Pup - Puppeteer Bridge

P0 (2026-08-10, John hit it live): pup's janitor KILLED the browser hosting John's open, actively-used windows while he was drawing an annotation. Log sequence this boot:

• [reconcile] reaped closed session "ab-wiki" (no open windows, periodic)
• [reconcile] reaped closed session "ai-adom-lbr-wiki-page-in-pup" (no open windows, periodic)
• [janitor] reaped 11 orphaned pup browser process(es) that no live session owned — 0 live profile(s) were spared

Both sessions had OPEN, VISIBLE windows (John was mid-annotation in adom-lbr). The reconciler's "no open windows" verdict was FALSE, the sessions were reaped, and the janitor then saw the (live) Chrome processes as unowned and taskkilled them. User-visible result: window vanished from the taskbar mid-draw, annotation lost, no capture, no Crashpad dump (it was a kill, not a crash) — initially misdiagnosed as a Chrome crash until the dump census showed none.

Context that likely fed the false verdict: minutes earlier the session had heavy churn (ghost-window adoption + takeover closes + a full profile cycle + repeated bridge respawns). The reconciler's open-window detection must be treated as UNRELIABLE input: a destructive kill needs GROUND TRUTH (enumerate the process's actual OS windows via desktop_enum_windows and refuse to kill any process that owns a visible top-level window), the same bare-over-wrong doctrine as overlays and the #434 refCount lesson: never let a derived model authorize destruction.

Fix sketch: (1) janitor: before killing any "orphaned" chrome pid, enum its visible Chrome_WidgetWin_1 windows; any visible window = NOT orphaned, adopt instead of kill. (2) reconcile: "no open windows, periodic" must cross-check the OS enum before reaping a session. (3) ralph: a churn harness (adopt + takeover-close + respawn cycles) asserting no live-window process is ever killed.