What

Two tab-scoped, non-persistent recovery controls in the popup for the "this page looks broken" case — deliberately distinct from the permanent Disable on this site denylist (ADR-0018):

• Reveal everything on this page — one-click panic button. Reveals everything the shield hid and stops re-hiding for the current page load. Page-scoped: cleared on the next top-frame navigation, so a reload restores protection.
• Time-boxed snooze — Until closed / 15 min / 1 hour. Tab-scoped: survives navigation within the tab (so a multi-page checkout stays unblocked) until expiry or tab close. The popup shows a live countdown and a Resume now button.

Why

When a rule eats real content today, the only escapes are hunting for the per-element reveal, or writing a permanent denylist entry a daily driver never cleans up — silently unprotected on that site forever. There was no panic button and no "just let me through this once."

How

• One mechanism, reused teardown. Both controls write a per-tab TabPause into a webext-storage StorageItemMap on the session area. It becomes a third input to effective-enforcement.ts (global && !denylist && !tabPaused); flipping it false routes through the engine's existing revealAll + teardown path — no new reveal code.
• chrome.storage.session survives MV3 service-worker restarts and auto-clears on browser restart — exactly the ephemerality we want, no cleanup debt.
• No chrome.alarms, no new permissions. Liveness is lazy (expiresAt > now). A timed snooze that expires while the page is open leaves the page revealed and re-engages protection on the next navigation — a forgotten timer never yanks content back mid-task. Manual Resume now re-enforces immediately.
• Toolbar gains a "paused" off-reason, reusing the greyed icon + off badge (FR-2a).
• Content bridge: content scripts can't read the session area or know their own tabId, so the background resolves liveness for them via get-tab-pause + tab-pause-changed messages. Popup and background (privileged) read/write the map directly, mirroring the denylist flow.

Popup hierarchy

Landing recovery as a third standalone card under Disable on this site left the popup with four ungrouped "turn protection off" controls whose visual weight inverted their scope — the narrowest, most ephemeral action (Reveal) shouted loudest with an orange fill.

Consolidated the site-disable + recovery cards into one Protection card with an internal scope ladder, each row carrying an eyebrow that states scope + persistence once:

• This tab · temporary — Reveal (now an orange outline, not a fill) + the tab snooze.
• This site · saved — the denylist toggle.

New ProtectionSection wraps both rows; the divider is a CSS adjacent-sibling rule, so it only appears when both render (recovery still drops out on denylisted / non-content pages, leaving the site row alone). Also shortened the indefinite-pause label to Until closed so it stops wrapping to three lines at 280px.

Docs

• Spec 0010 — new FR-7e–FR-7h, updated FR-2a / FR-4, user story, current-impl, related.
• ADR-0019 — the session-scoped, alarm-free, lazy-expiry decision (incl. rejected alternatives).
• docs/install.md — user-facing "Recovering a page the shield broke" section.

Verification

• bun run preflight (build → biome+eslint → tsc → knip → coverage): green; 2027 tests pass, including new tab-pause unit + fast-check property tests and extended toolbar-protection tests.
• bun run build: bundles cleanly; background-worker purity canary passes.
• Popup hierarchy refactor verified against the real popup CSS in all three states (default, paused, denylisted) at the 280px popup width.
• Markdown pre-commit run: mdformat + markdownlint pass.

Review note

A denylisted-and-paused tab reports the site toolbar reason (the popup only offers recovery when not denylisted, so they don't overlap in practice) — documented as a consequence in ADR-0019.

🤖 Generated with Claude Code