Currently step 4 here:

https://w3c.github.io/ServiceWorker/#client-navigate

Requires that the Client.navigate(url) method reject if its called a Client that is not controlled by the current service worker.

What is the purpose of this restriction?

I believe an origin could easily use Client.postMessage() and then modify window.location. AIUI this is the same rationale why we don't require interaction for navigate(). Is this restriction legacy from before includeUncontrolled:true?

This came up because we were not aware of this spec step and I tried to fix the WPT in web-platform-tests/wpt#8743.