fix(mv3): classify click postcondition mismatches

[cursor]

Close the red Manifest V3 click-diagnostic contract on PR #43 head 9c29a087.

Buyer-visible gap

A failed real-click post-condition still interpolated page-controlled WebDriver element text into RuntimeError. That text is untrusted page data and must not enter runner exceptions, trial evidence, or logs.

What landed

• _exercise_real_click now raises only real click post-condition mismatch.
• Doctoring records W3C WebDriver Get Element Text as page-controlled data (APA 7th).
• CHANGELOG notes the classified mismatch token.

Evidence

• Observed the exact-head Rust-contracts failure: the new contract expected real click post-condition mismatch and received interpolated fixture text.
• Local python3 -m unittest discover -s tests -p 'test_*.py' — 154 passed, including test_mv3_click_diagnostic_contract.

Next action

Do not merge PR #43 on 9c29a087. Use this successor for the production classification, then re-run Rust contracts on the new head. Keep HTTP #37 and reserved MV3 drafts #49/#56/#59/#60/#61 off this runner.

  

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[cursor]

Stale comment

Review — exact head 5f5d0e60a78582ba0bd7e24853b25396d04cec66

This successor closes the red click-diagnostic contract from #43 9c29a087 and adds the missing doctoring/CHANGELOG that #43 e129c28 still lacks: W3C WebDriver Get Element Text is page-controlled data, and a mismatch retains only real click post-condition mismatch.

Exact-head evidence already on this PR: Rust contracts success, Production coverage success, Pinned Chrome for Testing MV3 fixture success. Remaining SAST, security, Strix, and review workflows were still queued at this read and are not promoted.

The production classification now also exists on #43 e129c28. Unique value here is the APA 7th WebDriver citation plus the changelog line. If #43 remains the merge vehicle, cherry-pick those docs onto test/mv3-downloads. If this PR remains the landing, close #43 after merge so the downloads lane has one head. Do not open a third downloads pull request.

Do not merge until remaining required checks are green on this exact head. This actor does not approve or merge. Keep HTTP #37 and reserved MV3 drafts off this runner. Chrome-permission isolation stays on #175.

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Verdict

Exact head 5f5d0e60a78582ba0bd7e24853b25396d04cec66 closes the click post-condition leak. This identity cannot APPROVE its own pull request; treat the finding as a technical pass, not a counted approval.

_exercise_real_click now raises only the fixed token real click post-condition mismatch. Page-controlled WebDriver Get Element Text no longer enters the exception, trial evidence, or runner logs. Local tests.test_mv3_click_diagnostic_contract passed on this head. CHANGELOG and doctoring record the boundary with the dated W3C WebDriver Recommendation (APA 7th).

CodeRabbit CLI 0.7.3 is installed here, but coderabbit auth login --agent timed out (authentication_failed). This review is from exact-head inspection, not CodeRabbit.

Already green on this head: Rust contracts, Production coverage, and Pinned Chrome for Testing MV3 fixture.

Next action

Merge #176 only after the remaining required exact-head checks on 5f5d0e60 succeed. Do not merge predecessor #43 on 9c29a087. Keep HTTP #37 and reserved MV3 drafts #49/#56/#59/#60/#61 off this landing lane. After #176 lands, continue issue #27 from the next unpublished matrix row (Chrome-permission isolation remains #175).

  

_{Sent by Cursor Automation: Fix Issues}

[seonghobae]

Superseded by the existing canonical MV3 downloads owner, PR #43. I preserved every unique valuable change from this branch on #43: the fixed click-mismatch diagnostic, the refined runner docstring, the CHANGELOG entry, and both WebDriver doctoring additions. Exact PR #43 head cbd5d8cf3b18036c1ca0368761e232a158e71f11 and this PR head 5f5d0e60a78582ba0bd7e24853b25396d04cec66 now point to the identical tree 1f4b1bf73f707fa89a0e37448d28bba0ecece774; keeping both PRs open would duplicate the same production state and split the existing #43 MV3 stack.