=== poc.html (vulnerable build) === [INFO:CONSOLE] "[POC] visited-probe pixel @(50,50) = rgba(255,255,255,255)" [INFO:CONSOLE] "[POC] unvisited-probe pixel @(150,50) = rgba(0,0,0,255)" [INFO:CONSOLE] "[POC] R-channel delta = 255" [INFO:CONSOLE] "[POC] LEAK CONFIRMED: getImageData() distinguishes :visited from :link" [INFO:CONSOLE] "[POC] => a:visited resolves currentColor to white (R~255), a:link to black (R~0)" === control.html (bare currentcolor — existing gate works correctly) === [INFO:CONSOLE] "[CONTROL] visited=0,0,0,255 unvisited=0,0,0,255 delta=0 OK (no leak; gate works)" === poc.html (with bandaid-fix.patch applied) === [INFO:CONSOLE] "[POC] visited-probe pixel @(50,50) = rgba(0,0,0,255)" [INFO:CONSOLE] "[POC] unvisited-probe pixel @(150,50) = rgba(0,0,0,255)" [INFO:CONSOLE] "[POC] R-channel delta = 0" [INFO:CONSOLE] "[POC] no leak observed (delta too small)"