diff --git a/spec.bs b/spec.bs
index 83987a25..8f12c115 100644
--- a/spec.bs
+++ b/spec.bs
@@ -45,6 +45,10 @@ spec: html; urlPrefix: https://html.spec.whatwg.org/multipage/
     text: initialize the navigable; url: document-sequences.html#initialize-the-navigable
     text: node navigable; url: document-sequences.html#node-navigable
     text: document state; url: browsing-the-web.html#she-document-state
+    text: historyHandling; url: browsing-the-web.html#navigation-hh
+    text: referrerPolicy; url: browsing-the-web.html#navigation-referrer-policy
+    for: history handling behavior
+      text: replace; url: browsing-the-web.html#hh-replace
     for: document state
       text: document; url: browsing-the-web.html#document-state-document
     for: navigable
@@ -193,7 +197,38 @@ Each <{fencedframe}> has a <dfn for=fencedframe>config</dfn>, which is either a
 
   1. <span class=XXX>Parse the sandbox attributes, once it exists</span>
 
-  1. <span class=XXX>Process the actual attributes, and start the navigation</span>
+  1. [=Process the fencedframe attributes=] with |element| and [=initialInsertion=] set to true.
+</div>
+
+<div algorithm=process-the-fencedframe-attributes>
+  To <dfn>process the <{fencedframe}> attributes</dfn> given a <{fencedframe}> element |element| and
+  a boolean <dfn><var>initialInsertion</var></dfn>, run these steps:
+
+  1. [=Assert=]: |element| is [=connected=].
+
+  Issue: It's not necessary to call the <a
+  href=https://html.spec.whatwg.org/multipage/browsing-the-web.html#url-and-history-update-steps>URL
+  and history update steps</a> as we do during usual <a
+  href=https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element:url-and-history-update-steps>child
+  navigable creation</a> or <a
+  href=https://html.spec.whatwg.org/multipage/nav-history-apis.html#apis-for-creating-and-navigating-browsing-contexts-by-name:url-and-history-update-steps>top-level
+  traversable creation</a>, but we still need a mechanism to initialize
+  {{History}}.{{History/length}} in the new navigable. This is an existing issue in the HTML
+  Standard: <a
+  href=https://github.com/whatwg/html/issues/9030>https://github.com/whatwg/html/issues/9030</a>.
+
+  1. If |element|'s [=fencedframe/config=] is null and |initialInsertion| is true, then return.
+
+  1. Let |url| be the [=URL record=] <code>about:blank</code>.
+
+  1. <a spec="HTML" lt="parse a URL">Parse</a> |element|'s [=fencedframe/config=]'s
+     [=fencedframeconfig/url=] relative to |element|'s [=Node/node document=]. If this is
+     successful, then set [=url=] to the <a spec="HTML">resulting URL record</a>.
+
+  1. [=Navigate=] |element|'s [=fencedframe/nested traversable=] to |url| using |element|'s
+     [=fencedframe/nested traversable=]'s [=navigable/active document=], with [=historyHandling=]
+     set to "<a for="history handling behavior">`replace`</a>" , and [=referrerPolicy=] set to
+     <a>"`no-referrer`"</a>.
 </div>
 
 <div algorithm=destroy>
@@ -234,6 +269,9 @@ elements that the <code>[=width=]</code> and <code>[=height=]</code> dimension a
   };
 </pre>
 
+Each {{FencedFrameConfig}} has a <dfn for=fencedframeconfig>url</dfn>, which is a string, initially
+null.
+
 <span class=XXX>TODO: Fix the "indistinguishable" IDL bug with the unions above.</span>
 
 <h3 id=fence-interface>The {{Fence}} interface</h3>