Repository navigation
[Defect] tab_handle_refresh can return an unattributed blank target without cleanup proof #175
Description
Expected behavior
tab_handle_refresh with repairPolicy=open_if_missing must return a caller-bound service tab handle plus explicit proof that no duplicate or peer cleanup was attempted. A consumer must be able to distinguish safe reuse from incomplete or cross-caller adoption.
Observed behavior
On Agent Browser 0.28.0, refresh of a released Books Receipts handle returned success with decision reused_compatible_target and reused an about:blank target whose retained trace belonged to another caller. The response omitted the required duplicateCleanupAttempted: false proof, so the Books Receipts driver failed closed with tab_handle_refresh_cleanup_unexpected.
Service job: mcp-service-request-tab_handle_refresh-7516ee13-3808-445d-8e5b-c39218e49fbb.
Terminal effect state: verified_effect.
No BILL transaction or accounting effect occurred.
Bounded reproduction
- Start one retained shared-profile browser.
- Persist a valid service tab handle, then release its exact physical tab.
- Call
tab_handle_refreshon the persisted handle withrepairPolicy=open_if_missing. - Observe selection of an unattributed compatible blank target and an incomplete refresh response.
- A strict consumer requiring caller identity and explicit no-cleanup proof refuses the returned handle.
External-effect posture: No live effect required. A targetless service fixture can reproduce this contract drift.
Activity
ecochran76 commentedon Sep 17, 2026
Plan 0207 is admitted for provider-free repair planning.
Accountable owner: @ecochran76
Product lane: PL-BUGFIX
Branch:
fix/p207-tab-handle-refresh-custodyPlan:
docs/dev/plans/0207-2026-09-16-tab-handle-refresh-custody-repair.mdSource baseline:
2632e31ce34e62873598088d0c92c498357aafe2Bounded outcome: make
tab_handle_refreshreuse only caller-bound compatible targets, preserve canonical caller attribution, and return explicit no-cleanup proof. Foreign or unattributed peer targets must remain untouched.Known overlaps: PR #157 owns pending generated service-request and documentation changes; P205 owns Service-model extraction. P207 will keep the first repair packet in the browser-lifecycle adapter and tests, then reconcile public contract files after the shared checkpoint. No browser, provider, credential, installed-runtime, production, or release effect is authorized.
ecochran76 commentedon Sep 17, 2026
P207 durable plan published.
fix/p207-tab-handle-refresh-custody2e1b1d4d798736b39d47a629859a37bfd4aadace52c06647docs/dev/plans/0207-2026-09-16-tab-handle-refresh-custody-repair.mdecochran76 commentedon Sep 17, 2026
P207 source repair is published in draft PR #184.
Implementation checkpoint:
c3d69f3eQualified evidence:
tab_handle_refreshRust tests pass, including caller-A versus caller-B blank-target rejection, durable canonical replacement readback, and peer-preserving duplicate selection.Targeted browser acceptance remains blocked before Chrome launch: both disposable attempts returned
stock_chrome_capability_selection_failed: no_matching_preference_bindingbecause the isolated Service State lacked a reviewed stock-Chrome preference binding. Both attempts cleaned up; no Chrome process or external effect occurred.The issue remains open and PR #184 remains draft until that exact isolated capability-registry prerequisite is supplied and targeted browser acceptance passes.
ecochran76 commentedon Sep 17, 2026
Real-browser acceptance now passes at
838b771a. The disposable stock-Chrome smoke exercised exact stale-target close, canonical replacement persistence, peer survival, and cleanup. Draft PR #184 is ready for review; full CI remains intentionally excluded.