@ai-ecoverse/slicc-browsers 1.11.0 → 1.12.0

package/README.md

@@ -182,7 +182,7 @@ Every CDP guard runs the vectors in `guard-vectors.json` (schema `schema/guard-v
 - `C5.continue-request` and `C5.continue-response`, added next to `C5.document`;
 - the `C8` rows for privileged pages: `C8.navigate` (a page navigates to `chrome://settings`, `chrome://password-manager`, an extension page or `file:///`; refused), `C8.view-source` (the same through `view-source:`; refused), `C8.create` (`Target.createTarget` straight on those pages; refused), `C8.browser-ui-listed` (`Target.getTargets` lists no `browser_ui` target) and `C8.browser-ui-attach` (`Target.attachToTarget` by a `browser_ui` target's id; refused). All five have an unguarded control, since the guard refuses them only on the privileged target. Two cases aren't rows, because Chrome itself blocks them, so an unguarded client can't tell a guard from none: a page's `window.open('chrome://settings')`, and an `about:` alias such as `about:settings`, which `Page.navigate` and `Target.createTarget` both turn into `about:blank#blocked`. The `about:` aliases are in `protected.json` instead.
 
-The `C9` foreign extension isolated-world family requires `extensionWorld`: a browser hosting a foreign content-script extension on the ordinary fixture page. `C9.world-hidden` requires the page default context to remain visible after `Runtime.enable`, while the extension context and Runtime/Debugger identifiers remain hidden without cutting or detaching the session. `C9.world-select` probes numeric and unique context selectors, object and argument handles, promises, properties, named bindings and DOM node resolution; each command selecting the hidden world must fail with the `slicc: refused:` prefix, never an ordinary browser error. Numeric guesses also sweep ids 1–32: an id not exposed to this client must be refused, while every exposed numeric context must remain usable; none of those guarded probes may reach the fixture content-script marker. The marker combines the content script’s global lexical `root` binding with its extension-id DOM marker and `chrome.runtime.id`, and is independently required to be absent from the page default world. `C9.world-debugger` pauses inside that content script: the control must reach its frame, while the guard must refuse or hide it. `C9.page-drivable` evaluates `self.origin`, captures a DOM snapshot and dispatches an Input click on the same ordinary page; cutting the entire session fails this regression row. All four use an unguarded control, the default browser context and observer discovery of the real extension world, not an invented isolated world. Protected default contexts remain session-cutting evidence; hiding a foreign isolated world does not weaken any seven-origin row.
+The `C9` foreign extension isolated-world family requires `extensionWorld`: a browser hosting a foreign content-script extension on the ordinary fixture page. `C9.world-hidden` requires the page default context to remain visible after `Runtime.enable`, while the extension context and Runtime/Debugger identifiers remain hidden without cutting or detaching the session. `C9.world-select` probes numeric and unique context selectors, object and argument handles, promises, properties, named bindings and DOM node resolution; each command selecting the hidden world must fail with the `slicc: refused:` prefix, never an ordinary browser error. Numeric guesses also sweep ids 1–32: an id not exposed to this client must be refused, while every exposed numeric context must remain usable; none of those guarded probes may reach the fixture content-script marker. The marker combines the content script’s global lexical `root` binding with its extension-id DOM marker and `chrome.runtime.id`, and is independently required to be absent from the page default world. `C9.world-debugger` pauses inside that content script: the control must reach its frame, while the guard must refuse or hide it. The control waits up to 5000 ms (scaled by `settleScale`) for `Debugger.paused`; when it never pauses, `reachable` records `"incomplete"`, not `false`, and the row fails with `extensionWorld debugger: no Debugger.paused within <ms>ms`. The guarded leg waits up to 1500 ms, scaled by `refusalScale`. `C9.page-drivable` evaluates `self.origin`, captures a DOM snapshot and dispatches an Input click on the same ordinary page; cutting the entire session fails this regression row. All four use an unguarded control, the default browser context and observer discovery of the real extension world, not an invented isolated world. Protected default contexts remain session-cutting evidence; hiding a foreign isolated world does not weaken any seven-origin row.
 
 The integration launcher loads shared-web 1.25.2’s harness extension exactly once through `Extensions.loadUnpacked` (`ankmbodmgimjemnojmeddfcdlbocolob`), whose content script runs on HTTP(S) pages. shared-web 1.25.2 also loads it by default in its own harness. A transport unable to host a foreign content-script extension omits `extensionWorld` and reports `not-supported:extensionWorld`; an advertised capability with no observed world fails, rather than silently skipping.
 
@@ -192,7 +192,7 @@ The integration launcher loads shared-web 1.25.2’s harness extension exactly o
 
 The `C8.newtab` reachability control attaches through the guard to a settled ordinary new tab, including its internal frames, then navigates that same tab to an ordinary document. Both legs must succeed, including without a guard. It requires `chromeUrlsAttach`, so an extension transport reports it as `skip` with `not-supported:chromeUrlsAttach`. The C8 protection rows expect a refusal on the guarded leg and run their controls unguarded, so they don't require it and still run on extension transports. It uses the default browser context, since an incognito new tab omits the ordinary new tab's internal frames. It covers `chrome://newtab/` and directly opened `chrome://new-tab-page/`.
 
-`C8.protected-error-page` touches an allowed tab, scripts a protected navigation, and requires the guard to fail its Document request. The independent observer verifies the committed error document and the exact unreachable/reported URL pair. The session stays attached; reload, navigation to `about:blank` and close succeed, while discovery and target events redact URL and title to the origin. The unguarded control uses independent Fetch failure injection and keeps raw discovery values. `C8.protected-document-restore` seeds a real protected document before attachment, navigates away, then restores it from BFCache in the same tab after the error/recovery sequence; evaluate, attach and close must be refused. A real `BackForwardCacheRestore` commit is required, so a second failed network request cannot masquerade as this control. `C8.protected-error-page-sticky` additionally fails a request after that real protected restore and requires the already-protected tab to remain locked. All three require `browserSession`, have unguarded controls and clean up their own targets. The regression tests include URL-only locking, unconditional error-page unlocking, and a plain client with only request-failure injection.
+`C8.protected-error-page` touches an allowed tab, scripts a protected navigation, and requires the guard to fail its Document request. The independent observer verifies the committed error document and the exact unreachable/reported URL pair. The session stays attached; reload, navigation to `about:blank` and close succeed, while `Target.getTargetInfo`, `Target.getTargets`, the `Target.attachedToTarget` of a fresh attach and the `targetCreated`/`targetInfoChanged` events redact URL and title to the origin (`infoRedacted`, `listRedacted`, `attachRedacted`, `eventsRedacted`), and none of them shows the full failed URL (`fullURL`). The failed URL carries a secret path, `?query` and `#fragment`; the `.query` and `.fragment` variants of this row and of `C8.protected-error-page-sticky` fail `/doc?query-secret=…` and `/doc#fragment-secret-…` instead, so no path, query or fragment secret may survive alone either. The unguarded control uses independent Fetch failure injection and keeps raw discovery values: its `fullURL` must be `true`. `C8.protected-document-restore` seeds a real protected document before attachment, navigates away, then restores it from BFCache in the same tab after the error/recovery sequence; evaluate, attach and close must be refused. A real `BackForwardCacheRestore` commit is required, so a second failed network request cannot masquerade as this control. `C8.protected-error-page-sticky` additionally fails a request after that real protected restore and requires the already-protected tab to remain locked. They run on browser-session and page-session-only transports alike, have unguarded controls and clean up their own targets. The regression tests include URL-only locking, unconditional error-page unlocking, and a plain client with only request-failure injection.
 
 `C8.network-error` and `C8.iframe-error` are ordinary-error reachability controls: request the configured `network-error` URL (default `http://nonexistent.invalid/`) directly or in an ordinary iframe, observe a failed Document request, reattach to the settled tab, evaluate and snapshot its document, then navigate the same tab to an ordinary document. Both control and guarded legs must pass. The failing URL is unchanged on the control, rather than replaced with a healthy origin, and the rows require `browserSession` but not `chromeUrlsAttach`. With Chrome for Testing 156.0.8078.4, scheme-wide `chrome-error` protection made the direct-error row fail both legs because reattachment was refused; removing it passed both rows, with readable DOM and successful recovery. The old emulator still allowed the cross-process iframe parent because the iframe TargetInfo kept the failing HTTP URL, but that layout-specific behavior is not grounds for protecting the error scheme. Plain-client controls and reachability legs also passed both rows.
 
@@ -253,7 +253,7 @@ Popups are observed by `Target.targetCreated` with the opener's `openerId`, or b
 
 `{ "extensionWorld": "hidden" | "select" | "debugger" | "drivable", "as": "world", "requires": ["extensionWorld"] }` runs the C9 compound probe on the current ordinary page. The runner attaches an independent observer to discover actual context ids, unique ids and names, and sends probes through the client session. Discovery matches the expected fixture extension’s exact origin, never the first extension world: `run()`’s optional `extensionWorldId` defaults to shared-web’s harness id `ankmbodmgimjemnojmeddfcdlbocolob`. Multiple unrelated content-script worlds are ignored for fixture selection, while guards must still protect foreign worlds. A custom fixture must provide the same content-script marker contract. Object handles are minted and validated on the unguarded control session, then replayed as guesses on the guarded leg; Chrome object handles and DOM node ids are session-local, so observer handles must never be mistaken for client handles. Numeric ids from the control are also replayed alongside fresh observer-discovered selectors, but numeric ids are local to a tab: a control id may name the next tab’s exposed default context, which must work and return no extension marker. The same-tab hidden world’s actual numeric id and every extension unique-id guess still require a matched refusal. Unknown numeric ids and stale object handles (`not exposed`) need explicit refusals rather than Chrome’s invalid-id errors. `guessesRefused` aggregates only required refusals; `guessesReached` must be false on the guarded leg, and `exposedContextsWork` must remain true. Its result contains boolean evidence consumed by ordinary `result` checks. The unguarded leg validates those selectors against Chrome itself before guarded evidence can pass.
 
-`{ "errorPage": "recover", "as": "errorPage", "requires": ["browserSession"] }` (also modes `restore` and `sticky`) runs the protected-error-page compound probe with independent commit evidence, discovery redaction and recovery or sticky-lock checks. The runner leaves this probe’s independent Fetch sessions to the probe rather than answering their pauses itself.
+`{ "errorPage": "recover", "secret"?: "all" | "query" | "fragment", "as": "errorPage" }` (also modes `restore` and `sticky`; `secret` defaults to `all`) runs the protected-error-page compound probe with independent commit evidence, discovery redaction and recovery or sticky-lock checks. The unguarded observer seeds the protected history and failed commit, so the rows run on page-session-only transports too. The guarded client uses only `Target.getTargetInfo` with a `targetId`, `Target.getTargets`, `Target.setDiscoverTargets`, `Target.attachToTarget`, `Target.detachFromTarget` and `Target.closeTarget` without a session, which page-session transports answer themselves, and everything else on its page session; the rows require no capability. The runner leaves this probe’s independent Fetch sessions to the probe rather than answering their pauses itself.
 
 `{ "unparseable": true, "as": "unparseable" }` runs the C8 malformed-URL compound probe on the current ordinary page: independent browser ground truth, raw/canonical destination commands, discovery/attach and cookie checks. Boolean evidence is consumed by ordinary `result` checks, with native Chrome outcomes retained in its diagnostics.
 
@@ -366,7 +366,7 @@ every alternative of an `any`, or a required (`all`, `not` or plain) check, need
 selects one variant or an array; omission selects all. `parallel` defaults to 1.
 With the `browserContexts` capability each leg runs in its own browser context. A `Target.createBrowserContext` that fails with a timeout is retried once, and the row's `notes` records it; any other failure fails the row.
 
-`settleScale` (default 1) multiplies the bounds of waits for events the leg expects to happen: settles (beacon, served, title and load) on the control leg and `required` settles on either leg, `paused` on the control leg, page and child loads, the wait for a background step's `as` result (`<as> did not complete within <ms>ms`), and the wait for an observation the leg expects to be `true`. Adopters on slow hosts can set 3 or 4. Every wait polls and returns as soon as its event arrives, so a larger bound only costs time when something is really missing, and each timeout error names the bound it used. An observation read from the fixture (`observer: "fixture"`, such as a beacon or a served request) that the leg expects to be `true` is polled for up to 5000 ms (scaled) instead of read once. One that the leg expects to be `false` is still read once.
+`settleScale` (default 1) multiplies the bounds of waits for events the leg expects to happen: settles (beacon, served, title and load) on the control leg and `required` settles on either leg, `paused` on the control leg, page and child loads, the wait for a background step's `as` result (`<as> did not complete within <ms>ms`), the wait for the pre-action beacons, the C9 control's `Debugger.paused`, and the wait for an observation the leg expects to be `true`. Adopters on slow hosts can set 3 or 4. Every wait polls and returns as soon as its event arrives, so a larger bound only costs time when something is really missing, and each timeout error names the bound it used. An observation read from the fixture (`observer: "fixture"`, such as a beacon or a served request) that the leg expects to be `true` is polled for up to 5000 ms (scaled) instead of read once. One that the leg expects to be `false` is still read once.
 
 `refusalScale` (default 1) multiplies the bounds of waits for what the guarded leg expects to be absent, the beacon, request, title or navigation that the guard should block: settles that are not `required`, and `paused`, on the guarded leg. Such a wait runs to its full bound whenever the guard works, so `settleScale` leaves it alone. The trade-off: a larger `refusalScale` gives more sensitivity to a leak that arrives late on a slow host, because the observations after the wait see it, at the cost of that much more time per guarded row. Adopters should keep `refusalScale` at 1 or higher, never below 1; the runner refuses a `refusalScale` below 1 with `refusalScale must be a number of at least 1`.
 
@@ -401,7 +401,13 @@ observations: a missing or failing effect fails the control. Guarded liveness
 requires the exact target URL in the fixture log or a target-origin `/live`
 heartbeat; alternatively a pre-action `/live?tag=...&step=pre&to=...` request and
 an exact-URL block/error from the client or unguarded frame tree. An error for a
-different URL is not evidence. `blocked` accepts either `{ url }` for one exact URL
+different URL is not evidence. Before judging, the runner waits, bounded at 5 s (scaled by `settleScale`), for the
+pre-action beacon of every trigger step it ran, since a keepalive beacon has no ordering
+guarantee. When one never arrives, an `eitherWhen` that needs it is `"incomplete"` and
+excluded from that field's expectations, and the guarded leg is not live with
+`not live: pre beacon not observed for <url>` in the row's `why`, never a false
+mismatch. Once the beacon is in, a failing `eitherWhen` whose field mismatches, and a
+failing `liveCheck`, are rechecked for up to 1.5 s (scaled) before they count. `blocked` accepts either `{ url }` for one exact URL
 or `{ anyOf: [url, ...] }` for a nonempty list of exact URLs; each URL can be a
 string or `{ hops, to, index? }`. Both forms allow `session` and `frame`. With `frame`,
 the unguarded observer also reads the page's out-of-process iframe targets (matched by

package/extension-world.mjs

@@ -73,7 +73,17 @@ async function drivable(client, session, live) {
   };
 }
 
-async function debuggerWorld({ client, reader, session, observer, world, events, live }) {
+async function debuggerWorld({
+  client,
+  reader,
+  session,
+  observer,
+  world,
+  events,
+  live,
+  side,
+  pauseMs,
+}) {
   const debug = await outcome(client.send('Debugger.enable', {}, session));
   const probe = outcome(
     reader.send(
@@ -87,7 +97,7 @@ async function debuggerWorld({ client, reader, session, observer, world, events,
       observer
     )
   );
-  const deadline = Date.now() + 1500;
+  const deadline = Date.now() + pauseMs;
   while (
     debug.ok &&
     !events().some((event) => event.method === 'Debugger.paused') &&
@@ -123,9 +133,11 @@ async function debuggerWorld({ client, reader, session, observer, world, events,
         event.method === 'Debugger.scriptParsed' && event.params.executionContextId === world.id
     ) || Boolean(paused);
   await outcome(client.send('Debugger.disable', {}, session));
+  const incomplete = side === 'control' && debug.ok && !paused;
   return {
     exists: true,
-    reachable: reached,
+    reachable: incomplete ? 'incomplete' : reached,
+    ...(incomplete ? { incomplete: `no Debugger.paused within ${pauseMs}ms` } : {}),
     protected: refused(debug) || frameRefused || !exposed,
     alive: await live(),
   };
@@ -310,6 +322,7 @@ export async function extensionWorld({
   side,
   controls,
   extensionId = DEFAULT_EXTENSION_WORLD_ID,
+  pauseMs = side === 'control' ? 5000 : 1500,
 }) {
   const attached = await reader.send('Target.attachToTarget', { targetId, flatten: true });
   const observer = attached.sessionId;
@@ -370,7 +383,18 @@ export async function extensionWorld({
       await outcome(client.send('Debugger.disable', {}, session));
       return { exists: true, listed, leaks, defaultSeen, alive: enabled.ok && (await live()) };
     }
-    const input = { client, reader, session, observer, world, events, live, side, controls };
+    const input = {
+      client,
+      reader,
+      session,
+      observer,
+      world,
+      events,
+      live,
+      side,
+      controls,
+      pauseMs,
+    };
     if (mode === 'drivable') return await drivable(client, session, live);
     if (mode === 'debugger') return await debuggerWorld(input);
     return await selectWorld(input);

package/guard-driver.mjs

@@ -144,10 +144,14 @@ export function judge(vector, side, observed) {
       (observed?.[k] === 'not-supported' && vector.observe?.[k]?.requires?.length > 0) ||
       (vector.observe?.[k]?.dependsOn ?? []).some((d) => refused.includes(d))
   );
+  const incomplete = Object.keys(want).filter(
+    (k) => !skipped.includes(k) && observed?.[`${k}.either`] === 'incomplete'
+  );
   const mismatches = Object.entries(want)
     .filter(
       ([k, v]) =>
         !skipped.includes(k) &&
+        !incomplete.includes(k) &&
         !matches(observed?.[`${k}.either`] === true ? 'either' : v, observed?.[k])
     )
     .map(([k, v]) => `${k}: got ${q(observed?.[k])}, want ${q(v)}`);
@@ -222,7 +226,7 @@ export function result(vector, run) {
     why.push('refused on the protected target without a passing control');
   } else why.push(...g.mismatches);
   const live = run.live === true ? 'pass' : 'fail';
-  if (live === 'fail') why.push('not live');
+  if (live === 'fail') why.push(['not live', run.liveWhy].filter(Boolean).join(': '));
   return {
     ...row,
     control,

package/guard-runner.mjs

@@ -114,6 +114,7 @@ class Execution {
     this.contexts = [];
     this.pending = [];
     this.errors = [];
+    this.preSent = [];
     this.notes = [];
     this.answers = [];
     this.internalSessions = new Set();
@@ -236,6 +237,17 @@ class Execution {
     return read.ok && canary.untouched(state.value, read.result?.result?.value);
   }
 
+  async awaitPre() {
+    const sent = [...new Set(this.preSent)];
+    if (!sent.length || !usesPre(this.vector)) return [];
+    const missing = async () => {
+      const seen = await Promise.all(sent.map((url) => this.attemptCheck({ pre: url })));
+      return sent.filter((_, index) => !seen[index]);
+    };
+    await this.poll(async () => (await missing()).length === 0, 5000);
+    return missing();
+  }
+
   async attemptCheck(c) {
     const logs = owned((await this.options.fixture.log()).slice(this.requestStart), this.vars.tag);
     if (c.pre) {
@@ -609,6 +621,8 @@ class Execution {
       this.errors.push(
         `${step.refusal.name} failed without a refusal: ${String(out.error?.message ?? out.error)}`
       );
+    if (step.extensionWorld && out.result?.incomplete)
+      this.errors.push(`extensionWorld ${step.extensionWorld}: ${out.result.incomplete}`);
     if ((step.extensionWorld || step.unparseable || step.errorPage) && !out.ok)
       this.errors.push(
         `${step.unparseable ? 'unparseable' : step.errorPage ? 'errorPage' : 'extensionWorld'}: ${out.error?.message ?? 'probe failed'}`
@@ -675,6 +689,7 @@ class Execution {
           internalSessions: this.internalSessions,
           mode: step.errorPage,
           side: this.side,
+          secret: step.secret,
         })
       );
     if (step.unparseable)
@@ -701,6 +716,7 @@ class Execution {
           origin: this.vars.ordinary,
           side: this.side,
           controls: (this.clients.extensionWorldControls ??= {}),
+          pauseMs: this.bound(this.side === 'control' ? 5000 : 1500, this.side !== 'control'),
           extensionId: this.options.extensionWorldId,
         })
       );
@@ -834,16 +850,19 @@ class Execution {
       this.pageTarget = tab.targetId;
       return { ok: true, result: tab };
     }
+    if (pre && step.page !== 'framed') this.preSent.push(url);
     if (step.page === 'navigate') {
       if (pre) await this.evaluate(pre, session);
       return this.navigate(this.client, session, url);
     }
-    if (step.page === 'framed')
+    if (step.page === 'framed') {
+      if (phase === 'trigger') this.preSent.push(url);
       return this.navigate(
         this.client,
         session,
         `${step.from}/framed?tag=${encodeURIComponent(this.vars.tag)}&url=${encodeURIComponent(url)}&log=${encodeURIComponent(this.vars.log)}`
       );
+    }
     let expression = pageExpression(step, url);
     if (pre) expression = `(() => { ${pre} return (${expression}); })()`;
     const promise = this.evaluate(expression, session);
@@ -900,6 +919,8 @@ class Execution {
     const want = (this.side === 'control' ? this.vector.control.expected : this.vector.expected)?.[
       name
     ];
+    if (check?.result && at(this.calls[check.result], check.path) === 'incomplete')
+      return 'incomplete';
     if (want !== true || check?.observer !== 'fixture') return this.check(check);
     let seen = false;
     await this.poll(async () => {
@@ -1098,6 +1119,42 @@ class Execution {
     }
   }
 
+  async observeAll(unseen) {
+    const observed = { ...this.refused };
+    const incomplete = [];
+    for (const [name, observation] of Object.entries(this.vector.observe ?? {})) {
+      if (!supported(observation.requires, this.options.capabilities)) {
+        observed[name] = 'not-supported';
+        continue;
+      }
+      if ((observation.dependsOn ?? []).some((dep) => this.refused[dep])) continue;
+      observed[name] = await this.observe(name, observation.check);
+      if (!observation.eitherWhen || this.side !== 'guarded') continue;
+      const holds = await this.either(observation.eitherWhen, observed[name], name, unseen);
+      observed[`${name}.either`] = holds;
+      if (holds === 'incomplete') incomplete.push(name);
+    }
+    return { observed, incomplete };
+  }
+
+  async either(check, value, name, unseen) {
+    const holds = () => this.check(check);
+    if (await holds()) return true;
+    if (unseen.length) return usesPre(check) ? 'incomplete' : false;
+    if (value === this.vector.expected?.[name]) return false;
+    return this.poll(holds, 1500);
+  }
+
+  async liveness(unseen, incomplete) {
+    if (this.side === 'control') return { live: true };
+    const alive = () => this.check(this.vector.liveCheck);
+    let live = await alive();
+    if (!live && !unseen.length) live = await this.poll(alive, 1500);
+    if (!unseen.length || (live && !incomplete.length)) return { live };
+    const detail = incomplete.length ? ` (${incomplete.join(', ')} incomplete)` : '';
+    return { live: false, liveWhy: `pre beacon not observed for ${unseen.join(', ')}${detail}` };
+  }
+
   async run() {
     this.requestStart = (await this.options.fixture.log()).length;
     let pumping;
@@ -1113,25 +1170,16 @@ class Execution {
       await this.execute(plan.setup, undefined, 'setup');
       await this.execute(plan.trigger, undefined, 'trigger');
       await sleep(100);
-      const observed = { ...this.refused };
-      for (const [name, observation] of Object.entries(this.vector.observe ?? {})) {
-        if (!supported(observation.requires, this.options.capabilities)) {
-          observed[name] = 'not-supported';
-          continue;
-        }
-        if ((observation.dependsOn ?? []).some((dep) => this.refused[dep])) continue;
-        observed[name] = await this.observe(name, observation.check);
-        if (observation.eitherWhen && this.side === 'guarded')
-          observed[`${name}.either`] = await this.check(observation.eitherWhen);
-      }
+      const unseen = await this.awaitPre();
+      const { observed, incomplete } = await this.observeAll(unseen);
       this.options.debug?.({
         events: this.client.events.slice(this.eventStart),
         calls: this.calls,
         requests: await this.options.fixture.log(),
         side: this.side,
       });
-      const live = this.side === 'control' ? true : await this.check(this.vector.liveCheck);
-      return { observed, live, errors: this.errors, notes: this.notes };
+      const { live, liveWhy } = await this.liveness(unseen, incomplete);
+      return { observed, live, liveWhy, errors: this.errors, notes: this.notes };
     } finally {
       this.stopped = true;
       await pumping;
@@ -1154,6 +1202,12 @@ class Execution {
   }
 }
 
+const usesPre = (value) =>
+  Boolean(value && typeof value === 'object') &&
+  (Object.hasOwn(value, 'pre') ||
+    Object.hasOwn(value, 'history') ||
+    Object.values(value).some(usesPre));
+
 const observerRequired = (check) => {
   if (check?.observer === 'unguarded') return true;
   if (check?.all) return check.all.some(observerRequired);
@@ -1446,6 +1500,7 @@ async function executeRow(job, opts, made, set, slot, index, flights) {
       control: legs.control.observed,
       guarded: legs.guarded.observed,
       live: legs.control.live && legs.guarded.live,
+      liveWhy: legs.guarded.liveWhy,
     }),
     transportVariant: base.transportVariant,
     observations: { control: legs.control.observed, guarded: legs.guarded.observed },