docs(debug): SC#1 sw-offscreen-persistence investigation session 2 — REFUTED-architecture (canvas-captureStream issue)

Session-2 (continuation of d614462 INCONCLUSIVE) executed disambiguation
plan and converged on a definitive verdict. Three independent observations
ruled out ALL architectural-failure hypotheses:

  Step A: race-tolerant offscreen target attach (committed separately;
  enabled visibility into the offscreen recorder + remux pipeline).

  Step B: pre-kill and post-kill segment-count probes via the existing
  `__mokoshOffscreenQuery 'get-segment-count'` bridge op (no new
  test-only symbols introduced; FORBIDDEN_HOOK_STRINGS inventory
  unchanged at 12 entries). Observed segments.length transition:
    POST-PRIME=0 → PRE-KILL=3 → POST-KILL=3
  Segments structurally survive the SW kill (offscreen still responds
  to bridge query post-kill). Hypothesis A (architectural RAM loss
  across SW termination) REFUTED.

  Step C: SPIKE_SKIP_SW_KILL=1 env-var mode skips worker.close(). The
  resulting videoSize is IDENTICAL to the canonical run (8505 bytes).
  Hypothesis C (CDP-induced offscreen collateral teardown) REFUTED.
  Since SW was not killed, its console listener stayed connected,
  exposing the full Remux pipeline output:
    [SW:Remux] Segment ts=1: 0 frames, duration=0ms, trackInfo=320x180
    [SW:Remux] Segment ts=2: 0 frames, duration=0ms, trackInfo=320x180
    [SW:Remux] Segment ts=3: 0 frames, duration=0ms, trackInfo=320x180
    [SW:Remux] Remux complete: 0 frames, total timeline=0ms, output=8505 bytes
  Each segment Blob has a valid track header (PixelWidth/Height parsed
  successfully) but ZERO VP9 frames. Hypothesis B (canvas-captureStream
  throttling in headless idle) CONFIRMED.

VERDICT: REFUTED-architecture (canvas-captureStream issue).

The architecture (offscreen-RAM `segments: Blob[] = []`) works
correctly; the spike's test methodology is invalid. The
`installFakeDisplayMedia` synthetic stream (canvas.captureStream(30)
on a hidden -9999px-offset 320x180 canvas) cannot sustain frame
production during a 5-min headless idle window despite the
`setInterval(drawFrame, 33ms)` belt-and-suspenders mitigation. This
matches the documented Chromium throttling of MediaRecorder on
invisible-canvas sources (Chrome bug 653548; auto-throttled-screen-capture
design doc; sendrec.eu blog "Why Canvas Breaks Your Screen Recorder").

ROUTING RECOMMENDATION (out of scope for this debug session):
  - Do NOT proceed with the IndexedDB persistence plan-fix proposed by
    Plan 04-04 SUMMARY. The plan-fix would NOT close SC #1 because the
    spike would STILL produce 8505 bytes after IDB lands — the failure
    is in the test's fake stream, not in segment persistence.
  - Open a new plan slot (likely Plan 04-08 or a Phase 5 plan) that
    reframes SC #1 verification methodology. Options:
      (a) real getDisplayMedia in non-headless Puppeteer with
          --auto-select-desktop-capture-source;
      (b) video-file-backed MediaStream source (HTMLVideoElement
          playing a bundled WebM) — bypasses canvas-captureStream
          throttling entirely;
      (c) reduce SC #1 wall-clock idle threshold to a value short
          enough that canvas-captureStream survives (e.g., 30s) AND
          add a separate manual operator-empirical test for 5-min.

ROADMAP SC #1 status: REMAINS OPEN. The architecture is sound; the
empirical verification gate is broken. Plan 04-04 SUMMARY's
characterization ("spike FAILED → architectural plan-fix needed") is
TECHNICALLY CORRECT on the first clause but INCORRECT on the second —
the spike's failure mode is in test infrastructure, not in production
code.

Files in this commit:
  - tests/uat/spike-a33-sw-persistence.ts: added probeSegmentCount
    helper using existing __mokoshOffscreenQuery bridge op; 3
    checkpoints (POST-PRIME / PRE-KILL / POST-KILL); SPIKE_SKIP_SW_KILL=1
    env-var skips worker.close() for Step C disambiguation.
  - .planning/debug/sw-offscreen-persistence-investigation-session-2.md:
    NEW session-2 debug note documenting full evidence trail + verdict
    derivation + routing recommendation.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/uat/spike-a33-sw-persistence.ts

@@ -1,4 +1,5 @@
-// tests/uat/spike-a33-sw-persistence.ts — Plan 04-04 Wave 0 SPIKE.
+// tests/uat/spike-a33-sw-persistence.ts — Plan 04-04 Wave 0 SPIKE +
+// Plan-04-04 debug session-2 disambiguation probes.
 //
 // One-shot empirical investigation: does the offscreen document survive
 // a 5-min idle window followed by Puppeteer-driven force-termination
@@ -8,6 +9,19 @@
 // is MEDIUM because the Chrome docs leave the offscreen-vs-SW interplay
 // implicit. This spike is the empirical hedge.
 //
+// Session-2 disambiguation (committed alongside debug
+// session-2 note .planning/debug/sw-offscreen-persistence-investigation-session-2.md):
+//   - get-segment-count probes at 3 checkpoints (post-prime, pre-kill,
+//     post-kill-pre-SAVE) — distinguishes "segments empty pre-kill
+//     (canvas-captureStream throttled)" from "segments existed pre-kill
+//     but lost post-kill (architectural)". Probes ride the production
+//     __mokoshOffscreenQuery bridge op (already in FORBIDDEN_HOOK_STRINGS
+//     inventory); no new test-only symbols introduced.
+//   - SPIKE_SKIP_SW_KILL=1 env-var skips the worker.close() call —
+//     distinguishes "SW kill via CDP causes the failure (CDP artifact)"
+//     from "5-min idle alone causes the failure (architectural OR
+//     canvas-throttling-without-SW-involvement)".
+//
 // Outcome decision tree:
 //   - videoSize > 100_000 bytes → SPIKE PASSED. Plan 04-04 Wave 1
 //     proceeds: A33 is a verification-only harness assertion that
@@ -63,16 +77,99 @@ const SPIKE_DOWNLOAD_SETTLE_MS = 5_000;
  *  meta.json + screenshot is ~50 KB; anything above 100 KB means the
  *  video buffer actually contained segments). */
 const SPIKE_VIDEO_SIZE_FLOOR_BYTES = 100_000;
+/** Session-2: probe op timeout (5s; matches the harness's offscreenQuery default). */
+const SPIKE_PROBE_TIMEOUT_MS = 5_000;
+
+/**
+ * Session-2 disambiguation probe — query the offscreen recorder's live
+ * `segments.length` via the production `__mokoshOffscreenQuery`
+ * `get-segment-count` bridge op (src/test-hooks/offscreen-hooks.ts:493).
+ *
+ * Returns the segment count (number of fully-rotated 10s WebM segments
+ * in the in-memory ring buffer), or `-1` on bridge error.
+ *
+ * The bridge op rides chrome.runtime.sendMessage from the harness page
+ * realm → offscreen-hooks's onMessage listener responds synchronously
+ * via sendResponse({count: number}). No new test-hook symbol; the
+ * `get-segment-count` op is already in the 12-entry FORBIDDEN_HOOK_STRINGS
+ * inventory (Plan 01-13 Wave 3D A11 contract).
+ *
+ * Used at 3 checkpoints in the spike:
+ *   1. post-prime: confirms baseline segment-count ≈ 0 (no rotations yet)
+ *      — sanity check; if NON-zero here, the prime did unexpected work.
+ *   2. pre-kill (just BEFORE stopServiceWorker): the critical probe —
+ *      if zero here, hypothesis B (canvas-throttling) confirmed;
+ *      if non-zero here but archive empty post-SAVE, hypothesis A
+ *      (architectural RAM loss across SW termination) confirmed.
+ *   3. post-kill-pre-SAVE: confirms offscreen still respawns + can
+ *      respond — if the offscreen target itself died with the SW kill,
+ *      this probe would throw or time out; that result distinguishes
+ *      "offscreen survives kill but loses state" from "offscreen dies
+ *      with the SW kill (collateral teardown per Puppeteer #9995)".
+ *
+ * @param page - The harness page (has chrome.runtime access).
+ * @returns The live segment count, or `-1` on probe error.
+ */
+async function probeSegmentCount(
+  page: import('puppeteer').Page,
+  label: string,
+): Promise<number> {
+  try {
+    const result = await page.evaluate(
+      (timeoutMs: number) =>
+        new Promise<{ count?: number; error?: string }>((resolve) => {
+          const timer = setTimeout(() => {
+            resolve({ error: `get-segment-count timed out after ${timeoutMs}ms` });
+          }, timeoutMs);
+          chrome.runtime.sendMessage(
+            { type: '__mokoshOffscreenQuery', op: 'get-segment-count' },
+            (response: unknown) => {
+              clearTimeout(timer);
+              if (chrome.runtime.lastError !== undefined) {
+                resolve({ error: String(chrome.runtime.lastError.message) });
+                return;
+              }
+              resolve(response as { count?: number; error?: string });
+            },
+          );
+        }),
+      SPIKE_PROBE_TIMEOUT_MS,
+    );
+    if (typeof result.count === 'number') {
+      process.stdout.write(
+        `SPIKE PROBE [${label}]: segments.length=${result.count}\n`,
+      );
+      return result.count;
+    }
+    process.stdout.write(
+      `SPIKE PROBE [${label}]: ERROR ${result.error ?? '(unknown)'}\n`,
+    );
+    return -1;
+  } catch (err) {
+    process.stdout.write(
+      `SPIKE PROBE [${label}]: THREW ${err instanceof Error ? err.message : String(err)}\n`,
+    );
+    return -1;
+  }
+}
 
 /**
  * Spike entrypoint. Returns a Node exit code (0 = PASSED, 1 = FAILED).
  */
 async function main(): Promise<number> {
+  // Session-2 mode switch: SPIKE_SKIP_SW_KILL=1 = run Step C variant
+  // (5-min idle + SAVE, NO worker.close()). Distinguishes "SW kill is
+  // the cause" from "5-min idle alone is the cause".
+  const skipSwKill = process.env.SPIKE_SKIP_SW_KILL === '1';
+
   process.stdout.write('\nMokosh Plan 04-04 Wave 0 SPIKE — SW state persistence empirical test\n');
   process.stdout.write('='.repeat(72) + '\n');
   process.stdout.write(
     `SPIKE: idle window = ${SPIKE_IDLE_WAIT_MS}ms (${SPIKE_IDLE_WAIT_MS / 60_000} min); ` +
-      `pass floor = ${SPIKE_VIDEO_SIZE_FLOOR_BYTES} bytes\n\n`,
+      `pass floor = ${SPIKE_VIDEO_SIZE_FLOOR_BYTES} bytes\n`,
+  );
+  process.stdout.write(
+    `SPIKE: mode = ${skipSwKill ? 'STEP-C (skip-sw-kill: 5-min idle + SAVE, no worker.close)' : 'CANONICAL (5-min idle + worker.close + SAVE)'}\n\n`,
   );
 
   const t0 = Date.now();
@@ -108,20 +205,55 @@ async function main(): Promise<number> {
       throw new Error(`assertA2 priming failed: ${a2Result.error ?? '(no error)'}`);
     }
 
+    // Session-2 PROBE 1: post-prime baseline. Expected: 0 (no segment
+    // rotation has happened yet; A2's prime takes <1s + first rotation
+    // is at +10s).
+    await probeSegmentCount(handles.harnessPage, 'POST-PRIME');
+
     // Step 2 — 5-min wall-clock idle. The whole point of the spike.
     process.stdout.write(`\nSPIKE Step 2: waiting ${SPIKE_IDLE_WAIT_MS}ms for SW idle window...\n`);
     process.stdout.write(`SPIKE Step 2: ETA ${new Date(Date.now() + SPIKE_IDLE_WAIT_MS).toISOString()}\n`);
     await new Promise((res) => setTimeout(res, SPIKE_IDLE_WAIT_MS));
     process.stdout.write('SPIKE Step 2 OK — 5-min idle elapsed\n');
 
-    // Step 3 — force-terminate the SW via Puppeteer CDP worker.close().
-    process.stdout.write('\nSPIKE Step 3: stopServiceWorker(browser, extensionId)\n');
-    await stopServiceWorker(handles.browser, handles.extensionId);
-    process.stdout.write('SPIKE Step 3 OK — SW terminated via worker.close()\n');
+    // Session-2 PROBE 2: pre-kill — THE critical disambiguation point.
+    // If count==0 here: hypothesis B (canvas-captureStream throttled in
+    //   headless idle; segments never accumulated). Architecture NOT broken.
+    // If count>=3 here: hypothesis A (architectural RAM loss across SW
+    //   termination); the test is correct; segments existed pre-kill.
+    //   Then check post-SAVE archive: if also empty, IDB persistence needed.
+    // If count==-1 (probe failed): offscreen is unresponsive — either
+    //   collateral-killed already (unlikely; no worker.close yet) or
+    //   SW had to broker and SW is also unresponsive.
+    const segCountPreKill = await probeSegmentCount(handles.harnessPage, 'PRE-KILL');
+
+    if (skipSwKill) {
+      // Step C variant — skip the SW kill entirely. Use the same 500ms
+      // settle as the canonical path so the timing between SAVE dispatch
+      // and zip mtime stays consistent across runs.
+      process.stdout.write(
+        '\nSPIKE Step 3: SKIPPED (SPIKE_SKIP_SW_KILL=1) — testing 5-min idle alone\n',
+      );
+    } else {
+      // Step 3 — force-terminate the SW via Puppeteer CDP worker.close().
+      process.stdout.write('\nSPIKE Step 3: stopServiceWorker(browser, extensionId)\n');
+      await stopServiceWorker(handles.browser, handles.extensionId);
+      process.stdout.write('SPIKE Step 3 OK — SW terminated via worker.close()\n');
+    }
 
     // Step 4 — brief settle for SW teardown.
     await new Promise((res) => setTimeout(res, SPIKE_NEW_SW_BOOT_MS));
 
+    // Session-2 PROBE 3: post-kill (or post-skip-kill) — confirms
+    // offscreen is still responsive after worker.close. If count drops
+    // from pre-kill value, the SW kill collaterally destroyed offscreen
+    // state. If count is same (or grows by 1 due to a rotation between
+    // probes), offscreen survived.
+    const segCountPostKill = await probeSegmentCount(handles.harnessPage, skipSwKill ? 'POST-SKIP-KILL' : 'POST-KILL');
+    process.stdout.write(
+      `SPIKE: segment-count transition: pre=${segCountPreKill}, post=${segCountPostKill}\n`,
+    );
+
     // Step 5 — dispatch SAVE_ARCHIVE via chrome.runtime.sendMessage from
     // the harness page realm. The first message after worker.close()
     // wakes the SW back up (event-driven respawn — canonical MV3 wakeup
@@ -177,7 +309,10 @@ async function main(): Promise<number> {
   const elapsedSec = (tEnd - t0) / 1000;
 
   process.stdout.write('\n' + '='.repeat(72) + '\n');
-  process.stdout.write(`SPIKE RESULT: videoSize=${videoSize} bytes (floor=${SPIKE_VIDEO_SIZE_FLOOR_BYTES}; elapsed=${elapsedSec.toFixed(1)}s)\n`);
+  process.stdout.write(
+    `SPIKE RESULT [${skipSwKill ? 'STEP-C-NO-KILL' : 'CANONICAL'}]: ` +
+      `videoSize=${videoSize} bytes (floor=${SPIKE_VIDEO_SIZE_FLOOR_BYTES}; elapsed=${elapsedSec.toFixed(1)}s)\n`,
+  );
   if (spikeError !== null) {
     process.stdout.write(`SPIKE OUTCOME: FAILED (spike threw: ${spikeError})\n`);
     process.stdout.write('='.repeat(72) + '\n');