feat(network): unsubscribe committed navigation events

[seonghobae]

Current subscription parent adoption

Exact head 4868d3e9f19133ac3382ee8532878aef27468893 ordinarily incorporates #277 46ae62aa31e35c702cd61c16322d05c7a9c35da1, preserving original #263 3f22de94b63da83eaa8b5b1270912b21a3ecd006 as an ancestor. Both unsubscribe production modules and original assertions are preserved. Only two unsubscribe fixtures needed migration to the existing sealed connection reader.

Real replacement-connection success and error regressions first failed (0/2); parent adoption then exposed two compile failures in raw-response fixtures. The repaired combined tree passes all 10 focused tests, full Rust 1.97.1 formatting/checks/tests/strict Clippy/rustdoc, and 144 Python contracts. Production coverage is 100%: 1244/1244 functions, 13053/13053 lines, 16729/16729 regions, 1422/1422 branches. Local artifact coverage-unsubscribe-parent.json SHA-256 1e51cd7d08ebacc80ecadb568e0bca94384ffc0e1d721237b018cae31daa1336; pinned nightly branch instrumentation remains experimental.

Independent read-only preservation review found no actionable findings at this exact head. This is not a counted GitHub approval. Hosted current-head verification remains separate from local evidence. Remain Draft: unsubscribe dispatch/response provenance, receipt reuse, authenticated events, foundation recovery, protected-main integration and release acceptance are not established.

Actual visual inspection in the in-app browser verified the complete exact-head subscription-adoption documentation section and its authority caveats, with readable wrapping and no observed clipping or overlap. Edge page text was available but its screenshot capture timed out; the in-app screenshot supplied actual visual evidence. This is documentation inspection, not real Chromium product acceptance.

Fresh hosted exact-head CI 34065055213 is terminal success on 4868d3e9f19133ac3382ee8532878aef27468893. Production coverage job 101572241214 ran on GitHub-hosted ubuntu-24.04 and passed measurement, uncovered-line diagnostics, artifact upload, and exact coverage enforcement. Rust contracts job 101572241329 passed Python repository contracts, canonical formatting, workspace check, full tests, strict Clippy, and API documentation. These results do not transfer protected-main integration, browser/MV3 acceptance, review approval, or release acceptance; the PR remains Draft.

Historical predecessor evidence — applies only to the named older heads

Partial implementation of #28, non-force restacked onto PR #277 exact 973e34bc24ae9bdd96a50764f2be6c8603eff66c and then repaired on its own exact head.

Buyer-visible boundary

This Draft adds an explicit typed WebDriver BiDi session.unsubscribe path for the exact opaque subscription receipt produced by the committed-navigation session.subscribe boundary. It uses only the specification's by-ID form and does not expose arbitrary event names, generic dispatch, generic result JSON, or caller-supplied ambient subscription identifiers. A successful EmptyResult is protocol acknowledgment only; it does not prove that already-in-flight events have drained, that navigation state is unchanged, or that browser/process/profile cleanup completed.

Repair / restack lineage

Predecessor 24fc763f0c4ae4e0dd2c62b9dca4b5bc0d23a94b had been retargeted to repaired #277 without adapting its source. #277 replaced generic command correlation with exact WebDriverBiDiCommandKind provenance and moved invalid-frame-deadline rejection before correlation registration. The old unsubscribe implementation still called removed generic correlation APIs and expected a zero deadline to leave a phantom outstanding command.

37ae698c4a9e12d2fabf821ae5b910ea8a35ab8a repaired that mismatch with an ordinary two-parent forward commit: first parent the existing #263 head, second parent exact #277. It added distinct NavigationCommittedUnsubscribe provenance, pre-I/O deadline rejection, no-write-only correlation retirement, ambiguous-write retention, same-id cross-command isolation, the realistic loopback TCP → RFC 6455 → subscribe receipt → unsubscribe → EmptyResult path, and docs/traceability/webdriver-bidi-navigation-unsubscribe.md grounded in the W3C WebDriver BiDi Working Draft of 3 September 2026.

Hosted RED and causal test repair

Exact 37ae698c... CI 34006176797 is terminal failure and produced two independently useful diagnostics rather than a generic rerun target:

• Rust contracts job 101413665735: Python repository contracts passed; canonical rustfmt failed, after which workspace tests/Clippy/rustdoc were correctly skipped. Canonical formatting artifact 9981618648, digest sha256:852e3af7df909d4caa3e61062bb3ba74b522056533d70ed01aece549ff7ee770, contained formatting-only changes in webdriver_bidi_navigation_committed_unsubscribe_failures.rs.
• Production coverage job 101413665600: coverage measurement completed, but exact enforcement failed. Artifact 9981538773, digest sha256:d6ea0585f860a08d62a832e3e0002a86e6d466a4994f8d94dc3e9d21b11ce1f9, localized the only uncovered production line to the Err(source) => map_frame_failure(...) branch inside the real typed unsubscribe send path.

Current exact head 3f22de94b63da83eaa8b5b1270912b21a3ecd006 is a normal one-parent forward commit from 37ae698c... and changes only crates/originweave-network/tests/webdriver_bidi_navigation_committed_unsubscribe_failures.rs. It applies the canonical rustfmt artifact and adds one realistic loopback regression that first records a masking key on the established RFC 6455 connection with an empty client Pong, then attempts the typed unsubscribe with the same adjacent key. The frame owner rejects that reuse locally as MalformedFrame; the test exercises the previously uncovered send error arm, proves no unsubscribe bytes reached the peer, and proves only the just-registered unsubscribe correlation is retired. Production source, command semantics, workflow authority, security gates, and coverage denominator are unchanged.

Exact-current verification

CI 34009256997 is terminal success on exact 3f22de94b63da83eaa8b5b1270912b21a3ecd006. Rust contracts job 101422055630 completed Python repository contracts, canonical formatting, locked workspace checks, full tests, strict Clippy, and rustdoc successfully. Production coverage job 101422055538 completed measurement, missing-line diagnostics, artifact upload, and exact coverage enforcement successfully. This repository-native GREEN applies only to this exact tree; it does not transfer protected-main integration, central security/review evidence, real Chromium acceptance, or the separate upstream stale-tree foundation repair.

Authority boundary

The adapter performs no policy authorization, destination approval, browser authentication, action dispatch, semantic observation, or durable evidence escalation. WebDriver BiDi remains an adapter; browser-domain truth remains in OriginWeave. Keep Draft while #277 and its ancestors remain Draft and while the separate stale-tree foundation recovery is still active upstream. No self-approval, bypass, force update, destructive rebase, workflow/ruleset/secret mutation, tag, publish, release, or predecessor-evidence transfer is authorized.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Writer lease RELEASED — root task 01a06c0f-b427-7830-b654-9addcdfe7aff. Published non-force head4868d3e9f19133ac3382ee8532878aef27468893 on verified parent46ae62aa31e35c702cd61c16322d05c7a9c35da1. Actual RED0/2, two fixture compile failures, repaired10focused tests, full Rust1.97.1 gates and144Python contracts passed; exact production coverage1244/13053/16729/1422 each100%. Independent read-only preservation review found no actionable findings, not counted approval. Actual in-app-browser screenshot verified the entire published adoption section and authority caveats without observed clipping/overlap. NativeCI34065055213 queued; no hosted GREEN, protected merge or release claim. Both original unsubscribe production modules and assertions preserved. Local coverage artifact and all history retained. No active source writer remains in this worktree.

[seonghobae]

OriginWeave hourly writer acquires one bounded #263 PR-state/evidence-only slice at verified exact head 4868d3e9f19133ac3382ee8532878aef27468893, exact parent #277 46ae62aa31e35c702cd61c16322d05c7a9c35da1, Draft. Fresh public coordination shows prior source lease 5562611932 explicitly RELEASED and no later #263 writer.

Fresh hosted evidence has materially changed: CI 34065055213 is now terminal success on this unchanged exact head. Production coverage 101572241214 ran on GitHub-hosted ubuntu-24.04 and passed measurement, diagnostics upload, and exact coverage enforcement. Rust contracts 101572241329 passed Python repository contracts, canonical formatting, workspace check, full tests, strict Clippy, and API documentation. Scope is only correcting stale queued evidence in the PR body; no source, parent, workflow/ruleset/secret, approval, Draft/Ready, protected-main, tag or release mutation. Explicit release follows body update/readback.

[seonghobae]

#263 PR-state/evidence writer RELEASED. Exact head remains 4868d3e9f19133ac3382ee8532878aef27468893, parent #277 46ae62aa31e35c702cd61c16322d05c7a9c35da1, Draft. PR body now records terminal hosted CI 34065055213: Production coverage 101572241214 and Rust contracts 101572241329 both succeeded on the unchanged exact head, including exact coverage enforcement and full repository/Rust gates. Readback confirmed the body/head/base. No source, workflow/ruleset/secret, approval, protected merge, tag or release mutation; no #263 writer remains.