Add scoped native history and window agent controls

docs/requirements-audit.md

@@ -564,3 +564,48 @@ tests pass (`artifacts/human-windows-build.log`, `human-package-proof.log`,
    These require independent deployment evidence, not only mocked local tests.
 
 Mac/Linux/mobile remain explicitly deferred by the user's Windows-first scope.
+
+## Secured history and window agent capabilities
+
+Four separately signed, default-unchecked capabilities now cover inspected
+history listing, opaque snapshot navigation and bounded native window state/control.
+Baseline, profile and individual-grant restrictions apply together. Native history
+output excludes pageState; private bounded comparison checksums detect changed
+state without retaining or exporting form values. Snapshots expire, are actor-
+and session-bound and consumed once. Credential-bearing entries are masked and
+cannot navigate; destination scope filters apply before metadata export and
+immediately before native navigation. See `docs/agent-history-window.md`.
+
+Actual Windows/Electron proof covers two individual actors, host exclusions,
+cross-actor/replay/stale denial, one exact indexed target, native maximize,
+minimize, restore and focus, targeted revocation and global disable. Completed
+history trace `d331f2f223782a94c9b99b7b6c7c6b6c` contains its named native navigation
+child; window trace `2fc7b43bea197f4bd7fada08b81ed30e` contains its named window child.
+Missing action names were found in the diagnostic allowlist and corrected rather
+than relying on generic dispatch timing. Ordinary audit excludes content and
+native state (`artifacts/extended-agent-controls-native-proof.json`).
+
+Central admin controls and individual grant defaults were verified in the actual
+UI. The fixture now records real network outcomes and requires correlated backend
+spans for every completed request and all mutations. 148 completed requests and
+seven mutation attempts have trace evidence; three failed GET attempts are
+reported separately. An earlier attempted request's missing trace is absent even
+from protected archives and remains unproven, not retroactively passed. No
+enforcement assertion was relaxed (`artifacts/control-scopes-admin-ui-current.log`).
+
+The current full suite passes 569 tests. Native browser and syntax checks pass.
+These controls do not complete full first-class agent access: persistent session
+restoration, safely inspected screenshots, vault/file/admin operations, arbitrary
+widgets and worker ownership remain open, together with the production/integration
+limits listed above. Same-state native page-state mutation is unit-proven only.
+
+Final current Windows build and packaged-source verification pass, including the
+new history-state and window-control modules, contained scanners, offline semantic
+inference, upload leases and both shipped agent clients. Syntax and the native
+tab/DLP/revocation proof pass. Logs: `artifacts/extended-controls-windows-build.log`,
+`extended-controls-package-proof.log`, `extended-controls-syntax.log`,
+`extended-controls-native-tabs.log`. Executable Authenticode remains `NotSigned`.
+Next control milestones are persistent session restoration and scoped vault/file
+operations; history inventory/navigation and the four bounded window operations
+are now implemented, rather than remaining wholly absent. The overall objective
+remains active and unachieved.