fix(core): reject control-bearing BiDi locator text

[cursor]

Successor to #138 on exact prerequisite #127 head 65f51937ff2af64d9c157666e7c3b7df89cbb89a.

Buyer/security gap

#138 admitted accessibility locator text and BiDi sharedId values after empty and UTF-8 budget checks only, and left admitted remote values unbound to current document authority. This branch keeps the typed operation-to-capability binding, fail-closes control/whitespace protocol text, and translates a reviewed locateNodes result into ObservedNodeHandle values only while the exact session, context, origin, and document epoch remain current.

TDD sequence

1. Test-only 601628b / syntax-fixed ce0af01 established missing-production REDs for control-bearing locator text and for bind_current_nodes.
2. 496f556 rejects whitespace/controls in exact roles, control/whitespace-only names, BiDi sharedId, and registry external identifiers. Ordinary spaces in accessible names such as Task text and 작업 텍스트 remain valid.
3. 5ee16f1 admits every untrusted result item first, then binds admitted sharedId values through the registry. Over-budget results, non-node items, stale epochs, unknown sessions, and exhausted node-identifier space fail closed.

Exact-current proof

On unchanged exact head 5ee16f1 in this workspace:

• cargo test --locked -p originweave-core --all-targets succeeded;
• cargo clippy --locked -p originweave-core --all-targets -- -D warnings succeeded;
• RUSTDOCFLAGS='-D warnings' cargo doc --locked -p originweave-core --no-deps succeeded;
• cargo fmt --all --check succeeded;
• product-documentation and documentation-fitness Python contracts succeeded.

This does not transfer #138 or #127 check, review, coverage, or merge evidence. Keep Draft while #127 and its prerequisite stack remain active. Workspace verification is not GitHub CI, production-coverage, or independent approval evidence.

Truth boundary

This still does not serialize a BiDi command, authenticate Chromium, observe a live accessibility tree, authorize typed input, or prove a post-condition. A later adapter must sample the query result from a trusted transport and revalidate the returned handles immediately before action.

Do not merge this Draft.

[cursor]

Review at exact head 5ee16f1ea72342dde6461f74f0677e21bcc8d623

Draft successor to #138, stacked on #127 (65f51937ff2af64d9c157666e7c3b7df89cbb89a). The two #138 blocking defects are closed. Do not merge this Draft. Do not treat this comment as approval of the stack.

Closed from #138

1. WebDriverBiDiAccessibilityQuery::new now rejects whitespace and controls in roles, and rejects controls plus whitespace-only accessible names. Ordinary spaces in names such as Task text and 작업 텍스트 remain valid.
2. WebDriverBiDiRemoteNodeReference::new and validate_external_identifier now reject empty, over-budget, control, and whitespace sharedId values together.
3. bind_current_nodes is the missing composition: current session/context/origin/epoch first, then result-count budget, then per-item node+sharedId admission, then registry bind_node into ObservedNodeHandle. Stale epoch, unknown session, exhausted identifiers, non-node items, and over-budget results fail closed.

Residual (non-blocking for this slice)

• Composition tests do not yet drive control-bearing or omitted sharedId through bind_current_nodes. Constructor tests already reject those values; add the composition cases on the next slice so a later reorder cannot bind before admission.
• docs/doctoring.md still says a later admission boundary may translate handles. This head implements that boundary. Keep the no-I/O and untrusted-handle sentences; change the translation sentence to present tense.
• bind_current_nodes still does not consume QueryNodes / SemanticObservation or a non-cloneable protocol-use proof. That is the next bounded product slice, not a silent authority merge.

Next buyer-visible slice

Compose BrowserProtocolOperation::QueryNodes dispatch with bind_current_nodes so an untrusted locateNodes result cannot become ObservedNodeHandle values without proving SemanticObservation on the exact current session, context, origin, and document epoch. Still no browser I/O. Keep Draft until the #127 stack can land.

Passing or in-progress checks on this Draft are not merge permission.

  

_{Sent by Cursor Automation: Fix Issues}

[seonghobae]

Superseded by #174 after fresh exact ancestry verification. Current #174 head d83fec050a2e5dee53ae4137220140885ef443b4 contains this exact head 5ee16f1ea72342dde6461f74f0677e21bcc8d623 as an ancestor (merge base equals #171 head; ahead 9 / behind 0), preserving the full control-bearing locator/sharedId and document-bound node-admission work while adding the later QueryNodes and SemanticObservation-proof boundaries. Closing this duplicate review vehicle transfers no checks/reviews/coverage/approval; #174 remains Draft behind #127 and must independently revalidate its exact head.