fix(browser): retain forced-close teardown evidence on failure

CHANGELOG.md

@@ -6,6 +6,7 @@ All notable changes to OriginWeave are documented in this file. The format follo
 
 ### Added
 
+- Controlled browser trials reject malformed pre-shutdown exit counts, retain validated driver and cleanup outcomes after ordinary task failure, and report mid-request protocol failures without remote diagnostic text; failed trials remain failures, startup retries keep their existing narrow scope, and obsolete HTTP-body close signals are no longer accepted.
 - Failed controlled Agent Task runs now report whether their original browser process ended after shutdown, alongside temporary-profile cleanup; a failed task never becomes a pass merely because cleanup succeeded. If process observation itself fails, termination remains unproven. This covers the original browser process only, not all descendants or arbitrary browser recovery.
 - Controlled pinned-Chromium Agent Task success now binds the ChromeDriver browser root to its exact Linux `/proc/<pid>/stat` start-time identity, binds every still-live PID from the already sampled bounded Chromium root-plus-descendant set before shutdown, explicitly records descendants that already exited between the `/proc` lineage snapshot and identity capture, and fails closed unless every retained exact identity terminates after session/driver shutdown; root disappearance or identity change remains an error, PID reuse counts only as termination of the original identity, and this does not attest cgroup/task ownership, processes appearing only after the sample, or OS-wide orphan absence.
 - Failed ordinary and forced-close Agent Task browser trials now retain credential-free temporary-profile cleanup evidence after bounded browser errors, and separate aggregate compatibility gates require cleanup proof from every trial rather than filtering unsuccessful trials out; this does not attest adversarial filesystem erasure, process termination, or arbitrary browser recovery.

docs/doctoring.md

@@ -110,6 +110,14 @@ The #145 ordinary integration adopts #144 `3c0c5c363c2da0b4e8a621226e2f7766c735b
 
 Ten controlled probes of the actual browser-pass and outer-trial flows cover observed root/set exit, a surviving root, a surviving sampled set, a process-observation error, and interruption before a complete result in each lane. Session deletion and driver shutdown precede the applicable exit observations. Late ordinary failure retains observed true/false root and captured-set outcomes without becoming a pass; incomplete capture omits set evidence. Forced-close success requires both observations to be true. Successful cleanup commands do not establish that sampled processes are already dead: a surviving identity fails the trial. Forced-close interruption skips post-finally observers and leaves termination unproven, while observation errors produce only the bounded fallback error type. Private exception messages remain absent. These injected probes establish control-flow contracts, not live Linux/Chromium termination, and exact-head hosted compatibility is still required.
 
+### Reviewed cleanup-evidence regression repair
+
+PR #146 at `2553b66a5351c73d45cb99aa326e6314324ce480` passed 216 Python contracts while omitting the inherited pre-shutdown exit-count gate, dropping ordinary-trial driver/cleanup observations, and allowing mid-pass HTTP protocol exceptions to escape the bounded failure evidence. The closed-context recognizer also retained an HTTP-JSON diagnostic branch that its redacted request producer no longer emitted. Ordinary adoption of #145 `bb5e8f834c37f9ce35f84db8ed1146da3659d6aa` retains the parent failure-path regressions; a new five-test behavioral suite then reproduced ten assertion failures and seven uncaught protocol-error cases before the repair.
+
+The repair restores the existing non-boolean integer range check, forwards only known validated optional cleanup fields, removes the obsolete recognizer branch, and catches the existing HTTP protocol exception family at terminal browser/trial/aggregate evidence boundaries. It does not retry those terminal failures. The startup helper and its narrower recoverable-fault list remain unchanged: converting all request errors into a generic runtime error was rejected because it would also disable the existing recoverable startup retries. No new helper abstraction, provider, dependency, deadline, success exemption or workflow is introduced.
+
+The regressions execute the production success predicate, actual ordinary/forced-close browser-pass and outer-trial paths, and aggregate evidence generation with controlled faults. They check invalid counts, observed root survival, driver cleanup, early failure without invented identity evidence, private-message exclusion, and final rejection with the original trial denominator intact. Unknown fields are not forwarded and malformed known cleanup values are rejected. A sixth regression covers all three final aggregate exception boundaries and server teardown. Controlled tests do not establish live Linux/Chromium termination, cgroup ownership, OS-wide orphan absence or release acceptance; exact-head hosted compatibility remains mandatory.
+
 ## References
 
 Amazon Web Services. (n.d.). *Set up the Amazon EKS Pod Identity Agent*. Retrieved August 6, 2026, from https://docs.aws.amazon.com/eks/latest/userguide/pod-id-agent-setup.html