Native host client boundaries

Use default-features = false, features = ["host-client"] when a native viewer consumes a session host but owns no listener. This tier exposes UiSessionIsolation and resolve_session_mount, and adds URL parsing rather than an HTTP stack, async runtime, cross-process registry or browser launcher. The default session tier includes it too.

Deserialize the host’s isolation value into UiSessionIsolation. Resolve each live card’s proxy_url_secret against the authenticated host URL with resolve_session_mount. Refusal is None; do not substitute the original address or open a different origin as a fallback. The result remains a credential, so keep it out of ordinary lists, logs and diagnostics.

The shared validator checks:

• opaque-origin: the same host, port and scheme, with a /s/<credential>/ path.
• own-origin: one s-<credential> label below the host, the same port/scheme, and the origin’s root path.
• port-origin: the same host on a distinct explicit HTTP port and a /<credential>/ path.

Only HTTP and HTTPS host URLs are accepted. All shapes refuse URL userinfo, queries and fragments on the host and mount. Credential syntax is checked rather than accepted as an arbitrary path. This is addressing validation, not authentication or a replacement for attention/reopen handling.

A native viewer using port-origin must still create one independent nonpersistent browser data store for each mounted session. Cookies are scoped by host rather than port; separate ports alone cannot provide that boundary. Opening a replacement mount creates a fresh store. Leaving the view stops its attention and discards its painted content; it does not end the provider.

Native content zoom belongs to the browser engine’s page-zoom API. Do not rewrite provider CSS/JavaScript, scale a screenshot or alter CSP to implement host controls. Domain actions, byte bodies and change notifications continue through the same session runtime in every delivery shape.