Gateway SIGTERM leaves orphan browser-vm-control-service

Part of #87.

Summary

Runtime keeps each Browser Engine and its profile lease until exact cleanup proves that native resources and writers have stopped. This task repairs gateway stop, crash cleanup and durable replay under the existing Browser contracts. Local Browser recovery belongs to #87; the full Browser mission belongs to #283.

Current checkpoint: accepted lifecycle proof; release verification open

PR #295's ownership repair is included in merged PR #307 (c1b99a62), which OMP integrated into the alpha.15 train. This issue retains its six accepted installed Mac criteria and the exact receipts below. #217 owns the current queued Linux x86 source/check record. That Linux service run is recorded in #217 (Close 13/13; reopen audio failed). Published Mac/Jetson and later Linux fault results retain their separate artifact bindings.

Author verification passed the final canonical pre-push gate: 2589 server tests passed with 27 existing ignored, 228 Runtime binary tests, 115 VZ library tests, 70 VZ supervisor tests and four stream-bridge tests passed. Formatting, product-data checks and Clippy passed. All ten required CI jobs passed at the same head; release publication was correctly skipped for this PR. The posted independent Opus review passed. Independent review also accepted the exact installed build and four Mac journeys.

The accepted installation binds Runtime SHA 53e389668fccc886402ecb1525afeab20edc298c8bbdb5876fcffbed74fb3f89 and composition f86171b87b40e11d3fbdd6d4849e329ce34a9b5cc399208806afcf85de67e8f2. Its 26 reused component bindings retain their actual producer origins. The journey harness is 60372c61cc9d7c3276ce8b8422b6f86b2f147680, tree 65947ba6c5bf28e3a96ae7dbffd63825d4e5a534. Normal navigation, decoded WebRTC frames, typed input, scroll and Close passed. Separate active Home stop, SIGTERM and SIGKILL runs completed all thirteen cleanup effects naturally within their predeclared 60000 ms bounds. Restart preserved all eight profile identity fields and committed cookie, localStorage and IndexedDB state, rejected retired actions and closed a distinct new generation. The reviewed runs ended with their owned processes and resources absent. Historical Reset evidence retains its tested 0d4493db source.

The first six criteria below are proven on the recorded Mac installation. PR #307 is merged. Required human approval and the fresh published-release record remain explicit gates for closure; merge/source tests alone do not extend these receipts to the newer release or Linux unit.

Historical evidence and exact receipt references preserve the previous body byte-for-byte, including earlier failures, their repairs and prior candidate proofs. Broader media, hardware, soak, Wallet, manual UX, confinement and profile qualification retain their owning issues and gates.

The steps below retain the original reproduction and expected ownership boundary.

Steps

Start tip Home gateway (e.g. localhost:61192); note gateway pid and any browser-vm-control-service pid under the models home.
kill -TERM <gateway-pid> and wait until the gateway exits (~600ms observed).
Inspect remaining processes for browser-vm-control-service (and guest browser-vm / crosvm if the image is installed).

Expected

All helper processes started for that Home/gateway stop with the gateway (or are explicitly supervised and reaped).

Browser mission installed cleanup gate (#283)

Lane: Installed product. Acceptance uses the exact candidate and installed evidence above.

A stable isolated installation binds source/tree, built and installed Runtime/helper hashes, matching image/guest inputs, manifest/capsule hashes and installation time. Image reuse follows verified compatible inputs; changed guest inputs require affected rebuild/verification.
Home → Browser → controlled page → decoded WebRTC frame → navigate/type/scroll → normal Close passes.
Separate graceful gateway stop and active gateway SIGTERM runs stop the exact owned control service, Engine helpers, VM and network/media processes within a numeric bound declared in the receipt before the test.
An abrupt gateway crash and restart exercise independent parent-death/orphan reclamation. Restart recovers committed profile state and rejects stale ownership/actions.
Every run proves page, child, VM, route, socket, transport session, TURN process/listener/relay ports, ordinary/media/bootstrap vsock bridges and hibernation state absent for this session. Other Homes remain outside the fixture's ownership.
Profile reopening preserves the committed state. Surviving owned processes after the declared deadline fail the run.
Required source regression/review and exact-candidate installed proof pass; the implementing PR is reviewed and merged before closure.

Browser ownership boundaries

This task establishes exact native observation, worker/TURN/profile lease lifetime, caller settlement and durable full-effect replay. Runtime retains the pending writer barrier until exact reconciliation permits reuse. #289 owns independent short operations and quotas; #292 consumes this task's local committed-profile result; #293 owns broader capacity and 100-cycle qualification.

Independent source review of prepared 29c0867 against 67c268c found no additional blocking finding. Helper lifetime: 4 passes; shutdown order: 2 passes; rootfs cancellation: 4 cases pass in isolated runs.
A controlled startup delay exposes a fixture timing race. A test-only correction uses the current interpreter and gives copy startup five seconds; production cleanup is unchanged.
Installed Mac acceptance remains open: matching Runtime, adapter and helper binaries are absent. The next gate is exact-candidate gateway/VM cleanup, profile preservation and reopen.

The parallel Browser lane is preparing a new isolated Mac cleanup fixture for exact source 29c0867; existing Homes and OMP fixtures keep their current owners.
The verified Browser image can be reused. Runtime and helpers need matching builds; the corrected 540164eb proof harness and explicit VM/socket/TURN isolation are required.
The Mac build lease remains with the #194 pre-push candidate. Browser will claim it only after that gate ends; target launch follows a verified fixture receipt.

Parallel Browser cleanup preparation is ready for installed verification. Product source remains 29c0867079b87d007c5205cace6fa073559c8390 (tree ff7a5f8f3c94eca72ff2226e58c6e3bf79bbbc11). The corrected journey harness is 540164eb548112e51066772f81e65ef932b9a770 (tree c27bb5d8f534cb2ea58578be932023fa5c02eb58). Both checkouts remain clean. Product source is 4 commits ahead and 28 behind fetched origin/develop; the harness is 2 ahead and 71 behind. Integration compatibility still needs review.

The private fixture selects a narrow Mac VZ build surface and reserves a separate stable Home, VM paths, sockets and TURN ports. It binds source trees, the existing image archive, the guest control helper and the journey harness. Future staging records built and installed binary hashes, the component manifest and capsule tree. Its preparation script is SHA-256 8d4117c416fbbfb0a6f55331513b5648d5ebb0b66663d72f3721273d23776b98.

Preparation validation: Python AST/help, configuration isolation, source/input hashes and authorization refusal pass. Four mocked cleanup regressions pass, including an exited Cargo leader with remaining children and retention of the shared build lease until the owned group ends. Independent review passes for private preparation after one cleanup correction. The normal build budget is 45 minutes; an exceptional surviving process group keeps the lease until cleanup succeeds. No Cargo build, image extraction, Home launch or VM launch occurred.

The installed gate remains open. AGENTS.md requires durable SSH before serious Mac testing. The current SSH configuration has no intended Mac staging alias. A read-only localhost check matched the local SSH host key, but existing credentials were refused in BatchMode. The temporary check file was removed and SSH settings remain unchanged. The Home, build target, extracted image store, build receipt and host-binding receipt are absent.

The recorded Browser journey covers normal close. This issue also requires a separate test that sends SIGTERM to the verified fixture gateway while Browser helpers and the VM are active, then proves bounded cleanup of those exact owned processes. This installed acceptance remains open. Next: verify the authorized Mac SSH host, claim the single heavy-build slot, build/stage the exact candidate, prove artifact parity, then run the Browser journey and active-gateway shutdown check. Future start and stop operations use the fixture’s recorded HOME/XDG values and clear inherited Browser settings. Existing Homes and OMP source checkouts remain unchanged.

Browser mission #283 has resumed at the existing cleanup candidate. Codex owns #131 source/receipt reconciliation and the proposed isolated Mac test. OMP retains its existing Home and release fixtures.

Passed: fetched origin/develop is 91ba79c. Product 29c0867 (tree ff7a5f8f3c94eca72ff2226e58c6e3bf79bbbc11) and harness 540164eb548112e51066772f81e65ef932b9a770 (tree c27bb5d8f534cb2ea58578be932023fa5c02eb58) remain clean. Product divergence is 103 behind / 4 ahead of develop; harness is 146 behind / 2 ahead. The Mac has 63 GiB available. Existing local work is preserved.

Failed prerequisite: localhost SSH matches the local public host key, but BatchMode authentication is refused. The intended staging alias is absent. The user has been asked for working staging access or an explicit exception for direct isolated testing, as AGENTS requires durable SSH.

Pending: the shared local-ai-heavy-build lock is held by OMP train/alpha9 at 7969517. Browser has started zero builds and zero Home/VM runs. Image reuse also needs the complete 922bd38a receipt and matching guest inputs: this candidate changes browser-native-proxy-engine, which is an image input. Hash equality alone will not establish guest compatibility. There is still no PR for this candidate.

Next experiment: reconcile the full image/helper receipt and preparation fixture, then use the single build lease for only missing or changed inputs. After staging access and artifact parity pass, run the ordinary Home/sign-in/page/decoded-frame/input/Close journey, followed by separate graceful stop, active SIGTERM, abrupt crash/restart, orphan reclamation and committed-profile reopen. Full #131 and B01–B16 acceptance remain open.

The preserved fixture preparation and rebuilt image have been recovered. The preparation script still matches its recorded SHA-256 8d4117c416fbbfb0a6f55331513b5648d5ebb0b66663d72f3721273d23776b98. The image archive matches 922bd38a1580ef88418da186bad1634cf1168cec473c1f2a2f355b1862de6dd3; its original build source is 7d710fb827b087ae5abfba2657b267b07700e51c, tree 3d4ae03a7ae12e83c6c6d87a1093f2ef18172898. The isolated Home, build target and extracted image remain absent.

Passed: 4 helper-lifetime tests, 2 shutdown-order tests and the 4 rootfs-copy cancellation cases. Product-data validation passes for 42 capsules, 8 profiles and 28 contracts; Runtime and chain-provider formatting and diff checks pass. The named legacy Home entropy script is absent on this candidate; the shipped replacement data/behavior gate was used and that difference remains explicit.

The previously reviewed test fixture correction is now local commit e6a3390, tree 31dda57a5a6acb6ae5cb1095ee70efa1db364753. It uses the running test interpreter and gives its fake copy process a bounded startup budget. Independent source review found no material issue. Production behavior remains the existing cleanup candidate. The branch is 103 behind / 5 ahead of fetched develop; it remains unpublished with no PR.

Pending installed proof: staging access/user exception, OMP's existing shared build lease, and compatibility binding between the historical guest image and this cleanup candidate. The selected Mac guest leaves the native-proxy EOF opt-in unset, so that new branch is inactive in the VZ journey; unchanged launcher/control/profile inputs are being checked before image reuse. Separate native-helper EOF proof keeps its own affected-binary requirement.

Next experiment: finish that scoped compatibility receipt and add an active-page fault checkpoint to the existing controlled harness. The current harness always reaches normal Close; it needs an exact-owned gateway TERM/KILL observation before Close for this issue. All installed, profile, media and human acceptance remain open. Browser has started zero heavy builds and zero Home/VM runs in this session.

The #131 cleanup candidate and test harness are frozen for the isolated installed experiment. Codex owns this Mac fixture; OMP retains its release sources and existing Homes.

Passed: product commit e6a3390293376428596c351536d08f290ab855e1, tree 31dda57a5a6acb6ae5cb1095ee70efa1db364753, remains clean and 103 behind / 5 ahead of fetched develop 91ba79c467cf9cae764d8ff3b76d7c08043e6081. Harness commit 2c54b41a7c49a8a0947460206af28ed20d38b87d, tree 57ee31826f00f7b492fa30b5d3571637604a0722, is clean and 146 behind / 3 ahead. Both are local candidates; their PR and integration gates remain open.

The harness now pauses after a decoded WebRTC frame, navigation, text, scroll and committed profile-write checks. It can send TERM or KILL to the verified fixture gateway while Browser is active. It binds process identity, installed hashes, served Browser bytes and the control socket. Fifteen current fault-harness tests pass. Independent review also passes for guarded preparation after corrections to stale-receipt rejection, configuration binding and owned-process cleanup. Four mocked build cleanup tests and three stale-receipt refusal cases pass. Exact source/harness, image compatibility and configuration hashes pass after rebinding. Earlier helper lifetime, shutdown order, copy cancellation, product-data and formatting gates remain passed. The requested legacy entropy script is absent on this candidate; its replacement data/behavior gate is recorded separately.

The recovered image archive is SHA-256 922bd38a1580ef88418da186bad1634cf1168cec473c1f2a2f355b1862de6dd3, from source 7d710fb827b087ae5abfba2657b267b07700e51c, tree 3d4ae03a7ae12e83c6c6d87a1093f2ef18172898. Its unchanged guest/control inputs permit the scoped Mac VZ owner-pipe experiment. The changed native-helper EOF branch requires separate current-binary proof. The private compatibility receipt is SHA-256 3180df8c9fa6cb934fb659076f6cd0e71aa613e930c23106f288cba87679e9f5; guarded preparation is 41ce0fb5a4c9e4931b28f9fcf68dc063783039a6c54bb0042c996c3059a0b905 and rebound inputs are 19a2c40fc61768fa598bc6c153ff17e0305395701743a7b4c1de777f612b4c96.

Failed prerequisite: localhost staging SSH authentication is refused. The requested working alias or explicit direct-local exception remains pending. The shared build lease remains idle; Browser has started zero heavy builds and zero Home/VM runs. At 18:07 UTC disk has 58.72 GiB free. The required 10% reserve is 46.04 GiB. Conservative build/stage growth is 14 GiB, requiring at least 60.04 GiB free; the full journey growth budget is 22 GiB, requiring 68.04 GiB free unless the APFS clone is proved and full-copy fallback is constrained. Those budgets include the expanded image and affected release output/cache growth. The fixture now refuses build before lease/cache/output writes if its budget consumes the reserve. Independent review and current-volume/boundary refusal checks pass. The isolated installation is absent. Existing owners retain their artifacts; read-only reconciliation found no large reclaim candidate with complete owner and lifecycle proof.

Pending installed acceptance: ordinary Home/sign-in/page/frame/input/Close, separate graceful stop and active TERM/KILL, restart, stale-action rejection, orphan cleanup and profile reopen. Process disappearance alone keeps all 13 cleanup effects pending in the new harness; it cannot report full acceptance from that partial result. All B01–B16 hardware, media, soak, human-review and approval gates remain open.

Next experiment: resolve staging access and secure the recorded disk budget, build only missing matching host artifacts under the shared lease, then stage the compatible image with reviewed artifact parity. Run the ordinary journey first, capture its first failure and repair that component before repeating and running the fault cases. Preparation continues independently while the staging decision is pending.

The user selected this Mac and Jetson for Browser tests, with installed Namespace tools for Linux x86 work. The isolated #131 fixture now uses direct local Mac execution. Its private receipt records that user-selected scope and the current host identity; its authorization check passes without representing SSH proof. Independent review passes, including rejection cases. Existing SSH configuration and credentials remain unchanged.

Product remains e6a3390293376428596c351536d08f290ab855e1 / tree 31dda57a5a6acb6ae5cb1095ee70efa1db364753; harness remains 2c54b41a7c49a8a0947460206af28ed20d38b87d / tree 57ee31826f00f7b492fa30b5d3571637604a0722. Both are clean local candidates with PR/integration gates open. Earlier source and harness proof remains passed.

Passed target access: Jetson SSH works. That account sees KVM but needs device permissions and crosvm before a Browser VM test. The existing Namespace pilot is Ubuntu 24.04.3/x86_64 with read/write KVM access and 47.34 GiB free. Its clean source is ecda431dd194ce073072031a027cdf5b233d56ba, tree 5ec6cd29bf1e6a6500d70c042768e2f997338a23, 522 behind / 0 ahead of current fetched develop. Its prior proof covers source gates only. New Linux testing needs a current candidate and scoped owner; the closed #114 adoption decision and paid-plan boundary remain unchanged.

Mac capacity hold: the guarded build still preserves the 10% reserve with 14 GiB build/stage and 22 GiB journey growth budgets. Read-only reconciliation has identified two inactive historical producer rootfs outputs totaling 16 GiB. Current hashes match their original receipts and retained compressed restoration packages. Their source commits are protected by fetched refs. Open-file, VM-process and installed/config reference checks pass. Only those exact raw output files are candidates for removal; their source, archives, receipts and remaining artifacts retain their owners.

Next experiment: record the retention evidence privately, reclaim the two recoverable raw output duplicates and measure actual free space. Then claim the shared lease for one narrow matching host build, stage the reviewed image and run the ordinary Home/sign-in/Browser/page/frame/input/Close journey. Capture its first failure before any repair or fault experiments. Browser has started zero builds and zero Home/VM runs; all installed and B01–B16 acceptance remains open.

#131 is ready for one bounded matching Mac build. Direct local execution uses the user-selected Mac scope. Product is e6a3390293376428596c351536d08f290ab855e1, tree 31dda57a5a6acb6ae5cb1095ee70efa1db364753; harness is 2c54b41a7c49a8a0947460206af28ed20d38b87d, tree 57ee31826f00f7b492fa30b5d3571637604a0722. Source remains 103 behind / 5 ahead, harness 146 behind / 3 ahead of fetched develop. Both are clean, local and awaiting PR/integration proof.

Passed: full offline locked dependency metadata for all seven planned workspace/provider surfaces, real Rust 1.91/toolchain and Apple compiler checks, fresh-install receipt/launcher contract review, direct-local host binding, guarded preparation review and disk-refusal checks before launch, during an owned child and after successful child exit. Four existing lease/group cleanup regressions still pass. Earlier product/harness gates remain passed.

Capacity reconciliation removed only two hash-verified, recoverable historical raw image duplicates and an accepted, inactive source-test Cargo target. The raw files shared APFS extents and freed about 1 MiB; the source-test cache freed 1.998 GiB. Canonical source, archives, receipts, dirty worktrees and OMP state are preserved. Measured free space is 60.85 GiB, above the 46.04 GiB reserve plus 14 GiB build/staging budget. Full journey space remains a separate gate because the default VZ rootfs copy can fall back to 8 GiB copying.

The build will clone an existing matching Rust 1.91 release dependency cache into a private cache under the shared lease. Cargo will validate fingerprints and rebuild current package outputs. The original cache and its dirty source remain preserved; it supplies dependency inputs, not candidate binaries. New growth is bounded at 4 GiB with at least 1 GiB working margin above the reserve. Disk checks run before child creation, during the wait and after exit; failure retains the lease until the owned process group is gone. The normal time budget is 45 minutes with two Cargo jobs. Reviewed preparation SHA-256 is 4ef81bed7e0c4a1a8808e1d74657c303b6a2fc0535cce3d9f9b5bdaabb83f5b7; inputs are 3e2577f40f2d6412ac8d579e302fe2996c39e43d1c643e36b99c042e6856396a.

Next experiment: claim the idle lease and build the narrow matching host surface once, then validate built/installed hashes and stage the compatible image. Source tests remain separate from installed acceptance. Secure full default-copy capacity before Home/sign-in/Browser/frame/input/Close, then capture the first runtime failure. Existing Jetson/Namespace access evidence stays scoped to capability; their installed Browser proof is pending. All B01–B16 gates remain intact.

Build execution update (19:01 UTC): The isolated #131 build owns the shared lease from 18:55:49 UTC. Cargo has reached the Runtime, VZ and localhost-provider workspace binaries. The private seed remains separate from current outputs; the old cache and five dirty source files are preserved. Free space is 61.68 GiB and the disk guard remains within budget. The build receipt is pending; Home/VM runs remain zero. Further capacity reconciliation continues read-only while this single build runs.

19:07 UTC execution update: the #131 build still owns the shared Mac lease. The Runtime, VZ helper and localhost provider build steps completed, and Cargo is compiling the Browser Engine Adapter. Removing three inactive debug caches recovered 9.44 GiB; their source checkouts, receipts and the release cache seed remain intact. Available space is now 70.75 GiB. The build guard measures net volume use against its fixed free-space floor. This reclaim also supplies capacity for the default per-launch Browser image copy. Installed Home and VM proof remain pending until the build receipt and installation parity checks pass.

19:10 UTC build result: PASS. The single two-job release build completed at 19:07:31 UTC with ten hash-bound native binaries, source e6a3390293376428596c351536d08f290ab855e1, tree 31dda57a5a6acb6ae5cb1095ee70efa1db364753, and frozen input SHA-256 3e2577f40f2d6412ac8d579e302fe2996c39e43d1c643e36b99c042e6856396a. The build lease has returned. Available space is 70.06 GiB against a 46.04 GiB reserve; the 8.11 GiB verified image extraction and one default 8 GiB launch copy fit with working margin. Next: claim the same lease for isolated installation, verify installed hashes and receipts, then run the controlled Home-to-Browser journey. Product and fault acceptance remain pending.

19:12 UTC first installation failure: source_capsule_archive_identity. The Runtime installer rejected the inherited WalletConnect projection record: it carries a source entrypoint hash and an archive release path, while this narrow fixture had selected the Wallet projection without its WalletConnect companion. The failure was captured before Runtime installation or image extraction. Native build evidence stays valid. Next experiment: include and source-stamp that small companion projection in the isolated fixture, repeat the installer parity check, and continue staging from the preserved failure. This repair needs no new Cargo build.

19:15 UTC source reconciliation: another worker advanced the fetched develop ref to d96e01e61dd3e30df31f87d31bc7d6d639d97393. The unchanged isolated source is now 125 behind / 5 ahead; the harness is 168 behind / 3 ahead. Compatibility and integration remain review gates. Independent verification passed for every built binary and the original input/image bindings. The controlled experiment will use the existing journey harness and an exact localhost fixture grant in both Exit consumers. Reserved TURN listener/relay ranges are already installed correctly.

19:19 UTC isolated installation result: PASS. The companion projection was source-stamped, and the Runtime installer accepted the final manifest. The installed Runtime equals its built SHA-256 917f279131b63d2a1c1b0f3e48127aa3492004978153b5b4bed6111696581d2d; final components SHA-256 48e878f061dd79ec74f085f7095c2ce74608a0f4f998e53b32c1758d5538b071. The VZ helper retains separate unsigned-build and final signed-artifact provenance. The verified four-member image was extracted and linked with guest-control parity. Source-root init dry-run passed. Available space is 61.75 GiB, which covers a 9 GiB default launch allowance above the 46.04 GiB reserve. Next: actual init/health and served artifact parity, then Home sign-in and the controlled decoded-frame/input/Close journey. Human UX, product media and fault recovery remain pending.

#131 installed candidate checkpoint — 19:22 UTC

Passed: the single release build and independent ten-binary hash review; repaired source-home manifest installation; image member and guest-control parity; actual source-root init; HTTP 200 with built/installed/served Home hashes equal; installed-provider verification for all eight fixture providers/helpers. Source stays clean at e6a3390293376428596c351536d08f290ab855e1 / tree 31dda57a5a6acb6ae5cb1095ee70efa1db364753. Harness stays clean at 2c54b41a7c49a8a0947460206af28ed20d38b87d / tree 57ee31826f00f7b492fa30b5d3571637604a0722. Image reuse stays bound to 922bd38a1580ef88418da186bad1634cf1168cec473c1f2a2f355b1862de6dd3 and its reviewed historical guest inputs.

Failed, then repaired: the first installation rejected an inherited WalletConnect archive/source identity conflict. The isolated fixture now includes that same-source companion projection and source-stamped manifest. Its first failure log, original native build receipt, signed helper provenance and exact controlled-fixture config deltas remain retained. Cargo was run once.

Pending: controlled Home sign-in → Browser → page → decoded WebRTC navigation/type/scroll → scoped Close; active gateway TERM; crash/restart; orphan cleanup; profile reopen; all thirteen terminal effects; hardware/media/soak/human review and integration gates. The shared Mac lease is idle and there is one isolated test owner. The next run will hold it for bounded VM proof, retain the first failure, and stop the owned Home and test processes afterward.

Refs: fetched develop is d96e01e61dd3e30df31f87d31bc7d6d639d97393; source is 125 behind / 5 ahead, harness 168 behind / 3 ahead. Both candidates remain unpublished; PR/integration work is pending. Next experiment: the existing controlled journey harness against the installed candidate, with fresh isolated passkey/profile state and a precise local Exit grant. #283 B01–B16 and all 70 stable criteria remain preserved; full acceptance stays open.

19:23 UTC lease admission: the controlled VM run correctly stopped before launch because another local worker had acquired the shared lease for Runtime setup tests. Its owner remains untouched. The idle isolated Home was stopped cleanly while that work completes. Actual init and served artifact parity passed; Browser page/frame/input proof has yet to start. Next: acquire the lease after the current owner releases it, restart the same receipt-bound fixture, and run the one bounded controlled journey. This admission hold creates no additional build.

19:25 UTC execution update: #131 acquired the released shared lease and restarted the matching isolated Home. The controlled journey is now running. Independent final verification passed for all native bytes, the signed VZ entitlement, all four image members, the capsule tree and every installation/config receipt. The first installation failure remains retained. Next observation is the first actual Home/Browser journey result; its owned cleanup stops the observer, fixture server and Home.

19:29 UTC first installed Browser failure: Home sign-in, sign-out, sign-in again and Browser launch passed. The VM launch then failed with vz_invalid_configuration: its storage attachment was invalid. Browser Close remained pending on the failed launch's Runtime ownership. The control journal retained a bound terminal_post_effect_cleanup settlement; that is evidence to inspect, rather than full thirteen-effect acceptance. The owned observer and controlled server stopped, and source-home shutdown returned zero. Decoded frames, input and scoped Close remain unproved. Next experiment: inspect the private rootfs permission/copy contract and VZ storage attachment, repair the smallest responsible preparation or host component, then repeat the same journey using the existing binaries.

19:38 UTC smallest source repairs: the copy probe confirmed that the host's per-launch clone preserves a read-only seed mode, while Browser requests a writable disk. The VZ helper will make only its owned launch copy writable and preserve the source image. The separate live Close defect is a producer field mismatch: native VZ effects.vm is a conservative may-have-acted marker, but control copied it into outer vm_acquired. Both accepted consumers correctly require no acquired Engine page/VM binding for this terminal pre-readiness receipt. The control producer will validate and project new and retained exact settlements without changing the raw evidence or consumer checks. Tests and independent review will precede one cached helper build. The existing Runtime, provider binaries and image can be reused where their complete inputs still match.

19:43 UTC repair checks: product-data, workspace/provider formatting, diff checks and all 31 shutdown/Close regression tests pass. Independent review caught a failed-clone fallback case; the VZ fix now removes only the owned partial destination before copying and sets that launch file to mode 0600. Its read-only source stays unchanged. The control producer repair also covers the retained exact journal through a response projection, so the existing failed-launch obligation can reconcile without deleting evidence. The source changes and Rust regression are still pending the final reviewed candidate and one-target build. Legacy Home/Browser entropy script names are absent in this branch; current product-data checks passed, while the product objective audit still requires accepted media and manual UX proof.

The next isolated Mac candidate is beab28b59dc6b3066789ce2b3bf8e2dd0ce31c4c, tree cba7f06c15253e806469731b539416f916041bc6, on fix/131-browser-helper-orphan. It contains two new reviewable commits: 73f7be93 makes the owned launch copy writable while preserving the immutable image; beab28b5 projects exact terminal native cleanup into failed-launch acquisition state and preserves retained journal evidence. Independent source review passed for both repairs. The candidate is 125 commits behind and 7 ahead of fetched origin/develop@d96e01e6; compatibility with that integration line remains open. Nothing was pushed.

Passed: the settlement regression smoke, JS and shell syntax, product-data/public-copy gates, Rust formatting, diff checks, and 31 shutdown/Close checks. The original installed run passed Home sign-in, Browser launch, explicit Engine selection and address submission before failing at VM storage attachment. Its observer, controlled fixture and Home were stopped. The verified image and nine matching native binaries remain reusable with their original provenance.

Failed: the first installed journey has no decoded frame, input, profile-write or normal Close proof. An additional general control-service smoke expected an immediate malformed-output error and instead received the unchanged launcher's timeout result. Source comparison confirms that parser predates these repairs; this check remains failed and is not counted as a pass.

Pending: one cached VZ-only regression/build under the shared lease, composed installed artifact verification, retained failed-launch reconciliation, then the repeated controlled journey and active gateway TERM/crash/restart, orphan and profile proof. Full 13-effect cleanup, product media, human UX, hardware, soak and approval gates stay open. The next experiment reuses the image and Runtime/provider artifacts, installs only the changed VZ and control helpers, and records exact hashes before running Home → sign-in → Browser → controlled page → decoded WebRTC frame → navigate/type/scroll → Close. Test targets remain this Mac, Jetson and the existing Namespace pilot. The public server is outside this run.

19:58 UTC update: the single VZ regression/build passed in 3 minutes 11 seconds. The writable-copy regression passed, then the release helper built successfully. Unsigned helper SHA-256 is 8a5b6877ca466fe04acc78cc509d52864766859fc2e03c7ef820b6cf34456d0d; build receipt is 6c9cc49bc19754736ab4a70698908d93c7cb710e6ca051cfd757e5d172bf084d. All ten original binary hashes stayed unchanged. The shared lease is released. The reviewed composed installation is next.

20:05 UTC update: composed installation passed. Signed VZ helper SHA-256 1861b3771af7bc6ec2f39538e90fe75eeba50cc61ccc5e213fd9e91cb6bad25c matches the installed helper; all executable sections match the unsigned build and strict signing verifies the isolated development entitlement. Installed control JS matches source SHA-256 70431f19ccd4beaa712867ab449bec2d75bfc9ef0a1743fc0f168ffd0b4b37e6. Composed receipt SHA-256 is 655e9e7c188d648b3b7fe53f57c25113cd8d1a8b45cb0b5dfc1db1db4a5f59ac. Nine native artifacts retain their e6 source provenance and unchanged bytes; components, capsules, configurations, profile and image are retained. Old receipts and the failed-launch journal are preserved. The next owned run includes init dry-run/start, retained-launch recovery and the repeated controlled journey.

20:07 UTC update: normal-02 is running under the shared lease after independent install/runner review. It uses the clean beab28b source, frozen 2c54b41a harness, exact composed artifacts, a fresh controlled profile marker, and bounded owned cleanup. Init/recovery and decoded-frame/input/Close results are pending.

20:08 UTC update: independent installed composition review passed, including all 276 capsule files. Normal-02 passed init/start and the retained failed-launch reconciliation record was removed by Runtime recovery. The run then stopped at the private parity probe because Python urllib did not follow Home’s HTTP 308 redirect; Browser was not launched. Observer/fixture groups are absent and owned Home stop passed. This harness failure is retained. The next run uses the canonical Home front door for the parity probe, with the same installed candidate and a fresh profile marker. No source rebuild is needed.

20:10 UTC update: normal-03 reached the canonical HTTP front door, then stopped at another private parity-guard error: the guard used the wrong installed Home file path. The correct Home browser projection was checked against source before the next start; both SHA-256 values are 9e10a1191102a3d15ea8d6f2fd67da722817760643999b8874fb470f6176a4bf. Browser was not launched in normal-03, and owned Home stop passed. Both guard failures are retained. Normal-04 corrects the guard path and adds its file check before starting Home; it uses the same source and installed artifacts.

20:11 UTC update: normal-04 stopped at the redundant private parity guard before Browser launch. Source inspection shows the canonical installed Home document is /home/; the restart owner had already proved HTTP 200 and equal source/installed/served SHA-256 9e10a119… in this run. The extra guard fetched a different root document. Normal-05 consumes the fresh matching restart receipt and uses the source-defined Home route. All three private guard failures remain recorded; each owned stop passed, and no rebuild or VM launch occurred for them.

20:14 UTC update: normal-05 passed sign-in, sign-out/sign-in, credential/public-copy checks, Browser launch, Engine selection and controlled address submission. The actual per-launch rootfs is private mode 0600 and writable; the immutable base remains unchanged. The test is waiting for page readiness/first decoded frame within its existing deadline.

20:19 UTC update: normal-05 failed at guest Browser control readiness after 122.6 seconds. VM start and validated transport bootstrap completed; guest control connections reset before a page could open. Host/guest control port bindings match. TURN start/listener readiness passed. Exact terminal native cleanup reports all ten absence fields true, and control shutdown reports zero owned launcher children. Observer/fixture group stop and owned Home stop passed. Frame/input/profile and full 13-effect acceptance remain pending. The underlying guest startup error is absent from the saved logs, so the next experiment adds a bounded private stderr capture to the same fixture and repeats once. It preserves source, installed helper hashes and the image; it needs no build.

The current installed Mac candidate is beab28b59dc6b3066789ce2b3bf8e2dd0ce31c4c, tree cba7f06c15253e806469731b539416f916041bc6, on fix/131-browser-helper-orphan. The independent install review passed. The candidate remains 125 commits behind and 7 ahead of fetched origin/develop@d96e01e6; compatibility and publication are pending. Harness 2c54b41a7c49a8a0947460206af28ed20d38b87d, tree 57ee31826f00f7b492fa30b5d3571637604a0722, remains clean at 168 behind and 3 ahead.

Passed: the writable-copy VZ regression and release helper build; settlement regression, syntax, product-data/public-copy, formatting, diff and 31 shutdown/Close checks; strict fixture signing and installed helper parity; all nine reused native binaries, components, configurations and 276 capsule files unchanged. The repaired installation recovered the original retained failed launch. The actual controlled run passed Home sign-in/out/in, Browser launch, explicit Engine selection, address submission, writable private rootfs, VM start, validated transport bootstrap, and TURN listener readiness.

The new failed startup closed correctly: Runtime returned terminal no_page at 92 ms, Browser detached at 94 ms, and session/cleanup/reconciliation obligations returned to zero. Native terminal proof reports all ten absence fields true. The observer, controlled fixture and Home stopped. This is failed-startup cleanup proof, not full acquired-page or 13-effect acceptance.

Failed: the controlled page never opened. Guest Browser control stayed unavailable and timed out after 122.6 seconds; the last vsock connection reset by peer. Ordinary relay EOF warnings do not establish the guest's cause. Three private parity-probe errors were retained; none launched a VM or caused a rebuild. The general malformed-stdout smoke remains failed against its unchanged timeout behavior.

Exact artifacts: original image archive 922bd38a1580ef88418da186bad1634cf1168cec473c1f2a2f355b1862de6dd3 from 7d710fb8; new unsigned VZ 8a5b6877ca466fe04acc78cc509d52864766859fc2e03c7ef820b6cf34456d0d; signed and installed VZ 1861b3771af7bc6ec2f39538e90fe75eeba50cc61ccc5e213fd9e91cb6bad25c; source and installed control helper 70431f19ccd4beaa712867ab449bec2d75bfc9ef0a1743fc0f168ffd0b4b37e6; composed installation receipt 655e9e7c188d648b3b7fe53f57c25113cd8d1a8b45cb0b5dfc1db1db4a5f59ac; active Runtime receipt cbf0717f423f2e07530e7bc693ee09292a3085a69e758d25993ebfb394d96d5b. Original source provenance and frozen receipts are retained.

Next experiment: enable the existing private VM console log and capture at most 1 MiB of native stderr in the isolated fixture, then repeat once with the same image and installed helpers. The passive capture check preserved stdin/stdout/stderr. This gives the guest startup cause before another component change; no build is planned for this diagnostic run. Then repair that component and repeat the complete page/frame/input/Close journey, followed by active gateway TERM, crash/restart, natural orphan cleanup and profile reopening.

Pending: M1 acquired-page evidence, all 13 cleanup effects, active fault/recovery/profile proof, M2 signed delivery/update, media, hardware, soak, human UX/review and approval gates. The producer review identifies #217's complete Mac image/helper closure as the next M2 output for the current #89/#274 release owner. The accepted #246 staging output still needs Browser image admission/update integration; source presence does not prove normal Browser delivery. The run stays within this Mac, Jetson and the existing Namespace pilot. All B01–B16 criteria remain unchanged. Work continues after this report.

20:25 UTC update: another release owner holds the shared Mac lease. The diagnostic fixture stays stopped while that work runs. The passive capture success and injected I/O-failure checks passed, and independent review confirmed that capture failure preserves native child ownership. Read-only guest/producer checks continue; the next VM run waits for lease release.

20:34 UTC execution update: read-only profile inspection found the retained, unconsumed creation marker and an absent ext4 superblock in the isolated test profile. Native preparation grants initialization only on exclusive creation; the guest requires that current intent plus the exact marker. This is a concrete startup hypothesis, pending private guest-console confirmation. Existing profile bytes and format authority are preserved. The shared Mac lease is now free. The next experiment remains one bounded diagnostic run with the same installed candidate and image.

Timeline since 19:34 UTC: 19:44 writable rootfs copy repair committed; 19:53 terminal failed-launch normalization committed; 19:54–19:57 one helper-only regression/build batch passed in 3 minutes 11 seconds; 20:04 the isolated composed installation and artifact parity review passed; 20:07–20:10 three private runner parity probes failed and were corrected without VM launches or builds; 20:11–20:14 the real journey reached VM start and transport bootstrap, then failed at guest page control; failed-startup Close passed in 94 ms and owned resources stopped; 20:15–20:25 bounded private console capture was prepared and independently reviewed; 20:25–20:28 diagnostic attempts yielded to the other release owner's lease before starting any fixture. Full page/frame/input acceptance remains pending.

20:36 UTC diagnostic finding: the same installed candidate now has direct guest-console evidence. The retained profile disk has no ext4 filesystem; guest init fails at that mount and the kernel panics before Browser control starts. The bounded launch is finishing its natural timeout and cleanup. The smallest repair will reject this retained, unconsumed creation marker before VM boot and return profile_recovery_required through the existing typed error contract. It will preserve profile bytes and the guest’s one-use initialization authority. Existing Reset profile confirmation remains the recovery route. No image rebuild is needed for this host/error-projection change.

20:45 UTC source checkpoint: independent review passed the eight-file interrupted-profile repair. Browser status tests (15), typed settlement smoke, syntax, product-data/public-copy, Rust formatting and diff checks passed. Native and Runtime compilation plus installed typed recovery remain pending. One cached native/Runtime test and build batch will cover the complete repair. The failed profile was preserved byte-exact in one immutable, private sparse-file clone before any explicit fixture Reset; the original remains unchanged. The diagnostic run finished with failed-startup Close at 86 ms, all ten native absence fields true, and successful observer/fixture/Home stop. Native stderr SHA-256 is 671699b315d0275e73c192c33ad7efee6a86adfafa66dea7b1936b7ca2171127.

Historical comparison: 6 October installed Mac proof passed sign-in, decoded WebRTC frames (7 to 153), navigation, typing, scrolling, Close and profile durability using the same image archive. It still reported the control-service orphan after gateway SIGTERM, and left fresh-install delivery open. The current failures therefore concern cold/failed-start initialization and recovery on this isolated candidate; the earlier page/frame evidence remains valid for its recorded installation. Full regression/integration qualification stays open.

Current checkpoint — 2026-10-07T22:23:47.534244+00:00

Owner: Codex, #131 installed-product lane; one isolated direct-local Mac fixture and the shared build lease. This Mac and Jetson are the target scope; the existing Namespace pilot is an x86 fallback. Existing OMP source and release work stays with its owner. The fixture remains stopped and unchanged. No push, PR, CI run or profile Reset occurred.

Exact integrated source: clean 38dca66da4c6bcfbb176311367e2684eae17ec7f, tree 48663ccf8913dc7128ff65535b88fd62cd2a42a4; 0 behind/12 ahead of fetched develop 1828919980b1af1d60895c6cee178f769daed74c, tree 7888ca70a76a07abbf45a341bbfdc7e4107e38a5. Clean harness 1af31a46275246b17dca0f77a8c134047802b97a, tree ed3965ebe432085b6d18d0774ea83e215210e419, is 0 behind/6 ahead. Normal merge commits preserve the reviewed cleanup/Reset and harness histories. Independent review verified actual ancestry and exact corrected-path diffs.

Base authority resolved: GitHub returns HTTP 301 for the AGENTS-approved feat/0.7.1-models branch API to develop. The missing local ref was a branch rename. Standing default-base authority applies to develop; the pending base question was withdrawn. The current base was merged without rewriting history. The harness merge retains both Reset UI and System update entry guards. The two product corrections use the canonical scoped FileLock as the sole Reset lease release owner and the upstream child-writer fixture helper for fork-safe lifetime tests.

Passed: current product-data/public-copy/diff/workspace and chain formatting gates; 54 Browser status/startup/Close/passive-log checks; exact partial-receipt settlement smoke; all 42 merged harness checks and syntax. The first merged harness run exposed two missing sandbox defaults; one test-only correction fixed both and the full repeat passed. Independent source review carries to these exact clean heads. The earlier native stage passed 11 VZ profile tests; current Runtime/VZ/provider compilation remains pending.

Failed and preserved: the installed beab28b5 fixture reached VZ transport bootstrap, then its retained unformatted profile caused guest mount failure/PID1 panic. Failed-startup Close passed at 86 ms with ten native absence fields and owned stop. Original profile bytes and one private immutable copy remain unchanged. The earlier 9m45s cached build stopped at its too-small 3 GiB storage guard; an EPERM cleanup probe masked that primary error. Failed receipt SHA 45db965ef62c86eec4e9770e88471947bb46f8da5072c15db7274ed3bc9f4c13 stays preserved. Subsequent zero-compiler/open-cache checks proved quiescence; the old child-group identity was absent from that record. The reviewed new guard records exact groups, checks a full census on EPERM and retains primary and cleanup errors separately.

Build plan changed to match current inputs: one cached two-job batch, 30-minute ceiling, provisional 12 GiB build/staging allowance, preserving the mission's 10% free-space reserve plus margin. Nine native binaries need current builds: Runtime, VZ and seven fixture providers. Only the standalone local Exit binary has an unchanged reuse closure. The scoped 16-capsule fixture uses source projections and provider contracts; it needs zero WASM builds. Replace two Browser status files, four Home GUI files and one control helper; byte-matching other projections/helpers can stay. Full normal setup still needs its separate complete provider/CLI/content closure under the existing delivery owners.

Image reuse: archive 922bd38a1580ef88418da186bad1634cf1168cec473c1f2a2f355b1862de6dd3 retains producer 7d710fb827b087ae5abfba2657b267b07700e51c, tree 3d4ae03a7ae12e83c6c6d87a1093f2ef18172898. Independent review verified six pinned producer inputs are byte-identical; the seventh, the packager, changes only resource admission and its message. A reviewed continuation receipt must name that semantic difference. Guest/native proxy EOF opt-in remains separately scoped. This supports the Mac experiment; it does not establish current guest/release qualification.

Installed identity: still beab28b59dc6b3066789ce2b3bf8e2dd0ce31c4c, tree cba7f06c15253e806469731b539416f916041bc6, composed receipt 655e9e7c188d648b3b7fe53f57c25113cd8d1a8b45cb0b5dfc1db1db4a5f59ac. Current source is uninstalled. Old prepared two-binary recipes remain blocked and unexecuted.

Next experiment: finish review of the exact current-source batch, run it once under the lease, then compose and verify matching installed hashes/receipts. Prove typed retained-profile refusal → confirmed Home Reset UI → controlled page → decoded WebRTC → navigate/type/scroll → Close. Then active SIGTERM, crash/restart, natural orphan reconciliation and committed-profile reopening. Capture natural failure evidence before forced teardown. Continue authorized work after this checkpoint.

The first-principles review retains Runtime authority/lifecycle, Engine execution and independent selected Exit networking, with Carrier below Runtime. Remaining root causes are transactional first-use profile publication, durable full-effect settlement across restart, native uncertain lease lifetime and Linux profile parity, default diagnostic privacy, and complete signed delivery. M0 stays accepted; M1/M2 and all pending B01–B16, media, operator, remote, authority, profile, hardware, soak, human-review and approval gates stay open.

Current batch checkpoint — 2026-10-07T22:45:20.083518+00:00: source stays 38dca66d and harness 1af31a46. Runtime compilation passed and eight nonempty regression invocations passed: 11 VZ profile, 13 Runtime profile, 13 host-lock, three retained-owner, one stale-owner, one typed-already-absent, one failed-profile durability and two terminal-settlement tests. The ninth command selected the library target for a test owned by the elastos binary; Cargo returned zero tests. The proof guard correctly stopped acceptance. This is a recipe target-selection error, not a failed product assertion. Exact batch time: 2026-10-07T22:35:21.224408+00:00 → 2026-10-07T22:42:04.995428+00:00. Owned groups are proven gone, shared lease released and installed fixture/profile unchanged. Final native build commands have yet to run. Failed receipt SHA cdc10765882b697273f9da8ed8a80572f7eeef260d525a3de59218554fb605e9 and log SHA 86fccb300e6084b110d3b5c2e189098ac43bd6cb5b33fed8d48aa5c1ade6376e remain preserved.

Next: correct only that test-target selection in a separate continuation recipe. Reuse the eight exact successful source/input-bound results and warm compiled library; run the remaining binary test and seven build invocations under the same two-job/30-minute/12 GiB guards. Preserve the original recipe and failure record. Then verify exact installed composition → retained-profile refusal → actual Reset UI → controlled page/frame/input/Close → active TERM/crash/restart/profile reopening. Full product acceptance remains open.

Normal-delivery root cause: the #217 producer audit names missing complete host-role records, image-set staging path/streaming gaps and input/license closure. #287 owns immutable CID acquisition, including Browser images. Shared update/producer owners keep their scope and signing gates; the Browser contribution consumes those canonical paths.

Continuation admission — 2026-10-07T22:51:18.090218+00:00: root reviewed the separate continuation recipe, SHA fbd36d9c3f836a3814e68aa7ad064b126dd16aadca59cb5b0442c9e91b7bef01. It reproduces all eight accepted command-output hashes from the preserved log and confirms their test counts against cached test-list output. Metadata confirms the omitted helper test belongs to the elastos binary target. The original failed recipe/receipt/log remain unchanged. Only eight remaining commands are admitted: the corrected binary test plus seven native build commands, using the same source/tree, target and warm cache. Full metadata/source/input checks and eight refusal/finalization mock groups passed. Runtime/VZ/provider outputs and installed proof remain pending.

Prior diagnosis and decision evidence

The following records the completed first-principles review and its earlier evidence. The current candidate and next action are stated above.

Browser mission checkpoint, 7 October 20:56 UTC. The user requested a first-principles review of unresolved issues and the current implementation before another build. The next build is held; all fixture processes are stopped. Codex retains the isolated Mac fixture scope; OMP retains Runtime/release work. This Mac, Jetson and the existing Namespace pilot remain the target scope.

Exact source candidate: clean fix/131-browser-helper-orphan@b116b659c9c0f9ed63ba6233a7d445d25d70a6c0, tree 12f2f9f901d02ee7bd858b2d06a08525dc237e68. It is 125 behind and 8 ahead of freshly fetched origin/develop@d96e01e61dd3e30df31f87d31bc7d6d639d97393, tree ece846e89e42122eff28b964572525ad62c16dfa. A read-only merge-tree check has no textual conflicts and yields tree 01fc892b2ef550ba9de5df85700781490c01fad3; this is compatibility input, not a merged or tested candidate. Nothing was pushed.

Installed artifacts remain the previous beab28b5 composition, receipt 655e9e7c188d648b3b7fe53f57c25113cd8d1a8b45cb0b5dfc1db1db4a5f59ac. The new interrupted-profile source repair is committed but unbuilt/uninstalled. Independent source review, Browser status tests (15), typed settlement smoke, syntax, product-data/public-copy, both formatting gates and diff checks passed. The general malformed-stdout smoke retains its unchanged timeout failure. One warm-cache native/Runtime batch is prepared and its lease/deadline/disk/cleanup guards passed review; it has not run.

The diagnostic repeat confirmed guest profile mount failure: the retained unformatted disk makes guest init exit and panic before Browser control starts. Failed-startup Close passed at 86 ms; native proof has all ten absence fields true; observer, fixture and Home stopped. This is failed-start proof, not acquired-page/full thirteen-effect proof. Native stderr SHA 671699b315d0275e73c192c33ad7efee6a86adfafa66dea7b1936b7ca2171127. One byte-exact immutable sparse clone preserves the failed profile, SHA 15debbdb21dd333358dcfeca5a9840a18cffc464f5fa3262d4c093f0cd6581ce; original bytes/identity remain unchanged. Reset has not run.

Harness remains 2c54b41a7c49a8a0947460206af28ed20d38b87d, tree 57ee31826f00f7b492fa30b5d3571637604a0722, 168 behind and 3 ahead, with one preserved uncommitted opt-in UI Reset proof edit. File SHA c720209629e244655049137e31e14d6d5e506d88f586f39f9cc9292073b91db0. Syntax/diff and its two existing mock-only checks pass. It exercises actual decline/confirm controls in the isolated fixture; human acceptance remains separate.

First-principles review so far: all 82 open issue titles were reconciled, with Browser and shared delivery/security/CI owners examined. The initial failures are one cold-start transaction chain: immutable executable image versus writable launch disk, followed by canonical profile creation whose initialization permission belongs only to the failed invocation. Typed recovery preserves authority but is containment; routine pre-boot retry still deserves a transaction review. The guest initializer is identical on current develop.

A material cleanup gap exists on both source lines: Runtime treats the textual lost-owner results indeterminate after service restart: exact owned launcher unavailable and Engine retained owner unavailable as terminal absence. Some current tests expect the ownership obligation to disappear on those messages. Lost bookkeeping does not establish child/VM/route absence. The revised fault gate must retain pending ownership until exact bound terminal evidence arrives. Profile lock lifetime and Reset-versus-launch exclusion also need adversarial verification; these are source findings, not observed data loss.

Normal delivery remains a separate producer gap: neither current line has a complete Browser image/VZ helper signed component set. The developer-composed fixture cannot prove normal install. #217 owns complete producer closure; #89/#108/#274 own compatible signed acquisition/update. Source packaging can proceed alongside bounded M1 proof while existing owners retain those files.

Next: finish the independent root-cause synthesis, then select the smallest coherent source corrections and one current-compatible proof candidate. Use one cached test/build batch after that selection. Prove retained-profile refusal and explicit fixture recovery, the full page/frame/input/Close journey, active SIGTERM, crash/restart, exact natural cleanup and profile reopening. Full M1/M2, media, hardware, soak, human review and approval gates remain open. All B01–B16 acceptance IDs are preserved. Work continues after this report.

21:04 UTC completed first-principles synthesis: the Runtime/Engine/Exit direction matches PRINCIPLES; repair the existing boundaries instead of replacing the Engine or adding a general VM framework. Preserve one Runtime authority and effect identity, provider-owned execution and exact settlement, separate mutable profile objects, and one canonical signed installation/update path.

Root causes confirmed in source: (1) the native helper publishes a canonical unformatted profile before later launch preparation, so failed creation and crash recovery lack a complete transaction; (2) lost Engine-owner text can retire durable cleanup ownership without terminal Engine proof; (3) full ten/native and thirteen/provider effect evidence is retained inconsistently across shutdown/restart; (4) Reset checks ownership and then deletes without one exclusion boundary with new launch/native writers; (5) Linux crosvm ignores Runtime's persistent profile descriptor and uses disposable-rootfs profile state; (6) default control events log raw URL/principal/profile/path fields despite redacted public status; (7) complete Browser image/helper acquisition remains outside the normal signed component set. The reset/lock and Linux findings are source evidence, not observed corruption or target acceptance.

The b116b659 profile rejection remains useful containment: it preserves bytes and explains recovery. It does not complete profile transactions. The eventual first-use design should initialize an unpublished disk under the existing principal/lifecycle ownership and atomically publish after profile-ready proof, before page dispatch. A smaller pre-boot cleanup may abort only a disk exclusively created by that attempt after exact absence and unchanged identity/intent evidence. Pre-existing or uncertain bytes stay preserved. Renewing format authority from a marker alone is excluded.

Revised sequence: correct cleanup truth and verify Reset/open exclusion before another installed recovery run; complete one current-compatible page/frame/input/Close and active fault/profile candidate; prepare the #217 complete immutable role payload set in parallel with M1 for existing release owners; consume accepted M1/M2 contracts for media/operator/remote/profile milestones; complete all measured, hardware and human qualification last. Keep per-owner journals where they serve distinct responsibilities, and remove competing terminal decisions. Repeated Close must project accepted bound evidence.

Next immediate source experiment: make unavailable-owner Close retain pending Engine ownership across explicit Close, stale reap and retry, while Runtime can release its own effects. Test repeated Close/restart, blocked Reset/new launch, substituted/partial proof, and convergence only after a matching terminal receipt. Capture natural fault evidence before the harness signals helpers, then separate restart reconciliation and forced teardown timestamps. Default diagnostics get canary-secret refusal tests. The build stays held until the source batch and its review are ready.

First-principles review refinement — 2026-10-07

The frozen candidate remains 38dca66da4c6bcfbb176311367e2684eae17ec7f, tree 48663ccf8913dc7128ff65535b88fd62cd2a42a4; harness 1af31a46275246b17dca0f77a8c134047802b97a, tree ed3965ebe432085b6d18d0774ea83e215210e419. The shared-lease continuation started at 22:54:26 UTC. The corrected Runtime binary parent-lifetime test passed; the 45 earlier tests remain carried from their exact output hashes. Native production builds remain pending. The installed Home remains the earlier composition and has stayed stopped.

Source review found an additional cleanup evidence gap. VZ RunningVm.stop() caches Stopped after a stop error or timeout. is_running() recognizes only actual Running, so provider status can return the cached value while the native machine is Starting, Stopping, Paused or Unknown. Browser cleanup currently accepts that status as VM absence and releases profile/rootfs leases. This is a static finding, separate from an observed current product failure. Exact native terminal state or handle teardown must prove absence; an uncertain owner must retain its cleanup obligation and disk lease. An empty process census alone remains insufficient for all thirteen effects.

For first-use profiles, the smaller proposed repair uses the existing profile lease: create one privately owned sibling disk, format it with admitted e2fsprogs tools and explicit compatible options, validate and sync it, then publish atomically without replacement before VM attachment. Existing or unknown bytes stay preserved. The guest already mounts valid ext4 without its fresh-format flag, so this can preserve the verified image and avoid a new guest handshake. Tool/configuration/library provenance and an actual guest mount still need proof. Host filesystem readiness does not establish page readiness.

Reset remains containment: it safely removes the idle failed disk, while the next Open currently repeats the vulnerable early-publication order. Keep this gap open even if the Reset journey passes. Required next injections cover formatter/cancellation/publication failures, inode/ancestor/sidecar substitution, stop timeout with transitional native states, and lease retention during uncertain cleanup. Linux persistence and full normal delivery remain separate owning work.

The next installed experiment remains retained-profile refusal, trusted UI Reset, controlled decoded frame, navigation/type/scroll and ordinary Close. Then capture active SIGTERM/crash natural settlement before observer release or fixture cleanup, restart, and read the same committed profile. Full media, hardware, soak, manual UX, independent/human review and approval gates remain open.

Current candidate build acceptance — 2026-10-07 23:04 UTC

The same-source continuation passed at 23:03:27 UTC after nine minutes. Candidate 38dca66da4c6bcfbb176311367e2684eae17ec7f, tree 48663ccf8913dc7128ff65535b88fd62cd2a42a4, produced all nine required native binaries. The combined proof has 16 commands and 46 nonempty passing tests. Eight earlier test invocations/45 tests were carried by exact log hashes; the corrected binary-target parent-lifetime test and seven native build invocations passed. All eight new owned process groups are gone. Only the unchanged native local Exit is reused; WASM builds: zero.

Successful continuation receipt SHA-256: c695dd8ce7e70bf2980d61ee8c661ce6e340c6cc588713395051396487d864d3; log: ecb0e85597da74791d48ed732f62f6b0412258926b41e913233c3104a1d1c162. Runtime binary: bcb01dc1080e20e404bc94ce6893b850e6a2c5b9eab8e0914f4db621f504625a; unsigned VZ supervisor: bcbfa5b340aee08bcf93c6a7e3c03213387a4767bc20373f59de91e93df099a8. Root rechecked the complete lineage, clean source, Cargo metadata/locks, toolchain/environment, target selection, binary hashes and disappearance receipts through the reviewed composition gate.

Installed proof remains pending. Next: install this candidate into the stopped disposable Home under the shared lease, verify provider and served artifact parity, preserve the retained failed profile, then run refusal → UI Reset → controlled WebRTC journey → Close. The first-principles findings and full acceptance gates above remain open. No PR was pushed or merged and no installed real Home or public server changed.

Installation admission — 2026-10-07

The current installer stopped before creating its attempt directory or changing any installed artifact. The first failure was a historical capsule receipt encoding mismatch. Root compared every one of the 276 installed capsule files against original committed source e6a3390293376428596c351536d08f290ab855e1: all bytes match. The original fixture hashed files in path-component order; the later admission helper sorted full relative strings. Hyphenated capsule names produce a different aggregate hash for identical bytes.

Historical receipt hash remains 85564cf019d320f2a88839ade9263e9f3f01667b247a95fa6b0eec4cd6b918bc; the canonical string-order aggregate for those same files is f7cf5bbb23cd7d497609ed03364d06ccab66e011a06af78e03b14c88d0bd1008. Preserve both meanings and the original receipt. Repair only the strict historical admission adapter, with changed/missing/extra-file refusal checks. Current candidate build receipt c695dd8ce7e70bf2980d61ee8c661ce6e340c6cc588713395051396487d864d3 remains passed; a new Rust build is unnecessary. Installed product proof stays pending.

Corrected installation recipe and lease — 2026-10-07

Root and independent review accepted the strict historical encoding adapter. Its 11 focused checks passed, including changed/missing/extra-file refusal and restoration of the canonical digest after failure. Enabled installation recipe SHA-256: e0b86d41ffcf11a0baa79d460f3cc6e6bd868673fe9e2e88cdd7b2eb0d37b292. All 276 original capsule files remain byte-identical; existing receipts remain preserved.

Installation admission then refused the busy shared build lease before creating an attempt or changing artifacts. The kernel lease has another live local owner. Allow that owner to finish; continue light review meanwhile. The same nine binaries and build receipt remain valid. Next experiment and acceptance gates are unchanged.

Installed current candidate — 2026-10-07 23:15 UTC

The corrected recipe acquired the shared lease and installed the frozen candidate at 23:13:31–23:13:41 UTC. Composition receipt SHA-256: 66b3dc1ad353bc7dd215454e5e16b395b32199859d92b7221deda504660a2965. Source remains 38dca66da4c6bcfbb176311367e2684eae17ec7f, tree 48663ccf8913dc7128ff65535b88fd62cd2a42a4; harness remains 1af31a46275246b17dca0f77a8c134047802b97a.

Built and installed Runtime bytes match bcb01dc1080e20e404bc94ce6893b850e6a2c5b9eab8e0914f4db621f504625a. VZ unsigned build bcbfa5b340aee08bcf93c6a7e3c03213387a4767bc20373f59de91e93df099a8 maps to isolated ad-hoc signed/installed bytes 022279ade091f011eab5244bd133a0de44d56b45d24aaeec76a2c57d461c142f; entitlement, strict codesign and all executable sections match. Provider verification passed for all seven selected providers plus reused local Exit. All six installation command groups are gone.

Components hash: 323ce9d0340468748eff6c108210d7d7cd694ed4393b570d9a04177129e92d14; selected capsule tree: bc0912d07311ee10faf1c6dc168514e515fd1a3f20fe49b4042a6ec50044ffb7; projection receipt: 357c9d8e8d40a938e829f53f1bece101ebe88f202ce3733b464dbc7e84fc40be. The verified image is reused with six identical producer inputs and the reviewed packager capacity-only difference, bound by continuation receipt 2e49c99f5216a10fb7be2bbf5af9a0f5e297ce5eed41153266a6e5370e1139b0. The failed profile and its immutable evidence copy remain unchanged.

Enabled journey recipe SHA-256: 1fee238f8ff913c7b8b4cb57065456cf68170855ec7d81adebb34a35ef03496a. Next experiment is installed retained-profile refusal, followed by trusted UI Reset and the full controlled journey. Those product outcomes remain pending, together with active gateway/restart, full media, hardware, soak, manual UX and required review gates. Other local work retained the shared lease during the earlier admission; it completed before this install. Real Homes and public servers stay preserved.

User-directed plan review — 2026-10-07

The user requested a deeper first-principles review after repeated experiment issues. Hold further launches, builds and source changes while reviewing the full current queue: 83 open issues, including exact Browser owners, release/CI dependencies and unrelated scope. Read full issue bodies and compare them with governing principles and actual source; distinguish observed product failures, static defects, fixture failures and pending qualification.

Current candidate and installed receipt remain the 23:15 snapshot above. The retained-profile journey stopped in admission before creating its proof directory or starting Home/VM: the private process census required every global ps PID/UID row to contain a command string. A later read-only census had complete rows; the first incomplete row was not captured, so its cause remains unproven. Fix the observation contract rather than retrying an unchanged launch or treating this as a Browser failure.

Review outputs will state the architectural invariants, shared root causes, minimal owning-component repairs, accepted producer milestones and a revised risk-ordered plan. Preserve all existing work and acceptance criteria, including hardware/media/soak/manual UX/human review and approval gates. The stopped fixture, original failed profile and immutable evidence remain preserved; other local work is untouched.

First-principles review and revised execution order — 2026-10-07 23:30 UTC

The review read all 83 current open issue bodies, with exhaustive, disjoint coverage: 26 product/release/scope issues, 27 delivery/update/CI issues and 30 Browser/authority/isolation issues. Two independent agents reviewed the producer and Engine boundaries. Root checked the critical current source paths. Source, installed artifacts, profile state and processes stayed unchanged during this review.

Conclusion: keep the Runtime → Engine → selected Exit architecture, with Carrier providing off-box transport. The main defects are incomplete state transitions across those boundaries. More launch wrappers, alternate display paths or a new Browser framework would add competing policy. Reuse the existing Runtime authority, FileLock, installation transaction, native state API and strict effect validators.

What is observed, and what remains a hypothesis

The earlier 6 October #87 journey passed decoded frames, navigation, typing, scrolling, ordinary Close and persistence on a prepared valid profile. That remains useful evidence for its candidate and inputs. It did not establish interrupted first-use recovery, active gateway fault settlement, normal signed delivery or all targets.

This session observed a retained unformatted profile causing guest mount failure/PID1 panic on the earlier installed candidate. Failed-start Close produced ten native absence fields and owned stop. The current installed candidate has not started its Home/VM journey: admission stopped on a global process-row assertion. The exact incomplete row was not captured; a later complete census cannot establish its cause. Treat this as a fixture failure rather than a demonstrated current Browser regression.

Other delays were avoidable verification defects: the too-small initial storage allowance, a cleanup probe that masked the primary storage failure, routing a binary-owned test to the library target, and two aggregate-hash orderings for the same 276 files. The last two guards safely refused acceptance. Their corrections preserved original failure records. These failures require better admission and fewer competing test-policy implementations, rather than another product build.

Root causes and owning repairs

Profile publication precedes readiness. The native supervisor creates final profile.ext4 before guest formatting and VM readiness. The guest consumes the one-use marker before format. An interrupted first attempt can therefore leave unusable published state. Exact-marker refusal and explicit Reset contain damage, but the next Open repeats that order. Under the existing profile lease, prepare an exclusive sibling, validate read-only, sync, atomically publish without replacement and sync its directory before attachment. Preserve existing/unknown bytes and rooted descriptor/inode checks consistent with Runtime Reset. Filesystem readiness and page readiness remain separate outcomes. Independent delivery review revised the preparation choice: prefer a producer-owned verified empty ext4 template in #217's existing image family. It avoids a new host executable closure and a new guest readiness protocol or publication while attached. The producer must prove compatible filesystem features, provenance, size policy, sparse-copy behavior and acquisition/update. Host formatting remains an alternative if Wrap third-party software as capsules served over Carrier; never download from other servers #217 deliberately delivers its tools/libraries/configuration; ambient Mac e2fsprogs does not establish that contract. The existing guest mounts valid ext4 without initialization authority; template compatibility still needs target proof.
Cached status is treated as terminal observation. VZ stop sets cached Stopped even on error; provider status returns that cache whenever actual native state is anything other than Running. Transitional/unknown native states can therefore satisfy cleanup's terminal check. Cleanup also drops profile/rootfs leases with uncertain VM absence, and main exits after an error. This is a current static defect; this session has not injected that fault. Use the existing native current_state() for exact terminal evidence. Retain the owner, unfinished bridge handles, TURN child, disk leases and obligation through uncertain cleanup. The current control-service caller force-terminates a live failed launcher, so the native fix and caller must change together: return a bounded exact pending result, retain the acknowledged child in the existing owned set/journal, then accept only its validated later terminal proof. A request deadline bounds the response; it does not establish resource absence. A conditional lease drop alone cannot fix subsequent owner/process destruction. SIGKILL ends native lease ownership, so Runtime durable principal admission stays pending until independent teardown proof. Native stop-timeout telemetry does not perform a forced VM stop. Test transitional state, stalled observation, retained workers/TURN, cancellation and path substitution before fault acceptance.
Shutdown and restart discard parts of the outcome. Control-service shutdown reaps children and clears maps but bypasses ordinary Close's full 13-effect terminal receipt. Runtime reaped-page tombstones retain identity/profile durability but omit the full exact generation/provider/effect binding. An empty process list proves a different fact from durable settlement. Extend the existing journal/tombstone with the validated bounded terminal proof and replay it after restart. Preserve strict consumers and pending outcomes. Capture natural fault evidence before observer release or forced fixture cleanup; later teardown cannot turn an earlier failure into a pass. Owner: #131, with G5 Private Browser: Browser on Apple Silicon Mac #87's broader lifecycle qualification remaining open.
Content identity, installed state and mutable data have mixed meanings. #287 still fetches a mutable release name while the signed record identifies immutable content. #270 still deletes changed installed capsule trees as cache. The private receipt ordering mismatch is another identity-contract error. Use one signed immutable artifact record with explicit type, CID, checksum, size, platform and input closure, consumed by one installation writer. Profiles, accounts and journals remain separately owned mutable state. Serve only hash-verified capsule assets #171 still owns full-package/publisher admission and serve-time integrity. Wrap third-party software as capsules served over Carrier; never download from other servers #217 owns complete Browser image/helper acquisition; private source projection proves a narrower composition. UP-02: Stage one complete release #108/UP-03: Restart and recover safely #109 own interruption/recovery and UP-04: Add the System update flow #110/UP-07: Accept updates on Mac, Linux and Jetson #113 own System/Undo journeys. Real published Undo for Undo and older Homes fetch components by name, so they get the newest release's bytes #287 requires fixed clients on both sides, fixed alpha.N+1 → fixed alpha.N.
Accepted operations and active execution are not consistently separated. The provider bridge holds a serial I/O mutex through long Open; later status/Close can wait behind it. Removing the mutex would break response correspondence. Use the existing owned-operation contract so long admission returns a bounded accepted operation and short controls remain available. Linux crosvm currently omits Runtime's persistent profile disk descriptor, so a page-opening pass cannot establish profile continuity. Ordinary remote Engine already uses authenticated Carrier, but its 5-second supervision and 50-second heartbeat differ from Required: Isolation as promised #173/Browser mission: complete stable local and remote browsing with human and agent parity #283's 2-second reachable enforcement and 30-second partition expiry. Repair and measure each enforcing owner, rather than changing timers alone. Owners remain Linux Browser launcher must not need passwordless sudo #165/G5 Private Browser: Jetson support #90, Required: Isolation as promised #173 and the B07/remote producer milestones.
Verification repeats policy instead of consuming a single candidate. Private QA generations import historical executable policy, while mocks passed before the real receipt/host admission ran. Run cheap actual target/filter, source/input, artifact, capacity and ownership admission before heavy work. Consume one current candidate/input manifest and one installed receipt; historical records supply provenance. After the bounded baseline, move only reusable digest/snapshot/census/terminal checks into existing harness modules. Preserve first failures, nonempty test counts and separate source, built, installed and qualified claims.

Queue reconciliation

The full queue is broader than this repair. #93's current release plan places local private Browser in #87 and schedules full remote #283 after the release; the user's explicit mission reorders our current work without erasing those acceptance boundaries. #83/#174 keep the seed in its distribution role, and this mission uses this Mac and Jetson. Existing Namespace remains an optional x86 fallback. Public live work stays outside this test scope.

#279 and #280 repairs already exist in frozen source; their named Jetson installed acceptance/review remain open. Avoid duplicate implementation from stale issue bodies. #89's accepted signed Mac CLI install/update milestones remain accepted, while Home/cross-target acceptance stays open. #157/#213 key delegation/freshness and #158/#159 publication authenticity retain separate security and human gates. #194 already has cache and source-gate work; final merged-source producers and exact shipping-artifact consumers still need reconciliation. CI's altered LTO/codegen source-home fixture is a scoped journey input, rather than exact release-binary proof. #282's media hang is observed, while the proposed global-barrier cause still needs its parallel reproduction.

#111/#150/#265/#281 retain their documented deferrals. AI, Chat/Community, phone UI, protected content, hosted keys, resident WASM and generic VM tasks retain their existing owners and criteria. Their common lifecycle/content patterns inform this review; they do not become parallel Browser implementation tasks. Older source findings require current-candidate revalidation before changes. Input composition/horizontal wheel, default URL-log privacy, Wallet, accessibility and package-integrity gaps remain explicit later Browser/security work.

Revised order

Correct only the observed private census admission; capture bounded exact identity diagnostics and run admission against the real current artifacts, profile and host. Preserve unknown relevant ownership as a blocker. This needs zero Rust builds and zero reinstallations.
Run one bounded current-candidate retained-profile refusal → actual Home Reset decline/confirm → controlled decoded-frame/navigation/type/scroll/Close experiment. Stop at its first failure. This is diagnostic containment evidence; the fundamental transaction/lifetime defects above remain open even if it passes.
Repair the existing native terminal/lifetime and rooted first-use transaction, then durable full-effect journal/replay, with reviewable concerns and failure injections. Run narrow meaningful checks first. Freeze the resulting closure and perform one affected-output build under the shared lease; reuse exact unchanged outputs and the compatible image. Rebind installed receipts before testing.
Repeat the normal installed journey, then independent graceful stop, active SIGTERM, abrupt crash/restart, natural orphan reconciliation and same-principal profile read. Capture all 13 natural effects before observer release/forced cleanup. Verify exact candidate and numeric deadlines; uncertain or late outcomes remain failed/pending.
Consume the normal signed delivery milestone from Wrap third-party software as capsules served over Carrier; never download from other servers #217/Undo and older Homes fetch components by name, so they get the newest release's bytes #287/update: elastos update deletes installed Home/System on a source-installed Home when its capsules map changes #270 and the existing installation/update owners. Their lane remains with its current owner. Accepted contract milestones unblock implementation while full installed acceptance remains open.
Complete Linux profile parity, measured authority bounds, ordinary Engine/Exit placement and operator parity, then media/input/Wallet/accessibility, cycles, cold/warm samples, soak, hardware rows, hash-bound human UX and required review. Preserve all 70 B01–B16 criterion IDs and all approval gates.

This order first restores a trustworthy observation, then fixes the state model before fault/soak qualification. It avoids broad repeated builds, source changes for fixture failures, and a new controller. The fixture is stopped; OMP and existing Homes retain their owners and state. No PR was pushed or merged. Work continues after this record.

Current-candidate admission now passes on the real Mac inputs. Product remains clean 38dca66da4c6bcfbb176311367e2684eae17ec7f, tree 48663ccf8913dc7128ff65535b88fd62cd2a42a4; installed composition remains 66b3dc1ad353bc7dd215454e5e16b395b32199859d92b7221deda504660a2965. Build: 46 tests/nine binaries remains accepted; zero new builds or reinstalls were needed.

The corrected private runner passed 17 focused checks on actual Python 3.9.6 and independent review. Enabled recipe SHA 893bbb1e2b3fc2436c0ad4122381503e182f45f615ba2cb21f8fd5bb7a8b2b35; repair receipt SHA 0f78d5aff965415b2d53369c469ad8d85652643ce65573adfa059421dc8e1273. The failed original 1fee238f recipe is preserved. Actual admission-only receipt SHA 2cdc42a4a36a77f000440ce463cb6bab7e38b3c7478c480a47aa03e749c84eb8 binds host/artifacts/profile/capacity and quiescence. Lease metadata stayed byte-identical; no journey directory, Home or VM was created.

The exact original incomplete process row remains unknown. Current source defects remain open as recorded in the deep review. The #217 template proposal is pending producer acceptance. Next experiment: one bounded Home sign-in/Browser retained-profile refusal and visible recovery check, preserving profile bytes, followed by owned stop. Normal decoded-frame/Reset, active fault/restart, media, target, soak and human/review gates remain pending. PR: none; source histories, OMP, real Homes and public targets remain preserved.

Installed retained-profile recovery containment PASSED on source 38dca66da4c6bcfbb176311367e2684eae17ec7f, tree 48663ccf8913dc7128ff65535b88fd62cd2a42a4, composition 66b3dc1ad353bc7dd215454e5e16b395b32199859d92b7221deda504660a2965. Owned-run receipt SHA 4a843f512689718fcc473c7657c640ce3963445cde25efca82acb38c87805e50; finished 23:42:56 UTC.

Home sign-in and Browser produced typed profile_recovery_required. The bound installed DOM displayed the expected recovery copy; text SHA bd99217481f9372ce735e4f7f661ffc3fdd436d76c2a0914cdb18668f2abe5ba. The native record proves VM was never started and the Runtime session view is empty. Original failed-profile bytes and the immutable copy remain unchanged. All five owned process groups are gone; Home down and final quiescence passed. This is automated visible-status/containment evidence; human UX and complete cleanup/media acceptance stay open.

Next experiment is a single confirmed isolated Home Reset decline/confirm → fresh controlled page → decoded WebRTC → navigate/type/scroll → ordinary Close. The fundamental profile transaction, native pending lifetime/caller and full durable receipt findings remain open even if this normal path passes. No new build/reinstall occurred, and the preserved evidence permits exact diagnosis of any next first failure. PR: none; OMP and real Homes remain preserved.

The single Reset-and-normal experiment FAILED at its first confirmation step, before Engine open or native VM launch. Candidate/source and composition remain unchanged. Receipt SHA beb0012015097b56c3cca1870bf68d033d37d823550f1b48720977916e934d56; ended 23:47:19 UTC. Home sign-in/re-sign-in passed. The harness clicked Reset for the decline case, then timed out waiting ten seconds for a native JavaScript dialog. All five owned groups are gone; Home down/quiescence passed. Root verified the original profile snapshot remains exactly equal to pre-run and its immutable copy is unchanged.

This exposes a product/UI boundary defect. Browser uses window.confirm() at browser.js:2484. The actual Home/Browser sandbox permits scripts/modals while preserving an opaque origin. The HTML sandbox contract requires same-origin permission and same top-level origin for these native simple dialogs; the simple-dialog algorithm refuses this origin boundary. The current UI and harness assumed a native confirmation could appear inside an isolated capsule. Source mocks did not exercise that installed boundary. The original console warning was not captured; source/flags/spec support the diagnosis, while an exact opaque-frame regression must verify the replacement.

Smallest next repair: an explicit in-capsule confirmation with Cancel/Reset controls, keyboard/focus/close handling and one confirmed request under the existing launch authority. Preserve opaque sandboxing, Runtime's idle-profile ownership checks and the complete user confirmation. Change the harness to operate those visible controls and prove decline/Escape/Close send zero requests and confirm sends exactly one. Check the affected build-input closure before staging; another native build is not scheduled. Preserve this failure and repeat the same journey after exact installed parity.

The 83-issue review and preferred #217 profile-template producer proposal remain current. Retained refusal/visible recovery is independently reviewed PASS; normal frame/input, foundational native lifetime/profile/replay, faults, target/media/soak/manual and review gates remain open. PR: none. This experiment stops here; the fixture is stopped and real Homes/OMP stay preserved.

Browser-only review checkpoint — 8 October 2026 00:10 UTC

Correction to the previous diagnosis: the installed Reset attempt observed a ten-second timeout waiting for the expected confirmation, before Engine open. An exact cause was inferred too early. Two nested opaque HTTP frames with the same sandbox permissions emitted a native confirmation in the exact journey executable, Chrome 151.0.7922.34. The current HTML prompt algorithm also does not establish the earlier claimed same-origin restriction. The categorical opaque-origin explanation is withdrawn; the original failed run remains failed.

Passed: current clean product source 38dca66da4c6bcfbb176311367e2684eae17ec7f, tree 48663ccf8913dc7128ff65535b88fd62cd2a42a4, remains 0 behind / 12 ahead of refreshed origin/develop 1828919980b1af1d60895c6cee178f769daed74c. Installed composition remains 66b3dc1ad353bc7dd215454e5e16b395b32199859d92b7221deda504660a2965. The retained-profile containment and failed-start owned cleanup proof remains accepted at its exact scope.

Additional light verification: python3 scripts/install-bootstrap-test.py --bash /bin/bash completed 66 cases: 62 passed, four retained-publisher checks skipped in this offline run. node --test scripts/browser-startup-readiness.test.mjs scripts/browser-window-close-handshake.test.mjs scripts/browser-vm-local-crosvm-launcher.test.mjs scripts/build/browser-profile-disk-init.test.mjs scripts/browser-profile-disk-flush.test.mjs capsules/browser/browser/browser-input-surface.test.mjs passed 66/66. python3 scripts/browser-vm-linux-network.test.py passed 15/15. The 12 installer/input/test inputs have aggregate SHA 1b911dd8daa89b2719508b776ae89eefd3eb4d2204f8ca2a832237fe0181d81a (lexically sorted path, NUL, raw SHA-256 of each file). These are source/offline proofs, separate from installed acceptance.

A real-browser diagnostic loaded the current input surface: twenty wheel events at about 16 ms intervals lasted 344.5 ms, produced zero dispatches during the gesture, then one accumulated dispatch 64 ms after its end. This confirms the trailing 80 ms debounce violates B05's during-gesture dispatch requirement. The existing encoder also omits the accumulated horizontal delta. A visible HTML confirmation prototype supported Cancel, Escape and one explicit Reset while preserving opaque isolation; this is feasibility evidence, not a product repair.

Next experiment: capture the exact Reset button's enabled/loading state, loaded Browser asset hash, frame/ancestor sandbox flags, launch-token readiness, console errors, click completion/error and dialog events in the installed fixture. The harness currently loses the click result when the dialog wait fails. Repair the component that this evidence identifies before repeating the normal page/frame/input/Close journey. The desired profile transaction, exact native resource lifetime and durable full-effect replay remain necessary even if that journey passes. Active SIGTERM/crash/restart/orphan/profile reopening remain pending.

This review ran zero builds or reinstallations and started no product Home or VM. Diagnostic browser processes and their temporary HTTP servers were closed. The fixture stays stopped; existing Homes and OMP retain their owners. The Browser-only delivery plan and ETA are being reconciled in #283 with independent Engine and installer review.

Browser plan checkpoint — 2026-10-08 00:44 UTC

Passed: bounded first-principles/Occam review, native creation/hierarchy for #288–#293, single Project issue items and exclusive producer/consumer ownership. #283 retains all 70 B01–B16 criteria; current refined plan. GitHub owner records now point to the executable tasks. #131 is In progress in the installed lane; OMP/release owners and other task statuses remain preserved.

Failed: current Reset/normal receipt beb0012015097b56c3cca1870bf68d033d37d823550f1b48720977916e934d56 still ends before Engine open when expected native confirmation is absent. Its cause remains unknown; the categorical sandbox explanation remains withdrawn.

Exact candidate: unchanged clean product 38dca66da4c6bcfbb176311367e2684eae17ec7f, tree 48663ccf8913dc7128ff65535b88fd62cd2a42a4; clean harness 1af31a46275246b17dca0f77a8c134047802b97a, tree ed3965ebe432085b6d18d0774ea83e215210e419; installed composition 66b3dc1ad353bc7dd215454e5e16b395b32199859d92b7221deda504660a2965. No source edit, build, install, product launch or new media/active-fault proof during this record review.

Pending and next experiment: confirm current isolated Mac owner, host/input parity and shared lease; capture button/loading/asset/handler/token readiness, console and both Reset click/dialog results. Repair the smallest responsible UI/harness component, then repeat the exact installed Home/sign-in/Browser/controlled-page/decoded-frame/navigate/type/scroll/Close. Keep native lifetime, rooted unpublished profile choice and durable full-effect replay integrated; continue separate graceful stop, active SIGTERM, crash/restart, natural orphan cleanup and committed profile reopen. #289 handles independent operations/quotas; #217/#288 the ordinary signed delivery producer/consumer; #292 full profiles and #293 qualification. Hardware/media/soak/human/approval gates remain open.

Historical installed acceptance checkpoint, superseded by the current issue body.

Ownership checkpoint — 2026-10-08 04:11 UTC

Root remains the sole isolated Mac test owner. Installed composition is now aa56e1244d2abe04f9b77f848b1f5774ce7e7878770f1b6f1a45d28ca022a92e at product 0d4493db; this task has no PR. Prepared product is now clean at 0d4493dbc34851af8d1c188548b5d977283ef21b, tree fe808ae3ce3a3470c96d743cf7be22b69d6e0b84, 0 behind/21 ahead of refreshed develop b2261294acdb104cedd07383c2db0a30659e27ee. A normal merge preserves task history and integrates the two upstream model/smoke JavaScript changes. The scoped startup-payload lint expectation preserves native transfer and cleanup code byte for byte.

Passed: current-source whitespace, both required Rust format checks, product-data validation and 102 cases, and 40 Close/shutdown/profile-flush cases. The fault harness now compares all eight durable profile identity fields with the preceding completed normal journey before sending a signal. The optional guard preserves existing fixtures. Author verification passed 33 cases; independent review passed the relevant 11 cases and confirmed current adapter/provider formats. Harness is now clean at 60372c61cc9d7c3276ce8b8422b6f86b2f147680, tree 65947ba6c5bf28e3a96ae7dbffd63825d4e5a534, 0 behind/13 ahead of refreshed develop. Commits 20ba9e13 and 38dd125c contain the prior-profile and restart probes; a normal integration merge preserves their history. The opt-in restart stale-page probe passed independent review and its focused eight-case rerun. Its focused eight cases and full 50-case suite passed, including the actual controlled-journey mock variants. It uses fresh authenticated Browser authority to require old-page heartbeat/input 404 before Open, then verifies the retired page stays absent after decoded navigation/input. The broad test selection opened and closed one ephemeral loopback fixture; Home, VM and mission ports remained untouched. Both task branches now include the current base.

The final all-targets Clippy recipe SHA is 4b1926997b2a300dcbc9ffdf04fd7b887687d1e648bc6a4356669e2e9ea886cf. It acquired the shared lease at 03:44:26 UTC and failed after 13 seconds on one large_enum_variant warning in the one-shot native startup payload. The production build stayed unstarted, the exact group settled and the lease was released. Failed receipt SHA 1637cfe9082e0bb99673581fa6838ef44099af12b7ef9184a2053d16f93f40f7 and log SHA 551c308c7764a7091946090d24e87d1242e4378189dad45b6bc4a4bb97464f53 remain preserved. Independent review selected the enum-scoped expectation: each owner retains one sequential startup result; an additional allocation offers no demonstrated benefit. The correction is committed at ec88f952. Parent 134-test proof remains bound to its exact source; final-source build proof remains pending.

The corrected immutable cached batch SHA 812bc58552a90d1f4d6a10818459d3afb6fc6d606ce3d0313270b4231127cd3a acquired the shared lease at 03:55:47 UTC. All-targets release Clippy for Runtime and VZ passed in 58 seconds with warnings denied. Its exact group settled. The two release binaries completed at 04:02:45 UTC from 0d4493db, using the existing shared intermediates with two jobs. Both command groups settled. Passing receipt SHA is 0f844928a70a991b327e7b41d2b18def3f57083eccdf4bd8b59be66f6a8ff7bd; log SHA is 59c68df19c8cdbdbdf05bf6d887861a072b51169e0fb945baea00866595839af. Runtime SHA is 8a4543dd4b6088a15b6cf2f0be0a28d92738f6287cf1639a74c23c787c1574b2; unsigned VZ helper SHA is a61cf58587b945ba846d04b2a69d01a4b561700e0a0c1c5c0c2b920bed1ca8ca. All three Rust deltas restore the passing parent files after their reviewed lint-only transformations; the two upstream JavaScript projections match the refreshed base. Parent 134 tests remain explicitly parent-tested; this batch separately compiles the final source. The verified image and eight matching native helpers remain reusable under their exact input gates.

The independently reviewed composer SHA cd1cd4341fe46315ee514f78e80988d14e40f2f7ae67a0d1deb971661104714b passed exact isolated installation. Runtime built/installed SHA is 8a4543dd4b6088a15b6cf2f0be0a28d92738f6287cf1639a74c23c787c1574b2. Signed VZ built/installed SHA is 59ced9d75128dc9230c6fa762ad4a3e0599541f0ac6f25fa2b6d23e9cff070a0, with exact unsigned executable-section parity and verified fixture virtualization entitlement. Components SHA is 1848eb52829af7fd5b8f0c3fa49a1b278371f5e67edce8eb10ebe430f54713aa; capsule tree SHA is a5ae7fe954fde8c8729c24d8b51de7c88c936a094459af27b14924b443232202. All eight reused native helpers passed installed verification; the verified image, retained profile/copy and original receipts remain bound and intact.

The exact journey recipe is now enabled at SHA 2d25ea069d6bdcdef3e58b0b7198a33ecf4f6ce6b7a22a5cf71560b7fef15ff0. One root-owned lease spans retained-profile refusal and the installed Reset/normal journey, including each mandatory Home-down and quiescence check. The actual retained-profile experiment passed its expected startup refusal and visible recovery checks. Receipt SHA 779e42a4fabe7c66232c11d512ec1f38a68a7fb935f183cc7fbf1535a01fbd5a binds the exact candidate, unchanged retained disk/recovery copy and settled owned groups. The installed Reset/normal journey passed. Receipt SHA 32b9bc9bc103eacf3e239c99ff1ae2ff341bbcb5cc7c910f89491ef8d8ed2dd9 proves Home → sign-in → Browser, decline then confirm Reset, two controlled documents with decoded WebRTC frame growth, typed input and scroll, ordinary Close and committed cookie/localStorage/IndexedDB writes. Close reports profile durability proved and all thirteen terminal effects true. Home-down, exact owned-group settlement, empty Runtime and fixture quiescence passed; the immutable retained-profile copy stayed intact. Independent review also passes the disabled fault/restart wrapper at SHA 420e01cbb68a88af4ff482e914b41350896a68b95f7a6b1068fbc4543a18bde5, including direct new-generation/stream and full native terminal proof. Its actual execution waits for the completed normal-profile baseline.

The first active-SIGTERM wrapper stopped before signalling because the 180-second live-fixture review window expired. Failed receipt SHA d119892477476c13d4b717585881c88540e0c79a84085a88c77ae27df4ad9a69 records the review deadline, complete owned cleanup, fixture quiescence and released lease. The public fault CLI stayed unstarted. This is an operator review-window failure; the installed Reset/normal pass remains valid. The next run reuses the same immutable wrapper, installed candidate, verified image and bounds with a fresh live-fixture review. Completed artifact inspection is reused; fresh health, served UI and exact process/socket identities are checked first.

The second pre-signal attempt completed fresh health, served UI and process/socket review. The public CLI then rejected its live identity because the private operator projection kept the double space in the macOS process birth string, while the CLI canonicalized whitespace. Its viewer and signal stages stayed unstarted. Failed receipt SHA 28c3b24e92b7c55c2779be01d237af87a175982a9beeefdbac20feaed45ce8ba preserves the admission failure and complete fixture cleanup. Two independent reviews confirmed the refusal occurs before viewer spawn and signal dispatch, and verified all registered child groups, Home/VM processes, listeners and control socket absent. Root reconciled and stopped only its exact lease-retaining wrapper. Private reconciliation SHA fe1d78a04813f0876108da2f5309207e3882f4de87e765489b78c482db18bfde and result SHA 885d895b234b3d33b6d27e2af01e3b38f5bf0874f969bcf3c54b0281a57a9fea preserve the failed result and released ownership. The next waiting OMP test acquired the shared lease and keeps its owner. The reviewed one-line repair canonicalizes only the projected birth string to the existing public contract. New wrapper SHA is ea0008482dc8b202bfdd2261675733ddc09615cc048fbb779e5061bfe0f827cd; reversing that line restores the frozen prior bytes. Installed source, artifacts and normal-journey proof remain unchanged. Next: the fresh SIGTERM fixture starts after the shared lease becomes available, then the same-profile read and separate SIGKILL run.

Active gateway SIGTERM now passed on the unchanged installed candidate with corrected wrapper ea000848. Fault receipt SHA 06dff508649af15f9c2e7481ef5dd1244c95a37c6959ff680e2c2acade43a71c records natural exact cleanup in 6789 ms against the declared 60000 ms bound, all thirteen terminal effects, matched active ownership, verified preceding eight-field profile binding, and confirmed viewer/fixture settlement. The public fault receipt remains pending for its separate restart, stale-action and profile-read obligations. Root continues that read/restart under the original 900-second batch clock before the independent SIGKILL run.

The full SIGTERM/restart/read batch passed. Receipt SHA ae6623a4071504adf7079742c8a3ef63080a7afaaa72fc4a8972274f35ef06de binds the exact candidate, natural full-effect fault cleanup, completed same-principal profile read, fresh authority rejecting old-page heartbeat and input, different page generations/streams and full terminal proof for the reopened documents. Read receipt SHA is 466544efcb9071221e40759a97953c8c3f301521ebb8b81b3d53a3963b362e9f; new-generation terminal proof SHA is ea8010d06d7586f4debdd24a4aa011f5d0f5af4f34891658b2f56bb138eeddf6. Prior terminal evidence remained byte-identical across reopening. Exact owned groups settled, Home-down and fixture quiescence passed, and the protected profile copy stayed intact. Next: separate active SIGKILL/crash, natural orphan cleanup, restart and the same committed-profile read on this unchanged installed candidate.

Pending: active SIGTERM and crash/restart with full-effect terminal cleanup, new generation/stream proof and committed-profile read, followed by exact pre-push checks, required reviews and merge. The next experiment is active gateway SIGTERM with a 60000 ms fault bound declared before signalling, followed by restart, fresh-authority old-page rejection and a read of the same committed profile under one original 900-second batch clock. Separate SIGKILL repeats the independent crash/orphan path. The reviewed wrapper is enabled at SHA c0257d06e88389d8eb57803f3cdb606fde224a4106e3b30b50c93516ea947110 and binds the successful normal baseline before fault admission. All Done means and broader media/hardware/human/review gates remain open.

@irzhywau

Historical evidence snapshot - before checkpoint consolidation

This preserves the issue body last updated at 2026-10-08T16:10:23Z. It includes earlier candidates, failed experiments and their later dispositions. The current issue body owns current status. Original body SHA-256: b8cf1d1ab07437a4ba3de5ad8274c671cd7b70d97ddf01fdc99f8c6c6918aaf0.

Preserved body and receipt references

Summary

On tip Home from feat/0.7.1-models @ b1a22a6ec0c0aed2a8df44cc4cdf98618eadd61b, SIGTERM of the elastos gateway process cleans nested providers/elastos serve, but browser-vm-control-service stays running (orphaned under pid 1 / session leader). Guest browser-vm orphan could not be probed here because the browser VM image is not installed (image_set_verified:false).

Related to #87 Done means: “child processes stop correctly.” (Distinct from LA model-process orphans #98/#100.)

Notion archive id: QA-48.

Status

Closeout check at 16:08 UTC: fetched develop is d430a1330e2b2e07afe0db3c13a13563b149ac3f; the frozen task is clean, 8 behind/26 ahead, and matches its published branch. A read-only simulated normal merge is clean at tree b78abb1d24ceefa2fb2470ac605f4146ca10c26b; all 61 reviewed task-path blobs remain identical and the eight new base commits touch ten separate files. Independent compatibility review is GO for source compatibility: startup umask, atomic-install predicates, Carrier cancellation/ownership and bounded image transfer preserve the scoped ownership contract. PR #296 CI passed its ten jobs for the new base producer; PR #295 CI remains PASS at exact ff4c9e46. These are separate receipts, and the simulated combined tree has no new installed claim.

The existing irzhywau review request is present and GitHub has no human review yet. Required human approval and the normal merge are the remaining #131 gate. Keep the current candidate and installed evidence frozen; no additional local build, test Home launch, source push, merge or production signing was needed for this closeout check.

Active owner: Codex, one isolated direct-local Mac fixture. Current source is ff4c9e468a592de44fc2cb2caa54b7cee134af45, tree affc2e5c4530f2542cf7c219e44eb6dd49fedb53, clean and 8 behind/26 ahead of freshly fetched develop d430a1330e2b2e07afe0db3c13a13563b149ac3f. Existing source/installed receipts retain their tested base 34b2e5c5c092c827a2566de6e671fbd5e15f8081. The new ordinary commit isolates Unix stream-bridge test directories; it preserves all production bytes. Independent read-only review passed at file SHA 0c0da3e9d64e938e537e49760d54183ecfd1df9a7704306c25a1b63a56c28c4b, production-prefix SHA f15ba6a1fcd3ca76a63d420a56553134b31c0ecabc6fdc889d221015f169ded8.

Frozen artifact batch passed: one Runtime-only release build took 3m45s. Build receipt a5968701420fbca45fb866ddadd90236291797e418955a1a127d1ce73c276643 and log 4489ed7c80f34308813ffa74c644f34f7ff8922e197fc3920fb275dba926d1da bind source ff4c9e46. The existing installer verified built/installed Runtime SHA 53e389668fccc886402ecb1525afeab20edc298c8bbdb5876fcffbed74fb3f89; install receipt 52e88fb194368c0ecefffa965a0a3332813055bc72f643deb471507bf7352c51 and composition f86171b87b40e11d3fbdd6d4849e329ce34a9b5cc399208806afcf85de67e8f2 retain all 26 reused component bindings byte-for-byte, including their actual producer origins. The build group is absent and its lease was released. Fresh normal-use/profile proof 51953f2119653428f42ac9fe777ed6907d4273ac9b3013296a74076146d372b6 passed at this composition: sign-out/sign-in, controlled decoded WebRTC pages, navigation, typed input, scroll and natural Close with all thirteen effects and proved profile durability. Reopening matched all eight identity fields and committed cookie/localStorage/IndexedDB state against the exact historical writer. All five owned groups are absent and Home stopped. Active SIGTERM/restart also passed: combined receipt db873375652d1c34c2ab5b65de51b742a09321ddd92991d76c4670ce23c4a6aa, read receipt d989c8ed03e241d88da16cd0a5ad75486d44b1c45c07dbd86a02fc035f6b93b1. Natural exact full-effect cleanup met the predeclared 60000 ms fault bound. Restart preserved the profile, rejected retired actions and closed a distinct new generation; prior terminal bytes remained unchanged. All ten registered outer groups are absent. Separate SIGKILL/crash and restart passed: combined receipt 192bb6e6e9715adec5f1be4a3983fc30b323841f85d28a13bdac4f19c10ead1a, read 0d7cee9fa57098d460a2eba28076faf304200e3d458b6bbd488e127a1fa19999; natural cleanup took 4577 ms. Separate actual managed Home stop also passed: combined 96ffae8764d7e9c21e44d944f632ab943703d5d625b2b78d9a7d3ce6f206d72d, read bc348a26cc659080bc49dc3bc8b581829a548a7be635d206bcb18187a9edb7e3; managed action took 6744.75 ms, with TERM-only behavior and unused force fallback. Both retain full natural cleanup, committed profile recovery, stale-action rejection, distinct new generations and unchanged prior terminal bytes. The initial managed invocation used the wrong selector; admission rejected it before lease, Home or signal effects. The corrected explicit HOME_DOWN run supplied the actual managed-stop proof. All four current receipt sets pass. Independent restart_probe_review accepts the whole current build/install and four-journey batch. Final kernel census found all 52 distinct owned groups, 50 frozen old PIDs, four new native PIDs, seven gateway PIDs, managed helper and 67 session ports absent. Gateway PID files, control socket and VM/socket roots are absent. Exact natural cleanup predates harness cleanup; committed disk identity and the immutable incident copy remain protected.

Preserved harness: source 60372c61cc9d7c3276ce8b8422b6f86b2f147680, tree 65947ba6c5bf28e3a96ae7dbffd63825d4e5a534, is clean and now 34 behind/13 ahead of freshly fetched develop. Its unique work stays protected. Compatibility reconciliation and harness integration follow the reviewed product merge; historical proof keeps its exact producer binding.

Passed: the small fixture experiment reproduced two parallel tests claiming the same directory. A forced existing-directory regression failed with the previous create_dir_all behavior (0 passed/1 failed), then passed after exclusive directory creation. The repaired package passed all four cases and 1,000 parallel repetitions (4,000 cases), with every test process reaped and its owned directories absent. Package Clippy with warnings denied, formatting and whitespace passed. These narrow results are agent-reported tool-transcript evidence, rather than new raw receipt files. The preceding dbae2a35 canonical batch passed the full server suite (2589 passed, 0 failed, 27 existing ignored; 435.09 seconds), Runtime/all-target Clippy, provider checks, 115 VZ library cases and 70 VZ supervisor cases. Installed producer 2e6632ae retains independently accepted decoded frames, input, Close, managed Home stop, SIGTERM, crash/restart, orphan cleanup and committed profile reopening. Historical Reset evidence retains its tested source.

Failed gate: the preceding dbae2a35 publication stopped at browser-stream-bridge::tests::forwards_bytes_between_private_unix_sockets, with Invalid argument (os error 22) and a socket wait timeout. Raw log SHA 7b4ced9e1cd90c2bc524e2bf12284d7659cd4758482468c1289a4e1c948116b8 preserves that failure. The directory collision is proven; the specific original errno mechanism remains unproved. The original gate remains failed. That preceding attempt ended before publication. Its failed record remains historical; the current candidate and its stopped fixture have separate passing source and installed proof.

Scheduling change: group compatible source work into a bounded candidate. Use small static checks and meaningful regressions during editing, review the combined change, then run the full gate and affected artifact build once at that boundary. Reuse the verified image, VZ helper, capsules and other components when their exact production inputs match. Check the remaining small helper suites before another long server run. Review the normal-delivery producer/consumer ownership before starting a second Browser lane; accepted contract milestones permit source work while full product acceptance stays open. Preserve Runtime authority and durable reconciliation, Engine operations and exact native resource retirement under the existing Browser contract.

Published for review: PR #295 targets approved develop. The final canonical pre-push gate passed for exact source ff4c9e468a592de44fc2cb2caa54b7cee134af45; raw log SHA is 22c63ed3c46d7c56c654b349e334ea85163fd76f7635efe57841171d5e0149a7. Formatting, product-data/102 cases, all-target checks and Clippy passed. The full server suite passed 2589 tests, with 0 failures and 27 existing ignored, in 440.32 seconds; 228 Runtime binary tests, 115 VZ library cases, 70 VZ supervisor cases, four Unix bridge cases and other selected package targets also passed. Git and its hook are absent, and root released the shared build lease. Remote branch origin/fix/131-browser-helper-orphan matches the candidate, with 0 behind/0 ahead. The publication gate used develop 34b2e5c5, with task divergence then 0 behind/26 ahead. Current independent installed review passed. At that publication base the branch was 0 behind/26 ahead; it had 61 changed files and 6043 insertions/909 deletions, preserving all 26 ordinary commits and merges. The remote task branch was absent before this publication. The frozen artifact has exact Runtime parity. Current posted Opus review is PASS for the exact published head. Its nonblocking notes are assigned to existing owners: #87 carries actionable recovery when exact inherited cleanup evidence is unavailable, with broader profiles in #292; #289 carries a nonblocking/stalled-writer retry and shutdown-bound experiment; #293 carries a harmless concurrent-spawn qualification fixture for possible macOS writer inheritance, with any common lifetime repair owned by #131. Existing missing-evidence refusal remains intentional: it preserves profile ownership rather than inferring full retirement from a dead launcher. Every retry already observes explicit shutdown; directional EOF is a separate signal. Those next experiments retain their original acceptance gates and make no new current-source or installed claim. CI run passed all ten required jobs for unchanged head ff4c9e46, including macOS and both Linux installed-Home jobs. Release publication was correctly skipped for this PR. Required irzhywau human approval and normal merge remain before #131 closure. PR #295 is ready for review; @irzhywau has been requested. All ten platform CI jobs passed; the requested human review remains pending. Agent reviews and six installed criteria are proven; the final human-review/merge criterion stays open. #131 is in QA / Review, with no additional local build or source push during this handoff. #217 is the next eligible normal-delivery producer; its shared release-file scope needs #89 owner coordination before source edits. #288 consumes that compatible package milestone; #289 follows later. #173 retains confinement; #283 retains all B01–B16 hardware, media, soak, wallet, manual UX and approval gates.

Acceptance record — 2026-10-08 08:48 UTC

Candidate: product fix/131-browser-helper-orphan at 2e6632ae1469b1cdc91205739673ee0833310c1b, tree 6bd2cfdc5ed97762d9fb46f0352cf99c0305a2ed; harness fix/87-browser-journey-harness at 60372c61cc9d7c3276ce8b8422b6f86b2f147680, tree 65947ba6c5bf28e3a96ae7dbffd63825d4e5a534. The committed heads include refreshed develop b2261294; divergence is 0 behind/23 ahead and 0 behind/13 ahead. Both worktrees are clean. The VZ repair is a new normal commit; existing history is preserved. These task branches await their draft PRs.

Exercised checks: real-Chromium sandbox Reset, focused Reset/principal-read, Close, profile, parent-lifetime, persistent-control and observer-settlement regressions passed. Required formatting and product-data/102 cases passed. Installed source 0d4493db passed all-target release Clippy with warnings denied and two release binaries at receipt 0f844928a70a991b327e7b41d2b18def3f57083eccdf4bd8b59be66f6a8ff7bd. Parent 90fc8e68 passed 134 compiled tests; those remain parent-tested, with reviewed carry-forward deltas and separate installed-source compilation.

The enabled canonical push hook admitted source 0d4493db after three zero-build lease-contention refusals. Before the full server suite, a concrete test-isolation race was found: its global two-party preadmission barrier could pair with an unrelated page and strand the intended test worker. Root stopped its owned hook; its compiler groups settled under the lease. Stopped publication receipt 89987995abb588e41e2f818e74828edc33cb3c27b78f36af798554d2bb9dd98b and log 9f8787390156a8128445774e9746c4bf0a7a3deee761ac4df9ea07902ac38d23 preserve that attempt.

Commit 7c66ffeb binds the cfg(test) barrier to its existing (root, page) identity. The new bounded regression failed against the old helper after 1.04 seconds on a foreign-root commit, then all seven Browser media tests passed with two test threads; the exact late-preadmit/retains-stream pair also passed in parallel. The test proves foreign root/page isolation and owned close/release settlement. Whitespace, product-data/102 cases and required formats passed. The production source projection remains byte-identical to 0d4493db (SHA 15cc7f31387df80f8d117a5e3b3a409eb6a28d02bf2872df96f059a3e227a9af). This test-only delta preserves the installed evidence at its tested source. The full canonical gate ran from 06:43 to 06:50 UTC for 7c66ffeb. Product-data/102 cases, formatting, provider checks, Runtime workspace all-target check/Clippy and earlier unit suites passed. The VZ library passed 115 cases. The VZ supervisor suite then failed bridge_shutdown_joins_backpressured_write_without_guest_eof: 68 cases passed and one failed because the worker returned an error during shutdown. At 07:06 UTC the bounded diagnostic probe reproduced Broken pipe (os error 32) in the backpressured shutdown case. Source review identifies an in-flight write returning after the other forwarder closes their shared socket. Baseline receipt 83543fb4180b3ef590cd1b81c3acaf765cf0ddbc2fb725c73722202475f10170 and log f985da8370c410e4f59b5f758623c4016ae836ad2f2115c60f659069c3f56d2c retain the failing result. The owned test group was reaped and absent. The deterministic partial-write regression also failed before repair at receipt b5ad7c02ff046d5cef24607ac76ccf2b4ca8a7c2f3bb31534edf79d2b350657f. Commit 2e6632ae changes seven production lines: a broken-pipe write after explicit launch shutdown returns the exact copied count. Ordinary broken pipes, peer completion and unrelated I/O failures retain their errors; all joins and cleanup-effect checks remain intact. After repair, five bridge/cleanup cases and all 70 native supervisor cases passed; product-data/102 and shutdown/Close/31 cases plus formatting and whitespace passed. Repaired receipt a6c6c2fcf90a203dcd300f0f9188453b712a542da4df6a6dda02fd88cdc13371 binds source SHA a181f368838808cc71894a6860f04c54159456e523bb8f848f02bf5b45fe12cd and raw log 5c7e3925b33c39785ebccc488aae1fc274d6a54950069e5436b43a2c0bebe4c9; all four owned test groups were reaped and absent. The server unit suite and later gate steps remain pending. The gate stopped at its first failure, all captured descendant processes settled, and the remote branch is absent. Failed receipt 85a99a9c31be282d017c2fca7dff584b62b185c3cdff0f333d58b56e3f44205c and raw log 61f4de78735c6fdce30b9c5b688759c4a064faa4825eb8c6a692362bd82f829a preserve the attempt. Other workers retain their installed resources.

Reviews: independent development reviews accept the Reset repair, native ownership, control-service settlement and restart observer. Full-diff Opus review initially found inherited records keeping a restarted service alive; 90fc8e68 repaired that finding and the corrected review passed. Reviewed diff SHA is cc166940fdb57de98fe2b867ccfe7b83c771e8917e15564c070552abe3afccec; review output SHA is 64c2b5f3773cccac896adfdd34f3a2a58ca6eccdaf9fefbb12bd94b61006f839. Final installed normal, SIGTERM and SIGKILL/restart/profile evidence has independent read-only PASS. Narrow carry-forward review browser_candidate_review is PASS at installed source 0d4493db: reviewed parent 90fc8e68 and fetched develop are ancestors, 56 of 59 concern-path blobs are identical, and the three differences are scoped lint changes. The base merge preserves the reviewed ownership and Reset behavior. Independent native_lifetime_review accepts the new test-only repair at file SHA 318c4cafd2c16ca9c3cc096a1dcfca338c0edd1b2fe06903798c000497e8970c, including the bounded regression and unchanged production projection. Independent native_lifetime_review also accepts the VZ repair at source SHA a181f368838808cc71894a6860f04c54159456e523bb8f848f02bf5b45fe12cd and diff SHA 2fdea541defa16fb97c4b72af7e547bd39acb68a80a3655cc82e72991ce469a7, with verified raw before/after evidence and unchanged Runtime/image production closure. Current published-candidate cross-family and required human reviews remain pending.

Installed evidence at product source 0d4493dbc34851af8d1c188548b5d977283ef21b and harness 60372c61: composition aa56e1244d2abe04f9b77f848b1f5774ce7e7878770f1b6f1a45d28ca022a92e binds the exact source, built and installed Runtime SHA 8a4543dd4b6088a15b6cf2f0be0a28d92738f6287cf1639a74c23c787c1574b2, signed VZ helper SHA 59ced9d75128dc9230c6fa762ad4a3e0599541f0ac6f25fa2b6d23e9cff070a0, components SHA 1848eb52829af7fd5b8f0c3fa49a1b278371f5e67edce8eb10ebe430f54713aa and capsule tree SHA a5ae7fe954fde8c8729c24d8b51de7c88c936a094459af27b14924b443232202. Matching native helpers and the compatible verified image were reused under exact input gates. Executable-section parity and the isolated virtualization entitlement passed.

Passed normal journey: retained-profile refusal receipt 779e42a4fabe7c66232c11d512ec1f38a68a7fb935f183cc7fbf1535a01fbd5a, then Reset/normal receipt 32b9bc9bc103eacf3e239c99ff1ae2ff341bbcb5cc7c910f89491ef8d8ed2dd9. Home → sign-in → Browser → Reset decline/confirm → controlled pages produced decoded WebRTC frames, accepted all sixteen typed prefixes and scroll, then completed ordinary Close with all thirteen native terminal effects and proved profile durability. Cookie, localStorage and committed IndexedDB writes completed. The first failure was native confirmation blocked by the capsule sandbox; the scoped capsule dialog repairs it. Sandbox policy remains intact.

Passed active SIGTERM and restart: combined receipt ae6623a4071504adf7079742c8a3ef63080a7afaaa72fc4a8972274f35ef06de, fault 06dff508649af15f9c2e7481ef5dd1244c95a37c6959ff680e2c2acade43a71c, natural cleanup 6789 ms within the declared 60000 ms limit. Same-profile read receipt 466544efcb9071221e40759a97953c8c3f301521ebb8b81b3d53a3963b362e9f verifies all eight identity fields and committed storage. Fresh authority rejected retired-page heartbeat/input with 404; after new Open the current session was present and the old page absent. New-generation terminal proof ea8010d06d7586f4debdd24a4aa011f5d0f5af4f34891658b2f56bb138eeddf6 binds different generations/streams and complete new Close evidence. The prior terminal remained byte-identical; all fifteen registered groups settled.

Passed separate SIGKILL/crash and natural orphan cleanup: combined receipt 0954fa267b7e6fe6b37335e787b13b1d3306b84781f4fa964e1e6e8fd5ddd5ba, fault 6c9fccc84a6eb2702b055d4ac994c81c616c2ade06b73c026e74e2e3fb25bc05, natural cleanup 4547 ms within the same declared fault limit. Restarted same-profile read fa8348a90e11102056583950b05b1bdd74388b021d100b2511de3b54c2618eb0 matched all identity fields and committed storage. The retired page was rejected, the new generation/stream differed, and prior terminal bytes stayed unchanged. All thirteen terminal effects, exact process-group settlement, Home-down, empty VM/control state, socket/port absence and the protected immutable profile copy passed. Independent review accepted the complete crash/restart/read proof.

Failed pre-signal operator attempts remain failed and preserved: a review-window expiry and a raw macOS process-birth spacing mismatch stopped before a fault run. The smallest private projection correction and exact owned-wrapper reconciliation passed independent review. The current private wrapper 9af1a4fef6a5cf3949f366a91483437cc7ea2ac0773a928b1f9bff652770bddf adds optional kernel waiting with a lock-file identity recheck; its fault/read/cleanup behavior and 60000 ms fault/900-second acquired-batch bounds remain unchanged. Historical source, failed checks and reconciliation details remain in the preceding checkpoint.

Fresh current installed normal proof: receipt 7ab2f1fc824646c8d834fa8183a0e4ed62b81c2d2a8892b3459c249c41223519 binds product 2e6632ae, tree 6bd2cfdc and composition 2e112733. Fresh sign-out/sign-in, two controlled pages with decoded WebRTC progress, navigation, all typed input and scroll passed. Natural Close proved profile durability and all thirteen native terminal effects. Reopening matched the eight identity fields and saved cookie, localStorage and committed IndexedDB state from the exact historical writer. The immutable incident profile copy remained unchanged. Home stopped; all five registered groups were reaped and independently kernel-absent. Separate SIGTERM admission is active; its signal follows exact live fixture and installation review.

Fresh current SIGTERM/restart proof: combined receipt eab599731b44b92958e880d83c5b4e861786307a5eef90d3e9bf494d5f2df6d2, fault 75e46757ee59a00b762bdfc5864805f13c89b85f85a6fcfa0598a3bd04bd8e77, read 891bdc36847713351d09bade0fd6d7e06c7471a12f146a6720d481fc14aa90ea. Natural cleanup took 6641 ms within the predeclared 60000 ms limit. Complete native effects, same-profile identity/storage, retired-page rejection and new-generation Close passed. Prior terminal bytes remained identical; new-generation proof is cee9984fa396633bd85f295853fc54caa31d4b9dc618307341aee35ded377362. All fifteen outer/read groups are reaped and kernel-absent, Home is down, and the immutable incident copy is unchanged. Independent raw review is underway. Separate current SIGKILL admission now owns the fixture sequence.

Fresh current SIGKILL/crash/restart proof: combined receipt 4b38c7c3e03270216ac69bc94938ac7d332a020273eb6b7d9c3c3b688834109a, fault fd68e11e0454c8016b598c9d978473c0e92d3323ea47dfd084b4237bd1d80d57, read 3c9656bf33b406077fbd41c50c93ccbf1f0f69d3266069ebe07937d030b017fb. Natural orphan cleanup took 4568 ms within the predeclared 60000 ms limit. Restart recovered the committed profile, rejected retired actions before new Open, and proved complete new Close with a different generation/stream. Prior terminal bytes remained identical; new-generation proof is 643418c0f93176b3443b5e04a59c138121ec10ec215d1e25441dc52ad52b85a5. All fifteen outer/read groups are reaped and kernel-absent. Home and VM/control state are empty, the control socket is absent, and the immutable incident profile copy is unchanged. Independent restart_probe_review accepted all current normal and direct fault/read raw receipts and verified final live absence. Its criterion mapping identified the original separate managed active Home stop requirement. The new managed run and its incremental independent raw review passed as recorded below. Direct active SIGTERM and crash evidence remain accepted.

Remaining gate: exact pre-push results, draft PRs, current-candidate independent/cross-family review, required CI and human reviews, and normal merge. Keep this issue open until its implementing PR is reviewed and merged. #283 retains B01–B16, broader media, hardware, soak, wallet, human UX and approval gates; this result establishes the scoped Mac ownership producer milestone.

Current execution: the one release batch passed all 70 VZ cases, strict all-targets Runtime/VZ Clippy and the two-bin build. Build receipt 9d0954a5d78e49e551656c6e719f9215c2cf12cf9c0cd973547252792075094e and log 899323ced4ed2770943048b5b21557fa699acdfdd2f3269d7ea2f591c94412f4 bind source 2e6632ae. Installed Runtime is aae7c274663e7dd2f051afc28a6a69b5b23ba3bedb11586e3e86b77b0fd5bfde; unsigned VZ is 7a784c7697162f075ba9e677aeb1613c6b320ec7a1e21086b627d909d69b8d55; signed/installed VZ is 074a13e1abd1a2ca65a0f4bf5b4d2b5654b8106e9a35155454803475b11af363. Virtualization entitlement and all executable-section parity passed. Composition 2e112733143ad95d0c488b1f0fd08fbfa44480ecd15ea395b2ffc2b976486725 and install receipt b0d909057252c3c94a1a499efcccc4fa4e382785e85ad3fa3393fedf8c21c785 bind actual producer origins and profile protection. All seven build/install groups are kernel-absent. Matching helper/image/capsule inputs were reused.

The private fixture admission repair verifies all 27 installed bindings and the exact approved image links. Earlier admissions stopped before Cargo or artifact writes; the corrected layout guard passed independent review. Current normal and separate fault/read runs are now complete as recorded above. Root alone owned the Mac fixture and shared lease. The lease is released; other local workers retain their own resources.

First-principles review after the user checkpoint: the current ownership model is coherent and needs a final behavior check rather than a rewrite. Reproduced causes were capsule Reset depending on blocked native confirmation, native/control owners settling before their exact resources and disk writers, inherited records being treated as current service ownership, and a blocked write returning BrokenPipe after explicit shutdown. The source gate also exposed a separate cfg(test) barrier shared across unrelated pages. Current source repairs keep Runtime authority and exact reconciliation, Engine operation semantics and native adapter lifetime distinct under one Browser contract. The installed proofs remain accepted.

The recorded build/stage/normal/SIGTERM/SIGKILL operations consumed 19m21s in a 48m45s window. The remaining 29m24s lies between operations; receipts establish a 23m31s stage-to-normal gap but do not divide every minute between shared-lease waiting and preparation/review. Private candidate-specific wrapper expansion added avoidable delivery overhead. The adjusted route freezes product source/artifacts, adds only the missing managed-stop trigger to existing observation, then runs one canonical publication gate. Further product changes require an actual failure. Hardware, broader media, soak, wallet, manual UX and human approval gates retain their original owners.

Managed active Home stop passed at the same installed source on 2026-10-08 09:33 UTC. Combined receipt 0c70fd415a7c252d7a2c22ada3805c5b15a88f1160880b58b3c12b7e9a7b8902 binds the action managed_home_down, the existing Home stop command, the exact reviewed helper and original numeric bounds. Complete native cleanup took 6758 ms within the predeclared 60000 ms limit. The Bash trace records one owned gateway SIGTERM and zero SIGKILL commands, helper exit 0 and an unused force-stop fallback. All thirteen native terminal effects settled naturally. Same-profile restart/read receipt 6ec9bdef1662bba30f3fa8fca93e4a17649c6240a367366d900662668717194a passed committed-state and generation checks. The prior terminal remained byte-identical at 2dcf2010c34fdade5d1b52a87428785d675c0beeaa40fcbfecd6d0a293114455; new-generation proof is c90ef2eacee6dcd4a8d5af975054c75b6bccbd0f62bfb145a7891a9928092a10. Root reaped the run, verified all ten outer process groups absent and released the lease. The fixture is quiescent and the immutable incident profile remains unchanged. Independent restart_probe_review accepted the raw managed increment: active page/VM before stop, pre-run bounds, exact TERM-only helper trace, all thirteen natural cleanup effects and durability, complete committed profile readback and all eight identity bindings, old-page rejection and new-generation Close. All fifteen registered groups, all sixteen frozen old process identities and the helper are absent. This closes the separate active graceful-stop evidence gap. The product, image, installed helpers and original three passing journeys stayed fixed. Private controller preparation defects were corrected before this first actual managed run.

Current experiment: the actual canonical gate started at 09:39:50 UTC at source 2e6632ae and stopped at its first unexpected server failure. Signed Carrier test test_services_remote_engine_signed_approval_retains_scoped_execution_grant failed during remote Engine close_page. The remote-serving path had obtained a validated full cleanup receipt, then omitted it when calling Runtime's new durable terminal-proof commit. The first close therefore failed; Carrier returned the scoped carrier_provider_invocation error. Call-site review confirms the other fresh cleanup commits already retain their receipts, and the local receipt-free replay has its intended validated fallback. The smallest repair passes Some(&receipt) at this one remote commit, preserving binding, cleanup ordering and authority checks. The cached canonical 2e6632ae test binary reproduced the signed Carrier failure in 0.92 seconds. With the one-argument repair, one targeted server compile ran both exact signed Carrier and remote partial-cleanup/retry/replay/late-input tests: 2 passed, 0 failed in 4.44 seconds. Receipt aec931ebdd4998416964a641520ed793ff7dea4f2b3b3f98cdbd8b690f6bec3c and raw log 719a7792be27e1043d5935d7661fa80e0dcaf12824f4d8c67d768f537f5ee46f bind the failing baseline and repaired source SHA 4e6390ba79c9540f1ec6ae14868e6063e1ede649b1154ba02e05522bdde17863. Whitespace, required workspace formatting and product-data checks also passed. Independent incremental review is underway. Next, reuse the compiled repaired test binary for the full server suite before any Runtime artifact rebuild or full canonical gate. Forward commit b2498bef contains only this one argument change and preserves existing history. The prepared source is clean; independent browser_candidate_review accepted the exact receipt validation, all fresh callers, deliberate durable replay and unchanged remote authority/cleanup ordering. The installed Mac proofs stay accepted at their tested source; a corrected source needs its own Runtime artifact parity before current installed acceptance.

The cached repaired full server binary passed all enabled cases: 2588 passed, 0 failed, 27 existing ignored, in 458.37 seconds. Raw log fd6e196f1c190d717fb5fc2b53ebd5f287b3e2a2ce413f9c0547eeb1840adc96 and raw-review receipt 0eea3d5b0b74c0c3a8116b2692179229723317dbf91f0c26954406f8265f4e13 bind source b2498bef, compiled unit binary and reused unchanged providers. The private result guard incorrectly expected all 2615 listed cases to be passed; it returned after the successful unit process. Original controller receipt 15c53b1e824f3e69a4cff026bdcf97e7389e500d8e3b0798009a688c230d2492 is retained, and the raw result was reconciled without another run. Ignored hardware/manual cases retain their original gates. Source review identified why two capacity tests were slow: repeated reads sync every record, so 128 inserts cause 8128 prior-record syncs. #289 now records this read-path and global-lock finding for short-operation work. It does not authorize weakening terminal or profile durability.

Stopped publication receipt 3b5d32671a1aa3a7ac7cae2b51d4aa1563a0848b89793010aab36067b736c91d and log d429cfe5b6bd12d24c03e9c10f08a8e2bda5041a4fd146f12748c4b2d66dac2d preserve the actual run. Root stopped only its exact birth/UID/parent-bound canonical hook and verified all 137 recorded groups absent. The source gate remains failed and the candidate remains absent from the remote. The private supervisor also encountered a transient foreign-UID census member and did not identify macOS's capitalized Python executable; this controller failure delayed its automatic stop. Root used the exact owned hook, retained all cleanup ownership and changed no other worker. Further controller work is limited to correct ownership/stop behavior, rather than new orchestration. At that checkpoint, develop was b2261294; the fresh 34b2e5c5 integration is now recorded above. Next: refresh only the affected Runtime artifact and exact installed evidence at b2498bef before the final canonical publication gate. The cached full server run passed; matching VZ helper, image, capsules and provider inputs remain reusable. Reuse the unchanged VZ helper, image, capsules and other matching components. Publish the product draft PR and collect current posted cross-family review, required CI and irzhywau human approval before normal merge into approved develop. Publish the harness after develop includes this product; its standalone source retains the reproduced unkeyed barrier and its Reset journey consumes the product dialog. Preserve 60372c61 installed harness receipts, verify unchanged harness inputs after normal develop integration, then run its own required gate and PR review. Broader isolation remains tracked in #173: native providers generally retain the Runtime user's rights. These lifecycle results establish the scoped producer milestone; full capsule isolation and Browser qualification retain their original gates.

Steps

Start tip Home gateway (e.g. localhost:61192); note gateway pid and any browser-vm-control-service pid under the models home.
kill -TERM <gateway-pid> and wait until the gateway exits (~600ms observed).
Inspect remaining processes for browser-vm-control-service (and guest browser-vm / crosvm if the image is installed).

Expected

All helper processes started for that Home/gateway stop with the gateway (or are explicitly supervised and reaped).

Actual

Gateway and child providers exit; models browser-vm-control-service remains (ppid already not the gateway before kill; stays orphaned after). Guest browser-vm process N/A without installed image.

Build / identity

Branch: feat/0.7.1-models
Commit: b1a22a6ec0c0aed2a8df44cc4cdf98618eadd61b
Binary: elastos 0.7.0-dev
Pre-kill gateway pid example: 322716; orphan control-service: 322756
Retest: 2026-09-29 (America/Panama)

Evidence

/workspace/elastos-qa/github-reset-20260929/retest-models/ (RETEST.md, 06-qa48-pre.txt, 06-qa48-post.txt, 06-qa48-sigterm.txt).

Browser mission installed cleanup gate (#283)

Lane: Installed product. Current source candidate: ff4c9e4; tree affc2e5c4530f2542cf7c219e44eb6dd49fedb53. Accepted installed proof retains product source 2e6632a and the historical Reset writer 0d4493d. The new fixture delta is test-only; the integrated Runtime source requires its current artifact and journey proof. Matching VZ, helper, image and capsule inputs remain reusable. Journey harness: 60372c61cc9d7c3276ce8b8422b6f86b2f147680; tree 65947ba6c5bf28e3a96ae7dbffd63825d4e5a534. Recheck source/target compatibility and current ownership before use.

The first Home/page/frame/input/Close run plus active SIGTERM is a delivery milestone. Complete acceptance also requires separate abrupt crash, restart and orphan-reclamation evidence.

A stable isolated installation binds source/tree, built and installed Runtime/helper hashes, matching image/guest inputs, manifest/capsule hashes and installation time. Image reuse follows verified compatible inputs; changed guest inputs require affected rebuild/verification.
Home → Browser → controlled page → decoded WebRTC frame → navigate/type/scroll → normal Close passes.
Separate graceful gateway stop and active gateway SIGTERM runs stop the exact owned control service, Engine helpers, VM and network/media processes within a numeric bound declared in the receipt before the test.
An abrupt gateway crash and restart exercise independent parent-death/orphan reclamation. Restart recovers committed profile state and rejects stale ownership/actions.
Every run proves page, child, VM, route, socket, transport session, TURN process/listener/relay ports, ordinary/media/bootstrap vsock bridges and hibernation state absent for this session. Other Homes remain outside the fixture's ownership.
Profile reopening preserves the committed state. Surviving owned processes after the declared deadline fail the run.
Required source regression/review and exact-candidate installed proof pass; the implementing PR is reviewed and merged before closure.

The historical missing-SSH/unstaged-input checkpoint is superseded by the current isolated direct-local Mac installation and verified Jetson SSH. Recheck changed host/artifact inputs, keep one Mac/build owner and record any actual blocker. Keep this issue open after a starting smoke while its remaining installed/review gates are pending. #283 carries B07 capacity/100-cycle qualification beyond this defect's exact scope.

Browser ownership boundaries

This task establishes exact native observation, worker/TURN/profile lease lifetime, caller settlement and durable full-effect replay. Runtime retains the pending writer barrier until exact reconciliation permits reuse. #289 owns independent short operations and quotas; #292 consumes this task's local committed-profile result; #293 owns broader capacity and 100-cycle qualification.

Moved to After 0.8.0 (audit 15 Oct): the fix (#295 via #307) is on develop (c1b99a6 is an ancestor of 5b60f67) and boxes 1-6 have installed Mac proof (6068139215). Left from this issue's own gates: Irzhy's review of #307 and a rerun on a published release. The 0.8.0 Browser-session line depends on this cleanup, so "stop Home with Browser open" is in the alpha.19 Mac check (#87).

Status check (19 Oct): 6 of 7 boxes are proven and PR #307 (which includes #295) is merged on develop. The last box stays open because this body names human approval and a fresh published-release record as closure gates. Not closing.

Gateway SIGTERM leaves orphan browser-vm-control-service #131

Description

Summary

Current checkpoint: accepted lifecycle proof; release verification open

Steps

Expected

Browser mission installed cleanup gate (#283)

Browser ownership boundaries

Activity

andersalm commented on Oct 6, 2026

andersalm commented on Oct 6, 2026

andersalm commented on Oct 6, 2026

andersalm commented on Oct 7, 2026

andersalm commented on Oct 7, 2026

andersalm commented on Oct 7, 2026

andersalm commented on Oct 7, 2026

andersalm commented on Oct 7, 2026

andersalm commented on Oct 7, 2026

andersalm commented on Oct 7, 2026

andersalm commented on Oct 7, 2026

andersalm commented on Oct 7, 2026

Current checkpoint — 2026-10-07T22:23:47.534244+00:00

Prior diagnosis and decision evidence

First-principles review refinement — 2026-10-07

Current candidate build acceptance — 2026-10-07 23:04 UTC

Installation admission — 2026-10-07

Corrected installation recipe and lease — 2026-10-07

Installed current candidate — 2026-10-07 23:15 UTC

User-directed plan review — 2026-10-07

andersalm commented on Oct 7, 2026

First-principles review and revised execution order — 2026-10-07 23:30 UTC

What is observed, and what remains a hypothesis

Root causes and owning repairs

Queue reconciliation

Revised order

andersalm commented on Oct 7, 2026

andersalm commented on Oct 7, 2026

andersalm commented on Oct 7, 2026

andersalm commented on Oct 8, 2026

andersalm commented on Oct 8, 2026

Browser plan checkpoint — 2026-10-08 00:44 UTC

andersalm commented on Oct 8, 2026

Ownership checkpoint — 2026-10-08 04:11 UTC

andersalm commented on Oct 8, 2026

Historical evidence snapshot - before checkpoint consolidation

Summary

Status

Acceptance record — 2026-10-08 08:48 UTC

Steps

Expected

Actual

Build / identity

Evidence

Browser mission installed cleanup gate (#283)

Browser ownership boundaries

andersalm commented on Oct 15, 2026

andersalm commented on Oct 19, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions