fix: clarify invalid selectors and dedupe diagnostics

chore: add session-loss diagnostics
2026-09-10 13:01:23 +08:00 · 2026-09-01 21:03:22 +08:00 · 2026-09-01 20:16:32 +08:00
183 changed files with 3568 additions and 16787 deletions
@@ -37,35 +37,6 @@ jobs:
      - name: Run Rust tests
        run: cargo test --workspace --locked

-  windows-daemon:
-    name: Windows daemon, installer and cancellation regression tests
-    runs-on: windows-latest
-
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: dtolnay/rust-toolchain@stable
-
-      - name: Run Windows named-pipe tests
-        run: cargo test -p bsk --lib --locked daemon::ipc::windows::tests
-
-      - name: Run Windows process liveness tests
-        run: cargo test -p bsk --lib --locked daemon::lockfile::tests
-
-      - name: Run Windows update tests
-        run: cargo test -p bsk --lib --locked cli::update::tests
-
-      - name: Run Windows update and cancellation process tests
-        run: cargo test -p bsk --test windows_update --test windows_parent_cancel --locked
-
-      - name: Run installer tests (Windows PowerShell 5.1)
-        shell: powershell
-        run: ./scripts/install-windows.test.ps1
-
-      - name: Run installer tests (PowerShell 7)
-        shell: pwsh
-        run: ./scripts/install-windows.test.ps1
-
  frontend:
    name: Frontend lint, typecheck, tests, build
    runs-on: ubuntu-latest
@@ -7,10 +7,6 @@ dist/
 .output/
 .wxt/
 .web-extension-id
-.pnpm-store/
-
-# Git worktrees
-.worktrees/

 # Logs
 *.log
@@ -1,109 +0,0 @@
-# Changelog
-
-All notable changes to BrowserSkill will be documented in this file.
-The format is based on [Keep a Changelog](https://keepachangelog.com/).
-
-Starting from 0.2.0, CLI / Extension / DSH Plugin share the same version number.
-
-## [0.2.1] - 2026-09-09
-
-### Changed
- DSH Plugin: clarified installation, configuration, profile restart, and upgrade instructions
-
-### Fixed
- CLI: reliable Windows self-updates, including executable replacement and daemon restart
- CLI: Windows named-pipe connection continuity and stale daemon process detection
- Windows installer: PowerShell 5.1 compatibility, path quoting, and staged executable replacement
- CLI / DSH Plugin: cancellation propagation and upload/download cleanup when the parent process exits
- Extension: tab ownership and session cleanup when agent tabs fail to open or borrowed tabs are returned or closed
- Extension: navigation recovery when other extensions restrict Chrome DevTools Protocol access
- Extension: background input filling, automatic append behavior, and verification of field values before reporting success
- Extension: match observed form state to the correct element after page changes
- Extension: UUID generation fallback for recording and overlays on insecure origins
- Browser locale matching for regional language variants
- DSH Plugin: observation state synchronization, thumbnail capture lifecycle, and stale preview cleanup
- DSH Plugin: removed the obsolete client runtime host dependency
-
-## [0.2.0] - 2026-09-02
-
-### Added
- File transfer: upload and download support across CLI, Extension, and DSH Plugin
- File transfer: drag-and-drop upload (`drop-to-upload`)
- VOM semantic graph, name enrichment, and hover perception modules
- VOM hover probing (opt-in via `observe` parameter)
- DSH Plugin: browser tool parity with CLI commands
- Edge Add-ons automated publishing in CI
- Protocol upgrade reminder when CLI / Extension protocol versions differ
- Browser evaluation harness (`evals/browser/`)
- Unified release script (`scripts/release.mjs`)
-
-### Changed
- **Version scheme**: all three components now share the same semver
- VOM rendering algorithm optimizations
- Leaner SKILL.md agent instructions
- DSH Plugin: simplified browser commands
- Borrow confirmation UX — proactive focus and longer timeout
- PiP window now has a close button
-
-### Fixed
- Screenshot media type detection (was hard-coded to `image/png`)
- DSH Plugin session lifecycle stability
- DSH Plugin Cordis package ID mismatch
- Observation thumbnail media type sniffing
- Upload/download race conditions and layout bypass issues
- VOM repeated name and safety policy issues
-
---
-
-*Previous releases used independent version numbers per component.*
-
-## CLI 0.1.11 / Extension 0.1.7 / DSH Plugin 0.1.2 — 2026-08-26 ~ 2026-08-29
-
-### Added
- DSH Plugin sidebar integration, session lifecycle, and archive cleanup
- Recorder iframe and OOPIF support
-
-### Changed
- VOM functional refactor
-
-### Fixed
- Recorder safety policy and bug fixes
-
-## CLI 0.1.10 / Extension 0.1.6 — 2026-08-08
-
-### Added
- VOM observation recording and settled-state detection
- Record overlay timer
-
-### Fixed
- Browser keepalive disconnect handling
-
-## CLI 0.1.9 / Extension 0.1.5 — 2026-07-29
-
-### Added
- CLI auto-update mechanism
- Trace v3 protocol and recorder
-
-### Fixed
- MV3 keepalive disconnect
-
-## CLI 0.1.8 / Extension 0.1.4 — 2026-07-22
-
-### Added
- More browser interaction actions
-
-### Fixed
- Windows named-pipe hash-only path issue
-
-## CLI 0.1.7 / Extension 0.1.3 — 2026-07-07
-
-Initial public release pair.
-
-## CLI 0.1.6 — 2026-06-30
-
-### Fixed
- Minor CLI fixes
-
-## CLI 0.1.5 / Extension 0.1.2 — 2026-06-22
-
-First tagged releases.
@@ -134,10 +134,9 @@ dependencies = [

 [[package]]
 name = "bsk"
-version = "0.2.1"
+version = "0.1.11"
 dependencies = [
 "anyhow",
- "base64",
 "bsk-protocol",
 "clap",
 "console",
@@ -169,7 +168,7 @@ dependencies = [

 [[package]]
 name = "bsk-protocol"
-version = "0.2.1"
+version = "0.1.11"
 dependencies = [
 "schemars",
 "semver",
@@ -7,7 +7,7 @@ members = [
 default-members = ["crates/bsk-cli"]

 [workspace.package]
-version = "0.2.1"
+version = "0.1.11"
 edition = "2024"
 rust-version = "1.85"
 license = "MIT"
@@ -36,14 +36,13 @@ flate2 = "1.1.9"
 tar = "0.4.46"
 zip = { version = "7.2.0", default-features = false, features = ["deflate"] }
 sha2 = "0.11.0"
-base64 = "0.22"
 tempfile = "3"
 nix = { version = "0.29", features = ["signal", "process"] }
 rand = "0.8"
 uuid = { version = "1", features = ["v4", "serde"] }

 # Workspace crates (version required for `cargo publish` of dependents)
-bsk-protocol = { version = "0.2.1", path = "crates/bsk-protocol" }
+bsk-protocol = { version = "0.1.9", path = "crates/bsk-protocol" }

 [profile.release]
 strip = "symbols"
@@ -147,26 +147,20 @@ Start a new Agent session and write a prompt that needs the browser, for example
 Using [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (`dsh`)?
 BrowserSkill ships a first-class dsh plugin on npm as
 [`@wxg-prc-cpg/browser-skill-dsh-plugin`](https://www.npmjs.com/package/@wxg-prc-cpg/browser-skill-dsh-plugin).
-It gives the agent native `browser_*` tools and a live view of its browser sessions
-in the Web UI. The plugin runs `bsk` on the agent's behalf.
+It injects native `browser_*` tools (no shelling out to `bsk`) and a live Web UI
+overlay of each Agent Window.

-Install the `bsk` CLI and connect the browser extension first. Then add the plugin
-to a dsh profile and start it (replace `web` with your profile name):
+Add it to a dsh profile, then start that profile:

 ```sh
 dsh plugin --profile web add @wxg-prc-cpg/browser-skill-dsh-plugin
 dsh --profile web
 ```

-The plugin includes the `browser-skill` skill, so `bsk install-skill` is not needed
-for dsh. Installed plugins do not update automatically. To upgrade this plugin:
-
-```sh
-dsh plugin --profile web update @wxg-prc-cpg/browser-skill-dsh-plugin --latest
-```
-
-Restart the profile after upgrading. See the
-[plugin README](packages/dsh-plugin-browserskill/README.md) for usage and configuration.
+The plugin carries its own copy of the skill, so `bsk install-skill` is not needed
+for dsh — but the `bsk` CLI and the browser extension are still prerequisites. See
+the [plugin README](packages/dsh-plugin-browserskill/README.md) for the tool list,
+configuration, and the observation overlay.

 ## How It Works

@@ -125,22 +125,16 @@ bsk install-skill

 ## DeepSeek Harness 插件

-在用 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)（`dsh`）？BrowserSkill 提供了官方 dsh 插件，已发布到 npm：[`@wxg-prc-cpg/browser-skill-dsh-plugin`](https://www.npmjs.com/package/@wxg-prc-cpg/browser-skill-dsh-plugin)。它为 Agent 提供原生 `browser_*` 工具，由插件代为调用 `bsk`，并在 Web UI 中实时展示浏览器会话。
+在用 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)（`dsh`）？BrowserSkill 提供了官方 dsh 插件，已发布到 npm：[`@wxg-prc-cpg/browser-skill-dsh-plugin`](https://www.npmjs.com/package/@wxg-prc-cpg/browser-skill-dsh-plugin)。它会注入原生 `browser_*` 工具（无需再通过 Shell 调用 `bsk`），并在 Web UI 中实时观察每个 Agent Window。

-先安装 `bsk` CLI 并连接浏览器扩展，再将插件装进 dsh profile 并启动（将 `web` 替换为你的 profile 名称）：
+把它装进某个 dsh profile，然后启动该 profile：

 ```sh
 dsh plugin --profile web add @wxg-prc-cpg/browser-skill-dsh-plugin
 dsh --profile web
 ```

-插件自带 `browser-skill` skill，所以在 dsh 下无需执行 `bsk install-skill`。已安装的插件不会自动更新；升级此插件请运行：
-
-```sh
-dsh plugin --profile web update @wxg-prc-cpg/browser-skill-dsh-plugin --latest
-```
-
-升级后重启该 profile。用法与配置见[插件 README](packages/dsh-plugin-browserskill/README.md)。
+插件自带 skill，所以在 dsh 下无需执行 `bsk install-skill`；但 `bsk` CLI 和浏览器扩展仍是前置条件。工具清单、配置项与观察浮层见[插件 README](packages/dsh-plugin-browserskill/README.md)。

 ## 工作原理

@@ -1,6 +1,6 @@
 # BrowserSkill — Privacy Policy

-**Last updated:** August 20, 2026
+**Last updated:** May 25, 2026

 This Privacy Policy describes how the **BrowserSkill** browser extension (the "Extension") handles information when you install and use it. BrowserSkill is published as part of the open-source [BrowserSkill](https://github.com/Tencent/BrowserSkill) project. The source code is publicly auditable.

@@ -14,7 +14,7 @@ BrowserSkill is a local automation bridge that lets AI coding agents (such as Cu

 ## 2. Single Purpose

-The Extension's single purpose is to expose browser automation primitives (navigation, DOM observation, screenshots, clicks, form filling, task-scoped file transfer, and tab management) to a locally running BrowserSkill daemon over a WebSocket connection on `127.0.0.1`, so that an AI agent invoked by the user can interact with web pages on the user's behalf.
+The Extension's single purpose is to expose browser automation primitives (navigation, DOM observation, screenshots, clicks, form filling, tab management) to a locally running BrowserSkill daemon over a WebSocket connection on `127.0.0.1`, so that an AI agent invoked by the user can interact with web pages on the user's behalf.

 ## 3. Data the Extension Accesses

@@ -26,7 +26,6 @@ Depending on the commands the user (via their AI agent) sends to the local daemo
 | **User input simulated by the agent** | Mouse clicks, keystrokes, and form values that the AI agent dispatches through the Chrome DevTools Protocol (CDP). | Required to perform automation actions the user has asked the agent to do. |
 | **Tab and window metadata** | Tab IDs, URLs, titles, window IDs of the Agent Window and any tabs the user explicitly authorizes. | Required to target automation commands at the correct tab/window. |
 | **Local extension storage** | A randomly generated 8-character instance ID and an optional user-supplied label. | Used so the local daemon can recognize this browser instance across reconnects. No personal data is stored. |
-| **File transfers requested by the agent** | Local files explicitly supplied to `bsk upload`, and the file created by a single `bsk download` action. | Required to attach a task file to a web page or return a browser-generated download to the invoking local agent. |
 | **OS notifications** | Permission to display a system notification when the agent requests to "borrow" one of the user's existing tabs. | Required to obtain explicit, per-tab user consent before the agent touches any pre-existing tab. |

 ## 4. Data the Extension Does **Not** Collect
@@ -35,7 +34,7 @@ BrowserSkill does **not**:

 - Send any data to remote servers, the Extension's authors, or any third party.
 - Call any LLM, AI, or cloud API. The Extension contains no API keys, model identifiers, or remote endpoints.
- Read or transmit cookies, browsing history, bookmarks, saved passwords, or autofill data. It observes only the download initiated by an active `bsk download` call, not download history generally.
+- Read or transmit cookies, browsing history, bookmarks, downloads, saved passwords, or autofill data.
 - Use webcam, microphone, geolocation, or any device sensor.
 - Include analytics, telemetry, crash reporting, advertising SDKs, or fingerprinting code.
 - Track users across websites or across sessions.
@@ -51,7 +50,6 @@ The Extension requests the following Chrome permissions. Each is used solely for
 - **`alarms`** — Periodically wake the service worker to keep the local WebSocket connection alive.
 - **`idle`** — Detect when the device returns from idle/locked so the Extension can promptly re-establish the local WebSocket connection after the machine wakes. No idle data is stored or transmitted.
 - **`notifications`** — Show a system notification to obtain user approval before the agent borrows a user-owned tab.
- **`downloads`** — Correlate and route the one browser download initiated by an active `bsk download` command. If that claimed transaction fails, BrowserSkill cancels an in-progress file or removes its completed temporary browser file. It is not used to enumerate download history or alter unclaimed downloads.
 - **`storage`** — Persist a random instance ID and optional label in `chrome.storage.local`.
 - **Host permission `<all_urls>`** — Inject a small status overlay (showing "Agent Active") on pages controlled by the agent, and enable automation across whatever sites the user directs the agent to. The Extension does **not** read or transmit page content from sites the agent is not actively driving.

@@ -63,7 +61,6 @@ All Extension activity stays on the user's local device. The only network traffi

 - The instance ID and optional label persist in `chrome.storage.local` until the user uninstalls the Extension or clears extension storage.
 - Page content, screenshots, DOM snapshots, and other observed data are returned to the local daemon in response to commands and are **not retained by the Extension**. They live only as long as the agent's tool call.
- Upload and download bytes are staged by the local daemon in a private, session-scoped directory. Download staging is removed after it is copied to the requested destination. Upload staging is retained until the session ends so a later form submission can still read the attached file. Remaining staging is removed when the session ends or disconnects, or when the daemon next starts after a crash.

 ## 8. User Control

@@ -1,81 +0,0 @@
-<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8" />
-    <title>BrowserSkill file-transfer fixture</title>
-    <style>
-      body { font: 16px system-ui; max-width: 760px; margin: 48px auto; }
-      .actions { display: flex; gap: 12px; align-items: center; margin: 24px 0; }
-      button, a { padding: 10px 16px; border: 1px solid #777; border-radius: 8px; }
-      a[aria-disabled="true"] { opacity: .45; pointer-events: none; }
-      #drop { padding: 36px; border: 3px dashed #777; border-radius: 12px; text-align: center; }
-      #drop.dragging { border-color: #2563eb; background: #eff6ff; }
-      img { display: block; max-width: 480px; max-height: 360px; margin-top: 20px; }
-    </style>
-  </head>
-  <body>
-    <h1>Upload then download the same image</h1>
-    <p id="status">No image selected</p>
-    <div class="actions">
-      <button id="upload" type="button">Upload through file input</button>
-      <input id="file" type="file" accept="image/png" hidden />
-      <a id="download" aria-disabled="true">Download uploaded image</a>
-    </div>
-    <div id="drop" role="button" tabindex="0">Drop an image here</div>
-    <img id="preview" alt="Uploaded image preview" hidden />
-    <script>
-      const input = document.querySelector('#file');
-      const upload = document.querySelector('#upload');
-      const drop = document.querySelector('#drop');
-      const download = document.querySelector('#download');
-      const preview = document.querySelector('#preview');
-      const status = document.querySelector('#status');
-      let objectUrl;
-
-      window.__bskTransferFixture = { events: [], result: null };
-
-      function accept(file, mechanism) {
-        if (!file) return;
-        if (objectUrl) URL.revokeObjectURL(objectUrl);
-        objectUrl = URL.createObjectURL(file);
-        preview.src = objectUrl;
-        preview.hidden = false;
-        download.href = objectUrl;
-        download.download = file.name;
-        download.removeAttribute('aria-disabled');
-        status.textContent = `Ready via ${mechanism}: ${file.name} (${file.size} bytes)`;
-        window.__bskTransferFixture.result = {
-          mechanism,
-          name: file.name,
-          size: file.size,
-          type: file.type,
-          hasPathProperty: 'path' in file,
-        };
-      }
-
-      upload.addEventListener('click', () => input.click());
-      input.addEventListener('change', () => accept(input.files[0], 'input'));
-
-      for (const type of ['dragenter', 'dragover']) {
-        drop.addEventListener(type, event => {
-          const types = [...event.dataTransfer.types];
-          window.__bskTransferFixture.events.push({ type, types });
-          if (!types.includes('Files')) return;
-          event.preventDefault();
-          drop.classList.add('dragging');
-        });
-      }
-      drop.addEventListener('dragleave', () => drop.classList.remove('dragging'));
-      drop.addEventListener('drop', event => {
-        window.__bskTransferFixture.events.push({
-          type: 'drop',
-          types: [...event.dataTransfer.types],
-          fileCount: event.dataTransfer.files.length,
-        });
-        event.preventDefault();
-        drop.classList.remove('dragging');
-        accept(event.dataTransfer.files[0], 'drop');
-      });
-    </script>
-  </body>
-</html>
@@ -1,6 +1,6 @@
 {
  "name": "@browser-skill/extension",
-  "version": "0.2.1",
+  "version": "0.1.7",
  "private": true,
  "type": "module",
  "scripts": {
@@ -254,69 +254,6 @@ describe("ChromiumCdp", () => {
    expect(cdp.isAttached(7)).toBe(false);
  });

-  it.each([
-    false,
-    true,
-  ])("waits for detach before reconnecting a returned tab (detach rejects: %s)", async (rejectDetach) => {
-    const { api } = fakeApi();
-    const attached = new Set<number>();
-    let finishDetach!: () => void;
-    vi.mocked(api.attach).mockImplementation(async ({ tabId }) => {
-      if (attached.has(tabId!)) throw new Error("Another debugger is already attached");
-      attached.add(tabId!);
-    });
-    vi.mocked(api.detach).mockImplementation(async ({ tabId }) => {
-      attached.delete(tabId!);
-    });
-    vi.mocked(api.detach).mockImplementationOnce(
-      ({ tabId }) =>
-        new Promise<void>((resolve, reject) => {
-          finishDetach = () => {
-            attached.delete(tabId!);
-            if (rejectDetach) reject(new Error("tab already detached"));
-            else resolve();
-          };
-        }),
-    );
-    const cdp = new ChromiumCdp(api);
-    cdp.trackSessionTab("aa11", 7);
-    await cdp.ensureAttached(7);
-    const returning = cdp.releaseSessionTab("aa11", 7);
-    await vi.waitFor(() => expect(api.detach).toHaveBeenCalledOnce());
-    let duplicateDetachFinished = false;
-    const duplicateDetach = cdp.detach(7).then(() => {
-      duplicateDetachFinished = true;
-    });
-
-    cdp.trackSessionTab("bb22", 7);
-    // Register rejection handlers immediately; the pre-fix driver rejects
-    // both commands while the browser still has the previous attachment.
-    const pending = Promise.allSettled([
-      cdp.send(7, "Runtime.evaluate", { expression: "document.title" }),
-      cdp.send(7, "DOM.getDocument"),
-    ]);
-    await cdp.send(8, "DOM.getDocument");
-    const finishedEarly = duplicateDetachFinished;
-    finishDetach();
-    await Promise.all([returning, duplicateDetach]);
-
-    expect(await pending).toEqual([
-      { status: "fulfilled", value: { ok: true } },
-      { status: "fulfilled", value: { ok: true } },
-    ]);
-    expect(finishedEarly).toBe(false);
-    expect(vi.mocked(api.attach).mock.calls.filter(([target]) => target.tabId === 7)).toHaveLength(
-      2,
-    );
-    expect(cdp.isAttached(7)).toBe(true);
-    expect(cdp.isAttached(8)).toBe(true);
-    await cdp.detachSession("bb22");
-    expect(api.detach).toHaveBeenCalledTimes(2);
-    expect(cdp.isAttached(7)).toBe(false);
-    expect(attached.has(7)).toBe(false);
-    expect(cdp.isAttached(8)).toBe(true);
-  });
-
  it("detachAll() iterates every cached tab", async () => {
    const { api } = fakeApi();
    const cdp = new ChromiumCdp(api);
@@ -714,155 +651,6 @@ describe("ChromiumCdp", () => {
    expect(cdp.networkEntriesSince(33, 0, 50, 1000).entries[0].url).toBeUndefined();
  });

-  it("releases only the returning session's claim on a tab", async () => {
-    const { api } = fakeApi();
-    const cdp = new ChromiumCdp(api);
-    await cdp.ensureAttached(1);
-    await cdp.ensureAttached(2);
-    cdp.trackSessionTab("aa11", 1);
-    cdp.trackSessionTab("bb22", 1);
-    cdp.trackSessionTab("aa11", 2);
-
-    await cdp.releaseSessionTab("unknown", 1);
-    await cdp.releaseSessionTab("aa11", 1);
-    expect(api.detach).not.toHaveBeenCalled();
-
-    await cdp.releaseSessionTab("bb22", 1);
-    await cdp.releaseSessionTab("bb22", 1);
-    expect(api.detach).toHaveBeenCalledExactlyOnceWith({ tabId: 1 });
-    expect(cdp.isAttached(2)).toBe(true);
-
-    await cdp.detachSession("aa11");
-    expect(api.detach).toHaveBeenCalledTimes(2);
-    expect(api.detach).toHaveBeenLastCalledWith({ tabId: 2 });
-  });
-
-  it.each([
-    false,
-    true,
-  ])("releases a tab with an attachment in flight (new owner: %s)", async (newOwner) => {
-    const { api } = fakeApi();
-    let finishAttach!: () => void;
-    vi.mocked(api.attach).mockImplementationOnce(
-      () =>
-        new Promise<void>((resolve) => {
-          finishAttach = resolve;
-        }),
-    );
-    const cdp = new ChromiumCdp(api);
-    cdp.trackSessionTab("aa11", 1);
-    const attaching = cdp.ensureAttached(1);
-    const releasing = cdp.releaseSessionTab("aa11", 1);
-    if (newOwner) cdp.trackSessionTab("bb22", 1);
-    finishAttach();
-    await Promise.all([attaching, releasing]);
-
-    expect(cdp.isAttached(1)).toBe(newOwner);
-    expect(api.detach).toHaveBeenCalledTimes(newOwner ? 0 : 1);
-  });
-
-  it("stops accepting dialogs on a returned tab even when another session keeps CDP attached", async () => {
-    const { api, onEvent } = fakeApi();
-    let controlled = true;
-    const cdp = new ChromiumCdp(api, { shouldAutoAcceptDialog: () => controlled });
-    cdp.trackSessionTab("aa11", 1);
-    cdp.trackSessionTab("bb22", 1);
-    await cdp.ensureAttached(1);
-    onEvent.fire({ tabId: 1 }, "Page.javascriptDialogOpening", {
-      type: "confirm",
-      message: "before return",
-    });
-    await vi.waitFor(() => expect(cdp.dialogsSince(1, 0)).toHaveLength(1));
-    vi.mocked(api.sendCommand).mockClear();
-
-    controlled = false;
-    await cdp.releaseSessionTab("aa11", 1);
-    expect(cdp.isAttached(1)).toBe(true);
-    onEvent.fire({ tabId: 1 }, "Page.javascriptDialogOpening", {
-      type: "confirm",
-      message: "after return",
-    });
-    await Promise.resolve();
-    expect(api.sendCommand).not.toHaveBeenCalled();
-    expect(cdp.dialogsSince(1, 0)).toHaveLength(1);
-
-    controlled = true;
-    onEvent.fire({ tabId: 1 }, "Page.javascriptDialogOpening", {
-      type: "alert",
-      message: "borrowed again",
-    });
-    await vi.waitFor(() => expect(cdp.dialogsSince(1, 0)).toHaveLength(2));
-    expect(api.sendCommand).toHaveBeenCalledExactlyOnceWith(
-      { tabId: 1 },
-      "Page.handleJavaScriptDialog",
-      { accept: true },
-    );
-  });
-
-  it("ignores dialog events after detach, including a pending eligibility check", async () => {
-    const { api, onEvent } = fakeApi();
-    let resolveEligibility!: (value: boolean) => void;
-    const shouldAutoAcceptDialog = vi.fn(
-      () =>
-        new Promise<boolean>((resolve) => {
-          resolveEligibility = resolve;
-        }),
-    );
-    const cdp = new ChromiumCdp(api, { shouldAutoAcceptDialog });
-    await cdp.ensureAttached(1);
-    onEvent.fire({ tabId: 1 }, "Page.javascriptDialogOpening", { type: "alert" });
-    await cdp.detach(1);
-    resolveEligibility(true);
-    await Promise.resolve();
-    onEvent.fire({ tabId: 1 }, "Page.javascriptDialogOpening", { type: "alert" });
-
-    expect(shouldAutoAcceptDialog).toHaveBeenCalledOnce();
-    expect(api.sendCommand).not.toHaveBeenCalledWith(
-      expect.anything(),
-      "Page.handleJavaScriptDialog",
-      expect.anything(),
-    );
-    expect(cdp.dialogsSince(1, 0)).toEqual([]);
-  });
-
-  it("does not accept dialogs when the tab's current scope cannot be determined", async () => {
-    const { api, onEvent } = fakeApi();
-    const shouldAutoAcceptDialog = vi.fn(async () => {
-      throw new Error("tab is gone");
-    });
-    const cdp = new ChromiumCdp(api, { shouldAutoAcceptDialog });
-    await cdp.ensureAttached(1);
-    vi.mocked(api.sendCommand).mockClear();
-
-    onEvent.fire({ tabId: 1 }, "Page.javascriptDialogOpening", { type: "confirm" });
-    await Promise.resolve();
-
-    expect(shouldAutoAcceptDialog).toHaveBeenCalledWith(1);
-    expect(api.sendCommand).not.toHaveBeenCalled();
-    expect(cdp.dialogsSince(1, 0)).toEqual([]);
-  });
-
-  it("does not restore dialog state when an acceptance completes after detach", async () => {
-    const { api, onEvent } = fakeApi();
-    const cdp = new ChromiumCdp(api);
-    await cdp.ensureAttached(1);
-    let finishAccept!: () => void;
-    vi.mocked(api.sendCommand).mockImplementationOnce(
-      () =>
-        new Promise<void>((resolve) => {
-          finishAccept = resolve;
-        }),
-    );
-
-    onEvent.fire({ tabId: 1 }, "Page.javascriptDialogOpening", { type: "alert" });
-    await cdp.detach(1);
-    finishAccept();
-    await Promise.resolve();
-
-    expect(cdp.dialogsSince(1, 0)).toEqual([]);
-    expect(cdp.dialogCursor(1)).toBe(0);
-  });
-
  it("detachSession only detaches tabs no other session owns", async () => {
    const { api } = fakeApi();
    const cdp = new ChromiumCdp(api);
@@ -165,7 +165,6 @@ export class ChromiumCdp {
  private readonly api: CdpDebuggerApi;
  private readonly attachedTabs = new Set<number>();
  private readonly attachInFlight = new Map<number, Promise<void>>();
-  private readonly detachInFlight = new Map<number, Promise<void>>();
  private readonly tabOwners = new Map<number, Set<string>>();
  private readonly dialogBuffers = new Map<number, JavaScriptDialogInfo[]>();
  private readonly dialogSequences = new Map<number, number>();
@@ -183,13 +182,7 @@ export class ChromiumCdp {
  private networkSubscription: { dispose(): void } | null = null;
  private frameTargetSubscription: { dispose(): void } | null = null;

-  constructor(
-    api: CdpDebuggerApi = chromeDebuggerApi,
-    private readonly options: {
-      /** CDP observation alone does not authorize dismissing user dialogs. */
-      shouldAutoAcceptDialog?: (tabId: number) => boolean | Promise<boolean>;
-    } = {},
-  ) {
+  constructor(api: CdpDebuggerApi = chromeDebuggerApi) {
    this.api = api;
    this.bindAutoDetach();
    this.bindDialogHandler();
@@ -200,10 +193,6 @@ export class ChromiumCdp {

  /** Attach to `tabId` if we haven't already in this driver. */
  async ensureAttached(tabId: number): Promise<void> {
-    // Returning a tab clears the cache before Chrome finishes detaching.
-    // New observers must wait before opening the next connection to that tab.
-    const detaching = this.detachInFlight.get(tabId);
-    if (detaching) await detaching;
    if (this.attachedTabs.has(tabId)) return;
    const existing = this.attachInFlight.get(tabId);
    if (existing) {
@@ -436,11 +425,6 @@ export class ChromiumCdp {

  /** Detach if attached; never throws. */
  async detach(tabId: number): Promise<void> {
-    const existing = this.detachInFlight.get(tabId);
-    if (existing) {
-      await existing;
-      return;
-    }
    this.attachInFlight.delete(tabId);
    if (!this.attachedTabs.has(tabId)) return;
    this.attachedTabs.delete(tabId);
@@ -448,19 +432,13 @@ export class ChromiumCdp {
    this.clearConsoleState(tabId);
    this.clearNetworkState(tabId);
    this.clearFrameState(tabId);
-    const detach = (async () => {
-      try {
-        await this.api.detach({ tabId });
-      } catch (err) {
-        // Tab may already be gone — Chrome auto-detaches on close. Log
-        // at debug so production builds aren't noisy.
-        console.debug("[bsk cdp] detach failed (likely tab already closed)", err);
-      }
-    })().finally(() => {
-      this.detachInFlight.delete(tabId);
-    });
-    this.detachInFlight.set(tabId, detach);
-    await detach;
+    try {
+      await this.api.detach({ tabId });
+    } catch (err) {
+      // Tab may already be gone — Chrome auto-detaches on close. Log
+      // at debug so production builds aren't noisy.
+      console.debug("[bsk cdp] detach failed (likely tab already closed)", err);
+    }
  }

  /** True iff `ensureAttached(tabId)` has succeeded since the last detach. */
@@ -475,17 +453,6 @@ export class ChromiumCdp {
    this.tabOwners.set(tabId, owners);
  }

-  /** Release one session's claim, preserving attachments still used by another. */
-  async releaseSessionTab(sessionId: string, tabId: number): Promise<void> {
-    const owners = this.tabOwners.get(tabId);
-    if (!owners?.delete(sessionId) || owners.size > 0) return;
-    this.tabOwners.delete(tabId);
-    // An observation may still be attaching when the tab is returned. Wait
-    // for it so detach cannot miss the attachment or remove a new owner's claim.
-    await this.attachInFlight.get(tabId)?.catch(() => {});
-    if (!this.tabOwners.has(tabId)) await this.detach(tabId);
-  }
-
  /** Subscribe to all CDP events. Returned disposable removes the listener. */
  onEvent(handler: (source: CdpDebuggee, method: string, params: unknown) => void): {
    dispose(): void;
@@ -672,23 +639,13 @@ export class ChromiumCdp {
  }

  private async onJavaScriptDialogOpening(tabId: number, params: unknown): Promise<void> {
-    if (!this.attachedTabs.has(tabId) && !this.attachInFlight.has(tabId)) return;
    const parsed = parseDialogOpeningParams(params);
    try {
-      if (
-        this.options.shouldAutoAcceptDialog &&
-        !(await this.options.shouldAutoAcceptDialog(tabId))
-      ) {
-        return;
-      }
-      // The tab may have been returned while its current scope was checked.
-      if (!this.attachedTabs.has(tabId) && !this.attachInFlight.has(tabId)) return;
      const handleParams: { accept: boolean; promptText?: string } = { accept: true };
      if (parsed.type === "prompt") {
        handleParams.promptText = parsed.defaultPrompt ?? "";
      }
      await this.api.sendCommand({ tabId }, "Page.handleJavaScriptDialog", handleParams);
-      if (!this.attachedTabs.has(tabId) && !this.attachInFlight.has(tabId)) return;
      const sequence = (this.dialogSequences.get(tabId) ?? 0) + 1;
      this.dialogSequences.set(tabId, sequence);
      this.appendDialog(tabId, {
@@ -878,9 +835,15 @@ export class ChromiumCdp {

  /** Detach tabs only when no other live session has claimed them. */
  async detachSession(sessionId: string): Promise<void> {
-    await Promise.all(
-      Array.from(this.tabOwners.keys(), (tabId) => this.releaseSessionTab(sessionId, tabId)),
-    );
+    const tabsToDetach: number[] = [];
+    for (const [tabId, owners] of this.tabOwners) {
+      owners.delete(sessionId);
+      if (owners.size === 0) {
+        this.tabOwners.delete(tabId);
+        tabsToDetach.push(tabId);
+      }
+    }
+    await Promise.all(tabsToDetach.map((tabId) => this.detach(tabId)));
  }
 }

@@ -23,7 +23,7 @@ describe("BorrowConfirmationOverlay", () => {
            id: "req-1",
            isActiveTab: true,
            tabTitle: "Example",
-            timeoutMs: 60_000,
+            timeoutMs: 5000,
            onAllow,
            onDeny,
          },
@@ -32,7 +32,7 @@ describe("BorrowConfirmationOverlay", () => {
    );

    expect(screen.getByText("允许借用标签页？")).toBeTruthy();
-    for (let i = 0; i < 60; i++) {
+    for (let i = 0; i < 5; i++) {
      await act(async () => {
        await vi.advanceTimersByTimeAsync(1000);
      });
@@ -66,7 +66,7 @@ describe("BorrowConfirmationOverlay", () => {
            id: "req-fallback",
            isActiveTab: true,
            tabTitle: "Example",
-            timeoutMs: 60_000,
+            timeoutMs: 5000,
            onAllow,
            onDeny,
          },
@@ -74,7 +74,7 @@ describe("BorrowConfirmationOverlay", () => {
      />,
    );

-    for (let i = 0; i < 60; i++) {
+    for (let i = 0; i < 5; i++) {
      await act(async () => {
        await vi.advanceTimersByTimeAsync(1000);
      });
@@ -45,32 +45,10 @@ function portHarness() {

 describe("RecordFrameAgent", () => {
  afterEach(() => {
-    vi.unstubAllGlobals();
    document.documentElement.removeAttribute(RECORD_DOCUMENT_ATTRIBUTE);
    document.body.replaceChildren();
  });

-  it("starts when crypto.randomUUID is unavailable", async () => {
-    const harness = portHarness();
-    const getRandomValues = vi.fn((bytes: Uint8Array) => {
-      bytes.fill(0x11);
-      return bytes;
-    });
-    vi.stubGlobal("crypto", { getRandomValues });
-    vi.stubGlobal("chrome", {
-      runtime: {
-        connect: vi.fn(() => harness.port),
-        sendMessage: vi.fn(),
-      },
-    });
-    const agent = new RecordFrameAgent();
-
-    await expect(
-      agent.start({ type: RECORD_FRAME_START, requestId: "rec-http", startedAtMs: 10 }),
-    ).resolves.toEqual({ ok: true });
-    expect(getRandomValues).toHaveBeenCalled();
-  });
-
  it("keeps a failed stop retryable and flushes the final dirty fill", async () => {
    const harness = portHarness();
    const sendMessage = vi
@@ -1,4 +1,3 @@
-import { createRandomUuid } from "@/lib/random-uuid";
 import {
  isAcceptedRecordStepAck,
  RECORD_STEP,
@@ -19,7 +18,7 @@ export class RecordStepDelivery {
  constructor(
    requestId: string,
    send: SendRecordStepMessage = (message) => chrome.runtime.sendMessage(message),
-    producerId: string = createRandomUuid(),
+    producerId: string = crypto.randomUUID(),
  ) {
    this.#requestId = requestId;
    this.#producerId = producerId;
@@ -1,4 +1,3 @@
-import { createRandomUuid } from "@/lib/random-uuid";
 import {
  markRecordingDocument,
  type RecordingDocumentMarker,
@@ -68,7 +67,7 @@ export class RecordFrameAgent {
  async #start(
    message: RecordFrameStartMessage,
  ): Promise<{ ok: true } | { ok: false; error: string }> {
-    const producerId = createRandomUuid();
+    const producerId = crypto.randomUUID();
    const root = await waitForDocumentElement();
    if (this.#disposed) return { ok: false, error: "recording document is disposed" };
    const marker = markRecordingDocument(producerId, root);
@@ -1,6 +1,7 @@
 import { i18n } from "@browser-skill/i18n";
 import { ChromiumCdp } from "@/browser-driver/chromium-cdp";
 import { ConnectionController } from "@/lib/connection-controller";
+import { DiagnosticLogger } from "@/lib/diagnostics";
 import { startHeartbeat } from "@/lib/heartbeat";
 import {
  getConnectionEnabled,
@@ -25,7 +26,7 @@ import { recordFrameCoordinator } from "@/lib/recording/frame-coordinator";
 import { attachSessionsLiveFlag } from "@/lib/sessions-live-flag";
 import { createDisconnectCleanup } from "@/session-manager/disconnect-cleanup";
 import { attachSessionEventHandler } from "@/session-manager/event-handler";
-import { isAgentControlledTab, SessionManager } from "@/session-manager/manager";
+import { SessionManager } from "@/session-manager/manager";
 import {
  attachBorrowNotificationButtonHandler,
  attachBorrowNotificationClickHandler,
@@ -41,22 +42,26 @@ import {
  attachRecordStepListener,
  type RecordRuntimeDeps,
 } from "@/tools/record";
-import { chromeTabsApi } from "@/tools/shared";
-import { chromeTabMutationApi } from "@/tools/tabs";
 import { detectBrowserMeta } from "@/transport/handshake";
 import type { Transport } from "@/transport/transport";
 import { WSTransport } from "@/transport/ws-transport";

 export default defineBackground(() => {
-  const controller = new ConnectionController();
-  const transport = new WSTransport({ url: __BSK_DAEMON_WS_URL__ });
-  const sessions = new SessionManager();
-  const cdp = new ChromiumCdp(undefined, {
-    shouldAutoAcceptDialog: async (tabId) => {
-      const tab = await chrome.tabs.get(tabId);
-      return sessions.findByWindowId(tab.windowId) !== null;
-    },
+  const diagnostics = new DiagnosticLogger();
+  diagnostics.record("extension.worker.started", {
+    diagnostic_build: "lumi-session-loss-v2",
+    extension_version: __BSK_EXT_VERSION__,
+    extension_runtime_id: chrome.runtime.id,
+    daemon_ws_url: __BSK_DAEMON_WS_URL__,
  });
+  const controller = new ConnectionController(diagnostics.sink);
+  const transport = new WSTransport({
+    url: __BSK_DAEMON_WS_URL__,
+    diagnostics: diagnostics.sink,
+  });
+  diagnostics.bindTransport((frame) => transport.send(frame));
+  const sessions = new SessionManager({ diagnostics: diagnostics.sink });
+  const cdp = new ChromiumCdp();
  const sessionsLive = attachSessionsLiveFlag({ manager: sessions });
  let overlayGeneration = 0;
  const controlModes = new Map<string, OverlayMode>();
@@ -87,24 +92,6 @@ export default defineBackground(() => {
    };
  }

-  /**
-   * Authoritative overlay state for a specific tab. Agent Window tabs are
-   * free by default; only tabs explicitly claimed through session startup,
-   * `tab_create`, or `tab_borrow` receive the control overlay.
-   */
-  function overlayStateForTab(tabId?: number, windowId?: number): OverlayAgentStateMessage {
-    if (typeof tabId === "number" && typeof windowId === "number") {
-      const ctx = sessions.findByWindowId(windowId);
-      if (ctx && isAgentControlledTab(ctx, tabId)) return overlayStateForWindow(windowId);
-    }
-    return {
-      type: OVERLAY_AGENT_STATE,
-      sessionId: null,
-      mode: "hidden",
-      generation: overlayGeneration,
-    };
-  }
-
  async function pushOverlayStateToTab(
    tabId: number,
    state: OverlayAgentStateMessage,
@@ -116,18 +103,13 @@ export default defineBackground(() => {
    }
  }

-  async function pushOverlayStateForTab(tabId: number, windowId?: number): Promise<void> {
-    const state = overlayStateForTab(tabId, windowId);
-    await pushOverlayStateToTab(tabId, state);
-  }
-
  async function pushOverlayStateForWindow(windowId: number): Promise<void> {
+    const state = overlayStateForWindow(windowId);
    const tabs = await chrome.tabs.query({ windowId });
    await Promise.all(
-      tabs.map((tab) => {
-        if (typeof tab.id !== "number") return Promise.resolve();
-        return pushOverlayStateForTab(tab.id, windowId);
-      }),
+      tabs.map((tab) =>
+        typeof tab.id === "number" ? pushOverlayStateToTab(tab.id, state) : Promise.resolve(),
+      ),
    );
  }

@@ -139,6 +121,9 @@ export default defineBackground(() => {
  }

  function onOverlaySessionStateChanged(): void {
+    diagnostics.record("background.sessions.changed", {
+      live_session_ids: sessions.list().map((ctx) => ctx.sessionId),
+    });
    void sessionsLive.syncFromManager();
    const liveSessionIds = new Set(sessions.list().map((ctx) => ctx.sessionId));
    for (const sessionId of controlModes.keys()) {
@@ -166,33 +151,17 @@ export default defineBackground(() => {
    if (typeof tab.windowId !== "number") return;
    pushOverlayStateForAgentWindow(tab.windowId);
  });
-  // Newly observed tabs are free unless the agent's own creation path has
-  // already claimed their concrete id. This listener only renders that
-  // state; it never infers or mutates ownership from event ordering.
-  chrome.tabs.onCreated.addListener((tab) => {
-    if (typeof tab.windowId !== "number" || typeof tab.id !== "number") return;
-    if (!sessions.findByWindowId(tab.windowId)) return;
-    void pushOverlayStateForTab(tab.id, tab.windowId);
-  });
-  chrome.tabs.onRemoved.addListener((tabId, removeInfo) => {
-    sessions.forgetClosedTab(tabId, { isWindowClosing: removeInfo.isWindowClosing });
-  });
  // Re-sync the storage.session flag on SW startup so a previous SW's
  // stale `true` does not keep waking us on every page load until the
  // first mutation (review M4/M5 round 3 m-R3-1).
  void sessionsLive.refresh();
  const cleanupAfterDisconnect = createDisconnectCleanup({
    manager: sessions,
-    // Same contract as the dispatcher's `tool.session_stop`: without these
-    // deps the agent-tab cleanup and the window-release path are dead code.
-    sessionStopDeps: {
-      cdp,
-      tabManagement: { tabs: chromeTabMutationApi },
-      tabsQuery: chromeTabsApi,
-    },
+    sessionStopDeps: { cdp },
    onSessionsChanged: () => {
      void sessionsLive.syncFromManager();
    },
+    diagnostics: diagnostics.sink,
  });
  const recordDeps = {
    tabsApi: chrome.tabs,
@@ -223,9 +192,6 @@ export default defineBackground(() => {
    recording: recordDeps,
    onSessionsChanged: onOverlaySessionStateChanged,
    onBrowserControlResumed,
-    onAgentTabClaimed: (tabId, windowId) => {
-      void pushOverlayStateForTab(tabId, windowId);
-    },
    approveBorrow: (ctx) =>
      requestBorrowConfirmation(ctx.tabId, {
        ...(ctx.signal !== undefined ? { signal: ctx.signal } : {}),
@@ -243,6 +209,7 @@ export default defineBackground(() => {
      title: i18n.t("helpRequest.notificationTitle", { ns: "extension" }),
      body: "",
    }),
+    diagnostics: diagnostics.sink,
  });
  dispatcher.start();
  if (typeof chrome.notifications?.onClicked?.addListener === "function") {
@@ -275,6 +242,7 @@ export default defineBackground(() => {
    transport,
    cdp,
    onSessionsChanged: onOverlaySessionStateChanged,
+    diagnostics: diagnostics.sink,
  });

  // MV3 service worker keepalive + reconnect supervisor (review M4/M5
@@ -286,6 +254,7 @@ export default defineBackground(() => {
  startKeepalive({
    transport,
    shouldConnect: () => controller.isConnectionEnabled,
+    diagnostics: diagnostics.sink,
  });

  // Application-level heartbeat (Chrome 116+): while the post-handshake
@@ -299,6 +268,19 @@ export default defineBackground(() => {
      controller.subscribe((snap) =>
        cb(snap.state === "connected" || snap.state === "version_skew"),
      ),
+    diagnostics: diagnostics.sink,
+  });
+
+  controller.subscribe((snapshot) => {
+    const ready = snapshot.state === "connected" || snapshot.state === "version_skew";
+    diagnostics.setTransportReady(ready);
+    diagnostics.record("background.controller.snapshot", {
+      state: snapshot.state,
+      connection_enabled: snapshot.connectionEnabled,
+      instance_id: snapshot.instanceId,
+      last_error: snapshot.lastError,
+      live_session_ids: sessions.list().map((ctx) => ctx.sessionId),
+    });
  });

  // Wake-driven reconnect (best effort). An MV3 service worker is killed
@@ -307,7 +289,12 @@ export default defineBackground(() => {
  // the worker and let us reconnect immediately instead of waiting for
  // the next 30s alarm tick. They only help when the daemon is actually
  // running; a cold daemon is (re)spawned by the next `bsk` command.
-  const reconnectIfNeeded = () => {
+  const reconnectIfNeeded = (source: string) => {
+    diagnostics.record("background.wake_reconnect.requested", {
+      source,
+      controller_enabled: controller.isConnectionEnabled,
+      transport_state: transport.state,
+    });
    if (!controller.isConnectionEnabled) return;
    if (transport.state === "connected") return;
    void transport.connect().catch((err) => {
@@ -315,13 +302,14 @@ export default defineBackground(() => {
    });
  };
  if (typeof chrome.runtime?.onStartup?.addListener === "function") {
-    chrome.runtime.onStartup.addListener(reconnectIfNeeded);
+    chrome.runtime.onStartup.addListener(() => reconnectIfNeeded("runtime.onStartup"));
  }
  if (typeof chrome.idle?.onStateChanged?.addListener === "function") {
    chrome.idle.onStateChanged.addListener((state) => {
+      diagnostics.record("chrome.idle.state_changed", { state });
      // "active" fires when the user returns from idle/locked — the most
      // reliable "machine just woke" signal we get.
-      if (state === "active") reconnectIfNeeded();
+      if (state === "active") reconnectIfNeeded("idle.active");
    });
    // Treat >60s of no input as idle so the active transition is timely.
    chrome.idle.setDetectionInterval?.(60);
@@ -329,14 +317,21 @@ export default defineBackground(() => {

  void (async () => {
    const connectionEnabled = await getConnectionEnabled();
+    diagnostics.record("background.controller.attach_started", { connectionEnabled });
    await controller.attach(transport, detectBrowserMeta(), connectionEnabled, {
      beforeDisconnect: async () => {
+        diagnostics.record("background.before_disconnect_cleanup", {
+          live_session_ids: sessions.list().map((ctx) => ctx.sessionId),
+        });
        const report = await cleanupAfterDisconnect();
        if (report.failures.length > 0) {
          console.warn("[browser-skill] session cleanup before disconnect was incomplete", report);
        }
      },
      onDisconnected: async () => {
+        diagnostics.record("background.after_disconnect_cleanup", {
+          live_session_ids: sessions.list().map((ctx) => ctx.sessionId),
+        });
        const report = await cleanupAfterDisconnect();
        if (report.failures.length > 0) {
          console.warn("[browser-skill] session cleanup after disconnect was incomplete", report);
@@ -344,6 +339,7 @@ export default defineBackground(() => {
      },
    });
  })().catch((err) => {
+    diagnostics.record("background.controller.attach_failed", { error: err });
    console.error("[browser-skill] controller failed to attach", err);
  });

@@ -359,11 +355,7 @@ export default defineBackground(() => {
    }

    if (msg.kind === OVERLAY_MSG_READY) {
-      // Resolve from explicit tab ownership before sending so free tabs never
-      // flash the control mask.
-      if (typeof sender.tab?.id === "number") {
-        void pushOverlayStateForTab(sender.tab.id, sender.tab.windowId);
-      }
+      sendResponse(overlayStateForWindow(sender.tab?.windowId));
      return false;
    }

@@ -428,6 +420,15 @@ export default defineBackground(() => {
    dbg.__bhDispatcher = dispatcher;
  }

+  if (typeof chrome.runtime?.onSuspend?.addListener === "function") {
+    chrome.runtime.onSuspend.addListener(() => {
+      diagnostics.record("extension.worker.suspending", {
+        live_session_ids: sessions.list().map((ctx) => ctx.sessionId),
+        transport_state: transport.state,
+      });
+    });
+  }
+
  console.info("[browser-skill] background worker initialised");
 });

@@ -122,8 +122,8 @@ describe("App", () => {

    expect(screen.queryByText(/^扩展 v/)).toBeNull();
    expect(screen.queryByText(/^daemon v/)).toBeNull();
-    expect(screen.getByTitle("扩展版本").textContent).toBe(`Ext ${EXTENSION_VERSION}`);
-    expect(screen.getByTitle("bsk 版本").textContent).toBe(`CLI ${mockDaemonVersion}`);
+    expect(screen.getByTitle("扩展版本").textContent).toBe(EXTENSION_VERSION);
+    expect(screen.getByTitle("bsk 版本").textContent).toBe(mockDaemonVersion);
    expect(screen.getByText("03c3e47f")).toBeTruthy();

    const copyButton = screen.getByRole("button", { name: "复制实例 ID" });
@@ -267,9 +267,9 @@ export function App() {
            data-slot="popup-meta"
          >
            <div className="flex shrink-0 items-center gap-1">
-              <span title={t("popup.daemonVersionHint")}>CLI {daemonVersion}</span>
+              <span title={t("popup.extensionVersionHint")}>{extensionVersion}</span>
              <span aria-hidden>/</span>
-              <span title={t("popup.extensionVersionHint")}>Ext {extensionVersion}</span>
+              <span title={t("popup.daemonVersionHint")}>{daemonVersion}</span>
            </div>
            <div className="flex min-w-0 items-center justify-end gap-1">
              <span className="shrink-0">{t("popup.instanceTitle")}</span>
@@ -2,7 +2,7 @@ import { describe, expect, it, vi } from "vitest";
 import {
  CAPTURE_SUPPRESS,
  type CaptureSuppressMessage,
-  withExtensionOverlayHidden,
+  withOverlaysHiddenForCapture,
 } from "../capture-suppress-bridge";

 function recordingSendToTab(events: string[]) {
@@ -12,12 +12,12 @@ function recordingSendToTab(events: string[]) {
  });
 }

-describe("withExtensionOverlayHidden", () => {
+describe("withOverlaysHiddenForCapture", () => {
  it("sends begin → fn → end and returns fn's result", async () => {
    const events: string[] = [];
    const sendToTab = recordingSendToTab(events);

-    const result = await withExtensionOverlayHidden(
+    const result = await withOverlaysHiddenForCapture(
      7,
      async () => {
        events.push("capture");
@@ -37,7 +37,7 @@ describe("withExtensionOverlayHidden", () => {
    const sendToTab = recordingSendToTab(events);

    await expect(
-      withExtensionOverlayHidden(
+      withOverlaysHiddenForCapture(
        7,
        async () => {
          events.push("capture");
@@ -55,7 +55,7 @@ describe("withExtensionOverlayHidden", () => {
    });
    const fn = vi.fn(async () => "shot");

-    const result = await withExtensionOverlayHidden(7, fn, sendToTab);
+    const result = await withOverlaysHiddenForCapture(7, fn, sendToTab);

    expect(result).toBe("shot");
    expect(fn).toHaveBeenCalledTimes(1);
@@ -69,7 +69,7 @@ describe("withExtensionOverlayHidden", () => {
      return { type: CAPTURE_SUPPRESS, ok: true };
    });

-    const result = await withExtensionOverlayHidden(7, async () => "shot", sendToTab);
+    const result = await withOverlaysHiddenForCapture(7, async () => "shot", sendToTab);

    expect(result).toBe("shot");
    expect(sendToTab).toHaveBeenCalledTimes(2);
@@ -0,0 +1,85 @@
+import { describe, expect, it, vi } from "vitest";
+import { DiagnosticLogger } from "../diagnostics";
+
+class MemoryStorage {
+  value: Record<string, unknown> = {};
+
+  async get(key: string): Promise<Record<string, unknown>> {
+    return { [key]: this.value[key] };
+  }
+
+  async set(items: Record<string, unknown>): Promise<void> {
+    this.value = { ...this.value, ...items };
+  }
+}
+
+describe("DiagnosticLogger", () => {
+  it("persists evidence before transport readiness and flushes it after reconnect", async () => {
+    const storage = new MemoryStorage();
+    const send = vi.fn();
+    const logger = new DiagnosticLogger(storage);
+    logger.bindTransport(send);
+
+    logger.record("transport.socket.closed", { code: 1006 });
+    await logger.flush();
+    expect(send).not.toHaveBeenCalled();
+
+    logger.setTransportReady(true);
+    await logger.flush();
+
+    expect(send).toHaveBeenCalledOnce();
+    expect(send.mock.calls[0]?.[0]).toMatchObject({
+      event: "browser.diagnostic",
+      payload: {
+        schema_version: 1,
+        entries: [
+          {
+            event: "transport.socket.closed",
+            fields: { code: 1006 },
+          },
+        ],
+      },
+    });
+    expect(storage.value.bsk_diagnostic_events_v1).toEqual([]);
+  });
+
+  it("keeps persisted evidence when the transport rejects the flush", async () => {
+    const storage = new MemoryStorage();
+    const logger = new DiagnosticLogger(storage);
+    logger.bindTransport(() => {
+      throw new Error("socket closed");
+    });
+    logger.record("session.stop.requested", { session_id: "abcd" });
+
+    logger.setTransportReady(true);
+    await logger.flush();
+
+    expect(storage.value.bsk_diagnostic_events_v1).toMatchObject([
+      { event: "session.stop.requested", fields: { session_id: "abcd" } },
+    ]);
+  });
+
+  it("does not resend an acknowledged event when send records a new event", async () => {
+    const storage = new MemoryStorage();
+    const batches: Array<{ payload?: { entries?: Array<{ event: string }> } }> = [];
+    const logger = new DiagnosticLogger(storage);
+    logger.record("dispatcher.rpc.received", { rpc_id: "one" });
+    await logger.flush();
+    logger.bindTransport((frame) => {
+      batches.push(frame as { payload?: { entries?: Array<{ event: string }> } });
+      if (batches.length === 1) {
+        logger.record("dispatcher.rpc.response_sent", { rpc_id: "one" });
+      }
+    });
+
+    logger.setTransportReady(true);
+    await logger.flush();
+    await logger.flush();
+
+    expect(batches.map((batch) => batch.payload?.entries?.map((entry) => entry.event))).toEqual([
+      ["dispatcher.rpc.received"],
+      ["dispatcher.rpc.response_sent"],
+    ]);
+    expect(storage.value.bsk_diagnostic_events_v1).toEqual([]);
+  });
+});
@@ -1,30 +0,0 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { createRandomUuid } from "../random-uuid";
-
-describe("createRandomUuid", () => {
-  afterEach(() => {
-    vi.unstubAllGlobals();
-  });
-
-  it("uses crypto.randomUUID when it is available", () => {
-    const randomUUID = vi.fn(() => "00000000-0000-4000-8000-000000000000");
-    vi.stubGlobal("crypto", { randomUUID, getRandomValues: vi.fn() });
-
-    expect(createRandomUuid()).toBe("00000000-0000-4000-8000-000000000000");
-    expect(randomUUID).toHaveBeenCalledOnce();
-  });
-
-  it("falls back to getRandomValues and sets UUID v4 bits", () => {
-    const bytes = new Uint8Array(16).fill(0xff);
-    const getRandomValues = vi.fn((target: Uint8Array) => {
-      target.set(bytes);
-      return target;
-    });
-    vi.stubGlobal("crypto", { getRandomValues });
-
-    const uuid = createRandomUuid();
-
-    expect(uuid).toBe("ffffffff-ffff-4fff-bfff-ffffffffffff");
-    expect(getRandomValues).toHaveBeenCalledOnce();
-  });
-});
@@ -1,9 +1,9 @@
 /**
- * Wire protocol and background-side helper for temporarily excluding the
- * extension's in-page overlay. Screenshots use it to avoid captured chrome;
- * coordinate-driven native input uses it so Chrome hit-tests the page.
+ * Wire protocol and background-side helper for hiding the extension's
+ * in-page overlay while a screenshot is captured, so captured frames only
+ * contain the page itself.
 *
- * The background wraps each bounded operation in `withExtensionOverlayHidden`,
+ * The background wraps every capture in `withOverlaysHiddenForCapture`,
 * which sends `begin` (the content script hides the overlay host and only
 * acks once the compositor has produced an overlay-free frame) and always
 * follows up with `end`, even when the capture throws. Tabs without the
@@ -46,7 +46,7 @@ const defaultSendToTab: CaptureSuppressSendToTab = (tabId, message) =>
 * (or any other `begin` failure) simply skips suppression — there is no
 * overlay to hide in that tab.
 */
-export async function withExtensionOverlayHidden<T>(
+export async function withOverlaysHiddenForCapture<T>(
  tabId: number,
  fn: () => Promise<T>,
  sendToTab: CaptureSuppressSendToTab = defaultSendToTab,
@@ -6,6 +6,7 @@ import {
 } from "../transport/handshake";
 import type { Transport } from "../transport/transport";
 import type { ConnectionState, HandshakeResult } from "../transport/types";
+import type { DiagnosticSink } from "./diagnostics";
 import { getLabel, getOrCreateInstanceId } from "./instance-id";
 import { compareProtocol, parseProtocolMajor } from "./semver";

@@ -51,6 +52,11 @@ export class ConnectionController {
  private handshakeAbort: AbortController | null = null;
  private handshakeRetryTimer: ReturnType<typeof setTimeout> | null = null;
  private suppressDisconnectRecovery = false;
+  private readonly diagnostics?: DiagnosticSink;
+
+  constructor(diagnostics?: DiagnosticSink) {
+    this.diagnostics = diagnostics;
+  }

  get isConnectionEnabled(): boolean {
    return this.connectionEnabled;
@@ -89,8 +95,20 @@ export class ConnectionController {
    this.lifecycleHooks = lifecycleHooks;
    this.instanceId = await getOrCreateInstanceId();
    this.label = await getLabel();
+    this.diagnostics?.("controller.attach", {
+      instance_id: this.instanceId,
+      connection_enabled: connectionEnabled,
+      transport_state: transport.state,
+    });

    transport.onConnectionStateChange((s) => {
+      this.diagnostics?.("controller.transport_state", {
+        transport_state: s,
+        controller_state: this.currentState,
+        connection_generation: this.connectionGeneration,
+        suppress_disconnect_recovery: this.suppressDisconnectRecovery,
+        recovery_inflight: this.disconnectRecovery !== null,
+      });
      if (s === "disconnected") {
        // An in-flight handshake belongs to the dead connection — cancel it so
        // a late resolution can never clobber the next attempt.
@@ -103,6 +121,9 @@ export class ConnectionController {
            // handshake bounce); the caller owns the reconnect policy there.
            this.suppressDisconnectRecovery = false;
          } else {
+            this.diagnostics?.("controller.disconnect_recovery.requested", {
+              connection_generation: this.connectionGeneration,
+            });
            void this.recoverFromDisconnect();
          }
        }
@@ -161,6 +182,12 @@ export class ConnectionController {
    const generation = ++this.connectionGeneration;
    const abort = new AbortController();
    this.handshakeAbort = abort;
+    this.diagnostics?.("controller.handshake.started", {
+      connection_generation: generation,
+      browser_name: browser.name,
+      browser_version: browser.version,
+      instance_id: this.instanceId,
+    });
    void this.runHandshake(browser, generation, abort.signal);
  }

@@ -197,11 +224,21 @@ export class ConnectionController {
      }
      this.clearHandshakeRetry();
      this.lastError = null;
+      this.diagnostics?.("controller.handshake.completed", {
+        connection_generation: generation,
+        verdict: verdict.kind,
+        daemon_version: outcome.result.version,
+        daemon_protocol: outcome.result.protocol_version,
+      });
      this.setState(verdict.kind);
    } catch (err) {
      if (generation !== this.connectionGeneration || signal.aborted || isAbortError(err)) return;
      this.handshake = null;
      this.lastError = err instanceof Error ? err.message : String(err);
+      this.diagnostics?.("controller.handshake.failed", {
+        connection_generation: generation,
+        error: err,
+      });
      // Bounce the half-open socket deliberately; the retry timer below owns
      // the reconnect, so skip unexpected-loss recovery for this disconnect.
      this.suppressDisconnectRecovery = true;
@@ -228,23 +265,57 @@ export class ConnectionController {
  }

  private recoverFromDisconnect(): Promise<void> {
-    if (this.disconnectRecovery) return this.disconnectRecovery;
+    if (this.disconnectRecovery) {
+      this.diagnostics?.("controller.disconnect_recovery.coalesced", {
+        connection_generation: this.connectionGeneration,
+      });
+      return this.disconnectRecovery;
+    }
    const recovery = (async () => {
+      const recoveryGeneration = this.connectionGeneration;
+      this.diagnostics?.("controller.disconnect_recovery.started", {
+        recovery_generation: recoveryGeneration,
+      });
      // WSTransport schedules its reconnect timer immediately after notifying
      // state listeners. Yield once, then disconnect explicitly so that timer
      // is cancelled before local session teardown begins.
      await Promise.resolve();
-      if (!this.connectionEnabled || !this.transport) return;
+      if (!this.connectionEnabled || !this.transport) {
+        this.diagnostics?.("controller.disconnect_recovery.skipped", {
+          recovery_generation: recoveryGeneration,
+          reason: "disabled_or_missing_transport",
+        });
+        return;
+      }
      // Another path already reconnected while we yielded — nothing to do.
-      if (this.currentState !== "disconnected") return;
+      if (this.currentState !== "disconnected") {
+        this.diagnostics?.("controller.disconnect_recovery.skipped", {
+          recovery_generation: recoveryGeneration,
+          reason: "state_already_changed",
+          current_state: this.currentState,
+        });
+        return;
+      }
      await this.transport.disconnect().catch(() => {});
      try {
+        this.diagnostics?.("controller.disconnect_cleanup.started", {
+          recovery_generation: recoveryGeneration,
+          current_generation: this.connectionGeneration,
+        });
        await this.lifecycleHooks.onDisconnected?.();
+        this.diagnostics?.("controller.disconnect_cleanup.completed", {
+          recovery_generation: recoveryGeneration,
+          current_generation: this.connectionGeneration,
+        });
      } catch (err) {
        console.warn("[browser-skill] session cleanup after disconnect failed", err);
      }
      if (!this.connectionEnabled) return;
      try {
+        this.diagnostics?.("controller.disconnect_reconnect.started", {
+          recovery_generation: recoveryGeneration,
+          current_generation: this.connectionGeneration,
+        });
        await this.transport.connect();
      } catch (err) {
        this.lastError = err instanceof Error ? err.message : String(err);
@@ -252,22 +323,39 @@ export class ConnectionController {
      }
    })();
    this.disconnectRecovery = recovery.finally(() => {
+      this.diagnostics?.("controller.disconnect_recovery.completed", {
+        connection_generation: this.connectionGeneration,
+        current_state: this.currentState,
+      });
      this.disconnectRecovery = null;
    });
    return this.disconnectRecovery;
  }

  private cancelHandshake(): void {
+    const previousGeneration = this.connectionGeneration;
    this.connectionGeneration += 1;
+    this.diagnostics?.("controller.handshake.cancelled", {
+      previous_generation: previousGeneration,
+      next_generation: this.connectionGeneration,
+      had_abort_controller: this.handshakeAbort !== null,
+    });
    this.handshakeAbort?.abort();
    this.handshakeAbort = null;
  }

  private scheduleHandshakeRetry(browser: { name: string; version: string }): void {
    if (this.handshakeRetryTimer || !this.connectionEnabled) return;
+    this.diagnostics?.("controller.handshake_retry.scheduled", {
+      delay_ms: HANDSHAKE_RETRY_DELAY_MS,
+      connection_generation: this.connectionGeneration,
+    });
    this.handshakeRetryTimer = setTimeout(() => {
      this.handshakeRetryTimer = null;
      if (!this.connectionEnabled || !this.transport) return;
+      this.diagnostics?.("controller.handshake_retry.timer_fired", {
+        connection_generation: this.connectionGeneration,
+      });
      void this.transport.connect().catch((err) => {
        this.lastError = err instanceof Error ? err.message : String(err);
        this.setState("disconnected");
@@ -0,0 +1,178 @@
+import type { ProtocolFrame } from "@/transport/types";
+
+const STORAGE_KEY = "bsk_diagnostic_events_v1";
+const MAX_ENTRIES = 500;
+
+export type DiagnosticFields = Record<string, unknown>;
+export type DiagnosticSink = (event: string, fields?: DiagnosticFields) => void;
+
+export interface DiagnosticEntry {
+  id: string;
+  sequence: number;
+  timestamp: string;
+  monotonic_ms: number;
+  worker_boot_id: string;
+  event: string;
+  fields: DiagnosticFields;
+}
+
+interface DiagnosticStorage {
+  get(key: string): Promise<Record<string, unknown>>;
+  set(items: Record<string, unknown>): Promise<void>;
+}
+
+function defaultStorage(): DiagnosticStorage | null {
+  if (typeof chrome === "undefined" || !chrome.storage?.local) return null;
+  return {
+    get: (key) => chrome.storage.local.get(key),
+    set: (items) => chrome.storage.local.set(items),
+  };
+}
+
+function makeBootId(): string {
+  try {
+    return crypto.randomUUID();
+  } catch {
+    return `worker-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+  }
+}
+
+function normalise(value: unknown): unknown {
+  if (value instanceof Error) {
+    return { name: value.name, message: value.message, stack: value.stack };
+  }
+  if (typeof value === "bigint") return value.toString();
+  if (Array.isArray(value)) return value.map(normalise);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value as Record<string, unknown>).map(([key, child]) => [
+        key,
+        normalise(child),
+      ]),
+    );
+  }
+  return value;
+}
+
+/**
+ * Persistent diagnostics for the MV3 background worker.
+ *
+ * Events are first written to chrome.storage.local so a worker termination or
+ * dead WebSocket does not erase the evidence. Once the post-handshake link is
+ * ready, pending entries are forwarded to the daemon as one
+ * `browser.diagnostic` event and removed from the local queue.
+ */
+export class DiagnosticLogger {
+  readonly workerBootId: string;
+  readonly sink: DiagnosticSink;
+
+  private sequence = 0;
+  private storageQueue: Promise<void> = Promise.resolve();
+  private flushPromise: Promise<void> | null = null;
+  private flushRequested = false;
+  private send: ((frame: ProtocolFrame) => void) | null = null;
+  private transportReady = false;
+  private readonly storage: DiagnosticStorage | null;
+
+  constructor(storage: DiagnosticStorage | null = defaultStorage()) {
+    this.workerBootId = makeBootId();
+    this.storage = storage;
+    this.sink = (event, fields = {}) => this.record(event, fields);
+  }
+
+  bindTransport(send: (frame: ProtocolFrame) => void): void {
+    this.send = send;
+  }
+
+  setTransportReady(ready: boolean): void {
+    this.transportReady = ready;
+    if (ready) void this.flush();
+  }
+
+  record(event: string, fields: DiagnosticFields = {}): void {
+    const sequence = ++this.sequence;
+    const entry: DiagnosticEntry = {
+      id: `${this.workerBootId}:${sequence}`,
+      sequence,
+      timestamp: new Date().toISOString(),
+      monotonic_ms: Math.round(performance.now()),
+      worker_boot_id: this.workerBootId,
+      event,
+      fields: normalise(fields) as DiagnosticFields,
+    };
+    console.info("[bsk diagnostic]", entry);
+    this.storageQueue = this.storageQueue
+      .then(async () => {
+        if (!this.storage) return;
+        const stored = await this.storage.get(STORAGE_KEY);
+        const previous = Array.isArray(stored[STORAGE_KEY])
+          ? (stored[STORAGE_KEY] as DiagnosticEntry[])
+          : [];
+        await this.storage.set({
+          [STORAGE_KEY]: [...previous, entry].slice(-MAX_ENTRIES),
+        });
+      })
+      .catch((error) => {
+        console.warn("[bsk diagnostic] failed to persist event", error);
+      });
+    if (this.transportReady) void this.flush();
+  }
+
+  flush(): Promise<void> {
+    if (this.flushPromise) {
+      this.flushRequested = true;
+      return this.flushPromise;
+    }
+    const running = (async () => {
+      await this.storageQueue;
+      if (!this.transportReady || !this.send || !this.storage) return;
+      const stored = await this.storage.get(STORAGE_KEY);
+      const entries = Array.isArray(stored[STORAGE_KEY])
+        ? (stored[STORAGE_KEY] as DiagnosticEntry[])
+        : [];
+      if (entries.length === 0) return;
+      try {
+        this.send({
+          event: "browser.diagnostic",
+          payload: {
+            schema_version: 1,
+            worker_boot_id: this.workerBootId,
+            entries,
+          },
+        });
+      } catch (error) {
+        console.warn("[bsk diagnostic] daemon flush failed", error);
+        return;
+      }
+      const sentIds = new Set(entries.map((entry) => entry.id));
+      // Serialize acknowledgement behind every record write that may have
+      // started while send() was in progress. Without this, a concurrent
+      // record can read the pre-ack queue and write an already-sent entry
+      // back into storage, causing the next batch to duplicate it.
+      this.storageQueue = this.storageQueue
+        .then(async () => {
+          const current = await this.storage?.get(STORAGE_KEY);
+          const currentEntries = Array.isArray(current?.[STORAGE_KEY])
+            ? (current[STORAGE_KEY] as DiagnosticEntry[])
+            : [];
+          await this.storage?.set({
+            [STORAGE_KEY]: currentEntries.filter((entry) => !sentIds.has(entry.id)),
+          });
+        })
+        .catch((error) => {
+          console.warn("[bsk diagnostic] failed to acknowledge event batch", error);
+        });
+      await this.storageQueue;
+    })().catch((error) => {
+      console.warn("[bsk diagnostic] flush failed", error);
+    });
+    this.flushPromise = running.finally(() => {
+      this.flushPromise = null;
+      if (this.flushRequested && this.transportReady) {
+        this.flushRequested = false;
+        void this.flush();
+      }
+    });
+    return this.flushPromise;
+  }
+}
@@ -21,6 +21,7 @@
 * after the handshake has landed.
 */

+import type { DiagnosticSink } from "@/lib/diagnostics";
 import type { ProtocolFrame } from "@/transport/types";

 export const HEARTBEAT_EVENT = "system.heartbeat";
@@ -46,6 +47,7 @@ export interface HeartbeatOptions {
  intervalMs?: number;
  /** Inject fake timers (tests). */
  timers?: HeartbeatTimers;
+  diagnostics?: DiagnosticSink;
 }

 export interface HeartbeatHandle {
@@ -74,7 +76,9 @@ export function startHeartbeat(options: HeartbeatOptions): HeartbeatHandle {
  const beat = () => {
    try {
      options.send({ event: HEARTBEAT_EVENT, payload: {} });
+      options.diagnostics?.("heartbeat.sent");
    } catch (err) {
+      options.diagnostics?.("heartbeat.send_failed", { error: err });
      // The socket raced a close between the state change and this
      // tick. The transport's own reconnect path recovers; swallow so
      // the interval keeps running (it is cleared on the disconnect
@@ -87,12 +91,14 @@ export function startHeartbeat(options: HeartbeatOptions): HeartbeatHandle {
    if (timer !== null) {
      timers.clearInterval(timer);
      timer = null;
+      options.diagnostics?.("heartbeat.timer.stopped");
    }
  };

  const start = () => {
    if (timer !== null) return;
    timer = timers.setInterval(beat, intervalMs);
+    options.diagnostics?.("heartbeat.timer.started", { interval_ms: intervalMs });
  };

  const unsubscribe = options.onActiveChange((active) => {
@@ -20,6 +20,7 @@
 * SW idle threshold.
 */

+import type { DiagnosticSink } from "@/lib/diagnostics";
 import type { Transport } from "@/transport/transport";

 export const KEEPALIVE_ALARM_NAME = "bh-keepalive";
@@ -59,6 +60,7 @@ export interface KeepaliveOptions {
  alarmName?: string;
  /** Override the alarm period (tests). */
  periodMin?: number;
+  diagnostics?: DiagnosticSink;
 }

 export interface KeepaliveHandle {
@@ -79,11 +81,24 @@ export function startKeepalive(options: KeepaliveOptions): KeepaliveHandle {
  const period = options.periodMin ?? KEEPALIVE_PERIOD_MIN;

  const tick = async () => {
-    if (options.shouldConnect && !options.shouldConnect()) return;
-    if (options.transport.state === "connected") return;
+    if (options.shouldConnect && !options.shouldConnect()) {
+      options.diagnostics?.("keepalive.tick.skipped", { reason: "connection_disabled" });
+      return;
+    }
+    if (options.transport.state === "connected") {
+      options.diagnostics?.("keepalive.tick.healthy", { transport_state: "connected" });
+      return;
+    }
+    options.diagnostics?.("keepalive.reconnect.started", {
+      transport_state: options.transport.state,
+    });
    try {
      await options.transport.connect();
+      options.diagnostics?.("keepalive.reconnect.completed", {
+        transport_state: options.transport.state,
+      });
    } catch (err) {
+      options.diagnostics?.("keepalive.reconnect.failed", { error: err });
      console.debug("[bsk keepalive] connect attempt failed", err);
    }
  };
@@ -3,10 +3,8 @@
 * between the content-script control overlay and the background SW.
 *
 * Content script → background:
- *  - `{ kind: "overlay.ready" }` → background decides the per-tab state first
- *      (see overlayStateForTab) and pushes the authoritative overlay state for
- *      that tab. It also proactively pushes on tab create and control-mode
- *      change, so a tab usually receives state before it ever sends ready.
+ *  - `{ kind: "overlay.ready" }` → background replies with the authoritative
+ *      overlay state for the sender's window.
 *  - `{ kind: "overlay.interrupt", sessionId }` → background asks the
 *      daemon (via a `session.user_interrupt` WS event) to cancel
 *      every inflight + queued tool call for that session with
@@ -1,26 +0,0 @@
-/**
- * Generate a UUID v4 in browser contexts where randomUUID() is unavailable.
- *
- * Crypto.randomUUID() is restricted to secure contexts, while
- * crypto.getRandomValues() is available to content scripts on ordinary HTTP
- * origins. BrowserSkill records many intranet pages served over HTTP, so the
- * fallback is required for recording to work on those pages.
- */
-export function createRandomUuid(): string {
-  const cryptoApi = globalThis.crypto;
-  if (typeof cryptoApi.randomUUID === "function") return cryptoApi.randomUUID();
-
-  const bytes = new Uint8Array(16);
-  cryptoApi.getRandomValues(bytes);
-  bytes[6] = (bytes[6]! & 0x0f) | 0x40;
-  bytes[8] = (bytes[8]! & 0x3f) | 0x80;
-
-  const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
-  return [
-    hex.slice(0, 8),
-    hex.slice(8, 12),
-    hex.slice(12, 16),
-    hex.slice(16, 20),
-    hex.slice(20),
-  ].join("-");
-}
@@ -1,4 +1,3 @@
-import { createRandomUuid } from "../random-uuid";
 import {
  isRecordFrameQueryMessage,
  RECORD_FRAME_PORT,
@@ -189,7 +188,7 @@ export class RecordFrameCoordinator {
    const recording = this.#recordings.get(requestId);
    if (!recording) return true;
    recording.finishing = true;
-    const commandId = createRandomUuid();
+    const commandId = crypto.randomUUID();
    const results = await Promise.all(
      [...recording.agents.values()].map((agent) => this.#stopAgent(agent, requestId, commandId)),
    );
@@ -9,7 +9,7 @@ describe("disconnect session cleanup", () => {
    const manager = new SessionManager({
      agentWindow: {
        create: vi.fn(async () => nextWindowId++),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
        remove,
      },
    });
@@ -41,7 +41,7 @@ describe("disconnect session cleanup", () => {
    const manager = new SessionManager({
      agentWindow: {
        create: vi.fn(async () => 100),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
        remove: vi.fn(() => removeGate),
      },
    });
@@ -39,7 +39,7 @@ describe("attachSessionEventHandler", () => {
      agentWindow: {
        create: vi.fn(async () => 4242),
        remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    await manager.start("aa11");
@@ -73,7 +73,7 @@ describe("attachSessionEventHandler", () => {
      agentWindow: {
        create: vi.fn(async () => 4242),
        remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    const ctx = await manager.start("aa11");
@@ -87,7 +87,6 @@ describe("attachSessionEventHandler", () => {
      windowEvents: events.api,
    });

-    manager.forgetClosedTab(7, { isWindowClosing: true });
    events.emit(4242);
    for (let i = 0; i < 4; i += 1) await Promise.resolve();

@@ -114,7 +113,7 @@ describe("attachSessionEventHandler", () => {
      agentWindow: {
        create: vi.fn(async () => 1),
        remove: vi.fn(),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    const transport = fakeTransport();
@@ -130,7 +129,7 @@ describe("attachSessionEventHandler", () => {
      agentWindow: {
        create: vi.fn(async () => 1),
        remove: vi.fn(),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    const transport = fakeTransport();
@@ -1,6 +1,6 @@
 import { describe, expect, it, vi } from "vitest";
 import type { AgentWindowApi, AgentWindowCreateOptions } from "../agent-window";
-import { isAgentControlledTab, SessionManager } from "../manager";
+import { SessionManager } from "../manager";

 function fakeAgentWindow(): AgentWindowApi & {
  createMock: ReturnType<typeof vi.fn>;
@@ -13,7 +13,7 @@ function fakeAgentWindow(): AgentWindowApi & {
    return id;
  });
  const removeMock = vi.fn(async (_id: number) => {});
-  const ensureActiveTabMock = vi.fn(async (_windowId: number, _url: string) => 0);
+  const ensureActiveTabMock = vi.fn(async (_windowId: number, _url: string) => {});
  return {
    create: createMock,
    remove: removeMock,
@@ -151,76 +151,6 @@ describe("SessionManager", () => {
    expect(sm.list()).toEqual([]);
  });

-  describe("explicit tab claims", () => {
-    it("claims the exact home tab returned by AgentWindowApi", async () => {
-      const sm = new SessionManager({ agentWindow: fakeAgentWindow() });
-      const ctx = await sm.start("aa11");
-      expect(ctx.agentCreatedTabs).toEqual(new Set([0]));
-      expect(isAgentControlledTab(ctx, 0)).toBe(true);
-    });
-
-    it("keeps every other tab free without classification state", async () => {
-      const sm = new SessionManager({ agentWindow: fakeAgentWindow() });
-      const ctx = await sm.start("aa11");
-      expect(isAgentControlledTab(ctx, 99)).toBe(false);
-      expect(ctx).not.toHaveProperty("userTabs");
-      expect(ctx).not.toHaveProperty("pendingAgentTabCount");
-    });
-
-    it("treats a committed borrow as an explicit claim", async () => {
-      const sm = new SessionManager({ agentWindow: fakeAgentWindow() });
-      const ctx = await sm.start("aa11");
-      const reservation = sm.tryReserveBorrow(42, ctx.sessionId);
-      if ("borrowedBy" in reservation) throw new Error("unexpected borrow conflict");
-      reservation.commit({ tabId: 42, originalWindowId: 7, originalIndex: 3 });
-      expect(isAgentControlledTab(ctx, 42)).toBe(true);
-    });
-
-    it("forgets an agent-created tab after Chrome removes it", async () => {
-      const sm = new SessionManager({ agentWindow: fakeAgentWindow() });
-      const ctx = await sm.start("aa11");
-      ctx.agentCreatedTabs.add(42);
-      sm.forgetClosedTab(42);
-      expect(ctx.agentCreatedTabs.has(42)).toBe(false);
-      expect(isAgentControlledTab(ctx, 0)).toBe(true);
-    });
-
-    it("forgets closed borrows idempotently without affecting other tabs or sessions", async () => {
-      const sm = new SessionManager({ agentWindow: fakeAgentWindow() });
-      const a = await sm.start("aa11");
-      const b = await sm.start("bb22");
-      a.borrowedTabs.set(42, { tabId: 42, originalWindowId: 7, originalIndex: 0 });
-      a.borrowedTabs.set(43, { tabId: 43, originalWindowId: 7, originalIndex: 1 });
-      b.borrowedTabs.set(44, { tabId: 44, originalWindowId: 8, originalIndex: 0 });
-
-      sm.forgetClosedTab(42);
-      sm.forgetClosedTab(42);
-      sm.forgetClosedTab(999);
-
-      expect(isAgentControlledTab(a, 42)).toBe(false);
-      expect(sm.findBorrowingSession(42, null)).toBeNull();
-      expect([...a.borrowedTabs.keys()]).toEqual([43]);
-      expect([...b.borrowedTabs.keys()]).toEqual([44]);
-      expect(sm.list()).toHaveLength(2);
-    });
-
-    it("prevents an in-flight borrow from reclaiming a closed tab", async () => {
-      const sm = new SessionManager({ agentWindow: fakeAgentWindow() });
-      const ctx = await sm.start("aa11");
-      const reservation = sm.tryReserveBorrow(42, ctx.sessionId);
-      if ("borrowedBy" in reservation) throw new Error("unexpected borrow conflict");
-
-      sm.forgetClosedTab(42);
-
-      expect(() =>
-        reservation.commit({ tabId: 42, originalWindowId: 7, originalIndex: 0 }),
-      ).toThrow(/reservation disappeared/);
-      reservation.release();
-      expect(sm.findBorrowingSession(42, null)).toBeNull();
-      expect(ctx.borrowedTabs.has(42)).toBe(false);
-    });
-  });
-
  describe("findBorrowingSession", () => {
    it("returns null when no session has borrowed the tab", async () => {
      const sm = new SessionManager({ agentWindow: fakeAgentWindow() });
@@ -14,11 +14,8 @@ export interface AgentWindowApi {
   * Guarantee the Agent Window has an active, CDP-navigable tab.
   * `chrome://` pages (including the New Tab page) reject `Page.navigate`,
   * so sessions bootstrap with `about:blank` instead.
-   *
-   * Resolves with the id of the activated (or newly created) tab, so callers
-   * can track the session's home tab without re-querying Chrome.
   */
-  ensureActiveTab(windowId: number, url: string): Promise<number>;
+  ensureActiveTab(windowId: number, url: string): Promise<void>;
 }

 /** Creation hints for a new Agent Window. */
@@ -52,19 +49,15 @@ export const chromeAgentWindowApi: AgentWindowApi = {
    // cancellation success while the Agent Window remains open.
    await chrome.windows.remove(windowId);
  },
-  async ensureActiveTab(windowId: number, url: string): Promise<number> {
+  async ensureActiveTab(windowId: number, url: string): Promise<void> {
    const tabs = await chrome.tabs.query({ windowId });
    const first = tabs.find((t) => typeof t.id === "number");
-    if (first?.id !== undefined) {
+    if (first?.id) {
      if (!first.active) {
        await chrome.tabs.update(first.id, { active: true });
      }
-      return first.id;
+      return;
    }
-    const created = await chrome.tabs.create({ windowId, url, active: true });
-    if (typeof created?.id !== "number") {
-      throw new Error("[bh] chrome.tabs.create returned no tab id");
-    }
-    return created.id;
+    await chrome.tabs.create({ windowId, url, active: true });
  },
 };
@@ -1,3 +1,4 @@
+import type { DiagnosticSink } from "@/lib/diagnostics";
 import { handleSessionStop, type SessionStopDeps } from "@/tools/session";
 import type { SessionManager } from "./manager";

@@ -15,6 +16,7 @@ export interface DisconnectCleanupOptions {
  manager: SessionManager;
  sessionStopDeps?: SessionStopDeps;
  onSessionsChanged?: () => void;
+  diagnostics?: DiagnosticSink;
 }

 /**
@@ -29,7 +31,15 @@ export function createDisconnectCleanup(options: DisconnectCleanupOptions) {
  let inFlight: Promise<DisconnectCleanupReport> | null = null;

  return (): Promise<DisconnectCleanupReport> => {
-    if (inFlight) return inFlight;
+    if (inFlight) {
+      options.diagnostics?.("disconnect_cleanup.coalesced", {
+        live_session_ids: options.manager.list().map((ctx) => ctx.sessionId),
+      });
+      return inFlight;
+    }
+    options.diagnostics?.("disconnect_cleanup.scheduled", {
+      live_session_ids: options.manager.list().map((ctx) => ctx.sessionId),
+    });
    inFlight = cleanupSessions(options).finally(() => {
      inFlight = null;
    });
@@ -42,8 +52,17 @@ async function cleanupSessions(
 ): Promise<DisconnectCleanupReport> {
  const stoppedSessionIds: string[] = [];
  const failures: DisconnectCleanupFailure[] = [];
+  const capturedSessions = options.manager.list();
+  options.diagnostics?.("disconnect_cleanup.started", {
+    captured_session_ids: capturedSessions.map((ctx) => ctx.sessionId),
+  });

-  for (const ctx of options.manager.list()) {
+  for (const ctx of capturedSessions) {
+    options.diagnostics?.("disconnect_cleanup.session_stop.started", {
+      session_id: ctx.sessionId,
+      agent_window_id: ctx.agentWindowId,
+      still_registered: options.manager.has(ctx.sessionId),
+    });
    try {
      const result = await handleSessionStop(
        options.manager,
@@ -62,14 +81,26 @@ async function cleanupSessions(
        continue;
      }
      stoppedSessionIds.push(ctx.sessionId);
+      options.diagnostics?.("disconnect_cleanup.session_stop.completed", {
+        session_id: ctx.sessionId,
+      });
    } catch (err) {
      failures.push({
        sessionId: ctx.sessionId,
        message: err instanceof Error ? err.message : String(err),
      });
+      options.diagnostics?.("disconnect_cleanup.session_stop.failed", {
+        session_id: ctx.sessionId,
+        error: err,
+      });
    }
  }

  options.onSessionsChanged?.();
+  options.diagnostics?.("disconnect_cleanup.completed", {
+    stopped_session_ids: stoppedSessionIds,
+    failures,
+    remaining_session_ids: options.manager.list().map((ctx) => ctx.sessionId),
+  });
  return { stoppedSessionIds, failures };
 }
@@ -1,3 +1,4 @@
+import type { DiagnosticSink } from "@/lib/diagnostics";
 import type { Transport } from "@/transport/transport";
 import type { EventFrame } from "@/transport/types";
 import type { SessionManager } from "./manager";
@@ -24,6 +25,7 @@ export interface SessionEventHandlerOptions {
   * `chrome.storage.session` "sessions live" flag (review M4/M5 I3).
   */
  onSessionsChanged?: () => void;
+  diagnostics?: DiagnosticSink;
 }

 function chromeWindowEvents(): WindowRemovedListener {
@@ -50,6 +52,11 @@ export function attachSessionEventHandler(options: SessionEventHandlerOptions):

  const onRemoved = (windowId: number): void => {
    const ctx = manager.findByWindowId(windowId);
+    options.diagnostics?.("chrome.window.removed", {
+      window_id: windowId,
+      matched_session_id: ctx?.sessionId ?? null,
+      live_session_ids: manager.list().map((entry) => entry.sessionId),
+    });
    if (!ctx) return;
    const returnFailures = Array.from(ctx.borrowedTabs.keys()).map((tabId) => ({
      tab_id: tabId,
@@ -81,7 +88,16 @@ export function attachSessionEventHandler(options: SessionEventHandlerOptions):
        };
        try {
          transport.send(event);
+          options.diagnostics?.("session.window_closed.sent", {
+            session_id: ctx.sessionId,
+            window_id: windowId,
+          });
        } catch (err) {
+          options.diagnostics?.("session.window_closed.send_failed", {
+            session_id: ctx.sessionId,
+            window_id: windowId,
+            error: err,
+          });
          console.warn("[bh] could not push session.window_closed event", err);
        }
      })
@@ -1,3 +1,4 @@
+import type { DiagnosticSink } from "@/lib/diagnostics";
 import { AGENT_WINDOW_HOME, type AgentWindowApi, chromeAgentWindowApi } from "./agent-window";
 import { RefStore } from "./ref-store";

@@ -6,20 +7,9 @@ export interface SessionContext {
  agentWindowId: number;
  refStore: RefStore;
  borrowedTabs: Map<number, BorrowedTab>;
-  /**
-   * Tabs explicitly claimed by the agent because it created them. This
-   * includes the Agent Window's home tab and tabs created by `tool.tab_create`.
-   * Tabs opened through Chrome UI never enter this set.
-   */
-  agentCreatedTabs: Set<number>;
  createdAtMs: number;
 }

-/** Whether this session has explicitly claimed control of `tabId`. */
-export function isAgentControlledTab(ctx: SessionContext, tabId: number): boolean {
-  return ctx.agentCreatedTabs.has(tabId) || ctx.borrowedTabs.has(tabId);
-}
-
 export interface BorrowedTab {
  tabId: number;
  originalWindowId: number;
@@ -34,6 +24,7 @@ export interface BorrowReservation {
 export interface SessionManagerOptions {
  agentWindow?: AgentWindowApi;
  now?: () => number;
+  diagnostics?: DiagnosticSink;
 }

 /** Options for starting a session's Agent Window. */
@@ -94,10 +85,12 @@ export class SessionManager {
  private readonly borrowReservations = new Map<number, string>();
  private readonly agentWindow: AgentWindowApi;
  private readonly now: () => number;
+  private readonly diagnostics?: DiagnosticSink;

  constructor(options: SessionManagerOptions = {}) {
    this.agentWindow = options.agentWindow ?? chromeAgentWindowApi;
    this.now = options.now ?? Date.now;
+    this.diagnostics = options.diagnostics;
  }

  has(sessionId: string): boolean {
@@ -117,19 +110,6 @@ export class SessionManager {
    return Array.from(this.sessions.values());
  }

-  /**
-   * Forget a tab Chrome has removed, including any uncommitted borrow.
-   * Whole-window closures keep committed borrows until the window-removed
-   * handler reports which user tabs could not be returned.
-   */
-  forgetClosedTab(tabId: number, { isWindowClosing = false } = {}): void {
-    this.borrowReservations.delete(tabId);
-    for (const ctx of this.sessions.values()) {
-      ctx.agentCreatedTabs.delete(tabId);
-      if (!isWindowClosing) ctx.borrowedTabs.delete(tabId);
-    }
-  }
-
  /**
   * Look up whether `tabId` is currently borrowed by some *other*
   * session than the one calling. Used by M8 `tab_borrow` to refuse
@@ -193,6 +173,13 @@ export class SessionManager {
   * daemon in the `tool.session_start` reply.
   */
  async start(sessionId: string, opts: SessionStartOptions = {}): Promise<SessionContext> {
+    this.diagnostics?.("session_manager.start.requested", {
+      session_id: sessionId,
+      existing_session_ids: this.list().map((ctx) => ctx.sessionId),
+      focused: opts.focused ?? null,
+      size: opts.size ?? null,
+      signal_aborted: opts.signal?.aborted ?? false,
+    });
    if (this.sessions.has(sessionId)) {
      throw new Error(`[bh] session ${sessionId} already exists`);
    }
@@ -202,8 +189,12 @@ export class SessionManager {
    try {
      const { signal: _signal, ...createOptions } = opts;
      windowId = await this.agentWindow.create(AGENT_WINDOW_HOME, createOptions);
+      this.diagnostics?.("session_manager.window.created", {
+        session_id: sessionId,
+        agent_window_id: windowId,
+      });
      throwIfSessionStartAborted(opts.signal);
-      const homeTabId = await this.agentWindow.ensureActiveTab(windowId, AGENT_WINDOW_HOME);
+      await this.agentWindow.ensureActiveTab(windowId, AGENT_WINDOW_HOME);
      throwIfSessionStartAborted(opts.signal);

      const ctx: SessionContext = {
@@ -211,16 +202,22 @@ export class SessionManager {
        agentWindowId: windowId,
        refStore: new RefStore(),
        borrowedTabs: new Map(),
-        // The home tab is the session's first explicit claim. Every other
-        // tab remains free until `tab_create` or `tab_borrow` identifies it
-        // by its concrete Chrome tab id.
-        agentCreatedTabs: new Set([homeTabId]),
        createdAtMs: this.now(),
      };
      this.sessions.set(sessionId, ctx);
      this.windowIndex.set(windowId, sessionId);
+      this.diagnostics?.("session_manager.start.committed", {
+        session_id: sessionId,
+        agent_window_id: windowId,
+        live_session_ids: this.list().map((entry) => entry.sessionId),
+      });
      return ctx;
    } catch (startupError) {
+      this.diagnostics?.("session_manager.start.failed", {
+        session_id: sessionId,
+        agent_window_id: windowId,
+        error: startupError,
+      });
      if (windowId !== null) {
        try {
          await this.agentWindow.remove(windowId);
@@ -244,12 +241,28 @@ export class SessionManager {
    options: { dropOnly?: boolean } = {},
  ): Promise<SessionContext | null> {
    const ctx = this.sessions.get(sessionId);
+    this.diagnostics?.("session_manager.stop.requested", {
+      session_id: sessionId,
+      drop_only: options.dropOnly ?? false,
+      existed: ctx !== undefined,
+      live_session_ids: this.list().map((entry) => entry.sessionId),
+    });
    if (!ctx) return null;
    if (!options.dropOnly) {
      await this.agentWindow.remove(ctx.agentWindowId);
+      this.diagnostics?.("session_manager.window.removed", {
+        session_id: sessionId,
+        agent_window_id: ctx.agentWindowId,
+      });
    }
    this.sessions.delete(sessionId);
    this.windowIndex.delete(ctx.agentWindowId);
+    this.diagnostics?.("session_manager.stop.committed", {
+      session_id: sessionId,
+      agent_window_id: ctx.agentWindowId,
+      drop_only: options.dropOnly ?? false,
+      live_session_ids: this.list().map((entry) => entry.sessionId),
+    });
    return ctx;
  }

@@ -127,38 +127,6 @@ describe("requestBorrowConfirmation", () => {
    expect(message.requestId.length).toBeGreaterThan(0);
  });

-  it("proactively focuses the user window before sending the overlay message", async () => {
-    tabs.get.mockResolvedValueOnce({ id: 42, title: "Tab" });
-    windows.getLastFocused.mockResolvedValueOnce(
-      userWindowWithActiveTab({ windowId: 77, tabId: 7, url: "https://app.example/" }),
-    );
-    tabs.sendMessage.mockResolvedValueOnce({ type: "borrow-response", allowed: true });
-
-    const pending = requestBorrowConfirmation(42, {
-      deps: { tabs, windows, notifications },
-    });
-    await vi.runAllTimersAsync();
-    await pending;
-
-    expect(windows.update).toHaveBeenCalledWith(77, { focused: true });
-  });
-
-  it("still proceeds when proactive window focus fails", async () => {
-    tabs.get.mockResolvedValueOnce({ id: 42, title: "Tab" });
-    windows.getLastFocused.mockResolvedValueOnce(
-      userWindowWithActiveTab({ windowId: 77, tabId: 7, url: "https://app.example/" }),
-    );
-    windows.update.mockRejectedValueOnce(new Error("window gone"));
-    tabs.sendMessage.mockResolvedValueOnce({ type: "borrow-response", allowed: true });
-
-    const pending = requestBorrowConfirmation(42, {
-      deps: { tabs, windows, notifications },
-    });
-    await vi.runAllTimersAsync();
-
-    expect(await pending).toBe(true);
-  });
-
  it("sends confirmation to the borrow target when it is the active tab", async () => {
    tabs.get.mockResolvedValueOnce({ id: 42, title: "Active Tab" });
    windows.getLastFocused.mockResolvedValueOnce(
@@ -13,7 +13,7 @@ function fakeAgentWindow(ids: number[]) {
      return id;
    }),
    remove: vi.fn(async () => {}),
-    ensureActiveTab: vi.fn(async () => 1),
+    ensureActiveTab: vi.fn(async () => {}),
  };
 }

@@ -49,54 +49,13 @@ describe("ToolDispatcher", () => {
    vi.unstubAllGlobals();
  });

-  it.each([
-    "tool.snapshot",
-    "tool.evaluate",
-    "tool.get_html",
-    "tool.console",
-  ])("annotates Chrome extension-access failures from %s", async (method) => {
-    const tab = { id: 7, windowId: 4242, active: true, url: "https://example.test" };
-    vi.stubGlobal("chrome", {
-      tabs: {
-        get: vi.fn(async () => tab),
-        query: vi.fn(async () => [tab]),
-      },
-    });
-    const { transport, sent, deliver } = fakeTransport();
-    const sessions = new SessionManager({
-      agentWindow: {
-        create: vi.fn(async () => 4242),
-        remove: vi.fn(),
-        ensureActiveTab: vi.fn(),
-      },
-    });
-    await sessions.start("test");
-    const error = new Error("Cannot access a chrome-extension:// URL of different extension");
-    const cdp = {
-      send: vi.fn().mockRejectedValue(error),
-      ensureConsoleCapture: vi.fn().mockRejectedValue(error),
-      consoleEntriesSince: vi.fn(),
-    } as unknown as TestDispatcherCdp;
-    const dispatcher = new ToolDispatcher({ transport, sessions, cdp });
-    dispatcher.start();
-    deliver(makeRequest(method, { session_id: "test", expression: "document.title" }));
-    await vi.waitFor(() => expect(sent).toHaveLength(1));
-    expect(sent[0]).toMatchObject({
-      error: {
-        code: "cdp_failed",
-        data: { reason: "cdp_extension_access_denied" },
-      },
-    });
-    dispatcher.stop();
-  });
-
  it("uses the configured recording runtime for start and stop", async () => {
    const { transport, sent, deliver } = fakeTransport();
    const sessions = new SessionManager({
      agentWindow: {
        create: vi.fn(async () => 4242),
        remove: vi.fn(),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    await sessions.start("aa11");
@@ -158,7 +117,7 @@ describe("ToolDispatcher", () => {
      agentWindow: {
        create: vi.fn(async () => 4242),
        remove: vi.fn(),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    const dispatcher = new ToolDispatcher({ transport, sessions });
@@ -181,7 +140,7 @@ describe("ToolDispatcher", () => {
      agentWindow: {
        create,
        remove: vi.fn(),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    const dispatcher = new ToolDispatcher({ transport, sessions });
@@ -199,7 +158,7 @@ describe("ToolDispatcher", () => {
      agentWindow: {
        create: vi.fn(async () => 4242),
        remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    await sessions.start("aa11");
@@ -213,47 +172,6 @@ describe("ToolDispatcher", () => {
    expect(sent[0]).toEqual({ id: "r-1", result: {} });
  });

-  it("wires the production tab APIs into tool.session_stop so a surviving user tab releases the window", async () => {
-    // Regression guard for the deps that session_stop reads directly: when
-    // `tabManagement.tabs` / `tabsQuery` are not injected by the dispatcher,
-    // the agent-tab cleanup and the release decision silently no-op and the
-    // Agent Window is closed even though a user tab is still open (issue #57).
-    const removeTab = vi.fn(async () => {});
-    const closeWindow = vi.fn(async () => {});
-    // After cleanup the window still holds one tab (id 99) that is neither
-    // the home tab nor an agent-created tab — i.e. a genuine user tab.
-    vi.stubGlobal("chrome", {
-      tabs: {
-        remove: removeTab,
-        query: vi.fn(async () => [{ id: 99, windowId: 4242, active: true }]),
-      },
-    });
-    const { transport, sent, deliver } = fakeTransport();
-    const sessions = new SessionManager({
-      agentWindow: {
-        create: vi.fn(async () => 4242),
-        remove: closeWindow,
-        ensureActiveTab: vi.fn(async () => 1),
-      },
-    });
-    await sessions.start("aa11");
-    // Register the exact tab id returned by the agent's creation path.
-    sessions.get("aa11")?.agentCreatedTabs.add(7);
-
-    const dispatcher = new ToolDispatcher({ transport, sessions });
-    dispatcher.start();
-
-    deliver(makeRequest("tool.session_stop", { session_id: "aa11" }));
-    await flushMicrotasks();
-
-    // The agent tab is closed through the real chrome.tabs surface...
-    expect(removeTab).toHaveBeenCalledWith(7);
-    // ...and the window is released rather than closed, so the user's tab survives.
-    expect(closeWindow).not.toHaveBeenCalled();
-    expect(sessions.has("aa11")).toBe(false);
-    expect(sent[0]).toEqual({ id: "r-1", result: { window_released: true } });
-  });
-
  it("routes tool.console through the CDP console buffer", async () => {
    vi.stubGlobal("chrome", {
      tabs: {
@@ -265,7 +183,7 @@ describe("ToolDispatcher", () => {
      agentWindow: {
        create: vi.fn(async () => 4242),
        remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    await sessions.start("aa11");
@@ -314,114 +232,13 @@ describe("ToolDispatcher", () => {
    });
  });

-  it("bypasses and restores the control overlay for an upload trigger click", async () => {
-    const sendMessage = vi.fn(async () => undefined);
-    vi.stubGlobal("chrome", {
-      tabs: {
-        get: vi.fn(async () => ({ id: 7, windowId: 4242, active: true })),
-        query: vi.fn(async () => [{ id: 7, windowId: 4242, active: true }]),
-        sendMessage,
-      },
-    });
-    const { transport, sent, deliver } = fakeTransport();
-    const sessions = new SessionManager({
-      agentWindow: {
-        create: vi.fn(async () => 4242),
-        remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => 1),
-      },
-    });
-    const ctx = await sessions.start("aa11");
-    ctx.refStore.set("e1", 123, { tabId: 7 });
-    const send = vi.fn(async <T>(_tabId: number, method: string, params?: object) => {
-      if (method === "Page.getLayoutMetrics") {
-        return { cssLayoutViewport: { clientWidth: 1280, clientHeight: 720 } } as T;
-      }
-      if (method === "DOM.getContentQuads") {
-        return { quads: [[0, 0, 20, 0, 20, 20, 0, 20]] } as T;
-      }
-      if (method === "DOM.resolveNode") {
-        return { object: { objectId: "trigger-object" } } as T;
-      }
-      if (method === "DOM.describeNode") return { node: { backendNodeId: 456 } } as T;
-      if (method === "Runtime.callFunctionOn") {
-        const declaration = (params as { functionDeclaration?: string }).functionDeclaration ?? "";
-        if (declaration.includes("count: state.inputs.length")) {
-          return { result: { value: { count: 1, multiple: false } } } as T;
-        }
-        if (declaration.includes("inputs[0]")) {
-          return { result: { objectId: "input-object" } } as T;
-        }
-        return { result: { value: true } } as T;
-      }
-      if (method === "Runtime.evaluate") {
-        const expression = (params as { expression?: string }).expression ?? "";
-        if (expression.includes("overlayDetails")) {
-          return { result: { value: { hitIndex: 0 } } } as T;
-        }
-        if (expression.includes("overlayHostPresent")) {
-          return {
-            result: {
-              value: { overlayHostPresent: true, overlayHostConnected: true },
-            },
-          } as T;
-        }
-        if (expression.includes("count:")) {
-          return { result: { value: { count: 1, multiple: false } } } as T;
-        }
-        if (expression.includes("?.inputs[0]")) {
-          return { result: { objectId: "input-object" } } as T;
-        }
-        return { result: { value: true } } as T;
-      }
-      return {} as T;
-    });
-    const cdp = {
-      send,
-      detachSession: vi.fn(async () => {}),
-      ensureNetworkCapture: vi.fn(async () => {}),
-      networkEntriesSince: vi.fn(() => ({
-        tab_id: 7,
-        entries: [],
-        next_since: 0,
-        truncated: false,
-      })),
-      setDeviceMetricsOverride: vi.fn(async () => {}),
-      clearDeviceMetricsOverride: vi.fn(async () => {}),
-      setUserAgentOverride: vi.fn(async () => {}),
-      setTouchEmulationEnabled: vi.fn(async () => {}),
-    };
-    const dispatcher = new ToolDispatcher({ transport, sessions, cdp: cdp as TestDispatcherCdp });
-    dispatcher.start();
-
-    deliver(
-      makeRequest("tool.upload", {
-        session_id: "aa11",
-        ref: "@e1",
-        files: [{ transfer_id: "tr_1", name: "test.png", staged_path: "/stage/test.png" }],
-      }),
-    );
-    await flushMicrotasks();
-    await vi.waitFor(() => expect(sent).toHaveLength(1));
-
-    expect(sent[0]).toMatchObject({ result: { tab_id: 7, file_names: ["test.png"] } });
-    expect(sendMessage).toHaveBeenNthCalledWith(1, 7, {
-      type: "bh-automation-bypass",
-      enabled: true,
-    });
-    expect(sendMessage).toHaveBeenNthCalledWith(2, 7, {
-      type: "bh-automation-bypass",
-      enabled: false,
-    });
-  });
-
  it("detaches CDP state before stopping a session", async () => {
    const { transport, sent, deliver } = fakeTransport();
    const sessions = new SessionManager({
      agentWindow: {
        create: vi.fn(async () => 4242),
        remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    await sessions.start("aa11");
@@ -457,7 +274,7 @@ describe("ToolDispatcher", () => {
      agentWindow: {
        create: vi.fn(async () => 4242),
        remove,
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    await sessions.start("aa11");
@@ -505,7 +322,7 @@ describe("ToolDispatcher", () => {
      agentWindow: {
        create: vi.fn(async () => 1),
        remove: vi.fn(),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    const dispatcher = new ToolDispatcher({ transport, sessions });
@@ -525,7 +342,7 @@ describe("ToolDispatcher", () => {
      agentWindow: {
        create: vi.fn(async () => 1),
        remove: vi.fn(),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    const dispatcher = new ToolDispatcher({ transport, sessions });
@@ -549,7 +366,7 @@ describe("ToolDispatcher", () => {
      agentWindow: {
        create: vi.fn(async () => 1),
        remove: vi.fn(),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    const dispatcher = new ToolDispatcher({ transport, sessions });
@@ -566,7 +383,7 @@ describe("ToolDispatcher", () => {
      agentWindow: {
        create: vi.fn(async () => 1),
        remove: vi.fn(),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    const dispatcher = new ToolDispatcher({ transport, sessions });
@@ -583,7 +400,7 @@ describe("ToolDispatcher", () => {
      agentWindow: {
        create: vi.fn(async () => 1),
        remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    const onSessionsChanged = vi.fn();
@@ -600,32 +417,16 @@ describe("ToolDispatcher", () => {
  });

  it("invokes onBrowserControlResumed for browser-control tools but not passive reads", async () => {
-    vi.stubGlobal("chrome", {
-      tabs: {
-        create: vi.fn(async (props: chrome.tabs.CreateProperties) => ({
-          id: 7,
-          windowId: props.windowId,
-          url: props.url,
-          active: props.active,
-        })),
-      },
-    });
    const { transport, sent, deliver } = fakeTransport();
    const sessions = new SessionManager({
      agentWindow: {
        create: vi.fn(async () => 1),
        remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    const onBrowserControlResumed = vi.fn();
-    const onAgentTabClaimed = vi.fn();
-    const dispatcher = new ToolDispatcher({
-      transport,
-      sessions,
-      onBrowserControlResumed,
-      onAgentTabClaimed,
-    });
+    const dispatcher = new ToolDispatcher({ transport, sessions, onBrowserControlResumed });
    dispatcher.start();

    deliver(makeRequest("tool.session_start", { session_id: "aa11" }));
@@ -642,7 +443,6 @@ describe("ToolDispatcher", () => {
    });
    await flushMicrotasks();
    expect(onBrowserControlResumed).toHaveBeenCalledWith("aa11");
-    expect(onAgentTabClaimed).toHaveBeenCalledWith(7, 1);
  });

  it("reasserts remembered hover before follow-up work and releases only after actions", async () => {
@@ -656,7 +456,7 @@ describe("ToolDispatcher", () => {
      agentWindow: {
        create: vi.fn(async () => 1),
        remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    const order: string[] = [];
@@ -738,7 +538,7 @@ describe("ToolDispatcher", () => {
      agentWindow: {
        create: vi.fn(async () => 1),
        remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    const cdp = {
@@ -788,135 +588,6 @@ describe("ToolDispatcher", () => {
    );
  });

-  it.each([
-    { tab_id: 7, code: "not_found" },
-    { tab_id: undefined, code: "invalid_params" },
-  ])("keeps hover when tab_return is rejected with $code", async ({ tab_id, code }) => {
-    const sendMessage = vi.fn(async () => undefined);
-    vi.stubGlobal("chrome", {
-      tabs: {
-        sendMessage,
-        get: vi.fn(async () => ({ id: 7, windowId: 100, active: true })),
-        query: vi.fn(async () => [{ id: 7, windowId: 100, active: true }]),
-      },
-    });
-    const { transport, sent, deliver } = fakeTransport();
-    const sessions = new SessionManager({
-      agentWindow: {
-        create: vi.fn(async () => 100),
-        remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => 1),
-      },
-    });
-    await sessions.start("aa11");
-    const cdp = {
-      send: vi.fn(async <T>() => ({}) as T),
-      detachSession: vi.fn(async () => {}),
-      releaseSessionTab: vi.fn(async () => {}),
-    };
-    const dispatcher = new ToolDispatcher({
-      transport,
-      sessions,
-      cdp: cdp as unknown as TestDispatcherCdp,
-    });
-    const helpers = dispatcher as unknown as {
-      rememberHover: (sessionId: string, result: unknown) => unknown;
-      setHoverBypass: (sessionId: string, tabId: number, enabled: boolean) => Promise<void>;
-      withHoverReassert: <T>(
-        params: { session_id: string; tab_id?: number },
-        work: () => Promise<T>,
-      ) => Promise<T>;
-    };
-    helpers.rememberHover("aa11", { tab_id: 7, x: 10, y: 20 });
-    await helpers.setHoverBypass("aa11", 7, true);
-    dispatcher.start();
-    deliver(makeRequest("tool.tab_return", { session_id: "aa11", tab_id }));
-    await vi.waitFor(() => expect(sent).toHaveLength(1));
-
-    expect(sent[0]).toMatchObject({ error: { code } });
-    expect(cdp.releaseSessionTab).not.toHaveBeenCalled();
-    expect(sendMessage).not.toHaveBeenCalledWith(7, expect.objectContaining({ enabled: false }));
-    await helpers.withHoverReassert({ session_id: "aa11", tab_id: 7 }, async () => ({}));
-    expect(cdp.send).toHaveBeenCalledExactlyOnceWith(7, "Input.dispatchMouseEvent", {
-      type: "mouseMoved",
-      x: 10,
-      y: 20,
-    });
-    dispatcher.stop();
-  });
-
-  it("releases the returned tab's hover before moving it and leaves other tabs alone", async () => {
-    const sendMessage = vi.fn(async () => undefined);
-    const move = vi.fn(async () => {
-      expect(sendMessage).toHaveBeenCalledWith(7, expect.objectContaining({ enabled: false }));
-      return { id: 7, windowId: 200, index: 4 };
-    });
-    vi.stubGlobal("chrome", {
-      tabs: { sendMessage, move },
-      windows: { get: vi.fn(async () => ({ id: 200 })) },
-    });
-    const { transport, sent, deliver } = fakeTransport();
-    const sessions = new SessionManager({
-      agentWindow: {
-        create: vi.fn(async () => 100),
-        remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => 1),
-      },
-    });
-    const ctx = await sessions.start("aa11");
-    ctx.borrowedTabs.set(7, { tabId: 7, originalWindowId: 200, originalIndex: 4 });
-    const cdp = {
-      send: vi.fn(async <T>() => ({}) as T),
-      detachSession: vi.fn(async () => {}),
-      releaseSessionTab: vi.fn(async () => {}),
-    };
-    const dispatcher = new ToolDispatcher({
-      transport,
-      sessions,
-      cdp: cdp as unknown as TestDispatcherCdp,
-    });
-    const helpers = dispatcher as unknown as {
-      rememberHover: (sessionId: string, result: unknown) => unknown;
-      setHoverBypass: (sessionId: string, tabId: number, enabled: boolean) => Promise<void>;
-      withHoverReassert: <T>(
-        params: { session_id: string; tab_id?: number },
-        work: () => Promise<T>,
-      ) => Promise<T>;
-    };
-    for (const [sessionId, tabId] of [
-      ["aa11", 7],
-      ["aa11", 8],
-      ["bb22", 9],
-    ] as const) {
-      helpers.rememberHover(sessionId, { tab_id: tabId, x: 10, y: 20 });
-      await helpers.setHoverBypass(sessionId, tabId, true);
-    }
-    dispatcher.start();
-    deliver(makeRequest("tool.tab_return", { session_id: "aa11", tab_id: 7 }));
-    await vi.waitFor(() => expect(sent).toHaveLength(1));
-
-    expect(sent[0]).toMatchObject({ result: { tab_id: 7, returned_to_window_id: 200 } });
-    expect(cdp.releaseSessionTab).toHaveBeenCalledExactlyOnceWith("aa11", 7);
-    await helpers.withHoverReassert({ session_id: "aa11", tab_id: 7 }, async () => ({}));
-    expect(cdp.send).not.toHaveBeenCalled();
-    for (const [sessionId, tabId] of [
-      ["aa11", 8],
-      ["bb22", 9],
-    ] as const) {
-      expect(sendMessage).not.toHaveBeenCalledWith(
-        tabId,
-        expect.objectContaining({ enabled: false }),
-      );
-      await helpers.withHoverReassert({ session_id: sessionId, tab_id: tabId }, async () => ({}));
-      expect(cdp.send).toHaveBeenLastCalledWith(tabId, "Input.dispatchMouseEvent", {
-        type: "mouseMoved",
-        x: 10,
-        y: 20,
-      });
-    }
-    dispatcher.stop();
-  });
-
  it("transfers hover overlay bypass ownership between sessions", async () => {
    vi.stubGlobal("chrome", {
      tabs: {
@@ -928,7 +599,7 @@ describe("ToolDispatcher", () => {
      agentWindow: {
        create: vi.fn(async () => 1),
        remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    const dispatcher = new ToolDispatcher({ transport, sessions });
@@ -965,7 +636,7 @@ describe("ToolDispatcher", () => {
      agentWindow: {
        create: vi.fn(async () => 4242),
        remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    await sessions.start("aa11");
@@ -1017,7 +688,7 @@ describe("ToolDispatcher", () => {
      agentWindow: {
        create: vi.fn(async () => 1),
        remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    const dispatcher = new ToolDispatcher({ transport, sessions });
@@ -1051,7 +722,7 @@ describe("ToolDispatcher", () => {
      agentWindow: {
        create: vi.fn(async () => 4242),
        remove: vi.fn(),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    transport.send = () => {
@@ -1073,7 +744,7 @@ describe("ToolDispatcher", () => {
      agentWindow: {
        create: vi.fn(async () => 5555),
        remove,
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    transport.send = () => {
@@ -1101,7 +772,7 @@ describe("ToolDispatcher", () => {
      agentWindow: {
        create: vi.fn(() => createPromise),
        remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    const dispatcher = new ToolDispatcher({ transport, sessions });
@@ -1152,7 +823,7 @@ describe("ToolDispatcher", () => {
      agentWindow: {
        create: vi.fn(async () => 1),
        remove: vi.fn(),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    const dispatcher = new ToolDispatcher({ transport, sessions });
@@ -1173,7 +844,7 @@ describe("ToolDispatcher", () => {
      agentWindow: {
        create: vi.fn(() => createPromise),
        remove: vi.fn(),
-        ensureActiveTab: vi.fn(async () => 1),
+        ensureActiveTab: vi.fn(async () => {}),
      },
    });
    const dispatcher = new ToolDispatcher({ transport, sessions });
@@ -20,7 +20,7 @@ function fakeAgentWindow(ids: number[]) {
      return id;
    }),
    remove: vi.fn(async () => {}),
-    ensureActiveTab: vi.fn(async () => 1),
+    ensureActiveTab: vi.fn(async () => {}),
  };
 }

@@ -1,39 +0,0 @@
-import { describe, expect, it } from "vitest";
-import type { RpcError } from "@/transport/types";
-import { cdpError, classifyCdpError } from "../errors";
-
-const denied = "Cannot access a chrome-extension:// URL of different extension";
-
-describe("CDP extension access errors", () => {
-  it("classifies both Chrome Error instances and string failures", () => {
-    for (const error of [new Error(denied), denied]) {
-      expect(cdpError(error)).toEqual({
-        code: "cdp_failed",
-        message: denied,
-        data: { reason: "cdp_extension_access_denied" },
-      });
-    }
-  });
-
-  it("preserves transfer outcome and cleanup instructions when CDP was denied", () => {
-    const error: RpcError = {
-      code: "cdp_failed",
-      message: denied,
-      data: {
-        reason: "transfer_outcome_unknown",
-        effect_state: "unknown",
-        cleanup_state: "failed",
-      },
-    };
-    expect(classifyCdpError(error)).toBe(error);
-  });
-
-  it("leaves other error codes and unrelated debugger failures unchanged", () => {
-    for (const error of [
-      { code: "permission_denied", message: denied },
-      { code: "cdp_failed", message: "Another debugger is already attached" },
-    ] satisfies RpcError[]) {
-      expect(classifyCdpError(error)).toBe(error);
-    }
-  });
-});
@@ -12,7 +12,7 @@ function fakeAgentWindow(ids: number[]) {
      return id;
    }),
    remove: vi.fn(async () => {}),
-    ensureActiveTab: vi.fn(async () => 1),
+    ensureActiveTab: vi.fn(async () => {}),
  };
 }

@@ -1,988 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-import { SessionManager } from "@/session-manager/manager";
-import { type DownloadsApi, handleDownload } from "../download";
-import { captureBrowserDownload } from "../download-capture";
-import { uploadThroughFileDrop } from "../file-drop-transaction";
-import { uploadThroughActivatedFileInput } from "../file-input-transaction";
-import type { ResolvedActionTarget } from "../interaction";
-import type { CdpRunner } from "../shared";
-import { handleUpload } from "../upload";
-
-function sessions() {
-  return new SessionManager({
-    agentWindow: {
-      create: vi.fn(async () => 100),
-      remove: vi.fn(async () => {}),
-      ensureActiveTab: vi.fn(async () => 1),
-    },
-  });
-}
-
-function tabsApi() {
-  return {
-    get: vi.fn(
-      async (tabId: number) => ({ id: tabId, windowId: 100, active: true }) as chrome.tabs.Tab,
-    ),
-    query: vi.fn(async () => [{ id: 4, windowId: 100, active: true } as chrome.tabs.Tab]),
-  };
-}
-
-function fakeEvent<T extends (...args: never[]) => unknown>() {
-  const listeners = new Set<T>();
-  return {
-    addListener: (listener: T) => listeners.add(listener),
-    removeListener: (listener: T) => listeners.delete(listener),
-    emit: (...args: Parameters<T>) => {
-      for (const listener of listeners) listener(...args);
-    },
-  };
-}
-
-function actionTarget(frameId?: string, sessionId?: string): ResolvedActionTarget {
-  return {
-    tab: { tabId: 4, windowId: 100, active: true },
-    backendNodeId: 123,
-    cdpTarget: { tabId: 4, ...(sessionId ? { sessionId } : {}) },
-    ...(frameId ? { frameId } : {}),
-    usedRef: "e3",
-  };
-}
-
-function withoutOverlay<T>(operation: () => Promise<T>): Promise<T> {
-  return operation();
-}
-
-function uploadCdp(
-  options: {
-    inputCount?: number;
-    multiple?: boolean;
-    chooser?: { frameId?: string; backendNodeId?: number; mode?: string };
-    pendingResolve?: boolean;
-  } = {},
-) {
-  const calls: Array<{ method: string; params?: object }> = [];
-  let cdpEvent: Parameters<NonNullable<CdpRunner["onEvent"]>>[0] | undefined;
-  const send = vi.fn(async (_tabId: number, method: string, params?: object) => {
-    calls.push({ method, params });
-    if (method === "DOM.scrollIntoViewIfNeeded") return {};
-    if (method === "Page.setInterceptFileChooserDialog") return {};
-    if (method === "Page.getLayoutMetrics")
-      return { cssLayoutViewport: { clientWidth: 1280, clientHeight: 720 } };
-    if (method === "DOM.getContentQuads") return { quads: [[0, 0, 20, 0, 20, 20, 0, 20]] };
-    if (method === "DOM.resolveNode") {
-      if (options.pendingResolve) return new Promise<never>(() => {});
-      return { object: { objectId: "trigger-object" } };
-    }
-    if (method === "Runtime.callFunctionOn") {
-      const declaration = (params as { functionDeclaration?: string }).functionDeclaration ?? "";
-      if (declaration.includes("Object.defineProperty")) return { result: { value: true } };
-      if (declaration.includes("count: state.inputs.length")) {
-        return {
-          result: {
-            value: {
-              count: options.inputCount ?? 1,
-              multiple: options.multiple ?? true,
-            },
-          },
-        };
-      }
-      if (declaration.includes("inputs[0]")) {
-        return { result: { objectId: "input-object" } };
-      }
-      return { result: { value: true } };
-    }
-    if (method === "DOM.describeNode") return { node: { backendNodeId: 456 } };
-    if (
-      method === "Input.dispatchMouseEvent" &&
-      (params as { type?: string }).type === "mousePressed" &&
-      options.chooser
-    ) {
-      cdpEvent?.({ tabId: 4 }, "Page.fileChooserOpened", options.chooser);
-    }
-    return {};
-  });
-  const cdp: CdpRunner = {
-    send: send as unknown as CdpRunner["send"],
-    onEvent: (handler) => {
-      cdpEvent = handler;
-      return { dispose: vi.fn() };
-    },
-  };
-  return {
-    calls,
-    emitChooser: (event: { frameId?: string; backendNodeId?: number; mode?: string }) =>
-      cdpEvent?.({ tabId: 4 }, "Page.fileChooserOpened", event),
-    cdp,
-  };
-}
-
-function dropCdp(
-  options: {
-    targetContainsPoint?: boolean;
-    dispatchError?: (type: string) => Error | Promise<never> | undefined;
-    onCall?: (method: string) => void;
-  } = {},
-) {
-  const calls: Array<{ method: string; params?: object }> = [];
-  const detach = vi.fn(async () => {});
-  const send = vi.fn(async (_tabId: number, method: string, params?: object) => {
-    calls.push({ method, params });
-    options.onCall?.(method);
-    if (method === "DOM.scrollIntoViewIfNeeded") return {};
-    if (method === "Page.getLayoutMetrics") {
-      return { cssLayoutViewport: { clientWidth: 1280, clientHeight: 720 } };
-    }
-    if (method === "DOM.getContentQuads") {
-      return { quads: [[10, 20, 210, 20, 210, 120, 10, 120]] };
-    }
-    if (method === "DOM.getNodeForLocation") return { backendNodeId: 124 };
-    if (method === "DOM.resolveNode") {
-      const id = (params as { backendNodeId?: number }).backendNodeId;
-      return { object: { objectId: id === 123 ? "drop-target" : "hit-target" } };
-    }
-    if (method === "Runtime.callFunctionOn") {
-      return { result: { value: options.targetContainsPoint ?? true } };
-    }
-    if (method === "Input.dispatchDragEvent") {
-      const type = (params as { type?: string }).type ?? "";
-      const error = options.dispatchError?.(type);
-      if (error instanceof Promise) return error;
-      if (error) throw error;
-      return {};
-    }
-    if (method === "Runtime.releaseObjectGroup") return {};
-    throw new Error(`unexpected drop CDP command ${method}`);
-  });
-  const cdp: CdpRunner = {
-    send: send as unknown as CdpRunner["send"],
-    detach,
-  };
-  return { calls, cdp, detach };
-}
-
-describe("file transfer tools", () => {
-  it("captures the file input activated by the requested click and injects only staged paths", async () => {
-    const manager = sessions();
-    const ctx = await manager.start("s1");
-    ctx.refStore.set("e3", 123, { tabId: 4 });
-    const { cdp, calls } = uploadCdp();
-
-    const result = await handleUpload(
-      manager,
-      {
-        session_id: "s1",
-        ref: "@e3",
-        files: [
-          { transfer_id: "tr_1", name: "one.png", staged_path: "/private/stage/one" },
-          { transfer_id: "tr_2", name: "two.png", staged_path: "/private/stage/two" },
-        ],
-      },
-      { cdp, tabsApi: tabsApi() },
-    );
-
-    expect(result).toMatchObject({ tab_id: 4, file_names: ["one.png", "two.png"] });
-    expect(calls[0]).toEqual({
-      method: "Page.setInterceptFileChooserDialog",
-      params: { enabled: true },
-    });
-    expect(calls).toContainEqual({
-      method: "Page.setInterceptFileChooserDialog",
-      params: { enabled: false, cancel: true },
-    });
-    expect(calls).toContainEqual({
-      method: "DOM.setFileInputFiles",
-      params: { files: ["/private/stage/one", "/private/stage/two"], backendNodeId: 456 },
-    });
-  });
-
-  it("fails immediately when the trigger does not activate a file input", async () => {
-    const { cdp } = uploadCdp({ inputCount: 0 });
-    const result = await uploadThroughActivatedFileInput({
-      cdp,
-      actionTarget: actionTarget(),
-      files: ["/private/stage/one"],
-      timeoutMs: 100,
-      trigger: async () => ({ tab_id: 4, x: 10, y: 10 }),
-    });
-
-    expect(result).toMatchObject({
-      code: "unsupported",
-      data: { reason: "file_input_not_activated", phase: "resolve_input" },
-    });
-  });
-
-  it("fails before clicking when chooser interception is unavailable", async () => {
-    const trigger = vi.fn(async () => ({ tab_id: 4, x: 10, y: 10 }));
-    const cdp: CdpRunner = {
-      send: vi.fn(async (_tabId: number, method: string) => {
-        if (method === "Page.setInterceptFileChooserDialog") {
-          throw new Error("method unavailable");
-        }
-        return {};
-      }) as CdpRunner["send"],
-    };
-
-    const result = await uploadThroughActivatedFileInput({
-      cdp,
-      actionTarget: actionTarget(),
-      files: ["/private/stage/one"],
-      timeoutMs: 100,
-      trigger,
-    });
-
-    expect(result).toMatchObject({
-      code: "cdp_failed",
-      data: { effect_state: "none", phase: "arm_interception" },
-    });
-    expect(trigger).not.toHaveBeenCalled();
-  });
-
-  it("uses an exact chooser event as an independent input-location signal", async () => {
-    const { cdp, calls, emitChooser } = uploadCdp({ inputCount: 0 });
-    const result = await uploadThroughActivatedFileInput({
-      cdp,
-      actionTarget: actionTarget("f1"),
-      files: ["/private/stage/one"],
-      timeoutMs: 100,
-      trigger: async () => {
-        emitChooser({ frameId: "f1", backendNodeId: 789, mode: "selectSingle" });
-        return { tab_id: 4, x: 10, y: 10 };
-      },
-    });
-
-    expect(result).toMatchObject({ multiple: false });
-    expect(calls).toContainEqual({
-      method: "DOM.setFileInputFiles",
-      params: { files: ["/private/stage/one"], backendNodeId: 789 },
-    });
-  });
-
-  it("reports a File System Access picker without waiting for a timeout", async () => {
-    const { cdp, emitChooser } = uploadCdp({
-      inputCount: 0,
-    });
-    const result = await uploadThroughActivatedFileInput({
-      cdp,
-      actionTarget: actionTarget("f1"),
-      files: ["/private/stage/one"],
-      timeoutMs: 100,
-      trigger: async () => {
-        emitChooser({ frameId: "f1", mode: "selectSingle" });
-        return { tab_id: 4, x: 10, y: 10 };
-      },
-    });
-
-    expect(result).toMatchObject({
-      code: "unsupported",
-      message: "upload trigger invoked a non-input file picker",
-      data: { reason: "file_input_not_activated", phase: "resolve_input" },
-    });
-  });
-
-  it("bounds a stuck file-input probe", async () => {
-    const { cdp } = uploadCdp({ pendingResolve: true });
-
-    const result = await uploadThroughActivatedFileInput({
-      cdp,
-      actionTarget: actionTarget(),
-      files: ["/private/stage/one"],
-      timeoutMs: 5,
-      trigger: vi.fn(),
-    });
-
-    expect(result).toMatchObject({
-      code: "timeout",
-      data: { reason: "file_input_probe_failed", phase: "arm_input_probe" },
-    });
-  });
-
-  it("marks a timed-out file assignment unknown and detaches browser state", async () => {
-    const fixture = uploadCdp();
-    const originalSend = fixture.cdp.send;
-    const detach = vi.fn(async () => {});
-    fixture.cdp.detach = detach;
-    fixture.cdp.send = vi.fn((tabId: number, method: string, params?: object) => {
-      if (method === "DOM.setFileInputFiles") return new Promise<never>(() => {});
-      return originalSend(tabId, method, params);
-    }) as CdpRunner["send"];
-
-    const result = await uploadThroughActivatedFileInput({
-      cdp: fixture.cdp,
-      actionTarget: actionTarget(),
-      files: ["/private/stage/one"],
-      timeoutMs: 10,
-      trigger: async () => ({ tab_id: 4, x: 10, y: 10 }),
-    });
-
-    expect(result).toMatchObject({
-      code: "timeout",
-      data: { effect_state: "unknown", phase: "set_files" },
-    });
-    expect(detach).toHaveBeenCalledWith(4);
-  });
-
-  it("delivers staged files through one explicit native drop without clicking", async () => {
-    const manager = sessions();
-    const ctx = await manager.start("s1");
-    ctx.refStore.set("e3", 123, { tabId: 4 });
-    const lifecycle: string[] = [];
-    const { cdp, calls } = dropCdp({ onCall: (method) => lifecycle.push(method) });
-    const overlayPhases: string[] = [];
-
-    const result = await handleUpload(
-      manager,
-      {
-        session_id: "s1",
-        ref: "@e3",
-        mode: "drop",
-        files: [{ transfer_id: "tr_1", name: "one.png", staged_path: "/stage/one.png" }],
-      },
-      {
-        cdp,
-        tabsApi: tabsApi(),
-        sendToTab: vi.fn(async (_tabId, message) => {
-          overlayPhases.push(message.phase);
-          lifecycle.push(`overlay:${message.phase}`);
-        }),
-      },
-    );
-
-    expect(result).toMatchObject({ tab_id: 4, used_ref: "e3", file_names: ["one.png"] });
-    expect(calls.filter((call) => call.method === "Input.dispatchDragEvent")).toEqual([
-      {
-        method: "Input.dispatchDragEvent",
-        params: {
-          type: "dragEnter",
-          x: 110,
-          y: 70,
-          data: { items: [], files: ["/stage/one.png"], dragOperationsMask: 1 },
-        },
-      },
-      {
-        method: "Input.dispatchDragEvent",
-        params: {
-          type: "dragOver",
-          x: 110,
-          y: 70,
-          data: { items: [], files: ["/stage/one.png"], dragOperationsMask: 1 },
-        },
-      },
-      {
-        method: "Input.dispatchDragEvent",
-        params: {
-          type: "drop",
-          x: 110,
-          y: 70,
-          data: { items: [], files: ["/stage/one.png"], dragOperationsMask: 1 },
-        },
-      },
-    ]);
-    expect(calls.some((call) => call.method === "Input.dispatchMouseEvent")).toBe(false);
-    expect(overlayPhases).toEqual(["begin", "end"]);
-    expect(lifecycle.indexOf("DOM.getContentQuads")).toBeLessThan(
-      lifecycle.indexOf("overlay:begin"),
-    );
-    expect(lifecycle.indexOf("overlay:begin")).toBeLessThan(
-      lifecycle.indexOf("DOM.getNodeForLocation"),
-    );
-    expect(lifecycle.lastIndexOf("Input.dispatchDragEvent")).toBeLessThan(
-      lifecycle.indexOf("overlay:end"),
-    );
-    expect(lifecycle.indexOf("overlay:end")).toBeLessThan(
-      lifecycle.indexOf("Runtime.releaseObjectGroup"),
-    );
-  });
-
-  it("fails closed before dragging when another element owns the action point", async () => {
-    const { cdp, calls } = dropCdp({ targetContainsPoint: false });
-    const result = await uploadThroughFileDrop({
-      cdp,
-      actionTarget: actionTarget(),
-      files: ["/stage/one.png"],
-      timeoutMs: 100,
-      withOverlayHidden: withoutOverlay,
-    });
-
-    expect(result).toMatchObject({
-      code: "permission_denied",
-      data: {
-        reason: "file_drop_target_unavailable",
-        mechanism: "drop",
-        effect_state: "none",
-        phase: "resolve_target",
-      },
-    });
-    expect(calls.some((call) => call.method === "Input.dispatchDragEvent")).toBe(false);
-  });
-
-  it("dispatches an OOPIF file drop in the child target's local coordinates", async () => {
-    const rootCalls: Array<{ method: string; params?: object }> = [];
-    const childCalls: Array<{ method: string; params?: object }> = [];
-    const cdp: CdpRunner = {
-      send: vi.fn(async (_tabId, method, params) => {
-        rootCalls.push({ method, params });
-        if (method === "DOM.scrollIntoViewIfNeeded") return {};
-        if (method === "DOM.getBoxModel") {
-          return { model: { content: [100, 100, 300, 100, 300, 200, 100, 200] } };
-        }
-        if (method === "Page.getLayoutMetrics") {
-          return { cssLayoutViewport: { clientWidth: 800, clientHeight: 600 } };
-        }
-        throw new Error(`unexpected root command ${method}`);
-      }) as CdpRunner["send"],
-      sendToTarget: vi.fn(async (_target, method, params) => {
-        childCalls.push({ method, params });
-        if (method === "DOM.scrollIntoViewIfNeeded") return {};
-        if (method === "DOM.getContentQuads") {
-          return { quads: [[10, 20, 210, 20, 210, 120, 10, 120]] };
-        }
-        if (method === "Page.getLayoutMetrics") {
-          return { cssLayoutViewport: { clientWidth: 400, clientHeight: 300 } };
-        }
-        if (method === "DOM.getNodeForLocation") {
-          return { backendNodeId: 124, frameId: "child" };
-        }
-        if (method === "DOM.resolveNode") {
-          const id = (params as { backendNodeId?: number }).backendNodeId;
-          return { object: { objectId: id === 123 ? "drop-target" : "hit-target" } };
-        }
-        if (method === "Runtime.callFunctionOn") return { result: { value: true } };
-        if (method === "Input.dispatchDragEvent" || method === "Runtime.releaseObjectGroup") {
-          return {};
-        }
-        throw new Error(`unexpected child command ${method}`);
-      }) as CdpRunner["sendToTarget"],
-      getFrameGraph: vi.fn(async () => ({
-        rootFrameId: "main",
-        frames: [
-          { frameId: "main", target: { tabId: 4 } },
-          {
-            frameId: "child",
-            parentFrameId: "main",
-            ownerBackendNodeId: 10,
-            target: { tabId: 4, sessionId: "child-session" },
-          },
-        ],
-      })),
-    };
-
-    const result = await uploadThroughFileDrop({
-      cdp,
-      actionTarget: actionTarget("child", "child-session"),
-      files: ["/stage/one.png"],
-      timeoutMs: 100,
-      withOverlayHidden: withoutOverlay,
-    });
-
-    expect(result).toMatchObject({ x: 110, y: 70 });
-    expect(
-      childCalls
-        .filter((call) => call.method === "Input.dispatchDragEvent")
-        .map((call) => call.params),
-    ).toEqual([
-      expect.objectContaining({ type: "dragEnter", x: 110, y: 70 }),
-      expect.objectContaining({ type: "dragOver", x: 110, y: 70 }),
-      expect.objectContaining({ type: "drop", x: 110, y: 70 }),
-    ]);
-    expect(rootCalls.some((call) => call.method === "Input.dispatchDragEvent")).toBe(false);
-  });
-
-  it("reports a missing native drag command as unsupported before commit", async () => {
-    const { cdp } = dropCdp({
-      dispatchError: (type) =>
-        type === "dragEnter" ? new Error("'Input.dispatchDragEvent' wasn't found") : undefined,
-    });
-    const result = await uploadThroughFileDrop({
-      cdp,
-      actionTarget: actionTarget(),
-      files: ["/stage/one.png"],
-      timeoutMs: 100,
-      withOverlayHidden: withoutOverlay,
-    });
-
-    expect(result).toMatchObject({
-      code: "unsupported",
-      data: {
-        reason: "upload_mechanism_unsupported",
-        effect_state: "none",
-        phase: "drag_enter",
-      },
-    });
-  });
-
-  it("cancels an unresolved drag before returning a pre-commit timeout", async () => {
-    const { cdp, calls } = dropCdp({
-      dispatchError: (type) => (type === "dragEnter" ? new Promise<never>(() => {}) : undefined),
-    });
-    const result = await uploadThroughFileDrop({
-      cdp,
-      actionTarget: actionTarget(),
-      files: ["/stage/one.png"],
-      timeoutMs: 10,
-      withOverlayHidden: withoutOverlay,
-    });
-
-    expect(result).toMatchObject({
-      code: "timeout",
-      data: { reason: "file_drop_failed", effect_state: "none", phase: "drag_enter" },
-    });
-    expect(calls).toContainEqual({
-      method: "Input.dispatchDragEvent",
-      params: expect.objectContaining({ type: "dragCancel" }),
-    });
-  });
-
-  it("marks an unresolved drop unknown and detaches browser state", async () => {
-    const { cdp, detach } = dropCdp({
-      dispatchError: (type) => (type === "drop" ? new Promise<never>(() => {}) : undefined),
-    });
-    const result = await uploadThroughFileDrop({
-      cdp,
-      actionTarget: actionTarget(),
-      files: ["/stage/one.png"],
-      timeoutMs: 10,
-      withOverlayHidden: withoutOverlay,
-    });
-
-    expect(result).toMatchObject({
-      code: "timeout",
-      data: { reason: "file_drop_failed", effect_state: "unknown", phase: "drop" },
-    });
-    expect(detach).toHaveBeenCalledWith(4);
-  });
-
-  it("routes one exact-target download through a browser-relative capability", async () => {
-    const manager = sessions();
-    const ctx = await manager.start("s1");
-    ctx.refStore.set("e3", 123, { tabId: 4 });
-    const onCreated = fakeEvent<(item: chrome.downloads.DownloadItem) => void>();
-    const onChanged = fakeEvent<(delta: chrome.downloads.DownloadDelta) => void>();
-    const onDeterminingFilename =
-      fakeEvent<
-        (
-          item: chrome.downloads.DownloadItem,
-          suggest: (suggestion?: chrome.downloads.DownloadFilenameSuggestion) => void,
-        ) => void | true
-      >();
-    const initial = {
-      id: 9,
-      url: "https://example.test/result.zip",
-      finalUrl: "https://example.test/result.zip",
-      filename: "result.zip",
-      state: "in_progress",
-      fileSize: -1,
-      totalBytes: 12,
-      mime: "application/zip",
-      danger: "safe",
-    } as chrome.downloads.DownloadItem;
-    const completed = {
-      ...initial,
-      filename: "/profile/Downloads/BrowserSkill/tr_1/result.zip",
-      state: "complete",
-      fileSize: 12,
-    } as chrome.downloads.DownloadItem;
-    const downloads: DownloadsApi = {
-      onCreated,
-      onChanged,
-      onDeterminingFilename,
-      search: vi.fn(async () => [completed]),
-      cancel: vi.fn(async () => {}),
-      removeFile: vi.fn(async () => {}),
-    };
-    let cdpEvent: Parameters<NonNullable<CdpRunner["onEvent"]>>[0] | undefined;
-    let suggested: chrome.downloads.DownloadFilenameSuggestion | undefined;
-    const send = vi.fn(async (_tabId: number, method: string, params?: object) => {
-      if (method === "Page.getLayoutMetrics")
-        return { cssLayoutViewport: { clientWidth: 1280, clientHeight: 720 } };
-      if (method === "DOM.getContentQuads") return { quads: [[0, 0, 20, 0, 20, 20, 0, 20]] };
-      if (
-        method === "Input.dispatchMouseEvent" &&
-        (params as { type?: string }).type === "mousePressed"
-      ) {
-        cdpEvent?.({ tabId: 4 }, "Page.downloadWillBegin", {
-          url: initial.url,
-          suggestedFilename: "result.zip",
-        });
-        await new Promise<void>((resolve) => {
-          onDeterminingFilename.emit(initial, (value) => {
-            suggested = value;
-            resolve();
-          });
-        });
-        onCreated.emit(completed);
-      }
-      return {};
-    });
-    const cdp: CdpRunner = {
-      send: send as unknown as CdpRunner["send"],
-      onEvent: (handler) => {
-        cdpEvent = handler;
-        return { dispose: vi.fn() };
-      },
-    };
-
-    const result = await handleDownload(
-      manager,
-      { session_id: "s1", ref: "@e3", browser_relative_dir: "BrowserSkill/tr_1" },
-      { cdp, tabsApi: tabsApi(), downloads },
-    );
-
-    expect(suggested).toEqual({
-      filename: "BrowserSkill/tr_1/result.zip",
-      conflictAction: "overwrite",
-    });
-    expect(result).toMatchObject({
-      tab_id: 4,
-      suggested_filename: "result.zip",
-      byte_size: 12,
-      browser_path: completed.filename,
-    });
-  });
-
-  it("does not claim a download without an intent from the exact target", async () => {
-    const onCreated = fakeEvent<(item: chrome.downloads.DownloadItem) => void>();
-    const onChanged = fakeEvent<(delta: chrome.downloads.DownloadDelta) => void>();
-    const onDeterminingFilename =
-      fakeEvent<
-        (
-          item: chrome.downloads.DownloadItem,
-          suggest: (suggestion?: chrome.downloads.DownloadFilenameSuggestion) => void,
-        ) => void | true
-      >();
-    const downloads: DownloadsApi = {
-      onCreated,
-      onChanged,
-      onDeterminingFilename,
-      search: vi.fn(async () => []),
-      cancel: vi.fn(async () => {}),
-      removeFile: vi.fn(async () => {}),
-    };
-    let cdpEvent: Parameters<NonNullable<CdpRunner["onEvent"]>>[0] | undefined;
-    const cdp: CdpRunner = {
-      send: vi.fn(async () => ({})) as unknown as CdpRunner["send"],
-      onEvent: (handler) => {
-        cdpEvent = handler;
-        return { dispose: vi.fn() };
-      },
-    };
-    const unrelated = {
-      id: 17,
-      url: "https://example.test/unrelated.zip",
-      finalUrl: "https://example.test/unrelated.zip",
-      filename: "unrelated.zip",
-      state: "in_progress",
-    } as chrome.downloads.DownloadItem;
-    let defaultSuggestionCalled = false;
-
-    const result = await captureBrowserDownload({
-      cdp,
-      target: { tabId: 4, sessionId: "expected-child" },
-      downloads,
-      browserRelativeDir: "BrowserSkill/tr_1",
-      timeoutMs: 5,
-      trigger: async () => {
-        cdpEvent?.({ tabId: 4, sessionId: "other-child" }, "Page.downloadWillBegin", {
-          url: unrelated.url,
-          suggestedFilename: unrelated.filename,
-        });
-        onDeterminingFilename.emit(unrelated, (suggestion) => {
-          defaultSuggestionCalled = suggestion === undefined;
-        });
-        return { tab_id: 4, x: 10, y: 10 };
-      },
-    });
-
-    expect(defaultSuggestionCalled).toBe(true);
-    expect(downloads.cancel).not.toHaveBeenCalled();
-    expect(result).toMatchObject({
-      code: "cdp_failed",
-      data: { reason: "download_capture_failed" },
-    });
-  });
-
-  it("correlates a filename candidate that arrives before the CDP intent", async () => {
-    const onCreated = fakeEvent<(item: chrome.downloads.DownloadItem) => void>();
-    const onChanged = fakeEvent<(delta: chrome.downloads.DownloadDelta) => void>();
-    const onDeterminingFilename =
-      fakeEvent<
-        (
-          item: chrome.downloads.DownloadItem,
-          suggest: (suggestion?: chrome.downloads.DownloadFilenameSuggestion) => void,
-        ) => void | true
-      >();
-    const initial = {
-      id: 21,
-      url: "https://example.test/candidate-first.bin",
-      finalUrl: "https://example.test/candidate-first.bin",
-      filename: "candidate-first.bin",
-      state: "in_progress",
-      fileSize: -1,
-      totalBytes: 4,
-      bytesReceived: 0,
-    } as chrome.downloads.DownloadItem;
-    const complete = {
-      ...initial,
-      state: "complete",
-      fileSize: 4,
-    } as chrome.downloads.DownloadItem;
-    const downloads: DownloadsApi = {
-      onCreated,
-      onChanged,
-      onDeterminingFilename,
-      search: vi.fn(async () => [complete]),
-      cancel: vi.fn(async () => {}),
-      removeFile: vi.fn(async () => {}),
-    };
-    let cdpEvent: Parameters<NonNullable<CdpRunner["onEvent"]>>[0] | undefined;
-    const cdp: CdpRunner = {
-      send: vi.fn(async () => ({})) as CdpRunner["send"],
-      onEvent: (handler) => {
-        cdpEvent = handler;
-        return { dispose: vi.fn() };
-      },
-    };
-    let suggestion: chrome.downloads.DownloadFilenameSuggestion | undefined;
-
-    const result = await captureBrowserDownload({
-      cdp,
-      target: { tabId: 4 },
-      downloads,
-      browserRelativeDir: "BrowserSkill/tr_21",
-      timeoutMs: 1_000,
-      trigger: async () => {
-        const suggested = new Promise<void>((resolve) => {
-          onDeterminingFilename.emit(initial, (value) => {
-            suggestion = value;
-            resolve();
-          });
-        });
-        cdpEvent?.({ tabId: 4 }, "Page.downloadWillBegin", {
-          url: initial.url,
-          suggestedFilename: initial.filename,
-        });
-        await suggested;
-        onCreated.emit(complete);
-        return { tab_id: 4, x: 10, y: 10 };
-      },
-    });
-
-    expect(suggestion).toEqual({
-      filename: "BrowserSkill/tr_21/candidate-first.bin",
-      conflictAction: "overwrite",
-    });
-    expect(result).toMatchObject({ item: { id: 21, state: "complete" } });
-  });
-
-  it("removes a completed download when the final size exceeds the limit", async () => {
-    const onCreated = fakeEvent<(item: chrome.downloads.DownloadItem) => void>();
-    const onChanged = fakeEvent<(delta: chrome.downloads.DownloadDelta) => void>();
-    const onDeterminingFilename =
-      fakeEvent<
-        (
-          item: chrome.downloads.DownloadItem,
-          suggest: (suggestion?: chrome.downloads.DownloadFilenameSuggestion) => void,
-        ) => void | true
-      >();
-    const initial = {
-      id: 22,
-      url: "https://example.test/oversized.bin",
-      finalUrl: "https://example.test/oversized.bin",
-      filename: "oversized.bin",
-      state: "in_progress",
-      fileSize: -1,
-      totalBytes: -1,
-      bytesReceived: 0,
-    } as chrome.downloads.DownloadItem;
-    const complete = {
-      ...initial,
-      filename: "/profile/Downloads/BrowserSkill/tr_22/oversized.bin",
-      state: "complete",
-      fileSize: 8,
-      totalBytes: 8,
-      bytesReceived: 8,
-    } as chrome.downloads.DownloadItem;
-    const downloads: DownloadsApi = {
-      onCreated,
-      onChanged,
-      onDeterminingFilename,
-      search: vi.fn(async () => [complete]),
-      cancel: vi.fn(async () => {}),
-      removeFile: vi.fn(async () => {}),
-    };
-    let cdpEvent: Parameters<NonNullable<CdpRunner["onEvent"]>>[0] | undefined;
-    const cdp: CdpRunner = {
-      send: vi.fn(async () => ({})) as CdpRunner["send"],
-      onEvent: (handler) => {
-        cdpEvent = handler;
-        return { dispose: vi.fn() };
-      },
-    };
-
-    const result = await captureBrowserDownload({
-      cdp,
-      target: { tabId: 4 },
-      downloads,
-      browserRelativeDir: "BrowserSkill/tr_22",
-      maxByteSize: 4,
-      timeoutMs: 1_000,
-      trigger: async () => {
-        cdpEvent?.({ tabId: 4 }, "Page.downloadWillBegin", {
-          url: initial.url,
-          suggestedFilename: initial.filename,
-        });
-        await new Promise<void>((resolve) => {
-          onDeterminingFilename.emit(initial, () => resolve());
-        });
-        onCreated.emit(initial);
-        onChanged.emit({ id: initial.id, state: { current: "complete" } });
-        return { tab_id: 4, x: 10, y: 10 };
-      },
-    });
-
-    expect(result).toMatchObject({
-      code: "cdp_failed",
-      data: { reason: "download_capture_failed", effect_state: "committed" },
-    });
-    expect(downloads.removeFile).toHaveBeenCalledWith(initial.id);
-    expect(downloads.cancel).not.toHaveBeenCalled();
-  });
-
-  it("reconciles a download that completes while cancellation is being requested", async () => {
-    const onCreated = fakeEvent<(item: chrome.downloads.DownloadItem) => void>();
-    const onChanged = fakeEvent<(delta: chrome.downloads.DownloadDelta) => void>();
-    const onDeterminingFilename =
-      fakeEvent<
-        (
-          item: chrome.downloads.DownloadItem,
-          suggest: (suggestion?: chrome.downloads.DownloadFilenameSuggestion) => void,
-        ) => void | true
-      >();
-    const initial = {
-      id: 23,
-      url: "https://example.test/racing.bin",
-      finalUrl: "https://example.test/racing.bin",
-      filename: "racing.bin",
-      state: "in_progress",
-      fileSize: -1,
-      totalBytes: -1,
-      bytesReceived: 0,
-    } as chrome.downloads.DownloadItem;
-    const complete = {
-      ...initial,
-      filename: "/profile/Downloads/BrowserSkill/tr_23/racing.bin",
-      state: "complete",
-      fileSize: 4,
-      totalBytes: 4,
-      bytesReceived: 4,
-    } as chrome.downloads.DownloadItem;
-    const downloads: DownloadsApi = {
-      onCreated,
-      onChanged,
-      onDeterminingFilename,
-      search: vi.fn().mockResolvedValueOnce([initial]).mockResolvedValueOnce([complete]),
-      cancel: vi.fn(async () => {
-        throw new Error("download already complete");
-      }),
-      removeFile: vi.fn(async () => {}),
-    };
-    let cdpEvent: Parameters<NonNullable<CdpRunner["onEvent"]>>[0] | undefined;
-    const cdp: CdpRunner = {
-      send: vi.fn(async () => ({})) as CdpRunner["send"],
-      onEvent: (handler) => {
-        cdpEvent = handler;
-        return { dispose: vi.fn() };
-      },
-    };
-
-    const result = await captureBrowserDownload({
-      cdp,
-      target: { tabId: 4 },
-      downloads,
-      browserRelativeDir: "BrowserSkill/tr_23",
-      timeoutMs: 80,
-      trigger: async () => {
-        cdpEvent?.({ tabId: 4 }, "Page.downloadWillBegin", {
-          url: initial.url,
-          suggestedFilename: initial.filename,
-        });
-        await new Promise<void>((resolve) => {
-          onDeterminingFilename.emit(initial, () => resolve());
-        });
-        onCreated.emit(initial);
-        return { tab_id: 4, x: 10, y: 10 };
-      },
-    });
-
-    expect(result).toMatchObject({
-      code: "cdp_failed",
-      data: { reason: "download_capture_failed", effect_state: "committed" },
-    });
-    expect(downloads.cancel).toHaveBeenCalledWith(initial.id);
-    expect(downloads.removeFile).toHaveBeenCalledWith(initial.id);
-    expect(result).not.toMatchObject({ data: { cleanup_state: "failed" } });
-  });
-
-  it("rejects ambiguous attribution without cancelling either unclaimed download", async () => {
-    const onCreated = fakeEvent<(item: chrome.downloads.DownloadItem) => void>();
-    const onChanged = fakeEvent<(delta: chrome.downloads.DownloadDelta) => void>();
-    const onDeterminingFilename =
-      fakeEvent<
-        (
-          item: chrome.downloads.DownloadItem,
-          suggest: (suggestion?: chrome.downloads.DownloadFilenameSuggestion) => void,
-        ) => void | true
-      >();
-    const downloads: DownloadsApi = {
-      onCreated,
-      onChanged,
-      onDeterminingFilename,
-      search: vi.fn(async () => []),
-      cancel: vi.fn(async () => {}),
-      removeFile: vi.fn(async () => {}),
-    };
-    let cdpEvent: Parameters<NonNullable<CdpRunner["onEvent"]>>[0] | undefined;
-    const cdp: CdpRunner = {
-      send: vi.fn(async () => ({})) as CdpRunner["send"],
-      onEvent: (handler) => {
-        cdpEvent = handler;
-        return { dispose: vi.fn() };
-      },
-    };
-    const defaults: number[] = [];
-    const candidate = (id: number) =>
-      ({
-        id,
-        url: "https://example.test/same.bin",
-        finalUrl: "https://example.test/same.bin",
-        filename: "same.bin",
-        state: "in_progress",
-      }) as chrome.downloads.DownloadItem;
-
-    const result = await captureBrowserDownload({
-      cdp,
-      target: { tabId: 4 },
-      downloads,
-      browserRelativeDir: "BrowserSkill/tr_ambiguous",
-      timeoutMs: 100,
-      trigger: async () => {
-        cdpEvent?.({ tabId: 4 }, "Page.downloadWillBegin", {
-          url: "https://example.test/same.bin",
-          suggestedFilename: "same.bin",
-        });
-        for (const id of [31, 32]) {
-          onDeterminingFilename.emit(candidate(id), (value) => {
-            if (value === undefined) defaults.push(id);
-          });
-        }
-        return { tab_id: 4, x: 10, y: 10 };
-      },
-    });
-
-    expect(defaults.sort()).toEqual([31, 32]);
-    expect(downloads.cancel).not.toHaveBeenCalled();
-    expect(result).toMatchObject({
-      code: "cdp_failed",
-      data: { effect_state: "unknown", phase: "attribution" },
-    });
-  });
-});
@@ -1,573 +0,0 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { SessionManager } from "@/session-manager/manager";
-import type { CdpRunner } from "@/tools/shared";
-import { handleFill } from "../interaction";
-
-interface ScriptParams {
-  functionDeclaration: string;
-  arguments?: Array<{ value: unknown }>;
-}
-
-async function setup(markup = '<input value="old">') {
-  document.body.innerHTML = markup;
-  const element = document.body.firstElementChild as HTMLInputElement;
-  const manager = new SessionManager({
-    agentWindow: {
-      create: async () => 100,
-      remove: async () => {},
-      ensureActiveTab: async () => 4,
-    },
-  });
-  const ctx = await manager.start("aa11");
-  ctx.refStore.set("e1", 12, { tabId: 4 });
-  const script = vi.fn(async (params: ScriptParams): Promise<unknown> => {
-    try {
-      const fn = new Function(`return (${params.functionDeclaration})`)();
-      return {
-        result: {
-          value: await fn.apply(
-            element,
-            (params.arguments ?? []).map((arg) => arg.value),
-          ),
-        },
-      };
-    } catch {
-      return { exceptionDetails: { text: "test page script failed" } };
-    }
-  });
-  // Number/email controls have a browser caret even though their selection
-  // getters return null. Model that caret instead of assuming it is at the end.
-  const hiddenCaret = { start: 0, end: 0 };
-  const moveToEnd = vi.fn(async () => {
-    if (typeof element.selectionStart === "number") {
-      element.setSelectionRange(element.value.length, element.value.length);
-    } else {
-      hiddenCaret.start = hiddenCaret.end = element.value.length;
-    }
-  });
-  const insert = vi.fn(async (text: string) => {
-    const focused = document.activeElement as HTMLInputElement;
-    if (focused.readOnly || focused.disabled) return;
-    const start = focused.selectionStart ?? hiddenCaret.start;
-    const end = focused.selectionEnd ?? hiddenCaret.end;
-    const value = focused.value.slice(0, start) + text + focused.value.slice(end);
-    focused.value = focused.maxLength >= 0 ? value.slice(0, focused.maxLength) : value;
-    hiddenCaret.start = hiddenCaret.end = Math.min(start + text.length, focused.value.length);
-    focused.dispatchEvent(new Event("input", { bubbles: true }));
-  });
-  const release = vi.fn(async () => ({}));
-  const send = vi.fn(async (_tabId: number, method: string, params?: object) => {
-    switch (method) {
-      case "DOM.describeNode":
-        return {
-          node: {
-            nodeName: element.tagName,
-            attributes: Array.from(element.attributes).flatMap((attr) => [attr.name, attr.value]),
-          },
-        };
-      case "DOM.scrollIntoViewIfNeeded":
-        return {};
-      case "DOM.focus":
-        element.focus();
-        return {};
-      case "DOM.resolveNode":
-        return { object: { objectId: "fill-target" } };
-      case "Runtime.callFunctionOn":
-        return script(params as ScriptParams);
-      case "Input.insertText":
-        await insert((params as { text: string }).text);
-        return {};
-      case "Input.dispatchKeyEvent":
-        if ((params as { commands?: string[] }).commands?.includes("moveToEndOfDocument")) {
-          await moveToEnd();
-        }
-        return {};
-      case "Runtime.releaseObject":
-        return release();
-      default:
-        throw new Error(`unexpected ${method}`);
-    }
-  });
-  return {
-    element,
-    hiddenCaret,
-    moveToEnd,
-    script,
-    insert,
-    release,
-    send,
-    fill: (value = "hello", clearBefore = true, signal?: AbortSignal) =>
-      handleFill(
-        manager,
-        { session_id: "aa11", ref: "e1", value, clear_before: clearBefore },
-        {
-          cdp: { send: send as CdpRunner["send"] },
-          tabsApi: {
-            get: async (id) => ({ id, windowId: 100, active: true }) as chrome.tabs.Tab,
-            query: async () => [{ id: 4, windowId: 100, active: true } as chrome.tabs.Tab],
-          },
-          signal,
-        },
-      ),
-  };
-}
-
-afterEach(() => {
-  vi.restoreAllMocks();
-  document.body.innerHTML = "";
-});
-
-describe("fill result verification", () => {
-  it.each([
-    "readonly",
-    "disabled",
-  ])("preserves a %s field before rejecting it", async (attribute) => {
-    const h = await setup(`<input ${attribute} value="old">`);
-    expect(await h.fill()).toMatchObject({
-      code: "invalid_params",
-      data: { reason: "target_not_fillable" },
-    });
-    expect(h.element.value).toBe("old");
-    expect(h.insert).not.toHaveBeenCalled();
-    expect(h.release).toHaveBeenCalledOnce();
-  });
-
-  it.each([
-    "checkbox",
-    "radio",
-    "range",
-    "date",
-    "file",
-  ])("rejects an unsupported %s input before clearing", async (type) => {
-    const h = await setup(`<input type="${type}">`);
-    const before = h.element.value;
-    expect(await h.fill()).toMatchObject({
-      code: "invalid_params",
-      data: { reason: "target_not_fillable" },
-    });
-    expect(h.element.value).toBe(before);
-    expect(h.insert).not.toHaveBeenCalled();
-  });
-
-  it("rejects an overlong value before clearing", async () => {
-    const h = await setup('<input maxlength="3" value="old">');
-    expect(await h.fill()).toMatchObject({
-      code: "invalid_params",
-      message: /maxlength/,
-      data: { reason: "fill_value_invalid" },
-    });
-    expect(h.element.value).toBe("old");
-    expect(h.insert).not.toHaveBeenCalled();
-  });
-
-  it.each([
-    true,
-    false,
-  ])("classifies a DOM.focus rejection on a disabled=%s target", async (disabled) => {
-    const h = await setup(`<input ${disabled ? "disabled" : ""} value="old">`);
-    const send = h.send.getMockImplementation()!;
-    h.send.mockImplementation(async (tabId, method, params) => {
-      if (method === "DOM.focus") throw new Error("Element is not focusable");
-      return send(tabId, method, params);
-    });
-    expect(await h.fill()).toMatchObject({
-      code: disabled ? "invalid_params" : "cdp_failed",
-      data: { reason: disabled ? "target_not_fillable" : "fill_failed" },
-    });
-    expect(h.element.value).toBe("old");
-    expect(h.insert).not.toHaveBeenCalled();
-    expect(h.release).toHaveBeenCalledOnce();
-  });
-
-  it("fills a background document without requiring foreground browser focus", async () => {
-    const h = await setup();
-    vi.spyOn(document, "hasFocus").mockReturnValue(false);
-    expect(await h.fill()).toMatchObject({ value_length: 5 });
-    expect(h.element.value).toBe("hello");
-  });
-
-  it("restores focus once after clearing without typing into another field", async () => {
-    const h = await setup();
-    const other = document.createElement("input");
-    document.body.append(other);
-    h.element.addEventListener("input", () => other.focus());
-    expect(await h.fill()).toMatchObject({ value_length: 5 });
-    expect(h.element.value).toBe("hello");
-    expect(other.value).toBe("");
-    expect(h.send.mock.calls.filter(([, method]) => method === "DOM.focus")).toHaveLength(2);
-  });
-
-  it.each([
-    "focus",
-    "value",
-  ])("rechecks %s after restoring focus, without retrying again", async (action) => {
-    const h = await setup();
-    const other = document.createElement("input");
-    document.body.append(other);
-    h.element.addEventListener(
-      "input",
-      () => {
-        other.focus();
-        h.element.addEventListener("focus", () => {
-          if (action === "focus") queueMicrotask(() => other.focus());
-          else h.element.value = "changed";
-        });
-      },
-      { once: true },
-    );
-    expect(await h.fill()).toMatchObject({
-      code: "cdp_failed",
-      data: { reason: action === "focus" ? "fill_focus_lost" : "fill_target_changed" },
-    });
-    expect(other.value).toBe("");
-    expect(h.insert).not.toHaveBeenCalled();
-    expect(h.send.mock.calls.filter(([, method]) => method === "DOM.focus")).toHaveLength(2);
-  });
-
-  it.each([
-    "remove",
-    "readonly",
-    "restore",
-    "microtask-restore",
-  ])("stops when clearing causes the page to %s the target", async (action) => {
-    const h = await setup();
-    h.element.addEventListener("input", () => {
-      if (action === "remove") h.element.remove();
-      if (action === "readonly") h.element.readOnly = true;
-      if (action === "restore") h.element.value = "restored";
-      if (action === "microtask-restore")
-        queueMicrotask(() => {
-          h.element.value = "restored";
-        });
-    });
-    expect(await h.fill()).toMatchObject({
-      code: "cdp_failed",
-      data: { reason: "fill_target_changed" },
-    });
-    expect(h.insert).not.toHaveBeenCalled();
-  });
-
-  it("fails when insertText is acknowledged without changing the value", async () => {
-    const h = await setup();
-    h.insert.mockImplementation(async () => {});
-    expect(await h.fill()).toMatchObject({
-      code: "cdp_failed",
-      data: { reason: "fill_value_mismatch" },
-    });
-    expect(h.release).toHaveBeenCalledOnce();
-  });
-
-  it("detects truncation when maxlength changes after preparation", async () => {
-    const h = await setup();
-    h.element.addEventListener(
-      "input",
-      () => {
-        h.element.maxLength = 3;
-      },
-      { once: true },
-    );
-    expect(await h.fill()).toMatchObject({
-      code: "cdp_failed",
-      data: { reason: "fill_value_mismatch" },
-    });
-    expect(h.element.value).toBe("hel");
-  });
-
-  it.each([
-    "input",
-    "change",
-    "microtask-change",
-  ])("detects a value reverted by the %s handler", async (event) => {
-    const h = await setup();
-    h.element.addEventListener(event === "microtask-change" ? "change" : event, () => {
-      if (event === "microtask-change")
-        queueMicrotask(() => {
-          h.element.value = "";
-        });
-      else h.element.value = "";
-    });
-    expect(await h.fill()).toMatchObject({ code: "cdp_failed", message: /expected value/ });
-  });
-
-  it("compares content rather than length without including field values in the error", async () => {
-    const h = await setup('<input type="password">');
-    h.element.addEventListener("change", () => {
-      h.element.value = "other-secret";
-    });
-    const result = await h.fill("given-secret");
-    expect(result).toMatchObject({ code: "cdp_failed", message: /expected value/ });
-    expect(JSON.stringify(result)).not.toMatch(/given-secret|other-secret/);
-  });
-
-  it("does not report success for a target replaced by a change handler", async () => {
-    const h = await setup();
-    h.element.addEventListener("change", () => h.element.replaceWith(h.element.cloneNode()));
-    expect(await h.fill()).toMatchObject({
-      code: "cdp_failed",
-      data: { reason: "fill_target_changed" },
-    });
-  });
-
-  it.each([
-    1, 2, 3, 4, 5,
-  ])("rejects script exceptions at phase %s and releases the target", async (phase) => {
-    const h = await setup();
-    vi.spyOn(document, "hasFocus").mockReturnValue(false);
-    const run = h.script.getMockImplementation()!;
-    let count = 0;
-    h.script.mockImplementation(async (params) =>
-      ++count === phase ? { exceptionDetails: { text: "page secret" } } : run(params),
-    );
-    const result = await h.fill();
-    expect(result).toMatchObject({ code: "cdp_failed", data: { reason: "fill_failed" } });
-    expect(JSON.stringify(result)).not.toContain("page secret");
-    if (phase <= 3) expect(h.insert).not.toHaveBeenCalled();
-    expect(h.release).toHaveBeenCalledOnce();
-  });
-
-  it.each([1, 2, 3, 5])("rejects missing results at phase %s", async (phase) => {
-    const h = await setup();
-    vi.spyOn(document, "hasFocus").mockReturnValue(false);
-    const run = h.script.getMockImplementation()!;
-    let count = 0;
-    h.script.mockImplementation(async (params) =>
-      ++count === phase ? { result: { type: "undefined" } } : run(params),
-    );
-    expect(await h.fill()).toMatchObject({ code: "cdp_failed" });
-    if (phase <= 3) expect(h.insert).not.toHaveBeenCalled();
-  });
-
-  it.each(["input", "change"])("checks state after nested microtasks from %s", async (event) => {
-    const h = await setup();
-    h.element.addEventListener(event, () => {
-      queueMicrotask(() =>
-        queueMicrotask(() => {
-          h.element.value = "reverted";
-        }),
-      );
-    });
-    expect(await h.fill()).toMatchObject({ code: "cdp_failed" });
-    if (event === "input") expect(h.insert).not.toHaveBeenCalled();
-  });
-
-  it.each([
-    "<input>",
-    '<input type="password">',
-    "<textarea></textarea>",
-  ])("verifies successful text in %s", async (markup) => {
-    const h = await setup(markup);
-    expect(await h.fill("你好🙂")).toMatchObject({ value_length: 4 });
-    expect(h.element.value).toBe("你好🙂");
-    expect(h.release).toHaveBeenCalledOnce();
-  });
-
-  it("verifies append against the old value plus the requested text", async () => {
-    const h = await setup();
-    h.element.focus();
-    h.element.setSelectionRange(3, 3);
-    expect(await h.fill("!", false)).toMatchObject({ value_length: 4 });
-    expect(h.element.value).toBe("old!");
-  });
-
-  it.each([
-    ["<textarea></textarea>", "a\r\nb", "a\nb"],
-    ["<input>", "a\nb", "a b"],
-    ["<input>", "a\r\nb", "a b"],
-    [
-      '<input type="email" multiple>',
-      " a@example.com , b@example.com ",
-      "a@example.com,b@example.com",
-    ],
-  ])("accepts native normalization for %s", async (markup, requested, normalized) => {
-    if (markup.startsWith("<textarea")) {
-      // Happy DOM does not implement Chrome's textarea line-ending normalization.
-      const setter = Object.getOwnPropertyDescriptor(HTMLTextAreaElement.prototype, "value")!.set!;
-      vi.spyOn(HTMLTextAreaElement.prototype, "value", "set").mockImplementation(function (
-        this: HTMLTextAreaElement,
-        value,
-      ) {
-        setter.call(this, value.replace(/\r\n?/g, "\n"));
-      });
-    }
-    const h = await setup(markup);
-    h.insert.mockImplementation(async () => {
-      h.element.value = normalized;
-    });
-    expect(await h.fill(requested)).toMatchObject({ value_length: normalized.length });
-  });
-
-  it("does not count an editable padding break as an extra typed character", async () => {
-    const h = await setup('<div contenteditable="true" tabindex="0"></div>');
-    // These two layout/editability properties are missing in Happy DOM.
-    let innerText = "";
-    Object.defineProperty(h.element, "isContentEditable", { get: () => true });
-    Object.defineProperty(h.element, "innerText", { get: () => innerText });
-    h.insert.mockImplementation(async () => {
-      h.element.innerHTML = "one<div><br></div>";
-      innerText = "one\n\n";
-    });
-    expect(await h.fill("one\n")).toMatchObject({ value_length: 4 });
-  });
-
-  it.each([
-    [0, 0],
-    [1, 1],
-    [0, 3],
-  ])("appends after moving selection %s:%s to the end", async (start, end) => {
-    const h = await setup();
-    h.element.focus();
-    h.element.setSelectionRange(start, end);
-    expect(await h.fill("🙂", false)).toMatchObject({ value_length: 5 });
-    expect(h.element.value).toBe("old🙂");
-  });
-
-  it.each(
-    ["number", "email"].flatMap((type) =>
-      [
-        [0, 0],
-        [1, 1],
-        [0, 2],
-      ].map(([start, end]) => ({ type, start, end })),
-    ),
-  )("appends to $type from selection $start:$end without using its unsupported API", async ({
-    type,
-    start,
-    end,
-  }) => {
-    const h = await setup(`<input type="${type}" value="12">`);
-    Object.assign(h.hiddenCaret, { start, end });
-    vi.spyOn(h.element, "selectionStart", "get").mockReturnValue(null);
-    vi.spyOn(h.element, "selectionEnd", "get").mockReturnValue(null);
-    const selection = vi.spyOn(h.element, "setSelectionRange").mockImplementation(() => {
-      throw new DOMException("unsupported", "InvalidStateError");
-    });
-    expect(await h.fill("3", false)).toMatchObject({ value_length: 3 });
-    expect(h.element.value).toBe("123");
-    expect(selection).not.toHaveBeenCalled();
-  });
-
-  it.each([
-    "number",
-    "email",
-  ])("does not report successful %s append when the caret command is ignored", async (type) => {
-    const h = await setup(`<input type="${type}" value="12">`);
-    vi.spyOn(h.element, "selectionStart", "get").mockReturnValue(null);
-    vi.spyOn(h.element, "selectionEnd", "get").mockReturnValue(null);
-    h.moveToEnd.mockResolvedValueOnce(undefined);
-    expect(await h.fill("3", false)).toMatchObject({
-      code: "cdp_failed",
-      data: { reason: "fill_value_mismatch" },
-    });
-    expect(h.element.value).toBe("312");
-    expect(h.insert).toHaveBeenCalledOnce();
-  });
-
-  it("rejects invalid number text before clearing", async () => {
-    const h = await setup('<input type="number" value="12">');
-    expect(await h.fill("abc")).toMatchObject({
-      code: "invalid_params",
-      data: { reason: "fill_value_invalid" },
-    });
-    expect(h.element.value).toBe("12");
-    expect(h.insert).not.toHaveBeenCalled();
-  });
-
-  it("reports page formatting as unconfirmed without retrying the write", async () => {
-    const h = await setup();
-    h.element.addEventListener("change", () => {
-      h.element.value = h.element.value.toUpperCase();
-    });
-    expect(await h.fill()).toMatchObject({
-      code: "cdp_failed",
-      data: { reason: "fill_value_mismatch" },
-    });
-    expect(h.element.value).toBe("HELLO");
-    expect(h.insert).toHaveBeenCalledOnce();
-  });
-
-  it.each([
-    ["focus", false],
-    ["focus", true],
-    ["value", false],
-    ["value", true],
-    ["cancel", false],
-    ["cancel", true],
-    ["throw", false],
-    ["throw", true],
-  ] as const)("stops when positioning triggers %s (clear=%s) and releases the key", async (action, clearBefore) => {
-    const h = await setup();
-    vi.spyOn(document, "hasFocus").mockReturnValue(false);
-    const controller = new AbortController();
-    const other = document.createElement("input");
-    document.body.append(other);
-    const send = h.send.getMockImplementation()!;
-    h.send.mockImplementation(async (tabId, method, params) => {
-      const reply = await send(tabId, method, params);
-      if (
-        method === "Input.dispatchKeyEvent" &&
-        (params as { type: string }).type === "rawKeyDown"
-      ) {
-        if (action === "focus") other.focus();
-        if (action === "value") h.element.value = "changed";
-        if (action === "cancel") controller.abort();
-        if (action === "throw") throw new Error("dispatch failed");
-      }
-      return reply;
-    });
-    const result = await h.fill("!", clearBefore, controller.signal);
-    expect(result).toMatchObject({ code: action === "cancel" ? "cancelled" : "cdp_failed" });
-    expect(h.insert).not.toHaveBeenCalled();
-    expect(other.value).toBe("");
-    expect(h.send).toHaveBeenCalledWith(
-      4,
-      "Input.dispatchKeyEvent",
-      expect.objectContaining({ type: "keyUp" }),
-    );
-    expect(h.release).toHaveBeenCalledOnce();
-  });
-
-  it.each([true, false])("verifies an empty request with clear_before=%s", async (clearBefore) => {
-    const h = await setup();
-    expect(await h.fill("", clearBefore)).toMatchObject({ value_length: clearBefore ? 0 : 3 });
-    expect(h.element.value).toBe(clearBefore ? "" : "old");
-    expect(h.insert).not.toHaveBeenCalled();
-  });
-
-  it("cancels after insertion without sending change events", async () => {
-    const h = await setup();
-    const controller = new AbortController();
-    h.insert.mockImplementation(async () => controller.abort());
-    expect(await h.fill("hello", true, controller.signal)).toMatchObject({ code: "cancelled" });
-    expect(h.script).toHaveBeenCalledTimes(2);
-    expect(h.release).toHaveBeenCalledOnce();
-  });
-
-  it("cancels after resolving the remote object without clearing the field", async () => {
-    const h = await setup();
-    const controller = new AbortController();
-    const send = h.send.getMockImplementation()!;
-    h.send.mockImplementation(async (tabId, method, params) => {
-      const result = await send(tabId, method, params);
-      if (method === "DOM.resolveNode") controller.abort();
-      return result;
-    });
-    expect(await h.fill("hello", true, controller.signal)).toMatchObject({ code: "cancelled" });
-    expect(h.element.value).toBe("old");
-    expect(h.script).not.toHaveBeenCalled();
-    expect(h.release).toHaveBeenCalledOnce();
-  });
-
-  it("honors cancellation during verification", async () => {
-    const h = await setup();
-    const controller = new AbortController();
-    h.element.addEventListener("change", () => controller.abort());
-    expect(await h.fill("hello", true, controller.signal)).toMatchObject({ code: "cancelled" });
-    expect(h.release).toHaveBeenCalledOnce();
-  });
-
-  it("keeps the verified outcome when releasing the remote object fails", async () => {
-    const h = await setup();
-    h.release.mockRejectedValueOnce(new Error("target closed"));
-    expect(await h.fill()).toMatchObject({ value_length: 5 });
-  });
-});
@@ -1,5 +1,5 @@
 import { describe, expect, it, vi } from "vitest";
-import { resolveNodeGeometry } from "../frame-geometry";
+import { resolveFrameProjection, resolveNodeGeometry } from "../frame-geometry";
 import {
  clipPolygon,
  polygonArea,
@@ -10,7 +10,6 @@ import {
  rectPolygon,
  regionBounds,
 } from "../geometry";
-import { GeometryContext } from "../geometry/frame-context";
 import type { CdpRunner } from "../shared";

 describe("frame geometry projection", () => {
@@ -83,24 +82,28 @@ describe("frame geometry projection", () => {
        throw new Error(`unexpected child command ${method}`);
      }) as CdpRunner["sendToTarget"],
    };
-    const projection = await new GeometryContext(cdp, 4, {
-      rootFrameId: "main",
-      frames: [
-        { frameId: "main", target: { tabId: 4 } },
-        {
-          frameId: "same-process-parent",
-          parentFrameId: "main",
-          ownerBackendNodeId: 10,
-          target: { tabId: 4 },
-        },
-        {
-          frameId: "oopif",
-          parentFrameId: "same-process-parent",
-          ownerBackendNodeId: 20,
-          target: { tabId: 4, sessionId: "oopif-session" },
-        },
-      ],
-    }).targetProjection("oopif");
+    const projection = await resolveFrameProjection(
+      cdp,
+      {
+        rootFrameId: "main",
+        frames: [
+          { frameId: "main", target: { tabId: 4 } },
+          {
+            frameId: "same-process-parent",
+            parentFrameId: "main",
+            ownerBackendNodeId: 10,
+            target: { tabId: 4 },
+          },
+          {
+            frameId: "oopif",
+            parentFrameId: "same-process-parent",
+            ownerBackendNodeId: 20,
+            target: { tabId: 4, sessionId: "oopif-session" },
+          },
+        ],
+      },
+      "oopif",
+    );

    expect(projection?.edges).toEqual([
      {
@@ -166,7 +169,6 @@ describe("frame geometry projection", () => {
    expect(geometry).toMatchObject({
      topBounds: { x: 100, y: 100, width: 200, height: 100 },
      actionPoint: { x: 200, y: 150 },
-      targetActionPoint: { x: 100, y: 50 },
    });
  });

@@ -259,7 +261,6 @@ describe("frame geometry projection", () => {
    expect(geometry).toMatchObject({
      topBounds: { x: 100, y: 100, width: 200, height: 100 },
      actionPoint: { x: 200, y: 150 },
-      targetActionPoint: { x: 200, y: 150 },
    });
  });

@@ -1,464 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-import type { CdpFrameGraph } from "@/browser-driver/frame-graph";
-import { resolveNodeGeometry } from "../frame-geometry";
-import { rectPolygon } from "../geometry";
-import {
-  projectSnapshotRect,
-  screenshotPageRect,
-  snapshotCoordinates,
-  snapshotViewportRect,
-} from "../geometry/coordinate-types";
-import { GeometryContext, snapshotLayoutScale } from "../geometry/frame-context";
-import type { CdpRunner } from "../shared";
-
-const target = { tabId: 4 };
-const graph: CdpFrameGraph = {
-  rootFrameId: "main",
-  frames: [
-    { frameId: "main", target },
-    { frameId: "child", parentFrameId: "main", ownerBackendNodeId: 10, target },
-  ],
-};
-
-function driver() {
-  const send = vi.fn(async (_tab: number, method: string): Promise<object> => {
-    if (method === "Page.getLayoutMetrics")
-      return {
-        visualViewport: { clientWidth: 1000 },
-        cssVisualViewport: { clientWidth: 1000 },
-        cssLayoutViewport: { clientWidth: 1000, clientHeight: 1000 },
-      };
-    if (method === "DOM.getBoxModel")
-      return { model: { content: [52.5, 612.5, 427.5, 612.5, 427.5, 862.5, 52.5, 862.5] } };
-    if (method === "DOM.resolveNode") return { object: { objectId: "owner" } };
-    if (method === "Runtime.callFunctionOn")
-      return { result: { value: { width: 300, height: 200 } } };
-    if (method === "Runtime.releaseObject") return {};
-    throw new Error(method);
-  });
-  return { send: send as CdpRunner["send"], getFrameGraph: vi.fn(async () => graph), calls: send };
-}
-
-describe("measurement geometry context", () => {
-  it.each([0.8, 1, 1.25, 2])("normalizes snapshot layout units at scale %s", (scale) => {
-    const measured = snapshotLayoutScale({
-      visualViewport: { clientWidth: 997.25, zoom: 1.1 },
-      cssVisualViewport: { clientWidth: 997.25 / scale, zoom: 1.1 },
-      // Rounded layout dimensions must not supply the scale.
-      layoutViewport: { clientWidth: 997 },
-      cssLayoutViewport: { clientWidth: Math.floor(997.25 / scale) },
-    });
-    expect(measured).toBeCloseTo(scale, 12);
-    const coordinates = snapshotCoordinates(
-      { scrollOffsetX: 80 * scale, scrollOffsetY: 200 * scale },
-      measured,
-      { x: 999, y: 999 },
-    );
-    expect(
-      snapshotViewportRect(
-        [160 * scale, 320 * scale, 120 * scale, 40 * scale],
-        { target },
-        coordinates,
-      )?.rect,
-    ).toEqual({ x: 80, y: 120, width: 120, height: 40 });
-  });
-
-  it("uses CSS root scroll only for missing snapshot offsets, without scaling it twice", () => {
-    const coordinates = snapshotCoordinates({ scrollOffsetX: 80 }, 2, { x: 999, y: 100 });
-    expect(snapshotViewportRect([200, 800, 240, 80], { target }, coordinates)?.rect).toEqual({
-      x: 60,
-      y: 300,
-      width: 120,
-      height: 40,
-    });
-    expect(snapshotCoordinates({ scrollOffsetX: 0 }, 2)).toBeNull();
-    expect(
-      snapshotCoordinates({ scrollOffsetX: NaN, scrollOffsetY: 0 }, 2, { x: 0, y: 0 }),
-    ).toBeNull();
-  });
-
-  it("does not infer snapshot units from missing, invalid, or CSS-only metrics", () => {
-    expect(snapshotLayoutScale({ cssLayoutViewport: { clientWidth: 800 } })).toBeNull();
-    for (const raw of [0, -1, NaN, Infinity]) {
-      expect(
-        snapshotLayoutScale({
-          visualViewport: { clientWidth: raw },
-          cssVisualViewport: { clientWidth: 800 },
-        }),
-      ).toBeNull();
-    }
-    expect(
-      snapshotLayoutScale({
-        visualViewport: { clientWidth: 0, clientHeight: 600 },
-        cssVisualViewport: { clientWidth: 0, clientHeight: 300 },
-      }),
-    ).toBe(2);
-    expect(snapshotCoordinates({ scrollOffsetX: 0, scrollOffsetY: 0 }, null)).toBeNull();
-    expect(snapshotViewportRect([10, 20, 120, 40], { target }, null)).toBeNull();
-  });
-
-  it("shares in-flight frame measurements, but never shares them with the next context", async () => {
-    const cdp = driver();
-    const context = new GeometryContext(cdp, 4);
-    const results = await Promise.all(
-      Array.from({ length: 20 }, () => context.targetProjection("child")),
-    );
-    expect(results.every((value) => value === results[0])).toBe(true);
-    expect(cdp.getFrameGraph).toHaveBeenCalledTimes(1);
-    expect(cdp.calls.mock.calls.map(([, method]) => method)).toEqual([
-      "Page.getLayoutMetrics",
-      "DOM.getBoxModel",
-    ]);
-    await new GeometryContext(cdp, 4).targetProjection("child");
-    expect(cdp.getFrameGraph).toHaveBeenCalledTimes(2);
-    expect(cdp.calls.mock.calls).toHaveLength(4);
-  });
-
-  it("projects frame-local snapshot CSS bounds through the scaled owner content quad", async () => {
-    const cdp = driver();
-    const context = new GeometryContext(cdp, 4);
-    const source = { target, frameId: "child" };
-    const projection = await context.snapshotProjection(source, 10, [], {
-      width: 1000,
-      height: 1000,
-    });
-    if (projection.status !== "available") throw new Error("expected available projection");
-    const input = snapshotViewportRect([17, 23, 120, 40], source, {
-      layoutUnitsPerCssPixel: 1,
-      scrollCss: { x: 0, y: 0 },
-    });
-    expect(projectSnapshotRect(input!, projection.projection)).toEqual({
-      x: 73.75,
-      y: 641.25,
-      width: 150,
-      height: 50,
-    });
-    const scrolled = snapshotViewportRect([17, 23, 120, 40], source, {
-      layoutUnitsPerCssPixel: 1,
-      scrollCss: { x: 0, y: 10 },
-    });
-    expect(projectSnapshotRect(scrolled!, projection.projection)?.y).toBe(628.75);
-    await context.snapshotProjection(source, 10, [], { width: 1000, height: 1000 });
-    expect(cdp.calls.mock.calls.filter(([, method]) => method === "DOM.resolveNode")).toHaveLength(
-      1,
-    );
-    expect(
-      cdp.calls.mock.calls.filter(([, method]) => method === "Runtime.releaseObject"),
-    ).toHaveLength(1);
-  });
-
-  it("falls back only for missing or invalid batch entries and does not reuse sizes across contexts", async () => {
-    const cdp = driver();
-    const original = cdp.send;
-    const calls: string[] = [];
-    cdp.send = async (tabId, method, params) => {
-      calls.push(method);
-      if (method === "Runtime.evaluate")
-        return {
-          result: {
-            deepSerializedValue: {
-              type: "array",
-              value: [
-                {
-                  type: "array",
-                  value: [
-                    { type: "node", value: { backendNodeId: 10 } },
-                    { type: "string", value: '{"width":300,"height":200}' },
-                  ],
-                },
-                {
-                  type: "array",
-                  value: [
-                    { type: "node", value: { backendNodeId: 11 } },
-                    { type: "string", value: '{"width":0,"height":200}' },
-                  ],
-                },
-              ],
-            },
-          },
-        } as never;
-      if (method === "Runtime.releaseObjectGroup") return {} as never;
-      return original(tabId, method, params);
-    };
-    const context = new GeometryContext(cdp, 4);
-    context.registerSnapshotOwners(target, new Set([10, 11]));
-    const values = await Promise.all(
-      [10, 11].map((id) =>
-        context.snapshotProjection({ target, frameId: String(id) }, id, [], {
-          width: 1000,
-          height: 1000,
-        }),
-      ),
-    );
-    expect(values.every((value) => value.status === "available")).toBe(true);
-    expect(calls.filter((method) => method === "DOM.resolveNode")).toHaveLength(1);
-    expect(calls.filter((method) => method === "Runtime.evaluate")).toHaveLength(1);
-    await new GeometryContext(cdp, 4).snapshotProjection({ target, frameId: "child" }, 10, [], {
-      width: 1000,
-      height: 1000,
-    });
-    expect(calls.filter((method) => method === "DOM.resolveNode")).toHaveLength(2);
-  });
-
-  it("waits for batch object cleanup and propagates cancellation", async () => {
-    const cdp = driver();
-    const original = cdp.send;
-    const controller = new AbortController();
-    let release!: () => void;
-    let cleanup!: () => void;
-    const started = new Promise<void>((resolve) => {
-      cleanup = resolve;
-    });
-    cdp.send = async (tabId, method, params) => {
-      if (method === "Runtime.evaluate") return {} as never;
-      if (method === "Runtime.releaseObjectGroup") {
-        cleanup();
-        await new Promise<void>((resolve) => {
-          release = resolve;
-        });
-        return {} as never;
-      }
-      return original(tabId, method, params);
-    };
-    const context = new GeometryContext(cdp, 4, undefined, controller.signal);
-    context.registerSnapshotOwners(target, new Set([10, 11]));
-    let settled = false;
-    const operation = context
-      .snapshotProjection({ target, frameId: "child" }, 10, [], { width: 1000, height: 1000 })
-      .finally(() => {
-        settled = true;
-      });
-    const rejected = expect(operation).rejects.toMatchObject({ name: "AbortError" });
-    await started;
-    controller.abort();
-    expect(settled).toBe(false);
-    release();
-    await rejected;
-    expect(cdp.calls.mock.calls.some(([, method]) => method === "DOM.resolveNode")).toBe(false);
-  });
-
-  it("rejects owner mismatches and invalid numeric bounds", () => {
-    const input = snapshotViewportRect(
-      [30, 50, 120, 40],
-      { target, frameId: "main" },
-      { layoutUnitsPerCssPixel: 1, scrollCss: { x: 10, y: 20 } },
-    )!;
-    const projection = {
-      source: { target, frameId: "main" },
-      geometry: { sourceClips: [], edges: [], topViewport: { width: 800, height: 600 } },
-    };
-    expect(projectSnapshotRect(input, projection)).toEqual({
-      x: 20,
-      y: 30,
-      width: 120,
-      height: 40,
-    });
-    expect(
-      projectSnapshotRect(input, { ...projection, source: { target, frameId: "other" } }),
-    ).toBeNull();
-    expect(
-      projectSnapshotRect(input, {
-        ...projection,
-        source: { target: { tabId: 5 }, frameId: "main" },
-      }),
-    ).toBeNull();
-    expect(
-      snapshotViewportRect(
-        [0, 0, NaN, 40],
-        { target },
-        { layoutUnitsPerCssPixel: 1, scrollCss: { x: 0, y: 0 } },
-      ),
-    ).toBeNull();
-    expect(
-      snapshotViewportRect(
-        [0, 0, 10, 40],
-        { target },
-        { layoutUnitsPerCssPixel: 1, scrollCss: { x: Infinity, y: 0 } },
-      ),
-    ).toBeNull();
-  });
-
-  it("does not turn a border quad or a failed owner read into a content projection", async () => {
-    const cdp: CdpRunner = {
-      send: vi.fn(async () => ({
-        model: { border: [0, 0, 100, 0, 100, 100, 0, 100] },
-      })) as CdpRunner["send"],
-    };
-    expect(
-      await new GeometryContext(cdp, 4).snapshotProjection({ target, frameId: "child" }, 10, [], {
-        width: 100,
-        height: 100,
-      }),
-    ).toEqual({
-      status: "unavailable",
-      source: { target, frameId: "child" },
-      ownerBackendNodeId: 10,
-    });
-  });
-
-  it("keeps ancestor clips in target coordinates instead of applying nested offsets twice", async () => {
-    const cdp = driver();
-    const projection = await new GeometryContext(cdp, 4).snapshotProjection(
-      { target, frameId: "nested" },
-      10,
-      [rectPolygon({ x: 60, y: 620, w: 100, h: 100 })],
-      { width: 1000, height: 1000 },
-    );
-    if (projection.status !== "available") throw new Error("expected available projection");
-    const input = snapshotViewportRect(
-      [0, 0, 300, 200],
-      { target, frameId: "nested" },
-      { layoutUnitsPerCssPixel: 1, scrollCss: { x: 0, y: 0 } },
-    );
-    expect(projectSnapshotRect(input!, projection.projection)).toEqual({
-      x: 60,
-      y: 620,
-      width: 100,
-      height: 100,
-    });
-  });
-
-  it("rejects malformed frame ancestry without looping", async () => {
-    const cdp = driver();
-    const cycle: CdpFrameGraph = {
-      rootFrameId: "a",
-      frames: [
-        { frameId: "a", parentFrameId: "b", target },
-        { frameId: "b", parentFrameId: "a", target },
-      ],
-    };
-    expect(await new GeometryContext(cdp, 4, cycle).targetProjection("a")).toBeNull();
-    expect(cdp.calls).not.toHaveBeenCalled();
-    const orphan: CdpFrameGraph = {
-      rootFrameId: "a",
-      frames: [{ frameId: "a", parentFrameId: "missing", target }],
-    };
-    expect(await new GeometryContext(cdp, 4, orphan).targetProjection("a")).toBeNull();
-  });
-
-  it("rejects a live node whose frame belongs to another target before any DOM input", async () => {
-    const cdp = driver();
-    expect(
-      await resolveNodeGeometry(
-        cdp,
-        4,
-        { target: { tabId: 4, sessionId: "wrong" }, frameId: "child", backendNodeId: 20 },
-        { scrollIntoView: true },
-      ),
-    ).toMatchObject({ code: "cdp_failed" });
-    expect(cdp.calls).not.toHaveBeenCalled();
-  });
-
-  it("bounds concurrent measurements and does not dispatch queued reads after cancellation", async () => {
-    let active = 0;
-    let peak = 0;
-    const release: Array<() => void> = [];
-    const send = vi.fn(async () => {
-      active++;
-      peak = Math.max(peak, active);
-      await new Promise<void>((resolve) => release.push(resolve));
-      active--;
-      return {
-        visualViewport: { clientWidth: 1000 },
-        cssVisualViewport: { clientWidth: 1000 },
-        cssLayoutViewport: { clientWidth: 100, clientHeight: 100 },
-      };
-    });
-    const controller = new AbortController();
-    const context = new GeometryContext(
-      { send: send as CdpRunner["send"] },
-      4,
-      undefined,
-      controller.signal,
-    );
-    const tasks = Array.from({ length: 8 }, (_, index) =>
-      context.viewport({ tabId: 4, sessionId: String(index) }),
-    );
-    const settled = Promise.allSettled(tasks);
-    expect(send).toHaveBeenCalledTimes(4);
-    controller.abort();
-    for (const done of release) done();
-    const results = await settled;
-    expect(peak).toBe(4);
-    expect(send).toHaveBeenCalledTimes(4);
-    expect(results.filter((item) => item.status === "rejected")).toHaveLength(4);
-  });
-
-  it("releases an owner object even when cancellation arrives before its viewport read", async () => {
-    const controller = new AbortController();
-    const cdp = driver();
-    const original = cdp.calls.getMockImplementation()!;
-    cdp.calls.mockImplementation(async (tab, method) => {
-      const result = await original(tab, method);
-      if (method === "DOM.resolveNode") controller.abort();
-      return result;
-    });
-    const context = new GeometryContext(cdp, 4, undefined, controller.signal);
-    await expect(
-      context.snapshotProjection({ target, frameId: "child" }, 10, [], {
-        width: 1000,
-        height: 1000,
-      }),
-    ).rejects.toMatchObject({ name: "AbortError" });
-    expect(cdp.calls.mock.calls.map(([, method]) => method)).toEqual([
-      "DOM.getBoxModel",
-      "DOM.resolveNode",
-      "Runtime.releaseObject",
-    ]);
-  });
-
-  it("reads live owner geometry only after scrolling", async () => {
-    const cdp = driver();
-    const original = cdp.calls.getMockImplementation()!;
-    let scrolled = false;
-    cdp.calls.mockImplementation(async (tab, method) => {
-      if (method === "DOM.scrollIntoViewIfNeeded") {
-        scrolled = true;
-        return {};
-      }
-      if (method === "DOM.getContentQuads") {
-        expect(scrolled).toBe(true);
-        return { quads: [[60, 620, 100, 620, 100, 640, 60, 640]] };
-      }
-      if (method === "DOM.getBoxModel") expect(scrolled).toBe(true);
-      return original(tab, method);
-    });
-    expect(
-      await resolveNodeGeometry(
-        cdp,
-        4,
-        { target, frameId: "child", backendNodeId: 20 },
-        { scrollIntoView: true },
-      ),
-    ).toMatchObject({ topBounds: { x: 60, y: 620, width: 40, height: 20 } });
-    expect(cdp.getFrameGraph).toHaveBeenCalledTimes(1);
-    expect(cdp.calls.mock.calls.filter(([, method]) => method === "DOM.getBoxModel")).toHaveLength(
-      1,
-    );
-  });
-
-  it("adapts viewport CSS bounds to page DIP with scroll and browser zoom, never raster DPR", () => {
-    const viewport = { width: 1600, height: 1000, scrollX: 10, scrollY: 100, cssToDip: 0.9 };
-    const clip = screenshotPageRect({ x: 20, y: 30, width: 120, height: 40 }, viewport);
-    expect(clip).toEqual({ space: "page-dip", rect: { x: 27, y: 117, width: 108, height: 36 } });
-    expect(
-      screenshotPageRect({ x: 20, y: 30, width: 120, height: 40 }, { ...viewport, cssToDip: NaN }),
-    ).toBeNull();
-    expect(
-      screenshotPageRect({ x: 20, y: 30, width: 120, height: 40 }, { ...viewport, cssToDip: 0 }),
-    ).toBeNull();
-  });
-
-  it("retries a rejected measurement only in a new operation", async () => {
-    const cdp = driver();
-    cdp.calls.mockRejectedValueOnce(new Error("unavailable"));
-    const context = new GeometryContext(cdp, 4);
-    await expect(context.viewport(target)).rejects.toThrow("unavailable");
-    await expect(context.viewport(target)).rejects.toThrow("unavailable");
-    expect(cdp.calls).toHaveBeenCalledTimes(1);
-    expect(await new GeometryContext(cdp, 4).viewport(target)).toEqual({
-      width: 1000,
-      height: 1000,
-    });
-  });
-});
@@ -21,7 +21,7 @@ function fakeAgentWindow(ids: number[]) {
      return id;
    }),
    remove: vi.fn(async () => {}),
-    ensureActiveTab: vi.fn(async () => 1),
+    ensureActiveTab: vi.fn(async () => {}),
  };
 }

@@ -456,6 +456,30 @@ describe("handleClick", () => {
    expect(res).toMatchObject({ code: "not_found", data: { reason: "selector_not_found" } });
  });

+  it("returns invalid_selector when Chrome rejects non-CSS selector syntax", async () => {
+    const sm = new SessionManager({ agentWindow: fakeAgentWindow([100]) });
+    await sm.start("aa11");
+    const fake = makeFakeCdp({
+      "DOM.getDocument": () => ({ root: { nodeId: 1 } }),
+      "DOM.querySelector": () => {
+        throw new Error('{"code":-32000,"message":"DOM Error while querying"}');
+      },
+    });
+    const res = await handleClick(
+      sm,
+      { session_id: "aa11", selector: "text=下午 12~18点" },
+      { cdp: fake.cdp, tabsApi: fake.tabsApi },
+    );
+    expect(res).toMatchObject({
+      code: "invalid_params",
+      message: "selector is not valid CSS: text=下午 12~18点",
+      data: {
+        reason: "invalid_selector",
+        selector: "text=下午 12~18点",
+      },
+    });
+  });
+
  it("respects the AbortSignal", async () => {
    const sm = new SessionManager({ agentWindow: fakeAgentWindow([100]) });
    const ctx = await sm.start("aa11");
@@ -540,21 +564,6 @@ describe("handleHover", () => {
  });
 });

-function successfulFillScript(params: unknown) {
-  const script = params as { arguments?: Array<{ value: unknown }>; functionDeclaration: string };
-  const args = script.arguments ?? [];
-  return {
-    result: {
-      value:
-        args.length === 2
-          ? { before: "", expected: args[0].value }
-          : script.functionDeclaration.startsWith("function(expected)")
-            ? { connected: true, matches: true, valueLength: String(args[0].value).length }
-            : "ready",
-    },
-  };
-}
-
 describe("handleFill", () => {
  it("returns not_found for unknown ref", async () => {
    const sm = new SessionManager({ agentWindow: fakeAgentWindow([100]) });
@@ -601,8 +610,7 @@ describe("handleFill", () => {
      "DOM.scrollIntoViewIfNeeded": () => ({}),
      "DOM.focus": () => ({}),
      "DOM.resolveNode": () => ({ object: { objectId: "obj-1" } }),
-      "Runtime.callFunctionOn": successfulFillScript,
-      "Runtime.releaseObject": () => ({}),
+      "Runtime.callFunctionOn": () => ({ result: { type: "undefined" } }),
      "Input.insertText": () => ({}),
    });
    const res = await handleFill(
@@ -616,12 +624,13 @@ describe("handleFill", () => {
    expect(res.used_ref).toBe("e1");
    const insert = fake.sent.find((c) => c.method === "Input.insertText");
    expect(insert?.params).toEqual({ text: "hello" });
-    // Foreground replacement needs no extra caret-positioning round trip.
+    // clear_before defaults to true → callFunctionOn invoked once to
+    // clear, once to fire input/change after typing.
    const callFns = fake.sent.filter((c) => c.method === "Runtime.callFunctionOn");
-    expect(callFns).toHaveLength(4);
+    expect(callFns.length).toBeGreaterThanOrEqual(2);
  });

-  it("passes clear_before=false to preparation and verifies the result", async () => {
+  it("clear_before=false skips the wipe call", async () => {
    const sm = new SessionManager({ agentWindow: fakeAgentWindow([100]) });
    const ctx = await sm.start("aa11");
    ctx.refStore.set("e1", 1, { tabId: 4 });
@@ -633,12 +642,12 @@ describe("handleFill", () => {
      "DOM.focus": () => ({}),
      "DOM.resolveNode": () => ({ object: { objectId: "obj-2" } }),
      "Runtime.callFunctionOn": (p) => {
-        const args = (p as { arguments?: Array<{ value: unknown }> }).arguments ?? [];
-        if (args.length === 2) expect(args[1].value).toBe(false);
-        return successfulFillScript(p);
+        const fn = (p as { functionDeclaration?: string }).functionDeclaration ?? "";
+        // No "this.value = ''" clearing on a no-clear path; only the
+        // post-input dispatchEvent.
+        expect(fn).not.toMatch(/this\.value\s*=\s*''/);
+        return { result: { type: "undefined" } };
      },
-      "Input.dispatchKeyEvent": () => ({}),
-      "Runtime.releaseObject": () => ({}),
      "Input.insertText": () => ({}),
    });
    const res = await handleFill(
@@ -665,8 +674,7 @@ describe("handleFill", () => {
      "DOM.scrollIntoViewIfNeeded": () => ({}),
      "DOM.focus": () => ({}),
      "DOM.resolveNode": () => ({ object: { objectId: "obj-3" } }),
-      "Runtime.callFunctionOn": successfulFillScript,
-      "Runtime.releaseObject": () => ({}),
+      "Runtime.callFunctionOn": () => ({ result: { type: "undefined" } }),
      "Input.insertText": () => ({}),
    });
    const res = await handleFill(
@@ -1,266 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-import { SessionManager } from "@/session-manager/manager";
-import type { BrowserNavigationApi } from "../browser-navigation";
-import { handleNavigate, handleReload } from "../navigation";
-import type { CdpRunner } from "../shared";
-
-const denied = "Cannot access a chrome-extension:// URL of different extension";
-const url = "https://example.test/recovered";
-
-function event<T extends (...args: never[]) => void>() {
-  const listeners = new Set<T>();
-  return {
-    listeners,
-    addListener: (listener: T) => listeners.add(listener),
-    removeListener: (listener: T) => listeners.delete(listener),
-    fire: (...args: Parameters<T>) => {
-      for (const listener of [...listeners]) listener(...args);
-    },
-  };
-}
-
-async function fixture() {
-  const manager = new SessionManager({
-    agentWindow: {
-      create: vi.fn(async () => 100),
-      remove: vi.fn(async () => {}),
-      ensureActiveTab: vi.fn(async () => 4),
-    },
-  });
-  await manager.start("test");
-  type Listener = Parameters<BrowserNavigationApi["onCommitted"]["addListener"]>[0];
-  const events = {
-    onCommitted: event<Listener>(),
-    onDOMContentLoaded: event<Listener>(),
-    onCompleted: event<Listener>(),
-    onErrorOccurred: event<Listener>(),
-  };
-  const cdpEvents = event<Parameters<NonNullable<CdpRunner["onEvent"]>>[0]>();
-  const state = { blocked: true, destinationBlocked: false, emitIdle: true };
-  const send = vi.fn(async (_tabId: number, method: string) => {
-    if (state.blocked) throw new Error(denied);
-    if (method === "Page.getFrameTree") {
-      return { frameTree: { frame: { id: "main", loaderId: "new-loader" } } };
-    }
-    if (method === "Runtime.evaluate") return { result: { value: "complete" } };
-    if (method === "Page.setLifecycleEventsEnabled" && state.emitIdle) {
-      cdpEvents.fire({ tabId: 4 }, "Page.lifecycleEvent", {
-        frameId: "main",
-        loaderId: "new-loader",
-        name: "networkIdle",
-      });
-    }
-    if (method === "Page.navigate") return { frameId: "main", loaderId: "new-loader" };
-    return {};
-  });
-  const cdp: CdpRunner = {
-    send: send as CdpRunner["send"],
-    onEvent: (listener) => {
-      cdpEvents.addListener(listener);
-      return { dispose: () => cdpEvents.removeListener(listener) };
-    },
-  };
-  const main = { tabId: 4, frameId: 0, documentId: "new-document" };
-  const navigate = async () => {
-    state.blocked = state.destinationBlocked;
-    events.onCommitted.fire(main);
-    events.onDOMContentLoaded.fire(main);
-    events.onCompleted.fire(main);
-  };
-  const browserNavigation = { ...events, update: vi.fn(navigate), reload: vi.fn(navigate) };
-  const tab = { id: 4, windowId: 100, active: true, url } as chrome.tabs.Tab;
-  const tabsApi = { get: vi.fn(async () => tab), query: vi.fn(async () => [tab]) };
-  const deps = { cdp, tabsApi, browserNavigation, defaultTimeoutMs: 1000 };
-  const expectCleanedUp = () => {
-    for (const entry of Object.values(events)) expect(entry.listeners.size).toBe(0);
-    expect(cdpEvents.listeners.size).toBe(0);
-  };
-  return { manager, deps, state, send, events, main, cdpEvents, expectCleanedUp };
-}
-
-describe("navigation after Chrome denies extension-frame access", () => {
-  it.each([
-    "load",
-    "commit",
-    "domcontentloaded",
-    "networkidle",
-  ] as const)("recovers the same tab with the requested %s checkpoint", async (waitUntil) => {
-    const f = await fixture();
-    const result = await handleNavigate(
-      f.manager,
-      {
-        session_id: "test",
-        url,
-        wait_until: waitUntil,
-      },
-      f.deps,
-    );
-
-    expect(result).toMatchObject({ tab_id: 4, final_url: url, reached: waitUntil });
-    expect(f.deps.browserNavigation.update).toHaveBeenCalledExactlyOnceWith(4, { url });
-    expect(f.send.mock.calls.some(([, method]) => method === "Page.navigate")).toBe(false);
-    expect(f.send).toHaveBeenCalledWith(4, "Page.enable", {});
-    f.expectCleanedUp();
-  });
-
-  it("recovers reload through tabs.reload and preserves hard reload", async () => {
-    const f = await fixture();
-    const result = await handleReload(f.manager, { session_id: "test", hard: true }, f.deps);
-    expect(result).toMatchObject({ tab_id: 4, reached: "load" });
-    expect(f.deps.browserNavigation.reload).toHaveBeenCalledExactlyOnceWith(4, {
-      bypassCache: true,
-    });
-    expect(f.deps.browserNavigation.update).not.toHaveBeenCalled();
-    f.expectCleanedUp();
-  });
-
-  it("reports the restriction when reload leaves the conflicting frame present", async () => {
-    const f = await fixture();
-    f.state.destinationBlocked = true;
-    const result = await handleReload(f.manager, { session_id: "test" }, f.deps);
-    expect(result).toMatchObject({
-      code: "cdp_failed",
-      data: { reason: "cdp_extension_access_denied" },
-    });
-    expect(f.deps.browserNavigation.reload).toHaveBeenCalledOnce();
-    f.expectCleanedUp();
-  });
-
-  it("does not fall back for unrelated debugger failures", async () => {
-    const f = await fixture();
-    f.send.mockRejectedValue(new Error("Another debugger is already attached"));
-    const result = await handleNavigate(f.manager, { session_id: "test", url }, f.deps);
-    expect(result).toMatchObject({
-      code: "cdp_failed",
-      message: "Another debugger is already attached",
-    });
-    expect(f.deps.browserNavigation.update).not.toHaveBeenCalled();
-    f.expectCleanedUp();
-  });
-
-  it("does not replay navigation when a dispatched CDP command fails", async () => {
-    const f = await fixture();
-    f.state.blocked = false;
-    const send = f.send.getMockImplementation()!;
-    f.send.mockImplementation(async (tabId, method) => {
-      if (method === "Page.navigate") throw new Error(denied);
-      return send(tabId, method);
-    });
-    const result = await handleNavigate(f.manager, { session_id: "test", url }, f.deps);
-    expect(result).toMatchObject({
-      code: "cdp_failed",
-      data: { reason: "cdp_extension_access_denied" },
-    });
-    expect(f.deps.browserNavigation.update).not.toHaveBeenCalled();
-    f.expectCleanedUp();
-  });
-
-  it("keeps the Agent Window guard in front of the recovery", async () => {
-    const f = await fixture();
-    f.deps.tabsApi.get.mockResolvedValue({
-      id: 4,
-      windowId: 200,
-      active: true,
-      url,
-    } as chrome.tabs.Tab);
-    const result = await handleNavigate(f.manager, { session_id: "test", tab_id: 4, url }, f.deps);
-    expect(result).toMatchObject({ code: "permission_denied" });
-    expect(f.send).not.toHaveBeenCalled();
-    expect(f.deps.browserNavigation.update).not.toHaveBeenCalled();
-  });
-
-  it("ignores old-document, subframe, and other-tab completion events", async () => {
-    const f = await fixture();
-    f.deps.browserNavigation.update.mockImplementation(async () => {});
-    let settled = false;
-    const work = handleNavigate(f.manager, { session_id: "test", url }, f.deps).then((result) => {
-      settled = true;
-      return result;
-    });
-    await vi.waitFor(() => expect(f.deps.browserNavigation.update).toHaveBeenCalledOnce());
-    f.events.onCompleted.fire(f.main);
-    f.events.onCommitted.fire({ ...f.main, tabId: 9 });
-    f.events.onCommitted.fire({ ...f.main, frameId: 1 });
-    f.events.onCompleted.fire(f.main);
-    await Promise.resolve();
-    expect(settled).toBe(false);
-    f.events.onCommitted.fire(f.main);
-    f.events.onCompleted.fire({ ...f.main, documentId: "old-document" });
-    await Promise.resolve();
-    expect(settled).toBe(false);
-    f.state.blocked = false;
-    f.events.onCompleted.fire(f.main);
-    expect(await work).toMatchObject({ reached: "load" });
-    f.expectCleanedUp();
-  });
-
-  it("does not infer network idle from a browser load event", async () => {
-    const f = await fixture();
-    f.state.emitIdle = false;
-    const result = await handleNavigate(
-      f.manager,
-      {
-        session_id: "test",
-        url,
-        wait_until: "networkidle",
-        timeout_ms: 10,
-      },
-      f.deps,
-    );
-    expect(result).toMatchObject({ reached: "timeout" });
-    f.expectCleanedUp();
-  });
-
-  it("cleans up browser listeners on timeout", async () => {
-    const f = await fixture();
-    f.deps.browserNavigation.update.mockImplementation(async () => {});
-    const result = await handleNavigate(
-      f.manager,
-      { session_id: "test", url, timeout_ms: 10 },
-      f.deps,
-    );
-    expect(result).toMatchObject({ reached: "timeout" });
-    f.expectCleanedUp();
-  });
-
-  it("does not navigate an already-cancelled request", async () => {
-    const f = await fixture();
-    const result = await handleNavigate(
-      f.manager,
-      { session_id: "test", url },
-      {
-        ...f.deps,
-        signal: AbortSignal.abort(),
-      },
-    );
-    expect(result).toMatchObject({ code: "cancelled" });
-    expect(f.deps.browserNavigation.update).not.toHaveBeenCalled();
-    f.expectCleanedUp();
-  });
-
-  it("cleans up browser listeners when cancelled after dispatch", async () => {
-    const f = await fixture();
-    const ac = new AbortController();
-    f.deps.browserNavigation.update.mockImplementation(async () => {
-      ac.abort();
-    });
-    const result = await handleNavigate(
-      f.manager,
-      { session_id: "test", url },
-      { ...f.deps, signal: ac.signal },
-    );
-    expect(result).toMatchObject({ code: "cancelled" });
-    expect(f.deps.browserNavigation.update).toHaveBeenCalledOnce();
-    f.expectCleanedUp();
-  });
-
-  it("reports browser navigation errors and releases listeners", async () => {
-    const f = await fixture();
-    f.deps.browserNavigation.update.mockImplementation(async () => {
-      f.events.onErrorOccurred.fire({ ...f.main, error: "net::ERR_NAME_NOT_RESOLVED" });
-    });
-    const result = await handleNavigate(f.manager, { session_id: "test", url }, f.deps);
-    expect(result).toMatchObject({ code: "cdp_failed", message: "net::ERR_NAME_NOT_RESOLVED" });
-    f.expectCleanedUp();
-  });
-});
@@ -21,7 +21,7 @@ function fakeAgentWindow(ids: number[]) {
      return id;
    }),
    remove: vi.fn(async () => {}),
-    ensureActiveTab: vi.fn(async () => 1),
+    ensureActiveTab: vi.fn(async () => {}),
  };
 }

@@ -12,7 +12,7 @@ function fakeAgentWindow(ids: number[]) {
      return id;
    }),
    remove: vi.fn(async () => {}),
-    ensureActiveTab: vi.fn(async () => 1),
+    ensureActiveTab: vi.fn(async () => {}),
  };
 }

@@ -28,7 +28,7 @@ function fakeAgentWindow(ids: number[]) {
      return id;
    }),
    remove: vi.fn(async () => {}),
-    ensureActiveTab: vi.fn(async () => 1),
+    ensureActiveTab: vi.fn(async () => {}),
  };
 }

@@ -65,11 +65,7 @@ function makeFakeCdp(handlers: Record<string, (params?: object) => unknown>) {
    sent.push({ method, params });
    const handler = handlers[method];
    if (!handler && method === "Page.getLayoutMetrics") {
-      return {
-        visualViewport: { clientWidth: 1000 },
-        cssVisualViewport: { clientWidth: 1000 },
-        cssLayoutViewport: { clientWidth: 1280, clientHeight: 720 },
-      };
+      return { cssLayoutViewport: { clientWidth: 1280, clientHeight: 720 } };
    }
    if (!handler) throw new Error(`unexpected CDP call ${method}`);
    return handler(params);
@@ -270,15 +266,7 @@ describe("handleScreenshot", () => {
    expect(sent.find((c) => c.method === "Page.captureScreenshot")).toBeUndefined();
  });

-  it.each([
-    { zoom: 1, scroll: 0, expected: { x: 10, y: 20, width: 100, height: 40 } },
-    { zoom: 0.9, scroll: 100, expected: { x: 9, y: 108, width: 90, height: 36 } },
-    { zoom: 1.25, scroll: 100, expected: { x: 12.5, y: 150, width: 125, height: 50 } },
-  ])("captures a ref in page DIP at zoom $zoom and scroll $scroll", async ({
-    zoom,
-    scroll,
-    expected,
-  }) => {
+  it("captures a clipped PNG when ref is given", async () => {
    const sm = new SessionManager({ agentWindow: fakeAgentWindow([100]) });
    const ctx = await sm.start("aa11");
    ctx.refStore.set("e5", 999, { tabId: 7 });
@@ -286,10 +274,6 @@ describe("handleScreenshot", () => {
      "DOM.scrollIntoViewIfNeeded": () => ({}),
      "DOM.getContentQuads": () => ({ quads: [[10, 20, 110, 20, 110, 60, 10, 60]] }),
      "Page.captureScreenshot": () => ({ data: TINY_PNG }),
-      "Page.getLayoutMetrics": () => ({
-        cssLayoutViewport: { clientWidth: 1280, clientHeight: 720, pageX: 0, pageY: scroll },
-        cssVisualViewport: { zoom },
-      }),
    });
    const captureVisibleTab = vi.fn();
    const res = await handleScreenshot(
@@ -313,8 +297,7 @@ describe("handleScreenshot", () => {
        clip?: { x: number; y: number; width: number; height: number };
      }
    )?.clip;
-    expect(clip).toMatchObject(expected);
-    expect(sent.filter((c) => c.method === "Page.getLayoutMetrics")).toHaveLength(1);
+    expect(clip).toMatchObject({ x: 10, y: 20, width: 100, height: 40 });
  });

  it("returns not_found for unknown ref", async () => {
@@ -672,60 +655,6 @@ describe("buildVomScene", () => {
    expect(nestedInput?.parentId).toBe(result.nodes.find((item) => item.backendNodeId === 210)?.id);
  });

-  it("excludes an overlay only in its owning document when target backend ids collide", () => {
-    const owner = (id: number): CapturedNode => ({
-      backendNodeId: id,
-      parentBackendNodeId: null,
-      frameId: "main",
-      tag: "iframe",
-      attrs: {},
-      rect: { x: id * 10, y: 0, w: 200, h: 100 },
-      paintOrder: 0,
-      position: "static",
-      pointerEvents: "auto",
-    });
-    const owners = [owner(10), owner(20)];
-    const result = buildFrameVomScene(
-      [
-        {
-          frameId: "main",
-          contextScopeId: "main",
-          target: { tabId: 7 },
-          domNodes: owners,
-          axNodes: [],
-        },
-        ...["left", "right"].map((frameId, i) => ({
-          frameId,
-          contextScopeId: frameId,
-          parentFrameId: "main",
-          ownerBackendNodeId: owners[i].backendNodeId,
-          target: { tabId: 7, sessionId: frameId },
-          excludedBackendNodeIds: new Set(i === 0 ? [7] : []),
-          domNodes: [],
-          axNodes: [
-            {
-              nodeId: "button",
-              frameId,
-              backendDOMNodeId: 7,
-              role: { type: "role", value: "button" },
-              name: { type: "computedString", value: frameId + " action" },
-            },
-          ],
-        })),
-      ],
-      {
-        nodes: owners,
-        viewport: { width: 800, height: 600 },
-        iframeNodes: new Map(),
-        excludedBackendNodeIds: new Set(),
-      },
-    );
-    const rendered = renderVom(result);
-    expect(rendered.text).not.toContain("left action");
-    expect(rendered.text).toContain("right action");
-    expect(rendered.refs.find((ref) => ref.backendNodeId === 7)?.frameId).toBe("right");
-  });
-
  it("does not place a child document at the page root when its frame boundary is unresolved", () => {
    const childNode: CapturedNode = {
      backendNodeId: 101,
@@ -1975,41 +1904,36 @@ describe("buildVomScene", () => {
        backendDOMNodeId: 20,
      },
    ];
-    const scene = buildVomScene(
-      axNodes,
-      {
-        viewport: { width: 1000, height: 800 },
-        iframeNodes: new Map(),
-        excludedBackendNodeIds: new Set(),
-        nodes: [
-          {
-            backendNodeId: 10,
-            parentBackendNodeId: null,
-            tag: "body",
-            attrs: {},
-            rect: { x: 0, y: 0, w: 1000, h: 800 },
-            paintOrder: 0,
-            position: "static",
-            pointerEvents: "auto",
-          },
-          {
-            backendNodeId: 20,
-            parentBackendNodeId: 10,
-            tag: "button",
-            attrs: {},
-            rect: { x: 20, y: 20, w: 120, h: 40 },
-            paintOrder: 1,
-            position: "static",
-            pointerEvents: "auto",
-          },
-        ],
-      },
-      {
-        surfaceProbes: [
-          { triggerBackendNodeId: 20, triggerAction: "hover", subItems: ["Shoes", "Bags"] },
-        ],
-      },
-    );
+    const scene = buildVomScene(axNodes, {
+      viewport: { width: 1000, height: 800 },
+      iframeNodes: new Map(),
+      excludedBackendNodeIds: new Set(),
+      surfaceProbes: [
+        { triggerBackendNodeId: 20, triggerAction: "hover", subItems: ["Shoes", "Bags"] },
+      ],
+      nodes: [
+        {
+          backendNodeId: 10,
+          parentBackendNodeId: null,
+          tag: "body",
+          attrs: {},
+          rect: { x: 0, y: 0, w: 1000, h: 800 },
+          paintOrder: 0,
+          position: "static",
+          pointerEvents: "auto",
+        },
+        {
+          backendNodeId: 20,
+          parentBackendNodeId: 10,
+          tag: "button",
+          attrs: {},
+          rect: { x: 20, y: 20, w: 120, h: 40 },
+          paintOrder: 1,
+          position: "static",
+          pointerEvents: "auto",
+        },
+      ],
+    });

    expect(scene.surfaces).toEqual([
      { triggerId: 20, triggerAction: "hover", subItems: ["Shoes", "Bags"] },
@@ -2033,51 +1957,46 @@ describe("buildVomScene", () => {
        backendDOMNodeId: 21,
      },
    ];
-    const scene = buildVomScene(
-      axNodes,
-      {
-        viewport: { width: 1000, height: 800 },
-        iframeNodes: new Map(),
-        excludedBackendNodeIds: new Set(),
-        nodes: [
-          {
-            backendNodeId: 10,
-            parentBackendNodeId: null,
-            tag: "body",
-            attrs: {},
-            rect: { x: 0, y: 0, w: 1000, h: 800 },
-            paintOrder: 0,
-            position: "static",
-            pointerEvents: "auto",
-          },
-          {
-            backendNodeId: 20,
-            parentBackendNodeId: 10,
-            tag: "div",
-            attrs: { class: "tg-avatar" },
-            rect: { x: 900, y: 10, w: 30, h: 30 },
-            paintOrder: 1,
-            position: "static",
-            pointerEvents: "auto",
-          },
-          {
-            backendNodeId: 21,
-            parentBackendNodeId: 20,
-            tag: "div",
-            attrs: { class: "tg-avatar__inner" },
-            rect: { x: 902, y: 12, w: 26, h: 26 },
-            paintOrder: 2,
-            position: "static",
-            pointerEvents: "auto",
-          },
-        ],
-      },
-      {
-        surfaceProbes: [
-          { triggerBackendNodeId: 20, triggerAction: "hover", subItems: ["My profile"] },
-        ],
-      },
-    );
+    const scene = buildVomScene(axNodes, {
+      viewport: { width: 1000, height: 800 },
+      iframeNodes: new Map(),
+      excludedBackendNodeIds: new Set(),
+      surfaceProbes: [
+        { triggerBackendNodeId: 20, triggerAction: "hover", subItems: ["My profile"] },
+      ],
+      nodes: [
+        {
+          backendNodeId: 10,
+          parentBackendNodeId: null,
+          tag: "body",
+          attrs: {},
+          rect: { x: 0, y: 0, w: 1000, h: 800 },
+          paintOrder: 0,
+          position: "static",
+          pointerEvents: "auto",
+        },
+        {
+          backendNodeId: 20,
+          parentBackendNodeId: 10,
+          tag: "div",
+          attrs: { class: "tg-avatar" },
+          rect: { x: 900, y: 10, w: 30, h: 30 },
+          paintOrder: 1,
+          position: "static",
+          pointerEvents: "auto",
+        },
+        {
+          backendNodeId: 21,
+          parentBackendNodeId: 20,
+          tag: "div",
+          attrs: { class: "tg-avatar__inner" },
+          rect: { x: 902, y: 12, w: 26, h: 26 },
+          paintOrder: 2,
+          position: "static",
+          pointerEvents: "auto",
+        },
+      ],
+    });

    expect(renderVom(scene).text).toContain('@e1 button "image" [hover first: My profile]');
  });
@@ -2098,53 +2017,48 @@ describe("buildVomScene", () => {
        backendDOMNodeId: 21,
      },
    ];
-    const scene = buildVomScene(
-      axNodes,
-      {
-        viewport: { width: 1000, height: 800 },
-        iframeNodes: new Map(),
-        excludedBackendNodeIds: new Set(),
-        nodes: [
-          {
-            backendNodeId: 10,
-            parentBackendNodeId: null,
-            tag: "body",
-            attrs: {},
-            rect: { x: 0, y: 0, w: 1000, h: 800 },
-            paintOrder: 0,
-            position: "static",
-            pointerEvents: "auto",
-          },
-          {
-            backendNodeId: 20,
-            parentBackendNodeId: 10,
-            tag: "div",
-            attrs: { class: "tg-avatar" },
-            rect: { x: 900, y: 10, w: 30, h: 30 },
-            paintOrder: 1,
-            position: "static",
-            pointerEvents: "auto",
-          },
-          {
-            backendNodeId: 21,
-            parentBackendNodeId: 20,
-            tag: "div",
-            attrs: { class: "tg-avatar__inner" },
-            rect: { x: 902, y: 12, w: 26, h: 26 },
-            paintOrder: 2,
-            position: "static",
-            pointerEvents: "auto",
-          },
-        ],
-      },
-      {
-        surfaceProbes: [
-          { triggerBackendNodeId: 20, triggerAction: "hover", subItems: ["My profile"] },
-          { triggerBackendNodeId: 20, triggerAction: "hover", subItems: ["Sign out"] },
-          { triggerBackendNodeId: 21, triggerAction: "hover", subItems: ["Settings"] },
-        ],
-      },
-    );
+    const scene = buildVomScene(axNodes, {
+      viewport: { width: 1000, height: 800 },
+      iframeNodes: new Map(),
+      excludedBackendNodeIds: new Set(),
+      surfaceProbes: [
+        { triggerBackendNodeId: 20, triggerAction: "hover", subItems: ["My profile"] },
+        { triggerBackendNodeId: 20, triggerAction: "hover", subItems: ["Sign out"] },
+        { triggerBackendNodeId: 21, triggerAction: "hover", subItems: ["Settings"] },
+      ],
+      nodes: [
+        {
+          backendNodeId: 10,
+          parentBackendNodeId: null,
+          tag: "body",
+          attrs: {},
+          rect: { x: 0, y: 0, w: 1000, h: 800 },
+          paintOrder: 0,
+          position: "static",
+          pointerEvents: "auto",
+        },
+        {
+          backendNodeId: 20,
+          parentBackendNodeId: 10,
+          tag: "div",
+          attrs: { class: "tg-avatar" },
+          rect: { x: 900, y: 10, w: 30, h: 30 },
+          paintOrder: 1,
+          position: "static",
+          pointerEvents: "auto",
+        },
+        {
+          backendNodeId: 21,
+          parentBackendNodeId: 20,
+          tag: "div",
+          attrs: { class: "tg-avatar__inner" },
+          rect: { x: 902, y: 12, w: 26, h: 26 },
+          paintOrder: 2,
+          position: "static",
+          pointerEvents: "auto",
+        },
+      ],
+    });

    expect(scene.surfaces).toEqual([
      { triggerId: 21, triggerAction: "hover", subItems: ["My profile"] },
@@ -2167,59 +2081,54 @@ describe("buildVomScene", () => {
        backendDOMNodeId: 21,
      },
    ];
-    const scene = buildVomScene(
-      axNodes,
-      {
-        viewport: { width: 1000, height: 800 },
-        iframeNodes: new Map(),
-        excludedBackendNodeIds: new Set(),
-        nodes: [
-          {
-            backendNodeId: 10,
-            parentBackendNodeId: null,
-            tag: "body",
-            attrs: {},
-            rect: { x: 0, y: 0, w: 1000, h: 800 },
-            paintOrder: 0,
-            position: "static",
-            pointerEvents: "auto",
-            cursor: "auto",
-          },
-          {
-            backendNodeId: 20,
-            parentBackendNodeId: 10,
-            tag: "div",
-            attrs: { class: "tg-avatar" },
-            rect: { x: 900, y: 10, w: 30, h: 30 },
-            paintOrder: 1,
-            position: "static",
-            pointerEvents: "auto",
-            cursor: "pointer",
-          },
-          {
-            backendNodeId: 21,
-            parentBackendNodeId: 20,
-            tag: "div",
-            attrs: { class: "tg-avatar__inner" },
-            rect: { x: 902, y: 12, w: 26, h: 26 },
-            paintOrder: 2,
-            position: "static",
-            pointerEvents: "auto",
-            cursor: "pointer",
-          },
-        ],
-      },
-      {
-        surfaceProbes: [
-          {
-            triggerBackendNodeId: 20,
-            triggerPoint: { x: 915, y: 25 },
-            triggerAction: "hover",
-            subItems: ["My profile", "Sign out"],
-          },
-        ],
-      },
-    );
+    const scene = buildVomScene(axNodes, {
+      viewport: { width: 1000, height: 800 },
+      iframeNodes: new Map(),
+      excludedBackendNodeIds: new Set(),
+      surfaceProbes: [
+        {
+          triggerBackendNodeId: 20,
+          triggerPoint: { x: 915, y: 25 },
+          triggerAction: "hover",
+          subItems: ["My profile", "Sign out"],
+        },
+      ],
+      nodes: [
+        {
+          backendNodeId: 10,
+          parentBackendNodeId: null,
+          tag: "body",
+          attrs: {},
+          rect: { x: 0, y: 0, w: 1000, h: 800 },
+          paintOrder: 0,
+          position: "static",
+          pointerEvents: "auto",
+          cursor: "auto",
+        },
+        {
+          backendNodeId: 20,
+          parentBackendNodeId: 10,
+          tag: "div",
+          attrs: { class: "tg-avatar" },
+          rect: { x: 900, y: 10, w: 30, h: 30 },
+          paintOrder: 1,
+          position: "static",
+          pointerEvents: "auto",
+          cursor: "pointer",
+        },
+        {
+          backendNodeId: 21,
+          parentBackendNodeId: 20,
+          tag: "div",
+          attrs: { class: "tg-avatar__inner" },
+          rect: { x: 902, y: 12, w: 26, h: 26 },
+          paintOrder: 2,
+          position: "static",
+          pointerEvents: "auto",
+          cursor: "pointer",
+        },
+      ],
+    });

    expect(scene.surfaces).toEqual([
      { triggerId: 20, triggerAction: "hover", subItems: ["My profile", "Sign out"] },
@@ -2245,46 +2154,41 @@ describe("buildVomScene", () => {
        backendDOMNodeId: 42,
      },
    ];
-    const scene = buildVomScene(
-      axNodes,
-      {
-        viewport: { width: 1000, height: 800 },
-        iframeNodes: new Map(),
-        excludedBackendNodeIds: new Set(),
-        nodes: [
-          {
-            backendNodeId: 10,
-            parentBackendNodeId: null,
-            tag: "body",
-            attrs: {},
-            rect: { x: 0, y: 0, w: 1000, h: 800 },
-            paintOrder: 0,
-            position: "static",
-            pointerEvents: "auto",
-          },
-          {
-            backendNodeId: 42,
-            parentBackendNodeId: 10,
-            tag: "a",
-            attrs: {},
-            rect: { x: 860, y: 120, w: 40, h: 30 },
-            paintOrder: 1,
-            position: "static",
-            pointerEvents: "auto",
-          },
-        ],
-      },
-      {
-        surfaceProbes: [
-          {
-            triggerBackendNodeId: 999,
-            triggerPoint: { x: 900, y: 20 },
-            triggerAction: "hover",
-            subItems: ["My profile"],
-          },
-        ],
-      },
-    );
+    const scene = buildVomScene(axNodes, {
+      viewport: { width: 1000, height: 800 },
+      iframeNodes: new Map(),
+      excludedBackendNodeIds: new Set(),
+      surfaceProbes: [
+        {
+          triggerBackendNodeId: 999,
+          triggerPoint: { x: 900, y: 20 },
+          triggerAction: "hover",
+          subItems: ["My profile"],
+        },
+      ],
+      nodes: [
+        {
+          backendNodeId: 10,
+          parentBackendNodeId: null,
+          tag: "body",
+          attrs: {},
+          rect: { x: 0, y: 0, w: 1000, h: 800 },
+          paintOrder: 0,
+          position: "static",
+          pointerEvents: "auto",
+        },
+        {
+          backendNodeId: 42,
+          parentBackendNodeId: 10,
+          tag: "a",
+          attrs: {},
+          rect: { x: 860, y: 120, w: 40, h: 30 },
+          paintOrder: 1,
+          position: "static",
+          pointerEvents: "auto",
+        },
+      ],
+    });

    expect(scene.surfaces).toBeUndefined();
    expect(renderVom(scene).text).not.toContain("[hover first:");
@@ -2552,11 +2456,7 @@ describe("handleSnapshot", () => {
      if (method === "Accessibility.enable") return {};
      if (method === "Accessibility.getFullAXTree") return { nodes };
      if (method === "Page.getLayoutMetrics") {
-        return {
-          visualViewport: { clientWidth: 1000 },
-          cssVisualViewport: { clientWidth: 1000 },
-          cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
-        };
+        return { cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 } };
      }
      if (method === "DOMSnapshot.enable") return {};
      if (method === "DOMSnapshot.captureSnapshot") throw new Error("snapshot unsupported");
@@ -2643,11 +2543,7 @@ describe("handleSnapshot", () => {
      if (method === "Accessibility.enable") return {};
      if (method === "Accessibility.getFullAXTree") return { nodes: [root, button] };
      if (method === "Page.getLayoutMetrics") {
-        return {
-          visualViewport: { clientWidth: 1000 },
-          cssVisualViewport: { clientWidth: 1000 },
-          cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
-        };
+        return { cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 } };
      }
      if (method === "DOMSnapshot.enable") return {};
      if (method === "DOMSnapshot.captureSnapshot") {
@@ -2710,110 +2606,7 @@ describe("handleSnapshot", () => {
    );
  });

-  it("hovers the page only after the accessibility tree has been captured", async () => {
-    // Hovering can open menus and reflow the page. Probing between the DOM and
-    // AX captures would leave the two halves of one observation describing the
-    // page on either side of that change.
-    const sm = new SessionManager({ agentWindow: fakeAgentWindow([100]) });
-    await sm.start("aa11");
-    const root: CdpAxNode = {
-      nodeId: "1",
-      role: { type: "role", value: "RootWebArea" },
-      name: { type: "computedString", value: "Example" },
-      backendDOMNodeId: 100,
-      childIds: ["2"],
-    };
-    const button: CdpAxNode = {
-      nodeId: "2",
-      parentId: "1",
-      role: { type: "role", value: "button" },
-      name: { type: "computedString", value: "Products" },
-      backendDOMNodeId: 200,
-    };
-    const strings = ["body", "button", "position", "static", "pointer-events", "auto", "cursor"];
-    const i = (s: string) => strings.indexOf(s);
-    const methodOrder: string[] = [];
-    const send = vi.fn(async (_tabId: number, method: string, params?: object) => {
-      methodOrder.push(method);
-      if (method === "Accessibility.enable") return {};
-      if (method === "Accessibility.getFullAXTree") return { nodes: [root, button] };
-      if (method === "Page.getLayoutMetrics") {
-        return {
-          visualViewport: { clientWidth: 1000 },
-          cssVisualViewport: { clientWidth: 1000 },
-          cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
-        };
-      }
-      if (method === "DOMSnapshot.enable") return {};
-      if (method === "DOMSnapshot.captureSnapshot") {
-        return {
-          strings,
-          documents: [
-            {
-              nodes: {
-                parentIndex: [-1, 0],
-                nodeName: [i("body"), i("button")],
-                backendNodeId: [100, 200],
-                attributes: [[], []],
-              },
-              layout: {
-                nodeIndex: [0, 1],
-                styles: [
-                  [i("static"), i("auto"), i("auto")],
-                  [i("static"), i("auto"), i("auto")],
-                ],
-                bounds: [
-                  [0, 0, 1000, 800],
-                  [20, 20, 120, 40],
-                ],
-                paintOrders: [0, 1],
-              },
-            },
-          ],
-        };
-      }
-      if (method === "Input.dispatchMouseEvent") return {};
-      if (method === "Runtime.evaluate") {
-        const expression = (params as { expression?: string } | undefined)?.expression ?? "";
-        // Report the button as a `:hover` rule target so a real hover fires.
-        if (expression.includes("document.styleSheets")) {
-          return { result: { value: [{ x: 80, y: 40 }] } };
-        }
-        return { result: { value: [] } };
-      }
-      throw new Error(`unexpected CDP method ${method}`);
-    });
-
-    const res = await handleObserve(
-      sm,
-      { session_id: "aa11", probe_hover: true },
-      {
-        cdp: {
-          send: send as unknown as <T = unknown>(
-            tabId: number,
-            method: string,
-            params?: object,
-          ) => Promise<T>,
-          trackSessionTab: vi.fn(),
-        },
-        tabsApi: {
-          get: vi.fn(
-            async (tabId: number) =>
-              ({ id: tabId, windowId: 100, active: true }) as chrome.tabs.Tab,
-          ),
-          query: vi.fn(async () => [{ id: 4, windowId: 100, active: true } as chrome.tabs.Tab]),
-        },
-      },
-    );
-
-    if ("code" in res) throw new Error(`unexpected error: ${JSON.stringify(res)}`);
-    const firstHover = methodOrder.indexOf("Input.dispatchMouseEvent");
-    expect(firstHover).toBeGreaterThan(-1);
-    expect(methodOrder.lastIndexOf("DOMSnapshot.captureSnapshot")).toBeLessThan(firstHover);
-    expect(methodOrder.lastIndexOf("Accessibility.getFullAXTree")).toBeLessThan(firstHover);
-  });
-
-  it("runs conditional surface probing only when observe opts in", async () => {
+  it("enables conditional surface probing for semantic observe", async () => {
    const sm = new SessionManager({ agentWindow: fakeAgentWindow([100]) });
    await sm.start("aa11");
    const root: CdpAxNode = {
@@ -2836,11 +2629,7 @@ describe("handleSnapshot", () => {
      if (method === "Accessibility.enable") return {};
      if (method === "Accessibility.getFullAXTree") return { nodes: [root, button] };
      if (method === "Page.getLayoutMetrics") {
-        return {
-          visualViewport: { clientWidth: 1000 },
-          cssVisualViewport: { clientWidth: 1000 },
-          cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
-        };
+        return { cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 } };
      }
      if (method === "DOMSnapshot.enable") return {};
      if (method === "DOMSnapshot.captureSnapshot") {
@@ -2873,46 +2662,30 @@ describe("handleSnapshot", () => {
      if (method === "Runtime.evaluate") return { result: { value: [] } };
      throw new Error(`unexpected CDP method ${method}`);
    });
-    const deps = {
-      cdp: {
-        send: send as unknown as <T = unknown>(
-          tabId: number,
-          method: string,
-          params?: object,
-        ) => Promise<T>,
-        trackSessionTab: vi.fn(),
-      },
-      tabsApi: {
-        get: vi.fn(
-          async (tabId: number) => ({ id: tabId, windowId: 100, active: true }) as chrome.tabs.Tab,
-        ),
-        query: vi.fn(async () => [{ id: 4, windowId: 100, active: true } as chrome.tabs.Tab]),
-      },
-    };
-
-    const withoutProbe = await handleObserve(
+    const res = await handleObserve(
      sm,
      { session_id: "aa11", debug_surfaces: true },
-      deps,
-    );
-    if ("code" in withoutProbe) {
-      throw new Error(`unexpected error: ${JSON.stringify(withoutProbe)}`);
-    }
-    expect(withoutProbe.hover_probe).toBeUndefined();
-    expect(send).not.toHaveBeenCalledWith(
-      4,
-      "Runtime.evaluate",
-      expect.objectContaining({ returnByValue: true }),
+      {
+        cdp: {
+          send: send as unknown as <T = unknown>(
+            tabId: number,
+            method: string,
+            params?: object,
+          ) => Promise<T>,
+          trackSessionTab: vi.fn(),
+        },
+        tabsApi: {
+          get: vi.fn(
+            async (tabId: number) =>
+              ({ id: tabId, windowId: 100, active: true }) as chrome.tabs.Tab,
+          ),
+          query: vi.fn(async () => [{ id: 4, windowId: 100, active: true } as chrome.tabs.Tab]),
+        },
+      },
    );

-    const withProbe = await handleObserve(
-      sm,
-      { session_id: "aa11", debug_surfaces: true, probe_hover: true },
-      deps,
-    );
-    if ("code" in withProbe) throw new Error(`unexpected error: ${JSON.stringify(withProbe)}`);
-    expect(withProbe.debug).toEqual({ surface_probes: [] });
-    expect(withProbe.hover_probe).toEqual({ performed: true, revealed_content: false });
+    if ("code" in res) throw new Error(`unexpected error: ${JSON.stringify(res)}`);
+    expect(res.debug).toEqual({ surface_probes: [] });
    expect(send).toHaveBeenCalledWith(
      4,
      "Runtime.evaluate",
@@ -3005,11 +2778,7 @@ describe("handleSnapshot", () => {
        };
      }
      if (method === "Page.getLayoutMetrics") {
-        return {
-          visualViewport: { clientWidth: 1000 },
-          cssVisualViewport: { clientWidth: 1000 },
-          cssLayoutViewport: { clientWidth: 1000, clientHeight: 800 },
-        };
+        return { cssLayoutViewport: { clientWidth: 1000, clientHeight: 800 } };
      }
      if (method === "DOMSnapshot.enable") return {};
      if (method === "DOMSnapshot.captureSnapshot") {
@@ -3222,14 +2991,10 @@ describe("handleSnapshot", () => {
  }

  const VP_METRICS = {
-    visualViewport: { clientWidth: 1000 },
-    cssVisualViewport: { clientWidth: 1000 },
    cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
  };

-  function makeFrameAwareDeps(
-    ownerGeometry: "unavailable" | "available" | "clipped" = "unavailable",
-  ) {
+  function makeFrameAwareDeps() {
    const strings = ["html", "body", "iframe", "button", "title", "Remote", "static", "auto"];
    const i = (value: string) => strings.indexOf(value);
    const styles = [i("static"), i("auto"), i("auto")];
@@ -3237,8 +3002,6 @@ describe("handleSnapshot", () => {
      strings,
      documents: [
        {
-          scrollOffsetX: 0,
-          scrollOffsetY: 0,
          frameId: "main",
          nodes: {
            parentIndex: [-1, 0, 1],
@@ -3259,8 +3022,6 @@ describe("handleSnapshot", () => {
          },
        },
        {
-          scrollOffsetX: 0,
-          scrollOffsetY: 0,
          frameId: "child",
          nodes: {
            parentIndex: [-1, 0, 1],
@@ -3313,16 +3074,6 @@ describe("handleSnapshot", () => {
    ];
    const send = vi.fn(async (_tabId: number, method: string) => {
      if (method === "Page.getLayoutMetrics") return VP_METRICS;
-      if (ownerGeometry !== "unavailable") {
-        if (method === "DOM.getBoxModel") {
-          const x = ownerGeometry === "clipped" ? 10000 : 100;
-          return { model: { content: [x, 100, x + 400, 100, x + 400, 400, x, 400] } };
-        }
-        if (method === "DOM.resolveNode") return { object: { objectId: "owner" } };
-        if (method === "Runtime.callFunctionOn")
-          return { result: { value: { width: 400, height: 300 } } };
-        if (method === "Runtime.releaseObject") return {};
-      }
      if (method === "DOMSnapshot.enable" || method === "Accessibility.enable") return {};
      if (method === "DOMSnapshot.captureSnapshot") return snapshot;
      if (method === "Accessibility.getFullAXTree") return { nodes: mainAx };
@@ -3563,43 +3314,6 @@ describe("handleSnapshot", () => {
    expect(result.text).toContain("•••");
  });

-  it.each([
-    undefined,
-    100,
-    0,
-  ])("reports unavailable iframe geometry within the observation budget %s", async (maxTokens) => {
-    const result = await captureVomObservation(makeFrameAwareDeps().cdp, 4, "https://example.com", {
-      maxTokens,
-    });
-    expect(result.text.match(/@warning/g)).toHaveLength(1);
-    expect(result.text).toContain("geometry incomplete");
-    expect(result.text.startsWith("@vom 1\n")).toBe(true);
-    if (maxTokens === undefined) {
-      expect(result.truncated).toBe(false);
-      expect(result.text).toContain("Frame action");
-      expect(result.matchNodes.find((node) => node.backendNodeId === 22)).toMatchObject({
-        rect: null,
-        localRect: { x: 20, y: 30, w: 120, h: 40 },
-      });
-    }
-    if (maxTokens === 100) expect(Math.ceil(result.text.length / 4)).toBeLessThanOrEqual(maxTokens);
-  });
-
-  it.each([
-    "available",
-    "clipped",
-  ] as const)("does not report successful %s geometry as an observation failure", async (ownerGeometry) => {
-    const result = await captureVomObservation(
-      makeFrameAwareDeps(ownerGeometry).cdp,
-      4,
-      "https://example.com",
-    );
-    expect(result.text).not.toContain("@warning");
-    const node = result.matchNodes.find((item) => item.backendNodeId === 22);
-    if (ownerGeometry === "clipped") expect(node?.rect).toBeNull();
-    else expect(node?.rect).toEqual({ x: 120, y: 130, w: 120, h: 40 });
-  });
-
  it("keeps frames and rendered refs on the same frame identity", async () => {
    const deps = makeFrameAwareDeps();

@@ -1,26 +1,8 @@
 import { describe, expect, it, vi } from "vitest";
 import { SessionManager } from "@/session-manager/manager";
 import { handleSessionStop } from "../session";
-import type { ChromeTabsApi } from "../shared";
 import { type AgentOverlayResetApi, type ChromeWindowsApi, type TabMutationApi } from "../tabs";

-/** Build a read-only query api over a FakeState. */
-function makeQuery(state: FakeState): ChromeTabsApi {
-  return {
-    get: vi.fn(async (id) => {
-      const t = state.tabs.get(id);
-      if (!t) throw new Error(`tab ${id} not found`);
-      return t;
-    }),
-    query: vi.fn(async (q: chrome.tabs.QueryInfo) => {
-      const w = q.windowId;
-      return Array.from(state.tabs.values()).filter(
-        (t) => typeof w !== "number" || t.windowId === w,
-      );
-    }),
-  };
-}
-
 function fakeAgentWindow(ids: number[]) {
  let i = 0;
  const create = vi.fn(async () => {
@@ -29,7 +11,7 @@ function fakeAgentWindow(ids: number[]) {
    return id;
  });
  const remove = vi.fn(async () => {});
-  const ensureActiveTab = vi.fn(async () => 0);
+  const ensureActiveTab = vi.fn(async () => {});
  return { create, remove, ensureActiveTab };
 }

@@ -48,9 +30,7 @@ function makeApis(
 } {
  const tabs: TabMutationApi = {
    create: vi.fn(),
-    remove: vi.fn(async (id: number) => {
-      state.tabs.delete(id);
-    }),
+    remove: vi.fn(async () => {}),
    update: vi.fn(async (_id, _p) => undefined),
    get: vi.fn(async (id) => {
      const t = state.tabs.get(id);
@@ -257,15 +237,11 @@ describe("handleSessionStop with auto-return", () => {
      moves: [],
    };
    const { tabs, windows } = makeApis(state, { moveThrowsFor: new Set([1]) });
-    const cdp = {
-      detachSession: vi.fn(async () => {}),
-      releaseSessionTab: vi.fn(async () => {}),
-    };

    const res = await handleSessionStop(
      sm,
      { session_id: "aa11" },
-      { cdp, tabManagement: { tabs, windows } },
+      { tabManagement: { tabs, windows } },
    );
    if ("code" in res) throw new Error(`unexpected error: ${JSON.stringify(res)}`);
    expect(res.return_failures?.map((f) => f.tab_id)).toEqual([1]);
@@ -273,8 +249,6 @@ describe("handleSessionStop with auto-return", () => {
    expect(sm.has("aa11")).toBe(true);
    expect(ctx.borrowedTabs.has(1)).toBe(true);
    expect(ctx.borrowedTabs.has(2)).toBe(false);
-    expect(cdp.releaseSessionTab).toHaveBeenCalledExactlyOnceWith("aa11", 2);
-    expect(cdp.detachSession).not.toHaveBeenCalled();
    expect(aw.remove).not.toHaveBeenCalled();
  });

@@ -293,275 +267,4 @@ describe("handleSessionStop with auto-return", () => {
    await handleSessionStop(sm, { session_id: "aa11" }, { tabManagement: { tabs, windows } });
    expect(ctx.refStore.isEmpty()).toBe(true);
  });
-
-  it.each([
-    "before teardown",
-    "during its return",
-    "after its return failed",
-    "before its turn in the return loop",
-  ])("finishes stopping when a borrowed tab closes %s", async (timing) => {
-    const aw = fakeAgentWindow([100]);
-    const sm = new SessionManager({ agentWindow: aw });
-    const ctx = await sm.start("aa11");
-    ctx.borrowedTabs.set(1, { tabId: 1, originalWindowId: 200, originalIndex: 0 });
-    ctx.borrowedTabs.set(2, { tabId: 2, originalWindowId: 200, originalIndex: 1 });
-    const state: FakeState = {
-      tabs: new Map([
-        [1, { id: 1, windowId: 100 } as chrome.tabs.Tab],
-        [2, { id: 2, windowId: 100 } as chrome.tabs.Tab],
-      ]),
-      windowsClosed: new Set(),
-      moves: [],
-    };
-    const { tabs, windows } = makeApis(state);
-    const cdp = { detachSession: vi.fn(async () => {}) };
-    const closeTab = (tabId: number) => {
-      state.tabs.delete(tabId);
-      sm.forgetClosedTab(tabId);
-    };
-    const baseMove = tabs.move;
-    tabs.move = vi.fn(async (tabId, props) => {
-      if (tabId === 1 && timing === "during its return") closeTab(1);
-      if (tabId === 1 && timing === "after its return failed") {
-        throw new Error("simulated move failure");
-      }
-      if (tabId === 2 && timing === "after its return failed") closeTab(1);
-      if (tabId === 1 && timing === "before its turn in the return loop") closeTab(2);
-      if (!state.tabs.has(tabId)) throw new Error(`tab ${tabId} not found`);
-      return baseMove(tabId, props);
-    });
-    if (timing === "before teardown") closeTab(1);
-
-    const res = await handleSessionStop(
-      sm,
-      { session_id: "aa11" },
-      {
-        cdp,
-        tabManagement: {
-          tabs,
-          windows,
-          agentOverlayReset: { resetAgentOverlays: vi.fn(async () => {}) },
-        },
-        tabsQuery: makeQuery(state),
-      },
-    );
-
-    if ("code" in res) throw new Error(`unexpected error: ${JSON.stringify(res)}`);
-    const closedTabId = timing === "before its turn in the return loop" ? 2 : 1;
-    expect(res.returned_tab_ids).toEqual([closedTabId === 1 ? 2 : 1]);
-    expect(res.return_failures).toBeUndefined();
-    expect(ctx.borrowedTabs.size).toBe(0);
-    expect(sm.has("aa11")).toBe(false);
-    expect(cdp.detachSession).toHaveBeenCalledWith("aa11");
-    expect(aw.remove).toHaveBeenCalledWith(100);
-    if (timing === "before teardown" || timing === "before its turn in the return loop") {
-      expect(tabs.move).not.toHaveBeenCalledWith(closedTabId, expect.anything());
-    }
-  });
-});
-
-describe("handleSessionStop window release (issue #57)", () => {
-  const agentWindowId = 100;
-
-  it("releases the window when user-created tabs remain", async () => {
-    const aw = fakeAgentWindow([agentWindowId]);
-    // ensureActiveTab returns the home tab id (10). We override the fake to
-    // return a known id.
-    aw.ensureActiveTab = vi.fn(async () => 10);
-    const sm = new SessionManager({ agentWindow: aw });
-    const ctx = await sm.start("aa11");
-    ctx.agentCreatedTabs.add(11);
-    ctx.agentCreatedTabs.add(12);
-    // user tab 99 (created via Chrome UI, NOT in agentCreatedTabs)
-    const state: FakeState = {
-      tabs: new Map([
-        [10, { id: 10, windowId: agentWindowId } as chrome.tabs.Tab],
-        [11, { id: 11, windowId: agentWindowId } as chrome.tabs.Tab],
-        [12, { id: 12, windowId: agentWindowId } as chrome.tabs.Tab],
-        [99, { id: 99, windowId: agentWindowId } as chrome.tabs.Tab],
-      ]),
-      windowsClosed: new Set(),
-      moves: [],
-    };
-    const { tabs, windows } = makeApis(state);
-    const query = makeQuery(state);
-
-    const res = await handleSessionStop(
-      sm,
-      { session_id: "aa11" },
-      { tabManagement: { tabs, windows }, tabsQuery: query },
-    );
-    if ("code" in res) throw new Error(`unexpected error: ${JSON.stringify(res)}`);
-    expect(res.window_released).toBe(true);
-    // agent tabs + home removed, user tab 99 kept
-    expect((tabs.remove as ReturnType<typeof vi.fn>).mock.calls.map((c) => c[0]).sort()).toEqual([
-      10, 11, 12,
-    ]);
-    expect(state.tabs.has(99)).toBe(true);
-    // window released (dropOnly), not closed
-    expect(aw.remove).not.toHaveBeenCalled();
-    expect(sm.has("aa11")).toBe(false);
-  });
-
-  it("closes the window (not release) when no user tabs remain", async () => {
-    const aw = fakeAgentWindow([agentWindowId]);
-    aw.ensureActiveTab = vi.fn(async () => 10);
-    const sm = new SessionManager({ agentWindow: aw });
-    const ctx = await sm.start("aa11");
-    ctx.agentCreatedTabs.add(11);
-    const state: FakeState = {
-      tabs: new Map([
-        [10, { id: 10, windowId: agentWindowId } as chrome.tabs.Tab],
-        [11, { id: 11, windowId: agentWindowId } as chrome.tabs.Tab],
-      ]),
-      windowsClosed: new Set(),
-      moves: [],
-    };
-    const { tabs, windows } = makeApis(state);
-    const query = makeQuery(state);
-
-    const res = await handleSessionStop(
-      sm,
-      { session_id: "aa11" },
-      { tabManagement: { tabs, windows }, tabsQuery: query },
-    );
-    if ("code" in res) throw new Error(`unexpected error: ${JSON.stringify(res)}`);
-    expect(res.window_released).toBeFalsy();
-    expect(aw.remove).toHaveBeenCalledWith(agentWindowId);
-    expect(sm.has("aa11")).toBe(false);
-  });
-
-  it("is non-fatal when an agent tab is already gone", async () => {
-    const aw = fakeAgentWindow([agentWindowId]);
-    aw.ensureActiveTab = vi.fn(async () => 10);
-    const sm = new SessionManager({ agentWindow: aw });
-    const ctx = await sm.start("aa11");
-    ctx.agentCreatedTabs.add(11); // no longer in state → remove throws
-    const state: FakeState = {
-      tabs: new Map([[10, { id: 10, windowId: agentWindowId } as chrome.tabs.Tab]]),
-      windowsClosed: new Set(),
-      moves: [],
-    };
-    const { tabs, windows } = makeApis(state);
-    (tabs.remove as ReturnType<typeof vi.fn>).mockImplementation(async (id: number) => {
-      if (id === 11) throw new Error("tab 11 already closed");
-      state.tabs.delete(id); // home (10) removed normally
-    });
-    const query = makeQuery(state);
-
-    const res = await handleSessionStop(
-      sm,
-      { session_id: "aa11" },
-      { tabManagement: { tabs, windows }, tabsQuery: query },
-    );
-    if ("code" in res) throw new Error(`unexpected error: ${JSON.stringify(res)}`);
-    // user tab 10? no — 10 is home, removed. window would be empty → close.
-    expect(res.window_released).toBeFalsy();
-    expect(aw.remove).toHaveBeenCalled();
-  });
-
-  it("degrades to close-window when tabsQuery is missing", async () => {
-    const aw = fakeAgentWindow([agentWindowId]);
-    aw.ensureActiveTab = vi.fn(async () => 10);
-    const sm = new SessionManager({ agentWindow: aw });
-    const ctx = await sm.start("aa11");
-    ctx.agentCreatedTabs.add(11);
-    const state: FakeState = {
-      tabs: new Map([
-        [10, { id: 10, windowId: agentWindowId } as chrome.tabs.Tab],
-        [11, { id: 11, windowId: agentWindowId } as chrome.tabs.Tab],
-      ]),
-      windowsClosed: new Set(),
-      moves: [],
-    };
-    const { tabs, windows } = makeApis(state);
-
-    const res = await handleSessionStop(
-      sm,
-      { session_id: "aa11" },
-      { tabManagement: { tabs, windows } }, // no tabsQuery
-    );
-    if ("code" in res) throw new Error(`unexpected error: ${JSON.stringify(res)}`);
-    // No query available → conservatively close the window.
-    expect(res.window_released).toBeFalsy();
-    expect(aw.remove).toHaveBeenCalledWith(agentWindowId);
-  });
-
-  it("degrades to close-window when tabsQuery.query throws", async () => {
-    const aw = fakeAgentWindow([agentWindowId]);
-    aw.ensureActiveTab = vi.fn(async () => 10);
-    const sm = new SessionManager({ agentWindow: aw });
-    const ctx = await sm.start("aa11");
-    ctx.agentCreatedTabs.add(11);
-    const state: FakeState = {
-      tabs: new Map([[11, { id: 11, windowId: agentWindowId } as chrome.tabs.Tab]]),
-      windowsClosed: new Set(),
-      moves: [],
-    };
-    const { tabs, windows } = makeApis(state);
-    const query = makeQuery(state);
-    (query.query as ReturnType<typeof vi.fn>).mockImplementation(async () => {
-      throw new Error("query failed");
-    });
-
-    const res = await handleSessionStop(
-      sm,
-      { session_id: "aa11" },
-      { tabManagement: { tabs, windows }, tabsQuery: query },
-    );
-    if ("code" in res) throw new Error(`unexpected error: ${JSON.stringify(res)}`);
-    expect(res.window_released).toBeFalsy();
-    expect(aw.remove).toHaveBeenCalled();
-  });
-
-  it("tracks agentCreatedTabs across tab_create / tab_close", async () => {
-    const aw = fakeAgentWindow([agentWindowId]);
-    aw.ensureActiveTab = vi.fn(async () => 10);
-    const sm = new SessionManager({ agentWindow: aw });
-    const ctx = await sm.start("aa11");
-    // Simulate handleTabCreate adding, then handleTabClose removing.
-    ctx.agentCreatedTabs.add(11);
-    expect(ctx.agentCreatedTabs.has(11)).toBe(true);
-    ctx.agentCreatedTabs.delete(11); // as handleTabClose does on success
-    expect(ctx.agentCreatedTabs.has(11)).toBe(false);
-    // Unknown id delete is a safe no-op (user-closed tab).
-    expect(() => ctx.agentCreatedTabs.delete(999)).not.toThrow();
-  });
-
-  it("closes the window (not release) when an agent tab fails to close", async () => {
-    // Regression: a leaked agent tab (still in agentCreatedTabs, but
-    // still present because Step 4 remove() threw) must NOT be mistaken
-    // for a user tab. Otherwise the window would be released (dropOnly)
-    // and the agent tab would leak (issue #57 regression).
-    const aw = fakeAgentWindow([agentWindowId]);
-    aw.ensureActiveTab = vi.fn(async () => 10);
-    const sm = new SessionManager({ agentWindow: aw });
-    const ctx = await sm.start("aa11");
-    ctx.agentCreatedTabs.add(11); // Step 4 remove() will throw for this tab
-    const state: FakeState = {
-      tabs: new Map([
-        [10, { id: 10, windowId: agentWindowId } as chrome.tabs.Tab],
-        [11, { id: 11, windowId: agentWindowId } as chrome.tabs.Tab],
-      ]),
-      windowsClosed: new Set(),
-      moves: [],
-    };
-    const { tabs, windows } = makeApis(state);
-    (tabs.remove as ReturnType<typeof vi.fn>).mockImplementation(async (id: number) => {
-      if (id === 11) throw new Error("tab 11 failed to close");
-      state.tabs.delete(id); // home (10) removed normally; 11 lingers
-    });
-    const query = makeQuery(state);
-
-    const res = await handleSessionStop(
-      sm,
-      { session_id: "aa11" },
-      { tabManagement: { tabs, windows }, tabsQuery: query },
-    );
-    if ("code" in res) throw new Error(`unexpected error: ${JSON.stringify(res)}`);
-    // The leaked agent tab must NOT keep the window open.
-    expect(res.window_released).toBeFalsy();
-    expect(aw.remove).toHaveBeenCalledWith(agentWindowId);
-    expect(sm.has("aa11")).toBe(false);
-  });
 });
@@ -12,7 +12,7 @@ function fakeAgentWindow() {
  return {
    create: vi.fn(async () => 100),
    remove: vi.fn(async () => {}),
-    ensureActiveTab: vi.fn(async () => 1),
+    ensureActiveTab: vi.fn(async () => {}),
  };
 }

@@ -1,237 +0,0 @@
-// @vitest-environment node
-import { describe, expect, it } from "vitest";
-import type { CdpFrame, CdpFrameGraph, CdpTarget } from "@/browser-driver/frame-graph";
-import { GeometryContext } from "../geometry/frame-context";
-import type { CdpRunner } from "../shared";
-import { captureViewModel } from "../vom/capture";
-import { captureFrameData } from "../vom/frame-capture";
-
-type Send = <T = Record<string, unknown>>(
-  method: string,
-  params?: object,
-  sessionId?: string,
-) => Promise<T>;
-type Tree = { frame: { id: string; parentId?: string; name?: string }; childFrames?: Tree[] };
-type Rect = { x: number; y: number; w: number; h: number };
-type Oracle = { probe: Rect; owners: Record<string, { x: number; y: number; scale: number }> };
-
-// The independent oracle uses DOM border boxes and this fixture's axis-aligned
-// iframe transforms. No production snapshot conversion/projection builds expectations.
-const oracleExpression = `(() => {
-  const box = document.querySelector('#probe').getBoundingClientRect();
-  const owners = {};
-  for (const frame of document.querySelectorAll('iframe')) {
-    const rect = frame.getBoundingClientRect();
-    const style = getComputedStyle(frame);
-    const scale = rect.width / frame.offsetWidth;
-    owners[frame.name] = {
-      x: rect.x + (frame.clientLeft + parseFloat(style.paddingLeft)) * scale,
-      y: rect.y + (frame.clientTop + parseFloat(style.paddingTop)) * scale,
-      scale,
-    };
-  }
-  return { probe: { x: box.x, y: box.y, w: box.width, h: box.height }, owners };
-})()`;
-
-describe.skipIf(!process.env.BSK_GEOMETRY_CHROME)("real DOMSnapshot coordinate contract", () => {
-  it.each([
-    { deviceScale: 1, zoom: 1 },
-    { deviceScale: 0.8, zoom: 1 },
-    { deviceScale: 1, zoom: 1.25 },
-    { deviceScale: 2, zoom: 1 },
-    { deviceScale: 2, zoom: 0.8 },
-  ])("matches DOM geometry at device scale $deviceScale and zoom $zoom", async (configuration) => {
-    const evalRoot = new URL("../../../../../evals/browser/", import.meta.url);
-    const { createEvalServer } = await import(new URL("lib/server.mjs", evalRoot).href);
-    const { withChrome } = await import(
-      new URL("cases/regression/snapshot-coordinates/chrome.mjs", evalRoot).href
-    );
-    const server = createEvalServer();
-    const { baseUrl } = await server.start();
-    try {
-      await withChrome(
-        { executable: process.env.BSK_GEOMETRY_CHROME, ...configuration },
-        async (send: Send) => {
-          const { targetId } = await send<{ targetId: string }>("Target.createTarget", {
-            url: "about:blank",
-          });
-          const { sessionId: rootSession } = await send<{ sessionId: string }>(
-            "Target.attachToTarget",
-            { targetId, flatten: true },
-          );
-          await send(
-            "Page.navigate",
-            { url: `${baseUrl}/snapshot-coordinates?run=coordinates` },
-            rootSession,
-          );
-          await expect
-            .poll(
-              () =>
-                server
-                  .snapshot("coordinates")
-                  .events.some(
-                    (event: { type: string; data: { root?: boolean } }) =>
-                      event.type === "geometry.ready" && event.data.root,
-                  ),
-              { timeout: 10_000 },
-            )
-            .toBe(true);
-
-          const targets = await send<{ targetInfos: { targetId: string; type: string }[] }>(
-            "Target.getTargets",
-          );
-          const sessions = [rootSession];
-          for (const target of targets.targetInfos.filter((target) => target.type === "iframe")) {
-            const { sessionId } = await send<{ sessionId: string }>("Target.attachToTarget", {
-              targetId: target.targetId,
-              flatten: true,
-            });
-            sessions.push(sessionId);
-          }
-          expect(sessions.length).toBe(2); // The cross-site fixture must actually be an OOPIF.
-          const frames: CdpFrame[] = [];
-          const names = new Map<string, string>();
-          const sessionFor = (target: CdpTarget) => target.sessionId ?? rootSession;
-          for (const sessionId of sessions) {
-            const { frameTree } = await send<{ frameTree: Tree }>(
-              "Page.getFrameTree",
-              {},
-              sessionId,
-            );
-            const target: CdpTarget = {
-              tabId: 1,
-              ...(sessionId === rootSession ? {} : { sessionId }),
-            };
-            const visit = (tree: Tree, parentFrameId = tree.frame.parentId) => {
-              frames.push({ frameId: tree.frame.id, parentFrameId, target });
-              names.set(tree.frame.id, tree.frame.name ?? "");
-              for (const child of tree.childFrames ?? []) visit(child, tree.frame.id);
-            };
-            visit(frameTree);
-          }
-          expect(frames).toHaveLength(5);
-          for (const frame of frames) {
-            if (!frame.parentFrameId) continue;
-            const parent = frames.find((item) => item.frameId === frame.parentFrameId)!;
-            const owner = await send<{ backendNodeId: number }>(
-              "DOM.getFrameOwner",
-              { frameId: frame.frameId },
-              sessionFor(parent.target),
-            );
-            frame.ownerBackendNodeId = owner.backendNodeId;
-          }
-          const graph: CdpFrameGraph = { rootFrameId: frames[0].frameId, frames };
-          const calls: string[] = [];
-          const cdp: CdpRunner = {
-            send: (tabId, method, params) => {
-              calls.push(`${tabId}:${method}`);
-              return send(method, params, rootSession);
-            },
-            sendToTarget: (target, method, params) => {
-              calls.push(`${target.sessionId ?? target.tabId}:${method}`);
-              return send(method, params, sessionFor(target));
-            },
-            getFrameGraph: async () => graph,
-          };
-          const oracles = new Map<string, Oracle>();
-          for (const frame of frames) {
-            const session = sessionFor(frame.target);
-            const { executionContextId } = await send<{ executionContextId: number }>(
-              "Page.createIsolatedWorld",
-              { frameId: frame.frameId, worldName: "coordinate-oracle" },
-              session,
-            );
-            await expect
-              .poll(
-                async () => {
-                  const ready = await send<{ result: { value: boolean } }>(
-                    "Runtime.evaluate",
-                    {
-                      expression: 'document.documentElement.dataset.geometryReady === "true"',
-                      contextId: executionContextId,
-                      returnByValue: true,
-                    },
-                    session,
-                  );
-                  return ready.result.value;
-                },
-                { timeout: 5_000 },
-              )
-              .toBe(true);
-            // Establish scroll after cross-process target creation/layout settles.
-            const scroll = frame.parentFrameId
-              ? names.get(frame.frameId) === "nested"
-                ? [10, 20]
-                : [40, 100]
-              : [80, 240];
-            await send(
-              "Runtime.evaluate",
-              {
-                expression: `(async () => { scrollTo(${scroll.join(",")}); await new Promise(resolve => requestAnimationFrame(() => requestAnimationFrame(resolve))); })()`,
-                contextId: executionContextId,
-                awaitPromise: true,
-              },
-              session,
-            );
-            const reply = await send<{ result: { value: Oracle } }>(
-              "Runtime.evaluate",
-              { expression: oracleExpression, contextId: executionContextId, returnByValue: true },
-              session,
-            );
-            oracles.set(frame.frameId, reply.result.value);
-          }
-          const geometry = new GeometryContext(cdp, 1, graph);
-          const captured = await captureViewModel(cdp, 1, { geometry });
-          await captureFrameData(cdp, 1, captured, undefined, geometry);
-          expect(captured.frameGeometryIssues).toEqual([]);
-          for (const frame of frames) {
-            const node = captured.frameNodes
-              ?.get(frame.frameId)
-              ?.find((node) => node.attrs.id === "probe");
-            expect(node, `missing probe in ${names.get(frame.frameId) || "root"}`).toBeDefined();
-            const local = oracles.get(frame.frameId)!.probe;
-            const top = { ...local };
-            let current = frame;
-            while (current.parentFrameId) {
-              const owner = oracles.get(current.parentFrameId)!.owners[names.get(current.frameId)!];
-              top.x = owner.x + top.x * owner.scale;
-              top.y = owner.y + top.y * owner.scale;
-              top.w *= owner.scale;
-              top.h *= owner.scale;
-              current = frames.find((item) => item.frameId === current.parentFrameId)!;
-            }
-            expect(
-              node!.rect,
-              JSON.stringify({
-                frame: names.get(frame.frameId),
-                local,
-                top,
-                viewport: captured.viewport,
-              }),
-            ).not.toBeNull();
-            for (const key of ["x", "y", "w", "h"] as const) {
-              expect(
-                Math.abs(node!.localRect![key] - local[key]),
-                `${names.get(frame.frameId)} local ${key}`,
-              ).toBeLessThan(2);
-              expect(
-                Math.abs(node!.rect![key] - top[key]),
-                `${names.get(frame.frameId)} top ${key}`,
-              ).toBeLessThan(2);
-            }
-          }
-          expect(calls.filter((call) => call.endsWith(":Page.getLayoutMetrics"))).toHaveLength(
-            sessions.length,
-          );
-          const metrics = await send<{
-            cssVisualViewport: { zoom: number };
-            visualViewport: { clientWidth: number };
-          }>("Page.getLayoutMetrics", {}, rootSession);
-          expect(metrics.cssVisualViewport.zoom).toBeCloseTo(configuration.zoom, 4);
-        },
-      );
-    } finally {
-      await server.stop();
-    }
-  }, 30_000);
-});
@@ -11,7 +11,7 @@ function fakeAgentWindow(ids: number[]) {
      return id;
    },
    remove: async () => {},
-    ensureActiveTab: async () => 1,
+    ensureActiveTab: async () => {},
  };
 }

@@ -1,7 +1,5 @@
 import { describe, expect, it, vi } from "vitest";
-import { type CdpDebuggerApi, ChromiumCdp } from "@/browser-driver/chromium-cdp";
 import { SessionManager } from "@/session-manager/manager";
-import { handleHover } from "../interaction";
 import {
  type AgentOverlayResetApi,
  type ChromeWindowsApi,
@@ -25,7 +23,7 @@ function fakeAgentWindow(ids: number[]) {
      return id;
    }),
    remove: vi.fn(async () => {}),
-    ensureActiveTab: vi.fn(async () => 1),
+    ensureActiveTab: vi.fn(async () => {}),
  };
 }

@@ -223,7 +221,6 @@ describe("handleTabCreate", () => {
      active: true,
    });
    expect(res).toMatchObject({ tab_id: 10, window_id: 100 });
-    expect(sm.get("aa11")?.agentCreatedTabs.has(10)).toBe(true);
  });

  it("forwards explicit url + index + active=false", async () => {
@@ -259,41 +256,6 @@ describe("handleTabCreate", () => {
    const res = await handleTabCreate(sm, { session_id: "aa11", index: -1 }, { tabs: api });
    expect(res).toMatchObject({ code: "invalid_params" });
  });
-
-  it("does not claim any tab when chrome.tabs.create fails", async () => {
-    const sm = new SessionManager({ agentWindow: fakeAgentWindow([100]) });
-    await sm.start("aa11");
-    const state: FakeTabState = { tabs: new Map(), nextTabId: 10, windowsClosed: new Set() };
-    const { api, spies } = makeTabMutationApi(state);
-    spies.create.mockRejectedValueOnce(new Error("chrome.tabs.create failed"));
-
-    const res = await handleTabCreate(sm, { session_id: "aa11" }, { tabs: api });
-    expect(res).toMatchObject({ code: "protocol_error" });
-
-    expect(sm.get("aa11")?.agentCreatedTabs).toEqual(new Set([1]));
-  });
-
-  it("claims the returned id even when a user tab appears during tab creation", async () => {
-    const sm = new SessionManager({ agentWindow: fakeAgentWindow([100]) });
-    const ctx = await sm.start("aa11");
-    const state: FakeTabState = { tabs: new Map(), nextTabId: 10, windowsClosed: new Set() };
-    const { api, spies } = makeTabMutationApi(state);
-    let resolveCreate!: (tab: chrome.tabs.Tab) => void;
-    const createResult = new Promise<chrome.tabs.Tab>((resolve) => {
-      resolveCreate = resolve;
-    });
-    spies.create.mockImplementationOnce(() => createResult);
-
-    const pending = handleTabCreate(sm, { session_id: "aa11" }, { tabs: api });
-    // A user can create an unrelated same-window tab while Chrome is still
-    // resolving the agent request. There is no pending slot for it to steal.
-    expect(ctx.agentCreatedTabs.has(99)).toBe(false);
-    resolveCreate({ id: 10, windowId: 100, active: true } as chrome.tabs.Tab);
-
-    await expect(pending).resolves.toMatchObject({ tab_id: 10 });
-    expect(ctx.agentCreatedTabs.has(10)).toBe(true);
-    expect(ctx.agentCreatedTabs.has(99)).toBe(false);
-  });
 });

 describe("handleTabClose", () => {
@@ -549,148 +511,6 @@ describe("handleTabBorrow", () => {
 });

 describe("handleTabReturn", () => {
-  it.each([
-    "not_found",
-    "cdp_failed",
-  ])("detaches after selector resolution fails with %s", async (code) => {
-    const sm = new SessionManager({ agentWindow: fakeAgentWindow([100]) });
-    const ctx = await sm.start("aa11");
-    ctx.borrowedTabs.set(7, { tabId: 7, originalWindowId: 200, originalIndex: 4 });
-    const state: FakeTabState = {
-      tabs: new Map([[7, { id: 7, windowId: 100 } as chrome.tabs.Tab]]),
-      nextTabId: 50,
-      windowsClosed: new Set(),
-    };
-    const { api } = makeTabMutationApi(state);
-    const { api: windows } = makeWindowsApi(state);
-    const debuggerApi = {
-      attach: vi.fn(async () => {}),
-      detach: vi.fn(async () => {}),
-      sendCommand: vi.fn(async (_target: unknown, method: string) => {
-        if (method === "DOM.getDocument") return { root: { nodeId: 1 } };
-        if (method === "DOM.querySelector") {
-          if (code === "cdp_failed") throw new Error("selector query failed");
-          return { nodeId: 0 };
-        }
-        return {};
-      }),
-      onEvent: { addListener: vi.fn(), removeListener: vi.fn() },
-      onDetach: { addListener: vi.fn(), removeListener: vi.fn() },
-    };
-    const cdp = new ChromiumCdp(debuggerApi as unknown as CdpDebuggerApi);
-
-    const hover = await handleHover(
-      sm,
-      { session_id: "aa11", tab_id: 7, selector: "#missing" },
-      {
-        cdp,
-        tabsApi: { get: api.get, query: vi.fn(async () => []) },
-      },
-    );
-    expect(hover).toMatchObject({ code });
-    expect(cdp.isAttached(7)).toBe(true);
-
-    const returned = await handleTabReturn(
-      sm,
-      { session_id: "aa11", tab_id: 7 },
-      {
-        tabs: api,
-        windows,
-        cdp,
-        agentOverlayReset: { resetAgentOverlays: vi.fn(async () => {}) },
-      },
-    );
-    expect(returned).toMatchObject({ returned_to_window_id: 200 });
-    expect(ctx.borrowedTabs.has(7)).toBe(false);
-    expect(cdp.isAttached(7)).toBe(false);
-    expect(debuggerApi.detach).toHaveBeenCalledExactlyOnceWith({ tabId: 7 });
-    cdp.dispose();
-  });
-
-  it("honours cancellation while preparing a validated return", async () => {
-    const sm = new SessionManager({ agentWindow: fakeAgentWindow([100]) });
-    const ctx = await sm.start("aa11");
-    ctx.borrowedTabs.set(7, { tabId: 7, originalWindowId: 200, originalIndex: 4 });
-    const state: FakeTabState = {
-      tabs: new Map([[7, { id: 7, windowId: 100 } as chrome.tabs.Tab]]),
-      nextTabId: 50,
-      windowsClosed: new Set(),
-    };
-    const { api, spies } = makeTabMutationApi(state);
-    const { api: windows } = makeWindowsApi(state);
-    const controller = new AbortController();
-    const beforeReturn = vi.fn(async () => {
-      controller.abort();
-    });
-    const result = await handleTabReturn(
-      sm,
-      { session_id: "aa11", tab_id: 7 },
-      {
-        tabs: api,
-        windows,
-        signal: controller.signal,
-        beforeReturn,
-      },
-    );
-
-    expect(result).toMatchObject({ code: "cancelled" });
-    expect(beforeReturn).toHaveBeenCalledExactlyOnceWith("aa11", 7);
-    expect(spies.move).not.toHaveBeenCalled();
-    expect(ctx.borrowedTabs.has(7)).toBe(true);
-  });
-
-  it.each([
-    "original",
-    "fallback",
-    "cleanup_failed",
-    "failed",
-    "cancelled",
-  ])("releases CDP only after a successful return (%s)", async (mode) => {
-    const sm = new SessionManager({ agentWindow: fakeAgentWindow([100]) });
-    const ctx = await sm.start("aa11");
-    ctx.borrowedTabs.set(7, { tabId: 7, originalWindowId: 200, originalIndex: 4 });
-    const state: FakeTabState = {
-      tabs: new Map([[7, { id: 7, windowId: 100 } as chrome.tabs.Tab]]),
-      nextTabId: 50,
-      windowsClosed: new Set(),
-    };
-    const { api, spies } = makeTabMutationApi(state);
-    const { api: windowsApi } = makeWindowsApi(state, { lastFocused: 500 });
-    const success = mode !== "failed" && mode !== "cancelled";
-    if (mode === "fallback") spies.move.mockRejectedValueOnce(new Error("original move failed"));
-    if (mode === "failed") spies.move.mockRejectedValue(new Error("move failed"));
-    let windowAtRelease: number | undefined;
-    const cdp = {
-      releaseSessionTab: vi.fn(async () => {
-        windowAtRelease = state.tabs.get(7)?.windowId;
-        if (mode === "cleanup_failed") throw new Error("debugger release failed");
-      }),
-    };
-    const controller = new AbortController();
-    if (mode === "cancelled") controller.abort();
-
-    const result = await handleTabReturn(
-      sm,
-      { session_id: "aa11", tab_id: 7 },
-      {
-        tabs: api,
-        windows: windowsApi,
-        cdp,
-        signal: controller.signal,
-        agentOverlayReset: { resetAgentOverlays: vi.fn(async () => {}) },
-      },
-    );
-
-    expect("code" in result).toBe(!success);
-    expect(ctx.borrowedTabs.has(7)).toBe(!success);
-    expect(cdp.releaseSessionTab).toHaveBeenCalledTimes(success ? 1 : 0);
-    if (success) {
-      expect(cdp.releaseSessionTab).toHaveBeenCalledWith("aa11", 7);
-      expect(windowAtRelease).toBe(mode === "fallback" ? 500 : 200);
-      expect(spies.move).toHaveBeenCalledTimes(mode === "fallback" ? 2 : 1);
-    }
-  });
-
  it("returns the tab to its original window/index and clears borrowedTabs", async () => {
    const sm = new SessionManager({ agentWindow: fakeAgentWindow([100]) });
    const ctx = await sm.start("aa11");
@@ -12,7 +12,7 @@ function fakeAgentWindow(ids: number[]) {
      return id;
    }),
    remove: vi.fn(async () => {}),
-    ensureActiveTab: vi.fn(async () => 1),
+    ensureActiveTab: vi.fn(async () => {}),
  };
 }

@@ -11,7 +11,7 @@ function fakeAgentWindow(ids: number[]) {
    return id;
  });
  const remove = vi.fn(async () => {});
-  const ensureActiveTab = vi.fn(async () => 1);
+  const ensureActiveTab = vi.fn(async () => {});
  return { create, remove, ensureActiveTab };
 }

@@ -24,7 +24,7 @@ export interface BorrowResponseMessage {
  allowed: boolean;
 }

-export const CONFIRMATION_TIMEOUT_MS = 60_000;
+export const CONFIRMATION_TIMEOUT_MS = 5000;
 const EXIT_ANIMATION_MS = 150;
 /** Matches BorrowConfirmationOverlay progress ring/bar transition (duration-1000). */
 export const PROGRESS_TRANSITION_MS = 1000;
@@ -480,13 +480,6 @@ export async function requestBorrowConfirmation(
      settle(false);
    }, BACKGROUND_TIMEOUT_MS);

-    // Bring the user window to the front so the overlay is visible even
-    // when the Agent Window has stolen focus. This is fire-and-forget: if
-    // it fails the overlay / OS notification still give the user a path.
-    void windowsApi.update(notificationAnchor.windowId, { focused: true }).catch((err) => {
-      console.debug("[bsk borrow] proactive focus of user window failed", err);
-    });
-
    // Surface the OS notification *before* messaging any candidate so the
    // user has a parallel signal even if every content script is missing.
    // The Allow / Deny buttons let the user authorize explicitly when the
@@ -1,110 +0,0 @@
-import type { RpcError, WaitUntil } from "@/transport/types";
-import { cdpError } from "./errors";
-
-interface NavigationEvent {
-  tabId: number;
-  frameId: number;
-  documentId?: string;
-  error?: string;
-}
-
-interface NavigationEvents {
-  addListener(listener: (details: NavigationEvent) => void): void;
-  removeListener(listener: (details: NavigationEvent) => void): void;
-}
-
-/** Normal browser navigation remains available when chrome.debugger is denied. */
-export interface BrowserNavigationApi {
-  update(tabId: number, props: { url: string }): Promise<unknown>;
-  reload(tabId: number, props: { bypassCache: boolean }): Promise<void>;
-  onCommitted: NavigationEvents;
-  onDOMContentLoaded: NavigationEvents;
-  onCompleted: NavigationEvents;
-  onErrorOccurred: NavigationEvents;
-}
-
-export const chromeBrowserNavigationApi: BrowserNavigationApi = {
-  update: (tabId, props) => chrome.tabs.update(tabId, props),
-  reload: (tabId, props) => chrome.tabs.reload(tabId, props),
-  get onCommitted() {
-    return chrome.webNavigation.onCommitted;
-  },
-  get onDOMContentLoaded() {
-    return chrome.webNavigation.onDOMContentLoaded;
-  },
-  get onCompleted() {
-    return chrome.webNavigation.onCompleted;
-  },
-  get onErrorOccurred() {
-    return chrome.webNavigation.onErrorOccurred;
-  },
-};
-
-export type NavigationOutcome =
-  | { reached: "match" | "timeout" | "cancelled"; lastLifecycle?: string }
-  | { reached: "failed"; error: RpcError };
-
-/** Subscribe before dispatch and ignore the departing document's load events. */
-export async function navigateWithBrowserApi(
-  api: BrowserNavigationApi,
-  tabId: number,
-  action: () => Promise<unknown>,
-  waitUntil: Exclude<WaitUntil, "networkidle">,
-  timeoutMs: number,
-  signal?: AbortSignal,
-): Promise<NavigationOutcome> {
-  if (signal?.aborted) return { reached: "cancelled" };
-  if (timeoutMs <= 0) return { reached: "timeout" };
-  let committed = false;
-  let documentId: string | undefined;
-  let lastLifecycle: string | undefined;
-  let finish!: (outcome: NavigationOutcome) => void;
-  const outcome = new Promise<NavigationOutcome>((resolve) => {
-    finish = resolve;
-  });
-  const isMainFrame = (details: NavigationEvent) =>
-    details.tabId === tabId && details.frameId === 0;
-  const onCommitted = (details: NavigationEvent) => {
-    if (!isMainFrame(details)) return;
-    committed = true;
-    documentId = details.documentId;
-    lastLifecycle = "commit";
-    if (waitUntil === "commit") finish({ reached: "match", lastLifecycle });
-  };
-  const onDOMContentLoaded = (details: NavigationEvent) => {
-    if (!isMainFrame(details) || !committed || (documentId && details.documentId !== documentId))
-      return;
-    lastLifecycle = "DOMContentLoaded";
-    if (waitUntil === "domcontentloaded") finish({ reached: "match", lastLifecycle });
-  };
-  const onCompleted = (details: NavigationEvent) => {
-    if (!isMainFrame(details) || !committed || (documentId && details.documentId !== documentId))
-      return;
-    finish({ reached: "match", lastLifecycle: "load" });
-  };
-  const onError = (details: NavigationEvent) => {
-    if (!isMainFrame(details)) return;
-    finish({ reached: "failed", error: cdpError(details.error ?? "browser navigation failed") });
-  };
-  const onAbort = () => finish({ reached: "cancelled", lastLifecycle });
-  const subscriptions = [
-    [api.onCommitted, onCommitted],
-    [api.onDOMContentLoaded, onDOMContentLoaded],
-    [api.onCompleted, onCompleted],
-    [api.onErrorOccurred, onError],
-  ] as const;
-  for (const [event, listener] of subscriptions) event.addListener(listener);
-  signal?.addEventListener("abort", onAbort, { once: true });
-  const timer = setTimeout(() => finish({ reached: "timeout", lastLifecycle }), timeoutMs);
-  try {
-    if (signal?.aborted) return { reached: "cancelled" };
-    await action();
-    return await outcome;
-  } catch (error) {
-    return { reached: "failed", error: cdpError(error) };
-  } finally {
-    clearTimeout(timer);
-    signal?.removeEventListener("abort", onAbort);
-    for (const [event, listener] of subscriptions) event.removeListener(listener);
-  }
-}
@@ -1,10 +1,10 @@
+import type { DiagnosticSink } from "@/lib/diagnostics";
 import { OVERLAY_AUTOMATION_BYPASS } from "@/lib/overlay-bridge";
 import type { SessionManager } from "@/session-manager/manager";
 import type { Transport } from "@/transport/transport";
 import type {
  ClickParams,
  ConsoleParams,
-  DownloadParams,
  EmulateParams,
  EvaluateParams,
  FillParams,
@@ -29,14 +29,11 @@ import type {
  ScreenshotParams,
  SelectParams,
  SnapshotParams,
-  UploadParams,
  WaitForNavigationParams,
 } from "@/transport/types";
 import { isRequestFrame } from "@/transport/types";
 import { handleConsole } from "./console";
-import { handleDownload } from "./download";
 import { type EmulateCdpRunner, handleEmulate } from "./emulate";
-import { classifyCdpError } from "./errors";
 import { handleEvaluate } from "./evaluate";
 import { handleRequestHelp } from "./human-loop";
 import { handleClick, handleFill, handleHover, handlePress, handleSelect } from "./interaction";
@@ -70,7 +67,6 @@ import {
 import { chromeTabsApi, lookupSession, resolveTargetTab } from "./shared";
 import {
  type BorrowConfirmationApprover,
-  chromeTabMutationApi,
  handleTabBorrow,
  handleTabClose,
  handleTabCreate,
@@ -84,7 +80,6 @@ import {
  type TabReturnParams,
  type TabSelectParams,
 } from "./tabs";
-import { handleUpload } from "./upload";
 import { handleWaitForNavigation } from "./waits";
 import { handleWindowResize, type WindowResizeParams } from "./window";

@@ -120,12 +115,11 @@ export interface DispatcherDeps {
  onSessionsChanged?: () => void;
  /** Invoked before a tool that dispatches page input or mutates browser state is forwarded. */
  onBrowserControlResumed?: (sessionId: string) => void;
-  /** Invoked after a tab is explicitly claimed so its overlay can be refreshed immediately. */
-  onAgentTabClaimed?: (tabId: number, windowId: number) => void;
  /** User approval for `tool.tab_borrow` (overlay in content script). */
  approveBorrow?: BorrowConfirmationApprover;
  /** i18n notification copy for `tool.request_help` (resolved per-call). */
  helpNotificationCopy?: () => { title: string; body: string };
+  diagnostics?: DiagnosticSink;
 }

 /**
@@ -151,9 +145,9 @@ export class ToolDispatcher {
  private readonly recording?: RecordRuntimeDeps;
  private readonly onSessionsChanged?: () => void;
  private readonly onBrowserControlResumed?: (sessionId: string) => void;
-  private readonly onAgentTabClaimed?: (tabId: number, windowId: number) => void;
  private readonly approveBorrow?: BorrowConfirmationApprover;
  private readonly helpNotificationCopy?: () => { title: string; body: string };
+  private readonly diagnostics?: DiagnosticSink;
  private subscription: { dispose(): void } | null = null;
  private readonly hoverBypassTabs = new Map<number, string>();
  private readonly hoverLatches = new Map<number, HoverLatch>();
@@ -172,9 +166,9 @@ export class ToolDispatcher {
    this.recording = deps.recording;
    this.onSessionsChanged = deps.onSessionsChanged;
    this.onBrowserControlResumed = deps.onBrowserControlResumed;
-    this.onAgentTabClaimed = deps.onAgentTabClaimed;
    this.approveBorrow = deps.approveBorrow;
    this.helpNotificationCopy = deps.helpNotificationCopy;
+    this.diagnostics = deps.diagnostics;
  }

  start(): void {
@@ -202,6 +196,16 @@ export class ToolDispatcher {
  private async dispatch(msg: ProtocolFrame): Promise<void> {
    if (!isRequestFrame(msg)) return;
    const req = msg as RequestFrame;
+    const requestSessionId = (req.params as { session_id?: unknown } | undefined)?.session_id;
+    const startedAt = performance.now();
+    this.diagnostics?.("dispatcher.rpc.received", {
+      rpc_id: req.id,
+      method: req.method,
+      session_id: typeof requestSessionId === "string" ? requestSessionId : null,
+      transport_state: this.transport.state,
+      live_session_ids: this.sessions.list().map((ctx) => ctx.sessionId),
+      inflight_rpc_ids: Array.from(this.inflightAbortControllers.keys()),
+    });

    // Cancel frames take a fast path: trip the matching controller
    // (if any), reply with `{cancelled}` so the daemon can answer
@@ -210,6 +214,12 @@ export class ToolDispatcher {
      const params = (req.params as { rpc_id?: string } | undefined) ?? {};
      const target = typeof params.rpc_id === "string" ? params.rpc_id : "";
      const ac = target ? this.inflightAbortControllers.get(target) : undefined;
+      this.diagnostics?.("dispatcher.cancel.received", {
+        rpc_id: req.id,
+        target_rpc_id: target,
+        target_found: ac !== undefined,
+        inflight_rpc_ids: Array.from(this.inflightAbortControllers.keys()),
+      });
      if (ac) {
        try {
          ac.abort();
@@ -223,7 +233,17 @@ export class ToolDispatcher {
      };
      try {
        this.transport.send(reply);
+        this.diagnostics?.("dispatcher.cancel.ack_sent", {
+          rpc_id: req.id,
+          target_rpc_id: target,
+          cancelled: ac !== undefined,
+        });
      } catch (sendErr) {
+        this.diagnostics?.("dispatcher.cancel.ack_failed", {
+          rpc_id: req.id,
+          target_rpc_id: target,
+          error: sendErr,
+        });
        console.warn("[bsk dispatcher] failed to ack cancel", sendErr);
      }
      return;
@@ -240,7 +260,7 @@ export class ToolDispatcher {
      if (sessionId) this.onBrowserControlResumed?.(sessionId);
      const result = await this.invoke(req, ac.signal);
      if (isRpcError(result)) {
-        body = { id: req.id, error: classifyCdpError(result) };
+        body = { id: req.id, error: result };
      } else {
        body = { id: req.id, result };
        if (req.method === "tool.session_start") {
@@ -248,6 +268,13 @@ export class ToolDispatcher {
        }
      }
    } catch (err) {
+      this.diagnostics?.("dispatcher.rpc.invoke_failed", {
+        rpc_id: req.id,
+        method: req.method,
+        session_id: typeof requestSessionId === "string" ? requestSessionId : null,
+        abort_signal: ac.signal.aborted,
+        error: err,
+      });
      if (isAbortLikeError(err)) {
        body = {
          id: req.id,
@@ -268,8 +295,27 @@ export class ToolDispatcher {
    let sent = true;
    try {
      this.transport.send(body);
+      this.diagnostics?.("dispatcher.rpc.response_sent", {
+        rpc_id: req.id,
+        method: req.method,
+        session_id: typeof requestSessionId === "string" ? requestSessionId : null,
+        response_kind: "error" in body ? "error" : "ok",
+        error_code: "error" in body ? body.error.code : null,
+        elapsed_ms: Math.round(performance.now() - startedAt),
+        transport_state: this.transport.state,
+        live_session_ids: this.sessions.list().map((ctx) => ctx.sessionId),
+      });
    } catch (sendErr) {
      sent = false;
+      this.diagnostics?.("dispatcher.rpc.response_send_failed", {
+        rpc_id: req.id,
+        method: req.method,
+        session_id: typeof requestSessionId === "string" ? requestSessionId : null,
+        started_session_id: startedSession,
+        elapsed_ms: Math.round(performance.now() - startedAt),
+        transport_state: this.transport.state,
+        error: sendErr,
+      });
      // Transport is dead by the time we want to reply. Drop the link
      // proactively so the alarm-driven keepalive reconnects sooner
      // and the daemon's pending RPC times out cleanly instead of
@@ -288,12 +334,23 @@ export class ToolDispatcher {
      try {
        const ctx = await this.sessions.stop(startedSession);
        if (ctx) {
+          this.diagnostics?.("dispatcher.session_start.rolled_back", {
+            rpc_id: req.id,
+            session_id: startedSession,
+            agent_window_id: ctx.agentWindowId,
+            reason: "response_send_failed",
+          });
          console.warn(
            "[bsk dispatcher] rolled back orphan session after send failure",
            startedSession,
          );
        }
      } catch (rollbackErr) {
+        this.diagnostics?.("dispatcher.session_start.rollback_failed", {
+          rpc_id: req.id,
+          session_id: startedSession,
+          error: rollbackErr,
+        });
        console.warn("[bsk dispatcher] session rollback after send failure failed", rollbackErr);
      }
    }
@@ -308,25 +365,13 @@ export class ToolDispatcher {
        await this.releaseHoverLatch((req.params as SessionStopParams).session_id);
        return handleSessionStop(this.sessions, req.params as SessionStopParams, {
          cdp: this.cdp,
-          // Must be wired in production: the agent-tab cleanup and the
-          // window-release decision (issue #57) read these deps directly
-          // and silently no-op when they are absent.
-          tabManagement: { tabs: chromeTabMutationApi },
-          tabsQuery: chromeTabsApi,
          signal,
        });
      }
      case "tool.tab_list":
        return handleTabList(this.sessions, req.params as TabListParams, chromeTabsApi, signal);
-      case "tool.tab_create": {
-        const result = await handleTabCreate(this.sessions, req.params as TabCreateParams, {
-          signal,
-        });
-        if (!isRpcError(result)) {
-          this.onAgentTabClaimed?.(result.tab_id, result.window_id);
-        }
-        return result;
-      }
+      case "tool.tab_create":
+        return handleTabCreate(this.sessions, req.params as TabCreateParams, { signal });
      case "tool.tab_close":
        return this.withHoverReleaseForRequest(
          req.params as TabCloseParams,
@@ -335,22 +380,13 @@ export class ToolDispatcher {
        );
      case "tool.tab_select":
        return handleTabSelect(this.sessions, req.params as TabSelectParams, { signal });
-      case "tool.tab_borrow": {
-        const result = await handleTabBorrow(this.sessions, req.params as TabBorrowParams, {
+      case "tool.tab_borrow":
+        return handleTabBorrow(this.sessions, req.params as TabBorrowParams, {
          signal,
          approveBorrow: this.approveBorrow,
        });
-        if (!isRpcError(result)) {
-          this.onAgentTabClaimed?.(result.tab_id, result.agent_window_id);
-        }
-        return result;
-      }
      case "tool.tab_return":
-        return handleTabReturn(this.sessions, req.params as TabReturnParams, {
-          signal,
-          cdp: this.cdp,
-          beforeReturn: (sessionId, tabId) => this.releaseHoverLatch(sessionId, tabId),
-        });
+        return handleTabReturn(this.sessions, req.params as TabReturnParams, { signal });
      case "tool.window_resize":
        return handleWindowResize(
          this.sessions,
@@ -414,11 +450,7 @@ export class ToolDispatcher {
                ? {
                    cdp: this.cdp,
                    tabsApi: chromeTabsCaptureApi,
-                    // Active hover probing is opt-in. A held hover latch still
-                    // suppresses it, because probing would move the cursor off
-                    // the element the caller is deliberately holding.
-                    conditionalSurfaceProbe:
-                      params.probe_hover === true && !this.hasHoverLatchForScope(hoverScope),
+                    conditionalSurfaceProbe: !this.hasHoverLatchForScope(hoverScope),
                    hoverProbeBypassOverlay: bypassOverlay,
                  }
                : undefined,
@@ -548,40 +580,6 @@ export class ToolDispatcher {
            ),
          signal,
        );
-      case "tool.upload":
-        return this.withHoverReleaseForRequest(
-          req.params as UploadParams,
-          () =>
-            this.cdp
-              ? handleUpload(this.sessions, req.params as UploadParams, {
-                  cdp: this.cdp,
-                  tabsApi: chromeTabsApi,
-                  signal,
-                  bypassOverlay,
-                })
-              : Promise.resolve({
-                  code: "unsupported",
-                  message: "upload requires CDP",
-                } satisfies RpcError),
-          signal,
-        );
-      case "tool.download":
-        return this.withHoverReleaseForRequest(
-          req.params as DownloadParams,
-          () =>
-            this.cdp
-              ? handleDownload(this.sessions, req.params as DownloadParams, {
-                  cdp: this.cdp,
-                  tabsApi: chromeTabsApi,
-                  signal,
-                  bypassOverlay,
-                })
-              : Promise.resolve({
-                  code: "unsupported",
-                  message: "download requires CDP",
-                } satisfies RpcError),
-          signal,
-        );
      case "tool.evaluate":
        return handleEvaluate(
          this.sessions,
@@ -788,8 +786,6 @@ function sessionIdForBrowserControlMethod(req: RequestFrame): string | null {
    case "tool.fill":
    case "tool.press":
    case "tool.select":
-    case "tool.upload":
-    case "tool.download":
    case "tool.evaluate":
    case "tool.observe":
    case "tool.request_help":
@@ -1,364 +0,0 @@
-// Order-independent coordinator for one browser download. CDP supplies the
-// exact target/frame intent while chrome.downloads supplies the download id
-// and filename routing hook; neither event is assumed to arrive first.
-
-import type { CdpTarget } from "@/browser-driver/frame-graph";
-import type { ClickResult, RpcError, TransferEffectState } from "@/transport/types";
-import { transferError } from "./errors";
-import { type CdpRunner, isRpcError } from "./shared";
-
-const CORRELATION_GRACE_MS = 750;
-const UNIQUE_SETTLE_MS = 50;
-const SIZE_POLL_MS = 250;
-
-type DeterminingFilenameListener = (
-  item: chrome.downloads.DownloadItem,
-  suggest: (suggestion?: chrome.downloads.DownloadFilenameSuggestion) => void,
-) => void | true;
-
-interface ListenerEvent<T> {
-  addListener(listener: T): void;
-  removeListener(listener: T): void;
-}
-
-export interface DownloadsApi {
-  onCreated: ListenerEvent<(item: chrome.downloads.DownloadItem) => void>;
-  onChanged: ListenerEvent<(delta: chrome.downloads.DownloadDelta) => void>;
-  onDeterminingFilename: ListenerEvent<DeterminingFilenameListener>;
-  search(query: chrome.downloads.DownloadQuery): Promise<chrome.downloads.DownloadItem[]>;
-  cancel(downloadId: number): Promise<void>;
-  removeFile(downloadId: number): Promise<void>;
-}
-
-export const chromeDownloadsApi: DownloadsApi = {
-  get onCreated() {
-    return chrome.downloads.onCreated;
-  },
-  get onChanged() {
-    return chrome.downloads.onChanged;
-  },
-  get onDeterminingFilename() {
-    return chrome.downloads.onDeterminingFilename;
-  },
-  search: (query) => chrome.downloads.search(query),
-  cancel: (id) => chrome.downloads.cancel(id),
-  removeFile: (id) => chrome.downloads.removeFile(id),
-};
-
-export interface DownloadCaptureOptions {
-  cdp: CdpRunner;
-  target: CdpTarget;
-  expectedFrameId?: string;
-  downloads: DownloadsApi;
-  browserRelativeDir: string;
-  maxByteSize?: number;
-  timeoutMs: number;
-  signal?: AbortSignal;
-  trigger(): Promise<ClickResult | RpcError>;
-}
-
-export interface DownloadCaptureResult {
-  click: ClickResult;
-  item: chrome.downloads.DownloadItem;
-}
-
-interface DownloadIntent {
-  url: string;
-  suggestedFilename: string;
-  frameId?: string;
-}
-
-interface DownloadCandidate {
-  item: chrome.downloads.DownloadItem;
-  suggest: (suggestion?: chrome.downloads.DownloadFilenameSuggestion) => void;
-  suggested: boolean;
-  graceTimer: ReturnType<typeof setTimeout>;
-}
-
-function safeBasename(filename: string): string {
-  const basename = filename.split(/[\\/]/).pop()?.trim();
-  return basename && basename !== "." && basename !== ".." ? basename : "download";
-}
-
-function sameTarget(source: { tabId?: number; sessionId?: string }, target: CdpTarget): boolean {
-  return source.tabId === target.tabId && source.sessionId === target.sessionId;
-}
-
-function matchesIntent(item: chrome.downloads.DownloadItem, intent: DownloadIntent): boolean {
-  const urlMatches = item.url === intent.url || item.finalUrl === intent.url;
-  return urlMatches && safeBasename(item.filename) === safeBasename(intent.suggestedFilename);
-}
-
-function knownSize(item: chrome.downloads.DownloadItem): number | undefined {
-  if (item.fileSize >= 0) return item.fileSize;
-  if (item.totalBytes >= 0) return item.totalBytes;
-  return undefined;
-}
-
-function captureError(
-  message: string,
-  effectState: TransferEffectState,
-  phase: string,
-  cleanupFailed = false,
-): RpcError {
-  return transferError("cdp_failed", "download_capture_failed", message, {
-    effectState,
-    phase,
-    ...(cleanupFailed ? { cleanupState: "failed" } : {}),
-  });
-}
-
-async function cleanupClaimedDownload(downloads: DownloadsApi, downloadId: number): Promise<void> {
-  const lookup = async () => (await downloads.search({ id: downloadId }))[0];
-  const item = await lookup();
-  if (!item || item.state === "interrupted") return;
-  if (item.state === "complete") {
-    await downloads.removeFile(downloadId);
-    return;
-  }
-
-  try {
-    await downloads.cancel(downloadId);
-  } catch (cancelError) {
-    // Completion can win the race after the lookup but before cancellation.
-    // Reconcile against Chrome's authoritative state before declaring cleanup
-    // failed so every terminal state has one explicit cleanup path.
-    const reconciled = await lookup();
-    if (!reconciled || reconciled.state === "interrupted") return;
-    if (reconciled.state === "complete") {
-      await downloads.removeFile(downloadId);
-      return;
-    }
-    throw cancelError;
-  }
-}
-
-export async function captureBrowserDownload(
-  options: DownloadCaptureOptions,
-): Promise<DownloadCaptureResult | RpcError> {
-  let click: ClickResult | undefined;
-  let intent: DownloadIntent | undefined;
-  let capturedId: number | undefined;
-  let settled = false;
-  let succeeded = false;
-  let failureResult: RpcError | undefined;
-  let uniquenessTimer: ReturnType<typeof setTimeout> | undefined;
-  let operationTimer: ReturnType<typeof setTimeout> | undefined;
-  let sizePoll: ReturnType<typeof setInterval> | undefined;
-  const candidates = new Map<number, DownloadCandidate>();
-  const createdItems = new Map<number, chrome.downloads.DownloadItem>();
-
-  let resolveCompletion!: (item: chrome.downloads.DownloadItem) => void;
-  let rejectCompletion!: (error: Error) => void;
-  const completion = new Promise<chrome.downloads.DownloadItem>((resolve, reject) => {
-    resolveCompletion = resolve;
-    rejectCompletion = reject;
-  });
-  const fail = (error: Error) => {
-    if (settled) return;
-    settled = true;
-    rejectCompletion(error);
-  };
-  const complete = (item: chrome.downloads.DownloadItem) => {
-    if (settled) return;
-    const size = knownSize(item);
-    if (size !== undefined && options.maxByteSize !== undefined && size > options.maxByteSize) {
-      fail(new Error(`download exceeds transfer limit ${options.maxByteSize}`));
-      return;
-    }
-    settled = true;
-    resolveCompletion(item);
-  };
-  const suggestDefault = (candidate: DownloadCandidate) => {
-    if (candidate.suggested) return;
-    candidate.suggested = true;
-    candidate.suggest();
-  };
-  const matchingCandidates = (): DownloadCandidate[] => {
-    const currentIntent = intent;
-    return currentIntent
-      ? [...candidates.values()].filter(
-          (candidate) => !candidate.suggested && matchesIntent(candidate.item, currentIntent),
-        )
-      : [];
-  };
-
-  const claimUnique = () => {
-    uniquenessTimer = undefined;
-    if (settled || capturedId !== undefined || !intent) return;
-    const matches = matchingCandidates();
-    if (matches.length !== 1) {
-      if (matches.length > 1) {
-        for (const candidate of matches) suggestDefault(candidate);
-        fail(new Error("download attribution is ambiguous"));
-      }
-      return;
-    }
-    const candidate = matches[0];
-    candidate.suggested = true;
-    clearTimeout(candidate.graceTimer);
-    capturedId = candidate.item.id;
-    candidate.suggest({
-      filename: `${options.browserRelativeDir}/${safeBasename(intent.suggestedFilename)}`,
-      conflictAction: "overwrite",
-    });
-    const size = knownSize(candidate.item);
-    if (size !== undefined && options.maxByteSize !== undefined && size > options.maxByteSize) {
-      fail(new Error(`download exceeds transfer limit ${options.maxByteSize}`));
-      return;
-    }
-    const created = createdItems.get(candidate.item.id);
-    if (created?.state === "interrupted") {
-      fail(new Error(created.error ?? "download interrupted"));
-    } else if (created?.state === "complete") {
-      complete(created);
-    }
-  };
-  const reconcile = () => {
-    if (settled || capturedId !== undefined || !intent) return;
-    const matches = matchingCandidates();
-    if (matches.length > 1) {
-      for (const candidate of matches) suggestDefault(candidate);
-      fail(new Error("download attribution is ambiguous"));
-      return;
-    }
-    if (matches.length === 1 && !uniquenessTimer) {
-      uniquenessTimer = setTimeout(claimUnique, UNIQUE_SETTLE_MS);
-    }
-  };
-
-  const determiningListener: DeterminingFilenameListener = (item, suggest) => {
-    const candidate: DownloadCandidate = {
-      item,
-      suggest,
-      suggested: false,
-      graceTimer: setTimeout(() => {
-        suggestDefault(candidate);
-        candidates.delete(item.id);
-        if (intent && matchesIntent(item, intent) && capturedId === undefined) {
-          fail(new Error("download correlation grace elapsed before unique attribution"));
-        }
-      }, CORRELATION_GRACE_MS),
-    };
-    candidates.set(item.id, candidate);
-    reconcile();
-    return true;
-  };
-  const createdListener = (item: chrome.downloads.DownloadItem) => {
-    createdItems.set(item.id, item);
-    if (capturedId !== item.id) return;
-    if (item.state === "interrupted") {
-      fail(new Error(item.error ?? "download interrupted"));
-    } else if (item.state === "complete") {
-      complete(item);
-    }
-  };
-  const changedListener = async (delta: chrome.downloads.DownloadDelta) => {
-    if (capturedId === undefined || delta.id !== capturedId || settled) return;
-    if (delta.state?.current === "interrupted" || delta.error?.current) {
-      fail(new Error(delta.error?.current ?? "download interrupted"));
-      return;
-    }
-    if (delta.state?.current === "complete") {
-      try {
-        const [item] = await options.downloads.search({ id: delta.id });
-        if (item) complete(item);
-        else fail(new Error("completed download disappeared"));
-      } catch (err) {
-        fail(err instanceof Error ? err : new Error(String(err)));
-      }
-    }
-  };
-  const onAbort = () => fail(new DOMException("aborted", "AbortError"));
-  const cdpSubscription = options.cdp.onEvent?.((source, method, raw) => {
-    if (method !== "Page.downloadWillBegin" || !sameTarget(source, options.target)) return;
-    const event = raw as { url?: unknown; suggestedFilename?: unknown; frameId?: unknown };
-    if (typeof event.url !== "string" || typeof event.suggestedFilename !== "string") return;
-    if (options.expectedFrameId && event.frameId !== options.expectedFrameId) {
-      fail(new Error("download originated from a different frame"));
-      return;
-    }
-    if (intent) {
-      fail(new Error("download trigger produced more than one browser download intent"));
-      return;
-    }
-    intent = {
-      url: event.url,
-      suggestedFilename: event.suggestedFilename,
-      ...(typeof event.frameId === "string" ? { frameId: event.frameId } : {}),
-    };
-    reconcile();
-  });
-  if (!cdpSubscription) {
-    return captureError("CDP download intent subscription unavailable", "none", "arm");
-  }
-
-  options.downloads.onDeterminingFilename.addListener(determiningListener);
-  options.downloads.onCreated.addListener(createdListener);
-  options.downloads.onChanged.addListener(changedListener);
-  options.signal?.addEventListener("abort", onAbort, { once: true });
-  operationTimer = setTimeout(
-    () => fail(new Error("download did not complete before timeout")),
-    options.timeoutMs,
-  );
-  sizePoll = setInterval(() => {
-    if (capturedId === undefined || settled || options.maxByteSize === undefined) return;
-    void options.downloads
-      .search({ id: capturedId })
-      .then(([item]) => {
-        if (!item || settled) return;
-        if (item.bytesReceived > (options.maxByteSize as number)) {
-          fail(new Error(`download exceeds transfer limit ${options.maxByteSize}`));
-        }
-      })
-      .catch((err) => fail(err instanceof Error ? err : new Error(String(err))));
-  }, SIZE_POLL_MS);
-
-  try {
-    const triggered = await options.trigger();
-    if (isRpcError(triggered)) {
-      void completion.catch(() => undefined);
-      const effect: TransferEffectState =
-        capturedId !== undefined ? "committed" : intent ? "unknown" : "none";
-      failureResult = {
-        ...triggered,
-        data: { ...triggered.data, effect_state: effect, phase: "trigger" },
-      };
-      return failureResult;
-    }
-    click = triggered;
-    const item = await completion;
-    succeeded = true;
-    return { click, item };
-  } catch (err) {
-    const effect: TransferEffectState =
-      capturedId !== undefined ? "committed" : click ? "unknown" : "none";
-    failureResult = captureError(
-      err instanceof Error ? err.message : String(err),
-      effect,
-      capturedId !== undefined ? "download" : "attribution",
-    );
-    return failureResult;
-  } finally {
-    settled = true;
-    if (operationTimer) clearTimeout(operationTimer);
-    if (uniquenessTimer) clearTimeout(uniquenessTimer);
-    if (sizePoll) clearInterval(sizePoll);
-    options.signal?.removeEventListener("abort", onAbort);
-    options.downloads.onDeterminingFilename.removeListener(determiningListener);
-    options.downloads.onCreated.removeListener(createdListener);
-    options.downloads.onChanged.removeListener(changedListener);
-    cdpSubscription.dispose();
-    for (const candidate of candidates.values()) {
-      clearTimeout(candidate.graceTimer);
-      if (candidate.item.id !== capturedId) suggestDefault(candidate);
-    }
-    if (!succeeded && capturedId !== undefined) {
-      try {
-        await cleanupClaimedDownload(options.downloads, capturedId);
-      } catch {
-        if (failureResult?.data) failureResult.data.cleanup_state = "failed";
-      }
-    }
-  }
-}
@@ -1,64 +0,0 @@
-// Download orchestration: validate session/tab ownership, then delegate one
-// browser-global chrome.downloads transaction to download-capture.ts.
-
-import type { SessionManager } from "@/session-manager/manager";
-import type { DownloadParams, DownloadResult, RpcError } from "@/transport/types";
-import { captureBrowserDownload, chromeDownloadsApi, type DownloadsApi } from "./download-capture";
-import { clickResolvedTarget, type InteractionDeps, resolveActionTarget } from "./interaction";
-import { enforceAgentWindow, isRpcError, lookupSession, resolveTargetTab } from "./shared";
-
-let downloadActive = false;
-
-export type { DownloadsApi } from "./download-capture";
-
-export interface DownloadDeps extends InteractionDeps {
-  downloads?: DownloadsApi;
-}
-
-export async function handleDownload(
-  manager: SessionManager,
-  params: DownloadParams,
-  deps: DownloadDeps,
-): Promise<DownloadResult | RpcError> {
-  if (downloadActive) return { code: "invalid_params", message: "another bsk download is active" };
-  downloadActive = true;
-  try {
-    const ctx = lookupSession(manager, params, "download");
-    if (isRpcError(ctx)) return ctx;
-    const target = await resolveTargetTab(manager, ctx, params.tab_id, deps.tabsApi);
-    if (isRpcError(target)) return target;
-    const denied = enforceAgentWindow(ctx, target, "download");
-    if (denied) return denied;
-    if (!params.browser_relative_dir) {
-      return { code: "invalid_params", message: "download requires a daemon capability directory" };
-    }
-    const address = await resolveActionTarget(deps.cdp, ctx, target, params, "download");
-    if (isRpcError(address)) return address;
-
-    const capture = await captureBrowserDownload({
-      cdp: deps.cdp,
-      target: address.cdpTarget,
-      downloads: deps.downloads ?? chromeDownloadsApi,
-      browserRelativeDir: params.browser_relative_dir,
-      maxByteSize: params.max_byte_size,
-      timeoutMs: params.timeout_ms ?? 120_000,
-      signal: deps.signal,
-      expectedFrameId: address.frameId,
-      trigger: () => clickResolvedTarget(ctx, address, {}, deps),
-    });
-    if (isRpcError(capture)) return capture;
-    const { click, item } = capture;
-    return {
-      tab_id: target.tabId,
-      used_ref: click.used_ref,
-      used_selector: click.used_selector,
-      suggested_filename: item.filename.split(/[\\/]/).pop() ?? "download",
-      byte_size: item.fileSize >= 0 ? item.fileSize : item.totalBytes,
-      mime: item.mime || undefined,
-      danger: item.danger,
-      browser_path: item.filename,
-    };
-  } finally {
-    downloadActive = false;
-  }
-}
@@ -2,51 +2,10 @@
 // rendering. Extension handlers attach reasons here; human-facing copy
 // lives in bsk-cli `render_error.rs`.

-import type {
-  ErrorCode,
-  RpcError,
-  RpcErrorData,
-  RpcErrorReason,
-  TransferCleanupState,
-  TransferEffectState,
-} from "@/transport/types";
+import type { ErrorCode, RpcError, RpcErrorData, RpcErrorReason } from "@/transport/types";

 export type { RpcErrorData, RpcErrorReason };

-/** Chrome checks the whole tab's frame tree, including other extensions' frames. */
-export function isCdpExtensionAccessDenied(error: unknown): boolean {
-  const message = error instanceof Error ? error.message : String(error);
-  return message.includes("Cannot access a chrome-extension:// URL of different extension");
-}
-
-/** Preserve more specific reasons, especially file-transfer outcome/cleanup details. */
-export function classifyCdpError(error: RpcError): RpcError {
-  if (
-    error.code !== "cdp_failed" ||
-    error.data?.reason ||
-    !isCdpExtensionAccessDenied(error.message)
-  ) {
-    return error;
-  }
-  return {
-    ...error,
-    data: { ...error.data, reason: "cdp_extension_access_denied" },
-  };
-}
-
-export function cdpError(error: unknown): RpcError {
-  return classifyCdpError({
-    code: "cdp_failed",
-    message: error instanceof Error ? error.message : String(error),
-  });
-}
-
-export interface TransferErrorOptions {
-  effectState: TransferEffectState;
-  phase: string;
-  cleanupState?: TransferCleanupState;
-}
-
 export function rpcError(
  code: ErrorCode,
  reason: RpcErrorReason,
@@ -56,16 +15,3 @@ export function rpcError(
  const data: RpcErrorData = { reason, ...extra };
  return { code, message, data };
 }
-
-export function transferError(
-  code: ErrorCode,
-  reason: RpcErrorReason,
-  message: string,
-  options: TransferErrorOptions,
-): RpcError {
-  return rpcError(code, reason, message, {
-    effect_state: options.effectState,
-    phase: options.phase,
-    ...(options.cleanupState ? { cleanup_state: options.cleanupState } : {}),
-  });
-}
@@ -1,319 +0,0 @@
-// One native file-drop transaction bound to an explicit page target. CDP drag
-// events are sent to the target that owns the node: root targets use top-level
-// coordinates, while OOPIF targets require coordinates local to their session.
-
-import type { RpcError, TransferEffectState } from "@/transport/types";
-import { transferError } from "./errors";
-import { resolveNodeGeometry } from "./frame-geometry";
-import type { ResolvedActionTarget } from "./interaction";
-import { type CdpRunner, isRpcError, sendToCdpTarget } from "./shared";
-import { BoundedWaitError, waitBounded } from "./transfer-transaction";
-
-const CLEANUP_TIMEOUT_MS = 1_000;
-
-type FileDropPhase = "resolve_target" | "drag_enter" | "drag_over" | "drop" | "cleanup";
-
-interface RuntimeReply {
-  result?: { value?: unknown; objectId?: string };
-  exceptionDetails?: { text?: string; exception?: { description?: string } };
-}
-
-interface DragData {
-  items: [];
-  files: string[];
-  dragOperationsMask: number;
-}
-
-export interface FileDropTransactionOptions {
-  cdp: CdpRunner;
-  actionTarget: ResolvedActionTarget;
-  files: string[];
-  timeoutMs: number;
-  signal?: AbortSignal;
-  withOverlayHidden: <T>(operation: () => Promise<T>) => Promise<T>;
-}
-
-export interface FileDropTransactionResult {
-  x: number;
-  y: number;
-}
-
-function failure(
-  code: RpcError["code"],
-  reason: "upload_mechanism_unsupported" | "file_drop_target_unavailable" | "file_drop_failed",
-  message: string,
-  effectState: TransferEffectState,
-  phase: FileDropPhase,
-): RpcError {
-  const error = transferError(code, reason, message, { effectState, phase });
-  error.data = { ...error.data, mechanism: "drop" };
-  return error;
-}
-
-function enrichFailure(
-  error: RpcError,
-  effectState: TransferEffectState,
-  phase: FileDropPhase,
-): RpcError {
-  return {
-    ...error,
-    data: {
-      ...error.data,
-      mechanism: "drop",
-      effect_state: effectState,
-      phase,
-    },
-  };
-}
-
-function messageOf(error: unknown): string {
-  return error instanceof Error ? error.message : String(error);
-}
-
-function methodUnavailable(error: unknown): boolean {
-  return /(?:method|command).*(?:not found|wasn't found|unsupported)|wasn't found|-32601/i.test(
-    messageOf(error),
-  );
-}
-
-function runtimeError(reply: RuntimeReply, fallback: string): Error | null {
-  if (!reply.exceptionDetails) return null;
-  return new Error(
-    reply.exceptionDetails.exception?.description ?? reply.exceptionDetails.text ?? fallback,
-  );
-}
-
-async function pointBelongsToTarget(
-  options: FileDropTransactionOptions,
-  x: number,
-  y: number,
-  objectGroup: string,
-): Promise<boolean> {
-  const target = options.actionTarget.cdpTarget;
-  const hit = await sendToCdpTarget<{ backendNodeId?: number; frameId?: string }>(
-    options.cdp,
-    target,
-    "DOM.getNodeForLocation",
-    { x: Math.round(x), y: Math.round(y), includeUserAgentShadowDOM: true },
-  );
-  if (typeof hit.backendNodeId !== "number") return false;
-  if (options.actionTarget.frameId && hit.frameId !== options.actionTarget.frameId) return false;
-
-  const [resolvedTarget, resolvedHit] = await Promise.all([
-    sendToCdpTarget<{ object?: { objectId?: string } }>(options.cdp, target, "DOM.resolveNode", {
-      backendNodeId: options.actionTarget.backendNodeId,
-      objectGroup,
-    }),
-    sendToCdpTarget<{ object?: { objectId?: string } }>(options.cdp, target, "DOM.resolveNode", {
-      backendNodeId: hit.backendNodeId,
-      objectGroup,
-    }),
-  ]);
-  const targetObjectId = resolvedTarget.object?.objectId;
-  const hitObjectId = resolvedHit.object?.objectId;
-  if (!targetObjectId || !hitObjectId) return false;
-
-  const reply = await sendToCdpTarget<RuntimeReply>(options.cdp, target, "Runtime.callFunctionOn", {
-    objectId: targetObjectId,
-    functionDeclaration: `function(hit) {
-        for (let node = hit; node; ) {
-          if (node === this) return true;
-          if (this.contains?.(node)) return true;
-          const root = node.getRootNode?.();
-          node = node.parentNode || (root && root !== node ? root.host : null);
-        }
-        return false;
-      }`,
-    arguments: [{ objectId: hitObjectId }],
-    returnByValue: true,
-  });
-  const error = runtimeError(reply, "failed to verify file-drop target");
-  if (error) throw error;
-  return reply.result?.value === true;
-}
-
-export async function uploadThroughFileDrop(
-  options: FileDropTransactionOptions,
-): Promise<FileDropTransactionResult | RpcError> {
-  const deadline = Date.now() + options.timeoutMs;
-  const target = options.actionTarget.cdpTarget;
-  const objectGroup = `bsk-file-drop-${crypto.randomUUID()}`;
-  const dragData: DragData = {
-    items: [],
-    files: options.files,
-    dragOperationsMask: 1,
-  };
-  let dragStarted = false;
-  let dropSent = false;
-  let dragPoint = { x: 0, y: 0 };
-  let cleanupFailed = false;
-  let outcome: FileDropTransactionResult | RpcError = failure(
-    "protocol_error",
-    "file_drop_failed",
-    "file-drop transaction ended without an outcome",
-    "none",
-    "cleanup",
-  );
-
-  try {
-    const geometry = await waitBounded(
-      resolveNodeGeometry(
-        options.cdp,
-        options.actionTarget.tab.tabId,
-        {
-          target,
-          backendNodeId: options.actionTarget.backendNodeId,
-          ...(options.actionTarget.frameId ? { frameId: options.actionTarget.frameId } : {}),
-        },
-        { scrollIntoView: true },
-      ),
-      deadline,
-      options.signal,
-      "resolving file-drop target timed out",
-    );
-    if (isRpcError(geometry)) {
-      outcome = enrichFailure(geometry, "none", "resolve_target");
-      return outcome;
-    }
-    const point = geometry.targetActionPoint;
-    dragPoint = point;
-
-    outcome = await options.withOverlayHidden(async () => {
-      try {
-        try {
-          const belongs = await waitBounded(
-            pointBelongsToTarget(options, point.x, point.y, objectGroup),
-            deadline,
-            options.signal,
-            "verifying file-drop target timed out",
-          );
-          if (!belongs) {
-            return failure(
-              "permission_denied",
-              "file_drop_target_unavailable",
-              "file-drop target is not the topmost element at its action point",
-              "none",
-              "resolve_target",
-            );
-          }
-        } catch (error) {
-          return failure(
-            error instanceof BoundedWaitError ? "timeout" : "cdp_failed",
-            "file_drop_target_unavailable",
-            messageOf(error),
-            "none",
-            "resolve_target",
-          );
-        }
-
-        for (const [type, phase] of [
-          ["dragEnter", "drag_enter"],
-          ["dragOver", "drag_over"],
-        ] as const) {
-          try {
-            if (type === "dragEnter") dragStarted = true;
-            await waitBounded(
-              sendToCdpTarget(options.cdp, target, "Input.dispatchDragEvent", {
-                type,
-                x: point.x,
-                y: point.y,
-                data: dragData,
-              }),
-              deadline,
-              options.signal,
-              `${type} timed out`,
-            );
-          } catch (error) {
-            const unsupported = methodUnavailable(error);
-            if (type === "dragEnter" && unsupported) dragStarted = false;
-            return failure(
-              unsupported
-                ? "unsupported"
-                : error instanceof BoundedWaitError
-                  ? "timeout"
-                  : "cdp_failed",
-              unsupported ? "upload_mechanism_unsupported" : "file_drop_failed",
-              messageOf(error),
-              "none",
-              phase,
-            );
-          }
-        }
-
-        try {
-          dropSent = true;
-          await waitBounded(
-            sendToCdpTarget(options.cdp, target, "Input.dispatchDragEvent", {
-              type: "drop",
-              x: point.x,
-              y: point.y,
-              data: dragData,
-            }),
-            deadline,
-            options.signal,
-            "file drop timed out",
-          );
-          return { x: point.x, y: point.y };
-        } catch (error) {
-          outcome = failure(
-            error instanceof BoundedWaitError ? "timeout" : "cdp_failed",
-            "file_drop_failed",
-            messageOf(error),
-            "unknown",
-            "drop",
-          );
-          return outcome;
-        }
-      } finally {
-        if (dragStarted && !dropSent) {
-          try {
-            await waitBounded(
-              sendToCdpTarget(options.cdp, target, "Input.dispatchDragEvent", {
-                type: "dragCancel",
-                x: dragPoint.x,
-                y: dragPoint.y,
-                data: dragData,
-              }),
-              Date.now() + CLEANUP_TIMEOUT_MS,
-              undefined,
-              "cancelling file drag timed out",
-            );
-          } catch {
-            cleanupFailed = true;
-          }
-        }
-      }
-    });
-    return outcome;
-  } catch (error) {
-    outcome = failure(
-      error instanceof BoundedWaitError ? "timeout" : "cdp_failed",
-      "file_drop_target_unavailable",
-      messageOf(error),
-      "none",
-      "resolve_target",
-    );
-    return outcome;
-  } finally {
-    try {
-      await waitBounded(
-        sendToCdpTarget(options.cdp, target, "Runtime.releaseObjectGroup", { objectGroup }),
-        Date.now() + CLEANUP_TIMEOUT_MS,
-        undefined,
-        "releasing file-drop object group timed out",
-      );
-    } catch {
-      cleanupFailed = true;
-    }
-
-    const effect = isRpcError(outcome)
-      ? (outcome.data?.effect_state as TransferEffectState | undefined)
-      : "committed";
-    if (effect === "unknown" || cleanupFailed) {
-      await options.cdp.detach?.(target.tabId);
-    }
-    if (cleanupFailed && isRpcError(outcome)) {
-      outcome.data = { ...outcome.data, cleanup_state: "failed" };
-    }
-  }
-}
@@ -1,445 +0,0 @@
-// One upload transaction with an explicit browser-side commit boundary.
-// Chrome interception prevents a native chooser from escaping automation;
-// chooser events and a frame-scoped DOM probe are independent input-location
-// signals, so event delivery is not required for standard file inputs.
-
-import type { ClickResult, RpcError, TransferEffectState } from "@/transport/types";
-import { transferError } from "./errors";
-import type { ResolvedActionTarget } from "./interaction";
-import { type CdpRunner, isRpcError, sendToCdpTarget } from "./shared";
-import { BoundedWaitError, remainingMs, waitBounded } from "./transfer-transaction";
-
-const CLEANUP_TIMEOUT_MS = 1_000;
-const ACTIVATION_GRACE_MS = 1_000;
-const PROBE_INTERVAL_MS = 20;
-
-type UploadPhase =
-  | "arm_interception"
-  | "arm_input_probe"
-  | "trigger"
-  | "resolve_input"
-  | "set_files"
-  | "cleanup";
-
-interface RuntimeReply {
-  result?: { value?: unknown; objectId?: string };
-  exceptionDetails?: { text?: string; exception?: { description?: string } };
-}
-
-interface ChooserEvent {
-  frameId?: string;
-  backendNodeId?: number;
-  mode?: "selectSingle" | "selectMultiple";
-}
-
-export interface FileInputTransactionOptions {
-  cdp: CdpRunner;
-  actionTarget: ResolvedActionTarget;
-  files: string[];
-  timeoutMs: number;
-  signal?: AbortSignal;
-  trigger(): Promise<ClickResult | RpcError>;
-}
-
-export interface FileInputTransactionResult {
-  click: ClickResult;
-  multiple: boolean;
-}
-
-function runtimeError(reply: RuntimeReply, fallback: string): Error | null {
-  if (!reply.exceptionDetails) return null;
-  return new Error(
-    reply.exceptionDetails.exception?.description ?? reply.exceptionDetails.text ?? fallback,
-  );
-}
-
-function transferFailure(
-  code: RpcError["code"],
-  reason: "file_input_probe_failed" | "file_input_not_activated" | "set_file_input_failed",
-  message: string,
-  effectState: TransferEffectState,
-  phase: UploadPhase,
-): RpcError {
-  return transferError(code, reason, message, { effectState, phase });
-}
-
-function enrichFailure(
-  error: RpcError,
-  effectState: TransferEffectState,
-  phase: UploadPhase,
-): RpcError {
-  return {
-    ...error,
-    data: { ...error.data, effect_state: effectState, phase },
-  };
-}
-
-function sameTarget(
-  source: { tabId?: number; sessionId?: string },
-  target: { tabId: number; sessionId?: string },
-): boolean {
-  return source.tabId === target.tabId && source.sessionId === target.sessionId;
-}
-
-async function delay(ms: number, signal?: AbortSignal): Promise<void> {
-  await waitBounded(
-    new Promise((resolve) => setTimeout(resolve, ms)),
-    Date.now() + ms + 1,
-    signal,
-    "upload activation probe timed out",
-  );
-}
-
-async function callOnTrigger<T = RuntimeReply>(
-  options: FileInputTransactionOptions,
-  objectId: string,
-  functionDeclaration: string,
-  args: unknown[],
-  returnByValue: boolean,
-): Promise<T> {
-  return sendToCdpTarget<T>(options.cdp, options.actionTarget.cdpTarget, "Runtime.callFunctionOn", {
-    objectId,
-    functionDeclaration,
-    arguments: args.map((value) => ({ value })),
-    returnByValue,
-    awaitPromise: false,
-  });
-}
-
-export async function uploadThroughActivatedFileInput(
-  options: FileInputTransactionOptions,
-): Promise<FileInputTransactionResult | RpcError> {
-  const deadline = Date.now() + options.timeoutMs;
-  const target = options.actionTarget.cdpTarget;
-  const objectGroup = `bsk-upload-${crypto.randomUUID()}`;
-  const stateKey = `__bskUpload_${crypto.randomUUID().replaceAll("-", "")}`;
-  const chooserEvents: ChooserEvent[] = [];
-  let interceptionArmed = false;
-  let probeArmed = false;
-  let triggerObjectId: string | undefined;
-  let outcome: FileInputTransactionResult | RpcError = transferFailure(
-    "protocol_error",
-    "file_input_probe_failed",
-    "upload transaction ended without an outcome",
-    "none",
-    "cleanup",
-  );
-
-  const chooserSubscription = options.cdp.onEvent?.((source, method, raw) => {
-    if (method !== "Page.fileChooserOpened" || !sameTarget(source, target)) return;
-    const event = raw as ChooserEvent;
-    chooserEvents.push(event);
-  });
-
-  try {
-    try {
-      await waitBounded(
-        sendToCdpTarget(options.cdp, target, "Page.setInterceptFileChooserDialog", {
-          enabled: true,
-        }),
-        deadline,
-        options.signal,
-        "arming native file chooser interception timed out",
-      );
-      interceptionArmed = true;
-    } catch (err) {
-      outcome = transferFailure(
-        err instanceof BoundedWaitError ? "timeout" : "cdp_failed",
-        "file_input_probe_failed",
-        err instanceof Error ? err.message : String(err),
-        "none",
-        "arm_interception",
-      );
-      return outcome;
-    }
-
-    try {
-      const resolved = await waitBounded(
-        sendToCdpTarget<{ object?: { objectId?: string } }>(
-          options.cdp,
-          target,
-          "DOM.resolveNode",
-          {
-            backendNodeId: options.actionTarget.backendNodeId,
-            objectGroup,
-          },
-        ),
-        deadline,
-        options.signal,
-        "resolving upload trigger timed out",
-      );
-      triggerObjectId = resolved.object?.objectId;
-      if (!triggerObjectId) throw new Error("DOM.resolveNode returned no trigger objectId");
-
-      const armed = await waitBounded(
-        callOnTrigger<RuntimeReply>(
-          options,
-          triggerObjectId,
-          `function(key) {
-            const doc = this.ownerDocument;
-            const owner = doc.defaultView;
-            if (!owner) return false;
-            const state = { inputs: [], listener: null };
-            Object.defineProperty(owner, key, { value: state, configurable: true });
-            state.listener = event => {
-              const path = typeof event.composedPath === "function" ? event.composedPath() : [];
-              const candidate = path[0] || event.target;
-              if (candidate && candidate.nodeType === 1 &&
-                  candidate.localName === "input" && candidate.type === "file") {
-                if (!state.inputs.includes(candidate)) state.inputs.push(candidate);
-                event.preventDefault();
-              }
-            };
-            doc.addEventListener("click", state.listener, true);
-            return true;
-          }`,
-          [stateKey],
-          true,
-        ),
-        deadline,
-        options.signal,
-        "arming frame-scoped file input probe timed out",
-      );
-      const armError = runtimeError(armed, "failed to arm file input probe");
-      if (armError || armed.result?.value !== true) {
-        throw armError ?? new Error("file input probe did not arm");
-      }
-      probeArmed = true;
-    } catch (err) {
-      outcome = transferFailure(
-        err instanceof BoundedWaitError ? "timeout" : "cdp_failed",
-        "file_input_probe_failed",
-        err instanceof Error ? err.message : String(err),
-        "none",
-        "arm_input_probe",
-      );
-      return outcome;
-    }
-
-    let click: ClickResult | RpcError;
-    try {
-      click = await waitBounded(
-        options.trigger(),
-        deadline,
-        options.signal,
-        "upload trigger timed out",
-      );
-    } catch (err) {
-      outcome = transferFailure(
-        err instanceof BoundedWaitError ? "timeout" : "cdp_failed",
-        "file_input_probe_failed",
-        err instanceof Error ? err.message : String(err),
-        "none",
-        "trigger",
-      );
-      return outcome;
-    }
-    if (isRpcError(click)) {
-      outcome = enrichFailure(click, "none", "trigger");
-      return outcome;
-    }
-
-    try {
-      const activationDeadline = Math.min(deadline, Date.now() + ACTIVATION_GRACE_MS);
-      let summary: { count: number; multiple: boolean } = { count: 0, multiple: false };
-      while (Date.now() < activationDeadline) {
-        if (chooserEvents.length > 0) break;
-        const reply = await callOnTrigger<RuntimeReply>(
-          options,
-          triggerObjectId,
-          `function(key) {
-            const state = this.ownerDocument.defaultView?.[key];
-            return state
-              ? { count: state.inputs.length, multiple: state.inputs[0]?.multiple === true }
-              : { count: 0, multiple: false };
-          }`,
-          [stateKey],
-          true,
-        );
-        const summaryError = runtimeError(reply, "failed to inspect activated file input");
-        if (summaryError) throw summaryError;
-        const value = reply.result?.value as { count?: unknown; multiple?: unknown } | undefined;
-        summary = {
-          count: typeof value?.count === "number" ? value.count : 0,
-          multiple: value?.multiple === true,
-        };
-        if (summary.count > 0) break;
-        await delay(Math.min(PROBE_INTERVAL_MS, remainingMs(activationDeadline)), options.signal);
-      }
-
-      if (chooserEvents.length > 1) {
-        outcome = transferFailure(
-          "unsupported",
-          "file_input_not_activated",
-          "upload trigger activated more than one file chooser",
-          "none",
-          "resolve_input",
-        );
-        return outcome;
-      }
-
-      const chooser = chooserEvents[0];
-      let backendNodeId: number | undefined;
-      let multiple = summary.multiple;
-      if (chooser) {
-        if (options.actionTarget.frameId && chooser.frameId !== options.actionTarget.frameId) {
-          outcome = transferFailure(
-            "unsupported",
-            "file_input_not_activated",
-            "upload trigger activated a file chooser in a different frame",
-            "none",
-            "resolve_input",
-          );
-          return outcome;
-        }
-        if (typeof chooser.backendNodeId !== "number") {
-          outcome = transferFailure(
-            "unsupported",
-            "file_input_not_activated",
-            "upload trigger invoked a non-input file picker",
-            "none",
-            "resolve_input",
-          );
-          return outcome;
-        }
-        backendNodeId = chooser.backendNodeId;
-        multiple = chooser.mode === "selectMultiple";
-      } else {
-        if (summary.count !== 1) {
-          outcome = transferFailure(
-            "unsupported",
-            "file_input_not_activated",
-            summary.count === 0
-              ? "upload trigger did not activate an input[type=file]"
-              : "upload trigger activated more than one input[type=file]",
-            "none",
-            "resolve_input",
-          );
-          return outcome;
-        }
-        const input = await callOnTrigger<RuntimeReply>(
-          options,
-          triggerObjectId,
-          `function(key) { return this.ownerDocument.defaultView?.[key]?.inputs[0]; }`,
-          [stateKey],
-          false,
-        );
-        const inputError = runtimeError(input, "failed to resolve activated file input object");
-        if (inputError) throw inputError;
-        if (!input.result?.objectId) throw new Error("activated file input returned no objectId");
-        const described = await sendToCdpTarget<{ node?: { backendNodeId?: number } }>(
-          options.cdp,
-          target,
-          "DOM.describeNode",
-          { objectId: input.result.objectId },
-        );
-        backendNodeId = described.node?.backendNodeId;
-        if (typeof backendNodeId !== "number") {
-          throw new Error("DOM.describeNode returned no file input backendNodeId");
-        }
-      }
-
-      if (!multiple && options.files.length !== 1) {
-        outcome = enrichFailure(
-          { code: "invalid_params", message: "file input accepts exactly one file" },
-          "none",
-          "resolve_input",
-        );
-        return outcome;
-      }
-
-      try {
-        await waitBounded(
-          sendToCdpTarget(options.cdp, target, "DOM.setFileInputFiles", {
-            files: options.files,
-            backendNodeId,
-          }),
-          deadline,
-          options.signal,
-          "setting file input files timed out",
-        );
-      } catch (err) {
-        outcome = transferFailure(
-          err instanceof BoundedWaitError ? "timeout" : "cdp_failed",
-          "set_file_input_failed",
-          err instanceof Error ? err.message : String(err),
-          "unknown",
-          "set_files",
-        );
-        return outcome;
-      }
-      outcome = { click, multiple };
-      return outcome;
-    } catch (err) {
-      outcome = transferFailure(
-        err instanceof BoundedWaitError ? "timeout" : "cdp_failed",
-        "file_input_probe_failed",
-        err instanceof Error ? err.message : String(err),
-        "none",
-        "resolve_input",
-      );
-      return outcome;
-    }
-  } finally {
-    chooserSubscription?.dispose();
-    let cleanupFailed = false;
-    if (probeArmed && triggerObjectId) {
-      try {
-        await waitBounded(
-          callOnTrigger(
-            options,
-            triggerObjectId,
-            `function(key) {
-              const owner = this.ownerDocument.defaultView;
-              const state = owner?.[key];
-              if (state?.listener) this.ownerDocument.removeEventListener("click", state.listener, true);
-              if (owner) delete owner[key];
-            }`,
-            [stateKey],
-            true,
-          ),
-          Date.now() + CLEANUP_TIMEOUT_MS,
-          undefined,
-          "cleaning file input probe timed out",
-        );
-      } catch {
-        cleanupFailed = true;
-      }
-    }
-    if (interceptionArmed) {
-      try {
-        await waitBounded(
-          sendToCdpTarget(options.cdp, target, "Page.setInterceptFileChooserDialog", {
-            enabled: false,
-            cancel: true,
-          }),
-          Date.now() + CLEANUP_TIMEOUT_MS,
-          undefined,
-          "disabling file chooser interception timed out",
-        );
-      } catch {
-        cleanupFailed = true;
-      }
-    }
-    try {
-      await waitBounded(
-        sendToCdpTarget(options.cdp, target, "Runtime.releaseObjectGroup", { objectGroup }),
-        Date.now() + CLEANUP_TIMEOUT_MS,
-        undefined,
-        "releasing upload object group timed out",
-      );
-    } catch {
-      cleanupFailed = true;
-    }
-
-    const effect = isRpcError(outcome)
-      ? (outcome.data?.effect_state as TransferEffectState | undefined)
-      : "committed";
-    if (effect === "unknown" || cleanupFailed) {
-      await options.cdp.detach?.(target.tabId);
-    }
-    if (cleanupFailed && isRpcError(outcome)) {
-      outcome.data = { ...outcome.data, cleanup_state: "failed" };
-    }
-  }
-}
@@ -1,21 +1,24 @@
-import { type CdpTarget, cdpTargetKey } from "@/browser-driver/frame-graph";
+import { type CdpFrame, type CdpFrameGraph, type CdpTarget } from "@/browser-driver/frame-graph";
 import type { RpcError } from "@/transport/types";
 import { nodeContentRegion, scrollNodeIntoView } from "./element-geometry";
 import {
  clipPolygon,
+  type GeometryProjection,
  type Point,
  type Polygon,
+  type ProjectiveEdge,
+  parseCdpQuad,
  polygonArea,
  polygonCentroid,
  projectRegionToViewport,
+  type Quad,
  type Region,
  rectPolygon,
  regionBounds,
+  type Size,
  type ViewportRect,
 } from "./geometry";
-import type { CssViewport } from "./geometry/coordinate-types";
-import { cssViewport, GeometryContext } from "./geometry/frame-context";
-import { type CdpRunner, cdpRunnerForTarget, isRpcError } from "./shared";
+import { type CdpRunner, cdpRunnerForTarget, isRpcError, sendToCdpTarget } from "./shared";

 export interface NodeAddress {
  target: CdpTarget;
@@ -24,30 +27,154 @@ export interface NodeAddress {
 }

 export interface ResolvedNodeGeometry {
-  /** The same top-level measurement used by projection, for screenshot coordinate adaptation. */
-  topViewport: CssViewport;
  topVisibleRegions: Region;
  topBounds: ViewportRect;
-  /** Point in the top-level tab viewport, used by root-target input events. */
  actionPoint: Point;
-  /** Point in the addressed CDP target's viewport, used by OOPIF-local input events. */
-  targetActionPoint: Point;
 }

 function geometryError(message: string): RpcError {
  return { code: "cdp_failed", message };
 }

+function frameMap(graph: CdpFrameGraph): Map<string, CdpFrame> {
+  return new Map(graph.frames.map((frame) => [frame.frameId, frame]));
+}
+
+function targetRootFrame(byId: Map<string, CdpFrame>, frame: CdpFrame): CdpFrame | null {
+  const seen = new Set<string>();
+  let current = frame;
+  while (current.parentFrameId) {
+    if (seen.has(current.frameId)) return null;
+    seen.add(current.frameId);
+    const parent = byId.get(current.parentFrameId);
+    if (!parent || parent.target.sessionId !== current.target.sessionId) break;
+    current = parent;
+  }
+  return current;
+}
+
+function frameAncestry(graph: CdpFrameGraph, frameId: string): CdpFrame[] | null {
+  const byId = frameMap(graph);
+  const path: CdpFrame[] = [];
+  const seen = new Set<string>();
+  let current = byId.get(frameId);
+  if (!current) return null;
+  while (current.parentFrameId) {
+    if (seen.has(current.frameId)) return null;
+    seen.add(current.frameId);
+    path.push(current);
+    const parent = byId.get(current.parentFrameId);
+    if (!parent) return null;
+    current = parent;
+  }
+  return path;
+}
+
+async function targetViewport(cdp: CdpRunner, target: CdpTarget): Promise<Size | null> {
+  const metrics = await sendToCdpTarget<{
+    cssLayoutViewport?: { clientWidth?: number; clientHeight?: number };
+    layoutViewport?: { clientWidth?: number; clientHeight?: number };
+  }>(cdp, target, "Page.getLayoutMetrics", {});
+  const viewport = metrics.cssLayoutViewport ?? metrics.layoutViewport ?? {};
+  const width = viewport.clientWidth ?? 0;
+  const height = viewport.clientHeight ?? 0;
+  return width > 0 && height > 0 ? { width, height } : null;
+}
+
+async function ownerContentQuad(
+  cdp: CdpRunner,
+  parent: CdpFrame,
+  ownerBackendNodeId: number,
+): Promise<Quad | null> {
+  const result = await sendToCdpTarget<{ model?: { content?: number[] } }>(
+    cdp,
+    parent.target,
+    "DOM.getBoxModel",
+    { backendNodeId: ownerBackendNodeId },
+  );
+  return parseCdpQuad(result.model?.content);
+}
+
+async function sameTargetFrameClips(
+  cdp: CdpRunner,
+  byId: Map<string, CdpFrame>,
+  frame: CdpFrame,
+  targetRoot: CdpFrame,
+): Promise<Polygon[] | null> {
+  const clips: Polygon[] = [];
+  let current = frame;
+  const seen = new Set<string>();
+  while (current.frameId !== targetRoot.frameId) {
+    if (seen.has(current.frameId) || !current.parentFrameId) return null;
+    seen.add(current.frameId);
+    const parent = byId.get(current.parentFrameId);
+    if (!parent || current.ownerBackendNodeId === undefined) return null;
+    const clip = await ownerContentQuad(cdp, parent, current.ownerBackendNodeId);
+    if (!clip) return null;
+    clips.push(clip);
+    current = parent;
+  }
+  return clips;
+}
+
+export async function resolveFrameProjection(
+  cdp: CdpRunner,
+  graph: CdpFrameGraph,
+  frameId: string,
+): Promise<GeometryProjection | null> {
+  const byId = frameMap(graph);
+  const frame = byId.get(frameId);
+  if (!frame) return null;
+  let targetRoot = targetRootFrame(byId, frame);
+  if (!targetRoot) return null;
+  const sourceViewport = await targetViewport(cdp, targetRoot.target);
+  if (!sourceViewport) return null;
+  const sourceClips = await sameTargetFrameClips(cdp, byId, frame, targetRoot);
+  if (!sourceClips) return null;
+
+  const edges: ProjectiveEdge[] = [];
+  while (targetRoot.parentFrameId) {
+    const parent = byId.get(targetRoot.parentFrameId);
+    if (!parent || targetRoot.ownerBackendNodeId === undefined) return null;
+    const destinationQuad = await ownerContentQuad(cdp, parent, targetRoot.ownerBackendNodeId);
+    if (!destinationQuad) return null;
+    const source =
+      edges.length === 0 ? sourceViewport : await targetViewport(cdp, targetRoot.target);
+    if (!source) return null;
+    const parentTargetRoot = targetRootFrame(byId, parent);
+    if (!parentTargetRoot) return null;
+    const destinationClips = await sameTargetFrameClips(cdp, byId, parent, parentTargetRoot);
+    if (!destinationClips) return null;
+    edges.push({ sourceViewport: source, destinationQuad, destinationClips });
+    targetRoot = parentTargetRoot;
+  }
+
+  const topViewport =
+    edges.length === 0 ? sourceViewport : await targetViewport(cdp, targetRoot.target);
+  return topViewport ? { sourceClips, edges, topViewport } : null;
+}
+
+async function loadFrameGraph(cdp: CdpRunner, tabId: number): Promise<CdpFrameGraph | null> {
+  if (!cdp.getFrameGraph) return null;
+  try {
+    return await cdp.getFrameGraph(tabId);
+  } catch (error) {
+    console.debug("[bsk frame-geometry] frame graph resolution failed", error);
+    return null;
+  }
+}
+
 async function scrollFrameOwners(
  cdp: CdpRunner,
  tabId: number,
-  context: GeometryContext,
+  graph: CdpFrameGraph,
  frameId: string,
 ): Promise<RpcError | null> {
-  const ancestry = await context.ancestry(frameId);
+  const byId = frameMap(graph);
+  const ancestry = frameAncestry(graph, frameId);
  if (!ancestry) return geometryError(`could not resolve frame ancestry for ${frameId}`);
  for (const child of [...ancestry].reverse()) {
-    const parent = child.parentFrameId ? await context.frame(child.parentFrameId) : undefined;
+    const parent = child.parentFrameId ? byId.get(child.parentFrameId) : undefined;
    if (!parent || child.ownerBackendNodeId === undefined) {
      return geometryError(`could not resolve frame owner for ${child.frameId}`);
    }
@@ -61,20 +188,17 @@ async function scrollFrameOwners(
  return null;
 }

-async function scrollElementWithContext(
+async function scrollElementWithFrameGraph(
  cdp: CdpRunner,
  tabId: number,
  target: CdpTarget,
  backendNodeId: number,
  frameId: string | undefined,
-  context: GeometryContext,
+  graph: CdpFrameGraph | null,
 ): Promise<RpcError | null> {
  if (frameId) {
-    const frame = await context.frame(frameId);
-    if (!frame || cdpTargetKey(frame.target) !== cdpTargetKey(target)) {
-      return geometryError("node frame does not belong to its target");
-    }
-    const error = await scrollFrameOwners(cdp, tabId, context, frameId);
+    if (!graph) return geometryError(`could not resolve frame graph for ${frameId}`);
+    const error = await scrollFrameOwners(cdp, tabId, graph, frameId);
    if (error) return error;
  } else if (target.sessionId) {
    return geometryError("an OOPIF node address requires frameId");
@@ -89,15 +213,8 @@ export async function scrollElementAndFramesIntoView(
  backendNodeId: number,
  frameId?: string,
 ): Promise<RpcError | null> {
-  if (target.tabId !== tabId) return geometryError("node target belongs to another tab");
-  return scrollElementWithContext(
-    cdp,
-    tabId,
-    target,
-    backendNodeId,
-    frameId,
-    new GeometryContext(cdp, tabId),
-  );
+  const graph = frameId ? await loadFrameGraph(cdp, tabId) : null;
+  return scrollElementWithFrameGraph(cdp, tabId, target, backendNodeId, frameId, graph);
 }

 function largestRegion(regions: Region): Polygon | null {
@@ -120,32 +237,23 @@ export async function resolveNodeGeometry(
    if (address.target.sessionId && !address.frameId) {
      return geometryError("an OOPIF node address requires frameId");
    }
-    if (address.target.tabId !== tabId) return geometryError("node target belongs to another tab");
-    const context = new GeometryContext(cdp, tabId);
-    const graph = address.frameId ? await context.graph() : null;
-    if (address.frameId && graph) {
-      const frame = await context.frame(address.frameId);
-      if (!frame || cdpTargetKey(frame.target) !== cdpTargetKey(address.target)) {
-        return geometryError("node frame does not belong to its target");
-      }
-    }
+    const graph = address.frameId ? await loadFrameGraph(cdp, tabId) : null;
    if (address.frameId && !graph) {
      return geometryError(`could not resolve frame graph for ${address.frameId}`);
    }

    if (options.scrollIntoView) {
-      const scrollError = await scrollElementWithContext(
+      const scrollError = await scrollElementWithFrameGraph(
        cdp,
        tabId,
        address.target,
        address.backendNodeId,
        address.frameId,
-        context,
+        graph,
      );
      if (scrollError) return scrollError;
    }

-    // Only topology was read above. Begin live measurements after scrolling.
    const localRegion = await nodeContentRegion(
      cdpRunnerForTarget(cdp, address.target),
      tabId,
@@ -154,32 +262,13 @@ export async function resolveNodeGeometry(
    if (isRpcError(localRegion)) return localRegion;

    let topVisibleRegions: Region;
-    let targetActionPoint: Point | null = null;
    if (address.frameId && graph) {
-      const projection = await context.targetProjection(address.frameId);
+      const projection = await resolveFrameProjection(cdp, graph, address.frameId);
      if (!projection)
        return geometryError(`could not resolve frame geometry for ${address.frameId}`);
      topVisibleRegions = projectRegionToViewport(localRegion, projection);
-      if (address.target.sessionId) {
-        const localViewport = projection.edges[0]?.sourceViewport ?? projection.topViewport;
-        const localVisibleRegions = localRegion
-          .map((polygon) =>
-            clipPolygon(
-              polygon,
-              rectPolygon({
-                x: 0,
-                y: 0,
-                w: localViewport.width,
-                h: localViewport.height,
-              }),
-            ),
-          )
-          .filter((polygon) => polygon.length >= 3);
-        const localActionRegion = largestRegion(localVisibleRegions);
-        targetActionPoint = localActionRegion ? polygonCentroid(localActionRegion) : null;
-      }
    } else {
-      const viewport = await context.viewport(address.target);
+      const viewport = await targetViewport(cdp, address.target);
      if (!viewport) return geometryError("could not resolve top viewport geometry");
      topVisibleRegions = localRegion
        .map((polygon) =>
@@ -194,17 +283,7 @@ export async function resolveNodeGeometry(
    if (!topBounds || !actionPoint) {
      return { code: "permission_denied", message: "element not visible" };
    }
-    if (address.target.sessionId && !targetActionPoint) {
-      return { code: "permission_denied", message: "element not visible in its target" };
-    }
-    targetActionPoint ??= actionPoint;
-    return {
-      topVisibleRegions,
-      topBounds,
-      actionPoint,
-      targetActionPoint,
-      topViewport: cssViewport(await context.layoutMetrics({ tabId })),
-    };
+    return { topVisibleRegions, topBounds, actionPoint };
  } catch (error) {
    return geometryError(error instanceof Error ? error.message : String(error));
  }
@@ -245,3 +245,22 @@ export function projectRectToViewport(
  if (!rect) return null;
  return regionBounds(projectRegionToViewport([rectPolygon(rect)], projection));
 }
+
+export function childFrameProjection(
+  parent: GeometryProjection,
+  ownerRectInParent: { x: number; y: number; w: number; h: number },
+): GeometryProjection {
+  const destinationQuad = rectPolygon(ownerRectInParent);
+  return {
+    sourceClips: [],
+    edges: [
+      {
+        sourceViewport: { width: ownerRectInParent.w, height: ownerRectInParent.h },
+        destinationQuad,
+        destinationClips: parent.sourceClips,
+      },
+      ...parent.edges,
+    ],
+    topViewport: parent.topViewport,
+  };
+}
@@ -1,157 +0,0 @@
-import { type CdpTarget, cdpTargetKey } from "@/browser-driver/frame-graph";
-import type { GeometryProjection, ViewportRect } from "../geometry";
-import { projectRectToViewport } from "../geometry";
-
-export interface CoordinateOwner {
-  target: CdpTarget;
-  frameId?: string;
-}
-
-export interface FrameViewportRect {
-  space: "frame-viewport-css";
-  owner: CoordinateOwner;
-  rect: ViewportRect;
-}
-
-export interface SnapshotProjection {
-  source: CoordinateOwner;
-  geometry: GeometryProjection;
-}
-
-/** A failed owner read is different from a successfully projected, clipped-out rect. */
-export interface UnavailableFrameProjection {
-  status: "unavailable";
-  source: CoordinateOwner;
-  ownerBackendNodeId: number;
-}
-
-export interface UnavailableSnapshotCoordinates {
-  status: "unavailable";
-  source: CoordinateOwner;
-  reason: "snapshot-coordinates-unavailable";
-}
-
-export type SnapshotProjectionResult =
-  | { status: "available"; projection: SnapshotProjection }
-  | UnavailableFrameProjection;
-
-/** Descendants inherit the failed boundary without attempting another owner read. */
-export type FrameProjectionIssue =
-  | UnavailableFrameProjection
-  | UnavailableSnapshotCoordinates
-  | {
-      status: "blocked";
-      source: CoordinateOwner;
-      cause: UnavailableFrameProjection | UnavailableSnapshotCoordinates;
-    };
-
-export type FrameProjectionState = SnapshotProjectionResult | FrameProjectionIssue;
-
-export interface SnapshotCoordinates {
-  layoutUnitsPerCssPixel: number;
-  scrollCss: { x: number; y: number };
-}
-
-/** Snapshot scroll offsets share the raw layout units of its bounds. Only a
- * target's root document may fall back to that target's CSS layout viewport. */
-export function snapshotCoordinates(
-  document: { scrollOffsetX?: number; scrollOffsetY?: number },
-  layoutUnitsPerCssPixel: number | null,
-  rootScrollCss?: { x?: number; y?: number },
-): SnapshotCoordinates | null {
-  if (
-    layoutUnitsPerCssPixel === null ||
-    !Number.isFinite(layoutUnitsPerCssPixel) ||
-    layoutUnitsPerCssPixel <= 0
-  )
-    return null;
-  const x =
-    document.scrollOffsetX === undefined
-      ? rootScrollCss?.x
-      : document.scrollOffsetX / layoutUnitsPerCssPixel;
-  const y =
-    document.scrollOffsetY === undefined
-      ? rootScrollCss?.y
-      : document.scrollOffsetY / layoutUnitsPerCssPixel;
-  if (x === undefined || y === undefined || !Number.isFinite(x) || !Number.isFinite(y)) return null;
-  return { layoutUnitsPerCssPixel, scrollCss: { x, y } };
-}
-
-/** Convert raw document-relative Blink layout units exactly once, before any
- * CSS viewport clipping or frame projection. This scale is not screenshot zoom. */
-export function snapshotViewportRect(
-  bounds: number[],
-  owner: CoordinateOwner,
-  coordinates: SnapshotCoordinates | null,
-): FrameViewportRect | null {
-  if (!coordinates || bounds.length < 4 || !bounds.slice(0, 4).every(Number.isFinite)) return null;
-  const { layoutUnitsPerCssPixel: scale, scrollCss: scroll } = coordinates;
-  const [x, y, width, height] = bounds;
-  if (
-    !Number.isFinite(scale) ||
-    scale <= 0 ||
-    width <= 0 ||
-    height <= 0 ||
-    !Number.isFinite(scroll.x) ||
-    !Number.isFinite(scroll.y)
-  ) {
-    return null;
-  }
-  return {
-    space: "frame-viewport-css",
-    owner,
-    rect: {
-      x: x / scale - scroll.x,
-      y: y / scale - scroll.y,
-      width: width / scale,
-      height: height / scale,
-    },
-  };
-}
-
-export function projectSnapshotRect(
-  input: FrameViewportRect,
-  projection: SnapshotProjection,
-): ViewportRect | null {
-  if (
-    input.owner.frameId !== projection.source.frameId ||
-    cdpTargetKey(input.owner.target) !== cdpTargetKey(projection.source.target)
-  ) {
-    return null;
-  }
-  const { x, y, width: w, height: h } = input.rect;
-  return projectRectToViewport({ x, y, w, h }, projection.geometry);
-}
-
-/** CSS viewport metadata; browser zoom is distinct from raster devicePixelRatio. */
-export interface CssViewport {
-  width: number;
-  height: number;
-  scrollX: number;
-  scrollY: number;
-  cssToDip: number;
-}
-
-/** Page.captureScreenshot takes page-relative DIP, not viewport-relative CSS pixels. */
-export function screenshotPageRect(
-  rect: ViewportRect,
-  viewport: CssViewport,
-): { space: "page-dip"; rect: ViewportRect } | null {
-  const { cssToDip, scrollX, scrollY } = viewport;
-  if (
-    ![rect.x, rect.y, rect.width, rect.height, cssToDip, scrollX, scrollY].every(Number.isFinite) ||
-    cssToDip <= 0 ||
-    rect.width <= 0 ||
-    rect.height <= 0
-  )
-    return null;
-  return {
-    space: "page-dip",
-    rect: {
-      x: (rect.x + scrollX) * cssToDip,
-      y: (rect.y + scrollY) * cssToDip,
-      width: rect.width * cssToDip,
-      height: rect.height * cssToDip,
-    },
-  };
-}
@@ -1,356 +0,0 @@
-import {
-  type CdpFrame,
-  type CdpFrameGraph,
-  type CdpTarget,
-  cdpTargetKey,
-} from "@/browser-driver/frame-graph";
-import {
-  type GeometryProjection,
-  type Polygon,
-  type ProjectiveEdge,
-  parseCdpQuad,
-  type Quad,
-  type Size,
-} from "../geometry";
-import { type CdpRunner, sendToCdpTarget } from "../shared";
-import type { CoordinateOwner, CssViewport, SnapshotProjectionResult } from "./coordinate-types";
-
-import { readSnapshotOwnerSizes } from "./snapshot-owner-sizes";
-
-export interface LayoutMetrics {
-  cssVisualViewport?: { zoom?: number; clientWidth?: number; clientHeight?: number };
-  visualViewport?: { zoom?: number; clientWidth?: number; clientHeight?: number };
-  cssLayoutViewport?: {
-    clientWidth?: number;
-    clientHeight?: number;
-    pageX?: number;
-    pageY?: number;
-  };
-  layoutViewport?: { clientWidth?: number; clientHeight?: number; pageX?: number; pageY?: number };
-}
-
-/** Chromium emits these paired floating-point dimensions before/after dividing
- * by LayoutZoomFactor. Integer layout viewport dimensions lose precision at
- * fractional zoom. Neither visualViewport.scale nor .zoom is this conversion.
- * See InspectorPageAgent::getLayoutMetrics in Chromium. */
-export function snapshotLayoutScale(metrics: LayoutMetrics): number | null {
-  for (const dimension of ["clientWidth", "clientHeight"] as const) {
-    const raw = metrics.visualViewport?.[dimension];
-    const css = metrics.cssVisualViewport?.[dimension];
-    if (
-      raw !== undefined &&
-      css !== undefined &&
-      Number.isFinite(raw) &&
-      Number.isFinite(css) &&
-      raw > 0 &&
-      css > 0
-    ) {
-      const scale = raw / css;
-      if (Number.isFinite(scale) && scale > 0) return scale;
-    }
-  }
-  return null;
-}
-
-/** The legacy field is a compatibility fallback, never a source of raster DPR. */
-export function cssViewport(metrics: LayoutMetrics): CssViewport {
-  const value = metrics.cssLayoutViewport ?? metrics.layoutViewport;
-  return {
-    width: value?.clientWidth ?? 0,
-    height: value?.clientHeight ?? 0,
-    scrollX: value?.pageX ?? 0,
-    scrollY: value?.pageY ?? 0,
-    cssToDip: metrics.cssVisualViewport?.zoom ?? metrics.visualViewport?.zoom ?? 1,
-  };
-}
-
-/** One read-only measurement phase. Discard after scrolling or any later operation. */
-export class GeometryContext {
-  private readonly metrics = new Map<string, Promise<LayoutMetrics>>();
-  private readonly owners = new Map<string, Promise<Quad | null>>();
-  private readonly projections = new Map<string, Promise<GeometryProjection | null>>();
-  private readonly snapshotOwners = new Map<string, Promise<{ quad: Quad; size: Size } | null>>();
-  private readonly sizeBatches = new Map<string, () => Promise<Map<number, Size>>>();
-  private active = 0;
-  private readonly waiting: Array<() => void> = [];
-  private graphPromise?: Promise<CdpFrameGraph | null>;
-  private framesPromise?: Promise<Map<string, CdpFrame>>;
-
-  constructor(
-    private readonly cdp: CdpRunner,
-    private readonly tabId: number,
-    graph?: CdpFrameGraph,
-    private readonly signal?: AbortSignal,
-  ) {
-    if (graph) this.graphPromise = Promise.resolve(graph);
-  }
-
-  private async request<T>(
-    target: CdpTarget,
-    method: string,
-    params: object,
-    cleanup = false,
-  ): Promise<T> {
-    if (!cleanup && this.signal?.aborted) throw new DOMException("geometry aborted", "AbortError");
-    if (this.active >= 4) await new Promise<void>((resolve) => this.waiting.push(resolve));
-    else this.active++;
-    try {
-      if (!cleanup && this.signal?.aborted)
-        throw new DOMException("geometry aborted", "AbortError");
-      return await sendToCdpTarget<T>(this.cdp, target, method, params);
-    } finally {
-      const next = this.waiting.shift();
-      if (next) next();
-      else this.active--;
-    }
-  }
-
-  graph(): Promise<CdpFrameGraph | null> {
-    this.graphPromise ??=
-      this.cdp.getFrameGraph?.(this.tabId).catch(() => null) ?? Promise.resolve(null);
-    return this.graphPromise;
-  }
-
-  private frames(): Promise<Map<string, CdpFrame>> {
-    this.framesPromise ??= this.graph().then(
-      (graph) => new Map(graph?.frames.map((frame) => [frame.frameId, frame]) ?? []),
-    );
-    return this.framesPromise;
-  }
-
-  async frame(frameId: string): Promise<CdpFrame | undefined> {
-    return (await this.frames()).get(frameId);
-  }
-
-  /** Topology only: safe to resolve before the caller scrolls frame owners. */
-  async ancestry(frameId: string): Promise<CdpFrame[] | null> {
-    const frames = await this.frames();
-    const path: CdpFrame[] = [];
-    const seen = new Set<string>();
-    let current = frames.get(frameId);
-    if (!current) return null;
-    while (current.parentFrameId) {
-      if (seen.has(current.frameId)) return null;
-      seen.add(current.frameId);
-      path.push(current);
-      const parent = frames.get(current.parentFrameId);
-      if (!parent) return null;
-      current = parent;
-    }
-    return path;
-  }
-
-  layoutMetrics(target: CdpTarget): Promise<LayoutMetrics> {
-    const key = cdpTargetKey(target);
-    let promise = this.metrics.get(key);
-    if (!promise) {
-      promise = this.request<LayoutMetrics>(target, "Page.getLayoutMetrics", {});
-      this.metrics.set(key, promise);
-    }
-    return promise;
-  }
-
-  async viewport(target: CdpTarget): Promise<Size | null> {
-    const { width, height } = cssViewport(await this.layoutMetrics(target));
-    return Number.isFinite(width) && Number.isFinite(height) && width > 0 && height > 0
-      ? { width, height }
-      : null;
-  }
-
-  ownerContent(target: CdpTarget, backendNodeId: number): Promise<Quad | null> {
-    const key = `${cdpTargetKey(target)}:${backendNodeId}`;
-    let promise = this.owners.get(key);
-    if (!promise) {
-      promise = this.request<{ model?: { content?: number[] } }>(target, "DOM.getBoxModel", {
-        backendNodeId,
-      }).then((reply) => parseCdpQuad(reply.model?.content));
-      this.owners.set(key, promise);
-    }
-    return promise;
-  }
-
-  /** Same-target owner quads are already target-relative, including nested owners. */
-  async snapshotProjection(
-    source: CoordinateOwner,
-    ownerBackendNodeId: number,
-    ancestorClips: Polygon[],
-    viewport: Size,
-  ): Promise<SnapshotProjectionResult> {
-    const key = `${cdpTargetKey(source.target)}:${ownerBackendNodeId}`;
-    let promise = this.snapshotOwners.get(key);
-    if (!promise) {
-      promise = this.snapshotOwner(source.target, ownerBackendNodeId);
-      this.snapshotOwners.set(key, promise);
-    }
-    let owner: { quad: Quad; size: Size } | null;
-    try {
-      owner = await promise;
-    } catch (error) {
-      if (error && typeof error === "object" && "name" in error && error.name === "AbortError")
-        throw error;
-      console.debug("[bsk geometry] frame owner unavailable", error);
-      owner = null;
-    }
-    return owner
-      ? {
-          status: "available",
-          projection: {
-            source,
-            geometry: {
-              sourceClips: [],
-              edges: [
-                {
-                  sourceViewport: owner.size,
-                  destinationQuad: owner.quad,
-                  destinationClips: ancestorClips,
-                },
-              ],
-              topViewport: viewport,
-            },
-          },
-        }
-      : { status: "unavailable", source, ownerBackendNodeId };
-  }
-
-  /** Register one target's snapshot owners; the batch starts only when a
-   * projection actually needs a size. Single owners keep the cheaper old path. */
-  registerSnapshotOwners(target: CdpTarget, owners: ReadonlySet<number>): void {
-    const key = cdpTargetKey(target);
-    if (owners.size < 2 || this.sizeBatches.has(key)) return;
-    let pending: Promise<Map<number, Size>> | undefined;
-    this.sizeBatches.set(key, () => {
-      pending ??= readSnapshotOwnerSizes(
-        (method, params, cleanup) => this.request(target, method, params, cleanup),
-        owners,
-      ).catch((error) => {
-        if (error && typeof error === "object" && "name" in error && error.name === "AbortError")
-          throw error;
-        return new Map<number, Size>();
-      });
-      return pending;
-    });
-  }
-
-  private async snapshotOwner(
-    target: CdpTarget,
-    backendNodeId: number,
-  ): Promise<{ quad: Quad; size: Size } | null> {
-    const quad = await this.ownerContent(target, backendNodeId);
-    if (!quad) return null;
-    const batchSize = (await this.sizeBatches.get(cdpTargetKey(target))?.())?.get(backendNodeId);
-    if (this.signal?.aborted) throw new DOMException("geometry aborted", "AbortError");
-    if (batchSize) return { quad, size: batchSize };
-    const resolved = await this.request<{ object?: { objectId?: string } }>(
-      target,
-      "DOM.resolveNode",
-      { backendNodeId },
-    );
-    const objectId = resolved.object?.objectId;
-    if (!objectId) return null;
-    try {
-      const reply = await this.request<{ result?: { value?: Size }; exceptionDetails?: unknown }>(
-        target,
-        "Runtime.callFunctionOn",
-        {
-          objectId,
-          functionDeclaration: `function() {
-          if (!this.isConnected) return null;
-          const style = getComputedStyle(this);
-          return {
-            width: this.clientWidth - parseFloat(style.paddingLeft) - parseFloat(style.paddingRight),
-            height: this.clientHeight - parseFloat(style.paddingTop) - parseFloat(style.paddingBottom)
-          };
-        }`,
-          returnByValue: true,
-        },
-      );
-      const size = reply.result?.value;
-      return !reply.exceptionDetails &&
-        size &&
-        Number.isFinite(size.width) &&
-        Number.isFinite(size.height) &&
-        size.width > 0 &&
-        size.height > 0
-        ? { quad, size }
-        : null;
-    } finally {
-      // Cleanup must still run if cancellation arrived after resolving the object.
-      await this.request(target, "Runtime.releaseObject", { objectId }, true).catch(() => {});
-    }
-  }
-
-  private targetRoot(frames: Map<string, CdpFrame>, frame: CdpFrame): CdpFrame | null {
-    const seen = new Set<string>();
-    let current = frame;
-    while (current.parentFrameId) {
-      if (seen.has(current.frameId)) return null;
-      seen.add(current.frameId);
-      const parent = frames.get(current.parentFrameId);
-      if (!parent) return null;
-      if (cdpTargetKey(parent.target) !== cdpTargetKey(current.target)) break;
-      current = parent;
-    }
-    return current;
-  }
-
-  private async clips(
-    frames: Map<string, CdpFrame>,
-    frame: CdpFrame,
-    root: CdpFrame,
-  ): Promise<Polygon[] | null> {
-    const clips: Polygon[] = [];
-    let current = frame;
-    const seen = new Set<string>();
-    while (current.frameId !== root.frameId) {
-      if (seen.has(current.frameId) || !current.parentFrameId) return null;
-      seen.add(current.frameId);
-      const parent = frames.get(current.parentFrameId);
-      if (!parent || current.ownerBackendNodeId === undefined) return null;
-      const quad = await this.ownerContent(parent.target, current.ownerBackendNodeId);
-      if (!quad) return null;
-      clips.push(quad);
-      current = parent;
-    }
-    return clips;
-  }
-
-  /** Input is already in the frame's CDP target viewport, not its local viewport. */
-  targetProjection(frameId: string): Promise<GeometryProjection | null> {
-    let promise = this.projections.get(frameId);
-    if (!promise) {
-      promise = this.buildTargetProjection(frameId);
-      this.projections.set(frameId, promise);
-    }
-    return promise;
-  }
-
-  private async buildTargetProjection(frameId: string): Promise<GeometryProjection | null> {
-    const frames = await this.frames();
-    const frame = frames.get(frameId);
-    if (!frame) return null;
-    let root = this.targetRoot(frames, frame);
-    if (!root) return null;
-    const sourceViewport = await this.viewport(root.target);
-    if (!sourceViewport) return null;
-    const sourceClips = await this.clips(frames, frame, root);
-    if (!sourceClips) return null;
-    const edges: ProjectiveEdge[] = [];
-    const seen = new Set<string>();
-    while (root.parentFrameId) {
-      if (seen.has(root.frameId)) return null;
-      seen.add(root.frameId);
-      const parent = frames.get(root.parentFrameId);
-      if (!parent || root.ownerBackendNodeId === undefined) return null;
-      const destinationQuad = await this.ownerContent(parent.target, root.ownerBackendNodeId);
-      const source = await this.viewport(root.target);
-      const parentRoot = this.targetRoot(frames, parent);
-      if (!destinationQuad || !source || !parentRoot) return null;
-      const destinationClips = await this.clips(frames, parent, parentRoot);
-      if (!destinationClips) return null;
-      edges.push({ sourceViewport: source, destinationQuad, destinationClips });
-      root = parentRoot;
-    }
-    const topViewport = await this.viewport(root.target);
-    return topViewport ? { sourceClips, edges, topViewport } : null;
-  }
-}
@@ -1,74 +0,0 @@
-import type { Size } from "../geometry";
-
-interface SerializedValue {
-  type: string;
-  value?: unknown;
-}
-
-type Send = <T>(method: string, params: object, cleanup?: boolean) => Promise<T>;
-
-/** Batch only accessible frame owners. Missing/shadow/cross-origin owners keep
- * the existing node-scoped read; no page-wide style columns are requested. */
-export async function readSnapshotOwnerSizes(
-  send: Send,
-  owners: ReadonlySet<number>,
-): Promise<Map<number, Size>> {
-  const sizes = new Map<number, Size>();
-  const objectGroup = `bsk-frame-sizes-${crypto.randomUUID()}`;
-  try {
-    const reply = await send<{ result?: { deepSerializedValue?: SerializedValue } }>(
-      "Runtime.evaluate",
-      {
-        expression: `(() => {
-          const result = [];
-          const documents = [document];
-          for (let i = 0; i < documents.length && result.length < ${owners.size}; i++) {
-            for (const owner of documents[i].querySelectorAll('iframe,frame')) {
-              if (result.length >= ${owners.size}) break;
-              if (!owner.isConnected) continue;
-              const style = getComputedStyle(owner);
-              result.push([owner, JSON.stringify({
-                width: owner.clientWidth - parseFloat(style.paddingLeft) - parseFloat(style.paddingRight),
-                height: owner.clientHeight - parseFloat(style.paddingTop) - parseFloat(style.paddingBottom)
-              })]);
-              try { if (owner.contentDocument) documents.push(owner.contentDocument); } catch {}
-            }
-          }
-          return result;
-        })()`,
-        objectGroup,
-        serializationOptions: {
-          serialization: "deep",
-          maxDepth: 3,
-          additionalParameters: { maxNodeDepth: 0, includeShadowTree: "none" },
-        },
-      },
-    );
-    const result = reply.result?.deepSerializedValue;
-    if (result?.type !== "array" || !Array.isArray(result.value)) return sizes;
-    for (const entry of result.value as SerializedValue[]) {
-      if (entry.type !== "array" || !Array.isArray(entry.value)) continue;
-      const [node, data] = entry.value as SerializedValue[];
-      if (node?.type !== "node" || data?.type !== "string" || typeof data.value !== "string")
-        continue;
-      const id = (node.value as { backendNodeId?: number } | undefined)?.backendNodeId;
-      if (id === undefined || !owners.has(id)) continue;
-      try {
-        const size = JSON.parse(data.value) as Size;
-        if (
-          size &&
-          Number.isFinite(size.width) &&
-          Number.isFinite(size.height) &&
-          size.width > 0 &&
-          size.height > 0
-        )
-          sizes.set(id, size);
-      } catch {
-        /* An invalid entry uses the existing individual read. */
-      }
-    }
-  } finally {
-    await send("Runtime.releaseObjectGroup", { objectGroup }, true).catch(() => {});
-  }
-  return sizes;
-}
@@ -40,7 +40,6 @@ import {
  enforceAgentWindow,
  isRpcError,
  lookupSession,
-  type ResolvedTargetTab,
  resolveTargetTab,
 } from "./shared";
 import { resolveSnapshotRef } from "./snapshot-ref";
@@ -57,15 +56,6 @@ export interface InteractionDeps {
  keepOverlayBypassAfterHover?: boolean;
 }

-export interface ResolvedActionTarget {
-  tab: ResolvedTargetTab;
-  backendNodeId: number;
-  cdpTarget: CdpTarget;
-  frameId?: string;
-  usedRef?: string;
-  usedSelector?: string;
-}
-
 const DEFAULT_TIMEOUT_MS = 30_000;
 const DEFAULT_HOVER_SETTLE_MS = 200;

@@ -116,6 +106,14 @@ function isAbortLikeError(err: unknown): boolean {
  return err instanceof DOMException && err.name === "AbortError";
 }

+function isInvalidCssSelectorError(err: unknown): boolean {
+  const message = err instanceof Error ? err.message : String(err);
+  return (
+    message.includes("DOM Error while querying") ||
+    /invalid selector|not a valid selector|querySelector.*failed/i.test(message)
+  );
+}
+
 async function wait(ms: number, signal?: AbortSignal): Promise<void> {
  if (signal?.aborted) throw new DOMException("aborted", "AbortError");
  await new Promise<void>((resolve, reject) => {
@@ -138,7 +136,7 @@ async function wait(ms: number, signal?: AbortSignal): Promise<void> {
 * `RpcError` if the caller supplied neither (or both), or if neither
 * lookup matched.
 */
-export async function resolveBackendNode(
+async function resolveBackendNode(
  cdp: CdpRunner,
  ctx: SessionContext,
  target: { tabId: number },
@@ -183,8 +181,6 @@ export async function resolveBackendNode(
  }
  // selector path
  try {
-    // Selector lookup itself attaches CDP, even when no element is found.
-    cdp.trackSessionTab?.(ctx.sessionId, target.tabId);
    const doc = await cdp.send<{ root?: { nodeId?: number } }>(target.tabId, "DOM.getDocument", {
      depth: 0,
    });
@@ -220,6 +216,14 @@ export async function resolveBackendNode(
    }
    return { backendNodeId, cdpTarget: { tabId: target.tabId }, usedSelector: params.selector };
  } catch (err) {
+    if (isInvalidCssSelectorError(err)) {
+      return rpcError(
+        "invalid_params",
+        "invalid_selector",
+        `selector is not valid CSS: ${params.selector}`,
+        { selector: params.selector },
+      );
+    }
    return {
      code: "cdp_failed",
      message: err instanceof Error ? err.message : String(err),
@@ -227,17 +231,6 @@ export async function resolveBackendNode(
  }
 }

-export async function resolveActionTarget(
-  cdp: CdpRunner,
-  ctx: SessionContext,
-  target: ResolvedTargetTab,
-  params: { ref?: string; selector?: string },
-  toolName: string,
-): Promise<ResolvedActionTarget | RpcError> {
-  const node = await resolveBackendNode(cdp, ctx, target, params, toolName);
-  return isRpcError(node) ? node : { tab: target, ...node };
-}
-
 // ---------------------------------------------------------------------------
 // tool.click
 // ---------------------------------------------------------------------------
@@ -256,20 +249,11 @@ export async function handleClick(
  if (isRpcError(target)) return target;
  const denied = enforceAgentWindow(ctx, target, "click");
  if (denied) return denied;
-  const resolved = await resolveActionTarget(deps.cdp, ctx, target, params, "click");
-  if (isRpcError(resolved)) return resolved;
-  return clickResolvedTarget(ctx, resolved, params, deps);
-}
-
-export async function clickResolvedTarget(
-  ctx: SessionContext,
-  resolved: ResolvedActionTarget,
-  params: Pick<ClickParams, "button" | "click_count" | "modifiers">,
-  deps: InteractionDeps,
-): Promise<ClickResult | RpcError> {
-  const { tab: target } = resolved;
  const dialogCursor = markDialogCursor(deps.cdp, target.tabId);

+  const node = await resolveBackendNode(deps.cdp, ctx, target, params, "click");
+  if (isRpcError(node)) return node;
+
  if (throwIfAborted(deps.signal)) {
    return { code: "cancelled", message: "click aborted" };
  }
@@ -279,9 +263,9 @@ export async function clickResolvedTarget(
    deps.cdp,
    target.tabId,
    {
-      target: resolved.cdpTarget,
-      backendNodeId: resolved.backendNodeId,
-      ...(resolved.frameId ? { frameId: resolved.frameId } : {}),
+      target: node.cdpTarget,
+      backendNodeId: node.backendNodeId,
+      ...(node.frameId ? { frameId: node.frameId } : {}),
    },
    { scrollIntoView: true },
  );
@@ -369,8 +353,8 @@ export async function clickResolvedTarget(

  return attachDialogs(deps.cdp, target.tabId, dialogCursor, {
    tab_id: target.tabId,
-    used_ref: resolved.usedRef,
-    used_selector: resolved.usedSelector,
+    used_ref: node.usedRef,
+    used_selector: node.usedSelector,
    x: centre.x,
    y: centre.y,
  });
@@ -609,53 +593,6 @@ type SelectMutationResult =
 // tool.fill
 // ---------------------------------------------------------------------------

-type FillFailureReason =
-  | "target_not_fillable"
-  | "fill_value_invalid"
-  | "fill_target_changed"
-  | "fill_focus_lost"
-  | "fill_value_mismatch"
-  | "fill_failed";
-
-type FillPreparation =
-  | { before: string; expected: string }
-  | { reason: FillFailureReason; error: string };
-
-type FillReadiness = "ready" | "background" | "fill_target_changed" | "fill_focus_lost";
-
-function fillError(reason: FillFailureReason, message: string): RpcError {
-  return rpcError(
-    reason === "target_not_fillable" || reason === "fill_value_invalid"
-      ? "invalid_params"
-      : "cdp_failed",
-    reason,
-    message,
-  );
-}
-
-interface FillScriptReply<T> {
-  result?: { value?: T };
-  exceptionDetails?: unknown;
-}
-
-const FILL_EDITABLE_FUNCTION = `function() {
-  const tag = this.tagName.toLowerCase();
-  const supported = tag === 'input'
-    ? ['text', 'search', 'tel', 'url', 'email', 'password', 'number'].includes(this.type)
-    : tag === 'textarea' || this.isContentEditable;
-  return this.isConnected && supported && !this.readOnly && !this.matches(':disabled');
-}`;
-
-// Chrome renders a trailing editable newline with an empty <div><br></div>.
-// innerText includes the padding break; it is not an extra typed character.
-const FILL_VALUE_FUNCTION = `function() {
-  if (!this.isContentEditable) return this.value;
-  const value = this.innerText;
-  const tail = this.lastChild;
-  const padding = tail && tail.nodeName === 'DIV' && tail.childNodes.length === 1 && tail.firstChild.nodeName === 'BR';
-  return padding && value.endsWith('\\n\\n') ? value.slice(0, -1) : value;
-}`;
-
 export async function handleFill(
  manager: SessionManager,
  params: FillParams,
@@ -707,8 +644,12 @@ export async function handleFill(
    if (throwIfAborted(deps.signal)) {
      return { code: "cancelled", message: "fill aborted" };
    }
+    await nodeCdp.send(target.tabId, "DOM.focus", { backendNodeId: node.backendNodeId });
  } catch (err) {
-    return fillError("fill_failed", err instanceof Error ? err.message : String(err));
+    return {
+      code: "cdp_failed",
+      message: err instanceof Error ? err.message : String(err),
+    };
  }

  if (throwIfAborted(deps.signal)) {
@@ -721,252 +662,57 @@ export async function handleFill(
  const clearBefore = params.clear_before ?? true;

  try {
-    if (throwIfAborted(deps.signal)) {
-      return { code: "cancelled", message: "fill aborted" };
-    }
-    try {
-      await nodeCdp.send(target.tabId, "DOM.focus", { backendNodeId: node.backendNodeId });
-    } catch (error) {
-      // Chrome rejects DOM.focus for disabled controls, including inherited
-      // fieldset state. Classify the live target before treating this as a
-      // browser failure; the normal path needs no extra round trip.
-      const editable = await nodeCdp.send<FillScriptReply<boolean>>(
-        target.tabId,
-        "Runtime.callFunctionOn",
-        { objectId, functionDeclaration: FILL_EDITABLE_FUNCTION, returnByValue: true },
-      );
-      if (throwIfAborted(deps.signal)) {
-        return { code: "cancelled", message: "fill aborted" };
-      }
-      if (!editable.exceptionDetails && editable.result?.value === false) {
-        return fillError(
-          "target_not_fillable",
-          "fill target is not editable or its input type is unsupported",
-        );
-      }
-      throw error;
-    }
-    if (throwIfAborted(deps.signal)) {
-      return { code: "cancelled", message: "fill aborted" };
-    }
-    // Check editability before clearing. Keep the expected result tied to
-    // this object, including the existing value on the append path.
-    const prepared = await nodeCdp.send<FillScriptReply<FillPreparation>>(
-      target.tabId,
-      "Runtime.callFunctionOn",
-      {
+    if (clearBefore) {
+      // Clear input/textarea value or wipe contenteditable innerText,
+      // then fire `input` so frameworks observe the empty state.
+      await nodeCdp.send(target.tabId, "Runtime.callFunctionOn", {
        objectId,
-        functionDeclaration: `function(value, clearBefore) {
-          const tag = this.tagName.toLowerCase();
-          const native = tag === 'input' || tag === 'textarea';
-          if (!(${FILL_EDITABLE_FUNCTION}).call(this)) return { reason: 'target_not_fillable', error: 'fill target is not editable or its input type is unsupported' };
-          if (this.getRootNode().activeElement !== this) return { reason: 'fill_focus_lost', error: 'fill target does not have focus' };
-          const before = clearBefore ? '' : (${FILL_VALUE_FUNCTION}).call(this);
-          let expected = before + value;
-          if (native) {
-            // Use the browser's own value sanitization (e.g. textarea
-            // line endings) without changing the live control.
-            const normalizer = this.ownerDocument.createElement(tag);
-            if (tag === 'input') {
-              normalizer.type = this.type;
-              normalizer.multiple = this.multiple;
-            }
-            // insertText treats line breaks in a single-line input as spaces.
-            if (tag === 'input') expected = expected.replace(/\\r\\n|\\r|\\n/g, ' ');
-            normalizer.value = expected;
-            if (expected !== '' && normalizer.value === '' && this.type === 'number') {
-              return { reason: 'fill_value_invalid', error: 'fill value is not valid for a number input' };
-            }
-            expected = normalizer.value;
-            if (this.type !== 'number' && this.maxLength >= 0 && expected.length > this.maxLength) {
-              return { reason: 'fill_value_invalid', error: 'fill value exceeds the target maxlength' };
-            }
-          } else {
-            expected = expected.replace(/\\r\\n?/g, '\\n');
+        functionDeclaration: `function() {
+          if (this.isContentEditable) { this.textContent = ''; }
+          else {
+            const proto = this instanceof HTMLTextAreaElement
+              ? HTMLTextAreaElement.prototype
+              : HTMLInputElement.prototype;
+            const descriptor = Object.getOwnPropertyDescriptor(proto, 'value');
+            if (descriptor && descriptor.set) descriptor.set.call(this, '');
+            else this.value = '';
          }
-          if (clearBefore) {
-            if (native) {
-              const proto = tag === 'textarea' ? HTMLTextAreaElement.prototype : HTMLInputElement.prototype;
-              Object.getOwnPropertyDescriptor(proto, 'value').set.call(this, '');
-            } else {
-              this.textContent = '';
-            }
-            this.dispatchEvent(new Event('input', { bubbles: true }));
-          }
-          return { before, expected };
+          this.dispatchEvent(new Event('input', { bubbles: true }));
        }`,
-        arguments: [{ value: params.value }, { value: clearBefore }],
        returnByValue: true,
-      },
-    );
-    if (throwIfAborted(deps.signal)) {
-      return { code: "cancelled", message: "fill aborted" };
-    }
-    if (prepared.exceptionDetails) {
-      return fillError("fill_failed", "fill preparation script failed");
-    }
-    const preparation = prepared.result?.value;
-    if (preparation && "error" in preparation) {
-      return fillError(preparation.reason, preparation.error);
-    }
-    if (typeof preparation?.before !== "string" || typeof preparation?.expected !== "string") {
-      return fillError("fill_failed", "fill preparation returned an unexpected result");
-    }
-    // A separate call runs after the clearing event's microtasks drain.
-    // DOM focus works in background tabs. Use document.hasFocus() only to
-    // detect deferred focus events, never to reject background input.
-    const checkReady = async (): Promise<FillReadiness | RpcError> => {
-      const reply = await nodeCdp.send<FillScriptReply<FillReadiness>>(
-        target.tabId,
-        "Runtime.callFunctionOn",
-        {
-          objectId,
-          functionDeclaration: `function(before) {
-            if (!(${FILL_EDITABLE_FUNCTION}).call(this) ||
-                (${FILL_VALUE_FUNCTION}).call(this) !== before) return 'fill_target_changed';
-            if (this.getRootNode().activeElement !== this) return 'fill_focus_lost';
-            return this.ownerDocument.hasFocus() ? 'ready' : 'background';
-          }`,
-          arguments: [{ value: preparation.before }],
-          returnByValue: true,
-        },
-      );
-      const state = reply.result?.value;
-      if (
-        reply.exceptionDetails ||
-        (state !== "ready" &&
-          state !== "background" &&
-          state !== "fill_target_changed" &&
-          state !== "fill_focus_lost")
-      ) {
-        return fillError(
-          "fill_failed",
-          "fill readiness script failed or returned an unexpected result",
-        );
-      }
-      return state;
-    };
-    let ready = await checkReady();
-    if (throwIfAborted(deps.signal)) {
-      return { code: "cancelled", message: "fill aborted" };
-    }
-    // Restore focus once only if clearing left this same target editable
-    // and unchanged. Recheck after focus handlers have run.
-    if (clearBefore && ready === "fill_focus_lost") {
-      await nodeCdp.send(target.tabId, "DOM.focus", { backendNodeId: node.backendNodeId });
-      if (throwIfAborted(deps.signal)) {
-        return { code: "cancelled", message: "fill aborted" };
-      }
-      ready = await checkReady();
+      });
    }
    if (throwIfAborted(deps.signal)) {
      return { code: "cancelled", message: "fill aborted" };
    }
-    if (typeof ready !== "string") return ready;
-    if (ready !== "ready" && ready !== "background") {
-      return fillError(ready, "fill target changed or lost focus before typing");
-    }
-    if (params.value !== "" && (!clearBefore || ready === "background")) {
-      // Native editing commands also support number/email inputs, whose
-      // selection APIs cannot set a caret, and multiline contenteditables.
-      // Also do this for background replacement: CDP input focuses the
-      // renderer, delivering deferred focus events before it inserts text.
-      // Use a command-only event so this does not invoke an End shortcut.
-      try {
-        await deps.cdp.send(target.tabId, "Input.dispatchKeyEvent", {
-          type: "rawKeyDown",
-          commands: ["moveToEndOfDocument"],
-        });
-      } finally {
-        await deps.cdp.send(target.tabId, "Input.dispatchKeyEvent", { type: "keyUp" });
-      }
-      if (throwIfAborted(deps.signal)) {
-        return { code: "cancelled", message: "fill aborted" };
-      }
-      // Focus and key handlers can change the target or move focus too.
-      ready = await checkReady();
-      if (throwIfAborted(deps.signal)) {
-        return { code: "cancelled", message: "fill aborted" };
-      }
-      if (typeof ready !== "string") return ready;
-      if (ready !== "ready" && ready !== "background") {
-        return fillError(ready, "fill target changed or lost focus while positioning the caret");
-      }
-    }
    // CDP `Input.insertText` handles IME / multi-byte input out of the
    // box, much more reliably than per-key `dispatchKeyEvent`.
-    if (params.value !== "") {
-      await deps.cdp.send(target.tabId, "Input.insertText", { text: params.value });
-    }
+    await deps.cdp.send(target.tabId, "Input.insertText", { text: params.value });
    if (throwIfAborted(deps.signal)) {
      return { code: "cancelled", message: "fill aborted" };
    }
-    // Keep the existing notifications, then read in a separate call so
-    // nested microtasks queued by the page cannot race the verification.
-    const notified = await nodeCdp.send<FillScriptReply<unknown>>(
-      target.tabId,
-      "Runtime.callFunctionOn",
-      {
-        objectId,
-        functionDeclaration: `function() {
-          this.dispatchEvent(new Event('input', { bubbles: true }));
-          this.dispatchEvent(new Event('change', { bubbles: true }));
-        }`,
-        returnByValue: true,
-      },
-    );
-    if (throwIfAborted(deps.signal)) {
-      return { code: "cancelled", message: "fill aborted" };
-    }
-    if (notified.exceptionDetails) {
-      return fillError("fill_failed", "fill notification script failed");
-    }
-    const verified = await nodeCdp.send<
-      FillScriptReply<{ connected: boolean; matches: boolean; valueLength: number }>
-    >(target.tabId, "Runtime.callFunctionOn", {
+    // Fire `input` + `change` so React / Vue controlled inputs commit.
+    await nodeCdp.send(target.tabId, "Runtime.callFunctionOn", {
      objectId,
-      functionDeclaration: `function(expected) {
-          const value = (${FILL_VALUE_FUNCTION}).call(this);
-          return { connected: this.isConnected, matches: value === expected, valueLength: value.length };
-        }`,
-      arguments: [{ value: preparation.expected }],
+      functionDeclaration: `function() {
+        this.dispatchEvent(new Event('input', { bubbles: true }));
+        this.dispatchEvent(new Event('change', { bubbles: true }));
+      }`,
      returnByValue: true,
    });
-    if (throwIfAborted(deps.signal)) {
-      return { code: "cancelled", message: "fill aborted" };
-    }
-    const verification = verified.result?.value;
-    if (
-      verified.exceptionDetails ||
-      typeof verification?.connected !== "boolean" ||
-      typeof verification?.matches !== "boolean" ||
-      typeof verification?.valueLength !== "number"
-    ) {
-      return fillError(
-        "fill_failed",
-        "fill verification script failed or returned an unexpected result",
-      );
-    }
-    if (!verification.connected) {
-      return fillError("fill_target_changed", "fill target was removed or replaced during input");
-    }
-    if (!verification.matches) {
-      return fillError(
-        "fill_value_mismatch",
-        "fill could not verify the expected value; observe the page before deciding whether to retry",
-      );
-    }
-    return attachDialogs(deps.cdp, target.tabId, dialogCursor, {
-      tab_id: target.tabId,
-      used_ref: node.usedRef,
-      used_selector: node.usedSelector,
-      value_length: verification.valueLength,
-    });
  } catch (err) {
-    return fillError("fill_failed", err instanceof Error ? err.message : String(err));
-  } finally {
-    await nodeCdp.send(target.tabId, "Runtime.releaseObject", { objectId }).catch(() => undefined);
+    return {
+      code: "cdp_failed",
+      message: err instanceof Error ? err.message : String(err),
+    };
  }
+
+  return attachDialogs(deps.cdp, target.tabId, dialogCursor, {
+    tab_id: target.tabId,
+    used_ref: node.usedRef,
+    used_selector: node.usedSelector,
+    value_length: params.value.length,
+  });
 }

 // ---------------------------------------------------------------------------
@@ -28,13 +28,7 @@ import type {
  RpcError,
  WaitUntil,
 } from "@/transport/types";
-import {
-  type BrowserNavigationApi,
-  chromeBrowserNavigationApi,
-  navigateWithBrowserApi,
-} from "./browser-navigation";
 import { attachDialogs, markDialogCursor } from "./dialogs";
-import { cdpError, isCdpExtensionAccessDenied } from "./errors";
 import {
  type CdpRunner,
  type ChromeTabsApi,
@@ -48,7 +42,6 @@ import {
 export interface NavigationDeps {
  cdp: CdpRunner;
  tabsApi: ChromeTabsApi;
-  browserNavigation?: BrowserNavigationApi;
  /** Optional AbortSignal — M7 abort hook (M10.2 will wire the full chain). */
  signal?: AbortSignal;
  /** Override default timeout when the caller omits `timeout_ms`. */
@@ -486,81 +479,6 @@ async function readTabUrl(api: ChromeTabsApi, tabId: number): Promise<string | u
  }
 }

-/** Recover only a failed preflight; never replay an already-dispatched navigation. */
-async function recoverBrowserNavigation(
-  deps: NavigationDeps,
-  tabId: number,
-  action: (api: BrowserNavigationApi) => Promise<unknown>,
-  waitUntil: WaitUntil,
-  timeoutMs: number,
-): Promise<ReloadResult | RpcError> {
-  const abort = linkedAbortSignal(deps.signal);
-  const deadline = Date.now() + timeoutMs;
-  const api = deps.browserNavigation ?? chromeBrowserNavigationApi;
-  try {
-    let outcome = await navigateWithBrowserApi(
-      api,
-      tabId,
-      () => action(api),
-      waitUntil === "networkidle" ? "commit" : waitUntil,
-      timeoutMs,
-      abort.signal,
-    );
-    if (outcome.reached === "failed") return outcome.error;
-    if (outcome.reached === "cancelled" || abort.signal.aborted) {
-      return { code: "cancelled", message: "navigation recovery aborted" };
-    }
-    if (outcome.reached === "match") {
-      // A completed reload is not a recovery if the restricted frame remains.
-      await deps.cdp.send(tabId, "Page.enable", {});
-      if (abort.signal.aborted)
-        return { code: "cancelled", message: "navigation recovery aborted" };
-      if (waitUntil === "networkidle") {
-        // webNavigation cannot prove network idle. Subscribe on the new
-        // document before enabling CDP lifecycle events after its commit.
-        const frame = await readMainFrameInfo(deps.cdp, tabId);
-        if (!frame.frameId) return cdpError("no main frame after navigation");
-        const remaining = deadline - Date.now();
-        if (remaining <= 0) {
-          outcome = { reached: "timeout", lastLifecycle: "commit" };
-        } else {
-          const wait = startLifecycleWait(
-            deps.cdp,
-            tabId,
-            frame.frameId,
-            "networkIdle",
-            remaining,
-            abort.signal,
-            { loaderId: frame.loaderId ?? undefined },
-          );
-          await deps.cdp.send(tabId, "Page.setLifecycleEventsEnabled", { enabled: true });
-          outcome = await wait.promise;
-        }
-      }
-    }
-    if (outcome.reached === "cancelled" || abort.signal.aborted) {
-      return { code: "cancelled", message: "navigation recovery aborted" };
-    }
-    return {
-      tab_id: tabId,
-      final_url: await readTabUrl(deps.tabsApi, tabId),
-      reached: outcome.reached === "match" ? waitUntil : "timeout",
-      ...(outcome.reached === "timeout"
-        ? {
-            error_text: `timed out waiting for ${waitUntil} during navigation recovery after ${timeoutMs}ms`,
-          }
-        : {}),
-    };
-  } catch (error) {
-    return abort.signal.aborted
-      ? { code: "cancelled", message: "navigation recovery aborted" }
-      : cdpError(error);
-  } finally {
-    abort.abort();
-    abort.cleanup();
-  }
-}
-
 // ---------------------------------------------------------------------------
 // tool.navigate
 // ---------------------------------------------------------------------------
@@ -587,20 +505,7 @@ export async function handleNavigate(

  try {
    deps.cdp.trackSessionTab?.(ctx.sessionId, target.tabId);
-    try {
-      await ensureCdpReady(deps.cdp, target.tabId);
-    } catch (error) {
-      if (!isCdpExtensionAccessDenied(error)) throw error;
-      const recovered = await recoverBrowserNavigation(
-        deps,
-        target.tabId,
-        (api) => api.update(target.tabId, { url: params.url }),
-        waitUntil,
-        timeoutMs,
-      );
-      if (isRpcError(recovered)) return recovered;
-      return attachDialogs(deps.cdp, target.tabId, dialogCursor, { ...recovered, url: params.url });
-    }
+    await ensureCdpReady(deps.cdp, target.tabId);
    const expected = cdpLifecycleName(waitUntil);
    const beforeReadyState = await probeMainFrameReadyState(deps.cdp, target.tabId);
    const beforeFrame = await readMainFrameInfo(deps.cdp, target.tabId);
@@ -669,7 +574,10 @@ export async function handleNavigate(
      }`,
    });
  } catch (err) {
-    return cdpError(err);
+    return {
+      code: "cdp_failed",
+      message: err instanceof Error ? err.message : String(err),
+    };
  }
 }

@@ -819,24 +727,7 @@ export async function handleReload(

  try {
    deps.cdp.trackSessionTab?.(ctx.sessionId, target.tabId);
-    try {
-      await ensureCdpReady(deps.cdp, target.tabId);
-    } catch (error) {
-      if (!isCdpExtensionAccessDenied(error)) throw error;
-      const previousUrl = await readTabUrl(deps.tabsApi, target.tabId);
-      const recovered = await recoverBrowserNavigation(
-        deps,
-        target.tabId,
-        (api) => api.reload(target.tabId, { bypassCache: ignoreCache }),
-        waitUntil,
-        timeoutMs,
-      );
-      if (isRpcError(recovered)) return recovered;
-      return attachDialogs(deps.cdp, target.tabId, dialogCursor, {
-        ...recovered,
-        previous_url: previousUrl,
-      });
-    }
+    await ensureCdpReady(deps.cdp, target.tabId);
    const previousUrl = await readTabUrl(deps.tabsApi, target.tabId);
    const beforeFrame = await readMainFrameInfo(deps.cdp, target.tabId);
    const expected = cdpLifecycleName(waitUntil);
@@ -885,7 +776,10 @@ export async function handleReload(
      }`,
    });
  } catch (err) {
-    return cdpError(err);
+    return {
+      code: "cdp_failed",
+      message: err instanceof Error ? err.message : String(err),
+    };
  }
 }

@@ -17,7 +17,7 @@ import { ChromiumCdp } from "@/browser-driver/chromium-cdp";
 import type { CdpTarget } from "@/browser-driver/frame-graph";
 import {
  type CaptureSuppressSendToTab,
-  withExtensionOverlayHidden,
+  withOverlaysHiddenForCapture,
 } from "@/lib/capture-suppress-bridge";
 import type { SessionContext, SessionManager } from "@/session-manager/manager";
 import type {
@@ -34,8 +34,6 @@ import type {
 import { attachDialogs, markDialogCursor } from "./dialogs";
 import { rpcError } from "./errors";
 import { resolveNodeGeometry } from "./frame-geometry";
-import { screenshotPageRect } from "./geometry/coordinate-types";
-import { cssViewport, GeometryContext } from "./geometry/frame-context";
 import {
  type ChromeTabsApi,
  enforceToolTargetScope,
@@ -51,14 +49,11 @@ import {
 import { resolveSnapshotRef } from "./snapshot-ref";
 import {
  type CapturedNode,
-  type CapturedSurfaceProbe,
  type CapturedViewModel,
  captureViewModel,
  collectOverlayExcludedBackendIds,
-  probeHoverSurfaces,
 } from "./vom/capture";
 import { type CapturedFrameDocument, captureFrameData } from "./vom/frame-capture";
-import { withOverlayBypass } from "./vom/hover-perception";
 import { probeTooltipNames } from "./vom/name-enrichment";
 import {
  type CaptureVomObservationResult,
@@ -199,14 +194,15 @@ async function captureElementScreenshot(
  if (isRpcError(geometry)) return geometry;
  if (signal?.aborted) return cancelled("screenshot");
  const rect = geometry.topBounds;
-  const clip = screenshotPageRect(rect, geometry.topViewport);
-  if (!clip) return { code: "cdp_failed", message: "invalid screenshot coordinate space" };

  try {
    const shot = await cdp.send<{ data?: string }>(tabId, "Page.captureScreenshot", {
      format: "png",
      clip: {
-        ...clip.rect,
+        x: rect.x,
+        y: rect.y,
+        width: rect.width,
+        height: rect.height,
        scale: 1,
      },
    });
@@ -325,7 +321,7 @@ export async function handleScreenshot(
      tabId: target.tabId,
      ...(node.cdpSessionId ? { sessionId: node.cdpSessionId } : {}),
    };
-    const captured = await withExtensionOverlayHidden(
+    const captured = await withOverlaysHiddenForCapture(
      target.tabId,
      () =>
        captureElementScreenshot(
@@ -357,7 +353,7 @@ export async function handleScreenshot(
    );
  }

-  const captured = await withExtensionOverlayHidden(
+  const captured = await withOverlaysHiddenForCapture(
    target.tabId,
    () => captureFullTabPng(deps, ctx, target, signal),
    deps.sendToTab,
@@ -529,11 +525,8 @@ function buildActiveScopeBlocks(nodes: VomNode[], signals: VomNodeDomSignals): A
  return blocks;
 }

-function buildConditionalSurfaces(
-  nodes: VomNode[],
-  captured: CapturedViewModel,
-  probes: CapturedSurfaceProbe[],
-): CondSurface[] {
+function buildConditionalSurfaces(nodes: VomNode[], captured: CapturedViewModel): CondSurface[] {
+  const probes = captured.surfaceProbes ?? [];
  if (probes.length === 0) return [];

  const surfaces: CondSurface[] = [];
@@ -656,7 +649,6 @@ function findSurfaceNodeByPoint(
 export interface BuildVomSceneOptions {
  pageUrl?: string;
  supplementalNames?: ReadonlyMap<string, string>;
-  surfaceProbes?: CapturedSurfaceProbe[];
 }

 export type VomFrameDocument = CapturedFrameDocument<CdpAxNode>;
@@ -676,7 +668,6 @@ function legacyFrameDocuments(
      ...(pageUrl ? { url: pageUrl } : {}),
      axNodes: [],
      domNodes: captured.nodes.map((node) => ({ ...node, frameId: node.frameId ?? rootFrameId })),
-      excludedBackendNodeIds: captured.frameExcludedBackendNodeIds?.get(rootFrameId),
    },
  ];
  const pending = [...captured.iframeNodes.entries()];
@@ -700,7 +691,6 @@ function legacyFrameDocuments(
        target: parent.target,
        axNodes: [],
        domNodes: domNodes.map((node) => ({ ...node, frameId: node.frameId ?? frameId })),
-        excludedBackendNodeIds: captured.frameExcludedBackendNodeIds?.get(frameId),
      });
      pending.splice(index, 1);
      progress = true;
@@ -827,19 +817,18 @@ export function buildFrameVomScene(
    excludedBackendNodeIds: captured.excludedBackendNodeIds,
    supplementalNames: options.supplementalNames,
  });
-  return attachCapturedSceneAnnotations(scene, documents, captured, options.surfaceProbes ?? []);
+  return attachCapturedSceneAnnotations(scene, documents, captured);
 }

 function attachCapturedSceneAnnotations(
  scene: VomScene,
  documents: VomFrameDocument[],
  captured: CapturedViewModel,
-  surfaceProbes: CapturedSurfaceProbe[],
 ): VomScene {
  const rootDocument = documents.find((document) => document.frameId === scene.rootFrameId);
  const signals = capturedOnlySignals(rootDocument?.domNodes ?? captured.nodes);
  const activeScopeBlocks = buildActiveScopeBlocks(scene.nodes, signals);
-  const surfaces = buildConditionalSurfaces(scene.nodes, captured, surfaceProbes);
+  const surfaces = buildConditionalSurfaces(scene.nodes, captured);
  return {
    ...scene,
    ...(surfaces.length > 0 ? { surfaces } : {}),
@@ -987,19 +976,26 @@ function emptyCapturedViewModel(viewport = { width: 0, height: 0 }): CapturedVie
  return { viewport, nodes: [], iframeNodes: new Map(), excludedBackendNodeIds: new Set() };
 }

+interface LayoutMetricsViewportReply {
+  cssLayoutViewport?: { clientWidth?: number; clientHeight?: number };
+  layoutViewport?: { clientWidth?: number; clientHeight?: number };
+}
+
 async function fallbackCapturedViewModel(
  cdp: CdpRunner,
  tabId: number,
-  geometry: GeometryContext,
  signal?: AbortSignal,
 ): Promise<CapturedViewModel> {
  throwIfAborted(signal, "observation");
  let viewport = { width: 0, height: 0 };
  try {
-    const metrics = await geometry.layoutMetrics({ tabId });
+    const metrics = await cdp.send<LayoutMetricsViewportReply>(tabId, "Page.getLayoutMetrics", {});
    throwIfAborted(signal, "observation");
-    const source = cssViewport(metrics);
-    viewport = { width: source.width, height: source.height };
+    const source = metrics.cssLayoutViewport ?? metrics.layoutViewport ?? {};
+    viewport = {
+      width: source.clientWidth ?? 0,
+      height: source.clientHeight ?? 0,
+    };
  } catch (error) {
    if (isAbortError(error)) throw error;
  }
@@ -1012,72 +1008,19 @@ async function captureForVom(
  cdp: CdpRunner,
  tabId: number,
  options: CaptureVomObservationOptions,
-  geometry: GeometryContext,
 ): Promise<CapturedViewModel> {
  try {
-    return await captureViewModel(cdp, tabId, { signal: options.signal, geometry });
+    return await captureViewModel(cdp, tabId, {
+      conditionalSurfaceProbe: options.conditionalSurfaceProbe ?? false,
+      hoverProbeBypassOverlay: options.hoverProbeBypassOverlay,
+      signal: options.signal,
+    });
  } catch (error) {
    if (isAbortError(error)) throw error;
-    return fallbackCapturedViewModel(cdp, tabId, geometry, options.signal);
+    return fallbackCapturedViewModel(cdp, tabId, options.signal);
  }
 }

-export interface HoverProbeOutcome {
-  /** Whether any active hover was dispatched during this observation. */
-  performed: boolean;
-  /**
-   * Whether hovering surfaced content absent from the static snapshot. Cached
-   * tooltip names count, so this may over-report on repeat observations — it
-   * errs towards telling the caller the snapshot is less fresh than it looks.
-   */
-  revealedContent: boolean;
-  surfaceProbes: CapturedSurfaceProbe[];
-  tooltipNames: Map<string, string>;
-}
-
-const NO_HOVER_PROBES: HoverProbeOutcome = {
-  performed: false,
-  revealedContent: false,
-  surfaceProbes: [],
-  tooltipNames: new Map(),
-};
-
-/**
- * Runs both active-hover chains back to back.
- *
- * Ordering matters: this happens after DOM *and* accessibility capture so a
- * hover that opens a menu cannot leave one half of the observation describing
- * the page before the change and the other half after it. Sharing one overlay
- * bypass span also means the agent overlay toggles once per observation
- * instead of once per chain.
- */
-async function runHoverProbes(
-  cdp: CdpRunner,
-  tabId: number,
-  captured: CapturedViewModel,
-  documents: VomFrameDocument[],
-  staticSemantics: ReturnType<typeof resolveSemanticGraph>,
-  options: CaptureVomObservationOptions,
-): Promise<HoverProbeOutcome> {
-  if (!options.conditionalSurfaceProbe) return NO_HOVER_PROBES;
-
-  return withOverlayBypass(options.hoverProbeBypassOverlay, tabId, async () => {
-    const surfaceProbes = await probeHoverSurfaces(cdp, tabId, captured.nodes, {
-      signal: options.signal,
-    });
-    throwIfAborted(options.signal, "observation");
-    const tooltipNames = await probeTooltipNames(cdp, tabId, documents, staticSemantics, {
-      signal: options.signal,
-    });
-    return {
-      performed: true,
-      revealedContent: surfaceProbes.length > 0 || tooltipNames.size > 0,
-      surfaceProbes,
-      tooltipNames,
-    };
-  });
-}
-
 export interface CaptureVomObservationOptions extends VomOptions {
  conditionalSurfaceProbe?: boolean;
  hoverProbeBypassOverlay?: (tabId: number, enabled: boolean) => Promise<void>;
@@ -1093,16 +1036,9 @@ export async function captureVomObservation(
  throwIfAborted(options.signal, "observation");
  await cdp.ensureAttachedToUrl?.(tabId, url);
  throwIfAborted(options.signal, "observation");
-  const geometry = new GeometryContext(cdp, tabId, undefined, options.signal);
-  const captured = await captureForVom(cdp, tabId, options, geometry);
+  const captured = await captureForVom(cdp, tabId, options);
  throwIfAborted(options.signal, "observation");
-  const documents = await captureFrameData<CdpAxNode>(
-    cdp,
-    tabId,
-    captured,
-    options.signal,
-    geometry,
-  );
+  const documents = await captureFrameData<CdpAxNode>(cdp, tabId, captured, options.signal);
  throwIfAborted(options.signal, "observation");
  const normalizedDocuments =
    documents.length === 1 && captured.iframeNodes.size > 0
@@ -1115,51 +1051,31 @@ export async function captureVomObservation(
    excludedBackendNodeIds: captured.excludedBackendNodeIds,
  });
  const staticSemantics = resolveSemanticGraph(semanticGraph, { identifierFallback: false });
-  const hoverProbes = await runHoverProbes(
-    cdp,
-    tabId,
-    captured,
-    normalizedDocuments,
-    staticSemantics,
-    options,
-  );
+  const tooltipNames = options.conditionalSurfaceProbe
+    ? await probeTooltipNames(cdp, tabId, normalizedDocuments, staticSemantics, {
+        signal: options.signal,
+        hoverProbeBypassOverlay: options.hoverProbeBypassOverlay,
+      })
+    : new Map<string, string>();
  throwIfAborted(options.signal, "observation");
  const scene = projectSemanticGraph(
    normalizeSemanticStructure(
-      resolveSemanticGraph(semanticGraph, { supplementalNames: hoverProbes.tooltipNames }),
+      resolveSemanticGraph(semanticGraph, { supplementalNames: tooltipNames }),
    ),
  );
-  const decoratedScene = attachCapturedSceneAnnotations(
-    scene,
-    normalizedDocuments,
-    captured,
-    hoverProbes.surfaceProbes,
-  );
-  // Reserve space using the renderer's character-based token estimate. Like VOM
-  // headers, this integrity notice remains visible even under a tiny token budget.
-  const geometryNotice = captured.frameGeometryIssues?.length
-    ? "@warning geometry incomplete: some page or frame content has no top-level coordinates.\n"
-    : "";
+  const decoratedScene = attachCapturedSceneAnnotations(scene, normalizedDocuments, captured);
  const rendered = renderVom(decoratedScene, {
    maxDepth: options.maxDepth,
-    maxTokens:
-      !geometryNotice || options.maxTokens === undefined
-        ? options.maxTokens
-        : Math.max(0, options.maxTokens - Math.ceil(geometryNotice.length / 4)),
+    maxTokens: options.maxTokens,
    redactValues: options.redactValues,
    activeRegionPolicy: options.activeRegionPolicy,
  });
-  if (geometryNotice) rendered.text += `\n${geometryNotice.trimEnd()}`;
  throwIfAborted(options.signal, "observation");
  return projectRecordSafeObservation({
    rootFrameId: captured.rootFrameId ?? normalizedDocuments[0]?.frameId ?? "root",
    frameDocuments: normalizedDocuments,
    rendered,
-    surfaceProbes: hoverProbes.surfaceProbes,
-    hoverProbe: {
-      performed: hoverProbes.performed,
-      revealedContent: hoverProbes.revealedContent,
-    },
+    surfaceProbes: captured.surfaceProbes,
  });
 }

@@ -1225,14 +1141,6 @@ async function handleVomObservation(
      ref_count: observation.refs.length,
      tab_id: target.tabId,
      truncated: observation.truncated,
-      ...(toolName === "observe" && observation.hoverProbe?.performed
-        ? {
-            hover_probe: {
-              performed: true,
-              revealed_content: observation.hoverProbe.revealedContent,
-            },
-          }
-        : {}),
      ...(toolName === "observe" && (params as ObserveParams).debug_surfaces
        ? {
            debug: {
@@ -1271,13 +1179,5 @@ export async function handleObserve(
  deps: SnapshotDeps = getDefaultDeps(),
  signal?: AbortSignal,
 ): Promise<ObserveResult | RpcError> {
-  return handleVomObservation(
-    manager,
-    params,
-    "observe",
-    "transient_input",
-    params.probe_hover === true,
-    deps,
-    signal,
-  );
+  return handleVomObservation(manager, params, "observe", "transient_input", true, deps, signal);
 }
@@ -2,7 +2,6 @@ import { type SessionManager, SessionStartCleanupError } from "@/session-manager
 import type { RpcError } from "@/transport/types";
 import { rpcError } from "./errors";
 import { clearRecordingForSession } from "./record";
-import type { CdpRunner, ChromeTabsApi } from "./shared";
 import { isRpcError } from "./shared";
 import { returnBorrowedTab, type TabManagementDeps } from "./tabs";

@@ -74,17 +73,11 @@ export interface SessionStopResult {
  /** Tab ids whose return path failed; those entries remain borrowed so
   *  shutdown can be retried without closing the Agent Window. */
  return_failures?: Array<{ tab_id: number; code: string; message: string }>;
-  /**
-   * True when the Agent Window was *released* to the user (instead of being
-   * closed) because it still contained user-created tabs after the agent's own
-   * tabs were closed. Single-session scope.
-   */
-  window_released?: boolean;
 }

 export interface SessionStopDeps {
  signal?: AbortSignal;
-  cdp?: Pick<CdpRunner, "releaseSessionTab"> & {
+  cdp?: {
    detachSession(sessionId: string): Promise<void>;
  };
  /**
@@ -94,13 +87,6 @@ export interface SessionStopDeps {
   * without a real browser.
   */
  tabManagement?: TabManagementDeps;
-  /**
-   * Read-only Chrome tabs API used to *query* remaining tabs before deciding
-   * whether to release the window. Kept separate from `tabManagement.tabs`
-   * (a `TabMutationApi` that has no `query`) so the mutation interface stays
-   * pure. Tests can inject a fake `ChromeTabsApi` too.
-   */
-  tabsQuery?: ChromeTabsApi;
 }

 /**
@@ -166,10 +152,8 @@ export async function handleSessionStart(
 *      cleanly (review parity with M6).
 *   3. Detach CDP sessions the extension still holds for this
 *      session (no-op if M6/M7 didn't attach to any tab).
- *   4. Close the agent-created tabs and the home tab (design §3.2).
- *   5. If any tab remains — those are user-created tabs — release the
- *      window to the user (dropOnly) instead of closing it, so user
- *      tabs survive. Otherwise close the window as before.
+ *   4. Close the Agent Window. SessionManager.stop() removes the
+ *      Chrome window and forgets the context.
 *
 * Failures in step 1 keep the Agent Window open: a failed borrowed tab
 * may still be there, so closing the window would risk losing user
@@ -204,19 +188,15 @@ export async function handleSessionStop(
  const returnFailures: SessionStopResult["return_failures"] = [];
  const borrowedIds = Array.from(ctx.borrowedTabs.keys());
  for (const tabId of borrowedIds) {
-    // A close event may have removed this borrow while another tab returned.
-    if (!ctx.borrowedTabs.has(tabId)) continue;
    try {
      const tabManagement = {
        ...(deps.tabManagement ?? {}),
-        cdp: deps.cdp ?? deps.tabManagement?.cdp,
        signal: deps.signal,
        isAgentWindowId:
          deps.tabManagement?.isAgentWindowId ??
          ((windowId: number) => manager.findByWindowId(windowId) !== null),
      };
      const outcome = await returnBorrowedTab(ctx, tabId, tabManagement);
-      if (!ctx.borrowedTabs.has(tabId)) continue;
      if (typeof outcome === "object" && "code" in outcome) {
        console.warn(`[bsk session_stop] auto-return failed for tab ${tabId}`, outcome);
        returnFailures?.push({
@@ -229,7 +209,6 @@ export async function handleSessionStop(
        ctx.borrowedTabs.delete(tabId);
      }
    } catch (err) {
-      if (!ctx.borrowedTabs.has(tabId)) continue;
      const message = err instanceof Error ? err.message : String(err);
      console.warn(`[bsk session_stop] auto-return threw for tab ${tabId}: ${message}`);
      returnFailures?.push({
@@ -240,15 +219,8 @@ export async function handleSessionStop(
    }
  }

-  // A previously failed tab may have closed during a later return. Only
-  // confirmed close events remove borrows; ordinary move failures stay retryable.
-  const pendingReturnFailures = returnFailures.filter((failure) =>
-    ctx.borrowedTabs.has(failure.tab_id),
-  );
  if (deps.signal?.aborted) {
-    const nonCancelFailures = pendingReturnFailures.filter(
-      (failure) => failure.code !== "cancelled",
-    );
+    const nonCancelFailures = returnFailures?.filter((failure) => failure.code !== "cancelled");
    if (nonCancelFailures && nonCancelFailures.length > 0) {
      return {
        ...(returnedTabIds.length > 0 ? { returned_tab_ids: returnedTabIds } : {}),
@@ -260,8 +232,8 @@ export async function handleSessionStop(

  const result: SessionStopResult = {};
  if (returnedTabIds.length > 0) result.returned_tab_ids = returnedTabIds;
-  if (pendingReturnFailures.length > 0) {
-    result.return_failures = pendingReturnFailures;
+  if (returnFailures && returnFailures.length > 0) {
+    result.return_failures = returnFailures;
    // A failed return means at least one borrowed user tab may still be
    // inside the Agent Window. Keep the session/window alive so the user
    // can retry `bsk session stop` or explicitly `bsk tab return` after the
@@ -281,66 +253,8 @@ export async function handleSessionStop(
    return { code: "cancelled", message: "session_stop aborted before window close" };
  }

-  // Step 4: close every tab explicitly created by the agent, including the
-  // home tab. `tabsApi` is a
-  // TabMutationApi (remove only); `queryApi` is a separate read-only
-  // ChromeTabsApi. If neither is injected, we conservatively fall back to
-  // closing the window (see Step 5).
-  const tabsApi = deps.tabManagement?.tabs;
-  const queryApi = deps.tabsQuery;
-
-  if (tabsApi) {
-    // Close each agent-created tab that still exists.
-    const agentCreatedTabIds = Array.from(ctx.agentCreatedTabs);
-    for (const tabId of agentCreatedTabIds) {
-      try {
-        await tabsApi.remove(tabId);
-        ctx.agentCreatedTabs.delete(tabId);
-      } catch (err) {
-        // Tab may already be gone (closed by the user). Non-fatal.
-        console.warn(`[bsk session_stop] failed to close agent tab ${tabId}`, err);
-      }
-    }
-  }
-
-  // Step 5: decide whether to release (keep) the window or close it.
-  let shouldRelease = false;
-  if (queryApi) {
-    try {
-      const liveWindowTabs = await queryApi.query({ windowId: ctx.agentWindowId });
-      // Only genuine *user* tabs count toward keeping the window open.
-      // An agent tab that failed to close in Step 4 may still be present
-      // here; if we counted it as a reason to release (dropOnly), the
-      // window would be kept and that agent tab would leak (issue #57
-      // regression). Exclude any id still tracked in agentCreatedTabs.
-      const userTabs = liveWindowTabs.filter((t) => {
-        if (t.id === undefined) return false;
-        return !ctx.agentCreatedTabs.has(t.id);
-      });
-      const leakedAgentTabs = liveWindowTabs.filter(
-        (t) => t.id !== undefined && ctx.agentCreatedTabs.has(t.id),
-      );
-      if (leakedAgentTabs.length > 0) {
-        console.warn(
-          `[bsk session_stop] ${leakedAgentTabs.length} agent tab(s) failed to close; forcing window close instead of release`,
-          leakedAgentTabs.map((t) => t.id),
-        );
-      }
-      shouldRelease = userTabs.length > 0;
-    } catch {
-      // Query failed (e.g. window already gone) — conservatively close it.
-      shouldRelease = false;
-    }
-  }
-
-  if (shouldRelease) {
-    // Keep the window + its user tabs; only drop the session binding.
-    await manager.stop(params.session_id, { dropOnly: true });
-    result.window_released = true;
-  } else {
-    // Window is empty (or we couldn't verify state) — close it.
-    await manager.stop(params.session_id);
-  }
+  // Step 4: close the Agent Window and drop the context.
+  await manager.stop(params.session_id);

  return result;
 }
@@ -53,11 +53,9 @@ export type { DialogCursor };
 export interface CdpRunner {
  send<T = unknown>(tabId: number, method: string, params?: object): Promise<T>;
  sendToTarget?<T = unknown>(target: CdpTarget, method: string, params?: object): Promise<T>;
-  detach?(tabId: number): Promise<void>;
  getFrameGraph?(tabId: number): Promise<CdpFrameGraph>;
  ensureAttachedToUrl?(tabId: number, expectedUrl: string | undefined): Promise<void>;
  trackSessionTab?(sessionId: string, tabId: number): void;
-  releaseSessionTab?(sessionId: string, tabId: number): Promise<void>;
  onEvent?(handler: (source: CdpDebuggee, method: string, params: unknown) => void): {
    dispose(): void;
  };
@@ -10,7 +10,7 @@ import {
 import type { SessionContext, SessionManager } from "@/session-manager/manager";
 import type { RpcError } from "@/transport/types";
 import { rpcError } from "./errors";
-import { type CdpRunner, isRpcError, lookupSession } from "./shared";
+import { isRpcError, lookupSession } from "./shared";

 export type TabScope = "user" | "agent" | "all";

@@ -287,10 +287,6 @@ export interface TabManagementDeps {
  approveBorrow?: BorrowConfirmationApprover;
  /** Clears Agent-scoped overlays after a borrowed tab is returned. */
  agentOverlayReset?: AgentOverlayResetApi;
-  /** Releases this session's CDP claim after a borrowed tab is returned. */
-  cdp?: Pick<CdpRunner, "releaseSessionTab">;
-  /** Runs after tab_return validation, before moving the borrowed tab. */
-  beforeReturn?: (sessionId: string, tabId: number) => Promise<void>;
  /**
   * Reports whether `windowId` is any live session's Agent Window.
   * `tab_return`'s fallback window picker uses this to avoid moving a
@@ -373,7 +369,6 @@ function buildCreateProps(
 * Returns the created tab on success, or an `RpcError` on failure.
 */
 async function createTabAndCleanup(
-  ctx: SessionContext,
  deps: TabManagementDeps,
  createProps: chrome.tabs.CreateProperties,
 ): Promise<CreatedChromeTab | RpcError> {
@@ -386,28 +381,25 @@ async function createTabAndCleanup(
      message: err instanceof Error ? err.message : String(err),
    };
  }
-  if (typeof tab.id !== "number") {
-    return { code: "protocol_error", message: "chrome.tabs.create returned no tab id" };
-  }
-  // Claim the concrete id returned by Chrome. Ownership never depends on
-  // matching this request to an asynchronous onCreated event.
-  ctx.agentCreatedTabs.add(tab.id);
  if (aborted(deps.signal, "tab_create")) {
-    try {
-      await getTabsApi(deps).remove(tab.id);
-      ctx.agentCreatedTabs.delete(tab.id);
-    } catch (cleanupErr) {
-      // Keep the claim when cleanup fails so session_stop can retry instead
-      // of releasing an agent-owned tab to the user.
-      return rpcError(
-        "protocol_error",
-        "cleanup_failed",
-        `tab_create aborted but cleanup of tab ${tab.id} failed: ${describeError(cleanupErr)}`,
-        { resource_type: "tab", resource_id: tab.id },
-      );
+    // We already opened the tab; close it on abort so we don't leak.
+    if (typeof tab.id === "number") {
+      try {
+        await getTabsApi(deps).remove(tab.id);
+      } catch (cleanupErr) {
+        return rpcError(
+          "protocol_error",
+          "cleanup_failed",
+          `tab_create aborted but cleanup of tab ${tab.id} failed: ${describeError(cleanupErr)}`,
+          { resource_type: "tab", resource_id: tab.id },
+        );
+      }
    }
    return { code: "cancelled", message: "tab_create aborted" };
  }
+  if (typeof tab.id !== "number") {
+    return { code: "protocol_error", message: "chrome.tabs.create returned no tab id" };
+  }
  return { ...tab, id: tab.id };
 }

@@ -434,7 +426,7 @@ export async function handleTabCreate(
  const paramErr = validateTabCreateParams(params);
  if (paramErr) return paramErr;

-  const tab = await createTabAndCleanup(ctx, deps, buildCreateProps(ctx, params));
+  const tab = await createTabAndCleanup(deps, buildCreateProps(ctx, params));
  if (isRpcError(tab)) return tab;

  return {
@@ -534,9 +526,6 @@ export async function handleTabClose(
  }
  try {
    await getTabsApi(deps).remove(params.tab_id);
-    // Keep the tracking set accurate so session_stop won't try to close a
-    // tab that's already gone (design §3.1).
-    ctx.agentCreatedTabs.delete(params.tab_id);
  } catch (err) {
    return {
      code: "protocol_error",
@@ -764,6 +753,13 @@ async function executeBorrowCore(
  );
  if (moveErr) return moveErr;

+  // Best-effort activation — failure is non-fatal.
+  try {
+    await p.tabsApi.update(p.tabId, { active: true });
+  } catch (err) {
+    console.debug("[bsk tab_borrow] activate after move failed", err);
+  }
+
  return { originalWindowId, originalIndex };
 }

@@ -827,12 +823,6 @@ export async function handleTabBorrow(
        message: err instanceof Error ? err.message : String(err),
      };
    }
-    // Activate after commit so overlay/event observers see the tab as claimed.
-    try {
-      await tabsApi.update(params.tab_id, { active: true });
-    } catch (err) {
-      console.debug("[bsk tab_borrow] activate after move failed", err);
-    }
    return {
      tab_id: params.tab_id,
      original_window_id: coreResult.originalWindowId,
@@ -949,22 +939,16 @@ async function cleanupUnusedFallbackWindow(
  }
 }

-async function releaseReturnedTabState(
+function resetAgentOverlaysInReturnedTab(
  ctx: SessionContext,
  tabId: number,
  deps: TabManagementDeps,
-): Promise<void> {
+): void {
  void getAgentOverlayResetApi(deps)
    .resetAgentOverlays(tabId, ctx.sessionId)
    .catch((err) => {
      console.debug("[bsk tab_return] agent overlay reset failed", err);
    });
-  try {
-    await deps.cdp?.releaseSessionTab?.(ctx.sessionId, tabId);
-  } catch (err) {
-    // A successful move must not be retried because debugger cleanup failed.
-    console.debug("[bsk tab_return] CDP release failed", err);
-  }
 }

 /**
@@ -1038,7 +1022,7 @@ export async function returnBorrowedTab(
    });
    const movedTab = Array.isArray(moved) ? moved[0] : moved;
    const finalIndex = typeof movedTab?.index === "number" ? movedTab.index : targetIndex;
-    await releaseReturnedTabState(ctx, tabId, deps);
+    resetAgentOverlaysInReturnedTab(ctx, tabId, deps);
    return {
      tabId,
      toWindowId: targetWindowId,
@@ -1080,7 +1064,7 @@ export async function returnBorrowedTab(
        });
        const movedTab = Array.isArray(moved) ? moved[0] : moved;
        const finalIndex = typeof movedTab?.index === "number" ? movedTab.index : target.index;
-        await releaseReturnedTabState(ctx, tabId, deps);
+        resetAgentOverlaysInReturnedTab(ctx, tabId, deps);
        return {
          tabId,
          toWindowId: target.windowId,
@@ -1126,7 +1110,6 @@ export async function handleTabReturn(
      message: `tab_return: tab ${params.tab_id} is not borrowed by this session`,
    };
  }
-  await deps.beforeReturn?.(ctx.sessionId, params.tab_id);
  const outcome = await returnBorrowedTab(ctx, params.tab_id, {
    ...deps,
    isAgentWindowId:
@@ -1,42 +0,0 @@
-// Shared time boundary for browser-side file-transfer transactions. Concrete
-// upload/download mechanisms own their state machines and effect semantics.
-
-export class BoundedWaitError extends Error {
-  constructor(
-    readonly kind: "timeout" | "aborted",
-    message: string,
-  ) {
-    super(message);
-  }
-}
-
-export function remainingMs(deadline: number): number {
-  return Math.max(0, deadline - Date.now());
-}
-
-export async function waitBounded<T>(
-  promise: Promise<T>,
-  deadline: number,
-  signal: AbortSignal | undefined,
-  timeoutMessage: string,
-): Promise<T> {
-  const remaining = remainingMs(deadline);
-  if (signal?.aborted) throw new BoundedWaitError("aborted", "file transfer aborted");
-  if (remaining === 0) throw new BoundedWaitError("timeout", timeoutMessage);
-
-  let timer: ReturnType<typeof setTimeout> | undefined;
-  let onAbort: (() => void) | undefined;
-  const boundary = new Promise<never>((_resolve, reject) => {
-    timer = setTimeout(() => reject(new BoundedWaitError("timeout", timeoutMessage)), remaining);
-    if (signal) {
-      onAbort = () => reject(new BoundedWaitError("aborted", "file transfer aborted"));
-      signal.addEventListener("abort", onAbort, { once: true });
-    }
-  });
-  try {
-    return await Promise.race([promise, boundary]);
-  } finally {
-    if (timer) clearTimeout(timer);
-    if (signal && onAbort) signal.removeEventListener("abort", onAbort);
-  }
-}
@@ -1,85 +0,0 @@
-// Upload orchestration: validate the session-scoped request, resolve its click
-// target, then delegate the browser protocol transaction to the file-input
-// transaction module.
-
-import {
-  type CaptureSuppressSendToTab,
-  withExtensionOverlayHidden,
-} from "@/lib/capture-suppress-bridge";
-import type { SessionManager } from "@/session-manager/manager";
-import type { RpcError, UploadParams, UploadResult } from "@/transport/types";
-import { uploadThroughFileDrop } from "./file-drop-transaction";
-import { uploadThroughActivatedFileInput } from "./file-input-transaction";
-import { clickResolvedTarget, type InteractionDeps, resolveActionTarget } from "./interaction";
-import {
-  type CdpRunner,
-  enforceAgentWindow,
-  isRpcError,
-  lookupSession,
-  resolveTargetTab,
-} from "./shared";
-
-const DEFAULT_TIMEOUT_MS = 120_000;
-
-export interface UploadDeps extends InteractionDeps {
-  cdp: CdpRunner;
-  sendToTab?: CaptureSuppressSendToTab;
-}
-
-export async function handleUpload(
-  manager: SessionManager,
-  params: UploadParams,
-  deps: UploadDeps,
-): Promise<UploadResult | RpcError> {
-  const ctx = lookupSession(manager, params, "upload");
-  if (isRpcError(ctx)) return ctx;
-  const target = await resolveTargetTab(manager, ctx, params.tab_id, deps.tabsApi);
-  if (isRpcError(target)) return target;
-  const denied = enforceAgentWindow(ctx, target, "upload");
-  if (denied) return denied;
-  if (
-    params.files.length === 0 ||
-    params.files.length > 20 ||
-    params.files.some((file) => !file.staged_path)
-  ) {
-    return { code: "invalid_params", message: "upload requires daemon-staged files" };
-  }
-  const address = await resolveActionTarget(deps.cdp, ctx, target, params, "upload");
-  if (isRpcError(address)) return address;
-  const timeoutMs = params.timeout_ms ?? DEFAULT_TIMEOUT_MS;
-  const files = params.files.map((file) => file.staged_path as string);
-  const mode = params.mode ?? "input";
-  let usedRef = address.usedRef;
-  let usedSelector = address.usedSelector;
-  if (mode === "drop") {
-    deps.cdp.trackSessionTab?.(ctx.sessionId, target.tabId);
-    const transaction = await uploadThroughFileDrop({
-      cdp: deps.cdp,
-      actionTarget: address,
-      files,
-      timeoutMs,
-      signal: deps.signal,
-      withOverlayHidden: (operation) =>
-        withExtensionOverlayHidden(target.tabId, operation, deps.sendToTab),
-    });
-    if (isRpcError(transaction)) return transaction;
-  } else {
-    const transaction = await uploadThroughActivatedFileInput({
-      cdp: deps.cdp,
-      actionTarget: address,
-      files,
-      timeoutMs,
-      signal: deps.signal,
-      trigger: () => clickResolvedTarget(ctx, address, {}, deps),
-    });
-    if (isRpcError(transaction)) return transaction;
-    usedRef = transaction.click.used_ref;
-    usedSelector = transaction.click.used_selector;
-  }
-  return {
-    tab_id: target.tabId,
-    used_ref: usedRef,
-    used_selector: usedSelector,
-    file_names: params.files.map((file) => file.name),
-  };
-}
@@ -1,7 +1,6 @@
 import { describe, expect, it, vi } from "vitest";
 import { OVERLAY_HOST_MARKER_ATTR, OVERLAY_HOST_NAME } from "../../../lib/overlay-bridge";
-import type { CdpRunner } from "../../shared";
-import { captureViewModel, collectOverlayExcludedBackendIds, probeHoverSurfaces } from "../capture";
+import { captureViewModel, collectOverlayExcludedBackendIds } from "../capture";

 // Minimal but format-accurate captureSnapshot reply: a body with one
 // fixed full-screen overlay div carrying a password input.
@@ -211,38 +210,26 @@ function makeCdp(snapshot: unknown) {
      if (method === "DOMSnapshot.enable") return {};
      if (method === "DOMSnapshot.captureSnapshot") return snapshot;
      if (method === "Page.getLayoutMetrics") {
-        return {
-          visualViewport: { clientWidth: 1000 },
-          cssVisualViewport: { clientWidth: 1000 },
-          cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
-        };
+        return { cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 } };
      }
      if (method === "Runtime.evaluate") {
        return {
          result: {
-            deepSerializedValue: {
-              type: "array",
-              value: [
+            value: {
+              controls: [
                {
-                  type: "array",
-                  value: [
-                    { type: "node", value: { backendNodeId: 13 } },
-                    {
-                      type: "string",
-                      value: JSON.stringify({
-                        state: "filled",
-                        sensitive: true,
-                        placeholder: "secret",
-                      }),
-                    },
-                  ],
+                  state: "filled",
+                  sensitive: true,
+                  defaultValue: "hunter2",
+                  value: "hunter2",
+                  placeholder: "secret",
                },
              ],
+              childFrames: [],
            },
          },
        };
      }
-      if (method === "Runtime.releaseObjectGroup") return {};
      throw new Error(`unexpected ${method}`);
    }) as unknown as <T>(tabId: number, method: string, params?: object) => Promise<T>,
  };
@@ -264,10 +251,11 @@ describe("captureViewModel", () => {
    expect(input?.attrs).toEqual({ type: "password" });
  });

-  it("never hovers the page while capturing", async () => {
+  it("does not run conditional surface probes by default", async () => {
    const cdp = makeCdp(fakeSnapshotReply());
-    await captureViewModel(cdp, 4);
+    const result = await captureViewModel(cdp, 4);

+    expect(result.surfaceProbes).toEqual([]);
    expect(cdp.send).not.toHaveBeenCalledWith(4, "Input.dispatchMouseEvent", expect.anything());
  });

@@ -286,11 +274,8 @@ describe("captureViewModel", () => {
    expect(cdp.send).toHaveBeenCalledWith(
      4,
      "Runtime.evaluate",
-      expect.objectContaining({
-        serializationOptions: expect.objectContaining({ serialization: "deep" }),
-      }),
+      expect.objectContaining({ returnByValue: true }),
    );
-    expect(cdp.send).toHaveBeenCalledWith(4, "Runtime.releaseObjectGroup", expect.anything());
    expect(cdp.send).not.toHaveBeenCalledWith(4, "DOM.resolveNode", expect.anything());
    expect(cdp.send).not.toHaveBeenCalledWith(4, "Runtime.callFunctionOn", expect.anything());
  });
@@ -303,8 +288,6 @@ describe("captureViewModel", () => {
        if (method === "DOMSnapshot.captureSnapshot") return hoverTriggerSnapshotReply();
        if (method === "Page.getLayoutMetrics") {
          return {
-            visualViewport: { clientWidth: 1000 },
-            cssVisualViewport: { clientWidth: 1000 },
            cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
          };
        }
@@ -336,10 +319,9 @@ describe("captureViewModel", () => {
      }) as unknown as <T>(tabId: number, method: string, params?: object) => Promise<T>,
    };

-    const captured = await captureViewModel(cdp, 4);
-    const surfaceProbes = await probeHoverSurfaces(cdp, 4, captured.nodes);
+    const result = await captureViewModel(cdp, 4, { conditionalSurfaceProbe: true });

-    expect(surfaceProbes).toEqual([
+    expect(result.surfaceProbes).toEqual([
      {
        triggerBackendNodeId: 12,
        triggerPoint: { x: 956, y: 32 },
@@ -368,8 +350,6 @@ describe("captureViewModel", () => {
        if (method === "DOMSnapshot.captureSnapshot") return twoHoverTriggerSnapshotReply();
        if (method === "Page.getLayoutMetrics") {
          return {
-            visualViewport: { clientWidth: 1000 },
-            cssVisualViewport: { clientWidth: 1000 },
            cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
          };
        }
@@ -398,10 +378,9 @@ describe("captureViewModel", () => {
      }) as unknown as <T>(tabId: number, method: string, params?: object) => Promise<T>,
    };

-    const captured = await captureViewModel(cdp, 4);
-    const surfaceProbes = await probeHoverSurfaces(cdp, 4, captured.nodes);
+    const result = await captureViewModel(cdp, 4, { conditionalSurfaceProbe: true });

-    expect(surfaceProbes).toEqual([
+    expect(result.surfaceProbes).toEqual([
      expect.objectContaining({
        triggerBackendNodeId: 12,
        subItems: ["My profile", "Sign out"],
@@ -418,8 +397,6 @@ describe("captureViewModel", () => {
        if (method === "DOMSnapshot.captureSnapshot") return nestedHoverTriggerSnapshotReply();
        if (method === "Page.getLayoutMetrics") {
          return {
-            visualViewport: { clientWidth: 1000 },
-            cssVisualViewport: { clientWidth: 1000 },
            cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
          };
        }
@@ -445,8 +422,7 @@ describe("captureViewModel", () => {
      }) as unknown as <T>(tabId: number, method: string, params?: object) => Promise<T>,
    };

-    const captured = await captureViewModel(cdp, 4);
-    await probeHoverSurfaces(cdp, 4, captured.nodes);
+    await captureViewModel(cdp, 4, { conditionalSurfaceProbe: true });

    expect(hoverMoves).toBe(1);
  });
@@ -538,9 +514,6 @@ describe("captureViewModel", () => {
      strings: S,
      documents: [
        {
-          scrollOffsetX: 0,
-          scrollOffsetY: 0,
-          frameId: "main",
          nodes: {
            parentIndex: [-1, 0, 1, 0, 3, 4],
            nodeName: [i("html"), i("body"), i("div"), i(OVERLAY_HOST_NAME), i("div"), i("button")],
@@ -571,12 +544,8 @@ describe("captureViewModel", () => {
      ],
    };

-    const { excludedBackendNodeIds, frameExcludedBackendNodeIds } = await captureViewModel(
-      makeCdp(snapshot),
-      4,
-    );
+    const { excludedBackendNodeIds } = await captureViewModel(makeCdp(snapshot), 4);
    expect(excludedBackendNodeIds).toEqual(new Set([13, 14, 15]));
-    expect(frameExcludedBackendNodeIds?.get("main")).toEqual(excludedBackendNodeIds);
  });

  it("excludes overlay host matched by tag name only", async () => {
@@ -760,8 +729,6 @@ describe("captureViewModel", () => {
        if (method === "DOMSnapshot.captureSnapshot") return fakeSnapshotReply();
        if (method === "Page.getLayoutMetrics") {
          return {
-            visualViewport: { clientWidth: 1000 },
-            cssVisualViewport: { clientWidth: 1000 },
            cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 200 },
          };
        }
@@ -774,46 +741,7 @@ describe("captureViewModel", () => {
    expect(div?.rect).toMatchObject({ y: 0, h: 600 });
  });

-  it("normalizes snapshot-owned scroll before using a stale CSS metrics fallback", async () => {
-    const snapshot = {
-      strings: ["html", "button"],
-      documents: [
-        {
-          frameId: "root",
-          scrollOffsetX: 40,
-          scrollOffsetY: 200,
-          nodes: {
-            parentIndex: [-1, 0],
-            nodeName: [0, 1],
-            backendNodeId: [10, 11],
-            attributes: [[], []],
-          },
-          layout: { nodeIndex: [1], bounds: [[200, 800, 240, 80]] },
-        },
-      ],
-    };
-    const cdp: CdpRunner = {
-      send: vi.fn(async (_tab: number, method: string) => {
-        if (method === "DOMSnapshot.captureSnapshot") return snapshot;
-        if (method === "Page.getLayoutMetrics")
-          return {
-            visualViewport: { clientWidth: 2000 },
-            cssVisualViewport: { clientWidth: 1000 },
-            cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 999, pageY: 999 },
-          };
-        return {};
-      }) as CdpRunner["send"],
-    };
-    const captured = await captureViewModel(cdp, 4);
-    expect(captured.nodes.find((node) => node.backendNodeId === 11)).toMatchObject({
-      localRect: { x: 80, y: 300, w: 120, h: 40 },
-      rect: { x: 80, y: 300, w: 120, h: 40 },
-      rendered: true,
-    });
-    expect(captured.frameGeometryIssues).toEqual([]);
-  });
-
-  it("normalizes raw snapshot bounds before viewport clipping", async () => {
+  it("normalizes device-pixel bounds by devicePixelRatio", async () => {
    const S = ["html", "body", "div", "position", "fixed", "static", "pointer-events", "auto"];
    const i = (s: string) => S.indexOf(s);
    const snapshot = {
@@ -847,8 +775,6 @@ describe("captureViewModel", () => {
        if (method === "DOMSnapshot.captureSnapshot") return snapshot;
        if (method === "Page.getLayoutMetrics") {
          return {
-            visualViewport: { clientWidth: 2000 },
-            cssVisualViewport: { clientWidth: 1000 },
            cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
            layoutViewport: { clientWidth: 2000, clientHeight: 1600 },
          };
@@ -863,12 +789,6 @@ describe("captureViewModel", () => {
      w: 1000,
      h: 800,
    });
-    expect(nodes.find((n) => n.backendNodeId === 12)?.localRect).toEqual({
-      x: 0,
-      y: 0,
-      w: 1000,
-      h: 800,
-    });
  });

  it("extracts textContent from #text child nodes via nodeValue", async () => {
@@ -924,8 +844,6 @@ describe("captureViewModel", () => {
        if (method === "DOMSnapshot.captureSnapshot") return snapshot;
        if (method === "Page.getLayoutMetrics") {
          return {
-            visualViewport: { clientWidth: 1000 },
-            cssVisualViewport: { clientWidth: 1000 },
            cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
          };
        }
@@ -1016,17 +934,9 @@ describe("captureViewModel", () => {
        if (method === "DOMSnapshot.captureSnapshot") return snapshot;
        if (method === "Page.getLayoutMetrics") {
          return {
-            visualViewport: { clientWidth: 1000 },
-            cssVisualViewport: { clientWidth: 1000 },
            cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
          };
        }
-        if (method === "DOM.getBoxModel")
-          return { model: { content: [100, 300, 900, 300, 900, 700, 100, 700] } };
-        if (method === "DOM.resolveNode") return { object: { objectId: "owner" } };
-        if (method === "Runtime.callFunctionOn")
-          return { result: { value: { width: 800, height: 400 } } };
-        if (method === "Runtime.releaseObject") return {};
        throw new Error(method);
      }) as unknown as <T>(tabId: number, method: string, params?: object) => Promise<T>,
    };
@@ -1056,7 +966,7 @@ describe("captureViewModel", () => {
    expect(frameParentIds?.get("child-frame")).toBe("main-frame");
  });

-  it("projects iframe documents independently of owner snapshot geometry", async () => {
+  it("captures iframe documents without requiring owner-frame geometry", async () => {
    const S = [
      "html",
      "body",
@@ -1114,17 +1024,9 @@ describe("captureViewModel", () => {
        if (method === "DOMSnapshot.captureSnapshot") return snapshot;
        if (method === "Page.getLayoutMetrics") {
          return {
-            visualViewport: { clientWidth: 1000 },
-            cssVisualViewport: { clientWidth: 1000 },
            cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
          };
        }
-        if (method === "DOM.getBoxModel")
-          return { model: { content: [100, 300, 900, 300, 900, 700, 100, 700] } };
-        if (method === "DOM.resolveNode") return { object: { objectId: "owner" } };
-        if (method === "Runtime.callFunctionOn")
-          return { result: { value: { width: 800, height: 400 } } };
-        if (method === "Runtime.releaseObject") return {};
        throw new Error(method);
      }) as unknown as <T>(tabId: number, method: string, params?: object) => Promise<T>,
    };
@@ -1133,7 +1035,7 @@ describe("captureViewModel", () => {
    const input = iframeNodes.get(13)?.find((n) => n.backendNodeId === 101);

    expect(input?.localRect).toEqual({ x: 20, y: 20, w: 120, h: 60 });
-    expect(input?.rect).toEqual({ x: 120, y: 320, w: 120, h: 60 });
+    expect(input?.rect).toBeNull();
  });

  it("recursively normalizes nested iframe sub-documents", async () => {
@@ -1175,8 +1077,6 @@ describe("captureViewModel", () => {
          },
        },
        {
-          scrollOffsetX: 0,
-          scrollOffsetY: 0,
          nodes: {
            parentIndex: [-1, 0, 1],
            nodeName: [i("html"), i("body"), i("iframe")],
@@ -1198,8 +1098,6 @@ describe("captureViewModel", () => {
          },
        },
        {
-          scrollOffsetX: 0,
-          scrollOffsetY: 0,
          nodes: {
            parentIndex: [-1, 0],
            nodeName: [i("body"), i("input")],
@@ -1216,45 +1114,16 @@ describe("captureViewModel", () => {
      ],
    };
    const cdp = {
-      send: vi.fn(
-        async (
-          _t: number,
-          method: string,
-          params?: { backendNodeId?: number; objectId?: string },
-        ) => {
-          if (method === "DOMSnapshot.enable") return {};
-          if (method === "DOMSnapshot.captureSnapshot") return snapshot;
-          if (method === "Page.getLayoutMetrics") {
-            return {
-              visualViewport: { clientWidth: 1000 },
-              cssVisualViewport: { clientWidth: 1000 },
-              cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
-            };
-          }
-          if (method === "DOM.getBoxModel")
-            return {
-              model: {
-                content:
-                  params?.backendNodeId === 13
-                    ? [10, 20, 310, 20, 310, 220, 10, 220]
-                    : [15, 26, 115, 26, 115, 106, 15, 106],
-              },
-            };
-          if (method === "DOM.resolveNode")
-            return { object: { objectId: String(params?.backendNodeId) } };
-          if (method === "Runtime.callFunctionOn")
-            return {
-              result: {
-                value:
-                  params?.objectId === "13"
-                    ? { width: 300, height: 200 }
-                    : { width: 100, height: 80 },
-              },
-            };
-          if (method === "Runtime.releaseObject") return {};
-          throw new Error(method);
-        },
-      ) as unknown as <T>(tabId: number, method: string, params?: object) => Promise<T>,
+      send: vi.fn(async (_t: number, method: string) => {
+        if (method === "DOMSnapshot.enable") return {};
+        if (method === "DOMSnapshot.captureSnapshot") return snapshot;
+        if (method === "Page.getLayoutMetrics") {
+          return {
+            cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
+          };
+        }
+        throw new Error(method);
+      }) as unknown as <T>(tabId: number, method: string, params?: object) => Promise<T>,
    };

    const { iframeNodes } = await captureViewModel(cdp, 4);
@@ -1268,7 +1137,7 @@ describe("captureViewModel", () => {
    expect(input?.rect).toEqual({ x: 16, y: 28, w: 40, h: 20 });
  });

-  it("subtracts CSS scroll once without dividing snapshot bounds by a metrics ratio", async () => {
+  it("normalizes bounds then subtracts CSS scroll at dpr>1", async () => {
    const S = ["html", "body", "div", "position", "fixed", "static", "pointer-events", "auto"];
    const i = (s: string) => S.indexOf(s);
    const snapshot = {
@@ -1302,8 +1171,6 @@ describe("captureViewModel", () => {
        if (method === "DOMSnapshot.captureSnapshot") return snapshot;
        if (method === "Page.getLayoutMetrics") {
          return {
-            visualViewport: { clientWidth: 2000 },
-            cssVisualViewport: { clientWidth: 1000 },
            cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 100 },
            layoutViewport: { clientWidth: 2000, clientHeight: 1600 },
          };
@@ -1337,200 +1204,3 @@ describe("captureViewModel", () => {
    expect(excluded).toEqual(new Set([200, 201, 202]));
  });
 });
-
-// Six sibling frames and one nested frame exercise scheduling through the real capture entry.
-function siblingCaptureFixture(
-  beforeReply: (method: string, params: Record<string, unknown>) => Promise<void> = async () => {},
-) {
-  const document = (id: number, owners: number[], childIndexes: number[]) => ({
-    scrollOffsetX: 0,
-    scrollOffsetY: 0,
-    frameId: `frame-${id}`,
-    nodes: {
-      parentIndex: [-1, ...owners.map(() => 0)],
-      nodeName: [0, ...owners.map(() => 1)],
-      backendNodeId: [1000 + id, ...owners],
-      attributes: [[], ...owners.map(() => [])],
-      contentDocumentIndex: { index: owners.map((_, i) => i + 1), value: childIndexes },
-    },
-    layout: {
-      nodeIndex: [0, ...owners.map((_, i) => i + 1)],
-      bounds: [[0, 0, 200, 100], ...owners.map(() => [0, 0, 200, 100])],
-    },
-  });
-  const snapshot = {
-    strings: ["body", "iframe"],
-    documents: [
-      document(0, [100, 101, 102, 103, 104, 105], [1, 2, 3, 4, 5, 6]),
-      document(1, [200], [7]),
-      ...Array.from({ length: 6 }, (_, i) => document(i + 2, [], [])),
-    ],
-  };
-  let active = 0;
-  let peak = 0;
-  const send = vi.fn(async (_tabId: number, method: string, params: object = {}) => {
-    const args = params as Record<string, unknown>;
-    active++;
-    peak = Math.max(peak, active);
-    try {
-      await beforeReply(method, args);
-      if (method === "DOMSnapshot.captureSnapshot") return snapshot;
-      if (method === "Page.getLayoutMetrics")
-        return {
-          visualViewport: { clientWidth: 1000 },
-          cssVisualViewport: { clientWidth: 1000 },
-          cssLayoutViewport: { clientWidth: 1000, clientHeight: 800 },
-        };
-      if (method === "DOM.getBoxModel")
-        return { model: { content: [0, 0, 200, 0, 200, 100, 0, 100] } };
-      if (method === "DOM.resolveNode") return { object: { objectId: String(args.backendNodeId) } };
-      if (method === "Runtime.callFunctionOn")
-        return { result: { value: { width: 200, height: 100 } } };
-      return {};
-    } finally {
-      active--;
-    }
-  });
-  return {
-    cdp: { send: send as CdpRunner["send"] },
-    send,
-    peak: () => peak,
-    active: () => active,
-    measured: () =>
-      send.mock.calls
-        .filter(([, method]) => method === "DOM.getBoxModel")
-        .map(([, , params]) => (params as { backendNodeId: number }).backendNodeId),
-  };
-}
-
-describe("sibling frame measurement scheduling", () => {
-  it("batches same-target owner sizes without changing projected results", async () => {
-    const fixture = siblingCaptureFixture();
-    const original = fixture.cdp.send;
-    const methods: string[] = [];
-    fixture.cdp.send = async (tabId, method, params) => {
-      methods.push(method);
-      if (method === "Runtime.evaluate")
-        return {
-          result: {
-            deepSerializedValue: {
-              type: "array",
-              value: [100, 101, 102, 103, 104, 105, 200].map((backendNodeId) => ({
-                type: "array",
-                value: [
-                  { type: "node", value: { backendNodeId } },
-                  { type: "string", value: JSON.stringify({ width: 200, height: 100 }) },
-                ],
-              })),
-            },
-          },
-        } as never;
-      return original(tabId, method, params);
-    };
-    const captured = await captureViewModel(fixture.cdp, 4);
-    expect(captured.frameGeometryIssues).toEqual([]);
-    expect([...captured.iframeNodes.keys()]).toEqual([100, 200, 101, 102, 103, 104, 105]);
-    expect(captured.iframeNodes.get(200)?.[0].rect).toEqual({ x: 0, y: 0, w: 200, h: 100 });
-    expect(methods.filter((method) => method === "DOM.getBoxModel")).toHaveLength(7);
-    expect(methods.filter((method) => method === "Runtime.evaluate")).toHaveLength(1);
-    expect(methods.filter((method) => method === "Runtime.releaseObjectGroup")).toHaveLength(1);
-    expect(methods).not.toContain("DOM.resolveNode");
-    expect(methods).not.toContain("Runtime.callFunctionOn");
-  });
-
-  it("bounds concurrent reads, fills free slots and preserves depth-first output despite reordered replies", async () => {
-    const pending = new Map<number, () => void>();
-    const fixture = siblingCaptureFixture(async (method, params) => {
-      if (method === "DOM.getBoxModel" && Number(params.backendNodeId) < 200)
-        await new Promise<void>((resolve) => pending.set(Number(params.backendNodeId), resolve));
-    });
-    const capture = captureViewModel(fixture.cdp, 4);
-    await vi.waitFor(() => expect(pending.size).toBe(4));
-    expect(fixture.measured()).toEqual([100, 101, 102, 103]);
-    pending.get(103)!();
-    await vi.waitFor(() => expect(pending.has(104)).toBe(true));
-    pending.get(104)!();
-    await vi.waitFor(() => expect(pending.has(105)).toBe(true));
-    expect(fixture.measured()).not.toContain(200);
-    for (const id of [105, 102, 101, 100]) pending.get(id)!();
-    const captured = await capture;
-    expect(captured.frameGeometryIssues).toEqual([]);
-    expect(fixture.peak()).toBe(4);
-    expect(fixture.active()).toBe(0);
-    expect(fixture.measured()).toEqual([100, 101, 102, 103, 104, 105, 200]);
-    expect([...captured.iframeNodes.keys()]).toEqual([100, 200, 101, 102, 103, 104, 105]);
-    expect(captured.iframeNodes.get(200)?.[0].rect).toEqual({ x: 0, y: 0, w: 200, h: 100 });
-    for (const method of [
-      "DOM.getBoxModel",
-      "DOM.resolveNode",
-      "Runtime.callFunctionOn",
-      "Runtime.releaseObject",
-    ])
-      expect(fixture.send.mock.calls.filter(([, name]) => name === method)).toHaveLength(7);
-  });
-
-  it("does not measure descendants of a failed owner and retains sibling geometry and local nodes", async () => {
-    const fixture = siblingCaptureFixture(async (method, params) => {
-      if (method === "DOM.resolveNode" && params.backendNodeId === 100)
-        throw new Error("owner replaced");
-    });
-    const captured = await captureViewModel(fixture.cdp, 4);
-    expect(captured.frameGeometryIssues).toEqual([
-      {
-        status: "unavailable",
-        source: { target: { tabId: 4 }, frameId: "frame-1" },
-        ownerBackendNodeId: 100,
-      },
-      {
-        status: "blocked",
-        source: { target: { tabId: 4 }, frameId: "frame-7" },
-        cause: captured.frameGeometryIssues?.[0],
-      },
-    ]);
-    expect(fixture.measured()).not.toContain(200);
-    expect(captured.iframeNodes.get(200)?.[0]).toMatchObject({
-      tag: "body",
-      rect: null,
-      localRect: { x: 0, y: 0, w: 200, h: 100 },
-    });
-    expect(captured.iframeNodes.get(101)?.[0].rect).toEqual({ x: 0, y: 0, w: 200, h: 100 });
-    expect([...captured.iframeNodes.keys()]).toEqual([100, 200, 101, 102, 103, 104, 105]);
-  });
-
-  it("stops scheduling on cancellation and waits for resolved objects to be released", async () => {
-    const controller = new AbortController();
-    const resolutions = new Map<string, () => void>();
-    const releases = new Map<string, () => void>();
-    const fixture = siblingCaptureFixture(async (method, params) => {
-      if (method === "DOM.resolveNode")
-        await new Promise<void>((resolve) =>
-          resolutions.set(String(params.backendNodeId), resolve),
-        );
-      if (method === "Runtime.releaseObject")
-        await new Promise<void>((resolve) => releases.set(String(params.objectId), resolve));
-    });
-    let settled = false;
-    const capture = captureViewModel(fixture.cdp, 4, { signal: controller.signal });
-    const rejected = expect(capture).rejects.toMatchObject({ name: "AbortError" });
-    void capture.then(
-      () => {
-        settled = true;
-      },
-      () => {
-        settled = true;
-      },
-    );
-    await vi.waitFor(() => expect(resolutions.size).toBe(4));
-    controller.abort();
-    for (const resolve of resolutions.values()) resolve();
-    await vi.waitFor(() => expect(releases.size).toBe(4));
-    expect(settled).toBe(false);
-    expect(fixture.measured()).toEqual([100, 101, 102, 103]);
-    for (const release of releases.values()) release();
-    await rejected;
-    expect(fixture.active()).toBe(0);
-    expect(fixture.send.mock.calls.some(([, method]) => method === "Runtime.callFunctionOn")).toBe(
-      false,
-    );
-  });
-});
@@ -1,127 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-import { OVERLAY_HOST_MARKER_ATTR } from "@/lib/overlay-bridge";
-import { createCaptureCheckpoint } from "../capture-abort";
-import { buildDocumentIndex, type DecodedNode } from "../facts";
-import { decodeDocument, REQUESTED_STYLES } from "../snapshot";
-
-function node(id: number, parent: number | null): DecodedNode {
-  return {
-    backendNodeId: id,
-    parentBackendNodeId: parent,
-    tag: "div",
-    attrs: {},
-    paintOrder: 0,
-    position: "static",
-    pointerEvents: "auto",
-  };
-}
-
-describe("document facts", () => {
-  it.each([
-    1_000, 10_000, 100_000,
-  ])("indexes deep and wide inputs of %i without copying ancestors", async (count) => {
-    for (const wide of [false, true]) {
-      let reads = 0;
-      const input = Array.from({ length: count }, (_, i) => {
-        const item = node(i, i ? (wide ? 0 : i - 1) : null);
-        if (i === 0) item.attrs[OVERLAY_HOST_MARKER_ATTR] = "";
-        Object.defineProperty(item, "parentBackendNodeId", {
-          get: () => {
-            reads++;
-            return i ? (wide ? 0 : i - 1) : null;
-          },
-        });
-        return item;
-      }).reverse(); // parent need not precede child
-      const index = await buildDocumentIndex(input);
-      expect(index.nodes.size).toBe(count);
-      expect(index.excludedBackendNodeIds.size).toBe(count);
-      expect(reads).toBeLessThanOrEqual(count * 8);
-      expect(index.nodes.get(count - 1)).toBe(input[0]);
-    }
-  });
-
-  it("handles cycles and orphans and propagates overlay through shadow roots", async () => {
-    const host = { ...node(1, null), attrs: { [OVERLAY_HOST_MARKER_ATTR]: "" } };
-    const input = [
-      node(3, 2),
-      { ...node(2, 1), tag: "#document-fragment" },
-      host,
-      node(4, 99),
-      node(5, 6),
-      node(6, 5),
-      node(7, 6),
-    ];
-    const index = await buildDocumentIndex(input);
-    expect([...index.excludedBackendNodeIds].sort()).toEqual([1, 2, 3]);
-    expect(index.nodes.size).toBe(input.length);
-  });
-
-  it("does not propagate a descendant overlay backwards into a cycle", async () => {
-    const overlay = { ...node(3, 1), attrs: { [OVERLAY_HOST_MARKER_ATTR]: "" } };
-    const index = await buildDocumentIndex([overlay, node(1, 2), node(2, 1)]);
-    expect([...index.excludedBackendNodeIds]).toEqual([3]);
-  });
-
-  it("decodes current observation bounds, styles and attributes without projecting coordinates", async () => {
-    const strings = ["div", "aria-hidden", "true", "inert", "", "visible", "0", "static", "auto"];
-    const styles = REQUESTED_STYLES.map((style) =>
-      style === "visibility" ? 5 : style === "opacity" ? 6 : style === "position" ? 7 : 8,
-    );
-    const { nodes } = await decodeDocument(
-      {
-        nodes: { backendNodeId: [1], parentIndex: [-1], nodeName: [0], attributes: [[1, 2, 3, 4]] },
-        layout: { nodeIndex: [0], bounds: [[10, 20, 120, 40]], styles: [styles] },
-      },
-      strings,
-    );
-    expect(nodes[0].attrs).toEqual({ "aria-hidden": "true", inert: "" });
-    expect(nodes[0].layout).toEqual({
-      boundsSpace: "snapshot-document-layout",
-      bounds: [10, 20, 120, 40],
-      styles: {
-        position: "static",
-        "pointer-events": "auto",
-        cursor: "auto",
-        visibility: "visible",
-        opacity: "0",
-      },
-    });
-    expect(nodes[0]).not.toHaveProperty("rect");
-    expect(nodes[0]).not.toHaveProperty("excluded");
-  });
-
-  it("keeps short blocks synchronous and checks cancellation after yielding", async () => {
-    const clock = vi.spyOn(performance, "now").mockReturnValue(0);
-    try {
-      const controller = new AbortController();
-      const checkpoint = createCaptureCheckpoint(controller.signal);
-      for (let i = 0; i < 20; i++) expect(checkpoint()).toBeUndefined();
-      clock.mockReturnValue(9);
-      const pending = checkpoint();
-      expect(pending).toBeInstanceOf(Promise);
-      controller.abort();
-      await expect(pending).rejects.toMatchObject({ name: "AbortError" });
-    } finally {
-      clock.mockRestore();
-    }
-  });
-
-  it("checks cancellation at bounded indexing blocks", async () => {
-    const controller = new AbortController();
-    const input = Array.from({ length: 100_000 }, (_, i) => node(i, i ? i - 1 : null));
-    let reads = 0;
-    for (const item of input)
-      Object.defineProperty(item, "attrs", {
-        get: () => {
-          reads++;
-          if (reads === 100) controller.abort();
-          return {};
-        },
-      });
-    await expect(buildDocumentIndex(input, controller.signal)).rejects.toMatchObject({
-      name: "AbortError",
-    });
-    expect(reads).toBeLessThanOrEqual(356);
-  });
-});
@@ -1,298 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-import { type CdpRunner, cdpRunnerForTarget } from "../../shared";
-import { enrichFormControlStates } from "../form-capture";
-import { decodeDocument } from "../snapshot";
-
-interface Control {
-  id: number;
-  value: string;
-  type?: string;
-}
-
-function snapshot(groups: Control[][]) {
-  const strings: string[] = [];
-  const str = (value: string) => {
-    let index = strings.indexOf(value);
-    if (index < 0) index = strings.push(value) - 1;
-    return index;
-  };
-  const documents = groups.map((controls, groupIndex) => ({
-    frameId: `frame-${groupIndex}`,
-    nodes: {
-      parentIndex: [-1, 0, ...controls.map(() => 1)],
-      nodeName: [str("html"), str("body"), ...controls.map(() => str("input"))],
-      backendNodeId: [8000 + groupIndex * 2, 8001 + groupIndex * 2, ...controls.map((c) => c.id)],
-      attributes: [
-        [],
-        [],
-        ...controls.map((c) => [
-          str("type"),
-          str(c.type ?? "text"),
-          str("placeholder"),
-          str("snapshot placeholder"),
-        ]),
-      ],
-      inputValue: {
-        index: controls.map((_, i) => i + 2),
-        value: controls.map((c) => str(c.value)),
-      },
-      contentDocumentIndex: { index: [] as number[], value: [] as number[] },
-    },
-  }));
-  const root = documents[0].nodes;
-  for (let i = 1; i < documents.length; i++) {
-    root.contentDocumentIndex.index.push(root.backendNodeId.length);
-    root.contentDocumentIndex.value.push(i);
-    root.parentIndex.push(1);
-    root.nodeName.push(str("iframe"));
-    root.backendNodeId.push(9000 + i);
-    root.attributes.push([]);
-  }
-  return { strings, documents };
-}
-
-function state(value: string) {
-  return {
-    value,
-    defaultValue: "",
-    placeholder: "live placeholder",
-    state: value ? "filled" : "empty",
-    sensitive: false,
-  };
-}
-
-function reply(entries: Array<[number, unknown]>) {
-  return {
-    result: {
-      deepSerializedValue: {
-        type: "array",
-        value: entries.map(([backendNodeId, fields]) => ({
-          type: "array",
-          value: [
-            { type: "node", value: { backendNodeId } },
-            { type: "string", value: JSON.stringify(fields) },
-          ],
-        })),
-      },
-    },
-  };
-}
-
-async function fakeCdp(
-  groups: Control[][],
-  evaluate: (params: Record<string, unknown>) => unknown,
-) {
-  const snap = snapshot(groups);
-  const send = vi.fn(async (_tabId: number, method: string, params?: object) => {
-    if (method === "Runtime.evaluate") return evaluate(params as Record<string, unknown>);
-    return {};
-  });
-  const nodes = await decodeControls(snap);
-  return { send, cdp: { send: send as CdpRunner["send"] }, nodes };
-}
-
-async function decodeControls(snap: ReturnType<typeof snapshot>) {
-  return Promise.all(
-    snap.documents.map(async (doc) =>
-      (await decodeDocument(doc, snap.strings)).nodes.map((node) => ({ ...node, rect: null })),
-    ),
-  );
-}
-
-describe("form state identity", () => {
-  it("matches reordered controls by identity and preserves controls missing from the batch", async () => {
-    // The snapshot includes a shadow input. The runtime query skips it,
-    // encounters a new input, and sees the remaining inputs in a new order.
-    const { cdp, nodes } = await fakeCdp(
-      [
-        [
-          { id: 10, value: "" },
-          { id: 11, value: "old email" },
-          { id: 12, value: "old city" },
-        ],
-      ],
-      () =>
-        reply([
-          [99, state("new control")],
-          [12, state("上海")],
-          [11, state("alice@example.com")],
-        ]),
-    );
-    await enrichFormControlStates(cdp, 7, nodes);
-    expect(nodes[0].find((n) => n.backendNodeId === 10)).toMatchObject({
-      formValue: "",
-      formState: "empty",
-      formPlaceholder: "snapshot placeholder",
-    });
-    expect(nodes[0].find((n) => n.backendNodeId === 11)).toMatchObject({
-      formValue: "alice@example.com",
-    });
-    expect(nodes[0].find((n) => n.backendNodeId === 12)).toMatchObject({ formValue: "上海" });
-    expect(nodes[0].some((n) => n.backendNodeId === 99)).toBe(false);
-  });
-
-  it("does not shift state between frames when one frame is absent from the runtime batch", async () => {
-    const { cdp, nodes } = await fakeCdp(
-      [
-        [],
-        [{ id: 11, value: "inaccessible frame" }],
-        [{ id: 21, value: "old second" }],
-        [{ id: 31, value: "old third" }],
-      ],
-      () =>
-        reply([
-          [31, state("third frame")],
-          [21, state("second frame")],
-        ]),
-    );
-    await enrichFormControlStates(cdp, 7, nodes);
-    const controls = nodes.slice(1).flat();
-    expect(controls.find((n) => n.backendNodeId === 11)?.formValue).toBe("inaccessible frame");
-    expect(controls.find((n) => n.backendNodeId === 21)?.formValue).toBe("second frame");
-    expect(controls.find((n) => n.backendNodeId === 31)?.formValue).toBe("third frame");
-  });
-
-  it("keeps identical backend ids in different OOPIF targets separate", async () => {
-    const sendToTarget = vi.fn(async (target, method) => {
-      if (method === "Runtime.evaluate") return reply([[11, state(target.sessionId)]]);
-      return {};
-    });
-    const send = vi.fn(async () => {
-      throw new Error("unexpected top-level target");
-    });
-    const cdp = { send, sendToTarget } as unknown as CdpRunner;
-    for (const sessionId of ["left-frame", "right-frame"]) {
-      const nodes = await decodeControls(snapshot([[{ id: 11, value: "old" }]]));
-      await enrichFormControlStates(cdpRunnerForTarget(cdp, { tabId: 7, sessionId }), 7, nodes);
-      expect(nodes[0].find((n) => n.backendNodeId === 11)?.formValue).toBe(sessionId);
-      expect(sendToTarget).toHaveBeenCalledWith(
-        { tabId: 7, sessionId },
-        "Runtime.releaseObjectGroup",
-        expect.anything(),
-      );
-    }
-    expect(send).not.toHaveBeenCalled();
-  });
-
-  it.each([
-    "unsupported",
-    "legacy",
-    "malformed",
-    "invalid-state",
-  ])("preserves snapshot data when enrichment is %s", async (mode) => {
-    const { cdp, send, nodes } = await fakeCdp([[{ id: 11, value: "snapshot value" }]], () => {
-      if (mode === "unsupported") throw new Error("serialization unsupported");
-      if (mode === "legacy") return { result: { value: { controls: [state("wrong value")] } } };
-      const result = reply([
-        [11, mode === "invalid-state" ? { value: "wrong value" } : state("wrong value")],
-      ]);
-      if (mode === "malformed")
-        result.result.deepSerializedValue.value[0].value[1].value = "not json";
-      return result;
-    });
-    expect(await enrichFormControlStates(cdp, 7, nodes)).toBe(mode !== "unsupported");
-    expect(nodes[0].find((n) => n.backendNodeId === 11)).toMatchObject({
-      formValue: "snapshot value",
-      formPlaceholder: "snapshot placeholder",
-    });
-    expect(send).toHaveBeenCalledWith(7, "Runtime.releaseObjectGroup", expect.anything());
-  });
-
-  it("releases the batch's remote objects when capture is cancelled", async () => {
-    const controller = new AbortController();
-    const { cdp, send, nodes } = await fakeCdp([[{ id: 11, value: "old" }]], () => {
-      controller.abort();
-      return reply([[11, state("new")]]);
-    });
-    await expect(enrichFormControlStates(cdp, 7, nodes, controller.signal)).rejects.toMatchObject({
-      name: "AbortError",
-    });
-    expect(send).toHaveBeenCalledWith(7, "Runtime.releaseObjectGroup", expect.anything());
-  });
-
-  it("does not report success when cancelled during object cleanup", async () => {
-    const controller = new AbortController();
-    const nodes = await decodeControls(snapshot([[{ id: 11, value: "old" }]]));
-    const cdp: CdpRunner = {
-      send: vi.fn(async (_tabId, method) => {
-        if (method === "Runtime.evaluate") return reply([[11, state("new")]]);
-        if (method === "Runtime.releaseObjectGroup") controller.abort();
-        return {};
-      }) as CdpRunner["send"],
-    };
-    await expect(enrichFormControlStates(cdp, 7, nodes, controller.signal)).rejects.toMatchObject({
-      name: "AbortError",
-    });
-    expect(cdp.send).toHaveBeenCalledWith(7, "Runtime.releaseObjectGroup", expect.anything());
-  });
-
-  it("skips entries without node identity while still applying valid entries", async () => {
-    const { cdp, nodes } = await fakeCdp(
-      [
-        [
-          { id: 11, value: "snapshot value" },
-          { id: 12, value: "old value" },
-        ],
-      ],
-      () => {
-        const result = reply([
-          [11, state("wrong value")],
-          [12, state("live value")],
-        ]);
-        const element = result.result.deepSerializedValue.value[0].value[0];
-        delete (element.value as { backendNodeId?: number }).backendNodeId;
-        return result;
-      },
-    );
-    await enrichFormControlStates(cdp, 7, nodes);
-    expect(nodes[0].find((n) => n.backendNodeId === 11)?.formValue).toBe("snapshot value");
-    expect(nodes[0].find((n) => n.backendNodeId === 12)?.formValue).toBe("live value");
-  });
-
-  it.each([
-    "password",
-    "text",
-  ])("redacts a sensitive %s control after identity matching", async (type) => {
-    const { cdp, nodes } = await fakeCdp([[{ id: 11, value: "secret", type }]], () =>
-      reply([[11, { ...state("secret"), sensitive: true }]]),
-    );
-    await enrichFormControlStates(cdp, 7, nodes);
-    const control = nodes[0].find((n) => n.backendNodeId === 11);
-    expect(control?.formState).toBe("filled");
-    expect(control?.formValue).toBeUndefined();
-    expect(control?.formDefaultValue).toBeUndefined();
-    expect(control?.attrs.value).toBeUndefined();
-  });
-
-  it("keeps one bounded batch without per-control CDP queries", async () => {
-    const controls = Array.from({ length: 251 }, (_, i) => ({ id: i + 1, value: "old" }));
-    const elements = controls.map((c) => ({
-      backendNodeId: c.id,
-      tagName: "INPUT",
-      type: "text",
-      value: `live ${c.id}`,
-      defaultValue: "",
-      placeholder: "",
-    }));
-    const { cdp, send, nodes } = await fakeCdp([controls], (params) => {
-      const doc = {
-        querySelectorAll: (selector: string) =>
-          selector === "input,textarea,select" ? elements : [],
-      };
-      const entries = new Function("document", `return ${params.expression}`)(doc) as Array<
-        [{ backendNodeId: number }, string]
-      >;
-      expect(entries).toHaveLength(250);
-      return reply(entries.map(([element, json]) => [element.backendNodeId, JSON.parse(json)]));
-    });
-    await enrichFormControlStates(cdp, 7, nodes);
-    expect(nodes[0].find((n) => n.backendNodeId === 250)?.formValue).toBe("live 250");
-    expect(nodes[0].find((n) => n.backendNodeId === 251)?.formValue).toBe("old");
-    expect(send.mock.calls.filter(([, method]) => method === "Runtime.evaluate")).toHaveLength(1);
-    expect(
-      send.mock.calls.filter(([, method]) => method === "Runtime.releaseObjectGroup"),
-    ).toHaveLength(1);
-    expect(send).not.toHaveBeenCalledWith(7, "DOM.resolveNode", expect.anything());
-    expect(send).not.toHaveBeenCalledWith(7, "Runtime.callFunctionOn", expect.anything());
-  });
-});
@@ -1,5 +1,4 @@
 import { describe, expect, it, vi } from "vitest";
-import { OVERLAY_HOST_MARKER_ATTR } from "@/lib/overlay-bridge";
 import type { CdpRunner } from "../../shared";
 import type { CapturedNode, CapturedViewModel } from "../capture";
 import { captureFrameData } from "../frame-capture";
@@ -26,14 +25,12 @@ function childSnapshot(frameId: string, backendNodeId: number) {
    strings,
    documents: [
      {
-        scrollOffsetX: 0,
-        scrollOffsetY: 0,
        frameId,
        nodes: {
          parentIndex: [-1, 0],
          nodeName: [1, 2],
          backendNodeId: [backendNodeId - 1, backendNodeId],
-          attributes: [[], []] as number[][],
+          attributes: [[], []],
        },
        layout: {
          nodeIndex: [0, 1],
@@ -53,72 +50,6 @@ function childSnapshot(frameId: string, backendNodeId: number) {
 }

 describe("captureFrameData", () => {
-  it("retains nested owner failures when merging a captured OOPIF", async () => {
-    const owner = ownerNode(10, 50);
-    const captured: CapturedViewModel = {
-      nodes: [owner],
-      viewport: { width: 1000, height: 800 },
-      iframeNodes: new Map(),
-      frameNodes: new Map([["main", [owner]]]),
-      rootFrameId: "main",
-      excludedBackendNodeIds: new Set(),
-    };
-    const child = childSnapshot("child", 101);
-    const nested = childSnapshot("nested", 201);
-    const document = child.documents[0];
-    const snapshot = {
-      strings: child.strings,
-      documents: [
-        {
-          ...document,
-          nodes: { ...document.nodes, contentDocumentIndex: { index: [1], value: [1] } },
-        },
-        nested.documents[0],
-      ],
-    };
-    const reply = async (_target: unknown, method: string) => {
-      if (method === "Page.getLayoutMetrics")
-        return {
-          visualViewport: { clientWidth: 1000 },
-          cssVisualViewport: { clientWidth: 1000 },
-          cssLayoutViewport: { clientWidth: 300, clientHeight: 200 },
-        };
-      if (method === "DOMSnapshot.captureSnapshot") return snapshot;
-      if (method === "DOM.getBoxModel")
-        return { model: { content: [50, 100, 350, 100, 350, 300, 50, 300] } };
-      if (method === "DOM.resolveNode") throw new Error("nested owner replaced");
-      return {};
-    };
-    const cdp: CdpRunner = {
-      send: vi.fn(reply) as CdpRunner["send"],
-      sendToTarget: vi.fn(reply) as NonNullable<CdpRunner["sendToTarget"]>,
-      getFrameGraph: vi.fn(async () => ({
-        rootFrameId: "main",
-        frames: [
-          { frameId: "main", target: { tabId: 4 } },
-          {
-            frameId: "child",
-            parentFrameId: "main",
-            ownerBackendNodeId: 10,
-            target: { tabId: 4, sessionId: "child-session" },
-          },
-        ],
-      })),
-    };
-    await captureFrameData(cdp, 4, captured);
-    expect(captured.frameGeometryIssues).toEqual([
-      {
-        status: "unavailable",
-        source: { target: { tabId: 4, sessionId: "child-session" }, frameId: "nested" },
-        ownerBackendNodeId: 101,
-      },
-    ]);
-    expect(captured.frameNodes?.get("nested")?.[1]).toMatchObject({
-      rect: null,
-      localRect: { x: 10, y: 20, w: 100, h: 40 },
-    });
-  });
-
  it("captures and positions multiple OOPIF documents missing from the root snapshot", async () => {
    const leftOwner = ownerNode(10, 50);
    const rightOwner = ownerNode(20, 500);
@@ -133,23 +64,13 @@ describe("captureFrameData", () => {
    };
    const sendToTarget = vi.fn(async (target, method) => {
      if (method === "Page.getLayoutMetrics") {
-        return {
-          visualViewport: { clientWidth: 1000 },
-          cssVisualViewport: { clientWidth: 1000 },
-          cssLayoutViewport: { clientWidth: 300, clientHeight: 200, pageX: 0, pageY: 0 },
-        };
+        return { cssLayoutViewport: { clientWidth: 300, clientHeight: 200, pageX: 0, pageY: 0 } };
      }
      if (method === "DOMSnapshot.enable" || method === "Accessibility.enable") return {};
      if (method === "DOMSnapshot.captureSnapshot") {
-        if (target.sessionId !== "left-session") return childSnapshot("right", 201);
-        const snapshot = childSnapshot("left", 101);
-        const marker = snapshot.strings.push(OVERLAY_HOST_MARKER_ATTR) - 1;
-        const nodes = snapshot.documents[0].nodes;
-        nodes.backendNodeId.push(201); // Same id as a real button in the other target.
-        nodes.parentIndex.push(0);
-        nodes.nodeName.push(2);
-        nodes.attributes.push([marker, -1]);
-        return snapshot;
+        return target.sessionId === "left-session"
+          ? childSnapshot("left", 101)
+          : childSnapshot("right", 201);
      }
      if (method === "Accessibility.getFullAXTree") return { nodes: [] };
      throw new Error(`unexpected ${method}`);
@@ -164,11 +85,7 @@ describe("captureFrameData", () => {
          return { model: { content: [x, 100, x + 300, 100, x + 300, 300, x, 300] } };
        }
        if (method === "Page.getLayoutMetrics") {
-          return {
-            visualViewport: { clientWidth: 1000 },
-            cssVisualViewport: { clientWidth: 1000 },
-            cssLayoutViewport: { clientWidth: 1000, clientHeight: 800 },
-          };
+          return { cssLayoutViewport: { clientWidth: 1000, clientHeight: 800 } };
        }
        throw new Error(`unexpected root ${method}`);
      }) as CdpRunner["send"],
@@ -195,10 +112,6 @@ describe("captureFrameData", () => {

    const trees = await captureFrameData(cdp, 4, captured);

-    expect(trees.find((tree) => tree.frameId === "left")?.excludedBackendNodeIds).toEqual(
-      new Set([201]),
-    );
-    expect(trees.find((tree) => tree.frameId === "right")?.excludedBackendNodeIds?.size).toBe(0);
    expect(trees.map((tree) => tree.frameId)).toEqual(["main", "left", "right"]);
    expect(
      captured.frameNodes?.get("left")?.find((node) => node.backendNodeId === 101)?.rect,
@@ -236,11 +149,7 @@ describe("captureFrameData", () => {
        if (method === "Accessibility.getFullAXTree") return { nodes: [] };
        if (method === "DOM.getBoxModel") throw new Error("owner geometry unavailable");
        if (method === "Page.getLayoutMetrics") {
-          return {
-            visualViewport: { clientWidth: 1000 },
-            cssVisualViewport: { clientWidth: 1000 },
-            cssLayoutViewport: { clientWidth: 1000, clientHeight: 800 },
-          };
+          return { cssLayoutViewport: { clientWidth: 1000, clientHeight: 800 } };
        }
        throw new Error(`unexpected root ${method}`);
      }) as CdpRunner["send"],
@@ -283,7 +192,7 @@ describe("captureFrameData", () => {
      expect.objectContaining({ backendDOMNodeId: 101, frameId: "child" }),
    ]);
    expect(childDocument?.domNodes.find((node) => node.backendNodeId === 101)).toEqual(
-      expect.objectContaining({ rect: null, localRect: null, rendered: true }),
+      expect.objectContaining({ rect: null, localRect: { x: 10, y: 20, w: 100, h: 40 } }),
    );
  });
 });
@@ -29,7 +29,7 @@ function captured(frameNodes: Map<string, CapturedNode[]>): CapturedViewModel {
 }

 describe("buildFrameDocuments", () => {
-  it("partitions mixed AX results by node ownership and cuts cross-frame parent edges", async () => {
+  it("partitions mixed AX results by node ownership and cuts cross-frame parent edges", () => {
    const graph: CdpFrameGraph = {
      rootFrameId: "main",
      frames: [
@@ -54,7 +54,7 @@ describe("buildFrameDocuments", () => {
      },
    ];

-    const documents = await buildFrameDocuments(
+    const documents = buildFrameDocuments(
      graph,
      batches,
      captured(
@@ -72,7 +72,7 @@ describe("buildFrameDocuments", () => {
    expect(childNodes.find((node) => node.nodeId === "virtual")?.frameId).toBe("child");
  });

-  it("deduplicates overlapping same-target AX results using the strongest ownership", async () => {
+  it("deduplicates overlapping same-target AX results using the strongest ownership", () => {
    const graph: CdpFrameGraph = {
      rootFrameId: "main",
      frames: [
@@ -92,7 +92,7 @@ describe("buildFrameDocuments", () => {
      },
    ];

-    const documents = await buildFrameDocuments(
+    const documents = buildFrameDocuments(
      graph,
      batches,
      captured(
@@ -107,7 +107,7 @@ describe("buildFrameDocuments", () => {
    expect(documents.find((document) => document.frameId === "child")?.axNodes).toHaveLength(1);
  });

-  it("uses target-scoped backend ownership when OOPIF backend ids collide", async () => {
+  it("uses target-scoped backend ownership when OOPIF backend ids collide", () => {
    const graph: CdpFrameGraph = {
      rootFrameId: "main",
      frames: [
@@ -129,7 +129,7 @@ describe("buildFrameDocuments", () => {
      nodes: [{ nodeId: `${frame.frameId}-node`, backendDOMNodeId: 7 }],
    }));

-    const documents = await buildFrameDocuments(
+    const documents = buildFrameDocuments(
      graph,
      batches,
      captured(
@@ -149,7 +149,7 @@ describe("buildFrameDocuments", () => {
    );
  });

-  it("uses captured frame parent identity instead of guessing from backend ids", async () => {
+  it("uses captured frame parent identity instead of guessing from backend ids", () => {
    const frameNodes = new Map([
      ["main", [domNode("main", 1)]],
      ["left", [domNode("left", 7)]],
@@ -164,25 +164,11 @@ describe("buildFrameDocuments", () => {
      nodes: [],
    }));

-    const documents = await buildFrameDocuments(null, frames, capture);
+    const documents = buildFrameDocuments(null, frames, capture);

    expect(documents.find((document) => document.frameId === "child")).toMatchObject({
      parentFrameId: "left",
      ownerBackendNodeId: 7,
    });
  });
-  it("resolves a reverse-ordered deep AX parent chain without recursion", async () => {
-    const frame = { frameId: "main", target: { tabId: 4 } };
-    const nodes: FrameOwnedAxNode[] = Array.from({ length: 10000 }, (_, i) => ({
-      nodeId: String(i),
-      ...(i ? { parentId: String(i - 1) } : { frameId: "main" }),
-    })).reverse();
-    const documents = await buildFrameDocuments(
-      { rootFrameId: "main", frames: [frame] },
-      [{ frame, nodes }],
-      captured(new Map()),
-    );
-    expect(documents[0].axNodes).toHaveLength(10000);
-    expect(documents[0].axNodes[0].frameId).toBe("main");
-  });
 });
@@ -1,84 +0,0 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { ProbeBudget, resetOverlayBypassDepth, withOverlayBypass } from "../hover-perception";
-
-afterEach(() => {
-  resetOverlayBypassDepth();
-});
-
-describe("ProbeBudget", () => {
-  it("refuses a candidate that cannot finish inside the budget", () => {
-    const budget = new ProbeBudget(500);
-
-    expect(budget.canAfford(400)).toBe(true);
-    expect(budget.canAfford(600)).toBe(false);
-  });
-
-  it("stops admitting candidates once the remaining budget is smaller than one", async () => {
-    const budget = new ProbeBudget(60);
-    await new Promise((resolve) => setTimeout(resolve, 40));
-
-    // A top-of-loop `elapsed > total` check would still admit this candidate
-    // and then overshoot by its full cost.
-    expect(budget.canAfford(50)).toBe(false);
-  });
-});
-
-describe("withOverlayBypass", () => {
-  it("toggles the overlay once around nested probe phases", async () => {
-    const bypass = vi.fn(async () => {});
-
-    await withOverlayBypass(bypass, 4, async () => {
-      await withOverlayBypass(bypass, 4, async () => {
-        expect(bypass).toHaveBeenCalledTimes(1);
-      });
-      expect(bypass).toHaveBeenCalledTimes(1);
-    });
-
-    expect(bypass.mock.calls).toEqual([
-      [4, true],
-      [4, false],
-    ]);
-  });
-
-  it("restores the overlay when the probe throws", async () => {
-    const bypass = vi.fn(async () => {});
-
-    await expect(
-      withOverlayBypass(bypass, 4, async () => {
-        throw new Error("probe exploded");
-      }),
-    ).rejects.toThrow("probe exploded");
-
-    expect(bypass).toHaveBeenLastCalledWith(4, false);
-  });
-
-  it("reports a failed restore instead of swallowing it", async () => {
-    const onRestoreFailure = vi.fn();
-    const bypass = vi.fn(async (_tabId: number, enabled: boolean) => {
-      if (!enabled) throw new Error("tab is gone");
-    });
-
-    await withOverlayBypass(bypass, 4, async () => undefined, { onRestoreFailure });
-
-    expect(onRestoreFailure).toHaveBeenCalledTimes(1);
-  });
-
-  it("does not pin the overlay off for the tab when a restore fails", async () => {
-    const failing = vi.fn(async (_tabId: number, enabled: boolean) => {
-      if (!enabled) throw new Error("tab is gone");
-    });
-    await withOverlayBypass(failing, 4, async () => undefined, { onRestoreFailure: () => {} });
-
-    const bypass = vi.fn(async () => {});
-    await withOverlayBypass(bypass, 4, async () => undefined);
-
-    expect(bypass.mock.calls).toEqual([
-      [4, true],
-      [4, false],
-    ]);
-  });
-
-  it("runs the probe untouched when no bypass is wired up", async () => {
-    await expect(withOverlayBypass(undefined, 4, async () => "done")).resolves.toBe("done");
-  });
-});
@@ -132,37 +132,6 @@ describe("tooltip name enrichment", () => {
    expect(cdp.sendToTarget).not.toHaveBeenCalled();
  });

-  it("remembers controls that revealed no tooltip so the miss is paid once", async () => {
-    const cdp: CdpRunner = {
-      send: vi.fn(async () => ({})) as CdpRunner["send"],
-      sendToTarget: vi.fn(async (_target, method) => {
-        if (method === "Page.createIsolatedWorld") return { executionContextId: 31 };
-        if (method === "DOM.resolveNode") return { object: { objectId: "button-801" } };
-        if (method === "Runtime.callFunctionOn") return { result: { value: [] } };
-        return {};
-      }) as CdpRunner["sendToTarget"],
-    };
-
-    const documents = [
-      document({ tabId: 11, sessionId: "miss-session" }, 801, undefined, "miss-frame"),
-    ];
-    const graph = semantics(documents);
-
-    const first = await probeTooltipNames(cdp, 11, documents, graph);
-    expect(first.size).toBe(0);
-    const hoversAfterFirst = vi
-      .mocked(cdp.send)
-      .mock.calls.filter(([, method]) => method === "Input.dispatchMouseEvent").length;
-    expect(hoversAfterFirst).toBeGreaterThan(0);
-
-    const second = await probeTooltipNames(cdp, 11, documents, graph);
-    expect(second.size).toBe(0);
-    expect(
-      vi.mocked(cdp.send).mock.calls.filter(([, method]) => method === "Input.dispatchMouseEvent")
-        .length,
-    ).toBe(hoversAfterFirst);
-  });
-
  it("keeps tooltip evidence isolated across sibling frame sessions", async () => {
    let hoveredX = -10;
    const cdp: CdpRunner = {
@@ -1,40 +0,0 @@
-function captureAbortError(): Error {
-  const error = new Error("observation aborted");
-  error.name = "AbortError";
-  return error;
-}
-
-export function isAbortError(error: unknown): boolean {
-  return (
-    typeof error === "object" &&
-    error !== null &&
-    (error as { name?: string }).name === "AbortError"
-  );
-}
-
-export function throwIfAborted(signal: AbortSignal | undefined): void {
-  if (signal?.aborted) throw captureAbortError();
-}
-
-/** Check at bounded work blocks; yield only after a processing slice is spent.
- * Each caller owns its deadline, so unrelated captures do not share state. */
-export function createCaptureCheckpoint(signal?: AbortSignal): () => Promise<void> | undefined {
-  throwIfAborted(signal);
-  let deadline = performance.now() + 8;
-  return () => {
-    throwIfAborted(signal);
-    if (performance.now() < deadline) return;
-    return new Promise<void>((resolve) => {
-      const channel = new MessageChannel();
-      channel.port1.onmessage = () => {
-        channel.port1.close();
-        channel.port2.close();
-        resolve();
-      };
-      channel.port2.postMessage(null);
-    }).then(() => {
-      throwIfAborted(signal);
-      deadline = performance.now() + 8;
-    });
-  };
-}
@@ -1,37 +0,0 @@
-import type { Rect } from "@browser-skill/vom";
-
-export interface CapturedNode {
-  backendNodeId: number;
-  parentBackendNodeId: number | null;
-  frameId?: string;
-  /** Owning iframe backend node id; `null` for the top-level document. */
-  ownerFrameBackendNodeId?: number | null;
-  tag: string;
-  attrs: Record<string, string>;
-  /** Top-level viewport-relative CSS px, clipped to the owning frame viewport. */
-  rect: Rect | null;
-  /** Frame-local viewport-relative CSS px before top-level projection. */
-  localRect?: Rect | null;
-  paintOrder: number;
-  position: string;
-  pointerEvents: string;
-  /**
-   * computed `cursor`. `cursor: pointer` is the strongest CDP-free signal
-   * that a non-semantic element (a `<div>`/`<span>` with a click handler)
-   * is actually an interactive control — used by the adapter to surface
-   * custom buttons/checkboxes the AX tree drops as `generic`. Optional like
-   * `textContent`: the live parser always sets it, hand-built fixtures may not.
-   */
-  cursor?: string;
-  /**
-   * Whether the live DOM snapshot provides a painted, non-hidden box for this
-   * node. Semantic resolution uses this only for DOM fallback nodes; AX-backed
-   * nodes remain authoritative even when they are outside the viewport.
-   */
-  rendered?: boolean;
-  textContent?: string;
-  formState?: "empty" | "filled" | "default";
-  formValue?: string;
-  formDefaultValue?: string;
-  formPlaceholder?: string;
-}
@@ -1,94 +0,0 @@
-import { isOverlayHostNode } from "@/lib/overlay-bridge";
-import { createCaptureCheckpoint } from "./capture-abort";
-import type { CapturedNode } from "./capture-types";
-
-/** Bounds retain their raw snapshot document layout units until normalization. */
-export interface SnapshotLayout {
-  readonly boundsSpace: "snapshot-document-layout";
-  bounds?: number[];
-  styles: Readonly<Record<string, string>>;
-}
-
-export interface DecodedNode extends Omit<CapturedNode, "rect" | "localRect" | "rendered"> {
-  nodeType?: number;
-  layout?: SnapshotLayout;
-}
-
-export interface NodeFacts extends CapturedNode {
-  nodeType?: number;
-  layout?: SnapshotLayout;
-}
-
-export interface DocumentIndex<T extends DecodedNode = NodeFacts> {
-  readonly nodes: ReadonlyMap<number, T>;
-  readonly excludedBackendNodeIds: ReadonlySet<number>;
-}
-
-export interface DecodedDocument {
-  nodes: DecodedNode[];
-}
-
-/** All snapshot nodes participate, including document and shadow roots. This
- * preserves overlay propagation when the semantic adapter omits those nodes. */
-export async function buildDocumentIndex<T extends DecodedNode>(
-  input: readonly T[],
-  signal?: AbortSignal,
-): Promise<DocumentIndex<T>> {
-  const checkpoint = createCaptureCheckpoint(signal);
-  const nodes = new Map<number, T>();
-  const overlayByNode = new Map<number, boolean>();
-  const excludedBackendNodeIds = new Set<number>();
-  for (let i = 0; i < input.length; i++) {
-    if (i % 256 === 0) {
-      const pending = checkpoint();
-      if (pending) await pending;
-    }
-    const node = input[i];
-    nodes.set(node.backendNodeId, node);
-  }
-  let work = 0;
-  for (const node of input) {
-    if (work++ % 256 === 0) {
-      const pending = checkpoint();
-      if (pending) await pending;
-    }
-    if (overlayByNode.has(node.backendNodeId)) continue;
-    const path: DecodedNode[] = [];
-    const visiting = new Set<number>();
-    let current: DecodedNode | undefined = node;
-    let overlay = false;
-    while (current && !overlayByNode.has(current.backendNodeId)) {
-      if (work++ % 256 === 0) {
-        const pending = checkpoint();
-        if (pending) await pending;
-      }
-      if (visiting.has(current.backendNodeId)) {
-        // Only an overlay inside the cycle may mark the cycle and its descendants.
-        overlay = path
-          .slice(path.findIndex((item) => item.backendNodeId === current!.backendNodeId))
-          .some((item) => isOverlayHostNode(item.tag, Object.keys(item.attrs)));
-        break;
-      }
-      visiting.add(current.backendNodeId);
-      path.push(current);
-      if (current.parentBackendNodeId === null) {
-        current = undefined;
-        break;
-      }
-      current = nodes.get(current.parentBackendNodeId);
-    }
-    if (current && overlayByNode.has(current.backendNodeId))
-      overlay = overlayByNode.get(current.backendNodeId)!;
-    for (let i = path.length - 1; i >= 0; i--) {
-      if (work++ % 256 === 0) {
-        const pending = checkpoint();
-        if (pending) await pending;
-      }
-      const item = path[i];
-      overlay = overlay || isOverlayHostNode(item.tag, Object.keys(item.attrs));
-      overlayByNode.set(item.backendNodeId, overlay);
-      if (overlay) excludedBackendNodeIds.add(item.backendNodeId);
-    }
-  }
-  return { nodes, excludedBackendNodeIds };
-}
@@ -1,155 +0,0 @@
-import type { CdpRunner } from "../shared";
-import { isAbortError, throwIfAborted } from "./capture-abort";
-import type { CapturedNode } from "./capture-types";
-
-interface RuntimeEvaluateReply {
-  result?: { deepSerializedValue?: DeepSerializedValue };
-}
-const MAX_FORM_ENRICH_CONTROLS = 250;
-
-interface CapturedFormState {
-  value?: string;
-  defaultValue?: string;
-  placeholder?: string;
-  state?: "empty" | "filled" | "default";
-  sensitive?: boolean;
-}
-
-interface DeepSerializedValue {
-  type: string;
-  value?: unknown;
-}
-
-function formStateBatchExpression(maxControls: number): string {
-  return `(() => {
-    const maxControls = ${JSON.stringify(maxControls)};
-    let remaining = maxControls;
-    const controlSelector = "input,textarea,select";
-    const controlState = (el) => {
-      const tag = el.tagName.toLowerCase();
-      const type = tag === "input" ? String(el.type || "text").toLowerCase() : tag;
-      const sensitive = type === "password" || type === "credit-card";
-      const rawValue = typeof el.value === "string" ? el.value : "";
-      const defaultValue = typeof el.defaultValue === "string" ? el.defaultValue : "";
-      const placeholder = typeof el.placeholder === "string" ? el.placeholder : "";
-      const state = rawValue === "" ? "empty" : rawValue === defaultValue ? "default" : "filled";
-      return {
-        state,
-        sensitive,
-        placeholder,
-        ...(sensitive ? {} : { value: rawValue, defaultValue }),
-      };
-    };
-    const controls = [];
-    const collect = (doc) => {
-      for (const el of Array.from(doc.querySelectorAll(controlSelector))) {
-        if (remaining <= 0) break;
-        // Deep serialization supplies the node's backend id. Keep the
-        // state as JSON so decoding needs no general-purpose V8 deserializer.
-        controls.push([el, JSON.stringify(controlState(el))]);
-        remaining -= 1;
-      }
-      for (const frame of Array.from(doc.querySelectorAll("iframe"))) {
-        if (remaining <= 0) break;
-        let childDoc = null;
-        try { childDoc = frame.contentDocument; } catch { childDoc = null; }
-        if (childDoc) collect(childDoc);
-      }
-    };
-    collect(document);
-    return controls;
-  })()`;
-}
-
-function formStatesByBackendId(result: RuntimeEvaluateReply): Map<number, CapturedFormState> {
-  const states = new Map<number, CapturedFormState>();
-  const serialized = result.result?.deepSerializedValue;
-  if (serialized?.type !== "array" || !Array.isArray(serialized.value)) return states;
-  for (const entry of serialized.value as DeepSerializedValue[]) {
-    if (entry?.type !== "array" || !Array.isArray(entry.value)) continue;
-    const [element, json] = entry.value as DeepSerializedValue[];
-    if (element?.type !== "node" || json?.type !== "string" || typeof json.value !== "string") {
-      continue;
-    }
-    const backendNodeId = (element.value as { backendNodeId?: number } | undefined)?.backendNodeId;
-    if (typeof backendNodeId !== "number" || !Number.isSafeInteger(backendNodeId)) continue;
-    try {
-      const state = JSON.parse(json.value) as CapturedFormState | null;
-      if (
-        !state ||
-        !["empty", "filled", "default"].includes(state.state ?? "") ||
-        typeof state.sensitive !== "boolean" ||
-        typeof state.placeholder !== "string" ||
-        (!state.sensitive &&
-          (typeof state.value !== "string" || typeof state.defaultValue !== "string"))
-      ) {
-        continue;
-      }
-      states.set(backendNodeId, state);
-    } catch {
-      // A malformed entry must not overwrite the snapshot's own state.
-    }
-  }
-  return states;
-}
-
-function applyFormStates(nodes: CapturedNode[], states: Map<number, CapturedFormState>): void {
-  for (const node of nodes) {
-    if (!["input", "textarea", "select"].includes(node.tag)) continue;
-    const state = states.get(node.backendNodeId);
-    if (!state) continue;
-    node.formState = state.state;
-    node.formPlaceholder = state.placeholder ?? "";
-    if (
-      state.sensitive ||
-      (node.tag === "input" && (node.attrs.type ?? "").toLowerCase() === "password")
-    ) {
-      delete node.formValue;
-      delete node.formDefaultValue;
-      delete node.attrs.value;
-    } else {
-      node.formDefaultValue = state.defaultValue ?? "";
-      if (state.value !== undefined) node.formValue = state.value;
-    }
-  }
-}
-
-export async function enrichFormControlStates(
-  cdp: CdpRunner,
-  tabId: number,
-  frameNodeGroups: CapturedNode[][],
-  signal?: AbortSignal,
-): Promise<boolean> {
-  const hasControls = frameNodeGroups.some((nodes) =>
-    nodes.some((node) => ["input", "textarea", "select"].includes(node.tag)),
-  );
-  if (!hasControls) return true;
-  const objectGroup = `bsk-vom-forms-${crypto.randomUUID()}`;
-  try {
-    throwIfAborted(signal);
-    const result = await cdp.send<RuntimeEvaluateReply>(tabId, "Runtime.evaluate", {
-      expression: formStateBatchExpression(MAX_FORM_ENRICH_CONTROLS),
-      objectGroup,
-      serializationOptions: {
-        serialization: "deep",
-        maxDepth: 3,
-        additionalParameters: { maxNodeDepth: 0, includeShadowTree: "none" },
-      },
-    });
-    throwIfAborted(signal);
-    // Backend ids are scoped to this capture's CDP target. OOPIF targets
-    // have separate enrichment calls and never share this lookup.
-    const states = formStatesByBackendId(result);
-    for (const nodes of frameNodeGroups) {
-      applyFormStates(nodes, states);
-    }
-    return true;
-  } catch (error) {
-    if (isAbortError(error)) throw error;
-    // Best-effort enrichment. DOMSnapshot/AX data still carries the nodes.
-    return false;
-  } finally {
-    await cdp.send(tabId, "Runtime.releaseObjectGroup", { objectGroup }).catch(() => undefined);
-    throwIfAborted(signal);
-  }
-}
@@ -1,6 +1,6 @@
 import type { CdpFrame, CdpFrameGraph } from "@/browser-driver/frame-graph";
+import { resolveFrameProjection } from "../frame-geometry";
 import { type GeometryProjection, projectRectToViewport } from "../geometry";
-import { GeometryContext } from "../geometry/frame-context";
 import { type CdpRunner, cdpRunnerForTarget, sendToCdpTarget } from "../shared";
 import { type CapturedNode, type CapturedViewModel, captureViewModel } from "./capture";
 import {
@@ -21,6 +21,16 @@ function isAbortError(err: unknown): boolean {
  return err instanceof Error && err.name === "AbortError";
 }

+async function discoverFrameGraph(cdp: CdpRunner, tabId: number): Promise<CdpFrameGraph | null> {
+  if (!cdp.getFrameGraph) return null;
+  try {
+    return await cdp.getFrameGraph(tabId);
+  } catch (err) {
+    console.debug("[bsk observation] frame graph capture failed", err);
+    return null;
+  }
+}
+
 function transformFrameNodes(
  nodes: CapturedNode[],
  projection: GeometryProjection | null,
@@ -41,7 +51,6 @@ async function captureMissingFrameDocuments(
  tabId: number,
  graph: CdpFrameGraph,
  captured: CapturedViewModel,
-  geometry: GeometryContext,
  signal?: AbortSignal,
 ): Promise<void> {
  if (!captured.frameNodes) captured.frameNodes = new Map();
@@ -53,20 +62,10 @@ async function captureMissingFrameDocuments(
    try {
      const child = await captureViewModel(cdpRunnerForTarget(cdp, frame.target), tabId, {
        signal,
-        geometry,
-        target: frame.target,
      });
-      if (child.frameExcludedBackendNodeIds?.size) {
-        captured.frameExcludedBackendNodeIds ??= new Map();
-        for (const [id, excluded] of child.frameExcludedBackendNodeIds)
-          captured.frameExcludedBackendNodeIds.set(id, excluded);
-      }
-      if (child.frameGeometryIssues?.length) {
-        (captured.frameGeometryIssues ??= []).push(...child.frameGeometryIssues);
-      }
      let projection: GeometryProjection | null = null;
      try {
-        projection = await geometry.targetProjection(frame.frameId);
+        projection = await resolveFrameProjection(cdp, graph, frame.frameId);
      } catch (err) {
        if (isAbortError(err)) throw err;
        console.debug("[bsk observation] child frame geometry projection failed", {
@@ -172,12 +171,11 @@ export async function captureFrameData<T extends FrameAxNode>(
  tabId: number,
  captured: CapturedViewModel,
  signal?: AbortSignal,
-  geometry = new GeometryContext(cdp, tabId, undefined, signal),
 ): Promise<CapturedFrameDocument<T>[]> {
-  const graph = await geometry.graph();
+  const graph = await discoverFrameGraph(cdp, tabId);
  const frames = graph?.frames ?? [];
-  if (graph) await captureMissingFrameDocuments(cdp, tabId, graph, captured, geometry, signal);
+  if (graph) await captureMissingFrameDocuments(cdp, tabId, graph, captured, signal);
  throwIfAborted(signal);
  const batches = await captureAxTrees<T>(cdp, tabId, frames, captured, signal);
-  return buildFrameDocuments(graph, batches, captured, signal);
+  return buildFrameDocuments(graph, batches, captured);
 }
@@ -4,8 +4,7 @@ import {
  type CdpTarget,
  cdpTargetKey,
 } from "@/browser-driver/frame-graph";
-import { createCaptureCheckpoint } from "./capture-abort";
-import type { CapturedNode } from "./capture-types";
+import type { CapturedNode, CapturedViewModel } from "./capture";

 export interface FrameOwnedAxNode {
  nodeId: string;
@@ -24,17 +23,6 @@ export interface FrameDocument<T extends FrameOwnedAxNode> extends CdpFrame {
  contextScopeId: string;
  axNodes: T[];
  domNodes: CapturedNode[];
-  excludedBackendNodeIds?: ReadonlySet<number>;
-}
-
-/** Explicit snapshot document data used to join DOM and AX ownership. */
-export interface FrameDomInput {
-  nodes: CapturedNode[];
-  rootFrameId?: string;
-  frameNodes?: ReadonlyMap<string, CapturedNode[]>;
-  frameOwnerBackendNodeIds?: ReadonlyMap<string, number>;
-  frameParentIds?: ReadonlyMap<string, string>;
-  frameExcludedBackendNodeIds?: ReadonlyMap<string, ReadonlySet<number>>;
 }

 interface Ownership {
@@ -59,7 +47,7 @@ function targetBackendKey(target: CdpTarget, backendNodeId: number): string {
 function frameList<T extends FrameOwnedAxNode>(
  graph: CdpFrameGraph | null,
  batches: FrameAxBatch<T>[],
-  captured: FrameDomInput,
+  captured: CapturedViewModel,
 ): CdpFrame[] {
  const frames = new Map<string, CdpFrame>();
  for (const frame of graph?.frames ?? []) frames.set(frame.frameId, frame);
@@ -82,14 +70,11 @@ function frameList<T extends FrameOwnedAxNode>(
  });
 }

-export async function buildFrameDocuments<T extends FrameOwnedAxNode>(
+export function buildFrameDocuments<T extends FrameOwnedAxNode>(
  graph: CdpFrameGraph | null,
  batches: FrameAxBatch<T>[],
-  captured: FrameDomInput,
-  signal?: AbortSignal,
-): Promise<FrameDocument<T>[]> {
-  const checkpoint = createCaptureCheckpoint(signal);
-  let work = 0;
+  captured: CapturedViewModel,
+): FrameDocument<T>[] {
  const frames = frameList(graph, batches, captured);
  const frameById = new Map(frames.map((frame) => [frame.frameId, frame]));
  const rootFrameId = graph?.rootFrameId ?? captured.rootFrameId ?? frames[0]?.frameId;
@@ -98,68 +83,54 @@ export async function buildFrameDocuments<T extends FrameOwnedAxNode>(
  const backendOwner = new Map<string, string>();
  for (const frame of frames) {
    for (const node of domNodesForFrame(frame.frameId)) {
-      if (work++ % 256 === 0) {
-        const pending = checkpoint();
-        if (pending) await pending;
-      }
      backendOwner.set(targetBackendKey(frame.target, node.backendNodeId), frame.frameId);
    }
  }

  const candidates = new Map<string, OwnedCandidate<T>>();
  for (const batch of batches) {
-    const nodeById = new Map<string, T>();
-    for (const node of batch.nodes) {
-      if (work++ % 256 === 0) {
-        const pending = checkpoint();
-        if (pending) await pending;
-      }
-      nodeById.set(node.nodeId, node);
-    }
+    const nodeById = new Map(batch.nodes.map((node) => [node.nodeId, node]));
    const ownershipByNodeId = new Map<string, Ownership>();
-    for (const node of batch.nodes) {
-      const path: T[] = [];
-      const visiting = new Set<string>();
-      let current: T | undefined = node;
-      let ownership: Ownership = { frameId: batch.frame.frameId, strength: 1 };
-      while (current) {
-        if (work++ % 256 === 0) {
-          const pending = checkpoint();
-          if (pending) await pending;
-        }
-        const cached = ownershipByNodeId.get(current.nodeId);
-        if (cached) {
-          ownership = cached;
-          break;
-        }
-        if (visiting.has(current.nodeId)) break;
-        visiting.add(current.nodeId);
-        if (current.frameId && frameById.has(current.frameId)) {
-          ownership = { frameId: current.frameId, strength: 4 };
-          ownershipByNodeId.set(current.nodeId, ownership);
-          break;
-        }
-        const frameId =
-          typeof current.backendDOMNodeId === "number"
-            ? backendOwner.get(targetBackendKey(batch.frame.target, current.backendDOMNodeId))
-            : undefined;
+    const resolving = new Set<string>();
+    const resolveOwnership = (node: T): Ownership => {
+      const cached = ownershipByNodeId.get(node.nodeId);
+      if (cached) return cached;
+      if (node.frameId && frameById.has(node.frameId)) {
+        const ownership = { frameId: node.frameId, strength: 4 };
+        ownershipByNodeId.set(node.nodeId, ownership);
+        return ownership;
+      }
+      if (typeof node.backendDOMNodeId === "number") {
+        const frameId = backendOwner.get(
+          targetBackendKey(batch.frame.target, node.backendDOMNodeId),
+        );
        if (frameId) {
-          ownership = { frameId, strength: 3 };
-          ownershipByNodeId.set(current.nodeId, ownership);
-          break;
+          const ownership = { frameId, strength: 3 };
+          ownershipByNodeId.set(node.nodeId, ownership);
+          return ownership;
        }
-        path.push(current);
-        current = current.parentId ? nodeById.get(current.parentId) : undefined;
      }
-      for (let i = path.length - 1; i >= 0; i--) {
-        if (work++ % 256 === 0) {
-          const pending = checkpoint();
-          if (pending) await pending;
+      if (node.parentId && !resolving.has(node.nodeId)) {
+        const parent = nodeById.get(node.parentId);
+        if (parent) {
+          resolving.add(node.nodeId);
+          const inherited = resolveOwnership(parent);
+          resolving.delete(node.nodeId);
+          const ownership = {
+            frameId: inherited.frameId,
+            strength: Math.min(2, inherited.strength),
+          };
+          ownershipByNodeId.set(node.nodeId, ownership);
+          return ownership;
        }
-        ownership = { frameId: ownership.frameId, strength: Math.min(2, ownership.strength) };
-        ownershipByNodeId.set(path[i].nodeId, ownership);
      }
-      if (!ownershipByNodeId.has(node.nodeId)) ownershipByNodeId.set(node.nodeId, ownership);
+      const ownership = { frameId: batch.frame.frameId, strength: 1 };
+      ownershipByNodeId.set(node.nodeId, ownership);
+      return ownership;
+    };
+
+    for (const node of batch.nodes) {
+      const ownership = resolveOwnership(node);
      const key = targetNodeKey(batch.frame.target, node.nodeId);
      const existing = candidates.get(key);
      if (!existing || ownership.strength > existing.ownership.strength) {
@@ -173,10 +144,6 @@ export async function buildFrameDocuments<T extends FrameOwnedAxNode>(
  );
  const axNodesByFrame = new Map<string, T[]>();
  for (const candidate of candidates.values()) {
-    if (work++ % 256 === 0) {
-      const pending = checkpoint();
-      if (pending) await pending;
-    }
    const { node, target, ownership } = candidate;
    const parentFrameId = node.parentId
      ? ownershipByTargetNode.get(targetNodeKey(target, node.parentId))
@@ -202,6 +169,5 @@ export async function buildFrameDocuments<T extends FrameOwnedAxNode>(
    contextScopeId: frame.frameId,
    axNodes: axNodesByFrame.get(frame.frameId) ?? [],
    domNodes: domNodesForFrame(frame.frameId),
-    excludedBackendNodeIds: captured.frameExcludedBackendNodeIds?.get(frame.frameId),
  }));
 }
@@ -35,91 +35,3 @@ export async function clearHover(cdp: CdpRunner, tabId: number): Promise<void> {
      }),
    );
 }
-
-/**
- * Wall-clock budget for a probe phase.
- *
- * Callers ask whether the *next* candidate still fits before starting it,
- * rather than checking elapsed time at the top of the loop. A top-of-loop
- * check lets a candidate start with 1ms of budget left and then run to
- * completion, overshooting by a full settle window.
- */
-export class ProbeBudget {
-  private readonly startedAt = Date.now();
-
-  constructor(private readonly totalMs: number) {}
-
-  get elapsedMs(): number {
-    return Date.now() - this.startedAt;
-  }
-
-  /** True when a candidate costing `estimatedMs` still fits in the budget. */
-  canAfford(estimatedMs: number): boolean {
-    return this.elapsedMs + estimatedMs <= this.totalMs;
-  }
-}
-
-export type OverlayBypass = (tabId: number, enabled: boolean) => Promise<void>;
-
-export interface OverlayBypassScopeOptions {
-  /**
-   * Called when the overlay could not be restored. Defaults to `console.error`
-   * so a stuck-bypassed overlay is never silent; tests inject a spy.
-   */
-  onRestoreFailure?: (error: unknown) => void;
-}
-
-const overlayBypassDepth = new Map<number, number>();
-
-/**
- * Runs `body` with the agent overlay bypassed, restoring it afterwards.
- *
- * Reference counted per tab so nested probe phases share a single bypass span
- * instead of toggling the overlay once per phase. Restore failures are
- * reported rather than swallowed, and the depth is released even when restore
- * throws so a failure cannot pin the overlay off for the tab's lifetime.
- */
-export async function withOverlayBypass<T>(
-  bypass: OverlayBypass | undefined,
-  tabId: number,
-  body: () => Promise<T>,
-  options: OverlayBypassScopeOptions = {},
-): Promise<T> {
-  if (!bypass) return body();
-
-  const depth = overlayBypassDepth.get(tabId) ?? 0;
-  overlayBypassDepth.set(tabId, depth + 1);
-  if (depth === 0) {
-    try {
-      await bypass(tabId, true);
-    } catch (error) {
-      // Failing to hide the overlay only risks probing our own UI, so continue.
-      console.debug("[bsk hover] overlay bypass could not be enabled", error);
-    }
-  }
-
-  try {
-    return await body();
-  } finally {
-    const current = overlayBypassDepth.get(tabId) ?? 1;
-    if (current <= 1) {
-      overlayBypassDepth.delete(tabId);
-      try {
-        await bypass(tabId, false);
-      } catch (error) {
-        (options.onRestoreFailure ?? defaultRestoreFailure)(error);
-      }
-    } else {
-      overlayBypassDepth.set(tabId, current - 1);
-    }
-  }
-}
-
-function defaultRestoreFailure(error: unknown): void {
-  console.error("[bsk hover] agent overlay could not be restored after probing", error);
-}
-
-/** Test seam: drops any bypass depth left behind by a crashed probe. */
-export function resetOverlayBypassDepth(): void {
-  overlayBypassDepth.clear();
-}
@@ -1,7 +1,7 @@
 import { isVomReferenceNode } from "@browser-skill/vom";
 import { type CdpRunner, sendToCdpTarget } from "../shared";
 import type { FrameDocument, FrameOwnedAxNode } from "./frame-document";
-import { clearHover, ProbeBudget, waitForHover } from "./hover-perception";
+import { clearHover, waitForHover } from "./hover-perception";
 import { stableIdentifierName } from "./semantic-graph/name-evidence";
 import { frameBackendKey, type ResolvedSemanticGraph } from "./semantic-graph/types";

@@ -9,18 +9,11 @@ const MAX_TOOLTIP_CANDIDATES = 8;
 const MAX_TOOLTIP_PROBE_MS = 2_400;
 const TOOLTIP_SETTLE_MS = 250;
 const CACHE_TTL_MS = 5 * 60_000;
-/**
- * Misses expire sooner than hits: a control that gains a tooltip once the app
- * finishes booting should still be discoverable, but not at the cost of
- * re-probing every unlabelled control on every observation.
- */
-const MISS_CACHE_TTL_MS = 60_000;
 const MAX_CACHE_ENTRIES = 500;
 const FORM_CONTROL_TAGS = new Set(["input", "select", "textarea"]);

 interface TooltipCacheEntry {
-  /** `null` records "probed, revealed no tooltip" so the miss is not re-paid. */
-  name: string | null;
+  name: string;
  expiresAt: number;
 }

@@ -34,6 +27,7 @@ interface TooltipCandidate<T extends FrameOwnedAxNode> {

 export interface TooltipNameProbeOptions {
  signal?: AbortSignal;
+  hoverProbeBypassOverlay?: (tabId: number, enabled: boolean) => Promise<void>;
 }

 const tooltipCache = new Map<string, TooltipCacheEntry>();
@@ -45,11 +39,10 @@ function cacheKey<T extends FrameOwnedAxNode>(
  return `${document.target.tabId}\u0000${document.frameId}\u0000${document.url ?? ""}\u0000${backendNodeId}`;
 }

-/** Returns the cache entry, or `undefined` when this control was never probed. */
-function cachedEntry<T extends FrameOwnedAxNode>(
+function cachedName<T extends FrameOwnedAxNode>(
  document: FrameDocument<T>,
  backendNodeId: number,
-): TooltipCacheEntry | undefined {
+): string | undefined {
  const key = cacheKey(document, backendNodeId);
  const entry = tooltipCache.get(key);
  if (!entry) return undefined;
@@ -57,13 +50,13 @@ function cachedEntry<T extends FrameOwnedAxNode>(
    tooltipCache.delete(key);
    return undefined;
  }
-  return entry;
+  return entry.name;
 }

 function storeName<T extends FrameOwnedAxNode>(
  document: FrameDocument<T>,
  backendNodeId: number,
-  name: string | null,
+  name: string,
 ): void {
  if (tooltipCache.size >= MAX_CACHE_ENTRIES) {
    const oldest = tooltipCache.keys().next().value;
@@ -71,7 +64,7 @@ function storeName<T extends FrameOwnedAxNode>(
  }
  tooltipCache.set(cacheKey(document, backendNodeId), {
    name,
-    expiresAt: Date.now() + (name === null ? MISS_CACHE_TTL_MS : CACHE_TTL_MS),
+    expiresAt: Date.now() + CACHE_TTL_MS,
  });
 }

@@ -244,27 +237,22 @@ export async function probeTooltipNames<T extends FrameOwnedAxNode>(
  const names = new Map<string, string>();
  const pending: TooltipCandidate<T>[] = [];
  for (const candidate of candidates(documents, graph)) {
-    const cached = cachedEntry(candidate.document, candidate.backendNodeId);
+    const cached = cachedName(candidate.document, candidate.backendNodeId);
    if (cached) {
-      // A cached miss is still a decision: skip the control instead of re-probing.
-      if (cached.name !== null) {
-        names.set(
-          frameBackendKey(candidate.document.frameId, candidate.backendNodeId),
-          cached.name,
-        );
-      }
+      names.set(frameBackendKey(candidate.document.frameId, candidate.backendNodeId), cached);
    } else if (pending.length < MAX_TOOLTIP_CANDIDATES) {
      pending.push(candidate);
    }
  }
  if (pending.length === 0) return names;

-  const budget = new ProbeBudget(MAX_TOOLTIP_PROBE_MS);
+  const started = Date.now();
  const contexts = new Map<string, number>();
+  await options.hoverProbeBypassOverlay?.(tabId, true).catch(() => undefined);
  try {
    for (const candidate of pending) {
      if (options.signal?.aborted) throw new DOMException("observation aborted", "AbortError");
-      if (!budget.canAfford(TOOLTIP_SETTLE_MS)) break;
+      if (Date.now() - started >= MAX_TOOLTIP_PROBE_MS) break;
      let objectId: string | undefined;
      try {
        let contextId = contexts.get(candidate.document.frameId);
@@ -290,9 +278,9 @@ export async function probeTooltipNames<T extends FrameOwnedAxNode>(
        await waitForHover(TOOLTIP_SETTLE_MS, options.signal);
        const after = await tooltipTexts(cdp, candidate.document, objectId);
        const name = cleanTooltipDiff(before, after);
-        storeName(candidate.document, candidate.backendNodeId, name ?? null);
        if (!name) continue;
        names.set(frameBackendKey(candidate.document.frameId, candidate.backendNodeId), name);
+        storeName(candidate.document, candidate.backendNodeId, name);
      } catch (error) {
        if (error instanceof Error && error.name === "AbortError") throw error;
      } finally {
@@ -302,6 +290,7 @@ export async function probeTooltipNames<T extends FrameOwnedAxNode>(
    }
  } finally {
    await clearHover(cdp, tabId);
+    await options.hoverProbeBypassOverlay?.(tabId, false).catch(() => undefined);
  }
  return names;
 }
@@ -1,78 +0,0 @@
-import type { CdpTarget } from "@/browser-driver/frame-graph";
-import {
-  type FrameProjectionState,
-  projectSnapshotRect,
-  type SnapshotCoordinates,
-  snapshotViewportRect,
-} from "../geometry/coordinate-types";
-import { createCaptureCheckpoint } from "./capture-abort";
-import { buildDocumentIndex, type DocumentIndex, type NodeFacts } from "./facts";
-import { decodeDocument, type SnapshotDocument } from "./snapshot";
-
-export interface FrameContext {
-  frameId?: string;
-  ownerFrameBackendNodeId: number | null;
-  projection: FrameProjectionState;
-  target: CdpTarget;
-  coordinates: SnapshotCoordinates | null;
-  layoutUnitsPerCssPixel: number | null;
-}
-
-export interface NormalizedDocument {
-  nodes: NodeFacts[];
-  index: DocumentIndex;
-}
-
-/** Interpret one document using a supplied projection. No live reads or frame scheduling. */
-export async function normalizeDocument(
-  doc: SnapshotDocument,
-  strings: string[],
-  context: FrameContext,
-  signal?: AbortSignal,
-): Promise<NormalizedDocument> {
-  const decoded = await decodeDocument(doc, strings, signal);
-  const checkpoint = createCaptureCheckpoint(signal);
-  const nodes: NodeFacts[] = [];
-  for (let i = 0; i < decoded.nodes.length; i++) {
-    if (i % 256 === 0) {
-      const pending = checkpoint();
-      if (pending) await pending;
-    }
-    const node = decoded.nodes[i];
-    const bounds = node.layout?.bounds ?? [];
-    const input = snapshotViewportRect(
-      bounds,
-      { target: context.target, frameId: context.frameId },
-      context.coordinates,
-    );
-    const local = input?.rect;
-    const rect =
-      input && context.projection.status === "available"
-        ? projectSnapshotRect(input, context.projection.projection)
-        : null;
-    const visibility = node.layout?.styles.visibility || "visible";
-    const opacity = node.layout?.styles.opacity || "1";
-    nodes.push({
-      ...node,
-      ...(context.frameId ? { frameId: context.frameId } : {}),
-      ownerFrameBackendNodeId: context.ownerFrameBackendNodeId,
-      localRect: local ? { x: local.x, y: local.y, w: local.width, h: local.height } : null,
-      rect: rect ? { x: rect.x, y: rect.y, w: rect.width, h: rect.height } : null,
-      rendered:
-        bounds.length >= 4 &&
-        bounds.slice(0, 4).every(Number.isFinite) &&
-        bounds[2] > 0 &&
-        bounds[3] > 0 &&
-        visibility !== "hidden" &&
-        visibility !== "collapse" &&
-        (Number.parseFloat(opacity) || 0) > 0,
-    });
-  }
-  const index = await buildDocumentIndex(nodes, signal);
-  return {
-    nodes: nodes.filter(
-      (node) => !node.tag.startsWith("#") && !index.excludedBackendNodeIds.has(node.backendNodeId),
-    ),
-    index,
-  };
-}
@@ -2,10 +2,7 @@ import type { Rect, RenderedRef, VomResult } from "@browser-skill/vom";
 import type { CdpTarget } from "@/browser-driver/frame-graph";
 import { readRecordingDocumentIdentity } from "@/shared/recording-document-identity";
 import type { CapturedSurfaceProbe } from "./capture";
-import type {
-  FrameDocument as CapturedFrameDocument,
-  FrameOwnedAxNode as FrameAxNode,
-} from "./frame-document";
+import type { CapturedFrameDocument, FrameAxNode } from "./frame-capture";

 /** Frame identity needed to resolve an `@eN` that lives in an iframe. */
 export interface CaptureVomFrame {
@@ -40,17 +37,6 @@ export interface CaptureVomObservationResult {
  frames: CaptureVomFrame[];
  matchNodes: CaptureVomMatchNode[];
  surfaceProbes?: CapturedSurfaceProbe[];
-  /**
-   * Whether this observation actively hovered the page, and whether that
-   * revealed content the static tree does not contain. Lets callers judge how
-   * far the page may have drifted from the returned snapshot.
-   */
-  hoverProbe?: HoverProbeReport;
-}
-
-export interface HoverProbeReport {
-  performed: boolean;
-  revealedContent: boolean;
 }

 function projectFrames(documents: CapturedFrameDocument<FrameAxNode>[]): CaptureVomFrame[] {
@@ -89,7 +75,6 @@ export function projectRecordSafeObservation(input: {
  frameDocuments: CapturedFrameDocument<FrameAxNode>[];
  rendered: VomResult;
  surfaceProbes?: CapturedSurfaceProbe[];
-  hoverProbe?: HoverProbeReport;
 }): CaptureVomObservationResult {
  return {
    text: input.rendered.text,
@@ -99,6 +84,5 @@ export function projectRecordSafeObservation(input: {
    frames: projectFrames(input.frameDocuments),
    matchNodes: projectMatchNodes(input.frameDocuments),
    surfaceProbes: input.surfaceProbes,
-    ...(input.hoverProbe ? { hoverProbe: input.hoverProbe } : {}),
  };
 }
@@ -61,9 +61,8 @@ export function buildSemanticGraph(input: BuildSemanticGraphInput): SemanticGrap
        dom,
        sourceOrder: index,
        excluded:
-          document.excludedBackendNodeIds?.has(dom.backendNodeId) === true ||
-          (document.frameId === rootFrameId &&
-            input.excludedBackendNodeIds?.has(dom.backendNodeId) === true),
+          document.frameId === rootFrameId &&
+          input.excludedBackendNodeIds?.has(dom.backendNodeId) === true,
      };
      nodes.set(id, node);
      frameNodeIds.push(id);
@@ -91,10 +90,9 @@ export function buildSemanticGraph(input: BuildSemanticGraphInput): SemanticGrap
          ax,
          sourceOrder: document.domNodes.length + index,
          excluded:
+            document.frameId === rootFrameId &&
            typeof ax.backendDOMNodeId === "number" &&
-            (document.excludedBackendNodeIds?.has(ax.backendDOMNodeId) === true ||
-              (document.frameId === rootFrameId &&
-                input.excludedBackendNodeIds?.has(ax.backendDOMNodeId) === true)),
+            input.excludedBackendNodeIds?.has(ax.backendDOMNodeId) === true,
        });
        frameNodeIds.push(id);
      }
@@ -1,224 +0,0 @@
-import { createCaptureCheckpoint } from "./capture-abort";
-import type { CapturedNode } from "./capture-types";
-import type { DecodedDocument, DecodedNode } from "./facts";
-export const REQUESTED_STYLES = [
-  "position",
-  "pointer-events",
-  "cursor",
-  "visibility",
-  "opacity",
-] as const;
-const STYLE_COL = Object.fromEntries(
-  REQUESTED_STYLES.map((name, index) => [name, index]),
-) as Record<(typeof REQUESTED_STYLES)[number], number>;
-/** Sparse array format Chrome uses for infrequently-set per-node fields. */
-interface SparseArray {
-  index: number[];
-  value: number[];
-}
-
-interface RareBooleanData {
-  index: number[];
-}
-
-export interface SnapshotDocument {
-  frameId?: string | number;
-  scrollOffsetX?: number;
-  scrollOffsetY?: number;
-  nodes?: {
-    parentIndex?: number[];
-    nodeName?: number[];
-    nodeType?: number[];
-    backendNodeId?: number[];
-    attributes?: number[][];
-    /**
-     * Per-node text value (index into strings), set for `#text` / CDATA nodes.
-     * Element nodes carry -1. Same length as `backendNodeId`.
-     */
-    nodeValue?: number[];
-    /** Maps node array index → index into `documents[]` for frame content. */
-    contentDocumentIndex?: SparseArray;
-    inputValue?: SparseArray;
-    textValue?: SparseArray;
-    inputChecked?: RareBooleanData;
-    optionSelected?: RareBooleanData;
-  };
-  layout?: {
-    nodeIndex?: number[];
-    styles?: number[][];
-    bounds?: number[][];
-    paintOrders?: number[];
-  };
-}
-
-export function snapshotFrameId(document: SnapshotDocument, strings: string[]): string | undefined {
-  if (typeof document.frameId === "string") return document.frameId || undefined;
-  if (typeof document.frameId === "number") return str(strings, document.frameId) || undefined;
-  return undefined;
-}
-
-export interface SnapshotReply {
-  strings?: string[];
-  documents?: SnapshotDocument[];
-}
-
-function isSensitiveFormControl(node: Pick<CapturedNode, "tag" | "attrs">): boolean {
-  return node.tag === "input" && (node.attrs.type ?? "").toLowerCase() === "password";
-}
-
-function snapshotFormState(
-  value: string | undefined,
-  defaultValue: string,
-  hasDefaultValue: boolean,
-  sensitive: boolean,
-): CapturedNode["formState"] {
-  if (sensitive) {
-    if (value === undefined && !hasDefaultValue) return undefined;
-    return (value ?? defaultValue) === "" ? "empty" : "filled";
-  }
-  if (value === undefined) return undefined;
-  if (value === "") return "empty";
-  return value === defaultValue ? "default" : "filled";
-}
-
-function str(strings: string[], idx: number | undefined): string {
-  if (idx === undefined || idx < 0) return "";
-  return strings[idx] ?? "";
-}
-
-export function sparseIndexMap(sparse: SparseArray | undefined): Map<number, number> {
-  const out = new Map<number, number>();
-  if (!sparse?.index || !sparse.value) return out;
-  for (let i = 0; i < sparse.index.length; i++) {
-    const nodeIndex = sparse.index[i];
-    const docIndex = sparse.value[i];
-    if (nodeIndex !== undefined && docIndex !== undefined) out.set(nodeIndex, docIndex);
-  }
-  return out;
-}
-
-export async function decodeDocument(
-  doc: SnapshotDocument,
-  strings: string[],
-  signal?: AbortSignal,
-): Promise<DecodedDocument> {
-  const checkpoint = createCaptureCheckpoint(signal);
-  const dn = doc.nodes;
-  const dl = doc.layout;
-  if (!dn?.backendNodeId) {
-    return { nodes: [] };
-  }
-
-  const count = dn.backendNodeId.length;
-  const layoutByNode = new Map<number, number>();
-  for (let i = 0; i < (dl?.nodeIndex?.length ?? 0); i++) {
-    if (i % 256 === 0) {
-      const pending = checkpoint();
-      if (pending) await pending;
-    }
-    layoutByNode.set(dl!.nodeIndex![i], i);
-  }
-
-  const inputValues = sparseIndexMap(dn.inputValue);
-  const textValues = sparseIndexMap(dn.textValue);
-  const checkedInputs = new Set(dn.inputChecked?.index ?? []);
-  const selectedOptions = new Set(dn.optionSelected?.index ?? []);
-
-  // Collect visible text from #text child nodes so element CapturedNodes
-  // carry a textContent value usable as a button/link label fallback.
-  // nodeValue is a parallel array: string index for text nodes, -1 otherwise.
-  const nodeTextContent = new Map<number, string[]>();
-  if (dn.nodeValue) {
-    for (let n = 0; n < count; n++) {
-      if (n % 256 === 0) {
-        const pending = checkpoint();
-        if (pending) await pending;
-      }
-      const nvIdx = dn.nodeValue[n] ?? -1;
-      if (nvIdx < 0) continue;
-      const text = str(strings, nvIdx).trim();
-      if (!text) continue;
-      const parentIdx = dn.parentIndex?.[n] ?? -1;
-      if (parentIdx >= 0) {
-        const existing = nodeTextContent.get(parentIdx);
-        if (existing) existing.push(text);
-        else nodeTextContent.set(parentIdx, [text]);
-      }
-    }
-  }
-
-  // Decode fields without assigning a coordinate projection or semantic policy.
-  const nodes: DecodedNode[] = [];
-  for (let n = 0; n < count; n++) {
-    if (n % 256 === 0) {
-      const pending = checkpoint();
-      if (pending) await pending;
-    }
-    const backendNodeId = dn.backendNodeId[n];
-    const parentIdx = dn.parentIndex?.[n] ?? -1;
-    const parentBackendNodeId = parentIdx >= 0 ? (dn.backendNodeId[parentIdx] ?? null) : null;
-    const tag = str(strings, dn.nodeName?.[n]).toLowerCase();
-
-    const attrs: Record<string, string> = {};
-    const pairs = dn.attributes?.[n] ?? [];
-    for (let a = 0; a + 1 < pairs.length; a += 2) {
-      attrs[str(strings, pairs[a]).toLowerCase()] = str(strings, pairs[a + 1]);
-    }
-
-    const li = layoutByNode.get(n);
-    const styleRow = li === undefined ? [] : (dl?.styles?.[li] ?? []);
-    const styles: Record<string, string> = {};
-    for (const name of REQUESTED_STYLES) styles[name] = str(strings, styleRow[STYLE_COL[name]]);
-    const layout =
-      li === undefined
-        ? undefined
-        : {
-            boundsSpace: "snapshot-document-layout" as const,
-            bounds: dl?.bounds?.[li],
-            styles,
-          };
-
-    const textContent = nodeTextContent.get(n)?.join(" ");
-
-    const rawFormValueIndex = tag === "textarea" ? textValues.get(n) : inputValues.get(n);
-    const rawFormValue =
-      rawFormValueIndex !== undefined ? str(strings, rawFormValueIndex) : undefined;
-    const sensitive = isSensitiveFormControl({ tag, attrs });
-    const formDefaultValue = attrs.value ?? "";
-    const formValue = sensitive ? undefined : rawFormValue;
-    const formState = snapshotFormState(
-      rawFormValue,
-      formDefaultValue,
-      Object.prototype.hasOwnProperty.call(attrs, "value"),
-      sensitive,
-    );
-    if (sensitive) delete attrs.value;
-
-    nodes.push({
-      backendNodeId,
-      nodeType: dn.nodeType?.[n],
-      parentBackendNodeId,
-
-      tag,
-      attrs,
-      layout,
-      paintOrder: li === undefined ? 0 : (dl?.paintOrders?.[li] ?? 0),
-      position: styles.position || "static",
-      pointerEvents: styles["pointer-events"] || "auto",
-      cursor: styles.cursor || "auto",
-
-      textContent,
-      ...(formValue !== undefined ? { formValue } : {}),
-      ...(tag === "input" || tag === "textarea"
-        ? {
-            formPlaceholder: attrs.placeholder ?? "",
-            ...(!sensitive ? { formDefaultValue } : {}),
-            ...(formState ? { formState } : {}),
-          }
-        : {}),
-      ...(checkedInputs.has(n) ? { formValue: "true", formState: "filled" } : {}),
-      ...(selectedOptions.has(n) ? { formValue: attrs.value ?? textContent ?? "" } : {}),
-    });
-  }
-  return { nodes };
-}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
drakezhang	388c1283bc	fix: clarify invalid selectors and dedupe diagnostics	2026-09-01 21:03:22 +08:00
drakezhang	b449be1544	chore: add session-loss diagnostics	2026-09-01 20:16:32 +08:00