@ai-ecoverse/slicc-browsers 1.18.1 → 1.18.4

package/README.md

@@ -195,11 +195,11 @@ The `C9` foreign extension isolated-world family requires `extensionWorld`: a br
 
 The integration launcher loads shared-web 1.25.2’s harness extension exactly once through `Extensions.loadUnpacked` (`ankmbodmgimjemnojmeddfcdlbocolob`), whose content script runs on HTTP(S) pages. shared-web 1.25.2 also loads it by default in its own harness. A transport unable to host a foreign content-script extension omits `extensionWorld` and reports `not-supported:extensionWorld`; an advertised capability with no observed world fails, rather than silently skipping.
 
-`C2.redirect-secret` probes ordinary fixture 302s to seven’s `/auth/callback?code=…&state=…` and vault’s `/oauth/mcp-callback?code=…`, plus `#access_token=…` variants of both. It navigates with Page and scripted `location.href`, fetches a subresource and sends an XHR. After each one it waits, at least 250 ms and up to two seconds scaled by `settleScale` (stall-tolerant), for the fixture to log the redirect URL and every request seen for it to end, before it navigates away. On the guarded leg, once one action's wait times out, the remaining actions skip it, so a guard that never terminates costs that bound once per leg. The 302 carries `Location`, `Content-Location`, `Refresh: 0;url=…` and `Link: <…>; rel=preconnect`. Page, Network (including ExtraInfo), Runtime, Log, Audits and both Fetch stages are enabled. Every received raw message is scanned, including replies but not the probe’s own observer session traffic, across an eight-second tail, for raw, percent-encoded, JSON-escaped and base64 marker representations. Both response-body APIs are attempted on each hop; guarded bodies need matched refusals. `Network.getResponseBody` is attempted, once per id, with every network id the client learns for a 301–308 hop: the `requestId` of a Network event carrying the redirect status and the `networkId` of the Fetch response-stage pause. For each registered hop whose id the client learned neither way, the probe reads the hop’s real id from the harness’s own unguarded tap (the observer session, which enables Network on the guarded leg) and attempts the read on the guarded session with it. The evidence’s `networkBodyCarriers` counts the ids per carrier, and `networkBodyPath` names the weakest carrier any id needed: `withheld+tap`, then `fetch-networkId`, then `network`, or `none` without any id. These reads never hold up a Fetch pause, and the probe gives them five seconds after `Fetch.disable` to settle, and again after the terminal wait for reads that late events started. A read still unanswered then is not a refusal. `networkBodyAttempted` and `networkBodyRefused` hold only when every attempt is refused. On the guarded leg a `fetch-networkId` or `withheld+tap` carrier also needs the same row’s unguarded control to have seen the redirect’s Network events. Without that proof, or with no id at all, both read `incomplete` and the probe returns `redirect-secret: network body leg <reason>`; an attempt that is not refused is measured and fails. Every request the client sees for a registered redirect URL, through its initial `Network.requestWillBeSent` or a redirect `requestWillBeSent` whose `redirectResponse.url` is that URL, must end within the step in a redirect `requestWillBeSent`, `loadingFinished` or `loadingFailed` for that `requestId`. Before the evidence is evaluated, on every leg, the probe waits up to five seconds scaled by `settleScale` (stall-tolerant) for every seen request to reach one of those events. The evidence’s `hops` records per `requestId` the `delivery` (`redacted` for an origin-only protected redirect in place, `withheld` for a terminal without the redirect, `ordinary`, `raw` or `unterminated`) and the `terminal` event method. On the guarded leg `requestsTerminated` is false on any `unterminated` request after that wait, a measured guard failure rather than missing evidence; on the unguarded control an `unterminated` request is missing evidence, so `requestsTerminated` reads `incomplete` and the probe returns `redirect-secret: control requests <ids> unterminated`; `hopsRedacted` is false on any `raw` or `ordinary` hop, so a delivered protected hop must be origin-only, never the raw or a substituted URL; the guarded leg expects it. Page frame trees, resource trees and navigation history are read before recovery to catch error-page leftovers. A separate structural check requires every protected `Network.Request.urlFragment` and `Page.Frame.urlFragment` to be empty or absent, even if its value contains no marker; the ordinary `#access_token` control independently requires fragment evidence in request events, frame events, frame-tree replies and resource-tree replies. The ordinary session must survive. The unguarded ordinary redirect control preserves all four headers in `redirectResponse`, ExtraInfo’s headers and `headersText`, and Fetch’s response headers. `C2.redirect-secret-mix` repeats that matrix with 301/303/307/308. The protected leg requires in-place ExtraInfo delivery with origin-only header values, not merely the absence of a marker.
+`C2.redirect-secret` probes ordinary fixture 302s to seven’s `/auth/callback?code=…&state=…` and vault’s `/oauth/mcp-callback?code=…`, plus `#access_token=…` variants of both. It navigates with Page and scripted `location.href`, fetches a subresource and sends an XHR. After each one it waits, at least 250 ms and up to two seconds scaled by `settleScale` (stall-tolerant), for the fixture to log the redirect URL and every request seen for it to end, before it navigates away. On the guarded leg, once one action's wait times out, the remaining actions skip it, so a guard that never terminates costs that bound once per leg. The 302 carries `Location`, `Content-Location`, `Refresh: 0;url=…` and `Link: <…>; rel=preconnect`. Page, Network (including ExtraInfo), Runtime, Log, Audits and both Fetch stages are enabled. Every received raw message is scanned, including replies; only traffic proven to belong to the shared unguarded observer is excluded. The scan runs across an eight-second tail, for raw, percent-encoded, JSON-escaped and base64 marker representations. Both response-body APIs are attempted on each hop; guarded bodies need matched refusals. `Network.getResponseBody` is attempted, once per id, with every network id the client learns for a 301–308 hop: the `requestId` of a Network event carrying the redirect status and the `networkId` of the Fetch response-stage pause. For each registered hop whose id the client learned neither way, the probe reads the hop’s real id from the harness’s own unguarded tap (the observer session, which enables Network on the guarded leg) and attempts the read on the guarded session with it. The evidence’s `networkBodyCarriers` counts the ids per carrier, and `networkBodyPath` names the weakest carrier any id needed: `withheld+tap`, then `fetch-networkId`, then `network`, or `none` without any id. These reads never hold up a Fetch pause, and the probe gives them five seconds after `Fetch.disable` to settle, and again after the terminal wait for reads that late events started. A read still unanswered then is not a refusal. `networkBodyAttempted` and `networkBodyRefused` hold only when every attempt is refused. On the guarded leg a `fetch-networkId` or `withheld+tap` carrier also needs the same row’s unguarded control to have seen the redirect’s Network events. Without that proof, or with no id at all, both read `incomplete` and the probe returns `redirect-secret: network body leg <reason>`; an attempt that is not refused is measured and fails. Every request the client sees for a registered redirect URL, through its initial `Network.requestWillBeSent` or a redirect `requestWillBeSent` whose `redirectResponse.url` is that URL, must end within the step in a redirect `requestWillBeSent`, `loadingFinished` or `loadingFailed` for that `requestId`. Before the evidence is evaluated, on every leg, the probe waits up to five seconds scaled by `settleScale` (stall-tolerant) for every seen request to reach one of those events. The evidence’s `hops` records per `requestId` the `delivery` (`redacted` for an origin-only protected redirect in place, `withheld` for a terminal without the redirect, `ordinary`, `raw` or `unterminated`) and the `terminal` event method. On the guarded leg `requestsTerminated` is false on any `unterminated` request after that wait, a measured guard failure rather than missing evidence; on the unguarded control an `unterminated` request is missing evidence, so `requestsTerminated` reads `incomplete` and the probe returns `redirect-secret: control requests <ids> unterminated`; `hopsRedacted` is false on any `raw` or `ordinary` hop, so a delivered protected hop must be origin-only, never the raw or a substituted URL; the guarded leg expects it. Page frame trees, resource trees and navigation history are read before recovery to catch error-page leftovers. Recovery and each following action use a fresh ordinary tab, never a tab whose history contains the protected destination. Each request's body reads stay on its owning client session; all probe tabs and observers remain alive through the eight-second tail and terminal/body-read waits. A closed body owner leaves that read `incomplete`, not `sessionEnded`; another live owner of the same request id is still read. A closed retained tab does not cut the tail or the remaining actions short. `sessionSurvives` proves the client can evaluate the title in a fresh ordinary tab. A content-command refusal in a protected-history tab is not itself a failure; every received message still enters the leak checks. Missing recovery evidence or an unseen override pause is `incomplete`, not a pass. A measured leak takes precedence over incomplete evidence. A separate structural check requires every protected `Network.Request.urlFragment` and `Page.Frame.urlFragment` to be empty or absent, even if its value contains no marker; the ordinary `#access_token` control independently requires fragment evidence in request events, frame events, frame-tree replies and resource-tree replies. The ordinary session must survive. The unguarded ordinary redirect control preserves all four headers in `redirectResponse`, ExtraInfo’s headers and `headersText`, and Fetch’s response headers. `C2.redirect-secret-mix` repeats that matrix with 301/303/307/308. The protected leg requires in-place ExtraInfo delivery with origin-only header values, not merely the absence of a marker.
 
 `C2.redirect-body` calls `Network.loadNetworkResource` on an ordinary redirect with `includeCredentials: true`, reads any stream with `IO.read`, replays a redirected XHR, requests Page resource content, and captures Page/MHTML and DOM snapshots after a main-frame redirect. It also captures an ordinary parent containing an iframe redirected to vault, including its error document, and overrides a paused ordinary Fetch request to the allowed redirect URL. No protected marker may appear in any message or body, and no request from those operations may send the independently seeded seven cookie. The ordinary control must return the body, resource content and snapshots, and accept the URL override. Its network-body carrier, `networkBodyAttempted`, `networkBodyRefused`, `hops`, `requestsTerminated` and `hopsRedacted` follow `C2.redirect-secret`. Each probe cleans up its redirect registrations, observer session and cookie. The focused Chrome tests use HTTPS with SPKI-pinned fixture trust and default-port protected URLs; host resolver rules route seven and vault to the fixture rather than the public service.
 
-Every C2 redirect probe reports `sessionEnded`. It becomes true when the guarded client’s session ends during the probe: a `Target.detachedFromTarget` for that session, or a CDP reply that the session is closed or not found, or that the target, websocket or transport is closed. `Inspected target navigated or closed` is an ordinary reply on a live session, not a session end. When an expected Fetch pause or XHR event is missing, the probe sends one `Runtime.evaluate` to check that the session is still alive. Once the session has ended, the probe sends nothing more on it, skips the eight-second tail and the termination wait, and evaluates what the client received before the end. `secretHidden`, `protectedBodyHidden`, `cookieHidden`, `fragmentsHidden` and `hopsRedacted` are measured on those messages, replies, bodies and fixture logs, so a guard that leaked before the end still fails them. A clean end passes them. `sessionSurvives` reads false. Checks that need evidence from after the end read `incomplete`, with `redirect-secret: session ended (<how>)` in the probe’s `incomplete`. If the end cuts the probe’s action matrix short, or leaves any body read pending or unanswered, then `fetchBodyAttempted`, `fetchBodyRefused` and the network-body leg read `incomplete`, even after some refused reads. Any answer that isn’t a refusal still fails its refusal check. `requestsTerminated` reads `incomplete` when requests are unterminated or the matrix was cut short. A short but origin-only `extraLocation` reads `incomplete`. So does each attempt or override check whose command never reached the client: it wasn’t sent because the session had already ended, or its reply was the session end. On the unguarded control, a session end is an error: the probe throws `redirect-secret: control session ended (<how>)`.
+Every C2 redirect probe reports `sessionEnded`. It becomes true when the guarded client’s active session ends during the probe: a `Target.detachedFromTarget` for that active session unless its owner is already known closed, a non-body CDP reply that the active session is closed or not found, or that the websocket or transport is closed. `Inspected target navigated or closed` is an ordinary reply on a live session, not a session end. When an expected Fetch pause or XHR event is missing, the probe sends one `Runtime.evaluate` to check that the session is still alive. Once the session has ended, the probe sends nothing more on it, skips the eight-second tail and the termination wait, and evaluates what the client received before the end. `secretHidden`, `protectedBodyHidden`, `cookieHidden`, `fragmentsHidden` and `hopsRedacted` are measured on those messages, replies, bodies and fixture logs, so a guard that leaked before the end still fails them. A clean end passes them. `sessionSurvives` reads false. Checks that need evidence from after the end read `incomplete`, with `redirect-secret: session ended (<how>)` in the probe’s `incomplete`. If the end cuts the probe’s action matrix short, or leaves any body read pending or unanswered, then `fetchBodyAttempted`, `fetchBodyRefused` and the network-body leg read `incomplete`, even after some refused reads. Any answer that isn’t a refusal still fails its refusal check. `requestsTerminated` reads `incomplete` when requests are unterminated or the matrix was cut short. A short but origin-only `extraLocation` reads `incomplete`. So does each attempt or override check whose command never reached the client: it wasn’t sent because the session had already ended, or its reply was the session end. On the unguarded control, a session end is an error: the probe throws `redirect-secret: control session ended (<how>)`.
 
 `C8.unparseable` probes both raw and canonical space/U+200D/invalid-punycode URLs through creation and navigation. Every guarded destination needs a matched refusal. Its unguarded controls record `document` or `native-rejection` outcomes, including Chrome builds that reject raw U+200D instead of committing it. Both raw and encoded-space forms must commit real fixture documents, because that is the proven cookie leak. An independent observer loads the encoded-space document and confirms it shares a uniquely seeded `.sliccy.ai` cookie; the guarded client must neither list nor attach to it, read its cookie, query that cookie by URL, nor cause a cookie-bearing destination request. The guard does not erase the observer’s private browser state. The row runs on both browser-session and page-session-only transports, uses the default context, and cleans up its own targets and cookie. Cookie seeding always uses the unguarded observer’s browser session, never the guarded client. Only guarded browser-session target listing requires `browserSession`; without it, `listed` records `not-supported` explicitly in probe and observation evidence, and the result lists that field in `notSupported`. Creation, navigation, attachment and `Network.getCookies` with `urls` still require matched refusals; filtering cookies without refusing fails `cookieRefused`. Fixture URLs omit the colon when the port is empty, and reported URLs are compared after canonicalisation, including Chrome’s WHATWG-unparseable encoded-space hosts. Launchers must resolve the raw/canonical space, U+200D/punycode and invalid-punycode `.sliccy.ai` fixture hosts to the fixture server, including for default-port HTTP or HTTPS origins. The HTTP fixture accepts Chrome’s encoded-space Host header without reparsing it as a WHATWG origin.
 
@@ -207,9 +207,9 @@ Every C2 redirect probe reports `sessionEnded`. It becomes true when the guarded
 
 The `C8.newtab` reachability control attaches through the guard to a settled ordinary new tab, including its internal frames, then navigates that same tab to an ordinary document. Both legs must succeed, including without a guard. It requires `chromeUrlsAttach`, so an extension transport reports it as `skip` with `not-supported:chromeUrlsAttach`. The C8 protection rows expect a refusal on the guarded leg and run their controls unguarded, so they don't require it and still run on extension transports. It uses the default browser context, since an incognito new tab omits the ordinary new tab's internal frames. It covers `chrome://newtab/` and directly opened `chrome://new-tab-page/`.
 
-`C8.protected-bfcache-restore` and `.history` test history restoration on seven and vault, with both detach variants. The independent observer seeds ordinary A, protected P and ordinary B on one tab. `/bfcache?n=<tag>` has no unload handler: it retains a global and sessionStorage marker, records `pageshow.persisted` and counts key events. The guarded client must answer on B before the gate is armed. The first row restores P with the observer's `Page.navigateToHistoryEntry`; `.history` sends that navigation through the client instead. A matched client navigation refusal lets the observer restore the same entry. The unguarded control must observe a real `BackForwardCacheRestore`, persisted pageshow, the marker and protected origin in evaluate, a touched global, and positive evidence from every probe method.
+`C8.protected-bfcache-restore` and `.history` test history restoration on seven and vault, with both detach variants. The independent observer seeds ordinary A, protected P and ordinary B on one tab before the first client attach. `/bfcache?n=<tag>` has no unload handler: it retains a global and sessionStorage marker, records `pageshow.persisted` and counts key events. The attached client acknowledges B with `Page.getFrameTree` before the gate is armed; no client script is required. Missing acknowledgement leaves the affected leg and guarded liveness `incomplete`. The first row restores P with the observer's `Page.navigateToHistoryEntry`; `.history` sends that navigation through the client instead. A matched client navigation refusal lets the observer restore the same entry. The unguarded control must observe a real `BackForwardCacheRestore`, persisted pageshow, the marker and protected origin in evaluate, a touched global, and positive evidence from every probe method.
 
-The rows require `inboundDelay`. The guarded client supplies `inboundDelay({ targetId, sessionId, ms, side, client, gate: true })`, a harness gate before the guard's inbound stream. It holds every browser-to-guard message until explicit release; guard-to-browser writes remain possible. The control gates only its unguarded client stream, not the independent observer session. Immediately before restoration the runner requests a gate with a 1500 ms minimum hold. The hook returns `{ targetId, sessionId, ms, gate: true, protectedObserved, ordinaryObserved, release, audit? }`. Both observed flags acknowledge delivery of the protected seed and subsequent ordinary B through the relevant stream before injection. `release()` restores delivery and returns `{ delayedEvents, firstDelayedAt, releasedAt }`, counting held restore events and recording their first hold and actual release times. Missing capability or hook is `not-supported:inboundDelay`; an unacknowledged gate, absent seed acknowledgement or no held restore event is `incomplete`. A timer-only event delay does not meet this contract.
+The rows require `inboundDelay`. The guarded client supplies `inboundDelay({ targetId, sessionId, ms, side, client, gate: true })`, a harness gate before the guard's inbound stream. It holds every browser-to-guard message until explicit release; guard-to-browser writes remain possible. The control gates only its unguarded client stream, not the independent observer session. Immediately before restoration the runner requests a gate with a 1500 ms minimum hold. The hook returns `{ targetId, sessionId, ms, gate: true, protectedObserved, ordinaryObserved, release, audit? }`. Both observed flags acknowledge the observer’s protected seed and subsequent ordinary B before injection. `release()` restores delivery and returns `{ delayedEvents, firstDelayedAt, releasedAt }`, counting held restore events and recording their first hold and actual release times. Missing capability or hook is `not-supported:inboundDelay`; an unacknowledged gate, absent seed acknowledgement or no held restore event is `incomplete`. A timer-only event delay does not meet this contract.
 
 After the observer confirms the persisted protected document, the client repeatedly probes `Runtime.evaluate`, `Runtime.callFunctionOn`, `DOM.getDocument`, `Accessibility.getFullAXTree`, `Input.dispatchKeyEvent`, `Page.captureScreenshot` and `IO.read` for 2500 ms while the gate stays closed. Runtime probes write `__touched`; Input is measured by the fixture's key counter. The observer supplies a real network-resource stream for IO's positive control: the read must use that handle and show the document marker, including base64-encoded bodies. Screenshot controls must return PNG bytes captured while P is current that match the independent observer's capture of P; unrelated or merely nonempty data is not evidence. The guard must hide the marker from all received messages and events and hide the protected origin from every probe reply, not only Runtime replies, and leave both side effects absent on P. A returned screenshot while P is current fails, regardless of its encoded contents. Refused, answered and unanswered outcomes are retained individually; an unanswered call alone never proves protection. The observer measures P's marker, persisted state and side effects before and after release. Missing restore, fixture, hold or side-effect evidence is `incomplete`, even when every measured observation matches; measured leaks or side effects fail even beside missing evidence. After release the runner drains probe replies for up to 5000 ms, scaled by `settleScale`, before scanning them and judging screenshots. An unresolved reply needs a complete final forwarding ledger proving terminal non-forwarding; otherwise its missing measurement is `incomplete`. A measured failure takes precedence over incomplete evidence.
 
@@ -283,7 +283,7 @@ Popups are observed by `Target.targetCreated` with the opener's `openerId`, or b
 
 `{ "extensionWorld": "hidden" | "select" | "debugger" | "drivable", "as": "world", "requires": ["extensionWorld"] }` runs the C9 compound probe on the current ordinary page. The runner attaches an independent observer to discover actual context ids, unique ids and names, and sends probes through the client session. Discovery matches the expected fixture extension’s exact origin, never the first extension world: `run()`’s optional `extensionWorldId` defaults to shared-web’s harness id `ankmbodmgimjemnojmeddfcdlbocolob`. Multiple unrelated content-script worlds are ignored for fixture selection, while guards must still protect foreign worlds. A custom fixture must provide the same content-script marker contract. Object handles are minted and validated on the unguarded control session, then replayed as guesses on the guarded leg; Chrome object handles and DOM node ids are session-local, so observer handles must never be mistaken for client handles. Numeric ids from the control are also replayed alongside fresh observer-discovered selectors, but numeric ids are local to a tab: a control id may name the next tab’s exposed default context, which must work and return no extension marker. The same-tab hidden world’s actual numeric id and every extension unique-id guess still require a matched refusal. Unknown numeric ids and stale object handles (`not exposed`) need explicit refusals rather than Chrome’s invalid-id errors. `guessesRefused` aggregates only required refusals; `guessesReached` must be false on the guarded leg, and `exposedContextsWork` must remain true. Its result contains boolean evidence consumed by ordinary `result` checks. The unguarded leg validates those selectors against Chrome itself before guarded evidence can pass.
 
-`{ "errorPage": "recover", "secret"?: "all" | "query" | "fragment", "as": "errorPage" }` (also modes `restore` and `sticky`; `secret` defaults to `all`) runs the protected-error-page compound probe with independent commit evidence, discovery redaction and recovery or sticky-lock checks. The unguarded observer seeds the protected history and failed commit, so the rows run on page-session-only transports too. The guarded client uses only `Target.getTargetInfo` with a `targetId`, `Target.getTargets`, `Target.setDiscoverTargets`, `Target.attachToTarget`, `Target.detachFromTarget` and `Target.closeTarget` without a session, which page-session transports answer themselves, and everything else on its page session; the rows require no whole-vector capability. Only `eventsRedacted` requires `discovery`: without it the probe does not call `Target.setDiscoverTargets`, that one field is `not-supported` in both legs, and the notes say `not-supported:discovery`; info, list, attach, recovery and lock checks still run. Discovery absence is structural: a guarded transport delivering either `Target.targetCreated` or `Target.targetInfoChanged` during such a row without declaring `discovery` fails the row, even when the event names an ordinary target. `Target.attachedToTarget` remains independently checked by `attachRedacted`. The runner leaves this probe’s independent Fetch sessions to the probe rather than answering their pauses itself. Each of the probe’s waits is bounded at 5000 ms, scaled by `settleScale`. When the probe’s own evidence is missing, it returns `incomplete` with `protected-error-page: <reason>` instead of throwing: the observer target could not be created or attached (an `openerId` included, after cleaning the target up), the observer’s history seed or allowed document did not commit (or its setup failed), the client’s `Page.navigate` to the trigger failed or was refused, the control’s own Fetch failure injection left no error commit, the protected history entry is missing, no real `BackForwardCacheRestore` arrived, or the observer’s sticky failure left no error page. The guarded leg’s missing error commit is not incomplete: it is the guard’s, and stays `live: false`.
+`{ "errorPage": "recover", "secret"?: "all" | "query" | "fragment", "as": "errorPage" }` (also modes `restore` and `sticky`; `secret` defaults to `all`) runs the protected-error-page compound probe with independent commit evidence, discovery redaction and recovery or sticky-lock checks. The unguarded observer seeds the protected history and failed commit, so the rows run on page-session-only transports too. The guarded client uses only `Target.getTargetInfo` with a `targetId`, `Target.getTargets`, `Target.setDiscoverTargets`, `Target.attachToTarget`, `Target.detachFromTarget` and `Target.closeTarget` without a session, which page-session transports answer themselves, and everything else on its page session; the rows require no whole-vector capability. Only `eventsRedacted` requires `discovery`: without it the probe does not call `Target.setDiscoverTargets`, that one field is `not-supported` in both legs, and the notes say `not-supported:discovery`; info, list, attach, recovery and lock checks still run. Discovery absence is structural: a guarded transport delivering either `Target.targetCreated` or `Target.targetInfoChanged` during such a row without declaring `discovery` fails the row, even when the event names an ordinary target. `Target.attachedToTarget` remains independently checked by `attachRedacted`. The runner leaves this probe’s independent Fetch sessions to the probe rather than answering their pauses itself. Each of the probe’s waits is bounded at 5000 ms, scaled by `settleScale`. Its `diagnostics` record the client’s `Target.attachToTarget` as `clientAttach`, whose `outcome` is `answered` (with `sessionId`, whether the reply carried one), `refused` or `error` (both with the `error` text), and, once the client has navigated, the error-commit wait as `errorCommit`: `seen`, `elapsedMs` when seen or at timeout, `budgetMs` with `settleScale` applied, and the last `frame` and `targetInfo` read. They change no verdict. The row carries them as `evidence.control.errorPage` and `evidence.guarded.errorPage`, and a guarded leg that is not live because the attach gave no session or the commit was not seen says why: `not live: client attach refused: <text>` (or `failed: <text>`, or `answered without a sessionId`), or `not live: error commit not seen after <elapsed>ms (budget <budget>ms): frame <url> unreachableUrl <url or none>, target <url>`. When the probe’s own evidence is missing, it returns `incomplete` with `protected-error-page: <reason>` instead of throwing: the observer target could not be created or attached (an `openerId` included, after cleaning the target up), the observer’s history seed or allowed document did not commit (or its setup failed), the client’s `Page.navigate` to the trigger failed or was refused, the control’s own Fetch failure injection left no error commit, the protected history entry is missing, no real `BackForwardCacheRestore` arrived, or the observer’s sticky failure left no error page. The guarded leg’s missing error commit is not incomplete: it is the guard’s, and stays `live: false`.
 
 `{ "redirectSecret": "headers" | "mix" | "body", "as": "redirect" }` runs a C2 compound probe and owns its Fetch pauses. The client must expose `messages`, an append-only array of every raw received CDP text frame, recorded before parsing; an events-only or reply-only tap fails `rawRecorded`. Whenever a run includes a `C2.redirect-*` row or a `redirectSecret` step, `run()` retains an explicit `fixture.redirectSecret` hook or automatically installs a fetch-only `POST /redirect` bridge. Its base is `fixtureBase`, then `fixture.origin`, then `targets.ordinary`; a browser-page alias or reverse proxy must forward that endpoint to the bundled fixture. The bundled `fixtureServer()` always supplies both its direct hook and HTTP control endpoint, so no custom registration method is needed. Missing, unreachable or non-successful registration is an explicit row/summary error containing `redirectSecret fixture registration required`, never a pass or a skipped observation. Fixture logs must include headers for the cookie check. The guard’s events and raw messages must represent the same delivered stream. The leak scan memoizes each decoded string and yields to the event loop between items, so concurrent rows in the same process are not starved. When the probe’s own unguarded observer setup (attach, `Page.enable` and the seven cookie) fails before the client is used, the probe returns `incomplete` with `redirect-secret: observer setup failed: <reason>` instead of throwing.
 

package/bfcache-restore.mjs

@@ -109,33 +109,23 @@ class Restore {
     await this.read('Page.enable', {});
     if (!(await this.loaded(`${this.ordinary}/bfcache?n=${this.tag}-a`)))
       return this.missingEvidence('ordinary A did not commit');
-    if (!(await this.attach())) return this.missingEvidence('initial client attach unanswered');
-    await this.call('Page.enable', {});
     await this.read('Page.navigate', { url: this.url });
     if (!(await this.loaded(this.url)))
       return this.missingEvidence('protected seed did not commit');
     const state = await this.state();
     if (state?.marker !== this.marker || state.stored !== this.marker)
       return this.missingEvidence('protected fixture marker absent');
-    const lock = await this.call('Runtime.evaluate', {
-      expression: 'location.origin',
-      returnByValue: true,
-    });
-    this.result.protectedLocked = refusal(lock);
-    this.result.seed = { protectedURL: this.url, lock };
+    this.result.seed = { protectedURL: this.url };
     const b = `${this.ordinary}/bfcache?n=${this.tag}-b`;
     await this.read('Page.navigate', { url: b });
     if (!(await this.loaded(b))) return this.missingEvidence('ordinary B did not commit');
-    await bounded(
-      this.client.send('Target.detachFromTarget', { sessionId: this.session }),
-      this.budget
-    );
-    const live = (await this.attach())
-      ? await this.call('Runtime.evaluate', { expression: 'location.href', returnByValue: true })
-      : { ok: false };
-    this.result.sessionLive = value(live) === b;
+    if (!(await this.attach())) return this.missingEvidence('initial client attach unanswered');
+    const live = await this.call('Page.getFrameTree', {});
+    const frame = live.result?.frameTree?.frame;
     this.result.seed.ordinaryAnswer = live;
-    if (!this.result.sessionLive) return false;
+    if (!(live.ok && frame?.url === b && !frame.unreachableUrl))
+      return this.missingEvidence('ordinary B acknowledgement unavailable');
+    this.result.sessionLive = true;
     await this.call('Page.enable', {});
     const history = await this.read('Page.getNavigationHistory', {});
     this.entry = history.result?.entries?.find((item) => item.url === this.url);

package/guard-runner.mjs

@@ -753,6 +753,7 @@ class Execution {
             side: this.side,
             settleScale: this.scale,
             controls: (this.clients.redirectSecretControls ??= {}),
+            internalSessions: this.internalSessions,
           })
         );
       } finally {
@@ -1283,7 +1284,10 @@ class Execution {
     if (!live && this.unmeasured(this.vector.liveCheck))
       return { live: 'incomplete', liveWhy: 'incomplete' };
     if (!live && !unseen.length) live = await this.poll(alive, 1500);
-    if (!unseen.length || (live && !incomplete.length)) return { live };
+    if (!unseen.length || (live && !incomplete.length))
+      return live
+        ? { live }
+        : { live, liveWhy: this.calls[this.vector.liveCheck.result]?.result?.liveWhy };
     const detail = incomplete.length ? ` (${incomplete.join(', ')} incomplete)` : '';
     return { live: false, liveWhy: `pre beacon not observed for ${unseen.join(', ')}${detail}` };
   }
@@ -1321,8 +1325,10 @@ class Execution {
         incomplete: this.incomplete,
         evidence: Object.fromEntries(
           Object.entries(this.calls)
-            .filter(([, out]) => out?.result?.delay && out.result.probes)
-            .map(([name, out]) => [name, out.result])
+            .filter(
+              ([, out]) => (out?.result?.delay && out.result.probes) || out?.result?.diagnostics
+            )
+            .map(([name, out]) => [name, out.result.diagnostics ?? out.result])
         ),
       };
     } finally {
@@ -1746,6 +1752,7 @@ function settleIncomplete(row, vector, base, legs) {
     control: fill('control'),
     guarded: fill('guarded'),
     live: legs.control.live === true && [true, 'incomplete'].includes(legs.guarded.live),
+    liveWhy: legs.guarded.liveWhy,
   });
   for (const side of ['control', 'guarded'])
     if (legs[side].incomplete?.length && filled[side] === 'pass') row[side] = 'incomplete';

package/guard-vectors.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "setVersion": "1.18.1",
+  "setVersion": "1.18.4",
   "sources": [
     {
       "repo": "ai-ecoverse/slicc-cli",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-browsers",
-  "version": "1.18.1",
+  "version": "1.18.4",
   "description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
   "type": "module",
   "license": "Apache-2.0",
@@ -68,7 +68,7 @@
     "validate": "node scripts/validate.mjs",
     "lint": "slicc-lint && test -z \"$(gofmt -l .)\" && go mod tidy -diff && go vet ./... && golangci-lint run && cargo fmt --check && cargo clippy --all-features --all-targets -- -D warnings",
     "format": "biome check --write . && gofmt -w . && cargo fmt",
-    "test": "npm run validate && node --test --test-concurrency=1 test/integration/self-contained.test.mjs test/integration/browser-runner.test.mjs test/integration/fixture-client.test.mjs test/integration/git-retry.test.mjs test/integration/release-line.test.mjs test/integration/guard-redirect-carrier.test.mjs test/integration/guard-redirect-session-end.test.mjs test/integration/guard-incomplete.test.mjs test/integration/guard-stall.test.mjs test/integration/guard-forged.test.mjs test/integration/guard-exit-steps.test.mjs test/integration/guard-frame-read.test.mjs test/integration/guard-bfcache.test.mjs test/integration/guard-bfcache-review.test.mjs test/integration/guard-error-page-navigation.test.mjs && go test -race -count=1 ./test/integration/... && cargo test --all-features",
+    "test": "npm run validate && node --test --test-concurrency=1 test/integration/self-contained.test.mjs test/integration/browser-runner.test.mjs test/integration/fixture-client.test.mjs test/integration/git-retry.test.mjs test/integration/release-line.test.mjs test/integration/guard-redirect-carrier.test.mjs test/integration/guard-redirect-session-end.test.mjs test/integration/guard-redirect-history.test.mjs test/integration/guard-incomplete.test.mjs test/integration/guard-stall.test.mjs test/integration/guard-forged.test.mjs test/integration/guard-exit-steps.test.mjs test/integration/guard-frame-read.test.mjs test/integration/guard-bfcache.test.mjs test/integration/guard-bfcache-review.test.mjs test/integration/guard-bfcache-quarantine.test.mjs test/integration/guard-error-page-navigation.test.mjs && go test -race -count=1 ./test/integration/... && cargo test --all-features",
     "test:unit": "mkdir -p coverage/unit && node --experimental-test-coverage --test --test-concurrency=1 --test-reporter=lcov --test-reporter-destination=coverage/unit/lcov.info test/unit/*.test.mjs && go test -race -cover ./...",
     "build": "go build ./... && cargo build --all-features && cargo build --target wasm32-wasip1 --all-features && npm pack --dry-run",
     "trust": "npx fledgling sync -y --skip-publish",
@@ -79,7 +79,7 @@
     "test:guard-sweep": "node scripts/test-guards.mjs",
     "test:gates": "node --test test/integration/gates.test.mjs",
     "test:guard-target": "node --test test/integration/guard-runner.test.mjs",
-    "test:unit:redirect": "mkdir -p coverage/unit && node --experimental-test-coverage --test --test-coverage-include=redirect-secret.mjs --test-coverage-include=redirect-fragments.mjs --test-reporter=lcov --test-reporter-destination=coverage/unit/redirect.lcov test/unit/guard-redirect-*.test.mjs && slicc-diff-cover coverage/unit/redirect.lcov",
+    "test:unit:redirect": "mkdir -p coverage/unit && node --experimental-test-coverage --test --test-concurrency=1 --test-coverage-include=redirect-secret.mjs --test-coverage-include=redirect-fragments.mjs --test-reporter=lcov --test-reporter-destination=coverage/unit/redirect.lcov test/unit/guard-redirect-*.test.mjs && slicc-diff-cover coverage/unit/redirect.lcov",
     "test:unit:guard": "mkdir -p coverage/unit && node --experimental-vm-modules --no-warnings --experimental-test-coverage --test --test-concurrency=1 --test-coverage-include=guard-runner.mjs --test-coverage-include=fixture-server.mjs --test-coverage-include=fixture-client.mjs --test-coverage-include=observer-target.mjs --test-coverage-include=frame-read.mjs --test-coverage-include=bfcache-restore.mjs --test-coverage-include=protected-error-page.mjs --test-coverage-include=unparseable-url.mjs --test-coverage-include=scripts/browser-runner.mjs --test-coverage-include=scripts/validate.mjs --test-reporter=lcov --test-reporter-destination=coverage/unit/guard.lcov test/unit/guard-*.test.mjs && slicc-diff-cover coverage/unit/guard.lcov"
   },
   "devDependencies": {

package/protected-error-page.mjs

@@ -4,6 +4,22 @@ import { createObserverTarget } from './observer-target.mjs';
 const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 const refused = (out) => !out.ok && /^slicc: refused:/.test(out.error?.message ?? '');
 
+function attachOutcome(out) {
+  if (out.ok) return { outcome: 'answered', sessionId: Boolean(out.result?.sessionId) };
+  return {
+    outcome: refused(out) ? 'refused' : 'error',
+    error: String(out.error?.message ?? out.error),
+  };
+}
+
+const attachWhy = ({ outcome: kind, error }) =>
+  kind === 'answered'
+    ? 'client attach answered without a sessionId'
+    : `client attach ${kind === 'refused' ? 'refused' : 'failed'}: ${error}`;
+
+const commitWhy = ({ elapsedMs, budgetMs, frame, targetInfo }) =>
+  `error commit not seen after ${elapsedMs}ms (budget ${budgetMs}ms): frame ${frame.url} unreachableUrl ${frame.unreachableUrl ?? 'none'}, target ${targetInfo.url}`;
+
 async function loadedDocument(reader, observer, url, until) {
   return until(async () => {
     const { frameTree } = await reader.send('Page.getFrameTree', {}, observer);
@@ -197,7 +213,14 @@ export async function protectedErrorPage({
       client.send('Target.attachToTarget', { targetId, flatten: true })
     );
     session = attached.result?.sessionId;
-    if (!session) return { live: false, attached: false };
+    result.diagnostics = { clientAttach: attachOutcome(attached) };
+    if (!session)
+      return {
+        ...result,
+        live: false,
+        attached: false,
+        liveWhy: attachWhy(result.diagnostics.clientAttach),
+      };
     await client.send('Page.enable', {}, session);
     await client.send('Runtime.enable', {}, session);
     if (discovery) await client.send('Target.setDiscoverTargets', { discover: true });
@@ -212,6 +235,7 @@ export async function protectedErrorPage({
     const unsent = await scripted(client, session, ordinary, failedURL);
     if (unsent) return missing(unsent);
     let evidence;
+    const waited = Date.now();
     const live = await until(async () => {
       const f = await frame();
       const { targetInfo } = await reader.send('Target.getTargetInfo', { targetId });
@@ -224,10 +248,16 @@ export async function protectedErrorPage({
       );
     });
     result.evidence = evidence;
+    result.diagnostics.errorCommit = {
+      seen: live,
+      elapsedMs: Date.now() - waited,
+      budgetMs: budget,
+      ...evidence,
+    };
     if (!live && side === 'control')
       return missing(`missing error commit ${JSON.stringify(evidence)}`);
     result.live = live;
-    if (!live) return result;
+    if (!live) return { ...result, liveWhy: commitWhy(result.diagnostics.errorCommit) };
     await redaction({ client, targetId, failedURL, protectedOrigin, start, result, discovery });
     const beforeReload = (await frame()).loaderId;
     result.reload = (await outcome(client.send('Page.reload', {}, session))).ok;

package/redirect-secret.mjs

@@ -1,4 +1,5 @@
 import { load, outcome, waitFor } from './guard-driver.mjs';
+import { createObserverTarget } from './observer-target.mjs';
 import { redirectFragments } from './redirect-fragments.mjs';
 
 const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
@@ -26,6 +27,12 @@ const gone = (out) =>
   /session with given id not found|no session with given id|\bsession (?:has been |is |was )?(?:closed|detached)|\btarget closed|target page, context or browser has been closed|\b(?:cdp|connection|transport|websocket|socket) (?:has been |is |was )?closed|websocket is not open/i.test(
     out.error?.message ?? ''
   );
+const connectionGone = (out) =>
+  !out.ok &&
+  /\b(?:cdp|connection|transport|websocket|socket) (?:has been |is |was )?closed|websocket is not open/i.test(
+    out.error?.message ?? ''
+  );
+const bodyRead = (method) => /^(?:Network|Fetch)\.getResponseBody$/.test(method);
 const redirects = [301, 302, 303, 307, 308];
 const redirectHeaders = (to) => ({
   location: to,
@@ -98,6 +105,11 @@ class RedirectProbe {
     this.networkBodies = new Set();
     this.learned = { network: new Set(), fetch: new Set(), tap: new Set() };
     this.registrations = [];
+    this.sessions = new Map([[this.session, undefined]]);
+    this.observers = new Set();
+    this.closedSessions = new Set();
+    this.targets = new Set();
+    this.missing = [];
     this.seen = new Map();
     this.scale = this.settleScale ?? 1;
     this.protectedURLs = [
@@ -118,14 +130,21 @@ class RedirectProbe {
     const events = this.client.events;
     for (; !this.end && this.detachScan < events.length; this.detachScan++) {
       const event = events[this.detachScan];
-      if (event.method === 'Target.detachedFromTarget' && event.params?.sessionId === this.session)
-        this.end = 'Target.detachedFromTarget';
+      if (
+        event.method === 'Target.detachedFromTarget' &&
+        this.sessions.has(event.params?.sessionId)
+      ) {
+        const session = event.params.sessionId;
+        if (session === this.session && !this.closedSessions.has(session))
+          this.end = 'Target.detachedFromTarget';
+        else this.closedSessions.add(session);
+      }
     }
     return Boolean(this.end);
   }
 
   cut() {
-    return Boolean(this.end) && !this.complete;
+    return Boolean(this.end || this.halted) && !this.complete;
   }
 
   async lost() {
@@ -135,20 +154,35 @@ class RedirectProbe {
 
   answers(method) {
     const all = this.attempts.filter((entry) => entry.method === method);
-    const answered = all.filter((entry) => !(this.end && (entry.pending || entry.ended)));
+    const missing = (entry) =>
+      entry.incomplete ||
+      (entry.pending && this.closedSessions.has(entry.session)) ||
+      (this.end && (entry.pending || entry.ended));
+    const answered = all.filter((entry) => !missing(entry));
     const short =
-      Boolean(this.end) && (!this.complete || !answered.length || answered.length < all.length);
+      all.some(missing) ||
+      (Boolean(this.end || this.halted) &&
+        (!this.complete || !answered.length || answered.length < all.length));
     return { answered, short };
   }
 
-  async send(method, params = {}) {
+  async send(method, params = {}, session = this.session) {
     if (this.ended())
       return { ok: false, ended: true, error: { message: `session ended (${this.end})` } };
-    const out = await outcome(this.client.send(method, params, this.session));
+    const out = this.closedSessions.has(session)
+      ? { ok: false, incomplete: true, error: { message: 'owning tab closed' } }
+      : await outcome(this.client.send(method, params, session));
     if (gone(out)) {
-      this.end ??= out.error.message;
-      return { ...out, ended: true };
+      if (!connectionGone(out) && (bodyRead(method) || session !== this.session)) {
+        this.closedSessions.add(session);
+        out.incomplete = true;
+      } else {
+        this.end ??= out.error.message;
+        return { ...out, ended: true };
+      }
     }
+    if (bodyRead(method) && out.incomplete)
+      this.missing.push(`redirect-secret: ${method} ${params.requestId} owning tab closed`);
     this.responses.push({ method, ...out });
     return out;
   }
@@ -160,11 +194,24 @@ class RedirectProbe {
 
   async fetchPause(event) {
     if (redirects.includes(event.params.responseStatusCode)) {
-      const out = await this.send('Fetch.getResponseBody', { requestId: event.params.requestId });
-      this.attempts.push({ method: 'Fetch.getResponseBody', ...out });
-      if (event.params.networkId) this.track(this.networkBody(event.params.networkId, 'fetch'));
+      const entry = {
+        method: 'Fetch.getResponseBody',
+        session: event.sessionId,
+        pending: true,
+      };
+      this.attempts.push(entry);
+      const out = await this.send(
+        'Fetch.getResponseBody',
+        { requestId: event.params.requestId },
+        event.sessionId
+      );
+      delete entry.pending;
+      Object.assign(entry, out);
+      if (event.params.networkId)
+        this.track(this.networkBody(event.params.networkId, 'fetch', event.sessionId));
     }
     if (
+      event.sessionId === this.session &&
       this.holdURL &&
       event.params.request.url === this.holdURL &&
       !event.params.responseStatusCode
@@ -172,30 +219,35 @@ class RedirectProbe {
       this.held = event;
       return;
     }
-    await this.send('Fetch.continueRequest', { requestId: event.params.requestId });
+    await this.send(
+      'Fetch.continueRequest',
+      { requestId: event.params.requestId },
+      event.sessionId
+    );
   }
 
   async watch() {
     while (!this.stopped) {
       for (const event of this.client.events.slice(this.cursor)) {
         this.cursor++;
-        if (event.sessionId !== this.session) continue;
+        if (!this.sessions.has(event.sessionId)) continue;
         if (event.method === 'Fetch.requestPaused') this.track(this.fetchPause(event));
         const response = event.params?.redirectResponse ?? event.params?.response;
         if (!response || !redirects.includes(response.status)) continue;
-        this.track(this.networkBody(event.params.requestId, 'network'));
+        this.track(this.networkBody(event.params.requestId, 'network', event.sessionId));
       }
       await pause(5);
     }
   }
 
-  async networkBody(requestId, source) {
-    this.learned[source].add(requestId);
-    if (this.networkBodies.has(requestId) || this.ended()) return;
-    this.networkBodies.add(requestId);
-    const entry = { method: 'Network.getResponseBody', source, pending: true };
+  async networkBody(requestId, source, session) {
+    const key = `${session}:${requestId}`;
+    this.learned[source].add(key);
+    if (this.networkBodies.has(key) || this.ended()) return;
+    this.networkBodies.add(key);
+    const entry = { method: 'Network.getResponseBody', source, session, pending: true };
     this.attempts.push(entry);
-    const out = await this.send('Network.getResponseBody', { requestId });
+    const out = await this.send('Network.getResponseBody', { requestId }, session);
     delete entry.pending;
     Object.assign(entry, out);
   }
@@ -206,10 +258,11 @@ class RedirectProbe {
 
   tap() {
     for (const event of this.reader.events ?? []) {
-      if (event.sessionId !== this.observer) continue;
+      const session = [...this.sessions].find(([, observer]) => observer === event.sessionId)?.[0];
+      if (!session) continue;
       const response = event.params?.redirectResponse ?? event.params?.response;
       if (response?.url?.startsWith(this.prefix) && redirects.includes(response.status))
-        this.track(this.networkBody(event.params.requestId, 'tap'));
+        this.track(this.networkBody(event.params.requestId, 'tap', session));
     }
   }
 
@@ -240,7 +293,7 @@ class RedirectProbe {
         : !proven
           ? 'control did not prove the redirect Network events'
           : short
-            ? `session ended (${this.end}) before every network body read was answered`
+            ? 'not every network body read was answered on a live owner'
             : undefined;
     if (reason && (!attempts.length || refusedAll))
       return {
@@ -259,7 +312,7 @@ class RedirectProbe {
   }
 
   requests(events, match = (url) => url?.startsWith(this.prefix)) {
-    const own = events.filter((event) => event.sessionId === this.session);
+    const own = events.filter((event) => this.sessions.has(event.sessionId));
     const seen = new Set(
       own
         .filter(
@@ -347,7 +400,7 @@ class RedirectProbe {
     const who = this.end ? `session ended (${this.end}) with requests` : 'control requests';
     const detail = open.length
       ? `${who} ${open.join(', ')} unterminated`
-      : `session ended (${this.end}) before every request was issued`;
+      : 'probe ended before every request was issued';
     return {
       hops,
       requestsTerminated: missing ? 'incomplete' : !open.length,
@@ -372,7 +425,36 @@ class RedirectProbe {
   }
 
   async reset(suffix = 'reset') {
-    await load(this.reader, this.observer, `${this.ordinary}/doc?n=${this.tag}-${suffix}`);
+    if (this.ended() || this.halted) return false;
+    const recovered = await outcome(
+      (async () => {
+        const { targetId } = await createObserverTarget(this.reader, { url: 'about:blank' });
+        this.targets.add(targetId);
+        const { sessionId: observer } = await this.reader.send('Target.attachToTarget', {
+          targetId,
+          flatten: true,
+        });
+        if (!observer) throw new Error('ordinary observer session missing');
+        this.observers.add(observer);
+        await this.reader.send('Page.enable', {}, observer);
+        if (this.side === 'guarded') await this.reader.send('Network.enable', {}, observer);
+        await load(this.reader, observer, `${this.ordinary}/doc?n=${this.tag}-${suffix}`);
+        const { sessionId } = await this.client.send('Target.attachToTarget', {
+          targetId,
+          flatten: true,
+        });
+        if (!sessionId) throw new Error('ordinary client session missing');
+        this.sessions.set(sessionId, observer);
+        this.internalSessions?.add(sessionId);
+        this.session = sessionId;
+        await this.enable();
+      })()
+    );
+    if (!recovered.ok) {
+      this.halted = true;
+      this.missing.push(`redirect-secret: ordinary tab recovery ${recovered.error.message}`);
+    }
+    return recovered.ok;
   }
 
   contains(value) {
@@ -395,6 +477,8 @@ class RedirectProbe {
     this.observer = (
       await this.reader.send('Target.attachToTarget', { targetId: this.targetId, flatten: true })
     ).sessionId;
+    this.sessions.set(this.session, this.observer);
+    this.observers.add(this.observer);
     this.watching = this.watch();
     await this.reader.send('Page.enable', {}, this.observer);
     if (this.side === 'guarded') await this.reader.send('Network.enable', {}, this.observer);
@@ -412,7 +496,7 @@ class RedirectProbe {
     });
   }
 
-  async setup() {
+  async enable() {
     for (const domain of ['Page', 'Network', 'Runtime', 'Log', 'Audits'])
       await this.send(`${domain}.enable`);
     await this.send('Fetch.enable', {
@@ -421,6 +505,10 @@ class RedirectProbe {
         { urlPattern: '*', requestStage: 'Response' },
       ],
     });
+  }
+
+  async setup() {
+    await this.enable();
     for (const to of [...this.protectedURLs, this.plainURL]) {
       const url = new URL(to);
       if (url.hash) continue;
@@ -433,13 +521,12 @@ class RedirectProbe {
   async headers() {
     for (const [index, to] of this.destinations.entries()) {
       for (const kind of ['navigate', 'href', 'fetch', 'xhr']) {
-        if (this.ended()) return;
+        if (this.ended() || this.halted) return;
         const code = this.mode === 'mix' ? [301, 303, 307, 308][index] : 302;
         const url = await this.register(`${index}-${kind}`, to, code);
         const start = this.client.events.length;
         if (kind === 'navigate') await this.send('Page.navigate', { url });
         else {
-          await this.reset();
           const expression =
             kind === 'href'
               ? `location.href=${JSON.stringify(url)};void 0`
@@ -495,7 +582,7 @@ class RedirectProbe {
   }
 
   async override(url) {
-    await this.reset('override');
+    if (!(await this.reset('override'))) return;
     this.holdURL = `${this.ordinary}/data?n=${this.tag}-override`;
     this.held = undefined;
     await this.send('Runtime.evaluate', {
@@ -505,7 +592,9 @@ class RedirectProbe {
     if (!this.held) {
       this.holdURL = undefined;
       if (await this.lost()) return;
-      throw new Error('redirect body: Fetch override pause missing');
+      this.overrideIncomplete = true;
+      this.missing.push('redirect-secret: override pause not observed');
+      return;
     }
     const requestId = this.held.params.requestId;
     const out = await this.send('Fetch.continueRequest', { requestId, url });
@@ -568,13 +657,13 @@ class RedirectProbe {
       () => this.iframe(),
       () => this.override(url),
     ]) {
-      if (this.ended()) return;
+      if (this.ended() || this.halted) return;
       await step();
     }
   }
 
   async iframe() {
-    await this.reset('iframe');
+    if (!(await this.reset('iframe'))) return;
     const url = await this.register('iframe', this.destinations[1]);
     await this.send('Runtime.evaluate', {
       expression: `(()=>{const f=document.createElement('iframe');f.src=${JSON.stringify(url)};document.body.append(f)})();void 0`,
@@ -590,25 +679,50 @@ class RedirectProbe {
     });
   }
 
+  observerTraffic(value) {
+    return (
+      this.client === this.reader &&
+      this.observers.has(value?.sessionId) &&
+      !this.sessions.has(value?.sessionId)
+    );
+  }
+
+  observerMessage(message) {
+    try {
+      return this.observerTraffic(JSON.parse(message));
+    } catch {
+      return false;
+    }
+  }
+
+  overrideCheck(key, unseen) {
+    const overrides = this.responses.filter((entry) => entry.overrideMethod);
+    if (!overrides.length) return this.overrideIncomplete ? 'incomplete' : unseen;
+    return overrides.every((entry) => entry[key]);
+  }
+
+  async survival() {
+    for (const session of this.sessions.keys()) await this.send('Fetch.disable', {}, session);
+    if (!(await this.reset('survive'))) return { ok: false };
+    return this.send('Runtime.evaluate', {
+      expression: 'document.title',
+      returnByValue: true,
+    });
+  }
+
   async evidence() {
     if (!this.ended()) await pause(8000);
     if (!this.ended()) this.tap();
     if (this.side === 'control' && this.controls)
       this.controls.networkEvents = this.learned.network.size > 0;
-    await this.send('Fetch.disable');
-    await this.reset('survive');
-    const survives = await this.send('Runtime.evaluate', {
-      expression: 'document.title',
-      returnByValue: true,
-    });
+    const survives = await this.survival();
     await this.settle();
     await this.terminated();
-    const tapped = `"sessionId":"${this.observer}"`;
     const events = this.client.events
       .slice(this.eventsStart)
-      .filter((event) => event.sessionId !== this.observer);
+      .filter((event) => !this.observerTraffic(event));
     const messages = (this.client.messages?.slice(this.messagesStart) ?? []).filter(
-      (message) => !message.includes(tapped)
+      (message) => !this.observerMessage(message)
     );
     const eventLeaks = await this.scan(events);
     const ordinaryEvents = events.filter(
@@ -619,7 +733,7 @@ class RedirectProbe {
     const replyLeaks = await this.scan(replies);
     const extra = events.filter(
       (event) =>
-        event.sessionId === this.session &&
+        this.sessions.has(event.sessionId) &&
         event.method === 'Network.responseReceivedExtraInfo' &&
         redirects.includes(event.params.statusCode)
     );
@@ -634,12 +748,11 @@ class RedirectProbe {
     });
     const extraInPlace =
       extraHeld &&
-      (extra.length >= this.destinations.length * 4 || (this.end ? 'incomplete' : false));
-    const unseen = this.end ? 'incomplete' : false;
+      (extra.length >= this.destinations.length * 4 || (this.cut() ? 'incomplete' : false));
+    const unseen = this.end || this.halted ? 'incomplete' : false;
     const found = (key) => this.responses.some((entry) => entry[key]);
     const fetchReads = this.answers('Fetch.getResponseBody');
     const fetchLeaked = fetchReads.answered.some((entry) => !refused(entry));
-    const overrides = this.responses.filter((entry) => entry.overrideMethod);
     const evidence = {
       live: (await this.fixture.log()).some((entry) =>
         entry.url.includes(`/redirect-secret/${this.tag}`)
@@ -653,7 +766,9 @@ class RedirectProbe {
             : (message.method ?? 'reply')
         ),
       secretHidden: !replyLeaks.includes(true),
-      sessionSurvives: survives.ok && survives.result?.result?.value === 'doc',
+      sessionSurvives: this.halted
+        ? 'incomplete'
+        : survives.ok && survives.result?.result?.value === 'doc',
       sessionEnded: this.ended(),
       fetchBodyAttempted: fetchReads.short ? 'incomplete' : fetchReads.answered.length > 0,
       fetchBodyRefused: fetchLeaked
@@ -706,31 +821,38 @@ class RedirectProbe {
           'ordinaryIframeDOM',
         ].map((key) => [key, found(key) || unseen])
       ),
-      overridesRefused: overrides.length
-        ? overrides.every((entry) => entry.overrideRefused)
-        : unseen,
-      overridesWorked: overrides.length ? overrides.every((entry) => entry.overrideWorked) : unseen,
+      overridesRefused: this.overrideCheck('overrideRefused', unseen),
+      overridesWorked: this.overrideCheck('overrideWorked', unseen),
     };
-    if (!this.end || !Object.values(evidence).includes('incomplete')) return evidence;
-    const incomplete = [evidence.incomplete, `redirect-secret: session ended (${this.end})`];
-    return { ...evidence, incomplete: incomplete.filter(Boolean).join('; ') };
+    const incomplete = [evidence.incomplete, ...this.missing];
+    if (this.end && Object.values(evidence).includes('incomplete'))
+      incomplete.push(`redirect-secret: session ended (${this.end})`);
+    return incomplete.some(Boolean)
+      ? { ...evidence, incomplete: incomplete.filter(Boolean).join('; ') }
+      : evidence;
   }
 
   async close() {
     this.stopped = true;
     await this.watching;
     await this.settle();
-    if (!this.ended()) await outcome(this.client.send('Fetch.disable', {}, this.session));
+    for (const session of this.sessions.keys()) {
+      if (!this.ended()) await outcome(this.client.send('Fetch.disable', {}, session));
+      if (session !== this.sessions.keys().next().value) this.internalSessions?.delete(session);
+    }
+    for (const observer of this.observers)
+      await outcome(this.reader.send('Target.detachFromTarget', { sessionId: observer }));
     if (this.observer) {
       await outcome(
-        this.reader.send(
-          'Network.deleteCookies',
-          { name: this.cookie, domain: 'seven.sliccy.ai', path: '/' },
-          this.observer
-        )
+        this.reader.send('Network.deleteCookies', {
+          name: this.cookie,
+          domain: 'seven.sliccy.ai',
+          path: '/',
+        })
       );
-      await outcome(this.reader.send('Target.detachFromTarget', { sessionId: this.observer }));
     }
+    for (const targetId of this.targets)
+      await outcome(this.reader.send('Target.closeTarget', { targetId }));
     for (const registration of this.registrations)
       await this.fixture.redirectSecret({ ...registration, remove: true });
   }
@@ -749,7 +871,7 @@ export async function redirectSecret(options) {
     await probe.setup();
     if (options.mode === 'body') await probe.body();
     else await probe.headers();
-    probe.complete = !probe.ended();
+    probe.complete = !probe.ended() && !probe.halted;
     const evidence = await probe.evidence();
     if (probe.end && options.side !== 'guarded')
       throw new Error(`redirect-secret: ${options.side} session ended (${probe.end})`);