feat(network): send bounded WebDriver BiDi session.status command

[seonghobae]

Boundary

This Draft owns the narrowly typed outbound WebDriver BiDi session.status command over the bounded RFC 6455 stream. It serializes only the fixed method and empty parameters, uses typed command correlation and adds no generic dispatch, policy/secret authority, retry, reconnect or completion-by-write semantics. A successful frame write is transport progress, not a browser post-condition.

Current exact topology

Current head 84b9407978ae0f6c115f01170b6069c601b21104 ordinarily merges current #248 b386f17c4826adabebda084bff2fba35aee94dd0 into predecessor 017d6e816f5a86544a63821b3ceaba94d5f17f44. The required parent is an ancestor; no force push or destructive reconstruction was used.

The only conflict was adjacent CHANGELOG additions. Both release records are preserved. The four session-status source/export/Rust-test blobs are unchanged; owning peer-lifetime and native release-test repairs are inherited intact. Before integration, the required parent was absent and the inherited correlation release module collected zero native unittest checks. It now collects and executes one.

Existing causal contract

Invalid deadlines fail before command registration. Proven preflight rejection, including adjacent masking-key reuse, retires only the exact just-registered command. Once a write may have begun, errors retain correlation because the remote effect is ambiguous and the consumed stream is not reusable. No received-response generation or browser completion is inferred.

Fresh local verification — 5 September 2026

• 142 Python repository contracts, native release-test discovery and compileall pass.
• Rust 1.97.1 formatting, locked all-target check, full workspace tests, strict Clippy and strict rustdoc pass.
• Pinned nightly-2026-08-01 production verifier passes: 989/989 functions, 9978/9978 lines, 12717/12717 regions, 1098/1098 branches (100% each).
• Child-owned production and Rust test blobs match predecessor 017d6e81... exactly.

Fresh native CI 33954334610 binds this exact head and is non-terminal. Prior run 33942378277, earlier parent runs and predecessor review prose do not transfer. Draft and parent-first protected integration remain mandatory; the previously conflicting dependency is repaired locally/on the PR, not shipped to protected main.

No PR merge, closure, self-approval, bypass, force push, workflow/ruleset/secret mutation, weakened check, tag, release or publication is included.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Parent-first reconstruction review: #248 4b9a04e... is now exact-head GREEN, so this child was rebuilt from that verified tree and only its four session.status command files were reapplied. This avoids carrying the predecessor parent's uncovered impossible branch or duplicating the parent repair. Fresh exact-head CI 33771106565 is still required before any child result or descendant restack can be accepted.

[seonghobae]

Current-head source verification on 3c9124b: the parent-first topology remains exact (#248d835c35 merge base, 0 behind, four semantic paths). The invalid-deadline repair now rejects both zero and above-MAX_WEBSOCKET_FRAME_TIMEOUT before command registration, while preserving the existing rule that a failure after valid registration/emission begins leaves the id outstanding. This removes the local-precondition/correlation-capacity leak without making frame ACK a command post-condition or widening authority. CI 33851946207 is non-terminal (Rust 100956517128, coverage 100956516744 queued), so this is not an approval or exact-head GREEN claim.

[seonghobae]

새 causal finding: send()는 invalid timeout은 correlation 등록 전에 거부하지만, frame owner의 다른 local preflight인 adjacent masking-key reuse는 correlation 등록 뒤 write_text_frame() 안에서 거부됩니다. ClientMaskKeyHistory::reserve()는 socket write 전에 같은 key를 거부하므로 이 경우 원격 side effect가 없는데도 command id가 outstanding으로 남아 bounded correlation capacity를 소모합니다. Timeout repair와 같은 invariant로 수리해야 합니다: frame owner가 side-effect-free preflight를 canonical하게 제공하고, session.status는 timeout/payload/mask-key-history preflight가 모두 끝난 뒤 correlation을 등록해야 합니다. Partial/ambiguous write 이후에는 기존 outstanding 보존 규칙을 유지합니다.

[seonghobae]

Current-head source verification: the adjacent masking-key regression is now realistic and names only the observable invariant. Exact test-only b293b35535b463a15b42b18ae35b178a418d9249 first required a seed client text frame followed by the same masking key on session.status to fail without leaving correlation outstanding. Causal 8c7b9750d81d1fb6d9b75437b4eda0c605d45929 keeps registration before possible emission but, when the frame owner's current MalformedFrame pre-write guard proves the frame never began, retires only the exact just-registered SessionStatus id through the correlation owner's typed retirement API. Partial/ambiguous write errors still retain correlation. Final b9e38b4ca535470122b98fabd93929c6292af299 only corrects the regression name. Exact parent remains #248 d835c35b..., 0 behind, four semantic paths. CI 33857014776 is non-terminal (coverage 100972555193, Rust 100972555474, both queued/no runner/steps), so this is not approval or GREEN.

[seonghobae]

Separate merge-readiness finding from protected-main AGENTS.md: the current exact semantic delta is still four code/test paths and does not update docs/doctoring.md or CHANGELOG.md, although this slice introduces a standards-bound WebDriver BiDi command and changes transport/correlation behavior. Keep Draft even after native CI becomes GREEN until the branch carries a truthful changelog entry and standards doctoring for the current WebDriver BiDi Editor’s Draft plus RFC 6455 client-mask obligation. Do not describe the 1 June Working Draft as current; the live W3C Editor’s Draft is dated 1 September 2026. This is documentation repair, not a reason to weaken or duplicate the code boundary.

[seonghobae]

Standards-date correction to the preceding documentation finding: fresh authoritative retrieval now shows the live WebDriver BiDi Editor’s Draft is dated 3 September 2026, not 1 September. session.status remains a static command with EmptyParams and required StatusResult { ready: bool, message: text }. The merge-readiness finding is unchanged: this exact four-path code/test delta still lacks the docs/doctoring.md and CHANGELOG.md updates required by protected-main contributor instructions. Doctor the 3 September 2026 Editor’s Draft and RFC 6455 §5.3; do not present the older 1 June Working Draft as current. This comment supersedes only the date in review 5111284918, not its gate.

[seonghobae]

Current-head documentation repair on 117d7593d66243c391bde04791cf521a92a34e18: fresh primary-source retrieval shows the live WebDriver BiDi Editor's Draft is dated 1 September 2026; the earlier 3 September date in review prose was incorrect. docs/doctoring.md now records that live draft, the exact static session.status / EmptyParams / StatusResult { ready, message } contract, and RFC 6455 §5.3's fresh unpredictable client masking-key obligation while explicitly separating OriginWeave's adjacent-key rejection as stronger local policy. CHANGELOG.md now records the typed outbound command and distinguishes pre-I/O retirement from ambiguous-write retention and transport write from command completion. Base→head compare remains exact #248 as merge base, 0 behind, six semantic paths, no .github/**. CI 33858777817 is non-terminal (coverage 100978123412, Rust 100978123617, both queued/no runner), so this is not approval or GREEN.

[seonghobae]

Superseding my earlier date correction: direct retrieval of the rendered W3C WebDriver BiDi Editor's Draft header now shows 3 September 2026. Commit 588514bfa2150381bff8f3ccbb81e6072fde6218 corrected docs/doctoring.md to that authoritative date and APA reference; commit 422ac8cce072cb016af16ed37e0de357a9ce854d restored an unrelated RFC 5280 author citation that was accidentally transcribed while replacing the whole documentation file. Current base→head remains exact #248, 0 behind, six semantic paths. Fresh CI 33859271719 is still non-terminal: Production coverage 100979703576 and Rust contracts 100979703825 are queued without runner/steps. This is a correction/verification comment, not approval or GREEN.

[seonghobae]

Parent-first stack update after this head's documentation repair: canonical common-envelope #247 has now moved to test-only 1bdfb42b35f1bda118e4b4b1a4d331db2190c3bc for the finite WebDriver BiDi ErrorCode repair. Direct parent #248 is consequently non-mergeable against its live base until that ancestor is fixed and reverified. This #249 branch remains structurally a child of the old exact #248 generation, so even if CI 33859271719 later completes successfully it can prove only this commit's own delta on that old generation, not the live parent-first stack. Keep Draft. Required continuation is #247 RED→minimal fix→exact GREEN, then non-force #248 restack+GREEN, then non-force #249 restack+fresh GREEN. Do not copy the common ErrorCode rule into this command sender or force-push. This is a dependency note, not approval.

[seonghobae]

Current-parent reconstruction and exact-head RCA on 6860fc573f6d0c3ea5affc7804d386827dc7407d:

• Refetched feat(network): correlate bounded WebDriver BiDi responses #248 at 43e428a4000972f78c20fb062ee0140ce65cb8d8 and merged it non-destructively.
• Prior Rust failure was pinned-rustfmt output; the branch is now formatted.
• Prior coverage missed the failure-propagation branch after a registered session.status frame write. The deterministic policy helper now tests both observable outcomes directly: pre-write malformed-frame rejection retires the exact typed correlation, while an ambiguous write failure retains it. The impossible retirement-error mapping branch was removed without weakening correlation or write ambiguity rules.
• Local documentation contracts, focused policy tests, strict workspace/all-target/all-feature Clippy, all workspace/all-target/all-feature tests, and rustdoc passed.
• A first local pinned-nightly run reached the expected single branch deficit before the helper test repair. Subsequent full coverage executions were interrupted by existing macOS loopback socket timing failures in unrelated WebSocket tests; no skip or coverage exclusion was added. Hosted Linux exact-head coverage remains authoritative.

This PR remains draft and stacked on #248.

[seonghobae]

Exact-head repair evidence for 44387182ddd2c416e5c5182c8eeee1957fed6ade on parent 7349dc4b5f4564824a04a0edc8b3bbebbec974ce:

• Root cause: the only uncovered regions were the failure arms generated by two redundant assert!(matches!(...)) calls inside the correlation-state test, not production behavior.
• Minimal repair: removed those redundant return-wrapper assertions; the test still proves preflight retirement and ambiguous-write retention from the observable outstanding-correlation count.
• Parent refresh: merged the current exact parent non-destructively; the sole conflict retained both changelog entries.
• Verification on the final exact head: focused regression passed; cargo fmt --all -- --check; workspace all-feature/all-target check; strict Clippy; rustdoc with warnings denied; 139 Python contracts; full workspace tests under cargo llvm-cov; production functions, lines, regions, and branches all 100%.

The newly queued GitHub checks remain authoritative for this changed head; this comment does not claim protected merge or shipment.

[seonghobae]

Exact-head child refresh evidence for 2279d18189fcd6cdb2b38aca53b877434d41c913 on current #248 parent de7754aaeb97ccb0fd47bcbe1c4d99c10eaf84eb:

• Adopted the current parent non-destructively with no conflicts; the coverage repair remains unchanged.
• Verification passed: rustfmt; workspace all-feature/all-target check; strict Clippy; rustdoc with warnings denied; 141 Python contracts; and the repository CI-equivalent pinned nightly-2026-08-01 branch-coverage command at 100% for production functions, lines, regions, and branches.
• This child remains Draft until parent-first integration; newly queued hosted checks are authoritative.

[seonghobae]

Verified PR #248 current exact head 7d6db16b2ead201fcec320854923f90d3ad0d8bc locally, then non-force restacked this child on it. PR #249 is now exact head 017d6e816f5a86544a63821b3ceaba94d5f17f44. Both the parent verification and this final tree passed rustfmt, all-feature/all-target check, strict Clippy, rustdoc, 141 Python contracts, and CI-equivalent pinned-nightly production function/line/region/branch coverage at 100%. Fresh hosted exact-head checks and ordered parent integration remain required.

[seonghobae]

Exact-head focused review for stacked child 017d6e816f5a86544a63821b3ceaba94d5f17f44 over parent #248 7d6db16b2ead201fcec320854923f90d3ad0d8bc: no actionable defect found in the bounded session.status sender. The command has static method/params serialization, enforces the WebDriver BiDi js-uint ceiling, registers typed correlation before I/O, rejects invalid deadlines before registration, retires only proven preflight failures, and consumes the established stream on ambiguous write failure. Local exact-head evidence: rustfmt passed; all 5 focused integration tests passed; strict all-target/all-feature Clippy passed. Keep Draft and parent-first: its two hosted checks are queued and #248 has not reached protected main.