feat(network): correlate bounded BiDi pointer click response

[seonghobae]

Connection-bound pointer replies

Published exact head 5417ce32ed957aa166807f1023647caccc2920cb integrates sender #257 9451fd8a23dec95b31749376bc78c2eaca977fe8 by ordinary merge 0234b587. The consumer accepts only the existing sealed received-message type and checks its private connection generation before consuming a pointer command. No public provenance constructor or raw fallback was introduced.

Executed evidence: published 8193fcd5 failed when a replacement socket consumed the original request; strengthened d9396f05 failed for both foreign success and error using one listener/session. Consumer-only 588fe731 failed original success with missing sender provenance. Integrated tests now require exact mismatch, retain two pending requests, then accept the original reply and leave the unrelated request pending (2 → 2 → 1). All six focused tests pass, including existing malformed, unknown-id, extensible success and genuine remote-error cases.

Full exact-head local Rust1.97.1 format/check/workspace tests/strict Clippy/rustdoc,142 Python contracts,compileall,CodeGraph and diff checks passed. Pinned coverage:1100 functions/11191 lines/14276 regions/1214 branches, all100%. Artifact SHA256 ed46b5881d952723eec724a74e6ebb8856a0801e4db0570c9f8a6e6cf04eadb5. Independent read-only review found no actionable findings; it is not counted approval.

Keep Draft. Fresh hosted CI is not yet verified successful. Outbound session authority, same-connection freshness, browser ownership, page effects, protected-main acceptance and release remain separate and unproven. No force update, workflow/security-gate mutation, self-approval, merge or release.

Previous exact-head evidence (historical)

Partial implementation of #28. This Draft owns typed local-end response correlation for the transported WebDriver BiDi primary-button click. Protocol success is not an observed DOM/UI post-condition and grants no browser/session/origin/document/policy authority.

Current non-force stack adoption

Current exact head is b8eaa97f7a417c79250b6b760ff214ac03d39b8a, a tree-identical ordinary two-parent adoption over predecessor 5f830324f6d5a47ac213a57528ef95649bdfd0df and current #257 8f1507346f65798a6bf4eaf370d65a2d406a6f44. No source, test, docs, workflow, dependency, gate or authority changed; #255's safe-successor topology is simply carried forward.

Predecessor CI 33965695405 and local numeric 100% evidence belong to predecessor 5f830324... only. Fresh exact-head CI 34003285350 completed success on b8eaa97f7a417c79250b6b760ff214ac03d39b8a. This validates this exact adopted tree only; it does not establish browser action/post-condition evidence, protected-main integration, central review/security acceptance, or release readiness.

The response boundary still accepts only the exact outstanding pointer-click correlation and leaves unrelated state untouched on malformed, mismatched-kind or unknown-id input. Keep Draft and parent-first protected integration. No workflow/ruleset/secret mutation, self-approval, bypass, force update, destructive rebase, merge, tag, release or publication was performed.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head restack verification: exact parent #257 ac7b03574ff4c99e32c240bedc3b9a7834a7e57b is repository-native CI GREEN (33770755986; Rust contracts 100700073107, Production coverage 100700073689). This head bd3652892ecc5a7ed5cf3d7faa4ac2b912c0a14d adopts that verified parent non-force while preserving the prior child lineage. Exact parent→child compare is 0 behind and three semantic paths only: crate composition plus the typed pointer-click response source and realistic response test. Parent structural routing/correlation repairs and send-failure coverage are inherited from the parent tree rather than duplicated. Fresh exact-head CI 33881791731 remains queued, so this is not a GREEN/merge-ready claim. Keep Draft; #259 remains parent-first blocked until this exact head is terminally verified.

[seonghobae]

Restacked on exact parent #257 head 53faa74beb48d0e6a77cac2f3b3ef2eca91c094a and repaired the response regression exposed by the parent protocol hardening.

RCA: the remote-error fixture used a code outside the current reviewed WebDriver BiDi ErrorCode vocabulary and omitted the required stacktrace, so it failed envelope admission before testing the intended correlated remote-error consumption. The fixture now uses a complete, valid error envelope; CHANGELOG.md also records the buyer-visible response boundary.

Exact local evidence:

• focused pointer-click response tests
• strict all-target Clippy
• full workspace tests
• documentation contracts: 22 passed, 177 subtests passed
• rustdoc with warnings denied
• pinned nightly production functions/lines/regions/branches: 100%

[seonghobae]

Current-head lineage review: live parent is #257 53faa74beb48d0e6a77cac2f3b3ef2eca91c094a, current head is b9415ba8e0376447355caa7fa093eaa0d168f6d9, and fresh compare is 9 ahead / 0 behind. Current exact CI 33901290367 is non-terminal. Earlier bd365289... and ac7b035... evidence is predecessor-only after the non-destructive parent refresh. A successful input.performActions response remains protocol evidence, not the page-observed post-condition.

[seonghobae]

Non-force restacked on PR #257 exact head ac73abfe7edd5786a7eb3eaab1a8c773093be7d3; PR #258 is now exact head a61c717e525eb94f5a4aaa68d3bfdabc9152edfd. Verification: rustfmt, all-feature/all-target check, strict Clippy, rustdoc, 141 Python contracts, and CI-equivalent pinned-nightly production function/line/region/branch coverage at 100%. Fresh hosted exact-head checks and ordered parent integration remain required.

[seonghobae]

Non-force restacked on PR #257 exact head ea2b5b78868917219c46f1304558b92490a7f6fe; PR #258 is now exact head f2ceabb3ea50b1959e936503c50cae12f3e6e480. Verification: rustfmt, all-feature/all-target check, strict Clippy, rustdoc, 141 Python contracts, and CI-equivalent pinned-nightly production function/line/region/branch coverage at 100%. Fresh hosted exact-head checks and ordered parent integration remain required.

[seonghobae]

Writer lease RELEASED — task 01a06c0f-b427-7830-b654-9addcdfe7aff. No source/test/doc edits or commits made. Exact b8eaa97 baseline ran all four pointer response integration tests: 4 passed. Actual Edge screenshot inspected: Draft/parent readable without observed clipping, but description still names b8eaa97 after live head advanced to 8193fcd. Concurrent hourly writer comment 5560125008 owns the same RED slice; yielding source ownership and switching to read-only review rather than duplicating or overwriting it. Preserve its history; no merge/release claim. Isolated baseline worktree /private/tmp/originweave-pr258-receipt.rXaWSc remains untouched.

[seonghobae]

Pointer-response receipt-provenance RED writer acquired — 2026-09-06 15:08 UTC

OriginWeave hourly writer acquires one bounded test-first #258 response-provenance slice at verified exact head b8eaa97f7a417c79250b6b760ff214ac03d39b8a, exact parent #257 8f1507346f65798a6bf4eaf370d65a2d406a6f44, Draft. Fresh public comments show no unreleased #258 writer. Scope is only a realistic same-session replacement-connection response regression; no production/shared-correlation/parent mutation or governance/release action is included.

The test will send a real pointer command on connection A, receive the same-id protocol success on replacement connection B with the same external session, and require rejection without consuming A's outstanding command. This isolates receipt provenance from the separate pointer outbound session-authority gap. Explicit release follows RED publication or defer.

[seonghobae]

Pointer-response receipt-provenance RED writer RELEASED — 2026-09-06 15:10 UTC

Published test-only exact head 8193fcd50125d9e9a43b4755e0f7626801b74374 over predecessor b8eaa97f7a417c79250b6b760ff214ac03d39b8a, preserving the complete #258/#257 lineage. The new actual-loopback regression sends the pointer command on original connection A, receives the same-id success on replacement connection B with the same external session, and requires rejection without consuming A's outstanding command.

No production/shared-correlation/parent source, workflow, ruleset, secret, merge, tag, release or approval state changed. Exact CI 34041420155 is queued: Rust 101508763198, Production coverage 101508763376, no execution steps yet. Therefore this is a published RED experiment whose behavioral failure is not yet observed; static inspection of the raw-message/generic-correlation path is not promoted to executed evidence.

This writer is explicitly released while runner acquisition is pending. The eventual receipt repair must remain separate from the pointer outbound session guard and adopt the shared connection-provenance invariant content-aware, preserving current #257/#258 semantic deltas.

[seonghobae]

Read-only verification coordination: root task 01a06c0f-b427-7830-b654-9addcdfe7aff has released writer5560123670 and is executing the published8193fcd5 regression locally. Baseline b8eaa97's four existing pointer response tests passed. No duplicate source edits. Static follow-up for the eventual repair: preserve sender #257 timeout/retirement behavior, reuse existing register_command_for_connection / correlate_response_for_connection and sealed received-message reader; also require rejection for a replacement socket on the same listener/session, matched remote-error rejection, and original-connection recovery without consuming unrelated pending state. These strengthen the acceptance boundary beyond differing-port rejection; no runtime or approval claim.

[seonghobae]

Executed RED confirmed at exact head8193fcd50125d9e9a43b4755e0f7626801b74374: cargo +1.97.1 test --locked -p originweave-network --test webdriver_bidi_pointer_click_response_connection_provenance exited101; 0passed/1failed. Failure at line178: same-session replacement connection unexpectedly consumed the original pointer command. Baseline four existing pointer-response tests passed at b8eaa97. This is local transport-regression evidence, not browser postcondition, hosted CI or release acceptance. Root is proceeding sequentially with canonical #257 sender registration prerequisite before #258 sealed receipt consumption; no concurrent source writer.

[seonghobae]

Read-only acceptance finding at8193fcd5, independently reviewed: the new test currently accepts any error plus pending=1 (lines178–185). A consumer-only receipt migration could pass with CommandConnectionProvenanceMissing while the original sender remains unbound. Require exact ResponseConnectionMismatch and original-connection success after foreign rejection; keep an unrelated pending request. Reuse one listener/address for both sockets (currently separate ephemeral ports) so peer-address-only validation cannot satisfy the test. Include foreign matching error as well as success. Root #257 writer5560144371 now owns the sender prerequisite; no #258 source mutation yet.

[seonghobae]

Writer lease RELEASED — root task 01a06c0f-b427-7830-b654-9addcdfe7aff. Published exact head 5417ce3, base #257 9451fd8, preserving hourly RED 8193fcd and ordinary parent merge 0234b58. Stronger d9396f0 reproduced foreign success/error failures; consumer-only 588fe73 reproduced missing sender provenance; integrated six focused tests pass with exact mismatch and pending counts 2→2→1. Full Rust 1.97.1 gates, 142 Python contracts, compileall/CodeGraph/diff pass. Pinned coverage: 1100 functions /11191 lines /14276 regions /1214 branches, all 100%; SHA256 ed46b5881d952723eec724a74e6ebb8856a0801e4db0570c9f8a6e6cf04eadb5. Independent read-only review no actionable findings, not approval. Actual Edge screenshot inspected published head/base and evidence: readable without observed clipping/overlap; limitations visible. Hosted exact-head success still unverified. Outbound session authority, status receipt owner prerequisites, descendant adoption and real browser postconditions remain separate executable queue items. No merge/release or protected-main completion claim.