termivar_scanner/web_runtime/

supplied_session_runtime.rs

//! Bounded supplied-session orchestration under the assessment's shared authority.

mod oauth_authorization;
mod oauth_code;
pub(crate) use oauth_authorization::OAuthAuthorizationDispatchPermit;
pub use oauth_authorization::{
    SuppliedSessionOAuthAuthorizationAudit, SuppliedSessionOAuthAuthorizationOutcome,
};
mod oauth_refresh;
use oauth_code::{CommittedOAuthCodeReceipt, OAuthCodeAcquisitionContext};
pub use oauth_code::{
    SuppliedSessionOAuthCodeAudit, SuppliedSessionOAuthCodeOutcome,
    SuppliedSessionOAuthInitiatedTokenAudit,
};
pub(crate) use oauth_refresh::OAuthRefreshDispatchPermit;
use oauth_refresh::{CommittedOAuthRefreshReceipt, OAuthRefreshContext};
pub use oauth_refresh::{SuppliedSessionOAuthRefreshAudit, SuppliedSessionOAuthRefreshOutcome};

/// V6 records one explicitly scheduled, separately committed OAuth renewal.
pub const SUPPLIED_SESSION_OAUTH_REFRESH_AUDIT_SCHEMA: &str = "security.supplied-session-audit/v6";
/// V7 client-generated authorization and a separately committed token exchange.
pub const SUPPLIED_SESSION_OAUTH_AUTHORIZATION_AUDIT_SCHEMA: &str =
    "security.supplied-session-audit/v7";

use std::time::Duration;

use serde::{
    de::{DeserializeSeed, MapAccess, SeqAccess, Visitor},
    Deserializer, Serialize,
};
use sha2::{Digest, Sha256};
use termivar_core::{
    ConfidenceScore, EntityId, Evidence, EvidenceId, EvidenceKind, EvidenceSource, EvidenceValue,
    KnowledgePredicate,
};

#[cfg(feature = "websocket-review")]
use super::websocket_runtime::{
    execute_supplied_session_websocket_review, websocket_review_not_run,
    WebAssessmentWebSocketReviewAudit, WebSocketSuppliedSessionContextAudit,
    WebSocketSuppliedSessionHealthAudit, WebSocketSuppliedSessionQualification,
};
use super::{authority::SharedWebRuntimeAuthority, RuntimeExecution};
#[cfg(feature = "websocket-review")]
use crate::supplied_session_review::SuppliedSessionAuthorization;
use crate::{
    http_evidence::{
        extract_supplied_session_login_csrf, CollectedHttpResponse, HttpRequestBroker,
        OAuthCodeRequestBroker, OAuthCodeRequestDescriptor, OAuthRefreshRequestDescriptor,
        SuppliedSessionCookieUpdateClassification, SuppliedSessionCookieUpdateObservation,
        SuppliedSessionLoginCsrfToken, SuppliedSessionLoginFormError, SuppliedSessionRequestError,
    },
    supplied_session_review::{
        SuppliedSessionCookieSummary, SuppliedSessionCookieUpdatePolicy, SuppliedSessionCredential,
        SuppliedSessionCredentialAcquisition, SuppliedSessionCredentialMechanism,
        SuppliedSessionFormBody, SuppliedSessionPolicy, SuppliedSessionPolicyVersion,
        SuppliedSessionRequestDescriptor, SuppliedSessionRequestPurpose,
        SuppliedSessionRuntimeInput, MAX_SUPPLIED_SESSION_CHECKPOINTS,
        MAX_SUPPLIED_SESSION_RESOURCES,
    },
    DecisionActionOrigin, DecisionExecutionLimits, DecisionExecutionStage, KnowledgeBase,
};
#[cfg(feature = "websocket-review")]
use crate::{web_runtime::WebSocketReviewFailureKind, websocket_review::WebSocketReviewPolicy};

/// Sealed runtime observer for consumers of health-qualified supplied-session
/// resource responses. Implementations may reduce a body while it is alive,
/// but can publish only after receiving the exact committed S01 receipt.
pub(super) trait SuppliedSessionCommittedResourceObserver: Send + Sync {
    fn begin(
        &self,
        policy: &SuppliedSessionPolicy,
        resources: &[(SuppliedSessionRequestDescriptor, String)],
    ) -> Result<(), ()>;

    fn stage_response(
        &self,
        sequence: u8,
        policy: &SuppliedSessionPolicy,
        descriptor: &SuppliedSessionRequestDescriptor,
        response: &CollectedHttpResponse,
    ) -> Result<(), ()>;

    fn commit_response(
        &self,
        sequence: u8,
        policy: &SuppliedSessionPolicy,
        descriptor: &SuppliedSessionRequestDescriptor,
        receipt: &CommittedSuppliedSessionResourceReceipt,
        knowledge: &KnowledgeBase,
    ) -> Result<(), ()>;

    fn discard_response(&self, sequence: u8);

    fn fail(&self);
}

/// Exact, value-safe proof that S01 committed one resource only after its
/// immediately following healthy checkpoint. Fields are intentionally sealed.
pub(super) struct CommittedSuppliedSessionResourceReceipt {
    #[cfg(feature = "wordpress-review")]
    sequence: u8,
    #[cfg(feature = "wordpress-review")]
    resource_reference: String,
    #[cfg(feature = "wordpress-review")]
    policy_reference: String,
    #[cfg(feature = "wordpress-review")]
    application_reference: String,
    #[cfg(feature = "wordpress-review")]
    principal_reference: String,
    #[cfg(feature = "wordpress-review")]
    credential_mechanism: SuppliedSessionCredentialMechanism,
    #[cfg(feature = "wordpress-review")]
    epoch: u8,
    evidence_reference: String,
    #[cfg(feature = "wordpress-review")]
    expected_evidence: Evidence,
}

#[cfg(feature = "wordpress-review")]
impl CommittedSuppliedSessionResourceReceipt {
    pub(super) const fn sequence(&self) -> u8 {
        self.sequence
    }

    pub(super) fn resource_reference(&self) -> &str {
        &self.resource_reference
    }

    pub(super) fn evidence_reference(&self) -> &str {
        &self.evidence_reference
    }

    pub(super) fn is_valid_for(
        &self,
        sequence: u8,
        policy: &SuppliedSessionPolicy,
        descriptor: &SuppliedSessionRequestDescriptor,
        knowledge: &KnowledgeBase,
    ) -> bool {
        EvidenceId::parse(self.evidence_reference.clone())
            .ok()
            .and_then(|id| {
                knowledge.inspect_evidence(&id, |stored| stored == &self.expected_evidence)
            })
            == Some(true)
            && self.sequence == sequence
            && self.resource_reference == descriptor.target_reference()
            && self.policy_reference == policy.policy_reference()
            && self.application_reference == policy.application_reference()
            && self.principal_reference == policy.principal_reference()
            && self.credential_mechanism == policy.credential_mechanism()
            && self.epoch == 1
            && descriptor.validate()
            && descriptor.purpose() == SuppliedSessionRequestPurpose::Resource
            && self.expected_evidence.kind() == &EvidenceKind::Authentication
            && self.expected_evidence.predicate().namespace() == RESOURCE_COMMIT_EVIDENCE_NAMESPACE
            && self.expected_evidence.predicate().name() == RESOURCE_COMMIT_EVIDENCE_PREDICATE
    }
}

/// Exact, value-safe startup/terminal health proof used only to narrow the
/// supplied-session WebSocket authority. The proof is sealed to this module
/// and revalidates its committed parent evidence before minting transport.
#[cfg(feature = "websocket-review")]
struct CommittedSuppliedSessionHealthReceipt {
    sequence: u8,
    phase: SuppliedSessionHealthCheckpointPhase,
    after_subject_count: u8,
    policy_reference: String,
    application_reference: String,
    principal_reference: String,
    credential_mechanism: SuppliedSessionCredentialMechanism,
    epoch: u8,
    evidence_reference: String,
    expected_evidence: Evidence,
}

#[cfg(feature = "websocket-review")]
impl CommittedSuppliedSessionHealthReceipt {
    fn from_checkpoint(
        policy: &SuppliedSessionPolicy,
        checkpoint: &WebAssessmentSuppliedSessionCheckpointAudit,
        expected_phase: SuppliedSessionHealthCheckpointPhase,
        expected_after_subject_count: u8,
        knowledge: &KnowledgeBase,
    ) -> Option<Self> {
        if checkpoint.phase() != expected_phase
            || checkpoint.after_subject_count() != expected_after_subject_count
            || checkpoint.outcome() != SuppliedSessionHealthOutcome::Healthy
            || checkpoint.body_state() != SuppliedSessionBodyState::Complete
            || checkpoint.predicate() != SuppliedSessionPredicateOutcome::Matched
        {
            return None;
        }
        let evidence_reference = checkpoint.evidence_reference()?.to_owned();
        let evidence_id = EvidenceId::parse(evidence_reference.clone()).ok()?;
        let expected_evidence = knowledge.inspect_evidence(&evidence_id, Clone::clone)?;
        Some(Self {
            sequence: checkpoint.sequence(),
            phase: checkpoint.phase(),
            after_subject_count: checkpoint.after_subject_count(),
            policy_reference: policy.policy_reference().to_owned(),
            application_reference: policy.application_reference().to_owned(),
            principal_reference: policy.principal_reference().to_owned(),
            credential_mechanism: policy.credential_mechanism(),
            epoch: 1,
            evidence_reference,
            expected_evidence,
        })
    }

    fn is_valid_for(
        &self,
        policy: &SuppliedSessionPolicy,
        expected_phase: SuppliedSessionHealthCheckpointPhase,
        expected_after_subject_count: u8,
        knowledge: &KnowledgeBase,
    ) -> bool {
        EvidenceId::parse(self.evidence_reference.clone())
            .ok()
            .and_then(|id| {
                knowledge.inspect_evidence(&id, |stored| stored == &self.expected_evidence)
            })
            == Some(true)
            && self.sequence
                == match expected_phase {
                    SuppliedSessionHealthCheckpointPhase::Startup => 0,
                    SuppliedSessionHealthCheckpointPhase::Terminal => 1,
                    SuppliedSessionHealthCheckpointPhase::SubjectBoundary
                    | SuppliedSessionHealthCheckpointPhase::Renewal => return false,
                }
            && self.phase == expected_phase
            && self.after_subject_count == expected_after_subject_count
            && self.policy_reference == policy.policy_reference()
            && self.application_reference == policy.application_reference()
            && self.principal_reference == policy.principal_reference()
            && self.credential_mechanism == SuppliedSessionCredentialMechanism::AuthorizationHeader
            && policy.version() == SuppliedSessionPolicyVersion::V1
            && policy.credential_mechanism()
                == SuppliedSessionCredentialMechanism::AuthorizationHeader
            && policy.resource_count() == 1
            && self.epoch == 1
            && self.expected_evidence.kind() == &EvidenceKind::Authentication
            && self.expected_evidence.predicate().namespace() == RESOURCE_COMMIT_EVIDENCE_NAMESPACE
            && self.expected_evidence.predicate().name() == HEALTH_COMMIT_EVIDENCE_PREDICATE
    }
}

/// Move-only, module-sealed authorization for one supplied-session WebSocket
/// handshake. It borrows the guarded header and never stores or hashes it.
#[cfg(feature = "websocket-review")]
pub(super) struct SuppliedSessionWebSocketPermit<'a> {
    policy: &'a SuppliedSessionPolicy,
    authorization: &'a SuppliedSessionAuthorization,
    websocket_policy_reference: &'a str,
    websocket_endpoint_reference: &'a str,
    session_deadline: Option<tokio::time::Instant>,
    startup: CommittedSuppliedSessionHealthReceipt,
}

#[cfg(feature = "websocket-review")]
impl<'a> SuppliedSessionWebSocketPermit<'a> {
    fn new(
        policy: &'a SuppliedSessionPolicy,
        authorization: &'a SuppliedSessionAuthorization,
        websocket: &'a WebSocketReviewPolicy,
        session_deadline: Option<tokio::time::Instant>,
        startup: CommittedSuppliedSessionHealthReceipt,
    ) -> Self {
        Self {
            policy,
            authorization,
            websocket_policy_reference: websocket.policy_reference(),
            websocket_endpoint_reference: websocket.endpoint_reference(),
            session_deadline,
            startup,
        }
    }

    pub(super) fn is_valid_for(
        &self,
        selected_application: &url::Url,
        websocket: &WebSocketReviewPolicy,
        knowledge: &KnowledgeBase,
        parent_deadline: Option<tokio::time::Instant>,
    ) -> bool {
        self.policy.application_url() == selected_application
            && self.policy.version() == SuppliedSessionPolicyVersion::V1
            && self.policy.credential_mechanism()
                == SuppliedSessionCredentialMechanism::AuthorizationHeader
            && self.policy.resource_count() == 1
            && self.websocket_policy_reference == websocket.policy_reference()
            && self.websocket_endpoint_reference == websocket.endpoint_reference()
            && self.session_deadline.is_some()
            && parent_deadline.is_none_or(|parent| {
                self.session_deadline
                    .is_some_and(|session| session <= parent)
            })
            && self.startup.is_valid_for(
                self.policy,
                SuppliedSessionHealthCheckpointPhase::Startup,
                0,
                knowledge,
            )
    }

    pub(super) const fn authorization(&self) -> &SuppliedSessionAuthorization {
        self.authorization
    }

    pub(super) const fn session_deadline(&self) -> Option<tokio::time::Instant> {
        self.session_deadline
    }
}

/// Stable saved-audit schema for the supplied-session child.
pub const SUPPLIED_SESSION_AUDIT_SCHEMA: &str = "security.supplied-session-audit/v1";
/// Strict saved-audit schema for supplied-cookie sessions.
pub const SUPPLIED_SESSION_COOKIE_AUDIT_SCHEMA: &str = "security.supplied-session-audit/v2";
/// Strict saved-audit schema for one bounded form-login transition.
pub const SUPPLIED_SESSION_FORM_LOGIN_AUDIT_SCHEMA: &str = "security.supplied-session-audit/v3";
/// Scheduled supplied-cookie renewal audit, preserving the historical audits.
pub const SUPPLIED_SESSION_RENEWAL_AUDIT_SCHEMA: &str = "security.supplied-session-audit/v4";
/// Imported-code acquisition plus the existing independently qualified health loop.
pub const SUPPLIED_SESSION_OAUTH_CODE_AUDIT_SCHEMA: &str = "security.supplied-session-audit/v5";
/// Stable capability identity. This audit-only V1 emits no assessment item.
pub const SUPPLIED_SESSION_CAPABILITY_ID: &str = "session.supplied-context-assessment@1";

const HEALTH_JSON_MAX_DEPTH: usize = 16;
const HEALTH_JSON_MAX_NODES: usize = 512;
const HEALTH_JSON_MAX_KEY_BYTES: usize = 256;
const RESOURCE_COMMIT_EVIDENCE_DOMAIN: &[u8] = b"security.supplied-session-resource-evidence.v1\0";
const HEALTH_COMMIT_EVIDENCE_DOMAIN: &[u8] = b"security.supplied-session-health-evidence.v1\0";
const RESOURCE_COMMIT_EVIDENCE_PREFIX: &str = "supplied-session-resource-evidence-sha256";
const HEALTH_COMMIT_EVIDENCE_PREFIX: &str = "supplied-session-checkpoint-evidence-sha256";
const RESOURCE_COMMIT_EVIDENCE_NAMESPACE: &str = "session.supplied-context-assessment";
const RESOURCE_COMMIT_EVIDENCE_PREDICATE: &str = "protected-resource-response-committed";
const RESOURCE_HEALTH_UNQUALIFIED_EVIDENCE_PREDICATE: &str =
    "protected-resource-response-health-unqualified";
const HEALTH_COMMIT_EVIDENCE_PREDICATE: &str = "health-checkpoint-observation-committed";
const RESOURCE_COMMIT_EVIDENCE_COMPONENT: &str = "supplied-session.runtime";
const RESOURCE_COMMIT_EVIDENCE_METHOD_V1: &str = "descriptor-bound-complete-authorization-get";
const HEALTH_COMMIT_EVIDENCE_METHOD_V1: &str = "descriptor-bound-health-authorization-get";
const RESOURCE_COMMIT_EVIDENCE_METHOD_V2: &str = "descriptor-bound-complete-supplied-cookie-get";
const HEALTH_COMMIT_EVIDENCE_METHOD_V2: &str = "descriptor-bound-health-supplied-cookie-get";
const RESOURCE_COMMIT_EVIDENCE_METHOD_V3: &str = "descriptor-bound-complete-form-login-cookie-get";
const HEALTH_COMMIT_EVIDENCE_METHOD_V3: &str = "descriptor-bound-health-form-login-cookie-get";
const SUPPLIED_SESSION_NON_BROWSER_COOKIE_SEMANTICS: &str =
    "attributes_preserved_not_browser_csrf_emulation";

/// Assurance attached to the principal label used for this run.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
#[serde(rename_all = "snake_case")]
#[non_exhaustive]
pub enum SuppliedSessionPrincipalAssurance {
    /// The principal alias was declared by the operator, not authenticated as identity truth.
    OperatorDeclared,
}

/// The closed health predicate implemented by V1.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
#[serde(rename_all = "snake_case")]
#[non_exhaustive]
pub enum SuppliedSessionHealthOracleKind {
    /// A configured top-level JSON member must be the boolean `true`.
    JsonBooleanTrue,
}

/// Value-free description of the configured health oracle.
#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
pub struct SuppliedSessionHealthOracleAudit {
    kind: SuppliedSessionHealthOracleKind,
    field_reference: String,
}

impl SuppliedSessionHealthOracleAudit {
    pub const fn kind(&self) -> SuppliedSessionHealthOracleKind {
        self.kind
    }

    pub fn field_reference(&self) -> &str {
        &self.field_reference
    }
}

/// Overall bounded child outcome.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
#[serde(rename_all = "snake_case")]
#[non_exhaustive]
pub enum SuppliedSessionAuditOutcome {
    Complete,
    StartupUnhealthy,
    SessionLost,
    ResourceUnavailable,
    RuntimeLimit,
    Cancelled,
    /// A selected cookie was reissued; V2 stopped without applying it.
    CredentialUpdateRequired,
    /// A response cookie update could not be classified within V2's bounds.
    CredentialUpdateUnusable,
    /// The explicit login page did not yield one admissible form/token.
    LoginFormUnavailable,
    /// The single stateful login submission could not complete.
    LoginSubmitUnavailable,
    /// The login response did not yield the exact declared cookie set.
    LoginCookieUnavailable,
    /// The one selected renewal did not yield a usable replacement context.
    RenewalUnavailable,
    /// The one external code exchange did not yield a committed usable credential.
    #[serde(rename = "oauth_code_exchange_unavailable")]
    OAuthCodeExchangeUnavailable,
    /// The one declared OAuth refresh did not commit a usable next context.
    OAuthRefreshUnavailable,
}

/// Value-free result of selecting the one policy-bound login form.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
#[serde(rename_all = "snake_case")]
#[non_exhaustive]
pub enum SuppliedSessionLoginFormOutcome {
    Matched,
    IneligibleResponse,
    Missing,
    Ambiguous,
    Invalid,
    TransportFailed,
    RuntimeLimit,
    Cancelled,
    NotEvaluated,
}

/// Value-free result of the single login POST.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
#[serde(rename_all = "snake_case")]
#[non_exhaustive]
pub enum SuppliedSessionLoginSubmitOutcome {
    CookieAcquired,
    CookieUnavailable,
    HttpError,
    RedirectRefused,
    Incomplete,
    TransportFailed,
    RuntimeLimit,
    Cancelled,
    NotDispatched,
}

/// Redaction-safe V3 acquisition record. Epoch one is established only after
/// the existing startup health checkpoint matches and commits.
#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
pub struct SuppliedSessionLoginAudit {
    login_reference: String,
    max_attempts: u8,
    attempt_count: u8,
    page_dispatched: bool,
    page_status: Option<u16>,
    page_body_state: SuppliedSessionBodyState,
    form_outcome: SuppliedSessionLoginFormOutcome,
    #[serde(skip_serializing_if = "Option::is_none")]
    form_error_code: Option<&'static str>,
    submit_dispatched: bool,
    submit_status: Option<u16>,
    submit_body_state: SuppliedSessionBodyState,
    submit_outcome: SuppliedSessionLoginSubmitOutcome,
    acquired_cookie_count: u8,
    response_bytes: u64,
    initial_epoch: u8,
    final_epoch: u8,
    pre_session_cookie_applied: bool,
}

impl SuppliedSessionLoginAudit {
    pub fn login_reference(&self) -> &str {
        &self.login_reference
    }
    pub const fn max_attempts(&self) -> u8 {
        self.max_attempts
    }
    pub const fn attempt_count(&self) -> u8 {
        self.attempt_count
    }
    pub const fn page_dispatched(&self) -> bool {
        self.page_dispatched
    }
    pub const fn page_status(&self) -> Option<u16> {
        self.page_status
    }
    pub const fn page_body_state(&self) -> SuppliedSessionBodyState {
        self.page_body_state
    }
    pub const fn form_outcome(&self) -> SuppliedSessionLoginFormOutcome {
        self.form_outcome
    }
    pub const fn form_error_code(&self) -> Option<&'static str> {
        self.form_error_code
    }
    pub const fn submit_dispatched(&self) -> bool {
        self.submit_dispatched
    }
    pub const fn submit_status(&self) -> Option<u16> {
        self.submit_status
    }
    pub const fn submit_body_state(&self) -> SuppliedSessionBodyState {
        self.submit_body_state
    }
    pub const fn submit_outcome(&self) -> SuppliedSessionLoginSubmitOutcome {
        self.submit_outcome
    }
    pub const fn acquired_cookie_count(&self) -> u8 {
        self.acquired_cookie_count
    }
    pub const fn response_bytes(&self) -> u64 {
        self.response_bytes
    }
    pub const fn initial_epoch(&self) -> u8 {
        self.initial_epoch
    }
    pub const fn final_epoch(&self) -> u8 {
        self.final_epoch
    }
    pub const fn pre_session_cookie_applied(&self) -> bool {
        self.pre_session_cookie_applied
    }
}

/// Authenticated resource coverage established by committed resource responses and checkpoints.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
#[serde(rename_all = "snake_case")]
#[non_exhaustive]
pub enum SuppliedSessionCoverage {
    Complete,
    Partial,
    None,
}

/// Position of one health check in the fixed schedule.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
#[serde(rename_all = "snake_case")]
#[non_exhaustive]
pub enum SuppliedSessionHealthCheckpointPhase {
    Startup,
    SubjectBoundary,
    Terminal,
    /// Immediate health check after applying the selected replacement cookies.
    Renewal,
}

/// Health interpretation at one actually dispatched checkpoint.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
#[serde(rename_all = "snake_case")]
#[non_exhaustive]
pub enum SuppliedSessionHealthOutcome {
    Healthy,
    Unhealthy,
    Indeterminate,
}

/// Completeness of a health-check response body.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
#[serde(rename_all = "snake_case")]
#[non_exhaustive]
pub enum SuppliedSessionBodyState {
    Complete,
    Incomplete,
    Unavailable,
}

/// Whether the closed health predicate was evaluated successfully.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
#[serde(rename_all = "snake_case")]
#[non_exhaustive]
pub enum SuppliedSessionPredicateOutcome {
    Matched,
    NotMatched,
    NotEvaluated,
}

/// Outcome of one selected protected-resource request.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
#[serde(rename_all = "snake_case")]
#[non_exhaustive]
pub enum SuppliedSessionResourceOutcome {
    Committed,
    /// A complete response was observed, but the following health checkpoint
    /// did not qualify it as authenticated coverage.
    HealthUnqualified,
    HttpError,
    RedirectRefused,
    Incomplete,
    TransportFailed,
    NotDispatched,
}

/// One value-free, actually dispatched health checkpoint.
#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
pub struct WebAssessmentSuppliedSessionCheckpointAudit {
    sequence: u8,
    evidence_reference: Option<String>,
    phase: SuppliedSessionHealthCheckpointPhase,
    after_subject_count: u8,
    outcome: SuppliedSessionHealthOutcome,
    status: Option<u16>,
    body_state: SuppliedSessionBodyState,
    predicate: SuppliedSessionPredicateOutcome,
    response_bytes: u64,
    #[serde(skip_serializing_if = "Option::is_none")]
    epoch: Option<u8>,
    #[serde(skip)]
    cookie_update: Option<SuppliedSessionResponseCookieUpdate>,
}

impl WebAssessmentSuppliedSessionCheckpointAudit {
    pub fn epoch(&self) -> u8 {
        self.epoch.unwrap_or(1)
    }
    pub const fn sequence(&self) -> u8 {
        self.sequence
    }
    pub fn evidence_reference(&self) -> Option<&str> {
        self.evidence_reference.as_deref()
    }
    pub const fn phase(&self) -> SuppliedSessionHealthCheckpointPhase {
        self.phase
    }
    pub const fn after_subject_count(&self) -> u8 {
        self.after_subject_count
    }
    pub const fn outcome(&self) -> SuppliedSessionHealthOutcome {
        self.outcome
    }
    pub const fn status(&self) -> Option<u16> {
        self.status
    }
    pub const fn body_state(&self) -> SuppliedSessionBodyState {
        self.body_state
    }
    pub const fn predicate(&self) -> SuppliedSessionPredicateOutcome {
        self.predicate
    }
    pub const fn response_bytes(&self) -> u64 {
        self.response_bytes
    }
}

/// One selected protected resource and its value-free execution result.
#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
pub struct WebAssessmentSuppliedSessionResourceAudit {
    sequence: u8,
    resource_reference: String,
    evidence_reference: Option<String>,
    outcome: SuppliedSessionResourceOutcome,
    status: Option<u16>,
    response_bytes: u64,
    epoch: u8,
    #[serde(skip)]
    cookie_update: Option<SuppliedSessionResponseCookieUpdate>,
}

impl WebAssessmentSuppliedSessionResourceAudit {
    pub const fn sequence(&self) -> u8 {
        self.sequence
    }
    pub fn resource_reference(&self) -> &str {
        &self.resource_reference
    }
    pub fn evidence_reference(&self) -> Option<&str> {
        self.evidence_reference.as_deref()
    }
    pub const fn outcome(&self) -> SuppliedSessionResourceOutcome {
        self.outcome
    }
    pub const fn status(&self) -> Option<u16> {
        self.status
    }
    pub const fn response_bytes(&self) -> u64 {
        self.response_bytes
    }
    pub const fn epoch(&self) -> u8 {
        self.epoch
    }
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
enum SuppliedSessionResponseCookieUpdateKind {
    None,
    UnselectedOnly,
    Selected,
    Unusable,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
struct SuppliedSessionResponseCookieUpdate {
    kind: SuppliedSessionResponseCookieUpdateKind,
    selected_count: u8,
    unselected_count: u8,
}

/// Redaction-safe static cookie-policy aggregate for audit V2.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
pub struct SuppliedSessionCookiePolicyAudit {
    declared_count: u8,
    host_only_count: u8,
    domain_count: u8,
    secure_count: u8,
    http_only_count: u8,
    session_count: u8,
    persistent_count: u8,
    same_site_missing_count: u8,
    same_site_strict_count: u8,
    same_site_lax_count: u8,
    same_site_none_count: u8,
    update_policy: SuppliedSessionCookieUpdatePolicy,
}

impl SuppliedSessionCookiePolicyAudit {
    pub const fn declared_count(&self) -> u8 {
        self.declared_count
    }
    pub const fn host_only_count(&self) -> u8 {
        self.host_only_count
    }
    pub const fn domain_count(&self) -> u8 {
        self.domain_count
    }
    pub const fn secure_count(&self) -> u8 {
        self.secure_count
    }
    pub const fn http_only_count(&self) -> u8 {
        self.http_only_count
    }
    pub const fn session_count(&self) -> u8 {
        self.session_count
    }
    pub const fn persistent_count(&self) -> u8 {
        self.persistent_count
    }
    pub const fn same_site_missing_count(&self) -> u8 {
        self.same_site_missing_count
    }
    pub const fn same_site_strict_count(&self) -> u8 {
        self.same_site_strict_count
    }
    pub const fn same_site_lax_count(&self) -> u8 {
        self.same_site_lax_count
    }
    pub const fn same_site_none_count(&self) -> u8 {
        self.same_site_none_count
    }
    pub const fn update_policy(&self) -> SuppliedSessionCookieUpdatePolicy {
        self.update_policy
    }
    pub const fn browser_semantics(&self) -> &'static str {
        SUPPLIED_SESSION_NON_BROWSER_COOKIE_SEMANTICS
    }
}

/// Redaction-safe dynamic cookie lifecycle aggregate for audit V2.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
pub struct SuppliedSessionCookieLifecycleAudit {
    initial_epoch: u8,
    final_epoch: u8,
    selected_update_response_count: u8,
    unselected_update_response_count: u8,
    update_classification_failure_count: u8,
    updates_applied: u8,
}

impl SuppliedSessionCookieLifecycleAudit {
    pub const fn initial_epoch(&self) -> u8 {
        self.initial_epoch
    }
    pub const fn final_epoch(&self) -> u8 {
        self.final_epoch
    }
    pub const fn selected_update_response_count(&self) -> u8 {
        self.selected_update_response_count
    }
    pub const fn unselected_update_response_count(&self) -> u8 {
        self.unselected_update_response_count
    }
    pub const fn update_classification_failure_count(&self) -> u8 {
        self.update_classification_failure_count
    }
    pub const fn updates_applied(&self) -> u8 {
        self.updates_applied
    }
}

/// Redaction-safe audit for one explicitly selected supplied-session child.
#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
pub struct WebAssessmentSuppliedSessionAudit {
    schema: &'static str,
    capability_id: &'static str,
    policy_reference: String,
    application_reference: String,
    principal_reference: String,
    principal_alias: String,
    principal_assurance: SuppliedSessionPrincipalAssurance,
    credential_mechanism: SuppliedSessionCredentialMechanism,
    #[serde(skip_serializing_if = "legacy_credential_acquisition")]
    credential_acquisition: SuppliedSessionCredentialAcquisition,
    health_oracle: SuppliedSessionHealthOracleAudit,
    outcome: SuppliedSessionAuditOutcome,
    coverage: SuppliedSessionCoverage,
    checkpoints: Vec<WebAssessmentSuppliedSessionCheckpointAudit>,
    resources: Vec<WebAssessmentSuppliedSessionResourceAudit>,
    selected_resource_count: u8,
    dispatched_resource_count: u8,
    committed_resource_count: u8,
    dispatched_request_count: u8,
    response_bytes: u64,
    response_byte_limit: u64,
    response_byte_limit_exceeded: bool,
    refresh_performed: bool,
    anonymous_fallback_performed: bool,
    continuous_authentication_established: bool,
    exploit_execution_performed: bool,
    impact_validation_performed: bool,
    #[serde(skip_serializing_if = "Option::is_none")]
    cookie_policy: Option<SuppliedSessionCookiePolicyAudit>,
    #[serde(skip_serializing_if = "Option::is_none")]
    cookie_lifecycle: Option<SuppliedSessionCookieLifecycleAudit>,
    #[serde(skip_serializing_if = "Option::is_none")]
    login: Option<SuppliedSessionLoginAudit>,
    #[serde(skip_serializing_if = "Option::is_none")]
    renewal: Option<SuppliedSessionRenewalAudit>,
    // V5-only state must not enlarge every legacy report's inline payload.
    #[serde(skip_serializing_if = "Option::is_none")]
    oauth_code: Option<Box<SuppliedSessionOAuthCodeAudit>>,
    #[serde(skip_serializing_if = "Option::is_none")]
    oauth_refresh: Option<Box<SuppliedSessionOAuthRefreshAudit>>,
    #[serde(skip_serializing_if = "Option::is_none")]
    oauth_authorization: Option<Box<SuppliedSessionOAuthAuthorizationAudit>>,
    #[serde(skip_serializing_if = "Option::is_none")]
    oauth_token_exchange: Option<Box<SuppliedSessionOAuthInitiatedTokenAudit>>,
}

/// Value-free record of the one explicit credential transition and its health gate.
#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
pub struct SuppliedSessionRenewalAudit {
    renewal_reference: String,
    after_resource_count: u8,
    attempt_count: u8,
    status: Option<u16>,
    body_state: SuppliedSessionBodyState,
    outcome: SuppliedSessionLoginSubmitOutcome,
    response_bytes: u64,
    applied_cookie_count: u8,
    initial_epoch: u8,
    final_epoch: u8,
    #[serde(skip_serializing_if = "Option::is_none")]
    health: Option<WebAssessmentSuppliedSessionCheckpointAudit>,
    #[serde(skip)]
    cookie_update: Option<SuppliedSessionResponseCookieUpdate>,
}

impl SuppliedSessionRenewalAudit {
    pub fn renewal_reference(&self) -> &str {
        &self.renewal_reference
    }
    pub const fn after_resource_count(&self) -> u8 {
        self.after_resource_count
    }
    pub const fn attempt_count(&self) -> u8 {
        self.attempt_count
    }
    pub const fn status(&self) -> Option<u16> {
        self.status
    }
    pub const fn body_state(&self) -> SuppliedSessionBodyState {
        self.body_state
    }
    pub const fn outcome(&self) -> SuppliedSessionLoginSubmitOutcome {
        self.outcome
    }
    pub const fn response_bytes(&self) -> u64 {
        self.response_bytes
    }
    pub const fn applied_cookie_count(&self) -> u8 {
        self.applied_cookie_count
    }
    pub const fn initial_epoch(&self) -> u8 {
        self.initial_epoch
    }
    pub const fn final_epoch(&self) -> u8 {
        self.final_epoch
    }
    pub fn health(&self) -> Option<&WebAssessmentSuppliedSessionCheckpointAudit> {
        self.health.as_ref()
    }
}

const fn legacy_credential_acquisition(value: &SuppliedSessionCredentialAcquisition) -> bool {
    matches!(
        value,
        SuppliedSessionCredentialAcquisition::SuppliedAuthorization
            | SuppliedSessionCredentialAcquisition::SuppliedCookieJar
    )
}

impl WebAssessmentSuppliedSessionAudit {
    pub fn oauth_authorization(&self) -> Option<&SuppliedSessionOAuthAuthorizationAudit> {
        self.oauth_authorization.as_deref()
    }
    pub fn oauth_token_exchange(&self) -> Option<&SuppliedSessionOAuthInitiatedTokenAudit> {
        self.oauth_token_exchange.as_deref()
    }
    pub fn oauth_refresh(&self) -> Option<&SuppliedSessionOAuthRefreshAudit> {
        self.oauth_refresh.as_deref()
    }
    pub fn oauth_code(&self) -> Option<&SuppliedSessionOAuthCodeAudit> {
        self.oauth_code.as_deref()
    }
    pub fn renewal(&self) -> Option<&SuppliedSessionRenewalAudit> {
        self.renewal.as_ref()
    }
    pub const fn schema(&self) -> &'static str {
        self.schema
    }
    pub const fn capability_id(&self) -> &'static str {
        self.capability_id
    }
    pub fn policy_reference(&self) -> &str {
        &self.policy_reference
    }
    pub fn application_reference(&self) -> &str {
        &self.application_reference
    }
    pub fn principal_reference(&self) -> &str {
        &self.principal_reference
    }
    /// Explicitly non-secret operator assertion, not authenticated identity truth.
    pub fn principal_alias(&self) -> &str {
        &self.principal_alias
    }
    pub const fn principal_assurance(&self) -> SuppliedSessionPrincipalAssurance {
        self.principal_assurance
    }
    pub const fn credential_mechanism(&self) -> SuppliedSessionCredentialMechanism {
        self.credential_mechanism
    }
    pub const fn credential_acquisition(&self) -> SuppliedSessionCredentialAcquisition {
        self.credential_acquisition
    }
    pub const fn health_oracle(&self) -> &SuppliedSessionHealthOracleAudit {
        &self.health_oracle
    }
    pub const fn outcome(&self) -> SuppliedSessionAuditOutcome {
        self.outcome
    }
    pub const fn coverage(&self) -> SuppliedSessionCoverage {
        self.coverage
    }
    pub fn checkpoints(&self) -> &[WebAssessmentSuppliedSessionCheckpointAudit] {
        &self.checkpoints
    }
    pub fn resources(&self) -> &[WebAssessmentSuppliedSessionResourceAudit] {
        &self.resources
    }
    pub const fn selected_resource_count(&self) -> u8 {
        self.selected_resource_count
    }
    pub const fn dispatched_resource_count(&self) -> u8 {
        self.dispatched_resource_count
    }
    pub const fn committed_resource_count(&self) -> u8 {
        self.committed_resource_count
    }
    pub const fn dispatched_request_count(&self) -> u8 {
        self.dispatched_request_count
    }
    pub const fn response_bytes(&self) -> u64 {
        self.response_bytes
    }
    /// Configured child byte budget. Actual transport accounting may exceed it
    /// by the broker's final delivered chunk and is never clamped in the audit.
    pub const fn response_byte_limit(&self) -> u64 {
        self.response_byte_limit
    }
    pub const fn response_byte_limit_exceeded(&self) -> bool {
        self.response_byte_limit_exceeded
    }
    pub const fn refresh_performed(&self) -> bool {
        self.refresh_performed
    }
    pub const fn anonymous_fallback_performed(&self) -> bool {
        self.anonymous_fallback_performed
    }
    pub const fn continuous_authentication_established(&self) -> bool {
        self.continuous_authentication_established
    }
    pub const fn exploit_execution_performed(&self) -> bool {
        self.exploit_execution_performed
    }
    pub const fn impact_validation_performed(&self) -> bool {
        self.impact_validation_performed
    }
    pub const fn cookie_policy(&self) -> Option<&SuppliedSessionCookiePolicyAudit> {
        self.cookie_policy.as_ref()
    }
    pub const fn cookie_lifecycle(&self) -> Option<&SuppliedSessionCookieLifecycleAudit> {
        self.cookie_lifecycle.as_ref()
    }
    pub const fn login(&self) -> Option<&SuppliedSessionLoginAudit> {
        self.login.as_ref()
    }
}

pub(super) struct SuppliedSessionRuntimeConfig {
    policy: SuppliedSessionPolicy,
    input: SuppliedSessionRuntimeInput,
    requests: HttpRequestBroker,
    login_page: Option<SuppliedSessionRequestDescriptor>,
    login_submit: Option<SuppliedSessionRequestDescriptor>,
    // These children are allocated only when V5 is selected. The broker and
    // descriptor retain the same owner and shared assessment allowance.
    oauth_code_requests: Option<Box<OAuthCodeRequestBroker>>,
    oauth_code_descriptor: Option<Box<OAuthCodeRequestDescriptor>>,
    oauth_refresh_descriptor: Option<Box<OAuthRefreshRequestDescriptor>>,
    health: SuppliedSessionRequestDescriptor,
    resources: Vec<(SuppliedSessionRequestDescriptor, String)>,
}

impl SuppliedSessionRuntimeConfig {
    pub(super) fn new<C>(
        policy: SuppliedSessionPolicy,
        credential: C,
        authority: &SharedWebRuntimeAuthority,
    ) -> Result<Self, ()>
    where
        C: Into<SuppliedSessionRuntimeInput>,
    {
        let input = credential.into();
        if !input.matches_policy(&policy) {
            return Err(());
        }
        let requests = authority
            .requests()
            .isolated_supplied_session()
            .map_err(|_| ())?;
        let health = SuppliedSessionRequestDescriptor::health(&policy);
        let (login_page, login_submit) = if policy.version() == SuppliedSessionPolicyVersion::V3 {
            (
                Some(SuppliedSessionRequestDescriptor::login_page(&policy).ok_or(())?),
                Some(SuppliedSessionRequestDescriptor::login_submit(&policy).ok_or(())?),
            )
        } else {
            (None, None)
        };
        let resources = policy
            .execution_resources()
            .map(|(target, reference)| {
                SuppliedSessionRequestDescriptor::resource(&policy, target, reference)
                    .map(|descriptor| (descriptor, reference.to_owned()))
            })
            .collect::<Option<Vec<_>>>()
            .ok_or(())?;
        let (oauth_code_requests, oauth_code_descriptor) = if matches!(
            policy.version(),
            SuppliedSessionPolicyVersion::V5
                | SuppliedSessionPolicyVersion::V6
                | SuppliedSessionPolicyVersion::V7
        ) {
            (
                Some(Box::new(authority.mint_oauth_code_broker(&policy)?)),
                Some(Box::new(
                    OAuthCodeRequestDescriptor::from_policy(&policy).ok_or(())?,
                )),
            )
        } else {
            (None, None)
        };
        let oauth_refresh_descriptor = if policy.version() == SuppliedSessionPolicyVersion::V6 {
            Some(Box::new(
                OAuthRefreshRequestDescriptor::from_policy(&policy).ok_or(())?,
            ))
        } else {
            None
        };
        Ok(Self {
            policy,
            input,
            requests,
            login_page,
            login_submit,
            oauth_code_requests,
            oauth_code_descriptor,
            oauth_refresh_descriptor,
            health,
            resources,
        })
    }

    pub(super) async fn execute(
        self,
        authority: &SharedWebRuntimeAuthority,
        resource_observer: Option<&dyn SuppliedSessionCommittedResourceObserver>,
    ) -> WebAssessmentSuppliedSessionAudit {
        let Self {
            policy,
            input,
            requests,
            login_page,
            login_submit,
            oauth_code_requests,
            oauth_code_descriptor,
            oauth_refresh_descriptor,
            health,
            resources,
        } = self;
        let selected_resource_count = u8::try_from(resources.len()).unwrap_or(u8::MAX);
        let timing = authority.start();
        let local_deadline = tokio::time::Instant::now()
            .checked_add(Duration::from_millis(policy.max_wall_time_ms()));
        let mut session_deadline = earliest_deadline(timing.deadline(), local_deadline);
        let mut deadline = session_deadline;
        let mut state = ExecutionState::new(&policy, selected_resource_count);
        if resource_observer.is_some_and(|observer| observer.begin(&policy, &resources).is_err()) {
            resource_observer.expect("observer remains present").fail();
        }

        let mut oauth_receipt = None;
        let mut oauth_refresh_token = None;
        let mut oauth_refresh_receipt = None;
        let mut credential = match input {
            SuppliedSessionRuntimeInput::Ready(credential) => credential,
            SuppliedSessionRuntimeInput::OAuthAuthorization(output) => {
                let mint = match authority.mint_oauth_authorization_callback(&policy) {
                    Ok(mint) => mint,
                    Err(()) => {
                        state.outcome = SuppliedSessionAuditOutcome::OAuthCodeExchangeUnavailable;
                        state.add_not_dispatched(&resources);
                        return state.finish(policy);
                    },
                };
                let (authorization_audit, permit) = boxed_dispatch_execution(|| {
                    oauth_authorization::receive(authority, mint, &policy, *output)
                })
                .await;
                let authorization_outcome = authorization_audit.outcome();
                state.oauth_authorization = Some(Box::new(authorization_audit));
                let permit = match permit {
                    Ok(permit) => permit,
                    Err(()) => {
                        state.outcome = match authorization_outcome {
                            SuppliedSessionOAuthAuthorizationOutcome::Cancelled => {
                                SuppliedSessionAuditOutcome::Cancelled
                            },
                            SuppliedSessionOAuthAuthorizationOutcome::RuntimeLimit => {
                                SuppliedSessionAuditOutcome::RuntimeLimit
                            },
                            _ => SuppliedSessionAuditOutcome::OAuthCodeExchangeUnavailable,
                        };
                        state.add_not_dispatched(&resources);
                        return state.finish(policy);
                    },
                };
                // Only the V7 pre-session wait is separate. The existing parent
                // clock is never reset or extended; its smaller deadline wins.
                session_deadline = earliest_deadline(timing.deadline(), Some(permit.deadline()));
                deadline = session_deadline;
                let (Some(idp_requests), Some(descriptor)) =
                    (oauth_code_requests.as_ref(), oauth_code_descriptor.as_ref())
                else {
                    state.outcome = SuppliedSessionAuditOutcome::OAuthCodeExchangeUnavailable;
                    state.add_not_dispatched(&resources);
                    return state.finish(policy);
                };
                let (audit, acquired) = boxed_dispatch_execution(|| {
                    oauth_code::acquire_authorized(
                        OAuthCodeAcquisitionContext {
                            authority,
                            requests: idp_requests,
                            descriptor,
                            policy: &policy,
                            deadline,
                            budget: state.dispatch_budget(),
                        },
                        permit,
                    )
                })
                .await;
                state.response_bytes = state.response_bytes.saturating_add(audit.response_bytes());
                state.oauth_code = Some(Box::new(audit));
                match acquired {
                    Ok(acquired) => {
                        deadline = earliest_deadline(
                            session_deadline,
                            tokio::time::Instant::now().checked_add(acquired.declared_lifetime),
                        );
                        oauth_receipt = Some(Box::new(acquired.receipt));
                        acquired.credential
                    },
                    Err(outcome) => {
                        state.outcome = outcome;
                        state.add_not_dispatched(&resources);
                        return state.finish(policy);
                    },
                }
            },
            SuppliedSessionRuntimeInput::FormLogin(form_credential) => {
                let (Some(login_page), Some(login_submit)) =
                    (login_page.as_ref(), login_submit.as_ref())
                else {
                    state.outcome = SuppliedSessionAuditOutcome::LoginFormUnavailable;
                    state.add_not_dispatched(&resources);
                    return state.finish(policy);
                };
                state.begin_login(&policy, login_page);
                let acquisition_context = LoginDispatchContext {
                    authority,
                    requests: &requests,
                    policy: &policy,
                    deadline,
                };
                let login_page_result =
                    dispatch_login_page(&acquisition_context, login_page, state.dispatch_budget())
                        .await;
                let csrf = match state.record_login_page(login_page_result, &policy) {
                    Ok(csrf) => csrf,
                    Err(outcome) => {
                        state.outcome = outcome;
                        state.add_not_dispatched(&resources);
                        return state.finish(policy);
                    },
                };
                let body = match form_credential.compose_form_body(&policy, csrf.as_str()) {
                    Ok(body) => body,
                    Err(_) => {
                        state.mark_login_form_body_invalid();
                        state.outcome = SuppliedSessionAuditOutcome::LoginFormUnavailable;
                        state.add_not_dispatched(&resources);
                        return state.finish(policy);
                    },
                };
                let login_submit_result = dispatch_login_submit(
                    &acquisition_context,
                    login_submit,
                    &body,
                    state.dispatch_budget(),
                )
                .await;
                match state.record_login_submit(login_submit_result, &policy) {
                    Ok(credential) => credential,
                    Err(outcome) => {
                        state.outcome = outcome;
                        state.add_not_dispatched(&resources);
                        return state.finish(policy);
                    },
                }
            },
            SuppliedSessionRuntimeInput::OAuthCode(grant) => {
                let (Some(idp_requests), Some(descriptor)) =
                    (oauth_code_requests.as_ref(), oauth_code_descriptor.as_ref())
                else {
                    state.outcome = SuppliedSessionAuditOutcome::OAuthCodeExchangeUnavailable;
                    state.add_not_dispatched(&resources);
                    return state.finish(policy);
                };
                // Keep this new child's construction frame out of legacy
                // session polls; it is still driven by this one parent.
                let (audit, acquired) = boxed_dispatch_execution(|| {
                    oauth_code::acquire(
                        OAuthCodeAcquisitionContext {
                            authority,
                            requests: idp_requests,
                            descriptor,
                            policy: &policy,
                            deadline,
                            budget: state.dispatch_budget(),
                        },
                        &grant,
                    )
                })
                .await;
                state.response_bytes = state.response_bytes.saturating_add(audit.response_bytes());
                state.oauth_code = Some(Box::new(audit));
                match acquired {
                    Ok(acquired) => {
                        // Provider-declared lifetime narrows use; reaching it
                        // is not an observed server-side expiration decision.
                        deadline = earliest_deadline(
                            session_deadline,
                            tokio::time::Instant::now().checked_add(acquired.declared_lifetime),
                        );
                        oauth_receipt = Some(Box::new(acquired.receipt));
                        oauth_refresh_token = acquired.refresh_token.map(Box::new);
                        acquired.credential
                    },
                    Err(outcome) => {
                        state.outcome = outcome;
                        state.add_not_dispatched(&resources);
                        return state.finish(policy);
                    },
                }
            },
        };
        let dispatch_context = DispatchContext {
            authority,
            requests: &requests,
            credential: &credential,
            credential_acquisition: oauth_receipt.as_deref(),
            credential_renewal: oauth_refresh_receipt.as_deref(),
            credential_epoch: state.epoch,
            policy: &policy,
            deadline,
        };
        let resource_commit_context = ResourceCommitContext {
            policy: &policy,
            knowledge: authority.knowledge(),
            observer: resource_observer,
        };

        let startup = dispatch(
            &dispatch_context,
            &health,
            state.dispatch_budget(),
            DecisionActionOrigin::Bootstrap,
            SuppliedSessionRequestPurpose::Health,
        )
        .await;
        match state.record_health(
            startup,
            &health,
            SuppliedSessionHealthCheckpointPhase::Startup,
            0,
            &policy,
            authority.knowledge(),
        ) {
            Continue::Yes => state.mark_login_authenticated(),
            Continue::No(outcome) => {
                state.outcome = outcome;
                state.add_not_dispatched(&resources);
                return state.finish(policy);
            },
        }

        for (index, (descriptor, reference)) in resources.iter().enumerate() {
            let dispatch_context = DispatchContext {
                authority,
                requests: &requests,
                credential: &credential,
                credential_acquisition: oauth_receipt.as_deref(),
                credential_renewal: oauth_refresh_receipt.as_deref(),
                credential_epoch: state.epoch,
                policy: &policy,
                deadline,
            };
            let sequence = u8::try_from(index).unwrap_or(u8::MAX);
            let resource = dispatch(
                &dispatch_context,
                descriptor,
                state.dispatch_budget(),
                DecisionActionOrigin::Planned,
                SuppliedSessionRequestPurpose::Resource,
            )
            .await;
            let staged = match state.record_resource(
                sequence,
                descriptor,
                reference,
                resource,
                resource_commit_context,
            ) {
                ResourceContinuation::AwaitingHealth(staged) => staged,
                ResourceContinuation::No(outcome) => {
                    state.outcome = outcome;
                    state.add_not_dispatched(&resources[index + 1..]);
                    return state.finish(policy);
                },
            };

            let phase = if index + 1 == resources.len() {
                SuppliedSessionHealthCheckpointPhase::Terminal
            } else {
                SuppliedSessionHealthCheckpointPhase::SubjectBoundary
            };
            let health_result = dispatch(
                &dispatch_context,
                &health,
                state.dispatch_budget_with_pending_resource(staged),
                DecisionActionOrigin::Planned,
                SuppliedSessionRequestPurpose::Health,
            )
            .await;
            let after_subject_count = u8::try_from(index + 1).unwrap_or(u8::MAX);
            match state.record_health(
                health_result,
                &health,
                phase,
                after_subject_count,
                &policy,
                authority.knowledge(),
            ) {
                Continue::Yes => {
                    if let Continue::No(outcome) = state.record_health_qualified_resource(
                        sequence,
                        descriptor,
                        reference,
                        staged,
                        resource_commit_context,
                    ) {
                        state.outcome = outcome;
                        state.add_not_dispatched(&resources[index + 1..]);
                        return state.finish(policy);
                    }
                },
                Continue::No(outcome) => {
                    state.record_health_unqualified_resource(
                        sequence,
                        descriptor,
                        reference,
                        staged,
                        &policy,
                        authority.knowledge(),
                    );
                    if let Some(observer) = resource_observer {
                        observer.discard_response(sequence);
                    }
                    state.outcome = outcome;
                    state.add_not_dispatched(&resources[index + 1..]);
                    return state.finish(policy);
                },
            }
            if policy.renewal_after_resource_count() == Some(after_subject_count) {
                let renewal = SuppliedSessionRequestDescriptor::renewal(&policy)
                    .expect("V4 policy owns the validated renewal descriptor");
                let result = dispatch(
                    &dispatch_context,
                    &renewal,
                    state.dispatch_budget(),
                    DecisionActionOrigin::Planned,
                    SuppliedSessionRequestPurpose::Renewal,
                )
                .await;
                let replacement = match state.record_renewal(result, &renewal, &policy) {
                    Ok(replacement) => replacement,
                    Err(outcome) => {
                        state.outcome = outcome;
                        state.add_not_dispatched(&resources[index + 1..]);
                        return state.finish(policy);
                    },
                };
                credential = replacement;
                let dispatch_context = DispatchContext {
                    authority,
                    requests: &requests,
                    credential: &credential,
                    credential_acquisition: oauth_receipt.as_deref(),
                    credential_renewal: oauth_refresh_receipt.as_deref(),
                    credential_epoch: state.epoch,
                    policy: &policy,
                    deadline,
                };
                let result = dispatch(
                    &dispatch_context,
                    &health,
                    state.dispatch_budget(),
                    DecisionActionOrigin::Planned,
                    SuppliedSessionRequestPurpose::Health,
                )
                .await;
                let previous_checkpoint_count = state.checkpoints.len();
                let continued = state.record_health(
                    result,
                    &health,
                    SuppliedSessionHealthCheckpointPhase::Renewal,
                    after_subject_count,
                    &policy,
                    authority.knowledge(),
                );
                let renewal_health = (state.checkpoints.len() > previous_checkpoint_count)
                    .then(|| state.checkpoints.pop())
                    .flatten();
                state
                    .renewal
                    .as_mut()
                    .expect("renewal is initialized")
                    .health = renewal_health;
                if let Continue::No(outcome) = continued {
                    state.outcome = outcome;
                    state.add_not_dispatched(&resources[index + 1..]);
                    return state.finish(policy);
                }
            }
            if policy
                .oauth_refresh_policy()
                .is_some_and(|refresh| refresh.after_resource_count() == after_subject_count)
            {
                let (
                    Some(idp_requests),
                    Some(refresh_descriptor),
                    Some(code),
                    Some(old_refresh),
                    Some(resource),
                    Some(boundary_health),
                ) = (
                    oauth_code_requests.as_deref(),
                    oauth_refresh_descriptor.as_deref(),
                    oauth_receipt.as_deref(),
                    oauth_refresh_token.take(),
                    state.resources.last(),
                    state.checkpoints.last(),
                )
                else {
                    if let Some(audit) = state.oauth_refresh.as_mut() {
                        audit.context_unavailable();
                    }
                    state.outcome = SuppliedSessionAuditOutcome::OAuthRefreshUnavailable;
                    state.add_not_dispatched(&resources[index + 1..]);
                    return state.finish(policy);
                };
                let refresh_context = OAuthRefreshContext {
                    authority,
                    requests: idp_requests,
                    descriptor: refresh_descriptor,
                    policy: &policy,
                    code,
                    resource,
                    health: boundary_health,
                    // Renewal may replace the credential lifetime, never this
                    // immutable assessment/policy wall-time bound.
                    deadline: session_deadline,
                    budget: state.dispatch_budget(),
                };
                let (audit, acquired) = boxed_dispatch_execution(|| {
                    oauth_refresh::execute_refresh(refresh_context, &old_refresh)
                })
                .await;
                // This phase has been spent even on ambiguous failure. Never
                // retain the old refresh token for fallback or another attempt.
                drop(old_refresh);
                state.response_bytes = state.response_bytes.saturating_add(audit.response_bytes());
                state.oauth_refresh = Some(Box::new(audit));
                match acquired {
                    Ok(acquired) => {
                        credential = acquired.credential;
                        oauth_refresh_receipt = Some(Box::new(acquired.receipt));
                        state.epoch = 2;
                        deadline = earliest_deadline(
                            session_deadline,
                            tokio::time::Instant::now().checked_add(acquired.declared_lifetime),
                        );
                    },
                    Err(outcome) => {
                        state.outcome = outcome;
                        state.add_not_dispatched(&resources[index + 1..]);
                        return state.finish(policy);
                    },
                }
                let renewed_context = DispatchContext {
                    authority,
                    requests: &requests,
                    credential: &credential,
                    credential_acquisition: oauth_receipt.as_deref(),
                    credential_renewal: oauth_refresh_receipt.as_deref(),
                    credential_epoch: state.epoch,
                    policy: &policy,
                    deadline,
                };
                let result = dispatch(
                    &renewed_context,
                    &health,
                    state.dispatch_budget(),
                    DecisionActionOrigin::Planned,
                    SuppliedSessionRequestPurpose::Health,
                )
                .await;
                let previous_count = state.checkpoints.len();
                let continued = state.record_health(
                    result,
                    &health,
                    SuppliedSessionHealthCheckpointPhase::Renewal,
                    after_subject_count,
                    &policy,
                    authority.knowledge(),
                );
                if state.checkpoints.len() > previous_count {
                    if let Some(health) = state.checkpoints.pop() {
                        state
                            .oauth_refresh
                            .as_mut()
                            .expect("selected refresh audit")
                            .set_health(health);
                    }
                }
                if let Continue::No(outcome) = continued {
                    state.outcome = outcome;
                    state.add_not_dispatched(&resources[index + 1..]);
                    return state.finish(policy);
                }
            }
        }
        state.outcome = SuppliedSessionAuditOutcome::Complete;
        state.finish(policy)
    }

    /// Executes the first supplied-Authorization WebSocket integration as one
    /// fixed health window: startup health, one staged protected resource, one
    /// bounded WebSocket exchange, then terminal health. No cookie or login
    /// policy can enter this path and the credential is borrowed only at the
    /// handshake boundary.
    #[cfg(feature = "websocket-review")]
    pub(super) async fn execute_with_websocket(
        self,
        authority: &SharedWebRuntimeAuthority,
        websocket: &WebSocketReviewPolicy,
    ) -> (
        WebAssessmentSuppliedSessionAudit,
        WebAssessmentWebSocketReviewAudit,
    ) {
        let Self {
            policy,
            input,
            requests,
            login_page,
            login_submit,
            oauth_code_requests: _,
            oauth_code_descriptor: _,
            oauth_refresh_descriptor: _,
            health,
            resources,
        } = self;
        let selected_resource_count = u8::try_from(resources.len()).unwrap_or(u8::MAX);
        let timing = authority.start();
        let local_deadline = tokio::time::Instant::now()
            .checked_add(Duration::from_millis(policy.max_wall_time_ms()));
        let deadline = earliest_deadline(timing.deadline(), local_deadline);
        let mut state = ExecutionState::new(&policy, selected_resource_count);

        if policy.version() != SuppliedSessionPolicyVersion::V1
            || policy.credential_mechanism()
                != SuppliedSessionCredentialMechanism::AuthorizationHeader
            || policy.resource_count() != 1
            || login_page.is_some()
            || login_submit.is_some()
            || resources.len() != 1
        {
            state.outcome = SuppliedSessionAuditOutcome::ResourceUnavailable;
            state.add_not_dispatched(&resources);
            let websocket_audit = supplied_session_websocket_not_run(
                websocket,
                &policy,
                &state,
                WebSocketReviewFailureKind::ParentAuthorityUnavailable,
            );
            return (state.finish(policy), websocket_audit);
        }
        let credential = match input {
            SuppliedSessionRuntimeInput::Ready(SuppliedSessionCredential::Authorization(value)) => {
                SuppliedSessionCredential::Authorization(value)
            },
            SuppliedSessionRuntimeInput::Ready(SuppliedSessionCredential::SuppliedCookies(_))
            | SuppliedSessionRuntimeInput::FormLogin(_)
            | SuppliedSessionRuntimeInput::OAuthCode(_)
            | SuppliedSessionRuntimeInput::OAuthAuthorization(_) => {
                state.outcome = SuppliedSessionAuditOutcome::ResourceUnavailable;
                state.add_not_dispatched(&resources);
                let websocket_audit = supplied_session_websocket_not_run(
                    websocket,
                    &policy,
                    &state,
                    WebSocketReviewFailureKind::ParentAuthorityUnavailable,
                );
                return (state.finish(policy), websocket_audit);
            },
        };
        let dispatch_context = DispatchContext {
            authority,
            requests: &requests,
            credential: &credential,
            credential_acquisition: None,
            credential_renewal: None,
            credential_epoch: 1,
            policy: &policy,
            deadline,
        };
        let resource_commit_context = ResourceCommitContext {
            policy: &policy,
            knowledge: authority.knowledge(),
            observer: None,
        };

        let startup = dispatch(
            &dispatch_context,
            &health,
            state.dispatch_budget(),
            DecisionActionOrigin::Bootstrap,
            SuppliedSessionRequestPurpose::Health,
        )
        .await;
        match state.record_health(
            startup,
            &health,
            SuppliedSessionHealthCheckpointPhase::Startup,
            0,
            &policy,
            authority.knowledge(),
        ) {
            Continue::Yes => state.mark_login_authenticated(),
            Continue::No(outcome) => {
                state.outcome = outcome;
                state.add_not_dispatched(&resources);
                let websocket_audit = supplied_session_websocket_not_run(
                    websocket,
                    &policy,
                    &state,
                    WebSocketReviewFailureKind::ParentAuthorityUnavailable,
                );
                return (state.finish(policy), websocket_audit);
            },
        }
        let Some(startup_receipt) = state.checkpoints.last().and_then(|checkpoint| {
            CommittedSuppliedSessionHealthReceipt::from_checkpoint(
                &policy,
                checkpoint,
                SuppliedSessionHealthCheckpointPhase::Startup,
                0,
                authority.knowledge(),
            )
        }) else {
            state.outcome = SuppliedSessionAuditOutcome::ResourceUnavailable;
            state.add_not_dispatched(&resources);
            let websocket_audit = supplied_session_websocket_not_run(
                websocket,
                &policy,
                &state,
                WebSocketReviewFailureKind::ParentAuthorityUnavailable,
            );
            return (state.finish(policy), websocket_audit);
        };

        let (descriptor, reference) = &resources[0];
        let resource = dispatch(
            &dispatch_context,
            descriptor,
            state.dispatch_budget(),
            DecisionActionOrigin::Planned,
            SuppliedSessionRequestPurpose::Resource,
        )
        .await;
        let staged = match state.record_resource(
            0,
            descriptor,
            reference,
            resource,
            resource_commit_context,
        ) {
            ResourceContinuation::AwaitingHealth(staged) => staged,
            ResourceContinuation::No(outcome) => {
                state.outcome = outcome;
                let websocket_audit = supplied_session_websocket_not_run(
                    websocket,
                    &policy,
                    &state,
                    WebSocketReviewFailureKind::ParentAuthorityUnavailable,
                );
                return (state.finish(policy), websocket_audit);
            },
        };

        let authorization = credential
            .authorization()
            .expect("combined V1 credential was matched above");
        let permit = SuppliedSessionWebSocketPermit::new(
            &policy,
            authorization,
            websocket,
            deadline,
            startup_receipt,
        );
        let mut websocket_audit =
            execute_supplied_session_websocket_review(authority, websocket, &permit).await;

        let terminal = dispatch(
            &dispatch_context,
            &health,
            state.dispatch_budget_with_pending_resource(staged),
            DecisionActionOrigin::Planned,
            SuppliedSessionRequestPurpose::Health,
        )
        .await;
        let health_qualification = match state.record_health(
            terminal,
            &health,
            SuppliedSessionHealthCheckpointPhase::Terminal,
            1,
            &policy,
            authority.knowledge(),
        ) {
            Continue::Yes => {
                let terminal_receipt = state.checkpoints.last().and_then(|checkpoint| {
                    CommittedSuppliedSessionHealthReceipt::from_checkpoint(
                        &policy,
                        checkpoint,
                        SuppliedSessionHealthCheckpointPhase::Terminal,
                        1,
                        authority.knowledge(),
                    )
                });
                if terminal_receipt.is_none() {
                    state.record_health_unqualified_resource(
                        0,
                        descriptor,
                        reference,
                        staged,
                        &policy,
                        authority.knowledge(),
                    );
                    state.outcome = SuppliedSessionAuditOutcome::ResourceUnavailable;
                    WebSocketSuppliedSessionQualification::ContextUnqualified
                } else if let Continue::No(outcome) = state.record_health_qualified_resource(
                    0,
                    descriptor,
                    reference,
                    staged,
                    resource_commit_context,
                ) {
                    state.outcome = outcome;
                    WebSocketSuppliedSessionQualification::ContextQualified
                } else {
                    state.outcome = SuppliedSessionAuditOutcome::Complete;
                    WebSocketSuppliedSessionQualification::ContextQualified
                }
            },
            Continue::No(outcome) => {
                state.record_health_unqualified_resource(
                    0,
                    descriptor,
                    reference,
                    staged,
                    &policy,
                    authority.knowledge(),
                );
                state.outcome = outcome;
                WebSocketSuppliedSessionQualification::ContextUnqualified
            },
        };
        let qualification = if websocket_audit.request_admitted_count() == 0 {
            WebSocketSuppliedSessionQualification::NotEstablished
        } else {
            health_qualification
        };
        websocket_audit.bind_supplied_session_context(supplied_session_websocket_context(
            &policy,
            &state,
            qualification,
        ));
        debug_assert!(websocket_audit.is_consistent());
        (state.finish(policy), websocket_audit)
    }
}

#[cfg(feature = "websocket-review")]
fn supplied_session_websocket_not_run(
    websocket: &WebSocketReviewPolicy,
    policy: &SuppliedSessionPolicy,
    state: &ExecutionState,
    failure: WebSocketReviewFailureKind,
) -> WebAssessmentWebSocketReviewAudit {
    let mut audit = websocket_review_not_run(websocket, failure);
    audit.bind_supplied_session_context(supplied_session_websocket_context(
        policy,
        state,
        WebSocketSuppliedSessionQualification::NotEstablished,
    ));
    debug_assert!(audit.is_consistent());
    audit
}

#[cfg(feature = "websocket-review")]
fn supplied_session_websocket_context(
    policy: &SuppliedSessionPolicy,
    state: &ExecutionState,
    qualification: WebSocketSuppliedSessionQualification,
) -> WebSocketSuppliedSessionContextAudit {
    let health = |phase| {
        state
            .checkpoints
            .iter()
            .find(|checkpoint| checkpoint.phase() == phase)
            .map(|checkpoint| {
                WebSocketSuppliedSessionHealthAudit::new(
                    health_outcome_token(checkpoint.outcome()),
                    checkpoint.evidence_reference(),
                )
            })
    };
    WebSocketSuppliedSessionContextAudit::new(
        policy.policy_reference(),
        policy.application_reference(),
        policy.principal_reference(),
        policy.principal_alias(),
        health(SuppliedSessionHealthCheckpointPhase::Startup),
        health(SuppliedSessionHealthCheckpointPhase::Terminal),
        qualification,
    )
}

struct ExecutionState {
    checkpoints: Vec<WebAssessmentSuppliedSessionCheckpointAudit>,
    resources: Vec<WebAssessmentSuppliedSessionResourceAudit>,
    login: Option<SuppliedSessionLoginAudit>,
    outcome: SuppliedSessionAuditOutcome,
    selected_resource_count: u8,
    response_bytes: u64,
    epoch: u8,
    renewal: Option<SuppliedSessionRenewalAudit>,
    oauth_code: Option<Box<SuppliedSessionOAuthCodeAudit>>,
    oauth_refresh: Option<Box<SuppliedSessionOAuthRefreshAudit>>,
    oauth_authorization: Option<Box<SuppliedSessionOAuthAuthorizationAudit>>,
}

#[derive(Clone, Copy)]
struct ResourceCommitContext<'a> {
    policy: &'a SuppliedSessionPolicy,
    knowledge: &'a KnowledgeBase,
    observer: Option<&'a dyn SuppliedSessionCommittedResourceObserver>,
}

impl ExecutionState {
    fn new(policy: &SuppliedSessionPolicy, selected_resource_count: u8) -> Self {
        debug_assert!(policy.resource_count() <= MAX_SUPPLIED_SESSION_RESOURCES);
        Self {
            checkpoints: Vec::with_capacity(MAX_SUPPLIED_SESSION_CHECKPOINTS),
            resources: Vec::with_capacity(MAX_SUPPLIED_SESSION_RESOURCES),
            login: None,
            outcome: SuppliedSessionAuditOutcome::RuntimeLimit,
            selected_resource_count,
            response_bytes: 0,
            epoch: 1,
            oauth_code: SuppliedSessionOAuthCodeAudit::selected(policy).map(Box::new),
            oauth_refresh: SuppliedSessionOAuthRefreshAudit::selected(policy).map(Box::new),
            oauth_authorization: SuppliedSessionOAuthAuthorizationAudit::selected(policy)
                .map(Box::new),
            renewal: policy
                .renewal_after_resource_count()
                .map(|after_resource_count| SuppliedSessionRenewalAudit {
                    renewal_reference: SuppliedSessionRequestDescriptor::renewal(policy)
                        .expect("validated V4 descriptor")
                        .target_reference()
                        .to_owned(),
                    after_resource_count,
                    attempt_count: 0,
                    status: None,
                    body_state: SuppliedSessionBodyState::Unavailable,
                    outcome: SuppliedSessionLoginSubmitOutcome::NotDispatched,
                    response_bytes: 0,
                    applied_cookie_count: 0,
                    initial_epoch: 1,
                    final_epoch: 1,
                    health: None,
                    cookie_update: None,
                }),
        }
    }

    fn begin_login(
        &mut self,
        policy: &SuppliedSessionPolicy,
        descriptor: &SuppliedSessionRequestDescriptor,
    ) {
        debug_assert_eq!(policy.version(), SuppliedSessionPolicyVersion::V3);
        debug_assert_eq!(
            descriptor.purpose(),
            SuppliedSessionRequestPurpose::LoginPage
        );
        self.login = Some(SuppliedSessionLoginAudit {
            login_reference: descriptor.target_reference().to_owned(),
            max_attempts: policy.max_login_attempts().unwrap_or(0),
            attempt_count: 0,
            page_dispatched: false,
            page_status: None,
            page_body_state: SuppliedSessionBodyState::Unavailable,
            form_outcome: SuppliedSessionLoginFormOutcome::NotEvaluated,
            form_error_code: None,
            submit_dispatched: false,
            submit_status: None,
            submit_body_state: SuppliedSessionBodyState::Unavailable,
            submit_outcome: SuppliedSessionLoginSubmitOutcome::NotDispatched,
            acquired_cookie_count: 0,
            response_bytes: 0,
            initial_epoch: 0,
            final_epoch: 0,
            pre_session_cookie_applied: false,
        });
    }

    fn record_login_page(
        &mut self,
        dispatch: DispatchResult,
        policy: &SuppliedSessionPolicy,
    ) -> Result<SuppliedSessionLoginCsrfToken, SuppliedSessionAuditOutcome> {
        let login = self
            .login
            .as_mut()
            .expect("V3 login state is initialized before page dispatch");
        match dispatch {
            DispatchResult::Response {
                response,
                bytes,
                exact_target,
                cookie_update: _,
            } => {
                login.page_dispatched = true;
                login.page_status = Some(response.status());
                login.page_body_state = if response.body_complete() {
                    SuppliedSessionBodyState::Complete
                } else {
                    SuppliedSessionBodyState::Incomplete
                };
                login.response_bytes = login.response_bytes.saturating_add(bytes);
                self.response_bytes = self.response_bytes.saturating_add(bytes);
                if !exact_target || response.supplied_session_has_set_cookie_fields() {
                    login.form_outcome = SuppliedSessionLoginFormOutcome::IneligibleResponse;
                    login.form_error_code = Some(if exact_target {
                        "pre_session_cookie_unsupported"
                    } else {
                        "inexact_final_target"
                    });
                    return Err(SuppliedSessionAuditOutcome::LoginFormUnavailable);
                }
                match extract_supplied_session_login_csrf(&response, policy) {
                    Ok(token) => {
                        login.form_outcome = SuppliedSessionLoginFormOutcome::Matched;
                        Ok(token)
                    },
                    Err(error) => {
                        login.form_outcome = login_form_outcome(error);
                        login.form_error_code = Some(error.as_str());
                        Err(SuppliedSessionAuditOutcome::LoginFormUnavailable)
                    },
                }
            },
            DispatchResult::Transport { bytes, dispatched } => {
                login.page_dispatched = dispatched;
                login.form_outcome = SuppliedSessionLoginFormOutcome::TransportFailed;
                login.form_error_code = Some("transport_failed");
                login.response_bytes = login.response_bytes.saturating_add(bytes);
                self.response_bytes = self.response_bytes.saturating_add(bytes);
                Err(SuppliedSessionAuditOutcome::LoginFormUnavailable)
            },
            DispatchResult::RuntimeLimit { bytes, dispatched } => {
                login.page_dispatched = dispatched;
                login.form_outcome = SuppliedSessionLoginFormOutcome::RuntimeLimit;
                login.form_error_code = Some("runtime_limit");
                login.response_bytes = login.response_bytes.saturating_add(bytes);
                self.response_bytes = self.response_bytes.saturating_add(bytes);
                Err(SuppliedSessionAuditOutcome::RuntimeLimit)
            },
            DispatchResult::Cancelled { bytes, dispatched } => {
                login.page_dispatched = dispatched;
                login.form_outcome = SuppliedSessionLoginFormOutcome::Cancelled;
                login.form_error_code = Some("cancelled");
                login.response_bytes = login.response_bytes.saturating_add(bytes);
                self.response_bytes = self.response_bytes.saturating_add(bytes);
                Err(SuppliedSessionAuditOutcome::Cancelled)
            },
            DispatchResult::InvalidDescriptor => {
                login.form_outcome = SuppliedSessionLoginFormOutcome::Invalid;
                login.form_error_code = Some("invalid_descriptor");
                Err(SuppliedSessionAuditOutcome::LoginFormUnavailable)
            },
        }
    }

    fn mark_login_form_body_invalid(&mut self) {
        if let Some(login) = self.login.as_mut() {
            login.form_outcome = SuppliedSessionLoginFormOutcome::Invalid;
            login.form_error_code = Some("invalid_form_body");
        }
    }

    fn record_login_submit(
        &mut self,
        dispatch: DispatchResult,
        policy: &SuppliedSessionPolicy,
    ) -> Result<SuppliedSessionCredential, SuppliedSessionAuditOutcome> {
        let login = self
            .login
            .as_mut()
            .expect("V3 login state is initialized before submit dispatch");
        match dispatch {
            DispatchResult::Response {
                response,
                bytes,
                exact_target,
                cookie_update: _,
            } => {
                login.submit_dispatched = true;
                login.attempt_count = 1;
                login.submit_status = Some(response.status());
                login.submit_body_state = if response.body_complete() {
                    SuppliedSessionBodyState::Complete
                } else {
                    SuppliedSessionBodyState::Incomplete
                };
                login.response_bytes = login.response_bytes.saturating_add(bytes);
                self.response_bytes = self.response_bytes.saturating_add(bytes);
                if !exact_target || (300..400).contains(&response.status()) {
                    login.submit_outcome = SuppliedSessionLoginSubmitOutcome::RedirectRefused;
                    return Err(SuppliedSessionAuditOutcome::LoginSubmitUnavailable);
                }
                if !response.body_complete() {
                    login.submit_outcome = SuppliedSessionLoginSubmitOutcome::Incomplete;
                    return Err(SuppliedSessionAuditOutcome::LoginSubmitUnavailable);
                }
                if response.status() != 200 {
                    login.submit_outcome = SuppliedSessionLoginSubmitOutcome::HttpError;
                    return Err(SuppliedSessionAuditOutcome::LoginSubmitUnavailable);
                }
                login.submit_outcome = SuppliedSessionLoginSubmitOutcome::CookieUnavailable;
                let now = unix_time_seconds()
                    .ok_or(SuppliedSessionAuditOutcome::LoginCookieUnavailable)?;
                let cookies = response
                    .supplied_session_form_login_cookies(policy, now)
                    .map_err(|_| SuppliedSessionAuditOutcome::LoginCookieUnavailable)?;
                login.acquired_cookie_count =
                    u8::try_from(cookies.cookie_count()).unwrap_or(u8::MAX);
                login.submit_outcome = SuppliedSessionLoginSubmitOutcome::CookieAcquired;
                Ok(SuppliedSessionCredential::SuppliedCookies(cookies))
            },
            DispatchResult::Transport { bytes, dispatched } => {
                login.submit_dispatched = dispatched;
                login.attempt_count = u8::from(dispatched);
                login.submit_outcome = SuppliedSessionLoginSubmitOutcome::TransportFailed;
                login.response_bytes = login.response_bytes.saturating_add(bytes);
                self.response_bytes = self.response_bytes.saturating_add(bytes);
                Err(SuppliedSessionAuditOutcome::LoginSubmitUnavailable)
            },
            DispatchResult::RuntimeLimit { bytes, dispatched } => {
                login.submit_dispatched = dispatched;
                login.attempt_count = u8::from(dispatched);
                login.submit_outcome = SuppliedSessionLoginSubmitOutcome::RuntimeLimit;
                login.response_bytes = login.response_bytes.saturating_add(bytes);
                self.response_bytes = self.response_bytes.saturating_add(bytes);
                Err(SuppliedSessionAuditOutcome::RuntimeLimit)
            },
            DispatchResult::Cancelled { bytes, dispatched } => {
                login.submit_dispatched = dispatched;
                login.attempt_count = u8::from(dispatched);
                login.submit_outcome = SuppliedSessionLoginSubmitOutcome::Cancelled;
                login.response_bytes = login.response_bytes.saturating_add(bytes);
                self.response_bytes = self.response_bytes.saturating_add(bytes);
                Err(SuppliedSessionAuditOutcome::Cancelled)
            },
            DispatchResult::InvalidDescriptor => {
                login.submit_outcome = SuppliedSessionLoginSubmitOutcome::NotDispatched;
                Err(SuppliedSessionAuditOutcome::LoginSubmitUnavailable)
            },
        }
    }

    fn mark_login_authenticated(&mut self) {
        if let Some(login) = self.login.as_mut() {
            login.final_epoch = 1;
        }
    }

    fn record_renewal(
        &mut self,
        dispatch: DispatchResult,
        descriptor: &SuppliedSessionRequestDescriptor,
        policy: &SuppliedSessionPolicy,
    ) -> Result<SuppliedSessionCredential, SuppliedSessionAuditOutcome> {
        let renewal = self
            .renewal
            .as_mut()
            .ok_or(SuppliedSessionAuditOutcome::RenewalUnavailable)?;
        if renewal.attempt_count != 0 || !descriptor.validate_against(policy) {
            return Err(SuppliedSessionAuditOutcome::RenewalUnavailable);
        }
        let (bytes, dispatched, outcome) = match dispatch {
            DispatchResult::Response {
                response,
                bytes,
                exact_target,
                cookie_update,
            } => {
                renewal.attempt_count = 1;
                renewal.response_bytes = bytes;
                renewal.status = Some(response.status());
                renewal.body_state = if response.body_complete() {
                    SuppliedSessionBodyState::Complete
                } else {
                    SuppliedSessionBodyState::Incomplete
                };
                renewal.cookie_update = cookie_update;
                renewal.outcome = if (300..400).contains(&response.status()) {
                    SuppliedSessionLoginSubmitOutcome::RedirectRefused
                } else if !response.body_complete() {
                    SuppliedSessionLoginSubmitOutcome::Incomplete
                } else if response.status() != 200 {
                    SuppliedSessionLoginSubmitOutcome::HttpError
                } else {
                    SuppliedSessionLoginSubmitOutcome::CookieUnavailable
                };
                self.response_bytes = self.response_bytes.saturating_add(bytes);
                if !exact_target
                    || !cookie_update.is_some_and(|update| {
                        update.kind == SuppliedSessionResponseCookieUpdateKind::Selected
                    })
                {
                    return Err(SuppliedSessionAuditOutcome::RenewalUnavailable);
                }
                let now =
                    unix_time_seconds().ok_or(SuppliedSessionAuditOutcome::RenewalUnavailable)?;
                let cookies = response
                    .supplied_session_renewal_cookies(policy, now)
                    .map_err(|_| SuppliedSessionAuditOutcome::RenewalUnavailable)?;
                renewal.applied_cookie_count =
                    u8::try_from(cookies.cookie_count()).unwrap_or(u8::MAX);
                renewal.outcome = SuppliedSessionLoginSubmitOutcome::CookieAcquired;
                renewal.final_epoch = 2;
                self.epoch = 2;
                return Ok(SuppliedSessionCredential::SuppliedCookies(cookies));
            },
            DispatchResult::Transport { bytes, dispatched } => (
                bytes,
                dispatched,
                SuppliedSessionAuditOutcome::RenewalUnavailable,
            ),
            DispatchResult::RuntimeLimit { bytes, dispatched } => {
                (bytes, dispatched, SuppliedSessionAuditOutcome::RuntimeLimit)
            },
            DispatchResult::Cancelled { bytes, dispatched } => {
                (bytes, dispatched, SuppliedSessionAuditOutcome::Cancelled)
            },
            DispatchResult::InvalidDescriptor => {
                (0, false, SuppliedSessionAuditOutcome::RenewalUnavailable)
            },
        };
        renewal.attempt_count = u8::from(dispatched);
        renewal.outcome = match outcome {
            SuppliedSessionAuditOutcome::RuntimeLimit => {
                SuppliedSessionLoginSubmitOutcome::RuntimeLimit
            },
            SuppliedSessionAuditOutcome::Cancelled => SuppliedSessionLoginSubmitOutcome::Cancelled,
            _ if dispatched => SuppliedSessionLoginSubmitOutcome::TransportFailed,
            _ => SuppliedSessionLoginSubmitOutcome::NotDispatched,
        };
        renewal.response_bytes = bytes;
        self.response_bytes = self.response_bytes.saturating_add(bytes);
        Err(outcome)
    }

    fn dispatched_request_count(&self) -> u8 {
        let dispatched_resources = self
            .resources
            .iter()
            .filter(|resource| resource.outcome != SuppliedSessionResourceOutcome::NotDispatched)
            .count();
        let login_requests = self.login.as_ref().map_or(0, |login| {
            u8::from(login.page_dispatched).saturating_add(u8::from(login.submit_dispatched))
        });
        u8::try_from(self.checkpoints.len())
            .unwrap_or(u8::MAX)
            .saturating_add(u8::try_from(dispatched_resources).unwrap_or(u8::MAX))
            .saturating_add(login_requests)
            .saturating_add(
                self.oauth_code
                    .as_ref()
                    .map_or(0, |audit| audit.request_admitted_count()),
            )
            .saturating_add(self.renewal.as_ref().map_or(0, |renewal| {
                renewal
                    .attempt_count
                    .saturating_add(u8::from(renewal.health.is_some()))
            }))
            .saturating_add(self.oauth_refresh.as_ref().map_or(0, |refresh| {
                refresh
                    .request_admitted_count()
                    .saturating_add(u8::from(refresh.health().is_some()))
            }))
    }

    fn dispatch_budget(&self) -> DispatchBudget {
        DispatchBudget {
            accounted_response_bytes: self.response_bytes,
            dispatched_requests: self.dispatched_request_count(),
        }
    }

    fn dispatch_budget_with_pending_resource(
        &self,
        staged: StagedSuppliedSessionResource,
    ) -> DispatchBudget {
        DispatchBudget {
            accounted_response_bytes: self.response_bytes.saturating_add(staged.response_bytes),
            dispatched_requests: self.dispatched_request_count().saturating_add(1),
        }
    }

    fn record_health(
        &mut self,
        dispatch: DispatchResult,
        descriptor: &SuppliedSessionRequestDescriptor,
        phase: SuppliedSessionHealthCheckpointPhase,
        after_subject_count: u8,
        policy: &SuppliedSessionPolicy,
        knowledge: &KnowledgeBase,
    ) -> Continue {
        let is_startup = phase == SuppliedSessionHealthCheckpointPhase::Startup;
        let sequence = u8::try_from(self.checkpoints.len()).unwrap_or(u8::MAX);
        let (record, stop) = match dispatch {
            DispatchResult::Response {
                response,
                bytes,
                exact_target,
                cookie_update,
            } => {
                let mut record = classify_health(
                    *response,
                    bytes,
                    exact_target,
                    cookie_update,
                    HealthCheckpointPosition {
                        sequence,
                        phase,
                        after_subject_count,
                    },
                    policy,
                );
                record.epoch = matches!(
                    policy.version(),
                    SuppliedSessionPolicyVersion::V4 | SuppliedSessionPolicyVersion::V6
                )
                .then_some(self.epoch);
                bind_health_evidence(
                    &mut record,
                    policy,
                    descriptor,
                    Some(exact_target),
                    knowledge,
                );
                let stop = cookie_update_stop_outcome(record.cookie_update)
                    .or_else(|| health_stop_outcome(record.outcome, is_startup));
                (Some(record), stop)
            },
            DispatchResult::Transport { bytes, dispatched } => {
                let record = dispatched.then(|| {
                    committed_health_unavailable(
                        policy,
                        descriptor,
                        sequence,
                        phase,
                        after_subject_count,
                        bytes,
                        knowledge,
                    )
                });
                (
                    record,
                    Some(SuppliedSessionAuditOutcome::ResourceUnavailable),
                )
            },
            DispatchResult::RuntimeLimit { bytes, dispatched } => {
                let record = dispatched.then(|| {
                    committed_health_unavailable(
                        policy,
                        descriptor,
                        sequence,
                        phase,
                        after_subject_count,
                        bytes,
                        knowledge,
                    )
                });
                (record, Some(SuppliedSessionAuditOutcome::RuntimeLimit))
            },
            DispatchResult::Cancelled { bytes, dispatched } => {
                let record = dispatched.then(|| {
                    committed_health_unavailable(
                        policy,
                        descriptor,
                        sequence,
                        phase,
                        after_subject_count,
                        bytes,
                        knowledge,
                    )
                });
                (record, Some(SuppliedSessionAuditOutcome::Cancelled))
            },
            DispatchResult::InvalidDescriptor => {
                (None, Some(SuppliedSessionAuditOutcome::ResourceUnavailable))
            },
        };
        if let Some(mut record) = record {
            if matches!(
                policy.version(),
                SuppliedSessionPolicyVersion::V4 | SuppliedSessionPolicyVersion::V6
            ) && record.epoch != Some(self.epoch)
            {
                record.epoch = Some(self.epoch);
                bind_health_evidence(&mut record, policy, descriptor, None, knowledge);
            }
            self.response_bytes = self.response_bytes.saturating_add(record.response_bytes);
            self.checkpoints.push(record);
        }
        stop.map_or(Continue::Yes, Continue::No)
    }

    fn record_resource(
        &mut self,
        sequence: u8,
        descriptor: &SuppliedSessionRequestDescriptor,
        reference: &str,
        dispatch: DispatchResult,
        context: ResourceCommitContext<'_>,
    ) -> ResourceContinuation {
        let (mut record, stop) = match dispatch {
            DispatchResult::Response {
                response,
                bytes,
                exact_target,
                cookie_update,
            } => {
                let mut staged =
                    stage_resource_response(&response, bytes, exact_target, cookie_update);
                staged.epoch = self.epoch;
                if let Some(outcome) = cookie_update_stop_outcome(staged.cookie_update) {
                    let record = commit_health_unqualified_resource(
                        sequence,
                        descriptor,
                        reference,
                        context.policy,
                        context.knowledge,
                        staged,
                        None,
                    );
                    self.response_bytes = self.response_bytes.saturating_add(record.response_bytes);
                    self.resources.push(record);
                    return ResourceContinuation::No(outcome);
                }
                if staged_resource_can_await_health(descriptor, reference, staged) {
                    if let Some(observer) = context.observer {
                        if observer
                            .stage_response(sequence, context.policy, descriptor, &response)
                            .is_err()
                        {
                            observer.fail();
                        }
                    }
                    return ResourceContinuation::AwaitingHealth(staged);
                }
                let record = commit_staged_resource(
                    sequence,
                    descriptor,
                    reference,
                    context.policy,
                    context.knowledge,
                    staged,
                    None,
                );
                let outcome = record.outcome;
                let stop = (outcome != SuppliedSessionResourceOutcome::Committed)
                    .then_some(SuppliedSessionAuditOutcome::ResourceUnavailable);
                (record, stop)
            },
            DispatchResult::Transport { bytes, dispatched } => {
                if !dispatched {
                    self.resources
                        .push(resource_not_dispatched(sequence, reference));
                    return ResourceContinuation::No(
                        SuppliedSessionAuditOutcome::ResourceUnavailable,
                    );
                }
                (
                    resource_transport_failure(sequence, reference, bytes),
                    Some(SuppliedSessionAuditOutcome::ResourceUnavailable),
                )
            },
            DispatchResult::RuntimeLimit { bytes, dispatched } => {
                if !dispatched {
                    self.resources
                        .push(resource_not_dispatched(sequence, reference));
                    return ResourceContinuation::No(SuppliedSessionAuditOutcome::RuntimeLimit);
                }
                (
                    resource_transport_failure(sequence, reference, bytes),
                    Some(SuppliedSessionAuditOutcome::RuntimeLimit),
                )
            },
            DispatchResult::Cancelled { bytes, dispatched } => {
                if !dispatched {
                    self.resources
                        .push(resource_not_dispatched(sequence, reference));
                    return ResourceContinuation::No(SuppliedSessionAuditOutcome::Cancelled);
                }
                (
                    resource_transport_failure(sequence, reference, bytes),
                    Some(SuppliedSessionAuditOutcome::Cancelled),
                )
            },
            DispatchResult::InvalidDescriptor => {
                self.resources
                    .push(resource_not_dispatched(sequence, reference));
                return ResourceContinuation::No(SuppliedSessionAuditOutcome::ResourceUnavailable);
            },
        };
        if context.policy.version() == SuppliedSessionPolicyVersion::V6 {
            record.epoch = self.epoch;
        }
        self.response_bytes = self.response_bytes.saturating_add(record.response_bytes);
        self.resources.push(record);
        ResourceContinuation::No(stop.unwrap_or(SuppliedSessionAuditOutcome::ResourceUnavailable))
    }

    fn record_health_qualified_resource(
        &mut self,
        sequence: u8,
        descriptor: &SuppliedSessionRequestDescriptor,
        reference: &str,
        staged: StagedSuppliedSessionResource,
        context: ResourceCommitContext<'_>,
    ) -> Continue {
        let qualifying_checkpoint = self.checkpoints.last().and_then(|checkpoint| {
            (checkpoint.outcome == SuppliedSessionHealthOutcome::Healthy
                && checkpoint.after_subject_count == sequence.saturating_add(1))
            .then_some(checkpoint.evidence_reference.as_deref())
            .flatten()
        });
        let (record, receipt) = commit_staged_resource_with_receipt(
            sequence,
            descriptor,
            reference,
            context.policy,
            context.knowledge,
            staged,
            qualifying_checkpoint,
        );
        let committed = record.outcome == SuppliedSessionResourceOutcome::Committed;
        if let (Some(observer), Some(receipt)) = (context.observer, receipt.as_ref()) {
            if observer
                .commit_response(
                    sequence,
                    context.policy,
                    descriptor,
                    receipt,
                    context.knowledge,
                )
                .is_err()
            {
                observer.fail();
            }
        } else if let Some(observer) = context.observer {
            observer.discard_response(sequence);
        }
        self.response_bytes = self.response_bytes.saturating_add(record.response_bytes);
        self.resources.push(record);
        if committed {
            Continue::Yes
        } else {
            Continue::No(SuppliedSessionAuditOutcome::ResourceUnavailable)
        }
    }

    fn record_health_unqualified_resource(
        &mut self,
        sequence: u8,
        descriptor: &SuppliedSessionRequestDescriptor,
        reference: &str,
        staged: StagedSuppliedSessionResource,
        policy: &SuppliedSessionPolicy,
        knowledge: &KnowledgeBase,
    ) {
        let checkpoint_reference = self.checkpoints.last().and_then(|checkpoint| {
            (checkpoint.after_subject_count == sequence.saturating_add(1))
                .then_some(checkpoint.evidence_reference.as_deref())
                .flatten()
        });
        let record = commit_health_unqualified_resource(
            sequence,
            descriptor,
            reference,
            policy,
            knowledge,
            staged,
            checkpoint_reference,
        );
        self.response_bytes = self.response_bytes.saturating_add(record.response_bytes);
        self.resources.push(record);
    }

    fn add_not_dispatched(&mut self, resources: &[(SuppliedSessionRequestDescriptor, String)]) {
        for (_, reference) in resources {
            let sequence = u8::try_from(self.resources.len()).unwrap_or(u8::MAX);
            self.resources
                .push(resource_not_dispatched(sequence, reference));
        }
    }

    fn finish(mut self, policy: SuppliedSessionPolicy) -> WebAssessmentSuppliedSessionAudit {
        if let Some(boundary) = policy.renewal_after_resource_count() {
            for resource in &mut self.resources {
                resource.epoch = if self.epoch == 2 && resource.sequence >= boundary {
                    2
                } else {
                    1
                };
            }
        }
        if policy.version() == SuppliedSessionPolicyVersion::V6 {
            // Actual observed rows already carry their acquisition epoch. Do
            // not rewrite them to hide a bad transition. Only undispatched
            // declarations inherit the current planned context.
            for resource in &mut self.resources {
                if resource.outcome == SuppliedSessionResourceOutcome::NotDispatched {
                    resource.epoch = if self.epoch == 2 && resource.sequence >= 1 {
                        2
                    } else {
                        1
                    };
                }
            }
        }
        let response_byte_limit = policy.max_total_response_bytes();
        let cookie_policy = policy
            .cookie_summary()
            .map(|summary| cookie_policy_audit(summary, &policy));
        let cookie_lifecycle = cookie_policy.is_some().then(|| {
            let mut lifecycle = cookie_lifecycle_audit(
                &self.checkpoints,
                &self.resources,
                self.login.as_ref(),
                self.renewal.as_ref(),
            );
            if let Some(renewal) = self.renewal.as_ref() {
                lifecycle.final_epoch = renewal.final_epoch;
                lifecycle.updates_applied = u8::from(renewal.applied_cookie_count > 0);
            }
            lifecycle
        });
        let dispatched_resource_count = u8::try_from(
            self.resources
                .iter()
                .filter(|resource| {
                    resource.outcome != SuppliedSessionResourceOutcome::NotDispatched
                })
                .count(),
        )
        .unwrap_or(u8::MAX);
        let committed_resource_count = u8::try_from(
            self.resources
                .iter()
                .filter(|resource| resource.outcome == SuppliedSessionResourceOutcome::Committed)
                .count(),
        )
        .unwrap_or(u8::MAX);
        let coverage = if self.outcome == SuppliedSessionAuditOutcome::Complete
            && committed_resource_count == self.selected_resource_count
        {
            SuppliedSessionCoverage::Complete
        } else if committed_resource_count == 0 {
            SuppliedSessionCoverage::None
        } else {
            SuppliedSessionCoverage::Partial
        };
        let dispatched_request_count = self.dispatched_request_count();
        debug_assert_eq!(
            self.resources.len(),
            usize::from(self.selected_resource_count)
        );
        debug_assert!(self
            .checkpoints
            .iter()
            .enumerate()
            .all(
                |(index, checkpoint)| checkpoint.sequence == u8::try_from(index).unwrap_or(u8::MAX)
            ));
        debug_assert!(self.checkpoints.iter().all(|checkpoint| {
            checkpoint.outcome == SuppliedSessionHealthOutcome::Indeterminate
                || checkpoint.evidence_reference.is_some()
        }));
        debug_assert!(self
            .resources
            .iter()
            .enumerate()
            .all(|(index, resource)| resource.sequence == u8::try_from(index).unwrap_or(u8::MAX)));
        debug_assert!(self.resources.iter().all(|resource| {
            matches!(
                resource.outcome,
                SuppliedSessionResourceOutcome::Committed
                    | SuppliedSessionResourceOutcome::HealthUnqualified
            ) == resource.evidence_reference.is_some()
        }));
        debug_assert_eq!(
            self.response_bytes,
            self.login
                .as_ref()
                .map_or(0, SuppliedSessionLoginAudit::response_bytes)
                .saturating_add(
                    self.oauth_code
                        .as_ref()
                        .map_or(0, |audit| audit.response_bytes())
                )
                .saturating_add(
                    self.checkpoints
                        .iter()
                        .map(WebAssessmentSuppliedSessionCheckpointAudit::response_bytes)
                        .sum::<u64>()
                )
                .saturating_add(
                    self.resources
                        .iter()
                        .map(WebAssessmentSuppliedSessionResourceAudit::response_bytes)
                        .sum::<u64>()
                )
                .saturating_add(self.renewal.as_ref().map_or(0, |renewal| {
                    renewal.response_bytes.saturating_add(
                        renewal
                            .health
                            .as_ref()
                            .map_or(0, |health| health.response_bytes),
                    )
                }))
                .saturating_add(self.oauth_refresh.as_ref().map_or(0, |refresh| {
                    refresh.response_bytes().saturating_add(
                        refresh.health().map_or(0, |health| health.response_bytes()),
                    )
                }))
        );
        let oauth_token_exchange = if policy.version() == SuppliedSessionPolicyVersion::V7 {
            self.oauth_code.take().map(|audit| {
                Box::new(SuppliedSessionOAuthInitiatedTokenAudit::from_exchange(
                    *audit,
                ))
            })
        } else {
            None
        };
        WebAssessmentSuppliedSessionAudit {
            schema: match policy.version() {
                SuppliedSessionPolicyVersion::V1 => SUPPLIED_SESSION_AUDIT_SCHEMA,
                SuppliedSessionPolicyVersion::V2 => SUPPLIED_SESSION_COOKIE_AUDIT_SCHEMA,
                SuppliedSessionPolicyVersion::V3 => SUPPLIED_SESSION_FORM_LOGIN_AUDIT_SCHEMA,
                SuppliedSessionPolicyVersion::V4 => SUPPLIED_SESSION_RENEWAL_AUDIT_SCHEMA,
                SuppliedSessionPolicyVersion::V5 => SUPPLIED_SESSION_OAUTH_CODE_AUDIT_SCHEMA,
                SuppliedSessionPolicyVersion::V6 => SUPPLIED_SESSION_OAUTH_REFRESH_AUDIT_SCHEMA,
                SuppliedSessionPolicyVersion::V7 => {
                    SUPPLIED_SESSION_OAUTH_AUTHORIZATION_AUDIT_SCHEMA
                },
            },
            capability_id: SUPPLIED_SESSION_CAPABILITY_ID,
            policy_reference: policy.policy_reference().to_owned(),
            application_reference: policy.application_reference().to_owned(),
            principal_reference: policy.principal_reference().to_owned(),
            principal_alias: policy.principal_alias().to_owned(),
            principal_assurance: SuppliedSessionPrincipalAssurance::OperatorDeclared,
            credential_mechanism: policy.credential_mechanism(),
            credential_acquisition: policy.credential_acquisition(),
            health_oracle: SuppliedSessionHealthOracleAudit {
                kind: SuppliedSessionHealthOracleKind::JsonBooleanTrue,
                field_reference: policy.health_field_reference().to_owned(),
            },
            outcome: self.outcome,
            coverage,
            checkpoints: self.checkpoints,
            resources: self.resources,
            selected_resource_count: self.selected_resource_count,
            dispatched_resource_count,
            committed_resource_count,
            dispatched_request_count,
            response_bytes: self.response_bytes,
            response_byte_limit,
            response_byte_limit_exceeded: self.response_bytes > response_byte_limit,
            refresh_performed: self
                .renewal
                .as_ref()
                .is_some_and(|renewal| renewal.applied_cookie_count > 0)
                || self
                    .oauth_refresh
                    .as_ref()
                    .is_some_and(|refresh| refresh.credential_commit_count() == 1),
            anonymous_fallback_performed: false,
            continuous_authentication_established: false,
            exploit_execution_performed: false,
            impact_validation_performed: false,
            cookie_policy,
            cookie_lifecycle,
            login: self.login,
            renewal: self.renewal,
            oauth_code: self.oauth_code,
            oauth_refresh: self.oauth_refresh,
            oauth_authorization: self.oauth_authorization,
            oauth_token_exchange,
        }
    }
}

fn cookie_policy_audit(
    summary: SuppliedSessionCookieSummary,
    policy: &SuppliedSessionPolicy,
) -> SuppliedSessionCookiePolicyAudit {
    SuppliedSessionCookiePolicyAudit {
        declared_count: u8::try_from(summary.cookie_count()).unwrap_or(u8::MAX),
        host_only_count: u8::try_from(summary.host_only_count()).unwrap_or(u8::MAX),
        domain_count: u8::try_from(summary.domain_count()).unwrap_or(u8::MAX),
        secure_count: u8::try_from(summary.secure_count()).unwrap_or(u8::MAX),
        http_only_count: u8::try_from(summary.http_only_count()).unwrap_or(u8::MAX),
        session_count: u8::try_from(summary.session_count()).unwrap_or(u8::MAX),
        persistent_count: u8::try_from(summary.persistent_count()).unwrap_or(u8::MAX),
        same_site_missing_count: u8::try_from(summary.same_site_missing_count()).unwrap_or(u8::MAX),
        same_site_strict_count: u8::try_from(summary.same_site_strict_count()).unwrap_or(u8::MAX),
        same_site_lax_count: u8::try_from(summary.same_site_lax_count()).unwrap_or(u8::MAX),
        same_site_none_count: u8::try_from(summary.same_site_none_count()).unwrap_or(u8::MAX),
        update_policy: policy
            .cookie_update_policy()
            .expect("cookie policy summary requires an update policy"),
    }
}

fn cookie_lifecycle_audit(
    checkpoints: &[WebAssessmentSuppliedSessionCheckpointAudit],
    resources: &[WebAssessmentSuppliedSessionResourceAudit],
    login: Option<&SuppliedSessionLoginAudit>,
    renewal: Option<&SuppliedSessionRenewalAudit>,
) -> SuppliedSessionCookieLifecycleAudit {
    let updates = checkpoints
        .iter()
        .filter_map(|record| record.cookie_update)
        .chain(resources.iter().filter_map(|record| record.cookie_update))
        .chain(renewal.and_then(|renewal| renewal.cookie_update))
        .chain(
            renewal
                .and_then(|renewal| renewal.health.as_ref())
                .and_then(|health| health.cookie_update),
        );
    let mut selected_update_response_count = 0_u8;
    let mut unselected_update_response_count = 0_u8;
    let mut update_classification_failure_count = 0_u8;
    for update in updates {
        if update.selected_count > 0 {
            selected_update_response_count = selected_update_response_count.saturating_add(1);
        }
        if update.unselected_count > 0 {
            unselected_update_response_count = unselected_update_response_count.saturating_add(1);
        }
        if update.kind == SuppliedSessionResponseCookieUpdateKind::Unusable {
            update_classification_failure_count =
                update_classification_failure_count.saturating_add(1);
        }
    }
    SuppliedSessionCookieLifecycleAudit {
        initial_epoch: login.map_or(1, SuppliedSessionLoginAudit::initial_epoch),
        final_epoch: login.map_or(1, SuppliedSessionLoginAudit::final_epoch),
        selected_update_response_count,
        unselected_update_response_count,
        update_classification_failure_count,
        updates_applied: 0,
    }
}

fn health_stop_outcome(
    outcome: SuppliedSessionHealthOutcome,
    is_startup: bool,
) -> Option<SuppliedSessionAuditOutcome> {
    match outcome {
        SuppliedSessionHealthOutcome::Healthy => None,
        SuppliedSessionHealthOutcome::Unhealthy if is_startup => {
            Some(SuppliedSessionAuditOutcome::StartupUnhealthy)
        },
        SuppliedSessionHealthOutcome::Unhealthy => Some(SuppliedSessionAuditOutcome::SessionLost),
        SuppliedSessionHealthOutcome::Indeterminate => {
            Some(SuppliedSessionAuditOutcome::ResourceUnavailable)
        },
    }
}

enum Continue {
    Yes,
    No(SuppliedSessionAuditOutcome),
}

enum ResourceContinuation {
    AwaitingHealth(StagedSuppliedSessionResource),
    No(SuppliedSessionAuditOutcome),
}

enum DispatchResult {
    Response {
        response: Box<CollectedHttpResponse>,
        bytes: u64,
        exact_target: bool,
        cookie_update: Option<SuppliedSessionResponseCookieUpdate>,
    },
    Transport {
        bytes: u64,
        dispatched: bool,
    },
    RuntimeLimit {
        bytes: u64,
        dispatched: bool,
    },
    Cancelled {
        bytes: u64,
        dispatched: bool,
    },
    InvalidDescriptor,
}

struct DispatchContext<'a> {
    authority: &'a SharedWebRuntimeAuthority,
    requests: &'a HttpRequestBroker,
    credential: &'a SuppliedSessionCredential,
    credential_acquisition: Option<&'a CommittedOAuthCodeReceipt>,
    credential_renewal: Option<&'a CommittedOAuthRefreshReceipt>,
    credential_epoch: u8,
    policy: &'a SuppliedSessionPolicy,
    deadline: Option<tokio::time::Instant>,
}

struct LoginDispatchContext<'a> {
    authority: &'a SharedWebRuntimeAuthority,
    requests: &'a HttpRequestBroker,
    policy: &'a SuppliedSessionPolicy,
    deadline: Option<tokio::time::Instant>,
}

#[derive(Clone, Copy)]
struct DispatchBudget {
    accounted_response_bytes: u64,
    dispatched_requests: u8,
}

#[derive(Clone, Copy)]
struct HealthCheckpointPosition {
    sequence: u8,
    phase: SuppliedSessionHealthCheckpointPhase,
    after_subject_count: u8,
}

async fn dispatch_login_page(
    context: &LoginDispatchContext<'_>,
    descriptor: &SuppliedSessionRequestDescriptor,
    budget: DispatchBudget,
) -> DispatchResult {
    if descriptor.purpose() != SuppliedSessionRequestPurpose::LoginPage {
        return DispatchResult::InvalidDescriptor;
    }
    let Some(limits) = login_dispatch_limits(context, budget) else {
        return if context.authority.cancellation().is_cancelled() {
            DispatchResult::Cancelled {
                bytes: 0,
                dispatched: false,
            }
        } else {
            DispatchResult::RuntimeLimit {
                bytes: 0,
                dispatched: false,
            }
        };
    };
    let before = context.authority.request_accounting().snapshot();
    let execution = context
        .requests
        .collect_supplied_session_login_page_for_runtime(
            DecisionExecutionStage::Passive,
            Some(DecisionActionOrigin::Bootstrap),
            limits,
            descriptor,
            context.policy,
        );
    let result = super::await_execution(
        context.authority.cancellation(),
        context.deadline,
        execution,
    )
    .await;
    login_dispatch_result(context, descriptor, before, result)
}

async fn dispatch_login_submit(
    context: &LoginDispatchContext<'_>,
    descriptor: &SuppliedSessionRequestDescriptor,
    body: &SuppliedSessionFormBody,
    budget: DispatchBudget,
) -> DispatchResult {
    if descriptor.purpose() != SuppliedSessionRequestPurpose::LoginSubmit {
        return DispatchResult::InvalidDescriptor;
    }
    let Some(limits) = login_dispatch_limits(context, budget) else {
        return if context.authority.cancellation().is_cancelled() {
            DispatchResult::Cancelled {
                bytes: 0,
                dispatched: false,
            }
        } else {
            DispatchResult::RuntimeLimit {
                bytes: 0,
                dispatched: false,
            }
        };
    };
    let before = context.authority.request_accounting().snapshot();
    let execution = context
        .requests
        .collect_supplied_session_login_submit_for_runtime(
            DecisionExecutionStage::Active,
            None,
            limits,
            descriptor,
            context.policy,
            body,
        );
    let result = super::await_execution(
        context.authority.cancellation(),
        context.deadline,
        execution,
    )
    .await;
    login_dispatch_result(context, descriptor, before, result)
}

fn login_dispatch_limits(
    context: &LoginDispatchContext<'_>,
    budget: DispatchBudget,
) -> Option<DecisionExecutionLimits> {
    if context.authority.cancellation().is_cancelled()
        || context
            .deadline
            .is_some_and(|deadline| tokio::time::Instant::now() >= deadline)
        || budget.accounted_response_bytes >= context.policy.max_total_response_bytes()
        || budget.dispatched_requests >= context.policy.max_session_requests()
    {
        return None;
    }
    let remaining = context
        .policy
        .max_total_response_bytes()
        .saturating_sub(budget.accounted_response_bytes);
    let response_limit =
        remaining.min(u64::try_from(context.policy.max_response_body_bytes()).unwrap_or(u64::MAX));
    (response_limit > 0)
        .then(|| DecisionExecutionLimits::new().with_max_response_body_bytes(response_limit))
}

fn login_dispatch_result(
    context: &LoginDispatchContext<'_>,
    descriptor: &SuppliedSessionRequestDescriptor,
    before: crate::runtime_budget::RequestAccountingSnapshot,
    result: RuntimeExecution<Result<CollectedHttpResponse, SuppliedSessionRequestError>>,
) -> DispatchResult {
    let after = context.authority.request_accounting().snapshot();
    let dispatched = after.total_requests() > before.total_requests();
    let bytes = after
        .response_bytes()
        .saturating_sub(before.response_bytes());
    match result {
        RuntimeExecution::Completed(Ok(response)) => DispatchResult::Response {
            exact_target: response.final_url() == descriptor.target(),
            response: Box::new(response),
            bytes,
            cookie_update: None,
        },
        RuntimeExecution::Completed(Err(SuppliedSessionRequestError::RuntimeLimit)) => {
            DispatchResult::RuntimeLimit { bytes, dispatched }
        },
        RuntimeExecution::Completed(Err(SuppliedSessionRequestError::Http)) => {
            DispatchResult::Transport { bytes, dispatched }
        },
        RuntimeExecution::Completed(Err(SuppliedSessionRequestError::InvalidDescriptor)) => {
            DispatchResult::InvalidDescriptor
        },
        RuntimeExecution::Cancelled => DispatchResult::Cancelled { bytes, dispatched },
        RuntimeExecution::WallTimeExceeded => DispatchResult::RuntimeLimit { bytes, dispatched },
    }
}

// Construct the selected broker future outside dispatch's poll frame. The
// one-shot factory runs immediately and retains no independent execution.
#[inline(never)]
fn boxed_dispatch_execution<F: std::future::Future>(
    make: impl FnOnce() -> F,
) -> std::pin::Pin<Box<F>> {
    Box::pin(make())
}

async fn dispatch(
    context: &DispatchContext<'_>,
    descriptor: &SuppliedSessionRequestDescriptor,
    budget: DispatchBudget,
    origin: DecisionActionOrigin,
    expected_purpose: SuppliedSessionRequestPurpose,
) -> DispatchResult {
    if descriptor.purpose() != expected_purpose {
        return DispatchResult::InvalidDescriptor;
    }
    let acquisition_is_valid = if context.policy.version() == SuppliedSessionPolicyVersion::V6 {
        context.credential_acquisition.is_some_and(|code| {
            code.is_valid_for(context.policy, context.authority.knowledge())
                && match context.credential_epoch {
                    1 => context.credential_renewal.is_none(),
                    2 => context.credential_renewal.is_some_and(|renewed| {
                        renewed.is_valid_for(context.policy, code, context.authority.knowledge())
                    }),
                    _ => false,
                }
        })
    } else if matches!(
        context.policy.version(),
        SuppliedSessionPolicyVersion::V5 | SuppliedSessionPolicyVersion::V7
    ) {
        context.credential_acquisition.is_some_and(|receipt| {
            context.credential_epoch == 1
                && context.credential_renewal.is_none()
                && receipt.is_valid_for(context.policy, context.authority.knowledge())
        })
    } else {
        context.credential_acquisition.is_none() && context.credential_renewal.is_none()
    };
    if !acquisition_is_valid {
        return DispatchResult::InvalidDescriptor;
    }
    if context.authority.cancellation().is_cancelled() {
        return DispatchResult::Cancelled {
            bytes: 0,
            dispatched: false,
        };
    }
    if context
        .deadline
        .is_some_and(|deadline| tokio::time::Instant::now() >= deadline)
        || budget.accounted_response_bytes >= context.policy.max_total_response_bytes()
        || budget.dispatched_requests >= context.policy.max_session_requests()
    {
        return DispatchResult::RuntimeLimit {
            bytes: 0,
            dispatched: false,
        };
    }
    let remaining = context
        .policy
        .max_total_response_bytes()
        .saturating_sub(budget.accounted_response_bytes);
    let response_limit =
        remaining.min(u64::try_from(context.policy.max_response_body_bytes()).unwrap_or(u64::MAX));
    if response_limit == 0 {
        return DispatchResult::RuntimeLimit {
            bytes: 0,
            dispatched: false,
        };
    }
    let limits = DecisionExecutionLimits::new().with_max_response_body_bytes(response_limit);
    let before = context.authority.request_accounting().snapshot();
    let execution = boxed_dispatch_execution(|| async {
        if expected_purpose == SuppliedSessionRequestPurpose::Renewal {
            context
                .requests
                .collect_supplied_session_renewal_for_runtime(
                    limits,
                    descriptor,
                    context.policy,
                    context.credential,
                )
                .await
        } else {
            context
                .requests
                .collect_supplied_session_get_for_runtime(
                    DecisionExecutionStage::Passive,
                    Some(origin),
                    limits,
                    descriptor,
                    context.policy,
                    context.credential,
                )
                .await
        }
    });
    let result = super::await_execution(
        context.authority.cancellation(),
        context.deadline,
        execution,
    )
    .await;
    let after = context.authority.request_accounting().snapshot();
    let dispatched = after.total_requests() > before.total_requests();
    let bytes = after
        .response_bytes()
        .saturating_sub(before.response_bytes());
    match result {
        RuntimeExecution::Completed(Ok(response)) => {
            let exact_target = response.final_url() == descriptor.target();
            let cookie_update = response_cookie_update(context.policy, &response, exact_target);
            DispatchResult::Response {
                response: Box::new(response),
                bytes,
                exact_target,
                cookie_update,
            }
        },
        RuntimeExecution::Completed(Err(SuppliedSessionRequestError::RuntimeLimit)) => {
            DispatchResult::RuntimeLimit { bytes, dispatched }
        },
        RuntimeExecution::Completed(Err(SuppliedSessionRequestError::Http)) => {
            DispatchResult::Transport { bytes, dispatched }
        },
        RuntimeExecution::Completed(Err(SuppliedSessionRequestError::InvalidDescriptor)) => {
            DispatchResult::InvalidDescriptor
        },
        RuntimeExecution::Cancelled => DispatchResult::Cancelled { bytes, dispatched },
        RuntimeExecution::WallTimeExceeded => DispatchResult::RuntimeLimit { bytes, dispatched },
    }
}

fn cookie_update_stop_outcome(
    update: Option<SuppliedSessionResponseCookieUpdate>,
) -> Option<SuppliedSessionAuditOutcome> {
    match update.map(|value| value.kind) {
        Some(SuppliedSessionResponseCookieUpdateKind::Selected) => {
            Some(SuppliedSessionAuditOutcome::CredentialUpdateRequired)
        },
        Some(SuppliedSessionResponseCookieUpdateKind::Unusable) => {
            Some(SuppliedSessionAuditOutcome::CredentialUpdateUnusable)
        },
        None
        | Some(SuppliedSessionResponseCookieUpdateKind::None)
        | Some(SuppliedSessionResponseCookieUpdateKind::UnselectedOnly) => None,
    }
}

fn response_cookie_update(
    policy: &SuppliedSessionPolicy,
    response: &CollectedHttpResponse,
    exact_target: bool,
) -> Option<SuppliedSessionResponseCookieUpdate> {
    if !matches!(
        policy.version(),
        SuppliedSessionPolicyVersion::V2
            | SuppliedSessionPolicyVersion::V3
            | SuppliedSessionPolicyVersion::V4
    ) {
        return None;
    }
    if !exact_target {
        return Some(SuppliedSessionResponseCookieUpdate {
            kind: SuppliedSessionResponseCookieUpdateKind::Unusable,
            selected_count: 0,
            unselected_count: 0,
        });
    }
    Some(response.supplied_session_cookie_updates(policy).into())
}

fn login_form_outcome(error: SuppliedSessionLoginFormError) -> SuppliedSessionLoginFormOutcome {
    match error {
        SuppliedSessionLoginFormError::IneligibleResponse => {
            SuppliedSessionLoginFormOutcome::IneligibleResponse
        },
        SuppliedSessionLoginFormError::MissingForm | SuppliedSessionLoginFormError::MissingCsrf => {
            SuppliedSessionLoginFormOutcome::Missing
        },
        SuppliedSessionLoginFormError::AmbiguousForm
        | SuppliedSessionLoginFormError::AmbiguousCsrf => {
            SuppliedSessionLoginFormOutcome::Ambiguous
        },
        SuppliedSessionLoginFormError::InvalidFormContract
        | SuppliedSessionLoginFormError::InvalidCsrf => SuppliedSessionLoginFormOutcome::Invalid,
    }
}

fn unix_time_seconds() -> Option<i64> {
    std::time::SystemTime::now()
        .duration_since(std::time::UNIX_EPOCH)
        .ok()
        .and_then(|duration| i64::try_from(duration.as_secs()).ok())
}

impl From<SuppliedSessionCookieUpdateObservation> for SuppliedSessionResponseCookieUpdate {
    fn from(observation: SuppliedSessionCookieUpdateObservation) -> Self {
        let kind = match observation.classification() {
            SuppliedSessionCookieUpdateClassification::None => {
                SuppliedSessionResponseCookieUpdateKind::None
            },
            SuppliedSessionCookieUpdateClassification::UnselectedOnly => {
                SuppliedSessionResponseCookieUpdateKind::UnselectedOnly
            },
            SuppliedSessionCookieUpdateClassification::Selected => {
                SuppliedSessionResponseCookieUpdateKind::Selected
            },
            SuppliedSessionCookieUpdateClassification::Unusable => {
                SuppliedSessionResponseCookieUpdateKind::Unusable
            },
        };
        Self {
            kind,
            selected_count: observation.selected_count(),
            unselected_count: observation.unselected_count(),
        }
    }
}

fn earliest_deadline(
    parent: Option<tokio::time::Instant>,
    local: Option<tokio::time::Instant>,
) -> Option<tokio::time::Instant> {
    match (parent, local) {
        (Some(parent), Some(local)) => Some(parent.min(local)),
        (Some(parent), None) => Some(parent),
        (None, Some(local)) => Some(local),
        (None, None) => None,
    }
}

fn classify_health(
    response: CollectedHttpResponse,
    bytes: u64,
    exact_target: bool,
    cookie_update: Option<SuppliedSessionResponseCookieUpdate>,
    position: HealthCheckpointPosition,
    policy: &SuppliedSessionPolicy,
) -> WebAssessmentSuppliedSessionCheckpointAudit {
    let status = response.status();
    let complete = response.body_complete();
    let body_state = if complete {
        SuppliedSessionBodyState::Complete
    } else {
        SuppliedSessionBodyState::Incomplete
    };
    let predicate =
        if exact_target && complete && status == 200 && response.has_json_compatible_media_type() {
            if strict_top_level_boolean(response.body(), policy.health_json_field()) == Some(true) {
                SuppliedSessionPredicateOutcome::Matched
            } else {
                SuppliedSessionPredicateOutcome::NotMatched
            }
        } else {
            SuppliedSessionPredicateOutcome::NotEvaluated
        };
    let outcome = if predicate == SuppliedSessionPredicateOutcome::Matched {
        SuppliedSessionHealthOutcome::Healthy
    } else if complete {
        SuppliedSessionHealthOutcome::Unhealthy
    } else {
        SuppliedSessionHealthOutcome::Indeterminate
    };
    WebAssessmentSuppliedSessionCheckpointAudit {
        sequence: position.sequence,
        evidence_reference: None,
        phase: position.phase,
        after_subject_count: position.after_subject_count,
        outcome,
        status: Some(status),
        body_state,
        predicate,
        response_bytes: bytes,
        epoch: None,
        cookie_update,
    }
}

fn health_unavailable(
    sequence: u8,
    phase: SuppliedSessionHealthCheckpointPhase,
    after_subject_count: u8,
    bytes: u64,
) -> WebAssessmentSuppliedSessionCheckpointAudit {
    WebAssessmentSuppliedSessionCheckpointAudit {
        sequence,
        evidence_reference: None,
        phase,
        after_subject_count,
        outcome: SuppliedSessionHealthOutcome::Indeterminate,
        status: None,
        body_state: SuppliedSessionBodyState::Unavailable,
        predicate: SuppliedSessionPredicateOutcome::NotEvaluated,
        response_bytes: bytes,
        epoch: None,
        cookie_update: None,
    }
}

fn committed_health_unavailable(
    policy: &SuppliedSessionPolicy,
    descriptor: &SuppliedSessionRequestDescriptor,
    sequence: u8,
    phase: SuppliedSessionHealthCheckpointPhase,
    after_subject_count: u8,
    response_bytes: u64,
    knowledge: &KnowledgeBase,
) -> WebAssessmentSuppliedSessionCheckpointAudit {
    let mut record = health_unavailable(sequence, phase, after_subject_count, response_bytes);
    bind_health_evidence(&mut record, policy, descriptor, None, knowledge);
    record
}

fn bind_health_evidence(
    checkpoint: &mut WebAssessmentSuppliedSessionCheckpointAudit,
    policy: &SuppliedSessionPolicy,
    descriptor: &SuppliedSessionRequestDescriptor,
    exact_response_target: Option<bool>,
    knowledge: &KnowledgeBase,
) {
    checkpoint.evidence_reference = commit_health_evidence(
        policy,
        descriptor,
        checkpoint,
        exact_response_target,
        knowledge,
    );
    if checkpoint.evidence_reference.is_none() {
        checkpoint.outcome = SuppliedSessionHealthOutcome::Indeterminate;
        checkpoint.predicate = SuppliedSessionPredicateOutcome::NotEvaluated;
    }
}

/// Commits a redaction-safe checkpoint receipt to the parent knowledge store.
/// A complete health predicate cannot qualify resource coverage unless this
/// transaction succeeds and the immutable record can be read back exactly.
fn commit_health_evidence(
    policy: &SuppliedSessionPolicy,
    descriptor: &SuppliedSessionRequestDescriptor,
    checkpoint: &WebAssessmentSuppliedSessionCheckpointAudit,
    exact_response_target: Option<bool>,
    knowledge: &KnowledgeBase,
) -> Option<String> {
    if !descriptor.validate()
        || descriptor.purpose() != SuppliedSessionRequestPurpose::Health
        || exact_response_target == Some(false)
    {
        return None;
    }
    let status = checkpoint
        .status
        .map_or_else(|| "unavailable".to_owned(), |status| status.to_string());
    let target_state = if exact_response_target == Some(true) {
        "exact"
    } else {
        "unavailable"
    };
    let mut binding = format!(
        "policy={};application={};health_field={};purpose=health;sequence={};phase={};after_subject_count={};target={target_state};status={status};body_state={};predicate={};outcome={};response_bytes={}",
        policy.policy_reference(),
        policy.application_reference(),
        policy.health_field_reference(),
        checkpoint.sequence,
        checkpoint_phase_token(checkpoint.phase),
        checkpoint.after_subject_count,
        body_state_token(checkpoint.body_state),
        predicate_token(checkpoint.predicate),
        health_outcome_token(checkpoint.outcome),
        checkpoint.response_bytes,
    );
    if matches!(
        policy.version(),
        SuppliedSessionPolicyVersion::V4 | SuppliedSessionPolicyVersion::V6
    ) {
        use std::fmt::Write as _;
        let _ = write!(binding, ";epoch={}", checkpoint.epoch());
    }
    append_cookie_update_binding(policy, &mut binding, checkpoint.cookie_update);
    commit_value_safe_evidence(
        policy,
        policy.health_field_reference(),
        HEALTH_COMMIT_EVIDENCE_DOMAIN,
        HEALTH_COMMIT_EVIDENCE_PREFIX,
        HEALTH_COMMIT_EVIDENCE_PREDICATE,
        health_commit_evidence_method(policy),
        binding,
        knowledge,
    )
}

fn checkpoint_phase_token(phase: SuppliedSessionHealthCheckpointPhase) -> &'static str {
    match phase {
        SuppliedSessionHealthCheckpointPhase::Startup => "startup",
        SuppliedSessionHealthCheckpointPhase::SubjectBoundary => "subject_boundary",
        SuppliedSessionHealthCheckpointPhase::Terminal => "terminal",
        SuppliedSessionHealthCheckpointPhase::Renewal => "renewal",
    }
}

fn health_outcome_token(outcome: SuppliedSessionHealthOutcome) -> &'static str {
    match outcome {
        SuppliedSessionHealthOutcome::Healthy => "healthy",
        SuppliedSessionHealthOutcome::Unhealthy => "unhealthy",
        SuppliedSessionHealthOutcome::Indeterminate => "indeterminate",
    }
}

fn body_state_token(state: SuppliedSessionBodyState) -> &'static str {
    match state {
        SuppliedSessionBodyState::Complete => "complete",
        SuppliedSessionBodyState::Incomplete => "incomplete",
        SuppliedSessionBodyState::Unavailable => "unavailable",
    }
}

fn predicate_token(predicate: SuppliedSessionPredicateOutcome) -> &'static str {
    match predicate {
        SuppliedSessionPredicateOutcome::Matched => "matched",
        SuppliedSessionPredicateOutcome::NotMatched => "not_matched",
        SuppliedSessionPredicateOutcome::NotEvaluated => "not_evaluated",
    }
}

/// Body-free staging record awaiting the following health checkpoint.
///
/// The collected response is reduced immediately, so neither its body nor
/// headers can enter the shared knowledge base or saved audit. A complete 200
/// remains staged until its immediately following committed health checkpoint
/// qualifies it. Only then may it become authenticated `Committed` coverage.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
struct StagedSuppliedSessionResource {
    status: u16,
    response_bytes: u64,
    exact_target: bool,
    body_complete: bool,
    cookie_update: Option<SuppliedSessionResponseCookieUpdate>,
    epoch: u8,
}

fn stage_resource_response(
    response: &CollectedHttpResponse,
    response_bytes: u64,
    exact_target: bool,
    cookie_update: Option<SuppliedSessionResponseCookieUpdate>,
) -> StagedSuppliedSessionResource {
    StagedSuppliedSessionResource {
        status: response.status(),
        response_bytes,
        exact_target,
        body_complete: response.body_complete(),
        cookie_update,
        epoch: 1,
    }
}

fn staged_resource_can_await_health(
    descriptor: &SuppliedSessionRequestDescriptor,
    expected_reference: &str,
    staged: StagedSuppliedSessionResource,
) -> bool {
    descriptor.validate()
        && descriptor.purpose() == SuppliedSessionRequestPurpose::Resource
        && descriptor.target_reference() == expected_reference
        && staged.exact_target
        && staged.body_complete
        && staged.status == 200
}

fn commit_staged_resource(
    sequence: u8,
    descriptor: &SuppliedSessionRequestDescriptor,
    expected_reference: &str,
    policy: &SuppliedSessionPolicy,
    knowledge: &KnowledgeBase,
    staged: StagedSuppliedSessionResource,
    qualifying_checkpoint_reference: Option<&str>,
) -> WebAssessmentSuppliedSessionResourceAudit {
    commit_staged_resource_with_receipt(
        sequence,
        descriptor,
        expected_reference,
        policy,
        knowledge,
        staged,
        qualifying_checkpoint_reference,
    )
    .0
}

fn commit_staged_resource_with_receipt(
    sequence: u8,
    descriptor: &SuppliedSessionRequestDescriptor,
    expected_reference: &str,
    policy: &SuppliedSessionPolicy,
    knowledge: &KnowledgeBase,
    staged: StagedSuppliedSessionResource,
    qualifying_checkpoint_reference: Option<&str>,
) -> (
    WebAssessmentSuppliedSessionResourceAudit,
    Option<CommittedSuppliedSessionResourceReceipt>,
) {
    let descriptor_is_exact = descriptor.validate()
        && descriptor.purpose() == SuppliedSessionRequestPurpose::Resource
        && descriptor.target_reference() == expected_reference;
    let (outcome, receipt) = if (300..400).contains(&staged.status) {
        (SuppliedSessionResourceOutcome::RedirectRefused, None)
    } else if !descriptor_is_exact || !staged.exact_target || !staged.body_complete {
        (SuppliedSessionResourceOutcome::Incomplete, None)
    } else if staged.status == 200 {
        match qualifying_checkpoint_reference.and_then(|checkpoint_reference| {
            commit_resource_evidence(
                ResourceEvidenceCommitInput {
                    #[cfg(feature = "wordpress-review")]
                    sequence,
                    descriptor,
                    resource_reference: expected_reference,
                    response_bytes: staged.response_bytes,
                    cookie_update: staged.cookie_update,
                    epoch: staged.epoch,
                    qualifying_checkpoint_reference: checkpoint_reference,
                },
                policy,
                knowledge,
            )
        }) {
            Some(receipt) => (SuppliedSessionResourceOutcome::Committed, Some(receipt)),
            None => (SuppliedSessionResourceOutcome::Incomplete, None),
        }
    } else {
        (SuppliedSessionResourceOutcome::HttpError, None)
    };
    let evidence_reference = receipt
        .as_ref()
        .map(|receipt| receipt.evidence_reference.clone());
    (
        WebAssessmentSuppliedSessionResourceAudit {
            sequence,
            resource_reference: expected_reference.to_owned(),
            evidence_reference,
            outcome,
            status: Some(staged.status),
            response_bytes: staged.response_bytes,
            epoch: staged.epoch,
            cookie_update: staged.cookie_update,
        },
        receipt,
    )
}

fn commit_health_unqualified_resource(
    sequence: u8,
    descriptor: &SuppliedSessionRequestDescriptor,
    expected_reference: &str,
    policy: &SuppliedSessionPolicy,
    knowledge: &KnowledgeBase,
    staged: StagedSuppliedSessionResource,
    checkpoint_reference: Option<&str>,
) -> WebAssessmentSuppliedSessionResourceAudit {
    let evidence_reference =
        staged_resource_can_await_health(descriptor, expected_reference, staged)
            .then(|| {
                commit_health_unqualified_resource_evidence(
                    policy,
                    descriptor,
                    expected_reference,
                    staged.response_bytes,
                    staged.cookie_update,
                    checkpoint_reference,
                    knowledge,
                )
            })
            .flatten();
    WebAssessmentSuppliedSessionResourceAudit {
        sequence,
        resource_reference: expected_reference.to_owned(),
        outcome: if evidence_reference.is_some() {
            SuppliedSessionResourceOutcome::HealthUnqualified
        } else {
            SuppliedSessionResourceOutcome::Incomplete
        },
        evidence_reference,
        status: Some(staged.status),
        response_bytes: staged.response_bytes,
        epoch: staged.epoch,
        cookie_update: staged.cookie_update,
    }
}

/// Commits one value-safe resource receipt to the assessment's parent knowledge
/// transaction. The retained record includes only typed references, purpose,
/// status, byte count, and outcome; it never includes the URL, response body,
/// headers, authorization value, or a digest of the authorization value.
struct ResourceEvidenceCommitInput<'a> {
    #[cfg(feature = "wordpress-review")]
    sequence: u8,
    descriptor: &'a SuppliedSessionRequestDescriptor,
    resource_reference: &'a str,
    response_bytes: u64,
    cookie_update: Option<SuppliedSessionResponseCookieUpdate>,
    qualifying_checkpoint_reference: &'a str,
    epoch: u8,
}

fn commit_resource_evidence(
    input: ResourceEvidenceCommitInput<'_>,
    policy: &SuppliedSessionPolicy,
    knowledge: &KnowledgeBase,
) -> Option<CommittedSuppliedSessionResourceReceipt> {
    if !input.descriptor.validate()
        || input.descriptor.purpose() != SuppliedSessionRequestPurpose::Resource
        || input.descriptor.target_reference() != input.resource_reference
    {
        return None;
    }
    require_committed_health_evidence(input.qualifying_checkpoint_reference, knowledge)?;
    if matches!(
        policy.version(),
        SuppliedSessionPolicyVersion::V4 | SuppliedSessionPolicyVersion::V6
    ) {
        let id = EvidenceId::parse(input.qualifying_checkpoint_reference).ok()?;
        let expected_binding = format!(
            "policy={};application={};",
            policy.policy_reference(),
            policy.application_reference()
        );
        let epoch_binding = format!(";epoch={};", input.epoch);
        let v6_epoch_field = format!("epoch={}", input.epoch);
        if !knowledge.inspect_evidence(&id, |evidence| {
            matches!(evidence.value(), EvidenceValue::Text(binding)
                if binding.starts_with(&expected_binding)
                    && if policy.version() == SuppliedSessionPolicyVersion::V6 {
                        binding.split(';').any(|field| field == v6_epoch_field)
                    } else { binding.contains(&epoch_binding) }
                    && binding.contains(";outcome=healthy;"))
        })? {
            return None;
        }
    }
    let mut binding = format!(
        "policy={};application={};resource={};purpose=resource;status=200;response_bytes={};qualifying_checkpoint={};outcome=committed",
        policy.policy_reference(),
        policy.application_reference(),
        input.resource_reference,
        input.response_bytes,
        input.qualifying_checkpoint_reference,
    );
    if matches!(
        policy.version(),
        SuppliedSessionPolicyVersion::V4 | SuppliedSessionPolicyVersion::V6
    ) {
        use std::fmt::Write as _;
        let _ = write!(binding, ";epoch={}", input.epoch);
    }
    append_cookie_update_binding(policy, &mut binding, input.cookie_update);
    let evidence_reference = commit_value_safe_evidence(
        policy,
        input.resource_reference,
        RESOURCE_COMMIT_EVIDENCE_DOMAIN,
        RESOURCE_COMMIT_EVIDENCE_PREFIX,
        RESOURCE_COMMIT_EVIDENCE_PREDICATE,
        resource_commit_evidence_method(policy),
        binding,
        knowledge,
    )?;
    #[cfg(feature = "wordpress-review")]
    let expected_evidence = {
        let evidence_id = EvidenceId::parse(evidence_reference.clone()).ok()?;
        knowledge.inspect_evidence(&evidence_id, Clone::clone)?
    };
    Some(CommittedSuppliedSessionResourceReceipt {
        #[cfg(feature = "wordpress-review")]
        sequence: input.sequence,
        #[cfg(feature = "wordpress-review")]
        resource_reference: input.resource_reference.to_owned(),
        #[cfg(feature = "wordpress-review")]
        policy_reference: policy.policy_reference().to_owned(),
        #[cfg(feature = "wordpress-review")]
        application_reference: policy.application_reference().to_owned(),
        #[cfg(feature = "wordpress-review")]
        principal_reference: policy.principal_reference().to_owned(),
        #[cfg(feature = "wordpress-review")]
        credential_mechanism: policy.credential_mechanism(),
        #[cfg(feature = "wordpress-review")]
        epoch: input.epoch,
        evidence_reference,
        #[cfg(feature = "wordpress-review")]
        expected_evidence,
    })
}

fn commit_health_unqualified_resource_evidence(
    policy: &SuppliedSessionPolicy,
    descriptor: &SuppliedSessionRequestDescriptor,
    resource_reference: &str,
    response_bytes: u64,
    cookie_update: Option<SuppliedSessionResponseCookieUpdate>,
    checkpoint_reference: Option<&str>,
    knowledge: &KnowledgeBase,
) -> Option<String> {
    if !descriptor.validate()
        || descriptor.purpose() != SuppliedSessionRequestPurpose::Resource
        || descriptor.target_reference() != resource_reference
    {
        return None;
    }
    if let Some(reference) = checkpoint_reference {
        require_committed_health_evidence(reference, knowledge)?;
    }
    let checkpoint = checkpoint_reference.unwrap_or("unavailable");
    let mut binding = format!(
        "policy={};application={};resource={resource_reference};purpose=resource;status=200;response_bytes={response_bytes};qualifying_checkpoint={checkpoint};outcome=health_unqualified",
        policy.policy_reference(),
        policy.application_reference(),
    );
    append_cookie_update_binding(policy, &mut binding, cookie_update);
    commit_value_safe_evidence(
        policy,
        resource_reference,
        RESOURCE_COMMIT_EVIDENCE_DOMAIN,
        RESOURCE_COMMIT_EVIDENCE_PREFIX,
        RESOURCE_HEALTH_UNQUALIFIED_EVIDENCE_PREDICATE,
        resource_commit_evidence_method(policy),
        binding,
        knowledge,
    )
}

fn health_commit_evidence_method(policy: &SuppliedSessionPolicy) -> &'static str {
    match policy.version() {
        SuppliedSessionPolicyVersion::V1 => HEALTH_COMMIT_EVIDENCE_METHOD_V1,
        SuppliedSessionPolicyVersion::V2 => HEALTH_COMMIT_EVIDENCE_METHOD_V2,
        SuppliedSessionPolicyVersion::V3 => HEALTH_COMMIT_EVIDENCE_METHOD_V3,
        SuppliedSessionPolicyVersion::V4 => "supplied-session-health/v4",
        SuppliedSessionPolicyVersion::V5 => "supplied-session-health/v5",
        SuppliedSessionPolicyVersion::V6 => "supplied-session-health/v6",
        SuppliedSessionPolicyVersion::V7 => "supplied-session-health/v7",
    }
}

fn resource_commit_evidence_method(policy: &SuppliedSessionPolicy) -> &'static str {
    match policy.version() {
        SuppliedSessionPolicyVersion::V1 => RESOURCE_COMMIT_EVIDENCE_METHOD_V1,
        SuppliedSessionPolicyVersion::V2 => RESOURCE_COMMIT_EVIDENCE_METHOD_V2,
        SuppliedSessionPolicyVersion::V3 => RESOURCE_COMMIT_EVIDENCE_METHOD_V3,
        SuppliedSessionPolicyVersion::V4 => "supplied-session-resource/v4",
        SuppliedSessionPolicyVersion::V5 => "supplied-session-resource/v5",
        SuppliedSessionPolicyVersion::V6 => "supplied-session-resource/v6",
        SuppliedSessionPolicyVersion::V7 => "supplied-session-resource/v7",
    }
}

fn append_cookie_update_binding(
    policy: &SuppliedSessionPolicy,
    binding: &mut String,
    update: Option<SuppliedSessionResponseCookieUpdate>,
) {
    if !matches!(
        policy.version(),
        SuppliedSessionPolicyVersion::V2
            | SuppliedSessionPolicyVersion::V3
            | SuppliedSessionPolicyVersion::V4
    ) {
        return;
    }
    let update = update.unwrap_or(SuppliedSessionResponseCookieUpdate {
        kind: SuppliedSessionResponseCookieUpdateKind::None,
        selected_count: 0,
        unselected_count: 0,
    });
    use std::fmt::Write as _;
    let _ = write!(
        binding,
        ";cookie_update={};selected_update_count={};unselected_update_count={}",
        cookie_update_token(update.kind),
        update.selected_count,
        update.unselected_count,
    );
}

fn cookie_update_token(kind: SuppliedSessionResponseCookieUpdateKind) -> &'static str {
    match kind {
        SuppliedSessionResponseCookieUpdateKind::None => "none",
        SuppliedSessionResponseCookieUpdateKind::UnselectedOnly => "unselected_only",
        SuppliedSessionResponseCookieUpdateKind::Selected => "selected",
        SuppliedSessionResponseCookieUpdateKind::Unusable => "unusable",
    }
}

fn require_committed_health_evidence(reference: &str, knowledge: &KnowledgeBase) -> Option<()> {
    let evidence_id = EvidenceId::parse(reference).ok()?;
    knowledge
        .inspect_evidence(&evidence_id, |evidence| {
            evidence.kind() == &EvidenceKind::Authentication
                && evidence.predicate().namespace() == RESOURCE_COMMIT_EVIDENCE_NAMESPACE
                && evidence.predicate().name() == HEALTH_COMMIT_EVIDENCE_PREDICATE
        })?
        .then_some(())
}

#[allow(clippy::too_many_arguments)]
fn commit_value_safe_evidence(
    policy: &SuppliedSessionPolicy,
    correlation_reference: &str,
    digest_domain: &[u8],
    evidence_prefix: &str,
    predicate_name: &str,
    method: &str,
    binding: String,
    knowledge: &KnowledgeBase,
) -> Option<String> {
    let mut digest = Sha256::new();
    digest.update(digest_domain);
    digest.update(binding.as_bytes());
    let evidence_reference = format!("{evidence_prefix}:{:x}", digest.finalize());
    let evidence_id = EvidenceId::parse(evidence_reference.clone()).ok()?;
    let subject = EntityId::new(policy.application_reference().to_owned()).ok()?;
    let predicate =
        KnowledgePredicate::new(RESOURCE_COMMIT_EVIDENCE_NAMESPACE, predicate_name).ok()?;
    let source = EvidenceSource::new(RESOURCE_COMMIT_EVIDENCE_COMPONENT, method)
        .and_then(|source| source.with_correlation_id(correlation_reference.to_owned()))
        .ok()?;
    let evidence = Evidence::with_id(
        evidence_id.clone(),
        subject,
        EvidenceKind::Authentication,
        predicate,
        EvidenceValue::Text(binding),
        source,
        ConfidenceScore::MAX,
    );
    knowledge.insert_evidence(evidence.clone()).ok()?;
    (knowledge.inspect_evidence(&evidence_id, |stored| stored == &evidence) == Some(true))
        .then_some(evidence_reference)
}

fn resource_transport_failure(
    sequence: u8,
    reference: &str,
    bytes: u64,
) -> WebAssessmentSuppliedSessionResourceAudit {
    WebAssessmentSuppliedSessionResourceAudit {
        sequence,
        resource_reference: reference.to_owned(),
        evidence_reference: None,
        outcome: SuppliedSessionResourceOutcome::TransportFailed,
        status: None,
        response_bytes: bytes,
        epoch: 1,
        cookie_update: None,
    }
}

fn resource_not_dispatched(
    sequence: u8,
    reference: &str,
) -> WebAssessmentSuppliedSessionResourceAudit {
    WebAssessmentSuppliedSessionResourceAudit {
        sequence,
        resource_reference: reference.to_owned(),
        evidence_reference: None,
        outcome: SuppliedSessionResourceOutcome::NotDispatched,
        status: None,
        response_bytes: 0,
        epoch: 1,
        cookie_update: None,
    }
}

#[derive(Clone, Copy)]
enum StrictHealthValue {
    Bool(bool),
    Other,
}

struct StrictHealthSeed<'a> {
    depth: usize,
    nodes: &'a mut usize,
}

impl<'de> DeserializeSeed<'de> for StrictHealthSeed<'_> {
    type Value = StrictHealthValue;
    fn deserialize<D>(self, deserializer: D) -> Result<Self::Value, D::Error>
    where
        D: Deserializer<'de>,
    {
        if self.depth > HEALTH_JSON_MAX_DEPTH || *self.nodes >= HEALTH_JSON_MAX_NODES {
            return Err(serde::de::Error::custom("bounded health JSON limit"));
        }
        *self.nodes += 1;
        deserializer.deserialize_any(StrictHealthVisitor {
            depth: self.depth,
            nodes: self.nodes,
        })
    }
}

struct StrictHealthVisitor<'a> {
    depth: usize,
    nodes: &'a mut usize,
}

impl<'de> Visitor<'de> for StrictHealthVisitor<'_> {
    type Value = StrictHealthValue;
    fn expecting(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        formatter.write_str("bounded JSON")
    }
    fn visit_bool<E>(self, value: bool) -> Result<Self::Value, E> {
        Ok(StrictHealthValue::Bool(value))
    }
    fn visit_i64<E>(self, _: i64) -> Result<Self::Value, E> {
        Ok(StrictHealthValue::Other)
    }
    fn visit_u64<E>(self, _: u64) -> Result<Self::Value, E> {
        Ok(StrictHealthValue::Other)
    }
    fn visit_f64<E>(self, _: f64) -> Result<Self::Value, E> {
        Ok(StrictHealthValue::Other)
    }
    fn visit_none<E>(self) -> Result<Self::Value, E> {
        Ok(StrictHealthValue::Other)
    }
    fn visit_unit<E>(self) -> Result<Self::Value, E> {
        Ok(StrictHealthValue::Other)
    }
    fn visit_str<E>(self, value: &str) -> Result<Self::Value, E>
    where
        E: serde::de::Error,
    {
        if value.len() > HEALTH_JSON_MAX_KEY_BYTES {
            return Err(E::custom("bounded health JSON string"));
        }
        Ok(StrictHealthValue::Other)
    }
    fn visit_seq<A>(self, mut sequence: A) -> Result<Self::Value, A::Error>
    where
        A: SeqAccess<'de>,
    {
        while sequence
            .next_element_seed(StrictHealthSeed {
                depth: self.depth + 1,
                nodes: self.nodes,
            })?
            .is_some()
        {}
        Ok(StrictHealthValue::Other)
    }
    fn visit_map<A>(self, mut map: A) -> Result<Self::Value, A::Error>
    where
        A: MapAccess<'de>,
    {
        let mut seen = std::collections::BTreeSet::new();
        while let Some(key) = map.next_key::<String>()? {
            if key.len() > HEALTH_JSON_MAX_KEY_BYTES || !seen.insert(key) {
                return Err(serde::de::Error::custom(
                    "duplicate or oversized health JSON key",
                ));
            }
            let _ = map.next_value_seed(StrictHealthSeed {
                depth: self.depth + 1,
                nodes: self.nodes,
            })?;
        }
        Ok(StrictHealthValue::Other)
    }
}

fn strict_top_level_boolean(bytes: &[u8], field: &str) -> Option<bool> {
    struct RootSeed<'a> {
        field: &'a str,
        nodes: &'a mut usize,
    }
    impl<'de> DeserializeSeed<'de> for RootSeed<'_> {
        type Value = Option<bool>;
        fn deserialize<D>(self, deserializer: D) -> Result<Self::Value, D::Error>
        where
            D: Deserializer<'de>,
        {
            struct RootVisitor<'a> {
                field: &'a str,
                nodes: &'a mut usize,
            }
            impl<'de> Visitor<'de> for RootVisitor<'_> {
                type Value = Option<bool>;
                fn expecting(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
                    formatter.write_str("a bounded JSON object")
                }
                fn visit_map<A>(self, mut map: A) -> Result<Self::Value, A::Error>
                where
                    A: MapAccess<'de>,
                {
                    let mut seen = std::collections::BTreeSet::new();
                    let mut selected = None;
                    while let Some(key) = map.next_key::<String>()? {
                        if key.len() > HEALTH_JSON_MAX_KEY_BYTES || !seen.insert(key.clone()) {
                            return Err(serde::de::Error::custom(
                                "duplicate or oversized health JSON key",
                            ));
                        }
                        let value = map.next_value_seed(StrictHealthSeed {
                            depth: 1,
                            nodes: self.nodes,
                        })?;
                        if key == self.field {
                            selected = match value {
                                StrictHealthValue::Bool(value) => Some(value),
                                StrictHealthValue::Other => None,
                            };
                        }
                    }
                    Ok(selected)
                }
            }
            deserializer.deserialize_map(RootVisitor {
                field: self.field,
                nodes: self.nodes,
            })
        }
    }
    let mut nodes = 0;
    let mut decoder = serde_json::Deserializer::from_slice(bytes);
    let parsed = RootSeed {
        field,
        nodes: &mut nodes,
    }
    .deserialize(&mut decoder)
    .ok()?;
    decoder.end().ok()?;
    parsed
}

#[cfg(test)]
mod tests {
    #[test]
    fn oauth_optional_runtime_storage_is_indirect_for_legacy_contexts() {
        let _: fn(&SuppliedSessionRuntimeConfig) -> &Option<Box<OAuthCodeRequestBroker>> =
            |config| &config.oauth_code_requests;
        let _: fn(&SuppliedSessionRuntimeConfig) -> &Option<Box<OAuthCodeRequestDescriptor>> =
            |config| &config.oauth_code_descriptor;
        let _: fn(
            &WebAssessmentSuppliedSessionAudit,
        ) -> &Option<Box<SuppliedSessionOAuthCodeAudit>> = |audit| &audit.oauth_code;
        let legacy = policy(&url::Url::parse("http://127.0.0.1:1/app/").unwrap());
        let state = ExecutionState::new(&legacy, 1);
        assert!(state.oauth_code.is_none());
        assert_eq!(
            std::mem::size_of_val(&state.oauth_code),
            std::mem::size_of::<usize>()
        );
    }
    use super::*;
    use crate::supplied_session_review::{
        SuppliedSessionAuthorization, SuppliedSessionCookies, SuppliedSessionFormCredential,
    };
    use crate::web_runtime::{
        WebAssessmentLimits, WebAssessmentRuntimeBuilder, WebAssessmentRuntimeError,
    };
    #[cfg(feature = "wordpress-review")]
    use crate::wordpress_review::WordPressReviewInputs;
    #[cfg(feature = "websocket-review")]
    use futures::{SinkExt, StreamExt};
    #[cfg(feature = "websocket-review")]
    use serde_json::json;
    #[cfg(feature = "websocket-review")]
    use std::sync::atomic::{AtomicBool, Ordering};
    use std::sync::Arc;
    use tokio::{
        io::{AsyncReadExt, AsyncWriteExt},
        net::TcpListener,
        sync::Mutex,
    };

    fn policy(application: &url::Url) -> SuppliedSessionPolicy {
        policy_with_wall_time(application, 5_000)
    }

    fn policy_with_wall_time(
        application: &url::Url,
        max_wall_time_ms: u64,
    ) -> SuppliedSessionPolicy {
        let source = format!(
            r#"schema = "security.supplied-session-policy/v1"
principal_alias = "fixture-principal"
credential_mechanism = "authorization_header"
health_path = "/app/session-health"
health_json_field = "authenticated"
resources = ["/app/private"]
max_session_requests = 3
max_total_response_bytes = 65536
max_response_body_bytes = 16384
max_wall_time_ms = {max_wall_time_ms}
"#
        );
        SuppliedSessionPolicy::parse_toml(application, source.as_bytes()).unwrap()
    }

    #[cfg(feature = "websocket-review")]
    fn websocket_policy(
        application: &url::Url,
        endpoint: &url::Url,
        max_wall_time_ms: u64,
    ) -> WebSocketReviewPolicy {
        let expected = b"expected";
        let source = serde_json::to_vec(&json!({
            "schema": "security.websocket-review-policy/v1",
            "target_authorized": true,
            "messages_read_only_acknowledged": true,
            "message_content_is_non_secret": true,
            "endpoint": endpoint.as_str(),
            "origin_mode": "application_origin",
            "compression": false,
            "reconnect": false,
            "messages": [{
                "id": "combined-session-message",
                "text": "request",
                "expected_response": {
                    "sha256": format!("{:x}", Sha256::digest(expected)),
                    "length": expected.len()
                }
            }],
            "limits": {
                "max_inbound_message_bytes": 4096,
                "max_outbound_message_bytes": 4096,
                "max_messages": 1,
                "max_control_frames": 4,
                "max_wall_time_ms": max_wall_time_ms
            }
        }))
        .unwrap();
        WebSocketReviewPolicy::parse_json(application, &source).unwrap()
    }

    #[cfg(feature = "websocket-review")]
    struct ExactAuthorizationCallback(&'static str);

    #[cfg(feature = "websocket-review")]
    impl tokio_tungstenite::tungstenite::handshake::server::Callback for ExactAuthorizationCallback {
        fn on_request(
            self,
            request: &tokio_tungstenite::tungstenite::handshake::server::Request,
            response: tokio_tungstenite::tungstenite::handshake::server::Response,
        ) -> Result<
            tokio_tungstenite::tungstenite::handshake::server::Response,
            tokio_tungstenite::tungstenite::handshake::server::ErrorResponse,
        > {
            assert!(
                request
                    .headers()
                    .get("authorization")
                    .and_then(|value| value.to_str().ok())
                    == Some(self.0),
                "fixture WebSocket authorization mismatch"
            );
            Ok(response)
        }
    }

    #[cfg(feature = "websocket-review")]
    struct ObserveAuthorizationCallback {
        expected: &'static [u8],
        observed: Arc<AtomicBool>,
    }

    #[cfg(feature = "websocket-review")]
    impl tokio_tungstenite::tungstenite::handshake::server::Callback for ObserveAuthorizationCallback {
        fn on_request(
            self,
            request: &tokio_tungstenite::tungstenite::handshake::server::Request,
            response: tokio_tungstenite::tungstenite::handshake::server::Response,
        ) -> Result<
            tokio_tungstenite::tungstenite::handshake::server::Response,
            tokio_tungstenite::tungstenite::handshake::server::ErrorResponse,
        > {
            self.observed.store(
                request
                    .headers()
                    .get("authorization")
                    .is_some_and(|value| value.as_bytes() == self.expected),
                Ordering::SeqCst,
            );
            Ok(response)
        }
    }

    fn cookie_policy(application: &url::Url) -> SuppliedSessionPolicy {
        let bytes = format!(
            r#"schema = "security.supplied-session-policy/v2"
principal_alias = "cookie-fixture-principal"
credential_mechanism = "cookie_jar"
cookie_update_policy = "stop_on_selected_cookie"
health_path = "/app/session-health"
health_json_field = "authenticated"
resources = ["/app/private"]
max_session_requests = 3
max_total_response_bytes = 65536
max_response_body_bytes = 16384
max_wall_time_ms = 5000

[[cookies]]
id = "session-secret"
name = "session"
domain = "{}"
host_only = true
path = "/app/"
secure = false
http_only = true
same_site = "lax"
"#,
            application.host_str().unwrap()
        );
        SuppliedSessionPolicy::parse_toml(application, bytes.as_bytes()).unwrap()
    }

    fn renewal_policy(application: &url::Url) -> SuppliedSessionPolicy {
        let source = format!(
            r#"schema = "security.supplied-session-policy/v4"
principal_alias = "renewal-fixture"
credential_mechanism = "cookie_jar"
cookie_update_policy = "stop_on_selected_cookie"
renewal_path = "/app/renew"
renewal_method = "post"
renewal_after_resource_count = 1
max_renewal_attempts = 1
health_path = "/app/health"
health_json_field = "authenticated"
resources = ["/app/before", "/app/after"]
max_session_requests = 7
max_total_response_bytes = 65536
max_response_body_bytes = 16384
max_wall_time_ms = 5000
[[cookies]]
id = "session"
name = "session"
domain = "{}"
host_only = true
path = "/app/"
secure = {}
http_only = true
same_site = "lax"
"#,
            application.host_str().unwrap(),
            application.scheme() == "https"
        );
        SuppliedSessionPolicy::parse_toml(application, source.as_bytes()).unwrap()
    }

    #[test]
    fn renewal_resource_commit_requires_the_committed_matching_epoch_not_a_reported_number() {
        let policy = renewal_policy(&url::Url::parse("https://example.test/app/").unwrap());
        let health = SuppliedSessionRequestDescriptor::health(&policy);
        let (target, reference) = policy.execution_resources().nth(1).unwrap();
        let descriptor =
            SuppliedSessionRequestDescriptor::resource(&policy, target, reference).unwrap();
        let knowledge = KnowledgeBase::new();
        let mut checkpoint = WebAssessmentSuppliedSessionCheckpointAudit {
            sequence: 2,
            evidence_reference: None,
            phase: SuppliedSessionHealthCheckpointPhase::Terminal,
            after_subject_count: 2,
            outcome: SuppliedSessionHealthOutcome::Healthy,
            status: Some(200),
            body_state: SuppliedSessionBodyState::Complete,
            predicate: SuppliedSessionPredicateOutcome::Matched,
            response_bytes: 22,
            epoch: Some(1),
            cookie_update: None,
        };
        bind_health_evidence(&mut checkpoint, &policy, &health, Some(true), &knowledge);
        let staged = StagedSuppliedSessionResource {
            status: 200,
            response_bytes: 17,
            exact_target: true,
            body_complete: true,
            cookie_update: None,
            epoch: 2,
        };
        let (rejected, receipt) = commit_staged_resource_with_receipt(
            1,
            &descriptor,
            reference,
            &policy,
            &knowledge,
            staged,
            checkpoint.evidence_reference(),
        );
        assert_eq!(
            rejected.outcome(),
            SuppliedSessionResourceOutcome::Incomplete
        );
        assert!(
            receipt.is_none(),
            "old-epoch committed health authorized renewed resource"
        );
        checkpoint.epoch = Some(2);
        bind_health_evidence(&mut checkpoint, &policy, &health, Some(true), &knowledge);
        let (accepted, receipt) = commit_staged_resource_with_receipt(
            1,
            &descriptor,
            reference,
            &policy,
            &knowledge,
            staged,
            checkpoint.evidence_reference(),
        );
        assert_eq!(
            accepted.outcome(),
            SuppliedSessionResourceOutcome::Committed
        );
        assert_eq!(accepted.epoch(), 2);
        assert!(receipt.is_some());
    }

    #[tokio::test]
    async fn normal_runtime_renewal_preserves_epochs_classifier_parent_budget_and_cancellation() {
        for case in 0_u8..4 {
            let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
            let address = listener.local_addr().unwrap();
            let trace = Arc::new(Mutex::new(Vec::new()));
            let server_trace = Arc::clone(&trace);
            let replacement = if case == 1 {
                format!(
                    "Set-Cookie: session={}; Path=/app/; HttpOnly; SameSite=Lax\r\n",
                    "COOKIE-OVERFLOW-CANARY".repeat(185)
                )
            } else {
                "Set-Cookie: session=NEW-RENEWAL-CANARY; Path=/app/; HttpOnly; SameSite=Lax\r\n"
                    .to_owned()
            };
            let server = tokio::spawn(async move {
                let mut renewed = false;
                loop {
                    let Ok((mut stream, _)) = listener.accept().await else {
                        break;
                    };
                    let mut request = Vec::new();
                    while request.len() <= 16 * 1024 {
                        let mut chunk = [0_u8; 1024];
                        let read = stream.read(&mut chunk).await.unwrap_or(0);
                        if read == 0 {
                            break;
                        }
                        request.extend_from_slice(&chunk[..read]);
                        if request.windows(4).any(|window| window == b"\r\n\r\n") {
                            break;
                        }
                    }
                    let text = String::from_utf8_lossy(&request);
                    let mut line = text.lines().next().unwrap_or("").split_whitespace();
                    let method = line.next().unwrap_or("");
                    let path = line.next().unwrap_or("");
                    let old = text.lines().any(|line| {
                        line.eq_ignore_ascii_case("cookie: session=OLD-RENEWAL-CANARY")
                    });
                    let new = text.lines().any(|line| {
                        line.eq_ignore_ascii_case("cookie: session=NEW-RENEWAL-CANARY")
                    });
                    server_trace
                        .lock()
                        .await
                        .push((method.to_owned(), path.to_owned(), old, new));
                    let active = if renewed { new } else { old };
                    let (status, media, body, headers) = match (method, path) {
                        ("GET", "/app/health") => (
                            200,
                            "application/json",
                            if active {
                                r#"{"authenticated":true}"#
                            } else {
                                r#"{"authenticated":false}"#
                            },
                            "",
                        ),
                        ("GET", "/app/before") if old && !renewed => {
                            (200, "text/html", "PRIVATE-RENEWAL-BODY", "")
                        },
                        ("POST", "/app/renew") if old && !renewed => {
                            renewed = true;
                            (200, "application/json", "{}", replacement.as_str())
                        },
                        ("GET", "/app/after") if new && renewed => {
                            (200, "text/html", "PRIVATE-RENEWAL-BODY", "")
                        },
                        (_, "/app/before" | "/app/after" | "/app/renew") => {
                            (403, "text/plain", "denied", "")
                        },
                        _ => (200, "text/html", "<title>public</title>", ""),
                    };
                    let response = format!("HTTP/1.1 {status} OK\r\nContent-Type: {media}\r\n{headers}Content-Length: {}\r\nConnection: close\r\n\r\n{body}", body.len());
                    let _ = stream.write_all(response.as_bytes()).await;
                    let _ = stream.shutdown().await;
                }
            });
            let application = url::Url::parse(&format!("http://{address}/app/")).unwrap();
            let policy = renewal_policy(&application);
            let credential = SuppliedSessionCookies::parse_tsv(
                &policy,
                b"session\tOLD-RENEWAL-CANARY".to_vec(),
                0,
            )
            .unwrap();
            let limits = if case == 2 {
                WebAssessmentLimits::default()
                    .with_max_total_requests(4)
                    .unwrap()
            } else {
                WebAssessmentLimits::default()
            };
            let cancellation = tokio_util::sync::CancellationToken::new();
            if case == 3 {
                cancellation.cancel();
            }
            let mut runtime = WebAssessmentRuntimeBuilder::new(application)
                .limits(limits)
                .cancellation_token(cancellation)
                .with_supplied_session_review(policy, credential)
                .build()
                .unwrap();
            let report = runtime.analyze().await.unwrap();
            let audit = report.supplied_session_audit().unwrap();
            let (expected_outcome, expected_requests, expected_committed, expected_epoch) =
                match case {
                    0 => (SuppliedSessionAuditOutcome::Complete, 7, 2, 2),
                    1 => (SuppliedSessionAuditOutcome::RenewalUnavailable, 4, 1, 1),
                    2 => (SuppliedSessionAuditOutcome::RuntimeLimit, 4, 1, 2),
                    _ => (SuppliedSessionAuditOutcome::Cancelled, 0, 0, 1),
                };
            assert_eq!(audit.outcome(), expected_outcome, "case {case}");
            assert_eq!(audit.dispatched_request_count(), expected_requests);
            assert_eq!(audit.committed_resource_count(), expected_committed);
            assert_eq!(audit.resources()[0].epoch(), 1);
            assert_eq!(audit.resources()[1].epoch(), expected_epoch);
            assert_eq!(
                audit.renewal().unwrap().attempt_count(),
                u8::from(case != 3)
            );
            if case == 0 {
                assert_eq!(audit.renewal().unwrap().health().unwrap().epoch(), 2);
            } else {
                assert!(audit.renewal().unwrap().health().is_none());
            }
            if case == 2 {
                assert_eq!(report.usage().total_requests(), 4);
            }
            let saved = serde_json::to_string(audit).unwrap();
            for private in [
                "OLD-RENEWAL-CANARY",
                "NEW-RENEWAL-CANARY",
                "PRIVATE-RENEWAL-BODY",
                "COOKIE-OVERFLOW-CANARY",
                "/app/renew",
            ] {
                assert!(!saved.contains(private));
            }
            let trace = trace.lock().await;
            let actual: Vec<_> = trace
                .iter()
                .filter(|(_, _, old, new)| *old || *new)
                .cloned()
                .collect();
            let expected = [
                ("GET".into(), "/app/health".into(), true, false),
                ("GET".into(), "/app/before".into(), true, false),
                ("GET".into(), "/app/health".into(), true, false),
                ("POST".into(), "/app/renew".into(), true, false),
                ("GET".into(), "/app/health".into(), false, true),
                ("GET".into(), "/app/after".into(), false, true),
                ("GET".into(), "/app/health".into(), false, true),
            ];
            assert_eq!(
                actual,
                expected[..expected_requests as usize],
                "case {case}"
            );
            server.abort();
        }
    }

    fn cookie_credential(policy: &SuppliedSessionPolicy) -> SuppliedSessionCookies {
        SuppliedSessionCookies::parse_tsv(
            policy,
            b"session-secret\tCOOKIE-RUNTIME-CANARY\n".to_vec(),
            1,
        )
        .unwrap()
    }

    fn form_login_policy(application: &url::Url) -> SuppliedSessionPolicy {
        let bytes = format!(
            r#"schema = "security.supplied-session-policy/v3"
principal_alias = "login-fixture-principal"
credential_mechanism = "cookie_jar"
credential_acquisition = "bounded_form_login"
cookie_update_policy = "stop_on_selected_cookie"
login_path = "/app/login"
login_method = "post"
login_encoding = "application/x-www-form-urlencoded"
username_field = "user"
password_field = "pass"
csrf_field = "csrf"
max_login_attempts = 1
health_path = "/app/session-health"
health_json_field = "authenticated"
resources = ["/app/private"]
max_session_requests = 5
max_total_response_bytes = 65536
max_response_body_bytes = 16384
max_wall_time_ms = 5000

[[cookies]]
id = "generated-session"
name = "session"
domain = "{}"
host_only = true
path = "/app/"
secure = false
http_only = true
same_site = "lax"
"#,
            application.host_str().unwrap()
        );
        SuppliedSessionPolicy::parse_toml(application, bytes.as_bytes()).unwrap()
    }

    fn committed_health_qualification(
        policy: &SuppliedSessionPolicy,
        knowledge: &KnowledgeBase,
    ) -> String {
        let descriptor = SuppliedSessionRequestDescriptor::health(policy);
        let mut checkpoint = WebAssessmentSuppliedSessionCheckpointAudit {
            sequence: 1,
            evidence_reference: None,
            phase: SuppliedSessionHealthCheckpointPhase::Terminal,
            after_subject_count: 1,
            outcome: SuppliedSessionHealthOutcome::Healthy,
            status: Some(200),
            body_state: SuppliedSessionBodyState::Complete,
            predicate: SuppliedSessionPredicateOutcome::Matched,
            response_bytes: 22,
            epoch: None,
            cookie_update: None,
        };
        bind_health_evidence(&mut checkpoint, policy, &descriptor, Some(true), knowledge);
        checkpoint
            .evidence_reference
            .expect("fixture health receipt must commit")
    }

    #[test]
    fn strict_health_json_rejects_duplicates_and_non_boolean_values() {
        assert_eq!(
            strict_top_level_boolean(br#"{"authenticated":true}"#, "authenticated"),
            Some(true)
        );
        assert_eq!(
            strict_top_level_boolean(br#"{"authenticated":false}"#, "authenticated"),
            Some(false)
        );
        assert_eq!(
            strict_top_level_boolean(br#"{"authenticated":"true"}"#, "authenticated"),
            None
        );
        assert_eq!(
            strict_top_level_boolean(
                br#"{"authenticated":true,"authenticated":false}"#,
                "authenticated"
            ),
            None
        );
        assert_eq!(
            strict_top_level_boolean(br#"[true]"#, "authenticated"),
            None
        );
    }

    #[test]
    fn only_a_complete_negative_post_startup_checkpoint_claims_session_loss() {
        assert_eq!(
            health_stop_outcome(SuppliedSessionHealthOutcome::Healthy, true),
            None
        );
        assert_eq!(
            health_stop_outcome(SuppliedSessionHealthOutcome::Unhealthy, true),
            Some(SuppliedSessionAuditOutcome::StartupUnhealthy)
        );
        assert_eq!(
            health_stop_outcome(SuppliedSessionHealthOutcome::Indeterminate, true),
            Some(SuppliedSessionAuditOutcome::ResourceUnavailable)
        );
        assert_eq!(
            health_stop_outcome(SuppliedSessionHealthOutcome::Unhealthy, false),
            Some(SuppliedSessionAuditOutcome::SessionLost)
        );
        assert_eq!(
            health_stop_outcome(SuppliedSessionHealthOutcome::Indeterminate, false),
            Some(SuppliedSessionAuditOutcome::ResourceUnavailable)
        );
    }

    #[test]
    fn health_truth_requires_a_parent_knowledge_commit() {
        let application = url::Url::parse("https://example.test/app/").unwrap();
        let policy = policy(&application);
        let descriptor = SuppliedSessionRequestDescriptor::health(&policy);
        let healthy = || WebAssessmentSuppliedSessionCheckpointAudit {
            sequence: 0,
            evidence_reference: None,
            phase: SuppliedSessionHealthCheckpointPhase::Startup,
            after_subject_count: 0,
            outcome: SuppliedSessionHealthOutcome::Healthy,
            status: Some(200),
            body_state: SuppliedSessionBodyState::Complete,
            predicate: SuppliedSessionPredicateOutcome::Matched,
            response_bytes: 22,
            epoch: None,
            cookie_update: None,
        };

        let committed_knowledge = KnowledgeBase::new();
        let mut committed = healthy();
        bind_health_evidence(
            &mut committed,
            &policy,
            &descriptor,
            Some(true),
            &committed_knowledge,
        );
        assert_eq!(committed.outcome(), SuppliedSessionHealthOutcome::Healthy);
        let evidence_reference = committed
            .evidence_reference()
            .expect("healthy checkpoint must have a committed receipt")
            .to_owned();

        let conflicting = Evidence::with_id(
            EvidenceId::parse(evidence_reference).unwrap(),
            EntityId::new("supplied-session-conflict-fixture").unwrap(),
            EvidenceKind::Authentication,
            KnowledgePredicate::new("fixture", "conflict").unwrap(),
            EvidenceValue::Boolean(false),
            EvidenceSource::new("fixture", "conflict").unwrap(),
            ConfidenceScore::MAX,
        );
        let conflicting_knowledge = KnowledgeBase::new();
        conflicting_knowledge.insert_evidence(conflicting).unwrap();
        let mut rejected = healthy();
        bind_health_evidence(
            &mut rejected,
            &policy,
            &descriptor,
            Some(true),
            &conflicting_knowledge,
        );
        assert_eq!(rejected.evidence_reference(), None);
        assert_eq!(
            rejected.outcome(),
            SuppliedSessionHealthOutcome::Indeterminate
        );
        assert_eq!(
            rejected.predicate(),
            SuppliedSessionPredicateOutcome::NotEvaluated
        );

        let mut wrong_target = healthy();
        bind_health_evidence(
            &mut wrong_target,
            &policy,
            &descriptor,
            Some(false),
            &KnowledgeBase::new(),
        );
        assert_eq!(wrong_target.evidence_reference(), None);
        assert_eq!(
            wrong_target.outcome(),
            SuppliedSessionHealthOutcome::Indeterminate
        );
    }

    #[cfg(feature = "websocket-review")]
    #[test]
    fn startup_health_permit_rejects_mutated_binding_and_widened_deadline() {
        let application = url::Url::parse("http://127.0.0.1:8123/app/").unwrap();
        let endpoint = url::Url::parse("ws://127.0.0.1:8123/app/socket").unwrap();
        let policy = policy(&application);
        let websocket = websocket_policy(&application, &endpoint, 1_000);
        let descriptor = SuppliedSessionRequestDescriptor::health(&policy);
        let knowledge = KnowledgeBase::new();
        let mut checkpoint = WebAssessmentSuppliedSessionCheckpointAudit {
            sequence: 0,
            evidence_reference: None,
            phase: SuppliedSessionHealthCheckpointPhase::Startup,
            after_subject_count: 0,
            outcome: SuppliedSessionHealthOutcome::Healthy,
            status: Some(200),
            body_state: SuppliedSessionBodyState::Complete,
            predicate: SuppliedSessionPredicateOutcome::Matched,
            response_bytes: 22,
            epoch: None,
            cookie_update: None,
        };
        bind_health_evidence(
            &mut checkpoint,
            &policy,
            &descriptor,
            Some(true),
            &knowledge,
        );
        let startup = CommittedSuppliedSessionHealthReceipt::from_checkpoint(
            &policy,
            &checkpoint,
            SuppliedSessionHealthCheckpointPhase::Startup,
            0,
            &knowledge,
        )
        .expect("fixture must commit one exact startup receipt");
        let authorization =
            SuppliedSessionAuthorization::new("Bearer STARTUP-PERMIT-CANARY").unwrap();
        let parent_deadline = tokio::time::Instant::now()
            .checked_add(Duration::from_secs(10))
            .unwrap();
        let session_deadline = tokio::time::Instant::now()
            .checked_add(Duration::from_secs(5))
            .unwrap();
        let mut permit = SuppliedSessionWebSocketPermit::new(
            &policy,
            &authorization,
            &websocket,
            Some(session_deadline),
            startup,
        );
        assert!(permit.is_valid_for(&application, &websocket, &knowledge, Some(parent_deadline)));

        permit.startup.epoch = 2;
        assert!(!permit.is_valid_for(&application, &websocket, &knowledge, Some(parent_deadline)));
        permit.startup.epoch = 1;
        permit.startup.after_subject_count = 1;
        assert!(!permit.is_valid_for(&application, &websocket, &knowledge, Some(parent_deadline)));
        permit.startup.after_subject_count = 0;
        permit.websocket_endpoint_reference = "websocket-endpoint-sha256:wrong";
        assert!(!permit.is_valid_for(&application, &websocket, &knowledge, Some(parent_deadline)));
        permit.websocket_endpoint_reference = websocket.endpoint_reference();
        permit.session_deadline = None;
        assert!(!permit.is_valid_for(&application, &websocket, &knowledge, Some(parent_deadline)));
        permit.session_deadline = parent_deadline.checked_add(Duration::from_millis(1));
        assert!(!permit.is_valid_for(&application, &websocket, &knowledge, Some(parent_deadline)));
    }

    #[test]
    fn resource_commit_revalidates_descriptor_and_complete_response_receipt() {
        let application = url::Url::parse("https://example.test/app/").unwrap();
        let policy = policy(&application);
        let (target, reference) = policy.execution_resources().next().unwrap();
        let descriptor = SuppliedSessionRequestDescriptor::resource(&policy, target, reference)
            .expect("fixture resource descriptor");
        let complete = StagedSuppliedSessionResource {
            status: 200,
            response_bytes: 17,
            exact_target: true,
            body_complete: true,
            cookie_update: None,
            epoch: 1,
        };
        let knowledge = KnowledgeBase::new();
        assert_eq!(
            commit_staged_resource(
                0,
                &descriptor,
                reference,
                &policy,
                &knowledge,
                complete,
                None,
            )
            .outcome(),
            SuppliedSessionResourceOutcome::Incomplete,
            "a complete 200 is not authenticated coverage without its following health receipt"
        );
        let qualifier = committed_health_qualification(&policy, &knowledge);
        let committed = commit_staged_resource(
            0,
            &descriptor,
            reference,
            &policy,
            &knowledge,
            complete,
            Some(&qualifier),
        );
        assert_eq!(
            committed.outcome(),
            SuppliedSessionResourceOutcome::Committed
        );
        let evidence_reference = committed
            .evidence_reference()
            .expect("knowledge commit must leave an opaque receipt")
            .to_owned();
        assert_eq!(knowledge.stats().evidence, 2);

        let conflicting = Evidence::with_id(
            EvidenceId::parse(evidence_reference).unwrap(),
            EntityId::new("supplied-session-conflict-fixture").unwrap(),
            EvidenceKind::Authentication,
            KnowledgePredicate::new("fixture", "conflict").unwrap(),
            EvidenceValue::Boolean(false),
            EvidenceSource::new("fixture", "conflict").unwrap(),
            ConfidenceScore::MAX,
        );
        let conflicting_knowledge = KnowledgeBase::new();
        let conflicting_qualifier = committed_health_qualification(&policy, &conflicting_knowledge);
        conflicting_knowledge.insert_evidence(conflicting).unwrap();
        let rejected = commit_staged_resource(
            0,
            &descriptor,
            reference,
            &policy,
            &conflicting_knowledge,
            complete,
            Some(&conflicting_qualifier),
        );
        assert_eq!(
            rejected.outcome(),
            SuppliedSessionResourceOutcome::Incomplete
        );
        assert_eq!(rejected.evidence_reference(), None);

        for mutation in [
            StagedSuppliedSessionResource {
                exact_target: false,
                ..complete
            },
            StagedSuppliedSessionResource {
                body_complete: false,
                ..complete
            },
        ] {
            assert_eq!(
                commit_staged_resource(
                    0,
                    &descriptor,
                    reference,
                    &policy,
                    &KnowledgeBase::new(),
                    mutation,
                    None,
                )
                .outcome(),
                SuppliedSessionResourceOutcome::Incomplete
            );
        }
        assert_eq!(
            commit_staged_resource(
                0,
                &descriptor,
                "supplied-session-resource-sha256:wrong",
                &policy,
                &KnowledgeBase::new(),
                complete,
                None,
            )
            .outcome(),
            SuppliedSessionResourceOutcome::Incomplete
        );
        assert_eq!(
            commit_staged_resource(
                0,
                &descriptor,
                reference,
                &policy,
                &KnowledgeBase::new(),
                StagedSuppliedSessionResource {
                    status: 302,
                    ..complete
                },
                None,
            )
            .outcome(),
            SuppliedSessionResourceOutcome::RedirectRefused
        );
        assert_eq!(
            commit_staged_resource(
                0,
                &descriptor,
                reference,
                &policy,
                &KnowledgeBase::new(),
                StagedSuppliedSessionResource {
                    status: 403,
                    ..complete
                },
                None,
            )
            .outcome(),
            SuppliedSessionResourceOutcome::HttpError
        );
    }

    #[cfg(feature = "wordpress-review")]
    #[test]
    fn committed_resource_receipt_revalidates_the_full_session_binding() {
        let application = url::Url::parse("https://example.test/app/").unwrap();
        let policy = policy(&application);
        let (target, reference) = policy.execution_resources().next().unwrap();
        let descriptor = SuppliedSessionRequestDescriptor::resource(&policy, target, reference)
            .expect("fixture resource descriptor");
        let staged = StagedSuppliedSessionResource {
            status: 200,
            response_bytes: 17,
            exact_target: true,
            body_complete: true,
            cookie_update: None,
            epoch: 1,
        };
        let knowledge = KnowledgeBase::new();
        let qualifier = committed_health_qualification(&policy, &knowledge);
        let (audit, receipt) = commit_staged_resource_with_receipt(
            0,
            &descriptor,
            reference,
            &policy,
            &knowledge,
            staged,
            Some(&qualifier),
        );
        assert_eq!(audit.outcome(), SuppliedSessionResourceOutcome::Committed);
        let mut receipt = receipt.expect("complete qualified response must mint a sealed receipt");
        assert!(receipt.is_valid_for(0, &policy, &descriptor, &knowledge));

        receipt.epoch = 2;
        assert!(!receipt.is_valid_for(0, &policy, &descriptor, &knowledge));
        receipt.epoch = 1;
        receipt.principal_reference = "supplied-session-principal-9999".to_owned();
        assert!(!receipt.is_valid_for(0, &policy, &descriptor, &knowledge));
        receipt.principal_reference = policy.principal_reference().to_owned();
        receipt.credential_mechanism = SuppliedSessionCredentialMechanism::CookieJar;
        assert!(!receipt.is_valid_for(0, &policy, &descriptor, &knowledge));
        receipt.credential_mechanism = SuppliedSessionCredentialMechanism::AuthorizationHeader;
        receipt.application_reference =
            "supplied-session-application-sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
                .to_owned();
        assert!(!receipt.is_valid_for(0, &policy, &descriptor, &knowledge));
        receipt.application_reference = policy.application_reference().to_owned();
        receipt.policy_reference =
            "supplied-session-policy-sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
                .to_owned();
        assert!(!receipt.is_valid_for(0, &policy, &descriptor, &knowledge));
        receipt.policy_reference = policy.policy_reference().to_owned();
        receipt.resource_reference =
            "supplied-session-resource-sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
                .to_owned();
        assert!(!receipt.is_valid_for(0, &policy, &descriptor, &knowledge));
        receipt.resource_reference = descriptor.target_reference().to_owned();
        assert!(!receipt.is_valid_for(1, &policy, &descriptor, &knowledge));
        assert!(receipt.is_valid_for(0, &policy, &descriptor, &knowledge));
    }

    #[test]
    fn builder_rejects_cleartext_non_loopback_and_application_mismatch() {
        let insecure = url::Url::parse("http://example.test/app/").unwrap();
        let error = WebAssessmentRuntimeBuilder::new(insecure.clone())
            .with_supplied_session_review(
                policy(&insecure),
                SuppliedSessionAuthorization::new("Bearer REDACTED-CANARY").unwrap(),
            )
            .build()
            .err()
            .expect("cleartext non-loopback session must be rejected");
        assert!(matches!(
            error,
            WebAssessmentRuntimeError::InsecureSuppliedSessionTransport
        ));

        let selected = url::Url::parse("https://example.test/app/").unwrap();
        let other = url::Url::parse("https://example.test/other/").unwrap();
        let other_policy = SuppliedSessionPolicy::parse_toml(
            &other,
            br#"schema = "security.supplied-session-policy/v1"
principal_alias = "fixture-principal"
credential_mechanism = "authorization_header"
health_path = "/other/session-health"
health_json_field = "authenticated"
resources = ["/other/private"]
max_session_requests = 3
max_total_response_bytes = 65536
max_response_body_bytes = 16384
max_wall_time_ms = 5000
"#,
        )
        .unwrap();
        let error = WebAssessmentRuntimeBuilder::new(selected)
            .with_supplied_session_review(
                other_policy,
                SuppliedSessionAuthorization::new("Bearer REDACTED-CANARY").unwrap(),
            )
            .build()
            .err()
            .expect("policy bound to another application must be rejected");
        assert!(matches!(
            error,
            WebAssessmentRuntimeError::SuppliedSessionApplicationMismatch
        ));
    }

    #[cfg(feature = "wordpress-review")]
    #[test]
    fn wordpress_supplied_session_selection_requires_every_runtime_input() {
        let application = url::Url::parse("https://example.test/app/").unwrap();
        let authorization =
            || SuppliedSessionAuthorization::new("Bearer REDACTED-WORDPRESS-CANARY").unwrap();

        let missing_all = WebAssessmentRuntimeBuilder::new(application.clone())
            .with_wordpress_supplied_session()
            .build()
            .err()
            .expect("integration without either child must fail preflight");
        assert!(matches!(
            missing_all,
            WebAssessmentRuntimeError::WordPressSuppliedSessionRequiresInputs
        ));

        let missing_session = WebAssessmentRuntimeBuilder::new(application.clone())
            .with_wordpress_review(WordPressReviewInputs::new(None, None))
            .with_wordpress_discovery()
            .with_wordpress_supplied_session()
            .build()
            .err()
            .expect("WordPress discovery without a supplied session must fail preflight");
        assert!(matches!(
            missing_session,
            WebAssessmentRuntimeError::WordPressSuppliedSessionRequiresInputs
        ));

        let missing_discovery = WebAssessmentRuntimeBuilder::new(application.clone())
            .with_wordpress_review(WordPressReviewInputs::new(None, None))
            .with_supplied_session_review(policy(&application), authorization())
            .with_wordpress_supplied_session()
            .build()
            .err()
            .expect("integration without metadata discovery must fail preflight");
        assert!(matches!(
            missing_discovery,
            WebAssessmentRuntimeError::WordPressSuppliedSessionRequiresInputs
        ));

        let form_application = url::Url::parse("http://127.0.0.1:8123/app/").unwrap();
        let form_policy = form_login_policy(&form_application);
        let form_credential = SuppliedSessionFormCredential::parse_tsv(
            &form_policy,
            b"username\tUSER-RUNTIME-CANARY\npassword\tPASSWORD-RUNTIME-CANARY\n".to_vec(),
        )
        .unwrap();
        WebAssessmentRuntimeBuilder::new(form_application)
            .with_wordpress_review(WordPressReviewInputs::new(None, None))
            .with_wordpress_discovery()
            .with_supplied_session_review(form_policy, form_credential)
            .with_wordpress_supplied_session()
            .build()
            .expect("V3 is a bounded fixed-epoch WordPress session consumer");

        let renewal = renewal_policy(&application);
        let credential =
            SuppliedSessionCookies::parse_tsv(&renewal, b"session\tRENEWAL-WP-CANARY".to_vec(), 0)
                .unwrap();
        let unsupported_renewal = WebAssessmentRuntimeBuilder::new(application.clone())
            .with_wordpress_review(WordPressReviewInputs::new(None, None))
            .with_wordpress_discovery()
            .with_supplied_session_review(renewal, credential)
            .with_wordpress_supplied_session()
            .build()
            .err()
            .expect("V4 renewal must not reach the fixed-epoch WordPress consumer");
        assert!(matches!(
            unsupported_renewal,
            WebAssessmentRuntimeError::WordPressSuppliedSessionUnsupportedPolicy
        ));

        WebAssessmentRuntimeBuilder::new(application.clone())
            .with_wordpress_review(WordPressReviewInputs::new(None, None))
            .with_wordpress_discovery()
            .with_supplied_session_review(policy(&application), authorization())
            .with_wordpress_supplied_session()
            .build()
            .expect("complete integration selection must build");
    }

    #[tokio::test]
    async fn normal_runtime_runs_session_before_anonymous_bfs_and_keeps_bodies_private() {
        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
        let address = listener.local_addr().unwrap();
        let observed = Arc::new(Mutex::new(Vec::<(String, bool, bool)>::new()));
        let server_observed = observed.clone();
        let server = tokio::spawn(async move {
            loop {
                let Ok((mut stream, _)) = listener.accept().await else {
                    break;
                };
                let mut request = Vec::new();
                loop {
                    let mut chunk = [0_u8; 1024];
                    let read = stream.read(&mut chunk).await.unwrap_or(0);
                    if read == 0 {
                        break;
                    }
                    request.extend_from_slice(&chunk[..read]);
                    if request.windows(4).any(|window| window == b"\r\n\r\n")
                        || request.len() > 16 * 1024
                    {
                        break;
                    }
                }
                let text = String::from_utf8_lossy(&request);
                let path = text
                    .lines()
                    .next()
                    .and_then(|line| line.split_ascii_whitespace().nth(1))
                    .unwrap_or("")
                    .to_owned();
                let has_authorization = text.lines().any(|line| {
                    line.eq_ignore_ascii_case("authorization: Bearer SECRET-RUNTIME-CANARY")
                });
                let has_cookie = text
                    .lines()
                    .any(|line| line.to_ascii_lowercase().starts_with("cookie:"));
                server_observed
                    .lock()
                    .await
                    .push((path.clone(), has_authorization, has_cookie));
                let (media_type, body) = match path.as_str() {
                    "/app/session-health" => ("application/json", r#"{"authenticated":true}"#),
                    "/app/private" => ("text/html", "PRIVATE-BODY-MUST-NOT-BE-RETAINED"),
                    _ => ("text/html", "<!doctype html><title>public root</title>"),
                };
                let response = format!(
                    "HTTP/1.1 200 OK\r\nContent-Type: {media_type}\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
                    body.len()
                );
                let _ = stream.write_all(response.as_bytes()).await;
                let _ = stream.shutdown().await;
            }
        });

        let application = url::Url::parse(&format!("http://{address}/app/")).unwrap();
        let mut runtime = WebAssessmentRuntimeBuilder::new(application.clone())
            .with_supplied_session_review(
                policy(&application),
                SuppliedSessionAuthorization::new("Bearer SECRET-RUNTIME-CANARY").unwrap(),
            )
            .build()
            .unwrap();
        let report = runtime.analyze().await.unwrap();
        let audit = report
            .supplied_session_audit()
            .expect("selected child must retain an audit");
        assert_eq!(audit.capability_id(), SUPPLIED_SESSION_CAPABILITY_ID);
        assert_eq!(audit.outcome(), SuppliedSessionAuditOutcome::Complete);
        assert_eq!(audit.coverage(), SuppliedSessionCoverage::Complete);
        assert_eq!(audit.selected_resource_count(), 1);
        assert_eq!(audit.dispatched_resource_count(), 1);
        assert_eq!(audit.committed_resource_count(), 1);
        assert_eq!(audit.dispatched_request_count(), 3);
        assert_eq!(audit.checkpoints().len(), 2);
        assert_eq!(audit.checkpoints()[0].sequence(), 0);
        assert!(audit.checkpoints()[0]
            .evidence_reference()
            .is_some_and(|reference| reference.starts_with(HEALTH_COMMIT_EVIDENCE_PREFIX)));
        assert_eq!(audit.checkpoints()[0].after_subject_count(), 0);
        assert_eq!(
            audit.checkpoints()[0].phase(),
            SuppliedSessionHealthCheckpointPhase::Startup
        );
        assert_eq!(audit.checkpoints()[1].sequence(), 1);
        assert!(audit.checkpoints()[1]
            .evidence_reference()
            .is_some_and(|reference| reference.starts_with(HEALTH_COMMIT_EVIDENCE_PREFIX)));
        assert_eq!(audit.checkpoints()[1].after_subject_count(), 1);
        assert_eq!(
            audit.checkpoints()[1].phase(),
            SuppliedSessionHealthCheckpointPhase::Terminal
        );
        assert_eq!(audit.resources()[0].sequence(), 0);
        assert_eq!(
            audit.resources()[0].outcome(),
            SuppliedSessionResourceOutcome::Committed
        );
        assert_eq!(audit.resources()[0].epoch(), 1);
        let evidence_reference = audit.resources()[0]
            .evidence_reference()
            .expect("committed resource must retain its knowledge receipt");
        assert!(evidence_reference.starts_with(RESOURCE_COMMIT_EVIDENCE_PREFIX));
        let evidence_id = EvidenceId::parse(evidence_reference).unwrap();
        assert_eq!(
            runtime
                .knowledge()
                .inspect_evidence(&evidence_id, |evidence| {
                    evidence.kind() == &EvidenceKind::Authentication
                        && evidence.predicate().namespace() == RESOURCE_COMMIT_EVIDENCE_NAMESPACE
                        && evidence.predicate().name() == RESOURCE_COMMIT_EVIDENCE_PREDICATE
                }),
            Some(true)
        );
        for checkpoint in audit.checkpoints() {
            let evidence_id = EvidenceId::parse(checkpoint.evidence_reference().unwrap()).unwrap();
            assert_eq!(
                runtime
                    .knowledge()
                    .inspect_evidence(&evidence_id, |evidence| {
                        evidence.kind() == &EvidenceKind::Authentication
                            && evidence.predicate().namespace()
                                == RESOURCE_COMMIT_EVIDENCE_NAMESPACE
                            && evidence.predicate().name() == HEALTH_COMMIT_EVIDENCE_PREDICATE
                    }),
                Some(true)
            );
        }
        assert_eq!(
            audit.response_bytes(),
            audit
                .checkpoints()
                .iter()
                .map(WebAssessmentSuppliedSessionCheckpointAudit::response_bytes)
                .chain(
                    audit
                        .resources()
                        .iter()
                        .map(WebAssessmentSuppliedSessionResourceAudit::response_bytes),
                )
                .sum::<u64>()
        );
        let saved = serde_json::to_string(audit).unwrap();
        let direct = serde_json::to_value(audit).unwrap();
        assert_eq!(
            direct.get("schema").and_then(serde_json::Value::as_str),
            Some(SUPPLIED_SESSION_AUDIT_SCHEMA)
        );
        assert!(!direct
            .as_object()
            .unwrap()
            .contains_key("credential_acquisition"));
        assert_eq!(audit.principal_alias(), "fixture-principal");
        assert!(saved.contains(r#""principal_alias":"fixture-principal""#));
        for forbidden in [
            "SECRET-RUNTIME-CANARY",
            "PRIVATE-BODY-MUST-NOT-BE-RETAINED",
            "/app/private",
        ] {
            assert!(!saved.contains(forbidden));
        }

        let observed = observed.lock().await.clone();
        assert!(
            observed.len() >= 4,
            "session plus ordinary root must execute"
        );
        assert_eq!(observed[0], ("/app/session-health".to_owned(), true, false));
        assert_eq!(observed[1], ("/app/private".to_owned(), true, false));
        assert_eq!(observed[2], ("/app/session-health".to_owned(), true, false));
        assert_eq!(observed[3], ("/app/".to_owned(), false, false));
        server.abort();
    }

    #[cfg(feature = "websocket-review")]
    #[tokio::test]
    async fn shared_request_refusal_retains_health_projection_without_claiming_ws_context() {
        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
        let address = listener.local_addr().unwrap();
        let observed = Arc::new(Mutex::new(Vec::<String>::new()));
        let server_observed = Arc::clone(&observed);
        let server = tokio::spawn(async move {
            loop {
                let Ok((mut stream, _)) = listener.accept().await else {
                    break;
                };
                let mut request = Vec::new();
                loop {
                    let mut chunk = [0_u8; 1024];
                    let read = stream.read(&mut chunk).await.unwrap_or(0);
                    if read == 0 {
                        break;
                    }
                    request.extend_from_slice(&chunk[..read]);
                    if request.windows(4).any(|window| window == b"\r\n\r\n")
                        || request.len() > 16 * 1024
                    {
                        break;
                    }
                }
                let text = String::from_utf8_lossy(&request);
                let path = text
                    .lines()
                    .next()
                    .and_then(|line| line.split_ascii_whitespace().nth(1))
                    .unwrap_or("")
                    .to_owned();
                server_observed.lock().await.push(path.clone());
                let (media_type, body) = match path.as_str() {
                    "/app/session-health" => ("application/json", r#"{"authenticated":true}"#),
                    "/app/private" => ("text/html", "PRIVATE-ZERO-ADMISSION-CANARY"),
                    _ => ("text/html", "unexpected"),
                };
                let response = format!(
                    "HTTP/1.1 200 OK\r\nContent-Type: {media_type}\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
                    body.len()
                );
                let _ = stream.write_all(response.as_bytes()).await;
                let _ = stream.shutdown().await;
            }
        });

        let application = url::Url::parse(&format!("http://{address}/app/")).unwrap();
        let endpoint = url::Url::parse(&format!("ws://{address}/app/socket")).unwrap();
        let limits = WebAssessmentLimits::default()
            .with_max_total_requests(2)
            .unwrap();
        let mut runtime = WebAssessmentRuntimeBuilder::new(application.clone())
            .limits(limits)
            .with_supplied_session_review(
                policy(&application),
                SuppliedSessionAuthorization::new("Bearer ZERO-ADMISSION-SECRET-CANARY").unwrap(),
            )
            .with_websocket_review(websocket_policy(&application, &endpoint, 2_000))
            .with_websocket_supplied_session()
            .build()
            .unwrap();
        let report = runtime.analyze().await.unwrap();
        assert!(report
            .completion()
            .reasons()
            .contains(&crate::web_runtime::WebAssessmentIncompleteReason::TotalRequestLimit));

        let session = report.supplied_session_audit().unwrap();
        assert_eq!(session.checkpoints().len(), 1);
        assert_eq!(
            session.checkpoints()[0].outcome(),
            SuppliedSessionHealthOutcome::Healthy
        );
        let websocket = report.websocket_review_audit().unwrap();
        assert_eq!(websocket.request_attempt_count(), 1);
        assert_eq!(websocket.request_admitted_count(), 0);
        assert_eq!(websocket.connection_attempt_count(), 0);
        assert_eq!(websocket.handshake_completed_count(), 0);
        let context = websocket.supplied_session_context().unwrap();
        assert_eq!(
            context.qualification(),
            WebSocketSuppliedSessionQualification::NotEstablished
        );
        assert_eq!(
            context
                .startup_health()
                .map(WebSocketSuppliedSessionHealthAudit::outcome),
            Some("healthy")
        );
        assert!(context.terminal_health().is_none());
        assert!(websocket.is_consistent());

        let diagnostic = format!("{websocket:?}");
        for forbidden in [
            "ZERO-ADMISSION-SECRET-CANARY",
            "PRIVATE-ZERO-ADMISSION-CANARY",
            "/app/private",
            "/app/socket",
        ] {
            assert!(!diagnostic.contains(forbidden));
        }
        assert_eq!(
            observed.lock().await.clone(),
            vec!["/app/session-health".to_owned(), "/app/private".to_owned()]
        );
        server.abort();
    }

    #[cfg(feature = "websocket-review")]
    #[tokio::test]
    async fn completed_combined_ws_prefix_survives_later_ordinary_runtime_failure() {
        const SECRET: &str = "Bearer FAILURE-RECEIPT-SECRET-CANARY";
        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
        let address = listener.local_addr().unwrap();
        let server = tokio::spawn(async move {
            loop {
                let Ok((mut stream, _)) = listener.accept().await else {
                    break;
                };
                tokio::spawn(async move {
                    let mut preview = [0_u8; 4096];
                    let Ok(Ok(preview_len)) =
                        tokio::time::timeout(Duration::from_secs(1), stream.peek(&mut preview))
                            .await
                    else {
                        return;
                    };
                    let preview = String::from_utf8_lossy(&preview[..preview_len]);
                    if preview.starts_with("GET /app/socket HTTP/1.1\r\n") {
                        let accepted = tokio_tungstenite::accept_hdr_async(
                            stream,
                            ExactAuthorizationCallback(SECRET),
                        )
                        .await;
                        if let Ok(mut socket) = accepted {
                            if socket.next().await.is_some() {
                                let _ = socket
                                    .send(tokio_tungstenite::tungstenite::Message::Text(
                                        "expected".into(),
                                    ))
                                    .await;
                            }
                            let _ = socket.close(None).await;
                        }
                        return;
                    }

                    let mut request = Vec::new();
                    loop {
                        let mut chunk = [0_u8; 1024];
                        let read = stream.read(&mut chunk).await.unwrap_or(0);
                        if read == 0 {
                            break;
                        }
                        request.extend_from_slice(&chunk[..read]);
                        if request.windows(4).any(|window| window == b"\r\n\r\n")
                            || request.len() > 16 * 1024
                        {
                            break;
                        }
                    }
                    let text = String::from_utf8_lossy(&request);
                    let path = text
                        .lines()
                        .next()
                        .and_then(|line| line.split_ascii_whitespace().nth(1))
                        .unwrap_or("");
                    if path == "/app/" {
                        let _ = stream.shutdown().await;
                        return;
                    }
                    let (media_type, body) = match path {
                        "/app/session-health" => ("application/json", r#"{"authenticated":true}"#),
                        "/app/private" => ("text/html", "PRIVATE-FAILURE-BODY-CANARY"),
                        _ => ("text/html", "unexpected"),
                    };
                    let response = format!(
                        "HTTP/1.1 200 OK\r\nContent-Type: {media_type}\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
                        body.len()
                    );
                    let _ = stream.write_all(response.as_bytes()).await;
                    let _ = stream.shutdown().await;
                });
            }
        });

        let application = url::Url::parse(&format!("http://{address}/app/")).unwrap();
        let endpoint = url::Url::parse(&format!("ws://{address}/app/socket")).unwrap();
        let mut runtime = WebAssessmentRuntimeBuilder::new(application.clone())
            .with_supplied_session_review(
                policy(&application),
                SuppliedSessionAuthorization::new(SECRET).unwrap(),
            )
            .with_websocket_review(websocket_policy(&application, &endpoint, 2_000))
            .with_websocket_supplied_session()
            .build()
            .unwrap();
        let error = runtime
            .analyze()
            .await
            .expect_err("ordinary root failure must preserve the completed combined prefix");
        let receipt = error.failure_receipt().expect("started failure receipt");

        let session = receipt.supplied_session_audit().unwrap();
        assert_eq!(session.outcome(), SuppliedSessionAuditOutcome::Complete);
        assert_eq!(session.checkpoints().len(), 2);
        let websocket = receipt.websocket_review_audit().unwrap();
        assert_eq!(
            websocket.schema(),
            crate::web_runtime::WEBSOCKET_SUPPLIED_SESSION_AUDIT_SCHEMA
        );
        assert_eq!(websocket.request_attempt_count(), 1);
        assert_eq!(websocket.request_admitted_count(), 1);
        assert_eq!(websocket.handshake_completed_count(), 1);
        assert_eq!(websocket.outbound_message_count(), 1);
        assert_eq!(websocket.inbound_message_count(), 1);
        assert_eq!(websocket.matched_response_count(), 1);
        assert_eq!(
            websocket
                .supplied_session_context()
                .unwrap()
                .qualification(),
            WebSocketSuppliedSessionQualification::ContextQualified
        );
        assert!(websocket.is_consistent());

        let diagnostic = format!("{error:?}{websocket:?}");
        for forbidden in [
            "FAILURE-RECEIPT-SECRET-CANARY",
            "PRIVATE-FAILURE-BODY-CANARY",
            "/app/private",
            "/app/socket",
        ] {
            assert!(!diagnostic.contains(forbidden));
        }
        server.abort();
    }

    #[cfg(feature = "websocket-review")]
    #[tokio::test]
    async fn supplied_session_deadline_bounds_websocket_and_leaves_context_unqualified() {
        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
        let address = listener.local_addr().unwrap();
        let http_observed = Arc::new(Mutex::new(Vec::<(String, bool)>::new()));
        let websocket_authorized = Arc::new(AtomicBool::new(false));
        let server_http_observed = http_observed.clone();
        let server_websocket_authorized = websocket_authorized.clone();
        let server = tokio::spawn(async move {
            loop {
                let Ok((mut stream, _)) = listener.accept().await else {
                    break;
                };
                let observed = server_http_observed.clone();
                let websocket_authorized = server_websocket_authorized.clone();
                tokio::spawn(async move {
                    let mut preview = [0_u8; 4096];
                    let Ok(Ok(preview_len)) =
                        tokio::time::timeout(Duration::from_secs(1), stream.peek(&mut preview))
                            .await
                    else {
                        return;
                    };
                    let preview = String::from_utf8_lossy(&preview[..preview_len]);
                    if preview.starts_with("GET /app/socket HTTP/1.1\r\n") {
                        let accepted = tokio_tungstenite::accept_hdr_async(
                            stream,
                            ObserveAuthorizationCallback {
                                expected: b"Bearer SESSION-DEADLINE-CANARY",
                                observed: websocket_authorized,
                            },
                        )
                        .await;
                        if let Ok(mut socket) = accepted {
                            let _ = socket.next().await;
                            tokio::time::sleep(Duration::from_secs(2)).await;
                        }
                        return;
                    }

                    let mut request = Vec::new();
                    loop {
                        let mut chunk = [0_u8; 1024];
                        let read = stream.read(&mut chunk).await.unwrap_or(0);
                        if read == 0 {
                            break;
                        }
                        request.extend_from_slice(&chunk[..read]);
                        if request.windows(4).any(|window| window == b"\r\n\r\n")
                            || request.len() > 16 * 1024
                        {
                            break;
                        }
                    }
                    let text = String::from_utf8_lossy(&request);
                    let path = text
                        .lines()
                        .next()
                        .and_then(|line| line.split_ascii_whitespace().nth(1))
                        .unwrap_or("")
                        .to_owned();
                    let authorized = text.lines().any(|line| {
                        line.eq_ignore_ascii_case("authorization: Bearer SESSION-DEADLINE-CANARY")
                    });
                    observed.lock().await.push((path.clone(), authorized));
                    let (media_type, body) = match path.as_str() {
                        "/app/session-health" => ("application/json", r#"{"authenticated":true}"#),
                        "/app/private" => ("text/html", "PRIVATE-DEADLINE-BODY"),
                        _ => ("text/html", "<!doctype html><title>public root</title>"),
                    };
                    let response = format!(
                        "HTTP/1.1 200 OK\r\nContent-Type: {media_type}\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
                        body.len()
                    );
                    let _ = stream.write_all(response.as_bytes()).await;
                    let _ = stream.shutdown().await;
                });
            }
        });

        let application = url::Url::parse(&format!("http://{address}/app/")).unwrap();
        let endpoint = url::Url::parse(&format!("ws://{address}/app/socket")).unwrap();
        let mut runtime = WebAssessmentRuntimeBuilder::new(application.clone())
            .with_supplied_session_review(
                policy_with_wall_time(&application, 250),
                SuppliedSessionAuthorization::new("Bearer SESSION-DEADLINE-CANARY").unwrap(),
            )
            .with_websocket_review(websocket_policy(&application, &endpoint, 2_000))
            .with_websocket_supplied_session()
            .build()
            .unwrap();
        let report = runtime.analyze().await.unwrap();
        let session = report.supplied_session_audit().unwrap();
        assert_eq!(session.outcome(), SuppliedSessionAuditOutcome::RuntimeLimit);
        assert_eq!(session.checkpoints().len(), 1);
        assert_eq!(session.committed_resource_count(), 0);
        assert_eq!(
            session.resources()[0].outcome(),
            SuppliedSessionResourceOutcome::HealthUnqualified
        );

        let websocket = report.websocket_review_audit().unwrap();
        assert_eq!(
            websocket.schema(),
            crate::web_runtime::WEBSOCKET_SUPPLIED_SESSION_AUDIT_SCHEMA
        );
        assert_eq!(
            websocket.terminal(),
            crate::web_runtime::WebSocketReviewTerminal::DeadlineReached
        );
        assert_eq!(websocket.request_attempt_count(), 1);
        assert_eq!(websocket.request_admitted_count(), 1);
        assert_eq!(websocket.handshake_completed_count(), 1);
        let context = websocket.supplied_session_context().unwrap();
        assert_eq!(
            context.qualification(),
            WebSocketSuppliedSessionQualification::ContextUnqualified
        );
        assert!(context.startup_health().is_some_and(|health| {
            health.outcome() == "healthy" && health.evidence_reference().is_some()
        }));
        assert_eq!(context.terminal_health(), None);
        assert!(websocket.is_consistent());
        assert!(websocket_authorized.load(Ordering::SeqCst));

        let observed = http_observed.lock().await.clone();
        assert_eq!(
            observed
                .iter()
                .filter(|(path, authorized)| { path == "/app/session-health" && *authorized })
                .count(),
            1,
            "the elapsed child deadline must prevent a terminal-health dispatch"
        );
        assert!(observed
            .iter()
            .any(|(path, authorized)| path == "/app/private" && *authorized));
        assert!(observed
            .iter()
            .any(|(path, authorized)| path == "/app/" && !authorized));
        server.abort();
    }

    #[cfg(feature = "wordpress-review")]
    #[tokio::test]
    async fn wordpress_integration_commits_health_qualified_html_before_anonymous_metadata() {
        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
        let address = listener.local_addr().unwrap();
        let observed = Arc::new(Mutex::new(Vec::<(String, bool)>::new()));
        let server_observed = observed.clone();
        let server = tokio::spawn(async move {
            loop {
                let Ok((mut stream, _)) = listener.accept().await else {
                    break;
                };
                let mut request = Vec::new();
                loop {
                    let mut chunk = [0_u8; 1024];
                    let read = stream.read(&mut chunk).await.unwrap_or(0);
                    if read == 0 {
                        break;
                    }
                    request.extend_from_slice(&chunk[..read]);
                    if request.windows(4).any(|window| window == b"\r\n\r\n")
                        || request.len() > 16 * 1024
                    {
                        break;
                    }
                }
                let request = String::from_utf8_lossy(&request);
                let request_line = request.lines().next().unwrap_or_default();
                let method = request_line
                    .split_ascii_whitespace()
                    .next()
                    .unwrap_or_default();
                let path = request_line
                    .split_ascii_whitespace()
                    .nth(1)
                    .unwrap_or_default()
                    .to_owned();
                let authorized = request.lines().any(|line| {
                    line.eq_ignore_ascii_case("authorization: Bearer WORDPRESS-SESSION-CANARY")
                });
                server_observed
                    .lock()
                    .await
                    .push((path.clone(), authorized));
                let (media_type, body) = match path.as_str() {
                    "/app/" => (
                        "text/html",
                        r#"<meta name="generator" content="WordPress 6.9.4">
                           <link rel="https://api.w.org/" href="/app/wp-json/">
                           <link rel="stylesheet" href="/app/wp-content/themes/session-theme/style.css">"#,
                    ),
                    "/app/session-health" => ("application/json", r#"{"authenticated":true}"#),
                    "/app/private" => (
                        "text/html",
                        r#"<script src="/app/wp-content/plugins/private-component/assets/site.js"></script>
                           <link rel="stylesheet" href="/app/wp-content/plugins/private-component/assets/site.css">"#,
                    ),
                    "/app/wp-json/" => ("application/json", r#"{"namespaces":["wp/v2"]}"#),
                    "/app/wp-content/themes/session-theme/style.css" => (
                        "text/css",
                        "/*\nTheme Name: Session Theme\nVersion: 1.5\n*/\n",
                    ),
                    "/app/wp-content/plugins/private-component/readme.txt" => (
                        "text/plain",
                        "=== Private Component ===\nStable tag: 9.9.9\n",
                    ),
                    _ => ("text/plain", "not found"),
                };
                let status = if body == "not found" {
                    "404 Not Found"
                } else {
                    "200 OK"
                };
                let response = format!(
                    "HTTP/1.1 {status}\r\nContent-Type: {media_type}\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
                    body.len()
                );
                let _ = stream.write_all(response.as_bytes()).await;
                let _ = stream.shutdown().await;
                if method.is_empty() {
                    break;
                }
            }
        });

        let application = url::Url::parse(&format!("http://{address}/app/")).unwrap();
        let mut runtime = WebAssessmentRuntimeBuilder::new(application.clone())
            .with_wordpress_review(WordPressReviewInputs::new(None, None))
            .with_wordpress_discovery()
            .with_supplied_session_review(
                policy(&application),
                SuppliedSessionAuthorization::new("Bearer WORDPRESS-SESSION-CANARY").unwrap(),
            )
            .with_wordpress_supplied_session()
            .build()
            .unwrap();
        let report = runtime.analyze().await.unwrap();
        let session = report.supplied_session_audit().unwrap();
        assert_eq!(session.outcome(), SuppliedSessionAuditOutcome::Complete);
        assert_eq!(session.committed_resource_count(), 1);
        let wordpress = report.wordpress_review_audit().unwrap();
        let discovery = wordpress.discovery().unwrap();
        let pages = discovery.supplied_session_pages().unwrap();
        assert_eq!(pages.selected_count(), 1);
        assert_eq!(pages.committed_count(), 1);
        assert_eq!(pages.accepted_count(), 1);
        assert_eq!(pages.rejected_count(), 0);
        assert_eq!(pages.not_established_count(), 0);
        assert_eq!(pages.not_evaluated_count(), 0);
        assert_eq!(pages.pages().len(), 1);
        let page = &pages.pages()[0];
        assert_eq!(page.association().as_str(), "accepted");
        assert_eq!(page.outcome().as_str(), "accepted");
        assert!(page.resource_evidence_reference().is_some());
        assert_eq!(page.evidence_ids().len(), 1);

        let private_source = discovery
            .sources()
            .iter()
            .find(|source| source.component_slug() == Some("private-component"))
            .expect("health-qualified private page must nominate one plugin readme");
        assert!(private_source.source_page_references().is_empty());
        assert_eq!(
            private_source.source_supplied_session_page_references(),
            [page.context_page_reference()]
        );
        assert!(discovery
            .sources()
            .iter()
            .filter(|source| source.component_slug() != Some("private-component"))
            .all(|source| source.source_supplied_session_page_references().is_empty()));

        let observed = observed.lock().await.clone();
        let root_index = observed
            .iter()
            .position(|(path, authorized)| path == "/app/" && !authorized)
            .unwrap();
        let startup_index = observed
            .iter()
            .position(|(path, authorized)| path == "/app/session-health" && *authorized)
            .unwrap();
        let metadata_index = observed
            .iter()
            .position(|(path, authorized)| {
                path == "/app/wp-content/plugins/private-component/readme.txt" && !authorized
            })
            .unwrap();
        assert!(root_index < startup_index && startup_index < metadata_index);
        assert_eq!(
            observed
                .iter()
                .filter(|(path, _)| path == "/app/private")
                .count(),
            1
        );
        assert!(observed
            .iter()
            .all(|(path, authorized)| { !path.starts_with("/app/wp-content/") || !authorized }));
        server.abort();
    }

    #[tokio::test]
    async fn bounded_form_login_uses_one_stateful_attempt_then_existing_health_oracle() {
        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
        let address = listener.local_addr().unwrap();
        let observed = Arc::new(Mutex::new(
            Vec::<(String, String, bool, bool, bool, String)>::new(),
        ));
        let server_observed = observed.clone();
        let server = tokio::spawn(async move {
            loop {
                let Ok((mut stream, _)) = listener.accept().await else {
                    break;
                };
                let mut request = Vec::new();
                let header_end = loop {
                    if let Some(offset) =
                        request.windows(4).position(|window| window == b"\r\n\r\n")
                    {
                        break offset + 4;
                    }
                    let mut chunk = [0_u8; 1024];
                    let read = stream.read(&mut chunk).await.unwrap_or(0);
                    if read == 0 || request.len() > 16 * 1024 {
                        break request.len();
                    }
                    request.extend_from_slice(&chunk[..read]);
                };
                let header_text = String::from_utf8_lossy(&request[..header_end]).into_owned();
                let content_length = header_text
                    .lines()
                    .find_map(|line| {
                        line.strip_prefix("content-length: ")
                            .or_else(|| line.strip_prefix("Content-Length: "))
                    })
                    .and_then(|value| value.trim().parse::<usize>().ok())
                    .unwrap_or(0);
                while request.len() < header_end.saturating_add(content_length) {
                    let mut chunk = [0_u8; 1024];
                    let read = stream.read(&mut chunk).await.unwrap_or(0);
                    if read == 0 || request.len() > 24 * 1024 {
                        break;
                    }
                    request.extend_from_slice(&chunk[..read]);
                }
                let request_line = header_text.lines().next().unwrap_or("");
                let mut parts = request_line.split_ascii_whitespace();
                let method = parts.next().unwrap_or("").to_owned();
                let path = parts.next().unwrap_or("").to_owned();
                let has_cookie = header_text.lines().any(|line| {
                    line.eq_ignore_ascii_case("cookie: session=SESSION-RUNTIME-CANARY")
                });
                let has_authorization = header_text
                    .lines()
                    .any(|line| line.to_ascii_lowercase().starts_with("authorization:"));
                let is_form_encoded = header_text.lines().any(|line| {
                    line.eq_ignore_ascii_case("content-type: application/x-www-form-urlencoded")
                });
                let body = String::from_utf8_lossy(&request[header_end..]).into_owned();
                server_observed.lock().await.push((
                    method.clone(),
                    path.clone(),
                    has_cookie,
                    has_authorization,
                    is_form_encoded,
                    body.clone(),
                ));

                let (status, media_type, extra_headers, response_body) =
                    match (method.as_str(), path.as_str()) {
                        ("GET", "/app/login") => (
                            "200 OK",
                            "text/html",
                            "",
                            concat!(
                            "<form action=\"/app/login\" method=\"post\">",
                            "<input name=\"user\">",
                            "<input type=\"password\" name=\"pass\">",
                            "<input type=\"hidden\" name=\"csrf\" value=\"CSRF-RUNTIME-CANARY\">",
                            "</form>"
                        ),
                        ),
                        ("POST", "/app/login") => (
                            "200 OK",
                            "application/json",
                            concat!(
                                "Set-Cookie: session=SESSION-RUNTIME-CANARY; ",
                                "Path=/app/; HttpOnly; SameSite=Lax\r\n"
                            ),
                            r#"{"login":"received"}"#,
                        ),
                        ("GET", "/app/session-health") if has_cookie => (
                            "200 OK",
                            "application/json",
                            "",
                            r#"{"authenticated":true}"#,
                        ),
                        ("GET", "/app/session-health") => (
                            "200 OK",
                            "application/json",
                            "",
                            r#"{"authenticated":false}"#,
                        ),
                        ("GET", "/app/private") if has_cookie => (
                            "200 OK",
                            "text/html",
                            "",
                            "PRIVATE-FORM-LOGIN-BODY-MUST-NOT-BE-RETAINED",
                        ),
                        _ => ("200 OK", "text/html", "", "<title>public root</title>"),
                    };
                let response = format!(
                    "HTTP/1.1 {status}\r\nContent-Type: {media_type}\r\n{extra_headers}Content-Length: {}\r\nConnection: close\r\n\r\n{response_body}",
                    response_body.len()
                );
                let _ = stream.write_all(response.as_bytes()).await;
                let _ = stream.shutdown().await;
            }
        });

        let application = url::Url::parse(&format!("http://{address}/app/")).unwrap();
        let policy = form_login_policy(&application);
        let credential = SuppliedSessionFormCredential::parse_tsv(
            &policy,
            b"username\tUSER-RUNTIME-CANARY\npassword\tPASSWORD-RUNTIME-CANARY\n".to_vec(),
        )
        .unwrap();
        let mut runtime = WebAssessmentRuntimeBuilder::new(application)
            .with_supplied_session_review(policy, credential)
            .build()
            .unwrap();
        let report = runtime.analyze().await.unwrap();
        let audit = report.supplied_session_audit().unwrap();
        assert_eq!(audit.schema(), SUPPLIED_SESSION_FORM_LOGIN_AUDIT_SCHEMA);
        assert_eq!(
            audit.credential_acquisition(),
            SuppliedSessionCredentialAcquisition::BoundedFormLogin
        );
        assert_eq!(audit.outcome(), SuppliedSessionAuditOutcome::Complete);
        assert_eq!(audit.coverage(), SuppliedSessionCoverage::Complete);
        assert_eq!(audit.dispatched_request_count(), 5);
        assert_eq!(audit.committed_resource_count(), 1);
        let login = audit.login().unwrap();
        assert_eq!(login.max_attempts(), 1);
        assert_eq!(login.attempt_count(), 1);
        assert!(login.page_dispatched());
        assert_eq!(
            login.form_outcome(),
            SuppliedSessionLoginFormOutcome::Matched
        );
        assert_eq!(login.form_error_code(), None);
        assert!(login.submit_dispatched());
        assert_eq!(
            login.submit_outcome(),
            SuppliedSessionLoginSubmitOutcome::CookieAcquired
        );
        assert_eq!(login.acquired_cookie_count(), 1);
        assert_eq!(login.initial_epoch(), 0);
        assert_eq!(login.final_epoch(), 1);
        assert!(!login.pre_session_cookie_applied());
        let lifecycle = audit.cookie_lifecycle().unwrap();
        assert_eq!(lifecycle.initial_epoch(), 0);
        assert_eq!(lifecycle.final_epoch(), 1);
        assert_eq!(lifecycle.updates_applied(), 0);
        assert_eq!(report.usage().active_verifications(), 1);
        assert_eq!(
            audit.response_bytes(),
            login
                .response_bytes()
                .saturating_add(
                    audit
                        .checkpoints()
                        .iter()
                        .map(WebAssessmentSuppliedSessionCheckpointAudit::response_bytes)
                        .sum::<u64>()
                )
                .saturating_add(
                    audit
                        .resources()
                        .iter()
                        .map(WebAssessmentSuppliedSessionResourceAudit::response_bytes)
                        .sum::<u64>()
                )
        );

        let observed = observed.lock().await.clone();
        assert!(
            observed.len() >= 6,
            "session child plus public root must run"
        );
        assert_eq!(observed[0].0, "GET");
        assert_eq!(observed[0].1, "/app/login");
        assert!(!observed[0].2 && !observed[0].3 && !observed[0].4);
        assert_eq!(observed[1].0, "POST");
        assert_eq!(observed[1].1, "/app/login");
        assert!(!observed[1].2 && !observed[1].3 && observed[1].4);
        assert_eq!(
            observed[1].5,
            "csrf=CSRF-RUNTIME-CANARY&user=USER-RUNTIME-CANARY&pass=PASSWORD-RUNTIME-CANARY"
        );
        assert_eq!(observed[2].1, "/app/session-health");
        assert!(observed[2].2 && !observed[2].3);
        assert_eq!(observed[3].1, "/app/private");
        assert!(observed[3].2 && !observed[3].3);
        assert_eq!(observed[4].1, "/app/session-health");
        assert!(observed[4].2 && !observed[4].3);
        assert_eq!(observed[5].1, "/app/");
        assert!(!observed[5].2 && !observed[5].3);
        assert_eq!(
            observed
                .iter()
                .filter(|request| request.0 == "POST" && request.1 == "/app/login")
                .count(),
            1
        );

        let saved = serde_json::to_string(audit).unwrap();
        let direct = serde_json::to_value(audit).unwrap();
        assert_eq!(
            direct
                .get("credential_acquisition")
                .and_then(serde_json::Value::as_str),
            Some("bounded_form_login")
        );
        for forbidden in [
            "USER-RUNTIME-CANARY",
            "PASSWORD-RUNTIME-CANARY",
            "CSRF-RUNTIME-CANARY",
            "SESSION-RUNTIME-CANARY",
            "PRIVATE-FORM-LOGIN-BODY-MUST-NOT-BE-RETAINED",
            "/app/login",
            "/app/private",
        ] {
            assert!(!saved.contains(forbidden));
        }
        server.abort();
    }

    async fn run_cookie_update_fixture(
        set_cookie: &'static str,
        update_path: &'static str,
    ) -> (WebAssessmentSuppliedSessionAudit, Vec<(String, bool, bool)>) {
        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
        let address = listener.local_addr().unwrap();
        let observed = Arc::new(Mutex::new(Vec::<(String, bool, bool)>::new()));
        let server_observed = observed.clone();
        let server = tokio::spawn(async move {
            loop {
                let Ok((mut stream, _)) = listener.accept().await else {
                    break;
                };
                let mut request = Vec::new();
                loop {
                    let mut chunk = [0_u8; 1024];
                    let read = stream.read(&mut chunk).await.unwrap_or(0);
                    if read == 0 {
                        break;
                    }
                    request.extend_from_slice(&chunk[..read]);
                    if request.windows(4).any(|window| window == b"\r\n\r\n")
                        || request.len() > 16 * 1024
                    {
                        break;
                    }
                }
                let text = String::from_utf8_lossy(&request);
                let path = text
                    .lines()
                    .next()
                    .and_then(|line| line.split_ascii_whitespace().nth(1))
                    .unwrap_or("")
                    .to_owned();
                let exact_cookie = text
                    .lines()
                    .any(|line| line.eq_ignore_ascii_case("cookie: session=COOKIE-RUNTIME-CANARY"));
                let has_authorization = text
                    .lines()
                    .any(|line| line.to_ascii_lowercase().starts_with("authorization:"));
                server_observed
                    .lock()
                    .await
                    .push((path.clone(), exact_cookie, has_authorization));
                let (media_type, body) = match path.as_str() {
                    "/app/session-health" => ("application/json", r#"{"authenticated":true}"#),
                    "/app/private" => ("text/html", "COOKIE-PRIVATE-BODY-MUST-NOT-BE-RETAINED"),
                    _ => ("text/html", "<title>public root</title>"),
                };
                let update = if path == update_path { set_cookie } else { "" };
                let response = format!(
                    "HTTP/1.1 200 OK\r\nContent-Type: {media_type}\r\n{update}Content-Length: {}\r\nConnection: close\r\n\r\n{body}",
                    body.len()
                );
                let _ = stream.write_all(response.as_bytes()).await;
                let _ = stream.shutdown().await;
            }
        });

        let application = url::Url::parse(&format!("http://{address}/app/")).unwrap();
        let policy = cookie_policy(&application);
        let cookies = cookie_credential(&policy);
        let mut runtime = WebAssessmentRuntimeBuilder::new(application)
            .with_supplied_session_review(policy, cookies)
            .build()
            .unwrap();
        let report = runtime.analyze().await.unwrap();
        let audit = report.supplied_session_audit().unwrap().clone();
        let observed = observed.lock().await.clone();
        server.abort();
        (audit, observed)
    }

    #[tokio::test]
    async fn selected_cookie_update_stops_before_following_health_and_is_value_free() {
        let (audit, observed) = run_cookie_update_fixture(
            "Set-Cookie: session=ROTATED-SECRET; Path=/app/\r\n",
            "/app/private",
        )
        .await;
        assert_eq!(audit.schema(), SUPPLIED_SESSION_COOKIE_AUDIT_SCHEMA);
        assert_eq!(
            audit.outcome(),
            SuppliedSessionAuditOutcome::CredentialUpdateRequired
        );
        assert_eq!(audit.coverage(), SuppliedSessionCoverage::None);
        assert_eq!(audit.dispatched_request_count(), 2);
        assert_eq!(audit.checkpoints().len(), 1);
        assert_eq!(audit.resources().len(), 1);
        assert_eq!(
            audit.resources()[0].outcome(),
            SuppliedSessionResourceOutcome::HealthUnqualified
        );
        let lifecycle = audit.cookie_lifecycle().unwrap();
        assert_eq!(lifecycle.selected_update_response_count(), 1);
        assert_eq!(lifecycle.unselected_update_response_count(), 0);
        assert_eq!(lifecycle.update_classification_failure_count(), 0);
        assert_eq!(lifecycle.initial_epoch(), 1);
        assert_eq!(lifecycle.final_epoch(), 1);
        assert_eq!(lifecycle.updates_applied(), 0);
        assert_eq!(observed[0], ("/app/session-health".to_owned(), true, false));
        assert_eq!(observed[1], ("/app/private".to_owned(), true, false));
        assert!(observed
            .iter()
            .skip(2)
            .all(|(_, has_cookie, _)| !has_cookie));
        let saved = serde_json::to_string(&audit).unwrap();
        let direct = serde_json::to_value(&audit).unwrap();
        assert_eq!(
            direct.get("schema").and_then(serde_json::Value::as_str),
            Some(SUPPLIED_SESSION_COOKIE_AUDIT_SCHEMA)
        );
        assert!(!direct
            .as_object()
            .unwrap()
            .contains_key("credential_acquisition"));
        for forbidden in [
            "COOKIE-RUNTIME-CANARY",
            "ROTATED-SECRET",
            "COOKIE-PRIVATE-BODY-MUST-NOT-BE-RETAINED",
        ] {
            assert!(!saved.contains(forbidden));
        }
    }

    #[tokio::test]
    async fn unselected_cookie_update_does_not_mutate_or_stop_the_session() {
        let (audit, observed) =
            run_cookie_update_fixture("Set-Cookie: analytics=OPAQUE; Path=/\r\n", "/app/private")
                .await;
        assert_eq!(audit.outcome(), SuppliedSessionAuditOutcome::Complete);
        assert_eq!(audit.coverage(), SuppliedSessionCoverage::Complete);
        assert_eq!(audit.dispatched_request_count(), 3);
        assert_eq!(audit.checkpoints().len(), 2);
        assert_eq!(audit.committed_resource_count(), 1);
        let lifecycle = audit.cookie_lifecycle().unwrap();
        assert_eq!(lifecycle.selected_update_response_count(), 0);
        assert_eq!(lifecycle.unselected_update_response_count(), 1);
        assert_eq!(lifecycle.update_classification_failure_count(), 0);
        assert_eq!(lifecycle.updates_applied(), 0);
        assert_eq!(
            &observed[..3],
            &[
                ("/app/session-health".to_owned(), true, false),
                ("/app/private".to_owned(), true, false),
                ("/app/session-health".to_owned(), true, false),
            ]
        );
    }

    #[tokio::test]
    async fn selected_startup_cookie_update_stops_before_any_resource() {
        let (audit, observed) = run_cookie_update_fixture(
            "Set-Cookie: session=ROTATED-AT-STARTUP; Path=/app/\r\n",
            "/app/session-health",
        )
        .await;
        assert_eq!(
            audit.outcome(),
            SuppliedSessionAuditOutcome::CredentialUpdateRequired
        );
        assert_eq!(audit.coverage(), SuppliedSessionCoverage::None);
        assert_eq!(audit.dispatched_request_count(), 1);
        assert_eq!(audit.dispatched_resource_count(), 0);
        assert_eq!(audit.committed_resource_count(), 0);
        assert_eq!(audit.checkpoints().len(), 1);
        assert!(audit
            .resources()
            .iter()
            .all(|resource| resource.outcome() == SuppliedSessionResourceOutcome::NotDispatched));
        let lifecycle = audit.cookie_lifecycle().unwrap();
        assert_eq!(lifecycle.selected_update_response_count(), 1);
        assert_eq!(lifecycle.update_classification_failure_count(), 0);
        assert_eq!(lifecycle.updates_applied(), 0);
        assert_eq!(observed[0], ("/app/session-health".to_owned(), true, false));
        assert!(observed
            .iter()
            .skip(1)
            .all(|(_, has_cookie, has_authorization)| !has_cookie && !has_authorization));
        assert!(observed.iter().any(|(path, _, _)| path == "/app/"));
        assert!(!serde_json::to_string(&audit)
            .unwrap()
            .contains("ROTATED-AT-STARTUP"));
    }

    #[tokio::test]
    async fn unusable_cookie_update_stops_without_guessing_selected_names() {
        let (audit, observed) = run_cookie_update_fixture(
            "Set-Cookie: bad name=UNUSABLE-COOKIE-CANARY; Path=/app/\r\n",
            "/app/private",
        )
        .await;
        assert_eq!(
            audit.outcome(),
            SuppliedSessionAuditOutcome::CredentialUpdateUnusable
        );
        assert_eq!(audit.coverage(), SuppliedSessionCoverage::None);
        assert_eq!(audit.dispatched_request_count(), 2);
        assert_eq!(audit.dispatched_resource_count(), 1);
        assert_eq!(audit.committed_resource_count(), 0);
        assert_eq!(
            audit.resources()[0].outcome(),
            SuppliedSessionResourceOutcome::HealthUnqualified
        );
        let lifecycle = audit.cookie_lifecycle().unwrap();
        assert_eq!(lifecycle.selected_update_response_count(), 0);
        assert_eq!(lifecycle.unselected_update_response_count(), 0);
        assert_eq!(lifecycle.update_classification_failure_count(), 1);
        assert_eq!(lifecycle.updates_applied(), 0);
        assert_eq!(
            &observed[..2],
            &[
                ("/app/session-health".to_owned(), true, false),
                ("/app/private".to_owned(), true, false),
            ]
        );
        assert!(!serde_json::to_string(&audit)
            .unwrap()
            .contains("UNUSABLE-COOKIE-CANARY"));
    }

    #[tokio::test]
    async fn unhealthy_post_resource_checkpoint_prevents_authenticated_coverage() {
        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
        let address = listener.local_addr().unwrap();
        let observed = Arc::new(Mutex::new(Vec::<(String, bool)>::new()));
        let health_count = Arc::new(Mutex::new(0_u8));
        let server_observed = observed.clone();
        let server_health_count = health_count.clone();
        let server = tokio::spawn(async move {
            loop {
                let Ok((mut stream, _)) = listener.accept().await else {
                    break;
                };
                let mut request = Vec::new();
                loop {
                    let mut chunk = [0_u8; 1024];
                    let read = stream.read(&mut chunk).await.unwrap_or(0);
                    if read == 0 {
                        break;
                    }
                    request.extend_from_slice(&chunk[..read]);
                    if request.windows(4).any(|window| window == b"\r\n\r\n")
                        || request.len() > 16 * 1024
                    {
                        break;
                    }
                }
                let text = String::from_utf8_lossy(&request);
                let path = text
                    .lines()
                    .next()
                    .and_then(|line| line.split_ascii_whitespace().nth(1))
                    .unwrap_or("")
                    .to_owned();
                let authorized = text.lines().any(|line| {
                    line.eq_ignore_ascii_case("authorization: Bearer HEALTH-LOSS-CANARY")
                });
                server_observed
                    .lock()
                    .await
                    .push((path.clone(), authorized));
                let (media_type, body) = match path.as_str() {
                    "/app/session-health" => {
                        let mut count = server_health_count.lock().await;
                        *count = count.saturating_add(1);
                        if *count == 1 {
                            ("application/json", r#"{"authenticated":true}"#)
                        } else {
                            ("application/json", r#"{"authenticated":false}"#)
                        }
                    },
                    "/app/private" => (
                        "text/html",
                        "<form>LOGIN-PAGE-BODY-MUST-NOT-BE-RETAINED</form>",
                    ),
                    _ => ("text/html", "<!doctype html><title>public root</title>"),
                };
                let response = format!(
                    "HTTP/1.1 200 OK\r\nContent-Type: {media_type}\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
                    body.len()
                );
                let _ = stream.write_all(response.as_bytes()).await;
                let _ = stream.shutdown().await;
            }
        });

        let application = url::Url::parse(&format!("http://{address}/app/")).unwrap();
        let mut runtime = WebAssessmentRuntimeBuilder::new(application.clone())
            .with_supplied_session_review(
                policy(&application),
                SuppliedSessionAuthorization::new("Bearer HEALTH-LOSS-CANARY").unwrap(),
            )
            .build()
            .unwrap();
        let report = runtime.analyze().await.unwrap();
        let audit = report.supplied_session_audit().unwrap();
        assert_eq!(audit.outcome(), SuppliedSessionAuditOutcome::SessionLost);
        assert_eq!(audit.coverage(), SuppliedSessionCoverage::None);
        assert_eq!(audit.selected_resource_count(), 1);
        assert_eq!(audit.dispatched_resource_count(), 1);
        assert_eq!(audit.committed_resource_count(), 0);
        assert_eq!(audit.dispatched_request_count(), 3);
        assert_eq!(audit.checkpoints().len(), 2);
        assert_eq!(
            audit.checkpoints()[0].outcome(),
            SuppliedSessionHealthOutcome::Healthy
        );
        assert_eq!(
            audit.checkpoints()[1].outcome(),
            SuppliedSessionHealthOutcome::Unhealthy
        );
        assert_eq!(audit.resources().len(), 1);
        assert_eq!(
            audit.resources()[0].outcome(),
            SuppliedSessionResourceOutcome::HealthUnqualified
        );
        assert_eq!(audit.resources()[0].status(), Some(200));
        let evidence_reference = audit.resources()[0]
            .evidence_reference()
            .expect("observed but health-unqualified response keeps a value-safe receipt");
        let evidence_id = EvidenceId::parse(evidence_reference).unwrap();
        assert_eq!(
            runtime
                .knowledge()
                .inspect_evidence(&evidence_id, |evidence| {
                    evidence.kind() == &EvidenceKind::Authentication
                        && evidence.predicate().namespace() == RESOURCE_COMMIT_EVIDENCE_NAMESPACE
                        && evidence.predicate().name()
                            == RESOURCE_HEALTH_UNQUALIFIED_EVIDENCE_PREDICATE
                }),
            Some(true)
        );
        let saved = serde_json::to_string(audit).unwrap();
        for forbidden in [
            "HEALTH-LOSS-CANARY",
            "LOGIN-PAGE-BODY-MUST-NOT-BE-RETAINED",
            "/app/private",
        ] {
            assert!(!saved.contains(forbidden));
        }

        let observed = observed.lock().await.clone();
        assert_eq!(
            &observed[..3],
            &[
                ("/app/session-health".to_owned(), true),
                ("/app/private".to_owned(), true),
                ("/app/session-health".to_owned(), true),
            ]
        );
        server.abort();
    }

    #[tokio::test]
    async fn hostile_resource_redirect_is_not_followed_or_committed() {
        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
        let address = listener.local_addr().unwrap();
        let observed = Arc::new(Mutex::new(Vec::<String>::new()));
        let server_observed = observed.clone();
        let server = tokio::spawn(async move {
            loop {
                let Ok((mut stream, _)) = listener.accept().await else {
                    break;
                };
                let mut request = Vec::new();
                loop {
                    let mut chunk = [0_u8; 1024];
                    let read = stream.read(&mut chunk).await.unwrap_or(0);
                    if read == 0 {
                        break;
                    }
                    request.extend_from_slice(&chunk[..read]);
                    if request.windows(4).any(|window| window == b"\r\n\r\n")
                        || request.len() > 16 * 1024
                    {
                        break;
                    }
                }
                let text = String::from_utf8_lossy(&request);
                let path = text
                    .lines()
                    .next()
                    .and_then(|line| line.split_ascii_whitespace().nth(1))
                    .unwrap_or("")
                    .to_owned();
                server_observed.lock().await.push(path.clone());
                let response = match path.as_str() {
                    "/app/session-health" => concat!(
                        "HTTP/1.1 200 OK\r\n",
                        "Content-Type: application/json\r\n",
                        "Content-Length: 22\r\n",
                        "Connection: close\r\n\r\n",
                        "{\"authenticated\":true}"
                    )
                    .to_owned(),
                    "/app/private" => concat!(
                        "HTTP/1.1 302 Found\r\n",
                        "Location: /app/redirect-sink\r\n",
                        "Content-Length: 0\r\n",
                        "Connection: close\r\n\r\n"
                    )
                    .to_owned(),
                    "/app/redirect-sink" => concat!(
                        "HTTP/1.1 200 OK\r\n",
                        "Content-Type: text/html\r\n",
                        "Content-Length: 21\r\n",
                        "Connection: close\r\n\r\n",
                        "REDIRECT-WAS-FOLLOWED"
                    )
                    .to_owned(),
                    _ => concat!(
                        "HTTP/1.1 200 OK\r\n",
                        "Content-Type: text/html\r\n",
                        "Content-Length: 19\r\n",
                        "Connection: close\r\n\r\n",
                        "<title>root</title>"
                    )
                    .to_owned(),
                };
                let _ = stream.write_all(response.as_bytes()).await;
                let _ = stream.shutdown().await;
            }
        });

        let application = url::Url::parse(&format!("http://{address}/app/")).unwrap();
        let mut runtime = WebAssessmentRuntimeBuilder::new(application.clone())
            .with_supplied_session_review(
                policy(&application),
                SuppliedSessionAuthorization::new("Bearer REDIRECT-TEST-CANARY").unwrap(),
            )
            .build()
            .unwrap();
        let report = runtime.analyze().await.unwrap();
        let audit = report.supplied_session_audit().unwrap();
        assert_eq!(
            audit.outcome(),
            SuppliedSessionAuditOutcome::ResourceUnavailable
        );
        assert_eq!(audit.coverage(), SuppliedSessionCoverage::None);
        assert_eq!(audit.dispatched_request_count(), 2);
        assert_eq!(audit.checkpoints().len(), 1);
        assert_eq!(audit.resources().len(), 1);
        assert_eq!(
            audit.resources()[0].outcome(),
            SuppliedSessionResourceOutcome::RedirectRefused
        );
        assert_eq!(audit.resources()[0].status(), Some(302));
        assert_eq!(audit.resources()[0].evidence_reference(), None);

        let observed = observed.lock().await.clone();
        assert!(observed.iter().any(|path| path == "/app/private"));
        assert!(
            observed.iter().all(|path| path != "/app/redirect-sink"),
            "the session client must never follow even a same-origin Location"
        );
        server.abort();
    }

    #[tokio::test]
    async fn pre_cancelled_parent_dispatches_nothing_and_commits_no_session_evidence() {
        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
        let address = listener.local_addr().unwrap();
        let application = url::Url::parse(&format!("http://{address}/app/")).unwrap();
        let cancellation = tokio_util::sync::CancellationToken::new();
        cancellation.cancel();
        let mut runtime = WebAssessmentRuntimeBuilder::new(application.clone())
            .cancellation_token(cancellation)
            .with_supplied_session_review(
                policy(&application),
                SuppliedSessionAuthorization::new("Bearer CANCELLED-TEST-CANARY").unwrap(),
            )
            .build()
            .unwrap();

        let report = runtime.analyze().await.unwrap();
        let audit = report.supplied_session_audit().unwrap();
        assert_eq!(audit.outcome(), SuppliedSessionAuditOutcome::Cancelled);
        assert_eq!(audit.coverage(), SuppliedSessionCoverage::None);
        assert_eq!(audit.dispatched_request_count(), 0);
        assert_eq!(audit.dispatched_resource_count(), 0);
        assert_eq!(audit.committed_resource_count(), 0);
        assert_eq!(audit.response_bytes(), 0);
        assert!(audit.checkpoints().is_empty());
        assert_eq!(audit.resources().len(), 1);
        assert_eq!(
            audit.resources()[0].outcome(),
            SuppliedSessionResourceOutcome::NotDispatched
        );
        assert_eq!(audit.resources()[0].evidence_reference(), None);
        assert_eq!(runtime.knowledge().stats().evidence, 0);
        assert_eq!(report.usage().total_requests(), 0);
        assert!(report.transport().is_empty());

        let no_connection =
            tokio::time::timeout(Duration::from_millis(50), listener.accept()).await;
        assert!(
            no_connection.is_err(),
            "pre-cancelled authority must not open a socket"
        );
    }
}