@trusty-squire/mcp 1.1.13-rc.9 → 1.1.13

package/dist/bot/provision-session.js

@@ -15,25 +15,22 @@
 //    not navigation the agent chose, so they are never blocked.
 //  - no credential is ever read back to the agent except via the explicit
 //    `finish`/extract path; the vault stays write-only.
-import { createHash, randomInt, randomUUID } from "node:crypto";
+import { createHash, createHmac, randomInt } from "node:crypto";
 import { Buffer } from "node:buffer";
 import { chmodSync, mkdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { BrowserController, CHECKOUT_SUBMIT_LABEL_RE, clickDispatchStatusForError, parseCheckoutAmount, } from "./browser.js";
+import { CHECKOUT_SUBMIT_LABEL_RE, clickDispatchStatusForError, parseCheckoutAmount, } from "./browser.js";
 import { TwoCaptchaSolver } from "./captcha-solver-2captcha.js";
+import { buildSafeControlsV2, checkoutStageFromUrlV2, compactV2LegacyRefForHandle, compactV2PayloadWithinBudget, COMPACT_V2_HANDLE_LENGTH, isCompactV2Handle, isCompactV2Label, controlMatchesPrivateQueryV2, diffSafeControlsV2, equalSafePageSemanticsV2, encodeV2Delta, encodeV2Page, compactV2AuditHost, compactV2AuditUrl, compactV2AuditValue, recordableTokenV2, safeDescriptionV2, safeOriginV2, safePageSemanticsV2, sealRetainedInteractiveElementsV2, safeStageV2, } from "./compact-observation-v2.js";
+import { elementFingerprints } from "./element-fingerprint.js";
 import { extractApiKeyFromText, isTruncatedCapture } from "./credential-text.js";
 import { pickVerificationLink } from "./email-verification.js";
-import { acquireOperatorProfile, OperatorProfileAcquisitionInterruptedError, } from "./operator-profile-pool.js";
-import { acquireDirectIdentityProfile, OperatorDirectIdentityAcquisitionInterruptedError, } from "./operator-direct-identity.js";
-import { loginSessionGuidance } from "./skill-hint.js";
 import { checkSuccessSignal, bindKnownEmailTemplate, bindRecipePostcondition, bindRecipeTarget, bindRecipeValue, cssEscapeRecipeValue, fillTemplate, hasRecipeTargetCandidate, isSingleUseUrl, isCheckoutShapeKey, isSameRecipeDomain, knownRecipeInputValue, localeStableFieldRole, operatorRecipeDomain, operatorRecipeKeyForDomain, canonicalVerb, extractActionPath, checkoutFieldSetSignature, checkoutShapeKey, readRecipe, resolveRecipeFieldTarget, resolveRecipeTarget, verifyFilledFieldValues, writeRecipe, } from "./operator-recipe.js";
 import { captureOnboardingRound, currentRunId, resetCaptureChain, resolveCaptureDir, } from "./onboarding-capture.js";
 import { promoteToSkill, pickRowDisambiguator, pickStableDomHint, pickHrefHint, } from "./promote-to-skill.js";
 import { serviceSlugFromHost } from "@trusty-squire/skill-schema";
-import { looksLikeCodeIdentifier, looksLikeCredentialValue, isCredentialNoise, findCredentialTokens, keyFamilyPrefix, pickRelaxedNearCopyCredential, } from "./credential-shape.js";
+import { looksLikeCodeIdentifier, isCredentialNoise, findCredentialTokens, findOtpCredential, keyFamilyPrefix, pickRelaxedNearCopyCredential, } from "./credential-shape.js";
 import { initialExtractionState, accumulateCandidate, hasFullHit, resolveExtraction, } from "./extraction.js";
-import { OperatorBrowserWatchdog, } from "./operator-browser-watchdog.js";
 // Identity-provider + auth-handler hosts a signup legitimately bounces
 // through. Used to widen domain-scope so an OAuth `goto` (rare) isn't blocked.
 // Organic redirects are already exempt (scope only gates explicit goto).
@@ -43,299 +40,81 @@ const DEFAULT_AUTH_HOSTS = [
     "login.microsoftonline.com",
     "appleid.apple.com",
 ];
-// Plain host list for the pieces that only need the names (goto gate, audit,
-// observed-hosts). The source metadata stays on the Session.
-function hostStrings(session) {
-    return session.allowedHosts.map((e) => e.host);
-}
-// Hosts that may seed credential EGRESS (where a stored key is later sent by
-// the proxy): start + auto_widen, never mid_session task scope — a wide operate
-// scope must not silently over-grant a key's egress allow-list (Codex). The
-// vault unions these with the service-default + any agent-declared egress_hosts.
-function egressSeedHosts(session) {
-    return session.allowedHosts.filter((e) => e.source !== "mid_session").map((e) => e.host);
-}
-function merchantSiblingSeedHosts(session) {
-    return session.allowedHosts.filter((e) => e.source !== "mid_session").map((e) => e.host);
-}
-const sessions = new Map();
-// The pool and canonical-profile guard are authoritative for their respective
-// cross-process capacity. These maps only retain the local controller/lease
-// pairing needed for lifecycle cleanup; they deliberately do not impose a
-// process-global single-session gate.
-const leasedBrowsers = new Map();
-const startingBrowsers = new Set();
-const capacityWaiters = new Set();
-let shutdownGeneration = 0;
-const START_CAPACITY_WAIT_MS = 30_000;
-const START_CAPACITY_RETRY_MS = 50;
-function isOperatorCapacityError(error) {
-    return error instanceof Error && error.message.startsWith("operate_start capacity reached:");
-}
-async function acquireOperatorProfileBounded(opts, sessionId, generation) {
-    let wake = () => undefined;
-    let resolveSettled = () => undefined;
-    const waiter = {
-        generation,
-        cancelRequested: false,
-        abortController: new AbortController(),
-        wake: () => wake(),
-        settled: new Promise((resolve) => {
-            resolveSettled = resolve;
-        }),
-        resolveSettled: () => resolveSettled(),
-    };
-    capacityWaiters.add(waiter);
-    const deadline = Date.now() + START_CAPACITY_WAIT_MS;
-    try {
-        for (;;) {
-            if (waiter.cancelRequested || waiter.generation !== shutdownGeneration) {
-                throw new Error("operate_start cancelled: operator server is shutting down");
-            }
-            try {
-                const lease = await acquireOperatorProfile(sessionId, {
-                    ...(opts.profileDir !== undefined ? { sourceProfileDir: opts.profileDir } : {}),
-                    deadline,
-                    signal: waiter.abortController.signal,
-                });
-                if (waiter.cancelRequested || waiter.generation !== shutdownGeneration) {
-                    await lease.destroy();
-                    throw new Error("operate_start cancelled: operator server is shutting down");
-                }
-                return lease;
-            }
-            catch (error) {
-                if (waiter.cancelRequested || waiter.generation !== shutdownGeneration) {
-                    throw new Error("operate_start cancelled: operator server is shutting down");
-                }
-                if (error instanceof OperatorProfileAcquisitionInterruptedError &&
-                    error.reason === "cancelled") {
-                    throw new Error("operate_start cancelled: operator server is shutting down");
-                }
-                if (error instanceof OperatorProfileAcquisitionInterruptedError &&
-                    error.reason === "timeout") {
-                    if (error.phase === "seed_lock") {
-                        throw new Error("operate_start failed: start deadline exceeded while waiting to acquire the shared seed lock");
-                    }
-                    throw new Error("operate_start failed: start deadline exceeded while acquiring an isolated operator profile");
-                }
-                if (isOperatorCapacityError(error) && Date.now() >= deadline) {
-                    throw new Error("operate_start capacity wait timed out: 2 operator sessions are active; finish one and retry");
-                }
-                if (!isOperatorCapacityError(error)) {
-                    throw error;
-                }
-                await new Promise((resolve) => {
-                    wake = resolve;
-                    const timer = setTimeout(resolve, START_CAPACITY_RETRY_MS);
-                    waiter.wake = () => {
-                        clearTimeout(timer);
-                        resolve();
-                    };
-                });
-            }
-        }
-    }
-    finally {
-        capacityWaiters.delete(waiter);
-        waiter.resolveSettled();
-    }
-}
-// The Google-authenticated counterpart of acquireOperatorProfileBounded — see
-// operator-direct-identity.ts. Registers the same CapacityWaiter shape so
-// closeAllProvisionSessions cancels an in-flight acquisition uniformly,
-// but the underlying resource is the single canonical profile, not a
-// two-slot pool: acquireDirectIdentityProfile already polls/blocks
-// internally, so there is no outer capacity-retry loop to drive here.
-async function acquireDirectIdentityProfileBounded(opts, generation) {
-    const waiter = {
-        generation,
-        cancelRequested: false,
-        abortController: new AbortController(),
-        wake: () => undefined,
-        settled: Promise.resolve(),
-        resolveSettled: () => undefined,
-    };
-    let resolveSettled = () => undefined;
-    waiter.settled = new Promise((resolve) => {
-        resolveSettled = resolve;
-    });
-    waiter.resolveSettled = () => resolveSettled();
-    capacityWaiters.add(waiter);
-    try {
-        if (waiter.cancelRequested || waiter.generation !== shutdownGeneration) {
-            throw new Error("operate_start cancelled: operator server is shutting down");
-        }
-        try {
-            return await acquireDirectIdentityProfile({
-                ...(opts.profileDir !== undefined ? { profileDir: opts.profileDir } : {}),
-                deadline: Date.now() + START_CAPACITY_WAIT_MS,
-                signal: waiter.abortController.signal,
-            });
-        }
-        catch (error) {
-            if (waiter.cancelRequested || waiter.generation !== shutdownGeneration) {
-                throw new Error("operate_start cancelled: operator server is shutting down");
-            }
-            if (error instanceof OperatorDirectIdentityAcquisitionInterruptedError) {
-                throw error.reason === "cancelled"
-                    ? new Error("operate_start cancelled: operator server is shutting down")
-                    : new Error("operate_start capacity reached: the Google-identity operator profile is in " +
-                        "use by another session; finish it and retry");
-            }
-            throw error;
-        }
-    }
-    finally {
-        capacityWaiters.delete(waiter);
-        waiter.resolveSettled();
-    }
-}
-async function acquireWarmBrowser(opts, sessionId) {
-    if ((process.env.BOT_CDP_ENDPOINT ?? "").trim().length > 0) {
-        throw new Error("operate_start does not support remote CDP with isolated profile leases");
-    }
-    const generation = shutdownGeneration;
-    const lease = opts.requireLiveIdentity === true
-        ? await acquireDirectIdentityProfileBounded(opts, generation)
-        : await acquireOperatorProfileBounded(opts, sessionId, generation);
-    if (generation !== shutdownGeneration) {
-        await lease.destroy();
-        throw new Error("operate_start cancelled: operator server is shutting down");
-    }
-    const controller = new BrowserController({
-        profileDir: lease.profileDir,
-        ...("takeProfileOperationLease" in lease
-            ? { profileOperationLease: lease.takeProfileOperationLease() }
-            : {}),
-        ...(opts.proxyUrl !== undefined ? { proxyUrl: opts.proxyUrl } : {}),
-    });
-    const pending = {
-        controller,
-        lease,
-        launch: Promise.resolve(),
-        cancelRequested: false,
-        cleanupPromise: null,
+import { egressSeedHosts, hostStrings, registrableHost, serviceLoginRouteHosts, } from "./session/hosts.js";
+// Phase 2 — the lifecycle registry transaction moved to session/lifecycle.ts as
+// one unit (registry, real-profile lease, call leases and drains, watchdog,
+// bounded close, terminal owner, artifact cleanup, start/finish/shutdown).
+// Everything it owns is re-exported below, so no caller import changed.
+import { activeSessionCount, audit, closeAllProvisionSessions, finishProvisionSession, finishProvisionSessionWithPreparation, googleSessionGate, observeSnapshotDir, paymentSession, sessionForCall, startProvisionSession as startProvisionSessionInternal, startHarnessProvisionSession as startHarnessProvisionSessionInternal, withPaymentSessionCall, withProvisionSessionCall, } from "./session/lifecycle.js";
+export { activeSessionCount, closeAllProvisionSessions, finishProvisionSession, finishProvisionSessionWithPreparation, googleSessionGate, paymentSession, withPaymentSessionCall, withProvisionSessionCall, };
+let oauthActionLeaseTail = Promise.resolve();
+const DEFAULT_OAUTH_LOGIN_LEASE_COOLDOWN_MS = 3_000;
+const DEFAULT_OAUTH_ACTION_TIMEOUT_MS = 30_000;
+function oauthActionTimeoutMs() {
+    const configured = Number(process.env.TRUSTY_SQUIRE_OAUTH_ACTION_TIMEOUT_MS);
+    return Number.isFinite(configured) && configured > 0
+        ? Math.min(configured, DEFAULT_OAUTH_ACTION_TIMEOUT_MS)
+        : DEFAULT_OAUTH_ACTION_TIMEOUT_MS;
+}
+function oauthActionDeadline(provider) {
+    const timeoutMs = oauthActionTimeoutMs();
+    return {
+        expiresAt: Date.now() + timeoutMs,
+        timeoutMs,
+        provider,
+        timedOut: false,
+        inFlight: new Set(),
     };
-    pending.launch = startBrowserBounded(controller, sessionId, async () => {
-        await cancelStartingBrowser(pending);
-    });
-    startingBrowsers.add(pending);
-    try {
-        await pending.launch;
-        if (pending.cancelRequested) {
-            throw new Error("operate_start cancelled: operator server is shutting down");
-        }
-        // Several unit harnesses replace BrowserController with the narrow legacy
-        // shape. Production controllers always expose identity; a harness without
-        // a real process simply leaves the descriptor worker-less.
-        if (typeof controller.operatorWorkerIdentity === "function") {
-            const worker = controller.operatorWorkerIdentity();
-            if (worker !== null)
-                lease.bindWorker(worker);
-        }
-    }
-    catch (err) {
-        if (!pending.cancelRequested) {
-            await closeLeasedBrowser(controller, lease, false);
-        }
-        throw err;
-    }
-    finally {
-        startingBrowsers.delete(pending);
-    }
-    leasedBrowsers.set(controller, { controller, lease });
-    return { controller, profileDir: lease.profileDir };
 }
-async function releaseWarmBrowserPage(browser, reusable) {
-    const slot = leasedBrowsers.get(browser);
-    if (slot === undefined) {
-        await browser.close().catch(() => undefined);
-        return;
-    }
-    try {
-        if (reusable)
-            await browser.resetPageForReuse();
-        await closeLeasedBrowser(browser, slot.lease, reusable);
-    }
-    catch {
-        await closeLeasedBrowser(browser, slot.lease, false);
-    }
-    if (leasedBrowsers.get(browser) === slot)
-        leasedBrowsers.delete(browser);
+function oauthActionRemainingMs(deadline) {
+    return Math.max(0, deadline.expiresAt - Date.now());
 }
-async function forceReleaseWarmBrowserPage(browser) {
-    const slot = leasedBrowsers.get(browser);
-    const closeState = await closeBrowserBounded(browser, false, "operator browser force-close timed out");
-    if (slot === undefined)
-        return;
-    if (closeState === "closed")
-        await slot.lease.destroy();
-    else
-        await slot.lease.retain(true);
-    if (leasedBrowsers.get(browser) === slot)
-        leasedBrowsers.delete(browser);
-}
-async function closeBrowserBounded(browser, cancelStart, timeoutMessage) {
-    const forceClose = browser.forceCloseOwnedProcessTree;
-    const ordinaryClose = browser
-        .close(cancelStart ? { cancelStart: true } : undefined)
-        .catch(() => "unknown");
-    const forcedClose = forceClose === undefined
-        ? ordinaryClose
-        : forceClose.call(browser).catch(() => "unknown");
-    const closed = Promise.race([
-        ordinaryClose.then((state) => (state === "closed" ? state : forcedClose)),
-        forcedClose.then((state) => (state === "closed" ? state : ordinaryClose)),
-    ]);
-    return await withTerminalTimeout(closed, positiveTimeout("TRUSTY_SQUIRE_OPERATOR_FORCE_CLOSE_TIMEOUT_MS", DEFAULT_OPERATOR_FORCE_CLOSE_TIMEOUT_MS), timeoutMessage).catch(() => "unknown");
-}
-async function cancelStartingBrowser(pending) {
-    pending.cancelRequested = true;
-    if (pending.cleanupPromise !== null)
-        return await pending.cleanupPromise;
-    pending.cleanupPromise = (async () => {
-        const closeState = await closeBrowserBounded(pending.controller, true, "operator browser startup cancellation timed out");
-        if (closeState === "closed")
-            await pending.lease.destroy();
-        else
-            await pending.lease.retain(true);
-    })();
-    return await pending.cleanupPromise;
-}
-async function closeLeasedBrowser(browser, lease, reusable) {
-    const closeState = await browser.close().catch(() => "unknown");
-    if (closeState !== "closed") {
-        await lease.retain(!reusable);
+function trackOAuthActionPromise(deadline, promise) {
+    deadline.inFlight.add(promise);
+    void promise.then(() => deadline.inFlight.delete(promise), () => deadline.inFlight.delete(promise));
+    return promise;
+}
+function expireOAuthAction(deadline) {
+    if (deadline.timedOut)
         return;
+    deadline.timedOut = true;
+}
+async function waitForOAuthActionQuiescence(deadline) {
+    for (;;) {
+        const pending = [...deadline.inFlight];
+        if (pending.length === 0) {
+            await Promise.resolve();
+            if (deadline.inFlight.size === 0)
+                return;
+            continue;
+        }
+        await Promise.allSettled(pending);
     }
-    if (reusable)
-        await lease.returnWarm(closeState);
-    else
-        await lease.destroy();
-}
-function stopSessionWatchdog(session) {
-    session.watchdog?.stop();
 }
-function disposeSessionWatchdog(session) {
-    session.watchdog?.dispose();
-    session.watchdog = null;
-}
-const DEFAULT_SESSION_TERMINAL_DRAIN_TIMEOUT_MS = 5_000;
-const DEFAULT_PENDING_THREE_DS_FINALIZE_TIMEOUT_MS = 3_000;
-const DEFAULT_SESSION_TERMINAL_TRANSITION_TIMEOUT_MS = 30_000;
-const DEFAULT_OPERATOR_FORCE_CLOSE_TIMEOUT_MS = 3_000;
-function positiveTimeout(name, fallback) {
-    const value = Number(process.env[name]);
-    return Number.isFinite(value) && value > 0 ? value : fallback;
+function oauthActionDeadlineError(deadline) {
+    if (deadline.provider === undefined || deadline.provider === "google") {
+        return Object.assign(new Error(`google_session: OAuth did not complete within ${Math.ceil(deadline.timeoutMs / 1000)} seconds; ` +
+            "the saved session may have expired, so reconnect with " +
+            "`npx @trusty-squire/mcp connect --force-relogin=google` before retrying"), { code: "google_session" });
+    }
+    return new Error(`OAuth action did not complete within ${Math.ceil(deadline.timeoutMs / 1000)} seconds`);
 }
-async function withTerminalTimeout(promise, timeoutMs, message) {
+async function withinOAuthActionDeadline(promise, deadline) {
+    const tracked = trackOAuthActionPromise(deadline, promise);
+    const remainingMs = oauthActionRemainingMs(deadline);
+    if (remainingMs <= 0 || deadline.timedOut) {
+        expireOAuthAction(deadline);
+        throw oauthActionDeadlineError(deadline);
+    }
     let timer;
     try {
         return await Promise.race([
-            promise,
-            new Promise((_, reject) => {
-                timer = setTimeout(() => reject(new Error(message)), timeoutMs);
+            tracked,
+            new Promise((_resolve, reject) => {
+                timer = setTimeout(() => {
+                    expireOAuthAction(deadline);
+                    reject(oauthActionDeadlineError(deadline));
+                }, remainingMs);
             }),
         ]);
     }
@@ -344,277 +123,103 @@ async function withTerminalTimeout(promise, timeoutMs, message) {
             clearTimeout(timer);
     }
 }
-async function forceTerminateProvisionSession(session, event, detail, auditPendingThreeDs = true) {
-    session.paymentDispatchClosed = true;
-    const owner = session.terminalTeardownOwner ??
-        (session.terminalTeardownOwner = {
-            forced: false,
-            forcePromise: null,
-            routinePromise: null,
-        });
-    if (owner.forcePromise !== null)
-        return await owner.forcePromise;
-    owner.forced = true;
-    owner.forcePromise = forceTerminateProvisionSessionOwned(session, event, detail, auditPendingThreeDs);
-    return await owner.forcePromise;
-}
-async function forceTerminateProvisionSessionOwned(session, event, detail, auditPendingThreeDs) {
-    session.closing = true;
-    stopSessionWatchdog(session);
-    audit(session.id, event, detail);
-    const handoff = session.paymentDispatchHandoff;
-    if (handoff !== null) {
-        handoff.terminalizing = true;
-        const timeoutMs = positiveTimeout("TRUSTY_SQUIRE_OPERATOR_PENDING_3DS_FINALIZE_TIMEOUT_MS", DEFAULT_PENDING_THREE_DS_FINALIZE_TIMEOUT_MS);
-        await withTerminalTimeout(handoff.settled, timeoutMs, `payment dispatch handoff exceeded ${timeoutMs}ms`).catch(() => undefined);
-    }
-    if (sessions.get(session.id) === session)
-        sessions.delete(session.id);
-    let terminalError;
-    if (auditPendingThreeDs && session.pendingThreeDs !== null) {
-        try {
-            await auditPendingThreeDsForSessionCloseBounded(session);
-        }
-        catch (error) {
-            terminalError = error;
-            const message = error instanceof Error ? error.message : String(error);
-            process.stderr.write(`[operator] terminal 3DS audit failed session=${session.id}: ${message}\n`);
-        }
-    }
-    if (handoff !== null) {
-        handoff.terminalComplete = true;
-        if (handoff.released && session.paymentDispatchHandoff === handoff) {
-            session.paymentDispatchHandoff = null;
-        }
-    }
-    session.activePayment = null;
-    session.paymentFieldSealActive = false;
-    session.pendingThreeDs = null;
-    await forceReleaseWarmBrowserPage(session.browser).catch((error) => {
-        if (terminalError === undefined)
-            terminalError = error;
-        const message = error instanceof Error ? error.message : String(error);
-        process.stderr.write(`[operator] terminal browser close failed session=${session.id}: ${message}\n`);
-    });
-    disposeSessionWatchdog(session);
-    return terminalError;
-}
-async function terminateExpiredProvisionSession(session, reason) {
-    const owner = session.terminalTeardownOwner ??
-        (session.terminalTeardownOwner = {
-            forced: false,
-            forcePromise: null,
-            routinePromise: null,
-        });
-    if (owner.routinePromise !== null)
-        return await owner.routinePromise;
-    session.closing = true;
-    stopSessionWatchdog(session);
-    owner.routinePromise = (async () => {
-        if (reason.kind !== "idle_timeout" && session.paymentCallCount > 0) {
-            const timeoutMs = positiveTimeout("TRUSTY_SQUIRE_OPERATOR_TERMINAL_TRANSITION_TIMEOUT_MS", DEFAULT_SESSION_TERMINAL_TRANSITION_TIMEOUT_MS);
-            await withTerminalTimeout(waitForPaymentCallsToDrain(session), timeoutMs, `payment call drain exceeded ${timeoutMs}ms`).catch(() => undefined);
-        }
-        if (owner.forcePromise !== null) {
-            await owner.forcePromise;
-            return;
-        }
-        await forceTerminateProvisionSession(session, "browser_watchdog_terminate", { ...reason });
-    })();
-    await owner.routinePromise;
-}
-function startSessionWatchdog(session) {
-    if (session.watchdog !== null) {
-        session.watchdog.start();
-        return;
-    }
-    const browser = session.browser;
-    const watchdog = new OperatorBrowserWatchdog({
-        startedAt: session.startedAt,
-        lastActivityAt: () => session.lastActivityAt,
-        hasActiveCall: () => session.callCount > 0,
-        processMarker: () => browser.operatorBrowserMarker?.() ?? null,
-        onTerminate: async (reason) => await terminateExpiredProvisionSession(session, reason),
-    });
-    session.watchdog = watchdog;
-    watchdog.start();
-}
-function sessionForCall(sessionId) {
-    return sessions.get(sessionId);
-}
-// Money rule (simplified 2026-08-16): the fence is the live human biometric
-// approval per charge, not a software re-check of replay field values. The
-// only surviving invariant — a card-charging trace step is never blind-
-// replayed — is enforced unconditionally where operate_pay steps are
-// encountered during replay (see replayOperatorRecipe), not here.
-function assertPaymentSessionAllowed(session) {
-    if (session.closing) {
-        throw new Error(`provision session ${session.id} is closing`);
-    }
-}
-// Resolve the compatibility omission once, at tool entry.  In particular, do
-// not repeat this lookup in completion callbacks: after an await, a different
-// session could otherwise become the sole process-local session.
-export function paymentSession(sessionId) {
-    let session;
-    if (sessionId !== undefined) {
-        session = sessionForCall(sessionId);
-        if (session === undefined)
-            throw new Error(`unknown provision session ${sessionId}`);
-    }
-    else {
-        if (sessions.size !== 1) {
-            throw new Error(sessions.size === 0
-                ? "operate_pay requires one active operate_start browser session"
-                : "operate_pay requires session_id when multiple operator sessions are active");
-        }
-        session = sessions.values().next().value;
-    }
-    assertPaymentSessionAllowed(session);
-    return session;
-}
-function acquireSessionCallLease(session) {
-    if (session.closing)
-        throw new Error(`provision session ${session.id} is closing`);
-    session.lastActivityAt = Date.now();
-    session.callCount += 1;
-    let released = false;
-    return () => {
-        if (released)
-            return;
-        released = true;
-        session.callCount -= 1;
-        if (session.callCount === 0) {
-            session.lastActivityAt = Date.now();
-            for (const wake of session.callDrainWaiters)
-                wake();
-            session.callDrainWaiters.clear();
-        }
-    };
-}
-function acquirePaymentCallLease(session) {
-    session.paymentCallCount += 1;
-    let released = false;
-    return () => {
-        if (released)
-            return;
-        released = true;
-        session.paymentCallCount -= 1;
-        if (session.paymentCallCount === 0) {
-            for (const wake of session.paymentCallDrainWaiters)
-                wake();
-            session.paymentCallDrainWaiters.clear();
-        }
-    };
+function oauthLoginLeaseCooldownMs() {
+    const configured = Number(process.env.TRUSTY_SQUIRE_OAUTH_LOGIN_COOLDOWN_MS);
+    return Number.isFinite(configured) && configured >= 0
+        ? Math.min(configured, 60_000)
+        : DEFAULT_OAUTH_LOGIN_LEASE_COOLDOWN_MS;
 }
-async function waitForPaymentCallsToDrain(session) {
-    if (session.paymentCallCount === 0)
+async function waitForOAuthLeaseCooldown(cooldownMs) {
+    if (cooldownMs <= 0)
         return;
     await new Promise((resolve) => {
-        session.paymentCallDrainWaiters.add(resolve);
+        const timer = setTimeout(resolve, cooldownMs);
+        timer.unref();
     });
 }
-async function waitForSessionCallsToDrain(session) {
-    if (session.callCount === 0)
-        return true;
-    const timeoutMs = positiveTimeout("TRUSTY_SQUIRE_OPERATOR_TERMINAL_DRAIN_TIMEOUT_MS", DEFAULT_SESSION_TERMINAL_DRAIN_TIMEOUT_MS);
-    let timer;
-    let wake;
-    try {
-        return await Promise.race([
-            new Promise((resolve) => {
-                wake = () => resolve(true);
-                session.callDrainWaiters.add(wake);
-            }),
-            new Promise((resolve) => {
-                timer = setTimeout(() => resolve(false), timeoutMs);
-            }),
-        ]);
-    }
-    finally {
-        if (timer !== undefined)
-            clearTimeout(timer);
-        if (wake !== undefined)
-            session.callDrainWaiters.delete(wake);
-    }
-}
-async function withSelectedProvisionSessionCall(session, fn) {
-    const release = acquireSessionCallLease(session);
+async function withOAuthActionLease(deadline, run, releaseCooldownMs = 0) {
+    let release;
+    const previous = oauthActionLeaseTail;
+    const turn = new Promise((resolve) => {
+        release = resolve;
+    });
+    oauthActionLeaseTail = previous.then(() => turn);
+    let acquired = false;
     try {
-        return await fn(session);
+        if (deadline === undefined)
+            await previous;
+        else
+            await withinOAuthActionDeadline(previous, deadline);
+        acquired = true;
+        return await run();
     }
     finally {
-        release();
-    }
-}
-export async function withProvisionSessionCall(sessionId, fn) {
-    const session = sessionForCall(sessionId);
-    if (session === undefined)
-        throw new Error(`unknown provision session ${sessionId}`);
-    return await withSelectedProvisionSessionCall(session, fn);
-}
-export async function withPaymentSessionCall(sessionId, fn) {
-    const session = paymentSession(sessionId);
-    return await withSelectedProvisionSessionCall(session, async (selectedSession) => {
-        const releasePaymentCall = acquirePaymentCallLease(selectedSession);
-        try {
-            return await fn(selectedSession);
+        if (deadline === undefined) {
+            release();
         }
-        finally {
-            releasePaymentCall();
+        else if (!acquired) {
+            void previous.then(release, release);
         }
-    });
+        else {
+            void waitForOAuthActionQuiescence(deadline)
+                .then(() => waitForOAuthLeaseCooldown(releaseCooldownMs))
+                .then(release, release);
+        }
+    }
+}
+async function withOAuthActionBoundary(session, provider, run) {
+    const deadline = oauthActionDeadline(provider);
+    const releaseCooldownMs = oauthLoginLeaseCooldownMs();
+    // A deadline expiry must NOT terminalize the session: the in-flight OAuth
+    // operation is budget-bounded (loginWithOAuth races its own completion
+    // window), so unwinding needs no teardown. Force-closing here used to
+    // deregister a healthy session mid-handoff, leaving the pending
+    // chooser/consent screen unreachable — observe/screenshot/oauth_settle all
+    // returned "unknown provision session" and the only recovery was a fresh
+    // session that lost all progress. The timeout surfaces as a recoverable
+    // error while the session, browser, and page stay valid for inspection and
+    // a settle/retry. Serialization custody is unchanged: the lease below still
+    // drains the in-flight work (plus the cooldown) before the next OAuth
+    // action acquires it, and a genuinely dead browser still surfaces as
+    // unavailable through its own close paths.
+    return await withOAuthActionLease(deadline, async () => {
+        return await withinOAuthActionDeadline(run(deadline), deadline);
+    }, releaseCooldownMs);
+}
+async function runSerializedGoogleIdentityOperation(session, operation, options = {}) {
+    const browser = session.browser;
+    const result = options.deadline === undefined
+        ? await operation(browser)
+        : await withinOAuthActionDeadline(operation(browser), options.deadline);
+    return { browser, result };
+}
+async function runDetachedGoogleIdentityOperation(session, operation) {
+    return await withOAuthActionLease(undefined, async () => (await runSerializedGoogleIdentityOperation(session, operation)).result);
+}
+async function runSerializedOAuthBoundary(session, authorizedElement, authorizedElements, provider, deadline) {
+    const authorizedRef = provisionElementRefs(authorizedElements).get(authorizedElement);
+    if (authorizedRef === undefined) {
+        throw new Error("OAuth action target was not present in the authorized action map");
+    }
+    const expectedGoogleAccountEmail = session.userEmail ?? undefined;
+    const completed = await runSerializedGoogleIdentityOperation(session, async (browser) => {
+        // The action was authorized against the session's isolated browser before
+        // the canonical profile was opened. Re-extract inside the same serialized
+        // operation and require the identical structural element identity before
+        // clicking; this keeps stale-handle protection without letting a prepared
+        // canonical browser escape the boundary on reobserve_required.
+        const fresh = await browser.extractInteractiveElements();
+        retainSessionElements(session, fresh);
+        const resolved = resolveTarget(fresh, authorizedRef);
+        if (resolved === null) {
+            throw new Error("OAuth action target changed during the identity handoff; re-observe before retrying");
+        }
+        await browser.loginWithOAuth(resolved.selector, oauthActionRemainingMs(deadline), provider, provider === "github" ? undefined : expectedGoogleAccountEmail);
+        await settleAfterStateChange(browser);
+    }, { deadline });
+    return completed.browser;
 }
 const settle = (ms) => new Promise((r) => setTimeout(r, ms));
-// Audit trail (security posture): every session action emits one structured
-// stderr line the host's MCP log captures. The `provision-audit` marker makes
-// the trail greppable. No credential VALUES are ever logged — only the action
-// shape + url.
-function audit(sessionId, event, detail = {}) {
-    process.stderr.write(`${JSON.stringify({ marker: "provision-audit", surface: "operate", session_id: sessionId, event, ...detail })}\n`);
-}
-// operate_start's browser launch is the one UNBOUNDED step in the session
-// bootstrap: on a fresh box the first launch downloads Chromium and spins up a
-// virtual display (Xvfb), and a wedged profile lock or missing browser deps can
-// otherwise hang it indefinitely — a real dogfood run sat on a silent ~30-min
-// hang here with zero feedback (the worst first-run failure: the user assumes
-// it's broken and never comes back). Cap it so a stuck launch fails LOUDLY with
-// an actionable message. The default is generous (a cold Chromium download is
-// legitimately multi-minute — better to wait than false-fail a slow-but-working
-// launch); tune with BOT_START_TIMEOUT_MS. Timeout uses the independent bounded
-// cancellation boundary: it releases or quarantines profile custody without
-// awaiting the unresolved launch, and late settlement cleans up only this
-// controller's marked process.
-async function startBrowserBounded(browser, sessionId, cancel) {
-    const timeoutMs = Number(process.env.BOT_START_TIMEOUT_MS) || 600_000;
-    audit(sessionId, "browser_launch", {
-        note: "first launch may download Chromium + start Xvfb; slow but one-time",
-        timeout_ms: timeoutMs,
-    });
-    let timer;
-    const timeout = new Promise((_resolve, reject) => {
-        timer = setTimeout(() => reject(new Error("__browser_start_timeout__")), timeoutMs);
-    });
-    try {
-        await Promise.race([browser.start(), timeout]);
-    }
-    catch (err) {
-        if (err instanceof Error && err.message === "__browser_start_timeout__") {
-            await cancel().catch(() => undefined);
-            throw new Error(`operate_start: browser did not launch within ${Math.round(timeoutMs / 1000)}s. ` +
-                "On a fresh machine the first launch downloads Chromium and starts a virtual display " +
-                "(Xvfb) — slow but one-time. A hang this long usually means the browser binaries or Xvfb " +
-                "are missing on this box. Retry once (a partial download resumes and later launches reuse " +
-                "the cache); if it recurs, run `npx @trusty-squire/mcp connect` here to install the browser " +
-                "deps, or raise BOT_START_TIMEOUT_MS to wait longer.");
-        }
-        throw err;
-    }
-    finally {
-        if (timer !== undefined)
-            clearTimeout(timer);
-    }
-}
 // ── pure helpers (exported for unit tests) ──
 const norm = (s) => (s ?? "").replace(/\s+/g, " ").trim().toLowerCase();
 // Element ref = a STABLE-by-default handle: "@e:<identity>_<ordinal>". For a
@@ -660,7 +265,7 @@ function baseIdentityFields(el) {
         el.container ?? "",
         el.role ?? "",
         el.tag,
-        elementRef(el),
+        elementRef({ ...el, value: null }),
         el.href ?? "",
         el.type ?? "",
         // Frame origin — WITHOUT this, an element's `selector` (folded into
@@ -889,6 +494,21 @@ export class TargetStaleError extends Error {
         this.result = result;
     }
 }
+class CompactV2StaleRefError extends Error {
+}
+class ProvisionTargetNotAllowedError extends Error {
+}
+class ProvisionTargetMissingError extends Error {
+}
+class CompactV2ActionFailureError extends Error {
+}
+/**
+ * A `@label` that names more than one observed control. Extends the
+ * already-sealed failure channel so its message survives V2's opaque error
+ * mapping: it carries ONLY refs the agent already holds, never page text.
+ */
+class CompactV2AmbiguousLabelError extends CompactV2ActionFailureError {
+}
 function replacementCandidates(elements) {
     const refs = provisionElementRefs(elements);
     const candidates = {};
@@ -934,174 +554,18 @@ function elementTargetKeys(el) {
         return v.length > 0 ? [v] : [];
     });
 }
-const PENDING_CARD_AUTOCOMPLETE_FIELDS = new Set([
-    "cc-number",
-    "cc-exp",
-    "cc-exp-month",
-    "cc-exp-year",
-    "cc-csc",
-    "cc-name",
-]);
-function isPendingCardFilledField(el) {
+// Shopify defers address geocoding (and therefore delivery-rate loading) until
+// its required shipping street field is committed. Keep this deliberately
+// narrow: ordinary text fields and even other autocomplete controls retain
+// their existing type-only behavior.
+function isRequiredShippingAddressLine1(el) {
+    if (!el.required)
+        return false;
     const autocomplete = (el.autocomplete ?? "")
         .toLowerCase()
         .split(/\s+/)
         .filter((token) => token.length > 0);
-    if (autocomplete.some((token) => PENDING_CARD_AUTOCOMPLETE_FIELDS.has(token)))
-        return true;
-    if (autocomplete.includes("billing") &&
-        autocomplete.some((token) => [
-            "address-line1",
-            "address-line2",
-            "address-level1",
-            "address-level2",
-            "postal-code",
-            "country",
-        ].includes(token))) {
-        return true;
-    }
-    const name = (el.name ?? "").toLowerCase();
-    const id = (el.id ?? "").toLowerCase();
-    const ariaLabel = (el.ariaLabel ?? "").toLowerCase();
-    const placeholder = (el.placeholder ?? "").toLowerCase();
-    return (name.includes("cardnumber") ||
-        id.includes("card-number") ||
-        id.includes("cardnumber") ||
-        name.includes("cardholder") ||
-        name.includes("card-name") ||
-        id.includes("cardholder") ||
-        name.includes("cvv") ||
-        name.includes("cvc") ||
-        name.includes("security-code") ||
-        id.includes("cvv") ||
-        id.includes("cvc") ||
-        ((name.includes("exp") || id.includes("exp")) &&
-            (name.includes("month") ||
-                name.includes("year") ||
-                name.includes("date") ||
-                name.includes("expir") ||
-                id.includes("month") ||
-                id.includes("year") ||
-                id.includes("date") ||
-                id.includes("expir") ||
-                name === "exp" ||
-                id === "exp")) ||
-        placeholder.replace(/\s+/g, "") === "mm/yy" ||
-        ariaLabel.replace(/\s+/g, "") === "mm/yy" ||
-        ((name.includes("billing") || id.includes("billing")) &&
-            /address|line1|line2|city|locality|state|region|postal|zip|country/.test(`${name} ${id}`)));
-}
-function pendingCardSecretKind(el) {
-    const autocomplete = (el.autocomplete ?? "").toLowerCase().split(/\s+/);
-    const signal = `${el.name ?? ""} ${el.id ?? ""}`.toLowerCase();
-    if (autocomplete.includes("cc-number") ||
-        signal.includes("cardnumber") ||
-        signal.includes("card-number")) {
-        return "pan";
-    }
-    if (autocomplete.includes("cc-csc") ||
-        signal.includes("cvv") ||
-        signal.includes("cvc") ||
-        signal.includes("security-code")) {
-        return "cvv";
-    }
-    return null;
-}
-function redactPaymentObservationText(text, elements, active) {
-    if (!active)
-        return text;
-    let redacted = text;
-    for (const element of elements) {
-        const kind = pendingCardSecretKind(element);
-        const value = element.value?.trim() ?? "";
-        if (kind === null || value.length === 0)
-            continue;
-        if (kind === "pan") {
-            redacted = redactExactDigitSequence(redacted, value.replace(/\D/g, ""));
-        }
-        const escaped = value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-        redacted = redacted.replace(kind === "cvv" ? new RegExp(`\\b${escaped}\\b`, "g") : new RegExp(escaped, "g"), "[sealed payment]");
-    }
-    redacted = redactLuhnPanSpans(redacted);
-    return redacted.replace(/\b(cvv|cvc|security\s+code)\s*[:#-]?\s*\d{3,4}\b/gi, "$1 [sealed payment]");
-}
-function presentPaymentSafeString(value, paymentSealActive) {
-    return paymentSealActive ? redactPaymentObservationText(value, [], true) : value;
-}
-const PAYMENT_PAN_MAX_SPAN_CHARS = 96;
-function redactExactDigitSequence(text, expectedDigits) {
-    if (expectedDigits.length < 13)
-        return text;
-    const digitMatches = Array.from(text.matchAll(/\d/g));
-    const replacements = [];
-    for (let start = 0; start + expectedDigits.length <= digitMatches.length; start += 1) {
-        const matches = digitMatches.slice(start, start + expectedDigits.length);
-        if (matches.map((match) => match[0]).join("") !== expectedDigits)
-            continue;
-        if (matches[matches.length - 1].index - matches[0].index + 1 > PAYMENT_PAN_MAX_SPAN_CHARS) {
-            continue;
-        }
-        replacements.push({
-            start: matches[0].index,
-            end: matches[matches.length - 1].index + 1,
-        });
-        start += expectedDigits.length - 1;
-    }
-    if (replacements.length === 0)
-        return text;
-    let cursor = 0;
-    let result = "";
-    for (const replacement of replacements) {
-        result += `${text.slice(cursor, replacement.start)}[sealed payment]`;
-        cursor = replacement.end;
-    }
-    return result + text.slice(cursor);
-}
-function redactLuhnPanSpans(text) {
-    const digitPositions = Array.from(text.matchAll(/\d/g), (match) => match.index);
-    const replacements = [];
-    let startDigit = 0;
-    while (startDigit + 13 <= digitPositions.length) {
-        let matchedDigits = 0;
-        const maxDigits = Math.min(19, digitPositions.length - startDigit);
-        for (let length = maxDigits; length >= 13; length -= 1) {
-            const positions = digitPositions.slice(startDigit, startDigit + length);
-            if (positions[positions.length - 1] - positions[0] + 1 > PAYMENT_PAN_MAX_SPAN_CHARS) {
-                continue;
-            }
-            const digits = positions.map((position) => text[position]).join("");
-            if (passesLuhn(digits)) {
-                matchedDigits = length;
-                replacements.push({
-                    start: positions[0],
-                    end: positions[positions.length - 1] + 1,
-                });
-                break;
-            }
-        }
-        startDigit += matchedDigits || 1;
-    }
-    if (replacements.length === 0)
-        return text;
-    let cursor = 0;
-    let result = "";
-    for (const replacement of replacements) {
-        result += `${text.slice(cursor, replacement.start)}[sealed payment]`;
-        cursor = replacement.end;
-    }
-    return result + text.slice(cursor);
-}
-function observationSealedFieldKeys(session, elements) {
-    if (!session.paymentFieldSealActive)
-        return session.sealedFieldKeys;
-    const sealed = new Set(session.sealedFieldKeys);
-    for (const el of elements) {
-        if (!isPendingCardFilledField(el))
-            continue;
-        for (const key of elementTargetKeys(el))
-            sealed.add(key);
-    }
-    return sealed;
+    return autocomplete.includes("shipping") && autocomplete.includes("address-line1");
 }
 // Resolve a host-supplied target string to one live element. Matching is by
 // structured path, test id, or label text, scored exact > startsWith > contains.
@@ -1175,6 +639,104 @@ export function resolveTarget(elements, target) {
     }
     return best?.el ?? null;
 }
+function invalidateCompactV2Snapshot(session) {
+    session.compactV2Refs = new Map();
+    session.compactV2Index = null;
+    session.compactV2Previous = null;
+}
+function throwCompactV2StaleRef() {
+    // Deliberately opaque: stale V2 errors must not construct V1 replacement
+    // candidates or reveal raw labels/legacy identities outside the safe view.
+    throw new CompactV2StaleRefError("stale_ref");
+}
+/**
+ * The parts of an observed row that carry what the agent CHOSE the control for.
+ * `state`, `visibility` and `choice` legitimately churn on a live form and are
+ * excluded, so a ref stays actionable across a re-render; role, intent, field
+ * class, frame and label are not — a control whose label went from "Continue"
+ * to "Delete account" is no longer the control the agent reasoned about, even
+ * though its fingerprint (its DOM id) never moved.
+ */
+function sameCompactV2Intent(left, right) {
+    return (left.role === right.role &&
+        left.action === right.action &&
+        left.field === right.field &&
+        left.frame === right.frame &&
+        left.label === right.label);
+}
+/** Row equality over the sealed representation only — never raw page data. */
+function sameCompactV2Control(left, right) {
+    return (left.role === right.role &&
+        left.state === right.state &&
+        left.visibility === right.visibility &&
+        left.action === right.action &&
+        left.field === right.field &&
+        left.label === right.label &&
+        left.choice === right.choice &&
+        left.frame === right.frame);
+}
+/**
+ * Authorize an agent-supplied target against the observed skeleton. Two forms:
+ * a `@e:` handle (the durable fingerprint) or a `@label` alias, which resolves
+ * to exactly one observed handle or fails — never a guess. Only the epoch's
+ * `doc` gates here; a benign re-render since the observation is expected and is
+ * settled at act time against live elements.
+ */
+function compactV2AuthorizationForTarget(session, target) {
+    const index = session.compactV2Index;
+    if (index === null)
+        throwCompactV2StaleRef();
+    if (index.expiresAt < Date.now() || index.epoch.doc !== compactV2EpochDoc(session)) {
+        invalidateCompactV2Snapshot(session);
+        throwCompactV2StaleRef();
+    }
+    const row = isCompactV2Label(target)
+        ? resolveCompactV2Label(index.rows, target)
+        : index.rows.find((candidate) => candidate.ref === target);
+    if (row === undefined)
+        throwCompactV2StaleRef();
+    const legacy = compactV2LegacyRefForHandle(session.compactV2Refs, row.ref);
+    if (legacy === null)
+        throwCompactV2StaleRef();
+    return { legacyRef: legacy, row };
+}
+/** A label acts only when it names exactly one observed control. */
+function resolveCompactV2Label(rows, label) {
+    const matches = rows.filter((row) => row.label === label);
+    if (matches.length > 1) {
+        throw new CompactV2AmbiguousLabelError(`ambiguous_target: "${label}" names ${matches.length} controls. ` +
+            `Retry with one exact ref: ${matches.map((row) => row.ref).join(", ")}`);
+    }
+    return matches[0];
+}
+/**
+ * Re-resolve an authorized ref against LIVE elements. The handle is minted from
+ * the element's durable fingerprint under the current document epoch, so this
+ * survives a re-render between two acts (the whole point of the identity model)
+ * while a replaced document, a removed control, or a control that changed role
+ * under the same fingerprint all fail closed.
+ */
+function resolveAuthorizedCompactV2Target(session, elements, authorization) {
+    const index = session.compactV2Index;
+    if (index === null || index.epoch.doc !== compactV2EpochDoc(session)) {
+        invalidateCompactV2Snapshot(session);
+        throwCompactV2StaleRef();
+    }
+    const live = compactV2LiveControls(session, elements);
+    const matches = live.rows.filter((row) => row.ref === authorization.row.ref);
+    // Fingerprints are unique within an inventory by construction, so >1 means a
+    // broken invariant rather than an addressable ambiguity: refuse either way.
+    if (matches.length !== 1)
+        throwCompactV2StaleRef();
+    const liveRow = matches[0];
+    if (!sameCompactV2Intent(liveRow, authorization.row))
+        throwCompactV2StaleRef();
+    const legacy = live.byRef.get(liveRow.ref);
+    const resolved = legacy === undefined ? null : resolveTarget(elements, legacy);
+    if (resolved === null)
+        throwCompactV2StaleRef();
+    return resolved;
+}
 // Squire's OWN control plane. The operator browser runs in the connect-seeded
 // profile, so it is authenticated as the user (a live Google session). It must
 // therefore NEVER be allowed to reach Squire's own web app / API: otherwise a
@@ -1196,8 +758,9 @@ export function isSquireControlPlaneHost(host) {
     return SQUIRE_CONTROL_PLANE_HOSTS.some((d) => h === d || h.endsWith(`.${d}`));
 }
 // Domain-scope check for an agent-initiated goto. Allows the target host, any
-// subdomain of it, the configured auth hosts, and *.firebaseapp.com /
-// *.web.app auth handlers. Organic redirects are NOT routed through here.
+// subdomain of it, exact service-specific login routes, the configured auth
+// hosts, and *.firebaseapp.com / *.web.app auth handlers. Organic redirects
+// are NOT routed through here.
 export function hostAllowed(url, allowedHosts) {
     let host;
     try {
@@ -1213,6 +776,8 @@ export function hostAllowed(url, allowedHosts) {
     const ok = (allowed) => host === allowed || host.endsWith(`.${allowed}`);
     if (allowedHosts.some(ok))
         return true;
+    if (serviceLoginRouteHosts(allowedHosts).includes(host))
+        return true;
     if (DEFAULT_AUTH_HOSTS.some(ok))
         return true;
     if (host.endsWith(".firebaseapp.com") || host.endsWith(".web.app"))
@@ -1223,7 +788,7 @@ function frameTargetFor(el) {
     if (el.framePath === undefined || el.framePath === null)
         return null;
     if (el.frameOrigin === undefined || el.frameOrigin === null) {
-        throw new Error("frame target lacks an origin");
+        throw new ProvisionTargetNotAllowedError("frame target lacks an origin");
     }
     return {
         framePath: el.framePath,
@@ -1250,12 +815,12 @@ function assertFrameTargetAllowed(session, el, kind) {
     // message below suggests allow_host, which can never succeed for a null
     // origin — a remedy the model would loop on forever.
     if (el.frameOpaque === true || el.frameOrigin === "null") {
-        throw new Error(`${kind} refused: the target lives in an opaque (null-origin) frame — a sandboxed ` +
+        throw new ProvisionTargetNotAllowedError(`${kind} refused: the target lives in an opaque (null-origin) frame — a sandboxed ` +
             `iframe without allow-same-origin, or an unconfirmed about:blank/srcdoc document. ` +
             `No host declaration can ever permit a null origin; this control is not reachable ` +
             `through operate_act. Drive the page's own controls instead.`);
     }
-    throw new Error(`${kind} blocked by domain-scope: the target lives in a cross-domain frame ` +
+    throw new ProvisionTargetNotAllowedError(`${kind} blocked by domain-scope: the target lives in a cross-domain frame ` +
         `(${el.frameOrigin ?? el.frameUrl}) outside the allowed hosts ` +
         `[${hostStrings(session).join(", ")}] + auth providers. ` +
         `Declare it first with an allow_host action if this task spans it.`);
@@ -1271,13 +836,13 @@ function assertSecretFrameTargetAllowed(session, el) {
     if (target === null)
         return;
     if (target.frameOpaque === true) {
-        throw new Error("type_secret refused: the target lives in an opaque frame. Secrets may only be " +
+        throw new ProvisionTargetNotAllowedError("type_secret refused: the target lives in an opaque frame. Secrets may only be " +
             "typed into the main frame or a frame on the page's own domain.");
     }
     const pageUrl = session.browser.currentUrl();
     if (isSameRecipeDomain(target.frameOrigin, pageUrl))
         return;
-    throw new Error(`type_secret refused: the target lives in a cross-domain frame ` +
+    throw new ProvisionTargetNotAllowedError(`type_secret refused: the target lives in a cross-domain frame ` +
         `(${target.frameOrigin}), not the page's own domain. Secrets may only be ` +
         `typed into the main frame or a frame on the page's own domain.`);
 }
@@ -1292,7 +857,7 @@ function assertSecretFrameTargetAllowed(session, el) {
 function assertNoFrameTarget(el, kind) {
     if (el.framePath === undefined || el.framePath === null)
         return;
-    throw new Error(`operate_act kind="${kind}" does not yet support a target inside an <iframe> ` +
+    throw new ProvisionTargetNotAllowedError(`operate_act kind="${kind}" does not yet support a target inside an <iframe> ` +
         `(frame ${el.frameOrigin ?? "unknown"}). Use click/js_click/type/type_secret/select ` +
         `for frame targets.`);
 }
@@ -1635,7 +1200,7 @@ export function manualCardEntryBlockReason(text) {
     }
     return null;
 }
-export function buildScreenOutline(elements, pageText, sealedFieldKeys = new Set(), paymentSealActive = false) {
+export function buildScreenOutline(elements, pageText) {
     if (elements.length === 0)
         return undefined;
     const byRegion = new Map();
@@ -1644,8 +1209,8 @@ export function buildScreenOutline(elements, pageText, sealedFieldKeys = new Set
         const role = id.split(":")[0] ?? "region";
         const existing = byRegion.get(id);
         const region = existing ?? {
-            id: presentPaymentSafeString(id, paymentSealActive),
-            role: presentPaymentSafeString(role, paymentSealActive),
+            id: id,
+            role: role,
             topmost: false,
             occluded_by: null,
             children: [],
@@ -1657,22 +1222,24 @@ export function buildScreenOutline(elements, pageText, sealedFieldKeys = new Set
         else if (region.occluded_by === null &&
             el.occludedBy !== null &&
             el.occludedBy !== undefined) {
-            region.occluded_by = presentPaymentSafeString(el.occludedBy, paymentSealActive);
+            region.occluded_by = el.occludedBy;
         }
         if (region.children.length < 10) {
             region.children.push({
                 ref: el.screenPath !== null && el.screenPath !== undefined
-                    ? presentPaymentSafeString(el.screenPath, paymentSealActive)
-                    : presentLabel(el, sealedFieldKeys, paymentSealActive),
-                role: el.role === null ? null : presentPaymentSafeString(el.role, paymentSealActive),
-                text: presentLabel(el, sealedFieldKeys, paymentSealActive),
+                    ? el.screenPath
+                    : elementRef(el),
+                role: el.role === null
+                    ? null
+                    : el.role,
+                text: elementRef(el),
                 href: el.href === null || el.href === undefined
                     ? null
-                    : presentPaymentSafeString(el.href, paymentSealActive),
+                    : el.href,
                 topmost: el.topmost ?? null,
                 occluded_by: el.occludedBy === null || el.occludedBy === undefined
                     ? null
-                    : presentPaymentSafeString(el.occludedBy, paymentSealActive),
+                    : el.occludedBy,
             });
         }
         byRegion.set(id, region);
@@ -1696,44 +1263,7 @@ function roleForAccessibility(el) {
         return el.type ?? "textbox";
     return el.tag;
 }
-// PR3 privacy — a host-facing observation reads field VALUES straight off the
-// live DOM, so after a type_secret the cleartext password (or any sealed slot)
-// would surface in the observation/accessibility tree the planner sees and logs.
-// The whole point of prepare_login/extract is that the host only ever holds a
-// MASKED handle. Mask the presented copy here; internal callers (form-fill,
-// replay, postcondition length checks) read the raw InteractiveElement and are
-// unaffected. A field is sealed if it's a password input or a target a secret
-// slot was typed into (tracked per-session in sealedFieldKeys).
-const SEALED_FIELD_PLACEHOLDER = "[sealed]";
-function isSealedFieldValue(el, sealed) {
-    if (el.sealed === true)
-        return true;
-    if ((el.type ?? "").toLowerCase() === "password")
-        return true;
-    if ((el.sealedIdentityKeys ?? []).some((key) => sealed.has(key)))
-        return true;
-    return elementTargetKeys(el).some((k) => sealed.has(k));
-}
-function presentFieldValue(el, sealed, paymentSealActive = false) {
-    const v = el.value ?? null;
-    if (v === null || v.length === 0)
-        return v;
-    return isSealedFieldValue(el, sealed)
-        ? SEALED_FIELD_PLACEHOLDER
-        : presentPaymentSafeString(v, paymentSealActive);
-}
-// The host-facing LABEL. elementRef falls back to a field's VALUE when it has no
-// other label text — which would leak a sealed secret as the element's name. For
-// a sealed field, re-derive the label with the value stripped so it lands on the
-// next signal (placeholder/name) or `tag#index`, never the secret. Ref-keying
-// and targeting still use the raw elementRef, so resolution is unaffected.
-function presentLabel(el, sealed, paymentSealActive = false) {
-    const label = isSealedFieldValue(el, sealed)
-        ? elementRef({ ...el, value: null })
-        : elementRef(el);
-    return presentPaymentSafeString(label, paymentSealActive);
-}
-export function buildAccessibilitySnapshot(elements, limit = 12000, sealedFieldKeys = new Set(), paymentSealActive = false) {
+export function buildAccessibilitySnapshot(elements, limit = 12000) {
     if (elements.length === 0)
         return undefined;
     const refs = provisionElementRefs(elements);
@@ -1748,21 +1278,21 @@ export function buildAccessibilitySnapshot(elements, limit = 12000, sealedFieldK
     const structurallyTruncated = entries.length > 24 || entries.some(([, group]) => group.length > 16);
     const lines = ["RootWebArea"];
     for (const [region, group] of entries.slice(0, 24)) {
-        lines.push(`  region "${presentPaymentSafeString(region, paymentSealActive)}"`);
+        lines.push(`  region "${region}"`);
         for (const el of group.slice(0, 16)) {
-            const label = presentLabel(el, sealedFieldKeys, paymentSealActive).replace(/"/g, '\\"');
-            const role = presentPaymentSafeString(roleForAccessibility(el), paymentSealActive);
-            const shownValue = presentFieldValue(el, sealedFieldKeys, paymentSealActive);
+            const label = elementRef(el).replace(/"/g, '\\"');
+            const role = roleForAccessibility(el);
+            const shownValue = (el.value ?? null);
             const flags = [
                 el.value !== undefined && el.value !== null
                     ? `value="${(shownValue ?? "").slice(0, 60)}"`
                     : null,
                 el.checked !== undefined && el.checked !== null ? `checked=${el.checked}` : null,
                 el.href !== undefined && el.href !== null
-                    ? `href="${presentPaymentSafeString(el.href, paymentSealActive).slice(0, 120)}"`
+                    ? `href="${el.href.slice(0, 120)}"`
                     : null,
                 el.topmost === false
-                    ? `occluded_by="${presentPaymentSafeString(el.occludedBy ?? "unknown", paymentSealActive)}"`
+                    ? `occluded_by="${el.occludedBy ?? "unknown"}"`
                     : null,
             ].filter((v) => v !== null);
             lines.push(`    ${role} "${label}" ref=${refs.get(el) ?? provisionElementRef(el)}` +
@@ -1792,14 +1322,6 @@ export function buildAccessibilitySnapshot(elements, limit = 12000, sealedFieldK
         source: "interactive_dom",
     };
 }
-function registrableHost(url) {
-    try {
-        return new URL(url).hostname.toLowerCase();
-    }
-    catch {
-        return null;
-    }
-}
 function baseDomain(host) {
     const parts = host.toLowerCase().split(".").filter(Boolean);
     if (parts.length <= 2)
@@ -1844,234 +1366,21 @@ function widenAllowedHostsFromCurrentUrl(session) {
         });
     }
 }
-export function googleSessionGate(liveProviders) {
-    if (liveProviders.includes("google"))
-        return { ok: true };
-    return {
-        ok: false,
-        needs_user: {
-            wall: "google_session",
-            message: "No live Google session in the bot profile, so the operator cannot act " +
-                "as you yet. Refresh it with `npx @trusty-squire/mcp connect --force-relogin` " +
-                "— plain `connect` may report 'already connected' from a cached marker and " +
-                "skip the sign-in, so it will NOT fix a stale/expired session. Then retry " +
-                "— the task has NOT started and nothing was changed.",
-            resume: "connect",
-        },
-    };
-}
-async function ensureProvisionPrimaryProviderSession(browser) {
-    if (typeof browser.detectSessionProviders !== "function")
-        return [];
-    return await browser.detectSessionProviders().catch(() => []);
-}
+// ── session lifecycle ──
+//
+// The transaction itself lives in session/lifecycle.ts. These two wrappers are
+// the facade: they bind the perception collaborators the start paths need, so
+// the lifecycle module keeps a one-way dependency on this file (types only).
+const sessionStartPorts = {
+    observeSession: async (session, detail, startMetadata) => await observeSession(session, detail, startMetadata),
+    compactV2StartMetadata: (registryHint, loginHint, userEmail) => compactV2StartMetadata(registryHint, loginHint, userEmail),
+};
 export async function startProvisionSession(opts) {
-    const id = randomUUID();
-    let browser;
-    let liveProviders;
-    let workerEmail;
-    const acquired = await acquireWarmBrowser(opts, id);
-    browser = acquired.controller;
-    // Probe the selected browser: ordinary sessions use a claimed/cloned worker,
-    // while requireLiveIdentity uses the canonical login-authoring profile directly.
-    // The immutable seed is never opened by Chrome during an operator start.
-    liveProviders = await ensureProvisionPrimaryProviderSession(browser);
-    workerEmail =
-        typeof browser.detectGoogleAccountEmail === "function"
-            ? await browser.detectGoogleAccountEmail().catch(() => null)
-            : null;
-    // Change 5 — fail-closed identity gate BEFORE driving. If an operate task
-    // needs to act as the user and there's no live Google session, hand back now;
-    // do not start the browser or the task. No autonomous login is attempted.
-    if (opts.requireLiveIdentity === true) {
-        const gate = googleSessionGate(liveProviders);
-        if (!gate.ok) {
-            audit(id, "connect_gate", { ok: false, wall: "google_session" });
-            await releaseWarmBrowserPage(browser, true);
-            return { session_id: id, url: "", text: "", elements: [], needs_user: gate.needs_user };
-        }
-    }
-    const targetHost = registrableHost(opts.serviceUrl);
-    const seedHosts = [
-        ...(targetHost !== null ? [targetHost] : []),
-        ...(opts.extraAllowedHosts ?? []),
-    ];
-    // All start-declared hosts are sourced "start" — auto-widen chains off these,
-    // and credential egress may seed from these (but never from mid_session).
-    const allowedHosts = [...new Set(seedHosts)].map((host) => ({
-        host,
-        source: "start",
-    }));
-    const session = {
-        id,
-        browser,
-        allowedHosts,
-        generation: 0,
-        secretSlots: new Map(),
-        sealedFieldKeys: new Set(),
-        lastElements: [],
-        prevObserve: null,
-        observeSnapshotFile: null,
-        actionTrace: [],
-        recordedValues: [],
-        committedSelectValues: new Map(),
-        captureRounds: [],
-        usedLocatorFallback: false,
-        recipeRejectionReason: null,
-        replayState: null,
-        activePayment: null,
-        paymentFieldSealActive: false,
-        pendingThreeDs: null,
-        paymentDispatchHandoff: null,
-        placeOrderApproval: null,
-        placeOrderAttempted: false,
-        lastCartCheckout: null,
-        cartAdds: new Map(),
-        cartAddsByIdempotencyKey: new Map(),
-        cartUrls: new Map(),
-        lastCartMutation: null,
-        closing: false,
-        callCount: 0,
-        callDrainWaiters: new Set(),
-        paymentCallCount: 0,
-        paymentCallDrainWaiters: new Set(),
-        paymentDispatchClosed: false,
-        startedAt: Date.now(),
-        lastActivityAt: Date.now(),
-        watchdog: null,
-        terminalTeardownOwner: null,
-        hintServed: opts.hint !== undefined,
-        startUrl: opts.serviceUrl,
-        consentInboxRead: opts.consentInboxRead === true,
-        userEmail: workerEmail,
-        ...(opts.api !== undefined ? { api: opts.api } : {}),
-    };
-    sessions.set(id, session);
-    startSessionWatchdog(session);
-    try {
-        if (typeof browser.setHostScopeAllowedHosts === "function") {
-            await browser.setHostScopeAllowedHosts(() => hostStrings(session), () => merchantSiblingSeedHosts(session));
-        }
-        audit(id, "start", {
-            service_url: opts.serviceUrl,
-            allowed_hosts: hostStrings(session),
-            has_hint: opts.hint !== undefined,
-        });
-        await browser.goto(opts.serviceUrl);
-        // A cookie/consent overlay (Usercentrics/OneTrust/…) renders after load and its
-        // backdrop occludes the ENTIRE form — the agent then sees every element
-        // occluded_by a div and gives up, or falls back to the only thing that looks
-        // clickable (e.g. a "Connect wallet" CTA on the Robinhood faucet). Dismiss it
-        // BEFORE the first observation so the real actionable form is operable.
-        // dismissConsentBanner() existed but had NO call sites (dead code); it only
-        // clicks banner-specific CTAs (accept/reject all), so a false click is unlikely.
-        // Best-effort + one retry, since the widget lazy-loads a beat after the goto.
-        for (let attempt = 0; attempt < 2; attempt++) {
-            const cta = await browser.dismissConsentBanner().catch(() => null);
-            if (cta !== null) {
-                audit(id, "consent_dismissed", { cta });
-                break;
-            }
-            if (attempt === 0)
-                await browser.waitForCaptchaChallengeToSettle(800, 0).catch(() => false);
-        }
-        const observation = await observeSession(session);
-        // Tell the agent which provider the user actually has a live session for
-        // (Google-preferred) — the bot knows from the profile cookies, so the agent
-        // doesn't have to guess. Composed with the skill route hint (if any).
-        const hintParts = [
-            loginSessionGuidance(liveProviders),
-            ...(opts.hint !== undefined ? [opts.hint] : []),
-        ];
-        return {
-            ...observation,
-            hint: hintParts.join("\n"),
-            ...(session.userEmail !== null ? { user_email: session.userEmail } : {}),
-        };
-    }
-    catch (err) {
-        sessions.delete(id);
-        disposeSessionWatchdog(session);
-        await releaseWarmBrowserPage(browser, false);
-        throw err;
-    }
+    return await startProvisionSessionInternal(opts, sessionStartPorts);
 }
 /** Start a normal guarded session on a caller-owned harness page. */
 export async function startHarnessProvisionSession(opts) {
-    const id = randomUUID();
-    if (opts.requireLiveIdentity === true) {
-        throw new Error("harness sessions cannot request live identity");
-    }
-    const targetHost = registrableHost(opts.serviceUrl);
-    const allowedHosts = [
-        ...(targetHost === null ? [] : [targetHost]),
-        ...(opts.extraAllowedHosts ?? []),
-    ]
-        .filter((host, index, hosts) => hosts.indexOf(host) === index)
-        .map((host) => ({
-        host,
-        source: "start",
-    }));
-    const session = {
-        id,
-        browser: opts.browser,
-        allowedHosts,
-        generation: 0,
-        secretSlots: new Map(),
-        sealedFieldKeys: new Set(),
-        lastElements: [],
-        prevObserve: null,
-        observeSnapshotFile: null,
-        actionTrace: [],
-        recordedValues: [],
-        committedSelectValues: new Map(),
-        captureRounds: [],
-        usedLocatorFallback: false,
-        recipeRejectionReason: null,
-        replayState: null,
-        activePayment: null,
-        paymentFieldSealActive: false,
-        pendingThreeDs: null,
-        paymentDispatchHandoff: null,
-        placeOrderApproval: null,
-        placeOrderAttempted: false,
-        lastCartCheckout: null,
-        cartAdds: new Map(),
-        cartAddsByIdempotencyKey: new Map(),
-        cartUrls: new Map(),
-        lastCartMutation: null,
-        closing: false,
-        callCount: 0,
-        callDrainWaiters: new Set(),
-        paymentCallCount: 0,
-        paymentCallDrainWaiters: new Set(),
-        paymentDispatchClosed: false,
-        startedAt: Date.now(),
-        lastActivityAt: Date.now(),
-        watchdog: null,
-        terminalTeardownOwner: null,
-        hintServed: opts.hint !== undefined,
-        startUrl: opts.serviceUrl,
-        consentInboxRead: false,
-        userEmail: null,
-        ...(opts.api === undefined ? {} : { api: opts.api }),
-    };
-    sessions.set(id, session);
-    startSessionWatchdog(session);
-    try {
-        audit(id, "start_harness", {
-            service_url: opts.serviceUrl,
-            allowed_hosts: hostStrings(session),
-        });
-        await opts.browser.goto(opts.serviceUrl);
-        return { ...(await observeSession(session)), hint: opts.hint ?? "" };
-    }
-    catch (error) {
-        sessions.delete(id);
-        disposeSessionWatchdog(session);
-        await opts.browser.close().catch(() => undefined);
-        throw error;
-    }
+    return await startHarnessProvisionSessionInternal(opts, sessionStartPorts);
 }
 export async function observe(sessionId, detail = "compact") {
     const session = sessionForCall(sessionId);
@@ -2079,28 +1388,18 @@ export async function observe(sessionId, detail = "compact") {
         throw new Error(`unknown provision session ${sessionId}`);
     return await observeSession(session, detail);
 }
-// operate_screenshot's session-level entry point: refuses an active card-fill
-// lease, then delegates the capture-scoped sealed-value checks and pixel
-// redaction to BrowserController.captureOperatorScreenshot (browser.ts).
+// operate_screenshot's session-level entry point. The capture is the page's real
+// pixels — there is no redaction pass and no sealed-context refusal.
 export async function captureScreenshot(sessionId, opts = {}) {
     const session = sessionForCall(sessionId);
     if (session === undefined)
         throw new Error(`unknown provision session ${sessionId}`);
-    // A live card fill is never safe to inspect, even when the caller selects a
-    // child frame. Historical seals are different: sealedFieldKeys is cumulative,
-    // so the browser must inspect only the frames this capture would include.
-    if (session.paymentFieldSealActive || session.activePayment?.status === "operating") {
-        throw new Error("screenshot_unavailable_sealed_context");
-    }
-    const captured = await session.browser.captureOperatorScreenshot(opts, [
-        ...session.sealedFieldKeys,
-    ]);
+    const captured = await session.browser.captureOperatorScreenshot(opts);
     return {
         session_id: sessionId,
         url: session.browser.currentUrl(),
         frame_url: captured.frameUrl,
         frame_count: captured.frameCount,
-        redacted_count: captured.redactedCount,
         image: { mime_type: "image/jpeg", data_base64: captured.base64 },
     };
 }
@@ -2157,14 +1456,20 @@ export function currentProvisionUrl(sessionId) {
         throw new Error(`unknown provision session ${sessionId}`);
     return session.browser.currentUrl();
 }
+export function isCompactV2ProvisionSession(sessionId) {
+    return sessionForCall(sessionId)?.compactV2Mode === "on";
+}
 function activeProvisionSession() {
     return paymentSession();
 }
 export function activeProvisionBrowser() {
-    return activeProvisionSession().browser;
+    const session = activeProvisionSession();
+    invalidateCompactV2Snapshot(session);
+    return session.browser;
 }
 export async function activeProvisionBrowserForPayment(selectedSession) {
     const session = selectedSession ?? activeProvisionSession();
+    invalidateCompactV2Snapshot(session);
     return session.browser;
 }
 function placeOrderApprovalFromPendingFill(pending) {
@@ -2196,13 +1501,37 @@ export function getActivePendingCardFill(selectedSession) {
     const state = (selectedSession ?? activeProvisionSession()).activePayment;
     return state?.status === "pending" ? state.pending : null;
 }
-// [P0] Read-only: the outstanding approval a prior operate_pay call left
-// waiting on the human, if any. Backs operate_payment_status, which does not
-// touch session state and just reports on it.
+// The outstanding approval a prior bounded operate_pay call left waiting on
+// the human, if any. A status read may transition this exact state to terminal
+// denial/expiry and scrub its private operator key.
 export function getActivePendingApproval(selectedSession) {
     const state = (selectedSession ?? activeProvisionSession()).activePayment;
     return state?.status === "awaiting_approval" ? state.state : null;
 }
+export function getTerminalPaymentApproval(selectedSession) {
+    const activePayment = (selectedSession ?? activeProvisionSession()).activePayment;
+    return activePayment?.status === "terminal_approval"
+        ? { state: activePayment.state, terminalStatus: activePayment.terminalStatus }
+        : null;
+}
+export function completeActivePendingApprovalWithTerminalStatus(state, terminalStatus, selectedSession) {
+    const session = selectedSession ?? activeProvisionSession();
+    const activePayment = session.activePayment;
+    if (activePayment?.status !== "awaiting_approval" || activePayment.state !== state)
+        return false;
+    state.keypair.privateKey = "";
+    session.activePayment = { status: "terminal_approval", state, terminalStatus };
+    return true;
+}
+export function completeActivePaymentLeaseWithTerminalApproval(lease, state, terminalStatus, selectedSession) {
+    const session = selectedSession ?? activeProvisionSession();
+    const activePayment = session.activePayment;
+    if (activePayment?.status !== "operating" || activePayment.lease !== lease) {
+        throw new Error("operate_pay terminal approval completed without ownership of the active payment lease");
+    }
+    state.keypair.privateKey = "";
+    session.activePayment = { status: "terminal_approval", state, terminalStatus };
+}
 export function getActivePendingThreeDs(selectedSession) {
     return (selectedSession ?? activeProvisionSession()).pendingThreeDs ?? null;
 }
@@ -2278,6 +1607,13 @@ export function claimActivePaymentForOperatePay(phase, selectedSession) {
     if (state?.status === "sealed") {
         throw new Error("operate_pay refused: payment field cleanup remains unverified");
     }
+    if (state?.status === "terminal_approval") {
+        return {
+            kind: "terminal",
+            state: state.state,
+            terminalStatus: state.terminalStatus,
+        };
+    }
     if (state?.status === "pending") {
         if (phase !== "confirm") {
             throw new Error('operate_pay refused: a vaulted card fill is pending; phase="confirm" is required next');
@@ -2413,6 +1749,14 @@ function alreadyInCartResult(result) {
         checkout_state: { ...result.checkout_state },
     };
 }
+async function capturePrivateCheckoutState(session) {
+    const elements = await session.browser.extractInteractiveElements();
+    retainSessionElements(session, elements);
+    const url = session.browser.currentUrl();
+    const text = await session.browser.extractVisibleText();
+    const liveCheckout = await captureCartCheckoutForFillCardFallback(session, url);
+    return checkoutStateForObservation(session, url, text.slice(0, 12_000), elements, liveCheckout);
+}
 async function reconcileReservedCartAdd(session, record) {
     if (record.result !== null)
         return alreadyInCartResult(record.result);
@@ -2432,14 +1776,14 @@ async function reconcileReservedCartAdd(session, record) {
                 cartDelta: "0",
                 origin: originForUrl(session.browser.currentUrl()) ?? "",
             };
-            const observed = await observeSession(session);
-            if (observed.checkout_state === undefined)
+            const checkoutState = await capturePrivateCheckoutState(session);
+            if (checkoutState === undefined)
                 throw error;
             const result = {
                 status: "already_in_cart",
                 cart_delta: "0",
-                cart_url: observed.checkout_state.cart_url,
-                checkout_state: { ...observed.checkout_state, quantity },
+                cart_url: checkoutState.cart_url,
+                checkout_state: { ...checkoutState, quantity },
                 postcondition: {
                     product_identity: record.productIdentity,
                     options_hash: record.optionsHash,
@@ -2462,14 +1806,14 @@ async function performCartAdd(session, record) {
             cartDelta: "0",
             origin: originForUrl(session.browser.currentUrl()) ?? "",
         };
-        const observed = await observeSession(session);
-        if (observed.checkout_state === undefined)
+        const checkoutState = await capturePrivateCheckoutState(session);
+        if (checkoutState === undefined)
             throw new Error("cart state was not observable");
         return {
             status: "already_in_cart",
             cart_delta: "0",
-            cart_url: observed.checkout_state.cart_url,
-            checkout_state: { ...observed.checkout_state, quantity: beforeQuantity },
+            cart_url: checkoutState.cart_url,
+            checkout_state: { ...checkoutState, quantity: beforeQuantity },
             postcondition: {
                 product_identity: record.productIdentity,
                 options_hash: record.optionsHash,
@@ -2484,33 +1828,33 @@ async function performCartAdd(session, record) {
         'text="カートに追加"',
     ];
     let addError;
-    let observed = null;
+    let actionResult = null;
     for (const target of addTargets) {
         try {
-            observed = await act(session.id, { kind: "click", target }, "compact", {
+            actionResult = await actInternally(session.id, { kind: "click", target }, "compact", {
                 productIdentity: record.productIdentity,
                 optionsHash: record.optionsHash,
                 onActionReady: () => {
                     record.phase = "click_started";
                 },
-            });
+            }, true);
             addError = undefined;
             break;
         }
         catch (error) {
             addError = error;
-            if (!(error instanceof Error) || !error.message.startsWith("no element matched locator")) {
+            if (!(error instanceof ProvisionTargetMissingError)) {
                 throw error;
             }
         }
     }
-    if (addError !== undefined || observed === null)
+    if (addError !== undefined || actionResult === null)
         throw addError;
     const afterQuantity = await cartLineQuantity(session, record.productIdentity, record.optionsHash);
     if (afterQuantity === null || afterQuantity <= 0) {
         throw new Error("requested product/variant line was not observable after add");
     }
-    const checkoutState = observed.checkout_state;
+    const checkoutState = actionResult.outcome.checkoutState;
     if (checkoutState === undefined)
         throw new Error("cart state was not observable after add");
     const cartDelta = beforeQuantity === null
@@ -2538,6 +1882,29 @@ async function performCartAdd(session, record) {
         },
     };
 }
+// Deterministic cart-normalize affordance: empty the cart before a cart_add so
+// a run reaches a KNOWN quantity regardless of what accumulated in the shared
+// persistent-profile cart across earlier operate_start sessions. Drops the
+// local idempotency reservations too — a stale "already_in_cart" for a line
+// that no longer exists must not suppress a real add after the clear.
+export async function cartClear(sessionId) {
+    const session = sessionForCall(sessionId);
+    if (session === undefined)
+        throw new Error(`unknown provision session ${sessionId}`);
+    const cleared = await session.browser.clearCart();
+    if (!cleared)
+        throw new Error("cart_clear failed to reach the cart-clear endpoint");
+    session.cartAdds.clear();
+    session.cartAddsByIdempotencyKey.clear();
+    session.lastCartMutation = null;
+    session.lastCartCheckout = null;
+    const observed = await observeSession(session);
+    return {
+        status: "cleared",
+        cart_url: observed.checkout_state?.cart_url ?? null,
+        ...(observed.checkout_state !== undefined ? { checkout_state: observed.checkout_state } : {}),
+    };
+}
 export async function cartAdd(sessionId, productIdentity, optionsHash, idempotencyKey) {
     const session = sessionForCall(sessionId);
     if (session === undefined)
@@ -2667,7 +2034,7 @@ function annotatePaymentControl(out, el) {
 // empty. `value`→`value_len` (never the raw value — keeps the sealed-field moat);
 // `checked` kept for real checkables (true OR false), omitted when null;
 // `topmost` only when false (the informative case); `container` dropped.
-export function toCompactElement(el, ref, sealed, 
+export function toCompactElement(el, ref, 
 // `path` is the single most verbose field and agents act by ref, not path — so
 // it is DROPPED from the default host payload (78% → 85% of the measured cut).
 // It is retained ONLY in the persisted snapshot file (includePath=true), which
@@ -2677,41 +2044,37 @@ includePath = false,
 // Apply type-elision (Phase 4) to the WIRE form. The persisted file
 // form keeps full fidelity for re-expansion, so callers that write the file
 // pass false.
-elide = false, paymentSealActive = false) {
+elide = false) {
     const out = {
         ref,
-        label: presentLabel(el, sealed, paymentSealActive),
-        tag: presentPaymentSafeString(el.tag, paymentSealActive),
+        label: elementRef(el),
+        tag: el.tag,
     };
     if (el.role)
-        out.role = presentPaymentSafeString(el.role, paymentSealActive);
+        out.role = el.role;
     if (el.type && !(elide && shouldElideType(el))) {
-        out.type = presentPaymentSafeString(el.type, paymentSealActive);
+        out.type = el.type;
     }
     // value_len is a LENGTH signal, not the value — report the REAL character count.
-    // presentFieldValue masks a sealed field to "[sealed]" (8 chars), so using its
-    // length made a correctly-filled 19-char email read as value_len:8 and misled
-    // the agent into thinking its fill truncated. The length isn't the secret (the
-    // min_value_len postcondition already uses the real length for the same reason).
     const realLen = (el.value ?? "").length;
     if (realLen > 0)
         out.value_len = realLen;
     if (el.checked !== null && el.checked !== undefined)
         out.checked = el.checked;
     if (el.href)
-        out.href = presentPaymentSafeString(el.href, paymentSealActive);
+        out.href = el.href;
     if (el.testId)
-        out.testId = presentPaymentSafeString(el.testId, paymentSealActive);
+        out.testId = el.testId;
     if (includePath && el.screenPath) {
-        out.path = presentPaymentSafeString(el.screenPath, paymentSealActive);
+        out.path = el.screenPath;
     }
     if (el.topmost === false)
         out.topmost = false;
     if (el.occludedBy) {
-        out.occluded_by = presentPaymentSafeString(el.occludedBy, paymentSealActive);
+        out.occluded_by = el.occludedBy;
     }
     if (el.frameOrigin) {
-        out.frame_origin = presentPaymentSafeString(el.frameOrigin, paymentSealActive);
+        out.frame_origin = el.frameOrigin;
     }
     annotatePaymentControl(out, el);
     return out;
@@ -2881,11 +2244,6 @@ function emitElements(els, encode) {
 // a write failure must NEVER break an observe. Rolling one file per session (the
 // latest COMPLETE inventory) — that's what the host wants when it re-expands
 // after a context compaction or greps for an element the delta didn't re-show.
-function observeSnapshotDir(sessionId) {
-    const override = (process.env.TRUSTY_SQUIRE_OBSERVE_DIR ?? "").trim();
-    const parent = override.length > 0 ? override : join(tmpdir(), "trusty-squire-observe");
-    return join(parent, sessionId);
-}
 function persistObserveSnapshot(session, generation, url, text, textTruncated, elements) {
     let temporaryFile = null;
     const dir = observeSnapshotDir(session.id);
@@ -3018,10 +2376,8 @@ const OBSERVE_CHURN_FULL_THRESHOLD = 0.6;
 // collapse, and returns both the emit and the complete ground-truth set.
 export function buildCompactObservation(args) {
     const { sessionId, url, text, elements, prev } = args;
-    const sealed = args.sealed ?? new Set();
     const encode = args.encode ?? "columnar";
     const elide = args.elide ?? true;
-    const paymentSealActive = args.paymentSealActive ?? false;
     const refs = provisionElementRefs(elements);
     const refOf = (el) => refs.get(el) ?? provisionElementRef(el);
     const fullByRef = new Map();
@@ -3029,11 +2385,11 @@ export function buildCompactObservation(args) {
     const fileElements = [];
     for (const el of elements) {
         const ref = refOf(el);
-        fullByRef.set(ref, toCompactElement(el, ref, sealed, false, elide, paymentSealActive));
+        fullByRef.set(ref, toCompactElement(el, ref, false, elide));
         serializedByRef.set(ref, JSON.stringify(fullByRef.get(ref)));
         // The persisted file keeps FULL fidelity (path included, no elision) so a
         // re-expansion after a host compaction loses nothing.
-        fileElements.push(toCompactElement(el, ref, sealed, true, false, paymentSealActive));
+        fileElements.push(toCompactElement(el, ref, true, false));
     }
     const nextState = { url, byRef: serializedByRef, text };
     // A dialog/modal region with at least one topmost (unoccluded) element is
@@ -3135,19 +2491,7 @@ async function captureCartCheckoutForFillCardFallback(session, url) {
     return null;
 }
 function checkoutStageFromUrl(url) {
-    let pathname = "";
-    try {
-        pathname = decodeURIComponent(new URL(url).pathname).toLowerCase();
-    }
-    catch {
-        return null;
-    }
-    if (/(?:^|\/)(?:checkout|secure[-_]?checkout|payment|order[-_]?review|order\/review)(?:\.(?:php|html?))?(?:\/|$)/i.test(pathname)) {
-        return "checkout";
-    }
-    if (/(?:^|\/)(?:cart|shopping[-_]?cart|view[-_]?cart|basket|bag)(?:\.(?:php|html?))?(?:\/|$)/i.test(pathname))
-        return "cart";
-    return null;
+    return checkoutStageFromUrlV2(url);
 }
 function checkoutStage(url, elements) {
     const routeStage = checkoutStageFromUrl(url);
@@ -3335,25 +2679,527 @@ function isCartAffectingAction(action, el, extraLabels = []) {
     return ((action.kind === "type" || action.kind === "select") &&
         /(?:\b(?:quantity|qty)\b|数量|個数)/i.test(target));
 }
-async function observeSession(session, detail = "compact") {
+function retainSessionElements(session, elements) {
+    session.lastElements =
+        session.compactV2Mode === "on"
+            ? sealRetainedInteractiveElementsV2(elements, (element) => compactV2CorrelationSelector(session, element))
+            : elements;
+}
+function compactV2CommittedSelectKey(session, selector) {
+    if (session.compactV2Mode !== "on")
+        return selector;
+    return createHmac("sha256", session.compactV2Secret)
+        .update(`select-key\0${selector}`)
+        .digest("base64url");
+}
+function compactV2CommittedSelectValue(session, value) {
+    if (session.compactV2Mode !== "on")
+        return value;
+    return createHmac("sha256", session.compactV2Secret)
+        .update(`select-value\0${value}`)
+        .digest("base64url");
+}
+function clearCommittedSelectValue(session, selector) {
+    session.committedSelectValues.delete(compactV2CommittedSelectKey(session, selector));
+}
+function compactV2CorrelationSelector(session, element) {
+    const binding = JSON.stringify([
+        element.frameOrigin ?? null,
+        element.framePath ?? null,
+        element.selector,
+    ]);
+    return `@c:${createHmac("sha256", session.compactV2Secret)
+        .update(binding)
+        .digest("base64url")
+        .slice(0, 22)}`;
+}
+function replaySafeElementForSession(session, element) {
+    if (element === null || session.compactV2Mode !== "on")
+        return element;
+    if (element.frameOrigin !== null && element.frameOrigin !== undefined) {
+        if (safeOriginV2(element.frameOrigin) === null) {
+            rejectRecipeRecording(session, "compact_v2_unrepresentable_frame_origin");
+            return null;
+        }
+    }
+    return (sealRetainedInteractiveElementsV2([element], (candidate) => compactV2CorrelationSelector(session, candidate))[0] ?? null);
+}
+function splitUtf8Pages(value, maxBytes) {
+    if (value.length === 0)
+        return [];
+    const pages = [];
+    let page = "";
+    let bytes = 0;
+    for (const character of value) {
+        const characterBytes = Buffer.byteLength(character, "utf8");
+        if (bytes + characterBytes > maxBytes && page.length > 0) {
+            pages.push(page);
+            page = "";
+            bytes = 0;
+        }
+        page += character;
+        bytes += characterBytes;
+    }
+    if (page.length > 0)
+        pages.push(page);
+    return pages;
+}
+function compactV2StartMetadata(registryHint, loginHint, userEmail) {
+    const hint = [loginHint, registryHint]
+        .filter((part) => part !== undefined && part.length > 0)
+        .join("\n");
+    const validEmail = userEmail !== null &&
+        Buffer.byteLength(userEmail, "utf8") <= 254 &&
+        /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(userEmail)
+        ? userEmail
+        : undefined;
+    return {
+        ...(hint.length === 0 ? {} : { hintPages: splitUtf8Pages(hint, 384) }),
+        ...(validEmail === undefined ? {} : { userEmail: validEmail }),
+    };
+}
+function compactV2QueryCursorScope(session, query, role) {
+    return createHmac("sha256", session.compactV2Secret)
+        .update(JSON.stringify([query, role ?? null]))
+        .digest("base64url")
+        .slice(0, 10);
+}
+function compactV2HintCursorScope(session) {
+    return createHmac("sha256", session.compactV2Secret)
+        .update("start-metadata")
+        .digest("base64url")
+        .slice(0, 10);
+}
+function compactV2Cursor(session, rev, offset, scope) {
+    // The session-held index owns the five-minute expiry, so the cursor need not
+    // repeat a UUID/timestamp on every dense-page observation. A session-secret
+    // HMAC makes this compact in-MCP token unforgeable across sessions. Binding
+    // the epoch revision is what kills a page offset across a re-serialization.
+    const body = `${rev.toString(36)}:${offset.toString(36)}:${scope}`;
+    const signature = createHmac("sha256", session.compactV2Secret)
+        .update(body)
+        .digest("base64url")
+        .slice(0, 12);
+    return `${body}.${signature}`;
+}
+// A live checkout mints a per-checkout token INTO ITS PATH and re-writes it as
+// the checkout SPA re-renders a step. The token names the checkout, never the
+// document, so folding it into `doc` retires every ref between two fills of one
+// address block. This is the path-side twin of the query/fragment exclusion
+// PR #624 landed; it is deliberately a CLOSED list of known checkout shapes —
+// every other path keeps its full identity, so an SPA route change to a
+// different logical page still retires refs.
+const VOLATILE_CHECKOUT_PATH_RULES = [
+    // Shopify hosted checkout, current (`…/checkouts/cn/<token>[/<step>]`) and
+    // legacy (`…/checkouts/c|co/<token>[/<step>]`), under any locale/shop prefix.
+    // The marker must be a whole segment, so a token that merely starts with "c"
+    // cannot be split across the capture.
+    /^(.*\/checkouts\/c[no]?)\/([^/]+)(?:\/.*)?$/i,
+    // Older Shopify: `/<shop-id>/checkouts/<token>[/<step>]`.
+    /^(.*\/checkouts)\/([^/]+)(?:\/.*)?$/i,
+];
+/**
+ * Generated, not authored. An authored path slug under `/checkouts/` (a docs
+ * page, a marketing route) must keep its own identity, so the token has to look
+ * minted: long, in the URL-safe token alphabet, and carrying a digit.
+ */
+function looksLikeVolatileCheckoutToken(segment) {
+    return segment.length >= 16 && /^[A-Za-z0-9_-]+$/.test(segment) && /\d/.test(segment);
+}
+/**
+ * Collapse a known-volatile checkout path onto one logical-page key. The step
+ * suffix collapses with the token: inside a single checkout the steps are
+ * same-document SPA routing, and a move to a DIFFERENT checkout replaces the
+ * document, which the primary document-identity signal catches.
+ */
+function normalizeVolatileCheckoutPath(pathname) {
+    for (const rule of VOLATILE_CHECKOUT_PATH_RULES) {
+        const match = rule.exec(pathname);
+        if (match !== null && looksLikeVolatileCheckoutToken(match[2])) {
+            return `${match[1]}/:checkout`;
+        }
+    }
+    return pathname;
+}
+// The `doc` half of the observation epoch (docs/observation-model.md §4.1):
+// the browser's stable main-document identity, not the URL. The full URL is too
+// volatile to key on — live checkouts (e.g. Shopify) rotate a token in the
+// query string AND in the path on every step re-render, which would invalidate
+// every ref between two acts. A NORMALIZED origin+pathname is folded in as a
+// fail-closed backstop for a host whose document identity does not move on a
+// logical page change; query-string, fragment, and known-volatile checkout
+// token churn on the same logical page must not invalidate.
+function compactV2EpochDoc(session) {
+    let location = session.browser.currentUrl();
+    try {
+        const parsed = new URL(location);
+        if (parsed.origin !== "null" && parsed.origin !== "")
+            location = `${parsed.origin}${normalizeVolatileCheckoutPath(parsed.pathname)}`;
+    }
+    catch { }
+    return createHmac("sha256", session.compactV2Secret)
+        .update(`${session.browser.mainDocumentIdentity()}\u0000${location}`)
+        .digest("base64url");
+}
+/**
+ * Mint the durable, document-scoped handle for every element in one inventory.
+ * The session HMAC makes a handle unforgeable and unlinkable across sessions;
+ * folding the epoch's `doc` into it is what makes a ref die on a real
+ * navigation without any snapshot bookkeeping — a handle simply stops being
+ * producible by any live element once the document is replaced.
+ */
+function compactV2Handles(session, elements) {
+    const doc = compactV2EpochDoc(session);
+    const handles = new Map();
+    for (const [element, fingerprint] of elementFingerprints(elements)) {
+        const digest = createHmac("sha256", session.compactV2Secret)
+            .update(`${doc}\u001f${fingerprint}`)
+            .digest("base64url")
+            .slice(0, COMPACT_V2_HANDLE_LENGTH);
+        handles.set(element, `@e:${digest}`);
+    }
+    return handles;
+}
+/** The live skeleton for an element inventory, under the session's epoch. */
+function compactV2LiveControls(session, elements) {
+    let pageOrigin = "";
+    try {
+        pageOrigin = new URL(session.browser.currentUrl()).origin;
+    }
+    catch { }
+    return buildSafeControlsV2({
+        elements,
+        legacyRefs: provisionElementRefs(elements),
+        handles: compactV2Handles(session, elements),
+        pageOrigin,
+        pageUrl: session.browser.currentUrl(),
+    });
+}
+function parseCompactV2Cursor(session, cursor, expectedScope) {
+    const [body, signature, extra] = cursor.split(".");
+    if (body === undefined || signature === undefined || extra !== undefined)
+        throw new Error("invalid_cursor");
+    const expected = createHmac("sha256", session.compactV2Secret)
+        .update(body)
+        .digest("base64url")
+        .slice(0, 12);
+    if (signature !== expected)
+        throw new Error("invalid_cursor");
+    const [revRaw, offsetRaw, scope, extraPart] = body.split(":");
+    if (revRaw === undefined ||
+        offsetRaw === undefined ||
+        scope === undefined ||
+        extraPart !== undefined ||
+        scope !== expectedScope) {
+        throw new Error("invalid_cursor");
+    }
+    const rev = Number.parseInt(revRaw, 36);
+    const offset = Number.parseInt(offsetRaw, 36);
+    if (!Number.isSafeInteger(rev) ||
+        !Number.isSafeInteger(offset) ||
+        offset < 0 ||
+        rev.toString(36) !== revRaw ||
+        offset.toString(36) !== offsetRaw) {
+        throw new Error("stale_cursor");
+    }
+    return { rev, offset };
+}
+function compactV2HintPage(session, index, offset) {
+    const hint = session.compactV2HintPages[offset];
+    if (hint === undefined)
+        throw new Error("invalid_cursor");
+    const nextOffset = offset + 1;
+    const remaining = session.compactV2HintPages.length - nextOffset;
+    const payload = {
+        format: "compact-v2",
+        url: "",
+        text: "",
+        session_id: session.id,
+        stage: index.stage,
+        hint,
+        ...(remaining > 0
+            ? {
+                hint_overflow: {
+                    remaining,
+                    next_cursor: compactV2Cursor(session, index.epoch.rev, nextOffset, compactV2HintCursorScope(session)),
+                },
+            }
+            : {}),
+    };
+    if (!compactV2PayloadWithinBudget(payload)) {
+        throw new Error("compact-v2 budget metadata exceeded");
+    }
+    return payload;
+}
+function compactV2PublicObservation(session, legacy, fields) {
+    if (session.compactV2Mode !== "on")
+        return legacy();
+    session.compactV2Active = true;
+    const payload = {
+        format: "compact-v2",
+        session_id: session.id,
+        url: session.browser.currentUrl(),
+        text: "",
+        stage: fields.stage,
+        ...(fields.guidance === undefined ? {} : { guidance: fields.guidance }),
+        ...(fields.oauth === undefined ? {} : { oauth: fields.oauth }),
+        ...(fields.observed === undefined ? {} : { observed: fields.observed }),
+    };
+    if (!compactV2PayloadWithinBudget(payload)) {
+        throw new Error("compact-v2 budget metadata exceeded");
+    }
+    return payload;
+}
+function compactV2Observation(session, generation, elements, semanticSource, startMetadata) {
+    if (startMetadata?.hintPages !== undefined) {
+        session.compactV2HintPages = [...startMetadata.hintPages];
+    }
+    const stage = safeStageV2(session.browser.currentUrl(), elements);
+    const semantics = safePageSemanticsV2(semanticSource);
+    const epochDoc = compactV2EpochDoc(session);
+    const previous = session.compactV2Previous;
+    const sameDocument = previous !== null && previous.epoch.doc === epochDoc;
+    const safe = compactV2LiveControls(session, elements);
+    let delta = sameDocument ? diffSafeControlsV2(previous, stage, safe.rows) : null;
+    const privateBindingsChanged = sameDocument &&
+        (session.compactV2Refs.size !== safe.byRef.size ||
+            [...safe.byRef].some(([ref, legacy]) => session.compactV2Refs.get(ref) !== legacy));
+    const requiresResync = !sameDocument ||
+        delta === null ||
+        delta.stageChanged ||
+        privateBindingsChanged ||
+        delta.added.length > 0 ||
+        delta.changed.length > 0 ||
+        delta.removed.length > 0;
+    if (requiresResync)
+        delta = null;
+    // The epoch's DOM-mutation counter advances only when the skeleton actually
+    // changed. Refs are fingerprint-derived and survive it; paging cursors are
+    // positional and bound to it, so a cursor minted before a re-render dies.
+    const epoch = {
+        doc: epochDoc,
+        rev: sameDocument && !requiresResync ? previous.epoch.rev : generation,
+    };
+    const index = {
+        epoch,
+        stage,
+        semantics,
+        rows: safe.rows,
+        byRef: safe.byRef,
+        expiresAt: Date.now() + 5 * 60_000,
+    };
+    // Raw DOM values fall out of scope here.
+    // Only this enum-only index survives to delta/query/action resolution.
+    session.compactV2Active = true;
+    session.compactV2Index = index;
+    session.compactV2Refs = safe.byRef;
+    session.compactV2Previous = {
+        epoch,
+        stage,
+        semantics,
+        byRef: new Map(safe.rows.map((row) => [row.ref, row])),
+    };
+    session.prevObserve = null;
+    if (previous !== null && !requiresResync && delta !== null) {
+        const encodedDelta = encodeV2Delta({
+            sessionId: session.id,
+            stage,
+            pageUrl: session.browser.currentUrl(),
+            // The first V2 page establishes semantic essentials. On a delta they
+            // are sticky, so resend only a sealed semantic change rather than the
+            // same title/heading on every harmless re-observe.
+            semantics: equalSafePageSemanticsV2(previous.semantics, semantics) ? undefined : semantics,
+            delta,
+        });
+        // A high-churn delta is less useful than a fresh paged map.  This also
+        // guarantees any overflow remains in the MCP cursor protocol.
+        if (encodedDelta !== null)
+            return encodedDelta;
+    }
+    const page = encodeV2Page({
+        sessionId: session.id,
+        stage: index.stage,
+        pageUrl: session.browser.currentUrl(),
+        semantics,
+        rows: index.rows,
+        cursorFor: (offset) => compactV2Cursor(session, epoch.rev, offset, compactV2QueryCursorScope(session, "", undefined)),
+        ...(startMetadata === undefined
+            ? {}
+            : {
+                startMetadata: {
+                    ...(session.compactV2HintPages[0] === undefined
+                        ? {}
+                        : { hint: session.compactV2HintPages[0] }),
+                    ...(startMetadata.userEmail === undefined
+                        ? {}
+                        : { userEmail: startMetadata.userEmail }),
+                    ...(session.compactV2HintPages.length <= 1
+                        ? {}
+                        : {
+                            hintOverflow: {
+                                remaining: session.compactV2HintPages.length - 1,
+                                next_cursor: compactV2Cursor(session, epoch.rev, 1, compactV2HintCursorScope(session)),
+                            },
+                        }),
+                },
+            }),
+    });
+    return page.payload;
+}
+function exerciseCompactV2Shadow(session, generation, elements, semanticSource) {
+    const saved = {
+        compactV2Active: session.compactV2Active,
+        compactV2Index: session.compactV2Index,
+        compactV2Refs: session.compactV2Refs,
+        compactV2Previous: session.compactV2Previous,
+        prevObserve: session.prevObserve,
+    };
+    try {
+        compactV2Observation(session, generation, elements, semanticSource);
+    }
+    catch {
+    }
+    finally {
+        session.compactV2Active = saved.compactV2Active;
+        session.compactV2Index = saved.compactV2Index;
+        session.compactV2Refs = saved.compactV2Refs;
+        session.compactV2Previous = saved.compactV2Previous;
+        session.prevObserve = saved.prevObserve;
+    }
+}
+export async function observeQuery(sessionId, query, role, cursor) {
+    const session = sessionForCall(sessionId);
+    if (session === undefined)
+        throw new Error(`unknown provision session ${sessionId}`);
+    const index = session.compactV2Index;
+    if (index === null || index.expiresAt < Date.now())
+        throw new Error("stale_cursor");
+    // Query/paging is part of the same sealed action-map protocol: never return
+    // rows from a page whose private binding no longer matches the live page.
+    if (index.epoch.doc !== compactV2EpochDoc(session)) {
+        invalidateCompactV2Snapshot(session);
+        throw new Error("stale_cursor");
+    }
+    const needle = norm(query);
+    const cursorScope = compactV2QueryCursorScope(session, needle, role);
+    let offset = 0;
+    if (cursor !== undefined) {
+        if (needle.length === 0 && role === undefined && session.compactV2HintPages.length > 0) {
+            try {
+                const parsed = parseCompactV2Cursor(session, cursor, compactV2HintCursorScope(session));
+                if (parsed.rev !== index.epoch.rev)
+                    throw new Error("stale_cursor");
+                return compactV2HintPage(session, index, parsed.offset);
+            }
+            catch (error) {
+                if (!(error instanceof Error) || error.message !== "invalid_cursor")
+                    throw error;
+            }
+        }
+        const parsed = parseCompactV2Cursor(session, cursor, cursorScope);
+        if (parsed.rev !== index.epoch.rev)
+            throw new Error("stale_cursor");
+        offset = parsed.offset;
+    }
+    const liveElements = await session.browser.extractInteractiveElements();
+    const liveSafe = compactV2LiveControls(session, liveElements);
+    const liveUnchanged = liveSafe.rows.length === index.rows.length &&
+        liveSafe.byRef.size === session.compactV2Refs.size &&
+        liveSafe.rows.every((row, rowIndex) => sameCompactV2Control(row, index.rows[rowIndex])) &&
+        [...liveSafe.byRef].every(([ref, legacy]) => session.compactV2Refs.get(ref) === legacy);
+    let snapshotRows = index.rows;
+    let pagingStage = index.stage;
+    let pagingRev = index.epoch.rev;
+    if (!liveUnchanged) {
+        // Benign live re-render (validation states appearing, dynamic fields
+        // toggling, rotating checkout query tokens): re-serialize the same
+        // document instead of failing the page. Refs are unaffected — they are
+        // fingerprint-derived — but the positional page offsets are not, so the
+        // epoch's revision advances and cursors minted here bind to the fresh map.
+        session.generation += 1;
+        pagingRev = session.generation;
+        pagingStage = safeStageV2(session.browser.currentUrl(), liveElements);
+        snapshotRows = liveSafe.rows;
+        const epoch = { doc: index.epoch.doc, rev: pagingRev };
+        session.compactV2Index = {
+            epoch,
+            stage: pagingStage,
+            semantics: index.semantics,
+            rows: liveSafe.rows,
+            byRef: liveSafe.byRef,
+            expiresAt: Date.now() + 5 * 60_000,
+        };
+        session.compactV2Refs = liveSafe.byRef;
+        session.compactV2Previous = {
+            epoch,
+            stage: pagingStage,
+            semantics: index.semantics,
+            byRef: new Map(liveSafe.rows.map((row) => [row.ref, row])),
+        };
+    }
+    const liveByLegacy = new Map();
+    for (const [element, legacy] of provisionElementRefs(liveElements)) {
+        liveByLegacy.set(legacy, element);
+    }
+    const privateMatches = new Set();
+    if (needle.length > 0) {
+        for (const [ref, legacy] of session.compactV2Refs) {
+            const element = liveByLegacy.get(legacy);
+            if (element !== undefined && controlMatchesPrivateQueryV2(element, query)) {
+                privateMatches.add(ref);
+            }
+        }
+    }
+    const rows = snapshotRows.filter((row) => {
+        const searchable = [
+            row.label,
+            row.role,
+            row.state,
+            row.visibility,
+            row.action,
+            row.field,
+            row.choice,
+            row.frame,
+        ]
+            .filter((value) => value !== undefined)
+            .map(norm);
+        return ((needle.length === 0 ||
+            searchable.some((value) => value.includes(needle)) ||
+            privateMatches.has(row.ref)) &&
+            (role === undefined || row.role === role));
+    });
+    const page = encodeV2Page({
+        sessionId: session.id,
+        stage: pagingStage,
+        pageUrl: session.browser.currentUrl(),
+        semantics: index.semantics,
+        rows,
+        offset,
+        cursorFor: (next) => compactV2Cursor(session, pagingRev, next, cursorScope),
+    });
+    return page.payload;
+}
+async function observeSession(session, detail = "compact", startMetadata) {
     const oauthInProgress = () => {
         session.prevObserve = null;
+        invalidateCompactV2Snapshot(session);
         const oauth = session.browser.oauthTransitionStatus?.();
-        const observation = {
+        const guidance = "OAuth in progress: the provider detached or closed its page as expected. " +
+            "Do not switch login methods or close the session; call operate_observe again to read the retained product page.";
+        const state = {
+            state: "in_progress",
+            provider_page: "closed_or_detached",
+            next_action: "operate_observe",
+        };
+        session.browser.completeOAuthTransitionRecovery();
+        return compactV2PublicObservation(session, () => ({
             session_id: session.id,
             url: oauth?.productUrl ?? session.startUrl,
             text: "",
-            guidance: "OAuth in progress: the provider detached or closed its page as expected. " +
-                "Do not switch login methods or close the session; call operate_observe again to read the retained product page.",
+            guidance,
             elements: [],
-            oauth: {
-                state: "in_progress",
-                provider_page: "closed_or_detached",
-                next_action: "operate_observe",
-            },
-        };
-        session.browser.completeOAuthTransitionRecovery();
-        return observation;
+            oauth: state,
+        }), { stage: "auth", guidance, oauth: state });
     };
     try {
         session.browser.recoverActivePage();
@@ -3367,9 +3213,27 @@ async function observeSession(session, detail = "compact") {
         session.generation += 1;
         const generation = session.generation;
         const elements = await session.browser.extractInteractiveElements();
-        session.lastElements = elements;
-        const sealedFieldKeys = observationSealedFieldKeys(session, elements);
-        const text = redactPaymentObservationText(await session.browser.extractVisibleText(), elements, session.paymentFieldSealActive);
+        retainSessionElements(session, elements);
+        let semanticSource = { title: "", headings: [] };
+        try {
+            semanticSource = await session.browser.extractObservationSemantics();
+        }
+        catch {
+            // Semantic context is optional availability-wise; it is independently
+            // sealed below and never changes action-map safety.
+        }
+        // Native TypeScript compact serializer over TS's own CDP-derived DOM
+        // inventory. Its allowlist seal runs before any retained/emitted view; no
+        // Python subprocess or externally provisioned runtime participates.
+        const v2Mode = session.compactV2Mode;
+        if (v2Mode === "on") {
+            return compactV2Observation(session, generation, elements, semanticSource, startMetadata);
+        }
+        if (v2Mode === "shadow")
+            exerciseCompactV2Shadow(session, generation, elements, semanticSource);
+        session.compactV2Active = false;
+        invalidateCompactV2Snapshot(session);
+        const text = await session.browser.extractVisibleText();
         const normalizedFull = text.replace(/\s+/g, " ").trim();
         const normalizedText = normalizedFull.slice(0, 4000);
         const guidance = provisionPerceptionGuidance(normalizedText);
@@ -3389,8 +3253,6 @@ async function observeSession(session, detail = "compact") {
                 textTruncated,
                 ...(guidance !== undefined ? { guidance } : {}),
                 elements,
-                sealed: sealedFieldKeys,
-                paymentSealActive: session.paymentFieldSealActive,
                 prev: session.prevObserve,
             });
             // Persist the COMPLETE snapshot (path INCLUDED) — the safety net that makes
@@ -3437,9 +3299,9 @@ async function observeSession(session, detail = "compact") {
         // full-only observe can't restore stale state (the previous compact snapshot).
         // Deliberately NOT surfaced in the payload — the full escape hatch stays
         // byte-equivalent to the legacy shape (no snapshot_file field added).
-        persistObserveSnapshot(session, generation, url, normalizedText, textTruncated, elements.map((el) => toCompactElement(el, refOf(el), sealedFieldKeys, true, false, session.paymentFieldSealActive)));
-        const screen = buildScreenOutline(elements, normalizedText, sealedFieldKeys, session.paymentFieldSealActive);
-        const accessibility = buildAccessibilitySnapshot(elements, undefined, sealedFieldKeys, session.paymentFieldSealActive);
+        persistObserveSnapshot(session, generation, url, normalizedText, textTruncated, elements.map((el) => toCompactElement(el, refOf(el), true, false)));
+        const screen = buildScreenOutline(elements, normalizedText);
+        const accessibility = buildAccessibilitySnapshot(elements);
         return withCheckoutState({
             session_id: session.id,
             url,
@@ -3450,35 +3312,35 @@ async function observeSession(session, detail = "compact") {
             elements: elements.map((el) => {
                 const observed = {
                     ref: refOf(el),
-                    label: presentLabel(el, sealedFieldKeys, session.paymentFieldSealActive),
-                    tag: presentPaymentSafeString(el.tag, session.paymentFieldSealActive),
+                    label: elementRef(el),
+                    tag: el.tag,
                     role: el.role === null
                         ? null
-                        : presentPaymentSafeString(el.role, session.paymentFieldSealActive),
+                        : el.role,
                     type: el.type === null
                         ? null
-                        : presentPaymentSafeString(el.type, session.paymentFieldSealActive),
-                    value: presentFieldValue(el, sealedFieldKeys, session.paymentFieldSealActive),
+                        : el.type,
+                    value: (el.value ?? null),
                     checked: el.checked ?? null,
                     href: el.href === null || el.href === undefined
                         ? null
-                        : presentPaymentSafeString(el.href, session.paymentFieldSealActive),
+                        : el.href,
                     testId: el.testId === null || el.testId === undefined
                         ? null
-                        : presentPaymentSafeString(el.testId, session.paymentFieldSealActive),
+                        : el.testId,
                     path: el.screenPath === null || el.screenPath === undefined
                         ? null
-                        : presentPaymentSafeString(el.screenPath, session.paymentFieldSealActive),
+                        : el.screenPath,
                     container: el.container === null || el.container === undefined
                         ? null
-                        : presentPaymentSafeString(el.container, session.paymentFieldSealActive),
+                        : el.container,
                     topmost: el.topmost ?? null,
                     occluded_by: el.occludedBy === null || el.occludedBy === undefined
                         ? null
-                        : presentPaymentSafeString(el.occludedBy, session.paymentFieldSealActive),
+                        : el.occludedBy,
                     frame_origin: el.frameOrigin === null || el.frameOrigin === undefined
                         ? null
-                        : presentPaymentSafeString(el.frameOrigin, session.paymentFieldSealActive),
+                        : el.frameOrigin,
                 };
                 annotatePaymentControl(observed, el);
                 return observed;
@@ -3594,7 +3456,42 @@ async function runClickWithPlaceOrderGuard(session, click) {
     }
     await recordPlaceOrderAttemptAudit(session, approval);
 }
+async function actInternally(sessionId, action, detail = "compact", cartIdentity, collectCheckoutState = false, compactV2Authorization) {
+    const session = sessionForCall(sessionId);
+    const oauthProvider = action.kind === "oauth_login" || action.kind === "oauth_click" ? action.provider : undefined;
+    try {
+        const execute = async (deadline) => await executeAct(sessionId, action, detail, cartIdentity, true, collectCheckoutState, compactV2Authorization, deadline);
+        return session !== undefined && (action.kind === "oauth_login" || action.kind === "oauth_click")
+            ? await withOAuthActionBoundary(session, oauthProvider, execute)
+            : await execute(undefined);
+    }
+    catch (error) {
+        if (session?.compactV2Active === true &&
+            !(error instanceof ManualCardEntryBlockedError) &&
+            !(error instanceof ProvisionTargetMissingError)) {
+            throw new CompactV2ActionFailureError(compactV2ActionFailureReason(error, action.kind));
+        }
+        throw error;
+    }
+}
 export async function act(sessionId, action, detail = "compact", cartIdentity) {
+    const session = sessionForCall(sessionId);
+    const oauthProvider = action.kind === "oauth_login" || action.kind === "oauth_click" ? action.provider : undefined;
+    try {
+        const execute = async (deadline) => await executeAct(sessionId, action, detail, cartIdentity, false, false, undefined, deadline);
+        const result = session !== undefined && (action.kind === "oauth_login" || action.kind === "oauth_click")
+            ? await withOAuthActionBoundary(session, oauthProvider, execute)
+            : await execute(undefined);
+        return result.observation;
+    }
+    catch (error) {
+        if (session?.compactV2Active === true) {
+            throw new Error(compactV2ActionFailureReason(error, action.kind));
+        }
+        throw error;
+    }
+}
+async function executeAct(sessionId, action, detail, cartIdentity, internalAccess, collectCheckoutState, internalAuthorization, oauthDeadline) {
     const session = sessionForCall(sessionId);
     if (session === undefined)
         throw new Error(`unknown provision session ${sessionId}`);
@@ -3610,7 +3507,7 @@ export async function act(sessionId, action, detail = "compact", cartIdentity) {
         if (cardBlock !== null)
             throw new ManualCardEntryBlockedError(cardBlock);
     }
-    const { browser } = session;
+    let browser = session.browser;
     let completedAction = action;
     let sensitiveSource;
     let cartAffecting = false;
@@ -3623,15 +3520,37 @@ export async function act(sessionId, action, detail = "compact", cartIdentity) {
         cartAffecting = true;
         cartIdentity.onActionReady?.();
     };
-    const auditTarget = "target" in action && parseLocatorTarget(action.target) !== null
-        ? "<mode>=<redacted>"
-        : "target" in action
-            ? action.target
-            : undefined;
+    let resolutionTarget;
+    let auditTarget;
+    let compactV2Authorization = internalAuthorization;
+    if ("target" in action) {
+        if (session.compactV2Active && !internalAccess) {
+            try {
+                compactV2Authorization = compactV2AuthorizationForTarget(session, action.target);
+                resolutionTarget = compactV2Authorization.legacyRef;
+                auditTarget = action.target;
+            }
+            catch (error) {
+                audit(sessionId, "act", { kind: action.kind, target: "<rejected-v2-target>" });
+                throw error;
+            }
+        }
+        else {
+            resolutionTarget = action.target;
+            auditTarget =
+                session.compactV2Active && internalAccess
+                    ? "<internal-target>"
+                    : parseLocatorTarget(action.target) !== null
+                        ? "<mode>=<redacted>"
+                        : action.target;
+        }
+    }
     audit(sessionId, "act", {
         kind: action.kind,
         ...(auditTarget !== undefined ? { target: auditTarget } : {}),
-        ...("url" in action ? { url: action.url } : {}),
+        ...("url" in action
+            ? { url: session.compactV2Active ? compactV2AuditUrl(action.url) : action.url }
+            : {}),
     });
     // The URL the action is taken ON — captured BEFORE the action navigates. The
     // capture round pairs this with the pre-action inventory + observed; using
@@ -3653,7 +3572,7 @@ export async function act(sessionId, action, detail = "compact", cartIdentity) {
             curHost = null;
         }
         if (curHost !== null && isSquireControlPlaneHost(curHost)) {
-            throw new Error(`action refused: the browser is on Squire's own control plane (${curHost}). ` +
+            throw new ProvisionTargetNotAllowedError(`action refused: the browser is on Squire's own control plane (${curHost}). ` +
                 `The operator may not act on the Trusty Squire vault/app — navigate away with goto.`);
         }
     }
@@ -3661,410 +3580,486 @@ export async function act(sessionId, action, detail = "compact", cartIdentity) {
     // Captured for the operator-recipe trace: the element a target action
     // resolved to, so we record the VISIBLE text it acted on (not the ref).
     let resolvedEl = null;
-    switch (action.kind) {
-        case "goto": {
-            if (!hostAllowed(action.url, hostStrings(session))) {
-                throw new Error(`goto blocked by domain-scope: ${action.url} is outside the allowed hosts ` +
-                    `[${hostStrings(session).join(", ")}] + auth providers. ` +
-                    `Declare it first with an allow_host action if this task spans it.`);
+    try {
+        switch (action.kind) {
+            case "goto": {
+                if (!hostAllowed(action.url, hostStrings(session))) {
+                    throw new ProvisionTargetNotAllowedError(`goto blocked by domain-scope: ${action.url} is outside the allowed hosts ` +
+                        `[${hostStrings(session).join(", ")}] + auth providers. ` +
+                        `Declare it first with an allow_host action if this task spans it.`);
+                }
+                await browser.goto(action.url);
+                break;
             }
-            await browser.goto(action.url);
-            break;
-        }
-        case "allow_host": {
-            const checked = validateAllowHost(action.host);
-            if ("error" in checked) {
-                throw new Error(`allow_host rejected "${action.host}": ${checked.error}`);
+            case "allow_host": {
+                const checked = validateAllowHost(action.host);
+                if ("error" in checked) {
+                    throw new ProvisionTargetNotAllowedError(`allow_host rejected "${action.host}": ${checked.error}`);
+                }
+                if (!session.allowedHosts.some((e) => e.host === checked.host)) {
+                    session.allowedHosts.push({ host: checked.host, source: "mid_session" });
+                    audit(sessionId, "allow_host", {
+                        host: checked.host,
+                        allowed_hosts: hostStrings(session),
+                    });
+                }
+                break;
             }
-            if (!session.allowedHosts.some((e) => e.host === checked.host)) {
-                session.allowedHosts.push({ host: checked.host, source: "mid_session" });
-                audit(sessionId, "allow_host", { host: checked.host, allowed_hosts: hostStrings(session) });
+            case "press": {
+                await browser.pressKey(action.key);
+                break;
             }
-            break;
-        }
-        case "press": {
-            await browser.pressKey(action.key);
-            break;
-        }
-        case "oauth_settle": {
-            await browser.settleAfterOAuth();
-            break;
-        }
-        case "scroll": {
-            await browser.scrollViewport(action.direction ?? "down");
-            break;
-        }
-        case "type_secret": {
-            const value = session.secretSlots.get(action.slot);
-            if (value === undefined) {
-                throw new Error(`type_secret: no sealed slot named "${action.slot}". Capture it first with ` +
-                    `operate_act { kind: "extract", into_slot: "${action.slot}" }. Known slots: ` +
-                    `[${[...session.secretSlots.keys()].join(", ")}]`);
+            case "oauth_settle": {
+                await browser.settleAfterOAuth();
+                break;
             }
-            sensitiveSource = {
-                traceIndex: -1,
-                hole: `credential.${action.slot}`,
-                literal: value,
-            };
-            const locator = parseLocatorTarget(action.target);
-            if (locator !== null) {
-                const resolved = await browser.resolvePageTarget(locator.mode, locator.value, "type");
-                if (!resolved.ok) {
-                    if (resolved.reason === "none") {
-                        throw new Error(`type_secret: no element matched locator "${action.target}".`);
-                    }
-                    throw new AmbiguousProvisionTargetError(action.target, resolved.candidates);
+            case "scroll": {
+                await browser.scrollViewport(action.direction ?? "down");
+                break;
+            }
+            case "type_secret": {
+                const value = session.secretSlots.get(action.slot);
+                if (value === undefined) {
+                    throw new Error(`type_secret: no sealed slot named "${action.slot}". Capture it first with ` +
+                        `operate_act { kind: "extract", into_slot: "${action.slot}" }. Known slots: ` +
+                        `[${[...session.secretSlots.keys()].join(", ")}]`);
                 }
-                try {
-                    if (resolved.frameTarget !== null) {
-                        assertSecretFrameTargetAllowed(session, resolved.frameTarget);
+                sensitiveSource = {
+                    traceIndex: -1,
+                    hole: `credential.${action.slot}`,
+                    literal: value,
+                };
+                const locator = parseLocatorTarget(resolutionTarget);
+                if (locator !== null) {
+                    const resolved = await browser.resolvePageTarget(locator.mode, locator.value, "type");
+                    if (!resolved.ok) {
+                        if (resolved.reason === "none") {
+                            throw new Error(`type_secret: no element matched locator "${action.target}".`);
+                        }
+                        throw new AmbiguousProvisionTargetError(action.target, resolved.candidates);
                     }
-                    session.usedLocatorFallback = true;
-                    const sealedFieldKeys = await browser.typeHandle(resolved.handle, value, true);
-                    for (const key of sealedFieldKeys)
-                        session.sealedFieldKeys.add(key);
+                    try {
+                        if (resolved.frameTarget !== null) {
+                            assertSecretFrameTargetAllowed(session, resolved.frameTarget);
+                        }
+                        session.usedLocatorFallback = true;
+                        await browser.typeHandle(resolved.handle, value, true);
+                    }
+                    finally {
+                        await resolved.handle.dispose().catch(() => undefined);
+                    }
+                    audit(sessionId, "type_secret", {
+                        slot: action.slot,
+                        locator_mode: locator.mode,
+                        host: registrableHost(browser.currentUrl()),
+                    });
+                    break;
                 }
-                finally {
-                    await resolved.handle.dispose().catch(() => undefined);
+                const fresh = await browser.extractInteractiveElements();
+                retainSessionElements(session, fresh);
+                // resolveTarget recomputes identities (incl. volatile positional-group
+                // fingerprints) from these FRESH elements, so a ref whose group fingerprint
+                // changed since the last observe resolves to null, not a survivor (#399).
+                const el = compactV2Authorization === undefined
+                    ? resolveTarget(fresh, resolutionTarget)
+                    : resolveAuthorizedCompactV2Target(session, fresh, compactV2Authorization);
+                if (el === null) {
+                    if (session.compactV2Active) {
+                        if (!internalAccess)
+                            throwCompactV2StaleRef();
+                        throw new Error("type_secret: internal live target changed");
+                    }
+                    const stale = staleTargetError(session, action.target, fresh);
+                    if (stale !== null)
+                        throw stale;
+                    throw new Error(`type_secret: no element matched target "${action.target}".`);
                 }
+                resolvedEl = el;
+                // Frame domain-lock (operator-frame-support) — never let a secret cross
+                // into a rogue/third-party (e.g. payment) iframe. See
+                // assertSecretFrameTargetAllowed; a main-frame or same-domain-frame
+                // target is unaffected.
+                assertSecretFrameTargetAllowed(session, el);
+                // Type the REAL value into the page. It crosses only browser↔page; the
+                // value is never returned to the host and never logged.
+                const target = frameTargetFor(el);
+                if (target !== null)
+                    await browser.typeInFrame(target, el.selector, value, true);
+                else
+                    await browser.type(el.selector, value, true);
                 audit(sessionId, "type_secret", {
                     slot: action.slot,
-                    locator_mode: locator.mode,
+                    target: auditTarget,
                     host: registrableHost(browser.currentUrl()),
                 });
                 break;
             }
-            const fresh = await browser.extractInteractiveElements();
-            session.lastElements = fresh;
-            // resolveTarget recomputes identities (incl. volatile positional-group
-            // fingerprints) from these FRESH elements, so a ref whose group fingerprint
-            // changed since the last observe resolves to null, not a survivor (#399).
-            const el = resolveTarget(fresh, action.target);
-            if (el === null) {
-                const stale = staleTargetError(session, action.target, fresh);
-                if (stale !== null)
-                    throw stale;
-                throw new Error(`type_secret: no element matched target "${action.target}".`);
+            case "select": {
+                // Re-resolve against FRESH elements — the target may be the <select> or
+                // its <label>. Main-frame execution uses selectOption; frame execution
+                // uses selectInFrame. text is the fuzzy option matcher in both paths.
+                const fresh = await browser.extractInteractiveElements();
+                retainSessionElements(session, fresh);
+                const el = compactV2Authorization === undefined
+                    ? resolveTarget(fresh, resolutionTarget)
+                    : resolveAuthorizedCompactV2Target(session, fresh, compactV2Authorization);
+                if (el === null) {
+                    if (session.compactV2Active) {
+                        if (!internalAccess)
+                            throwCompactV2StaleRef();
+                        throw new Error("select: internal live target changed");
+                    }
+                    const stale = staleTargetError(session, action.target, fresh);
+                    if (stale !== null)
+                        throw stale;
+                    throw new Error(`select: no element matched target "${action.target}". Visible: ` +
+                        fresh
+                            .map((e) => `"${e.screenPath ?? elementRef(e)}"`)
+                            .slice(0, 20)
+                            .join(", "));
+                }
+                resolvedEl = el;
+                // Frame domain-lock (operator-frame-support) — the SAME gate a frame
+                // click/type passes; see frameTargetAllowed. A native <select> is not a
+                // secret field, so the stricter type_secret cross-origin rule does not
+                // apply, but the ordinary domain lock does.
+                assertFrameTargetAllowed(session, el, "select");
+                bindCartIdentity(isCartAffectingAction(action, el));
+                const selectFrame = frameTargetFor(el);
+                const committedText = selectFrame !== null
+                    ? await browser.selectInFrame(selectFrame, el.selector, action.text)
+                    : await browser.selectOption(el.selector, action.text);
+                session.committedSelectValues.set(compactV2CommittedSelectKey(session, el.selector), compactV2CommittedSelectValue(session, committedText));
+                completedAction = { ...action, text: committedText };
+                await settleAfterStateChange(browser);
+                break;
             }
-            resolvedEl = el;
-            // Frame domain-lock (operator-frame-support) — never let a secret cross
-            // into a rogue/third-party (e.g. payment) iframe. See
-            // assertSecretFrameTargetAllowed; a main-frame or same-domain-frame
-            // target is unaffected.
-            assertSecretFrameTargetAllowed(session, el);
-            // Type the REAL value into the page. It crosses only browser↔page; the
-            // value is never returned to the host and never logged.
-            const target = frameTargetFor(el);
-            const sealedFieldKeys = target !== null
-                ? await browser.typeInFrame(target, el.selector, value, true)
-                : await browser.type(el.selector, value, true);
-            for (const key of sealedFieldKeys)
-                session.sealedFieldKeys.add(key);
-            audit(sessionId, "type_secret", {
-                slot: action.slot,
-                target: action.target,
-                host: registrableHost(browser.currentUrl()),
-            });
-            break;
-        }
-        case "select": {
-            // Re-resolve against FRESH elements — the target may be the <select> or
-            // its <label>. Main-frame execution uses selectOption; frame execution
-            // uses selectInFrame. text is the fuzzy option matcher in both paths.
-            const fresh = await browser.extractInteractiveElements();
-            session.lastElements = fresh;
-            const el = resolveTarget(fresh, action.target);
-            if (el === null) {
-                const stale = staleTargetError(session, action.target, fresh);
-                if (stale !== null)
-                    throw stale;
-                throw new Error(`select: no element matched target "${action.target}". Visible: ` +
-                    fresh
-                        .map((e) => `"${e.screenPath ?? elementRef(e)}"`)
-                        .slice(0, 20)
-                        .join(", "));
+            case "set_phone_country": {
+                // No captured element — the bot finds the phone-local native <select>.
+                // resolvedEl stays null; the step records without a captured-element
+                // trace (the country is host-replannable, not a replay recipe).
+                await browser.setPhoneCountry(action.country);
+                await settleAfterStateChange(browser);
+                break;
             }
-            resolvedEl = el;
-            // Frame domain-lock (operator-frame-support) — the SAME gate a frame
-            // click/type passes; see frameTargetAllowed. A native <select> is not a
-            // secret field, so the stricter type_secret cross-origin rule does not
-            // apply, but the ordinary domain lock does.
-            assertFrameTargetAllowed(session, el, "select");
-            bindCartIdentity(isCartAffectingAction(action, el));
-            const selectFrame = frameTargetFor(el);
-            const committedText = selectFrame !== null
-                ? await browser.selectInFrame(selectFrame, el.selector, action.text)
-                : await browser.selectOption(el.selector, action.text);
-            session.committedSelectValues.set(el.selector, committedText);
-            completedAction = { ...action, text: committedText };
-            await settleAfterStateChange(browser);
-            break;
-        }
-        case "set_phone_country": {
-            // No captured element — the bot finds the phone-local native <select>.
-            // resolvedEl stays null; the step records without a captured-element
-            // trace (the country is host-replannable, not a replay recipe).
-            await browser.setPhoneCountry(action.country);
-            await settleAfterStateChange(browser);
-            break;
-        }
-        case "click":
-        case "js_click":
-        case "type":
-        case "upload":
-        case "oauth_click": {
-            const pageText = await browser.extractVisibleText();
-            const blockReason = shouldBlockUnsafeProvisionAction(pageText, action);
-            if (blockReason !== null)
-                throw new Error(blockReason);
-            // Locator-form target (`text=…` / `css=…`): the host is pointing at a
-            // control that has NO `@e:` ref because the inventory never emitted it (a
-            // bare click-handler <div> with no role/label, e.g. a SPA "Add To Cart"
-            // that falls past the card-scan cap). Resolve it directly against the live
-            // page instead of the extracted-element list.
-            const locator = parseLocatorTarget(action.target);
-            if (locator !== null) {
-                if (action.kind !== "click" && action.kind !== "js_click" && action.kind !== "type") {
-                    throw new Error(`operate_act kind="${action.kind}" does not accept a text=/css= locator target; ` +
-                        `use an @e: ref from operate_observe.`);
+            case "click":
+            case "js_click":
+            case "type":
+            case "upload":
+            case "oauth_click": {
+                const pageText = await browser.extractVisibleText();
+                const blockReason = shouldBlockUnsafeProvisionAction(pageText, action);
+                if (blockReason !== null)
+                    throw new Error(blockReason);
+                // Locator-form target (`text=…` / `css=…`): the host is pointing at a
+                // control that has NO `@e:` ref because the inventory never emitted it (a
+                // bare click-handler <div> with no role/label, e.g. a SPA "Add To Cart"
+                // that falls past the card-scan cap). Resolve it directly against the live
+                // page instead of the extracted-element list.
+                const locator = parseLocatorTarget(resolutionTarget);
+                if (locator !== null) {
+                    if (action.kind !== "click" && action.kind !== "js_click" && action.kind !== "type") {
+                        throw new Error(`operate_act kind="${action.kind}" does not accept a text=/css= locator target; ` +
+                            `use an @e: ref from operate_observe.`);
+                    }
+                    const resolved = await browser.resolvePageTarget(locator.mode, locator.value, action.kind === "type" ? "type" : "click");
+                    if (!resolved.ok) {
+                        if (resolved.reason === "none") {
+                            throw new ProvisionTargetMissingError(`no element matched locator "${action.target}". If the control is visible, ` +
+                                `try a shorter/exact text= label or a css=<selector>.`);
+                        }
+                        throw new AmbiguousProvisionTargetError(action.target, resolved.candidates);
+                    }
+                    // The unsafe-action guard above inspected the RAW target, so an opaque
+                    // `css=<selector>` (or any target whose string carries no verb/noun the
+                    // guard matches) could resolve to a destructive billing/setup control the
+                    // guard couldn't see through — clicking "Save product" in live mode via
+                    // css=#submit. Re-run it against compact safety signals computed from the
+                    // resolved control now that we know what the locator actually points at.
+                    // Mark the session non-promotable BEFORE the action: a locator action can't
+                    // be replayed from the inventory (the element was never in it), so a
+                    // skill synthesized from this run would silently omit the step. Setting
+                    // it up front means an action that lands but then throws still can't leave
+                    // the session promotable (see captureAndPromoteSession) (codex).
+                    try {
+                        const resolvedBlock = shouldBlockUnsafeProvisionSignals(pageText, resolved.safetySignals);
+                        if (resolvedBlock !== null)
+                            throw new Error(resolvedBlock);
+                        if (resolved.frameTarget !== null) {
+                            assertFrameTargetAllowed(session, resolved.frameTarget, action.kind);
+                        }
+                        bindCartIdentity(isCartAffectingAction(action, null, resolved.labels));
+                        session.usedLocatorFallback = true;
+                        const isPlaceOrderCandidate = isCheckoutSubmitLabeled([
+                            resolved.text,
+                            ...resolved.labels,
+                        ]);
+                        if ((session.placeOrderApproval !== null || getActivePendingThreeDs(session) !== null) &&
+                            isPlaceOrderCandidate &&
+                            (action.kind === "click" || action.kind === "js_click")) {
+                            await runClickWithPlaceOrderGuard(session, (shouldTrack) => browser.clickWithDispatchTracking({
+                                kind: "handle",
+                                handle: resolved.handle,
+                                method: action.kind,
+                            }, shouldTrack));
+                        }
+                        else if (action.kind === "click" || action.kind === "js_click") {
+                            const method = action.kind;
+                            await adoptTabOpenedByClick(session, browser, async () => {
+                                if (method === "click")
+                                    await browser.clickHandle(resolved.handle);
+                                else
+                                    await browser.jsClickHandle(resolved.handle);
+                            });
+                        }
+                        else
+                            await browser.typeHandle(resolved.handle, action.text);
+                    }
+                    finally {
+                        await resolved.handle.dispose().catch(() => undefined);
+                    }
+                    audit(sessionId, action.kind, {
+                        locator_mode: locator.mode,
+                        host: registrableHost(browser.currentUrl()),
+                    });
+                    if (action.kind !== "type") {
+                        await settleAfterStateChange(browser);
+                        // A tab opened by JS a tick after the click lands during the
+                        // settle above, not inside the click's own grace window. Drain it
+                        // here — the queue is already populated, so this costs nothing.
+                        await adoptOpenedTab(session, browser, 0);
+                    }
+                    break;
                 }
-                const resolved = await browser.resolvePageTarget(locator.mode, locator.value, action.kind === "type" ? "type" : "click");
-                if (!resolved.ok) {
-                    if (resolved.reason === "none") {
-                        throw new Error(`no element matched locator "${action.target}". If the control is visible, ` +
-                            `try a shorter/exact text= label or a css=<selector>.`);
+                // Re-resolve against FRESH elements every act — never trust a stale index.
+                const fresh = await browser.extractInteractiveElements();
+                retainSessionElements(session, fresh);
+                // resolveTarget recomputes identities (incl. volatile positional-group
+                // fingerprints) from these FRESH elements, so a ref whose group fingerprint
+                // changed since the last observe resolves to null, not a survivor (#399).
+                const el = compactV2Authorization === undefined
+                    ? resolveTarget(fresh, resolutionTarget)
+                    : resolveAuthorizedCompactV2Target(session, fresh, compactV2Authorization);
+                if (el === null) {
+                    if (session.compactV2Active) {
+                        if (!internalAccess)
+                            throwCompactV2StaleRef();
+                        throw new Error(`${action.kind}: internal live target changed`);
                     }
-                    throw new AmbiguousProvisionTargetError(action.target, resolved.candidates);
+                    const stale = staleTargetError(session, action.target, fresh);
+                    if (stale !== null)
+                        throw stale;
+                    throw new Error(`no element matched target "${action.target}". Visible: ` +
+                        fresh
+                            .map((e) => `"${e.screenPath ?? elementRef(e)}"`)
+                            .slice(0, 20)
+                            .join(", "));
                 }
-                // The unsafe-action guard above inspected the RAW target, so an opaque
-                // `css=<selector>` (or any target whose string carries no verb/noun the
-                // guard matches) could resolve to a destructive billing/setup control the
-                // guard couldn't see through — clicking "Save product" in live mode via
-                // css=#submit. Re-run it against compact safety signals computed from the
-                // resolved control now that we know what the locator actually points at.
-                // Mark the session non-promotable BEFORE the action: a locator action can't
-                // be replayed from the inventory (the element was never in it), so a
-                // skill synthesized from this run would silently omit the step. Setting
-                // it up front means an action that lands but then throws still can't leave
-                // the session promotable (see captureAndPromoteSession) (codex).
-                try {
-                    const resolvedBlock = shouldBlockUnsafeProvisionSignals(pageText, resolved.safetySignals);
-                    if (resolvedBlock !== null)
-                        throw new Error(resolvedBlock);
-                    if (resolved.frameTarget !== null) {
-                        assertFrameTargetAllowed(session, resolved.frameTarget, action.kind);
+                resolvedEl = el;
+                // Frame domain-lock (operator-frame-support) — see frameTargetAllowed.
+                // A main-frame or same-domain-frame target is unaffected.
+                assertFrameTargetAllowed(session, el, action.kind);
+                bindCartIdentity(isCartAffectingAction(action, el));
+                if (action.kind === "click" || action.kind === "js_click") {
+                    const target = frameTargetFor(el);
+                    if ((session.placeOrderApproval !== null || getActivePendingThreeDs(session) !== null) &&
+                        isPlaceOrderClickCandidate(el)) {
+                        await runClickWithPlaceOrderGuard(session, (shouldTrack) => browser.clickWithDispatchTracking(target !== null
+                            ? { kind: "frame", frame: target, selector: el.selector, method: action.kind }
+                            : { kind: "selector", selector: el.selector, method: action.kind }, shouldTrack));
+                    }
+                    else if (action.kind === "click") {
+                        await adoptTabOpenedByClick(session, browser, async () => {
+                            if (target !== null)
+                                await browser.clickInFrame(target, el.selector);
+                            else
+                                await browser.click(el.selector);
+                        });
                     }
-                    bindCartIdentity(isCartAffectingAction(action, null, resolved.labels));
-                    session.usedLocatorFallback = true;
-                    const isPlaceOrderCandidate = isCheckoutSubmitLabeled([
-                        resolved.text,
-                        ...resolved.labels,
-                    ]);
-                    if (isPlaceOrderCandidate && (action.kind === "click" || action.kind === "js_click")) {
-                        await runClickWithPlaceOrderGuard(session, (shouldTrack) => browser.clickWithDispatchTracking({
-                            kind: "handle",
-                            handle: resolved.handle,
-                            method: action.kind,
-                        }, shouldTrack));
+                    else {
+                        await adoptTabOpenedByClick(session, browser, async () => {
+                            if (target !== null)
+                                await browser.clickViaJsInFrame(target, el.selector);
+                            else
+                                await browser.clickViaJs(el.selector);
+                        });
                     }
-                    else if (action.kind === "click")
-                        await browser.clickHandle(resolved.handle);
-                    else if (action.kind === "js_click")
-                        await browser.jsClickHandle(resolved.handle);
-                    else
-                        await browser.typeHandle(resolved.handle, action.text);
                 }
-                finally {
-                    await resolved.handle.dispose().catch(() => undefined);
+                else if (action.kind === "type" && frameTargetFor(el) !== null) {
+                    // Frame targets skip the autocomplete-popup-commit machinery below —
+                    // it operates on the main page's DOM only (markPreexistingType
+                    // SuggestionPopups / detectTypeSuggestionPopup / commitTypeSuggestion
+                    // are page-scoped). Out of scope for the checkout-option case frame
+                    // support exists for; a plain frame-scoped fill covers it.
+                    clearCommittedSelectValue(session, el.selector);
+                    await browser.typeInFrame(frameTargetFor(el), el.selector, action.text);
                 }
-                audit(sessionId, action.kind, {
-                    locator_mode: locator.mode,
-                    host: registrableHost(browser.currentUrl()),
-                });
-                if (action.kind !== "type")
-                    await settleAfterStateChange(browser);
-                break;
-            }
-            // Re-resolve against FRESH elements every act — never trust a stale index.
-            const fresh = await browser.extractInteractiveElements();
-            session.lastElements = fresh;
-            // resolveTarget recomputes identities (incl. volatile positional-group
-            // fingerprints) from these FRESH elements, so a ref whose group fingerprint
-            // changed since the last observe resolves to null, not a survivor (#399).
-            const el = resolveTarget(fresh, action.target);
-            if (el === null) {
-                const stale = staleTargetError(session, action.target, fresh);
-                if (stale !== null)
-                    throw stale;
-                throw new Error(`no element matched target "${action.target}". Visible: ` +
-                    fresh
-                        .map((e) => `"${e.screenPath ?? elementRef(e)}"`)
-                        .slice(0, 20)
-                        .join(", "));
-            }
-            resolvedEl = el;
-            // Frame domain-lock (operator-frame-support) — see frameTargetAllowed.
-            // A main-frame or same-domain-frame target is unaffected.
-            assertFrameTargetAllowed(session, el, action.kind);
-            bindCartIdentity(isCartAffectingAction(action, el));
-            if (action.kind === "click" || action.kind === "js_click") {
-                const target = frameTargetFor(el);
-                if (isPlaceOrderClickCandidate(el)) {
-                    await runClickWithPlaceOrderGuard(session, (shouldTrack) => browser.clickWithDispatchTracking(target !== null
-                        ? { kind: "frame", frame: target, selector: el.selector, method: action.kind }
-                        : { kind: "selector", selector: el.selector, method: action.kind }, shouldTrack));
+                else if (action.kind === "type") {
+                    clearCommittedSelectValue(session, el.selector);
+                    if (!isAutocompleteScopedTypeField(action.provenance, el)) {
+                        // Free text only — e.g. a site-search/catalog-search box, which
+                        // can legitimately open its own suggestion listbox too. 3.1 only
+                        // applies to a form/recipe field where a committed value is
+                        // actually required; forcing every incidental popup into
+                        // commit-or-stop would break ordinary search typing.
+                        await browser.type(el.selector, action.text);
+                    }
+                    else {
+                        // 3.1 — a Google-Places-style address field or a react-select/cmdk/
+                        // Radix combobox can open a suggestion popup as a side effect of
+                        // typing, not just of an explicit `select`. Snapshot pre-existing
+                        // popups BEFORE typing (it can open mid-keystroke), then detect what
+                        // opened afterward.
+                        await browser.markPreexistingTypeSuggestionPopups();
+                        await browser.type(el.selector, action.text);
+                        // Cleanup (clear our tracking markers, and dismiss with Escape
+                        // ONLY when a detected popup is plausibly still open) must run no
+                        // matter how this resolves — no popup, an ambiguous stop, a
+                        // failed commit, or success — mirroring selectFromCombobox's own
+                        // try/finally. Scoping the try to only the
+                        // suggestionTexts.length > 0 branch left the "preexisting"
+                        // markers set by markPreexistingTypeSuggestionPopups uncleared on
+                        // the no-popup path; markComboboxPreexistingElements only ADDS
+                        // markers, so a stale one could exclude a genuine popup from
+                        // detection on a LATER type/select into the same element. Escape
+                        // fires on the ambiguous-stop and failed-commit paths (popup
+                        // never interacted with / click may not have registered — still
+                        // open either way) but NEVER after a confirmed commit: the widget
+                        // already closed its popup on selection, so Escape would land on
+                        // nothing and bubble to close an enclosing modal/dialog instead.
+                        let dismissPopupWithEscape = false;
+                        try {
+                            const suggestionTexts = await browser.detectTypeSuggestionPopup(el.selector);
+                            if (suggestionTexts.length > 0) {
+                                dismissPopupWithEscape = true;
+                                const candidates = matchAutocompleteSuggestions(action.text, suggestionTexts);
+                                if (candidates.length !== 1) {
+                                    // Pass the MATCHED subset, not the full popup — passing every
+                                    // suggestion made candidates.length effectively the popup
+                                    // size (always > 0 here), so the constructor's zero-match
+                                    // branch was dead code and the multi-match message reported
+                                    // the wrong count.
+                                    throw new AutocompleteCommitRequiredError(action.text, candidates.map((i) => suggestionTexts[i]));
+                                }
+                                const pickedText = suggestionTexts[candidates[0]];
+                                await browser.commitTypeSuggestion(candidates[0]);
+                                // Never trust that a click "looked right" — POSITIVELY confirm
+                                // the commit took (same hard constraint as the field-role
+                                // guard, PR #447: a miss is a stop, never a silent
+                                // pass-through). Checking only the typed-into selector's own
+                                // `.value` false-fails on react-select/cmdk-style widgets,
+                                // which clear their search input on selection and render the
+                                // committed choice in a nearby element instead —
+                                // confirmAutocompleteCommitted checks that too, bounded to the
+                                // field's own neighborhood, and returns false (never a guess)
+                                // when nothing confirms it.
+                                const committed = await browser.confirmAutocompleteCommitted(el.selector, pickedText);
+                                if (!committed) {
+                                    throw new Error(`autocomplete commit for "${action.text}" did not take — nothing on the page ` +
+                                        `confirms the field now holds "${pickedText}" after selecting it.`);
+                                }
+                                dismissPopupWithEscape = false;
+                                // Rewrite the completed action to the field's LIVE post-commit
+                                // value (not the raw typed draft) before it reaches
+                                // recordTrace/recordedValues, so the recorded trace reflects
+                                // what actually ended up on the page. Recording pickedText
+                                // would diverge from the live value exactly when the commit
+                                // was confirmed via a NEARBY element (react-select/cmdk clear
+                                // their search input on selection), and the cold-path
+                                // transition attestation (attestRecordedFieldsBeforeTransition
+                                // → verifyFilledFieldValues) re-reads the live value — a
+                                // pickedText literal would flag every such commit as a
+                                // mismatch and disqualify recipe recording. Reading the same
+                                // live value here is attestation-consistent by construction.
+                                // Known limitation: after a nearby-signal-only commit the
+                                // field itself can be empty, so the recorded literal is "" —
+                                // that field won't cleanly template into a saved recipe, but
+                                // the live run is unaffected.
+                                const refreshed = await browser.extractInteractiveElements();
+                                retainSessionElements(session, refreshed);
+                                const liveField = refreshed.find((field) => field.selector === el.selector);
+                                const liveValue = typeof liveField?.value === "string" ? liveField.value : pickedText;
+                                completedAction = { ...action, text: liveValue };
+                            }
+                        }
+                        finally {
+                            await browser.discardTypeSuggestionPopup(dismissPopupWithEscape);
+                        }
+                        if (isRequiredShippingAddressLine1(el)) {
+                            await browser.commitRequiredShippingAddressLine1(el.selector);
+                        }
+                    }
                 }
-                else if (action.kind === "click") {
-                    if (target !== null)
-                        await browser.clickInFrame(target, el.selector);
-                    else
-                        await browser.click(el.selector);
+                else if (action.kind === "upload") {
+                    assertNoFrameTarget(el, "upload");
+                    await browser.uploadFile(el.selector, action.path);
+                    audit(sessionId, "upload", {
+                        target: auditTarget,
+                        path: session.compactV2Active ? "<local-file>" : action.path,
+                        host: registrableHost(browser.currentUrl()),
+                    });
                 }
                 else {
-                    if (target !== null)
-                        await browser.clickViaJsInFrame(target, el.selector);
-                    else
-                        await browser.clickViaJs(el.selector);
+                    assertNoFrameTarget(el, "oauth_click");
+                    if (oauthDeadline === undefined) {
+                        throw new Error("OAuth action deadline was not established");
+                    }
+                    browser = await runSerializedOAuthBoundary(session, el, fresh, action.provider, oauthDeadline);
                 }
-            }
-            else if (action.kind === "type" && frameTargetFor(el) !== null) {
-                // Frame targets skip the autocomplete-popup-commit machinery below —
-                // it operates on the main page's DOM only (markPreexistingType
-                // SuggestionPopups / detectTypeSuggestionPopup / commitTypeSuggestion
-                // are page-scoped). Out of scope for the checkout-option case frame
-                // support exists for; a plain frame-scoped fill covers it.
-                session.committedSelectValues.delete(el.selector);
-                await browser.typeInFrame(frameTargetFor(el), el.selector, action.text);
-            }
-            else if (action.kind === "type") {
-                session.committedSelectValues.delete(el.selector);
-                if (!isAutocompleteScopedTypeField(action.provenance, el)) {
-                    // Free text only — e.g. a site-search/catalog-search box, which
-                    // can legitimately open its own suggestion listbox too. 3.1 only
-                    // applies to a form/recipe field where a committed value is
-                    // actually required; forcing every incidental popup into
-                    // commit-or-stop would break ordinary search typing.
-                    await browser.type(el.selector, action.text);
+                if (action.kind !== "type")
+                    await settleAfterStateChange(browser);
+                // Only a plain click follows a tab it opened. oauth_click owns its own
+                // provider-page lifecycle and upload never opens one.
+                if (action.kind === "click" || action.kind === "js_click") {
+                    await adoptOpenedTab(session, browser, 0);
                 }
-                else {
-                    // 3.1 — a Google-Places-style address field or a react-select/cmdk/
-                    // Radix combobox can open a suggestion popup as a side effect of
-                    // typing, not just of an explicit `select`. Snapshot pre-existing
-                    // popups BEFORE typing (it can open mid-keystroke), then detect what
-                    // opened afterward.
-                    await browser.markPreexistingTypeSuggestionPopups();
-                    await browser.type(el.selector, action.text);
-                    // Cleanup (clear our tracking markers, and dismiss with Escape
-                    // ONLY when a detected popup is plausibly still open) must run no
-                    // matter how this resolves — no popup, an ambiguous stop, a
-                    // failed commit, or success — mirroring selectFromCombobox's own
-                    // try/finally. Scoping the try to only the
-                    // suggestionTexts.length > 0 branch left the "preexisting"
-                    // markers set by markPreexistingTypeSuggestionPopups uncleared on
-                    // the no-popup path; markComboboxPreexistingElements only ADDS
-                    // markers, so a stale one could exclude a genuine popup from
-                    // detection on a LATER type/select into the same element. Escape
-                    // fires on the ambiguous-stop and failed-commit paths (popup
-                    // never interacted with / click may not have registered — still
-                    // open either way) but NEVER after a confirmed commit: the widget
-                    // already closed its popup on selection, so Escape would land on
-                    // nothing and bubble to close an enclosing modal/dialog instead.
-                    let dismissPopupWithEscape = false;
-                    try {
-                        const suggestionTexts = await browser.detectTypeSuggestionPopup(el.selector);
-                        if (suggestionTexts.length > 0) {
-                            dismissPopupWithEscape = true;
-                            const candidates = matchAutocompleteSuggestions(action.text, suggestionTexts);
-                            if (candidates.length !== 1) {
-                                // Pass the MATCHED subset, not the full popup — passing every
-                                // suggestion made candidates.length effectively the popup
-                                // size (always > 0 here), so the constructor's zero-match
-                                // branch was dead code and the multi-match message reported
-                                // the wrong count.
-                                throw new AutocompleteCommitRequiredError(action.text, candidates.map((i) => suggestionTexts[i]));
-                            }
-                            const pickedText = suggestionTexts[candidates[0]];
-                            await browser.commitTypeSuggestion(candidates[0]);
-                            // Never trust that a click "looked right" — POSITIVELY confirm
-                            // the commit took (same hard constraint as the field-role
-                            // guard, PR #447: a miss is a stop, never a silent
-                            // pass-through). Checking only the typed-into selector's own
-                            // `.value` false-fails on react-select/cmdk-style widgets,
-                            // which clear their search input on selection and render the
-                            // committed choice in a nearby element instead —
-                            // confirmAutocompleteCommitted checks that too, bounded to the
-                            // field's own neighborhood, and returns false (never a guess)
-                            // when nothing confirms it.
-                            const committed = await browser.confirmAutocompleteCommitted(el.selector, pickedText);
-                            if (!committed) {
-                                throw new Error(`autocomplete commit for "${action.text}" did not take — nothing on the page ` +
-                                    `confirms the field now holds "${pickedText}" after selecting it.`);
-                            }
-                            dismissPopupWithEscape = false;
-                            // Rewrite the completed action to the field's LIVE post-commit
-                            // value (not the raw typed draft) before it reaches
-                            // recordTrace/recordedValues, so the recorded trace reflects
-                            // what actually ended up on the page. Recording pickedText
-                            // would diverge from the live value exactly when the commit
-                            // was confirmed via a NEARBY element (react-select/cmdk clear
-                            // their search input on selection), and the cold-path
-                            // transition attestation (attestRecordedFieldsBeforeTransition
-                            // → verifyFilledFieldValues) re-reads the live value — a
-                            // pickedText literal would flag every such commit as a
-                            // mismatch and disqualify recipe recording. Reading the same
-                            // live value here is attestation-consistent by construction.
-                            // Known limitation: after a nearby-signal-only commit the
-                            // field itself can be empty, so the recorded literal is "" —
-                            // that field won't cleanly template into a saved recipe, but
-                            // the live run is unaffected.
-                            const refreshed = await browser.extractInteractiveElements();
-                            session.lastElements = refreshed;
-                            const liveField = refreshed.find((field) => field.selector === el.selector);
-                            const liveValue = typeof liveField?.value === "string" ? liveField.value : pickedText;
-                            completedAction = { ...action, text: liveValue };
-                        }
-                    }
-                    finally {
-                        await browser.discardTypeSuggestionPopup(dismissPopupWithEscape);
+                break;
+            }
+            case "oauth_login": {
+                const pageText = await browser.extractVisibleText();
+                const blockReason = shouldBlockUnsafeProvisionAction(pageText, action);
+                if (blockReason !== null)
+                    throw new Error(blockReason);
+                // Atomic OAuth deliberately accepts only the observed stable ref. A raw
+                // locator would lose the same stale-reference guarantees as every other
+                // action before the provider transition begins.
+                const fresh = await browser.extractInteractiveElements();
+                retainSessionElements(session, fresh);
+                const el = compactV2Authorization === undefined
+                    ? resolveTarget(fresh, resolutionTarget)
+                    : resolveAuthorizedCompactV2Target(session, fresh, compactV2Authorization);
+                if (el === null) {
+                    if (session.compactV2Active) {
+                        if (!internalAccess)
+                            throwCompactV2StaleRef();
+                        throw new Error("oauth_login: internal live target changed");
                     }
+                    throw new Error(`oauth_login: no element matched target "${action.target}". Re-observe and use the OAuth button ref.`);
                 }
+                resolvedEl = el;
+                assertNoFrameTarget(el, "oauth_login");
+                if (oauthDeadline === undefined) {
+                    throw new Error("OAuth action deadline was not established");
+                }
+                browser = await runSerializedOAuthBoundary(session, el, fresh, action.provider, oauthDeadline);
+                break;
             }
-            else if (action.kind === "upload") {
-                assertNoFrameTarget(el, "upload");
-                await browser.uploadFile(el.selector, action.path);
-                audit(sessionId, "upload", {
-                    target: action.target,
-                    path: action.path,
-                    host: registrableHost(browser.currentUrl()),
-                });
-            }
-            else {
-                assertNoFrameTarget(el, "oauth_click");
-                await browser.startOAuth(el.selector);
-            }
-            if (action.kind !== "type")
-                await settleAfterStateChange(browser);
-            break;
         }
-        case "oauth_login": {
-            const pageText = await browser.extractVisibleText();
-            const blockReason = shouldBlockUnsafeProvisionAction(pageText, action);
-            if (blockReason !== null)
-                throw new Error(blockReason);
-            // Atomic OAuth deliberately accepts only the observed stable ref. A raw
-            // locator would lose the same stale-reference guarantees as every other
-            // action before the provider transition begins.
-            const fresh = await browser.extractInteractiveElements();
-            session.lastElements = fresh;
-            const el = resolveTarget(fresh, action.target);
-            if (el === null) {
-                throw new Error(`oauth_login: no element matched target "${action.target}". Re-observe and use the OAuth button ref.`);
+    }
+    finally {
+        // An act no longer retires the action map. Refs are fingerprint-derived and
+        // re-resolved live against the observed epoch on every act, so the agent can
+        // fill a whole form from one observation. Only LEAVING the observed document
+        // retires them — the same condition the authorization check enforces — so
+        // drop the snapshot exactly then, and fail closed if the epoch is unreadable.
+        if (action.kind !== "allow_host" && session.compactV2Index !== null) {
+            let stillObservedDocument = false;
+            try {
+                stillObservedDocument = session.compactV2Index.epoch.doc === compactV2EpochDoc(session);
             }
-            resolvedEl = el;
-            assertNoFrameTarget(el, "oauth_login");
-            await browser.loginWithOAuth(el.selector);
-            await settleAfterStateChange(browser);
-            break;
+            catch { }
+            if (!stillObservedDocument)
+                invalidateCompactV2Snapshot(session);
         }
     }
     await verifyRecordedFieldsAfterTransition(session, action, recordingTransitionFields);
@@ -4072,8 +4067,9 @@ export async function act(sessionId, action, detail = "compact", cartIdentity) {
     // INBOX_READ_HOSTS): replay re-reads the code via awaitVerification, and a
     // recorded inbox click would bake the email's subject into a shared recipe.
     if (!isInboxReadHost(browser.currentUrl())) {
-        recordTrace(session, completedAction, resolvedEl, sensitiveSource);
-        recordCaptureRound(session, completedAction, resolvedEl, urlBeforeAction);
+        const replayElement = replaySafeElementForSession(session, resolvedEl);
+        recordTrace(session, completedAction, replayElement, sensitiveSource);
+        recordCaptureRound(session, completedAction, replayElement, urlBeforeAction);
     }
     if (cartAffecting) {
         session.lastCartMutation = {
@@ -4086,47 +4082,92 @@ export async function act(sessionId, action, detail = "compact", cartIdentity) {
     // `detail:"none"` returns a minimal ack (the action ran; no perception emitted)
     // so multi-field fills don't each echo the page. The host must call
     // operate_observe before its next ref-targeted act (refs aren't refreshed here).
+    const checkoutState = internalAccess && collectCheckoutState ? await capturePrivateCheckoutState(session) : undefined;
     const observation = detail === "none" && !cartAffecting && action.kind !== "oauth_login"
-        ? {
+        ? compactV2PublicObservation(session, () => ({
             session_id: session.id,
             url: browser.currentUrl(),
             text: "",
             elements: [],
             observed: "none",
-        }
+        }), {
+            stage: safeStageV2(browser.currentUrl(), session.lastElements),
+            observed: "none",
+        })
         : await observeSession(session, detail === "none" ? "compact" : detail);
-    return completedAction.kind === "select"
-        ? { ...observation, selected_option: completedAction.text }
-        : observation;
+    return {
+        observation: completedAction.kind === "select" && observation.format !== "compact-v2"
+            ? { ...observation, selected_option: completedAction.text }
+            : observation,
+        outcome: {
+            ...(completedAction.kind === "select" ? { selectedOption: completedAction.text } : {}),
+            ...(checkoutState === undefined ? {} : { checkoutState }),
+        },
+    };
 }
 export async function formSelectMany(sessionId, selections) {
     const fields = [];
-    // Keep variant changes in one host call. Each successful select is followed
-    // by a real observe before the next target resolves: variant widgets commonly
-    // replace all dependent selects, so continuing from an old inventory is worse
-    // than reporting a partial result.
-    for (const [label, option] of Object.entries(selections)) {
+    const session = sessionForCall(sessionId);
+    if (session === undefined)
+        throw new Error(`unknown provision session ${sessionId}`);
+    const selectionEntries = Object.entries(selections);
+    for (let index = 0; index < selectionEntries.length; index += 1) {
+        const [label, option] = selectionEntries[index];
+        const publicLabel = session.compactV2Active && !isCompactV2Handle(label) && !isCompactV2Label(label)
+            ? "<rejected-v2-target>"
+            : label;
+        const publicSelection = session.compactV2Active
+            ? { label: publicLabel }
+            : { label: publicLabel, option };
+        let authorization;
+        if (session.compactV2Active) {
+            try {
+                authorization = compactV2AuthorizationForTarget(session, label);
+            }
+            catch (error) {
+                audit(sessionId, "act", { kind: "select_many", target: "<rejected-v2-target>" });
+                if (index === 0)
+                    throw error;
+                fields.push({
+                    ...publicSelection,
+                    status: "failed",
+                    reason: compactV2SelectionFailureReason(error),
+                });
+                if (index + 1 < selectionEntries.length)
+                    await observe(sessionId, "compact");
+                continue;
+            }
+        }
         try {
-            const actionResult = await act(sessionId, { kind: "select", target: label, text: option }, "none");
-            const selectedOption = actionResult.selected_option;
+            const target = authorization?.legacyRef ?? label;
+            const actionResult = await actInternally(sessionId, { kind: "select", target, text: option }, "none", undefined, false, authorization);
+            const selectedOption = actionResult.outcome.selectedOption;
             if (selectedOption === undefined) {
                 throw new Error("select: successful action omitted the selected option");
             }
             // `detail:none` is intentionally a minimal ack. The explicit observe here
             // refreshes the DOM generation between every potentially mutating select.
             await observe(sessionId, "compact");
+            const publicSelectedOption = session.compactV2Active
+                ? safeDescriptionV2(selectedOption)
+                : selectedOption;
             fields.push({
-                label,
-                option,
+                ...publicSelection,
                 status: "selected",
-                selected_option: selectedOption,
+                ...(publicSelectedOption === undefined ? {} : { selected_option: publicSelectedOption }),
             });
         }
         catch (err) {
-            if (err instanceof TargetStaleError) {
+            if (session.compactV2Active) {
                 fields.push({
-                    label,
-                    option,
+                    ...publicSelection,
+                    status: "failed",
+                    reason: compactV2SelectionFailureReason(err),
+                });
+            }
+            else if (err instanceof TargetStaleError) {
+                fields.push({
+                    ...publicSelection,
                     status: "failed",
                     reason: err.message,
                     repair: err.result,
@@ -4134,12 +4175,14 @@ export async function formSelectMany(sessionId, selections) {
             }
             else {
                 fields.push({
-                    label,
-                    option,
+                    ...publicSelection,
                     status: "failed",
                     reason: err instanceof Error ? err.message : String(err),
                 });
             }
+            if (session.compactV2Active && index + 1 < selectionEntries.length) {
+                await observe(sessionId, "compact");
+            }
         }
     }
     return {
@@ -4148,6 +4191,24 @@ export async function formSelectMany(sessionId, selections) {
         observation: await observe(sessionId, "compact"),
     };
 }
+function compactV2SelectionFailureReason(error) {
+    return compactV2ActionFailureReason(error, "select");
+}
+function compactV2ActionFailureReason(error, kind) {
+    if (error instanceof CompactV2ActionFailureError)
+        return error.message;
+    if (error instanceof Error && error.code === "google_session") {
+        return error.message;
+    }
+    if (error instanceof CompactV2StaleRefError)
+        return "stale_ref";
+    if (error instanceof TargetStaleError)
+        return "reobserve_required";
+    if (error instanceof ProvisionTargetNotAllowedError) {
+        return "target_not_allowed";
+    }
+    return kind === "select" ? "selection_failed" : "action_failed";
+}
 // PR3 privacy: in the operator model the host fills the USER's real email into
 // signup forms (no Squire alias anymore). The recipe trace must NOT persist that
 // literal address — it would land in operator recipes and any skill synthesized
@@ -4225,6 +4286,113 @@ const REPLAY_VERIFIED_HOLE = /^(?:address|contact)(?:\.|$)|^quantity$/;
 function looksLikeEmailValue(v) {
     return /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(v.trim());
 }
+const COMPACT_V2_REPLAY_ROUTE_SEGMENTS = new Set([
+    "account",
+    "accounts",
+    "api",
+    "app",
+    "apps",
+    "auth",
+    "basket",
+    "billing",
+    "callback",
+    "cart",
+    "checkout",
+    "complete",
+    "console",
+    "create",
+    "credential",
+    "credentials",
+    "dashboard",
+    "developer",
+    "developers",
+    "key",
+    "keys",
+    "login",
+    "new",
+    "oauth",
+    "payment",
+    "profile",
+    "project",
+    "projects",
+    "register",
+    "security",
+    "settings",
+    "sign-in",
+    "sign-up",
+    "signin",
+    "signup",
+    "success",
+    "token",
+    "tokens",
+    "verification",
+    "verify",
+    "workspace",
+    "workspaces",
+]);
+function compactV2ReplaySafeUrl(rawUrl) {
+    try {
+        const parsed = new URL(rawUrl);
+        if (safeOriginV2(parsed.origin) === null)
+            return null;
+        if (parsed.username.length > 0 ||
+            parsed.password.length > 0 ||
+            parsed.search.length > 0 ||
+            parsed.hash.length > 0 ||
+            isSingleUseUrl(rawUrl)) {
+            return null;
+        }
+        const segments = parsed.pathname.split("/").filter(Boolean);
+        if (segments.some((segment) => segment !== segment.toLowerCase() || !COMPACT_V2_REPLAY_ROUTE_SEGMENTS.has(segment))) {
+            return null;
+        }
+        return parsed.toString();
+    }
+    catch {
+        return null;
+    }
+}
+function compactV2RecordedAction(session, action) {
+    if (session.compactV2Mode !== "on")
+        return action;
+    if (action.kind === "goto") {
+        const url = compactV2ReplaySafeUrl(action.url);
+        if (url !== null)
+            return { ...action, url };
+        rejectRecipeRecording(session, "compact_v2_unrepresentable_goto");
+        return null;
+    }
+    if (action.kind === "allow_host") {
+        const origin = safeOriginV2(`https://${action.host}`);
+        if (origin !== null)
+            return { ...action, host: new URL(origin).hostname };
+        rejectRecipeRecording(session, "compact_v2_unrepresentable_host");
+        return null;
+    }
+    if (action.kind === "type") {
+        if (looksLikeEmailValue(action.text))
+            return { ...action, text: EMAIL_SLOT_TEMPLATE };
+        rejectRecipeRecording(session, "compact_v2_unrepresentable_value_action");
+        return null;
+    }
+    if (action.kind === "select") {
+        // Registry-bound recipe value, not an observation: it must be recognizable
+        // code-owned vocabulary before it is published to the shared registry.
+        const text = recordableTokenV2(action.text);
+        if (text !== undefined)
+            return { ...action, text };
+        rejectRecipeRecording(session, "compact_v2_unrepresentable_value_action");
+        return null;
+    }
+    if (action.kind === "set_phone_country") {
+        if (/^[a-z]{2}$/i.test(action.country)) {
+            return { ...action, country: action.country.toUpperCase() };
+        }
+        rejectRecipeRecording(session, "compact_v2_unrepresentable_value_action");
+        return null;
+    }
+    return action;
+}
 // Exported for unit tests.
 export function redactEmailForTrace(value) {
     return looksLikeEmailValue(value) ? EMAIL_SLOT_TEMPLATE : value;
@@ -4328,7 +4496,9 @@ export function recipeTargetFor(el, inventory = [], userEmail = null) {
             : {}),
         ...(nearText !== null ? { near_text_hint: scrub(nearText) } : {}),
         ...(hrefHint !== null && !isSingleUseUrl(el.href ?? "") ? { href_hint: scrub(hrefHint) } : {}),
-        ...(el.selector.length > 0 ? { css: scrub(el.selector) } : {}),
+        ...(el.selector.length > 0 && !el.selector.startsWith("@c:")
+            ? { css: scrub(el.selector) }
+            : {}),
         ...(el.visibleText !== null && el.visibleText.length > 0
             ? { visible_text: scrub(el.visibleText) }
             : {}),
@@ -4340,6 +4510,10 @@ export function recipeTargetFor(el, inventory = [], userEmail = null) {
     };
 }
 function recordTrace(session, action, el, sensitiveSource) {
+    const recordedAction = compactV2RecordedAction(session, action);
+    if (recordedAction === null)
+        return;
+    action = recordedAction;
     // Never freeze a single-use link (email-verify / magic / reset token) into
     // the recipe — it's dead on the next replay. The host agent re-plans the
     // verification step live (operate_act { kind: "await_verification" } fetches a FRESH link)
@@ -4518,16 +4692,29 @@ export function captureObserved(action, el) {
 }
 // Accumulate one MEDIUM round: inventory + action + url, no html/screenshot.
 function recordCaptureRound(session, action, el, urlAtObservation) {
-    const observed = captureObserved(action, el);
+    const recordedAction = compactV2RecordedAction(session, action);
+    if (recordedAction === null)
+        return;
+    const observed = captureObserved(recordedAction, el);
     if (observed === null)
         return;
+    const stateUrl = session.compactV2Mode === "on" ? compactV2ReplaySafeUrl(urlAtObservation) : urlAtObservation;
+    if (stateUrl === null) {
+        rejectRecipeRecording(session, "compact_v2_unrepresentable_page_url");
+        return;
+    }
     session.captureRounds.push({
         service: captureService(session),
         round: session.captureRounds.length,
-        oauth: action.kind === "oauth_click" || action.kind === "oauth_login",
+        oauth: recordedAction.kind === "oauth_click" || recordedAction.kind === "oauth_login",
         // The URL the inventory + action belong to (pre-action), NOT the post-
         // navigation URL — see urlBeforeAction in act().
-        state: { url: urlAtObservation, title: "", html: "", screenshot: "" },
+        state: {
+            url: stateUrl,
+            title: "",
+            html: "",
+            screenshot: "",
+        },
         inventory: session.lastElements,
         observed,
     });
@@ -4536,20 +4723,35 @@ function recordCaptureRound(session, action, el, urlAtObservation) {
 // step is synthesized from the page where the credential is shown.
 async function recordExtractRound(session) {
     let html = "";
-    try {
-        html = (await session.browser.getState()).html;
+    if (session.compactV2Mode !== "on") {
+        try {
+            html = (await session.browser.getState()).html;
+        }
+        catch {
+            /* best-effort — the copy-button/inventory extract path still works */
+        }
     }
-    catch {
-        /* best-effort — the copy-button/inventory extract path still works */
+    const stateUrl = session.compactV2Mode === "on"
+        ? compactV2ReplaySafeUrl(session.browser.currentUrl())
+        : session.browser.currentUrl();
+    if (stateUrl === null) {
+        rejectRecipeRecording(session, "compact_v2_unrepresentable_page_url");
+        return false;
     }
     session.captureRounds.push({
         service: captureService(session),
         round: session.captureRounds.length,
         oauth: false,
-        state: { url: session.browser.currentUrl(), title: "", html, screenshot: "" },
+        state: {
+            url: stateUrl,
+            title: "",
+            html,
+            screenshot: "",
+        },
         inventory: session.lastElements,
         observed: { kind: "extract", reason: "extract the credential shown on the page" },
     });
+    return true;
 }
 // Record the extract round from the live page, then write the accumulated medium
 // rounds through the real capture path (integrity chain) and synthesize a skill.
@@ -4565,12 +4767,18 @@ export async function captureAndPromoteSession(sessionId) {
     if (session.usedLocatorFallback) {
         return { kind: "skipped", reason: "locator_fallback_unrepresentable" };
     }
+    if (session.recipeRejectionReason !== null) {
+        return { kind: "skipped", reason: session.recipeRejectionReason };
+    }
     const dir = resolveCaptureDir();
     if (dir === null)
         return { kind: "skipped", reason: "capture_disabled" };
     if (!session.captureRounds.some((r) => r.observed.kind === "extract")) {
         await recordExtractRound(session);
     }
+    if (session.recipeRejectionReason !== null) {
+        return { kind: "skipped", reason: session.recipeRejectionReason };
+    }
     const hasExtract = session.captureRounds.some((r) => r.observed.kind === "extract");
     if (!hasExtract || session.captureRounds.length < 2) {
         return { kind: "skipped", reason: "too_few_rounds" };
@@ -4617,18 +4825,63 @@ export function emitProvisionMeasurement(sessionId, outcome) {
         now: Date.now(),
         turns: session.actionTrace.length,
     });
-    process.stderr.write(`${JSON.stringify({ marker: "provision-measurement", ...m })}\n`);
+    const emitted = session.compactV2Mode === "on"
+        ? { ...m, service: compactV2AuditValue("service", m.service) }
+        : m;
+    process.stderr.write(`${JSON.stringify({ marker: "provision-measurement", ...emitted })}\n`);
     return m;
 }
+// ── new-tab adoption ──
+//
+// A click on a `target=_blank` link or a `window.open` control opens a NEW TAB,
+// and a real user lands on it. The operator has to do the same: an email
+// magic-link button in Gmail opens its login tab that way, and following the
+// tab is the ONLY safe way to reach it — the link carries a single-use login
+// token, so `extract` seals the href and must never hand it to the host as
+// text. Navigating the browser exposes nothing.
+//
+// Grace between the click returning and Playwright delivering the context
+// "page" event for the tab it opened. It cannot be zero: MEASURED 2026-09-03
+// (new-tab-adoption.test.ts, 3 runs) — at 0 the event has not landed yet and
+// every follow case fails, including the post-settle drain below. It is kept
+// short because a click that opens NO tab pays it in full, and a tab that
+// arrives later than this is still caught by that drain.
+const OPENED_TAB_GRACE_MS = 300;
+// Payment is deliberately out of scope. A sealed card fill and a live
+// place-order/3DS approval both own their page identity, so leave the operator
+// anchored where those flows put it rather than following a tab into them.
+function newTabAdoptionAllowed(session) {
+    return (!session.paymentFieldSealActive &&
+        session.placeOrderApproval === null &&
+        getActivePendingThreeDs(session) === null);
+}
+async function adoptOpenedTab(session, browser, graceMs) {
+    if (!newTabAdoptionAllowed(session))
+        return;
+    const url = await browser.adoptOpenedTab(graceMs).catch(() => null);
+    if (url === null)
+        return;
+    audit(session.id, "new_tab_adopted", { host: registrableHost(url) });
+}
+async function adoptTabOpenedByClick(session, browser, click) {
+    if (!newTabAdoptionAllowed(session)) {
+        await click();
+        return;
+    }
+    browser.armOpenedTabAdoption();
+    try {
+        await click();
+    }
+    finally {
+        await adoptOpenedTab(session, browser, OPENED_TAB_GRACE_MS);
+    }
+}
 async function settleAfterStateChange(browser) {
-    await settle(450);
+    // A fixed dwell here used to consume the OAuth action's completion window
+    // after the provider had already returned. Wait for the page's actual
+    // interactive state instead; it resolves immediately when the redirect has
+    // rendered and remains bounded for slow SPAs.
     await browser.waitForInteractiveDom(1, 2_000).catch(() => undefined);
-    for (let i = 0; i < 4; i += 1) {
-        const text = await browser.extractVisibleText().catch(() => "");
-        if (text.replace(/\s+/g, " ").trim().length > 0)
-            return;
-        await settle(300);
-    }
 }
 // ── operator-recipe: remember a successful run, verify a postcondition ──
 // Persist the session's action trace as a keyed, replayable operator-recipe.
@@ -4888,16 +5141,42 @@ async function rememberCheckoutLeg(session, verb, trace) {
 // Read a single page snapshot for postcondition checking. Field VALUES are
 // reduced to lengths here so a token/secret success-signal can't leak.
 async function snapshotForPostcondition(session) {
+    const privateFields = session.compactV2Mode === "on"
+        ? (await session.browser.extractInteractiveElements())
+            .filter((element) => typeof element.value === "string" && element.value.length > 0)
+            .map((element) => {
+            const sealed = sealRetainedInteractiveElementsV2([element])[0];
+            const description = safeDescriptionV2(sealed.labelText ??
+                sealed.ariaLabel ??
+                sealed.placeholder ??
+                sealed.title ??
+                sealed.name ??
+                sealed.id);
+            const fieldRole = localeStableFieldRole(sealed);
+            return {
+                label: [description, fieldRole]
+                    .filter((value) => value !== undefined && value !== null)
+                    .join(" "),
+                value_len: element.value.length,
+            };
+        })
+            .filter((field) => field.label.length > 0)
+        : null;
     const obs = await observeSession(session);
-    // Read lengths off the RAW elements (session.lastElements, set by
-    // observeSession). The compact wire carries only value_len and never the raw
-    // value; deriving from the live elements preserves the real length for a
-    // min_value_len success-signal. Lengths never expose the value, so this stays
-    // leak-free.
-    const fields = session.lastElements
-        .filter((e) => typeof e.value === "string" && e.value.length > 0)
-        .map((e) => ({ label: elementRef(e), value_len: (e.value ?? "").length }));
-    return { url: obs.url, text: session.prevObserve?.text ?? obs.text, fields };
+    const fields = privateFields ??
+        session.lastElements
+            .filter((element) => typeof element.value === "string" && element.value.length > 0)
+            .map((element) => ({
+            label: elementRef(element),
+            value_len: element.value.length,
+        }));
+    return {
+        url: obs.format === "compact-v2" ? session.browser.currentUrl() : obs.url,
+        text: obs.format === "compact-v2"
+            ? await session.browser.extractVisibleText()
+            : (session.prevObserve?.text ?? obs.text),
+        fields,
+    };
 }
 // Verify a recipe's postcondition against the live session — the anti-false-
 // green gate for replay. execute_capability checks the current end-state;
@@ -4911,6 +5190,7 @@ export async function verifyPostcondition(sessionId, postcondition) {
         if (host !== null && !session.allowedHosts.some((e) => e.host === host)) {
             session.allowedHosts.push({ host, source: "mid_session" });
         }
+        invalidateCompactV2Snapshot(session);
         await session.browser.goto(postcondition.probe_url);
         await settle(1500);
     }
@@ -4924,7 +5204,7 @@ export async function verifyPostcondition(sessionId, postcondition) {
     return result;
 }
 export async function verifySavedRecipePostcondition(sessionId, recipe) {
-    const session = sessions.get(sessionId);
+    const session = sessionForCall(sessionId);
     if (session === undefined)
         throw new Error(`unknown provision session ${sessionId}`);
     const state = session.replayState;
@@ -4941,7 +5221,7 @@ export async function verifySavedRecipePostcondition(sessionId, recipe) {
     return await verifyPostcondition(sessionId, postcondition);
 }
 export async function verifyActiveRecipePostcondition(sessionId, recipeName) {
-    const session = sessions.get(sessionId);
+    const session = sessionForCall(sessionId);
     if (session === undefined)
         throw new Error(`unknown provision session ${sessionId}`);
     const state = session.replayState;
@@ -5120,7 +5400,7 @@ function replayTargetWithinRecipeDomain(url, recipeDomain) {
     return isSameRecipeDomain(url, recipeDomain);
 }
 function markReplayDomainLockViolation(session, host, recipeDomain) {
-    rejectRecipeRecording(session, `replay refused: "${host}" is outside the recipe's own domain "${recipeDomain}"`);
+    rejectRecipeRecording(session, "replay_domain_lock_violation");
     audit(session.id, "replay_domain_lock_violation", { host, recipe_domain: recipeDomain });
 }
 function verifyReplayFieldInElements(session, expected, elements, allowCommittedSelect = false) {
@@ -5140,18 +5420,18 @@ function verifyReplayFieldInElements(session, expected, elements, allowCommitted
     ]);
     if (guard.ok) {
         if (expected.kind === "select") {
-            session.committedSelectValues.delete(resolution.element.selector);
+            clearCommittedSelectValue(session, resolution.element.selector);
         }
         return { ok: true };
     }
     if (allowCommittedSelect &&
         expected.kind === "select" &&
-        session.committedSelectValues.get(resolution.element.selector) === expected.expected) {
-        session.committedSelectValues.delete(resolution.element.selector);
+        session.committedSelectValues.get(compactV2CommittedSelectKey(session, resolution.element.selector)) === compactV2CommittedSelectValue(session, expected.expected)) {
+        clearCommittedSelectValue(session, resolution.element.selector);
         return { ok: true };
     }
     if (expected.kind === "select") {
-        session.committedSelectValues.delete(resolution.element.selector);
+        clearCommittedSelectValue(session, resolution.element.selector);
     }
     return { ok: false, reason: guard.reason };
 }
@@ -5165,7 +5445,7 @@ async function verifyReplayField(session, expected, allowCommittedSelect = false
     if (target === null)
         return { ok: false, reason: "field_missing" };
     const fresh = await session.browser.extractInteractiveElements();
-    session.lastElements = fresh;
+    retainSessionElements(session, fresh);
     return verifyReplayFieldInElements(session, expected, fresh, allowCommittedSelect);
 }
 async function verifyReplayFieldWithElements(session, expected, elements, allowCommittedSelect = false) {
@@ -5227,7 +5507,7 @@ async function attestRecordedFieldsBeforeTransition(session, action) {
     if (fields.length === 0)
         return fields;
     const fresh = await session.browser.extractInteractiveElements();
-    session.lastElements = fresh;
+    retainSessionElements(session, fresh);
     for (const expected of fields) {
         const guard = await verifyReplayFieldWithElements(session, expected, fresh);
         if (!guard.ok) {
@@ -5242,7 +5522,7 @@ async function verifyRecordedFieldsAfterTransition(session, action, fields) {
         return;
     }
     const fresh = await session.browser.extractInteractiveElements();
-    session.lastElements = fresh;
+    retainSessionElements(session, fresh);
     for (const expected of fields) {
         if (!(await isReplayFieldMounted(session, expected, fresh))) {
             rejectRecipeRecording(session, `checkout transition could not be attested (${expected.hole}: field_missing)`);
@@ -5261,7 +5541,7 @@ async function verifyRecordedFieldsAfterTransition(session, action, fields) {
  * repairs that one step, calling again with `fromIndex=next_index` continues.
  */
 export async function replayOperatorRecipe(sessionId, recipe, bindings, fromIndex = 0, options = {}) {
-    const session = sessions.get(sessionId);
+    const session = sessionForCall(sessionId);
     if (session === undefined)
         throw new Error(`unknown provision session ${sessionId}`);
     const recipeHash = replayDigest(recipe);
@@ -5360,12 +5640,16 @@ export async function replayOperatorRecipe(sessionId, recipe, bindings, fromInde
     const recipeDomain = recipe.domain;
     const domainLockViolation = async (stepIndex, host) => {
         markReplayDomainLockViolation(session, host, recipeDomain);
+        const publicHost = session.compactV2Active ? compactV2AuditHost(host) : host;
+        const publicRecipeDomain = session.compactV2Active
+            ? compactV2AuditHost(recipeDomain)
+            : recipeDomain;
         return {
             status: "domain_lock_violation",
             observation: await observe(sessionId),
             step_index: stepIndex,
-            host,
-            recipe_domain: recipeDomain,
+            host: publicHost,
+            recipe_domain: publicRecipeDomain,
         };
     };
     for (let i = fromIndex; i < recipe.trace.length; i += 1) {
@@ -5467,7 +5751,7 @@ export async function replayOperatorRecipe(sessionId, recipe, bindings, fromInde
             // Structural pre-check: resolve against the live inventory before every
             // deterministic act. This is especially load-bearing on money paths.
             const fresh = await session.browser.extractInteractiveElements();
-            session.lastElements = fresh;
+            retainSessionElements(session, fresh);
             const expectedForStep = state.expectedFields.get(i);
             const resolution = expectedForStep === undefined
                 ? resolveRecipeTarget(fresh, target)
@@ -5518,12 +5802,19 @@ export async function replayOperatorRecipe(sessionId, recipe, bindings, fromInde
                 action = { kind: "js_click", target: ref };
             }
             else {
-                action = { kind: "oauth_click", target: ref };
+                const recipeProvider = recipe.oauth_provider;
+                action = {
+                    kind: "oauth_click",
+                    target: ref,
+                    ...(recipeProvider === "google" || recipeProvider === "github"
+                        ? { provider: recipeProvider }
+                        : {}),
+                };
             }
         }
         try {
             await options.beforeAction?.({ step_index: i, action });
-            await act(sessionId, action, "none");
+            await actInternally(sessionId, action, "none");
             replayed += 1;
             const expected = state.expectedFields.get(i);
             if (expected !== undefined) {
@@ -5536,7 +5827,11 @@ export async function replayOperatorRecipe(sessionId, recipe, bindings, fromInde
         catch (error) {
             if (error instanceof ManualCardEntryBlockedError)
                 throw error;
-            return await fallback(step, i, error instanceof Error ? error.message : String(error));
+            return await fallback(step, i, session.compactV2Active
+                ? compactV2ActionFailureReason(error, action.kind)
+                : error instanceof Error
+                    ? error.message
+                    : String(error));
         }
     }
     return {
@@ -5615,10 +5910,11 @@ export function sanitizeExtractedCredentials(credentials, url, haystack = Object
         const k = normLabelKey(key);
         if (k === "refcode" || k === "referral_code")
             continue;
+        // Page PROSE is still dropped — a greeting or a date under a "Key" heading
+        // is not a value the page is presenting as a credential. A masked-looking
+        // display is NOT prose: it is what the page renders, so it is returned.
         if (isCredentialNoise(value))
             continue;
-        if ((k === "key" || k === "api_key") && !looksLikeCredentialValue(value))
-            continue;
         if (host === "api.together.ai" && /^key_[A-Za-z0-9]{16,}$/i.test(value.trim()))
             continue;
         normalized[key] = value;
@@ -5652,6 +5948,7 @@ export async function extractCredentials(sessionId) {
     if (session === undefined)
         throw new Error(`unknown provision session ${sessionId}`);
     const { browser } = session;
+    invalidateCompactV2Snapshot(session);
     // The masked-display trap: click reveal/show toggles before reading.
     await browser.revealMaskedCredentials();
     const labeled = await browser.extractLabeledCredentialCandidates();
@@ -5706,16 +6003,13 @@ export async function extractCredentials(sessionId) {
             : { kind: "full", value: key };
         state = accumulateCandidate(state, cls);
     }
-    // Named credentials for multi-cred services (skip still-masked values and
-    // env-var NAME displays — "LANGWATCH_API_KEY=" is the SDK-snippet prefix, not
-    // a credential).
+    // Named credentials for multi-cred services. Every labeled value the page
+    // renders is returned under its label — including one that still LOOKS masked.
+    // A value on the page is the agent's to read; refusing it (the old
+    // `isMasked` skip) boxed the operator out of keys the page was displaying.
     const named = {};
     for (const c of labeled) {
-        if (c.label === null || c.isMasked)
-            continue;
-        if (isCredentialNoise(c.value))
-            continue;
-        if (looksLikeCodeIdentifier(c.value))
+        if (c.label === null)
             continue;
         const k = normLabelKey(c.label);
         if (k.length > 0 && !(k in named))
@@ -5766,28 +6060,12 @@ export async function extractCredentials(sessionId) {
     }
     const sanitized = sanitizeExtractedCredentials(credentials, browser.currentUrl(), haystack);
     const found = Object.keys(sanitized).length > 0;
-    // Report-back so the agent keeps going instead of treating an empty result as
-    // done: if the page HAD labeled candidates but none survived as a real
-    // credential, they were page noise (a date/email/greeting) or a still-masked
-    // display — i.e. this isn't the keys page or the key needs revealing. Tell the
-    // agent that so it navigates/reveals and extracts again, rather than storing junk.
-    const notLegit = !found && labeled.length > 0
-        ? "no_legit_credential: the page had candidate values but none looked like a " +
-            "real key (they were page text — a date/email/label — or a still-masked " +
-            "display). You are likely NOT on the API-keys page, or the key is masked. " +
-            "Navigate to the keys/settings page (or click reveal/show/copy), then extract again."
-        : null;
-    audit(sessionId, "extract", {
-        found,
-        candidate_count: labeled.length,
-        not_legit: notLegit !== null,
-    });
+    audit(sessionId, "extract", { found, candidate_count: labeled.length });
     return {
         session_id: sessionId,
         url: browser.currentUrl(),
         credentials: sanitized,
         candidate_count: labeled.length,
-        ...(notLegit !== null ? { blocked_reason: notLegit } : {}),
     };
 }
 // A TwoCaptchaVaultProxy backed by the MCP api-client: every 2Captcha call is
@@ -5904,6 +6182,7 @@ export async function captchaGate(sessionId) {
     const session = sessionForCall(sessionId);
     if (session === undefined)
         throw new Error(`unknown provision session ${sessionId}`);
+    invalidateCompactV2Snapshot(session);
     const det = await session.browser.detectCaptchaVariant();
     const found = det.variant !== "unknown" || det.challengeRendered;
     if (!found) {
@@ -5996,15 +6275,10 @@ export async function captchaGate(sessionId) {
 // number elsewhere in the mail doesn't win; falls back to the first standalone
 // 4-8 digit run. The link uses the bot's pickVerificationLink heuristic.
 const OTP_ANY_RE = /(?:^|[^0-9])(\d{4,8})(?:[^0-9]|$)/g;
-const OTP_KEYWORD_RE = /(?:code|verification|verify|otp|passcode|one[- ]time)\D{0,40}?(\d{4,8})|(\d{4,8})\D{0,8}?(?:code|verification|verify|otp|passcode)/i;
-export function parseVerification(text, links) {
-    const link = pickVerificationLink([...links]);
-    const kw = OTP_KEYWORD_RE.exec(text);
-    let code = null;
-    if (kw !== null) {
-        code = kw[1] ?? kw[2] ?? null;
-    }
-    else {
+export function parseVerification(text, links, expectedDomains) {
+    const link = pickVerificationLink([...links], expectedDomains);
+    let code = findOtpCredential(text);
+    if (code === null) {
         const m = OTP_ANY_RE.exec(text);
         code = m !== null ? (m[1] ?? null) : null;
     }
@@ -6019,6 +6293,17 @@ export function extractSenderEmail(text) {
     const m = /<([A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,})>/.exec(text);
     return m !== null ? m[1].toLowerCase() : null;
 }
+// Derives the domain(s) pickVerificationLink should prefer: the caller's
+// `sender` search hint (an email address or a bare domain) and the sender
+// address read off the opened message, deduped and lowercased. Exported for
+// unit tests.
+export function expectedVerificationDomains(sender, sourceFrom) {
+    const domainOf = (s) => (s.includes("@") ? s.split("@").pop() : s).toLowerCase();
+    const domains = [sender, sourceFrom ?? undefined]
+        .filter((s) => s !== undefined && s.length > 0)
+        .map(domainOf);
+    return [...new Set(domains)];
+}
 // Pure: assemble the verification result. When neither a code nor a link was
 // found, the thick session is still live, so this is a RESUMABLE hand-back
 // (Flow A) — the host asks the user for the code and types it — not a give-up.
@@ -6039,21 +6324,19 @@ export function buildVerificationResult(sessionId, code, link, sourceFrom = null
     };
     return { session_id: sessionId, found, code, link, needs_user, ...src };
 }
-// PR2 — consent refusal. The user has not consented to the operator reading
-// their inbox, so we do NOT read it. The session stays live (resumable): the
-// host asks the user for the code and types it, or the user grants inbox consent
-// and retries. Distinct message from buildVerificationResult so the host can tell
-// "consent withheld" apart from "code not found in an inbox we DID read".
+// Inbox-read opt-out refusal. The session stays live (resumable): the host asks
+// the user for the code and types it, or restores inbox access and retries.
+// Distinct from buildVerificationResult so the host can tell "access disabled"
+// apart from "code not found in an inbox we DID read".
 // Exported for unit tests.
 export function buildConsentRefusal(sessionId) {
     const needs_user = {
         wall: "verification_code",
-        message: "Inbox reading is not consented, so the operator did not read any mail. Ask " +
-            "the user, in context: may the operator read your inbox to fetch the code for " +
-            'this signup? If YES, retry operate_act { kind: "await_verification" } with ' +
-            "grant_inbox_consent:true (grants it for the rest of this session). If NO, " +
-            "ask them for the code and type it with operate_act — the session is still " +
-            "live either way. (To grant it permanently, re-run `connect` and allow inbox access.)",
+        message: "Inbox reading is disabled, so the operator did not read any mail. Ask " +
+            "the user for the code and type it with operate_act, or retry " +
+            'operate_act { kind: "await_verification" } with grant_inbox_consent:true ' +
+            "to restore inbox reading for this session. The session stays live either way. " +
+            "To change the default permanently, re-run `connect` and update advanced settings.",
         resume: "code",
     };
     return { session_id: sessionId, found: false, code: null, link: null, needs_user };
@@ -6069,72 +6352,112 @@ export function buildVerificationSearchQuery(sender) {
     return [
         sender !== undefined && sender.length > 0 ? `from:${sender}` : "",
         "newer_than:1d",
-        '(verify OR verification OR confirm OR confirmation OR code OR otp OR passcode OR password OR login OR "log in" OR "sign in" OR "sign-in" OR signin OR "magic link" OR activate OR activation OR welcome)',
+        '(verify OR verification OR confirm OR confirmation OR code OR otp OR passcode OR password OR login OR "log in" OR "sign in" OR "sign-in" OR signin OR "magic link" OR activate OR activation OR welcome OR "link account" OR "link your" OR continue)',
     ]
         .filter((s) => s.length > 0)
         .join(" ");
 }
+// Gmail's own search backend intermittently throws a transient error —
+// "Oops... the system encountered a problem (#2014) - Retrying in Ns" —
+// and while that banner is up a search like `from:xata.io` can spuriously
+// render "No messages matched your search" even though the message is
+// really there. Exported for unit tests.
+export function isGmailTransientErrorText(text) {
+    return /#2014|encountered a problem|retrying in\s*\d+/i.test(text);
+}
+// Exported for unit tests.
+export function isEmptyGmailResultText(text) {
+    return /no messages matched your search/i.test(text);
+}
+// Backoff schedule for the transient-error retry, in ms: 800, 1600, 3200,
+// capped at 4000. Exported for unit tests.
+export function gmailTransientBackoffMs(retryIndex) {
+    return Math.min(800 * 2 ** retryIndex, 4000);
+}
+// Bounded — a genuinely empty inbox must still resolve to not-found in
+// finite time, not hang retrying forever.
+const GMAIL_TRANSIENT_MAX_RETRIES = 3;
+// Reads the Gmail search results list, retrying through Gmail's own transient
+// backend error with backoff before accepting a result as final. Detects
+// EITHER the error banner itself, or an empty-looking "No messages matched"
+// render with no result links (the shape the banner's spurious empty state
+// takes) — and only gives up on the bounded retries running out, never on
+// the first read. Exported for unit tests via the pure detectors above; this
+// wrapper needs a live browser so it isn't itself unit tested directly.
+async function readGmailSearchResultsResilient(browser, searchUrl, linkCandidatesOf) {
+    let text = "";
+    let links = [];
+    for (let retry = 0; retry <= GMAIL_TRANSIENT_MAX_RETRIES; retry++) {
+        if (retry > 0) {
+            await browser
+                .waitForCaptchaChallengeToSettle(gmailTransientBackoffMs(retry - 1), 0)
+                .catch(() => false);
+            await browser.goto(searchUrl);
+        }
+        for (let i = 0; i < 6; i++) {
+            text = await browser.extractVisibleText();
+            if (text.length > 200)
+                break;
+            await browser.waitForCaptchaChallengeToSettle(1200, 0).catch(() => false);
+        }
+        links = linkCandidatesOf(await browser.extractInteractiveElements());
+        const transientOrEmpty = isGmailTransientErrorText(text) || (isEmptyGmailResultText(text) && links.length === 0);
+        if (!transientOrEmpty || retry === GMAIL_TRANSIENT_MAX_RETRIES)
+            break;
+    }
+    return { text, links };
+}
 export async function awaitVerification(sessionId, opts = {}) {
     const session = sessionForCall(sessionId);
     if (session === undefined)
         throw new Error(`unknown provision session ${sessionId}`);
-    const { browser } = session;
-    // PR3b — JIT consent grant: the host passes grantConsent ONLY after the user
-    // agreed in-context. Grant inbox-read for the rest of this session (remembered
-    // so we don't re-prompt each await); does not touch the standing install flag.
-    if (opts.grantConsent === true && !session.consentInboxRead) {
-        session.consentInboxRead = true;
-        audit(sessionId, "inbox_consent_granted", { scope: "session" });
-    }
-    // PR2 fail-closed gate: without inbox-read consent, do NOT read the user's
-    // mail. Hand the code request back to the user instead (resumable). The old
-    // behavior read mail.google.com unconditionally, silently breaking the
-    // default-off consent promise.
+    // A caller can override the default for this session without changing the
+    // saved advanced preference. In particular, false must win over default-on.
+    if (opts.grantConsent !== undefined && opts.grantConsent !== session.consentInboxRead) {
+        session.consentInboxRead = opts.grantConsent;
+        audit(sessionId, opts.grantConsent ? "inbox_consent_granted" : "inbox_consent_revoked", {
+            scope: "session",
+        });
+    }
+    // Explicit opt-out gate: do NOT read mail while disabled. Hand the code
+    // request back to the user instead (resumable).
     if (!session.consentInboxRead) {
         audit(sessionId, "await_verification", { refused: "no_inbox_consent" });
         return buildConsentRefusal(sessionId);
     }
-    const query = buildVerificationSearchQuery(opts.sender);
-    const searchUrl = `https://mail.google.com/mail/u/0/#search/${encodeURIComponent(query)}`;
-    const hrefsOf = (els) => els.map((e) => e.href).filter((h) => typeof h === "string" && h.length > 0);
-    // A verification email commonly lands 10–30s AFTER the trigger, so a single
-    // search misses it and hands back "not found" the agent has to re-issue. Re-run
-    // the search up to 3× with a short wait between attempts within this one call.
-    let code = null;
-    let link = null;
-    let sourceFrom = null;
-    for (let attempt = 0; attempt < 3 && code === null && link === null; attempt++) {
-        sourceFrom = null;
-        if (attempt > 0)
-            await browser.waitForCaptchaChallengeToSettle(4000, 0).catch(() => false);
-        // Internal navigation (not an agent goto) — sanctioned read of the user's mail.
-        await browser.goto(searchUrl);
-        // Poll briefly for the result list to render.
-        let listText = "";
-        for (let i = 0; i < 6; i++) {
-            listText = await browser.extractVisibleText();
-            if (listText.length > 200)
-                break;
-            await browser.waitForCaptchaChallengeToSettle(1200, 0).catch(() => false);
-        }
-        const listLinks = hrefsOf(await browser.extractInteractiveElements());
-        const opened = await browser.openFirstMailResult().catch(() => false);
-        if (opened) {
-            // Parse the OPENED email as the AUTHORITATIVE source. Merging the
-            // results-list snippets let an UNRELATED sender's code (a bank OTP shown in
-            // the list) override the target email's link — a real wrong-code grab
-            // (Brave signup 2026-07-04: a GO2bank "verification code is 580210" beat
-            // Brave's verify LINK). The list snippets stay a fallback only, for when the
-            // mail won't open (an OTP-in-snippet still works then).
-            const openedText = await browser.extractVisibleText();
-            const openedLinks = hrefsOf(await browser.extractInteractiveElements());
-            sourceFrom = extractSenderEmail(openedText);
-            ({ code, link } = parseVerification(openedText, [...openedLinks, ...listLinks]));
-        }
-        else {
-            ({ code, link } = parseVerification(listText, listLinks));
-        }
-    }
+    invalidateCompactV2Snapshot(session);
+    const verification = await runDetachedGoogleIdentityOperation(session, async (browser) => {
+        return await browser.withTemporaryHostScopeAllowedHosts(["mail.google.com"], async () => {
+            const query = buildVerificationSearchQuery(opts.sender);
+            const searchUrl = `https://mail.google.com/mail/u/0/#search/${encodeURIComponent(query)}`;
+            const linkCandidatesOf = (els) => els
+                .filter((e) => typeof e.href === "string" && e.href.length > 0)
+                .map((e) => ({ url: e.href, text: e.visibleText ?? e.labelText ?? e.ariaLabel ?? null }));
+            let code = null;
+            let link = null;
+            let sourceFrom = null;
+            for (let attempt = 0; attempt < 3 && code === null && link === null; attempt++) {
+                sourceFrom = null;
+                if (attempt > 0)
+                    await browser.waitForCaptchaChallengeToSettle(4000, 0).catch(() => false);
+                await browser.goto(searchUrl);
+                const { text: listText, links: listLinks } = await readGmailSearchResultsResilient(browser, searchUrl, linkCandidatesOf);
+                const opened = await browser.openFirstMailResult().catch(() => false);
+                if (opened) {
+                    const openedText = await browser.extractVisibleText();
+                    const openedLinks = linkCandidatesOf(await browser.extractInteractiveElements());
+                    sourceFrom = extractSenderEmail(openedText);
+                    const expectedDomains = expectedVerificationDomains(opts.sender, sourceFrom);
+                    ({ code, link } = parseVerification(openedText, [...openedLinks, ...listLinks], expectedDomains));
+                }
+                else {
+                    ({ code, link } = parseVerification(listText, listLinks, expectedVerificationDomains(opts.sender, null)));
+                }
+            }
+            return { code, link, sourceFrom };
+        });
+    });
+    const { code, link, sourceFrom } = verification;
     const found = code !== null || link !== null;
     audit(sessionId, "await_verification", {
         sender: opts.sender ?? null,
@@ -6160,163 +6483,4 @@ export async function awaitVerification(sessionId, opts = {}) {
     }
     return buildVerificationResult(sessionId, code, link, sourceFrom);
 }
-function profileRequiresDestroy(session) {
-    return (session.activePayment !== null ||
-        session.paymentFieldSealActive ||
-        session.pendingThreeDs !== null);
-}
-function pendingThreeDsAuditStatus(resolution) {
-    if (resolution === "succeeded")
-        return "payment_submitted";
-    if (resolution === "failed")
-        return "payment_declined";
-    return "payment_3ds_unresolved";
-}
-async function auditPendingThreeDsForSessionClose(session) {
-    const pending = session.pendingThreeDs;
-    if (pending === null)
-        return;
-    if (session.api === undefined) {
-        throw new Error("operate_finish refused: pending 3-D Secure outcome cannot be audited without an active API session");
-    }
-    const resolution = await session.browser.waitForThreeDsResolution(0);
-    const recordAudit = async () => {
-        await session.api.auditPayment({
-            ...pending.checkout,
-            last4: pending.last4,
-            status: pendingThreeDsAuditStatus(resolution),
-            approval_id: pending.approval_id,
-            ...(pending.mandate_id !== undefined ? { mandate_id: pending.mandate_id } : {}),
-        });
-    };
-    const handoff = session.paymentDispatchHandoff;
-    if (handoff?.state === pending) {
-        handoff.auditPromise ??= recordAudit();
-        await handoff.auditPromise;
-        return;
-    }
-    await recordAudit();
-}
-async function auditPendingThreeDsForSessionCloseBounded(session) {
-    const timeoutMs = positiveTimeout("TRUSTY_SQUIRE_OPERATOR_PENDING_3DS_FINALIZE_TIMEOUT_MS", DEFAULT_PENDING_THREE_DS_FINALIZE_TIMEOUT_MS);
-    await withTerminalTimeout(auditPendingThreeDsForSessionClose(session), timeoutMs, `pending 3-D Secure finalization exceeded ${timeoutMs}ms`);
-}
-async function closeFinishingProvisionSession(session, destroyProfile) {
-    const sessionId = session.id;
-    await auditPendingThreeDsForSessionCloseBounded(session);
-    const url = session.browser.currentUrl();
-    audit(sessionId, "finish", { url });
-    session.activePayment = null;
-    session.paymentFieldSealActive = false;
-    session.pendingThreeDs = null;
-    sessions.delete(sessionId);
-    stopSessionWatchdog(session);
-    await releaseWarmBrowserPage(session.browser, !destroyProfile);
-    disposeSessionWatchdog(session);
-    return { session_id: sessionId, url, closed: true };
-}
-export async function finishProvisionSessionWithPreparation(sessionId, prepare) {
-    const session = sessionForCall(sessionId);
-    if (session === undefined)
-        throw new Error(`unknown provision session ${sessionId}`);
-    if (session.closing)
-        throw new Error(`provision session ${sessionId} is already closing`);
-    const owner = {
-        forced: false,
-        forcePromise: null,
-        routinePromise: null,
-    };
-    session.terminalTeardownOwner = owner;
-    session.closing = true;
-    stopSessionWatchdog(session);
-    const timeoutMs = positiveTimeout("TRUSTY_SQUIRE_OPERATOR_TERMINAL_TRANSITION_TIMEOUT_MS", DEFAULT_SESSION_TERMINAL_TRANSITION_TIMEOUT_MS);
-    let timer;
-    const transition = (async () => {
-        const drained = await waitForSessionCallsToDrain(session);
-        if (!drained) {
-            await forceTerminateProvisionSession(session, "finish_forced_terminate", {
-                reason: "call_drain_timeout",
-            });
-            throw new Error(`provision session ${sessionId} call drain timed out; browser terminated`);
-        }
-        const prepared = await prepare();
-        if (owner.forced || sessions.get(sessionId) !== session) {
-            throw new Error(`provision session ${sessionId} terminal transition was forced`);
-        }
-        const destroyProfile = profileRequiresDestroy(session);
-        try {
-            const finish = await closeFinishingProvisionSession(session, destroyProfile);
-            return { finish, prepared };
-        }
-        catch (error) {
-            await forceTerminateProvisionSession(session, "finish_forced_terminate", { reason: "terminal_close_failed" }, false);
-            throw error;
-        }
-    })();
-    try {
-        return await Promise.race([
-            transition,
-            new Promise((_, reject) => {
-                timer = setTimeout(() => {
-                    void forceTerminateProvisionSession(session, "finish_forced_terminate", {
-                        reason: "terminal_transition_timeout",
-                        timeout_ms: timeoutMs,
-                    }).then(() => reject(new Error(`provision session ${sessionId} terminal transition timed out; browser terminated`)), reject);
-                }, timeoutMs);
-                timer.unref();
-            }),
-        ]);
-    }
-    catch (error) {
-        if (!owner.forced && sessions.get(sessionId) === session) {
-            session.closing = false;
-            session.terminalTeardownOwner = null;
-            startSessionWatchdog(session);
-        }
-        throw error;
-    }
-    finally {
-        if (timer !== undefined)
-            clearTimeout(timer);
-    }
-}
-export async function finishProvisionSession(sessionId) {
-    return (await finishProvisionSessionWithPreparation(sessionId, async () => undefined)).finish;
-}
-// Test/teardown helper — close every live session (used by the dev shim on exit).
-export async function closeAllProvisionSessions() {
-    shutdownGeneration += 1;
-    const waiters = [...capacityWaiters];
-    for (const waiter of waiters) {
-        waiter.cancelRequested = true;
-        waiter.abortController.abort();
-        waiter.wake();
-    }
-    await Promise.all(waiters.map((waiter) => waiter.settled));
-    for (const pending of [...startingBrowsers]) {
-        await cancelStartingBrowser(pending).catch(() => undefined);
-    }
-    const closingSessions = [...sessions.values()];
-    for (const session of closingSessions) {
-        session.closing = true;
-        stopSessionWatchdog(session);
-    }
-    let closeError;
-    for (const session of closingSessions) {
-        const drained = await waitForSessionCallsToDrain(session);
-        const error = await forceTerminateProvisionSession(session, "shutdown_terminate", {
-            reason: drained ? "transport_disconnect" : "call_drain_timeout",
-        });
-        if (closeError === undefined && error !== undefined)
-            closeError = error;
-    }
-    for (const slot of [...leasedBrowsers.values()]) {
-        await forceReleaseWarmBrowserPage(slot.controller).catch(() => undefined);
-    }
-    if (closeError !== undefined)
-        throw closeError;
-}
-export function activeSessionCount() {
-    return sessions.size;
-}
 //# sourceMappingURL=provision-session.js.map