agl 23.0.0 → 24.0.0

package/ts/classes.controller.ts

@@ -12,6 +12,21 @@ import {
   controllerBuiltinCommands,
   controllerMaxToolEventBytes,
   controllerMaxLiveMessageEventBytes,
+  controllerBrowserTransportEventContentType,
+  controllerBrowserTransportMaximumActiveAcknowledgements,
+  controllerBrowserTransportMaximumFrameBytes,
+  controllerBrowserTransportMaximumJsonBytes,
+  controllerBrowserTransportMaximumPendingEventBytes,
+  controllerBrowserTransportMaximumPendingEvents,
+  controllerBrowserTransportMaximumPendingOperations,
+  controllerBrowserTransportMaximumQueuedOperationBytes,
+  controllerBrowserTransportMaximumRecoveryAttempts,
+  controllerBrowserTransportOperationContentType,
+  controllerBrowserTransportPairOpenTimeoutMs,
+  controllerBrowserTransportProtocol,
+  controllerBrowserTransportRecoveryGraceMs,
+  decodeControllerBrowserTransportPacket,
+  encodeControllerBrowserTransportPacket,
   controllerLiveMessageDeltaTargetBytes,
   controllerInitialMessageBundleLimit,
   controllerMaximumTranscriptBytes,
@@ -95,8 +110,15 @@ import {
   type IReq_ControllerBrowserViewOpen,
   type IReq_ControllerBrowserViewActivate,
   type IReq_ControllerBrowserViewClose,
-  type IReq_ControllerBrowserViewOperate,
-  type IReq_ControllerBrowserViewEvent,
+  type IReq_ControllerBrowserViewRecover,
+  type IControllerBrowserFrame,
+  type IControllerBrowserFrameMetadata,
+  type IControllerBrowserViewState,
+  type IControllerBrowserOperationPacket,
+  type IControllerBrowserOperationResultPacket,
+  type TControllerBrowserClientPacket,
+  type TControllerBrowserServerPacket,
+  type TControllerBrowserViewOperation,
   type IReq_ControllerProjectCreate,
   type IReq_ControllerProjectList,
   type IReq_ControllerProjectRemove,
@@ -242,7 +264,8 @@ import {
   assertBrowserViewOpenRequest,
   assertBrowserViewActivateRequest,
   assertBrowserViewCloseRequest,
-  assertBrowserViewOperateRequest,
+  assertBrowserViewRecoverRequest,
+  assertControllerBrowserClientPacket,
   assertProjectCreateRequest,
   resolveProjectPathInput,
   assertProjectRemoveRequest,
@@ -332,9 +355,12 @@ const trustedProxySecretHeader = 'x-harness-controller-proxy-secret';
 const websocketPayloadLimit = 16 * 1024 * 1024;
 const browserViewActivationTimeoutMs = 15_000;
 const browserViewCleanupRetryMs = 1_000;
-const maxPendingBrowserViewEvents = 16;
-const maxPendingBrowserViewEventBytes = 16 * 1024 * 1024;
-const browserFrameStreamAuthorizationMarker = Symbol('controller.browser.frame.stream');
+const browserViewTransportCleanupTimeoutMs = 9_000;
+const browserViewRealtimePeerRate = 120;
+const browserViewRealtimePeerBurst = 240;
+const browserViewRealtimeGlobalRate = 512;
+const browserViewRealtimeGlobalBurst = 1_024;
+const browserStreamAuthorizationMarker = Symbol('controller.browser.stream');
 const browserSemanticOperationClassifications: ReadonlySet<
   plugins.browserRuntime.TBrowserRuntimeOperationClassification
 > = new Set(['navigation', 'tab', 'agent-action']);
@@ -476,22 +502,122 @@ interface ITerminalPeerLifecycleState {
   connected: boolean;
 }
 
+class ControllerBrowserTokenBucket {
+  private tokens: number;
+  private updatedAt = performance.now();
+
+  constructor(
+    private readonly refillPerSecond: number,
+    private readonly capacity: number,
+  ) {
+    this.tokens = capacity;
+  }
+
+  public consume(nowArg = performance.now()): boolean {
+    const elapsedMs = Math.max(0, nowArg - this.updatedAt);
+    this.updatedAt = nowArg;
+    this.tokens = Math.min(
+      this.capacity,
+      this.tokens + ((elapsedMs / 1_000) * this.refillPerSecond),
+    );
+    if (this.tokens < 1) return false;
+    this.tokens -= 1;
+    return true;
+  }
+}
+
+type TControllerBrowserViewLifecycle =
+  | 'inactive'
+  | 'activating'
+  | 'active'
+  | 'recoverable'
+  | 'recovering'
+  | 'failing'
+  | 'closing';
+
+type TControllerBrowserTransportLifecycle =
+  | 'opening'
+  | 'ready'
+  | 'active'
+  | 'failed'
+  | 'retiring'
+  | 'retired';
+
+interface IControllerBrowserQueuedOperation {
+  operationId: number;
+  operation: TControllerBrowserViewOperation;
+  byteLength: number;
+  abortController?: AbortController;
+  cancelled: boolean;
+  terminal: boolean;
+}
+
+interface IControllerBrowserAcknowledgementOperation {
+  operationId: number;
+  terminal: boolean;
+  operation: Promise<void>;
+}
+
+interface IControllerBrowserViewTransport {
+  readonly identity: symbol;
+  generation: number;
+  lifecycle: TControllerBrowserTransportLifecycle;
+  events: plugins.typedrequestInterfaces.TVirtualStream<'send'>;
+  operations: plugins.typedrequestInterfaces.TVirtualStream<'receive'>;
+  abortController: AbortController;
+  openingTask: Promise<void>;
+  receiveTask?: Promise<void>;
+  drainTask?: Promise<void>;
+  deliveryTail: Promise<void>;
+  pendingEventCount: number;
+  pendingEventBytes: number;
+  operationQueue: IControllerBrowserQueuedOperation[];
+  queuedOperationBytes: number;
+  highestOperationId: number;
+  cancellableOperationIds: Set<number>;
+  activeMutation?: IControllerBrowserQueuedOperation;
+  activeAcknowledgements: Map<number, IControllerBrowserAcknowledgementOperation>;
+  retirementTask?: Promise<void>;
+  retirementSettlement?: Promise<void>;
+  retirementSettled?: boolean;
+  retirementDeadlineExpired?: boolean;
+  failure?: unknown;
+}
+
+interface IControllerBrowserTransportConstructionCleanup {
+  readonly settlement: Promise<void>;
+  readonly reason: unknown;
+  settled: boolean;
+  deadlineExpired: boolean;
+}
+
 interface IControllerBrowserView {
   id: string;
   peerId: string;
+  credentialId: string;
   transportConnection: plugins.typedsocket.ISmartServeConnectionWrapper;
   transportPeer: plugins.typedsocket.ISmartServeConnectionWrapper['peer'];
   resource: IControllerResourceDocument;
   handle: Awaited<ReturnType<ControllerBrowserResourceHost['openHumanView']>>;
   authority: plugins.browserRuntime.TBrowserRuntimeLeaseAuthority;
-  activationState: 'inactive' | 'activating' | 'active';
+  lifecycle: TControllerBrowserViewLifecycle;
   activationAbortController: AbortController;
   activationTimer?: ReturnType<typeof setTimeout>;
   activationPromise?: Promise<void>;
-  deliveryTail: Promise<void>;
-  pendingEventCount: number;
-  pendingEventBytes: number;
-  activeFrameStreams: Set<plugins.typedrequestInterfaces.TVirtualStream<'send'>>;
+  transport?: IControllerBrowserViewTransport;
+  pendingTransportIdentity?: symbol;
+  transportConstructionCleanup?: IControllerBrowserTransportConstructionCleanup;
+  streamGeneration: number;
+  stateRevision: number;
+  recoveryAttempts: number;
+  recoveryDeadlineAt?: number;
+  recoveryTimer?: ReturnType<typeof setTimeout>;
+  recoveryFrameGate?: {
+    tabId: string;
+    minimumGeneration: number;
+    viewportRevision: number;
+    admitted: boolean;
+  };
   closing: boolean;
   cleanupTask?: Promise<void>;
   cleanupRetryTimer?: ReturnType<typeof setTimeout>;
@@ -503,13 +629,15 @@ interface IControllerBrowserViewSlot {
   view?: IControllerBrowserView;
 }
 
-interface IControllerBrowserFrameStreamAuthorization {
-  readonly marker: typeof browserFrameStreamAuthorizationMarker;
+interface IControllerBrowserStreamAuthorization {
+  readonly marker: typeof browserStreamAuthorizationMarker;
   readonly view: IControllerBrowserView;
   readonly authority: plugins.browserRuntime.TBrowserRuntimeLeaseAuthority;
   readonly transportPeer: plugins.typedsocket.ISmartServeConnectionWrapper['peer'];
+  readonly transportIdentity: symbol;
+  readonly streamGeneration: number;
+  readonly creatorDirection: plugins.typedrequestInterfaces.TVirtualStreamDirection;
   readonly contentType: string;
-  readonly integrity: plugins.typedrequestInterfaces.IVirtualStreamIntegrity;
 }
 
 interface IFlexRefreshJobCacheEntry {
@@ -1611,6 +1739,11 @@ export class OpenCodeController {
   private resourceCoordinator?: ControllerResourceCoordinator;
   private readonly browserViews = new Map<string, IControllerBrowserView>();
   private readonly browserViewSlots = new Map<string, IControllerBrowserViewSlot>();
+  private readonly browserViewRealtimeBucketsByPeer = new Map<string, ControllerBrowserTokenBucket>();
+  private readonly browserViewRealtimeGlobalBucket = new ControllerBrowserTokenBucket(
+    browserViewRealtimeGlobalRate,
+    browserViewRealtimeGlobalBurst,
+  );
   private readonly authenticatedPeerIds = new Set<string>();
   private openCodeResourceGeneration = 0;
   private flexResourceGeneration = 0;
@@ -2059,7 +2192,7 @@ export class OpenCodeController {
       headersTimeout: 10_000,
       requestTimeout: 30_000,
       virtualStreamAuthorizationAdapter: {
-        bind: (authorizationArg, contextArg) => this.bindBrowserFrameStreamAuthorization(
+        bind: (authorizationArg, contextArg) => this.bindBrowserStreamAuthorization(
           authorizationArg,
           contextArg,
         ),
@@ -3046,6 +3179,7 @@ export class OpenCodeController {
       (terminalPeerLifecycle as ITerminalPeerLifecycleState).connected = false;
     }
     this.authenticatedPeerIds.delete(peerArg.id);
+    this.browserViewRealtimeBucketsByPeer.delete(peerArg.id);
     const cleanupResults = await Promise.allSettled([
       this.terminalManager?.detachPeer(peerArg.id) ?? Promise.resolve(),
       this.closeBrowserViewsForPeer(peerArg.id),
@@ -3243,6 +3377,7 @@ export class OpenCodeController {
     }
     this.resourceCoordinator = undefined;
     this.authenticatedPeerIds.clear();
+    this.browserViewRealtimeBucketsByPeer.clear();
 
     await Promise.allSettled([
       ...(this.openCodeControllerEventDrainTask ? [this.openCodeControllerEventDrainTask] : []),
@@ -5808,43 +5943,52 @@ export class OpenCodeController {
       'controller.browser.view.activate',
       async (requestArg, toolsArg) => {
         const peer = peerFromLocalData(toolsArg?.localData);
-        const { viewId } = validateRequest(() => assertBrowserViewActivateRequest(requestArg));
+        const { viewId, streamGeneration } = validateRequest(
+          () => assertBrowserViewActivateRequest(requestArg),
+        );
         return this.runOperation(peer, async (signalArg) => {
-          await this.activateBrowserView(viewId, peer.id, signalArg);
+          await this.activateBrowserView(viewId, peer, streamGeneration, signalArg);
           return { activated: true as const };
         }, toolsArg?.abortSignal);
       },
     ));
 
+    protectedRouter.addTypedHandler(new plugins.typedrequest.TypedHandler<IReq_ControllerBrowserViewRecover>(
+      'controller.browser.view.recover',
+      async (requestArg, toolsArg) => {
+        const peer = peerFromLocalData(toolsArg?.localData);
+        const transportConnection = this.requireTypedServer().getServerConnectionForRequest(toolsArg);
+        const parsed = validateRequest(() => assertBrowserViewRecoverRequest(requestArg));
+        return this.runOperation(peer, async (signalArg) => this.recoverBrowserView(
+          peer,
+          transportConnection,
+          parsed,
+          signalArg,
+        ), toolsArg?.abortSignal);
+      },
+    ));
+
     protectedRouter.addTypedHandler(new plugins.typedrequest.TypedHandler<IReq_ControllerBrowserViewClose>(
       'controller.browser.view.close',
       async (requestArg, toolsArg) => {
         const peer = peerFromLocalData(toolsArg?.localData);
-        const { viewId } = validateRequest(() => assertBrowserViewCloseRequest(requestArg));
+        const { viewId, expectedStreamGeneration } = validateRequest(
+          () => assertBrowserViewCloseRequest(requestArg),
+        );
         return this.runOperation(peer, async () => this.runAudited(
           { type: 'resource.browser.view.close', peerId: peer.id },
           async () => {
-            await this.closeBrowserView(viewId, peer.id);
-            return { closed: true as const };
+            const closed = await this.closeBrowserView(
+              viewId,
+              peer,
+              expectedStreamGeneration,
+            );
+            return { closed };
           },
         ));
       },
     ));
 
-    protectedRouter.addTypedHandler(new plugins.typedrequest.TypedHandler<IReq_ControllerBrowserViewOperate>(
-      'controller.browser.view.operate',
-      async (requestArg, toolsArg) => {
-        const peer = peerFromLocalData(toolsArg?.localData);
-        const parsed = validateRequest(() => assertBrowserViewOperateRequest(requestArg));
-        return this.runOperation(peer, async (signalArg) => this.operateBrowserView(
-          peer.id,
-          parsed.viewId,
-          parsed.operation,
-          signalArg,
-        ), toolsArg?.abortSignal);
-      },
-    ));
-
     protectedRouter.addTypedHandler(
       new plugins.typedrequest.TypedHandler<IReq_ControllerSessionGroupsGet>(
         'controller.sessiongroups.get',
@@ -13018,7 +13162,9 @@ export class OpenCodeController {
     transportConnectionArg: plugins.typedsocket.ISmartServeConnectionWrapper,
     requestArg: IReq_ControllerBrowserViewOpen['request'],
     signalArg: AbortSignal,
-  ): Promise<IReq_ControllerBrowserViewOpen['response']> {
+  ): Promise<plugins.typedrequest.TReverseVirtualStreamDirections<
+    IReq_ControllerBrowserViewOpen['response']
+  >> {
     return this.runBrowserViewSlotOperation(peerArg.id, async (slotArg) => {
       const transportPeer = transportConnectionArg.peer;
       signalArg.throwIfAborted();
@@ -13075,17 +13221,17 @@ export class OpenCodeController {
         view = {
           id: viewId,
           peerId: peerArg.id,
+          credentialId,
           transportConnection: transportConnectionArg,
           transportPeer,
           resource,
           handle,
           authority: handle.lease.getAuthority(),
-          activationState: 'inactive',
+          lifecycle: 'inactive',
           activationAbortController: new AbortController(),
-          deliveryTail: Promise.resolve(),
-          pendingEventCount: 0,
-          pendingEventBytes: 0,
-          activeFrameStreams: new Set(),
+          streamGeneration: 1,
+          stateRevision: 0,
+          recoveryAttempts: 0,
           closing: false,
         };
         slotArg.view = view;
@@ -13101,6 +13247,9 @@ export class OpenCodeController {
           );
         }
         this.browserViews.set(view.id, view);
+        const transport = await this.createBrowserViewTransport(view, 1);
+        this.beginBrowserViewTransportOpening(view, transport);
+        signalArg.throwIfAborted();
         view.activationTimer = setTimeout(() => {
           this.scheduleBrowserViewClose(view!, new Error('Browser view activation timed out.'));
         }, browserViewActivationTimeoutMs);
@@ -13109,7 +13258,10 @@ export class OpenCodeController {
           viewId,
           resourceId: resource.id,
           attachmentRevision: resource.attachmentRevision,
-          state: this.toControllerBrowserViewState(handle.lease.getState()),
+          streamGeneration: transport.generation,
+          events: transport.events,
+          operations: transport.operations,
+          state: this.nextControllerBrowserViewState(view, handle.lease.getState()),
         };
       } catch (errorArg) {
         let cleanupError: unknown;
@@ -13135,43 +13287,53 @@ export class OpenCodeController {
 
   private async activateBrowserView(
     viewIdArg: string,
-    peerIdArg: string,
+    peerArg: IControllerPeer,
+    streamGenerationArg: number,
     signalArg: AbortSignal,
   ): Promise<void> {
-    await this.runBrowserViewSlotOperation(peerIdArg, async (slotArg) => {
+    await this.runBrowserViewSlotOperation(peerArg.id, async (slotArg) => {
       const view = slotArg.view;
+      const transport = view?.transport;
       if (
         !view
         || view.id !== viewIdArg
         || view.closing
+        || view.transportPeer !== peerArg
+        || view.credentialId !== peerArg.context.state[authenticatedPeerStateKey]
+        || view.streamGeneration !== streamGenerationArg
+        || !transport
+        || transport.generation !== streamGenerationArg
         || this.browserViews.get(viewIdArg) !== view
       ) {
         throw new plugins.typedrequest.TypedResponseError('The browser view is unavailable.', {
           code: 'resource_unavailable',
         });
       }
-      if (view.activationState === 'active') return;
+      await this.assertBrowserViewAuthority(
+        view,
+        streamGenerationArg,
+        transport.identity,
+        signalArg,
+      );
+      if (view.lifecycle === 'active' && transport.lifecycle === 'active') return;
       if (view.activationPromise) {
         await awaitWithAbortSignal(view.activationPromise, signalArg);
         return;
       }
-      view.activationState = 'activating';
-      const activation = view.handle.activate((eventArg) => {
-        if (view.closing || slotArg.view !== view) return;
-        this.queueBrowserViewEvent(view, eventArg);
-      });
+      const recovering = view.lifecycle === 'recovering';
+      if (!recovering && view.lifecycle !== 'inactive') {
+        throw new plugins.typedrequest.TypedResponseError('The browser view cannot be activated.', {
+          code: 'concurrent_change',
+        });
+      }
+      if (!recovering) view.lifecycle = 'activating';
+      const activation = this.activateBrowserViewTransport(view, transport, recovering, signalArg);
       view.activationPromise = activation;
-      const activationSignal = AbortSignal.any([
-        signalArg,
-        view.activationAbortController.signal,
-      ]);
       try {
-        await awaitWithAbortSignal(activation, activationSignal);
-        activationSignal.throwIfAborted();
+        await activation;
         if (view.closing || slotArg.view !== view) {
           throw new Error('The browser view changed during activation.');
         }
-        view.activationState = 'active';
         if (view.activationTimer) clearTimeout(view.activationTimer);
         view.activationTimer = undefined;
       } catch (errorArg) {
@@ -13183,11 +13345,173 @@ export class OpenCodeController {
     });
   }
 
-  private async closeBrowserView(viewIdArg: string, peerIdArg: string): Promise<void> {
-    const slot = this.browserViewSlots.get(peerIdArg);
+  private async activateBrowserViewTransport(
+    viewArg: IControllerBrowserView,
+    transportArg: IControllerBrowserViewTransport,
+    recoveringArg: boolean,
+    signalArg: AbortSignal,
+  ): Promise<void> {
+    const signals = [
+      signalArg,
+      viewArg.activationAbortController.signal,
+      transportArg.abortController.signal,
+    ];
+    if (recoveringArg && viewArg.recoveryDeadlineAt !== undefined) {
+      const remainingMs = viewArg.recoveryDeadlineAt - Date.now();
+      if (remainingMs <= 0) throw new Error('Browser view recovery timed out.');
+      signals.push(AbortSignal.timeout(remainingMs));
+    }
+    const activationSignal = AbortSignal.any(signals);
+    await awaitWithAbortSignal(transportArg.openingTask, activationSignal);
+    activationSignal.throwIfAborted();
+    if (viewArg.transport !== transportArg || transportArg.lifecycle !== 'ready') {
+      throw new Error('The browser view transport changed during activation.');
+    }
+    transportArg.lifecycle = 'active';
+
+    if (!recoveringArg) {
+      await awaitWithAbortSignal(viewArg.handle.activate((eventArg) => {
+        const currentTransport = viewArg.transport;
+        if (viewArg.closing || !currentTransport) return;
+        this.queueBrowserViewEvent(viewArg, currentTransport, eventArg);
+      }), activationSignal);
+      activationSignal.throwIfAborted();
+      viewArg.lifecycle = 'active';
+      this.ensureBrowserOperationDrain(viewArg, transportArg);
+      return;
+    }
+
+    const runtimeState = viewArg.handle.lease.getState();
+    const activeTab = runtimeState.tabs.find((tabArg) => tabArg.id === runtimeState.activeTabId);
+    if (!activeTab || !activeTab.active || activeTab.status !== 'open' || !activeTab.streaming) {
+      throw new Error('The active browser tab cannot refresh its frame stream.');
+    }
+    const stateDelivery = this.queueBrowserServerPacket(viewArg, transportArg, {
+      protocol: controllerBrowserTransportProtocol,
+      streamGeneration: transportArg.generation,
+      type: 'state',
+      state: this.nextControllerBrowserViewState(viewArg, runtimeState),
+    });
+    if (!stateDelivery) throw new Error('The recovered browser state could not be queued.');
+    await awaitWithAbortSignal(stateDelivery, activationSignal);
+    viewArg.recoveryFrameGate = {
+      tabId: activeTab.id,
+      minimumGeneration: activeTab.generation + 1,
+      viewportRevision: runtimeState.viewportRevision,
+      admitted: false,
+    };
+    await viewArg.handle.refreshFrameStream(activationSignal);
+    if (!viewArg.recoveryFrameGate.admitted) {
+      throw new Error('BrowserRuntime did not deliver the recovered frame boundary.');
+    }
+    viewArg.recoveryFrameGate = undefined;
+    viewArg.lifecycle = 'active';
+    viewArg.recoveryDeadlineAt = undefined;
+    if (viewArg.recoveryTimer) clearTimeout(viewArg.recoveryTimer);
+    viewArg.recoveryTimer = undefined;
+    this.ensureBrowserOperationDrain(viewArg, transportArg);
+  }
+
+  private async recoverBrowserView(
+    peerArg: IControllerPeer,
+    transportConnectionArg: plugins.typedsocket.ISmartServeConnectionWrapper,
+    requestArg: IReq_ControllerBrowserViewRecover['request'],
+    signalArg: AbortSignal,
+  ): Promise<plugins.typedrequest.TReverseVirtualStreamDirections<
+    IReq_ControllerBrowserViewRecover['response']
+  >> {
+    return this.runBrowserViewSlotOperation(peerArg.id, async (slotArg) => {
+      const view = slotArg.view;
+      const oldTransport = view?.transport;
+      if (
+        !view
+        || view.id !== requestArg.viewId
+        || view.closing
+        || view.transportConnection.peer !== transportConnectionArg.peer
+        || view.transportPeer !== peerArg
+        || view.credentialId !== peerArg.context.state[authenticatedPeerStateKey]
+        || view.streamGeneration !== requestArg.expectedStreamGeneration
+        || !oldTransport
+        || oldTransport.generation !== requestArg.expectedStreamGeneration
+        || (view.lifecycle !== 'active' && view.lifecycle !== 'recoverable')
+      ) {
+        throw new plugins.typedrequest.TypedResponseError('The browser view cannot be recovered.', {
+          code: 'resource_unavailable',
+        });
+      }
+      await this.assertBrowserViewAuthority(
+        view,
+        oldTransport.generation,
+        oldTransport.identity,
+        signalArg,
+      );
+      const now = Date.now();
+      view.recoveryDeadlineAt ??= now + controllerBrowserTransportRecoveryGraceMs;
+      if (
+        now >= view.recoveryDeadlineAt
+        || view.recoveryAttempts >= controllerBrowserTransportMaximumRecoveryAttempts
+      ) {
+        throw new plugins.typedrequest.TypedResponseError('Browser view recovery capacity was reached.', {
+          code: 'operation_limit',
+        });
+      }
+      view.recoveryAttempts += 1;
+      view.lifecycle = 'recovering';
+      this.armBrowserViewRecoveryDeadline(view);
+      try {
+        await this.retireBrowserViewTransport(
+          view,
+          oldTransport,
+          Math.min(
+            view.recoveryDeadlineAt,
+            Date.now() + browserViewTransportCleanupTimeoutMs,
+          ),
+        );
+        signalArg.throwIfAborted();
+        if (Date.now() >= view.recoveryDeadlineAt) {
+          throw new Error('Browser view recovery timed out.');
+        }
+        const streamGeneration = oldTransport.generation + 1;
+        view.streamGeneration = streamGeneration;
+        const transport = await this.createBrowserViewTransport(view, streamGeneration);
+        this.beginBrowserViewTransportOpening(view, transport);
+        signalArg.throwIfAborted();
+        return {
+          viewId: view.id,
+          resourceId: view.resource.id,
+          attachmentRevision: view.resource.attachmentRevision,
+          streamGeneration,
+          events: transport.events,
+          operations: transport.operations,
+          state: this.nextControllerBrowserViewState(view, view.handle.lease.getState()),
+        };
+      } catch (errorArg) {
+        this.scheduleBrowserViewClose(view, errorArg);
+        throw asTypedResponseError(errorArg);
+      }
+    });
+  }
+
+  private async closeBrowserView(
+    viewIdArg: string,
+    peerArg: string | IControllerPeer,
+    expectedStreamGenerationArg?: number,
+  ): Promise<boolean> {
+    const peerId = typeof peerArg === 'string' ? peerArg : peerArg.id;
+    const slot = this.browserViewSlots.get(peerId);
     const view = slot?.view;
-    if (!slot || !view || view.id !== viewIdArg) return;
+    if (
+      !slot
+      || !view
+      || view.id !== viewIdArg
+      || (typeof peerArg !== 'string' && view.transportPeer !== peerArg)
+      || (
+        expectedStreamGenerationArg !== undefined
+        && view.streamGeneration !== expectedStreamGenerationArg
+      )
+    ) return false;
     await this.requestBrowserViewCleanup(slot, view, new Error('Browser view closed.'));
+    return true;
   }
 
   private async closeBrowserViewsForPeer(peerIdArg: string): Promise<void> {
@@ -13261,15 +13585,22 @@ export class OpenCodeController {
   private markBrowserViewClosing(viewArg: IControllerBrowserView, reasonArg: unknown): void {
     if (!viewArg.closing) {
       viewArg.closing = true;
+      viewArg.lifecycle = 'closing';
       if (this.browserViews.get(viewArg.id) === viewArg) this.browserViews.delete(viewArg.id);
       if (viewArg.activationTimer) clearTimeout(viewArg.activationTimer);
       viewArg.activationTimer = undefined;
+      if (viewArg.recoveryTimer) clearTimeout(viewArg.recoveryTimer);
+      viewArg.recoveryTimer = undefined;
       if (!viewArg.activationAbortController.signal.aborted) {
         viewArg.activationAbortController.abort(reasonArg);
       }
     }
-    for (const stream of viewArg.activeFrameStreams) {
-      void stream.abort(reasonArg).catch(() => undefined);
+    const transport = viewArg.transport;
+    if (transport) {
+      if (!transport.abortController.signal.aborted) transport.abortController.abort(reasonArg);
+      transport.activeMutation?.abortController?.abort(reasonArg);
+      void transport.events.abort(reasonArg).catch(() => undefined);
+      void transport.operations.abort(reasonArg).catch(() => undefined);
     }
   }
 
@@ -13334,14 +13665,18 @@ export class OpenCodeController {
     this.markBrowserViewClosing(viewArg, reasonArg);
     if (slotArg.view !== viewArg) return;
     const errors: unknown[] = [];
-    const streamResults = await Promise.allSettled(
-      [...viewArg.activeFrameStreams].map((stream) => stream.abort(reasonArg)),
-    );
-    errors.push(...streamResults
-      .filter((result): result is PromiseRejectedResult => result.status === 'rejected')
-      .map((result) => result.reason));
+    const constructionCleanup = viewArg.transportConstructionCleanup;
+    if (constructionCleanup && !constructionCleanup.settled) {
+      errors.push(new Error('Browser stream pair construction cleanup remains pending.'));
+    }
+    if (viewArg.transport) {
+      await this.retireBrowserViewTransport(
+        viewArg,
+        viewArg.transport,
+        Date.now() + browserViewTransportCleanupTimeoutMs,
+      ).catch((errorArg) => errors.push(errorArg));
+    }
     await viewArg.handle.close().catch((errorArg) => errors.push(errorArg));
-    await viewArg.deliveryTail.catch((errorArg) => errors.push(errorArg));
     if (errors.length === 1) throw errors[0];
     if (errors.length > 1) {
       throw new AggregateError(errors, 'Browser view cleanup is incomplete.');
@@ -13357,6 +13692,13 @@ export class OpenCodeController {
     reasonArg: unknown,
   ): void {
     if (slotArg.view !== viewArg || viewArg.cleanupRetryTimer) return;
+    if (
+      viewArg.transportConstructionCleanup
+      || (
+      viewArg.transport?.retirementSettlement
+      && !viewArg.transport.retirementSettled
+      )
+    ) return;
     const timer = setTimeout(() => {
       if (viewArg.cleanupRetryTimer === timer) viewArg.cleanupRetryTimer = undefined;
       if (slotArg.view !== viewArg) return;
@@ -13368,250 +13710,932 @@ export class OpenCodeController {
     timer.unref?.();
   }
 
-  private async operateBrowserView(
-    peerIdArg: string,
-    viewIdArg: string,
-    operationArg: IReq_ControllerBrowserViewOperate['request']['operation'],
-    signalArg: AbortSignal,
-  ): Promise<IReq_ControllerBrowserViewOperate['response']> {
-    const view = this.browserViews.get(viewIdArg);
-    if (!view || view.peerId !== peerIdArg || view.closing) {
-      throw new plugins.typedrequest.TypedResponseError('The browser view is unavailable.', {
-        code: 'resource_unavailable',
+  private queueBrowserViewEvent(
+    viewArg: IControllerBrowserView,
+    transportArg: IControllerBrowserViewTransport,
+    eventArg: plugins.browserRuntime.TBrowserRuntimeEvent,
+  ): void {
+    try {
+      if (viewArg.lifecycle === 'failing' || viewArg.lifecycle === 'closing') return;
+      if (eventArg.type === 'state') {
+        if (viewArg.lifecycle === 'recoverable') return;
+        this.queueBrowserServerPacket(viewArg, transportArg, {
+          protocol: controllerBrowserTransportProtocol,
+          streamGeneration: transportArg.generation,
+          type: 'state',
+          state: this.nextControllerBrowserViewState(viewArg, eventArg.state),
+        });
+        return;
+      }
+      if (eventArg.type === 'error') {
+        const delivery = this.queueBrowserServerPacket(viewArg, transportArg, {
+          protocol: controllerBrowserTransportProtocol,
+          streamGeneration: transportArg.generation,
+          type: 'error',
+          error: { ...eventArg.error, message: eventArg.error.code },
+        });
+        if (eventArg.error.fatal) {
+          const reason = new Error(eventArg.error.code);
+          viewArg.lifecycle = 'failing';
+          this.terminalizeBrowserTransportOperations(transportArg, reason);
+          if (!delivery) {
+            this.scheduleBrowserViewClose(viewArg, reason);
+          } else {
+            void awaitWithAbortSignal(
+              delivery,
+              AbortSignal.timeout(browserViewTransportCleanupTimeoutMs),
+            ).then(
+              () => this.scheduleBrowserViewClose(viewArg, reason),
+              () => this.scheduleBrowserViewClose(viewArg, reason),
+            );
+          }
+        }
+        return;
+      }
+      if (viewArg.lifecycle === 'recoverable') return;
+      const gate = viewArg.recoveryFrameGate;
+      if (viewArg.lifecycle === 'recovering') {
+        if (
+          !gate
+          || eventArg.frame.tabId !== gate.tabId
+          || eventArg.frame.generation < gate.minimumGeneration
+          || eventArg.frame.viewportRevision !== gate.viewportRevision
+        ) return;
+      }
+      const { data, ...frame } = eventArg.frame;
+      if (data.byteLength > controllerBrowserTransportMaximumFrameBytes) {
+        throw new Error('The browser frame exceeds the transport byte limit.');
+      }
+      const copiedData = Uint8Array.from(data);
+      const metadata: IControllerBrowserFrameMetadata = {
+        ...frame,
+        dataByteLength: copiedData.byteLength,
+      };
+      this.queueBrowserServerPacket(viewArg, transportArg, {
+        protocol: controllerBrowserTransportProtocol,
+        streamGeneration: transportArg.generation,
+        type: 'frame',
+        frame: metadata,
+      }, copiedData);
+      if (gate) gate.admitted = true;
+    } catch (errorArg) {
+      this.scheduleBrowserViewClose(viewArg, errorArg);
+      throw errorArg;
+    }
+  }
+
+  private async createBrowserViewTransport(
+    viewArg: IControllerBrowserView,
+    streamGenerationArg: number,
+  ): Promise<IControllerBrowserViewTransport> {
+    const typedSocket = this.typedServer?.typedsocket;
+    if (!typedSocket) throw new Error('The controller transport is unavailable.');
+    const transportIdentity = Symbol('controller.browser.transport');
+    if (viewArg.pendingTransportIdentity || viewArg.transportConstructionCleanup) {
+      throw new Error('A browser stream pair is already being constructed.');
+    }
+    viewArg.pendingTransportIdentity = transportIdentity;
+    const createAuthorization = (
+      creatorDirectionArg: plugins.typedrequestInterfaces.TVirtualStreamDirection,
+      contentTypeArg: string,
+    ): IControllerBrowserStreamAuthorization => Object.freeze({
+      marker: browserStreamAuthorizationMarker,
+      view: viewArg,
+      authority: viewArg.authority,
+      transportPeer: viewArg.transportPeer,
+      transportIdentity,
+      streamGeneration: streamGenerationArg,
+      creatorDirection: creatorDirectionArg,
+      contentType: contentTypeArg,
+    });
+    try {
+      const events = typedSocket.createVirtualStream({
+        target: viewArg.transportConnection,
+        creatorDirection: 'send',
+        contentType: controllerBrowserTransportEventContentType,
+        authorization: createAuthorization('send', controllerBrowserTransportEventContentType),
+      });
+      let operations: plugins.typedrequestInterfaces.TVirtualStream<'receive'>;
+      try {
+        operations = typedSocket.createVirtualStream({
+          target: viewArg.transportConnection,
+          creatorDirection: 'receive',
+          contentType: controllerBrowserTransportOperationContentType,
+          authorization: createAuthorization('receive', controllerBrowserTransportOperationContentType),
+        });
+      } catch (errorArg) {
+        let cleanup!: IControllerBrowserTransportConstructionCleanup;
+        const settlement = Promise.allSettled([
+          Promise.resolve().then(() => events.abort(errorArg)),
+          events.opened,
+          events.completion,
+          events.closed,
+        ]).then(() => {
+          cleanup.settled = true;
+          const slot = this.browserViewSlots.get(viewArg.peerId);
+          if (
+            !cleanup.deadlineExpired
+            || !viewArg.closing
+            || slot?.view !== viewArg
+          ) {
+            if (viewArg.transportConstructionCleanup === cleanup) {
+              viewArg.transportConstructionCleanup = undefined;
+            }
+            return;
+          }
+          const activeCleanupTask = viewArg.cleanupTask;
+          void (activeCleanupTask
+            ? activeCleanupTask.catch(() => undefined)
+            : Promise.resolve()
+          ).then(() => {
+            const currentSlot = this.browserViewSlots.get(viewArg.peerId);
+            if (
+              viewArg.transportConstructionCleanup !== cleanup
+              || !viewArg.closing
+              || currentSlot?.view !== viewArg
+            ) return;
+            viewArg.transportConstructionCleanup = undefined;
+            void this.requestBrowserViewCleanup(currentSlot, viewArg, cleanup.reason).catch(
+              (cleanupErrorArg) => {
+                console.error(`Browser view ${viewArg.id} late construction cleanup failed.`, cleanupErrorArg);
+              },
+            );
+          });
+        });
+        cleanup = {
+          settlement,
+          reason: errorArg,
+          settled: false,
+          deadlineExpired: false,
+        };
+        viewArg.transportConstructionCleanup = cleanup;
+        try {
+          await this.waitForBrowserTransportSettlement(
+            settlement,
+            Date.now() + browserViewTransportCleanupTimeoutMs,
+          );
+        } catch (cleanupErrorArg) {
+          cleanup.deadlineExpired = true;
+          throw new AggregateError(
+            [errorArg, cleanupErrorArg],
+            'Browser stream pair construction cleanup is incomplete.',
+          );
+        }
+        throw errorArg;
+      }
+      const transport: IControllerBrowserViewTransport = {
+        identity: transportIdentity,
+        generation: streamGenerationArg,
+        lifecycle: 'opening',
+        events,
+        operations,
+        abortController: new AbortController(),
+        openingTask: Promise.resolve(),
+        deliveryTail: Promise.resolve(),
+        pendingEventCount: 0,
+        pendingEventBytes: 0,
+        operationQueue: [],
+        queuedOperationBytes: 0,
+        highestOperationId: 0,
+        cancellableOperationIds: new Set(),
+        activeAcknowledgements: new Map(),
+      };
+      viewArg.transport = transport;
+      return transport;
+    } finally {
+      if (viewArg.pendingTransportIdentity === transportIdentity) {
+        viewArg.pendingTransportIdentity = undefined;
+      }
+    }
+  }
+
+  private beginBrowserViewTransportOpening(
+    viewArg: IControllerBrowserView,
+    transportArg: IControllerBrowserViewTransport,
+  ): void {
+    if (viewArg.transport !== transportArg) {
+      throw new Error('The browser stream pair cannot open before publication.');
+    }
+    const openingTask = this.openBrowserViewTransport(viewArg, transportArg);
+    transportArg.openingTask = openingTask;
+    void openingTask.catch((errorArg) => {
+      this.noteBrowserTransportFault(viewArg, transportArg, errorArg, true);
+    });
+  }
+
+  private async openBrowserViewTransport(
+    viewArg: IControllerBrowserView,
+    transportArg: IControllerBrowserViewTransport,
+  ): Promise<void> {
+    let timeout: ReturnType<typeof setTimeout> | undefined;
+    try {
+      await Promise.race([
+        Promise.all([transportArg.events.opened, transportArg.operations.opened]),
+        new Promise<never>((_resolve, reject) => {
+          timeout = setTimeout(() => reject(new Error('Browser stream pair opening timed out.')),
+            controllerBrowserTransportPairOpenTimeoutMs);
+          timeout.unref?.();
+        }),
+      ]);
+      if (
+        viewArg.transport !== transportArg
+        || viewArg.closing
+        || viewArg.streamGeneration !== transportArg.generation
+        || transportArg.lifecycle !== 'opening'
+      ) throw new Error('The browser stream pair became stale while opening.');
+      transportArg.lifecycle = 'ready';
+      const receiveTask = this.receiveBrowserOperations(viewArg, transportArg);
+      transportArg.receiveTask = receiveTask;
+      void receiveTask.catch((errorArg) => {
+        this.noteBrowserTransportFault(viewArg, transportArg, errorArg, true);
       });
+    } finally {
+      if (timeout) clearTimeout(timeout);
     }
-    const current = await awaitWithAbortSignal(
-      this.requireAuthStore().getResource(view.resource.projectId, view.resource.id),
-      signalArg,
-    );
+  }
+
+  private async receiveBrowserOperations(
+    viewArg: IControllerBrowserView,
+    transportArg: IControllerBrowserViewTransport,
+  ): Promise<void> {
+    while (transportArg.lifecycle !== 'retiring' && transportArg.lifecycle !== 'retired') {
+      const chunk = await transportArg.operations.receive();
+      if (chunk === undefined) {
+        if (transportArg.abortController.signal.aborted) return;
+        await transportArg.operations.accept();
+        throw new Error('The browser operation stream closed unexpectedly.');
+      }
+      let packet: TControllerBrowserClientPacket;
+      try {
+        packet = assertControllerBrowserClientPacket(
+          decodeControllerBrowserTransportPacket(chunk),
+        );
+      } catch (errorArg) {
+        this.failBrowserTransportProtocol(viewArg, transportArg, errorArg);
+        return;
+      }
+      if (packet.streamGeneration !== transportArg.generation) {
+        this.failBrowserTransportProtocol(
+          viewArg,
+          transportArg,
+          new Error('The browser operation belongs to a stale stream generation.'),
+        );
+        return;
+      }
+      this.admitBrowserClientPacket(viewArg, transportArg, packet, chunk.byteLength);
+    }
+  }
+
+  private admitBrowserClientPacket(
+    viewArg: IControllerBrowserView,
+    transportArg: IControllerBrowserViewTransport,
+    packetArg: TControllerBrowserClientPacket,
+    byteLengthArg: number,
+  ): void {
+    if (packetArg.type === 'cancel') {
+      if (packetArg.operationId > transportArg.highestOperationId) {
+        this.failBrowserTransportProtocol(viewArg, transportArg, new Error('cancel targeted a future operation.'));
+        return;
+      }
+      if (transportArg.cancellableOperationIds.has(packetArg.operationId)) {
+        this.cancelBrowserOperation(viewArg, transportArg, packetArg.operationId);
+      }
+      return;
+    }
+    const admitted = this.consumeBrowserRealtimeAdmission(viewArg.peerId);
+    if (!admitted) {
+      if (packetArg.operationId <= transportArg.highestOperationId) {
+        this.failBrowserTransportProtocol(viewArg, transportArg, new Error('operationId was reused.'));
+        return;
+      }
+      transportArg.highestOperationId = packetArg.operationId;
+      this.queueBrowserOperationResult(viewArg, transportArg, packetArg.operationId, {
+        status: 'failed',
+        error: { code: 'rate_limited', message: 'The browser input rate limit was reached.' },
+      });
+      return;
+    }
+    if (packetArg.operationId <= transportArg.highestOperationId) {
+      this.failBrowserTransportProtocol(viewArg, transportArg, new Error('operationId was reused.'));
+      return;
+    }
+    transportArg.highestOperationId = packetArg.operationId;
+    const queued: IControllerBrowserQueuedOperation = {
+      operationId: packetArg.operationId,
+      operation: packetArg.operation,
+      byteLength: byteLengthArg,
+      cancelled: false,
+      terminal: false,
+    };
     if (
-      !current
-      || current.lifecycle !== 'active'
-      || current.kind !== 'browser'
-      || current.pendingAttachment
-      || current.attachmentAuthorityId !== view.resource.attachmentAuthorityId
-      || current.attachmentRevision !== view.resource.attachmentRevision
+      transportArg.operationQueue.length >= controllerBrowserTransportMaximumPendingOperations
+      || transportArg.queuedOperationBytes + byteLengthArg
+        > controllerBrowserTransportMaximumQueuedOperationBytes
     ) {
-      await this.closeBrowserView(view.id, peerIdArg);
-      throw new plugins.typedrequest.TypedResponseError('The browser resource changed.', {
-        code: 'resource_unavailable',
+      this.settleBrowserOperation(viewArg, transportArg, queued, {
+        status: 'failed',
+        error: { code: 'operation_limit', message: 'The browser operation queue is full.' },
       });
+      return;
     }
-    const lease = view.handle.lease;
-    let accepted = true;
-    try {
-      switch (operationArg.type) {
-        case 'acknowledgeFrame':
-          signalArg.throwIfAborted();
-          accepted = await lease.acknowledgeFrame(operationArg.acknowledgement);
-          signalArg.throwIfAborted();
-          break;
-        case 'setViewport':
-          await lease.setViewport(operationArg.viewport, { signal: signalArg });
-          break;
-        case 'dispatchMouse':
-          await lease.dispatchMouse(operationArg.input, { signal: signalArg });
-          break;
-        case 'dispatchWheel':
-          await lease.dispatchWheel(operationArg.input, { signal: signalArg });
-          break;
-        case 'dispatchKey':
-          await lease.dispatchKey(operationArg.input, { signal: signalArg });
-          break;
-        case 'insertText':
-          await lease.insertText(operationArg.input, { signal: signalArg });
-          break;
-        case 'navigate':
-          await lease.executeHumanAction({
-            action: 'navigate',
-            url: operationArg.url,
-            ...(operationArg.tabId === undefined ? {} : { tabId: operationArg.tabId }),
-            ...(operationArg.timeoutMs === undefined ? {} : { timeoutMs: operationArg.timeoutMs }),
-          }, { signal: signalArg });
-          break;
-        case 'createTab':
-          await lease.createTab({
-            ...(operationArg.url === undefined ? {} : { url: operationArg.url }),
-            ...(operationArg.activate === undefined ? {} : { activate: operationArg.activate }),
-          }, { signal: signalArg });
-          break;
-        case 'activateTab':
-          await lease.activateTab(operationArg.tabId, { signal: signalArg });
-          break;
-        case 'closeTab':
-          await lease.closeTab(operationArg.tabId, { signal: signalArg });
-          break;
-        case 'back':
-          await lease.back(
-            operationArg.tabId === undefined ? {} : { tabId: operationArg.tabId },
-            { signal: signalArg },
-          );
-          break;
-        case 'forward':
-          await lease.forward(
-            operationArg.tabId === undefined ? {} : { tabId: operationArg.tabId },
-            { signal: signalArg },
-          );
-          break;
-        case 'reload':
-          await lease.reload(
-            operationArg.tabId === undefined ? {} : { tabId: operationArg.tabId },
-            { signal: signalArg },
-          );
-          break;
+    transportArg.cancellableOperationIds.add(queued.operationId);
+    const tail = transportArg.operationQueue.at(-1);
+    if (tail && this.browserOperationsCanCoalesce(tail.operation, queued.operation)) {
+      transportArg.operationQueue.pop();
+      transportArg.queuedOperationBytes -= tail.byteLength;
+      this.settleBrowserOperation(viewArg, transportArg, tail, { status: 'superseded' });
+    }
+    transportArg.operationQueue.push(queued);
+    transportArg.queuedOperationBytes += byteLengthArg;
+    if (viewArg.lifecycle === 'active' && transportArg.lifecycle === 'active') {
+      if (queued.operation.type === 'acknowledgeFrame') {
+        const index = transportArg.operationQueue.indexOf(queued);
+        if (index >= 0) {
+          transportArg.operationQueue.splice(index, 1);
+          transportArg.queuedOperationBytes -= queued.byteLength;
+          this.startBrowserAcknowledgement(viewArg, transportArg, queued);
+        }
+      } else {
+        this.ensureBrowserOperationDrain(viewArg, transportArg);
       }
-    } catch (errorArg) {
-      throw asTypedResponseError(errorArg);
     }
-    return { accepted, state: this.toControllerBrowserViewState(lease.getState()) };
   }
 
-  private queueBrowserViewEvent(
+  private consumeBrowserRealtimeAdmission(peerIdArg: string): boolean {
+    let peerBucket = this.browserViewRealtimeBucketsByPeer.get(peerIdArg);
+    if (!peerBucket) {
+      peerBucket = new ControllerBrowserTokenBucket(
+        browserViewRealtimePeerRate,
+        browserViewRealtimePeerBurst,
+      );
+      this.browserViewRealtimeBucketsByPeer.set(peerIdArg, peerBucket);
+    }
+    const now = performance.now();
+    return peerBucket.consume(now) && this.browserViewRealtimeGlobalBucket.consume(now);
+  }
+
+  private browserOperationsCanCoalesce(
+    existingArg: TControllerBrowserViewOperation,
+    candidateArg: TControllerBrowserViewOperation,
+  ): boolean {
+    if (existingArg.type === 'setViewport' && candidateArg.type === 'setViewport') return true;
+    return existingArg.type === 'dispatchMouse'
+      && candidateArg.type === 'dispatchMouse'
+      && existingArg.input.type === 'move'
+      && candidateArg.input.type === 'move'
+      && existingArg.input.tabId === candidateArg.input.tabId
+      && existingArg.input.generation === candidateArg.input.generation
+      && existingArg.input.viewportRevision === candidateArg.input.viewportRevision;
+  }
+
+  private cancelBrowserOperation(
     viewArg: IControllerBrowserView,
-    eventArg: plugins.browserRuntime.TBrowserRuntimeEvent,
+    transportArg: IControllerBrowserViewTransport,
+    operationIdArg: number,
+  ): void {
+    if (!transportArg.cancellableOperationIds.delete(operationIdArg)) return;
+    const queuedIndex = transportArg.operationQueue.findIndex(
+      (candidateArg) => candidateArg.operationId === operationIdArg,
+    );
+    if (queuedIndex >= 0) {
+      const [queued] = transportArg.operationQueue.splice(queuedIndex, 1);
+      if (!queued) return;
+      transportArg.queuedOperationBytes -= queued.byteLength;
+      queued.cancelled = true;
+      this.settleBrowserOperation(viewArg, transportArg, queued, { status: 'cancelled' });
+      return;
+    }
+    const active = transportArg.activeMutation;
+    if (active?.operationId === operationIdArg && !active.terminal) {
+      active.cancelled = true;
+      active.abortController?.abort(new Error('The browser operation was cancelled.'));
+      return;
+    }
+    const acknowledgement = transportArg.activeAcknowledgements.get(operationIdArg);
+    if (acknowledgement && !acknowledgement.terminal) {
+      acknowledgement.terminal = true;
+      this.queueBrowserOperationResult(viewArg, transportArg, operationIdArg, {
+        status: 'cancelled',
+      });
+    }
+  }
+
+  private ensureBrowserOperationDrain(
+    viewArg: IControllerBrowserView,
+    transportArg: IControllerBrowserViewTransport,
+  ): void {
+    if (
+      transportArg.drainTask
+      || viewArg.lifecycle !== 'active'
+      || transportArg.lifecycle !== 'active'
+    ) return;
+    const drainTask = this.drainBrowserOperations(viewArg, transportArg).finally(() => {
+      if (transportArg.drainTask === drainTask) transportArg.drainTask = undefined;
+      if (
+        viewArg.lifecycle === 'active'
+        && transportArg.lifecycle === 'active'
+        && transportArg.operationQueue.length > 0
+      ) this.ensureBrowserOperationDrain(viewArg, transportArg);
+    });
+    transportArg.drainTask = drainTask;
+    void drainTask.catch((errorArg) => {
+      this.noteBrowserTransportFault(viewArg, transportArg, errorArg, false);
+    });
+  }
+
+  private async drainBrowserOperations(
+    viewArg: IControllerBrowserView,
+    transportArg: IControllerBrowserViewTransport,
+  ): Promise<void> {
+    while (
+      viewArg.lifecycle === 'active'
+      && transportArg.lifecycle === 'active'
+      && viewArg.transport === transportArg
+    ) {
+      const queued = transportArg.operationQueue.shift();
+      if (!queued) return;
+      transportArg.queuedOperationBytes -= queued.byteLength;
+      if (queued.terminal) continue;
+      if (queued.operation.type === 'acknowledgeFrame') {
+        this.startBrowserAcknowledgement(viewArg, transportArg, queued);
+        continue;
+      }
+      transportArg.activeMutation = queued;
+      queued.abortController = new AbortController();
+      const peerAbortController = viewArg.transportPeer.context.state[
+        operationAbortControllerPeerStateKey
+      ];
+      const operationSignal = AbortSignal.any([
+        queued.abortController.signal,
+        viewArg.activationAbortController.signal,
+        transportArg.abortController.signal,
+        this.operationAbortController.signal,
+        ...(peerAbortController instanceof AbortController ? [peerAbortController.signal] : []),
+      ]);
+      try {
+        const state = await this.runBrowserMutationOperation(
+          viewArg,
+          transportArg,
+          queued.operation,
+          operationSignal,
+        );
+        this.settleBrowserOperation(viewArg, transportArg, queued, {
+          status: 'succeeded',
+          ...(state === undefined ? {} : { state }),
+        });
+      } catch (errorArg) {
+        this.settleBrowserOperation(
+          viewArg,
+          transportArg,
+          queued,
+          queued.cancelled || operationSignal.aborted
+            ? { status: 'cancelled' }
+            : { status: 'failed', error: this.browserOperationError(errorArg) },
+        );
+      } finally {
+        if (transportArg.activeMutation === queued) transportArg.activeMutation = undefined;
+      }
+    }
+  }
+
+  private async runBrowserMutationOperation(
+    viewArg: IControllerBrowserView,
+    transportArg: IControllerBrowserViewTransport,
+    operationArg: Exclude<TControllerBrowserViewOperation, { type: 'acknowledgeFrame' }>,
+    signalArg: AbortSignal,
+  ): Promise<IControllerBrowserViewState | undefined> {
+    const execute = async (operationSignalArg: AbortSignal) => {
+      await this.assertBrowserViewAuthority(
+        viewArg,
+        transportArg.generation,
+        transportArg.identity,
+        operationSignalArg,
+      );
+      await this.executeBrowserMutation(viewArg, operationArg, operationSignalArg);
+    };
+    if (this.isBrowserSemanticOperation(operationArg)) {
+      await this.runOperation(viewArg.transportPeer, execute, signalArg);
+      return this.nextControllerBrowserViewState(viewArg, viewArg.handle.lease.getState());
+    }
+    if (this.lifecycleState !== 'ready' || this.stopRequested) {
+      throw new Error('The controller is not ready to accept browser input.');
+    }
+    await execute(signalArg);
+    return undefined;
+  }
+
+  private isBrowserSemanticOperation(operationArg: TControllerBrowserViewOperation): boolean {
+    return operationArg.type === 'navigate'
+      || operationArg.type === 'createTab'
+      || operationArg.type === 'activateTab'
+      || operationArg.type === 'closeTab'
+      || operationArg.type === 'back'
+      || operationArg.type === 'forward'
+      || operationArg.type === 'reload';
+  }
+
+  private async executeBrowserMutation(
+    viewArg: IControllerBrowserView,
+    operationArg: Exclude<TControllerBrowserViewOperation, { type: 'acknowledgeFrame' }>,
+    signalArg: AbortSignal,
+  ): Promise<void> {
+    const lease = viewArg.handle.lease;
+    switch (operationArg.type) {
+      case 'setViewport':
+        await lease.setViewport(operationArg.viewport, { signal: signalArg });
+        return;
+      case 'dispatchMouse':
+        await lease.dispatchMouse(operationArg.input, { signal: signalArg });
+        return;
+      case 'dispatchWheel':
+        await lease.dispatchWheel(operationArg.input, { signal: signalArg });
+        return;
+      case 'dispatchKey':
+        await lease.dispatchKey(operationArg.input, { signal: signalArg });
+        return;
+      case 'insertText':
+        await lease.insertText(operationArg.input, { signal: signalArg });
+        return;
+      case 'navigate':
+        await lease.executeHumanAction({
+          action: 'navigate',
+          url: operationArg.url,
+          ...(operationArg.tabId === undefined ? {} : { tabId: operationArg.tabId }),
+          ...(operationArg.timeoutMs === undefined ? {} : { timeoutMs: operationArg.timeoutMs }),
+        }, { signal: signalArg });
+        return;
+      case 'createTab':
+        await lease.createTab({
+          ...(operationArg.url === undefined ? {} : { url: operationArg.url }),
+          ...(operationArg.activate === undefined ? {} : { activate: operationArg.activate }),
+        }, { signal: signalArg });
+        return;
+      case 'activateTab':
+        await lease.activateTab(operationArg.tabId, { signal: signalArg });
+        return;
+      case 'closeTab':
+        await lease.closeTab(operationArg.tabId, { signal: signalArg });
+        return;
+      case 'back':
+        await lease.back(
+          operationArg.tabId === undefined ? {} : { tabId: operationArg.tabId },
+          { signal: signalArg },
+        );
+        return;
+      case 'forward':
+        await lease.forward(
+          operationArg.tabId === undefined ? {} : { tabId: operationArg.tabId },
+          { signal: signalArg },
+        );
+        return;
+      case 'reload':
+        await lease.reload(
+          operationArg.tabId === undefined ? {} : { tabId: operationArg.tabId },
+          { signal: signalArg },
+        );
+    }
+  }
+
+  private startBrowserAcknowledgement(
+    viewArg: IControllerBrowserView,
+    transportArg: IControllerBrowserViewTransport,
+    queuedArg: IControllerBrowserQueuedOperation,
   ): void {
-    const eventBytes = eventArg.type === 'frame' ? eventArg.frame.data.byteLength : 0;
+    const operationRequest = queuedArg.operation;
+    if (operationRequest.type !== 'acknowledgeFrame') return;
     if (
-      viewArg.pendingEventCount >= maxPendingBrowserViewEvents
-      || eventBytes > plugins.typedsocket.VIRTUAL_STREAM_MAX_LOGICAL_CHUNK_BYTES
-      || viewArg.pendingEventBytes + eventBytes > maxPendingBrowserViewEventBytes
+      transportArg.activeAcknowledgements.size
+      >= controllerBrowserTransportMaximumActiveAcknowledgements
     ) {
-      this.scheduleBrowserViewClose(viewArg, new Error('The browser view delivery queue is full.'));
+      this.settleBrowserOperation(viewArg, transportArg, queuedArg, {
+        status: 'failed',
+        error: { code: 'operation_limit', message: 'Frame acknowledgement capacity was reached.' },
+      });
       return;
     }
-    const queuedEvent: plugins.browserRuntime.TBrowserRuntimeEvent = eventArg.type === 'frame'
-      ? { type: 'frame', frame: { ...eventArg.frame, data: Uint8Array.from(eventArg.frame.data) } }
-      : eventArg;
-    viewArg.pendingEventCount += 1;
-    viewArg.pendingEventBytes += eventBytes;
-    const delivery = viewArg.deliveryTail.then(async () => {
-      if (viewArg.closing || this.browserViews.get(viewArg.id) !== viewArg) return;
-      await this.sendBrowserViewEvent(viewArg, queuedEvent);
-    }).catch((errorArg) => {
-      this.scheduleBrowserViewClose(viewArg, errorArg);
+    const acknowledgement: IControllerBrowserAcknowledgementOperation = {
+      operationId: queuedArg.operationId,
+      terminal: false,
+      operation: Promise.resolve(),
+    };
+    transportArg.activeAcknowledgements.set(queuedArg.operationId, acknowledgement);
+    const operation = (async () => {
+      try {
+        await this.assertBrowserViewAuthority(
+          viewArg,
+          transportArg.generation,
+          transportArg.identity,
+          transportArg.abortController.signal,
+        );
+        const accepted = await viewArg.handle.lease.acknowledgeFrame(
+          operationRequest.acknowledgement,
+        );
+        if (!acknowledgement.terminal) {
+          acknowledgement.terminal = true;
+          this.queueBrowserOperationResult(viewArg, transportArg, queuedArg.operationId, {
+            status: 'succeeded',
+            accepted,
+          });
+        }
+      } catch (errorArg) {
+        if (!acknowledgement.terminal) {
+          acknowledgement.terminal = true;
+          this.queueBrowserOperationResult(viewArg, transportArg, queuedArg.operationId, {
+            status: 'failed',
+            error: this.browserOperationError(errorArg),
+          });
+        }
+      } finally {
+        transportArg.activeAcknowledgements.delete(queuedArg.operationId);
+      }
+    })();
+    acknowledgement.operation = operation;
+  }
+
+  private settleBrowserOperation(
+    viewArg: IControllerBrowserView,
+    transportArg: IControllerBrowserViewTransport,
+    queuedArg: IControllerBrowserQueuedOperation,
+    resultArg: IControllerBrowserOperationResultPacket['result'],
+  ): void {
+    if (queuedArg.terminal) return;
+    queuedArg.terminal = true;
+    this.queueBrowserOperationResult(viewArg, transportArg, queuedArg.operationId, resultArg);
+  }
+
+  private queueBrowserOperationResult(
+    viewArg: IControllerBrowserView,
+    transportArg: IControllerBrowserViewTransport,
+    operationIdArg: number,
+    resultArg: IControllerBrowserOperationResultPacket['result'],
+  ): void {
+    transportArg.cancellableOperationIds.delete(operationIdArg);
+    try {
+      this.queueBrowserServerPacket(viewArg, transportArg, {
+        protocol: controllerBrowserTransportProtocol,
+        streamGeneration: transportArg.generation,
+        type: 'operationResult',
+        operationId: operationIdArg,
+        result: resultArg,
+      });
+    } catch (errorArg) {
+      this.noteBrowserTransportFault(viewArg, transportArg, errorArg, false);
+    }
+  }
+
+  private queueBrowserServerPacket(
+    viewArg: IControllerBrowserView,
+    transportArg: IControllerBrowserViewTransport,
+    packetArg: TControllerBrowserServerPacket,
+    rawFrameArg?: Uint8Array,
+  ): Promise<void> | undefined {
+    if (
+      viewArg.closing
+      || viewArg.transport !== transportArg
+      || !this.browserTransportCanDeliverPacket(transportArg, packetArg)
+    ) return undefined;
+    const packetBytes = encodeControllerBrowserTransportPacket(packetArg);
+    const eventBytes = packetBytes.byteLength + (rawFrameArg?.byteLength ?? 0);
+    if (
+      transportArg.pendingEventCount >= controllerBrowserTransportMaximumPendingEvents
+      || transportArg.pendingEventBytes + eventBytes
+        > controllerBrowserTransportMaximumPendingEventBytes
+    ) throw new Error('The browser view delivery queue is full.');
+    transportArg.pendingEventCount += 1;
+    transportArg.pendingEventBytes += eventBytes;
+    const delivery = transportArg.deliveryTail.then(async () => {
+      if (
+        viewArg.closing
+        || viewArg.transport !== transportArg
+        || !this.browserTransportCanDeliverPacket(transportArg, packetArg)
+      ) return;
+      await transportArg.events.send(packetBytes);
+      if (rawFrameArg) await transportArg.events.send(rawFrameArg);
+    });
+    transportArg.deliveryTail = delivery.then(() => undefined, () => undefined);
+    void delivery.catch((errorArg) => {
+      this.noteBrowserTransportFault(viewArg, transportArg, errorArg, true);
     }).finally(() => {
-      viewArg.pendingEventCount -= 1;
-      viewArg.pendingEventBytes -= eventBytes;
+      transportArg.pendingEventCount -= 1;
+      transportArg.pendingEventBytes -= eventBytes;
     });
-    viewArg.deliveryTail = delivery;
+    return delivery;
   }
 
-  private async sendBrowserViewEvent(
+  private browserTransportCanDeliverPacket(
+    transportArg: IControllerBrowserViewTransport,
+    packetArg: TControllerBrowserServerPacket,
+  ): boolean {
+    return transportArg.lifecycle === 'active'
+      || (transportArg.lifecycle === 'ready' && packetArg.type === 'operationResult');
+  }
+
+  private failBrowserTransportProtocol(
     viewArg: IControllerBrowserView,
-    eventArg: plugins.browserRuntime.TBrowserRuntimeEvent,
+    transportArg: IControllerBrowserViewTransport,
+    reasonArg: unknown,
+  ): void {
+    if (transportArg.lifecycle === 'retiring' || transportArg.lifecycle === 'retired') return;
+    transportArg.lifecycle = 'failed';
+    transportArg.failure = reasonArg;
+    this.terminalizeBrowserTransportOperations(transportArg, reasonArg);
+    void transportArg.events.abort(reasonArg).catch(() => undefined);
+    void transportArg.operations.abort(reasonArg).catch(() => undefined);
+    if (viewArg.transport !== transportArg) return;
+    this.scheduleBrowserViewClose(viewArg, reasonArg);
+  }
+
+  private noteBrowserTransportFault(
+    viewArg: IControllerBrowserView,
+    transportArg: IControllerBrowserViewTransport,
+    reasonArg: unknown,
+    recoverableArg: boolean,
+  ): void {
+    if (
+      transportArg.lifecycle === 'failed'
+      || transportArg.lifecycle === 'retiring'
+      || transportArg.lifecycle === 'retired'
+    ) return;
+    transportArg.lifecycle = 'failed';
+    transportArg.failure = reasonArg;
+    this.terminalizeBrowserTransportOperations(transportArg, reasonArg);
+    void transportArg.events.abort(reasonArg).catch(() => undefined);
+    void transportArg.operations.abort(reasonArg).catch(() => undefined);
+    if (viewArg.transport !== transportArg) return;
+    if (
+      recoverableArg
+      && !viewArg.closing
+      && viewArg.transport === transportArg
+      && viewArg.lifecycle === 'active'
+    ) {
+      viewArg.lifecycle = 'recoverable';
+      viewArg.recoveryDeadlineAt = Date.now() + controllerBrowserTransportRecoveryGraceMs;
+      this.armBrowserViewRecoveryDeadline(viewArg);
+      return;
+    }
+    this.scheduleBrowserViewClose(viewArg, reasonArg);
+  }
+
+  private terminalizeBrowserTransportOperations(
+    transportArg: IControllerBrowserViewTransport,
+    reasonArg: unknown,
+  ): void {
+    if (!transportArg.abortController.signal.aborted) {
+      transportArg.abortController.abort(reasonArg);
+    }
+    for (const queued of transportArg.operationQueue.splice(0)) queued.terminal = true;
+    transportArg.queuedOperationBytes = 0;
+    transportArg.cancellableOperationIds.clear();
+    if (transportArg.activeMutation) {
+      transportArg.activeMutation.cancelled = true;
+      transportArg.activeMutation.abortController?.abort(reasonArg);
+    }
+    for (const acknowledgement of transportArg.activeAcknowledgements.values()) {
+      acknowledgement.terminal = true;
+    }
+  }
+
+  private armBrowserViewRecoveryDeadline(viewArg: IControllerBrowserView): void {
+    if (viewArg.recoveryTimer || viewArg.recoveryDeadlineAt === undefined) return;
+    const delayMs = Math.max(0, viewArg.recoveryDeadlineAt - Date.now());
+    const timer = setTimeout(() => {
+      if (viewArg.recoveryTimer === timer) viewArg.recoveryTimer = undefined;
+      if (viewArg.closing || viewArg.lifecycle === 'active') return;
+      this.scheduleBrowserViewClose(viewArg, new Error('Browser view recovery timed out.'));
+    }, delayMs);
+    viewArg.recoveryTimer = timer;
+    timer.unref?.();
+  }
+
+  private retireBrowserViewTransport(
+    viewArg: IControllerBrowserView,
+    transportArg: IControllerBrowserViewTransport,
+    deadlineAtArg: number,
   ): Promise<void> {
-    const typedSocket = this.typedServer?.typedsocket;
-    if (!typedSocket) throw new Error('The controller transport is unavailable.');
-    if (eventArg.type !== 'frame') {
-      const event: IReq_ControllerBrowserViewEvent['request']['event'] = eventArg.type === 'error'
-        ? {
-            type: 'error',
-            error: { ...eventArg.error, message: eventArg.error.code },
+    if (transportArg.lifecycle === 'retired') return Promise.resolve();
+    if (transportArg.retirementTask) return transportArg.retirementTask;
+    if (transportArg.retirementSettlement && !transportArg.retirementSettled) {
+      return Promise.reject(new Error('Browser stream generation cleanup remains pending.'));
+    }
+    if (!transportArg.retirementSettlement) {
+      transportArg.lifecycle = 'retiring';
+      const retirementReason = new Error('The browser stream generation was retired.');
+      this.terminalizeBrowserTransportOperations(transportArg, retirementReason);
+      const settlement = Promise.allSettled([
+        Promise.resolve().then(() => transportArg.events.abort(retirementReason)),
+        Promise.resolve().then(() => transportArg.operations.abort(retirementReason)),
+        transportArg.openingTask,
+        transportArg.receiveTask,
+        transportArg.drainTask,
+        transportArg.deliveryTail,
+        ...[...transportArg.activeAcknowledgements.values()].map((entryArg) => entryArg.operation),
+      ].filter((candidateArg): candidateArg is Promise<void> => candidateArg !== undefined))
+        .then(() => {
+          transportArg.retirementSettled = true;
+          transportArg.lifecycle = 'retired';
+          const stillAssociated = viewArg.transport === transportArg;
+          const slot = this.browserViewSlots.get(viewArg.peerId);
+          if (stillAssociated && viewArg.closing) viewArg.transport = undefined;
+          if (
+            transportArg.retirementDeadlineExpired
+            && stillAssociated
+            && viewArg.closing
+            && slot?.view === viewArg
+          ) {
+            void this.requestBrowserViewCleanup(slot, viewArg, retirementReason).catch((errorArg) => {
+              console.error(`Browser view ${viewArg.id} late cleanup failed.`, errorArg);
+            });
           }
-        : {
-            type: 'state',
-            state: this.toControllerBrowserViewState(eventArg.state),
-          };
-      await typedSocket.createTypedRequest<IReq_ControllerBrowserViewEvent>(
-        'controller.browser.view.event',
-        viewArg.transportConnection,
-        { timeoutMs: 5_000 },
-      ).fire({
-        viewId: viewArg.id,
-        resourceId: viewArg.resource.id,
-        attachmentRevision: viewArg.resource.attachmentRevision,
-        event,
-      }, { timeoutMs: 5_000, maxRetries: 0 });
-      return;
+        });
+      transportArg.retirementSettlement = settlement;
     }
-    const { data, ...frame } = eventArg.frame;
-    const integrity: plugins.typedrequestInterfaces.IVirtualStreamIntegrity = Object.freeze({
-      algorithm: 'sha256',
-      byteLength: data.byteLength,
-      digest: `sha256:${plugins.crypto.createHash('sha256').update(data).digest('hex')}`,
-    });
-    const authorization: IControllerBrowserFrameStreamAuthorization = Object.freeze({
-      marker: browserFrameStreamAuthorizationMarker,
-      view: viewArg,
-      authority: viewArg.authority,
-      transportPeer: viewArg.transportPeer,
-      contentType: frame.mimeType,
-      integrity,
+    if (transportArg.retirementSettled) return Promise.resolve();
+    const retirement = this.waitForBrowserTransportSettlement(
+      transportArg.retirementSettlement,
+      deadlineAtArg,
+    ).catch((errorArg) => {
+      transportArg.retirementDeadlineExpired = true;
+      throw errorArg;
     });
-    const stream = typedSocket.createVirtualStream({
-      target: viewArg.transportConnection,
-      creatorDirection: 'send',
-      contentType: frame.mimeType,
-      integrity,
-      authorization,
+    let tracked!: Promise<void>;
+    tracked = retirement.finally(() => {
+      if (transportArg.retirementTask === tracked) transportArg.retirementTask = undefined;
     });
-    viewArg.activeFrameStreams.add(stream);
-    const event: IReq_ControllerBrowserViewEvent['request']['event'] = {
-      type: 'frame',
-      frame: { ...frame, dataStream: stream },
-    };
-    const push = typedSocket.createTypedRequest<IReq_ControllerBrowserViewEvent>(
-      'controller.browser.view.event',
-      viewArg.transportConnection,
-      { timeoutMs: 5_000 },
-    ).fire({
-      viewId: viewArg.id,
-      resourceId: viewArg.resource.id,
-      attachmentRevision: viewArg.resource.attachmentRevision,
-      event,
-    }, { timeoutMs: 5_000, maxRetries: 0 });
-    const production = (async () => {
-      await stream.send(data);
-      await stream.close();
-    })();
+    transportArg.retirementTask = tracked;
+    return tracked;
+  }
+
+  private async waitForBrowserTransportSettlement(
+    settlementArg: Promise<void>,
+    deadlineAtArg: number,
+  ): Promise<void> {
+    const remainingMs = deadlineAtArg - Date.now();
+    if (remainingMs <= 0) throw new Error('Browser stream generation cleanup timed out.');
+    let timeout: ReturnType<typeof setTimeout> | undefined;
     try {
-      await Promise.all([push, production]);
-    } catch (errorArg) {
-      await stream.abort(errorArg).catch(() => undefined);
-      await Promise.allSettled([push, production]);
-      throw errorArg;
+      await Promise.race([
+        settlementArg,
+        new Promise<never>((_resolve, reject) => {
+          timeout = setTimeout(
+            () => reject(new Error('Browser stream generation cleanup timed out.')),
+            remainingMs,
+          );
+          timeout.unref?.();
+        }),
+      ]);
     } finally {
-      viewArg.activeFrameStreams.delete(stream);
+      if (timeout) clearTimeout(timeout);
     }
   }
 
-  private bindBrowserFrameStreamAuthorization(
+  private browserOperationError(errorArg: unknown): { code: string; message: string } {
+    const typedError = asTypedResponseError(errorArg);
+    const code = typeof typedError.errorData?.code === 'string'
+      ? typedError.errorData.code.slice(0, 128)
+      : 'browser_operation_failed';
+    return { code, message: typedError.message.slice(0, 512) };
+  }
+
+  private bindBrowserStreamAuthorization(
     authorizationArg: unknown,
     contextArg: Readonly<plugins.typedsocket.IVirtualStreamAuthorizationContext>,
   ): plugins.typedsocket.IVirtualStreamAuthorizationBinding {
     if (typeof authorizationArg !== 'object' || authorizationArg === null) {
-      throw new Error('Unknown browser frame stream authority.');
+      throw new Error('Unknown browser stream authority.');
     }
-    const authorization = authorizationArg as Partial<IControllerBrowserFrameStreamAuthorization>;
+    const authorization = authorizationArg as Partial<IControllerBrowserStreamAuthorization>;
     const view = authorization.view;
     if (
-      authorization.marker !== browserFrameStreamAuthorizationMarker
+      authorization.marker !== browserStreamAuthorizationMarker
       || !view
       || authorization.authority !== view.authority
       || authorization.transportPeer !== view.transportPeer
+      || typeof authorization.transportIdentity !== 'symbol'
       || contextArg.target !== view.transportPeer
-      || contextArg.creatorDirection !== 'send'
+      || authorization.streamGeneration !== view.streamGeneration
+      || contextArg.creatorDirection !== authorization.creatorDirection
       || contextArg.contentType !== authorization.contentType
-      || contextArg.integrity?.algorithm !== authorization.integrity?.algorithm
-      || contextArg.integrity?.byteLength !== authorization.integrity?.byteLength
-      || contextArg.integrity?.digest !== authorization.integrity?.digest
+      || contextArg.integrity !== undefined
       || view.closing
-      || view.activationState === 'inactive'
       || this.browserViews.get(view.id) !== view
       || this.browserViewSlots.get(view.peerId)?.view !== view
-      || !this.isBrowserRuntimeAuthorityCurrent(view)
-    ) throw new Error('The browser frame stream authority is unavailable.');
-    const bound = authorization as IControllerBrowserFrameStreamAuthorization;
+      || !this.isBrowserStreamBindingAuthorityCurrent(
+        view,
+        authorization.streamGeneration,
+        authorization.transportIdentity,
+      )
+    ) throw new Error('The browser stream authority is unavailable.');
+    const bound = authorization as IControllerBrowserStreamAuthorization;
     return {
-      revalidate: (revalidationArg) => this.revalidateBrowserFrameStream(
+      revalidate: (revalidationArg) => this.revalidateBrowserStream(
         bound,
         revalidationArg,
       ),
     };
   }
 
-  private async revalidateBrowserFrameStream(
-    authorizationArg: IControllerBrowserFrameStreamAuthorization,
+  private async revalidateBrowserStream(
+    authorizationArg: IControllerBrowserStreamAuthorization,
     contextArg: Readonly<plugins.typedsocket.IVirtualStreamRevalidationContext>,
   ): Promise<boolean> {
     const view = authorizationArg.view;
@@ -13621,32 +14645,93 @@ export class OpenCodeController {
       || contextArg.connection.peer !== authorizationArg.transportPeer
       || view.transportPeer !== authorizationArg.transportPeer
       || view.authority !== authorizationArg.authority
-      || view.closing
-      || view.activationState === 'inactive'
-      || this.browserViews.get(view.id) !== view
-      || this.browserViewSlots.get(view.peerId)?.view !== view
-      || !this.authenticatedPeerIds.has(view.peerId)
-      || typeof view.transportPeer.context.state[authenticatedPeerStateKey] !== 'string'
+      || view.streamGeneration !== authorizationArg.streamGeneration
+      || !this.isBrowserViewInMemoryAuthorityCurrent(
+        view,
+        authorizationArg.streamGeneration,
+        authorizationArg.transportIdentity,
+      )
       || view.transportPeer.context.headers.get('origin') !== this.requireRuntimeConfig().publicOrigin
-      || !this.isBrowserRuntimeAuthorityCurrent(view)
     ) return false;
     try {
-      const current = await awaitWithAbortSignal(this.requireAuthStore().getResource(
-        view.resource.projectId,
-        view.resource.id,
-      ), contextArg.abortSignal);
-      return current !== undefined
-        && current.kind === 'browser'
-        && current.lifecycle === 'active'
-        && current.pendingAttachment === undefined
-        && current.attachmentAuthorityId === view.resource.attachmentAuthorityId
-        && current.attachmentRevision === view.resource.attachmentRevision
-        && this.isBrowserRuntimeAuthorityCurrent(view);
+      await this.assertBrowserViewAuthority(
+        view,
+        authorizationArg.streamGeneration,
+        authorizationArg.transportIdentity,
+        contextArg.abortSignal,
+      );
+      return true;
     } catch {
       return false;
     }
   }
 
+  private isBrowserStreamBindingAuthorityCurrent(
+    viewArg: IControllerBrowserView,
+    streamGenerationArg: number,
+    transportIdentityArg: symbol,
+  ): boolean {
+    return !viewArg.closing
+      && viewArg.lifecycle !== 'closing'
+      && viewArg.streamGeneration === streamGenerationArg
+      && viewArg.pendingTransportIdentity === transportIdentityArg
+      && this.browserViews.get(viewArg.id) === viewArg
+      && this.browserViewSlots.get(viewArg.peerId)?.view === viewArg
+      && this.authenticatedPeerIds.has(viewArg.peerId)
+      && viewArg.transportPeer.context.state[authenticatedPeerStateKey] === viewArg.credentialId
+      && this.isBrowserRuntimeAuthorityCurrent(viewArg);
+  }
+
+  private isBrowserViewInMemoryAuthorityCurrent(
+    viewArg: IControllerBrowserView,
+    streamGenerationArg: number,
+    transportIdentityArg: symbol,
+  ): boolean {
+    return !viewArg.closing
+      && viewArg.lifecycle !== 'closing'
+      && viewArg.streamGeneration === streamGenerationArg
+      && viewArg.transport?.identity === transportIdentityArg
+      && this.browserViews.get(viewArg.id) === viewArg
+      && this.browserViewSlots.get(viewArg.peerId)?.view === viewArg
+      && this.authenticatedPeerIds.has(viewArg.peerId)
+      && viewArg.transportPeer.context.state[authenticatedPeerStateKey] === viewArg.credentialId
+      && this.isBrowserRuntimeAuthorityCurrent(viewArg);
+  }
+
+  private async assertBrowserViewAuthority(
+    viewArg: IControllerBrowserView,
+    streamGenerationArg: number,
+    transportIdentityArg: symbol,
+    signalArg: AbortSignal,
+  ): Promise<void> {
+    signalArg.throwIfAborted();
+    if (!this.isBrowserViewInMemoryAuthorityCurrent(
+      viewArg,
+      streamGenerationArg,
+      transportIdentityArg,
+    )) {
+      throw new ControllerResourceUnavailableError('The browser view authority is unavailable.');
+    }
+    const current = await awaitWithAbortSignal(this.requireAuthStore().getResource(
+      viewArg.resource.projectId,
+      viewArg.resource.id,
+    ), signalArg);
+    signalArg.throwIfAborted();
+    if (
+      !current
+      || current.kind !== 'browser'
+      || current.lifecycle !== 'active'
+      || current.pendingAttachment
+      || current.attachmentAuthorityId !== viewArg.resource.attachmentAuthorityId
+      || current.attachmentRevision !== viewArg.resource.attachmentRevision
+      || !this.isBrowserViewInMemoryAuthorityCurrent(
+        viewArg,
+        streamGenerationArg,
+        transportIdentityArg,
+      )
+    ) throw new ControllerResourceUnavailableError('The browser resource changed.');
+  }
+
   private isBrowserRuntimeAuthorityCurrent(viewArg: IControllerBrowserView): boolean {
     try {
       return viewArg.handle.lease.isAuthorityCurrent(viewArg.authority);
@@ -13655,11 +14740,14 @@ export class OpenCodeController {
     }
   }
 
-  private toControllerBrowserViewState(
+  private nextControllerBrowserViewState(
+    viewArg: IControllerBrowserView,
     stateArg: plugins.browserRuntime.IBrowserRuntimeState,
-  ): IReq_ControllerBrowserViewOpen['response']['state'] {
+  ): IControllerBrowserViewState {
     const { lastError, ...state } = stateArg;
+    viewArg.stateRevision += 1;
     return {
+      revision: viewArg.stateRevision,
       ...state,
       ...(lastError === undefined ? {} : {
         lastError: { ...lastError, message: lastError.code },