# Implementation progress

Updated: 2026-09-15 (Asia/Shanghai). Goal remains active. These are implementation increments of the [full v2 plan](plans/browser-runtime-plan-v2.zh-CN.md), not completion of that plan.

## Authoritative evidence collected

Bounded page windows now work inside one authorized same-origin child document or known child root. The optional portable `readFramePage` seam, exact frame/root scopes and source-bound pager preserve child epochs and refs without widening to the root page or entering nested frames. A targeted, document-bound boolean text predicate also fixes post-click confirmation when feedback falls beyond the ordinary bounded child observation; action results remain frame-scoped for delta-cache correctness. Real Chrome and Edge assembled gates each pass seven groups over 4,000 controls/81 windows, including a trusted final-window click with no replay, token/scope/reorder/replacement/adoption denial, incomplete whole-child marking, navigation and actual Stop/re-consent. [Chrome](compatibility/2026-09-15-chrome-frame-page-native.json), [Edge](compatibility/2026-09-15-edge-frame-page-native.json), [usage and limits](development.md#bounded-same-origin-child-page-windows). Cross-origin approval, OOPIF input geometry, richer child actions and model/Codex acceptance remain unfinished.

Child-region reading and contextual lookup combine `frame` with an already observed `rootRef`, optionally `query`. The portable `observeFrameSubtree` seam and optional `findFrame` root argument reuse independent scope/delta validation, while shared source `withFrameNodeScope` binds document/root identity, filters composed membership (including open shadow/slot paths), rechecks root semantics and releases objects before publication. Scoped reads verify at most 256 projected nodes and queries 128 under shared object/call limits. Seven real DSH → Native → MV3 groups pass on each of Chrome and Edge, including Billing-only disambiguated trusted Save, region/query deltas, root/sibling/foreign exclusions, same-name replacement, adoption into a same-origin sibling and Stop/re-consent. [Chrome evidence](compatibility/2026-09-12-chrome-frame-subtree-native.json), [Edge evidence](compatibility/2026-09-12-edge-frame-subtree-native.json), [usage and bounds](development.md#known-child-regions-and-contextual-queries). Child paging is now covered by the newer evidence above; richer input, cross-origin approval and the remaining original-plan gates are still incomplete.

Exact child queries combine `browser_observe`'s `frame` and `query`, with optional portable `findFrame`, independent query/frame cursors, document-root binding, per-candidate ownership and object-bound AX identity, and cleanup/publication fences. The source caps candidate ownership work at 128 and preserves the shared bounded scope budget; there is no root-search fallback. Real Chrome/Edge native gates each pass eight groups, including a control omitted from a 220-control default view, formal trusted click/no replay, 20 duplicate candidates and delta reconstruction, wrong-scope/root/sibling/foreign-descendant exclusion, same-name replacement, child reload and Stop/re-consent. [Chrome](compatibility/2026-09-12-chrome-frame-query-native.json), [Edge](compatibility/2026-09-12-edge-frame-query-native.json), [usage/bounds](development.md#exact-same-origin-child-queries). Child paging is now covered by the newer evidence above; richer input, cross-origin approval and model/Codex acceptance remain unfinished. Earlier report hashes are dated evidence for their recorded builds, not a claim that every old report matches the current sources.

The latest increment adds explicit `browser_act({frame,...})` for same-origin, same-process child clicks, with matching child epochs, semantic source binding, read-only preparation, fresh dispatch checks, child-only text verification and durable no-replay behavior. Public tool count remains nine. Source/runtime/provider/extension/adapter tests cover validation, immutable policy inputs, wrong scope, context/origin changes, Stop, missing acknowledgement and no root fallback. Real DSH → Native → MV3 gates pass 11 groups on each of Chrome and Edge, including transformed nested frames, approval refusal, Stop during approval and Broker SIGKILL after trusted input. All 17 public approval requests per run have one audited decision; owned cleanup completes. [Chrome report](compatibility/2026-09-12-chrome-frame-click-native.json), [Edge report](compatibility/2026-09-12-edge-frame-click-native.json), [usage and explicit limitations](development.md#explicit-same-origin-child-clicks). This is not richer child input, OOPIF/cross-origin support or Codex parity.

| Area | Implemented / observed | Evidence and scope |
|---|---|---|
| Contracts/core | Provider boundary, owner-bound leases, fencing tokens, serial queues, cancellation, bounded request deduplication, unknown dispatch outcomes | `test/runtime.test.mjs`; includes non-Chromium FakeProvider |
| Bounded action batches | 1–8 explicit steps, shared deadline and single tab queue slot, public DSH approval per step, post-approval policy/lease recheck, whole-plan and child durable fences, stop on failure/unknown/document replacement, metadata-only step results and at most one final observation | `test/batch.test.mjs` and adapter regressions cover immutable plans, concurrent duplicates, queue isolation, denial/cancel/Stop, callback identity/index/capacity, cache eviction and journal restart/settlement faults. `test:batch-native` passes seven real DSH ApprovalService/Session/audit → Broker/Native/MV3/Chrome checks, including partial denial, real policy rejection, popup Stop and owned-Broker SIGKILL after input; 16 asked events each have one unique decided event. Controlled answerer, not approval UI/model acceptance; no automatic resume/rollback/new-ref variables |
| Incremental observation | Immutable per-consumer cursors, node/text deltas, deterministic public reducer, document/scope resync, bounded cache, action-result cursors | `test/observations.test.mjs` includes 300 deterministic mutation round trips; runtime and real DSH/native cursor tests; each call freshly reads its requested scope |
| Bounded source discovery/scoped reads | Shared Chromium AX walker runs inside MV3; reachable-root traversal, bounded nodes/edges/retained bytes/AX calls/depth/output, semantic projection, explicit truncation, root/loader/Stop checks and 2,048-ref LRU | `test/ax-reader.test.mjs`, provider/extension regressions; real CDP and native 4,000-button fixture whose raw AX exceeds 1 MiB; no full-tree transfer or scoped-to-document fallback; explicit window continuation now listed separately below |
| Live page windows | Portable optional root and child-frame page seams, separate read tool/no delta-cache pollution, bounded source-side DFS windows, identity-only single-use continuation, lease/document/frame/root binding and fresh active-path checks, upcoming-node rereads, scope-root LRU preservation, Stop/navigation cleanup | Root and child pager/runtime/adapter/provider/extension regressions; root `test:page-native` passes seven isolated checks. Child `test:frame-page-native` passes seven assembled checks per Chrome/Edge: 4,000 controls across 81 ordered windows, trusted final-window click with off-window text confirmation/no replay, scope/token/reorder/replacement/adoption refusal, nested-frame incomplete marking, navigation and Stop/re-consent. Maximum child results 5,943/5,942 bytes; no atomic snapshot, virtualized-list, LLM or latency claim |
| Exact semantic search | Optional portable `find`, literal name/role source filters, optional known context, distinct duplicate refs, query-specific cursor scope, bounded projection and normal action identity/approval | `test/semantic-query.test.mjs`, provider/extension regressions; real Chrome/native search beyond default discovery, contextual duplicates, literal/case-sensitive matching, iframe exclusion and same-name replacement rejection; no automatic selection or fuzzy search |
| Page keyboard | Portable named-key action, optional Shift, canonical CDP key pairs, extension key/code/modifier validation, AX + DOM focus checks shared with fill, historical deduplication | `test/keyboard.test.mjs`, provider/extension regressions; real Chrome and DSH/native trusted events, form submission, caret/focus movement and focus-stealing fixtures |
| Contenteditable fill | Existing portable fill action, generic AX editing-host discovery/search, exact host/focus/full-selection checks, trusted insertion/deletion, bounded logical editing-text verification including caret-placeholder BR and final identity/value recheck | `test/editable.test.mjs`, provider regressions and `scripts/verify-editable.mjs` through direct Chrome and assembled DSH/native: Chinese/emoji/multiline, whitespace copy-text oracle, rich/plaintext-only/open-shadow/generic hosts, protected/oversized refusal, beforeinput prevention, focus/selection theft and no replay; not IME, arbitrary HTML/CSS serialization or full framework-editor acceptance |
| Guarded suffix append | Portable `append` action, bounded current-prefix capture, native/editor end-caret positioning, last-call text/caret check, native maxlength and combined-value budget, suffix-only insertion, full final value and replay fencing | `test/append.test.mjs`, provider regressions and `scripts/verify-append.mjs` through direct Chrome and assembled DSH/native: trusted suffix data, prefix/format-node preservation, textarea/generic/open-shadow hosts, empty/trailing-newline content, no-op, page-value/caret changes, prevented input and stale targets; durable append records reopen; not arbitrary-caret typing or atomic protection from all later edits |
| Element-state postconditions | Portable state/ref expectation for attachment, layout visibility, supported enabled/disabled and checked/unchecked predicates; exact pre-input object binding, bounded read-only predicate, same-document wait and post-observation recheck | `test/element-state.test.mjs`, provider/adapter regressions, and `scripts/verify-element-state.mjs` through Chrome and real DSH/native: delayed conditions, native fieldset, open shadow, same-object reattachment, same-name replacement rejection, stale/unsupported preflight, prevented fill, action-specific paths and deduplication; cancelled/lost-object/navigation and final-read races covered in provider regressions. Not new-node discovery, transition/causation proof, global dialog absence or cross-frame support |
| Checkbox/switch state | Portable boolean `check`, observable checked/mixed state, AX/DOM agreement, no-op when already correct, one trusted click at most and final state/identity verification | Checked contract/provider/query tests; `scripts/verify-checked.mjs` through direct Chrome and real DSH/native; no-op/dedup, delayed switch, prevented toggle and replaced target; native radios now covered separately below |
| Native radio selection | `check` with true only, exact native group behavior, action-local input/tree/form/name/value binding, label fallback, no-op, one click and checked-state verification | Checked/provider/capability tests; `scripts/verify-radio.mjs` through both browser paths: trusted events, form isolation, nameless independence, cancellation of default activation, disabled/custom refusal, group changes before/after input and replacement refs; not custom ARIA radio or a transactional peer-group snapshot |
| Native checkbox label surface | Sole explicit/wrapping native association, original input identity/state, label hit/stability checks, disabled/inert input ancestry, exact-label scrolling, pre-input binding recheck and object cleanup | `test/checked.test.mjs`, provider regressions and `scripts/verify-check-labels.mjs` through direct Chrome and DSH/native; transparent input, no-op/dedup, nested-button exclusion, disabled external label, offscreen label, hidden-label fallback and mid-geometry reassociation; multiple labels/AX-absent inputs/custom-element activation not yet supported |
| Explicit DOM scrolling | Portable document/exact-element action, signed before/after offsets, stable measurement, boundary evidence, exact target binding and single dispatch | `test/scroll.test.mjs` and `scripts/verify-scroll.mjs`; real Chrome and assembled native checks for nested containers, RTL, loaded text, deduplication and replacement rejection; not wheel/gesture or cross-frame support |
| Native wheel sample | Portable ref-bound `wheel`, bounded signed CSS-pixel deltas, stable exact hit point, one canonical CDP sample, MV3 parameter/Stop gate and optional text/URL verification | `test/wheel.test.mjs`, extension regressions and `scripts/verify-wheel.mjs` through Chrome and DSH/native; trusted canvas handler without DOM scrolling, vertical/horizontal overflow, no-repeat unknown result and stale/nested-target refusal; not continuous gestures, inferred movement or cross-frame support |
| Exposed-point actionability | Bounded client-rect/clip candidates, composed-tree hit ownership, nested-control rejection and exact selected-point recheck before mouse-down | `test/actionability.test.mjs`, provider regressions and `scripts/verify-actionability.mjs`; trusted real Chrome/native clicks on partial overlay, multiline, narrow-clip and open-shadow fixtures; no nested-control misclick |
| Transport | Bounded native-endian frames, malformed-input rejection, bidirectional RPC, cancellation, backpressure; typed local deadline/lease/Stop reason preservation | `test/transport.test.mjs`; native nested-control timeout originally reproduced a false `CANCELLED` classification and now returns `DEADLINE_EXCEEDED` |
| Wire contract and negotiation | Shared Node/MV3 envelope and hello/welcome validation, generated JSON Schema, required-capability negotiation, lifetime transport-ID replay rejection and explicit local-close teardown | `test/wire.test.mjs` compares over 1,000 mutations with independent Ajv 2020; Unix-socket rejection before registration/use; MV3-bundle pre-welcome, timeout, replay and obsolete-port regressions; isolated native/MV3 smoke rerun |
| Connection/control lifecycle budgets | Default 64 sockets, 16 providers, 64 live/reserved leases, 32 pending claims; typed claim deadline, connection-scoped release and no historical Broker owner/lease index | `test/resources.test.mjs`, real-socket Broker admission/churn/release tests; simultaneous grants, expiration, ignored cancellation, late grant cleanup, same-ID provider replacement and same-session-name connection isolation; full native/Chrome regression rerun |
| Action-result retention | Independent 128-entry/8 MiB/128 KiB per-result/120-second LRU payload cache; settled identity fences retain metadata, not result Promises; eviction never permits replay; release purges payloads and checks late delivery | `test/action-results.test.mjs`; real-socket 129-action/default-cache eviction and session release; full Chrome/native duplicate-action regression; byte accounting and structural retention evidence, not heap/RSS or soak certification |
| Broker/host | Private Unix socket/token, version handshake, restricted exact-origin policy plus explicit personal consented-tab policy, owner isolation, native-host launcher/relay | `test/broker.test.mjs`; actual socket and child process, including tab-scoped cross-origin rebinding, not browser startup of host |
| Durable replay fences | Before-provider fsynced intent, metadata-only keyed journal, bounded expiry/atomic compaction, fail-closed persistence, independent reconnect capability and lease authority | `test/journal.test.mjs`, Broker restart/isolation tests and real DSH/native repeat-after-restart; child SIGKILL after side effect leaves a non-replayable intent; not exactly-once business execution |
| Broker lifetime ownership | SQLite exclusive transaction, metadata-only stable lock inode, guarded stale-socket removal, fail-closed unsafe state, shutdown drain before ownership release | `test/ownership.test.mjs`: four competing processes, SIGKILL/restart, interrupted action recovery, legacy listener/unsafe path preservation; real independent CLI Broker SIGKILL in native smoke; macOS/local filesystem evidence |
| Installation integrity | Three-file bounded/no-follow preflight, owned-launcher/manifest validation, per-runtime and per-manifest locks, brand-scoped origin additions, unchanged-file no-op, atomic per-file publication and ordinary-failure rollback | `test/installer.test.mjs`: real files, post-publication faults, foreign replacement preservation, independent-process lock/SIGKILL/retry; native smoke repeats installation while Broker runs, then Chrome launches the host; no multi-file crash transaction yet |
| Scoped host unregistration | Explicit browser/extension-ID removal, private durable manifest backup before change, last-origin manifest removal, no-op on absence, shared state/other browser preservation and common installer locks | `test/uninstall.test.mjs`: real file/CLI conflicts and backup-write failure; native smoke proves fresh Chrome host discovery fails after unregistration and succeeds after reinstall while the old connection is not stopped; not package deletion, active-lease revocation or system-wide policy removal |
| Read-only doctor | Versioned redacted report, bounded private-file checks, manifest/origin/extension matching, fixed launcher/path checks, shared-deadline handshake/list, brand counts and recovery hints | `test/doctor.test.mjs`: actual temporary installation, unsafe/missing/malformed paths, moved launcher, silent socket, invalid response and child CLI exit; real native installation/connection preflight preserves an active DSH lease; no repair or browser authority |
| Chromium engine | AX controls/text, identity-preserving refs, shared-deadline actionability/postcondition waits, auto-scroll, click/fill/empty fill, exact-origin navigation plus personal tab-scoped HTTP(S) navigation, value/URL/text confirmation, stable viewport image | `test/chromium.test.mjs`, `test/wait.test.mjs`; plus live Chrome below |
| Extension | Shared Chrome/Edge build, startup handshake, popup consent in restricted mode, negotiated prompt-free HTTP(S) discovery in explicit personal mode, HTTP(S) host permission for cross-site pointer presentation, origin/tab-scoped last-mile gates, Stop, debugger attach/release, bounded payload-free change events | `test/extension.test.mjs` on bundled script with API double; real MV3 seam below |
| DSH | Nine tools, normal approval hook, exact-origin trusted mode, tab-scoped personal mode, separate public per-step batch approval, Host image output, and a Web client module sourced from canonical Session Controller state | `scripts/smoke-dsh.mjs` passed against installed CLI 0.1.5-rc.1 and its resolved runtime modules; fake browser, real tool/attachment services. The local browser-lab Web module list includes `dsh-native-browser/client.js`; batch/page/frame service/native evidence is listed separately |
| DSH lifecycle | Pre-approval binding, synchronous cancellation on restricted turn/end, all-mode session disposal/foreground-conversation change, personal same-conversation turn retention, stale client update rejection, disposal guard, no image return to revoked executions | `test/adapter.test.mjs` and `test/client.test.mjs`; plus actual DSH late-approval race reproduced and fixed in native integration below. Full active-lease interruption through a human UI switch remains a manual acceptance item |
| Vision-adapter foundation | Bounded turn/lease-scoped ScreenshotRef metadata, Host canonical hash verification, public Router result parser, affine pixel/CSS mapping, invalid-box rejection | `test/vision.test.mjs`, including 30 deterministic DPR/zoom/scroll fixtures; real DSH/native screenshot hash-size-lease checks; no vision-model or visual-click proof |
| Screenshot publication lifecycle | Eight pending captures max, turn/lease/connection cancellation, metadata-only owner-targeted revocation, same-connection authority check after Host storage/read | A regression first reproduced late publication after handoff; runtime/Broker/adapter tests cover revocation, origin change without event, foreign owner, listener/capture bounds and disconnect. Native smoke holds completion of real Host storage/read and proves handoff/actual popup Stop return no image, then explicit re-consent permits a new capture. Historical Host images are not deleted |
| Public Vision Router compatibility | Actual DSH ToolRuntime/Session/Host attachment and file services with Router public entry, explicit Vision-mode route, complete/short attachment IDs, public grounding inverse and CSS mapping | `scripts/smoke-vision-router.mjs`: 6 checks on Router 2.1.5 and DSH 0.1.5-rc.1; random pixel target, same-session image authorization, cross-session denial and local 429; FakeProvider and loopback pixel detector, not Chrome/LLM; exact socket fence blocks upstream npm/GitHub update attempts; no production egress/visual-action claim |
| Live Chrome | Chinese AX, scoped reads/byte measurements, large-page traversal/semantic search, fill/empty fill/append, keyboard and focus guards, contenteditable/Shadow DOM/generic editing hosts, checkbox/radio/label surfaces, fragment-based click points, delayed text, temporary overlay, cancellation, explicit DOM scrolling and native wheel, offscreen auto-scroll, navigation, stale refs, JPEG capture, release | `pnpm test:chrome` passed 90 checks on Chrome `152.0.7977.84`; CDP test seam, isolated profile |
| Live MV3 | Production extension, toolbar activeTab grant, popup approval, actual debugger attach/input/navigation/events/screenshot, bound child geometry read/cleanup, Stop detach and later-input/read denial | `pnpm test:extension` passed 15 checks on Chrome-for-Testing `151.0.7922.10`; production bundle, isolated profile, native transport substituted only; child click is test-only, not a public frame action |
| Early Edge compatibility | Existing Edge extension/installer brand, shared Chromium provider and unchanged runtime-core, actual Edge-started Native Host and DSH tool/approval/attachment stack | `pnpm test:edge-native` passes eight gate checks on macOS Edge `152.0.4191.66`/DSH `0.1.5-rc.1`: all 20 unchanged executor oracles, batch/replay, 220-control paging, navigation/stale refs, Stop/re-consent/handoff, 45 uniquely paired approval audits and cleanup. [Retained report](compatibility/2026-09-12-edge-native.json) includes unchanged core source hashes; isolated profile and controlled answers, not full P5/model/performance acceptance |
| Assembled native stack | Real DSH ToolRuntime/attachments → Unix socket → independent Broker CLI process → Chrome-started Native Host → real nativeMessaging/MV3 → browser; repeat installation/doctor preflight, keyboard, contenteditable/append, checkbox/radio/label surfaces, DOM scrolling/native wheel, click points, large-page/query/scoped observations, screenshots, cancellation, Stop, turn/end, late approval, SIGKILL/stale-socket recovery, no replay, unregistration/reinstallation host-discovery probes | `pnpm test:native /path/to/installed/dsh` passed 105 checks on macOS, Chrome-for-Testing `151.0.7922.10`, DSH `0.1.5-rc.1`; isolated profile and loopback fixture; no native/renderer transport substitutions; controlled test approval service and control-free registration hello probes, no LLM |

The standard suite currently contains 513 passing tests on this non-root macOS run. The directory-permission backup-write fault test skips when run as root, which bypasses those permissions. Packaging/public reducer checks are run separately; the reducer has no browser/DSH dependencies. Treat these as dated evidence, not permanent release assertions; run the commands on the current checkout. The real DSH smoke confirms actual schema acceptance and image content blocks, not just a hand-written context mock. It does not invoke any LLM or cloud vision service.

The following source-acquisition increment now implements internal MV3 `frame.geometry`: same-origin ancestor authority, exact default-context/object ownership, fixed leaf and ancestor hit functions, revision gates around every read, private object groups and cleanup before publication. Thirteen source unit tests and three extension regressions cover stale/foreign/incomplete contexts, wrong-document objects, OOPIF refusal, foreign-sibling isolation, navigation/cancellation/Stop, post-cleanup races, cleanup failure and explicit call/scope budgets. The real source gate passes 70 assertion groups / 35 trusted test-only clicks per browser on Chrome and Edge, including actual remote-object release checks; [Chrome](compatibility/2026-09-12-chrome-frame-geometry-source.json) / [Edge](compatibility/2026-09-12-edge-frame-geometry-source.json) reports retain source/build hashes. The real MV3 smoke passes 15 checks including this command, but substitutes the native port. The separate existing assembled native frame-read gate still passes ten checks. That geometry-read report does not exercise public input; the newer child-click gate below covers semantic refs and dispatch fences, but still not OOPIF geometry. See [source acquisition and bounds](development.md#bound-frame-geometry-acquisition).

The next frame increment implements internal projective content-quad mapping and bound ancestor-owner hit checks, with exact geometry rereads and cancellation/identity/candidate checks. Fifteen unit tests cover transformations/inverse mapping, bounds, invalid/cyclic/stale chains, overlays, fractional movement and caller mutation. The new isolated `test:frame-geometry` gate passes 42 assertion groups on each of Chrome-for-Testing 151 and Edge 152: seven layouts, 35 trusted center/near-corner clicks per browser, root/intermediate overlays, pointer-disabled owners and movement refusal. A reproduced inherited-CSS-zoom unit mismatch was corrected using measured relative document scale rather than absolute DPR. [Chrome](compatibility/2026-09-12-chrome-frame-geometry.json) and [Edge](compatibility/2026-09-12-edge-frame-geometry.json) evidence retains source/build hashes and actual child event coordinates. The primitive alone is not input authority. The newer same-origin child-click path adds source/session binding, leaf identity, authorization and dispatch gates; OOPIF acquisition remains required. See [scope and limitations](development.md#frame-geometry-development-gate).

Frame foundation now includes optional portable `frames`, the ninth DSH tool `browser_frames`, same-process/default-context metadata and recursive iframe-only flat sessions. Public origins/opaque handles never expose URL paths, child text or session/context IDs; runtime validates a bounded acyclic graph rooted in the authorized document. Source topology races, failed parent setup/descendant cleanup, context-ID reuse, cancellation, malformed graphs and capacity are covered by new unit regressions. The isolated real Chrome and Edge native frame tests each pass ten checks across five frames, with independently observed recursive extension-owned sessions, child document-epoch change, subtree removal, Stop/re-consent and handoff. The current gate additionally proves explicit same-origin child AX/deltas, password omission, foreign/opaque/foreign-ancestor denial and stale-read refusal after navigation/retargeting/Stop. It does **not** prove child input or cross-origin content approval. See [implementation and bounds](development.md#frame-discovery-foundation) and retained [Chrome](compatibility/2026-09-12-chrome-frames-native.json) / [Edge](compatibility/2026-09-12-edge-frames-native.json) reports.

That real test initially failed because the old screenshot origin check trusted the root session's incomplete frame tree after OOPIF attachment. MV3 now checks the full session graph before and after capture and discards images when frame structure changes, including transient changes that return to the same final tree. Foreign/opaque/incomplete coverage is denied even without a preceding public frame query. Full Chrome (90 checks) and assembled native (105 checks) regressions pass after this change; no signed-in profile/model/production acceptance is implied.

Explicit child reading reuses `browser_observe({leaseId,frame:{frameId,documentEpoch},cursor?})`, while `browser_read_page` now accepts the same explicit frame for sequential bounded windows. Runtime and MV3 independently enforce the same-origin ancestor chain. Internal `ax.frame`/`ax.frame.page` bind root/child loaders and the unique default execution context, resolve the session from current evidence, and check topology around acquisition. Source/runtime/provider/extension/adapter regressions cover stale identities, context replacement, Stop, foreign ancestors, mixed scopes, final-read races, colliding backend IDs, pager invalidation and the eight-child-cache bound. The shared node projection omits password values and stops at nested frames. Real Chrome/Edge tests prove Chinese child text, independent delta reconstruction, all 4,000 mounted controls through child windows, final-window trusted action, root-input rejection, changed document refusal and read eligibility changing correctly across OOPIF-to-same-process-to-OOPIF navigation. Cross-origin content approval remains missing.

The initial [L1 native benchmark](benchmarks.md) now has 20 predeclared executor tasks × 5 measured repetitions, plus a retained warmup round, through the real isolated DSH/Broker/Native/MV3 stack. The recorded run passed 100/100 measured and 20/20 warmup oracles, with owned-resource cleanup complete. Observation/action/capture task p95 were 9.22/133.14/62.35 ms on the controlled fixture; task timing includes independent verification but excludes reset/claim/discovery. The raw report, source fingerprint, per-task quantiles, sample limitations and exploratory-run provenance are retained. This is not fixed-model L2, Codex L3, pure RPC, per-stage production spans, regular-profile or real-site proof.

The base fixture has five named regions, including a real form, nested scroll containers and an RTL container; focused action helpers add and remove their own temporary regions. The current native run measured 1,652 bytes for the initial document view, 440 for an unchanged delta, and 519 for a one-fragment text update (UTF-8 JSON; metadata varies between runs). Live Chrome instrumentation measured a 19,703-byte raw full-tree baseline, 3,398-byte projected document acquisition, 1,215-byte projected subtree acquisition, and 7,308 bytes across nine scoped AX calls including identity checks. Only the baseline intentionally invokes raw full-tree acquisition, outside the production observation path. These are not total traffic, browser CPU, model tokens or latency claims. Discovery and action-result reads now use the same bounded traversal as scoped reads. Full resync/replacement rejection passed through the real native stack; the exact Host-returned image remains separate from the final Playwright diagnostic.

The earlier native stress fixture adds 4,000 buttons: its raw measurement-only AX response was 5,852,429 bytes (over the native frame maximum), while the bounded observation was 16,642 bytes with `truncated: true`. A known small region then returned a complete local view; its button received one trusted, postcondition-verified click despite repeating the request. The new separate `browser_read_page` path now offers sequential discovery beyond the default view and has its own 4,000-control native proof above. It does not expand the default observation budget or turn page windows into whole-page delta baselines. Single CDP sibling allocations, globally consistent scans and virtualized/unmounted content remain unproven or unsupported.

Exact semantic queries now recover the last button omitted from that default view and verify its trusted click with no replay. A separate fixture returns two same-name candidates, finds a named region, restricts the query to that region, and clicks only the intended button. It checks query cursor resync, literal/case-sensitive matching, iframe exclusion and replacement invalidation. Queries do not turn an ambiguous result into an automatic action or reuse a stale ref based on a matching name. Their returned projection is bounded, but Chromium's name computation/raw match allocation is not; no general query-latency, fuzzy search or cross-frame claim is made.

Scoped reads are deliberately explicit: a full response can be a full **local view**, not a full page. Changing scope invalidates the delta base; a replaced root fails rather than widening the read or binding to a lookalike. Reading one region does not invalidate other regions' current control refs. The shared provider now retains only emitted refs within a bounded LRU, avoiding unbounded identity retention when scanning a large AX tree. Pre-action target validation uses targeted AX identity checks instead of an unnecessary whole-page reread; postcondition/result acquisition remains full-document.

Keyboard verification checks real page `isTrusted` key events, not just a successful CDP acknowledgement. Enter submits the local form exactly once even when its request is repeated; arrows move its real caret; Tab/Shift+Tab move focus; Space activates a button with a verified text result. Page focus handlers that redirect focus prevent subsequent key delivery and text insertion. AX focus evidence and a final DOM ownership check supplement the existing target identity checks. Focusing is itself a potentially side-effecting operation, so later failure remains conservatively unknown. A lost key-up acknowledgement is also unknown and cannot cause a replayed keydown. These are bounded current-state checks, not an atomic lock against all future human/page focus changes or proof of complete IME/editor support.

The MV3 test caught a navigation-time viewport race that the direct-CDP fixture had not exposed. Screenshot acquisition now discards stale pixels and retries only that read-only capture under its shared deadline. A separate regression verifies the returned image metadata matches the stable capture and cross-origin failures are never retried. Another regression ensures navigation cannot satisfy a text expectation from the outgoing document before the returned loader commits.

The assembled native test also reproduced a lifecycle race: an approval resolving after `turn/end` could previously create a new lease. Ownership is now captured in the DSH pre-execute stage, synchronously invalidated on turn end, and mapped to a distinct wire owner for each turn. The original failing native test now passes; six focused adapter regressions cover late approval, in-flight grant cancellation, old/new turn separation, screenshot completion, disposal and bypassing the pre-execute boundary.

Contenteditable work reproduced two Chrome-specific gaps in initial checks: `innerText` counted caret-placeholder BR nodes as extra newlines, and shadow-root selection ranges normalized to text-leaf endpoints. The implementation now uses bounded logical editing-text rules and equivalent structural endpoint checks. Live whitespace cases compare against Chrome's copy-text output, independent of the implementation's serializer. AX generic editing hosts retain their true role and an editable flag rather than being relabeled as textboxes; losing the capability invalidates the reference. These changes reuse the existing input/action/approval/replay path. Real editors with unsupported layout, protected islands or framework semantics remain explicit gaps.

Exposed-point selection processes up to 16 client-rect fragments and nine points per fragment, clipped by viewport/ancestor evidence. It rechecks the same point immediately before mouse-down and rejects nested independent controls. The live fixture explicitly proves that bounding-box centers miss in the overlay/multiline/clip cases, then verifies the actual trusted event targets. The nested-control refusal also exposed an RPC error-classification bug: a typed local deadline was replaced with generic user cancellation. That reason now survives the local transport cancellation boundary. These checks are not atomic with future mutations; closed shadow roots, frames, hostile renderer monkeypatching and general hover/complex-animation behavior remain limitations.

Doctor checks registration and connection without opening the lifetime-lock inode, reading the action journal, running launchers, auto-repairing installation, accessing tabs or granting leases. Bounded no-follow file reads and fixed-format output prevent accidental secret/error-payload disclosure. The real native test verifies diagnosis during an active DSH lease and subsequent successful observation using that lease. `ready` is deliberately limited to the reported preflight evidence; it does not certify executable compatibility, enterprise/profile policy, DSH model capability, or production readiness. Doctor's Edge coverage remains a brand/path seam; the separate early Edge native smoke above does not certify its full diagnostic/installer lifecycle.

## Remaining work against the original plan

- **P0 unfinished:** fully assembled regular-profile Chrome extension/native/Broker/DSH test; browser→Vision Router→vision model proof; explicit external-image policy validation; first 20-task Codex comparison baseline; reuse review.
- **P1 partial:** APIs, local transport, safety kernel, lifetime ownership, stale-socket recovery, durable metadata fences, connection/control admission budgets, installation preflight/serialization/ordinary-failure rollback, scoped host unregistration and read-only diagnostic CLI exist. Need DSH-process recovery identity, corrupt/bootstrap/interrupted-compaction recovery, journal capacity reconciliation, durable installation crash recovery/full package removal, complete global byte/teardown/extension limits, package lifecycle, complete diagnostic/profile/policy UX and more approval/lifecycle race tests.
- **P2 partial:** shared-deadline event-hinted waiting, bounded text/deltas, source discovery/known-root traversal, root and same-origin child live page windows with continuation, exact semantic query/context scopes, explicit document/container DOM scrolling, ref-bound native wheel samples, offscreen auto-scroll, focused named page keys, bounded contenteditable fill and guarded suffix append, boolean checkbox/switch state with native label surfaces, exact-object element-state postconditions, separately approved bounded action batches, empty fill and same-origin navigation now exist. Early real Edge compatibility and current child-frame gates pass without browser-specific core forks. Event-driven incremental acquisition, robust node versions, cross-origin frame authorization, child actions beyond the initial same-process click/text verification and OOPIF geometry, virtualized-list workflows, continuous/trackpad gestures, richer keyboard/editor behavior and batch new-ref bindings/higher-level risk boundaries remain unfinished.
- **P3 partial foundation only:** canonical screenshot references and deterministic grounding/geometry validation now exist. Actual vision dispatch with frozen egress policy, live model accuracy, current-page visual hit verification and visual input are not implemented. IME and framework-specific editor behavior, upload/download/dialogs, created-tab lifecycle and richer handoff/status UI also remain unfinished.
- **P4/P5 unfinished:** initial L1 fixture p50/p95 and failure-retaining runner now exist; broad deterministic/real-world fixtures, production spans, fault/soak/security/performance gates, real-user validation, distribution/signing/store release and Edge formal support remain missing.

Do not mark the overall project complete based on the present tests. They deliberately state each seam's coverage instead of claiming a mocked extension or a CDP-only smoke proves the full product.

## Next engineering sequence

1. The assembled isolated native stack now passes. Extend it to real agent/model turns and richer fixtures; regular signed-in-profile acceptance remains an explicit opt-in gate.
2. Complete screenshot/attachment/visual-tool session authorization and privacy policy tests before any cloud visual experiment.
3. Expand action-specific waiting, continuous gestures and complex-layout/editor fixtures; the current DOM scrolling, single native wheel samples, named-key support and bounded fragment-hit checks are not full cross-site reliability.
4. Extend current root/child bounded live windows to richer dynamic/virtualized-page fixtures and OOPIF/cross-origin support; keep the now-passing Edge child-frame smoke as a cross-browser regression gate.

The runtime foundation was committed and pushed with user confirmation as `f8d36d2`. Label-surface, wheel, installation-integrity, scoped-unregistration, native-radio, public Vision Router compatibility and screenshot-publication lifecycle changes were committed and pushed with confirmation as `7a875f1`. The subsequent contenteditable, append, L1 benchmark, element-state postcondition, bounded-batch, live-page-window and early-Edge-validation increments remain local. Fresh user confirmation of an exact plan is required before any future push or Git integration.

Protocol audit follow-up: [protocol.md](protocol.md) and the generated `protocol/v1.schema.json` now describe the actual `type/id` wire envelope. Node and MV3 share envelope/handshake rules; independent Ajv validation and real socket tests cover malformed traffic, required-capability mismatch and rejection before authority is granted. The extension rejects completed transport-ID replay and performs explicit synchronous teardown on active disconnect (Chrome does not emit `onDisconnect` on the initiating port). Tests verify old-port traffic cannot affect a successor connection. This is development-v1 negotiation, not stable N/N-1 upgrade support: method-payload schemas, richer feature evolution, blob chunking, comprehensive event-gap handling, global resource limits and soak tests remain incomplete. The original v2 plan remains unchanged.