@ai-ecoverse/slicc-browsers 1.21.0 → 1.22.0

package/guard-vectors.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "setVersion": "1.21.0",
+  "setVersion": "1.22.0",
   "sources": [
     {
       "repo": "ai-ecoverse/slicc-cli",
@@ -105,7 +105,8 @@
     "forwardAudit": "a complete browser-side forwarding ledger for history-restore probes and for checks of a command's forwarded params (client.forwarded)",
     "stockSetup": "the guard admits stock clients' setup calls: init scripts with no code (the no-code regex is matched on the whole string without the multiline flag), the four display emulation calls, bindings scoped to an isolated world, Page.createIsolatedWorld on an ordinary frame with grantUniveralAccess and contentSecurityPolicy stripped and no executionContextId for any other frame, and Target.setAutoAttach narrowed to tab targets (pages under the tab held like pages, with the same URL redaction in targetInfo)",
     "syntheticAutoAttach": "the transport has no native Target.setAutoAttach, so the guard attaches new tabs, pages and their children itself and synthesizes Target.attachedToTarget, with the same placement and holds",
-    "secureOrigin": "the fixture and page origins are secure contexts (HTTPS), so service worker registration is available"
+    "secureOrigin": "the fixture and page origins are secure contexts (HTTPS), so service worker registration is available",
+    "closeProtected": "the guard lets Target.closeTarget close a protected tab"
   },
   "placeholders": {
     "target": "the target's origin; {plain} on the control",
@@ -1706,6 +1707,7 @@
         },
         "closeRefused": {
           "means": "protected error-page restore: closeRefused",
+          "unless": ["closeProtected"],
           "check": {
             "result": "errorPage",
             "path": "result.closeRefused",
@@ -1713,6 +1715,16 @@
             "observer": "client"
           }
         },
+        "closed": {
+          "means": "protected error-page restore: Target.closeTarget on the locked tab is answered with success and the tab is gone",
+          "check": {
+            "result": "errorPage",
+            "path": "result.closed",
+            "equals": true,
+            "observer": "client"
+          },
+          "requires": ["closeProtected"]
+        },
         "attachRedacted": {
           "means": "protected error-page restore: attachRedacted",
           "check": {
@@ -1754,6 +1766,7 @@
           "evaluateRefused": false,
           "attachRefused": false,
           "closeRefused": false,
+          "closed": true,
           "attachRedacted": false,
           "fullURL": true
         }
@@ -1770,6 +1783,7 @@
         "evaluateRefused": true,
         "attachRefused": true,
         "closeRefused": true,
+        "closed": true,
         "attachRedacted": true,
         "fullURL": false
       }
@@ -1887,6 +1901,7 @@
         },
         "closeRefused": {
           "means": "protected error-page sticky: closeRefused",
+          "unless": ["closeProtected"],
           "check": {
             "result": "errorPage",
             "path": "result.closeRefused",
@@ -1894,6 +1909,16 @@
             "observer": "client"
           }
         },
+        "closed": {
+          "means": "protected error-page sticky: Target.closeTarget on the locked tab is answered with success and the tab is gone",
+          "check": {
+            "result": "errorPage",
+            "path": "result.closed",
+            "equals": true,
+            "observer": "client"
+          },
+          "requires": ["closeProtected"]
+        },
         "stickyError": {
           "means": "protected error-page sticky: stickyError",
           "check": {
@@ -1944,6 +1969,7 @@
           "evaluateRefused": false,
           "attachRefused": false,
           "closeRefused": false,
+          "closed": true,
           "stickyError": true,
           "attachRedacted": false,
           "fullURL": true
@@ -1961,6 +1987,7 @@
         "evaluateRefused": true,
         "attachRefused": true,
         "closeRefused": true,
+        "closed": true,
         "stickyError": true,
         "attachRedacted": true,
         "fullURL": false
@@ -2080,6 +2107,7 @@
         },
         "closeRefused": {
           "means": "protected error-page sticky (query): closeRefused",
+          "unless": ["closeProtected"],
           "check": {
             "result": "errorPage",
             "path": "result.closeRefused",
@@ -2087,6 +2115,16 @@
             "observer": "client"
           }
         },
+        "closed": {
+          "means": "protected error-page sticky (query): Target.closeTarget on the locked tab is answered with success and the tab is gone",
+          "check": {
+            "result": "errorPage",
+            "path": "result.closed",
+            "equals": true,
+            "observer": "client"
+          },
+          "requires": ["closeProtected"]
+        },
         "stickyError": {
           "means": "protected error-page sticky (query): stickyError",
           "check": {
@@ -2137,6 +2175,7 @@
           "evaluateRefused": false,
           "attachRefused": false,
           "closeRefused": false,
+          "closed": true,
           "stickyError": true,
           "attachRedacted": false,
           "fullURL": true
@@ -2154,6 +2193,7 @@
         "evaluateRefused": true,
         "attachRefused": true,
         "closeRefused": true,
+        "closed": true,
         "stickyError": true,
         "attachRedacted": true,
         "fullURL": false
@@ -2273,6 +2313,7 @@
         },
         "closeRefused": {
           "means": "protected error-page sticky (fragment): closeRefused",
+          "unless": ["closeProtected"],
           "check": {
             "result": "errorPage",
             "path": "result.closeRefused",
@@ -2280,6 +2321,16 @@
             "observer": "client"
           }
         },
+        "closed": {
+          "means": "protected error-page sticky (fragment): Target.closeTarget on the locked tab is answered with success and the tab is gone",
+          "check": {
+            "result": "errorPage",
+            "path": "result.closed",
+            "equals": true,
+            "observer": "client"
+          },
+          "requires": ["closeProtected"]
+        },
         "stickyError": {
           "means": "protected error-page sticky (fragment): stickyError",
           "check": {
@@ -2330,6 +2381,7 @@
           "evaluateRefused": false,
           "attachRefused": false,
           "closeRefused": false,
+          "closed": true,
           "stickyError": true,
           "attachRedacted": false,
           "fullURL": true
@@ -2347,6 +2399,7 @@
         "evaluateRefused": true,
         "attachRefused": true,
         "closeRefused": true,
+        "closed": true,
         "stickyError": true,
         "attachRedacted": true,
         "fullURL": false
@@ -26528,7 +26581,12 @@
       "trigger": [
         {
           "page": "navigate",
-          "url": "{target}/doc?n={tag}"
+          "url": "{target}/doc?n={tag}",
+          "as": "nav",
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          }
         },
         {
           "settle": {
@@ -26569,6 +26627,10 @@
       "live": "the stand-in served {target}/doc?n={tag}, or the guard refused the protected navigation (pre + blocked), or refused a refusable setup step",
       "liveCheck": {
         "any": [
+          {
+            "refused": ["nav"],
+            "observer": "client"
+          },
           {
             "loaded": "{target}/doc?n={tag}",
             "observer": "fixture"
@@ -26631,6 +26693,137 @@
       },
       "designDependent": ["loaded"]
     },
+    {
+      "id": "E7.init-world-carry.script",
+      "family": "E",
+      "kind": "cdp",
+      "scope": "any",
+      "setup": [
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?n=start-{tag}"
+        },
+        {
+          "observer": "watch"
+        },
+        {
+          "cdp": "Page.enable"
+        },
+        {
+          "cdp": "Runtime.enable"
+        },
+        {
+          "cdp": "Page.addScriptToEvaluateOnNewDocument",
+          "params": {
+            "source": "",
+            "worldName": "slicc-carry-{tag}"
+          },
+          "as": "world",
+          "requires": ["stockSetup"]
+        }
+      ],
+      "trigger": [
+        {
+          "page": "href",
+          "url": "{target}/doc?n={tag}"
+        },
+        {
+          "settle": {
+            "title": "doc",
+            "ms": 5000,
+            "or": {
+              "served": "{target}/doc?n={tag}",
+              "observer": "fixture"
+            }
+          }
+        },
+        {
+          "settle": {
+            "ms": 500
+          }
+        }
+      ],
+      "targets": ["seven", "vault"],
+      "requires": ["stockSetup"],
+      "observe": {
+        "worldOnProtected": {
+          "means": "the unguarded observer saw the named world created on {target}",
+          "check": {
+            "world": "slicc-carry-{tag}",
+            "origin": "{target}",
+            "observer": "unguarded"
+          }
+        },
+        "loaded": {
+          "means": "the stand-in served {target}/doc?n={tag}",
+          "dependsOn": [],
+          "check": {
+            "served": "{target}/doc?n={tag}",
+            "observer": "fixture"
+          }
+        }
+      },
+      "live": "the stand-in served the protected document, or the guard refused that load (pre + blocked)",
+      "liveCheck": {
+        "any": [
+          {
+            "loaded": "{target}/doc?n={tag}",
+            "observer": "fixture"
+          },
+          {
+            "all": [
+              {
+                "pre": "{target}/doc?n={tag}",
+                "observer": "fixture"
+              },
+              {
+                "any": [
+                  {
+                    "blocked": {
+                      "url": "{target}/doc?n={tag}",
+                      "session": "page",
+                      "frame": false
+                    },
+                    "observer": "client"
+                  },
+                  {
+                    "blocked": {
+                      "url": "{target}/doc?n={tag}",
+                      "session": "page",
+                      "frame": false
+                    },
+                    "observer": "unguarded"
+                  },
+                  {
+                    "history": {
+                      "url": "{target}/doc?n={tag}",
+                      "session": "page"
+                    },
+                    "observer": "unguarded"
+                  }
+                ],
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          }
+        ],
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "worldOnProtected": true,
+          "loaded": true
+        }
+      },
+      "expected": {
+        "worldOnProtected": false,
+        "loaded": "either"
+      },
+      "designDependent": ["loaded"]
+    },
     {
       "id": "E7.init-world-bfcache",
       "family": "E",
@@ -26663,7 +26856,12 @@
       "trigger": [
         {
           "page": "navigate",
-          "url": "{target}/bfcache?n={tag}-p"
+          "url": "{target}/bfcache?n={tag}-p",
+          "as": "nav",
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          }
         },
         {
           "settle": {
@@ -26728,12 +26926,17 @@
           "check": {
             "served": "{target}/bfcache?n={tag}-p",
             "observer": "fixture"
-          }
+          },
+          "dependsOn": []
         }
       },
       "live": "the stand-in served the protected bfcache document, or the guard refused that navigation (pre + blocked), or refused a refusable setup step",
       "liveCheck": {
         "any": [
+          {
+            "refused": ["nav"],
+            "observer": "client"
+          },
           {
             "loaded": "{target}/bfcache?n={tag}-p",
             "observer": "fixture"
@@ -26799,22 +27002,18 @@
       "designDependent": ["loaded"]
     },
     {
-      "id": "E7.init-world-error",
+      "id": "E7.init-world-bfcache.script",
       "family": "E",
       "kind": "cdp",
       "scope": "any",
       "setup": [
         {
           "page": "tab",
-          "url": "{ordinary}/doc?n=start-{tag}"
+          "url": "{ordinary}/bfcache?n={tag}-start"
         },
         {
           "observer": "watch"
         },
-        {
-          "observer": "fail",
-          "url": "{target}/doc*"
-        },
         {
           "cdp": "Page.enable"
         },
@@ -26825,30 +27024,65 @@
           "cdp": "Page.addScriptToEvaluateOnNewDocument",
           "params": {
             "source": "",
-            "worldName": "slicc-error-{tag}"
+            "worldName": "slicc-bf-{tag}"
           },
           "as": "world",
           "requires": ["stockSetup"]
         }
       ],
       "trigger": [
+        {
+          "page": "href",
+          "url": "{target}/bfcache?n={tag}-p"
+        },
+        {
+          "settle": {
+            "ms": 5000,
+            "or": {
+              "served": "{target}/bfcache?n={tag}-p",
+              "observer": "fixture"
+            }
+          }
+        },
         {
           "page": "navigate",
-          "url": "{target}/doc?n={tag}"
+          "url": "{ordinary}/bfcache?n={tag}-b"
         },
         {
           "settle": {
-            "ms": 5000
+            "ms": 5000,
+            "or": {
+              "served": "{ordinary}/bfcache?n={tag}-b",
+              "observer": "fixture"
+            }
+          }
+        },
+        {
+          "observer": "watch"
+        },
+        {
+          "cdp": "Runtime.evaluate",
+          "params": {
+            "expression": "history.back()",
+            "returnByValue": true
+          },
+          "as": "back"
+        },
+        {
+          "settle": {
+            "ms": 3000
           }
         }
       ],
       "targets": ["seven", "vault"],
       "requires": ["stockSetup"],
       "observe": {
-        "worldOnError": {
-          "means": "the unguarded observer saw the admitted no-code world on Chrome's error page for the failed {target} navigation",
+        "worldOnProtected": {
+          "means": "after bfcache restore the unguarded observer saw the named no-code world on the protected document",
           "check": {
-            "world": "slicc-error-{tag}",
+            "world": "slicc-bf-{tag}",
+            "origin": "{target}",
+            "afterClear": true,
             "observer": "unguarded"
           }
         },
@@ -26859,47 +27093,556 @@
             "observer": "fixture"
           }
         },
-        "pre": {
-          "means": "the stand-in saw a pre-request for {target}/doc?n={tag}",
-          "dependsOn": [],
+        "loaded": {
+          "means": "the stand-in served the protected bfcache document",
           "check": {
-            "pre": "{target}/doc?n={tag}",
+            "served": "{target}/bfcache?n={tag}-p",
             "observer": "fixture"
-          }
+          },
+          "dependsOn": []
         }
       },
-      "live": "the runner saw a pre-request for the protected URL, or the guard refused the world",
+      "live": "the stand-in served the protected document, or the guard refused that load (pre + blocked)",
       "liveCheck": {
         "any": [
           {
-            "pre": "{target}/doc?n={tag}",
+            "loaded": "{target}/bfcache?n={tag}-p",
             "observer": "fixture"
           },
           {
-            "registration": "any",
-            "observer": "client"
-          }
-        ],
-        "observer": "client"
-      },
-      "control": {
-        "origin": "ordinary",
-        "via": "unguarded",
-        "expected": {
-          "worldOnError": true,
-          "beacon": false,
-          "pre": true
+            "all": [
+              {
+                "pre": "{target}/bfcache?n={tag}-p",
+                "observer": "fixture"
+              },
+              {
+                "any": [
+                  {
+                    "blocked": {
+                      "url": "{target}/bfcache?n={tag}-p",
+                      "session": "page",
+                      "frame": false
+                    },
+                    "observer": "client"
+                  },
+                  {
+                    "blocked": {
+                      "url": "{target}/bfcache?n={tag}-p",
+                      "session": "page",
+                      "frame": false
+                    },
+                    "observer": "unguarded"
+                  },
+                  {
+                    "history": {
+                      "url": "{target}/bfcache?n={tag}-p",
+                      "session": "page"
+                    },
+                    "observer": "unguarded"
+                  }
+                ],
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          }
+        ],
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "worldOnProtected": true,
+          "beacon": false,
+          "loaded": true
+        }
+      },
+      "expected": {
+        "worldOnProtected": false,
+        "beacon": false,
+        "loaded": "either"
+      },
+      "designDependent": ["loaded"]
+    },
+    {
+      "id": "E7.init-world-error",
+      "family": "E",
+      "kind": "cdp",
+      "scope": "any",
+      "setup": [
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?n=start-{tag}"
+        },
+        {
+          "observer": "watch"
+        },
+        {
+          "observer": "fail",
+          "url": "{target}/doc*"
+        },
+        {
+          "cdp": "Page.enable"
+        },
+        {
+          "cdp": "Runtime.enable"
+        },
+        {
+          "cdp": "Page.addScriptToEvaluateOnNewDocument",
+          "params": {
+            "source": "",
+            "worldName": "slicc-error-{tag}"
+          },
+          "as": "world",
+          "requires": ["stockSetup"]
+        }
+      ],
+      "trigger": [
+        {
+          "page": "navigate",
+          "url": "{target}/doc?n={tag}",
+          "as": "nav",
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          }
+        },
+        {
+          "settle": {
+            "ms": 5000
+          }
+        }
+      ],
+      "targets": ["seven", "vault"],
+      "requires": ["stockSetup"],
+      "observe": {
+        "worldOnError": {
+          "means": "the unguarded observer saw the admitted no-code world on Chrome's error page for the failed {target} navigation",
+          "check": {
+            "world": "slicc-error-{tag}",
+            "observer": "unguarded"
+          },
+          "dependsOn": ["nav"]
+        },
+        "beacon": {
+          "means": "a beacon from {target}",
+          "check": {
+            "beacon": "{target}",
+            "observer": "fixture"
+          }
+        },
+        "pre": {
+          "means": "the stand-in saw a pre-request for {target}/doc?n={tag}",
+          "dependsOn": [],
+          "check": {
+            "pre": "{target}/doc?n={tag}",
+            "observer": "fixture"
+          }
+        }
+      },
+      "live": "the runner saw a pre-request for the protected URL, or the guard refused the world, or the guard refused the protected navigation command",
+      "liveCheck": {
+        "any": [
+          {
+            "refused": ["nav"],
+            "observer": "client"
+          },
+          {
+            "pre": "{target}/doc?n={tag}",
+            "observer": "fixture"
+          },
+          {
+            "registration": "any",
+            "observer": "client"
+          }
+        ],
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "worldOnError": true,
+          "beacon": false,
+          "pre": true
+        }
+      },
+      "expected": {
+        "worldOnError": true,
+        "beacon": false,
+        "pre": "either"
+      },
+      "designDependent": ["pre"]
+    },
+    {
+      "id": "E7.init-world-error.script",
+      "family": "E",
+      "kind": "cdp",
+      "scope": "any",
+      "setup": [
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?n=start-{tag}"
+        },
+        {
+          "observer": "watch"
+        },
+        {
+          "observer": "fail",
+          "url": "{target}/doc*"
+        },
+        {
+          "cdp": "Page.enable"
+        },
+        {
+          "cdp": "Runtime.enable"
+        },
+        {
+          "cdp": "Page.addScriptToEvaluateOnNewDocument",
+          "params": {
+            "source": "",
+            "worldName": "slicc-error-{tag}"
+          },
+          "as": "world",
+          "requires": ["stockSetup"]
+        }
+      ],
+      "trigger": [
+        {
+          "page": "href",
+          "url": "{target}/doc?n={tag}"
+        },
+        {
+          "settle": {
+            "ms": 5000
+          }
+        }
+      ],
+      "targets": ["seven", "vault"],
+      "requires": ["stockSetup"],
+      "observe": {
+        "worldOnError": {
+          "means": "the unguarded observer saw the admitted no-code world on Chrome's error page for the failed {target} navigation",
+          "check": {
+            "world": "slicc-error-{tag}",
+            "observer": "unguarded"
+          }
+        },
+        "beacon": {
+          "means": "a beacon from {target}",
+          "check": {
+            "beacon": "{target}",
+            "observer": "fixture"
+          }
+        },
+        "pre": {
+          "means": "the stand-in saw a pre-request for {target}/doc?n={tag}",
+          "dependsOn": [],
+          "check": {
+            "pre": "{target}/doc?n={tag}",
+            "observer": "fixture"
+          }
+        }
+      },
+      "live": "the runner saw a pre-request for the protected URL, or refused that load (pre + blocked)",
+      "liveCheck": {
+        "any": [
+          {
+            "pre": "{target}/doc?n={tag}",
+            "observer": "fixture"
+          },
+          {
+            "all": [
+              {
+                "pre": "{target}/doc?n={tag}",
+                "observer": "fixture"
+              },
+              {
+                "any": [
+                  {
+                    "blocked": {
+                      "url": "{target}/doc?n={tag}",
+                      "session": "page",
+                      "frame": false
+                    },
+                    "observer": "client"
+                  },
+                  {
+                    "blocked": {
+                      "url": "{target}/doc?n={tag}",
+                      "session": "page",
+                      "frame": false
+                    },
+                    "observer": "unguarded"
+                  },
+                  {
+                    "history": {
+                      "url": "{target}/doc?n={tag}",
+                      "session": "page"
+                    },
+                    "observer": "unguarded"
+                  }
+                ],
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          }
+        ],
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "worldOnError": true,
+          "beacon": false,
+          "pre": true
+        }
+      },
+      "expected": {
+        "worldOnError": true,
+        "beacon": false,
+        "pre": "either"
+      },
+      "designDependent": ["pre"]
+    },
+    {
+      "id": "E7.emulation-carry",
+      "family": "E",
+      "kind": "cdp",
+      "scope": "any",
+      "setup": [
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?n=start-{tag}"
+        },
+        {
+          "cdp": "Page.enable"
+        },
+        {
+          "cdp": "Emulation.setFocusEmulationEnabled",
+          "params": {
+            "enabled": true
+          },
+          "as": "focus",
+          "requires": ["stockSetup"]
+        },
+        {
+          "cdp": "Emulation.setEmulatedMedia",
+          "params": {
+            "media": "",
+            "features": [
+              {
+                "name": "prefers-color-scheme",
+                "value": "light"
+              },
+              {
+                "name": "prefers-reduced-motion",
+                "value": "reduce"
+              },
+              {
+                "name": "forced-colors",
+                "value": "none"
+              },
+              {
+                "name": "prefers-contrast",
+                "value": "no-preference"
+              }
+            ]
+          },
+          "as": "media",
+          "requires": ["stockSetup"]
+        },
+        {
+          "cdp": "Emulation.setDeviceMetricsOverride",
+          "params": {
+            "width": 1001,
+            "height": 601,
+            "deviceScaleFactor": 1,
+            "mobile": false,
+            "screenWidth": 1001,
+            "screenHeight": 601
+          },
+          "as": "metrics",
+          "requires": ["stockSetup"]
+        },
+        {
+          "cdp": "Emulation.setTouchEmulationEnabled",
+          "params": {
+            "enabled": true,
+            "maxTouchPoints": 2
+          },
+          "as": "touch",
+          "requires": ["stockSetup"]
+        }
+      ],
+      "trigger": [
+        {
+          "page": "navigate",
+          "url": "{target}/doc?n={tag}",
+          "as": "nav",
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          }
+        },
+        {
+          "settle": {
+            "ms": 5000,
+            "or": {
+              "served": "{target}/doc?n={tag}",
+              "observer": "fixture"
+            }
+          }
+        }
+      ],
+      "targets": ["seven", "vault"],
+      "requires": ["stockSetup"],
+      "observe": {
+        "focused": {
+          "means": "the unguarded observer still reads focus emulation on the document after the protected navigation attempt",
+          "check": {
+            "expression": "document.hasFocus()",
+            "equals": true,
+            "via": "unguarded",
+            "observer": "unguarded"
+          },
+          "dependsOn": ["nav"]
+        },
+        "media": {
+          "means": "the unguarded observer matches prefers-reduced-motion: reduce on {target}",
+          "check": {
+            "expression": "matchMedia('(prefers-reduced-motion: reduce)').matches",
+            "equals": true,
+            "via": "unguarded",
+            "observer": "unguarded"
+          },
+          "dependsOn": ["nav"]
+        },
+        "viewport": {
+          "means": "the unguarded observer still reads the admitted viewport override after the protected navigation attempt",
+          "check": {
+            "expression": "innerWidth + 'x' + innerHeight",
+            "equals": "1001x601",
+            "via": "unguarded",
+            "observer": "unguarded"
+          },
+          "dependsOn": ["nav"]
+        },
+        "touch": {
+          "means": "the unguarded observer reads navigator.maxTouchPoints as 2 on {target}",
+          "check": {
+            "expression": "navigator.maxTouchPoints",
+            "equals": 2,
+            "via": "unguarded",
+            "observer": "unguarded"
+          },
+          "dependsOn": ["nav"]
+        },
+        "beacon": {
+          "means": "a beacon from {target}",
+          "check": {
+            "beacon": "{target}",
+            "observer": "fixture"
+          }
+        },
+        "loaded": {
+          "means": "the stand-in served {target}/doc?n={tag}",
+          "dependsOn": [],
+          "check": {
+            "served": "{target}/doc?n={tag}",
+            "observer": "fixture"
+          }
+        },
+        "exposed": {
+          "means": "the unguarded observer finds the admitted display overrides (focus, media, viewport, touch) on a document at {target}",
+          "check": {
+            "expression": "location.href.includes('/doc?n={tag}') && location.href.includes(location.origin) && document.hasFocus() && matchMedia('(prefers-reduced-motion: reduce)').matches && innerWidth === 1001 && navigator.maxTouchPoints === 2",
+            "equals": true,
+            "via": "unguarded",
+            "observer": "unguarded"
+          }
+        }
+      },
+      "live": "the stand-in served {target}/doc?n={tag}, or the guard refused the protected navigation (pre + blocked), or refused a refusable setup step",
+      "liveCheck": {
+        "any": [
+          {
+            "refused": ["nav"],
+            "observer": "client"
+          },
+          {
+            "loaded": "{target}/doc?n={tag}",
+            "observer": "fixture"
+          },
+          {
+            "all": [
+              {
+                "pre": "{target}/doc?n={tag}",
+                "observer": "fixture"
+              },
+              {
+                "any": [
+                  {
+                    "blocked": {
+                      "url": "{target}/doc?n={tag}",
+                      "session": "page",
+                      "frame": false
+                    },
+                    "observer": "client"
+                  },
+                  {
+                    "blocked": {
+                      "url": "{target}/doc?n={tag}",
+                      "session": "page",
+                      "frame": false
+                    },
+                    "observer": "unguarded"
+                  },
+                  {
+                    "history": {
+                      "url": "{target}/doc?n={tag}",
+                      "session": "page"
+                    },
+                    "observer": "unguarded"
+                  }
+                ],
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          },
+          {
+            "registration": "any",
+            "observer": "client"
+          }
+        ],
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "focused": true,
+          "media": true,
+          "viewport": true,
+          "touch": true,
+          "exposed": true,
+          "beacon": false,
+          "loaded": true
         }
       },
       "expected": {
-        "worldOnError": true,
+        "exposed": false,
         "beacon": false,
-        "pre": "either"
+        "loaded": "either"
       },
-      "designDependent": ["pre"]
+      "designDependent": ["loaded"]
     },
     {
-      "id": "E7.emulation-carry",
+      "id": "E7.emulation-carry.script",
       "family": "E",
       "kind": "cdp",
       "scope": "any",
@@ -26970,12 +27713,11 @@
       ],
       "trigger": [
         {
-          "page": "navigate",
+          "page": "href",
           "url": "{target}/doc?n={tag}"
         },
         {
           "settle": {
-            "title": "doc",
             "ms": 5000,
             "or": {
               "served": "{target}/doc?n={tag}",
@@ -27048,7 +27790,7 @@
           }
         }
       },
-      "live": "the stand-in served {target}/doc?n={tag}, or the guard refused the protected navigation (pre + blocked), or refused a refusable setup step",
+      "live": "the stand-in served the protected document, or the guard refused that load (pre + blocked)",
       "liveCheck": {
         "any": [
           {
@@ -27091,10 +27833,6 @@
               }
             ],
             "observer": "client"
-          },
-          {
-            "registration": "any",
-            "observer": "client"
           }
         ],
         "observer": "client"
@@ -27143,12 +27881,142 @@
       "trigger": [
         {
           "page": "navigate",
+          "url": "{target}/doc?n={tag}",
+          "as": "nav",
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          }
+        },
+        {
+          "settle": {
+            "ms": 5000,
+            "or": {
+              "served": "{target}/doc?n={tag}",
+              "observer": "fixture"
+            }
+          }
+        },
+        {
+          "cdp": "Page.getFrameTree",
+          "as": "tree"
+        },
+        {
+          "cdp": "Page.createIsolatedWorld",
+          "params": {
+            "frameId": {
+              "$result": "tree",
+              "path": "result.frameTree.frame.id"
+            },
+            "worldName": "slicc-foreign-{tag}",
+            "grantUniveralAccess": true,
+            "contentSecurityPolicy": "default-src 'none'"
+          },
+          "as": "foreign",
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          },
+          "requires": ["stockSetup"]
+        }
+      ],
+      "targets": ["seven", "vault"],
+      "requires": ["stockSetup"],
+      "observe": {
+        "noContext": {
+          "means": "createIsolatedWorld on a protected document returned no executionContextId",
+          "dependsOn": ["nav", "foreign"],
+          "check": {
+            "any": [
+              {
+                "refused": ["foreign"],
+                "observer": "client"
+              },
+              {
+                "result": "foreign",
+                "path": "result.executionContextId",
+                "equals": {
+                  "$absentOr": 0
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          }
+        },
+        "world": {
+          "means": "the unguarded observer saw world slicc-foreign-{tag} on the document",
+          "check": {
+            "world": "slicc-foreign-{tag}",
+            "observer": "unguarded",
+            "origin": "{target}"
+          }
+        }
+      },
+      "live": "the stand-in served {target}/doc?n={tag}, or the guard refused the protected navigation or the isolated world",
+      "liveCheck": {
+        "any": [
+          {
+            "refused": ["nav"],
+            "observer": "client"
+          },
+          {
+            "refused": ["foreign"],
+            "observer": "client"
+          },
+          {
+            "loaded": "{target}/doc?n={tag}",
+            "observer": "fixture"
+          }
+        ],
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "noContext": false,
+          "world": true
+        }
+      },
+      "expected": {
+        "noContext": true,
+        "world": false
+      }
+    },
+    {
+      "id": "E7.isolated-foreign.script",
+      "family": "E",
+      "kind": "cdp",
+      "scope": "any",
+      "setup": [
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?n=start-{tag}"
+        },
+        {
+          "observer": "watch"
+        },
+        {
+          "cdp": "Page.enable",
+          "requires": ["stockSetup"]
+        },
+        {
+          "cdp": "Runtime.enable"
+        }
+      ],
+      "trigger": [
+        {
+          "page": "href",
           "url": "{target}/doc?n={tag}"
         },
         {
           "settle": {
-            "title": "doc",
             "ms": 5000,
+            "or": {
+              "served": "{target}/doc?n={tag}",
+              "observer": "fixture"
+            },
             "required": true
           }
         },
@@ -27203,15 +28071,61 @@
           "means": "the unguarded observer saw world slicc-foreign-{tag} on the document",
           "check": {
             "world": "slicc-foreign-{tag}",
-            "observer": "unguarded"
-          },
-          "dependsOn": []
+            "observer": "unguarded",
+            "origin": "{target}"
+          }
         }
       },
-      "live": "the stand-in served {target}/doc?n={tag}",
+      "live": "the stand-in served {target}/doc?n={tag}, or the guard refused the isolated world, or refused the protected document load (pre + blocked)",
       "liveCheck": {
-        "loaded": "{target}/doc?n={tag}",
-        "observer": "fixture"
+        "any": [
+          {
+            "refused": ["foreign"],
+            "observer": "client"
+          },
+          {
+            "loaded": "{target}/doc?n={tag}",
+            "observer": "fixture"
+          },
+          {
+            "all": [
+              {
+                "pre": "{target}/doc?n={tag}",
+                "observer": "fixture"
+              },
+              {
+                "any": [
+                  {
+                    "blocked": {
+                      "url": "{target}/doc?n={tag}",
+                      "session": "page",
+                      "frame": false
+                    },
+                    "observer": "client"
+                  },
+                  {
+                    "blocked": {
+                      "url": "{target}/doc?n={tag}",
+                      "session": "page",
+                      "frame": false
+                    },
+                    "observer": "unguarded"
+                  },
+                  {
+                    "history": {
+                      "url": "{target}/doc?n={tag}",
+                      "session": "page"
+                    },
+                    "observer": "unguarded"
+                  }
+                ],
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          }
+        ],
+        "observer": "client"
       },
       "control": {
         "origin": "ordinary",
@@ -27554,7 +28468,11 @@
           },
           "session": "browser",
           "as": "created",
-          "requires": ["browserSession"]
+          "requires": ["browserSession"],
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          }
         },
         {
           "wait": 2000
@@ -27575,7 +28493,8 @@
               }
             },
             "observer": "client"
-          }
+          },
+          "dependsOn": ["created"]
         },
         "pageAttached": {
           "means": "the client kept a page session for the protected tab child",
@@ -27604,7 +28523,8 @@
             "via": "unguarded",
             "session": "child",
             "observer": "unguarded"
-          }
+          },
+          "dependsOn": ["created"]
         },
         "beacon": {
           "means": "a beacon from {target}",
@@ -27614,9 +28534,13 @@
           }
         }
       },
-      "live": "the stand-in served {target}/doc?n={tag}, or the tab was held without a client page session",
+      "live": "the stand-in served {target}/doc?n={tag}, or the tab was held without a client page session, or the guard refused creating the protected target",
       "liveCheck": {
         "any": [
+          {
+            "refused": ["created"],
+            "observer": "client"
+          },
           {
             "loaded": "{target}/doc?n={tag}",
             "observer": "fixture"
@@ -27839,7 +28763,11 @@
           },
           "session": "browser",
           "as": "created",
-          "requires": ["browserSession"]
+          "requires": ["browserSession"],
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          }
         },
         {
           "wait": 2000
@@ -27860,7 +28788,8 @@
               }
             },
             "observer": "client"
-          }
+          },
+          "dependsOn": ["created"]
         },
         "pageAttached": {
           "means": "the client kept a page session for the protected tab child",
@@ -27889,7 +28818,8 @@
             "via": "unguarded",
             "session": "child",
             "observer": "unguarded"
-          }
+          },
+          "dependsOn": ["created"]
         },
         "beacon": {
           "means": "a beacon from {target}",
@@ -27899,9 +28829,13 @@
           }
         }
       },
-      "live": "the stand-in served {target}/doc?n={tag}, or the tab was held without a client page session",
+      "live": "the stand-in served {target}/doc?n={tag}, or the tab was held without a client page session, or the guard refused creating the protected target",
       "liveCheck": {
         "any": [
+          {
+            "refused": ["created"],
+            "observer": "client"
+          },
           {
             "loaded": "{target}/doc?n={tag}",
             "observer": "fixture"