test(browser): require sampled Chromium process-set termination evidence

[seonghobae]

Partial implementation of #28. Current head is 3c0c5c363c2da0b4e8a621226e2f7766c735b743, an ordinary two-parent integration of prior child 09f2e087d0c20fe81386c18099e739a9e611a8ad and current #143 44fd9a450f864feff5cf2ba2883425a71ba10b9b.

Buyer / reliability boundary

Controlled Chromium is multi-process. Root exit alone cannot prove renderer, GPU or utility exit. This Draft captures a bounded set of sampled process IDs, matches the root to its expected PID/start-time identity, binds still-live descendants to start times observed during later capture, and requires those retained identities to exit before success. Profile cleanup and browser-task success remain separate evidence.

Test-first parent adoption / current local proof

The previous head passed 194 Python contracts but collected only three of the five failure-path contracts now owned by #143. The expected-five assertion failed before integration. Read-only merge-tree reproduced a CHANGELOG-only conflict. The ordinary merge retains both failure-path and expanded success-path release records and carries the parent's behavioral regression unchanged. The production runner and child process-set test are byte-for-byte identical to the previous child.

The integrated tree passes all five focused failure-path contracts, all 196 Python repository contracts, compileall, Rust 1.97.1 formatting, workspace/all-target check and tests, strict Clippy, rustdoc, and pinned-nightly owned-production coverage enforcement. Coverage is 100% of 415 functions, 3,555 lines, 4,444 regions and 476 branches. Local success is not hosted or browser-runtime acceptance.

Current exact-head hosted CI 33956094018 and Manifest V3 Compatibility 33956094011 are queued, not GREEN. The previous child-head runs 33916685294 and 33916685137 were cancelled. No old-head result transfers to the integrated head.

Informational review / measured limits

Controlled probes of the real helpers on unchanged production source established:

• Descendant start times are captured after the lineage snapshot. A PID reused during that gap can bind an unrelated live process and conservatively fail the trial. The probe requires a still-live reused identity to time out as false; it does not claim immutable descendant ownership at the earlier snapshot.
• The root waiter and process-set waiter each have a bounded deadline. A surviving root can consume both budgets; a fake-clock 2-second + 2-second probe records 4 seconds. One shared deadline applies within the set waiter, not globally across both calls.
• Eight absent/live combinations of three descendants preserve exited-count plus retained-count equal to sampled-count, with the retained root excluded from exited-count. The upper bound is a defensive evidence invariant, not independent statistical proof.

All three informational threads are resolved; this is not an eligible formal approval. No production timeout, workflow or quality gate was changed.

Historical provenance — not current acceptance

Test-only d20fd0f0d02e4c9d58a5c471b25b13e82d9ddac3 established the original missing process-set contract. Earlier non-force integration 5ed8fb140f031fbc637175169fd7796692e6d6c3 on then-parent 452927dd0c6040fc7814b277e553ce6eff9e1479 had successful CI 32606913420 and compatibility 32606913450; those results do not transfer to the current head or prerequisite.

Authority / next dependency

Keep this PR Draft while its prerequisite is unprotected and hosted acceptance is pending. #145 separately owns late-failure process-set evidence and must adopt this current parent without losing its child delta. Current hosted checks, live rules and eligible independent approval remain separate requirements.

This scope does not establish cgroup/task ownership, processes appearing after sampling, cross-platform supervision, authenticated Chromium/ChromeDriver provenance or OS-wide orphan absence. No protected merge, self-approval, bypass, force-push, workflow/ruleset/secret mutation, tag, release or publication is included.

Instrumentation limit: a fresh report from the pinned cargo-llvm-cov 0.8.6 branch data emits warning: --branch option is unstable. The repository's four-dimension numerical coverage verifier passes, but the instrumentation is experimental and this is not warning-free measurement or release acceptance. The warning is recorded, not suppressed or bypassed; Rust compiler/Clippy/rustdoc results remain separate.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 3 potential issues.