@modelprofile.com/browser-runtime 4.3.0 → 5.0.0

package/ts/classes.runtime.ts

@@ -28,6 +28,7 @@ import type {
   IBrowserRuntimeOptions,
   IBrowserResourceRegistration,
   IBrowserRuntimeState,
+  IBrowserRuntimeViewportResult,
   IBrowserScreenshotResult,
   ICreateBrowserResourceRequest,
   TQualifiedBrowserSessionId,
@@ -116,6 +117,7 @@ type TCapabilityRecord = TBrowserCapabilityDescriptor & {
   expiryTimer: ReturnType<typeof setTimeout>;
   disconnect?: (signal: AbortSignal) => Promise<void> | void;
   lease?: ILeaseRecord;
+  acquiring?: boolean;
   revocationPromise?: Promise<void>;
   revocationInvokeDisconnect?: boolean;
   revocationComplete?: boolean;
@@ -135,8 +137,15 @@ interface ILeaseRecord {
   authorityGeneration: number;
   released: boolean;
   releasePromise?: Promise<void>;
-  releaseGeneration?: number;
-  releaseOwnsFence?: boolean;
+  preferredViewport?: plugins.smartpuppeteer.ILiveBrowserViewport;
+  heldKeys: Map<string, plugins.smartpuppeteer.ILiveBrowserKeyInput>;
+  heldButtons: Map<string, plugins.smartpuppeteer.ILiveBrowserMouseInput>;
+}
+
+export interface IBrowserRuntimeLeaseRenewalOptions {
+  signal?: AbortSignal;
+  /** Lifetime from successful reauthorization; defaults to the runtime capability lifetime. */
+  expiresInMs?: number;
 }
 
 interface IOperationRecord {
@@ -165,6 +174,8 @@ interface IQueuedOperationRecord {
   reject(error: unknown): void;
   state: 'queued' | 'starting' | 'active' | 'settled';
   onQueuedAbort?: () => void;
+  /** Resource-owned cleanup, admitted only for this exact released participant. */
+  participantCleanup?: boolean;
 }
 
 interface IOutstandingFrameRecord {
@@ -172,6 +183,7 @@ interface IOutstandingFrameRecord {
   timer?: ReturnType<typeof setTimeout>;
   session: ILiveBrowserSessionLike;
   incarnationGeneration: number;
+  producerAcknowledgement: Promise<TFrameAcknowledgementOutcome>;
 }
 
 type TFrameAcknowledgementOutcome =
@@ -202,6 +214,7 @@ interface IFrameRefreshRecord {
   abandoned: boolean;
   boundaryCandidate?: plugins.smartpuppeteer.ILiveBrowserFrameIdentity;
   failure?: BrowserRuntimeError;
+  producerFailure?: Promise<boolean>;
 }
 
 interface IResourceSlot {
@@ -222,12 +235,15 @@ interface IResourceSlot {
   proxy?: BrowserEgressProxy;
   profileDirectory?: string;
   unsubscribeSession?: () => void;
-  lease?: ILeaseRecord;
+  leases: Map<string, ILeaseRecord>;
   operation?: IOperationRecord;
   operationQueue: IQueuedOperationRecord[];
   operationSchedulerRunning: boolean;
-  frameSubscription?: IFrameSubscriptionRecord;
+  frameSubscriptions: Map<string, IFrameSubscriptionRecord>;
+  highestFrameSequence: number;
+  producerAcknowledgements: Set<Promise<TFrameAcknowledgementOutcome>>;
   frameRefresh?: IFrameRefreshRecord;
+  frameFailure?: { session: ILiveBrowserSessionLike; promise: Promise<boolean> };
   idleTimer?: ReturnType<typeof setTimeout>;
   lifecycleTail: Promise<void>;
   lifecycleOperationCount: number;
@@ -259,6 +275,8 @@ export class BrowserRuntime {
   private readonly failedRevocations = new Set<TCapabilityRecord>();
   private readonly capabilityMutex = new TransitionMutex();
   private readonly cleanupOperations = new Set<Promise<void>>();
+  // Retain admission until the host callback actually settles, including after cancellation.
+  private readonly leaseRenewals = new Set<ILeaseRecord>();
   private readonly framedPeers = new Set<BrowserRuntimeFramedServerPeer>();
   private startPromise?: Promise<void>;
   private stopPromise?: Promise<void>;
@@ -689,6 +707,10 @@ export class BrowserRuntime {
       permanentlyFenced: false,
       retirementPending: false,
       attachmentFenceCount: 0,
+      leases: new Map(),
+      frameSubscriptions: new Map(),
+      highestFrameSequence: 0,
+      producerAcknowledgements: new Set(),
       operationQueue: [],
       operationSchedulerRunning: false,
       lifecycleTail: Promise.resolve(),
@@ -831,7 +853,6 @@ export class BrowserRuntime {
     const sessionId = requestArg.sessionId === undefined
       ? undefined
       : this.validateQualifiedSessionId(requestArg.sessionId);
-    if (sessionId?.harnessId === 'codex') throw new BrowserRuntimeError('INVALID_INPUT');
     if (
       (role === 'agent' && !sessionId)
       || (role === 'human' && sessionId !== undefined)
@@ -839,7 +860,7 @@ export class BrowserRuntime {
         || sessionId?.harnessId !== 'flex'))
       || (source === 'mcp' && (scopeId !== undefined || channelId !== undefined
         || runId !== undefined
-        || sessionId?.harnessId !== 'opencode'))
+        || sessionId === undefined))
       || (source === 'human' && (scopeId !== undefined || channelId !== undefined
         || runId !== undefined))
     ) throw new BrowserRuntimeError('INVALID_INPUT');
@@ -1016,9 +1037,7 @@ export class BrowserRuntime {
     );
     const slot = this.getRegisteredSlot(capability.projectId, capability.browserResourceId);
     this.assertCapabilityStillAttached(capability, slot);
-    return capability.role === 'agent'
-      ? this.acquireAgentLease(slot, capability, digest, optionsArg)
-      : this.acquireHumanLease(slot, capability, digest, optionsArg);
+    return this.acquireParticipantLease(slot, capability, digest, optionsArg);
   }
 
   public authorizeCapability(
@@ -1130,6 +1149,75 @@ export class BrowserRuntime {
     return this.createLeaseAuthority(lease);
   }
 
+  /** @internal */
+  public async renewLease(
+    lease: ILeaseRecord,
+    optionsArg: IBrowserRuntimeLeaseRenewalOptions = {},
+  ): Promise<number> {
+    const options = validateExactKeys(optionsArg, ['signal', 'expiresInMs'], 'renewal');
+    if (options.signal !== undefined && !(options.signal instanceof AbortSignal)) {
+      throw new BrowserRuntimeError('INVALID_INPUT');
+    }
+    const lifetimeMs = validateOptionalInteger(
+      options.expiresInMs, 'expiresInMs', 1000,
+      this.options.capabilityMaximumTtlMs, this.options.capabilityDefaultTtlMs,
+    );
+    const authority = this.getLeaseAuthority(lease);
+    if (!this.isLeaseAuthorityCurrent(lease, authority)) throw new BrowserRuntimeError('FENCED');
+    if (this.leaseRenewals.has(lease)) throw new BrowserRuntimeError('BUSY');
+    if (this.leaseRenewals.size >= this.options.maxCapabilities) {
+      throw new BrowserRuntimeError('QUOTA_EXCEEDED');
+    }
+    const controller = new AbortController();
+    const signal = AbortSignal.any([
+      controller.signal, this.lifecycleController.signal, lease.controller.signal,
+      ...(optionsArg.signal ? [optionsArg.signal] : []),
+    ]);
+    signal.throwIfAborted();
+    const timeout = setTimeout(() => controller.abort(new BrowserRuntimeError('TIMEOUT')),
+      Math.min(this.options.authorizationTimeoutMs, lease.capability.expiresAt - Date.now()));
+    timeout.unref();
+    const binding = this.describeCapabilityIdentity(lease.capability);
+    if (binding.sessionId) Object.freeze(binding.sessionId);
+    Object.freeze(binding);
+    this.leaseRenewals.add(lease);
+    const authorization = Promise.resolve().then(() => {
+      signal.throwIfAborted();
+      return this.options.authorizeCapability(binding, signal);
+    });
+    void authorization.then(
+      () => this.leaseRenewals.delete(lease),
+      () => this.leaseRenewals.delete(lease),
+    );
+    let abortListener: (() => void) | undefined;
+    try {
+      const authorized = await new Promise<boolean>((resolve, reject) => {
+        abortListener = () => reject(signal.reason ?? new BrowserRuntimeError('ABORTED'));
+        signal.addEventListener('abort', abortListener, { once: true });
+        if (signal.aborted) abortListener();
+        void authorization.then(resolve, () => reject(new BrowserRuntimeError('AUTHORIZATION_DENIED')));
+      });
+      signal.throwIfAborted();
+      if (authorized !== true) throw new BrowserRuntimeError('AUTHORIZATION_DENIED');
+      // Neither expiry, release, attachment change nor incarnation replacement may be revived.
+      if (!this.isLeaseAuthorityCurrent(lease, authority)) throw new BrowserRuntimeError('CAPABILITY_REVOKED');
+      const capability = lease.capability;
+      const expiresAt = Date.now() + lifetimeMs;
+      clearTimeout(capability.expiryTimer);
+      capability.expiresAt = expiresAt;
+      capability.expiryTimer = setTimeout(() => {
+        if (capability.state === 'active') capability.state = 'expired';
+        this.trackCleanup(this.revokeCapabilityRecord(capability));
+      }, lifetimeMs);
+      capability.expiryTimer.unref();
+      return expiresAt;
+    } finally {
+      clearTimeout(timeout);
+      if (abortListener) signal.removeEventListener('abort', abortListener);
+      controller.abort(new BrowserRuntimeError('ABORTED'));
+    }
+  }
+
   /** @internal */
   public isLeaseAuthorityCurrent(
     lease: ILeaseRecord,
@@ -1248,17 +1336,61 @@ export class BrowserRuntime {
     lease: ILeaseRecord,
     viewport: plugins.smartpuppeteer.ILiveBrowserViewport,
     operationOptions: IBrowserRuntimeOperationOptions = {},
-  ): Promise<void> {
+  ): Promise<IBrowserRuntimeViewportResult> {
     this.requireHuman(lease);
-    await this.runOperation(
-      lease,
-      'setViewport',
-      'viewport',
-      operationOptions,
+    const preferredViewport = this.validatePreferredViewport(viewport);
+    return this.runOperation(lease, 'setViewport', 'viewport', operationOptions,
       async (signal, session) => {
+        const previous = lease.preferredViewport;
+        lease.preferredViewport = preferredViewport;
+        try {
+          return await this.applySharedViewport(lease.slot, session, signal);
+        } catch (error) {
+          lease.preferredViewport = previous;
+          throw error;
+        }
+      });
+  }
+
+  private validatePreferredViewport(
+    value: plugins.smartpuppeteer.ILiveBrowserViewport,
+  ): plugins.smartpuppeteer.ILiveBrowserViewport {
+    const record = validateExactKeys(value, ['width', 'height', 'deviceScaleFactor'], 'viewport');
+    const width = validateInteger(record.width, 'viewport.width', 1, 4096);
+    const height = validateInteger(record.height, 'viewport.height', 1, 4096);
+    const deviceScaleFactor = record.deviceScaleFactor;
+    if (typeof deviceScaleFactor !== 'number' || !Number.isFinite(deviceScaleFactor)
+      || deviceScaleFactor < 0.25 || deviceScaleFactor > 3
+      || Math.ceil(width * deviceScaleFactor) * Math.ceil(height * deviceScaleFactor)
+        > maxScreencastPixelArea
+    ) throw new BrowserRuntimeError('INVALID_INPUT');
+    return { width, height, deviceScaleFactor };
+  }
+
+  private async applySharedViewport(
+    slot: IResourceSlot,
+    session: ILiveBrowserSessionLike,
+    signal: AbortSignal,
+  ): Promise<IBrowserRuntimeViewportResult> {
+    const preferences = [...slot.leases.values()]
+      .filter((lease) => lease.role === 'human' && !lease.released && lease.preferredViewport)
+      .map((lease) => lease.preferredViewport!);
+    const current = session.getState();
+    const viewport = preferences.length ? {
+      width: Math.min(...preferences.map((value) => value.width)),
+      height: Math.min(...preferences.map((value) => value.height)),
+      deviceScaleFactor: Math.min(...preferences.map((value) => value.deviceScaleFactor)),
+    } : current.viewport;
+    if (
+      viewport.width !== current.viewport.width || viewport.height !== current.viewport.height
+      || viewport.deviceScaleFactor !== current.viewport.deviceScaleFactor
+    ) {
+      await this.releaseAllParticipantInput(slot, session);
+      signal.throwIfAborted();
       await session.setViewport(viewport, { signal });
-      },
-    );
+    }
+    const state = session.getState();
+    return { viewport: { ...state.viewport }, viewportRevision: state.viewportRevision };
   }
 
   /** @internal */
@@ -1269,7 +1401,7 @@ export class BrowserRuntime {
     this.requireHuman(lease);
     this.requireValidLease(lease);
     const slot = lease.slot;
-    const subscription = slot.frameSubscription;
+    const subscription = slot.frameSubscriptions.get(lease.leaseId);
     if (!subscription || subscription.closed || subscription.lease !== lease) {
       throw new BrowserRuntimeError('BUSY');
     }
@@ -1308,17 +1440,161 @@ export class BrowserRuntime {
     this.requireHuman(lease);
     await this.runOperation(lease, action, 'raw-input', operationOptions, async (_signal, session) => {
       if (action === 'dispatchMouse') {
-        await session.dispatchMouse(input as plugins.smartpuppeteer.ILiveBrowserMouseInput);
+        const mouse = input as plugins.smartpuppeteer.ILiveBrowserMouseInput;
+        if (mouse.type === 'down') {
+          this.validateHeldInputTarget(session, mouse);
+          if (!['none', 'left', 'middle', 'right', 'back', 'forward'].includes(mouse.button ?? 'left')
+            || !Number.isFinite(mouse.x) || !Number.isFinite(mouse.y) || mouse.x < 0 || mouse.y < 0
+          ) throw new BrowserRuntimeError('INVALID_INPUT');
+        }
+        const key = this.mouseOwnershipKey(mouse);
+        if (mouse.type === 'up' && this.otherParticipantHolds(lease, 'heldButtons', key)) {
+          lease.heldButtons.delete(key);
+          return;
+        }
+        if (mouse.type === 'down' && lease.heldButtons.size >= 5 && !lease.heldButtons.has(key)) {
+          throw new BrowserRuntimeError('QUOTA_EXCEEDED');
+        }
+        if (mouse.type === 'down') lease.heldButtons.set(key, { ...mouse });
+        await session.dispatchMouse({ ...mouse,
+          buttons: this.sharedMouseButtons(lease.slot, mouse.tabId,
+            mouse.type === 'up' ? { lease, key } : undefined),
+          modifiers: this.sharedModifiers(lease.slot, mouse.tabId, mouse.modifiers),
+        });
+        if (mouse.type === 'up') lease.heldButtons.delete(key);
       } else if (action === 'dispatchWheel') {
-        await session.dispatchWheel(input as plugins.smartpuppeteer.ILiveBrowserWheelInput);
+        const wheel = input as plugins.smartpuppeteer.ILiveBrowserWheelInput;
+        await session.dispatchWheel({ ...wheel,
+          modifiers: this.sharedModifiers(lease.slot, wheel.tabId, wheel.modifiers),
+        });
       } else if (action === 'dispatchKey') {
-        await session.dispatchKey(input as plugins.smartpuppeteer.ILiveBrowserKeyInput);
+        const keyInput = input as plugins.smartpuppeteer.ILiveBrowserKeyInput;
+        if (keyInput.type === 'down') {
+          this.validateHeldInputTarget(session, keyInput);
+          if (typeof keyInput.key !== 'string' || keyInput.key.length < 1 || keyInput.key.length > 64
+            || (keyInput.code !== undefined && (typeof keyInput.code !== 'string'
+              || keyInput.code.length < 1 || keyInput.code.length > 64))
+          ) throw new BrowserRuntimeError('INVALID_INPUT');
+        }
+        const key = this.keyOwnershipKey(keyInput);
+        if (keyInput.type === 'up' && this.otherParticipantHolds(lease, 'heldKeys', key)) {
+          lease.heldKeys.delete(key);
+          return;
+        }
+        if (keyInput.type === 'down' && lease.heldKeys.size >= 64 && !lease.heldKeys.has(key)) {
+          throw new BrowserRuntimeError('QUOTA_EXCEEDED');
+        }
+        if (keyInput.type === 'down') lease.heldKeys.set(key, { ...keyInput });
+        await session.dispatchKey({ ...keyInput,
+          modifiers: this.sharedModifiers(lease.slot, keyInput.tabId, keyInput.modifiers,
+            keyInput.type === 'up' ? { lease, key } : undefined),
+        });
+        if (keyInput.type === 'up') lease.heldKeys.delete(key);
       } else {
         await session.insertText(input as plugins.smartpuppeteer.ILiveBrowserInsertTextInput);
       }
     });
   }
 
+  private keyOwnershipKey(input: plugins.smartpuppeteer.ILiveBrowserKeyInput): string {
+    return JSON.stringify([input.tabId, input.code ?? input.key]);
+  }
+
+  private validateHeldInputTarget(
+    session: ILiveBrowserSessionLike,
+    input: plugins.smartpuppeteer.ILiveBrowserInputBase,
+  ): void {
+    const state = session.getState();
+    const tab = state.tabs.find((value) => value.id === state.activeTabId);
+    if (!tab || tab.status !== 'open' || tab.id !== input.tabId
+      || tab.generation !== input.generation || state.viewportRevision !== input.viewportRevision
+    ) throw new BrowserRuntimeError('INVALID_INPUT');
+  }
+
+  private mouseOwnershipKey(input: plugins.smartpuppeteer.ILiveBrowserMouseInput): string {
+    return JSON.stringify([input.tabId, input.button ?? 'left']);
+  }
+
+  private otherParticipantHolds(
+    lease: ILeaseRecord, kind: 'heldKeys' | 'heldButtons', key: string,
+  ): boolean {
+    return [...lease.slot.leases.values()].some((other) => other !== lease && other[kind].has(key));
+  }
+
+  private sharedMouseButtons(
+    slot: IResourceSlot,
+    tabId: string,
+    excluding?: { lease: ILeaseRecord; key: string },
+  ): number {
+    const masks = { left: 1, right: 2, middle: 4, back: 8, forward: 16, none: 0 };
+    let buttons = 0;
+    for (const lease of slot.leases.values()) {
+      for (const [key, input] of lease.heldButtons) {
+        if (input.tabId !== tabId || (excluding?.lease === lease && excluding.key === key)) continue;
+        buttons |= masks[input.button ?? 'left'];
+      }
+    }
+    return buttons;
+  }
+
+  private sharedModifiers(
+    slot: IResourceSlot,
+    tabId: string,
+    supplied?: plugins.smartpuppeteer.ILiveBrowserModifierState,
+    excluding?: { lease: ILeaseRecord; key: string },
+  ): plugins.smartpuppeteer.ILiveBrowserModifierState {
+    const modifiers = { ...supplied };
+    for (const lease of slot.leases.values()) {
+      for (const [key, input] of lease.heldKeys) {
+        if (input.tabId !== tabId || (excluding?.lease === lease && excluding.key === key)) continue;
+        if (input.key === 'Shift') modifiers.shift = true;
+        else if (input.key === 'Control') modifiers.control = true;
+        else if (input.key === 'Alt') modifiers.alt = true;
+        else if (input.key === 'Meta') modifiers.meta = true;
+      }
+    }
+    return modifiers;
+  }
+
+  private async releaseAllParticipantInput(
+    slot: IResourceSlot, session: ILiveBrowserSessionLike,
+  ): Promise<void> {
+    for (const lease of slot.leases.values()) await this.releaseParticipantInput(lease, session);
+  }
+
+  private async releaseParticipantInput(
+    lease: ILeaseRecord, session: ILiveBrowserSessionLike,
+  ): Promise<void> {
+    if (!lease.heldKeys.size && !lease.heldButtons.size) return;
+    let state = session.getState();
+    let tab = state.tabs.find((value) => value.id === state.activeTabId);
+    if (tab?.status === 'open' && !tab.streaming) {
+      await session.refreshScreencast();
+      state = session.getState();
+      tab = state.tabs.find((value) => value.id === state.activeTabId);
+    }
+    const target = tab?.status === 'open'
+      ? { tabId: tab.id, generation: tab.generation, viewportRevision: state.viewportRevision }
+      : undefined;
+    for (const [key, input] of lease.heldKeys) {
+      if (!this.otherParticipantHolds(lease, 'heldKeys', key) && target?.tabId === input.tabId) {
+        await session.dispatchKey({ ...target, type: 'up', key: input.key, code: input.code,
+          modifiers: this.sharedModifiers(lease.slot, input.tabId, undefined, { lease, key }) });
+      }
+      lease.heldKeys.delete(key);
+    }
+    for (const [key, input] of lease.heldButtons) {
+      if (!this.otherParticipantHolds(lease, 'heldButtons', key) && target?.tabId === input.tabId) {
+        await session.dispatchMouse({ ...target, type: 'up', button: input.button,
+          buttons: this.sharedMouseButtons(lease.slot, input.tabId, { lease, key }),
+          x: Math.min(input.x, state.viewport.width - 1),
+          y: Math.min(input.y, state.viewport.height - 1),
+          modifiers: this.sharedModifiers(lease.slot, input.tabId) });
+      }
+      lease.heldButtons.delete(key);
+    }
+  }
+
   /** @internal */
   public async subscribeLeaseEvents(
     lease: ILeaseRecord,
@@ -1332,7 +1608,7 @@ export class BrowserRuntime {
     let subscription: IFrameSubscriptionRecord;
     try {
       this.requireValidLease(lease);
-      if (slot.frameSubscription || slot.frameRefresh) throw new BrowserRuntimeError('BUSY');
+      if (slot.frameSubscriptions.has(lease.leaseId)) throw new BrowserRuntimeError('BUSY');
       subscription = {
         lease,
         listener,
@@ -1340,7 +1616,7 @@ export class BrowserRuntime {
         highestSequence: 0,
         closed: false,
       };
-      slot.frameSubscription = subscription;
+      slot.frameSubscriptions.set(lease.leaseId, subscription);
       this.pushToSubscription(subscription, {
         type: 'state',
         state: this.resourceState(slot.session!.getState()),
@@ -1359,45 +1635,13 @@ export class BrowserRuntime {
     acknowledgementArg: plugins.smartpuppeteer.ILiveBrowserFrameAcknowledgementRequest,
   ): Promise<boolean> {
     this.requireHuman(lease);
-    const acknowledgement = this.validateFrameAcknowledgement(acknowledgementArg, true);
-    const key = this.frameAcknowledgementKey(acknowledgement);
-    const slot = lease.slot;
-    const subscription = slot.frameSubscription;
     this.requireValidLease(lease);
-    if (!subscription || subscription.lease !== lease) return false;
-    const outstanding = subscription.outstanding.get(key);
-    if (!outstanding) return false;
-    const { session, incarnationGeneration } = outstanding;
-    const refresh = this.matchingFrameRefresh(
-      slot,
-      subscription,
-      session,
-      incarnationGeneration,
-    );
-    if (refresh?.admissionClosed) {
-      subscription.outstanding.delete(key);
-      if (outstanding.timer) clearTimeout(outstanding.timer);
-      outstanding.timer = undefined;
-      return false;
-    }
-    subscription.outstanding.delete(key);
-    if (outstanding.timer) clearTimeout(outstanding.timer);
-    outstanding.timer = undefined;
-    const refreshOwned = Boolean(refresh && !refresh.abandoned);
-    const outcome = await this.beginFrameAcknowledgement(
-      session,
-      outstanding.acknowledgement,
-      refreshOwned ? refresh : undefined,
+    const acknowledgement = this.validateFrameAcknowledgement(acknowledgementArg, true);
+    const subscription = lease.slot.frameSubscriptions.get(lease.leaseId);
+    if (!subscription) return false;
+    return this.retireOutstandingFrame(
+      subscription, this.frameAcknowledgementKey(acknowledgement),
     );
-    if (outcome.status === 'fulfilled') return outcome.accepted;
-    if (refreshOwned) return false;
-    if (refresh && slot.frameRefresh === refresh) {
-      this.failFrameRefresh(refresh, 'FRAME_STREAM_FAILED');
-      return false;
-    }
-    await this.options.beforeFrameFailureTermination?.();
-    await this.handleFrameFailure(slot, session, incarnationGeneration, subscription.lease);
-    return false;
   }
 
   /** @internal */
@@ -1581,19 +1825,21 @@ export class BrowserRuntime {
     }
   }
 
-  private async acquireAgentLease(
+  private async acquireParticipantLease(
     slot: IResourceSlot,
     capability: TCapabilityRecord,
     digest: plugins.Buffer,
     acquisition: TAcquireBrowserRuntimeLeaseOptions,
   ): Promise<BrowserRuntimeLease> {
-    const release = slot.mutex.tryAcquire();
-    if (!release) throw new BrowserRuntimeError('BUSY');
+    this.assertSlotAvailable(slot);
+    if (capability.lease || capability.acquiring) throw new BrowserRuntimeError('BUSY');
+    capability.acquiring = true;
+    let release: (() => void) | undefined;
     try {
+      release = await slot.mutex.acquire();
       this.assertSlotAvailable(slot);
       this.resolveCapability(digest, this.validateExpectedCapabilityBinding(acquisition));
       this.assertCapabilityStillAttached(capability, slot);
-      if (slot.lease || slot.operation) throw new BrowserRuntimeError('BUSY');
       await this.ensureSession(slot, acquisition.signal);
       await this.options.beforeLeasePublication?.();
       this.throwIfAcquisitionAborted(acquisition.signal);
@@ -1603,84 +1849,11 @@ export class BrowserRuntime {
       const lease = this.createLeaseRecord(slot, capability, digest);
       return new BrowserRuntimeLease(this, lease);
     } catch (error) {
-      if (slot.session && !slot.lease) this.scheduleIdleTermination(slot);
+      if (slot.session && slot.leases.size === 0) this.scheduleIdleTermination(slot);
       throw error;
     } finally {
-      release();
-    }
-  }
-
-  private async acquireHumanLease(
-    slot: IResourceSlot,
-    capability: TCapabilityRecord,
-    digest: plugins.Buffer,
-    acquisition: TAcquireBrowserRuntimeLeaseOptions,
-  ): Promise<BrowserRuntimeLease> {
-    const release = await slot.mutex.acquire();
-    let generation = 0;
-    let preemptedLease: ILeaseRecord | undefined;
-    try {
-      this.assertSlotAvailable(slot);
-      this.resolveCapability(digest, this.validateExpectedCapabilityBinding(acquisition));
-      this.assertCapabilityStillAttached(capability, slot);
-      this.throwIfAcquisitionAborted(acquisition.signal);
-      if (slot.fencingGeneration !== undefined) throw new BrowserRuntimeError('BUSY');
-      if (slot.lease?.role === 'human') throw new BrowserRuntimeError('BUSY');
-      generation = ++slot.arbitrationGeneration;
-      slot.fencingGeneration = generation;
-      preemptedLease = slot.lease;
-      if (preemptedLease) {
-        preemptedLease.released = true;
-        preemptedLease.controller.abort(new BrowserRuntimeError('ABORTED'));
-        slot.operation?.controller.abort(new BrowserRuntimeError('ABORTED'));
-        this.notifyFramedLeaseEnded(preemptedLease);
-      }
-    } finally {
-      release();
-    }
-
-    try {
-      if (preemptedLease) await this.quiesceSlot(slot);
-      this.throwIfAcquisitionAborted(acquisition.signal);
-      const finalRelease = await slot.mutex.acquire();
-      try {
-        if (slot.arbitrationGeneration !== generation || slot.fencingGeneration !== generation) {
-          throw new BrowserRuntimeError('BUSY');
-        }
-        if (preemptedLease) {
-          if (preemptedLease.capability.lease === preemptedLease) {
-            preemptedLease.capability.lease = undefined;
-          }
-          if (slot.lease === preemptedLease) slot.lease = undefined;
-        }
-        if (slot.permanentlyFenced) throw new BrowserRuntimeError('FENCED');
-        slot.fencingGeneration = undefined;
-        await this.ensureSession(slot, acquisition.signal);
-        await this.options.beforeLeasePublication?.();
-        this.throwIfAcquisitionAborted(acquisition.signal);
-        this.assertSlotAvailable(slot);
-        this.resolveCapability(digest, this.validateExpectedCapabilityBinding(acquisition));
-        this.assertCapabilityStillAttached(capability, slot);
-        const lease = this.createLeaseRecord(slot, capability, digest);
-        return new BrowserRuntimeLease(this, lease);
-      } finally {
-        finalRelease();
-      }
-    } catch (error) {
-      const cleanupRelease = await slot.mutex.acquire();
-      try {
-        if (preemptedLease) {
-          if (preemptedLease.capability.lease === preemptedLease) {
-            preemptedLease.capability.lease = undefined;
-          }
-          if (slot.lease === preemptedLease) slot.lease = undefined;
-        }
-        if (slot.fencingGeneration === generation) slot.fencingGeneration = undefined;
-        if (slot.session && !slot.lease) this.scheduleIdleTermination(slot);
-      } finally {
-        cleanupRelease();
-      }
-      throw error;
+      capability.acquiring = false;
+      release?.();
     }
   }
 
@@ -1691,7 +1864,7 @@ export class BrowserRuntime {
   ): ILeaseRecord {
     this.assertSlotAvailable(slot);
     this.assertCapabilityStillAttached(capability, slot);
-    if (capability.lease || slot.lease) throw new BrowserRuntimeError('BUSY');
+    if (capability.lease) throw new BrowserRuntimeError('BUSY');
     if (slot.idleTimer) {
       clearTimeout(slot.idleTimer);
       slot.idleTimer = undefined;
@@ -1711,8 +1884,10 @@ export class BrowserRuntime {
       controller: new AbortController(),
       authorityGeneration: slot.authorityGeneration,
       released: false,
+      heldKeys: new Map(),
+      heldButtons: new Map(),
     };
-    slot.lease = lease;
+    slot.leases.set(lease.leaseId, lease);
     capability.lease = lease;
     return lease;
   }
@@ -1877,6 +2052,7 @@ export class BrowserRuntime {
     operationOptions: IBrowserRuntimeOperationOptions,
     execute: (signal: AbortSignal, session: ILiveBrowserSessionLike) => Promise<T>,
     finalize?: () => Promise<void>,
+    participantCleanup = false,
   ): Promise<T> {
     if (!operationOptions || typeof operationOptions !== 'object') {
       throw new BrowserRuntimeError('INVALID_INPUT');
@@ -1891,16 +2067,21 @@ export class BrowserRuntime {
     ) throw new BrowserRuntimeError('INVALID_INPUT');
     if (operationOptions.signal?.aborted) throw new BrowserRuntimeError('ABORTED');
     const slot = lease.slot;
-    this.requireValidLease(lease);
+    this.requireQueuedLease(lease, participantCleanup);
     this.assertSlotAvailable(slot);
-    if (slot.operationQueue.length >= this.options.maxQueuedOperationsPerLease) {
+    if (!participantCleanup && (
+      slot.operationQueue.filter((entry) => entry.lease === lease).length
+        >= this.options.maxQueuedOperationsPerLease
+      || slot.operationQueue.length >= this.options.maxQueuedOperationsPerLease
+        * this.options.maxCapabilitiesPerResource
+    )) {
       throw new BrowserRuntimeError('QUOTA_EXCEEDED');
     }
     const timeoutMs = operationOptions.timeoutMs === undefined
       ? this.options.operationTimeoutMs
       : validateInteger(operationOptions.timeoutMs, 'timeoutMs', 100, 120_000);
     const signal = AbortSignal.any([
-      lease.controller.signal,
+      ...(participantCleanup ? [] : [lease.controller.signal]),
       this.lifecycleController.signal,
       operationOptions.signal ?? new AbortController().signal,
     ]);
@@ -1919,6 +2100,7 @@ export class BrowserRuntime {
         resolve: (value) => resolve(value as T),
         reject,
         state: 'queued',
+        participantCleanup,
       };
       const onQueuedAbort = (): void => {
         if (queued.state !== 'queued' && queued.state !== 'starting') return;
@@ -1928,7 +2110,15 @@ export class BrowserRuntime {
         }
         queued.state = 'settled';
         signal.removeEventListener('abort', onQueuedAbort);
-        reject(this.queuedOperationAbortError(queued));
+        const error = this.queuedOperationAbortError(queued);
+        const frameFailure = slot.frameFailure;
+        if (frameFailure && frameFailure.session === slot.session) {
+          // Stop admission immediately, but expose the terminal result only
+          // after cleanup of the failed producer's incarnation has settled.
+          void frameFailure.promise.then(() => reject(error), reject);
+        } else {
+          reject(error);
+        }
       };
       queued.onQueuedAbort = onQueuedAbort;
       signal.addEventListener('abort', onQueuedAbort, { once: true });
@@ -1992,7 +2182,7 @@ export class BrowserRuntime {
     try {
       if (queued.state === 'settled') return undefined;
       queued.signal.throwIfAborted();
-      this.requireValidLease(lease);
+      this.requireQueuedLease(lease, queued.participantCleanup);
       this.assertSlotAvailable(slot);
       if (slot.operation) throw new BrowserRuntimeError('BUSY');
       session = slot.session!;
@@ -2053,13 +2243,12 @@ export class BrowserRuntime {
     let executionStarted = false;
     let executionSettled = false;
     try {
-      await this.runBeforeOperation(operationIdentity, combinedSignal);
+      if (!queued.participantCleanup) await this.runBeforeOperation(operationIdentity, combinedSignal);
       const executionRelease = await slot.mutex.acquire();
       try {
         combinedSignal.throwIfAborted();
-        this.requireValidLease(lease);
+        this.requireQueuedLease(lease, queued.participantCleanup);
         this.assertSlotAvailable(slot);
-        this.assertCapabilityStillAttached(lease.capability, slot);
         if (
           slot.operation !== operation
           || slot.session !== session
@@ -2067,7 +2256,13 @@ export class BrowserRuntime {
           || slot.incarnationGeneration !== incarnationGeneration
         ) throw new BrowserRuntimeError('ABORTED');
         executionStarted = true;
-        executionPromise = queued.execute(combinedSignal, session);
+        executionPromise = (async () => {
+          if (classification === 'navigation' || classification === 'tab') {
+            await this.releaseAllParticipantInput(slot, session);
+          }
+          combinedSignal.throwIfAborted();
+          return queued.execute(combinedSignal, session);
+        })();
         operation.promise = executionPromise.then(() => undefined, () => undefined).finally(() => {
           executionSettled = true;
         });
@@ -2085,8 +2280,7 @@ export class BrowserRuntime {
         combinedSignal.removeEventListener('abort', onAbort);
       }
       if (combinedSignal.aborted) throw combinedSignal.reason;
-      this.requireValidLease(lease);
-      this.assertCapabilityStillAttached(lease.capability, slot);
+      this.requireQueuedLease(lease, queued.participantCleanup);
       if (slot.session !== session! || slot.arbitrationGeneration !== generation!) {
         throw new BrowserRuntimeError('ABORTED');
       }
@@ -2128,6 +2322,12 @@ export class BrowserRuntime {
           failure = error;
         }
       }
+      if (slot.frameFailure?.session === session) {
+        try { await slot.frameFailure.promise; } catch (error) {
+          failed = true;
+          failure = error;
+        }
+      }
       const errorCode = failed ? this.operationErrorCode(failure) : undefined;
       await this.emitAudit(Object.freeze({
         ...operationIdentity,
@@ -2455,10 +2655,10 @@ export class BrowserRuntime {
   ): IFrameRefreshRecord {
     if (
       slot.frameRefresh
-      || slot.frameSubscription !== subscription
+      || slot.frameSubscriptions.get(lease.leaseId) !== subscription
       || subscription.closed
       || subscription.lease !== lease
-      || slot.lease !== lease
+      || slot.leases.get(lease.leaseId) !== lease
       || slot.session !== session
     ) throw new BrowserRuntimeError('BUSY');
     const state = session.getState();
@@ -2467,7 +2667,7 @@ export class BrowserRuntime {
       !activeTab
       || !activeTab.active
       || activeTab.status !== 'open'
-      || !activeTab.streaming
+      || state.status !== 'running'
     ) throw new BrowserRuntimeError('BUSY');
     const refresh: IFrameRefreshRecord = {
       lease,
@@ -2477,7 +2677,7 @@ export class BrowserRuntime {
       initialTabId: activeTab.id,
       initialGeneration: activeTab.generation,
       initialViewportRevision: state.viewportRevision,
-      startingHighestSequence: subscription.highestSequence,
+      startingHighestSequence: slot.highestFrameSequence,
       pendingAcknowledgements: new Set(),
       refreshStarted: false,
       admissionClosed: false,
@@ -2527,17 +2727,17 @@ export class BrowserRuntime {
   }
 
   private async drainFrameRefreshOutstanding(refresh: IFrameRefreshRecord): Promise<void> {
-    const outstanding = [...refresh.subscription.outstanding.values()];
-    refresh.subscription.outstanding.clear();
-    for (const frame of outstanding) {
-      if (frame.timer) clearTimeout(frame.timer);
-      frame.timer = undefined;
+    const slot = refresh.lease.slot;
+    for (const subscription of slot.frameSubscriptions.values()) {
+      for (const frame of subscription.outstanding.values()) {
+        if (frame.timer) clearTimeout(frame.timer);
+      }
+      subscription.outstanding.clear();
+    }
+    const outcomes = await Promise.all([...slot.producerAcknowledgements]);
+    if (outcomes.some((outcome) => outcome.status !== 'fulfilled')) {
+      this.failFrameRefresh(refresh, 'FRAME_STREAM_FAILED');
     }
-    await Promise.all(outstanding.map((frame) => this.beginFrameAcknowledgement(
-      frame.session,
-      frame.acknowledgement,
-      refresh,
-    )));
   }
 
   private validateFrameRefreshBoundary(
@@ -2569,25 +2769,23 @@ export class BrowserRuntime {
     refresh: IFrameRefreshRecord,
     identity: plugins.smartpuppeteer.ILiveBrowserFrameIdentity,
   ): Promise<void> {
-    const retirements: Array<Promise<TFrameAcknowledgementOutcome>> = [];
-    for (const [key, frame] of refresh.subscription.outstanding) {
-      const acknowledgement = frame.acknowledgement;
-      if (
-        acknowledgement.tabId === identity.tabId
-        && acknowledgement.generation === identity.generation
-        && acknowledgement.viewportRevision === identity.viewportRevision
-        && acknowledgement.sequence >= identity.sequence
-      ) continue;
-      refresh.subscription.outstanding.delete(key);
-      if (frame.timer) clearTimeout(frame.timer);
-      frame.timer = undefined;
-      retirements.push(this.beginFrameAcknowledgement(
-        frame.session,
-        acknowledgement,
-        refresh,
-      ));
+    for (const subscription of refresh.lease.slot.frameSubscriptions.values()) {
+      for (const [key, frame] of subscription.outstanding) {
+        const acknowledgement = frame.acknowledgement;
+        if (
+          acknowledgement.tabId === identity.tabId
+          && acknowledgement.generation === identity.generation
+          && acknowledgement.viewportRevision === identity.viewportRevision
+          && acknowledgement.sequence >= identity.sequence
+        ) continue;
+        subscription.outstanding.delete(key);
+        if (frame.timer) clearTimeout(frame.timer);
+      }
+    }
+    const outcomes = await Promise.all([...refresh.lease.slot.producerAcknowledgements]);
+    if (outcomes.some((outcome) => outcome.status !== 'fulfilled')) {
+      this.failFrameRefresh(refresh, 'FRAME_STREAM_FAILED');
     }
-    await Promise.all(retirements);
   }
 
   private beginFrameAcknowledgement(
@@ -2621,14 +2819,14 @@ export class BrowserRuntime {
     refresh: IFrameRefreshRecord,
   ): Promise<void> {
     if (refresh.failure) {
-      await this.options.beforeFrameFailureTermination?.();
-      const claimed = await this.handleFrameFailure(
-        slot,
-        refresh.session,
-        refresh.incarnationGeneration,
-        refresh.lease,
-        refresh,
-      );
+      let claimed: boolean;
+      if (refresh.producerFailure) claimed = await refresh.producerFailure;
+      else {
+        await this.options.beforeFrameFailureTermination?.();
+        claimed = await this.handleFrameFailure(
+          slot, refresh.session, refresh.incarnationGeneration, refresh,
+        );
+      }
       if (!claimed) {
         this.abandonFrameRefresh(slot, refresh);
         throw new BrowserRuntimeError('ABORTED');
@@ -2643,7 +2841,7 @@ export class BrowserRuntime {
         this.requireValidLease(refresh.lease);
         current = slot.frameRefresh === refresh
           && !refresh.abandoned
-          && slot.frameSubscription === refresh.subscription
+          && slot.frameSubscriptions.get(refresh.lease.leaseId) === refresh.subscription
           && !refresh.subscription.closed
           && slot.session === refresh.session
           && slot.incarnationGeneration === refresh.incarnationGeneration;
@@ -2671,7 +2869,7 @@ export class BrowserRuntime {
     refresh.abandoned = true;
     slot.frameRefresh = undefined;
     if (
-      slot.frameSubscription === refresh.subscription
+      slot.frameSubscriptions.get(refresh.lease.leaseId) === refresh.subscription
       && !refresh.subscription.closed
       && slot.session === refresh.session
       && slot.incarnationGeneration === refresh.incarnationGeneration
@@ -2689,274 +2887,140 @@ export class BrowserRuntime {
   ): void {
     if (frame.timer || subscription.closed || !subscription.outstanding.has(key)) return;
     const timer = setTimeout(() => {
-      // A late application acknowledgement retires the entry exactly like oldest-first
-      // eviction: the frame is acknowledged toward the session and the lease is untouched.
-      this.trackCleanup(this.retireOutstandingFrame(subscription, key, false).then(() => undefined));
+      // Viewer lag retires only its local window; producer acknowledgement already started.
+      this.trackCleanup(this.retireOutstandingFrame(subscription, key).then(() => undefined));
     }, this.options.frameAcknowledgementTimeoutMs);
     timer.unref();
     frame.timer = timer;
   }
 
-  private matchingFrameRefresh(
-    slot: IResourceSlot,
-    subscription: IFrameSubscriptionRecord,
-    session: ILiveBrowserSessionLike,
-    incarnationGeneration: number,
-  ): IFrameRefreshRecord | undefined {
-    const refresh = slot.frameRefresh;
-    return refresh
-      && !refresh.abandoned
-      && refresh.subscription === subscription
-      && refresh.lease === subscription.lease
-      && refresh.session === session
-      && refresh.incarnationGeneration === incarnationGeneration
-      ? refresh
-      : undefined;
-  }
-
   private handleSessionEvent(
     slot: IResourceSlot,
     session: ILiveBrowserSessionLike,
     event: plugins.smartpuppeteer.TLiveBrowserEvent,
   ): void {
-    if (slot.session && slot.session !== session) {
-      if (event.type === 'frame') {
-        this.trackCleanup(this.acknowledgeFrameInBackground(slot, session, {
-          tabId: event.frame.tabId,
-          sequence: event.frame.sequence,
-          generation: event.frame.generation,
-          viewportRevision: event.frame.viewportRevision,
-        }));
-      }
-      return;
-    }
-    const subscription = slot.frameSubscription;
-    const refreshForSession = slot.frameRefresh
-      && !slot.frameRefresh.abandoned
-      && slot.frameRefresh.session === session
-      && slot.frameRefresh.incarnationGeneration === slot.incarnationGeneration
-      ? slot.frameRefresh
-      : undefined;
+    if (slot.session && slot.session !== session) return;
+    const incarnationGeneration = slot.incarnationGeneration;
+    const refresh = slot.frameRefresh?.session === session && !slot.frameRefresh.abandoned
+      ? slot.frameRefresh : undefined;
     if (event.type === 'frame') {
       let acknowledgement: plugins.smartpuppeteer.ILiveBrowserFrameAcknowledgementRequest;
       try {
-        if (!(event.frame.data instanceof Uint8Array)) {
-          throw new BrowserRuntimeError('INVALID_INPUT');
-        }
+        if (!(event.frame.data instanceof Uint8Array)) throw new BrowserRuntimeError('INVALID_INPUT');
         acknowledgement = this.validateFrameAcknowledgement(event.frame);
-      } catch {
-        if (refreshForSession) {
-          this.failFrameRefresh(refreshForSession, 'FRAME_STREAM_FAILED');
-          return;
+        if (acknowledgement.sequence <= slot.highestFrameSequence) {
+          throw new BrowserRuntimeError('FRAME_STREAM_FAILED');
         }
-        const failedLease = slot.session === session ? (slot.lease ?? null) : null;
-        this.trackCleanup(this.handleFrameFailure(
-          slot,
-          session,
-          slot.incarnationGeneration,
-          failedLease,
-        ).then(() => undefined));
-        return;
-      }
-      if (!subscription || subscription.closed) {
-        if (refreshForSession) {
-          this.failFrameRefresh(refreshForSession, 'FRAME_STREAM_FAILED');
-          return;
+        if (slot.producerAcknowledgements.size >= this.options.maxOutstandingFrames) {
+          throw new BrowserRuntimeError('FRAME_STREAM_FAILED');
         }
-        this.trackCleanup(this.acknowledgeFrameInBackground(slot, session, acknowledgement));
-        return;
-      }
-      const refresh = this.matchingFrameRefresh(
-        slot,
-        subscription,
-        session,
-        slot.incarnationGeneration,
-      );
-      if (refreshForSession && refreshForSession !== refresh) {
-        this.failFrameRefresh(refreshForSession, 'FRAME_STREAM_FAILED');
-        return;
-      }
-      try {
-        this.requireValidLease(subscription.lease);
       } catch {
-        if (refresh) {
-          this.failFrameRefresh(refresh, 'FRAME_STREAM_FAILED');
-          return;
-        }
-        this.trackCleanup(this.acknowledgeFrameInBackground(slot, session, acknowledgement));
-        this.trackCleanup(this.revokeCapabilityRecord(subscription.lease.capability));
+        if (refresh) this.failFrameRefresh(refresh, 'FRAME_STREAM_FAILED');
+        else this.trackCleanup(this.handleFrameFailure(slot, session, incarnationGeneration).then(() => undefined));
         return;
       }
-      const key = this.frameAcknowledgementKey(acknowledgement);
-      if (acknowledgement.sequence <= subscription.highestSequence) {
-        if (refresh) {
+      slot.highestFrameSequence = acknowledgement.sequence;
+      // The producer has one bounded ACK, independent of how quickly any viewer paints.
+      const producerAcknowledgement = this.beginFrameAcknowledgement(
+        session, acknowledgement, refresh,
+      );
+      slot.producerAcknowledgements.add(producerAcknowledgement);
+      this.trackCleanup(producerAcknowledgement.then(async (outcome) => {
+        slot.producerAcknowledgements.delete(producerAcknowledgement);
+        if (outcome.status === 'fulfilled') return;
+        if (refresh && slot.frameRefresh === refresh && !refresh.abandoned) {
           this.failFrameRefresh(refresh, 'FRAME_STREAM_FAILED');
           return;
         }
-        this.trackCleanup(this.handleFrameFailure(
-          slot,
-          session,
-          slot.incarnationGeneration,
-          subscription.lease,
-        ).then(() => undefined));
-        return;
-      }
-      subscription.highestSequence = acknowledgement.sequence;
+        await this.options.beforeFrameFailureTermination?.();
+        await this.handleFrameFailure(slot, session, incarnationGeneration);
+      }));
       if (event.frame.data.byteLength > this.options.maxFrameBytes) {
-        // An oversized frame is dropped, not fatal: the sequence watermark already advanced so
-        // later frames stay valid, and the subscriber is told without losing its lease.
-        if (refresh) {
-          this.failFrameRefresh(refresh, 'FRAME_TOO_LARGE');
+        if (refresh) this.failFrameRefresh(refresh, 'FRAME_TOO_LARGE');
+        for (const subscription of slot.frameSubscriptions.values()) {
           this.pushToSubscription(subscription, {
             type: 'error',
-            error: { code: 'FRAME_TOO_LARGE', fatal: false, tabId: event.frame.tabId },
+            error: { code: 'FRAME_TOO_LARGE', fatal: false, tabId: acknowledgement.tabId },
           });
-          return;
         }
-        this.trackCleanup(this.acknowledgeFrameInBackground(slot, session, acknowledgement));
-        this.pushToSubscription(subscription, {
-          type: 'error',
-          error: { code: 'FRAME_TOO_LARGE', fatal: false, tabId: event.frame.tabId },
-        });
         return;
       }
-      if (refresh?.admissionClosed) return;
-      const refreshAdmission = refresh && !refresh.admissionClosed && !refresh.abandoned
-        ? refresh
-        : undefined;
-      if (refreshAdmission) {
-        if (refreshAdmission.failure) return;
+      if (refresh?.refreshStarted && !refresh.boundaryCandidate && !refresh.admissionClosed) {
         if (
-          subscription.outstanding.size + refreshAdmission.pendingAcknowledgements.size
-          >= this.options.maxOutstandingFrames
-        ) {
-          this.failFrameRefresh(refreshAdmission, 'FRAME_STREAM_FAILED');
-          return;
-        }
-      } else {
-        if (refresh && subscription.outstanding.size >= this.options.maxOutstandingFrames) {
-          this.failFrameRefresh(refresh, 'FRAME_STREAM_FAILED');
-        }
-        while (subscription.outstanding.size >= this.options.maxOutstandingFrames) {
-          const oldestKey = subscription.outstanding.keys().next().value as string | undefined;
-          if (!oldestKey) break;
-          this.trackCleanup(
-            this.retireOutstandingFrame(subscription, oldestKey, false).then(() => undefined),
-          );
-        }
+          acknowledgement.tabId === refresh.initialTabId
+          && acknowledgement.sequence > refresh.startingHighestSequence
+          && acknowledgement.generation > refresh.initialGeneration
+          && acknowledgement.viewportRevision === refresh.initialViewportRevision
+        ) refresh.boundaryCandidate = { ...acknowledgement };
+        else this.failFrameRefresh(refresh, 'FRAME_STREAM_FAILED');
       }
-      const outstanding: IOutstandingFrameRecord = {
-        acknowledgement,
-        session,
-        incarnationGeneration: slot.incarnationGeneration,
-      };
-      subscription.outstanding.set(key, outstanding);
-      if (!refreshAdmission) this.armFrameAcknowledgementTimer(subscription, key, outstanding);
-      const delivered = this.pushToSubscription(subscription, { type: 'frame', frame: event.frame });
-      if (
-        delivered
-        && refreshAdmission
-        && refreshAdmission.refreshStarted
-        && !refreshAdmission.boundaryCandidate
-      ) {
-        if (
-          acknowledgement.tabId === refreshAdmission.initialTabId
-          && acknowledgement.sequence > refreshAdmission.startingHighestSequence
-          && acknowledgement.generation > refreshAdmission.initialGeneration
-          && acknowledgement.viewportRevision === refreshAdmission.initialViewportRevision
-        ) {
-          refreshAdmission.boundaryCandidate = { ...acknowledgement };
-        } else {
-          this.failFrameRefresh(refreshAdmission, 'FRAME_STREAM_FAILED');
+      const key = this.frameAcknowledgementKey(acknowledgement);
+      for (const subscription of [...slot.frameSubscriptions.values()]) {
+        if (subscription.closed) continue;
+        while (subscription.outstanding.size >= this.options.maxOutstandingFrames) {
+          const oldestKey = subscription.outstanding.keys().next().value!;
+          this.trackCleanup(this.retireOutstandingFrame(subscription, oldestKey).then(() => undefined));
         }
+        const outstanding: IOutstandingFrameRecord = {
+          acknowledgement, session, incarnationGeneration, producerAcknowledgement,
+        };
+        subscription.highestSequence = acknowledgement.sequence;
+        subscription.outstanding.set(key, outstanding);
+        this.armFrameAcknowledgementTimer(subscription, key, outstanding);
+        this.pushToSubscription(subscription, { type: 'frame', frame: event.frame });
       }
       return;
     }
-    if (event.type === 'error') {
-      const runtimeEvent = {
-        type: 'error',
-        error: {
-          code: truncateString(event.error.code, 128),
-          fatal: event.error.fatal,
-          message: truncateString(event.error.message, 2048),
-          ...(event.error.tabId ? { tabId: truncateString(event.error.tabId, 128) } : {}),
-        },
-      } satisfies TBrowserRuntimeEvent;
-      let fatalLease = event.error.fatal && slot.lease?.capability.state === 'active'
-        ? slot.lease
-        : undefined;
-      if (fatalLease) {
-        try {
-          this.requireValidLease(fatalLease);
-        } catch {
-          fatalLease = undefined;
-        }
+    const runtimeEvent: TBrowserRuntimeEvent = event.type === 'state'
+      ? { type: 'state', state: this.resourceState(event.state) }
+      : {
+          type: 'error',
+          error: {
+            code: truncateString(event.error.code, 128),
+            fatal: event.error.fatal,
+            message: truncateString(event.error.message, 2048),
+            ...(event.error.tabId ? { tabId: truncateString(event.error.tabId, 128) } : {}),
+          },
+        };
+    if (event.type === 'error' && event.error.fatal) {
+      const subscribers = [...slot.frameSubscriptions.values()].filter((subscription) => (
+        !subscription.closed && !subscription.lease.released
+      ));
+      // Publish the cleanup promise before synchronous revocation wakes queued callers.
+      if (refresh) this.failFrameRefresh(refresh, 'FRAME_STREAM_FAILED');
+      const failure = this.handleFrameFailure(slot, session, incarnationGeneration);
+      if (refresh) refresh.producerFailure = failure;
+      for (const lease of slot.leases.values()) {
+        if (lease.released) continue;
+        this.invalidateCapabilityRecord(lease.capability);
+        lease.released = true;
+        lease.controller.abort(new BrowserRuntimeError('CAPABILITY_REVOKED'));
       }
-      if (event.error.fatal && !fatalLease) return;
-      if (fatalLease) {
-        const fatalSubscription = subscription
-          && !subscription.closed
-          && subscription.lease === fatalLease
-          ? subscription
-          : undefined;
-        if (refreshForSession?.lease === fatalLease) {
-          this.failFrameRefresh(refreshForSession, 'FRAME_STREAM_FAILED');
-        }
-        this.invalidateCapabilityRecord(fatalLease.capability);
-        try {
-          fatalSubscription?.listener(runtimeEvent);
-        } catch {
-          // Fatal revocation already owns cleanup for a failing listener.
-        } finally {
-          this.trackCleanup(this.revokeCapabilityRecord(fatalLease.capability));
-        }
-        return;
+      slot.operation?.controller.abort(new BrowserRuntimeError('CAPABILITY_REVOKED'));
+      for (const subscription of subscribers) {
+        try { subscription.listener(runtimeEvent); } catch { /* Producer failure owns cleanup. */ }
       }
-      if (!subscription || subscription.closed) return;
-      this.pushToSubscription(subscription, runtimeEvent);
+      this.trackCleanup(failure.then(() => undefined));
       return;
     }
-    if (!subscription || subscription.closed) return;
-    this.pushToSubscription(subscription, { type: 'state', state: this.resourceState(event.state) });
+    for (const subscription of [...slot.frameSubscriptions.values()]) {
+      this.pushToSubscription(subscription, runtimeEvent);
+    }
   }
 
   private pushToSubscription(
     subscription: IFrameSubscriptionRecord,
     event: TBrowserRuntimeEvent,
   ): boolean {
+    if (subscription.closed) return false;
     try {
       this.requireValidLease(subscription.lease);
       subscription.listener(event);
       return true;
     } catch {
-      const slot = subscription.lease.slot;
-      const session = slot.session;
-      const incarnationGeneration = slot.incarnationGeneration;
-      const refresh = session
-        ? this.matchingFrameRefresh(slot, subscription, session, incarnationGeneration)
-        : undefined;
-      if (event.type === 'frame') {
-        const key = this.frameAcknowledgementKey(this.validateFrameAcknowledgement(event.frame));
-        this.trackCleanup(this.retireOutstandingFrame(subscription, key, true).then(() => undefined));
-        return false;
-      }
-      if (refresh) {
-        this.failFrameRefresh(refresh, 'FRAME_STREAM_FAILED');
-        return false;
-      }
-      if (!session) {
-        this.trackCleanup(this.revokeCapabilityRecord(subscription.lease.capability));
-        return false;
-      }
-      this.trackCleanup((async () => {
-        await this.options.beforeFrameFailureTermination?.();
-        await this.handleFrameFailure(
-          slot,
-          session,
-          incarnationGeneration,
-          subscription.lease,
-        );
-      })());
+      // A failed participant transport cannot revoke another participant or kill the producer.
+      this.trackCleanup(this.closeFrameSubscription(subscription));
+      this.trackCleanup(this.revokeCapabilityRecord(subscription.lease.capability));
       return false;
     }
   }
@@ -2965,60 +3029,28 @@ export class BrowserRuntime {
     if (subscription.closed) return;
     subscription.closed = true;
     const slot = subscription.lease.slot;
-    const refresh = slot.frameRefresh;
-    if (refresh?.subscription === subscription && !refresh.abandoned) {
-      this.failFrameRefresh(refresh, 'FRAME_STREAM_FAILED');
+    if (slot.frameRefresh?.subscription === subscription) {
+      this.abandonFrameRefresh(slot, slot.frameRefresh);
     }
-    if (slot.frameSubscription === subscription) slot.frameSubscription = undefined;
-    for (const key of [...subscription.outstanding.keys()]) {
-      await this.retireOutstandingFrame(subscription, key, false);
+    if (slot.frameSubscriptions.get(subscription.lease.leaseId) === subscription) {
+      slot.frameSubscriptions.delete(subscription.lease.leaseId);
     }
+    for (const frame of subscription.outstanding.values()) {
+      if (frame.timer) clearTimeout(frame.timer);
+    }
+    subscription.outstanding.clear();
   }
 
   private async retireOutstandingFrame(
     subscription: IFrameSubscriptionRecord,
     key: string,
-    failLease: boolean,
   ): Promise<boolean> {
     const outstanding = subscription.outstanding.get(key);
     if (!outstanding) return false;
     subscription.outstanding.delete(key);
     if (outstanding.timer) clearTimeout(outstanding.timer);
-    outstanding.timer = undefined;
-    const slot = subscription.lease.slot;
-    const refresh = this.matchingFrameRefresh(
-      slot,
-      subscription,
-      outstanding.session,
-      outstanding.incarnationGeneration,
-    );
-    if (refresh?.admissionClosed) {
-      this.failFrameRefresh(refresh, 'FRAME_STREAM_FAILED');
-      return false;
-    }
-    if (refresh && failLease) this.failFrameRefresh(refresh, 'FRAME_STREAM_FAILED');
-    const refreshOwned = Boolean(refresh && !refresh.abandoned);
-    const outcome = await this.beginFrameAcknowledgement(
-      outstanding.session,
-      outstanding.acknowledgement,
-      refreshOwned ? refresh : undefined,
-    );
-    if (outcome.status === 'fulfilled' && !failLease) return outcome.accepted;
-    if (refreshOwned) return outcome.status === 'fulfilled' ? outcome.accepted : false;
-    if (refresh && slot.frameRefresh === refresh) {
-      if (outcome.status !== 'fulfilled') {
-        this.failFrameRefresh(refresh, 'FRAME_STREAM_FAILED');
-      }
-      return outcome.status === 'fulfilled' ? outcome.accepted : false;
-    }
-    await this.options.beforeFrameFailureTermination?.();
-    await this.handleFrameFailure(
-      slot,
-      outstanding.session,
-      outstanding.incarnationGeneration,
-      subscription.lease,
-    );
-    return outcome.status === 'fulfilled' ? outcome.accepted : false;
+    const outcome = await outstanding.producerAcknowledgement;
+    return outcome.status === 'fulfilled' && outcome.accepted;
   }
 
   private validateFrameAcknowledgement(
@@ -3080,130 +3112,73 @@ export class BrowserRuntime {
     }
   }
 
-  private async acknowledgeFrameInBackground(
+  private async handleFrameFailure(
     slot: IResourceSlot,
     session: ILiveBrowserSessionLike,
-    acknowledgement: plugins.smartpuppeteer.ILiveBrowserFrameAcknowledgementRequest,
-    failLease = false,
-  ): Promise<void> {
-    const failedLease = slot.session === session ? (slot.lease ?? null) : null;
-    const incarnationGeneration = slot.incarnationGeneration;
-    const subscription = slot.frameSubscription;
-    const refresh = subscription
-      ? this.matchingFrameRefresh(slot, subscription, session, incarnationGeneration)
-      : undefined;
-    if (refresh && failLease) this.failFrameRefresh(refresh, 'FRAME_STREAM_FAILED');
-    const refreshOwned = Boolean(refresh && !refresh.admissionClosed && !refresh.abandoned);
-    const outcome = await this.beginFrameAcknowledgement(
-      session,
-      acknowledgement,
-      refreshOwned ? refresh : undefined,
-    );
-    if (outcome.status === 'fulfilled' && !failLease) return;
-    if (refreshOwned) return;
-    if (refresh && slot.frameRefresh === refresh) {
-      if (outcome.status !== 'fulfilled') {
-        this.failFrameRefresh(refresh, 'FRAME_STREAM_FAILED');
-      }
-      return;
+    incarnationGeneration: number,
+    expectedRefresh?: IFrameRefreshRecord,
+  ): Promise<boolean> {
+    if (slot.session !== session || slot.incarnationGeneration !== incarnationGeneration) return false;
+    if (slot.frameFailure?.session === session) return slot.frameFailure.promise;
+    const promise = this.handleFrameFailureInternal(slot, session, incarnationGeneration, expectedRefresh);
+    const failure = { session, promise };
+    slot.frameFailure = failure;
+    try { return await promise; } finally {
+      if (slot.frameFailure === failure) slot.frameFailure = undefined;
     }
-    await this.options.beforeFrameFailureTermination?.();
-    await this.handleFrameFailure(slot, session, incarnationGeneration, failedLease);
   }
 
-  private async handleFrameFailure(
+  private async handleFrameFailureInternal(
     slot: IResourceSlot,
     session: ILiveBrowserSessionLike,
     incarnationGeneration: number,
-    expectedLease: ILeaseRecord | null,
     expectedRefresh?: IFrameRefreshRecord,
   ): Promise<boolean> {
-    let transitionGeneration = 0;
-    let ownsTransitionFence = false;
-    const lease = expectedLease ?? undefined;
     const release = await slot.mutex.acquire();
+    let generation: number;
+    let leases: ILeaseRecord[];
     try {
-      const exactLeaseIsCurrent = expectedLease === null
-        ? slot.lease === undefined
-        : slot.lease === expectedLease && expectedLease.capability.lease === expectedLease;
-      let leaseAttachmentIsCurrent = true;
-      if (lease) {
-        try {
-          this.assertCapabilityStillAttached(lease.capability, slot);
-        } catch {
-          leaseAttachmentIsCurrent = false;
-        }
-      }
-      const borrowsLeaseReleaseFence = Boolean(
-        lease
-        && exactLeaseIsCurrent
-        && lease.releaseGeneration !== undefined
-        && slot.fencingGeneration === lease.releaseGeneration,
-      );
       if (
         slot.session !== session
         || slot.incarnationGeneration !== incarnationGeneration
-        || slot.permanentlyFenced
-        || slot.retirementPending
-        || slot.terminationFenceGeneration !== undefined
-        || slot.attachmentFenceCount > 0
-        || slot.attachmentRetryBinding
-        || !exactLeaseIsCurrent
-        || !leaseAttachmentIsCurrent
-        || (expectedRefresh !== undefined && slot.frameRefresh !== expectedRefresh)
-        || (slot.fencingGeneration !== undefined && !borrowsLeaseReleaseFence)
+        || slot.permanentlyFenced || slot.retirementPending
+        || slot.terminationFenceGeneration !== undefined || slot.fencingGeneration !== undefined
+        || (expectedRefresh && slot.frameRefresh !== expectedRefresh)
       ) return false;
-      if (expectedRefresh) {
-        expectedRefresh.admissionClosed = true;
-        expectedRefresh.abandoned = true;
-        slot.frameRefresh = undefined;
-      }
-      if (lease) this.invalidateCapabilityRecord(lease.capability);
-      if (borrowsLeaseReleaseFence) {
-        transitionGeneration = slot.fencingGeneration!;
-      } else {
-        transitionGeneration = ++slot.arbitrationGeneration;
-        slot.fencingGeneration = transitionGeneration;
-        ownsTransitionFence = true;
-      }
-      if (lease) {
+      generation = ++slot.arbitrationGeneration;
+      slot.fencingGeneration = generation;
+      this.abandonFrameRefresh(slot);
+      leases = [...slot.leases.values()];
+      for (const lease of leases) {
+        this.invalidateCapabilityRecord(lease.capability);
         lease.released = true;
         lease.controller.abort(new BrowserRuntimeError('CAPABILITY_REVOKED'));
+        this.notifyFramedLeaseEnded(lease);
       }
-      if (!lease || slot.operation?.lease === lease) {
-        slot.operation?.controller.abort(new BrowserRuntimeError('CAPABILITY_REVOKED'));
-      }
+      slot.operation?.controller.abort(new BrowserRuntimeError('CAPABILITY_REVOKED'));
     } finally {
       release();
     }
-    if (lease) this.trackFrameCapabilityRevocation(lease);
     await this.options.afterFrameFailureFence?.();
-    if (lease) await this.closeFrameSubscriptionIfLease(lease);
+    await Promise.all(leases.map((lease) => this.closeFrameSubscriptionIfLease(lease)));
     const errors: unknown[] = [];
     await this.quiesceSlot(slot).catch((error) => errors.push(error));
     await this.terminateSlotSession(slot, session).catch((error) => errors.push(error));
     const finalRelease = await slot.mutex.acquire();
     try {
-      if (
-        slot.arbitrationGeneration === transitionGeneration
-        && slot.fencingGeneration === transitionGeneration
-        && slot.incarnationGeneration === incarnationGeneration
-        && slot.session !== session
-      ) {
-        if (ownsTransitionFence && lease && slot.lease === lease) slot.lease = undefined;
-        if (ownsTransitionFence && lease && lease.capability.lease === lease) {
-          lease.capability.lease = undefined;
+      if (slot.fencingGeneration === generation && errors.length === 0) {
+        for (const lease of leases) {
+          slot.leases.delete(lease.leaseId);
+          if (lease.capability.lease === lease) lease.capability.lease = undefined;
         }
-        if (!lease || slot.operation?.lease === lease) slot.operation = undefined;
-        if (ownsTransitionFence && errors.length === 0) slot.fencingGeneration = undefined;
+        slot.operation = undefined;
+        slot.fencingGeneration = undefined;
       }
     } finally {
       finalRelease();
     }
-    if (errors.length === 1) throw errors[0];
-    if (errors.length > 1) {
-      throw new AggregateError(errors, 'Frame acknowledgement cleanup is incomplete');
-    }
+    for (const lease of leases) this.trackFrameCapabilityRevocation(lease);
+    if (errors.length) throw new AggregateError(errors, 'Frame producer cleanup is incomplete');
     return true;
   }
 
@@ -3216,6 +3191,14 @@ export class BrowserRuntime {
     this.trackCleanup(operation);
   }
 
+  private requireQueuedLease(lease: ILeaseRecord, participantCleanup = false): void {
+    if (!participantCleanup) return this.requireValidLease(lease);
+    if (
+      !lease.released || lease.slot.leases.get(lease.leaseId) !== lease
+      || lease.capability.lease !== lease || !lease.slot.session
+    ) throw new BrowserRuntimeError('CAPABILITY_REVOKED');
+  }
+
   private requireValidLease(lease: ILeaseRecord): void {
     if (lease.released || lease.controller.signal.aborted) {
       throw new BrowserRuntimeError('CAPABILITY_REVOKED');
@@ -3227,7 +3210,7 @@ export class BrowserRuntime {
     if (
       capability !== lease.capability
       || capability.lease !== lease
-      || lease.slot.lease !== lease
+      || lease.slot.leases.get(lease.leaseId) !== lease
       || !lease.slot.session
     ) {
       throw new BrowserRuntimeError('CAPABILITY_REVOKED');
@@ -3350,57 +3333,58 @@ export class BrowserRuntime {
   }
 
   private async releaseLeaseRecordInternal(lease: ILeaseRecord): Promise<void> {
-    if (lease.released && lease.slot.lease !== lease) return;
     const slot = lease.slot;
+    if (slot.leases.get(lease.leaseId) !== lease) return;
     const release = await slot.mutex.acquire();
-    const existingFence = slot.fencingGeneration;
-    const generation = lease.releaseGeneration
-      ?? existingFence
-      ?? ++slot.arbitrationGeneration;
-    lease.releaseGeneration = generation;
-    lease.releaseOwnsFence ??= existingFence === undefined;
+    let operation: IOperationRecord | undefined;
     try {
-      if (existingFence !== undefined) {
-        lease.controller.abort(new BrowserRuntimeError('ABORTED'));
-      } else {
-        slot.fencingGeneration = generation;
-      }
       lease.released = true;
       lease.controller.abort(new BrowserRuntimeError('ABORTED'));
-      if (slot.operation?.lease === lease) {
-        slot.operation.controller.abort(new BrowserRuntimeError('ABORTED'));
-      }
+      operation = slot.operation?.lease === lease ? slot.operation : undefined;
+      operation?.controller.abort(new BrowserRuntimeError('ABORTED'));
     } finally {
       release();
     }
     await this.closeFrameSubscriptionIfLease(lease);
-    await this.quiesceSlot(slot);
-    if (slot.frameRefresh?.lease === lease) {
-      this.abandonFrameRefresh(slot, slot.frameRefresh);
+    if (operation) {
+      const settled = await waitBounded(operation.promise, this.options.quiescenceTimeoutMs);
+      if (!settled.settled) {
+        // An unquiescent operation belongs to the browser process, so its incarnation must end.
+        await this.terminateRegisteredResourceInternal(slot, false, {
+          session: operation.session, incarnationGeneration: operation.incarnationGeneration,
+        });
+      }
     }
+    if (slot.frameRefresh?.lease === lease) this.abandonFrameRefresh(slot, slot.frameRefresh);
     if (
-      slot.permanentlyFenced
-      && (slot.session || slot.proxy || slot.profileDirectory)
-    ) await this.terminateSlotSession(slot);
+      this.lifecycleState === 'running' && slot.session && !slot.permanentlyFenced && !slot.retirementPending
+      && slot.fencingGeneration === undefined && slot.terminationFenceGeneration === undefined
+      && (lease.preferredViewport || lease.heldKeys.size || lease.heldButtons.size)
+    ) {
+      await this.runOperation(lease, 'releaseParticipant', 'viewport', {},
+        async (signal, session) => {
+          await this.releaseParticipantInput(lease, session);
+          await this.applySharedViewport(slot, session, signal);
+          lease.preferredViewport = undefined;
+        }, undefined, true);
+    }
+    if (slot.permanentlyFenced && (slot.session || slot.proxy || slot.profileDirectory)) {
+      await this.terminateSlotSession(slot);
+    }
     const finalRelease = await slot.mutex.acquire();
     try {
       if (lease.capability.state === 'active') this.notifyFramedLeaseEnded(lease);
-      if (slot.lease === lease) slot.lease = undefined;
+      slot.leases.delete(lease.leaseId);
       if (lease.capability.lease === lease) lease.capability.lease = undefined;
-      if (lease.releaseOwnsFence && slot.fencingGeneration === generation) {
-        slot.fencingGeneration = undefined;
-      }
-      lease.releaseGeneration = undefined;
-      lease.releaseOwnsFence = undefined;
-      this.scheduleIdleTermination(slot);
+      if (slot.leases.size === 0) this.scheduleIdleTermination(slot);
     } finally {
       finalRelease();
     }
   }
 
   private async closeFrameSubscriptionIfLease(lease: ILeaseRecord): Promise<void> {
-    const subscription = lease.slot.frameSubscription;
-    if (subscription?.lease === lease) await this.closeFrameSubscription(subscription);
+    const subscription = lease.slot.frameSubscriptions.get(lease.leaseId);
+    if (subscription) await this.closeFrameSubscription(subscription);
   }
 
   private async quiesceSlot(slot: IResourceSlot): Promise<void> {
@@ -3436,6 +3420,12 @@ export class BrowserRuntime {
       return;
     }
     const slot = operation.lease.slot;
+    if (slot.operation === operation && slot.session === operation.session
+      && slot.incarnationGeneration === operation.incarnationGeneration) {
+      await this.terminateRegisteredResourceInternal(slot, false, {
+        session: operation.session, incarnationGeneration: operation.incarnationGeneration,
+      });
+    }
     const release = await slot.mutex.acquire();
     try {
       if (
@@ -3488,6 +3478,8 @@ export class BrowserRuntime {
       slot.unsubscribeSession?.();
       slot.unsubscribeSession = undefined;
       slot.session = undefined;
+      slot.highestFrameSequence = 0;
+      slot.producerAcknowledgements.clear();
     }
     if (slot.proxy) {
       await this.stopProxyBounded(slot.proxy).then(
@@ -3505,7 +3497,7 @@ export class BrowserRuntime {
   }
 
   private scheduleIdleTermination(slot: IResourceSlot): void {
-    if (slot.terminationFenceGeneration !== undefined || slot.retirementPending) return;
+    if (slot.leases.size > 0 || slot.terminationFenceGeneration !== undefined || slot.retirementPending) return;
     if (slot.idleTimer) clearTimeout(slot.idleTimer);
     const arbitrationGeneration = slot.arbitrationGeneration;
     const incarnationGeneration = slot.incarnationGeneration;
@@ -3549,7 +3541,7 @@ export class BrowserRuntime {
   ): Promise<void> {
     const release = await slot.mutex.acquire();
     let generation = 0;
-    let attachmentFenceOwnsTransition = false;
+    let leases: ILeaseRecord[];
     try {
       if (
         (expected?.arbitrationGeneration !== undefined
@@ -3557,48 +3549,34 @@ export class BrowserRuntime {
         || (expected?.incarnationGeneration !== undefined
           && slot.incarnationGeneration !== expected.incarnationGeneration)
         || (expected?.session !== undefined && slot.session !== expected.session)
-        || (expected?.requireIdle && slot.lease)
+        || (expected?.requireIdle && slot.leases.size > 0)
       ) return;
-      attachmentFenceOwnsTransition = slot.attachmentRetryBinding !== undefined;
-      if (!attachmentFenceOwnsTransition) {
-        generation = ++slot.arbitrationGeneration;
-        slot.fencingGeneration = generation;
-      }
-      if (slot.idleTimer) {
-        clearTimeout(slot.idleTimer);
-        slot.idleTimer = undefined;
-      }
-      if (slot.lease) {
-        slot.lease.released = true;
-        slot.lease.controller.abort(new BrowserRuntimeError('ABORTED'));
-        if (!stopping && !attachmentFenceOwnsTransition) {
-          this.notifyFramedLeaseEnded(slot.lease);
-        }
+      generation = ++slot.arbitrationGeneration;
+      slot.fencingGeneration = generation;
+      if (slot.idleTimer) clearTimeout(slot.idleTimer);
+      slot.idleTimer = undefined;
+      leases = [...slot.leases.values()];
+      for (const lease of leases) {
+        lease.released = true;
+        lease.controller.abort(new BrowserRuntimeError('ABORTED'));
+        if (!stopping) this.notifyFramedLeaseEnded(lease);
       }
       slot.operation?.controller.abort(new BrowserRuntimeError('ABORTED'));
     } finally {
       release();
     }
-    if (attachmentFenceOwnsTransition) {
-      await this.quiesceSlot(slot);
-      if (slot.lease) await this.closeFrameSubscriptionIfLease(slot.lease);
-      await this.terminateSlotSession(slot, expected?.session);
-      return;
-    }
-    if (generation === 0) return;
     await this.quiesceSlot(slot);
-    if (slot.lease) await this.closeFrameSubscriptionIfLease(slot.lease);
+    await Promise.all(leases.map((lease) => this.closeFrameSubscriptionIfLease(lease)));
     await this.terminateSlotSession(slot, expected?.session);
     const finalRelease = await slot.mutex.acquire();
     try {
       if (slot.arbitrationGeneration !== generation || slot.fencingGeneration !== generation) {
         throw new BrowserRuntimeError('BUSY');
       }
-      const lease = slot.lease;
-      if (lease && lease.capability.lease === lease) {
-        lease.capability.lease = undefined;
+      for (const lease of leases) {
+        if (lease.capability.lease === lease) lease.capability.lease = undefined;
+        slot.leases.delete(lease.leaseId);
       }
-      slot.lease = undefined;
       slot.operation = undefined;
       slot.fencingGeneration = undefined;
     } finally {
@@ -3642,7 +3620,6 @@ export class BrowserRuntime {
     if (slot.retirementPending) throw new BrowserRuntimeError('RESOURCE_RETIRED');
     if (slot.permanentlyFenced) throw new BrowserRuntimeError('FENCED');
     if (slot.terminationFenceGeneration !== undefined) throw new BrowserRuntimeError('BUSY');
-    if (slot.attachmentFenceCount > 0) throw new BrowserRuntimeError('BUSY');
     if (slot.fencingGeneration !== undefined) throw new BrowserRuntimeError('BUSY');
   }
 
@@ -3685,54 +3662,45 @@ export class BrowserRuntime {
     if (binding.attachmentRevision < current.attachmentRevision) {
       throw new BrowserRuntimeError('ATTACHMENT_CONFLICT');
     }
-    if (
-      binding.attachmentRevision === current.attachmentRevision
-      && !slot.attachmentRetryBinding
-    ) {
-      if (!this.bindingsEqual(binding, current)) {
-        throw new BrowserRuntimeError('ATTACHMENT_CONFLICT');
-      }
+    if (binding.attachmentRevision === current.attachmentRevision && !slot.attachmentRetryBinding) {
+      if (!this.bindingsEqual(binding, current)) throw new BrowserRuntimeError('ATTACHMENT_CONFLICT');
       return this.describeResource(slot);
     }
-    if (
-      slot.attachmentRetryBinding
-      && !this.bindingsEqual(binding, slot.attachmentRetryBinding)
-    ) throw new BrowserRuntimeError('BUSY');
+    if (slot.attachmentRetryBinding && !this.bindingsEqual(binding, slot.attachmentRetryBinding)) {
+      throw new BrowserRuntimeError('BUSY');
+    }
     const release = await slot.mutex.acquire();
-    let fenceGeneration = 0;
     try {
-      fenceGeneration = ++slot.arbitrationGeneration;
-      slot.fencingGeneration = fenceGeneration;
       slot.attachmentBinding = binding;
       slot.attachmentRetryBinding = binding;
-      slot.lease?.controller.abort(new BrowserRuntimeError('CAPABILITY_REVOKED'));
-      slot.operation?.controller.abort(new BrowserRuntimeError('CAPABILITY_REVOKED'));
+      for (const lease of slot.leases.values()) {
+        if (lease.role === 'agent') {
+          lease.controller.abort(new BrowserRuntimeError('CAPABILITY_REVOKED'));
+        }
+      }
+      if (slot.operation?.lease.role === 'agent') {
+        slot.operation.controller.abort(new BrowserRuntimeError('CAPABILITY_REVOKED'));
+      }
     } finally {
       release();
     }
     const peerResults = await Promise.allSettled(
       this.framedPeersForResource(slot).map((peer) => peer.close()),
     );
-    const capabilities = this.capabilitiesForResource(slot);
     const capabilityResults = await Promise.allSettled(
-      capabilities.map((record) => this.revokeCapabilityRecord(record)),
+      this.capabilitiesForResource(slot).filter((record) => record.role === 'agent')
+        .map((record) => this.revokeCapabilityRecord(record)),
     );
     const errors = [...peerResults, ...capabilityResults]
       .filter((result): result is PromiseRejectedResult => result.status === 'rejected')
       .map((result) => result.reason);
-    await this.quiesceSlot(slot).catch((error) => errors.push(error));
     const finalRelease = await slot.mutex.acquire();
     try {
-      if (slot.fencingGeneration === fenceGeneration && errors.length === 0) {
-        slot.fencingGeneration = undefined;
-        slot.attachmentRetryBinding = undefined;
-      }
+      if (errors.length === 0) slot.attachmentRetryBinding = undefined;
     } finally {
       finalRelease();
     }
-    if (errors.length > 0) {
-      throw new AggregateError(errors, 'Attachment fencing is incomplete');
-    }
+    if (errors.length) throw new AggregateError(errors, 'Attachment fencing is incomplete');
     return this.describeResource(slot);
   }
 
@@ -3902,6 +3870,9 @@ export class BrowserRuntime {
       || binding.attachmentRevision !== expected.attachmentRevision
     ) throw new BrowserRuntimeError('ATTACHMENT_CONFLICT');
     if (expected.role === 'agent') {
+      if (slot.attachmentFenceCount > 0 || slot.attachmentRetryBinding) {
+        throw new BrowserRuntimeError('BUSY');
+      }
       if (!binding.sessionId || !this.sessionsEqual(binding.sessionId, expected.sessionId)) {
         throw new BrowserRuntimeError('ATTACHMENT_CONFLICT');
       }
@@ -3918,6 +3889,7 @@ export class BrowserRuntime {
       capability.projectId !== slot.projectId
       || capability.browserResourceId !== slot.browserResourceId
     ) throw new BrowserRuntimeError('CAPABILITY_INVALID');
+    if (capability.role === 'human') return;
     try {
       this.assertCapabilityBinding(slot, capability);
     } catch {
@@ -3950,7 +3922,7 @@ export class BrowserRuntime {
         || sessionId?.harnessId !== 'flex'))
       || (source === 'mcp' && (scopeId !== undefined || channelId !== undefined
         || runId !== undefined
-        || sessionId?.harnessId !== 'opencode'))
+        || sessionId === undefined))
       || (source === 'human' && (scopeId !== undefined || channelId !== undefined
         || runId !== undefined))
     ) throw new BrowserRuntimeError('INVALID_INPUT');
@@ -3984,7 +3956,8 @@ export class BrowserRuntime {
         runId: runId!,
       };
     }
-    if (role === 'agent' && source === 'mcp' && sessionId?.harnessId === 'opencode') {
+    if (role === 'agent' && source === 'mcp'
+      && sessionId !== undefined) {
       return { ...base, role, source, sessionId };
     }
     throw new BrowserRuntimeError('INVALID_INPUT');
@@ -4022,7 +3995,7 @@ export class BrowserRuntime {
     if (
       capability.role === 'agent'
       && capability.source === 'mcp'
-      && capability.sessionId?.harnessId === 'opencode'
+      && capability.sessionId !== undefined
     ) {
       return {
         ...base,
@@ -4128,6 +4101,15 @@ export class BrowserRuntimeLease {
     return this.record.capability.capabilityId;
   }
 
+  public get expiresAt(): number {
+    return this.record.capability.expiresAt;
+  }
+
+  /** Reauthorize this exact live lease without replacing its frame stream or browser incarnation. */
+  public renew(options?: IBrowserRuntimeLeaseRenewalOptions): Promise<number> {
+    return this.runtime.renewLease(this.record, options);
+  }
+
   public get role(): TBrowserActorRole {
     return this.record.role;
   }
@@ -4219,7 +4201,7 @@ export class BrowserRuntimeLease {
   public setViewport(
     viewport: plugins.smartpuppeteer.ILiveBrowserViewport,
     operationOptions?: IBrowserRuntimeOperationOptions,
-  ): Promise<void> {
+  ): Promise<IBrowserRuntimeViewportResult> {
     return this.runtime.leaseSetViewport(this.record, viewport, operationOptions);
   }