@ai-ecoverse/slicc-browsers 1.14.10 → 1.15.1

package/README.md

@@ -185,12 +185,15 @@ Every CDP guard runs the vectors in `guard-vectors.json` (schema `schema/guard-v
 - the cert lane's E and B rows;
 - `C5.continue-request` and `C5.continue-response`, added next to `C5.document`;
 - the `C8` rows for privileged pages: `C8.navigate` (a page navigates to `chrome://settings`, `chrome://password-manager`, an extension page or `file:///`; refused), `C8.view-source` (the same through `view-source:`; refused), `C8.create` (`Target.createTarget` straight on those pages; refused), `C8.browser-ui-listed` (`Target.getTargets` lists no `browser_ui` target) and `C8.browser-ui-attach` (`Target.attachToTarget` by a `browser_ui` target's id; refused). All five have an unguarded control, since the guard refuses them only on the privileged target. Two cases aren't rows, because Chrome itself blocks them, so an unguarded client can't tell a guard from none: a page's `window.open('chrome://settings')`, and an `about:` alias such as `about:settings`, which `Page.navigate` and `Target.createTarget` both turn into `about:blank#blocked`. The `about:` aliases are in `protected.json` instead.
+- slicc-cdp's owner vectors in `test/integration/guard-native.test.mjs` at `d85ac3c`: `C5.script`, a protected script subresource under the client's own `Fetch.enable` `*` at both stages (the guard neither pauses it for the client nor lets the client fulfil it, and the page runs the stand-in's real `/script`, while the control's paused request carries its headers as an object with `User-Agent` and runs the forged script), and `X1.after-exit`, the client lifecycle row below.
+
+`X1.after-exit` (family `X`, client lifecycle) needs `clientExit`. Through the guard, the client opens an ordinary tab, registers `Page.addScriptToEvaluateOnNewDocument` with `{beacon}`, `Network.setExtraHTTPHeaders` with `x-probe: {tag}` and `Fetch.enable` `*` with a rule that fulfils the destination with a forged `FULFILLED` page, then loads the `/page` trigger whose `go()` navigates to `{target}/canary/{tag}`. Before the exit it must see its init-script beacon, its header on the trigger request and the trigger's `Fetch.requestPaused`: those are the positive evidence on both legs. Then the client exits, the unguarded observer calls `go()`, and the destination must be served and read as the real `canary` document, with no beacon from `{target}`, no `x-probe` on its request, no forged body and no `Fetch.requestPaused` for it reaching the client: nothing the client registered may outlive it. The control runs the same on `{plain}` through the guard, and expects the same, since an ordinary navigation after the exit must be just as clean. A guard that keeps its upstream session, or its own init scripts, headers or interception, past the client's exit fails the row.
 
 The `C9` foreign extension isolated-world family requires `extensionWorld`: a browser hosting a foreign content-script extension on the ordinary fixture page. `C9.world-hidden` requires the page default context to remain visible after `Runtime.enable`, while the extension context and Runtime/Debugger identifiers remain hidden without cutting or detaching the session. `C9.world-select` probes numeric and unique context selectors, object and argument handles, promises, properties, named bindings and DOM node resolution; each command selecting the hidden world must fail with the `slicc: refused:` prefix, never an ordinary browser error. Numeric guesses also sweep ids 1–32: an id not exposed to this client must be refused, while every exposed numeric context must remain usable; none of those guarded probes may reach the fixture content-script marker. The marker combines the content script’s global lexical `root` binding with its extension-id DOM marker and `chrome.runtime.id`, and is independently required to be absent from the page default world. `C9.world-debugger` pauses inside that content script: the control must reach its frame, while the guard must refuse or hide it. The control waits up to 5000 ms (scaled by `settleScale`) for `Debugger.paused`; when it never pauses, `reachable` records `"incomplete"`, not `false`, and the row fails with `extensionWorld debugger: no Debugger.paused within <ms>ms`. The guarded leg waits up to 1500 ms, scaled by `refusalScale`. `C9.page-drivable` evaluates `self.origin`, captures a DOM snapshot and dispatches an Input click on the same ordinary page; cutting the entire session fails this regression row. All four use an unguarded control, the default browser context and observer discovery of the real extension world, not an invented isolated world. Protected default contexts remain session-cutting evidence; hiding a foreign isolated world does not weaken any seven-origin row.
 
 The integration launcher loads shared-web 1.25.2’s harness extension exactly once through `Extensions.loadUnpacked` (`ankmbodmgimjemnojmeddfcdlbocolob`), whose content script runs on HTTP(S) pages. shared-web 1.25.2 also loads it by default in its own harness. A transport unable to host a foreign content-script extension omits `extensionWorld` and reports `not-supported:extensionWorld`; an advertised capability with no observed world fails, rather than silently skipping.
 
-`C2.redirect-secret` probes ordinary fixture 302s to seven’s `/auth/callback?code=…&state=…` and vault’s `/oauth/mcp-callback?code=…`, plus `#access_token=…` variants of both. It navigates with Page and scripted `location.href`, fetches a subresource and sends an XHR. The 302 carries `Location`, `Content-Location`, `Refresh: 0;url=…` and `Link: <…>; rel=preconnect`. Page, Network (including ExtraInfo), Runtime, Log, Audits and both Fetch stages are enabled. Every received raw message is scanned, including replies but not the probe’s own observer session traffic, across an eight-second tail, for raw, percent-encoded, JSON-escaped and base64 marker representations. Both response-body APIs are attempted on each hop; guarded bodies need matched refusals. `Network.getResponseBody` is attempted, once per id, with every network id the client learns for a 301–308 hop: the `requestId` of a Network event carrying the redirect status and the `networkId` of the Fetch response-stage pause. For each registered hop whose id the client learned neither way, the probe reads the hop’s real id from the harness’s own unguarded tap (the observer session, which enables Network on the guarded leg) and attempts the read on the guarded session with it. The evidence’s `networkBodyCarriers` counts the ids per carrier, and `networkBodyPath` names the weakest carrier any id needed: `withheld+tap`, then `fetch-networkId`, then `network`, or `none` without any id. These reads never hold up a Fetch pause, and the probe gives them five seconds after `Fetch.disable` to settle. A read still unanswered then is not a refusal. `networkBodyAttempted` and `networkBodyRefused` hold only when every attempt is refused. On the guarded leg a `fetch-networkId` or `withheld+tap` carrier also needs the same row’s unguarded control to have seen the redirect’s Network events. Without that proof, or with no id at all, both read `incomplete` and the probe returns `redirect-secret: network body leg <reason>`; an attempt that is not refused is measured and fails. Every request the client sees for a registered redirect URL, through its initial `Network.requestWillBeSent` or a redirect `requestWillBeSent` whose `redirectResponse.url` is that URL, must end within the step in a redirect `requestWillBeSent`, `loadingFinished` or `loadingFailed` for that `requestId`. The evidence’s `hops` records per `requestId` the `delivery` (`redacted` for an origin-only protected redirect in place, `withheld` for a terminal without the redirect, `ordinary`, `raw` or `unterminated`) and the `terminal` event method. `requestsTerminated` is false on any `unterminated` request, a measured guard failure rather than missing evidence; `hopsRedacted` is false on any `raw` or `ordinary` hop, so a delivered protected hop must be origin-only, never the raw or a substituted URL; the guarded leg expects it. Page frame trees, resource trees and navigation history are read before recovery to catch error-page leftovers. A separate structural check requires every protected `Network.Request.urlFragment` and `Page.Frame.urlFragment` to be empty or absent, even if its value contains no marker; the ordinary `#access_token` control independently requires fragment evidence in request events, frame events, frame-tree replies and resource-tree replies. The ordinary session must survive. The unguarded ordinary redirect control preserves all four headers in `redirectResponse`, ExtraInfo’s headers and `headersText`, and Fetch’s response headers. `C2.redirect-secret-mix` repeats that matrix with 301/303/307/308. The protected leg requires in-place ExtraInfo delivery with origin-only header values, not merely the absence of a marker.
+`C2.redirect-secret` probes ordinary fixture 302s to seven’s `/auth/callback?code=…&state=…` and vault’s `/oauth/mcp-callback?code=…`, plus `#access_token=…` variants of both. It navigates with Page and scripted `location.href`, fetches a subresource and sends an XHR. After each one it waits, at least 250 ms and up to two seconds scaled by `settleScale` (stall-tolerant), for the fixture to log the redirect URL and every request seen for it to end, before it navigates away. On the guarded leg, once one action's wait times out, the remaining actions skip it, so a guard that never terminates costs that bound once per leg. The 302 carries `Location`, `Content-Location`, `Refresh: 0;url=…` and `Link: <…>; rel=preconnect`. Page, Network (including ExtraInfo), Runtime, Log, Audits and both Fetch stages are enabled. Every received raw message is scanned, including replies but not the probe’s own observer session traffic, across an eight-second tail, for raw, percent-encoded, JSON-escaped and base64 marker representations. Both response-body APIs are attempted on each hop; guarded bodies need matched refusals. `Network.getResponseBody` is attempted, once per id, with every network id the client learns for a 301–308 hop: the `requestId` of a Network event carrying the redirect status and the `networkId` of the Fetch response-stage pause. For each registered hop whose id the client learned neither way, the probe reads the hop’s real id from the harness’s own unguarded tap (the observer session, which enables Network on the guarded leg) and attempts the read on the guarded session with it. The evidence’s `networkBodyCarriers` counts the ids per carrier, and `networkBodyPath` names the weakest carrier any id needed: `withheld+tap`, then `fetch-networkId`, then `network`, or `none` without any id. These reads never hold up a Fetch pause, and the probe gives them five seconds after `Fetch.disable` to settle, and again after the terminal wait for reads that late events started. A read still unanswered then is not a refusal. `networkBodyAttempted` and `networkBodyRefused` hold only when every attempt is refused. On the guarded leg a `fetch-networkId` or `withheld+tap` carrier also needs the same row’s unguarded control to have seen the redirect’s Network events. Without that proof, or with no id at all, both read `incomplete` and the probe returns `redirect-secret: network body leg <reason>`; an attempt that is not refused is measured and fails. Every request the client sees for a registered redirect URL, through its initial `Network.requestWillBeSent` or a redirect `requestWillBeSent` whose `redirectResponse.url` is that URL, must end within the step in a redirect `requestWillBeSent`, `loadingFinished` or `loadingFailed` for that `requestId`. Before the evidence is evaluated, on every leg, the probe waits up to five seconds scaled by `settleScale` (stall-tolerant) for every seen request to reach one of those events. The evidence’s `hops` records per `requestId` the `delivery` (`redacted` for an origin-only protected redirect in place, `withheld` for a terminal without the redirect, `ordinary`, `raw` or `unterminated`) and the `terminal` event method. On the guarded leg `requestsTerminated` is false on any `unterminated` request after that wait, a measured guard failure rather than missing evidence; on the unguarded control an `unterminated` request is missing evidence, so `requestsTerminated` reads `incomplete` and the probe returns `redirect-secret: control requests <ids> unterminated`; `hopsRedacted` is false on any `raw` or `ordinary` hop, so a delivered protected hop must be origin-only, never the raw or a substituted URL; the guarded leg expects it. Page frame trees, resource trees and navigation history are read before recovery to catch error-page leftovers. A separate structural check requires every protected `Network.Request.urlFragment` and `Page.Frame.urlFragment` to be empty or absent, even if its value contains no marker; the ordinary `#access_token` control independently requires fragment evidence in request events, frame events, frame-tree replies and resource-tree replies. The ordinary session must survive. The unguarded ordinary redirect control preserves all four headers in `redirectResponse`, ExtraInfo’s headers and `headersText`, and Fetch’s response headers. `C2.redirect-secret-mix` repeats that matrix with 301/303/307/308. The protected leg requires in-place ExtraInfo delivery with origin-only header values, not merely the absence of a marker.
 
 `C2.redirect-body` calls `Network.loadNetworkResource` on an ordinary redirect with `includeCredentials: true`, reads any stream with `IO.read`, replays a redirected XHR, requests Page resource content, and captures Page/MHTML and DOM snapshots after a main-frame redirect. It also captures an ordinary parent containing an iframe redirected to vault, including its error document, and overrides a paused ordinary Fetch request to the allowed redirect URL. No protected marker may appear in any message or body, and no request from those operations may send the independently seeded seven cookie. The ordinary control must return the body, resource content and snapshots, and accept the URL override. Its network-body carrier, `networkBodyAttempted`, `networkBodyRefused`, `hops`, `requestsTerminated` and `hopsRedacted` follow `C2.redirect-secret`. Each probe cleans up its redirect registrations, observer session and cookie. The focused Chrome tests use HTTPS with SPKI-pinned fixture trust and default-port protected URLs; host resolver rules route seven and vault to the fixture rather than the public service.
 
@@ -213,11 +216,11 @@ A client may register `Fetch.enable` patterns naming a protected origin in eithe
 - `setVersion`: the package version. The release flow stamps it into the npm package and the crate (`scripts/set-crate-version.mjs`). In git, and so in the Go module, it reads `0.0.0`; Go code gets the version from the module.
 - `targets`: the names a runner maps to a scheme, host and port: `seven`, `vault`, `vault-x` (a vault branch preview), `apex`, `own` (the client page's origin, `{client}`), `ordinary`, `ordinary-same-site`, `chrome-newtab`, `chrome-new-tab-page`, `chrome-settings`, `chrome-passwords`, `chrome-search`, `network-error`, `chrome-extension-page` and `file-root`. Each has a `description` and, for the protected ones, a default `host`. `chrome-newtab` (`chrome://newtab/`), `chrome-new-tab-page` (`chrome://new-tab-page/`), `chrome-settings` (`chrome://settings/`), `chrome-passwords` (`chrome://password-manager/`), `chrome-search` (`chrome-search://most-visited/`), `network-error` (`http://nonexistent.invalid/`), `chrome-extension-page` (a page of Chrome's built-in PDF viewer extension) and `file-root` (`file:///`) carry a `url`, which the runner uses unless `targets` maps the name to something else. No other URL in the file is one a runner must use.
 - `variants`: the detach variants in ms. `prompt` and `lagging` are documented; a runner may add others, such as `lagging-8s`, and reports the name it ran.
-- `capabilities`: what a transport may lack. `autoAttach` covers `Target.setAutoAttach`, `children` steps and child sessions; `browserSession` covers calls on the browser session; `browserContexts` covers `Target.createBrowserContext` and `Target.disposeBrowserContext`; `extensionWorld` means it can host a foreign content-script extension isolated world on the ordinary fixture; `discovery` means session-less `Target.setDiscoverTargets` and `Target.targetCreated`/`Target.targetInfoChanged` delivery; `chromeUrlsAttach` means the transport can attach to and drive `chrome://` pages. CDP over a DevTools port can; `chrome.debugger` can't, since Chrome refuses it every `chrome://` page, even with `--extensions-on-chrome-urls`.
+- `capabilities`: what a transport may lack. `autoAttach` covers `Target.setAutoAttach`, `children` steps and child sessions; `browserSession` covers calls on the browser session; `browserContexts` covers `Target.createBrowserContext` and `Target.disposeBrowserContext`; `extensionWorld` means it can host a foreign content-script extension isolated world on the ordinary fixture; `discovery` means session-less `Target.setDiscoverTargets` and `Target.targetCreated`/`Target.targetInfoChanged` delivery; `chromeUrlsAttach` means the transport can attach to and drive `chrome://` pages. CDP over a DevTools port can; `chrome.debugger` can't, since Chrome refuses it every `chrome://` page, even with `--extensions-on-chrome-urls`. `clientExit` means the harness can close the guarded client in the middle of a row: the client has `close()`, the `clientFactory` makes a fresh guarded client for the next leg, and an unguarded observer independent of the client outlives it.
 - `placeholders`: every `{name}` used in the vectors, with what it stands for. `{client}` is the client page's origin, which the runner maps.
 
 **A vector** has:
-- `id`, and `family` (`C`, `E` or `B`, the id's first letter);
+- `id`, and `family` (`C`, `E`, `B` or `X`, the id's first letter);
 - `kind`: `cdp` (runnable steps) or `text` (rows in words, which runners report as `not-run`, never `pass`);
 - `scope`: `any`, or the one guard the vector is for;
 - `setup` and `trigger`, both lists of steps;
@@ -238,7 +241,7 @@ Any `cdp`, `page` or `children` step can take `requires`, the capabilities it ne
   - `open`: `window.open` with a user gesture;
   - `iframe`: add an iframe;
   - `framed`: load the `/framed` page from `from`, with `url` in an iframe;
-  - `fetch`, `xhr`, `image`: load `url` and name the body (`width N` for an image, or `<status> <body>` with `status`); `background` doesn't wait;
+  - `fetch`, `xhr`, `image`, `script`: load `url` and name the body (`width N` for an image, `String(globalThis.vectorScript)` after a `<script src>` loads, `error` when it fails, or `<status> <body>` with `status`); `background` doesn't wait;
   - `eval`: evaluate `expression`.
   `hops` routes `url` through `/hop` on each `origin`, with its `code`.
 - `{ "answer": { "url", "stage"?, "cdp"?, "params"?, "hold"? } }`: answer each paused request or auth challenge for `url` with that call; `hold` leaves it paused. Every other paused request continues unchanged.
@@ -247,6 +250,7 @@ Any `cdp`, `page` or `children` step can take `requires`, the capabilities it ne
 - `{ "wait": ms }`.
 - `{ "paused": { "url", "ms" } }`: wait until the client has seen the pause that an `answer` rule for `url` matches (`Fetch.requestPaused` at the rule's stage, or `Fetch.authRequired` for a `Fetch.continueWithAuth` rule). It waits up to `ms`. On the control leg, a pause that never comes fails the row with `paused: no pause for <url> within <ms>ms`. On the guarded leg the guard may hide that pause, so the step waits the full `ms` and doesn't fail. The C5 guessed-id vectors and `C5.auth` use it before their second request, so the probe's interception id falls between the two ids the guess spans.
 - `{ "guess": { "between", "cdp", "params" }, "as" }`: the call for each request id between the ids paused for the two URLs.
+- `{ "client": "exit" }`: the guarded client exits. The runner calls its `close()`, waits up to 5000 ms (scaled by `settleScale`) for the page target to be no longer attached, noting in `notes` when it stays attached, attaches its unguarded observer to the page, and runs every later step of the leg through that observer. Observations still read the exited client's events. It runs only at the top level of `setup` or `trigger`, and the vector requires `clientExit`.
 - `{ "text": … }`: a step in words.
 
 Popups are observed by `Target.targetCreated` with the opener's `openerId`, or by the child's `Target.attachedToTarget`, never by the URL: a popup waiting for the debugger can still be `about:blank`.
@@ -256,6 +260,8 @@ Popups are observed by `Target.targetCreated` with the opener's `openerId`, or b
 - `/hop?code=&to=` and `/framed?src=`;
 - `/listener.js`: one line registering a window `load` listener, served with `SourceMap: /listener.js.map`;
 - `/data?n=`: `real-<n>`, with CORS;
+- `/script?n=`: a script setting `globalThis.vectorScript` to `real-<n>`;
+- `/page?k=&to=`: a trigger page whose `go()` sends the page to `to` (`k=href`, `replace`, `popup` or `form`), and `/canary/<tag>`: a document titled `canary` with the marker;
 - `/img`: a 1×1 PNG;
 - `/auth`: Basic `u`:`p`, then `authed`;
 - `/rewritten` (title `rewritten`);
@@ -325,6 +331,7 @@ It exports:
 - `observe` defines every expected name;
 - in a vector with a refusable step, every observation, except an `as` of a step before the first refusable one, has `dependsOn`, and each name in it is a refusable step's refusal name;
 - every `Target.setAutoAttach`, `children`, child-session, browser-session and browser-context step has the matching `requires`, and a vector's `requires` includes its steps' requirements; observation-only requirements can remain local;
+- a client exit step is top-level and its vector requires `clientExit`, and only a vector with a client exit step scopes a check with `exit`;
 - every `{name}` is in `placeholders`;
 - no URL uses a port from 9222 to 9229.
 
@@ -348,7 +355,7 @@ means guarded transport only; rows requiring an observer report
 `skips`, the number of skipped rows per reason, and appends
 `skips <n> (<reason>=<count>, ...)` to `line` whenever any row was skipped, so a
 certification line never reads skipped rows as coverage.
-`clientFactory({ variant, detachDelay, vector, target, slot })` is called per row
+`clientFactory({ variant, detachDelay, vector, target, slot, leg? })` is called per row
 and may return either a client or `{ client, unguarded, close, transportVariant }`.
 The factory can configure the guard's own transport delay from this metadata;
 the runner never reaches into the guard. `transportVariant: true` acknowledges
@@ -363,6 +370,15 @@ of supported names, and a capability that isn't declared is unsupported: a CDP
 transport over a DevTools port declares `chromeUrlsAttach: true`, and an
 extension on `chrome.debugger` leaves it out, so `C8.newtab` is skipped with
 `not-supported:chromeUrlsAttach`. `capabilities.scope` selects owner-specific rows; pass the same name as `guard` to `summary()`.
+A row with a client exit step needs `clientExit` declared, a `clientFactory` and an
+unguarded observer that isn't the guarded client: without the capability or the factory
+it is `skip` with `not-supported:clientExit`, and without such an observer, with
+`not-supported:unguarded-observer`, since nothing could watch the page after the exit.
+When the control leg exits, the runner calls `clientFactory` again with `leg: "guarded"`
+for the guarded leg's clients and releases them with their `close` after the row. If
+that call fails, or its observer is the client, the guarded leg is `incomplete`, with
+`clientFactory: <reason>` or `client exit: <reason>` in `incomplete`, never a pass. A
+leg whose client can't exit (it has no `close()`) fails with `client exit: <reason>`.
 
 Map `ordinary`, `ordinary-same-site`, `seven`, `vault`, `vault-x`, `apex`, `own`
 and `client` to origins. `chrome-newtab`, `chrome-new-tab-page`, `chrome-settings`, `chrome-passwords`, `chrome-search`, `network-error`, `chrome-extension-page` and `file-root` default to their `url`.
@@ -410,7 +426,9 @@ Checks include: `beacon`, `served`, `header` with
 `compare`, `refused`, `reached`, `attached`, `delivered`, `title`, `expression`,
 `hops` (each exact nested redirect URL), `detached`, `loaded`, `pre`, `blocked`,
 `history`, `frameBlocked`, `registration`, `state` and `filtered`. The diagnostic `executed` and `live`
-checks are not valid liveness proofs.
+checks are not valid liveness proofs. A `beacon`, `served` or `header` check with
+`exit: "before"` reads only the requests logged before the leg's client exit, and with
+`exit: "after"` only those logged after it; on a leg that never exited it is false.
 Compose checks with `all`, `any` or `not`. Predicates support nested partial
 objects, `$contains`, `$regex`, `$some`, nonempty `$every`, and `$encoded` with
 `{ value, prefix }` for a base64-encoded value with an optional prefix. Reads of titles and
@@ -497,7 +515,7 @@ Without `tls`, the server and logged URLs remain HTTP. It returns
 The server serves document, frame, redirect, CSP, authentication, data, image,
 canary and beacon paths. Configure host resolution in your test browser, not in
 the runner. `npm run test:guard` exercises Chromium twice with no guard, one target per
-invocation: controls must pass and guarded protection expectations must fail; the `C8.newtab` reachability control must instead pass both legs. For a single
+invocation: controls must pass and guarded protection expectations must fail; the `C8.newtab` reachability control and `X1.after-exit`, whose plain client leaves nothing behind when it exits, must instead pass both legs. For a single
 target use `GUARD_TARGET=seven npm run test:guard-target`. The fixture also serves
 `/live` image requests from stand-in documents, independently of injected code.
 
@@ -648,15 +666,15 @@ Changing a table in `slicc-cli/internal/browser` means changing `catalog.json` h
 
 ## Releases
 
-semantic-release cuts one version from `main` for all three packages (`.github/workflows/release.yml`). The maintenance branch `1.13.x` (`.releaserc.json`: range `1.13.x`, channel `release-1.13.x`) cuts `1.13.N` patches the same way; it takes only `fix:` commits, cherry-picked from `main` after they merge there, through pull requests that merge on green CI.
+semantic-release cuts one version from `main` for all three packages (`.github/workflows/release.yml`).
 1. The tag `vX.Y.Z` and a GitHub release are the Go module's release. `scripts/major-guard.mjs` fails the release when the major doesn't fit the module path in `go.mod` (no suffix allows v0 and v1, `/vN` only vN). The workflow then asks `proxy.golang.org` for the new version and `pkg.go.dev` to fetch it; both only warn.
-2. **npm:** with the repository variable `SLICC_BROWSERS_NPM_PUBLISH` set to `true`, the package is stamped with the version and published through npm trusted publishing (OIDC, with provenance). A version that is already on npm is skipped. `scripts/dist-tag.mjs <version> <ref> <latest>` picks the dist-tag: `latest` for a run from `main` whose version is not below the current `latest`, otherwise `release-X.Y.x`; a run from `main` fails when it cannot read `latest`. So a `1.13.x` release publishes to `release-1.13.x` and never moves `latest`. The GitHub release of a maintenance version is not marked latest, and the Go proxy and crates.io order by version.
+2. **npm:** with the repository variable `SLICC_BROWSERS_NPM_PUBLISH` set to `true`, the package is stamped with the version and published through npm trusted publishing (OIDC, with provenance). A version that is already on npm is skipped. It goes out on the `latest` dist-tag without `--tag`, so npm refuses a version below the current `latest`.
 3. **crates.io:** with the repository variable `SLICC_BROWSERS_CRATES_PUBLISH` set to `true`, `Cargo.toml` is stamped with the version and `cargo publish` runs with a short-lived token from crates.io trusted publishing (`rust-lang/crates-io-auth-action`). A version that is already on crates.io is skipped.
 4. **Cert line:** after the npm publish, the workflow runs `npm pack @ai-ecoverse/slicc-browsers@X.Y.Z` against the registry and appends `cert: @ai-ecoverse/slicc-browsers@X.Y.Z sha256=<hex> gitHead=<sha>` to the `vX.Y.Z` GitHub release and the job summary, once; the cert lane copies it from there.
 
 GitHub sometimes rejects the push of `refs/notes/semantic-release-vX.Y.Z` with a bare `(failed)` right after the tag push; no ruleset covers `refs/notes/*`. The semantic-release step runs with `pipefail` and puts `scripts/git-retry.mjs` first on `PATH` as `git`: it runs the real git (`REAL_GIT`) and retries a push of a `refs/notes/` ref up to five times, 5, 10, 15 and 20 seconds apart; any other git command runs once. When semantic-release still fails, the job fails before npm and crates.io publish. Recover without moving the tag: create the GitHub release on the existing tag, then run `gh workflow run release.yml --ref main -f tag=vX.Y.Z`. A tag without its note counts as on the default channel (semantic-release reads a missing note as `channels: [null]`), so the next release builds on it. `test/integration/git-retry.test.mjs` tests the retry with a fake git.
 
-A run started by hand publishes what's missing without a new release: `gh workflow run release.yml --ref main` when `main`'s head has its tag, or `gh workflow run release.yml --ref main -f tag=vX.Y.Z` for any existing tag. `gh workflow run release.yml --ref main -f cert-only=true` only adds the cert line for the latest npm version. On the maintenance line, use `--ref 1.13.x -f tag=v1.13.N`.
+A run started by hand publishes what's missing without a new release: `gh workflow run release.yml --ref main` when `main`'s head has its tag, or `gh workflow run release.yml --ref main -f tag=vX.Y.Z` for any existing tag. `gh workflow run release.yml --ref main -f cert-only=true` only adds the cert line for the latest npm version.
 
 **Go module versions.** A pushed tag is the release: `proxy.golang.org` caches it and `sum.golang.org` records its hash for good. Never move or delete a pushed tag; retract a bad version in `go.mod` and release anew. A `BREAKING CHANGE` needs a `/vN` module path first.
 

package/guard-runner.mjs

@@ -105,6 +105,9 @@ function pageExpression(step, url) {
     case 'image':
       expression = `new Promise(resolve=>{const i=new Image();i.onload=()=>resolve('width '+i.naturalWidth);i.onerror=()=>resolve('error');i.src=${q(url)};})`;
       break;
+    case 'script':
+      expression = `new Promise(resolve=>{const s=document.createElement('script');s.onload=()=>resolve(String(globalThis.vectorScript));s.onerror=()=>resolve('error');s.src=${q(url)};document.head.append(s);})`;
+      break;
     default:
       throw new Error(`Unknown page kind: ${step.page}`);
   }
@@ -148,6 +151,34 @@ class Execution {
     this.stopped = false;
   }
 
+  actor() {
+    return this.exitedTo ?? this.client;
+  }
+
+  async exit() {
+    const gone = this.client;
+    if (typeof gone.close !== 'function') throw new Error('the guarded client has no close()');
+    this.exitRequestStart = (await this.options.fixture.log()).length;
+    this.clients.exited = true;
+    await gone.close();
+    const released = await this.poll(async () => {
+      const read = await outcome(
+        this.reader.send('Target.getTargetInfo', { targetId: this.pageTarget })
+      );
+      return read.ok && read.result.targetInfo?.attached === false;
+    }, 5000);
+    if (!released)
+      this.notes.push(`client exit: the page stayed attached for ${this.bound(5000)}ms`);
+    const { sessionId } = await this.reader.send('Target.attachToTarget', {
+      targetId: this.pageTarget,
+      flatten: true,
+    });
+    await this.reader.send('Page.enable', {}, sessionId);
+    this.exitedTo = this.reader;
+    this.sessions.page = sessionId;
+    return { sessionId, released };
+  }
+
   session(kind) {
     if (kind === 'browser') return undefined;
     return this.sessions[kind === 'child' ? 'child' : 'page'];
@@ -642,6 +673,7 @@ class Execution {
       (key) => step[key]
     );
     if (probe && !out.ok) this.errors.push(`${probe}: ${out.error?.message ?? 'probe failed'}`);
+    if (step.client && !out.ok) this.errors.push(`client exit: ${out.error.message}`);
     if (['errorPage', 'redirectSecret'].includes(probe) && out.ok && out.result?.incomplete)
       this.incomplete.push(`${probe}: ${out.result.incomplete}`);
     if (step.as && !out.result?.pending) this.calls[step.as] = out;
@@ -693,6 +725,7 @@ class Execution {
       await this.settle(step.settle);
       return;
     }
+    if (step.client) return outcome(this.exit());
     if (step.redirectSecret) {
       this.internalSessions.add(session);
       try {
@@ -707,6 +740,7 @@ class Execution {
             fixture: this.options.fixture,
             mode: step.redirectSecret,
             side: this.side,
+            settleScale: this.scale,
             controls: (this.clients.redirectSecretControls ??= {}),
           })
         );
@@ -793,7 +827,7 @@ class Execution {
             (await this.requestCheck({ served: this.actionDestination }, this.actionRequestStart)))
         );
       if (settle.title) return this.check({ title: settle.title, session: settle.session });
-      const events = this.client.events.slice(this.actionEventStart);
+      const events = this.actor().events.slice(this.actionEventStart);
       return events.some(
         (event, index) =>
           event.method === 'Page.frameNavigated' &&
@@ -850,7 +884,7 @@ class Execution {
       session === undefined
     )
       params.browserContextId = this.vars.context;
-    const out = await outcome(this.client.send(step.cdp, params, session));
+    const out = await outcome(this.actor().send(step.cdp, params, session));
     if (step.cdp === 'Target.setAutoAttach' && out.ok) {
       if (params.autoAttach) this.attachSettings.set(session, true);
       else this.attachSettings.delete(session);
@@ -873,7 +907,8 @@ class Execution {
   }
 
   async page(step, session, phase) {
-    this.actionEventStart = this.client.events.length;
+    const client = this.actor();
+    this.actionEventStart = client.events.length;
     this.actionRequestStart = (await this.options.fixture.log()).length;
     this.actionDestination = step.hops ? step.url : undefined;
     const url = step.hops ? hop(step.hops, step.url) : step.url;
@@ -885,7 +920,7 @@ class Execution {
       const tab = await this.create(
         url,
         step.context ?? this.vars.context,
-        this.client,
+        client,
         step.background ?? true
       );
       this.sessions.page = tab.sessionId;
@@ -894,20 +929,20 @@ class Execution {
     }
     if (pre && step.page !== 'framed') this.preSent.push(url);
     if (step.page === 'navigate') {
-      if (pre) await this.evaluate(pre, session);
-      return this.navigate(this.client, session, url);
+      if (pre) await this.evaluate(pre, session, client);
+      return this.navigate(client, session, url);
     }
     if (step.page === 'framed') {
       if (phase === 'trigger') this.preSent.push(url);
       return this.navigate(
-        this.client,
+        client,
         session,
         `${step.from}/framed?tag=${encodeURIComponent(this.vars.tag)}&url=${encodeURIComponent(url)}&log=${encodeURIComponent(this.vars.log)}`
       );
     }
     let expression = pageExpression(step, url);
     if (pre) expression = `(() => { ${pre} return (${expression}); })()`;
-    const promise = this.evaluate(expression, session);
+    const promise = this.evaluate(expression, session, client);
     if (step.background) {
       const done = promise.then((out) => {
         if (typeof step.as === 'string') this.calls[step.as] = out;
@@ -1127,7 +1162,12 @@ class Execution {
   }
 
   async requestCheck(c, start = this.requestStart) {
-    const logs = (await this.options.fixture.log()).slice(start);
+    if (c.exit && this.exitRequestStart === undefined) return false;
+    const all = await this.options.fixture.log();
+    const logs = all.slice(
+      c.exit === 'after' ? this.exitRequestStart : start,
+      c.exit === 'before' ? this.exitRequestStart : all.length
+    );
     if (c.hops)
       return c.hops.every((_, i) =>
         logs.some((entry) => entry?.url === hop(c.hops.slice(i), c.to))
@@ -1294,6 +1334,15 @@ const inactive = (vector, target, capabilities) =>
   inapplicable(vector, target, capabilities.scope) || !supported(vector.requires, capabilities);
 
 const allSteps = (list) => list.flatMap((step) => [step, ...allSteps(step.children ?? [])]);
+const exitsClient = (vector) =>
+  [...(vector.setup ?? []), ...(vector.trigger ?? [])].some((step) => step.client === 'exit');
+const skipRow = (base, reason) => ({
+  ...base,
+  control: 'skip',
+  guarded: 'skip',
+  live: 'skip',
+  reason,
+});
 const browserContextStep = (vector, capabilities) =>
   allSteps([...vector.setup, ...vector.trigger]).some(
     (step) =>
@@ -1510,35 +1559,16 @@ async function executeRow(job, opts, made, set, slot, index, flights) {
       live: 'skip',
       reason: 'not-supported:browserSession',
     };
-  if (needsObserver(vector) && !clients.unguarded)
-    return {
-      ...base,
-      control: 'skip',
-      guarded: 'skip',
-      live: 'skip',
-      reason: 'not-supported:unguarded-observer',
-    };
+  const observerReason = observerSkip(vector, opts, made, clients);
+  if (observerReason) return skipRow(base, observerReason);
   const legs = {};
+  const renewed = [];
   flights.add({ flight, base, clients });
   opts.onStart?.(base);
-  const sides = (async () => {
-    for (const side of ['control', 'guarded']) {
-      const vars = variables(opts.targets, target, side, slot, index);
-      const execution = new Execution(vector, side, opts, clients, vars, set.variants[variant]);
-      try {
-        legs[side] = await execution.run();
-      } catch (error) {
-        legs[side] = {
-          observed: {},
-          live: false,
-          errors: [...execution.errors, String(error.message ?? error)],
-          notes: execution.notes,
-        };
-      }
-    }
-  })();
+  const sides = runLegs({ vector, opts, clients, set, job, slot, index, legs, renewed });
   const stuck = await watch(sides, opts.rowTimeoutMs, () => view(flight, base, clients));
   for (const entry of flights) if (entry.flight === flight) flights.delete(entry);
+  await closeAll(renewed);
   if (stuck) {
     flight.abandoned = true;
     return timedOut(stuck, base, made, sides, opts);
@@ -1573,6 +1603,65 @@ async function executeRow(job, opts, made, set, slot, index, flights) {
   return row;
 }
 
+function observerSkip(vector, opts, made, clients) {
+  if (needsObserver(vector) && !clients.unguarded) return 'not-supported:unguarded-observer';
+  if (!exitsClient(vector)) return undefined;
+  if (!opts.clientFactory) return 'not-supported:clientExit';
+  if (!made.unguarded || made.unguarded === made.client) return 'not-supported:unguarded-observer';
+  return undefined;
+}
+
+async function runLegs({ vector, opts, clients, set, job, slot, index, legs, renewed }) {
+  for (const side of ['control', 'guarded']) {
+    if (clients.exited) {
+      const missing = await renew(job, opts, set, slot, clients, renewed);
+      if (missing) {
+        legs[side] = unmeasured(vector, missing);
+        continue;
+      }
+    }
+    const vars = variables(opts.targets, job.target, side, slot, index);
+    const execution = new Execution(vector, side, opts, clients, vars, set.variants[job.variant]);
+    try {
+      legs[side] = await execution.run();
+    } catch (error) {
+      legs[side] = {
+        observed: {},
+        live: false,
+        errors: [...execution.errors, String(error.message ?? error)],
+        notes: execution.notes,
+      };
+    }
+  }
+}
+
+async function closeAll(closers) {
+  for (const close of closers) await close?.();
+}
+
+async function renew(job, opts, set, slot, clients, renewed) {
+  clients.exited = false;
+  const factory = await factoryClients(opts, set, { ...job, leg: 'guarded' }, slot);
+  if (!factory.ok) return `clientFactory: ${factory.error.message}`;
+  const fresh = normalize(factory.result, opts);
+  renewed.push(fresh.close);
+  if (!fresh.unguarded || fresh.unguarded === fresh.client)
+    return 'client exit: the fresh client has no independent unguarded observer';
+  clients.client = tracked(fresh.client, clients.flight.calls, 'client');
+  clients.unguarded = tracked(fresh.unguarded, clients.flight.calls, 'unguarded');
+  return undefined;
+}
+
+function unmeasured(vector, reason) {
+  return {
+    observed: Object.fromEntries(Object.keys(vector.expected).map((name) => [name, 'incomplete'])),
+    live: 'incomplete',
+    errors: [],
+    notes: [],
+    incomplete: [reason],
+  };
+}
+
 function settleIncomplete(row, vector, base, legs) {
   const incomplete = ['control', 'guarded'].flatMap((side) =>
     (legs[side].incomplete ?? []).map((reason) => `${side} ${reason}`)
@@ -1675,11 +1764,25 @@ function factoryClients(opts, set, job, slot) {
             detachDelay: set.variants[job.variant],
             vector: job.vector,
             target: job.target,
+            ...(job.leg ? { leg: job.leg } : {}),
           })
         : opts.client)()
   );
 }
 
+function normalize(made, opts) {
+  const clients =
+    typeof made?.send === 'function'
+      ? {
+          client: made,
+          unguarded: opts.unguarded ?? made.unguarded,
+          transportVariant: made.transportVariant,
+        }
+      : (made ?? { client: undefined, unguarded: opts.unguarded });
+  clients.unguarded ??= opts.unguarded;
+  return clients;
+}
+
 function unmade(job, message) {
   const reason = `clientFactory: ${message}`;
   return {
@@ -1739,15 +1842,7 @@ async function runAll(set, options, flights) {
       }
       const made = factory.result;
       transport = (typeof made?.send === 'function' ? made : made?.client)?.transport ?? transport;
-      const clients =
-        typeof made?.send === 'function'
-          ? {
-              client: made,
-              unguarded: opts.unguarded ?? made.unguarded,
-              transportVariant: made.transportVariant,
-            }
-          : (made ?? { client: undefined, unguarded: opts.unguarded });
-      clients.unguarded ??= opts.unguarded;
+      const clients = normalize(made, opts);
       try {
         const stateful = [...job.vector.setup, ...job.vector.trigger].some((s) =>
           /Cookie|Storage|IndexedDB|CacheStorage/.test(s.cdp ?? '')

package/guard-vectors.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "setVersion": "1.14.10",
+  "setVersion": "1.15.1",
   "sources": [
     {
       "repo": "ai-ecoverse/slicc-cli",
@@ -21,6 +21,11 @@
       "repo": "cert lane",
       "ref": "guard-rows.md",
       "path": "E1-E6, B1-B7"
+    },
+    {
+      "repo": "ai-ecoverse/slicc-cdp",
+      "ref": "d85ac3c93d398cbadefda9fc8602f5bbd686b5c6",
+      "path": "test/integration/guard-native.test.mjs"
     }
   ],
   "targets": {
@@ -92,7 +97,8 @@
     "browserContexts": "Target.createBrowserContext and Target.disposeBrowserContext",
     "extensionWorld": "a browser hosting a foreign content-script extension isolated world on the ordinary fixture page",
     "discovery": "session-less Target.setDiscoverTargets and targetCreated/targetInfoChanged delivery; absent transports must emit neither event",
-    "chromeUrlsAttach": "attaching to and driving chrome:// pages, which CDP over a DevTools port can and chrome.debugger can't"
+    "chromeUrlsAttach": "attaching to and driving chrome:// pages, which CDP over a DevTools port can and chrome.debugger can't",
+    "clientExit": "closing the guarded client mid-row: the client has close(), the clientFactory makes a fresh guarded client for the next leg, and an independent unguarded observer outlives it"
   },
   "placeholders": {
     "target": "the target's origin; {plain} on the control",
@@ -9984,6 +9990,172 @@
         "observer": "client"
       }
     },
+    {
+      "id": "C5.script",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "setup": [
+        {
+          "text": "a plain page whose own Fetch.enable pauses every request at both stages, and fulfils the probe's script with a forged one"
+        },
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?n=fetcher-{tag}"
+        },
+        {
+          "cdp": "Fetch.enable",
+          "params": {
+            "patterns": [
+              {
+                "urlPattern": "*",
+                "requestStage": "Request"
+              },
+              {
+                "urlPattern": "*",
+                "requestStage": "Response"
+              }
+            ]
+          }
+        },
+        {
+          "answer": {
+            "url": "{target}/script?n={tag}",
+            "stage": "Request",
+            "cdp": "Fetch.fulfillRequest",
+            "params": {
+              "responseCode": 200,
+              "responseHeaders": [
+                {
+                  "name": "content-type",
+                  "value": "text/javascript"
+                },
+                {
+                  "name": "access-control-allow-origin",
+                  "value": "*"
+                }
+              ],
+              "body": "Z2xvYmFsVGhpcy52ZWN0b3JTY3JpcHQ9J2Z1bGZpbGxlZCc="
+            }
+          }
+        }
+      ],
+      "trigger": [
+        {
+          "page": "script",
+          "url": "{target}/script?n={tag}",
+          "as": "body"
+        }
+      ],
+      "targets": ["seven", "vault", "vault-x", "apex"],
+      "observe": {
+        "seen": {
+          "means": "a Fetch.requestPaused for {target}/script?n={tag} reached the client",
+          "check": {
+            "event": "Fetch.requestPaused",
+            "where": {
+              "params": {
+                "request": {
+                  "url": "{target}/script?n={tag}"
+                }
+              }
+            },
+            "observer": "client"
+          }
+        },
+        "headers": {
+          "means": "the Fetch.requestPaused for {target}/script?n={tag} carried its request headers as an object with User-Agent",
+          "check": {
+            "event": "Fetch.requestPaused",
+            "where": {
+              "params": {
+                "request": {
+                  "url": "{target}/script?n={tag}",
+                  "headers": {
+                    "$regex": "^\\{.*\"[Uu]ser-[Aa]gent\":"
+                  }
+                }
+              }
+            },
+            "observer": "client"
+          }
+        },
+        "fulfilled": {
+          "means": "body is 'fulfilled'",
+          "check": {
+            "result": "body",
+            "path": "result.result.value",
+            "equals": "fulfilled",
+            "observer": "client"
+          }
+        },
+        "answered": {
+          "means": "body is 'real-{tag}', the stand-in's own script",
+          "check": {
+            "result": "body",
+            "path": "result.result.value",
+            "equals": "real-{tag}",
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the runner's own CDP sees {target}'s document load (title, marker or URL), or the guard returned its refusal for a refusable step",
+      "control": {
+        "origin": "ordinary",
+        "via": "guard",
+        "expected": {
+          "seen": true,
+          "headers": true,
+          "fulfilled": true,
+          "answered": false
+        }
+      },
+      "expected": {
+        "seen": false,
+        "headers": false,
+        "fulfilled": false,
+        "answered": true
+      },
+      "liveCheck": {
+        "any": [
+          {
+            "loaded": "{target}/script?n={tag}",
+            "observer": "fixture"
+          },
+          {
+            "all": [
+              {
+                "pre": "{target}/script?n={tag}",
+                "observer": "fixture"
+              },
+              {
+                "any": [
+                  {
+                    "blocked": {
+                      "url": "{target}/script?n={tag}",
+                      "session": "page",
+                      "frame": false
+                    },
+                    "observer": "client"
+                  },
+                  {
+                    "blocked": {
+                      "url": "{target}/script?n={tag}",
+                      "session": "page",
+                      "frame": false
+                    },
+                    "observer": "unguarded"
+                  }
+                ],
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          }
+        ],
+        "observer": "client"
+      }
+    },
     {
       "id": "C5.auth",
       "family": "C",
@@ -17809,6 +17981,209 @@
         ],
         "observer": "client"
       }
+    },
+    {
+      "id": "X1.after-exit",
+      "family": "X",
+      "kind": "cdp",
+      "scope": "any",
+      "requires": ["clientExit"],
+      "setup": [
+        {
+          "text": "a plain page whose client registers an init script, an x-probe header and Fetch.enable '*' that fulfils the destination with a forged body, then loads a trigger page whose navigation into {target} is pending when the client exits"
+        },
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?n=exit-{tag}"
+        },
+        {
+          "cdp": "Page.addScriptToEvaluateOnNewDocument",
+          "params": {
+            "source": "{beacon}"
+          }
+        },
+        {
+          "cdp": "Network.setExtraHTTPHeaders",
+          "params": {
+            "headers": {
+              "x-probe": "{tag}"
+            }
+          }
+        },
+        {
+          "cdp": "Fetch.enable",
+          "params": {
+            "patterns": [
+              {
+                "urlPattern": "*"
+              }
+            ]
+          }
+        },
+        {
+          "answer": {
+            "url": "{target}/canary/{tag}",
+            "stage": "Request",
+            "cdp": "Fetch.fulfillRequest",
+            "params": {
+              "responseCode": 200,
+              "responseHeaders": [
+                {
+                  "name": "content-type",
+                  "value": "text/html"
+                }
+              ],
+              "body": "PCFkb2N0eXBlIGh0bWw+PHRpdGxlPmZvcmdlZDwvdGl0bGU+PHA+RlVMRklMTEVEPC9wPg=="
+            }
+          }
+        }
+      ],
+      "trigger": [
+        {
+          "page": "navigate",
+          "url": "{ordinary}/page?k=href&to={target}/canary/{tag}&tag={tag}"
+        },
+        {
+          "settle": {
+            "beacon": "{ordinary}",
+            "required": true
+          }
+        },
+        {
+          "client": "exit"
+        },
+        {
+          "page": "eval",
+          "expression": "go()"
+        },
+        {
+          "settle": {
+            "title": "canary",
+            "ms": 5000
+          }
+        }
+      ],
+      "targets": ["seven", "vault"],
+      "observe": {
+        "instrumented": {
+          "means": "the client's init script sent its beacon from {ordinary} before the exit",
+          "check": {
+            "beacon": "{ordinary}",
+            "exit": "before",
+            "observer": "fixture"
+          }
+        },
+        "headed": {
+          "means": "the trigger page's request carried the client's x-probe header before the exit",
+          "check": {
+            "header": "x-probe",
+            "on": "/page",
+            "exit": "before",
+            "observer": "fixture"
+          }
+        },
+        "intercepted": {
+          "means": "a Fetch.requestPaused for the trigger page reached the client before the exit",
+          "check": {
+            "event": "Fetch.requestPaused",
+            "where": {
+              "params": {
+                "request": {
+                  "url": "{ordinary}/page?k=href&to={target}/canary/{tag}&tag={tag}"
+                }
+              }
+            },
+            "observer": "client"
+          }
+        },
+        "served": {
+          "means": "the stand-in served {target}/canary/{tag} after the exit",
+          "check": {
+            "served": "{target}/canary/{tag}",
+            "exit": "after",
+            "observer": "fixture"
+          }
+        },
+        "document": {
+          "means": "the unguarded observer reads {target}'s real document, title 'canary'",
+          "check": {
+            "title": "canary",
+            "via": "unguarded",
+            "observer": "unguarded"
+          }
+        },
+        "forged": {
+          "means": "the unguarded observer reads the client's forged FULFILLED body",
+          "check": {
+            "expression": "document.body ? document.body.innerText.includes('FULFILLED') : false",
+            "equals": true,
+            "via": "unguarded",
+            "observer": "unguarded"
+          }
+        },
+        "scripted": {
+          "means": "the client's init script sent a beacon from {target} after the exit",
+          "check": {
+            "beacon": "{target}",
+            "exit": "after",
+            "observer": "fixture"
+          }
+        },
+        "probed": {
+          "means": "a request for {target}/canary/{tag} carried the client's x-probe header after the exit",
+          "check": {
+            "header": "x-probe",
+            "on": "{target}/canary/{tag}",
+            "exit": "after",
+            "observer": "fixture"
+          }
+        },
+        "paused": {
+          "means": "a Fetch.requestPaused for {target}/canary/{tag} reached the client",
+          "check": {
+            "event": "Fetch.requestPaused",
+            "where": {
+              "params": {
+                "request": {
+                  "url": "{target}/canary/{tag}"
+                }
+              }
+            },
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the stand-in serves {target}'s document after the client exits",
+      "control": {
+        "origin": "ordinary",
+        "via": "guard",
+        "expected": {
+          "instrumented": true,
+          "headed": true,
+          "intercepted": true,
+          "served": true,
+          "document": true,
+          "forged": false,
+          "scripted": false,
+          "probed": false,
+          "paused": false
+        }
+      },
+      "expected": {
+        "instrumented": true,
+        "headed": true,
+        "intercepted": true,
+        "served": true,
+        "document": true,
+        "forged": false,
+        "scripted": false,
+        "probed": false,
+        "paused": false
+      },
+      "liveCheck": {
+        "loaded": "{target}/canary/{tag}",
+        "observer": "fixture"
+      }
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-browsers",
-  "version": "1.14.10",
+  "version": "1.15.1",
   "description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
   "type": "module",
   "license": "Apache-2.0",
@@ -66,14 +66,14 @@
     "validate": "node scripts/validate.mjs",
     "lint": "slicc-lint && test -z \"$(gofmt -l .)\" && go mod tidy -diff && go vet ./... && golangci-lint run && cargo fmt --check && cargo clippy --all-features --all-targets -- -D warnings",
     "format": "biome check --write . && gofmt -w . && cargo fmt",
-    "test": "npm run validate && node --test test/integration/self-contained.test.mjs test/integration/browser-runner.test.mjs test/integration/fixture-client.test.mjs test/integration/git-retry.test.mjs test/integration/guard-redirect-carrier.test.mjs test/integration/dist-tag.test.mjs test/integration/guard-incomplete.test.mjs test/integration/guard-stall.test.mjs test/integration/guard-forged.test.mjs && go test -race -count=1 ./test/integration/... && cargo test --all-features",
+    "test": "npm run validate && node --test test/integration/self-contained.test.mjs test/integration/browser-runner.test.mjs test/integration/fixture-client.test.mjs test/integration/git-retry.test.mjs test/integration/release-line.test.mjs test/integration/guard-redirect-carrier.test.mjs test/integration/guard-incomplete.test.mjs test/integration/guard-stall.test.mjs test/integration/guard-forged.test.mjs test/integration/guard-exit-steps.test.mjs && go test -race -count=1 ./test/integration/... && cargo test --all-features",
     "test:unit": "go test -race -cover ./...",
     "build": "go build ./... && cargo build --all-features && cargo build --target wasm32-wasip1 --all-features && npm pack --dry-run",
     "trust": "npx fledgling sync -y --skip-publish",
     "trust:dry": "npx fledgling sync --dry-run -y --skip-publish",
     "release": "semantic-release",
     "test:guard": "npm run test:guard-integration && npm run test:guard-sweep",
-    "test:guard-integration": "node --test --test-concurrency=2 test/integration/guard-lifecycle.test.mjs test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs test/integration/guard-late-pause.test.mjs test/integration/guard-legs.test.mjs test/integration/guard-fetch-enable.test.mjs test/integration/guard-diagnostics.test.mjs test/integration/guard-chrome.test.mjs test/integration/guard-worlds.test.mjs test/integration/guard-world-discovery.test.mjs test/integration/guard-world-guesses.test.mjs test/integration/guard-unparseable.test.mjs test/integration/guard-redirect-secret.test.mjs test/integration/guard-error-page.test.mjs test/integration/guard-discovery.test.mjs test/integration/guard-browser-page.test.mjs test/integration/guard-scales.test.mjs test/integration/guard-shared-log.test.mjs test/integration/guard-pre-beacon.test.mjs test/integration/guard-world-pause.test.mjs test/integration/guard-parallel.test.mjs test/integration/self-contained.test.mjs",
+    "test:guard-integration": "node --test --test-concurrency=2 test/integration/guard-lifecycle.test.mjs test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs test/integration/guard-late-pause.test.mjs test/integration/guard-legs.test.mjs test/integration/guard-fetch-enable.test.mjs test/integration/guard-diagnostics.test.mjs test/integration/guard-chrome.test.mjs test/integration/guard-worlds.test.mjs test/integration/guard-world-discovery.test.mjs test/integration/guard-world-guesses.test.mjs test/integration/guard-unparseable.test.mjs test/integration/guard-redirect-secret.test.mjs test/integration/guard-error-page.test.mjs test/integration/guard-discovery.test.mjs test/integration/guard-browser-page.test.mjs test/integration/guard-scales.test.mjs test/integration/guard-shared-log.test.mjs test/integration/guard-pre-beacon.test.mjs test/integration/guard-world-pause.test.mjs test/integration/guard-parallel.test.mjs test/integration/guard-client-exit.test.mjs test/integration/self-contained.test.mjs",
     "test:guard-sweep": "node scripts/test-guards.mjs",
     "test:gates": "node --test test/integration/gates.test.mjs",
     "test:guard-target": "node --test test/integration/guard-runner.test.mjs",
@@ -81,7 +81,7 @@
     "test:unit:guard": "mkdir -p coverage/unit && node --experimental-vm-modules --no-warnings --experimental-test-coverage --test --test-coverage-include=guard-runner.mjs --test-coverage-include=fixture-server.mjs --test-coverage-include=fixture-client.mjs --test-coverage-include=observer-target.mjs --test-coverage-include=protected-error-page.mjs --test-coverage-include=unparseable-url.mjs --test-coverage-include=scripts/browser-runner.mjs --test-coverage-include=scripts/validate.mjs --test-reporter=lcov --test-reporter-destination=coverage/unit/guard.lcov test/unit/guard-*.test.mjs && slicc-diff-cover coverage/unit/guard.lcov"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-shared-web": "2.4.0",
+    "@ai-ecoverse/slicc-shared-web": "2.4.5",
     "@biomejs/biome": "2.5.15",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",

package/redirect-secret.mjs

@@ -92,6 +92,7 @@ class RedirectProbe {
     this.learned = { network: new Set(), fetch: new Set(), tap: new Set() };
     this.registrations = [];
     this.seen = new Map();
+    this.scale = this.settleScale ?? 1;
     this.protectedURLs = [
       `https://seven.sliccy.ai/auth/callback?code=${encodeURIComponent(this.marker)}&state=${encodeURIComponent(this.marker)}`,
       `https://vault.sliccy.ai/oauth/mcp-callback?code=${encodeURIComponent(this.marker)}`,
@@ -215,31 +216,69 @@ class RedirectProbe {
     };
   }
 
-  hops(events) {
+  requests(events, match = (url) => url?.startsWith(this.prefix)) {
     const own = events.filter((event) => event.sessionId === this.session);
     const seen = new Set(
       own
         .filter(
           (event) =>
             event.method === 'Network.requestWillBeSent' &&
-            (event.params.redirectResponse
-              ? event.params.redirectResponse.url?.startsWith(this.prefix)
-              : event.params.request?.url?.startsWith(this.prefix))
+            match(
+              event.params.redirectResponse
+                ? event.params.redirectResponse.url
+                : event.params.request?.url
+            )
         )
         .map((event) => event.params.requestId)
     );
-    const protectedOrigins = this.protectedURLs.map((url) => new URL(url).origin);
-    const hops = Object.fromEntries(
-      [...seen].map((requestId) => {
-        const mine = own.filter((event) => event.params?.requestId === requestId);
-        const hop = mine.find(
+    return [...seen].map((requestId) => {
+      const mine = own.filter((event) => event.params?.requestId === requestId);
+      return {
+        requestId,
+        hop: mine.find(
           (event) =>
             event.method === 'Network.requestWillBeSent' &&
-            event.params.redirectResponse?.url?.startsWith(this.prefix)
-        );
-        const end = mine.find((event) =>
+            match(event.params.redirectResponse?.url)
+        ),
+        end: mine.find((event) =>
           ['Network.loadingFinished', 'Network.loadingFailed'].includes(event.method)
-        );
+        ),
+      };
+    });
+  }
+
+  open(events, match) {
+    return this.requests(events, match).filter(({ hop, end }) => !hop && !end);
+  }
+
+  async land(url, start) {
+    const path = new URL(url).pathname;
+    await pause(250);
+    if (this.stalled) return;
+    const landed = await waitFor(
+      async () =>
+        (await this.fixture.log()).some((entry) => entry.url.includes(path)) &&
+        !this.open(this.client.events.slice(start), (seen) => seen === url).length,
+      Math.round(2000 * this.scale),
+      50
+    );
+    this.stalled = !landed && this.side === 'guarded';
+  }
+
+  async terminated() {
+    await waitFor(
+      () => !this.open(this.client.events.slice(this.eventsStart)).length,
+      Math.round(5000 * this.scale),
+      50
+    );
+    await waitFor(() => this.cursor >= this.client.events.length, 1000, 5);
+    await this.settle();
+  }
+
+  hops(events) {
+    const protectedOrigins = this.protectedURLs.map((url) => new URL(url).origin);
+    const hops = Object.fromEntries(
+      this.requests(events).map(({ requestId, hop, end }) => {
         const url = hop?.params.request?.url ?? '';
         const origin = protectedOrigins.find((value) => url.startsWith(value));
         return [
@@ -260,13 +299,25 @@ class RedirectProbe {
       })
     );
     const deliveries = Object.values(hops).map((entry) => entry.delivery);
+    const open = Object.keys(hops).filter((id) => hops[id].delivery === 'unterminated');
+    const missing = open.length > 0 && this.side === 'control';
     return {
       hops,
-      requestsTerminated: !deliveries.includes('unterminated'),
+      requestsTerminated: missing ? 'incomplete' : !open.length,
+      ...(missing
+        ? { incomplete: `redirect-secret: control requests ${open.join(', ')} unterminated` }
+        : {}),
       hopsRedacted: !deliveries.some((delivery) => ['raw', 'ordinary'].includes(delivery)),
     };
   }
 
+  legs(events) {
+    const network = this.networkLeg();
+    const hops = this.hops(events);
+    const incomplete = [network.incomplete, hops.incomplete].filter(Boolean).join('; ');
+    return { ...network, ...hops, ...(incomplete ? { incomplete } : {}) };
+  }
+
   async register(key, to, code = 302) {
     const url = `${this.ordinary}/redirect-secret/${this.tag}-${key}`;
     const path = new URL(url).pathname;
@@ -339,6 +390,7 @@ class RedirectProbe {
       for (const kind of ['navigate', 'href', 'fetch', 'xhr']) {
         const code = this.mode === 'mix' ? [301, 303, 307, 308][index] : 302;
         const url = await this.register(`${index}-${kind}`, to, code);
+        const start = this.client.events.length;
         if (kind === 'navigate') await this.send('Page.navigate', { url });
         else {
           await this.reset();
@@ -350,7 +402,7 @@ class RedirectProbe {
                 : this.xhrExpression(url);
           await this.send('Runtime.evaluate', { expression });
         }
-        await pause(250);
+        await this.land(url, start);
         await this.send('Page.getFrameTree');
         await this.send('Page.getResourceTree');
         await this.send('Page.getNavigationHistory');
@@ -487,6 +539,7 @@ class RedirectProbe {
       returnByValue: true,
     });
     await this.settle();
+    await this.terminated();
     const tapped = `"sessionId":"${this.observer}"`;
     const events = this.client.events
       .slice(this.eventsStart)
@@ -536,8 +589,7 @@ class RedirectProbe {
       sessionSurvives: survives.ok && survives.result?.result?.value === 'doc',
       fetchBodyAttempted: fetchAttempts.length > 0,
       fetchBodyRefused: fetchAttempts.length > 0 && fetchAttempts.every(refused),
-      ...this.networkLeg(),
-      ...this.hops(events),
+      ...this.legs(events),
       extraInPlace,
       ...redirectFragments({
         messages,

package/schema/guard-vectors.schema.json

@@ -87,7 +87,8 @@
         "browserContexts",
         "chromeUrlsAttach",
         "extensionWorld",
-        "discovery"
+        "discovery",
+        "clientExit"
       ],
       "properties": {
         "autoAttach": {
@@ -107,7 +108,8 @@
         "chromeUrlsAttach": {
           "type": "string",
           "minLength": 1
-        }
+        },
+        "clientExit": { "type": "string", "minLength": 1 }
       }
     },
     "placeholders": {
@@ -136,7 +138,8 @@
         "browserContexts",
         "chromeUrlsAttach",
         "extensionWorld",
-        "discovery"
+        "discovery",
+        "clientExit"
       ]
     },
     "requires": {
@@ -233,10 +236,10 @@
       "properties": {
         "id": {
           "type": "string",
-          "pattern": "^[CEB][1-9](\\.[A-Za-z0-9-]+)*$"
+          "pattern": "^[CEBX][1-9](\\.[A-Za-z0-9-]+)*$"
         },
         "family": {
-          "enum": ["C", "E", "B"]
+          "enum": ["C", "E", "B", "X"]
         },
         "kind": {
           "enum": ["cdp", "text"]
@@ -482,6 +485,14 @@
             }
           }
         },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["client"],
+          "properties": {
+            "client": { "const": "exit" }
+          }
+        },
         {
           "type": "object",
           "additionalProperties": false,
@@ -561,6 +572,7 @@
                 "fetch",
                 "xhr",
                 "image",
+                "script",
                 "eval"
               ]
             },
@@ -805,6 +817,9 @@
             },
             "observer": {
               "const": "fixture"
+            },
+            "exit": {
+              "enum": ["before", "after"]
             }
           }
         },
@@ -824,6 +839,9 @@
             },
             "tagged": {
               "type": "boolean"
+            },
+            "exit": {
+              "enum": ["before", "after"]
             }
           }
         },
@@ -843,6 +861,9 @@
             },
             "observer": {
               "const": "fixture"
+            },
+            "exit": {
+              "enum": ["before", "after"]
             }
           }
         },