From b5b11192c409c998ff09d58da8377f4a9d4b855c Mon Sep 17 00:00:00 2001
From: Filippo Vecchiato <filippo@parity.io>
Date: Tue, 18 Aug 2026 15:10:57 +0100
Subject: [PATCH 1/3] feat(container): gate WebRTC on a decision resolved
 before the product realm

An async permission request inside the product's own realm is forgeable, so the host bakes the decision in as a literal and a fresh grant only applies on the next load.
---
 android/truapi-host/README.md                 |   9 +-
 .../kotlin/io/parity/truapi/TrUAPIHost.kt     |  16 +-
 ios/truapi-host/README.md                     |  27 ++-
 .../TrUAPIHost/Resources/truapi-container.js  |  21 +-
 .../Sources/TrUAPIHost/TrUAPIHost.swift       |  16 +-
 js/container/package-lock.json                |  38 ++++
 js/container/package.json                     |   4 +-
 js/container/src/freeze.ts                    |  38 ++++
 js/container/src/index.ts                     |  45 ++---
 js/container/src/webrtc.test.ts               | 189 ++++++++++++++++++
 js/container/src/webrtc.ts                    |  60 ++++++
 playground/src/lib/auto-test.ts               |   2 +-
 playground/src/lib/webrtc-check.ts            |  39 +++-
 13 files changed, 456 insertions(+), 48 deletions(-)
 create mode 100644 js/container/src/freeze.ts
 create mode 100644 js/container/src/webrtc.test.ts
 create mode 100644 js/container/src/webrtc.ts

diff --git a/android/truapi-host/README.md b/android/truapi-host/README.md
index 71086bdd5..c8f8fa9cb 100644
--- a/android/truapi-host/README.md
+++ b/android/truapi-host/README.md
@@ -261,7 +261,14 @@ core.notifyChainClosed(chainConnectionId)
 // following `loadUrl` replaces, so the product would lose the endpoint. Scope
 // it to the product origin. The page reads `window.__truapi_localhost.url` and
 // passes it to `@parity/truapi`'s `createWebSocketProvider`.
-val bootstrap = LocalhostBridgeBootstrap.script(endpoint.port, endpoint.token)
+// A peek, never a prompt — see LocalhostBridgeBootstrap.script. Baked in as a
+// literal because the container enforces it inside the product's own realm,
+// where an async permission request would be forgeable. A fresh grant therefore
+// only takes effect once the web view reloads.
+val webRtcAllowed = core.permissionAuthorizationStatus(
+    PermissionAuthorizationRequest.Remote(RemotePermissionRequest(RemotePermission.WebRtc))
+) == PermissionAuthorizationStatus.AUTHORIZED
+val bootstrap = LocalhostBridgeBootstrap.script(endpoint.port, endpoint.token, webRtcAllowed)
 main.post {
     val productUrl = "https://your-product.example/"
     if (WebViewFeature.isFeatureSupported(WebViewFeature.DOCUMENT_START_SCRIPT)) {
diff --git a/android/truapi-host/src/main/kotlin/io/parity/truapi/TrUAPIHost.kt b/android/truapi-host/src/main/kotlin/io/parity/truapi/TrUAPIHost.kt
index e1aa4726c..1425776b5 100644
--- a/android/truapi-host/src/main/kotlin/io/parity/truapi/TrUAPIHost.kt
+++ b/android/truapi-host/src/main/kotlin/io/parity/truapi/TrUAPIHost.kt
@@ -408,15 +408,26 @@ private class HostCallbackAdapter(private val bridge: HostBridge) : HostCallback
 object LocalhostBridgeBootstrap {
     /**
      * Returns a `<script>`-injectable snippet that publishes the endpoint
-     * metadata on `window.__truapi_localhost`, exposes the legacy
+     * metadata on `window.__truapi_localhost`, the pre-resolved permission
+     * decisions on `window.__truapi_policy__`, exposes the legacy
      * `window.__HOST_API_PORT__` webview transport shape, and fires a
      * `truapi-native-ready` event. Inject at document start (before the product
      * page scripts run) so the page can dial the bridge immediately.
+     *
+     * [webRtcAllowed] must come from `permissionAuthorizationStatus` for
+     * `RemotePermission.Remote.WebRtc` — a peek, never a prompt. It is baked in
+     * as a literal because the container enforces it inside the product's own
+     * realm, where an asynchronous permission request would be forgeable:
+     * product script can hook the primitives such a request's bookkeeping
+     * relies on and resolve it itself. A settled value has nothing to steal.
+     * The consequence is that a fresh grant only takes effect once the web view
+     * reloads.
      */
-    fun script(port: UShort, token: String): String {
+    fun script(port: UShort, token: String, webRtcAllowed: Boolean): String {
         val url = "ws://127.0.0.1:$port/?t=$token"
         val safeUrl = jsStringLiteral(url)
         val safeToken = jsStringLiteral(token)
+        val safeWebRtc = if (webRtcAllowed) "true" else "false"
         return """
         (function() {
           var endpoint = { url: $safeUrl, token: $safeToken };
@@ -484,6 +495,7 @@ object LocalhostBridgeBootstrap {
           }
 
           window.__truapi_localhost = endpoint;
+          window.__truapi_policy__ = { webRtcAllowed: $safeWebRtc };
           window.__HOST_WEBVIEW_MARK__ = true;
           window.__HOST_API_PORT__ = createWebSocketMessagePort(endpoint.url);
           window.dispatchEvent(new Event('truapi-native-ready'));
diff --git a/ios/truapi-host/README.md b/ios/truapi-host/README.md
index 23d05e72a..e9de3376e 100644
--- a/ios/truapi-host/README.md
+++ b/ios/truapi-host/README.md
@@ -254,10 +254,29 @@ core.notifyChainClosed(connectionId: chainConnectionId)
 
 // Both scripts must be registered before the web view loads the product page,
 // and in this order: the bootstrap publishes the bridge endpoint on
-// `window.__truapi_localhost`; the container script then locks down the
-// page's platform APIs and reads that endpoint at eval time.
+// `window.__truapi_localhost` and the resolved permission decisions on
+// `window.__truapi_policy__`; the container script then locks down the page's
+// platform APIs and reads both at eval time.
+//
+// The frame scopes differ, and the difference is load-bearing:
+//
+//   * the CONTAINER goes into every frame (`forMainFrameOnly: false`). A realm
+//     without it has pristine fetch/WebSocket/RTCPeerConnection, and a product
+//     can reach one through any iframe path that skips `document.createElement`
+//     (innerHTML, document.write, createElementNS, srcdoc). Injecting only the
+//     main frame leaves the whole lockdown one line away from bypass.
+//   * the BOOTSTRAP stays main-frame-only. A subframe then has no bridge
+//     endpoint and no policy, so every gate in the container fails closed there.
 let contentController = WKUserContentController()
-let bootstrapScript = LocalhostBridgeBootstrap.script(port: endpoint.port, token: endpoint.token)
+// A peek, never a prompt — see LocalhostBridgeBootstrap.script.
+let webRtcAllowed = try core.permissionAuthorizationStatus(
+    request: .remote(RemotePermissionRequest(permission: .webRtc))
+) == .authorized
+let bootstrapScript = LocalhostBridgeBootstrap.script(
+    port: endpoint.port,
+    token: endpoint.token,
+    webRtcAllowed: webRtcAllowed
+)
 contentController.addUserScript(WKUserScript(
     source: bootstrapScript,
     injectionTime: .atDocumentStart,
@@ -266,7 +285,7 @@ contentController.addUserScript(WKUserScript(
 contentController.addUserScript(WKUserScript(
     source: try ContainerScriptBundle.load(),
     injectionTime: .atDocumentStart,
-    forMainFrameOnly: true
+    forMainFrameOnly: false
 ))
 
 let configuration = WKWebViewConfiguration()
diff --git a/ios/truapi-host/Sources/TrUAPIHost/Resources/truapi-container.js b/ios/truapi-host/Sources/TrUAPIHost/Resources/truapi-container.js
index c9a54165e..5d6b55e95 100644
--- a/ios/truapi-host/Sources/TrUAPIHost/Resources/truapi-container.js
+++ b/ios/truapi-host/Sources/TrUAPIHost/Resources/truapi-container.js
@@ -1,6 +1,6 @@
 "use strict";
 (() => {
-  // src/index.ts
+  // src/freeze.ts
   function freezeAndDelete(obj, prop) {
     try {
       Object.defineProperty(obj, prop, {
@@ -27,6 +27,24 @@
     } catch {
     }
   }
+
+  // src/webrtc.ts
+  var POLICY_GLOBAL = "__truapi_policy__";
+  function installWebRtcPolicy(win, allowed) {
+    if (allowed === true) {
+      return;
+    }
+    freezeAndDelete(win, "RTCPeerConnection");
+    freezeAndDelete(win, "webkitRTCPeerConnection");
+    freezeAndDelete(win, "mozRTCPeerConnection");
+  }
+  function consumeWebRtcPolicy(win) {
+    const allowed = win?.[POLICY_GLOBAL]?.webRtcAllowed;
+    freezeAndDelete(win, POLICY_GLOBAL);
+    return allowed;
+  }
+
+  // src/index.ts
   var _nativeFetch = window.fetch.bind(window);
   var _NativeWebSocket = window.WebSocket;
   var _bridgeUrl = window.__truapi_localhost?.url;
@@ -94,4 +112,5 @@
     }
     return _createElement(tagName, options);
   });
+  installWebRtcPolicy(window, consumeWebRtcPolicy(window));
 })();
diff --git a/ios/truapi-host/Sources/TrUAPIHost/TrUAPIHost.swift b/ios/truapi-host/Sources/TrUAPIHost/TrUAPIHost.swift
index 6075a8e98..92ee39eda 100644
--- a/ios/truapi-host/Sources/TrUAPIHost/TrUAPIHost.swift
+++ b/ios/truapi-host/Sources/TrUAPIHost/TrUAPIHost.swift
@@ -178,13 +178,24 @@ public struct ProductExecutionConfig: Sendable, Equatable {
 /// cdylib is built with the `ws-bridge` feature.
 public enum LocalhostBridgeBootstrap {
     /// Returns a `<script>`-injectable snippet that publishes the endpoint
-    /// metadata on `window.__truapi_localhost`, exposes the legacy
+    /// metadata on `window.__truapi_localhost`, the pre-resolved permission
+    /// decisions on `window.__truapi_policy__`, exposes the legacy
     /// `window.__HOST_API_PORT__` webview transport shape, and fires a
     /// `truapi-native-ready` event.
-    public static func script(port: UInt16, token: String) -> String {
+    ///
+    /// `webRtcAllowed` must come from `permissionAuthorizationStatus` for
+    /// `RemotePermission.remote(.webRtc)` — a peek, never a prompt. It is baked
+    /// in as a literal because the container enforces it inside the product's
+    /// own realm, where an asynchronous permission request would be forgeable:
+    /// product script can hook the primitives such a request's bookkeeping
+    /// relies on and resolve it itself. A settled value has nothing to steal.
+    /// The consequence is that a fresh grant only takes effect once the web
+    /// view reloads.
+    public static func script(port: UInt16, token: String, webRtcAllowed: Bool) -> String {
         let url = "ws://127.0.0.1:\(port)/?t=\(token)"
         let safeUrl = jsStringLiteral(url)
         let safeToken = jsStringLiteral(token)
+        let safeWebRtc = webRtcAllowed ? "true" : "false"
         return """
         (function() {
           var endpoint = { url: \(safeUrl), token: \(safeToken) };
@@ -256,6 +267,7 @@ public enum LocalhostBridgeBootstrap {
           }
 
           window.__truapi_localhost = endpoint;
+          window.__truapi_policy__ = { webRtcAllowed: \(safeWebRtc) };
           window.__HOST_WEBVIEW_MARK__ = true;
           window.__HOST_API_PORT__ = createWebSocketMessagePort(endpoint.url);
           window.dispatchEvent(new Event('truapi-native-ready'));
diff --git a/js/container/package-lock.json b/js/container/package-lock.json
index 424211241..d29401c9e 100644
--- a/js/container/package-lock.json
+++ b/js/container/package-lock.json
@@ -8,6 +8,7 @@
       "name": "truapi-container",
       "version": "1.0.0",
       "devDependencies": {
+        "@types/bun": "^1.3.14",
         "esbuild": "^0.28.1",
         "typescript": "^5.3.0"
       }
@@ -454,6 +455,36 @@
         "node": ">=18"
       }
     },
+    "node_modules/@types/bun": {
+      "version": "1.3.14",
+      "resolved": "https://registry.npmjs.org/@types/bun/-/bun-1.3.14.tgz",
+      "integrity": "sha512-h1hFqFVcvAvD9j9K7ZW7vd82aSA+rTdznZa+5bwvCwqSB1jmmfLcbIWhOLx1/+boy/xmjgCs/OMUL8hRJSmnPw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "bun-types": "1.3.14"
+      }
+    },
+    "node_modules/@types/node": {
+      "version": "26.2.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.2.0.tgz",
+      "integrity": "sha512-5IviulTZeRNp2vAJ514cc/HUlY5nZ9fCbq9DMyC52BrhFZACo3nI0R7qBxhQmo/d27NFe96ur/b7Wwxklda+kg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~8.3.0"
+      }
+    },
+    "node_modules/bun-types": {
+      "version": "1.3.14",
+      "resolved": "https://registry.npmjs.org/bun-types/-/bun-types-1.3.14.tgz",
+      "integrity": "sha512-4N0ig0fEomHt5R0KCFWjovxow98rIoRwKolrYdCcknNwMekCXRnWEUvgu5soYV8QXtVsrUD8B95MBOZGPvr6KQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
     "node_modules/esbuild": {
       "version": "0.28.1",
       "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.1.tgz",
@@ -509,6 +540,13 @@
       "engines": {
         "node": ">=14.17"
       }
+    },
+    "node_modules/undici-types": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz",
+      "integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==",
+      "dev": true,
+      "license": "MIT"
     }
   }
 }
diff --git a/js/container/package.json b/js/container/package.json
index d4aebc769..f29e5c24d 100644
--- a/js/container/package.json
+++ b/js/container/package.json
@@ -4,9 +4,11 @@
   "private": true,
   "scripts": {
     "build": "esbuild src/index.ts --bundle --outfile=../../ios/truapi-host/Sources/TrUAPIHost/Resources/truapi-container.js --format=iife --target=es2020 --define:process.env.NODE_ENV=\\\"production\\\"",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "test": "bun test"
   },
   "devDependencies": {
+    "@types/bun": "^1.3.14",
     "esbuild": "^0.28.1",
     "typescript": "^5.3.0"
   }
diff --git a/js/container/src/freeze.ts b/js/container/src/freeze.ts
new file mode 100644
index 000000000..14f3f365d
--- /dev/null
+++ b/js/container/src/freeze.ts
@@ -0,0 +1,38 @@
+// Property-locking helpers shared by the lockdown container and its policies.
+//
+// The container runs in the product's own realm, so a locked property must not
+// be reachable, replaceable, or wrappable by product script. Every definition
+// here is `configurable: false` with a setter that silently ignores writes,
+// which is what makes the lock survive a product's own `defineProperty` or
+// assignment attempt.
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+/** Make `prop` read as `undefined` and stay that way. */
+export function freezeAndDelete(obj: any, prop: string): void {
+  try {
+    Object.defineProperty(obj, prop, {
+      get: () => undefined,
+      set() { /* silently ignore */ },
+      configurable: false,
+    });
+  } catch {
+    // Property may already be non-configurable; try delete as fallback
+    try { delete obj[prop]; } catch { /* best effort */ }
+  }
+}
+
+/** Pin `prop` to `value` and stay that way. */
+export function freezeValue(obj: any, prop: string, value: any): void {
+  try {
+    // Use a getter instead of a data property with writable:false.
+    // A non-writable data property on the prototype chain prevents
+    // descendant objects from shadowing it, which breaks polyfills
+    // that create objects with window/self as prototype.
+    Object.defineProperty(obj, prop, {
+      get: () => value,
+      set() { /* silently ignore */ },
+      configurable: false,
+    });
+  } catch { /* best effort */ }
+}
diff --git a/js/container/src/index.ts b/js/container/src/index.ts
index 6147cf7ad..3ff3ee49e 100644
--- a/js/container/src/index.ts
+++ b/js/container/src/index.ts
@@ -1,41 +1,26 @@
 // ============================================================================
 // TrUAPI mode lockdown. Runs AFTER LocalhostBridgeBootstrap (native injects
 // the bootstrap first), which publishes the bridge endpoint on
-// window.__truapi_localhost and exposes __HOST_API_PORT__ / __HOST_WEBVIEW_MARK__.
+// window.__truapi_localhost, the pre-resolved permission decisions on
+// window.__truapi_policy__, and exposes __HOST_API_PORT__ /
+// __HOST_WEBVIEW_MARK__.
 // The bootstrap dials its WebSocket lazily (inside port.start()), so
 // window.WebSocket must remain constructible for exactly the bridge URL.
+//
+// Hosts must inject this script into EVERY frame, not just the main frame. A
+// realm without it has pristine fetch/WebSocket/RTCPeerConnection, and a
+// product can reach one through any iframe path that skips
+// `document.createElement` (innerHTML, document.write, createElementNS,
+// srcdoc). Only the bootstrap is main-frame-only: a subframe with no bridge
+// endpoint and no policy fails closed on every gate below.
 // ============================================================================
 
 // =============================================================================
 // Isolation: Lock down globals so product scripts cannot access platform APIs.
 // =============================================================================
 
-function freezeAndDelete(obj: any, prop: string) {
-  try {
-    Object.defineProperty(obj, prop, {
-      get: () => undefined,
-      set() { /* silently ignore */ },
-      configurable: false,
-    });
-  } catch {
-    // Property may already be non-configurable; try delete as fallback
-    try { delete obj[prop]; } catch { /* best effort */ }
-  }
-}
-
-function freezeValue(obj: any, prop: string, value: any) {
-  try {
-    // Use a getter instead of a data property with writable:false.
-    // A non-writable data property on the prototype chain prevents
-    // descendant objects from shadowing it, which breaks polyfills
-    // that create objects with window/self as prototype.
-    Object.defineProperty(obj, prop, {
-      get: () => value,
-      set() { /* silently ignore */ },
-      configurable: false,
-    });
-  } catch { /* best effort */ }
-}
+import { freezeAndDelete, freezeValue } from './freeze.js';
+import { consumeWebRtcPolicy, installWebRtcPolicy } from './webrtc.js';
 
 // Capture native fetch BEFORE lockdown so the same-origin gate can use it.
 const _nativeFetch = window.fetch.bind(window);
@@ -121,4 +106,10 @@ freezeValue(document, 'createElement', (tagName: string, options?: ElementCreati
   return _createElement(tagName, options);
 });
 
+// --- WebRTC: gated on the decision the host resolved before this realm ---
+// Read and clear the policy global first so nothing downstream can observe or
+// rewrite it. An absent policy denies, which is what makes a subframe (no
+// bootstrap, so no policy) fail closed.
+installWebRtcPolicy(window, consumeWebRtcPolicy(window));
+
 export {};
diff --git a/js/container/src/webrtc.test.ts b/js/container/src/webrtc.test.ts
new file mode 100644
index 000000000..e7243e357
--- /dev/null
+++ b/js/container/src/webrtc.test.ts
@@ -0,0 +1,189 @@
+import { describe, expect, it } from 'bun:test';
+
+import { POLICY_GLOBAL, consumeWebRtcPolicy, installWebRtcPolicy } from './webrtc.js';
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+/** Stand-in for the native constructor, so a test can tell it apart. */
+class NativePeerConnection {
+  createOffer() { return Promise.resolve({ sdp: 'native', type: 'offer' }); }
+  createAnswer() { return Promise.resolve({ sdp: 'native', type: 'answer' }); }
+  setLocalDescription() { return Promise.resolve(); }
+  setRemoteDescription() { return Promise.resolve(); }
+  addIceCandidate() { return Promise.resolve(); }
+  createDataChannel() { return { send() {} }; }
+}
+
+function realm(policy?: unknown): any {
+  const win: any = {
+    RTCPeerConnection: NativePeerConnection,
+    webkitRTCPeerConnection: NativePeerConnection,
+  };
+  if (policy !== undefined) {
+    win[POLICY_GLOBAL] = policy;
+  }
+  return win;
+}
+
+function denied(): any {
+  const win = realm({ webRtcAllowed: false });
+  installWebRtcPolicy(win, consumeWebRtcPolicy(win));
+  return win;
+}
+
+describe('the decision', () => {
+  it('leaves the constructor in place when granted', () => {
+    const win = realm({ webRtcAllowed: true });
+    installWebRtcPolicy(win, consumeWebRtcPolicy(win));
+    expect(win.RTCPeerConnection).toBe(NativePeerConnection);
+  });
+
+  it('removes the constructor when denied', () => {
+    expect(denied().RTCPeerConnection).toBeUndefined();
+  });
+
+  it('removes vendor-prefixed aliases too', () => {
+    // A separate constructor, not a view of the standard one: leaving it
+    // behind would reopen the path outright.
+    expect(denied().webkitRTCPeerConnection).toBeUndefined();
+  });
+
+  it('consumes the policy global so the realm does not carry it', () => {
+    const win = realm({ webRtcAllowed: true });
+    consumeWebRtcPolicy(win);
+    expect(win[POLICY_GLOBAL]).toBeUndefined();
+  });
+});
+
+describe('fails closed', () => {
+  // A subframe gets the container but no bootstrap, so it has no policy at all.
+  it('with no policy global', () => {
+    const win = realm();
+    installWebRtcPolicy(win, consumeWebRtcPolicy(win));
+    expect(win.RTCPeerConnection).toBeUndefined();
+  });
+
+  // Only an explicit `true` may grant, so a truthy-but-not-true value — the
+  // shape a sloppy host or a tampered global would produce — must still deny.
+  const nonGrants: Array<[string, unknown]> = [
+    ['a truthy string', 'yes'],
+    ['a truthy number', 1],
+    ['null', null],
+    ['undefined', undefined],
+    ['an empty policy object', {}],
+  ];
+  for (const [label, value] of nonGrants) {
+    it(`on ${label}`, () => {
+      const win = realm({ webRtcAllowed: value });
+      installWebRtcPolicy(win, consumeWebRtcPolicy(win));
+      expect(win.RTCPeerConnection).toBeUndefined();
+    });
+  }
+});
+
+// The four escapes that killed the gate in truapi#379. Each recovered a working
+// peer connection from a *subclass*-based gate, because a subclass leaves the
+// native class reachable. Each route below must yield no connection that can
+// produce an offer — that is the property, not "some property access throws".
+//
+// `attempt` runs a route and reports what a product would actually get: an
+// offer means the route won.
+async function attempt(route: () => any): Promise<string | null> {
+  try {
+    const offer = await route().createOffer();
+    return offer?.sdp ?? null;
+  } catch {
+    return null;
+  }
+}
+
+describe('resists the #379 escapes when denied', () => {
+  it('yields no connection by deleting a shadowing prototype method', async () => {
+    const win = denied();
+    expect(
+      await attempt(() => {
+        delete win.RTCPeerConnection.prototype.createOffer;
+        return new win.RTCPeerConnection();
+      }),
+    ).toBeNull();
+  });
+
+  it('yields no connection by reaching the parent prototype', async () => {
+    const win = denied();
+    expect(
+      await attempt(() => {
+        const pc = new win.RTCPeerConnection();
+        const parent = Object.getPrototypeOf(Object.getPrototypeOf(pc));
+        return { createOffer: () => parent.createOffer.call(pc) };
+      }),
+    ).toBeNull();
+  });
+
+  it('yields no connection by recovering the class [[Prototype]]', async () => {
+    const win = denied();
+    expect(
+      await attempt(() => new (Object.getPrototypeOf(win.RTCPeerConnection))()),
+    ).toBeNull();
+  });
+
+  it('has no pending request whose resolver could be stolen', () => {
+    // The decisive #379 break: hook the primitive the pending-request
+    // bookkeeping used, steal the `{resolve, reject}` pair, and forge a grant.
+    // A settled boolean has no such bookkeeping, so there is nothing to hand a
+    // product.
+    const win = realm({ webRtcAllowed: false });
+    const realSet = Map.prototype.set;
+    let stolen: unknown;
+    Map.prototype.set = function (this: Map<unknown, unknown>, key: unknown, value: unknown) {
+      stolen = value;
+      return realSet.call(this, key, value);
+    };
+    try {
+      installWebRtcPolicy(win, consumeWebRtcPolicy(win));
+    } finally {
+      Map.prototype.set = realSet;
+    }
+    expect(stolen).toBeUndefined();
+    expect(win.RTCPeerConnection).toBeUndefined();
+  });
+
+  it('cannot be restored by redefining the property', () => {
+    const win = denied();
+    expect(() =>
+      Object.defineProperty(win, 'RTCPeerConnection', { value: NativePeerConnection }),
+    ).toThrow();
+    expect(win.RTCPeerConnection).toBeUndefined();
+  });
+
+  it('ignores a plain assignment', () => {
+    const win = denied();
+    win.RTCPeerConnection = NativePeerConnection;
+    expect(win.RTCPeerConnection).toBeUndefined();
+  });
+});
+
+// Guard the guard: the same routes must succeed against the subclass design, or
+// the tests above would pass for a gate that does nothing.
+describe('the escape routes are real against a subclass gate', () => {
+  function subclassGated(): any {
+    const Gated = class extends NativePeerConnection {
+      override createOffer(): any {
+        return Promise.reject(new TypeError('WebRTC access is not allowed'));
+      }
+    };
+    return { RTCPeerConnection: Gated };
+  }
+
+  it('the parent prototype still answers', async () => {
+    const win = subclassGated();
+    const pc = new win.RTCPeerConnection();
+    const parent = Object.getPrototypeOf(Object.getPrototypeOf(pc));
+    expect(await parent.createOffer.call(pc)).toMatchObject({ sdp: 'native' });
+  });
+
+  it('the class [[Prototype]] is the native constructor', async () => {
+    const win = subclassGated();
+    const Native = Object.getPrototypeOf(win.RTCPeerConnection);
+    expect(await new Native().createOffer()).toMatchObject({ sdp: 'native' });
+  });
+});
diff --git a/js/container/src/webrtc.ts b/js/container/src/webrtc.ts
new file mode 100644
index 000000000..3350b9b08
--- /dev/null
+++ b/js/container/src/webrtc.ts
@@ -0,0 +1,60 @@
+// WebRTC egress policy (RFC 0002 `RemotePermission::WebRtc`).
+//
+// A peer connection reaches an arbitrary host without touching any layer the
+// host can observe: ICE is UDP to whatever STUN/TURN server the product names,
+// so no content rule list, no `shouldInterceptRequest`, and no CSP directive
+// sees it. That makes this the one egress path with no out-of-realm enforcement
+// point on any host, and the reason the decision has to be enforced in-realm.
+//
+// The decision is resolved by the host *before* this realm exists and arrives
+// as a plain boolean. That is deliberate and load-bearing: an asynchronous
+// permission request from inside the product's realm is forgeable, because the
+// product can hook whatever primitive the pending-request bookkeeping touches
+// and resolve it itself:
+//
+//     const realSet = Map.prototype.set;
+//     let steal;
+//     Map.prototype.set = function (id, e) { steal = e; return realSet.call(this, id, e); };
+//     new RTCPeerConnection().createOffer().catch(() => {});
+//     queueMicrotask(() => steal.resolve({ allowed: true }));
+//
+// With a boolean settled up front there is no pending state to steal, and a
+// denial needs no gate at all: removing the constructor leaves no reachable
+// prototype and no recoverable native class, so there is nothing to escape
+// from. The cost is that a fresh grant only takes effect on the next load.
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+import { freezeAndDelete } from './freeze.js';
+
+/**
+ * Global the host's bootstrap publishes with the pre-resolved decision. Read
+ * once and removed, so the product realm never carries a knob that looks
+ * negotiable.
+ */
+export const POLICY_GLOBAL = '__truapi_policy__';
+
+/**
+ * Apply the WebRTC decision to `win`.
+ *
+ * Anything other than an explicit `true` denies: an absent policy global means
+ * a host that never resolved a decision — including any subframe, which gets no
+ * bootstrap — and that must fail closed.
+ */
+export function installWebRtcPolicy(win: any, allowed: unknown): void {
+  if (allowed === true) {
+    return;
+  }
+  freezeAndDelete(win, 'RTCPeerConnection');
+  // Vendor-prefixed aliases are separate constructors, not views of the
+  // standard one, so leaving either behind reopens the path outright.
+  freezeAndDelete(win, 'webkitRTCPeerConnection');
+  freezeAndDelete(win, 'mozRTCPeerConnection');
+}
+
+/** Read the decision the bootstrap published, then remove the global. */
+export function consumeWebRtcPolicy(win: any): unknown {
+  const allowed = win?.[POLICY_GLOBAL]?.webRtcAllowed;
+  freezeAndDelete(win, POLICY_GLOBAL);
+  return allowed;
+}
diff --git a/playground/src/lib/auto-test.ts b/playground/src/lib/auto-test.ts
index c20a58bf9..787be657d 100644
--- a/playground/src/lib/auto-test.ts
+++ b/playground/src/lib/auto-test.ts
@@ -28,7 +28,7 @@ const SKIPPED_SERVICES = new Map<string, string>([
   ["Payment", "Payment service not yet wired up by hosts"],
   [
     WEBRTC_SERVICE_NAME,
-    "WebRTC needs a live camera/microphone permission grant; run it interactively from the method browser",
+    "WebRTC needs a live camera/microphone grant, and a first-time WebRtc grant only takes effect after a reload; run it interactively from the method browser",
   ],
 ]);
 // Methods that trigger a host permission/signing prompt, so they need the
diff --git a/playground/src/lib/webrtc-check.ts b/playground/src/lib/webrtc-check.ts
index b3cce222c..8600b5521 100644
--- a/playground/src/lib/webrtc-check.ts
+++ b/playground/src/lib/webrtc-check.ts
@@ -7,10 +7,19 @@ import type { ServiceInfo } from "@parity/truapi/playground/services-types";
 // runner's function scope), so it shows up in the method browser, ⌘K, and the
 // diagnosis alike.
 //
-// The example follows the product model — request every device permission via
-// TrUAPI first, then use the capability:
-//   1. requestDevicePermission("Camera") and ("Microphone") — device permissions;
-//   2. only once granted, getUserMedia + RTCPeerConnection.createOffer.
+// The example follows the product model — request every permission via TrUAPI
+// first, then use the capability:
+//   1. requestRemotePermission("WebRtc") — governs whether the container leaves
+//      `RTCPeerConnection` in the realm at all;
+//   2. requestDevicePermission("Camera") and ("Microphone") — device permissions;
+//   3. only once granted, getUserMedia + RTCPeerConnection.createOffer.
+//
+// The WebRtc decision is resolved by the host before the product realm exists
+// and baked into the container, because a permission request made from inside
+// that realm would be forgeable by product script. So a first-time grant cannot
+// take effect during this run: `RTCPeerConnection` stays absent until the next
+// load. Granting and re-running is the expected path, and the reason this method
+// cannot pass unattended.
 
 export const WEBRTC_SERVICE_NAME = "WebRTC";
 export const WEBRTC_METHOD_NAME = "peer_connection";
@@ -23,7 +32,16 @@ assert(
   "Not a secure context — WebRTC media capture requires HTTPS or a localhost/loopback origin.",
 );
 
-// Permission phase — request the camera and microphone through TrUAPI up front.
+// Permission phase — the WebRtc remote permission first: it decides whether the
+// container leaves RTCPeerConnection in this realm at all.
+const webRtc = await truapi.permissions.requestRemotePermission({
+  permission: { tag: "WebRtc" },
+});
+assert(webRtc.isOk(), "WebRTC permission request failed:", webRtc);
+assert(webRtc.value.granted, "WebRTC permission denied");
+console.log("WebRTC permission granted");
+
+// Then the camera and microphone through TrUAPI.
 const camera = await truapi.permissions.requestDevicePermission("Camera");
 assert(camera.isOk(), "camera permission request failed:", camera);
 assert(camera.value.granted, "camera permission denied");
@@ -37,7 +55,9 @@ console.log("microphone granted");
 // Capability phase — permissions granted, now access the capability.
 assert(
   typeof RTCPeerConnection !== "undefined",
-  "RTCPeerConnection is unavailable — the host has not wired the WebRTC bridge (fail-closed).",
+  "RTCPeerConnection is unavailable (fail-closed). The container removes it unless " +
+    "the WebRtc grant was already in place when this realm loaded, so if you just " +
+    "granted it, reload and run again.",
 );
 assert(
   typeof navigator !== "undefined" && !!navigator.mediaDevices?.getUserMedia,
@@ -72,9 +92,10 @@ export const WEBRTC_SERVICE: ServiceInfo = {
       name: WEBRTC_METHOD_NAME,
       type: "unary",
       description:
-        "Requests camera + microphone (device permissions) through TrUAPI, " +
-        "then — once granted — opens an RTCPeerConnection and creates an " +
-        "offer with the captured media.",
+        "Requests the WebRtc remote permission plus camera + microphone " +
+        "through TrUAPI, then — once granted — opens an RTCPeerConnection and " +
+        "creates an offer with the captured media. A first-time WebRtc grant " +
+        "only takes effect after a reload.",
       exampleSource: WEBRTC_EXAMPLE_SOURCE,
     },
   ],

From 116e553e953610a8df2bc1875814fa55ba74c57a Mon Sep 17 00:00:00 2001
From: Filippo Vecchiato <filippo@parity.io>
Date: Tue, 18 Aug 2026 15:34:52 +0100
Subject: [PATCH 2/3] feat(ios): own product script registration so the
 container reaches every frame

A main-frame-only container leaves any subframe with pristine fetch/WebSocket/RTCPeerConnection, and a product reaches one through an iframe in its own HTML, so the frame scope has to be API rather than documentation.
---
 ios/truapi-host/README.md                     | 46 +++++----------
 .../Sources/TrUAPIHost/ProductScripts.swift   | 57 +++++++++++++++++++
 2 files changed, 70 insertions(+), 33 deletions(-)
 create mode 100644 ios/truapi-host/Sources/TrUAPIHost/ProductScripts.swift

diff --git a/ios/truapi-host/README.md b/ios/truapi-host/README.md
index e9de3376e..735688962 100644
--- a/ios/truapi-host/README.md
+++ b/ios/truapi-host/README.md
@@ -9,6 +9,7 @@ The package lives in the truapi repo next to the Rust core it wraps. `Package.sw
 The `TrUAPIHost` SPM package an iOS host app imports directly. It carries:
 
 - [`Sources/TrUAPIHost/TrUAPIHost.swift`](Sources/TrUAPIHost/TrUAPIHost.swift) — the hand-written shell: `TrUAPIHostCore` (owning wrapper around the UniFFI-generated `NativeTrUApiCore`, with the localhost WS bridge, session controls, and native change notifications), `TrUAPIHostCoreProtocol`, `RuntimeConfig`, and `LocalhostBridgeBootstrap`.
+- [`Sources/TrUAPIHost/ProductScripts.swift`](Sources/TrUAPIHost/ProductScripts.swift) — `TrUAPIHost.installProductScripts(into:core:endpoint:)`, which registers the bootstrap and the lockdown container with the frame scopes the lockdown depends on and peeks the WebRTC decision. The supported way to wire a product web view.
 - the Rust core as a binary target — a GitHub release asset by default (`publishedBinaryURL` in the root `Package.swift`), or the locally built `Binaries/truapi_server.xcframework` when `useLocalBinary` is flipped to true.
 - `Sources/TrUAPIHost/truapi_server.swift` and `Sources/truapi_serverFFI/include/` — the generated UniFFI bindings.
 - [`js/container/`](../../js/container) — the TS lockdown container; built into `Sources/TrUAPIHost/Resources/truapi-container.js` and exposed via `ContainerScriptBundle.load()`.
@@ -252,41 +253,20 @@ core.notifyPreimageChanged(key: preimageKey, value: preimageBytesOrNil)
 core.notifyChainResponse(connectionId: chainConnectionId, json: jsonRpcResponse)
 core.notifyChainClosed(connectionId: chainConnectionId)
 
-// Both scripts must be registered before the web view loads the product page,
-// and in this order: the bootstrap publishes the bridge endpoint on
-// `window.__truapi_localhost` and the resolved permission decisions on
-// `window.__truapi_policy__`; the container script then locks down the page's
-// platform APIs and reads both at eval time.
-//
-// The frame scopes differ, and the difference is load-bearing:
-//
-//   * the CONTAINER goes into every frame (`forMainFrameOnly: false`). A realm
-//     without it has pristine fetch/WebSocket/RTCPeerConnection, and a product
-//     can reach one through any iframe path that skips `document.createElement`
-//     (innerHTML, document.write, createElementNS, srcdoc). Injecting only the
-//     main frame leaves the whole lockdown one line away from bypass.
-//   * the BOOTSTRAP stays main-frame-only. A subframe then has no bridge
-//     endpoint and no policy, so every gate in the container fails closed there.
+// Register the bootstrap + lockdown container before the web view loads the
+// product page. `installProductScripts` owns the two properties that are easy to
+// get wrong and silently fatal: the container goes into EVERY frame (a frame
+// without it has pristine fetch/WebSocket/RTCPeerConnection, and a product
+// reaches one through an `<iframe>` in its own HTML), while the bootstrap stays
+// main-frame-only so a subframe has no bridge and no policy and fails closed. It
+// also resolves the WebRTC decision by peeking the core rather than prompting.
+// Do not register these scripts by hand.
 let contentController = WKUserContentController()
-// A peek, never a prompt — see LocalhostBridgeBootstrap.script.
-let webRtcAllowed = try core.permissionAuthorizationStatus(
-    request: .remote(RemotePermissionRequest(permission: .webRtc))
-) == .authorized
-let bootstrapScript = LocalhostBridgeBootstrap.script(
-    port: endpoint.port,
-    token: endpoint.token,
-    webRtcAllowed: webRtcAllowed
+try TrUAPIHost.installProductScripts(
+    into: contentController,
+    core: core,
+    endpoint: endpoint
 )
-contentController.addUserScript(WKUserScript(
-    source: bootstrapScript,
-    injectionTime: .atDocumentStart,
-    forMainFrameOnly: true
-))
-contentController.addUserScript(WKUserScript(
-    source: try ContainerScriptBundle.load(),
-    injectionTime: .atDocumentStart,
-    forMainFrameOnly: false
-))
 
 let configuration = WKWebViewConfiguration()
 configuration.userContentController = contentController
diff --git a/ios/truapi-host/Sources/TrUAPIHost/ProductScripts.swift b/ios/truapi-host/Sources/TrUAPIHost/ProductScripts.swift
new file mode 100644
index 000000000..9533d049c
--- /dev/null
+++ b/ios/truapi-host/Sources/TrUAPIHost/ProductScripts.swift
@@ -0,0 +1,57 @@
+// User-script installation for a product web view.
+//
+// The lockdown container's guarantees depend on two things a host would
+// otherwise have to get right by hand, so the package owns both.
+
+#if canImport(WebKit)
+
+import WebKit
+
+public extension TrUAPIHost {
+    /// Registers the bootstrap and lockdown container on `controller` with the
+    /// frame scopes the lockdown depends on, resolving the container's policy
+    /// from `core`.
+    ///
+    /// Prefer this over registering the scripts by hand. Two properties are
+    /// easy to get wrong and silently fatal:
+    ///
+    /// - **The container must run in every frame.** A frame without it has
+    ///   pristine `fetch`, `WebSocket`, `XMLHttpRequest` and
+    ///   `RTCPeerConnection`, and a product reaches one through an `<iframe>` in
+    ///   its own HTML — parsed before any script runs — so intercepting DOM
+    ///   creation APIs is no substitute. The bootstrap stays main-frame-only:
+    ///   a subframe then has no bridge endpoint and no policy, and every gate in
+    ///   the container fails closed there.
+    /// - **The WebRTC decision is a peek, never a prompt**, and it is baked in
+    ///   as a literal because the container enforces it inside the product's own
+    ///   realm, where an asynchronous permission request would be forgeable. A
+    ///   fresh grant therefore only applies once the web view reloads.
+    ///
+    /// Call before the web view loads the product page.
+    static func installProductScripts(
+        into controller: WKUserContentController,
+        core: any TrUAPIHostCoreProtocol,
+        endpoint: WsBridgeEndpoint
+    ) throws {
+        let webRtcAllowed = try core.permissionAuthorizationStatus(
+            request: .remote(RemotePermissionRequest(permission: .webRtc))
+        ) == .authorized
+
+        controller.addUserScript(WKUserScript(
+            source: LocalhostBridgeBootstrap.script(
+                port: endpoint.port,
+                token: endpoint.token,
+                webRtcAllowed: webRtcAllowed
+            ),
+            injectionTime: .atDocumentStart,
+            forMainFrameOnly: true
+        ))
+        controller.addUserScript(WKUserScript(
+            source: try ContainerScriptBundle.load(),
+            injectionTime: .atDocumentStart,
+            forMainFrameOnly: false
+        ))
+    }
+}
+
+#endif

From 2722efc97e85ee604f6f4485df629b6b8cb9ca66 Mon Sep 17 00:00:00 2001
From: Filippo Vecchiato <filippo@parity.io>
Date: Tue, 18 Aug 2026 20:21:35 +0100
Subject: [PATCH 3/3] fix(container): report a lock that does not take instead
 of failing quietly

---
 android/truapi-host/README.md                 |   6 +
 .../kotlin/io/parity/truapi/TrUAPIHost.kt     |  15 +++
 .../TrUAPIHost/Resources/truapi-container.js  |  94 +++++++++-----
 .../Sources/TrUAPIHost/truapi.swift           |  16 ++-
 js/container/src/freeze.test.ts               | 116 ++++++++++++++++++
 js/container/src/freeze.ts                    |  84 ++++++++++++-
 js/container/src/index.ts                     |  57 +++++----
 rust/crates/truapi/src/v01/permissions.rs     |  16 ++-
 8 files changed, 340 insertions(+), 64 deletions(-)
 create mode 100644 js/container/src/freeze.test.ts

diff --git a/android/truapi-host/README.md b/android/truapi-host/README.md
index c8f8fa9cb..8c0deae61 100644
--- a/android/truapi-host/README.md
+++ b/android/truapi-host/README.md
@@ -265,6 +265,12 @@ core.notifyChainClosed(chainConnectionId)
 // literal because the container enforces it inside the product's own realm,
 // where an async permission request would be forgeable. A fresh grant therefore
 // only takes effect once the web view reloads.
+//
+// Read this as a policy value, not a gate: Android injects no lockdown
+// container, so nothing consumes the decision and WebRTC is reachable on
+// Android whatever the status says. Pass what the core returns anyway — a
+// literal `true` compiles and would silently keep that open once the container
+// does land (#334 scopes the gate to iOS).
 val webRtcAllowed = core.permissionAuthorizationStatus(
     PermissionAuthorizationRequest.Remote(RemotePermissionRequest(RemotePermission.WebRtc))
 ) == PermissionAuthorizationStatus.AUTHORIZED
diff --git a/android/truapi-host/src/main/kotlin/io/parity/truapi/TrUAPIHost.kt b/android/truapi-host/src/main/kotlin/io/parity/truapi/TrUAPIHost.kt
index 1425776b5..ae71326b4 100644
--- a/android/truapi-host/src/main/kotlin/io/parity/truapi/TrUAPIHost.kt
+++ b/android/truapi-host/src/main/kotlin/io/parity/truapi/TrUAPIHost.kt
@@ -422,11 +422,26 @@ object LocalhostBridgeBootstrap {
      * relies on and resolve it itself. A settled value has nothing to steal.
      * The consequence is that a fresh grant only takes effect once the web view
      * reloads.
+     *
+     * The parameter is required so that every host has to answer, but a `Boolean`
+     * cannot force the answer to be a real one: passing a literal `true`
+     * compiles and grants WebRTC unconditionally, which is the pre-gate
+     * behaviour. Nothing downstream can detect that, so read the status from the
+     * core and pass what it returns. A type that only a
+     * [PermissionAuthorizationStatus] could produce would make the mistake
+     * unrepresentable; it is deliberately deferred until Android enforces the
+     * decision at all (see the container note where the policy is published).
      */
     fun script(port: UShort, token: String, webRtcAllowed: Boolean): String {
         val url = "ws://127.0.0.1:$port/?t=$token"
         val safeUrl = jsStringLiteral(url)
         val safeToken = jsStringLiteral(token)
+        // Published for the lockdown container to read, but Android does not
+        // inject the container, so on Android nothing reads it and WebRTC stays
+        // reachable regardless of the decision. This is a policy value, not an
+        // enforcement point: it is here so the bootstrap contract matches iOS,
+        // where the container is injected and does enforce it. Android
+        // enforcement is tracked separately (#334 scopes the gate to iOS).
         val safeWebRtc = if (webRtcAllowed) "true" else "false"
         return """
         (function() {
diff --git a/ios/truapi-host/Sources/TrUAPIHost/Resources/truapi-container.js b/ios/truapi-host/Sources/TrUAPIHost/Resources/truapi-container.js
index 5d6b55e95..f1d2714e5 100644
--- a/ios/truapi-host/Sources/TrUAPIHost/Resources/truapi-container.js
+++ b/ios/truapi-host/Sources/TrUAPIHost/Resources/truapi-container.js
@@ -1,6 +1,15 @@
 "use strict";
 (() => {
   // src/freeze.ts
+  var failures = [];
+  function describe(obj) {
+    if (obj === globalThis) return "window";
+    const name = obj?.constructor?.name;
+    return typeof name === "string" && name.length > 0 ? name : "object";
+  }
+  function recordFailure(obj, prop) {
+    failures.push(`${describe(obj)}.${prop}`);
+  }
   function freezeAndDelete(obj, prop) {
     try {
       Object.defineProperty(obj, prop, {
@@ -15,6 +24,9 @@
       } catch {
       }
     }
+    if (obj?.[prop] !== void 0) {
+      recordFailure(obj, prop);
+    }
   }
   function freezeValue(obj, prop, value) {
     try {
@@ -26,6 +38,34 @@
       });
     } catch {
     }
+    if (obj?.[prop] !== value) {
+      recordFailure(obj, prop);
+    }
+  }
+  function freezeCustom(obj, prop, descriptor, verify) {
+    try {
+      Object.defineProperty(obj, prop, { configurable: false, ...descriptor });
+    } catch {
+    }
+    let locked = false;
+    try {
+      locked = verify(obj?.[prop]);
+    } catch {
+    }
+    if (!locked) {
+      recordFailure(obj, prop);
+    }
+  }
+  function reportLockdownFailures() {
+    if (failures.length === 0) {
+      return;
+    }
+    const message = `TrUAPI container lockdown failed for: ${failures.join(", ")}`;
+    try {
+      console.error(message);
+    } catch {
+    }
+    throw new Error(message);
   }
 
   // src/webrtc.ts
@@ -57,14 +97,12 @@
     }
   });
   freezeValue(window, "WebSocket", _GatedWebSocket);
-  try {
-    Object.defineProperty(_NativeWebSocket.prototype, "constructor", {
-      value: _GatedWebSocket,
-      writable: false,
-      configurable: false
-    });
-  } catch {
-  }
+  freezeCustom(
+    _NativeWebSocket.prototype,
+    "constructor",
+    { value: _GatedWebSocket, writable: false },
+    (current) => current === _GatedWebSocket
+  );
   freezeValue(window, "fetch", (input, init) => {
     try {
       const raw = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
@@ -81,29 +119,26 @@
   freezeValue(navigator, "sendBeacon", () => false);
   freezeAndDelete(window, "indexedDB");
   freezeAndDelete(window, "caches");
-  try {
-    Object.defineProperty(document, "cookie", {
-      get: () => "",
-      set: () => {
-      },
-      configurable: false
-    });
-  } catch {
-  }
+  freezeCustom(
+    document,
+    "cookie",
+    { get: () => "", set: () => {
+    } },
+    (current) => current === ""
+  );
   freezeAndDelete(window, "SharedWorker");
   if (navigator.serviceWorker) {
-    try {
-      Object.defineProperty(navigator, "serviceWorker", {
-        value: Object.freeze({
-          register: () => {
-            throw new Error("ServiceWorker is not available");
-          }
-        }),
-        writable: false,
-        configurable: false
-      });
-    } catch {
-    }
+    const _stubServiceWorker = Object.freeze({
+      register: () => {
+        throw new Error("ServiceWorker is not available");
+      }
+    });
+    freezeCustom(
+      navigator,
+      "serviceWorker",
+      { value: _stubServiceWorker, writable: false },
+      (current) => current === _stubServiceWorker
+    );
   }
   var _createElement = document.createElement.bind(document);
   freezeValue(document, "createElement", (tagName, options) => {
@@ -113,4 +148,5 @@
     return _createElement(tagName, options);
   });
   installWebRtcPolicy(window, consumeWebRtcPolicy(window));
+  reportLockdownFailures();
 })();
diff --git a/ios/truapi-host/Sources/TrUAPIHost/truapi.swift b/ios/truapi-host/Sources/TrUAPIHost/truapi.swift
index 9df7082d8..2a3a0b8c2 100644
--- a/ios/truapi-host/Sources/TrUAPIHost/truapi.swift
+++ b/ios/truapi-host/Sources/TrUAPIHost/truapi.swift
@@ -5718,10 +5718,18 @@ public enum RemotePermission: Equatable, Hashable {
          */domains: [String]
     )
     /**
-     * WebRTC access. Advertised and persistable, but host enforcement is not
-     * yet implemented: the lockdown container leaves `RTCPeerConnection`
-     * available to products, and camera/microphone capture is gated by the OS
-     * permission prompts rather than by this permission.
+     * WebRTC access.
+     *
+     * Enforced inside the product's own realm rather than at a network layer:
+     * ICE reaches an arbitrary host over UDP, so no content rule list, request
+     * interceptor, or CSP directive observes it. A host peeks this decision
+     * before the product realm exists and the lockdown container removes
+     * `RTCPeerConnection` — and its vendor-prefixed aliases — unless the answer
+     * was an explicit grant. Resolving it up front is what makes the gate
+     * unforgeable, and it means a fresh grant applies from the next load.
+     *
+     * Camera and microphone capture is gated by the OS permission prompts and
+     * [`HostDevicePermissionRequest`], not by this permission.
      */
     case webRtc
     /**
diff --git a/js/container/src/freeze.test.ts b/js/container/src/freeze.test.ts
new file mode 100644
index 000000000..18f48eb29
--- /dev/null
+++ b/js/container/src/freeze.test.ts
@@ -0,0 +1,116 @@
+import { beforeEach, describe, expect, it } from 'bun:test';
+
+import {
+  freezeAndDelete,
+  freezeCustom,
+  freezeValue,
+  lockdownFailures,
+  reportLockdownFailures,
+  resetLockdownFailures,
+} from './freeze.js';
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+/**
+ * An object whose `prop` cannot be locked: non-configurable defeats
+ * `defineProperty`, and the module's strict mode makes the `delete` fallback
+ * throw. This is the shape that used to fail silently.
+ */
+function unlockable(prop: string, value: unknown): any {
+  const obj: any = {};
+  Object.defineProperty(obj, prop, { value, configurable: false, writable: false });
+  return obj;
+}
+
+beforeEach(() => {
+  resetLockdownFailures();
+});
+
+describe('a lock that takes', () => {
+  it('records nothing when the property reads as undefined', () => {
+    const win: any = { RTCPeerConnection: class {} };
+    freezeAndDelete(win, 'RTCPeerConnection');
+    expect(win.RTCPeerConnection).toBeUndefined();
+    expect(lockdownFailures()).toEqual([]);
+  });
+
+  it('records nothing when the property reads as the pinned value', () => {
+    const win: any = { fetch: () => {} };
+    const gated = () => {};
+    freezeValue(win, 'fetch', gated);
+    expect(win.fetch).toBe(gated);
+    expect(lockdownFailures()).toEqual([]);
+  });
+
+  it('records nothing when a custom verify accepts the result', () => {
+    const doc: any = { cookie: 'session=1' };
+    freezeCustom(doc, 'cookie', { get: () => '', set: () => {} }, (c) => c === '');
+    expect(doc.cookie).toBe('');
+    expect(lockdownFailures()).toEqual([]);
+  });
+
+  it('reports nothing to throw about', () => {
+    expect(() => reportLockdownFailures()).not.toThrow();
+  });
+});
+
+describe('a lock that does not take', () => {
+  // The gap this reporting exists to close: `defineProperty` threw, `delete`
+  // threw, and the constructor stayed reachable with nobody the wiser.
+  it('is recorded when the constructor survives freezeAndDelete', () => {
+    const Native = class {};
+    const win = unlockable('RTCPeerConnection', Native);
+    freezeAndDelete(win, 'RTCPeerConnection');
+    expect(win.RTCPeerConnection).toBe(Native);
+    expect(lockdownFailures()).toEqual(['Object.RTCPeerConnection']);
+  });
+
+  it('is recorded when freezeValue cannot replace the property', () => {
+    const win = unlockable('fetch', () => 'native');
+    freezeValue(win, 'fetch', () => 'gated');
+    expect(lockdownFailures()).toEqual(['Object.fetch']);
+  });
+
+  it('is recorded when a custom verify rejects the result', () => {
+    const doc = unlockable('cookie', 'session=1');
+    freezeCustom(doc, 'cookie', { get: () => '', set: () => {} }, (c) => c === '');
+    expect(lockdownFailures()).toEqual(['Object.cookie']);
+  });
+
+  it('is recorded when the verify itself throws', () => {
+    const obj = unlockable('boom', 1);
+    freezeCustom(obj, 'boom', { value: 2, writable: false }, () => {
+      throw new Error('unreadable');
+    });
+    expect(lockdownFailures()).toEqual(['Object.boom']);
+  });
+
+  it('accumulates every failure in order rather than stopping at the first', () => {
+    // Throwing mid-sequence would skip the remaining locks and widen the hole,
+    // so each one is still attempted.
+    freezeAndDelete(unlockable('RTCPeerConnection', class {}), 'RTCPeerConnection');
+    freezeAndDelete(unlockable('XMLHttpRequest', class {}), 'XMLHttpRequest');
+    expect(lockdownFailures()).toEqual([
+      'Object.RTCPeerConnection',
+      'Object.XMLHttpRequest',
+    ]);
+  });
+
+  it('throws from the report, naming the property, so the host learns', () => {
+    freezeAndDelete(unlockable('RTCPeerConnection', class {}), 'RTCPeerConnection');
+    expect(() => reportLockdownFailures()).toThrow(/RTCPeerConnection/);
+  });
+
+  it('logs before throwing, since a host may only see that evaluation failed', () => {
+    const original = console.error;
+    const logged: unknown[] = [];
+    console.error = (...args: unknown[]) => { logged.push(args[0]); };
+    try {
+      freezeAndDelete(unlockable('EventSource', class {}), 'EventSource');
+      expect(() => reportLockdownFailures()).toThrow();
+    } finally {
+      console.error = original;
+    }
+    expect(String(logged[0])).toContain('Object.EventSource');
+  });
+});
diff --git a/js/container/src/freeze.ts b/js/container/src/freeze.ts
index 14f3f365d..7e85cea32 100644
--- a/js/container/src/freeze.ts
+++ b/js/container/src/freeze.ts
@@ -5,9 +5,30 @@
 // here is `configurable: false` with a setter that silently ignores writes,
 // which is what makes the lock survive a product's own `defineProperty` or
 // assignment attempt.
+//
+// A lock that does not take is a hole in the sandbox, so none of these helpers
+// trusts `defineProperty` to have worked: each verifies the property afterwards
+// and records a failure it could not repair. Failures are collected rather than
+// thrown, because throwing mid-sequence would skip every lock after the failing
+// one and widen the hole. The caller applies all of them and then reports —
+// see `reportLockdownFailures`.
 
 /* eslint-disable @typescript-eslint/no-explicit-any */
 
+/** Properties whose lock could not be verified, in the order they were tried. */
+const failures: string[] = [];
+
+/** Name for `obj`, for a failure message a host can act on. */
+function describe(obj: any): string {
+  if (obj === globalThis) return 'window';
+  const name = obj?.constructor?.name;
+  return typeof name === 'string' && name.length > 0 ? name : 'object';
+}
+
+function recordFailure(obj: any, prop: string): void {
+  failures.push(`${describe(obj)}.${prop}`);
+}
+
 /** Make `prop` read as `undefined` and stay that way. */
 export function freezeAndDelete(obj: any, prop: string): void {
   try {
@@ -17,8 +38,12 @@ export function freezeAndDelete(obj: any, prop: string): void {
       configurable: false,
     });
   } catch {
-    // Property may already be non-configurable; try delete as fallback
-    try { delete obj[prop]; } catch { /* best effort */ }
+    // Property may already be non-configurable; try delete as fallback.
+    try { delete obj[prop]; } catch { /* verified below */ }
+  }
+  // Both routes can fail without throwing, so trust the read, not the call.
+  if (obj?.[prop] !== undefined) {
+    recordFailure(obj, prop);
   }
 }
 
@@ -34,5 +59,58 @@ export function freezeValue(obj: any, prop: string, value: any): void {
       set() { /* silently ignore */ },
       configurable: false,
     });
-  } catch { /* best effort */ }
+  } catch { /* verified below */ }
+  if (obj?.[prop] !== value) {
+    recordFailure(obj, prop);
+  }
+}
+
+/**
+ * Install `descriptor` on `prop`, recording a failure when `verify` rejects what
+ * the property reads back as. For locks whose success is neither "reads as
+ * `undefined`" nor "reads as this value".
+ */
+export function freezeCustom(
+  obj: any,
+  prop: string,
+  descriptor: PropertyDescriptor,
+  verify: (current: any) => boolean,
+): void {
+  try {
+    Object.defineProperty(obj, prop, { configurable: false, ...descriptor });
+  } catch { /* verified below */ }
+  let locked = false;
+  try { locked = verify(obj?.[prop]); } catch { /* treat a throwing read as a failure */ }
+  if (!locked) {
+    recordFailure(obj, prop);
+  }
+}
+
+/** Properties whose lock did not take. Empty means the realm is locked down. */
+export function lockdownFailures(): readonly string[] {
+  return failures;
+}
+
+/** Forget recorded failures. For tests, which share one module instance. */
+export function resetLockdownFailures(): void {
+  failures.length = 0;
+}
+
+/**
+ * Surface any lock that did not take, then throw.
+ *
+ * A half-locked realm is a security failure, and one that is silent is worse
+ * than one that is loud: the host would keep serving products into a sandbox it
+ * believes is closed. Call this last, once every lock has been attempted, so the
+ * throw costs no further coverage.
+ */
+export function reportLockdownFailures(): void {
+  if (failures.length === 0) {
+    return;
+  }
+  const message = `TrUAPI container lockdown failed for: ${failures.join(', ')}`;
+  // Console first: the throw below propagates out of the injected script, where
+  // a host may see only that evaluation failed and not which property it was.
+  try { console.error(message); } catch { /* console may itself be locked */ }
+  throw new Error(message);
 }
diff --git a/js/container/src/index.ts b/js/container/src/index.ts
index 3ff3ee49e..48cdde5ae 100644
--- a/js/container/src/index.ts
+++ b/js/container/src/index.ts
@@ -19,7 +19,12 @@
 // Isolation: Lock down globals so product scripts cannot access platform APIs.
 // =============================================================================
 
-import { freezeAndDelete, freezeValue } from './freeze.js';
+import {
+  freezeAndDelete,
+  freezeCustom,
+  freezeValue,
+  reportLockdownFailures,
+} from './freeze.js';
 import { consumeWebRtcPolicy, installWebRtcPolicy } from './webrtc.js';
 
 // Capture native fetch BEFORE lockdown so the same-origin gate can use it.
@@ -41,13 +46,12 @@ freezeValue(window, 'WebSocket', _GatedWebSocket);
 
 // Close the prototype-constructor bypass: `new window.WebSocket.prototype.constructor(url)`
 // would reach the ungated native constructor without this.
-try {
-  Object.defineProperty(_NativeWebSocket.prototype, 'constructor', {
-    value: _GatedWebSocket,
-    writable: false,
-    configurable: false,
-  });
-} catch { /* best effort */ }
+freezeCustom(
+  _NativeWebSocket.prototype,
+  'constructor',
+  { value: _GatedWebSocket, writable: false },
+  (current) => current === _GatedWebSocket,
+);
 
 // --- Network: fetch gated to same-origin only ---
 freezeValue(window, 'fetch', (input: RequestInfo | URL, init?: RequestInit) => {
@@ -74,27 +78,26 @@ freezeAndDelete(window, 'indexedDB');
 freezeAndDelete(window, 'caches');
 
 // document.cookie — redefine as no-op getter/setter
-try {
-  Object.defineProperty(document, 'cookie', {
-    get: () => '',
-    set: () => {},
-    configurable: false,
-  });
-} catch { /* best effort */ }
+freezeCustom(
+  document,
+  'cookie',
+  { get: () => '', set: () => {} },
+  (current) => current === '',
+);
 
 // --- Workers ---
 freezeAndDelete(window, 'SharedWorker');
 
 if (navigator.serviceWorker) {
-  try {
-    Object.defineProperty(navigator, 'serviceWorker', {
-      value: Object.freeze({
-        register: () => { throw new Error('ServiceWorker is not available'); },
-      }),
-      writable: false,
-      configurable: false,
-    });
-  } catch { /* best effort */ }
+  const _stubServiceWorker = Object.freeze({
+    register: () => { throw new Error('ServiceWorker is not available'); },
+  });
+  freezeCustom(
+    navigator,
+    'serviceWorker',
+    { value: _stubServiceWorker, writable: false },
+    (current) => current === _stubServiceWorker,
+  );
 }
 
 // --- DOM: block iframe creation ---
@@ -112,4 +115,10 @@ freezeValue(document, 'createElement', (tagName: string, options?: ElementCreati
 // bootstrap, so no policy) fail closed.
 installWebRtcPolicy(window, consumeWebRtcPolicy(window));
 
+// --- Report: every lock above has been attempted, so a failure can throw ---
+// A lock that did not take is a hole in the sandbox. Reporting last means the
+// throw costs no coverage, and it means the host learns rather than serving
+// products into a realm it believes is closed.
+reportLockdownFailures();
+
 export {};
diff --git a/rust/crates/truapi/src/v01/permissions.rs b/rust/crates/truapi/src/v01/permissions.rs
index b78fb3f9a..4c10e1a26 100644
--- a/rust/crates/truapi/src/v01/permissions.rs
+++ b/rust/crates/truapi/src/v01/permissions.rs
@@ -52,10 +52,18 @@ pub enum RemotePermission {
         /// Domain patterns requested by the product.
         domains: Vec<String>,
     },
-    /// WebRTC access. Advertised and persistable, but host enforcement is not
-    /// yet implemented: the lockdown container leaves `RTCPeerConnection`
-    /// available to products, and camera/microphone capture is gated by the OS
-    /// permission prompts rather than by this permission.
+    /// WebRTC access.
+    ///
+    /// Enforced inside the product's own realm rather than at a network layer:
+    /// ICE reaches an arbitrary host over UDP, so no content rule list, request
+    /// interceptor, or CSP directive observes it. A host peeks this decision
+    /// before the product realm exists and the lockdown container removes
+    /// `RTCPeerConnection` — and its vendor-prefixed aliases — unless the answer
+    /// was an explicit grant. Resolving it up front is what makes the gate
+    /// unforgeable, and it means a fresh grant applies from the next load.
+    ///
+    /// Camera and microphone capture is gated by the OS permission prompts and
+    /// [`HostDevicePermissionRequest`], not by this permission.
     #[display("WebRTC connections")]
     WebRtc,
     /// Submitting transactions on behalf of the user via `remote_chain_transaction_broadcast`.