Build everything mountApplet needs, without touching the DOM.
The environment is kehto's resolveShellEnvironment, so it is the live
domains narrowed by the host's capabilities.resolveEnvironment (kernl's
grants). The CSP is the guard's zero-network profile, inserted first in
<head> by prepareNappletSrcdoc with kehto's nested-context lock enabled
(experimental.nestedContextLock): the policy gains kehto's Trusted Types
directives and the mandatory namespace prelude installs kehto's creation
lock. kernl's insertion lock follows the prelude. Markup that declares a
nested frame is refused by kehto's scan before any of that (D-014).
missingRequired lists what the applet asked for and will not get, so the
host can warn before mounting.
Build everything
mountAppletneeds, without touching the DOM.The environment is kehto's
resolveShellEnvironment, so it is the live domains narrowed by the host'scapabilities.resolveEnvironment(kernl's grants). The CSP is the guard's zero-network profile, inserted first in<head>byprepareNappletSrcdocwith kehto's nested-context lock enabled (experimental.nestedContextLock): the policy gains kehto's Trusted Types directives and the mandatory namespace prelude installs kehto's creation lock. kernl's insertion lock follows the prelude. Markup that declares a nested frame is refused by kehto's scan before any of that (D-014).missingRequiredlists what the applet asked for and will not get, so the host can warn before mounting.