An orphaned Chrome kept holding the profile lock, so we changed force_release to kill the lease’s chrome_pid (PID-scoped, as reap does) and return chrome_killed. The orphan stopped holding the lock. Later the same day, every kill in the pool had to prove the process first.
The kill we shipped first
force_release read chrome_pid off the lease and killed it. That was the whole mechanism.
What replaced it
Other commits that day set a different rule for both paths. force_release and reap kill chrome_pid only if its create_time still matches, and a kill needs a proven create_time identity.
clear_relaunching records the new create_time.
clear_relaunching drops an unreadable stamp.
_reap_wedged_slot only kills a pid proven to be the lease’s Chrome, by name and create_time. Otherwise it just releases the lease and fails the task.
When the Chrome is alive but its identity is unproven, force_release returns skipped 'identity unproven' before the wipe and the lease delete, and reap leaves the lease in place. That commit’s own description of the outcome: no more orphan holding SingletonLock.
One case still goes the other way. An unstamped lease whose chrome_pid is dead is released by reap, and we added a test for it so the slot cannot leak forever.
The reap-safety fixture
The reap-safety fixture now carries a proven create_time. Its test still shows an agent-owned stale slot being reaped and killed. A new test pins the other side: an unproven live Chrome keeps its lease.
Human-held and presented slots
The same set of changes added these guards:
force_release skips human-held and presented slots, and returns before the wipe and the unlink.
reap skips presented live slots.
_reap_wedged_slot skips on handoff_requested and human_held.
The browser task _cleanup honors chrome_pool.presentation_hold, so a presented slot is not killed or released.
So when force_release now meets a live Chrome whose create_time it cannot prove, it answers skipped 'identity unproven' before the wipe and the lease delete.
AI Skills
Use this lesson with the AI assistant you already use
An orphaned Chrome kept holding the profile lock, so force_release was changed to kill the lease's chrome_pid. The same day's commits replaced that blind kill with a rule that requires a proven create_time identity before any kill.
Paste the prompt, share only the context needed to answer it, and treat the result as a draft for your review. Do not include confidential information or let an AI assistant make changes without your approval.
Optional: for a visual report and saved memory, run /dxdev first.
Don’t have it? Get it at dxdev.com/skills/dxdev. The prompt works without it.
dxdev LESSON · paste into your AI coding agent
LESSON: Kill A Process Only When Its Identity Is Proven, And Otherwise Release The Lease Without Killing
SOURCE: dxdev.com/blog/kill-only-the-process-you-proved
WHAT HAPPENED: force_release first read chrome_pid off the lease and killed it, which cleared the orphan holding the profile lock. The same day's commits changed both force_release and reap to kill chrome_pid only if its create_time still matches. clear_relaunching now records the new create_time and drops an unreadable stamp, and _reap_wedged_slot kills a pid only when it is proven to be the lease's Chrome by name and create_time. When a live Chrome's identity is unproven, force_release returns skipped 'identity unproven' before the wipe and lease delete, and reap leaves the lease in place. An unstamped lease whose chrome_pid is dead is still released, with a test so the slot cannot leak forever. Human-held and presented slots were also guarded so they are never killed or released.
THE RULE: Never kill a process just because a stored PID points at it, because the PID may have been reused or the process may belong to someone else. Kill only after proving the identity of the process, and when identity is unproven, skip the kill and leave the state intact.
CHECK MY CODE, then report PASS or FAIL with file:line for each:
1. Every code path that kills a process by a stored PID also compares a recorded create_time (or equivalent identity stamp) and the process name before sending the kill.
2. When a live process's identity cannot be proven, the cleanup path returns a skip result before any destructive step such as wiping a profile or deleting a lease.
3. A test covers each side: a proven stale owner is reaped and killed, an unproven live process keeps its lease, and an unstamped lease with a dead pid is still released so the slot cannot leak.
THEN PRINT: a table (check, PASS/FAIL, evidence, fix) + a verdict (applies / partially / OUT_OF_SCOPE / no) + the single most important next action.
