Fix audited persistence, filter lifecycle, and Safari compatibility issues

[0xCUB3]

Summary

Implements the 26 actionable findings from the audit of 35834142, plus the verified popup-owner and staged-marker races, in 18 incremental commits on top of ccb29f23.

The coverage matrix, source-level explanations, dependency decisions, and remaining investigations are in docs/audit-reliability-2026-09.md.

Reliability fixes

• Make protobuf recovery and first migration durable; preserve concurrent filter deletions and insertions.
• Refuse incomplete included lists and overflowing Safari output; recover pending source publication after process death; use refreshed counts and compile pending downloads before a 304 can hide them.
• Correct userscript update metadata, bounded include matching, fragment handling, resource hydration, authoritative refresh equality, and duplicate Less/Stylus variables.
• Relay native messages through the extension background, coalesce Zapper refreshes, and use generation-safe, atomic DNR installation.
• Restore complete definitions with stable identities and explicit empty states; roll back transaction-owned source writes if file or metadata persistence fails; preserve newer edits and deletion markers.
• Separate real local additions from updates in Cloud reconciliation; retain remote deletions, reject superseded imports, and compare/merge disabled-host state inside the coordinated disk mutation.
• Make popup claims cross-process and owner-token checked; make launch-agent failures retryable and App Intent outcomes accurate.
• Run the parameterized rules-viewer UI suite in a dedicated simulator job; use isolated scratch storage for compiler tests.

Safari quota correction and OS compatibility

Current Safari's combined dynamic/session quota is 30,000, confirmed in WebKit's implementation. This PR preserves that capacity. It consults the runtime quota and uses a conservative fallback only for older runtimes that do not expose it. Native generation and runtime admission both retain exceptions before redirects; a late exception beyond the source-order cutoff must not disappear. If protections alone consume capacity, no stripping rules are admitted.

The separate Safari content-blocker limit remains 150,000 per extension. Overflow no longer silently publishes truncated target output.

macOS 12.3 and iOS/iPadOS 15.4 deployment targets and compatibility fallbacks are unchanged. The existing XROS_DEPLOYMENT_TARGET = 2.0 setting is unchanged, but the scheme offers no native visionOS destination in this environment; no successful visionOS build is claimed.

Seven verified dependency/tool updates

Component	Previous	Updated
Less	4.9.0	4.9.1
Dart Sass	1.102.0	1.104.0
PostCSS	8.5.26	8.5.28
Extension esbuild	0.28.1	0.28.2
swift-psl	1.1.155	1.1.172
actions/checkout	v5	v7.0.1, pinned commit
actions/cache	v4	v6.1.0, pinned commit

Bundled compiler provenance, checksums, and licenses are retained and verified. Offline WebKit Worker isolation and the Safari 15 JavaScript output target remain intact. SafariConverterLib 4.3.0 and SwiftProtobuf 1.38.1 are unchanged. Swift Argument Parser remains 1.5.0 because SafariConverterLib pins it exactly; no incompatible lockfile-only upgrade is attempted.

Validation

Local validation on Xcode 26.6, using the existing signed wBlock DerivedData:

• Full scripts/run-ci-tests.sh: passed.
• macOS Debug app build: passed.
• iOS Simulator Debug app build: passed.
• Dedicated rules-viewer gesture UI test on iOS 26.5: passed.
• Final focused backup and real native DNR generator tests: passed, including metadata-save failure, concurrent deletion, a 30,001-rule late exception, disabled-site capacity reservation, and protection-only overflow.
• Vendor checksum/license checks, PSL resource checks, and git diff --check: passed.

GitHub check results below apply to the current pushed revision. Local logs remain under /Users/skula/.cache/wblock-audit.YCnL7g/implementation/.

Explicit remaining investigations

R01 (MAIN-world privileged GM authority) and R04 (XPC work lifetime after early reply/client disconnect) are not represented as fixed. R01 needs a compatible sandbox/settings-bridge redesign: blindly moving all privileged scripts out of the page would break Tube Cleaner's page hooks. R04 has not been reproduced as an actual service-termination defect, so no speculative ownership change was made.

No oldest-supported-OS runtime validation, live CloudKit account exchange, real Safari exploit demonstration, or battery benchmark is claimed. The original main worktree, existing user data, and sibling userscript repository were left untouched.

---

Note

High Risk
Wide changes to on-disk protobuf/backup state, Cloud sync, DNR rule installation, userscript privilege boundaries, and XPC filter-update lifetime—areas where regressions directly affect data integrity or extension security.

Overview
This PR lands the September 2026 reliability audit: durable protobuf migration/recovery, safer filter download/publication and pending-revision handling, backup restore with rollback, Cloud sync reconciliation fixes, and compile-time metadata refresh—backed by a large expansion of focused regression tests and a new audit write-up in docs/audit-reliability-2026-09.md.

Extension and service behavior routes No Autoplay and Zapper state/mutations through the background script instead of page-native calls. Removeparam DNR installation now validates chunked loads, respects runtime quota (30k with a legacy 5k fallback), prioritizes protective rules, downgrades or skips unrepresentable legacy conditions, and replaces rules in one atomic updateDynamicRules call. The filter-update XPC service holds work via FilterUpdateWorkLifetime and owner-token popup claims so early replies and disconnects cannot drop in-flight updates.

Userscript security and matching shifts privileged GM networking/storage to the isolated world (page wrappers no longer carry bridge tokens), tightens Tube Cleaner’s bounded page preference channel, and broadens metadata/matching tests (fragments, regex includes, authoritative refresh equality). CI pins actions/checkout and actions/cache, adds a dedicated iOS 26+ simulator job for rules-viewer UI gestures, and skips that suite from the default shell-test glob unless WBLOCK_UI_TEST_SIMULATOR is set. Tooling bumps include esbuild 0.28.2 and Dart Sass 1.104.0 bundle paths in test scripts.

^{Reviewed by Cursor Bugbot for commit 0cd7543. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-08T22:30:54.069164Z	5d5b549	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5d5b54918f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 13851b3. Configure here.}

[cursor]

Stale comment