capybara-simulated 0.5.0 → 0.7.0

data/lib/capybara/simulated/browser.rb

@@ -9,11 +9,13 @@ require 'net/http'
 require 'openssl'
 require 'rack/mock'
 require 'securerandom'
+require 'set'
 require 'socket'
 require 'thread'
 require 'time'
 require 'uri'
 require 'uri/idna'   # WHATWG/UTS46 domain-to-ASCII/Unicode (uri-idna gem)
+require 'zlib'
 require_relative 'asset_cache'
 require_relative 'errors'
 require_relative 'stack_resolver'
@@ -54,6 +56,18 @@ module Capybara
       # `Last-Modified` per RFC 9111.
       @@asset_cache = AssetCache.new
 
+      # Opt-in: capture each request's author header names verbatim on the Rack env
+      # (`csim.raw_request_headers`) so the WPT .py-handler harness can replay them with
+      # exact casing / token chars (inspect-headers / echo-headers). OFF for real app
+      # traffic — nothing there consumes the list, so it would only allocate per request.
+      @@capture_raw_request_headers = false
+      def self.capture_raw_request_headers
+        @@capture_raw_request_headers
+      end
+      def self.capture_raw_request_headers=(v)
+        @@capture_raw_request_headers = v
+      end
+
       attr_writer :timers_active
 
       # The Driver's handle for the window this Browser backs (set right after
@@ -97,6 +111,16 @@ module Capybara
       # green at 100 across gem 1579, WPT 660, Forem, Avo, :464 passing). Clamped
       # >=1 so a `CSIM_POLL_TICK_STEP_MS=0` misconfig can't freeze the fixed-step path.
       POLL_TICK_STEP_MS = [(ENV['CSIM_POLL_TICK_STEP_MS'] || '100').to_i, 1].max
+      # One animation frame (~60 Hz, whole ms — `run_loop_step` truncates). When a
+      # poll advances the clock while the page has work runnable NOW (a rAF chain or
+      # a timer burst), `tick_real_time` runs the advance in chunks this size so the
+      # page's rendering runs at real-browser cadence (one render phase per frame),
+      # not one `POLL_TICK_STEP_MS` super-frame — the same model the WPT drain uses.
+      FRAME_STEP_MS = 16
+      # Per-poll task-iteration cap, mirroring `RuntimeShared#run_loop_step`'s own
+      # default — shared across the frame chunks of one poll so sub-stepping keeps
+      # the same per-poll ceiling the single-step path had.
+      RUN_LOOP_MAX_ITER = 10_000
       # Horizon-gated fast-forward: when the page is observably idle (no timer due
       # now, no background IO) but a timer is parked within this horizon, jump the
       # virtual clock straight to it instead of waiting ~delay/step polls. A timer
@@ -116,6 +140,11 @@ module Capybara
       # timer/microtask storm so one settle iter returns to Ruby; large enough
       # for the heaviest legit chain (Mastodon hydrate, Turbo stream batch).
       SETTLE_MAX_ITER_TASKS = 256
+      # Backstop for the post-boot deferred-external-script drain: a dynamically
+      # inserted external <script> runs async (setTimeout 0), so an app's chunk
+      # loader chains many of them at boot. We pump only ALREADY-due tasks until the
+      # pending count hits 0; this caps a pathological self-injecting loader.
+      BOOT_SCRIPT_DRAIN_MAX_ITER = 300
       # Post-user-action virtual-clock advance. Default 0 — the
       # wall-sync model (each tick_real_time advances by the wall
       # ms elapsed since the last tick) lets Capybara's outer poll
@@ -167,9 +196,10 @@ module Capybara
         Rack::Mime.mime_type(File.extname(path.to_s), '')
       end
 
-      def initialize(app, driver: nil, js_engine: nil, cookies: nil, local_storage: nil)
+      def initialize(app, driver: nil, js_engine: nil, cookies: nil, local_storage: nil, all_hosts_local: nil)
         @app                          = app
         @driver                       = driver
+        @all_hosts_local_override     = all_hosts_local
         @runtime                      = build_runtime(js_engine)
         # Per-poll clock decisions cached at construction (CLAUDE.md rule 3 — the
         # runtime type + env are fixed for the session): the wall-sync escape
@@ -218,6 +248,18 @@ module Capybara
         # `Capybara.app_host` / `server_host` / `server_port` on every
         # rack call (CLAUDE.md: cache env decisions at construction).
         @default_host                 = self.class.default_host
+        # The WPT runner serves EVERY host through one in-process Rack app (the
+        # wptserve catch-all), so cross-origin test fixtures are genuinely local
+        # there. Setting this makes `url_is_local?` true for all hosts, so a
+        # cross-origin iframe eager-builds + is served by @app.call directly
+        # (no failing net_http_fetch). Apps leave it off: an external embed stays
+        # non-local → lazy → no @app.call side effect (extra visit / log row).
+        # Universal-server context (every host served in-process → cross-origin frames
+        # eager-build). The Driver captures this at session-construction time (when the
+        # WPT runner has the env set) and passes it to EVERY window it builds, so an aux
+        # window opened LATER — after the runner restored the env — still inherits it.
+        # nil override (a stand-alone Browser) falls back to the live env check.
+        @all_hosts_local              = @all_hosts_local_override.nil? ? (ENV['CSIM_LOCAL_ALL_HOSTS'] == '1') : @all_hosts_local_override
         # Handle IDs are per-Context integer sequences: a handle from
         # a pre-rebuild context could collide with a fresh node's id
         # in the new context. Node captures this on construction;
@@ -243,6 +285,7 @@ module Capybara
         @ticking                      = false
         @history                      = []
         @history_idx                  = -1
+        @cors_preflight_cache         = {}
         @modal_handlers               = []
         # Geolocation override (CDP-ish). nil = no override configured →
         # navigator.geolocation reports POSITION_UNAVAILABLE. Ruby-backed so
@@ -403,8 +446,8 @@ module Capybara
 
       # Address-bar navigation: no Referer, and relative paths resolve
       # against the host root (not the current page's directory).
-      def visit(url)
-        navigate(resolve_visit_url(url), referer: nil)
+      def visit(url, referer: nil)
+        navigate(resolve_visit_url(url), referer: referer)
       end
 
       URL_UNSAFE_CHARS = %r{[^!*'();:@&=+$,/?#\[\]A-Za-z0-9\-._~%]}n.freeze
@@ -915,12 +958,13 @@ module Capybara
             end
           # `target="_blank"` (or any non-_self/_top/_parent name) opens
           # in a new browsing context (its own Browser/VM); the primary
-          # stays put (per HTML spec — original window is unaffected). No
-          # `opener_handle` is passed: modern browsers default `target=_blank`
-          # to `noopener` (so `window.opener` is null), unlike JS `window.open`
-          # which keeps the opener — see `open_window_from_js`.
+          # stays put (per HTML spec — original window is unaffected). A
+          # `target=_blank` link defaults to `noopener` (window.opener null) unless
+          # `rel=opener` (carried as `action['opener']`); open_aux_window forces
+          # noopener anyway for a cross-partition blob. Matches the scripted
+          # click / dispatchEvent activation paths.
           elsif !target.empty? && !%w[_self _top _parent].include?(target.downcase) && @driver.respond_to?(:open_aux_window)
-            @driver.open_aux_window(resolve_against_current(url, use_base: true), source: self, blob_snapshot: action['blob'])
+            @driver.open_aux_window(resolve_against_current(url, use_base: true), source: self, opener: !!action['opener'], blob_snapshot: action['blob'])
           # In-page anchor links (`#frag` / current-page + `#frag`) move
           # the hash but don't fetch a new document. Pure-fragment also
           # short-circuits the `<a>`s test fixtures use as click sinks.
@@ -966,7 +1010,7 @@ module Capybara
           elsif @current_url != submit_baseline_url
             # Already navigated; nothing more to do.
           else
-            submit_form_handle(action['formHandle'], action['submitter'])
+            submit_form_handle(action['formHandle'], action['submitter'], action['entryList'])
           end
         when 'download'
           download_link(resolve_against_current(action['url'].to_s), action['filename'].to_s)
@@ -1035,7 +1079,7 @@ module Capybara
         # `attach_file` hands us a Pathname (or Array of Pathnames);
         # the marshaller rejects non-primitive types. Coerce to a path-list
         # form V8 can hold — the actual multipart upload happens later
-        # in `build_multipart_body` during form submission.
+        # in `encode_entry_list` during form submission.
         coerced = coerce_set_value(value)
         # For date/time-shaped inputs we need the type-specific
         # string. Probe the handle's `type` and re-format Date / Time
@@ -1375,7 +1419,7 @@ module Capybara
       def consume_pending_form_submit
         pending = @runtime.call('__csimTakePendingFormSubmit')
         return unless pending.is_a?(Hash) && pending['formHandle']
-        submit_form_handle(pending['formHandle'].to_i, pending['submitterHandle'])
+        submit_form_handle(pending['formHandle'].to_i, pending['submitterHandle'], pending['entryList'])
       end
 
       # Pin the URL the page is at as a user action BEGINS — the FIRST line of
@@ -1475,7 +1519,9 @@ module Capybara
         url    = pending['url'].to_s
         target = pending['target'].to_s
         if !target.empty? && !%w[_self _top _parent].include?(target.downcase) && @driver.respond_to?(:open_aux_window)
-          @driver.open_aux_window(resolve_against_current(url, use_base: true), source: self, blob_snapshot: pending['blob'])
+          # `opener` reflects rel=opener (a bare target=_blank link is noopener);
+          # open_aux_window forces noopener anyway for a cross-partition blob.
+          @driver.open_aux_window(resolve_against_current(url, use_base: true), source: self, opener: !!pending['opener'], blob_snapshot: pending['blob'])
         elsif pure_fragment_navigation?(url)
           update_current_hash(url)
         else
@@ -1607,11 +1653,34 @@ module Capybara
       def go_back        ; history_go(-1, force: true) ; end
       def go_forward     ; history_go(+1, force: true) ; end
 
+      # Reset the session history to empty WITHOUT the full `reset!` (cookies /
+      # storage / viewport / frame scope stay put). A single session that visits
+      # many documents in sequence — the WPT conformance runner reuses one for
+      # the whole 1645-file suite — otherwise accumulates every prior visit's
+      # history entry, so a document that calls `history.back()` (e.g. a bfcache
+      # round-trip test) traverses the SHARED history back into the PREVIOUS
+      # document and re-runs it. Clearing history per visit confines each
+      # document's back / forward to its own navigations, matching a real
+      # browser's fresh-browsing-context isolation, so results don't depend on
+      # visit order. Not wired into `visit` itself — a normal session keeps
+      # cross-`visit` back-navigation (Selenium parity); only callers that want
+      # per-document isolation invoke it.
+      def reset_history!
+        @history.clear
+        @history_idx              = -1
+        @pending_history_traverse = nil
+      end
+
       # Move through the history stack by `delta`. Per HTML spec, a
       # same-document traversal (within a chain of pushState entries
       # rooted at a single navigation) updates `location` and fires
       # `popstate` with the entry's state — no full reload. A cross-
       # document traversal replays the entry (full navigate / re-POST).
+      # Returns the traversal kind so a cross-window caller
+      # (`window_history_go`) knows whether to fire the target window's
+      # deferred `load`: `:same_document` (pushState traversal — popstate
+      # already fired, no load), `:cross_document` (full document replay —
+      # load follows), or `nil` (no-op: zero delta / out of range).
       def history_go(delta, force: false)
         delta = delta.to_i
         return if delta == 0
@@ -1626,10 +1695,13 @@ module Capybara
           @current_url = entry[:url]
           @runtime.call('__csimUpdateLocation', @current_url)
           @runtime.call('__csimDispatchPopState', entry[:state])
+          :same_document
         elsif force
-          # Ruby-driven (`page.go_back`) — no live JS call to interrupt,
-          # safe to rebuild the Context synchronously.
+          # Ruby-driven (`page.go_back`), or a non-active window driven by its
+          # opener (`w.history.back()`) — no live JS call on THIS window's
+          # isolate to interrupt, safe to rebuild the Context synchronously.
           perform_history_traverse(target)
+          :cross_document
         else
           # JS-driven (`history.back()` from a page handler): replaying
           # the history entry synchronously would call `rebuild_ctx`
@@ -1639,6 +1711,7 @@ module Capybara
           # and drain after the call returns — mirrors
           # `location_assign` / `location_reload`.
           @pending_history_traverse = target
+          :cross_document
         end
       end
 
@@ -1649,8 +1722,29 @@ module Capybara
       end
 
       private def perform_history_traverse(target)
+        capture_outgoing_form_state
         @history_idx = target
         replay_history_entry(@history[target])
+        restore_form_state(@history[target])
+      end
+
+      # Snapshot the OUTGOING document's form-control state into the history entry
+      # we are leaving, so a later back/forward traversal to it restores the
+      # values the user/script had set (HTML "persisted user state"), not the
+      # markup defaults. Captured while the outgoing VM is still live — before
+      # record_history advances the index or boot rebuilds the context.
+      def capture_outgoing_form_state
+        return if @history_idx < 0 || (entry = @history[@history_idx]).nil?
+        state = (@runtime.call('__csimCaptureFormState') rescue nil)
+        entry[:form_state] = state if state
+      end
+
+      # Re-apply a history entry's captured form state after its document has been
+      # rebuilt. The JS setters set the dirty value flag WITHOUT firing
+      # input/change, so a restored value doesn't look like a fresh user edit.
+      def restore_form_state(entry)
+        return unless entry && (state = entry[:form_state])
+        @runtime.call('__csimRestoreFormState', state) rescue nil
       end
 
       # Same-document = every entry between `from` and `to` (inclusive)
@@ -1993,22 +2087,54 @@ module Capybara
           @last_tick_ts = now
           effective_step = step_ms || horizon_fast_forward_step
           if @timers_active && effective_step > 0
-            r = @runtime.run_loop_step(effective_step)
-            # `dirtied` (settleGen changed) catches a render-phase rAF / microtask-
-            # delivered MutationObserver that mutated the DOM without firing a timer
-            # (fired == 0) — a fired-count-only test would leave a stale find cache.
-            @find_cache_dirty = true if r['dirtied'] || r['fired'].to_i > 0
+            # When the page has work runnable NOW (a rAF chain / timer burst — set
+            # by `horizon_fast_forward_step`), run the poll's worth of virtual time
+            # in frame-sized chunks so the page renders at real-browser cadence
+            # rather than one `POLL_TICK_STEP_MS` super-frame. The `step_ms` path
+            # (explicit `sleep` / `wait_for_timeout`) and idle/parked/fast-forward
+            # polls keep the single step — nothing is rendering frame-by-frame, so
+            # sub-stepping would only spin empty render phases. The tail-jump bails
+            # the moment a frame goes quiet, so a chain that settles early (or the
+            # rare quiet sub-step) doesn't pay for the unused remainder.
+            if step_ms.nil? && @page_runnable_now && effective_step > FRAME_STEP_MS
+              remaining = effective_step
+              # Share ONE task-iteration budget across the chunks so the per-poll
+              # cap matches the single-step path (each `run_loop_step` otherwise
+              # gets a fresh `RUN_LOOP_MAX_ITER`, so an always-due `setInterval(0)`
+              # busy loop could run N× the work). Exhausting it ends the poll —
+              # the clock is stuck on that loop either way.
+              iter_budget = RUN_LOOP_MAX_ITER
+              while remaining > 0 && iter_budget > 0
+                chunk = remaining < FRAME_STEP_MS ? remaining : FRAME_STEP_MS
+                r = @runtime.run_loop_step(chunk, iter_budget)
+                @find_cache_dirty = true if r['dirtied'] || r['fired'].to_i > 0
+                remaining    -= chunk
+                iter_budget  -= r['fired'].to_i
+                # Idle frame → nothing left to render frame-by-frame this poll: jump
+                # the remaining advance in one step (fires any timer parked within
+                # it). A still-queued rAF (`r['raf']`) is NOT idle — a non-mutating
+                # animation chain fires no timer and dirties nothing yet keeps
+                # rendering, so keep sub-stepping it at frame cadence.
+                if remaining > 0 && r['fired'].to_i.zero? && !r['dirtied'] && !r['raf']
+                  r = @runtime.run_loop_step(remaining, iter_budget)
+                  @find_cache_dirty = true if r['dirtied'] || r['fired'].to_i > 0
+                  break
+                end
+              end
+            else
+              r = @runtime.run_loop_step(effective_step)
+              # `dirtied` (settleGen changed) catches a render-phase rAF / microtask-
+              # delivered MutationObserver that mutated the DOM without firing a timer
+              # (fired == 0) — a fired-count-only test would leave a stale find cache.
+              @find_cache_dirty = true if r['dirtied'] || r['fired'].to_i > 0
+            end
           end
           # Pull any pending Worker / EventSource messages into JS
           # state. Without this, `evaluate_script` after kicking off
           # a worker round-trip would see stale state — the inbox
           # outbox only drains during `settle`, which doesn't run
           # for direct `execute_script` / `evaluate_script` calls.
-          @find_cache_dirty = true if deliver_worker_messages > 0
-          @find_cache_dirty = true if deliver_event_source_events > 0
-          @find_cache_dirty = true if deliver_hijacked_fetches > 0
-          @find_cache_dirty = true if deliver_window_messages > 0
-          @find_cache_dirty = true if deliver_websocket_events > 0
+          drain_async_channels
         ensure
           @ticking = false
         end
@@ -2032,6 +2158,142 @@ module Capybara
         consume_pending_download
       end
 
+      # Backstop on the per-frame quiescence loop — caps the event-loop turns
+      # processed at a single instant so a `setInterval(0)` (always-due) busy loop
+      # advances a frame and continues, rather than spinning forever. Generous:
+      # real frames here run hundreds of microtask/rAF turns (e.g. ~80 sequential
+      # rAF promise_tests, each ~2 render turns).
+      EVENT_LOOP_QUIESCENCE_CAP = 512
+
+      # Run ONE real-cadence event-loop frame and report the loop's observable
+      # state. A general primitive — it models a browser animation frame and knows
+      # nothing about any particular test harness; the WPT runner is its first
+      # caller (driving a page to completion one frame at a time). It advances the
+      # same virtual clock as the Capybara poll path: `tick_real_time` keeps its own
+      # per-poll BUDGET (a ~100 ms `horizon_fast_forward` step, tuned for app
+      # debounce observation) but, when the page has work runnable now, spends that
+      # budget in `FRAME_STEP_MS` chunks — the same frame cadence this primitive
+      # uses — so a page renders frame-by-frame regardless of which path drives it.
+      #
+      # A real browser processes EVERYTHING ready at the current instant within a
+      # single animation frame — microtasks, timers due now (incl. newly scheduled
+      # `setTimeout(0)`), the render-phase rAF callbacks, and the navigation /
+      # form-submit / worker chains they trigger — and only THEN advances ~16.67 ms
+      # to the next frame. Modelling that is essential: a multi-hop chain (a form →
+      # iframe-rebuild → onload → next-submit sequence, or N sequential rAF
+      # `promise_test`s) must complete inside a frame. Advancing the clock per host
+      # round-trip instead (the old WPT runner did ~3 `evaluate_script`s/frame, each
+      # a full ~100 ms `tick_real_time` poll tick) runs it ~20× real cadence, so a
+      # page that needs many frames trips a wall-clock-budget harness timeout long
+      # before its queue drains. Driving the loop here keeps real cadence (one frame
+      # interval per frame) while still completing the chains.
+      #
+      # Phase 1 — quiescence at the CURRENT virtual time: repeatedly run the loop
+      # with a ZERO advance (`run_loop_step(0)` fires only timers due now + the
+      # microtask checkpoints + the render phase) and drain the Ruby-side async /
+      # nav / form-submit / download chains they queue, until a turn makes no
+      # observable progress (or the backstop caps a busy loop). Phase 2 — advance
+      # exactly one frame so the next batch of timers comes due.
+      #
+      # Returns the loop state: `progressed` (this frame did real work — drives a
+      # caller's idle detection), `raf` (an animation frame is queued), `async` (a
+      # non-timer background channel — worker / SSE / hijacked fetch — is in
+      # flight), and `next_timer` (ms to the nearest scheduled timer, -1 = none, so
+      # a caller can tell a page PARKED on a near-future `setTimeout` from an idle
+      # one). Whether the page reached some application-level "done" state is the
+      # caller's concern — read it separately with `peek_script` (clock-free).
+      def run_event_loop_frame(frame_ms)
+        turns = 0
+        loop do
+          r = @runtime.run_loop_step(0)          # run only what's due NOW + microtasks + render; no clock advance
+          progressed = step_and_drain_progressed(r)
+          turns += 1
+          break unless progressed
+          break if turns >= EVENT_LOOP_QUIESCENCE_CAP
+        end
+        # Phase 2 — advance one real frame so the next batch of timers becomes due.
+        # Its work counts toward `progressed` too: a timer that first comes due in
+        # this advance (e.g. a `setTimeout(…, 8)` firing mid-frame) and the nav hop
+        # it queues are real progress, so a caller mustn't read the frame as idle.
+        frame_progressed = step_and_drain_progressed(@runtime.run_loop_step(frame_ms))
+        probe = dom_call('__csimEventLoopProbe')
+        {
+          'raf'        => !!probe['raf'],
+          'async'      => !!probe['async'],
+          # ms until the nearest scheduled timer (-1 = none). Lets a caller keep
+          # advancing while a near-future `setTimeout` is parked (a `step_timeout`-
+          # style wait) instead of declaring the page idle — see `__csimEventLoopProbe`.
+          'next_timer' => probe['nextTimer'].to_f,
+          # `turns > 1` ⇒ phase 1's quiescence did work (the trailing no-progress
+          # turn that ends the loop is the +1); OR phase 2's advance did.
+          'progressed' => turns > 1 || frame_progressed
+        }
+      end
+
+      # Drain the Ruby-side async / navigation / form-submit / download chains a
+      # `run_loop_step` (passed as `r`) may have queued, and report whether this
+      # step+drain made observable progress. Shared by both phases of
+      # `run_event_loop_frame`.
+      #
+      # A pending Ruby-side navigation/submit/reload intent counts as progress:
+      # draining it rebuilds a child frame realm and fires that iframe's `onload`
+      # synchronously, whose handler can queue the NEXT hop (submit-entity-body's
+      # `run_simple_test` chain: form.submit() → realm rebuild → onload → next
+      # form.submit()). That work happens entirely in the CHILD realm, so it bumps
+      # the child's `settleGen`, never the main realm's `settle_gen` we sample, and
+      # fires no main-realm timer. Snapshot the intent BEFORE draining: this call
+      # consumes one hop and the onload re-queues the next, which the following
+      # call sees — so the quiescence loop self-terminates when the chain ends.
+      private def step_and_drain_progressed(r)
+        pulled = drain_async_channels
+        invalidate_find_cache
+        drained_nav = pending_nav_intent?
+        drain_pending_navigation
+        consume_pending_form_submit
+        consume_pending_download
+        # `r['dirtied']` already covers settleGen changes DURING the step; compare
+        # the post-drain gen against the step's post-step gen (`r['gen']`, free —
+        # no extra crossing) to also catch a main-realm change the drains caused.
+        r['fired'].to_i.positive? || r['dirtied'] || pulled || drained_nav ||
+          @runtime.settle_gen != r['gen'].to_i
+      end
+
+      # Clock-FREE read of a JS expression in the active browsing context. Unlike
+      # `evaluate_script` (which ticks `tick_real_time` first), this is a bare
+      # `dom_call` and advances no virtual time — so a caller polling page state
+      # once per `run_event_loop_frame` (e.g. the WPT runner checking its harness's
+      # completion sentinel) doesn't perturb the frame cadence the loop maintains.
+      def peek_script(expr)
+        dom_call('__csimEvalScript', expr.to_s, marshal_args([]))
+      end
+
+      # Any Ruby-side navigation intent queued and waiting for `drain_pending_navigation`
+      # to act on it — the same set that method drains (location / frame nav / frame
+      # submit / frame reload / reload / history traverse). The quiescence loop treats
+      # a queued intent as progress because draining it does cross-realm work (rebuild
+      # a child frame realm + fire its `onload`) that the main-realm `settleGen` /
+      # fired-timer signals can't see. Aux-window opens are intentionally excluded:
+      # they build a separate Browser, not a hop in a same-page chain.
+      private def pending_nav_intent?
+        !@pending_location.nil? ||
+          @pending_reload ||
+          !@pending_history_traverse.nil? ||
+          !(@pending_frame_nav || {}).empty? ||
+          !(@pending_frame_submit || []).empty? ||
+          !(@pending_frame_reload || []).empty?
+      end
+
+      # Pull every background async channel (Worker / EventSource / hijacked fetch
+      # / postMessage / WebSocket) into JS state, marking the find cache dirty if
+      # any delivered. Shared by `tick_real_time` and `run_event_loop_frame`.
+      # Returns true if any channel delivered.
+      private def drain_async_channels
+        n = deliver_worker_messages + deliver_event_source_events + deliver_hijacked_fetches +
+            deliver_window_messages + deliver_websocket_events
+        @find_cache_dirty = true if n.positive?
+        n.positive?
+      end
+
       # This tick's deterministic virtual-clock advance (ms). Default is the fixed
       # `POLL_TICK_STEP_MS` — never wall-derived, so per-poll JS/Ruby/GC cost cannot
       # shift WHEN a timer fires (the wall-sync↔perf coupling this replaces). When
@@ -2040,6 +2302,11 @@ module Capybara
       # it — but only after the transient-guard window so pre-debounce states are
       # still observed across several polls. `FF_HORIZON_MS=0` ⇒ pure fixed-step.
       def horizon_fast_forward_step
+        # Whether the page has work runnable at the CURRENT instant (a rAF or a
+        # due-now timer). Only then does `tick_real_time` sub-step the advance into
+        # frames — an idle/parked poll has nothing to render frame-by-frame, so it
+        # stays a single step (no extra render phases on the common idle-wait poll).
+        @page_runnable_now = false
         # Escape hatch to the legacy wall-sync clock (virtual advance = real
         # wall-elapsed per poll). The deterministic model decouples perf from
         # timing but can't match a real browser's wall-proportional cadence for
@@ -2064,6 +2331,7 @@ module Capybara
         # (2) Runnable now → fixed step, reset guard (not a quiet pre-debounce window).
         if delay.zero?
           @ff_transient_polls = 0
+          @page_runnable_now  = true
           return POLL_TICK_STEP_MS
         end
         # (3) Nothing parked → nothing to fast-forward to.
@@ -2109,95 +2377,173 @@ module Capybara
       attr_reader :context_gen
 
       # Pulls the serialised form-state out of JS, encodes it, and
-      # drives the Rack app via `navigate` (for GET) or a POST.
-      def submit_form_handle(form_handle, submitter_handle)
+      # drives the Rack app via `navigate` (for GET) or a POST. `entry_list` is the
+      # list JS already constructed (post-`formdata`, so a handler's append/delete
+      # is honoured); when absent (the Enter implicit-submit path) we build it from
+      # the form's own controls.
+      def submit_form_handle(form_handle, submitter_handle, entry_list = nil)
         invalidate_find_cache
         spec = dom_call('__csimFormSerialize', form_handle, submitter_handle || 0)
         return unless spec.is_a?(Hash)
         action  = spec['action'].to_s
         method  = spec['method'].to_s.upcase
         method  = 'GET' if method.empty?
-        fields  = (spec['fields'] || []).map {|pair| [pair[0].to_s, pair[1].to_s] }
-        file_inputs = spec['fileInputs'] || []
-        enctype = spec['enctype'].to_s
-        multipart = enctype.start_with?('multipart/form-data')
-        content_type = nil
-        body =
-          if multipart
-            built = build_multipart_body(fields, file_inputs)
-            content_type = built[:content_type]
-            built[:body]
-          else
-            # Non-multipart: file inputs contribute the filename only.
-            file_inputs.each do |fi|
-              picks = @file_picks && @file_picks[fi['handle'].to_i] || []
-              fields << [fi['name'].to_s, picks.first ? File.basename(picks.first) : '']
-            end
-            URI.encode_www_form(fields)
-          end
+        enctype = spec['enctype'].to_s.empty? ? 'application/x-www-form-urlencoded' : spec['enctype'].to_s.downcase
+        entries = entry_list.is_a?(Array) ? entry_list : entries_from_spec(spec)
         action_url = action.empty? ? (current_browsing_context_url || @default_host) : resolve_against_current(action)
         # A form submitted inside a frame whose target is that frame (self, or a
         # `_parent` of a ≥2-deep frame) navigates the FRAME, not the top page.
         frame_entry = frame_nav_target_entry(spec['target'])
+        # A non-frame named target (`_blank`, or a window name that isn't a frame)
+        # submits into a NEW/named browsing context — open (or reuse) an aux window,
+        # mirroring the link `target=_blank` branch. `_blank` is always a fresh window;
+        # a named target that matches THIS window's own `window.name` navigates in
+        # place (HTML named-context targeting), so it isn't a new window.
+        target = spec['target'].to_s
+        named_target = frame_entry.nil? && !target.empty? &&
+                       !%w[_self _top _parent].include?(target.downcase) &&
+                       @driver.respond_to?(:open_aux_window)
+        own_name   = named_target ? (@runtime.call('__csimReadWindowProp', false, 'name').to_s rescue '') : ''
+        new_window = named_target && (target.casecmp?('_blank') || target != own_name)
+        window_name = target.casecmp?('_blank') ? '' : target
+        # Opener exposure for a `<form target>` new context, per the link-relation
+        # model: `noopener`/`noreferrer` always drop the opener; `target=_blank`
+        # ALSO defaults to noopener unless `rel=opener` opts back in (a named target
+        # keeps its opener by default). `noreferrer` additionally empties the referrer.
+        rel_tokens  = spec['rel'].to_s.downcase.split(/\s+/)
+        no_referrer = rel_tokens.include?('noreferrer')
+        keep_opener = !no_referrer && !rel_tokens.include?('noopener') &&
+                      (target.downcase != '_blank' || rel_tokens.include?('opener'))
+        referrer    = no_referrer ? '' : (@current_url || '')
+        # Opening a new top-level browsing context consumes transient user activation.
+        @runtime.call('__csimConsumeTransientActivation') if new_window rescue nil
         if method == 'GET'
+          # GET ignores enctype: the entry list is always the urlencoded query.
+          query, = encode_entry_list(entries, 'application/x-www-form-urlencoded')
           uri = URI.parse(action_url)
-          uri.query = body unless body.empty?
-          frame_entry ? navigate_frame(uri.to_s, entry: frame_entry) : navigate(uri.to_s)
-        elsif frame_entry
-          navigate_frame_post(action_url, body, content_type || enctype, entry: frame_entry)
+          # HTML "mutate action URL" for GET: SET the query to the entry list
+          # unconditionally — an empty list clears any query the action already
+          # carried (browsers navigate to `action?`), it isn't preserved.
+          uri.query = query
+          if new_window
+            @driver.open_aux_window(uri.to_s, name: window_name, source: self,
+                                    opener: keep_opener, referrer: referrer)
+          elsif frame_entry
+            navigate_frame(uri.to_s, entry: frame_entry)
+          else
+            navigate(uri.to_s)
+          end
         else
-          navigate_post(action_url, body, content_type || enctype)
+          body, content_type = encode_entry_list(entries, enctype)
+          if new_window
+            @driver.open_aux_window(action_url, name: window_name, source: self,
+                                    opener: keep_opener, referrer: referrer,
+                                    post: {body: body, content_type: content_type})
+          elsif frame_entry
+            navigate_frame_post(action_url, body, content_type, entry: frame_entry)
+          else
+            navigate_post(action_url, body, content_type)
+          end
         end
       end
 
-      def build_multipart_body(fields, file_inputs)
-        boundary = "csim-#{SecureRandom.hex(8)}"
-        body     = String.new.force_encoding(Encoding::ASCII_8BIT)
-        fields.each do |name, value|
-          append_multipart_part(body, boundary, name, value.to_s)
-        end
-        file_inputs.each do |fi|
-          picks = file_pick_paths(fi)
-          if picks.empty?
-            append_multipart_part(body, boundary, fi['name'].to_s, '', filename: '')
-          else
-            picks.each do |path|
-              append_multipart_part(body, boundary, fi['name'].to_s, File.binread(path),
-                                    filename:     File.basename(path),
-                                    content_type: Rack::Mime.mime_type(File.extname(path)))
+      # HTML "encode the entry list" by enctype → [body, exact Content-Type]. The
+      # Content-Type is sent verbatim (no charset suffix), which the spec's
+      # form-submission resources compare exactly. text/plain is `name=value\r\n`
+      # per entry (NOT urlencoded); urlencoded (and GET) merge each file entry as
+      # its bare filename. `entries` is the ordered entry list — string
+      # {'name','value'} or file {'name','file'=>true,'filename','handle','index'}
+      # entries; a file's bytes resolve through the `@file_picks` slot.
+      def encode_entry_list(entries, enctype)
+        if enctype.start_with?('multipart/form-data')
+          boundary = "csim-#{SecureRandom.hex(8)}"
+          body     = String.new.force_encoding(Encoding::ASCII_8BIT)
+          entries.each do |e|
+            if e['file']
+              path = entry_file_path(e)
+              if path
+                append_multipart_part(body, boundary, e['name'].to_s, File.binread(path),
+                                      filename:     File.basename(path),
+                                      content_type: Rack::Mime.mime_type(File.extname(path)))
+              elsif e['b64']
+                # An in-memory `new File([…])` has no on-disk slot; its bytes are
+                # carried base64-encoded from the VM. Decode them for the part body.
+                content = e['b64'].to_s.unpack1('m')
+                ct      = e['type'].to_s
+                ct      = 'application/octet-stream' if ct.empty?
+                append_multipart_part(body, boundary, e['name'].to_s, content,
+                                      filename: e['filename'].to_s, content_type: ct)
+              else
+                append_multipart_part(body, boundary, e['name'].to_s, '', filename: e['filename'].to_s)
+              end
+            else
+              append_multipart_part(body, boundary, e['name'].to_s, e['value'].to_s)
             end
           end
+          body << "--#{boundary}--\r\n"
+          [body, "multipart/form-data; boundary=#{boundary}"]
+        else
+          # The urlencoded / text-plain encoders normalize CR/LF → CRLF in each entry's
+          # name and value (a file entry's filename is the value) — the entry list itself
+          # stays raw, so normalization lives here, matching the JS encoders and real
+          # browsers (newline-normalization.html).
+          pairs = entries.map {|e|
+            [normalize_form_newlines(e['name']), normalize_form_newlines(e['file'] ? e['filename'] : e['value'])]
+          }
+          if enctype == 'text/plain'
+            [pairs.map {|name, value| "#{name}=#{value}\r\n" }.join, 'text/plain']
+          else
+            [URI.encode_www_form(pairs), 'application/x-www-form-urlencoded']
+          end
         end
-        body << "--#{boundary}--\r\n"
-        {content_type: "multipart/form-data; boundary=#{boundary}", body: body}
       end
 
-      # The on-disk paths backing a file input's current selection. Each
-      # selected File reports its host-backed source (`handle`/`index` → the
-      # `@file_picks` slot recorded at `attach_file` time); this resolves bytes
-      # even when JS moved a File onto a different input (`input.files =
-      # dataTransfer.files`), whose own handle was never attached to. Falls back
-      # to the input's own handle for older serializer payloads.
-      #
-      # Only host-backed Files (from `attach_file`) resolve here; a purely
-      # in-memory `new File(['bytes'], …)` assigned via JS has no `@file_picks`
-      # slot, so a CLASSIC (non-Turbo) submit drops its bytes — the fetch/XHR
-      # path serializes those in JS (`serializeMultipart` → `blobBytes`) and is
-      # unaffected. This matches the pre-existing behaviour and covers every
-      # realistic upload (host-backed file submitted through Turbo or a plain
-      # form).
-      def file_pick_paths(fi)
-        refs = fi['files']
-        if refs.is_a?(Array) && !refs.empty?
-          refs.filter_map {|ref|
-            handle = ref['handle']
-            next if handle.nil?
-            picks = @file_picks && @file_picks[handle.to_i]
-            picks && picks[ref['index'].to_i]
-          }
-        else
-          (@file_picks && @file_picks[fi['handle'].to_i]) || []
+      # HTML form-submission newline normalization: every lone CR, lone LF, and CRLF in an
+      # entry name/value becomes a CRLF (the JS encoders' `normalizeNL` counterpart).
+      def normalize_form_newlines(s)
+        s.to_s.gsub(/\r\n?|\n/, "\r\n")
+      end
+
+      # Resolve a threaded file entry's on-disk path via the `@file_picks` slot
+      # recorded at `attach_file` time (handle/index). nil for a purely in-memory
+      # `new File(['bytes'], …)` (no slot) — a CLASSIC (non-Turbo) submit then
+      # drops its bytes, while the fetch/XHR path serializes them in JS
+      # (`serializeMultipart` → `blobBytes`). This covers every realistic upload
+      # (a host-backed file submitted through Turbo or a plain form).
+      def entry_file_path(entry)
+        handle = entry['handle']
+        return nil if handle.nil?
+        picks = @file_picks && @file_picks[handle.to_i]
+        picks && picks[entry['index'].to_i]
+      end
+
+      # Build the entry list from the form's own controls, for triggers that didn't
+      # construct one in JS (the Enter implicit-submit path). Mirrors the JS FormData
+      # construction: non-file fields in tree order, then each file input's selection
+      # (one empty entry when nothing is picked). A selected File reports its
+      # host-backed source (`handle`/`index`); the older payload shape with no per-File
+      # refs falls back to the input's own handle slot.
+      def entries_from_spec(spec)
+        entries = (spec['fields'] || []).map {|pair| {'name' => pair[0].to_s, 'value' => pair[1].to_s} }
+        (spec['fileInputs'] || []).each do |fi|
+          name = fi['name'].to_s
+          refs = fi['files']
+          if refs.is_a?(Array) && !refs.empty?
+            refs.each {|ref|
+              entries << {'name' => name, 'file' => true, 'filename' => ref['name'].to_s, 'handle' => ref['handle'], 'index' => ref['index']}
+            }
+          else
+            picks = (@file_picks && @file_picks[fi['handle'].to_i]) || []
+            if picks.empty?
+              entries << {'name' => name, 'file' => true, 'filename' => '', 'handle' => nil, 'index' => nil}
+            else
+              picks.each_index {|i|
+                entries << {'name' => name, 'file' => true, 'filename' => File.basename(picks[i]), 'handle' => fi['handle'], 'index' => i}
+              }
+            end
+          end
         end
+        entries
       end
 
       def append_multipart_part(body, boundary, name, content, filename: nil, content_type: nil)
@@ -2211,14 +2557,17 @@ module Capybara
         body << "\r\n"
       end
 
-      def navigate_post(url, body, content_type, depth: 0, from_history: false)
+      def navigate_post(url, body, content_type, depth: 0, from_history: false, referer: @current_url)
         raise 'too many redirects' if depth > 10
         invalidate_find_cache
-        record_history({method: :post, url: url, body: body, content_type: content_type}) unless from_history || depth > 0
+        unless from_history || depth > 0
+          capture_outgoing_form_state
+          record_history({method: :post, url: url, body: body, content_type: content_type})
+        end
         env = Rack::MockRequest.env_for(url, method: 'POST', input: body)
         env['CONTENT_TYPE']   = content_type.empty? ? 'application/x-www-form-urlencoded' : content_type
         env['CONTENT_LENGTH'] = body.bytesize.to_s
-        apply_default_request_env(env, referer: @current_url)
+        apply_default_request_env(env, referer: referer)
         status, headers, resp_body = dispatch_rack_or_http(url, env, method: 'POST', body: body)
         merge_set_cookie(headers)
         if (loc = redirect_location(status, headers))
@@ -2277,6 +2626,11 @@ module Capybara
         reset_frame_scope
         @history.clear
         @history_idx     = -1
+        @cors_preflight_cache = {}   # CORS-preflight cache is per browsing context
+        # A JS-driven history.back()/go() that scheduled a deferred traverse but
+        # never drained (the page navigated away first) must not survive the reset
+        # — otherwise the stale target replays against the NEXT page's fresh history.
+        @pending_history_traverse = nil
         @file_picks      = {} if @file_picks
         # Hand the live trace off to `@pending_trace` so an after-hook
         # running after `reset_session!` (Capybara's per-test teardown
@@ -2386,7 +2740,14 @@ module Capybara
       # Returns nil on 4xx / fetch failure so the JS caller skips it exactly as the
       # old `__rackFetch` branch did.
       def external_asset_source(url)
-        key = resolve_against_current(url.to_s)
+        # A blob:/data:/about: document's location can't anchor an absolute-path
+        # `src=/common/…` (URI.join on a `blob:` URL yields nothing usable), but its
+        # `<base href>` points at a real http(s) origin — so for THOSE documents
+        # resolve against `<base href>` (HTML base-tag semantics) and the script loads.
+        # Ordinary http(s) pages keep the document-URL base so the hot path skips the
+        # `base_href` dom_call (CLAUDE.md rule 3).
+        needs_base = @current_url.to_s.start_with?('blob:', 'data:', 'about:')
+        key = resolve_against_current(url.to_s, use_base: needs_base)
         return nil unless key.is_a?(String)
         @@asset_src_lock.synchronize do
           if (e = @@asset_src[key])
@@ -3064,28 +3425,48 @@ module Capybara
       # worker's `__csim_workerPostMessage` host fn closes over its
       # handle and routes outgoing messages onto a shared outbox the
       # main settle drains.
-      def worker_spawn(url, shared: false)
+      def worker_spawn(url, shared: false, service: false)
         handle       = (@worker_seq += 1)
+        target       = resolve_against_current(url.to_s)
+        # A worker script from a blob: URL in a DIFFERENT storage partition than this
+        # context can't be created (cross-partition-worker-creation): the worker would
+        # run in the creating context's partition, not the blob's. Deliver an error so
+        # Worker/SharedWorker fires `onerror`, and spawn no thread. The handle is still
+        # >0 so the JS registers the worker and the queued __error reaches it.
+        if target.start_with?('blob:') && @driver.respond_to?(:cross_partition_blob?) && @driver.cross_partition_blob?(target, self)
+          return worker_fail(handle, 'Worker creation from a cross-partition blob URL is blocked')
+        end
         inbox        = Thread::Queue.new
         outbox       = @worker_outbox
         engine_class = @runtime.class
-        target       = resolve_against_current(url.to_s)
         # Resolve the worker script body on the main thread before
         # handing off to the worker. `blob:` URLs need the main VM's
         # blob registry; calling into the main runtime from a
         # non-owning thread SEGVs (V8 isolates are thread-
         # bound; quickjs.rb's VM is similarly per-thread).
         body = fetch_worker_script(target)
+        # A blob: worker script that didn't resolve (revoked / unavailable) fails the
+        # same way — fire onerror rather than spawn a worker that runs nothing.
+        return worker_fail(handle, 'Worker script could not be loaded') if target.start_with?('blob:') && body.to_s.empty?
         # Pending until the worker's initial script has run (see @worker_initializing).
         @worker_init_lock.synchronize { @worker_initializing += 1 }
         thread = Thread.new do
           Thread.current.report_on_exception = false
-          run_worker(handle, target, body, inbox, outbox, engine_class, shared: shared)
+          run_worker(handle, target, body, inbox, outbox, engine_class, shared: shared, service: service)
         end
         @workers[handle] = {thread: thread, inbox: inbox}
         handle
       end
 
+      # Fail a worker that can't be created (blocked / unloadable script): queue an
+      # error event so the JS Worker/SharedWorker fires `onerror`, spawn no thread,
+      # and return the (still >0) handle so the JS registers the worker and the error
+      # reaches it.
+      private def worker_fail(handle, message)
+        @worker_outbox << {handle: handle, kind: '__error', message: message}
+        handle
+      end
+
       def worker_post_to_worker(handle, data)
         w = @workers[handle.to_i]
         return unless w
@@ -3137,9 +3518,32 @@ module Capybara
       # `window.open(url, name)` from JS — returns the new (or reused, by name)
       # window's handle, or nil. The URL is resolved against THIS document so a
       # relative `window.open('/x')` targets the right origin/path.
-      def open_child_window(url, name)
+      def open_child_window(url, name, opener_realm_id = 0)
         return nil unless @driver.respond_to?(:open_window_from_js)
-        @driver.open_window_from_js(self, url.to_s, name.to_s)
+        @driver.open_window_from_js(self, url.to_s, name.to_s, opener_realm_id.to_i)
+      end
+
+      # A `target=_blank`/named link/area activation from a frame or window realm in
+      # THIS browser opens a new top-level auxiliary window. `opener` reflects
+      # rel=opener (a bare target=_blank is noopener); the Driver forces noopener for
+      # a cross-partition blob: target. `blob` is an optional click-time blob snapshot.
+      def open_aux_from_realm(url, opener, blob)
+        return unless @driver.respond_to?(:open_aux_window)
+        snap = blob.is_a?(Hash) ? blob : nil
+        @driver.open_aux_window(resolve_document_url(url.to_s), source: self, opener: !!opener, blob_snapshot: snap)
+      end
+
+      # Open a SAME-ORIGIN auxiliary window as a realm in THIS browser's isolate
+      # (shared heap) rather than a separate Browser/VM, returning the new realm's
+      # context id for `window.open` to wrap in a NATIVE WindowProxy — so
+      # `popup.document` is a real same-isolate Document and cross-window adoptNode
+      # works (dom/nodes/remove-and-adopt-thcrash). Returns nil to fall back to the
+      # separate-VM aux-window path. First stage: about:blank only (a non-blank
+      # same-origin URL still takes the aux path until realm URL-loading lands).
+      def open_window_realm(url, name: nil, opener_realm_id: 0)
+        return nil unless @runtime.respond_to?(:create_window_realm)
+        return nil unless url.nil?
+        @runtime.create_window_realm('', '', 'text/html', window_name: name, opener_id: opener_realm_id)
       end
 
       # `targetWindow.postMessage(data, origin)` — route to the target window's
@@ -3154,6 +3558,41 @@ module Capybara
       # route to the Driver, which reads a PRIMITIVE off the target window's VM.
       def window_get(handle, prop)     = (@driver.respond_to?(:window_read) ? @driver.window_read(handle.to_s, prop.to_s, doc: false) : nil)
       def window_doc_get(handle, prop) = (@driver.respond_to?(:window_read) ? @driver.window_read(handle.to_s, prop.to_s, doc: true)  : nil)
+      # Cross-window remote-ref RPC — SOURCE side: forward a node/object proxy op to
+      # the target window's Browser via the Driver.
+      def window_ref_get(handle, id, prop)         = (@driver.respond_to?(:window_ref_get) ? @driver.window_ref_get(handle.to_s, id, prop.to_s) : nil)
+      def window_ref_set(handle, id, prop, value)  = (@driver.window_ref_set(handle.to_s, id, prop.to_s, value) if @driver.respond_to?(:window_ref_set))
+      def window_ref_call(handle, id, method, args) = (@driver.respond_to?(:window_ref_call) ? @driver.window_ref_call(handle.to_s, id, method.to_s, args) : nil)
+      # TARGET side: execute the op against THIS window's VM (the Driver calls these
+      # on the resolved target Browser).
+      def remote_ref_get(id, prop)          = @runtime.call('__csimRemoteRefGet', id, prop.to_s)
+      def remote_ref_set(id, prop, value)
+        @runtime.call('__csimRemoteRefSet', id, prop.to_s, value)
+        # A cross-isolate property set can queue a navigation in THIS (target)
+        # window — `w.location.href = …` / `w.location = …`. Drain it (and any other
+        # pending action it triggered) so the non-active window actions it now.
+        drain_pending_after_remote_ref
+        nil
+      end
+      def remote_ref_call(id, method, args)
+        result = @runtime.call('__csimRemoteRefCall', id, method.to_s, args || [])
+        # A cross-isolate call can queue a pending action in THIS (target) window —
+        # `w.form.submit()` (form submit), `w.history.back()` (history traverse),
+        # `w.location.assign()` (navigation). Drain them so the non-active window
+        # actions them (they would otherwise wait for a Capybara action on it).
+        drain_pending_after_remote_ref
+        result
+      end
+      # Drain every deferred action a cross-isolate operation may have queued in this
+      # window: form submission, plain navigation, same-document history traversal
+      # (history.back/forward/go — restores the previous entry + fires load), and
+      # child-frame navigation. Each consume is a no-op when nothing is pending.
+      def drain_pending_after_remote_ref
+        consume_pending_form_submit
+        consume_pending_navigation
+        consume_pending_history_traverse
+        consume_pending_frame_nav
+      end
       # Read a primitive property off THIS window's globalThis / document — called
       # by the Driver to serve another window's cross-window proxy read.
       def read_property(prop, doc: false)
@@ -3162,9 +3601,13 @@ module Capybara
         nil
       end
       def set_window_location(handle, url) = (@driver.window_set_location(handle.to_s, url.to_s) if @driver.respond_to?(:window_set_location))
+      def window_history_go(handle, delta) = (@driver.respond_to?(:window_history_go) ? @driver.window_history_go(handle.to_s, delta.to_i) : false)
       def window_closed?(handle)       = @driver.respond_to?(:window_closed?)      ? @driver.window_closed?(handle.to_s)           : true
       def close_child_window(handle)   = (@driver.close_window(handle.to_s) if @driver.respond_to?(:close_window))
       def opener_handle                = @driver.respond_to?(:opener_handle_of)    ? @driver.opener_handle_of(self)                : nil
+      # Fire an aux window's own window `load` (called by its opener, deferred).
+      def fire_aux_window_load(handle)  = (@driver.fire_aux_window_load(handle.to_s) if @driver.respond_to?(:fire_aux_window_load))
+      def fire_own_window_load          = (@runtime.call('__csimFireWindowLoad') rescue nil)
 
       # Queue a cross-window message for delivery into THIS window's VM (called
       # by the Driver on the target Browser). Delivered as a `message` event the
@@ -3177,9 +3620,13 @@ module Capybara
       # cross-window event channels share these drain/pending hooks.
       def window_message_pending? = !@window_inbox.empty? || !@broadcast_inbox.empty?
 
-      # A BroadcastChannel message from another window, queued for delivery to
-      # this window's channels with the same name.
-      def enqueue_broadcast(name, data) = (@broadcast_inbox << {'name' => name.to_s, 'data' => data})
+      # A BroadcastChannel message queued for delivery to this Browser's channels.
+      # `source_realm_id` is the posting realm's context id within THIS isolate (0 =
+      # main), or nil when the post came from ANOTHER isolate (the Driver's cross-
+      # window fanout) — a nil source matches no local realm, so it reaches every one.
+      def enqueue_broadcast(name, data, source_realm_id = nil)
+        @broadcast_inbox << {'name' => name.to_s, 'data' => data, 'source' => source_realm_id}
+      end
 
       # Fire queued cross-window messages (postMessage + BroadcastChannel).
       def deliver_window_messages
@@ -3191,16 +3638,39 @@ module Capybara
         end
         unless @broadcast_inbox.empty?
           events = @broadcast_inbox.slice!(0, @broadcast_inbox.length)
-          @runtime.call('__csim_deliverBroadcasts', events)
+          # A BroadcastChannel reaches every same-origin browsing context EXCEPT the
+          # poster. Within this isolate each browsing context is a realm, so deliver to
+          # the main realm (0) and every live frame/window realm, skipping the realm
+          # that posted (it already delivered to itself in-VM via `_bcChannels`). A nil
+          # source (cross-isolate) is excluded from no realm.
+          realm_ids = @runtime.respond_to?(:frame_realm_ids) ? @runtime.frame_realm_ids : []
+          [0, *realm_ids].each do |target_id|
+            batch = events.reject {|e| e['source'] == target_id }
+            next if batch.empty?
+            if target_id.zero?
+              @runtime.call('__csim_deliverBroadcasts', batch)
+            elsif @runtime.frame_realm_alive?(target_id)
+              @runtime.realm_call(target_id, '__csim_deliverBroadcasts', batch)
+            end
+          end
           n += events.size
         end
         n
       end
 
-      # `BroadcastChannel.postMessage` in THIS window — fan out to every OTHER
-      # window's matching channels (same-window delivery happens in-VM).
-      def broadcast_to_windows(name, data)
+      # `BroadcastChannel.postMessage` in THIS window — fan out to every OTHER same-
+      # origin browsing context's matching channels (same-realm delivery happens
+      # in-VM). `source_realm_id` is the posting realm's context id. The cross-ISOLATE
+      # fanout goes through the Driver; the same-ISOLATE fanout (main ↔ sibling realms,
+      # sibling ↔ sibling) is queued here and delivered per-realm by
+      # `deliver_window_messages`, which skips the posting realm.
+      def broadcast_to_windows(name, data, source_realm_id = 0)
         @driver.broadcast_channel(self, name.to_s, data) if @driver.respond_to?(:broadcast_channel)
+        # Only queue for same-isolate delivery when sibling realms exist — a single-
+        # realm page already delivered to itself in-VM, so this stays zero-overhead.
+        if @runtime.respond_to?(:frame_realm_ids) && @runtime.frame_realm_ids.any?
+          enqueue_broadcast(name, data, source_realm_id.to_i)
+        end
       end
 
       # ── Image decode (libvips) ─────────────────────────────────────
@@ -3281,13 +3751,53 @@ module Capybara
           # that context would wrongly revoke a now-page-owned URL.
           if key then @blob_owners[url.to_s] = key else @blob_owners.delete(url.to_s) end
         end
+        # Record the blob's STORAGE PARTITION (this window's top-level site) in the
+        # Driver-level store so another window can resolve it only from the same
+        # partition (blob URL partitioning). Keyed by the creating Browser so the
+        # bytes are read back from wherever they live (the creator's isolate).
+        @driver.register_blob_partition(url.to_s, self, blob_partition_site) if @driver.respond_to?(:register_blob_partition)
         nil
       end
 
       def blob_resolve(url)
+        # A same-partition blob created in another window/isolate is spec-fetchable
+        # cross-window, but resolving its bytes means a real-time cross-isolate read
+        # (+ worker round-trips for the worker variants) that races the per-example
+        # timeout under suite load — flaky in the gate. So we only resolve a blob from
+        # THIS window's registry; the cross-window same-partition fetch is a backlog
+        # item (cross-partition.https "fetched from a same-partition {iframe,worker}").
         @blob_registry_lock.synchronize { @blob_registry[url.to_s] }
       end
 
+      # The SITE (scheme + registrable domain) of this window's top-level document.
+      # Storage partitioning keys a blob URL on its creator's top-level site, so a
+      # same-origin iframe embedded in a cross-site top-level context is a DIFFERENT
+      # partition and can't reach the blob. Registrable domain is approximated as the
+      # host's last two dot-labels — correct for the single-label public suffixes our
+      # in-process hosts use (web-platform.test / not-web-platform.test / *.com); a
+      # full Public Suffix List isn't warranted here.
+      def blob_partition_site
+        # A blob: document's location is `blob:<innerURL>` (e.g.
+        # `blob:https://host:port/uuid`) — strip the prefix so the site derives from
+        # the inner origin, not the opaque blob: scheme. data:/about: have no host →
+        # '' (an opaque origin, never same-partition with a real one).
+        u = URI.parse(@current_url.to_s.sub(/\Ablob:/, ''))
+        host = u.host.to_s
+        return '' if host.empty?
+        labels = host.split('.')
+        # An IP literal (v4 dotted / v6 bracketed) or a ≤2-label host IS its own
+        # registrable domain; otherwise approximate eTLD+1 as the last two labels
+        # (no Public Suffix List — correct for the single-label TLDs our hosts use).
+        regd = if host.start_with?('[') || host.match?(/\A\d+(\.\d+){3}\z/) || labels.length <= 2
+          host
+        else
+          labels.last(2).join('.')
+        end
+        "#{u.scheme}://#{regd}"
+      rescue URI::Error
+        ''
+      end
+
       # WHATWG URL "domain to ASCII" — the JS tr46 stub delegates non-ASCII / xn--
       # hosts here (the ASCII fast path stays in-VM). Returns the punycode form, or
       # nil on an IDNA failure (so whatwg-url reports "domain to ASCII failed").
@@ -3295,10 +3805,25 @@ module Capybara
       # VerifyDnsLength off) — empty middle labels (`x..y`) and `_`/etc. are
       # allowed, matching whatwg-url's `domainToASCII(domain, false)`.
       def domain_to_ascii(domain)
-        URI::IDNA.whatwg_to_ascii(domain.to_s, be_strict: false)
+        d = domain.to_s
+        # An all-ASCII domain needs no IDNA mapping: WHATWG "domain to ASCII"
+        # (beStrict false) keeps it verbatim and only ASCII-lowercases it — including
+        # an `xn--` A-label whose punycode doesn't decode to a valid UTS46 label
+        # (`xn--pokxncvks` → disallowed U+3253…, or the bare `xn--`). Browsers (and the
+        # WPT urltestdata) keep those A-labels as-is; uri-idna RE-validates the decoded
+        # label and raises, which would wrongly fail the parse. So route only domains
+        # with non-ASCII codepoints (the ones that actually need punycode) through
+        # uri-idna. Forbidden host code points in an ASCII host are caught separately
+        # by whatwg-url's host parser, not here. (Residual: a host MIXING a non-ASCII
+        # label with a non-decodable `xn--` label still routes through uri-idna and
+        # fails — a narrow per-label gap no current test hits; the all-ASCII fast path
+        # covers every observed case.)
+        return d.downcase if d.ascii_only?
+        URI::IDNA.whatwg_to_ascii(d, be_strict: false)
       rescue URI::IDNA::Error
-        nil   # a genuine IDNA failure (bad punycode / disallowed codepoint) — let
-              # whatwg-url report "domain to ASCII failed". Non-IDNA errors propagate.
+        nil   # a genuine IDNA failure on a non-ASCII host (bad punycode / disallowed
+              # codepoint) — let whatwg-url report "domain to ASCII failed". Non-IDNA
+              # errors propagate.
       end
 
       # WHATWG URL "domain to Unicode" — best-effort (never fails the parse per
@@ -3334,20 +3859,62 @@ module Capybara
         # type (url-charset) is preserved so it can override <meta charset>.
         ct = "#{ct};charset=utf-8" unless ct.downcase.include?('charset')
         record_response(200, {'content-type' => ct})
+        b64 = Base64.strict_encode64(bytes.to_s.b)
+        # Make the blob URL fetchable from the document we're about to load — a blob:
+        # document that fetches itself (or a media `src` first-party load) snapshots
+        # the bytes SYNCHRONOUSLY at fetch() time, which runs DURING boot below, so the
+        # bytes must be registered in this window's @blob_registry FIRST. No partition
+        # entry — the blob keeps its original storage partition; this only makes it
+        # first-party-fetchable in the window it was navigated into.
+        @blob_registry_lock.synchronize { @blob_registry[url.to_s] = b64 }
         boot_response_into_ctx(bytes)
+        # Adopt into the in-VM store too, so a LATER resolve keeps the correct content
+        # type (the @blob_registry b64 path resolves as application/octet-stream).
+        @runtime.call('__csimAdoptBlobBytes', url.to_s, b64, content_type.to_s) rescue nil
       end
 
+      # A user-initiated `URL.revokeObjectURL`. Storage-partitioned + cross-isolate:
+      # the Driver vetoes a cross-partition revoke (a same-origin but cross-top-level-
+      # site context can't revoke the blob — cross-partition.https) and, for a
+      # same-partition revoke, invalidates the blob in the CREATOR's isolate too so
+      # every window stops resolving it (the blob may have been created in another
+      # window). (Context-teardown revokes go through revoke_owned_blobs, not here.)
       def blob_unregister(url)
-        @blob_registry_lock.synchronize { @blob_registry.delete(url.to_s); @blob_owners.delete(url.to_s) }
+        if @driver.respond_to?(:revoke_blob_partitioned)
+          return nil unless @driver.revoke_blob_partitioned(url.to_s, self)
+        elsif @driver.respond_to?(:unregister_blob_partition)
+          @driver.unregister_blob_partition(url.to_s)
+        end
+        drop_local_blob(url)
         nil
       end
 
+      # Forget a blob URL in THIS isolate: its validity marker / bytes in
+      # @blob_registry and its in-VM store entry. Called for a local revoke and, via
+      # the Driver, when another same-partition window revokes a blob this isolate
+      # created. The @blob_registry removal is the AUTHORITATIVE invalidation
+      # (resolveBlobBytes gates on it cross-realm); the in-VM `__csimDropBlob` is a
+      # same-thread V8 call, so it's skipped on a worker thread — a worker's
+      # `revokeObjectURL` forwards here on the WORKER thread, and calling a
+      # thread-confined isolate from a non-owning thread SEGVs (V8/quickjs isolates
+      # are thread-bound). The stale in-VM entry is harmless: resolveBlobBytes returns
+      # null once the registry marker is gone.
+      def drop_local_blob(url)
+        @blob_registry_lock.synchronize { @blob_registry.delete(url.to_s); @blob_owners.delete(url.to_s) }
+        return if Thread.current[:csim_worker_handle]   # worker thread: the registry removal above is enough
+        @runtime.call('__csimDropBlob', url.to_s) rescue nil
+      end
+
       # Revoke every blob URL owned by a context that's going away (its blob URL
       # store is part of the global being torn down).
       def revoke_owned_blobs(key)
-        @blob_registry_lock.synchronize do
+        revoked = @blob_registry_lock.synchronize do
           urls = @blob_owners.select {|_url, owner| owner == key }.keys
           urls.each {|url| @blob_registry.delete(url); @blob_owners.delete(url) }
+          urls
+        end
+        if @driver.respond_to?(:unregister_blob_partition)
+          revoked.each {|url| @driver.unregister_blob_partition(url) }
         end
       end
       # Keys are normalized with `.to_i` on BOTH sides (register tags
@@ -3473,6 +4040,17 @@ module Capybara
       }.freeze
       private_constant :MIME_TO_VIPS_EXT
 
+      # The canonical MIME for each format we actually encode. An unsupported
+      # request type maps to '.png' below, so the encoded format (and the type
+      # we report back to the canvas) is image/png — matching the toBlob /
+      # toDataURL "unsupported type falls back to image/png" rule.
+      EXT_TO_MIME = {
+        '.jpg'  => 'image/jpeg',
+        '.webp' => 'image/webp',
+        '.png'  => 'image/png'
+      }.freeze
+      private_constant :EXT_TO_MIME
+
       def encode_image(pixels_ref, width, height, mime_type = 'image/png', quality = 90)
         host_image_op('encode_image') {
           require 'vips' unless defined?(Vips)
@@ -3483,7 +4061,7 @@ module Capybara
           img = Vips::Image.new_from_memory_copy(raw, w, h, 4, :uchar)
           ext = MIME_TO_VIPS_EXT[mime_type.to_s.downcase] || '.png'
           opts = (ext == '.jpg' || ext == '.webp') ? {Q: quality.to_i} : {}
-          {'refId' => transfer_buffer_stash(img.write_to_buffer(ext, **opts))}
+          {'refId' => transfer_buffer_stash(img.write_to_buffer(ext, **opts)), 'mime' => EXT_TO_MIME[ext]}
         }
       end
 
@@ -3493,7 +4071,7 @@ module Capybara
       # `build_worker` factory, evaluates the worker script, then
       # loops draining microtasks + timers + inbox until `:terminate`
       # lands or an exception propagates.
-      private def run_worker(handle, url, body, inbox, outbox, engine_class, shared: false)
+      private def run_worker(handle, url, body, inbox, outbox, engine_class, shared: false, service: false)
         # Release the spawn-time `@worker_initializing` count exactly once, however
         # this method exits (normal start, `self.close()`, or an exception), so
         # worker_pending? doesn't stay stuck true forever.
@@ -3518,6 +4096,9 @@ module Capybara
         # resolve chunks against the worker's own origin rather than
         # the snapshot-time `http://placeholder/`.
         rt.eval("globalThis.__csimUpdateLocation(#{JSON.generate(url.to_s)});")
+        # A service worker runs in a ServiceWorkerGlobalScope: adjust the worker scope
+        # (no blob-URL minting; SW lifecycle stubs) BEFORE its script runs.
+        rt.eval('__csim_installServiceWorkerScope();') if service
         rt.eval(body)
         rt.drain_microtasks
         # A SharedWorker fires `connect` AFTER its script set `self.onconnect`; the
@@ -3531,16 +4112,25 @@ module Capybara
         release_init.call
         # A worker that called `self.close()` in its top-level script stops here —
         # the script ran (and may have posted), but no further messages are pulled.
-        unless rt.eval('!!globalThis.__csimWorkerClosed')
+        unless rt.call('__csimWorkerClosedRead')
           loop do
             msg = pop_with_timeout(inbox, WORKER_POLL_INTERVAL)
             break if msg == :terminate
-            if msg
-              rt.call('__csim_workerOnMessage', msg)
+            rt.call('__csim_workerOnMessage', msg) if msg
+            # Drive the worker's OWN event loop each tick: a message handler OR an
+            # AUTONOMOUS loop (the dispatcher executor-worker's receive→fetch→setTimeout
+            # retry, which has no inbox message) may have pending timers. Drain ~one poll
+            # interval (WorkerRuntime#drain_timers advances the worker clock a step) so
+            # they progress; worker http fetch is setTimeout(0)+__rackFetch, resolved on
+            # this thread by the drain. Gated on a PENDING timer (any, not just due-now —
+            # the clock must advance to fire a future randomDelay) so an idle
+            # message-driven worker with no timers stays lazy. Host CALLS, not string
+            # `eval`, keep the per-tick cost off the V8 compile path (rule 3).
+            if rt.call('__nextTimerDelay').to_f >= 0
               rt.drain_microtasks
-              rt.drain_timers if rt.has_ready_timer?
-              break if rt.eval('!!globalThis.__csimWorkerClosed')
+              rt.drain_timers
             end
+            break if rt.call('__csimWorkerClosedRead')
           end
         end
       rescue StandardError => e
@@ -3558,6 +4148,13 @@ module Capybara
       private def fetch_worker_script(url)
         u = url.to_s
         if u.start_with?('blob:')
+          # Resolve via the Driver's partition store so a SAME-partition blob created
+          # in ANOTHER window/isolate (the cross-partition-worker-creation test creates
+          # the blob in the opener and the worker in a same-site iframe) is readable.
+          # Falls back to this realm's own store when there's no Driver entry.
+          if @driver.respond_to?(:blob_bytes_for) && (data = @driver.blob_bytes_for(u, self))
+            return data[:bytes]
+          end
           b64 = @runtime.call('__csimReadBlobBase64', u)
           return nil unless b64
           return Base64.decode64(b64.to_s)
@@ -3647,15 +4244,134 @@ module Capybara
         end
       end
 
+      # Fetch caps a request at 20 redirects: the 21st is a network error (redirect-count).
+      # The loop below runs one iteration PER dispatch, so it needs 20 redirect hops plus
+      # the final response — MAX_FETCH_REDIRECTS + 1 iterations — to let exactly 20 succeed.
       MAX_FETCH_REDIRECTS = 20
+      # Request cache modes that never READ the store (always hit the network), and modes that
+      # serve a STORED response even when stale. Frozen so the hot rack_fetch path allocates no
+      # throwaway arrays per hop (perf).
+      CACHE_MODES_SKIP_READ  = %w[no-store reload].freeze
+      CACHE_MODES_SERVE_STALE = %w[force-cache only-if-cached].freeze
+      # Fetch "bad port" blocklist (https://fetch.spec.whatwg.org/#port-blocking) —
+      # ports tied to non-HTTP protocols a request must never reach. Frozen Set for
+      # O(1) membership on the rack_fetch path.
+      BAD_PORTS = Set[
+        0, 1, 7, 9, 11, 13, 15, 17, 19, 20, 21, 22, 23, 25, 37, 42, 43, 53, 69, 77,
+        79, 87, 95, 101, 102, 103, 104, 109, 110, 111, 113, 115, 117, 119, 123, 135,
+        137, 139, 143, 161, 179, 389, 427, 465, 512, 513, 514, 515, 526, 530, 531,
+        532, 540, 548, 554, 556, 563, 587, 601, 636, 989, 990, 993, 995, 1719, 1720,
+        1723, 2049, 3659, 4045, 4190, 5060, 5061, 6000, 6566, 6665, 6666, 6667, 6668,
+        6669, 6679, 6697, 10080
+      ].freeze
+
+      REFERRER_POLICIES = %w[
+        no-referrer no-referrer-when-downgrade origin origin-when-cross-origin
+        same-origin strict-origin strict-origin-when-cross-origin unsafe-url
+      ].freeze
+
+      # The `Referer` value a request carries under a Referrer-Policy — nil = send none
+      # (https://w3c.github.io/webappsec-referrer-policy/#determine-requests-referrer).
+      # `referrer_url` is the request's referrer (the initiating document); `target_url`
+      # its destination. "full" is the referrer stripped of fragment + credentials;
+      # "origin" is scheme://host[:port]/. An empty / unknown policy → the default
+      # (strict-origin-when-cross-origin).
+      def compute_referrer(policy, referrer_url, target_url)
+        return nil if referrer_url.nil? || referrer_url.to_s.empty?
+        policy = 'strict-origin-when-cross-origin' unless REFERRER_POLICIES.include?(policy)
+        return nil if policy == 'no-referrer'
+        # The referrer is almost always the (constant) document URL — memoise its parse
+        # so the rack_fetch hot path doesn't re-parse it per request (rule 3).
+        ref = parse_referrer_url(referrer_url)
+        return nil unless ref && %w[http https].include?(ref.scheme)
+        full        = -> { u = ref.dup; u.fragment = nil; u.password = nil; u.user = nil; u.to_s }
+        origin_only = -> {
+          default_port = ref.scheme == 'https' ? 443 : 80
+          port         = ref.port && ref.port != default_port ? ":#{ref.port}" : ''
+          "#{ref.scheme}://#{ref.host}#{port}/"
+        }
+        return full.call        if policy == 'unsafe-url'
+        return origin_only.call if policy == 'origin'
+        # The remaining policies need the target to know same-origin / downgrade.
+        tgt = (URI.parse(target_url) rescue nil)
+        return nil unless tgt
+        same_origin = ref.scheme == tgt.scheme && ref.host == tgt.host && ref.port == tgt.port
+        downgrade   = ref.scheme == 'https' && tgt.scheme == 'http'
+        case policy
+        when 'origin-when-cross-origin'        then same_origin ? full.call : origin_only.call
+        when 'same-origin'                     then same_origin ? full.call : nil
+        when 'strict-origin'                   then downgrade ? nil : origin_only.call
+        when 'no-referrer-when-downgrade'      then downgrade ? nil : full.call
+        when 'strict-origin-when-cross-origin' then same_origin ? full.call : (downgrade ? nil : origin_only.call)
+        end
+      end
+
+      # Parse a referrer URL, memoising the last one (the referrer is the document URL
+      # for nearly every request, so this caches across the whole page's subresources).
+      def parse_referrer_url(url)
+        return @referrer_parsed if defined?(@referrer_parsed_for) && @referrer_parsed_for == url
+        @referrer_parsed_for = url
+        @referrer_parsed     = (URI.parse(url) rescue nil)
+      end
+
+      # Whether a request to `url_str` must be blocked as a Fetch "bad port". Cheap
+      # pre-gate: only URLs whose authority carries an explicit `:<digit>` are parsed
+      # (the vast majority don't), so the rack_fetch hot path — every asset / xhr /
+      # fetch, cache hits included — skips URI.parse entirely.
+      def bad_port?(url_str)
+        return false unless url_str =~ %r{\A[a-z]+://[^/]*:\d}i
+        port = URI.parse(url_str).port
+        port && BAD_PORTS.include?(port)
+      rescue URI::Error
+        false
+      end
+
       # URLs we won't even try to route through Rack: anything that
       # isn't http(s) (data: / mailto: / about:) plus pseudo-tokens
       # like V8's `<snapshot>` that sourcemap libraries pull out of
       # error stacks and feed straight to `fetch()` / `xhr.open()`.
-      def rack_fetch(method, url, body, headers, redirect_mode, env_extras: nil)
+      def rack_fetch(method, url, body, headers, redirect_mode, cors_mode = nil, credentials: 'same-origin', env_extras: nil, referrer_policy: nil, referrer: nil, cache_mode: 'default')
+        # NB: a relative fetch/XHR URL is resolved against the document's API base URL
+        # at OPEN time (XHR open() / fetch()), in JS, NOT here — resolving at send time
+        # would wrongly pick up a `<base href>` inserted after open() (open-url-base
+        # -inserted-after-open). So this resolves only against the document URL.
         target = resolve_against_current(url.to_s)
         return nil unless target.is_a?(String) && target.match?(%r{\Ahttps?://}i)
-        method = (method || 'GET').to_s.upcase
+        # Fetch "port blocking" (https://fetch.spec.whatwg.org/#port-blocking): a
+        # request to a blocked port is a network error before any connection —
+        # fetch() rejects with TypeError, a sync XHR throws NetworkError
+        # (request-bad-port). Re-checked per redirect hop below ("HTTP-redirect fetch"
+        # re-runs the block), so a 3xx Location to a bad port is refused too.
+        return nil if bad_port?(target)
+        # CORS enforcement (preflight + Access-Control checks) applies only to cors_mode
+        # 'cors' — sent by XHR and by fetch()'s default mode. fetch() also threads
+        # 'no-cors' / 'same-origin' (mode semantics below), and a form-submission
+        # navigation threads 'navigate'; other callers (sendBeacon, ESM, workers, the
+        # internal asset GET) pass nil → no CORS and no mode semantics. The document's
+        # origin is the request's origin; a different target origin is cross-origin.
+        cors        = cors_mode == 'cors'
+        req_origin  = cors ? url_origin(@current_url) : nil
+        # Fetch request "mode" (fetch threads it; XHR is always 'cors'; a non-fetch/xhr
+        # caller passes nil → no mode semantics, a plain 'basic' response). `no-cors`
+        # filters a cross-origin response to opaque; `same-origin` makes a cross-origin
+        # request a network error. `doc_origin` detects cross-origin for the response
+        # TYPE regardless of whether CORS enforcement (cors) runs; `crossed` latches once
+        # any hop leaves the document origin.
+        no_cors_mode     = cors_mode == 'no-cors'
+        same_origin_mode = cors_mode == 'same-origin'
+        # Only the real fetch request modes carry cross-origin semantics; a 'navigate'
+        # (form submission) or a nil-mode internal caller gets a plain readable response.
+        doc_origin       = %w[cors no-cors same-origin].include?(cors_mode) ? url_origin(@current_url) : nil
+        crossed          = false
+        # A request is "credentialed" (cookies + the credentialed CORS check) only in
+        # `include` mode; `same-origin` (default) and `omit` are uncredentialed for the
+        # CORS check, while the cookie decision below distinguishes all three.
+        with_credentials = credentials == 'include'
+        # Use the method's case AS GIVEN: the JS callers already applied the spec
+        # normalization (XHR open() / Fetch upper-case the known methods, preserving
+        # an unknown method's case — open-method-case-sensitive). Upper-casing here
+        # would clobber a custom method like `xUNIcorn`.
+        method = (method || 'GET').to_s
         redirected = false
         # JS-side base64-encodes Blob/File bodies (raw bytes survive
         # the engine's UTF-8 string boundary that way); decode before
@@ -3664,22 +4380,117 @@ module Capybara
           body = Base64.decode64(body.to_s)
           headers = headers.reject {|k, _| k == 'X-Csim-Body-B64' }
         end
-        MAX_FETCH_REDIRECTS.times do
+        # The request's origin starts as the document origin; a cross-origin REDIRECT
+        # taints it to an opaque origin (serialized "null") per Fetch "HTTP-redirect
+        # fetch". `effective_origin` IS that origin — it's what the Origin header
+        # carries and what the CORS check / preflight compare against from that hop on
+        # ('null' once tainted, so the server must then allow 'null' or '*').
+        effective_origin = req_origin
+        # An author conditional (If-None-Match / …) means the caller is doing its own
+        # revalidation, so the UA cache must step aside (computed once — the headers
+        # carrying it survive every redirect hop unchanged).
+        skip_cache = request_has_conditional_headers?(headers)
+        ref_policy = referrer_policy   # may be overridden per hop by a response Referrer-Policy
+        # The referrer is stripped PROGRESSIVELY: each hop applies its (possibly
+        # overridden) policy to the referrer the PREVIOUS hop sent, not to the original
+        # document — so once a hop reduces it to an origin (or drops it), a later, laxer
+        # policy can't widen it back (redirect-referrer-override). The initial source is
+        # the request's referrer: an explicit `init.referrer` URL when given, else the
+        # document URL ("client"); an empty referrer means no-referrer (compute_referrer
+        # maps a blank source to nil).
+        ref_source = referrer.nil? ? @current_url : referrer
+        (MAX_FETCH_REDIRECTS + 1).times do
           t0 = @trace && Process.clock_gettime(Process::CLOCK_MONOTONIC)
-          # GET-only cache shortcut (RFC 9111). Fresh hit → skip @app.call
-          # entirely; stale-but-revalidatable → fall through with conditional
-          # headers added so the server can return 304.
-          cache_entry = method == 'GET' ? @@asset_cache.lookup(target) : nil
-          if cache_entry&.fresh?
-            # Cached static asset — log headers/type/size but skip the (boring) body.
+          # Cross-origin-ness for the request mode/type, latched across hops. Computed
+          # BEFORE the cache so a cross-origin request never takes the cache fast path
+          # (which would bypass the opaque filter / same-origin-mode error / cors type).
+          crossed ||= !!(doc_origin && (effective_origin == 'null' || url_origin(target) != doc_origin))
+          return nil if same_origin_mode && crossed   # 'same-origin' mode forbids a cross-origin hop
+          # HTTP cache (RFC 9111 + Fetch "HTTP-network-or-cache fetch"), gated by the request's
+          # cache MODE. GET-only, same-origin (a cross-origin hop always redispatches so the mode
+          # filtering below runs), and stepped aside when the author sent their own conditional.
+          #   - no-store / reload    : never read the store — always hit the network, no conditional
+          #   - force-cache / only-if-cached : serve a stored response even when STALE, no revalidation
+          #                                    (only-if-cached with nothing stored is a network error)
+          #   - no-cache             : always revalidate, even a fresh entry
+          #   - default              : serve fresh; revalidate stale (fall through with conditionals)
+          read_cache  = method == 'GET' && !skip_cache && !crossed && !CACHE_MODES_SKIP_READ.include?(cache_mode)
+          cache_entry = read_cache ? @@asset_cache.lookup(target) : nil
+          serve_stored = cache_entry &&
+            (CACHE_MODES_SERVE_STALE.include?(cache_mode) || (cache_entry.fresh? && cache_mode != 'no-cache'))
+          if serve_stored
+            if REDIRECT_STATUSES.include?(cache_entry.status.to_i)
+              # A cached REDIRECT obeys the redirect mode exactly like a fresh one: `error` is a
+              # network error, `manual` is an opaque-redirect, and `follow` follows it THROUGH
+              # the cache — resolve the Location and continue so the next hop serves the cached
+              # target (request-cache "uses cached … redirects"). only-if-cached / force-cache
+              # reach this only same-origin GET (read_cache excludes cross-origin), so there's no
+              # method rewrite / origin taint.
+              raise StandardError, '[capybara-simulated] fetch: redirect blocked by redirect=error mode' if redirect_mode == 'error'
+              if redirect_mode != 'follow'
+                return response_hash(0, {}, '', target, false, type: 'opaqueredirect', body_null: true)
+              end
+              if (loc = redirect_location(cache_entry.status, cache_entry.headers))
+                trace_network(method, target, cache_entry.status, headers, body, cache_entry.headers, nil, t0, true)
+                redirected = true
+                next_url   = resolve_against(loc, target)
+                return nil unless next_url.to_s.match?(%r{\Ahttps?://}i)
+                target = carry_fragment(target, next_url)
+                return nil if bad_port?(target)   # a cached redirect to a blocked port is still a network error
+                next
+              end
+            end
+            # Cached asset — log headers/type/size but skip the (boring) body.
             trace_network(method, target, cache_entry.status, headers, body, cache_entry.headers, nil, t0, false)
             return response_hash(cache_entry.status, cache_entry.headers, cache_entry.body, target, redirected)
           end
+          # only-if-cached forbids the network: no usable stored response → a network error.
+          return nil if cache_mode == 'only-if-cached'
 
           env = Rack::MockRequest.env_for(target, method: method, input: body || '')
+          env['REQUEST_METHOD'] = method   # env_for upcases the method; restore the exact case (open-method-case-sensitive)
+          # A GET/HEAD request carries no body, so it sends no Content-Length (env_for
+          # always sets it to the input bytesize, i.e. 0). A POST/PUT with an empty body
+          # keeps Content-Length: 0 (send-entity-body-none / -empty).
+          env.delete('CONTENT_LENGTH') if %w[GET HEAD].include?(method.to_s.upcase)
           apply_request_headers(env, headers) if headers
           apply_request_headers(env, @@asset_cache.revalidation_headers(cache_entry)) if cache_entry
-          apply_default_request_env(env, referer: @current_url, force: false)
+          # The Referer follows the request's Referrer-Policy (a redirect response can
+          # override the policy for the next hop — see below). `hop_referer` also becomes
+          # the source the NEXT hop strips from.
+          hop_referer = compute_referrer(ref_policy, ref_source, target)
+          apply_default_request_env(env, referer: hop_referer, force: false)
+          # Whether this hop is cross-origin (cors only): a tainted (opaque) origin is
+          # cross-origin to every real target; otherwise compare the target to the
+          # document origin. Drives the Origin header, preflight, and the CORS check.
+          cross_origin = cors && (effective_origin == 'null' || url_origin(target) != req_origin)
+          # Fetch credentials mode decides cookie attachment, independent of the CORS
+          # mode: `omit` never sends them; `include` always does; `same-origin` (default)
+          # sends them only to a same-origin target — so an uncredentialed cross-origin
+          # hop (cors OR no-cors) must not leak the document's cookies
+          # (cors-redirect-credentials / cors-cookies). A navigation / internal caller has
+          # no doc_origin, so it counts as same-origin and keeps them.
+          hop_cross_origin = !!(doc_origin && (effective_origin == 'null' || url_origin(target) != doc_origin))
+          send_cookies     = credentials == 'include' || (credentials != 'omit' && !hop_cross_origin)
+          env.delete('HTTP_COOKIE') unless send_cookies
+          # A CORS request to a URL carrying credentials (`user:pass@`) is a network
+          # error (access-control-and-redirects "user info" subtest).
+          return nil if cross_origin && url_has_userinfo?(target)
+          # CORS-preflight, re-evaluated PER HOP: a cross-origin non-simple request (a
+          # non-safelisted method / header / Content-Type) must pass an OPTIONS preflight
+          # first — so a same-origin request redirected cross-origin to an unsafe resource
+          # is preflighted on the NEW origin (send-redirect-to-cors), not just an initially
+          # cross-origin one (access-control-basic-get-fail-non-simple / preflight-*).
+          if cross_origin && cors_unsafe_request?(method, headers)
+            return nil unless cors_preflight_ok?(target, method, headers, effective_origin, with_credentials, hop_referer)
+          end
+          # Send the (effective) Origin — the UA owns this header — on a cors request when
+          # the hop is cross-origin OR the method is not GET/HEAD (Fetch appends Origin to
+          # every non-GET/HEAD request, so a same-origin POST carries it too). After a
+          # cross-origin redirect the origin is the opaque "null".
+          if cross_origin || (req_origin && !%w[GET HEAD].include?(method.to_s.upcase))
+            env['HTTP_ORIGIN'] = effective_origin
+          end
           env.merge!(env_extras) if env_extras
           status, resp_headers, resp_body = dispatch_rack_or_http(target, env, method: method, body: body)
           merge_set_cookie(resp_headers)
@@ -3689,23 +4500,119 @@ module Capybara
             @@asset_cache.refresh(cache_entry, resp_headers)
             return response_hash(cache_entry.status, cache_entry.headers, cache_entry.body, target, redirected)
           end
-          if redirect_mode != 'manual' && (loc = redirect_location(status, resp_headers))
+          # Fetch "CORS check" runs on EVERY cross-origin response — including a 3xx the
+          # UA is about to follow (a redirect whose response lacks a valid Access-Control
+          # -Allow-Origin is itself a network error: access-control-and-redirects). A
+          # credentialed request additionally forbids `*` and needs Allow-Credentials.
+          if cross_origin && !cors_response_ok?(resp_headers, effective_origin, with_credentials)
+            resp_body.close if resp_body.respond_to?(:close)
+            return nil
+          end
+          # A redirect-status response in a NON-follow mode is handled without following,
+          # keyed on the status ALONE (the Location is never parsed): `error` is a network
+          # error; `manual` is an opaque-redirect filtered response (status 0, empty
+          # statusText/headers, the ORIGINAL request URL, type 'opaqueredirect'). The CORS
+          # check above runs first, so a cross-origin redirect that fails CORS is a network
+          # error either way (redirect-mode / -location).
+          if redirect_mode != 'follow' && REDIRECT_STATUSES.include?(status.to_i)
+            resp_body.close if resp_body.respond_to?(:close)
             raise StandardError, '[capybara-simulated] fetch: redirect blocked by redirect=error mode' if redirect_mode == 'error'
+            # A no-cors request may not even opaquely expose a CROSS-origin redirect — a
+            # no-cors non-follow redirect to a cross-origin target is a network error,
+            # while a same-origin one still yields an opaque-redirect.
+            return nil if no_cors_mode && crossed
+            return response_hash(0, {}, '', target, false, type: 'opaqueredirect', body_null: true)
+          end
+          if (loc = redirect_location(status, resp_headers))
             # Log this hop (3xx) before method/body are rewritten for the next.
             trace_network(method, target, status, headers, body, resp_headers, nil, t0, true)
+            # Cache the redirect itself (a cacheable 3xx with freshness) BEFORE following it —
+            # the follow does `next`, which would otherwise skip the store below — so a later
+            # only-if-cached / force-cache request can follow the redirect chain from the cache
+            # (request-cache "uses cached … redirects"). Same store gate as the terminal hop.
+            @@asset_cache.store(target, status, resp_headers, '') if method == 'GET' && cache_mode != 'no-store' && !skip_cache
             redirected = true
-            preserve = [307, 308].include?(status)
+            ref_source = hop_referer   # the next hop strips from what THIS hop sent
+            # A redirect response's Referrer-Policy overrides the policy for the next hop
+            # (redirect-referrer-override): the last valid token of the header wins.
+            if (rp = resp_headers['referrer-policy'] || resp_headers['Referrer-Policy'])
+              tok = Array(rp).join(',').split(',').map(&:strip).reverse.find {|t| REFERRER_POLICIES.include?(t) }
+              ref_policy = tok if tok
+            end
             next_url = resolve_against(loc, target)
+            # The UA only follows http(s) redirects: a Location that resolves to a
+            # non-HTTP(S) URL (data:, an `invalidurl:` scheme, …) is a network error
+            # (redirect-location data/invalid in follow mode).
+            unless next_url.to_s.match?(%r{\Ahttps?://}i)
+              resp_body.close if resp_body.respond_to?(:close)
+              return nil
+            end
+            # A cross-origin redirect taints the request's origin to opaque ("null") only
+            # once the request was ALREADY cross-origin (response tainting "cors", i.e.
+            # `crossed`) and the hop changes origin — so a subsequent hop sends Origin: null
+            # and the CORS check demands the server allow "null"/"*". The FIRST cross-origin
+            # hop out of a same-origin request keeps the real origin (redirect-origin
+            # "same origin to other origin" sends the document origin, not null).
+            effective_origin = 'null' if cors && crossed && url_origin(next_url) != url_origin(target)
             target = carry_fragment(target, next_url)
-            method = 'GET' unless preserve
-            body = nil unless preserve
+            if bad_port?(target)   # a redirect to a blocked port is a network error too
+              resp_body.close if resp_body.respond_to?(:close)
+              return nil
+            end
+            # Fetch "HTTP-redirect fetch": the method changes to GET (dropping the
+            # body + its Content-* headers) ONLY for 301/302 of a POST, or 303 of a
+            # non-GET/HEAD. Otherwise method, body, and headers are preserved — so a
+            # GET/HEAD redirected via 301/302/303 keeps its method and Content-Type,
+            # and 307/308 always preserve (xhr send-redirect basics).
+            up = method.to_s.upcase
+            if ([301, 302].include?(status) && up == 'POST') || (status == 303 && !%w[GET HEAD].include?(up))
+              method  = 'GET'
+              body    = nil
+              headers = headers.reject {|k, _| REDIRECT_DROPPED_HEADERS.include?(k.to_s.downcase) } if headers.is_a?(Hash)
+            end
             resp_body.close if resp_body.respond_to?(:close)
             next
           end
+          # A follow-mode redirect whose Location header IS present but EMPTY parses to the
+          # request URL — a self-redirect that would loop until the redirect limit trips a
+          # network error. redirect_location returns nil for it (empty ⇒ no followable
+          # target, so navigation keeps rendering the 3xx), so recognize it here and fail
+          # directly — fetch-only (redirect-empty-location follow mode).
+          if REDIRECT_STATUSES.include?(status.to_i)
+            raw_loc = resp_headers['location'] || resp_headers['Location']
+            raw_loc = raw_loc.first if raw_loc.is_a?(Array)
+            if raw_loc && raw_loc.to_s.empty?
+              resp_body.close if resp_body.respond_to?(:close)
+              return nil
+            end
+          end
           body_str = read_rack_body(resp_body)
+          # A HEAD response, and a null-body status (204/205/304), have NO body — the UA
+          # discards whatever the server sent and exposes response.body as null
+          # (response-method HEAD; response-null-body). `null_body` flags it so the JS
+          # Response reports a null body + empty text.
+          null_body = method.to_s.upcase == 'HEAD' || NULL_BODY_STATUSES.include?(status.to_i)
+          body_str = '' if null_body
+          # The UA transparently decodes a Content-Encoding'd body (gzip/deflate); the
+          # header stays, the bytes are inflated (response-data-gzip / -deflate).
+          body_str = decode_content_encoding(body_str, resp_headers)
+          # A cross-origin response only EXPOSES (getResponseHeader / getAllResponseHeaders)
+          # the CORS-safelisted response headers plus those named in Access-Control-Expose
+          # -Headers (`*` = all). content-type stays safelisted, so response decoding is
+          # unaffected. (Filtered for script exposure only — trace / set-cookie / cache see
+          # the full set.) The CORS check itself already ran above (incl. on 3xx hops).
+          exposed_headers = cross_origin ? cors_exposed_headers(resp_headers) : resp_headers
           trace_network(method, target, status, headers, body, resp_headers, body_str, t0, false)
-          @@asset_cache.store(target, status, resp_headers, body_str) if method == 'GET'
-          return response_hash(status, resp_headers, body_str, target, redirected)
+          # A no-store request must not write the cache (RFC 9111 §5.2.1.5); a request carrying
+          # the author's own conditional bypasses the UA cache entirely (read AND write) — it's
+          # "treated similarly to no-store" (request-cache-default-conditional). Every other mode
+          # (incl. reload, which refreshes it) stores a cacheable GET response.
+          @@asset_cache.store(target, status, resp_headers, body_str) if method == 'GET' && cache_mode != 'no-store' && !skip_cache
+          # A no-cors cross-origin response is OPAQUE: status 0, empty body, no exposed
+          # headers, empty URL (cors-basic "Opaque filter"). Otherwise the type is 'cors'
+          # for a cross-origin (CORS-allowed) response, else 'basic'.
+          return response_hash(0, {}, '', '', false, type: 'opaque', body_null: true) if no_cors_mode && crossed
+          return response_hash(status, exposed_headers, body_str, target, redirected, type: crossed ? 'cors' : 'basic', body_null: null_body)
         end
         raise StandardError, "[capybara-simulated] fetch exceeded #{MAX_FETCH_REDIRECTS} redirects"
       rescue StandardError => e
@@ -3726,7 +4633,7 @@ module Capybara
         return unless @trace
         ct = resp_headers && (resp_headers['content-type'] || resp_headers['Content-Type'])
         ct = ct.first if ct.is_a?(Array)  # Rack 3 permits array-valued header fields
-        ct = ct.split(';', 2).first.strip if ct.is_a?(String)
+        ct = ct.split(';', 2).first&.strip if ct.is_a?(String)   # "" → split is [] → first is nil
         size = if resp_body
                  resp_body.bytesize
                elsif (cl = resp_headers && (resp_headers['content-length'] || resp_headers['Content-Length']))
@@ -3767,7 +4674,13 @@ module Capybara
 
       def normalize_trace_headers(headers)
         return nil unless headers
-        headers.each_with_object({}) {|(k, v), out| out[k.to_s] = v.is_a?(Array) ? v.join(', ') : v.to_s }
+        headers.each_with_object({}) do |(k, v), out|
+          # `x-csim-status-text` is an internal sentinel carrying the HTTP reason
+          # phrase (response_hash lifts it into statusText); it's never a real wire
+          # header, so keep it out of the trace.
+          next if k.to_s.downcase == 'x-csim-status-text'
+          out[k.to_s] = v.is_a?(Array) ? v.join(', ') : v.to_s
+        end
       end
 
       # CGI convention: `Content-Type` and `Content-Length` land in env
@@ -3778,7 +4691,14 @@ module Capybara
       # `@rails/request.js` never deserialise and the server reads an
       # empty params hash.
       def apply_request_headers(env, headers)
+        # Preserve the author's exact header names (casing + token chars) alongside the
+        # CGI-mangled HTTP_* keys: the Rack env upcases names and drops non-alphanumerics
+        # (Status-URI → HTTP_STATUS_URI, a tchar-only name → an unrecoverable key), but a
+        # .py echo handler (inspect-headers / echo-headers) reports the names verbatim.
+        # run_py_handler reads this side list to emit the original names.
+        raw = (env['csim.raw_request_headers'] ||= []) if @@capture_raw_request_headers
         headers.each {|k, v|
+          raw << [k.to_s, v.to_s] if raw
           name = k.to_s.upcase.tr('-', '_')
           case name
           when 'CONTENT_TYPE', 'CONTENT_LENGTH' then env[name] = v.to_s
@@ -3797,9 +4717,13 @@ module Capybara
       # text body when `body_b64` is absent.
       TEXT_CONTENT_TYPE_PREFIXES = %w[text/ application/json application/javascript application/ecmascript application/xml image/svg+xml].freeze
 
-      def response_hash(status, headers, body, url, redirected)
+      def response_hash(status, headers, body, url, redirected, type: 'basic', body_null: false)
         raw     = body.to_s
         hdrs    = stringify(headers)
+        # A NUL in a header value is not a valid HTTP message; a real server can't
+        # put it on the wire, so the fetch is a network error (nil → status 0 / a
+        # thrown NetworkError for a sync XHR). See headers-normalize-response.
+        return nil if hdrs.any? {|_, v| v.include?("\u0000") }
         is_text = text_response?(hdrs)
         # `body` crosses as TEXT — `responseText` semantics: the bytes decoded
         # as UTF-8 with invalid sequences replaced (a leading BOM selects the
@@ -3814,18 +4738,43 @@ module Capybara
           else
             RuntimeShared.utf8_text(raw)
           end
+        # statusText = the HTTP reason phrase: a custom one carried on the internal
+        # x-csim-status-text header (status.py), else the status code's standard
+        # reason (xhr status/statusText tests). Strip the internal header either way.
+        custom_reason = hdrs.delete('x-csim-status-text')
+        # Rack::Utils::HTTP_STATUS_CODES values are ASCII-8BIT (binary) strings — the V8
+        # bridge marshals a binary string as a byte array, not a JS string, so statusText
+        # would arrive as [79,75] instead of "OK" (abort-during-loading reads statusText
+        # on a static-file response). utf8_text re-tags + scrubs to a clean JS string, the
+        # same path the body and every header value already take.
+        reason = RuntimeShared.utf8_text(custom_reason || Rack::Utils::HTTP_STATUS_CODES[status.to_i] || '')
+        # HTTP/2 has no reason phrase, so statusText is always the empty string there (a WPT
+        # `.h2` test document's fetches run over h2). We don't model the h2 transport, so key
+        # off the document URL — the same signal WPT uses to serve the resource over h2
+        # (fetch/xhr status.h2 "statusText over H2 … should be the empty string").
+        reason = '' if @current_url.to_s.include?('.h2.')
         out = {
           'status'     => status,
+          'statusText' => reason,
           'headers'    => hdrs,
           'body'       => text,
           'url'        => url,
           'redirected' => redirected,
-          'type'       => 'basic'
+          'type'       => type
         }
+        out['body_null'] = true if body_null   # null-body status / HEAD → response.body is null
         # The BOM-detected encoding (if any) — a frame load pins its document's
         # characterSet to it (see __csimFrameWindow); highest-precedence signal.
         out['charset']  = bom_charset if bom_charset
-        out['body_b64'] = Base64.strict_encode64(raw) unless is_text
+        # Hand the raw bytes to the (XHR) client UNLESS the response is pure-ASCII text.
+        # ASCII decodes identically under every encoding — so responseText is already
+        # correct from the UTF-8 `body`, and it round-trips byte-for-byte as an
+        # ArrayBuffer/Blob. Any NON-ASCII body needs the bytes: a non-UTF-8 charset or an
+        # XML-prolog / <meta charset>-sniffed encoding (responseText), or multibyte UTF-8
+        # read as arraybuffer/blob — the client decodes them with the final encoding
+        # (decodeResponseBytes). `ascii_only?` is a cheap C-level scan, so the dominant
+        # pure-ASCII app JSON/HTML traffic keeps the fast path and pays no base64.
+        out['body_b64'] = Base64.strict_encode64(raw) unless is_text && raw.ascii_only?
         out
       end
 
@@ -3901,6 +4850,34 @@ module Capybara
         buf
       end
 
+      # Transparently decode a Content-Encoding'd response body (HTTP "content coding"):
+      # gzip / x-gzip via Zlib.gunzip; deflate via zlib-wrapped inflate, falling back to
+      # raw DEFLATE (the "deflate" coding is ambiguously used for both). Unknown codings
+      # (e.g. br) and malformed data are left untouched — best-effort, like a browser that
+      # would error, but we keep the bytes so the caller still sees a response.
+      def decode_content_encoding(body, headers)
+        return body if body.nil? || body.empty?
+        raw = headers.find {|k, _| k.to_s.downcase == 'content-encoding' }&.last
+        enc = (raw.is_a?(Array) ? raw.join(',') : raw.to_s).strip.downcase   # Rack 3 may hand the value as an array
+        # The decoded bytes re-enter the UTF-8 text pipeline the same as an
+        # un-encoded body (read_rack_body yields UTF-8), so re-tag them — Zlib
+        # output is ASCII-8BIT, which would otherwise marshal to V8 as a byte array.
+        decoded =
+          case enc
+          when 'gzip', 'x-gzip' then Zlib.gunzip(body.b)
+          when 'deflate'
+            begin
+              Zlib::Inflate.inflate(body.b)
+            rescue Zlib::Error
+              Zlib::Inflate.new(-Zlib::MAX_WBITS).inflate(body.b)   # raw (header-less) DEFLATE
+            end
+          else return body
+          end
+        decoded.force_encoding('UTF-8')
+      rescue Zlib::Error
+        body
+      end
+
       # Defer the navigation: doing it from inside the running V8 call
       # would dispose the Context mid-call. tick_real_time drains
       # after the call returns. Same pattern as `__csimPendingFormSubmit`.
@@ -3940,6 +4917,9 @@ module Capybara
         (@pending_frame_nav ||= {})[realm_id] = url.to_s
       end
       def consume_pending_frame_nav
+        # Window-realm self-navs are realm navs too — drain them at every frame-nav
+        # drain point (before the frame-nav early-return so a window-only nav lands).
+        consume_pending_window_nav
         return if @pending_frame_nav.nil? || @pending_frame_nav.empty?
         navs = @pending_frame_nav
         @pending_frame_nav = nil
@@ -3963,6 +4943,44 @@ module Capybara
           log_console('warn', "frame self-navigation failed: #{e.message}")
         end
       end
+      # A same-origin WINDOW realm (window.open in this isolate) navigating itself
+      # via `win.location = …`. Like frame_navigate_self, defer (the call lands here
+      # from the realm's own location setter, mid-flight) and drain after the action.
+      # A blob: URL is resolved to bytes NOW — before the opener's typical immediate
+      # `revokeObjectURL` — since the realm reload happens later (url-in-tags-revoke).
+      def window_realm_navigate_self(url, realm_id)
+        return if realm_id.nil? || realm_id.zero?
+        spec = {url: url.to_s}
+        if url.to_s.start_with?('blob:') && (b = read_blob_for_window(url.to_s))
+          # The blob's bytes arrive BINARY-tagged (Base64-decoded). __csimLoadDocument
+          # HTML-parses TEXT, and a BINARY string marshals to V8 as a Uint8Array (not a
+          # String), which `String(...)`s to comma-joined digits — a script-less doc. Decode
+          # to UTF-8 text like every other load path (see RuntimeShared.utf8_text).
+          spec[:body]  = RuntimeShared.utf8_text(b[:bytes])
+          spec[:ctype] = b[:type].to_s.empty? ? 'text/html' : b[:type]
+        end
+        (@pending_window_nav ||= {})[realm_id] = spec
+      end
+      def consume_pending_window_nav
+        return if @pending_window_nav.nil? || @pending_window_nav.empty?
+        navs = @pending_window_nav
+        @pending_window_nav = nil
+        navs.each do |realm_id, spec|
+          invalidate_find_cache
+          body, ctype = spec[:body], spec[:ctype]
+          # http(s) / relative URL window-realm nav (rack fetch) is not modeled yet —
+          # only the blob/in-memory document case (which pre-resolved bytes above)
+          # loads here. Warn rather than silently drop so an unsupported popup
+          # navigation is diagnosable instead of looking like a frozen about:blank.
+          if body.nil?
+            log_console('warn', "window-realm navigation to #{spec[:url]} not modeled (only blob: documents load); ignoring")
+            next
+          end
+          @runtime.reload_window_realm(realm_id, spec[:url], body.to_s, ctype.to_s)
+        rescue StandardError => e
+          log_console('warn', "window realm self-navigation failed: #{e.message}")
+        end
+      end
       # Mirror of `location_assign`'s deferral for `location.reload()`:
       # the JS call lands here from `__locationReload`; running
       # `browser.refresh` directly would `navigate` (rebuilding the
@@ -4029,11 +5047,103 @@ module Capybara
           sub = @runtime.realm_call(realm_id, '__csimTakePendingFormSubmit')
           next unless sub.is_a?(Hash) && sub['formHandle']
           invalidate_find_cache
-          submit_form_in_realm(realm_id, sub['formHandle'], sub['submitterHandle'])
+          submit_form_in_realm(realm_id, sub['formHandle'], sub['submitterHandle'], sub['entryList'])
         rescue StandardError => e
           log_console('warn', "nested-context form submission failed: #{e.message}")
         end
       end
+      # ── Frame session history ──────────────────────────────────────────────
+      # A nested browsing context (iframe) keeps its OWN back/forward history of
+      # the documents it navigates through, with each entry's form-control state
+      # captured for restoration (HTML "persisted user state" / bfcache). Keyed by
+      # [parent realm, iframe element handle] — stable across the frame-realm
+      # rebuilds a navigation triggers (the element outlives its realm).
+      #
+      # `iframe.contentWindow.history.back()` runs while the frame realm is on the
+      # V8 stack, so (like frame_navigate_self) DEFER the traversal and drain it
+      # after the call returns — rebuilding the realm inline would terminate it.
+      def frame_history_go(realm_id, delta)
+        return if realm_id.nil? || realm_id.zero?
+        @pending_frame_traverse = {realm_id: realm_id, delta: delta.to_i}
+      end
+      def consume_pending_frame_traverse
+        return if @pending_frame_traverse.nil?
+        pt = @pending_frame_traverse
+        @pending_frame_traverse = nil
+        invalidate_find_cache
+        perform_frame_traverse(pt[:realm_id], pt[:delta])
+      rescue StandardError => e
+        log_console('warn', "frame history traversal failed: #{e.message}")
+      end
+      def perform_frame_traverse(realm_id, delta)
+        # The traversal was deferred; the frame may have been disposed (a competing
+        # nav) between flag and drain — drop it gracefully.
+        return unless @runtime.frame_realm_alive?(realm_id)
+        parent = @runtime.frame_realm_parent(realm_id)
+        handle = frame_container_handle(realm_id, parent)
+        return if handle.zero?
+        h = (@frame_histories ||= {})[[parent, handle]]
+        return if h.nil?
+        target = h[:idx] + delta
+        return if target.negative? || target >= h[:entries].size
+        # Snapshot the entry we're leaving so a later forward traversal restores it.
+        h[:entries][h[:idx]] = frame_history_entry(realm_id) if h[:idx] >= 0
+        reload_frame_to_entry(realm_id, h[:entries][target])
+        h[:idx] = target   # advance only after the rebuild succeeds
+      end
+      # Record a frame navigation away from `realm_id` to `new_url`: snapshot the
+      # OUTGOING document (URL + form state) into the current entry — seeding entry
+      # 0 the first time — then drop any forward tail and push the new entry. Hooked
+      # into the frame form-submission paths; frame navigations driven by
+      # `location.href` / link clicks aren't recorded yet (history.back there falls
+      # through to the top document, as before).
+      def record_frame_nav(realm_id, new_url)
+        return if realm_id.nil? || realm_id.zero?
+        parent = @runtime.frame_realm_parent(realm_id)
+        handle = frame_container_handle(realm_id, parent)
+        return if handle.zero?
+        h = (@frame_histories ||= {})[[parent, handle]] ||= {entries: [], idx: -1}
+        outgoing = frame_history_entry(realm_id)
+        if h[:idx] >= 0
+          h[:entries][h[:idx]] = outgoing
+        else
+          h[:entries] << outgoing
+          h[:idx] = 0
+        end
+        h[:entries] = h[:entries][0..h[:idx]]
+        h[:entries] << {url: new_url.to_s, form_state: nil}
+        h[:idx] = h[:entries].size - 1
+      end
+      # The history entry for the document currently loaded in `realm_id`: its URL
+      # plus a snapshot of its form-control state.
+      def frame_history_entry(realm_id)
+        {url: frame_realm_url(realm_id), form_state: capture_frame_form_state(realm_id)}
+      end
+      def frame_realm_url(realm_id)
+        return nil unless @runtime.frame_realm_alive?(realm_id)
+        @runtime.realm_call(realm_id, '__csimLocationHref').to_s
+      rescue StandardError
+        nil
+      end
+      def capture_frame_form_state(realm_id)
+        return nil unless @runtime.frame_realm_alive?(realm_id)
+        @runtime.realm_call(realm_id, '__csimCaptureFormState')
+      rescue StandardError
+        nil
+      end
+      # Re-fetch a history entry's URL and rebuild the frame realm from it, then
+      # restore the entry's captured form state (before the element load fires).
+      def reload_frame_to_entry(realm_id, entry)
+        url = entry[:url].to_s
+        return if url.empty?
+        env = Rack::MockRequest.env_for(url, method: 'GET')
+        apply_default_request_env(env, referer: current_browsing_context_url)
+        status, headers, body = dispatch_rack_or_http(url, env, method: 'GET')
+        merge_set_cookie(headers)
+        return if download_response?(headers)
+        html = read_rack_body(body)
+        reload_frame_realm_by_id(realm_id, url, html, response_content_type(headers), restore_state: entry[:form_state])
+      end
       # Serialize + route a form submitted inside frame realm `realm_id`. We
       # serialize in the INITIATING realm (so shadow-tree controls are excluded
       # and relative URLs resolve against that document), then route by target:
@@ -4044,23 +5154,25 @@ module Capybara
       # GET fully supported. POST to a self frame needs the entered stack
       # (navigate_frame_post); POST-to-named and other targets from a nested
       # context aren't modeled (no in-scope need) — logged rather than dropped.
-      def submit_form_in_realm(realm_id, form_handle, submitter_handle)
+      def submit_form_in_realm(realm_id, form_handle, submitter_handle, entry_list = nil)
         spec = @runtime.realm_call(realm_id, '__csimFormSerialize', form_handle, submitter_handle || 0)
         return unless spec.is_a?(Hash)
         method = spec['method'].to_s.upcase
         method = 'GET' if method.empty?
         target = spec['target'].to_s
         action = spec['action'].to_s
-        fields = (spec['fields'] || []).map {|pair| [pair[0].to_s, pair[1].to_s] }
-        # Non-multipart file inputs contribute the filename only (mirror submit_form_handle's GET path).
-        (spec['fileInputs'] || []).each do |fi|
-          picks = @file_picks && @file_picks[fi['handle'].to_i] || []
-          fields << [fi['name'].to_s, picks.first ? File.basename(picks.first) : '']
-        end
-        body    = URI.encode_www_form(fields)
-        get_url = form_get_url(action, body)
+        enctype = spec['enctype'].to_s.empty? ? 'application/x-www-form-urlencoded' : spec['enctype'].to_s.downcase
+        entries = entry_list.is_a?(Array) ? entry_list : entries_from_spec(spec)
+        # GET → urlencoded query (enctype ignored); POST → enctype-encoded body.
+        get_query, = encode_entry_list(entries, 'application/x-www-form-urlencoded')
+        get_url = form_get_url(action, get_query)
         if frame_self_target?(target)
-          navigate_realm_self(realm_id, get_url, action, method, body, spec['enctype'].to_s)
+          if method == 'GET'
+            navigate_realm_self_get(realm_id, get_url)
+          else
+            body, content_type = encode_entry_list(entries, enctype)
+            navigate_realm_self_post(realm_id, resolve_against_current(action), body, content_type)
+          end
         elsif %w[_parent _top _blank].include?(target.downcase)
           log_console('warn', "nested-context form submit (target=#{target.inspect}) is not modeled")
         elsif method == 'GET'
@@ -4078,30 +5190,103 @@ module Capybara
       # URL's query with the serialized entry list (dropping any pre-existing
       # query), preserving a trailing #fragment. String-based so it works on the
       # raw (possibly relative) action attribute without URI.parse fragility;
-      # the absolute equivalent of submit_form_handle's `uri.query = body`.
+      # the absolute equivalent of submit_form_handle's `uri.query = body`. An
+      # EMPTY entry list still clears the query (→ `action?`), matching browsers.
       def form_get_url(action, body)
-        return action if body.empty?
         base, _hash, frag = action.partition('#')
         path = base.split('?', 2).first
         url  = "#{path}?#{body}"
         frag.empty? ? url : "#{url}##{frag}"
       end
-      # Navigate the initiating frame realm itself (a self-targeted form submit).
-      def navigate_realm_self(realm_id, get_url, action, method, body, enctype)
+      # A self-targeted GET form submit in the initiating frame realm: navigate
+      # that frame to the action URL (query already mutated in).
+      def navigate_realm_self_get(realm_id, get_url)
+        record_frame_nav(realm_id, get_url)
         entry = @frame_stack.find {|e| e[:realm_id] == realm_id }
-        if method == 'GET'
-          if entry
-            navigate_frame(resolve_against_current(get_url), entry: entry)
-          else
-            # A frame reached via contentWindow (not on the entered stack): its
-            # owning iframe lives in the parent document — re-navigate by realm id
-            # (relative get_url resolves against the frame's base on rebuild).
-            @runtime.call('__csimNavigateFrameByRealm', realm_id, get_url)
+        if entry
+          navigate_frame(resolve_against_current(get_url), entry: entry)
+        else
+          # A frame reached via contentWindow (not on the entered stack): its
+          # owning iframe lives in its PARENT realm's document (the main realm for
+          # a top-level frame, an intermediate realm for a nested one), so route
+          # the by-realm src-reassignment there — not unconditionally to main.
+          # (relative get_url resolves against the frame's base on rebuild).
+          parent = @runtime.frame_realm_parent(realm_id)
+          frame_realm_host_call(parent, '__csimNavigateFrameByRealm', realm_id, get_url)
+        end
+      end
+      # A self-targeted POST form submit in the initiating frame realm. POST the
+      # entity body to the action URL, then rebuild that frame's realm from the
+      # response. An ENTERED frame (on @frame_stack) reuses navigate_frame_post;
+      # a frame reached via contentWindow has no stack entry, so rebuild it by
+      # realm id (recovering its container element + parent realm) and fire the
+      # iframe element's load event the GET/src path would.
+      def navigate_realm_self_post(realm_id, url, body, content_type, depth: 0)
+        raise 'too many redirects' if depth > 10
+        record_frame_nav(realm_id, url) if depth.zero?
+        entry = @frame_stack.find {|e| e[:realm_id] == realm_id }
+        return navigate_frame_post(url, body, content_type, entry: entry) if entry
+        invalidate_find_cache
+        env = Rack::MockRequest.env_for(url, method: 'POST', input: body)
+        env['CONTENT_TYPE']   = content_type.to_s.empty? ? 'application/x-www-form-urlencoded' : content_type
+        env['CONTENT_LENGTH'] = body.bytesize.to_s
+        apply_default_request_env(env, referer: current_browsing_context_url)
+        status, headers, resp_body = dispatch_rack_or_http(url, env, method: 'POST', body: body)
+        merge_set_cookie(headers)
+        if (loc = redirect_location(status, headers))
+          next_url = resolve_against_current(loc)
+          resp_body.close if resp_body.respond_to?(:close)
+          # 307/308 preserve method + body; 301/302/303 → GET the frame (routed
+          # through the realm that OWNS the iframe, as in navigate_realm_self_get).
+          if [307, 308].include?(status)
+            return navigate_realm_self_post(realm_id, next_url, body, content_type, depth: depth + 1)
           end
-        elsif entry
-          navigate_frame_post(resolve_against_current(action), body, enctype, entry: entry)
+          parent = @runtime.frame_realm_parent(realm_id)
+          return frame_realm_host_call(parent, '__csimNavigateFrameByRealm', realm_id, next_url)
+        end
+        if download_response?(headers)
+          save_downloaded_response(url, headers, resp_body)
+          return
+        end
+        reload_frame_realm_by_id(realm_id, url.to_s, read_rack_body(resp_body), response_content_type(headers))
+      end
+      # Rebuild a frame realm reached via contentWindow (no @frame_stack entry):
+      # recover its container element handle + parent realm, swap in a fresh realm
+      # built from `html`, re-point the iframe at it, and fire the element load.
+      def reload_frame_realm_by_id(realm_id, url, html, content_type, restore_state: nil)
+        parent = @runtime.frame_realm_parent(realm_id)
+        handle = frame_container_handle(realm_id, parent)
+        return if handle.zero?
+        new_id = @runtime.reload_frame_realm(realm_id, parent.to_i, url, RuntimeShared.utf8_text(html), content_type).to_i
+        return if new_id.zero?
+        begin
+          rebind_frame_realm(parent, handle, realm_id, new_id)
+          # Restore captured form state (history traversal) BEFORE the element load
+          # fires, so the restored values are in place by the time the parent's
+          # `iframe.onload` handler — and any assertion after it — runs.
+          @runtime.realm_call(new_id, '__csimRestoreFormState', restore_state) if restore_state
+          frame_realm_host_call(parent, '__csimFireFrameElementLoad', handle)
+        rescue StandardError
+          # The element rebind/load failed — don't strand the freshly built realm
+          # (it's no longer referenced by any iframe), then surface the error.
+          @runtime.dispose_frame_realm(new_id)
+          raise
+        end
+        invalidate_find_cache
+        settle
+        new_id
+      end
+      # The iframe/frame element handle that owns `realm_id`, found in the document
+      # of its parent realm (main realm for a top-level frame).
+      def frame_container_handle(realm_id, parent)
+        frame_realm_host_call(parent, '__csimGetFrameHandle', realm_id).to_i
+      end
+      # Call a host fn in the realm that OWNS an iframe (main realm for 0/nil).
+      def frame_realm_host_call(parent_realm_id, fn, *args)
+        if parent_realm_id.nil? || parent_realm_id.zero?
+          @runtime.call(fn, *args)
         else
-          log_console('warn', "nested-context self-form POST (realm #{realm_id}) is not modeled")
+          @runtime.realm_call(parent_realm_id, fn, *args)
         end
       end
       def drain_pending_navigation
@@ -4109,6 +5294,7 @@ module Capybara
         consume_pending_frame_nav
         consume_pending_frame_submit
         consume_pending_frame_reload
+        consume_pending_frame_traverse
         consume_pending_reload
         consume_pending_history_traverse
         consume_pending_aux_window
@@ -4404,7 +5590,10 @@ module Capybara
             boot_response_into_ctx('')
             return
           end
-          record_history({method: :get, url: url}) unless from_history || depth > 0
+          unless from_history || depth > 0
+            capture_outgoing_form_state
+            record_history({method: :get, url: url})
+          end
           env = Rack::MockRequest.env_for(url, method: 'GET')
           apply_default_request_env(env, referer: referer)
           status, headers, body = dispatch_rack_or_http(url, env, method: 'GET')
@@ -4471,7 +5660,9 @@ module Capybara
         @runtime.rebuild_ctx
         # A full page (re)build disposes every frame realm, so any active
         # `within_frame` scope is now stale — fall back to the main document.
+        # Per-frame session histories are scoped to this document tree; drop them.
         reset_frame_scope
+        @frame_histories = nil
         reset_timer_state
         # The response content type drives both the parser choice (XML vs HTML —
         # XHTML/XML/SVG parse case-sensitively, no html/head/body skeleton,
@@ -4518,6 +5709,22 @@ module Capybara
         end
         opts['userAgent'] = @default_user_agent if @default_user_agent
         @document_handle = @runtime.call('__csimBootContext', opts).to_i
+        # Drain the app's deferred external-script (chunk) boot chain to quiescence.
+        # A dynamically-inserted external <script> runs async (setTimeout 0; HTML
+        # "prepare the script" force-async), so a module/chunk loader's scripts
+        # haven't executed when boot returns — leaving the page half-booted, where a
+        # negative assertion (have_no_*) passes early or a reactive control (a toggle
+        # whose handler a chunk wires up) does nothing. `run_loop_step(0)` fires only
+        # ALREADY-due timers (the setTimeout(0) chunks + their .then chains, which
+        # may insert further due-now chunks), NOT delayed app timers — so the lazy
+        # wall-sync clock is preserved (smoke_spec "queries DOM before advancing
+        # pending timers"). Bounded by the finite pending-script count.
+        if @runtime.respond_to?(:run_loop_step)
+          BOOT_SCRIPT_DRAIN_MAX_ITER.times do
+            break if @runtime.call('__csimPendingExternalScriptCount').to_i.zero?
+            @runtime.run_loop_step(0, SETTLE_MAX_ITER_TASKS, yield_on_gen: false)
+          end
+        end
         @polling_grace = POST_NAV_POLL_GRACE_POLLS
       end
 
@@ -4638,10 +5845,20 @@ module Capybara
         net_http_fetch(url, env, method: method, body: body) || @app.call(env)
       end
 
+      # Whether this is a universal-server context (the WPT runner's wptserve shim
+      # serves every host in-process). Gates cross-origin eager frame building: in
+      # such a context a cross-origin iframe's content IS served locally, so it
+      # eager-builds; an ordinary app leaves cross-origin frames lazy (= baseline),
+      # so an external embed isn't eager-fetched. A simple flag, NOT per-URL —
+      # url_is_local? compares only host:port (ignoring scheme) and treats a missing
+      # ref origin as local, which would eager-build frames the baseline left lazy.
+      def all_hosts_local? = @all_hosts_local
+
       # Path-only or fragment-only URLs are always against the current
       # origin. For absolute URLs, compare host:port to the cached
       # parsed @current_url (or default_host on first navigate).
       def url_is_local?(url)
+        return true if @all_hosts_local
         s = url.to_s
         return true if s.empty? || s.start_with?('/', '#', '?')
         uri = safe_uri(s)
@@ -4737,18 +5954,40 @@ module Capybara
       end
 
       # Header names/values are TEXT (RFC 9110: field values are ASCII); Rack
-      # hands them over BINARY-tagged (see `RuntimeShared.utf8_text`).
+      # hands them over BINARY-tagged (see `RuntimeShared.utf8_text`). Per-value HTTP
+      # -whitespace normalization happens upstream, BEFORE duplicate values are
+      # combined (WptRunner.combine_headers) — not here, where a combined value like
+      # `", "` (two empty fields) would wrongly lose its trailing space. An
+      # Array-valued header (a Rack app emitting a repeated field) is combined with
+      # `, ` — the WHATWG "combine" separator getAllResponseHeaders exposes, matching
+      # both real browsers and the harness's combine_headers.
       def stringify(headers)
         out = {}
         headers.each do |k, v|
-          out[k.to_s] = RuntimeShared.utf8_text(v.is_a?(Array) ? v.join(',') : v.to_s)
+          out[k.to_s] = RuntimeShared.utf8_text(v.is_a?(Array) ? v.join(', ') : v.to_s)
         end
         out
       end
 
+      # The Fetch "redirect status" set — ONLY these are followed. 300 (multiple
+      # choice), 304 (not modified), 305/306 (deprecated) are NOT redirects: the 3xx
+      # response is returned to the caller as-is (xhr send-redirect basics).
+      REDIRECT_STATUSES = [301, 302, 303, 307, 308].freeze
+      # Statuses whose response has no body (Fetch "null body status") — the body is dropped
+      # and response.body is null (response-null-body). (101 is unreachable here.)
+      NULL_BODY_STATUSES = [204, 205, 304].freeze
+      # Request-body headers removed when a redirect nulls the body (method → GET).
+      REDIRECT_DROPPED_HEADERS = %w[content-encoding content-language content-location content-type content-length].freeze
       def redirect_location(status, headers)
-        return nil unless (300..399).include?(status.to_i)
-        headers['location'] || headers['Location']
+        return nil unless REDIRECT_STATUSES.include?(status.to_i)
+        loc = headers['location'] || headers['Location']
+        loc = loc.first if loc.is_a?(Array)   # Rack 3 permits array-valued header fields
+        # A blank (or absent) Location has no FOLLOWABLE target: an empty value parses back
+        # to the current URL, so following it would just self-redirect. Return nil so a
+        # caller renders the 3xx as-is rather than looping — the several navigation handlers
+        # rely on this. (The fetch redirect loop recognizes a present-but-empty Location
+        # separately and turns it into a network error per Fetch — see rack_fetch.)
+        loc unless loc.to_s.empty?
       end
 
       def resolve_against_current(url, use_base: false)
@@ -4778,6 +6017,218 @@ module Capybara
         dom_call('__csimBaseHref').to_s
       end
 
+      # Fetch "CORS-safelisted method" / "…request-header" / "…Content-Type". A request
+      # is "simple" (no preflight) iff its method is safelisted AND every author header is
+      # safelisted (Content-Type only for a urlencoded / multipart / text/plain value).
+      CORS_SAFELISTED_METHODS = %w[GET HEAD POST].freeze
+      CORS_SAFELISTED_HEADERS = %w[accept accept-language content-language content-type].freeze
+      # RFC 7230 `token` (tchar+) — a valid HTTP method / field-name. Used to reject a
+      # preflight whose Access-Control-Allow-Methods / -Headers carries a malformed value.
+      HTTP_TOKEN = /\A[!#$%&'*+\-.^_`|~0-9A-Za-z]+\z/.freeze
+      CORS_SAFELISTED_CTYPES  = %w[application/x-www-form-urlencoded multipart/form-data text/plain].freeze
+
+      # The sorted, lowercased author header names that are NOT CORS-safelisted (a
+      # non-safe Content-Type counts). These are echoed in Access-Control-Request-Headers
+      # for the preflight and must be covered by Access-Control-Allow-Headers.
+      def cors_unsafe_headers(headers)
+        (headers || {}).filter_map {|k, v|
+          name = k.to_s.downcase
+          next if name.start_with?('x-csim') || name == 'content-length'
+          if name == 'content-type'
+            essence = v.to_s.split(';', 2).first.to_s.strip.downcase
+            CORS_SAFELISTED_CTYPES.include?(essence) ? nil : name
+          else
+            CORS_SAFELISTED_HEADERS.include?(name) ? nil : name
+          end
+        }.uniq.sort
+      end
+
+      def cors_unsafe_request?(method, headers)
+        !CORS_SAFELISTED_METHODS.include?(method.to_s.upcase) || !cors_unsafe_headers(headers).empty?
+      end
+
+      # Fetch "CORS check" on a cross-origin response: it must allow the request's
+      # (effective) origin via Access-Control-Allow-Origin. A NON-credentialed request
+      # accepts `*` or the exact origin; a CREDENTIALED one (withCredentials) forbids
+      # `*` — the ACAO must be the exact origin AND Access-Control-Allow-Credentials
+      # must be `true` (access-control-and-redirects-async-same-origin credentials cases).
+      def cors_response_ok?(resp_headers, origin, credentialed)
+        acao = cors_header(resp_headers, 'access-control-allow-origin')
+        return false if acao.nil?
+        if credentialed
+          return false unless acao == origin
+          cors_header(resp_headers, 'access-control-allow-credentials').to_s.downcase == 'true'
+        else
+          acao == '*' || acao == origin
+        end
+      end
+
+      # Whether a URL carries userinfo (`user[:password]@`). A CORS request to such a
+      # URL is a network error (access-control-and-redirects "user info" subtest).
+      def url_has_userinfo?(url)
+        u = URI.parse(url.to_s)
+        !u.userinfo.to_s.empty?
+      rescue URI::InvalidURIError
+        false
+      end
+
+      # An author-set conditional header means the CALLER is doing its own revalidation,
+      # so the UA cache must step aside: the request reaches the origin and the server's
+      # own 304/200 decision is returned (send-conditional), not a cached hit.
+      CONDITIONAL_REQUEST_HEADERS = %w[if-none-match if-modified-since if-match if-unmodified-since if-range].freeze
+      def request_has_conditional_headers?(headers)
+        headers.is_a?(Hash) && headers.any? {|k, _| CONDITIONAL_REQUEST_HEADERS.include?(k.to_s.downcase) }
+      end
+
+      # Run the CORS preflight unless a cached result already covers this request (Fetch
+      # "CORS-preflight cache"): a prior preflight to the same (origin, url) within its
+      # Access-Control-Max-Age that allows this method + headers lets the actual request
+      # skip the OPTIONS (access-control-basic-allow-preflight-cache). Returns false (=
+      # network error) only when a fresh preflight is needed AND fails.
+      def cors_preflight_ok?(target, method, headers, req_origin, credentialed, referer)
+        return true if cors_preflight_cached?(target, req_origin, method, headers, credentialed)
+        result = cors_run_preflight(target, method, headers, req_origin, credentialed, referer)
+        return false unless result
+        # Cache the grant for Max-Age seconds so a covered follow-up skips the preflight.
+        # The key is (origin, url, credentialed): a credentialed grant (ACAO echoing the
+        # origin, no `*` matching) can't cover an uncredentialed follow-up or vice versa,
+        # so the two are cached apart. Expiry uses the REAL monotonic clock (not the
+        # virtual one), so a test that virtual-sleeps past Max-Age to force a re-preflight
+        # isn't caught yet.
+        @cors_preflight_cache[[req_origin, target, credentialed]] = result.merge(stored_at: Process.clock_gettime(Process::CLOCK_MONOTONIC)) if result[:max_age].positive?
+        true
+      end
+
+      # Whether a cached preflight grant covers this request (not expired + method/headers
+      # allowed). A method/header the cache doesn't cover — or an expired entry — forces a
+      # fresh preflight (cache-invalidation-by-method / -header / -timeout).
+      def cors_preflight_cached?(target, req_origin, method, headers, credentialed)
+        entry = @cors_preflight_cache[[req_origin, target, credentialed]]
+        return false unless entry
+        return false if Process.clock_gettime(Process::CLOCK_MONOTONIC) - entry[:stored_at] >= entry[:max_age]
+        cors_grant_allows?(entry[:methods], entry[:headers], method, cors_unsafe_headers(headers), credentialed)
+      end
+
+      # `Authorization` is Fetch's sole "CORS non-wildcard request-header name": a preflight
+      # `Access-Control-Allow-Headers: *` never covers it — it must be listed by name — even
+      # for an uncredentialed request (cors-preflight "authorization not covered by wildcard").
+      CORS_NON_WILDCARD_REQUEST_HEADERS = %w[authorization].freeze
+
+      # Does a preflight grant (its Access-Control-Allow-Methods / -Headers) cover this
+      # request: the method is allowed / `*` / CORS-safelisted, and every unsafe header is
+      # allowed / `*`. Shared by the fresh-preflight accept check and the cache-hit check.
+      # For a CREDENTIALED request the wildcard loses its meaning — Fetch's "CORS-preflight
+      # fetch" matches `*` against no method/header when credentials mode is include, so a
+      # non-listed method or unsafe header is rejected (cors-preflight-star credentialed).
+      def cors_grant_allows?(allow_methods, allow_headers, method, unsafe_headers, credentialed = false)
+        # The method match is byte-CASE-SENSITIVE (Fetch normalizes the request method but
+        # compares it verbatim against Access-Control-Allow-Methods): `delete` in the grant
+        # does not cover a `DELETE` request. Safelisted GET/HEAD/POST pass regardless
+        # (they're always normalized to upper-case) (cors-preflight-star method-case).
+        m = method.to_s
+        method_ok = allow_methods.include?(m) || CORS_SAFELISTED_METHODS.include?(m) || (!credentialed && allow_methods.include?('*'))
+        return false unless method_ok
+        wildcard_headers = !credentialed && allow_headers.include?('*')
+        unsafe_headers.all? {|h|
+          allow_headers.include?(h) || (wildcard_headers && !CORS_NON_WILDCARD_REQUEST_HEADERS.include?(h))
+        }
+      end
+
+      # Fetch "CORS-preflight fetch": send an OPTIONS with Access-Control-Request-Method
+      # / -Headers + Origin; on success (ok-status, ACAO match, and the grant covers the
+      # method + unsafe headers) return the grant {methods, headers, max_age} for the
+      # cache, else nil. A credentialed preflight additionally requires the response to
+      # allow credentials (ACAC:true) and forbids `*` in the origin/method/header grants.
+      def cors_run_preflight(target, method, headers, req_origin, credentialed, referer)
+        unsafe = cors_unsafe_headers(headers)
+        env    = Rack::MockRequest.env_for(target, method: 'OPTIONS')
+        env['REQUEST_METHOD'] = 'OPTIONS'
+        # The preflight's Referer is the request's referrer under its referrer policy —
+        # the SAME value the actual request sends (computed by the caller), not the raw
+        # document URL (cors-preflight-referrer).
+        apply_default_request_env(env, referer: referer, force: false)
+        # A CORS-preflight is a fetch, so it carries fetch's default `Accept: */*` (NOT
+        # the navigation Accept apply_default_request_env sets) — some handlers reject a
+        # preflight whose Accept isn't */* (preflight.py).
+        env['HTTP_ACCEPT'] = '*/*'
+        # A CORS-preflight is always uncredentialed — it carries no cookies, even when the
+        # actual request that follows is credentialed.
+        env.delete('HTTP_COOKIE')
+        env['HTTP_ORIGIN'] = req_origin
+        # Access-Control-Request-Method carries the request's (already-normalized) method
+        # VERBATIM — `patch` stays `patch`, matching the byte-case-sensitive grant check.
+        env['HTTP_ACCESS_CONTROL_REQUEST_METHOD'] = method.to_s
+        env['HTTP_ACCESS_CONTROL_REQUEST_HEADERS'] = unsafe.join(',') unless unsafe.empty?
+        status, ph, pbody = dispatch_rack_or_http(target, env, method: 'OPTIONS', body: nil)
+        pbody.close if pbody.respond_to?(:close)
+        return nil unless (200..299).include?(status.to_i)
+        acao = cors_header(ph, 'access-control-allow-origin')
+        # A credentialed preflight can't be allowed by the wildcard origin and must carry
+        # Access-Control-Allow-Credentials: true (cors-preflight-star credentialed).
+        return nil unless credentialed ? acao == req_origin : (acao == '*' || acao == req_origin)
+        return nil if credentialed && cors_header(ph, 'access-control-allow-credentials') != 'true'
+        allow_methods = cors_list(cors_header(ph, 'access-control-allow-methods'))
+        allow_headers = cors_list(cors_header(ph, 'access-control-allow-headers')).map(&:downcase)
+        # Fetch "extract header list values" fails when a grant contains a malformed token
+        # (`Access-Control-Allow-Methods: Bad value` — a space isn't a tchar), and a failed
+        # extraction is a network error (cors-preflight-response-validation). Methods and
+        # header names are both HTTP tokens; `*` is a valid tchar so the wildcard passes.
+        return nil unless (allow_methods + allow_headers).all? {|t| t.match?(HTTP_TOKEN) }
+        return nil unless cors_grant_allows?(allow_methods, allow_headers, method, unsafe, credentialed)
+        {methods: allow_methods, headers: allow_headers, max_age: cors_header(ph, 'access-control-max-age').to_i}
+      end
+
+      # Fetch "CORS-safelisted response-header name" — always exposed to script for a
+      # cross-origin response, without being listed in Access-Control-Expose-Headers.
+      CORS_SAFELISTED_RESPONSE_HEADERS = %w[
+        cache-control content-language content-length content-type expires last-modified pragma
+      ].freeze
+
+      # The response headers a cross-origin "cors" response exposes to getResponseHeader /
+      # getAllResponseHeaders: the CORS-safelisted set plus any named in Access-Control
+      # -Expose-Headers (`*` exposes all — only valid without credentials, which these
+      # cases don't use).
+      def cors_exposed_headers(headers)
+        # set-cookie / set-cookie2 are forbidden response-header names — NEVER exposed to
+        # script, even under `Access-Control-Expose-Headers: *`. x-csim-status-text is our
+        # internal reason-phrase sentinel (response_hash lifts it into statusText, which
+        # IS exposed cross-origin, then strips it from the script-visible map), so it must
+        # survive the filter.
+        forbidden = %w[set-cookie set-cookie2]
+        expose    = cors_list(cors_header(headers, 'access-control-expose-headers')).map(&:downcase)
+        return headers.reject {|k, _| forbidden.include?(k.to_s.downcase) } if expose.include?('*')
+        allowed = CORS_SAFELISTED_RESPONSE_HEADERS + expose + ['x-csim-status-text']
+        headers.select {|k, _| allowed.include?(k.to_s.downcase) }
+      end
+
+      # Case-insensitive response-header lookup + comma-list split for the CORS checks.
+      def cors_header(headers, name)
+        pair = headers.find {|k, _| k.to_s.downcase == name }
+        pair&.last.to_s
+      end
+
+      def cors_list(value)
+        value.to_s.split(',').map(&:strip).reject(&:empty?)
+      end
+
+      # The origin of a URL — `scheme://host[:port]` with the default port (80/443)
+      # elided — for the CORS same/cross-origin comparison. nil for a non-http(s) or
+      # unparseable URL (about:blank / data: / a relative current_url) so CORS never
+      # treats those as a comparable origin.
+      def url_origin(url)
+        u = URI.parse(url.to_s)
+        return nil unless u.scheme && u.host && u.scheme.match?(/\Ahttps?\z/i)
+        # An origin is (scheme, host, port) compared case-insensitively on scheme+host —
+        # so canonicalize both to lowercase, else http://Example.com vs http://example.com
+        # would mis-classify a same-origin request as cross-origin.
+        scheme  = u.scheme.downcase
+        default = scheme == 'https' ? 443 : 80
+        port    = u.port && u.port != default ? ":#{u.port}" : ''
+        "#{scheme}://#{u.host.downcase}#{port}"
+      rescue URI::InvalidURIError
+        nil
+      end
+
       def carry_fragment(from_url, to_url)
         from = URI.parse(from_url.to_s)
         to   = URI.parse(to_url.to_s)
@@ -4794,7 +6245,7 @@ module Capybara
       # within the `record_action` block, which handles begin/finish
       # step bookkeeping + on-failure DOM snapshot.
       module RecordedActions
-        def visit(url)
+        def visit(url, referer: nil)
           record_action(:visit, "visit #{url}") { super }
         end
         def refresh