@ai-ecoverse/slicc-browsers 1.17.0 → 1.18.1

package/README.md

@@ -207,7 +207,15 @@ Every C2 redirect probe reports `sessionEnded`. It becomes true when the guarded
 
 The `C8.newtab` reachability control attaches through the guard to a settled ordinary new tab, including its internal frames, then navigates that same tab to an ordinary document. Both legs must succeed, including without a guard. It requires `chromeUrlsAttach`, so an extension transport reports it as `skip` with `not-supported:chromeUrlsAttach`. The C8 protection rows expect a refusal on the guarded leg and run their controls unguarded, so they don't require it and still run on extension transports. It uses the default browser context, since an incognito new tab omits the ordinary new tab's internal frames. It covers `chrome://newtab/` and directly opened `chrome://new-tab-page/`.
 
-`C8.protected-error-page` touches an allowed tab, scripts a protected navigation, and requires the guard to fail its Document request. The independent observer verifies the committed error document and the exact unreachable/reported URL pair. The session stays attached; reload, navigation to `about:blank` and close succeed, while `Target.getTargetInfo`, `Target.getTargets`, the `Target.attachedToTarget` of a fresh attach and the `targetCreated`/`targetInfoChanged` events redact URL and title to the origin (`infoRedacted`, `listRedacted`, `attachRedacted`, `eventsRedacted`), and none of them shows the full failed URL (`fullURL`). The failed URL carries a secret path, `?query` and `#fragment`; the `.query` and `.fragment` variants of this row and of `C8.protected-error-page-sticky` fail `/doc?query-secret=…` and `/doc#fragment-secret-…` instead, so no path, query or fragment secret may survive alone either. The unguarded control uses independent Fetch failure injection and keeps raw discovery values: its `fullURL` must be `true`. `C8.protected-document-restore` seeds a real protected document before attachment, navigates away, then restores it from BFCache in the same tab after the error/recovery sequence; evaluate, attach and close must be refused. A real `BackForwardCacheRestore` commit is required, so a second failed network request cannot masquerade as this control. `C8.protected-error-page-sticky` additionally fails a request after that real protected restore and requires the already-protected tab to remain locked. They run on browser-session and page-session-only transports alike, have unguarded controls and clean up their own targets. The regression tests include URL-only locking, unconditional error-page unlocking, and a plain client with only request-failure injection.
+`C8.protected-bfcache-restore` and `.history` test history restoration on seven and vault, with both detach variants. The independent observer seeds ordinary A, protected P and ordinary B on one tab. `/bfcache?n=<tag>` has no unload handler: it retains a global and sessionStorage marker, records `pageshow.persisted` and counts key events. The guarded client must answer on B before the gate is armed. The first row restores P with the observer's `Page.navigateToHistoryEntry`; `.history` sends that navigation through the client instead. A matched client navigation refusal lets the observer restore the same entry. The unguarded control must observe a real `BackForwardCacheRestore`, persisted pageshow, the marker and protected origin in evaluate, a touched global, and positive evidence from every probe method.
+
+The rows require `inboundDelay`. The guarded client supplies `inboundDelay({ targetId, sessionId, ms, side, client, gate: true })`, a harness gate before the guard's inbound stream. It holds every browser-to-guard message until explicit release; guard-to-browser writes remain possible. The control gates only its unguarded client stream, not the independent observer session. Immediately before restoration the runner requests a gate with a 1500 ms minimum hold. The hook returns `{ targetId, sessionId, ms, gate: true, protectedObserved, ordinaryObserved, release, audit? }`. Both observed flags acknowledge delivery of the protected seed and subsequent ordinary B through the relevant stream before injection. `release()` restores delivery and returns `{ delayedEvents, firstDelayedAt, releasedAt }`, counting held restore events and recording their first hold and actual release times. Missing capability or hook is `not-supported:inboundDelay`; an unacknowledged gate, absent seed acknowledgement or no held restore event is `incomplete`. A timer-only event delay does not meet this contract.
+
+After the observer confirms the persisted protected document, the client repeatedly probes `Runtime.evaluate`, `Runtime.callFunctionOn`, `DOM.getDocument`, `Accessibility.getFullAXTree`, `Input.dispatchKeyEvent`, `Page.captureScreenshot` and `IO.read` for 2500 ms while the gate stays closed. Runtime probes write `__touched`; Input is measured by the fixture's key counter. The observer supplies a real network-resource stream for IO's positive control: the read must use that handle and show the document marker, including base64-encoded bodies. Screenshot controls must return PNG bytes captured while P is current that match the independent observer's capture of P; unrelated or merely nonempty data is not evidence. The guard must hide the marker from all received messages and events and hide the protected origin from every probe reply, not only Runtime replies, and leave both side effects absent on P. A returned screenshot while P is current fails, regardless of its encoded contents. Refused, answered and unanswered outcomes are retained individually; an unanswered call alone never proves protection. The observer measures P's marker, persisted state and side effects before and after release. Missing restore, fixture, hold or side-effect evidence is `incomplete`, even when every measured observation matches; measured leaks or side effects fail even beside missing evidence. After release the runner drains probe replies for up to 5000 ms, scaled by `settleScale`, before scanning them and judging screenshots. An unresolved reply needs a complete final forwarding ledger proving terminal non-forwarding; otherwise its missing measurement is `incomplete`. A measured failure takes precedence over incomplete evidence.
+
+`forwardAudit` gates only `commandsUnforwarded`. When advertised, `audit({ probes, final })` must return `{ complete: true, probes: [{ id, forwarded }] }` with a browser-side forwarding decision for every probe id; any probe sent while the gate is armed that was forwarded fails, even when its frame state was unknown. The gate-window audit runs before release. The final audit runs after reply settlement and certifies terminal forwarding decisions, including commands queued at release; its ledger must remain available after `release()`. An observed forward fails even beside a partial ledger. Guard-generated internal calls and the history trigger are not probe calls. A missing or partial ledger is `incomplete`. Without the capability the audit is `not-supported`, and the independent side-effect, leak and screenshot checks remain required. Each row's `evidence.control.restore` and `evidence.guarded.restore` retains gate acknowledgement/release, the restore timestamp, every probe's send time and outcome, forwarding evidence when available, and the independent side-effect reads. Cleanup releases the gate and closes only that row's targets, streams and sessions.
+
+`C8.protected-error-page` touches an allowed tab, scripts a protected navigation, and requires the guard to fail its Document request. That navigation stays script-initiated, because a protected `Page.navigate` destination must be refused: the client sends `Page.navigate` to the ordinary `/page?k=deferred&defer=0` trigger, whose own script navigates to the protected URL, passed fully percent-encoded so it never appears in the trigger's URL. No step navigates with client or observer script, so a guard that refuses client `Runtime.evaluate` in a tab whose history holds a protected entry still gets a verdict; a failed or refused client `Page.navigate` leaves the row `incomplete`. The independent observer verifies the committed error document and the exact unreachable/reported URL pair. The session stays attached; reload, navigation to `about:blank` and close succeed (close after the same trigger fails the URL again), while `Target.getTargetInfo`, `Target.getTargets`, the `Target.attachedToTarget` of a fresh attach and the `targetCreated`/`targetInfoChanged` events redact URL and title to the origin (`infoRedacted`, `listRedacted`, `attachRedacted`, `eventsRedacted`), and none of them shows the full failed URL (`fullURL`). The failed URL carries a secret path, `?query` and `#fragment`; the `.query` and `.fragment` variants of this row and of `C8.protected-error-page-sticky` fail `/doc?query-secret=…` and `/doc#fragment-secret-…` instead, so no path, query or fragment secret may survive alone either. The unguarded control uses independent Fetch failure injection on the protected origin and keeps raw discovery values: its `fullURL` must be `true`. `C8.protected-document-restore` seeds a real protected document before attachment, navigates away, then the observer restores it from BFCache with `Page.navigateToHistoryEntry` in the same tab after the error/recovery sequence; evaluate, attach and close must be refused. A real `BackForwardCacheRestore` commit is required, so a second failed network request cannot masquerade as this control. `C8.protected-error-page-sticky` additionally fails a request after that real protected restore and requires the already-protected tab to remain locked. They run on browser-session and page-session-only transports alike, have unguarded controls and clean up their own targets. The regression tests include URL-only locking, unconditional error-page unlocking, a plain client with only request-failure injection, and a guard that refuses client `Runtime.evaluate` in a tab whose history holds a protected entry.
 
 `C8.network-error` and `C8.iframe-error` are ordinary-error reachability controls: request the configured `network-error` URL (default `http://nonexistent.invalid/`) directly or in an ordinary iframe, observe a failed Document request, reattach to the settled tab, evaluate and snapshot its document, then navigate the same tab to an ordinary document. Both control and guarded legs must pass. The failing URL is unchanged on the control, rather than replaced with a healthy origin, and the rows require `browserSession` but not `chromeUrlsAttach`. With Chrome for Testing 156.0.8078.4, scheme-wide `chrome-error` protection made the direct-error row fail both legs because reattachment was refused; removing it passed both rows, with readable DOM and successful recovery. The old emulator still allowed the cross-process iframe parent because the iframe TargetInfo kept the failing HTTP URL, but that layout-specific behavior is not grounds for protecting the error scheme. Plain-client controls and reachability legs also passed both rows.
 
@@ -265,7 +273,7 @@ Popups are observed by `Target.targetCreated` with the opener's `openerId`, or b
 - `/listener.js`: one line registering a window `load` listener, served with `SourceMap: /listener.js.map`;
 - `/data?n=`: `real-<n>`, with CORS;
 - `/script?n=`: a script setting `globalThis.vectorScript` to `real-<n>`;
-- `/page?k=&to=`: a trigger page whose `go()` sends the page to `to` (`k=href`, `replace`, `popup` or `form`), and `/canary/<tag>`: a document titled `canary` with the marker;
+- `/page?k=&to=`: a trigger page whose `go()` sends the page to `to` (`k=href`, `replace`, `popup` or `form`; `deferred` runs `href` itself after `defer` ms, default 3000), and `/canary/<tag>`: a document titled `canary` with the marker;
 - `/nest?n=&kind=` (and any path under `/nest`): the `C4.iframe-preattach` frame, with its `about:blank` or `about:srcdoc` child;
 - `/img`: a 1×1 PNG;
 - `/auth`: Basic `u`:`p`, then `authed`;
@@ -275,7 +283,7 @@ Popups are observed by `Target.targetCreated` with the opener's `openerId`, or b
 
 `{ "extensionWorld": "hidden" | "select" | "debugger" | "drivable", "as": "world", "requires": ["extensionWorld"] }` runs the C9 compound probe on the current ordinary page. The runner attaches an independent observer to discover actual context ids, unique ids and names, and sends probes through the client session. Discovery matches the expected fixture extension’s exact origin, never the first extension world: `run()`’s optional `extensionWorldId` defaults to shared-web’s harness id `ankmbodmgimjemnojmeddfcdlbocolob`. Multiple unrelated content-script worlds are ignored for fixture selection, while guards must still protect foreign worlds. A custom fixture must provide the same content-script marker contract. Object handles are minted and validated on the unguarded control session, then replayed as guesses on the guarded leg; Chrome object handles and DOM node ids are session-local, so observer handles must never be mistaken for client handles. Numeric ids from the control are also replayed alongside fresh observer-discovered selectors, but numeric ids are local to a tab: a control id may name the next tab’s exposed default context, which must work and return no extension marker. The same-tab hidden world’s actual numeric id and every extension unique-id guess still require a matched refusal. Unknown numeric ids and stale object handles (`not exposed`) need explicit refusals rather than Chrome’s invalid-id errors. `guessesRefused` aggregates only required refusals; `guessesReached` must be false on the guarded leg, and `exposedContextsWork` must remain true. Its result contains boolean evidence consumed by ordinary `result` checks. The unguarded leg validates those selectors against Chrome itself before guarded evidence can pass.
 
-`{ "errorPage": "recover", "secret"?: "all" | "query" | "fragment", "as": "errorPage" }` (also modes `restore` and `sticky`; `secret` defaults to `all`) runs the protected-error-page compound probe with independent commit evidence, discovery redaction and recovery or sticky-lock checks. The unguarded observer seeds the protected history and failed commit, so the rows run on page-session-only transports too. The guarded client uses only `Target.getTargetInfo` with a `targetId`, `Target.getTargets`, `Target.setDiscoverTargets`, `Target.attachToTarget`, `Target.detachFromTarget` and `Target.closeTarget` without a session, which page-session transports answer themselves, and everything else on its page session; the rows require no whole-vector capability. Only `eventsRedacted` requires `discovery`: without it the probe does not call `Target.setDiscoverTargets`, that one field is `not-supported` in both legs, and the notes say `not-supported:discovery`; info, list, attach, recovery and lock checks still run. Discovery absence is structural: a guarded transport delivering either `Target.targetCreated` or `Target.targetInfoChanged` during such a row without declaring `discovery` fails the row, even when the event names an ordinary target. `Target.attachedToTarget` remains independently checked by `attachRedacted`. The runner leaves this probe’s independent Fetch sessions to the probe rather than answering their pauses itself. Each of the probe’s waits is bounded at 5000 ms, scaled by `settleScale`. When the probe’s own evidence is missing, it returns `incomplete` with `protected-error-page: <reason>` instead of throwing: the observer target could not be created or attached (an `openerId` included, after cleaning the target up), the observer’s history seed or allowed document did not commit (or its setup failed), the control’s own Fetch failure injection left no error commit, the protected history entry is missing, no real `BackForwardCacheRestore` arrived, or the observer’s sticky failure left no error page. The guarded leg’s missing error commit is not incomplete: it is the guard’s, and stays `live: false`.
+`{ "errorPage": "recover", "secret"?: "all" | "query" | "fragment", "as": "errorPage" }` (also modes `restore` and `sticky`; `secret` defaults to `all`) runs the protected-error-page compound probe with independent commit evidence, discovery redaction and recovery or sticky-lock checks. The unguarded observer seeds the protected history and failed commit, so the rows run on page-session-only transports too. The guarded client uses only `Target.getTargetInfo` with a `targetId`, `Target.getTargets`, `Target.setDiscoverTargets`, `Target.attachToTarget`, `Target.detachFromTarget` and `Target.closeTarget` without a session, which page-session transports answer themselves, and everything else on its page session; the rows require no whole-vector capability. Only `eventsRedacted` requires `discovery`: without it the probe does not call `Target.setDiscoverTargets`, that one field is `not-supported` in both legs, and the notes say `not-supported:discovery`; info, list, attach, recovery and lock checks still run. Discovery absence is structural: a guarded transport delivering either `Target.targetCreated` or `Target.targetInfoChanged` during such a row without declaring `discovery` fails the row, even when the event names an ordinary target. `Target.attachedToTarget` remains independently checked by `attachRedacted`. The runner leaves this probe’s independent Fetch sessions to the probe rather than answering their pauses itself. Each of the probe’s waits is bounded at 5000 ms, scaled by `settleScale`. When the probe’s own evidence is missing, it returns `incomplete` with `protected-error-page: <reason>` instead of throwing: the observer target could not be created or attached (an `openerId` included, after cleaning the target up), the observer’s history seed or allowed document did not commit (or its setup failed), the client’s `Page.navigate` to the trigger failed or was refused, the control’s own Fetch failure injection left no error commit, the protected history entry is missing, no real `BackForwardCacheRestore` arrived, or the observer’s sticky failure left no error page. The guarded leg’s missing error commit is not incomplete: it is the guard’s, and stays `live: false`.
 
 `{ "redirectSecret": "headers" | "mix" | "body", "as": "redirect" }` runs a C2 compound probe and owns its Fetch pauses. The client must expose `messages`, an append-only array of every raw received CDP text frame, recorded before parsing; an events-only or reply-only tap fails `rawRecorded`. Whenever a run includes a `C2.redirect-*` row or a `redirectSecret` step, `run()` retains an explicit `fixture.redirectSecret` hook or automatically installs a fetch-only `POST /redirect` bridge. Its base is `fixtureBase`, then `fixture.origin`, then `targets.ordinary`; a browser-page alias or reverse proxy must forward that endpoint to the bundled fixture. The bundled `fixtureServer()` always supplies both its direct hook and HTTP control endpoint, so no custom registration method is needed. Missing, unreachable or non-successful registration is an explicit row/summary error containing `redirectSecret fixture registration required`, never a pass or a skipped observation. Fixture logs must include headers for the cookie check. The guard’s events and raw messages must represent the same delivered stream. The leak scan memoizes each decoded string and yields to the event loop between items, so concurrent rows in the same process are not starved. When the probe’s own unguarded observer setup (attach, `Page.enable` and the seven cookie) fails before the client is used, the probe returns `incomplete` with `redirect-secret: observer setup failed: <reason>` instead of throwing.
 
@@ -283,6 +291,8 @@ Popups are observed by `Target.targetCreated` with the opener's `openerId`, or b
 
 For remote/page harnesses, `fixtureClient(base)` is exported by `./guard-runner` and `./fixture-client`, or `run(set, { fixtureBase: base, ... })` constructs it. The bundled server serves CORS-safe `GET /log?since=N` as `{ from: N, entries: [...] }`, with an append-only history unaffected by `fixture.reset()`, and `POST /redirect` with a JSON-encoded string body (a simple text/plain request, without a preflight). Control requests do not appear in the log. Registration descriptors are `{ path, host?, search?, to?, code?, body, remove? }`: `path` starts with `/`, `host` selects the callback hostname, `search` distinguishes query-bearing callbacks, `to` creates a redirect with the four Location/Content-Location/Refresh/Link headers, `code` defaults to 302, an omitted `to` serves the callback body, and `remove: true` unregisters it. The bundled endpoint returns 204; custom servers must acknowledge with a successful status and actually serve the registered routes. Custom fixtures may instead supply an async `fixture.redirectSecret` hook directly; a separate log/control server can implement the same `GET /log` and `POST /redirect` contract. A Node harness using browser-only DNS aliases should pass a reachable `fixtureBase` or its direct hook.
 
+`{ "bfcacheRestore": "observer" | "history", "origin": "{protectedTarget}", "as": "restore", "requires": ["inboundDelay"] }` runs the history-restore compound probe. `{protectedTarget}` is the row target on both legs, so the unguarded control exercises the same protected fixture origin.
+
 `{ "frameRead": "blank" | "srcdoc", "from", "as": "frames", "on"?, "requires"? }` runs the `C4.iframe-preattach` compound probe: the observer's page and reads, then the client's attach and reads, with boolean evidence for ordinary `result` checks.
 
 `{ "unparseable": true, "as": "unparseable" }` runs the C8 malformed-URL compound probe on the current ordinary page: independent browser ground truth, raw/canonical destination commands, discovery/attach and cookie checks. Boolean evidence is consumed by ordinary `result` checks, with native Chrome outcomes retained in its diagnostics.
@@ -415,7 +425,7 @@ Every target created by the runner’s own unguarded observer uses `Target.creat
 
 `refusalScale` (default 1) multiplies the bounds of waits for what the guarded leg expects to be absent, the beacon, request, title or navigation that the guard should block: settles that are not `required`, and `paused`, on the guarded leg. Such a wait runs to its full bound whenever the guard works, so `settleScale` leaves it alone. The trade-off: a larger `refusalScale` gives more sensitivity to a leak that arrives late on a slow host, because the observations after the wait see it, at the cost of that much more time per guarded row. Adopters should keep `refusalScale` at 1 or higher, never below 1; the runner refuses a `refusalScale` below 1 with `refusalScale must be a number of at least 1`.
 
-**Incomplete.** A probe that returns `incomplete` (only `errorPage`, `redirectSecret` and `frameRead` steps) records the reason in the row's `incomplete` as `<leg> <probe>: <reason>`. Its unmeasured observations read `"incomplete"`, and so does guarded liveness when the probe never measured it. A leg whose measured observations all match is then `incomplete`, never `pass`, and `live` is `incomplete` when only its evidence is missing; a measured mismatch still makes the leg `fail`, and any row error still fails both legs. `summary()` counts `incomplete` per leg, returns the number of rows with any `incomplete` status as `incomplete`, appends `incomplete <n>` to `line`, and never passes such a run. A leg that throws keeps the errors it recorded before the throw.
+**Incomplete.** A probe that returns `incomplete` (including `errorPage`, `redirectSecret`, `frameRead` and `bfcacheRestore` steps) records the reason in the row's `incomplete` as `<leg> <probe>: <reason>`. Its unmeasured observations read `"incomplete"`, and so does guarded liveness when the probe never measured it. A leg whose measured observations all match is then `incomplete`, never `pass`, and `live` is `incomplete` when only its evidence is missing; a measured mismatch still makes the leg `fail`, and any row error still fails both legs. `summary()` counts `incomplete` per leg, returns the number of rows with any `incomplete` status as `incomplete`, appends `incomplete <n>` to `line`, and never passes such a run. A leg that throws keeps the errors it recorded before the throw.
 
 `onStart(row)` receives each row's `id`, `target`, `variant`, `transport` and `via` as the row starts. `run()` returns a promise that also has `inFlight()`, and its result has `inFlight` too. `inFlight()` lists the rows that are running now, each as `{ id, target, variant, leg, phase, step, clients }`, where `step` is the index of the current step in its `phase` (`setup`, `trigger` or `child`), and `clients` lists each client's pending CDP calls as `{ method, session, ageMs }` (`client`, plus `unguarded` when it is a separate client). With `rowTimeoutMs`, a row still running after that many milliseconds fails on its own. Its `errors` hold `row timed out after <ms>ms: <the in-flight view>`, `inFlight` holds the view, and the clients that `clientFactory` made for it are closed. The run then goes on to the next row. It is off by default, and a client passed as `client` is never closed.
 

package/bfcache-restore.mjs

@@ -0,0 +1,514 @@
+import { outcome, waitFor } from './guard-driver.mjs';
+import { createObserverTarget } from './observer-target.mjs';
+import { containsSecret } from './redirect-secret.mjs';
+
+const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const refusal = (out) =>
+  !out.ok &&
+  /^(slicc: refused:)|session.*(closed|not found)|no session|target.*closed/i.test(
+    out.error?.message ?? ''
+  );
+const value = (out) =>
+  out.ok && !out.result?.exceptionDetails ? out.result?.result?.value : undefined;
+const png = (data) => {
+  try {
+    return typeof data === 'string' && atob(data).startsWith('\x89PNG\r\n\x1a\n');
+  } catch {
+    return false;
+  }
+};
+const methods = [
+  'Runtime.evaluate',
+  'Runtime.callFunctionOn',
+  'DOM.getDocument',
+  'Accessibility.getFullAXTree',
+  'Input.dispatchKeyEvent',
+  'Page.captureScreenshot',
+  'IO.read',
+];
+
+async function bounded(work, ms) {
+  let timer;
+  const expired = new Promise((resolve) => {
+    timer = setTimeout(() => resolve({ ok: false, error: { message: 'no answer' } }), ms);
+  });
+  const out = await Promise.race([outcome(work), expired]);
+  clearTimeout(timer);
+  return out;
+}
+
+class Restore {
+  constructor(options) {
+    Object.assign(this, options);
+    this.marker = `bfcache-marker-${this.tag}`;
+    this.url = `${this.protectedOrigin}/bfcache?n=${encodeURIComponent(this.tag)}`;
+    this.result = { probes: [], delay: { requestedMs: this.delayMs } };
+    this.missing = [];
+    this.pending = [];
+    this.probeId = 0;
+  }
+
+  missingEvidence(reason) {
+    this.missing.push(reason);
+    return false;
+  }
+
+  read(method, params, session = method.startsWith('Target.') ? undefined : this.observer) {
+    return bounded(this.reader.send(method, params, session), this.budget);
+  }
+
+  call(method, params) {
+    return bounded(this.client.send(method, params, this.session), this.budget);
+  }
+
+  async frame() {
+    return (await this.read('Page.getFrameTree', {})).result?.frameTree?.frame;
+  }
+
+  async state() {
+    return value(
+      await this.read('Runtime.evaluate', {
+        expression:
+          '({origin:location.origin,marker:globalThis.__bfcacheMarker,stored:sessionStorage.getItem("bfcache-marker"),persisted:globalThis.__bfcachePersisted,touched:globalThis.__touched,keys:globalThis.__bfcacheKeys||0})',
+        returnByValue: true,
+      })
+    );
+  }
+
+  loaded(destination) {
+    return waitFor(async () => {
+      const f = await this.frame();
+      return (
+        f?.url === destination &&
+        !f.unreachableUrl &&
+        value(
+          await this.read('Runtime.evaluate', {
+            expression: 'document.readyState',
+            returnByValue: true,
+          })
+        ) === 'complete'
+      );
+    }, this.budget);
+  }
+
+  async attach() {
+    this.session = (
+      await bounded(
+        this.client.send('Target.attachToTarget', { targetId: this.targetId, flatten: true }),
+        this.budget
+      )
+    ).result?.sessionId;
+    return Boolean(this.session);
+  }
+
+  async seed() {
+    this.observer = (
+      await this.read('Target.attachToTarget', { targetId: this.targetId, flatten: true })
+    ).result?.sessionId;
+    if (!this.observer) return this.missingEvidence('observer attach unanswered');
+    await this.read('Page.enable', {});
+    if (!(await this.loaded(`${this.ordinary}/bfcache?n=${this.tag}-a`)))
+      return this.missingEvidence('ordinary A did not commit');
+    if (!(await this.attach())) return this.missingEvidence('initial client attach unanswered');
+    await this.call('Page.enable', {});
+    await this.read('Page.navigate', { url: this.url });
+    if (!(await this.loaded(this.url)))
+      return this.missingEvidence('protected seed did not commit');
+    const state = await this.state();
+    if (state?.marker !== this.marker || state.stored !== this.marker)
+      return this.missingEvidence('protected fixture marker absent');
+    const lock = await this.call('Runtime.evaluate', {
+      expression: 'location.origin',
+      returnByValue: true,
+    });
+    this.result.protectedLocked = refusal(lock);
+    this.result.seed = { protectedURL: this.url, lock };
+    const b = `${this.ordinary}/bfcache?n=${this.tag}-b`;
+    await this.read('Page.navigate', { url: b });
+    if (!(await this.loaded(b))) return this.missingEvidence('ordinary B did not commit');
+    await bounded(
+      this.client.send('Target.detachFromTarget', { sessionId: this.session }),
+      this.budget
+    );
+    const live = (await this.attach())
+      ? await this.call('Runtime.evaluate', { expression: 'location.href', returnByValue: true })
+      : { ok: false };
+    this.result.sessionLive = value(live) === b;
+    this.result.seed.ordinaryAnswer = live;
+    if (!this.result.sessionLive) return false;
+    await this.call('Page.enable', {});
+    const history = await this.read('Page.getNavigationHistory', {});
+    this.entry = history.result?.entries?.find((item) => item.url === this.url);
+    return Boolean(this.entry) || this.missingEvidence('protected history entry absent');
+  }
+
+  async install() {
+    const { targetId, session, delayMs: ms, side, client } = this;
+    const installed = await outcome(
+      this.delayClient.inboundDelay({ targetId, sessionId: session, ms, side, client, gate: true })
+    );
+    this.delay = installed.result;
+    this.gate = this.delay;
+    const delay = this.delay;
+    this.result.delay.seeding = {
+      protectedObserved: delay?.protectedObserved,
+      ordinaryObserved: delay?.ordinaryObserved,
+    };
+    this.result.delay.acknowledged =
+      installed.ok &&
+      delay?.ms === ms &&
+      delay.targetId === targetId &&
+      delay.sessionId === session &&
+      delay.protectedObserved === true &&
+      delay.ordinaryObserved === true &&
+      delay.gate === true;
+    return (
+      (this.result.delay.acknowledged && typeof delay.release === 'function') ||
+      this.missingEvidence('inbound delay not acknowledged')
+    );
+  }
+
+  async trigger() {
+    const params = { entryId: this.entry.id };
+    const out =
+      this.mode === 'history'
+        ? await this.call('Page.navigateToHistoryEntry', params)
+        : await this.read('Page.navigateToHistoryEntry', params);
+    this.result.trigger = out;
+    if (this.mode === 'history' && refusal(out))
+      await this.read('Page.navigateToHistoryEntry', params);
+  }
+
+  async probe(method, params, current) {
+    const sentAt = Date.now();
+    const record = { id: ++this.probeId, params, method, sentAt, protectedCurrent: current };
+    this.result.probes.push(record);
+    const work = this.client.send(method, params, this.session);
+    const out = await bounded(work, Math.min(this.budget, 250));
+    this.answer(record, out);
+    record.windowOutcome = record.outcome;
+    this.pending.push(
+      outcome(work).then((answer) => {
+        this.answer(record, answer);
+        record.answeredAt = Date.now();
+      })
+    );
+    return out;
+  }
+
+  answer(record, out) {
+    record.outcome = refusal(out)
+      ? 'refused'
+      : out.error?.message === 'no answer'
+        ? 'no answer'
+        : 'answered';
+    record.reply = out;
+  }
+
+  async round() {
+    const f = await this.frame();
+    const current = f?.url === this.url && !f.unreachableUrl;
+    const restored = this.reader.events
+      .slice(this.eventStart)
+      .some(
+        (event) =>
+          event.sessionId === this.observer &&
+          event.method === 'Page.frameNavigated' &&
+          event.params?.type === 'BackForwardCacheRestore' &&
+          event.params.frame?.url === this.url
+      );
+    if (restored && this.result.restoreAt === undefined) this.result.restoreAt = Date.now();
+    const expression =
+      'globalThis.__touched=1; JSON.stringify({origin:location.origin,marker:globalThis.__bfcacheMarker,stored:sessionStorage.getItem("bfcache-marker")})';
+    const calls = [
+      this.probe('Runtime.evaluate', { expression, returnByValue: true }, current),
+      this.probe('DOM.getDocument', { depth: -1, pierce: true }, current),
+      this.probe('Accessibility.getFullAXTree', {}, current),
+      this.probe('Page.captureScreenshot', { format: 'png' }, current),
+      this.probe('IO.read', { handle: this.stream ?? 'unavailable-stream' }, current),
+      this.probe(
+        'Input.dispatchKeyEvent',
+        { type: 'keyDown', key: 'x', code: 'KeyX', windowsVirtualKeyCode: 88 },
+        current
+      ),
+    ];
+    calls.push(
+      this.probe(
+        'Runtime.callFunctionOn',
+        {
+          executionContextId: this.contextId,
+          functionDeclaration:
+            'function(){this.__touched=1;return JSON.stringify({origin:location.origin,marker:this.__bfcacheMarker})}',
+          returnByValue: true,
+        },
+        current
+      )
+    );
+    await Promise.all(calls);
+  }
+
+  async window() {
+    this.eventStart = this.reader.events.length;
+    this.clientStart = this.client.events.length;
+    this.messageStart = this.client.messages?.length ?? 0;
+    this.result.delay.startedAt = Date.now();
+    const trigger = this.trigger();
+    const restored = await waitFor(async () => {
+      const f = await this.frame();
+      return f?.url === this.url && !f.unreachableUrl && (await this.state())?.persisted === true;
+    }, this.budget);
+    if (!restored) this.missingEvidence('protected restore before probes not observed');
+    const f = await this.frame();
+    const contextStart = this.reader.events.length;
+    await this.read('Runtime.enable', {});
+    this.contextId = this.reader.events
+      .slice(contextStart)
+      .find(
+        (event) =>
+          event.sessionId === this.observer &&
+          event.method === 'Runtime.executionContextCreated' &&
+          event.params?.context?.auxData?.isDefault &&
+          event.params.context.auxData.frameId === f?.id
+      )?.params.context.id;
+    this.result.screenshotProof = {
+      capturedAt: Date.now(),
+      url: f?.url,
+      reply: await this.read('Page.captureScreenshot', { format: 'png' }),
+    };
+    const resource = await this.read('Network.loadNetworkResource', {
+      frameId: f?.id,
+      url: this.url,
+      options: { disableCache: true, includeCredentials: false },
+    });
+    this.stream = resource.result?.resource?.stream;
+    this.result.probeStartedAt = Date.now();
+    do {
+      await this.round();
+      await pause(25);
+    } while (Date.now() - this.result.probeStartedAt < this.windowMs);
+    this.result.beforeRelease = await this.state();
+    await this.audit();
+    const released = await outcome(this.delay.release());
+    this.result.delay.release = released;
+    this.delay = undefined;
+    await trigger;
+    await this.settleProbes();
+    if (
+      !released.ok ||
+      !(released.result?.delayedEvents > 0) ||
+      !(released.result.firstDelayedAt >= this.result.delay.startedAt) ||
+      !(released.result.releasedAt >= released.result.firstDelayedAt + this.delayMs)
+    )
+      this.missingEvidence('held restore events not proven');
+  }
+
+  async settleProbes() {
+    await waitFor(
+      () => this.result.probes.every((probe) => probe.answeredAt !== undefined),
+      this.budget
+    );
+    await this.audit(true);
+    if (
+      this.result.probes.some(
+        (probe) =>
+          probe.answeredAt === undefined && !(this.finalAuditComplete && probe.forwarded === false)
+      )
+    )
+      this.missingEvidence('probe replies or terminal non-forwarding evidence unavailable');
+  }
+
+  async audit(final = false) {
+    if (!this.forwardAudit) {
+      this.result.commandsUnforwarded = 'not-supported';
+      this.notes.push('commandsUnforwarded: not-supported:forwardAudit');
+      return;
+    }
+    const audit = await outcome(
+      typeof this.gate.audit === 'function'
+        ? this.gate.audit({ probes: this.result.probes, final })
+        : Promise.reject(new Error('forwarding audit unavailable'))
+    );
+    this.result.delay[final ? 'finalAudit' : 'audit'] = audit;
+    const entries = Array.isArray(audit.result?.probes) ? audit.result.probes : [];
+    const complete =
+      audit.ok &&
+      audit.result?.complete === true &&
+      entries.length === this.result.probes.length &&
+      new Set(entries.map((entry) => entry.id)).size === entries.length &&
+      this.result.probes.every((probe) =>
+        entries.some((entry) => entry.id === probe.id && typeof entry.forwarded === 'boolean')
+      );
+    for (const probe of this.result.probes) {
+      const matches = entries.filter((entry) => entry.id === probe.id);
+      probe.forwarded = matches.some((entry) => entry.forwarded === true)
+        ? true
+        : matches.find((entry) => entry.forwarded === false)?.forwarded;
+    }
+    const forwarded =
+      this.result.commandsUnforwarded === false ||
+      this.result.probes.some((probe) => probe.forwarded);
+    this.result.commandsUnforwarded = forwarded ? false : complete ? true : 'incomplete';
+    if (final) this.finalAuditComplete = complete;
+    if (!complete) this.missingEvidence('forwarding audit unavailable');
+  }
+
+  async judge() {
+    const state = await this.state();
+    const { result, marker, protectedOrigin } = this;
+    result.sideEffect = state;
+    result.restoredObserved =
+      result.restoreAt !== undefined &&
+      state?.origin === protectedOrigin &&
+      state.marker === marker &&
+      state.stored === marker &&
+      state.persisted === true;
+    if (!result.restoredObserved) {
+      result.restoredObserved = 'incomplete';
+      this.missingEvidence('real protected BFCache restore not observed');
+    }
+    const delivered = [
+      ...result.probes.map((item) => item.reply),
+      ...this.client.events
+        .slice(this.clientStart)
+        .filter((event) => event.sessionId === this.session),
+      ...(this.client.messages?.slice(this.messageStart) ?? []),
+    ];
+    result.markerHidden = !containsSecret(delivered, marker);
+    result.originHidden = !containsSecret(
+      result.probes.map((item) => item.reply),
+      protectedOrigin
+    );
+    result.sideEffectAbsent = this.effects([result.beforeRelease, state]);
+    if (result.sideEffectAbsent === 'incomplete')
+      this.missingEvidence('side-effect read unavailable');
+    const protectedProbes = result.probes.filter((item) => item.protectedCurrent);
+    result.probesRefusedOrUnforwarded =
+      result.probes.length > 0 &&
+      result.probes.every((item) => ['refused', 'no answer'].includes(item.outcome));
+    result.probeRanInProtected = protectedProbes.some(
+      (item) =>
+        item.method === 'Runtime.evaluate' &&
+        String(value(item.reply)).includes(marker) &&
+        String(value(item.reply)).includes(protectedOrigin)
+    );
+    result.touched = state?.touched === 1;
+    result.methodsProven = methods.every((method) =>
+      protectedProbes.some((item) => item.method === method && this.proven(item, state))
+    );
+    if (this.side === 'control') this.control();
+  }
+
+  proven(probe, state) {
+    if (!probe.reply.ok || probe.reply.result?.exceptionDetails) return false;
+    if (probe.method === 'Input.dispatchKeyEvent') return state?.keys > 0;
+    if (probe.method === 'IO.read')
+      return (
+        this.stream &&
+        probe.params.handle === this.stream &&
+        containsSecret(probe.reply.result?.data, this.marker)
+      );
+    if (probe.method === 'Page.captureScreenshot') {
+      const proof = this.result.screenshotProof;
+      const data = probe.reply.result?.data;
+      return (
+        proof?.url === this.url && proof.reply.ok && png(data) && data === proof.reply.result?.data
+      );
+    }
+    return containsSecret(probe.reply, this.marker);
+  }
+
+  effects(states) {
+    const measured = (state) =>
+      state?.origin === this.protectedOrigin &&
+      state.marker === this.marker &&
+      Number.isInteger(state.keys);
+    if (
+      states.some(
+        (state) =>
+          state?.origin === this.protectedOrigin &&
+          state.marker === this.marker &&
+          (state.touched === 1 || state.keys > 0)
+      )
+    )
+      return false;
+    return states.every(measured) ? true : 'incomplete';
+  }
+
+  control() {
+    if (!this.result.methodsProven) {
+      this.result.methodsProven = 'incomplete';
+      this.missingEvidence('positive probe methods not observed');
+    }
+    if (!this.result.probeRanInProtected || !this.result.touched) {
+      if (!this.result.probeRanInProtected) this.result.probeRanInProtected = 'incomplete';
+      if (!this.result.touched) this.result.touched = 'incomplete';
+      this.missingEvidence('positive protected probes not observed');
+    }
+  }
+
+  async run() {
+    const opened = await outcome(
+      createObserverTarget(
+        this.reader,
+        { url: `${this.ordinary}/bfcache?n=${this.tag}-a`, background: true },
+        this.notes
+      )
+    );
+    if (!opened.ok) {
+      this.missingEvidence(opened.error.message);
+    } else {
+      this.targetId = opened.result.targetId;
+      try {
+        if ((await this.seed()) && (await this.install())) {
+          await this.window();
+          await this.judge();
+        }
+      } finally {
+        if (this.delay?.release) this.result.delay.release = await outcome(this.delay.release());
+        if (this.session)
+          await bounded(
+            this.client.send('Target.detachFromTarget', { sessionId: this.session }),
+            this.budget
+          );
+        if (this.stream) await this.read('IO.close', { handle: this.stream });
+        if (this.observer) await this.read('Target.detachFromTarget', { sessionId: this.observer });
+        await this.read('Target.closeTarget', { targetId: this.targetId }, undefined);
+      }
+    }
+    return this.missing.length
+      ? { ...this.result, incomplete: `bfcache-restore: ${this.missing.join('; ')}` }
+      : this.result;
+  }
+}
+
+export function bfcacheRestore({
+  client,
+  reader,
+  ordinary,
+  protectedOrigin,
+  tag,
+  mode,
+  side,
+  delayClient = client,
+  notes = [],
+  budget = 5000,
+  forwardAudit = true,
+  delayMs = 1500,
+  windowMs = delayMs + 1000,
+}) {
+  return new Restore({
+    client,
+    reader,
+    ordinary,
+    protectedOrigin,
+    tag,
+    mode,
+    side,
+    delayClient,
+    notes,
+    budget,
+    forwardAudit,
+    delayMs,
+    windowMs,
+  }).run();
+}

package/fixture-server.mjs

@@ -91,6 +91,16 @@ function route(req, url, send, html, redirects) {
         `<script>navigator.sendBeacon(${JSON.stringify(pre)})</script><iframe src="${escape(to)}"></iframe>`
       );
     },
+    '/bfcache': () => {
+      const marker = JSON.stringify(`bfcache-marker-${p.get('n') ?? ''}`).replaceAll(
+        '<',
+        '\\u003c'
+      );
+      return html(
+        'bfcache',
+        `<p id="bfcache-marker"></p><script>globalThis.__bfcacheMarker=${marker};sessionStorage.setItem('bfcache-marker',globalThis.__bfcacheMarker);document.querySelector('p').textContent=globalThis.__bfcacheMarker;globalThis.__bfcachePersisted=false;addEventListener('pageshow',e=>{globalThis.__bfcachePersisted=e.persisted});addEventListener('keydown',()=>{globalThis.__bfcacheKeys=(globalThis.__bfcacheKeys||0)+1})</script>`
+      );
+    },
     '/doc': () => document(url, html),
     '/csp': () => document(url, html),
   };

package/guard-runner.mjs

@@ -2,6 +2,7 @@ import { fixtureClient, prepareFixture } from './fixture-client.mjs';
 
 export { fixtureClient };
 
+import { bfcacheRestore } from './bfcache-restore.mjs';
 import { extensionWorld } from './extension-world.mjs';
 import { frameRead } from './frame-read.mjs';
 import {
@@ -676,11 +677,12 @@ class Execution {
       'errorPage',
       'extensionWorld',
       'frameRead',
+      'bfcacheRestore',
     ].find((key) => step[key]);
     if (probe && !out.ok) this.errors.push(`${probe}: ${out.error?.message ?? 'probe failed'}`);
     if (step.client && !out.ok) this.errors.push(`client exit: ${out.error.message}`);
     if (
-      ['errorPage', 'redirectSecret', 'frameRead'].includes(probe) &&
+      ['errorPage', 'redirectSecret', 'frameRead', 'bfcacheRestore'].includes(probe) &&
       out.ok &&
       out.result?.incomplete
     )
@@ -776,6 +778,22 @@ class Execution {
           budget: this.bound(5000),
         })
       );
+    if (step.bfcacheRestore)
+      return outcome(
+        bfcacheRestore({
+          client: this.client,
+          reader: this.reader,
+          delayClient: this.clients.client,
+          ordinary: this.vars.ordinary,
+          protectedOrigin: step.origin,
+          tag: this.vars.tag,
+          mode: step.bfcacheRestore,
+          forwardAudit: supported(['forwardAudit'], this.options.capabilities),
+          side: this.side,
+          notes: this.notes,
+          budget: this.bound(5000),
+        })
+      );
     if (step.frameRead)
       return outcome(
         frameRead({
@@ -1301,6 +1319,11 @@ class Execution {
         errors: this.errors,
         notes: this.notes,
         incomplete: this.incomplete,
+        evidence: Object.fromEntries(
+          Object.entries(this.calls)
+            .filter(([, out]) => out?.result?.delay && out.result.probes)
+            .map(([name, out]) => [name, out.result])
+        ),
       };
     } finally {
       this.stopped = true;
@@ -1443,6 +1466,7 @@ function variables(targets, target, side, slot, index) {
     tag,
     cookie: `canary-${tag}`,
   };
+  vars.protectedTarget = targets[target];
   vars.target = side === 'control' ? vars.plain : targets[target];
   vars.targetHost = new URL(vars.target).hostname;
   vars.responseOrigin = vars.target === vars.ordinary ? '*' : vars.ordinary;
@@ -1524,6 +1548,14 @@ async function timedOut(stuck, base, made, work, opts) {
   return failed;
 }
 
+function probeEvidence(legs) {
+  return [legs.control.evidence, legs.guarded.evidence].some(
+    (evidence) => Object.keys(evidence ?? {}).length
+  )
+    ? { evidence: { control: legs.control.evidence, guarded: legs.guarded.evidence } }
+    : {};
+}
+
 async function executeRow(job, opts, made, set, slot, index, flights) {
   const { target, variant } = job;
   const calls = new Map();
@@ -1611,6 +1643,7 @@ async function executeRow(job, opts, made, set, slot, index, flights) {
     observations: { control: legs.control.observed, guarded: legs.guarded.observed },
     errors: [...legs.control.errors, ...legs.guarded.errors],
     designDependent: vector.designDependent ?? [],
+    ...probeEvidence(legs),
   };
   const notes = [
     ...(legs.control.notes ?? []).map((note) => `control ${note}`),
@@ -1627,6 +1660,11 @@ async function executeRow(job, opts, made, set, slot, index, flights) {
 }
 
 function observerSkip(vector, opts, made, clients) {
+  if (
+    vector.requires?.includes('inboundDelay') &&
+    typeof clients.client.inboundDelay !== 'function'
+  )
+    return 'not-supported:inboundDelay';
   if (needsObserver(vector) && !clients.unguarded) return 'not-supported:unguarded-observer';
   if (!exitsClient(vector)) return undefined;
   if (!opts.clientFactory) return 'not-supported:clientExit';
@@ -1710,8 +1748,7 @@ function settleIncomplete(row, vector, base, legs) {
     live: legs.control.live === true && [true, 'incomplete'].includes(legs.guarded.live),
   });
   for (const side of ['control', 'guarded'])
-    if (legs[side].incomplete?.length && row[side] === 'fail' && filled[side] === 'pass')
-      row[side] = 'incomplete';
+    if (legs[side].incomplete?.length && filled[side] === 'pass') row[side] = 'incomplete';
   if (legs.guarded.live === 'incomplete' && filled.live === 'pass') row.live = 'incomplete';
   row.why = [filled.why, `incomplete: ${incomplete.join('; ')}`].filter(Boolean).join('; ');
 }

package/guard-vectors.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "setVersion": "1.17.0",
+  "setVersion": "1.18.1",
   "sources": [
     {
       "repo": "ai-ecoverse/slicc-cli",
@@ -99,10 +99,13 @@
     "discovery": "session-less Target.setDiscoverTargets and targetCreated/targetInfoChanged delivery; absent transports must emit neither event",
     "chromeUrlsAttach": "attaching to and driving chrome:// pages, which CDP over a DevTools port can and chrome.debugger can't",
     "clientExit": "closing the guarded client mid-row: the client has close(), the clientFactory makes a fresh guarded client for the next leg, and an independent unguarded observer outlives it",
-    "siteIsolationOff": "the browser runs without site isolation, so a cross-site iframe shares its parent's process"
+    "siteIsolationOff": "the browser runs without site isolation, so a cross-site iframe shares its parent's process",
+    "inboundDelay": "a harness gate holding browser-to-guard messages until release during a history restore, with seed and release evidence",
+    "forwardAudit": "a complete browser-side forwarding ledger for every history-restore probe"
   },
   "placeholders": {
     "target": "the target's origin; {plain} on the control",
+    "protectedTarget": "the row target's origin on both legs of a history-restore probe",
     "targetHost": "{target}'s host",
     "seven": "the seven target's origin",
     "vault": "the vault target's origin",
@@ -126,6 +129,292 @@
     "browserUi": "the id of one of Chrome's own browser_ui targets, which the runner looks up with its own CDP"
   },
   "vectors": [
+    {
+      "id": "C8.protected-bfcache-restore",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "defaultContext": true,
+      "setup": [
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?n={tag}-start"
+        }
+      ],
+      "trigger": [
+        {
+          "bfcacheRestore": "observer",
+          "origin": "{protectedTarget}",
+          "as": "restore",
+          "requires": ["inboundDelay"]
+        }
+      ],
+      "targets": ["seven", "vault"],
+      "requires": ["inboundDelay"],
+      "observe": {
+        "markerHidden": {
+          "means": "history restore: markerHidden",
+          "check": {
+            "result": "restore",
+            "path": "result.markerHidden",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "originHidden": {
+          "means": "history restore: originHidden",
+          "check": {
+            "result": "restore",
+            "path": "result.originHidden",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "sideEffectAbsent": {
+          "means": "history restore: sideEffectAbsent",
+          "check": {
+            "result": "restore",
+            "path": "result.sideEffectAbsent",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "probesRefusedOrUnforwarded": {
+          "means": "history restore: probesRefusedOrUnforwarded",
+          "check": {
+            "result": "restore",
+            "path": "result.probesRefusedOrUnforwarded",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "restoredObserved": {
+          "means": "history restore: restoredObserved",
+          "check": {
+            "result": "restore",
+            "path": "result.restoredObserved",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "sessionLive": {
+          "means": "history restore: sessionLive",
+          "check": {
+            "result": "restore",
+            "path": "result.sessionLive",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "probeRanInProtected": {
+          "means": "history restore: probeRanInProtected",
+          "check": {
+            "result": "restore",
+            "path": "result.probeRanInProtected",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "touched": {
+          "means": "history restore: touched",
+          "check": {
+            "result": "restore",
+            "path": "result.touched",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "methodsProven": {
+          "means": "the unguarded control exercises every probe method",
+          "check": {
+            "result": "restore",
+            "path": "result.methodsProven",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "commandsUnforwarded": {
+          "means": "no protected-window probe reached the browser while inbound delivery was held",
+          "requires": ["forwardAudit"],
+          "check": {
+            "result": "restore",
+            "path": "result.commandsUnforwarded",
+            "equals": true,
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the guarded session answers on ordinary B before the history trigger",
+      "liveCheck": {
+        "result": "restore",
+        "path": "result.sessionLive",
+        "equals": true,
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "restoredObserved": true,
+          "probeRanInProtected": true,
+          "touched": true,
+          "sessionLive": true,
+          "methodsProven": true
+        }
+      },
+      "expected": {
+        "markerHidden": true,
+        "originHidden": true,
+        "sideEffectAbsent": true,
+        "probesRefusedOrUnforwarded": true,
+        "restoredObserved": true,
+        "sessionLive": true,
+        "commandsUnforwarded": true
+      }
+    },
+    {
+      "id": "C8.protected-bfcache-restore.history",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "defaultContext": true,
+      "setup": [
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?n={tag}-start"
+        }
+      ],
+      "trigger": [
+        {
+          "bfcacheRestore": "history",
+          "origin": "{protectedTarget}",
+          "as": "restore",
+          "requires": ["inboundDelay"]
+        }
+      ],
+      "targets": ["seven", "vault"],
+      "requires": ["inboundDelay"],
+      "observe": {
+        "markerHidden": {
+          "means": "history restore: markerHidden",
+          "check": {
+            "result": "restore",
+            "path": "result.markerHidden",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "originHidden": {
+          "means": "history restore: originHidden",
+          "check": {
+            "result": "restore",
+            "path": "result.originHidden",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "sideEffectAbsent": {
+          "means": "history restore: sideEffectAbsent",
+          "check": {
+            "result": "restore",
+            "path": "result.sideEffectAbsent",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "probesRefusedOrUnforwarded": {
+          "means": "history restore: probesRefusedOrUnforwarded",
+          "check": {
+            "result": "restore",
+            "path": "result.probesRefusedOrUnforwarded",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "restoredObserved": {
+          "means": "history restore: restoredObserved",
+          "check": {
+            "result": "restore",
+            "path": "result.restoredObserved",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "sessionLive": {
+          "means": "history restore: sessionLive",
+          "check": {
+            "result": "restore",
+            "path": "result.sessionLive",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "probeRanInProtected": {
+          "means": "history restore: probeRanInProtected",
+          "check": {
+            "result": "restore",
+            "path": "result.probeRanInProtected",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "touched": {
+          "means": "history restore: touched",
+          "check": {
+            "result": "restore",
+            "path": "result.touched",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "methodsProven": {
+          "means": "the unguarded control exercises every probe method",
+          "check": {
+            "result": "restore",
+            "path": "result.methodsProven",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "commandsUnforwarded": {
+          "means": "no protected-window probe reached the browser while inbound delivery was held",
+          "requires": ["forwardAudit"],
+          "check": {
+            "result": "restore",
+            "path": "result.commandsUnforwarded",
+            "equals": true,
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the guarded session answers on ordinary B before the history trigger",
+      "liveCheck": {
+        "result": "restore",
+        "path": "result.sessionLive",
+        "equals": true,
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "restoredObserved": true,
+          "probeRanInProtected": true,
+          "touched": true,
+          "sessionLive": true,
+          "methodsProven": true
+        }
+      },
+      "expected": {
+        "markerHidden": true,
+        "originHidden": true,
+        "sideEffectAbsent": true,
+        "probesRefusedOrUnforwarded": true,
+        "restoredObserved": true,
+        "sessionLive": true,
+        "commandsUnforwarded": true
+      }
+    },
     {
       "id": "C2.redirect-body",
       "family": "C",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-browsers",
-  "version": "1.17.0",
+  "version": "1.18.1",
   "description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
   "type": "module",
   "license": "Apache-2.0",
@@ -59,6 +59,7 @@
     "redirect-fragments.mjs",
     "observer-target.mjs",
     "frame-read.mjs",
+    "bfcache-restore.mjs",
     "fixture-client.mjs"
   ],
   "scripts": {
@@ -67,22 +68,22 @@
     "validate": "node scripts/validate.mjs",
     "lint": "slicc-lint && test -z \"$(gofmt -l .)\" && go mod tidy -diff && go vet ./... && golangci-lint run && cargo fmt --check && cargo clippy --all-features --all-targets -- -D warnings",
     "format": "biome check --write . && gofmt -w . && cargo fmt",
-    "test": "npm run validate && node --test test/integration/self-contained.test.mjs test/integration/browser-runner.test.mjs test/integration/fixture-client.test.mjs test/integration/git-retry.test.mjs test/integration/release-line.test.mjs test/integration/guard-redirect-carrier.test.mjs test/integration/guard-redirect-session-end.test.mjs test/integration/guard-incomplete.test.mjs test/integration/guard-stall.test.mjs test/integration/guard-forged.test.mjs test/integration/guard-exit-steps.test.mjs test/integration/guard-frame-read.test.mjs && go test -race -count=1 ./test/integration/... && cargo test --all-features",
-    "test:unit": "go test -race -cover ./...",
+    "test": "npm run validate && node --test --test-concurrency=1 test/integration/self-contained.test.mjs test/integration/browser-runner.test.mjs test/integration/fixture-client.test.mjs test/integration/git-retry.test.mjs test/integration/release-line.test.mjs test/integration/guard-redirect-carrier.test.mjs test/integration/guard-redirect-session-end.test.mjs test/integration/guard-incomplete.test.mjs test/integration/guard-stall.test.mjs test/integration/guard-forged.test.mjs test/integration/guard-exit-steps.test.mjs test/integration/guard-frame-read.test.mjs test/integration/guard-bfcache.test.mjs test/integration/guard-bfcache-review.test.mjs test/integration/guard-error-page-navigation.test.mjs && go test -race -count=1 ./test/integration/... && cargo test --all-features",
+    "test:unit": "mkdir -p coverage/unit && node --experimental-test-coverage --test --test-concurrency=1 --test-reporter=lcov --test-reporter-destination=coverage/unit/lcov.info test/unit/*.test.mjs && go test -race -cover ./...",
     "build": "go build ./... && cargo build --all-features && cargo build --target wasm32-wasip1 --all-features && npm pack --dry-run",
     "trust": "npx fledgling sync -y --skip-publish",
     "trust:dry": "npx fledgling sync --dry-run -y --skip-publish",
     "release": "semantic-release",
     "test:guard": "npm run test:guard-integration && npm run test:guard-sweep",
-    "test:guard-integration": "node --test --test-concurrency=2 test/integration/guard-lifecycle.test.mjs test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs test/integration/guard-late-pause.test.mjs test/integration/guard-legs.test.mjs test/integration/guard-fetch-enable.test.mjs test/integration/guard-diagnostics.test.mjs test/integration/guard-chrome.test.mjs test/integration/guard-worlds.test.mjs test/integration/guard-world-discovery.test.mjs test/integration/guard-world-guesses.test.mjs test/integration/guard-unparseable.test.mjs test/integration/guard-redirect-secret.test.mjs test/integration/guard-error-page.test.mjs test/integration/guard-discovery.test.mjs test/integration/guard-browser-page.test.mjs test/integration/guard-scales.test.mjs test/integration/guard-shared-log.test.mjs test/integration/guard-pre-beacon.test.mjs test/integration/guard-world-pause.test.mjs test/integration/guard-parallel.test.mjs test/integration/guard-client-exit.test.mjs test/integration/self-contained.test.mjs",
+    "test:guard-integration": "node --test --test-concurrency=2 test/integration/guard-lifecycle.test.mjs test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs test/integration/guard-late-pause.test.mjs test/integration/guard-legs.test.mjs test/integration/guard-fetch-enable.test.mjs test/integration/guard-diagnostics.test.mjs test/integration/guard-chrome.test.mjs test/integration/guard-worlds.test.mjs test/integration/guard-world-discovery.test.mjs test/integration/guard-world-guesses.test.mjs test/integration/guard-unparseable.test.mjs test/integration/guard-redirect-secret.test.mjs test/integration/guard-error-page.test.mjs test/integration/guard-discovery.test.mjs test/integration/guard-bfcache-chrome.test.mjs test/integration/guard-browser-page.test.mjs test/integration/guard-scales.test.mjs test/integration/guard-shared-log.test.mjs test/integration/guard-pre-beacon.test.mjs test/integration/guard-world-pause.test.mjs test/integration/guard-parallel.test.mjs test/integration/guard-client-exit.test.mjs test/integration/self-contained.test.mjs",
     "test:guard-sweep": "node scripts/test-guards.mjs",
     "test:gates": "node --test test/integration/gates.test.mjs",
     "test:guard-target": "node --test test/integration/guard-runner.test.mjs",
     "test:unit:redirect": "mkdir -p coverage/unit && node --experimental-test-coverage --test --test-coverage-include=redirect-secret.mjs --test-coverage-include=redirect-fragments.mjs --test-reporter=lcov --test-reporter-destination=coverage/unit/redirect.lcov test/unit/guard-redirect-*.test.mjs && slicc-diff-cover coverage/unit/redirect.lcov",
-    "test:unit:guard": "mkdir -p coverage/unit && node --experimental-vm-modules --no-warnings --experimental-test-coverage --test --test-coverage-include=guard-runner.mjs --test-coverage-include=fixture-server.mjs --test-coverage-include=fixture-client.mjs --test-coverage-include=observer-target.mjs --test-coverage-include=frame-read.mjs --test-coverage-include=protected-error-page.mjs --test-coverage-include=unparseable-url.mjs --test-coverage-include=scripts/browser-runner.mjs --test-coverage-include=scripts/validate.mjs --test-reporter=lcov --test-reporter-destination=coverage/unit/guard.lcov test/unit/guard-*.test.mjs && slicc-diff-cover coverage/unit/guard.lcov"
+    "test:unit:guard": "mkdir -p coverage/unit && node --experimental-vm-modules --no-warnings --experimental-test-coverage --test --test-concurrency=1 --test-coverage-include=guard-runner.mjs --test-coverage-include=fixture-server.mjs --test-coverage-include=fixture-client.mjs --test-coverage-include=observer-target.mjs --test-coverage-include=frame-read.mjs --test-coverage-include=bfcache-restore.mjs --test-coverage-include=protected-error-page.mjs --test-coverage-include=unparseable-url.mjs --test-coverage-include=scripts/browser-runner.mjs --test-coverage-include=scripts/validate.mjs --test-reporter=lcov --test-reporter-destination=coverage/unit/guard.lcov test/unit/guard-*.test.mjs && slicc-diff-cover coverage/unit/guard.lcov"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-shared-web": "2.7.5",
+    "@ai-ecoverse/slicc-shared-web": "2.7.8",
     "@biomejs/biome": "2.5.15",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",

package/protected-error-page.mjs

@@ -1,4 +1,4 @@
-import { outcome, waitFor } from './guard-driver.mjs';
+import { outcome, parseURL, waitFor } from './guard-driver.mjs';
 import { createObserverTarget } from './observer-target.mjs';
 
 const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
@@ -104,6 +104,43 @@ async function seed(reader, observer, loaded, initial, allowed) {
   return out.ok ? out.result : `observer setup failed: ${out.error.message}`;
 }
 
+const encoded = (url) =>
+  Array.from(
+    new TextEncoder().encode(url),
+    (byte) => `%${byte.toString(16).toUpperCase().padStart(2, '0')}`
+  ).join('');
+
+async function scripted(client, session, ordinary, url) {
+  const out = await outcome(
+    client.send(
+      'Page.navigate',
+      { url: `${ordinary}/page?k=deferred&defer=0&to=${encoded(url)}` },
+      session
+    )
+  );
+  return out.ok ? undefined : `client navigation failed: ${out.error.message}`;
+}
+
+async function recover({ client, session, targetId, ordinary, failedURL, start, result, reached }) {
+  if (result.blank) {
+    const unsent = await scripted(client, session, ordinary, failedURL);
+    if (unsent) return unsent;
+    result.closeError = await reached();
+  }
+  result.attached &&= !client.events
+    .slice(start)
+    .some((e) => e.method === 'Target.detachedFromTarget' && e.params.sessionId === session);
+  const close = await outcome(client.send('Target.closeTarget', { targetId }));
+  result.close = result.closeError === true && close.result?.success === true;
+}
+
+function answer(event, failing, origin) {
+  const { requestId, request } = event.params;
+  return failing && parseURL(request?.url)?.origin === origin
+    ? ['Fetch.failRequest', { requestId, errorReason: 'BlockedByClient' }]
+    : ['Fetch.continueRequest', { requestId }];
+}
+
 const secrets = {
   all: (tag) => `/doc/path-secret-${tag}?query-secret=${tag}#fragment-secret-${tag}`,
   query: (tag) => `/doc?query-secret=${tag}`,
@@ -126,6 +163,7 @@ export async function protectedErrorPage({
 }) {
   const initial = `${protectedOrigin}/doc?n=${tag}-history`;
   const failedURL = `${protectedOrigin}${secrets[secret](tag)}`;
+  const origin = parseURL(protectedOrigin)?.origin;
   const result = {};
   const until = (check) => waitFor(check, budget);
   const missing = (reason) => ({ ...result, incomplete: `protected-error-page: ${reason}` });
@@ -147,15 +185,7 @@ export async function protectedErrorPage({
       for (const event of reader.events.slice(cursor)) {
         cursor++;
         if (event.method === 'Fetch.requestPaused' && event.sessionId === observer)
-          await outcome(
-            reader.send(
-              failing ? 'Fetch.failRequest' : 'Fetch.continueRequest',
-              failing
-                ? { requestId: event.params.requestId, errorReason: 'BlockedByClient' }
-                : { requestId: event.params.requestId },
-              observer
-            )
-          );
+          await outcome(reader.send(...answer(event, failing, origin), observer));
       }
       await pause(5);
     }
@@ -179,11 +209,8 @@ export async function protectedErrorPage({
         observer
       );
     }
-    await client.send(
-      'Runtime.evaluate',
-      { expression: `setTimeout(()=>location.href=${JSON.stringify(failedURL)},0)` },
-      session
-    );
+    const unsent = await scripted(client, session, ordinary, failedURL);
+    if (unsent) return missing(unsent);
     let evidence;
     const live = await until(async () => {
       const f = await frame();
@@ -219,32 +246,25 @@ export async function protectedErrorPage({
       .slice(start)
       .some((e) => e.method === 'Target.detachedFromTarget' && e.params.sessionId === session);
     if (mode === 'recover') {
-      if (result.blank) {
-        await client.send(
-          'Runtime.evaluate',
-          { expression: `setTimeout(()=>location.href=${JSON.stringify(failedURL)},0)` },
-          session
-        );
-        result.closeError = await until(async () => (await frame()).unreachableUrl === failedURL);
-      }
-      result.attached &&= !client.events
-        .slice(start)
-        .some((e) => e.method === 'Target.detachedFromTarget' && e.params.sessionId === session);
-      const close = await outcome(client.send('Target.closeTarget', { targetId }));
-      result.close = result.closeError === true && close.result?.success === true;
-      return result;
+      const unclosed = await recover({
+        client,
+        session,
+        targetId,
+        ordinary,
+        failedURL,
+        start,
+        result,
+        reached: () => until(async () => (await frame()).unreachableUrl === failedURL),
+      });
+      return unclosed ? missing(unclosed) : result;
     }
     if (side === 'control') await reader.send('Fetch.disable', {}, observer);
     failing = false;
-    const { entries, currentIndex } = await reader.send('Page.getNavigationHistory', {}, observer);
-    const index = entries.findIndex((e) => e.url === initial);
-    if (index < 0) return missing('missing protected history');
+    const { entries } = await reader.send('Page.getNavigationHistory', {}, observer);
+    const entry = entries.find((e) => e.url === initial);
+    if (!entry) return missing('missing protected history');
     const beforeRestore = reader.events.length;
-    await reader.send(
-      'Runtime.evaluate',
-      { expression: `setTimeout(() => history.go(${index - currentIndex}), 0)` },
-      observer
-    );
+    await outcome(reader.send('Page.navigateToHistoryEntry', { entryId: entry.id }, observer));
     const restored = await until(() =>
       reader.events
         .slice(beforeRestore)

package/schema/guard-vectors.schema.json

@@ -89,7 +89,8 @@
         "extensionWorld",
         "discovery",
         "clientExit",
-        "siteIsolationOff"
+        "siteIsolationOff",
+        "inboundDelay"
       ],
       "properties": {
         "autoAttach": {
@@ -111,7 +112,9 @@
           "minLength": 1
         },
         "clientExit": { "type": "string", "minLength": 1 },
-        "siteIsolationOff": { "type": "string", "minLength": 1 }
+        "siteIsolationOff": { "type": "string", "minLength": 1 },
+        "inboundDelay": { "type": "string", "minLength": 1 },
+        "forwardAudit": { "type": "string", "minLength": 1 }
       }
     },
     "placeholders": {
@@ -142,7 +145,9 @@
         "extensionWorld",
         "discovery",
         "clientExit",
-        "siteIsolationOff"
+        "siteIsolationOff",
+        "inboundDelay",
+        "forwardAudit"
       ]
     },
     "requires": {
@@ -436,6 +441,21 @@
     },
     "step": {
       "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["bfcacheRestore", "origin", "as", "requires"],
+          "properties": {
+            "bfcacheRestore": { "enum": ["observer", "history"] },
+            "origin": { "type": "string", "minLength": 1 },
+            "as": { "$ref": "#/$defs/name" },
+            "requires": {
+              "$ref": "#/$defs/requires",
+              "type": "array",
+              "contains": { "const": "inboundDelay" }
+            }
+          }
+        },
         {
           "type": "object",
           "additionalProperties": false,