[ejgallego]

Disposing a browser app should stop its browser effects and release its backend references. This adds idempotent Runtime disposal, integrates Wasm and remote startup, and restores the previous live owner when startup fails.

Disposal closes input and aborts cancellable work immediately. The current synchronous DOM opcode or delegated handler may finish, including a coalesced removal batch; no following opcode or ancestor handler starts. Handle tables and the transport remain valid until the outermost synchronous entry unwinds, then release exactly once. Terminal errors notify after cleanup; cleanup exceptions do not replace the original error. Async continuations check closure separately, and temporary image/frame handles close in finally. Decoded bitmaps close before their pixels are delivered to Lean. The last DOM is retained.

Server-generated boot handlers treat AbortError as quiet startup cancellation: they neither start a fallback app nor overwrite the current boot state or a replacement owner. Genuine startup failures still fall back in auto mode and report failure in wasm mode.

Validation:

• Targeted Lean 4.34 build of the server tests, demo server, and CLI; native server tests pass.
• Chromium 145 and Firefox 146: 16 lifecycle cases per engine, including actual listener detachment, mount rebinding, synchronous reentry, effect cancellation, late async completion, startup rollback, and bitmap cleanup ordering.
• Full browser server suite in both engines, with six new startup scenarios per engine covering cancellation, replacement ownership, and genuine failures in auto and wasm modes.
• Removing listener abort signals or old-mount listener removal makes the corresponding lifecycle regression fail in both engines (evidence-only mutation checks).
• The initial Runtime head also passed existing compiled Counter startup/disposal and DepthProbe overflow checks, DOM semantics (35 cases), templates (32 corpus scenarios plus 4 hand checks), and fuzz (320 sessions, 2,747 buffers per engine).
• JavaScript/shell syntax and whitespace checks.

Existing compiled Wasm artifacts were reused; the native page generator and callers were rebuilt for the cancellation change. Full site/Roster/container CI has not been run locally.

This is the shared Runtime layer of the planned stack. QED64 worker lifecycle and VIR SDK/byte effects will follow separately.