feat(network): bind navigation events to active subscriptions

CHANGELOG.md

@@ -4,8 +4,22 @@ All notable changes to OriginWeave are documented in this file. The format follo
 
 ## [Unreleased]
 
+- Integrated the current navigation-subscription safeguards while preserving active-subscription admission, replay rejection and stale-document checks. A response from a replacement connection still cannot complete an earlier session shutdown; this source integration is not real-browser or release acceptance.
+
 ### Changed
 
+- Reject replacement-connection click replies while retaining increasing request numbers, original subscription ownership and same-connection shutdown checks.
+
+- Reject a navigation subscription aimed at a different browser session before sending it, without creating or replacing browser state.
+- Keep connection-failure checks focused on the requested action by completing fixture setup before the simulated peer disconnects.
+
+- Keep subscription shutdown on its original connection and reject replies from another connection without losing the pending request. Beginning shutdown ends local event admission; a failed shutdown requires a new subscription before admission resumes.
+
+- Prevent an earlier browser reply from completing a later request that reuses its number. Typed browser requests now use increasing numbers on each connection, and low-level protocol traffic uses a separate connection.
+
+- Keep navigation subscriptions and accepted navigation events attached to their original browser state, so a replacement state with matching local identifiers cannot send a request or change another document.
+- Reject navigation-subscription replies and events received on a different connection, even when their session and request details match. Rejected messages leave the original request and document unchanged, so the original connection can still complete its work.
+- Prevent an unsent navigation subscription from borrowing another request's successful response, including when separate sessions reuse the same local numbers. Re-registering a completed request number without sending a new request cannot recreate its consumed subscription.
 - Carried replacement-connection subscription-reply rejection into unsubscribe preparation, preserving opaque identifiers and existing teardown checks without claiming that pending events have drained.
 - Reject navigation-subscription replies received on replacement connections while keeping the original request available for its own reply; a successful subscription still does not prove that a navigation occurred.
 - Carried replacement-connection click-reply rejection into the navigation-subscription stack while preserving deadline rejection, unrelated pending requests and conservative handling of uncertain writes.

crates/originweave-core/src/browser_authority_registry.rs

@@ -1,3 +1,5 @@
+use std::sync::Arc;
+
 use crate::browser_registry::BrowserAuthorityRegistry as RawBrowserAuthorityRegistry;
 use crate::{
     BrowserRegistryError, BrowserSessionId, BrowsingContextId, DocumentEpoch, ObservedNodeHandle,
@@ -15,14 +17,24 @@ use crate::{
 /// before atomically minting handles.
 pub struct BrowserAuthorityRegistry {
     inner: RawBrowserAuthorityRegistry,
+    registry_identity: Arc<()>,
 }
 
+/// Opaque process-local identity of one browser-authority registry allocation.
+///
+/// Cloning preserves the same registry identity without keeping its mutable state alive. This
+/// witness contains no wire identifier, address, durable identity, or grant of browser authority.
+/// It must be captured by a trusted admission boundary and revalidated with current context state.
+#[derive(Clone)]
+pub struct BrowserRegistryIdentity(Arc<()>);
+
 impl BrowserAuthorityRegistry {
     /// Create an empty registry with the reviewed default per-namespace identifier capacity.
     #[must_use]
     pub fn new() -> Self {
         Self {
             inner: RawBrowserAuthorityRegistry::new(),
+            registry_identity: Arc::new(()),
         }
     }
 
@@ -34,9 +46,33 @@ impl BrowserAuthorityRegistry {
     pub fn with_identifier_limit(maximum_identifier: u64) -> Self {
         Self {
             inner: RawBrowserAuthorityRegistry::with_identifier_limit(maximum_identifier),
+            registry_identity: Arc::new(()),
         }
     }
 
+    /// Capture this registry's opaque identity for later exact-owner revalidation.
+    ///
+    /// The identity survives moves of this registry but cannot match a replacement registry,
+    /// including one whose local session and context identifiers have identical numeric values.
+    #[must_use]
+    pub fn registry_identity(&self) -> BrowserRegistryIdentity {
+        BrowserRegistryIdentity(Arc::clone(&self.registry_identity))
+    }
+
+    /// Reject a witness issued by any other registry before consulting registry-local identifiers.
+    ///
+    /// Success proves only registry ownership; callers must still validate live session, context,
+    /// document epoch, origin and operation-specific authority at their actual use boundary.
+    pub fn require_identity(
+        &self,
+        expected_identity: &BrowserRegistryIdentity,
+    ) -> Result<(), BrowserRegistryError> {
+        if !Arc::ptr_eq(&self.registry_identity, &expected_identity.0) {
+            return Err(BrowserRegistryError::RegistryInstanceMismatch);
+        }
+        Ok(())
+    }
+
     /// Register one opaque external browser-session identifier.
     pub fn register_session(
         &mut self,
@@ -45,6 +81,20 @@ impl BrowserAuthorityRegistry {
         self.inner.register_session(external_identifier)
     }
 
+    /// Require external protocol session text to name this exact currently registered session.
+    ///
+    /// This read-only check reuses the canonical mapping and never creates authority from transport
+    /// text. Unknown, retired and mismatched sessions fail closed. Success does not authenticate a
+    /// browser process or authorize an action; callers must also revalidate registry ownership.
+    pub fn require_registered_session_external_identifier(
+        &self,
+        browser_session: BrowserSessionId,
+        external_identifier: &str,
+    ) -> Result<(), BrowserRegistryError> {
+        self.inner
+            .require_session_external_identifier(browser_session, external_identifier)
+    }
+
     /// Register one opaque external browsing-context identifier inside a known browser session.
     pub fn register_context(
         &mut self,

crates/originweave-core/src/browser_registry.rs

@@ -108,6 +108,19 @@ impl BrowserAuthorityRegistry {
         })
     }
 
+    /// Check the existing canonical external-session mapping without creating authority.
+    pub(crate) fn require_session_external_identifier(
+        &self,
+        browser_session: BrowserSessionId,
+        external_identifier: &str,
+    ) -> Result<(), BrowserRegistryError> {
+        validate_external_identifier(external_identifier)?;
+        if self.session_by_external.get(external_identifier).copied() != Some(browser_session) {
+            return Err(BrowserRegistryError::SessionExternalIdentifierMismatch);
+        }
+        Ok(())
+    }
+
     /// Register one opaque external browsing-context identifier inside a known browser session.
     ///
     /// A newly registered context starts at document epoch one. The same external context text in
@@ -427,10 +440,14 @@ impl Default for BrowserAuthorityRegistry {
 /// A fail-closed error produced while translating external browser identifiers into local authority.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum BrowserRegistryError {
+    /// A retained authority witness belongs to a different registry instance.
+    RegistryInstanceMismatch,
     /// An external identifier was empty, contained control, whitespace, or Unicode format text, or exceeded the reviewed byte bound.
     InvalidExternalIdentifier,
     /// The supplied OriginWeave browser session is not registered in this registry.
     UnknownBrowserSession,
+    /// The transport-level session identifier does not name the supplied registered session.
+    SessionExternalIdentifierMismatch,
     /// The supplied OriginWeave browsing context is not registered in this registry.
     UnknownBrowsingContext,
     /// The browsing context belongs to another browser session.
@@ -457,12 +474,18 @@ pub enum BrowserRegistryError {
 impl fmt::Display for BrowserRegistryError {
     fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {
+            Self::RegistryInstanceMismatch => {
+                formatter.write_str("browser authority belongs to another registry instance")
+            }
             Self::InvalidExternalIdentifier => formatter.write_str(
                 "external browser identifier must contain 1 to 512 UTF-8 bytes without control, whitespace, or Unicode format characters",
             ),
             Self::UnknownBrowserSession => {
                 formatter.write_str("browser session is not registered in this authority registry")
             }
+            Self::SessionExternalIdentifierMismatch => formatter.write_str(
+                "browser session external identifier does not match the registered session",
+            ),
             Self::UnknownBrowsingContext => {
                 formatter.write_str("browsing context is not registered in this authority registry")
             }
@@ -836,13 +859,30 @@ mod tests {
 
     #[test]
     fn browser_registry_errors_have_non_sensitive_deterministic_text() {
+        let original_registry = crate::BrowserAuthorityRegistry::new();
+        let retained_identity = original_registry.registry_identity().clone();
+        assert!(
+            original_registry
+                .require_identity(&retained_identity)
+                .is_ok()
+        );
+        drop(original_registry);
+        let replacement_registry = crate::BrowserAuthorityRegistry::with_identifier_limit(8);
+        let replacement_errors: Vec<_> = replacement_registry
+            .require_identity(&retained_identity)
+            .err()
+            .into_iter()
+            .collect();
+        assert_eq!(replacement_errors.len(), 1);
         let expected_values = values(BrowserSessionId::new(1));
         let actual_values = values(BrowserSessionId::new(2));
         assert_eq!(expected_values.len(), 1);
         assert_eq!(actual_values.len(), 1);
         let errors = [
+            replacement_errors[0],
             BrowserRegistryError::InvalidExternalIdentifier,
             BrowserRegistryError::UnknownBrowserSession,
+            BrowserRegistryError::SessionExternalIdentifierMismatch,
             BrowserRegistryError::UnknownBrowsingContext,
             BrowserRegistryError::ContextSessionMismatch {
                 expected: expected_values[0],

crates/originweave-core/src/lib.rs

@@ -41,7 +41,7 @@ mod webdriver_bidi_result;
 mod webdriver_bidi_websocket_connect_target;
 mod webdriver_bidi_websocket_endpoint;
 
-pub use browser_authority_registry::BrowserAuthorityRegistry;
+pub use browser_authority_registry::{BrowserAuthorityRegistry, BrowserRegistryIdentity};
 pub use browser_protocol::{
     BrowserProtocolAdapterDescriptor, BrowserProtocolCapability,
     BrowserProtocolCapabilityRequirementError, BrowserProtocolDescriptorError, BrowserProtocolKind,

crates/originweave-core/tests/browser_registry_session_provenance.rs

@@ -0,0 +1,46 @@
+use originweave_core::{BrowserAuthorityRegistry, BrowserRegistryError, BrowserSessionId};
+
+#[test]
+fn session_mapping_is_read_only_exact_and_revoked_on_retirement() -> Result<(), BrowserRegistryError>
+{
+    let mut registry = BrowserAuthorityRegistry::new();
+    let first = registry.register_session("session-a")?;
+    let second = registry.register_session("session-b")?;
+    registry.require_registered_session_external_identifier(first, "session-a")?;
+    for (session, external) in [
+        (first, "session-b"),
+        (second, "session-a"),
+        (first, "unknown"),
+        (
+            BrowserSessionId::new(99)
+                .map_err(|_| BrowserRegistryError::InternalAuthorityInvariant)?,
+            "session-a",
+        ),
+    ] {
+        assert_eq!(
+            registry.require_registered_session_external_identifier(session, external),
+            Err(BrowserRegistryError::SessionExternalIdentifierMismatch)
+        );
+    }
+    assert_eq!(
+        registry.require_registered_session_external_identifier(first, "\n"),
+        Err(BrowserRegistryError::InvalidExternalIdentifier)
+    );
+    registry.remove_session(first)?;
+    assert_eq!(
+        registry.require_registered_session_external_identifier(first, "session-a"),
+        Err(BrowserRegistryError::SessionExternalIdentifierMismatch)
+    );
+    let replacement = registry.register_session("session-a")?;
+    assert_ne!(first, replacement);
+    registry.require_registered_session_external_identifier(replacement, "session-a")?;
+    assert_eq!(
+        registry.require_registered_session_external_identifier(first, "session-a"),
+        Err(BrowserRegistryError::SessionExternalIdentifierMismatch)
+    );
+    assert_eq!(
+        BrowserRegistryError::SessionExternalIdentifierMismatch.to_string(),
+        "browser session external identifier does not match the registered session"
+    );
+    Ok(())
+}

crates/originweave-network/src/lib.rs

@@ -11,7 +11,9 @@
 //! complete local-end JSON envelopes, tracks bounded command-response correlation,
 //! transports a narrowly typed pointer click, admits its typed correlated protocol
 //! response, sends a context-bound committed-navigation subscription and retains
-//! its typed bounded correlated identifier, explicitly unsubscribes that exact
+//! its typed bounded correlated identifier, binds navigation-event admission to
+//! that active command/receipt lifecycle with bounded fail-closed navigation replay
+//! prevention, explicitly unsubscribes that exact
 //! retained identifier, admits its typed correlated unsubscribe response, admits a
 //! bounded navigation observation for one exact registered context and URL, rotates
 //! that context's document epoch only from an exact caller-captured pre-action
@@ -33,6 +35,7 @@ mod webdriver_bidi_connection;
 mod webdriver_bidi_json_envelope;
 mod webdriver_bidi_navigation_committed_postcondition;
 mod webdriver_bidi_navigation_committed_subscription;
+mod webdriver_bidi_navigation_committed_subscription_admission;
 mod webdriver_bidi_navigation_committed_subscription_response;
 mod webdriver_bidi_navigation_committed_unsubscribe;
 mod webdriver_bidi_navigation_committed_unsubscribe_response;
@@ -83,6 +86,14 @@ pub use webdriver_bidi_navigation_committed_subscription::{
     WebDriverBiDiNavigationCommittedSubscriptionCommand,
     WebDriverBiDiNavigationCommittedSubscriptionCommandError,
 };
+pub use webdriver_bidi_navigation_committed_subscription_admission::{
+    MAX_WEBDRIVER_BIDI_NAVIGATION_COMMITTED_ADMISSIONS,
+    WebDriverBiDiNavigationCommittedSubscribedObservation,
+    WebDriverBiDiNavigationCommittedSubscriptionAdmission,
+    WebDriverBiDiNavigationCommittedSubscriptionAdmissionError,
+    WebDriverBiDiNavigationCommittedSubscriptionBinding,
+    WebDriverBiDiNavigationCommittedSubscriptionEventError,
+};
 pub use webdriver_bidi_navigation_committed_subscription_response::{
     MAX_WEBDRIVER_BIDI_SUBSCRIPTION_IDENTIFIER_BYTES,
     WebDriverBiDiNavigationCommittedSubscriptionResponseError,