test(browser): measure bounded Chromium process-tree RSS

CHANGELOG.md

@@ -11,6 +11,7 @@ All notable changes to OriginWeave are documented in this file. The format follo
 - Close the first pinned-Chrome fixture server when startup of the second server fails, and attempt both shutdowns when one cleanup fails, preventing partial compatibility runs from leaking loopback server threads.
 - The fixture-shutdown contract now exercises successful MV3 and Agent Task trial paths before asserting reverse-order server cleanup.
 - The resource-evidence shutdown fixture now supplies complete semantic and measured resource surfaces before exercising reverse-order cleanup.
+- The process-set resource fixture now supplies Chromium count and aggregate RSS surfaces before exercising reverse-order cleanup.
 - The fixture-shutdown success double now includes both browser-computed semantic verification surfaces, so cleanup failures cannot mask incomplete Agent Task evidence.
 ### Added
 - Corrected the 2026-08-26 product-gap snapshot with current #229 presentation-identity evidence, stacked-only #205 integration evidence, current base/head pairs, the 126-PR queue count, explicit root-versus-child merge ordering, and the active GitHub counted-approval gate.
@@ -45,6 +46,7 @@ All notable changes to OriginWeave are documented in this file. The format follo
 - Real pinned-Chrome WebDriver evidence for the controlled Agent Task fixture: the CI lane uses an isolated profile, disables extensions, types and submits synthetic text, observes the same-document post-condition, and proves profile cleanup; this does not claim a shipped OriginWeave browser adapter.
 - Active pinned-Chrome Agent Task evidence verifies browser-computed role/name for controlled input and submit targets before action; this remains test-harness semantic evidence and does not claim a product semantic observer or authority.
 - Active pinned-Chrome Agent Task evidence records browser-process RSS, semantic-observation bytes, action latency, and task duration from bounded trusted adapter inputs; this remains test evidence and does not claim process-set attribution or product resource telemetry.
+- Active pinned-Chrome Agent Task evidence derives a bounded Chromium process count and process-set RSS from one Linux proc snapshot, rejects proc/fixture symlink escapes, and retains failure-type-only diagnostics; this remains test-harness evidence and does not claim trusted production process attribution.
 - Universally value-redacted network evidence with explicit path, metadata, and provenance bounds; ambiguous path rejection; validated source URLs; lowercase SHA-256 identifiers; and verification state.
 - Versioned schema-bound extraction contracts with bounded identifiers and field counts, typed value/cardinality metadata, explicit duplicate-free reviewed source channels, fail-closed schema validation, and deterministic `Display`/`std::error::Error` contracts for public schema failures.
 - Rust 1.97.1 build contract, strict Clippy and rustdoc gates, and exact production function, line, region, and branch coverage enforcement.

docs/DOCUMENTATION_FITNESS.md

@@ -164,9 +164,9 @@ Active #65 supplies a deterministic synthetic local web fixture with a labelled
 
 ### 3.20 Bounded browser process-set resource evidence
 
-Active #51→#66 establishes two distinct layers: #51 owns single explicitly supplied Linux PID sampling and the bounded telemetry value boundary; #66 owns bounded duplicate-safe aggregation/sampling over an exact caller-owned PID set. #66's exact current contract rejects empty, zero-PID, duplicate, oversized and overflow states and fails closed if any member cannot be sampled. Active PR #72 records browser-process RSS, semantic-observation bytes, action latency, and task duration for the controlled pinned-Chrome fixture from bounded trusted adapter inputs.
+Active #51→#66 establishes two distinct layers: #51 owns single explicitly supplied Linux PID sampling and the bounded telemetry value boundary; #66 owns bounded duplicate-safe aggregation/sampling over an exact caller-owned PID set. #66's exact current contract rejects empty, zero-PID, duplicate, oversized and overflow states and fails closed if any member cannot be sampled. Active PR #72 records browser-process RSS, semantic-observation bytes, action latency, and task duration for the controlled pinned-Chrome fixture from bounded trusted adapter inputs. Active PR #73 derives a bounded Chromium process count and process-set RSS from one Linux proc snapshot, with process identity and symlink-escape checks.
 
-**Resolution:** aggregate resource measurement must not silently undercount a known caller-owned process set, but process membership remains an external attribution responsibility. PR #72 is bounded resource evidence for test repeatability; it does not discover Chromium PIDs, prove process ancestry/task ownership, walk cgroups, sample GPU/VRAM or create a durable telemetry store, and does not turn the fixture into a product resource adapter.
+**Resolution:** aggregate resource measurement must not silently undercount a known caller-owned process set, but process membership remains an external attribution responsibility. PR #72 is bounded resource evidence for test repeatability, while PR #73 adds bounded test-harness process-set evidence from one proc snapshot. Neither discovers production authority, proves task ownership, walks cgroups, samples GPU/VRAM or creates a durable telemetry store, and neither turns the fixture into a product resource adapter.
 
 ## 4. Durable product decisions captured by the canonical graph
 

docs/traceability/action-postcondition-evidence.md

@@ -79,6 +79,14 @@ PR #72 records browser-process RSS, semantic-observation bytes, action latency,
 
 This is resource evidence for the active test harness, not process-set attribution or a product resource adapter. It does not discover Chromium children, prove task ownership or ancestry, walk cgroups, sample GPU/VRAM, or export durable product telemetry.
 
+### PR #73 — bounded Chromium process-set resource evidence
+
+**Capability maturity:** `IMPLEMENTED_ON_ACTIVE_PR`
+
+PR #73 derives a bounded Chromium process count and process-set RSS from one Linux `/proc` snapshot, binding each sampled status file to its directory PID and rejecting proc-entry symlinks. Its cleanup regression double supplies the Chromium count and aggregate RSS surfaces before shutdown failure is exercised, so incomplete process evidence cannot pass incidentally. It also contains the local fixture server within its configured root and records only a bounded failure type when a trial fails.
+
+This remains test-harness evidence, not trusted production process attribution or a product resource adapter. It does not prove cgroup/task ownership, GPU/VRAM accounting, durable telemetry, or the shipped browser runtime's process authority.
+
 ## 4. Non-transitive success semantics
 
 The intended first-slice chain is:
@@ -120,9 +128,10 @@ The first real Chromium vertical slice remains distributed across bounded active
 - PR #65 — controlled hostile local Agent Task workflow fixture; and
 - PR #70 — real WebDriver execution of that fixture on pinned Chrome, without claiming a product browser adapter; and
 - PR #71 — browser-computed role/name evidence before controlled action, without claiming a product semantic observer; and
-- PR #72 — bounded browser-process RSS, semantic-observation byte, latency, and task-duration resource evidence, without claiming process-set attribution or a product resource adapter.
+- PR #72 — bounded browser-process RSS, semantic-observation byte, latency, and task-duration resource evidence, without claiming process-set attribution or a product resource adapter; and
+- PR #73 — bounded Chromium process count and process-set RSS evidence from one proc snapshot, without claiming trusted production process attribution or a product resource adapter.
 
-These active PRs are non-shipped evidence. PR #70/#71/#72 prove bounded browser-level, semantic, and resource evidence, but the active set does not itself compose WebDriver BiDi/CDP transport, OriginWeave authority translation, trusted Chromium process attribution, policy-authorized real input dispatch, causal post-condition observation, or deterministic end-to-end teardown/recovery into one protected-main runtime.
+These active PRs are non-shipped evidence. PR #70/#71/#72/#73 prove bounded browser-level, semantic, and resource evidence, but the active set does not itself compose WebDriver BiDi/CDP transport, OriginWeave authority translation, trusted Chromium process attribution, policy-authorized real input dispatch, causal post-condition observation, or deterministic end-to-end teardown/recovery into one protected-main runtime.
 
 ## 6. Remaining issue #28 boundary