fix(iframe): [PKG-IFRAME-03] release failed setup and bind message peers

packages/artplayer-tool-iframe/ARCHITECTURE.md

@@ -5,6 +5,9 @@ message listener, child injection/execution protocol and public callbacks.
 `src/requests.ts` owns request IDs, pending promises, injection polling and
 settlement/cancellation. Its host interface uses only the iframe, registry and
 two lifecycle flags; it does not depend on ArtPlayer or import the entry class.
+`src/connection.ts` owns listener acquisition/release and ensures request
+cancellation runs even if listener removal throws. `src/protocol.ts` checks the
+selected window peer and packet shape before either public receiver processes it.
 
 The entry initializes the same seven enumerable, writable fields in the same
 order. Internal request ownership lives in a module WeakMap, keeping instance
@@ -30,6 +33,10 @@ including failures reached from polling. `destroy()` first marks the instance
 destroyed, removes its listener, then immediately rejects both sent and waiting
 requests with `The instance has been destroyed`. Saved listener/timer callbacks
 become inert. Repeated destroy is harmless. There is no implicit request timeout.
+If constructor setup fails, it marks the partial instance destroyed, releases
+the acquired listener and cancels reentrant requests, preserving the original
+setup error even if cleanup also fails. The listener receiver and owning window
+are captured on acquisition; connection ownership is removed before releasing it.
 
 These are deliberate defect corrections: callers holding a promise during
 destroy must handle rejection; previously sent requests remained pending forever.
@@ -46,10 +53,24 @@ the async handler; resolver commits await the result. Execution errors still
 send an error packet and reject the handler. Expression arrow functions, closure
 capture and CSP restrictions have not been replaced with a new RPC protocol.
 
-This checkpoint does not fix navigation/reinjection, malformed message handling
-or source/origin validation. The executable commit protocol is not a sandbox;
-the current listener still accepts messages from unrelated windows. IFRAME-LIFE-01
-and IFRAME-TRUST-01 remain open. Continue in PKG-IFRAME-03/05 before release.
+Both receivers ignore malformed payloads (a non-null object with a string `type`
+is required, including an empty string). The parent accepts native messages only
+from the configured iframe's contentWindow; the child accepts them only from
+window.parent. Public direct onMessage calls with a missing/null source remain
+available to local callers. Same-page script or privileged injection is not
+isolated by this check. Generic response types and commit payload error handling
+are unchanged after the peer/envelope check.
+
+The initial URL's origin is deliberately not pinned: redirects and sandboxed
+opaque-origin children still communicate with their selected parent. The peer's
+content and the embedding parent must be trusted; executable commit is not a
+sandbox or a parent-origin allowlist. Upgrading one side does not secure the
+unchanged historical receiver on the other side. See the independent decision in
+[iframe-message-boundary.md](../../refactor/iframe-message-boundary.md).
+
+Navigation/reinjection remains unfinished. A child can inject before iframe load;
+blindly resetting state on load would lose a valid handshake. IFRAME-LIFE-01 and
+IFRAME-TRUST-01 remain open for complete lifecycle/integration and release review.
 
 Public declarations remain in `types/artplayer-tool-iframe.d.ts`; source typing
 does not yet establish historical declaration/entry compatibility. PKG-IFRAME-04
@@ -67,6 +88,10 @@ publication is implied by this source migration.
   generated docs copies. Never hand-edit those files.
 - `yarn test:browser test/browser/iframe.spec.js`: real same/cross-origin windows
   in Chromium, Firefox and WebKit. This tool-only fixture creates no player.
+- `yarn test:browser test/browser/iframe-boundaries.spec.js`: native peer rejection,
+  malformed packets, actual HTTP redirects, opaque sandbox and normal new/old
+  parent-child wire combinations. `ARTPLAYER_IFRAME_BOUNDARIES_ONLY=1` omits the
+  mixed-version controls when reproducing a candidate boundary failure.
 - Set `ARTPLAYER_IFRAME_LIFECYCLE_ONLY=1` for candidate lifecycle browser rows;
   `ARTPLAYER_IFRAME_ARTIFACT` selects an actual built file. For an unchanged
   candidate test against the old workspace, set `ARTPLAYER_IFRAME_BASELINE=1`.