Harden Remote WebView lifecycle, origins, proxy routing, and Android 16 insets

[649472774]

Scope

Remote-only hardening for the coordinated Phase 1 upgrade. Native UI, core data/auth/proxy, and release configuration remain separately owned.

• Separate the retained browser session, lifecycle state, navigation policy, page scripts, transfers, cookie handling, proxy controller, and native inset host from Compose chrome.
• Keep Activity edge-to-edge permanent. Native Remote chrome follows Material light/dark colors, uses 48dp controls, and never changes decor fitting or bar colors on route transitions. A native host applies target IME overlap rather than per-frame Compose padding or viewport/scroll JavaScript.
• Preserve unchanged live documents across re-entry and Activity recreation. Renderer loss, inactive memory reclamation, interrupted loads, and proxy changes produce explicit recovery states.
• Check exact HTTPS origins at request and document lifecycle boundaries. External sites require browser confirmation; POST redirects cannot retain a trusted Copilot title. Handle pre-start HTTP failures and canceled same-URL callbacks without reporting false readiness.
• Add opt-in WebView proxy routing with feature detection, initialization/error gates, serialized native callbacks, supported HTTP/SOCKS5 rules, and no silent direct fallback. Retained documents retain their proxy lease; destruction blocks service-worker networking before restoration.
• Complete/cancel upload callbacks, validate readable document URIs off Main, explain browser-download limitations, and await cookie/storage callbacks before reopening a logged-out page.

Integration dependencies

Approved release prerequisite 8a128d0c2cb626ad0a25c59ab1c2d4457744ec0e was adopted as 98ac921. Integration that already has the prerequisite should adopt the Remote checkpoints 282fc03, 204fd4d, f292cf8, and 62b8c7f, without duplicating the prerequisite.

The additive Remote arguments are container.proxySettings.config, .initialized, and .loadError. Core owns those readiness/error flows; the native UI owner confirmed the bindings on its workstream. Missing wiring blocks follow-app-proxy mode rather than assuming direct connectivity. No shared source files were manually edited here.

Evidence

Baseline v0.1.33 assembleDebug passed before edits. Current source passes 43 focused JVM tests, assembleDebug, assembleDebugAndroidTest, strict lintDebug, and GitHub build. The independent Astra/max review identified three callback-order defects; all were corrected with explicit regression coverage.

All 13 Remote instrumentation cases passed on both API31 and API36 in the integrated portrait matrix.

Device / WebView	Integrated source	Result
AOSP API31 / 91.0.4472.114	c5af1f8f310dc1e3720101166692b3f10041c42d	Remote 13/13; 14/14 combined run including the separately owned native-copy case
AOSP API36 / 133.0.6943.137	278f974f16448afedb832ba5ef521163ad1fc12e	Remote 13/13

Both result manifests attest installed app APK bytes with SHA-256 d27c7724d3e71b83cd374c26f82536667f911ba89ebc7a10a0692ccc31910036. Actual software IME was enabled; strict resize-count, actual textarea visual-viewport, scroll, Back, system-bar, retained-state/context, recovery, and 200% text assertions passed. Run-fresh full-device IME, large-font dark, and returned-native captures were inspected: composer visible directly above the keyboard without extra gap, reachable header controls, and normal bars after return. API31 golden data was also verified read-only after cold restart by integration.

The hermetic suite uses a blank ComponentActivity matching MainActivity edge-to-edge/adjustResize, in-memory settings/proxy/cookie doubles, blocked network loads, CSP, and local HTTPS responses delivered after the production origin guard. Production's optional response supplier defaults to null. It does not read or clear a real account's cookies. Controlled images and failure-only metadata are stored under remote-acceptance; diagnostics exclude cookies, document text, and query strings.

The initial data-document fixture had failed before assertions on both engines because its navigation was stopped by policy and Chromium displayed an error document. f292cf8 added diagnostics/full-device capture; 62b8c7f switched to normal HTTPS navigation with in-memory responses. No origin exception, forced READY state, or timeout increase was used to obtain the passing results.

The integration owner exclusively operated the fresh devices; this branch owner did not drive adb/install/emulator UI. Production remains frozen at 62b8c7f.

Explicit limitations and release boundary

This is the agreed portrait Remote matrix, not a claim of broad landscape/split-screen or live-site acceptance. UI-owned host-PAN/short-landscape work remains separate. Overall stable-release approval belongs to the integration coordinator.

External enterprise SSO continues in the system browser, whose cookies/proxy settings are independent. Authenticated WebView proxies and unsupported WebView proxy implementations fail closed. Blob/data downloads cannot be transferred to a browser; HTTP(S) downloads are handed off with confirmation, not reported as completed downloads. Older engines lacking complete browsing-data deletion explicitly report that limitation after awaited cookie removal.

Renderer/process loss or deliberate network/desktop changes may require a reload and lose unsent web-only drafts. Live GitHub composer behavior, authenticated web login, and real proxy reachability remain separate integration acceptance items.

No version bump, main merge, release publication, or shared/user-checkout modification.