Can this context actually use the History API? A probe, not a heuristic:
pushState/replaceState throw SecurityError whenever the document URL and
origin mismatch — sandboxed/srcdoc iframes (opaque origin), data:
documents, and even non-sandboxed freshly-created contexts (see
whatwg/html#6836). Attribute sniffing can't cover all of those; calling
replaceState with the CURRENT state is side-effect-free and authoritative.
Can this context actually use the History API? A probe, not a heuristic: pushState/replaceState throw SecurityError whenever the document URL and origin mismatch — sandboxed/srcdoc iframes (opaque origin), data: documents, and even non-sandboxed freshly-created contexts (see whatwg/html#6836). Attribute sniffing can't cover all of those; calling replaceState with the CURRENT state is side-effect-free and authoritative.