diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6315ac4..d852d98 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,10 @@ Releases before 1.1.3 predate this file; their notes live on the
 
 ### Changed
 
+- The browser worker delegates realm handling, live view, artifacts and
+  recording, snapshots, trusted input, site tools, and CAPTCHA operations to
+  import-safe modules with explicit dependencies. Launch, execution queues,
+  network guards, and shutdown ordering remain in the process entrypoint.
 - `bun run test:e2e` tests a supplied BetterWright executable or `betterwright`
   on PATH through isolated local fixtures, with per-case JSON reporting,
   explicit skips, and a strict CI mode. See `docs/binary-e2e.md` for coverage
@@ -18,6 +22,10 @@ Releases before 1.1.3 predate this file; their notes live on the
 
 ### Fixed
 
+- CAPTCHA Verify and checkbox controls are scrolled into view before the
+  trusted pointer clicks them, including image-grid submission. A visible
+  challenge widget without a response token no longer reports success after
+  unsuccessful tile picks.
 - `human.type(..., { clear: false })` positions the caret at the end before
   typing, rather than inserting at the point where the focus click landed.
 - History navigation waits for document readiness on back/forward-cache
diff --git a/docs/worker-architecture.md b/docs/worker-architecture.md
new file mode 100644
index 0000000..9966dd0
--- /dev/null
+++ b/docs/worker-architecture.md
@@ -0,0 +1,64 @@
+# Worker architecture
+
+`src/worker.ts` is the process entrypoint. It owns stdin/stdout RPC, session
+queues, browser launch and shutdown, execution orchestration, network guards,
+download approvals, and secret tracking. Do not import it into tests: importing
+it installs process handlers and emits the ready handshake.
+
+The worker constructs these internal modules before accepting messages:
+
+| Module | Responsibility and owned state |
+| --- | --- |
+| `worker-session.ts` | Session construction and the shared page limit. The worker owns the session registry. |
+| `worker-live-view.ts` | Live-view instance, preferred session, chat, asks, and handoffs. |
+| `worker-artifacts.ts` | Artifact paths and quotas, recording ownership, screenshots, and annotations. |
+| `worker-snapshots.ts` | Snapshot generation, password-value scrubbing, and per-page diff caches. |
+| `worker-realm.ts` | Playwright facades, restricted methods and paths, VM globals, and result serialization. Owns facade-to-object identity. |
+| `worker-human.ts` | Trusted input targeting, clearing, and typing recovery. |
+| `worker-site.ts` | Request history, guarded same-origin HTTP requests, and WebAgents discovery caches. |
+| `challenge-scan.ts` | Challenge metadata collection, scan gating, and session reporting. |
+| `captcha-runtime.ts` | Browser CAPTCHA interaction and puzzle capture. Uses the pure algorithms in `captcha-solver.ts`. |
+| `worker-sandbox.ts` | Composes the model-callable APIs for one execution using the trusted operations above. |
+| `credential-fill.ts` | Credential resolution, trusted filling, and pending-credential operations. |
+
+Factories receive the operations they need. Browser and configuration getters
+are evaluated at use time, so a factory does not retain an obsolete context
+across launches. The modules do not import the worker entrypoint.
+
+## Ordering contracts
+
+- Execute, credential operations, and session close use per-session queues.
+  Separate sessions can run concurrently.
+- RPC replies, live-view control, asks, and handoffs bypass those queues.
+  Queueing an RPC reply behind the operation waiting for it would deadlock.
+- Cookie Sync uses its own global busy gate.
+- Execution joins credential tasks and flushes page events before accepting
+  the result. Result envelopes refresh cookie secrets before redaction.
+- Download permissions are browser-wide and reference-counted; approval is
+  still checked against the owning session.
+- Recording finalization, parking, context close, and profile release retain
+  their existing ordering in the entrypoint.
+- Explicit live-view stop notifies viewers. Worker shutdown passes
+  `{ notify: false }` so viewers can reconnect after worker replacement.
+- Callbacks serialized into a page must be self-contained. They cannot close
+  over imported host helpers.
+
+## Verification
+
+Run `bun run lint`, `bun run typecheck`, `bun run check:build`, and
+`bun run test:types`. The formatter is disabled; match the existing hand style.
+
+Run `BETTERWRIGHT_REQUIRE_BROWSER=1 bun run test` for the unit and managed-browser
+suites. `test:unit` omits `tests/node/browser.test.ts` and is insufficient for a
+worker refactor. The `worker-*.test.ts` files also verify that extracted modules
+can be imported without worker process wiring.
+
+For black-box coverage of the built CLI:
+
+```sh
+bun tests/e2e/run.ts --binary bun \
+  --binary-arg "$PWD/dist/bin/betterwright.js" --require-all
+```
+
+Do not rebuild `dist/` while browser tests are running. Each new worker process
+loads the built modules, including dynamic imports during an execution.
diff --git a/src/captcha-runtime.ts b/src/captcha-runtime.ts
new file mode 100644
index 0000000..99d0815
--- /dev/null
+++ b/src/captcha-runtime.ts
@@ -0,0 +1,1444 @@
+// Native CAPTCHA interactions. Browser ownership and artifact storage stay with
+// the caller; only the screenshot operation is injected into the runtime.
+import fs from "node:fs";
+import type { Frame, Locator, Page, PageScreenshotOptions } from "playwright-core";
+import {
+  blobToPageBounds,
+  buildSolveResult,
+  CAPTCHA_SOLVE_STATUSES,
+  CAPTCHA_STAGES,
+  CHALLENGE_INSTRUCTION_SELECTORS,
+  CHALLENGE_WIDGET_SELECTORS,
+  CHECKBOX_SELECTORS,
+  classifyChallengeStage,
+  clusterSimilarBoxes,
+  extractDarkBlobs,
+  findGrowingRegion,
+  gridFromTiles,
+  IMAGE_TILE_SELECTORS,
+  isCaptchaChromeLabel,
+  isCaptchaSkipSubmitLabel,
+  isCaptchaVerifySubmitReady,
+  MOTION_CONFIRM_SELECTORS,
+  maxAutoStages,
+  nextSolveAction,
+  parseTileIndexes,
+  pickBestTileSet,
+  pickDragFitPair,
+  SELECTED_IMAGE_TILE_SELECTORS,
+  SLIDER_SELECTORS,
+  solveTimeoutMs,
+  unionClip,
+  VERIFY_BUTTON_SELECTORS,
+  visionGridInstruction,
+  WIDGET_FRAME_PATTERNS,
+} from "./captcha-solver.js";
+import {
+  type CaptureChallengeScreenshot,
+  type ChallengeSession,
+  collectChallengeMetadata,
+} from "./challenge-scan.js";
+import { detectBotChallenge } from "./challenges.js";
+import { movePointer, pointInside, pressPointer } from "./human.js";
+
+export interface CaptchaSession extends Pick<ChallengeSession, "artifacts"> {
+  cursor: { x: number; y: number; initialized: boolean };
+  captchaTargets: Map<number, {
+    bounds: { x: number; y: number; width: number; height: number };
+    pageBounds?: { x: number; y: number; width: number; height: number };
+    label: string | null;
+  }>;
+  captchaGrid: { url: string; signature: string } | null;
+}
+
+interface CaptchaRuntimeDeps<Session> {
+  captureScreenshot: CaptureChallengeScreenshot<Session>;
+}
+
+export const CAPTCHA_SCREENSHOT_TIMEOUT_MS = 8_000;
+// Local fixture widgets that render without a provider frame.
+const LOCAL_WIDGET_SELECTOR = "[data-bw-captcha], #bw-captcha, .bw-captcha";
+export const CAPTCHA_TILE_OVERLAY_ID = "__betterwright_captcha_tiles__";
+
+export function captchaBounds(value, label = "bounds") {
+  const bounds = {
+    x: Number(value?.x),
+    y: Number(value?.y),
+    width: Number(value?.width),
+    height: Number(value?.height),
+  };
+  if (
+    !Object.values(bounds).every(Number.isFinite) ||
+    bounds.width <= 0 ||
+    bounds.height <= 0
+  ) {
+    throw new Error(
+      `captcha ${label} requires finite x, y, width, and height values with positive dimensions.`,
+    );
+  }
+  return bounds;
+}
+
+export function captchaPoint(value, label) {
+  const point = { x: Number(value?.x), y: Number(value?.y) };
+  if (!Number.isFinite(point.x) || !Number.isFinite(point.y)) {
+    throw new Error(`captcha ${label} requires finite x and y values.`);
+  }
+  return point;
+}
+
+export function drawCaptchaTileOverlay({ tiles, overlayId }) {
+  document.getElementById(overlayId)?.remove();
+  const root = document.createElement("div");
+  root.id = overlayId;
+  root.style.cssText =
+    "position:fixed;left:0;top:0;width:0;height:0;z-index:2147483647;pointer-events:none;";
+  for (const tile of tiles) {
+    const box = tile.bounds;
+    const frame = document.createElement("div");
+    frame.style.cssText =
+      `position:absolute;left:${box.x}px;top:${box.y}px;` +
+      `width:${box.width}px;height:${box.height}px;` +
+      "border:3px solid #facc15;box-sizing:border-box;" +
+      "background:rgba(250,204,21,0.14);";
+    const label = document.createElement("span");
+    label.textContent = String(tile.index);
+    const size = Math.max(
+      16,
+      Math.min(36, Math.floor(Math.min(box.width, box.height) * 0.34)),
+    );
+    label.style.cssText =
+      "position:absolute;left:50%;top:50%;transform:translate(-50%,-50%);" +
+      `background:#111;color:#facc15;font:${size}px/${size + 4}px ui-monospace,monospace;` +
+      "font-weight:700;padding:1px 6px;border-radius:4px;border:2px solid #facc15;";
+    frame.appendChild(label);
+    root.appendChild(frame);
+  }
+  document.body.appendChild(root);
+}
+
+function removeAnnotationOverlay(overlayId) {
+  document.getElementById(overlayId)?.remove();
+}
+
+function hostDelay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+export function sampleCanvasRgbaInPage(canvas, maxWidth) {
+  if (!canvas || canvas.width < 16 || canvas.height < 16) return null;
+  const scale = Math.min(1, maxWidth / canvas.width);
+  const width = Math.max(8, Math.round(canvas.width * scale));
+  const height = Math.max(8, Math.round(canvas.height * scale));
+  const copy = document.createElement("canvas");
+  copy.width = width;
+  copy.height = height;
+  const ctx = copy.getContext("2d");
+  if (!ctx) return null;
+  try {
+    ctx.drawImage(canvas, 0, 0, width, height);
+  } catch {
+    return null;
+  }
+  const img = ctx.getImageData(0, 0, width, height);
+  let dark = 0;
+  for (let i = 0; i < img.data.length; i += 16) {
+    if (0.299 * img.data[i] + 0.587 * img.data[i + 1] + 0.114 * img.data[i + 2] < 110) {
+      dark += 1;
+    }
+  }
+  if (dark < 3) return null;
+  return { width, height, data: Array.from(img.data) };
+}
+
+function frameMatchesProvider(frame: Frame, provider) {
+  const url = frame.url() || "";
+  if (provider && WIDGET_FRAME_PATTERNS[provider]) {
+    return WIDGET_FRAME_PATTERNS[provider].test(url);
+  }
+  return Object.values(WIDGET_FRAME_PATTERNS).some((pattern) => pattern.test(url));
+}
+
+function candidateFrames(page: Page, provider) {
+  const frames = page.frames().filter((frame) => frame !== page.mainFrame());
+  const matched = frames.filter((frame) => frameMatchesProvider(frame, provider));
+  return matched.length ? matched : frames.slice(0, 8);
+}
+
+/**
+ * Page-coordinate box of a provider's challenge frame, taken from the frame
+ * element itself. Turnstile mounts its iframe in a closed shadow root, where
+ * neither `document.querySelector` nor a Playwright selector can see it, so
+ * walking back from the attached frame is the only way to locate the widget.
+ */
+async function widgetFrameBox(page: Page, provider) {
+  for (const frame of candidateFrames(page, provider)) {
+    const element = await frame.frameElement().catch(() => null);
+    if (!element) continue;
+    try {
+      const box = await element.boundingBox().catch(() => null);
+      if (box && box.width > 0 && box.height > 0) return box;
+    } finally {
+      await element.dispose().catch(() => {});
+    }
+  }
+  return null;
+}
+
+async function elementBoxInPage(_page: Page, _frame: Page | Frame, locator: Locator) {
+  const handle = await locator.elementHandle({ timeout: 1_500 }).catch(() => null);
+  if (!handle) return null;
+  try {
+    const box = await handle.boundingBox();
+    if (!box || box.width <= 0 || box.height <= 0) return null;
+    // Frame-local boxes are already in page CSS pixels for Playwright frames.
+    return box;
+  } finally {
+    await handle.dispose().catch(() => {});
+  }
+}
+
+async function findClickableInScopes(page: Page, scopes: (Page | Frame)[], selectors) {
+  for (const scope of scopes) {
+    for (const selector of selectors) {
+      const locator = scope.locator(selector).first();
+      const visible = await locator.isVisible({ timeout: 400 }).catch(() => false);
+      if (!visible) continue;
+      const box = await elementBoxInPage(page, scope, locator);
+      if (box) return { locator, box, scope, selector };
+    }
+  }
+  return null;
+}
+
+async function locatorAccessibleName(locator: Locator) {
+  const parts = await Promise.all([
+    locator.innerText().catch(() => ""),
+    locator.getAttribute("aria-label").catch(() => ""),
+    locator.getAttribute("title").catch(() => ""),
+    locator.getAttribute("value").catch(() => ""),
+  ]);
+  return (
+    parts
+      .map((value) => String(value || "").replace(/\s+/g, " ").trim())
+      .find(Boolean) || ""
+  );
+}
+
+async function locatorLooksDisabled(locator: Locator) {
+  const aria = await locator.getAttribute("aria-disabled").catch(() => null);
+  if (aria === "true") return true;
+  const className = await locator.getAttribute("class").catch(() => "");
+  return /(?:^|\s)(?:disabled|rc-button-disabled)(?:\s|$)/i.test(String(className || ""));
+}
+
+async function scopeHasSelectedCaptchaTiles(scope: Page | Frame) {
+  const locator = scope.locator(SELECTED_IMAGE_TILE_SELECTORS.join(", "));
+  const count = await locator.count().catch(() => 0);
+  if (!count) return false;
+  for (let i = 0; i < Math.min(count, 8); i += 1) {
+    const visible = await locator.nth(i).isVisible({ timeout: 200 }).catch(() => false);
+    if (visible) return true;
+  }
+  return false;
+}
+
+async function anyScopeHasSelectedCaptchaTiles(scopes) {
+  for (const scope of scopes) {
+    if (await scopeHasSelectedCaptchaTiles(scope)) return true;
+  }
+  return false;
+}
+
+async function recaptchaVerifyButtonLabel(scopes) {
+  for (const scope of scopes) {
+    const locator = scope.locator("#recaptcha-verify-button").first();
+    const visible = await locator.isVisible({ timeout: 400 }).catch(() => false);
+    if (!visible) continue;
+    return locatorAccessibleName(locator);
+  }
+  return "";
+}
+
+/**
+ * Submit control for the current challenge. reCAPTCHA reuses
+ * `#recaptcha-verify-button` for Skip (new puzzle) and Verify (submit).
+ * Clicking it while it still says Skip abandons a correct tile selection.
+ */
+async function findVerifyControl(page: Page, scopes: (Page | Frame)[], options: any = {}) {
+  const previousLabel = String(options.previousLabel || "");
+  for (const scope of scopes) {
+    for (const selector of VERIFY_BUTTON_SELECTORS) {
+      if (selector === "body") continue;
+      const locator = scope.locator(selector).first();
+      const visible = await locator.isVisible({ timeout: 400 }).catch(() => false);
+      if (!visible) continue;
+      const label = await locatorAccessibleName(locator);
+      if (isCaptchaSkipSubmitLabel(label)) continue;
+      if (await locatorLooksDisabled(locator)) continue;
+      if (selector === "#recaptcha-verify-button") {
+        if (
+          !isCaptchaVerifySubmitReady({
+            label,
+            previousLabel,
+            hadSelection: options.hadSelection,
+          })
+        ) {
+          continue;
+        }
+      }
+      const box = await elementBoxInPage(page, scope, locator);
+      if (box) return { locator, box, scope, selector, label };
+    }
+  }
+  return null;
+}
+
+async function waitForVerifyControl(page: Page, scopes: (Page | Frame)[], timeoutMs = 2_500, options: any = {}) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const found = await findVerifyControl(page, scopes, options);
+    if (found) return found;
+    await hostDelay(120);
+  }
+  return null;
+}
+
+async function humanClickBox(page: Page, session: CaptchaSession, box, options: any = {}) {
+  const inputLike = Boolean(options.inputLike);
+  const leftBias = options.leftBias !== false;
+  const point = leftBias
+    ? {
+        x: Math.round(box.x + box.width * (0.12 + Math.random() * 0.08)),
+        y: Math.round(box.y + box.height * (0.4 + Math.random() * 0.2)),
+      }
+    : pointInside(box, inputLike);
+  await movePointer(page.mouse, session.cursor, point, { stepDivisor: 8 });
+  await pressPointer(page.mouse, inputLike);
+  return point;
+}
+
+// Verify and checkbox controls come from boundingBox() in viewport
+// coordinates, which may sit below the fold. Scroll them in first so the
+// trusted pointer lands on the control instead of empty space.
+async function humanClickControl(page: Page, session: CaptchaSession, box, options: any = {}) {
+  const visible = await captchaBoxInViewport(page, box);
+  return humanClickBox(page, session, visible, options);
+}
+
+async function pageScrollMetrics(page: Page) {
+  return page.evaluate(() => ({
+    x: window.scrollX,
+    y: window.scrollY,
+    width: window.innerWidth,
+    height: window.innerHeight,
+  }));
+}
+
+/**
+ * Turn a captured page-coordinate CAPTCHA box into current viewport
+ * coordinates, scrolling only when its center is outside the clickable
+ * viewport. Playwright can report a bounding box below the fold, while
+ * page.mouse uses viewport coordinates and otherwise clicks empty space.
+ */
+export async function captchaBoxInViewport(page: Page, box, pageCoordinates = false) {
+  const before = await pageScrollMetrics(page);
+  const absolute = pageCoordinates
+    ? box
+    : { ...box, x: box.x + before.x, y: box.y + before.y };
+  const center = {
+    x: absolute.x + absolute.width / 2,
+    y: absolute.y + absolute.height / 2,
+  };
+  const currentCenter = { x: center.x - before.x, y: center.y - before.y };
+  const margin = 8;
+  let left = before.x;
+  let top = before.y;
+  if (currentCenter.x < margin || currentCenter.x > before.width - margin) {
+    left = Math.max(0, center.x - before.width / 2);
+  }
+  if (currentCenter.y < margin || currentCenter.y > before.height - margin) {
+    top = Math.max(0, center.y - before.height / 2);
+  }
+  if (left !== before.x || top !== before.y) {
+    await page.evaluate(({ left: x, top: y }) => window.scrollTo(x, y), { left, top });
+  }
+  const after = await pageScrollMetrics(page);
+  return {
+    x: absolute.x - after.x,
+    y: absolute.y - after.y,
+    width: absolute.width,
+    height: absolute.height,
+  };
+}
+
+async function challengeStillPresent(page: Page, provider) {
+  const metadata = await collectChallengeMetadata(page);
+  if (provider && metadata.tokens[provider]) return { present: false, metadata };
+  if (Object.keys(metadata.tokens).length) return { present: false, metadata };
+  const challenge = detectBotChallenge(metadata);
+  // Generic widgets need not carry the interstitial text the detector matches.
+  // Any visible challenge widget without a token is still unresolved after a
+  // click. Dormant provider frames are hidden, so filter on visibility rather
+  // than testing the first match.
+  const widgetVisible = provider === "generic"
+    ? await page
+      .locator(CHALLENGE_WIDGET_SELECTORS.join(", "))
+      .filter({ visible: true })
+      .count()
+      .then((count) => count > 0)
+      .catch(() => false)
+    : false;
+  return { present: Boolean(challenge) || widgetVisible, metadata, challenge };
+}
+
+/**
+ * Widget container box for clicking. `challengeWidgetBox` exists to crop
+ * screenshots and so demands a puzzle-sized box; a checkbox widget is a wide,
+ * short strip that the size gate rejects. Clicking only needs a real target.
+ */
+async function challengeWidgetClickBox(page: Page, provider) {
+  const scopes = [page, ...candidateFrames(page, provider)];
+  for (const scope of scopes) {
+    const widget = scope.locator(CHALLENGE_WIDGET_SELECTORS.join(", ")).first();
+    const visible = await widget.isVisible({ timeout: 400 }).catch(() => false);
+    if (!visible) continue;
+    const box = await elementBoxInPage(page, scope, widget);
+    if (box && box.width >= 24 && box.height >= 16) return box;
+  }
+  return null;
+}
+
+async function challengeWidgetBox(page: Page, provider) {
+  // Prefer the puzzle iframe. `.first()` on the combined selector is the
+  // hCaptcha checkbox (too short), so a size-gated first() skipped the crop
+  // and inspect fell back to a full-page screenshot.
+  const preferred = page.locator(
+    'iframe[src*="frame=challenge" i], iframe[src*="bframe" i]',
+  ).first();
+  const preferredBox = await preferred.boundingBox({ timeout: 800 }).catch(() => null);
+  if (preferredBox && preferredBox.width >= 80 && preferredBox.height >= 80) {
+    return preferredBox;
+  }
+  const loc = page.locator(CHALLENGE_WIDGET_SELECTORS.join(", "));
+  const n = await loc.count().catch(() => 0);
+  let best = null;
+  for (let i = 0; i < Math.min(n, 8); i += 1) {
+    const box = await loc.nth(i).boundingBox({ timeout: 400 }).catch(() => null);
+    if (!box || box.width < 80 || box.height < 80) continue;
+    if (!best || box.width * box.height > best.width * best.height) best = box;
+  }
+  if (best) return best;
+  const scopes = [page, ...candidateFrames(page, provider)];
+  for (const scope of scopes) {
+    const local = scope.locator(LOCAL_WIDGET_SELECTOR).first();
+    const localBox = await elementBoxInPage(page, scope, local);
+    if (localBox && localBox.width >= 80 && localBox.height >= 80) return localBox;
+  }
+  return null;
+}
+
+async function readChallengeInstruction(page: Page, provider) {
+  const scopes = [page, ...candidateFrames(page, provider)];
+  for (const scope of scopes) {
+    for (const selector of CHALLENGE_INSTRUCTION_SELECTORS) {
+      const locator = scope.locator(selector).first();
+      const visible = await locator.isVisible({ timeout: 250 }).catch(() => false);
+      if (!visible) continue;
+      const text = String(await locator.innerText().catch(() => ""))
+        .replace(/\s+/g, " ")
+        .trim();
+      if (text.length >= 8 && text.length < 240) return text;
+    }
+  }
+  return null;
+}
+
+async function collectTilesFromSelector(page: Page, scope: Page | Frame, selector) {
+  const locators = scope.locator(selector);
+  const count = await locators.count().catch(() => 0);
+  if (count < 3) return [];
+  const found = [];
+  const limit = Math.min(count, 16);
+  for (let index = 0; index < limit; index += 1) {
+    const tile = locators.nth(index);
+    const visible = await tile.isVisible().catch(() => false);
+    if (!visible) continue;
+    const box = await elementBoxInPage(page, scope, tile);
+    if (!box) continue;
+    const label = await tile.getAttribute("aria-label").catch(() => null);
+    if (isCaptchaChromeLabel(label)) continue;
+    found.push({ box, label: label || null });
+  }
+  const clustered = clusterSimilarBoxes(found.map((entry) => entry.box));
+  if (clustered.length < 3) return [];
+  return clustered.map((bounds, index) => {
+    const match = found.find(
+      (entry) =>
+        Math.abs(entry.box.x - bounds.x) < 3 && Math.abs(entry.box.y - bounds.y) < 3,
+    );
+    return { index, bounds, label: match?.label || null };
+  });
+}
+
+async function collectClickableCluster(page: Page, scope: Page | Frame) {
+  const locators = scope.locator(
+    "button, [role='button'], [role='checkbox'], img, [class*='task']",
+  );
+  const count = Math.min(await locators.count().catch(() => 0), 40);
+  const found = [];
+  for (let index = 0; index < count; index += 1) {
+    const locator = locators.nth(index);
+    const visible = await locator.isVisible().catch(() => false);
+    if (!visible) continue;
+    const tag = await locator.evaluate((el) => el.tagName).catch(() => "");
+    if (String(tag).toUpperCase() === "CANVAS") continue;
+    const label = [
+      await locator.getAttribute("aria-label").catch(() => ""),
+      await locator.getAttribute("title").catch(() => ""),
+      await locator.innerText().catch(() => ""),
+    ]
+      .map((value) => String(value || "").trim())
+      .find(Boolean);
+    if (isCaptchaChromeLabel(label)) continue;
+    const box = await elementBoxInPage(page, scope, locator);
+    if (box) found.push({ box, label: label || null });
+  }
+  const clustered = clusterSimilarBoxes(found.map((entry) => entry.box));
+  return clustered.map((bounds, index) => {
+    const match = found.find(
+      (entry) =>
+        Math.abs(entry.box.x - bounds.x) < 3 && Math.abs(entry.box.y - bounds.y) < 3,
+    );
+    return { index, bounds, label: match?.label || null };
+  });
+}
+
+async function collectChallengeTiles(page: Page, provider) {
+  const frames = candidateFrames(page, provider);
+  const scopes = frames.length ? [...frames, page] : [page];
+  const sets = [];
+  for (const scope of scopes) {
+    for (const selector of IMAGE_TILE_SELECTORS) {
+      const tiles = await collectTilesFromSelector(page, scope, selector);
+      if (tiles.length) sets.push(tiles);
+    }
+    const clickable = await collectClickableCluster(page, scope);
+    if (clickable.length) sets.push(clickable);
+  }
+  return pickBestTileSet(sets);
+}
+
+// Identifies the grid a numbered crop was taken from. Tile indexes only mean
+// something relative to the image the model looked at, so coordinates captured
+// for one challenge must never be replayed against another.
+export function captchaGridSignature(tiles, scroll = { x: 0, y: 0 }) {
+  return tiles
+    .map((tile) => {
+      const box = tile.bounds || {};
+      return [
+        Math.round((box.x || 0) + scroll.x),
+        Math.round((box.y || 0) + scroll.y),
+        Math.round(box.width || 0),
+        Math.round(box.height || 0),
+      ].join(",");
+    })
+    .join("|");
+}
+
+function rememberCaptchaTiles(page: Page, session: CaptchaSession, tiles, scroll) {
+  session.captchaTargets.clear();
+  for (const tile of tiles) {
+    session.captchaTargets.set(tile.index, {
+      bounds: tile.bounds,
+      pageBounds: {
+        ...tile.bounds,
+        x: tile.bounds.x + scroll.x,
+        y: tile.bounds.y + scroll.y,
+      },
+      label: tile.label || null,
+    });
+  }
+  session.captchaGrid = tiles.length
+    ? { url: page.url(), signature: captchaGridSignature(tiles, scroll) }
+    : null;
+}
+
+/**
+ * True when the stored tile coordinates no longer describe what is on screen —
+ * the page navigated, or the challenge swapped in a new grid. Clicking cached
+ * boxes in that state hits the wrong tiles or unrelated controls, so callers
+ * must recapture and let the model pick again rather than submit stale picks.
+ */
+export async function captchaTilesStale(page: Page, session: CaptchaSession, provider) {
+  const stored = session.captchaGrid;
+  if (!stored) return true;
+  if (stored.url !== page.url()) return true;
+  const live = await collectChallengeTiles(page, provider).catch(() => []);
+  if (!live.length) return true;
+  const scroll = await pageScrollMetrics(page);
+  return captchaGridSignature(live, scroll) !== stored.signature;
+}
+
+function clipForPuzzle(tileBoxes, widgetBox, viewport) {
+  if (
+    widgetBox &&
+    widgetBox.width >= 80 &&
+    widgetBox.height >= 80 &&
+    widgetBox.width <= 760 &&
+    widgetBox.height <= 900
+  ) {
+    return unionClip([widgetBox], { pad: 8, promptPad: 0, viewport });
+  }
+  return unionClip(tileBoxes, { pad: 10, promptPad: 80, viewport });
+}
+
+export async function detectCaptchaOnPage(page: Page) {
+  const metadata = await collectChallengeMetadata(page);
+  const challenge = detectBotChallenge(metadata);
+  const classification = classifyChallengeStage({
+    ...metadata,
+    provider: challenge?.provider,
+    type: challenge?.type,
+  });
+  const widgets = [];
+  const childFrames = page.frames().filter((frame) => frame !== page.mainFrame());
+  for (const [index, frame] of childFrames.entries()) {
+    if (metadata.frames[index]?.visible === false) continue;
+    const url = frame.url() || "";
+    for (const [provider, pattern] of Object.entries(WIDGET_FRAME_PATTERNS)) {
+      if (pattern.test(url)) {
+        widgets.push({ provider, url, kind: "frame" });
+        break;
+      }
+    }
+  }
+  // Local fixtures may expose data-bw-captcha without provider frames.
+  const localWidget = await page
+    .locator(LOCAL_WIDGET_SELECTOR)
+    .count()
+    .then((count) => count > 0)
+    .catch(() => false);
+  if (localWidget) {
+    widgets.push({ provider: "generic", url: page.url(), kind: "local" });
+  }
+  return {
+    present: Boolean(challenge) || widgets.length > 0 || classification.stage !== CAPTCHA_STAGES.NONE,
+    challenge: challenge || null,
+    classification,
+    widgets,
+    tokens: metadata.tokens,
+    cleared: Object.keys(metadata.tokens).length > 0,
+    url: page.url(),
+  };
+}
+
+export function createCaptchaRuntime<Session extends CaptchaSession>({
+  captureScreenshot,
+}: CaptchaRuntimeDeps<Session>) {
+  async function capturePuzzleScreenshot(page: Page, session: Session, name, clip, extra: any = {}) {
+    const options: PageScreenshotOptions = {
+      type: "png",
+      animations: extra.animations ?? "disabled",
+      timeout: CAPTCHA_SCREENSHOT_TIMEOUT_MS,
+    };
+    try {
+      return await captureScreenshot(
+        page,
+        session,
+        name,
+        name,
+        clip ? { ...options, clip } : options,
+      );
+    } catch {
+      return captureScreenshot(page, session, name, name, options);
+    }
+  }
+
+  async function captureTiles(page: Page, session: Session, provider) {
+    const tiles = await collectChallengeTiles(page, provider);
+    const scroll = await pageScrollMetrics(page);
+    rememberCaptchaTiles(page, session, tiles, scroll);
+    const widgetBox = await challengeWidgetBox(page, provider);
+    const viewport = page.viewportSize();
+    const clip = tiles.length
+      ? clipForPuzzle(
+          tiles.map((tile) => tile.bounds),
+          widgetBox,
+          viewport,
+        )
+      : widgetBox
+        ? unionClip([widgetBox], { pad: 8, promptPad: 0, viewport })
+        : null;
+    let overlayDrawn = false;
+    if (tiles.length) {
+      try {
+        await page.evaluate(drawCaptchaTileOverlay, {
+          tiles,
+          overlayId: CAPTCHA_TILE_OVERLAY_ID,
+        });
+        overlayDrawn = true;
+      } catch {
+        overlayDrawn = false;
+      }
+    }
+    let file;
+    try {
+      file = await capturePuzzleScreenshot(page, session, "captcha-grid.png", clip);
+    } finally {
+      if (overlayDrawn) {
+        await page
+          .evaluate(removeAnnotationOverlay, CAPTCHA_TILE_OVERLAY_ID)
+          .catch(() => {});
+      }
+    }
+    const artifact = { kind: "captcha", path: file, media: `MEDIA:${file}` };
+    session.artifacts.push(artifact);
+    const prompt = await readChallengeInstruction(page, provider);
+    const grid = gridFromTiles(tiles);
+    return {
+      tiles,
+      artifact,
+      grid,
+      prompt,
+      instruction: visionGridInstruction({
+        prompt,
+        grid,
+        tileCount: tiles.length,
+      }),
+    };
+  }
+
+  async function clickStoredTiles(page: Page, session: Session, indexes) {
+    if (!session.captchaTargets.size) return { ok: false, reason: "tiles_not_captured" };
+    const scopes = [page, ...page.frames().filter((frame) => frame !== page.mainFrame()).slice(0, 8)];
+    const previousLabel = await recaptchaVerifyButtonLabel(scopes);
+    const hadSelection = await anyScopeHasSelectedCaptchaTiles(scopes);
+    const clicked = [];
+    for (const index of indexes) {
+      const tile = session.captchaTargets.get(index);
+      if (!tile?.bounds) continue;
+      const visibleBounds = await captchaBoxInViewport(
+        page,
+        tile.pageBounds || tile.bounds,
+        Boolean(tile.pageBounds),
+      );
+      await humanClickBox(page, session, visibleBounds, { leftBias: false });
+      clicked.push(index);
+      await hostDelay(70 + Math.random() * 140);
+    }
+    if (!clicked.length) return { ok: false, reason: "tiles_not_found" };
+    // The Skip/Verify label flips only after the last tile click lands.
+    const verify = await waitForVerifyControl(page, scopes, 2_500, {
+      previousLabel,
+      hadSelection,
+    });
+    if (!verify) {
+      return { ok: true, clicked, verified: false, reason: "verify_not_ready" };
+    }
+    await hostDelay(80 + Math.random() * 120);
+    await humanClickControl(page, session, verify.box, { leftBias: false });
+    return { ok: true, clicked, verified: true, label: verify.label || null };
+  }
+
+  async function dragSliderOnPage(page: Page, session: Session, provider) {
+    const scopes = [page, ...candidateFrames(page, provider)];
+    const found = await findClickableInScopes(page, scopes, SLIDER_SELECTORS);
+    if (!found) return { ok: false, reason: "slider_not_found" };
+    const { box } = found;
+    const start = {
+      x: Math.round(box.x + box.width * 0.5),
+      y: Math.round(box.y + box.height * 0.5),
+    };
+    // Prefer the track width when the handle is small; drag most of the way across.
+    const trackWidth = Math.max(box.width * 4, 220);
+    const end = {
+      x: Math.round(start.x + trackWidth * (0.82 + Math.random() * 0.1)),
+      y: Math.round(start.y + (Math.random() - 0.5) * 4),
+    };
+    await movePointer(page.mouse, session.cursor, start, { stepDivisor: 8 });
+    await hostDelay(100 + Math.random() * 120);
+    await page.mouse.down();
+    await hostDelay(80 + Math.random() * 100);
+    await movePointer(page.mouse, session.cursor, end, {
+      stepDivisor: Math.max(3, Math.hypot(end.x - start.x, end.y - start.y) / 24),
+    });
+    await hostDelay(80 + Math.random() * 120);
+    await page.mouse.up();
+    return { ok: true, from: start, to: end };
+  }
+
+  async function sampleCanvasRgba(scope: Page | Frame) {
+    const locator = scope.locator("canvas").first();
+    const handle = await locator.elementHandle({ timeout: 800 }).catch(() => null);
+    if (!handle) return null;
+    try {
+      const box = await handle.boundingBox();
+      const image = await handle
+        .evaluate(sampleCanvasRgbaInPage, 200)
+        .catch(() => null);
+      if (!image || !box || box.width < 16 || box.height < 16) return null;
+      return { image, box };
+    } finally {
+      await handle.dispose().catch(() => {});
+    }
+  }
+
+  async function decodePngRgba(page: Page, buffer, maxWidth = 220) {
+    const b64 = Buffer.from(buffer).toString("base64");
+    return page.evaluate(
+      async ({ b64, maxWidth }) => {
+        const img = new Image();
+        img.src = `data:image/png;base64,${b64}`;
+        await img.decode();
+        const scale = Math.min(1, maxWidth / img.naturalWidth);
+        const width = Math.max(8, Math.round(img.naturalWidth * scale));
+        const height = Math.max(8, Math.round(img.naturalHeight * scale));
+        const copy = document.createElement("canvas");
+        copy.width = width;
+        copy.height = height;
+        const ctx = copy.getContext("2d");
+        if (!ctx) return null;
+        ctx.drawImage(img, 0, 0, width, height);
+        const pixels = ctx.getImageData(0, 0, width, height);
+        return { width, height, data: Array.from(pixels.data) };
+      },
+      { b64, maxWidth },
+    );
+  }
+
+  async function screenshotRgba(page: Page, session: Session, clip) {
+    const file = await capturePuzzleScreenshot(
+      page,
+      session,
+      "captcha-motion-frame.png",
+      clip,
+      { animations: "allow" },
+    );
+    const buffer = fs.readFileSync(file);
+    const image = await decodePngRgba(page, buffer);
+    return { image, box: clip, file };
+  }
+
+  function bestGrownFromSamples(samples, options) {
+    let best = null;
+    for (let i = 0; i < samples.length; i += 1) {
+      for (let j = i + 1; j < samples.length; j += 1) {
+        const grown = findGrowingRegion(samples[i].image, samples[j].image, options);
+        if (!grown) continue;
+        if (!best || grown.score > best.grown.score) {
+          best = { grown, sample: samples[j] };
+        }
+      }
+    }
+    return best;
+  }
+
+  async function locateGrowingRegion(page: Page, session: Session, provider) {
+    const scopes = [...candidateFrames(page, provider), page];
+    for (const scope of scopes) {
+      const samples = [];
+      for (let i = 0; i < 3; i += 1) {
+        if (i > 0) await hostDelay(420);
+        const sample = await sampleCanvasRgba(scope);
+        if (sample) samples.push(sample);
+      }
+      const picked = bestGrownFromSamples(samples, { topInset: 0, bottomInset: 0 });
+      if (picked?.grown) {
+        return {
+          bounds: blobToPageBounds(picked.grown, picked.sample.image, picked.sample.box),
+          score: picked.grown.score,
+          confidence: picked.grown.confidence,
+          source: "canvas",
+        };
+      }
+    }
+    const widgetBox = await challengeWidgetBox(page, provider);
+    const clip = widgetBox
+      ? unionClip([widgetBox], {
+          pad: 8,
+          promptPad: 0,
+          viewport: page.viewportSize(),
+        })
+      : null;
+    if (!clip) return null;
+    const shots = [];
+    for (let i = 0; i < 3; i += 1) {
+      if (i > 0) await hostDelay(420);
+      const shot = await screenshotRgba(page, session, clip);
+      if (shot?.image) shots.push(shot);
+    }
+    const picked = bestGrownFromSamples(shots, { topInset: 0.12, bottomInset: 0.18 });
+    if (!picked?.grown) return null;
+    return {
+      bounds: blobToPageBounds(picked.grown, picked.sample.image, picked.sample.box),
+      score: picked.grown.score,
+      confidence: picked.grown.confidence,
+      source: "screenshot",
+      artifact: picked.sample.file,
+    };
+  }
+
+  async function confirmMotionSelection(page: Page, session: Session, provider) {
+    const frames = candidateFrames(page, provider);
+    const found = await findClickableInScopes(
+      page,
+      frames,
+      MOTION_CONFIRM_SELECTORS,
+    );
+    if (!found) return false;
+    await humanClickBox(page, session, found.box, { leftBias: false });
+    return true;
+  }
+
+  async function dragFitOnPage(page: Page, session: Session, provider) {
+    const scopes = [...candidateFrames(page, provider), page];
+    for (const scope of scopes) {
+      const sample = await sampleCanvasRgba(scope);
+      if (!sample) continue;
+      const pair = pickDragFitPair(extractDarkBlobs(sample.image));
+      if (!pair) continue;
+      const from = blobToPageBounds(pair.piece, sample.image, sample.box, 4);
+      const to = blobToPageBounds(pair.hole, sample.image, sample.box, 4);
+      await movePointer(
+        page.mouse,
+        session.cursor,
+        { x: from.cx, y: from.cy },
+        { stepDivisor: 8 },
+      );
+      await hostDelay(90 + Math.random() * 120);
+      await page.mouse.down();
+      await hostDelay(70 + Math.random() * 90);
+      await movePointer(
+        page.mouse,
+        session.cursor,
+        { x: to.cx, y: to.cy },
+        {
+          stepDivisor: Math.max(
+            3,
+            Math.hypot(to.cx - from.cx, to.cy - from.cy) / 22,
+          ),
+        },
+      );
+      await hostDelay(80 + Math.random() * 100);
+      await page.mouse.up();
+      return { ok: true, from, to, source: "canvas" };
+    }
+    return { ok: false, reason: "drag_fit_not_found" };
+  }
+
+  async function runCaptchaSolveAction(
+    page: Page,
+    session: Session,
+    classification,
+    action,
+  ): Promise<any> {
+    const provider = classification.provider;
+    const scopes = [page, ...candidateFrames(page, provider)];
+    switch (action.action) {
+      case "click_checkbox": {
+        // Prefer real checkbox/controls; never fall through to a bare `body` hit
+        // when a verify button is available (managed / generic widgets).
+        // The widget's own control first, then the widget itself, and only then
+        // generic page buttons. Order matters: VERIFY_BUTTON_SELECTORS ends in
+        // `button[type='submit']`, which on a demo or login page is the host
+        // form's own button. Reaching that before the widget submits the form
+        // unsolved while the attempt log still claims a successful click.
+        const preferred = CHECKBOX_SELECTORS.filter((selector) => selector !== "body");
+        let found = await findClickableInScopes(page, scopes, preferred);
+        if (!found) {
+          // Turnstile mounts its iframe in a CLOSED shadow root, so neither the
+          // DOM nor a Playwright selector can see it. The frame stays attached
+          // and its frame element still reports real page geometry, which is the
+          // only remaining way to reach the checkbox.
+          const frameBox = await widgetFrameBox(page, provider);
+          if (frameBox) {
+            const point = await humanClickBox(page, session, frameBox, { leftBias: true });
+            return { ok: true, point, target: "frame_element" };
+          }
+          // Widget iframes that are visible in the DOM. Every pattern has to name
+          // a challenge: a bare `title*="widget"` also matches ordinary site
+          // furniture such as chat launchers, and clicking one of those reports a
+          // solve while opening a support window.
+          const iframe = page
+            .locator(
+              'iframe[src*="recaptcha" i], iframe[src*="hcaptcha" i], iframe[src*="turnstile" i], iframe[src*="challenges.cloudflare" i], iframe[title*="captcha" i], iframe[title*="challenge" i], iframe[title*="verification" i], iframe[title*="security check" i]',
+            )
+            .first();
+          // Bounded: an unmatched locator otherwise blocks for Playwright's 30s
+          // default, which is the whole solve budget spent before the first click.
+          const box = await iframe.boundingBox({ timeout: 800 }).catch(() => null);
+          if (box) {
+            const point = await humanClickBox(page, session, box, { leftBias: true });
+            return { ok: true, point, target: "iframe" };
+          }
+          // The widget container itself, for challenges that render inline rather
+          // than in a frame. Still ahead of the generic buttons below.
+          const inlineBox = await challengeWidgetClickBox(page, provider);
+          if (inlineBox) {
+            const point = await humanClickBox(page, session, inlineBox, { leftBias: true });
+            return { ok: true, point, target: "widget" };
+          }
+          found = await findVerifyControl(page, scopes);
+          if (!found) return { ok: false, reason: "checkbox_not_found" };
+          const verifyPoint = await humanClickControl(page, session, found.box, {
+            leftBias: found.box.width > 80,
+          });
+          return {
+            ok: true,
+            point: verifyPoint,
+            target: "verify_button",
+            selector: found.selector || null,
+          };
+        }
+        const point = await humanClickControl(page, session, found.box, {
+          leftBias: found.box.width > 80,
+        });
+        return { ok: true, point, target: "checkbox", selector: found.selector || null };
+      }
+      case "click_verify": {
+        // Challenge-frame controls first so a host-page Submit cannot steal the
+        // click. Next is how hCaptcha confirms a motion-target selection.
+        const frames = candidateFrames(page, provider);
+        const found =
+          (await findVerifyControl(page, [...frames, page])) ||
+          (await findClickableInScopes(page, [...frames, page], CHECKBOX_SELECTORS));
+        if (!found) return { ok: false, reason: "verify_control_not_found", soft: true };
+        const point = await humanClickControl(page, session, found.box, {
+          leftBias: false,
+        });
+        return { ok: true, point, target: "verify" };
+      }
+      case "drag_slider": {
+        const slider = await dragSliderOnPage(page, session, provider);
+        if (slider.ok) return slider;
+        const fit = await dragFitOnPage(page, session, provider);
+        if (fit.ok) return fit;
+        return { ...slider, soft: true };
+      }
+      case "click_growing": {
+        const located = await locateGrowingRegion(page, session, provider);
+        if (!located?.bounds) {
+          return runCaptchaSolveAction(page, session, classification, {
+            action: "inspect",
+            waitMs: 0,
+            description: "Motion target was ambiguous; capture frames for host vision",
+          });
+        }
+        await humanClickBox(page, session, located.bounds, { leftBias: false });
+        await hostDelay(700 + Math.random() * 400);
+        const confirmed = await confirmMotionSelection(page, session, provider);
+        return {
+          ok: true,
+          auto: true,
+          confirmed,
+          target: located,
+          source: located.source,
+        };
+      }
+      case "capture_tiles": {
+        const captured = await captureTiles(page, session, provider);
+        return {
+          ok: true,
+          needsVision: true,
+          tiles: captured.tiles,
+          artifact: captured.artifact,
+          grid: captured.grid,
+          instruction: captured.instruction,
+        };
+      }
+      case "capture_text": {
+        const widgetBox = await challengeWidgetBox(page, provider);
+        const file = await capturePuzzleScreenshot(
+          page,
+          session,
+          "captcha-text.png",
+          widgetBox
+            ? unionClip([widgetBox], {
+                pad: 8,
+                promptPad: 0,
+                viewport: page.viewportSize(),
+              })
+            : null,
+        );
+        const artifact = { kind: "captcha", path: file, media: `MEDIA:${file}` };
+        session.artifacts.push(artifact);
+        return {
+          ok: true,
+          needsVision: true,
+          artifact,
+          instruction: "Read the attached CAPTCHA crop and type the text into the challenge input.",
+        };
+      }
+      case "wait_token":
+      case "wait_clear":
+        return { ok: true, waited: true };
+      case "inspect": {
+        const widgetBox = await challengeWidgetBox(page, provider);
+        const clip = widgetBox
+          ? unionClip([widgetBox], {
+              pad: 8,
+              promptPad: 0,
+              viewport: page.viewportSize(),
+            })
+          : null;
+        const file = await capturePuzzleScreenshot(
+          page,
+          session,
+          "captcha-challenge.png",
+          clip,
+          { animations: "allow" },
+        );
+        const artifact = { kind: "captcha", path: file, media: `MEDIA:${file}` };
+        session.artifacts.push(artifact);
+        await hostDelay(450);
+        let artifact2 = null;
+        try {
+          const file2 = await capturePuzzleScreenshot(
+            page,
+            session,
+            "captcha-challenge-b.png",
+            clip,
+            { animations: "allow" },
+          );
+          artifact2 = { kind: "captcha", path: file2, media: `MEDIA:${file2}` };
+          session.artifacts.push(artifact2);
+        } catch {
+          artifact2 = null;
+        }
+        return {
+          ok: true,
+          needsVision: true,
+          artifact,
+          artifact2,
+          instruction:
+            "Compare the two attached frames and click the shape that grew, then call captcha.solve() again so Next can confirm. This is not a numbered image grid.",
+        };
+      }
+      default:
+        return { ok: false, reason: `unknown_action:${action.action}` };
+    }
+  }
+
+  async function solveCaptchaOnPage(page: Page, session: Session, options: any = {}) {
+    const started = Date.now();
+    const timeoutMs = solveTimeoutMs(options);
+    const maxStages = maxAutoStages(options);
+    const attempts = [];
+    const requestId = `bw_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
+
+    let lastClassification = null;
+    let lastChallenge = null;
+    let lastArtifact = null;
+    let lastTiles = null;
+    let lastInstruction = null;
+    let lastGrid = null;
+    let pendingTiles = parseTileIndexes(options?.tiles ?? options?.indexes);
+
+    for (let stageIndex = 0; stageIndex < maxStages; stageIndex += 1) {
+      if (Date.now() - started > timeoutMs) {
+        return buildSolveResult({
+          status: CAPTCHA_SOLVE_STATUSES.ERROR,
+          requestId,
+          provider: lastClassification?.provider || "generic",
+          stage: lastClassification?.stage || CAPTCHA_STAGES.UNKNOWN,
+          errorCode: "ERROR_TIMEOUT",
+          errorText: `CAPTCHA solve timed out after ${timeoutMs}ms`,
+          attempts,
+          artifact: lastArtifact,
+          tiles: lastTiles,
+          grid: lastGrid,
+          instruction: lastInstruction,
+          challenge: lastChallenge,
+        });
+      }
+
+      const metadata = await collectChallengeMetadata(page);
+      if (Object.keys(metadata.tokens).length) {
+        const provider = Object.keys(metadata.tokens)[0];
+        return buildSolveResult({
+          status: CAPTCHA_SOLVE_STATUSES.READY,
+          requestId,
+          provider,
+          stage: CAPTCHA_STAGES.NONE,
+          token: metadata.tokens[provider],
+          attempts,
+          cleared: true,
+          challenge: lastChallenge,
+        });
+      }
+
+      const challenge = detectBotChallenge(metadata);
+      lastChallenge = challenge;
+      const classification = classifyChallengeStage({
+        ...metadata,
+        provider: challenge?.provider,
+        type: challenge?.type,
+      });
+      lastClassification = classification;
+
+      // Local fixture widgets without provider frames.
+      if (classification.stage === CAPTCHA_STAGES.NONE) {
+        const local = await page
+          .locator(LOCAL_WIDGET_SELECTOR)
+          .first()
+          .isVisible()
+          .catch(() => false);
+        if (!local) {
+          // No challenge visible — treat as cleared.
+          return buildSolveResult({
+            status: CAPTCHA_SOLVE_STATUSES.READY,
+            requestId,
+            provider: "generic",
+            stage: CAPTCHA_STAGES.NONE,
+            attempts,
+            cleared: true,
+            challenge: null,
+          });
+        }
+        lastClassification = {
+          stage: CAPTCHA_STAGES.CHECKBOX,
+          provider: "generic",
+          autoSolvable: true,
+          needsVision: false,
+        };
+        const kind = await page
+          .locator(LOCAL_WIDGET_SELECTOR)
+          .first()
+          .getAttribute("data-bw-captcha")
+          .catch(() => "");
+        if (kind === "grid") {
+          lastClassification = {
+            stage: CAPTCHA_STAGES.IMAGE_GRID,
+            provider: "generic",
+            autoSolvable: false,
+            needsVision: true,
+          };
+        } else if (kind === "slider") {
+          lastClassification = {
+            stage: CAPTCHA_STAGES.SLIDER,
+            provider: "generic",
+            autoSolvable: true,
+            needsVision: false,
+          };
+        } else if (kind === "motion") {
+          lastClassification = {
+            stage: CAPTCHA_STAGES.MOTION,
+            provider: "generic",
+            autoSolvable: true,
+            needsVision: false,
+          };
+        } else if (kind === "drag") {
+          lastClassification = {
+            stage: CAPTCHA_STAGES.SLIDER,
+            provider: "generic",
+            autoSolvable: true,
+            needsVision: false,
+          };
+        }
+      }
+
+      if (pendingTiles.length && lastClassification.stage === CAPTCHA_STAGES.IMAGE_GRID) {
+        // Tile indexes describe the numbered crop the caller looked at. If that
+        // grid is gone, recapture and ask for fresh picks: replaying the old
+        // coordinates would click the wrong tiles and then submit Verify.
+        const stale =
+          !session.captchaTargets.size ||
+          (await captchaTilesStale(page, session, lastClassification.provider));
+        if (stale) {
+          const captured = await captureTiles(page, session, lastClassification.provider);
+          lastArtifact = captured.artifact;
+          lastTiles = captured.tiles;
+          lastGrid = captured.grid;
+          lastInstruction = captured.instruction;
+          pendingTiles = [];
+          attempts.push({
+            stageIndex,
+            stage: lastClassification.stage,
+            provider: lastClassification.provider,
+            action: "recapture_tiles",
+            description: "The numbered grid changed; captured a fresh crop for new picks",
+            ok: true,
+            reason: "grid_changed",
+            atMs: Date.now() - started,
+          });
+          return buildSolveResult({
+            status: CAPTCHA_SOLVE_STATUSES.PROCESSING,
+            requestId,
+            provider: lastClassification.provider,
+            stage: lastClassification.stage,
+            attempts,
+            artifact: lastArtifact,
+            tiles: lastTiles,
+            grid: lastGrid,
+            instruction:
+              lastInstruction ||
+              "The captcha grid changed. Open the attached numbered crop, pick matching tile indexes, then call captcha.solve({ tiles: [indexes] }).",
+            challenge: lastChallenge,
+          });
+        }
+        const outcome = await clickStoredTiles(page, session, pendingTiles);
+        const applied = pendingTiles;
+        pendingTiles = [];
+        attempts.push({
+          stageIndex,
+          stage: lastClassification.stage,
+          provider: lastClassification.provider,
+          action: "click_tiles",
+          description: `Click numbered tiles ${applied.join(", ")} and verify`,
+          ok: Boolean(outcome.ok),
+          reason: outcome.reason || null,
+          atMs: Date.now() - started,
+        });
+        if (!outcome.ok) {
+          return buildSolveResult({
+            status: CAPTCHA_SOLVE_STATUSES.ERROR,
+            requestId,
+            provider: lastClassification.provider,
+            stage: lastClassification.stage,
+            errorCode: "ERROR_ACTION_FAILED",
+            errorText: outcome.reason || "CAPTCHA tile click failed",
+            attempts,
+            artifact: lastArtifact,
+            tiles: lastTiles,
+            grid: lastGrid,
+            instruction: lastInstruction,
+            challenge: lastChallenge,
+          });
+        }
+        await hostDelay(1_600 + Math.random() * 900);
+        const afterTiles = await challengeStillPresent(page, lastClassification.provider);
+        if (!afterTiles.present) {
+          const provider =
+            Object.keys(afterTiles.metadata.tokens || {})[0] || lastClassification.provider;
+          return buildSolveResult({
+            status: CAPTCHA_SOLVE_STATUSES.READY,
+            requestId,
+            provider,
+            stage: lastClassification.stage,
+            token: afterTiles.metadata.tokens?.[provider] || null,
+            attempts,
+            cleared: true,
+            challenge: lastChallenge,
+          });
+        }
+        continue;
+      }
+
+      let action = nextSolveAction(lastClassification, stageIndex);
+      if (lastClassification.stage === CAPTCHA_STAGES.MOTION) {
+        const frames = candidateFrames(page, lastClassification.provider);
+        const confirm = await findClickableInScopes(page, frames, [
+          ":text-is('Next')",
+          "button:has-text('Next')",
+          "[role='button']:has-text('Next')",
+        ]);
+        if (confirm) {
+          action = {
+            action: "click_verify",
+            waitMs: 2_000,
+            description: "Confirm the selected motion target",
+          };
+        }
+      }
+      const outcome = await runCaptchaSolveAction(
+        page,
+        session,
+        lastClassification,
+        action,
+      );
+      attempts.push({
+        stageIndex,
+        stage: lastClassification.stage,
+        provider: lastClassification.provider,
+        action: action.action,
+        description: action.description,
+        ok: Boolean(outcome.ok),
+        reason: outcome.reason || null,
+        // Which control the action actually hit. Without this a click on the
+        // wrong element is indistinguishable from a click on the widget.
+        target: outcome.target || null,
+        selector: outcome.selector || null,
+        atMs: Date.now() - started,
+      });
+
+      if (outcome.artifact) lastArtifact = outcome.artifact;
+      if (outcome.tiles) lastTiles = outcome.tiles;
+      if (outcome.instruction) lastInstruction = outcome.instruction;
+      if (outcome.grid) lastGrid = outcome.grid;
+
+      if (outcome.needsVision) {
+        return buildSolveResult({
+          status: CAPTCHA_SOLVE_STATUSES.PROCESSING,
+          requestId,
+          provider: lastClassification.provider,
+          stage: lastClassification.stage,
+          attempts,
+          artifact: lastArtifact,
+          tiles: lastTiles,
+          grid: lastGrid,
+          instruction:
+            lastInstruction ||
+            "Open the attached numbered captcha crop, pick matching tile indexes, then call captcha.solve({ tiles: [indexes] }).",
+          challenge: lastChallenge,
+        });
+      }
+
+      if (!outcome.ok && !outcome.soft) {
+        // Soft failures (e.g. verify button absent on managed challenge) still wait.
+        if (stageIndex === maxStages - 1) {
+          return buildSolveResult({
+            status: CAPTCHA_SOLVE_STATUSES.ERROR,
+            requestId,
+            provider: lastClassification.provider,
+            stage: lastClassification.stage,
+            errorCode: "ERROR_ACTION_FAILED",
+            errorText: outcome.reason || "CAPTCHA action failed",
+            attempts,
+            artifact: lastArtifact,
+            challenge: lastChallenge,
+          });
+        }
+      }
+
+      if (action.waitMs > 0) {
+        await hostDelay(action.waitMs);
+      }
+
+      const after = await challengeStillPresent(page, lastClassification.provider);
+      if (!after.present) {
+        const provider =
+          Object.keys(after.metadata.tokens || {})[0] || lastClassification.provider;
+        return buildSolveResult({
+          status: CAPTCHA_SOLVE_STATUSES.READY,
+          requestId,
+          provider,
+          stage: lastClassification.stage,
+          token: after.metadata.tokens?.[provider] || null,
+          attempts,
+          cleared: true,
+          challenge: lastChallenge,
+        });
+      }
+    }
+
+    return buildSolveResult({
+      status: CAPTCHA_SOLVE_STATUSES.PROCESSING,
+      requestId,
+      provider: lastClassification?.provider || "generic",
+      stage: lastClassification?.stage || CAPTCHA_STAGES.UNKNOWN,
+      attempts,
+      artifact: lastArtifact,
+      tiles: lastTiles,
+      grid: lastGrid,
+      instruction:
+        lastInstruction ||
+        "Auto-solve stages exhausted. Inspect the page with captcha.inspect or hand off to a human.",
+      challenge: lastChallenge,
+      errorCode: null,
+      errorText: null,
+    });
+  }
+
+  return { captureTiles, clickStoredTiles, solveCaptchaOnPage };
+}
diff --git a/src/challenge-scan.ts b/src/challenge-scan.ts
new file mode 100644
index 0000000..76cb269
--- /dev/null
+++ b/src/challenge-scan.ts
@@ -0,0 +1,565 @@
+// Challenge metadata collection and per-session reporting. Importing this module
+// does not start a worker or browser. Serialized page callbacks stay self-contained.
+import type { Frame, Page, PageScreenshotOptions } from "playwright-core";
+import { classifyChallengeStage } from "./captcha-solver.js";
+import { challengeScanNeeded, detectBotChallenge } from "./challenges.js";
+import type { UntrustedValue } from "./untrusted-value.js";
+
+export interface ChallengeSession {
+  currentId: string | null;
+  pages: Map<string, Page>;
+  artifacts: { kind: string; path: string; media: string }[];
+  openChallengeProviders: Set<string>;
+}
+
+export type CaptureChallengeScreenshot<Session> = (
+  page: Page,
+  session: Session,
+  requested: string,
+  fallback: string,
+  options: PageScreenshotOptions,
+) => Promise<string>;
+
+interface ChallengeScanDeps<Session> {
+  captureScreenshot: CaptureChallengeScreenshot<Session>;
+  pageId: (page: Page) => string;
+  lastBlockedDocumentAt: (page: Page) => number | undefined;
+}
+
+const CHALLENGE_FRAME_LIMIT = 24;
+const CHALLENGE_MAIN_TEXT_LIMIT = 50_000;
+const CHALLENGE_FRAME_TEXT_LIMIT = 10_000;
+const CHALLENGE_MAIN_TEXT_TIMEOUT_MS = 750;
+const CHALLENGE_FRAME_TEXT_TIMEOUT_MS = 500;
+// The frame walk is work the main-frame read did not do before, so it gets its
+// own budget rather than borrowing the body-text one: a page slow enough to
+// lose the walk must still report its title, text and solved-provider tokens.
+const CHALLENGE_FRAME_WALK_TIMEOUT_MS = 750;
+// In-page ceiling for the same-origin text walk, so one slow frame layout
+// cannot spend the whole evaluate budget by itself.
+const CHALLENGE_WALK_BUDGET_MS = 250;
+const CHALLENGE_CHECKED_SELECTOR =
+  '[aria-checked="true"], input[type="checkbox"]:checked, .recaptcha-checkbox-checked';
+const CHALLENGE_COMPLETED_TEXT =
+  /verification (?:complete|successful)|success!|you are verified/i;
+// Navigation destroys the execution context a pending evaluate was scheduled
+// in. The locator APIs retry that internally, inside their own timeout;
+// `evaluate` surfaces it as a rejection, so it is retried once here to keep a
+// mid-scan navigation from blanking a field the old per-call reads kept.
+const CHALLENGE_EVALUATE_RETRY =
+  /execution context was destroyed|frame was detached|cannot find context/i;
+
+/**
+ * Filled challenge response fields, keyed by provider. Runs in the page's main
+ * world because the fields are page state, which is where this read has always
+ * lived.
+ */
+export const readSolvedProvidersInPage = () => {
+  const isResponseText = (value: UntrustedValue): value is string =>
+    typeof value === "string";
+  const read = (name) => {
+    const fields = [...document.querySelectorAll(`[name="${name}"]`)];
+    if (fields.length === 0) return "";
+    const values = fields.map((element) => {
+      // SAFETY: challenge response fields are <input>/<textarea>, whose `value`
+      // is a string; any other element carrying the name reads undefined here
+      // and fails the guard below, counting as unfilled.
+      const fieldValue = (element as { value?: UntrustedValue }).value;
+      return isResponseText(fieldValue) ? fieldValue.trim() : "";
+    });
+    // A provider only counts as solved once every response field is filled;
+    // a partially populated multi-widget page is still an open challenge.
+    return values.every(Boolean) ? values[0] : "";
+  };
+  const tokens: Record<string, string> = {};
+  const recaptcha = read("g-recaptcha-response");
+  const hcaptcha = read("h-captcha-response");
+  const turnstile = read("cf-turnstile-response");
+  if (recaptcha) tokens.recaptcha = recaptcha;
+  if (hcaptcha) tokens.hcaptcha = hcaptcha;
+  if (turnstile) tokens.turnstile = turnstile;
+  // Generic local fixture / self-hosted widgets.
+  const generic = read("bw-captcha-response") || read("captcha-response");
+  if (generic) tokens.generic = generic;
+  return tokens;
+};
+
+/**
+ * Child-frame geometry, plus the text of the same-origin ones when the caller
+ * is about to gate on it. One evaluate for the whole document tree instead of a
+ * round trip per frame. Serialized into the page, so it closes over no worker
+ * scope; `contentDocument` reaches same-origin frames (including `srcdoc`) and
+ * nothing else, which is why cross-origin frames still cost stage 2.
+ */
+export const readFrameWalkInPage = (options: any) => {
+  const isTextValue = (value: UntrustedValue): value is string =>
+    typeof value === "string";
+  const deadline = performance.now() + options.walkBudgetMs;
+  const presentationOf = (element) => {
+    const rect = element.getBoundingClientRect();
+    const view = element.ownerDocument?.defaultView;
+    const style = view ? view.getComputedStyle(element) : null;
+    return {
+      visible:
+        rect.width > 0 &&
+        rect.height > 0 &&
+        (!style ||
+          (style.display !== "none" &&
+            style.visibility !== "hidden" &&
+            Number(style.opacity || "1") > 0)),
+      width: rect.width,
+      height: rect.height,
+    };
+  };
+  // Only this document's own children: a nested frame's descriptors are read
+  // from that frame, and an iframe inside a shadow root (which
+  // `querySelectorAll` does not reach) is resolved through its own element by
+  // the caller rather than by walking every element on the page.
+  const elements = [...document.querySelectorAll("iframe, frame")].slice(
+    0,
+    options.frameLimit,
+  );
+  const iframes = elements.map((element) => ({
+    name: element.getAttribute("name") || element.getAttribute("id") || "",
+    // SAFETY: the selector matches only <iframe>/<frame> elements, whose `src`
+    // IDL attribute is a string; an impostor from another namespace reads
+    // undefined here, which || "" normalizes.
+    src: (element as { src?: string }).src || "",
+    ...presentationOf(element),
+  }));
+
+  const sameOrigin = [];
+  if (options.wantFrameText) {
+    const queue = [document];
+    while (queue.length > 0 && sameOrigin.length < options.frameLimit) {
+      if (performance.now() > deadline) break;
+      const scope = queue.shift();
+      let nested = [];
+      try {
+        nested = [...scope.querySelectorAll("iframe, frame")];
+      } catch {
+        continue;
+      }
+      for (const element of nested) {
+        if (sameOrigin.length >= options.frameLimit) break;
+        if (performance.now() > deadline) break;
+        let inner = null;
+        try {
+          inner = element.contentDocument;
+        } catch {
+          inner = null;
+        }
+        if (!inner) {
+          const srcdoc = element.getAttribute("srcdoc");
+          if (srcdoc) {
+            const parsed = document.createElement("div");
+            parsed.innerHTML = srcdoc;
+            sameOrigin.push({
+              url: "about:srcdoc",
+              title: parsed.querySelector("title")?.textContent || "",
+              text: String(parsed.innerText || parsed.textContent || "").slice(
+                0,
+                options.frameTextLimit,
+              ),
+              visible: presentationOf(element).visible,
+            });
+          }
+          continue;
+        }
+        const innerBody = inner.body;
+        let frameText = isTextValue(innerBody?.innerText)
+          ? innerBody.innerText
+          : String(innerBody?.textContent || "");
+        let frameTitle = inner.title || "";
+        if (!frameText) {
+          const srcdoc = element.getAttribute("srcdoc");
+          if (srcdoc) {
+            const parsed = document.createElement("div");
+            parsed.innerHTML = srcdoc;
+            frameText = String(parsed.innerText || parsed.textContent || "");
+            frameTitle = parsed.querySelector("title")?.textContent || frameTitle;
+          }
+        }
+        sameOrigin.push({
+          url: inner.location ? String(inner.location.href) : "",
+          title: frameTitle,
+          text: frameText.slice(0, options.frameTextLimit),
+          visible: presentationOf(element).visible,
+        });
+        queue.push(inner);
+      }
+    }
+  }
+  return { iframes, sameOrigin };
+};
+
+/**
+ * Geometry of one frame element, read through the element itself. Duplicates
+ * `presentationOf` above because in-page functions are serialized and cannot
+ * share worker-scope helpers.
+ */
+export const readFramePresentationInPage = (element) => {
+  const rect = element.getBoundingClientRect();
+  const view = element.ownerDocument?.defaultView;
+  const style = view ? view.getComputedStyle(element) : null;
+  return {
+    visible:
+      rect.width > 0 &&
+      rect.height > 0 &&
+      (!style ||
+        (style.display !== "none" &&
+          style.visibility !== "hidden" &&
+          Number(style.opacity || "1") > 0)),
+    width: rect.width,
+    height: rect.height,
+  };
+};
+
+function emptyFrameWalk() {
+  return { iframes: [], sameOrigin: [] };
+}
+
+async function evaluateOnce(target, fn, arg?) {
+  try {
+    return await target.evaluate(fn, arg);
+  } catch (error: any) {
+    if (!CHALLENGE_EVALUATE_RETRY.test(String(error?.message || ""))) throw error;
+    return target.evaluate(fn, arg);
+  }
+}
+
+// A hung page must degrade to the same empty value the old per-call `.catch()`
+// handlers produced, and must not leave a rejected evaluate unhandled once the
+// race is over.
+async function withChallengeTimeout(work, timeoutMs, fallback) {
+  let timer;
+  return Promise.race([
+    work,
+    new Promise((resolve) => {
+      timer = setTimeout(() => resolve(fallback), timeoutMs);
+    }),
+  ]).finally(() => clearTimeout(timer));
+}
+
+export async function readSolvedProviders(page: Page): Promise<Record<string, string>> {
+  return evaluateOnce(page, readSolvedProvidersInPage).catch(() => ({}));
+}
+
+async function readFrameWalk(target, options) {
+  return withChallengeTimeout(
+    evaluateOnce(target, readFrameWalkInPage, options).catch(() => emptyFrameWalk()),
+    CHALLENGE_FRAME_WALK_TIMEOUT_MS,
+    emptyFrameWalk(),
+  );
+}
+
+/**
+ * Text and solved-checkbox state of one frame. Both go through Playwright's
+ * locator APIs, which run in an isolated utility world: a page cannot hide its
+ * own prompt by patching `innerText`, nor declare its challenge solved by
+ * patching `querySelector`, and the CSS engine pierces open shadow roots the
+ * way a widget's own checkbox is usually rendered.
+ */
+async function readFrameSurface(frame: Frame) {
+  const [text, checked] = await Promise.all([
+    frame
+      .locator("body")
+      .innerText({ timeout: CHALLENGE_FRAME_TEXT_TIMEOUT_MS })
+      .catch(() => ""),
+    frame
+      .locator(CHALLENGE_CHECKED_SELECTOR)
+      .count()
+      .then((count) => count > 0)
+      .catch(() => false),
+  ]);
+  return { text: text.slice(0, CHALLENGE_FRAME_TEXT_LIMIT), checked };
+}
+
+function claimUnique(pool, matches) {
+  let found = null;
+  for (const entry of pool) {
+    if (entry.used || !matches(entry)) continue;
+    // Two candidates identify nothing: duplicate ad frames and duplicate
+    // widgets share both name and URL, and guessing between them would attach
+    // one frame's visibility to the other.
+    if (found) return null;
+    found = entry;
+  }
+  if (found) found.used = true;
+  return found;
+}
+
+// Playwright's `frame.name()` reports the frame element's name attribute and
+// falls back to its id, so both identify a frame exactly. `src` is the element
+// attribute, which only equals `frame.url()` while the frame has not navigated
+// itself. Anything left over is resolved through its own element instead of
+// being guessed at: a descriptor borrowed from a sibling could report
+// `visible: false`, and that is the one value that makes the detector drop a
+// real challenge.
+function matchFrameDescriptor(frame: Frame, pool) {
+  if (!pool.length) return null;
+  const name = frame.name();
+  const byName = name ? claimUnique(pool, (entry) => entry.name === name) : null;
+  if (byName) return byName;
+  const url = frame.url();
+  return url ? claimUnique(pool, (entry) => entry.src && entry.src === url) : null;
+}
+
+async function resolveFramePresentation(frame: Frame) {
+  return frame
+    .frameElement()
+    .then(async (element) => {
+      try {
+        return await element.evaluate(readFramePresentationInPage);
+      } finally {
+        await element.dispose().catch(() => {});
+      }
+    })
+    .catch(() => null);
+}
+
+// Stage 2 of the challenge scan: two parallel locator reads per frame instead
+// of the five sequential CDP round-trips (frameElement, rect/style, dispose,
+// innerText, checkbox count) this used to cost, with the geometry coming from
+// the parent's single descriptor walk. `mainDescriptors` is the main frame's
+// share of that, already collected by stage 1.
+async function collectFrameMetadata(page: Page, childFrames: Frame[], mainDescriptors) {
+  if (!childFrames.length) return [];
+  const mainFrame = page.mainFrame();
+  const parents = new Set();
+  for (const frame of childFrames) {
+    const parent = frame.parentFrame();
+    if (parent && parent !== mainFrame) parents.add(parent);
+  }
+  const surfaces = new Map();
+  const walks = new Map();
+  await Promise.all([
+    ...childFrames.map(async (frame) => {
+      surfaces.set(frame, await readFrameSurface(frame));
+    }),
+    ...[...parents].map(async (frame) => {
+      walks.set(
+        frame,
+        await readFrameWalk(frame, {
+          frameLimit: CHALLENGE_FRAME_LIMIT,
+          frameTextLimit: CHALLENGE_FRAME_TEXT_LIMIT,
+          wantFrameText: false,
+          walkBudgetMs: CHALLENGE_WALK_BUDGET_MS,
+        }),
+      );
+    }),
+  ]);
+
+  const pools = new Map();
+  const poolFor = (parent) => {
+    if (!parent) return [];
+    if (!pools.has(parent)) {
+      const source =
+        parent === mainFrame ? mainDescriptors : walks.get(parent)?.iframes;
+      pools.set(
+        parent,
+        (source || []).map((entry) => ({ ...entry, used: false })),
+      );
+    }
+    return pools.get(parent);
+  };
+
+  const presentations = new Map();
+  for (const frame of childFrames) {
+    presentations.set(
+      frame,
+      matchFrameDescriptor(frame, poolFor(frame.parentFrame())),
+    );
+  }
+  await Promise.all(
+    childFrames
+      .filter((frame) => !presentations.get(frame))
+      .map(async (frame) => {
+        presentations.set(frame, await resolveFramePresentation(frame));
+      }),
+  );
+
+  return childFrames.map((frame) => {
+    const surface = surfaces.get(frame) || { text: "", checked: false };
+    const presentation = presentations.get(frame) || null;
+    return {
+      url: frame.url(),
+      text: surface.text,
+      visible: presentation?.visible ?? null,
+      width: presentation?.width ?? null,
+      height: presentation?.height ?? null,
+      completed: surface.checked || CHALLENGE_COMPLETED_TEXT.test(surface.text),
+    };
+  });
+}
+
+// Stage 1 always runs; stage 2 runs only when `options.gate` says so. Without a
+// gate the full scan runs, which is what the captcha-solving paths need. The
+// returned shape is identical either way — a skipped stage 2 reports no frames,
+// exactly as a frame-free page does.
+//
+// The four stage-1 reads are issued together and degrade independently, so one
+// slow field cannot blank the others: an empty `tokens` in particular would
+// re-report a solved challenge and burn the solver's attempt budget.
+export async function collectChallengeMetadata(page: Page, options: any = {}) {
+  const [title, text, tokens, walk] = await Promise.all([
+    page.title().catch(() => ""),
+    page
+      .locator("body")
+      .innerText({ timeout: CHALLENGE_MAIN_TEXT_TIMEOUT_MS })
+      .catch(() => ""),
+    readSolvedProviders(page),
+    readFrameWalk(page, {
+      frameLimit: CHALLENGE_FRAME_LIMIT,
+      frameTextLimit: CHALLENGE_FRAME_TEXT_LIMIT,
+      // Frame text is only read when a gate will judge it; the full scan reads
+      // every frame itself and would otherwise pay for the same text twice.
+      wantFrameText: Boolean(options.gate),
+      walkBudgetMs: CHALLENGE_WALK_BUDGET_MS,
+    }),
+  ]);
+  const main = {
+    url: page.url(),
+    title,
+    text: text.slice(0, CHALLENGE_MAIN_TEXT_LIMIT),
+  };
+
+  let childFrames = [];
+  try {
+    childFrames = page
+      .frames()
+      .filter((frame) => frame !== page.mainFrame())
+      .slice(0, CHALLENGE_FRAME_LIMIT);
+  } catch {
+    // A page that closed mid-scan still reports its main-frame metadata.
+  }
+
+  const scanFrames = options.gate
+    ? options.gate({ main, tokens, childFrames, sameOrigin: walk.sameOrigin })
+    : true;
+  const frames = scanFrames
+    ? await collectFrameMetadata(page, childFrames, walk.iframes)
+    : [];
+  return { main, frames, solvedProviders: Object.keys(tokens), tokens };
+}
+
+export function createChallengeScanner<Session extends ChallengeSession>({
+  captureScreenshot,
+  pageId,
+  lastBlockedDocumentAt,
+}: ChallengeScanDeps<Session>) {
+  // The gate itself lives in challenges.ts so it cannot drift from the detector
+  // it has to agree with; this only reads the per-page state it needs.
+  //
+  // Each frame stage 2 would scan contributes exactly one source. Same-origin
+  // frames carry the text and visibility stage 1 already read, so the gate judges
+  // them on the same evidence the full scan would. Cross-origin frames carry only
+  // a URL and are flagged `readable: false`, which is what makes the gate treat
+  // them as unknown rather than as benign.
+  function challengeScanState(session: Session, page: Page, { main, tokens, childFrames, sameOrigin }) {
+    const readable = new Map();
+    for (const entry of sameOrigin || []) {
+      const queued = readable.get(entry.url);
+      if (queued) queued.push(entry);
+      else readable.set(entry.url, [entry]);
+    }
+    const frames = childFrames.map((frame) => {
+      const entry = readable.get(frame.url())?.shift();
+      return entry ? { ...entry, readable: true } : { url: frame.url(), readable: false };
+    });
+    // Anything the walk read that no live frame claimed is still evidence.
+    for (const queued of readable.values()) {
+      for (const entry of queued) frames.push({ ...entry, readable: true });
+    }
+    return {
+      openProviders: session.openChallengeProviders,
+      blockedAt: lastBlockedDocumentAt(page) || 0,
+      now: Date.now(),
+      main,
+      frames,
+      solvedProviders: Object.keys(tokens),
+    };
+  }
+
+  async function detectSessionChallenges(session: Session) {
+    const challenges = [];
+    const activePage = session.currentId
+      ? session.pages.get(session.currentId)
+      : null;
+    const pages =
+      activePage && !activePage.isClosed()
+        ? [activePage]
+        : [...session.pages.values()].filter((page) => !page.isClosed()).slice(0, 1);
+    let scanned = false;
+    for (const page of pages) {
+      if (page.isClosed()) continue;
+      const metadata = await collectChallengeMetadata(page, {
+        gate: (surface) => challengeScanNeeded(challengeScanState(session, page, surface)),
+      });
+      scanned = true;
+      const challenge = detectBotChallenge(metadata);
+      if (challenge) {
+        const classification = classifyChallengeStage({
+          ...metadata,
+          provider: challenge.provider,
+          type: challenge.type,
+        });
+        const reported: any = {
+          pageId: pageId(page),
+          ...challenge,
+          stage: classification.stage,
+          autoSolvable: classification.autoSolvable,
+          needsVision: classification.needsVision,
+        };
+        try {
+          const file = await captureScreenshot(
+            page,
+            session,
+            "captcha-detected.png",
+            "captcha-detected.png",
+            { type: "png", animations: "disabled" },
+          );
+          const artifact = { kind: "captcha", path: file, media: `MEDIA:${file}` };
+          session.artifacts.push(artifact);
+          reported.artifact = artifact;
+        } catch {
+          // Challenge reporting must survive pages that close or cannot be captured.
+        }
+        challenges.push(reported);
+      }
+    }
+    // Written only from a completed scan, and a scan that finds nothing writes an
+    // empty set — so a solved or navigated-away challenge always releases the
+    // gate instead of pinning every later execute on the full frame walk.
+    if (scanned) {
+      session.openChallengeProviders = new Set(
+        challenges.map((entry) => entry.provider).filter(Boolean),
+      );
+    }
+    return challenges;
+  }
+
+  return { detectSessionChallenges };
+}
+
+export function markChallengesForWorkerRestart(challenges) {
+  return challenges.map((challenge) => ({
+    ...challenge,
+    solve: {
+      ...challenge.solve,
+      resumeOnClear: false,
+      reopenRequired: true,
+    },
+    recovery: {
+      pagePreserved: false,
+      reopenUrl: challenge.url,
+    },
+    advice:
+      "A bot challenge was visible when the browser run had to be restarted, so " +
+      "this page cannot be preserved. In the next browser call, reopen the reported " +
+      "URL, inspect the attached challenge image and fresh snapshot, solve up to " +
+      "three distinct stages with the native CAPTCHA or human helpers, then resume " +
+      "the original task. Use a host web-research tool, first-party route, or human " +
+      "handoff if it remains unresolved.",
+  }));
+}
diff --git a/src/untrusted-value.ts b/src/untrusted-value.ts
index fad15a8..31f19f3 100644
--- a/src/untrusted-value.ts
+++ b/src/untrusted-value.ts
@@ -35,6 +35,11 @@ export function isRecord(value: UntrustedValue): value is UntrustedValue & objec
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
+/** Unlike isRecord, this worker payload check also admits arrays. */
+export function isObjectValue(value: UntrustedValue): value is UntrustedValue & object {
+  return typeof value === "object" && value !== null;
+}
+
 /**
  * Read one property of an untrusted value with ordinary lookup semantics
  * (prototype chain included, so duck-typing probes see methods), yielding
diff --git a/src/worker-artifacts.ts b/src/worker-artifacts.ts
new file mode 100644
index 0000000..12f06fa
--- /dev/null
+++ b/src/worker-artifacts.ts
@@ -0,0 +1,560 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import type {
+  CDPSession,
+  Page,
+} from "playwright-core";
+import { mkdirPrivate, writePrivateBytes } from "./fs-private.js";
+import type {
+  RecordingHandle,
+  RecordingOptions,
+  RecordingStatus,
+} from "./recording.js";
+import { parseAnnotationBoxes } from "./snapshot.js";
+import {
+  isRecord,
+  isString,
+  type UntrustedValue,
+  untrustedField,
+} from "./untrusted-value.js";
+
+export const MAX_TRACKED_ARTIFACTS = 500;
+export const DEFAULT_ARTIFACT_QUOTA = 100 * 1024 * 1024;
+export const DEFAULT_DOWNLOAD_LIMIT = 50 * 1024 * 1024;
+export const DEFAULT_SCREENSHOT_LIMIT = 10 * 1024 * 1024;
+export const DEFAULT_SCREENSHOT_PIXEL_LIMIT = 40_000_000;
+export const DEFAULT_RECORDING_LIMIT = 50 * 1024 * 1024;
+export const DEFAULT_SCREENSHOT_TIMEOUT_MS = 15_000;
+
+export const ANNOTATION_OVERLAY_ID = "__betterwright_annotations__";
+
+export interface WorkerArtifactSession {
+  id: string;
+  pages: Map<string, Page>;
+  artifacts: Array<{ kind: string; path: string; mimeType?: string }>;
+  warnings: string[];
+  reservedArtifactBytes: number;
+}
+
+export interface WorkerArtifactConfig {
+  artifactsDir: string;
+  maxArtifactBytes?: number;
+  maxDownloadBytes?: number;
+  maxScreenshotBytes?: number;
+  maxScreenshotPixels?: number;
+}
+
+export type RecordingOwner = {
+  handle: RecordingHandle;
+  page: Page;
+  path: string;
+};
+
+export type SessionRecording =
+  | { state: "starting"; ready: Promise<RecordingOwner> }
+  | { state: "active"; page: Page; path: string; ready: Promise<RecordingOwner> }
+  | { state: "finished"; page: Page; path: string; result: RecordingStatus };
+
+export interface WorkerArtifactsDeps<Session extends WorkerArtifactSession> {
+  getConfig: () => WorkerArtifactConfig;
+  newCDPSession: (page: Page) => Promise<CDPSession>;
+  sessions: () => Iterable<Session>;
+  ensureSessionPage: (session: Session) => Promise<Page>;
+  pageId: (page: Page) => string;
+  wakeSessionPages: (session: Session) => Promise<void>;
+  quietSessionPages: (session: Session) => void;
+  redactText: (value: UntrustedValue) => string;
+  actionTimeoutMs: number;
+}
+
+export function createWorkerArtifacts<Session extends WorkerArtifactSession>(
+  deps: WorkerArtifactsDeps<Session>,
+) {
+  const sessionRecordings = new Map<string, SessionRecording>();
+
+  function configuredLimit(value, fallback) {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+  }
+
+  function safeName(value, fallback = "artifact") {
+    const base = path.basename(String(value || fallback));
+    const cleaned = base.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^[-.]+/, "");
+    return (cleaned || fallback).slice(0, 160);
+  }
+
+  function uniqueName(name) {
+    const ext = path.extname(name);
+    const stem = path.basename(name, ext);
+    return `${stem}-${Date.now()}-${crypto.randomBytes(3).toString("hex")}${ext}`;
+  }
+
+  function artifactDir(session: Session) {
+    const root = deps.getConfig().artifactsDir;
+    const safeSession = crypto
+      .createHash("sha256")
+      .update(session.id)
+      .digest("hex")
+      .slice(0, 16);
+    const dir = path.join(root, safeSession);
+    mkdirPrivate(dir);
+    return dir;
+  }
+
+  function downloadByteLimit() {
+    const config = deps.getConfig();
+    return Math.min(
+      configuredLimit(config.maxDownloadBytes, DEFAULT_DOWNLOAD_LIMIT),
+      configuredLimit(config.maxArtifactBytes, DEFAULT_ARTIFACT_QUOTA),
+    );
+  }
+
+  function pruneArtifactQuota(session: Session, incomingBytes = 0) {
+    const root = artifactDir(session);
+    const limit = configuredLimit(
+      deps.getConfig().maxArtifactBytes,
+      DEFAULT_ARTIFACT_QUOTA,
+    );
+    if (incomingBytes > limit) {
+      throw new Error(`Browser artifact exceeds the ${limit}-byte artifact limit.`);
+    }
+    let total = Number(session.reservedArtifactBytes) || 0;
+    const files: Array<{ file: string; size: number; mtime: number }> = [];
+    for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+      if (!entry.isFile()) continue;
+      const file = path.join(root, entry.name);
+      const recording = sessionRecordings.get(session.id);
+      if (recording?.state === "active" && recording.path === file) continue;
+      const stat = fs.statSync(file);
+      total += stat.size;
+      files.push({ file, size: stat.size, mtime: stat.mtimeMs });
+    }
+    if (total + incomingBytes <= limit) return;
+    files.sort((left, right) => left.mtime - right.mtime);
+    for (const item of files) {
+      if (total + incomingBytes <= limit) break;
+      fs.rmSync(item.file, { force: true });
+      total -= item.size;
+      session.warnings.push(
+        `Artifact quota removed ${path.basename(item.file)}.`,
+      );
+    }
+    if (total + incomingBytes > limit) {
+      throw new Error(`Browser artifact quota cannot reserve ${incomingBytes} bytes.`);
+    }
+  }
+
+  function reserveArtifactQuota(session: Session, bytes) {
+    pruneArtifactQuota(session, bytes);
+    session.reservedArtifactBytes += bytes;
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      session.reservedArtifactBytes = Math.max(
+        0,
+        session.reservedArtifactBytes - bytes,
+      );
+    };
+  }
+
+  function writeBoundedArtifact(
+    session: Session,
+    file,
+    content,
+    perFileLimit,
+    label,
+  ) {
+    if (!Buffer.isBuffer(content)) throw new Error(`${label} did not produce bytes.`);
+    if (content.length > perFileLimit) {
+      throw new Error(`${label} exceeds the ${perFileLimit}-byte limit.`);
+    }
+    pruneArtifactQuota(session, content.length);
+    writePrivateBytes(file, content);
+  }
+
+  function makeArtifactPath(
+    session: Session,
+    requested,
+    fallback = "artifact.txt",
+    track = true,
+  ) {
+    const recordingSlots = sessionRecordings.get(session.id)?.state === "active" ? 1 : 0;
+    if (session.artifacts.length + recordingSlots >= MAX_TRACKED_ARTIFACTS) {
+      throw new Error(
+        `Browser artifact limit (${MAX_TRACKED_ARTIFACTS}) reached for this session.`,
+      );
+    }
+    const name = uniqueName(safeName(requested, fallback));
+    const file = path.join(artifactDir(session), name);
+    if (track) session.artifacts.push({ kind: "artifact", path: file });
+    return file;
+  }
+
+  async function startSessionRecording(
+    session: Session,
+    options: RecordingOptions = {},
+  ) {
+    if (!isRecord(options)) {
+      throw new TypeError("recording.start options must be an object.");
+    }
+    const requested = untrustedField(options, "name") ?? "recording.mp4";
+    if (!isString(requested) || !requested.trim() ||
+        requested !== path.basename(requested) || requested !== path.win32.basename(requested) ||
+        !/\.(mp4|webm)$/i.test(requested)) {
+      throw new TypeError("Recording name must be a .mp4 or .webm filename without directories.");
+    }
+    const current = sessionRecordings.get(session.id);
+    if (current && current.state !== "finished") {
+      throw new Error("A recording is already active in this session. Stop it or use recording.restart().");
+    }
+    const pending: Extract<SessionRecording, { state: "starting" }> = {
+      state: "starting",
+      ready: Promise.resolve().then(async () => {
+        let release = () => {};
+        let page: Page | undefined;
+        let active: Extract<SessionRecording, { state: "active" }> | undefined;
+        const onPageClosed = () => {
+          void pending.ready.then(({ handle }) => handle.stop()).catch(() => {});
+        };
+        try {
+          const { normalizeRecordingOptions, startRecording } = await import("./recording.js");
+          const settings = normalizeRecordingOptions(options);
+          page = await deps.ensureSessionPage(session);
+          const file = makeArtifactPath(session, requested, "recording.mp4", false);
+          const maxBytes = Math.max(1, Math.floor(Math.min(
+            DEFAULT_RECORDING_LIMIT,
+            configuredLimit(deps.getConfig().maxArtifactBytes, DEFAULT_ARTIFACT_QUOTA) / 2,
+          )));
+          release = reserveArtifactQuota(session, maxBytes);
+          active = { state: "active", page, path: file, ready: pending.ready };
+          sessionRecordings.set(session.id, active);
+          page.once("close", onPageClosed);
+          page.once("crash", onPageClosed);
+          await deps.wakeSessionPages(session);
+          const cdp = await deps.newCDPSession(page);
+          const handle = await startRecording({
+            cdp,
+            path: file,
+            options: settings,
+            maxBytes,
+            onStop: (result) => {
+              release();
+              page.off("close", onPageClosed);
+              page.off("crash", onPageClosed);
+              if (sessionRecordings.get(session.id) !== active) return;
+              sessionRecordings.set(session.id, { state: "finished", page, path: file, result });
+              if (result.state === "completed") {
+                session.artifacts.push({ kind: "recording", path: file, mimeType: /\.webm$/i.test(file) ? "video/webm" : "video/mp4" });
+              } else if (result.state === "failed") {
+                session.warnings.push(`Recording failed: ${deps.redactText(result.error)}`);
+              }
+              deps.quietSessionPages(session);
+            },
+          });
+          return { handle, page, path: file };
+        } catch (error) {
+          release();
+          page?.off("close", onPageClosed);
+          page?.off("crash", onPageClosed);
+          const entry = sessionRecordings.get(session.id);
+          if (entry === pending || entry === active) sessionRecordings.delete(session.id);
+          throw error;
+        }
+      }),
+    };
+    sessionRecordings.set(session.id, pending);
+    const { handle, page } = await pending.ready;
+    return Object.assign(Object.create(null), handle.status(), { pageId: deps.pageId(page) });
+  }
+
+  async function sessionRecordingStatus(session: Session) {
+    const entry = sessionRecordings.get(session.id);
+    if (!entry) return Object.assign(Object.create(null), { state: "idle" });
+    if (entry.state === "finished") {
+      return Object.assign(Object.create(null), entry.result, { pageId: deps.pageId(entry.page) });
+    }
+    const { handle, page } = await entry.ready;
+    return Object.assign(Object.create(null), handle.status(), { pageId: deps.pageId(page) });
+  }
+
+  async function stopSessionRecording(session: Session) {
+    const entry = sessionRecordings.get(session.id);
+    if (!entry) return Object.assign(Object.create(null), { state: "idle" });
+    if (entry.state === "finished") {
+      return Object.assign(Object.create(null), entry.result, { pageId: deps.pageId(entry.page) });
+    }
+    const { handle, page } = await entry.ready;
+    return Object.assign(Object.create(null), await handle.stop(), { pageId: deps.pageId(page) });
+  }
+
+  async function stopPageRecording(page: Page) {
+    for (const session of deps.sessions()) {
+      if (![...session.pages.values()].includes(page)) continue;
+      const entry = sessionRecordings.get(session.id);
+      if (!entry || entry.state === "finished") continue;
+      const owner = await entry.ready.catch(() => undefined);
+      if (owner?.page === page) await owner.handle.stop();
+    }
+  }
+
+  function sessionRecordingIsBusy(sessionId: string) {
+    const recording = sessionRecordings.get(sessionId);
+    return recording?.state === "starting" || recording?.state === "active";
+  }
+
+  function pageRecordingIsBusy(sessionId: string, page: Page) {
+    const recording = sessionRecordings.get(sessionId);
+    return recording?.state === "starting" ||
+      (recording?.state === "active" && recording.page === page);
+  }
+
+  async function assertScreenshotPixelLimit(page: Page, options) {
+    const scale = options.scale === "css"
+      ? 1
+      : await page
+          .evaluate(() => window.devicePixelRatio || 1)
+          .catch(() => 1);
+    const metrics = options.clip
+      ? {
+          width: Number(options.clip.width),
+          height: Number(options.clip.height),
+        }
+      : options.fullPage
+        ? await page.evaluate(() => ({
+            width: Math.max(
+              document.documentElement.scrollWidth,
+              document.body?.scrollWidth || 0,
+            ),
+            height: Math.max(
+              document.documentElement.scrollHeight,
+              document.body?.scrollHeight || 0,
+            ),
+          }))
+        : page.viewportSize() || { width: 1440, height: 900 };
+    const pixels =
+      Math.ceil(metrics.width * scale) * Math.ceil(metrics.height * scale);
+    const limit = configuredLimit(
+      deps.getConfig().maxScreenshotPixels,
+      DEFAULT_SCREENSHOT_PIXEL_LIMIT,
+    );
+    if (!Number.isFinite(pixels) || pixels <= 0 || pixels > limit) {
+      throw new Error(`Screenshot pixel limit (${limit}) exceeded.`);
+    }
+  }
+
+  function drawAnnotationOverlay({ boxes, fullPage, overlayId }) {
+    document.getElementById(overlayId)?.remove();
+    const root = document.createElement("div");
+    root.id = overlayId;
+    const dx = fullPage ? window.scrollX : 0;
+    const dy = fullPage ? window.scrollY : 0;
+    root.style.cssText =
+      `position:${fullPage ? "absolute" : "fixed"};left:0;top:0;width:0;` +
+      "height:0;z-index:2147483647;pointer-events:none;";
+    for (const box of boxes) {
+      const frame = document.createElement("div");
+      frame.style.cssText =
+        `position:absolute;left:${box.x + dx}px;top:${box.y + dy}px;` +
+        `width:${box.width}px;height:${box.height}px;` +
+        "border:2px solid #e11d48;border-radius:2px;box-sizing:border-box;";
+      const label = document.createElement("span");
+      label.textContent = box.ref;
+      label.style.cssText =
+        `position:absolute;left:-2px;top:${box.y + dy < 16 ? 0 : -16}px;` +
+        "background:#e11d48;color:#fff;font:11px/14px monospace;" +
+        "padding:0 3px;border-radius:2px;white-space:nowrap;";
+      frame.appendChild(label);
+      root.appendChild(frame);
+    }
+    document.body.appendChild(root);
+  }
+
+  function removeAnnotationOverlay(overlayId) {
+    document.getElementById(overlayId)?.remove();
+  }
+
+  async function addScreenshotAnnotations(page: Page, fullPage) {
+    const tree = await page.locator("body").ariaSnapshot({
+      mode: "ai",
+      boxes: true,
+      timeout: deps.actionTimeoutMs,
+    });
+    let boxes = parseAnnotationBoxes(tree);
+    if (!fullPage) {
+      const viewport = page.viewportSize();
+      if (viewport)
+        boxes = boxes.filter(
+          (box) =>
+            box.x < viewport.width &&
+            box.y < viewport.height &&
+            box.x + box.width > 0 &&
+            box.y + box.height > 0,
+        );
+    }
+    await page.evaluate(drawAnnotationOverlay, {
+      boxes,
+      fullPage: Boolean(fullPage),
+      overlayId: ANNOTATION_OVERLAY_ID,
+    });
+    return boxes.length;
+  }
+
+  async function removeScreenshotAnnotations(page: Page) {
+    await page.evaluate(removeAnnotationOverlay, ANNOTATION_OVERLAY_ID).catch(() => {});
+  }
+
+  async function writeScreenshotBytes(
+    session: Session,
+    requested,
+    fallback,
+    content,
+  ) {
+    const perFileLimit = configuredLimit(
+      deps.getConfig().maxScreenshotBytes,
+      DEFAULT_SCREENSHOT_LIMIT,
+    );
+    if (content.length > perFileLimit) {
+      throw new Error(`Screenshot exceeds the ${perFileLimit}-byte limit.`);
+    }
+    const file = makeArtifactPath(session, requested, fallback, false);
+    writeBoundedArtifact(session, file, content, perFileLimit, "Screenshot");
+    return file;
+  }
+
+  async function cssScreenshotClip(page: Page, options) {
+    if (options?.clip) {
+      return {
+        x: Math.max(0, Number(options.clip.x) || 0),
+        y: Math.max(0, Number(options.clip.y) || 0),
+        width: Math.max(1, Number(options.clip.width) || 1),
+        height: Math.max(1, Number(options.clip.height) || 1),
+        scale: 1,
+      };
+    }
+    if (options?.fullPage) {
+      const size = await page.evaluate(() => ({
+        width: Math.max(
+          document.documentElement.scrollWidth,
+          document.body?.scrollWidth || 0,
+        ),
+        height: Math.max(
+          document.documentElement.scrollHeight,
+          document.body?.scrollHeight || 0,
+        ),
+      }));
+      return {
+        x: 0,
+        y: 0,
+        width: Math.max(1, Number(size.width) || 1),
+        height: Math.max(1, Number(size.height) || 1),
+        scale: 1,
+      };
+    }
+    const viewport = page.viewportSize() || { width: 1440, height: 900 };
+    return {
+      x: 0,
+      y: 0,
+      width: Math.max(1, Number(viewport.width) || 1),
+      height: Math.max(1, Number(viewport.height) || 1),
+      scale: 1,
+    };
+  }
+
+  async function captureScreenshotViaCdp(
+    page: Page,
+    session: Session,
+    requested,
+    fallback,
+    options,
+  ) {
+    const cdp = await page.context().newCDPSession(page);
+    try {
+      const format: "jpeg" | "png" = options?.type === "jpeg" ? "jpeg" : "png";
+      const params = {
+        format,
+        fromSurface: true,
+        captureBeyondViewport: Boolean(options?.fullPage) && !options?.clip,
+        clip: await cssScreenshotClip(page, options),
+      };
+      const shot = await cdp.send(
+        "Page.captureScreenshot",
+        format === "jpeg"
+          ? { ...params, quality: Number(options?.quality) || 80 }
+          : params,
+      );
+      const content = Buffer.from(String(shot?.data || ""), "base64");
+      if (!content.length) throw new Error("CDP screenshot returned no bytes.");
+      return writeScreenshotBytes(session, requested, fallback, content);
+    } finally {
+      await cdp.detach().catch(() => {});
+    }
+  }
+
+  async function captureScreenshot(
+    page: Page,
+    session: Session,
+    requested,
+    fallback,
+    options,
+  ) {
+    // Preserve the browser-visible devicePixelRatio, screen geometry, rendering
+    // surface and WebGPU identity while encoding proof artifacts at one output
+    // pixel per CSS pixel. The captured macOS profile uses DPR 2, so device-scale
+    // output quadrupled screenshot surface area without adding useful evidence.
+    // `scale: "css"` affects only the trusted artifact encoder; page APIs and
+    // layout remain identical.
+    const screenshotOptions = {
+      scale: "css",
+      timeout: DEFAULT_SCREENSHOT_TIMEOUT_MS,
+      ...options,
+    };
+    await assertScreenshotPixelLimit(page, screenshotOptions);
+    try {
+      const content = await page.screenshot(screenshotOptions);
+      return writeScreenshotBytes(session, requested, fallback, content);
+    } catch {
+      // hCaptcha and similar widgets often leave `document.fonts` pending;
+      // CDP captures the current surface without that wait.
+      try {
+        return await captureScreenshotViaCdp(
+          page,
+          session,
+          requested,
+          fallback,
+          screenshotOptions,
+        );
+      } catch {
+        if (!screenshotOptions.clip) throw new Error("Screenshot capture failed.");
+        const uncropped = { ...screenshotOptions };
+        delete uncropped.clip;
+        return captureScreenshotViaCdp(
+          page,
+          session,
+          requested,
+          fallback,
+          uncropped,
+        );
+      }
+    }
+  }
+
+  return {
+    sessionRecordings,
+    artifactDir,
+    downloadByteLimit,
+    pruneArtifactQuota,
+    reserveArtifactQuota,
+    makeArtifactPath,
+    startSessionRecording,
+    sessionRecordingStatus,
+    stopSessionRecording,
+    stopPageRecording,
+    sessionRecordingIsBusy,
+    pageRecordingIsBusy,
+    addScreenshotAnnotations,
+    removeScreenshotAnnotations,
+    captureScreenshot,
+  };
+}
diff --git a/src/worker-human.ts b/src/worker-human.ts
new file mode 100644
index 0000000..f6f89a2
--- /dev/null
+++ b/src/worker-human.ts
@@ -0,0 +1,223 @@
+// Trusted input helpers shared by credentials and the snippet API.
+import { captchaBounds } from "./captcha-runtime.js";
+import { movePointer, pointInside, pressPointer, typedTextLanded } from "./human.js";
+import { isBoolean, isCallable, isObjectValue, isString, type UntrustedFunction, type UntrustedValue, untrustedField } from "./untrusted-value.js";
+
+interface HumanInputDeps {
+  unwrap: (value: UntrustedValue) => UntrustedValue;
+  objectKind: (value: UntrustedValue) => string;
+  actionTimeoutMs: number;
+}
+
+export function createHumanInput({ unwrap, objectKind, actionTimeoutMs: DEFAULT_ACTION_TIMEOUT_MS }: HumanInputDeps) {
+  function unwrapHumanTarget(page, value) {
+    if (isString(value)) return page.locator(value).first();
+    const raw = unwrap(value);
+    if (["Locator", "ElementHandle"].includes(objectKind(raw))) return raw;
+    if (isObjectValue(value)) return captchaBounds(value, "target");
+    throw new Error(
+      "human target must be a selector, Locator, ElementHandle, or bounds object.",
+    );
+  }
+
+  async function humanTargetBox(page, value, timeout = DEFAULT_ACTION_TIMEOUT_MS, inputLikeOverride) {
+    const target = unwrapHumanTarget(page, value);
+    if (!isCallable(untrustedField(target, "boundingBox"))) {
+      return { target: null, box: target, inputLike: false };
+    }
+    await target.scrollIntoViewIfNeeded?.({ timeout });
+    const box = await target.boundingBox({ timeout });
+    if (!box) throw new Error("human target is not visible.");
+    const inputLike =
+      isBoolean(inputLikeOverride)
+        ? inputLikeOverride
+        : await target
+            .evaluate(
+              (element) =>
+                ["INPUT", "TEXTAREA", "SELECT"].includes(element.tagName) ||
+                element.isContentEditable,
+            )
+            .catch(() => false);
+    return { target, box, inputLike };
+  }
+
+  async function humanClickTarget(page, session, value, options: any = {}) {
+    const timeout = Math.max(1, Number(options?.timeout) || DEFAULT_ACTION_TIMEOUT_MS);
+    const { target, box, inputLike } = await humanTargetBox(
+      page,
+      value,
+      timeout,
+      options?.inputLike,
+    );
+    const point = pointInside(box, inputLike);
+    await movePointer(page.mouse, session.cursor, point, options);
+    await pressPointer(page.mouse, inputLike);
+    return target;
+  }
+
+  // Select a target's existing text so the next Backspace clears it. The
+  // obvious `Control+A` chord is not reliable: the Chromium fork does not run
+  // the select-all editing command for synthesized keyboard events (stock
+  // Chromium does), so the chord silently left the old text in place and typed
+  // text landed in front of it. Selecting through the element works on every
+  // build and inside iframes, and raises the same `select` event a real
+  // shortcut would; the chord remains only for bounds-style targets that have
+  // no element to select through.
+  async function selectAllForClear(page, target) {
+    if (target && isCallable(untrustedField(target, "evaluate"))) {
+      await target.evaluate((element) => {
+        const isCallableValue = (value: UntrustedValue): value is UntrustedFunction =>
+          typeof value === "function";
+        if (isCallableValue(element.select)) {
+          element.select();
+          return;
+        }
+        if (element.isContentEditable) {
+          const selection = element.ownerDocument.defaultView?.getSelection();
+          if (!selection) return;
+          const range = element.ownerDocument.createRange();
+          range.selectNodeContents(element);
+          selection.removeAllRanges();
+          selection.addRange(range);
+        }
+      });
+      return;
+    }
+    await page.keyboard.press(process.platform === "darwin" ? "Meta+A" : "Control+A");
+  }
+
+  async function readTypedFieldText(target) {
+    if (!target || !isCallable(untrustedField(target, "evaluate"))) return null;
+    return target.evaluate((element) => {
+      if (
+        element instanceof HTMLInputElement ||
+        element instanceof HTMLTextAreaElement
+      ) {
+        return String(element.value ?? "");
+      }
+      return String(element.innerText ?? element.textContent ?? "");
+    });
+  }
+
+  async function restoreTypedFieldText(target, text) {
+    const value = String(text ?? "");
+    if (!target) return;
+    if (isCallable(untrustedField(target, "evaluate"))) {
+      await target.evaluate((element, next) => {
+        const isCallableValue = (value: UntrustedValue): value is UntrustedFunction =>
+          typeof value === "function";
+        if (
+          element instanceof HTMLInputElement ||
+          element instanceof HTMLTextAreaElement
+        ) {
+          element.value = next;
+          element.dispatchEvent(new Event("input", { bubbles: true }));
+          return;
+        }
+        if (!element.isContentEditable) return;
+        if (isCallableValue(element.focus)) element.focus();
+        const selection = element.ownerDocument.defaultView?.getSelection();
+        if (selection) {
+          const range = element.ownerDocument.createRange();
+          range.selectNodeContents(element);
+          selection.removeAllRanges();
+          selection.addRange(range);
+        }
+        const doc = element.ownerDocument;
+        if (!isCallableValue(doc.execCommand)) return;
+        if (next) doc.execCommand("insertText", false, next);
+        else doc.execCommand("delete");
+      }, value);
+    }
+    const after = await readTypedFieldText(target);
+    if (after != null && !typedFieldMatches(after, value)) {
+      throw new Error("human.type could not replace the field contents.");
+    }
+  }
+
+  function typedFieldMatches(actual, expected) {
+    if (expected === "") return String(actual).trim().length === 0;
+    return String(actual) === String(expected);
+  }
+
+  async function clearTypedField(page, target) {
+    await selectAllForClear(page, target);
+    await page.keyboard.press("Backspace");
+    const afterClear = await readTypedFieldText(target);
+    if (afterClear != null && afterClear.trim().length > 0) {
+      await restoreTypedFieldText(target, "");
+    }
+  }
+
+  async function moveTypedFieldCaretToEnd(page, target) {
+    if (target && isCallable(untrustedField(target, "evaluate"))) {
+      const positioned = await target.evaluate((element) => {
+        if (
+          element instanceof HTMLInputElement ||
+          element instanceof HTMLTextAreaElement
+        ) {
+          if (
+            element instanceof HTMLInputElement &&
+            !["text", "search", "url", "tel", "password"].includes(element.type)
+          ) return false;
+          const end = element.value.length;
+          element.setSelectionRange(end, end);
+          return true;
+        }
+        if (!element.isContentEditable) return false;
+        const selection = element.ownerDocument.defaultView?.getSelection();
+        if (!selection) return false;
+        const range = element.ownerDocument.createRange();
+        range.selectNodeContents(element);
+        range.collapse(false);
+        selection.removeAllRanges();
+        selection.addRange(range);
+        return true;
+      });
+      if (positioned) return;
+    }
+    await page.keyboard.press("End");
+  }
+
+  async function insertTypedText(page, target, text, before) {
+    const value = String(text);
+    if (!value) return;
+    if (target && isCallable(untrustedField(target, "focus"))) {
+      await target.focus().catch(() => {});
+    }
+    await moveTypedFieldCaretToEnd(page, target);
+    await page.keyboard.insertText(value);
+    const afterInsert = await readTypedFieldText(target);
+    if (afterInsert != null && typedTextLanded(value, before, afterInsert)) return;
+    if (!target || !isCallable(untrustedField(target, "evaluate"))) return;
+    await target.evaluate((element, inserted) => {
+      const isCallableValue = (value: UntrustedValue): value is UntrustedFunction =>
+        typeof value === "function";
+      if (isCallableValue(element.focus)) element.focus();
+      const doc = element.ownerDocument;
+      if (
+        isCallableValue(doc.execCommand) &&
+        doc.execCommand("insertText", false, inserted)
+      ) {
+        return;
+      }
+      const eventInit = {
+        bubbles: true,
+        composed: true,
+        inputType: "insertText",
+        data: inserted,
+      };
+      element.dispatchEvent(new InputEvent("beforeinput", eventInit));
+      element.dispatchEvent(new InputEvent("input", eventInit));
+    }, value);
+  }
+
+  return {
+    humanClickTarget,
+    clearTypedField,
+    moveTypedFieldCaretToEnd,
+    readTypedFieldText,
+    restoreTypedFieldText,
+    insertTypedText,
+  };
+}
diff --git a/src/worker-live-view.ts b/src/worker-live-view.ts
new file mode 100644
index 0000000..d0571d3
--- /dev/null
+++ b/src/worker-live-view.ts
@@ -0,0 +1,309 @@
+import type { BrowserContext, Page } from "playwright-core";
+
+import { createLiveViewServer } from "./live-view.js";
+import { liveViewHtml, liveViewLoginHtml } from "./live-view-html.js";
+import type { UntrustedValue } from "./untrusted-value.js";
+import { isObjectValue, untrustedField } from "./untrusted-value.js";
+import type { WorkerSession } from "./worker-session.js";
+
+type LiveViewServer = ReturnType<typeof createLiveViewServer>;
+type LiveViewStopOptions = Parameters<LiveViewServer["stop"]>[0];
+
+type WorkerResult = {
+  type: "result";
+  id: UntrustedValue;
+  [key: string]: UntrustedValue;
+};
+
+interface WorkerMessage {
+  id: UntrustedValue;
+  config?: UntrustedValue;
+  options?: UntrustedValue;
+  sessionId?: UntrustedValue;
+  prompt?: UntrustedValue;
+  question?: UntrustedValue;
+  timeoutMs?: UntrustedValue;
+  role?: UntrustedValue;
+  text?: UntrustedValue;
+  kind?: UntrustedValue;
+}
+
+interface WorkerLiveViewDeps {
+  getBrowserContext: () => BrowserContext | null;
+  sessions: ReadonlyMap<string, WorkerSession>;
+  sessionFor: (id: UntrustedValue) => WorkerSession;
+  pageOwner: (page: Page) => string | undefined;
+  adoptPage: (page: Page, sessionId: string) => Page;
+  wakeSessionPages: (session: WorkerSession) => Promise<void>;
+  ensureBrowser: (config: UntrustedValue) => Promise<BrowserContext>;
+  sendResult: (message: WorkerResult) => void;
+  redactText: (value: UntrustedValue) => string;
+  serverFactory?: typeof createLiveViewServer;
+}
+
+function currentBrowserContext(getBrowserContext: () => BrowserContext | null) {
+  const browserContext = getBrowserContext();
+  if (!browserContext) throw new Error("Browser context is not available.");
+  return browserContext;
+}
+
+export function createWorkerLiveView({
+  getBrowserContext,
+  sessions,
+  sessionFor,
+  pageOwner,
+  adoptPage,
+  wakeSessionPages,
+  ensureBrowser,
+  sendResult,
+  redactText,
+  serverFactory = createLiveViewServer,
+}: WorkerLiveViewDeps) {
+  let liveView: LiveViewServer | null = null;
+  let liveViewPreferredSession = "default";
+
+  function liveViewPages() {
+    const entries: Array<{
+      id: string;
+      page: Page;
+      sessionId: string;
+      active: boolean;
+    }> = [];
+    for (const [sessionId, session] of sessions) {
+      for (const [id, page] of session.pages) {
+        if (page.isClosed()) continue;
+        entries.push({
+          id,
+          page,
+          sessionId,
+          active: session.currentId === id,
+        });
+      }
+    }
+    return entries;
+  }
+
+  /** Tell a running live view to stream the agent's current tab when it changed. */
+  function notifyLiveViewPreferred() {
+    try {
+      liveView?.followPreferred?.();
+    } catch {
+      /* live view must never break page adoption */
+    }
+  }
+
+  function ensureLiveView(preferredSessionId: UntrustedValue) {
+    liveViewPreferredSession = String(preferredSessionId || "default");
+    liveView ??= serverFactory({
+      html: liveViewHtml,
+      loginHtml: liveViewLoginHtml,
+      listPages: liveViewPages,
+      preferredPage: () => {
+        const session = sessions.get(liveViewPreferredSession);
+        const page = session?.currentId ? session.pages.get(session.currentId) : null;
+        return page && !page.isClosed() ? page : null;
+      },
+      newCDPSession: (page: Page) => currentBrowserContext(getBrowserContext).newCDPSession(page),
+      openPage: async () => {
+        // A human's + button opens the tab in the viewed session, through the
+        // same adoption path as agent pages. Page limits, listeners, policy,
+        // and parking behavior all apply identically.
+        const session = sessionFor(liveViewPreferredSession);
+        const page = await currentBrowserContext(getBrowserContext).newPage();
+        return adoptPage(page, session.id);
+      },
+      onHumanActivity: (page: Page) => {
+        const sessionId = pageOwner(page);
+        // Human input keeps the owning session warm exactly like model activity,
+        // so the idle reaper never closes tabs under a person's hands.
+        if (sessionId) sessionFor(sessionId);
+      },
+      log: (line: string) => process.stderr.write(`${line}\n`),
+    });
+    return liveView;
+  }
+
+  async function liveViewStart(message: WorkerMessage) {
+    try {
+      await ensureBrowser(message.config);
+      const options = isObjectValue(message.options) ? message.options : {};
+      const view = ensureLiveView(untrustedField(options, "session"));
+      // A viewer is about to watch these pages, so nothing may stay parked: the
+      // stream would show a still frame of a page whose script is switched off.
+      // hasView() keeps them awake from here on while the instance is owned.
+      for (const session of sessions.values()) await wakeSessionPages(session);
+      const info = await view.start(options);
+      sendResult({ type: "result", id: message.id, ...info });
+    } catch (error) {
+      sendResult({
+        type: "result",
+        id: message.id,
+        ok: false,
+        error: redactText(error?.message || String(error)),
+      });
+    }
+  }
+
+  async function stop(options?: LiveViewStopOptions) {
+    const view = liveView;
+    liveView = null;
+    await view?.stop(options);
+  }
+
+  async function liveViewStop(message: WorkerMessage) {
+    try {
+      await stop();
+      sendResult({ type: "result", id: message.id, ok: true, running: false });
+    } catch (error) {
+      sendResult({
+        type: "result",
+        id: message.id,
+        ok: false,
+        error: redactText(error?.message || String(error)),
+      });
+    }
+  }
+
+  function liveViewStatus(message: WorkerMessage) {
+    const info = liveView ? liveView.status() : { ok: true, running: false };
+    sendResult({ type: "result", id: message.id, ...info });
+  }
+
+  async function handoffWait(message: WorkerMessage) {
+    const session = sessionFor(message.sessionId);
+    try {
+      if (!liveView?.running) {
+        throw new Error("Live view is not running; start it before requesting a handoff.");
+      }
+      // The reaper hold used by the ask flow: pages stay alive for the whole
+      // human turn even if it outlasts the idle timeout.
+      session.awaitingAnswerSince = Date.now();
+      const outcome = await liveView.beginHandoff(String(message.prompt || ""), {
+        timeoutMs: Math.max(Number(message.timeoutMs) || 0, 1_000),
+      });
+      sendResult({
+        type: "result",
+        id: message.id,
+        ok: true,
+        action: untrustedField(outcome, "action"),
+        note: redactText(untrustedField(outcome, "note") || ""),
+      });
+    } catch (error) {
+      sendResult({
+        type: "result",
+        id: message.id,
+        ok: false,
+        error: redactText(error?.message || String(error)),
+      });
+    } finally {
+      session.awaitingAnswerSince = null;
+    }
+  }
+
+  async function askWait(message: WorkerMessage) {
+    const session = sessionFor(message.sessionId);
+    try {
+      if (!liveView?.running) {
+        throw new Error("Live view is not running; start it before requesting an ask.");
+      }
+      session.awaitingAnswerSince = Date.now();
+      const options = Array.isArray(message.options) ? message.options : [];
+      const outcome = await liveView.beginAsk(String(message.question || ""), {
+        options,
+        timeoutMs: Math.max(Number(message.timeoutMs) || 0, 1_000),
+      });
+      sendResult({
+        type: "result",
+        id: message.id,
+        ok: true,
+        action: untrustedField(outcome, "action"),
+        answer: redactText(untrustedField(outcome, "answer") || ""),
+      });
+    } catch (error) {
+      sendResult({
+        type: "result",
+        id: message.id,
+        ok: false,
+        error: redactText(error?.message || String(error)),
+      });
+    } finally {
+      session.awaitingAnswerSince = null;
+    }
+  }
+
+  function liveViewChatPost(message: WorkerMessage) {
+    try {
+      if (!liveView?.running) {
+        sendResult({
+          type: "result",
+          id: message.id,
+          ok: false,
+          error: "Live view is not running.",
+        });
+        return;
+      }
+      const posted = liveView.postChat({
+        role: String(message.role || "agent"),
+        text: String(message.text || ""),
+        kind: message.kind ? String(message.kind) : undefined,
+      });
+      sendResult({
+        type: "result",
+        id: message.id,
+        ok: true,
+        message: posted,
+      });
+    } catch (error) {
+      sendResult({
+        type: "result",
+        id: message.id,
+        ok: false,
+        error: redactText(error?.message || String(error)),
+      });
+    }
+  }
+
+  function liveViewChatDrain(message: WorkerMessage) {
+    try {
+      const messages = liveView?.running ? liveView.drainHumanMessages() : [];
+      sendResult({
+        type: "result",
+        id: message.id,
+        ok: true,
+        messages: messages.map((item) => ({
+          text: redactText(item.text || ""),
+          at: item.at,
+        })),
+      });
+    } catch (error) {
+      sendResult({
+        type: "result",
+        id: message.id,
+        ok: false,
+        error: redactText(error?.message || String(error)),
+      });
+    }
+  }
+
+  function setAgentState(state: "idle" | "driving") {
+    liveView?.setAgentState(state);
+  }
+
+  function hasView() {
+    return Boolean(liveView);
+  }
+
+  return {
+    liveViewStart,
+    liveViewStop,
+    liveViewStatus,
+    handoffWait,
+    askWait,
+    liveViewChatPost,
+    liveViewChatDrain,
+    notifyLiveViewPreferred,
+    setAgentState,
+    hasView,
+    stop,
+  };
+}
diff --git a/src/worker-realm.ts b/src/worker-realm.ts
new file mode 100644
index 0000000..715643c
--- /dev/null
+++ b/src/worker-realm.ts
@@ -0,0 +1,1048 @@
+import fs from "node:fs";
+import path from "node:path";
+import { types as utilTypes } from "node:util";
+import vm from "node:vm";
+import type { Page } from "playwright-core";
+import {
+  isPublicSearchNavigation,
+  PUBLIC_SEARCH_BLOCK_ADVICE,
+} from "./challenges.js";
+import {
+  applyNavigationDefaults,
+  navigateHistory,
+} from "./navigation-defaults.js";
+import {
+  type createSnippetPageEvents,
+  isSnippetPageEventMethod,
+} from "./page-events.js";
+import {
+  isBoolean,
+  isCallable,
+  isNumber,
+  isObjectValue,
+  isString,
+  type UntrustedValue,
+  untrustedField,
+} from "./untrusted-value.js";
+import type { WorkerSession } from "./worker-session.js";
+
+export interface WorkerRealmDependencies {
+  artifactsDir: () => string;
+  hostOwnedTarget: () => boolean;
+  hostUploadFiles: () => readonly string[] | undefined;
+  publicSearchPolicy: () => string | undefined;
+  useSetContentCompatibility: () => boolean;
+  stopPageRecording: (page: Page) => Promise<void>;
+  redactText: (value: UntrustedValue) => string;
+  redactDeep: <Value>(value: Value) => Value;
+  pageId: (page: Page) => string;
+  pageIds: WeakMap<object, string>;
+  defaultNavigationTimeoutMs: number;
+  maxResponsePages: number;
+}
+
+type SnippetPageEvents = ReturnType<typeof createSnippetPageEvents>;
+
+type RealmFactories = {
+  adopt: (value: UntrustedValue) => UntrustedValue;
+  installPage: (hostGetter: () => UntrustedValue) => void;
+  make: (hostFunction: (...args: UntrustedValue[]) => UntrustedValue) =>
+    (...args: UntrustedValue[]) => UntrustedValue;
+  makeTracked: (hostFunction: (...args: UntrustedValue[]) => UntrustedValue) =>
+    (...args: UntrustedValue[]) => Promise<UntrustedValue>;
+  makePages: (hostGetter: () => UntrustedValue[]) => UntrustedValue[];
+};
+
+export type WorkerRealm = {
+  context: vm.Context;
+  cache: WeakMap<object, UntrustedValue>;
+  adopt: RealmFactories["adopt"];
+  installPage: RealmFactories["installPage"];
+  safeFunction: RealmFactories["make"];
+  safeTrackedFunction: RealmFactories["makeTracked"];
+  makePages: RealmFactories["makePages"];
+  pageEvents: SnippetPageEvents;
+};
+
+// Page.on/once/off stay in the set so Request/Context/Frame never expose raw
+// EventEmitter hooks. wrap() substitutes a dispatcher that accepts only
+// console and pageerror, and cannot remove the worker's own listeners.
+const FORBIDDEN_PROPERTIES = new Set([
+  "addListener",
+  "browser",
+  "constructor",
+  "context",
+  "exposeBinding",
+  "exposeFunction",
+  "newCDPSession",
+  "off",
+  "on",
+  "once",
+  "prependListener",
+  "removeAllListeners",
+  "removeListener",
+  "request",
+  "route",
+  "routeFromHAR",
+  "routeWebSocket",
+  "screenshot",
+  "serviceWorkers",
+  "unroute",
+  "unrouteAll",
+]);
+const BROWSER_SERIALIZED_CALLBACK_METHODS = new Set([
+  "$eval",
+  "$$eval",
+  "addInitScript",
+  "evaluate",
+  "evaluateAll",
+  "evaluateHandle",
+  "waitForFunction",
+]);
+
+function isWrappableValue(value: UntrustedValue): value is UntrustedValue & object {
+  return (typeof value === "object" || typeof value === "function") && value !== null;
+}
+
+function isSymbolValue(value: UntrustedValue): value is symbol {
+  return typeof value === "symbol";
+}
+
+function isBigIntValue(value: UntrustedValue): value is bigint {
+  return typeof value === "bigint";
+}
+
+function isInvocable(
+  value: UntrustedValue,
+): value is (...args: UntrustedValue[]) => UntrustedValue {
+  return typeof value === "function";
+}
+
+export function createWorkerRealm(deps: WorkerRealmDependencies) {
+  const facadeToRaw = new WeakMap<object, UntrustedValue & object>();
+
+  function objectKind(value) {
+    try {
+      return String(value?.constructor?.name || "")
+        .replace(/^_+/, "")
+        .replace(/\d+$/, "");
+    } catch {
+      return "";
+    }
+  }
+
+  function propertyForbidden(value, property) {
+    if (
+      !isString(property) ||
+      property.startsWith("_") ||
+      FORBIDDEN_PROPERTIES.has(property)
+    )
+      return true;
+    const kind = objectKind(value);
+    if (
+      kind === "BrowserContext" &&
+      [
+        "addCookies",
+        "clearCookies",
+        "close",
+        "cookies",
+        "newPage",
+        "pages",
+        "setStorageState",
+        "storageState",
+        "tracing",
+      ].includes(property)
+    )
+      return true;
+    if (
+      kind === "Download" &&
+      ["createReadStream", "path", "saveAs"].includes(property)
+    )
+      return true;
+    if (
+      kind === "Request" &&
+      [
+        "allHeaders",
+        "headerValue",
+        "headersArray",
+      ].includes(property)
+    )
+      return true;
+    if (
+      kind === "Response" &&
+      [
+        "allHeaders",
+        "headerValue",
+        "headerValues",
+        "headersArray",
+      ].includes(property)
+    )
+      return true;
+    return false;
+  }
+
+  function filterModelHeaders(headers) {
+    const filtered = {};
+    for (const [name, value] of Object.entries(headers || {})) {
+      if (["cookie", "set-cookie"].includes(name.toLowerCase())) continue;
+      filtered[name] = value;
+    }
+    return filtered;
+  }
+
+  function isWithin(candidate, root) {
+    const relative = path.relative(path.resolve(root), path.resolve(candidate));
+    return (
+      relative === "" ||
+      (!relative.startsWith("..") && !path.isAbsolute(relative))
+    );
+  }
+
+  function assertReadableBrowserPath(candidate) {
+    if (!isString(candidate) || !candidate) return;
+    let resolved;
+    let root;
+    try {
+      resolved = fs.realpathSync(candidate);
+      root = fs.realpathSync(deps.artifactsDir());
+    } catch {
+      throw new Error(
+        "Browser file inputs must reference an existing file inside the artifact directory.",
+      );
+    }
+    if (!isWithin(resolved, root))
+      throw new Error(
+        "Browser file inputs may only read files inside the artifact directory.",
+      );
+  }
+
+  function assertArtifactWritePath(candidate) {
+    if (!isString(candidate) || !candidate) return;
+    if (!isWithin(candidate, deps.artifactsDir())) {
+      throw new Error(
+        "Browser-created files must use artifactPath() or the screenshot() helper.",
+      );
+    }
+  }
+
+  function prepareArgument(value, property, realm) {
+    if (facadeToRaw.has(value)) return facadeToRaw.get(value);
+    if (isInvocable(value)) {
+      if (BROWSER_SERIALIZED_CALLBACK_METHODS.has(property)) return value;
+      return (...args) =>
+        value(...args.map((item) => realm.adopt(wrap(item, realm))));
+    }
+    if (Array.isArray(value))
+      return value.map((item) => prepareArgument(item, property, realm));
+    // RegExp values originate in the model's vm realm. Treating them as plain
+    // objects erases their non-enumerable source/flags and turns valid
+    // Playwright text/name matchers into {}, which later stringify as
+    // "[object Object]" inside internal selectors.
+    if (utilTypes.isRegExp(value)) return new RegExp(value.source, value.flags);
+    if (isObjectValue(value)) {
+      return Object.fromEntries(
+        Object.entries(value).map(([key, item]) => [
+          key,
+          prepareArgument(item, property, realm),
+        ]),
+      );
+    }
+    return value;
+  }
+
+  function argumentType(value) {
+    if (value === null) return "null";
+    if (Array.isArray(value)) return "array";
+    if (value === undefined) return "undefined";
+    if (isString(value)) return "string";
+    if (isNumber(value)) return "number";
+    if (isBoolean(value)) return "boolean";
+    if (isCallable(value)) return "function";
+    if (isSymbolValue(value)) return "symbol";
+    if (isBigIntValue(value)) return "bigint";
+    return "object";
+  }
+
+  function validateMethodArguments(property, args) {
+    if (property !== "getByRole" || args[1]?.name === undefined) return;
+    const name = args[1].name;
+    if (isString(name) || utilTypes.isRegExp(name)) return;
+    throw new TypeError(
+      `getByRole name must be a string or RegExp, received ${argumentType(name)}.`,
+    );
+  }
+
+  function assertPageHandle(value, helper) {
+    if (isString(value) || isNumber(value) || objectKind(facadeToRaw.get(value)) === "Page") return;
+    throw new TypeError(
+      `${helper} page handle must be a page ID string, numeric index, or page object, received ${argumentType(value)}.`,
+    );
+  }
+
+  // Resolve a page handle — an id, an index, or the page object `openPage`/`pages`
+  // hand out — to the session's `[id, page]` entry, or undefined when it is not
+  // an open page of this session.
+  function findPageEntry(entries, handle) {
+    if (isNumber(handle)) return entries[handle];
+    if (facadeToRaw.has(handle)) {
+      const raw = facadeToRaw.get(handle);
+      return entries.find(([, page]) => page === raw);
+    }
+    return entries.find(([id]) => id === String(handle));
+  }
+
+  function describePageHandle(handle) {
+    if (!facadeToRaw.has(handle)) return String(handle);
+    const id = deps.pageIds.get(facadeToRaw.get(handle));
+    return id ? `page object ${id}` : "page object";
+  }
+
+  function validateMethodPaths(kind, property, args) {
+    if (deps.hostOwnedTarget() &&
+        ((kind === "BrowserContext" && ["newPage", "close"].includes(property)) ||
+         (kind === "Page" && property === "close"))) {
+      throw new Error("Host-owned tabs must be opened or closed by the host.");
+    }
+    if (kind === "Page" && property === "pdf" && args[0]?.path)
+      assertArtifactWritePath(args[0].path);
+    if (
+      ["addInitScript", "addScriptTag", "addStyleTag"].includes(property) &&
+      args[0]?.path
+    ) {
+      assertReadableBrowserPath(args[0].path);
+    }
+    if (property === "setInputFiles" || property === "setFiles") {
+      const supplied =
+        property === "setFiles" || ["Locator", "ElementHandle"].includes(kind)
+          ? args[0]
+          : args[1];
+      const files = Array.isArray(supplied) ? supplied : [supplied];
+      for (const file of files) {
+        if (deps.hostOwnedTarget()) {
+          if (!isString(file) || !deps.hostUploadFiles()?.includes(file) ||
+              fs.realpathSync(file) !== file || !fs.statSync(file).isFile()) {
+            throw new Error("Host upload requires an exact approved regular staged file.");
+          }
+        } else if (isString(file)) assertReadableBrowserPath(file);
+      }
+    }
+    if (["Page", "Frame"].includes(kind) && property === "goto") {
+      assertModelNavigationUrl(args[0]);
+    }
+  }
+
+  async function setContentCompatible(target, html, options: any = {}) {
+    if (!isString(html)) {
+      throw new TypeError("setContent requires an HTML string.");
+    }
+    const waitUntil = String(options?.waitUntil || "load");
+    if (!["commit", "domcontentloaded", "load", "networkidle"].includes(waitUntil)) {
+      throw new TypeError(`Unsupported setContent waitUntil value: ${waitUntil}`);
+    }
+    const frame = objectKind(target) === "Frame" ? target : target.mainFrame();
+    const page = frame.page();
+    const timeout = frame._navigationTimeout(options || {});
+    const deadline = timeout === 0 ? Number.POSITIVE_INFINITY : Date.now() + timeout;
+    const inflight = new Set();
+    let lastNetworkActivity = Date.now();
+    const belongsToFrame = (request) => {
+      try {
+        let current = request.frame();
+        while (current) {
+          if (current === frame) return true;
+          current = current.parentFrame();
+        }
+        return false;
+      } catch {
+        return false;
+      }
+    };
+    const onRequest = (request) => {
+      if (!belongsToFrame(request)) return;
+      inflight.add(request);
+      lastNetworkActivity = Date.now();
+    };
+    const onRequestDone = (request) => {
+      if (!inflight.delete(request)) return;
+      lastNetworkActivity = Date.now();
+    };
+    if (waitUntil === "networkidle") {
+      page.on("request", onRequest);
+      page.on("requestfinished", onRequestDone);
+      page.on("requestfailed", onRequestDone);
+    }
+    const remaining = () => {
+      if (timeout === 0) return 0;
+      const value = deadline - Date.now();
+      if (value <= 0) {
+        throw new Error(`setContent: Timeout ${timeout}ms exceeded.`);
+      }
+      return value;
+    };
+    try {
+      await frame.evaluate(({ markup, expected, timeoutMs }) => {
+        document.open();
+        if (expected === "commit") {
+          document.write(markup);
+          document.close();
+          return undefined;
+        }
+        return new Promise((resolve, reject) => {
+          let settled = false;
+          const finish = (error = null) => {
+            if (settled) return;
+            settled = true;
+            if (timer !== null) clearTimeout(timer);
+            if (error) reject(error);
+            else resolve(undefined);
+          };
+          const eventName = expected === "domcontentloaded"
+            ? "DOMContentLoaded"
+            : "load";
+          const eventTarget = expected === "domcontentloaded" ? document : window;
+          eventTarget.addEventListener(eventName, () => finish(), { once: true });
+          const timer = timeoutMs > 0
+            ? setTimeout(
+                () => finish(new Error(`setContent: Timeout ${timeoutMs}ms exceeded.`)),
+                timeoutMs,
+              )
+            : null;
+          document.write(markup);
+          document.close();
+        });
+      }, { markup: html, expected: waitUntil, timeoutMs: remaining() });
+      if (waitUntil === "commit") return;
+      while (
+        inflight.size > 0 ||
+        (waitUntil === "networkidle" && Date.now() - lastNetworkActivity < 500)
+      ) {
+        remaining();
+        await new Promise((resolve) =>
+          setTimeout(resolve, Math.min(50, Math.max(1, deadline - Date.now()))),
+        );
+      }
+    } catch (error) {
+      if (timeout !== 0 && Date.now() >= deadline) {
+        throw new Error(`setContent: Timeout ${timeout}ms exceeded.`);
+      }
+      throw error;
+    } finally {
+      if (waitUntil === "networkidle") {
+        page.off("request", onRequest);
+        page.off("requestfinished", onRequestDone);
+        page.off("requestfailed", onRequestDone);
+      }
+    }
+  }
+
+  function assertModelNavigationUrl(value) {
+    const url = String(value || "");
+    let scheme;
+    try {
+      scheme = new URL(url).protocol.toLowerCase();
+    } catch {
+      throw new Error("Browser navigation requires a valid URL.");
+    }
+    const safeSpecial =
+      (scheme === "about:" && url.toLowerCase() === "about:blank") ||
+      scheme === "data:" ||
+      scheme === "blob:";
+    if (!safeSpecial && !["http:", "https:"].includes(scheme)) {
+      throw new Error(`Browser navigation scheme is not available: ${scheme}`);
+    }
+    if (
+      ["http:", "https:"].includes(scheme) &&
+      String(deps.publicSearchPolicy() || "block") !== "allow" &&
+      isPublicSearchNavigation(url)
+    ) {
+      throw new Error(PUBLIC_SEARCH_BLOCK_ADVICE);
+    }
+  }
+
+  let realmFactoryScript: vm.Script | null = null;
+
+  // The factory source is a constant template with no interpolation, so the parse
+  // is realm-independent: compile on first use and reuse the script thereafter.
+  function getRealmFactoryScript() {
+    if (realmFactoryScript) return realmFactoryScript;
+    realmFactoryScript = new vm.Script(
+      `(() => {
+      const PromiseCtor = Promise;
+      const ErrorCtor = Error;
+      const ArrayCtor = Array;
+      const errorMessage = error => {
+        try { return String(error && error.message ? error.message : error); }
+        catch { return 'Playwright operation failed'; }
+      };
+      const adopt = value => ArrayCtor.isArray(value) ? ArrayCtor.from(value, adopt) : value;
+      const bridge = (result, markHandled = null) => {
+        const bridged = new PromiseCtor((resolve, reject) => {
+          result.then(
+            value => resolve(adopt(value)),
+            error => reject(new ErrorCtor(errorMessage(error))),
+          );
+        });
+        const silence = promise => {
+          PromiseCtor.prototype.catch.call(promise, () => {});
+          return promise;
+        };
+        silence(bridged);
+        if (typeof markHandled !== 'function') return bridged;
+        const tracked = promise => new Proxy(silence(promise), {
+          get(target, property) {
+            if (property === 'then') {
+              return (onFulfilled, onRejected) => {
+                if (typeof onRejected === 'function') markHandled();
+                return tracked(PromiseCtor.prototype.then.call(
+                  target,
+                  onFulfilled,
+                  onRejected,
+                ));
+              };
+            }
+            if (property === 'catch') {
+              return onRejected => {
+                if (typeof onRejected === 'function') markHandled();
+                return tracked(PromiseCtor.prototype.catch.call(target, onRejected));
+              };
+            }
+            if (property === 'finally') {
+              return onFinally => tracked(
+                PromiseCtor.prototype.finally.call(target, onFinally),
+              );
+            }
+            return Reflect.get(target, property, target);
+          },
+        });
+        return tracked(bridged);
+      };
+      const call = (hostFunction, args) => {
+        let result;
+        try { result = hostFunction(...args); }
+        catch (error) { throw new ErrorCtor(errorMessage(error)); }
+        return result;
+      };
+      const make = hostFunction => (...args) => {
+        const result = call(hostFunction, args);
+        if (result && typeof result.then === 'function') return bridge(result);
+        return adopt(result);
+      };
+      const makeTracked = hostFunction => (...args) => {
+        const tracked = call(hostFunction, args);
+        return bridge(tracked.promise, tracked.markHandled);
+      };
+      const makePages = hostGetter => {
+        const getPages = make(hostGetter);
+        return new Proxy([], {
+          get(_target, property) {
+            const list = getPages();
+            const member = list[property];
+            return typeof member === 'function' ? member.bind(list) : member;
+          },
+          has(_target, property) { return property in getPages(); },
+          ownKeys() { return Reflect.ownKeys(getPages()); },
+          getOwnPropertyDescriptor() { return { configurable: true, enumerable: true }; },
+        });
+      };
+      const installPage = hostGetter => {
+        const getPage = make(hostGetter);
+        Object.defineProperty(globalThis, 'page', {
+          configurable: false,
+          enumerable: true,
+          get: getPage,
+        });
+      };
+      return { adopt, installPage, make, makePages, makeTracked };
+    })()`,
+      { filename: "browser-playwright-realm.js" },
+    );
+    return realmFactoryScript;
+  }
+
+  // WHATWG URL is not a JS intrinsic, so a fresh vm context lacks it, and the
+  // host's `URL` cannot be handed over: its `constructor` is the host realm's
+  // `Function`, which compiles code outside the context's restrictions. These
+  // classes live in the snippet realm and only ever receive strings and arrays
+  // of strings from the host, which `adopt` turns into realm values.
+  const URL_FIELDS = ["href", "protocol", "username", "password", "host", "hostname", "port", "pathname", "search", "hash", "origin"];
+
+  function urlParts(input, base, field, value) {
+    let url;
+    try {
+      url = new URL(input, base);
+    } catch {
+      throw new TypeError(`Invalid URL: ${input}`);
+    }
+    if (field) url[field] = value;
+    return URL_FIELDS.map((name) => url[name]);
+  }
+
+  let urlFactoryScript: vm.Script | null = null;
+
+  function getUrlFactoryScript() {
+    if (urlFactoryScript) return urlFactoryScript;
+    urlFactoryScript = new vm.Script(
+      `(fields, urlParts, parseParams, serializeParams) => {
+      const pairsOf = new WeakMap();
+      const owners = new WeakMap();
+      // Writing the owner's search re-enters the field setter below; the flag
+      // stops it from re-parsing the pairs it was just serialized from.
+      let syncing = false;
+      const sync = params => {
+        const owner = owners.get(params);
+        if (!owner) return;
+        syncing = true;
+        try { owner.search = serializeParams(pairsOf.get(params)); } finally { syncing = false; }
+      };
+      // Names and values are WebIDL USVStrings: lone surrogates become U+FFFD.
+      const usv = value => String(value).toWellFormed();
+      // WHATWG init: a string, an iterable of [name, value] pairs (array, Map,
+      // generator, another URLSearchParams), or a record of name -> value.
+      const pairsFrom = init => {
+        if (init === undefined) return [];
+        if (init !== null && (typeof init === 'object' || typeof init === 'function')) {
+          const iterator = init[Symbol.iterator];
+          if (iterator !== undefined && iterator !== null) {
+            if (typeof iterator !== 'function') throw new TypeError('Query init is not iterable');
+            const pairs = [];
+            for (const pair of { [Symbol.iterator]: () => iterator.call(init) }) {
+              if (pair === null || pair === undefined || typeof pair[Symbol.iterator] !== 'function')
+                throw new TypeError('Each query pair must be an iterable [name, value] entry');
+              const entry = [...pair];
+              if (entry.length !== 2)
+                throw new TypeError('Each query pair must be an iterable [name, value] entry');
+              pairs.push([usv(entry[0]), usv(entry[1])]);
+            }
+            return pairs;
+          }
+          return Object.entries(init).map(([key, value]) => [usv(key), usv(value)]);
+        }
+        return parseParams(usv(init));
+      };
+      // The pair list is only ever mutated in place, so an iterator holding an
+      // index into it stays live across delete()/set() like the native one.
+      const replace = (params, pairs) => { const list = pairsOf.get(params); list.splice(0, list.length, ...pairs); };
+      function* iterate(params, pick) {
+        for (let i = 0; i < pairsOf.get(params).length; i += 1) yield pick(pairsOf.get(params)[i]);
+      }
+      class URLSearchParams {
+        constructor(init = '') { pairsOf.set(this, pairsFrom(init)); }
+        get size() { return pairsOf.get(this).length; }
+        append(key, value) { pairsOf.get(this).push([usv(key), usv(value)]); sync(this); }
+        delete(key, value) {
+          key = usv(key);
+          if (value !== undefined) value = usv(value);
+          const pairs = pairsOf.get(this);
+          for (let i = pairs.length - 1; i >= 0; i -= 1) {
+            if (pairs[i][0] === key && (value === undefined || pairs[i][1] === value)) pairs.splice(i, 1);
+          }
+          sync(this);
+        }
+        get(key) { key = usv(key); const hit = pairsOf.get(this).find(([k]) => k === key); return hit ? hit[1] : null; }
+        getAll(key) { key = usv(key); return pairsOf.get(this).filter(([k]) => k === key).map(([, v]) => v); }
+        has(key, value) { key = usv(key); return pairsOf.get(this).some(([k, v]) => k === key && (value === undefined || v === usv(value))); }
+        set(key, value) {
+          key = usv(key);
+          value = usv(value);
+          const pairs = pairsOf.get(this);
+          const index = pairs.findIndex(([k]) => k === key);
+          if (index < 0) pairs.push([key, value]);
+          else {
+            pairs[index] = [key, value];
+            for (let i = pairs.length - 1; i > index; i -= 1) if (pairs[i][0] === key) pairs.splice(i, 1);
+          }
+          sync(this);
+        }
+        sort() { pairsOf.get(this).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)); sync(this); }
+        forEach(callback, thisArg) { for (const [key, value] of this) callback.call(thisArg, value, key, this); }
+        keys() { return iterate(this, ([key]) => key); }
+        values() { return iterate(this, ([, value]) => value); }
+        entries() { return iterate(this, ([key, value]) => [key, value]); }
+        [Symbol.iterator]() { return this.entries(); }
+        toString() { return serializeParams(pairsOf.get(this)); }
+        get [Symbol.toStringTag]() { return 'URLSearchParams'; }
+      }
+      const partsOf = new WeakMap();
+      const paramsOf = new WeakMap();
+      const assign = (url, values) => partsOf.set(url, Object.fromEntries(fields.map((name, i) => [name, values[i]])));
+      class URL {
+        constructor(input, base) {
+          assign(this, urlParts(String(input), base === undefined ? undefined : String(base)));
+        }
+        static canParse(input, base) { try { new URL(input, base); return true; } catch { return false; } }
+        static parse(input, base) { try { return new URL(input, base); } catch { return null; } }
+        get searchParams() {
+          let params = paramsOf.get(this);
+          if (!params) {
+            params = new URLSearchParams(partsOf.get(this).search);
+            owners.set(params, this);
+            paramsOf.set(this, params);
+          }
+          return params;
+        }
+        toString() { return partsOf.get(this).href; }
+        toJSON() { return partsOf.get(this).href; }
+        get [Symbol.toStringTag]() { return 'URL'; }
+      }
+      for (const name of fields) {
+        Object.defineProperty(URL.prototype, name, {
+          configurable: true,
+          enumerable: true,
+          get() { return partsOf.get(this)[name]; },
+          set: name === 'origin' ? undefined : function (value) {
+            assign(this, urlParts(partsOf.get(this).href, undefined, name, String(value)));
+            // searchParams keeps its identity (WHATWG) and follows every
+            // mutation of the query, whether through search, href, or the
+            // params object itself.
+            const params = paramsOf.get(this);
+            if (params && !syncing) replace(params, parseParams(partsOf.get(this).search));
+          },
+        });
+      }
+      return { URL, URLSearchParams };
+    }`,
+      { filename: "browser-url-realm.js" },
+    );
+    return urlFactoryScript;
+  }
+
+  function createUrlGlobals(realm: WorkerRealm) {
+    const factory = getUrlFactoryScript().runInContext(realm.context);
+    return factory(
+      realm.adopt(URL_FIELDS),
+      realm.safeFunction(urlParts),
+      realm.safeFunction((init) => [...new URLSearchParams(init)]),
+      realm.safeFunction((pairs) => new URLSearchParams(pairs).toString()),
+    );
+  }
+
+  function createRealm(context: vm.Context, pageEvents: SnippetPageEvents): WorkerRealm {
+    // SAFETY: the constant factory script returns this exact five-method record.
+    const factories = getRealmFactoryScript().runInContext(context) as RealmFactories;
+    return {
+      context,
+      cache: new WeakMap(),
+      adopt: factories.adopt,
+      installPage: factories.installPage,
+      safeFunction: factories.make,
+      safeTrackedFunction: factories.makeTracked,
+      makePages: factories.makePages,
+      pageEvents,
+    };
+  }
+
+  function wrap(value, realm: WorkerRealm) {
+    if (!isWrappableValue(value)) return value;
+    if (facadeToRaw.has(value)) return value;
+    if (Array.isArray(value)) return value.map((item) => wrap(item, realm));
+    const cached = realm.cache.get(value);
+    if (cached) return cached;
+
+    const facade = new Proxy(Object.create(null), {
+      get(_target, property) {
+        if (property === Symbol.toStringTag) return "PlaywrightObject";
+        if (isSymbolValue(property)) return undefined;
+        if (isSnippetPageEventMethod(objectKind(value), property)) {
+          return realm.safeFunction((event, listener) => {
+            realm.pageEvents.dispatch(
+              value,
+              property,
+              event,
+              listener,
+              (payload) => realm.adopt(wrap(payload, realm)),
+            );
+            return wrap(value, realm);
+          });
+        }
+        if (propertyForbidden(value, property)) return undefined;
+        const member = value[property];
+        if (!isCallable(member)) return wrap(member, realm);
+        return realm.safeFunction((...args) => {
+          const prepared = args.map((arg) =>
+            prepareArgument(arg, property, realm),
+          );
+          const kind = objectKind(value);
+          validateMethodArguments(property, prepared);
+          validateMethodPaths(kind, property, prepared);
+          applyNavigationDefaults(kind, property, prepared);
+          let result;
+          if (kind === "Page" && property === "close") {
+            // SAFETY: objectKind identified this Playwright value as a Page.
+            result = deps.stopPageRecording(value as Page).then(() => member.apply(value, prepared));
+          } else if (kind === "Page" && (property === "goBack" || property === "goForward")) {
+            result = navigateHistory(value, property, prepared[0], deps.defaultNavigationTimeoutMs);
+          } else if (
+            deps.useSetContentCompatibility() &&
+            ["Page", "Frame"].includes(kind) &&
+            property === "setContent"
+          ) {
+            result = setContentCompatible(value, prepared[0], prepared[1]);
+          } else {
+            result = member.apply(value, prepared);
+          }
+          if (["Keyboard", "Page", "Frame", "Locator"].includes(kind) &&
+              ["press", "pressSequentially", "type", "fill", "down"].includes(property) && result?.catch) {
+            result = result.catch(async (error) => {
+              // A failed chord can skip Playwright's key-up sequence.
+              const target: any = value;
+              const keyboard = kind === "Keyboard" ? target : kind === "Page" ? target.keyboard : target.page().keyboard;
+              for (const key of ["AltLeft", "AltRight", "ControlLeft", "ControlRight", "MetaLeft", "MetaRight", "ShiftLeft", "ShiftRight"]) {
+                await keyboard.up(key).catch(() => {});
+              }
+              throw error;
+            });
+          }
+          if (
+            ["Request", "Response"].includes(kind) &&
+            property === "headers"
+          ) {
+            result = result && isCallable(untrustedField(result, "then"))
+              ? result.then(filterModelHeaders)
+              : filterModelHeaders(result);
+          }
+          if (result && isCallable(untrustedField(result, "then"))) {
+            return result.then((item) => wrap(item, realm));
+          }
+          return wrap(result, realm);
+        });
+      },
+      has(_target, property) {
+        if (isSnippetPageEventMethod(objectKind(value), property)) return true;
+        return !propertyForbidden(value, property) && property in value;
+      },
+      ownKeys() {
+        return Reflect.ownKeys(value).filter(
+          (key) => !propertyForbidden(value, key),
+        );
+      },
+      getOwnPropertyDescriptor() {
+        return { configurable: true, enumerable: true };
+      },
+      getPrototypeOf() {
+        return null;
+      },
+      set() {
+        return false;
+      },
+    });
+    realm.cache.set(value, facade);
+    facadeToRaw.set(facade, value);
+    return facade;
+  }
+
+  function summaryText(value, maxLength = 4_000) {
+    return deps.redactText(String(value ?? "")).slice(0, maxLength);
+  }
+
+  async function callSummaryMethod(value, method, fallback = null) {
+    try {
+      if (!isCallable(value?.[method])) return fallback;
+      return await value[method]();
+    } catch {
+      return fallback;
+    }
+  }
+
+  async function summarizePlaywrightObject(raw, kind) {
+    if (kind === "Frame") {
+      return {
+        type: "Frame",
+        name: summaryText(await callSummaryMethod(raw, "name", "")),
+        url: summaryText(await callSummaryMethod(raw, "url", "")),
+        detached: Boolean(await callSummaryMethod(raw, "isDetached", true)),
+      };
+    }
+    if (kind === "ConsoleMessage") {
+      const location = await callSummaryMethod(raw, "location", {});
+      return {
+        type: "ConsoleMessage",
+        level: summaryText(await callSummaryMethod(raw, "type", ""), 80),
+        text: summaryText(await callSummaryMethod(raw, "text", "")),
+        location: {
+          url: summaryText(location?.url || ""),
+          lineNumber: Number(location?.lineNumber) || 0,
+          columnNumber: Number(location?.columnNumber) || 0,
+        },
+      };
+    }
+    if (kind === "Request") {
+      return {
+        type: "Request",
+        url: summaryText(await callSummaryMethod(raw, "url", "")),
+        method: summaryText(await callSummaryMethod(raw, "method", ""), 40),
+        resourceType: summaryText(
+          await callSummaryMethod(raw, "resourceType", ""),
+          80,
+        ),
+        navigation: Boolean(
+          await callSummaryMethod(raw, "isNavigationRequest", false),
+        ),
+      };
+    }
+    if (kind === "Response") {
+      return {
+        type: "Response",
+        url: summaryText(await callSummaryMethod(raw, "url", "")),
+        status: Number(await callSummaryMethod(raw, "status", 0)) || 0,
+        statusText: summaryText(
+          await callSummaryMethod(raw, "statusText", ""),
+          200,
+        ),
+        ok: Boolean(await callSummaryMethod(raw, "ok", false)),
+      };
+    }
+    if (kind === "Dialog") {
+      return {
+        type: "Dialog",
+        dialogType: summaryText(await callSummaryMethod(raw, "type", ""), 80),
+        message: summaryText(await callSummaryMethod(raw, "message", "")),
+        defaultValue: summaryText(
+          await callSummaryMethod(raw, "defaultValue", ""),
+        ),
+      };
+    }
+    if (kind === "Download") {
+      return {
+        type: "Download",
+        url: summaryText(await callSummaryMethod(raw, "url", "")),
+        suggestedFilename: summaryText(
+          await callSummaryMethod(raw, "suggestedFilename", ""),
+          300,
+        ),
+      };
+    }
+    if (kind === "WebSocket" || kind === "Worker") {
+      return {
+        type: kind,
+        url: summaryText(await callSummaryMethod(raw, "url", "")),
+      };
+    }
+    if (kind === "FileChooser") {
+      return {
+        type: "FileChooser",
+        multiple: Boolean(await callSummaryMethod(raw, "isMultiple", false)),
+      };
+    }
+    // Handles, contexts, sessions, routes, videos, and future Playwright classes
+    // fail closed. Their enumerable fields include transport channels and host
+    // process state that must never cross the model boundary.
+    return { type: kind || "PlaywrightObject" };
+  }
+
+  /**
+   * JSON-safe summary of a sandbox value as `summarize` produces it: primitives
+   * pass through and every container is reduced to plain arrays and objects.
+   */
+  type SummarizedValue =
+    | null
+    | string
+    | number
+    | boolean
+    | SummarizedValue[]
+    | { [key: string]: SummarizedValue };
+
+  async function summarize(value, seen = new WeakSet(), depth = 0) {
+    if (value === undefined) return null;
+    if (value === null || isString(value) || isNumber(value) || isBoolean(value))
+      return deps.redactDeep(value);
+    if (isBigIntValue(value)) return value.toString();
+    if (isCallable(value))
+      return `[Function ${value.name || "anonymous"}]`;
+    const raw = facadeToRaw.get(value) || value;
+    if (raw instanceof Error)
+      return { name: raw.name, message: deps.redactText(raw.message) };
+    if (depth > 8) return "[Max depth]";
+    if (seen.has(raw)) return "[Circular]";
+    seen.add(raw);
+
+    const kind = objectKind(raw);
+    if (deps.pageIds.has(raw)) {
+      // SAFETY: only Playwright Page objects are registered in pageIds.
+      const page = raw as Page;
+      let title = "";
+      try {
+        const domTitle = await page
+          .evaluate(
+            () => document.title || document.querySelector("title")?.textContent || "",
+          )
+          .catch(() => "");
+        if (isString(domTitle) && domTitle) title = domTitle;
+        else title = await page.title();
+      } catch {
+        /* page may have closed */
+      }
+      return {
+        type: "Page",
+        pageId: deps.pageId(page),
+        url: deps.redactText(page.url()),
+        title: deps.redactText(title),
+        closed: page.isClosed(),
+      };
+    }
+    if (kind === "Locator")
+      return { type: "Locator", locator: deps.redactText(raw.toString()) };
+    if (Array.isArray(raw))
+      return Promise.all(
+        raw.slice(0, 200).map((item) => summarize(item, seen, depth + 1)),
+      );
+    if (raw instanceof Map) {
+      const entries = [...raw.entries()].slice(0, 200);
+      return Object.fromEntries(
+        await Promise.all(
+          entries.map(async ([key, item]) => [
+            deps.redactText(key),
+            await summarize(item, seen, depth + 1),
+          ]),
+        ),
+      );
+    }
+    if (raw instanceof Set)
+      return Promise.all(
+        [...raw].slice(0, 200).map((item) => summarize(item, seen, depth + 1)),
+      );
+    if (kind !== "Object" && kind !== "") {
+      return summarizePlaywrightObject(raw, kind);
+    }
+    const output: Record<string, SummarizedValue> = {};
+    for (const key of Object.keys(raw).slice(0, 200)) {
+      try {
+        output[deps.redactText(key)] = await summarize(raw[key], seen, depth + 1);
+      } catch (error) {
+        output[deps.redactText(key)] = `[Unserializable: ${error?.message || error}]`;
+      }
+    }
+    return deps.redactDeep(output);
+  }
+
+  async function summarizeSessionPages(session: WorkerSession) {
+    return Promise.all(
+      [...session.pages.values()]
+        .filter((page) => !page.isClosed())
+        .slice(0, deps.maxResponsePages)
+        .map(async (page) => ({
+          ...(await summarize(page)),
+          active: deps.pageId(page) === session.currentId,
+        })),
+    );
+  }
+
+  function unwrapTarget(value: UntrustedValue) {
+    return facadeToRaw.get(value) || value;
+  }
+
+  return {
+    assertModelNavigationUrl,
+    assertPageHandle,
+    createRealm,
+    createUrlGlobals,
+    describePageHandle,
+    findPageEntry,
+    objectKind,
+    summarize,
+    summarizeSessionPages,
+    unwrapTarget,
+    wrap,
+  };
+}
+
+export type WorkerRealmOperations = ReturnType<typeof createWorkerRealm>;
diff --git a/src/worker-sandbox.ts b/src/worker-sandbox.ts
new file mode 100644
index 0000000..0991989
--- /dev/null
+++ b/src/worker-sandbox.ts
@@ -0,0 +1,642 @@
+// Model-callable helpers assembled for one execution. The process entrypoint
+// supplies trusted operations; browser and configuration access stays live.
+import vm from "node:vm";
+import type { BrowserContext, Page } from "playwright-core";
+import { CAPTCHA_SCREENSHOT_TIMEOUT_MS, captchaBounds, captchaBoxInViewport, captchaPoint, captchaTilesStale, type createCaptchaRuntime, detectCaptchaOnPage } from "./captcha-runtime.js";
+import { parseTileIndexes } from "./captcha-solver.js";
+import type { createCredentialFill } from "./credential-fill.js";
+import { movePointer, pressPointer, scrollWheel, typedTextLanded, typeText } from "./human.js";
+import { navigationOptions } from "./navigation-defaults.js";
+import { dismissObstructiveOverlays, inspectActionDirectory, inspectControls, inspectMedia } from "./page-inspect.js";
+import { siteTextExcerpts } from "./site-tools.js";
+import { executeUIBatch } from "./ui-batch.js";
+import { isObjectValue, isString, type UntrustedValue, untrustedField } from "./untrusted-value.js";
+import { prepareWebAgentsBatch, publicWebAgentsManifest } from "./webagents.js";
+import { invokeWebMCPTool, listWebMCPTools } from "./webmcp.js";
+import type { createWorkerArtifacts } from "./worker-artifacts.js";
+import type { createHumanInput } from "./worker-human.js";
+import type { createWorkerRealm, WorkerRealm } from "./worker-realm.js";
+import { MAX_PAGES_PER_SESSION, type WorkerSession } from "./worker-session.js";
+import type { createWorkerSite } from "./worker-site.js";
+import type { createWorkerSnapshots } from "./worker-snapshots.js";
+
+const MAX_CONSOLE_MESSAGES = 20;
+const MAX_CONSOLE_MESSAGE_CHARS = 300;
+
+interface ScreenshotOptions {
+  name?: string;
+  kind?: string;
+  type?: string;
+  fullPage?: boolean;
+  annotate?: boolean;
+  quality?: number;
+}
+
+interface ScreenshotArtifact {
+  kind: string;
+  path: string;
+  media: string;
+  annotations?: number;
+}
+
+function hostDelay(ms: number) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+type ArtifactOperations = ReturnType<typeof createWorkerArtifacts<WorkerSession>>;
+type RealmOperations = ReturnType<typeof createWorkerRealm>;
+type CredentialOperations = ReturnType<typeof createCredentialFill>;
+
+// The per-execute record shared with credential tasks; the sandbox only reads
+// its page events, credential-fill.ts owns the task bookkeeping.
+interface SandboxExecution {
+  acceptingCredentialTasks: boolean;
+  credentialTasks: unknown[];
+  pageEvents: WorkerRealm["pageEvents"];
+}
+
+interface WorkerSandboxDeps extends
+  Pick<RealmOperations, "createRealm" | "wrap" | "createUrlGlobals" | "assertPageHandle" | "findPageEntry" | "describePageHandle" | "assertModelNavigationUrl">,
+  Pick<ArtifactOperations, "stopPageRecording" | "makeArtifactPath" | "startSessionRecording" | "stopSessionRecording" | "sessionRecordingStatus" | "addScreenshotAnnotations" | "captureScreenshot" | "removeScreenshotAnnotations">,
+  ReturnType<typeof createHumanInput>,
+  Pick<ReturnType<typeof createWorkerSite>, "pageSiteRequests" | "inspectSiteAssets" | "pageSiteRequest" | "discoverPageWebAgents">,
+  Pick<ReturnType<typeof createWorkerSnapshots>, "snapshotPage">,
+  ReturnType<typeof createCaptchaRuntime<WorkerSession>> {
+  getConfig: () => { hostOwnedTarget?: boolean };
+  getBrowserContext: () => BrowserContext;
+  redactText: (value: UntrustedValue) => string;
+  adoptPage: (page: Page, sessionId: string) => Page;
+  notifyLiveViewPreferred: () => void;
+  ensureSessionPage: (session: WorkerSession) => Promise<Page>;
+  buildCredentials: CredentialOperations["buildCredentials"];
+}
+
+export function createWorkerSandbox({
+  getConfig,
+  getBrowserContext,
+  createRealm,
+  wrap,
+  createUrlGlobals,
+  assertPageHandle,
+  findPageEntry,
+  describePageHandle,
+  assertModelNavigationUrl,
+  redactText,
+  adoptPage,
+  notifyLiveViewPreferred,
+  stopPageRecording,
+  ensureSessionPage,
+  snapshotPage,
+  makeArtifactPath,
+  startSessionRecording,
+  stopSessionRecording,
+  sessionRecordingStatus,
+  addScreenshotAnnotations,
+  captureScreenshot,
+  removeScreenshotAnnotations,
+  solveCaptchaOnPage,
+  captureTiles,
+  clickStoredTiles,
+  humanClickTarget,
+  clearTypedField,
+  moveTypedFieldCaretToEnd,
+  readTypedFieldText,
+  restoreTypedFieldText,
+  insertTypedText,
+  pageSiteRequests,
+  inspectSiteAssets,
+  pageSiteRequest,
+  discoverPageWebAgents,
+  buildCredentials,
+}: WorkerSandboxDeps) {
+
+  function buildCaptcha(session: WorkerSession, realm: WorkerRealm) {
+    const captcha = Object.create(null);
+    captcha.detect = realm.safeFunction(async () => {
+      const page = await ensureSessionPage(session);
+      return detectCaptchaOnPage(page);
+    });
+    captcha.solve = realm.safeFunction(async (options: any = {}) => {
+      const page = await ensureSessionPage(session);
+      return solveCaptchaOnPage(page, session, options || {});
+    });
+    captcha.click = realm.safeFunction(async (bounds) => {
+      const page = await ensureSessionPage(session);
+      const target = captchaBounds(bounds);
+      const stored = [...session.captchaTargets.values()].find(
+        (entry) =>
+          Math.abs(entry.bounds.x - target.x) < 2 &&
+          Math.abs(entry.bounds.y - target.y) < 2 &&
+          Math.abs(entry.bounds.width - target.width) < 2 &&
+          Math.abs(entry.bounds.height - target.height) < 2,
+      );
+      const visibleTarget = await captchaBoxInViewport(
+        page,
+        stored?.pageBounds || target,
+        Boolean(stored?.pageBounds),
+      );
+      const point = {
+        x: Math.round(
+          visibleTarget.x + visibleTarget.width * (0.13 + Math.random() * 0.04),
+        ),
+        y: Math.round(
+          visibleTarget.y + visibleTarget.height * (0.44 + Math.random() * 0.12),
+        ),
+      };
+      await movePointer(page.mouse, session.cursor, point, { stepDivisor: 8 });
+      await pressPointer(page.mouse);
+      await hostDelay(2_000 + Math.random() * 1_500);
+      return snapshotPage(page);
+    });
+    captcha.drag = realm.safeFunction(async (from, to, options: any = {}) => {
+      const page = await ensureSessionPage(session);
+      const start = captchaPoint(from, "drag start");
+      const end = captchaPoint(to, "drag end");
+      const steps = Math.floor(
+        Math.max(1, Math.min(100, Number(options?.steps) || 20)),
+      );
+      await movePointer(page.mouse, session.cursor, start, { stepDivisor: 8 });
+      await hostDelay(120 + Math.random() * 180);
+      await page.mouse.down();
+      await hostDelay(90 + Math.random() * 150);
+      await movePointer(page.mouse, session.cursor, end, {
+        stepDivisor: Math.max(3, Math.hypot(end.x - start.x, end.y - start.y) / steps),
+      });
+      await hostDelay(100 + Math.random() * 180);
+      await page.mouse.up();
+      await hostDelay(1_500 + Math.random() * 1_000);
+      return snapshotPage(page);
+    });
+    async function captureCaptcha(bounds, requested, instruction) {
+      const page = await ensureSessionPage(session);
+      const clip = bounds == null ? null : captchaBounds(bounds);
+      const shotOptions = {
+        type: "png",
+        animations: "disabled",
+        timeout: CAPTCHA_SCREENSHOT_TIMEOUT_MS,
+      };
+      const file = await captureScreenshot(
+        page,
+        session,
+        requested,
+        requested,
+        clip ? { ...shotOptions, clip } : shotOptions,
+      );
+      const artifact = {
+        kind: "captcha",
+        path: file,
+        media: `MEDIA:${file}`,
+      };
+      session.artifacts.push(artifact);
+      return {
+        ...artifact,
+        instruction,
+      };
+    }
+    captcha.inspect = realm.safeFunction(async (bounds) => {
+      return captureCaptcha(
+        bounds,
+        "captcha-challenge.png",
+        "Inspect the attached challenge visually, choose the matching native " +
+          "CAPTCHA or human helper, then verify that the challenge cleared and " +
+          "resume the original task.",
+      );
+    });
+    captcha.readText = realm.safeFunction(async (bounds) => {
+      return captureCaptcha(
+        bounds,
+        "captcha-text.png",
+        "Read the attached CAPTCHA crop visually and return only its text.",
+      );
+    });
+    captcha.clickTiles = realm.safeFunction(async (indexes) => {
+      const page = await ensureSessionPage(session);
+      const picked = parseTileIndexes(indexes);
+      if (!picked.length) {
+        throw new Error("captcha.clickTiles requires an array of tile indexes from the numbered crop.");
+      }
+      if (!session.captchaTargets.size) {
+        await captureTiles(page, session, null);
+      } else if (await captchaTilesStale(page, session, null)) {
+        // The stored coordinates belong to a grid that is no longer on screen.
+        // Recapture so the caller re-reads the crop rather than clicking blind.
+        await captureTiles(page, session, null);
+        throw new Error(
+          "The captcha grid changed since the numbered crop was captured. " +
+            "Call captcha.solve() to get a fresh crop, then pick tiles again.",
+        );
+      }
+      const outcome = await clickStoredTiles(page, session, picked);
+      if (!outcome.ok) {
+        throw new Error(
+          outcome.reason === "tiles_not_captured"
+            ? "No numbered captcha grid is stored. Call captcha.solve() first."
+            : "None of the requested captcha tile indexes were on the stored grid.",
+        );
+      }
+      return snapshotPage(page);
+    });
+    return captcha;
+  }
+
+  function buildHuman(session: WorkerSession, realm: WorkerRealm) {
+    const human = Object.create(null);
+    human.click = realm.safeFunction(async (target, options: any = {}) => {
+      const page = await ensureSessionPage(session);
+      await humanClickTarget(page, session, target, options);
+      return { clicked: true };
+    });
+    human.type = realm.safeFunction(async (target, text, options: any = {}) => {
+      const page = await ensureSessionPage(session);
+      const clickedTarget = await humanClickTarget(page, session, target, options);
+      const clear = options?.clear !== false;
+      if (clear) await clearTypedField(page, clickedTarget);
+      else await moveTypedFieldCaretToEnd(page, clickedTarget);
+      const expected = String(text);
+      const before = await readTypedFieldText(clickedTarget);
+      await typeText(page.keyboard, expected, options);
+      let after = await readTypedFieldText(clickedTarget);
+      if (!typedTextLanded(expected, before, after)) {
+        if (clear) await clearTypedField(page, clickedTarget);
+        else if (before != null) {
+          await restoreTypedFieldText(clickedTarget, before);
+        }
+        const retryBefore = await readTypedFieldText(clickedTarget);
+        await insertTypedText(page, clickedTarget, expected, retryBefore);
+        after = await readTypedFieldText(clickedTarget);
+      }
+      if (!typedTextLanded(expected, before, after)) {
+        throw new Error(
+          "human.type did not change the field. The target may ignore synthetic key events (common in Draft.js and other rich-text editors).",
+        );
+      }
+      return { typed: expected.length };
+    });
+    human.scroll = realm.safeFunction(async (deltaOrOptions, options: any = {}) => {
+      const page = await ensureSessionPage(session);
+      const settings = isObjectValue(deltaOrOptions)
+        ? deltaOrOptions
+        : { ...options, deltaY: deltaOrOptions };
+      const deltaX = Number(untrustedField(settings, "deltaX")) || 0;
+      const deltaY = Number(untrustedField(settings, "deltaY")) || 0;
+      if (!deltaX && !deltaY)
+        throw new Error("human.scroll requires a non-zero deltaX or deltaY.");
+      await scrollWheel(page.mouse, deltaX, deltaY, settings);
+      return { scrolled: { deltaX, deltaY } };
+    });
+    return human;
+  }
+
+  function buildSite(session: WorkerSession, realm: WorkerRealm) {
+    const site = Object.create(null);
+    site.requests = realm.safeFunction(async (options: any = {}) => {
+      const page = await ensureSessionPage(session);
+      const includes = String(options.urlIncludes || "");
+      const resourceType = String(options.resourceType || "");
+      const limit = Math.max(1, Math.min(512, Number(options.limit) || 100));
+      return (pageSiteRequests.get(page) || [])
+        .filter(
+          (record) =>
+            (!includes || record.url.includes(includes)) &&
+            (!resourceType || record.resourceType === resourceType),
+        )
+        .slice(-limit);
+    });
+    site.assets = realm.safeFunction(async () => {
+      const page = await ensureSessionPage(session);
+      return inspectSiteAssets(page);
+    });
+    site.read = realm.safeFunction(async (url, options: any = {}) => {
+      const page = await ensureSessionPage(session);
+      const response = await pageSiteRequest(page, url, { method: "GET" });
+      return {
+        ...response,
+        text: siteTextExcerpts(
+          response.text,
+          options.find,
+          options.contextChars,
+          options.maxMatches,
+        ),
+      };
+    });
+    site.request = realm.safeFunction(async (url, options: any = {}) => {
+      const page = await ensureSessionPage(session);
+      return pageSiteRequest(page, url, options);
+    });
+    return site;
+  }
+
+  function buildWebAgents(session: WorkerSession, realm: WorkerRealm) {
+    const webagents = Object.create(null);
+    webagents.discover = realm.safeFunction(async (options: any = {}) => {
+      if (!isObjectValue(options) || Array.isArray(options)) {
+        throw new TypeError("webagents.discover options must be an object.");
+      }
+      const page = await ensureSessionPage(session);
+      const discovered = await discoverPageWebAgents(page, {
+        refresh: untrustedField(options, "refresh") === true,
+      });
+      if (!discovered.manifest) {
+        return {
+          available: false,
+          error: String(discovered.error || "WebAgents is unavailable.").slice(0, 500),
+        };
+      }
+      const activeUrl = new URL(page.url());
+      session.webAgentsAnnouncedOrigins.add(`${activeUrl.origin}${activeUrl.pathname}`);
+      return publicWebAgentsManifest(discovered.manifest);
+    });
+    webagents.batch = realm.safeFunction(
+      async (operationsValue, optionsValue: any = {}) => {
+        let operations = operationsValue;
+        let options = optionsValue;
+        if (isObjectValue(operationsValue) && !Array.isArray(operationsValue)) {
+          operations = untrustedField(operationsValue, "operations");
+          options = operationsValue;
+        }
+        if (!isObjectValue(options) || Array.isArray(options)) {
+          throw new TypeError("webagents.batch options must be an object.");
+        }
+        const page = await ensureSessionPage(session);
+        const discovered = await discoverPageWebAgents(page, {
+          refresh: untrustedField(options, "refresh") === true,
+        });
+        if (!discovered.manifest) {
+          throw new Error(discovered.error || "This origin does not publish WebAgents.");
+        }
+        const activeUrl = new URL(page.url());
+        session.webAgentsAnnouncedOrigins.add(`${activeUrl.origin}${activeUrl.pathname}`);
+        const request = prepareWebAgentsBatch(
+          discovered.manifest,
+          operations,
+          options,
+        );
+        const response = await pageSiteRequest(page, request.endpoint, {
+          method: "POST",
+          json: request.body,
+          response: "json",
+        });
+        if (!response.ok) {
+          const responseJson = "json" in response ? response.json : null;
+          const detail = isObjectValue(responseJson)
+            ? untrustedField(responseJson, "error")
+            : "";
+          const suffix = isString(detail) && detail.trim()
+            ? ` Site error (untrusted): ${detail.trim().slice(0, 500)}`
+            : "";
+          throw new Error(`WebAgents workflow failed with HTTP ${response.status}.${suffix}`);
+        }
+        const effects = new Map(
+          discovered.manifest.actions.map((action) => [action.name, action.effect]),
+        );
+        const hasEffects = request.body.operations.some(
+          (operation) => effects.get(operation.action) !== "read",
+        );
+        let pageUpdated = false;
+        if (hasEffects && untrustedField(options, "refresh") !== false) {
+          await page.reload({ waitUntil: "domcontentloaded" });
+          await page.waitForLoadState("load", { timeout: 5_000 }).catch(() => {});
+          await page.waitForTimeout(150);
+          pageUpdated = true;
+        }
+        return {
+          protocol: `webagents/${discovered.manifest.version}`,
+          status: response.status,
+          pageUpdated,
+          result: "json" in response ? response.json : null,
+          trust: "untrusted_external_data",
+        };
+      },
+    );
+    return webagents;
+  }
+
+  function buildScreenshot(session: WorkerSession, realm: WorkerRealm) {
+    return realm.safeFunction(async (options: string | ScreenshotOptions) => {
+      const settings = isString(options) ? { name: options } : options || {};
+      const page = await ensureSessionPage(session);
+      const kind = ["proof", "question", "debug"].includes(settings.kind)
+        ? settings.kind
+        : "debug";
+      const type = settings.type === "jpeg" ? "jpeg" : "png";
+      // Chromium infers the encoding from the file extension, so a name without
+      // one (e.g. "home") would fail. Normalize to the requested type and also
+      // pass `type` explicitly so the two can never disagree.
+      let requested = settings.name || `${kind}.${type}`;
+      if (!/\.(png|jpe?g)$/i.test(requested)) requested = `${requested}.${type}`;
+      const fullPage = Boolean(settings.fullPage);
+      let annotations;
+      const annotateInResidentPage = Boolean(settings.annotate);
+      if (settings.annotate) {
+        annotations = annotateInResidentPage
+          ? await addScreenshotAnnotations(page, fullPage)
+          : 0;
+      }
+      let file;
+      try {
+        const shotOptions = { type, fullPage, animations: "disabled" };
+        file = await captureScreenshot(
+          page,
+          session,
+          requested,
+          `${kind}.${type}`,
+          type === "jpeg"
+            ? { ...shotOptions, quality: Number(settings.quality) || 80 }
+            : shotOptions,
+        );
+      } finally {
+        if (annotateInResidentPage)
+          await removeScreenshotAnnotations(page);
+      }
+      const artifact: ScreenshotArtifact = {
+        kind,
+        path: file,
+        media: `MEDIA:${file}`,
+      };
+      if (annotations !== undefined) artifact.annotations = annotations;
+      session.artifacts.push(artifact);
+      if (kind === "question") session.awaitingAnswerSince = Date.now();
+      return artifact;
+    });
+  }
+
+  function buildSandbox(
+    session: WorkerSession,
+    consoleMessages: { level: string; text: string }[],
+    execution: SandboxExecution,
+  ) {
+    const sandbox = Object.create(null);
+    const context = vm.createContext(sandbox, {
+      name: `betterwright-${session.id}`,
+      codeGeneration: { strings: false, wasm: false },
+    });
+    const realm = createRealm(context, execution.pageEvents);
+    const addConsole = (level) =>
+      realm.safeFunction((...args) => {
+        if (consoleMessages.length >= MAX_CONSOLE_MESSAGES) return;
+        const joined = redactText(args.map(String).join(" "));
+        consoleMessages.push({
+          level,
+          text:
+            joined.length > MAX_CONSOLE_MESSAGE_CHARS
+              ? `${joined.slice(0, MAX_CONSOLE_MESSAGE_CHARS)}[truncated]`
+              : joined,
+        });
+        return undefined;
+      });
+    const consoleFacade = Object.create(null);
+    for (const level of ["log", "info", "warn", "error"])
+      consoleFacade[level] = addConsole(level);
+
+    const getCurrentPage = () => {
+      const current = session.pages.get(session.currentId);
+      if (!current || current.isClosed())
+        throw new Error("No active page; call openPage(url).");
+      return wrap(current, realm);
+    };
+    const getPages = () =>
+      [...session.pages.values()]
+        .filter((page) => !page.isClosed())
+        .map((page) => wrap(page, realm));
+
+    sandbox.console = Object.freeze(consoleFacade);
+    sandbox.context = wrap(getBrowserContext(), realm);
+    sandbox.state = session.state;
+    Object.assign(sandbox, createUrlGlobals(realm));
+    sandbox.pages = realm.makePages(getPages);
+    sandbox.openPage = realm.safeFunction(async (url = null, options: any = {}) => {
+      if (getConfig().hostOwnedTarget) throw new Error("Open another tab through the host.");
+      if (session.pages.size >= MAX_PAGES_PER_SESSION) {
+        throw new Error(
+          `Browser page limit (${MAX_PAGES_PER_SESSION}) reached for this session.`,
+        );
+      }
+      const rawPage = await getBrowserContext().newPage();
+      const page = adoptPage(rawPage, session.id);
+      if (url) {
+        assertModelNavigationUrl(url);
+        await page.goto(String(url), navigationOptions(options));
+      }
+      return wrap(page, realm);
+    });
+    sandbox.usePage = realm.safeFunction(async (selector) => {
+      assertPageHandle(selector, "usePage");
+      const entries = [...session.pages.entries()].filter(
+        ([, page]) => !page.isClosed(),
+      );
+      const entry = findPageEntry(entries, selector);
+      if (!entry)
+        throw new Error(
+          `Unknown page ${describePageHandle(selector)}; available: ${entries.map(([id]) => id).join(", ")}`,
+        );
+      session.currentId = entry[0];
+      notifyLiveViewPreferred();
+      return wrap(entry[1], realm);
+    });
+    sandbox.closePage = realm.safeFunction(async (selector) => {
+      if (getConfig().hostOwnedTarget) throw new Error("Close this tab through the host.");
+      const target = selector === undefined ? session.currentId : selector;
+      assertPageHandle(target, "closePage");
+      const entries = [...session.pages.entries()];
+      const entry = findPageEntry(entries, target);
+      if (!entry) return { closed: false };
+      await stopPageRecording(entry[1]);
+      await entry[1].close();
+      return { closed: true, pageId: entry[0] };
+    });
+    sandbox.snapshot = realm.safeFunction(async (options) => {
+      const page = await ensureSessionPage(session);
+      return snapshotPage(page, options);
+    });
+    sandbox.artifactPath = realm.safeFunction((requested) =>
+      makeArtifactPath(session, requested),
+    );
+    const recording = Object.create(null);
+    recording.start = realm.safeFunction((options) => startSessionRecording(session, options));
+    recording.stop = realm.safeFunction(() => stopSessionRecording(session));
+    recording.status = realm.safeFunction(() => sessionRecordingStatus(session));
+    recording.restart = realm.safeFunction(async (options) => {
+      await stopSessionRecording(session);
+      return startSessionRecording(session, options);
+    });
+    sandbox.recording = Object.freeze(recording);
+    sandbox.screenshot = buildScreenshot(session, realm);
+    const dialogs = Object.create(null);
+    dialogs.acceptNext = realm.safeFunction((promptText) => {
+      session.nextDialog = { action: "accept", promptText };
+      return { prepared: "accept" };
+    });
+    dialogs.dismissNext = realm.safeFunction(() => {
+      session.nextDialog = { action: "dismiss" };
+      return { prepared: "dismiss" };
+    });
+    const captcha = buildCaptcha(session, realm);
+    const human = buildHuman(session, realm);
+    const overlays = Object.create(null);
+    overlays.dismiss = realm.safeFunction(async () => {
+      const page = await ensureSessionPage(session);
+      return dismissObstructiveOverlays(page);
+    });
+    const controls = Object.create(null);
+    controls.inspect = realm.safeFunction(async () => {
+      const page = await ensureSessionPage(session);
+      return inspectControls(page);
+    });
+    controls.directory = realm.safeFunction(async (options) => {
+      const page = await ensureSessionPage(session);
+      return inspectActionDirectory(page, options);
+    });
+    controls.batch = realm.safeFunction(
+      async (operationsValue, optionsValue: any = {}) => {
+        let operations = operationsValue;
+        let options = optionsValue;
+        if (isObjectValue(operationsValue) && !Array.isArray(operationsValue)) {
+          operations = untrustedField(operationsValue, "operations");
+          options = operationsValue;
+        }
+        const page = await ensureSessionPage(session);
+        return executeUIBatch(page, operations, options);
+      },
+    );
+    const media = Object.create(null);
+    media.inspect = realm.safeFunction(async () => {
+      const page = await ensureSessionPage(session);
+      return inspectMedia(page);
+    });
+    const site = buildSite(session, realm);
+    const webmcp = Object.create(null);
+    webmcp.tools = realm.safeFunction(async (options: any = {}) => {
+      if (!isObjectValue(options) || Array.isArray(options)) {
+        throw new TypeError("webmcp.tools options must be an object.");
+      }
+      const page = await ensureSessionPage(session);
+      return listWebMCPTools(page, {
+        newCDPSession: (target) => getBrowserContext().newCDPSession(target),
+        timeout: untrustedField(options, "timeout"),
+      });
+    });
+    webmcp.invoke = realm.safeFunction(
+      async (name, input: any = {}, options: any = {}) => {
+        const page = await ensureSessionPage(session);
+        return invokeWebMCPTool(page, name, input, options, {
+          newCDPSession: (target) => getBrowserContext().newCDPSession(target),
+        });
+      },
+    );
+    const webagents = buildWebAgents(session, realm);
+    sandbox.dialogs = Object.freeze(dialogs);
+    sandbox.captcha = Object.freeze(captcha);
+    sandbox.human = Object.freeze(human);
+    sandbox.overlays = Object.freeze(overlays);
+    sandbox.controls = Object.freeze(controls);
+    sandbox.media = Object.freeze(media);
+    sandbox.site = Object.freeze(site);
+    sandbox.webmcp = Object.freeze(webmcp);
+    sandbox.webagents = Object.freeze(webagents);
+    sandbox.credentials = buildCredentials(session, realm, execution);
+    realm.installPage(getCurrentPage);
+    return { context, realm, sandbox };
+  }
+
+  return buildSandbox;
+}
diff --git a/src/worker-session.ts b/src/worker-session.ts
new file mode 100644
index 0000000..befcadb
--- /dev/null
+++ b/src/worker-session.ts
@@ -0,0 +1,34 @@
+import type { Page } from "playwright-core";
+
+export const MAX_PAGES_PER_SESSION = 32;
+
+// Session state is constructed without launching a browser or installing process
+// handlers. The worker owns the registry and serializes operations per session.
+export function createSession(id: string) {
+  return {
+    id,
+    pages: new Map<string, Page>(),
+    currentId: null,
+    state: Object.create(null),
+    events: [],
+    artifacts: [],
+    warnings: [],
+    pendingCredentialOrigins: new Map<string, string>(),
+    reservedArtifactBytes: 0,
+    lastActivity: Date.now(),
+    nextDialog: null,
+    awaitingAnswerSince: null,
+    cursor: { x: 0, y: 0, initialized: false },
+    captchaTargets: new Map(),
+    // Coordinates are valid only for the grid they were captured from.
+    captchaGrid: null,
+    // Only a completed scan replaces this set, including clearing it.
+    openChallengeProviders: new Set<string>(),
+    webAgentsAnnouncedOrigins: new Set<string>(),
+    uiDirectoryAnnouncedOrigins: new Set<string>(),
+    // Executions on different sessions must never share recovery state.
+    execution: { requestId: null, pendingRecovery: null, generationStarted: false },
+  };
+}
+
+export type WorkerSession = ReturnType<typeof createSession>;
diff --git a/src/worker-site.ts b/src/worker-site.ts
new file mode 100644
index 0000000..60065b5
--- /dev/null
+++ b/src/worker-site.ts
@@ -0,0 +1,309 @@
+// Per-page request history, guarded same-origin requests, and WebAgents discovery.
+import type { BrowserContext } from "playwright-core";
+import { compactAutomaticUI, hasReturnedUIDirectory } from "./automatic-ui.js";
+import type { createGuardUrl } from "./guard-url.js";
+import { inspectActionDirectory } from "./page-inspect.js";
+import { cookiesFromSetCookie, requestSiteResponse } from "./site-request.js";
+import { normalizeSiteHeaders, SITE_RESPONSE_LIMIT, sameOriginSiteUrl } from "./site-tools.js";
+import { parseWebAgentsDocument, publicWebAgentsManifest, WEBAGENTS_DISCOVERY_PATHS, WebAgentsPathScopeError } from "./webagents.js";
+
+const MAX_SITE_REQUESTS = 512;
+
+interface WorkerSiteDeps {
+  getBrowserContext: () => BrowserContext;
+  getProxyPort: () => number;
+  guardUrl: ReturnType<typeof createGuardUrl>;
+  transportExecuteId: () => string;
+  navigationTimeoutMs: number;
+}
+
+export function createWorkerSite({
+  getBrowserContext,
+  getProxyPort,
+  guardUrl,
+  transportExecuteId,
+  navigationTimeoutMs: DEFAULT_NAVIGATION_TIMEOUT_MS,
+}: WorkerSiteDeps) {
+  const pageSiteRequests = new WeakMap();
+  const pageWebAgentsDiscovery = new WeakMap();
+  const requestSiteRecord = new WeakMap();
+
+  // One observed page request, filled in as its response or failure arrives.
+  interface SiteRequestRecord {
+    method: string;
+    url: string;
+    resourceType: string;
+    status: number | null;
+    mimeType: string;
+    failure: string;
+    at: number;
+  }
+
+  function rememberSiteRequest(page, request) {
+    const records = pageSiteRequests.get(page) || [];
+    pageSiteRequests.set(page, records);
+    const record: SiteRequestRecord = {
+      method: String(request.method() || "GET"),
+      url: String(request.url() || ""),
+      resourceType: String(request.resourceType() || "other"),
+      status: null,
+      mimeType: "",
+      failure: "",
+      at: Date.now(),
+    };
+    records.push(record);
+    if (records.length > MAX_SITE_REQUESTS)
+      records.splice(0, records.length - MAX_SITE_REQUESTS);
+    requestSiteRecord.set(request, record);
+  }
+
+  async function pageSiteRequest(page, url, options: any = {}) {
+    let target = sameOriginSiteUrl(page.url(), url);
+    let method = String(options.method || "GET").trim().toUpperCase();
+    if (!["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE"].includes(method)) {
+      throw new Error("site.request method must be GET, HEAD, POST, PUT, PATCH, or DELETE.");
+    }
+    const headers: Record<string, string> = normalizeSiteHeaders(options.headers);
+    let body;
+    if (Object.hasOwn(options, "json")) {
+      body = JSON.stringify(options.json);
+      headers["content-type"] ||= "application/json";
+    } else if (Object.hasOwn(options, "body")) {
+      body = String(options.body);
+    }
+    if (body && Buffer.byteLength(body) > SITE_RESPONSE_LIMIT) {
+      throw new Error(`site.request body exceeds ${SITE_RESPONSE_LIMIT} bytes.`);
+    }
+    const pageUrl = page.url();
+    headers.origin ||= new URL(pageUrl).origin;
+    headers.referer ||= pageUrl;
+    headers["accept-encoding"] ||= "identity";
+    let response;
+    for (let redirects = 0; redirects <= 5; redirects += 1) {
+      const decision = await guardUrl(
+        target,
+        { method, resourceType: "fetch", siteHelper: true },
+        transportExecuteId(),
+      );
+      if (!decision?.allowed) {
+        throw new Error(decision?.reason || "site.request was blocked by policy.");
+      }
+      const requestHeaders = { ...headers };
+      const cookieHeader = (await getBrowserContext().cookies(target).catch(() => []))
+        .map((cookie) => `${cookie.name}=${cookie.value}`)
+        .join("; ");
+      if (cookieHeader) requestHeaders.cookie = cookieHeader;
+      response = await requestSiteResponse({
+        target,
+        proxyPort: getProxyPort(),
+        method,
+        headers: requestHeaders,
+        body:
+          body !== undefined && !["GET", "HEAD"].includes(method)
+            ? body
+            : undefined,
+        timeoutMs: DEFAULT_NAVIGATION_TIMEOUT_MS,
+        limit: SITE_RESPONSE_LIMIT,
+      });
+      const responseCookies = cookiesFromSetCookie(response.setCookie, target);
+      if (responseCookies.length) {
+        await getBrowserContext().addCookies(responseCookies).catch(() => {});
+      }
+      const location = response.headers.location;
+      if (![301, 302, 303, 307, 308].includes(response.status) || !location) {
+        break;
+      }
+      if (redirects === 5) throw new Error("site.request exceeded 5 redirects.");
+      target = sameOriginSiteUrl(pageUrl, new URL(location, target).href);
+      if (response.status === 303 ||
+        ([301, 302].includes(response.status) && method === "POST")) {
+        method = "GET";
+        body = undefined;
+      }
+    }
+    const bytes = response.bytes;
+    const text = bytes.toString("utf8");
+    const responseHeaders = response.headers;
+    const result = {
+      ok: response.status >= 200 && response.status < 300,
+      status: response.status,
+      statusText: response.statusText,
+      url: target,
+      contentType: responseHeaders["content-type"] || "",
+      text,
+      truncated: response.truncated,
+      length: response.length,
+    };
+    const records = pageSiteRequests.get(page) || [];
+    records.push({
+      method,
+      url: result.url,
+      resourceType: "fetch",
+      status: result.status,
+      mimeType: result.contentType.split(";", 1)[0].trim(),
+      failure: "",
+      at: Date.now(),
+    });
+    if (records.length > MAX_SITE_REQUESTS) {
+      records.splice(0, records.length - MAX_SITE_REQUESTS);
+    }
+    pageSiteRequests.set(page, records);
+    if (options.response === "json") {
+      try {
+        return { ...result, json: result.text ? JSON.parse(result.text) : null };
+      } catch {
+        throw new Error(`site.request expected JSON but received ${result.contentType || "unknown content"}.`);
+      }
+    }
+    return result;
+  }
+
+  async function discoverPageWebAgents(page, { refresh = false }: any = {}) {
+    let origin;
+    let pathname;
+    try {
+      const activeUrl = new URL(page.url());
+      origin = activeUrl.origin;
+      pathname = activeUrl.pathname;
+    } catch {
+      return {
+        manifest: null,
+        error: "WebAgents discovery requires an open HTTP(S) page.",
+      };
+    }
+    const cached = pageWebAgentsDiscovery.get(page);
+    if (
+      !refresh &&
+      cached?.origin === origin &&
+      (
+        cached.pathname === pathname ||
+        (!cached.manifest && cached.pathScoped !== true)
+      )
+    ) return cached;
+
+    const errors: string[] = [];
+    let pathScoped = false;
+    const probes = await Promise.all(WEBAGENTS_DISCOVERY_PATHS.map(async (path) => {
+      try {
+        return { path, response: await pageSiteRequest(page, path, { method: "GET" }) };
+      } catch (error) {
+        return { path, error };
+      }
+    }));
+    for (const probe of probes) {
+      const { path } = probe;
+      if ("error" in probe) {
+        errors.push(`${path}: ${probe.error?.message || probe.error}`);
+        continue;
+      }
+      const { response } = probe;
+      if (response.status === 404 || response.status === 410) continue;
+      if (!response.ok) {
+        errors.push(`${path}: HTTP ${response.status}`);
+        continue;
+      }
+      try {
+        const manifest = parseWebAgentsDocument(
+          response.text,
+          response.url,
+          page.url(),
+        );
+        const entry = { origin, pathname, manifest, error: "" };
+        pageWebAgentsDiscovery.set(page, entry);
+        return entry;
+      } catch (error) {
+        if (error instanceof WebAgentsPathScopeError) pathScoped = true;
+        errors.push(`${path}: ${error?.message || error}`);
+      }
+    }
+    const entry = {
+      origin,
+      pathname,
+      manifest: null,
+      pathScoped,
+      error: errors[0] || "This origin does not publish WebAgents.",
+    };
+    pageWebAgentsDiscovery.set(page, entry);
+    return entry;
+  }
+
+  async function unannouncedWebAgentsDirectory(session) {
+    const page = session.pages.get(session.currentId);
+    if (!page || page.isClosed()) return null;
+    let origin;
+    try {
+      const url = new URL(page.url());
+      if (!new Set(["http:", "https:"]).has(url.protocol)) return null;
+      origin = `${url.origin}${url.pathname}`;
+    } catch {
+      return null;
+    }
+    if (session.webAgentsAnnouncedOrigins.has(origin)) return null;
+    session.webAgentsAnnouncedOrigins.add(origin);
+    const discovered = await discoverPageWebAgents(page);
+    return discovered.manifest ? publicWebAgentsManifest(discovered.manifest) : null;
+  }
+
+  async function unannouncedUIDirectory(session, result) {
+    const page = session.pages.get(session.currentId);
+    if (!page || page.isClosed()) return null;
+    let key;
+    try {
+      const url = new URL(page.url());
+      if (!new Set(["http:", "https:"]).has(url.protocol)) return null;
+      key = `${url.origin}${url.pathname}`;
+    } catch {
+      return null;
+    }
+    if (session.uiDirectoryAnnouncedOrigins.has(key)) return null;
+    const discovered = pageWebAgentsDiscovery.get(page);
+    if (!discovered || discovered.manifest) return null;
+    session.uiDirectoryAnnouncedOrigins.add(key);
+    if (hasReturnedUIDirectory(result)) return null;
+    const directory = await inspectActionDirectory(page);
+    return directory.controls.length ? compactAutomaticUI(directory) : null;
+  }
+
+  async function inspectSiteAssets(page) {
+    const domAssets = await page.evaluate(() =>
+      [
+        ...[...document.scripts].map((element) => ({
+          url: element.src,
+          resourceType: "script",
+        })),
+        ...[...document.querySelectorAll('link[rel~="stylesheet"]')].map(
+          (element: HTMLLinkElement) => ({
+            url: element.href,
+            resourceType: "stylesheet",
+          }),
+        ),
+      ].filter((entry) => entry.url),
+    );
+    const networkAssets = (pageSiteRequests.get(page) || [])
+      .filter((record) =>
+        ["script", "stylesheet", "fetch", "xhr"].includes(record.resourceType),
+      )
+      .map(({ url, resourceType, status, mimeType }) => ({
+        url,
+        resourceType,
+        status,
+        mimeType,
+      }));
+    const unique = new Map();
+    for (const asset of [...domAssets, ...networkAssets]) {
+      if (!unique.has(asset.url)) unique.set(asset.url, asset);
+    }
+    return [...unique.values()].slice(0, MAX_SITE_REQUESTS);
+  }
+
+  return {
+    pageSiteRequests,
+    requestSiteRecord,
+    rememberSiteRequest,
+    pageSiteRequest,
+    discoverPageWebAgents,
+    unannouncedWebAgentsDirectory,
+    unannouncedUIDirectory,
+    inspectSiteAssets,
+  };
+}
diff --git a/src/worker-snapshots.ts b/src/worker-snapshots.ts
new file mode 100644
index 0000000..468a5f9
--- /dev/null
+++ b/src/worker-snapshots.ts
@@ -0,0 +1,147 @@
+import type { Page } from "playwright-core";
+import {
+  compressSnapshot,
+  diffSnapshots,
+  filterInteractive,
+} from "./snapshot.js";
+import type { UntrustedValue } from "./untrusted-value.js";
+
+export const DEFAULT_SNAPSHOT_MAX_CHARS = 10_000;
+export const MAX_SNAPSHOT_MAX_CHARS = 20_000;
+
+interface WorkerSnapshotsDeps {
+  trackSecret: (value: string) => void;
+  pageId: (page: Page) => string;
+  actionTimeoutMs: number;
+}
+
+export function createWorkerSnapshots(deps: WorkerSnapshotsDeps) {
+  // Last snapshot text per page, keyed by the options that shape it, so
+  // `diff: true` always compares like against like.
+  const lastSnapshots = new WeakMap<Page, Map<string, string>>();
+
+  // Replace any `<input type=password>` value with "[redacted]" in an aria
+  // snapshot. The values are read in the privileged worker (never handed to the
+  // sandbox) only to scrub them from the returned text and register them with the
+  // redaction net; nothing about them is returned. Empty when the page has no
+  // filled password field, so ordinary pages pay only one cheap evaluate.
+  async function redactPasswordValues(page: Page, text: string) {
+    if (!text) return text;
+    let values: string[];
+    try {
+      const perFrame = await Promise.all(
+        page.frames().map((frame) =>
+          frame
+            .evaluate(() => {
+              const isFilledText = (value: UntrustedValue): value is string =>
+                typeof value === "string" && value.length > 0;
+              // SAFETY: the selector matches only password inputs, whose HTML
+              // interface is HTMLInputElement; an impostor element from another
+              // namespace reads `value` as undefined and fails the guard.
+              return Array.from(document.querySelectorAll("input[type=password]"))
+                .map((element) => (element as HTMLInputElement).value)
+                .filter(isFilledText);
+            })
+            .catch(() => []),
+        ),
+      );
+      values = [...new Set(perFrame.flat())];
+    } catch {
+      // A page mid-navigation may refuse evaluate; the snapshot still returns.
+      return text;
+    }
+    let out = text;
+    for (const value of values) {
+      deps.trackSecret(value);
+      out = out.split(value).join("[redacted]");
+    }
+    return out;
+  }
+
+  async function snapshotPage(page: Page, options: any = {}) {
+    const depth = Math.floor(Number(options?.depth) || 0);
+    const ref = options?.ref ? String(options.ref) : "";
+    if (ref && !/^(?:f\d+)*e\d+$/.test(ref))
+      throw new Error(
+        `Invalid snapshot ref "${ref}" — expected a marker like "e12" or "f1e3".`,
+      );
+    const scope = ref
+      ? page.locator(`aria-ref=${ref}`)
+      : options?.selector
+        ? page.locator(String(options.selector))
+        : page.locator("body");
+    const snapshotRequest = {
+      mode: "ai" as const,
+      timeout: Number(options?.timeout || deps.actionTimeoutMs),
+    };
+    let text = await scope.ariaSnapshot(
+      depth > 0 ? { ...snapshotRequest, depth } : snapshotRequest,
+    );
+    // Playwright's aria snapshot includes filled input values, including
+    // `<input type=password>`. Scrub those before the text is stored (for diffs),
+    // truncated, or returned, so a routine read never slurps a just-typed or
+    // extension-filled secret into model context.
+    text = await redactPasswordValues(page, text);
+    text = compressSnapshot(text, { urls: options?.urls === true });
+    if (options?.interactive) text = filterInteractive(text);
+
+    const key = JSON.stringify([
+      ref,
+      String(options?.selector || ""),
+      Boolean(options?.interactive),
+      depth,
+      options?.urls === true,
+    ]);
+
+    let title = "";
+    try {
+      const rawTitle = await page.title();
+      title = String(rawTitle)
+        .replace(/\s+/g, " ")
+        .trim()
+        .slice(0, 120);
+    } catch {
+      // A page mid-navigation can refuse title(); the header works without it.
+    }
+    const header = `page ${deps.pageId(page)} ${page.url()}${title ? ` "${title}"` : ""}`;
+    const store = lastSnapshots.get(page) || new Map<string, string>();
+    lastSnapshots.set(page, store);
+    const previous = store.get(key);
+    const current = text;
+    if (options?.diff && previous !== undefined) {
+      const result = diffSnapshots(previous, text);
+      if (!result.changed)
+        return `${header}\n(no changes since previous snapshot)`;
+      if (!result.tooLarge)
+        text = `diff vs previous snapshot (+${result.additions} -${result.removals})\n${result.diff}`;
+    }
+    const limit = Math.max(
+      1_000,
+      Math.min(Number(options?.maxChars || DEFAULT_SNAPSHOT_MAX_CHARS), MAX_SNAPSHOT_MAX_CHARS),
+    );
+    if (text.length <= limit) {
+      store.set(key, current);
+      return `${header}\n${text}`;
+    }
+    // Refuse instead of truncating: a cut-off tree reads as complete and sends
+    // the model acting on half a page, while an error steers it to a scoped
+    // re-read.
+    const hints = [];
+    if (!options?.interactive)
+      hints.push("{interactive: true} to keep only actionable elements");
+    hints.push(
+      options?.ref || options?.selector
+        ? "a smaller {depth} or a deeper {ref}/{selector} to narrow this subtree"
+        : "{ref} or {selector} to scope to one element, or {depth} to limit nesting",
+    );
+    if (limit < MAX_SNAPSHOT_MAX_CHARS) hints.push(`{maxChars} up to ${MAX_SNAPSHOT_MAX_CHARS}`);
+    return (
+      `${header}\nSnapshot is ${text.length} chars, over the ${limit} limit. ` +
+      `Retry with ${hints.join(", ")}.`
+    );
+  }
+
+  return {
+    snapshotPage,
+  };
+}
diff --git a/src/worker.ts b/src/worker.ts
index dcc5d21..241ee4a 100644
--- a/src/worker.ts
+++ b/src/worker.ts
@@ -12,12 +12,7 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import readline from "node:readline";
-import { types as utilTypes } from "node:util";
-import vm from "node:vm";
-import type { Page } from "playwright-core";
 import { getDomain } from "tldts";
-import type { RecordingStatus } from "../types/recording.js";
-import { compactAutomaticUI, hasReturnedUIDirectory } from "./automatic-ui.js";
 import {
   cookieSyncConsentTarget,
   ProviderCleanupError,
@@ -32,40 +27,9 @@ import {
   chromiumNeedsSoftwareGpu,
   managedForkArgs,
 } from "./browser-runtime.js";
+import { createCaptchaRuntime } from "./captcha-runtime.js";
+import { createChallengeScanner, markChallengesForWorkerRestart } from "./challenge-scan.js";
 import {
-  blobToPageBounds,
-  buildSolveResult,
-  CAPTCHA_SOLVE_STATUSES,
-  CAPTCHA_STAGES,
-  CHALLENGE_INSTRUCTION_SELECTORS,
-  CHALLENGE_WIDGET_SELECTORS,
-  CHECKBOX_SELECTORS,
-  classifyChallengeStage,
-  clusterSimilarBoxes,
-  extractDarkBlobs,
-  findGrowingRegion,
-  gridFromTiles,
-  IMAGE_TILE_SELECTORS,
-  isCaptchaChromeLabel,
-  isCaptchaSkipSubmitLabel,
-  isCaptchaVerifySubmitReady,
-  MOTION_CONFIRM_SELECTORS,
-  maxAutoStages,
-  nextSolveAction,
-  parseTileIndexes,
-  pickBestTileSet,
-  pickDragFitPair,
-  SELECTED_IMAGE_TILE_SELECTORS,
-  SLIDER_SELECTORS,
-  solveTimeoutMs,
-  unionClip,
-  VERIFY_BUTTON_SELECTORS,
-  visionGridInstruction,
-  WIDGET_FRAME_PATTERNS,
-} from "./captcha-solver.js";
-import {
-  challengeScanNeeded,
-  detectBotChallenge,
   isPublicSearchNavigation,
   PUBLIC_SEARCH_BLOCK_ADVICE,
 } from "./challenges.js";
@@ -90,36 +54,16 @@ import {
   downloadBehaviorParams,
   normalizeDownloadPolicy,
 } from "./downloads.js";
-import { mkdirPrivate, writePrivate, writePrivateBytes } from "./fs-private.js";
+import { mkdirPrivate, writePrivate } from "./fs-private.js";
 import {
   createGuardProxy,
   httpGetViaProxy,
   parseUpstreamProxy,
 } from "./guard-proxy.js";
 import { createGuardUrl } from "./guard-url.js";
-import {
-  movePointer,
-  pointInside,
-  pressPointer,
-  scrollWheel,
-  typedTextLanded,
-  typeText,
-} from "./human.js";
 import { buildLaunchIdentityPlan, resolveGeoIdentity } from "./launch-identity.js";
-import { createLiveViewServer } from "./live-view.js";
-import { liveViewHtml, liveViewLoginHtml } from "./live-view-html.js";
-import { applyNavigationDefaults, navigateHistory, navigationOptions } from "./navigation-defaults.js";
-import {
-  createSnippetPageEvents,
-  isSnippetPageEventMethod,
-} from "./page-events.js";
-import {
-  dismissObstructiveOverlays,
-  inspectActionDirectory,
-  inspectActionEvidence,
-  inspectControls,
-  inspectMedia,
-} from "./page-inspect.js";
+import { createSnippetPageEvents } from "./page-events.js";
+import { inspectActionEvidence } from "./page-inspect.js";
 import { parkingEnabled, parkSession, unparkSession } from "./page-park.js";
 import {
   acquireProfileLock,
@@ -127,54 +71,27 @@ import {
   releaseProfileLockDir,
   touchProfileLock,
 } from "./profile-lock.js";
-import type { RecordingHandle } from "./recording.js";
 import {
-  cookiesFromSetCookie,
-  requestSiteResponse,
-} from "./site-request.js";
-import {
-  normalizeSiteHeaders,
-  SITE_RESPONSE_LIMIT,
-  sameOriginSiteUrl,
-  siteTextExcerpts,
-} from "./site-tools.js";
-import {
-  compressSnapshot,
-  diffSnapshots,
-  filterInteractive,
-  parseAnnotationBoxes,
-} from "./snapshot.js";
-import { executeUIBatch } from "./ui-batch.js";
-import {
-  isBoolean,
   isCallable,
   isNumber,
+  isObjectValue,
   isString,
-  type UntrustedFunction,
-  type UntrustedValue,
   untrustedField,
 } from "./untrusted-value.js";
 import { httpOrigin, installVaultCapture } from "./vault-capture.js";
-import {
-  parseWebAgentsDocument,
-  prepareWebAgentsBatch,
-  publicWebAgentsManifest,
-  WEBAGENTS_DISCOVERY_PATHS,
-  WebAgentsPathScopeError,
-} from "./webagents.js";
-import {
-  invokeWebMCPTool,
-  listWebMCPTools,
-  WEBMCP_FEATURE_SWITCH,
-} from "./webmcp.js";
+import { WEBMCP_FEATURE_SWITCH } from "./webmcp.js";
+import { createWorkerArtifacts } from "./worker-artifacts.js";
+import { createHumanInput } from "./worker-human.js";
+import { createWorkerLiveView } from "./worker-live-view.js";
+import { createWorkerRealm } from "./worker-realm.js";
+import { createWorkerSandbox } from "./worker-sandbox.js";
+import { createSession, MAX_PAGES_PER_SESSION, type WorkerSession } from "./worker-session.js";
+import { createWorkerSite } from "./worker-site.js";
+import { createWorkerSnapshots } from "./worker-snapshots.js";
 
 const WORKER_VERSION = 1;
 const MAX_EVENTS = 40;
-const MAX_CONSOLE_MESSAGES = 20;
-const MAX_CONSOLE_MESSAGE_CHARS = 300;
-const MAX_PAGES_PER_SESSION = 32;
 const MAX_RESPONSE_PAGES = 32;
-const MAX_TRACKED_ARTIFACTS = 500;
 // Sized so a default-limit run result (below) fits with its console, events,
 // and page list without sendResult stripping the diagnostics. A string result
 // counts by its raw length here, as it does for the output limit.
@@ -195,35 +112,12 @@ const DEFAULT_OUTPUT_LIMIT = 12_000;
  */
 const DEFAULT_ACTION_TIMEOUT_MS = 5_000;
 const DEFAULT_NAVIGATION_TIMEOUT_MS = 30_000;
-// A real page's compressed tree is often 12-40K chars, so a first unscoped
-// snapshot is usually refused with scoping hints. That round trip is cheaper
-// than carrying a 20K+ tree in context for every later turn: doubling these
-// caps in 2.8.5 grew final context 11-43% on shopping tasks without saving
-// wall-clock. The ceiling is for a snippet that knows it needs a large tree.
-const DEFAULT_SNAPSHOT_MAX_CHARS = 10_000;
-const MAX_SNAPSHOT_MAX_CHARS = 20_000;
 /**
  * Hard ceiling on graceful shutdown. If the browser or a page handler wedges,
  * the process still exits rather than lingering and holding the profile lock.
  */
 const SHUTDOWN_FAILSAFE_MS = 15_000;
-const DEFAULT_ARTIFACT_QUOTA = 100 * 1024 * 1024;
-const DEFAULT_DOWNLOAD_LIMIT = 50 * 1024 * 1024;
-const DEFAULT_SCREENSHOT_LIMIT = 10 * 1024 * 1024;
-const DEFAULT_SCREENSHOT_PIXEL_LIMIT = 40_000_000;
-const DEFAULT_RECORDING_LIMIT = 50 * 1024 * 1024;
 
-type RecordingOwner = { handle: RecordingHandle; page: Page; path: string };
-type SessionRecording =
-  | { state: "starting"; ready: Promise<RecordingOwner> }
-  | { state: "active"; page: Page; path: string; ready: Promise<RecordingOwner> }
-  | { state: "finished"; page: Page; path: string; result: RecordingStatus };
-const sessionRecordings = new Map<string, SessionRecording>();
-// Playwright's screenshot waits for `document.fonts`. Challenge widgets often
-// load webfonts that never settle behind the guard, so the default 30s timeout
-// burns the whole solve budget. Fail over to CDP before that happens.
-const DEFAULT_SCREENSHOT_TIMEOUT_MS = 15_000;
-const CAPTCHA_SCREENSHOT_TIMEOUT_MS = 8_000;
 const SAFE_SYNC_VM_TIMEOUT_MS = 1_000;
 const MAX_ACTIVE_SECRETS = 200;
 const MAX_ACTIVE_COOKIE_SECRETS = 20_000;
@@ -235,32 +129,6 @@ const COOKIE_SYNC_UNPARTITIONED_TOTAL_LIMIT = 3_000;
 const COOKIE_SYNC_DOMAIN_LIMIT = 150;
 const COOKIE_SYNC_PARTITION_BYTES_LIMIT = 10_240;
 
-// Guards for values that cross the vm/page bridges, alongside the shared ones
-// in untrusted-value.ts. The shared isRecord excludes arrays, which the call
-// sites here must keep, and UntrustedFunction accepts no arguments, while the
-// bridge forwards prepared values into model-authored callbacks.
-function isObjectValue(value: UntrustedValue): value is UntrustedValue & object {
-  return typeof value === "object" && value !== null;
-}
-
-function isWrappableValue(value: UntrustedValue): value is UntrustedValue & object {
-  return (typeof value === "object" || typeof value === "function") && value !== null;
-}
-
-function isSymbolValue(value: UntrustedValue): value is symbol {
-  return typeof value === "symbol";
-}
-
-function isBigIntValue(value: UntrustedValue): value is bigint {
-  return typeof value === "bigint";
-}
-
-function isInvocable(
-  value: UntrustedValue,
-): value is (...args: UntrustedValue[]) => UntrustedValue {
-  return typeof value === "function";
-}
-
 let browserContext = null;
 let transportProxyPort = 0;
 let launchPromise = null;
@@ -382,7 +250,7 @@ function quietSessionPages(session) {
     !parkingEnabled({
       config: launchConfig,
       headless: launchConfig?.headless !== false,
-      liveView: Boolean(liveView),
+      liveView: workerLiveView.hasView(),
     })
   )
     return;
@@ -394,11 +262,8 @@ function quietSessionPages(session) {
     if (!browserContext || sessionIsExecuting(session.id)) return;
     void parkSession(session, {
       newCDPSession: (page) => browserContext.newCDPSession(page),
-      isBusy: (page) => {
-        const recording = sessionRecordings.get(session.id);
-        return vaultCapture?.isBusy(page) === true || recording?.state === "starting" ||
-          (recording?.state === "active" && recording.page === page);
-      },
+      isBusy: (page) =>
+        vaultCapture?.isBusy(page) === true || pageRecordingIsBusy(session.id, page),
     }).catch(() => {});
   }, PARK_IDLE_DELAY_MS);
   // A pending park must never be the reason the worker stays alive.
@@ -420,15 +285,9 @@ const approvedDownloadSessions = new Set();
 // of the last execute to start stomping on a peer's approval.
 let downloadAllowHolders = 0;
 let vaultCapture = null;
-// The opt-in live-view server (live-view.ts). Lives in this process because
-// the CDP sessions frames come from are worker-internal; started only by an
-// explicit live_view_start message from the host, loopback + token by default.
-let liveView = null;
-
-const sessions = new Map();
+const sessions = new Map<string, WorkerSession>();
 const pageToSession = new WeakMap();
 const pageIds = new WeakMap();
-const facadeToRaw = new WeakMap();
 const pendingRpc = new Map();
 const activeSecrets = new Set();
 const cookieSecrets = new Set();
@@ -713,18 +572,6 @@ function hostDelay(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-function safeName(value, fallback = "artifact") {
-  const base = path.basename(String(value || fallback));
-  const cleaned = base.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^[-.]+/, "");
-  return (cleaned || fallback).slice(0, 160);
-}
-
-function uniqueName(name) {
-  const ext = path.extname(name);
-  const stem = path.basename(name, ext);
-  return `${stem}-${Date.now()}-${crypto.randomBytes(3).toString("hex")}${ext}`;
-}
-
 function startProfileLockHeartbeat() {
   if (!profileLock?.ownerFile || profileLockHeartbeat) return;
   profileLockHeartbeat = setInterval(() => {
@@ -896,35 +743,7 @@ function sessionFor(id) {
   const sessionId = String(id || "default");
   let session = sessions.get(sessionId);
   if (!session) {
-    session = {
-      id: sessionId,
-      pages: new Map(),
-      currentId: null,
-      state: Object.create(null),
-      events: [],
-      artifacts: [],
-      warnings: [],
-      pendingCredentialOrigins: new Map(),
-      reservedArtifactBytes: 0,
-      lastActivity: Date.now(),
-      nextDialog: null,
-      awaitingAnswerSince: null,
-      cursor: { x: 0, y: 0, initialized: false },
-      captchaTargets: new Map(),
-      // Identity of the grid captchaTargets was captured from, so stale
-      // coordinates are never replayed against a replaced challenge.
-      captchaGrid: null,
-      // Providers whose challenge was still unsolved at the end of the last
-      // execute. Non-empty forces the full frame scan on the next one; only a
-      // full scan writes this set, so it always drains once the page clears.
-      openChallengeProviders: new Set(),
-      webAgentsAnnouncedOrigins: new Set(),
-      uiDirectoryAnnouncedOrigins: new Set(),
-      // State that belongs to the execute currently running on this session.
-      // Per-session, not global: sessions run concurrently, so one execute's
-      // teardown must not clear another's request id or pending credential.
-      execution: { requestId: null, pendingRecovery: null, generationStarted: false },
-    };
+    session = createSession(sessionId);
     sessions.set(sessionId, session);
   }
   session.lastActivity = Date.now();
@@ -998,470 +817,6 @@ function pageId(page) {
   return id;
 }
 
-function artifactDir(session) {
-  const root = launchConfig.artifactsDir;
-  const safeSession = crypto
-    .createHash("sha256")
-    .update(session.id)
-    .digest("hex")
-    .slice(0, 16);
-  const dir = path.join(root, safeSession);
-  mkdirPrivate(dir);
-  return dir;
-}
-
-function configuredLimit(value, fallback) {
-  const parsed = Number(value);
-  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
-}
-
-function downloadByteLimit() {
-  return Math.min(
-    configuredLimit(launchConfig.maxDownloadBytes, DEFAULT_DOWNLOAD_LIMIT),
-    configuredLimit(launchConfig.maxArtifactBytes, DEFAULT_ARTIFACT_QUOTA),
-  );
-}
-
-function pruneArtifactQuota(session, incomingBytes = 0) {
-  const root = artifactDir(session);
-  const limit = configuredLimit(
-    launchConfig.maxArtifactBytes,
-    DEFAULT_ARTIFACT_QUOTA,
-  );
-  if (incomingBytes > limit) {
-    throw new Error(`Browser artifact exceeds the ${limit}-byte artifact limit.`);
-  }
-  let total = Number(session.reservedArtifactBytes) || 0;
-  const files = [];
-  for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
-    if (!entry.isFile()) continue;
-    const file = path.join(root, entry.name);
-    const recording = sessionRecordings.get(session.id);
-    if (recording?.state === "active" && recording.path === file) continue;
-    const stat = fs.statSync(file);
-    total += stat.size;
-    files.push({ file, size: stat.size, mtime: stat.mtimeMs });
-  }
-  if (total + incomingBytes <= limit) return;
-  files.sort((left, right) => left.mtime - right.mtime);
-  for (const item of files) {
-    if (total + incomingBytes <= limit) break;
-    fs.rmSync(item.file, { force: true });
-    total -= item.size;
-    session.warnings.push(
-      `Artifact quota removed ${path.basename(item.file)}.`,
-    );
-  }
-  if (total + incomingBytes > limit) {
-    throw new Error(`Browser artifact quota cannot reserve ${incomingBytes} bytes.`);
-  }
-}
-
-function reserveArtifactQuota(session, bytes) {
-  pruneArtifactQuota(session, bytes);
-  session.reservedArtifactBytes += bytes;
-  let released = false;
-  return () => {
-    if (released) return;
-    released = true;
-    session.reservedArtifactBytes = Math.max(
-      0,
-      session.reservedArtifactBytes - bytes,
-    );
-  };
-}
-
-function writeBoundedArtifact(session, file, content, perFileLimit, label) {
-  if (!Buffer.isBuffer(content)) throw new Error(`${label} did not produce bytes.`);
-  if (content.length > perFileLimit) {
-    throw new Error(`${label} exceeds the ${perFileLimit}-byte limit.`);
-  }
-  pruneArtifactQuota(session, content.length);
-  writePrivateBytes(file, content);
-}
-
-function makeArtifactPath(
-  session,
-  requested,
-  fallback = "artifact.txt",
-  track = true,
-) {
-  const recordingSlots = sessionRecordings.get(session.id)?.state === "active" ? 1 : 0;
-  if (session.artifacts.length + recordingSlots >= MAX_TRACKED_ARTIFACTS) {
-    throw new Error(
-      `Browser artifact limit (${MAX_TRACKED_ARTIFACTS}) reached for this session.`,
-    );
-  }
-  const name = uniqueName(safeName(requested, fallback));
-  const file = path.join(artifactDir(session), name);
-  if (track) session.artifacts.push({ kind: "artifact", path: file });
-  return file;
-}
-
-async function startSessionRecording(session, options = {}) {
-  if (!isObjectValue(options) || Array.isArray(options)) {
-    throw new TypeError("recording.start options must be an object.");
-  }
-  const requested = untrustedField(options, "name") ?? "recording.mp4";
-  if (!isString(requested) || !requested.trim() ||
-      requested !== path.basename(requested) || requested !== path.win32.basename(requested) ||
-      !/\.(mp4|webm)$/i.test(requested)) {
-    throw new TypeError("Recording name must be a .mp4 or .webm filename without directories.");
-  }
-  const current = sessionRecordings.get(session.id);
-  if (current && current.state !== "finished") {
-    throw new Error("A recording is already active in this session. Stop it or use recording.restart().");
-  }
-  const pending: Extract<SessionRecording, { state: "starting" }> = {
-    state: "starting",
-    ready: Promise.resolve().then(async () => {
-      let release = () => {};
-      let page: Page | undefined;
-      let active: Extract<SessionRecording, { state: "active" }> | undefined;
-      const onPageClosed = () => {
-        void pending.ready.then(({ handle }) => handle.stop()).catch(() => {});
-      };
-      try {
-        const { normalizeRecordingOptions, startRecording } = await import("./recording.js");
-        const settings = normalizeRecordingOptions(options);
-        page = await ensureSessionPage(session);
-        const file = makeArtifactPath(session, requested, "recording.mp4", false);
-        const maxBytes = Math.max(1, Math.floor(Math.min(
-          DEFAULT_RECORDING_LIMIT,
-          configuredLimit(launchConfig.maxArtifactBytes, DEFAULT_ARTIFACT_QUOTA) / 2,
-        )));
-        release = reserveArtifactQuota(session, maxBytes);
-        active = { state: "active", page, path: file, ready: pending.ready };
-        sessionRecordings.set(session.id, active);
-        page.once("close", onPageClosed);
-        page.once("crash", onPageClosed);
-        await wakeSessionPages(session);
-        const cdp = await browserContext.newCDPSession(page);
-        const handle = await startRecording({
-          cdp,
-          path: file,
-          options: settings,
-          maxBytes,
-          onStop: (result) => {
-            release();
-            page.off("close", onPageClosed);
-            page.off("crash", onPageClosed);
-            if (sessionRecordings.get(session.id) !== active) return;
-            sessionRecordings.set(session.id, { state: "finished", page, path: file, result });
-            if (result.state === "completed") {
-              session.artifacts.push({ kind: "recording", path: file, mimeType: /\.webm$/i.test(file) ? "video/webm" : "video/mp4" });
-            } else if (result.state === "failed") {
-              session.warnings.push(`Recording failed: ${redactText(result.error)}`);
-            }
-            quietSessionPages(session);
-          },
-        });
-        return { handle, page, path: file };
-      } catch (error) {
-        release();
-        page?.off("close", onPageClosed);
-        page?.off("crash", onPageClosed);
-        const entry = sessionRecordings.get(session.id);
-        if (entry === pending || entry === active) sessionRecordings.delete(session.id);
-        throw error;
-      }
-    }),
-  };
-  sessionRecordings.set(session.id, pending);
-  const { handle, page } = await pending.ready;
-  return Object.assign(Object.create(null), handle.status(), { pageId: pageId(page) });
-}
-
-async function sessionRecordingStatus(session) {
-  const entry = sessionRecordings.get(session.id);
-  if (!entry) return Object.assign(Object.create(null), { state: "idle" });
-  if (entry.state === "finished") {
-    return Object.assign(Object.create(null), entry.result, { pageId: pageId(entry.page) });
-  }
-  const { handle, page } = await entry.ready;
-  return Object.assign(Object.create(null), handle.status(), { pageId: pageId(page) });
-}
-
-async function stopSessionRecording(session) {
-  const entry = sessionRecordings.get(session.id);
-  if (!entry) return Object.assign(Object.create(null), { state: "idle" });
-  if (entry.state === "finished") {
-    return Object.assign(Object.create(null), entry.result, { pageId: pageId(entry.page) });
-  }
-  const { handle, page } = await entry.ready;
-  return Object.assign(Object.create(null), await handle.stop(), { pageId: pageId(page) });
-}
-
-async function stopPageRecording(page) {
-  for (const session of sessions.values()) {
-    if (![...session.pages.values()].includes(page)) continue;
-    const entry = sessionRecordings.get(session.id);
-    if (!entry || entry.state === "finished") continue;
-    const owner = await entry.ready.catch(() => undefined);
-    if (owner?.page === page) await owner.handle.stop();
-  }
-}
-
-async function assertScreenshotPixelLimit(page, options) {
-  const scale = options.scale === "css"
-    ? 1
-    : await page
-        .evaluate(() => window.devicePixelRatio || 1)
-        .catch(() => 1);
-  const metrics = options.clip
-    ? {
-        width: Number(options.clip.width),
-        height: Number(options.clip.height),
-      }
-    : options.fullPage
-      ? await page.evaluate(() => ({
-          width: Math.max(
-            document.documentElement.scrollWidth,
-            document.body?.scrollWidth || 0,
-          ),
-          height: Math.max(
-            document.documentElement.scrollHeight,
-            document.body?.scrollHeight || 0,
-          ),
-        }))
-      : page.viewportSize() || { width: 1440, height: 900 };
-  const pixels =
-    Math.ceil(metrics.width * scale) * Math.ceil(metrics.height * scale);
-  const limit = configuredLimit(
-    launchConfig.maxScreenshotPixels,
-    DEFAULT_SCREENSHOT_PIXEL_LIMIT,
-  );
-  if (!Number.isFinite(pixels) || pixels <= 0 || pixels > limit) {
-    throw new Error(`Screenshot pixel limit (${limit}) exceeded.`);
-  }
-}
-
-// Overlay id namespaced to avoid colliding with page-owned elements. The
-// overlay is pointer-events:none and removed right after capture.
-const ANNOTATION_OVERLAY_ID = "__betterwright_annotations__";
-const CAPTCHA_TILE_OVERLAY_ID = "__betterwright_captcha_tiles__";
-
-function drawAnnotationOverlay({ boxes, fullPage, overlayId }) {
-  document.getElementById(overlayId)?.remove();
-  const root = document.createElement("div");
-  root.id = overlayId;
-  const dx = fullPage ? window.scrollX : 0;
-  const dy = fullPage ? window.scrollY : 0;
-  root.style.cssText =
-    `position:${fullPage ? "absolute" : "fixed"};left:0;top:0;width:0;` +
-    "height:0;z-index:2147483647;pointer-events:none;";
-  for (const box of boxes) {
-    const frame = document.createElement("div");
-    frame.style.cssText =
-      `position:absolute;left:${box.x + dx}px;top:${box.y + dy}px;` +
-      `width:${box.width}px;height:${box.height}px;` +
-      "border:2px solid #e11d48;border-radius:2px;box-sizing:border-box;";
-    const label = document.createElement("span");
-    label.textContent = box.ref;
-    label.style.cssText =
-      `position:absolute;left:-2px;top:${box.y + dy < 16 ? 0 : -16}px;` +
-      "background:#e11d48;color:#fff;font:11px/14px monospace;" +
-      "padding:0 3px;border-radius:2px;white-space:nowrap;";
-    frame.appendChild(label);
-    root.appendChild(frame);
-  }
-  document.body.appendChild(root);
-}
-
-function removeAnnotationOverlay(overlayId) {
-  document.getElementById(overlayId)?.remove();
-}
-
-function drawCaptchaTileOverlay({ tiles, overlayId }) {
-  document.getElementById(overlayId)?.remove();
-  const root = document.createElement("div");
-  root.id = overlayId;
-  root.style.cssText =
-    "position:fixed;left:0;top:0;width:0;height:0;z-index:2147483647;pointer-events:none;";
-  for (const tile of tiles) {
-    const box = tile.bounds;
-    const frame = document.createElement("div");
-    frame.style.cssText =
-      `position:absolute;left:${box.x}px;top:${box.y}px;` +
-      `width:${box.width}px;height:${box.height}px;` +
-      "border:3px solid #facc15;box-sizing:border-box;" +
-      "background:rgba(250,204,21,0.14);";
-    const label = document.createElement("span");
-    label.textContent = String(tile.index);
-    const size = Math.max(
-      16,
-      Math.min(36, Math.floor(Math.min(box.width, box.height) * 0.34)),
-    );
-    label.style.cssText =
-      "position:absolute;left:50%;top:50%;transform:translate(-50%,-50%);" +
-      `background:#111;color:#facc15;font:${size}px/${size + 4}px ui-monospace,monospace;` +
-      "font-weight:700;padding:1px 6px;border-radius:4px;border:2px solid #facc15;";
-    frame.appendChild(label);
-    root.appendChild(frame);
-  }
-  document.body.appendChild(root);
-}
-
-// Take a fresh boxes-annotated aria snapshot, draw ref-labelled outlines over
-// the interactive elements (including those inside child iframes, offset to
-// page coordinates), and leave the overlay up for the caller's capture.
-// Returns how many elements were annotated.
-async function addScreenshotAnnotations(page, fullPage) {
-  const tree = await page.locator("body").ariaSnapshot({
-    mode: "ai",
-    boxes: true,
-    timeout: DEFAULT_ACTION_TIMEOUT_MS,
-  });
-  let boxes = parseAnnotationBoxes(tree);
-  if (!fullPage) {
-    const viewport = page.viewportSize();
-    if (viewport)
-      boxes = boxes.filter(
-        (box) =>
-          box.x < viewport.width &&
-          box.y < viewport.height &&
-          box.x + box.width > 0 &&
-          box.y + box.height > 0,
-      );
-  }
-  await page.evaluate(drawAnnotationOverlay, {
-    boxes,
-    fullPage: Boolean(fullPage),
-    overlayId: ANNOTATION_OVERLAY_ID,
-  });
-  return boxes.length;
-}
-
-async function writeScreenshotBytes(session, requested, fallback, content) {
-  const perFileLimit = configuredLimit(
-    launchConfig.maxScreenshotBytes,
-    DEFAULT_SCREENSHOT_LIMIT,
-  );
-  if (content.length > perFileLimit) {
-    throw new Error(`Screenshot exceeds the ${perFileLimit}-byte limit.`);
-  }
-  const file = makeArtifactPath(session, requested, fallback, false);
-  writeBoundedArtifact(session, file, content, perFileLimit, "Screenshot");
-  return file;
-}
-
-async function cssScreenshotClip(page, options) {
-  if (options?.clip) {
-    return {
-      x: Math.max(0, Number(options.clip.x) || 0),
-      y: Math.max(0, Number(options.clip.y) || 0),
-      width: Math.max(1, Number(options.clip.width) || 1),
-      height: Math.max(1, Number(options.clip.height) || 1),
-      scale: 1,
-    };
-  }
-  if (options?.fullPage) {
-    const size = await page.evaluate(() => ({
-      width: Math.max(
-        document.documentElement.scrollWidth,
-        document.body?.scrollWidth || 0,
-      ),
-      height: Math.max(
-        document.documentElement.scrollHeight,
-        document.body?.scrollHeight || 0,
-      ),
-    }));
-    return {
-      x: 0,
-      y: 0,
-      width: Math.max(1, Number(size.width) || 1),
-      height: Math.max(1, Number(size.height) || 1),
-      scale: 1,
-    };
-  }
-  const viewport = page.viewportSize() || { width: 1440, height: 900 };
-  return {
-    x: 0,
-    y: 0,
-    width: Math.max(1, Number(viewport.width) || 1),
-    height: Math.max(1, Number(viewport.height) || 1),
-    scale: 1,
-  };
-}
-
-async function captureScreenshotViaCdp(
-  page,
-  session,
-  requested,
-  fallback,
-  options,
-) {
-  const cdp = await page.context().newCDPSession(page);
-  try {
-    const format = options?.type === "jpeg" ? "jpeg" : "png";
-    const params = {
-      format,
-      fromSurface: true,
-      captureBeyondViewport: Boolean(options?.fullPage) && !options?.clip,
-      clip: await cssScreenshotClip(page, options),
-    };
-    const shot = await cdp.send(
-      "Page.captureScreenshot",
-      format === "jpeg"
-        ? { ...params, quality: Number(options?.quality) || 80 }
-        : params,
-    );
-    const content = Buffer.from(String(shot?.data || ""), "base64");
-    if (!content.length) throw new Error("CDP screenshot returned no bytes.");
-    return writeScreenshotBytes(session, requested, fallback, content);
-  } finally {
-    await cdp.detach().catch(() => {});
-  }
-}
-
-async function captureScreenshot(
-  page,
-  session,
-  requested,
-  fallback,
-  options,
-) {
-  // Preserve the browser-visible devicePixelRatio, screen geometry, rendering
-  // surface and WebGPU identity while encoding proof artifacts at one output
-  // pixel per CSS pixel. The captured macOS profile uses DPR 2, so device-scale
-  // output quadrupled screenshot surface area without adding useful evidence.
-  // `scale: "css"` affects only the trusted artifact encoder; page APIs and
-  // layout remain identical.
-  const screenshotOptions = {
-    scale: "css",
-    timeout: DEFAULT_SCREENSHOT_TIMEOUT_MS,
-    ...options,
-  };
-  await assertScreenshotPixelLimit(page, screenshotOptions);
-  try {
-    const content = await page.screenshot(screenshotOptions);
-    return writeScreenshotBytes(session, requested, fallback, content);
-  } catch {
-    // hCaptcha and similar widgets often leave `document.fonts` pending;
-    // CDP captures the current surface without that wait.
-    try {
-      return await captureScreenshotViaCdp(
-        page,
-        session,
-        requested,
-        fallback,
-        screenshotOptions,
-      );
-    } catch {
-      if (!screenshotOptions.clip) throw new Error("Screenshot capture failed.");
-      const uncropped = { ...screenshotOptions };
-      delete uncropped.clip;
-      return captureScreenshotViaCdp(
-        page,
-        session,
-        requested,
-        fallback,
-        uncropped,
-      );
-    }
-  }
-}
-
 async function handleDownload(page, download) {
   const ownerSid = pageToSession.get(page);
   const sid = ownerSid || "default";
@@ -1612,39 +967,6 @@ async function handleDialog(page, dialog) {
 // in challenges.ts, where the gate that reads this timestamp lives.
 const CHALLENGE_BLOCK_STATUSES = new Set([403, 429, 503]);
 const lastBlockedDocumentAt = new WeakMap();
-const pageSiteRequests = new WeakMap();
-const pageWebAgentsDiscovery = new WeakMap();
-const requestSiteRecord = new WeakMap();
-const MAX_SITE_REQUESTS = 512;
-
-// One observed page request, filled in as its response or failure arrives.
-interface SiteRequestRecord {
-  method: string;
-  url: string;
-  resourceType: string;
-  status: number | null;
-  mimeType: string;
-  failure: string;
-  at: number;
-}
-
-function rememberSiteRequest(page, request) {
-  const records = pageSiteRequests.get(page) || [];
-  pageSiteRequests.set(page, records);
-  const record: SiteRequestRecord = {
-    method: String(request.method() || "GET"),
-    url: String(request.url() || ""),
-    resourceType: String(request.resourceType() || "other"),
-    status: null,
-    mimeType: "",
-    failure: "",
-    at: Date.now(),
-  };
-  records.push(record);
-  if (records.length > MAX_SITE_REQUESTS)
-    records.splice(0, records.length - MAX_SITE_REQUESTS);
-  requestSiteRecord.set(request, record);
-}
 
 function adoptPage(page, sessionId) {
   const session = sessionFor(sessionId);
@@ -1764,359 +1086,6 @@ async function ensureSessionPage(session) {
   return adoptPage(page, session.id);
 }
 
-// Last snapshot text per page, keyed by the options that shape it, so
-// `diff: true` always compares like against like.
-const lastSnapshots = new WeakMap();
-// Replace any `<input type=password>` value with "[redacted]" in an aria
-// snapshot. The values are read in the privileged worker (never handed to the
-// sandbox) only to scrub them from the returned text and register them with the
-// redaction net; nothing about them is returned. Empty when the page has no
-// filled password field, so ordinary pages pay only one cheap evaluate.
-async function redactPasswordValues(page, text) {
-  if (!text) return text;
-  let values;
-  try {
-    const perFrame = await Promise.all(
-      page.frames().map((frame) =>
-        frame
-          .evaluate(() => {
-            const isFilledText = (value: UntrustedValue): value is string =>
-              typeof value === "string" && value.length > 0;
-            // SAFETY: the selector matches only password inputs, whose HTML
-            // interface is HTMLInputElement; an impostor element from another
-            // namespace reads `value` as undefined and fails the guard.
-            return Array.from(document.querySelectorAll("input[type=password]"))
-              .map((element) => (element as HTMLInputElement).value)
-              .filter(isFilledText);
-          })
-          .catch(() => []),
-      ),
-    );
-    values = [...new Set(perFrame.flat())];
-  } catch {
-    // A page mid-navigation may refuse evaluate; the snapshot still returns.
-    return text;
-  }
-  let out = text;
-  for (const value of values) {
-    trackSecret(value);
-    out = out.split(value).join("[redacted]");
-  }
-  return out;
-}
-
-async function snapshotPage(page, options: any = {}) {
-  const depth = Math.floor(Number(options?.depth) || 0);
-  const ref = options?.ref ? String(options.ref) : "";
-  if (ref && !/^(?:f\d+)*e\d+$/.test(ref))
-    throw new Error(
-      `Invalid snapshot ref "${ref}" — expected a marker like "e12" or "f1e3".`,
-    );
-  const scope = ref
-    ? page.locator(`aria-ref=${ref}`)
-    : options?.selector
-      ? page.locator(String(options.selector))
-      : page.locator("body");
-  const snapshotRequest = {
-    mode: "ai",
-    timeout: Number(options?.timeout || DEFAULT_ACTION_TIMEOUT_MS),
-  };
-  let text = await scope.ariaSnapshot(
-    depth > 0 ? { ...snapshotRequest, depth } : snapshotRequest,
-  );
-  // Playwright's aria snapshot includes filled input values, including
-  // `<input type=password>`. Scrub those before the text is stored (for diffs),
-  // truncated, or returned, so a routine read never slurps a just-typed or
-  // extension-filled secret into model context.
-  text = await redactPasswordValues(page, text);
-  text = compressSnapshot(text, { urls: options?.urls === true });
-  if (options?.interactive) text = filterInteractive(text);
-
-  const key = JSON.stringify([
-    ref,
-    String(options?.selector || ""),
-    Boolean(options?.interactive),
-    depth,
-    options?.urls === true,
-  ]);
-
-  let title = "";
-  try {
-    const rawTitle = await page.title();
-    title = String(rawTitle)
-      .replace(/\s+/g, " ")
-      .trim()
-      .slice(0, 120);
-  } catch {
-    // A page mid-navigation can refuse title(); the header works without it.
-  }
-  const header = `page ${pageId(page)} ${page.url()}${title ? ` "${title}"` : ""}`;
-  const store = lastSnapshots.get(page) || new Map();
-  lastSnapshots.set(page, store);
-  const previous = store.get(key);
-  const current = text;
-  if (options?.diff && previous !== undefined) {
-    const result = diffSnapshots(previous, text);
-    if (!result.changed)
-      return `${header}\n(no changes since previous snapshot)`;
-    if (!result.tooLarge)
-      text = `diff vs previous snapshot (+${result.additions} -${result.removals})\n${result.diff}`;
-  }
-  const limit = Math.max(
-    1_000,
-    Math.min(Number(options?.maxChars || DEFAULT_SNAPSHOT_MAX_CHARS), MAX_SNAPSHOT_MAX_CHARS),
-  );
-  if (text.length <= limit) {
-    store.set(key, current);
-    return `${header}\n${text}`;
-  }
-  // Refuse instead of truncating: a cut-off tree reads as complete and sends
-  // the model acting on half a page, while an error steers it to a scoped
-  // re-read.
-  const hints = [];
-  if (!options?.interactive)
-    hints.push("{interactive: true} to keep only actionable elements");
-  hints.push(
-    options?.ref || options?.selector
-      ? "a smaller {depth} or a deeper {ref}/{selector} to narrow this subtree"
-      : "{ref} or {selector} to scope to one element, or {depth} to limit nesting",
-  );
-  if (limit < MAX_SNAPSHOT_MAX_CHARS) hints.push(`{maxChars} up to ${MAX_SNAPSHOT_MAX_CHARS}`);
-  return (
-    `${header}\nSnapshot is ${text.length} chars, over the ${limit} limit. ` +
-    `Retry with ${hints.join(", ")}.`
-  );
-}
-
-function captchaBounds(value, label = "bounds") {
-  const bounds = {
-    x: Number(value?.x),
-    y: Number(value?.y),
-    width: Number(value?.width),
-    height: Number(value?.height),
-  };
-  if (
-    !Object.values(bounds).every(Number.isFinite) ||
-    bounds.width <= 0 ||
-    bounds.height <= 0
-  ) {
-    throw new Error(
-      `captcha ${label} requires finite x, y, width, and height values with positive dimensions.`,
-    );
-  }
-  return bounds;
-}
-
-function captchaPoint(value, label) {
-  const point = { x: Number(value?.x), y: Number(value?.y) };
-  if (!Number.isFinite(point.x) || !Number.isFinite(point.y)) {
-    throw new Error(`captcha ${label} requires finite x and y values.`);
-  }
-  return point;
-}
-
-function unwrapHumanTarget(page, value) {
-  if (isString(value)) return page.locator(value).first();
-  const raw = facadeToRaw.get(value) || value;
-  if (["Locator", "ElementHandle"].includes(objectKind(raw))) return raw;
-  if (isObjectValue(value)) return captchaBounds(value, "target");
-  throw new Error(
-    "human target must be a selector, Locator, ElementHandle, or bounds object.",
-  );
-}
-
-async function humanTargetBox(page, value, timeout = DEFAULT_ACTION_TIMEOUT_MS, inputLikeOverride) {
-  const target = unwrapHumanTarget(page, value);
-  if (!isCallable(untrustedField(target, "boundingBox"))) {
-    return { target: null, box: target, inputLike: false };
-  }
-  await target.scrollIntoViewIfNeeded?.({ timeout });
-  const box = await target.boundingBox({ timeout });
-  if (!box) throw new Error("human target is not visible.");
-  const inputLike =
-    isBoolean(inputLikeOverride)
-      ? inputLikeOverride
-      : await target
-          .evaluate(
-            (element) =>
-              ["INPUT", "TEXTAREA", "SELECT"].includes(element.tagName) ||
-              element.isContentEditable,
-          )
-          .catch(() => false);
-  return { target, box, inputLike };
-}
-
-async function humanClickTarget(page, session, value, options: any = {}) {
-  const timeout = Math.max(1, Number(options?.timeout) || DEFAULT_ACTION_TIMEOUT_MS);
-  const { target, box, inputLike } = await humanTargetBox(
-    page,
-    value,
-    timeout,
-    options?.inputLike,
-  );
-  const point = pointInside(box, inputLike);
-  await movePointer(page.mouse, session.cursor, point, options);
-  await pressPointer(page.mouse, inputLike);
-  return target;
-}
-
-// Select a target's existing text so the next Backspace clears it. The
-// obvious `Control+A` chord is not reliable: the Chromium fork does not run
-// the select-all editing command for synthesized keyboard events (stock
-// Chromium does), so the chord silently left the old text in place and typed
-// text landed in front of it. Selecting through the element works on every
-// build and inside iframes, and raises the same `select` event a real
-// shortcut would; the chord remains only for bounds-style targets that have
-// no element to select through.
-async function selectAllForClear(page, target) {
-  if (target && isCallable(untrustedField(target, "evaluate"))) {
-    await target.evaluate((element) => {
-      const isCallableValue = (value: UntrustedValue): value is UntrustedFunction =>
-        typeof value === "function";
-      if (isCallableValue(element.select)) {
-        element.select();
-        return;
-      }
-      if (element.isContentEditable) {
-        const selection = element.ownerDocument.defaultView?.getSelection();
-        if (!selection) return;
-        const range = element.ownerDocument.createRange();
-        range.selectNodeContents(element);
-        selection.removeAllRanges();
-        selection.addRange(range);
-      }
-    });
-    return;
-  }
-  await page.keyboard.press(process.platform === "darwin" ? "Meta+A" : "Control+A");
-}
-
-async function readTypedFieldText(target) {
-  if (!target || !isCallable(untrustedField(target, "evaluate"))) return null;
-  return target.evaluate((element) => {
-    if (
-      element instanceof HTMLInputElement ||
-      element instanceof HTMLTextAreaElement
-    ) {
-      return String(element.value ?? "");
-    }
-    return String(element.innerText ?? element.textContent ?? "");
-  });
-}
-
-async function restoreTypedFieldText(target, text) {
-  const value = String(text ?? "");
-  if (!target) return;
-  if (isCallable(untrustedField(target, "evaluate"))) {
-    await target.evaluate((element, next) => {
-      const isCallableValue = (value: UntrustedValue): value is UntrustedFunction =>
-        typeof value === "function";
-      if (
-        element instanceof HTMLInputElement ||
-        element instanceof HTMLTextAreaElement
-      ) {
-        element.value = next;
-        element.dispatchEvent(new Event("input", { bubbles: true }));
-        return;
-      }
-      if (!element.isContentEditable) return;
-      if (isCallableValue(element.focus)) element.focus();
-      const selection = element.ownerDocument.defaultView?.getSelection();
-      if (selection) {
-        const range = element.ownerDocument.createRange();
-        range.selectNodeContents(element);
-        selection.removeAllRanges();
-        selection.addRange(range);
-      }
-      const doc = element.ownerDocument;
-      if (!isCallableValue(doc.execCommand)) return;
-      if (next) doc.execCommand("insertText", false, next);
-      else doc.execCommand("delete");
-    }, value);
-  }
-  const after = await readTypedFieldText(target);
-  if (after != null && !typedFieldMatches(after, value)) {
-    throw new Error("human.type could not replace the field contents.");
-  }
-}
-
-function typedFieldMatches(actual, expected) {
-  if (expected === "") return String(actual).trim().length === 0;
-  return String(actual) === String(expected);
-}
-
-async function clearTypedField(page, target) {
-  await selectAllForClear(page, target);
-  await page.keyboard.press("Backspace");
-  const afterClear = await readTypedFieldText(target);
-  if (afterClear != null && afterClear.trim().length > 0) {
-    await restoreTypedFieldText(target, "");
-  }
-}
-
-async function moveTypedFieldCaretToEnd(page, target) {
-  if (target && isCallable(untrustedField(target, "evaluate"))) {
-    const positioned = await target.evaluate((element) => {
-      if (
-        element instanceof HTMLInputElement ||
-        element instanceof HTMLTextAreaElement
-      ) {
-        if (
-          element instanceof HTMLInputElement &&
-          !["text", "search", "url", "tel", "password"].includes(element.type)
-        ) return false;
-        const end = element.value.length;
-        element.setSelectionRange(end, end);
-        return true;
-      }
-      if (!element.isContentEditable) return false;
-      const selection = element.ownerDocument.defaultView?.getSelection();
-      if (!selection) return false;
-      const range = element.ownerDocument.createRange();
-      range.selectNodeContents(element);
-      range.collapse(false);
-      selection.removeAllRanges();
-      selection.addRange(range);
-      return true;
-    });
-    if (positioned) return;
-  }
-  await page.keyboard.press("End");
-}
-
-async function insertTypedText(page, target, text, before) {
-  const value = String(text);
-  if (!value) return;
-  if (target && isCallable(untrustedField(target, "focus"))) {
-    await target.focus().catch(() => {});
-  }
-  await moveTypedFieldCaretToEnd(page, target);
-  await page.keyboard.insertText(value);
-  const afterInsert = await readTypedFieldText(target);
-  if (afterInsert != null && typedTextLanded(value, before, afterInsert)) return;
-  if (!target || !isCallable(untrustedField(target, "evaluate"))) return;
-  await target.evaluate((element, inserted) => {
-    const isCallableValue = (value: UntrustedValue): value is UntrustedFunction =>
-      typeof value === "function";
-    if (isCallableValue(element.focus)) element.focus();
-    const doc = element.ownerDocument;
-    if (
-      isCallableValue(doc.execCommand) &&
-      doc.execCommand("insertText", false, inserted)
-    ) {
-      return;
-    }
-    const eventInit = {
-      bubbles: true,
-      composed: true,
-      inputType: "insertText",
-      data: inserted,
-    };
-    element.dispatchEvent(new InputEvent("beforeinput", eventInit));
-    element.dispatchEvent(new InputEvent("input", eventInit));
-  }, value);
-}
-
 async function installContextGuard(context) {
   adBlockNotes = [];
   const adBlocking = launchConfig.adBlock === true
@@ -2602,9 +1571,7 @@ async function ensureBrowser(config, { requirePersistentProfile = false } = {})
       if (end) void end().catch(() => {});
       // The stream has nothing left to show once the browser is gone; stop the
       // server so viewers see a clean "ended" screen instead of a dead canvas.
-      const closingLiveView = liveView;
-      liveView = null;
-      if (closingLiveView) void closingLiveView.stop().catch(() => {});
+      void workerLiveView.stop().catch(() => {});
     });
     if (launchConfig.credentialCapture !== false) {
       // CDP-level capture: the sensor runs in dedicated isolated worlds and
@@ -2670,746 +1637,97 @@ async function ensureBrowser(config, { requirePersistentProfile = false } = {})
   }
 }
 
-// Page.on/once/off stay in the set so Request/Context/Frame never expose raw
-// EventEmitter hooks. wrap() substitutes a dispatcher that accepts only
-// console and pageerror, and cannot remove the worker's own listeners.
-const FORBIDDEN_PROPERTIES = new Set([
-  "addListener",
-  "browser",
-  "constructor",
-  "context",
-  "exposeBinding",
-  "exposeFunction",
-  "newCDPSession",
-  "off",
-  "on",
-  "once",
-  "prependListener",
-  "removeAllListeners",
-  "removeListener",
-  "request",
-  "route",
-  "routeFromHAR",
-  "routeWebSocket",
-  "screenshot",
-  "serviceWorkers",
-  "unroute",
-  "unrouteAll",
-]);
-const BROWSER_SERIALIZED_CALLBACK_METHODS = new Set([
-  "$eval",
-  "$$eval",
-  "addInitScript",
-  "evaluate",
-  "evaluateAll",
-  "evaluateHandle",
-  "waitForFunction",
-]);
-
-function objectKind(value) {
-  try {
-    return String(value?.constructor?.name || "")
-      .replace(/^_+/, "")
-      .replace(/\d+$/, "");
-  } catch {
-    return "";
-  }
-}
-
-function propertyForbidden(value, property) {
-  if (
-    !isString(property) ||
-    property.startsWith("_") ||
-    FORBIDDEN_PROPERTIES.has(property)
-  )
-    return true;
-  const kind = objectKind(value);
-  if (
-    kind === "BrowserContext" &&
-    [
-      "addCookies",
-      "clearCookies",
-      "close",
-      "cookies",
-      "newPage",
-      "pages",
-      "setStorageState",
-      "storageState",
-      "tracing",
-    ].includes(property)
-  )
-    return true;
-  if (
-    kind === "Download" &&
-    ["createReadStream", "path", "saveAs"].includes(property)
-  )
-    return true;
-  if (
-    kind === "Request" &&
-    [
-      "allHeaders",
-      "headerValue",
-      "headersArray",
-    ].includes(property)
-  )
-    return true;
-  if (
-    kind === "Response" &&
-    [
-      "allHeaders",
-      "headerValue",
-      "headerValues",
-      "headersArray",
-    ].includes(property)
-  )
-    return true;
-  return false;
-}
-
-function filterModelHeaders(headers) {
-  const filtered = {};
-  for (const [name, value] of Object.entries(headers || {})) {
-    if (["cookie", "set-cookie"].includes(name.toLowerCase())) continue;
-    filtered[name] = value;
-  }
-  return filtered;
-}
-
-function isWithin(candidate, root) {
-  const relative = path.relative(path.resolve(root), path.resolve(candidate));
-  return (
-    relative === "" ||
-    (!relative.startsWith("..") && !path.isAbsolute(relative))
-  );
-}
-
-function assertReadableBrowserPath(candidate) {
-  if (!isString(candidate) || !candidate) return;
-  let resolved;
-  let root;
-  try {
-    resolved = fs.realpathSync(candidate);
-    root = fs.realpathSync(launchConfig.artifactsDir);
-  } catch {
-    throw new Error(
-      "Browser file inputs must reference an existing file inside the artifact directory.",
-    );
-  }
-  if (!isWithin(resolved, root))
-    throw new Error(
-      "Browser file inputs may only read files inside the artifact directory.",
-    );
-}
-
-function assertArtifactWritePath(candidate) {
-  if (!isString(candidate) || !candidate) return;
-  if (!isWithin(candidate, launchConfig.artifactsDir)) {
-    throw new Error(
-      "Browser-created files must use artifactPath() or the screenshot() helper.",
-    );
-  }
-}
-
-function prepareArgument(value, property, realm) {
-  if (facadeToRaw.has(value)) return facadeToRaw.get(value);
-  if (isInvocable(value)) {
-    if (BROWSER_SERIALIZED_CALLBACK_METHODS.has(property)) return value;
-    return (...args) =>
-      value(...args.map((item) => realm.adopt(wrap(item, realm))));
-  }
-  if (Array.isArray(value))
-    return value.map((item) => prepareArgument(item, property, realm));
-  // RegExp values originate in the model's vm realm. Treating them as plain
-  // objects erases their non-enumerable source/flags and turns valid
-  // Playwright text/name matchers into {}, which later stringify as
-  // "[object Object]" inside internal selectors.
-  if (utilTypes.isRegExp(value)) return new RegExp(value.source, value.flags);
-  if (isObjectValue(value)) {
-    return Object.fromEntries(
-      Object.entries(value).map(([key, item]) => [
-        key,
-        prepareArgument(item, property, realm),
-      ]),
-    );
-  }
-  return value;
-}
-
-function argumentType(value) {
-  if (value === null) return "null";
-  if (Array.isArray(value)) return "array";
-  if (value === undefined) return "undefined";
-  if (isString(value)) return "string";
-  if (isNumber(value)) return "number";
-  if (isBoolean(value)) return "boolean";
-  if (isCallable(value)) return "function";
-  if (isSymbolValue(value)) return "symbol";
-  if (isBigIntValue(value)) return "bigint";
-  return "object";
-}
-
-function validateMethodArguments(property, args) {
-  if (property !== "getByRole" || args[1]?.name === undefined) return;
-  const name = args[1].name;
-  if (isString(name) || utilTypes.isRegExp(name)) return;
-  throw new TypeError(
-    `getByRole name must be a string or RegExp, received ${argumentType(name)}.`,
-  );
-}
-
-function assertPageHandle(value, helper) {
-  if (isString(value) || isNumber(value) || objectKind(facadeToRaw.get(value)) === "Page") return;
-  throw new TypeError(
-    `${helper} page handle must be a page ID string, numeric index, or page object, received ${argumentType(value)}.`,
-  );
-}
-
-// Resolve a page handle — an id, an index, or the page object `openPage`/`pages`
-// hand out — to the session's `[id, page]` entry, or undefined when it is not
-// an open page of this session.
-function findPageEntry(entries, handle) {
-  if (isNumber(handle)) return entries[handle];
-  if (facadeToRaw.has(handle)) {
-    const raw = facadeToRaw.get(handle);
-    return entries.find(([, page]) => page === raw);
-  }
-  return entries.find(([id]) => id === String(handle));
-}
-
-function describePageHandle(handle) {
-  if (!facadeToRaw.has(handle)) return String(handle);
-  const id = pageIds.get(facadeToRaw.get(handle));
-  return id ? `page object ${id}` : "page object";
-}
-
-function validateMethodPaths(kind, property, args) {
-  if (launchConfig.hostOwnedTarget &&
-      ((kind === "BrowserContext" && ["newPage", "close"].includes(property)) ||
-       (kind === "Page" && property === "close"))) {
-    throw new Error("Host-owned tabs must be opened or closed by the host.");
-  }
-  if (kind === "Page" && property === "pdf" && args[0]?.path)
-    assertArtifactWritePath(args[0].path);
-  if (
-    ["addInitScript", "addScriptTag", "addStyleTag"].includes(property) &&
-    args[0]?.path
-  ) {
-    assertReadableBrowserPath(args[0].path);
-  }
-  if (property === "setInputFiles" || property === "setFiles") {
-    const supplied =
-      property === "setFiles" || ["Locator", "ElementHandle"].includes(kind)
-        ? args[0]
-        : args[1];
-    const files = Array.isArray(supplied) ? supplied : [supplied];
-    for (const file of files) {
-      if (launchConfig.hostOwnedTarget) {
-        if (!isString(file) || !launchConfig.hostUploadFiles?.includes(file) ||
-            fs.realpathSync(file) !== file || !fs.statSync(file).isFile()) {
-          throw new Error("Host upload requires an exact approved regular staged file.");
-        }
-      } else if (isString(file)) assertReadableBrowserPath(file);
-    }
-  }
-  if (["Page", "Frame"].includes(kind) && property === "goto") {
-    assertModelNavigationUrl(args[0]);
-  }
-}
-
-async function setContentCompatible(target, html, options: any = {}) {
-  if (!isString(html)) {
-    throw new TypeError("setContent requires an HTML string.");
-  }
-  const waitUntil = String(options?.waitUntil || "load");
-  if (!["commit", "domcontentloaded", "load", "networkidle"].includes(waitUntil)) {
-    throw new TypeError(`Unsupported setContent waitUntil value: ${waitUntil}`);
-  }
-  const frame = objectKind(target) === "Frame" ? target : target.mainFrame();
-  const page = frame.page();
-  const timeout = frame._navigationTimeout(options || {});
-  const deadline = timeout === 0 ? Number.POSITIVE_INFINITY : Date.now() + timeout;
-  const inflight = new Set();
-  let lastNetworkActivity = Date.now();
-  const belongsToFrame = (request) => {
-    try {
-      let current = request.frame();
-      while (current) {
-        if (current === frame) return true;
-        current = current.parentFrame();
-      }
-      return false;
-    } catch {
-      return false;
-    }
-  };
-  const onRequest = (request) => {
-    if (!belongsToFrame(request)) return;
-    inflight.add(request);
-    lastNetworkActivity = Date.now();
-  };
-  const onRequestDone = (request) => {
-    if (!inflight.delete(request)) return;
-    lastNetworkActivity = Date.now();
-  };
-  if (waitUntil === "networkidle") {
-    page.on("request", onRequest);
-    page.on("requestfinished", onRequestDone);
-    page.on("requestfailed", onRequestDone);
-  }
-  const remaining = () => {
-    if (timeout === 0) return 0;
-    const value = deadline - Date.now();
-    if (value <= 0) {
-      throw new Error(`setContent: Timeout ${timeout}ms exceeded.`);
-    }
-    return value;
-  };
-  try {
-    await frame.evaluate(({ markup, expected, timeoutMs }) => {
-      document.open();
-      if (expected === "commit") {
-        document.write(markup);
-        document.close();
-        return undefined;
-      }
-      return new Promise((resolve, reject) => {
-        let settled = false;
-        const finish = (error = null) => {
-          if (settled) return;
-          settled = true;
-          if (timer !== null) clearTimeout(timer);
-          if (error) reject(error);
-          else resolve(undefined);
-        };
-        const eventName = expected === "domcontentloaded"
-          ? "DOMContentLoaded"
-          : "load";
-        const eventTarget = expected === "domcontentloaded" ? document : window;
-        eventTarget.addEventListener(eventName, () => finish(), { once: true });
-        const timer = timeoutMs > 0
-          ? setTimeout(
-              () => finish(new Error(`setContent: Timeout ${timeoutMs}ms exceeded.`)),
-              timeoutMs,
-            )
-          : null;
-        document.write(markup);
-        document.close();
-      });
-    }, { markup: html, expected: waitUntil, timeoutMs: remaining() });
-    if (waitUntil === "commit") return;
-    while (
-      inflight.size > 0 ||
-      (waitUntil === "networkidle" && Date.now() - lastNetworkActivity < 500)
-    ) {
-      remaining();
-      await hostDelay(Math.min(50, Math.max(1, deadline - Date.now())));
-    }
-  } catch (error) {
-    if (timeout !== 0 && Date.now() >= deadline) {
-      throw new Error(`setContent: Timeout ${timeout}ms exceeded.`);
-    }
-    throw error;
-  } finally {
-    if (waitUntil === "networkidle") {
-      page.off("request", onRequest);
-      page.off("requestfinished", onRequestDone);
-      page.off("requestfailed", onRequestDone);
-    }
-  }
-}
-
-function assertModelNavigationUrl(value) {
-  const url = String(value || "");
-  let scheme;
-  try {
-    scheme = new URL(url).protocol.toLowerCase();
-  } catch {
-    throw new Error("Browser navigation requires a valid URL.");
-  }
-  const safeSpecial =
-    (scheme === "about:" && url.toLowerCase() === "about:blank") ||
-    scheme === "data:" ||
-    scheme === "blob:";
-  if (!safeSpecial && !["http:", "https:"].includes(scheme)) {
-    throw new Error(`Browser navigation scheme is not available: ${scheme}`);
-  }
-  if (
-    ["http:", "https:"].includes(scheme) &&
-    String(launchConfig?.publicSearchPolicy || "block") !== "allow" &&
-    isPublicSearchNavigation(url)
-  ) {
-    throw new Error(PUBLIC_SEARCH_BLOCK_ADVICE);
-  }
-}
-
-let realmFactoryScript = null;
-
-// The factory source is a constant template with no interpolation, so the parse
-// is realm-independent: compile on first use and reuse the script thereafter.
-function getRealmFactoryScript() {
-  if (realmFactoryScript) return realmFactoryScript;
-  realmFactoryScript = new vm.Script(
-    `(() => {
-    const PromiseCtor = Promise;
-    const ErrorCtor = Error;
-    const ArrayCtor = Array;
-    const errorMessage = error => {
-      try { return String(error && error.message ? error.message : error); }
-      catch { return 'Playwright operation failed'; }
-    };
-    const adopt = value => ArrayCtor.isArray(value) ? ArrayCtor.from(value, adopt) : value;
-    const bridge = (result, markHandled = null) => {
-      const bridged = new PromiseCtor((resolve, reject) => {
-        result.then(
-          value => resolve(adopt(value)),
-          error => reject(new ErrorCtor(errorMessage(error))),
-        );
-      });
-      const silence = promise => {
-        PromiseCtor.prototype.catch.call(promise, () => {});
-        return promise;
-      };
-      silence(bridged);
-      if (typeof markHandled !== 'function') return bridged;
-      const tracked = promise => new Proxy(silence(promise), {
-        get(target, property) {
-          if (property === 'then') {
-            return (onFulfilled, onRejected) => {
-              if (typeof onRejected === 'function') markHandled();
-              return tracked(PromiseCtor.prototype.then.call(
-                target,
-                onFulfilled,
-                onRejected,
-              ));
-            };
-          }
-          if (property === 'catch') {
-            return onRejected => {
-              if (typeof onRejected === 'function') markHandled();
-              return tracked(PromiseCtor.prototype.catch.call(target, onRejected));
-            };
-          }
-          if (property === 'finally') {
-            return onFinally => tracked(
-              PromiseCtor.prototype.finally.call(target, onFinally),
-            );
-          }
-          return Reflect.get(target, property, target);
-        },
-      });
-      return tracked(bridged);
-    };
-    const call = (hostFunction, args) => {
-      let result;
-      try { result = hostFunction(...args); }
-      catch (error) { throw new ErrorCtor(errorMessage(error)); }
-      return result;
-    };
-    const make = hostFunction => (...args) => {
-      const result = call(hostFunction, args);
-      if (result && typeof result.then === 'function') return bridge(result);
-      return adopt(result);
-    };
-    const makeTracked = hostFunction => (...args) => {
-      const tracked = call(hostFunction, args);
-      return bridge(tracked.promise, tracked.markHandled);
-    };
-    const makePages = hostGetter => {
-      const getPages = make(hostGetter);
-      return new Proxy([], {
-        get(_target, property) {
-          const list = getPages();
-          const member = list[property];
-          return typeof member === 'function' ? member.bind(list) : member;
-        },
-        has(_target, property) { return property in getPages(); },
-        ownKeys() { return Reflect.ownKeys(getPages()); },
-        getOwnPropertyDescriptor() { return { configurable: true, enumerable: true }; },
-      });
-    };
-    const installPage = hostGetter => {
-      const getPage = make(hostGetter);
-      Object.defineProperty(globalThis, 'page', {
-        configurable: false,
-        enumerable: true,
-        get: getPage,
-      });
-    };
-    return { adopt, installPage, make, makePages, makeTracked };
-  })()`,
-    { filename: "browser-playwright-realm.js" },
-  );
-  return realmFactoryScript;
-}
-
-// WHATWG URL is not a JS intrinsic, so a fresh vm context lacks it, and the
-// host's `URL` cannot be handed over: its `constructor` is the host realm's
-// `Function`, which compiles code outside the context's restrictions. These
-// classes live in the snippet realm and only ever receive strings and arrays
-// of strings from the host, which `adopt` turns into realm values.
-const URL_FIELDS = ["href", "protocol", "username", "password", "host", "hostname", "port", "pathname", "search", "hash", "origin"];
-
-function urlParts(input, base, field, value) {
-  let url;
-  try {
-    url = new URL(input, base);
-  } catch {
-    throw new TypeError(`Invalid URL: ${input}`);
-  }
-  if (field) url[field] = value;
-  return URL_FIELDS.map((name) => url[name]);
-}
-
-let urlFactoryScript = null;
-
-function getUrlFactoryScript() {
-  if (urlFactoryScript) return urlFactoryScript;
-  urlFactoryScript = new vm.Script(
-    `(fields, urlParts, parseParams, serializeParams) => {
-    const pairsOf = new WeakMap();
-    const owners = new WeakMap();
-    // Writing the owner's search re-enters the field setter below; the flag
-    // stops it from re-parsing the pairs it was just serialized from.
-    let syncing = false;
-    const sync = params => {
-      const owner = owners.get(params);
-      if (!owner) return;
-      syncing = true;
-      try { owner.search = serializeParams(pairsOf.get(params)); } finally { syncing = false; }
-    };
-    // Names and values are WebIDL USVStrings: lone surrogates become U+FFFD.
-    const usv = value => String(value).toWellFormed();
-    // WHATWG init: a string, an iterable of [name, value] pairs (array, Map,
-    // generator, another URLSearchParams), or a record of name -> value.
-    const pairsFrom = init => {
-      if (init === undefined) return [];
-      if (init !== null && (typeof init === 'object' || typeof init === 'function')) {
-        const iterator = init[Symbol.iterator];
-        if (iterator !== undefined && iterator !== null) {
-          if (typeof iterator !== 'function') throw new TypeError('Query init is not iterable');
-          const pairs = [];
-          for (const pair of { [Symbol.iterator]: () => iterator.call(init) }) {
-            if (pair === null || pair === undefined || typeof pair[Symbol.iterator] !== 'function')
-              throw new TypeError('Each query pair must be an iterable [name, value] entry');
-            const entry = [...pair];
-            if (entry.length !== 2)
-              throw new TypeError('Each query pair must be an iterable [name, value] entry');
-            pairs.push([usv(entry[0]), usv(entry[1])]);
-          }
-          return pairs;
-        }
-        return Object.entries(init).map(([key, value]) => [usv(key), usv(value)]);
-      }
-      return parseParams(usv(init));
-    };
-    // The pair list is only ever mutated in place, so an iterator holding an
-    // index into it stays live across delete()/set() like the native one.
-    const replace = (params, pairs) => { const list = pairsOf.get(params); list.splice(0, list.length, ...pairs); };
-    function* iterate(params, pick) {
-      for (let i = 0; i < pairsOf.get(params).length; i += 1) yield pick(pairsOf.get(params)[i]);
-    }
-    class URLSearchParams {
-      constructor(init = '') { pairsOf.set(this, pairsFrom(init)); }
-      get size() { return pairsOf.get(this).length; }
-      append(key, value) { pairsOf.get(this).push([usv(key), usv(value)]); sync(this); }
-      delete(key, value) {
-        key = usv(key);
-        if (value !== undefined) value = usv(value);
-        const pairs = pairsOf.get(this);
-        for (let i = pairs.length - 1; i >= 0; i -= 1) {
-          if (pairs[i][0] === key && (value === undefined || pairs[i][1] === value)) pairs.splice(i, 1);
-        }
-        sync(this);
-      }
-      get(key) { key = usv(key); const hit = pairsOf.get(this).find(([k]) => k === key); return hit ? hit[1] : null; }
-      getAll(key) { key = usv(key); return pairsOf.get(this).filter(([k]) => k === key).map(([, v]) => v); }
-      has(key, value) { key = usv(key); return pairsOf.get(this).some(([k, v]) => k === key && (value === undefined || v === usv(value))); }
-      set(key, value) {
-        key = usv(key);
-        value = usv(value);
-        const pairs = pairsOf.get(this);
-        const index = pairs.findIndex(([k]) => k === key);
-        if (index < 0) pairs.push([key, value]);
-        else {
-          pairs[index] = [key, value];
-          for (let i = pairs.length - 1; i > index; i -= 1) if (pairs[i][0] === key) pairs.splice(i, 1);
-        }
-        sync(this);
-      }
-      sort() { pairsOf.get(this).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)); sync(this); }
-      forEach(callback, thisArg) { for (const [key, value] of this) callback.call(thisArg, value, key, this); }
-      keys() { return iterate(this, ([key]) => key); }
-      values() { return iterate(this, ([, value]) => value); }
-      entries() { return iterate(this, ([key, value]) => [key, value]); }
-      [Symbol.iterator]() { return this.entries(); }
-      toString() { return serializeParams(pairsOf.get(this)); }
-      get [Symbol.toStringTag]() { return 'URLSearchParams'; }
-    }
-    const partsOf = new WeakMap();
-    const paramsOf = new WeakMap();
-    const assign = (url, values) => partsOf.set(url, Object.fromEntries(fields.map((name, i) => [name, values[i]])));
-    class URL {
-      constructor(input, base) {
-        assign(this, urlParts(String(input), base === undefined ? undefined : String(base)));
-      }
-      static canParse(input, base) { try { new URL(input, base); return true; } catch { return false; } }
-      static parse(input, base) { try { return new URL(input, base); } catch { return null; } }
-      get searchParams() {
-        let params = paramsOf.get(this);
-        if (!params) {
-          params = new URLSearchParams(partsOf.get(this).search);
-          owners.set(params, this);
-          paramsOf.set(this, params);
-        }
-        return params;
-      }
-      toString() { return partsOf.get(this).href; }
-      toJSON() { return partsOf.get(this).href; }
-      get [Symbol.toStringTag]() { return 'URL'; }
-    }
-    for (const name of fields) {
-      Object.defineProperty(URL.prototype, name, {
-        configurable: true,
-        enumerable: true,
-        get() { return partsOf.get(this)[name]; },
-        set: name === 'origin' ? undefined : function (value) {
-          assign(this, urlParts(partsOf.get(this).href, undefined, name, String(value)));
-          // searchParams keeps its identity (WHATWG) and follows every
-          // mutation of the query, whether through search, href, or the
-          // params object itself.
-          const params = paramsOf.get(this);
-          if (params && !syncing) replace(params, parseParams(partsOf.get(this).search));
-        },
-      });
-    }
-    return { URL, URLSearchParams };
-  }`,
-    { filename: "browser-url-realm.js" },
-  );
-  return urlFactoryScript;
-}
-
-function createUrlGlobals(realm) {
-  const factory = getUrlFactoryScript().runInContext(realm.context);
-  return factory(
-    realm.adopt(URL_FIELDS),
-    realm.safeFunction(urlParts),
-    realm.safeFunction((init) => [...new URLSearchParams(init)]),
-    realm.safeFunction((pairs) => new URLSearchParams(pairs).toString()),
-  );
-}
-
-function createRealm(context, pageEvents) {
-  const factories = getRealmFactoryScript().runInContext(context);
-  return {
-    context,
-    cache: new WeakMap(),
-    adopt: factories.adopt,
-    installPage: factories.installPage,
-    safeFunction: factories.make,
-    safeTrackedFunction: factories.makeTracked,
-    makePages: factories.makePages,
-    pageEvents,
-  };
-}
-
-function wrap(value, realm) {
-  if (!isWrappableValue(value)) return value;
-  if (facadeToRaw.has(value)) return value;
-  if (Array.isArray(value)) return value.map((item) => wrap(item, realm));
-  const cached = realm.cache.get(value);
-  if (cached) return cached;
-
-  const facade = new Proxy(Object.create(null), {
-    get(_target, property) {
-      if (property === Symbol.toStringTag) return "PlaywrightObject";
-      if (isSymbolValue(property)) return undefined;
-      if (isSnippetPageEventMethod(objectKind(value), property)) {
-        return realm.safeFunction((event, listener) => {
-          realm.pageEvents.dispatch(
-            value,
-            property,
-            event,
-            listener,
-            (payload) => realm.adopt(wrap(payload, realm)),
-          );
-          return wrap(value, realm);
-        });
-      }
-      if (propertyForbidden(value, property)) return undefined;
-      const member = value[property];
-      if (!isCallable(member)) return wrap(member, realm);
-      return realm.safeFunction((...args) => {
-        const prepared = args.map((arg) =>
-          prepareArgument(arg, property, realm),
-        );
-        const kind = objectKind(value);
-        validateMethodArguments(property, prepared);
-        validateMethodPaths(kind, property, prepared);
-        applyNavigationDefaults(kind, property, prepared);
-        let result;
-        if (kind === "Page" && property === "close") {
-          result = stopPageRecording(value).then(() => member.apply(value, prepared));
-        } else if (kind === "Page" && (property === "goBack" || property === "goForward")) {
-          result = navigateHistory(value, property, prepared[0], DEFAULT_NAVIGATION_TIMEOUT_MS);
-        } else if (
-          useSetContentCompatibility &&
-          ["Page", "Frame"].includes(kind) &&
-          property === "setContent"
-        ) {
-          result = setContentCompatible(value, prepared[0], prepared[1]);
-        } else {
-          result = member.apply(value, prepared);
-        }
-        if (["Keyboard", "Page", "Frame", "Locator"].includes(kind) &&
-            ["press", "pressSequentially", "type", "fill", "down"].includes(property) && result?.catch) {
-          result = result.catch(async (error) => {
-            // A failed chord can skip Playwright's key-up sequence.
-            const target: any = value;
-            const keyboard = kind === "Keyboard" ? target : kind === "Page" ? target.keyboard : target.page().keyboard;
-            for (const key of ["AltLeft", "AltRight", "ControlLeft", "ControlRight", "MetaLeft", "MetaRight", "ShiftLeft", "ShiftRight"]) {
-              await keyboard.up(key).catch(() => {});
-            }
-            throw error;
-          });
-        }
-        if (
-          ["Request", "Response"].includes(kind) &&
-          property === "headers"
-        ) {
-          result = result && isCallable(untrustedField(result, "then"))
-            ? result.then(filterModelHeaders)
-            : filterModelHeaders(result);
-        }
-        if (result && isCallable(untrustedField(result, "then"))) {
-          return result.then((item) => wrap(item, realm));
-        }
-        return wrap(result, realm);
-      });
-    },
-    has(_target, property) {
-      if (isSnippetPageEventMethod(objectKind(value), property)) return true;
-      return !propertyForbidden(value, property) && property in value;
-    },
-    ownKeys() {
-      return Reflect.ownKeys(value).filter(
-        (key) => !propertyForbidden(value, key),
-      );
-    },
-    getOwnPropertyDescriptor() {
-      return { configurable: true, enumerable: true };
-    },
-    getPrototypeOf() {
-      return null;
-    },
-    set() {
-      return false;
-    },
-  });
-  realm.cache.set(value, facade);
-  facadeToRaw.set(facade, value);
-  return facade;
-}
+// Factories own subsystem state. Getters keep browser/configuration references
+// current across launches; constructing a subsystem never starts external work.
+const workerLiveView = createWorkerLiveView({
+  getBrowserContext: () => browserContext,
+  sessions,
+  sessionFor,
+  pageOwner: (page) => pageToSession.get(page),
+  adoptPage,
+  wakeSessionPages,
+  ensureBrowser,
+  sendResult,
+  redactText,
+});
+const {
+  notifyLiveViewPreferred,
+  liveViewStart,
+  liveViewStop,
+  liveViewStatus,
+  liveViewChatPost,
+  liveViewChatDrain,
+  handoffWait,
+  askWait,
+} = workerLiveView;
+const artifacts = createWorkerArtifacts<WorkerSession>({
+  getConfig: () => launchConfig,
+  newCDPSession: (page) => browserContext.newCDPSession(page),
+  sessions: () => sessions.values(),
+  ensureSessionPage,
+  pageId,
+  wakeSessionPages,
+  quietSessionPages,
+  redactText,
+  actionTimeoutMs: DEFAULT_ACTION_TIMEOUT_MS,
+});
+const {
+  sessionRecordings,
+  downloadByteLimit,
+  pruneArtifactQuota,
+  reserveArtifactQuota,
+  makeArtifactPath,
+  stopSessionRecording,
+  stopPageRecording,
+  sessionRecordingIsBusy,
+  pageRecordingIsBusy,
+  captureScreenshot,
+} = artifacts;
+const { snapshotPage } = createWorkerSnapshots({
+  trackSecret,
+  pageId,
+  actionTimeoutMs: DEFAULT_ACTION_TIMEOUT_MS,
+});
+const realmOperations = createWorkerRealm({
+  artifactsDir: () => launchConfig.artifactsDir,
+  hostOwnedTarget: () => launchConfig.hostOwnedTarget,
+  hostUploadFiles: () => launchConfig.hostUploadFiles,
+  publicSearchPolicy: () => launchConfig.publicSearchPolicy,
+  useSetContentCompatibility: () => useSetContentCompatibility,
+  stopPageRecording,
+  redactText,
+  redactDeep,
+  pageId,
+  pageIds,
+  defaultNavigationTimeoutMs: DEFAULT_NAVIGATION_TIMEOUT_MS,
+  maxResponsePages: MAX_RESPONSE_PAGES,
+});
+const { summarize, summarizeSessionPages } = realmOperations;
+const humanInput = createHumanInput({
+  unwrap: realmOperations.unwrapTarget,
+  objectKind: realmOperations.objectKind,
+  actionTimeoutMs: DEFAULT_ACTION_TIMEOUT_MS,
+});
+const { humanClickTarget } = humanInput;
+const site = createWorkerSite({
+  getBrowserContext: () => browserContext,
+  getProxyPort: () => transportProxyPort,
+  guardUrl,
+  transportExecuteId,
+  navigationTimeoutMs: DEFAULT_NAVIGATION_TIMEOUT_MS,
+});
+const {
+  rememberSiteRequest,
+  requestSiteRecord,
+  unannouncedWebAgentsDirectory,
+  unannouncedUIDirectory,
+} = site;
+const { detectSessionChallenges } = createChallengeScanner<WorkerSession>({
+  captureScreenshot,
+  pageId,
+  lastBlockedDocumentAt: (page) => lastBlockedDocumentAt.get(page),
+});
+const captchaRuntime = createCaptchaRuntime<WorkerSession>({ captureScreenshot });
 
 // Credential fill lives in credential-fill.ts; the worker hands it the host RPC
 // channel, the redaction net, and trusted input, and keeps only the message
@@ -3431,6 +1749,22 @@ const {
   actionTimeoutMs: DEFAULT_ACTION_TIMEOUT_MS,
 });
 
+const buildSandbox = createWorkerSandbox({
+  getConfig: () => launchConfig,
+  getBrowserContext: () => browserContext,
+  ...realmOperations,
+  ...humanInput,
+  ...artifacts,
+  ...site,
+  ...captchaRuntime,
+  redactText,
+  adoptPage,
+  notifyLiveViewPreferred,
+  ensureSessionPage,
+  snapshotPage,
+  buildCredentials,
+});
+
 // Assemble the wire envelope shared by execute() and credentialFill().
 // Callers pass only what differs; warnings always lead with the profile
 // warning, then the first challenge's advice, then (when the run completed
@@ -3529,2873 +1863,108 @@ async function credentialFill(message) {
   } catch (error) {
     if (redactionCapacityExceeded) {
       sendRedactionCapacityFailure(message);
-      return;
-    }
-    const pendingCredential = recoveryFromError(error, session);
-    const restartWorker = secretCapacityRequiresRestart(error);
-    const failureFields = {
-      firstEvent,
-      pages: [],
-      ok: false,
-      error: redactText(error?.message || String(error)),
-      restartWorker,
-    };
-    sendResult(
-      await buildEnvelope(
-        session,
-        message,
-        started,
-        pendingCredential
-          ? { ...failureFields, pendingCredential }
-          : failureFields,
-      ),
-    );
-  } finally {
-    stampModelActivity(session);
-    endExecutionFor(session.id);
-    quietSessionPages(session);
-    session.execution = { requestId: null, pendingRecovery: null, generationStarted: false };
-  }
-}
-
-// Dedicated trusted host path for finalizing or discarding a staged generated
-// credential after the caller has verified the visible browser outcome.
-async function credentialPending(message) {
-  if (cookieSyncActive) {
-    cookieSyncBusyResult(message);
-    return;
-  }
-  const started = performance.now();
-  const session = sessionFor(message.sessionId);
-  session.awaitingAnswerSince = null;
-  const firstEvent = session.events.length;
-  beginExecutionFor(session.id);
-  try {
-    assertRedactionCapacity();
-    const action = String(message.action || "");
-    if (!new Set(["list", "commit", "discard"]).has(action)) {
-      throw new Error("pending credential action must be list, commit, or discard.");
-    }
-    await ensureBrowser(message.config);
-    await wakeSessionPages(session);
-    await ensureSessionPage(session);
-    let publicResult;
-    if (action === "list") {
-      const response = await vaultCall(session, "list-pending", {});
-      publicResult = response.pendingCredentials || [];
-    } else {
-      const pendingId = String(message.payload?.pendingId ?? "").trim();
-      if (!pendingId) {
-        throw new Error(
-          "pending credential action requires a non-empty pendingId.",
-        );
-      }
-      const response = await finalizePendingCredential(
-        session,
-        action,
-        pendingId,
-        String(message.payload?.pendingOrigin ?? "").trim(),
-      );
-      const { secret: _secret, ...result } = response || {};
-      publicResult = result;
-    }
-    assertRedactionCapacity();
-    sendResult(
-      await buildEnvelope(session, message, started, {
-        firstEvent,
-        drainSessionWarnings: true,
-        ok: true,
-        result: redactDeep(publicResult),
-      }),
-    );
-  } catch (error) {
-    if (redactionCapacityExceeded) {
-      sendRedactionCapacityFailure(message);
-      return;
-    }
-    const restartWorker = secretCapacityRequiresRestart(error);
-    sendResult(
-      await buildEnvelope(session, message, started, {
-        firstEvent,
-        pages: [],
-        ok: false,
-        error: redactText(error?.message || String(error)),
-        restartWorker,
-      }),
-    );
-  } finally {
-    endExecutionFor(session.id);
-    quietSessionPages(session);
-  }
-}
-
-async function pageSiteRequest(page, url, options: any = {}) {
-  let target = sameOriginSiteUrl(page.url(), url);
-  let method = String(options.method || "GET").trim().toUpperCase();
-  if (!["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE"].includes(method)) {
-    throw new Error("site.request method must be GET, HEAD, POST, PUT, PATCH, or DELETE.");
-  }
-  const headers: Record<string, string> = normalizeSiteHeaders(options.headers);
-  let body;
-  if (Object.hasOwn(options, "json")) {
-    body = JSON.stringify(options.json);
-    headers["content-type"] ||= "application/json";
-  } else if (Object.hasOwn(options, "body")) {
-    body = String(options.body);
-  }
-  if (body && Buffer.byteLength(body) > SITE_RESPONSE_LIMIT) {
-    throw new Error(`site.request body exceeds ${SITE_RESPONSE_LIMIT} bytes.`);
-  }
-  const pageUrl = page.url();
-  headers.origin ||= new URL(pageUrl).origin;
-  headers.referer ||= pageUrl;
-  headers["accept-encoding"] ||= "identity";
-  let response;
-  for (let redirects = 0; redirects <= 5; redirects += 1) {
-    const decision = await guardUrl(
-      target,
-      { method, resourceType: "fetch", siteHelper: true },
-      transportExecuteId(),
-    );
-    if (!decision?.allowed) {
-      throw new Error(decision?.reason || "site.request was blocked by policy.");
-    }
-    const requestHeaders = { ...headers };
-    const cookieHeader = (await browserContext.cookies(target).catch(() => []))
-      .map((cookie) => `${cookie.name}=${cookie.value}`)
-      .join("; ");
-    if (cookieHeader) requestHeaders.cookie = cookieHeader;
-    response = await requestSiteResponse({
-      target,
-      proxyPort: transportProxyPort,
-      method,
-      headers: requestHeaders,
-      body:
-        body !== undefined && !["GET", "HEAD"].includes(method)
-          ? body
-          : undefined,
-      timeoutMs: DEFAULT_NAVIGATION_TIMEOUT_MS,
-      limit: SITE_RESPONSE_LIMIT,
-    });
-    const responseCookies = cookiesFromSetCookie(response.setCookie, target);
-    if (responseCookies.length) {
-      await browserContext.addCookies(responseCookies).catch(() => {});
-    }
-    const location = response.headers.location;
-    if (![301, 302, 303, 307, 308].includes(response.status) || !location) {
-      break;
-    }
-    if (redirects === 5) throw new Error("site.request exceeded 5 redirects.");
-    target = sameOriginSiteUrl(pageUrl, new URL(location, target).href);
-    if (response.status === 303 ||
-      ([301, 302].includes(response.status) && method === "POST")) {
-      method = "GET";
-      body = undefined;
-    }
-  }
-  const bytes = response.bytes;
-  const text = bytes.toString("utf8");
-  const responseHeaders = response.headers;
-  const result = {
-    ok: response.status >= 200 && response.status < 300,
-    status: response.status,
-    statusText: response.statusText,
-    url: target,
-    contentType: responseHeaders["content-type"] || "",
-    text,
-    truncated: response.truncated,
-    length: response.length,
-  };
-  const records = pageSiteRequests.get(page) || [];
-  records.push({
-    method,
-    url: result.url,
-    resourceType: "fetch",
-    status: result.status,
-    mimeType: result.contentType.split(";", 1)[0].trim(),
-    failure: "",
-    at: Date.now(),
-  });
-  if (records.length > MAX_SITE_REQUESTS) {
-    records.splice(0, records.length - MAX_SITE_REQUESTS);
-  }
-  pageSiteRequests.set(page, records);
-  if (options.response === "json") {
-    try {
-      return { ...result, json: result.text ? JSON.parse(result.text) : null };
-    } catch {
-      throw new Error(`site.request expected JSON but received ${result.contentType || "unknown content"}.`);
-    }
-  }
-  return result;
-}
-
-async function discoverPageWebAgents(page, { refresh = false }: any = {}) {
-  let origin;
-  let pathname;
-  try {
-    const activeUrl = new URL(page.url());
-    origin = activeUrl.origin;
-    pathname = activeUrl.pathname;
-  } catch {
-    return {
-      manifest: null,
-      error: "WebAgents discovery requires an open HTTP(S) page.",
-    };
-  }
-  const cached = pageWebAgentsDiscovery.get(page);
-  if (
-    !refresh &&
-    cached?.origin === origin &&
-    (
-      cached.pathname === pathname ||
-      (!cached.manifest && cached.pathScoped !== true)
-    )
-  ) return cached;
-
-  const errors: string[] = [];
-  let pathScoped = false;
-  const probes = await Promise.all(WEBAGENTS_DISCOVERY_PATHS.map(async (path) => {
-    try {
-      return { path, response: await pageSiteRequest(page, path, { method: "GET" }) };
-    } catch (error) {
-      return { path, error };
-    }
-  }));
-  for (const probe of probes) {
-    const { path } = probe;
-    if ("error" in probe) {
-      errors.push(`${path}: ${probe.error?.message || probe.error}`);
-      continue;
-    }
-    const { response } = probe;
-    if (response.status === 404 || response.status === 410) continue;
-    if (!response.ok) {
-      errors.push(`${path}: HTTP ${response.status}`);
-      continue;
-    }
-    try {
-      const manifest = parseWebAgentsDocument(
-        response.text,
-        response.url,
-        page.url(),
-      );
-      const entry = { origin, pathname, manifest, error: "" };
-      pageWebAgentsDiscovery.set(page, entry);
-      return entry;
-    } catch (error) {
-      if (error instanceof WebAgentsPathScopeError) pathScoped = true;
-      errors.push(`${path}: ${error?.message || error}`);
-    }
-  }
-  const entry = {
-    origin,
-    pathname,
-    manifest: null,
-    pathScoped,
-    error: errors[0] || "This origin does not publish WebAgents.",
-  };
-  pageWebAgentsDiscovery.set(page, entry);
-  return entry;
-}
-
-async function unannouncedWebAgentsDirectory(session) {
-  const page = session.pages.get(session.currentId);
-  if (!page || page.isClosed()) return null;
-  let origin;
-  try {
-    const url = new URL(page.url());
-    if (!new Set(["http:", "https:"]).has(url.protocol)) return null;
-    origin = `${url.origin}${url.pathname}`;
-  } catch {
-    return null;
-  }
-  if (session.webAgentsAnnouncedOrigins.has(origin)) return null;
-  session.webAgentsAnnouncedOrigins.add(origin);
-  const discovered = await discoverPageWebAgents(page);
-  return discovered.manifest ? publicWebAgentsManifest(discovered.manifest) : null;
-}
-
-async function unannouncedUIDirectory(session, result) {
-  const page = session.pages.get(session.currentId);
-  if (!page || page.isClosed()) return null;
-  let key;
-  try {
-    const url = new URL(page.url());
-    if (!new Set(["http:", "https:"]).has(url.protocol)) return null;
-    key = `${url.origin}${url.pathname}`;
-  } catch {
-    return null;
-  }
-  if (session.uiDirectoryAnnouncedOrigins.has(key)) return null;
-  const discovered = pageWebAgentsDiscovery.get(page);
-  if (!discovered || discovered.manifest) return null;
-  session.uiDirectoryAnnouncedOrigins.add(key);
-  if (hasReturnedUIDirectory(result)) return null;
-  const directory = await inspectActionDirectory(page);
-  return directory.controls.length ? compactAutomaticUI(directory) : null;
-}
-
-async function inspectSiteAssets(page) {
-  const domAssets = await page.evaluate(() =>
-    [
-      ...[...document.scripts].map((element) => ({
-        url: element.src,
-        resourceType: "script",
-      })),
-      ...[...document.querySelectorAll('link[rel~="stylesheet"]')].map(
-        (element: HTMLLinkElement) => ({
-          url: element.href,
-          resourceType: "stylesheet",
-        }),
-      ),
-    ].filter((entry) => entry.url),
-  );
-  const networkAssets = (pageSiteRequests.get(page) || [])
-    .filter((record) =>
-      ["script", "stylesheet", "fetch", "xhr"].includes(record.resourceType),
-    )
-    .map(({ url, resourceType, status, mimeType }) => ({
-      url,
-      resourceType,
-      status,
-      mimeType,
-    }));
-  const unique = new Map();
-  for (const asset of [...domAssets, ...networkAssets]) {
-    if (!unique.has(asset.url)) unique.set(asset.url, asset);
-  }
-  return [...unique.values()].slice(0, MAX_SITE_REQUESTS);
-}
-
-// Result-envelope entry for a screenshot the model requested.
-interface ScreenshotArtifact {
-  kind: string;
-  path: string;
-  media: string;
-  annotations?: number;
-}
-
-function buildSandbox(session, consoleMessages, execution) {
-  const sandbox = Object.create(null);
-  const context = vm.createContext(sandbox, {
-    name: `betterwright-${session.id}`,
-    codeGeneration: { strings: false, wasm: false },
-  });
-  const realm = createRealm(context, execution.pageEvents);
-  const addConsole = (level) =>
-    realm.safeFunction((...args) => {
-      if (consoleMessages.length >= MAX_CONSOLE_MESSAGES) return;
-      const joined = redactText(args.map(String).join(" "));
-      consoleMessages.push({
-        level,
-        text:
-          joined.length > MAX_CONSOLE_MESSAGE_CHARS
-            ? `${joined.slice(0, MAX_CONSOLE_MESSAGE_CHARS)}[truncated]`
-            : joined,
-      });
-    });
-  const consoleFacade = Object.create(null);
-  for (const level of ["log", "info", "warn", "error"])
-    consoleFacade[level] = addConsole(level);
-
-  const getCurrentPage = () => {
-    const current = session.pages.get(session.currentId);
-    if (!current || current.isClosed())
-      throw new Error("No active page; call openPage(url).");
-    return wrap(current, realm);
-  };
-  const getPages = () =>
-    [...session.pages.values()]
-      .filter((page) => !page.isClosed())
-      .map((page) => wrap(page, realm));
-
-  sandbox.console = Object.freeze(consoleFacade);
-  sandbox.context = wrap(browserContext, realm);
-  sandbox.state = session.state;
-  Object.assign(sandbox, createUrlGlobals(realm));
-  sandbox.pages = realm.makePages(getPages);
-  sandbox.openPage = realm.safeFunction(async (url = null, options: any = {}) => {
-    if (launchConfig.hostOwnedTarget) throw new Error("Open another tab through the host.");
-    if (session.pages.size >= MAX_PAGES_PER_SESSION) {
-      throw new Error(
-        `Browser page limit (${MAX_PAGES_PER_SESSION}) reached for this session.`,
-      );
-    }
-    const rawPage = await browserContext.newPage();
-    const page = adoptPage(rawPage, session.id);
-    if (url) {
-      assertModelNavigationUrl(url);
-      await page.goto(String(url), navigationOptions(options));
-    }
-    return wrap(page, realm);
-  });
-  sandbox.usePage = realm.safeFunction(async (selector) => {
-    assertPageHandle(selector, "usePage");
-    const entries = [...session.pages.entries()].filter(
-      ([, page]) => !page.isClosed(),
-    );
-    const entry = findPageEntry(entries, selector);
-    if (!entry)
-      throw new Error(
-        `Unknown page ${describePageHandle(selector)}; available: ${entries.map(([id]) => id).join(", ")}`,
-      );
-    session.currentId = entry[0];
-    notifyLiveViewPreferred();
-    return wrap(entry[1], realm);
-  });
-  sandbox.closePage = realm.safeFunction(async (selector) => {
-    if (launchConfig.hostOwnedTarget) throw new Error("Close this tab through the host.");
-    const target = selector === undefined ? session.currentId : selector;
-    assertPageHandle(target, "closePage");
-    const entries = [...session.pages.entries()];
-    const entry = findPageEntry(entries, target);
-    if (!entry) return { closed: false };
-    await stopPageRecording(entry[1]);
-    await entry[1].close();
-    return { closed: true, pageId: entry[0] };
-  });
-  sandbox.snapshot = realm.safeFunction(async (options) => {
-    const page = await ensureSessionPage(session);
-    return snapshotPage(page, options);
-  });
-  sandbox.artifactPath = realm.safeFunction((requested) =>
-    makeArtifactPath(session, requested),
-  );
-  const recording = Object.create(null);
-  recording.start = realm.safeFunction((options) => startSessionRecording(session, options));
-  recording.stop = realm.safeFunction(() => stopSessionRecording(session));
-  recording.status = realm.safeFunction(() => sessionRecordingStatus(session));
-  recording.restart = realm.safeFunction(async (options) => {
-    await stopSessionRecording(session);
-    return startSessionRecording(session, options);
-  });
-  sandbox.recording = Object.freeze(recording);
-  sandbox.screenshot = realm.safeFunction(async (options) => {
-    const settings =
-      isString(options) ? { name: options } : options || {};
-    const page = await ensureSessionPage(session);
-    const kind = ["proof", "question", "debug"].includes(settings.kind)
-      ? settings.kind
-      : "debug";
-    const type = settings.type === "jpeg" ? "jpeg" : "png";
-    // Chromium infers the encoding from the file extension, so a name without
-    // one (e.g. "home") would fail. Normalize to the requested type and also
-    // pass `type` explicitly so the two can never disagree.
-    let requested = settings.name || `${kind}.${type}`;
-    if (!/\.(png|jpe?g)$/i.test(requested)) requested = `${requested}.${type}`;
-    const fullPage = Boolean(settings.fullPage);
-    let annotations;
-    const annotateInResidentPage = Boolean(settings.annotate);
-    if (settings.annotate) {
-      annotations = annotateInResidentPage
-        ? await addScreenshotAnnotations(page, fullPage)
-        : 0;
-    }
-    let file;
-    try {
-      const shotOptions = { type, fullPage, animations: "disabled" };
-      file = await captureScreenshot(
-        page,
-        session,
-        requested,
-        `${kind}.${type}`,
-        type === "jpeg"
-          ? { ...shotOptions, quality: Number(settings.quality) || 80 }
-          : shotOptions,
-      );
-    } finally {
-      if (annotateInResidentPage)
-        await page
-          .evaluate(removeAnnotationOverlay, ANNOTATION_OVERLAY_ID)
-          .catch(() => {});
-    }
-    const artifact: ScreenshotArtifact = {
-      kind,
-      path: file,
-      media: `MEDIA:${file}`,
-    };
-    if (annotations !== undefined) artifact.annotations = annotations;
-    session.artifacts.push(artifact);
-    if (kind === "question") session.awaitingAnswerSince = Date.now();
-    return artifact;
-  });
-  const dialogs = Object.create(null);
-  dialogs.acceptNext = realm.safeFunction((promptText) => {
-    session.nextDialog = { action: "accept", promptText };
-    return { prepared: "accept" };
-  });
-  dialogs.dismissNext = realm.safeFunction(() => {
-    session.nextDialog = { action: "dismiss" };
-    return { prepared: "dismiss" };
-  });
-  const captcha = Object.create(null);
-  captcha.detect = realm.safeFunction(async () => {
-    const page = await ensureSessionPage(session);
-    return detectCaptchaOnPage(page);
-  });
-  captcha.solve = realm.safeFunction(async (options: any = {}) => {
-    const page = await ensureSessionPage(session);
-    return solveCaptchaOnPage(page, session, options || {});
-  });
-  captcha.click = realm.safeFunction(async (bounds) => {
-    const page = await ensureSessionPage(session);
-    const target = captchaBounds(bounds);
-    const stored = [...session.captchaTargets.values()].find(
-      (entry) =>
-        Math.abs(entry.bounds.x - target.x) < 2 &&
-        Math.abs(entry.bounds.y - target.y) < 2 &&
-        Math.abs(entry.bounds.width - target.width) < 2 &&
-        Math.abs(entry.bounds.height - target.height) < 2,
-    );
-    const visibleTarget = await captchaBoxInViewport(
-      page,
-      stored?.pageBounds || target,
-      Boolean(stored?.pageBounds),
-    );
-    const point = {
-      x: Math.round(
-        visibleTarget.x + visibleTarget.width * (0.13 + Math.random() * 0.04),
-      ),
-      y: Math.round(
-        visibleTarget.y + visibleTarget.height * (0.44 + Math.random() * 0.12),
-      ),
-    };
-    await movePointer(page.mouse, session.cursor, point, { stepDivisor: 8 });
-    await pressPointer(page.mouse);
-    await hostDelay(2_000 + Math.random() * 1_500);
-    return snapshotPage(page);
-  });
-  captcha.drag = realm.safeFunction(async (from, to, options: any = {}) => {
-    const page = await ensureSessionPage(session);
-    const start = captchaPoint(from, "drag start");
-    const end = captchaPoint(to, "drag end");
-    const steps = Math.floor(
-      Math.max(1, Math.min(100, Number(options?.steps) || 20)),
-    );
-    await movePointer(page.mouse, session.cursor, start, { stepDivisor: 8 });
-    await hostDelay(120 + Math.random() * 180);
-    await page.mouse.down();
-    await hostDelay(90 + Math.random() * 150);
-    await movePointer(page.mouse, session.cursor, end, {
-      stepDivisor: Math.max(3, Math.hypot(end.x - start.x, end.y - start.y) / steps),
-    });
-    await hostDelay(100 + Math.random() * 180);
-    await page.mouse.up();
-    await hostDelay(1_500 + Math.random() * 1_000);
-    return snapshotPage(page);
-  });
-  async function captureCaptcha(bounds, requested, instruction) {
-    const page = await ensureSessionPage(session);
-    const clip = bounds == null ? null : captchaBounds(bounds);
-    const shotOptions = {
-      type: "png",
-      animations: "disabled",
-      timeout: CAPTCHA_SCREENSHOT_TIMEOUT_MS,
-    };
-    const file = await captureScreenshot(
-      page,
-      session,
-      requested,
-      requested,
-      clip ? { ...shotOptions, clip } : shotOptions,
-    );
-    const artifact = {
-      kind: "captcha",
-      path: file,
-      media: `MEDIA:${file}`,
-    };
-    session.artifacts.push(artifact);
-    return {
-      ...artifact,
-      instruction,
-    };
-  }
-  captcha.inspect = realm.safeFunction(async (bounds) => {
-    return captureCaptcha(
-      bounds,
-      "captcha-challenge.png",
-      "Inspect the attached challenge visually, choose the matching native " +
-        "CAPTCHA or human helper, then verify that the challenge cleared and " +
-        "resume the original task.",
-    );
-  });
-  captcha.readText = realm.safeFunction(async (bounds) => {
-    return captureCaptcha(
-      bounds,
-      "captcha-text.png",
-      "Read the attached CAPTCHA crop visually and return only its text.",
-    );
-  });
-  captcha.clickTiles = realm.safeFunction(async (indexes) => {
-    const page = await ensureSessionPage(session);
-    const picked = parseTileIndexes(indexes);
-    if (!picked.length) {
-      throw new Error("captcha.clickTiles requires an array of tile indexes from the numbered crop.");
-    }
-    if (!session.captchaTargets.size) {
-      await captureTiles(page, session, null);
-    } else if (await captchaTilesStale(page, session, null)) {
-      // The stored coordinates belong to a grid that is no longer on screen.
-      // Recapture so the caller re-reads the crop rather than clicking blind.
-      await captureTiles(page, session, null);
-      throw new Error(
-        "The captcha grid changed since the numbered crop was captured. " +
-          "Call captcha.solve() to get a fresh crop, then pick tiles again.",
-      );
-    }
-    const outcome = await clickStoredTiles(page, session, picked);
-    if (!outcome.ok) {
-      throw new Error(
-        outcome.reason === "tiles_not_captured"
-          ? "No numbered captcha grid is stored. Call captcha.solve() first."
-          : "None of the requested captcha tile indexes were on the stored grid.",
-      );
-    }
-    return snapshotPage(page);
-  });
-  const human = Object.create(null);
-  human.click = realm.safeFunction(async (target, options: any = {}) => {
-    const page = await ensureSessionPage(session);
-    await humanClickTarget(page, session, target, options);
-    return { clicked: true };
-  });
-  human.type = realm.safeFunction(async (target, text, options: any = {}) => {
-    const page = await ensureSessionPage(session);
-    const clickedTarget = await humanClickTarget(page, session, target, options);
-    const clear = options?.clear !== false;
-    if (clear) await clearTypedField(page, clickedTarget);
-    else await moveTypedFieldCaretToEnd(page, clickedTarget);
-    const expected = String(text);
-    const before = await readTypedFieldText(clickedTarget);
-    await typeText(page.keyboard, expected, options);
-    let after = await readTypedFieldText(clickedTarget);
-    if (!typedTextLanded(expected, before, after)) {
-      if (clear) await clearTypedField(page, clickedTarget);
-      else if (before != null) {
-        await restoreTypedFieldText(clickedTarget, before);
-      }
-      const retryBefore = await readTypedFieldText(clickedTarget);
-      await insertTypedText(page, clickedTarget, expected, retryBefore);
-      after = await readTypedFieldText(clickedTarget);
-    }
-    if (!typedTextLanded(expected, before, after)) {
-      throw new Error(
-        "human.type did not change the field. The target may ignore synthetic key events (common in Draft.js and other rich-text editors).",
-      );
-    }
-    return { typed: expected.length };
-  });
-  human.scroll = realm.safeFunction(async (deltaOrOptions, options: any = {}) => {
-    const page = await ensureSessionPage(session);
-    const settings = isObjectValue(deltaOrOptions)
-      ? deltaOrOptions
-      : { ...options, deltaY: deltaOrOptions };
-    const deltaX = Number(untrustedField(settings, "deltaX")) || 0;
-    const deltaY = Number(untrustedField(settings, "deltaY")) || 0;
-    if (!deltaX && !deltaY)
-      throw new Error("human.scroll requires a non-zero deltaX or deltaY.");
-    await scrollWheel(page.mouse, deltaX, deltaY, settings);
-    return { scrolled: { deltaX, deltaY } };
-  });
-  const overlays = Object.create(null);
-  overlays.dismiss = realm.safeFunction(async () => {
-    const page = await ensureSessionPage(session);
-    return dismissObstructiveOverlays(page);
-  });
-  const controls = Object.create(null);
-  controls.inspect = realm.safeFunction(async () => {
-    const page = await ensureSessionPage(session);
-    return inspectControls(page);
-  });
-  controls.directory = realm.safeFunction(async (options) => {
-    const page = await ensureSessionPage(session);
-    return inspectActionDirectory(page, options);
-  });
-  controls.batch = realm.safeFunction(
-    async (operationsValue, optionsValue: any = {}) => {
-      let operations = operationsValue;
-      let options = optionsValue;
-      if (isObjectValue(operationsValue) && !Array.isArray(operationsValue)) {
-        operations = untrustedField(operationsValue, "operations");
-        options = operationsValue;
-      }
-      const page = await ensureSessionPage(session);
-      return executeUIBatch(page, operations, options);
-    },
-  );
-  const media = Object.create(null);
-  media.inspect = realm.safeFunction(async () => {
-    const page = await ensureSessionPage(session);
-    return inspectMedia(page);
-  });
-  const site = Object.create(null);
-  site.requests = realm.safeFunction(async (options: any = {}) => {
-    const page = await ensureSessionPage(session);
-    const includes = String(options.urlIncludes || "");
-    const resourceType = String(options.resourceType || "");
-    const limit = Math.max(1, Math.min(512, Number(options.limit) || 100));
-    return (pageSiteRequests.get(page) || [])
-      .filter(
-        (record) =>
-          (!includes || record.url.includes(includes)) &&
-          (!resourceType || record.resourceType === resourceType),
-      )
-      .slice(-limit);
-  });
-  site.assets = realm.safeFunction(async () => {
-    const page = await ensureSessionPage(session);
-    return inspectSiteAssets(page);
-  });
-  site.read = realm.safeFunction(async (url, options: any = {}) => {
-    const page = await ensureSessionPage(session);
-    const response = await pageSiteRequest(page, url, { method: "GET" });
-    return {
-      ...response,
-      text: siteTextExcerpts(
-        response.text,
-        options.find,
-        options.contextChars,
-        options.maxMatches,
-      ),
-    };
-  });
-  site.request = realm.safeFunction(async (url, options: any = {}) => {
-    const page = await ensureSessionPage(session);
-    return pageSiteRequest(page, url, options);
-  });
-  const webmcp = Object.create(null);
-  webmcp.tools = realm.safeFunction(async (options: any = {}) => {
-    if (!isObjectValue(options) || Array.isArray(options)) {
-      throw new TypeError("webmcp.tools options must be an object.");
-    }
-    const page = await ensureSessionPage(session);
-    return listWebMCPTools(page, {
-      newCDPSession: (target) => browserContext.newCDPSession(target),
-      timeout: untrustedField(options, "timeout"),
-    });
-  });
-  webmcp.invoke = realm.safeFunction(
-    async (name, input: any = {}, options: any = {}) => {
-      const page = await ensureSessionPage(session);
-      return invokeWebMCPTool(page, name, input, options, {
-        newCDPSession: (target) => browserContext.newCDPSession(target),
-      });
-    },
-  );
-  const webagents = Object.create(null);
-  webagents.discover = realm.safeFunction(async (options: any = {}) => {
-    if (!isObjectValue(options) || Array.isArray(options)) {
-      throw new TypeError("webagents.discover options must be an object.");
-    }
-    const page = await ensureSessionPage(session);
-    const discovered = await discoverPageWebAgents(page, {
-      refresh: untrustedField(options, "refresh") === true,
-    });
-    if (!discovered.manifest) {
-      return {
-        available: false,
-        error: String(discovered.error || "WebAgents is unavailable.").slice(0, 500),
-      };
-    }
-    const activeUrl = new URL(page.url());
-    session.webAgentsAnnouncedOrigins.add(`${activeUrl.origin}${activeUrl.pathname}`);
-    return publicWebAgentsManifest(discovered.manifest);
-  });
-  webagents.batch = realm.safeFunction(
-    async (operationsValue, optionsValue: any = {}) => {
-      let operations = operationsValue;
-      let options = optionsValue;
-      if (isObjectValue(operationsValue) && !Array.isArray(operationsValue)) {
-        operations = untrustedField(operationsValue, "operations");
-        options = operationsValue;
-      }
-      if (!isObjectValue(options) || Array.isArray(options)) {
-        throw new TypeError("webagents.batch options must be an object.");
-      }
-      const page = await ensureSessionPage(session);
-      const discovered = await discoverPageWebAgents(page, {
-        refresh: untrustedField(options, "refresh") === true,
-      });
-      if (!discovered.manifest) {
-        throw new Error(discovered.error || "This origin does not publish WebAgents.");
-      }
-      const activeUrl = new URL(page.url());
-      session.webAgentsAnnouncedOrigins.add(`${activeUrl.origin}${activeUrl.pathname}`);
-      const request = prepareWebAgentsBatch(
-        discovered.manifest,
-        operations,
-        options,
-      );
-      const response = await pageSiteRequest(page, request.endpoint, {
-        method: "POST",
-        json: request.body,
-        response: "json",
-      });
-      if (!response.ok) {
-        const responseJson = "json" in response ? response.json : null;
-        const detail = isObjectValue(responseJson)
-          ? untrustedField(responseJson, "error")
-          : "";
-        const suffix = isString(detail) && detail.trim()
-          ? ` Site error (untrusted): ${detail.trim().slice(0, 500)}`
-          : "";
-        throw new Error(`WebAgents workflow failed with HTTP ${response.status}.${suffix}`);
-      }
-      const effects = new Map(
-        discovered.manifest.actions.map((action) => [action.name, action.effect]),
-      );
-      const hasEffects = request.body.operations.some(
-        (operation) => effects.get(operation.action) !== "read",
-      );
-      let pageUpdated = false;
-      if (hasEffects && untrustedField(options, "refresh") !== false) {
-        await page.reload({ waitUntil: "domcontentloaded" });
-        await page.waitForLoadState("load", { timeout: 5_000 }).catch(() => {});
-        await page.waitForTimeout(150);
-        pageUpdated = true;
-      }
-      return {
-        protocol: `webagents/${discovered.manifest.version}`,
-        status: response.status,
-        pageUpdated,
-        result: "json" in response ? response.json : null,
-        trust: "untrusted_external_data",
-      };
-    },
-  );
-  sandbox.dialogs = Object.freeze(dialogs);
-  sandbox.captcha = Object.freeze(captcha);
-  sandbox.human = Object.freeze(human);
-  sandbox.overlays = Object.freeze(overlays);
-  sandbox.controls = Object.freeze(controls);
-  sandbox.media = Object.freeze(media);
-  sandbox.site = Object.freeze(site);
-  sandbox.webmcp = Object.freeze(webmcp);
-  sandbox.webagents = Object.freeze(webagents);
-  sandbox.credentials = buildCredentials(session, realm, execution);
-  realm.installPage(getCurrentPage);
-  return { context, realm, sandbox };
-}
-
-function summaryText(value, maxLength = 4_000) {
-  return redactText(String(value ?? "")).slice(0, maxLength);
-}
-
-async function callSummaryMethod(value, method, fallback = null) {
-  try {
-    if (!isCallable(value?.[method])) return fallback;
-    return await value[method]();
-  } catch {
-    return fallback;
-  }
-}
-
-async function summarizePlaywrightObject(raw, kind) {
-  if (kind === "Frame") {
-    return {
-      type: "Frame",
-      name: summaryText(await callSummaryMethod(raw, "name", "")),
-      url: summaryText(await callSummaryMethod(raw, "url", "")),
-      detached: Boolean(await callSummaryMethod(raw, "isDetached", true)),
-    };
-  }
-  if (kind === "ConsoleMessage") {
-    const location = await callSummaryMethod(raw, "location", {});
-    return {
-      type: "ConsoleMessage",
-      level: summaryText(await callSummaryMethod(raw, "type", ""), 80),
-      text: summaryText(await callSummaryMethod(raw, "text", "")),
-      location: {
-        url: summaryText(location?.url || ""),
-        lineNumber: Number(location?.lineNumber) || 0,
-        columnNumber: Number(location?.columnNumber) || 0,
-      },
-    };
-  }
-  if (kind === "Request") {
-    return {
-      type: "Request",
-      url: summaryText(await callSummaryMethod(raw, "url", "")),
-      method: summaryText(await callSummaryMethod(raw, "method", ""), 40),
-      resourceType: summaryText(
-        await callSummaryMethod(raw, "resourceType", ""),
-        80,
-      ),
-      navigation: Boolean(
-        await callSummaryMethod(raw, "isNavigationRequest", false),
-      ),
-    };
-  }
-  if (kind === "Response") {
-    return {
-      type: "Response",
-      url: summaryText(await callSummaryMethod(raw, "url", "")),
-      status: Number(await callSummaryMethod(raw, "status", 0)) || 0,
-      statusText: summaryText(
-        await callSummaryMethod(raw, "statusText", ""),
-        200,
-      ),
-      ok: Boolean(await callSummaryMethod(raw, "ok", false)),
-    };
-  }
-  if (kind === "Dialog") {
-    return {
-      type: "Dialog",
-      dialogType: summaryText(await callSummaryMethod(raw, "type", ""), 80),
-      message: summaryText(await callSummaryMethod(raw, "message", "")),
-      defaultValue: summaryText(
-        await callSummaryMethod(raw, "defaultValue", ""),
-      ),
-    };
-  }
-  if (kind === "Download") {
-    return {
-      type: "Download",
-      url: summaryText(await callSummaryMethod(raw, "url", "")),
-      suggestedFilename: summaryText(
-        await callSummaryMethod(raw, "suggestedFilename", ""),
-        300,
-      ),
-    };
-  }
-  if (kind === "WebSocket" || kind === "Worker") {
-    return {
-      type: kind,
-      url: summaryText(await callSummaryMethod(raw, "url", "")),
-    };
-  }
-  if (kind === "FileChooser") {
-    return {
-      type: "FileChooser",
-      multiple: Boolean(await callSummaryMethod(raw, "isMultiple", false)),
-    };
-  }
-  // Handles, contexts, sessions, routes, videos, and future Playwright classes
-  // fail closed. Their enumerable fields include transport channels and host
-  // process state that must never cross the model boundary.
-  return { type: kind || "PlaywrightObject" };
-}
-
-/**
- * JSON-safe summary of a sandbox value as `summarize` produces it: primitives
- * pass through and every container is reduced to plain arrays and objects.
- */
-type SummarizedValue =
-  | null
-  | string
-  | number
-  | boolean
-  | SummarizedValue[]
-  | { [key: string]: SummarizedValue };
-
-async function summarize(value, seen = new WeakSet(), depth = 0) {
-  if (value === undefined) return null;
-  if (value === null || isString(value) || isNumber(value) || isBoolean(value))
-    return redactDeep(value);
-  if (isBigIntValue(value)) return value.toString();
-  if (isCallable(value))
-    return `[Function ${value.name || "anonymous"}]`;
-  const raw = facadeToRaw.get(value) || value;
-  if (raw instanceof Error)
-    return { name: raw.name, message: redactText(raw.message) };
-  if (depth > 8) return "[Max depth]";
-  if (seen.has(raw)) return "[Circular]";
-  seen.add(raw);
-
-  const kind = objectKind(raw);
-  if (pageIds.has(raw)) {
-    let title = "";
-    try {
-      const domTitle = await raw
-        .evaluate(
-          () => document.title || document.querySelector("title")?.textContent || "",
-        )
-        .catch(() => "");
-      if (isString(domTitle) && domTitle) title = domTitle;
-      else title = await raw.title();
-    } catch {
-      /* page may have closed */
-    }
-    return {
-      type: "Page",
-      pageId: pageId(raw),
-      url: redactText(raw.url()),
-      title: redactText(title),
-      closed: raw.isClosed(),
-    };
-  }
-  if (kind === "Locator")
-    return { type: "Locator", locator: redactText(raw.toString()) };
-  if (Array.isArray(raw))
-    return Promise.all(
-      raw.slice(0, 200).map((item) => summarize(item, seen, depth + 1)),
-    );
-  if (raw instanceof Map) {
-    const entries = [...raw.entries()].slice(0, 200);
-    return Object.fromEntries(
-      await Promise.all(
-        entries.map(async ([key, item]) => [
-          redactText(key),
-          await summarize(item, seen, depth + 1),
-        ]),
-      ),
-    );
-  }
-  if (raw instanceof Set)
-    return Promise.all(
-      [...raw].slice(0, 200).map((item) => summarize(item, seen, depth + 1)),
-    );
-  if (kind !== "Object" && kind !== "") {
-    return summarizePlaywrightObject(raw, kind);
-  }
-  const output: Record<string, SummarizedValue> = {};
-  for (const key of Object.keys(raw).slice(0, 200)) {
-    try {
-      output[redactText(key)] = await summarize(raw[key], seen, depth + 1);
-    } catch (error) {
-      output[redactText(key)] = `[Unserializable: ${error?.message || error}]`;
-    }
-  }
-  return redactDeep(output);
-}
-
-async function summarizeSessionPages(session) {
-  return Promise.all(
-    [...session.pages.values()]
-      .filter((page) => !page.isClosed())
-      .slice(0, MAX_RESPONSE_PAGES)
-      .map(async (page) => ({
-        ...(await summarize(page)),
-        active: pageId(page) === session.currentId,
-      })),
-  );
-}
-
-async function enforceArtifactQuota(session) {
-  pruneArtifactQuota(session);
-}
-
-const CHALLENGE_FRAME_LIMIT = 24;
-const CHALLENGE_MAIN_TEXT_LIMIT = 50_000;
-const CHALLENGE_FRAME_TEXT_LIMIT = 10_000;
-const CHALLENGE_MAIN_TEXT_TIMEOUT_MS = 750;
-const CHALLENGE_FRAME_TEXT_TIMEOUT_MS = 500;
-// The frame walk is work the main-frame read did not do before, so it gets its
-// own budget rather than borrowing the body-text one: a page slow enough to
-// lose the walk must still report its title, text and solved-provider tokens.
-const CHALLENGE_FRAME_WALK_TIMEOUT_MS = 750;
-// In-page ceiling for the same-origin text walk, so one slow frame layout
-// cannot spend the whole evaluate budget by itself.
-const CHALLENGE_WALK_BUDGET_MS = 250;
-const CHALLENGE_CHECKED_SELECTOR =
-  '[aria-checked="true"], input[type="checkbox"]:checked, .recaptcha-checkbox-checked';
-const CHALLENGE_COMPLETED_TEXT =
-  /verification (?:complete|successful)|success!|you are verified/i;
-// Navigation destroys the execution context a pending evaluate was scheduled
-// in. The locator APIs retry that internally, inside their own timeout;
-// `evaluate` surfaces it as a rejection, so it is retried once here to keep a
-// mid-scan navigation from blanking a field the old per-call reads kept.
-const CHALLENGE_EVALUATE_RETRY =
-  /execution context was destroyed|frame was detached|cannot find context/i;
-
-/**
- * Filled challenge response fields, keyed by provider. Runs in the page's main
- * world because the fields are page state, which is where this read has always
- * lived.
- */
-const readSolvedProvidersInPage = () => {
-  const isResponseText = (value: UntrustedValue): value is string =>
-    typeof value === "string";
-  const read = (name) => {
-    const fields = [...document.querySelectorAll(`[name="${name}"]`)];
-    if (fields.length === 0) return "";
-    const values = fields.map((element) => {
-      // SAFETY: challenge response fields are <input>/<textarea>, whose `value`
-      // is a string; any other element carrying the name reads undefined here
-      // and fails the guard below, counting as unfilled.
-      const fieldValue = (element as { value?: UntrustedValue }).value;
-      return isResponseText(fieldValue) ? fieldValue.trim() : "";
-    });
-    // A provider only counts as solved once every response field is filled;
-    // a partially populated multi-widget page is still an open challenge.
-    return values.every(Boolean) ? values[0] : "";
-  };
-  const tokens: Record<string, string> = {};
-  const recaptcha = read("g-recaptcha-response");
-  const hcaptcha = read("h-captcha-response");
-  const turnstile = read("cf-turnstile-response");
-  if (recaptcha) tokens.recaptcha = recaptcha;
-  if (hcaptcha) tokens.hcaptcha = hcaptcha;
-  if (turnstile) tokens.turnstile = turnstile;
-  // Generic local fixture / self-hosted widgets.
-  const generic = read("bw-captcha-response") || read("captcha-response");
-  if (generic) tokens.generic = generic;
-  return tokens;
-};
-
-/**
- * Child-frame geometry, plus the text of the same-origin ones when the caller
- * is about to gate on it. One evaluate for the whole document tree instead of a
- * round trip per frame. Serialized into the page, so it closes over no worker
- * scope; `contentDocument` reaches same-origin frames (including `srcdoc`) and
- * nothing else, which is why cross-origin frames still cost stage 2.
- */
-const readFrameWalkInPage = (options: any) => {
-  const isTextValue = (value: UntrustedValue): value is string =>
-    typeof value === "string";
-  const deadline = performance.now() + options.walkBudgetMs;
-  const presentationOf = (element) => {
-    const rect = element.getBoundingClientRect();
-    const view = element.ownerDocument?.defaultView;
-    const style = view ? view.getComputedStyle(element) : null;
-    return {
-      visible:
-        rect.width > 0 &&
-        rect.height > 0 &&
-        (!style ||
-          (style.display !== "none" &&
-            style.visibility !== "hidden" &&
-            Number(style.opacity || "1") > 0)),
-      width: rect.width,
-      height: rect.height,
-    };
-  };
-  // Only this document's own children: a nested frame's descriptors are read
-  // from that frame, and an iframe inside a shadow root (which
-  // `querySelectorAll` does not reach) is resolved through its own element by
-  // the caller rather than by walking every element on the page.
-  const elements = [...document.querySelectorAll("iframe, frame")].slice(
-    0,
-    options.frameLimit,
-  );
-  const iframes = elements.map((element) => ({
-    name: element.getAttribute("name") || element.getAttribute("id") || "",
-    // SAFETY: the selector matches only <iframe>/<frame> elements, whose `src`
-    // IDL attribute is a string; an impostor from another namespace reads
-    // undefined here, which || "" normalizes.
-    src: (element as { src?: string }).src || "",
-    ...presentationOf(element),
-  }));
-
-  const sameOrigin = [];
-  if (options.wantFrameText) {
-    const queue = [document];
-    while (queue.length > 0 && sameOrigin.length < options.frameLimit) {
-      if (performance.now() > deadline) break;
-      const scope = queue.shift();
-      let nested = [];
-      try {
-        nested = [...scope.querySelectorAll("iframe, frame")];
-      } catch {
-        continue;
-      }
-      for (const element of nested) {
-        if (sameOrigin.length >= options.frameLimit) break;
-        if (performance.now() > deadline) break;
-        let inner = null;
-        try {
-          inner = element.contentDocument;
-        } catch {
-          inner = null;
-        }
-        if (!inner) {
-          const srcdoc = element.getAttribute("srcdoc");
-          if (srcdoc) {
-            const parsed = document.createElement("div");
-            parsed.innerHTML = srcdoc;
-            sameOrigin.push({
-              url: "about:srcdoc",
-              title: parsed.querySelector("title")?.textContent || "",
-              text: String(parsed.innerText || parsed.textContent || "").slice(
-                0,
-                options.frameTextLimit,
-              ),
-              visible: presentationOf(element).visible,
-            });
-          }
-          continue;
-        }
-        const innerBody = inner.body;
-        let frameText = isTextValue(innerBody?.innerText)
-          ? innerBody.innerText
-          : String(innerBody?.textContent || "");
-        let frameTitle = inner.title || "";
-        if (!frameText) {
-          const srcdoc = element.getAttribute("srcdoc");
-          if (srcdoc) {
-            const parsed = document.createElement("div");
-            parsed.innerHTML = srcdoc;
-            frameText = String(parsed.innerText || parsed.textContent || "");
-            frameTitle = parsed.querySelector("title")?.textContent || frameTitle;
-          }
-        }
-        sameOrigin.push({
-          url: inner.location ? String(inner.location.href) : "",
-          title: frameTitle,
-          text: frameText.slice(0, options.frameTextLimit),
-          visible: presentationOf(element).visible,
-        });
-        queue.push(inner);
-      }
-    }
-  }
-  return { iframes, sameOrigin };
-};
-
-/**
- * Geometry of one frame element, read through the element itself. Duplicates
- * `presentationOf` above because in-page functions are serialized and cannot
- * share worker-scope helpers.
- */
-const readFramePresentationInPage = (element) => {
-  const rect = element.getBoundingClientRect();
-  const view = element.ownerDocument?.defaultView;
-  const style = view ? view.getComputedStyle(element) : null;
-  return {
-    visible:
-      rect.width > 0 &&
-      rect.height > 0 &&
-      (!style ||
-        (style.display !== "none" &&
-          style.visibility !== "hidden" &&
-          Number(style.opacity || "1") > 0)),
-    width: rect.width,
-    height: rect.height,
-  };
-};
-
-function emptyFrameWalk() {
-  return { iframes: [], sameOrigin: [] };
-}
-
-async function evaluateOnce(target, fn, arg?) {
-  try {
-    return await target.evaluate(fn, arg);
-  } catch (error: any) {
-    if (!CHALLENGE_EVALUATE_RETRY.test(String(error?.message || ""))) throw error;
-    return target.evaluate(fn, arg);
-  }
-}
-
-// A hung page must degrade to the same empty value the old per-call `.catch()`
-// handlers produced, and must not leave a rejected evaluate unhandled once the
-// race is over.
-async function withChallengeTimeout(work, timeoutMs, fallback) {
-  let timer;
-  return Promise.race([
-    work,
-    new Promise((resolve) => {
-      timer = setTimeout(() => resolve(fallback), timeoutMs);
-    }),
-  ]).finally(() => clearTimeout(timer));
-}
-
-async function readSolvedProviders(page): Promise<Record<string, string>> {
-  return evaluateOnce(page, readSolvedProvidersInPage).catch(() => ({}));
-}
-
-async function readFrameWalk(target, options) {
-  return withChallengeTimeout(
-    evaluateOnce(target, readFrameWalkInPage, options).catch(() => emptyFrameWalk()),
-    CHALLENGE_FRAME_WALK_TIMEOUT_MS,
-    emptyFrameWalk(),
-  );
-}
-
-/**
- * Text and solved-checkbox state of one frame. Both go through Playwright's
- * locator APIs, which run in an isolated utility world: a page cannot hide its
- * own prompt by patching `innerText`, nor declare its challenge solved by
- * patching `querySelector`, and the CSS engine pierces open shadow roots the
- * way a widget's own checkbox is usually rendered.
- */
-async function readFrameSurface(frame) {
-  const [text, checked] = await Promise.all([
-    frame
-      .locator("body")
-      .innerText({ timeout: CHALLENGE_FRAME_TEXT_TIMEOUT_MS })
-      .catch(() => ""),
-    frame
-      .locator(CHALLENGE_CHECKED_SELECTOR)
-      .count()
-      .then((count) => count > 0)
-      .catch(() => false),
-  ]);
-  return { text: text.slice(0, CHALLENGE_FRAME_TEXT_LIMIT), checked };
-}
-
-function claimUnique(pool, matches) {
-  let found = null;
-  for (const entry of pool) {
-    if (entry.used || !matches(entry)) continue;
-    // Two candidates identify nothing: duplicate ad frames and duplicate
-    // widgets share both name and URL, and guessing between them would attach
-    // one frame's visibility to the other.
-    if (found) return null;
-    found = entry;
-  }
-  if (found) found.used = true;
-  return found;
-}
-
-// Playwright's `frame.name()` reports the frame element's name attribute and
-// falls back to its id, so both identify a frame exactly. `src` is the element
-// attribute, which only equals `frame.url()` while the frame has not navigated
-// itself. Anything left over is resolved through its own element instead of
-// being guessed at: a descriptor borrowed from a sibling could report
-// `visible: false`, and that is the one value that makes the detector drop a
-// real challenge.
-function matchFrameDescriptor(frame, pool) {
-  if (!pool.length) return null;
-  const name = frame.name();
-  const byName = name ? claimUnique(pool, (entry) => entry.name === name) : null;
-  if (byName) return byName;
-  const url = frame.url();
-  return url ? claimUnique(pool, (entry) => entry.src && entry.src === url) : null;
-}
-
-async function resolveFramePresentation(frame) {
-  return frame
-    .frameElement()
-    .then(async (element) => {
-      try {
-        return await element.evaluate(readFramePresentationInPage);
-      } finally {
-        await element.dispose().catch(() => {});
-      }
-    })
-    .catch(() => null);
-}
-
-// Stage 2 of the challenge scan: two parallel locator reads per frame instead
-// of the five sequential CDP round-trips (frameElement, rect/style, dispose,
-// innerText, checkbox count) this used to cost, with the geometry coming from
-// the parent's single descriptor walk. `mainDescriptors` is the main frame's
-// share of that, already collected by stage 1.
-async function collectFrameMetadata(page, childFrames, mainDescriptors) {
-  if (!childFrames.length) return [];
-  const mainFrame = page.mainFrame();
-  const parents = new Set();
-  for (const frame of childFrames) {
-    const parent = frame.parentFrame();
-    if (parent && parent !== mainFrame) parents.add(parent);
-  }
-  const surfaces = new Map();
-  const walks = new Map();
-  await Promise.all([
-    ...childFrames.map(async (frame) => {
-      surfaces.set(frame, await readFrameSurface(frame));
-    }),
-    ...[...parents].map(async (frame) => {
-      walks.set(
-        frame,
-        await readFrameWalk(frame, {
-          frameLimit: CHALLENGE_FRAME_LIMIT,
-          frameTextLimit: CHALLENGE_FRAME_TEXT_LIMIT,
-          wantFrameText: false,
-          walkBudgetMs: CHALLENGE_WALK_BUDGET_MS,
-        }),
-      );
-    }),
-  ]);
-
-  const pools = new Map();
-  const poolFor = (parent) => {
-    if (!parent) return [];
-    if (!pools.has(parent)) {
-      const source =
-        parent === mainFrame ? mainDescriptors : walks.get(parent)?.iframes;
-      pools.set(
-        parent,
-        (source || []).map((entry) => ({ ...entry, used: false })),
-      );
-    }
-    return pools.get(parent);
-  };
-
-  const presentations = new Map();
-  for (const frame of childFrames) {
-    presentations.set(
-      frame,
-      matchFrameDescriptor(frame, poolFor(frame.parentFrame())),
-    );
-  }
-  await Promise.all(
-    childFrames
-      .filter((frame) => !presentations.get(frame))
-      .map(async (frame) => {
-        presentations.set(frame, await resolveFramePresentation(frame));
-      }),
-  );
-
-  return childFrames.map((frame) => {
-    const surface = surfaces.get(frame) || { text: "", checked: false };
-    const presentation = presentations.get(frame) || null;
-    return {
-      url: frame.url(),
-      text: surface.text,
-      visible: presentation?.visible ?? null,
-      width: presentation?.width ?? null,
-      height: presentation?.height ?? null,
-      completed: surface.checked || CHALLENGE_COMPLETED_TEXT.test(surface.text),
-    };
-  });
-}
-
-// Stage 1 always runs; stage 2 runs only when `options.gate` says so. Without a
-// gate the full scan runs, which is what the captcha-solving paths need. The
-// returned shape is identical either way — a skipped stage 2 reports no frames,
-// exactly as a frame-free page does.
-//
-// The four stage-1 reads are issued together and degrade independently, so one
-// slow field cannot blank the others: an empty `tokens` in particular would
-// re-report a solved challenge and burn the solver's attempt budget.
-async function collectChallengeMetadata(page, options: any = {}) {
-  const [title, text, tokens, walk] = await Promise.all([
-    page.title().catch(() => ""),
-    page
-      .locator("body")
-      .innerText({ timeout: CHALLENGE_MAIN_TEXT_TIMEOUT_MS })
-      .catch(() => ""),
-    readSolvedProviders(page),
-    readFrameWalk(page, {
-      frameLimit: CHALLENGE_FRAME_LIMIT,
-      frameTextLimit: CHALLENGE_FRAME_TEXT_LIMIT,
-      // Frame text is only read when a gate will judge it; the full scan reads
-      // every frame itself and would otherwise pay for the same text twice.
-      wantFrameText: Boolean(options.gate),
-      walkBudgetMs: CHALLENGE_WALK_BUDGET_MS,
-    }),
-  ]);
-  const main = {
-    url: page.url(),
-    title,
-    text: text.slice(0, CHALLENGE_MAIN_TEXT_LIMIT),
-  };
-
-  let childFrames = [];
-  try {
-    childFrames = page
-      .frames()
-      .filter((frame) => frame !== page.mainFrame())
-      .slice(0, CHALLENGE_FRAME_LIMIT);
-  } catch {
-    // A page that closed mid-scan still reports its main-frame metadata.
-  }
-
-  const scanFrames = options.gate
-    ? options.gate({ main, tokens, childFrames, sameOrigin: walk.sameOrigin })
-    : true;
-  const frames = scanFrames
-    ? await collectFrameMetadata(page, childFrames, walk.iframes)
-    : [];
-  return { main, frames, solvedProviders: Object.keys(tokens), tokens };
-}
-
-// The gate itself lives in challenges.ts so it cannot drift from the detector
-// it has to agree with; this only reads the per-page state it needs.
-//
-// Each frame stage 2 would scan contributes exactly one source. Same-origin
-// frames carry the text and visibility stage 1 already read, so the gate judges
-// them on the same evidence the full scan would. Cross-origin frames carry only
-// a URL and are flagged `readable: false`, which is what makes the gate treat
-// them as unknown rather than as benign.
-function challengeScanState(session, page, { main, tokens, childFrames, sameOrigin }) {
-  const readable = new Map();
-  for (const entry of sameOrigin || []) {
-    const queued = readable.get(entry.url);
-    if (queued) queued.push(entry);
-    else readable.set(entry.url, [entry]);
-  }
-  const frames = childFrames.map((frame) => {
-    const entry = readable.get(frame.url())?.shift();
-    return entry ? { ...entry, readable: true } : { url: frame.url(), readable: false };
-  });
-  // Anything the walk read that no live frame claimed is still evidence.
-  for (const queued of readable.values()) {
-    for (const entry of queued) frames.push({ ...entry, readable: true });
-  }
-  return {
-    openProviders: session.openChallengeProviders,
-    blockedAt: lastBlockedDocumentAt.get(page) || 0,
-    now: Date.now(),
-    main,
-    frames,
-    solvedProviders: Object.keys(tokens),
-  };
-}
-
-async function detectSessionChallenges(session) {
-  const challenges = [];
-  const activePage = session.currentId
-    ? session.pages.get(session.currentId)
-    : null;
-  const pages =
-    activePage && !activePage.isClosed()
-      ? [activePage]
-      : [...session.pages.values()].filter((page) => !page.isClosed()).slice(0, 1);
-  let scanned = false;
-  for (const page of pages) {
-    if (page.isClosed()) continue;
-    const metadata = await collectChallengeMetadata(page, {
-      gate: (surface) => challengeScanNeeded(challengeScanState(session, page, surface)),
-    });
-    scanned = true;
-    const challenge = detectBotChallenge(metadata);
-    if (challenge) {
-      const classification = classifyChallengeStage({
-        ...metadata,
-        provider: challenge.provider,
-        type: challenge.type,
-      });
-      const reported: any = {
-        pageId: pageId(page),
-        ...challenge,
-        stage: classification.stage,
-        autoSolvable: classification.autoSolvable,
-        needsVision: classification.needsVision,
-      };
-      try {
-        const file = await captureScreenshot(
-          page,
-          session,
-          "captcha-detected.png",
-          "captcha-detected.png",
-          { type: "png", animations: "disabled" },
-        );
-        const artifact = { kind: "captcha", path: file, media: `MEDIA:${file}` };
-        session.artifacts.push(artifact);
-        reported.artifact = artifact;
-      } catch {
-        // Challenge reporting must survive pages that close or cannot be captured.
-      }
-      challenges.push(reported);
-    }
-  }
-  // Written only from a completed scan, and a scan that finds nothing writes an
-  // empty set — so a solved or navigated-away challenge always releases the
-  // gate instead of pinning every later execute on the full frame walk.
-  if (scanned) {
-    session.openChallengeProviders = new Set(
-      challenges.map((entry) => entry.provider).filter(Boolean),
-    );
-  }
-  return challenges;
-}
-
-function frameMatchesProvider(frame, provider) {
-  const url = frame.url() || "";
-  if (provider && WIDGET_FRAME_PATTERNS[provider]) {
-    return WIDGET_FRAME_PATTERNS[provider].test(url);
-  }
-  return Object.values(WIDGET_FRAME_PATTERNS).some((pattern) => pattern.test(url));
-}
-
-function candidateFrames(page, provider) {
-  const frames = page.frames().filter((frame) => frame !== page.mainFrame());
-  const matched = frames.filter((frame) => frameMatchesProvider(frame, provider));
-  return matched.length ? matched : frames.slice(0, 8);
-}
-
-/**
- * Page-coordinate box of a provider's challenge frame, taken from the frame
- * element itself. Turnstile mounts its iframe in a closed shadow root, where
- * neither `document.querySelector` nor a Playwright selector can see it, so
- * walking back from the attached frame is the only way to locate the widget.
- */
-async function widgetFrameBox(page, provider) {
-  for (const frame of candidateFrames(page, provider)) {
-    const element = await frame.frameElement().catch(() => null);
-    if (!element) continue;
-    try {
-      const box = await element.boundingBox().catch(() => null);
-      if (box && box.width > 0 && box.height > 0) return box;
-    } finally {
-      await element.dispose().catch(() => {});
-    }
-  }
-  return null;
-}
-
-async function elementBoxInPage(_page, _frame, locator) {
-  const handle = await locator.elementHandle({ timeout: 1_500 }).catch(() => null);
-  if (!handle) return null;
-  try {
-    const box = await handle.boundingBox();
-    if (!box || box.width <= 0 || box.height <= 0) return null;
-    // Frame-local boxes are already in page CSS pixels for Playwright frames.
-    return box;
-  } finally {
-    await handle.dispose().catch(() => {});
-  }
-}
-
-async function findClickableInScopes(page, scopes, selectors) {
-  for (const scope of scopes) {
-    for (const selector of selectors) {
-      const locator = scope.locator(selector).first();
-      const visible = await locator.isVisible({ timeout: 400 }).catch(() => false);
-      if (!visible) continue;
-      const box = await elementBoxInPage(page, scope, locator);
-      if (box) return { locator, box, scope, selector };
-    }
-  }
-  return null;
-}
-
-async function locatorAccessibleName(locator) {
-  const parts = await Promise.all([
-    locator.innerText().catch(() => ""),
-    locator.getAttribute("aria-label").catch(() => ""),
-    locator.getAttribute("title").catch(() => ""),
-    locator.getAttribute("value").catch(() => ""),
-  ]);
-  return (
-    parts
-      .map((value) => String(value || "").replace(/\s+/g, " ").trim())
-      .find(Boolean) || ""
-  );
-}
-
-async function locatorLooksDisabled(locator) {
-  const aria = await locator.getAttribute("aria-disabled").catch(() => null);
-  if (aria === "true") return true;
-  const className = await locator.getAttribute("class").catch(() => "");
-  return /(?:^|\s)(?:disabled|rc-button-disabled)(?:\s|$)/i.test(String(className || ""));
-}
-
-async function scopeHasSelectedCaptchaTiles(scope) {
-  const locator = scope.locator(SELECTED_IMAGE_TILE_SELECTORS.join(", "));
-  const count = await locator.count().catch(() => 0);
-  if (!count) return false;
-  for (let i = 0; i < Math.min(count, 8); i += 1) {
-    const visible = await locator.nth(i).isVisible({ timeout: 200 }).catch(() => false);
-    if (visible) return true;
-  }
-  return false;
-}
-
-async function anyScopeHasSelectedCaptchaTiles(scopes) {
-  for (const scope of scopes) {
-    if (await scopeHasSelectedCaptchaTiles(scope)) return true;
-  }
-  return false;
-}
-
-async function recaptchaVerifyButtonLabel(scopes) {
-  for (const scope of scopes) {
-    const locator = scope.locator("#recaptcha-verify-button").first();
-    const visible = await locator.isVisible({ timeout: 400 }).catch(() => false);
-    if (!visible) continue;
-    return locatorAccessibleName(locator);
-  }
-  return "";
-}
-
-/**
- * Submit control for the current challenge. reCAPTCHA reuses
- * `#recaptcha-verify-button` for Skip (new puzzle) and Verify (submit).
- * Clicking it while it still says Skip abandons a correct tile selection.
- */
-async function findVerifyControl(page, scopes, options: any = {}) {
-  const previousLabel = String(options.previousLabel || "");
-  for (const scope of scopes) {
-    for (const selector of VERIFY_BUTTON_SELECTORS) {
-      if (selector === "body") continue;
-      const locator = scope.locator(selector).first();
-      const visible = await locator.isVisible({ timeout: 400 }).catch(() => false);
-      if (!visible) continue;
-      const label = await locatorAccessibleName(locator);
-      if (isCaptchaSkipSubmitLabel(label)) continue;
-      if (await locatorLooksDisabled(locator)) continue;
-      if (selector === "#recaptcha-verify-button") {
-        if (
-          !isCaptchaVerifySubmitReady({
-            label,
-            previousLabel,
-            hadSelection: options.hadSelection,
-          })
-        ) {
-          continue;
-        }
-      }
-      const box = await elementBoxInPage(page, scope, locator);
-      if (box) return { locator, box, scope, selector, label };
-    }
-  }
-  return null;
-}
-
-async function waitForVerifyControl(page, scopes, timeoutMs = 2_500, options: any = {}) {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    const found = await findVerifyControl(page, scopes, options);
-    if (found) return found;
-    await hostDelay(120);
-  }
-  return null;
-}
-
-async function humanClickBox(page, session, box, options: any = {}) {
-  const inputLike = Boolean(options.inputLike);
-  const leftBias = options.leftBias !== false;
-  const point = leftBias
-    ? {
-        x: Math.round(box.x + box.width * (0.12 + Math.random() * 0.08)),
-        y: Math.round(box.y + box.height * (0.4 + Math.random() * 0.2)),
-      }
-    : pointInside(box, inputLike);
-  await movePointer(page.mouse, session.cursor, point, { stepDivisor: 8 });
-  await pressPointer(page.mouse, inputLike);
-  return point;
-}
-
-async function pageScrollMetrics(page) {
-  return page.evaluate(() => ({
-    x: window.scrollX,
-    y: window.scrollY,
-    width: window.innerWidth,
-    height: window.innerHeight,
-  }));
-}
-
-/**
- * Turn a captured page-coordinate CAPTCHA box into current viewport
- * coordinates, scrolling only when its center is outside the clickable
- * viewport. Playwright can report a bounding box below the fold, while
- * page.mouse uses viewport coordinates and otherwise clicks empty space.
- */
-async function captchaBoxInViewport(page, box, pageCoordinates = false) {
-  const before = await pageScrollMetrics(page);
-  const absolute = pageCoordinates
-    ? box
-    : { ...box, x: box.x + before.x, y: box.y + before.y };
-  const center = {
-    x: absolute.x + absolute.width / 2,
-    y: absolute.y + absolute.height / 2,
-  };
-  const currentCenter = { x: center.x - before.x, y: center.y - before.y };
-  const margin = 8;
-  let left = before.x;
-  let top = before.y;
-  if (currentCenter.x < margin || currentCenter.x > before.width - margin) {
-    left = Math.max(0, center.x - before.width / 2);
-  }
-  if (currentCenter.y < margin || currentCenter.y > before.height - margin) {
-    top = Math.max(0, center.y - before.height / 2);
-  }
-  if (left !== before.x || top !== before.y) {
-    await page.evaluate(({ left: x, top: y }) => window.scrollTo(x, y), { left, top });
-  }
-  const after = await pageScrollMetrics(page);
-  return {
-    x: absolute.x - after.x,
-    y: absolute.y - after.y,
-    width: absolute.width,
-    height: absolute.height,
-  };
-}
-
-async function challengeStillPresent(page, provider) {
-  const metadata = await collectChallengeMetadata(page);
-  if (provider && metadata.tokens[provider]) return { present: false, metadata };
-  if (Object.keys(metadata.tokens).length) return { present: false, metadata };
-  const challenge = detectBotChallenge(metadata);
-  return { present: Boolean(challenge), metadata, challenge };
-}
-
-/**
- * Widget container box for clicking. `challengeWidgetBox` exists to crop
- * screenshots and so demands a puzzle-sized box; a checkbox widget is a wide,
- * short strip that the size gate rejects. Clicking only needs a real target.
- */
-async function challengeWidgetClickBox(page, provider) {
-  const scopes = [page, ...candidateFrames(page, provider)];
-  for (const scope of scopes) {
-    const widget = scope.locator(CHALLENGE_WIDGET_SELECTORS.join(", ")).first();
-    const visible = await widget.isVisible({ timeout: 400 }).catch(() => false);
-    if (!visible) continue;
-    const box = await elementBoxInPage(page, scope, widget);
-    if (box && box.width >= 24 && box.height >= 16) return box;
-  }
-  return null;
-}
-
-async function challengeWidgetBox(page, provider) {
-  // Prefer the puzzle iframe. `.first()` on the combined selector is the
-  // hCaptcha checkbox (too short), so a size-gated first() skipped the crop
-  // and inspect fell back to a full-page screenshot.
-  const preferred = page.locator(
-    'iframe[src*="frame=challenge" i], iframe[src*="bframe" i]',
-  ).first();
-  const preferredBox = await preferred.boundingBox({ timeout: 800 }).catch(() => null);
-  if (preferredBox && preferredBox.width >= 80 && preferredBox.height >= 80) {
-    return preferredBox;
-  }
-  const loc = page.locator(CHALLENGE_WIDGET_SELECTORS.join(", "));
-  const n = await loc.count().catch(() => 0);
-  let best = null;
-  for (let i = 0; i < Math.min(n, 8); i += 1) {
-    const box = await loc.nth(i).boundingBox({ timeout: 400 }).catch(() => null);
-    if (!box || box.width < 80 || box.height < 80) continue;
-    if (!best || box.width * box.height > best.width * best.height) best = box;
-  }
-  if (best) return best;
-  const scopes = [page, ...candidateFrames(page, provider)];
-  for (const scope of scopes) {
-    const local = scope.locator("[data-bw-captcha], #bw-captcha, .bw-captcha").first();
-    const localBox = await elementBoxInPage(page, scope, local);
-    if (localBox && localBox.width >= 80 && localBox.height >= 80) return localBox;
-  }
-  return null;
-}
-
-async function readChallengeInstruction(page, provider) {
-  const scopes = [page, ...candidateFrames(page, provider)];
-  for (const scope of scopes) {
-    for (const selector of CHALLENGE_INSTRUCTION_SELECTORS) {
-      const locator = scope.locator(selector).first();
-      const visible = await locator.isVisible({ timeout: 250 }).catch(() => false);
-      if (!visible) continue;
-      const text = String(await locator.innerText().catch(() => ""))
-        .replace(/\s+/g, " ")
-        .trim();
-      if (text.length >= 8 && text.length < 240) return text;
-    }
-  }
-  return null;
-}
-
-async function collectTilesFromSelector(page, scope, selector) {
-  const locators = scope.locator(selector);
-  const count = await locators.count().catch(() => 0);
-  if (count < 3) return [];
-  const found = [];
-  const limit = Math.min(count, 16);
-  for (let index = 0; index < limit; index += 1) {
-    const tile = locators.nth(index);
-    const visible = await tile.isVisible().catch(() => false);
-    if (!visible) continue;
-    const box = await elementBoxInPage(page, scope, tile);
-    if (!box) continue;
-    const label = await tile.getAttribute("aria-label").catch(() => null);
-    if (isCaptchaChromeLabel(label)) continue;
-    found.push({ box, label: label || null });
-  }
-  const clustered = clusterSimilarBoxes(found.map((entry) => entry.box));
-  if (clustered.length < 3) return [];
-  return clustered.map((bounds, index) => {
-    const match = found.find(
-      (entry) =>
-        Math.abs(entry.box.x - bounds.x) < 3 && Math.abs(entry.box.y - bounds.y) < 3,
-    );
-    return { index, bounds, label: match?.label || null };
-  });
-}
-
-async function collectClickableCluster(page, scope) {
-  const locators = scope.locator(
-    "button, [role='button'], [role='checkbox'], img, [class*='task']",
-  );
-  const count = Math.min(await locators.count().catch(() => 0), 40);
-  const found = [];
-  for (let index = 0; index < count; index += 1) {
-    const locator = locators.nth(index);
-    const visible = await locator.isVisible().catch(() => false);
-    if (!visible) continue;
-    const tag = await locator.evaluate((el) => el.tagName).catch(() => "");
-    if (String(tag).toUpperCase() === "CANVAS") continue;
-    const label = [
-      await locator.getAttribute("aria-label").catch(() => ""),
-      await locator.getAttribute("title").catch(() => ""),
-      await locator.innerText().catch(() => ""),
-    ]
-      .map((value) => String(value || "").trim())
-      .find(Boolean);
-    if (isCaptchaChromeLabel(label)) continue;
-    const box = await elementBoxInPage(page, scope, locator);
-    if (box) found.push({ box, label: label || null });
-  }
-  const clustered = clusterSimilarBoxes(found.map((entry) => entry.box));
-  return clustered.map((bounds, index) => {
-    const match = found.find(
-      (entry) =>
-        Math.abs(entry.box.x - bounds.x) < 3 && Math.abs(entry.box.y - bounds.y) < 3,
-    );
-    return { index, bounds, label: match?.label || null };
-  });
-}
-
-async function collectChallengeTiles(page, provider) {
-  const frames = candidateFrames(page, provider);
-  const scopes = frames.length ? [...frames, page] : [page];
-  const sets = [];
-  for (const scope of scopes) {
-    for (const selector of IMAGE_TILE_SELECTORS) {
-      const tiles = await collectTilesFromSelector(page, scope, selector);
-      if (tiles.length) sets.push(tiles);
-    }
-    const clickable = await collectClickableCluster(page, scope);
-    if (clickable.length) sets.push(clickable);
-  }
-  return pickBestTileSet(sets);
-}
-
-// Identifies the grid a numbered crop was taken from. Tile indexes only mean
-// something relative to the image the model looked at, so coordinates captured
-// for one challenge must never be replayed against another.
-function captchaGridSignature(tiles, scroll = { x: 0, y: 0 }) {
-  return tiles
-    .map((tile) => {
-      const box = tile.bounds || {};
-      return [
-        Math.round((box.x || 0) + scroll.x),
-        Math.round((box.y || 0) + scroll.y),
-        Math.round(box.width || 0),
-        Math.round(box.height || 0),
-      ].join(",");
-    })
-    .join("|");
-}
-
-function rememberCaptchaTiles(page, session, tiles, scroll) {
-  session.captchaTargets.clear();
-  for (const tile of tiles) {
-    session.captchaTargets.set(tile.index, {
-      bounds: tile.bounds,
-      pageBounds: {
-        ...tile.bounds,
-        x: tile.bounds.x + scroll.x,
-        y: tile.bounds.y + scroll.y,
-      },
-      label: tile.label || null,
-    });
-  }
-  session.captchaGrid = tiles.length
-    ? { url: page.url(), signature: captchaGridSignature(tiles, scroll) }
-    : null;
-}
-
-/**
- * True when the stored tile coordinates no longer describe what is on screen —
- * the page navigated, or the challenge swapped in a new grid. Clicking cached
- * boxes in that state hits the wrong tiles or unrelated controls, so callers
- * must recapture and let the model pick again rather than submit stale picks.
- */
-async function captchaTilesStale(page, session, provider) {
-  const stored = session.captchaGrid;
-  if (!stored) return true;
-  if (stored.url !== page.url()) return true;
-  const live = await collectChallengeTiles(page, provider).catch(() => []);
-  if (!live.length) return true;
-  const scroll = await pageScrollMetrics(page);
-  return captchaGridSignature(live, scroll) !== stored.signature;
-}
-
-function clipForPuzzle(tileBoxes, widgetBox, viewport) {
-  if (
-    widgetBox &&
-    widgetBox.width >= 80 &&
-    widgetBox.height >= 80 &&
-    widgetBox.width <= 760 &&
-    widgetBox.height <= 900
-  ) {
-    return unionClip([widgetBox], { pad: 8, promptPad: 0, viewport });
-  }
-  return unionClip(tileBoxes, { pad: 10, promptPad: 80, viewport });
-}
-
-async function capturePuzzleScreenshot(page, session, name, clip, extra: any = {}) {
-  const options = {
-    type: "png",
-    animations: extra.animations ?? "disabled",
-    timeout: CAPTCHA_SCREENSHOT_TIMEOUT_MS,
-  };
-  try {
-    return await captureScreenshot(
-      page,
-      session,
-      name,
-      name,
-      clip ? { ...options, clip } : options,
-    );
-  } catch {
-    return captureScreenshot(page, session, name, name, options);
-  }
-}
-
-async function captureTiles(page, session, provider) {
-  const tiles = await collectChallengeTiles(page, provider);
-  const scroll = await pageScrollMetrics(page);
-  rememberCaptchaTiles(page, session, tiles, scroll);
-  const widgetBox = await challengeWidgetBox(page, provider);
-  const viewport = page.viewportSize();
-  const clip = tiles.length
-    ? clipForPuzzle(
-        tiles.map((tile) => tile.bounds),
-        widgetBox,
-        viewport,
-      )
-    : widgetBox
-      ? unionClip([widgetBox], { pad: 8, promptPad: 0, viewport })
-      : null;
-  let overlayDrawn = false;
-  if (tiles.length) {
-    try {
-      await page.evaluate(drawCaptchaTileOverlay, {
-        tiles,
-        overlayId: CAPTCHA_TILE_OVERLAY_ID,
-      });
-      overlayDrawn = true;
-    } catch {
-      overlayDrawn = false;
-    }
-  }
-  let file;
-  try {
-    file = await capturePuzzleScreenshot(page, session, "captcha-grid.png", clip);
-  } finally {
-    if (overlayDrawn) {
-      await page
-        .evaluate(removeAnnotationOverlay, CAPTCHA_TILE_OVERLAY_ID)
-        .catch(() => {});
-    }
-  }
-  const artifact = { kind: "captcha", path: file, media: `MEDIA:${file}` };
-  session.artifacts.push(artifact);
-  const prompt = await readChallengeInstruction(page, provider);
-  const grid = gridFromTiles(tiles);
-  return {
-    tiles,
-    artifact,
-    grid,
-    prompt,
-    instruction: visionGridInstruction({
-      prompt,
-      grid,
-      tileCount: tiles.length,
-    }),
-  };
-}
-
-async function clickStoredTiles(page, session, indexes) {
-  if (!session.captchaTargets.size) return { ok: false, reason: "tiles_not_captured" };
-  const scopes = [page, ...page.frames().filter((frame) => frame !== page.mainFrame()).slice(0, 8)];
-  const previousLabel = await recaptchaVerifyButtonLabel(scopes);
-  const hadSelection = await anyScopeHasSelectedCaptchaTiles(scopes);
-  const clicked = [];
-  for (const index of indexes) {
-    const tile = session.captchaTargets.get(index);
-    if (!tile?.bounds) continue;
-    const visibleBounds = await captchaBoxInViewport(
-      page,
-      tile.pageBounds || tile.bounds,
-      Boolean(tile.pageBounds),
-    );
-    await humanClickBox(page, session, visibleBounds, { leftBias: false });
-    clicked.push(index);
-    await hostDelay(70 + Math.random() * 140);
-  }
-  if (!clicked.length) return { ok: false, reason: "tiles_not_found" };
-  // The Skip/Verify label flips only after the last tile click lands.
-  const verify = await waitForVerifyControl(page, scopes, 2_500, {
-    previousLabel,
-    hadSelection,
-  });
-  if (!verify) {
-    return { ok: true, clicked, verified: false, reason: "verify_not_ready" };
-  }
-  await hostDelay(80 + Math.random() * 120);
-  await humanClickBox(page, session, verify.box, { leftBias: false });
-  return { ok: true, clicked, verified: true, label: verify.label || null };
-}
-
-async function dragSliderOnPage(page, session, provider) {
-  const scopes = [page, ...candidateFrames(page, provider)];
-  const found = await findClickableInScopes(page, scopes, SLIDER_SELECTORS);
-  if (!found) return { ok: false, reason: "slider_not_found" };
-  const { box } = found;
-  const start = {
-    x: Math.round(box.x + box.width * 0.5),
-    y: Math.round(box.y + box.height * 0.5),
-  };
-  // Prefer the track width when the handle is small; drag most of the way across.
-  const trackWidth = Math.max(box.width * 4, 220);
-  const end = {
-    x: Math.round(start.x + trackWidth * (0.82 + Math.random() * 0.1)),
-    y: Math.round(start.y + (Math.random() - 0.5) * 4),
-  };
-  await movePointer(page.mouse, session.cursor, start, { stepDivisor: 8 });
-  await hostDelay(100 + Math.random() * 120);
-  await page.mouse.down();
-  await hostDelay(80 + Math.random() * 100);
-  await movePointer(page.mouse, session.cursor, end, {
-    stepDivisor: Math.max(3, Math.hypot(end.x - start.x, end.y - start.y) / 24),
-  });
-  await hostDelay(80 + Math.random() * 120);
-  await page.mouse.up();
-  return { ok: true, from: start, to: end };
-}
-
-function sampleCanvasRgbaInPage(canvas, maxWidth) {
-  if (!canvas || canvas.width < 16 || canvas.height < 16) return null;
-  const scale = Math.min(1, maxWidth / canvas.width);
-  const width = Math.max(8, Math.round(canvas.width * scale));
-  const height = Math.max(8, Math.round(canvas.height * scale));
-  const copy = document.createElement("canvas");
-  copy.width = width;
-  copy.height = height;
-  const ctx = copy.getContext("2d");
-  if (!ctx) return null;
-  try {
-    ctx.drawImage(canvas, 0, 0, width, height);
-  } catch {
-    return null;
-  }
-  const img = ctx.getImageData(0, 0, width, height);
-  let dark = 0;
-  for (let i = 0; i < img.data.length; i += 16) {
-    if (0.299 * img.data[i] + 0.587 * img.data[i + 1] + 0.114 * img.data[i + 2] < 110) {
-      dark += 1;
-    }
-  }
-  if (dark < 3) return null;
-  return { width, height, data: Array.from(img.data) };
-}
-
-async function sampleCanvasRgba(scope) {
-  const locator = scope.locator("canvas").first();
-  const handle = await locator.elementHandle({ timeout: 800 }).catch(() => null);
-  if (!handle) return null;
-  try {
-    const box = await handle.boundingBox();
-    const image = await handle
-      .evaluate(sampleCanvasRgbaInPage, 200)
-      .catch(() => null);
-    if (!image || !box || box.width < 16 || box.height < 16) return null;
-    return { image, box };
-  } finally {
-    await handle.dispose().catch(() => {});
-  }
-}
-
-async function decodePngRgba(page, buffer, maxWidth = 220) {
-  const b64 = Buffer.from(buffer).toString("base64");
-  return page.evaluate(
-    async ({ b64, maxWidth }) => {
-      const img = new Image();
-      img.src = `data:image/png;base64,${b64}`;
-      await img.decode();
-      const scale = Math.min(1, maxWidth / img.naturalWidth);
-      const width = Math.max(8, Math.round(img.naturalWidth * scale));
-      const height = Math.max(8, Math.round(img.naturalHeight * scale));
-      const copy = document.createElement("canvas");
-      copy.width = width;
-      copy.height = height;
-      const ctx = copy.getContext("2d");
-      if (!ctx) return null;
-      ctx.drawImage(img, 0, 0, width, height);
-      const pixels = ctx.getImageData(0, 0, width, height);
-      return { width, height, data: Array.from(pixels.data) };
-    },
-    { b64, maxWidth },
-  );
-}
-
-async function screenshotRgba(page, session, clip) {
-  const file = await capturePuzzleScreenshot(
-    page,
-    session,
-    "captcha-motion-frame.png",
-    clip,
-    { animations: "allow" },
-  );
-  const buffer = fs.readFileSync(file);
-  const image = await decodePngRgba(page, buffer);
-  return { image, box: clip, file };
-}
-
-function bestGrownFromSamples(samples, options) {
-  let best = null;
-  for (let i = 0; i < samples.length; i += 1) {
-    for (let j = i + 1; j < samples.length; j += 1) {
-      const grown = findGrowingRegion(samples[i].image, samples[j].image, options);
-      if (!grown) continue;
-      if (!best || grown.score > best.grown.score) {
-        best = { grown, sample: samples[j] };
-      }
-    }
-  }
-  return best;
-}
-
-async function locateGrowingRegion(page, session, provider) {
-  const scopes = [...candidateFrames(page, provider), page];
-  for (const scope of scopes) {
-    const samples = [];
-    for (let i = 0; i < 3; i += 1) {
-      if (i > 0) await hostDelay(420);
-      const sample = await sampleCanvasRgba(scope);
-      if (sample) samples.push(sample);
-    }
-    const picked = bestGrownFromSamples(samples, { topInset: 0, bottomInset: 0 });
-    if (picked?.grown) {
-      return {
-        bounds: blobToPageBounds(picked.grown, picked.sample.image, picked.sample.box),
-        score: picked.grown.score,
-        confidence: picked.grown.confidence,
-        source: "canvas",
-      };
-    }
-  }
-  const widgetBox = await challengeWidgetBox(page, provider);
-  const clip = widgetBox
-    ? unionClip([widgetBox], {
-        pad: 8,
-        promptPad: 0,
-        viewport: page.viewportSize(),
-      })
-    : null;
-  if (!clip) return null;
-  const shots = [];
-  for (let i = 0; i < 3; i += 1) {
-    if (i > 0) await hostDelay(420);
-    const shot = await screenshotRgba(page, session, clip);
-    if (shot?.image) shots.push(shot);
-  }
-  const picked = bestGrownFromSamples(shots, { topInset: 0.12, bottomInset: 0.18 });
-  if (!picked?.grown) return null;
-  return {
-    bounds: blobToPageBounds(picked.grown, picked.sample.image, picked.sample.box),
-    score: picked.grown.score,
-    confidence: picked.grown.confidence,
-    source: "screenshot",
-    artifact: picked.sample.file,
-  };
-}
-
-async function confirmMotionSelection(page, session, provider) {
-  const frames = candidateFrames(page, provider);
-  const found = await findClickableInScopes(
-    page,
-    frames,
-    MOTION_CONFIRM_SELECTORS,
-  );
-  if (!found) return false;
-  await humanClickBox(page, session, found.box, { leftBias: false });
-  return true;
-}
-
-async function dragFitOnPage(page, session, provider) {
-  const scopes = [...candidateFrames(page, provider), page];
-  for (const scope of scopes) {
-    const sample = await sampleCanvasRgba(scope);
-    if (!sample) continue;
-    const pair = pickDragFitPair(extractDarkBlobs(sample.image));
-    if (!pair) continue;
-    const from = blobToPageBounds(pair.piece, sample.image, sample.box, 4);
-    const to = blobToPageBounds(pair.hole, sample.image, sample.box, 4);
-    await movePointer(
-      page.mouse,
-      session.cursor,
-      { x: from.cx, y: from.cy },
-      { stepDivisor: 8 },
-    );
-    await hostDelay(90 + Math.random() * 120);
-    await page.mouse.down();
-    await hostDelay(70 + Math.random() * 90);
-    await movePointer(
-      page.mouse,
-      session.cursor,
-      { x: to.cx, y: to.cy },
-      {
-        stepDivisor: Math.max(
-          3,
-          Math.hypot(to.cx - from.cx, to.cy - from.cy) / 22,
-        ),
-      },
-    );
-    await hostDelay(80 + Math.random() * 100);
-    await page.mouse.up();
-    return { ok: true, from, to, source: "canvas" };
-  }
-  return { ok: false, reason: "drag_fit_not_found" };
-}
-
-async function runCaptchaSolveAction(
-  page,
-  session,
-  classification,
-  action,
-): Promise<any> {
-  const provider = classification.provider;
-  const scopes = [page, ...candidateFrames(page, provider)];
-  switch (action.action) {
-    case "click_checkbox": {
-      // Prefer real checkbox/controls; never fall through to a bare `body` hit
-      // when a verify button is available (managed / generic widgets).
-      // The widget's own control first, then the widget itself, and only then
-      // generic page buttons. Order matters: VERIFY_BUTTON_SELECTORS ends in
-      // `button[type='submit']`, which on a demo or login page is the host
-      // form's own button. Reaching that before the widget submits the form
-      // unsolved while the attempt log still claims a successful click.
-      const preferred = CHECKBOX_SELECTORS.filter((selector) => selector !== "body");
-      let found = await findClickableInScopes(page, scopes, preferred);
-      if (!found) {
-        // Turnstile mounts its iframe in a CLOSED shadow root, so neither the
-        // DOM nor a Playwright selector can see it. The frame stays attached
-        // and its frame element still reports real page geometry, which is the
-        // only remaining way to reach the checkbox.
-        const frameBox = await widgetFrameBox(page, provider);
-        if (frameBox) {
-          const point = await humanClickBox(page, session, frameBox, { leftBias: true });
-          return { ok: true, point, target: "frame_element" };
-        }
-        // Widget iframes that are visible in the DOM. Every pattern has to name
-        // a challenge: a bare `title*="widget"` also matches ordinary site
-        // furniture such as chat launchers, and clicking one of those reports a
-        // solve while opening a support window.
-        const iframe = page
-          .locator(
-            'iframe[src*="recaptcha" i], iframe[src*="hcaptcha" i], iframe[src*="turnstile" i], iframe[src*="challenges.cloudflare" i], iframe[title*="captcha" i], iframe[title*="challenge" i], iframe[title*="verification" i], iframe[title*="security check" i]',
-          )
-          .first();
-        // Bounded: an unmatched locator otherwise blocks for Playwright's 30s
-        // default, which is the whole solve budget spent before the first click.
-        const box = await iframe.boundingBox({ timeout: 800 }).catch(() => null);
-        if (box) {
-          const point = await humanClickBox(page, session, box, { leftBias: true });
-          return { ok: true, point, target: "iframe" };
-        }
-        // The widget container itself, for challenges that render inline rather
-        // than in a frame. Still ahead of the generic buttons below.
-        const inlineBox = await challengeWidgetClickBox(page, provider);
-        if (inlineBox) {
-          const point = await humanClickBox(page, session, inlineBox, { leftBias: true });
-          return { ok: true, point, target: "widget" };
-        }
-        found = await findVerifyControl(page, scopes);
-        if (!found) return { ok: false, reason: "checkbox_not_found" };
-        const verifyPoint = await humanClickBox(page, session, found.box, {
-          leftBias: found.box.width > 80,
-        });
-        return {
-          ok: true,
-          point: verifyPoint,
-          target: "verify_button",
-          selector: found.selector || null,
-        };
-      }
-      const point = await humanClickBox(page, session, found.box, {
-        leftBias: found.box.width > 80,
-      });
-      return { ok: true, point, target: "checkbox", selector: found.selector || null };
-    }
-    case "click_verify": {
-      // Challenge-frame controls first so a host-page Submit cannot steal the
-      // click. Next is how hCaptcha confirms a motion-target selection.
-      const frames = candidateFrames(page, provider);
-      const found =
-        (await findVerifyControl(page, [...frames, page])) ||
-        (await findClickableInScopes(page, [...frames, page], CHECKBOX_SELECTORS));
-      if (!found) return { ok: false, reason: "verify_control_not_found", soft: true };
-      const point = await humanClickBox(page, session, found.box, {
-        leftBias: false,
-      });
-      return { ok: true, point, target: "verify" };
-    }
-    case "drag_slider": {
-      const slider = await dragSliderOnPage(page, session, provider);
-      if (slider.ok) return slider;
-      const fit = await dragFitOnPage(page, session, provider);
-      if (fit.ok) return fit;
-      return { ...slider, soft: true };
-    }
-    case "click_growing": {
-      const located = await locateGrowingRegion(page, session, provider);
-      if (!located?.bounds) {
-        return runCaptchaSolveAction(page, session, classification, {
-          action: "inspect",
-          waitMs: 0,
-          description: "Motion target was ambiguous; capture frames for host vision",
-        });
-      }
-      await humanClickBox(page, session, located.bounds, { leftBias: false });
-      await hostDelay(700 + Math.random() * 400);
-      const confirmed = await confirmMotionSelection(page, session, provider);
-      return {
-        ok: true,
-        auto: true,
-        confirmed,
-        target: located,
-        source: located.source,
-      };
-    }
-    case "capture_tiles": {
-      const captured = await captureTiles(page, session, provider);
-      return {
-        ok: true,
-        needsVision: true,
-        tiles: captured.tiles,
-        artifact: captured.artifact,
-        grid: captured.grid,
-        instruction: captured.instruction,
-      };
-    }
-    case "capture_text": {
-      const widgetBox = await challengeWidgetBox(page, provider);
-      const file = await capturePuzzleScreenshot(
-        page,
-        session,
-        "captcha-text.png",
-        widgetBox
-          ? unionClip([widgetBox], {
-              pad: 8,
-              promptPad: 0,
-              viewport: page.viewportSize(),
-            })
-          : null,
-      );
-      const artifact = { kind: "captcha", path: file, media: `MEDIA:${file}` };
-      session.artifacts.push(artifact);
-      return {
-        ok: true,
-        needsVision: true,
-        artifact,
-        instruction: "Read the attached CAPTCHA crop and type the text into the challenge input.",
-      };
-    }
-    case "wait_token":
-    case "wait_clear":
-      return { ok: true, waited: true };
-    case "inspect": {
-      const widgetBox = await challengeWidgetBox(page, provider);
-      const clip = widgetBox
-        ? unionClip([widgetBox], {
-            pad: 8,
-            promptPad: 0,
-            viewport: page.viewportSize(),
-          })
-        : null;
-      const file = await capturePuzzleScreenshot(
-        page,
-        session,
-        "captcha-challenge.png",
-        clip,
-        { animations: "allow" },
-      );
-      const artifact = { kind: "captcha", path: file, media: `MEDIA:${file}` };
-      session.artifacts.push(artifact);
-      await hostDelay(450);
-      let artifact2 = null;
-      try {
-        const file2 = await capturePuzzleScreenshot(
-          page,
-          session,
-          "captcha-challenge-b.png",
-          clip,
-          { animations: "allow" },
-        );
-        artifact2 = { kind: "captcha", path: file2, media: `MEDIA:${file2}` };
-        session.artifacts.push(artifact2);
-      } catch {
-        artifact2 = null;
-      }
-      return {
-        ok: true,
-        needsVision: true,
-        artifact,
-        artifact2,
-        instruction:
-          "Compare the two attached frames and click the shape that grew, then call captcha.solve() again so Next can confirm. This is not a numbered image grid.",
-      };
+      return;
     }
-    default:
-      return { ok: false, reason: `unknown_action:${action.action}` };
+    const pendingCredential = recoveryFromError(error, session);
+    const restartWorker = secretCapacityRequiresRestart(error);
+    const failureFields = {
+      firstEvent,
+      pages: [],
+      ok: false,
+      error: redactText(error?.message || String(error)),
+      restartWorker,
+    };
+    sendResult(
+      await buildEnvelope(
+        session,
+        message,
+        started,
+        pendingCredential
+          ? { ...failureFields, pendingCredential }
+          : failureFields,
+      ),
+    );
+  } finally {
+    stampModelActivity(session);
+    endExecutionFor(session.id);
+    quietSessionPages(session);
+    session.execution = { requestId: null, pendingRecovery: null, generationStarted: false };
   }
 }
 
-async function detectCaptchaOnPage(page) {
-  const metadata = await collectChallengeMetadata(page);
-  const challenge = detectBotChallenge(metadata);
-  const classification = classifyChallengeStage({
-    ...metadata,
-    provider: challenge?.provider,
-    type: challenge?.type,
-  });
-  const widgets = [];
-  const childFrames = page.frames().filter((frame) => frame !== page.mainFrame());
-  for (const [index, frame] of childFrames.entries()) {
-    if (metadata.frames[index]?.visible === false) continue;
-    const url = frame.url() || "";
-    for (const [provider, pattern] of Object.entries(WIDGET_FRAME_PATTERNS)) {
-      if (pattern.test(url)) {
-        widgets.push({ provider, url, kind: "frame" });
-        break;
-      }
-    }
-  }
-  // Local fixtures may expose data-bw-captcha without provider frames.
-  const localWidget = await page
-    .locator("[data-bw-captcha], #bw-captcha, .bw-captcha")
-    .count()
-    .then((count) => count > 0)
-    .catch(() => false);
-  if (localWidget) {
-    widgets.push({ provider: "generic", url: page.url(), kind: "local" });
+// Dedicated trusted host path for finalizing or discarding a staged generated
+// credential after the caller has verified the visible browser outcome.
+async function credentialPending(message) {
+  if (cookieSyncActive) {
+    cookieSyncBusyResult(message);
+    return;
   }
-  return {
-    present: Boolean(challenge) || widgets.length > 0 || classification.stage !== CAPTCHA_STAGES.NONE,
-    challenge: challenge || null,
-    classification,
-    widgets,
-    tokens: metadata.tokens,
-    cleared: Object.keys(metadata.tokens).length > 0,
-    url: page.url(),
-  };
-}
-
-async function solveCaptchaOnPage(page, session, options: any = {}) {
-  const started = Date.now();
-  const timeoutMs = solveTimeoutMs(options);
-  const maxStages = maxAutoStages(options);
-  const attempts = [];
-  const requestId = `bw_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
-
-  let lastClassification = null;
-  let lastChallenge = null;
-  let lastArtifact = null;
-  let lastTiles = null;
-  let lastInstruction = null;
-  let lastGrid = null;
-  let pendingTiles = parseTileIndexes(options?.tiles ?? options?.indexes);
-
-  for (let stageIndex = 0; stageIndex < maxStages; stageIndex += 1) {
-    if (Date.now() - started > timeoutMs) {
-      return buildSolveResult({
-        status: CAPTCHA_SOLVE_STATUSES.ERROR,
-        requestId,
-        provider: lastClassification?.provider || "generic",
-        stage: lastClassification?.stage || CAPTCHA_STAGES.UNKNOWN,
-        errorCode: "ERROR_TIMEOUT",
-        errorText: `CAPTCHA solve timed out after ${timeoutMs}ms`,
-        attempts,
-        artifact: lastArtifact,
-        tiles: lastTiles,
-        grid: lastGrid,
-        instruction: lastInstruction,
-        challenge: lastChallenge,
-      });
-    }
-
-    const metadata = await collectChallengeMetadata(page);
-    if (Object.keys(metadata.tokens).length) {
-      const provider = Object.keys(metadata.tokens)[0];
-      return buildSolveResult({
-        status: CAPTCHA_SOLVE_STATUSES.READY,
-        requestId,
-        provider,
-        stage: CAPTCHA_STAGES.NONE,
-        token: metadata.tokens[provider],
-        attempts,
-        cleared: true,
-        challenge: lastChallenge,
-      });
-    }
-
-    const challenge = detectBotChallenge(metadata);
-    lastChallenge = challenge;
-    const classification = classifyChallengeStage({
-      ...metadata,
-      provider: challenge?.provider,
-      type: challenge?.type,
-    });
-    lastClassification = classification;
-
-    // Local fixture widgets without provider frames.
-    if (classification.stage === CAPTCHA_STAGES.NONE) {
-      const local = await page
-        .locator("[data-bw-captcha], #bw-captcha, .bw-captcha")
-        .first()
-        .isVisible()
-        .catch(() => false);
-      if (!local) {
-        // No challenge visible — treat as cleared.
-        return buildSolveResult({
-          status: CAPTCHA_SOLVE_STATUSES.READY,
-          requestId,
-          provider: "generic",
-          stage: CAPTCHA_STAGES.NONE,
-          attempts,
-          cleared: true,
-          challenge: null,
-        });
-      }
-      lastClassification = {
-        stage: CAPTCHA_STAGES.CHECKBOX,
-        provider: "generic",
-        autoSolvable: true,
-        needsVision: false,
-      };
-      const kind = await page
-        .locator("[data-bw-captcha], #bw-captcha, .bw-captcha")
-        .first()
-        .getAttribute("data-bw-captcha")
-        .catch(() => "");
-      if (kind === "grid") {
-        lastClassification = {
-          stage: CAPTCHA_STAGES.IMAGE_GRID,
-          provider: "generic",
-          autoSolvable: false,
-          needsVision: true,
-        };
-      } else if (kind === "slider") {
-        lastClassification = {
-          stage: CAPTCHA_STAGES.SLIDER,
-          provider: "generic",
-          autoSolvable: true,
-          needsVision: false,
-        };
-      } else if (kind === "motion") {
-        lastClassification = {
-          stage: CAPTCHA_STAGES.MOTION,
-          provider: "generic",
-          autoSolvable: true,
-          needsVision: false,
-        };
-      } else if (kind === "drag") {
-        lastClassification = {
-          stage: CAPTCHA_STAGES.SLIDER,
-          provider: "generic",
-          autoSolvable: true,
-          needsVision: false,
-        };
-      }
-    }
-
-    if (pendingTiles.length && lastClassification.stage === CAPTCHA_STAGES.IMAGE_GRID) {
-      // Tile indexes describe the numbered crop the caller looked at. If that
-      // grid is gone, recapture and ask for fresh picks: replaying the old
-      // coordinates would click the wrong tiles and then submit Verify.
-      const stale =
-        !session.captchaTargets.size ||
-        (await captchaTilesStale(page, session, lastClassification.provider));
-      if (stale) {
-        const captured = await captureTiles(page, session, lastClassification.provider);
-        lastArtifact = captured.artifact;
-        lastTiles = captured.tiles;
-        lastGrid = captured.grid;
-        lastInstruction = captured.instruction;
-        pendingTiles = [];
-        attempts.push({
-          stageIndex,
-          stage: lastClassification.stage,
-          provider: lastClassification.provider,
-          action: "recapture_tiles",
-          description: "The numbered grid changed; captured a fresh crop for new picks",
-          ok: true,
-          reason: "grid_changed",
-          atMs: Date.now() - started,
-        });
-        return buildSolveResult({
-          status: CAPTCHA_SOLVE_STATUSES.PROCESSING,
-          requestId,
-          provider: lastClassification.provider,
-          stage: lastClassification.stage,
-          attempts,
-          artifact: lastArtifact,
-          tiles: lastTiles,
-          grid: lastGrid,
-          instruction:
-            lastInstruction ||
-            "The captcha grid changed. Open the attached numbered crop, pick matching tile indexes, then call captcha.solve({ tiles: [indexes] }).",
-          challenge: lastChallenge,
-        });
-      }
-      const outcome = await clickStoredTiles(page, session, pendingTiles);
-      const applied = pendingTiles;
-      pendingTiles = [];
-      attempts.push({
-        stageIndex,
-        stage: lastClassification.stage,
-        provider: lastClassification.provider,
-        action: "click_tiles",
-        description: `Click numbered tiles ${applied.join(", ")} and verify`,
-        ok: Boolean(outcome.ok),
-        reason: outcome.reason || null,
-        atMs: Date.now() - started,
-      });
-      if (!outcome.ok) {
-        return buildSolveResult({
-          status: CAPTCHA_SOLVE_STATUSES.ERROR,
-          requestId,
-          provider: lastClassification.provider,
-          stage: lastClassification.stage,
-          errorCode: "ERROR_ACTION_FAILED",
-          errorText: outcome.reason || "CAPTCHA tile click failed",
-          attempts,
-          artifact: lastArtifact,
-          tiles: lastTiles,
-          grid: lastGrid,
-          instruction: lastInstruction,
-          challenge: lastChallenge,
-        });
-      }
-      await hostDelay(1_600 + Math.random() * 900);
-      const afterTiles = await challengeStillPresent(page, lastClassification.provider);
-      if (!afterTiles.present) {
-        const provider =
-          Object.keys(afterTiles.metadata.tokens || {})[0] || lastClassification.provider;
-        return buildSolveResult({
-          status: CAPTCHA_SOLVE_STATUSES.READY,
-          requestId,
-          provider,
-          stage: lastClassification.stage,
-          token: afterTiles.metadata.tokens?.[provider] || null,
-          attempts,
-          cleared: true,
-          challenge: lastChallenge,
-        });
-      }
-      continue;
+  const started = performance.now();
+  const session = sessionFor(message.sessionId);
+  session.awaitingAnswerSince = null;
+  const firstEvent = session.events.length;
+  beginExecutionFor(session.id);
+  try {
+    assertRedactionCapacity();
+    const action = String(message.action || "");
+    if (!new Set(["list", "commit", "discard"]).has(action)) {
+      throw new Error("pending credential action must be list, commit, or discard.");
     }
-
-    let action = nextSolveAction(lastClassification, stageIndex);
-    if (lastClassification.stage === CAPTCHA_STAGES.MOTION) {
-      const frames = candidateFrames(page, lastClassification.provider);
-      const confirm = await findClickableInScopes(page, frames, [
-        ":text-is('Next')",
-        "button:has-text('Next')",
-        "[role='button']:has-text('Next')",
-      ]);
-      if (confirm) {
-        action = {
-          action: "click_verify",
-          waitMs: 2_000,
-          description: "Confirm the selected motion target",
-        };
+    await ensureBrowser(message.config);
+    await wakeSessionPages(session);
+    await ensureSessionPage(session);
+    let publicResult;
+    if (action === "list") {
+      const response = await vaultCall(session, "list-pending", {});
+      publicResult = response.pendingCredentials || [];
+    } else {
+      const pendingId = String(message.payload?.pendingId ?? "").trim();
+      if (!pendingId) {
+        throw new Error(
+          "pending credential action requires a non-empty pendingId.",
+        );
       }
+      const response = await finalizePendingCredential(
+        session,
+        action,
+        pendingId,
+        String(message.payload?.pendingOrigin ?? "").trim(),
+      );
+      const { secret: _secret, ...result } = response || {};
+      publicResult = result;
     }
-    const outcome = await runCaptchaSolveAction(
-      page,
-      session,
-      lastClassification,
-      action,
+    assertRedactionCapacity();
+    sendResult(
+      await buildEnvelope(session, message, started, {
+        firstEvent,
+        drainSessionWarnings: true,
+        ok: true,
+        result: redactDeep(publicResult),
+      }),
     );
-    attempts.push({
-      stageIndex,
-      stage: lastClassification.stage,
-      provider: lastClassification.provider,
-      action: action.action,
-      description: action.description,
-      ok: Boolean(outcome.ok),
-      reason: outcome.reason || null,
-      // Which control the action actually hit. Without this a click on the
-      // wrong element is indistinguishable from a click on the widget.
-      target: outcome.target || null,
-      selector: outcome.selector || null,
-      atMs: Date.now() - started,
-    });
-
-    if (outcome.artifact) lastArtifact = outcome.artifact;
-    if (outcome.tiles) lastTiles = outcome.tiles;
-    if (outcome.instruction) lastInstruction = outcome.instruction;
-    if (outcome.grid) lastGrid = outcome.grid;
-
-    if (outcome.needsVision) {
-      return buildSolveResult({
-        status: CAPTCHA_SOLVE_STATUSES.PROCESSING,
-        requestId,
-        provider: lastClassification.provider,
-        stage: lastClassification.stage,
-        attempts,
-        artifact: lastArtifact,
-        tiles: lastTiles,
-        grid: lastGrid,
-        instruction:
-          lastInstruction ||
-          "Open the attached numbered captcha crop, pick matching tile indexes, then call captcha.solve({ tiles: [indexes] }).",
-        challenge: lastChallenge,
-      });
-    }
-
-    if (!outcome.ok && !outcome.soft) {
-      // Soft failures (e.g. verify button absent on managed challenge) still wait.
-      if (stageIndex === maxStages - 1) {
-        return buildSolveResult({
-          status: CAPTCHA_SOLVE_STATUSES.ERROR,
-          requestId,
-          provider: lastClassification.provider,
-          stage: lastClassification.stage,
-          errorCode: "ERROR_ACTION_FAILED",
-          errorText: outcome.reason || "CAPTCHA action failed",
-          attempts,
-          artifact: lastArtifact,
-          challenge: lastChallenge,
-        });
-      }
-    }
-
-    if (action.waitMs > 0) {
-      await hostDelay(action.waitMs);
-    }
-
-    const after = await challengeStillPresent(page, lastClassification.provider);
-    if (!after.present) {
-      const provider =
-        Object.keys(after.metadata.tokens || {})[0] || lastClassification.provider;
-      return buildSolveResult({
-        status: CAPTCHA_SOLVE_STATUSES.READY,
-        requestId,
-        provider,
-        stage: lastClassification.stage,
-        token: after.metadata.tokens?.[provider] || null,
-        attempts,
-        cleared: true,
-        challenge: lastChallenge,
-      });
+  } catch (error) {
+    if (redactionCapacityExceeded) {
+      sendRedactionCapacityFailure(message);
+      return;
     }
+    const restartWorker = secretCapacityRequiresRestart(error);
+    sendResult(
+      await buildEnvelope(session, message, started, {
+        firstEvent,
+        pages: [],
+        ok: false,
+        error: redactText(error?.message || String(error)),
+        restartWorker,
+      }),
+    );
+  } finally {
+    endExecutionFor(session.id);
+    quietSessionPages(session);
   }
-
-  return buildSolveResult({
-    status: CAPTCHA_SOLVE_STATUSES.PROCESSING,
-    requestId,
-    provider: lastClassification?.provider || "generic",
-    stage: lastClassification?.stage || CAPTCHA_STAGES.UNKNOWN,
-    attempts,
-    artifact: lastArtifact,
-    tiles: lastTiles,
-    grid: lastGrid,
-    instruction:
-      lastInstruction ||
-      "Auto-solve stages exhausted. Inspect the page with captcha.inspect or hand off to a human.",
-    challenge: lastChallenge,
-    errorCode: null,
-    errorText: null,
-  });
 }
 
-function markChallengesForWorkerRestart(challenges) {
-  return challenges.map((challenge) => ({
-    ...challenge,
-    solve: {
-      ...challenge.solve,
-      resumeOnClear: false,
-      reopenRequired: true,
-    },
-    recovery: {
-      pagePreserved: false,
-      reopenUrl: challenge.url,
-    },
-    advice:
-      "A bot challenge was visible when the browser run had to be restarted, so " +
-      "this page cannot be preserved. In the next browser call, reopen the reported " +
-      "URL, inspect the attached challenge image and fresh snapshot, solve up to " +
-      "three distinct stages with the native CAPTCHA or human helpers, then resume " +
-      "the original task. Use a host web-research tool, first-party route, or human " +
-      "handoff if it remains unresolved.",
-  }));
+async function enforceArtifactQuota(session) {
+  pruneArtifactQuota(session);
 }
 
 function unhandledCredentialTaskError(error) {
@@ -6870,7 +2439,7 @@ async function execute(message) {
     generationStarted: false,
   };
   // Viewer status pill: the agent is driving for the duration of this execute.
-  liveView?.setAgentState("driving");
+  workerLiveView.setAgentState("driving");
   try {
     assertRedactionCapacity();
     await ensureBrowser(message.config);
@@ -7093,7 +2662,7 @@ async function execute(message) {
       holdsDownloadGate = false;
       downloadAllowHolders = Math.max(0, downloadAllowHolders - 1);
     }
-    liveView?.setAgentState("idle");
+    workerLiveView.setAgentState("idle");
     endExecutionFor(session.id);
     quietSessionPages(session);
     session.execution = { requestId: null, pendingRecovery: null, generationStarted: false };
@@ -7104,229 +2673,6 @@ async function execute(message) {
   }
 }
 
-// ---------------------------------------------------------------------------
-// Live view + human handoff (live-view.ts). These handlers run outside the
-// executeQueue on purpose: a viewer must attach, and a handoff must resolve,
-// while an execute is in flight — and a pending handoff must never block a
-// later execute.
-
-function liveViewPages() {
-  const entries = [];
-  for (const [sessionId, session] of sessions) {
-    for (const [id, page] of session.pages) {
-      if (page.isClosed()) continue;
-      entries.push({
-        id,
-        page,
-        sessionId,
-        active: session.currentId === id,
-      });
-    }
-  }
-  return entries;
-}
-
-let liveViewPreferredSession = "default";
-
-/** Tell a running live view to stream the agent's current tab when it changed. */
-function notifyLiveViewPreferred() {
-  try {
-    liveView?.followPreferred?.();
-  } catch {
-    /* live view must never break page adoption */
-  }
-}
-
-function ensureLiveView(preferredSessionId) {
-  liveViewPreferredSession = String(preferredSessionId || "default");
-  liveView ??= createLiveViewServer({
-    html: liveViewHtml,
-    loginHtml: liveViewLoginHtml,
-    listPages: liveViewPages,
-    preferredPage: () => {
-      const session = sessions.get(liveViewPreferredSession);
-      const page = session?.currentId ? session.pages.get(session.currentId) : null;
-      return page && !page.isClosed() ? page : null;
-    },
-    newCDPSession: (page) => browserContext.newCDPSession(page),
-    openPage: async () => {
-      // A human's + button opens the tab in the viewed session, through the
-      // same adoption path as agent pages — page limit, listeners, policy and
-      // parking behavior all apply identically. adoptPage signals a refused
-      // page (limit reached) by closing it; live-view surfaces that as a toast.
-      const session = sessionFor(liveViewPreferredSession);
-      const page = await browserContext.newPage();
-      return adoptPage(page, session.id);
-    },
-    onHumanActivity: (page) => {
-      const sessionId = pageToSession.get(page);
-      // Human input keeps the owning session warm exactly like model activity,
-      // so the idle reaper never closes tabs under a person's hands.
-      if (sessionId) sessionFor(sessionId);
-    },
-    log: (line) => process.stderr.write(`${line}\n`),
-  });
-  return liveView;
-}
-
-async function liveViewStart(message) {
-  try {
-    await ensureBrowser(message.config);
-    const options = isObjectValue(message.options) ? message.options : {};
-    const view = ensureLiveView(untrustedField(options, "session"));
-    // A viewer is about to watch these pages, so nothing may stay parked: the
-    // stream would show a still frame of a page whose script is switched off.
-    // `parkingEnabled` keeps them awake from here on while the view runs.
-    for (const session of sessions.values()) await wakeSessionPages(session);
-    const info = await view.start(options);
-    sendResult({ type: "result", id: message.id, ...info });
-  } catch (error) {
-    sendResult({
-      type: "result",
-      id: message.id,
-      ok: false,
-      error: redactText(error?.message || String(error)),
-    });
-  }
-}
-
-async function liveViewStop(message) {
-  try {
-    const view = liveView;
-    liveView = null;
-    await view?.stop();
-    sendResult({ type: "result", id: message.id, ok: true, running: false });
-  } catch (error) {
-    sendResult({
-      type: "result",
-      id: message.id,
-      ok: false,
-      error: redactText(error?.message || String(error)),
-    });
-  }
-}
-
-function liveViewStatus(message) {
-  const info = liveView ? liveView.status() : { ok: true, running: false };
-  sendResult({ type: "result", id: message.id, ...info });
-}
-
-async function handoffWait(message) {
-  const session = sessionFor(message.sessionId);
-  try {
-    if (!liveView?.running) {
-      throw new Error("Live view is not running; start it before requesting a handoff.");
-    }
-    // The reaper hold used by the ask flow: pages stay alive for the whole
-    // human turn even if it outlasts the idle timeout.
-    session.awaitingAnswerSince = Date.now();
-    const outcome = await liveView.beginHandoff(String(message.prompt || ""), {
-      timeoutMs: Math.max(Number(message.timeoutMs) || 0, 1_000),
-    });
-    sendResult({
-      type: "result",
-      id: message.id,
-      ok: true,
-      action: outcome.action,
-      note: redactText(outcome.note || ""),
-    });
-  } catch (error) {
-    sendResult({
-      type: "result",
-      id: message.id,
-      ok: false,
-      error: redactText(error?.message || String(error)),
-    });
-  } finally {
-    session.awaitingAnswerSince = null;
-  }
-}
-
-async function askWait(message) {
-  const session = sessionFor(message.sessionId);
-  try {
-    if (!liveView?.running) {
-      throw new Error("Live view is not running; start it before requesting an ask.");
-    }
-    session.awaitingAnswerSince = Date.now();
-    const options = Array.isArray(message.options) ? message.options : [];
-    const outcome = await liveView.beginAsk(String(message.question || ""), {
-      options,
-      timeoutMs: Math.max(Number(message.timeoutMs) || 0, 1_000),
-    });
-    sendResult({
-      type: "result",
-      id: message.id,
-      ok: true,
-      action: outcome.action,
-      answer: redactText(outcome.answer || ""),
-    });
-  } catch (error) {
-    sendResult({
-      type: "result",
-      id: message.id,
-      ok: false,
-      error: redactText(error?.message || String(error)),
-    });
-  } finally {
-    session.awaitingAnswerSince = null;
-  }
-}
-
-function liveViewChatPost(message) {
-  try {
-    if (!liveView?.running) {
-      sendResult({
-        type: "result",
-        id: message.id,
-        ok: false,
-        error: "Live view is not running.",
-      });
-      return;
-    }
-    const posted = liveView.postChat({
-      role: String(message.role || "agent"),
-      text: String(message.text || ""),
-      kind: message.kind ? String(message.kind) : undefined,
-    });
-    sendResult({
-      type: "result",
-      id: message.id,
-      ok: true,
-      message: posted,
-    });
-  } catch (error) {
-    sendResult({
-      type: "result",
-      id: message.id,
-      ok: false,
-      error: redactText(error?.message || String(error)),
-    });
-  }
-}
-
-function liveViewChatDrain(message) {
-  try {
-    const messages = liveView?.running ? liveView.drainHumanMessages() : [];
-    sendResult({
-      type: "result",
-      id: message.id,
-      ok: true,
-      messages: messages.map((item) => ({
-        text: redactText(item.text || ""),
-        at: item.at,
-      })),
-    });
-  } catch (error) {
-    sendResult({
-      type: "result",
-      id: message.id,
-      ok: false,
-      error: redactText(error?.message || String(error)),
-    });
-  }
-}
-
 function shutdown() {
   shutdownPromise ??= performShutdown();
   return shutdownPromise;
@@ -7342,14 +2688,12 @@ async function performShutdown() {
   const ephemeralProfileDir = profileLock?.ephemeral
     ? profileLock.profileDir
     : null;
-  const closingLiveView = liveView;
-  liveView = null;
   try {
     // Worker teardown (restart or host close) drops viewer sockets without
     // the terminal "bye": viewers reconnect, and if the host revives the
     // view in a replacement worker (same port + token) they resume
     // seamlessly. Only an explicit live_view_stop announces the end.
-    await closingLiveView?.stop({ notify: false });
+    await workerLiveView.stop({ notify: false });
   } catch {
     /* parent/process exit */
   }
@@ -7484,7 +2828,7 @@ const idleReaper = setInterval(() => {
   const cutoff = Date.now() - Math.max(timeout, 600_000);
   for (const [sessionId, session] of sessions) {
     if (session.lastActivity >= cutoff || sessionIsExecuting(sessionId) ||
-        ["starting", "active"].includes(sessionRecordings.get(sessionId)?.state))
+        sessionRecordingIsBusy(sessionId))
       continue;
     if (
       session.awaitingAnswerSince &&
diff --git a/tests/node/captcha-e2e.test.ts b/tests/node/captcha-e2e.test.ts
index a86665b..4269465 100644
--- a/tests/node/captcha-e2e.test.ts
+++ b/tests/node/captcha-e2e.test.ts
@@ -181,6 +181,50 @@ test(
   },
 );
 
+test("captcha.solve scrolls Verify into a short viewport before submitting picks", opts, async () => {
+  const server = await startFixtureServer();
+  try {
+    await withBrowser(async (bw) => {
+      const result = await bw.run(`
+        await page.setViewportSize({width:800,height:320});
+        await page.goto(${JSON.stringify(`${server.base}/grid`)}, {waitUntil:"domcontentloaded"});
+        // Keep the grid visible but force its separate submit control below the fold.
+        await page.locator('#verify').evaluate(button => button.style.marginTop = '400px');
+        const first = await captcha.solve({timeoutMs:15000,maxStages:1});
+        const picks = first.tiles.filter(tile => tile.label === 'traffic light').map(tile => tile.index);
+        const solved = await captcha.solve({tiles:picks,timeoutMs:15000,maxStages:1});
+        return {solved,token:await page.locator('[name="bw-captcha-response"]').inputValue()};
+      `);
+      assert.equal(result.ok, true, result.error);
+      assert.equal(result.result.solved.cleared, true);
+      assert.match(result.result.token, /^bw_grid_token_/);
+    });
+  } finally {
+    await server.close();
+  }
+});
+
+test("captcha.solve does not report a visible generic grid cleared after wrong picks", opts, async () => {
+  const server = await startFixtureServer();
+  try {
+    await withBrowser(async (bw) => {
+      const result = await bw.run(`
+        await page.goto(${JSON.stringify(`${server.base}/grid`)}, {waitUntil:"domcontentloaded"});
+        await captcha.solve({timeoutMs:15000,maxStages:1});
+        const solved = await captcha.solve({tiles:[1],timeoutMs:15000,maxStages:1});
+        return {solved,token:await page.locator('[name="bw-captcha-response"]').inputValue(),visible:await page.locator('#bw-captcha').isVisible()};
+      `);
+      assert.equal(result.ok, true, result.error);
+      assert.equal(result.result.visible, true);
+      assert.equal(result.result.token, "");
+      assert.equal(result.result.solved.status, "processing");
+      assert.notEqual(result.result.solved.cleared, true);
+    });
+  } finally {
+    await server.close();
+  }
+});
+
 test(
   "captcha.click activates an image-grid target in the native browser",
   opts,
diff --git a/tests/node/cli-help.test.ts b/tests/node/cli-help.test.ts
index a43804e..0d3e2a3 100644
--- a/tests/node/cli-help.test.ts
+++ b/tests/node/cli-help.test.ts
@@ -7,7 +7,6 @@
 // exit 0, and without side effects.
 
 import assert from "node:assert/strict";
-import { execFile } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -15,25 +14,9 @@ import test from "node:test";
 import { fileURLToPath } from "node:url";
 
 import { COMMAND_SUMMARIES, helpFor, MAIN_USAGE, wantsHelp } from "../../dist/src/cli-help.js";
+import { runCli } from "./helpers/cli.js";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
-const cli = path.join(root, "dist", "bin", "betterwright.js");
-
-function runCli(args, { timeout = 20_000, env = {}, entrypoint = cli } = {}) {
-  return new Promise<{ status: number | null; signal: NodeJS.Signals | null; stdout: string; stderr: string }>(resolve => {
-    const child = execFile(process.execPath, [entrypoint, ...args], {
-      cwd: root,
-      encoding: "utf8",
-      timeout,
-      killSignal: "SIGKILL",
-      env: { ...process.env, ...env },
-    }, (_error, stdout, stderr) => {
-      resolve({ status: child.exitCode, signal: child.signalCode, stdout, stderr });
-    });
-    // Close stdin so a command that reads it cannot wait for more input.
-    child.stdin?.end();
-  });
-}
 
 test("CLI test subprocesses close stdin and preserve nonzero exit output", async t => {
   const directory = fs.mkdtempSync(path.join(os.tmpdir(), "betterwright-cli-helper-"));
diff --git a/tests/node/cli-startup.test.ts b/tests/node/cli-startup.test.ts
index bb28783..d128a10 100644
--- a/tests/node/cli-startup.test.ts
+++ b/tests/node/cli-startup.test.ts
@@ -23,7 +23,12 @@ fs.writeFileSync(importGuard, String.raw`
 `);
 
 function runWithoutSetupModules(args: string[], model?: string) {
-  const env = { ...process.env };
+  // Failed model selection must not start a daemon or touch the user's profile.
+  const env: NodeJS.ProcessEnv = {
+    ...process.env,
+    BETTERWRIGHT_HOME: makeTempDir("betterwright-startup-home-"),
+    BETTERWRIGHT_NO_DAEMON: "1",
+  };
   delete env.OPENROUTER_API_KEY;
   delete env.BETTERWRIGHT_MODEL_BASE_URL;
   delete env.BETTERWRIGHT_MODEL_API_KEY;
diff --git a/tests/node/credential-fill.test.ts b/tests/node/credential-fill.test.ts
index d7853cc..b4c6cd9 100644
--- a/tests/node/credential-fill.test.ts
+++ b/tests/node/credential-fill.test.ts
@@ -187,10 +187,10 @@ test("explicit target origin validation preserves both document checks", async (
 
 async function fixtureServer() {
   const pages = new Map();
-  const server = http.createServer((request, response) => {
+  const server = http.createServer(async (request, response) => {
     response.setHeader("content-type", "text/html; charset=utf-8");
     const route = pages.get(new URL(request.url, "http://fixture").pathname);
-    const body = isCallable(route) ? route(request, response) : route;
+    const body = isCallable(route) ? await route(request, response) : route;
     if (!response.writableEnded) response.end(body ?? "not found");
   });
   server.listen(0, "127.0.0.1");
@@ -922,13 +922,19 @@ test("semantic credential detection and pending credential plumbing", opts, asyn
       <button type="submit">Create account</button>
     </form>`,
   );
+  frameServer.pages.set("/delayed-frame-login", async () => {
+    // Keep one form behind the parent's DOMContentLoaded event so the
+    // ambiguity assertion cannot accidentally exercise a partial frame tree.
+    await new Promise((resolve) => setTimeout(resolve, 500));
+    return frameServer.pages.get("/frame-login-2");
+  });
   server.pages.set(
     "/iframe-host",
     `<!doctype html><main>Host shell</main><iframe id="login-frame" src="${frameServer.origin}/frame-login"></iframe>`,
   );
   server.pages.set(
     "/iframe-ambiguous",
-    `<!doctype html><iframe src="${frameServer.origin}/frame-login"></iframe><iframe src="${frameServer.origin}/frame-login-2"></iframe>`,
+    `<!doctype html><iframe src="${frameServer.origin}/frame-login"></iframe><iframe src="${frameServer.origin}/delayed-frame-login"></iframe>`,
   );
   server.pages.set(
     "/iframe-signup-host",
@@ -971,8 +977,10 @@ test("semantic credential detection and pending credential plumbing", opts, asyn
     vault,
   });
   const visit = async (pathname) => {
+    // Credential assertions need the child documents too; the runtime defaults
+    // to DOMContentLoaded, which does not wait for iframe navigation.
     const result = await bw.run(
-      `await page.goto(${JSON.stringify(`${server.origin}${pathname}`)}); return page.url();`,
+      `await page.goto(${JSON.stringify(`${server.origin}${pathname}`)}, { waitUntil: "load" }); return page.url();`,
     );
     assert.equal(result.ok, true, result.error);
   };
diff --git a/tests/node/helpers/cli.ts b/tests/node/helpers/cli.ts
new file mode 100644
index 0000000..2f5d90d
--- /dev/null
+++ b/tests/node/helpers/cli.ts
@@ -0,0 +1,24 @@
+import { execFile } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../..");
+const cli = path.join(root, "dist", "bin", "betterwright.js");
+
+// Keep the test event loop free while waiting for the CLI. A synchronous child
+// wait can hang a parallel test worker on macOS, beyond the test's own timeout.
+export function runCli(args, { timeout = 20_000, env = {}, entrypoint = cli } = {}) {
+  return new Promise<{ status: number | null; signal: NodeJS.Signals | null; stdout: string; stderr: string }>(resolve => {
+    const child = execFile(process.execPath, [entrypoint, ...args], {
+      cwd: root,
+      encoding: "utf8",
+      timeout,
+      killSignal: "SIGKILL",
+      env: { ...process.env, ...env },
+    }, (_error, stdout, stderr) => {
+      resolve({ status: child.exitCode, signal: child.signalCode, stdout, stderr });
+    });
+    // Close stdin so a command that reads it cannot wait for more input.
+    child.stdin?.end();
+  });
+}
diff --git a/tests/node/model-selection-cli.test.ts b/tests/node/model-selection-cli.test.ts
index a7756bd..9aaf844 100644
--- a/tests/node/model-selection-cli.test.ts
+++ b/tests/node/model-selection-cli.test.ts
@@ -9,6 +9,7 @@ import {
   endpointDiscoverySources,
   endpointSourceName,
 } from "../../dist/src/agent.js";
+import { makeTempDir } from "./helpers/temp-dir.js";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
 const cli = path.join(root, "dist", "bin", "betterwright.js");
@@ -18,7 +19,14 @@ const cli = path.join(root, "dist", "bin", "betterwright.js");
 // oven-sh/bun#37849), which is what failed Worker copies in sync on 2.5.2.
 function runCli(args, envOverrides = {}, timeout = 20_000) {
   return new Promise<{ status: number | null; signal: NodeJS.Signals | null; stdout: string; stderr: string }>((resolve) => {
-    const env = { ...process.env, ...envOverrides };
+    // These commands inspect configuration or fail before browser work. Keep
+    // them independent of saved user settings and persistent session daemons.
+    const env: NodeJS.ProcessEnv = {
+      ...process.env,
+      BETTERWRIGHT_HOME: makeTempDir("betterwright-model-cli-"),
+      BETTERWRIGHT_NO_DAEMON: "1",
+      ...envOverrides,
+    };
     for (const [name, value] of Object.entries(envOverrides)) {
       if (value === undefined) delete env[name];
     }
diff --git a/tests/node/profiles.test.ts b/tests/node/profiles.test.ts
index 61aea43..d883f5a 100644
--- a/tests/node/profiles.test.ts
+++ b/tests/node/profiles.test.ts
@@ -17,11 +17,9 @@
 // runtime installed.
 
 import assert from "node:assert/strict";
-import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import { test } from "node:test";
-import { fileURLToPath } from "node:url";
 
 import {
   createBrowserFromDaemonConfig,
@@ -56,11 +54,9 @@ import {
   saveTranscript,
   transcriptPath,
 } from "../../dist/src/session-store.js";
+import { runCli } from "./helpers/cli.js";
 import { makeTempDir } from "./helpers/temp-dir.js";
 
-const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
-const CLI = path.join(ROOT, "dist", "bin", "betterwright.js");
-
 // ---------------------------------------------------------------------------
 // Name validation
 // ---------------------------------------------------------------------------
@@ -746,20 +742,10 @@ test("profileFromEnv reads BETTERWRIGHT_PROFILE and validates it", () => {
   assert.throws(() => profileFromEnv({ BETTERWRIGHT_PROFILE: "../escape" }), TypeError);
 });
 
-function runCli(args, { env = {} } = {}) {
-  return spawnSync(process.execPath, [CLI, ...args], {
-    cwd: ROOT,
-    encoding: "utf8",
-    timeout: 30_000,
-    input: "",
-    env: { ...process.env, ...env },
-  });
-}
-
-test("an invalid --profile fails as one clear line, before anything launches", () => {
+test("an invalid --profile fails as one clear line, before anything launches", async () => {
   const home = makeTempDir("bw-profiles-home-");
   for (const bad of ["../escape", "a/b", "con", "x.betterwright-lock"]) {
-    const result = runCli(["run", "--profile", bad, "-c", "return 1"], {
+    const result = await runCli(["run", "--profile", bad, "-c", "return 1"], {
       env: { BETTERWRIGHT_HOME: home },
     });
     assert.equal(result.status, 1, `${bad}: exited ${result.status}`);
@@ -771,13 +757,13 @@ test("an invalid --profile fails as one clear line, before anything launches", (
   }
 });
 
-test("--help still answers even with an invalid --profile", () => {
-  const result = runCli(["run", "--help", "--profile", "../escape"]);
+test("--help still answers even with an invalid --profile", async () => {
+  const result = await runCli(["run", "--help", "--profile", "../escape"]);
   assert.equal(result.status, 0);
   assert.match(result.stdout, /Usage: betterwright run/);
 });
 
-test("the CLI documents --profile where it applies", () => {
+test("the CLI documents --profile where it applies", async () => {
   const helpCases: Array<[string[], RegExp]> = [
     [["run", "--help"], /--profile <name>/],
     [["repl", "--help"], /profile/],
@@ -786,30 +772,30 @@ test("the CLI documents --profile where it applies", () => {
     [["view", "--help"], /--profile <name>/],
   ];
   for (const [args, pattern] of helpCases) {
-    const result = runCli(args);
+    const result = await runCli(args);
     assert.equal(result.status, 0, `${args[0]} --help exited ${result.status}`);
     assert.match(result.stdout, pattern, `${args[0]} --help omits --profile`);
   }
 });
 
-test("sessions and close report per profile when no daemon is running", () => {
+test("sessions and close report per profile when no daemon is running", async () => {
   const home = makeTempDir("bw-profiles-home-");
-  const sessions = runCli(["sessions"], { env: { BETTERWRIGHT_HOME: home } });
+  const sessions = await runCli(["sessions"], { env: { BETTERWRIGHT_HOME: home } });
   assert.equal(sessions.status, 0);
   assert.match(sessions.stdout, /No session daemon is running\./);
 
-  const close = runCli(["close", "--profile", "social"], { env: { BETTERWRIGHT_HOME: home } });
+  const close = await runCli(["close", "--profile", "social"], { env: { BETTERWRIGHT_HOME: home } });
   assert.equal(close.status, 0);
   assert.match(close.stdout, /No session daemon is running for profile "social"/);
   // Inspecting must never start a daemon, on any profile.
   assert.equal(fs.existsSync(path.join(home, "daemon-social.sock")), false);
 });
 
-test("--profile \"\" is an error, not a silent fall back to the default identity", () => {
+test("--profile \"\" is an error, not a silent fall back to the default identity", async () => {
   const home = makeTempDir("bw-profiles-home-");
   // A script passing `--profile "$IDENTITY"` with the variable unset must fail
   // rather than quietly act as the default profile.
-  const result = runCli(["run", "--profile", "", "-c", "return 1"], {
+  const result = await runCli(["run", "--profile", "", "-c", "return 1"], {
     env: { BETTERWRIGHT_HOME: home },
   });
   assert.equal(result.status, 1, result.stdout || result.stderr);
@@ -817,9 +803,9 @@ test("--profile \"\" is an error, not a silent fall back to the default identity
   assert.equal(fs.existsSync(path.join(home, "browser")), false);
 });
 
-test("mcp --check refuses a bad BETTERWRIGHT_PROFILE and confirms a good one", () => {
+test("mcp --check refuses a bad BETTERWRIGHT_PROFILE and confirms a good one", async () => {
   const home = makeTempDir("bw-profiles-home-");
-  const bad = runCli(["mcp", "--check"], {
+  const bad = await runCli(["mcp", "--check"], {
     env: { BETTERWRIGHT_HOME: home, BETTERWRIGHT_PROFILE: "../escape" },
   });
   assert.notEqual(bad.status, 0);
@@ -828,32 +814,32 @@ test("mcp --check refuses a bad BETTERWRIGHT_PROFILE and confirms a good one", (
   assert.match(bad.stderr, /BETTERWRIGHT_PROFILE/);
   assert.doesNotMatch(bad.stdout, /The MCP server can start/);
 
-  const good = runCli(["mcp", "--check"], {
+  const good = await runCli(["mcp", "--check"], {
     env: { BETTERWRIGHT_HOME: home, BETTERWRIGHT_PROFILE: "social" },
   });
   assert.match(good.stdout, /Profile "social"/);
 });
 
-test("BETTERWRIGHT_PROFILE selects the identity for the CLI too, and --profile wins", () => {
+test("BETTERWRIGHT_PROFILE selects the identity for the CLI too, and --profile wins", async () => {
   const home = makeTempDir("bw-profiles-home-");
   // `close` needs no browser and names the profile it looked for, so it is the
   // cheapest way to observe which identity the CLI resolved.
-  const fromEnv = runCli(["close"], {
+  const fromEnv = await runCli(["close"], {
     env: { BETTERWRIGHT_HOME: home, BETTERWRIGHT_PROFILE: "social" },
   });
   assert.match(fromEnv.stdout, /profile "social"/);
 
-  const flagWins = runCli(["close", "--profile", "review"], {
+  const flagWins = await runCli(["close", "--profile", "review"], {
     env: { BETTERWRIGHT_HOME: home, BETTERWRIGHT_PROFILE: "social" },
   });
   assert.match(flagWins.stdout, /profile "review"/);
 
-  const blankEnv = runCli(["close"], {
+  const blankEnv = await runCli(["close"], {
     env: { BETTERWRIGHT_HOME: home, BETTERWRIGHT_PROFILE: "  " },
   });
   assert.doesNotMatch(blankEnv.stdout, /profile/);
 
-  const badEnv = runCli(["close"], {
+  const badEnv = await runCli(["close"], {
     env: { BETTERWRIGHT_HOME: home, BETTERWRIGHT_PROFILE: "../escape" },
   });
   assert.equal(badEnv.status, 1);
diff --git a/tests/node/worker-artifacts.test.ts b/tests/node/worker-artifacts.test.ts
new file mode 100644
index 0000000..491353a
--- /dev/null
+++ b/tests/node/worker-artifacts.test.ts
@@ -0,0 +1,125 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import type { Page } from "playwright-core";
+import {
+  createWorkerArtifacts,
+  MAX_TRACKED_ARTIFACTS,
+  type WorkerArtifactConfig,
+} from "../../dist/src/worker-artifacts.js";
+
+function fixture(t, config: Partial<WorkerArtifactConfig> = {}) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "bw-worker-artifacts-"));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  const session = {
+    id: "quota-session",
+    pages: new Map<string, Page>(),
+    // SAFETY: these empty arrays establish the element types required by the
+    // artifact subsystem before tests add representative entries.
+    artifacts: [] as Array<{ kind: string; path: string; mimeType?: string }>,
+    // SAFETY: this empty array establishes a mutable string warning sink.
+    warnings: [] as string[],
+    reservedArtifactBytes: 0,
+  };
+  // SAFETY: quota tests use the Page value only as an opaque identity key.
+  const page = Object.create(null) as Page;
+  session.pages.set("page-1", page);
+  const settings = {
+    artifactsDir: root,
+    ...config,
+  };
+  const artifacts = createWorkerArtifacts({
+    getConfig: () => settings,
+    newCDPSession: async () => {
+      throw new Error("CDP is not used by quota tests.");
+    },
+    sessions: () => [session],
+    ensureSessionPage: async () => page,
+    pageId: () => "page-1",
+    wakeSessionPages: async () => {},
+    quietSessionPages: () => {},
+    redactText: String,
+    actionTimeoutMs: 5_000,
+  });
+  return { artifacts, page, root, session };
+}
+
+function recordingHandle() {
+  const result = {
+    state: "completed" as const,
+    path: "recording.mp4",
+    fps: 60,
+    capturedFrames: 1,
+    outputFrames: 1,
+    droppedFrames: 0,
+    durationMs: 1,
+    bytes: 1,
+  };
+  return {
+    status: () => result,
+    stop: async () => result,
+  };
+}
+
+test("artifact quota evicts oldest files but never an active recording", t => {
+  const { artifacts, page, session } = fixture(t, { maxArtifactBytes: 10 });
+  const directory = artifacts.artifactDir(session);
+  const active = path.join(directory, "active.mp4");
+  const oldest = path.join(directory, "oldest.bin");
+  const newest = path.join(directory, "newest.bin");
+  fs.writeFileSync(active, Buffer.alloc(6));
+  fs.writeFileSync(oldest, Buffer.alloc(3));
+  fs.writeFileSync(newest, Buffer.alloc(1));
+  fs.utimesSync(oldest, 1, 1);
+  fs.utimesSync(newest, 2, 2);
+  fs.utimesSync(active, 3, 3);
+
+  session.reservedArtifactBytes = 6;
+  const handle = recordingHandle();
+  const owner = { handle, page, path: active };
+  artifacts.sessionRecordings.set(session.id, {
+    state: "active",
+    page,
+    path: active,
+    ready: Promise.resolve(owner),
+  });
+
+  artifacts.pruneArtifactQuota(session, 2);
+
+  assert.equal(fs.existsSync(active), true);
+  assert.equal(fs.existsSync(oldest), false);
+  assert.equal(fs.existsSync(newest), true);
+  assert.deepEqual(session.warnings, ["Artifact quota removed oldest.bin."]);
+});
+
+test("artifact reservations release exactly once", t => {
+  const { artifacts, session } = fixture(t, { maxArtifactBytes: 20 });
+  const release = artifacts.reserveArtifactQuota(session, 7);
+  assert.equal(session.reservedArtifactBytes, 7);
+  release();
+  release();
+  assert.equal(session.reservedArtifactBytes, 0);
+});
+
+test("an active recording consumes the final tracked-artifact slot", t => {
+  const { artifacts, page, session } = fixture(t);
+  session.artifacts = Array.from(
+    { length: MAX_TRACKED_ARTIFACTS - 1 },
+    (_, index) => ({ kind: "artifact", path: `artifact-${index}` }),
+  );
+  const handle = recordingHandle();
+  const owner = { handle, page, path: "active.mp4" };
+  artifacts.sessionRecordings.set(session.id, {
+    state: "active",
+    page,
+    path: owner.path,
+    ready: Promise.resolve(owner),
+  });
+
+  assert.throws(
+    () => artifacts.makeArtifactPath(session, "extra.txt"),
+    /Browser artifact limit \(500\) reached/,
+  );
+});
diff --git a/tests/node/worker-challenges.test.ts b/tests/node/worker-challenges.test.ts
new file mode 100644
index 0000000..3c19d98
--- /dev/null
+++ b/tests/node/worker-challenges.test.ts
@@ -0,0 +1,215 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { test } from "node:test";
+import vm from "node:vm";
+
+import {
+  captchaBounds,
+  captchaGridSignature,
+  captchaPoint,
+  createCaptchaRuntime,
+  drawCaptchaTileOverlay,
+  sampleCanvasRgbaInPage,
+} from "../../dist/src/captcha-runtime.js";
+import {
+  collectChallengeMetadata,
+  createChallengeScanner,
+  markChallengesForWorkerRestart,
+  readFramePresentationInPage,
+  readFrameWalkInPage,
+  readSolvedProvidersInPage,
+} from "../../dist/src/challenge-scan.js";
+
+function pageFixture({ text = "Ordinary content", tokens = {}, closed = false } = {}) {
+  const page = {
+    url: () => "https://example.com/checkout",
+    title: async () => "Checkout",
+    isClosed: () => closed,
+    frames: () => [page],
+    mainFrame: () => page,
+    locator: () => ({ innerText: async () => text }),
+    evaluate: async (fn) => fn === readSolvedProvidersInPage
+      ? tokens
+      : { iframes: [], sameOrigin: [] },
+  };
+  return page;
+}
+
+function sessionFixture(page?) {
+  return {
+    currentId: page ? "p1" : null,
+    pages: new Map(page ? [["p1", page]] : []),
+    artifacts: [],
+    openChallengeProviders: new Set(["recaptcha"]),
+    cursor: { x: 0, y: 0, initialized: false },
+    captchaTargets: new Map(),
+    captchaGrid: null,
+  };
+}
+
+test("challenge modules import without worker process wiring or output", () => {
+  const modules = [
+    new URL("../../dist/src/challenge-scan.js", import.meta.url).href,
+    new URL("../../dist/src/captcha-runtime.js", import.meta.url).href,
+  ];
+  const result = spawnSync(process.execPath, ["--input-type=module", "-e", `
+    const before = ["SIGTERM", "SIGINT", "uncaughtException", "unhandledRejection"]
+      .map((event) => process.listenerCount(event));
+    const stdinBefore = process.stdin.listenerCount("data");
+    for (const url of ${JSON.stringify(modules)}) await import(url);
+    const after = ["SIGTERM", "SIGINT", "uncaughtException", "unhandledRejection"]
+      .map((event) => process.listenerCount(event));
+    if (JSON.stringify(before) !== JSON.stringify(after)) process.exitCode = 2;
+    if (stdinBefore !== process.stdin.listenerCount("data")) process.exitCode = 3;
+  `], { encoding: "utf8", timeout: 5_000 });
+  assert.ifError(result.error);
+  assert.equal(result.status, 0, result.stderr);
+  assert.equal(result.stdout, "");
+  assert.equal(result.stderr, "");
+});
+
+test("bounds and points preserve numeric coercion and validation", () => {
+  assert.deepEqual(captchaBounds({ x: "3", y: -2, width: "9", height: 8 }), {
+    x: 3, y: -2, width: 9, height: 8,
+  });
+  assert.deepEqual(captchaPoint({ x: null, y: "4" }, "drag start"), { x: 0, y: 4 });
+  for (const width of [0, -1, Infinity, NaN]) {
+    assert.throws(() => captchaBounds({ x: 0, y: 0, width, height: 8 }), /positive dimensions/);
+  }
+  assert.throws(() => captchaBounds(null, "target"), /captcha target requires/);
+  assert.throws(() => captchaPoint({ x: 1 }, "drag end"), /captcha drag end requires/);
+});
+
+test("grid signatures preserve page coordinates, rounding, and tile order", () => {
+  const first = [{ bounds: { x: 10.2, y: 20.4, width: 30.4, height: 40.7 } }];
+  assert.equal(captchaGridSignature(first), "10,20,30,41");
+  assert.equal(captchaGridSignature(first, { x: 5, y: 100 }), "15,120,30,41");
+  assert.equal(captchaGridSignature([]), "");
+  assert.equal(captchaGridSignature([{ bounds: {} }, ...first]), "0,0,0,0|10,20,30,41");
+});
+
+test("restart advice copies challenges without mutating the prior result", () => {
+  const original = {
+    url: "https://example.com/checkout",
+    provider: "recaptcha",
+    solve: { resumeOnClear: true, maxStages: 3 },
+  };
+  const [restarted] = markChallengesForWorkerRestart([original]);
+  assert.deepEqual(original.solve, { resumeOnClear: true, maxStages: 3 });
+  assert.deepEqual(restarted.solve, {
+    resumeOnClear: false, maxStages: 3, reopenRequired: true,
+  });
+  assert.deepEqual(restarted.recovery, { pagePreserved: false, reopenUrl: original.url });
+  assert.match(restarted.advice, /reopen the reported URL/);
+});
+
+test("serialized solved-provider callback needs no host imports and requires all fields", () => {
+  const fields = new Map([
+    ['[name="g-recaptcha-response"]', [{ value: " first " }, { value: "" }]],
+    ['[name="h-captcha-response"]', [{ value: " solved " }]],
+    ['[name="bw-captcha-response"]', [{ value: 9 }]],
+  ]);
+  const read = () => JSON.parse(JSON.stringify(vm.runInNewContext(
+    `(${readSolvedProvidersInPage.toString()})()`,
+    { document: { querySelectorAll: (selector) => fields.get(selector) || [] } },
+  )));
+  assert.deepEqual(read(), { hcaptcha: "solved" });
+  fields.set('[name="g-recaptcha-response"]', [{ value: " first " }, { value: "second" }]);
+  assert.deepEqual(read(), { recaptcha: "first", hcaptcha: "solved" });
+});
+
+test("serialized geometry, walk, overlay, and canvas callbacks are self-contained", () => {
+  const element = {
+    getBoundingClientRect: () => ({ width: 80, height: 40 }),
+    ownerDocument: { defaultView: { getComputedStyle: () => ({ opacity: "0" }) } },
+  };
+  const presentation = vm.runInNewContext(`(${readFramePresentationInPage.toString()})(element)`, { element });
+  assert.equal(presentation.visible, false);
+  assert.equal(presentation.width, 80);
+  const walk = vm.runInNewContext(`(${readFrameWalkInPage.toString()})(options)`, {
+    performance: { now: () => 0 },
+    document: { querySelectorAll: () => [] },
+    options: { walkBudgetMs: 250, frameLimit: 24, wantFrameText: true },
+  });
+  assert.equal(walk.iframes.length, 0);
+  assert.equal(walk.sameOrigin.length, 0);
+  const appended = [];
+  vm.runInNewContext(`(${drawCaptchaTileOverlay.toString()})({ tiles: [], overlayId: "tiles" })`, {
+    document: {
+      getElementById: () => null,
+      createElement: () => ({ style: {} }),
+      body: { appendChild: (node) => appended.push(node) },
+    },
+  });
+  assert.equal(appended[0].id, "tiles");
+  assert.equal(vm.runInNewContext(`(${sampleCanvasRgbaInPage.toString()})(null, 200)`), null);
+});
+
+test("metadata gate retains solved tokens while skipping child-frame scans", async () => {
+  const page = pageFixture({ tokens: { recaptcha: "done" } });
+  const child = pageFixture();
+  child.url = () => "https://frame.example/";
+  child.locator = () => { throw new Error("child-frame scan must be skipped"); };
+  page.frames = () => [page, child];
+  let gateCalls = 0;
+  const result = await collectChallengeMetadata(page, {
+    gate: ({ childFrames, tokens }) => {
+      gateCalls += 1;
+      assert.equal(childFrames.length, 1);
+      assert.equal(tokens.recaptcha, "done");
+      return false;
+    },
+  });
+  assert.equal(gateCalls, 1);
+  assert.deepEqual(result.frames, []);
+  assert.deepEqual(result.solvedProviders, ["recaptcha"]);
+  assert.equal(result.main.text, "Ordinary content");
+});
+
+test("reporting clears providers only after a completed scan", async () => {
+  const { detectSessionChallenges } = createChallengeScanner({
+    captureScreenshot: async () => { throw new Error("unexpected screenshot"); },
+    pageId: () => "p1",
+    lastBlockedDocumentAt: () => 0,
+  });
+  const absent = sessionFixture();
+  assert.deepEqual(await detectSessionChallenges(absent), []);
+  assert.deepEqual([...absent.openChallengeProviders], ["recaptcha"]);
+  const ordinary = sessionFixture(pageFixture());
+  assert.deepEqual(await detectSessionChallenges(ordinary), []);
+  assert.equal(ordinary.openChallengeProviders.size, 0);
+});
+
+test("reporting survives screenshot failure and still tracks the open provider", async () => {
+  const page = pageFixture({
+    text: "Our systems have detected unusual traffic from your computer network.",
+  });
+  page.url = () => "https://www.google.com/sorry/index";
+  const session = sessionFixture(page);
+  const { detectSessionChallenges } = createChallengeScanner({
+    captureScreenshot: async () => { throw new Error("page closed during capture"); },
+    pageId: () => "p1",
+    lastBlockedDocumentAt: () => 0,
+  });
+  const challenges = await detectSessionChallenges(session);
+  assert.equal(challenges.length, 1);
+  assert.equal(challenges[0].pageId, "p1");
+  assert.equal(session.artifacts.length, 0);
+  assert.deepEqual([...session.openChallengeProviders], [challenges[0].provider]);
+});
+
+test("solver returns an existing token before interaction or screenshot work", async () => {
+  const page = pageFixture({ tokens: { recaptcha: "done" } });
+  const { solveCaptchaOnPage, clickStoredTiles } = createCaptchaRuntime({
+    captureScreenshot: async () => { throw new Error("unexpected screenshot"); },
+  });
+  const session = sessionFixture(page);
+  const result = await solveCaptchaOnPage(page, session);
+  assert.equal(result.status, "ready");
+  assert.equal(result.cleared, true);
+  assert.equal(result.token, "done");
+  assert.deepEqual(result.attempts, []);
+  assert.deepEqual(await clickStoredTiles(page, session, [0]), {
+    ok: false, reason: "tiles_not_captured",
+  });
+});
diff --git a/tests/node/worker-composition.test.ts b/tests/node/worker-composition.test.ts
new file mode 100644
index 0000000..d81b0a2
--- /dev/null
+++ b/tests/node/worker-composition.test.ts
@@ -0,0 +1,47 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import test from "node:test";
+
+import { createSession } from "../../dist/src/worker-session.js";
+
+// None of these imports may install the process-entrypoint wiring or emit its
+// ready handshake. This also catches accidental imports back into worker.js.
+test("worker subsystems import without process wiring or output", () => {
+  const modules = [
+    "captcha-runtime", "challenge-scan", "worker-artifacts", "worker-human",
+    "worker-live-view", "worker-realm", "worker-sandbox", "worker-session",
+    "worker-site", "worker-snapshots",
+  ].map((name) => new URL(`../../dist/src/${name}.js`, import.meta.url).href);
+  const child = spawnSync(process.execPath, ["--input-type=module", "-e", `
+    const events = ["SIGTERM", "SIGINT", "uncaughtException", "unhandledRejection"];
+    const before = events.map((event) => process.listenerCount(event));
+    const stdinBefore = process.stdin.listenerCount("data");
+    for (const url of ${JSON.stringify(modules)}) await import(url);
+    const after = events.map((event) => process.listenerCount(event));
+    if (JSON.stringify(before) !== JSON.stringify(after)) process.exitCode = 2;
+    if (stdinBefore !== process.stdin.listenerCount("data")) process.exitCode = 3;
+  `], { encoding: "utf8", timeout: 5_000 });
+  assert.ifError(child.error);
+  assert.equal(child.status, 0, child.stderr);
+  assert.equal(child.stdout, "");
+  assert.equal(child.stderr, "");
+});
+
+test("session construction isolates mutable state and credential recovery", () => {
+  const first = createSession("first");
+  const second = createSession("second");
+  first.state.counter = 1;
+  first.warnings.push("first warning");
+  first.openChallengeProviders.add("recaptcha");
+  first.pendingCredentialOrigins.set("pending-1", "https://example.com");
+  first.execution.requestId = "execute-1";
+  assert.equal(Object.getPrototypeOf(first.state), null);
+  assert.equal(second.state.counter, undefined);
+  assert.deepEqual(second.warnings, []);
+  assert.equal(second.openChallengeProviders.size, 0);
+  assert.equal(second.pendingCredentialOrigins.size, 0);
+  assert.equal(second.execution.requestId, null);
+  assert.notEqual(first.pages, second.pages);
+  assert.notEqual(first.cursor, second.cursor);
+  assert.notEqual(first.captchaTargets, second.captchaTargets);
+});
diff --git a/tests/node/worker-live-view.test.ts b/tests/node/worker-live-view.test.ts
new file mode 100644
index 0000000..57071f0
--- /dev/null
+++ b/tests/node/worker-live-view.test.ts
@@ -0,0 +1,217 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { createWorkerLiveView } from "../../dist/src/worker-live-view.js";
+import { createSession } from "../../dist/src/worker-session.js";
+
+function deferred<T>() {
+  let resolve!: (value: T) => void;
+  const promise = new Promise<T>((resolvePromise) => {
+    resolve = resolvePromise;
+  });
+  return { promise, resolve };
+}
+
+function fakePage(name: string, closed = false) {
+  return Object.assign(Object.create(null), {
+    name,
+    isClosed: () => closed,
+  });
+}
+
+function fakeServer(overrides = {}) {
+  return {
+    running: true,
+    async start() {
+      return { ok: true, running: true, url: "http://view.test" };
+    },
+    async stop() {},
+    status() {
+      return { ok: true, running: true };
+    },
+    async beginHandoff() {
+      return { action: "continue", note: "" };
+    },
+    async beginAsk() {
+      return { action: "answer", answer: "" };
+    },
+    postChat(message) {
+      return message;
+    },
+    drainHumanMessages() {
+      return [];
+    },
+    setAgentState() {},
+    async refreshTabs() {},
+    async followPreferred() {},
+    url: "http://view.test",
+    ...overrides,
+  };
+}
+
+function fixture(server) {
+  const sessions = new Map();
+  const defaultSession = createSession("default");
+  sessions.set(defaultSession.id, defaultSession);
+  const results = [];
+  let capturedServerOptions;
+  const controller = createWorkerLiveView({
+    getBrowserContext: () => Object.assign(Object.create(null), {
+      async newCDPSession() {
+        return {};
+      },
+      async newPage() {
+        return fakePage("new");
+      },
+    }),
+    sessions,
+    sessionFor: (id) => {
+      const sessionId = String(id || "default");
+      let session = sessions.get(sessionId);
+      if (!session) {
+        session = createSession(sessionId);
+        sessions.set(sessionId, session);
+      }
+      return session;
+    },
+    pageOwner: () => undefined,
+    adoptPage: (page) => page,
+    wakeSessionPages: async () => {},
+    ensureBrowser: async () => {},
+    sendResult: (message) => results.push(message),
+    redactText: (value) => String(value ?? "").replaceAll("secret", "[redacted]"),
+    serverFactory: (options) => {
+      capturedServerOptions = options;
+      return server;
+    },
+  });
+  return {
+    controller,
+    sessions,
+    defaultSession,
+    results,
+    serverOptions: () => capturedServerOptions,
+  };
+}
+
+test("hasView reflects owned instance even before the server reports running", async () => {
+  const server = fakeServer({ running: false });
+  const { controller } = fixture(server);
+  await controller.liveViewStart({ id: "start", options: {} });
+
+  assert.equal(controller.hasView(), true);
+});
+
+test("stop clears ownership before awaiting server teardown", async () => {
+  const teardown = deferred<void>();
+  const stopCalls = [];
+  const server = fakeServer({
+    stop(options) {
+      stopCalls.push(options);
+      return teardown.promise;
+    },
+  });
+  const { controller } = fixture(server);
+  await controller.liveViewStart({ id: "start", options: {} });
+  assert.equal(controller.hasView(), true);
+
+  const stopping = controller.stop();
+  assert.equal(controller.hasView(), false);
+  assert.deepEqual(stopCalls, [undefined]);
+
+  teardown.resolve();
+  await stopping;
+});
+
+test("stop preserves notify:false for context close and shutdown", async () => {
+  const stopCalls = [];
+  const server = fakeServer({
+    async stop(options) {
+      stopCalls.push(options);
+    },
+  });
+  const { controller } = fixture(server);
+  await controller.liveViewStart({ id: "start", options: {} });
+
+  await controller.stop({ notify: false });
+  assert.deepEqual(stopCalls, [{ notify: false }]);
+  assert.equal(controller.hasView(), false);
+});
+
+test("start tracks the preferred session and exposes its current open page", async () => {
+  let followCalls = 0;
+  const server = fakeServer({
+    async followPreferred() {
+      followCalls += 1;
+    },
+  });
+  const { controller, sessions, serverOptions } = fixture(server);
+  const alpha = createSession("alpha");
+  const alphaPage = fakePage("alpha");
+  alpha.pages.set("alpha-page", alphaPage);
+  alpha.currentId = "alpha-page";
+  sessions.set(alpha.id, alpha);
+  const beta = createSession("beta");
+  const betaPage = fakePage("beta");
+  beta.pages.set("beta-page", betaPage);
+  beta.currentId = "beta-page";
+  sessions.set(beta.id, beta);
+
+  await controller.liveViewStart({ id: "alpha-start", options: { session: "alpha" } });
+  assert.equal(serverOptions().preferredPage(), alphaPage);
+
+  await controller.liveViewStart({ id: "beta-start", options: { session: "beta" } });
+  assert.equal(serverOptions().preferredPage(), betaPage);
+
+  controller.notifyLiveViewPreferred();
+  assert.equal(followCalls, 1);
+});
+
+test("handoff holds the session until completion and redacts its reply", async () => {
+  const handoff = deferred<{ action: string; note: string }>();
+  const server = fakeServer({
+    beginHandoff() {
+      return handoff.promise;
+    },
+  });
+  const { controller, defaultSession, results } = fixture(server);
+  await controller.liveViewStart({ id: "start", options: {} });
+
+  const waiting = controller.handoffWait({
+    id: "handoff",
+    sessionId: "default",
+    prompt: "help",
+    timeoutMs: 10,
+  });
+  assert.notEqual(defaultSession.awaitingAnswerSince, null);
+
+  handoff.resolve({ action: "continue", note: "secret note" });
+  await waiting;
+  assert.equal(defaultSession.awaitingAnswerSince, null);
+  assert.deepEqual(results.at(-1), {
+    type: "result",
+    id: "handoff",
+    ok: true,
+    action: "continue",
+    note: "[redacted] note",
+  });
+});
+
+test("handoff clears its hold and redacts server failures", async () => {
+  const server = fakeServer({
+    async beginHandoff() {
+      throw new Error("secret failure");
+    },
+  });
+  const { controller, defaultSession, results } = fixture(server);
+  await controller.liveViewStart({ id: "start", options: {} });
+
+  await controller.handoffWait({ id: "handoff", sessionId: "default" });
+  assert.equal(defaultSession.awaitingAnswerSince, null);
+  assert.deepEqual(results.at(-1), {
+    type: "result",
+    id: "handoff",
+    ok: false,
+    error: "[redacted] failure",
+  });
+});
diff --git a/tests/node/worker-realm.test.ts b/tests/node/worker-realm.test.ts
new file mode 100644
index 0000000..951462b
--- /dev/null
+++ b/tests/node/worker-realm.test.ts
@@ -0,0 +1,262 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import vm from "node:vm";
+
+import { createSnippetPageEvents } from "../../dist/src/page-events.js";
+import { createWorkerRealm } from "../../dist/src/worker-realm.js";
+
+function makeRealmOperations(overrides = {}) {
+  const artifactsDir = fs.mkdtempSync(path.join(os.tmpdir(), "betterwright-realm-"));
+  const pageIds = new WeakMap();
+  let nextPage = 0;
+  const operations = createWorkerRealm({
+    artifactsDir: () => artifactsDir,
+    hostOwnedTarget: () => false,
+    hostUploadFiles: () => undefined,
+    publicSearchPolicy: () => "block",
+    useSetContentCompatibility: () => false,
+    stopPageRecording: async () => {},
+    redactText: (value) => String(value ?? "").replaceAll("secret", "[redacted]"),
+    redactDeep: (value) => value,
+    pageId: (page) => {
+      let id = pageIds.get(page);
+      if (!id) {
+        id = `page-${++nextPage}`;
+        pageIds.set(page, id);
+      }
+      return id;
+    },
+    pageIds,
+    defaultNavigationTimeoutMs: 30_000,
+    maxResponsePages: 32,
+    ...overrides,
+  });
+  return { artifactsDir, operations, pageIds };
+}
+
+function makeContext(operations) {
+  const sandbox = Object.create(null);
+  const context = vm.createContext(sandbox, {
+    name: "worker-realm-test",
+    codeGeneration: { strings: false, wasm: false },
+  });
+  const realm = operations.createRealm(context, createSnippetPageEvents());
+  Object.assign(sandbox, operations.createUrlGlobals(realm));
+  return { context, realm, sandbox };
+}
+
+function namedObject(name, members = {}) {
+  return Object.assign({ constructor: { name } }, members);
+}
+
+test("worker realm imports without worker entrypoint side effects", async () => {
+  let readlineCalls = 0;
+  const originalOn = process.stdin.on;
+  process.stdin.on = function (...args) {
+    readlineCalls += 1;
+    return originalOn.apply(this, args);
+  };
+  try {
+    await import(`../../dist/src/worker-realm.js?import-safety=${Date.now()}`);
+  } finally {
+    process.stdin.on = originalOn;
+  }
+  assert.equal(readlineCalls, 0);
+});
+
+test("realm functions and URL constructors cannot recover the host Function", () => {
+  const { operations } = makeRealmOperations();
+  const { context, realm } = makeContext(operations);
+  context.hostFunction = realm.safeFunction(() => "ok");
+
+  assert.equal(vm.runInContext("hostFunction()", context), "ok");
+  assert.throws(
+    () => vm.runInContext("hostFunction.constructor('return process')()", context),
+    /Code generation from strings disallowed/,
+  );
+  assert.throws(
+    () => vm.runInContext("URL.constructor('return process')()", context),
+    /Code generation from strings disallowed/,
+  );
+  assert.throws(
+    () => vm.runInContext("Function('return process')()", context),
+    /Code generation from strings disallowed/,
+  );
+});
+
+test("realm URL and URLSearchParams preserve mutation and iterable semantics", () => {
+  const { operations } = makeRealmOperations();
+  const { context } = makeContext(operations);
+  const result = vm.runInContext(`(() => {
+    const url = new URL('/start?a=1&a=2', 'https://user:pass@example.com:8443/base');
+    const params = url.searchParams;
+    params.delete('a', '1');
+    params.append('space', 'a b');
+    url.pathname = '/next';
+    url.search = '?x=1&x=2';
+    params.set('x', '3');
+    const fromMap = new URLSearchParams(new Map([['z', '9']]));
+    return {
+      href: url.href,
+      sameParams: params === url.searchParams,
+      entries: [...params],
+      encoded: String(new URLSearchParams({ lone: '\\ud800', space: 'a b' })),
+      map: fromMap.toString(),
+      canParse: URL.canParse('https://example.com'),
+      badParse: URL.parse('not a url'),
+      tag: Object.prototype.toString.call(url),
+    };
+  })()`, context);
+
+  assert.deepEqual(structuredClone(result), {
+    href: "https://user:pass@example.com:8443/next?x=3",
+    sameParams: true,
+    entries: [["x", "3"]],
+    encoded: "lone=%EF%BF%BD&space=a+b",
+    map: "z=9",
+    canParse: true,
+    badParse: null,
+    tag: "[object URL]",
+  });
+});
+
+test("wrapped objects keep forbidden methods and sensitive headers unavailable", async () => {
+  const { operations } = makeRealmOperations();
+  const { context, realm } = makeContext(operations);
+  const request = namedObject("Request", {
+    headers: () => ({ Cookie: "secret", Accept: "text/html", "Set-Cookie": "x=secret" }),
+    allHeaders: () => ({ Cookie: "secret" }),
+    headerValue: () => "secret",
+    url: () => "https://example.com",
+  });
+  context.request = operations.wrap(request, realm);
+
+  const result = await vm.runInContext(`(async () => ({
+    constructor: request.constructor,
+    on: request.on,
+    allHeaders: request.allHeaders,
+    headerValue: request.headerValue,
+    hasHeaders: 'headers' in request,
+    keys: Object.keys(request),
+    headers: await request.headers(),
+  }))()`, context);
+
+  assert.equal(result.constructor, undefined);
+  assert.equal(result.on, undefined);
+  assert.equal(result.allHeaders, undefined);
+  assert.equal(result.headerValue, undefined);
+  assert.equal(result.hasHeaders, true);
+  assert.equal(result.keys.includes("allHeaders"), false);
+  assert.equal(result.keys.includes("headerValue"), false);
+  assert.equal(result.headers.Accept, "text/html");
+  assert.deepEqual(Object.keys(result.headers), ["Accept"]);
+});
+
+test("wrapped navigation validates schemes, public search, host ownership, and write paths", async () => {
+  let hostOwned = false;
+  let publicSearchPolicy = "block";
+  const { artifactsDir, operations } = makeRealmOperations({
+    hostOwnedTarget: () => hostOwned,
+    publicSearchPolicy: () => publicSearchPolicy,
+  });
+  const { realm } = makeContext(operations);
+  const calls = [];
+  const page = namedObject("Page", {
+    goto: async (...args) => {
+      calls.push(args);
+      return null;
+    },
+    close: async () => {},
+    pdf: async () => {},
+  });
+  const wrapped = operations.wrap(page, realm);
+
+  assert.throws(() => wrapped.goto("file:///etc/passwd"), /scheme is not available: file:/);
+  assert.throws(() => wrapped.goto("https://www.google.com/search?q=test"), /Public search-result UI automation/);
+  publicSearchPolicy = "allow";
+  await wrapped.goto("https://www.google.com/search?q=test");
+  assert.deepEqual(calls, [[
+    "https://www.google.com/search?q=test",
+    { waitUntil: "domcontentloaded" },
+  ]]);
+
+  assert.throws(
+    () => wrapped.pdf({ path: path.join(artifactsDir, "..", "escape.pdf") }),
+    /artifactPath/,
+  );
+  await wrapped.pdf({ path: path.join(artifactsDir, "inside.pdf") });
+  hostOwned = true;
+  assert.throws(() => wrapped.close(), /Host-owned tabs/);
+});
+
+test("setContent compatibility bypasses the driver method and keeps waitUntil validation", async () => {
+  let compatibility = true;
+  let driverCalls = 0;
+  const evaluations = [];
+  const { operations } = makeRealmOperations({
+    useSetContentCompatibility: () => compatibility,
+  });
+  const { realm } = makeContext(operations);
+  const page = namedObject("Page");
+  const frame = namedObject("Frame", {
+    page: () => page,
+    _navigationTimeout: () => 100,
+    evaluate: async (_callback, argument) => {
+      evaluations.push(argument);
+    },
+  });
+  Object.assign(page, {
+    mainFrame: () => frame,
+    setContent: async () => {
+      driverCalls += 1;
+    },
+  });
+  const wrapped = operations.wrap(page, realm);
+
+  await wrapped.setContent("<p>ok</p>", { waitUntil: "commit" });
+  assert.equal(driverCalls, 0);
+  assert.equal(evaluations.length, 1);
+  assert.equal(evaluations[0].markup, "<p>ok</p>");
+  assert.equal(evaluations[0].expected, "commit");
+  await assert.rejects(
+    wrapped.setContent("<p>bad</p>", { waitUntil: "invalid" }),
+    /Unsupported setContent waitUntil value/,
+  );
+
+  compatibility = false;
+  await wrapped.setContent("<p>driver</p>");
+  assert.equal(driverCalls, 1);
+});
+
+test("facades unwrap for page handles and summaries redact without exposing internals", async () => {
+  const { operations, pageIds } = makeRealmOperations();
+  const { realm } = makeContext(operations);
+  const page = namedObject("Page", {
+    evaluate: async () => "secret title",
+    title: async () => "fallback",
+    url: () => "https://example.com/secret",
+    isClosed: () => false,
+  });
+  pageIds.set(page, "page-known");
+  const facade = operations.wrap(page, realm);
+
+  assert.notEqual(facade, page);
+  assert.equal(operations.unwrapTarget(facade), page);
+  operations.assertPageHandle(facade, "usePage");
+  assert.equal(operations.findPageEntry([["page-known", page]], facade)?.[0], "page-known");
+  assert.equal(operations.describePageHandle(facade), "page object page-known");
+  assert.throws(
+    () => operations.assertPageHandle({}, "usePage"),
+    /page handle must be a page ID string, numeric index, or page object/,
+  );
+  assert.deepEqual(await operations.summarize(facade), {
+    type: "Page",
+    pageId: "page-known",
+    url: "https://example.com/[redacted]",
+    title: "[redacted] title",
+    closed: false,
+  });
+});