Bind Serial Transports To Web Sessions

docs/agent/code-map.md

@@ -69,7 +69,7 @@ This is a semantic map, not a complete file inventory. Start here, then read the
 - Flow: `browser -> HTTPS Basic auth -> ticket -> WebSocket -> web transport -> broker`
 - Ownership: HTTPD owns socket send/close work; transport task owns broker mediation; two fixed WebSocket slots and four outstanding tickets.
 - Security constraints: Basic-auth cache hits still revalidate principal currentness; the browser's combined Connect/Disconnect control closes the WebSocket and pauses automatic reconnect until Connect is selected. Changes to the authored inline loader must update its hard-coded CSP hash in the same change.
-- Session-store boundary: admitted HTTPS start initializes four static records; failed start/accepted stop disables and wipes them. No route/ticket/account-revocation binding yet. RNG/SHA/database calls run outside its short portMUX; ID/expiry/epoch checks reject stale work. Run focused host checks with `python3 tests/web_session_store/run.py`.
+- Session-store boundary: admitted HTTPS start initializes four static records; failed start/accepted stop disables and wipes them. 8D.2 binds tickets/slots to non-reused session IDs (zero only for Basic); transport-specific cleanup and account/global revocation invalidate store records before socket cleanup. No cookie route yet. RNG/SHA/database calls run outside short portMUX sections; ID/expiry/epoch checks reject stale work. Run `python3 tests/web_session_store/run.py` and its `--serial` integration mode.
 - Asset constraint: `web_assets_data.c` is checked-in generated input to the build; do not hand-edit or regenerate casually.
 
 ## SSH