fix(browser-session): require aggregate-issued lifecycle request authority

ARCHITECTURE.md

@@ -151,9 +151,9 @@ Owns the narrow WebDriver BiDi adapter contract that is expressible by one expli
 
 ### `originweave-browser-session` (active PR)
 
-Owns the Browser Session aggregate boundary for disposable context lifecycle and presentation-mutation authority. Raw `BrowserSessionId` and `BrowsingContextId` values are transport addressability only. A context enters the owned set only after the narrow `DisposableContextPort` reports a fresh disposable isolation boundary together with its browsing-context address. The aggregate stores that exact handle and issues a non-caller-constructible `PresentationMutationAuthority` bound to browser-session identity, disposable-isolation identity, browsing context, and monotonic context epoch.
+Owns the Browser Session aggregate boundary for disposable context lifecycle and presentation-mutation authority. Raw `BrowserSessionId` and `BrowsingContextId` values are transport addressability only. A context enters the owned set only after the narrow `DisposableContextPort` reports a fresh disposable isolation boundary together with its browsing-context address. The aggregate stores that exact handle and issues a non-caller-constructible `PresentationMutationAuthority` bound to browser-session identity, `BrowserSessionIncarnation`, disposable-isolation identity, browsing context, and monotonic context epoch. `BrowserSessionIncarnation` participates in authorization validation and prevents sequential ABA when external session/context identifiers and local epoch values are reused.
 
-The isolation identity prevents distinct aggregate incarnations from aliasing authority when external session/context identifiers and local epoch values are reused. Destruction validates the full authority before adapter I/O and passes the stored isolation handle back to the port; cleanup authority is never reconstructed from `(BrowserSessionId, BrowsingContextId)`. For a WebDriver BiDi adapter, the port contract requires a one-to-one mapping from the domain's `DisposableIsolationId` to the specification-defined unique user-context id created for that live boundary. The protocol identifier is lifecycle addressability, not OriginWeave policy authority. Stale, foreign-session, foreign-isolation, unknown, destroyed, or uncertain authority fails closed; failed destruction makes the context uncertain; browser transport loss invalidates active authority; and normal session end is rejected until every owned boundary has proven destruction.
+The disposable-isolation identity binds lifecycle ownership to the exact browser isolation boundary; it does not substitute for `BrowserSessionIncarnation`. Destruction validates the full authority before adapter I/O and passes the stored isolation handle back to the port; cleanup authority is never reconstructed from `(BrowserSessionId, BrowsingContextId)`. For a WebDriver BiDi adapter, the port contract requires a one-to-one mapping from the domain's `DisposableIsolationId` to the specification-defined unique user-context id created for that live boundary. The protocol identifier is lifecycle addressability, not OriginWeave policy authority. Stale, foreign-session, foreign-isolation, unknown, destroyed, or uncertain authority fails closed; failed destruction makes the context uncertain; browser transport loss invalidates active authority; and normal session end is rejected until every owned boundary has proven destruction.
 
 This active slice deliberately stops before browser transport. WebDriver BiDi/CDP remain adapters and do not mint policy authority. The current proposal does not yet bridge domain authority into `originweave-bidi`'s private presentation/screen-area witnesses, implement the real `browser.createUserContext`/`browsingContext.create`/`browser.removeUserContext` adapter, prove exact-boundary cleanup post-conditions in Chromium, or establish protected-main behavior. ADR 0114, the Browser Session traceability dossier, and the lifecycle UML record those remaining boundaries.
 

crates/originweave-browser-session/tests/authorized_context_operation.rs

@@ -0,0 +1,171 @@
+use std::cell::{Cell, RefCell};
+use std::rc::Rc;
+
+use originweave_browser_session::{
+    AuthorizedContextOperationError, AuthorizedContextOperationPort,
+    AuthorizedContextOperationRequest, BrowserSession, BrowserSessionError,
+    BrowserSessionIncarnation, DisposableContextCreateCompletion,
+    DisposableContextCreateCompletionError, DisposableContextCreateError,
+    DisposableContextCreateRequest, DisposableContextDestroyError, DisposableContextDestroyRequest,
+    DisposableContextHandle, DisposableContextPort, DisposableIsolationId,
+};
+use originweave_core::{BrowserSessionId, BrowsingContextId};
+
+struct OperationPort {
+    handle: Option<DisposableContextHandle>,
+    operation_calls: Rc<Cell<usize>>,
+    observed_operations: Rc<RefCell<Vec<&'static str>>>,
+    observed_sessions: Rc<RefCell<Vec<BrowserSessionId>>>,
+    observed_incarnations: Rc<RefCell<Vec<BrowserSessionIncarnation>>>,
+    observed_epochs: Rc<RefCell<Vec<u64>>>,
+    fail_operation: Rc<Cell<bool>>,
+}
+
+impl DisposableContextPort for OperationPort {
+    fn create_disposable_context(
+        &mut self,
+        _request: &DisposableContextCreateRequest,
+    ) -> Result<DisposableContextHandle, DisposableContextCreateError> {
+        self.handle
+            .take()
+            .ok_or(DisposableContextCreateError::CreateFailedClean)
+    }
+
+    fn complete_disposable_context_creation(
+        &mut self,
+        _completion: &DisposableContextCreateCompletion,
+    ) -> Result<(), DisposableContextCreateCompletionError> {
+        Ok(())
+    }
+
+    fn destroy_disposable_context(
+        &mut self,
+        _request: &DisposableContextDestroyRequest,
+    ) -> Result<(), DisposableContextDestroyError> {
+        Ok(())
+    }
+}
+
+impl AuthorizedContextOperationPort for OperationPort {
+    type Operation = &'static str;
+    type Output = BrowsingContextId;
+    type Error = ();
+
+    fn execute_authorized_context_operation(
+        &mut self,
+        request: &AuthorizedContextOperationRequest<Self::Operation>,
+    ) -> Result<Self::Output, Self::Error> {
+        self.operation_calls.set(self.operation_calls.get() + 1);
+        self.observed_operations
+            .borrow_mut()
+            .push(*request.operation());
+        self.observed_sessions
+            .borrow_mut()
+            .push(request.browser_session());
+        self.observed_incarnations
+            .borrow_mut()
+            .push(request.incarnation());
+        self.observed_epochs
+            .borrow_mut()
+            .push(request.context_epoch().value());
+        if self.fail_operation.get() {
+            Err(())
+        } else {
+            Ok(request.context().browsing_context())
+        }
+    }
+}
+
+#[test]
+fn authorized_operation_uses_exact_bound_port_and_rejects_stale_authority_before_io() {
+    let operation_calls = Rc::new(Cell::new(0));
+    let observed_operations = Rc::new(RefCell::new(Vec::new()));
+    let observed_sessions = Rc::new(RefCell::new(Vec::new()));
+    let observed_incarnations = Rc::new(RefCell::new(Vec::new()));
+    let observed_epochs = Rc::new(RefCell::new(Vec::new()));
+    let fail_operation = Rc::new(Cell::new(false));
+    let context = BrowsingContextId::new(503).expect("valid browsing context");
+    let port = OperationPort {
+        handle: Some(DisposableContextHandle::new(
+            DisposableIsolationId::parse("operation-user-context-503").expect("valid isolation id"),
+            context,
+        )),
+        operation_calls: Rc::clone(&operation_calls),
+        observed_operations: Rc::clone(&observed_operations),
+        observed_sessions: Rc::clone(&observed_sessions),
+        observed_incarnations: Rc::clone(&observed_incarnations),
+        observed_epochs: Rc::clone(&observed_epochs),
+        fail_operation: Rc::clone(&fail_operation),
+    };
+    let session_id = BrowserSessionId::new(503).expect("valid session id");
+    let session = BrowserSession::start(session_id).expect("incarnation capacity");
+    let incarnation = session.incarnation();
+    let mut bound = session.bind_lifecycle_port(port);
+
+    let authority = bound
+        .create_disposable_context()
+        .expect("accepted disposable context");
+    assert_eq!(
+        bound.execute_authorized_context_operation(&authority, "set-viewport"),
+        Ok(context)
+    );
+    assert_eq!(operation_calls.get(), 1);
+    assert_eq!(observed_operations.borrow().as_slice(), &["set-viewport"]);
+    assert_eq!(observed_sessions.borrow().as_slice(), &[session_id]);
+    assert_eq!(observed_incarnations.borrow().as_slice(), &[incarnation]);
+    assert_eq!(observed_epochs.borrow().as_slice(), &[1]);
+
+    fail_operation.set(true);
+    assert_eq!(
+        bound.execute_authorized_context_operation(&authority, "remote-failure"),
+        Err(AuthorizedContextOperationError::Adapter(()))
+    );
+    assert_eq!(operation_calls.get(), 2);
+    assert_eq!(observed_epochs.borrow().as_slice(), &[1, 1]);
+    fail_operation.set(false);
+
+    let current = bound
+        .advance_context_epoch(context)
+        .expect("advance authority epoch");
+    assert_eq!(
+        bound.execute_authorized_context_operation(&authority, "stale-operation"),
+        Err(AuthorizedContextOperationError::BrowserSession(
+            BrowserSessionError::AuthorityMismatch
+        ))
+    );
+    assert_eq!(
+        operation_calls.get(),
+        2,
+        "stale authority must fail before the bound adapter observes an operation"
+    );
+    assert_eq!(
+        observed_epochs.borrow().as_slice(),
+        &[1, 1],
+        "stale authority must not emit an adapter request or provenance epoch"
+    );
+
+    assert_eq!(
+        bound.execute_authorized_context_operation(&current, "reconcile-liveness"),
+        Ok(context)
+    );
+    assert_eq!(operation_calls.get(), 3);
+    assert_eq!(
+        observed_operations.borrow().as_slice(),
+        &["set-viewport", "remote-failure", "reconcile-liveness"]
+    );
+    assert_eq!(
+        observed_sessions.borrow().as_slice(),
+        &[session_id, session_id, session_id],
+        "the purpose-bounded adapter must observe only the bound Browser Session identity"
+    );
+    assert_eq!(
+        observed_incarnations.borrow().as_slice(),
+        &[incarnation, incarnation, incarnation],
+        "the purpose-bounded adapter must observe only the bound Browser Session incarnation"
+    );
+    assert_eq!(
+        observed_epochs.borrow().as_slice(),
+        &[1, 1, 2],
+        "adapter requests must retain the exact validated authority epoch"
+    );
+}

crates/originweave-browser-session/tests/bound_session_abandonment.rs

@@ -0,0 +1,187 @@
+use std::cell::Cell;
+use std::rc::Rc;
+use std::sync::Mutex;
+
+use originweave_browser_session::{
+    BrowserSession, BrowserSessionError, DisposableContextCreateCompletion,
+    DisposableContextCreateCompletionError, DisposableContextCreateError,
+    DisposableContextCreateRequest, DisposableContextDestroyError, DisposableContextDestroyRequest,
+    DisposableContextHandle, DisposableContextPort, DisposableIsolationId,
+    abandoned_bound_session_count,
+};
+use originweave_core::{BrowserSessionId, BrowsingContextId};
+
+static ABANDONMENT_COUNTER_LOCK: Mutex<()> = Mutex::new(());
+
+struct AbandonmentPort {
+    handle: Option<DisposableContextHandle>,
+    destroy_calls: Rc<Cell<usize>>,
+}
+
+impl DisposableContextPort for AbandonmentPort {
+    fn create_disposable_context(
+        &mut self,
+        _request: &DisposableContextCreateRequest,
+    ) -> Result<DisposableContextHandle, DisposableContextCreateError> {
+        self.handle
+            .take()
+            .ok_or(DisposableContextCreateError::CreateFailedClean)
+    }
+
+    fn complete_disposable_context_creation(
+        &mut self,
+        _completion: &DisposableContextCreateCompletion,
+    ) -> Result<(), DisposableContextCreateCompletionError> {
+        Ok(())
+    }
+
+    fn destroy_disposable_context(
+        &mut self,
+        _request: &DisposableContextDestroyRequest,
+    ) -> Result<(), DisposableContextDestroyError> {
+        self.destroy_calls.set(self.destroy_calls.get() + 1);
+        Ok(())
+    }
+}
+
+fn port_for(context: u64, destroy_calls: &Rc<Cell<usize>>) -> AbandonmentPort {
+    AbandonmentPort {
+        handle: Some(DisposableContextHandle::new(
+            DisposableIsolationId::parse(&format!("abandoned-user-context-{context}"))
+                .expect("valid isolation id"),
+            BrowsingContextId::new(context).expect("valid browsing context"),
+        )),
+        destroy_calls: Rc::clone(destroy_calls),
+    }
+}
+
+#[test]
+fn dropping_unresolved_bound_session_is_observable_without_implicit_browser_io() {
+    let _guard = ABANDONMENT_COUNTER_LOCK
+        .lock()
+        .expect("abandonment counter test lock");
+    let destroy_calls = Rc::new(Cell::new(0));
+    let before = abandoned_bound_session_count();
+    let session = BrowserSession::start(BrowserSessionId::new(504).expect("valid session id"))
+        .expect("incarnation capacity");
+    let mut bound = session.bind_lifecycle_port(port_for(504, &destroy_calls));
+    let _authority = bound
+        .create_disposable_context()
+        .expect("accepted disposable context");
+
+    drop(bound);
+
+    assert_eq!(
+        destroy_calls.get(),
+        0,
+        "Drop must never pretend synchronous browser cleanup succeeded"
+    );
+    assert!(
+        abandoned_bound_session_count() > before,
+        "unresolved bound-session abandonment must be observable to recovery/operability code"
+    );
+}
+
+#[test]
+fn transport_loss_without_remote_ownership_is_not_counted_as_abandonment() {
+    let _guard = ABANDONMENT_COUNTER_LOCK
+        .lock()
+        .expect("abandonment counter test lock");
+    let destroy_calls = Rc::new(Cell::new(0));
+    let before = abandoned_bound_session_count();
+
+    let empty_session = BrowserSession::start(BrowserSessionId::new(507).expect("valid session id"))
+        .expect("incarnation capacity");
+    let mut empty_bound = empty_session.bind_lifecycle_port(port_for(507, &destroy_calls));
+    assert!(empty_bound.record_transport_loss());
+    drop(empty_bound);
+    assert_eq!(
+        abandoned_bound_session_count(),
+        before,
+        "transport loss with no owned or uncertain browser context is not unresolved remote ownership"
+    );
+
+    let session = BrowserSession::start(BrowserSessionId::new(508).expect("valid session id"))
+        .expect("incarnation capacity");
+    let mut bound = session.bind_lifecycle_port(port_for(508, &destroy_calls));
+    let authority = bound
+        .create_disposable_context()
+        .expect("accepted disposable context");
+    bound
+        .destroy_disposable_context(&authority)
+        .expect("proven destruction");
+    assert!(bound.record_transport_loss());
+    drop(bound);
+
+    assert_eq!(destroy_calls.get(), 1);
+    assert_eq!(
+        abandoned_bound_session_count(),
+        before,
+        "transport loss after all remote ownership was proven destroyed must not create a false abandonment signal"
+    );
+}
+
+#[test]
+fn failed_finish_retains_same_bound_owner_for_cleanup_and_retry() {
+    let _guard = ABANDONMENT_COUNTER_LOCK
+        .lock()
+        .expect("abandonment counter test lock");
+    let destroy_calls = Rc::new(Cell::new(0));
+    let before = abandoned_bound_session_count();
+    let session = BrowserSession::start(BrowserSessionId::new(506).expect("valid session id"))
+        .expect("incarnation capacity");
+    let mut bound = session.bind_lifecycle_port(port_for(506, &destroy_calls));
+    let authority = bound
+        .create_disposable_context()
+        .expect("accepted disposable context");
+
+    assert_eq!(
+        bound.finish(),
+        Err(BrowserSessionError::ActiveContextRemains)
+    );
+    assert_eq!(
+        abandoned_bound_session_count(),
+        before,
+        "a failed deliberate finish must retain the bound lifecycle owner instead of dropping it as abandonment"
+    );
+    assert_eq!(
+        destroy_calls.get(),
+        0,
+        "failed finish validation must not perform implicit browser cleanup"
+    );
+
+    bound
+        .destroy_disposable_context(&authority)
+        .expect("the same bound lifecycle owner must remain available for cleanup");
+    assert_eq!(destroy_calls.get(), 1);
+    bound
+        .finish()
+        .expect("retry succeeds after proven destruction");
+    drop(bound);
+    assert_eq!(
+        abandoned_bound_session_count(),
+        before,
+        "successful retry must leave no abandonment signal"
+    );
+}
+
+#[test]
+fn proven_destruction_can_finish_without_abandonment_path() {
+    let _guard = ABANDONMENT_COUNTER_LOCK
+        .lock()
+        .expect("abandonment counter test lock");
+    let destroy_calls = Rc::new(Cell::new(0));
+    let session = BrowserSession::start(BrowserSessionId::new(505).expect("valid session id"))
+        .expect("incarnation capacity");
+    let mut bound = session.bind_lifecycle_port(port_for(505, &destroy_calls));
+    let authority = bound
+        .create_disposable_context()
+        .expect("accepted disposable context");
+    bound
+        .destroy_disposable_context(&authority)
+        .expect("proven destruction");
+    bound
+        .finish()
+        .expect("end normally after proven destruction");
+    assert_eq!(destroy_calls.get(), 1);
+}