---
title: "force_release returns skipped identity unproven before the wipe"
canonical: https://dxdev.com/blog/kill-only-the-process-you-proved/
datePublished: 2026-10-03
---
An orphaned Chrome kept holding the profile lock, so we changed `force_release` to kill the lease's `chrome_pid` (PID-scoped, as `reap` does) and return `chrome_killed`. The orphan stopped holding the lock. Later the same day, every kill in the pool had to prove the process first.

## The kill we shipped first

`force_release` read `chrome_pid` off the lease and killed it. That was the whole mechanism.

## What replaced it

Other commits that day set a different rule for both paths. `force_release` and `reap` kill `chrome_pid` only if its `create_time` still matches, and a kill needs a proven `create_time` identity.

- `clear_relaunching` records the new `create_time`.
- `clear_relaunching` drops an unreadable stamp.
- `_reap_wedged_slot` only kills a pid proven to be the lease's Chrome, by name and `create_time`. Otherwise it just releases the lease and fails the task.
- When the Chrome is alive but its identity is unproven, `force_release` returns `skipped 'identity unproven'` before the wipe and the lease delete, and `reap` leaves the lease in place. That commit's own description of the outcome: no more orphan holding SingletonLock.

One case still goes the other way. An unstamped lease whose `chrome_pid` is dead is released by `reap`, and we added a test for it so the slot cannot leak forever.

## The reap-safety fixture

The reap-safety fixture now carries a proven `create_time`. Its test still shows an agent-owned stale slot being reaped and killed. A new test pins the other side: an unproven live Chrome keeps its lease.

## Human-held and presented slots

The same set of changes added these guards:

- `force_release` skips human-held and presented slots, and returns before the wipe and the unlink.
- `reap` skips presented live slots.
- `_reap_wedged_slot` skips on `handoff_requested` and `human_held`.
- The browser task `_cleanup` honors `chrome_pool.presentation_hold`, so a presented slot is not killed or released.

So when `force_release` now meets a live Chrome whose `create_time` it cannot prove, it answers `skipped 'identity unproven'` before the wipe and the lease delete.