docs(browser): keep Firefox process isolation and block the SDK successor

BACKLOG.md

@@ -48,7 +48,7 @@ records, generated release manifests, or the owning docs named above.
 
 | Status | ID | Scope | Completion condition |
 |---|---|---|---|
-| NEXT | BROWSER-TOOLCHAIN-01 | Qualify a stable browser-test successor to the pinned 1.63.0 SDK without the native WebKit select/CSP regression first shipped in 1.64.0: its WebKit sets a style attribute on a select element's internal slot before that slot is in the user-agent shadow tree, so the page's `style-src` refuses it and logs a console error. | Preserve native navigation, exact engine evidence, strict CSP and zero retries in the complete Chromium, Firefox and WebKit gate. Decide from repeated complete Firefox runs whether site-origin process isolation remains required (1.62.1 failed without it; one 1.63.0 run passed without it); update its fixture and contributor explanation together with any policy change. Do not substitute a custom engine or ignore console/security-policy failures. |
+| BLOCKED | BROWSER-TOOLCHAIN-01 | Qualify a stable browser-test successor to the pinned 1.63.0 SDK that contains the Firefox channel-identity repair ([microsoft/playwright@e5d880b](https://github.com/microsoft/playwright/commit/e5d880b05f9a1d7fb5d17dd031b53739e5e39c0e), Firefox r1551, first released in 1.64.0; 1.63.0 ships r1543 and lacks it) and lacks the native WebKit select/CSP regression first shipped in 1.64.0: WebKit commit `ef67848e5875` (bug 322676) sets a style attribute on a select element's internal slot before that slot is in the user-agent shadow tree, so the page's `style-src` refuses it and logs a console error (open as WebKit bug 327212). | Unblocked only by a stable Playwright release whose Firefox is r1551 or later and whose WebKit no longer reproduces that select/CSP regression (a native `select` under the workspace CSP logs no console or security-policy error); as of 2026-10-13, 1.64.0, the only stable successor, still has the regression. The complete Chromium, Firefox and WebKit gate must then pass with native navigation, exact engine evidence, strict CSP, console and security-policy checks and zero retries. Keep Firefox site-origin process isolation: on 1.63.0, Firefox runs without it reproduced the navigation completion failure under host load. Remove it only when at least five complete Firefox runs of the successor without it, interleaved with control runs that keep it and including runs under host load at least as high as the 1.63.0 complete run that reproduced the failure (1-minute load average median 19 on 8 CPUs), all pass with zero retries and no navigation completion failure; update its fixture and contributor explanation together with the policy change. Do not substitute a custom engine or ignore console/security-policy failures. |
 | NEXT | SOURCE-CONVERSION-01 | Close the residual review and installed-carrier evidence for `requirement-source-conversion` (`REQ-PROOFKIT-SPEC-044`): grouped v2 export to a complete flat v1 document, digest-bound baseline import of value edits only, and refusal of the retired flat v1 source. | Independent review admits the recorded format, preservation, ownership, legacy-v1 and future-adapter decisions in the spec-proof-core requirement and overview; the publishable closeout gate runs on the final committed object, including `package:artifact` and the provider carrier jobs, so the installed npm and wheel carriers execute the shared conversion smoke on that object; then remove this row. A DSL adapter is not part of this row and needs its own admission under the documented boundary. |
 | BLOCKED | GOVERNANCE-01 | Evaluate a generic explicit-inventory governance-observation command without promoting one consumer's policy into Proofkit; detailed candidate contract is retained in [issue #64](https://github.com/research-engineering/agentic-proofkit/issues/64). | A sanitized reproducible fixture detects one named failure without classifying its false-positive counterexample, existing owners are proven insufficient, and either a second independent consumer reproduces the predicate or the owner admits recurring first-consumer cost; otherwise retire the candidate. |
 | DEFERRED | VALUE-01 | Admit exact value-evidence comparisons only after a real producer and downstream consumer establish the public record boundary; detailed candidate contract is retained in [issue #65](https://github.com/research-engineering/agentic-proofkit/issues/65). | A real execution-receipt projection, baseline producer, and downstream consumer prove an exact producer-output-to-admission round trip plus compact/full-graph inclusion or an intentional omission non-claim; otherwise no public command is added. |

CONTRIBUTING.md

@@ -63,14 +63,24 @@ the same engines and Linux system dependencies before running that gate.
 
 The Firefox test project explicitly enables
 [site-origin process isolation](https://searchfox.org/mozilla-central/source/dom/ipc/ProcessIsolation.cpp)
-with `fission.webContentIsolationStrategy=1`. This avoided the navigation
-completion failure observed in the Playwright 1.62.1 bundle's shared-process
-configuration, without replacing its browser binary or weakening CSP, navigation
-assertions or retries. One complete Firefox run of the pinned 1.63.0 bundle
-without the preference passed; the policy remains until repeated qualification
-admits its removal.
-The engine fixture checks the requested launch policy. Keep the exact stable SDK
-and all three engine gates until a complete qualification admits a successor.
+with `fission.webContentIsolationStrategy=1` instead of the bundle default `0`.
+With it, no navigation completion failure (a navigation the driver never reports
+as finished) has been observed, and it replaces no browser binary and weakens no
+CSP, navigation assertion or retry. Without it, Firefox runs of the 1.62.1
+bundle and, under host load, of the pinned 1.63.0 bundle reproduced that
+failure, so the preference stays until its removal is qualified. Both bundles
+predate the Firefox channel-identity repair
+([microsoft/playwright@e5d880b](https://github.com/microsoft/playwright/commit/e5d880b05f9a1d7fb5d17dd031b53739e5e39c0e),
+Firefox r1551, first released in 1.64.0); 1.63.0 ships Firefox r1543.
+The engine fixture checks the requested launch policy. Keep the exact stable SDK,
+the preference and all three engine gates until a complete qualification admits
+a successor that contains the r1551 repair and lacks the WebKit select/CSP
+regression. Remove the preference only when at least five complete Firefox runs
+of that successor without it, interleaved with control runs that keep it and
+including runs under host load at least as high as the 1.63.0 complete run that
+reproduced the failure (1-minute load average median 19 on 8 CPUs), all pass
+with zero retries and no navigation completion failure, and update the fixture
+and this explanation together with it.
 
 The composed `go:check` and CI source job both run `npm run go:deps`:
 `go mod tidy -diff` rejects manifest drift without rewriting `go.mod` or