feat(network): bind typed transport evidence to BiDi teardown

AGENTS.md

@@ -113,6 +113,27 @@ A skipped security, GPU, browser, TLS, or statistical test is not passing eviden
 - Run reasoning-effort and orchestration-depth ablations before claiming an LLM path is superior.
 - Scheduled agents may create bounded reviewed PRs but may not merge, tag, publish, alter workflows, add secrets, or weaken checks.
 
+### Coverage diagnosis lesson
+
+Keep generic wire-code validation separate from endpoint-role validation. For
+WebSocket Close, reject server-sent client-only 1010 in the client closure state
+machine before echoing it, and pair that RED case with valid server 1011 so a
+blanket rejection cannot satisfy the regression.
+
+Repeated control-frame support must preserve the total deadline and per-write masking authority. Supply a separate caller-owned key per Ping, consume none for unsolicited Pong, and keep the Close key independent. Test exact-budget success, budget overflow, exhausted keys, and reused keys with a peer that verifies no rejected reply. The 64-control budget is local resource policy, not an RFC limit.
+
+For Close-code validation, check the current IANA registry as well as RFC 6455: the protocol-reserved range is not an allowance for unassigned values. Keep application/private ranges separate, test assigned and reserved boundaries, and verify rejected peer codes produce neither an echo nor closure evidence. Record the registry date; future assignments need a reviewed update, not ambient network lookup during frame parsing.
+
+For a multi-step socket deadline, reproduce a sequence whose individual waits fit the limit but whose sum does not. Carry one monotonic expiry through every step and recheck before admitting final evidence. Pair real delayed-peer tests with a controlled clock at each read/write/evidence transition; a pre-I/O check alone cannot reject late completion. This is not a hard real-time host scheduling guarantee.
+
+Aggregate LLVM code regions by source coordinates across function instantiations before identifying a missing path. An invalid-input test at a public entry point may stop at an earlier guard; it does not prove a later private writer's error return executed. Exercise that writer directly, assert the exact error, and verify the peer received no bytes. Do not rewrite production predicates based only on a file-level coverage deficit.
+
+Coordinate union alone does not reproduce LLVM's region summary: `RegionCoverageInfo::merge` takes maximum covered/total counts across instantiations. Complementary unit-test and integration-test executions can therefore leave a deficit. Exercise successful status-bearing and empty Close writes, invalid deadlines, and adjacent masking-key rejection in the same unit-test binary; compare literal wire bytes and join the peer. Reference: LLVM Project. (n.d.). *CoverageSummaryInfo.h* [Source code]. https://github.com/llvm/llvm-project/blob/main/llvm/tools/llvm-cov/CoverageSummaryInfo.h
+
+Inspect uncovered coordinates inside test assertions too: guarded `matches!` expressions can contribute never-taken failure branches to the file summary. Preserve exact variant and field checks rather than broadening the accepted error to make coverage pass.
+
+Mask-reuse socket tests must consume the preceding text/Pong frame before sending the frame that triggers rejection. Assert the exact reuse error, literal preceding bytes, and EOF with no rejected response; propagate peer thread errors. A broad transport-error assertion plus an ignored join can pass because the peer rejected the fixture's own wrong opcode. An intervening fresh-key Pong also changes the adjacent-key history, so an older text key does not test adjacent Close-key reuse.
+
 ## Release contract
 
 A release requires all current-head checks, complete coverage and docs, updated `CHANGELOG.md`, SBOM and provenance, reproducible artifacts, compatibility evidence, security review, and an explicit version decision. Pre-alpha commits are not releases.

CHANGELOG.md

@@ -4,12 +4,34 @@ All notable changes to OriginWeave are documented in this file. The format follo
 
 ## [Unreleased]
 
+### Changed
+
+- Browser transport shutdown rejects the client-only Close status 1010 when received from a server, before sending a reply or recording completion; server status 1011 remains supported.
+
+- Browser transport shutdown now handles repeated keepalive traffic within one time budget, using a separate supplied key for each reply and rejecting exhausted keys or excess traffic without reporting completion.
+
+- Browser transport shutdown rejects unassigned protocol close codes before replying or recording completion; application and private-use code ranges remain supported.
+
+- Browser transport shutdown now shares one time budget across control replies and final connection closure; late closure cannot become successful completion evidence.
+
+- Restored the simple frame-timeout validation after correcting coverage diagnosis; direct Close-writer tests verify invalid deadlines send no bytes and return the expected error.
+- Kept exact invalid-deadline error checks without compound test-only guards in the coverage measurement.
+- Verified literal masked Close bytes with and without a status code, and that a reused masking key emits no Close bytes after the preceding text frame.
+- Corrected three masking-rejection test peers so unrelated socket errors cannot masquerade as key-reuse protection; each now verifies the preceding frame, the exact rejection, and no subsequent bytes.
+
+- Removed an unused private correlated-response accessor while retaining connection-generation validation at the receiving-message boundary, and corrected the Rust `AtomicU64` standard-library reference to its canonical type-alias page.
+- Integrated the current teardown prerequisites into transport-closure observation, including the previously uncollected release-record check, while retaining the unresolved connection-provenance finding and its downstream repair ownership.
+- Integrated the verified opening-exchange and closure prerequisites into the connection-bound response repair, preserving its sender, receiver and closure provenance checks while restoring the inherited executable release contract; process and profile cleanup remain unproven.
+
 ### Added
 
 - Session-ending replies from a replacement connection can no longer complete the original pending request. The original reply remains usable, and a protocol acknowledgment still does not prove browser shutdown or cleanup.
 - The session-ending command stack now retains the status-reply protections from its current parent. A reply from a replacement connection is rejected while the original pending status request remains recoverable; sending the end command still does not prove that the browser session ended.
 - Typed outbound WebDriver BiDi `session.end` over the bounded client WebSocket stream: it serializes only the standards-defined method with empty params, rejects invalid frame deadlines before correlation registration, retires only the just-registered id when frame preflight proves no command bytes were emitted, preserves exact command-kind correlation across ambiguous writes, and does not treat frame-write success as proof that the browser session ended.
 - Typed `session.end` response admission that consumes only the exact outstanding command-kind correlation after complete envelope validation, preserves remote protocol errors as failures, and does not claim browser-process exit or resource cleanup from a protocol acknowledgment.
+- Fail-closed `session.end` teardown assessment that binds only the typed observation produced by consuming the exact transport, keeps browser-process-exit and task-profile-removal evidence unavailable until their runtime owners exist, and therefore cannot report operational completion from caller-supplied booleans.
+- Bounded WebDriver BiDi transport-closure observation that consumes the established stream, accepts only a validated peer Close frame or clean pre-frame EOF, permits at most one unsolicited Pong, and keeps transport closure separate from process-exit and profile-cleanup claims.
+
 - Regression checks now exercise fragmented browser replies, interleaved control messages, and rejected replies without losing a pending request. These checks do not establish browser readiness or release acceptance.
 - The typed browser-status response stack now includes its verified command and opening-exchange prerequisites, including the release-record check that previously did not execute; parsing remains bounded and does not grant browser authority or prove operational readiness.
 - Bounded RFC 6455 WebDriver BiDi opening-response validation on the exact peer-verified stream: it admits only HTTP/1.1 `101`, case-insensitive `Upgrade`/`Connection` tokens, and the client-key-correlated `Sec-WebSocket-Accept` value within monotonic time and header-size ceilings; it restores blocking mode and still does not implement WebSocket frames or grant browser/Agent authority.
@@ -62,6 +84,7 @@ All notable changes to OriginWeave are documented in this file. The format follo
 
 ### Changed
 
+- Carried current response prerequisites and the executable release-record check into the teardown-assessment stack; caller-supplied cleanup claims remain unverified and cannot establish operational acceptance.
 - Carried verified command prerequisites and the executable release-record check into session-end response validation without changing response admission or treating an acknowledgment as proof of resource cleanup.
 - Carried the verified status-response prerequisites into the session-end sender, preserving its command behavior and making the inherited release-record check execute in the existing test suite.
 - Kept the `session.status` frame-failure coverage contract focused on observable correlation state, avoiding assertion-internal uncovered branches without weakening preflight retirement or ambiguous-write retention checks.

crates/originweave-network/src/lib.rs

@@ -7,10 +7,14 @@
 //! `originweave-core` into one bounded exact TCP connection, binds and validates
 //! the RFC 6455 opening exchange, provides bounded masked client writes and
 //! unmasked server-frame reads, assembles bounded WebDriver BiDi text messages,
-//! classifies complete local-end JSON envelopes, tracks bounded command-response
-//! correlation, sends narrowly typed `session.status` and `session.end` commands,
-//! and admits typed correlated status and end responses without exposing generic
-//! JSON bodies or granting browser, TLS, policy, secret, or Agent authority.
+//! binds received fragmented text to one exact verified connection, classifies
+//! complete local-end JSON envelopes, tracks bounded command-response correlation,
+//! sends narrowly typed `session.status` and `session.end` commands, admits typed
+//! correlated status and end responses, binds `session.end` ACK and closure evidence
+//! to one private process-local connection generation, observes bounded peer Close
+//! or clean-EOF transport cessation, and keeps protocol/transport evidence separate
+//! from explicit operational teardown observations without exposing generic JSON
+//! bodies or granting browser, TLS, policy, secret, process, profile, or Agent authority.
 
 #![forbid(unsafe_code)]
 #![deny(missing_docs)]
@@ -24,14 +28,24 @@ mod webdriver_bidi_session_end_command;
 mod webdriver_bidi_session_end_response;
 mod webdriver_bidi_session_status_command;
 mod webdriver_bidi_session_status_response;
+mod webdriver_bidi_session_teardown;
 mod webdriver_bidi_websocket_frame;
 mod webdriver_bidi_websocket_handshake;
 mod webdriver_bidi_websocket_message;
 mod webdriver_bidi_websocket_opening_recovery;
+mod webdriver_bidi_websocket_transport_closure;
 
 #[cfg(test)]
 mod webdriver_bidi_json_envelope_public_boundary_tests;
 
+// LLVM coverage keeps the crate unit-test instantiation separate from integration-test binaries,
+// so compile the same realistic 1010/1011 loopback contract here instead of maintaining a copy.
+#[cfg(test)]
+extern crate self as originweave_network;
+#[cfg(test)]
+#[path = "../tests/webdriver_bidi_transport_close_role_validation.rs"]
+mod webdriver_bidi_transport_close_role_validation_unit;
+
 pub use connection::{
     ConnectionPlan, DirectTcpConnection, MAX_CONNECT_TIMEOUT, MAX_CONNECTION_ATTEMPTS,
     NetworkError, SocketConnectionEvidence,
@@ -67,6 +81,10 @@ pub use webdriver_bidi_session_status_response::{
     MAX_WEBDRIVER_BIDI_SESSION_STATUS_MESSAGE_SIZE, WebDriverBiDiSessionStatusResponseError,
     WebDriverBiDiSessionStatusResult,
 };
+pub use webdriver_bidi_session_teardown::{
+    WebDriverBiDiSessionTeardownAssessment, WebDriverBiDiSessionTeardownAssessmentError,
+    WebDriverBiDiSessionTeardownDisposition, WebDriverBiDiSessionTeardownObservations,
+};
 pub use webdriver_bidi_websocket_frame::{
     MAX_WEBSOCKET_FRAME_PAYLOAD_SIZE, MAX_WEBSOCKET_FRAME_TIMEOUT,
     WebDriverBiDiWebSocketEstablished, WebDriverBiDiWebSocketFrame,
@@ -86,3 +104,7 @@ pub use webdriver_bidi_websocket_message::{
     WebDriverBiDiWebSocketTextMessage,
 };
 pub use webdriver_bidi_websocket_opening_recovery::WebDriverBiDiWebSocketOpeningWriteRecoveryDisposition;
+pub use webdriver_bidi_websocket_transport_closure::{
+    WebDriverBiDiWebSocketTransportClosureError, WebDriverBiDiWebSocketTransportClosureKind,
+    WebDriverBiDiWebSocketTransportClosureObservation,
+};

crates/originweave-network/src/webdriver_bidi_command_correlation.rs

@@ -32,6 +32,25 @@ struct OutstandingCommand {
     connection_generation: Option<WebDriverBiDiConnectionGeneration>,
 }
 
+fn response_route(
+    envelope: &WebDriverBiDiJsonEnvelope,
+) -> Result<(u64, WebDriverBiDiCorrelatedResponseOutcome), WebDriverBiDiCommandCorrelationError> {
+    match envelope.routing() {
+        WebDriverBiDiJsonEnvelopeRouting::Event => {
+            Err(WebDriverBiDiCommandCorrelationError::EventIsNotResponse)
+        }
+        WebDriverBiDiJsonEnvelopeRouting::CommandError { command_id: None } => {
+            Err(WebDriverBiDiCommandCorrelationError::UncorrelatableErrorResponse)
+        }
+        WebDriverBiDiJsonEnvelopeRouting::CommandError {
+            command_id: Some(command_id),
+        } => Ok((command_id, WebDriverBiDiCorrelatedResponseOutcome::Error)),
+        WebDriverBiDiJsonEnvelopeRouting::CommandSuccess { command_id } => {
+            Ok((command_id, WebDriverBiDiCorrelatedResponseOutcome::Success))
+        }
+    }
+}
+
 /// Outcome of a response after it has consumed the matching outstanding command identifier.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub enum WebDriverBiDiCorrelatedResponseOutcome {
@@ -239,8 +258,26 @@ impl WebDriverBiDiCommandCorrelation {
         envelope: &WebDriverBiDiJsonEnvelope,
         expected_kind: WebDriverBiDiCommandKind,
     ) -> Result<WebDriverBiDiCorrelatedResponse, WebDriverBiDiCommandCorrelationError> {
-        let (command_id, outcome) = response_route(envelope)?;
-        self.complete(command_id, expected_kind, outcome)
+        match envelope.routing() {
+            WebDriverBiDiJsonEnvelopeRouting::Event => {
+                Err(WebDriverBiDiCommandCorrelationError::EventIsNotResponse)
+            }
+            WebDriverBiDiJsonEnvelopeRouting::CommandError { command_id: None } => {
+                Err(WebDriverBiDiCommandCorrelationError::UncorrelatableErrorResponse)
+            }
+            WebDriverBiDiJsonEnvelopeRouting::CommandError {
+                command_id: Some(command_id),
+            } => self.complete(
+                command_id,
+                expected_kind,
+                WebDriverBiDiCorrelatedResponseOutcome::Error,
+            ),
+            WebDriverBiDiJsonEnvelopeRouting::CommandSuccess { command_id } => self.complete(
+                command_id,
+                expected_kind,
+                WebDriverBiDiCorrelatedResponseOutcome::Success,
+            ),
+        }
     }
 
     pub(crate) fn correlate_response_for_connection(
@@ -317,25 +354,6 @@ impl WebDriverBiDiCommandCorrelation {
     }
 }
 
-fn response_route(
-    envelope: &WebDriverBiDiJsonEnvelope,
-) -> Result<(u64, WebDriverBiDiCorrelatedResponseOutcome), WebDriverBiDiCommandCorrelationError> {
-    match envelope.routing() {
-        WebDriverBiDiJsonEnvelopeRouting::Event => {
-            Err(WebDriverBiDiCommandCorrelationError::EventIsNotResponse)
-        }
-        WebDriverBiDiJsonEnvelopeRouting::CommandError { command_id: None } => {
-            Err(WebDriverBiDiCommandCorrelationError::UncorrelatableErrorResponse)
-        }
-        WebDriverBiDiJsonEnvelopeRouting::CommandError {
-            command_id: Some(command_id),
-        } => Ok((command_id, WebDriverBiDiCorrelatedResponseOutcome::Error)),
-        WebDriverBiDiJsonEnvelopeRouting::CommandSuccess { command_id } => {
-            Ok((command_id, WebDriverBiDiCorrelatedResponseOutcome::Success))
-        }
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::{WebDriverBiDiCommandCorrelationError, WebDriverBiDiCommandKind};

crates/originweave-network/src/webdriver_bidi_session_end_command.rs

@@ -41,12 +41,12 @@ impl WebDriverBiDiSessionEndCommand {
     /// Register and write this exact command on an already established verified BiDi stream.
     ///
     /// Locally invalid frame deadlines fail before correlation registration and before any remote
-    /// side effect. Correlation then binds the command to this connection before the first possible
-    /// frame write. Only a reply received on this same connection can complete that registration.
-    /// A frame-owner preflight rejection that proves no write began retires this exact command
-    /// again. Once frame emission can have begun, a later failure leaves the identifier outstanding
-    /// because partial or full emission is ambiguous. A successful write also leaves the identifier
-    /// outstanding until a later correlated response proves completion.
+    /// side effect. Correlation then binds the command id and command family to the private
+    /// process-local generation of this exact established connection before the first possible
+    /// frame write. A frame-owner preflight rejection that proves no write began retires this exact
+    /// command again. Once frame emission can have begun, a later failure leaves the identifier
+    /// outstanding because partial or full emission is ambiguous. A successful write also leaves
+    /// the identifier outstanding until a later correlated response proves completion.
     pub fn send(
         self,
         established: WebDriverBiDiWebSocketEstablished,
@@ -62,11 +62,12 @@ impl WebDriverBiDiSessionEndCommand {
                 },
             });
         }
+        let connection_generation = established.transport_evidence().connection_generation();
         correlation
             .register_command_for_connection(
                 self.command_id,
                 WebDriverBiDiCommandKind::SessionEnd,
-                established.transport_evidence().connection_generation(),
+                connection_generation,
             )
             .map_err(|source| WebDriverBiDiSessionEndCommandError::Correlation { source })?;
         let message = self.serialized();