Add browser Serial/Admin terminal switching

Keep the serial connection and lease intact while providing a separate,
bounded admin terminal with explicit open and close controls. Fence
retained
terminal state across sessions and add fit-readiness retries with
regression
coverage.

tests/web_ui_session/README.md

@@ -1,4 +1,4 @@
-# Existing serial app cookie-session cutover tests
+# Browser Session and Terminal Selector Tests
 
 Run from the repository root:
 
@@ -32,21 +32,32 @@ Coverage:
 - Authentication/ticket response cap 512 bytes, existing status cap 3,072 bytes,
   15-second request deadline, single status request in flight, bounded retry delay,
   and unchanged 5,000-line terminal scrollback.
+- Admin-only navigation, explicit protected-ticket open, 20 switches preserving
+  serial socket/client/writer IDs, separate output and selected-only input.
+- Independent 64 KiB pending output limits, visible dropped-byte counters and
+  resumed hidden output draining; 512-byte admin input frames and overflow close.
+- Admin close/reopen/remote exit isolation, 401/logout/expiry/pagehide cancellation,
+  late tickets/callbacks, handshake timeout, selected resize and three listener
+  cleanup/restore cycles.
+- Session identity changes (username, role or session-stable CSRF) force a clean
+  document before view adoption, close old admin and prevent replacement-session
+  logout; same-session restore retains both scrollbacks behind validation gating.
+- Undefined initial dimensions recover at unchanged bounds; failed fits never
+  populate the cache, readiness retries stop at three, and teardown fences stale
+  callbacks even after restore. Sixteen Node groups total.
 
 ## Integration and known gaps
 
-This is only the existing application browser portion of Phase 8D.3. It requires
-the simultaneous server cookie/Origin/CSRF cutover for every route. The renderer
+This covers the Phase 8D.3 browser session behavior and 8D.6 selector. The renderer
 still relies on its caller to authenticate resources; protected asset failures
 must be 401, never a redirect to HTML served as JavaScript. No Basic fallback is
-implemented here. No server, auth-store, transport, admin UI, or generated asset
-changes are included.
+implemented here. Existing 8D.5 server authorization/protocols are unchanged.
 
 These tests model DOM, timers, fetch cancellation and WebSocket events. They do
 not prove real-browser CSP enforcement, script-loading errors, TLS/HTTPD behavior,
 actual bfcache policy, cookie expiry, server revocation, or hardware serial byte
-integrity. Full firmware build and mandatory M1 browser/target checks remain the
-integrator's responsibility. The full build was deliberately not run in this
-restricted-write subtask. No target resource reserve is claimed. Browser secret
+integrity, actual xterm escape parsing, hidden prompts, or desktop/mobile layout.
+The 8D.6 firmware build and pending target checklist are recorded separately in
+`docs/phase8d6_implementation.md`. No target resource reserve is claimed. Browser secret
 references are dropped and never persisted/logged, but JavaScript cannot securely
 wipe engine-managed strings.