feat(core): rotate document epoch after same-document mutation

[cursor]

Buyer-visible gap

Partial implementation of #28. A buyer cannot treat an observed checkout field as durable after a single-page replacement. Protected main already rejects cross-session, cross-context, cross-origin, and stale-document handle reuse, but it has no protected-main control-plane rule for same-document mutations that change the target's identity or accessible name while the page origin stays the same.

Current exact implemented boundary

Protected main remains exact 0c376acf059be9ddddddfbde1d0189e4f39ef014; current exact contributor head is 308ff3cd2c76d6c1260773b250439d87eb4b9d09.

This active PR adds SameDocumentMutationKind and DocumentEpoch::after_same_document_mutation:

• target removal/replacement, role/name change, accessibility-tree invalidation, frame-document replacement, and actionable subtree replacement increment the epoch;
• a reviewed non-semantic mutation may keep the current handle;
• epoch overflow fails closed;
• a checkout-field handle emitted at epoch 1 is rejected after a target replacement, and only a re-observed handle at epoch 2 validates.

This remains IMPLEMENTED_ON_ACTIVE_PR, not protected-main shipped truth. It is a Rust decision function only: it does not watch the live DOM, consume MutationObserver or WebDriver BiDi events, dispatch input, or claim a completed Chromium vertical slice.

TDD and documentation-truth repair

The first same_document_mutation contract failed to compile because SameDocumentMutationKind, after_same_document_mutation, and DocumentEpochOverflow were absent. Production code was added after that RED.

A subsequent exact-head review found that three canonical documents had promoted the active primitive to protected-main/implemented wording. Current head 308ff3cd2c76d6c1260773b250439d87eb4b9d09 repairs that defect by restoring the protected-main docs/PRD.md, docs/TRD.md, and docs/THREAT_MODEL.md truth for those sections while retaining this PR's source/tests and explicitly active-PR documentation elsewhere. No production behavior or gate was weakened.

Exact-current verification

On unchanged exact head 308ff3cd2c76d6c1260773b250439d87eb4b9d09:

• CI run 31969963818: success, including repository contracts, canonical formatting, locked workspace checks, full tests, strict Clippy, rustdoc, and exact owned-production coverage enforcement;
• Manifest V3 Compatibility run 31969963804: success;
• SAST Semgrep run 31969963803: currently queued, not passing evidence;
• Security Scan run 31969963820: currently queued, not passing evidence;
• GitHub reports the PR mergeable and Ready for review; and
• the earlier CHANGES_REQUESTED review was submitted against predecessor head 837ad8a180f75f3431ffb823984953190721b6e8; it is historical evidence after the repairing push and is not converted into approval.

No predecessor, synthetic-merge, status-only, model-only, absent, skipped, queued, or stale evidence is promoted as current proof.

Standards and scope

Doctoring cites WebDriver stale-element semantics, the WHATWG DOM Standard, and WAI-ARIA 1.2 in APA 7th form. Those sources justify epoch rotation; they do not prove a live adapter.

The remaining #28 work is adapter/runtime integration: trusted same-document mutation observation, immediate revalidation at the action linearization boundary, real browser dispatch, post-condition proof, recovery, and credential-safe evidence. Do not represent this deterministic core primitive as that complete vertical slice.

Integration gate

No merge is attempted from this scheduled actor. Because this actor made the latest repairing push, it also cannot supply the qualifying independent/latest-push approval. Required current-head repository governance and applicable workflows must be satisfied without self-approval, manufactured approval, workflow mutation, secret changes, or gate weakening.

Partial implementation of #28.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[seonghobae]

Exact-head review found a documentation-maturity regression. The Rust mutation/epoch primitive and its stale-handle/overflow tests are coherent, but several canonical docs promote this active PR to shipped/implemented truth while protected main is still 0c376acf059be9ddddddfbde1d0189e4f39ef014: docs/TRD.md says “Core SameDocumentMutationKind is Implemented”; docs/THREAT_MODEL.md places it under “Implemented controls”; and docs/PRD.md says it “now decides” without identifying it as active/non-shipped evidence. OriginWeave’s documentation contract requires protected-main truth to remain distinct from active-PR evidence. Reword these entries to preserve the current protected-main ObservedNodeHandle validation as implemented and explicitly label SameDocumentMutationKind / same-document epoch rotation as active PR #173 until integration. Do not weaken the tests or behavior. Exact-head CI, SAST, Security, and MV3 are green; this review is limited to truth-status correctness.