[isomorphisms]

Summary

Implements the first real IB protected long-view path from current main.

• adds IB.LongViewTask as the browser-owned semantic model for durable task, tab, navigation, renderer, Activity, host-process, session, form, heap, and reconstruction state;
• makes IB Long View the Android launcher, with a switchable real URL and deterministic Kill renderer / Kill IB host acceptance controls;
• stores protected tasks under the existing state/tasks and state/tabs identities with synced atomic manifest replacement and append-only navigation history;
• reconstructs from the WebView app profile plus a conservative origin-only restart target;
• keeps live survival, Activity recreation, renderer replacement, host restart, and remote-site block distinct in state and receipts.

What survives

Across renderer death:

• task, tab, and navigation identities;
• neutral origin and redaction status;
• browser-owned continuity/reconstruction state;
• the platform WebView profile, without copying its cookies;
• permitted-form status, though no generic third-party field values are captured yet.

Across host-process death, the same items survive in the app-private task record. A new per-process identity advances the host generation and attaches a replacement renderer to the same logical task.

What does not survive

• JavaScript heap or DOM continuity;
• arbitrary page field values;
• passwords or other sensitive form contents;
• URL path, query, fragment, or user-info;
• copied cookies;
• bearer/access tokens, refresh tokens, or one-time authorization codes;
• proof that the reconstructed page is still authenticated.

A reconstructed page remains session=not-proven until the user records Session works. Needs repeat records an explicit incomplete remote-site state.

OAuth/native authorization boundary

The provider-neutral task record can carry adapter/provider/client identities, scopes, redirect origin, transaction phase, expiry, and references to protected state/nonce/PKCE material. It has no fields for authorization codes or tokens and rejects unknown fields.

PR #79, “Receive local Drive authorization handoffs,” remains separate. A native adapter may populate this continuation metadata, but it does not own IB task/tab/navigation identity or turn its one-time code into durable browser state.

PR #74 evidence

PR #74, “Keep incremental WebView loads alive while using another app,” remains useful failure evidence: the MIRO A1 killed a hidden renderer despite a foreground service and WebView's highest public renderer priority. This PR retains important renderer priority only as an optimization. It does not require Picture-in-Picture, foreground service residence, foreground use, or a kept-awake screen.

The switchable URL work from merged PR #78, “Make large-page renderer URL switchable,” is assimilated into the real launcher without preserving PiP as the architecture.

Issue coverage

Refs #71 and #81.

This satisfies the browser-owned identity, renderer replacement, host-process discovery, false-continuity refusal, conservative navigation, ordinary-state secret exclusion, and explicit incomplete-state portions.

Issue #71 should remain open for explicitly permitted ordinary third-party form restoration and MIRO A1 evidence. Issue #81 should remain open until the real authenticated/device-verification sequence passes on the MIRO A1. Whole-device reboot is not claimed.

Deterministic evidence

Local source checks at the submitted tree:

• git diff --check
• tests/idric-public-vocabulary-self-test.sh
• tests/idric-public-vocabulary.sh

The Idriç smoke now fails the process if either required identity-preserving transition, false continuity refusal, ordinary-tab non-durability, sensitive URL refusal, or the cross-language record contract fails.

Android unit tests cover renderer and host transitions, Activity-versus-host distinction, atomic discovery, query/code exclusion, authorization references, false authentication/heap claims, explicit remote block, unsafe path refusal, and ordinary-tab non-persistence.

Exact-head hosted evidence for 1b29a3aa6a6727197f86e61fb5bbaae57a96cfca:

• universal merge gate / merge-gate: success;
• Android WebView protected transaction / build-apk: success (unit tests, lint, boundary check, signed APK);
• Android WebView protected transaction / replacement-install: success, including two installs without uninstall;
• IB browser foundation / idric-core: success, including the executable long-view transition smoke;
• IB browser foundation / scientific-media: success.

APK artifact ib-webview-protected-transaction-apk:

• artifact id 10722287944;
• digest sha256:3dca725c4f88cf3e263acf53144e50373ac09e098b9a55fdf66df389c4133b6c;
• exact-head artifact archive;
• successful Android workflow.

These hosted checks are deterministic/emulator evidence, not physical MIRO A1 acceptance.

Physical evidence still required

The CI-built signed APK must be replacement-installed on the MIRO A1 without uninstalling. The real IB Long View path must then exercise:

1. a slow authenticated/admin workflow;
2. an off-screen interval longer than the previous failure;
3. return classified as live survival or reconstruction;
4. forced renderer death;
5. Kill IB host, relaunch, and same-task discovery;
6. an OAuth/device-verification detour;
7. explicit session usable or repeat-required result;
8. receipt inspection for accidental secret persistence.

The receipt includes exact source head, APK identity, Android/WebView versions, host PID and generations, renderer identity/generation, task/tab/navigation/run identities, elapsed off-screen duration, authentication result, reconstruction result, and required repeated step. CI or emulator results are not physical acceptance.