feat(browser): retain MV3 failure profile cleanup evidence

[seonghobae]

Partial implementation of #27 and #28, stacked on unchanged exact PR #139 head 499a6499112a11094279a1386238e26987d771d5.

Buyer/reliability gap

The Manifest V3 repeatability lane reuses one temporary browser profile across an initial pass and a restarted pass. A failure in either browser pass previously escaped _run_restart_trial; the outer loop then retained only the trial number and exception type. It discarded whether the extension-bearing profile was actually removed, and the aggregate compatibility gate had no all-trial teardown proof. A failed compatibility run could therefore lack credential-free cleanup evidence even though profile isolation and repeatable restart behavior are part of the extension-compatibility contract.

Dependency

This Draft targets unchanged exact #139 head 499a6499112a11094279a1386238e26987d771d5 and must remain Draft while #139/#136 and their prerequisite stack remain active. Current exact head is 42af52f77336112c4fbe1da5c5283899f6bd288e. No descendant PR currently targets this branch. No prerequisite check, review, status, coverage, mergeability, or synthetic-merge evidence transfers.

TDD and RCA sequence

1. Exact test-only head 7df005847ffc45526de42bf6bf7a8ec6c959cbe0 required failed initial/restart browser work to return bounded teardown evidence only after the temporary-profile context exited, and required one all-trial Manifest V3 cleanup evidence/gate boundary.
2. CI run 31657604009, Rust contracts job 94315391134, passed checkout and Rust setup and then failed at the Python repository-contract boundary because the mocked RuntimeError still escaped and mv3_profiles_cleaned plus the dedicated cleanup gate did not exist. This is the valid RED. The independently successful Rust production-coverage job on that test-only Python head is not promoted as source GREEN.
3. Production head 2301459a20bd5561054b7dd7d2151fd327634026 catches only the reviewed browser-run failure classes inside the temporary-profile lifecycle, verifies deletion after context exit, emits bounded success/failure cleanup evidence, and adds the all-trial aggregate evidence and fail-closed gate.
4. Current exact head 42af52f77336112c4fbe1da5c5283899f6bd288e adds only the truthful Unreleased changelog entry for that implemented boundary.

Implemented contract

_run_restart_trial now:

• catches only OSError, ValueError, RuntimeError, and json.JSONDecodeError around both the initial and restarted browser passes;
• records only the bounded exception type, never the exception message or browser/page content;
• verifies that the temporary profile path is absent after the context exits;
• raises a dedicated cleanup failure when the profile remains;
• returns trial_number, passed: false, failure_type, profile_cleaned: true, and duration when browser work fails but teardown succeeds;
• retains complete existing initial/restart success evidence plus profile_cleaned: true; and
• leaves unexpected exception classes unnormalized so programming defects still fail loudly.

The aggregate compatibility path now computes mv3_profiles_cleaned across every trial without filtering failures, emits profiles_cleaned in top-level evidence, and applies Manifest V3 profile cleanup gate failed before repeatability acceptance. An outer failure lacking cleanup proof therefore fails closed rather than inventing successful teardown evidence.

Exact-head proof

On unchanged exact head 42af52f77336112c4fbe1da5c5283899f6bd288e against unchanged exact prerequisite 499a6499112a11094279a1386238e26987d771d5:

• CI run 31660680288: success;
• Rust contracts job 94324664028: Python repository contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy, and rustdoc success;
• Production coverage job 94324664078: exact owned production function/line/region/branch enforcement success;
• Manifest V3 Compatibility run 31660680311: success;
• CodeRabbit exact-head status: success;
• GitHub reports the Draft mergeable against its unchanged prerequisite base; and
• no formal reviews or inline review threads are currently returned.

No predecessor-head, prerequisite, synthetic-merge, skipped, cancelled, absent, pending, or stale evidence is promoted as current proof.

Truth boundary

This lane records controlled temporary-profile teardown evidence for the pinned Manifest V3 compatibility runner only. It does not prove browser-process termination, adversarial filesystem erasure, removal of every extension artifact outside the temporary profile, extension-update rollback, browser/adapter authenticity, general enterprise profile isolation, durable incident evidence, or completion of #27/#28. A production runtime still needs trusted task/process ownership, recovery evidence, and separately reviewed cleanup/retention semantics.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0945ba13-a97a-4e43-8aa0-2fb165d4a525

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}