From 7c17106aadb8f0071d3cad9739325772d9342fca Mon Sep 17 00:00:00 2001
From: Dominic Farolino <dom@chromium.org>
Date: Wed, 14 Oct 2026 14:39:24 +0000
Subject: [PATCH 1/2] Fix inactive unregistration

---
 index.bs | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/index.bs b/index.bs
index 8669a88..067ba25 100644
--- a/index.bs
+++ b/index.bs
@@ -621,6 +621,13 @@ To <dfn for="model context">unregister a tool</dfn> given a {{ModelContext}} |mo
 1. Let |targetDocument| be |modelContext|'s [=relevant global object=]'s [=associated
    Document|associated <code>Document</code>=].
 
+1. If |targetDocument| is not [=Document/fully active=], then return.
+
+   Note: This can happen if a tool's {{ModelContextRegisterToolOptions/signal}} is aborted after
+   |targetDocument| has been removed from its [=navigable=], for example because its
+   <{iframe}> was removed. In that case, |targetDocument| has no [=node navigable=] from which to
+   find other documents to notify.
+
 1. [=In parallel=], [=notify documents of a tool change=] given |targetDocument| and |exposed
    origins|.
 

From bae1872aeee85ede32684d505db062be4dddb35f Mon Sep 17 00:00:00 2001
From: Dominic Farolino <dom@chromium.org>
Date: Wed, 14 Oct 2026 19:48:50 +0000
Subject: [PATCH 2/2] Fix registerTool() too

---
 index.bs | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/index.bs b/index.bs
index 067ba25..4fc6465 100644
--- a/index.bs
+++ b/index.bs
@@ -777,6 +777,13 @@ The <dfn method for=ModelContext>registerTool(<var>tool</var>, <var>options</var
      </ol>
    </div>
 
+1. If |tool owner| is not [=Document/fully active=], then return [=a promise rejected with=] an
+   "{{InvalidStateError}}" {{DOMException}}.
+
+   Note: |tool owner| was already checked for being [=Document/fully active=] above, but serializing
+   |tool|'s {{ModelContextTool/inputSchema}} can run script (e.g., a `toJSON()` method) that makes
+   |tool owner| no longer [=Document/fully active=], for example by removing its <{iframe}>.
+
 1. If |options|'s {{ModelContextRegisterToolOptions/signal}} [=map/exists=] and is
    [=AbortSignal/aborted=], then return [=a promise rejected with=] |options|'s
    {{ModelContextRegisterToolOptions/signal}}'s [=AbortSignal/abort reason=].