The Digital Credentials path in CredentialsContainer::get() bypasses several precondition checks that the Credential Management spec's "Request a Credential" algorithm (§2.5.1) requires before dispatching to [[DiscoverFromExternalSource]]. Gaps: 1. **Mediation conditional check (step 8a)**: The CredMan spec requires rejecting with TypeError when mediation is "conditional" and the credential type doesn't support it. Digital credentials don't support conditional mediation, but this wasn't checked in the CredMan layer. 2. **Permissions Policy check (step 11)**: The Permissions Policy check for `digital-credentials-get` was implemented inside DigitalCredential::discoverFromExternalSource() rather than in CredentialsContainer::get() where the spec requires it. 3. **"Fully active descendant of top-level traversable with user attention" (DC spec step 5)**: The implementation used Document::hasFocus() + visibilityState(), which is MORE restrictive than the spec requires. hasFocus() requires the focused frame to be a descendant of the calling document's frame, which breaks cross-origin iframes with `allow="digital-credentials-get"`. The spec's concept uses isFullyActive() + page-level visibility/focus (system attention on the top-level traversable). 4. **Wrong error code for concurrent requests**: CredentialRequestCoordinator rejected concurrent requests with InvalidStateError, but the CredMan spec requires NotAllowedError. Fix: - Add Document::isFullyActiveDescendantOfTopLevelTraversableWithUserAttention() using isFullyActive() + Page::isVisibleAndActive() - Move Permissions Policy and mediation conditional checks to CredentialsContainer::get() - Fix error code in CredentialRequestCoordinator from InvalidStateError to NotAllowedError Branch: eng/credman-dc-security-checks