fix(browser): prove exact crash-root termination before crash credit

[seonghobae]

Partial implementation of #28, stacked on exact PR #148 head a249607ea2ab0ca23740dad90f8a2e67b9fa8fb2.

Falsifiable defect

The controlled browser-crash lane previously credited browser_process_crash_detected = True after SIGKILL by waiting for a generic WebDriver URL probe to fail. That boundary could mislabel an unrelated ChromeDriver/transport failure as direct browser-process crash observation. The first attempted contract then exposed a deeper Linux lifecycle problem: polling /proc/<pid>/stat for disappearance is not an exact termination proof before parent reaping, because a killed child can remain present as the same PID/start-time zombie.

RED -> RCA -> GREEN

1. The test-first contract requires crash credit only after the exact signalled PID/start-time identity is observed terminated, forbids generic WebDriver-exception credit, and covers stale identity, non-terminating signal, and killed-but-unreaped child behavior.
2. Exact pre-fix head 7e218fc56b1adb738e67c8c5869612afe8413a23 failed CI run 31768982111: all four focused exact-exit contracts failed because _signal_and_wait_for_linux_process_identity_termination did not exist. Its Manifest V3 Compatibility run 31768982105 also failed browser-crash recovery 0/3 while ordinary and forced-close Agent Task trials remained green.
3. RCA: _wait_for_linux_process_identity_exit polls procfs identity disappearance/reuse. A SIGKILLed child may already be kernel-terminated yet remain at the same /proc/<pid>/stat identity until its parent reaps it, so procfs lifetime cannot prove pre-reap termination at this boundary.
4. Current exact head 43d39197ab10be73a69c4a4816b51e893804d67f adds the smallest root-cause-changing authority: open a pidfd only after exact PID/start-time validation, revalidate the same identity, signal through that pidfd, and wait for that same pidfd to become readable under the existing bounded timeout. Crash credit is assigned only after that same-handle termination observation. The existing post-cleanup sampled Chromium process-set teardown remains a distinct recovery proof. CHANGELOG.md records that exact behavioral boundary, as required by repository policy.

Current exact-head evidence

At exact head 43d39197ab10be73a69c4a4816b51e893804d67f against exact prerequisite #148 head a249607ea2ab0ca23740dad90f8a2e67b9fa8fb2:

• CI 31773832003: success on the exact checkout SHA;
• Python repository contracts: 183/183 passed;
• Rust 1.97.1 formatting, locked workspace check/tests, strict Clippy, and rustdoc: success;
• exact owned-production function/line/region/branch coverage job: success;
• Manifest V3 Compatibility 31773831971: success on the exact checkout SHA with pinned Chrome/ChromeDriver 150.0.7871.129;
• ordinary Agent Task trials: 3/3 passed, including bounded semantic/action evidence, profile cleanup, browser-root termination, and sampled Chromium process-set termination;
• forced-close recovery trials: 3/3 passed, each with forced_close_detected=true, surviving-session proof, root/process-set termination, and profile cleanup;
• browser-crash recovery trials: 3/3 passed, each with browser_process_crash_detected=true, browser_process_terminated=true, chromium_process_set_terminated=true, and profile cleanup;
• the broader pinned MV3 fixture also completed 3/3 trials with every listed compatibility surface true;
• CodeRabbit exact-head commit status: success;
• no formal reviews or inline review threads are currently returned; and
• GitHub reports the PR mergeable against its exact prerequisite base.

The PR is Ready for review. Passing automation is not independent approval, and the scheduled actor does not merge or self-approve.

Truth boundary

This proves controlled Linux/pinned-Chromium crash evidence only. It does not claim cgroup/task ownership, discover processes created after the sampled set, prove OS-wide orphan absence, authenticate Chromium/ChromeDriver provenance, implement automatic retry or mutation reconciliation, provide cross-platform supervision, or turn this CI compatibility runner into a product browser API.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c7fa6bad-93ff-4f4b-9d46-a092bf03d0dc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}