diff --git a/docs/specs/dor-browser.md b/docs/specs/dor-browser.md
index 015e125dc..bea73aea3 100644
--- a/docs/specs/dor-browser.md
+++ b/docs/specs/dor-browser.md
@@ -257,7 +257,7 @@ Source of truth: `createPlaywrightProvider` in `lib/src/host/playwright-host.ts`
 
 `dor iframe <url>` frames the page's own DOM — zero-lag for human inspection, but agents cannot drive or read it. On hosts with `createIframeProxyUrl`, `IframePanel` frames a per-grant loopback proxy URL; without it, a raw uninstrumented iframe. The desktop playground's `createIframeProxyUrl` fronts only its own viewers (`docs/specs/tutorial.md` → Playground filesystem).
 
-The proxy instruments any `http://` upstream it fronts, loopback and remote alike — a remote one only once allowed ([Iframe External Origins](#iframe-external-origins)): headers are rewritten per the table below and the shim injected into HTML; HTTP and WebSocket traffic passes through. A site's "do not embed" is overridden, not obeyed (rationale); the sandbox neutralizes JS framebusting. **Must connect a grant, over HTTP and WebSocket alike, only to the addresses its upstream resolved to when minted.** **Must refuse (`scheme`) an upstream resolving to any link-local / cloud-metadata address**, in any spelling; one that does not resolve is `unreachable`.
+The proxy instruments any `http://` upstream it fronts, loopback and remote alike — a remote one only once allowed ([Iframe External Origins](#iframe-external-origins)): headers are rewritten per the table below and the shim injected into HTML; HTTP and WebSocket traffic passes through. A site's "do not embed" is overridden, not obeyed (rationale); the sandbox neutralizes JS framebusting. **Must connect a grant, over HTTP and WebSocket alike, only to the addresses its upstream resolved to when minted.** **Must refuse (`scheme`) an upstream resolving to any link-local / cloud-metadata address**, in any spelling, including an IPv6 literal that reaches one through a translator (rationale); one that does not resolve is `unreachable`.
 
 **Must refuse `https://`, regardless of scheme casing, at every entry to the iframe renderer on a host with the proxy** (a host without it frames https raw):
 
@@ -276,13 +276,16 @@ Header rewriting beyond `Origin`, `Cookie`, `Set-Cookie`, and the framing header
 | request | `Host` | upstream host |
 | request | `Referer` | an exact parsed proxy origin replaced with the upstream origin, path and query kept |
 | request | `Accept-Encoding` | deleted on a document load (`Sec-Fetch-Dest` `document`, `iframe`, `frame`, `embed`, `object`, or none sent), so its HTML comes back identity; kept on every other request |
+| request | `Service-Worker: script` or `Sec-Fetch-Dest: serviceworker` | answered `403` without reaching the upstream, on every grant but a tunneled one |
 | response | `X-Dormouse-Preserve-CSP: 1` | consumed; preserves upstream CSP headers and meta policies |
 | response | hop-by-hop (RFC 7230 §6.1) | dropped |
 | response | `Location` | an exact upstream origin rewritten back to the proxy origin, so a redirect stays inside the proxy; any other origin on a frame load is [Iframe External Origins](#iframe-external-origins) |
 | response | `Vary` | `Sec-Fetch-Dest` appended, since the `Accept-Encoding` sent upstream depends on it |
-| response | `Clear-Site-Data` | `"cache", "storage"` on a freshly minted grant's first frame load only: its port may have fronted another upstream; never on a tunneled grant, whose page is not at that port |
+| response | `Clear-Site-Data` | `"cache", "storage"` on a freshly minted grant's first frame load only, clearing what another upstream on its port left; never on a tunneled grant, whose page is not at that port |
 | response body | `<meta http-equiv="content-security-policy">` | removed unless the response opts into CSP preservation |
 
+**Must keep every service worker off a non-tunneled grant's origin**, so none survives its grant to answer the next one on that port ahead of the proxy and its `Clear-Site-Data` (rationale). A page previews without its worker.
+
 **Must instrument only an identity-encoded, ASCII-compatible HTML body, keeping its `content-type` as sent**, charset included; a compressed body, or a UTF-16 one (any WHATWG label, or a byte-order mark), passes through uninstrumented (rationale), except that a tunneled grant decodes every compressed body first (`docs/specs/remote-api.md` -> "Frames"). **Never place the shim ahead of the doctype, a `<meta charset>` or a UTF-8 BOM.**
 
 **Must preserve enforced and report-only CSP verbatim when the upstream response sends `X-Dormouse-Preserve-CSP: 1`**, for every MIME type, adding the validated ancestor policy separately; opted-in policies may still prevent framing or shim execution (rationale). **Never infer this opt-in from request headers.**
@@ -324,7 +327,7 @@ The proxy's redirect page also posts `navigate` ([Iframe External Origins](#ifra
 
 **Must let only `http:` and `https:` reach a browser Surface, re-checked at the sink**: `open-window`, `navigate`, and the control socket's `surface.iframe` go through `browserSurfaceUrl`, and `IframePanel` checks `params.url` again before framing it, since the header's URL editor writes there too (rationale).
 
-Parent listeners check the message origin against live proxy grants (`docs/specs/security-local.md` -> "Browser panes"). A leader message exits passthrough like an in-document dual-tap; a `location` maps back to its upstream URL for chrome and history without reloading the frame; a new-tab request asks before opening an adjacent browser pane.
+Parent listeners check the message origin against live proxy grants (`docs/specs/security-local.md` -> "Browser panes", which also bounds `pointerdown`). A `pointerdown` from the frame holding focus enters its pane like a click; the shim focuses its own frame before posting one, since a browser gives a page that cancels a press no focus (rationale). A leader message exits passthrough like an in-document dual-tap; a `location` maps back to its upstream URL for chrome and history without reloading the frame; a new-tab request asks before opening an adjacent browser pane.
 
 A proxied frame whose shim has reported, then loads a document with no `location` report soon after, shows that document as uninstrumented (not HTML, off the proxy, refused, or its grant gone); a new frame source waits for its first report again (rationale).
 
diff --git a/docs/specs/dor-browser.rationale.md b/docs/specs/dor-browser.rationale.md
index 423e6024a..fedf28127 100644
--- a/docs/specs/dor-browser.rationale.md
+++ b/docs/specs/dor-browser.rationale.md
@@ -186,6 +186,10 @@ The built-in local-file viewer supplies its own content boundary and permits the
 
 **Why the HTML path keeps the body's own encoding.** Each was reproduced against the proxy (2026-09-23): relabelling every HTML response `charset=utf-8` overrode both the upstream header and any `<meta charset>`, so a Shift_JIS or windows-1252 page mis-decoded; an upstream that compresses without being asked had the shim prepended to its gzip bytes with `content-encoding: gzip` kept, and the frame failed with `ERR_CONTENT_DECODING_FAILED`; and a valid document with neither `</head>` nor `<body>` got the shim before `<!doctype html>`, switching it to quirks mode. Deleting `Accept-Encoding` on every request sent a remote upstream's scripts and styles uncompressed, typically 3-5x the bytes.
 
+**Which addresses a metadata refusal names.** Fixed endpoints outside 169.254/16 are matched as single addresses, since each sits in a block that also holds ordinary machines. The check reads IPv6 by form rather than by a list of spellings: mapped and the deprecated compatible form name the IPv4 address itself, and translated and NAT64 end an IPv6 connection at an IPv4 service through a translator. Tunnels (6to4, Teredo, ISATAP) are not read: they carry IPv6 inside IPv4 to the embedded address (RFC 3056, RFC 4380, RFC 5214), which has to decapsulate and speak IPv6 itself, so no TCP connection to an HTTP metadata endpoint forms. A deployment can choose its own NAT64 prefix, so any /96 ending in zeros counts, at the cost of refusing a host whose static address happens to read that way; a chosen prefix of another length, whose address carries no mark of it, is not read.
+
+**Why a preview has no service worker.** Measured 2026-11 on Chromium 156 and a macOS 27 WKWebView, both of which run workers on a loopback origin: a registered worker stays with the origin after its grant ends, and answers a later grant on the same port before the request reaches the proxy, so that grant's `Clear-Site-Data` never arrives. Only the proxy sees every registration, since the browser names the script fetch itself and a page cannot change that. The cost is that a local PWA previews without its worker. A tunneled grant is exempt because its page lives at the frame origin on the Client.
+
 **Why a grant gets its own origin instead of a path token.** A dedicated origin keeps root-relative resources and client-side routers working with no body URL rewriting; a path token would have to survive every link, redirect and `fetch` the page makes.
 
 ## Iframe External Origins
@@ -208,7 +212,7 @@ The built-in local-file viewer supplies its own content boundary and permits the
 
 **Why the host names the owner.** A webview that reloads or a window that closes never releases what its last page held; owner-scoped release at reinitialization and at the end of the owner reclaims those. Were the owner the webview's word, one webview could release another's views.
 
-**Why a fresh grant clears site data.** A port freed by one grant can be handed by the OS to the next, for another upstream, while the browser still keys the first upstream's storage and service worker on `http://127.0.0.1:<port>`. Only a freshly minted grant's first frame load clears it, so a reused grant keeps its page's storage, and a probe that names no destination cannot spend it. It is a mitigation, not a guarantee: a cache-first service worker the old upstream left can answer the navigation before the proxy sees it, and whether WebKit webviews honor the header on a loopback origin is unverified.
+**Why a fresh grant clears site data.** A port freed by one grant can be handed by the OS to the next, for another upstream, while the browser still keys the first upstream's storage and service worker on `http://127.0.0.1:<port>`. Only a freshly minted grant's first frame load clears it, so a reused grant keeps its page's storage, and a probe that names no destination cannot spend it. It is a mitigation, not a guarantee: whether WebKit webviews honor the header on a loopback origin is unverified, and a worker registered before grants refused them can still answer ahead of it.
 
 ## Iframe Shim
 
@@ -218,6 +222,8 @@ The built-in local-file viewer supplies its own content boundary and permits the
 
 **Why the panel checks again.** Every writer of `params.url` ends at the panel, and on a host with no proxy the raw fallback hands that string straight to `<iframe src>` under a sandbox that keeps `allow-same-origin`. Enumerating the writers is the fragile half: the header's URL editor was one the guarded callers did not cover, because `normalizeNavUrl` deliberately keeps a typed `javascript:` or `data:` scheme so the address bar can carry one. React blanks a `javascript:` `src` prop and nothing else, so `data:text/html,…` framed verbatim (reproduced in `IframePanel.test.tsx`, 2026-09) — a framework mitigation the code never claimed, for one scheme out of the set.
 
+**Why the shim focuses its own frame for a press.** Measured 2026-11 on Chromium 156 and a macOS 27 WKWebView: a real press focuses the frame on its own, unless the page cancels `mousedown` or `pointerdown`, when focus stays where it was. The panel cannot make up for that, because the page can post `pointerdown` with no press. Calling `window.focus()` from the frame covers the cancelled press on both engines, and is no more than the page could call itself. Focus also reached the embedding document ahead of the message on every press: 200 of 200 each in out-of-process Chromium, one level and at VS Code's depth, and 40 of 40 in WKWebView, with the press cancelled or not.
+
 **Why each shim hop has two explicit targets.** An injected document cannot tell whether its parent is the app or another document on the grant's proxy origin. It posts to both known origins; the browser delivers only the matching one. A same-origin parent reconstructs and relays only the three pane-level shapes upward; location is document-level, so only the outer document reports it. No wildcard or foreign origin enters the path.
 
 ## Iframe Focus And Rendering Notes
diff --git a/docs/specs/security-local.md b/docs/specs/security-local.md
index 947740e3c..a341df331 100644
--- a/docs/specs/security-local.md
+++ b/docs/specs/security-local.md
@@ -51,7 +51,7 @@ The attacker is the page inside a browser pane.
 
 Where Windows screenshots and pasted images land is a known gap (`docs/specs/security.md` -> "Known gaps").
 
-**Every listener the webview realm exposes to a framed page checks the sender's origin before it acts** — `IframePanel` against its own panel's proxy origin, the Wall's leader channel against any live grant (`docs/specs/dor-browser.md` -> "Iframe Shim"). **That separates a proxied frame from any other, never the injected shim from the page it runs in** (rationale).
+**Every listener the webview realm exposes to a framed page checks the sender's origin before it acts** — `IframePanel` against its own panel's proxy origin, the Wall's leader channel against any live grant (`docs/specs/dor-browser.md` -> "Iframe Shim"). **That separates a proxied frame from any other, never the injected shim from the page it runs in** (rationale), so a page can send every shim message with no gesture, and what bounds it is how far each one reaches. A `pointerdown` counts only from the frame already holding focus, so it never moves DOM focus or selection off another pane. A browser can still give a frame focus on the page's own call (`docs/specs/security.md` -> "Known gaps").
 
 **A framed page cannot forge a *host* message.** The VS Code webview authenticates every host→webview message with a per-boot token (`docs/specs/vscode.md` -> "Webview message authentication"). **The standalone adapters have no forgeable inbox**: host events arrive over Tauri IPC or the dev harness's own event stream, never `window.postMessage`.
 
@@ -60,6 +60,7 @@ Where Windows screenshots and pasted images land is a known gap (`docs/specs/sec
 - **FAIL IF** `S134` an injected shim targets anything but its proxy origin or the embedder chain's innermost origin, relays a nested `location`, a foreign-origin message, or an unregistered message, or the proxy uses a chain it did not validate in full: `iframeShim` and `normalizeEmbedderOrigins` in `lib/src/host/iframe-proxy-rewrite.ts`, applied in `lib/src/host/iframe-proxy.ts`. Pinned by `lib/src/host/iframe-proxy-rewrite.test.ts` and `lib/src/host/iframe-proxy.test.ts`.
 - **FAIL IF** `S135` a `VSCodeAdapter` host-channel listener acts on a message before `isHostMessage` (`lib/src/lib/vscode-message-token.ts`) accepts it, or the token stops being minted per serve and attached only by `WebviewChannel.post` in `vscode-ext/src/webview-messaging.ts`: `dor:controlRequest` is one of the shapes a framed page could otherwise claim. The proxy-origin listeners above are guarded by origin, not the token. Pinned by `lib/src/lib/platform/vscode-adapter.test.ts`.
 - **FAIL IF** `S136` any other webview `message` listener acts before checking its sender — `origin` against its proxy origin or a live grant, plus `source` where it answers one frame — or one appears that `lib/src/lib/webview-message-listeners.test.ts` does not classify; it names each listener's foreign-sender test.
+- **FAIL IF** `S303` a message from a framed page moves DOM focus into a frame, or changes selection or mode while its frame does not hold focus, since a page can post one with no click and whatever holds focus reads what is typed: the `pointerdown` branch in `lib/src/components/wall/IframePanel.tsx` must test `document.activeElement` first. Pinned by `lib/src/components/Wall.test.tsx` and `lib/src/components/wall/IframePanel.test.tsx`.
 - **FAIL IF** `S137` a standalone module registers a window `message` listener, or a standalone adapter takes a host event from anything but its transport. Pinned by `lib/src/lib/webview-message-listeners.test.ts` and `standalone/src/sidecar-adapters.test.ts`.
 - **FAIL IF** `S138` a browser pane's frame, proxied or raw, carries a `sandbox` token beyond `allow-scripts`, `allow-same-origin`, `allow-forms`, `allow-popups`, `allow-modals`, and `allow-downloads` — an `allow-top-navigation` form lets a page navigate the Wall away — or an `allow` feature beyond `autoplay`, `clipboard-write`, and `fullscreen`: `IFRAME_SANDBOX` and `IFRAME_ALLOW` in `lib/src/components/wall/IframePanel.tsx`. Pinned by `lib/src/components/wall/IframePanel.test.tsx`.
 
diff --git a/docs/specs/security-local.rationale.md b/docs/specs/security-local.rationale.md
index ae5240d9d..382248202 100644
--- a/docs/specs/security-local.rationale.md
+++ b/docs/specs/security-local.rationale.md
@@ -26,10 +26,12 @@ Why deceptive links are gated twice. The modal omits its Open action and focuses
 
 ## Browser panes
 
-Why the origin check is not an authenticity check. The iframe proxy serves the untrusted upstream on the same origin it grants the shim, so `e.origin` cannot tell a message the shim sent from one the page sent; what the check buys is that no *other* frame can send them at all. The shim's actions are bounded downstream — exiting passthrough, selecting a pane, an `http:`/`https:` URL behind an open prompt, a frame-URL reading that may lie, and read-only theme variables. Theme delivery additionally checks the actual iframe window; requesting it grants no host command. `use-wall-keyboard`'s leader channel accepts any live grant rather than one panel's, so a page in one browser pane can exit passthrough while another is focused. The nested-frame relay preserves this boundary: it accepts only the same proxy origin and reconstructs one of the three pane-level shapes, so document-level locations, unrelated application messages, and every foreign origin stop at the child frame.
+Why the origin check is not an authenticity check. The iframe proxy serves the untrusted upstream on the same origin it grants the shim, so `e.origin` cannot tell a message the shim sent from one the page sent; what the check buys is that no *other* frame can send them at all. The shim's actions are bounded downstream — exiting passthrough, selecting the pane whose frame already holds focus, an `http:`/`https:` URL behind an open prompt, a frame-URL reading that may lie, and read-only theme variables. Theme delivery additionally checks the actual iframe window; requesting it grants no host command. `use-wall-keyboard`'s leader channel accepts any live grant rather than one panel's, so a page in one browser pane can exit passthrough while another is focused. The nested-frame relay preserves this boundary: it accepts only the same proxy origin and reconstructs one of the three pane-level shapes, so document-level locations, unrelated application messages, and every foreign origin stop at the child frame.
 
 Why "the standalone adapters" and not "the standalone webview". The Wall's two proxy-origin `message` listeners (`use-wall-keyboard.ts`, `IframePanel.tsx`) are bundled into the standalone webview as well as the VS Code one, so a framed page's `parent.postMessage` does reach that window. What has no forgeable inbox is the adapters' host channel, which arrives over Tauri IPC. `docs/specs/vscode.md` -> "Webview message authentication" scopes it the same way.
 
+Why a page's press report counts only from a focused frame, and what that leaves. Focus is what the bound turns on: the frame holding it reads every key. Measured 2026-11 in Chromium 156 (the Wall included) and a macOS 27 WKWebView, a frame can still focus itself: Chromium at any time, WebKit once the frame has had a click. `inert` and the `focus-without-user-activation` policy (allow attribute and header) did not stop it in Chromium, so nothing a parent sets closes it. WebView2 and WebKitGTK were not run.
+
 ## The dor control socket
 
 Why the socket's limit is stated rather than assumed. A `0700` directory and a `0600` file stop another local *account*; neither stops a process already running under the user's own uid, which can read the socket path out of its own environment. The same limit is already stated for the Burrow ACL store in `docs/specs/security-remote.md`, and stating it here keeps an agent holding `dor` from being read as a lesser principal than the person at the keyboard.
diff --git a/docs/specs/security.md b/docs/specs/security.md
index 5da6708c1..3523072a1 100644
--- a/docs/specs/security.md
+++ b/docs/specs/security.md
@@ -78,6 +78,7 @@ Source of truth: root scripts in `package.json`; native jobs in `.github/workflo
 Gaps rather than accepted risks: we intend to close them.
 
 - **Shell-specific Windows command quoting does not protect every native batch handoff.** PowerShell can strip quotes around a no-space argument before a `.cmd` target parses it, turning an ampersand into command syntax. This affects argv Tools launched in new Sessions, preview retargets, and restored commands; falling back from portable quoting to a new Session does not repair it. The portable form used for paste and existing-prompt commands refuses these arguments ([Dor Tool configuration](./security-local.md#dor-tool-configuration)).
+- **A page in a browser pane can take the keyboard without a click.** Its messages to Dormouse never focus it, but the browser lets a frame focus itself: Chromium (VS Code, the Windows app) at any time, WebKit (the macOS and Linux apps) once it has been clicked. What you type then goes to that page until you click elsewhere ([Browser panes](./security-local.md#browser-panes)).
 - **Browser-pane scripts share loopback cookies across grant ports.** HTTP and WebSocket cookie headers are stripped, but `document.cookie` remains shared; cookie-authenticated iframe pages are unsupported ([Loopback Listeners](./security-local.md#loopback-listeners)).
 - **Windows screenshots and pasted clipboard images are only as private as the temp directory they land in:** private by default, exposed if it is shared or loosened ([Browser panes](./security-local.md#browser-panes)).
 - **Neither VS Code's peer-link token and endpoint, its Tool trust receipts, nor the `recovery.json` beside them carries a Windows ACL applied by Dormouse.** They are written owner-only by unix mode, which Windows makes a no-op; standalone locks its state directory instead ([Persisted state](./security-local.md#persisted-state)).
diff --git a/lib/src/components/Wall.test.tsx b/lib/src/components/Wall.test.tsx
index 3b3680922..418bd2f6b 100644
--- a/lib/src/components/Wall.test.tsx
+++ b/lib/src/components/Wall.test.tsx
@@ -8,7 +8,7 @@ import { previousWorkspaceSession, setWorkspaceTransferPending } from '../lib/wi
  * geometry — the Wall on Lath live acceptance list in
  * TESTING_AND_MODIFICATION_GUIDE.md (§5) is the live gate.
  */
-import { act } from 'react';
+import { act, type ReactElement } from 'react';
 import { type Root } from 'react-dom/client';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { dispatchDorControlRequest } from '../lib/platform/dor-control-dispatch';
@@ -3757,6 +3757,42 @@ describe('Wall on the Lath engine', () => {
     return response;
   }
 
+  describe('a press reported from inside a proxied frame', () => {
+    const PROXY = 'http://127.0.0.1:61234';
+    const press = () => act(async () => {
+      window.dispatchEvent(new MessageEvent('message', { origin: PROXY, data: { __dormouse: 'pointerdown' } }));
+    });
+
+    async function frameBeside(wall: ReactElement) {
+      fake.createIframeProxyUrl = vi.fn(async () => ({ ok: true as const, url: `${PROXY}/app` }));
+      await act(async () => root.render(wall));
+      await flush();
+      const { id } = await dispatchIframe('http://localhost:5173/');
+      await flushFrame();
+      return container.querySelector<HTMLIFrameElement>(`[data-lath-leaf="${id}"] iframe`)!;
+    }
+
+    it('changes nothing from a frame without focus', async () => {
+      const frame = await frameBeside(<Wall initialPaneIds={['surface:a']} initialMode="passthrough" />);
+      const focus = vi.spyOn(frame, 'focus');
+      await press();
+      await flushFrame();
+      expect(focus).not.toHaveBeenCalled();
+      expect(document.activeElement).not.toBe(frame);
+      expect(focusOf('surface:a')).toBe('true');
+    });
+
+    it('enters the pane for a press from the frame holding focus, without focusing it again', async () => {
+      const frame = await frameBeside(<Wall initialPaneIds={['surface:a']} initialMode="passthrough" />);
+      frame.focus();
+      const focus = vi.spyOn(frame, 'focus');
+      await press();
+      await flushFrame();
+      expect(focus).not.toHaveBeenCalled();
+      expect(focusOf('surface:a')).toBe('false');
+    });
+  });
+
   it('dor split transfers focus to the new surface (passthrough)', async () => {
     await act(async () => {
       root.render(<Wall initialPaneIds={['surface:a']} initialMode="passthrough" />);
diff --git a/lib/src/components/wall/IframePanel.test.tsx b/lib/src/components/wall/IframePanel.test.tsx
index d949bdcdd..14f93607a 100644
--- a/lib/src/components/wall/IframePanel.test.tsx
+++ b/lib/src/components/wall/IframePanel.test.tsx
@@ -377,7 +377,8 @@ describe('IframePanel', () => {
   it('acts on no message from any origin but its own proxy', async () => {
     const onClickPanel = vi.fn();
     proxyPlatform({ ok: true, url: `${PROXY}/app`, upstream: 'http://example.test/app' });
-    await renderPanel(stubActions({ onClickPanel }), paneProps('iframe-foreign'));
+    const frame = await renderPanel(stubActions({ onClickPanel }), paneProps('iframe-foreign'));
+    frame.focus();
     const chrome = () => getAgentBrowserScreenController('iframe-foreign')?.chrome().url;
     const before = chrome();
     const send = (origin: string, data: unknown) => act(async () => {
diff --git a/lib/src/components/wall/IframePanel.tsx b/lib/src/components/wall/IframePanel.tsx
index 80db9e319..d992f4be7 100644
--- a/lib/src/components/wall/IframePanel.tsx
+++ b/lib/src/components/wall/IframePanel.tsx
@@ -377,17 +377,17 @@ export function IframePanel({ id, title, params, onReady }: PaneProps & {
   // A cross-origin click reaches only the frame, so the Wall never sees the
   // mousedown — and on WebKit the iframe element's own `focus` event doesn't
   // fire for it either. The shim posts `pointerdown` from inside the frame;
-  // adopt it as entering the pane (select + passthrough), exactly like clicking
-  // any other pane. Only genuine clicks emit `pointerdown`, so command-mode
-  // arrow navigation never triggers it, and onClickPanel is idempotent for
-  // repeat clicks.
+  // adopt it as clicking the pane. The page shares the shim's origin and can post
+  // this with no click, so it counts only from the frame that holds focus: the
+  // shim takes focus before it posts, and focus reaches this document first. The
+  // message then adds no focus, and a frame without focus moves nothing.
   useEffect(() => {
     if (!proxyOrigin) return;
     const onMessage = (e: MessageEvent) => {
       if (e.origin !== proxyOrigin) return;
       const data = e.data as { __dormouse?: unknown; url?: unknown; loaded?: unknown; from?: unknown } | null;
       if (data?.__dormouse === 'pointerdown') {
-        actions.onClickPanel(id);
+        if (document.activeElement === iframeRef.current) actions.onClickPanel(id);
         return;
       }
       if (data?.__dormouse === 'open-window' && typeof data.url === 'string') {
diff --git a/lib/src/host/iframe-proxy-rewrite.test.ts b/lib/src/host/iframe-proxy-rewrite.test.ts
index 696ffc2aa..ec7c44341 100644
--- a/lib/src/host/iframe-proxy-rewrite.test.ts
+++ b/lib/src/host/iframe-proxy-rewrite.test.ts
@@ -32,7 +32,8 @@ function shimFrame(parentOrigin: string, deliver: (data: unknown) => void) {
       if (target === parentOrigin) deliver(JSON.parse(JSON.stringify(data)));
     },
   };
-  const window = { parent, open: undefined as unknown };
+  const focus = { held: false, calls: 0 };
+  const window = { parent, open: undefined as unknown, focus() { focus.held = true; focus.calls++; } };
   const properties = new Map<string, string>();
   const classes = new Set<string>();
   const root = {
@@ -43,7 +44,7 @@ function shimFrame(parentOrigin: string, deliver: (data: unknown) => void) {
   runInNewContext(IFRAME_SHIM, {
     window,
     location: { origin: PROXY, href: `${PROXY}/story` },
-    document: { readyState: 'loading', documentElement: root, body: root },
+    document: { readyState: 'loading', documentElement: root, body: root, hasFocus: () => focus.held },
     CustomEvent: class { constructor(public type: string) {} },
     dispatchEvent: (event: { type: string }) => dispatched.push(event.type),
     history: {},
@@ -52,7 +53,7 @@ function shimFrame(parentOrigin: string, deliver: (data: unknown) => void) {
     URL,
   });
   return {
-    parent, properties, classes, root, dispatched,
+    parent, properties, classes, root, dispatched, focus,
     emit(type: string, event: Record<string, unknown>) {
       for (const listener of listeners.get(type) ?? []) listener(event);
     },
@@ -191,6 +192,17 @@ describe('the shim addresses the grant and app, not the world', () => {
     ]);
   });
 
+  // The app does not focus a frame for this message, and a page that cancels the
+  // press gets no focus from the browser, so the frame takes it itself. Focusing
+  // a frame that holds focus can blank it on WebKit.
+  it('takes focus from inside on a press, only when the frame lacks it', () => {
+    const frame = shimFrame(APP, () => {});
+    frame.emit('pointerdown', {});
+    expect(frame.focus.calls).toBe(1);
+    frame.emit('pointerdown', {});
+    expect(frame.focus.calls).toBe(1);
+  });
+
   it('relays pane-level messages but not nested locations through same-origin frames', () => {
     const delivered: unknown[] = [];
     const outer = shimFrame(APP, (data) => delivered.push(data));
@@ -280,6 +292,57 @@ describe('isBlockedAddress', () => {
     expect(isBlockedAddress('[::ffff:169.254.169.254]')).toBe(true); // bracketed
     expect(isBlockedAddress('::169.254.169.254')).toBe(true); // compat form
   });
+  it.each([
+    'fd00:ec2::254', // AWS
+    'FD00:0EC2:0:0:0:0:0:0254', // the same, uppercase and in full
+    '[fd00:ec2::254%en0]',
+    'fd20:ce::254', // Google Cloud
+    '100.100.100.200', // Alibaba Cloud
+    '192.0.0.192', // Oracle Cloud
+    '168.63.129.16', // Azure
+    '0xa8.63.129.16',
+    '::ffff:100.100.100.200',
+  ])('blocks the cloud metadata address %s', (address) => {
+    expect(isBlockedAddress(address)).toBe(true);
+  });
+  // Each form names the embedded address or hands it to a translator, so the
+  // connection ends at the IPv4 address however the IPv6 literal reads.
+  it.each([
+    ['mapped, in full', '0:0:0:0:0:ffff:a9fe:a9fe'],
+    ['translated (SIIT)', '::ffff:0:a9fe:a9fe'],
+    ['NAT64', '64:ff9b::a9fe:a9fe'],
+    ['NAT64, dotted', '64:ff9b::169.254.169.254'],
+    ['NAT64, a fixed address', '64:ff9b::a83f:8110'],
+    ['local NAT64 /48', '64:ff9b:1:a83f:81:1000::'],
+    ['local NAT64 /56', '64:ff9b:1:a9:fe:a9fe::'],
+    ['local NAT64 /64', '64:ff9b:1:0:a9:fea9:fe00:0'],
+    ['local NAT64 /96', '64:ff9b:1::a9fe:a9fe'],
+    ['a network-specific NAT64 /96', '2001:db8:64:1::a9fe:a9fe'],
+    ['Oracle Cloud’s IPv6 metadata', 'fd00:c1::a9fe:a9fe'],
+  ])('blocks a metadata address embedded in IPv6: %s', (_form, address) => {
+    expect(isBlockedAddress(address)).toBe(true);
+  });
+  it.each([
+    'fd00:ec2::253', // the neighbouring DNS resolver
+    'fd00:ec2::1',
+    'fd20:ce::253',
+    '100.100.100.199',
+    '192.0.0.193',
+    '168.63.129.17',
+    '64:ff9b::808:808', // a public address through NAT64
+    '2001:db8::1',
+    '2001:db8:1:2:3:4:a9fe:a9fe', // low bits that merely look like one
+    'fe7f::1',
+    'fec0::1',
+    '::',
+    '::1',
+    '1:2:3',
+    '1:2:3:4:5:6:7:8:9',
+    '1::2::3',
+    'not:an:address',
+  ])('does not block %s', (address) => {
+    expect(isBlockedAddress(address)).toBe(false);
+  });
   it('allows ordinary hosts', () => {
     expect(isBlockedAddress('127.0.0.1')).toBe(false);
     expect(isBlockedAddress('localhost')).toBe(false);
diff --git a/lib/src/host/iframe-proxy-rewrite.ts b/lib/src/host/iframe-proxy-rewrite.ts
index f1b315a8b..8e61ec64a 100644
--- a/lib/src/host/iframe-proxy-rewrite.ts
+++ b/lib/src/host/iframe-proxy-rewrite.ts
@@ -10,7 +10,7 @@
  */
 
 import { dualTap, newDualTapState } from '../lib/dual-tap';
-import { ipv4Value, isLoopbackHostname } from '../lib/ip-literal';
+import { bareAddress, ipv4Value, ipv4sCarriedByIPv6, ipv6Bytes, isLoopbackHostname } from '../lib/ip-literal';
 
 /** Header bag shape both `http.IncomingHttpHeaders` and a plain map satisfy. */
 export type ProxyHeaders = Record<string, string | string[] | undefined>;
@@ -121,8 +121,9 @@ export function frameAncestorsCsp(embedderOrigins: string[]): string {
 //     frame focused.
 //   - `pointerdown`: a click landed in the frame. A cross-origin click reaches
 //     only the frame, so the Wall can't see it; this lets it select the pane /
-//     enter passthrough. It's genuine user input, so it can't loop with the
-//     parent's programmatic focus.
+//     enter passthrough. The app hears it only from a frame holding focus, since
+//     the page can post it too, so the frame takes focus first: a page that
+//     cancels the press would otherwise get none from the browser.
 //   - `location`: the proxied frame's current URL. The parent converts it back
 //     to the upstream URL and uses it to keep iframe Back/Forward/Reload chrome
 //     honest.
@@ -190,7 +191,7 @@ export function iframeShim(embedderOrigin: string): string {
   // Bound by position: a minifier may rename the function itself.
   var dualTap=${dualTap},taps=(${newDualTapState})();
   addEventListener('keydown',function(e){if(dualTap(taps,e))post('leader');},true);
-  addEventListener('pointerdown',function(){post('pointerdown');},true);
+  addEventListener('pointerdown',function(){if(!document.hasFocus())window.focus();post('pointerdown');},true);
   addEventListener('click',function(e){
     var a=anchorHref(e);
     if(!a||a.hasAttribute('download'))return;
@@ -371,13 +372,18 @@ function prologueEnd(html: string): number {
   return at;
 }
 
-// 169.254.0.0/16 — IPv4 link-local, incl. the 169.254.169.254 cloud-metadata
-// endpoint — as a numeric range so every equivalent encoding is caught.
-const LINK_LOCAL_V4_START = 0xa9fe0000; // 169.254.0.0
-const LINK_LOCAL_V4_END = 0xa9feffff; // 169.254.255.255
+// Metadata endpoints outside IPv4 link-local, each one host in a block that also
+// holds ordinary machines, so the address and not the block.
+const CLOUD_METADATA_V4 = new Set([
+  '100.100.100.200', // Alibaba Cloud
+  '192.0.0.192', // Oracle Cloud
+  '168.63.129.16', // Azure
+].map((address) => ipv4Value(address)));
+const CLOUD_METADATA_V6 = new Set([
+  'fd00:ec2::254', // AWS
+  'fd20:ce::254', // Google Cloud
+].map((address) => ipv6Bytes(address)!.join()));
 
-/** An address without brackets or a zone, lowercased. */
-const bareAddress = (address: string) => address.replace(/^\[|\]$/g, '').replace(/%.*$/, '').toLowerCase();
 
 /** One spelling per address: an IPv4 one, mapped into IPv6 or not, as its number. */
 function addressKey(address: string): string | number {
@@ -398,19 +404,26 @@ export function isThisMachineAddress(address: string, interfaceAddresses: readon
   return interfaceAddresses.some((held) => addressKey(held) === key);
 }
 
+function isBlockedIPv4(value: number): boolean {
+  // 169.254.0.0/16, the cloud-metadata endpoint's own range among them.
+  return value >>> 16 === 0xa9fe || CLOUD_METADATA_V4.has(value);
+}
+
+/**
+ * Whether a host names a link-local or cloud-metadata address, in any spelling:
+ * every IPv4 encoding (decimal/octal/hex, short forms), and every IPv6 literal
+ * that names one or reaches one through a translator. The WHATWG URL
+ * parser collapses the numeric IPv4 spellings before this guard runs, but a
+ * resolver's answer and a caller that did not parse have not been through it.
+ */
 export function isBlockedAddress(hostname: string): boolean {
-  // IPv6 link-local (fe80::/10).
-  if (/^\[?fe[89ab][0-9a-f]:/i.test(hostname)) return true;
-  // Resolve the host to its 32-bit IPv4 value across every equivalent encoding
-  // (decimal/octal/hex, short forms, IPv4-mapped IPv6) and range-check the
-  // link-local / cloud-metadata block. The genuine end-to-end hole a literal
-  // 169.254.* match leaves is the IPv6-embedded form (::ffff:169.254.169.254),
-  // which the WHATWG URL parser normalizes to a hex-group spelling the regex
-  // can't see; the numeric-IPv4 spellings are collapsed by that same parser
-  // before the guard runs, so canonicalizing them here is defense-in-depth
-  // against callers that don't pre-normalize rather than a live bypass fix.
+  const v6 = ipv6Bytes(hostname);
+  if (v6) {
+    const linkLocal = v6[0] === 0xfe && (v6[1] & 0xc0) === 0x80; // fe80::/10
+    return linkLocal || CLOUD_METADATA_V6.has(v6.join()) || ipv4sCarriedByIPv6(v6).some(isBlockedIPv4);
+  }
   const v4 = ipv4Value(hostname);
-  return v4 !== null && v4 >= LINK_LOCAL_V4_START && v4 <= LINK_LOCAL_V4_END;
+  return v4 !== null && isBlockedIPv4(v4);
 }
 
 // --- Served error / diagnostic pages ----------------------------------------
diff --git a/lib/src/host/iframe-proxy.test.ts b/lib/src/host/iframe-proxy.test.ts
index 4dba9675a..da833d27b 100644
--- a/lib/src/host/iframe-proxy.test.ts
+++ b/lib/src/host/iframe-proxy.test.ts
@@ -156,6 +156,15 @@ describe('createIframeProxyUrl — admission', () => {
     if (!r.ok) expect(r.reason).toBe('scheme');
   });
 
+  it('refuses a metadata address the user allowed, by literal or by name', async () => {
+    const allowed = { ...NO_LOG, allowExternal: true, interfaceAddresses: () => [] };
+    for (const literal of ['[fd00:ec2::254]', '[fd20:ce::254]', '[64:ff9b::a9fe:a9fe]', '100.100.100.200']) {
+      expect(await createIframeProxyUrl(`http://${literal}/`, allowed)).toMatchObject({ ok: false, reason: 'scheme' });
+    }
+    const resolve = async () => [{ address: 'fd00:ec2::254', family: 6 }];
+    expect(await createIframeProxyUrl('http://docs.example/', { ...allowed, resolve })).toMatchObject({ ok: false, reason: 'scheme' });
+  });
+
   it('preserves the target path + query in the framed URL', async () => {
     const port = await upstream((_q, s) => { s.writeHead(200, { 'content-type': 'text/html' }); s.end('<html><head></head><body>x</body></html>'); });
     const url = await frame(`http://127.0.0.1:${port}/app/page?q=1`);
@@ -178,7 +187,7 @@ describe('createIframeProxyUrl — the upstream address is fixed when the grant
   };
 
   it('refuses a name that resolves to a link-local / metadata address', async () => {
-    for (const blocked of ['169.254.169.254', '::ffff:169.254.169.254', 'fe80::1']) {
+    for (const blocked of ['169.254.169.254', '::ffff:169.254.169.254', 'fe80::1', 'fd00:ec2::254', '64:ff9b::a9fe:a9fe', '168.63.129.16']) {
       const { resolve } = resolving(['127.0.0.1', blocked]);
       const r = await createIframeProxyUrl('http://rebind.test:8080/', { ...NO_LOG, resolve });
       expect(r).toMatchObject({ ok: false, reason: 'scheme' });
@@ -998,6 +1007,35 @@ describe('iframe proxy leases', () => {
     expect(await isListening(portOf(urls[0]))).toBe(false);
   }, 30_000);
 
+  it('refuses a service worker script on a local grant, and sends it nothing upstream', async () => {
+    const seen: string[] = [];
+    const port = await upstream((q, s) => { seen.push(q.url!); s.writeHead(200, { 'content-type': 'text/javascript' }); s.end('//'); });
+    const url = await frame(`http://127.0.0.1:${port}/`, leased(lease()));
+    for (const headers of [{ 'Service-Worker': 'script' }, { 'Sec-Fetch-Dest': 'serviceworker' }, { 'Service-Worker': 'script', 'Sec-Fetch-Dest': 'serviceworker' }]) {
+      expect((await request(`${url}sw.js`, { headers })).status).toBe(403);
+    }
+    expect(seen).toEqual([]);
+    // Any other script is the page's own.
+    expect((await request(`${url}app.js`, { headers: { 'Sec-Fetch-Dest': 'script' } })).status).toBe(200);
+    expect((await request(`${url}worker.js`, { headers: { 'Sec-Fetch-Dest': 'worker' } })).status).toBe(200);
+    expect(seen).toEqual(['/app.js', '/worker.js']);
+  });
+
+  it('refuses a service worker script on an allowed external grant too', async () => {
+    const port = await upstream((_q, s) => { s.writeHead(200, { 'content-type': 'text/javascript' }); s.end('//'); });
+    const url = await frame(`http://docs.example:${port}/`, {
+      ...NO_LOG, allowExternal: true, interfaceAddresses: () => [],
+      resolve: async () => [{ address: '127.0.0.1', family: 4 }],
+    });
+    expect((await request(`${url}sw.js`, { headers: { 'Service-Worker': 'script' } })).status).toBe(403);
+  });
+
+  it('passes a service worker script through a tunneled grant, whose page is not at this port', async () => {
+    const port = await upstream((_q, s) => { s.writeHead(200, { 'content-type': 'text/javascript' }); s.end('//'); });
+    const url = await frame(`http://127.0.0.1:${port}/`, { ...leased(lease()), tunneled: true });
+    expect((await request(`${url}sw.js`, { headers: { 'Service-Worker': 'script' } })).status).toBe(200);
+  });
+
   it('clears site data on a freshly minted grant’s first response only', async () => {
     const port = await upstream((_q, s) => { s.writeHead(200, { 'content-type': 'text/html' }); s.end('<head></head>'); });
     const l = lease();
diff --git a/lib/src/host/iframe-proxy.ts b/lib/src/host/iframe-proxy.ts
index 4861ff047..d0defcde2 100644
--- a/lib/src/host/iframe-proxy.ts
+++ b/lib/src/host/iframe-proxy.ts
@@ -490,6 +490,11 @@ function upstreamRequestHeaders(grant: Grant, req: http.IncomingMessage): http.O
   return headers;
 }
 
+/** The browser names a worker's script fetch, its first and every update, itself. */
+function isServiceWorkerScript(req: http.IncomingMessage): boolean {
+  return req.headers['service-worker'] === 'script' || req.headers['sec-fetch-dest'] === 'serviceworker';
+}
+
 function handleRequest(grant: Grant, req: http.IncomingMessage, res: http.ServerResponse): void {
   if (!isLoopbackHost(req.headers.host, grant.port)) {
     // DNS rebinding: a hostile domain re-pointed at 127.0.0.1 reaches this
@@ -505,6 +510,14 @@ function handleRequest(grant: Grant, req: http.IncomingMessage, res: http.Server
   // must not do is let a page that says `Origin: https://evil.example` hold a
   // closed pane's grant, and its upstream binding, open indefinitely.
   if (!isForeignOrigin(req.headers.origin, grant.port)) grant.lastUsed = Date.now();
+  // A worker outlives its grant in the browser's storage for this origin, and
+  // would answer whichever later grant lands on this port, ahead of the proxy
+  // and its Clear-Site-Data. A tunneled page is not at this port.
+  if (!grant.tunneled && isServiceWorkerScript(req)) {
+    res.writeHead(403, { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store' });
+    res.end('A preview runs without service workers.');
+    return;
+  }
   const path = req.url ?? '/';
 
   const headers = upstreamRequestHeaders(grant, req);
diff --git a/lib/src/host/remote/network-interfaces.ts b/lib/src/host/remote/network-interfaces.ts
index d99b26365..d4e553f45 100644
--- a/lib/src/host/remote/network-interfaces.ts
+++ b/lib/src/host/remote/network-interfaces.ts
@@ -8,6 +8,7 @@
 
 import { BlockList, isIP } from 'node:net';
 import { networkInterfaces, type NetworkInterfaceInfo as OsAddress } from 'node:os';
+import { ipv6Groups, serializeIpv6 } from '../../lib/ip-literal';
 import type { NetworkInterfaceInfo } from '../../remote/network-policy';
 
 interface Cidr {
@@ -17,18 +18,6 @@ interface Cidr {
   prefix: number;
 }
 
-/**
- * IPv6 as `new URL` serializes it (RFC 5952: lower case, the longest zero run
- * compressed, an embedded IPv4 tail in hex), or `null` for text that is not one.
- */
-function serializeIpv6(address: string): string | null {
-  try {
-    return new URL(`http://[${address}]/`).hostname.slice(1, -1);
-  } catch {
-    return null;
-  }
-}
-
 /**
  * An IP literal's one spelling — IPv4 as a dotted quad, IPv6 as
  * {@link serializeIpv6} writes it — or `null` for a name or a zoned address.
@@ -39,15 +28,6 @@ export function canonicalAddress(address: string): string | null {
   return family === 4 ? address : family === 6 ? serializeIpv6(address) : null;
 }
 
-/** The eight 16-bit groups of an IPv6 address {@link serializeIpv6} spelled. */
-function ipv6Groups(serialized: string): number[] {
-  const [head, tail] = serialized.split('::') as [string, string | undefined];
-  const parse = (part: string | undefined) => (part ? part.split(':').map((group) => parseInt(group, 16)) : []);
-  const front = parse(head);
-  const back = parse(tail);
-  return [...front, ...new Array<number>(8 - front.length - back.length).fill(0), ...back];
-}
-
 /** Zero every bit past `prefix` in big-endian `units` of `width` bits each. */
 function mask(units: number[], width: number, prefix: number): number[] {
   return units.map((unit, index) => {
diff --git a/lib/src/lib/ip-literal.ts b/lib/src/lib/ip-literal.ts
index c306c3692..5955fcd1e 100644
--- a/lib/src/lib/ip-literal.ts
+++ b/lib/src/lib/ip-literal.ts
@@ -39,19 +39,81 @@ function parseIPv4(host: string): number | null {
   return value >>> 0 === value ? value : null;
 }
 
-// Extract the 32-bit IPv4 address embedded in an IPv4-mapped or IPv4-compatible
-// IPv6 literal (::ffff:169.254.169.254, ::ffff:a9fe:a9fe, ::169.254.169.254),
-// or null if this isn't such an address.
+/** An address without brackets or a zone, lowercased. */
+export const bareAddress = (address: string): string => address.replace(/^\[|\]$/g, '').replace(/%.*$/, '').toLowerCase();
+
+/**
+ * IPv6 as `new URL` serializes it (RFC 5952: lower case, the longest zero run
+ * compressed, an embedded IPv4 tail in hex), or `null` for text that is not one.
+ */
+export function serializeIpv6(address: string): string | null {
+  try {
+    return new URL(`http://[${address}]/`).hostname.slice(1, -1);
+  } catch {
+    return null;
+  }
+}
+
+/** The eight 16-bit groups of an IPv6 address {@link serializeIpv6} spelled. */
+export function ipv6Groups(serialized: string): number[] {
+  const [head, tail] = serialized.split('::') as [string, string | undefined];
+  const parse = (part: string | undefined) => (part ? part.split(':').map((group) => parseInt(group, 16)) : []);
+  const front = parse(head);
+  const back = parse(tail);
+  return [...front, ...new Array<number>(8 - front.length - back.length).fill(0), ...back];
+}
+
+/**
+ * A literal's 16 bytes, in any IPv6 spelling, bracketed or zoned or not, or null.
+ * An IPv4 tail reads as `inet_aton` would, which the URL parser alone refuses.
+ */
+export function ipv6Bytes(hostname: string): number[] | null {
+  let h = bareAddress(hostname);
+  if (!h.includes(':')) return null;
+  const tail = h.slice(h.lastIndexOf(':') + 1);
+  if (tail.includes('.')) {
+    const v4 = parseIPv4(tail);
+    if (v4 === null) return null;
+    h = `${h.slice(0, -tail.length)}${(v4 >>> 16).toString(16)}:${(v4 & 0xffff).toString(16)}`;
+  }
+  const serialized = serializeIpv6(h);
+  return serialized === null ? null : ipv6Groups(serialized).flatMap((group) => [group >> 8, group & 0xff]);
+}
+
+const u32 = (b: readonly number[], at: number): number =>
+  ((b[at] << 24) | (b[at + 1] << 16) | (b[at + 2] << 8) | b[at + 3]) >>> 0;
+
+const high64Zero = (b: readonly number[]): boolean => u32(b, 0) === 0 && u32(b, 4) === 0;
+
+// The 32-bit IPv4 address an IPv4-mapped or IPv4-compatible IPv6 literal names
+// (::ffff:169.254.169.254, ::ffff:a9fe:a9fe, ::169.254.169.254), or null if this
+// isn't such an address. `::` and `::1` are themselves, not IPv4 compatible.
 function embeddedIPv4(h: string): number | null {
-  const m = h.match(/^::(?:ffff:)?(.+)$/);
-  if (!m) return null;
-  const tail = m[1];
-  if (tail.includes('.')) return parseIPv4(tail.slice(tail.lastIndexOf(':') + 1));
-  const groups = tail.split(':');
-  if (groups.length === 2 && groups.every((g) => /^[0-9a-f]{1,4}$/.test(g))) {
-    return ((parseInt(groups[0], 16) << 16) >>> 0) + parseInt(groups[1], 16);
+  const b = ipv6Bytes(h);
+  if (!b || !high64Zero(b)) return null;
+  const [iid, v4] = [u32(b, 8), u32(b, 12)];
+  return iid === 0xffff || (iid === 0 && v4 > 0xffff) ? v4 : null;
+}
+
+/**
+ * Every IPv4 address an IPv6 literal's bytes name or hand to a translator, where
+ * an IPv6 connection ends at an IPv4 service. For a guard: a literal may match a
+ * form only by its shape, so these name where it could end up, not where it does.
+ */
+export function ipv4sCarriedByIPv6(b: readonly number[]): number[] {
+  const carried: number[] = [];
+  const [prefix, iid, low] = [u32(b, 0), u32(b, 8), u32(b, 12)];
+  // The low 32 bits: under any /96 ending in zeros (IPv4-compatible and every
+  // NAT64 prefix of that shape, RFC 6052, 64:ff9b::/96 among them), mapped,
+  // and translated.
+  const mappedOrTranslated = high64Zero(b) && (iid === 0xffff || iid === 0xffff0000);
+  if (iid === 0 || mappedOrTranslated) carried.push(low);
+  // Local-use NAT64 64:ff9b:1::/48 at RFC 6052's shorter lengths, which skip byte 8.
+  if (prefix === 0x0064ff9b && b[4] === 0 && b[5] === 1) {
+    const v4s = [...b.slice(6, 8), ...b.slice(9)];
+    carried.push(u32(v4s, 0), u32(v4s, 1), u32(v4s, 2));
   }
-  return null;
+  return carried;
 }
 
 /** The 32-bit IPv4 address a hostname spells — in any inet_aton encoding, or
diff --git a/scripts/security-rule-ids.json b/scripts/security-rule-ids.json
index a2a3c40dd..9b758a955 100644
--- a/scripts/security-rule-ids.json
+++ b/scripts/security-rule-ids.json
@@ -1,5 +1,5 @@
 {
-  "next": 303,
+  "next": 304,
   "retired": [
     265
   ]
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index 0602dee81..0e24c4073 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -6,7 +6,7 @@
   "docs/specs/alert.md": 8300,
   "docs/specs/auto-update.md": 1000,
   "docs/specs/deploy.md": 2300,
-  "docs/specs/dor-browser.md": 6400,
+  "docs/specs/dor-browser.md": 6500,
   "docs/specs/dor-cli.md": 5500,
   "docs/specs/dor-tool.md": 6700,
   "docs/specs/dor-tools-builtin.md": 1800,
@@ -27,10 +27,10 @@
   "docs/specs/security-audit.md": 5400,
   "docs/specs/security-ci.md": 3400,
   "docs/specs/security-hosted.md": 4600,
-  "docs/specs/security-local.md": 7100,
+  "docs/specs/security-local.md": 7200,
   "docs/specs/security-remote.md": 8200,
   "docs/specs/security-supply-chain.md": 1650,
-  "docs/specs/security.md": 3100,
+  "docs/specs/security.md": 3150,
   "docs/specs/shortcuts.md": 1200,
   "docs/specs/standalone.md": 6750,
   "docs/specs/terminal-context.md": 1100,