9.4 KiB
CPM Web Extension Breakage — статус и PR-план
Актуально на 2026-09-23. Полная трассировка: cpm-web-extension-breakage-findings.
Experiment Definition: cpm-background-graveyard-experiment-definition. 2026-09-25 source audit: cpm-service-worker-architecture-and-diagnostics. Earlier readiness/test results below are historical, not validation of the newly identified gaps. Additional gates: M2 stable-origin + M5/M6 reload/Fire interaction; worker exception contract; distinguish dashboard response from actual page initialization. No new device tests were run for this audit.
Решение
Есть два независимых класса проблем:
- Per-tab lifecycle исправлен в M1 и уже merged.
- All-tabs CPM outage: M3 telemetry merged; M4 hung recovery и объединённый M5+M6 graveyard A/B — независимые follow-up PRs.
M4 перезагружает Web Extensions при первом сигнале hung, который подтверждает global CPM outage после предшествующего messaging init failure. Сам messaging init failure остаётся диагностическим: он не меняет состояние расширений.
Статус проблем
| Проблема | Статус | Что делаем |
|---|---|---|
| Forced background-process death → persistent all-tabs CPM outage | Подтверждено | M3 измеряет production incidence; объединённый M5+M6 PR лечит и сравнивает control/treatment. |
| Natural crash/memory/CPU termination → production outage | Не проверено в production | Один production release M3 до включения M5/M6. |
| Close Other Tabs, popup duplicate, pin/unpin/reorder/move/merge/window close | Исправлено, merged | M1 PR #6827. |
| Нестабильный Web Extension base URL | Исправлено локально | M2 задаёт deterministic base URL до load/reload и отвергает malformed identifier без crash. |
| Startup/session-restore content-script miss | Подтверждено как transient | Не объясняет persistent all-tabs outage. |
| Failed background load навсегда блокирует WebKit | Отвергнуто | WebKit повторяет load; нужна повторяемая причина/traffic. |
| Critical memory pressure как root cause | Не воспроизведено | Остаётся diagnostic correlation M3. |
| Event starvation / JSC hang / native messaging stall | Не проверено | Остаётся в M3 diagnostic buckets. |
| Network process restart | Отвергнуто | На проверенной сборке CPM восстановился. |
| removeAllUserScripts / flag transition / scriptlet reload / page JS как all-tabs cause | Отвергнуто | Это не persistent global failure mode. |
Milestones
| Milestone | Branch / worktree | Готовность |
|---|---|---|
| M1 tab lifecycle | codex/cpm-tab-lifecycle-fixes |
Merged: PR #6827, CI green. |
| M2 stable base URL | alex/cpm-stable-base-url — /Users/admin/DuckDuckGo/apple-browsers.git/cpm-stable-base-url |
Production-ready: 2 files; 11/11 targeted tests. Добавлена safe URL construction и negative validation вместо force-unwrap. |
| M3 attribution telemetry | alex/cpm-failure-telemetry — /Users/admin/DuckDuckGo/apple-browsers.git/cpm-failure-telemetry |
Merged 2026-09-23: PR #6844, CI green. Bucketed diagnostics, app launch/version attribution, extension_updated, base_url_changed, recovery_from, reload-error pixel; recorder и proxy имеют отдельные flags. cpm-m3-telemetry-privacy-triage. |
| M4 hung recovery | codex/cpm-hung-recovery — /Users/admin/DuckDuckGo/apple-browsers.git/cpm-hung-recovery |
In progress: первый messaging init failure открывает diagnostic episode; первый последующий hung перезагружает Web Extensions. |
| M5+M6 graveyard mitigation + A/B | alex/cpm-graveyard-mitigation — /Users/admin/DuckDuckGo/apple-browsers.git/cpm-graveyard-mitigation |
Production-ready, default off; one PR over merged M3: one retained view maximum, 3-second bounded hold, weak scheduled release, runtime cleanup, lazy stable cohort enrollment, control/treatment isolation, bounded pending outcomes, operational and experiment pixels. 431/431 WebExtensions tests; iOS/macOS builds and pixel validators pass; earlier real forced-kill iOS E2E recovered with release at ≈3.15 s. |
| M7 state-restoration readiness gate | alex/cpm-state-restoration-race — /Users/admin/DuckDuckGo/apple-browsers.git/cpm-state-restoration-race |
Production-ready locally from current origin/main (b93091e769): restored main-frame HTTP(S) navigation waits for initial Web Extension loadAndSync, bounded by withTimeout(3) in decidePolicy. Timeout cancels only the cancellation-aware waiter; the underlying load continues and its retained task is cleared on completion/cancellation. Swift package and macOS Browser test builds pass. Targeted tests: 20/20 coordinator and 4/4 navigation-gate, including a non-cooperative load hang, waiter timeout, and late load completion. |
All milestone diffs pass git diff --check; changed Swift lines are within 150 columns.
M7 plan — state restoration / Web Extension load race
Confirmed race: setupWebExtensions() creates the manager/controller before state restoration, but starts WebExtensionLifecycleCoordinator.loadAndSync() without awaiting it. stateRestorationManager.applicationDidFinishLaunching() runs immediately afterward. A restored tab can therefore begin its main-frame navigation while the CPM WKWebExtensionContext is not loaded, so WebKit cannot inject the CPM content script at document start. The existing Content Blocking navigation responder already waits for internal user scripts and rule lists; M7 adds the equivalent readiness boundary for Web Extensions.
- Retain only the first coalesced
loadAndSynctask inWebExtensionLifecycleCoordinator, clear it on completion/cancellation, and expose a cancellation-aware waiter that never cancels the underlying load. - Inject that waiter into tab extensions. In the
decidePolicypath, wrap it in the projectwithTimeout(3)helper before allowing main-frame HTTP(S) navigation to proceed. Timeout is fail-open and cancels only the waiter. - Keep the wait startup-only: once initial
loadAndSyncfinishes, later navigations pass immediately. Non-web and subframe navigations do not wait. - Cover blocking/release/cancellation, a non-cooperative underlying load hang, late load completion, the three-second default, and navigation scope with unit tests.
- Acceptance: restored page loading normally waits for extension context readiness; a hung load cannot hold
decidePolicybeyond three seconds; disabled/cancelled startup work and normal post-launch navigation do not add a persistent wait.
Stack and Git state
M3 merged: PR #6844, merge commit 2d58ad8cf4fae728a92e2aae0d3ec6073ddf49f2.
M2 — independent stable-base-URL fix. Вошедший в M3 base_url_changed только сообщает о смене URL между загрузками контекста с одинаковым identifier; URL и identifier не отправляются. Это не фикс M2.
Stacked PRs:
M3 telemetry — merged into origin/main
├── M4 hung recovery
└── M5+M6 graveyard mitigation + A/B — one PR
M5+M6 объединены на origin/main (2d58ad8cf4fae728a92e2aae0d3ec6073ddf49f2) без commit: в worktree лежат 19 unstaged файлов mitigation и A/B. Старый M6 worktree сохранён только как источник/backup и не является отдельным PR. M4 не изменён.
Не включать generated Package.resolved churn.
Experiment contract
- Experiment:
cpmBackgroundGraveyardExperiment. - Cohorts:
control,treatment. - Enrollment: only on an actual eligible CPM background-process termination.
- Primary framework metric:
cpmBackgroundGraveyardOutcome, window0...1, valueshealthy,initialization_failed,not_measured. - Rollback: disable both
cpmBackgroundGraveyardExperimentandcpmBackgroundGraveyard.
Full definition and config draft: cpm-background-graveyard-experiment-definition.
Remaining gates
- Обновить и проверить M4 поверх merged M3. Открыть M2, M4 и объединённый M5+M6 PRs в topology выше.
- Create separate iOS and macOS experiment-log tasks.
- Create Privacy Configuration + privacy/schema review tasks.
- Create Data Science sample-size/design and Native Apps Experiment Analysis task.
- Ship M3 first; enable M5/M6 only if production telemetry confirms the process-death hypothesis.
M3 merged, но ещё не подтверждён как shipped production release. Feature flag registry tasks созданы отдельно для iOS/macOS; ссылки — в cpm-m3-telemetry-privacy-triage. Это обновление затрагивает только Obsidian.