[2026-10-29] eagle: work/projects/cpm-post-release-analysis-2026-10-27.md

work/projects/cpm-post-release-analysis-2026-10-27.md

@@ -380,3 +380,5 @@ Re-cut of the post-release data (macOS 1.213.x, 26–27 Oct, matured since the s
   - Integration tests (real `Tab`, `macOS Integration Tests`, run locally with the signed Debug build), all pass: ordinary load error (`-1003`), SSL error (`NSURLErrorServerCertificateUntrusted`), malicious-site warning (`MaliciousSiteError`, via the `duck://error` redirect). In each, after the failed load the page starts as `.errorPage`, so the monitor never measures it.
   - Harness (`CPMReproCornerCaseTests`, real WebKit, real extension, loopback HTTP), all pass: HTTP Basic auth with accepted credentials (CPM answers) and with a cancelled challenge (401 page, no episode); client redirects at 0.1 s, 2 s, meta refresh and a redirect after the 4 s grace (CPM answers on the target, no episode); PDF, text/plain and JSON documents (CPM answers on all three, content scripts do run on PDF); a Fire-window tab with a non-persistent data store (CPM answers). A 6 s JS timer redirect never fired in a window-less web view (timer throttling), which is a test artefact.
   - Not checked: downloads, http→https upgrade redirects, background or minimised windows, mass tab opening, popups from `about:blank`, closing a tab mid-measurement, iOS error pages, the macOS basic-auth dialog UI itself (by code reading nothing is committed while it is open, and cancel leads to no error page).
+- **More corner cases checked (29 Oct, harness, pass):** a link that becomes a download (`Content-Disposition: attachment`; WebKit fails the provisional navigation with "Frame load interrupted", no document, no episode); 25 tabs loaded at once with cross-origin frames (all finished in 0.8 s, all answered, no episode). Tab close during a measurement is covered by existing monitor unit tests (`testTabCloseCancelsCurrentMeasurement` and two more). iOS (by code reading): SSL/malicious special pages load via `loadSimulatedRequest` for the failed URL, an ordinary document on which CPM answers (same as every simulated page in the harness); other iOS load errors use a native error view, no document. Policy redirects (`.redirect`, used for malicious sites) are exercised by the malicious integration test. Still not testable here: real minimised/occluded windows and App Nap (harness web views have no window and still answer in milliseconds), http→https upgrade through the app's HTTPS upgrade store.
+- **Stable base URL (P3) limited to macOS/iOS 26.6+ (29 Oct, same branch, uncommitted):** `CPMExtensionBaseURLPolicy` has `isSupportedOS` (`guard #available(macOS 26.6, iOS 26.6, *) else { return false }`). On older OS `baseURL(for:)` returns nil (WebKit's random origin) without rotating the stored origin, and `recordBackgroundLoadFailure` does nothing. The 22 existing policy tests pass (this Mac is 26.7.1, CI image is `osx-tahoe-27`); the unsupported branch cannot be exercised on those hosts, so it has no test.