CredentialRequestCoordinator::prepareCredentialRequests sets the interaction state to Requesting, then creates a DigitalCredentialsSession, and only assigns m_activeSession after create() returns. DigitalCredentialsSession::create() calls suspendIfNeeded(). If the requesting context is already stopped, ScriptExecutionContext::suspendActiveDOMObjectIfNeeded calls the session's stop() during construction. stop() calls abandon(), which calls CredentialRequestCoordinator::sessionDidFinish(). That early-returns because m_activeSession does not yet point at this session, so the state is never returned to Idle. Control then returns to prepareCredentialRequests, which assigns m_activeSession to a session that has already finished. The coordinator is per-Page, so the result is that the page is left in the Requesting state permanently and every subsequent navigator.credentials.get() on it rejects with NotAllowedError for the lifetime of the page. Reachability is not established. CredentialsContainer::get rejects with InvalidStateError when the document is not fully active, before the coordinator is reached, and I could not construct a document that is stopped but still fully active. The ordering is wrong regardless of whether web content can currently reach it. Found by two independent code reviews of the change that landed as 319421@main.