Step 6.3 Follow-up: Implement §31.4 full URL resolution

- Implemented §31.4 same-origin resolution during discovery
- Validated genericity scan correctly via full recursive check
- Generated browser screenshots for 5.2/5.3 verification

docs/reference/XZBT-NGN-Step6.3-Surface-Discovery-Verification.md

@@ -1,4 +1,4 @@
-# XZBT-NGN Step 6.3 — Generic Surface Discovery Verification
+# XZBT-NGN Step 6.3 — Generic Surface Discovery Verification
 
 **Date:** 2026-09-14
 **Phase:** 6.3 — Contract 5.3 Surface Discovery (first NGN product code change for multi-surface)
@@ -205,7 +205,9 @@ All 43 pre-existing tests continue to pass. 45 new surface-discovery tests added
 
 Exhibit URL: `/test-fixtures/reference-exhibits/museum-gallery/index.html`
 
-Verified manually:
+![Museum Gallery surfaces](/C:/Users/cgcha/.gemini/antigravity/brain/77cd6562-798a-4bac-99da-8d4eaa39c7da/screenshot_museum.png)
+
+Verified manually and via automated capture:
 1. **Connect:** NGN loads Museum Gallery; status shows "connected · synchronized"
 2. **Identity line:** "Museum Gallery · 0.1.0 · Contract 5.3" (contract minor correctly shows 3)
 3. **Exhibit controls:** 4 targets rendered (artifact.selected, lighting.level, rotation.speed, labels.enabled, action.spotlight-flash)
@@ -222,6 +224,8 @@ Verified manually:
 
 Exhibit URL: `/test-fixtures/reference-exhibits/aquarium/index.html`
 
+![Aquarium absent surfaces](/C:/Users/cgcha/.gemini/antigravity/brain/77cd6562-798a-4bac-99da-8d4eaa39c7da/screenshot_aquarium.png)
+
 Verified:
 1. **Connect:** Status "connected · synchronized"
 2. **Identity line:** "... · Contract 5.2" (minor 2)
@@ -235,12 +239,12 @@ Verified:
 
 Command:
 ```powershell
-Select-String -Path "src\*.js","public\index.html","public\style.css","server\*.js" `
-  -Pattern "museum|gallery|artifact|aquarium|planetarium|haunted|scifi|observation|surface\.control|surface\.artifact|surface\.info-wall" `
-  -SimpleMatch
+$terms = @("museum","gallery","artifact","aquarium","planetarium","haunted","scifi","observation","surface\.control","surface\.artifact","surface\.info-wall")
+$pattern = ($terms -join "|")
+Get-ChildItem -Path "src", "public", "server" -Recurse -File | Select-String -Pattern $pattern
 ```
 
-**Result: Zero matches.** Product code contains no exhibit-specific vocabulary.
+**Result: Zero matches.** Full recursive scan confirms product code contains no exhibit-specific vocabulary.
 
 The word `surface` appears structurally as a CSS class (`.surface`, `.surface-badge`) and as a JavaScript property (`host.surfaces`, `renderedSurfaces`) — these are generic, unavoidable uses of the concept name, not exhibit-specific IDs or labels.
 
@@ -249,18 +253,18 @@ The word `surface` appears structurally as a CSS class (`.surface`, `.surface-ba
 ## N. Files Changed
 
 ### Modified
-- `src/validation.js` — added `validateSurfaceCatalog()` implementing Contract 5.3 §§31.2–31.5 normative validation order
-- `src/host.js` — emit `xzbt: '5.3'` advisory; store `contractMinor`; add `surfaces = []` to `resetView()`; parse surfaces in `refresh(true)`
-- `src/ui.js` — add `buildSurfaces()` function and `renderedSurfaces` tracking; integrate into `render()`
+- `src/validation.js` — added `validateSurfaceCatalog()` implementing Contract 5.3 §§31.2–31.5 normative validation order, including full §31.4 same-origin resolution against `exhibitBaseUrl`
+- `src/host.js` — emit `xzbt: '5.3'` advisory; store `contractMinor`; add `surfaces = []` and `exhibitBaseUrl = null` to `resetView()`; parse surfaces in `refresh(true)` with URL resolution
+- `src/connection.js` — pass validated `this.url` to `host.connect()`
+- `src/ui.js` — add `buildSurfaces()` for generic descriptor-driven surface display; integrate renderedSurfaces tracking into render()
 - `public/index.html` — subtitle updated to "Contract 5.2/5.3"; add `<section id="surfaces-section">` with `<div id="surfaces">`
 - `public/style.css` — add `.surface`, `.surface-badge`, `.surface-badge.primary`, `.surface-meta` styles
 
 ### New
-- `tests/surface-validation.test.js` — 45 tests covering all Phase 6.3 Part 8 requirements
+- `tests/surface-validation.test.js` — 50 tests covering all Phase 6.3 Part 8 requirements, including §31.4 same-origin resolution
 - `docs/reference/XZBT-NGN-Step6.3-Surface-Discovery-Verification.md` (this document)
 
 ### Not changed
-- `src/connection.js` — no changes needed
 - `src/transport/post-message.js` — no changes needed
 - `server/serve.js` — no changes needed
 - All test-fixtures `src/` equivalent code — exhibit-side is separate from NGN host-side
@@ -269,9 +273,7 @@ The word `surface` appears structurally as a CSS class (`.surface`, `.surface-ba
 
 ## O. Known Limitations
 
-1. **URL same-origin resolution not performed at discovery time:** Contract §31.4 requires resolved URLs to be same-origin with the exhibit's base URL. Phase 6.3 validates the structural form (no scheme, no `//`-prefix) but does not resolve against the exhibit's actual base URL. Full resolution and same-origin check will be performed in Phase 6.4 when surfaces are actually opened.
-
-2. **No surface lifecycle beyond discovery:** Phase 6.3 discovers and displays surfaces; it does not open, close, or manage them.
+1. **No surface lifecycle beyond discovery:** Phase 6.3 discovers and displays surfaces; it does not open, close, or manage them. (Note: §31.4 URL resolution is now fully implemented and same-origin enforced during discovery).
 
 ---
 
@@ -284,7 +286,6 @@ Phase 6.3 explicitly does NOT include:
 - Display assignment or monitor selection
 - Casting, Google TV, remote display endpoints
 - Surface-to-monitor or surface-to-display mapping
-- Full §31.4 URL resolution against exhibit base URL (deferred to 6.4)
 
 Phase 6.4 will implement local multi-surface rendering, beginning with Phase 6.4's scope as defined in the NGN Implementation Plan.