Browser: qualify the frozen candidate and maintain the supported role matrix #293

A second maintainer can install and repeat the complete Browser journey from one frozen compatible candidate. Each advertised device-role and placement has its own measured receipt, media/manual evidence and maintenance owner.

Goal: qualification and support maintenance. Lane: Installed product after accepted implementation milestones; light matrix/audit work can begin from M0. Own B01.A1/A3/A4 certification, B11.A1–A5, B16.A1–A5, measured B07.A3/A4 and B15.A3 maintenance policy. Behavior tasks retain their implementation ownership.

Scope and milestones

Reuse the Browser objective audit, existing receipt/manual schema and acceptance baseline. The published matrix distinguishes viewer, Engine and Exit roles, device/architecture/resources, virtualization, client versions/codecs and compatible signed artifacts. Unsupported or missing hardware keeps its row unverified.

Initial schema/matrix/privacy work uses accepted M0. Full acceptance consumes installed baseline/preparation, local media/recovery/Wallet, responsive sessions, operator, remote placement, profiles and enforcing authority outputs. Take accepted exact-candidate milestones rather than waiting for every broad producer issue to close.

Done means

• Each advertised row and placement passes every applicable preserved B01–B15 criterion; version/device refusal happens before page/profile/stream effects.
• Measure 100 cold and 100 warm launches with first installation separate, 100 lifecycle cycles and advertised-capacity/refusal behavior using original B07/B11/B16 budgets.
• Thirty-minute controlled audio/video/input continuity and the eight-hour mixed/hidden workload pass original monotonic timing, latency, resource, text/resize/adaptation and leak budgets.
• All five placements and physical LAN/WAN/relay-required networks pass their fault/partition/sleep/restart/revocation/mixed-version cases. Hardware and real mobile/viewer evidence retain their original scope.
• Each receipt binds the exact source tree, built/installed/served/runtime/package/helper/image identities, host/resources, clients/adapters, selected Engine/Exit, placement/network, commands, timings, failures, cleanup and matching accepted media/manual report.
• Basic repository gates, relevant Browser gates and scripts/browser-objective-audit.mjs pass for accepted product media/manual evidence. Obsolete current-work footer instructions point to issues; historical audits remain intact.
• A named maintainer owns upstream Engine/CVE monitoring, severity response, supported-version/EOL policy and release-neutral support instructions.
• A second maintainer completes fresh install → sign-in → Browser → browse/operator/media/recovery/Close with the exact candidate. Required human reviews and merged implementation remain closure gates.

Next experiment: turn current fixture/source-only results into accurately bounded matrix rows and verify receipt coverage. Begin resource/cycle samples only after exact installed behavior passes; reserve the mandatory soak once for the frozen candidate.

The posted Opus review gives exact ff4c9e46 PASS and records a nonblocking macOS concurrent-spawn qualification gap. process_lifetime.rs uses pipe() followed by fcntl to set close-on-exec. A concurrent fork in that interval could inherit the writer; the review did not reproduce that inheritance. This issue owns a harmless two-thread barrier fixture with a concurrent pre_exec fork: match the exact writer device/inode and prove owner-loss EOF under the declared bound. The fixture uses harmless local processes. #131 owns any resulting common lifetime implementation repair. This follow-up is nonblocking for the accepted scoped ff4 proof; full concurrent-spawn, hardware and mission qualification remain open.

Ownership and acceptance

Product owner: Anders (@andersalm). Part of Browser mission #283, acceptance revision Browser-2026-10-07-R1. The complete original criterion text and numerical budgets in #283 remain authoritative. This task supplies the stated contribution; shared-producer and full-mission acceptance remain open.

Record one execution owner, lane, approved task base/PR target, file scope, exact candidate and resource lease before implementation. Planning uses fetched develop 1828919980b1af1d60895c6cee178f769daed74c; existing branches retain their approved bases/history. Keep at most one active task per Browser lane. New tasks start in Backlog; #131 remains the installed-product task.

Runtime owns admission, principal/grants, placement, routing, resource limits, lifecycle and audit. Engine executes and renders websites and owns website TLS; the selected Exit performs authorized DNS and destination streams. Carrier carries off-box traffic below the same contract. Immutable signed capsule/dependency identity and separately rooted mutable profiles retain their distinct owners.

Verification and closeout

Use the smallest behavior tests that exercise the changed boundary. Freeze the affected input closure, then batch one needed build under the shared Mac lease. Reuse the verified image/helpers when inputs match. Source presence and prepared fixtures provide bounded evidence; installed acceptance binds source commit/tree, built/installed/served hashes, package/image/helper manifests, device/client/adapter versions, selected Engine/Exit, placement/network, commands, failures, cleanup and matching media/manual evidence.

Use one isolated Mac test owner and the authorized Mac/Jetson targets; existing Namespace is an optional x86 fallback. Other physical role/network rows remain unverified until their evidence exists. OMP and existing Homes keep their owners. Disposable fixture signing uses separate trust; production signing, existing-Home changes, release and deployment retain their approval gates.

Before reporting, update this issue with passed, failed, pending, exact candidate and next experiment; use 30-minute checkpoints during sustained execution. Full closure requires accepted behavior, resolved findings, required independent review, applicable irzhywau/security/signing review and human UX/media review, and a merged implementing PR. Applicable #173 changes retain its approval and different-model-family adversarial review gate. All #283 hardware/media/soak/second-maintainer gates remain intact.

Related Browser outputs: #87 Mac preparation/media/Wallet; #90 Jetson preparation and target proof; #217 signed payloads; #289 responsive capacity; #290 operators; #291 independent placements; #292 profiles; #131 exact cleanup. #288 is the closed Mac duplicate. PR #349 remains the x86 source candidate. #475 owns dependency freshness and #456 owns the physical Android viewer reproduction.

Current acceptance tooling dependency — 3 November 2026

At #90 source snapshot 3a8f41c62, scripts/browser-objective-audit.mjs:47 always calls the Mac VM proof validator. The manual UX validator does not admit the Jetson audit schema. Use the existing audit and manual review gate for both targets. Accept a Jetson artifact only after it binds the exact signed installation, decoded media/input, profile and lifecycle results, and require the human report to bind its hash. The existing Jetson runtime audit supplies readiness/parity evidence; complete its installed behavior evidence before accepting a product row. #90 owns the actual run. Keep the Mac criteria and all B01–B16 gates intact.

Preserved work after the 0.8.0 Browser finish line

Use #283 for current sequencing. Scope every support row to a named candidate, host/viewer/Exit role, compatible signed artifacts and installed evidence. The source-Home Jetson ten-cycle run is a development gate. The full sample counts, hardware, media, human and soak criteria remain at their original scope below. Keep the tested launch definitions distinct and compare measurements against the original B11 budgets. Publish a tested scope or obtain an explicit budget decision before a broader support claim.

• After 0.8.0, produce and qualify an x86-64 build of the same Linux VM guest recipe. Preserve Chromium + Selkies + Runtime-controlled networking; the host-native namespace Engine remains retired. Linux x86-64 uses the approved remote Engine until its VM row passes.

From #87, original box 2:

• Browse, type, audio/video, reload, reconnect and Close work; the profile
  survives restart and child processes stop correctly.

From #87, original box 5:

• Product media checks and the final human journey pass on one named candidate.

From #217, original box 8:

• Corrupt/missing/wrong-architecture/interrupted/low-disk/denied-virtualization cases preserve a recoverable installation and report the correct stage.

From #288, original box 3:

• Missing/corrupt artifacts, wrong architecture, denied virtualization, interrupted download/restart, cancellation and low disk report typed stages and direct remedies; partial work stays recoverable and creates no ready offer.