capybara-simulated 0.6.0 → 0.8.0

data/lib/capybara/simulated/browser.rb

@@ -9,11 +9,13 @@ require 'net/http'
 require 'openssl'
 require 'rack/mock'
 require 'securerandom'
+require 'set'
 require 'socket'
 require 'thread'
 require 'time'
 require 'uri'
 require 'uri/idna'   # WHATWG/UTS46 domain-to-ASCII/Unicode (uri-idna gem)
+require 'zlib'
 require_relative 'asset_cache'
 require_relative 'errors'
 require_relative 'stack_resolver'
@@ -54,6 +56,18 @@ module Capybara
       # `Last-Modified` per RFC 9111.
       @@asset_cache = AssetCache.new
 
+      # Opt-in: capture each request's author header names verbatim on the Rack env
+      # (`csim.raw_request_headers`) so the WPT .py-handler harness can replay them with
+      # exact casing / token chars (inspect-headers / echo-headers). OFF for real app
+      # traffic — nothing there consumes the list, so it would only allocate per request.
+      @@capture_raw_request_headers = false
+      def self.capture_raw_request_headers
+        @@capture_raw_request_headers
+      end
+      def self.capture_raw_request_headers=(v)
+        @@capture_raw_request_headers = v
+      end
+
       attr_writer :timers_active
 
       # The Driver's handle for the window this Browser backs (set right after
@@ -182,7 +196,7 @@ module Capybara
         Rack::Mime.mime_type(File.extname(path.to_s), '')
       end
 
-      def initialize(app, driver: nil, js_engine: nil, cookies: nil, local_storage: nil, all_hosts_local: nil)
+      def initialize(app, driver: nil, js_engine: nil, cookies: nil, auth_cache: nil, local_storage: nil, cache_storage: nil, all_hosts_local: nil)
         @app                          = app
         @driver                       = driver
         @all_hosts_local_override     = all_hosts_local
@@ -225,7 +239,16 @@ module Capybara
         # see the same auth state and storage as the primary. Tests
         # without a Driver (gem-internal callers) get fresh jars.
         @cookies                      = cookies       || {}
+        # HTTP Basic-auth credential cache, keyed by target origin: once credentials authenticate an
+        # origin, the UA sends them pre-emptively for later credentialed requests to it (RFC 7617
+        # §2.2), so a Basic-auth resource loads without re-challenging. Session-scoped (cleared on
+        # reset) and Driver-injected like the cookie jar, so target=_blank aux windows share one
+        # session's auth state (a real browser shares the HTTP auth cache across a session's tabs).
+        @auth_cache                   = auth_cache     || {}
         @local_storage                = local_storage || {}
+        # Cache Storage is origin-shared like localStorage (the Driver owns the store
+        # and injects it into every window Browser), origin-partitioned within.
+        @cache_storage                = cache_storage || {}
         @session_storage              = {}
         @sticky_headers               = {}
         @timers_active                = false
@@ -265,12 +288,16 @@ module Capybara
         @current_realm_id             = nil
         @frame_stack                  = []
         @last_tick_ts                 = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        # The first find of a navigation observes the current DOM without a pre-tick (see
+        # timer_wait_elapsed?); armed by the first find, disarmed by reset_timer_state.
+        @pre_tick_armed               = false
         @polling_grace                = nil
         @last_polled_gen              = nil
         @idle_settle_polls            = 0
         @ticking                      = false
         @history                      = []
         @history_idx                  = -1
+        @cors_preflight_cache         = {}
         @modal_handlers               = []
         # Geolocation override (CDP-ish). nil = no override configured →
         # navigator.geolocation reports POSITION_UNAVAILABLE. Ruby-backed so
@@ -317,6 +344,13 @@ module Capybara
         @websocket_sockets    = {}   # id → csim's socket end (main thread owns this hash)
         @websocket_app_sockets = {}  # id → the app's hijack end (closed on teardown)
         @websocket_queue      = Thread::Queue.new
+        @websocket_queue_head = nil   # one-slot buffer for an event hold_for_ws_close parked ahead of the queue
+        # In-flight `ws.close()` handshakes: hold the virtual clock until the reader surfaces the
+        # server's echoed close frame (a `__close` event) so a test awaiting `onclose` can't have
+        # its virtual-timeout outrun that real off-thread reply. Counted in ws_close, cleared as
+        # deliver_websocket_events delivers each terminal event. See hold_for_ws_close.
+        @ws_close_pending       = 0
+        @ws_close_wait_deadline = nil
         # All frame writes (the reader thread's pong replies + the main thread's
         # send/close) go through one socket; serialise them so two threads can't
         # interleave bytes into a corrupt frame.
@@ -340,10 +374,73 @@ module Capybara
         @worker_seq    = 0
         @workers       = {}
         @worker_outbox = Thread::Queue.new
+        # One-slot head buffer for the settle wait: an event popped while blocking on the outbox
+        # is parked here (a push-back would reorder it behind concurrent worker pushes) and
+        # consumed first by the next deliver_worker_messages.
+        @worker_outbox_head = nil
         # Outstanding posts-to-worker; `polling?` stays true while > 0
         # so long-running compute (e.g. mozjpeg over an 8900×8900 frame)
         # isn't starved by the settle_gen idle gate.
         @worker_in_flight = 0
+        # BroadcastChannel posts pushed to worker inboxes that the worker hasn't yet processed. Kept
+        # SEPARATE from @worker_in_flight: a broadcast is fire-and-forget (a listen-only worker never
+        # replies), so it must not be "answered" by an unrelated postMessage reply. The worker acks
+        # each broadcast it delivers (a `bcack` outbox event), which decrements this; `worker_pending?`
+        # stays true until then so settle waits for the delivery.
+        @worker_broadcast_pending = 0
+        # Client → service-worker messages awaiting the worker's ack (it processed the inbound
+        # `message`). A SW `postMessage` produces no 1:1 reply (the SW replies via client.postMessage,
+        # a separate outbox event), so — like broadcasts — it needs its own pending tally, or a
+        # listen-only SW would leave settle perpetually non-idle.
+        @sw_message_pending = 0
+        # Controlled-client fetches awaiting the SW's respondWith (released by a `fetch_response`).
+        @sw_fetch_pending = 0
+        # Streaming respondWith bodies still open (head delivered, terminal frame not yet), keyed by
+        # the emitting worker handle → the [realm_id, fetch_id] frames it opened. Lets worker_terminate
+        # release + error a stream its worker died mid-flight, instead of stranding @sw_fetch_pending.
+        @sw_open_streams = Hash.new {|h, k| h[k] = {} }
+        # Deadline (CLOCK_MONOTONIC) capping how long the event-loop drain holds the virtual clock
+        # for an outstanding SW-side fetch (see run_event_loop_frame). Shared across frames so a
+        # stuck fetch costs the budget ONCE, not per frame; reset on each delivered reply so the next
+        # fetch in a sequence waits afresh.
+        @sw_fetch_wait_deadline = nil
+        # Same budget for a pending SW message swack / broadcast ack (drain_pending_message_reply);
+        # separate from the fetch deadline so a message wait and a fetch hold don't share a spent
+        # budget. Reset once no message/broadcast reply is outstanding.
+        @sw_msg_wait_deadline = nil
+        # SW navigation-interception state. `@sw_registrations` mirrors scope-href → active
+        # worker handle (from the client lifecycle) so a navigation fetched Ruby-side — before
+        # the destination realm's JS exists — can find its controlling SW; it survives the
+        # per-visit rebuild_ctx (unlike the per-realm JS registrations Map). A navigation fetch
+        # is awaited SYNCHRONOUSLY on `@sw_nav_outbox` (a dedicated queue, off the general outbox)
+        # keyed by a NEGATIVE `@sw_nav_seq` id so it never mixes with client-fetch replies.
+        @sw_registrations = {}
+        # Navigation Preload state, per active-worker HANDLE (the registration's active worker — the
+        # client's `registration.active._handle` and the worker's own `__csimWorkerHandle` are the
+        # same id, so both isolates key here identically). {enabled:, header:}; absent → the spec
+        # default {false, 'true'}. Read at navigation time to decide whether to issue the parallel
+        # preload request (see service_worker_navigation_fetch), and by the NavigationPreloadManager.
+        # EARNED GAP: the spec keeps this per-REGISTRATION (it survives a SW update); keying by the
+        # active worker's handle means an update — which mints a fresh handle — resets it to default.
+        # No vendored subtest enables preload then updates the worker, so handle-keying (which needs no
+        # scope plumbing to the worker isolate) is the simpler load-bearing choice.
+        @sw_navpreload = {}
+        # clients.claim() events that arrived before their scope was mirrored into @sw_registrations
+        # (activate→claim() races the client-side lifecycle) — buffered here, flushed by sw_register_scope.
+        @sw_pending_claims = []
+        @sw_nav_outbox    = Thread::Queue.new
+        @sw_nav_seq       = 0
+        # Service-worker Client registry: realm id → {handle, rec} for every
+        # controlled frame/window client, mirrored into the SW's clientsById so
+        # matchAll / getClientByURL see the real set. `@sw_realm_controller` records
+        # each realm's controller so an opaque child (about:blank / srcdoc) inherits
+        # it. Both keyed by realm id, cleared when the last worker exits.
+        @sw_clients          = {}
+        @sw_realm_controller = {}
+        # Cross-isolate MessagePort channels: channel id → {realm:, sw:} endpoints. A port
+        # transferred between a client realm and a worker/SW isolate registers both ends here;
+        # the browser relays each side's postMessage to the other. Cleared with the workers.
+        @port_channels       = {}
         # Workers whose initial script hasn't finished running yet. A worker that
         # posts immediately on spawn (no main->worker message first) would leave
         # `@worker_in_flight` at 0, so `worker_pending?` would be false in the gap
@@ -351,6 +448,16 @@ module Capybara
         # stop waiting before the message lands. Count spawned-but-not-initialised
         # workers so the async drain holds until the initial script has run.
         @worker_initializing = 0
+        # Worker threads actively PROCESSING a plain postMessage (dequeued, not yet back at
+        # the idle poll). `@worker_in_flight` counts posted messages minus delivered replies,
+        # but one request yields MANY replies (progress updates + the final resolve), so it
+        # under-counts to 0 mid-handshake and `worker_pending?` would go false while the worker
+        # is still working — settle then breaks and abandons a multi-round protocol
+        # (Tesseract's createWorker load→loadLanguage→initialize→recognize, each a round-trip
+        # gated on a slow synchronous WASM step). The SW / broadcast message kinds have their
+        # own pending counters, so only the postMessage branch bumps this. Held under
+        # @worker_init_lock alongside @worker_initializing.
+        @worker_busy = 0
         @worker_init_lock = Mutex.new
         # Cross-isolate `blob:` store. Worker isolates can't see the
         # main scope's `__csimBlobs` Map, so we mirror bytes here and
@@ -367,6 +474,10 @@ module Capybara
         @transfer_buffer_lock = Mutex.new
         @transfer_buffers     = {}
         @transfer_buffer_seq  = 0
+        # Per-font ascent/descent probe cache for canvas text (render_text is
+        # worker-reachable via OffscreenCanvas, like decode_image).
+        @font_vmetrics_lock   = Mutex.new
+        @font_vmetrics        = {}
         # Zero-copy postMessage transfer tokens (rusty_racer >= 0.1.6
         # `RustyRacer.transferOut`): a buffer in a `postMessage` transfer list
         # crosses isolates by token (no byte copy), its source detached. A token
@@ -384,13 +495,52 @@ module Capybara
         # Cross-window BroadcastChannel messages from OTHER windows, delivered to
         # this window's matching channels on settle. [{name, data}] (same thread).
         @broadcast_inbox      = []
-      end
+        # Storage `storage` events queued for the OTHER same-origin documents (a change
+        # fires at every same-origin document EXCEPT the one that made it), delivered on
+        # settle. [{kind, key, old, new, url, source}] (same thread).
+        @storage_inbox        = []
+        # BroadcastChannel isolate-wide registry + global ordered delivery queue (the multi-realm
+        # path — see broadcast_to_windows / bc_post). `@bc_registry` is keyed by [realm_id, local_id]
+        # → {seq, name, origin_key, closed}; `@bc_seq` is the isolate-wide creation counter that
+        # orders delivery "oldest channel first"; `@bc_queue` is the FIFO of pending {realm_id,
+        # local_id, data, origin} deliveries drained in order by deliver_window_messages.
+        @bc_seq               = 0
+        @bc_registry          = {}
+        @bc_queue             = []
+      end
+
+      # Max BroadcastChannel deliveries drained per `deliver_broadcast_queue` call — a safety bound on a
+      # pathological mutual re-post loop (see there). Far above any real fan-out (the ordering test is ~14).
+      BROADCAST_DRAIN_CAP      = 100_000
 
       # Worker thread polling and termination intervals — split so a
       # tuning change to one doesn't accidentally rebind the other.
-      WORKER_POLL_INTERVAL   = 0.05
-      WORKER_TERMINATE_GRACE = 0.05
-      private_constant :WORKER_POLL_INTERVAL, :WORKER_TERMINATE_GRACE
+      WORKER_POLL_INTERVAL     = 0.05
+      # Max wall time settle blocks on a worker thread's outbox per call while it processes an
+      # inbound message / fetch (releasing the GVL so it runs). Bounded so a genuinely stuck worker
+      # can't hang settle — the outer poll loop re-drives across calls.
+      WORKER_ROUND_TRIP_BUDGET = 1.0
+      WORKER_TERMINATE_GRACE   = 0.05
+      # Max timer-draining rounds `drive_worker_to_quiescence` runs before yielding back
+      # to the poll loop. A message handler's async bring-up (Emscripten WASM init) settles
+      # in a handful of microtask/timer rounds; the cap only bites a worker that keeps
+      # rescheduling timers (a setInterval), which the poll loop then continues to advance.
+      WORKER_QUIESCE_MAX_ROUNDS = 256
+      # Per-frame GVL yield (run_event_loop_frame) while a worker thread is alive, so it gets a clean
+      # slice for cross-isolate work (transferIn / message replies) instead of being starved by the
+      # phase-1 spin. 0.3ms is the empirical floor for a deterministic cross-isolate transfer reply;
+      # 0.5ms adds margin for machine variance while staying cheap (only paid on worker/SW files).
+      WORKER_GVL_YIELD         = 0.0005
+      # Client-realm handler for each streaming respondWith frame kind (see deliver_worker_messages
+      # + sw-client.js). `fr_start` builds a ReadableStream-backed Response; `fr_chunk` enqueues;
+      # `fr_close` / `fr_error` close / error the body stream.
+      STREAM_FRAME_FNS = {
+        'fr_start' => '__csim_swFetchStreamStart',
+        'fr_chunk' => '__csim_swFetchStreamChunk',
+        'fr_close' => '__csim_swFetchStreamClose',
+        'fr_error' => '__csim_swFetchStreamError'
+      }.freeze
+      private_constant :WORKER_POLL_INTERVAL, :WORKER_ROUND_TRIP_BUDGET, :WORKER_TERMINATE_GRACE, :WORKER_GVL_YIELD, :WORKER_QUIESCE_MAX_ROUNDS, :STREAM_FRAME_FNS
 
       # `js_engine` picks the JS runtime: `:v8` (rusty_racer, fastest
       # per-spec) or `:quickjs` (quickjs.rb, smaller per-VM footprint —
@@ -596,7 +746,7 @@ module Capybara
           # browsing context to route into. Distinguish that (unsupported
           # engine) from a frame that simply failed to build (below), so the
           # error doesn't misattribute a load failure to the engine.
-          unless @runtime.respond_to?(:realm_call)
+          unless @runtime.supports_frames?
             raise Capybara::Simulated::FrameNotSupported,
               'within_frame needs a per-frame browsing context, which only the ' \
               'V8 (rusty_racer) engine provides; QuickJS keeps a same-realm fallback.'
@@ -725,6 +875,9 @@ module Capybara
 
       def find_with_timer_fallback(kind, arg, ctx)
         tick_real_time if timer_wait_elapsed?
+        # After the first find of a navigation, a later find IS Capybara retrying — arm the pre-tick
+        # so subsequent polls advance the clock (a timer-driven element / removal the test awaits).
+        @pre_tick_armed = true
         result = cached_find(kind, arg, ctx) { yield }
         # An empty result is the wait-for-it case: Capybara is retrying for
         # an element that hasn't appeared yet. Re-tick so the next poll
@@ -758,8 +911,20 @@ module Capybara
       # this above one Ruby boundary so a single visit+find pair
       # doesn't accidentally tick.
       FIND_PRE_TICK_MIN_S = 0.05
+      # Whether a find should advance the clock BEFORE reading the DOM. The FIRST find after a
+      # navigation observes the current (pre-timer) DOM unconditionally — the "query the DOM before
+      # advancing pending timers" contract — so it never pre-ticks; only a LATER find (Capybara
+      # retrying because the element wasn't there yet) does, gated on the tick FREQUENCY. Anchoring
+      # the first-find exemption on a flag (not the wall clock) keeps it deterministic: a >50 ms wall
+      # gap between the navigation and the first find under full-suite load must NOT fire a parked
+      # setTimeout(0) the page just scheduled (smoke_spec "queries the current DOM …").
+      # NOTE: the same first-find contract after a USER ACTION (click/fill) is still gated only on the
+      # 50 ms wall clock — @pre_tick_armed is disarmed by reset_timer_state (navigation) alone. Actions
+      # keep the wall gate because the post-action pre-tick timing is tuned against the debounce-
+      # between-actions app cases (Avo actions_spec:464); no action-path flake has surfaced there.
       def timer_wait_elapsed?
-        @timers_active &&
+        @pre_tick_armed &&
+          @timers_active &&
           (Process.clock_gettime(Process::CLOCK_MONOTONIC) - @last_tick_ts) >= FIND_PRE_TICK_MIN_S
       end
 
@@ -816,6 +981,30 @@ module Capybara
         tag(handle) == 'input' && attr(handle, 'type').to_s.downcase == 'file'
       end
       def visible?(handle)    = dom_call('__csimVisible', handle) ? true : false
+      # `obscured?` — coarse occlusion / hit-test in JS (layout.js). Non-visible / out-of-viewport /
+      # click-point-lands-on-another-element → obscured.
+      def obscured?(handle)   = dom_call('__csimObscured', handle) ? true : false
+      # `rect` — the element's coarse border-box from the layout engine, as the full 8-field box.
+      # Two key styles on purpose: Capybara's spatial `Rectangle` reads STRING keys
+      # (`position['top']`); Discourse's `wait_for_animation` reads the SYMBOL key (`rect[:x]`).
+      def rect(handle)
+        r = dom_call('__csimRect', handle)
+        x = (r['x'] || 0).to_f
+        y = (r['y'] || 0).to_f
+        w = (r['width'] || 0).to_f
+        h = (r['height'] || 0).to_f
+        {
+          x:, y:, width: w, height: h, top: y, left: x, bottom: y + h, right: x + w,
+          'x' => x, 'y' => y, 'width' => w, 'height' => h, 'top' => y, 'left' => x, 'bottom' => y + h, 'right' => x + w
+        }
+      end
+      # `scroll_to` — drive a real scroll offset in the layout engine (layout.applyScrollTo). `target`
+      # is a target element's handle (or nil); `pos` a keyword (`:top`/`:bottom`/`:center`); `x`/`y`
+      # an explicit coordinate. Symbols are stringified for the JS side.
+      def scroll_to(handle, target = nil, pos = nil, x = nil, y = nil)
+        dom_call('__csimScrollTo', handle, target, pos&.to_s, x, y)
+        nil
+      end
 
       # Capybara::Driver::Node surface — Node calls `check_stale`
       # before each read, and that advances the virtual clock.
@@ -1006,7 +1195,8 @@ module Capybara
         env = Rack::MockRequest.env_for(url, method: 'GET')
         env['HTTP_USER_AGENT'] = @default_user_agent || USER_AGENT
         env['REMOTE_ADDR']     = self.class.remote_addr_for(env['HTTP_HOST'] || env['SERVER_NAME'])
-        env['HTTP_COOKIE']     = document_cookie unless @cookies.empty?
+        ck = cookie_header_for(env_cookie_host(env))
+        env['HTTP_COOKIE']     = ck              unless ck.empty?
         env['HTTP_REFERER']    = @current_url    unless @current_url.nil? || @current_url.empty?
         status, headers, body = @app.call(env)
         return unless status.to_i == 200
@@ -1191,19 +1381,30 @@ module Capybara
       end
 
       # Element-to-element drag. Capybara's `Element#drag_to(target,
-      # delay: …)` lands here. Fires the HTML5 drag event sequence on
-      # the source / target pair (mousedown → dragstart → dragenter →
-      # dragover → drop → dragend) with a shared DataTransfer. Discourse
-      # sidebar reorder + Avo Sortable-shaped widgets read the
-      # `event.offsetY` to decide "above vs below"; without a layout
-      # engine we report 0, which routes drops above the target.
-      def drag_to(source_handle, target_handle, **_opts)
+      # drop_modifiers:, html5:, delay:)` lands here; the sequencing lives
+      # in `drag.js` (pointer-driven vs HTML5, decided from the source's
+      # mousedown). `drop_modifiers` are held down from `dragenter` on, the
+      # way a user pressing a key mid-drag produces. `delay` is a
+      # real-browser pacing knob — our dispatch is synchronous, so the page
+      # sees each step in order without it. Discourse sidebar reorder + Avo
+      # Sortable-shaped widgets read `event.offsetY` to decide "above vs
+      # below"; we report 0, which routes drops above the target.
+      def drag_to(source_handle, target_handle, html5: nil, drop_modifiers: [], **_opts)
         mark_action_baseline
         tick_real_time
         invalidate_find_cache
         ensure_alive_after_tick(source_handle)
         ensure_alive_after_tick(target_handle)
-        dom_call('__csimDragOnto', source_handle, target_handle)
+        # Staged with a settle between each step: a real drag spans several frames, and libraries
+        # use that gap (SortableJS applies its ghost class from a `setTimeout` scheduled in
+        # `dragstart` and never reaches its reorder logic if `dragover` lands in the same turn).
+        # This is what the reference driver's `delay:` between steps buys.
+        dom_call('__csimDragBegin', source_handle, target_handle,
+                 {'html5' => html5, 'modifiers' => modifier_flags(drop_modifiers)})
+        settle
+        dom_call('__csimDragMove')
+        settle
+        dom_call('__csimDragFinish')
         drain_after_user_action
       end
       def drop_items(arg)
@@ -1246,7 +1447,8 @@ module Capybara
         alt:      'altKey',
         option:   'altKey',
         meta:     'metaKey',
-        command:  'metaKey'
+        command:  'metaKey',
+        cmd:      'metaKey'
       }.freeze
       MODIFIER_KEY_NAMES = MODIFIER_KEYS.keys.to_set.freeze
       def modifier_flags(keys)
@@ -1256,19 +1458,26 @@ module Capybara
         }
       end
 
-      # Resolve click offset against the element's CSS-declared box.
-      # `opts[:offset] == :center` means "x/y is relative to the
-      # element's centre" (Capybara's w3c_click_offset semantics);
-      # otherwise the offset is relative to the top-left. We don't run
-      # a real layout engine — `__csimElementRect` reads
-      # top / left / width / height from the cascade so tests that
-      # declare those values via CSS see honest coordinates.
+      # Resolve the click point against the element's laid-out box — the
+      # same geometry `rect` / `obscured?` / `drag_to` and the page's own
+      # `getBoundingClientRect` read, so a click lands where the page
+      # believes the element is. `opts[:offset] == :center` means x/y are
+      # relative to the element's centre (Capybara's w3c_click_offset
+      # semantics); otherwise they're relative to its top-left, so the
+      # point is the element's own origin plus the offset — including the
+      # 8px body margin a real page has (confirmed in Chrome).
+      #
+      # This is exactly what the unified geometry buys: Capybara's own
+      # click-offset fixture logs `event.clientX - this.getBoundingClientRect()
+      # .left`, which only comes back as the requested offset when the
+      # pointer we synthesize and the rect the page measures are the same
+      # geometry. Two sources disagree by the element's position.
       def click_event_init(handle, keys, opts)
         out = modifier_flags(keys)
         has_xy = opts[:x] || opts[:y]
         center = opts[:offset] == :center || !has_xy
         if has_xy || center
-          rect = dom_call('__csimElementRect', handle)
+          rect = dom_call('__csimRect', handle)
           base_x = rect['x'].to_f + (center ? rect['width'].to_f  / 2.0 : 0.0)
           base_y = rect['y'].to_f + (center ? rect['height'].to_f / 2.0 : 0.0)
           out['clientX'] = base_x + opts[:x].to_f
@@ -1457,6 +1666,7 @@ module Capybara
       def settle
         start_gen = @runtime.settle_gen
         prev_gen  = start_gen
+        worker_wait_deadline = nil
         SETTLE_MAX_ITER.times do
           deliver_event_source_events
           deliver_worker_messages
@@ -1479,6 +1689,28 @@ module Capybara
           deliver_window_messages
           deliver_websocket_events
           break if @runtime.settle_gen > start_gen
+          # A background worker thread owes us a CONTRACTUAL reply (a swack / bcack /
+          # fetch_response is posted under `ensure`, so it always comes) but hasn't posted it
+          # yet. With no timer, `run_loop_step(0)` returns instantly, so busy-spinning the
+          # remaining iterations would STARVE the worker thread of the GVL and it would never
+          # process its inbox. Block briefly on the outbox instead: this releases the GVL (the
+          # worker runs) and wakes the instant it posts. The popped event is parked in
+          # (via `park_worker_reply`, which parks it in `@worker_outbox_head` — NOT pushed back,
+          # which would reorder it behind anything the worker enqueued in the meantime — so the next
+          # deliver drains it first). The budget is shared across the whole settle call, and
+          # exhausting it bails to Capybara's outer poll loop — a genuinely stuck worker must not pin
+          # every find's settle for SETTLE_MAX_ITER budgets. Gated on `worker_reply_pending?`, NOT
+          # `worker_pending?`: `@worker_in_flight` (plain postMessage — a listen-only worker never
+          # replies) and `@worker_initializing` have no matching reply, and blocking on them would
+          # tax every settle on such pages with the full budget.
+          if worker_reply_pending? && @worker_outbox.empty? && @worker_outbox_head.nil?
+            worker_wait_deadline ||= Process.clock_gettime(Process::CLOCK_MONOTONIC) + WORKER_ROUND_TRIP_BUDGET
+            park_worker_reply(worker_wait_deadline) while worker_reply_pending? &&
+              @worker_outbox.empty? && @worker_outbox_head.nil? &&
+              Process.clock_gettime(Process::CLOCK_MONOTONIC) < worker_wait_deadline
+            next if @worker_outbox_head || !@worker_outbox.empty?
+            break
+          end
           # No progress this iter (no DOM/URL change observed) — the
           # remaining timers are queued for the future; bail and let
           # Capybara's wall-clock-driven poll loop drive the next tick
@@ -2189,6 +2421,17 @@ module Capybara
       # caller's concern — read it separately with `peek_script` (clock-free).
       def run_event_loop_frame(frame_ms)
         turns = 0
+        # Give any live worker/SW thread a clean GVL slice before the phase-1 quiescence loop
+        # monopolises it. That loop spins `run_loop_step(0)` holding the GVL, which STARVES a
+        # worker mid-flight — in particular a CROSS-ISOLATE zero-copy transfer (`RustyRacer.
+        # transferIn` over a SendBackingStore) that a `worker.postMessage(view, [view.buffer])`
+        # reply must complete on the worker thread. Under starvation transferIn fails, the SW's
+        # message handler throws on the null result, and no reply is posted → the client's
+        # `onmessage` never fires and the drain force-timeouts it (postmessage.https transferable
+        # subtests; the whole SW→client message reply cluster). A brief `sleep` releases the GVL
+        # so the worker runs (Thread.pass does NOT hand it over); gated on a live worker so
+        # worker-free files pay nothing.
+        sleep(WORKER_GVL_YIELD) if @workers.any? {|_, w| w[:thread]&.alive? }
         loop do
           r = @runtime.run_loop_step(0)          # run only what's due NOW + microtasks + render; no clock advance
           progressed = step_and_drain_progressed(r)
@@ -2196,6 +2439,43 @@ module Capybara
           break unless progressed
           break if turns >= EVENT_LOOP_QUIESCENCE_CAP
         end
+
+        # Interlude — hold the virtual clock while a controlled-client fetch is awaiting the
+        # service worker's `respondWith`. The SW does the real request off-thread (a live network
+        # hop, an in-VM handler) and its reply is delivered Ruby-side, invisible to the JS event-loop
+        # probe. Advancing the clock now (phase 2) would let a caller's virtual-timeout outrun that
+        # off-thread work and mark the still-pending fetch as timed-out before the reply lands. So
+        # block briefly on the worker outbox — releasing the GVL so the worker runs, exactly like
+        # `settle` — and deliver the reply at the current instant, WITHOUT advancing the clock, then
+        # keep pumping. A fetch that never replies is bounded by `@sw_fetch_wait_deadline` (and, past
+        # that, the caller's own max-steps backstop), so it can't wedge the drain.
+        if @sw_fetch_pending.positive? && (held = hold_for_sw_fetch(turns))
+          return held
+        end
+        @sw_fetch_wait_deadline = nil unless @sw_fetch_pending.positive?
+
+        # Same interlude for an in-flight `ws.close()` handshake: the reader thread surfaces the
+        # server's echoed close frame as `__close` — real off-thread work the JS event-loop probe
+        # can't see. Advancing the clock now would let a test's virtual-timeout ("onclose should
+        # fire") outrun it. Block briefly on the WS queue (GVL released, like settle) so the reader
+        # runs, deliver at the current instant WITHOUT advancing time, then keep pumping. Bounded by
+        # a deadline so a peer that never replies (→ EOF 1006) can't wedge the drain.
+        if @ws_close_pending.positive? && (held = hold_for_ws_close(turns))
+          return held
+        end
+        @ws_close_wait_deadline = nil unless @ws_close_pending.positive?
+
+        # Same interlude for a pending SW message swack / broadcast ack — but WITHOUT holding
+        # the clock. Its reply is the same kind of cross-isolate transfer completed on the worker
+        # thread (a `worker.postMessage(view, [view.buffer])` reply zero-copies via transferIn),
+        # so we block briefly on the outbox to give a loaded runner's worker real GVL time to post
+        # it, then fall through to phase 2 — a message reply is delivered at the current instant by
+        # the drain below and the client-side lifecycle / nav timers its test then waits on advance
+        # via the clock, so (unlike a fetch) we must NOT hold: holding regressed about-blank-
+        # replacement. See drain_pending_message_reply.
+        drain_pending_message_reply if worker_message_reply_pending?
+        @sw_msg_wait_deadline = nil unless worker_message_reply_pending?
+
         # Phase 2 — advance one real frame so the next batch of timers becomes due.
         # Its work counts toward `progressed` too: a timer that first comes due in
         # this advance (e.g. a `setTimeout(…, 8)` firing mid-frame) and the nav hop
@@ -2204,7 +2484,9 @@ module Capybara
         probe = dom_call('__csimEventLoopProbe')
         {
           'raf'        => !!probe['raf'],
-          'async'      => !!probe['async'],
+          # A live WS reader counts as async so the drain loop yields the GVL to it each frame — see
+          # websocket_reader_active?. Without it a binary echo can be starved past the idle-bail.
+          'async'      => !!probe['async'] || websocket_reader_active?,
           # ms until the nearest scheduled timer (-1 = none). Lets a caller keep
           # advancing while a near-future `setTimeout` is parked (a `step_timeout`-
           # style wait) instead of declaring the page idle — see `__csimEventLoopProbe`.
@@ -2215,6 +2497,96 @@ module Capybara
         }
       end
 
+      # Hold the virtual clock for one frame while a controlled-client fetch awaits the SW's
+      # respondWith. Blocks briefly on the worker outbox (GVL released) up to a budget shared across
+      # frames; on a reply, delivers it at the current instant (a zero-advance `run_loop_step`) and
+      # returns the frame's loop-state so the caller keeps pumping without advancing time. Returns
+      # nil once the budget is spent, so the caller falls through to a normal frame (advancing the
+      # clock) and a genuinely stuck fetch can't wedge the drain. Reports the REAL nearest timer —
+      # holding the clock doesn't hide a parked timer, we simply haven't advanced to it yet.
+      private def hold_for_sw_fetch(turns)
+        @sw_fetch_wait_deadline ||= Process.clock_gettime(Process::CLOCK_MONOTONIC) + WORKER_ROUND_TRIP_BUDGET
+        park_worker_reply(@sw_fetch_wait_deadline)
+        reply_ready = @worker_outbox_head || !@worker_outbox.empty?
+        # A delivered reply refreshes the budget so the NEXT fetch in a sequence waits afresh instead
+        # of inheriting a spent deadline (which would abandon it to a premature timeout).
+        @sw_fetch_wait_deadline = nil if reply_ready
+        return nil unless reply_ready || Process.clock_gettime(Process::CLOCK_MONOTONIC) < @sw_fetch_wait_deadline
+
+        held_progressed = reply_ready && step_and_drain_progressed(@runtime.run_loop_step(0))
+        probe = dom_call('__csimEventLoopProbe')
+        {
+          'raf'        => !!probe['raf'],
+          'async'      => true,
+          'next_timer' => probe['nextTimer'].to_f,
+          'progressed' => turns > 1 || held_progressed
+        }
+      end
+
+      # Hold the virtual clock while a `ws.close()` handshake completes. Mirrors hold_for_sw_fetch,
+      # but the reply arrives on the WS queue (the reader thread), not the worker outbox: park
+      # briefly on that queue (GVL released, so the reader runs) and, once a frame is ready, deliver
+      # it at the current instant (`run_loop_step(0)` → deliver_websocket_events clears the counter)
+      # WITHOUT advancing time. Returns the frame-probe hash to hold; nil only once the deadline is
+      # spent with nothing delivered, so the caller falls through to phase 2 and the clock resumes.
+      private def hold_for_ws_close(turns)
+        @ws_close_wait_deadline ||= Process.clock_gettime(Process::CLOCK_MONOTONIC) + WORKER_ROUND_TRIP_BUDGET
+        if @websocket_queue_head.nil? && @websocket_queue.empty? && Process.clock_gettime(Process::CLOCK_MONOTONIC) < @ws_close_wait_deadline
+          # Pop one event to block until the reader produces something, then park it in the one-slot
+          # HEAD buffer — NOT pushed back onto the tail, which would reorder it behind anything the
+          # reader enqueued in the meantime. deliver_websocket_events drains the head first. Mirrors
+          # park_worker_reply.
+          @websocket_queue_head = pop_with_timeout(@websocket_queue, WORKER_POLL_INTERVAL)
+        end
+        ready = !@websocket_queue_head.nil? || !@websocket_queue.empty?
+        # A delivered frame refreshes the budget so the NEXT close in a sequence waits afresh.
+        @ws_close_wait_deadline = nil if ready
+        return nil unless ready || Process.clock_gettime(Process::CLOCK_MONOTONIC) < @ws_close_wait_deadline
+
+        held_progressed = ready && step_and_drain_progressed(@runtime.run_loop_step(0))
+        probe = dom_call('__csimEventLoopProbe')
+        {
+          'raf'        => !!probe['raf'],
+          'async'      => true,
+          'next_timer' => probe['nextTimer'].to_f,
+          'progressed' => turns > 1 || held_progressed
+        }
+      end
+
+      # Park briefly (GVL released) for an outstanding SW message swack / broadcast ack and deliver
+      # it at the current instant, then RETURN — the caller proceeds to phase 2 and advances the
+      # clock. Unlike `hold_for_sw_fetch` this does NOT hold time: a message/broadcast reply's test
+      # advances its client-side lifecycle / nav timers via the clock, so holding on it deadlocks
+      # (regressed about-blank-replacement). The only thing missing under load is worker GVL time for
+      # the cross-isolate transferable reply to complete — a fixed micro-sleep isn't enough margin on
+      # a loaded runner (postmessage.https transferable subtests), so we block on the outbox exactly
+      # like the fetch hold / `settle`. Budget shared across frames (a genuinely stuck reply pays it
+      # once — the spent deadline stays in the past, so later frames don't re-block and the clock runs
+      # free until the reply lands or the test times out); reset in `run_event_loop_frame` once no
+      # message/broadcast reply is outstanding, so the next one waits afresh.
+      private def drain_pending_message_reply
+        @sw_msg_wait_deadline ||= Process.clock_gettime(Process::CLOCK_MONOTONIC) + WORKER_ROUND_TRIP_BUDGET
+        park_worker_reply(@sw_msg_wait_deadline) while worker_message_reply_pending? &&
+          @worker_outbox.empty? && @worker_outbox_head.nil? &&
+          Process.clock_gettime(Process::CLOCK_MONOTONIC) < @sw_msg_wait_deadline
+        # `deliver_worker_messages` (inside step_and_drain) refreshes @sw_msg_wait_deadline whenever it
+        # delivers a swack/bcack, so the NEXT reply in a sequence waits afresh — and it does so on
+        # WHICHEVER drain path delivered the reply (this one, hold_for_sw_fetch's outbox drain, or
+        # settle), which resetting only here would miss when a co-pending fetch hold delivers it.
+        step_and_drain_progressed(@runtime.run_loop_step(0)) if @worker_outbox_head || !@worker_outbox.empty?
+      end
+
+      # Block up to one poll interval for a worker reply, parking it in the one-slot head buffer —
+      # NOT pushed back, which would reorder it behind anything the worker enqueued meanwhile. The
+      # `pop_with_timeout` releases the GVL so the worker thread runs and wakes us the instant it
+      # posts. No-op if a reply is already buffered or the budget is spent. Shared by `settle` and
+      # the SW-fetch hold in `run_event_loop_frame`.
+      private def park_worker_reply(deadline)
+        return unless @worker_outbox.empty? && @worker_outbox_head.nil? &&
+                      Process.clock_gettime(Process::CLOCK_MONOTONIC) < deadline
+        @worker_outbox_head = pop_with_timeout(@worker_outbox, WORKER_POLL_INTERVAL)
+      end
+
       # Drain the Ruby-side async / navigation / form-submit / download chains a
       # `run_loop_step` (passed as `r`) may have queued, and report whether this
       # step+drain made observable progress. Shared by both phases of
@@ -2356,6 +2728,9 @@ module Capybara
         @last_polled_gen    = nil
         @idle_settle_polls  = 0
         @ff_transient_polls = 0
+        # Disarm the find pre-tick so the FIRST find after this navigation reads the current DOM
+        # without advancing timers (see timer_wait_elapsed?), independent of wall-clock timing.
+        @pre_tick_armed     = false
         @context_gen       += 1
       end
 
@@ -2374,7 +2749,7 @@ module Capybara
         method  = spec['method'].to_s.upcase
         method  = 'GET' if method.empty?
         enctype = spec['enctype'].to_s.empty? ? 'application/x-www-form-urlencoded' : spec['enctype'].to_s.downcase
-        entries = entry_list.is_a?(Array) ? entry_list : entries_from_spec(spec)
+        entries = entry_list.is_a?(Array) ? entry_list : (spec['entries'] || [])
         action_url = action.empty? ? (current_browsing_context_url || @default_host) : resolve_against_current(action)
         # A form submitted inside a frame whose target is that frame (self, or a
         # `_parent` of a ≥2-deep frame) navigates the FRAME, not the top page.
@@ -2468,7 +2843,13 @@ module Capybara
           body << "--#{boundary}--\r\n"
           [body, "multipart/form-data; boundary=#{boundary}"]
         else
-          pairs = entries.map {|e| [e['name'].to_s, e['file'] ? e['filename'].to_s : e['value'].to_s] }
+          # The urlencoded / text-plain encoders normalize CR/LF → CRLF in each entry's
+          # name and value (a file entry's filename is the value) — the entry list itself
+          # stays raw, so normalization lives here, matching the JS encoders and real
+          # browsers (newline-normalization.html).
+          pairs = entries.map {|e|
+            [normalize_form_newlines(e['name']), normalize_form_newlines(e['file'] ? e['filename'] : e['value'])]
+          }
           if enctype == 'text/plain'
             [pairs.map {|name, value| "#{name}=#{value}\r\n" }.join, 'text/plain']
           else
@@ -2477,6 +2858,12 @@ module Capybara
         end
       end
 
+      # HTML form-submission newline normalization: every lone CR, lone LF, and CRLF in an
+      # entry name/value becomes a CRLF (the JS encoders' `normalizeNL` counterpart).
+      def normalize_form_newlines(s)
+        s.to_s.gsub(/\r\n?|\n/, "\r\n")
+      end
+
       # Resolve a threaded file entry's on-disk path via the `@file_picks` slot
       # recorded at `attach_file` time (handle/index). nil for a purely in-memory
       # `new File(['bytes'], …)` (no slot) — a CLASSIC (non-Turbo) submit then
@@ -2490,35 +2877,6 @@ module Capybara
         picks && picks[entry['index'].to_i]
       end
 
-      # Build the entry list from the form's own controls, for triggers that didn't
-      # construct one in JS (the Enter implicit-submit path). Mirrors the JS FormData
-      # construction: non-file fields in tree order, then each file input's selection
-      # (one empty entry when nothing is picked). A selected File reports its
-      # host-backed source (`handle`/`index`); the older payload shape with no per-File
-      # refs falls back to the input's own handle slot.
-      def entries_from_spec(spec)
-        entries = (spec['fields'] || []).map {|pair| {'name' => pair[0].to_s, 'value' => pair[1].to_s} }
-        (spec['fileInputs'] || []).each do |fi|
-          name = fi['name'].to_s
-          refs = fi['files']
-          if refs.is_a?(Array) && !refs.empty?
-            refs.each {|ref|
-              entries << {'name' => name, 'file' => true, 'filename' => ref['name'].to_s, 'handle' => ref['handle'], 'index' => ref['index']}
-            }
-          else
-            picks = (@file_picks && @file_picks[fi['handle'].to_i]) || []
-            if picks.empty?
-              entries << {'name' => name, 'file' => true, 'filename' => '', 'handle' => nil, 'index' => nil}
-            else
-              picks.each_index {|i|
-                entries << {'name' => name, 'file' => true, 'filename' => File.basename(picks[i]), 'handle' => fi['handle'], 'index' => i}
-              }
-            end
-          end
-        end
-        entries
-      end
-
       def append_multipart_part(body, boundary, name, content, filename: nil, content_type: nil)
         body << "--#{boundary}\r\n"
         disposition = %[form-data; name="#{name}"]
@@ -2542,7 +2900,7 @@ module Capybara
         env['CONTENT_LENGTH'] = body.bytesize.to_s
         apply_default_request_env(env, referer: referer)
         status, headers, resp_body = dispatch_rack_or_http(url, env, method: 'POST', body: body)
-        merge_set_cookie(headers)
+        merge_set_cookie(headers, url)
         if (loc = redirect_location(status, headers))
           next_url = resolve_against_current(loc)
           resp_body.close if resp_body.respond_to?(:close)
@@ -2571,7 +2929,9 @@ module Capybara
 
       def reset!
         @cookies.clear
+        @auth_cache.clear
         @local_storage.clear
+        @cache_storage.clear
         @session_storage.clear
         @sticky_headers.clear
         # The driver-side resize buffer has to clear too — without
@@ -2599,6 +2959,11 @@ module Capybara
         reset_frame_scope
         @history.clear
         @history_idx     = -1
+        @cors_preflight_cache = {}   # CORS-preflight cache is per browsing context
+        # A JS-driven history.back()/go() that scheduled a deferred traverse but
+        # never drained (the page navigated away first) must not survive the reset
+        # — otherwise the stale target replays against the NEXT page's fresh history.
+        @pending_history_traverse = nil
         @file_picks      = {} if @file_picks
         # Hand the live trace off to `@pending_trace` so an after-hook
         # running after `reset_session!` (Capybara's per-test teardown
@@ -2618,6 +2983,11 @@ module Capybara
         reset_websockets
         @window_inbox.clear
         @broadcast_inbox.clear
+        # The BroadcastChannel registry + ordered queue are per-page (the rebuilt VM has no live channels
+        # and restarts the realm/local id counters); a stale entry would misroute a later post.
+        @bc_registry.clear
+        @bc_queue.clear
+        @bc_seq = 0
         # Free any zero-copy transfer backing stores that went unimported
         # (worker killed before draining its inbox, etc.) before the rebuild.
         drop_pending_transfers
@@ -2651,6 +3021,8 @@ module Capybara
         reset_websockets
         @window_inbox.clear
         @broadcast_inbox.clear
+        @bc_registry.clear
+        @bc_queue.clear
         # Dispose the JS runtime/isolate itself — for an auxiliary window this
         # Browser is the isolate's last owner, but V8Runtime registers every
         # isolate in a process-wide `@@live` set (for at_exit cleanup), which
@@ -2702,6 +3074,27 @@ module Capybara
       @@asset_src_lock = Mutex.new
       ASSET_SRC_MAX    = 4096
 
+      # Decoded-image cache: resolved-URL => {'width'=>, 'height'=>, 'bytes'=> packed
+      # RGBA String}. Decoding an image (libvips) is the expensive step, so — like the
+      # V8 bytecode cache and the script/stylesheet source cache above — we keep the
+      # decoded pixels and reuse them for every `<img>` sharing a src, across elements
+      # AND visits. Same content-stability assumption as `@@asset_src` (a URL's bytes
+      # are stable within a process; content-hashed / data: URLs that dominate satisfy
+      # it); size-capped so an app cycling through many distinct images can't grow it
+      # without bound.
+      @@image_cache      = {}
+      @@image_cache_lock = Mutex.new
+      IMAGE_CACHE_MAX    = 512
+
+      # Cross-visit cache of @font-face font files, resolved-url → on-disk path (or nil
+      # when the fetch failed). The bytes are written to a process-lifetime temp file so
+      # pango/fontconfig (via `Vips::Image.text fontfile:`) can read them by path. Font
+      # URLs are content-stable app assets, so caching across the per-visit VM rebuild
+      # avoids re-fetching CanvasTest.ttf & friends on every visit.
+      @@font_file_cache      = {}
+      @@font_file_lock       = Mutex.new
+      @@font_files           = []   # pins the Tempfiles for the PROCESS (the cache is cross-visit)
+
       # Body of an external durably-cacheable asset (classic script or stylesheet),
       # served from the cross-visit cache when still fresh, else fetched (which
       # read-throughs the per-visit asset cache) and cached iff durably cacheable.
@@ -2876,12 +3269,10 @@ module Capybara
           'Cache-Control: no-store',
           'Connection: keep-alive'
         ]
-        # Forward the host-cookie jar so the streaming server can
-        # authenticate the user the same way the browser would. The
-        # jar is a flat name=value map (no per-host scoping); reuse
-        # the canonical `document_cookie` serialiser the Rack path
-        # uses, so we don't drift if its format changes.
-        cookies = document_cookie
+        # Forward the streaming host's cookie jar so the server can
+        # authenticate the user the same way the browser would — scoped to
+        # the EventSource target's host, like every other request.
+        cookies = cookie_header_for(cookie_host(uri))
         lines << "Cookie: #{cookies}" unless cookies.empty?
         socket.write(lines.join("\r\n") << "\r\n\r\n")
         socket.flush
@@ -2979,6 +3370,10 @@ module Capybara
         env['HTTP_CONNECTION']            = 'Upgrade'
         env['HTTP_SEC_WEBSOCKET_KEY']     = key
         env['HTTP_SEC_WEBSOCKET_VERSION'] = '13'
+        # The opening handshake always carries the initiating document's origin (the UA owns this
+        # header) — server handlers echo it back (websockets/opening-handshake origin test).
+        doc_origin = url_origin(@current_url)
+        env['HTTP_ORIGIN'] = doc_origin if doc_origin
         list = Array(protocols).map(&:to_s).reject(&:empty?)
         env['HTTP_SEC_WEBSOCKET_PROTOCOL'] = list.join(', ') unless list.empty?
         env['rack.hijack?']  = true
@@ -2998,7 +3393,7 @@ module Capybara
         queue  = @websocket_queue
         @websocket_threads[id] = Thread.new do
           Thread.current.report_on_exception = false
-          run_websocket_reader(id, csim_io, accept, queue)
+          run_websocket_reader(id, csim_io, accept, queue, target)
         end
         id
       rescue StandardError => e
@@ -3027,24 +3422,58 @@ module Capybara
         nil
       end
 
-      def ws_close(id, code = 1000, reason = '')
+      def ws_close(id, code = nil, reason = '')
         sock = @websocket_sockets[id.to_i] or return
         # Send the close frame and let the close HANDSHAKE complete: the server
         # replies with its own close frame, which the reader thread surfaces as
         # the `__close` event (carrying the agreed code) before tearing the
         # socket down in its `ensure`. Force teardown is `reset_websockets`'s job.
-        payload = [code.to_i].pack('n') + reason.to_s.b
+        # A nil code sends a BODYLESS close frame — `ws.close()` with no argument
+        # closes with no status, which the peer echoes and the reader reports as
+        # code 1005 (NO_STATUS), not 1000.
+        payload = code.nil? ? ''.b : [code.to_i].pack('n') + reason.to_s.b
         ws_write_frame(sock, 0x8, payload) rescue nil
+        # A close handshake is now in flight — hold the clock until the reader's `__close` lands
+        # (bounded by the deadline in hold_for_ws_close if the peer never replies → EOF 1006).
+        @ws_close_pending += 1
         nil
       end
 
-      def websocket_pending? = !@websocket_queue.empty?
+      # Pending WS work = queued reader events OR an in-flight `ws.close()` whose `__close` hasn't
+      # landed yet. Counting the latter keeps every advance path (settle, tick_real_time, and
+      # crucially horizon_fast_forward_step, which would otherwise jump straight to a test's pending
+      # timeout timer) from racing past the close handshake before hold_for_ws_close delivers it.
+      def websocket_pending? = !@websocket_queue_head.nil? || !@websocket_queue.empty? || @ws_close_pending.positive?
+
+      # A live reader thread = an open WS connection whose server may still surface an echo / push /
+      # close frame off-thread — pending async work the JS event-loop probe can't see. The event-loop
+      # frame reports it as `async` so the WPT drain loop yields the GVL each frame (its
+      # `sleep(0.001) if async`), feeding the reader instead of spinning it into starvation — a
+      # binary echo that only lands AFTER the idle-bail is exactly the flake this prevents. Zero-alloc
+      # on the common no-WS path (the `empty?` short-circuit); a handful of threads otherwise.
+      def websocket_reader_active? = !@websocket_threads.empty? && @websocket_threads.each_value.any?(&:alive?)
 
       def deliver_websocket_events
-        return 0 if @websocket_threads.empty? && @websocket_queue.empty?
-        events = drain_queue(@websocket_queue)
+        return 0 if @websocket_threads.empty? && @websocket_queue_head.nil? && @websocket_queue.empty?
+        # The head slot (parked by hold_for_ws_close) is delivered ahead of the queue to preserve
+        # reader order.
+        events = [@websocket_queue_head].compact
+        @websocket_queue_head = nil
+        events.concat(drain_queue(@websocket_queue))
         return 0 if events.empty?
-        @runtime.call('__csim_deliverWebSocketEvents', events)
+        # `__setcookie` is handled Ruby-side (store the handshake cookie in the jar) and NOT
+        # forwarded to JS; the reader queues it before `__open`, so document.cookie sees it in onopen.
+        js_events = events.reject do |e|
+          if e[:type] == '__setcookie'
+            merge_set_cookie({'set-cookie' => e[:cookies]}, e[:url])
+            true
+          end
+        end
+        @runtime.call('__csim_deliverWebSocketEvents', js_events) unless js_events.empty?
+        # A terminal event (`__close` / `__error`) completes a close handshake — release the clock
+        # hold. Clamp: a server-INITIATED close arrives without a matching ws_close increment.
+        terminals = events.count {|e| e[:type] == '__close' || e[:type] == '__error' }
+        @ws_close_pending = [@ws_close_pending - terminals, 0].max if terminals.positive?
         events.size
       end
 
@@ -3059,23 +3488,36 @@ module Capybara
         @websocket_sockets.clear
         @websocket_app_sockets.clear
         @websocket_queue.clear
+        @websocket_queue_head   = nil
+        @ws_close_pending       = 0
+        @ws_close_wait_deadline = nil
       end
 
       # Background-thread frame reader: verify the 101 handshake, then loop
       # decoding server→client frames into queue events until close / EOF.
-      private def run_websocket_reader(id, sock, expected_accept, queue)
-        ok, protocol = ws_read_handshake(sock, expected_accept)
+      private def run_websocket_reader(id, sock, expected_accept, queue, target)
+        ok, protocol, cookies = ws_read_handshake(sock, expected_accept)
         unless ok
           queue << {id: id, type: '__error', message: 'websocket handshake failed'}
           return
         end
+        # Store any handshake-response cookies (the main thread does the store) BEFORE `open` fires,
+        # so a document.cookie read in `onopen` sees them.
+        queue << {id: id, type: '__setcookie', cookies: cookies, url: target} unless cookies.empty?
         # Carry the negotiated subprotocol — Action Cable's client closes the
         # connection in its `onopen` unless `webSocket.protocol` is one it knows
         # (`actioncable-v1-json`).
         queue << {id: id, type: '__open', protocol: protocol}
         loop do
           frame = ws_read_message(sock, queue, id)
-          break if frame.nil?                       # EOF
+          if frame.nil?                             # TCP closed with no close frame → abnormal
+            queue << {id: id, type: '__close', code: 1006, reason: ''}
+            break
+          end
+          if frame == :protocol_error               # reserved opcode / malformed frame → fail the connection
+            queue << {id: id, type: '__error', message: 'protocol error'}
+            break
+          end
           opcode, payload = frame
           if opcode == :close
             code   = payload.bytesize >= 2 ? payload[0, 2].unpack1('n') : 1005
@@ -3107,9 +3549,10 @@ module Capybara
       # is set (Action Cable's client requires `actioncable-v1-json`).
       private def ws_read_handshake(sock, expected_accept)
         status = sock.gets
-        return [false, nil] unless status && status =~ %r{\AHTTP/1\.1 101}i
+        return [false, nil, []] unless status && status =~ %r{\AHTTP/1\.1 101}i
         accept_ok = false
         protocol  = nil
+        cookies   = []
         while (line = sock.gets)
           line = line.chomp
           break if line.empty?
@@ -3122,13 +3565,18 @@ module Capybara
           # JS Uint8Array — the protocol must reach JS as a real string so
           # `webSocket.protocol` compares equal to `actioncable-v1-json`.
           protocol  = RuntimeShared.utf8_text(val) if key == 'sec-websocket-protocol' && !val.empty?
+          # Cookies the server sets on the handshake response are stored in the jar (the main thread
+          # does the actual store — see deliver_websocket_events), so document.cookie / the next
+          # request's Cookie header reflect them.
+          cookies << RuntimeShared.utf8_text(val) if key == 'set-cookie' && !val.empty?
         end
-        [accept_ok, protocol]
+        [accept_ok, protocol, cookies]
       end
 
       # Read one complete message (reassembling continuation frames), handling
       # interleaved control frames inline. Returns `[opcode, payload]` (opcode
-      # 0x1 text / 0x2 binary, or `:close`), or nil on EOF.
+      # 0x1 text / 0x2 binary), `[:close, payload]`, `:protocol_error` (a reserved
+      # opcode — the connection must be failed), or nil on EOF.
       private def ws_read_message(sock, queue, id)
         data       = +''.b
         msg_opcode = nil
@@ -3161,7 +3609,8 @@ module Capybara
           when 0x9 then ws_write_frame(sock, 0xA, payload); next   # ping → pong
           when 0xA then next                                       # pong → ignore
           when 0x0 then data << payload                            # continuation
-          else          msg_opcode = opcode; data << payload       # 0x1 text / 0x2 binary
+          when 0x1, 0x2 then msg_opcode = opcode; data << payload  # text / binary
+          else return :protocol_error                              # reserved opcode (0x3-7, 0xB-F) → fail
           end
           return [msg_opcode || opcode, data] if fin
         end
@@ -3393,7 +3842,7 @@ module Capybara
       # worker's `__csim_workerPostMessage` host fn closes over its
       # handle and routes outgoing messages onto a shared outbox the
       # main settle drains.
-      def worker_spawn(url, shared: false, service: false)
+      def worker_spawn(url, shared: false, service: false, creator_key: nil)
         handle       = (@worker_seq += 1)
         target       = resolve_against_current(url.to_s)
         # A worker script from a blob: URL in a DIFFERENT storage partition than this
@@ -3420,7 +3869,7 @@ module Capybara
         @worker_init_lock.synchronize { @worker_initializing += 1 }
         thread = Thread.new do
           Thread.current.report_on_exception = false
-          run_worker(handle, target, body, inbox, outbox, engine_class, shared: shared, service: service)
+          run_worker(handle, target, body, inbox, outbox, engine_class, shared: shared, service: service, creator_key: creator_key)
         end
         @workers[handle] = {thread: thread, inbox: inbox}
         handle
@@ -3442,6 +3891,353 @@ module Capybara
         w[:inbox] << data.to_s
       end
 
+      # `ServiceWorker.postMessage` from a client window → deliver to the SW's `message` event with
+      # `source` = the posting client. Tracked in @sw_message_pending (released by the worker's
+      # `swack`) so settle waits for the SW to process it and any client.postMessage reply.
+      def service_worker_post_message(handle, data, client_id = nil, client_url = nil)
+        w = @workers[handle.to_i]
+        return unless w
+        @sw_message_pending += 1
+        w[:inbox] << {kind: 'sw_message', data: data.to_s, client: client_id, url: client_url}
+      end
+
+      # A controlled client's fetch → the controlling SW's `fetch` event. Tracked in
+      # @sw_fetch_pending (released by the `fetch_response`) so settle waits for the SW's
+      # respondWith. If the handle is dead, return false so the client falls back to the network.
+      def service_worker_controller_fetch(handle, req_json, fetch_id, realm_id = 0)
+        w = @workers[handle.to_i]
+        return false unless w
+        # Resolve BEFORE bumping the pending counter: a raise here must not strand @sw_fetch_pending
+        # (settle would then block for the full round-trip budget with no fetch ever queued to answer).
+        req = resolve_sw_fetch_referrer(req_json.to_s)
+        @sw_fetch_pending += 1
+        # fetch ids are per-realm (so they collide across realms) — carry the ORIGINATING realm so
+        # the response is delivered back to it, not the main realm (realm 0 = main/top window).
+        w[:inbox] << {kind: 'fetch', req:, fetch_id: fetch_id.to_i, realm_id: realm_id.to_i}
+        true
+      end
+
+      # A controlled client cancelled a streaming respondWith body (`response.body.cancel()` or an
+      # AbortController abort): route the cancel to the worker that owns this [realm, fetch] stream so
+      # it cancels the reader it's draining — firing the SW source stream's `cancel()`. @sw_open_streams
+      # maps the stream to its emitting worker; the worker's terminal frame still clears the counter.
+      def sw_stream_cancel(fetch_id, realm_id)
+        key = [realm_id.to_i, fetch_id.to_i]
+        handle, = @sw_open_streams.find {|_h, streams| streams.key?(key) }
+        return unless handle && (w = @workers[handle])
+        w[:inbox] << {kind: 'fetch_cancel', fetch_id: fetch_id.to_i}
+      end
+
+      # Resolve a controlled fetch's referrer the way the network hop would (compute_referrer
+      # applies the request's Referrer-Policy to its referrer source), so the SW's
+      # `event.request.referrer` matches a real browser's. The client sends the referrer SOURCE
+      # (`referrerSource`, its document URL for the `about:client` default); we replace it with the
+      # policy-resolved value under `referrer` (nil / stripped → '', the no-referrer state). No
+      # source (older payload / navigation request) → passed through untouched.
+      private def resolve_sw_fetch_referrer(req_json)
+        req = JSON.parse(req_json)
+        return req_json unless req.is_a?(Hash) && req.key?('referrerSource')
+
+        req['referrer'] = compute_referrer(req['referrerPolicy'], req.delete('referrerSource'), req['url']).to_s
+        JSON.generate(req)
+      rescue JSON::ParserError
+        req_json
+      end
+
+      # A SW `fetch` event's respondWith result. A NAVIGATION fetch (negative id — see
+      # service_worker_navigation_fetch) is awaited SYNCHRONOUSLY on a dedicated queue, off the
+      # general outbox, so it never interleaves with the client-fetch / message reply protocol;
+      # a client fetch (positive id) rides the outbox as before, tagged with the originating realm.
+      private def sw_deliver_fetch_response(handle, fetch_id, resp, outbox, realm_id = 0)
+        if fetch_id.negative?
+          @sw_nav_outbox << {fetch_id: fetch_id, resp: resp}
+        else
+          outbox << {handle: handle, kind: 'fetch_response', fetch_id: fetch_id, resp: resp, realm_id: realm_id}
+        end
+      end
+
+      # The active worker handle at an EXACT scope (0 if none) — see __csim_swActiveHandleForScope.
+      def sw_active_handle_for_scope(scope) = @sw_registrations[scope.to_s].to_i
+
+      # Mirror a registration's active-worker handle into Ruby, keyed by its (serialized) scope.
+      # Emitted by the client lifecycle at activation; survives rebuild_ctx so a navigation can
+      # find its controlling SW even after the destination realm's JS was rebuilt.
+      def sw_register_scope(scope, handle)
+        @sw_registrations[scope.to_s] = handle.to_i
+        # Flush any clients.claim() that arrived before this scope was mirrored (a worker's
+        # `activate → clients.claim()` fires decoupled from the client-side lifecycle that populates
+        # @sw_registrations, so the claim can be drained first — see the claim handler above).
+        if @sw_pending_claims.any? {|e| e[:handle].to_i == handle.to_i }
+          flush, @sw_pending_claims = @sw_pending_claims.partition {|e| e[:handle].to_i == handle.to_i }
+          flush.each {|e| broadcast_claim(e[:handle], e[:has_fetch], scope.to_s) }
+        end
+        nil
+      end
+
+      # Deliver a clients.claim() to EVERY in-scope client: broadcast to the main realm AND every
+      # frame realm; each self-checks whether its own document is in the claiming registration's
+      # scope (__csim_swClaimClient) so no realm→URL map is needed here. has_fetch = the SW's
+      # install-time fetch-listener snapshot, so a claimed client routes its fetches.
+      private def broadcast_claim(handle, has_fetch, scope)
+        script_url = @workers.dig(handle.to_i, :script_url).to_s
+        # The authoritative registration scope set — the claim's longest-registration-wins check runs
+        # against this, not a realm-local map that can lag under load (claim-not-using-registration).
+        all_scopes = @sw_registrations.keys
+        @runtime.call('__csim_swClaimClient', handle, has_fetch, script_url, scope, all_scopes)
+        @runtime.frame_realm_ids.each do |rid|
+          @runtime.realm_call(rid, '__csim_swClaimClient', handle, has_fetch, script_url, scope, all_scopes) if @runtime.frame_realm_alive?(rid)
+        end
+        nil
+      end
+      # Navigation Preload state for a registration's active worker (keyed by its handle). Returns the
+      # spec default {enabled:false, headerValue:'true'} when never set. Read by the client- and
+      # worker-side NavigationPreloadManager (getState) and at navigation time (nav_preload_enabled?).
+      def nav_preload_state(handle)
+        st = @sw_navpreload[handle.to_i] || {}
+        {'enabled' => st.fetch(:enabled, false), 'headerValue' => st.fetch(:header, 'true')}
+      end
+
+      # Update the state for a worker handle. A nil `enabled` / `header` leaves that field unchanged
+      # (enable/disable set only enabled; setHeaderValue sets only the header — the JS side has already
+      # validated the header value and String()-ified it). The InvalidStateError "no active worker"
+      # gate lives in the JS manager (a null handle never reaches here).
+      def nav_preload_set(handle, enabled, header)
+        st = (@sw_navpreload[handle.to_i] ||= {})
+        st[:enabled] = !!enabled unless enabled.nil?
+        st[:header]  = header.to_s unless header.nil?
+        nil
+      end
+
+      # Whether the registration whose active worker controls `url` has navigation preload enabled —
+      # gates the parallel preload request during a navigation.
+      def nav_preload_enabled?(handle)
+        handle && @sw_navpreload.dig(handle.to_i, :enabled) ? true : false
+      end
+
+      def sw_unregister_scope(scope)
+        @sw_registrations.delete(scope.to_s)
+        nil
+      end
+
+      # The registration handle controlling `url` — the one whose serialized scope is the longest
+      # prefix of `url` (spec "Match Service Worker Registration"; the scope embeds the origin, so
+      # a cross-origin scope can't prefix-match). nil when no registration's scope matches.
+      private def sw_scope_match(url)
+        u = url.to_s
+        best = nil
+        best_len = -1
+        @sw_registrations.each do |scope, handle|
+          next unless u.start_with?(scope) && scope.length > best_len
+          best     = [handle, scope]
+          best_len = scope.length
+        end
+        best
+      end
+
+      # The controller for a freshly-built frame realm at `url`, for wiring its
+      # `navigator.serviceWorker.controller`. Returns [handle, has_fetch, script_url] or nil.
+      # Unlike the navigation variant this keeps a controller whose fetch-handler snapshot is
+      # still UNKNOWN (nil, racing the SW's initial eval) — resolved to `true` here so the frame
+      # is controlled and routes; a controlled subresource fetch simply falls through to the
+      # network if no handler materializes. Only a KNOWN-false (messaging/push-only) SW skips.
+      def sw_client_controller_for(url)
+        match = sw_scope_match(url) or return nil
+        handle, scope = match
+        w = @workers[handle] or return nil
+        return nil unless w[:thread]&.alive?
+
+        [handle, w[:has_fetch] != false, w[:script_url].to_s, scope]
+      end
+
+      # The controller an OPAQUE child browsing context (about:blank / srcdoc)
+      # inherits from its creator. An about:blank document has no URL to scope-match,
+      # so it's controlled by its parent's active service worker (HTML "create and
+      # initialize a Document" inherits the creator's controller). Keyed by the
+      # parent frame realm's id, recorded when that realm was wired (below).
+      def sw_inherited_controller_for(parent_realm_id)
+        return nil if parent_realm_id.nil? || parent_realm_id.to_i.zero?
+        ctrl = @sw_realm_controller[parent_realm_id.to_i]
+        return nil unless ctrl && @workers[ctrl[0]]&.dig(:thread)&.alive?
+
+        ctrl
+      end
+
+      # Remember a frame/window realm's controller so its OWN opaque children can
+      # inherit it (sw_inherited_controller_for). Set at frame-realm build for both
+      # a scope-matched and an inherited controller, so inheritance chains through
+      # nested about:blank frames.
+      def sw_note_realm_controller(realm_id, ctrl)
+        @sw_realm_controller[realm_id.to_i] = ctrl
+        nil
+      end
+
+      # Register a controlled client (a frame/window realm) with its controlling SW
+      # so `clients.matchAll()` / `getClientByURL` reflect the real client set — not
+      # only clients that happened to postMessage the worker. The client id is
+      # realm-scoped (`client-<realm>`), stable for the realm's life. Pushed to the
+      # SW inbox (processed FIFO, so it precedes any later message that matchAll's it).
+      def sw_register_client(realm_id, url, type, frame_type, handle)
+        w = @workers[handle.to_i] or return
+        rec = {'id' => "client-#{realm_id.to_i}", 'url' => url.to_s, 'type' => type.to_s, 'frameType' => frame_type.to_s}
+        @sw_clients[realm_id.to_i] = {handle: handle.to_i, rec: rec}
+        w[:inbox] << {kind: 'client_register', client: rec}
+        nil
+      end
+
+      # Drop a client whose realm was disposed (frame navigated away / removed) so
+      # matchAll stops returning a dead client. No-op for an unregistered realm.
+      def sw_unregister_client(realm_id)
+        @sw_realm_controller.delete(realm_id.to_i)
+        entry = @sw_clients.delete(realm_id.to_i) or return
+        w = @workers[entry[:handle]] or return
+        w[:inbox] << {kind: 'client_unregister', id: entry[:rec]['id']}
+        nil
+      end
+
+      # ── Cross-isolate MessagePort channel relay (client realm ↔ worker/SW isolate) ──
+      # Each endpoint self-registers when it (de)serializes the transferred port.
+      def port_channel_endpoint_realm(channel, realm_id)
+        ch = (@port_channels[channel.to_s] ||= {})
+        ch[:realm] = realm_id.to_i
+        # Flush anything the worker posted before this endpoint was known (deliver_worker_messages).
+        if (pending = ch.delete(:pending_realm))
+          pending.each {|d| deliver_port_to_realm(realm_id.to_i, channel.to_s, d) }
+        end
+        nil
+      end
+      # Deliver a channel message into a client realm's endpoint port (realm 0 = the main realm).
+      private def deliver_port_to_realm(rid, channel, data)
+        if rid.zero?
+          @runtime.call('__csimPortChannelDeliver', channel, data)
+        elsif @runtime.frame_realm_alive?(rid)
+          @runtime.realm_call(rid, '__csimPortChannelDeliver', channel, data)
+        end
+      end
+      def port_channel_endpoint_sw(channel, handle)
+        ch = (@port_channels[channel.to_s] ||= {})
+        ch[:sw] = handle.to_i
+        # Flush anything the client posted before this endpoint was known (see client_port_post).
+        if (pending = ch.delete(:pending_sw)) && (w = @workers[handle.to_i])
+          pending.each {|d| @sw_message_pending += 1; w[:inbox] << {kind: 'port_msg', channel: channel.to_s, data: d} }
+        end
+        nil
+      end
+      # A client-realm port posts to its remote (worker/SW) peer: relay to the isolate's inbox.
+      # Counted like an sw_message so settle waits for the worker to process it (and any reply it
+      # posts straight back on the same or another channel). A message posted BEFORE the peer endpoint
+      # is registered (a port used right after transfer, before the worker decoded it — the Comlink
+      # handshake) is BUFFERED on the channel and flushed by port_channel_endpoint_sw, per HTML's port
+      # message queue, rather than dropped.
+      def client_port_post(channel, data)
+        ch = (@port_channels[channel.to_s] ||= {})
+        handle = ch[:sw]
+        if handle && (w = @workers[handle])
+          @sw_message_pending += 1
+          w[:inbox] << {kind: 'port_msg', channel: channel.to_s, data: data.to_s}
+        else
+          (ch[:pending_sw] ||= []) << data.to_s
+        end
+        nil
+      end
+
+      # The active fetch-handling worker controlling a navigation to `url`. nil when uncontrolled
+      # or the SW is known to have no fetch listener (→ load from the network).
+      private def sw_controller_for_navigation(url)
+        match = sw_scope_match(url) or return nil
+        handle = match[0]
+        w = @workers[handle] or return nil
+        # has_fetch is published from the worker thread AFTER its initial eval, so a navigation
+        # into a freshly-activated registration can read it as nil (unknown) — race-prone for the
+        # 2nd+ registration, whose initial load fires before the publish. Treat unknown as "maybe":
+        # route through and let the fetch dispatch fall through if the SW turns out to have no
+        # handler. Skip only a KNOWN-false (messaging/push-only) SW, or one whose thread is already
+        # DEAD (crashed during eval / closed) — routing there would just stall the nav for the full
+        # round-trip budget with no one to answer.
+        return nil if w[:has_fetch] == false || !w[:thread]&.alive?
+
+        handle
+      end
+
+      # Route a navigation request (document / iframe load) to its controlling SW's `fetch`
+      # event and BLOCK for the respondWith result. Mirrors settle's bounded wait: the main
+      # thread releases the GVL on the dedicated `@sw_nav_outbox`, so the worker thread runs the
+      # handler and posts back. Navigation ids are NEGATIVE so the response is delivered on that
+      # queue (sw_deliver_fetch_response), not the general outbox. Returns the parsed response
+      # hash (SW served the document), or nil to load from the network (no controller, no
+      # respondWith, network error, or the SW didn't answer within the round-trip budget).
+      def service_worker_navigation_fetch(url, is_reload: false, is_history: false, referrer_source: nil, referrer_policy: nil, method: 'GET', body_b64: '', content_type: nil, site_seed: nil, origin_null: false)
+        handle = sw_controller_for_navigation(url) or return nil
+        w      = @workers[handle] or return nil
+        fetch_id = (@sw_nav_seq -= 1)
+        # Navigation Preload: when the controlling registration has it enabled, issue the parallel
+        # preload request NOW (main thread, before dispatching the event) and hand the response to the
+        # SW as `event.preloadResponse`. GET only (the feature does not support other methods). The SW
+        # that serves `respondWith(event.preloadResponse)` echoes this response back — the server is hit
+        # exactly once. (EARNED GAP: if the SW instead FALLS THROUGH, this method returns nil and the
+        # caller re-fetches from the network — a second hit; the spec reuses the preload response for
+        # the fall-through. No vendored subtest enables preload then falls through.)
+        preload = if method.to_s.upcase == 'GET' && nav_preload_enabled?(handle)
+          navigation_preload_response(
+            url,
+            referrer_source,
+            referrer_policy,
+            site_seed,
+            origin_null,
+            nav_preload_state(handle)['headerValue']
+          )
+        end
+        # A form submission navigates with the form's method + encoded body (a POST nav the SW reads
+        # via `event.request.text()`); the Content-Type the form's enctype implies rides its headers.
+        headers = {'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7'}
+        headers['Content-Type'] = content_type.to_s unless content_type.to_s.empty?
+        req = JSON.generate(
+          method:              method.to_s.empty? ? 'GET' : method.to_s.upcase,
+          url:                 url.to_s,
+          # The Accept header Fetch inserts for a navigation request (destination 'document').
+          headers:             headers,
+          body_b64:            body_b64.to_s,
+          mode:                'navigate',
+          destination:         'document',
+          isReloadNavigation:  is_reload,
+          isHistoryNavigation: is_history,
+          # A reload navigation revalidates (cache mode 'no-cache'); a fresh/history load is 'default'.
+          cache:               is_reload ? 'no-cache' : 'default',
+          # The navigation's referrer is the initiating document, resolved under ITS Referrer-Policy
+          # (the document default absent a meta/header — strict-origin-when-cross-origin — so a
+          # same-origin nav keeps the full URL). A SW that re-issues the request
+          # (`fetch(event.request)`) computes Sec-Fetch-Site / Origin against this referrer's origin.
+          referrer:            compute_referrer(referrer_policy, referrer_source, url.to_s).to_s,
+          # `event.request.referrerPolicy` reflects the RESOLVED policy: a navigation with no explicit
+          # meta/header policy uses the document default (strict-origin-when-cross-origin), never the
+          # empty string a bare Request would carry (fetch-event-referrer-policy "default referrer policy").
+          referrerPolicy:      referrer_policy.to_s.empty? ? 'strict-origin-when-cross-origin' : referrer_policy.to_s,
+          # A passthrough `fetch(event.request)` re-fetch reports the navigation's OWN request
+          # metadata to the server, independent of the referrer (which Referrer-Policy may reduce):
+          # the initiator origin (the navigating frame's — the request's origin for the Origin
+          # header) and the redirect chain's latched Sec-Fetch-Site seed / Origin taint accumulated
+          # by the network hops before the SW intercepted the final URL.
+          initiator:           url_origin(referrer_source),
+          siteSeed:            site_seed,
+          originNull:          origin_null,
+          # The Navigation Preload response (nil unless preload is enabled), surfaced to the handler
+          # as `event.preloadResponse`.
+          preloadResponse:     preload
+        )
+        w[:inbox] << {kind: 'fetch', req:, fetch_id:}
+        deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + WORKER_ROUND_TRIP_BUDGET
+        while Process.clock_gettime(Process::CLOCK_MONOTONIC) < deadline
+          ev = pop_with_timeout(@sw_nav_outbox, WORKER_POLL_INTERVAL) or next
+          next unless ev[:fetch_id] == fetch_id   # discard a stale response from a timed-out nav
+
+          resp = JSON.parse(ev[:resp])
+          return nil                        if resp['fallthrough']    # no respondWith → load from the network
+          return {'networkError' => true}   if resp['networkError']   # respondWith(Response.error()) → failed navigation
+
+          return resp
+        end
+        nil   # SW never answered within budget → load from the network
+      end
+
       def worker_terminate(handle)
         w = @workers.delete(handle.to_i)
         return unless w
@@ -3456,26 +4252,159 @@ module Capybara
           w[:thread].kill
           w[:thread].join(WORKER_TERMINATE_GRACE)
         end
+        # The dead worker never answers what was still queued in its inbox: post the matching
+        # fallback replies so the reply-pending counters drain (a controlled fetch falls back to
+        # the network) instead of taxing every later settle's bounded wait. Mid-dispatch deaths
+        # are covered by the `ensure` acks in run_worker; only a respondWith parked on a worker
+        # timer that never fires can still strand a fetch (the client promise then just never
+        # settles, like a real dead SW).
+        until w[:inbox].empty?
+          msg = begin
+            w[:inbox].pop(true)
+          rescue ThreadError
+            break
+          end
+          next unless msg.is_a?(Hash)
+          case msg[:kind]
+          when 'sw_message', 'port_msg' then @worker_outbox << {handle: handle.to_i, kind: 'swack'}
+          when 'broadcast'  then @worker_outbox << {handle: handle.to_i, kind: 'bcack'}
+          when 'fetch'      then sw_deliver_fetch_response(handle.to_i, msg[:fetch_id].to_i, '{"fallthrough":true}', @worker_outbox, msg[:realm_id].to_i)
+          end
+        end
+        # A streaming respondWith whose worker died mid-body never emits its terminal frame: error the
+        # client's stream (so a pending body read rejects, not hangs) and release the @sw_fetch_pending
+        # each open stream still holds, so settle can reach idle.
+        open = @sw_open_streams.delete(handle.to_i)
+        if open&.any?
+          open.each_key do |realm_id, fetch_id|
+            @runtime.realm_call(realm_id, '__csim_swFetchStreamError', fetch_id)
+          end
+          @sw_fetch_pending = [0, @sw_fetch_pending - open.size].max
+        end
+        # Drop any navigation scope mirrored to this now-dead worker so a later navigation
+        # doesn't route to it (it falls through to the network instead).
+        @sw_registrations.reject! {|_scope, h| h == handle.to_i }
+        @sw_navpreload.delete(handle.to_i)
         # A blocked worker that never returned messages leaves
         # `@worker_in_flight` permanently > 0; reset when no workers
         # remain so `polling?` can short-circuit again.
-        @worker_in_flight = 0 if @workers.empty?
+        (@worker_in_flight = 0; @worker_broadcast_pending = 0; @sw_message_pending = 0; @sw_fetch_pending = 0; @sw_fetch_wait_deadline = nil; @sw_msg_wait_deadline = nil; @sw_clients = {}; @sw_realm_controller = {}; @port_channels = {}; @sw_pending_claims = []; @sw_navpreload = {}; @sw_open_streams.clear) if @workers.empty?
         # The worker is gone — revoke the blob URLs it created.
         revoke_worker_blobs(handle.to_i)
       end
 
       def deliver_worker_messages
-        return 0 if @workers.empty? && @worker_outbox.empty?
+        head = @worker_outbox_head
+        @worker_outbox_head = nil
+        return 0 if head.nil? && @workers.empty? && @worker_outbox.empty?
         events = drain_queue(@worker_outbox)
+        events.unshift(head) if head
         return 0 if events.empty?
-        # `__error` postbacks don't correspond to a prior post, so
-        # bottom out at zero.
-        @worker_in_flight = [0, @worker_in_flight - events.size].max
-        @runtime.call('__csim_deliverWorkerMessages', events)
+        # A worker-originated BroadcastChannel post ('broadcast') is fanned out on the main thread and
+        # is NOT a reply. A 'bcack' acknowledges a broadcast the worker just delivered → release one
+        # broadcast-pending. Everything else ('message'/'__error') is a postMessage reply.
+        broadcasts,  rest0  = events.partition {|e| e[:kind] == 'broadcast' }
+        port_ends,   rest0b = rest0.partition  {|e| e[:kind] == 'port_endpoint' }
+        port_msgs,   rest0c = rest0b.partition {|e| e[:kind] == 'port_msg' }
+        sw_msgs,     rest1  = rest0c.partition {|e| e[:kind] == 'sw_client_msg' }
+        swacks,      rest2  = rest1.partition  {|e| e[:kind] == 'swack' }
+        claims,      rest3  = rest2.partition  {|e| e[:kind] == 'sw_claim' }
+        fetch_resps,   rest4  = rest3.partition  {|e| e[:kind] == 'fetch_response' }
+        stream_frames, rest4b = rest4.partition  {|e| e[:kind].to_s.start_with?('fr_') }
+        acks,          msgs   = rest4b.partition {|e| e[:kind] == 'bcack' }
+        broadcasts.each {|e| broadcast_to_windows(e[:name], e[:data], nil, e[:origin], from_worker: e[:handle]) }
+        # A worker/SW registering its end of a cross-isolate MessagePort channel — record it BEFORE
+        # the message events below, so a port message carried in the same drain can already route.
+        port_ends.each {|e| port_channel_endpoint_sw(e[:channel], e[:handle]) }
+        # A worker/SW port → its remote (client-realm) peer: relay to that realm's channel endpoint.
+        # If the client hasn't registered its endpoint yet (it decodes the transferred port in the
+        # sw_client_msg processed just below), BUFFER until port_channel_endpoint_realm flushes.
+        port_msgs.each do |e|
+          ch  = (@port_channels[e[:channel].to_s] ||= {})
+          rid = ch[:realm]
+          if rid.nil?
+            (ch[:pending_realm] ||= []) << e[:data]
+          else
+            deliver_port_to_realm(rid, e[:channel].to_s, e[:data])
+          end
+        end
+        # A service worker → client message: deliver to the POSTING client's realm. The client id
+        # encodes it — `client-<realm>` for a frame/window realm, 'client-window' for the main realm.
+        # A `client.postMessage` to a controlled IFRAME must reach THAT frame's navigator.service-
+        # Worker, not the top window (postmessage-to-client). `e[:handle]` is the SENDING worker, so
+        # the client's message `source` is exact. A message to a DISCARDED frame realm is dropped
+        # (matching a real browser — a message to a gone client is discarded, not misrouted to top).
+        sw_msgs.each do |e|
+          m = /\Aclient-(\d+)\z/.match(e[:client].to_s)
+          if m
+            rid = m[1].to_i
+            @runtime.realm_call(rid, '__csim_swDeliverClientMessage', e[:data], e[:handle]) if @runtime.frame_realm_alive?(rid)
+          else
+            @runtime.call('__csim_swDeliverClientMessage', e[:data], e[:handle])
+          end
+        end
+        # clients.claim(): the claiming worker takes control of EVERY in-scope client — including
+        # ones that never register()'d (an iframe built before the SW existed). See broadcast_claim.
+        # Process LONGEST scope first: when nested-scope workers claim in the same drain, the deeper
+        # registration must be installed before the shallower one runs, or a client the shallow claim
+        # transiently seizes would fire a spurious extra controllerchange (a reload-on-controllerchange
+        # page would double-fire). A claim whose scope isn't mirrored into @sw_registrations yet — the
+        # worker fires activate→claim() decoupled from the CLIENT-side lifecycle that populates it — is
+        # BUFFERED and flushed by sw_register_scope, so an `activate → clients.claim()` isn't lost.
+        claims.map {|e| [e, @sw_registrations.key(e[:handle].to_i)] }
+              .sort_by {|_e, scope| -(scope ? scope.length : -1) }
+              .each do |e, scope|
+          if scope
+            broadcast_claim(e[:handle], e[:has_fetch], scope)
+          else
+            @sw_pending_claims << e
+          end
+        end
+        # A controlled fetch's respondWith result → resolve the pending client fetch in the
+        # realm that issued it (fetch ids are per-realm, so realm_id disambiguates collisions).
+        fetch_resps.each {|e| @runtime.realm_call(e[:realm_id].to_i, '__csim_swControllerFetchResponse', e[:fetch_id], e[:resp]) }
+        # Streaming respondWith frames — deliver IN EMISSION ORDER (per fetch id: start → chunk* →
+        # close/error) so the client reassembles the body ReadableStream correctly. The request's
+        # @sw_fetch_pending was counted at fetch time and clears on the terminal frame.
+        stream_frames.each do |e|
+          fn = STREAM_FRAME_FNS[e[:kind]]
+          @runtime.realm_call(e[:realm_id].to_i, fn, e[:fetch_id], e[:payload]) if fn
+          # Track a stream's open span (head → terminal) per emitting worker, so worker_terminate
+          # can release + error a body its worker died mid-stream.
+          key = [e[:realm_id].to_i, e[:fetch_id].to_i]
+          if e[:kind] == 'fr_start' then @sw_open_streams[e[:handle].to_i][key] = true
+          else                           @sw_open_streams[e[:handle].to_i].delete(key)
+          end
+        end
+        stream_terminals          = stream_frames.count {|e| e[:kind] == 'fr_close' || e[:kind] == 'fr_error' }
+        @sw_fetch_pending         = [0, @sw_fetch_pending - fetch_resps.size - stream_terminals].max
+        @worker_broadcast_pending = [0, @worker_broadcast_pending - acks.size].max
+        @sw_message_pending       = [0, @sw_message_pending - swacks.size].max
+        # A delivered swack/bcack refreshes the message-wait budget (drain_pending_message_reply), so
+        # the next reply in a sequence waits afresh instead of inheriting a spent deadline. Done here,
+        # at the single delivery point, so it fires no matter which drain path delivered the reply —
+        # including hold_for_sw_fetch's outbox drain when a fetch co-pends (which would otherwise
+        # strand an expired deadline and re-starve the next transferable reply under load).
+        @sw_msg_wait_deadline     = nil if acks.size.positive? || swacks.size.positive?
+        # `__error` postbacks don't correspond to a prior post, so bottom out at zero.
+        @worker_in_flight = [0, @worker_in_flight - msgs.size].max
+        @runtime.call('__csim_deliverWorkerMessages', msgs) unless msgs.empty?
         events.size
       end
 
-      def worker_pending? = !@worker_outbox.empty? || @worker_in_flight > 0 || @worker_init_lock.synchronize { @worker_initializing } > 0
+      def worker_pending? = !@worker_outbox.empty? || !@worker_outbox_head.nil? || @worker_in_flight > 0 || @worker_broadcast_pending > 0 || @sw_message_pending > 0 || @sw_fetch_pending > 0 || @worker_init_lock.synchronize { @worker_initializing + @worker_busy } > 0
+
+      # The subset of worker pendings whose outbox reply is CONTRACTUAL (bcack / swack /
+      # fetch_response are posted under `ensure`, so they arrive even when the worker-side
+      # handler raises). Safe for settle to block a bounded wait on — unlike @worker_in_flight
+      # (a plain postMessage that a listen-only worker never answers) or @worker_initializing.
+      def worker_reply_pending? = @worker_broadcast_pending > 0 || @sw_message_pending > 0 || @sw_fetch_pending > 0
+
+      # The message/broadcast subset of `worker_reply_pending?` — a swack (client→SW postMessage /
+      # cross-isolate port message) or a bcack (BroadcastChannel post). `run_event_loop_frame` waits
+      # on these WITHOUT holding the clock (drain_pending_message_reply); the SW-fetch pending is held
+      # separately (hold_for_sw_fetch), so it's deliberately excluded here.
+      def worker_message_reply_pending? = @worker_broadcast_pending > 0 || @sw_message_pending > 0
 
       # ── Cross-window messaging (window.open / opener / postMessage) ──
       # Each window is a separate Browser/VM/isolate, so a reference to another
@@ -3586,14 +4515,32 @@ module Capybara
 
       # Covers both cross-window postMessage AND BroadcastChannel — the two
       # cross-window event channels share these drain/pending hooks.
-      def window_message_pending? = !@window_inbox.empty? || !@broadcast_inbox.empty?
+      def window_message_pending? = !@window_inbox.empty? || !@broadcast_inbox.empty? || !@storage_inbox.empty? || !@bc_queue.empty?
 
       # A BroadcastChannel message queued for delivery to this Browser's channels.
       # `source_realm_id` is the posting realm's context id within THIS isolate (0 =
       # main), or nil when the post came from ANOTHER isolate (the Driver's cross-
       # window fanout) — a nil source matches no local realm, so it reaches every one.
-      def enqueue_broadcast(name, data, source_realm_id = nil)
-        @broadcast_inbox << {'name' => name.to_s, 'data' => data, 'source' => source_realm_id}
+      def enqueue_broadcast(name, data, source_realm_id = nil, origin = nil)
+        @broadcast_inbox << {'name' => name.to_s, 'data' => data, 'source' => source_realm_id, 'origin' => origin}
+      end
+
+      # A Storage change (setItem/removeItem/clear) in realm `source_realm_id`: fire a `storage`
+      # event at every OTHER same-origin document. Within this isolate that's the other realms
+      # (main + frames — a window's documents share both storage areas); localStorage ALSO spans
+      # separate same-origin windows (the Driver shares its jar), so fan the change out to them —
+      # sessionStorage is per-browsing-context and never crosses windows.
+      def storage_changed(kind, key, old, new, url, source_realm_id)
+        enqueue_storage_event(kind, key, old, new, url, source_realm_id)
+        @driver.storage_broadcast(self, kind, key, old, new, url) if kind == 'local' && @driver.respond_to?(:storage_broadcast)
+        nil
+      end
+
+      # Queue a storage event for THIS window's documents. `source_realm_id` is the changing realm
+      # within this isolate (skipped at delivery); nil (a cross-window fan-out) matches no realm, so
+      # it reaches every one.
+      def enqueue_storage_event(kind, key, old, new, url, source_realm_id = nil)
+        @storage_inbox << {'kind' => kind.to_s, 'key' => key, 'old' => old, 'new' => new, 'url' => url.to_s, 'source' => source_realm_id}
       end
 
       # Fire queued cross-window messages (postMessage + BroadcastChannel).
@@ -3623,6 +4570,26 @@ module Capybara
           end
           n += events.size
         end
+        unless @storage_inbox.empty?
+          events = @storage_inbox.slice!(0, @storage_inbox.length)
+          # The `storage` event fires at every same-origin document EXCEPT the one that changed
+          # the area — deliver to the main realm (0) and every live frame realm, skipping the
+          # source realm. A nil source (a cross-window fan-out) is excluded from no realm.
+          realm_ids = @runtime.respond_to?(:frame_realm_ids) ? @runtime.frame_realm_ids : []
+          [0, *realm_ids].each do |target_id|
+            batch = events.reject {|e| e['source'] == target_id }
+            next if batch.empty?
+            if target_id.zero?
+              @runtime.call('__csim_deliverStorageEvents', batch)
+            elsif @runtime.frame_realm_alive?(target_id)
+              @runtime.realm_call(target_id, '__csim_deliverStorageEvents', batch)
+            end
+          end
+          n += events.size
+        end
+        # Drain the ordered BroadcastChannel queue LAST, so a `message`/`storage` handler above that
+        # re-posts (multi-realm mode → bc_post) is picked up in this same pass.
+        n += deliver_broadcast_queue unless @bc_queue.empty?
         n
       end
 
@@ -3632,13 +4599,107 @@ module Capybara
       # fanout goes through the Driver; the same-ISOLATE fanout (main ↔ sibling realms,
       # sibling ↔ sibling) is queued here and delivered per-realm by
       # `deliver_window_messages`, which skips the posting realm.
-      def broadcast_to_windows(name, data, source_realm_id = 0)
-        @driver.broadcast_channel(self, name.to_s, data) if @driver.respond_to?(:broadcast_channel)
-        # Only queue for same-isolate delivery when sibling realms exist — a single-
-        # realm page already delivered to itself in-VM, so this stays zero-overhead.
-        if @runtime.respond_to?(:frame_realm_ids) && @runtime.frame_realm_ids.any?
-          enqueue_broadcast(name, data, source_realm_id.to_i)
+      # Fan a BroadcastChannel post out to every OTHER same-origin browsing context. Called on the
+      # MAIN thread — either directly from a main/frame-realm post (`source_realm_id` = the poster's
+      # realm, `from_worker` nil), or from `deliver_worker_messages` for a WORKER-originated post
+      # (`from_worker` = the posting worker's handle, `source_realm_id` nil).
+      def broadcast_to_windows(name, data, source_realm_id = 0, origin = nil, from_worker: nil)
+        broadcast_external(name, data, origin, from_worker: from_worker)
+        # Same-isolate main + frame realms (LEGACY single-realm / worker-inbound path — the multi-realm
+        # main-thread post goes through `bc_post`'s ordered queue instead). The poster already delivered
+        # to itself in-VM, so this only reaches the OTHER realms — queue whenever one exists. A WORKER
+        # post reaches realm 0 and every frame (a separate isolate delivered to none in-VM). A FRAME post
+        # always reaches main realm 0 — even when the posting frame's own realm isn't yet recorded in
+        # `frame_realms` (a BroadcastChannel posted SYNCHRONOUSLY during the frame's initial script runs
+        # before the realm is registered, so `has_frames` can be false though a valid target — main —
+        # exists). A MAIN post reaches the frames only when some are registered.
+        has_frames = @runtime.respond_to?(:frame_realm_ids) && @runtime.frame_realm_ids.any?
+        from_frame = !from_worker && !source_realm_id.nil? && source_realm_id != 0
+        enqueue_broadcast(name, data, source_realm_id, origin) if has_frames || from_worker || from_frame
+      end
+
+      # Fan a BroadcastChannel post out beyond this isolate's main-thread realms: OTHER top-level windows
+      # (separate isolates, via the Driver) and every live WORKER (separate isolate, via its thread-safe
+      # inbox, except the posting worker). Shared by the legacy `broadcast_to_windows` and the ordered
+      # `bc_post` — a same-isolate ordered post still reaches workers and other windows. `origin` here is
+      # the SCOPING origin KEY (opaque token / tuple origin), which the worker + cross-window sides match on.
+      def broadcast_external(name, data, origin, from_worker: nil)
+        @driver.broadcast_channel(self, name.to_s, data, origin) if @driver.respond_to?(:broadcast_channel)
+        # Skip a worker whose thread has already exited (self-close / termination in flight): it will
+        # never drain its inbox, so pushing would leak. Counted in a dedicated pending tally so `settle`
+        # waits until the worker acks the delivery (a `bcack`).
+        @workers.each do |h, w|
+          next if h == from_worker || !w[:thread].alive?
+          @worker_broadcast_pending += 1
+          w[:inbox] << {kind: 'broadcast', name: name.to_s, data: data, origin: origin}
+        end
+      end
+
+      # ── BroadcastChannel isolate-wide ordered delivery (multi-realm path) ──
+      # A channel registers on construction with the isolate-wide creation counter, so delivery can be
+      # ordered "oldest channel first" across realms.
+      def bc_register(realm_id, local_id, name, origin_key)
+        @bc_seq += 1
+        @bc_registry[[realm_id.to_i, local_id.to_i]] = {seq: @bc_seq, name: name.to_s, origin_key: origin_key, closed: false}
+        nil
+      end
+
+      def bc_unregister(realm_id, local_id)
+        @bc_registry.delete([realm_id.to_i, local_id.to_i])
+        nil
+      end
+
+      # Is another same-isolate realm (a frame / same-isolate window) live? Only then does a post use the
+      # ordered registry; a single-realm page keeps the in-VM microtask path (zero behaviour change).
+      def bc_siblings_exist? = @runtime.respond_to?(:frame_realm_ids) && @runtime.frame_realm_ids.any?
+
+      # A main-thread BroadcastChannel post in multi-realm mode. Snapshot the eligible target channels
+      # (same name + origin, still open, excluding the poster) at POST TIME, ordered by creation seq, and
+      # queue one ordered delivery each — so a channel created AFTER this post (higher seq / not yet
+      # registered) never receives it, and cross-realm targets interleave with same-realm ones by
+      # creation order (broadcastchannel/ordering). Also fans out to workers + other windows.
+      def bc_post(realm_id, local_id, name, origin_key, data, origin)
+        realm_id = realm_id.to_i
+        local_id = local_id.to_i
+        name     = name.to_s
+        # Snapshot ALL matching open channels — do NOT gate on `frame_realm_alive?` here: a channel that
+        # posts SYNCHRONOUSLY during its frame's initial script (opaque-origin's data: iframes) runs in a
+        # realm not yet registered in `frame_realms`, so a same-realm sibling would be wrongly excluded.
+        # `deliver_broadcast_queue` re-checks realm liveness at delivery time (by then it's registered),
+        # and a genuinely-dead realm's stale entry just yields a skipped delivery.
+        targets  = @bc_registry.reject {|(rid, lid), e|
+          e[:closed] || e[:name] != name || e[:origin_key] != origin_key ||
+            (rid == realm_id && lid == local_id)
+        }.sort_by {|_k, e| e[:seq] }
+        # `origin` (serialized, e.g. "null") is the MessageEvent.origin the same-isolate delivery
+        # exposes; `origin_key` (e.g. "opaque:…") is the SCOPING token workers / other windows match on.
+        targets.each {|(rid, lid), _e| @bc_queue << {realm_id: rid, local_id: lid, data: data, origin: origin} }
+        broadcast_external(name, data, origin_key)
+        nil
+      end
+
+      # Drain the ordered BroadcastChannel queue, delivering one message to one channel at a time in
+      # creation order. A handler's synchronous re-post appends to `@bc_queue` (via bc_post), so the loop
+      # keeps draining those in order too — reproducing the single global task queue the spec describes.
+      # Bounded per call (like every drain loop here): a pathological mutual re-post between two realms
+      # would otherwise spin forever holding the GVL. The cap leaves any remainder queued
+      # (`window_message_pending?` keeps the loop live), so a runaway is bounded by the runner's
+      # force-timeout across frames rather than hanging uninterruptibly in one.
+      def deliver_broadcast_queue
+        n = 0
+        until @bc_queue.empty?
+          break if n >= BROADCAST_DRAIN_CAP
+          item = @bc_queue.shift
+          e = @bc_registry[[item[:realm_id], item[:local_id]]]
+          next if e.nil? || e[:closed]   # closed after being queued → gets nothing
+          if item[:realm_id].zero?
+            @runtime.call('__csim_bcDeliverOne', item[:local_id], item[:data], item[:origin])
+          elsif @runtime.frame_realm_alive?(item[:realm_id])
+            @runtime.realm_call(item[:realm_id], '__csim_bcDeliverOne', item[:local_id], item[:data], item[:origin])
+          end
+          n += 1
         end
+        n
       end
 
       # ── Image decode (libvips) ─────────────────────────────────────
@@ -3655,29 +4716,210 @@ module Capybara
       # 8900×8900 frames Discourse uploads exercise. Optional
       # `max_w`/`max_h` lets the caller pre-shrink for cheap OCR-style
       # "downscale before pixel-touch" flows.
+      # Load an image resource for an `<img>` (or a pattern/drawImage source):
+      # resolve the URL against the current document, fetch the bytes, and decode
+      # them to an RGBA buffer via libvips. Returns `{width, height, refId}` (the
+      # raw pixels ride the transfer registry, like decode_image) or nil when the
+      # fetch or decode fails (a broken image → the `<img>` fires `error`).
+      # Fetch + decode an `<img>` resource to an RGBA bitmap for the drawImage /
+      # createPattern surface, memoized by resolved URL (see `@@image_cache`). Returns
+      # {'width','height','refId'} — a FRESH transfer stash per call, since
+      # `fetchTransfer` consumes the registry entry — or nil when the resource can't be
+      # fetched or decoded (the caller fires `error`). A scheme with no host-side reader
+      # yet (blob:, whose bytes live in the VM) returns {'unsupported' => true} so the
+      # caller stays inert rather than reporting a spuriously-broken image.
+      # `cors` (a `crossorigin` <img>) fetches under CORS: a cross-origin response without a
+      # matching Access-Control-Allow-Origin fails the load. `credentials` is 'include' for
+      # crossorigin="use-credentials", 'same-origin' (uncredentialed cross-origin) otherwise.
+      def load_image(url, cors = false, credentials = 'same-origin')
+        key = resolve_against_current(url.to_s)
+        return nil unless key.is_a?(String)
+        entry = cached_image(key, cors, credentials)
+        return {'unsupported' => true} if entry == :unsupported
+        # A valid zero-area image: complete + not broken, but no pixels. rsvg throws
+        # before dimensions can be read, so the intrinsic size collapses to 0×0 (a
+        # browser would keep the non-zero axis, e.g. 0×100 → naturalHeight 100) — a minor
+        # divergence, immaterial to createPattern / drawImage, which both need a
+        # non-zero area.
+        tainted = image_tainted?(key, cors)
+        return {'zeroSize' => true, 'width' => 0, 'height' => 0, 'tainted' => tainted} if entry == :zero_size
+        return nil unless entry
+        r = {'width' => entry['width'], 'height' => entry['height'], 'refId' => transfer_buffer_stash(entry['bytes']), 'colorSpace' => entry['colorSpace'], 'tainted' => tainted}
+        r['refIdP3'] = transfer_buffer_stash(entry['bytesP3']) if entry['bytesP3']
+        r
+      end
+
+      # Whether a successfully-loaded image taints a canvas it's drawn into: its bytes came
+      # cross-origin without CORS approval — i.e. a no-cors http(s) load from a different origin
+      # than the document. A CORS load that reached here passed the Access-Control check (so it's
+      # origin-clean), and same-origin / data: images are always clean. An opaque-origin document
+      # (data:/srcdoc/sandboxed — nil origin) is cross-origin to every http(s) image, so any such
+      # image taints it.
+      private def image_tainted?(key, cors)
+        return false if cors || !key.match?(%r{\Ahttps?://}i)
+        img = url_origin(key)
+        return false unless img
+        doc = url_origin(@current_url)
+        doc.nil? || doc != img
+      end
+
+      # A decoded-image cache entry for `key`, decoding + caching on a miss.
+      # :unsupported for a scheme we can't fetch host-side; nil on fetch/decode failure.
+      # A CORS load caches under a key tagged with the mode, the credentials, AND the requesting
+      # document origin — its success/failure is origin-dependent (a response's ACAO may allow one
+      # origin and not another), and @@image_cache is process-wide (shared across documents /
+      # sessions), so an origin-blind key would serve one origin's CORS success to another origin
+      # whose load should fail. A no-cors load is origin-independent (it always reads the bytes),
+      # so it keeps the bare URL key and shares the cache with the decode / canvas loaders.
+      private def cached_image(key, cors = false, credentials = 'same-origin')
+        cache_key = cors ? "cors:#{credentials}:#{url_origin(@current_url)}:#{key}" : key
+        cached = @@image_cache_lock.synchronize { @@image_cache[cache_key] }
+        return cached if cached
+        bytes = image_source_bytes(key, cors, credentials)
+        return bytes if bytes == :unsupported
+        return nil unless bytes
+        entry = decode_or_nil(bytes)
+        # nil (broken) and :zero_size (valid but zero-area) both carry no bitmap to cache.
+        return entry unless entry.is_a?(Hash)
+        @@image_cache_lock.synchronize do
+          @@image_cache.clear if @@image_cache.size >= IMAGE_CACHE_MAX
+          @@image_cache[cache_key] = entry
+        end
+        entry
+      end
+
+      # Raw (encoded) bytes for an image URL: `data:` decoded inline, http(s) via a
+      # binary-safe fetch (the raw bytes ride `body_b64`; the text body would mangle
+      # non-ASCII image bytes). A `cors` load threads 'cors' mode + credentials into the
+      # fetch, so rack_fetch's Access-Control enforcement rejects (→ nil) a cross-origin
+      # response with no matching ACAO. :unsupported for a scheme with no host-side reader,
+      # nil for a missing / failed / CORS-rejected / empty resource.
+      private def image_source_bytes(key, cors = false, credentials = 'same-origin')
+        if key.start_with?('data:')
+          bytes = decode_data_url_body(key)
+          bytes.empty? ? nil : bytes
+        elsif key.match?(%r{\Ahttps?://}i)
+          result = rack_fetch('GET', key, '', {}, 'follow', cors ? 'cors' : nil, credentials: credentials)
+          return nil unless result && result['status'].to_i < 400
+          bytes = result['body_b64'] ? Base64.decode64(result['body_b64']) : result['body'].to_s.b
+          bytes.empty? ? nil : bytes
+        else
+          :unsupported
+        end
+      end
+
+      # Decode a base64-encoded image (createImageBitmap's blob path), optionally
+      # downscaled to fit within (max_w, max_h) via its resize options.
       def decode_image(b64_bytes, max_w = nil, max_h = nil)
-        host_image_op('decode_image') {
-          require 'vips' unless defined?(Vips)
-          bytes = Base64.decode64(b64_bytes.to_s)
-          # `access: :sequential` keeps libvips from applying the
-          # source's ICC profile mid-stream (changes RGBA values by ±2
-          # vs raw decode). `colourspace('srgb')` is the same ICC
-          # transform Chrome's createImageBitmap runs, but rounding
-          # differs by a few ulp; only convert when libvips reports
-          # a non-sRGB interpretation, otherwise trust the bytes.
-          img   = Vips::Image.new_from_buffer(bytes, '', access: :sequential)
-          img   = img.colourspace('srgb') unless img.interpretation == :srgb || img.interpretation == :rgb
-          img   = img.bandjoin(255) if img.bands < 4
-          if max_w && max_h && max_w.to_i > 0 && max_h.to_i > 0 &&
-             (img.width > max_w.to_i || img.height > max_h.to_i)
-            shrink_x = img.width.to_f  / max_w.to_i
-            shrink_y = img.height.to_f / max_h.to_i
-            shrink  = [shrink_x, shrink_y].max
-            img     = img.resize(1.0 / shrink) if shrink > 1
+        entry = decode_or_nil(Base64.decode64(b64_bytes.to_s), max_w, max_h)
+        # nil (broken) or :zero_size — createImageBitmap of either rejects (a zero-area
+        # source is an InvalidStateError), so surface nil for the caller to reject on.
+        return nil unless entry.is_a?(Hash)
+        r = {'width' => entry['width'], 'height' => entry['height'], 'refId' => transfer_buffer_stash(entry['bytes']), 'colorSpace' => entry['colorSpace']}
+        r['refIdP3'] = transfer_buffer_stash(entry['bytesP3']) if entry['bytesP3']
+        r
+      end
+
+      # Decode an encoded image (PNG/JPEG/GIF/WEBP/SVG/…) to a packed RGBA bitmap via
+      # libvips, optionally downscaled to fit within (max_w, max_h). `access:
+      # :sequential` keeps libvips from applying the source ICC profile mid-stream (it
+      # shifts RGBA by ±2 vs a raw decode). Returns {'width','height','bytes','colorSpace'};
+      # `colorSpace` ('srgb' | 'display-p3') tells drawImage which space the bytes are in
+      # so it can convert into the destination canvas's colour space.
+      #
+      # Detection is by the profile's description text (both Display-P3 and the sRGB /
+      # Adobe profiles carry a readable name). A plain (unprofiled) OR sRGB-profiled RGB
+      # image is trusted as sRGB verbatim — the common case (incl. photos exported as
+      # sRGB) stays byte-identical. A Display-P3 image keeps its raw bytes: a Display-P3
+      # PNG already stores P3-encoded values, so we only TAG it and let drawImage do the
+      # gamut conversion. Adobe-RGB and CMYK aren't among the two predefined canvas colour
+      # spaces, so they're ICC-transformed to sRGB (their wide gamut is lost — a documented
+      # gap). Any other profiled non-RGB source (grayscale / Lab) is colour-converted to
+      # sRGB so it lands as packed RGB, never kept raw.
+      private def decode_rgba(bytes, max_w = nil, max_h = nil)
+        require 'vips' unless defined?(Vips)
+        img = Vips::Image.new_from_buffer(bytes, '', access: :sequential)
+        # RGB (incl. 16-bit `rgb16`); a non-RGB profiled source is colour-converted below.
+        rgb = %i[srgb rgb rgb16].include?(img.interpretation)
+        color_space = 'srgb'
+        p3_img = nil   # a second, Display-P3 rendering for a wide-gamut source (see below)
+        if img.get_fields.include?('icc-profile-data')
+          icc = img.get('icc-profile-data')
+          if rgb && (icc.include?('Display P3') || icc.include?('DCI-P3'))
+            color_space = 'display-p3'   # wide-gamut RGB: raw bytes are already P3-encoded
+          elsif img.interpretation == :cmyk || icc.include?('Adobe')
+            # A wide-gamut (Adobe-RGB / CMYK) profile can't be represented by a single
+            # buffer: an sRGB canvas needs the colour CLIPPED to sRGB, a Display-P3 canvas
+            # needs it PRESERVED in P3 (and those differ — ICC gamut-mapping to sRGB isn't a
+            # matrix clip of the P3 value). So decode BOTH renderings via libvips' built-in
+            # profiles; drawImage picks by the destination canvas's colour space. icc_transform
+            # needs random access, so re-decode without `access: :sequential`.
+            base = Vips::Image.new_from_buffer(bytes, '')
+            begin
+              img    = base.icc_transform('srgb', embedded: true)
+              p3_img = base.icc_transform('p3',   embedded: true)
+            rescue StandardError
+              img = img.colourspace('srgb'); p3_img = nil
+            end
+          elsif !rgb
+            img = img.colourspace('srgb')   # profiled grayscale / Lab → packed sRGB RGB
           end
-          raw = img.write_to_memory
-          {'width' => img.width, 'height' => img.height, 'refId' => transfer_buffer_stash(raw)}
-        }
+          # else: an sRGB-profiled (or other) RGB image → trust the raw bytes as sRGB.
+        elsif !rgb
+          img = img.colourspace('srgb')
+        end
+        pack = lambda do |i|
+          i = i.cast('uchar', shift: true) if i.format == :ushort   # 16-bit source → 8-bit, scaled
+          i = i.bandjoin(255) if i.bands < 4
+          i
+        end
+        img    = pack.call(img)
+        p3_img = pack.call(p3_img) if p3_img
+        if max_w && max_h && max_w.to_i > 0 && max_h.to_i > 0 &&
+           (img.width > max_w.to_i || img.height > max_h.to_i)
+          shrink = [img.width.to_f / max_w.to_i, img.height.to_f / max_h.to_i].max
+          if shrink > 1
+            img    = img.resize(1.0 / shrink)
+            p3_img = p3_img.resize(1.0 / shrink) if p3_img
+          end
+        end
+        out = {'width' => img.width, 'height' => img.height, 'bytes' => img.write_to_memory, 'colorSpace' => color_space}
+        # The P3 rendering is best-effort: libvips is lazy, so an ICC fault surfaces only
+        # here at sink evaluation — it must not break the already-rendered sRGB image, just
+        # drop the wide-gamut variant (that image then won't preserve wide colours in a P3 canvas).
+        if p3_img
+          begin
+            out['bytesP3'] = p3_img.write_to_memory
+          rescue StandardError
+            nil
+          end
+        end
+        out
+      end
+
+      # `decode_rgba` guarded. Outcomes:
+      #   Hash       — a decoded {'width','height','bytes'} bitmap
+      #   :zero_size — a VALID image with a non-positive intrinsic dimension (rsvg refuses
+      #                to rasterize an SVG whose width|height is 0). Browsers still load it,
+      #                reporting a zero-area bitmap, so this is "available but empty"
+      #                (bad usability → createPattern null / drawImage no-op), NOT broken.
+      #   nil        — an undecodable / corrupt body: a normal "broken image" outcome
+      #                (the caller fires `error` / rejects the ImageBitmap promise)
+      # A Vips::Error is a quiet outcome, not stderr noise; genuine host faults (missing
+      # libvips, OOM) still warn via `host_image_op`. The `bad dimensions` signal is the
+      # rsvg loader's own diagnostic for a non-positive canvas (libvips-version-coupled
+      # text; a corrupt raster / malformed SVG raises a different, non-matching message);
+      # it also covers a fully DIMENSIONLESS SVG that a browser would instead render at
+      # the 300×150 CSS default — a bounded, documented divergence, still a net
+      # improvement over the old nil→broken→InvalidStateError.
+      private def decode_or_nil(bytes, max_w = nil, max_h = nil)
+        require 'vips' unless defined?(Vips)
+        decode_rgba(bytes, max_w, max_h)
+      rescue Vips::Error => e
+        e.message.include?('bad dimensions') ? :zero_size : nil
+      rescue LoadError, StandardError => e
+        warn "[capybara-simulated] image decode failed: #{e.class}: #{e.message[0, 200]}"
+        nil
       end
 
       private def host_image_op(name)
@@ -3687,6 +4929,346 @@ module Capybara
         nil
       end
 
+      # Render a line of text to a coverage mask via libvips (pango / fontconfig),
+      # backing the canvas `fillText` / `measureText` surface with real system-font
+      # glyphs and metrics — no bundled font, so any installed family works. `font`
+      # is a pango font string ("Sans Bold 16"); at dpi 72 the point size equals CSS
+      # px. Returns `{width, height, xoffset, yoffset, ascent, descent[, refId]}`:
+      # the image is cropped to the INK box, and (xoffset, yoffset) locate that box
+      # within the logical layout, so the JS side can place the alphabetic baseline.
+      # `measure_only` skips rasterizing the mask (the lazy image already knows its
+      # dimensions) — the cheap path for `measureText`.
+      def render_text(text, font, measure_only = false, font_url = nil, kerning = nil)
+        host_image_op('render_text') {
+          require 'vips' unless defined?(Vips)
+          pango = font.to_s.empty? ? 'Sans 10' : font.to_s
+          fontfile = font_url && !font_url.to_s.empty? ? font_file_for(font_url) : nil
+          # Ascent/descent are properties of the FONT, not the variant: probe them with a
+          # small-caps-stripped description so the descender probe ('gjpqy') isn't rendered
+          # as (descenderless) small capitals, which would collapse the reported descent.
+          asc, desc = font_vmetrics(pango.sub(/ Small-Caps\b/i, ''), fontfile)
+          # NUL takes up no space and would abort the pango render; drop it so a lone
+          # "\0" measures/draws as empty rather than falling back to a fabricated width.
+          str = text.to_s.delete("\u0000")
+          return {'width' => 0, 'advance' => 0, 'height' => 0, 'xoffset' => 0, 'yoffset' => 0, 'ascent' => asc, 'descent' => desc} if str.empty?
+
+          # `Vips::Image.text` parses Pango markup — canvas text is always literal,
+          # so escape the markup metacharacters (an unescaped `&`/`<` would raise,
+          # silently dropping the text; `<b>…` would wrongly render as bold).
+          markup = str.gsub('&', '&amp;').gsub('<', '&lt;').gsub('>', '&gt;')
+          # `fontKerning = 'none'` disables the OpenType `kern` feature via a Pango markup
+          # span, so a system font's rendered advance widens to the un-kerned width. ('auto'
+          # / 'normal' leave pango's default kerning on.) A downloaded font's advance comes
+          # from hmtx and is unaffected.
+          markup = %(<span font_features="kern=0">#{markup}</span>) if kerning == 'none'
+          # Render the whole line at its natural width; the caller condenses it
+          # horizontally to honor canvas maxWidth (pango `width:` would word-WRAP,
+          # which the canvas text algorithm never does). An @font-face family loads its
+          # own font via `fontfile:` so pango resolves it (vips needs fontconfig support).
+          img = text_image(markup, pango, fontfile)
+          # `width` is the INK width (vips crops to it); `advance` is the pen movement
+          # (`measureText().width`), which a downloaded font's hmtx gives exactly and
+          # which falls back to the ink width for a system font we can't parse — or for a
+          # string whose codepoints the (BMP) cmap doesn't map yet still renders ink
+          # (astral / symbol-cmap), where a computed 0 advance would be wrong.
+          adv = fontfile && font_advance_px(pango, fontfile, str)
+          advance = adv && adv > 0 ? adv : img.width
+          em_asc, em_desc = fontfile ? font_em_vmetrics(pango, fontfile) : nil
+          res = {
+            'width'    => img.width,
+            'advance'  => advance,
+            'height'   => img.height,
+            'xoffset'  => img.get('xoffset'),
+            'yoffset'  => img.get('yoffset'),
+            'ascent'   => asc,
+            'descent'  => desc,
+            'emAscent'  => em_asc || asc,
+            'emDescent' => em_desc || desc
+          }
+          res.merge!(font_base_metrics(pango, fontfile) || {}) if fontfile   # BASE-table baselines, when present
+          unless measure_only
+            img = img.cast('uchar') unless img.format == :uchar
+            res['refId'] = transfer_buffer_stash(img.write_to_memory)
+          end
+          res
+        }
+      end
+
+      # `Vips::Image.text` with the optional `fontfile:` (an @font-face's downloaded
+      # font), which pango loads so it can resolve that family. Passing a nil fontfile
+      # would raise, so branch — a system-font family resolves through fontconfig.
+      private def text_image(markup, pango, fontfile)
+        if fontfile
+          Vips::Image.text(markup, font: pango, fontfile: fontfile, dpi: 72)
+        else
+          Vips::Image.text(markup, font: pango, dpi: 72)
+        end
+      end
+
+      # Ascent (baseline offset from the logical top) and descent for a pango font,
+      # probed once and cached. A no-descender cap/ascender string's ink bottom is
+      # the baseline (ascent); a descender string's ink bottom minus that is the
+      # descent. dpi 72 keeps units in CSS px. `fontfile` (an @font-face font) is part
+      # of the cache key so a downloaded family's metrics don't collide with a system one.
+      private def font_vmetrics(pango, fontfile = nil)
+        key = fontfile ? "#{pango}\0#{fontfile}" : pango
+        cached = @font_vmetrics_lock.synchronize { @font_vmetrics[key] }
+        return cached if cached
+
+        # A downloaded @font-face carries its own typographic metrics, and pango lays
+        # it out on those, so the baseline (ascent) comes from the font's OS/2 typo
+        # ascender/descender scaled to the pixel size — the ink-string heuristic below
+        # is only a fallback for the ambient system font, whose file we don't have.
+        asc, desc = font_typo_vmetrics(pango, fontfile) if fontfile
+        unless asc
+          asc = begin
+            r = text_image('Mbdfhklt', pango, fontfile)
+            r.get('yoffset') + r.height
+          rescue StandardError
+            10
+          end
+          desc = begin
+            r = text_image('gjpqy', pango, fontfile)
+            [(r.get('yoffset') + r.height) - asc, 0].max
+          rescue StandardError
+            (asc * 0.25).round
+          end
+        end
+        @font_vmetrics_lock.synchronize { @font_vmetrics[key] ||= [asc, desc] }
+      end
+
+      # [ascent, descent] in px from a font file's OS/2 typographic metrics scaled to
+      # the pango string's point size (dpi 72 → px), or nil if it can't be read. This is
+      # the FONT bounding box / baseline value (fontBoundingBoxAscent), typo-ascender
+      # over unitsPerEm.
+      private def font_typo_vmetrics(pango, fontfile)
+        m = font_typo_units(fontfile) or return nil
+        upm, ta, td = m
+        size = font_size_of(pango)
+        [(ta * size / upm).round, [(-td * size / upm).round, 0].max]
+      end
+
+      # [emHeightAscent, emHeightDescent] in px: the em square (= font size) split by the
+      # baseline at the typo ascender:descender ratio — NOT normalized by unitsPerEm, so a
+      # font whose ascender+descender ≠ em still fills the em (e.g. descent-0 → all ascent).
+      private def font_em_vmetrics(pango, fontfile)
+        m = font_typo_units(fontfile) or return nil
+        _upm, ta, td = m
+        span = ta + (-td)
+        return nil unless span.positive?
+        size = font_size_of(pango)
+        ea = size * ta / span.to_f
+        [ea.round, (size - ea).round]
+      end
+
+      # The point size in a pango font string ("CanvasTest 40" → 40); 10 as a fallback.
+      # The size is a whitespace-separated trailing token, so a family that itself ends
+      # in a digit ("B612") without a size isn't misread as one.
+      private def font_size_of(pango)
+        size = pango.to_s[/\s(\d+(?:\.\d+)?)\s*\z/, 1].to_f
+        size.positive? ? size : 10.0
+      end
+
+      # [unitsPerEm, sTypoAscender, sTypoDescender] from a TrueType/OpenType file's
+      # `head` + `OS/2` tables, or nil.
+      private def font_typo_units(fontfile)
+        g = font_glyph_data(fontfile) or return nil
+        [g[:upm], g[:typo_asc], g[:typo_desc]]
+      end
+
+      # The advance width (pen movement) of `text` in the font, in px at the pango
+      # string's size — the value `measureText().width` reports. vips crops to ink, so
+      # the advance (which includes side bearings) comes from the font's own hmtx table.
+      # nil if the font can't be parsed.
+      private def font_advance_px(pango, fontfile, text)
+        g = font_glyph_data(fontfile) or return nil
+        size = font_size_of(pango)
+        units = text.to_s.each_char.sum do |ch|
+          gid = g[:cmap][ch.ord]
+          next 0 unless gid   # a codepoint the font doesn't map (null, control) advances nothing
+          g[:advances][gid] || g[:advances].last || 0
+        end
+        units * size / g[:upm]
+      end
+
+      # Parse the glyph tables a canvas text metric needs out of a TrueType/OpenType
+      # file, memoized per path: unitsPerEm + typo metrics (head / OS/2), the per-glyph
+      # advance widths (hmtx), and a Unicode → glyph-id map (cmap format 4). nil when a
+      # required table is missing or malformed.
+      private def font_glyph_data(fontfile)
+        (@font_glyph ||= {})
+        return @font_glyph[fontfile] if @font_glyph.key?(fontfile)
+        @font_glyph[fontfile] = parse_font_glyph_data(fontfile)
+      end
+
+      private def parse_font_glyph_data(fontfile)
+        data = File.binread(fontfile)
+        n = data[4, 2].unpack1('n')
+        tabs = {}
+        12.step(12 + (n - 1) * 16, 16) { |o| tabs[data[o, 4]] = data[o + 8, 4].unpack1('N') }
+        head = tabs['head']; os2 = tabs['OS/2']; hhea = tabs['hhea']; hmtx = tabs['hmtx']; cmap = tabs['cmap']
+        return nil unless head && hhea && hmtx && cmap
+        upm = data[head + 18, 2].unpack1('n')
+        return nil unless upm.positive?
+        num_h = data[hhea + 34, 2].unpack1('n')
+        advances = (0...num_h).map { |i| data[hmtx + i * 4, 2].unpack1('n') }
+        {
+          upm:       upm,
+          typo_asc:  s16(data[(os2 || hhea) + (os2 ? 68 : 4), 2]),
+          typo_desc: s16(data[(os2 || hhea) + (os2 ? 70 : 6), 2]),
+          advances:  advances,
+          # A malformed cmap shouldn't discard the (already-read) upm / advances / typo
+          # metrics, so isolate its parse — an empty map just means advances fall back.
+          cmap:      (parse_cmap4(data, cmap) rescue {}),
+          # Optional horizontal-baseline coordinates ({tag => font units}) from the `BASE`
+          # table — the alphabetic / hanging / ideographic baselines measureText reports.
+          base:      (tabs['BASE'] ? (parse_base_table(data, tabs['BASE']) rescue {}) : {}),
+        }
+      rescue StandardError
+        nil
+      end
+
+      # Horizontal-axis baseline coordinates ({"hang"/"ideo"/"romn"/… => font units},
+      # relative to the script's default baseline) from the first BASE-table script's
+      # BaseValues. Empty when the table is absent or has no coordinates.
+      private def parse_base_table(data, base_off)
+        horiz_rel = data[base_off + 4, 2].unpack1('n')          # horizAxisOffset (0 = none)
+        return {} if horiz_rel.zero?
+        horiz = base_off + horiz_rel
+        tag_list = horiz + data[horiz, 2].unpack1('n')          # baseTagList (rel. to axis)
+        script_list = horiz + data[horiz + 2, 2].unpack1('n')   # baseScriptList (rel. to axis)
+        ntags = data[tag_list, 2].unpack1('n')
+        nscript = data[script_list, 2].unpack1('n')
+        # A count read past a truncated table is nil; `(0...nil)` is an ENDLESS range that
+        # would loop forever (never raising, so the caller's `rescue {}` can't save it).
+        return {} if ntags.nil? || nscript.nil? || nscript.zero?
+        tags = (0...ntags).map { |i| data[tag_list + 2 + i * 4, 4] }
+        # Prefer the DFLT / latn script's baselines; else the first record.
+        recs = (0...nscript).map { |i| o = script_list + 2 + i * 6; [data[o, 4], script_list + data[o + 4, 2].unpack1('n')] }
+        _tag, s_off = recs.find { |t, _| t == 'DFLT' || t == 'latn' } || recs.first
+        bv_rel = data[s_off, 2].unpack1('n')                    # baseValuesOffset (0 = none)
+        return {} if bv_rel.zero?
+        bv = s_off + bv_rel
+        ncoord = data[bv + 2, 2].unpack1('n')
+        out = {}
+        tags.each_with_index do |t, i|
+          break if i >= ncoord
+          co = bv + data[bv + 4 + i * 2, 2].unpack1('n')
+          out[t] = s16(data[co + 2, 2]) if [1, 2, 3].include?(data[co, 2].unpack1('n'))   # BaseCoord formats
+        end
+        out
+      end
+
+      # The alphabetic / hanging / ideographic baselines (px at the pango size) from the
+      # font's BASE table, or nil when the font has none — then the caller heuristically
+      # derives them from the vertical metrics instead.
+      private def font_base_metrics(pango, fontfile)
+        g = font_glyph_data(fontfile) or return nil
+        base = g[:base]
+        return nil if base.nil? || base.empty?
+        scale = font_size_of(pango) / g[:upm].to_f
+        romn = base['romn'] || 0                                # the alphabetic baseline = the reference
+        {
+          'alphabeticBaseline'  => 0.0,
+          'hangingBaseline'     => ((base['hang'] || romn) - romn) * scale,
+          'ideographicBaseline' => ((base['ideo'] || romn) - romn) * scale,
+        }
+      end
+
+      # A Unicode → glyph-id map from the first format-4 `cmap` subtable (the standard
+      # BMP Unicode encoding), as {codepoint => glyph}. Empty when none is present.
+      private def parse_cmap4(data, cmap)
+        ntab = data[cmap + 2, 2].unpack1('n')
+        return {} if ntab.nil?   # a count read past a truncated table → don't loop `(0...nil)` forever
+        # Prefer a Unicode BMP subtable — (3,1) Windows Unicode or (0,*) Unicode — over a
+        # (3,0) Symbol map (which shadows ASCII into the 0xF000 PUA); fall back to any
+        # format-4 table only if no Unicode one is present.
+        best = nil; best_rank = -1
+        (0...ntab).each do |i|
+          rec = cmap + 4 + i * 8
+          pid = data[rec, 2].unpack1('n'); eid = data[rec + 2, 2].unpack1('n')
+          off = data[rec + 4, 4].unpack1('N')
+          next unless data[cmap + off, 2].unpack1('n') == 4
+          rank = pid == 3 && eid == 1 ? 3 : pid.zero? ? 2 : pid == 3 && eid.zero? ? 0 : 1
+          if rank > best_rank then best_rank = rank; best = cmap + off end
+        end
+        sub = best
+        return {} unless sub
+        segx2 = data[sub + 6, 2].unpack1('n'); segc = segx2 / 2
+        endc  = sub + 14
+        startc = endc + segx2 + 2
+        iddelta = startc + segx2
+        idrange = iddelta + segx2
+        map = {}
+        (0...segc).each do |s|
+          e  = data[endc + s * 2, 2].unpack1('n')
+          st = data[startc + s * 2, 2].unpack1('n')
+          delta = data[iddelta + s * 2, 2].unpack1('n')
+          ro    = data[idrange + s * 2, 2].unpack1('n')
+          (st..e).each do |c|
+            next if c == 0xFFFF
+            gid = if ro.zero?
+                    (c + delta) & 0xFFFF
+                  else
+                    gi = idrange + s * 2 + ro + (c - st) * 2
+                    g = data[gi, 2].unpack1('n')
+                    g.zero? ? 0 : (g + delta) & 0xFFFF
+                  end
+            map[c] = gid if gid != 0
+          end
+        end
+        map
+      end
+
+      # A big-endian signed 16-bit value.
+      private def s16(bytes)
+        v = bytes.unpack1('n')
+        v >= 0x8000 ? v - 0x10000 : v
+      end
+
+      # Resolve an @font-face src URL to an on-disk font file pango can load, fetching
+      # the bytes through the Rack app (binary-safe) once and caching the temp path for
+      # the process. Returns nil when the fetch fails.
+      def font_file_for(url)
+        key = resolve_against_current(url.to_s)
+        return nil unless key.is_a?(String)
+        @@font_file_lock.synchronize { return @@font_file_cache[key] if @@font_file_cache.key?(key) }
+        path = build_font_file(key)
+        @@font_file_lock.synchronize { @@font_file_cache[key] = path }
+        path
+      end
+
+      private def build_font_file(key)
+        bytes = font_source_bytes(key)
+        return nil unless bytes && !bytes.empty?
+        require 'tempfile'
+        # Keep the Tempfile object alive for the process so its file isn't reaped while
+        # fontconfig may still read it; the cache holds the path.
+        file = Tempfile.new(['csim-font', File.extname(key)[0, 5]])
+        file.binmode
+        file.write(bytes)
+        file.flush
+        # Pin the handle for the whole process: the path is cached in the CLASS-level
+        # @@font_file_cache and outlives the per-visit Browser that first built it, so
+        # the Tempfile must not be finalized (and its file unlinked) with that instance.
+        @@font_file_lock.synchronize { @@font_files << file }
+        file.path
+      end
+
+      # Raw font bytes for a URL: `data:` inline, http(s) via a binary-safe Rack fetch
+      # (the raw bytes ride `body_b64`; a text body would mangle the font's non-ASCII).
+      private def font_source_bytes(key)
+        if key.start_with?('data:')
+          bytes = decode_data_url_body(key)
+          bytes.empty? ? nil : bytes
+        elsif key.match?(%r{\Ahttps?://}i)
+          result = rack_fetch('GET', key, '', {}, 'follow')
+          return nil unless result && result['status'].to_i < 400
+          bytes = result['body_b64'] ? Base64.decode64(result['body_b64']) : result['body'].to_s.b
+          bytes.empty? ? nil : bytes
+        end
+      end
+
       def reset_workers
         @workers.each_value do |w|
           w[:inbox] << :terminate
@@ -3694,7 +5276,21 @@ module Capybara
         end
         @workers.clear
         @worker_outbox.clear
-        @worker_in_flight = 0
+        @worker_outbox_head       = nil
+        @worker_in_flight         = 0
+        @worker_broadcast_pending = 0
+        @sw_message_pending       = 0
+        @sw_fetch_pending         = 0
+        @sw_open_streams.clear
+        @sw_fetch_wait_deadline   = nil
+        @sw_msg_wait_deadline     = nil
+        @sw_registrations.clear
+        @sw_navpreload       = {}
+        @sw_pending_claims   = []
+        @sw_clients          = {}
+        @sw_realm_controller = {}
+        @port_channels       = {}
+        @sw_nav_outbox.clear
         @transfer_buffer_lock.synchronize {
           @transfer_buffers.clear
           @transfer_buffer_seq = 0
@@ -3728,26 +5324,13 @@ module Capybara
       end
 
       def blob_resolve(url)
-        local = @blob_registry_lock.synchronize { @blob_registry[url.to_s] }
-        return local if local
-        # Not in this window's registry: a blob created in ANOTHER window/isolate is
-        # fetchable only from the SAME storage partition (cross-partition.https
-        # "fetched from a same-partition iframe" succeeds; a cross-partition fetch
-        # fails). Resolve the bytes cross-isolate from the creator and hand them back
-        # as base64 (resolveBlobBytes decodes them). The cross-isolate read enters the
-        # creator's V8 isolate, so only do it on the MAIN thread — a worker thread
-        # can't safely enter another isolate (so a same-partition WORKER fetch of a
-        # blob owned elsewhere isn't supported; a cross-partition one correctly fails).
-        # CAVEAT: bytes-only — resolveBlobBytes types a host-resolved blob as
-        # application/octet-stream (the cross-window path loses the Blob's `type`); no
-        # in-scope test reads the type on this path, and carrying it would change the
-        # __csim_blobResolve string protocol.
-        return nil unless @driver.respond_to?(:blob_partition_site_of) && @driver.respond_to?(:blob_bytes_for)
-        site = @driver.blob_partition_site_of(url.to_s)
-        return nil if site.nil? || site != blob_partition_site   # unknown / revoked / cross-partition
-        return nil if Thread.current[:csim_worker_handle]
-        data = @driver.blob_bytes_for(url.to_s, self)
-        data && Base64.strict_encode64(data[:bytes].to_s.b)
+        # A same-partition blob created in another window/isolate is spec-fetchable
+        # cross-window, but resolving its bytes means a real-time cross-isolate read
+        # (+ worker round-trips for the worker variants) that races the per-example
+        # timeout under suite load — flaky in the gate. So we only resolve a blob from
+        # THIS window's registry; the cross-window same-partition fetch is a backlog
+        # item (cross-partition.https "fetched from a same-partition {iframe,worker}").
+        @blob_registry_lock.synchronize { @blob_registry[url.to_s] }
       end
 
       # The SITE (scheme + registrable domain) of this window's top-level document.
@@ -3757,26 +5340,11 @@ module Capybara
       # host's last two dot-labels — correct for the single-label public suffixes our
       # in-process hosts use (web-platform.test / not-web-platform.test / *.com); a
       # full Public Suffix List isn't warranted here.
+      # This document's partition "site" (scheme + registrable domain) for Blob-URL / storage
+      # partitioning. A blob: document derives from its inner origin; data:/about: (no host) →
+      # '' (an opaque origin, never same-partition with a real one). See registrable_site.
       def blob_partition_site
-        # A blob: document's location is `blob:<innerURL>` (e.g.
-        # `blob:https://host:port/uuid`) — strip the prefix so the site derives from
-        # the inner origin, not the opaque blob: scheme. data:/about: have no host →
-        # '' (an opaque origin, never same-partition with a real one).
-        u = URI.parse(@current_url.to_s.sub(/\Ablob:/, ''))
-        host = u.host.to_s
-        return '' if host.empty?
-        labels = host.split('.')
-        # An IP literal (v4 dotted / v6 bracketed) or a ≤2-label host IS its own
-        # registrable domain; otherwise approximate eTLD+1 as the last two labels
-        # (no Public Suffix List — correct for the single-label TLDs our hosts use).
-        regd = if host.start_with?('[') || host.match?(/\A\d+(\.\d+){3}\z/) || labels.length <= 2
-          host
-        else
-          labels.last(2).join('.')
-        end
-        "#{u.scheme}://#{regd}"
-      rescue URI::Error
-        ''
+        registrable_site(@current_url) || ''
       end
 
       # WHATWG URL "domain to ASCII" — the JS tr46 stub delegates non-ASCII / xn--
@@ -3959,7 +5527,9 @@ module Capybara
       # Called from the JS bridge when a `<video>` element's `src` is
       # assigned a `blob:` URL. ffprobe extracts dimensions + duration,
       # ffmpeg extracts the first frame as raw RGBA. JS caches both so
-      # `canvas.drawImage(video, …)` blits like any ImageBitmap.
+      # `canvas.drawImage(video, …)` blits like any ImageBitmap. A `<video src>` that
+      # points at a served file (http / relative) or a `data:` URL resolves its bytes
+      # the same way — see `video_bytes_b64` below.
       def decode_video_frame(b64_bytes)
         host_image_op('decode_video_frame') {
           bytes = Base64.decode64(b64_bytes.to_s)
@@ -3982,6 +5552,22 @@ module Capybara
         }
       end
 
+      # Fetch a media resource (http / relative URL) and return its bytes base64-encoded,
+      # so a `<video src>` pointing at a served file decodes the same way a blob: / data:
+      # source does. Binary stays Ruby-side; only ASCII base64 crosses into V8. Returns
+      # nil when the fetch fails.
+      def video_bytes_b64(url)
+        result = rack_fetch('GET', url, '', {}, 'follow')
+        return nil unless result && result['status'].to_i < 400
+        # The RAW bytes ride `body_b64` (see response_hash) for any non-ASCII response;
+        # the text `body` field is a UTF-8 re-decode that corrupts binary media. Fall
+        # back to base64-of-body only for a pure-ASCII response (byte-identical there).
+        b64 = result['body_b64']
+        return b64 unless b64.nil? || b64.empty?
+        body = result['body'].to_s
+        body.empty? ? nil : [body].pack('m0')
+      end
+
       private def ffprobe_stream(path)
         json = IO.popen(
           ['ffprobe', '-v', 'error', '-select_streams', 'v:0',
@@ -4052,7 +5638,7 @@ module Capybara
       # `build_worker` factory, evaluates the worker script, then
       # loops draining microtasks + timers + inbox until `:terminate`
       # lands or an exception propagates.
-      private def run_worker(handle, url, body, inbox, outbox, engine_class, shared: false, service: false)
+      private def run_worker(handle, url, body, inbox, outbox, engine_class, shared: false, service: false, creator_key: nil)
         # Release the spawn-time `@worker_initializing` count exactly once, however
         # this method exits (normal start, `self.close()`, or an exception), so
         # worker_pending? doesn't stay stuck true forever.
@@ -4062,6 +5648,11 @@ module Capybara
           initializing = false
           @worker_init_lock.synchronize { @worker_initializing -= 1 }
         end
+        # True while THIS thread holds a `@worker_busy` increment for a message it's
+        # mid-handling; balanced in the `ensure` so an exception between the bump and
+        # the matching decrement can't strand the counter (which would pin
+        # `worker_pending?` true forever).
+        busy_held = false
         # Tag this thread so blob URLs created by the worker's script are owned by
         # this handle and revoked on terminate (see blob_register / revoke_worker_blobs).
         Thread.current[:csim_worker_handle] = handle
@@ -4071,17 +5662,83 @@ module Capybara
         # BINARY-tagged (see `RuntimeShared.utf8_text`).
         body = RuntimeShared.utf8_text(body)
         post_back = ->(data) { outbox << {handle: handle, kind: 'message', data: data.to_s} }
-        rt        = engine_class.build_worker(self, post_back)
+        # A worker's BroadcastChannel post rides the same thread-safe outbox; the main thread fans
+        # it out to the main + frame realms + OTHER workers (see deliver_worker_messages).
+        broadcast_out = ->(name, data, origin) { outbox << {handle: handle, kind: 'broadcast', name: name.to_s, data: data, origin: origin} }
+        # Service-worker → main-thread signals ride the outbox (delivered by deliver_worker_messages):
+        # client.postMessage, clients.claim (→ set the client's controller), and a controlled fetch's
+        # respondWith result. `sw_has_fetch` is snapshotted after the SW script's initial run (the
+        # spec records fetch-handler presence at install time) so a claim can tell the client
+        # whether intercepting is worth the cross-isolate round-trip at all.
+        sw_has_fetch = false
+        sw_hooks = {
+          post_to_client: ->(client_id, data) { outbox << {handle: handle, kind: 'sw_client_msg', client: client_id, data: data.to_s} },
+          claim:          ->                  { outbox << {handle: handle, kind: 'sw_claim', has_fetch: sw_has_fetch} },
+          fetch_respond:  ->(fetch_id, resp, realm_id) { sw_deliver_fetch_response(handle, fetch_id.to_i, resp.to_s, outbox, realm_id.to_i) },
+          # A streaming respondWith frame (start / chunk / close / error) for a controlled client's
+          # fetch — rides the outbox in emission order so the client realm reassembles the body
+          # stream incrementally (deliver_worker_messages). The request's @sw_fetch_pending stays up
+          # for the whole stream and clears on the terminal (close / error) frame.
+          fetch_stream:   ->(fetch_id, kind, payload, realm_id) { outbox << {handle: handle, kind: "fr_#{kind}", fetch_id: fetch_id.to_i, payload: payload.to_s, realm_id: realm_id.to_i} },
+          # Cross-isolate MessagePort channel: this worker's port endpoint + its outbound messages
+          # ride the outbox (delivered by deliver_worker_messages → the peer client realm).
+          port_endpoint:  ->(channel)       { outbox << {handle: handle, kind: 'port_endpoint', channel: channel.to_s} },
+          port_post:      ->(channel, data) { outbox << {handle: handle, kind: 'port_msg', channel: channel.to_s, data: data.to_s} }
+        }
+        rt        = engine_class.build_worker(self, post_back, broadcast_out, sw_hooks)
+        # A worker isolate loads the same snapshot as the main realm, so its `console.*`
+        # is a no-op until `traceActive` is set (console.js). The main realm turns it on
+        # from `CSIM_CONSOLE_STDERR`; without this a worker's console — and anything routed
+        # through it, e.g. an Emscripten `printErr` — is silently dropped during debugging.
+        rt.call('__csimSetTraceActive', true) if CONSOLE_STDERR
+        # This worker's handle — the JS keys cross-isolate MessagePort channel ids on it so they
+        # never collide with another isolate's (see __csim_installWorkerScope's allocator).
+        rt.eval("globalThis.__csimWorkerHandle = #{handle.to_i};")
         # Set the worker's `self.location.href` so webpack /
         # rollup public-path derivation + `new URL(rel, import.meta.url)`
         # resolve chunks against the worker's own origin rather than
         # the snapshot-time `http://placeholder/`.
         rt.eval("globalThis.__csimUpdateLocation(#{JSON.generate(url.to_s)});")
+        # A worker's BroadcastChannel origin KEY (its agent-cluster identity). A blob: worker
+        # INHERITS the creating context's origin (the blob URL carries no real origin of its own);
+        # a data: worker gets a FRESH opaque origin, unique per worker, so it never cross-talks with
+        # its creator or a sibling data: worker. An http(s) worker leaves this unset — the JS derives
+        # its key from `location.origin` (the script's own origin, same as the creator when
+        # same-origin). See `__csimBcOriginKey`.
+        worker_origin_key =
+          if url.to_s.start_with?('blob:')
+            creator_key
+          elsif url.to_s.start_with?('data:')
+            "opaque:worker#{handle}"
+          end
+        rt.eval("globalThis.__csimOriginKey = #{JSON.generate(worker_origin_key)};") if worker_origin_key
         # A service worker runs in a ServiceWorkerGlobalScope: adjust the worker scope
         # (no blob-URL minting; SW lifecycle stubs) BEFORE its script runs.
         rt.eval('__csim_installServiceWorkerScope();') if service
         rt.eval(body)
         rt.drain_microtasks
+        # Drive the service worker's lifecycle: fire `install`, then `activate`, draining each
+        # phase's `waitUntil` promises before the next (the client-side ServiceWorker object plays
+        # out the observable installing→installed→activating→activated timeline; here we run the
+        # worker's OWN install/activate handlers so their side effects — caching, importScripts —
+        # execute). See sw-client.js + __csim_swFireLifecycleEvent.
+        if service
+          sw_has_fetch = !!rt.call('__csim_swHasFetchListener')
+          # Publish the fetch-handler snapshot + script URL on the worker record so a NAVIGATION
+          # into this SW's scope can decide (Ruby-side) whether routing through it is worthwhile,
+          # and a freshly-built frame client can mint a `controller` naming this script.
+          if (w = @workers[handle])
+            w[:has_fetch]  = sw_has_fetch
+            w[:script_url] = url.to_s
+          end
+          %w[install activate].each do |phase|
+            rt.eval("globalThis.__csim_swFireLifecycleEvent(#{JSON.generate(phase)});")
+            # Drain microtasks AND timers: a `waitUntil` promise may settle off a
+            # setTimeout (e.g. a delayed cache warm-up), so advance the worker clock too.
+            rt.drain_microtasks
+            rt.drain_timers
+          end
+        end
         # A SharedWorker fires `connect` AFTER its script set `self.onconnect`; the
         # connect handler's port post lands in the outbox before release_init, so
         # worker_pending? stays true until it's delivered.
@@ -4097,26 +5754,119 @@ module Capybara
           loop do
             msg = pop_with_timeout(inbox, WORKER_POLL_INTERVAL)
             break if msg == :terminate
-            rt.call('__csim_workerOnMessage', msg) if msg
-            # Drive the worker's OWN event loop each tick: a message handler OR an
-            # AUTONOMOUS loop (the dispatcher executor-worker's receive→fetch→setTimeout
-            # retry, which has no inbox message) may have pending timers. Drain ~one poll
-            # interval (WorkerRuntime#drain_timers advances the worker clock a step) so
-            # they progress; worker http fetch is setTimeout(0)+__rackFetch, resolved on
-            # this thread by the drain. Gated on a PENDING timer (any, not just due-now —
-            # the clock must advance to fire a future randomDelay) so an idle
-            # message-driven worker with no timers stays lazy. Host CALLS, not string
-            # `eval`, keep the per-tick cost off the V8 compile path (rule 3).
+            # A main-side BroadcastChannel post to this worker arrives as a {kind:'broadcast'} hash;
+            # deliver it to the worker's channels (the receiver's own origin gate drops cross-origin).
+            # A plain string is a postMessage to the worker.
+            if msg.is_a?(Hash) && msg[:kind] == 'broadcast'
+              # Ack so the main thread releases the broadcast-pending it counted for this delivery
+              # (a listen-only worker never posts back — the ack is the only signal it processed
+              # it). Under `ensure`: the ack is CONTRACTUAL (settle's bounded wait relies on it —
+              # see worker_reply_pending?), so a raising channel handler must not leak it.
+              begin
+                rt.call('__csim_deliverBroadcasts', [{'name' => msg[:name], 'data' => msg[:data], 'origin' => msg[:origin]}])
+              ensure
+                outbox << {handle: handle, kind: 'bcack'}
+              end
+            elsif msg.is_a?(Hash) && msg[:kind] == 'sw_message'
+              # A client → service-worker postMessage: dispatch a `message` event with source = the
+              # posting client. Ack AFTER the dispatch — the outbox is FIFO, so a handler's
+              # synchronous `client.postMessage` reply (`sw_client_msg`) is guaranteed to precede
+              # the `swack`; acking first opens a window where the main thread sees the pending
+              # count hit zero (worker_pending? false) while the handler is still running, and the
+              # virtual clock fast-forwards past the caller's timeout before the reply lands. The
+              # `ensure` keeps a raising handler from leaking the counter and hanging settle.
+              begin
+                rt.call('__csim_swClientMessage', msg[:data], msg[:client], msg[:url])
+              ensure
+                outbox << {handle: handle, kind: 'swack'}
+              end
+            elsif msg.is_a?(Hash) && msg[:kind] == 'port_msg'
+              # A client-realm port → its remote peer in THIS worker: deliver to the channel endpoint
+              # port. Counted like an sw_message (client_port_post incremented @sw_message_pending), so
+              # ack AFTER dispatch under `ensure` — a synchronous reply the port handler posts back
+              # (another port_msg on the outbox) is FIFO-guaranteed to precede this swack.
+              begin
+                rt.call('__csimPortChannelDeliver', msg[:channel], msg[:data])
+              ensure
+                outbox << {handle: handle, kind: 'swack'}
+              end
+            elsif msg.is_a?(Hash) && msg[:kind] == 'client_register'
+              # A controlled client (frame/window realm) came into existence: mirror it into the
+              # SW's clientsById so matchAll/getClientByURL see it. Fire-and-forget (no reply /
+              # pending counter): the inbox is FIFO, so it's processed before any later message
+              # whose handler matchAll's the client.
+              rt.call('__csim_swRegisterClient', msg[:client])
+            elsif msg.is_a?(Hash) && msg[:kind] == 'client_unregister'
+              # The client's realm was disposed — drop it so matchAll stops returning a dead client.
+              rt.call('__csim_swUnregisterClient', msg[:id])
+            elsif msg.is_a?(Hash) && msg[:kind] == 'fetch'
+              # A controlled client's fetch: dispatch a `fetch` event. The SW's respondWith result
+              # (or a fall-through / network-error marker) is posted back as a `fetch_response`
+              # outbox event, which releases the @sw_fetch_pending counted for this request. A
+              # synchronous respondWith posts during the dispatch; an async one posts under the
+              # drain. If the dispatch itself dies (engine raise, Thread#kill) the JS side can
+              # never post — fall the client back to the network so the counter drains (a
+              # duplicate response is harmless: the client's pendingFetch entry is one-shot).
+              dispatched = false
+              begin
+                rt.call('__csim_swDispatchFetch', msg[:req], msg[:fetch_id], msg[:realm_id])
+                dispatched = true
+              ensure
+                sw_deliver_fetch_response(handle, msg[:fetch_id].to_i, '{"fallthrough":true}', outbox, msg[:realm_id].to_i) unless dispatched
+              end
+            elsif msg.is_a?(Hash) && msg[:kind] == 'fetch_cancel'
+              # The client cancelled this streaming respondWith body — cancel the reader
+              # streamDeliver is draining, firing the SW source stream's `cancel()`. Fire-and-forget:
+              # the reader's cancellation resolves its read as done, emitting the terminal frame that
+              # clears @sw_fetch_pending; no ack/counter of its own.
+              rt.call('__csim_swStreamCancel', msg[:fetch_id])
+            elsif msg
+              # Mark BUSY for the whole span of this postMessage handler. Unlike the SW /
+              # broadcast branches above (each tracked by its own pending counter),
+              # `@worker_in_flight` under-counts a multi-reply handshake to 0 mid-flight (one
+              # request → many progress replies + a final resolve), so `worker_pending?` would
+              # go false while the worker is still working and settle would abandon the
+              # protocol between replies. Keep it true until the handler returns.
+              @worker_init_lock.synchronize { @worker_busy += 1 }
+              busy_held = true
+              # A plain worker postMessage handler can start a multi-stage async bring-up
+              # that alternates microtasks and timers — most sharply Emscripten's WASM
+              # runtime init (addRunDependency → read the binary on a setTimeout(0) →
+              # WebAssembly.instantiate → removeRunDependency → run() → onRuntimeInitialized
+              # → the module factory's `.then`). Draining once leaves the microtask layers a
+              # fired timer queued *after the last timer* stranded, so the factory promise
+              # never settles (Tesseract hangs at "initializing tesseract"). Run the worker's
+              # own event loop to quiescence instead of a single gated tick.
+              rt.call('__csim_workerOnMessage', msg)
+              drive_worker_to_quiescence(rt)
+            end
+            # Drive the worker's OWN event loop each tick: an AUTONOMOUS loop (the dispatcher
+            # executor-worker's receive→fetch→setTimeout retry, which has no inbox message)
+            # may have pending timers. Drain ~one poll interval (WorkerRuntime#drain_timers
+            # advances the worker clock a step) so they progress; worker http fetch is
+            # setTimeout(0)+__rackFetch, resolved on this thread by the drain. Gated on a
+            # PENDING timer (any, not just due-now — the clock must advance to fire a future
+            # randomDelay) so an idle message-driven worker with no timers stays lazy. A
+            # regular postMessage already drove itself to quiescence above (no timer left),
+            # so this is a no-op for it. Host CALLS, not string `eval`, keep the per-tick
+            # cost off the V8 compile path (rule 3).
             if rt.call('__nextTimerDelay').to_f >= 0
               rt.drain_microtasks
               rt.drain_timers
             end
+            if busy_held
+              @worker_init_lock.synchronize { @worker_busy -= 1 }
+              busy_held = false
+            end
             break if rt.call('__csimWorkerClosedRead')
           end
         end
       rescue StandardError => e
         outbox << {handle: handle, kind: '__error', message: "#{e.class}: #{e.message}"}
       ensure
+        # A raise between the busy bump and its matching decrement would strand the
+        # counter; balance it here so worker_pending? can't stick true after this thread dies.
+        @worker_init_lock.synchronize { @worker_busy -= 1 } if busy_held
         release_init.call   # guarantee the init count is released on an early raise
         rt&.dispose
       end
@@ -4137,7 +5887,12 @@ module Capybara
             return data[:bytes]
           end
           b64 = @runtime.call('__csimReadBlobBase64', u)
-          return nil unless b64
+          # A blob created INSIDE a frame realm lives in that realm's in-VM store, which the main
+          # runtime's `__csimReadBlobBase64` above can't see. But createObjectURL also registered its
+          # bytes in the cross-realm `@blob_registry` (crossCtx, since a frame realm is multi-realm),
+          # so fall back to it — this is what makes `new Worker(blobURL)` work from a data: iframe.
+          b64 = blob_resolve(u) if b64.nil? || b64.to_s.empty?
+          return nil if b64.nil? || b64.to_s.empty?
           return Base64.decode64(b64.to_s)
         end
         # `data:[<mediatype>][;base64],<data>` worker scripts (a worker created
@@ -4161,6 +5916,24 @@ module Capybara
         end
       end
 
+      # Run a worker isolate's own event loop until it goes idle: drain microtasks,
+      # then — if a timer is pending — advance the worker clock to fire it and loop, so
+      # the microtasks that timer's callback queues get drained in turn. A single
+      # `drain_microtasks; drain_timers` pair strands whatever the last-fired timer
+      # queued, which is exactly how Emscripten's WASM bring-up stalls
+      # (`removeRunDependency` runs only after the binary-read setTimeout, and its
+      # `run()` → `onRuntimeInitialized` continuation is a bare microtask with no further
+      # timer to re-trigger a gated drain). Bounded by WORKER_QUIESCE_MAX_ROUNDS so a
+      # self-perpetuating timer (setInterval) yields back to the poll loop rather than
+      # pinning the thread.
+      private def drive_worker_to_quiescence(rt)
+        WORKER_QUIESCE_MAX_ROUNDS.times do
+          rt.drain_microtasks
+          break if rt.call('__nextTimerDelay').to_f < 0
+          rt.drain_timers
+        end
+      end
+
       # `Thread::Queue#pop(timeout:)` blocks releasing the GVL — fine
       # because the worker thread has nothing else to do while idle,
       # and `worker_post_to_worker` wakes the wait immediately.
@@ -4225,15 +5998,146 @@ module Capybara
         end
       end
 
+      # Fetch caps a request at 20 redirects: the 21st is a network error (redirect-count).
+      # The loop below runs one iteration PER dispatch, so it needs 20 redirect hops plus
+      # the final response — MAX_FETCH_REDIRECTS + 1 iterations — to let exactly 20 succeed.
       MAX_FETCH_REDIRECTS = 20
+      # Request cache modes that never READ the store (always hit the network), and modes that
+      # serve a STORED response even when stale. Frozen so the hot rack_fetch path allocates no
+      # throwaway arrays per hop (perf).
+      CACHE_MODES_SKIP_READ  = %w[no-store reload].freeze
+      CACHE_MODES_SERVE_STALE = %w[force-cache only-if-cached].freeze
+      # Fetch "bad port" blocklist (https://fetch.spec.whatwg.org/#port-blocking) —
+      # ports tied to non-HTTP protocols a request must never reach. Frozen Set for
+      # O(1) membership on the rack_fetch path.
+      BAD_PORTS = Set[
+        0, 1, 7, 9, 11, 13, 15, 17, 19, 20, 21, 22, 23, 25, 37, 42, 43, 53, 69, 77,
+        79, 87, 95, 101, 102, 103, 104, 109, 110, 111, 113, 115, 117, 119, 123, 135,
+        137, 139, 143, 161, 179, 389, 427, 465, 512, 513, 514, 515, 526, 530, 531,
+        532, 540, 548, 554, 556, 563, 587, 601, 636, 989, 990, 993, 995, 1719, 1720,
+        1723, 2049, 3659, 4045, 4190, 5060, 5061, 6000, 6566, 6665, 6666, 6667, 6668,
+        6669, 6679, 6697, 10080
+      ].freeze
+
+      REFERRER_POLICIES = %w[
+        no-referrer no-referrer-when-downgrade origin origin-when-cross-origin
+        same-origin strict-origin strict-origin-when-cross-origin unsafe-url
+      ].freeze
+
+      # The `Referer` value a request carries under a Referrer-Policy — nil = send none
+      # (https://w3c.github.io/webappsec-referrer-policy/#determine-requests-referrer).
+      # `referrer_url` is the request's referrer (the initiating document); `target_url`
+      # its destination. "full" is the referrer stripped of fragment + credentials;
+      # "origin" is scheme://host[:port]/. An empty / unknown policy → the default
+      # (strict-origin-when-cross-origin).
+      def compute_referrer(policy, referrer_url, target_url)
+        return nil if referrer_url.nil? || referrer_url.to_s.empty?
+        policy = 'strict-origin-when-cross-origin' unless REFERRER_POLICIES.include?(policy)
+        return nil if policy == 'no-referrer'
+        # The referrer is almost always the (constant) document URL — memoise its parse
+        # so the rack_fetch hot path doesn't re-parse it per request (rule 3).
+        ref = parse_referrer_url(referrer_url)
+        return nil unless ref && %w[http https].include?(ref.scheme)
+        full        = -> { u = ref.dup; u.fragment = nil; u.password = nil; u.user = nil; u.to_s }
+        origin_only = -> {
+          default_port = ref.scheme == 'https' ? 443 : 80
+          port         = ref.port && ref.port != default_port ? ":#{ref.port}" : ''
+          "#{ref.scheme}://#{ref.host}#{port}/"
+        }
+        return full.call        if policy == 'unsafe-url'
+        return origin_only.call if policy == 'origin'
+        # The remaining policies need the target to know same-origin / downgrade.
+        tgt = (URI.parse(target_url) rescue nil)
+        return nil unless tgt
+        same_origin = ref.scheme == tgt.scheme && ref.host == tgt.host && ref.port == tgt.port
+        downgrade   = ref.scheme == 'https' && tgt.scheme == 'http'
+        case policy
+        when 'origin-when-cross-origin'        then same_origin ? full.call : origin_only.call
+        when 'same-origin'                     then same_origin ? full.call : nil
+        when 'strict-origin'                   then downgrade ? nil : origin_only.call
+        when 'no-referrer-when-downgrade'      then downgrade ? nil : full.call
+        when 'strict-origin-when-cross-origin' then same_origin ? full.call : (downgrade ? nil : origin_only.call)
+        end
+      end
+
+      # Parse a referrer URL, memoising the last one (the referrer is the document URL
+      # for nearly every request, so this caches across the whole page's subresources).
+      def parse_referrer_url(url)
+        return @referrer_parsed if defined?(@referrer_parsed_for) && @referrer_parsed_for == url
+        @referrer_parsed_for = url
+        @referrer_parsed     = (URI.parse(url) rescue nil)
+      end
+
+      # Whether a request to `url_str` must be blocked as a Fetch "bad port". Cheap
+      # pre-gate: only URLs whose authority carries an explicit `:<digit>` are parsed
+      # (the vast majority don't), so the rack_fetch hot path — every asset / xhr /
+      # fetch, cache hits included — skips URI.parse entirely.
+      def bad_port?(url_str)
+        return false unless url_str =~ %r{\A[a-z]+://[^/]*:\d}i
+        port = URI.parse(url_str).port
+        port && BAD_PORTS.include?(port)
+      rescue URI::Error
+        false
+      end
+
       # URLs we won't even try to route through Rack: anything that
       # isn't http(s) (data: / mailto: / about:) plus pseudo-tokens
       # like V8's `<snapshot>` that sourcemap libraries pull out of
       # error stacks and feed straight to `fetch()` / `xhr.open()`.
-      def rack_fetch(method, url, body, headers, redirect_mode, env_extras: nil)
+      def rack_fetch(method, url, body, headers, redirect_mode, cors_mode = nil, credentials: 'same-origin', env_extras: nil, referrer_policy: nil, referrer: nil, cache_mode: 'default', initiator: nil, site_seed: nil, origin_null: false)
+        # NB: a relative fetch/XHR URL is resolved against the document's API base URL
+        # at OPEN time (XHR open() / fetch()), in JS, NOT here — resolving at send time
+        # would wrongly pick up a `<base href>` inserted after open() (open-url-base
+        # -inserted-after-open). So this resolves only against the document URL.
         target = resolve_against_current(url.to_s)
         return nil unless target.is_a?(String) && target.match?(%r{\Ahttps?://}i)
-        method = (method || 'GET').to_s.upcase
+        # Fetch "port blocking" (https://fetch.spec.whatwg.org/#port-blocking): a
+        # request to a blocked port is a network error before any connection —
+        # fetch() rejects with TypeError, a sync XHR throws NetworkError
+        # (request-bad-port). Re-checked per redirect hop below ("HTTP-redirect fetch"
+        # re-runs the block), so a 3xx Location to a bad port is refused too.
+        return nil if bad_port?(target)
+        # CORS enforcement (preflight + Access-Control checks) applies only to cors_mode
+        # 'cors' — sent by XHR and by fetch()'s default mode. fetch() also threads
+        # 'no-cors' / 'same-origin' (mode semantics below), and a form-submission
+        # navigation threads 'navigate'; other callers (sendBeacon, ESM, workers, the
+        # internal asset GET) pass nil → no CORS and no mode semantics. The document's
+        # origin is the request's origin; a different target origin is cross-origin.
+        cors        = cors_mode == 'cors'
+        # The request's origin (document origin) for EVERY fetch mode — Fetch appends an
+        # Origin header to every non-GET/HEAD request regardless of mode (a same-origin or
+        # no-cors POST/PUT still carries it, for the server's CSRF/Origin check). CORS
+        # enforcement itself stays gated on `cors` below; a nil-mode internal caller
+        # (navigation / asset GET) has no origin semantics. An explicit `initiator` (a SW
+        # re-issuing a navigation via `fetch(event.request)`) is the request's origin for
+        # ALL modes — so a passthrough 'navigate'-mode POST still carries its Origin.
+        req_origin  = initiator || (%w[cors no-cors same-origin].include?(cors_mode) ? url_origin(@current_url) : nil)
+        # Fetch request "mode" (fetch threads it; XHR is always 'cors'; a non-fetch/xhr
+        # caller passes nil → no mode semantics, a plain 'basic' response). `no-cors`
+        # filters a cross-origin response to opaque; `same-origin` makes a cross-origin
+        # request a network error. `doc_origin` detects cross-origin for the response
+        # TYPE regardless of whether CORS enforcement (cors) runs; `crossed` latches once
+        # any hop leaves the document origin.
+        no_cors_mode     = cors_mode == 'no-cors'
+        same_origin_mode = cors_mode == 'same-origin'
+        # Only the real fetch request modes carry cross-origin semantics; a 'navigate'
+        # (form submission) or a nil-mode internal caller gets a plain readable response.
+        doc_origin       = %w[cors no-cors same-origin].include?(cors_mode) ? url_origin(@current_url) : nil
+        crossed          = false
+        # Sec-Fetch-Site latches the widest initiator↔hop relationship across the redirect chain
+        # (like the navigation path), computed vs the request's referrer-source origin below. A SW
+        # re-fetch seeds it with the widened site the network hops accumulated BEFORE the SW
+        # intercepted the final hop (a same-site redirect the passthrough must keep reporting).
+        sec_site         = site_seed
+        # A request is "credentialed" (cookies + the credentialed CORS check) only in
+        # `include` mode; `same-origin` (default) and `omit` are uncredentialed for the
+        # CORS check, while the cookie decision below distinguishes all three.
+        with_credentials = credentials == 'include'
+        # Use the method's case AS GIVEN: the JS callers already applied the spec
+        # normalization (XHR open() / Fetch upper-case the known methods, preserving
+        # an unknown method's case — open-method-case-sensitive). Upper-casing here
+        # would clobber a custom method like `xUNIcorn`.
+        method = (method || 'GET').to_s
         redirected = false
         # JS-side base64-encodes Blob/File bodies (raw bytes survive
         # the engine's UTF-8 string boundary that way); decode before
@@ -4242,48 +6146,331 @@ module Capybara
           body = Base64.decode64(body.to_s)
           headers = headers.reject {|k, _| k == 'X-Csim-Body-B64' }
         end
-        MAX_FETCH_REDIRECTS.times do
+        # CHALLENGE credentials for transparent HTTP Basic auth — set by the XHR authentication path
+        # (open() user/password / URL userinfo), NOT a raw setRequestHeader('Authorization'). They are
+        # NOT sent proactively; a 401 "Basic" challenge triggers a single re-send with them (below).
+        # Strip the marker so it never reaches the server.
+        challenge_authz = nil
+        if headers.is_a?(Hash) && (mk = headers.keys.find {|k| k.to_s.casecmp?('x-csim-auth-challenge') })
+          challenge_authz = 'Basic ' + headers[mk].to_s
+          headers = headers.reject {|k, _| k == mk }
+        end
+        # The request's origin starts as the document origin; a cross-origin REDIRECT
+        # taints it to an opaque origin (serialized "null") per Fetch "HTTP-redirect
+        # fetch". `effective_origin` IS that origin — it's what the Origin header
+        # carries and what the CORS check / preflight compare against from that hop on
+        # ('null' once tainted, so the server must then allow 'null' or '*'). A SW re-fetch whose
+        # navigation ALREADY crossed origin via a network redirect starts tainted (origin_null).
+        effective_origin = origin_null ? 'null' : req_origin
+        # Virtual server delay (a handler's `time.sleep`, see wpt_py_handler.py) accumulated across
+        # EVERY sub-request this fetch makes — the CORS preflight AND every redirect hop — since the
+        # `timeout` a client applies spans them all and a redirect/preflight must not reset it
+        # (timeout-multiple-fetches). Reset per fetch; the final response carries the total.
+        @fetch_server_delay_ms = 0
+        # An author conditional (If-None-Match / …) means the caller is doing its own
+        # revalidation, so the UA cache must step aside (computed once — the headers
+        # carrying it survive every redirect hop unchanged).
+        skip_cache = request_has_conditional_headers?(headers)
+        ref_policy = referrer_policy   # may be overridden per hop by a response Referrer-Policy
+        # The referrer is stripped PROGRESSIVELY: each hop applies its (possibly
+        # overridden) policy to the referrer the PREVIOUS hop sent, not to the original
+        # document — so once a hop reduces it to an origin (or drops it), a later, laxer
+        # policy can't widen it back (redirect-referrer-override). The initial source is
+        # the request's referrer: an explicit `init.referrer` URL when given, else the
+        # document URL ("client"); an empty referrer means no-referrer (compute_referrer
+        # maps a blank source to nil).
+        ref_source = referrer.nil? ? @current_url : referrer
+        # The request's INITIATOR origin for Sec-Fetch-Site — captured ONCE (loop-invariant), before
+        # the per-hop referrer reassignment (5927 below) degrades ref_source, and independent of
+        # Referrer-Policy: the initiator is the referrer's origin (a SW's `fetch(event.request)`
+        # carries the navigating frame's origin here, so a cross-origin passthrough is same-/cross-site
+        # correctly), falling back to the document origin when the referrer was policy-emptied — never
+        # 'none' for a request that has a real initiator. An explicit `initiator` is authoritative:
+        # it survives the referrer reset a `new Request(event.request, init)` performs (referrer →
+        # about:client), so a SW's change-request re-fetch is same-origin to the SW's own script.
+        sec_initiator = initiator || url_origin(ref_source) || url_origin(@current_url)
+        (MAX_FETCH_REDIRECTS + 1).times do
           t0 = @trace && Process.clock_gettime(Process::CLOCK_MONOTONIC)
-          # GET-only cache shortcut (RFC 9111). Fresh hit → skip @app.call
-          # entirely; stale-but-revalidatable → fall through with conditional
-          # headers added so the server can return 304.
-          cache_entry = method == 'GET' ? @@asset_cache.lookup(target) : nil
-          if cache_entry&.fresh?
-            # Cached static asset — log headers/type/size but skip the (boring) body.
+          # Cross-origin-ness for the request mode/type, latched across hops. Computed
+          # BEFORE the cache so a cross-origin request never takes the cache fast path
+          # (which would bypass the opaque filter / same-origin-mode error / cors type).
+          crossed ||= !!(doc_origin && (effective_origin == 'null' || url_origin(target) != doc_origin))
+          return nil if same_origin_mode && crossed   # 'same-origin' mode forbids a cross-origin hop
+          # HTTP cache (RFC 9111 + Fetch "HTTP-network-or-cache fetch"), gated by the request's
+          # cache MODE. GET-only, same-origin (a cross-origin hop always redispatches so the mode
+          # filtering below runs), and stepped aside when the author sent their own conditional.
+          #   - no-store / reload    : never read the store — always hit the network, no conditional
+          #   - force-cache / only-if-cached : serve a stored response even when STALE, no revalidation
+          #                                    (only-if-cached with nothing stored is a network error)
+          #   - no-cache             : always revalidate, even a fresh entry
+          #   - default              : serve fresh; revalidate stale (fall through with conditionals)
+          read_cache  = method == 'GET' && !skip_cache && !crossed && !CACHE_MODES_SKIP_READ.include?(cache_mode)
+          cache_entry = read_cache ? @@asset_cache.lookup(target) : nil
+          serve_stored = cache_entry &&
+            (CACHE_MODES_SERVE_STALE.include?(cache_mode) || (cache_entry.fresh? && cache_mode != 'no-cache'))
+          if serve_stored
+            if REDIRECT_STATUSES.include?(cache_entry.status.to_i)
+              # A cached REDIRECT obeys the redirect mode exactly like a fresh one: `error` is a
+              # network error, `manual` is an opaque-redirect, and `follow` follows it THROUGH
+              # the cache — resolve the Location and continue so the next hop serves the cached
+              # target (request-cache "uses cached … redirects"). only-if-cached / force-cache
+              # reach this only same-origin GET (read_cache excludes cross-origin), so there's no
+              # method rewrite / origin taint.
+              raise StandardError, '[capybara-simulated] fetch: redirect blocked by redirect=error mode' if redirect_mode == 'error'
+              if redirect_mode != 'follow'
+                return response_hash(0, {}, '', target, false, type: 'opaqueredirect', body_null: true)
+              end
+              if (loc = redirect_location(cache_entry.status, cache_entry.headers))
+                trace_network(method, target, cache_entry.status, headers, body, cache_entry.headers, nil, t0, true)
+                redirected = true
+                next_url   = resolve_against(loc, target)
+                return nil unless next_url.to_s.match?(%r{\Ahttps?://}i)
+                target = carry_fragment(target, next_url)
+                return nil if bad_port?(target)   # a cached redirect to a blocked port is still a network error
+                next
+              end
+            end
+            # Cached asset — log headers/type/size but skip the (boring) body.
             trace_network(method, target, cache_entry.status, headers, body, cache_entry.headers, nil, t0, false)
             return response_hash(cache_entry.status, cache_entry.headers, cache_entry.body, target, redirected)
           end
+          # only-if-cached forbids the network: no usable stored response → a network error.
+          return nil if cache_mode == 'only-if-cached'
 
           env = Rack::MockRequest.env_for(target, method: method, input: body || '')
+          env['REQUEST_METHOD'] = method   # env_for upcases the method; restore the exact case (open-method-case-sensitive)
+          # env_for always sets Content-Length to the input bytesize (0 for an empty body).
+          # Fetch adds Content-Length: 0 for a bodyless request ONLY when the method is
+          # POST or PUT; GET/HEAD and every other method (incl. a custom one like `Chicken`)
+          # send no Content-Length when the body is empty (send-entity-body-none;
+          # request-headers custom-method). A non-empty body keeps its real length.
+          env.delete('CONTENT_LENGTH') if body.to_s.empty? && !%w[POST PUT].include?(method.to_s.upcase)
           apply_request_headers(env, headers) if headers
           apply_request_headers(env, @@asset_cache.revalidation_headers(cache_entry)) if cache_entry
-          apply_default_request_env(env, referer: @current_url, force: false)
+          # The Referer follows the request's Referrer-Policy (a redirect response can
+          # override the policy for the next hop — see below). `hop_referer` also becomes
+          # the source the NEXT hop strips from.
+          hop_referer = compute_referrer(ref_policy, ref_source, target)
+          apply_default_request_env(env, referer: hop_referer, force: false)
+          # Whether this hop is cross-origin (cors only): a tainted (opaque) origin is
+          # cross-origin to every real target; otherwise compare the target to the
+          # document origin. Drives the Origin header, preflight, and the CORS check.
+          cross_origin = cors && (effective_origin == 'null' || url_origin(target) != req_origin)
+          # Fetch credentials mode decides cookie attachment, independent of the CORS
+          # mode: `omit` never sends them; `include` always does; `same-origin` (default)
+          # sends them only to a same-origin target — so an uncredentialed cross-origin
+          # hop (cors OR no-cors) must not leak the document's cookies
+          # (cors-redirect-credentials / cors-cookies). A navigation / internal caller has
+          # no doc_origin, so it counts as same-origin and keeps them.
+          hop_cross_origin = !!(doc_origin && (effective_origin == 'null' || url_origin(target) != doc_origin))
+          send_cookies     = credentials == 'include' || (credentials != 'omit' && !hop_cross_origin)
+          env.delete('HTTP_COOKIE') unless send_cookies
+          # HTTP auth caching (RFC 7617 §2.2): once credentials succeed for an origin (cached below),
+          # the UA sends them pre-emptively for later credentialed requests to it — so a Basic-auth
+          # resource loads without a fresh 401 challenge (the login helper authenticates first, then
+          # the guarded image/XHR requests carry the cached header). Gated on the same credential
+          # decision as cookies; the caller's own Authorization (an explicit user:pass) always wins.
+          # Skip the pre-emptive cache when THIS request brought its own challenge credentials (open()
+          # user/pass) — those must win over a cached session, so the request goes out unauthenticated
+          # and the 401-retry below applies the caller's credentials, not a stale cached pair
+          # (send-authentication-competing-names-passwords).
+          if send_cookies && !env.key?('HTTP_AUTHORIZATION') && !challenge_authz && (cached = @auth_cache[url_origin(target)])
+            env['HTTP_AUTHORIZATION'] = cached
+          end
+          # A CORS request to a URL carrying credentials (`user:pass@`) is a network
+          # error (access-control-and-redirects "user info" subtest).
+          return nil if cross_origin && url_has_userinfo?(target)
+          # CORS-preflight, re-evaluated PER HOP: a cross-origin non-simple request (a
+          # non-safelisted method / header / Content-Type) must pass an OPTIONS preflight
+          # first — so a same-origin request redirected cross-origin to an unsafe resource
+          # is preflighted on the NEW origin (send-redirect-to-cors), not just an initially
+          # cross-origin one (access-control-basic-get-fail-non-simple / preflight-*).
+          if cross_origin && cors_unsafe_request?(method, headers)
+            return nil unless cors_preflight_ok?(target, method, headers, effective_origin, with_credentials, hop_referer)
+          end
+          # Send the (effective) Origin — the UA owns this header — on a cors request when
+          # the hop is cross-origin OR the method is not GET/HEAD (Fetch appends Origin to
+          # every non-GET/HEAD request, so a same-origin POST carries it too). After a
+          # cross-origin redirect the origin is the opaque "null".
+          if cross_origin || (req_origin && !%w[GET HEAD].include?(method.to_s.upcase))
+            env['HTTP_ORIGIN'] = effective_origin
+          end
+          # Fetch-Metadata request headers — emitted for every fetch/XHR/SW request (a mode is set;
+          # the nil-mode internal callers — ESM / asset GET / beacon — are left alone). Sec-Fetch-Site
+          # widens across the redirect chain vs the loop-invariant `sec_initiator` (see above). -Mode
+          # is the request mode (a SW's `fetch(event.request)` re-issues a 'navigate'-mode request,
+          # `new Request(…,{mode})` a 'same-origin' one); -Dest is 'empty' for a script-initiated fetch
+          # — the only navigate-mode path here (a navigation emits its own 'iframe'/'document' dest +
+          # -User via navigation_request_headers, never reaching rack_fetch).
+          if cors_mode
+            sec_site = widen_sec_fetch_site(sec_site, sec_fetch_site(sec_initiator, target))
+            env['HTTP_SEC_FETCH_SITE'] = sec_site
+            env['HTTP_SEC_FETCH_MODE'] = cors_mode
+            env['HTTP_SEC_FETCH_DEST'] = 'empty'
+          end
           env.merge!(env_extras) if env_extras
           status, resp_headers, resp_body = dispatch_rack_or_http(target, env, method: method, body: body)
-          merge_set_cookie(resp_headers)
+          @fetch_server_delay_ms += server_delay_ms_of(resp_headers)
+          # Transparent HTTP Basic auth (RFC 7617): a request carrying CHALLENGE credentials (open()
+          # user/pass / URL userinfo) that gets a 401 "Basic" challenge — and hasn't already sent an
+          # Authorization (an explicit setRequestHeader / a pre-emptively-attached cached credential) —
+          # is re-sent ONCE with them; only the authenticated response reaches script, the 401 never does
+          # (send-authentication-basic / -existing-session). `omit` sends no credentials at all.
+          if challenge_authz && status.to_i == 401 && credentials != 'omit' &&
+             !env.key?('HTTP_AUTHORIZATION') && www_authenticate_basic?(resp_headers)
+            resp_body.close if resp_body.respond_to?(:close)
+            env['HTTP_AUTHORIZATION'] = challenge_authz
+            status, resp_headers, resp_body = dispatch_rack_or_http(target, env, method: method, body: body)
+          end
+          # Fetch credentials mode "omit" ignores credentials the response sends back too —
+          # its Set-Cookie is dropped, not stored (cors-cookies / credentials "omit mode").
+          merge_set_cookie(resp_headers, target) unless credentials == 'omit'
+          # Cache the credentials this origin ACCEPTED (AUTHENTICATION credentials — a pre-emptively
+          # attached cached credential, or the challenge credential the 401-retry above just supplied —
+          # that weren't rejected with a 401), for the pre-emptive send above. `omit` neither sends nor
+          # caches. Only the request's OWN origin is cached: Authorization is stripped on a cross-origin
+          # redirect hop (above), so origin A's credentials can't seed origin B's cache. (A non-2xx
+          # same-origin response — an opaque status-0 no-cors fetch, a same-origin 3xx — still
+          # establishes the credentials for THAT origin, so the gate is "not a 401", not "is a 2xx".)
+          if challenge_authz && credentials != 'omit' && status.to_i != 401
+            @auth_cache[url_origin(target)] = env['HTTP_AUTHORIZATION'] || challenge_authz
+          end
           if status == 304 && cache_entry
             trace_network(method, target, cache_entry.status, headers, body, cache_entry.headers, nil, t0, false)
             resp_body.close if resp_body.respond_to?(:close)
             @@asset_cache.refresh(cache_entry, resp_headers)
-            return response_hash(cache_entry.status, cache_entry.headers, cache_entry.body, target, redirected)
+            # The cache stores the RAW response headers, so a cross-origin cached entry must
+            # be re-filtered through the CORS exposed-header set on the way back to script —
+            # a 304 revalidation must not leak headers the original cross-origin fetch hid.
+            cached_headers = cross_origin ? cors_exposed_headers(cache_entry.headers, with_credentials) : cache_entry.headers
+            return response_hash(cache_entry.status, cached_headers, cache_entry.body, target, redirected)
+          end
+          # Fetch "CORS check" runs on EVERY cross-origin response — including a 3xx the
+          # UA is about to follow (a redirect whose response lacks a valid Access-Control
+          # -Allow-Origin is itself a network error: access-control-and-redirects). A
+          # credentialed request additionally forbids `*` and needs Allow-Credentials.
+          if cross_origin && !cors_response_ok?(resp_headers, effective_origin, with_credentials)
+            resp_body.close if resp_body.respond_to?(:close)
+            return nil
           end
-          if redirect_mode != 'manual' && (loc = redirect_location(status, resp_headers))
+          # A redirect-status response in a NON-follow mode is handled without following,
+          # keyed on the status ALONE (the Location is never parsed): `error` is a network
+          # error; `manual` is an opaque-redirect filtered response (status 0, empty
+          # statusText/headers, the ORIGINAL request URL, type 'opaqueredirect'). The CORS
+          # check above runs first, so a cross-origin redirect that fails CORS is a network
+          # error either way (redirect-mode / -location).
+          if redirect_mode != 'follow' && REDIRECT_STATUSES.include?(status.to_i)
+            resp_body.close if resp_body.respond_to?(:close)
             raise StandardError, '[capybara-simulated] fetch: redirect blocked by redirect=error mode' if redirect_mode == 'error'
+            # A no-cors request may not even opaquely expose a CROSS-origin redirect — a
+            # no-cors non-follow redirect to a cross-origin target is a network error,
+            # while a same-origin one still yields an opaque-redirect.
+            return nil if no_cors_mode && crossed
+            return response_hash(0, {}, '', target, false, type: 'opaqueredirect', body_null: true)
+          end
+          if (loc = redirect_location(status, resp_headers))
             # Log this hop (3xx) before method/body are rewritten for the next.
             trace_network(method, target, status, headers, body, resp_headers, nil, t0, true)
+            # Cache the redirect itself (a cacheable 3xx with freshness) BEFORE following it —
+            # the follow does `next`, which would otherwise skip the store below — so a later
+            # only-if-cached / force-cache request can follow the redirect chain from the cache
+            # (request-cache "uses cached … redirects"). Same store gate as the terminal hop.
+            @@asset_cache.store(target, status, resp_headers, '') if method == 'GET' && cache_mode != 'no-store' && !skip_cache
             redirected = true
-            preserve = [307, 308].include?(status)
+            ref_source = hop_referer   # the next hop strips from what THIS hop sent
+            # A redirect response's Referrer-Policy overrides the policy for the next hop
+            # (redirect-referrer-override): the last valid token of the header wins.
+            if (rp = resp_headers['referrer-policy'] || resp_headers['Referrer-Policy'])
+              tok = Array(rp).join(',').split(',').map(&:strip).reverse.find {|t| REFERRER_POLICIES.include?(t) }
+              ref_policy = tok if tok
+            end
             next_url = resolve_against(loc, target)
+            # The UA only follows http(s) redirects: a Location that resolves to a
+            # non-HTTP(S) URL (data:, an `invalidurl:` scheme, …) is a network error
+            # (redirect-location data/invalid in follow mode).
+            unless next_url.to_s.match?(%r{\Ahttps?://}i)
+              resp_body.close if resp_body.respond_to?(:close)
+              return nil
+            end
+            # A cross-origin redirect taints the request's origin to opaque ("null") only
+            # once the request was ALREADY cross-origin (response tainting "cors", i.e.
+            # `crossed`) and the hop changes origin — so a subsequent hop sends Origin: null
+            # and the CORS check demands the server allow "null"/"*". The FIRST cross-origin
+            # hop out of a same-origin request keeps the real origin (redirect-origin
+            # "same origin to other origin" sends the document origin, not null).
+            effective_origin = 'null' if cors && crossed && url_origin(next_url) != url_origin(target)
+            # Fetch "HTTP-redirect fetch": a CROSS-ORIGIN redirect strips the request's
+            # `Authorization` — credentials sent to the first origin must not be replayed to a
+            # different one (nor seed that origin's auth cache below).
+            if url_origin(next_url) != url_origin(target) && headers.is_a?(Hash)
+              headers = headers.reject {|k, _| k.to_s.casecmp?('authorization') }
+            end
             target = carry_fragment(target, next_url)
-            method = 'GET' unless preserve
-            body = nil unless preserve
+            if bad_port?(target)   # a redirect to a blocked port is a network error too
+              resp_body.close if resp_body.respond_to?(:close)
+              return nil
+            end
+            # Fetch "HTTP-redirect fetch": the method changes to GET (dropping the
+            # body + its Content-* headers) ONLY for 301/302 of a POST, or 303 of a
+            # non-GET/HEAD. Otherwise method, body, and headers are preserved — so a
+            # GET/HEAD redirected via 301/302/303 keeps its method and Content-Type,
+            # and 307/308 always preserve (xhr send-redirect basics).
+            up = method.to_s.upcase
+            if ([301, 302].include?(status) && up == 'POST') || (status == 303 && !%w[GET HEAD].include?(up))
+              method  = 'GET'
+              body    = nil
+              headers = headers.reject {|k, _| REDIRECT_DROPPED_HEADERS.include?(k.to_s.downcase) } if headers.is_a?(Hash)
+            end
             resp_body.close if resp_body.respond_to?(:close)
             next
           end
+          # A follow-mode redirect whose Location header IS present but EMPTY parses to the
+          # request URL — a self-redirect that would loop until the redirect limit trips a
+          # network error. redirect_location returns nil for it (empty ⇒ no followable
+          # target, so navigation keeps rendering the 3xx), so recognize it here and fail
+          # directly — fetch-only (redirect-empty-location follow mode).
+          if REDIRECT_STATUSES.include?(status.to_i)
+            raw_loc = resp_headers['location'] || resp_headers['Location']
+            raw_loc = raw_loc.first if raw_loc.is_a?(Array)
+            if raw_loc && raw_loc.to_s.empty?
+              resp_body.close if resp_body.respond_to?(:close)
+              return nil
+            end
+          end
           body_str = read_rack_body(resp_body)
+          # A HEAD response, and a null-body status (204/205/304), have NO body — the UA
+          # discards whatever the server sent and exposes response.body as null
+          # (response-method HEAD; response-null-body). `null_body` flags it so the JS
+          # Response reports a null body + empty text.
+          null_body = method.to_s.upcase == 'HEAD' || NULL_BODY_STATUSES.include?(status.to_i)
+          body_str = '' if null_body
+          # The UA transparently decodes a Content-Encoding'd body (gzip/deflate); the
+          # header stays, the bytes are inflated (response-data-gzip / -deflate).
+          body_str = decode_content_encoding(body_str, resp_headers)
+          # A cross-origin response only EXPOSES (getResponseHeader / getAllResponseHeaders)
+          # the CORS-safelisted response headers plus those named in Access-Control-Expose
+          # -Headers (`*` = all). content-type stays safelisted, so response decoding is
+          # unaffected. (Filtered for script exposure only — trace / set-cookie / cache see
+          # the full set.) The CORS check itself already ran above (incl. on 3xx hops).
+          # The virtual server delay is EPHEMERAL processing time (accumulated across the preflight +
+          # every redirect hop): the client reads the TOTAL to time its async deferral, but it must
+          # never be cached or replayed on a cache hit — strip it from the traced/stored response and
+          # expose the total to the CLIENT only (added after CORS filtering, so it always survives).
+          total_delay      = @fetch_server_delay_ms.to_i
+          resp_headers      = resp_headers.reject {|k, _| k.to_s.casecmp?('x-csim-server-delay-ms') }
+          exposed_headers   = cross_origin ? cors_exposed_headers(resp_headers, with_credentials) : resp_headers
+          exposed_headers   = exposed_headers.merge('X-Csim-Server-Delay-Ms' => total_delay.to_s) if total_delay > 0
           trace_network(method, target, status, headers, body, resp_headers, body_str, t0, false)
-          @@asset_cache.store(target, status, resp_headers, body_str) if method == 'GET'
-          return response_hash(status, resp_headers, body_str, target, redirected)
+          # A no-store request must not write the cache (RFC 9111 §5.2.1.5); a request carrying
+          # the author's own conditional bypasses the UA cache entirely (read AND write) — it's
+          # "treated similarly to no-store" (request-cache-default-conditional). Every other mode
+          # (incl. reload, which refreshes it) stores a cacheable GET response.
+          @@asset_cache.store(target, status, resp_headers, body_str) if method == 'GET' && cache_mode != 'no-store' && !skip_cache
+          # A no-cors cross-origin response is OPAQUE: status 0, empty body, no exposed
+          # headers, empty URL (cors-basic "Opaque filter"). Otherwise the type is 'cors'
+          # for a cross-origin (CORS-allowed) response, else 'basic'.
+          return response_hash(0, {}, '', '', false, type: 'opaque', body_null: true, opaque_render: body_str) if no_cors_mode && crossed
+          return response_hash(status, exposed_headers, body_str, target, redirected, type: crossed ? 'cors' : 'basic', body_null: null_body)
         end
         raise StandardError, "[capybara-simulated] fetch exceeded #{MAX_FETCH_REDIRECTS} redirects"
       rescue StandardError => e
@@ -4304,7 +6491,7 @@ module Capybara
         return unless @trace
         ct = resp_headers && (resp_headers['content-type'] || resp_headers['Content-Type'])
         ct = ct.first if ct.is_a?(Array)  # Rack 3 permits array-valued header fields
-        ct = ct.split(';', 2).first.strip if ct.is_a?(String)
+        ct = ct.split(';', 2).first&.strip if ct.is_a?(String)   # "" → split is [] → first is nil
         size = if resp_body
                  resp_body.bytesize
                elsif (cl = resp_headers && (resp_headers['content-length'] || resp_headers['Content-Length']))
@@ -4345,7 +6532,13 @@ module Capybara
 
       def normalize_trace_headers(headers)
         return nil unless headers
-        headers.each_with_object({}) {|(k, v), out| out[k.to_s] = v.is_a?(Array) ? v.join(', ') : v.to_s }
+        headers.each_with_object({}) do |(k, v), out|
+          # `x-csim-status-text` is an internal sentinel carrying the HTTP reason
+          # phrase (response_hash lifts it into statusText); it's never a real wire
+          # header, so keep it out of the trace.
+          next if k.to_s.downcase == 'x-csim-status-text'
+          out[k.to_s] = v.is_a?(Array) ? v.join(', ') : v.to_s
+        end
       end
 
       # CGI convention: `Content-Type` and `Content-Length` land in env
@@ -4356,7 +6549,14 @@ module Capybara
       # `@rails/request.js` never deserialise and the server reads an
       # empty params hash.
       def apply_request_headers(env, headers)
+        # Preserve the author's exact header names (casing + token chars) alongside the
+        # CGI-mangled HTTP_* keys: the Rack env upcases names and drops non-alphanumerics
+        # (Status-URI → HTTP_STATUS_URI, a tchar-only name → an unrecoverable key), but a
+        # .py echo handler (inspect-headers / echo-headers) reports the names verbatim.
+        # run_py_handler reads this side list to emit the original names.
+        raw = (env['csim.raw_request_headers'] ||= []) if @@capture_raw_request_headers
         headers.each {|k, v|
+          raw << [k.to_s, v.to_s] if raw
           name = k.to_s.upcase.tr('-', '_')
           case name
           when 'CONTENT_TYPE', 'CONTENT_LENGTH' then env[name] = v.to_s
@@ -4375,9 +6575,13 @@ module Capybara
       # text body when `body_b64` is absent.
       TEXT_CONTENT_TYPE_PREFIXES = %w[text/ application/json application/javascript application/ecmascript application/xml image/svg+xml].freeze
 
-      def response_hash(status, headers, body, url, redirected)
+      def response_hash(status, headers, body, url, redirected, type: 'basic', body_null: false, opaque_render: nil)
         raw     = body.to_s
         hdrs    = stringify(headers)
+        # A NUL in a header value is not a valid HTTP message; a real server can't
+        # put it on the wire, so the fetch is a network error (nil → status 0 / a
+        # thrown NetworkError for a sync XHR). See headers-normalize-response.
+        return nil if hdrs.any? {|_, v| v.include?("\u0000") }
         is_text = text_response?(hdrs)
         # `body` crosses as TEXT — `responseText` semantics: the bytes decoded
         # as UTF-8 with invalid sequences replaced (a leading BOM selects the
@@ -4392,18 +6596,52 @@ module Capybara
           else
             RuntimeShared.utf8_text(raw)
           end
+        # statusText = the HTTP reason phrase: a custom one carried on the internal
+        # x-csim-status-text header (status.py), else the status code's standard
+        # reason (xhr status/statusText tests). Strip the internal header either way.
+        custom_reason = hdrs.delete('x-csim-status-text')
+        # Rack::Utils::HTTP_STATUS_CODES values are ASCII-8BIT (binary) strings — the V8
+        # bridge marshals a binary string as a byte array, not a JS string, so statusText
+        # would arrive as [79,75] instead of "OK" (abort-during-loading reads statusText
+        # on a static-file response). utf8_text re-tags + scrubs to a clean JS string, the
+        # same path the body and every header value already take.
+        reason = RuntimeShared.utf8_text(custom_reason || Rack::Utils::HTTP_STATUS_CODES[status.to_i] || '')
+        # HTTP/2 has no reason phrase, so statusText is always the empty string there (a WPT
+        # `.h2` test document's fetches run over h2). We don't model the h2 transport, so key
+        # off the document URL — the same signal WPT uses to serve the resource over h2
+        # (fetch/xhr status.h2 "statusText over H2 … should be the empty string").
+        reason = '' if @current_url.to_s.include?('.h2.')
         out = {
           'status'     => status,
+          'statusText' => reason,
           'headers'    => hdrs,
           'body'       => text,
           'url'        => url,
           'redirected' => redirected,
-          'type'       => 'basic'
+          'type'       => type
         }
+        out['body_null'] = true if body_null   # null-body status / HEAD → response.body is null
         # The BOM-detected encoding (if any) — a frame load pins its document's
         # characterSet to it (see __csimFrameWindow); highest-precedence signal.
         out['charset']  = bom_charset if bom_charset
-        out['body_b64'] = Base64.strict_encode64(raw) unless is_text
+        # Hand the raw bytes to the (XHR) client UNLESS the response is pure-ASCII text.
+        # ASCII decodes identically under every encoding — so responseText is already
+        # correct from the UTF-8 `body`, and it round-trips byte-for-byte as an
+        # ArrayBuffer/Blob. Any NON-ASCII body needs the bytes: a non-UTF-8 charset or an
+        # XML-prolog / <meta charset>-sniffed encoding (responseText), or multibyte UTF-8
+        # read as arraybuffer/blob — the client decodes them with the final encoding
+        # (decodeResponseBytes). `ascii_only?` is a cheap C-level scan, so the dominant
+        # pure-ASCII app JSON/HTML traffic keeps the fast path and pays no base64.
+        out['body_b64'] = Base64.strict_encode64(raw) unless is_text && raw.ascii_only?
+        # An OPAQUE (no-cors cross-origin) response hides its body from every script-visible read
+        # (body/body_b64 are empty). But the bytes are still needed to RENDER an <img> the response
+        # backs (a cross-origin image displays, merely canvas-tainting) — carry them on a private
+        # side channel the image decode path reads, never a public body accessor. Attached to EVERY
+        # opaque response, not just image requests: this is `rack_fetch`, which has no request
+        # destination (a SW's own no-cors `fetch()` doesn't know its eventual consumer is an <img>),
+        # so the choice is made client-side. The bytes are already in memory (`body_str`); the added
+        # cost is one base64 per opaque response, off any hot path.
+        out['opaque_render_b64'] = Base64.strict_encode64(opaque_render) if opaque_render && !opaque_render.empty?
         out
       end
 
@@ -4479,6 +6717,34 @@ module Capybara
         buf
       end
 
+      # Transparently decode a Content-Encoding'd response body (HTTP "content coding"):
+      # gzip / x-gzip via Zlib.gunzip; deflate via zlib-wrapped inflate, falling back to
+      # raw DEFLATE (the "deflate" coding is ambiguously used for both). Unknown codings
+      # (e.g. br) and malformed data are left untouched — best-effort, like a browser that
+      # would error, but we keep the bytes so the caller still sees a response.
+      def decode_content_encoding(body, headers)
+        return body if body.nil? || body.empty?
+        raw = headers.find {|k, _| k.to_s.downcase == 'content-encoding' }&.last
+        enc = (raw.is_a?(Array) ? raw.join(',') : raw.to_s).strip.downcase   # Rack 3 may hand the value as an array
+        # The decoded bytes re-enter the UTF-8 text pipeline the same as an
+        # un-encoded body (read_rack_body yields UTF-8), so re-tag them — Zlib
+        # output is ASCII-8BIT, which would otherwise marshal to V8 as a byte array.
+        decoded =
+          case enc
+          when 'gzip', 'x-gzip' then Zlib.gunzip(body.b)
+          when 'deflate'
+            begin
+              Zlib::Inflate.inflate(body.b)
+            rescue Zlib::Error
+              Zlib::Inflate.new(-Zlib::MAX_WBITS).inflate(body.b)   # raw (header-less) DEFLATE
+            end
+          else return body
+          end
+        decoded.force_encoding('UTF-8')
+      rescue Zlib::Error
+        body
+      end
+
       # Defer the navigation: doing it from inside the running V8 call
       # would dispose the Context mid-call. tick_real_time drains
       # after the call returns. Same pattern as `__csimPendingFormSubmit`.
@@ -4537,6 +6803,14 @@ module Capybara
           entry = @frame_stack.find {|e| e[:realm_id] == realm_id }
           if entry
             navigate_frame(url, entry: entry)
+          elsif url.match?(%r{\Ahttps?://}i)
+            # An absolute http(s) self-nav (`self.location = …` / link click) is fetched Ruby-side so
+            # it carries correct navigation request headers (Referer under policy / Sec-Fetch);
+            # non-http(s) and relative URLs stay on the JS src-reassignment path via
+            # navigate_realm_self_get. `record: false` — a location/link frame nav isn't history-
+            # recorded yet (that's a form-submission-only path), and must not push where a
+            # location.replace should overwrite.
+            navigate_realm_self_get(realm_id, url, record: false)
           else
             @runtime.call('__csimNavigateFrameByRealm', realm_id, url)
           end
@@ -4619,8 +6893,19 @@ module Capybara
           # JS-side, reusing the retained content so blob bytes survive a revoke.
           entry = @frame_stack.find {|e| e[:realm_id] == realm_id }
           url   = entry && @runtime.frame_realm_alive?(realm_id) ? @runtime.realm_call(realm_id, '__csimLocationHref').to_s : ''
+          cur   = current_frame_history_entry(realm_id)
           if entry && !url.empty?
             navigate_frame(url, entry: entry)
+          elsif cur && cur[:method] == 'POST'
+            # Reloading a document reached by POST re-POSTS it (isReloadNavigation) with the recorded
+            # body, rather than the JS reload path's GET refetch of the frame's src.
+            navigate_realm_self_post(realm_id, cur[:url], cur[:body], cur[:content_type], is_reload: true)
+          elsif cur && cur[:url].to_s.match?(%r{\Ahttps?://}i)
+            # Reload the CURRENT history entry (isReloadNavigation), not the frame's `src`: after a
+            # back/forward the src is stale, so `history.go(0)` / `location.reload()` must refetch the
+            # entry's URL. (A blob:/data:/srcdoc frame keeps the JS reload path — it reuses retained
+            # bytes a URL refetch can't reproduce.)
+            reload_frame_to_entry(realm_id, cur, is_reload: true, is_history: false)
           else
             @runtime.call('__csimReloadFrameByRealm', realm_id)
           end
@@ -4687,8 +6972,9 @@ module Capybara
         return if h.nil?
         target = h[:idx] + delta
         return if target.negative? || target >= h[:entries].size
-        # Snapshot the entry we're leaving so a later forward traversal restores it.
-        h[:entries][h[:idx]] = frame_history_entry(realm_id) if h[:idx] >= 0
+        # Snapshot the entry we're leaving so a later forward traversal restores it (keeping how it
+        # was reached, so a POST entry re-POSTs when traversed back to).
+        h[:entries][h[:idx]] = snapshot_outgoing_entry(realm_id, h[:entries][h[:idx]]) if h[:idx] >= 0
         reload_frame_to_entry(realm_id, h[:entries][target])
         h[:idx] = target   # advance only after the rebuild succeeds
       end
@@ -4698,52 +6984,110 @@ module Capybara
       # into the frame form-submission paths; frame navigations driven by
       # `location.href` / link clicks aren't recorded yet (history.back there falls
       # through to the top document, as before).
-      def record_frame_nav(realm_id, new_url)
+      # `post` (a {body, content_type}) records that this entry was reached by a POST submission,
+      # so a later reload / history traversal re-POSTs it (with the body) rather than GET-ing the URL.
+      def record_frame_nav(realm_id, new_url, post: nil)
         return if realm_id.nil? || realm_id.zero?
         parent = @runtime.frame_realm_parent(realm_id)
         handle = frame_container_handle(realm_id, parent)
         return if handle.zero?
         h = (@frame_histories ||= {})[[parent, handle]] ||= {entries: [], idx: -1}
-        outgoing = frame_history_entry(realm_id)
         if h[:idx] >= 0
-          h[:entries][h[:idx]] = outgoing
+          h[:entries][h[:idx]] = snapshot_outgoing_entry(realm_id, h[:entries][h[:idx]])
         else
-          h[:entries] << outgoing
+          h[:entries] << frame_history_entry(realm_id)
           h[:idx] = 0
         end
         h[:entries] = h[:entries][0..h[:idx]]
-        h[:entries] << {url: new_url.to_s, form_state: nil}
+        entry = {url: new_url.to_s, form_state: nil}
+        entry.merge!(method: 'POST', body: post[:body], content_type: post[:content_type]) if post
+        h[:entries] << entry
         h[:idx] = h[:entries].size - 1
       end
+      # The frame's CURRENT history entry (the loaded document), or nil — read by a reload to decide
+      # whether to re-POST.
+      def current_frame_history_entry(realm_id)
+        parent = @runtime.frame_realm_parent(realm_id)
+        handle = frame_container_handle(realm_id, parent)
+        return nil if handle.zero?
+        h = (@frame_histories || {})[[parent, handle]]
+        h && h[:idx] >= 0 ? h[:entries][h[:idx]] : nil
+      end
       # The history entry for the document currently loaded in `realm_id`: its URL
       # plus a snapshot of its form-control state.
       def frame_history_entry(realm_id)
         {url: frame_realm_url(realm_id), form_state: capture_frame_form_state(realm_id)}
       end
+      # Refresh the outgoing entry's url + form-state snapshot while PRESERVING how it was reached
+      # (a POST entry's method / body / content_type) — leaving a document doesn't change the request
+      # that loaded it, so a later traversal back re-POSTs rather than GET-ing.
+      def snapshot_outgoing_entry(realm_id, prev)
+        snap = frame_history_entry(realm_id)
+        prev ? prev.merge(snap) : snap
+      end
       def frame_realm_url(realm_id)
         return nil unless @runtime.frame_realm_alive?(realm_id)
         @runtime.realm_call(realm_id, '__csimLocationHref').to_s
       rescue StandardError
         nil
       end
+      # A frame document's referrer policy (its last valid `<meta name="referrer">`), read from
+      # the live realm to compute a self-navigation's Referer under the initiating document's
+      # policy. '' when the realm is gone / has no meta → the platform default applies.
+      def frame_document_referrer_policy(realm_id)
+        return '' unless @runtime.frame_realm_alive?(realm_id)
+        @runtime.realm_call(realm_id, '__csimDocumentReferrerPolicy').to_s
+      rescue StandardError
+        ''
+      end
       def capture_frame_form_state(realm_id)
         return nil unless @runtime.frame_realm_alive?(realm_id)
         @runtime.realm_call(realm_id, '__csimCaptureFormState')
       rescue StandardError
         nil
       end
-      # Re-fetch a history entry's URL and rebuild the frame realm from it, then
-      # restore the entry's captured form state (before the element load fires).
-      def reload_frame_to_entry(realm_id, entry)
+      # Re-fetch a history entry's URL and rebuild the frame realm from it, then restore the entry's
+      # captured form state (before the element load fires). Used for a history traversal
+      # (isHistoryNavigation) AND for a reload of the current entry (isReloadNavigation — e.g.
+      # `history.go(0)` / `location.reload()` after a back/forward, where the frame's `src` is stale
+      # and only the current entry names the right URL).
+      def reload_frame_to_entry(realm_id, entry, is_reload: false, is_history: true)
         url = entry[:url].to_s
         return if url.empty?
-        env = Rack::MockRequest.env_for(url, method: 'GET')
+        # An entry reached by a POST submission re-POSTS (with the recorded body); a normal entry
+        # re-GETs. The method drives both the SW fetch event and the network fallback.
+        is_post   = entry[:method] == 'POST'
+        body      = entry[:body].to_s
+        post_args = is_post ? {method: 'POST', body_b64: Base64.strict_encode64(body), content_type: entry[:content_type]} : {}
+        # A history TRAVERSAL restores the entry's persisted form state (bfcache); a RELOAD gives a
+        # fresh document, so it must NOT restore the (possibly stale) snapshot the entry was left with.
+        restore = is_reload ? nil : entry[:form_state]
+        # A traversal / reload is a navigation: route it through the controlling SW's fetch event
+        # first — the refetch happens here, Ruby-side, bypassing the __csimFrameWindow interception
+        # the initial load uses. A respondWith serves the document; a network error fails the
+        # navigation; nil falls through to the network below.
+        if (sw = service_worker_navigation_fetch(url, is_reload: is_reload, is_history: is_history,
+                                                      referrer_source: frame_realm_url(realm_id), referrer_policy: frame_document_referrer_policy(realm_id),
+                                                      **post_args))
+          return if sw['networkError']
+
+          # Raw decoded bytes (like read_rack_body's byte-tagged output); reload_frame_realm_by_id
+          # does the single utf8_text re-tag, matching the network path below.
+          reload_frame_realm_by_id(realm_id, url, Base64.decode64(sw['body_b64'].to_s),
+                                   response_content_type(sw['headers'] || {}), restore_state: restore)
+          return
+        end
+        env = Rack::MockRequest.env_for(url, method: is_post ? 'POST' : 'GET', input: is_post ? body : '')
+        if is_post
+          env['CONTENT_TYPE']   = entry[:content_type].to_s.empty? ? 'application/x-www-form-urlencoded' : entry[:content_type]
+          env['CONTENT_LENGTH'] = body.bytesize.to_s
+        end
         apply_default_request_env(env, referer: current_browsing_context_url)
-        status, headers, body = dispatch_rack_or_http(url, env, method: 'GET')
-        merge_set_cookie(headers)
+        status, headers, resp_body = dispatch_rack_or_http(url, env, method: is_post ? 'POST' : 'GET', body: is_post ? body : nil)
+        merge_set_cookie(headers, url)
         return if download_response?(headers)
-        html = read_rack_body(body)
-        reload_frame_realm_by_id(realm_id, url, html, response_content_type(headers), restore_state: entry[:form_state])
+        html = read_rack_body(resp_body)
+        reload_frame_realm_by_id(realm_id, url, html, response_content_type(headers), restore_state: restore)
       end
       # Serialize + route a form submitted inside frame realm `realm_id`. We
       # serialize in the INITIATING realm (so shadow-tree controls are excluded
@@ -4763,7 +7107,7 @@ module Capybara
         target = spec['target'].to_s
         action = spec['action'].to_s
         enctype = spec['enctype'].to_s.empty? ? 'application/x-www-form-urlencoded' : spec['enctype'].to_s.downcase
-        entries = entry_list.is_a?(Array) ? entry_list : entries_from_spec(spec)
+        entries = entry_list.is_a?(Array) ? entry_list : (spec['entries'] || [])
         # GET → urlencoded query (enctype ignored); POST → enctype-encoded body.
         get_query, = encode_entry_list(entries, 'application/x-www-form-urlencoded')
         get_url = form_get_url(action, get_query)
@@ -4801,20 +7145,63 @@ module Capybara
       end
       # A self-targeted GET form submit in the initiating frame realm: navigate
       # that frame to the action URL (query already mutated in).
-      def navigate_realm_self_get(realm_id, get_url)
-        record_frame_nav(realm_id, get_url)
+      # `record: false` for a `location.href=` / link-click self-nav — those frame navigations are
+      # deliberately NOT recorded in frame history yet (see record_frame_nav; history.back there falls
+      # through to the top document), and recording them here would push an entry where a
+      # `location.replace` must overwrite. A form GET submission (the default) IS a history push.
+      def navigate_realm_self_get(realm_id, get_url, depth: 0, is_reload: false, is_history: false, record: true, site_seed: nil, origin_null: false)
+        raise 'too many redirects' if depth > 10
+        record_frame_nav(realm_id, get_url) if record && depth.zero? && !is_reload && !is_history
         entry = @frame_stack.find {|e| e[:realm_id] == realm_id }
-        if entry
-          navigate_frame(resolve_against_current(get_url), entry: entry)
-        else
-          # A frame reached via contentWindow (not on the entered stack): its
-          # owning iframe lives in its PARENT realm's document (the main realm for
-          # a top-level frame, an intermediate realm for a nested one), so route
-          # the by-realm src-reassignment there — not unconditionally to main.
-          # (relative get_url resolves against the frame's base on rebuild).
-          parent = @runtime.frame_realm_parent(realm_id)
-          frame_realm_host_call(parent, '__csimNavigateFrameByRealm', realm_id, get_url)
+        return navigate_frame(resolve_against_current(get_url), entry: entry) if entry
+        # A frame reached via contentWindow (not on the entered stack). An ABSOLUTE http(s) target is
+        # fetched Ruby-side (like navigate_realm_self_post) so the navigation carries correct request
+        # headers — a Referer under the initiating document's Referrer-Policy, no Origin (GET), the
+        # Fetch-Metadata triple. A non-http(s) target (data:/blob:/javascript:/about:blank) or a
+        # relative one stays on the JS src-reassignment path, which owns those schemes and resolves a
+        # relative URL against the frame's base on rebuild — routed through the frame's PARENT realm
+        # (where the owning iframe lives), not unconditionally to main.
+        parent = @runtime.frame_realm_parent(realm_id)
+        unless get_url.is_a?(String) && get_url.match?(%r{\Ahttps?://}i)
+          return frame_realm_host_call(parent, '__csimNavigateFrameByRealm', realm_id, get_url)
         end
+        # The realm may have been disposed earlier in THIS drain batch — an ancestor frame that also
+        # self-navigated discarded this descendant (dispose_frame_realm_tree). Bail before issuing a
+        # network fetch whose response (reload_frame_realm_by_id) would find no container and be thrown
+        # away — the fetch's cookie / server side effects would fire for a navigation that never commits.
+        return unless @runtime.frame_realm_alive?(realm_id)
+        invalidate_find_cache
+        # A controlled navigation goes to the SW's fetch event first (mode 'navigate'); respondWith
+        # serves the document, a network error fails it, nil falls through to the network GET below.
+        if (sw = service_worker_navigation_fetch(get_url, method: 'GET', is_reload: is_reload, is_history: is_history,
+                                                          referrer_source: frame_realm_url(realm_id), referrer_policy: frame_document_referrer_policy(realm_id),
+                                                          site_seed: site_seed, origin_null: origin_null))
+          return if sw['networkError']
+
+          return reload_frame_realm_by_id(realm_id, get_url, Base64.decode64(sw['body_b64'].to_s), response_content_type(sw['headers'] || {}))
+        end
+        initiator = frame_realm_url(realm_id)
+        site      = widen_sec_fetch_site(site_seed, sec_fetch_site(initiator, get_url))
+        status, headers, resp_body = dispatch_navigation_request(
+          get_url,
+          method:          'GET',
+          initiator:       initiator,
+          referrer_policy: frame_document_referrer_policy(realm_id),
+          site:            site,
+          origin_null:     origin_null
+        )
+        if (loc = redirect_location(status, headers))
+          next_url = resolve_against(loc, get_url)
+          resp_body.close if resp_body.respond_to?(:close)
+          # Latch the redirect chain's Fetch-Metadata: Sec-Fetch-Site widens to include this hop, and
+          # a form POST's Origin taints to 'null' per redirect_taints_origin? (moot for GET — no Origin).
+          return navigate_realm_self_get(realm_id, next_url, depth: depth + 1, is_reload: is_reload, is_history: is_history, record: record,
+                                                   site_seed: site, origin_null: redirect_taints_origin?(origin_null, initiator, get_url, next_url))
+        end
+        if download_response?(headers)
+          return save_downloaded_response(get_url, headers, resp_body)
+        end
+        reload_frame_realm_by_id(realm_id, get_url, read_rack_body(resp_body), response_content_type(headers))
       end
       # A self-targeted POST form submit in the initiating frame realm. POST the
       # entity body to the action URL, then rebuild that frame's realm from the
@@ -4822,25 +7209,55 @@ module Capybara
       # a frame reached via contentWindow has no stack entry, so rebuild it by
       # realm id (recovering its container element + parent realm) and fire the
       # iframe element's load event the GET/src path would.
-      def navigate_realm_self_post(realm_id, url, body, content_type, depth: 0)
+      def navigate_realm_self_post(realm_id, url, body, content_type, depth: 0, is_reload: false, is_history: false, site_seed: nil, origin_null: false)
         raise 'too many redirects' if depth > 10
-        record_frame_nav(realm_id, url) if depth.zero?
+        # A reload / history traversal RE-POSTS an existing entry — it doesn't push a new one; only
+        # a fresh submission records history. The POST method/body is tagged onto the entry AFTER a
+        # DIRECT (non-redirect) response (tag_frame_entry_post below): a POST that redirects (the
+        # Post/Redirect/Get pattern) resolves to a GET document, so its entry must NOT re-POST on a
+        # later reload / back — only a directly-served POST does.
+        record_frame_nav(realm_id, url) if depth.zero? && !is_reload && !is_history
         entry = @frame_stack.find {|e| e[:realm_id] == realm_id }
         return navigate_frame_post(url, body, content_type, entry: entry) if entry
         invalidate_find_cache
-        env = Rack::MockRequest.env_for(url, method: 'POST', input: body)
-        env['CONTENT_TYPE']   = content_type.to_s.empty? ? 'application/x-www-form-urlencoded' : content_type
-        env['CONTENT_LENGTH'] = body.bytesize.to_s
-        apply_default_request_env(env, referer: current_browsing_context_url)
-        status, headers, resp_body = dispatch_rack_or_http(url, env, method: 'POST', body: body)
-        merge_set_cookie(headers)
+        # A controlled POST navigation goes to the SW's fetch event first (mode 'navigate', method
+        # POST — the SW reads the body via event.request.text()); respondWith serves the document,
+        # a network error fails it, nil falls through to the network POST below.
+        if (sw = service_worker_navigation_fetch(url, method: 'POST', body_b64: Base64.strict_encode64(body.to_s), content_type: content_type, is_reload: is_reload, is_history: is_history,
+                                                      referrer_source: frame_realm_url(realm_id), referrer_policy: frame_document_referrer_policy(realm_id),
+                                                      site_seed: site_seed, origin_null: origin_null))
+          return if sw['networkError']
+
+          tag_frame_entry_post(realm_id, body, content_type) if depth.zero?
+          reload_frame_realm_by_id(realm_id, url.to_s, Base64.decode64(sw['body_b64'].to_s), response_content_type(sw['headers'] || {}))
+          return
+        end
+        # The initiator is the FRAME's own document (still alive — the rebuild is below), not the
+        # top document `current_browsing_context_url` returns for a non-entered frame. A form POST
+        # navigation carries that document's Origin + a Referer under its Referrer-Policy + the
+        # Fetch-Metadata triple (Sec-Fetch-Dest 'iframe' for a subframe).
+        initiator = frame_realm_url(realm_id)
+        site      = widen_sec_fetch_site(site_seed, sec_fetch_site(initiator, url.to_s))
+        status, headers, resp_body = dispatch_navigation_request(
+          url,
+          method:          'POST',
+          initiator:       initiator,
+          referrer_policy: frame_document_referrer_policy(realm_id),
+          site:            site,
+          origin_null:     origin_null,
+          body:            body,
+          content_type:    content_type
+        )
+        merge_set_cookie(headers, url)
         if (loc = redirect_location(status, headers))
           next_url = resolve_against_current(loc)
           resp_body.close if resp_body.respond_to?(:close)
           # 307/308 preserve method + body; 301/302/303 → GET the frame (routed
-          # through the realm that OWNS the iframe, as in navigate_realm_self_get).
+          # through the realm that OWNS the iframe, as in navigate_realm_self_get). Latch the
+          # redirect chain's Sec-Fetch-Site (widened) + Origin taint (redirect_taints_origin?).
           if [307, 308].include?(status)
-            return navigate_realm_self_post(realm_id, next_url, body, content_type, depth: depth + 1)
+            return navigate_realm_self_post(realm_id, next_url, body, content_type, depth: depth + 1, is_reload: is_reload, is_history: is_history,
+                                                       site_seed: site, origin_null: redirect_taints_origin?(origin_null, initiator, url.to_s, next_url))
           end
           parent = @runtime.frame_realm_parent(realm_id)
           return frame_realm_host_call(parent, '__csimNavigateFrameByRealm', realm_id, next_url)
@@ -4849,8 +7266,16 @@ module Capybara
           save_downloaded_response(url, headers, resp_body)
           return
         end
+        tag_frame_entry_post(realm_id, body, content_type) if depth.zero?
         reload_frame_realm_by_id(realm_id, url.to_s, read_rack_body(resp_body), response_content_type(headers))
       end
+      # Tag the frame's current history entry as reached by a POST (with its body), so a later
+      # reload / history traversal re-POSTS it. Applied only on a DIRECT response (not a redirect),
+      # so a Post/Redirect/Get entry stays a GET.
+      def tag_frame_entry_post(realm_id, body, content_type)
+        cur = current_frame_history_entry(realm_id)
+        cur.merge!(method: 'POST', body: body, content_type: content_type) if cur
+      end
       # Rebuild a frame realm reached via contentWindow (no @frame_stack entry):
       # recover its container element handle + parent realm, swap in a fresh realm
       # built from `html`, re-point the iframe at it, and fire the element load.
@@ -4958,24 +7383,60 @@ module Capybara
       def history_length
         [@history.size, 1].max
       end
-      # `document.cookie` is TEXT; jar entries parsed out of Rack's Set-Cookie
-      # headers can carry the BINARY tag, which would make the joined string
-      # cross into JS as a Uint8Array (`document.cookie.match is not a
-      # function`). Cookies are ASCII per RFC 6265.
+      # The host a cookie is scoped to for `url`. RFC 6265 cookies are keyed by host
+      # (not scheme/port), so cross-host requests never see each other's cookies while
+      # a same-origin flow behaves exactly like a single jar. nil when the URL carries
+      # no host (about:blank / data: / a relative current_url before the first navigate).
+      def cookie_host(url)
+        h = safe_uri(url.to_s)&.host
+        h && !h.empty? ? h.downcase : nil
+      end
+
+      # The host cookies attach to for a request built into `env` — the target server
+      # (SERVER_NAME / HTTP_HOST), NOT the current document, so a cross-origin fetch sends
+      # the TARGET's cookies rather than leaking the document's (cors-cookies). Strips the
+      # port while preserving an IPv6 bracket-literal (`[::1]`) so the key matches what
+      # `cookie_host` derives from the URL via `URI#host`.
+      def env_cookie_host(env)
+        h = (env['HTTP_HOST'] || env['SERVER_NAME']).to_s
+        h = h.start_with?('[') ? h[/\A\[[^\]]*\]/].to_s : h.split(':', 2).first
+        h && !h.empty? ? h.downcase : nil
+      end
+
+      # The `Cookie` request-header value for a request to `host`: that host's jar,
+      # serialized `name=value; …`. (Domain-attribute subdomain sharing isn't modelled —
+      # the app suites are single-host; cross-host ISOLATION is what matters here.)
+      #
+      # TEXT, not binary: jar entries parsed out of Rack's Set-Cookie headers can carry the
+      # BINARY tag, which would make the joined string cross into JS as a Uint8Array
+      # (`document.cookie.match is not a function`). Cookies are ASCII per RFC 6265.
+      def cookie_header_for(host)
+        jar = host && @cookies[host]
+        return '' if jar.nil? || jar.empty?
+        RuntimeShared.utf8_text(jar.map {|k, v| "#{k}=#{v}" }.join('; '))
+      end
+
+      # `document.cookie` reads/writes the CURRENT document's host jar.
+      def document_cookie_host
+        cookie_host(current_browsing_context_url) || cookie_host(@default_host)
+      end
+
       def document_cookie
-        RuntimeShared.utf8_text(@cookies.map {|k, v| "#{k}=#{v}" }.join('; '))
+        cookie_header_for(document_cookie_host)
       end
       def current_referer      ; @current_referer.to_s ; end
       def write_document_cookie(s)
         return if s.nil? || s.empty?
+        host = document_cookie_host or return
         name, rest = s.split('=', 2)
         return if name.nil? || name.empty?
         parts = (rest || '').split(';').map(&:strip)
         value = parts.shift.to_s
+        jar = (@cookies[host] ||= {})
         if cookie_deletion?(parts)
-          @cookies.delete(name.strip)
+          jar.delete(name.strip)
         else
-          @cookies[name.strip] = value
+          jar[name.strip] = value
         end
       end
 
@@ -4990,9 +7451,25 @@ module Capybara
       def storage_get(kind, key)
         store(kind)[key.to_s]
       end
+      # Per-area storage quota (Chrome / Firefox both cap a localStorage / sessionStorage area at
+      # ~5 MiB per origin). Without it, the WPT quota tests — which `setItem` in a `while (true)` loop
+      # until QuotaExceededError — write unbounded gigabytes and OOM the process.
+      STORAGE_QUOTA_BYTES = 5 * 1024 * 1024
+
+      # Returns true when stored, false when the (key, value) would exceed the area's quota — the JS
+      # shim turns a false into a QuotaExceededError and does NOT store (WHATWG "setItem" step). The
+      # size is summed from the store each call (localStorage is shared across same-origin windows, so
+      # a per-Browser running total would drift); replacing a key frees its old bytes first.
       def storage_set(kind, key, value)
-        store(kind)[key.to_s] = value.to_s
-        nil
+        st    = store(kind)
+        key   = key.to_s
+        value = value.to_s
+        used  = st.sum {|k, v| k.bytesize + v.bytesize }
+        used -= key.bytesize + st[key].bytesize if st.key?(key)
+        return false if used + key.bytesize + value.bytesize > STORAGE_QUOTA_BYTES
+
+        st[key] = value
+        true
       end
       def storage_remove(kind, key)
         store(kind).delete(key.to_s)
@@ -5011,6 +7488,62 @@ module Capybara
       private def store(kind)
         kind.to_s == 'session' ? @session_storage : @local_storage
       end
+
+      # Cache Storage backing — origin-partitioned dumb store; the JS side owns the spec
+      # matching (cache-storage.js). `@cache_storage` is
+      #   origin => {seq:, names: {name => cache_id}, caches: {cache_id => {seq:, entries:}}}
+      # The name→id indirection models the spec's "dooms, but does not delete immediately":
+      # `caches.delete(name)` unmaps the name, but a Cache handle already bound to the id
+      # keeps operating on its own storage (a fresh `open(name)` gets a new id / empty cache).
+      # Each entry is `{id:, meta:, response:}` — `meta` the parsed request metadata the
+      # matcher needs ({url, method, headers, vary}), `response` an opaque serialized-Response
+      # JSON blob. Each host fn runs a single read-modify-write under the GVL, so concurrent
+      # access from a service-worker thread stays atomic without a lock (localStorage
+      # precedent). A doomed cache's storage lingers until `reset!` (per-test) frees it — a
+      # bounded leak we accept rather than refcount handles across the JS boundary.
+      def cache_storage_open(origin, name)
+        store = (@cache_storage[origin.to_s] ||= {seq: 0, names: {}, caches: {}})
+        id    = (store[:names][name.to_s] ||= (store[:seq] += 1))
+        store[:caches][id] ||= {seq: 0, entries: []}
+        id
+      end
+      def cache_storage_has(origin, name)
+        @cache_storage.dig(origin.to_s, :names)&.key?(name.to_s) || false
+      end
+      def cache_storage_delete(origin, name)
+        names = @cache_storage.dig(origin.to_s, :names) or return false
+        !names.delete(name.to_s).nil?
+      end
+      def cache_storage_keys(origin)
+        (@cache_storage.dig(origin.to_s, :names) || {}).keys
+      end
+      def cache_entries(origin, cache_id)
+        cache = cache_for(origin, cache_id) or return nil
+        JSON.generate(cache[:entries].map {|e| {id: e[:id]}.merge(e[:meta]) })
+      end
+      def cache_entry_response(origin, cache_id, entry_id)
+        cache = cache_for(origin, cache_id) or return nil
+        entry = cache[:entries].find {|e| e[:id] == entry_id.to_i } or return nil
+        entry[:response]
+      end
+      def cache_put(origin, cache_id, delete_ids_json, meta_json, response_json)
+        cache = cache_for(origin, cache_id) or return nil
+        ids   = JSON.parse(delete_ids_json).map(&:to_i)
+        cache[:entries].reject! {|e| ids.include?(e[:id]) } unless ids.empty?
+        cache[:entries] << {id: (cache[:seq] += 1), meta: JSON.parse(meta_json), response: response_json.to_s}
+        nil
+      end
+      def cache_delete_entries(origin, cache_id, ids_json)
+        cache  = cache_for(origin, cache_id) or return 0
+        ids    = JSON.parse(ids_json).map(&:to_i)
+        before = cache[:entries].size
+        cache[:entries].reject! {|e| ids.include?(e[:id]) }
+        before - cache[:entries].size
+      end
+      # The cache hash ({seq:, entries:}) bound to a Cache handle's id, or nil if it's gone.
+      private def cache_for(origin, cache_id)
+        @cache_storage.dig(origin.to_s, :caches, cache_id.to_i)
+      end
       # Push a one-shot handler onto the modal-dialog stack — the next
       # modal that fires consumes the topmost handler. Block exit pops
       # in case the dialog never fired.
@@ -5060,7 +7593,7 @@ module Capybara
         env = Rack::MockRequest.env_for(url, method: 'GET')
         apply_default_request_env(env, referer: current_browsing_context_url)
         status, headers, body = dispatch_rack_or_http(url, env, method: 'GET')
-        merge_set_cookie(headers)
+        merge_set_cookie(headers, url)
         if (loc = redirect_location(status, headers))
           next_url = carry_fragment(url, resolve_against_current(loc))
           body.close if body.respond_to?(:close)
@@ -5081,7 +7614,7 @@ module Capybara
         env['CONTENT_LENGTH'] = body.bytesize.to_s
         apply_default_request_env(env, referer: current_browsing_context_url)
         status, headers, resp_body = dispatch_rack_or_http(url, env, method: 'POST', body: body)
-        merge_set_cookie(headers)
+        merge_set_cookie(headers, url)
         if (loc = redirect_location(status, headers))
           next_url = resolve_against_current(loc)
           resp_body.close if resp_body.respond_to?(:close)
@@ -5198,7 +7731,7 @@ module Capybara
           env = Rack::MockRequest.env_for(url, method: 'GET')
           apply_default_request_env(env, referer: referer)
           status, headers, body = dispatch_rack_or_http(url, env, method: 'GET')
-          merge_set_cookie(headers)
+          merge_set_cookie(headers, url)
           if (loc = redirect_location(status, headers))
             next_url = resolve_against_current(loc)
             # Per RFC 7231: if the original request URL had a fragment
@@ -5426,8 +7959,147 @@ module Capybara
         # server can negotiate — HTML-only routes still pick html,
         # both-available pick the first registered.
         env['HTTP_ACCEPT'] ||= DEFAULT_HTTP_ACCEPT
-        env['HTTP_REFERER'] = referer         unless referer.nil? || referer.empty?
-        env['HTTP_COOKIE']  = document_cookie unless @cookies.empty?
+        env['HTTP_REFERER'] = referer unless referer.nil? || referer.empty?
+        # Attach the TARGET host's cookies (not the document's) — SERVER_NAME is the
+        # request's host — so a cross-origin request carries the right jar or none.
+        ck = cookie_header_for(env_cookie_host(env))
+        if ck.empty?
+          env.delete('HTTP_COOKIE')
+        else
+          env['HTTP_COOKIE'] = ck
+        end
+      end
+
+      # Referer / Origin / Fetch-Metadata for a NAVIGATION request (a document load — form
+      # submit, location set, link activation). Unlike a fetch/XHR (which carries a per-request
+      # policy through rack_fetch), a navigation's request headers derive from the INITIATING
+      # document: its Referrer-Policy (compute_referrer), its origin (an `Origin` header — sent
+      # only on an unsafe method, i.e. a form POST, never a GET/HEAD navigation), and the
+      # Fetch-Metadata triple. `dest` is 'document' for a top-level nav, 'iframe' for a subframe.
+      # `site_override` / `origin_null` carry redirect-chain latched state (navigate_realm_self_*
+      # thread it through each hop): Sec-Fetch-Site is the WIDEST initiator↔url relationship over the
+      # whole chain (a same-site redirect keeps 'same-site' even when the final hop is same-origin),
+      # and a form POST's Origin becomes the opaque 'null' once any hop has crossed origin.
+      def navigation_request_headers(env, method:, initiator_url:, target:, dest:, referrer_policy: nil, user_activated: false, site_override: nil, origin_null: false)
+        apply_default_request_env(env, referer: compute_referrer(referrer_policy, initiator_url, target))
+        # Origin is appended to every non-GET/HEAD request (a form POST carries it; a GET navigation
+        # does not). From a KNOWN initiating document it's that document's origin serialization, or
+        # the literal 'null' when that origin is opaque (an about:blank / data: frame) or has been
+        # tainted by a cross-origin redirect — matching the fetch path's `effective_origin`
+        # convention. Omitted only when the initiator is unknown (a disposed realm → nil url).
+        if initiator_url && !initiator_url.to_s.empty? && !%w[GET HEAD].include?(method.to_s.upcase)
+          env['HTTP_ORIGIN'] = (!origin_null && url_origin(initiator_url)) || 'null'
+        end
+        env['HTTP_SEC_FETCH_SITE'] = site_override || sec_fetch_site(initiator_url, target)
+        env['HTTP_SEC_FETCH_MODE'] = 'navigate'
+        env['HTTP_SEC_FETCH_DEST'] = dest.to_s
+        env['HTTP_SEC_FETCH_USER'] = '?1' if user_activated
+      end
+
+      # Build + dispatch a navigation request (a frame/document load) — the shared core of the GET
+      # self-nav, the POST self-nav, and the navigation-preload request, so all three send the SAME
+      # Referer / Origin / Fetch-Metadata (dest 'iframe') and can't silently diverge. `site` is the
+      # caller's already-widened Sec-Fetch-Site (threaded across the redirect chain it owns);
+      # `extra_headers` carries any request-specific CGI header (the preload marker). Returns
+      # [status, headers, resp_body] — the caller handles redirects / reload / the preload wire.
+      def dispatch_navigation_request(url, method:, initiator:, referrer_policy:, site:, origin_null:, body: nil, content_type: nil, extra_headers: nil)
+        env = Rack::MockRequest.env_for(url, method: method, input: body || '')
+        if content_type
+          env['CONTENT_TYPE']   = content_type.to_s.empty? ? 'application/x-www-form-urlencoded' : content_type
+          env['CONTENT_LENGTH'] = body.to_s.bytesize.to_s
+        end
+        navigation_request_headers(
+          env,
+          method:          method,
+          initiator_url:   initiator,
+          target:          url.to_s,
+          dest:            'iframe',
+          referrer_policy: referrer_policy,
+          site_override:   site,
+          origin_null:     origin_null
+        )
+        extra_headers&.each {|k, v| env[k] = v }
+        status, headers, resp_body = dispatch_rack_or_http(url, env, method: method, body: body)
+        merge_set_cookie(headers, url)
+        [status, headers, resp_body]
+      end
+
+      # The Navigation Preload request: a parallel GET the browser issues for a navigation whose
+      # controlling SW has preload enabled, exposed to the SW as `event.preloadResponse`. It IS a
+      # navigation request (dest 'iframe', mode 'navigate', the frame's Referer / Sec-Fetch-Site — so
+      # the server sees exactly what a no-SW navigation would) plus the `Service-Worker-Navigation-
+      # Preload` header carrying the registration's header value. The SW intercepts the FINAL URL (a
+      # pre-SW network redirect already happened + widened `site_seed`), so this is a single hop — no
+      # redirect loop. Returns the response wire hash for the fetch-event JSON, or nil on a hard error.
+      def navigation_preload_response(url, referrer_source, referrer_policy, site_seed, origin_null, header_value)
+        site = widen_sec_fetch_site(site_seed, sec_fetch_site(referrer_source, url))
+        status, headers, resp_body = dispatch_navigation_request(
+          url,
+          method:          'GET',
+          initiator:       referrer_source,
+          referrer_policy: referrer_policy,
+          site:            site,
+          origin_null:     origin_null,
+          extra_headers:   {'HTTP_SERVICE_WORKER_NAVIGATION_PRELOAD' => header_value.to_s}
+        )
+        {
+          'status'     => status,
+          'statusText' => RuntimeShared.utf8_text(Rack::Utils::HTTP_STATUS_CODES[status.to_i] || ''),
+          'headers'    => headers.to_h,
+          # The UA transparently decodes a Content-Encoding'd body (gzip/deflate) before the SW's
+          # `event.preloadResponse.text()` sees it — the header stays, the bytes are inflated (as the
+          # regular fetch path does).
+          'body_b64'   => Base64.strict_encode64(decode_content_encoding(read_rack_body(resp_body), headers))
+        }
+      rescue StandardError
+        nil
+      end
+
+      # Fetch-Metadata `Sec-Fetch-Site`: the relationship of a request's INITIATOR to its target.
+      # no initiator (a direct address-bar load) → 'none'; same (scheme,host,port) → 'same-origin';
+      # same registrable site (eTLD+1) → 'same-site'; else → 'cross-site'.
+      def sec_fetch_site(initiator_url, target_url)
+        io = url_origin(initiator_url)
+        return 'none' if io.nil?
+        return 'same-origin' if io == url_origin(target_url)
+        is = registrable_site(initiator_url)
+        ts = registrable_site(target_url)
+        is && ts && is == ts ? 'same-site' : 'cross-site'
+      end
+
+      SEC_FETCH_SITE_RANK = {'same-origin' => 0, 'same-site' => 1, 'cross-site' => 2, 'none' => 2}.freeze
+      private_constant :SEC_FETCH_SITE_RANK
+      # The wider (more distant) of two Sec-Fetch-Site values — used to latch the value across a
+      # redirect chain (same-origin < same-site < cross-site). `nil` seed → the other value.
+      def widen_sec_fetch_site(a, b)
+        return b if a.nil?
+        SEC_FETCH_SITE_RANK[b].to_i > SEC_FETCH_SITE_RANK[a].to_i ? b : a
+      end
+
+      # Fetch "HTTP-redirect fetch": a request's Origin opaques to 'null' once it follows a
+      # cross-origin redirect WHILE ALREADY off the initiator's origin — i.e. the current URL is
+      # cross-origin to BOTH the redirect target and the initiator. The FIRST cross-origin hop (still
+      # on the initiator's origin) keeps the real Origin; a later hop that redirects same-origin-to-
+      # current keeps it too. Monotonic: once opaque, an opaque origin is same-origin with nothing, so
+      # it stays null.
+      def redirect_taints_origin?(already_null, initiator_url, current_url, location_url)
+        already_null ||
+          (url_origin(current_url) != url_origin(location_url) && url_origin(initiator_url) != url_origin(current_url))
+      end
+
+      # scheme + registrable domain (approx eTLD+1) of a URL — the "site" a Sec-Fetch-Site /
+      # same-site comparison uses. Last-two-labels approximation (no Public Suffix List — correct
+      # for the single-label TLDs our hosts use); an IP literal / ≤2-label host is its own site.
+      # A `blob:` URL derives from its inner origin. nil for a hostless / non-http(s) URL.
+      def registrable_site(url)
+        u = URI.parse(url.to_s.sub(/\Ablob:/, ''))
+        host = u.host.to_s
+        return nil if host.empty? || !u.scheme&.match?(/\Ahttps?\z/i)
+        labels = host.split('.')
+        regd = host.start_with?('[') || host.match?(/\A\d+(\.\d+){3}\z/) || labels.length <= 2 ? host : labels.last(2).join('.')
+        "#{u.scheme}://#{regd}"
+      rescue URI::Error
+        nil
       end
 
       # Cross-host hop (e.g. Discourse's `discourse_connect` flow
@@ -5512,9 +8184,22 @@ module Capybara
         nil
       end
 
-      def merge_set_cookie(headers)
+      # Store a response's Set-Cookie headers under the RESPONDING host's jar (`url` is
+      # the hop that produced `headers`). A cross-origin hop therefore writes its own
+      # host's jar, never the document's (cors-cookies isolation).
+      # True if the response carries a `WWW-Authenticate: Basic …` challenge — the only scheme the
+      # transparent-auth retry in rack_fetch answers.
+      def www_authenticate_basic?(headers)
+        return false unless headers.is_a?(Hash)
+        headers.each {|k, v| return true if k.to_s.casecmp?('www-authenticate') && v.to_s.strip.downcase.start_with?('basic') }
+        false
+      end
+
+      def merge_set_cookie(headers, url)
         sc = headers['set-cookie'] || headers['Set-Cookie']
         return if sc.nil? || sc.empty?
+        host = cookie_host(url) || document_cookie_host or return
+        jar  = (@cookies[host] ||= {})
         # Rack 2 returns multiple Set-Cookie headers as a single
         # newline-separated string; Rack 3 returns an Array. Treat both
         # uniformly — splitting first means the second cookie in a
@@ -5527,9 +8212,9 @@ module Capybara
           name, value = pair.split('=', 2)
           next if name.nil? || name.empty?
           if cookie_deletion?(parts)
-            @cookies.delete(name.strip)
+            jar.delete(name.strip)
           else
-            @cookies[name.strip] = value.to_s.strip
+            jar[name.strip] = value.to_s.strip
           end
         }
       end
@@ -5555,18 +8240,40 @@ module Capybara
       end
 
       # Header names/values are TEXT (RFC 9110: field values are ASCII); Rack
-      # hands them over BINARY-tagged (see `RuntimeShared.utf8_text`).
+      # hands them over BINARY-tagged (see `RuntimeShared.utf8_text`). Per-value HTTP
+      # -whitespace normalization happens upstream, BEFORE duplicate values are
+      # combined (WptRunner.combine_headers) — not here, where a combined value like
+      # `", "` (two empty fields) would wrongly lose its trailing space. An
+      # Array-valued header (a Rack app emitting a repeated field) is combined with
+      # `, ` — the WHATWG "combine" separator getAllResponseHeaders exposes, matching
+      # both real browsers and the harness's combine_headers.
       def stringify(headers)
         out = {}
         headers.each do |k, v|
-          out[k.to_s] = RuntimeShared.utf8_text(v.is_a?(Array) ? v.join(',') : v.to_s)
+          out[k.to_s] = RuntimeShared.utf8_text(v.is_a?(Array) ? v.join(', ') : v.to_s)
         end
         out
       end
 
+      # The Fetch "redirect status" set — ONLY these are followed. 300 (multiple
+      # choice), 304 (not modified), 305/306 (deprecated) are NOT redirects: the 3xx
+      # response is returned to the caller as-is (xhr send-redirect basics).
+      REDIRECT_STATUSES = [301, 302, 303, 307, 308].freeze
+      # Statuses whose response has no body (Fetch "null body status") — the body is dropped
+      # and response.body is null (response-null-body). (101 is unreachable here.)
+      NULL_BODY_STATUSES = [204, 205, 304].freeze
+      # Request-body headers removed when a redirect nulls the body (method → GET).
+      REDIRECT_DROPPED_HEADERS = %w[content-encoding content-language content-location content-type content-length].freeze
       def redirect_location(status, headers)
-        return nil unless (300..399).include?(status.to_i)
-        headers['location'] || headers['Location']
+        return nil unless REDIRECT_STATUSES.include?(status.to_i)
+        loc = headers['location'] || headers['Location']
+        loc = loc.first if loc.is_a?(Array)   # Rack 3 permits array-valued header fields
+        # A blank (or absent) Location has no FOLLOWABLE target: an empty value parses back
+        # to the current URL, so following it would just self-redirect. Return nil so a
+        # caller renders the 3xx as-is rather than looping — the several navigation handlers
+        # rely on this. (The fetch redirect loop recognizes a present-but-empty Location
+        # separately and turns it into a network error per Fetch — see rack_fetch.)
+        loc unless loc.to_s.empty?
       end
 
       def resolve_against_current(url, use_base: false)
@@ -5596,6 +8303,260 @@ module Capybara
         dom_call('__csimBaseHref').to_s
       end
 
+      # Fetch "CORS-safelisted method" / "…request-header" / "…Content-Type". A request
+      # is "simple" (no preflight) iff its method is safelisted AND every author header is
+      # safelisted (Content-Type only for a urlencoded / multipart / text/plain value).
+      CORS_SAFELISTED_METHODS = %w[GET HEAD POST].freeze
+      CORS_SAFELISTED_HEADERS = %w[accept accept-language content-language content-type].freeze
+      # RFC 7230 `token` (tchar+) — a valid HTTP method / field-name. Used to reject a
+      # preflight whose Access-Control-Allow-Methods / -Headers carries a malformed value.
+      HTTP_TOKEN = /\A[!#$%&'*+\-.^_`|~0-9A-Za-z]+\z/.freeze
+      CORS_SAFELISTED_CTYPES  = %w[application/x-www-form-urlencoded multipart/form-data text/plain].freeze
+      # Fetch "CORS-unsafe request-header byte" — a byte in a header value that forces a
+      # safelisted-name header out of the safelisted set (so a preflight becomes necessary):
+      # a control byte other than HT (0x09), DEL, or one of the delimiters "(),:<>?@[\]{}.
+      CORS_UNSAFE_VALUE_BYTE  = /[\x00-\x08\x0a-\x1f\x7f"():<>?@\[\\\]{}]/n.freeze
+      # accept-language / content-language values are further restricted: only digits,
+      # ASCII letters, space, and `*,-.;=` keep them safelisted.
+      CORS_LANGUAGE_VALUE     = /\A[0-9A-Za-z *,\-.;=]*\z/n.freeze
+
+      # Fetch "CORS-safelisted request-header": a (name, value) whose value keeps the
+      # request "simple" (no preflight). All four names cap the value at 128 bytes; each
+      # then constrains which bytes the value may contain (a `"` in Accept, a control byte
+      # in Content-Language, an over-long text/plain Content-Type all force a preflight —
+      # cors-preflight-not-cors-safelisted).
+      def cors_safelisted_request_header?(name, value)
+        v = value.to_s.b
+        return false if v.bytesize > 128
+        case name
+        when 'accept'
+          !v.match?(CORS_UNSAFE_VALUE_BYTE)
+        when 'accept-language', 'content-language'
+          v.match?(CORS_LANGUAGE_VALUE)
+        when 'content-type'
+          return false if v.match?(CORS_UNSAFE_VALUE_BYTE)
+          essence = v.split(';', 2).first.to_s.strip.downcase
+          CORS_SAFELISTED_CTYPES.include?(essence)
+        else
+          false
+        end
+      end
+
+      # The sorted, lowercased author header names that are NOT CORS-safelisted. A
+      # safelisted NAME still counts as unsafe when its VALUE fails the safelisting (an
+      # unsafe byte / over-128-byte length / non-safelisted Content-Type essence). These
+      # are echoed in Access-Control-Request-Headers for the preflight and must be covered
+      # by Access-Control-Allow-Headers.
+      def cors_unsafe_headers(headers)
+        (headers || {}).filter_map {|k, v|
+          name = k.to_s.downcase
+          next if name.start_with?('x-csim') || name == 'content-length'
+          if CORS_SAFELISTED_HEADERS.include?(name)
+            cors_safelisted_request_header?(name, v) ? nil : name
+          else
+            name
+          end
+        }.uniq.sort
+      end
+
+      def cors_unsafe_request?(method, headers)
+        !CORS_SAFELISTED_METHODS.include?(method.to_s.upcase) || !cors_unsafe_headers(headers).empty?
+      end
+
+      # Fetch "CORS check" on a cross-origin response: it must allow the request's
+      # (effective) origin via Access-Control-Allow-Origin. A NON-credentialed request
+      # accepts `*` or the exact origin; a CREDENTIALED one (withCredentials) forbids
+      # `*` — the ACAO must be the exact origin AND Access-Control-Allow-Credentials
+      # must be `true` (access-control-and-redirects-async-same-origin credentials cases).
+      def cors_response_ok?(resp_headers, origin, credentialed)
+        acao = cors_header(resp_headers, 'access-control-allow-origin')
+        return false if acao.nil?
+        if credentialed
+          return false unless acao == origin
+          cors_header(resp_headers, 'access-control-allow-credentials').to_s.downcase == 'true'
+        else
+          acao == '*' || acao == origin
+        end
+      end
+
+      # Whether a URL carries userinfo (`user[:password]@`). A CORS request to such a
+      # URL is a network error (access-control-and-redirects "user info" subtest).
+      def url_has_userinfo?(url)
+        u = URI.parse(url.to_s)
+        !u.userinfo.to_s.empty?
+      rescue URI::InvalidURIError
+        false
+      end
+
+      # An author-set conditional header means the CALLER is doing its own revalidation,
+      # so the UA cache must step aside: the request reaches the origin and the server's
+      # own 304/200 decision is returned (send-conditional), not a cached hit.
+      CONDITIONAL_REQUEST_HEADERS = %w[if-none-match if-modified-since if-match if-unmodified-since if-range].freeze
+      def request_has_conditional_headers?(headers)
+        headers.is_a?(Hash) && headers.any? {|k, _| CONDITIONAL_REQUEST_HEADERS.include?(k.to_s.downcase) }
+      end
+
+      # Run the CORS preflight unless a cached result already covers this request (Fetch
+      # "CORS-preflight cache"): a prior preflight to the same (origin, url) within its
+      # Access-Control-Max-Age that allows this method + headers lets the actual request
+      # skip the OPTIONS (access-control-basic-allow-preflight-cache). Returns false (=
+      # network error) only when a fresh preflight is needed AND fails.
+      def cors_preflight_ok?(target, method, headers, req_origin, credentialed, referer)
+        return true if cors_preflight_cached?(target, req_origin, method, headers, credentialed)
+        result = cors_run_preflight(target, method, headers, req_origin, credentialed, referer)
+        return false unless result
+        # Cache the grant for Max-Age seconds so a covered follow-up skips the preflight.
+        # The key is (origin, url, credentialed): a credentialed grant (ACAO echoing the
+        # origin, no `*` matching) can't cover an uncredentialed follow-up or vice versa,
+        # so the two are cached apart. Expiry uses the REAL monotonic clock (not the
+        # virtual one), so a test that virtual-sleeps past Max-Age to force a re-preflight
+        # isn't caught yet.
+        @cors_preflight_cache[[req_origin, target, credentialed]] = result.merge(stored_at: Process.clock_gettime(Process::CLOCK_MONOTONIC)) if result[:max_age].positive?
+        true
+      end
+
+      # Whether a cached preflight grant covers this request (not expired + method/headers
+      # allowed). A method/header the cache doesn't cover — or an expired entry — forces a
+      # fresh preflight (cache-invalidation-by-method / -header / -timeout).
+      def cors_preflight_cached?(target, req_origin, method, headers, credentialed)
+        entry = @cors_preflight_cache[[req_origin, target, credentialed]]
+        return false unless entry
+        return false if Process.clock_gettime(Process::CLOCK_MONOTONIC) - entry[:stored_at] >= entry[:max_age]
+        cors_grant_allows?(entry[:methods], entry[:headers], method, cors_unsafe_headers(headers), credentialed)
+      end
+
+      # `Authorization` is Fetch's sole "CORS non-wildcard request-header name": a preflight
+      # `Access-Control-Allow-Headers: *` never covers it — it must be listed by name — even
+      # for an uncredentialed request (cors-preflight "authorization not covered by wildcard").
+      CORS_NON_WILDCARD_REQUEST_HEADERS = %w[authorization].freeze
+
+      # Does a preflight grant (its Access-Control-Allow-Methods / -Headers) cover this
+      # request: the method is allowed / `*` / CORS-safelisted, and every unsafe header is
+      # allowed / `*`. Shared by the fresh-preflight accept check and the cache-hit check.
+      # For a CREDENTIALED request the wildcard loses its meaning — Fetch's "CORS-preflight
+      # fetch" matches `*` against no method/header when credentials mode is include, so a
+      # non-listed method or unsafe header is rejected (cors-preflight-star credentialed).
+      def cors_grant_allows?(allow_methods, allow_headers, method, unsafe_headers, credentialed = false)
+        # The method match is byte-CASE-SENSITIVE (Fetch normalizes the request method but
+        # compares it verbatim against Access-Control-Allow-Methods): `delete` in the grant
+        # does not cover a `DELETE` request. Safelisted GET/HEAD/POST pass regardless
+        # (they're always normalized to upper-case) (cors-preflight-star method-case).
+        m = method.to_s
+        method_ok = allow_methods.include?(m) || CORS_SAFELISTED_METHODS.include?(m) || (!credentialed && allow_methods.include?('*'))
+        return false unless method_ok
+        wildcard_headers = !credentialed && allow_headers.include?('*')
+        unsafe_headers.all? {|h|
+          allow_headers.include?(h) || (wildcard_headers && !CORS_NON_WILDCARD_REQUEST_HEADERS.include?(h))
+        }
+      end
+
+      # Fetch "CORS-preflight fetch": send an OPTIONS with Access-Control-Request-Method
+      # / -Headers + Origin; on success (ok-status, ACAO match, and the grant covers the
+      # method + unsafe headers) return the grant {methods, headers, max_age} for the
+      # cache, else nil. A credentialed preflight additionally requires the response to
+      # allow credentials (ACAC:true) and forbids `*` in the origin/method/header grants.
+      def cors_run_preflight(target, method, headers, req_origin, credentialed, referer)
+        unsafe = cors_unsafe_headers(headers)
+        env    = Rack::MockRequest.env_for(target, method: 'OPTIONS')
+        env['REQUEST_METHOD'] = 'OPTIONS'
+        # The preflight's Referer is the request's referrer under its referrer policy —
+        # the SAME value the actual request sends (computed by the caller), not the raw
+        # document URL (cors-preflight-referrer).
+        apply_default_request_env(env, referer: referer, force: false)
+        # A CORS-preflight is a fetch, so it carries fetch's default `Accept: */*` (NOT
+        # the navigation Accept apply_default_request_env sets) — some handlers reject a
+        # preflight whose Accept isn't */* (preflight.py).
+        env['HTTP_ACCEPT'] = '*/*'
+        # A CORS-preflight is always uncredentialed — it carries no cookies, even when the
+        # actual request that follows is credentialed.
+        env.delete('HTTP_COOKIE')
+        env['HTTP_ORIGIN'] = req_origin
+        # Access-Control-Request-Method carries the request's (already-normalized) method
+        # VERBATIM — `patch` stays `patch`, matching the byte-case-sensitive grant check.
+        env['HTTP_ACCESS_CONTROL_REQUEST_METHOD'] = method.to_s
+        env['HTTP_ACCESS_CONTROL_REQUEST_HEADERS'] = unsafe.join(',') unless unsafe.empty?
+        status, ph, pbody = dispatch_rack_or_http(target, env, method: 'OPTIONS', body: nil)
+        pbody.close if pbody.respond_to?(:close)
+        # A slow preflight counts toward the client's timeout too (timeout-multiple-fetches).
+        @fetch_server_delay_ms += server_delay_ms_of(ph) if @fetch_server_delay_ms
+        return nil unless (200..299).include?(status.to_i)
+        acao = cors_header(ph, 'access-control-allow-origin')
+        # A credentialed preflight can't be allowed by the wildcard origin and must carry
+        # Access-Control-Allow-Credentials: true (cors-preflight-star credentialed).
+        return nil unless credentialed ? acao == req_origin : (acao == '*' || acao == req_origin)
+        return nil if credentialed && cors_header(ph, 'access-control-allow-credentials') != 'true'
+        allow_methods = cors_list(cors_header(ph, 'access-control-allow-methods'))
+        allow_headers = cors_list(cors_header(ph, 'access-control-allow-headers')).map(&:downcase)
+        # Fetch "extract header list values" fails when a grant contains a malformed token
+        # (`Access-Control-Allow-Methods: Bad value` — a space isn't a tchar), and a failed
+        # extraction is a network error (cors-preflight-response-validation). Methods and
+        # header names are both HTTP tokens; `*` is a valid tchar so the wildcard passes.
+        return nil unless (allow_methods + allow_headers).all? {|t| t.match?(HTTP_TOKEN) }
+        return nil unless cors_grant_allows?(allow_methods, allow_headers, method, unsafe, credentialed)
+        {methods: allow_methods, headers: allow_headers, max_age: cors_header(ph, 'access-control-max-age').to_i}
+      end
+
+      # Fetch "CORS-safelisted response-header name" — always exposed to script for a
+      # cross-origin response, without being listed in Access-Control-Expose-Headers.
+      CORS_SAFELISTED_RESPONSE_HEADERS = %w[
+        cache-control content-language content-length content-type expires last-modified pragma
+      ].freeze
+
+      # The response headers a cross-origin "cors" response exposes to getResponseHeader /
+      # getAllResponseHeaders: the CORS-safelisted set plus any named in Access-Control
+      # -Expose-Headers. `*` exposes every header, but ONLY for a non-credentialed response;
+      # with credentials the wildcard loses its meaning and matches a header literally named
+      # `*` (cors-expose-star "only matches literally").
+      # The virtual server delay a response carries (X-Csim-Server-Delay-Ms, ms), 0 if none.
+      def server_delay_ms_of(headers)
+        return 0 unless headers.is_a?(Hash)
+        pair = headers.find {|k, _| k.to_s.casecmp?('x-csim-server-delay-ms') }
+        pair ? pair.last.to_i : 0
+      end
+
+      def cors_exposed_headers(headers, credentialed = false)
+        # set-cookie / set-cookie2 are forbidden response-header names — NEVER exposed to
+        # script, even when explicitly named in Access-Control-Expose-Headers or covered by
+        # `*` (cors-filtering "header is forbidden"). x-csim-status-text is our internal
+        # reason-phrase sentinel (response_hash lifts it into statusText, which IS exposed
+        # cross-origin, then strips it from the script-visible map), so it must survive.
+        forbidden = %w[set-cookie set-cookie2]
+        expose    = cors_list(cors_header(headers, 'access-control-expose-headers')).map(&:downcase)
+        if !credentialed && expose.include?('*')
+          return headers.reject {|k, _| forbidden.include?(k.to_s.downcase) }
+        end
+        allowed = CORS_SAFELISTED_RESPONSE_HEADERS + expose + ['x-csim-status-text']
+        headers.select {|k, _| allowed.include?(k.to_s.downcase) && !forbidden.include?(k.to_s.downcase) }
+      end
+
+      # Case-insensitive response-header lookup + comma-list split for the CORS checks.
+      def cors_header(headers, name)
+        pair = headers.find {|k, _| k.to_s.downcase == name }
+        pair&.last.to_s
+      end
+
+      def cors_list(value)
+        value.to_s.split(',').map(&:strip).reject(&:empty?)
+      end
+
+      # The origin of a URL — `scheme://host[:port]` with the default port (80/443)
+      # elided — for the CORS same/cross-origin comparison. nil for a non-http(s) or
+      # unparseable URL (about:blank / data: / a relative current_url) so CORS never
+      # treats those as a comparable origin.
+      def url_origin(url)
+        u = URI.parse(url.to_s)
+        return nil unless u.scheme && u.host && u.scheme.match?(/\Ahttps?\z/i)
+        # An origin is (scheme, host, port) compared case-insensitively on scheme+host —
+        # so canonicalize both to lowercase, else http://Example.com vs http://example.com
+        # would mis-classify a same-origin request as cross-origin.
+        scheme  = u.scheme.downcase
+        default = scheme == 'https' ? 443 : 80
+        port    = u.port && u.port != default ? ":#{u.port}" : ''
+        "#{scheme}://#{u.host.downcase}#{port}"
+      rescue URI::InvalidURIError
+        nil
+      end
+
       def carry_fragment(from_url, to_url)
         from = URI.parse(from_url.to_s)
         to   = URI.parse(to_url.to_s)