ai-dev-browser 0.58.2__tar.gz → 0.58.3__tar.gz

{ai_dev_browser-0.58.2 → ai_dev_browser-0.58.3}/.github/workflows/ci.yml

@@ -167,13 +167,13 @@ jobs:
         env:
           AI_DEV_BROWSER_CHROME: ${{ steps.chrome.outputs.chrome-path }}
           AI_DEV_BROWSER_TEST_EXTENSION_CHROME: ${{ steps.chrome.outputs.chrome-path }}
-        run: xvfb-run -a -s "-screen 0 1280x1000x24" python -m pytest -v --full-trace -o faulthandler_timeout=180 tests/integration/test_remote_view.py tests/integration/test_remote_selection_live.py tests/integration/test_remote_vnc.py tests/integration/test_browser_control_live.py tests/integration/test_browser_session_live.py tests/integration/test_browser_files_live.py tests/integration/test_browser_worker_live.py tests/integration/test_existing_worker_live.py tests/integration/test_navigation_startup.py --basetemp remote-results
+        run: xvfb-run -a -s "-screen 0 1280x1000x24" python -m pytest -v --full-trace -o faulthandler_timeout=180 tests/integration/test_remote_view.py tests/integration/test_discovery_socket_pressure.py tests/integration/test_remote_selection_live.py tests/integration/test_remote_vnc.py tests/integration/test_browser_control_live.py tests/integration/test_browser_session_live.py tests/integration/test_browser_files_live.py tests/integration/test_browser_worker_live.py tests/integration/test_existing_worker_live.py tests/integration/test_navigation_startup.py --basetemp remote-results
       - name: Run page and extension workflows on Windows
         if: runner.os == 'Windows'
         env:
           AI_DEV_BROWSER_CHROME: ${{ steps.chrome.outputs.chrome-path }}
           AI_DEV_BROWSER_TEST_EXTENSION_CHROME: ${{ steps.chrome.outputs.chrome-path }}
-        run: python -m pytest -v --full-trace -o faulthandler_timeout=180 tests/integration/test_remote_view.py tests/integration/test_remote_selection_live.py tests/integration/test_browser_control_live.py tests/integration/test_browser_session_live.py tests/integration/test_browser_files_live.py tests/integration/test_browser_worker_live.py tests/integration/test_existing_worker_live.py tests/integration/test_navigation_startup.py --basetemp remote-results
+        run: python -m pytest -v --full-trace -o faulthandler_timeout=180 tests/integration/test_remote_view.py tests/integration/test_discovery_socket_pressure.py tests/integration/test_remote_selection_live.py tests/integration/test_browser_control_live.py tests/integration/test_browser_session_live.py tests/integration/test_browser_files_live.py tests/integration/test_browser_worker_live.py tests/integration/test_existing_worker_live.py tests/integration/test_navigation_startup.py --basetemp remote-results
       - name: Retain real viewer evidence
         if: always()
         uses: actions/upload-artifact@v4
@@ -193,7 +193,7 @@ jobs:
         run: docker build -f deploy/managed-chrome/Dockerfile --secret "id=extension_key,src=$RUNNER_TEMP/extension-fixture.pem" --build-arg "SOURCE_REVISION=$GITHUB_SHA" -t adb-managed-chrome:ci .
       - name: Run real signed extension, handoff and viewer workflows
         run: |
-          docker create --name "adb-managed-live-$GITHUB_RUN_ID" --memory=1536m --shm-size=256m --pids-limit=384 \
+          docker create --init --name "adb-managed-live-$GITHUB_RUN_ID" --memory=1536m --shm-size=256m --pids-limit=384 \
             --mount "type=bind,source=$PWD/tests,target=/opt/browser/tests,readonly" \
             adb-managed-chrome:ci /bin/sleep infinity
           docker start "adb-managed-live-$GITHUB_RUN_ID"
@@ -301,11 +301,16 @@ jobs:
             extension-results/**/installed-extension.png
             extension-results/**/extension-startup-evidence.json
             extension-results/**/extension-chrome.log
+            extension-results/**/host-resources-*.json
+            extension-results/**/navigation-readiness.json
             extension-results/**/extension-cleanup-stacks.txt
             native-ownership-results/**
             native-window-results/**/native-window-evidence.json
             native-window-results/**/native-window-accepted.png
             native-window-results/**/extension-chrome.log
+            native-window-results/**/host-resources-*.json
+            native-window-results/**/extension-cleanup-evidence.json
+            native-window-results/**/extension-cleanup-stacks.txt
             previous-extension-results/**/previous-extension-evidence.json
 
   # ─────────────────────────────────────────────────────────────────────

{ai_dev_browser-0.58.2 → ai_dev_browser-0.58.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ai-dev-browser
-Version: 0.58.2
+Version: 0.58.3
 Summary: A browser for AI to develop web automation — human-like automation that works seamlessly in a world designed for humans
 Author: sudoprivacy
 License: AGPL-3.0

{ai_dev_browser-0.58.2 → ai_dev_browser-0.58.3}/ai_dev_browser/core/ext_bridge.py

@@ -440,7 +440,7 @@ def _launch_page(connection_or_path, request_or_headers):
     path = connection_or_path if legacy else request_or_headers.path
     if not re.fullmatch(r"/adb-launch/[a-f0-9]{32}", path):
         return None
-    body = "<!doctype html><meta charset=utf-8><title>Connecting AI Dev Browser</title><p>Waiting for the configured browser extension.</p>"
+    body = "<!doctype html><meta charset=utf-8><title>AI Dev Browser</title><p>This window is reserved for your browser task.</p>"
     if legacy:
         return (
             HTTPStatus.OK,

{ai_dev_browser-0.58.2 → ai_dev_browser-0.58.3}/ai_dev_browser/core/port.py

@@ -1,7 +1,7 @@
 """Port management for Chrome debugging.
 
-Discovery uses port scanning + CDP (no process enumeration):
-  1. Scan port range for listening ports (socket.connect)
+Discovery uses the OS listener table + CDP (no process enumeration):
+  1. Read listening ports, with bounded probes on unsupported hosts
   2. Hit /json/version to confirm Chrome debug port
   3. CDP Browser.getBrowserCommandLine() to read workspace tag
 
@@ -11,6 +11,7 @@ Example:
 """
 
 import ipaddress
+import errno
 import json
 import logging
 import os
@@ -146,7 +147,10 @@ def _query_chrome_version(
 
 
 def _guid_from_version(info: dict) -> str | None:
-    m = _BROWSER_GUID_RE.search(info.get("webSocketDebuggerUrl", "") or "")
+    url = info.get("webSocketDebuggerUrl")
+    if not isinstance(url, str):
+        return None
+    m = _BROWSER_GUID_RE.search(url)
     return m.group(1) if m else None
 
 
@@ -174,9 +178,13 @@ def _resolve_instance(
     so the CDP cmdline is populated) or by an older build.
     """
     info = _query_chrome_version(port, host, timeout)
-    if info is None:
+    if not isinstance(info, dict):
         return None
     guid = _guid_from_version(info)
+    if not guid:
+        # An unrelated local HTTP service can also return JSON at this path.
+        # It has no browser identity and must not become a CDP candidate.
+        return None
 
     from . import registry
 
@@ -454,32 +462,65 @@ def _fast_listening_check(
         return False
 
 
+def _listening_ports(port_range: tuple[int, int]) -> list[int] | None:
+    """Read local IPv4 listeners without opening sockets to every candidate.
+
+    Some hosts do not expose their socket table to ordinary users. Retain the
+    existing probe path there, without changing process privileges. Resource
+    exhaustion must propagate instead of triggering more socket allocation.
+    """
+    import psutil
+
+    try:
+        connections = psutil.net_connections(kind="tcp4")
+    except OSError as error:
+        if (
+            error.errno in (errno.ENOBUFS, errno.ENOMEM, errno.EMFILE, errno.ENFILE)
+            or getattr(error, "winerror", None) == 10055
+        ):
+            raise
+        return None
+    except (psutil.Error, NotImplementedError):
+        return None
+    return sorted(
+        {
+            connection.laddr.port
+            for connection in connections
+            if connection.status == psutil.CONN_LISTEN
+            and connection.laddr
+            and connection.laddr.ip in (DEFAULT_DEBUG_HOST, "0.0.0.0")
+            and port_range[0] <= connection.laddr.port < port_range[1]
+        }
+    )
+
+
 def _scan_ports_for_chrome(
     port_range: tuple[int, int],
-    listening_workers: int = 256,
+    listening_workers: int = 16,
     cdp_workers: int = 16,
     cdp_timeout: float = 0.5,
 ) -> list[tuple[int, int | None, str | None]]:
     """Scan a port range for Chrome debug instances (parallelized).
 
     Two stages:
-      1. Parallel _fast_listening_check() — filter down to listening ports
-         (bind-first + tight-timeout IPv4 connect, no IPv6)
+      1. OS listener inventory; bounded IPv4 probes only when unavailable
       2. Parallel _resolve_instance() — verify each is Chrome (via
          /json/version) and read its workspace from the instance registry
          (GUID-matched), falling back to Browser.getBrowserCommandLine
 
-    Wide worker counts and short timeouts keep scans of the full OS
-    ephemeral range (~14-16k ports) under 2s.
+    Listener inventory avoids hundreds of probe threads and empty TCP
+    connections. The fallback keeps a bounded worker count.
     """
     ports = list(range(port_range[0], port_range[1]))
 
-    with ThreadPoolExecutor(max_workers=listening_workers) as pool:
-        listening = [
-            p
-            for p, live in pool.map(lambda p: (p, _fast_listening_check(p)), ports)
-            if live
-        ]
+    listening = _listening_ports(port_range)
+    if listening is None:
+        with ThreadPoolExecutor(max_workers=listening_workers) as pool:
+            listening = [
+                p
+                for p, live in pool.map(lambda p: (p, _fast_listening_check(p)), ports)
+                if live
+            ]
 
     if not listening:
         return []

{ai_dev_browser-0.58.2 → ai_dev_browser-0.58.3}/ai_dev_browser/extension/background.js

@@ -243,7 +243,6 @@ async function ensureDedicatedTabSelected() {
     if (marker) {
       launchToken = launchMarker(marker);
       await chrome.storage.session.set({ adbLaunchToken: launchToken });
-      await chrome.tabs.update(marker.id, { url: "about:blank" });
     }
     mainTabId = t.id;
     claim(t.id);
@@ -300,7 +299,9 @@ function adoptLaunch(tab) {
     await chrome.storage.session.set({ adbLaunchToken: token });
     claim(tab.id, null, "launch");
     await attachTab(tab.id);
-    await chrome.tabs.update(tab.id, { url: "about:blank" });
+    // The nonce page already belongs to this launch. Keep it until the caller
+    // navigates: an extra startup navigation can invalidate Chrome's debugger
+    // target after the ownership handshake has announced readiness.
     if (old != null && old !== tab.id && autoTabs.has(old)) {
       const previous = await chrome.tabs.get(old).catch(() => null);
       if (previous && previous.url === "about:blank") {

{ai_dev_browser-0.58.2 → ai_dev_browser-0.58.3}/ai_dev_browser/extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "AI Dev Browser — bridge",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "storage": { "managed_schema": "managed-schema.json" },
   "description": "Lets ai-dev-browser drive THIS Chrome (your real profile) via chrome.debugger over a local bridge. Opt-in; only active while ai-dev-browser is connected.",
   "minimum_chrome_version": "116",

{ai_dev_browser-0.58.2 → ai_dev_browser-0.58.3}/ai_dev_browser/remote/page_view.js

@@ -1,6 +1,6 @@
 /** A reusable pixel surface. The host owns authentication and control policy. */
 export class PageSurface {
-  constructor(image, send, { drag = false } = {}) {
+  constructor(image, send, { drag = false, touchDrag = false } = {}) {
     this.image = image;
     this.send = send;
     this.width = 0;
@@ -15,7 +15,7 @@ export class PageSurface {
       const point = this.point(event);
       if (!point) return;
       this.pointer = { id: event.pointerId, lastY: event.clientY, startY: event.clientY, startX: event.clientX,
-        moved: false, drag: drag && event.pointerType !== 'touch', points: [point] };
+        moved: false, drag: drag && (event.pointerType !== 'touch' || touchDrag), points: [point] };
       image.setPointerCapture(event.pointerId);
       image.focus({ preventScroll: true });
     });

{ai_dev_browser-0.58.2 → ai_dev_browser-0.58.3}/ai_dev_browser.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ai-dev-browser
-Version: 0.58.2
+Version: 0.58.3
 Summary: A browser for AI to develop web automation — human-like automation that works seamlessly in a world designed for humans
 Author: sudoprivacy
 License: AGPL-3.0

{ai_dev_browser-0.58.2 → ai_dev_browser-0.58.3}/ai_dev_browser.egg-info/SOURCES.txt

@@ -238,6 +238,7 @@ tests/integration/conftest.py
 tests/integration/extension_ownership_support.py
 tests/integration/extension_window_support.py
 tests/integration/live_cleanup.py
+tests/integration/live_resources.py
 tests/integration/native_window_occluder.py
 tests/integration/navigation_startup_support.py
 tests/integration/pdf_readiness_support.py
@@ -279,6 +280,7 @@ tests/integration/test_cookies_extract_windows.py
 tests/integration/test_cookies_import.py
 tests/integration/test_dialog_auto.py
 tests/integration/test_dialog_respond.py
+tests/integration/test_discovery_socket_pressure.py
 tests/integration/test_dom_discovery.py
 tests/integration/test_download_link.py
 tests/integration/test_download_link_frame.py
@@ -341,6 +343,7 @@ tests/unit/test_cli_error_envelope.py
 tests/unit/test_cli_param_type.py
 tests/unit/test_cli_steering_contract.py
 tests/unit/test_demo_encoding.py
+tests/unit/test_discovery_budget.py
 tests/unit/test_extension_ownership.py
 tests/unit/test_find_hint.py
 tests/unit/test_launch_window_size.py

{ai_dev_browser-0.58.2 → ai_dev_browser-0.58.3}/ai_dev_browser.egg-info/scm_file_list.json

@@ -233,6 +233,7 @@
     "tests/integration/extension_ownership_support.py",
     "tests/integration/extension_window_support.py",
     "tests/integration/live_cleanup.py",
+    "tests/integration/live_resources.py",
     "tests/integration/native_window_occluder.py",
     "tests/integration/navigation_startup_support.py",
     "tests/integration/pdf_readiness_support.py",
@@ -274,6 +275,7 @@
     "tests/integration/test_cookies_import.py",
     "tests/integration/test_dialog_auto.py",
     "tests/integration/test_dialog_respond.py",
+    "tests/integration/test_discovery_socket_pressure.py",
     "tests/integration/test_dom_discovery.py",
     "tests/integration/test_download_link.py",
     "tests/integration/test_download_link_frame.py",
@@ -336,6 +338,7 @@
     "tests/unit/test_cli_param_type.py",
     "tests/unit/test_cli_steering_contract.py",
     "tests/unit/test_demo_encoding.py",
+    "tests/unit/test_discovery_budget.py",
     "tests/unit/test_extension_ownership.py",
     "tests/unit/test_find_hint.py",
     "tests/unit/test_launch_window_size.py",

{ai_dev_browser-0.58.2 → ai_dev_browser-0.58.3}/docs/remote-views.md

@@ -53,7 +53,17 @@ dialogs and supported keys. `PageSurface` is a rendering/input adapter, not a
 complete tab bar, toolbar, WebSocket authorization protocol or React panel.
 Hosts whose worker advertises `capabilities.dragInput` can opt into mouse/pen
 selection with `new PageSurface(imageElement, sendAuthorizedInput, {drag: true})`.
-Touch gestures continue to scroll. A drag carries at most 64 viewport points in
+Touch gestures scroll by default. A host can offer an explicit "Select text or
+drag" gesture mode with `{drag: true, touchDrag: true}`. A cancelled touch sends
+no partial drag; switching away from a surface must dispose it before accepting
+another gesture. The existing host lease and epoch checks still apply. This is
+an input mode, not an ownership transfer or permission to resume AI. The real
+Chrome touch-emulation journey scrolls out and back in the default mode, then
+selects the exact phrase in drag mode through a separate scaled viewer. It also
+checks cancellation before a completed gesture. Physical iOS/Android acceptance
+remains a separate device requirement.
+
+A drag carries at most 64 viewport points in
 one bounded `input` operation; it is sent on pointer release, so this is not a
 continuous drag stream. The host's existing input barrier drains the gesture
 before changing control or targets. The adapter never retries it.
@@ -84,10 +94,11 @@ tool execution and viewer input.
 ## AI and human control
 
 The agent communicates why human input is needed through its native question,
-options or normal conversation. The host's existing Take control and Return to
-AI actions perform the actual ownership transition. A native answer is only
+options or normal conversation. The host's existing authenticated interrupt
+and continuation actions perform the actual ownership transition. A native answer is only
 communication unless the host explicitly routes it to that authenticated action
-and waits for the tool barrier. Do not build an additional question UI into the
+and waits for the tool barrier. Do not require separate browser business handoff
+buttons or build an additional question UI into the
 remote display adapter. Credentials are entered in the same browser by the
 human, not sent through agent chat. The public MCP tool catalog and normal CLI
 mode help include this guidance; execution barriers remain a host contract.
@@ -197,6 +208,11 @@ refuses arbitrary existing profiles. The host provides the policy/update server
 and exclusive profile ownership; the SDK does not modify extension preferences
 or install unpacked code into a user's browser.
 
+An extension launch keeps its owned loopback handshake page until the caller
+navigates. The handshake does not schedule an additional blank-page navigation:
+that can invalidate Chrome's debugger target after readiness was announced.
+An explicit launch URL still uses the normal caller-requested navigation.
+
 ### Managed Chrome image
 
 `deploy/managed-chrome/Dockerfile` is the shared Linux runtime for consuming
@@ -217,6 +233,8 @@ X11 or VNC service by default; hosts provide their authorized session API and
 start display resources when required. Chrome runs as UID 10001. Persist its
 host-owned profile separately from the image, enforce one runtime owner, and
 pin production images by digest after validating their recorded Chrome version.
+Docker hosts must use `--init` or another child-reaping supervisor so exited
+Chrome descendants do not accumulate against the runtime's process limit.
 The `Managed branded Chrome` CI job uses an isolated fixture signing key and
 real installed headless extension to exercise the same shared-session workflow
 as CDP, including trusted input, handoff and stale-target rejection.

{ai_dev_browser-0.58.2 → ai_dev_browser-0.58.3}/tests/integration/conftest.py

@@ -22,6 +22,26 @@ from ai_dev_browser.core.connection import BrowserClient
 from ai_dev_browser.core.ext_bridge import _Bridge
 from ai_dev_browser.core.extension import extension_dir
 
+# Shared fixture visibility must not depend on which test module pytest collects
+# before a module-level pytest_plugins declaration.
+from .test_remote_view import remote_site as remote_site
+
+
+@pytest.fixture(autouse=True)
+def live_host_resource_receipts(request, tmp_path):
+    if "live_extension" not in request.fixturenames and not os.environ.get(
+        "AI_DEV_BROWSER_MANAGED_EXTENSION_PROFILE"
+    ):
+        yield
+        return
+    from .live_resources import record_host_resources
+
+    record_host_resources(tmp_path, "before")
+    try:
+        yield
+    finally:
+        record_host_resources(tmp_path, "after")
+
 
 @pytest.fixture
 def lifecycle(tmp_path):

{ai_dev_browser-0.58.2 → ai_dev_browser-0.58.3}/tests/integration/extension_ownership_support.py

@@ -97,6 +97,7 @@ async def cli(extension, folder, *arguments, code=0):
 
 async def navigation_journey(extension, folder: Path, mode: str):
     receipts = []
+    visits = []
     url = ""
 
     async def receipt(request):
@@ -104,6 +105,7 @@ async def navigation_journey(extension, folder: Path, mode: str):
         return web.json_response({"accepted": True})
 
     async def page(request):
+        visits.append(request.path)
         destination = url.replace("127.0.0.1", "localhost") if mode != "same" else url
         landing = destination + "/result?private=must-not-log#private-fragment"
         action = f"location.href={json.dumps(landing)}"
@@ -138,6 +140,22 @@ await fetch('/receipt',{{method:'POST',headers:{{'Content-Type':'application/jso
     try:
         browser = await connect(extension)
         parent = await browser.get(url)
+        readiness = await wait_until(
+            lambda: parent.evaluate(
+                "({protocol:location.protocol,path:location.pathname,"
+                "ready:document.readyState,hasSubmit:!!document.querySelector('#submit'),"
+                "errorCode:document.querySelector('#error-code')?.textContent||null})"
+            ),
+            lambda value: value["protocol"] == "chrome-error:"
+            or (value["ready"] == "complete" and value["hasSubmit"]),
+        )
+        (folder / "navigation-readiness.json").write_text(
+            json.dumps(
+                {"mode": mode, "page": readiness, "fixtureVisits": visits}, indent=2
+            ),
+            encoding="utf8",
+        )
+        assert readiness["protocol"] == "http:" and readiness["hasSubmit"], readiness
         parent_id = str(parent.target_id)
         sentinel = await worker_call(
             extension,

{ai_dev_browser-0.58.2 → ai_dev_browser-0.58.3}/tests/integration/live_cleanup.py

@@ -47,6 +47,11 @@ async def close_live_extension(chrome, server, folder, timeout=30):
     from ai_dev_browser.core.browser import browser_stop
 
     try:
+        # Let the still-running extension acknowledge WebSocket close frames.
+        # Killing Chrome first resets its sockets on Windows and leaves the
+        # legacy server waiting for a peer that can no longer finish closing.
+        await close_live_server(server, folder)
+    finally:
         if chrome and "port" in chrome:
             record_phase(folder, "chrome-stop-start", pid=chrome["pid"])
             try:
@@ -63,5 +68,3 @@ async def close_live_extension(chrome, server, folder, timeout=30):
                 ) from exc
             record_phase(folder, "chrome-stopped", result=result)
             assert result.get("stopped") and result.get("count") == 1, result
-    finally:
-        await close_live_server(server, folder)

ai_dev_browser-0.58.3/tests/integration/live_resources.py

@@ -0,0 +1,58 @@
+"""Retain host resource counts, never process arguments or network addresses."""
+
+from collections import Counter
+from datetime import datetime, timezone
+import json
+from pathlib import Path
+import sys
+
+import psutil
+
+
+def record_host_resources(folder, phase):
+    snapshot = {"phase": phase, "at": datetime.now(timezone.utc).isoformat()}
+    try:
+        current = psutil.Process()
+        memory = psutil.virtual_memory()
+        snapshot.update(
+            pythonRss=current.memory_info().rss,
+            pythonThreads=current.num_threads(),
+            hostAvailableMemory=memory.available,
+            hostTotalMemory=memory.total,
+            tcpStates=dict(
+                Counter(
+                    connection.status for connection in psutil.net_connections("tcp4")
+                )
+            ),
+        )
+        chrome = []
+        for process in psutil.process_iter(
+            ["name", "num_threads", "memory_info"], ad_value=None
+        ):
+            if "chrome" in (process.info["name"] or "").lower():
+                chrome.append(process.info)
+        snapshot.update(
+            chromeProcessCount=len(chrome),
+            chromeThreads=sum(value["num_threads"] or 0 for value in chrome),
+            chromeRss=sum(
+                value["memory_info"].rss for value in chrome if value["memory_info"]
+            ),
+        )
+        if sys.platform == "linux":
+            snapshot["cgroup"] = {
+                name: path.read_text().strip()
+                for name in (
+                    "pids.current",
+                    "pids.max",
+                    "pids.events",
+                    "memory.current",
+                    "memory.max",
+                    "memory.events",
+                )
+                if (path := Path("/sys/fs/cgroup") / name).is_file()
+            }
+    except (psutil.Error, OSError) as error:
+        snapshot["auditUnavailable"] = type(error).__name__
+    (folder / f"host-resources-{phase}.json").write_text(
+        json.dumps(snapshot, indent=2), encoding="utf8"
+    )

{ai_dev_browser-0.58.2 → ai_dev_browser-0.58.3}/tests/integration/navigation_startup_support.py

@@ -9,16 +9,23 @@ import pytest
 from aiohttp import web
 
 from ai_dev_browser.core.browser import browser_start, browser_stop
-from tests.integration.test_remote_view import connect_page, navigate_owned_browser
+from tests.integration.test_remote_view import (
+    connect_page,
+    navigate_owned_browser,
+    wait_for,
+)
 
 
 async def startup_race_journey(folder, accepted=True):
     first_request = asyncio.Event()
     release_first = asyncio.Event()
     requests = []
+    bootstrap_requests = []
+    phases = []
 
     async def page(request):
         requests.append(request.path)
+        phases.append({"phase": "target-request", "count": len(requests)})
         if len(requests) == 1:
             first_request.set()
             await release_first.wait()
@@ -31,7 +38,18 @@ async def startup_race_journey(folder, accepted=True):
     app = web.Application()
     app.router.add_get("/target", page)
 
+    async def bootstrap(request):
+        bootstrap_requests.append(request.path)
+        return web.Response(
+            text='<title>Race fixture ready</title><main id="bootstrap">Ready</main>',
+            content_type="text/html",
+            headers={"Cache-Control": "no-store"},
+        )
+
+    app.router.add_get("/bootstrap", bootstrap)
+
     async def redirect(request):
+        phases.append({"phase": "competing-redirect"})
         raise web.HTTPFound("/target" if accepted else "/wrong")
 
     app.router.add_get("/redirect", redirect)
@@ -47,6 +65,7 @@ async def startup_race_journey(folder, accepted=True):
     site = web.TCPSite(runner, "127.0.0.1", 0)
     await site.start()
     url = f"http://127.0.0.1:{site._server.sockets[0].getsockname()[1]}/target"
+    bootstrap_url = url.replace("/target", "/bootstrap")
     browser = None
     navigation = None
     try:
@@ -64,12 +83,32 @@ async def startup_race_journey(folder, accepted=True):
                 http, browser["port"], browser["automation_target_id"]
             )
             try:
+                # Chrome for Testing 155 on Windows advertises the CLI startup
+                # URL while its document remains about:blank. Prepare this neutral
+                # fixture through the existing owned CDP connection exactly once;
+                # the cancellation under test is dispatched separately afterwards.
+                prepared = await peer.call("Page.navigate", {"url": bootstrap_url})
+                assert "errorText" not in prepared, prepared
+                await peer.wait_navigation(prepared, timeout=10)
+                ready = await wait_for(
+                    lambda: peer.js(
+                        "({url:location.href,ready:document.readyState,"
+                        "marker:document.querySelector('#bootstrap')?.textContent})"
+                    ),
+                    lambda value: value["url"] == bootstrap_url
+                    and value["ready"] in ("interactive", "complete")
+                    and value["marker"] == "Ready",
+                    timeout=10,
+                )
+                assert bootstrap_requests == ["/bootstrap"] and requests == []
+                phases.append({"phase": "bootstrap-ready", "observed": ready})
                 navigation = asyncio.create_task(
                     navigate_owned_browser(
                         browser, url, folder, settle_timeout=15 if accepted else 2
                     )
                 )
                 await asyncio.wait_for(first_request.wait(), 10)
+                phases.append({"phase": "first-target-held"})
                 # This independent owned driver is the controlled competing
                 # browser navigation; the helper itself still dispatches once.
                 await asyncio.wait_for(
@@ -108,6 +147,18 @@ async def startup_race_journey(folder, accepted=True):
                 await peer.close()
     finally:
         release_first.set()
+        (folder / "startup-navigation-race-evidence.json").write_text(
+            json.dumps(
+                {
+                    "bootstrapRequests": bootstrap_requests,
+                    "targetRequests": requests,
+                    "phases": phases,
+                    "acceptedDestination": accepted,
+                },
+                indent=2,
+            ),
+            encoding="utf-8",
+        )
         if browser and "session_id" in browser:
             stopped = await asyncio.to_thread(
                 browser_stop, session_id=browser["session_id"]