feat(evidence): record browser task interruption recovery state

[seonghobae]

Partial implementation of #28, stacked on PR #64.

Buyer-visible gap

OriginWeave's operability contract requires deterministic evidence when Chromium is interrupted: a renderer/browser failure that occurred before any external effect is materially different from a crash during an ambiguous externally visible mutation. The latter must quarantine rather than automatically retry. The prerequisite branch had verified action-outcome evidence, but no typed recovery evidence vocabulary for this distinction or for cleanup completion.

Dependency

This PR is stacked on unchanged exact PR #64 head 2c45411ed9aa0eecca2d06c85659db9f4bb85e4d. It is not independently integrable before that prerequisite.

TDD / RCA sequence

1. Test-only exact head 43b45301bee5f370573d8452046a3f431cd9b51f introduced the public recovery contract before production implemented it. CI run 31447631677, Rust contracts job 93645139256, passed repository contracts and formatting, then failed at cargo check --locked --workspace --all-targets because BrowserTaskInterruptionEvidence, BrowserTaskInterruptionKind, ExternalEffectDisposition, and RetryDisposition did not exist. This is the intended production-boundary RED.
2. The test contract was strengthened so incomplete browser-context closure, incomplete resource reclamation, or incomplete evidence finalization each requires quarantine even when interruption was proven to occur before an external effect.
3. Production then added only the bounded immutable recovery-evidence value object and public exports; it performs no browser I/O, retry dispatch, reconciliation, persistence, or cleanup detection.
4. Exact head d9f824df1a587592d205a868fad34af16d13e687 passed the complete repository CI and exact coverage gates.
5. Current exact head 9d9ebffee234ed4ab662dab7850bd08450ec365b adds only the truthful Unreleased changelog entry for the implemented boundary and has fresh exact-head CI proof.

Implemented boundary

The branch now provides:

• typed renderer-crash, browser-process-exit and forced-context-close interruption kinds;
• explicit InterruptedBeforeExternalEffect versus MayHaveCommitted disposition;
• separate caller-supplied facts for browser-context closure, task-resource reclamation and evidence finalization;
• recovery_complete() only when all three cleanup facts are true; and
• SafeToRetry only when interruption is known to have occurred before any external effect and cleanup is complete; every ambiguous-effect or incomplete-cleanup state is QuarantineRequired.

Exact-head evidence

On unchanged exact head 9d9ebffee234ed4ab662dab7850bd08450ec365b against unchanged exact prerequisite #64 head 2c45411ed9aa0eecca2d06c85659db9f4bb85e4d:

• CI run 31448465680: success;
• Rust contracts job 93647645175: repository Python contracts, formatting, locked workspace/all-target check, full tests, strict Clippy and rustdoc all success;
• Production coverage job 93647645271: success, including exact owned production function/line/region/branch enforcement;
• CodeRabbit exact-head commit status: success;
• no formal reviews or inline review threads are currently returned; and
• GitHub reports the PR mergeable against its exact prerequisite base.

No predecessor-head check, review, or mergeability result is transferred to this exact head. Repository security/review workflows that require a non-Draft PR remain separate gates and are not inferred from CI or CodeRabbit status.

Truth boundary

This lane does not detect Chromium crashes, kill or restart browser processes, prove that caller-supplied cleanup facts are trustworthy, reconcile an external mutation, dispatch/retry an action, persist evidence, implement checkpoints, or complete the real Chromium vertical slice. It creates a fail-explicit credential-free recovery evidence vocabulary for a later trusted browser/runtime adapter to populate.

This scheduled actor does not merge or self-approve. After exact CI/coverage proof, the PR may leave Draft so configured review/security gates can evaluate the unchanged current head; any later head movement invalidates the evidence above and requires fresh validation.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2a3fa0a2-c050-4229-aabb-7c4b18bb48fd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}