unified-ble-manager 4.0.0-alpha.21 → 4.0.0-alpha.24

package/CHANGELOG.md

@@ -6,6 +6,52 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [4.0.0-alpha.24] - 2026-07-31
+
+### Changed
+
+- Electron event acknowledgements now preserve normalized contract failures
+  across the main/preload/renderer boundary instead of collapsing them into
+  generic transport errors.
+
+### Fixed
+
+- Made renderer ownership self-healing after an Electron document reload or
+  replacement navigation: the exact stale lease is invalidated, its resources
+  are quarantined, and a fresh renderer client can bootstrap without reusing
+  scans, connections, subscriptions, or pending events from the old generation.
+- Prevented permanent acknowledgement failures, oversized-response rollback
+  failures, malformed IPC input, and late renderer cleanup from leaking or
+  retrying resources indefinitely.
+- Preserved the final authoritative main-router cleanup receipt when renderer
+  destruction follows an earlier ambiguous cleanup failure.
+
+## [4.0.0-alpha.23] - 2026-07-31
+
+### Fixed
+
+- Updated the canonical packed-artifact Electron smoke to model the complete
+  Electron 43 navigation and load-failure listener surface used by renderer
+  ownership tracking.
+
+## [4.0.0-alpha.22] - 2026-07-31
+
+### Changed
+
+- Electron renderer ownership now tracks replacement navigation with Electron's
+  structured navigation details and one sender-scoped navigation epoch shared
+  by overlapping renderer leases.
+- Added compiler proof that Electron 43 `WebContents` satisfies the public
+  main-process binding contract.
+
+### Fixed
+
+- Prevented the initial document's late `did-navigate` event from retiring the
+  renderer lease that document had just bootstrapped.
+- Quarantined every lease admitted after a replacement navigation starts,
+  including Strict Mode overlap, so the committed replacement document cannot
+  inherit stale scans, connections, subscriptions, or acknowledgements.
+
 ## [4.0.0-alpha.21] - 2026-07-31
 
 ### Added

package/MIGRATION_4.0.md

@@ -6,7 +6,7 @@
 
 **Architecture and sequencing authority:** [`docs/UNIFIED_BLE_4.0_IMPLEMENTATION_PLAN.md`](docs/UNIFIED_BLE_4.0_IMPLEMENTATION_PLAN.md)
 
-`unified-ble-manager@4.0.0-alpha.21` is the current public 4.0 prerelease. 4.0
+`unified-ble-manager@4.0.0-alpha.24` is the current public 4.0 prerelease. 4.0
 started as a new package with no released 4.0 consumer baseline. This is an
 adoption guide for a project that chooses to move from another BLE integration,
 not a supported in-place upgrade from `@sfourdrinier/react-native-ble-plx`.
@@ -18,13 +18,13 @@ Install the exact currently supported package line with your application's
 package manager:
 
 ```sh
-pnpm add unified-ble-manager@4.0.0-alpha.21
+pnpm add unified-ble-manager@4.0.0-alpha.24
 ```
 
-`next` is the mutable prerelease dist-tag; it currently resolves to alpha.21.
+`next` is the mutable prerelease dist-tag; it currently resolves to alpha.24.
 Pin the exact version you evaluate, and do not use a bare install or `@latest`
 to select the 4.0 alpha train. The prerelease package is Experimental: no
-current evidence record links alpha.21's package artifact to a hardware-backed
+current evidence record links alpha.24's package artifact to a hardware-backed
 backend support claim. See [`docs/PLATFORMS.md`](docs/PLATFORMS.md).
 
 Use only documented package subpaths. The root export is host-neutral; import

package/README.md

@@ -2,7 +2,7 @@
 
 # unified-ble-manager
 
-`unified-ble-manager@4.0.0-alpha.21` is the current public 4.0 prerelease for
+`unified-ble-manager@4.0.0-alpha.24` is the current public 4.0 prerelease for
 explicit, bytes-first Bluetooth Low Energy management across React Native, Web,
 Electron, and Node hosts. 4.0 is a new package line with no released 4.0
 consumer baseline; adopting it is an explicit integration, not a source-
@@ -16,14 +16,14 @@ The controlling architecture and sequencing record is
 
 ## Release status and evidence boundary
 
-`v4.0.0-alpha.21` is published to npm under the `next` dist-tag and has a
-[GitHub Release](https://github.com/sfourdrinier/react-native-ble-plx/releases/tag/v4.0.0-alpha.21).
+`v4.0.0-alpha.24` is published to npm under the `next` dist-tag and has a
+[GitHub Release](https://github.com/sfourdrinier/react-native-ble-plx/releases/tag/v4.0.0-alpha.24).
 It was published by GitHub Actions trusted publishing with an npm SLSA
 provenance attestation. This proves the package release path, not Bluetooth
 behavior.
 
 The package and deterministic contract surface are **Experimental**. No current
-evidence record binds the published alpha.21 artifact to a hardware-backed
+evidence record binds the published alpha.24 artifact to a hardware-backed
 backend scenario, so no React Native, Web, Node, or Electron backend is
 Preview, Live Preview, Supported, or Reliability-qualified. Missing hardware
 evidence blocks those labels only; it does not invalidate deterministic or
@@ -47,10 +47,10 @@ validation substitute.
 Pin the exact prerelease you validated. pnpm is used in this repository:
 
 ```sh
-pnpm add unified-ble-manager@4.0.0-alpha.21
+pnpm add unified-ble-manager@4.0.0-alpha.24
 ```
 
-`next` is the mutable prerelease dist-tag. It currently resolves to alpha.21,
+`next` is the mutable prerelease dist-tag. It currently resolves to alpha.24,
 but a later alpha can change it without changing your lockfile intent. Do not install
 the bare package name or `@latest` when adopting 4.0 alpha: those do not select
 the 4.0 prerelease train. Use your package manager's exact-version syntax when
@@ -300,10 +300,10 @@ final version uses npm `latest` and a normal GitHub Release.
 Check an installed-release candidate against npm metadata before integrating it:
 
 ```sh
-npm view unified-ble-manager@4.0.0-alpha.21 version dist-tags dist.integrity dist.attestations _npmUser --json
+npm view unified-ble-manager@4.0.0-alpha.24 version dist-tags dist.integrity dist.attestations _npmUser --json
 ```
 
-For alpha.21, the result must identify the exact version, `next` dist-tag,
+For alpha.24, the result must identify the exact version, `next` dist-tag,
 package integrity, a SLSA provenance attestation, and GitHub Actions as the npm
 trusted publisher. Cross-check the tag and release notes at the GitHub Release
 linked above. Provenance and integrity do not verify live Bluetooth behavior;

package/RELEASE.md

@@ -20,18 +20,18 @@ especially its package, evidence, deletion, and Section 31 release gates.
 
 ## Current public prerelease
 
-`unified-ble-manager@4.0.0-alpha.21` was published from
-`v4.0.0-alpha.21` by GitHub Actions trusted publishing. The published npm
+`unified-ble-manager@4.0.0-alpha.24` was published from
+`v4.0.0-alpha.24` by GitHub Actions trusted publishing. The published npm
 metadata identifies GitHub Actions as the trusted publisher and includes an npm
 SLSA provenance attestation. Its
-[GitHub Release](https://github.com/sfourdrinier/react-native-ble-plx/releases/tag/v4.0.0-alpha.21)
-is a prerelease and its notes are generated from the alpha.21 section of
+[GitHub Release](https://github.com/sfourdrinier/react-native-ble-plx/releases/tag/v4.0.0-alpha.24)
+is a prerelease and its notes are generated from the alpha.24 section of
 [`CHANGELOG.md`](CHANGELOG.md).
 
 This is an Experimental package release. It proves a public package, tested
 exports, and the workflow's deterministic/package gates; it does not establish
 hardware support for a backend. The repository's current evidence records do
-not bind alpha.21's package artifact to a passed physical-radio scenario. No
+not bind alpha.24's package artifact to a passed physical-radio scenario. No
 backend is thereby Preview, Live Preview, Supported, or Reliability-qualified.
 See [`docs/PLATFORMS.md`](docs/PLATFORMS.md) and
 [`evidence/v1/README.md`](evidence/v1/README.md).
@@ -47,7 +47,7 @@ verifying that the pushed `vX.Y.Z` tag exactly matches `package.json`:
 
 | Version form | npm dist-tag | GitHub Release state | Consumer guidance |
 | --- | --- | --- | --- |
-| Hyphenated SemVer prerelease, such as `4.0.0-alpha.21` | `next` | prerelease | Pin the exact version for reproducible evaluation; `@next` is mutable. |
+| Hyphenated SemVer prerelease, such as `4.0.0-alpha.24` | `next` | prerelease | Pin the exact version for reproducible evaluation; `@next` is mutable. |
 | Final SemVer version, such as `4.0.0` | `latest` | normal release | Use the final version only after its published evidence supports the required host claim. |
 
 Do not use a bare install or `@latest` to select a 4.0 alpha. The exact package
@@ -87,18 +87,18 @@ Check the published version, dist-tag, integrity, attestation, and trusted
 publisher from npm:
 
 ```sh
-npm view unified-ble-manager@4.0.0-alpha.21 version dist-tags dist.integrity dist.attestations _npmUser --json
+npm view unified-ble-manager@4.0.0-alpha.24 version dist-tags dist.integrity dist.attestations _npmUser --json
 ```
 
 Then cross-check the matching tag and GitHub Release:
 
 ```sh
-gh release view v4.0.0-alpha.21 --repo sfourdrinier/react-native-ble-plx --json tagName,isPrerelease,publishedAt,url
+gh release view v4.0.0-alpha.24 --repo sfourdrinier/react-native-ble-plx --json tagName,isPrerelease,publishedAt,url
 ```
 
-For alpha.21, npm must report the exact version, `next`, integrity, a SLSA
+For alpha.24, npm must report the exact version, `next`, integrity, a SLSA
 provenance attestation, and GitHub Actions trusted publisher; GitHub must report
-the matching `v4.0.0-alpha.21` tag with `isPrerelease: true`. These checks
+the matching `v4.0.0-alpha.24` tag with `isPrerelease: true`. These checks
 verify release identity and supply chain metadata only. They do not verify BLE
 hardware behavior, platform permissions, browser availability, background
 operation, restoration, reconnect, or reliability.
@@ -111,7 +111,7 @@ backend, hardware, Live Preview, Supported, or Reliability-qualified claims.
 Deterministic fault injection remains useful 4.0 contract proof but is never
 physical-radio proof.
 
-At the time of alpha.21, GitHub private vulnerability reporting is disabled and
+At the time of alpha.24, GitHub private vulnerability reporting is disabled and
 no private reporting channel or supported-version response policy is published.
 Release notes and support material must not claim otherwise. Establish and
 publish that external repository policy before advertising a confidential

package/ROADMAP.4.0.md

@@ -44,7 +44,7 @@ Applications and vendor libraries own device choice, vendor protocols, product r
 
 ## Published alpha and support claims
 
-`unified-ble-manager@4.0.0-alpha.20` is published under npm's `next` dist-tag
+`unified-ble-manager@4.0.0-alpha.24` is published under npm's `next` dist-tag
 with GitHub Actions trusted publishing, npm SLSA provenance, and a GitHub
 prerelease. Its host-neutral root and explicit public subpaths are the current
 alpha package contract; users must pin an exact alpha version rather than infer
@@ -52,7 +52,7 @@ an API from transitional source files or examples. The alpha has no 3.x
 compatibility layer.
 
 The current package release is Experimental. There is no current evidence record
-linking alpha.20's package artifact to a passed physical-radio backend scenario,
+linking alpha.24's package artifact to a passed physical-radio backend scenario,
 so it makes no Preview-or-higher platform claim. Hardware evidence is required
 only for the corresponding support label; it does not erase package or
 deterministic proof.

package/docs/ELECTRON.md

@@ -19,10 +19,10 @@ There is no Noble dependency, renderer Web Bluetooth fallback, legacy
 `BlePort`, `PortBleManager`, or mock-radio production fallback in these
 entrypoints.
 
-The published `4.0.0-alpha.21` Electron surface is Experimental. The release
+The published `4.0.0-alpha.24` Electron surface is Experimental. The release
 workflow's packed Electron smoke is deterministic L1 package/IPC proof, not an
 Electron host, adapter, or peripheral support claim. No current evidence record
-binds alpha.21 to a physical Electron radio journey.
+binds alpha.24 to a physical Electron radio journey.
 
 ## Main-process backend selection
 

package/docs/EXPO_PLUGIN.md

@@ -12,7 +12,7 @@ options are exactly the schema implemented in `plugin/src/withBLE.ts`:
 
 The plugin configuration is part of the Experimental 4.0 alpha package. The
 release workflow validates Expo SDK 57 CNG prebuild and Android assembly, but no
-current evidence record binds alpha.21 to a physical device, permission,
+current evidence record binds alpha.24 to a physical device, permission,
 background, or restoration scenario. Configuration and compilation therefore do
 not make a live-radio or restoration support claim.
 

package/docs/GAPS.4.0.md

@@ -14,7 +14,7 @@ This file tracks platform code, CI, package, lab, and live-radio evidence. It do
 
 The pre-4.0 source tree contains a transitional `BleManager`, `BlePort`, `PortBleManager`, Base64 bridge, byte convenience methods, static capability helpers, Noble-era code, and host examples. Any statement below about that source is current-state characterization and migration input. It is not proof that a clean-baseline 4.0 replacement exists.
 
-`unified-ble-manager@4.0.0-alpha.21` is published as an Experimental package,
+`unified-ble-manager@4.0.0-alpha.24` is published as an Experimental package,
 but no current record in `evidence/v1/records/` binds that artifact to a passed
 physical-radio backend scenario. The records below are historical L0 context and
 must not be read as Preview-or-higher evidence for the published alpha.

package/docs/GETTING_STARTED.md

@@ -4,7 +4,7 @@
 
 ## 4.0 status
 
-`unified-ble-manager@4.0.0-alpha.21` is the current public 4.0 alpha package
+`unified-ble-manager@4.0.0-alpha.24` is the current public 4.0 alpha package
 line. It is a clean API line launched with no released 4.0 consumer baseline:
 choose one explicit host entrypoint and build the matching native integration
 before making a Bluetooth claim. It is not a source-compatible rename of the
@@ -15,13 +15,13 @@ The architecture and implementation sequence are controlled by [`UNIFIED_BLE_4.0
 ## Install and select a host
 
 ```sh
-pnpm add unified-ble-manager@4.0.0-alpha.21
+pnpm add unified-ble-manager@4.0.0-alpha.24
 ```
 
 The alpha train publishes under npm's mutable `next` dist-tag. Pin the exact
 version you validate; do not use a bare install or `@latest` to select 4.0
 alpha. The package is Experimental, and no current evidence record binds the
-published alpha.21 artifact to a physical-radio backend result. Package builds
+published alpha.24 artifact to a physical-radio backend result. Package builds
 and deterministic tests remain useful proof at their own scope, but do not
 create a platform support label.
 

package/docs/NODE.md

@@ -6,7 +6,7 @@ The root `unified-ble-manager` entrypoint is host-neutral. Node applications
 must select an owned backend through an explicit subpath; a package import never
 chooses an adapter, enables a mock, or falls back to Noble.
 
-The Node host surfaces in `4.0.0-alpha.21` are Experimental. No current
+The Node host surfaces in `4.0.0-alpha.24` are Experimental. No current
 evidence record binds the published alpha package artifact to a physical BlueZ,
 CoreBluetooth, or WinRT scenario, so these entrypoints are not Preview-or-higher
 support claims.

package/docs/PLATFORMS.md

@@ -8,8 +8,8 @@ This page is an evidence index, not a static 4.0 capability matrix. In 4.0, an a
 
 ## Current alpha maturity
 
-`unified-ble-manager@4.0.0-alpha.21` is an **Experimental** package release.
-No current evidence record binds the published alpha.21 artifact to a passed
+`unified-ble-manager@4.0.0-alpha.24` is an **Experimental** package release.
+No current evidence record binds the published alpha.24 artifact to a passed
 physical-radio backend scenario. Consequently, no backend below is currently
 Preview, Live Preview, Supported, or Reliability-qualified. This is not a
 static 4.0 capability matrix: the table says what public surface and automated

package/docs/WEB.md

@@ -8,7 +8,7 @@
 
 Web Bluetooth is a first-party 4.0 backend with browser chooser constraints
 represented as a typed feature. It is not continuous scanning in disguise and
-does not grant a static support claim. `unified-ble-manager@4.0.0-alpha.21`
+does not grant a static support claim. `unified-ble-manager@4.0.0-alpha.24`
 publishes this API under npm's `next` tag, but no current evidence record binds
 that artifact to a browser/adapter/peripheral live-radio scenario. Web is
 therefore Experimental, not Preview-or-higher.

package/lib/commonjs/electron/main-binding.js

@@ -30,6 +30,7 @@ const destroyedRendererRetryDelayMilliseconds = 100;
 class ElectronMainBleBinding {
   renderers = new Map();
   bootstrapAdmissionTails = new Map();
+  navigationStates = new WeakMap();
   installed = false;
   lifecycle = 'active';
   destroyResult = null;
@@ -42,7 +43,7 @@ class ElectronMainBleBinding {
     if (this.installed) {
       return;
     }
-    this.options.port.handle(_protocol.ELECTRON_BLE_IPC_CHANNEL, (event, request) => this.handle(event, request));
+    this.options.port.handle(_protocol.ELECTRON_BLE_IPC_CHANNEL, (event, request) => this.handleIpcRequest(event, request));
     this.installed = true;
   }
   uninstall() {
@@ -123,6 +124,12 @@ class ElectronMainBleBinding {
         this.completeRendererRelease(rendererLeaseId);
       }
     }
+    if (routerCleanup.state === 'released') {
+      return {
+        state: 'released',
+        failures: []
+      };
+    }
     const failures = [...routerCleanup.failures];
     for (const cleanup of releaseRecords) {
       failures.push(...cleanup.failures);
@@ -135,6 +142,38 @@ class ElectronMainBleBinding {
       failures
     };
   }
+  async handleIpcRequest(event, request) {
+    try {
+      assertElectronBleIpcRequest(request);
+      return await this.handle(event, request);
+    } catch (error) {
+      return this.failureResponse(error, request);
+    }
+  }
+  failureResponse(error, request) {
+    if (error instanceof _errors.BackendContractError) {
+      return {
+        kind: 'failure',
+        error: error.normalized
+      };
+    }
+    console.error('[ElectronMainBleBinding] IPC request failed:', {
+      functionName: 'ElectronMainBleBinding.handleIpcRequest',
+      operation: electronIpcRequestKind(request),
+      error
+    });
+    return {
+      kind: 'failure',
+      error: (0, _errors.contractError)('platform.failure', 'ipc', 'electron-main-binding.ipc-handler', {
+        domain: 'electron-ipc',
+        code: 'unexpected-handler-error',
+        safeMessage: 'The Electron main process could not complete the BLE request.',
+        metadata: {
+          requestKind: electronIpcRequestKind(request)
+        }
+      }).normalized
+    };
+  }
   async handle(event, request) {
     this.assertActiveLifecycle();
     this.assertMainFrame(event);
@@ -162,7 +201,19 @@ class ElectronMainBleBinding {
         kind: 'event.ack'
       };
     }
-    const response = await this.options.router.dispatch(trusted, request);
+    let response;
+    try {
+      response = await this.options.router.dispatch(trusted, request);
+    } catch (error) {
+      if (isRollbackReleaseRequiredError(error) && bound !== undefined) {
+        bound.releaseRequired = true;
+        const cleanup = await this.releaseRendererAuthoritatively(rendererLeaseId, bound);
+        if (cleanup?.state === 'released') {
+          throw (0, _errors.contractError)('ownership.denied', 'ipc', 'electron-main-arbiter.renderer-registration');
+        }
+      }
+      throw error;
+    }
     if (response.kind === 'release' && response.cleanup.state === 'released') {
       if (request.kind !== 'release') {
         throw (0, _errors.contractError)('lifecycle.invariant-violation', 'ipc', 'electron-main-binding.release-response');
@@ -200,6 +251,9 @@ class ElectronMainBleBinding {
     this.assertMainFrame(event);
     this.assertTrustedSenderCurrent(event, trusted);
     this.assertBootstrapSender(event.sender, trusted);
+    const navigationState = this.navigationState(event.sender);
+    const navigationEpochAtAdmission = navigationState.epoch;
+    const replacementWasPendingForAdmittedFrame = navigationState.pendingReplacement && navigationState.sourceFrame?.processId === event.processId && navigationState.sourceFrame.routingId === event.frameId;
     const response = await this.options.router.dispatch(trusted, {
       kind: 'bootstrap'
     });
@@ -212,17 +266,104 @@ class ElectronMainBleBinding {
     const destroyedListener = () => {
       this.retireRenderer(rendererLeaseId, renderer, true, 'destroyed');
     };
+    let replacementNavigationStarted = replacementWasPendingForAdmittedFrame || navigationState.epoch !== navigationEpochAtAdmission;
+    const navigationStartListener = details => {
+      if (details.isMainFrame && !details.isSameDocument) {
+        if (navigationState.lastStartDetails !== details) {
+          if (navigationState.pendingReplacement && navigationState.lastStartDetails !== null) {
+            navigationState.supersededTargetUrls.push(navigationState.lastStartDetails.url);
+          }
+          navigationState.epoch += 1;
+          navigationState.pendingReplacement = true;
+          navigationState.lastStartDetails = details;
+          navigationState.sourceFrame = Object.freeze({
+            processId: renderer.frame.processId,
+            routingId: renderer.frame.routingId
+          });
+        }
+        replacementNavigationStarted = true;
+      }
+    };
+    const navigationRedirectListener = details => {
+      if (details.isMainFrame && !details.isSameDocument && navigationState.pendingReplacement) {
+        navigationState.lastStartDetails = details;
+      }
+    };
     const navigationListener = () => {
-      this.retireRenderer(rendererLeaseId, renderer, false, 'navigation');
+      navigationState.pendingReplacement = false;
+      navigationState.lastStartDetails = null;
+      navigationState.supersededTargetUrls.length = 0;
+      navigationState.unmatchedProvisionalFailures.clear();
+      navigationState.lastProvisionalFailureEvent = null;
+      navigationState.lastLoadFailureEvent = null;
+      navigationState.sourceFrame = null;
+      if (replacementNavigationStarted) {
+        this.retireRenderer(rendererLeaseId, renderer, false, 'navigation');
+      }
+    };
+    const applyNavigationFailure = (validatedUrl, isMainFrame) => {
+      if (!isMainFrame || !navigationState.pendingReplacement) {
+        return;
+      }
+      const supersededTargetIndex = navigationState.supersededTargetUrls.indexOf(validatedUrl);
+      if (navigationState.lastStartDetails?.url !== validatedUrl || supersededTargetIndex >= 0) {
+        if (supersededTargetIndex >= 0) {
+          navigationState.supersededTargetUrls.splice(supersededTargetIndex, 1);
+        }
+        return;
+      }
+      navigationState.pendingReplacement = false;
+      navigationState.lastStartDetails = null;
+      navigationState.supersededTargetUrls.length = 0;
+      navigationState.unmatchedProvisionalFailures.clear();
+      navigationState.sourceFrame = null;
+    };
+    const navigationProvisionalFailureListener = (failureEvent, errorCode, _errorDescription, validatedUrl, isMainFrame, frameProcessId, frameRoutingId) => {
+      if (navigationState.lastProvisionalFailureEvent === failureEvent) {
+        return;
+      }
+      navigationState.lastProvisionalFailureEvent = failureEvent;
+      const fingerprint = navigationFailureFingerprint(errorCode, validatedUrl, isMainFrame, frameProcessId, frameRoutingId);
+      const unmatchedCount = navigationState.unmatchedProvisionalFailures.get(fingerprint) ?? 0;
+      navigationState.unmatchedProvisionalFailures.set(fingerprint, unmatchedCount + 1);
+      applyNavigationFailure(validatedUrl, isMainFrame);
+    };
+    const navigationFailureListener = (failureEvent, errorCode, _errorDescription, validatedUrl, isMainFrame, frameProcessId, frameRoutingId) => {
+      if (navigationState.lastLoadFailureEvent === failureEvent) {
+        return;
+      }
+      navigationState.lastLoadFailureEvent = failureEvent;
+      const fingerprint = navigationFailureFingerprint(errorCode, validatedUrl, isMainFrame, frameProcessId, frameRoutingId);
+      const unmatchedCount = navigationState.unmatchedProvisionalFailures.get(fingerprint) ?? 0;
+      if (unmatchedCount > 0) {
+        // Electron exposes no navigation ID that can distinguish two same-target failures.
+        // Consume the possible provisional/load pair without disarming the current navigation;
+        // the renderer remains usable and is retired only if a later document actually commits.
+        if (unmatchedCount === 1) {
+          navigationState.unmatchedProvisionalFailures.delete(fingerprint);
+        } else {
+          navigationState.unmatchedProvisionalFailures.set(fingerprint, unmatchedCount - 1);
+        }
+        return;
+      }
+      applyNavigationFailure(validatedUrl, isMainFrame);
     };
     const renderProcessGoneListener = () => {
       this.retireRenderer(rendererLeaseId, renderer, true, 'render-process-gone');
     };
     renderer.destroyedListener = destroyedListener;
+    renderer.navigationStartListener = navigationStartListener;
+    renderer.navigationRedirectListener = navigationRedirectListener;
     renderer.navigationListener = navigationListener;
+    renderer.navigationFailureListener = navigationFailureListener;
+    renderer.navigationProvisionalFailureListener = navigationProvisionalFailureListener;
     renderer.renderProcessGoneListener = renderProcessGoneListener;
     event.sender.once('destroyed', destroyedListener);
+    event.sender.on('did-start-navigation', navigationStartListener);
+    event.sender.on('did-redirect-navigation', navigationRedirectListener);
     event.sender.on('did-navigate', navigationListener);
+    event.sender.on('did-fail-load', navigationFailureListener);
+    event.sender.on('did-fail-provisional-load', navigationProvisionalFailureListener);
     event.sender.on('render-process-gone', renderProcessGoneListener);
     try {
       this.assertActiveLifecycle();
@@ -239,6 +380,24 @@ class ElectronMainBleBinding {
     }
     return response;
   }
+  navigationState(sender) {
+    const existing = this.navigationStates.get(sender);
+    if (existing !== undefined) {
+      return existing;
+    }
+    const created = {
+      epoch: 0,
+      pendingReplacement: false,
+      lastStartDetails: null,
+      supersededTargetUrls: [],
+      unmatchedProvisionalFailures: new Map(),
+      lastProvisionalFailureEvent: null,
+      lastLoadFailureEvent: null,
+      sourceFrame: null
+    };
+    this.navigationStates.set(sender, created);
+    return created;
+  }
   assertMainFrame(event) {
     if (event === null || event === undefined || event.sender === null || event.sender === undefined) {
       throw (0, _errors.contractError)('protocol.malformed', 'ipc', 'electron-main-binding.frame-identity');
@@ -440,12 +599,14 @@ class ElectronMainBleBinding {
       if (cleanup.state === 'release-failed') {
         this.scheduleRendererReleaseRetry(rendererLeaseId, renderer);
       }
+      return cleanup;
     } catch (error) {
       console.error('[ElectronMainBleBinding] Authoritative renderer release rejected:', {
         rendererLeaseId,
         error
       });
       this.scheduleRendererReleaseRetry(rendererLeaseId, renderer);
+      return null;
     }
   }
   scheduleRendererReleaseRetry(rendererLeaseId, renderer) {
@@ -522,6 +683,22 @@ class ElectronMainBleBinding {
       renderer.sender.removeListener('did-navigate', renderer.navigationListener);
       renderer.navigationListener = null;
     }
+    if (renderer.navigationStartListener !== null) {
+      renderer.sender.removeListener('did-start-navigation', renderer.navigationStartListener);
+      renderer.navigationStartListener = null;
+    }
+    if (renderer.navigationRedirectListener !== null) {
+      renderer.sender.removeListener('did-redirect-navigation', renderer.navigationRedirectListener);
+      renderer.navigationRedirectListener = null;
+    }
+    if (renderer.navigationFailureListener !== null) {
+      renderer.sender.removeListener('did-fail-load', renderer.navigationFailureListener);
+      renderer.navigationFailureListener = null;
+    }
+    if (renderer.navigationProvisionalFailureListener !== null) {
+      renderer.sender.removeListener('did-fail-provisional-load', renderer.navigationProvisionalFailureListener);
+      renderer.navigationProvisionalFailureListener = null;
+    }
     if (renderer.renderProcessGoneListener !== null) {
       renderer.sender.removeListener('render-process-gone', renderer.renderProcessGoneListener);
       renderer.renderProcessGoneListener = null;
@@ -529,6 +706,9 @@ class ElectronMainBleBinding {
   }
 }
 exports.ElectronMainBleBinding = ElectronMainBleBinding;
+function navigationFailureFingerprint(errorCode, validatedUrl, isMainFrame, frameProcessId, frameRoutingId) {
+  return JSON.stringify([errorCode, validatedUrl, isMainFrame, frameProcessId, frameRoutingId]);
+}
 function createBoundRenderer(event, trusted, rendererLease) {
   return {
     rendererLease,
@@ -551,7 +731,11 @@ function createBoundRenderer(event, trusted, rendererLease) {
     retryHandle: null,
     releaseResult: null,
     destroyedListener: null,
+    navigationStartListener: null,
+    navigationRedirectListener: null,
     navigationListener: null,
+    navigationFailureListener: null,
+    navigationProvisionalFailureListener: null,
     renderProcessGoneListener: null
   };
 }
@@ -579,4 +763,38 @@ function assertEventLease(renderer, event) {
     throw (0, _errors.contractError)('ownership.denied', 'ipc', 'electron-main-binding.event-lease');
   }
 }
+
+/** Narrows the untrusted IPC wire value before any handler dereferences request fields. */
+function assertElectronBleIpcRequest(request) {
+  const record = recordValue(request);
+  if (record === null) {
+    throw (0, _errors.contractError)('protocol.malformed', 'ipc', 'electron-main-binding.request');
+  }
+  if (record.kind === 'bootstrap') {
+    return;
+  }
+  if (record.kind === 'route' && recordValue(record.envelope) !== null) {
+    return;
+  }
+  if (record.kind === 'release' && recordValue(record.rendererLease) !== null) {
+    return;
+  }
+  if (record.kind === 'event.ack' && recordValue(record.rendererLease) !== null && typeof record.eventId === 'string') {
+    return;
+  }
+  throw (0, _errors.contractError)('protocol.malformed', 'ipc', 'electron-main-binding.request');
+}
+function electronIpcRequestKind(request) {
+  const record = recordValue(request);
+  return typeof record?.kind === 'string' ? record.kind : 'malformed';
+}
+function recordValue(value) {
+  return isRecord(value) ? value : null;
+}
+function isRecord(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function isRollbackReleaseRequiredError(error) {
+  return error instanceof _errors.BackendContractError && error.normalized.code === 'lifecycle.invalid-state' && error.normalized.operation === 'electron-main-router.rollback-release-required';
+}
 //# sourceMappingURL=main-binding.js.map