@ai-ecoverse/slicc-browsers 1.16.0 → 1.16.2

package/README.md

@@ -187,7 +187,7 @@ Every CDP guard runs the vectors in `guard-vectors.json` (schema `schema/guard-v
 - the `C8` rows for privileged pages: `C8.navigate` (a page navigates to `chrome://settings`, `chrome://password-manager`, an extension page or `file:///`; refused), `C8.view-source` (the same through `view-source:`; refused), `C8.create` (`Target.createTarget` straight on those pages; refused), `C8.browser-ui-listed` (`Target.getTargets` lists no `browser_ui` target) and `C8.browser-ui-attach` (`Target.attachToTarget` by a `browser_ui` target's id; refused). All five have an unguarded control, since the guard refuses them only on the privileged target. Two cases aren't rows, because Chrome itself blocks them, so an unguarded client can't tell a guard from none: a page's `window.open('chrome://settings')`, and an `about:` alias such as `about:settings`, which `Page.navigate` and `Target.createTarget` both turn into `about:blank#blocked`. The `about:` aliases are in `protected.json` instead.
 - slicc-cdp's owner vectors in `test/integration/guard-native.test.mjs` at `d85ac3c`: `C5.script`, a protected script subresource under the client's own `Fetch.enable` `*` at both stages (the guard neither pauses it for the client nor lets the client fulfil it, and the page runs the stand-in's real `/script`, while the control's paused request carries its headers as an object with `User-Agent` and runs the forged script), and `X1.after-exit`, the client lifecycle row below.
 
-`X1.after-exit` (family `X`, client lifecycle) needs `clientExit`. Through the guard, the client opens an ordinary tab, registers `Page.addScriptToEvaluateOnNewDocument` with `{beacon}`, `Network.setExtraHTTPHeaders` with `x-probe: {tag}` and `Fetch.enable` `*` with a rule that fulfils the destination with a forged `FULFILLED` page, then loads the `/page` trigger whose `go()` navigates to `{target}/canary/{tag}`. Before the exit it must see its init-script beacon, its header on the trigger request and the trigger's `Fetch.requestPaused`: those are the positive evidence on both legs. Then the client exits, the unguarded observer calls `go()`, and the destination must be served and read as the real `canary` document, with no beacon from `{target}`, no `x-probe` on its request, no forged body and no `Fetch.requestPaused` for it reaching the client: nothing the client registered may outlive it. The control runs the same on `{plain}` through the guard, and expects the same, since an ordinary navigation after the exit must be just as clean. A guard that keeps its upstream session, or its own init scripts, headers or interception, past the client's exit fails the row.
+`X1.after-exit` (family `X`, client lifecycle) needs `clientExit`. Through the guard, the client opens an ordinary tab, registers `Page.addScriptToEvaluateOnNewDocument` with `{beacon}`, `Network.setExtraHTTPHeaders` with `x-probe: {tag}` and `Fetch.enable` `*` with a rule that fulfils the destination with a forged `FULFILLED` page, then loads the `/page?k=href&tag={tag}&to={target}/canary/{tag}` trigger whose `go()` navigates to `{target}/canary/{tag}`. Before the exit it must see its init-script beacon, its header on the trigger request and the trigger's `Fetch.requestPaused`, matched up to `&to=`, so a guard that redacts the embedded protected URL to its origin still matches: those are the positive evidence on both legs. Then the client exits, the unguarded observer calls `go()`, and the destination must be served and read as the real `canary` document, with no beacon from `{target}`, no `x-probe` on its request, no forged body and no `Fetch.requestPaused` for it reaching the client: nothing the client registered may outlive it. The control runs the same on `{plain}` through the guard, and expects the same, since an ordinary navigation after the exit must be just as clean. A guard that keeps its upstream session, or its own init scripts, headers or interception, past the client's exit fails the row.
 
 The `C9` foreign extension isolated-world family requires `extensionWorld`: a browser hosting a foreign content-script extension on the ordinary fixture page. `C9.world-hidden` requires the page default context to remain visible after `Runtime.enable`, while the extension context and Runtime/Debugger identifiers remain hidden without cutting or detaching the session. `C9.world-select` probes numeric and unique context selectors, object and argument handles, promises, properties, named bindings and DOM node resolution; each command selecting the hidden world must fail with the `slicc: refused:` prefix, never an ordinary browser error. Numeric guesses also sweep ids 1–32: an id not exposed to this client must be refused, while every exposed numeric context must remain usable; none of those guarded probes may reach the fixture content-script marker. The marker combines the content script’s global lexical `root` binding with its extension-id DOM marker and `chrome.runtime.id`, and is independently required to be absent from the page default world. `C9.world-debugger` pauses inside that content script: the control must reach its frame, while the guard must refuse or hide it. The control waits up to 5000 ms (scaled by `settleScale`) for `Debugger.paused`; when it never pauses, `reachable` records `"incomplete"`, not `false`, and the row fails with `extensionWorld debugger: no Debugger.paused within <ms>ms`. The guarded leg waits up to 1500 ms, scaled by `refusalScale`. `C9.page-drivable` evaluates `self.origin`, captures a DOM snapshot and dispatches an Input click on the same ordinary page; cutting the entire session fails this regression row. All four use an unguarded control, the default browser context and observer discovery of the real extension world, not an invented isolated world. Protected default contexts remain session-cutting evidence; hiding a foreign isolated world does not weaken any seven-origin row.
 
@@ -197,6 +197,8 @@ The integration launcher loads shared-web 1.25.2’s harness extension exactly o
 
 `C2.redirect-body` calls `Network.loadNetworkResource` on an ordinary redirect with `includeCredentials: true`, reads any stream with `IO.read`, replays a redirected XHR, requests Page resource content, and captures Page/MHTML and DOM snapshots after a main-frame redirect. It also captures an ordinary parent containing an iframe redirected to vault, including its error document, and overrides a paused ordinary Fetch request to the allowed redirect URL. No protected marker may appear in any message or body, and no request from those operations may send the independently seeded seven cookie. The ordinary control must return the body, resource content and snapshots, and accept the URL override. Its network-body carrier, `networkBodyAttempted`, `networkBodyRefused`, `hops`, `requestsTerminated` and `hopsRedacted` follow `C2.redirect-secret`. Each probe cleans up its redirect registrations, observer session and cookie. The focused Chrome tests use HTTPS with SPKI-pinned fixture trust and default-port protected URLs; host resolver rules route seven and vault to the fixture rather than the public service.
 
+Every C2 redirect probe reports `sessionEnded`. It becomes true when the guarded client’s session ends during the probe: a `Target.detachedFromTarget` for that session, or a CDP reply that the session is closed or not found, or that the target, websocket or transport is closed. `Inspected target navigated or closed` is an ordinary reply on a live session, not a session end. When an expected Fetch pause or XHR event is missing, the probe sends one `Runtime.evaluate` to check that the session is still alive. Once the session has ended, the probe sends nothing more on it, skips the eight-second tail and the termination wait, and evaluates what the client received before the end. `secretHidden`, `protectedBodyHidden`, `cookieHidden`, `fragmentsHidden` and `hopsRedacted` are measured on those messages, replies, bodies and fixture logs, so a guard that leaked before the end still fails them. A clean end passes them. `sessionSurvives` reads false. Checks that need evidence from after the end read `incomplete`, with `redirect-secret: session ended (<how>)` in the probe’s `incomplete`. If the end cuts the probe’s action matrix short, or leaves any body read pending or unanswered, then `fetchBodyAttempted`, `fetchBodyRefused` and the network-body leg read `incomplete`, even after some refused reads. Any answer that isn’t a refusal still fails its refusal check. `requestsTerminated` reads `incomplete` when requests are unterminated or the matrix was cut short. A short but origin-only `extraLocation` reads `incomplete`. So does each attempt or override check whose command never reached the client: it wasn’t sent because the session had already ended, or its reply was the session end. On the unguarded control, a session end is an error: the probe throws `redirect-secret: control session ended (<how>)`.
+
 `C8.unparseable` probes both raw and canonical space/U+200D/invalid-punycode URLs through creation and navigation. Every guarded destination needs a matched refusal. Its unguarded controls record `document` or `native-rejection` outcomes, including Chrome builds that reject raw U+200D instead of committing it. Both raw and encoded-space forms must commit real fixture documents, because that is the proven cookie leak. An independent observer loads the encoded-space document and confirms it shares a uniquely seeded `.sliccy.ai` cookie; the guarded client must neither list nor attach to it, read its cookie, query that cookie by URL, nor cause a cookie-bearing destination request. The guard does not erase the observer’s private browser state. The row runs on both browser-session and page-session-only transports, uses the default context, and cleans up its own targets and cookie. Cookie seeding always uses the unguarded observer’s browser session, never the guarded client. Only guarded browser-session target listing requires `browserSession`; without it, `listed` records `not-supported` explicitly in probe and observation evidence, and the result lists that field in `notSupported`. Creation, navigation, attachment and `Network.getCookies` with `urls` still require matched refusals; filtering cookies without refusing fails `cookieRefused`. Fixture URLs omit the colon when the port is empty, and reported URLs are compared after canonicalisation, including Chrome’s WHATWG-unparseable encoded-space hosts. Launchers must resolve the raw/canonical space, U+200D/punycode and invalid-punycode `.sliccy.ai` fixture hosts to the fixture server, including for default-port HTTP or HTTPS origins. The HTTP fixture accepts Chrome’s encoded-space Host header without reparsing it as a WHATWG origin.
 
 `C8.chrome-search` requests `chrome-search://most-visited/` through `Page.navigate` and requires an explicit guard refusal. Its unguarded control requires a CDP response, not a successful document commit: Chrome can answer with `errorText` when that internal data source is unavailable outside an Instant process. Browser-side load failure is not a guard refusal, and merely hiding the target must fail this row.
@@ -207,7 +209,7 @@ The `C8.newtab` reachability control attaches through the guard to a settled ord
 
 `C8.network-error` and `C8.iframe-error` are ordinary-error reachability controls: request the configured `network-error` URL (default `http://nonexistent.invalid/`) directly or in an ordinary iframe, observe a failed Document request, reattach to the settled tab, evaluate and snapshot its document, then navigate the same tab to an ordinary document. Both control and guarded legs must pass. The failing URL is unchanged on the control, rather than replaced with a healthy origin, and the rows require `browserSession` but not `chromeUrlsAttach`. With Chrome for Testing 156.0.8078.4, scheme-wide `chrome-error` protection made the direct-error row fail both legs because reattachment was refused; removing it passed both rows, with readable DOM and successful recovery. The old emulator still allowed the cross-process iframe parent because the iframe TargetInfo kept the failing HTTP URL, but that layout-specific behavior is not grounds for protecting the error scheme. Plain-client controls and reachability legs also passed both rows.
 
-`E4` and the `E6` rows are runnable, each with a guarded-through control on the ordinary origin that must show the effect. `E4` sets a `Debugger.setBreakpointByUrl` on line 0 of the `listener=1` document's `/listener.js?n=<tag>` with a condition that sends `{beacon}` and returns `false`; the control needs that beacon, and the guarded leg needs neither the beacon nor a `Debugger.paused` in the protected document. `E4.instrumentation` sets `Debugger.setInstrumentationBreakpoint` with `beforeScriptWithSourceMapExecution`, so only `/listener.js`, whose `SourceMap` header names a source map, pauses: `beforeScriptExecution` would also pause the runner's own `Runtime.evaluate` and any extension's content script first. `E4.event-listener` sets `DOMDebugger.setEventListenerBreakpoint` for `load`. Both set up before the trigger, need a `Debugger.paused` on the control (in `/listener.js`, or for `E4.event-listener` with `listener:load`, which only that document registers, since a listener pause reports no script URL), none on the guarded leg, and end with `Debugger.disable` to resume. The `E6` overrides are set on the page session before the trigger: `E6.headers` (`x-probe`), `E6.ua-network` and `E6.ua-emulation` (`User-Agent: slicc-probe-<tag>`) and `E6.cache-disabled` (`Pragma: no-cache`) are read from the stand-in's request log; `E6.network-conditions` (1500 ms latency) needs a navigation `duration` of at least 1000 ms, since Chrome delays the body rather than `responseStart`; `E6.locale` (`fr-CH`), `E6.timezone` (`Pacific/Chatham`) and `E6.network-state` (`navigator.onLine` false) are read by the unguarded observer in the destination document, and `E6.network-state` starts on `{cross}`, because Chrome drops that override on a same-site navigation once a second session is attached to the page. A guard that keeps its own session on the page, as the test emulator's Fetch shield does, can still lose it, and then fails that control rather than passing it; `E6.blocked-urls` has the observer fetch a blocked `/data` subresource there. Observer reads first check that the page is the exact destination URL, so a blocked or replaced document never shows the effect. The five overrides Chrome also applies inside a cross-site iframe have an `.iframe` row, triggered through `/framed`; `E6.network-conditions.iframe` reads the iframe's `duration` from the parent's resource timing. Each override is refusable at registration, with its observation depending on that refusal. These rows settle on the destination's load or request rather than on the detach variant, because each effect lands when the request is made or the script runs.
+`E4` and the `E6` rows are runnable, each with a guarded-through control on the ordinary origin that must show the effect. `E4` sets a `Debugger.setBreakpointByUrl` on line 0 of the `listener=1` document's `/listener.js?n=<tag>` with a condition that sends `{beacon}` and returns `false`; the control needs that beacon, and the guarded leg needs neither the beacon nor a `Debugger.paused` in the protected document. `E4.instrumentation` sets `Debugger.setInstrumentationBreakpoint` with `beforeScriptWithSourceMapExecution`, so only `/listener.js`, whose `SourceMap` header names a source map, pauses: `beforeScriptExecution` would also pause the runner's own `Runtime.evaluate` and any extension's content script first. `E4.event-listener` sets `DOMDebugger.setEventListenerBreakpoint` for `load`. Both set up before the trigger, need a `Debugger.paused` on the control (in `/listener.js`, or for `E4.event-listener` with `listener:load`, which only that document registers, since a listener pause reports no script URL), none on the guarded leg, and end with `Debugger.resume` and then `Debugger.disable` on the page session: Chrome doesn't answer `Debugger.disable` while the page sits in a pause, so a client that never times calls out would hang there. The resume can't hide a pause, since the `Debugger.paused` it ends was already seen, and every call in these rows must answer before the client's call timeout. The `E6` overrides are set on the page session before the trigger: `E6.headers` (`x-probe`), `E6.ua-network` and `E6.ua-emulation` (`User-Agent: slicc-probe-<tag>`) and `E6.cache-disabled` (`Pragma: no-cache`) are read from the stand-in's request log; `E6.network-conditions` (1500 ms latency) needs a navigation `duration` of at least 1000 ms, since Chrome delays the body rather than `responseStart`; `E6.locale` (`fr-CH`), `E6.timezone` (`Pacific/Chatham`) and `E6.network-state` (`navigator.onLine` false) are read by the unguarded observer in the destination document, and `E6.network-state` starts on `{cross}`, because Chrome drops that override on a same-site navigation once a second session is attached to the page. A guard that keeps its own session on the page, as the test emulator's Fetch shield does, can still lose it, and then fails that control rather than passing it; `E6.blocked-urls` has the observer fetch a blocked `/data` subresource there. Observer reads first check that the page is the exact destination URL, so a blocked or replaced document never shows the effect. The five overrides Chrome also applies inside a cross-site iframe have an `.iframe` row, triggered through `/framed`; `E6.network-conditions.iframe` reads the iframe's `duration` from the parent's resource timing. Each override is refusable at registration, with its observation depending on that refusal. These rows settle on the destination's load or request rather than on the detach variant, because each effect lands when the request is made or the script runs.
 
 A client may register `Fetch.enable` patterns naming a protected origin in either of two conformant ways: the guard allows registration but never pauses or forwards protected requests to the client and refuses continue, fulfil or fail calls for request ids it did not hand out; or the guard refuses registration with its declared refusal text. Setup calls explicitly naming a protected placeholder are refusable with `refusal.onlyProtected: true`, and interception-dependent observations depend on that refusal. Wildcard and ordinary-only patterns do not receive this exemption. The ordinary-origin control still runs through the guard and must succeed.
 

package/guard-vectors.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "setVersion": "1.16.0",
+  "setVersion": "1.16.2",
   "sources": [
     {
       "repo": "ai-ecoverse/slicc-cli",
@@ -14967,6 +14967,9 @@
         {
           "wait": 2000
         },
+        {
+          "cdp": "Debugger.resume"
+        },
         {
           "cdp": "Debugger.disable"
         }
@@ -15121,6 +15124,9 @@
         {
           "wait": 2000
         },
+        {
+          "cdp": "Debugger.resume"
+        },
         {
           "cdp": "Debugger.disable"
         }
@@ -18041,7 +18047,7 @@
       "trigger": [
         {
           "page": "navigate",
-          "url": "{ordinary}/page?k=href&to={target}/canary/{tag}&tag={tag}"
+          "url": "{ordinary}/page?k=href&tag={tag}&to={target}/canary/{tag}"
         },
         {
           "settle": {
@@ -18089,7 +18095,9 @@
             "where": {
               "params": {
                 "request": {
-                  "url": "{ordinary}/page?k=href&to={target}/canary/{tag}&tag={tag}"
+                  "url": {
+                    "$regex": "^{ordinary}/page\\?k=href&tag={tag}&to="
+                  }
                 }
               }
             },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-browsers",
-  "version": "1.16.0",
+  "version": "1.16.2",
   "description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
   "type": "module",
   "license": "Apache-2.0",
@@ -66,7 +66,7 @@
     "validate": "node scripts/validate.mjs",
     "lint": "slicc-lint && test -z \"$(gofmt -l .)\" && go mod tidy -diff && go vet ./... && golangci-lint run && cargo fmt --check && cargo clippy --all-features --all-targets -- -D warnings",
     "format": "biome check --write . && gofmt -w . && cargo fmt",
-    "test": "npm run validate && node --test test/integration/self-contained.test.mjs test/integration/browser-runner.test.mjs test/integration/fixture-client.test.mjs test/integration/git-retry.test.mjs test/integration/release-line.test.mjs test/integration/guard-redirect-carrier.test.mjs test/integration/guard-incomplete.test.mjs test/integration/guard-stall.test.mjs test/integration/guard-forged.test.mjs test/integration/guard-exit-steps.test.mjs && go test -race -count=1 ./test/integration/... && cargo test --all-features",
+    "test": "npm run validate && node --test test/integration/self-contained.test.mjs test/integration/browser-runner.test.mjs test/integration/fixture-client.test.mjs test/integration/git-retry.test.mjs test/integration/release-line.test.mjs test/integration/guard-redirect-carrier.test.mjs test/integration/guard-redirect-session-end.test.mjs test/integration/guard-incomplete.test.mjs test/integration/guard-stall.test.mjs test/integration/guard-forged.test.mjs test/integration/guard-exit-steps.test.mjs && go test -race -count=1 ./test/integration/... && cargo test --all-features",
     "test:unit": "go test -race -cover ./...",
     "build": "go build ./... && cargo build --all-features && cargo build --target wasm32-wasip1 --all-features && npm pack --dry-run",
     "trust": "npx fledgling sync -y --skip-publish",
@@ -81,7 +81,7 @@
     "test:unit:guard": "mkdir -p coverage/unit && node --experimental-vm-modules --no-warnings --experimental-test-coverage --test --test-coverage-include=guard-runner.mjs --test-coverage-include=fixture-server.mjs --test-coverage-include=fixture-client.mjs --test-coverage-include=observer-target.mjs --test-coverage-include=protected-error-page.mjs --test-coverage-include=unparseable-url.mjs --test-coverage-include=scripts/browser-runner.mjs --test-coverage-include=scripts/validate.mjs --test-reporter=lcov --test-reporter-destination=coverage/unit/guard.lcov test/unit/guard-*.test.mjs && slicc-diff-cover coverage/unit/guard.lcov"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-shared-web": "2.7.0",
+    "@ai-ecoverse/slicc-shared-web": "2.7.4",
     "@biomejs/biome": "2.5.15",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",

package/redirect-secret.mjs

@@ -20,6 +20,12 @@ const decodedBase64 = (value) =>
     base64Slices(text).map(decodeBase64)
   );
 const refused = (out) => !out.ok && /^slicc: refused:/.test(out.error?.message ?? '');
+const gone = (out) =>
+  !out.ok &&
+  !refused(out) &&
+  /session with given id not found|no session with given id|\bsession (?:has been |is |was )?(?:closed|detached)|\btarget closed|target page, context or browser has been closed|\b(?:cdp|connection|transport|websocket|socket) (?:has been |is |was )?closed|websocket is not open/i.test(
+    out.error?.message ?? ''
+  );
 const redirects = [301, 302, 303, 307, 308];
 const redirectHeaders = (to) => ({
   location: to,
@@ -85,6 +91,7 @@ class RedirectProbe {
     this.messagesStart = this.client.messages?.length;
     this.eventsStart = this.client.events.length;
     this.cursor = this.eventsStart;
+    this.detachScan = this.eventsStart;
     this.responses = [];
     this.attempts = [];
     this.jobs = new Set();
@@ -107,8 +114,41 @@ class RedirectProbe {
         : this.protectedURLs;
   }
 
+  ended() {
+    const events = this.client.events;
+    for (; !this.end && this.detachScan < events.length; this.detachScan++) {
+      const event = events[this.detachScan];
+      if (event.method === 'Target.detachedFromTarget' && event.params?.sessionId === this.session)
+        this.end = 'Target.detachedFromTarget';
+    }
+    return Boolean(this.end);
+  }
+
+  cut() {
+    return Boolean(this.end) && !this.complete;
+  }
+
+  async lost() {
+    if (!this.ended()) await this.send('Runtime.evaluate', { expression: 'void 0' });
+    return this.ended();
+  }
+
+  answers(method) {
+    const all = this.attempts.filter((entry) => entry.method === method);
+    const answered = all.filter((entry) => !(this.end && (entry.pending || entry.ended)));
+    const short =
+      Boolean(this.end) && (!this.complete || !answered.length || answered.length < all.length);
+    return { answered, short };
+  }
+
   async send(method, params = {}) {
+    if (this.ended())
+      return { ok: false, ended: true, error: { message: `session ended (${this.end})` } };
     const out = await outcome(this.client.send(method, params, this.session));
+    if (gone(out)) {
+      this.end ??= out.error.message;
+      return { ...out, ended: true };
+    }
     this.responses.push({ method, ...out });
     return out;
   }
@@ -151,7 +191,7 @@ class RedirectProbe {
 
   async networkBody(requestId, source) {
     this.learned[source].add(requestId);
-    if (this.networkBodies.has(requestId)) return;
+    if (this.networkBodies.has(requestId) || this.ended()) return;
     this.networkBodies.add(requestId);
     const entry = { method: 'Network.getResponseBody', source, pending: true };
     this.attempts.push(entry);
@@ -191,15 +231,17 @@ class RedirectProbe {
         carriers.filter((entry) => entry === carrier).length,
       ])
     );
-    const attempts = this.attempts.filter((entry) => entry.method === 'Network.getResponseBody');
+    const { answered: attempts, short } = this.answers('Network.getResponseBody');
     const refusedAll = attempts.length > 0 && attempts.every(refused);
     const proven = path === 'network' || this.side !== 'guarded' || this.controls?.networkEvents;
     const reason =
       path === 'none'
         ? 'no network id for the redirect'
-        : proven
-          ? undefined
-          : 'control did not prove the redirect Network events';
+        : !proven
+          ? 'control did not prove the redirect Network events'
+          : short
+            ? `session ended (${this.end}) before every network body read was answered`
+            : undefined;
     if (reason && (!attempts.length || refusedAll))
       return {
         networkBodyPath: path,
@@ -254,11 +296,12 @@ class RedirectProbe {
   async land(url, start) {
     const path = new URL(url).pathname;
     await pause(250);
-    if (this.stalled) return;
+    if (this.stalled || this.ended()) return;
     const landed = await waitFor(
       async () =>
-        (await this.fixture.log()).some((entry) => entry.url.includes(path)) &&
-        !this.open(this.client.events.slice(start), (seen) => seen === url).length,
+        this.ended() ||
+        ((await this.fixture.log()).some((entry) => entry.url.includes(path)) &&
+          !this.open(this.client.events.slice(start), (seen) => seen === url).length),
       Math.round(2000 * this.scale),
       50
     );
@@ -267,7 +310,7 @@ class RedirectProbe {
 
   async terminated() {
     await waitFor(
-      () => !this.open(this.client.events.slice(this.eventsStart)).length,
+      () => this.ended() || !this.open(this.client.events.slice(this.eventsStart)).length,
       Math.round(5000 * this.scale),
       50
     );
@@ -300,13 +343,15 @@ class RedirectProbe {
     );
     const deliveries = Object.values(hops).map((entry) => entry.delivery);
     const open = Object.keys(hops).filter((id) => hops[id].delivery === 'unterminated');
-    const missing = open.length > 0 && this.side === 'control';
+    const missing = (open.length > 0 && (this.side === 'control' || this.end)) || this.cut();
+    const who = this.end ? `session ended (${this.end}) with requests` : 'control requests';
+    const detail = open.length
+      ? `${who} ${open.join(', ')} unterminated`
+      : `session ended (${this.end}) before every request was issued`;
     return {
       hops,
       requestsTerminated: missing ? 'incomplete' : !open.length,
-      ...(missing
-        ? { incomplete: `redirect-secret: control requests ${open.join(', ')} unterminated` }
-        : {}),
+      ...(missing ? { incomplete: `redirect-secret: ${detail}` } : {}),
       hopsRedacted: !deliveries.some((delivery) => ['raw', 'ordinary'].includes(delivery)),
     };
   }
@@ -388,6 +433,7 @@ class RedirectProbe {
   async headers() {
     for (const [index, to] of this.destinations.entries()) {
       for (const kind of ['navigate', 'href', 'fetch', 'xhr']) {
+        if (this.ended()) return;
         const code = this.mode === 'mix' ? [301, 303, 307, 308][index] : 302;
         const url = await this.register(`${index}-${kind}`, to, code);
         const start = this.client.events.length;
@@ -439,9 +485,9 @@ class RedirectProbe {
     const snapshot = await this.send('Page.captureSnapshot', { format: 'mhtml' });
     const dom = await this.send('DOMSnapshot.captureSnapshot', { computedStyles: [] });
     this.responses.push({
-      resourceContentAttempted: true,
-      snapshotAttempted: true,
-      domSnapshotAttempted: true,
+      resourceContentAttempted: !resource.ended,
+      snapshotAttempted: !snapshot.ended,
+      domSnapshotAttempted: !dom.ended,
       ordinaryResource: this.contains(resource),
       ordinarySnapshot: this.contains(snapshot),
       ordinaryDOM: this.contains(dom),
@@ -455,16 +501,21 @@ class RedirectProbe {
     await this.send('Runtime.evaluate', {
       expression: `fetch(${JSON.stringify(this.holdURL)}).catch(()=>{});void 0`,
     });
-    if (!(await waitFor(() => Boolean(this.held), 5000, 10)))
+    await waitFor(() => Boolean(this.held) || this.ended(), 5000, 10);
+    if (!this.held) {
+      this.holdURL = undefined;
+      if (await this.lost()) return;
       throw new Error('redirect body: Fetch override pause missing');
+    }
     const requestId = this.held.params.requestId;
     const out = await this.send('Fetch.continueRequest', { requestId, url });
+    this.holdURL = undefined;
+    if (out.ended) return;
     this.responses.push({
       overrideMethod: 'Fetch.continueRequest',
       overrideRefused: refused(out),
       overrideWorked: out.ok,
     });
-    this.holdURL = undefined;
     if (!out.ok) await this.send('Fetch.continueRequest', { requestId });
     await pause(500);
   }
@@ -475,6 +526,15 @@ class RedirectProbe {
     const tree = await this.send('Page.getFrameTree');
     const frameId = tree.result?.frameTree.frame.id;
     const start = (await this.fixture.log()).length;
+    await this.reads(url, to, frameId);
+    this.responses.push({
+      cookieSent: (await this.fixture.log())
+        .slice(start)
+        .some((entry) => entry.headers.cookie?.includes(`${this.cookie}=`)),
+    });
+  }
+
+  async reads(url, to, frameId) {
     const resource = await this.send('Network.loadNetworkResource', {
       frameId,
       url,
@@ -496,18 +556,21 @@ class RedirectProbe {
           event.params.type === 'XHR' &&
           event.params.request.url === url
       );
-    if (!xhr) throw new Error('redirect body: XHR request was not observed');
-    await this.send('Network.replayXHR', { requestId: xhr.params.requestId });
-    this.responses.push({ replayAttempted: true });
+    if (!xhr) {
+      if (await this.lost()) return;
+      throw new Error('redirect body: XHR request was not observed');
+    }
+    const replay = await this.send('Network.replayXHR', { requestId: xhr.params.requestId });
+    this.responses.push({ replayAttempted: !replay.ended });
     await pause(500);
-    await this.snapshots(url, to, frameId);
-    await this.iframe();
-    await this.override(url);
-    this.responses.push({
-      cookieSent: (await this.fixture.log())
-        .slice(start)
-        .some((entry) => entry.headers.cookie?.includes(`${this.cookie}=`)),
-    });
+    for (const step of [
+      () => this.snapshots(url, to, frameId),
+      () => this.iframe(),
+      () => this.override(url),
+    ]) {
+      if (this.ended()) return;
+      await step();
+    }
   }
 
   async iframe() {
@@ -521,15 +584,15 @@ class RedirectProbe {
     const snapshot = await this.send('Page.captureSnapshot', { format: 'mhtml' });
     const dom = await this.send('DOMSnapshot.captureSnapshot', { computedStyles: [] });
     this.responses.push({
-      iframeSnapshotAttempted: true,
+      iframeSnapshotAttempted: !snapshot.ended && !dom.ended,
       ordinaryIframeSnapshot: this.contains(snapshot),
       ordinaryIframeDOM: this.contains(dom),
     });
   }
 
   async evidence() {
-    await pause(8000);
-    this.tap();
+    if (!this.ended()) await pause(8000);
+    if (!this.ended()) this.tap();
     if (this.side === 'control' && this.controls)
       this.controls.networkEvents = this.learned.network.size > 0;
     await this.send('Fetch.disable');
@@ -560,20 +623,24 @@ class RedirectProbe {
         event.method === 'Network.responseReceivedExtraInfo' &&
         redirects.includes(event.params.statusCode)
     );
+    const extraHeld = extra.every((event) => {
+      const headers = event.params.headers;
+      const origin = headers.location ?? headers.Location;
+      return (
+        this.protectedURLs.some((url) => new URL(url).origin === origin) &&
+        headersMatch(headers, origin) &&
+        headersTextMatch(event.params.headersText, origin)
+      );
+    });
     const extraInPlace =
-      extra.length >= this.destinations.length * 4 &&
-      extra.every((event) => {
-        const headers = event.params.headers;
-        const origin = headers.location ?? headers.Location;
-        return (
-          this.protectedURLs.some((url) => new URL(url).origin === origin) &&
-          headersMatch(headers, origin) &&
-          headersTextMatch(event.params.headersText, origin)
-        );
-      });
+      extraHeld &&
+      (extra.length >= this.destinations.length * 4 || (this.end ? 'incomplete' : false));
+    const unseen = this.end ? 'incomplete' : false;
     const found = (key) => this.responses.some((entry) => entry[key]);
-    const fetchAttempts = this.attempts.filter((entry) => entry.method === 'Fetch.getResponseBody');
-    return {
+    const fetchReads = this.answers('Fetch.getResponseBody');
+    const fetchLeaked = fetchReads.answered.some((entry) => !refused(entry));
+    const overrides = this.responses.filter((entry) => entry.overrideMethod);
+    const evidence = {
       live: (await this.fixture.log()).some((entry) =>
         entry.url.includes(`/redirect-secret/${this.tag}`)
       ),
@@ -587,8 +654,13 @@ class RedirectProbe {
         ),
       secretHidden: !replyLeaks.includes(true),
       sessionSurvives: survives.ok && survives.result?.result?.value === 'doc',
-      fetchBodyAttempted: fetchAttempts.length > 0,
-      fetchBodyRefused: fetchAttempts.length > 0 && fetchAttempts.every(refused),
+      sessionEnded: this.ended(),
+      fetchBodyAttempted: fetchReads.short ? 'incomplete' : fetchReads.answered.length > 0,
+      fetchBodyRefused: fetchLeaked
+        ? false
+        : fetchReads.short
+          ? 'incomplete'
+          : fetchReads.answered.length > 0,
       ...this.legs(events),
       extraInPlace,
       ...redirectFragments({
@@ -632,26 +704,23 @@ class RedirectProbe {
           'iframeSnapshotAttempted',
           'ordinaryIframeSnapshot',
           'ordinaryIframeDOM',
-        ].map((key) => [key, found(key)])
+        ].map((key) => [key, found(key) || unseen])
       ),
-      overridesRefused:
-        this.responses.some((entry) => entry.overrideMethod) &&
-        this.responses
-          .filter((entry) => entry.overrideMethod)
-          .every((entry) => entry.overrideRefused),
-      overridesWorked:
-        this.responses.some((entry) => entry.overrideMethod) &&
-        this.responses
-          .filter((entry) => entry.overrideMethod)
-          .every((entry) => entry.overrideWorked),
+      overridesRefused: overrides.length
+        ? overrides.every((entry) => entry.overrideRefused)
+        : unseen,
+      overridesWorked: overrides.length ? overrides.every((entry) => entry.overrideWorked) : unseen,
     };
+    if (!this.end || !Object.values(evidence).includes('incomplete')) return evidence;
+    const incomplete = [evidence.incomplete, `redirect-secret: session ended (${this.end})`];
+    return { ...evidence, incomplete: incomplete.filter(Boolean).join('; ') };
   }
 
   async close() {
     this.stopped = true;
     await this.watching;
     await this.settle();
-    await outcome(this.client.send('Fetch.disable', {}, this.session));
+    if (!this.ended()) await outcome(this.client.send('Fetch.disable', {}, this.session));
     if (this.observer) {
       await outcome(
         this.reader.send(
@@ -680,7 +749,11 @@ export async function redirectSecret(options) {
     await probe.setup();
     if (options.mode === 'body') await probe.body();
     else await probe.headers();
-    return await probe.evidence();
+    probe.complete = !probe.ended();
+    const evidence = await probe.evidence();
+    if (probe.end && options.side !== 'guarded')
+      throw new Error(`redirect-secret: ${options.side} session ended (${probe.end})`);
+    return evidence;
   } finally {
     await probe.close();
   }