fix(bidi): require ownership before screen-area mutation

[seonghobae]

Buyer/security gap

#310 correctly keeps WebDriver BiDi screen-area geometry out of the reusable presentation-profile plan, but its context-only Set/Reset surface could replace or clear a screen-settings override without proving that OriginWeave owns the predecessor state. The runtime-qualified 3 September 2026 WebDriver BiDi contract stores a screen-area override per browsing context; screenArea: null removes the entry rather than restoring an earlier owner value. Context identity is addressability, not mutation authority.

This child remains stacked on #310 exact eac7db0a21842baa447c24a0050acba1db42a5e8. It does not change the runtime-qualified BiDi revision, browser transport, #148/#212/#299 ownership, workflows, rulesets, secrets, sandbox posture, or browser trial denominators.

RED → causal repair

The first ownership-witness implementation reached exact f1380ab8e091964ccbdd576d933cf19d696c3791. Hosted CI 34419810636 executed repository code: Python repository contracts, formatting, and locked workspace tests passed; Production coverage 102692565938 passed exact enforcement; Rust contracts 102692565837 then failed strict Clippy because plan_explicit_screen_area_override and plan_explicit_screen_area_cleanup were dead production code. The witness intentionally had no legal external mint path, so retaining callable planner helpers contradicted the fail-closed lifecycle design. This was a real source RED, not a queue or coverage failure.

Test/regression commit e5295a0b72c0f2bb5693305a3ffa145a7fa88b30 requires the typed screen-area value/witness/Set/Reset vocabulary to remain while no public explicit screen-area planner exists before a Browser Session witness-mint path does. Its own CI generation was cancelled by the ordinary successor push and is not counted as executed RED. Production fix 2fc2f64a102a5bf6f87b9d20e709efcab2905c1d removes only the unreachable helpers, retains WebDriverBidiScreenArea, opaque WebDriverBidiScreenAreaOwnership, and witness-bearing SetScreenArea/ResetScreenArea, and adds no allow/expect(dead_code) or raw-context escape hatch. ADR/doctoring/traceability at bc3865df57ffdd6300184bbe4a8571bf6deab10d, 35b95d929c35182913749f8348f56bd2c8ae17f4, and final 43377c2de00865d0e92126c455ca6390297c9cf7 record that the planner/transport consumer must arrive with the reviewed Browser Session mint transition.

The reusable profile-derived plan remains viewport/DPR plus timezone; complete PresentationSurface::Screen remains fail closed because available-screen geometry is not modelled by the current profile and color depth is not controlled by the standard operation.

Exact-head GREEN

Current exact head 43377c2de00865d0e92126c455ca6390297c9cf7 is repository GREEN in CI 34423927553. Rust contracts 102705027719 passed Python repository contracts, canonical formatting, locked workspace tests, strict Clippy, and rustdoc/API documentation. Production coverage 102705027958 passed measurement, diagnostics publication, and exact function/line/region/branch enforcement.

The same run also produced useful queue evidence: both jobs were created at 2026-09-10T01:03:52Z with no runner, then were ordinarily assigned GitHub-hosted runners at 01:12:02Z without any leaf push, cancellation, rerun, workflow mutation, or synthetic status. The 8m10s pre-runner delay was handed to canonical .github#712; it is infrastructure/control-plane evidence, not a source failure.

CodeRabbit automatic review is disabled for the non-default stacked base, its manual retry was rate-limited, and Codex review reported account usage exhaustion. Those are not approvals. Exact-head COMMENT review 5161622064 records the repair without self-approval.

Acceptance and integration

This repository GREEN does not constitute browser GREEN. No WebDriver BiDi transport, command acknowledgement, page-observed state, #299 pinned-Chromium startup repair, or cleanup/destruction proof is supplied here. Browser acceptance still requires apply → page-observed post-condition → native interaction/outcome → owned reset/destruction → post-cleanup observation.

The child is now eligible for ordinary merge into its immediate #310 feature-branch parent so the parent fully inherits the valid delta. After that merge, #310 must regenerate its own exact-head repository evidence; predecessor and child checks do not transfer to the new parent head. No force push, destructive rebase, self-approval, protection bypass, workflow/ruleset/secret mutation, runtime repin, sandbox weakening, trial reduction, tag, or release is part of this repair.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 0a7358ad-cd65-4e53-8d1d-9087cd6a004d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[seonghobae]

ACTIVE writer lease on #311 at exact f6ad7387cf9c3d96edc8eb15528807fe62c97b04. Scope is only the verified screen-area ownership finding inherited from #310: refine the initially over-constrained RED into an opaque Browser Session ownership-witness contract, make the minimum Rust repair, remove the inherited duplicate latest-publication reference from the qualification doctoring surface, then run exact-head verification and RELEASE. I will not modify #310 source/PR-state, #148/#212/#299 ownership, the stacked base, workflow/ruleset/secret state, sandbox posture, trial denominators, merge, tag, or release.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[seonghobae]

RELEASE writer lease for #311 at exact f1380ab8e091964ccbdd576d933cf19d696c3791. The bounded source/doc repair is complete and PR-state is code-current. Exact-head CI 34419810636 is intentionally left alive and currently runner-incomplete: Rust contracts 102692565837 and Production coverage 102692565938 are both pre-step queued on ubuntu-24.04 with steps=[] and no assigned runner. I am leaving #311 Ready solely so GitHub does not cancel the only current-head executable attempt; the PR body now states explicitly that this is evidence admission, not merge readiness. The current canary is recorded on canonical queue owner .github#712 as comment 5610546654. No repository GREEN, browser GREEN, independent review, merge, tag, or release is claimed.

[seonghobae]

Continuing the existing #311 writer lease on unchanged exact f1380ab8e091964ccbdd576d933cf19d696c3791 after executable CI 34419810636 settled. This is now a real source RED, not a queue blocker: Python repository contracts, formatting, and locked workspace tests passed; Production coverage 102692565938 passed exact enforcement; Rust contracts 102692565837 failed strict Clippy because plan_explicit_screen_area_override and plan_explicit_screen_area_cleanup are production-dead while the ownership witness intentionally has no external mint path. I will repair that causal contradiction without allow/expect(dead_code), workflow churn, raw-context authority, or widening the Browser Session boundary, then regenerate exact-head evidence and RELEASE.

[seonghobae]

Exact-head follow-up on the ownership-witness repair. The executable predecessor RED was causal: strict Clippy rejected the two explicit screen-area planners because the adapter deliberately provided no production witness-mint path. This head removes only those unreachable helpers, keeps Set/Reset typed around the opaque ownership witness, leaves reusable presentation planning limited to viewport/DPR + timezone, keeps complete Screen admission fail closed, and records that the planner/transport consumer must arrive with the Browser Session mint transition. I found no reason to weaken dead_code, reintroduce raw-context authority, or claim browser/runtime acceptance. This COMMENT is not an approval; exact-head CI and eligible independent review remain gates.

[seonghobae]

RELEASE writer lease for #311 at final source head 43377c2de00865d0e92126c455ca6390297c9cf7. Exact CI 34423927553 is GREEN: Rust contracts 102705027719 passed repository contracts, formatting, locked workspace tests, strict Clippy and rustdoc; Production coverage 102705027958 passed exact enforcement. The valid child delta was normally merged into immediate parent #310 as af59acb08af802bba8d51bc23bd762c08f8ce481, so #311 is closed by merge rather than simple Close. Parent exact-head verification is now the active lane. No force push, destructive rebase, self-approval, bypass, workflow/ruleset/secret change, runtime repin, sandbox weakening, trial reduction, tag or release was used.