# Native host client boundaries

Use `default-features = false, features = ["host-client"]` when a native viewer
consumes a session host but owns no listener. This tier exposes
`UiSessionIsolation` and `resolve_session_mount`, and adds URL parsing rather
than an HTTP stack, async runtime, cross-process registry or browser launcher.
The default `session` tier includes it too.

Deserialize the host's `isolation` value into `UiSessionIsolation`. Resolve
each live card's `proxy_url_secret` against the authenticated host URL with
`resolve_session_mount`. Refusal is `None`; do not substitute the original
address or open a different origin as a fallback. The result remains a
credential, so keep it out of ordinary lists, logs and diagnostics.

The shared validator checks:

- `opaque-origin`: the same host, port and scheme, with a `/s/<credential>/` path.
- `own-origin`: one `s-<credential>` label below the host, the same port/scheme,
  and the origin's root path.
- `port-origin`: the same host on a distinct explicit HTTP port and a
  `/<credential>/` path.

Only HTTP and HTTPS host URLs are accepted. All shapes refuse URL userinfo,
queries and fragments on the host and mount. Credential syntax is
checked rather than accepted as an arbitrary path. This is addressing
validation, not authentication or a replacement for attention/reopen handling.

A native viewer using `port-origin` must still create one independent
nonpersistent browser data store for each mounted session. Cookies are scoped
by host rather than port; separate ports alone cannot provide that boundary.
Opening a replacement mount creates a fresh store. Leaving the view stops its
attention and discards its painted content; it does not end the provider.

Native content zoom belongs to the browser engine's page-zoom API. Do not
rewrite provider CSS/JavaScript, scale a screenshot or alter CSP to implement
host controls. Domain actions, byte bodies and change notifications continue
through the same session runtime in every delivery shape.