fix(browser): prove PID-safe browser crash recovery evidence

CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to OriginWeave are documented in this file. The format follo
 
 ## [Unreleased]
 
+- ChromeDriver `session not created` responses now retain a typed `session_not_created` failure and only the allowlisted `sandbox_unavailable` or `unknown` startup reason; raw driver-controlled response text remains excluded from browser-crash evidence.
+- Browser-crash trials no longer disable Chromium's sandbox. Rejected session startup remains one failed attempt with driver and temporary-profile cleanup, without an unsandboxed retry; live pinned-browser acceptance is still required.
+- Browser-crash failure evidence now preserves the first causal browser failure when session cleanup or ChromeDriver teardown also fails, retains secondary cleanup only as bounded exception-type fields, and excludes raw exception text from the emitted artifact. Cleanup-only failures remain fail-closed as primary failures.
+
 ### Added
 
 - Kept the inherited protocol-failure cleanup checks executable after shared-deadline integration by observing the correct cleanup path for ordinary and forced-close trials; all failure, cleanup and diagnostic-redaction assertions remain intact.
@@ -42,6 +46,7 @@ All notable changes to OriginWeave are documented in this file. The format follo
 
 ### Changed
 
+- Controlled browser-crash compatibility evidence now credits a crash only after the exact PID/start-time identity is signalled through a revalidated Linux pidfd and that same pidfd becomes readable within the bounded deadline; generic WebDriver transport failures no longer substitute for process-termination proof, while sampled Chromium process-set teardown remains a separate recovery boundary and the pidfd runtime contract remains mandatory on Linux CI.
 - Separated logical origin authority from resolved network destination authority; an origin grant no longer implies permission to connect to every resolver result.
 - Separated resolved-address authorization from direct transport evidence; an approved IP now becomes a usable stream only after the operating system reports the exact requested IP and port.
 - Separated exact TCP peer proof from authenticated TLS service identity; an observed peer becomes an authenticated HTTPS stream only after explicit-root, fixed-time, SAN-bound WebPKI verification over that same stream.

docs/doctoring.md

@@ -124,6 +124,16 @@ At #147 `af1b98ba377c73b88baa9633e2232e7f76e76f36`, all six parent review-eviden
 
 The existing test now specifies each lane's actual observer, return value and exact arguments. Ordinary trials keep the individual `False` result. Forced-close trials inject `(False, False)` from the shared observer and require `(321, 654, ((321, 654),))`, preserving root-only capture rather than inventing a complete descendant set. Every existing failed-trial, profile-cleanup, live-root, driver-termination, error-type and redaction assertion remains. No production code, deadline, retry, failed denominator or coverage gate changes. This repair does not address the separate ordinary-pass two-deadline finding or prove real Linux/pinned-Chromium acceptance.
 
+### Browser-crash sandbox conformance
+
+PR #148 adopts the current #147 parent `3dff28d9bf2dd27b72507e39979d51b8bf140fb4` by ordinary merge, retaining the crash/pidfd delta and all six inherited cleanup-evidence regressions. A new regression executes the actual outer crash trial and intercepts its session-start request: before the repair it fails because that request disables the Chromium sandbox. Removing that one crash-lane argument restores the existing sandbox invariant without introducing a configuration switch or fallback path.
+
+The same regression requires one failed startup attempt, driver reaping and actual temporary-profile removal. It preserves browser executable selection and never credits the failed startup as a successful crash trial. The existing PID-safe signal/exit observers, sampled-process checks and trial denominator are unchanged. Other launch lanes retain their separate owner repairs; this child must not be interpreted as complete runner-wide sandbox integration. Mocked launch requests prove the control-flow contract, not that a real Chromium binary started with its sandbox active. Linux pidfd tests and exact-head pinned-Chromium compatibility remain separate acceptance evidence; macOS skips are not passes.
+
+ChromeDriver session creation is also an evidence boundary. A structured `session not created` response is retained as a typed `session_not_created` failure. Only the reviewed `No usable sandbox` diagnostic maps to `sandbox_unavailable`; every other driver-controlled message maps to `unknown`. Raw response text, executable/profile paths and arbitrary diagnostics remain excluded, so the next pinned-browser run can distinguish the sandbox-helper case without admitting untrusted ChromeDriver prose into CI evidence. This classification does not install the helper, retry startup, disable the sandbox or make cleanup equivalent to browser success.
+
+Supplemental verification used the existing Colima Linux kernel `6.8.0-117-generic` and Python `3.12.3`, without installing dependencies or changing VM configuration. All 247 Python contracts execute there with no skips, including the three real pidfd cases skipped on macOS: killed-but-unreaped child, non-terminating signal and stale identity. Initial host-path discovery failed because this VM does not expose the host worktree. The first streamed archive then added AppleDouble `._*.rs` files, causing two TLS source-read errors. A fresh export of only Git-tracked paths with `COPYFILE_DISABLE=1 tar --no-xattrs --no-acls --no-fflags` removes that packaging artifact at its producer; no test filter or source exception was added. Source and regression-file SHA-256 hashes match across hosts. This proves the supplemental Linux contracts, not pinned-Chromium execution, hosted approval or release acceptance.
+
 ## References
 
 Amazon Web Services. (n.d.). *Set up the Amazon EKS Pod Identity Agent*. Retrieved August 6, 2026, from https://docs.aws.amazon.com/eks/latest/userguide/pod-id-agent-setup.html