irises_come

I presumed as much. But if you can covertly jimmy the UI and parse the user's interaction, you can more or less get at the history like that anyway.

I don't see any secure way to handle this besides disallowing :visited styling entirely.

Hm. Do you really need interaction at all?

Can't you just :visited { margin/pos/whatever }, then probe the dom on that or related elems to extract the juice? Or have browser vendors thought of this?