diff --git a/work/projects/cpm-post-release-analysis-2026-10-27.md b/work/projects/cpm-post-release-analysis-2026-10-27.md index bfb04e65..14180aab 100644 --- a/work/projects/cpm-post-release-analysis-2026-10-27.md +++ b/work/projects/cpm-post-release-analysis-2026-10-27.md @@ -1,15 +1,45 @@ --- -title: 'CPM — first post-release data (iOS 7.243.0 / macOS 1.213.0)' +title: CPM — first post-release data (iOS 7.243.0 / macOS 1.213.0) date: '2026-10-27' tags: - work - cpm - analysis +updated: '2026-10-30' --- # CPM: first post-release data, 26 October 2026 Internal metrics; keep these figures out of public PRs. Previous analysis: [[cpm-metrics-causes-and-mitigations-2026-10-16]], [[cpm-status-2026-10-15]] (§3–5, 12–14 October cut). +## Release update — 30 October 2026 + +- **Merged, not yet verified as publicly released:** [iOS #7753](https://github.com/duckduckgo/apple-browsers/pull/7753) into `release/ios/7.244.0` (merge `26a461e30e73608e75e6d84e09bca0ced842993c`) and [macOS #7752](https://github.com/duckduckgo/apple-browsers/pull/7752) into `release/macos/1.214.0` (merge `1e392bac233d7e3e5ccef340ebc82ad7aee72922`). Latest public GitHub releases checked on 30 Oct are still 7.243.0 / 1.213.0. Merge does not establish rollout or production effect. +- **Final stable-origin behavior:** set `baseURL` only on macOS/iOS 26.6+ with the feature flag enabled. Creating a context with an unsupported OS or disabled flag rotates the stored CPM origin and returns `nil` (WebKit chooses the context's origin). Toggling the flag alone does not change a live context; an off→on interval with no intervening context creation does not rotate anything. User reports the remote flag disabled; live remote configuration was not independently audited. +- **Only a storage-key rename:** property `cpmOriginIdentifier` now encodes/decodes JSON key `cpmStableOriginIdentifier`. Old `cpmOriginIdentifier` values are ignored. There is no migration, UUID prefill, OS-version marker or reset on every OS upgrade. Missing new-key value falls back to the already persisted installation `uniqueIdentifier`; this is reuse of that UUID, not creation of a fresh UUID. Subsequent launches reuse it. A later normal rotation saves a replacement under the new key and reuses that replacement. +- **Public-build transition:** 7.243 / 1.213 persist the installation UUID but do not assign it as the extension's baseURL. WebKit chooses a random origin for each new context. The first enabled stable-origin load therefore changes the origin once. An internal build with a replacement saved under the old key falls back to the installation UUID after this key change. +- **Error-page fix:** the health monitor skips error-page commit/finish; macOS maps `.alternateHtmlLoad` to `.errorPage`. These documents no longer start timeout measurements, episodes or M4 reloads. This does not establish what fraction of production wake episodes were error pages. +- **Validation:** the key-only revision passed all 1,025 WebExtensions package tests and strict lint; the final simplified policy suite passed 25 tests, including injected unsupported-OS coverage, with strict lint on both branches. The original release-base error-page change passed three macOS app integration tests (DNS, SSL and malicious-site warning), with a failing negative control when the mapping was removed. Those app tests were not rerun after the key/test-only edits; iOS runtime behavior was not tested. Final branch heads: iOS `fef5f9cdd35977b0cb848ac81f4feaca3e6a9ba6`, macOS `551cb2edd00c02e038b2b46a07a8c32d0b33e666`. +- **Mock follow-up:** the local `StubWebExtensionManager` stays in the release tests by reviewer agreement. Moving them to the shared mock is a [main-branch follow-up](https://app.asana.com/1/137249556945/project/1202406491309510/task/1220003778559454?focus=true). + +### Stable-origin evidence and limits + +The demonstrated benefit is avoiding WebKit's origin-change data cleanup before injection/background startup: real-cache reproductions measured about 1.5 / 10.9 / 32.2 seconds at 20k / 200k / 600k cache entries with changing origins, versus about 0.1 seconds with a stable origin. See [WebKit bug 320812](https://bugs.webkit.org/show_bug.cgi?id=320812) and the reproduction notes below. Production symptom cohorts are not proof that every matching episode has this cause. + +No test demonstrated an extension staying permanently broken after an OS upgrade because its baseURL was saved. A live-session background-process termination did reproduce an error-6 loop that origin rotation recovered. In the real two-process restart baseline, a full app restart restored messaging even while reusing the previous origin. Evidence: `alex/cpm-p3-integration-tests/macOS/IntegrationTests/CPM/README.md`, “two-process” prepare/resume results. Do not turn the live-session failure into a proven persistent-upgrade failure. + +The earlier claim that extension workers were *never* persisted was incorrect. [WebKit commit eff9f9231ad90e31e6ae2b128d2269c589550c8d](https://github.com/WebKit/WebKit/commit/eff9f9231ad90e31e6ae2b128d2269c589550c8d) (312316@main, 29 April 2026) stops new extension service-worker registrations being written to disk; that change does not purge existing records. Historical records are therefore possible, but this does not demonstrate the proposed upgrade failure. + +Pixels can show no response within five minutes, cross-tab failures, error 6 and reload outcomes. They cannot uniquely identify old-origin reuse after an OS upgrade; `base_url_changed` compares contexts within the current process, not across launches. “Permanent” in this analysis means the five-minute reporting outcome, not proof of an unrecoverable extension. + +### OS split of the no-background-view symptom — query on 29 October + +26–28 Oct (metrics date in Eastern time), released iOS 7.243.x / macOS 1.213.x without P3. Count-leg episode rows only, not users: `context_loaded=true AND bg_view_alive=false`, excluding a nonempty `bg_load_error_after` or an `error_[0-9]` event in `bg_events`. + +- iOS: OS <26.6 — 695 of 14,537 failure episodes (4.78%); OS 26.6+ — 27,670 of 97,982 (28.24%). Thus 97.55% of this symptom cohort is on 26.6+. Confirmed no-response subset: 43 / 347 respectively. +- macOS: OS <26.6 — 274 of 13,206 (2.07%); OS 26.6+ — 961 of 29,770 (3.23%). Thus 77.81% of this symptom cohort is on 26.6+. Confirmed no-response subset: 29 / 98 respectively. + +Source: `metrics.pixels`, `pixel_id='web'`, `web.extension.cpm.episode.count%`, agents `ddg_ios` / `ddg_mac_desktop`; OS split by major/minor tuple at (26,6). These are symptom counts, not a causal P3 share or a stable-origin safety comparison. The query was run on 29 Oct; it was not rerun for this documentation update. + ## Priorities — macOS browser-wide breakage first macOS fails far more than iOS, so priorities follow **cross-tab permanent failures on macOS**: CPM not answering in two or more tabs for 5 minutes, confirmed by a repeat or reload. These are browser-wide breakage, not one stuck tab. 26–27 Oct, macOS 1.213: **386 users, 1.85% of DAU**. @@ -25,11 +55,11 @@ Share of macOS cross-tab permanent: idle wake 174 (45%), other 78 (20%), extensi 3. **Other (20%).** No distinguishing signal yet; needs the telemetry from step 1. Not priorities: -- **P3 / origin change:** the baseURL fix is released. Verify its effect on recent context load, post-reload silence and the origin-change patterns (`base_url_changed`) once the build reaches users; no further work planned. +- **P3 / origin change:** the baseURL fix is in the upcoming 7.244 / 1.214 release branches. Public rollout and an enabled flag are prerequisites for measuring its effect; recent context load is not by itself proof of origin-change cleanup. - **P6:** 96% of P6 users have a single failing tab; 122 of its 131 permanent users are single-tab, only 9 cross-tab. One stuck tab, not browser-wide breakage. Low priority; find the trigger when convenient (~37% show `extension_updated` before the failure). - **Error 6 on macOS:** 2 cross-tab users. -iOS (cross-tab permanent 861 users, 0.26% of DAU): recent context load 38% (origin change; covered by the released P3), error 6 20% (error-6 loop: restart the stale background and re-send `init`), extension updated 14% (same fix as macOS step 2), idle wake 14%, other 8%, no background view 5%. +iOS (cross-tab permanent 861 users, 0.26% of DAU): recent context load 38% (a symptom targeted in part by upcoming P3; P3 is absent from this measured release), error 6 20% (error-6 loop: restart the stale background and re-send `init`), extension updated 14% (same fix as macOS step 2), idle wake 14%, other 8%, no background view 5%. ## Summary for the team — 26–27 Oct @@ -48,7 +78,7 @@ Definitions: failure = no CPM dashboard response within 4 s after a page finishe **Persistent mechanisms** (repeat episodes from the same users confirm a stuck state) - **iOS error-6 loop:** error 6 hits 0.86% of iOS DAU, and 10% of those users stay stuck. Stuck users average 7.4 episodes, recovered ones 1.2. In 38% of error-6 episodes the background keeps failing to load on every wake. Matches the stale-failed-background state reproduced in the harness. *Fix: restart the stale background on error 6 and re-send `init` to the page.* -- **Failures after an origin change (`base_url_changed`):** present in 1,733 iOS users (14% permanent, 3× baseline) and 193 macOS users (16%). On macOS these installs fail repeatedly (13–27 episodes per user in the idle-wake patterns, from small groups). The origin change itself causes a 1.5–32 s blackout depending on cache size (reproduced); P3 removes it. *P3 is released; verify its effect.* +- **Failures after an origin change (`base_url_changed`):** present in 1,733 iOS users (14% permanent, 3× baseline) and 193 macOS users (16%). On macOS these installs fail repeatedly (13–27 episodes per user in the idle-wake patterns, from small groups). The origin change itself causes a 1.5–32 s blackout depending on cache size (reproduced); P3 removes it. *P3 is merged into upcoming release branches; verify its effect after public rollout and flag enablement.* - **macOS P6:** 1.6% of DAU, 39% of them permanent, about 2 episodes per user. 96% are a single stuck tab (122 of 131 permanent are single-tab), not browser-wide breakage. ~37% of P6 users show `extension_updated` before the failure, so the mid-session upgrade is a likely trigger. *Fix: find the trigger (upgrade path first), then fix.* **Transient, not a stuck state** @@ -57,12 +87,12 @@ Definitions: failure = no CPM dashboard response within 4 s after a page finishe **Caveats:** two days after release, mostly early updaters (macOS ~17k DAU). Loop figures come from small groups. Not measured yet: retry attempts, events after the first failure, a healthy-navigation baseline. -## What shipped +## What shipped in the measured 7.243.0 / 1.213.0 releases - iOS **7.243.0** (tag 26 Oct 19:23 UTC), macOS **1.213.0** (tag 26 Oct 16:23 UTC). - Both: episode telemetry #7376/#7484, episode tab scope #7520/#7521, P1/P2/P4 recovery #7379/#7536, Network-process recovery #7459/#7531. - macOS only: P5 shared-pinned window close #7473, remote/debug disable #7498. -- **Not shipped:** P3 stable origin #7493 (on main only). **No P6 fix exists in either release**: no PR implements the controller rebind. +- **Absent from these measured releases:** P3 stable origin #7493; it is now in the upcoming 7.244 / 1.214 release branches. **No P6 fix exists in either release**: no PR implements the controller rebind. - Shipped episode contract is the rolled-back variant: `was_stuck` (bool), single-phase `bg_events` (no `;`), plus `tabs_affected`, `repeat_failures`, `interrupted`. No `bg_view_creations`, `context_errors` or `network_restarted`. Old cohort SQL needs adapting (below). - Monitor timing: 4 s response grace; suspended time no longer counts (8 s after resume, 30 s extension-load wait, 5 min deadline). @@ -377,7 +407,7 @@ Re-cut of the post-release data (macOS 1.213.x, 26–27 Oct, matured since the s - **Hypothesis, not verified:** pages that fail to load are shown on every tab after wake from sleep or a network drop. Each would count as a CPM failure right after an idle unload (fresh `dealloc>view>proxy_on`, background ready in under 1 s, healthy diagnostics), in several tabs (cross-tab) and with no answer until a normal navigation (permanent-looking, and M4 would not help). A same-tab second timeout also triggers M4 on a healthy extension (see `was_stuck` note above), which then adds the origin-change blackout. The pixel has no URL, so data cannot separate this; the check has to be an app run (debug build, Wi-Fi off, several tabs, wake) with the monitor log, or filtering `.alternateHtmlLoad` / `duck://error` and comparing wake rates. ### Notes -- The "P3" lines above disagreed. Checked on 29 Oct: `CPMExtensionBaseURLPolicy` is absent from the 1.213.0 and 7.243.0 release tags and present in `release/macos/1.214.0` and `release/ios/7.244.0`. So P3 is not in 1.213 / 7.243 ("What shipped" is right) and ships with 1.214.0 / 7.244.0, which also makes the 26.6+ gate in #7752 / #7753 relevant to those releases. +- **Release status corrected 30 Oct:** P3 is absent from the measured public 1.213.0 / 7.243.0 tags. #7752 / #7753 are merged into the upcoming 1.214.0 / 7.244.0 release branches; public release and remote enablement remain separate checks (see the release update above). - Scratch SQL runner and queries are in the session scratchpad; the harness test is not committed or pushed. ### Addendum 28 Oct — error pages produce the wake signature (replaces the first version of this addendum) @@ -389,10 +419,10 @@ Re-cut of the post-release data (macOS 1.213.x, 26–27 Oct, matured since the s - **Weak evidence against, kept for the record:** per-OS correlation of error pages per install with wake episodes per install is r = 0.02 (n = 9); hourly r = 0.88 for both wake and non-wake (rollout trend, uninformative). - **Unverified:** the running app (the scenario with `log stream --level debug --predicate 'subsystem == "WebExtensions" AND eventMessage CONTAINS "CPM Health Monitor"'`: three tabs idle >30 s, load a dead host in each, expect `timeoutElapsed` without `Dashboard response attributed`); iOS error pages; the share of wake episodes that are error pages (the episode pixel has no URL or error code). - **Decisive options:** (a) macOS build where the monitor ignores error documents (`.alternateHtmlLoad` / failed provisional navigations) and M4 never fires for them; compare wake share and permanent rate with the current build; (b) a flag parameter on the episode pixel (needs the privacy review you wanted to avoid). -- **Fix, tests and PRs (state on 29 Oct):** - - **PRs, same commit:** [#7752](https://github.com/duckduckgo/apple-browsers/pull/7752) into `release/macos/1.214.0` (branch `alex/cpm-error-page-filter`) and [#7753](https://github.com/duckduckgo/apple-browsers/pull/7753) into `release/ios/7.244.0` (branch `alex/cpm-error-page-filter-ios`); reviewer `miasma13`; CI had not started when they were opened. Worktrees `apple-browsers.git/cpm-error-page-filter` and `…-ios`. - - **Commit content:** `CPMNavigationKind.errorPage` and a monitor that does not measure commit/finish of such a navigation (so no timeout, no episode, no M4); macOS maps `.alternateHtmlLoad` to `.errorPage` in `PrivacyDashboardTabExtension.cpmMessagingNavigationKind`; `CPMExtensionBaseURLPolicy.isSupportedOS` (`#available(macOS 26.6, iOS 26.6, *)`) keeps WebKit's random origin below 26.6 without rotating the stored origin; two monitor unit tests; macOS integration tests `CPMErrorPageMonitoringTests` (both Integration Tests targets in the pbxproj). Harness tests and the reproduction suite are not part of it (the harness is not in the release branches). - - **Run results (macOS release base):** 125 package tests (103 monitor, 22 base URL policy) and the 3 integration tests pass; on the iOS release base the same 125 package tests pass. iOS app and iOS tests were not built (no iOS source changed, no exhaustive `switch` on `CPMNavigationKind` there). The old-OS branch of the base URL gate has no test (hosts run 26.6+). +- **Fix, tests and PRs (updated 30 Oct):** + - **PRs merged:** #7752 into macOS 1.214.0 and #7753 into iOS 7.244.0; merge commits and final branch heads are recorded in the release update above. The sibling branches contain the same intended WebExtensions/error-page changes on their respective release bases. + - **Commit content:** error-page monitor filtering and macOS alternate-HTML mapping; OS 26.6+ and flag gate; stored-origin rotation on a disabled/unsupported context load; JSON key rename to `cpmStableOriginIdentifier` with installation-UUID fallback. No migration or OS-version tracking. Harness/reproduction suites are not included. + - **Run results:** key-only revision: all 1,025 package tests passed. Final simplified policy suite: 25 passed, including unsupported-OS coverage; strict lint passed on both branches. Three macOS error-page app integration tests passed before the key/test-only edits, with a negative control; no iOS runtime run. See release update for the exact scope. - **Integration tests** (real `Tab`, `macOS Integration Tests`, run locally with the signed Debug build): ordinary load error (`-1003`), SSL (`NSURLErrorServerCertificateUntrusted`), malicious-site warning (`MaliciousSiteError` via the `duck://error` redirect) all pass. Negative control with the macOS mapping removed: the test fails, the monitor receives `["started:other", "failed", "started:other", "committed:https://testhost.com/", "finished:https://testhost.com/"]`, the error page as an ordinary navigation of the failed URL (the false positive in the app's own `Tab`/`Navigation` path); mapping restored. They use their own `StubWebExtensionManager`; `WebExtensionsTestSupport/MockWebExtensionManaging` exists but that product is not linked to the Integration Tests targets. - **Running locally:** do not build with `CODE_SIGNING_ALLOWED=NO`: the host app then lacks the keychain entitlement (`-34018`) and macOS asks for keychain access. Use the normal signed Debug build, `xcodebuild … test-without-building -only-testing:"Integration Tests/CPMErrorPageMonitoringTests"`. - **Corner cases checked (29 Oct), no further false-positive source found:** diff --git a/work/projects/cpm-status-2026-10-15.md b/work/projects/cpm-status-2026-10-15.md index f638c49a..72cd5475 100755 --- a/work/projects/cpm-status-2026-10-15.md +++ b/work/projects/cpm-status-2026-10-15.md @@ -5,10 +5,21 @@ tags: - work - cpm - status -updated: '2026-10-20' +updated: '2026-10-30' --- # CPM Web Extension: единый статус +## Обновление 30 октября 2026 — release PR merged + +[iOS #7753](https://github.com/duckduckgo/apple-browsers/pull/7753) merged в `release/ios/7.244.0`, [macOS #7752](https://github.com/duckduckgo/apple-browsers/pull/7752) — в `release/macos/1.214.0`. Последние публичные GitHub-релизы при проверке 30 октября — 7.243.0 / 1.213.0: merge не означает rollout или подтверждённый эффект. + +Итог: фильтр error pages; stable baseURL только на ОС 26.6+ при включённом флаге; при создании контекста на неподдерживаемой ОС или с выключенным флагом сохранённый origin ротируется, а WebKit получает `nil`. Само переключение флага живой контекст не меняет. Ключ JSON изменён с `cpmOriginIdentifier` на `cpmStableOriginIdentifier`; миграции, автозаполнения UUID и хранения версии ОС нет. Без нового ключа используется уже сохранённый installation UUID, который далее переиспользуется; обычная ротация сохраняет замену под новым ключом. + +Невосстановимая поломка после обновления ОС из-за сохранённого baseURL не доказана. В двухпроцессном baseline перезапуск восстановил messaging даже с прежним origin. Историческое утверждение «extension workers никогда не писались на диск» исправлено: upstream запретил новые записи, но этим изменением старые не удаляются. + +Полный итог, проверенные тесты, merge commits и OS-разрез данных 26–28 октября: [[cpm-post-release-analysis-2026-10-27#Release update — 30 October 2026]]. Ниже остаются датированные исторические срезы; их open/shipped-статусы не заменяют это обновление. + + > **P5 #7473 — merged 20 октября 2026, 14:17:11 Бишкек (08:17:11 UTC):** [merge `9bcce0264e`](https://github.com/duckduckgo/apple-browsers/commit/9bcce0264e60ef79b98c1b8aeb23ef9f26c45bc0) в `release/macos/1.213.0`, финальный PR head `574e9288ae`. Фикс shared-pinned window close включён по умолчанию и имеет remote failsafe. Подробности реализации, review и проверок — [[cpm-status-2026-10-15#P5 — merged 20 октября 2026]]. Merge в release branch подтверждён; публикация сборки, rollout и production effect этим не установлены. Эта сверка касается #7473. > **#7379 — независимый P2 flag, 20 октября 2026:** production `55a42802a6`, harness `a6e6835a5f`; новый `webExtensions.cpmBackgroundLoadRecovery` **default ON на iOS/macOS** отделяет same-context error-6 retry от `cpmMessagingHangRecovery` (full-context restart). **271 selected unit PASS**, 47 новых shared regression methods; четыре новых independence regressions дают 4 FAIL с прежними связанными проверками и PASS с новым flag. Signed macOS harness и полный iOS app build PASS. CI нового head: 39 SUCCESS / 13 SKIPPED / 4 IN_PROGRESS, без failures (20 октября, 14:16 UTC). Late GET reload по-прежнему default OFF; P4 detection независим. Подробности — в последнем разделе про independent P2 flag. diff --git a/work/projects/cpm-web-extension-breakage-findings.md b/work/projects/cpm-web-extension-breakage-findings.md index 94d242b4..d54184c4 100755 --- a/work/projects/cpm-web-extension-breakage-findings.md +++ b/work/projects/cpm-web-extension-breakage-findings.md @@ -7,10 +7,12 @@ tags: - cpm - webkit - web-extension -updated: '2026-10-20' +updated: '2026-10-30' --- # CPM Web Extension Breakage Findings +> **Актуализация 30 октября 2026:** #7752 / #7753 merged в release 1.214 / 7.244; публикация и эффект ещё не подтверждены. Только rename JSON key, без миграции UUID и OS-version tracking; без нового ключа используется installation UUID. Ошибочное утверждение ниже о том, что extension workers никогда не сохранялись, исправлено. Текущий итог и границы доказательств: [[cpm-post-release-analysis-2026-10-27#Release update — 30 October 2026]]. Остальные датированные разделы сохраняют историю исследования. + > **Актуальный контекст — 20 октября 2026.** Это исторический журнал source audit, ручных repro и отозванных гипотез. Его «нет фикса», local-only, bundle/OS и CI states относятся к датам записей; текущие heads и gates — [[cpm-status-2026-10-15#2. PR и quality gates]]. > > Опубликованы отдельные реализации P1/P2/P4 (#7379), Network recovery (#7459), P3 stable origin (#7493) и shared-pinned P5 (#7473). **#7473 merged 20 октября в `release/macos/1.213.0` (`9bcce0264e`)**, с default-ON failsafe; детали и отдельные app tests — [[cpm-status-2026-10-15#P5 — merged 20 октября 2026]]. Merge не доказывает rollout, shipped effect или всю production causal share. #7376 с единым episode report закрыт без merge. Его `bg_events` теперь продолжается до первого stuck, имеет `;`/`...`, но общий budget может вытеснить initial history. Реальная потеря начала подтверждена агрегатами production (§6 основного статуса). @@ -270,7 +272,7 @@ The following ideas do not yet have a traced path into a stable stuck state: They may alter timing or storage pressure, but should not be presented as reproduction scenarios without a corresponding failing handler sequence or production trace. -Safari 26.6 includes a fix for service-worker registration database files accumulating on launch, and WebKit has also fixed cold-launch cleanup that delayed extension content injection. **[corrected]** The registration-database fix is irrelevant here: extension service workers are never persisted (`SWServerWorker::shouldPersistToDisk` returns false for service-worker-page registrations) and the registration is cleared whenever the SW page client goes away. +**Correction, 30 October 2026:** the earlier “extension service workers are never persisted” statement was too broad. [WebKit commit eff9f9231ad90e31e6ae2b128d2269c589550c8d](https://github.com/WebKit/WebKit/commit/eff9f9231ad90e31e6ae2b128d2269c589550c8d) (312316@main, 29 April 2026, “Stop persisting service workers from browser extensions to disk”) adds a filter for new persistence writes; that change does not purge old registration records. Older WebKit could persist them. This establishes possible historical records, not a reproduced permanent breakage after an OS upgrade. A live-session background-process termination reproduced an error-6 loop recoverable by changing origin, whereas the real two-process restart baseline restored messaging even with the previous origin reused. See `alex/cpm-p3-integration-tests/macOS/IntegrationTests/CPM/README.md` and [[cpm-post-release-analysis-2026-10-27#Stable-origin evidence and limits]]. Avoid inferring either “old records cannot exist” or “saving the origin permanently breaks upgrading users” from the current evidence. ## Evidence needed next diff --git a/work/projects/cpm-web-extension-code-guide-2026-10-09.md b/work/projects/cpm-web-extension-code-guide-2026-10-09.md index d382174b..d02296e7 100755 --- a/work/projects/cpm-web-extension-code-guide-2026-10-09.md +++ b/work/projects/cpm-web-extension-code-guide-2026-10-09.md @@ -5,10 +5,25 @@ tags: - work - cpm - webkit -updated: '2026-10-20' +updated: '2026-10-30' --- # CPM Web Extension — карта кода по worktree и строкам +## Актуализация 30 октября 2026 + +Release PR merged: [iOS #7753](https://github.com/duckduckgo/apple-browsers/pull/7753), head `fef5f9cdd35977b0cb848ac81f4feaca3e6a9ba6`, worktree `cpm-error-page-filter-ios`; [macOS #7752](https://github.com/duckduckgo/apple-browsers/pull/7752), head `551cb2edd00c02e038b2b46a07a8c32d0b33e666`, worktree `cpm-error-page-filter`. + +Актуальные точки входа: +- `SharedPackages/WebExtensions/Sources/WebExtensions/Loading/InstalledWebExtension.swift`: `CodingKeys.cpmOriginIdentifier = "cpmStableOriginIdentifier"`; старый ключ игнорируется. Миграции и OS-version marker нет. +- `Loading/CPMExtensionBaseURLPolicy.swift` в том же модуле: installation-UUID fallback; stable URL при OS 26.6+ и включённом флаге; иначе ротация сохранённого origin и `nil` при создании контекста. Обычная ротация сохраняет новый UUID. +- `Autoconsent/CPMMessagingHealthMonitor.swift`: `.errorPage` исключён из измерения commit/finish. +- `macOS/DuckDuckGo/Tab/TabExtensions/PrivacyDashboardTabExtension.swift`: `.alternateHtmlLoad` → `.errorPage`. +- `CPMExtensionBaseURLTests.testUnsupportedOSReturnsNilAndRotatesSavedOrigin`: проверяет nil и замену сохранённого UUID через injected OS predicate. Финальная policy suite: 25 PASS; полный package run key-only revision: 1,025 PASS. +- `macOS/IntegrationTests/Tab/CPMErrorPageMonitoringTests.swift`: DNS, SSL, malicious warning; три PASS на исходной release-base реализации, отрицательный контроль без mapping падает. Shared-mock cleanup отложен на main; iOS runtime не проверялся. + +Статус публикации, ограничения доказательств и поведение при первом stable load: [[cpm-post-release-analysis-2026-10-27#Release update — 30 October 2026]]. Нижние ссылки на старые ветки/строки — исторические срезы, не актуальный release diff. + + > **#7379 — независимый P2 flag, 20 октября 2026:** production `55a42802a6`, harness `a6e6835a5f`; новый `webExtensions.cpmBackgroundLoadRecovery` **default ON на iOS/macOS** отделяет same-context error-6 retry от `cpmMessagingHangRecovery` (full-context restart). **271 selected unit PASS**, 47 новых shared regression methods; четыре новых independence regressions дают 4 FAIL с прежними связанными проверками и PASS с новым flag. Signed macOS harness и полный iOS app build PASS. CI нового head: 39 SUCCESS / 13 SKIPPED / 4 IN_PROGRESS, без failures (20 октября, 14:16 UTC). Late GET reload по-прежнему default OFF; P4 detection независим. Подробности — в последнем разделе про independent P2 flag. **Проверено 20 октября 2026:** карта ниже отражает существующие worktree и опубликованные heads; старые line numbers и результаты в архивных разделах относятся к своим ревизиям. PR/CI — [[cpm-status-2026-10-15#2. PR и quality gates]]. Пользовательский dirty `Package.resolved` в telemetry worktree сохранён. @@ -22,7 +37,7 @@ updated: '2026-10-20' - **macOS telemetry:** `alex/cpm-telemetry-macos-release`, ветка `alex/cpm-messaging-readiness-telemetry-macos-release`, **`3fb13b81fe`**, #7484. Старый `was_stuck`, без двухфазного timeline; release-base conflict. Это не идентичная копия текущего #7376. - **P1/P2/P4:** `alex/cpm-fix-init-loss-production`, `alex/cpm-fix-init-loss`, **`674bb809f2`**, #7379 на telemetry branch. Главные точки — `Manager/WebExtensionManager.swift`, `Autoconsent/CPMBackgroundReadinessRecovery.swift` и `Pixels/WebExtensionPixelFiring.swift` внутри WebExtensions Sources. Independent `startup_response_missing` не зависит от default-OFF late reload; recovery outcomes не являются page ACK. CI BSK красный. Отдельный app harness — `alex/cpm-fix-p1-p2`, `codex/cpm-fix-init-loss-integration-tests`. - **Network recovery:** `alex/cpm-network-process-recovery`, **`f41c7b7047`**, #7459 на telemetry branch; [watch/restart](/Users/admin/DuckDuckGo/apple-browsers.git/alex/cpm-network-process-recovery/SharedPackages/WebExtensions/Sources/WebExtensions/Lifecycle/CPMNetworkProcessRecovery.swift), manager wiring и `CPMNetworkProcessRecoveryTests.swift`. Applied pixel в metadata/обоих definitions: daily+count, no custom params, только после принятого restart. Нет доказательства recovery и нет `network_replaced_since_view` в episode. Harness: `alex/cpm-network-process-integration-tests`, `codex/cpm-network-process-integration-tests`. -- **P3 stable origin:** `alex/cpm-p3-stable-base-url`, **`dd96018da9`**, #7493 на telemetry branch; production default ON, remote kill switch. Это уже опубликованный ограниченный CPM origin policy, не старый глобальный M2 prototype. Harness `alex/cpm-p3-integration-tests`, `codex/cpm-p3-integration-tests`; full P3 failure остаётся невоспроизведённым. +- **P3 stable origin (история):** исходная ветка `alex/cpm-p3-stable-base-url`, `dd96018da9`, #7493. Актуальный release diff — #7752 / #7753 (см. обновление 30 октября выше). В коде есть default-ON и remote kill switch; live remote config этим не проверен. Harness: `alex/cpm-p3-integration-tests`, `codex/cpm-p3-integration-tests`. Задержка при смене origin воспроизведена с реальным HTTP cache; доля production failures от этого механизма не доказана. - **P5 shared pinned close:** [#7473](https://github.com/duckduckgo/apple-browsers/pull/7473) **MERGED 20 октября 2026** в `release/macos/1.213.0`, [merge `9bcce0264e`](https://github.com/duckduckgo/apple-browsers/commit/9bcce0264e60ef79b98c1b8aeb23ef9f26c45bc0); финальный reviewed/tested head **`574e9288ae`**, worktree `alex/cpm-p5-pinned-window-close`. Default ON + remote failsafe, CI зелёный. Harness остаётся отдельно: `alex/cpm-p5-integration-tests`, `codex/cpm-p5-release-integration-tests` @ `add6e514fe`. Один доказанный tab-lifecycle mechanism; rollout не подтверждён. - **Большой rewrite:** `alex/cpm-episode-telemetry`, **`7e8128c94f`** — альтернативный prototype, **не** реализация #7376. Не читать `CPMEpisodeTelemetry.swift`/`CPMEpisodeSummary.swift` как текущий PR. - Старый самостоятельный harness #7378 и baseline #7384 закрыты без merge. Native progress #7385 и JS #3727 открыты и не встроены в #7376; end-to-end delivery требует обеих сторон и обновлённого extension bundle.