@trusty-squire/mcp 1.1.13-rc.8 → 1.1.13

package/dist/bot/browser.js

@@ -22,20 +22,83 @@
 // captchas still need the click-and-wait pattern (the Tier 2 captcha
 // gate).
 import { chromium as baseChromium } from "playwright";
-import sharp from "sharp";
 import { createRequire } from "node:module";
-import { Socket, createServer } from "node:net";
-import { existsSync, mkdirSync, rmSync, statSync } from "node:fs";
-import { execFileSync, spawn } from "node:child_process";
+import { Socket } from "node:net";
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { spawn } from "node:child_process";
 import { isSameRecipeDomain } from "@trusty-squire/recipe-schema";
-import { acquireFreeProfileOperationGuard, CHROME_PROFILE_DIR, clearStaleSingletonLock, closeProfileWithProof, currentProfileHolderPid, launchWithProfileGate, profilePathIdentity, profileProcessIdentity, profileProcessIdentityState, profileProcessMatches, PROFILE_BUSY_MESSAGE, ProfileBusyError, reapProfileHolderIfOwned, signalProfileProcess, waitForProfileFree, } from "./profile.js";
-import { GOOGLE_LOGIN_COOKIE_MARKERS, } from "./operator-profile-pool.js";
-import { startXvfb, xvfbAvailable } from "./xvfb.js";
+import { clearStaleSingletonLock, closeProfileWithProof, currentProfileHolderPid, processBirthIdentity, processBirthIdentityState, profileProcessIdentity, profileProcessIdentityState, profileProcessMatches, PROFILE_BUSY_MESSAGE, ProfileBusyError, reapProfileHolderIfOwned, signalProfileProcess, } from "./profile.js";
+import { createOperatorBrowserMarker, OPERATOR_BROWSER_MARKER_ENV, operatorBrowserProcessMarker, operatorBrowserProcessMatchesMarker, startGlobalOperatorBrowserProcessWatchdog, } from "./operator-browser-watchdog.js";
+import { bindOwnerBrowserLaunch, markOwnerBrowserLaunchTerminal, reconcileOwnerBrowserLaunchAfterLeaderExit, terminateOwnerBrowserLaunch, trackOwnerBrowserLaunch, trackOwnerProcess, untrackOwnerBrowserLaunch, untrackOwnerProcess, } from "./owner-process-reaper.js";
 // Lazy registration: installing the plugin mutates the chromium singleton
 // from playwright-extra so we only do it once per process. We require()
 // the CJS modules lazily (the stealth toolchain only ships CJS) and treat
 // stealth as best-effort — a missing dep should never crash the bot.
 const require = createRequire(import.meta.url);
+// Operator signup runs are deliberately headed. Google, Stytch, and Cloudflare
+// routinely reject a headless Chrome even when it is otherwise self-launched.
+const OPERATOR_BROWSER_HEADLESS = false;
+export function registerLocalBrowserLaunch(profileDir, baseEnv = process.env, marker = createOperatorBrowserMarker()) {
+    trackOwnerBrowserLaunch(marker, profileDir);
+    return {
+        marker,
+        env: { ...baseEnv, [OPERATOR_BROWSER_MARKER_ENV]: marker },
+    };
+}
+export async function closeBrowserContextWithin(context, timeoutMs = 2_000) {
+    let timer;
+    const outcome = await Promise.race([
+        Promise.resolve()
+            .then(() => context.close())
+            .then(() => true, () => false),
+        new Promise((resolveTimeout) => {
+            timer = setTimeout(() => resolveTimeout(false), timeoutMs);
+        }),
+    ]);
+    if (timer !== undefined)
+        clearTimeout(timer);
+    return outcome;
+}
+function spawnLocalBrowser(binary, args, profileDir, options) {
+    const ownership = registerLocalBrowserLaunch(profileDir, options.env, options.marker);
+    try {
+        const child = spawn(binary, [...args], {
+            env: ownership.env,
+            stdio: options.stdio,
+            detached: options.detached,
+        });
+        localBrowserLaunchMarkers.set(child, ownership.marker);
+        child.once("exit", () => {
+            setTimeout(() => {
+                reconcileOwnerBrowserLaunchAfterLeaderExit(ownership.marker, profileDir);
+            }, 0).unref();
+        });
+        return child;
+    }
+    catch (error) {
+        untrackOwnerBrowserLaunch(ownership.marker);
+        throw error;
+    }
+}
+const localBrowserLaunchMarkers = new WeakMap();
+function markLocalBrowserLaunchTerminal(child) {
+    if (child === null)
+        return;
+    const marker = localBrowserLaunchMarkers.get(child);
+    if (marker !== undefined)
+        markOwnerBrowserLaunchTerminal(marker);
+}
+export async function closeLocalBrowserLaunch(marker, profileDir, runtime = {}) {
+    if (marker === undefined)
+        return;
+    (runtime.markTerminal ?? markOwnerBrowserLaunchTerminal)(marker);
+    if (!(await (runtime.terminate ?? terminateOwnerBrowserLaunch)(marker, profileDir))) {
+        throw new Error("local login browser closure unproven");
+    }
+    (runtime.untrack ?? untrackOwnerBrowserLaunch)(marker);
+}
 export function contextInitScriptsFor(options) {
     if (options.hardened)
         return [];
@@ -223,6 +286,34 @@ export class PaymentSubmitOutcomeUnknownError extends Error {
         this.name = "PaymentSubmitOutcomeUnknownError";
     }
 }
+export async function runCaptureConfirmedPaymentSubmit(options) {
+    let clickError;
+    let inputDispatchPossible = false;
+    try {
+        await options.click(() => {
+            inputDispatchPossible = true;
+        });
+    }
+    catch (error) {
+        clickError = error;
+    }
+    if (clickError instanceof BrowserClickDispatchError &&
+        clickError.dispatchStatus === "not_dispatched") {
+        await options.clear();
+        throw clickError;
+    }
+    const evidence = await options.readEvidence();
+    await options.clear();
+    if (!evidence.dispatched) {
+        if (clickError !== undefined && !inputDispatchPossible)
+            throw clickError;
+        throw new PaymentSubmitOutcomeUnknownError();
+    }
+    options.onSubmitDispatched?.();
+    if (clickError !== undefined)
+        throw new PaymentSubmitOutcomeUnknownError();
+    return evidence.baseline;
+}
 const CHECKOUT_TERMINAL_RESERVED_SEGMENTS = new Set([
     "about_blank",
     "blank",
@@ -414,6 +505,22 @@ function checkoutUrlOrderIdentities(rawUrl) {
         return null;
     }
 }
+// Shopify's thank-you route keeps the checkout token in a nested path
+// (`/checkouts/cn/<token>/<locale>/thank-you`), so it has no terminal order
+// identity for checkoutUrlOrderIdentities to compare. Treat it as terminal
+// only when the post-submit page also exposes unambiguous confirmation copy.
+function isShopifyCheckoutThankYouRoute(rawUrl) {
+    try {
+        const segments = new URL(rawUrl).pathname
+            .split("/")
+            .filter(Boolean)
+            .map((segment) => decodeURIComponent(segment).toLowerCase().replace(/-/g, "_"));
+        return ((segments[0] === "checkout" || segments[0] === "checkouts") && segments.at(-1) === "thank_you");
+    }
+    catch {
+        return false;
+    }
+}
 // EbisuMart — a widely-deployed Japanese EC platform (the Hibiya Kadan
 // checkout runs on it) — names its card fields CREDIT_NO / CREDIT_NAME /
 // SECURITY_CD / CREDIT_LIMIT_MONTH / CREDIT_LIMIT_YEAR. PAN name/id and JP
@@ -532,36 +639,6 @@ const CHECKOUT_CARD_VALUE_FIELD_SELECTORS = [
     CHECKOUT_CVV_FIELD_SELECTORS,
     CHECKOUT_CARD_NAME_FIELD_SELECTORS,
 ].join(",");
-// Defense-in-depth redaction set for operate_screenshot. The capture-scoped
-// guard refuses nonempty secrets before pixels are read; these selectors also
-// identify empty sensitive controls and provide rectangles that are composited
-// over the captured bytes. The set mirrors the card fields
-// fillCheckoutCardIntoFrames writes into, plus payment/type_secret markers and
-// other secret-shaped inputs.
-const SCREENSHOT_SECRET_FIELD_SELECTORS = [
-    '[data-ts-sealed-payment="1"]',
-    'input[type="password" i]',
-    'input[autocomplete~="one-time-code" i]',
-    'input[name*="otp" i]',
-    'input[id*="otp" i]',
-    'input[name*="pin" i]',
-    'input[id*="pin" i]',
-].join(",");
-const SCREENSHOT_REDACTION_SELECTORS = `${CHECKOUT_CARD_VALUE_FIELD_SELECTORS},${SCREENSHOT_SECRET_FIELD_SELECTORS}`;
-function sealedElementSemanticKeys(descriptor) {
-    const clean = (value) => (value ?? "").replace(/\s+/g, " ").trim().toLowerCase();
-    const tag = clean(descriptor.tag);
-    const type = clean(descriptor.type);
-    const landmark = clean(descriptor.landmark);
-    const label = clean(descriptor.labelText ?? descriptor.ariaLabel ?? descriptor.placeholder);
-    return Array.from(new Set([
-        clean(descriptor.testId) ? `test:${clean(descriptor.testId)}` : "",
-        clean(descriptor.id) ? `id:${clean(descriptor.id)}` : "",
-        clean(descriptor.name) ? `name:${tag}:${type}:${clean(descriptor.name)}` : "",
-        label ? `label:${landmark}:${tag}:${type}:${label}` : "",
-        `position:${landmark}:${tag}:${type}:${descriptor.ordinal}`,
-    ].filter((key) => key.length > 0)));
-}
 // Charge-verb button labels — the click that may move money. Used by
 // submitFilledCheckout to find the charge control, and by operate_act's
 // pending-card-fill guard to recognize and cap caller-placed attempts while a
@@ -575,6 +652,112 @@ function sealedElementSemanticKeys(descriptor) {
 // where a bare noun like 購入 would otherwise swallow navigation labels such
 // as 購入手続きへ). 確定 (finalize) is deliberate — 確認 (review) must NOT match.
 export const CHECKOUT_SUBMIT_LABEL_RE = /^(?:pay(?:\s+now)?|place\s+order|complete\s+(?:order|purchase|payment)|submit\s+payment|buy\s+now|confirm\s+(?:order|payment))\b|^ご?注文(?:内容)?[をの]?確定|^ご?注文する|^確定(?:する|$)|^購入(?:する|を確定|$)|^今すぐ(?:購入|注文|支払)|^支払う|^お?支払い(?:を確定|$)/i;
+const CHECKOUT_PAYMENT_EXECUTION_PATHS = new Set([
+    "authorize",
+    "capture",
+    "charge",
+    "charges",
+    "completecheckout",
+    "completeorder",
+    "confirmpayment",
+    "orders",
+    "placeorder",
+    "purchase",
+]);
+const CHECKOUT_PAYMENT_EXECUTION_MUTATIONS = new Set([
+    "authorizepayment",
+    "capturepayment",
+    "completecheckout",
+    "completeorder",
+    "completepayment",
+    "confirmpayment",
+    "createcharge",
+    "placeorder",
+    "submitpayment",
+]);
+const CHECKOUT_PAYMENT_EXCLUDED_PATH_SEGMENTS = new Set([
+    "analytics",
+    "collect",
+    "events",
+    "logs",
+    "metrics",
+    "paymentmethods",
+    "setupintents",
+    "telemetry",
+    "tokenization",
+    "tokens",
+    "tracking",
+]);
+const CHECKOUT_PAYMENT_REQUEST_OBSERVATION_MS = 15_000;
+function normalizedPaymentOperation(value) {
+    return value.toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+function isCheckoutPaymentExecutionOperation(value) {
+    return CHECKOUT_PAYMENT_EXECUTION_MUTATIONS.has(normalizedPaymentOperation(value));
+}
+function collectGraphqlMutationCandidates(query, candidates) {
+    const mutation = /\bmutation\b(?:\s+([A-Za-z_][A-Za-z0-9_-]*))?(?:\s*\([^{}]*\))?(?:\s+@[^{]+)?\s*\{\s*(?:([A-Za-z_][A-Za-z0-9_-]*)\s*:\s*)?([A-Za-z_][A-Za-z0-9_-]*)/gi;
+    for (const match of query.matchAll(mutation)) {
+        if (match[1] !== undefined)
+            candidates.push(match[1]);
+        if (match[3] !== undefined)
+            candidates.push(match[3]);
+    }
+}
+function hasCheckoutPaymentExecutionPayload(request) {
+    const payload = request.postData();
+    if (payload === null)
+        return false;
+    const candidates = [];
+    try {
+        const parsed = JSON.parse(payload);
+        if (parsed === null || Array.isArray(parsed) || typeof parsed !== "object")
+            return false;
+        const record = parsed;
+        if (typeof record.operationName === "string")
+            candidates.push(record.operationName);
+        if (typeof record.query === "string")
+            collectGraphqlMutationCandidates(record.query, candidates);
+    }
+    catch {
+        const form = new URLSearchParams(payload);
+        const operationName = form.get("operationName");
+        if (operationName !== null)
+            candidates.push(operationName);
+        const query = form.get("query");
+        collectGraphqlMutationCandidates(query ?? payload, candidates);
+    }
+    return candidates.some(isCheckoutPaymentExecutionOperation);
+}
+function isCheckoutPaymentRequest(request) {
+    if (!["document", "fetch", "xhr"].includes(request.resourceType()))
+        return false;
+    const method = request.method().toUpperCase();
+    if (method === "GET" || method === "HEAD" || method === "OPTIONS")
+        return false;
+    try {
+        const segments = new URL(request.url()).pathname.split("/").filter(Boolean);
+        const normalizedSegments = segments.map(normalizedPaymentOperation);
+        if (normalizedSegments.some((segment) => CHECKOUT_PAYMENT_EXCLUDED_PATH_SEGMENTS.has(segment))) {
+            return false;
+        }
+        const lastSegment = segments.at(-1);
+        if (lastSegment !== undefined &&
+            CHECKOUT_PAYMENT_EXECUTION_PATHS.has(normalizedPaymentOperation(lastSegment))) {
+            return true;
+        }
+        if (lastSegment !== undefined &&
+            (normalizedPaymentOperation(lastSegment) === "confirm" ||
+                normalizedPaymentOperation(lastSegment) === "capture") &&
+            segments.some((segment) => normalizedPaymentOperation(segment) === "paymentintents")) {
+            return true;
+        }
+    }
+    catch {
+        return false;
+    }
+    return hasCheckoutPaymentExecutionPayload(request);
+}
 export function checkoutSubmitLabel(signals) {
     return (signals.ariaLabel || signals.inputValue || signals.textContent || "").trim();
 }
@@ -1700,19 +1883,13 @@ export function extractGoogleAccountEmail(pageText) {
 }
 // Map a cookie jar to the OAuth providers that have a LIVE logged-in session.
 // The auth cookies that mean "signed in": GitHub → `user_session`; Google →
-// any of the *SID session cookies (NID / CONSENT / 1P_JAR are set even when
-// logged out, so they are deliberately NOT signals). Host-scoped so a
+// a legacy *SID cookie. NID / CONSENT / 1P_JAR and the current account-chooser
+// family are set even when logged out, so they are deliberately NOT signals.
+// Host-scoped so a
 // google.com cookie can't pass for github. Cookie NAMES + presence only;
 // values are checked for non-triviality, never logged. Exported for tests.
 export function sessionProvidersFromCookies(cookies) {
-    const SIGNATURES = [
-        { provider: "github", host: /(^|\.)github\.com$/i, names: ["user_session"] },
-        {
-            provider: "google",
-            host: /(^|\.)google\.com$/i,
-            names: GOOGLE_LOGIN_COOKIE_MARKERS,
-        },
-    ];
+    const SIGNATURES = [{ provider: "github", host: /(^|\.)github\.com$/i, names: ["user_session"] }];
     const live = [];
     for (const sig of SIGNATURES) {
         const present = cookies.some((c) => sig.host.test(c.domain.replace(/^\./, "")) &&
@@ -1721,6 +1898,11 @@ export function sessionProvidersFromCookies(cookies) {
         if (present)
             live.push(sig.provider);
     }
+    const googleSession = cookies.some((cookie) => /(^|\.)google\.com$/i.test(cookie.domain.replace(/^\./, "")) &&
+        ["__Secure-1PSID", "SID", "HSID", "SSID", "APISID", "SAPISID"].includes(cookie.name) &&
+        cookie.value.length > 10);
+    if (googleSession)
+        live.push("google");
     return live;
 }
 function isCaptchaVariant(v) {
@@ -1852,7 +2034,7 @@ export function resolveChannelBinary(channel) {
 // Cloudflare Turnstile's interactive challenge FAILS a Playwright/patchright
 // launchPersistentContext-driven Chrome and PASSES a Chrome the operator
 // launches itself and then attaches to over CDP — every other variable held
-// constant (same box, same datacenter IP, same Xvfb display, same Chrome 148
+// constant (same box, same datacenter IP, same headed display, same Chrome 148
 // binary, same software-WebGL, same humanized click). The discriminator
 // matrix:
 //   launchPersistentContext + CDP click   → "Verification failed"
@@ -1964,41 +2146,36 @@ export async function launchCancellablePersistentContext(opts) {
     void lateCleanup;
     return { status: "cancelled", closeState: "unknown" };
 }
-// Find an ephemeral TCP port for Chrome's --remote-debugging-port.
-function findFreePort() {
-    return new Promise((resolve, reject) => {
-        const srv = createServer();
-        srv.on("error", reject);
-        srv.listen(0, "127.0.0.1", () => {
-            const addr = srv.address();
-            const port = typeof addr === "object" && addr !== null ? addr.port : 0;
-            srv.close(() => (port > 0 ? resolve(port) : reject(new Error("no port"))));
-        });
-    });
-}
-// Poll Chrome's DevTools HTTP endpoint until it answers (the browser is up
-// and accepting CDP), or the deadline passes. Returns the base endpoint URL
-// connectOverCDP accepts.
-async function waitForDevtools(port, deadlineMs, child) {
-    const base = `http://127.0.0.1:${port}`;
+const DEVTOOLS_ACTIVE_PORT_FILE = "DevToolsActivePort";
+export async function waitForOwnedDevtoolsEndpoint(profileDir, deadlineMs, child) {
+    const activePortPath = join(profileDir, DEVTOOLS_ACTIVE_PORT_FILE);
     const deadline = Date.now() + deadlineMs;
     let lastErr = "";
     while (Date.now() < deadline) {
-        if (child !== undefined && !childProcessIsRunning(child)) {
-            throw new Error("Chrome exited before its DevTools endpoint became available");
+        if (!childProcessIsRunning(child)) {
+            throw new Error("Chrome exited before its owned DevTools endpoint became available");
         }
         try {
-            const res = await fetch(`${base}/json/version`, { signal: AbortSignal.timeout(2_000) });
-            if (res.ok)
-                return base;
-            lastErr = `HTTP ${res.status}`;
+            const [portText, browserPath] = (await readFile(activePortPath, "utf8")).split(/\r?\n/);
+            const port = Number(portText);
+            if (!Number.isInteger(port) ||
+                port < 1 ||
+                port > 65_535 ||
+                browserPath === undefined ||
+                !/^\/devtools\/browser\/[A-Za-z0-9-]+$/.test(browserPath)) {
+                throw new Error("invalid DevToolsActivePort contents");
+            }
+            return `ws://127.0.0.1:${port}${browserPath}`;
         }
-        catch (err) {
-            lastErr = err instanceof Error ? err.message : String(err);
+        catch (error) {
+            lastErr = error instanceof Error ? error.message : String(error);
         }
-        await new Promise((r) => setTimeout(r, 200));
+        await new Promise((resolveWait) => {
+            const timer = setTimeout(resolveWait, 200);
+            timer.unref();
+        });
     }
-    throw new Error(`Chrome DevTools endpoint never came up on ${base} (${lastErr})`);
+    throw new Error(`Owned Chrome DevTools endpoint was not published (${lastErr})`);
 }
 export async function withChromeStartupLock(fn, opts = {}) {
     const lockDir = opts.lockDir ?? "/tmp/trusty-squire-chrome-start.lock";
@@ -2037,13 +2214,13 @@ export async function withChromeStartupLock(fn, opts = {}) {
     }
 }
 const selfManagedChromes = new Map();
+const ownedChromeProcessTrees = new Set();
 let selfManagedCleanupInstalled = false;
 let selfManagedTerminationSignalExitEnabled = true;
-let orphanVerifierReapRan = false;
-const orphanOperatorProfilesReaped = new Set();
 function cleanupSelfManagedChromes() {
-    for (const identity of selfManagedChromes.values()) {
-        signalProfileProcess(identity, identity.user_data_dir, "SIGKILL");
+    for (const proof of ownedChromeProcessTrees) {
+        signalOwnedChromeProcessTree(proof.identity, proof.processGroup, "SIGKILL", { proof });
+        untrackOwnerProcess(proof.identity);
     }
     selfManagedChromes.clear();
 }
@@ -2054,7 +2231,20 @@ const exitForSelfManagedSignal = (code) => {
 const onSelfManagedSigint = () => exitForSelfManagedSignal(2);
 const onSelfManagedSigterm = () => exitForSelfManagedSignal(15);
 const onSelfManagedSighup = () => exitForSelfManagedSignal(1);
-// Whether the self-managed SIGINT/SIGTERM handlers may exit the process.
+const selfManagedTerminationSignalHandlers = [
+    ["SIGHUP", onSelfManagedSighup],
+    ["SIGINT", onSelfManagedSigint],
+    ["SIGTERM", onSelfManagedSigterm],
+];
+export function synchronizeSelfManagedChromeTerminationSignalHandlers(enabled, runtime = process) {
+    for (const [signal, handler] of selfManagedTerminationSignalHandlers) {
+        if (enabled)
+            runtime.once(signal, handler);
+        else
+            runtime.removeListener(signal, handler);
+    }
+}
+// Whether the self-managed termination-signal handlers may exit the process.
 // False means another shutdown owner (the MCP server's disconnect coordinator,
 // or an in-flight interactive login) holds process-exit responsibility.
 export function isSelfManagedChromeTerminationSignalExitEnabled() {
@@ -2066,14 +2256,7 @@ export function setSelfManagedChromeTerminationSignalExitEnabled(enabled) {
     selfManagedTerminationSignalExitEnabled = enabled;
     if (!selfManagedCleanupInstalled)
         return;
-    if (enabled) {
-        process.once("SIGINT", onSelfManagedSigint);
-        process.once("SIGTERM", onSelfManagedSigterm);
-    }
-    else {
-        process.removeListener("SIGINT", onSelfManagedSigint);
-        process.removeListener("SIGTERM", onSelfManagedSigterm);
-    }
+    synchronizeSelfManagedChromeTerminationSignalHandlers(enabled);
 }
 function installSelfManagedChromeCleanup() {
     if (selfManagedCleanupInstalled)
@@ -2081,28 +2264,47 @@ function installSelfManagedChromeCleanup() {
     selfManagedCleanupInstalled = true;
     process.once("exit", cleanupSelfManagedChromes);
     if (selfManagedTerminationSignalExitEnabled) {
-        process.once("SIGINT", onSelfManagedSigint);
-        process.once("SIGTERM", onSelfManagedSigterm);
+        synchronizeSelfManagedChromeTerminationSignalHandlers(true);
     }
-    process.once("SIGHUP", onSelfManagedSighup);
 }
-function registerSelfManagedChrome(child, profileDir) {
+function registerSelfManagedChrome(child, profileDir, processGroup = false) {
     installSelfManagedChromeCleanup();
     const identity = child.pid === undefined ? null : profileProcessIdentity(child.pid, profileDir);
-    if (identity !== null)
-        selfManagedChromes.set(identity.pid, identity);
+    if (identity !== null) {
+        const proof = trackOwnedChromeProcessTree(identity, processGroup);
+        if (proof !== null) {
+            const marker = proof.identity.process_marker;
+            if (marker !== undefined && !bindOwnerBrowserLaunch(marker, proof.identity)) {
+                releaseOwnedChromeProcessTree(proof);
+                throw new Error("local browser launch identity could not be bound to owner custody");
+            }
+            selfManagedChromes.set(identity.pid, { identity, processGroup, proof });
+        }
+    }
     child.once("exit", () => {
-        if (child.pid !== undefined)
+        if (child.pid === undefined)
+            return;
+        const tracked = selfManagedChromes.get(child.pid);
+        if (tracked === undefined)
+            return;
+        if (ownedChromeProcessTreeState(tracked.proof) === "stale") {
+            releaseOwnedChromeProcessTree(tracked.proof);
             selfManagedChromes.delete(child.pid);
+        }
     });
     return identity;
 }
-async function waitForTrackedProfileChildIdentity(child, profileDir, readIdentity, timeoutMs, pollMs) {
+async function waitForTrackedProfileChildIdentity(child, profileDir, readIdentity, timeoutMs, pollMs, processGroup = false) {
     const deadline = Date.now() + timeoutMs;
     while (childProcessIsRunning(child)) {
         const identity = child.pid === undefined ? null : readIdentity(child.pid, profileDir);
         if (identity !== null) {
-            selfManagedChromes.set(identity.pid, identity);
+            const existing = selfManagedChromes.get(identity.pid);
+            const proof = existing?.identity.start_time === identity.start_time
+                ? existing.proof
+                : trackOwnedChromeProcessTree(identity, processGroup);
+            if (proof !== null)
+                selfManagedChromes.set(identity.pid, { identity, processGroup, proof });
             return identity;
         }
         if (Date.now() >= deadline)
@@ -2117,7 +2319,172 @@ async function waitForTrackedProfileChildIdentity(child, profileDir, readIdentit
 export async function resolveAttachedProfileChildIdentity(child, profileDir, identity, options = {}) {
     if (identity !== null || (options.platform ?? process.platform) !== "linux")
         return identity;
-    return await waitForTrackedProfileChildIdentity(child, profileDir, options.readIdentity ?? profileProcessIdentity, options.identityTimeoutMs ?? PROFILE_IDENTITY_PROOF_TIMEOUT_MS, options.identityPollMs ?? PROFILE_IDENTITY_POLL_MS);
+    return await waitForTrackedProfileChildIdentity(child, profileDir, options.readIdentity ?? profileProcessIdentity, options.identityTimeoutMs ?? PROFILE_IDENTITY_PROOF_TIMEOUT_MS, options.identityPollMs ?? PROFILE_IDENTITY_POLL_MS, options.processGroup ?? false);
+}
+// Call this ONLY for a Chrome child spawned with detached:true. The identity
+// check protects against PID reuse, then POSIX negative-PID signalling reaches
+// Chrome's renderer/GPU/helper tree in one operation. A normal profile-root
+// signal remains the portable fallback for launchPersistentContext and Windows.
+export function signalOwnedChromeProcessTree(identity, processGroup, signal, options = {}) {
+    const profileMatches = options.profileMatches ?? profileProcessMatches;
+    const kill = options.kill ?? process.kill;
+    const proof = options.proof ??
+        captureOwnedChromeProcessTreeProof(identity, processGroup, {
+            profileMatches,
+            ...(options.platform === undefined ? {} : { platform: options.platform }),
+            ...(options.processTreePids === undefined
+                ? {}
+                : { processTreePids: options.processTreePids }),
+            ...(options.readBirthIdentity === undefined
+                ? {}
+                : { readBirthIdentity: options.readBirthIdentity }),
+        });
+    if (proof === null)
+        return false;
+    const platform = options.platform ?? process.platform;
+    const memberState = options.memberState ?? processBirthIdentityState;
+    const matchingMembers = proof.members.filter((member) => memberState(member) === "matching");
+    const matchingGroupMember = proof.processGroup && platform !== "win32"
+        ? matchingMembers.some((member) => platform !== "linux" ||
+            (options.processGroupId ?? linuxProcessGroupId)(member.pid) === proof.identity.pid)
+        : false;
+    if (matchingGroupMember) {
+        try {
+            kill(-proof.identity.pid, signal);
+            return true;
+        }
+        catch {
+            // A process may exit between the proof and the signal. Fall through to
+            // the root PID only while it is still identity-proven.
+        }
+    }
+    let signalled = false;
+    // Signal leaves first. This covers the Playwright persistent-context fallback
+    // (including chrome-headless-shell), whose child is not a detached process
+    // group leader but whose renderer tree is still rooted at the identity-proven
+    // browser PID.
+    for (const member of [...proof.members].reverse()) {
+        if (memberState(member) !== "matching")
+            continue;
+        try {
+            kill(member.pid, signal);
+            signalled = true;
+        }
+        catch {
+            // A child can naturally exit while the tree is being walked.
+        }
+    }
+    return signalled;
+}
+export function captureOwnedChromeProcessTreeProof(identity, processGroup, options = {}) {
+    const profileMatches = options.profileMatches ?? profileProcessMatches;
+    if (!profileMatches(identity, identity.user_data_dir))
+        return null;
+    const platform = options.platform ?? process.platform;
+    const pids = platform === "linux"
+        ? (options.processTreePids ?? linuxProcessTreePids)(identity.pid)
+        : [identity.pid];
+    const readBirthIdentity = options.readBirthIdentity ?? processBirthIdentity;
+    const members = pids.flatMap((pid) => {
+        if (pid === identity.pid)
+            return [{ pid, start_time: identity.start_time }];
+        const member = readBirthIdentity(pid);
+        return member === null ? [] : [member];
+    });
+    if (!members.some((member) => member.pid === identity.pid)) {
+        members.unshift({ pid: identity.pid, start_time: identity.start_time });
+    }
+    return { identity, processGroup, members };
+}
+function trackOwnedChromeProcessTree(identity, processGroup) {
+    installSelfManagedChromeCleanup();
+    const marker = operatorBrowserProcessMarker(identity.pid);
+    const trackedIdentity = marker === null ? identity : { ...identity, process_marker: marker };
+    const proof = captureOwnedChromeProcessTreeProof(trackedIdentity, processGroup);
+    if (proof === null)
+        return null;
+    ownedChromeProcessTrees.add(proof);
+    trackOwnerProcess(proof.identity);
+    return proof;
+}
+function releaseOwnedChromeProcessTree(proof) {
+    if (proof === null)
+        return;
+    ownedChromeProcessTrees.delete(proof);
+    untrackOwnerProcess(proof.identity);
+}
+export function ownedChromeProcessTreeState(proof, options = {}) {
+    const memberState = options.memberState ?? processBirthIdentityState;
+    let sawUnknown = false;
+    for (const member of proof.members) {
+        const state = memberState(member);
+        if (state === "matching")
+            return "matching";
+        if (state === "unknown")
+            sawUnknown = true;
+    }
+    return sawUnknown ? "unknown" : "stale";
+}
+function linuxProcessGroupId(pid) {
+    try {
+        const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+        const closeParen = stat.lastIndexOf(")");
+        if (closeParen < 0)
+            return null;
+        const processGroupId = Number(stat
+            .slice(closeParen + 2)
+            .trim()
+            .split(/\s+/)[2]);
+        return Number.isSafeInteger(processGroupId) ? processGroupId : null;
+    }
+    catch {
+        return null;
+    }
+}
+function linuxProcessTreePids(rootPid) {
+    try {
+        const childrenByParent = new Map();
+        for (const entry of readdirSync("/proc")) {
+            if (!/^\d+$/.test(entry))
+                continue;
+            const pid = Number(entry);
+            try {
+                const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+                const closeParen = stat.lastIndexOf(")");
+                if (closeParen < 0)
+                    continue;
+                const parentPid = Number(stat
+                    .slice(closeParen + 2)
+                    .trim()
+                    .split(/\s+/)[1]);
+                if (!Number.isSafeInteger(parentPid))
+                    continue;
+                const children = childrenByParent.get(parentPid) ?? [];
+                children.push(pid);
+                childrenByParent.set(parentPid, children);
+            }
+            catch {
+                // Processes leave /proc constantly; a partial tree is still safer than
+                // abandoning the profile-root browser after a failed close.
+            }
+        }
+        const pids = [];
+        const pending = [rootPid];
+        const seen = new Set();
+        while (pending.length > 0) {
+            const pid = pending.pop();
+            if (seen.has(pid))
+                continue;
+            seen.add(pid);
+            pids.push(pid);
+            for (const child of childrenByParent.get(pid) ?? [])
+                pending.push(child);
+        }
+        return pids;
+    }
+    catch {
+        return [rootPid];
+    }
 }
 export async function terminateTrackedProfileChild(child, profileDir, options = {}) {
     const readIdentity = options.readIdentity ?? profileProcessIdentity;
@@ -2131,10 +2498,20 @@ export async function terminateTrackedProfileChild(child, profileDir, options =
     if (identity === null && (options.platform ?? process.platform) !== "linux")
         return null;
     while (childProcessIsRunning(child)) {
-        identity ??= await waitForTrackedProfileChildIdentity(child, profileDir, readIdentity, options.identityTimeoutMs ?? PROFILE_IDENTITY_PROOF_TIMEOUT_MS, options.identityPollMs ?? PROFILE_IDENTITY_POLL_MS);
+        identity ??= await waitForTrackedProfileChildIdentity(child, profileDir, readIdentity, options.identityTimeoutMs ?? PROFILE_IDENTITY_PROOF_TIMEOUT_MS, options.identityPollMs ?? PROFILE_IDENTITY_POLL_MS, options.processGroup ?? false);
         if (identity === null)
             break;
-        selfManagedChromes.set(identity.pid, identity);
+        const existing = selfManagedChromes.get(identity.pid);
+        const proof = existing?.identity.start_time === identity.start_time
+            ? existing.proof
+            : trackOwnedChromeProcessTree(identity, options.processGroup ?? false);
+        if (proof !== null) {
+            selfManagedChromes.set(identity.pid, {
+                identity,
+                processGroup: options.processGroup ?? false,
+                proof,
+            });
+        }
         const terminated = terminate(identity, profileDir);
         if (!terminated) {
             identity = null;
@@ -2147,101 +2524,8 @@ export async function terminateTrackedProfileChild(child, profileDir, options =
             });
         }
     }
-    if (child.pid !== undefined)
-        selfManagedChromes.delete(child.pid);
     return identity;
 }
-// Stale verifier/operator browsers are the expensive leak mode: if the MCP process dies
-// mid-verify, self-launched Chrome survives as PPID=1 with a
-// ~/.trusty-squire/profiles/verify-* or ~/.trusty-squire/chrome-profile
-// user-data-dir. It keeps the profile lock,
-// burns memory, and may leave defunct helper children. A live verifier should
-// never be parented to init, so these are safe to reap at the next browser
-// startup. Best-effort and Linux-only; failure must not block signups.
-export function matchesReapableBrowserArgs(args, profileDirs, includeVerifier) {
-    return reapableBrowserProfile(args, profileDirs, includeVerifier) !== null;
-}
-function reapableBrowserProfile(args, profileDirs, includeVerifier) {
-    if (!/(?:chrome|chromium)/i.test(args))
-        return null;
-    const configuredProfiles = new Map(profileDirs.map((profileDir) => [profileDir, profilePathIdentity(profileDir)]));
-    const match = /--user-data-dir=(?:"([^"]+)"|'([^']+)'|([^\s]+))(?=\s|$)/.exec(args);
-    const candidate = match?.[1] ?? match?.[2] ?? match?.[3];
-    if (candidate !== undefined) {
-        const identity = profilePathIdentity(candidate);
-        if ([...configuredProfiles.values()].includes(identity))
-            return identity;
-        if (includeVerifier && /[/\\]\.trusty-squire[/\\]profiles[/\\]verify-[^/\\]+$/.test(identity)) {
-            return identity;
-        }
-    }
-    for (const [profileDir, identity] of configuredProfiles) {
-        for (const exactPath of new Set([profileDir, identity])) {
-            const variants = [exactPath, `"${exactPath}"`, `'${exactPath}'`];
-            if (variants.some((variant) => {
-                const option = `--user-data-dir=${variant}`;
-                const offset = args.indexOf(option);
-                return (offset >= 0 &&
-                    /\s|$/.test(args.slice(offset + option.length, offset + option.length + 1)));
-            })) {
-                return identity;
-            }
-        }
-    }
-    return null;
-}
-export function claimOrphanBrowserReapScope(profileDir) {
-    const includeVerifier = !orphanVerifierReapRan;
-    const profileDirs = [...new Set([CHROME_PROFILE_DIR, profileDir])].filter((candidate) => !orphanOperatorProfilesReaped.has(candidate));
-    if (!includeVerifier && profileDirs.length === 0)
-        return null;
-    orphanVerifierReapRan = true;
-    for (const candidate of profileDirs)
-        orphanOperatorProfilesReaped.add(candidate);
-    return { includeVerifier, profileDirs };
-}
-function reapOrphanedBrowsersOnce(profileDir) {
-    if (process.platform !== "linux")
-        return;
-    const scope = claimOrphanBrowserReapScope(profileDir);
-    if (scope === null)
-        return;
-    let rows = "";
-    try {
-        rows = execFileSync("ps", ["-eo", "pid=,ppid=,args="], {
-            stdio: ["ignore", "pipe", "ignore"],
-        }).toString("utf8");
-    }
-    catch {
-        return;
-    }
-    const identities = [];
-    for (const line of rows.split("\n")) {
-        const match = line.trim().match(/^(\d+)\s+(\d+)\s+(.+)$/);
-        if (match === null)
-            continue;
-        const pid = Number(match[1]);
-        const ppid = Number(match[2]);
-        const args = match[3] ?? "";
-        const expectedProfile = reapableBrowserProfile(args, scope.profileDirs, scope.includeVerifier);
-        if (Number.isFinite(pid) && ppid === 1 && expectedProfile !== null) {
-            const identity = profileProcessIdentity(pid, expectedProfile);
-            if (identity !== null)
-                identities.push(identity);
-        }
-    }
-    if (identities.length === 0)
-        return;
-    console.error(`[operator] reaping ${identities.length} orphaned Chrome process(es)`);
-    for (const identity of identities) {
-        signalProfileProcess(identity, identity.user_data_dir, "SIGTERM");
-    }
-    setTimeout(() => {
-        for (const identity of identities) {
-            signalProfileProcess(identity, identity.user_data_dir, "SIGKILL");
-        }
-    }, 2_000).unref();
-}
 // Classify an anti-bot interstitial page from its (title + body) text.
 // `onInterstitial` matches the static Cloudflare/Turnstile challenge copy.
 // `verificationPassed` is the signal the challenge SUCCEEDED — but
@@ -2288,122 +2572,45 @@ export function stripCloudflareChallengeParams(rawUrl) {
 export function childProcessIsRunning(child) {
     return child !== null && child.exitCode === null && child.signalCode === null;
 }
-export async function attachSelfManagedLoginContext(endpoint, child, profileDir, identity, options = {}) {
-    let browser = null;
-    try {
-        browser = await (options.launcher ?? getChromium()).connectOverCDP(endpoint);
-        const context = browser.contexts()[0];
-        if (context === undefined) {
-            throw new Error("self-launched login Chrome exposed no default browser context");
-        }
-        return { browser, context };
-    }
-    catch (error) {
-        await browser?.close().catch(() => undefined);
-        const terminateChild = options.terminateChild ??
-            ((ownedChild, ownedProfileDir, ownedIdentity) => terminateTrackedProfileChild(ownedChild, ownedProfileDir, {
-                identity: ownedIdentity,
-            }));
-        await terminateChild(child, profileDir, identity);
-        throw error;
-    }
-}
 function profileCollisionFromStderr(stderr) {
     return /ProcessSingleton|SingletonLock|profile.*in use/i.test(stderr)
         ? new ProfileBusyError(PROFILE_BUSY_MESSAGE)
         : null;
 }
-// Self-launch Chrome + connectOverCDP for the INTERACTIVE login (connect /
-// `mcp login`), instead of Playwright's launchPersistentContext.
-//
-// This is the STATE.md 2026-06-12 finding — the same launcher tell that fails
-// Cloudflare Turnstile from a launchPersistentContext-driven Chrome and passes
-// from a self-launched one — ported to the login path. BrowserController (the
-// signup path) already migrated; the connect login was the last consumer of
-// the detectable launcher. Kept STANDALONE (not a BrowserController method) so
-// the working signup path is untouched.
+// The signal that quits the plain login browser.
 //
-// Persistent profile is preserved: --user-data-dir=profileDir means the
-// provider session (Google/GitHub cookies) still lands in the bot's profile,
-// which the connect flow needs to seed for later Gmail-reading / OAuth signups.
-export async function launchSelfManagedLoginContext(params) {
-    let child = null;
-    let childIdentity = null;
-    const endpoint = await withChromeStartupLock(async () => {
-        const port = await findFreePort();
-        clearStaleSingletonLock(params.profileDir);
-        const argv = [
-            `--remote-debugging-port=${port}`,
-            "--remote-debugging-address=127.0.0.1",
-            `--user-data-dir=${params.profileDir}`,
-            "--no-first-run",
-            "--no-default-browser-check",
-            "--password-store=basic",
-            "--window-position=0,0",
-            `--window-size=${params.window.width},${params.window.height}`,
-            "--lang=en-US",
-            ...(params.extraArgs ?? []),
-            ...(params.proxyServer !== null ? [`--proxy-server=${params.proxyServer}`] : []),
-            // NB: we build argv ourselves, so Playwright's --enable-automation
-            // (and the rest of its launch instrumentation — the actual Turnstile
-            // tell) is never added. That is the whole point of self-launching.
-            params.appMode ? `--app=${params.initialUrl}` : params.initialUrl,
-        ];
-        const spawned = spawn(params.binary, argv, {
-            env: params.env,
-            stdio: ["ignore", "ignore", "pipe"],
-        });
-        child = spawned;
-        childIdentity = registerSelfManagedChrome(spawned, params.profileDir);
-        let chromeStderr = "";
-        spawned.stderr?.on("data", (chunk) => {
-            chromeStderr = (chromeStderr + chunk.toString("utf8")).slice(-4_000);
-        });
-        try {
-            const endpoint = await waitForDevtools(port, 30_000, spawned);
-            childIdentity = await resolveAttachedProfileChildIdentity(spawned, params.profileDir, childIdentity);
-            if (process.platform === "linux" && childIdentity === null) {
-                throw new Error("self-launched login Chrome exited before identity was proven");
-            }
-            return endpoint;
-        }
-        catch (err) {
-            childIdentity = await terminateTrackedProfileChild(spawned, params.profileDir, {
-                identity: childIdentity,
-            });
-            const detail = chromeStderr.trim();
-            const collision = profileCollisionFromStderr(detail);
-            if (collision !== null)
-                throw collision;
-            throw new Error(`${err instanceof Error ? err.message : String(err)}` +
-                `${detail.length > 0 ? `; Chrome stderr: ${detail}` : ""}`);
-        }
-    }, { deadlineMs: 0 });
-    if (child === null) {
-        throw new Error("self-launched login Chrome lost its process handle");
-    }
-    const { browser, context } = await attachSelfManagedLoginContext(endpoint, child, params.profileDir, childIdentity);
-    let torn = false;
-    const teardown = async () => {
-        if (torn)
-            return;
-        torn = true;
-        // Disconnect the CDP browser first; over connectOverCDP this leaves the
-        // real Chrome running, so kill the child explicitly (SIGTERM, then a
-        // hard SIGKILL after a short grace) to avoid the zombie-chrome leak.
-        await browser.close();
-        if (child !== null && childIdentity !== null) {
-            signalProfileProcess(childIdentity, params.profileDir, "SIGTERM");
-        }
-    };
-    const forceTeardown = () => {
-        if (childIdentity !== null) {
-            signalProfileProcess(childIdentity, params.profileDir, "SIGKILL");
-            selfManagedChromes.delete(childIdentity.pid);
-        }
-        reapProfileHolderIfOwned(params.profileDir, childIdentity);
-    };
-    return { context, teardown, forceTeardown, identity: childIdentity };
+// It MUST NOT be SIGTERM. Chrome routes SIGTERM to its "session ending" path,
+// which exits abruptly on the assumption the OS is tearing the machine down —
+// it does NOT flush the SQLite cookie store, and the store's own commit timer
+// is ~30s away. `connect` kills this browser within a couple of seconds of the
+// user finishing the Google OAuth dance, so a SIGTERM teardown discarded the
+// very session the ceremony existed to establish: the claim landed, the session
+// file was written, and the follow-up provider probe correctly reported "Google
+// not connected". SIGINT takes Chrome's graceful shutdown path, which flushes.
+// Measured on real Chrome 2026-09-04: cookie set 6s before the signal survives
+// SIGINT/SIGHUP and is lost on SIGTERM, deterministically, for both a bare pid
+// and a process-group signal.
+export const PLAIN_LOGIN_BROWSER_QUIT_SIGNAL = "SIGINT";
+// How long to let Chrome's graceful shutdown run before handing over to the
+// owner-launch reaper, whose own escalation starts at SIGTERM and would undo
+// the flush we just asked for.
+const PLAIN_LOGIN_BROWSER_QUIT_DEADLINE_MS = 10_000;
+// Quit the plain login browser and only THEN run the ownership-proving
+// teardown. Exported for tests: the ordering here is the fix, not an
+// implementation detail — `finalize` (the reaper) escalates SIGTERM →
+// SIGKILL, so running it while Chrome is still flushing reintroduces the
+// abrupt exit this signal choice exists to avoid.
+export async function quitPlainLoginBrowser(opts) {
+    const pollMs = opts.pollMs ?? 25;
+    const wait = opts.wait ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    // An undelivered quit has nothing to wait for — hand straight over to the
+    // reaper rather than burning the grace window on a process we cannot signal.
+    if (opts.signalQuit(PLAIN_LOGIN_BROWSER_QUIT_SIGNAL)) {
+        const deadline = Date.now() + (opts.deadlineMs ?? PLAIN_LOGIN_BROWSER_QUIT_DEADLINE_MS);
+        while (opts.isRunning() && Date.now() < deadline)
+            await wait(pollMs);
+    }
+    await opts.finalize();
 }
 // Launch a TRULY PLAIN Chrome for the interactive connect claim — NO
 // `--remote-debugging-port`, NO `connectOverCDP`, NO Playwright attach at all.
@@ -2416,93 +2623,146 @@ export async function launchSelfManagedLoginContext(params) {
 // though the same CDP browser passes a DIRECT accounts.google.com sign-in. The
 // tell is the CDP attachment itself (NOT the launcher, NOT the flags, NOT
 // `navigator.webdriver` — all separately ruled out). The connect claim doesn't
-// need to drive the browser: the USER signs in over noVNC, completion is read
-// from the API (`installPoll`), and provider seeding is read from the profile's
-// SQLite cookie store (`profileHasProviderCookies`). So we spawn Chrome and
-// only ever kill it — never attach.
+// need to drive the browser: the USER signs in interactively, completion comes
+// from the API (`installPoll`) plus its explicit Finish callback. So we spawn
+// Chrome and only ever kill it — never attach.
 //
 // Persistent profile is preserved (--user-data-dir=profileDir) so the Google/
 // GitHub session still lands in the bot's profile for later signups.
 export async function launchPlainLoginBrowser(params) {
     let child = null;
     let childIdentity = null;
-    await withChromeStartupLock(async () => {
-        clearStaleSingletonLock(params.profileDir);
-        const argv = [
-            `--user-data-dir=${params.profileDir}`,
-            "--no-first-run",
-            "--no-default-browser-check",
-            "--password-store=basic",
-            "--window-position=0,0",
-            `--window-size=${params.window.width},${params.window.height}`,
-            "--lang=en-US",
-            ...(params.extraArgs ?? []),
-            ...(params.proxyServer !== null ? [`--proxy-server=${params.proxyServer}`] : []),
-            `--app=${params.url}`,
-        ];
-        const spawned = spawn(params.binary, argv, {
-            env: params.env,
-            stdio: ["ignore", "ignore", "pipe"],
-        });
-        child = spawned;
-        childIdentity = registerSelfManagedChrome(spawned, params.profileDir);
-        let chromeStderr = "";
-        spawned.stderr?.on("data", (chunk) => {
-            chromeStderr = (chromeStderr + chunk.toString("utf8")).slice(-4_000);
-        });
-        // Give Chrome a moment to actually come up (or die). Unlike the CDP path
-        // there is no devtools endpoint to poll — but a crash-on-launch (bad
-        // profile, missing lib) should surface here, not 15min later as a blank
-        // noVNC. If the process is already dead, throw with its stderr.
-        await new Promise((r) => setTimeout(r, 1_200));
-        childIdentity ??=
-            spawned.pid === undefined ? null : profileProcessIdentity(spawned.pid, params.profileDir);
-        childIdentity = await resolveAttachedProfileChildIdentity(spawned, params.profileDir, childIdentity);
-        if (childIdentity !== null)
-            selfManagedChromes.set(childIdentity.pid, childIdentity);
-        if (!childProcessIsRunning(spawned)) {
-            reapProfileHolderIfOwned(params.profileDir, childIdentity);
-            const detail = chromeStderr.trim();
-            const collision = profileCollisionFromStderr(detail);
-            if (collision !== null)
-                throw collision;
-            const termination = spawned.exitCode !== null
-                ? `code ${spawned.exitCode}`
-                : `signal ${spawned.signalCode ?? "unknown"}`;
-            throw new Error(`plain login Chrome exited immediately (${termination})` +
-                `${detail.length > 0 ? `; Chrome stderr: ${detail}` : ""}`);
-        }
-        if (process.platform === "linux" && childIdentity === null) {
-            throw new Error("plain login Chrome identity could not be proven");
-        }
-    }, { deadlineMs: 0 });
-    let torn = false;
+    // Login's plain browser is the no-CDP path used for Google sign-in. Reserve
+    // its marker before launch so the rc.15 fail-closed reaper bind is legitimate.
+    const ownership = registerLocalBrowserLaunch(params.profileDir, params.env);
+    const launchMarker = ownership.marker;
+    let spawned = false;
+    try {
+        await withChromeStartupLock(async () => {
+            clearStaleSingletonLock(params.profileDir);
+            const argv = [
+                `--user-data-dir=${params.profileDir}`,
+                "--no-first-run",
+                "--no-default-browser-check",
+                "--password-store=basic",
+                "--window-position=0,0",
+                `--window-size=${params.window.width},${params.window.height}`,
+                "--lang=en-US",
+                ...(params.extraArgs ?? []),
+                ...(params.proxyServer !== null ? [`--proxy-server=${params.proxyServer}`] : []),
+                `--app=${params.url}`,
+            ];
+            const launched = spawnLocalBrowser(params.binary, argv, params.profileDir, {
+                detached: process.platform !== "win32",
+                env: ownership.env,
+                stdio: ["ignore", "ignore", "pipe"],
+                marker: launchMarker,
+            });
+            child = launched;
+            spawned = true;
+            let chromeStderr = "";
+            launched.stderr?.on("data", (chunk) => {
+                chromeStderr = (chromeStderr + chunk.toString("utf8")).slice(-4_000);
+            });
+            // Give Chrome a moment to actually come up (or die). Unlike the CDP path
+            // there is no devtools endpoint to poll — but a crash-on-launch (bad
+            // profile, missing lib) should surface here, not 15min later as a blank
+            // browser. If the process is already dead, throw with its stderr.
+            await new Promise((r) => setTimeout(r, 1_200));
+            childIdentity ??=
+                launched.pid === undefined
+                    ? null
+                    : profileProcessIdentity(launched.pid, params.profileDir);
+            childIdentity = await resolveAttachedProfileChildIdentity(launched, params.profileDir, childIdentity);
+            childIdentity = registerSelfManagedChrome(launched, params.profileDir) ?? childIdentity;
+            if (childIdentity !== null) {
+                const existing = selfManagedChromes.get(childIdentity.pid);
+                const proof = existing?.identity.start_time === childIdentity.start_time
+                    ? existing.proof
+                    : trackOwnedChromeProcessTree(childIdentity, false);
+                if (proof !== null) {
+                    selfManagedChromes.set(childIdentity.pid, {
+                        identity: childIdentity,
+                        processGroup: false,
+                        proof,
+                    });
+                }
+                // Bind the owner-launch anchor to the profile-proven child identity.
+                // registerSelfManagedChrome only binds when it can read the marker back
+                // from the process, but Chrome erases the marker from its own environ
+                // when it rewrites process titles, so that bind is skipped here. Use
+                // the marker we generated for THIS launch, keyed to the tracked launch
+                // record, so teardown can trust this anchor and reap the marker-only
+                // wrapper processes (the google-chrome launcher's stdout/stderr `cat`
+                // relays and crashpad) instead of reporting closure unproven.
+                bindOwnerBrowserLaunch(launchMarker, childIdentity);
+            }
+            if (!childProcessIsRunning(launched)) {
+                reapProfileHolderIfOwned(params.profileDir, childIdentity);
+                const detail = chromeStderr.trim();
+                const collision = profileCollisionFromStderr(detail);
+                if (collision !== null)
+                    throw collision;
+                const termination = launched.exitCode !== null
+                    ? `code ${launched.exitCode}`
+                    : `signal ${launched.signalCode ?? "unknown"}`;
+                throw new Error(`plain login Chrome exited immediately (${termination})` +
+                    `${detail.length > 0 ? `; Chrome stderr: ${detail}` : ""}`);
+            }
+            if (process.platform === "linux" && childIdentity === null) {
+                throw new Error("plain login Chrome identity could not be proven");
+            }
+        }, { deadlineMs: 0 });
+    }
+    catch (error) {
+        if (!spawned)
+            untrackOwnerBrowserLaunch(launchMarker);
+        throw error;
+    }
+    let teardownPromise;
     const forceTeardown = () => {
+        markLocalBrowserLaunchTerminal(child);
         if (childIdentity !== null) {
-            signalProfileProcess(childIdentity, params.profileDir, "SIGKILL");
-            selfManagedChromes.delete(childIdentity.pid);
+            const tracked = selfManagedChromes.get(childIdentity.pid);
+            signalOwnedChromeProcessTree(childIdentity, false, "SIGKILL", {
+                ...(tracked === undefined ? {} : { proof: tracked.proof }),
+            });
+        }
+        else if (childProcessIsRunning(child)) {
+            child?.kill("SIGKILL");
         }
         reapProfileHolderIfOwned(params.profileDir, childIdentity);
     };
-    const teardown = async () => {
-        if (torn)
-            return;
-        torn = true;
-        if (child !== null && childIdentity !== null) {
-            signalProfileProcess(childIdentity, params.profileDir, "SIGTERM");
-        }
+    const teardown = () => {
+        teardownPromise ??= (async () => {
+            markLocalBrowserLaunchTerminal(child);
+            await quitPlainLoginBrowser({
+                signalQuit: (signal) => {
+                    if (child !== null && childIdentity !== null) {
+                        return signalProfileProcess(childIdentity, params.profileDir, signal);
+                    }
+                    if (childProcessIsRunning(child)) {
+                        child?.kill(signal);
+                        return true;
+                    }
+                    return false;
+                },
+                isRunning: () => childProcessIsRunning(child),
+                finalize: async () => await closeLocalBrowserLaunch(launchMarker, params.profileDir),
+            });
+        })();
+        return teardownPromise;
     };
     return {
         teardown,
         forceTeardown,
         isRunning: () => childProcessIsRunning(child),
         identity: childIdentity,
+        marker: launchMarker,
     };
 }
 export class BrowserController {
-    // The persistent browser context. Persistent (launchPersistentContext)
-    // rather than an ephemeral context so the profile carries the user's
-    // Google session across runs — see profile.ts / google-login.ts.
+    // A persistent browser context backed by the user's real Chrome profile.
     context = null;
     page = null;
     checkoutCardGroupScope;
@@ -2511,31 +2771,43 @@ export class BrowserController {
     observedPaymentInstrumentMismatch;
     checkoutSubmitSequence = 0;
     clickDispatchSequence = 0;
-    sealedDocumentSequence = 0;
-    sealedDocuments = new Map();
+    mainDocumentSequence = 0;
+    mainDocumentIdentities = new WeakMap();
+    trackedMainDocumentPages = new WeakSet();
     // The page start() configured with the controller's navigation/captcha
-    // handlers. OAuth may temporarily switch `this.page` to a popup, but warm
+    // handlers. OAuth may temporarily switch `this.page` to a popup, but session
     // reuse must always restore this original page rather than adopting a popup
     // whose lifecycle handlers were never installed.
     primaryPage = null;
+    // Tabs the PAGE opened (target=_blank / window.open) since the operator armed
+    // adoption for an action, oldest first. A real user lands on the tab their
+    // click opened — an email magic-link button in Gmail is the case this exists
+    // for — so the operator has to follow it too. Reading the link's href instead
+    // is not an option: a single-use login token is sealed and must never be
+    // handed to the model as text.
+    openedTabs = [];
     // Self-launch path (Turnstile-safe; see selfLaunchEnabled). When we spawn
     // Chrome ourselves and attach over CDP, these hold the child process and
     // the connected Browser so close() can tear both down.
     childChrome = null;
     childChromeIdentity = null;
+    childChromeProcessGroup = false;
+    ownedDisplayRig = null;
+    ownedChromeProcessTreeProof = null;
+    operatorProcessMarker = null;
+    ownerLaunchTracked = false;
     cdpBrowser = null;
     // True once a local browser context launched this session.
     launchedContext = false;
     launchedProfileHolderIdentity = null;
-    profileOperationLease = null;
     startPromise = null;
     closePromise = null;
     startCancellationRequested = false;
     startLaunchCommitted = false;
     startSettled = false;
     persistentFallbackLaunchInFlight = false;
+    persistentFallbackOwnershipMonitor = null;
     persistentFallbackCancellationState = null;
-    profilePoolReusable = true;
     resolveStartCancellation = null;
     startCancellation = new Promise((resolveCancellation) => {
         this.resolveStartCancellation = resolveCancellation;
@@ -2563,6 +2835,7 @@ export class BrowserController {
     // siblings and fails-fast on genuinely out-of-scope in-page API calls. When
     // null/never set (harness replay, non-session use) the guard is inert.
     hostScopeAllowedHostsProvider = null;
+    operationScopedAllowedHosts = new Map();
     hostScopeGuardInstallation = null;
     // Feed the current session's allowed hosts to the request-scope guard. Read
     // lazily per request, so allow_host / auto-widen updates take effect without
@@ -2571,7 +2844,7 @@ export class BrowserController {
     // sessions, never for harness/replay or non-session browsers.
     async setHostScopeAllowedHosts(provider, siblingDomainProvider = provider) {
         this.hostScopeAllowedHostsProvider = () => ({
-            allowedHosts: provider(),
+            allowedHosts: [...provider(), ...this.operationScopedAllowedHosts.keys()],
             siblingDomainHosts: siblingDomainProvider(),
         });
         this.hostScopeGuardInstallation ??= this.installHostScopeGuard().catch((error) => {
@@ -2580,6 +2853,24 @@ export class BrowserController {
         });
         await this.hostScopeGuardInstallation;
     }
+    async withTemporaryHostScopeAllowedHosts(hosts, operation) {
+        const normalized = [...new Set(hosts.map((host) => host.trim().toLowerCase()).filter(Boolean))];
+        for (const host of normalized) {
+            this.operationScopedAllowedHosts.set(host, (this.operationScopedAllowedHosts.get(host) ?? 0) + 1);
+        }
+        try {
+            return await operation();
+        }
+        finally {
+            for (const host of normalized) {
+                const remaining = (this.operationScopedAllowedHosts.get(host) ?? 1) - 1;
+                if (remaining <= 0)
+                    this.operationScopedAllowedHosts.delete(host);
+                else
+                    this.operationScopedAllowedHosts.set(host, remaining);
+            }
+        }
+    }
     // Defect-A fail-fast request-scope guard. Only XHR/fetch subresource API
     // calls are scope-guarded; page-load resources (scripts/styles/images/frames)
     // always continue, so a legitimate render is never broken by the guard. A
@@ -2622,58 +2913,125 @@ export class BrowserController {
     oauthProductPage = null;
     oauthProviderPage = null;
     oauthProviderPageClosed = false;
-    // Deep-investigation instrumentation (UNIVERSAL_BOT_OAUTH_DEBUG): a ring
-    // buffer of OAuth/SSO-relevant network responses, so we can see WHY a Clerk/
-    // Stytch SSO callback fails to persist a session (cookie not set, FAPI
-    // rejection, etc.) without guessing. Off by default; zero cost when unset.
-    oauthNetLog = [];
-    oauthNetListenerAttached = false;
-    // F13 — on-demand Xvfb. Set when start() determined the host has no
-    // display surface but Xvfb is available, so Chrome can run with
-    // `headless: false` against a virtual display (Cloudflare/Stytch et
-    // al. detect Chromium-headless and block their signup forms). Torn
-    // down by close().
-    xvfb = null;
-    // F13 — which launch path start() took. Surfaced via .launchMode so
-    // the agent can push it into the run's step trail and we can see
-    // (from outside the box) whether the bot ran headed.
+    // Surfaced in the run trail so operators can distinguish local headed,
+    // remote, and headless launches.
     launchedMode = "unknown";
     get launchMode() {
         return this.launchedMode;
     }
     constructor(opts = {}) {
         this.humanize = opts.humanize ?? true;
-        this.profileDir = opts.profileDir ?? CHROME_PROFILE_DIR;
-        this.profileOperationLease = opts.profileOperationLease ?? null;
+        this.profileDir = opts.profileDir ?? "";
         this.proxyOverride =
             opts.proxyUrl !== undefined && opts.proxyUrl.trim().length > 0 ? opts.proxyUrl.trim() : null;
     }
+    trackMainDocument(page) {
+        if (this.trackedMainDocumentPages.has(page))
+            return;
+        this.trackedMainDocumentPages.add(page);
+        this.mainDocumentIdentities.set(page, ++this.mainDocumentSequence);
+        // A REPLACED main document advances the identity; a same-document History
+        // API navigation does not. Playwright emits `framenavigated` for both, so
+        // keying on it made every `history.replaceState` inside an SPA checkout
+        // retire every operator ref mid-form — the identity churned faster than a
+        // multi-field address block could be filled. `domcontentloaded` fires once
+        // per real main-frame document (playwright's client `Frame` gates it on
+        // `!this._parentFrame`), which is exactly the document-replacement signal.
+        // A same-document route change to a genuinely different logical page is
+        // still caught by the observation epoch's normalized origin+pathname fold
+        // (compactV2EpochDoc), which is the backstop this narrowing relies on.
+        page.on("domcontentloaded", () => {
+            this.mainDocumentIdentities.set(page, ++this.mainDocumentSequence);
+        });
+    }
+    mainDocumentIdentity() {
+        const page = this.page;
+        if (page === null)
+            return "none";
+        this.trackMainDocument(page);
+        return String(this.mainDocumentIdentities.get(page));
+    }
     /** Attach normal controller behavior to a harness-owned Playwright page. */
     static fromHarnessPage(page) {
         const controller = new BrowserController({ humanize: false });
         controller.context = page.context();
         controller.page = page;
         controller.primaryPage = page;
+        controller.trackMainDocument(page);
+        controller.trackOpenedTabs(page.context());
         controller.harnessAttachedPage = true;
         controller.launchedMode = "headless";
         return controller;
     }
+    // Record every page the CONTEXT opens. Covers window.open popups and
+    // target=_blank tabs alike; Playwright emits the same context-level "page"
+    // event for both.
+    trackOpenedTabs(context) {
+        context.on("page", (page) => {
+            this.trackMainDocument(page);
+            this.openedTabs.push(page);
+            // Bounded: adoption only ever reads the newest followable entry, and a
+            // controller driven by something other than the operator's click path
+            // never arms (and so never drains) this queue.
+            if (this.openedTabs.length > 8)
+                this.openedTabs.splice(0, this.openedTabs.length - 8);
+        });
+    }
     // Per-launch egress override. null means direct egress. Explicit overrides
     // are never subject to host-network classification.
     proxyOverride;
-    // Warm reuse is deliberately narrow: a browser belongs to exactly one
-    // persistent profile and one explicit egress override. Undefined/blank proxy
-    // values both mean direct egress.
-    matchesLaunchOptions(opts) {
-        const profileDir = opts.profileDir ?? CHROME_PROFILE_DIR;
-        const proxyUrl = opts.proxyUrl !== undefined && opts.proxyUrl.trim().length > 0 ? opts.proxyUrl.trim() : null;
-        return this.profileDir === profileDir && this.proxyOverride === proxyUrl;
-    }
-    /** Identity persisted by the operator profile lease for owner-safe crash recovery. */
-    operatorWorkerIdentity() {
-        return this.childChromeIdentity ?? this.launchedProfileHolderIdentity;
-    }
-    // Required health gate for a warm browser. BrowserContext alone is not a
+    operatorBrowserMarker() {
+        this.operatorProcessMarker ??= createOperatorBrowserMarker();
+        return this.operatorProcessMarker;
+    }
+    async ownedHeadedBrowserEnvironment() {
+        if (this.ownedDisplayRig === null) {
+            const { createXvfbDisplayRig, startRemoteLoginDisplay } = await import("./remote-login-display.js");
+            const rig = createXvfbDisplayRig();
+            this.ownedDisplayRig = rig;
+            await startRemoteLoginDisplay(rig);
+        }
+        const { remoteLoginEnvironment } = await import("./remote-login-display.js");
+        const rig = this.ownedDisplayRig;
+        if (rig === null)
+            throw new Error("headed operator display did not start");
+        return remoteLoginEnvironment(rig, process.env);
+    }
+    async teardownOwnedDisplay() {
+        const rig = this.ownedDisplayRig;
+        this.ownedDisplayRig = null;
+        if (rig === null)
+            return;
+        const { teardownRemoteLoginRig } = await import("./remote-login-display.js");
+        await teardownRemoteLoginRig(rig);
+    }
+    adoptOwnedChromeProcessTree(identity, processGroup) {
+        if (this.ownedChromeProcessTreeProof?.identity.pid === identity.pid &&
+            this.ownedChromeProcessTreeProof.identity.start_time === identity.start_time) {
+            return this.ownedChromeProcessTreeProof;
+        }
+        const tracked = selfManagedChromes.get(identity.pid);
+        const proof = tracked?.identity.start_time === identity.start_time
+            ? tracked.proof
+            : trackOwnedChromeProcessTree(identity, processGroup);
+        if (proof !== null && this.ownerLaunchTracked) {
+            if (!bindOwnerBrowserLaunch(this.operatorBrowserMarker(), proof.identity)) {
+                releaseOwnedChromeProcessTree(proof);
+                throw new Error("local browser launch identity could not be bound to owner custody");
+            }
+        }
+        if (proof !== null)
+            this.ownedChromeProcessTreeProof = proof;
+        return proof;
+    }
+    signalCurrentSelfManagedChrome(identity, signal) {
+        return signalOwnedChromeProcessTree(identity, this.childChromeProcessGroup, signal, {
+            ...(this.ownedChromeProcessTreeProof === null
+                ? {}
+                : { proof: this.ownedChromeProcessTreeProof }),
+        });
+    }
+    // Required health gate for a live session browser. BrowserContext alone is not a
     // sufficient signal: a dead CDP transport can leave stale JS objects behind.
     isConnected() {
         const browser = this.cdpBrowser ?? this.context?.browser() ?? null;
@@ -2740,13 +3098,12 @@ export class BrowserController {
             }
             return ctx;
         }
-        const endpoint = await withChromeStartupLock(async () => {
-            this.throwIfStartCancelled();
-            const port = await findFreePort();
+        const endpoint = await (async () => {
             this.throwIfStartCancelled();
             clearStaleSingletonLock(this.profileDir);
+            rmSync(join(this.profileDir, DEVTOOLS_ACTIVE_PORT_FILE), { force: true });
             const argv = [
-                `--remote-debugging-port=${port}`,
+                "--remote-debugging-port=0",
                 "--remote-debugging-address=127.0.0.1",
                 `--user-data-dir=${this.profileDir}`,
                 "--no-first-run",
@@ -2757,16 +3114,23 @@ export class BrowserController {
                 "--lang=en-US",
                 ...params.args,
                 ...(params.proxy !== null ? [`--proxy-server=${params.proxy.server}`] : []),
-                ...(params.headless ? ["--headless=new"] : []),
                 "about:blank",
             ];
             this.commitProfileLaunch();
-            const child = spawn(params.binary, argv, {
+            const child = spawnLocalBrowser(params.binary, argv, this.profileDir, {
                 env: params.env,
                 stdio: ["ignore", "ignore", "pipe"],
+                // A dedicated process group gives the session a single, identity-
+                // proven teardown target for Chrome plus every renderer/GPU helper.
+                detached: process.platform !== "win32",
+                marker: this.operatorBrowserMarker(),
             });
             this.childChrome = child;
-            this.childChromeIdentity = registerSelfManagedChrome(child, this.profileDir);
+            this.childChromeProcessGroup = process.platform !== "win32";
+            this.childChromeIdentity = registerSelfManagedChrome(child, this.profileDir, this.childChromeProcessGroup);
+            if (this.childChromeIdentity !== null) {
+                this.adoptOwnedChromeProcessTree(this.childChromeIdentity, this.childChromeProcessGroup);
+            }
             let chromeStderr = "";
             let chromeExit = "";
             child.stderr?.on("data", (chunk) => {
@@ -2780,11 +3144,14 @@ export class BrowserController {
                 throw new Error("BrowserController start cancelled");
             }
             try {
-                const endpoint = await waitForDevtools(port, 30_000);
-                this.childChromeIdentity = await resolveAttachedProfileChildIdentity(child, this.profileDir, this.childChromeIdentity);
+                const endpoint = await waitForOwnedDevtoolsEndpoint(this.profileDir, 30_000, child);
+                this.childChromeIdentity = await resolveAttachedProfileChildIdentity(child, this.profileDir, this.childChromeIdentity, { processGroup: this.childChromeProcessGroup });
                 if (process.platform === "linux" && this.childChromeIdentity === null) {
                     throw new Error("self-launched Chrome exited before identity was proven");
                 }
+                if (this.childChromeIdentity !== null) {
+                    this.adoptOwnedChromeProcessTree(this.childChromeIdentity, this.childChromeProcessGroup);
+                }
                 return endpoint;
             }
             catch (err) {
@@ -2792,14 +3159,25 @@ export class BrowserController {
                     profileProcessMatches(this.childChromeIdentity, this.profileDir);
                 this.childChromeIdentity = await terminateTrackedProfileChild(child, this.profileDir, {
                     identity: this.childChromeIdentity,
+                    terminate: (identity, profileDir) => {
+                        const signalled = signalOwnedChromeProcessTree(identity, this.childChromeProcessGroup, "SIGKILL", {
+                            ...(this.ownedChromeProcessTreeProof === null
+                                ? {}
+                                : { proof: this.ownedChromeProcessTreeProof }),
+                        });
+                        reapProfileHolderIfOwned(profileDir, identity);
+                        return signalled;
+                    },
+                    processGroup: this.childChromeProcessGroup,
                 });
                 this.childChrome = null;
                 this.childChromeIdentity = null;
+                this.childChromeProcessGroup = false;
                 const detail = chromeStderr.trim();
                 throw new Error(`${err instanceof Error ? err.message : String(err)}; Chrome pid=${child.pid ?? "unknown"} alive=${alive ? 1 : 0}` +
                     `${chromeExit}${detail.length > 0 ? `; Chrome stderr: ${detail}` : ""}`);
             }
-        }, { deadlineMs: 0 });
+        })();
         // Use the patchright launcher's connectOverCDP — it's the exact path the
         // falsification experiment validated (its connect avoids Runtime.enable,
         // which a plain attach would emit). The anti-detection that matters here
@@ -2816,10 +3194,21 @@ export class BrowserController {
     async cancelSpawnedSelfManagedChrome(child) {
         this.childChromeIdentity = await terminateTrackedProfileChild(child, this.profileDir, {
             identity: this.childChromeIdentity,
+            terminate: (identity, profileDir) => {
+                const signalled = signalOwnedChromeProcessTree(identity, this.childChromeProcessGroup, "SIGKILL", {
+                    ...(this.ownedChromeProcessTreeProof === null
+                        ? {}
+                        : { proof: this.ownedChromeProcessTreeProof }),
+                });
+                reapProfileHolderIfOwned(profileDir, identity);
+                return signalled;
+            },
+            processGroup: this.childChromeProcessGroup,
         });
         if (this.childChrome === child)
             this.childChrome = null;
         this.childChromeIdentity = null;
+        this.childChromeProcessGroup = false;
     }
     // Resource blocking for speed (BOT_BLOCK_RESOURCES, default OFF). Aborts
     // image/media/font requests + known analytics/tracker hosts to cut page-load
@@ -2894,6 +3283,9 @@ export class BrowserController {
         console.error("[operator] resource blocking ON (image/media/font + analytics aborted; captcha/CSS/JS allowed)");
     }
     async start() {
+        if (this.profileDir.length === 0) {
+            throw new Error("BrowserController.start requires a per-session profile directory");
+        }
         if (this.closePromise !== null)
             throw new Error("BrowserController is already closing");
         this.startPromise ??= this.startOnce();
@@ -2901,24 +3293,19 @@ export class BrowserController {
     }
     async startOnce() {
         const remoteMode = (process.env.BOT_CDP_ENDPOINT ?? "").trim().length > 0;
-        const lease = this.profileOperationLease ??
-            (remoteMode ? null : await acquireFreeProfileOperationGuard(this.profileDir));
-        this.profileOperationLease = lease;
+        if (!remoteMode)
+            startGlobalOperatorBrowserProcessWatchdog();
         try {
-            await this.startWithProfileGuard();
+            await this.startBrowser();
             if (this.startCancellationRequested) {
-                await this.closeWithProfileGuard();
+                await this.closeBrowser();
                 throw new Error("BrowserController start cancelled");
             }
         }
         catch (err) {
+            await this.teardownOwnedDisplay().catch(() => undefined);
             if (this.startCancellationRequested && this.persistentFallbackCancellationState === null) {
-                await this.closeWithProfileGuard().catch(() => undefined);
-            }
-            if (this.persistentFallbackCancellationState === null ||
-                this.persistentFallbackCancellationState === "closed") {
-                this.profileOperationLease = null;
-                lease?.release();
+                await this.closeBrowser().catch(() => undefined);
             }
             throw err;
         }
@@ -2934,9 +3321,8 @@ export class BrowserController {
         this.throwIfStartCancelled();
         this.startLaunchCommitted = true;
     }
-    async startWithProfileGuard() {
+    async startBrowser() {
         this.throwIfStartCancelled();
-        reapOrphanedBrowsersOnce(this.profileDir);
         const channel = await detectChromiumChannel();
         this.throwIfStartCancelled();
         this.launchedChannel = channel;
@@ -2951,7 +3337,7 @@ export class BrowserController {
         // (e.g. a Mac with a real GPU + residential egress) and we attach over CDP
         // across Tailscale. The remote machine IS a real device, so we spoof
         // NOTHING — no WebGL/device fingerprint patch (a fake-Intel string over a
-        // real Apple-GPU output would be its own mismatch tell), no local Xvfb, no
+        // real Apple-GPU output would be its own mismatch tell), no local display, no
         // egress-geo override (the remote host's real timezone + residential IP are
         // authentic). software-WebGL output is exactly what the toughest anti-bot
         // (hCaptcha Enterprise) scores; only real hardware fixes the pixel
@@ -2959,15 +3345,20 @@ export class BrowserController {
         const remoteMode = (process.env.BOT_CDP_ENDPOINT ?? "").trim().length > 0;
         if (remoteMode) {
             console.error(`[operator] REMOTE-CDP mode — attaching to ${(process.env.BOT_CDP_ENDPOINT ?? "").trim()} ` +
-                `(real-host GPU + egress; local fingerprint spoof + Xvfb DISABLED)`);
+                `(real-host GPU + egress; local fingerprint spoof + display setup disabled)`);
+        }
+        if (!remoteMode && !this.ownerLaunchTracked) {
+            registerLocalBrowserLaunch(this.profileDir, process.env, this.operatorBrowserMarker());
+            this.ownerLaunchTracked = true;
         }
+        const browserEnv = remoteMode ? process.env : await this.ownedHeadedBrowserEnvironment();
         // T3.1: probe where this run's traffic actually exits so the
         // browser's declared timezone matches its egress IP (a US-timezone
         // browser on a foreign proxy IP is itself an anti-bot signal).
         // Done before the real launch: launchPersistentContext bakes the
         // timezone in at creation, with no way to set it afterward. Skipped in
         // remote mode — the remote host's own clock/IP are the authentic truth.
-        const geo = remoteMode ? null : await this.probeEgressGeo(channel, proxy);
+        const geo = remoteMode ? null : await this.probeEgressGeo(channel, proxy, browserEnv);
         this.throwIfStartCancelled();
         if (geo !== null) {
             console.error(`[operator] egress geo: timezone=${geo.timezoneId}` +
@@ -2975,84 +3366,12 @@ export class BrowserController {
                     ? ` loc=${geo.geolocation.latitude},${geo.geolocation.longitude}`
                     : ""));
         }
-        // F13 — decide whether to spin up Xvfb and run Chrome headed.
-        // Modern SaaS signups (Cloudflare/Stytch, Clerk, Auth0) detect
-        // Chromium-headless via JS fingerprints and gate their forms
-        // behind the check. Running headed against Xvfb defeats the gate
-        // — the user never sees the display.
-        //
-        // The decision matrix:
-        //   - UNIVERSAL_BOT_HEADLESS=true (explicit opt-in): keep true
-        //     headless. CI / Codespaces that lack Xvfb.
-        //   - UNIVERSAL_BOT_HEADLESS=false (explicit opt-out): the
-        //     current pre-F13 behavior — DISPLAY must exist already.
-        //   - default + DISPLAY set: run headed against the existing
-        //     display (laptop/desktop install).
-        //   - default + no DISPLAY + Xvfb on PATH: spawn Xvfb, run
-        //     headed against it (the headless-server install — what
-        //     Cloudflare needed).
-        //   - default + no DISPLAY + no Xvfb: fall back to true
-        //     headless with a clear stderr warning.
-        let chromeEnv;
-        let chromeHeadless;
-        const explicitHeadless = process.env.UNIVERSAL_BOT_HEADLESS;
-        const hostHasDisplay = process.platform === "darwin" ||
-            process.platform === "win32" ||
-            (typeof process.env.DISPLAY === "string" && process.env.DISPLAY.length > 0);
-        if (explicitHeadless === "true") {
-            chromeHeadless = true;
-            this.launchedMode = "headless";
-        }
-        else if (explicitHeadless === "false") {
-            chromeHeadless = false;
-            this.launchedMode = "display";
-        }
-        else if (hostHasDisplay) {
-            chromeHeadless = false;
-            this.launchedMode = "display";
-        }
-        else if (xvfbAvailable()) {
-            try {
-                // 1920×1080 — the most common real desktop resolution. The old
-                // 1280×720 here was exactly Playwright's emulated-device viewport
-                // default (the code's own comments flag that as an anti-bot tell),
-                // and with viewport:null the page read it straight back. A 720p
-                // screen whose availHeight==height (no taskbar) is a headless
-                // signature strict Turnstiles (exa/cartesia) score against.
-                const xvfb = await startXvfb({ width: 1920, height: 1080 });
-                if (this.startCancellationRequested) {
-                    xvfb.stop();
-                    this.throwIfStartCancelled();
-                }
-                this.xvfb = xvfb;
-                chromeEnv = { ...process.env, DISPLAY: xvfb.display };
-                chromeHeadless = false;
-                this.launchedMode = "xvfb";
-                console.error(`[operator] no DISPLAY — spawned Xvfb at ${this.xvfb.display} for headed Chrome`);
-            }
-            catch (err) {
-                console.error(`[operator] Xvfb failed (${err instanceof Error ? err.message : String(err)}) — ` +
-                    `falling back to true headless; Cloudflare/Stytch-class signups may fail`);
-                chromeHeadless = true;
-                this.launchedMode = "headless";
-            }
-        }
-        else {
-            console.error(`[operator] no DISPLAY and Xvfb not installed — running true headless. ` +
-                `For Cloudflare/Stytch-class signups install xvfb: apt-get install -y xvfb`);
-            chromeHeadless = true;
-            this.launchedMode = "headless";
-        }
-        const free = await waitForProfileFree(this.profileDir, { deadlineMs: 0 });
-        this.throwIfStartCancelled();
-        if (!free) {
-            throw new ProfileBusyError(PROFILE_BUSY_MESSAGE);
-        }
-        // T3: a PERSISTENT context. The profile dir carries the user's
-        // Google session (established by `mcp login` — see google-login.ts),
-        // so the OAuth-first signup path reuses it instead of starting
-        // logged-out. launchPersistentContext takes launch + context
-        // options in one call.
+        // Keep the operator browser headed: the browser runs on the operator's
+        // Xvfb display, preserving the normal Chrome surface OAuth providers see.
+        this.launchedMode = "headed";
+        // T3: a PERSISTENT context backed by this operator session's unique
+        // profile. launchPersistentContext takes launch + context options in one
+        // call.
         // Resolve the launcher first so activeStealthProfile is set before we
         // decide on executablePath below.
         const launcher = getChromium();
@@ -3066,7 +3385,7 @@ export class BrowserController {
         this.launchedChannel = channel;
         // Launch args shared by BOTH paths (launchPersistentContext and the
         // self-launch). See the per-flag rationale: swiftshader gives a real
-        // (software) WebGL context on the GPU-less Xvfb box; the others are the
+        // (software) WebGL context on GPU-less hosts; the others are the
         // standard headless/sandbox flags. The three background-throttling disables
         // are payment correctness controls: a backgrounded CardinalCommerce ACS
         // frame must keep running its timers long enough to finish the issuer's OOB
@@ -3101,24 +3420,23 @@ export class BrowserController {
         this.throwIfStartCancelled();
         if (useSelfLaunch && selfLaunchBinary !== null) {
             console.error(`[operator] self-launch + connectOverCDP (Turnstile-safe launch) binary=${selfLaunchBinary}`);
-            const window = this.launchedMode === "xvfb"
-                ? { width: 1920, height: 1080 }
-                : { width: 1280, height: 1024 };
+            const window = { width: 1280, height: 1024 };
             const selfEnv = {
-                ...(chromeEnv ?? process.env),
+                ...browserEnv,
                 TZ: geo?.timezoneId ?? "America/New_York",
+                [OPERATOR_BROWSER_MARKER_ENV]: this.operatorBrowserMarker(),
             };
-            context = await launchWithProfileGate(this.profileDir, () => {
+            const launch = () => {
                 this.throwIfStartCancelled();
                 return this.launchSelfManagedContext({
                     binary: selfLaunchBinary,
-                    headless: chromeHeadless,
                     args: launchArgs,
                     proxy,
                     env: selfEnv,
                     window,
                 });
-            }, { failFast: true });
+            };
+            context = await launch();
             try {
                 await context.grantPermissions(grantedPermissions);
                 if (geo?.geolocation !== undefined) {
@@ -3130,8 +3448,8 @@ export class BrowserController {
             }
         }
         else {
-            this.profilePoolReusable = false;
             this.persistentFallbackLaunchInFlight = true;
+            this.startPersistentFallbackOwnershipMonitor();
             const cleanupProfileHolder = async () => {
                 const proof = await this.waitForPersistentFallbackIdentity();
                 if (proof.state === "absent")
@@ -3139,36 +3457,48 @@ export class BrowserController {
                 if (proof.state === "unknown")
                     return "unknown";
                 const { identity } = proof;
-                signalProfileProcess(identity, this.profileDir, "SIGKILL");
-                return (await this.waitForOwnedProfileExit(identity)) ? "closed" : "unknown";
+                const treeProof = this.adoptOwnedChromeProcessTree(identity, false);
+                signalOwnedChromeProcessTree(identity, false, "SIGKILL", {
+                    ...(treeProof === null ? {} : { proof: treeProof }),
+                });
+                return (await this.waitForOwnedProfileExit(identity, treeProof)) ? "closed" : "unknown";
             };
             const cleanupCancelled = async (lateContext) => {
-                const proof = await this.waitForPersistentFallbackIdentity();
+                const proof = await this.waitForPersistentFallbackIdentity().catch(() => ({ state: "unknown" }));
                 if (proof.state !== "owned") {
                     await lateContext.close().catch(() => undefined);
                     return proof.state === "absent" ? "closed" : "unknown";
                 }
                 const { identity } = proof;
+                const treeProof = this.adoptOwnedChromeProcessTree(identity, false);
                 const closeState = await closeProfileWithProof({
                     profileDir: this.profileDir,
                     identity,
                     close: () => lateContext.close(),
                     forceClose: () => {
-                        signalProfileProcess(identity, this.profileDir, "SIGKILL");
+                        signalOwnedChromeProcessTree(identity, false, "SIGKILL", {
+                            ...(treeProof === null ? {} : { proof: treeProof }),
+                        });
                         reapProfileHolderIfOwned(this.profileDir, identity);
                     },
+                    ...(treeProof === null
+                        ? {}
+                        : { identityState: () => ownedChromeProcessTreeState(treeProof) }),
                 });
                 if (closeState === "closed")
                     return closeState;
-                return (await this.waitForOwnedProfileExit(identity)) ? "closed" : "unknown";
+                return (await this.waitForOwnedProfileExit(identity, treeProof)) ? "closed" : "unknown";
             };
             const outcome = await (async () => {
                 try {
                     return await launchCancellablePersistentContext({
-                        launch: (options) => launchWithProfileGate(this.profileDir, () => launcher.launchPersistentContext(this.profileDir, options), { failFast: true }),
+                        launch: (options) => launcher.launchPersistentContext(this.profileDir, options),
                         options: {
-                            headless: chromeHeadless,
-                            ...(chromeEnv !== undefined ? { env: chromeEnv } : {}),
+                            headless: OPERATOR_BROWSER_HEADLESS,
+                            env: {
+                                ...browserEnv,
+                                [OPERATOR_BROWSER_MARKER_ENV]: this.operatorBrowserMarker(),
+                            },
                             ...(channel !== null ? { channel } : {}),
                             ...persistentProxyOptions(proxy),
                             args: [...launchArgs],
@@ -3206,9 +3536,23 @@ export class BrowserController {
             }
             this.context = context;
             this.launchedContext = true;
-            const holderPid = currentProfileHolderPid(this.profileDir);
-            this.launchedProfileHolderIdentity =
-                holderPid === null ? null : profileProcessIdentity(holderPid, this.profileDir);
+            this.launchedProfileHolderIdentity = await this.requirePersistentFallbackOwnership(async () => {
+                markOwnerBrowserLaunchTerminal(this.operatorBrowserMarker());
+                await Promise.race([
+                    context.close().catch(() => undefined),
+                    new Promise((resolveWait) => {
+                        const timer = setTimeout(resolveWait, PERSISTENT_CONTEXT_CANCELLATION_SETTLE_MS);
+                        timer.unref();
+                    }),
+                ]);
+                const markerClosed = await terminateOwnerBrowserLaunch(this.operatorBrowserMarker(), this.profileDir);
+                if (markerClosed) {
+                    untrackOwnerBrowserLaunch(this.operatorBrowserMarker());
+                    this.ownerLaunchTracked = false;
+                }
+                this.context = null;
+                this.launchedContext = false;
+            });
             this.commitProfileLaunch();
             this.persistentFallbackLaunchInFlight = false;
         }
@@ -3220,9 +3564,12 @@ export class BrowserController {
             this.launchedProfileHolderIdentity =
                 this.childChromeIdentity ??
                     (holderPid === null ? null : profileProcessIdentity(holderPid, this.profileDir));
+            if (this.launchedProfileHolderIdentity !== null) {
+                this.adoptOwnedChromeProcessTree(this.launchedProfileHolderIdentity, this.childChromeIdentity !== null && this.childChromeProcessGroup);
+            }
         }
         if (this.startCancellationRequested) {
-            await this.closeWithProfileGuard();
+            await this.closeBrowser();
             throw new Error("BrowserController start cancelled");
         }
         // Speed: optionally abort heavy/irrelevant requests before any navigation.
@@ -3325,7 +3672,7 @@ export class BrowserController {
             get: () => 8,
             configurable: true,
           });
-          // Screen availHeight tell: a headless Xvfb screen reports
+          // Screen availHeight tell: a virtual screen reports
           // availHeight == height (no OS taskbar), whereas a real Windows
           // desktop reserves ~40px for the taskbar (availHeight = height-40,
           // availWidth = width). Reinstate that gap so the screen reads like
@@ -3356,7 +3703,11 @@ export class BrowserController {
         if (contextInitScripts.includes("webgl-spoof")) {
             await context.addInitScript({ content: installWebglSpoofScript });
         }
+        for (const page of context.pages())
+            this.trackMainDocument(page);
+        this.trackOpenedTabs(context);
         this.page = context.pages()[0] ?? (await context.newPage());
+        this.trackMainDocument(this.page);
         this.primaryPage = this.page;
         // In baseline mode addInitScript covers document-start page JS, but
         // Playwright's page.evaluate utility execution can run in a separate realm.
@@ -3483,7 +3834,7 @@ export class BrowserController {
     // timezone has to be known before it is. The throwaway inherits the
     // same channel + proxy so it reports the real egress. Best-effort —
     // any failure returns null and start() keeps a default timezone.
-    async probeEgressGeo(channel, proxy) {
+    async probeEgressGeo(channel, proxy, browserEnv) {
         if (proxy === null) {
             try {
                 const resp = await fetch("https://ipinfo.io/json", { signal: AbortSignal.timeout(10_000) });
@@ -3500,7 +3851,8 @@ export class BrowserController {
         let probe;
         try {
             probe = await getChromium().launch({
-                headless: process.env.UNIVERSAL_BOT_HEADLESS !== "false",
+                headless: OPERATOR_BROWSER_HEADLESS,
+                env: browserEnv,
                 ...(channel !== null ? { channel } : {}),
                 ...(proxy !== null ? { proxy } : {}),
                 args: ["--no-sandbox", "--disable-dev-shm-usage"],
@@ -3791,7 +4143,28 @@ export class BrowserController {
     async type(selector, text, sealed = false) {
         if (!this.page)
             throw new Error("Browser not started");
-        return await this.withModalInertNeutralized(selector, () => this.typeInner(selector, text, sealed));
+        await this.withModalInertNeutralized(selector, () => this.typeInner(selector, text, sealed));
+    }
+    /**
+     * Commit Shopify's required shipping street field after type/autocomplete.
+     * Shopify Places only begins geocoding on this field's change/blur boundary;
+     * dispatching change and moving focus away mirrors the user's Tab action.
+     * This is intentionally not a generic post-type event mechanism.
+     */
+    async commitRequiredShippingAddressLine1(selector) {
+        if (!this.page)
+            throw new Error("Browser not started");
+        await this.page
+            .locator(selector)
+            .first()
+            .evaluate((field) => {
+            field.dispatchEvent(new Event("change", { bubbles: true }));
+            if (field instanceof HTMLElement)
+                field.blur();
+        });
+        // Allow Shopify's bounded Places/geocoding request to begin before the
+        // caller observes the delivery-method section.
+        await this.sleep(500);
     }
     async typeInner(selector, text, sealed = false) {
         if (!this.page)
@@ -3799,16 +4172,16 @@ export class BrowserController {
         // Wait for element to be visible and enabled before typing.
         await this.page.waitForSelector(selector, { state: "visible", timeout: 10000 });
         const locator = this.page.locator(selector);
-        const sealedFieldKeys = sealed
-            ? await this.operatorScreenshotIdentityKeys(locator, this.page.mainFrame())
-            : [];
+        // The marker is payment machinery — the card-clearing and saved-card
+        // resolution passes find the fields they filled through it. It is not a
+        // read seal: nothing masks or refuses a read because of it.
         if (sealed) {
             await locator.evaluate((el) => el.setAttribute("data-ts-sealed-payment", "1"));
         }
         if (!this.humanize) {
             // Fast path for tests / non-humanized runs.
             await this.page.fill(selector, text);
-            return sealedFieldKeys;
+            return;
         }
         // Humanized typing:
         //   - Click into the field first (moves mouse, generates focus event)
@@ -3839,7 +4212,6 @@ export class BrowserController {
         // hook, and over-engineering it added zero observable behavior-
         // score improvement.
         await locator.pressSequentially(text, { delay: rand(40, 110) });
-        return sealedFieldKeys;
     }
     // Best-effort scan for the SPECIFIC unfilled required field(s) blocking a
     // disabled submit. Returns a " Unfilled required field(s) — …" suffix for the
@@ -4827,20 +5199,16 @@ export class BrowserController {
         const ownerFrame = await handle.ownerFrame();
         if (ownerFrame === null)
             throw new Error("locator target has no owning frame");
-        const sealedFieldKeys = sealed
-            ? await this.operatorScreenshotIdentityKeys(handle, ownerFrame)
-            : [];
         if (sealed) {
             await handle.evaluate((el) => el.setAttribute("data-ts-sealed-payment", "1"));
         }
         if (!this.humanize) {
             await handle.fill(text);
-            return sealedFieldKeys;
+            return;
         }
         await handle.click({ timeout: 8000 }).catch(() => undefined);
         await handle.fill("").catch(() => undefined);
         await handle.type(text, { delay: rand(40, 110) });
-        return sealedFieldKeys;
     }
     // Dispatch a DOM .click() in the page context. Some React copy buttons fire
     // their onClick (and thus navigator.clipboard.writeText) on the synthetic
@@ -6439,7 +6807,7 @@ export class BrowserController {
         // device memory, screen, languages, webdriver flag. Turnstile
         // error 600010 ("internal client execution error") usually points
         // at one of these returning something the challenge JS can't
-        // handle (e.g. SwiftShader/llvmpipe renderer under Xvfb).
+        // handle (e.g. a SwiftShader/llvmpipe renderer).
         if (process.env.UNIVERSAL_BOT_CAPTCHA_TRACE === "1") {
             try {
                 const fp = await this.page.evaluate(() => {
@@ -7320,10 +7688,6 @@ export class BrowserController {
                     hasHcaptchaGlobal: win.hcaptcha !== undefined,
                 };
             }, { tok: token, key: responseKey });
-            if (process.env.UNIVERSAL_BOT_OAUTH_DEBUG) {
-                console.error(`[captcha] hCaptcha inject diag: ok=${diag.ok} textareas=${diag.textareas} ` +
-                    `widgets=${diag.widgets} callbackFired=${diag.callbackFired} hcaptchaGlobal=${diag.hasHcaptchaGlobal}`);
-            }
             return diag.ok;
         }
         catch {
@@ -7542,582 +7906,78 @@ export class BrowserController {
         }
         return null;
     }
-    async operatorScreenshotCaptureScope(targetFrame) {
-        if (!this.page)
-            throw new Error("Browser not started");
-        if (targetFrame === null || targetFrame === this.page.mainFrame()) {
-            const frames = this.page.frames();
-            return { frames, strictFrames: new Set(frames), clip: null };
-        }
-        const strictFrames = new Set();
-        const visit = (frame) => {
-            strictFrames.add(frame);
-            for (const child of frame.childFrames())
-                visit(child);
-        };
-        visit(targetFrame);
-        const targetHandle = await targetFrame.frameElement();
-        const clip = await targetHandle.boundingBox();
-        await targetHandle.dispose().catch(() => undefined);
-        if (clip === null)
-            throw new Error("screenshot_redaction_unresolved");
-        const intersects = (box) => box.x < clip.x + clip.width &&
-            box.x + box.width > clip.x &&
-            box.y < clip.y + clip.height &&
-            box.y + box.height > clip.y;
-        const frames = [];
-        for (const frame of this.page.frames()) {
-            if (frame === this.page.mainFrame() || strictFrames.has(frame)) {
-                frames.push(frame);
-                continue;
-            }
-            const handle = await frame.frameElement();
-            try {
-                const box = await handle.boundingBox();
-                if (box !== null && intersects(box))
-                    frames.push(frame);
-            }
-            finally {
-                await handle.dispose().catch(() => undefined);
-            }
-        }
-        return { frames, strictFrames, clip };
-    }
-    async sealedDocumentIdentity(frame) {
-        const current = this.sealedDocuments.get(frame);
-        if (current !== undefined &&
-            !frame.isDetached() &&
-            (await frame.evaluate((expected) => document === expected, current.handle).catch(() => false))) {
-            return current.identity;
-        }
-        await current?.handle.dispose().catch(() => undefined);
-        const handle = await frame.evaluateHandle(() => document);
-        const identity = `document-${this.sealedDocumentSequence++}`;
-        this.sealedDocuments.set(frame, { handle, identity });
-        return identity;
-    }
-    async operatorScreenshotIdentityKeys(target, frame) {
-        const descriptor = await target.evaluate((el) => {
-            const clean = (value) => {
-                const normalized = (value ?? "").replace(/\s+/g, " ").trim();
-                return normalized.length > 0 ? normalized : null;
-            };
-            const labelFor = (element) => {
-                const id = element.getAttribute("id");
-                if (id !== null && id.length > 0) {
-                    const label = document.querySelector(`label[for="${CSS.escape(id)}"]`);
-                    if (label !== null)
-                        return clean(label.textContent);
-                }
-                const labelledBy = element.getAttribute("aria-labelledby");
-                if (labelledBy !== null) {
-                    const text = labelledBy
-                        .split(/\s+/)
-                        .map((part) => clean(document.getElementById(part)?.textContent))
-                        .filter((part) => part !== null)
-                        .join(" ");
-                    if (text.length > 0)
-                        return text;
-                }
-                return clean(element.closest("label")?.textContent);
-            };
-            const controls = Array.from(el.getRootNode().querySelectorAll("input,textarea,select,[contenteditable='true']"));
-            return {
-                tag: el.tagName.toLowerCase(),
-                type: el.getAttribute("type"),
-                id: el.getAttribute("id"),
-                name: el.getAttribute("name"),
-                testId: el.getAttribute("data-testid") ??
-                    el.getAttribute("data-test-id") ??
-                    el.getAttribute("data-test") ??
-                    el.getAttribute("data-cy") ??
-                    el.getAttribute("data-qa"),
-                labelText: labelFor(el),
-                ariaLabel: el.getAttribute("aria-label"),
-                placeholder: el.getAttribute("placeholder"),
-                landmark: el.closest("header,main,footer,nav,aside,article,section")?.tagName.toLowerCase() ?? null,
-                ordinal: controls.indexOf(el),
-            };
-        });
-        const documentIdentity = await this.sealedDocumentIdentity(frame);
-        return sealedElementSemanticKeys(descriptor).map((key) => `${documentIdentity}:${key}`);
-    }
-    async resolveOperatorScreenshotSealedLocators(frames, sealedFieldKeys) {
-        const byFrame = new Map();
-        for (const frame of frames) {
-            const matches = [];
-            const candidates = await frame
-                .locator("input,textarea,select,[contenteditable='true']")
-                .all();
-            for (const candidate of candidates) {
-                const keys = await this.operatorScreenshotIdentityKeys(candidate, frame);
-                if (keys.some((key) => sealedFieldKeys.has(key)))
-                    matches.push(candidate);
-            }
-            byFrame.set(frame, matches);
-        }
-        return byFrame;
-    }
-    // Resolve every card-shaped/sealed field in the captured frames to a
-    // screenshot redaction rectangles — text-masking (presentFieldValue in
-    // provision-session.ts) only covers the JSON observation, not a rendered
-    // image. Beyond the attribute-based
-    // selector set, every renderable input/textarea whose CURRENT value contains
-    // a Luhn-valid PAN span is masked too (containsLuhnPanSpan — the same
-    // detection the payment paths use), so a card number sitting in a field the
-    // fixed selectors don't recognize still never reaches the image. Fail-closed
-    // throughout: a selector that cannot be queried, a value that cannot be
-    // read, or a matched element whose geometry cannot be resolved (boundingBox
-    // returns null rather than throwing) aborts the whole capture rather than
-    // shrinking the redaction. The per-frame count signature lets the caller
-    // verify the redaction set stayed stable across the capture window.
-    async collectOperatorScreenshotMask(frames, extraRedactionSelectors, sealedLocators = new Map(), captureClip = null, strictFrames = new Set(frames)) {
-        const selector = [SCREENSHOT_REDACTION_SELECTORS, ...extraRedactionSelectors].join(",");
-        const rectangles = [];
-        const handles = [];
-        const signatureParts = [];
-        try {
-            for (const [frameIndex, frame] of frames.entries()) {
-                let frameCount = 0;
-                const frameHandles = await frame.locator(selector).elementHandles();
-                for (const locator of sealedLocators.get(frame) ?? []) {
-                    const handle = await locator.elementHandle({ timeout: 5_000 });
-                    if (handle === null)
-                        throw new Error("screenshot_redaction_unresolved");
-                    if (!(await handle.evaluate((el, matchSelector) => el.matches(matchSelector), selector))) {
-                        frameHandles.push(handle);
-                    }
-                    else {
-                        await handle.dispose();
-                    }
-                }
-                const valueCandidates = await frame
-                    .locator('input:not([type="hidden" i]),textarea')
-                    .elementHandles();
-                for (const candidate of valueCandidates) {
-                    const value = await candidate.inputValue({ timeout: 5_000 });
-                    if (!containsLuhnPanSpan(value)) {
-                        await candidate.dispose();
-                        continue;
-                    }
-                    const duplicate = await Promise.all(frameHandles.map(async (existing) => await candidate.evaluate((el, other) => el === other, existing)));
-                    if (duplicate.includes(true)) {
-                        await candidate.dispose();
-                        continue;
-                    }
-                    frameHandles.push(candidate);
-                }
-                for (const handle of frameHandles) {
-                    if (!(await handle.evaluate((el) => el.isConnected))) {
-                        throw new Error("screenshot_redaction_unresolved");
-                    }
-                    const box = await handle.boundingBox();
-                    if (captureClip !== null &&
-                        !strictFrames.has(frame) &&
-                        (box === null ||
-                            box.x >= captureClip.x + captureClip.width ||
-                            box.x + box.width <= captureClip.x ||
-                            box.y >= captureClip.y + captureClip.height ||
-                            box.y + box.height <= captureClip.y)) {
-                        await handle.dispose();
-                        continue;
-                    }
-                    handles.push(handle);
-                    if (box !== null)
-                        rectangles.push(box);
-                    signatureParts.push(`${frameIndex}:${box === null ? "hidden" : [box.x, box.y, box.width, box.height].join(":")}`);
-                    frameCount += 1;
-                }
-                signatureParts.push(`count:${frameIndex}:${frameCount}`);
-            }
-        }
-        catch {
-            await Promise.all(handles.map(async (handle) => await handle.dispose().catch(() => undefined)));
-            throw new Error("screenshot_redaction_unresolved");
-        }
-        return {
-            rectangles,
-            redactedCount: handles.length,
-            signature: signatureParts.join("|"),
-            handles,
-        };
-    }
-    async redactOperatorScreenshot(buffer, rectangles, origin, captureSize) {
-        const metadata = await sharp(buffer).metadata();
-        if (metadata.width === undefined || metadata.height === undefined) {
-            throw new Error("screenshot_redaction_unresolved");
-        }
-        const scaleX = metadata.width / captureSize.width;
-        const scaleY = metadata.height / captureSize.height;
-        const rects = rectangles
-            .map((box) => `<rect x="${(box.x - origin.x) * scaleX}" y="${(box.y - origin.y) * scaleY}" width="${box.width * scaleX}" height="${box.height * scaleY}" fill="#ff00ff"/>`)
-            .join("");
-        const overlay = Buffer.from(`<svg width="${metadata.width}" height="${metadata.height}" xmlns="http://www.w3.org/2000/svg">${rects}</svg>`);
-        return (await sharp(buffer)
-            .composite([{ input: overlay, blend: "over" }])
-            .jpeg({ quality: 80 })
-            .toBuffer()).toString("base64");
-    }
-    // Verify the capture set before pixels are read. This is deliberately
-    // narrower than the capture-time mask: empty checkout controls are harmless,
-    // but a nonempty type_secret target, password, payment-sealed node, or
-    // Luhn-valid PAN means the requested image could contain a secret. Every
-    // frame included by the image must be readable; a detached or navigating
-    // frame is not evidence that it is safe to capture.
-    async assertOperatorScreenshotFramesNoSealedValues(frames, extraRedactionSelectors, sealedLocators = new Map(), captureClip = null, strictFrames = new Set(frames)) {
-        const sealedSelector = [SCREENSHOT_REDACTION_SELECTORS, ...extraRedactionSelectors].join(",");
-        try {
-            for (const frame of frames) {
-                if (frame.isDetached())
-                    throw new Error("frame detached");
-                const sealedMatches = [
-                    ...(await frame.locator(sealedSelector).all()),
-                    ...(sealedLocators.get(frame) ?? []),
-                ];
-                for (const match of sealedMatches) {
-                    const box = strictFrames.has(frame) ? null : await match.boundingBox();
-                    if (captureClip !== null &&
-                        !strictFrames.has(frame) &&
-                        (box === null ||
-                            box.x >= captureClip.x + captureClip.width ||
-                            box.x + box.width <= captureClip.x ||
-                            box.y >= captureClip.y + captureClip.height ||
-                            box.y + box.height <= captureClip.y)) {
-                        continue;
-                    }
-                    const hasValue = await match.evaluate((el) => {
-                        if (el instanceof HTMLSelectElement) {
-                            const optionText = el.options[el.selectedIndex]?.textContent ?? "";
-                            const normalizedOption = optionText.replace(/\s+/g, " ").trim();
-                            const placeholder = /^(?:select|choose)?\s*(?:a\s+)?(?:month|year|mm|yy)?\s*(?:\.\.\.|[-–—]*)$/i;
-                            return (el.value.trim().length > 0 ||
-                                (normalizedOption.length > 0 && !placeholder.test(normalizedOption)));
-                        }
-                        if (el instanceof HTMLInputElement || el instanceof HTMLTextAreaElement) {
-                            return el.value.trim().length > 0;
-                        }
-                        return (el.textContent ?? "").trim().length > 0;
-                    });
-                    if (hasValue)
-                        throw new Error("sealed value");
-                }
-                const candidates = await frame.locator('input:not([type="hidden" i]),textarea').all();
-                for (const candidate of candidates) {
-                    const box = strictFrames.has(frame) ? null : await candidate.boundingBox();
-                    if (captureClip !== null &&
-                        !strictFrames.has(frame) &&
-                        (box === null ||
-                            box.x >= captureClip.x + captureClip.width ||
-                            box.x + box.width <= captureClip.x ||
-                            box.y >= captureClip.y + captureClip.height ||
-                            box.y + box.height <= captureClip.y)) {
-                        continue;
-                    }
-                    const hasPan = await candidate.evaluate((el) => {
-                        const text = el instanceof HTMLInputElement || el instanceof HTMLTextAreaElement ? el.value : "";
-                        const digits = Array.from(text.matchAll(/\d/g), (match) => match.index);
-                        const luhn = (value) => {
-                            let sum = 0;
-                            let double = false;
-                            for (let index = value.length - 1; index >= 0; index -= 1) {
-                                let digit = Number(value[index]);
-                                if (double) {
-                                    digit *= 2;
-                                    if (digit > 9)
-                                        digit -= 9;
-                                }
-                                sum += digit;
-                                double = !double;
-                            }
-                            return sum % 10 === 0;
-                        };
-                        for (let start = 0; start + 13 <= digits.length; start += 1) {
-                            const maxLength = Math.min(19, digits.length - start);
-                            for (let length = 13; length <= maxLength; length += 1) {
-                                const positions = digits.slice(start, start + length);
-                                if (positions[positions.length - 1] - positions[0] + 1 >
-                                    PAYMENT_PAN_MAX_SPAN_CHARS) {
-                                    break;
-                                }
-                                if (luhn(positions.map((position) => text[position]).join("")))
-                                    return true;
-                            }
-                        }
-                        return false;
-                    });
-                    if (hasPan)
-                        throw new Error("card value");
-                }
-                if (strictFrames.has(frame) || captureClip === null || frame !== this.page?.mainFrame()) {
-                    const renderedText = await frame.evaluate(() => document.body?.innerText ?? document.documentElement?.innerText ?? "");
-                    if (containsLuhnPanSpan(renderedText))
-                        throw new Error("rendered card value");
-                }
-                else {
-                    const renderedTextInClip = await frame.evaluate((clip) => {
-                        const walker = document.createTreeWalker(document.body, NodeFilter.SHOW_TEXT);
-                        const texts = [];
-                        let node = walker.nextNode();
-                        while (node !== null) {
-                            const text = node.textContent ?? "";
-                            if (/\d/.test(text)) {
-                                const range = document.createRange();
-                                range.selectNodeContents(node);
-                                const overlaps = Array.from(range.getClientRects()).some((rect) => rect.left < clip.x + clip.width &&
-                                    rect.right > clip.x &&
-                                    rect.top < clip.y + clip.height &&
-                                    rect.bottom > clip.y);
-                                if (overlaps)
-                                    texts.push(text);
-                            }
-                            node = walker.nextNode();
-                        }
-                        return texts.join(" ");
-                    }, captureClip);
-                    if (containsLuhnPanSpan(renderedTextInClip))
-                        throw new Error("rendered card value");
-                }
-            }
-        }
-        catch {
-            throw new Error("screenshot_unavailable_sealed_context");
-        }
-    }
-    async captureOperatorScreenshot(opts = {}, sealedFieldKeys = []) {
-        if (!this.page)
-            throw new Error("Browser not started");
-        const targetFrame = this.resolveOperatorScreenshotFrame(opts);
-        const scope = await this.operatorScreenshotCaptureScope(targetFrame);
-        const { frames } = scope;
-        const documents = [];
-        try {
-            for (const frame of frames) {
-                if (frame.isDetached())
-                    throw new Error("frame detached");
-                documents.push(await frame.evaluateHandle(() => document));
-            }
-            const sealedLocators = await this.resolveOperatorScreenshotSealedLocators(frames, new Set(sealedFieldKeys));
-            await this.assertOperatorScreenshotFramesNoSealedValues(frames, [], sealedLocators, scope.clip, scope.strictFrames);
-            const documentsStillCurrent = async () => {
-                if (documents.length !== frames.length)
-                    return false;
-                for (let index = 0; index < frames.length; index += 1) {
-                    const frame = frames[index];
-                    if (frame.isDetached())
-                        return false;
-                    if (!(await frame.evaluate((expected) => document === expected, documents[index]))) {
-                        return false;
-                    }
-                }
-                return true;
-            };
-            if (!(await documentsStillCurrent())) {
-                throw new Error("screenshot_unavailable_sealed_context");
-            }
-            let captured;
-            let attemptScope = scope;
-            for (let attempt = 0; attempt < 2; attempt += 1) {
-                if (attempt > 0) {
-                    attemptScope = await this.operatorScreenshotCaptureScope(targetFrame);
-                    if (attemptScope.frames.length !== frames.length ||
-                        !frames.every((frame, index) => attemptScope.frames[index] === frame)) {
-                        throw new Error("screenshot_unavailable_sealed_context");
-                    }
-                }
-                try {
-                    captured = await this.screenshotForOperatorResolved(opts, targetFrame, frames, sealedLocators, attemptScope, async () => {
-                        if (!(await documentsStillCurrent())) {
-                            throw new Error("screenshot_unavailable_sealed_context");
-                        }
-                        await this.assertOperatorScreenshotFramesNoSealedValues(frames, [], sealedLocators, attemptScope.clip, attemptScope.strictFrames);
-                        if (!(await documentsStillCurrent())) {
-                            throw new Error("screenshot_unavailable_sealed_context");
-                        }
-                    });
-                    break;
-                }
-                catch (error) {
-                    if (attempt === 0 &&
-                        error instanceof Error &&
-                        error.message === "screenshot_redaction_unstable") {
-                        continue;
-                    }
-                    throw error;
-                }
-            }
-            if (captured === undefined)
-                throw new Error("screenshot_unavailable_sealed_context");
-            if (!(await documentsStillCurrent())) {
-                throw new Error("screenshot_unavailable_sealed_context");
-            }
-            await this.assertOperatorScreenshotFramesNoSealedValues(frames, [], sealedLocators, attemptScope.clip, attemptScope.strictFrames);
-            return captured;
-        }
-        catch (error) {
-            if (error instanceof Error && error.message === "screenshot_frame_not_found")
-                throw error;
-            if (error instanceof Error && error.message === "screenshot_unavailable_sealed_context") {
-                throw error;
-            }
-            throw new Error("screenshot_unavailable_sealed_context");
-        }
-        finally {
-            await Promise.all(documents.map(async (document) => await document.dispose().catch(() => undefined)));
-        }
+    // Read-only pixel capture for operate_screenshot. It never navigates, clicks,
+    // types, focuses, or mutates the DOM — and it never masks anything. What the
+    // page renders is what the driving agent gets back.
+    async captureOperatorScreenshot(opts = {}) {
+        return await this.screenshotForOperator(opts);
     }
-    // Low-level read-only capture used by captureOperatorScreenshot after its
-    // capture-scoped sealed-value checks, and directly by redaction tests. It
-    // never navigates, clicks, types, focuses, or mutates the DOM. Redaction
-    // covers every frame included in the image: the whole page composites its
-    // visible frames, while an isolated frame includes only that frame.
-    // `extraRedactionSelectors` is retained for callers that already resolved
-    // additional sensitive elements; production capture passes durable locators.
     async screenshotForOperator(opts = {}) {
-        if (!this.page)
-            throw new Error("Browser not started");
-        const targetFrame = this.resolveOperatorScreenshotFrame(opts);
-        const scope = await this.operatorScreenshotCaptureScope(targetFrame);
-        return await this.screenshotForOperatorResolved(opts, targetFrame, scope.frames, new Map(), scope);
-    }
-    async screenshotForOperatorResolved(opts, targetFrame, framesBefore, sealedLocators = new Map(), scope = { frames: [...framesBefore], strictFrames: new Set(framesBefore), clip: null }, beforeCapture) {
         if (!this.page)
             throw new Error("Browser not started");
         const page = this.page;
-        const extraRedactionSelectors = opts.extraRedactionSelectors ?? [];
-        const before = await this.collectOperatorScreenshotMask(framesBefore, extraRedactionSelectors, sealedLocators, scope.clip, scope.strictFrames);
-        const { rectangles, redactedCount, signature } = before;
-        let recheck;
+        const targetFrame = this.resolveOperatorScreenshotFrame(opts);
+        const cdp = await page.context().newCDPSession(page);
         try {
-            // caret:"initial" skips Playwright's default caret-hiding pass, which
-            // writes (and restores) caret-color on every editable element's inline
-            // style — this capture must leave element styles untouched.
-            let buffer;
-            let origin = { x: 0, y: 0 };
-            let captureSize;
-            const cdp = await page.context().newCDPSession(page);
-            try {
-                if (targetFrame !== null && targetFrame !== page.mainFrame()) {
-                    const handle = await targetFrame.frameElement();
-                    try {
-                        const box = await handle.boundingBox();
-                        if (box === null)
-                            throw new Error("screenshot_redaction_unresolved");
-                        if (scope.clip === null ||
-                            box.x !== scope.clip.x ||
-                            box.y !== scope.clip.y ||
-                            box.width !== scope.clip.width ||
-                            box.height !== scope.clip.height) {
-                            throw new Error("screenshot_redaction_unresolved");
-                        }
-                        const scroll = await page.evaluate(() => ({ x: window.scrollX, y: window.scrollY }));
-                        origin = { x: box.x, y: box.y };
-                        captureSize = { width: box.width, height: box.height };
-                        await beforeCapture?.();
-                        const result = await cdp.send("Page.captureScreenshot", {
-                            format: "jpeg",
-                            quality: 80,
-                            fromSurface: true,
-                            captureBeyondViewport: true,
-                            clip: {
-                                x: box.x + scroll.x,
-                                y: box.y + scroll.y,
-                                width: box.width,
-                                height: box.height,
-                                scale: 1,
-                            },
-                        });
-                        buffer = Buffer.from(result.data, "base64");
-                    }
-                    finally {
-                        await handle.dispose().catch(() => undefined);
-                    }
-                }
-                else if (opts.fullPage === true) {
-                    const dimensions = await page.evaluate(() => ({
-                        origin: { x: -window.scrollX, y: -window.scrollY },
-                        size: {
-                            width: document.documentElement.scrollWidth,
-                            height: document.documentElement.scrollHeight,
-                        },
-                    }));
-                    origin = dimensions.origin;
-                    captureSize = dimensions.size;
-                    await beforeCapture?.();
+            // caret:"initial" is not needed here — the CDP capture never runs
+            // Playwright's caret-hiding pass, so element styles stay untouched.
+            let base64;
+            if (targetFrame !== null && targetFrame !== page.mainFrame()) {
+                const handle = await targetFrame.frameElement();
+                try {
+                    const box = await handle.boundingBox();
+                    if (box === null)
+                        throw new Error("screenshot_frame_not_visible");
+                    const scroll = await page.evaluate(() => ({ x: window.scrollX, y: window.scrollY }));
                     const result = await cdp.send("Page.captureScreenshot", {
                         format: "jpeg",
                         quality: 80,
                         fromSurface: true,
                         captureBeyondViewport: true,
                         clip: {
-                            x: 0,
-                            y: 0,
-                            width: dimensions.size.width,
-                            height: dimensions.size.height,
+                            x: box.x + scroll.x,
+                            y: box.y + scroll.y,
+                            width: box.width,
+                            height: box.height,
                             scale: 1,
                         },
                     });
-                    buffer = Buffer.from(result.data, "base64");
+                    base64 = result.data;
                 }
-                else {
-                    const viewport = page.viewportSize();
-                    if (viewport === null)
-                        throw new Error("screenshot_redaction_unresolved");
-                    captureSize = viewport;
-                    await beforeCapture?.();
-                    const result = await cdp.send("Page.captureScreenshot", {
-                        format: "jpeg",
-                        quality: 80,
-                        fromSurface: true,
-                    });
-                    buffer = Buffer.from(result.data, "base64");
+                finally {
+                    await handle.dispose().catch(() => undefined);
                 }
             }
-            finally {
-                await cdp.detach().catch(() => undefined);
-            }
-            // Stability guard: the mask set was fixed before a capture that can take
-            // seconds. If the page grew another matching field or frame meanwhile,
-            // the image may hold pixels no mask covered — re-run the same collection
-            // and discard the image unless the frame set and per-frame redaction
-            // signature are unchanged.
-            const scopeAfter = await this.operatorScreenshotCaptureScope(targetFrame);
-            const framesAfter = scopeAfter.frames;
-            let stable = JSON.stringify(scopeAfter.clip) === JSON.stringify(scope.clip) &&
-                framesAfter.length === framesBefore.length &&
-                framesBefore.every((frame, index) => framesAfter[index] === frame);
-            if (stable) {
-                try {
-                    recheck = await this.collectOperatorScreenshotMask(framesAfter, extraRedactionSelectors, sealedLocators, scope.clip, scope.strictFrames);
-                    stable =
-                        recheck.signature === signature && recheck.handles.length === before.handles.length;
-                    if (stable) {
-                        for (let index = 0; index < before.handles.length; index += 1) {
-                            if (!(await recheck.handles[index].evaluate((el, expected) => el === expected, before.handles[index]))) {
-                                stable = false;
-                                break;
-                            }
-                        }
-                    }
-                }
-                catch {
-                    stable = false;
-                }
+            else if (opts.fullPage === true) {
+                const size = await page.evaluate(() => ({
+                    width: document.documentElement.scrollWidth,
+                    height: document.documentElement.scrollHeight,
+                }));
+                const result = await cdp.send("Page.captureScreenshot", {
+                    format: "jpeg",
+                    quality: 80,
+                    fromSurface: true,
+                    captureBeyondViewport: true,
+                    clip: { x: 0, y: 0, width: size.width, height: size.height, scale: 1 },
+                });
+                base64 = result.data;
+            }
+            else {
+                const result = await cdp.send("Page.captureScreenshot", {
+                    format: "jpeg",
+                    quality: 80,
+                    fromSurface: true,
+                });
+                base64 = result.data;
             }
-            if (!stable)
-                throw new Error("screenshot_redaction_unstable");
-            const base64 = await this.redactOperatorScreenshot(buffer, rectangles, origin, captureSize);
             return {
                 base64,
                 frameUrl: targetFrame?.url() ?? null,
                 frameCount: page.frames().length,
-                redactedCount,
             };
         }
         finally {
-            await Promise.all([
-                ...before.handles.map(async (handle) => await handle.dispose().catch(() => undefined)),
-                ...(recheck?.handles ?? []).map(async (handle) => await handle.dispose().catch(() => undefined)),
-            ]);
+            await cdp.detach().catch(() => undefined);
         }
     }
     async getState() {
@@ -8167,6 +8027,32 @@ export class BrowserController {
             throw new Error("Browser not started");
         return await this.page.evaluate(extractObservationVisibleText);
     }
+    /**
+     * Tiny structural source for compact V2. The raw values never leave the
+     * provision session: compact-observation-v2 applies its allowlist seal
+     * before the result is stored, delta'd, or emitted.
+     */
+    async extractObservationSemantics() {
+        if (!this.page)
+            throw new Error("Browser not started");
+        return await this.page.evaluate(() => {
+            const visible = (element) => {
+                const html = element;
+                const style = window.getComputedStyle(html);
+                const rect = html.getBoundingClientRect();
+                return (style.display !== "none" &&
+                    style.visibility !== "hidden" &&
+                    rect.width > 0 &&
+                    rect.height > 0);
+            };
+            const headings = Array.from(document.querySelectorAll("h1,h2"))
+                .filter(visible)
+                .map((element) => (element.textContent ?? "").replace(/\s+/g, " ").trim().slice(0, 160))
+                .filter(Boolean)
+                .slice(0, 2);
+            return { title: document.title.slice(0, 160), headings };
+        });
+    }
     async readCheckoutSummary(fallbackCurrency) {
         if (!this.page)
             throw new Error("Browser not started");
@@ -8461,6 +8347,28 @@ export class BrowserController {
         });
         return includeDetails ? items : items.map(({ title, quantity }) => ({ title, quantity }));
     }
+    // Deterministic cart-normalize primitive: Shopify's standard Ajax Cart API
+    // exposes POST /cart/clear.js on every storefront's own origin — no DOM
+    // markup dependency, so it works regardless of theme. This is how an
+    // operator reaches a KNOWN (empty) cart quantity before a fresh cart_add,
+    // rather than accumulating quantity across separate operate_start sessions
+    // on the shared persistent profile.
+    async clearCart() {
+        if (!this.page)
+            throw new Error("Browser not started");
+        return await this.page.evaluate(async () => {
+            try {
+                const response = await fetch("/cart/clear.js", {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json" },
+                });
+                return response.ok;
+            }
+            catch {
+                return false;
+            }
+        });
+    }
     async readSettledCheckoutReviewSummary(fallbackCurrency, timeoutMs = 12_000) {
         if (!this.page)
             throw new Error("Browser not started");
@@ -8521,10 +8429,10 @@ export class BrowserController {
         }
     }
     // The first frame that actually renders a visible card (PAN) input, or null.
-    async panFieldFrame() {
+    async panFieldFrame(frames) {
         if (!this.page)
             return null;
-        for (const frame of this.page.frames()) {
+        for (const frame of frames ?? this.page.frames()) {
             const locator = frame.locator(CHECKOUT_PAN_FIELD_SELECTORS);
             const count = await locator.count().catch(() => 0);
             for (let i = 0; i < count; i += 1) {
@@ -8537,7 +8445,7 @@ export class BrowserController {
         }
         return null;
     }
-    // Bounded wait for a PAN field to appear anywhere on the page. A
+    // Bounded wait for a PAN field to appear in caller-eligible frames. A
     // single-page checkout's card entry can live in a cross-origin PCI iframe
     // (e.g. Shopify's checkout.pci.shopifyinc.com) that mounts only after the
     // payment section itself renders — later than the total becomes readable,
@@ -8545,7 +8453,7 @@ export class BrowserController {
     // fillAndSubmitCheckout/fillCheckoutCardFields used to take one frames()
     // snapshot at call time; a frame that hadn't mounted YET at that exact
     // instant made a genuinely fillable checkout fail closed.
-    async waitForPanField(timeoutMs) {
+    async waitForPanField(timeoutMs, frameAllowed = () => true) {
         if (!this.page)
             return;
         const deadline = Date.now() + timeoutMs;
@@ -8555,14 +8463,108 @@ export class BrowserController {
             // CHECKOUT_PAN_FIELD_SELECTORS once stamped — without this,
             // panFieldFrame() below can never match and every call here burns its
             // full timeoutMs even though the field was on the page from the start.
-            await this.stampJapaneseCardLabelFields(this.page.frames());
-            if ((await this.panFieldFrame()) !== null)
+            const frames = this.page.frames().filter(frameAllowed);
+            await this.stampJapaneseCardLabelFields(frames);
+            if ((await this.panFieldFrame(frames)) !== null)
                 return;
             if (Date.now() >= deadline)
                 return;
             await this.page.waitForTimeout(200).catch(() => undefined);
         }
     }
+    // Split checkout waits are event-driven: a trusted hosted-field frame can
+    // attach as about:blank and only later navigate to its processor URL. Watch
+    // both lifecycle events and then wait inside that exact frame for the PAN.
+    // A settled page with a PAN only in excluded frames returns immediately so
+    // the caller can produce its existing fail-closed frame-origin refusal.
+    async waitForRecognizedPanField(pageUrl, deadline) {
+        if (!this.page)
+            return;
+        const page = this.page;
+        const frameAllowed = (frame) => frame === page.mainFrame() || recognizedPaymentProviderFrame(frame.url(), pageUrl);
+        const remaining = () => deadline === undefined ? 0 : Math.max(0, deadline - Date.now());
+        let done = false;
+        let resolveDone;
+        const complete = () => {
+            if (done)
+                return;
+            done = true;
+            resolveDone();
+        };
+        const completed = new Promise((resolve) => {
+            resolveDone = resolve;
+        });
+        const observeTrustedFrame = (frame) => {
+            if (done || !frameAllowed(frame))
+                return;
+            void (async () => {
+                // JP checkouts can expose their PAN only through an associated label,
+                // so normalize the trusted frame before starting its selector wait.
+                // This preserves the existing conservative label-to-control contract
+                // while never evaluating or mutating an excluded payment frame.
+                await this.stampJapaneseCardLabelFields([frame]);
+                if ((await this.panFieldFrame([frame])) !== null) {
+                    complete();
+                    return;
+                }
+                await frame
+                    .waitForSelector(CHECKOUT_PAN_FIELD_SELECTORS, {
+                    state: "visible",
+                    timeout: remaining(),
+                })
+                    .then(() => complete())
+                    .catch(() => undefined);
+            })();
+        };
+        const settleOrRefuse = () => {
+            void page
+                .waitForLoadState("networkidle", { timeout: remaining() })
+                .then(async () => {
+                if (done)
+                    return;
+                const frames = page.frames();
+                const trustedFrames = frames.filter(frameAllowed);
+                await this.stampJapaneseCardLabelFields(trustedFrames);
+                if ((await this.panFieldFrame(trustedFrames)) !== null) {
+                    complete();
+                    return;
+                }
+                // Do not reject while a recognized provider frame is still live:
+                // its PAN may appear after the provider's own hydration work. The
+                // deadline governs that wait; there is no local timing heuristic.
+                if (frames.some((frame) => frame !== page.mainFrame() && frameAllowed(frame)))
+                    return;
+                complete();
+            })
+                .catch(() => undefined);
+        };
+        const onFrameLifecycle = (frame) => {
+            observeTrustedFrame(frame);
+            settleOrRefuse();
+        };
+        page.on("frameattached", onFrameLifecycle);
+        page.on("framenavigated", onFrameLifecycle);
+        for (const frame of page.frames())
+            observeTrustedFrame(frame);
+        settleOrRefuse();
+        let deadlineTimer;
+        if (deadline !== undefined) {
+            const timeout = remaining();
+            if (timeout <= 0)
+                complete();
+            else
+                deadlineTimer = setTimeout(complete, timeout);
+        }
+        try {
+            await completed;
+        }
+        finally {
+            if (deadlineTimer !== undefined)
+                clearTimeout(deadlineTimer);
+            page.off("frameattached", onFrameLifecycle);
+            page.off("framenavigated", onFrameLifecycle);
+        }
+    }
     // Normalizes conservative PAN name/id conventions and scans
     // dt/th/label/"table-label" elements for カード番号 / カード名義 /
     // セキュリティコード and stamps the associated single text input with
@@ -9610,7 +9612,7 @@ export class BrowserController {
             ? undefined
             : { selected: cardGroup, groups: [...groups.values()] };
     }
-    async fillAndSubmitCheckout(card) {
+    async fillAndSubmitCheckout(card, options = {}) {
         if (!this.page)
             throw new Error("Browser not started");
         this.checkoutCardGroupScope = undefined;
@@ -9644,7 +9646,7 @@ export class BrowserController {
             this.rememberPaymentInstrumentExpectation(card);
             primary = {
                 kind: "outcome",
-                value: await this.submitFilledCheckoutInScope(cardGroup),
+                value: await this.submitFilledCheckoutInScope(cardGroup, options.onSubmitDispatched, options.beforeSubmitDispatch),
             };
         }
         catch (error) {
@@ -9678,7 +9680,7 @@ export class BrowserController {
     // left behind. On success the filled values STAY in the page (the site
     // needs them at its confirm step) marked data-ts-sealed-payment, which
     // extractInteractiveElements reports as sealed so observations mask them.
-    async fillCheckoutCardFields(card) {
+    async fillCheckoutCardFields(card, options = {}) {
         if (!this.page)
             throw new Error("Browser not started");
         this.checkoutCardGroupScope = undefined;
@@ -9687,11 +9689,10 @@ export class BrowserController {
         if (!recognizedPaymentProviderFrame(pageUrl, pageUrl)) {
             throw new Error("payment_checkout_https_required");
         }
-        // Same late-mount tolerance as fillAndSubmitCheckout: wait for a PAN
-        // field to appear anywhere before taking the trusted-frame snapshot below
-        // (which still restricts the actual fill to recognized frames — this only
-        // decides WHEN to look, never WHERE it's allowed to write).
-        await this.waitForPanField(10_000);
+        await this.waitForRecognizedPanField(pageUrl, options.deadline);
+        if (options.deadline !== undefined && Date.now() >= options.deadline) {
+            throw new Error("payment_approval_expired");
+        }
         const allowed = page
             .frames()
             .filter((frame) => frame === page.mainFrame() || recognizedPaymentProviderFrame(frame.url(), pageUrl));
@@ -9884,7 +9885,7 @@ export class BrowserController {
     async submitFilledCheckout() {
         return await this.submitFilledCheckoutInScope(this.checkoutCardGroupScope);
     }
-    async submitFilledCheckoutInScope(cardGroup) {
+    async submitFilledCheckoutInScope(cardGroup, onSubmitDispatched, beforeSubmitDispatch) {
         if (!this.page)
             throw new Error("Browser not started");
         const savedCardSelection = await this.resolveCompetingSavedCardSelection();
@@ -9894,6 +9895,7 @@ export class BrowserController {
         let outcomeBaseline;
         this.checkoutOutcomeBaseline = undefined;
         let submitted = false;
+        let clearSubmittedDispatchTracking = null;
         for (const frame of this.page.frames()) {
             const matches = frame.locator('button,input[type="submit"],[role="button"]');
             const count = Math.min(await matches.count().catch(() => 0), 100);
@@ -9943,115 +9945,147 @@ export class BrowserController {
                 if (!CHECKOUT_SUBMIT_LABEL_RE.test(label))
                     continue;
                 const dispatchToken = `ts-payment-submit-${this.checkoutSubmitSequence++}`;
-                const dispatchBaselineStorageKey = `__trusty_squire_payment_baseline_${dispatchToken}`;
                 const preDispatchFrameUrls = this.page.frames().map((pageFrame) => pageFrame.url());
+                const clickOnlyOutcomeBaseline = checkoutOutcomeBaselineFromDispatchSnapshot({
+                    url: this.page.url(),
+                    urls: preDispatchFrameUrls,
+                });
+                let submitDispatchedReported = false;
+                const reportSubmitDispatched = () => {
+                    if (submitDispatchedReported)
+                        return;
+                    onSubmitDispatched?.();
+                    submitDispatchedReported = true;
+                };
                 const dispatchTrackingInstalled = await candidate
-                    .evaluate((element, options) => {
-                    const { baselineStorageKey, frameUrls, token } = options;
+                    .evaluate((element, token) => {
                     const stateWindow = window;
-                    const tracked = element;
-                    if (tracked.__tsPaymentSubmitDispatchListener !== undefined) {
-                        element.removeEventListener("click", tracked.__tsPaymentSubmitDispatchListener, true);
-                    }
-                    stateWindow.__trustySquirePaymentSubmitDispatch = {
-                        token,
-                        dispatched: false,
-                    };
-                    const listener = () => {
-                        const state = stateWindow.__trustySquirePaymentSubmitDispatch;
-                        if (state?.token !== token)
-                            return;
-                        try {
-                            const merchantWindow = window.top;
-                            if (merchantWindow === null)
-                                return;
-                            const urls = new Set(frameUrls);
-                            const collectFrameUrls = (currentWindow) => {
-                                try {
-                                    urls.add(currentWindow.location.href);
-                                    for (let index = 0; index < currentWindow.frames.length; index += 1) {
-                                        collectFrameUrls(currentWindow.frames[index]);
-                                    }
-                                }
-                                catch (error) {
-                                    void error;
-                                }
-                            };
-                            collectFrameUrls(merchantWindow);
-                            const snapshot = {
-                                url: merchantWindow.location.href,
-                                urls: [...urls],
-                            };
-                            const baselineWindow = merchantWindow;
-                            baselineWindow.__trustySquirePaymentDispatchBaselines ??= {};
-                            baselineWindow.__trustySquirePaymentDispatchBaselines[token] = snapshot;
-                            try {
-                                merchantWindow.sessionStorage.setItem(baselineStorageKey, JSON.stringify(snapshot));
-                            }
-                            catch (error) {
-                                void error;
-                            }
-                        }
-                        finally {
-                            state.dispatched = true;
+                    const tracked = element;
+                    const priorTracking = tracked.__tsPaymentSubmitDispatchListeners;
+                    if (priorTracking !== undefined) {
+                        for (const registration of priorTracking) {
+                            registration.target.removeEventListener(registration.event, registration.listener, registration.capture);
                         }
+                    }
+                    stateWindow.__trustySquirePaymentSubmitDispatch = {
+                        token,
+                        validationBlocked: false,
                     };
-                    tracked.__tsPaymentSubmitDispatchListener = listener;
-                    element.addEventListener("click", listener, { capture: true, once: true });
-                }, {
-                    baselineStorageKey: dispatchBaselineStorageKey,
-                    frameUrls: preDispatchFrameUrls,
-                    token: dispatchToken,
-                })
+                    const form = element instanceof HTMLButtonElement || element instanceof HTMLInputElement
+                        ? element.form
+                        : element.closest("form");
+                    const submitTargets = form !== null ? [form] : Array.from(document.forms);
+                    const registrations = [];
+                    const invalidListener = () => {
+                        const state = stateWindow.__trustySquirePaymentSubmitDispatch;
+                        if (state?.token === token)
+                            state.validationBlocked = true;
+                    };
+                    registrations.push(...submitTargets.map((target) => ({
+                        capture: true,
+                        event: "invalid",
+                        listener: invalidListener,
+                        target,
+                    })));
+                    tracked.__tsPaymentSubmitDispatchListeners = registrations;
+                    for (const registration of registrations) {
+                        registration.target.addEventListener(registration.event, registration.listener, {
+                            capture: registration.capture,
+                            once: true,
+                        });
+                    }
+                }, dispatchToken)
                     .then(() => true)
                     .catch(() => false);
-                if (!dispatchTrackingInstalled)
+                if (!dispatchTrackingInstalled) {
                     continue;
-                const readDispatchOutcomeBaseline = async () => {
-                    const snapshot = await this.page.mainFrame()
-                        .evaluate(({ baselineStorageKey, token }) => {
-                        const baselineWindow = window;
-                        let captured = baselineWindow.__trustySquirePaymentDispatchBaselines?.[token] ?? null;
-                        if (captured !== null) {
-                            delete baselineWindow.__trustySquirePaymentDispatchBaselines?.[token];
-                        }
-                        if (captured === null) {
-                            try {
-                                const stored = sessionStorage.getItem(baselineStorageKey);
-                                if (stored !== null) {
-                                    captured = JSON.parse(stored);
-                                }
-                            }
-                            catch {
-                                captured = null;
-                            }
-                        }
-                        try {
-                            sessionStorage.removeItem(baselineStorageKey);
+                }
+                let paymentRequestTrackingArmed = false;
+                let concretePaymentRequestObserved = false;
+                let resolveConcretePaymentRequest = () => undefined;
+                const concretePaymentRequest = new Promise((resolve) => {
+                    resolveConcretePaymentRequest = resolve;
+                });
+                let navigationObserved = false;
+                let navigationTerminalObserved = false;
+                let navigationThreeDsObserved = false;
+                let resolveNavigationOutcome = () => undefined;
+                const navigationOutcome = new Promise((resolve) => {
+                    resolveNavigationOutcome = resolve;
+                });
+                const paymentRequestListener = (request) => {
+                    const activePage = this.page;
+                    if (!paymentRequestTrackingArmed || activePage === null)
+                        return;
+                    let sourceFrame;
+                    try {
+                        sourceFrame = request.frame();
+                    }
+                    catch {
+                        return;
+                    }
+                    if (sourceFrame !== frame && sourceFrame !== activePage.mainFrame())
+                        return;
+                    if (!isCheckoutPaymentRequest(request))
+                        return;
+                    concretePaymentRequestObserved = true;
+                    resolveConcretePaymentRequest();
+                };
+                const navigationListener = () => {
+                    if (!paymentRequestTrackingArmed || this.page === null)
+                        return;
+                    navigationObserved = true;
+                    void (async () => {
+                        if (await this.hasConfirmedCheckoutOutcome(clickOnlyOutcomeBaseline)) {
+                            navigationTerminalObserved = true;
+                            resolveNavigationOutcome();
+                            return;
                         }
-                        catch (error) {
-                            void error;
+                        const challenge = await this.detectThreeDsChallenge().catch(() => undefined);
+                        if (challenge?.three_ds_required === true) {
+                            navigationThreeDsObserved = true;
+                            resolveNavigationOutcome();
                         }
-                        return captured;
-                    }, { baselineStorageKey: dispatchBaselineStorageKey, token: dispatchToken })
-                        .catch(() => null);
-                    if (snapshot === null ||
-                        typeof snapshot.url !== "string" ||
-                        !Array.isArray(snapshot.urls) ||
-                        !snapshot.urls.every((url) => typeof url === "string")) {
-                        return null;
-                    }
-                    return checkoutOutcomeBaselineFromDispatchSnapshot(snapshot);
+                    })();
+                };
+                this.page.on("request", paymentRequestListener);
+                this.page.on("framenavigated", navigationListener);
+                const waitForDispatchEvidence = async () => {
+                    let timer;
+                    await Promise.race([
+                        concretePaymentRequest,
+                        navigationOutcome,
+                        new Promise((resolve) => {
+                            timer = setTimeout(resolve, CHECKOUT_PAYMENT_REQUEST_OBSERVATION_MS);
+                        }),
+                    ]);
+                    if (timer !== undefined)
+                        clearTimeout(timer);
                 };
+                const readDispatchState = async () => await frame
+                    .evaluate((token) => {
+                    const stateWindow = window;
+                    const state = stateWindow.__trustySquirePaymentSubmitDispatch;
+                    return {
+                        validationBlocked: state?.token === token && state.validationBlocked,
+                    };
+                }, dispatchToken)
+                    .catch(() => null);
                 const clearDispatchTracking = async () => {
+                    paymentRequestTrackingArmed = false;
+                    this.page?.off("request", paymentRequestListener);
+                    this.page?.off("framenavigated", navigationListener);
                     await candidate
                         .evaluate((element) => {
                         const tracked = element;
-                        if (tracked.__tsPaymentSubmitDispatchListener !== undefined) {
-                            element.removeEventListener("click", tracked.__tsPaymentSubmitDispatchListener, true);
-                            delete tracked.__tsPaymentSubmitDispatchListener;
+                        const tracking = tracked.__tsPaymentSubmitDispatchListeners;
+                        if (tracking !== undefined) {
+                            for (const registration of tracking) {
+                                registration.target.removeEventListener(registration.event, registration.listener, registration.capture);
+                            }
+                            delete tracked.__tsPaymentSubmitDispatchListeners;
                         }
-                    })
+                    }, undefined, { timeout: 250 })
                         .catch(() => undefined);
                     await frame
                         .evaluate((token) => {
@@ -10061,7 +10095,6 @@ export class BrowserController {
                         }
                     }, dispatchToken)
                         .catch(() => undefined);
-                    await readDispatchOutcomeBaseline();
                 };
                 // Money-fence boundary: the async pay-button scan above (visibility/
                 // enabled/ownership/label checks, dispatch-tracking install) is a real
@@ -10071,42 +10104,76 @@ export class BrowserController {
                 // can themselves trigger a merchant default-selection revert; the
                 // re-verification is then the LAST thing before the charge click is
                 // dispatched — never proceed on a stale check.
-                await this.page.bringToFront().catch(() => undefined);
-                if (!(await this.savedCardSelectionVerified(savedCardSelection.verification))) {
+                let capturedBaseline = null;
+                try {
+                    await this.page.bringToFront().catch(() => undefined);
+                    await candidate.click({ trial: true });
+                    if (!(await this.savedCardSelectionVerified(savedCardSelection.verification))) {
+                        throw new Error("payment_card_selection_ambiguous");
+                    }
+                    capturedBaseline = await runCaptureConfirmedPaymentSubmit({
+                        click: async (markInputDispatchPossible) => {
+                            let remainingMs;
+                            try {
+                                remainingMs = beforeSubmitDispatch?.();
+                            }
+                            catch (error) {
+                                throw new BrowserClickDispatchError("not_dispatched", error);
+                            }
+                            paymentRequestTrackingArmed = true;
+                            markInputDispatchPossible();
+                            await candidate.click({
+                                noWaitAfter: true,
+                                ...(typeof remainingMs === "number"
+                                    ? { timeout: Math.max(1, Math.ceil(remainingMs)) }
+                                    : {}),
+                            });
+                        },
+                        readEvidence: async () => {
+                            await waitForDispatchEvidence();
+                            const dispatchState = await readDispatchState();
+                            const clickOnlyOutcomeConfirmed = navigationTerminalObserved ||
+                                (await this.hasConfirmedCheckoutOutcome(clickOnlyOutcomeBaseline));
+                            const clickOnlyThreeDsObserved = navigationObserved &&
+                                (navigationThreeDsObserved ||
+                                    (await this.detectThreeDsChallenge().catch(() => undefined))
+                                        ?.three_ds_required === true);
+                            const clickOnlyDispatchObserved = (concretePaymentRequestObserved && dispatchState?.validationBlocked !== true) ||
+                                clickOnlyOutcomeConfirmed ||
+                                clickOnlyThreeDsObserved;
+                            return {
+                                baseline: clickOnlyDispatchObserved ? clickOnlyOutcomeBaseline : null,
+                                dispatched: clickOnlyDispatchObserved,
+                            };
+                        },
+                        clear: async () => undefined,
+                        onSubmitDispatched: reportSubmitDispatched,
+                    });
+                    clearSubmittedDispatchTracking = clearDispatchTracking;
+                }
+                catch (error) {
                     await clearDispatchTracking();
-                    throw new Error("payment_card_selection_ambiguous");
+                    throw error;
                 }
                 try {
-                    await candidate.click();
+                    outcomeBaseline = capturedBaseline ?? (await this.captureCheckoutOutcomeBaseline());
                 }
                 catch (error) {
-                    const dispatchState = await frame
-                        .evaluate((token) => {
-                        const stateWindow = window;
-                        const state = stateWindow.__trustySquirePaymentSubmitDispatch;
-                        return {
-                            sameDocument: state?.token === token,
-                            dispatched: state?.token === token && state.dispatched,
-                        };
-                    }, dispatchToken)
-                        .catch(() => null);
-                    await clearDispatchTracking();
-                    if (dispatchState?.sameDocument === true && !dispatchState.dispatched)
-                        throw error;
-                    throw new PaymentSubmitOutcomeUnknownError();
+                    await clearSubmittedDispatchTracking?.();
+                    clearSubmittedDispatchTracking = null;
+                    throw error;
                 }
-                outcomeBaseline =
-                    (await readDispatchOutcomeBaseline()) ?? (await this.captureCheckoutOutcomeBaseline());
                 this.checkoutOutcomeBaseline = outcomeBaseline;
-                await clearDispatchTracking();
                 submitted = true;
                 break;
             }
             if (submitted)
                 break;
         }
-        if (!submitted || outcomeBaseline === undefined)
+        if (!submitted || outcomeBaseline === undefined) {
+            await clearSubmittedDispatchTracking?.();
             throw new Error("payment_submit_not_found");
+        }
         try {
             const challengeDeadline = Date.now() + 15_000;
             while (Date.now() < challengeDeadline) {
@@ -10114,17 +10181,23 @@ export class BrowserController {
                     return { three_ds_required: false, order_confirmed: true };
                 }
                 const challenge = await this.detectThreeDsChallenge();
-                if (challenge.three_ds_required)
+                if (challenge.three_ds_required) {
                     return challenge;
+                }
                 await this.page.waitForTimeout(250).catch(() => undefined);
             }
             return { three_ds_required: false, order_confirmed: false };
         }
         catch (error) {
-            if (error instanceof PaymentSubmitOutcomeUnknownError)
+            if (error instanceof PaymentSubmitOutcomeUnknownError ||
+                error instanceof BrowserClickDispatchError) {
                 throw error;
+            }
             throw new PaymentSubmitOutcomeUnknownError();
         }
+        finally {
+            await clearSubmittedDispatchTracking?.();
+        }
     }
     async clearSealedPaymentFields() {
         this.checkoutCardGroupScope = undefined;
@@ -10586,9 +10659,23 @@ export class BrowserController {
         catch {
             sameCheckoutOrigin = current.url === baseline.url;
         }
-        return (sameCheckoutOrigin &&
+        const newTerminalOrderIdentity = sameCheckoutOrigin &&
             current.terminalUrlIdentity !== null &&
-            !baseline.orderUrlIdentities.includes(current.terminalUrlIdentity));
+            !baseline.orderUrlIdentities.includes(current.terminalUrlIdentity);
+        if (newTerminalOrderIdentity)
+            return true;
+        if (!sameCheckoutOrigin ||
+            current.url === baseline.url ||
+            !isShopifyCheckoutThankYouRoute(current.url)) {
+            return false;
+        }
+        return await this.page.mainFrame().evaluate(() => {
+            const visibleText = document.body?.innerText ?? "";
+            const confirmationNumber = /\bconfirmation\s*#\s*[a-z0-9][a-z0-9-]{3,}\b/i.test(visibleText);
+            const confirmedOrder = /\byour order is confirmed\b/i.test(visibleText);
+            const thankYouHeading = Array.from(document.querySelectorAll("h1, h2, [role=heading]")).some((element) => /\bthank you\b/i.test(element.textContent ?? ""));
+            return confirmedOrder || (thankYouHeading && confirmationNumber);
+        });
     }
     // Let the browser complete the challenge natively (including out-of-band
     // bank-app 3DS): just poll for the same terminal-order signal a plain
@@ -10601,11 +10688,14 @@ export class BrowserController {
         const failureText = /(?:payment|card|transaction) (?:was )?declined|authentication failed|could not be (?:authenticated|processed|completed)|(?:please )?try (?:a |another )?(?:different )?card|3-?d ?secure (?:failed|unsuccessful)/i;
         const deadline = Date.now() + Math.max(timeoutMs, 0);
         const mismatchAtEntry = this.observedPaymentInstrumentMismatch;
+        let challengeObserved = false;
         while (true) {
             await this.page.bringToFront().catch(() => undefined);
-            await this.detectThreeDsChallenge().catch(() => undefined);
+            const challenge = await this.detectThreeDsChallenge().catch(() => undefined);
+            if (challenge?.three_ds_required === true)
+                challengeObserved = true;
             if (mismatchAtEntry === undefined && this.observedPaymentInstrumentMismatch !== undefined) {
-                return "timeout";
+                return challengeObserved ? "challenge_pending" : "timeout";
             }
             if (await this.hasConfirmedCheckoutOutcome(outcomeBaseline))
                 return "succeeded";
@@ -10617,7 +10707,7 @@ export class BrowserController {
                 return "failed";
             const remainingMs = deadline - Date.now();
             if (remainingMs <= 0)
-                return "timeout";
+                return challengeObserved ? "challenge_pending" : "timeout";
             await this.page.waitForTimeout(Math.min(1_000, remainingMs)).catch(() => undefined);
         }
     }
@@ -12379,6 +12469,18 @@ export class BrowserController {
                 el instanceof HTMLTextAreaElement ||
                 el instanceof HTMLSelectElement;
             const regionFor = (el) => el.closest('[role="dialog"],dialog,[aria-modal="true"],nav,main,header,footer,aside,form,section,article');
+            const regionIds = new Map();
+            let nextRegionId = 1;
+            const regionId = (region) => {
+                if (region === null)
+                    return null;
+                const existing = regionIds.get(region);
+                if (existing !== undefined)
+                    return existing;
+                const id = nextRegionId++;
+                regionIds.set(region, id);
+                return id;
+            };
             const regionName = (region) => {
                 if (region === null)
                     return null;
@@ -12666,8 +12768,11 @@ export class BrowserController {
                 // matches it and the OAuth-first scan picks it up.
                 const isGoogleGSIIframe = el instanceof HTMLIFrameElement &&
                     (el.getAttribute("src") ?? "").includes("accounts.google.com/gsi/button");
-                const container = regionName(regionFor(el));
+                const region = regionFor(el);
+                const container = regionName(region);
+                const containerId = regionId(region);
                 const inDialog = nearestModalRegion(el) !== null;
+                const formId = regionId(el.closest("form"));
                 const status = topmostStatus(el);
                 const pathLabel = isGoogleGSIIframe
                     ? "Continue with Google"
@@ -12733,6 +12838,8 @@ export class BrowserController {
                     checked: el instanceof HTMLInputElement && (el.type === "checkbox" || el.type === "radio")
                         ? el.checked
                         : null,
+                    disabled: el.matches(":disabled") || el.getAttribute("aria-disabled") === "true" ? true : null,
+                    required: el.matches(":required") || el.getAttribute("aria-required") === "true" ? true : null,
                     // For <select>: the currently-selected option's visible text
                     // and a short list of available option labels. The combination
                     // is how the planner detects the "React-defaulted dropdown"
@@ -12756,12 +12863,12 @@ export class BrowserController {
                         ? clean(el.options[el.selectedIndex]?.textContent ?? null)
                         : null,
                     interactedThisRun: el.getAttribute("data-ts-touched") === "1",
-                    sealed: el.getAttribute("data-ts-sealed-payment") === "1",
-                    sealedOrdinal: Array.from(el.getRootNode().querySelectorAll("input,textarea,select,[contenteditable='true']")).indexOf(el),
                     screenPath: `${container ?? "body:root"} > ${elementKind(el)}:` +
                         slug(pathLabel, `${elementKind(el)}-${out.length}`),
                     container,
                     inDialog,
+                    containerId,
+                    formId,
                     topmost: status.topmost,
                     occludedBy: status.occludedBy,
                 });
@@ -13101,20 +13208,16 @@ export class BrowserController {
             const frame = await handle.ownerFrame();
             if (frame === null)
                 throw new Error("type target has no owning frame");
-            const sealedFieldKeys = sealed
-                ? await this.operatorScreenshotIdentityKeys(handle, frame)
-                : [];
             if (sealed) {
                 await handle.evaluate((el) => el.setAttribute("data-ts-sealed-payment", "1"));
             }
             if (!this.humanize) {
                 await handle.fill(text);
-                return sealedFieldKeys;
+                return;
             }
             await handle.click({ timeout: 8000 }).catch(() => undefined);
             await handle.fill("").catch(() => undefined);
             await handle.type(text, { delay: rand(40, 110) });
-            return sealedFieldKeys;
         }
         finally {
             await handle.dispose().catch(() => undefined);
@@ -13192,21 +13295,8 @@ export class BrowserController {
         const page = this.page;
         const mainRaw = await this.extractElementsFromContext(page);
         const mainGroups = assignCardRadioGroups(mainRaw.clusterMeta);
-        const mainDocumentIdentity = await this.sealedDocumentIdentity(page.mainFrame());
         const mainElements = mainRaw.out.map((e, i) => ({
             ...e,
-            sealedIdentityKeys: sealedElementSemanticKeys({
-                tag: e.tag,
-                type: e.type,
-                id: e.id,
-                name: e.name,
-                testId: e.testId,
-                labelText: e.labelText,
-                ariaLabel: e.ariaLabel,
-                placeholder: e.placeholder,
-                landmark: e.landmark,
-                ordinal: e.sealedOrdinal,
-            }).map((key) => `${mainDocumentIdentity}:${key}`),
             cardRadioGroup: mainGroups[i] ?? null,
             frameOrigin: null,
             frameUrl: null,
@@ -13238,23 +13328,10 @@ export class BrowserController {
                 const raw = await this.extractElementsFromContext(frame);
                 const security = await this.frameSecurity(frame);
                 const frameOrigin = security.origin;
-                const frameDocumentIdentity = await this.sealedDocumentIdentity(frame);
                 const groups = assignCardRadioGroups(raw.clusterMeta);
                 for (const [i, e] of raw.out.entries()) {
                     framedElements.push({
                         ...e,
-                        sealedIdentityKeys: sealedElementSemanticKeys({
-                            tag: e.tag,
-                            type: e.type,
-                            id: e.id,
-                            name: e.name,
-                            testId: e.testId,
-                            labelText: e.labelText,
-                            ariaLabel: e.ariaLabel,
-                            placeholder: e.placeholder,
-                            landmark: e.landmark,
-                            ordinal: e.sealedOrdinal,
-                        }).map((key) => `${frameDocumentIdentity}:${key}`),
                         cardRadioGroup: groups[i] ?? null,
                         frameOrigin,
                         frameUrl,
@@ -13330,7 +13407,6 @@ export class BrowserController {
     async startOAuth(selector) {
         if (!this.page || !this.context)
             throw new Error("Browser not started");
-        this.maybeAttachOAuthNetListener();
         if (!/accounts\.google\.com|github\.com\/login|login\.microsoftonline\.com/i.test(this.page.url())) {
             this.oauthProductPage = this.page;
         }
@@ -13367,30 +13443,46 @@ export class BrowserController {
     // clicks the product's already-observed OAuth control and waits for the
     // provider-owned window to finish; no credentials, frames, or consent scopes
     // are read or bypassed here.
-    async loginWithOAuth(selector, settleTimeoutMs = 12_000) {
+    async loginWithOAuth(selector, settleTimeoutMs = 30_000, consentProvider, expectedGoogleAccountEmail) {
         const product = this.page;
         const context = this.context;
         if (product === null || product.isClosed() || context === null) {
             throw new Error("OAuth login cannot start because the product page is unavailable");
         }
-        this.maybeAttachOAuthNetListener();
         this.oauthProductPage = product;
         this.oauthProviderPage = null;
         this.oauthProviderPageClosed = false;
+        const oauthBudgetMs = Math.max(1, settleTimeoutMs);
         const productUrl = product.url();
+        const oauthDeadline = Date.now() + oauthBudgetMs;
+        const remainingBudgetMs = () => Math.max(1, oauthDeadline - Date.now());
+        const deadlineError = () => consentProvider === "google"
+            ? Object.assign(new Error(`google_session: OAuth did not complete within ${Math.ceil(oauthBudgetMs / 1000)} seconds; ` +
+                "the saved session may have expired, so reconnect with " +
+                "`npx @trusty-squire/mcp connect --force-relogin=google` before retrying"), { code: "google_session" })
+            : new Error(`OAuth login is still awaiting the provider after ${Math.ceil(oauthBudgetMs / 1000)} seconds. Retry oauth_login; do not read or close the browser session.`);
         let recovery = null;
         let providerPage = null;
         let productDeparted = false;
+        let resolveProductDeparture = () => undefined;
+        const productDeparturePromise = new Promise((resolve) => {
+            resolveProductDeparture = resolve;
+        });
         const onProductNavigation = (frame) => {
             if (frame !== product.mainFrame())
                 return;
-            if (!this.isOAuthProductUrl(frame.url(), productUrl))
+            if (!this.isOAuthProductUrl(frame.url(), productUrl)) {
                 productDeparted = true;
+                resolveProductDeparture();
+            }
         };
         product.on("framenavigated", onProductNavigation);
         try {
             recovery = await context.newPage();
-            await recovery.goto(productUrl, { waitUntil: "domcontentloaded", timeout: 30_000 });
+            await recovery.goto(productUrl, {
+                waitUntil: "domcontentloaded",
+                timeout: remainingBudgetMs(),
+            });
             let resolvePopup = () => undefined;
             const popupPromise = new Promise((resolve) => {
                 resolvePopup = resolve;
@@ -13401,6 +13493,8 @@ export class BrowserController {
             };
             context.on("page", onPopup);
             try {
+                if (Date.now() >= oauthDeadline)
+                    throw deadlineError();
                 try {
                     await this.click(selector);
                 }
@@ -13410,25 +13504,56 @@ export class BrowserController {
                 }
                 providerPage = await Promise.race([
                     popupPromise,
-                    this.sleep(Math.min(settleTimeoutMs, 2_000)).then(() => null),
+                    // A same-tab provider redirect is just as conclusive as a popup.
+                    // Do not burn two seconds of the OAuth budget waiting for a window
+                    // that this service will never open.
+                    productDeparturePromise.then(() => null),
+                    this.sleep(Math.min(remainingBudgetMs(), 2_000)).then(() => null),
                 ]);
             }
             finally {
                 context.off("page", onPopup);
                 resolvePopup(null);
+                resolveProductDeparture();
             }
             const transient = providerPage ?? product;
+            productDeparted = productDeparted || !this.isOAuthProductUrl(transient.url(), productUrl);
             const durableProduct = providerPage === null ? recovery : product;
             this.oauthProductPage = durableProduct;
             this.oauthProviderPage = transient;
             this.oauthProviderPageClosed = transient.isClosed();
             this.restoreProductPageWhenOAuthPageCloses(transient, durableProduct);
-            const settled = await this.waitForOAuthLifecycle(transient, productUrl, settleTimeoutMs, providerPage === null, productDeparted);
+            this.page = transient;
+            let settled = null;
+            if (consentProvider === undefined) {
+                settled = await this.waitForOAuthLifecycle(transient, productUrl, remainingBudgetMs(), providerPage === null, productDeparted);
+            }
+            else {
+                const deadline = oauthDeadline;
+                while (settled === null && Date.now() < deadline) {
+                    const remaining = deadline - Date.now();
+                    settled = await this.waitForOAuthLifecycle(transient, productUrl, Math.min(1_000, remaining), providerPage === null, productDeparted);
+                    if (settled !== null || transient.isClosed())
+                        break;
+                    productDeparted = productDeparted || !this.isOAuthProductUrl(transient.url(), productUrl);
+                    if (Date.now() >= deadline)
+                        break;
+                    const consentBudgetMs = deadline - Date.now();
+                    const advanced = await this.advanceOAuthConsent(consentProvider, consentBudgetMs, expectedGoogleAccountEmail).catch(() => false);
+                    if (!advanced)
+                        await this.sleep(Math.min(250, remainingBudgetMs()));
+                }
+            }
             if (settled === null) {
-                throw new Error(`OAuth login is still awaiting the provider after ${Math.ceil(settleTimeoutMs / 1000)} seconds. Retry oauth_login; do not read or close the browser session.`);
+                throw deadlineError();
             }
             if (providerPage === null && product.isClosed()) {
-                await recovery.reload({ waitUntil: "domcontentloaded", timeout: 30_000 });
+                if (Date.now() >= oauthDeadline)
+                    throw deadlineError();
+                await recovery.reload({
+                    waitUntil: "domcontentloaded",
+                    timeout: remainingBudgetMs(),
+                });
             }
         }
         finally {
@@ -13447,7 +13572,9 @@ export class BrowserController {
             if (this.page !== null && !this.page.isClosed()) {
                 await this.page.bringToFront().catch(() => undefined);
                 await this.page
-                    .waitForLoadState("domcontentloaded", { timeout: 30_000 })
+                    .waitForLoadState("domcontentloaded", {
+                    timeout: remainingBudgetMs(),
+                })
                     .catch(() => undefined);
             }
         }
@@ -13487,12 +13614,23 @@ export class BrowserController {
             const url = page.url();
             const isProduct = this.isOAuthProductUrl(url, productUrl);
             if (startsOnProduct && departed && isProduct) {
-                const remaining = Math.max(1, deadline - Date.now());
-                const idle = await page
-                    .waitForLoadState("networkidle", { timeout: remaining })
+                // A return to the relying party is the OAuth completion signal. A
+                // dashboard can keep polling or streaming forever, so networkidle is
+                // not a valid requirement for a completed OAuth redirect.
+                const returnedUrl = url;
+                const ready = await page
+                    .waitForLoadState("domcontentloaded", { timeout: Math.max(1, deadline - Date.now()) })
                     .then(() => true)
                     .catch(() => false);
-                return idle && !page.isClosed() && this.isOAuthProductUrl(page.url(), productUrl)
+                if (!ready || page.isClosed() || !this.isOAuthProductUrl(page.url(), productUrl)) {
+                    return null;
+                }
+                // Require the return URL to survive one event-loop turn so a transient
+                // callback hop is never reported as the final product page.
+                await this.sleep(Math.min(50, Math.max(1, deadline - Date.now())));
+                return !page.isClosed() &&
+                    page.url() === returnedUrl &&
+                    this.isOAuthProductUrl(page.url(), productUrl)
                     ? "returned"
                     : null;
             }
@@ -13502,118 +13640,6 @@ export class BrowserController {
         }
         return page.isClosed() ? "closed" : null;
     }
-    // ── OAuth/SSO debug instrumentation (UNIVERSAL_BOT_OAUTH_DEBUG) ──
-    // Attach a context-level response recorder ONCE. Records SSO-relevant
-    // responses (the service host + Clerk/Stytch/WorkOS FAPI hosts) with their
-    // status + whether they set a cookie — the signal for "did the callback's
-    // session-establish request succeed and set the session cookie?"
-    maybeAttachOAuthNetListener() {
-        if (this.oauthNetListenerAttached)
-            return;
-        if (!/^(1|true|on)$/i.test(process.env.UNIVERSAL_BOT_OAUTH_DEBUG ?? ""))
-            return;
-        if (!this.context)
-            return;
-        this.oauthNetListenerAttached = true;
-        const RELEVANT = /clerk|stytch|workos|accounts\.|\/sso|\/oauth|\/session|\/sign|callback|\/v1\/client/i;
-        this.context.on("response", (res) => {
-            void (async () => {
-                try {
-                    const url = res.url();
-                    if (!RELEVANT.test(url))
-                        return;
-                    const headers = res.headers();
-                    if (this.oauthNetLog.length >= 200)
-                        return;
-                    const entry = {
-                        url: url.slice(0, 200),
-                        status: res.status(),
-                        setCookie: "set-cookie" in headers || "Set-Cookie" in headers,
-                        ct: (headers["content-type"] ?? "").slice(0, 40),
-                    };
-                    // Capture the body of a Clerk/Stytch/WorkOS sign-in/up/callback error
-                    // (>=400) — its error code is the definitive tell (captcha_invalid vs
-                    // transfer vs identifier_*). JSON only, bounded.
-                    if (res.status() >= 400 &&
-                        /\/v1\/client\/(sign_ins|sign_ups)|oauth_callback|\/session/i.test(url)) {
-                        entry.body = (await res.text().catch(() => "")).slice(0, 800);
-                    }
-                    this.oauthNetLog.push(entry);
-                }
-                catch {
-                    // best-effort observability — never perturb the run
-                }
-            })();
-        });
-    }
-    // Dump cookies + the SSO network log to a file for post-mortem. Called at the
-    // oauth_session_not_persisted decision point when UNIVERSAL_BOT_OAUTH_DEBUG.
-    async dumpOAuthDebug(service, label) {
-        if (!/^(1|true|on)$/i.test(process.env.UNIVERSAL_BOT_OAUTH_DEBUG ?? ""))
-            return;
-        if (!this.context)
-            return;
-        try {
-            const cookies = await this.context.cookies();
-            const cookieSummary = cookies.map((c) => ({
-                name: c.name,
-                domain: c.domain,
-                path: c.path,
-                len: c.value.length,
-                httpOnly: c.httpOnly,
-                secure: c.secure,
-                sameSite: c.sameSite,
-            }));
-            const url = this.page ? this.page.url() : "(no page)";
-            // Capture the live Clerk SDK state — the definitive read on whether a
-            // sign-up transfer is available (the new-user-OAuth fix hinges on this).
-            const clerkState = this.page
-                ? await this.page
-                    .evaluate(() => {
-                    const w = window;
-                    const c = w.Clerk;
-                    if (c === undefined)
-                        return { present: false };
-                    const client = c.client;
-                    const si = client?.["signIn"];
-                    const su = client?.["signUp"];
-                    const ffv = si?.["firstFactorVerification"];
-                    return {
-                        present: true,
-                        loaded: c.loaded ?? null,
-                        signInStatus: si?.["status"] ?? null,
-                        signInFFVStatus: ffv?.["status"] ?? null,
-                        signInFFVError: ffv?.["error"] ?? null,
-                        signUpStatus: su?.["status"] ?? null,
-                        signUpMissingFields: su?.["missingFields"] ?? null,
-                        hasSignUpCreate: typeof su?.create === "function",
-                    };
-                })
-                    .catch((e) => ({ present: "evalError", err: String(e).slice(0, 120) }))
-                : { present: false };
-            const consoleText = await this.extractText().catch(() => "");
-            const { writeFileSync, mkdirSync } = await import("node:fs");
-            const { join } = await import("node:path");
-            const { homedir } = await import("node:os");
-            const dir = join(homedir(), ".trusty-squire", "oauth-debug");
-            mkdirSync(dir, { recursive: true });
-            const ts = process.env.OAUTH_DEBUG_TS ?? String(this.oauthNetLog.length);
-            const path = join(dir, `${service}-${label}-${ts}.json`);
-            writeFileSync(path, JSON.stringify({
-                service,
-                label,
-                finalUrl: url,
-                clerkState,
-                cookies: cookieSummary,
-                netLog: this.oauthNetLog,
-                pageText: consoleText.slice(0, 600),
-            }, null, 2));
-            console.error(`[oauth-debug] wrote ${path} (${cookieSummary.length} cookies, ${this.oauthNetLog.length} net entries)`);
-        }
-        catch (err) {
-            console.error(`[oauth-debug] dump failed: ${err instanceof Error ? err.message : String(err)}`);
-        }
-    }
     // Read the page's Rails/OmniAuth CSRF token (<meta name="csrf-token">).
     // Needed to recover OmniAuth 2.0 POST-only OAuth when the provider button is
     // a GET <a> that page-JS upgrades to a POST.
@@ -13862,6 +13888,67 @@ export class BrowserController {
     recoverActivePage() {
         return this.adoptLivePage();
     }
+    // ───────────── new-tab adoption ─────────────
+    //
+    // Arm adoption immediately BEFORE an action that may open a tab. Anything
+    // already queued belonged to an earlier action and is not this action's to
+    // follow.
+    armOpenedTabAdoption() {
+        this.openedTabs.length = 0;
+    }
+    // Adopt the newest live tab opened since armOpenedTabAdoption() as the active
+    // page, so the next observe/act reads the tab the click actually opened.
+    // Returns the adopted URL, or null when the action opened no followable tab.
+    //
+    // `graceMs` covers the window between the click returning and Playwright
+    // delivering the context "page" event; a caller that has already waited for
+    // the page to settle passes 0 and just drains what arrived.
+    async adoptOpenedTab(graceMs = 0) {
+        const deadline = Date.now() + Math.max(0, graceMs);
+        let candidate = this.takeFollowableTab();
+        while (candidate === null && Date.now() < deadline) {
+            await this.sleep(50);
+            candidate = this.takeFollowableTab();
+        }
+        if (candidate === null)
+            return null;
+        this.openedTabs.length = 0;
+        // A window.open target starts at about:blank and is navigated a tick later.
+        // Adopting it while blank would report an empty page to the host, so wait
+        // (bounded) for the document it was opened for.
+        const blank = (url) => url === "" || url === "about:blank" || url === "about:srcdoc";
+        for (let i = 0; i < 40 && !candidate.isClosed() && blank(candidate.url()); i++) {
+            await this.sleep(50);
+        }
+        if (candidate.isClosed())
+            return null;
+        this.page = candidate;
+        this.trackMainDocument(candidate);
+        await candidate.bringToFront().catch(() => undefined);
+        await candidate
+            .waitForLoadState("domcontentloaded", { timeout: 15_000 })
+            .catch(() => undefined);
+        return candidate.isClosed() ? null : candidate.url();
+    }
+    // Newest queued tab the operator may follow. Pages the controller itself owns
+    // (the active page, the primary page, either side of an OAuth handshake, a
+    // recovery tab) are never adoption candidates — those lifecycles are managed
+    // by the code that created them.
+    takeFollowableTab() {
+        for (let i = this.openedTabs.length - 1; i >= 0; i--) {
+            const tab = this.openedTabs[i];
+            if (tab.isClosed())
+                continue;
+            if (tab === this.page ||
+                tab === this.primaryPage ||
+                tab === this.oauthProductPage ||
+                tab === this.oauthProviderPage) {
+                continue;
+            }
+            return tab;
+        }
+        return null;
+    }
     adoptLivePage() {
         if (this.page !== null && !this.page.isClosed())
             return true;
@@ -14099,14 +14186,7 @@ export class BrowserController {
             return false;
         }
     }
-    // Which OAuth providers have a LIVE session in this profile's cookie jar.
-    // The logged-in-providers.json marker is a memo that drifts out of sync
-    // (a --force-relogin clears it, a misclassified run clears it, a parallel
-    // run overwrites it) — so a session that is genuinely live in the cookies
-    // can go invisible to provider selection, which is exactly how a warm
-    // GitHub session got skipped in favour of a broken Google path. The cookie
-    // jar is the ground truth: read it directly. Cookie NAMES + presence only;
-    // values are never read into logs. Best-effort — a read failure returns [].
+    // Which OAuth providers have a live session in this profile's cookie jar.
     async detectSessionProviders() {
         if (this.context === null)
             return [];
@@ -14117,13 +14197,18 @@ export class BrowserController {
             return [];
         }
     }
-    async detectGoogleAccountEmail() {
+    async detectGoogleAccountEmail(expectedGoogleAccountEmail) {
         if (this.context === null)
             return null;
         let identityPage = null;
         try {
             identityPage = await this.context.newPage();
-            await identityPage.goto("https://myaccount.google.com/", {
+            const identityUrl = new URL("https://myaccount.google.com/");
+            const expectedEmail = expectedGoogleAccountEmail?.trim();
+            if (expectedEmail !== undefined && expectedEmail.length > 0) {
+                identityUrl.searchParams.set("authuser", expectedEmail);
+            }
+            await identityPage.goto(identityUrl.href, {
                 waitUntil: "domcontentloaded",
                 timeout: 20_000,
             });
@@ -14147,13 +14232,18 @@ export class BrowserController {
             await identityPage?.close().catch(() => undefined);
         }
     }
-    // Advance a provider's consent / account-chooser screen by one click
-    // — the scope-gated auto-approve (T7/T13). Returns false when no
+    // Advance a provider's consent / account-chooser screen by one click.
+    // Returns false when no
     // approve control is present — the agent then aborts rather than
     // hang. Clicks only; never types (the critical guarantee holds here).
-    async advanceOAuthConsent(provider) {
+    async advanceOAuthConsent(provider, timeoutMs = 8_000, expectedGoogleAccountEmail) {
         if (!this.page)
             throw new Error("Browser not started");
+        const deadline = Date.now() + Math.max(0, timeoutMs);
+        const hasBudget = () => Date.now() < deadline;
+        const boundedTimeout = (limitMs) => Math.max(1, Math.min(limitMs, deadline - Date.now()));
+        if (!hasBudget())
+            return false;
         if (provider === "github") {
             // GitHub App install flow can include an account target chooser before
             // the Install/Authorize screen:
@@ -14163,8 +14253,12 @@ export class BrowserController {
             // consent loop re-classify the next GitHub page.
             if (/\/apps\/[^/]+\/installations\/select_target\b/.test(new URL(this.page.url()).pathname)) {
                 const startUrl = this.page.url();
+                if (!hasBudget())
+                    return false;
                 const clicked = await this.page
-                    .evaluate(() => {
+                    .evaluate((expiresAt) => {
+                    if (Date.now() >= expiresAt)
+                        return false;
                     const visible = (el) => {
                         const r = el.getBoundingClientRect();
                         const s = window.getComputedStyle(el);
@@ -14189,13 +14283,17 @@ export class BrowserController {
                         });
                     if (target === undefined)
                         return false;
+                    if (Date.now() >= expiresAt)
+                        return false;
                     target.click();
                     return true;
-                })
+                }, deadline)
                     .catch(() => false);
                 if (clicked) {
                     const advanced = await this.page
-                        .waitForFunction((s) => window.location.href !== s, startUrl, { timeout: 8000 })
+                        .waitForFunction((s) => window.location.href !== s, startUrl, {
+                        timeout: boundedTimeout(8_000),
+                    })
                         .then(() => true)
                         .catch(() => false);
                     if (advanced)
@@ -14230,7 +14328,7 @@ export class BrowserController {
                 // (MEASURED 2026-06-11: defang's "Authorize DefangLabs"). Poll up to
                 // 12s for it to enable before clicking.
                 {
-                    const deadline = Date.now() + 12_000;
+                    const deadline = Date.now() + boundedTimeout(12_000);
                     while (Date.now() < deadline) {
                         const disabled = await btn
                             .evaluate((el) => {
@@ -14247,8 +14345,10 @@ export class BrowserController {
                         await this.sleep(400);
                     }
                 }
+                if (!hasBudget())
+                    return false;
                 try {
-                    await btn.click({ timeout: 8000 });
+                    await btn.click({ timeout: boundedTimeout(8_000) });
                 }
                 catch {
                     continue;
@@ -14258,7 +14358,9 @@ export class BrowserController {
                 // click silently failed (wrong element, or button disabled
                 // behind a hidden iframe). Return false so the caller knows.
                 const advanced = await this.page
-                    .waitForFunction((s) => window.location.href !== s, startUrl, { timeout: 4000 })
+                    .waitForFunction((s) => window.location.href !== s, startUrl, {
+                    timeout: boundedTimeout(4_000),
+                })
                     .then(() => true)
                     .catch(() => false);
                 if (advanced)
@@ -14291,10 +14393,89 @@ export class BrowserController {
         }
         // Google. Account chooser: Google renders each account with a
         // stable data-identifier attribute (the account email).
-        const tile = this.page.locator("[data-identifier]").first();
-        if ((await tile.count().catch(() => 0)) > 0) {
+        const tiles = this.page.locator("[data-identifier]");
+        const expectedEmail = expectedGoogleAccountEmail?.trim().toLowerCase() ?? null;
+        const matchingTileIndexes = await tiles
+            .evaluateAll((elements, expected) => {
+            return elements.flatMap((element, index) => {
+                const html = element;
+                const rect = html.getBoundingClientRect();
+                const style = window.getComputedStyle(html);
+                const identifier = element.getAttribute("data-identifier")?.trim().toLowerCase();
+                return rect.width >= 2 &&
+                    rect.height >= 2 &&
+                    style.display !== "none" &&
+                    style.visibility !== "hidden" &&
+                    identifier !== undefined &&
+                    (expected === null || identifier === expected)
+                    ? [index]
+                    : [];
+            });
+        }, expectedEmail)
+            .catch(() => []);
+        // Without account metadata, a sole visible chooser tile is still
+        // unambiguous. Multiple accounts remain intentionally untouched.
+        if (matchingTileIndexes.length === 1) {
+            if (!hasBudget())
+                return false;
+            try {
+                await tiles.nth(matchingTileIndexes[0]).click({ timeout: boundedTimeout(1_000) });
+                return true;
+            }
+            catch {
+                // fall through to the approve-button path
+            }
+        }
+        // Google's current account chooser also renders an identity as
+        // an ordinary semantic button/link without data-identifier. Select only a
+        // visible account-shaped row carrying an email address, and exclude only
+        // account-management alternatives. Authentication state is not inferred
+        // from provider-page content; completion remains the OAuth lifecycle signal.
+        // The identity text stays inside the provider page and is never returned.
+        const accountRows = this.page.locator('button, [role="button"], [role="link"], a[href]');
+        const accountRowLabels = await accountRows
+            .evaluateAll((elements) => {
+            const EXCLUDED = /(?:\buse another account|\bremove an account|\bmanage accounts?\b)/i;
+            return elements.map((element, index) => {
+                const html = element;
+                const rect = html.getBoundingClientRect();
+                const style = window.getComputedStyle(html);
+                if (rect.width < 2 ||
+                    rect.height < 2 ||
+                    style.display === "none" ||
+                    style.visibility === "hidden") {
+                    return null;
+                }
+                const labels = [
+                    element.getAttribute("aria-label") ?? "",
+                    element.textContent ?? "",
+                    ...Array.from(element.querySelectorAll("[aria-label], *")).flatMap((descendant) => [
+                        descendant.getAttribute("aria-label") ?? "",
+                        descendant.textContent ?? "",
+                    ]),
+                ]
+                    .map((label) => label.replace(/\s+/g, " ").trim())
+                    .filter((label) => label.length > 0);
+                return labels.some((label) => EXCLUDED.test(label)) ? null : { index, labels };
+            });
+        })
+            .catch(() => []);
+        const matchingAccountRows = expectedEmail === null
+            ? []
+            : accountRowLabels.filter((candidate) => {
+                if (candidate === null)
+                    return false;
+                return candidate.labels.some((label) => {
+                    const emails = label.match(/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/gi) ?? [];
+                    return emails.some((email) => email.toLowerCase() === expectedEmail);
+                });
+            });
+        const accountRowIndex = matchingAccountRows.length === 1 ? matchingAccountRows[0].index : -1;
+        if (accountRowIndex >= 0) {
+            if (!hasBudget())
+                return false;
             try {
-                await tile.click({ timeout: 8000 });
+                await accountRows.nth(accountRowIndex).click({ timeout: boundedTimeout(1_000) });
                 return true;
             }
             catch {
@@ -14312,14 +14493,16 @@ export class BrowserController {
         const APPROVE_NAME = /^(?:continue|allow|accept|agree)\b/i;
         const approve = this.page.getByRole("button", { name: APPROVE_NAME }).first();
         try {
-            await approve.waitFor({ state: "visible", timeout: 8000 });
+            await approve.waitFor({ state: "visible", timeout: boundedTimeout(1_000) });
         }
         catch {
             // not visible within the window — fall through to the DOM-scan path
         }
         if ((await approve.count().catch(() => 0)) > 0) {
+            if (!hasBudget())
+                return false;
             try {
-                await approve.click({ timeout: 8000 });
+                await approve.click({ timeout: boundedTimeout(1_000) });
                 return true;
             }
             catch {
@@ -14331,8 +14514,12 @@ export class BrowserController {
         // <div role>/<span> or an <input type=submit value="Allow access">).
         // Click the first visible candidate whose text is an approve verb and
         // is NOT a cancel/deny/back. Log what was visible on failure.
+        if (!hasBudget())
+            return false;
         const clicked = await this.page
-            .evaluate(() => {
+            .evaluate((expiresAt) => {
+            if (Date.now() >= expiresAt)
+                return null;
             const APPROVE = /^(?:continue|allow|accept|agree)\b/i;
             const DENY = /\b(?:cancel|deny|back|no\b|not now|reject)\b/i;
             const els = Array.from(document.querySelectorAll('button, input[type="submit"], [role="button"], a[href]'));
@@ -14346,12 +14533,14 @@ export class BrowserController {
                 if (DENY.test(t))
                     continue;
                 if (APPROVE.test(t)) {
+                    if (Date.now() >= expiresAt)
+                        return null;
                     el.click();
                     return t.slice(0, 40);
                 }
             }
             return null;
-        })
+        }, deadline)
             .catch(() => null);
         if (clicked !== null)
             return true;
@@ -14431,51 +14620,6 @@ export class BrowserController {
             this.oauthProviderPageClosed = false;
         }
     }
-    // End one sequential task without tearing down Chrome. The original,
-    // handler-bound page survives; OAuth popups and any other incidental tabs are
-    // closed. about:blank replaces the task document while the persistent profile
-    // (cookies, OAuth identity, local profile data) intentionally remains intact.
-    async resetPageForReuse() {
-        if (!this.profilePoolReusable)
-            throw new Error("browser profile is not pool-reusable");
-        const context = this.context;
-        const primaryPage = this.primaryPage;
-        if (!this.isConnected() || context === null || primaryPage === null || primaryPage.isClosed()) {
-            throw new Error("warm browser page is not reusable");
-        }
-        this.page = primaryPage;
-        this.oauthProductPage = null;
-        this.oauthProviderPage = null;
-        this.oauthProviderPageClosed = false;
-        this.oauthNetLog = [];
-        this.mouseX = 100;
-        this.mouseY = 100;
-        for (const page of context.pages()) {
-            if (page !== primaryPage && !page.isClosed()) {
-                let timer;
-                try {
-                    await Promise.race([
-                        page.close(),
-                        new Promise((_, reject) => {
-                            timer = setTimeout(() => reject(new Error("timed out closing warm browser popup")), 5_000);
-                            timer.unref();
-                        }),
-                    ]);
-                }
-                finally {
-                    if (timer !== undefined)
-                        clearTimeout(timer);
-                }
-            }
-        }
-        if (context.pages().some((page) => page !== primaryPage && !page.isClosed())) {
-            throw new Error("warm browser reset left a non-primary page open");
-        }
-        await primaryPage.goto("about:blank", {
-            waitUntil: "domcontentloaded",
-            timeout: 30_000,
-        });
-    }
     async close(options = {}) {
         if (options.cancelStart === true) {
             this.startCancellationRequested = true;
@@ -14485,36 +14629,59 @@ export class BrowserController {
         this.closePromise ??= this.closeAfterStart();
         return await this.closePromise;
     }
+    async waitForCancelledStartQuiescence() {
+        if (!this.startCancellationRequested)
+            return;
+        await Promise.allSettled([
+            this.startPromise ?? Promise.resolve(),
+            this.reapCancelledStartProcess(),
+        ]);
+        await this.persistentFallbackOwnershipMonitor?.catch(() => undefined);
+    }
+    async forceCloseOwnedProcessTree() {
+        this.startCancellationRequested = true;
+        this.resolveStartCancellation?.();
+        this.resolveStartCancellation = null;
+        const marker = this.operatorBrowserMarker();
+        if (this.ownerLaunchTracked)
+            markOwnerBrowserLaunchTerminal(marker);
+        const proof = this.ownedChromeProcessTreeProof;
+        const identity = proof?.identity ?? this.currentOwnedProfileIdentity();
+        if (identity !== null) {
+            signalOwnedChromeProcessTree(identity, proof?.processGroup ?? false, "SIGKILL", {
+                ...(proof === null ? {} : { proof }),
+            });
+            reapProfileHolderIfOwned(this.profileDir, identity);
+        }
+        const closed = identity === null
+            ? this.startSettled && !this.launchedContext
+            : await this.waitForOwnedProfileExit(identity, proof);
+        if (closed && proof !== null) {
+            releaseOwnedChromeProcessTree(proof);
+            const tracked = selfManagedChromes.get(proof.identity.pid);
+            if (tracked?.proof === proof)
+                selfManagedChromes.delete(proof.identity.pid);
+            if (this.ownedChromeProcessTreeProof === proof)
+                this.ownedChromeProcessTreeProof = null;
+        }
+        const markerClosed = !this.ownerLaunchTracked || (await terminateOwnerBrowserLaunch(marker, this.profileDir));
+        if (closed && markerClosed && this.ownerLaunchTracked) {
+            untrackOwnerBrowserLaunch(marker);
+            this.ownerLaunchTracked = false;
+        }
+        await this.teardownOwnedDisplay().catch(() => undefined);
+        return closed && markerClosed ? "closed" : "unknown";
+    }
     async closeCancelledStart() {
-        if (this.persistentFallbackLaunchInFlight) {
-            await this.startPromise?.catch(() => undefined);
-        }
+        void this.reapCancelledStartProcess().catch(() => undefined);
         if (this.persistentFallbackCancellationState !== null) {
-            const closeState = this.persistentFallbackCancellationState;
-            if (closeState === "closed") {
-                const lease = this.profileOperationLease;
-                this.profileOperationLease = null;
-                lease?.release();
-            }
-            return closeState;
+            return this.persistentFallbackCancellationState;
         }
         if (!this.startLaunchCommitted) {
-            await this.closeWithProfileGuard();
-            const lease = this.profileOperationLease;
-            this.profileOperationLease = null;
-            lease?.release();
-            return "closed";
-        }
-        const [closeState] = await Promise.all([
-            this.closeWithProfileGuard(),
-            this.reapCancelledStartProcess(),
-        ]);
-        if (this.startSettled) {
-            const lease = this.profileOperationLease;
-            this.profileOperationLease = null;
-            lease?.release();
+            const closeState = await this.closeBrowser();
+            return this.startSettled ? closeState : "unknown";
         }
-        return closeState;
+        return await this.closeBrowser();
     }
     async reapCancelledStartProcess() {
         this.cancelledStartReaper ??= this.monitorCancelledStartProcess();
@@ -14524,36 +14691,107 @@ export class BrowserController {
         while (!this.startSettled) {
             const identity = this.currentOwnedProfileIdentity();
             if (identity !== null) {
-                signalProfileProcess(identity, this.profileDir, "SIGKILL");
+                this.signalCurrentSelfManagedChrome(identity, "SIGKILL");
                 reapProfileHolderIfOwned(this.profileDir, identity);
             }
             await new Promise((resolveWait) => {
-                setTimeout(resolveWait, 25);
+                const timer = setTimeout(resolveWait, 25);
+                timer.unref();
             });
         }
     }
     currentOwnedProfileIdentity() {
-        const known = this.childChromeIdentity ?? this.launchedProfileHolderIdentity;
+        const known = this.ownedChromeProcessTreeProof?.identity ??
+            this.childChromeIdentity ??
+            this.launchedProfileHolderIdentity;
         if (known !== null)
             return known;
         const holderPid = currentProfileHolderPid(this.profileDir);
-        return holderPid === null ? null : profileProcessIdentity(holderPid, this.profileDir);
+        if (holderPid === null)
+            return null;
+        const identity = profileProcessIdentity(holderPid, this.profileDir);
+        if (identity === null)
+            return null;
+        if (!this.startCancellationRequested)
+            return identity;
+        return operatorBrowserProcessMatchesMarker(identity.pid, this.operatorBrowserMarker())
+            ? identity
+            : null;
     }
     async waitForPersistentFallbackIdentity() {
-        return await resolvePersistentFallbackIdentity({ profileDir: this.profileDir });
+        if (this.ownedChromeProcessTreeProof !== null) {
+            return { state: "owned", identity: this.ownedChromeProcessTreeProof.identity };
+        }
+        const proof = await resolvePersistentFallbackIdentity({ profileDir: this.profileDir });
+        if (proof.state === "owned" &&
+            this.startCancellationRequested &&
+            !operatorBrowserProcessMatchesMarker(proof.identity.pid, this.operatorBrowserMarker())) {
+            return { state: "unknown" };
+        }
+        if (proof.state === "owned")
+            this.adoptOwnedChromeProcessTree(proof.identity, false);
+        return proof;
+    }
+    async requirePersistentFallbackOwnership(cleanupUnproven) {
+        try {
+            const proof = await this.waitForPersistentFallbackIdentity();
+            if (proof.state !== "owned" || this.ownedChromeProcessTreeProof === null) {
+                throw new Error("persistent browser launch identity could not be bound to owner custody");
+            }
+            return proof.identity;
+        }
+        catch (error) {
+            await cleanupUnproven().catch(() => undefined);
+            this.persistentFallbackLaunchInFlight = false;
+            throw error;
+        }
+    }
+    startPersistentFallbackOwnershipMonitor() {
+        if (this.persistentFallbackOwnershipMonitor !== null)
+            return;
+        this.persistentFallbackOwnershipMonitor = (async () => {
+            while (this.persistentFallbackLaunchInFlight && this.ownedChromeProcessTreeProof === null) {
+                const holderPid = currentProfileHolderPid(this.profileDir);
+                const identity = holderPid === null ? null : profileProcessIdentity(holderPid, this.profileDir);
+                const controllerOwnsIdentity = identity !== null &&
+                    (!this.startCancellationRequested ||
+                        operatorBrowserProcessMatchesMarker(identity.pid, this.operatorBrowserMarker()));
+                if (identity !== null && controllerOwnsIdentity) {
+                    this.launchedProfileHolderIdentity = identity;
+                    try {
+                        this.adoptOwnedChromeProcessTree(identity, false);
+                    }
+                    catch { }
+                    return;
+                }
+                await new Promise((resolveWait) => {
+                    const timer = setTimeout(resolveWait, PROFILE_IDENTITY_POLL_MS);
+                    timer.unref();
+                });
+            }
+        })();
     }
-    async waitForOwnedProfileExit(identity) {
+    async waitForOwnedProfileExit(identity, existingProof) {
         const deadline = Date.now() + PROFILE_IDENTITY_PROOF_TIMEOUT_MS;
-        let state = profileProcessIdentityState(identity, this.profileDir);
+        const proof = existingProof ?? captureOwnedChromeProcessTreeProof(identity, false);
+        let state = proof === null
+            ? profileProcessIdentityState(identity, this.profileDir)
+            : ownedChromeProcessTreeState(proof);
         while (state !== "stale" && Date.now() < deadline) {
-            if (profileProcessMatches(identity, this.profileDir)) {
-                signalProfileProcess(identity, this.profileDir, "SIGKILL");
+            if (proof !== null) {
+                signalOwnedChromeProcessTree(identity, false, "SIGKILL", { proof });
+            }
+            else if (profileProcessMatches(identity, this.profileDir)) {
+                signalOwnedChromeProcessTree(identity, false, "SIGKILL");
             }
             await new Promise((resolveWait) => {
                 const timer = setTimeout(resolveWait, PROFILE_IDENTITY_POLL_MS);
                 timer.unref();
             });
-            state = profileProcessIdentityState(identity, this.profileDir);
+            state =
+                proof === null
+                    ? profileProcessIdentityState(identity, this.profileDir)
+                    : ownedChromeProcessTreeState(proof);
         }
         if (state !== "stale")
             return false;
@@ -14566,31 +14804,25 @@ export class BrowserController {
         }
         if (this.startCancellationRequested)
             return await this.closeCancelledStart();
-        try {
-            return await this.closeWithProfileGuard();
-        }
-        finally {
-            const lease = this.profileOperationLease;
-            this.profileOperationLease = null;
-            lease?.release();
-        }
+        return await this.closeBrowser();
     }
-    async closeWithProfileGuard() {
+    async closeBrowser() {
         if (this.harnessAttachedPage) {
             this.page = null;
             this.primaryPage = null;
             this.oauthProductPage = null;
             this.oauthProviderPage = null;
             this.oauthProviderPageClosed = false;
-            this.oauthNetLog = [];
             this.context = null;
             return "closed";
         }
+        const marker = this.operatorBrowserMarker();
+        if (this.ownerLaunchTracked)
+            markOwnerBrowserLaunchTerminal(marker);
         // Each step is best-effort and independent: a throw closing the page
-        // or context must NOT skip the Xvfb teardown below, or the virtual
-        // display leaks (orphaned Xvfb procs pile up over a long-lived MCP
-        // server and, worse, the un-closed Chrome keeps the profile's
-        // SingletonLock held — bricking the next signup + `mcp login`).
+        // or context must NOT skip the browser reap below, or an un-closed Chrome
+        // keeps the profile's
+        // SingletonLock held — bricking the next signup + `mcp connect`).
         //
         // EVERY close call is timeout-capped. On a wedged headed Chrome (e.g. a
         // run that crashed mid-captcha-click), BOTH page.close() AND
@@ -14603,60 +14835,73 @@ export class BrowserController {
         const context = this.context;
         const cdpBrowser = this.cdpBrowser;
         const childIdentity = this.childChromeIdentity;
+        const childChromeProcessGroup = this.childChromeProcessGroup;
         const holderIdentity = this.launchedProfileHolderIdentity ?? this.currentOwnedProfileIdentity();
-        const identity = childIdentity ?? holderIdentity;
+        const identity = this.ownedChromeProcessTreeProof?.identity ?? childIdentity ?? holderIdentity;
+        const treeProof = identity === null
+            ? null
+            : (this.ownedChromeProcessTreeProof ??
+                this.adoptOwnedChromeProcessTree(identity, childIdentity !== null ? childChromeProcessGroup : false));
         this.page = null;
         this.primaryPage = null;
         this.oauthProductPage = null;
         this.oauthProviderPage = null;
         this.oauthProviderPageClosed = false;
-        this.oauthNetLog = [];
         this.context = null;
         this.cdpBrowser = null;
         this.childChrome = null;
         this.childChromeIdentity = null;
+        this.childChromeProcessGroup = false;
         this.launchedContext = false;
         this.launchedProfileHolderIdentity = null;
         const closeState = await closeProfileWithProof({
             profileDir: this.profileDir,
             identity,
             close: async () => {
+                if (identity !== null) {
+                    signalOwnedChromeProcessTree(identity, treeProof?.processGroup ?? (childIdentity !== null ? childChromeProcessGroup : false), "SIGTERM", { ...(treeProof === null ? {} : { proof: treeProof }) });
+                }
+                // A process-tree SIGTERM can close the CDP target before Playwright
+                // observes it. That is successful teardown, not a reason to skip the
+                // proof/reap path or retain a cleanly closed ephemeral profile.
                 if (page !== null)
-                    await page.close();
+                    await page.close().catch(() => undefined);
                 if (context !== null)
-                    await context.close();
+                    await context.close().catch(() => undefined);
                 if (cdpBrowser !== null)
-                    await cdpBrowser.close();
-                if (childIdentity !== null) {
-                    signalProfileProcess(childIdentity, this.profileDir, "SIGTERM");
-                }
+                    await cdpBrowser.close().catch(() => undefined);
             },
             forceClose: () => {
-                if (identity !== null)
-                    signalProfileProcess(identity, this.profileDir, "SIGKILL");
+                if (identity !== null) {
+                    signalOwnedChromeProcessTree(identity, treeProof?.processGroup ?? (childIdentity !== null ? childChromeProcessGroup : false), "SIGKILL", { ...(treeProof === null ? {} : { proof: treeProof }) });
+                }
                 reapProfileHolderIfOwned(this.profileDir, identity);
             },
+            ...(treeProof === null
+                ? {}
+                : { identityState: () => ownedChromeProcessTreeState(treeProof) }),
         });
         // Self-launch path: disconnect the CDP browser and SIGKILL the Chrome we
         // spawned. context.close() on a connectOverCDP context only disconnects —
         // it does NOT necessarily exit the browser process, which would leak the
         // SingletonLock and brick the next run (the reap below is the backstop, but
         // killing our own child directly is cleaner and faster).
-        if (childIdentity !== null)
-            selfManagedChromes.delete(childIdentity.pid);
-        // F13 — release the on-demand Xvfb if we spawned one. Order
-        // matters: kill Chrome (context.close) first so it has its
-        // display until it exits, THEN kill Xvfb.
-        if (this.xvfb !== null) {
-            try {
-                this.xvfb.stop();
-            }
-            catch {
-                /* best-effort */
-            }
-            this.xvfb = null;
-        }
-        return closeState;
+        if (treeProof !== null && ownedChromeProcessTreeState(treeProof) === "stale") {
+            releaseOwnedChromeProcessTree(treeProof);
+            const tracked = selfManagedChromes.get(treeProof.identity.pid);
+            if (tracked?.proof === treeProof)
+                selfManagedChromes.delete(treeProof.identity.pid);
+            if (this.ownedChromeProcessTreeProof === treeProof) {
+                this.ownedChromeProcessTreeProof = null;
+            }
+        }
+        const markerClosed = !this.ownerLaunchTracked || (await terminateOwnerBrowserLaunch(marker, this.profileDir));
+        if (markerClosed && this.ownerLaunchTracked) {
+            untrackOwnerBrowserLaunch(marker);
+            this.ownerLaunchTracked = false;
+        }
+        await this.teardownOwnedDisplay().catch(() => undefined);
+        return closeState === "closed" && !markerClosed ? "force_closed_unproven" : closeState;
     }
 }
 // Random integer in [min, max]. We use Math.random() (not crypto)