@ai-ecoverse/slicc-browsers 1.18.17 → 1.18.19

package/guard-vectors.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "setVersion": "1.18.17",
+  "setVersion": "1.18.19",
   "sources": [
     {
       "repo": "ai-ecoverse/slicc-cli",
@@ -1200,7 +1200,7 @@
           }
         },
         "eventsRedacted": {
-          "means": "protected error-page recover: every discovery event for the tab shows the failed URL's origin only or a masked or absent url, and no url or title carries the failed URL, its path, query or fragment; one after the client's navigation shows that origin, Chrome's error page, or an empty url titled with the protected host",
+          "means": "protected error-page recover: every discovery event for the tab shows, decoded as often as it takes, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
           "requires": ["discovery"],
           "check": {
             "result": "errorPage",
@@ -1210,7 +1210,7 @@
           }
         },
         "reload": {
-          "means": "protected error-page recover: reload",
+          "means": "protected error-page recover: Page.reload is answered, then the observer sees the protected error page again, or on the guarded leg exactly data:text/html,%3Ctitle%3Eblocked%3C%2Ftitle%3E with no unreachableUrl and no protected URL in its target url, title or location; a title or location the observer can't read is incomplete",
           "check": {
             "result": "errorPage",
             "path": "result.reload",
@@ -1349,7 +1349,7 @@
           }
         },
         "eventsRedacted": {
-          "means": "protected error-page recover (query): every discovery event for the tab shows the failed URL's origin only or a masked or absent url, and no url or title carries the failed URL, its path, query or fragment; one after the client's navigation shows that origin, Chrome's error page, or an empty url titled with the protected host",
+          "means": "protected error-page recover (query): every discovery event for the tab shows, decoded as often as it takes, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
           "requires": ["discovery"],
           "check": {
             "result": "errorPage",
@@ -1359,7 +1359,7 @@
           }
         },
         "reload": {
-          "means": "protected error-page recover (query): reload",
+          "means": "protected error-page recover (query): Page.reload is answered, then the observer sees the protected error page again, or on the guarded leg exactly data:text/html,%3Ctitle%3Eblocked%3C%2Ftitle%3E with no unreachableUrl and no protected URL in its target url, title or location; a title or location the observer can't read is incomplete",
           "check": {
             "result": "errorPage",
             "path": "result.reload",
@@ -1498,7 +1498,7 @@
           }
         },
         "eventsRedacted": {
-          "means": "protected error-page recover (fragment): every discovery event for the tab shows the failed URL's origin only or a masked or absent url, and no url or title carries the failed URL, its path, query or fragment; one after the client's navigation shows that origin, Chrome's error page, or an empty url titled with the protected host",
+          "means": "protected error-page recover (fragment): every discovery event for the tab shows, decoded as often as it takes, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
           "requires": ["discovery"],
           "check": {
             "result": "errorPage",
@@ -1508,7 +1508,7 @@
           }
         },
         "reload": {
-          "means": "protected error-page recover (fragment): reload",
+          "means": "protected error-page recover (fragment): Page.reload is answered, then the observer sees the protected error page again, or on the guarded leg exactly data:text/html,%3Ctitle%3Eblocked%3C%2Ftitle%3E with no unreachableUrl and no protected URL in its target url, title or location; a title or location the observer can't read is incomplete",
           "check": {
             "result": "errorPage",
             "path": "result.reload",
@@ -1646,7 +1646,7 @@
           }
         },
         "eventsRedacted": {
-          "means": "protected error-page restore: every discovery event for the tab shows the failed URL's origin only or a masked or absent url, and no url or title carries the failed URL, its path, query or fragment; one after the client's navigation shows that origin, Chrome's error page, or an empty url titled with the protected host",
+          "means": "protected error-page restore: every discovery event for the tab shows, decoded as often as it takes, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
           "requires": ["discovery"],
           "check": {
             "result": "errorPage",
@@ -1656,7 +1656,7 @@
           }
         },
         "reload": {
-          "means": "protected error-page restore: reload",
+          "means": "protected error-page restore: Page.reload is answered, then the observer sees the protected error page again, or on the guarded leg exactly data:text/html,%3Ctitle%3Eblocked%3C%2Ftitle%3E with no unreachableUrl and no protected URL in its target url, title or location; a title or location the observer can't read is incomplete",
           "check": {
             "result": "errorPage",
             "path": "result.reload",
@@ -1827,7 +1827,7 @@
           }
         },
         "eventsRedacted": {
-          "means": "protected error-page sticky: every discovery event for the tab shows the failed URL's origin only or a masked or absent url, and no url or title carries the failed URL, its path, query or fragment; one after the client's navigation shows that origin, Chrome's error page, or an empty url titled with the protected host",
+          "means": "protected error-page sticky: every discovery event for the tab shows, decoded as often as it takes, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
           "requires": ["discovery"],
           "check": {
             "result": "errorPage",
@@ -1837,7 +1837,7 @@
           }
         },
         "reload": {
-          "means": "protected error-page sticky: reload",
+          "means": "protected error-page sticky: Page.reload is answered, then the observer sees the protected error page again, or on the guarded leg exactly data:text/html,%3Ctitle%3Eblocked%3C%2Ftitle%3E with no unreachableUrl and no protected URL in its target url, title or location; a title or location the observer can't read is incomplete",
           "check": {
             "result": "errorPage",
             "path": "result.reload",
@@ -2020,7 +2020,7 @@
           }
         },
         "eventsRedacted": {
-          "means": "protected error-page sticky (query): every discovery event for the tab shows the failed URL's origin only or a masked or absent url, and no url or title carries the failed URL, its path, query or fragment; one after the client's navigation shows that origin, Chrome's error page, or an empty url titled with the protected host",
+          "means": "protected error-page sticky (query): every discovery event for the tab shows, decoded as often as it takes, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
           "requires": ["discovery"],
           "check": {
             "result": "errorPage",
@@ -2030,7 +2030,7 @@
           }
         },
         "reload": {
-          "means": "protected error-page sticky (query): reload",
+          "means": "protected error-page sticky (query): Page.reload is answered, then the observer sees the protected error page again, or on the guarded leg exactly data:text/html,%3Ctitle%3Eblocked%3C%2Ftitle%3E with no unreachableUrl and no protected URL in its target url, title or location; a title or location the observer can't read is incomplete",
           "check": {
             "result": "errorPage",
             "path": "result.reload",
@@ -2213,7 +2213,7 @@
           }
         },
         "eventsRedacted": {
-          "means": "protected error-page sticky (fragment): every discovery event for the tab shows the failed URL's origin only or a masked or absent url, and no url or title carries the failed URL, its path, query or fragment; one after the client's navigation shows that origin, Chrome's error page, or an empty url titled with the protected host",
+          "means": "protected error-page sticky (fragment): every discovery event for the tab shows, decoded as often as it takes, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
           "requires": ["discovery"],
           "check": {
             "result": "errorPage",
@@ -2223,7 +2223,7 @@
           }
         },
         "reload": {
-          "means": "protected error-page sticky (fragment): reload",
+          "means": "protected error-page sticky (fragment): Page.reload is answered, then the observer sees the protected error page again, or on the guarded leg exactly data:text/html,%3Ctitle%3Eblocked%3C%2Ftitle%3E with no unreachableUrl and no protected URL in its target url, title or location; a title or location the observer can't read is incomplete",
           "check": {
             "result": "errorPage",
             "path": "result.reload",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-browsers",
-  "version": "1.18.17",
+  "version": "1.18.19",
   "description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
   "type": "module",
   "license": "Apache-2.0",
@@ -68,7 +68,7 @@
     "validate": "node scripts/validate.mjs",
     "lint": "slicc-lint && test -z \"$(gofmt -l .)\" && go mod tidy -diff && go vet ./... && GOOS=darwin go vet ./... && GOOS=windows go vet ./... && golangci-lint run && cargo fmt --check && cargo clippy --all-features --all-targets -- -D warnings && cargo check --target wasm32-wasip1 --no-default-features && cargo check --target wasm32-wasip1 --features serde && cargo check --target wasm32-wasip1 --all-features",
     "format": "biome check --write . && gofmt -w . && cargo fmt",
-    "test": "export PATH=\"$HOME/.cargo/bin:$PATH\" && node --test --test-concurrency=1 test/integration/self-contained.test.mjs test/integration/browser-runner.test.mjs test/integration/fixture-client.test.mjs test/integration/guard-redirect-carrier.test.mjs test/integration/guard-redirect-session-end.test.mjs test/integration/guard-redirect-history.test.mjs test/integration/guard-redirect-iframe.test.mjs test/integration/guard-incomplete.test.mjs test/integration/guard-unparseable-wipe.test.mjs test/integration/guard-browser-ui.test.mjs test/integration/guard-snapshot-settle.test.mjs test/integration/guard-stall.test.mjs test/integration/guard-forged.test.mjs test/integration/guard-exit-steps.test.mjs test/integration/guard-exit-refusal.test.mjs test/integration/guard-frame-read.test.mjs test/integration/guard-bfcache.test.mjs test/integration/guard-bfcache-marker.test.mjs test/integration/guard-bfcache-history.test.mjs test/integration/guard-bfcache-review.test.mjs test/integration/guard-bfcache-quarantine.test.mjs test/integration/guard-error-page-navigation.test.mjs test/integration/guard-error-page-events.test.mjs test/integration/guard-world-paint.test.mjs test/integration/gates.test.mjs test/integration/validate.test.mjs test/integration/go.test.mjs test/integration/cargo.test.mjs test/integration/workflows.test.mjs test/integration/guard-sweep-union.test.mjs && node --test --test-concurrency=2 test/integration/guard-lifecycle.test.mjs test/integration/chromium-launch.test.mjs test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs test/integration/guard-late-pause.test.mjs test/integration/guard-legs.test.mjs test/integration/guard-fetch-enable.test.mjs test/integration/guard-diagnostics.test.mjs test/integration/guard-chrome.test.mjs test/integration/guard-worlds.test.mjs test/integration/guard-world-discovery.test.mjs test/integration/guard-world-guesses.test.mjs test/integration/guard-unparseable.test.mjs test/integration/guard-redirect-secret.test.mjs test/integration/guard-error-page.test.mjs test/integration/guard-discovery.test.mjs test/integration/guard-bfcache-chrome.test.mjs test/integration/guard-browser-page.test.mjs test/integration/guard-scales.test.mjs test/integration/guard-shared-log.test.mjs test/integration/guard-pre-beacon.test.mjs test/integration/guard-world-pause.test.mjs test/integration/guard-parallel.test.mjs test/integration/guard-client-exit.test.mjs test/integration/guard-runner.test.mjs test/integration/guard-sweep-ordinary.test.mjs test/integration/guard-sweep-seven.test.mjs test/integration/guard-sweep-vault.test.mjs test/integration/guard-sweep-vault-x.test.mjs test/integration/guard-sweep-apex.test.mjs test/integration/guard-sweep-others.test.mjs",
+    "test": "export PATH=\"$HOME/.cargo/bin:$PATH\" && node --test --test-concurrency=1 test/integration/self-contained.test.mjs test/integration/browser-runner.test.mjs test/integration/fixture-client.test.mjs test/integration/guard-redirect-carrier.test.mjs test/integration/guard-redirect-session-end.test.mjs test/integration/guard-redirect-history.test.mjs test/integration/guard-redirect-iframe.test.mjs test/integration/guard-incomplete.test.mjs test/integration/guard-unparseable-wipe.test.mjs test/integration/guard-browser-ui.test.mjs test/integration/guard-snapshot-settle.test.mjs test/integration/guard-stall.test.mjs test/integration/guard-forged.test.mjs test/integration/guard-exit-steps.test.mjs test/integration/guard-exit-refusal.test.mjs test/integration/guard-frame-read.test.mjs test/integration/guard-bfcache.test.mjs test/integration/guard-bfcache-marker.test.mjs test/integration/guard-bfcache-history.test.mjs test/integration/guard-bfcache-review.test.mjs test/integration/guard-bfcache-quarantine.test.mjs test/integration/guard-error-page-navigation.test.mjs test/integration/guard-error-page-events.test.mjs test/integration/guard-error-page-reload.test.mjs test/integration/guard-world-paint.test.mjs test/integration/gates.test.mjs test/integration/validate.test.mjs test/integration/go.test.mjs test/integration/cargo.test.mjs test/integration/workflows.test.mjs test/integration/guard-sweep-union.test.mjs && node --test --test-concurrency=2 test/integration/guard-lifecycle.test.mjs test/integration/chromium-launch.test.mjs test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs test/integration/guard-late-pause.test.mjs test/integration/guard-legs.test.mjs test/integration/guard-fetch-enable.test.mjs test/integration/guard-diagnostics.test.mjs test/integration/guard-chrome.test.mjs test/integration/guard-worlds.test.mjs test/integration/guard-world-discovery.test.mjs test/integration/guard-world-guesses.test.mjs test/integration/guard-unparseable.test.mjs test/integration/guard-redirect-secret.test.mjs test/integration/guard-error-page.test.mjs test/integration/guard-discovery.test.mjs test/integration/guard-bfcache-chrome.test.mjs test/integration/guard-browser-page.test.mjs test/integration/guard-scales.test.mjs test/integration/guard-shared-log.test.mjs test/integration/guard-pre-beacon.test.mjs test/integration/guard-world-pause.test.mjs test/integration/guard-parallel.test.mjs test/integration/guard-client-exit.test.mjs test/integration/guard-runner.test.mjs test/integration/guard-sweep-ordinary.test.mjs test/integration/guard-sweep-seven.test.mjs test/integration/guard-sweep-vault.test.mjs test/integration/guard-sweep-vault-x.test.mjs test/integration/guard-sweep-apex.test.mjs test/integration/guard-sweep-others.test.mjs",
     "test:unit": "mkdir -p coverage/unit && node --experimental-test-coverage --test --test-concurrency=1 --test-reporter=lcov --test-reporter-destination=coverage/unit/lcov.info test/unit/*.test.mjs && go test -race -cover ./...",
     "build": "go build ./... && cargo build --all-features && cargo build --target wasm32-wasip1 --all-features && npm pack --dry-run",
     "prepublishOnly": "node scripts/set-crate-version.mjs \"$npm_package_version\"",
@@ -80,8 +80,8 @@
   },
   "devDependencies": {
     "@ai-ecoverse/slicc-cdp": "1.42.3",
-    "@ai-ecoverse/slicc-shared-web": "2.13.4",
-    "@biomejs/biome": "2.5.15",
+    "@ai-ecoverse/slicc-shared-web": "2.13.6",
+    "@biomejs/biome": "2.6.2",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",
     "lefthook": "2.2.2",

package/protected-error-page.mjs

@@ -52,7 +52,6 @@ async function lockChecks({ client, session, targetId, result }) {
 }
 
 const discoveryMethods = ['Target.targetCreated', 'Target.targetInfoChanged'];
-const errorPageURL = 'chrome-error://chromewebdata/';
 const lower = (value) => String(value ?? '').toLowerCase();
 const plain = (value) =>
   lower(
@@ -60,6 +59,11 @@ const plain = (value) =>
       String.fromCharCode(Number.parseInt(hex, 16))
     )
   );
+const layers = (value) => {
+  const out = [lower(value)];
+  for (let next = plain(out[0]); next !== out.at(-1); next = plain(next)) out.push(next);
+  return out;
+};
 const unschemed = (value) => value.replace(/^[a-z][a-z\d+.-]*:\/\//, '');
 
 const encoded = (url) =>
@@ -70,10 +74,12 @@ const encoded = (url) =>
 
 const triggerURL = (ordinary, url) => `${ordinary}/page?k=deferred&defer=0&to=${encoded(url)}`;
 
-function discoveryRules({ failedURL, tag, trigger }) {
+const errorPageURL = 'chrome-error://chromewebdata/';
+const privateBlankURL = 'data:text/html,%3Ctitle%3Eblocked%3C%2Ftitle%3E';
+
+function failureRules({ failedURL, tag }) {
   const failed = new URL(failedURL);
-  const { origin, host, hostname } = failed;
-  const named = [hostname, host, origin];
+  const { origin, hostname } = failed;
   const parts = [
     failedURL,
     `${failed.pathname}${failed.search}${failed.hash}`,
@@ -84,49 +90,74 @@ function discoveryRules({ failedURL, tag, trigger }) {
   ]
     .filter((part) => part && part !== '/')
     .map(plain);
-  const forms = (value) => [lower(value), plain(value)];
-  const leaks = (value) => forms(value).some((form) => parts.some((part) => form.includes(part)));
+  const leaks = (value) => layers(value).some((form) => parts.some((part) => form.includes(part)));
   const names = (value) =>
-    forms(value).some((form) => form.includes(hostname)) || parseURL(value)?.origin === origin;
+    layers(value).some((form) => form.includes(hostname)) || parseURL(value)?.origin === origin;
+  const carries = (value) => layers(value).some((form) => form.includes(plain(tag)));
+  return { failed, leaks, names, carries };
+}
+
+function discoveryRules({ failedURL, tag, trigger }) {
+  const { failed, leaks, names, carries } = failureRules({ failedURL, tag });
+  const { origin, host, hostname } = failed;
+  const named = [hostname, host, origin];
   const cleanTitle = (title) => !leaks(title) && (!names(title) || named.includes(lower(title)));
   const ownTitle = ({ url, title }) =>
     plain(title) !== '' && [plain(url), unschemed(plain(url))].includes(plain(title));
+  const inner = (u) => (u && !u.host ? inner(parseURL(u.pathname)) : u);
+  const onHost = (u) => u?.hostname.replace(/\.$/, '') === hostname;
+  const references = (form) =>
+    Array.from(
+      form.matchAll(/(?:[a-z][a-z\d+.-]*:)+[\\/]*[^\\/?#&\s]*|[\\/]{2}[^\\/?#&\s]*/g),
+      ([ref]) => inner(parseURL(ref, /^[\\/]/.test(ref) ? origin : undefined))
+    );
+  const exact = (form) =>
+    form === origin ||
+    (!onHost(inner(parseURL(form))) &&
+      references(form).every((u) => !onHost(u) || u.origin === origin));
+  const cleanURL = (url) => !leaks(url) && layers(url).every(exact);
   const home = parseURL(trigger)?.href;
   const clean = (info) => {
     if (parseURL(info.url)?.href === home) return ownTitle(info) || cleanTitle(info.title);
-    return (
-      !leaks(info.url) && (lower(info.url) === origin || !names(info.url)) && cleanTitle(info.title)
-    );
+    return cleanURL(info.url) && (cleanTitle(info.title) || (ownTitle(info) && !leaks(info.title)));
   };
-  const shows = ({ url, title }) =>
-    [origin, errorPageURL].includes(lower(url)) ||
-    (lower(url) === '' && named.includes(lower(title)));
-  return { clean, shows };
+  return { clean, carries };
 }
 
-function eventsRedacted({ events, targetId, start, sent, ...failure }) {
-  const infos = (from) =>
-    events
-      .slice(from)
-      .filter(
-        (e) => discoveryMethods.includes(e.method) && e.params?.targetInfo?.targetId === targetId
-      )
-      .map((e) => e.params.targetInfo);
-  const { clean, shows } = discoveryRules(failure);
-  return infos(sent).some(shows) && infos(start).every(clean);
+function eventsRedacted({ events, targetId, start, ...failure }) {
+  const { clean, carries } = discoveryRules(failure);
+  return events
+    .slice(start)
+    .filter((e) => discoveryMethods.includes(e.method))
+    .every((e) =>
+      e.params?.targetInfo?.targetId === targetId
+        ? clean(e.params.targetInfo)
+        : !carries(JSON.stringify(e.params ?? null))
+    );
 }
 
-async function redaction({
-  client,
-  targetId,
-  failedURL,
-  ordinary,
-  tag,
-  start,
-  sent,
-  result,
-  discovery,
-}) {
+async function privateBlank({ frame, reader, observer, targetId, failedURL, tag }) {
+  const { leaks, names } = failureRules({ failedURL, tag });
+  if (frame.url !== privateBlankURL || frame.unreachableUrl) return false;
+  const { targetInfo } = await reader.send('Target.getTargetInfo', { targetId });
+  if (targetInfo.url !== privateBlankURL) return false;
+  const read = async (expression) => {
+    const out = await outcome(
+      reader.send('Runtime.evaluate', { expression, returnByValue: true }, observer)
+    );
+    const value = out.result?.result?.value;
+    return out.ok && !out.result.exceptionDetails && typeof value === 'string' ? value : undefined;
+  };
+  const href = await read('location.href');
+  const title = await read('document.title');
+  if (href === undefined || title === undefined) return 'incomplete';
+  return (
+    href === privateBlankURL &&
+    ![targetInfo.title, title].some((value) => leaks(value) || names(value))
+  );
+}
+
+async function redaction({ client, targetId, failedURL, ordinary, tag, start, result, discovery }) {
   const info = await outcome(client.send('Target.getTargetInfo', { targetId }));
   const list = await outcome(client.send('Target.getTargets'));
   const before = client.events.length;
@@ -155,7 +186,6 @@ async function redaction({
         events: client.events,
         targetId,
         start,
-        sent,
         failedURL,
         tag,
         trigger: triggerURL(ordinary, failedURL),
@@ -290,7 +320,6 @@ export async function protectedErrorPage({
       );
     }
     await outcome(reader.send('Page.bringToFront', {}, observer));
-    const sent = client.events.length;
     const unsent = await scripted(client, session, ordinary, failedURL);
     if (unsent) return missing(unsent);
     let evidence;
@@ -300,7 +329,7 @@ export async function protectedErrorPage({
       const { targetInfo } = await reader.send('Target.getTargetInfo', { targetId });
       evidence = { frame: f, targetInfo };
       return (
-        f.url === 'chrome-error://chromewebdata/' &&
+        f.url === errorPageURL &&
         f.securityOrigin === '://' &&
         f.unreachableUrl === failedURL &&
         targetInfo.url === failedURL
@@ -317,25 +346,24 @@ export async function protectedErrorPage({
       return missing(`missing error commit ${JSON.stringify(evidence)}`);
     result.live = live;
     if (!live) return { ...result, liveWhy: commitWhy(result.diagnostics.errorCommit) };
-    await redaction({
-      client,
-      targetId,
-      failedURL,
-      ordinary,
-      tag,
-      start,
-      sent,
-      result,
-      discovery,
-    });
+    await redaction({ client, targetId, failedURL, ordinary, tag, start, result, discovery });
     const beforeReload = (await frame()).loaderId;
     result.reload = (await outcome(client.send('Page.reload', {}, session))).ok;
     if (result.reload) {
-      result.reloadedError = await until(async () => {
+      result.reload = await until(async () => {
         const f = await frame();
-        return f.loaderId !== beforeReload && f.unreachableUrl === failedURL;
+        result.reloadedError =
+          f.loaderId !== beforeReload && f.url === errorPageURL && f.unreachableUrl === failedURL;
+        result.reloadedBlank =
+          !result.reloadedError &&
+          side === 'guarded' &&
+          (await privateBlank({ frame: f, reader, observer, targetId, failedURL, tag }));
+        return result.reloadedError || result.reloadedBlank === true;
       });
-      result.reload = result.reloadedError;
+      if (!result.reload && result.reloadedBlank === 'incomplete') {
+        result.reload = 'incomplete';
+        result.incomplete = 'protected-error-page: the private blank page could not be read';
+      }
     }
     const recovery = `${ordinary}/blank?n=${tag}-recover`;
     result.blank = (await outcome(client.send('Page.navigate', { url: recovery }, session))).ok;