feat(core): admit locateNodes only after QueryNodes proof

[cursor]

Successor to #171 on exact prerequisite #127 head 65f51937ff2af64d9c157666e7c3b7df89cbb89a.

Buyer/security gap

#171 can translate an untrusted locateNodes result into ObservedNodeHandle values after current session/context/origin/epoch checks, but a caller can still invoke bind_current_nodes without proving QueryNodes / SemanticObservation. Navigation-only or TypedInput-only adapters must not mint observation handles. The same locator and identifier gates also still admitted Unicode format and bidirectional-override characters that are neither char::is_control nor ordinary whitespace.

TDD sequence

1. Test-only 2533394 established the missing-production RED for admit_query_nodes.
2. 4186437 consumes a non-cloneable QueryNodes protocol-use proof, then calls bind_current_nodes. Navigation-only and TypedInput-only descriptors fail closed. Control-bearing and omitted sharedId values fail as locateNodes admission errors after the protocol proof succeeds.
3. 87e1e71 records the QueryNodes admission boundary in CHANGELOG, doctoring, API, architecture, ADR 0010, and the roadmap.
4. Test-only 685d517 established the missing-production RED for zero-width and bidi-override format characters.
5. 816fa1f rejects the reviewed Unicode format-character set in roles, names, sharedId, and registry external identifiers. Ordinary U+0020 spaces in accessible names remain valid.
6. ef4a3b7 cites UTS test(mv3): require repeated compatibility evidence #39 Revision 32, UAX [Product Gap] Bound HTTP/1.1 semantics over the authenticated TLS stream #9, and the superseded UTR docs: reconcile product documentation baseline onto current main #36 report.

Exact-current proof

On unchanged exact head ef4a3b7bc5e4ee509aaf857b880945eff4bba5d7 in this workspace:

• cargo test --locked -p originweave-core --all-targets succeeded;
• cargo clippy --locked -p originweave-core --all-targets -- -D warnings succeeded;
• RUSTDOCFLAGS='-D warnings' cargo doc --locked -p originweave-core --no-deps succeeded;
• cargo fmt --all --check succeeded;
• product-documentation and documentation-fitness Python contracts succeeded.

This does not transfer #171, #138, or #127 check, review, coverage, or merge evidence. Keep Draft while #127 and its prerequisite stack remain active. Workspace verification is not GitHub CI, production-coverage, or independent approval evidence.

Truth boundary

This still does not serialize a BiDi command, authenticate Chromium, observe a live accessibility tree, authorize typed input, or prove a post-condition. A later adapter must sample the query result from a trusted transport and revalidate the returned handles immediately before action.

Prefer this branch over #171 for QueryNodes admission and format-character rejection. Do not merge this Draft.

[cursor]

Do not merge this Draft. Same-automation identity cannot file REQUEST_CHANGES on this head; treat the following as a merge-blocking authority gap, not an approval.

The QueryNodes wrapper exists, but the minting path this PR says it closed is still public and ungated. admit_query_nodes proves SemanticObservation, then drops the non-cloneable ValidatedBrowserProtocolUse and calls public bind_current_nodes with no proof. webdriver_bidi_locate_nodes_admission.rs still mints ObservedNodeHandle values from a well-formed locateNodes list with no adapter, no QueryNodes, and no SemanticObservation. A Navigation-only or TypedInput-only caller uses that API and bypasses the gate.

Successor work on this run consumes the proof by value on bind_current_nodes and rejects any capability other than SemanticObservation. Prefer that successor over #172, #171, and #138. Keep Draft while #127 remains active. Do not treat in-progress checks as merge evidence.

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

bind_current_nodes is still a public ungated mint. It takes only a registry, a current-authority target, and untrusted (&str, Option<&str>) items. After session/context/origin/epoch checks it calls bind_node and returns ObservedNodeHandle values with no descriptor, capability, or ValidatedBrowserProtocolUse.

That is the #171 bypass this PR names. Integration tests lock the bypass in by calling this method with no protocol proof. Require the non-cloneable SemanticObservation proof by value and fail closed for Navigation and TypedInput proofs.

[cursor]

The dispatch callback is built to move ValidatedBrowserProtocolUse by ownership. This callback drops it (|_validated, …| ()), then bind_current_nodes runs as a second independent public call. The proof is advisory sequencing, not an authority transfer.

Return the proof from the callback and pass it into bind_current_nodes so node minting cannot proceed without consuming SemanticObservation.

[seonghobae]

Superseded by #174 after fresh exact ancestry verification. Current #174 head d83fec050a2e5dee53ae4137220140885ef443b4 has this exact head ef4a3b7bc5e4ee509aaf857b880945eff4bba5d7 as its merge base and is ahead 3 / behind 0. The complete QueryNodes admission and Unicode-format hardening remains preserved in #174, which adds the dependent SemanticObservation-proof consumption boundary. Closing this duplicate review vehicle transfers no checks/reviews/coverage/approval; #174 remains Draft behind #127 and must independently revalidate its exact head.