diff --git a/.changeset/README.md b/.changeset/README.md
index 0404618..6b89f3c 100644
--- a/.changeset/README.md
+++ b/.changeset/README.md
@@ -4,4 +4,4 @@ Add one changeset for every user-visible change to the published `tokenless` CLI
 
 Run `npm run changeset` and select `tokenless`. The release workflow creates a
 version pull request only when an unpublished changeset is present. Merging that
-pull request publishes all six native runtime packages before the universal CLI.
+pull request publishes the single pure JavaScript `tokenless` package.
diff --git a/.changeset/bright-profiles-wave.md b/.changeset/bright-profiles-wave.md
new file mode 100644
index 0000000..cf3e9dd
--- /dev/null
+++ b/.changeset/bright-profiles-wave.md
@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Add case-sensitive `-P` profile and `-p` provider CLI shortcuts.
diff --git a/.changeset/browser-connection-mode-evaluation.md b/.changeset/browser-connection-mode-evaluation.md
new file mode 100644
index 0000000..e5e5840
--- /dev/null
+++ b/.changeset/browser-connection-mode-evaluation.md
@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Add an experimental config-only Playwright/CDP browser connection mode and a two-mode real-browser capability matrix while preserving the existing default.
diff --git a/.changeset/browser-runtime-selection.md b/.changeset/browser-runtime-selection.md
new file mode 100644
index 0000000..3bf6ae9
--- /dev/null
+++ b/.changeset/browser-runtime-selection.md
@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add profile-bound browser runtime selection with system-first auto discovery, a locked managed Chrome for Testing fallback, explicit Anti-Detect CloakBrowser setup, safe known-Chromium profile/version inventory before Cloak download, exact four-component Cloak compatibility classification, interactive or explicit non-interactive clean-profile confirmation, clean runtime-isolated profiles, exact daemon runtime errors, transactional artifact security verification, per-provider setup review tabs, keychain-neutral E2E Cloak launches, separate doctor profile/runtime compatibility checks, and gated real-browser acceptance coverage.
diff --git a/.changeset/cache-browser-executable-path.md b/.changeset/cache-browser-executable-path.md
new file mode 100644
index 0000000..d76d94d
--- /dev/null
+++ b/.changeset/cache-browser-executable-path.md
@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Cache the verified browser executable path in persistent config, resolve concrete browser selections during setup and install, retry standard-path discovery after stale cache entries, and add CLI and dashboard recovery controls for custom system-browser paths. Interactive setup no longer asks users to choose a normal browser runtime. Anti-Detect setup discloses Cloak installation in its initial question and uses one clean-or-compatible-profile source choice, without redundant import, copy-consent, or final installation prompts. Opaque import remains limited to profiles whose Chromium version exactly matches the supported CloakBrowser runtime, with a final compatibility check at the copy boundary.
diff --git a/.changeset/calm-dolphins-help.md b/.changeset/calm-dolphins-help.md
new file mode 100644
index 0000000..41c3b51
--- /dev/null
+++ b/.changeset/calm-dolphins-help.md
@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Reorganize CLI help into concise canonical and advanced command groups.
diff --git a/.changeset/calm-workspaces-align.md b/.changeset/calm-workspaces-align.md
new file mode 100644
index 0000000..6055fa8
--- /dev/null
+++ b/.changeset/calm-workspaces-align.md
@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add experimental four-provider capability inspection, explicit Workspace fallback modes, trusted conversation continuation, and visible file-upload acceptance evidence.
diff --git a/.changeset/capability-first-routing.md b/.changeset/capability-first-routing.md
new file mode 100644
index 0000000..53820e5
--- /dev/null
+++ b/.changeset/capability-first-routing.md
@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add a canonical task-capability catalog, expose evidence-backed provider routes through `tokenless capabilities list`, and route normal runs by explicit and inferred capability requirements before browser mutation.
diff --git a/.changeset/capability-ranked-provider-fallback.md b/.changeset/capability-ranked-provider-fallback.md
new file mode 100644
index 0000000..2ddc92f
--- /dev/null
+++ b/.changeset/capability-ranked-provider-fallback.md
@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Rank automatic provider fallback by the run's complete capability requirements, recheck live eligibility before mutation, reject under-declared routes, preserve a versioned context envelope, expose structured durable fallback evidence, and fail closed when file selection lacks visible provider acceptance.
diff --git a/.changeset/claude-cloudflare-known-issue.md b/.changeset/claude-cloudflare-known-issue.md
new file mode 100644
index 0000000..65db3db
--- /dev/null
+++ b/.changeset/claude-cloudflare-known-issue.md
@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Classify Claude Cloudflare human checks as a narrow live E2E release-gate known issue when the durable blocker code is structured as `visible_cloudflare_turnstile` or `visible_cloudflare_interstitial`.
diff --git a/.changeset/clean-daemon-v1-boundary.md b/.changeset/clean-daemon-v1-boundary.md
new file mode 100644
index 0000000..d88f36b
--- /dev/null
+++ b/.changeset/clean-daemon-v1-boundary.md
@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Unify and simplify the local CLI-daemon HTTP boundary under one Tokenless Daemon API v1 OpenAPI contract: keep only public job and browser-runtime routes, run Playwright coordination in-process, require proof before bearer use, and remove unreleased legacy payloads and extension compatibility.
diff --git a/.changeset/clean-provider-registry.md b/.changeset/clean-provider-registry.md
new file mode 100644
index 0000000..901d022
--- /dev/null
+++ b/.changeset/clean-provider-registry.md
@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add experimental Qwen guest-session support through the shared provider registry and visible Playwright workflow.
diff --git a/.changeset/clear-command-map.md b/.changeset/clear-command-map.md
new file mode 100644
index 0000000..6bbdc4c
--- /dev/null
+++ b/.changeset/clear-command-map.md
@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Publish a complete bilingual CLI command reference and link it from built-in help and public READMEs.
diff --git a/.changeset/deepseek-provider.md b/.changeset/deepseek-provider.md
new file mode 100644
index 0000000..b8fc1f3
--- /dev/null
+++ b/.changeset/deepseek-provider.md
@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add the experimental DeepSeek visible-session provider with safe navigation, sign-in detection, baseline chat controls, and evidence-gated capability classification.
diff --git a/.changeset/deepseek-visible-controls.md b/.changeset/deepseek-visible-controls.md
new file mode 100644
index 0000000..b306ba4
--- /dev/null
+++ b/.changeset/deepseek-visible-controls.md
@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add experimental DeepSeek visible provider support with exact Instant, Expert, and Vision mode selection, independent DeepThink and Search controls, hCaptcha detection, mode-aware capability inspection, and provenance-bound real-session DOM fixtures.
diff --git a/.changeset/doubao-experimental-provider.md b/.changeset/doubao-experimental-provider.md
new file mode 100644
index 0000000..59a2651
--- /dev/null
+++ b/.changeset/doubao-experimental-provider.md
@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add an experimental signed-in Doubao adapter with visible account and free-tier inspection, Cloak-tested file upload, exact mode and coding-oriented Web skill controls, visible unavailable-state handling, prompt and response handling, and provider challenge detection.
diff --git a/.changeset/durable-agent-replay.md b/.changeset/durable-agent-replay.md
new file mode 100644
index 0000000..9529610
--- /dev/null
+++ b/.changeset/durable-agent-replay.md
@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Start the local daemon on demand with SQLite-backed dynamic endpoint discovery, recover leased and checkpointed jobs after restart, and add agent-scoped one-time outcome replay with durable full-result lookup.
diff --git a/.changeset/gentle-composers-verify.md b/.changeset/gentle-composers-verify.md
new file mode 100644
index 0000000..748b76a
--- /dev/null
+++ b/.changeset/gentle-composers-verify.md
@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Accept non-empty visible composer content after prompt input instead of requiring an exact DOM text match.
diff --git a/.changeset/grok-visible-entitlements.md b/.changeset/grok-visible-entitlements.md
new file mode 100644
index 0000000..a67e972
--- /dev/null
+++ b/.changeset/grok-visible-entitlements.md
@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Report Grok profiles as Free or SuperGrok from visible model entitlements and inventory redacted provider DOM fixtures by page URL.
diff --git a/.changeset/guest-access-routing.md b/.changeset/guest-access-routing.md
new file mode 100644
index 0000000..7655de4
--- /dev/null
+++ b/.changeset/guest-access-routing.md
@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Add provider access/tier reporting and a provider-session state machine that runs ChatGPT and Gemini guest sessions, hands unauthenticated Claude and Grok jobs to the user before task input, and persists redacted structural DOM snapshots.
diff --git a/.changeset/import-profile-compatibility-state.md b/.changeset/import-profile-compatibility-state.md
new file mode 100644
index 0000000..1cb6189
--- /dev/null
+++ b/.changeset/import-profile-compatibility-state.md
@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Preserve limited Chromium compatibility state when importing a browser profile with explicit user consent.
diff --git a/.changeset/keychain-neutral-production-browser.md b/.changeset/keychain-neutral-production-browser.md
new file mode 100644
index 0000000..108b599
--- /dev/null
+++ b/.changeset/keychain-neutral-production-browser.md
@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Keep every production Chromium launch keychain-neutral with `--password-store=basic` and `--use-mock-keychain`, regardless of the configured browser executable or connection mode.
diff --git a/.changeset/local-web-control-plane.md b/.changeset/local-web-control-plane.md
new file mode 100644
index 0000000..eaf4706
--- /dev/null
+++ b/.changeset/local-web-control-plane.md
@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add the secure bilingual local web control plane, profile-scoped provider and browser preferences, reserved dashboard tabs, setup handoff, dashboard CLI command, and browser-facing administration API.
diff --git a/.changeset/localized-cli-language.md b/.changeset/localized-cli-language.md
new file mode 100644
index 0000000..7fde8f8
--- /dev/null
+++ b/.changeset/localized-cli-language.md
@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add English and Simplified Chinese CLI output selected during setup or through the persistent language config.
diff --git a/.changeset/manual-profile-onboarding.md b/.changeset/manual-profile-onboarding.md
new file mode 100644
index 0000000..11d9a0a
--- /dev/null
+++ b/.changeset/manual-profile-onboarding.md
@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Keep managed-profile initialization user-run instead of triggering it from agent skills.
diff --git a/.changeset/perplexity-experimental-provider.md b/.changeset/perplexity-experimental-provider.md
new file mode 100644
index 0000000..3138d3e
--- /dev/null
+++ b/.changeset/perplexity-experimental-provider.md
@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add experimental Perplexity guest chat routing with live prompt submission, completed responses, normalized citations, and visible citation-link closure through a managed Cloak profile.
diff --git a/.changeset/profile-owned-browser-instances.md b/.changeset/profile-owned-browser-instances.md
new file mode 100644
index 0000000..1959546
--- /dev/null
+++ b/.changeset/profile-owned-browser-instances.md
@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Keep one stable browser instance per active managed profile while removing the macOS-specific inspection launcher.
diff --git a/.changeset/prompt-controls-wait.md b/.changeset/prompt-controls-wait.md
new file mode 100644
index 0000000..06d14e4
--- /dev/null
+++ b/.changeset/prompt-controls-wait.md
@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Wait for visible prompt input and submit controls, distinguish availability timeouts from action failures, and allow free or anonymous prompt surfaces without an authentication precheck.
diff --git a/.changeset/provider-availability-routing.md b/.changeset/provider-availability-routing.md
new file mode 100644
index 0000000..3ec3b53
--- /dev/null
+++ b/.changeset/provider-availability-routing.md
@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Route implicit provider jobs through cached setup observations, report pre-submission errors when no cached provider is usable, and make doctor report provider usability plus normally stopped on-demand runtime state without treating either as damage.
diff --git a/.changeset/provider-rate-limit-cadence.md b/.changeset/provider-rate-limit-cadence.md
new file mode 100644
index 0000000..30610d2
--- /dev/null
+++ b/.changeset/provider-rate-limit-cadence.md
@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add a packaged subscription-aware provider rate-limit catalog, durable submission history, cadence-based admission and deferral, in-scope provider fallback, visible cooldown handling, and `tokenless limits inspect` diagnostics.
diff --git a/.changeset/provider-runtime-fallback.md b/.changeset/provider-runtime-fallback.md
new file mode 100644
index 0000000..a2fb92d
--- /dev/null
+++ b/.changeset/provider-runtime-fallback.md
@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Automatically fallback implicit runs across capability-compatible providers before human handoff while preserving one durable job and provider-attempt history.
diff --git a/.changeset/provider-whitelist-config.md b/.changeset/provider-whitelist-config.md
new file mode 100644
index 0000000..92853dd
--- /dev/null
+++ b/.changeset/provider-whitelist-config.md
@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Rename persistent preferred provider configuration to `providerWhitelist`, default it to every non-disabled provider except Gemini, and migrate existing config on the next write.
diff --git a/.changeset/providerless-profile-open.md b/.changeset/providerless-profile-open.md
new file mode 100644
index 0000000..63e9c71
--- /dev/null
+++ b/.changeset/providerless-profile-open.md
@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Allow `tokenless profiles open` to launch a managed profile without selecting or navigating to a provider unless `--provider` is passed.
diff --git a/.changeset/pure-js-runtime.md b/.changeset/pure-js-runtime.md
new file mode 100644
index 0000000..915c05f
--- /dev/null
+++ b/.changeset/pure-js-runtime.md
@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Ship Tokenless as a pure JavaScript package with the TypeScript daemon embedded in the CLI package, removing platform-specific native runtime packages and standalone Playwright runner artifacts.
diff --git a/.changeset/quiet-tabs-preserve.md b/.changeset/quiet-tabs-preserve.md
new file mode 100644
index 0000000..03b4173
--- /dev/null
+++ b/.changeset/quiet-tabs-preserve.md
@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Preserve independent browser tabs for different providers, projects, and conversations unless a local job explicitly requests replacement.
diff --git a/.changeset/qwen-dns-throttling.md b/.changeset/qwen-dns-throttling.md
new file mode 100644
index 0000000..7c065ee
--- /dev/null
+++ b/.changeset/qwen-dns-throttling.md
@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Record intermittent Qwen DNS failures as retryable suspected rate limits without claiming confirmed provider throttling, and document the distinction and recovery steps.
diff --git a/.changeset/qwen-visible-modes.md b/.changeset/qwen-visible-modes.md
new file mode 100644
index 0000000..436d8a4
--- /dev/null
+++ b/.changeset/qwen-visible-modes.md
@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add Qwen-specific mode discovery and selection, including Deep Research variants and Auto/Thinking/Fast effort controls.
diff --git a/.changeset/real-native-projects.md b/.changeset/real-native-projects.md
new file mode 100644
index 0000000..89a5691
--- /dev/null
+++ b/.changeset/real-native-projects.md
@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add real Claude and Grok native Project creation, exact reuse, instruction outcomes, and durable Project-scoped conversation identity. Use the canonical Qwen Studio chat surface with hydration-safe guest submission.
diff --git a/.changeset/setup-daemon-exact-reconcile.md b/.changeset/setup-daemon-exact-reconcile.md
new file mode 100644
index 0000000..94a4278
--- /dev/null
+++ b/.changeset/setup-daemon-exact-reconcile.md
@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Make ordinary daemon reuse depend on verified ready identity plus the exact package version, and let `tokenless setup` reconcile same-home version drift only after proof verification.
diff --git a/.changeset/setup-handoff-headed.md b/.changeset/setup-handoff-headed.md
new file mode 100644
index 0000000..8bf058f
--- /dev/null
+++ b/.changeset/setup-handoff-headed.md
@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Check each provider's setup sign-in status once and report it without opening a login handoff or retrying.
diff --git a/.changeset/setup-runtime-preflight.md b/.changeset/setup-runtime-preflight.md
new file mode 100644
index 0000000..fe6428b
--- /dev/null
+++ b/.changeset/setup-runtime-preflight.md
@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Make `tokenless setup` report the local CLI version against npm latest and reconcile installed-runtime drift after verified same-home ready identity.
diff --git a/.changeset/signed-capability-readiness.md b/.changeset/signed-capability-readiness.md
new file mode 100644
index 0000000..2be0ee1
--- /dev/null
+++ b/.changeset/signed-capability-readiness.md
@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Simplify daemon readiness to the same-home proof plus exact package version, and keep shutdown on the bearer-authenticated control endpoint.
diff --git a/.changeset/soft-lamps-daemon-stop.md b/.changeset/soft-lamps-daemon-stop.md
new file mode 100644
index 0000000..ad470b4
--- /dev/null
+++ b/.changeset/soft-lamps-daemon-stop.md
@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Negotiate daemon reuse independently from package versions, and add `tokenless daemon stop` with same-home ready verification followed by bearer-authenticated graceful self-shutdown that waits for the daemon-managed browser to release its profile before returning.
diff --git a/.changeset/strict-cli-options.md b/.changeset/strict-cli-options.md
new file mode 100644
index 0000000..a4e5495
--- /dev/null
+++ b/.changeset/strict-cli-options.md
@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Reject unknown and command-incompatible CLI options before dispatch, include command usage in human and JSON errors, and add common per-command `-h`/`--help`.
diff --git a/.changeset/unified-global-maintenance.md b/.changeset/unified-global-maintenance.md
new file mode 100644
index 0000000..79d2060
--- /dev/null
+++ b/.changeset/unified-global-maintenance.md
@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Unify setup and upgrade maintenance so the verified current CLI always upserts global Tokenless skills and reconciles its matching TypeScript daemon.
diff --git a/.changeset/visible-provider-accounts.md b/.changeset/visible-provider-accounts.md
new file mode 100644
index 0000000..c0675bb
--- /dev/null
+++ b/.changeset/visible-provider-accounts.md
@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Fail provider authentication checks closed on visible account controls and include visible provider usernames and subscription labels in managed profile output.
diff --git a/.changeset/zai-experimental-provider.md b/.changeset/zai-experimental-provider.md
new file mode 100644
index 0000000..43dadf7
--- /dev/null
+++ b/.changeset/zai-experimental-provider.md
@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add experimental Z.ai guest chat routing with Cloak-verified prompt submission, completed visible responses, conversation mapping, and durable state.
diff --git a/.changeset/zai-navigation-catalog.md b/.changeset/zai-navigation-catalog.md
new file mode 100644
index 0000000..6ba3734
--- /dev/null
+++ b/.changeset/zai-navigation-catalog.md
@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Move provider entry points and known page URL patterns into one navigation catalog, and use `https://z.ai/chat` as the Z.ai entry while retaining its official chat runtime origin.
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
new file mode 100644
index 0000000..1ac3dae
--- /dev/null
+++ b/.github/pull_request_template.md
@@ -0,0 +1,2 @@
+- [ ] I ran the applicable manual real-provider E2E gates locally, or this pull request does not affect visible-provider behavior.
+- [ ] Every applicable real-provider E2E passes before release; invoked suites had no skipped case or internal retry.
diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index 95ebf5d..49501ca 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -30,32 +30,10 @@ jobs:
       - id: release
         run: node scripts/release/verify-pending.mjs "$GITHUB_OUTPUT"
 
-  publish-native:
+  publish-cli:
     needs: prepare
     if: needs.prepare.outputs.publish == 'true'
-    runs-on: ${{ matrix.runner }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: macos-14
-            platform: darwin
-            arch: arm64
-          - runner: macos-15-intel
-            platform: darwin
-            arch: x64
-          - runner: ubuntu-24.04-arm
-            platform: linux
-            arch: arm64
-          - runner: ubuntu-24.04
-            platform: linux
-            arch: x64
-          - runner: windows-11-arm
-            platform: win32
-            arch: arm64
-          - runner: windows-2022
-            platform: win32
-            arch: x64
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -64,15 +42,13 @@ jobs:
           cache: npm
       - name: Install npm with Trusted Publishing support
         run: npm install --global npm@11.15.0
-      - name: Install Rust
-        run: rustup toolchain install stable --profile minimal
-      - name: Build and verify this native runtime
-        run: npm --prefix packages/cli run build:native
-      - name: Publish native runtime
-        run: node scripts/release/publish-package.mjs "packages/cli/npm/tokenless-native-${{ matrix.platform }}-${{ matrix.arch }}"
+      - name: Install dependencies
+        run: npm ci --ignore-scripts
+      - name: Publish CLI
+        run: node scripts/release/publish-package.mjs packages/cli
 
-  publish-cli:
-    needs: [prepare, publish-native]
+  create-github-release:
+    needs: [prepare, publish-cli]
     if: needs.prepare.outputs.publish == 'true'
     runs-on: ubuntu-24.04
     steps:
@@ -80,20 +56,27 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: '24'
-          cache: npm
-      - name: Install npm with Trusted Publishing support
-        run: npm install --global npm@11.15.0
-      - name: Install dependencies
+      - name: Extract release notes from persisted changelog
+        env:
+          VERSION: ${{ needs.prepare.outputs.version }}
+        run: node scripts/release/extract-changelog-section.mjs "$VERSION" /tmp/tokenless-release-notes.md
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ needs.prepare.outputs.version }}
         run: |
-          # Native packages are published immediately before this job, so refresh
-          # their optional-dependency entries while installing the workspace.
-          rm package-lock.json
-          npm install --ignore-scripts
-      - name: Publish universal CLI after every native runtime
-        run: node scripts/release/publish-package.mjs packages/cli
+          TAG="v$VERSION"
+          if gh release view "$TAG" >/dev/null 2>&1; then
+            echo "Release $TAG already exists; leaving it unchanged."
+          else
+            gh release create "$TAG" \
+              --target "$GITHUB_SHA" \
+              --title "tokenless $TAG" \
+              --notes-file /tmp/tokenless-release-notes.md
+          fi
 
   clear-pending-marker:
-    needs: [prepare, publish-cli]
+    needs: [prepare, create-github-release]
     if: needs.prepare.outputs.publish == 'true'
     runs-on: ubuntu-24.04
     steps:
@@ -115,7 +98,6 @@ jobs:
           git checkout -B "$CLEANUP_BRANCH" origin/main
           node scripts/release/verify-pending.mjs /tmp/release-output
           grep -Fx "version=$VERSION" /tmp/release-output
-          rm package-lock.json
           npm install --package-lock-only --ignore-scripts
           git rm .changeset/publish-pending.json
           git add package-lock.json
diff --git a/.gitignore b/.gitignore
index 93fca79..6b56e5a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,6 @@
 node_modules/
 test-results/
+test/fixtures/local/
 packages/cli/npm/*/bin/
 dist/
 packages/*/dist/
@@ -9,4 +10,14 @@ packages/*/dist/
 .env
 
 .workbuddy-ai/
-docs/
\ No newline at end of file
+docs/
+!docs/
+docs/*
+!docs/README.md
+!docs/README.zh-CN.md
+!docs/capability-matrix.md
+!docs/capability-matrix.zh-CN.md
+!docs/provider-capability-census.md
+!docs/provider-rate-limits.md
+!docs/roadmaps/
+!docs/roadmaps/**
diff --git a/AGENTS.md b/AGENTS.md
index 68860ec..4f9404b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2,26 +2,70 @@
 
 ## Language
 
-- Write source code, identifiers, package names, configuration keys, and inline code comments in English.
-- Support both Chinese-speaking and English-speaking users in user-facing documentation whenever practical.
-- Keep paired documentation, such as `README.md` and `README.zh-CN.md`, aligned in structure and meaning. When updating one language, update its counterpart as part of the same change whenever possible.
-- Internal technical documentation may remain in English when a bilingual version would not benefit users.
+- Use English for code, identifiers, package/config keys, and inline comments.
+- Localize every reasonable user-facing surface in both English and Simplified Chinese. Never ship one language alone or assume users know the other.
+- Keep commands, flags, identifiers, protocol fields, provider/model names, and clearer technical terms unchanged.
+- Keep language selection and fallback consistent; cover externally visible localization through real boundaries.
+- Keep paired docs, such as `README.md` and `README.zh-CN.md`, structurally and semantically aligned.
+- Internal technical docs may remain English when translation adds no user value.
+
+## Tokenless skill
+
+- Do not read or invoke the external `tokenless` skill during repository work. Use this file, source, and tests.
 
 ## Branches and releases
 
-- Treat `dev` as the prerelease integration branch. All prerelease work must land on `dev` before it reaches `main`.
-- Direct commits to `dev` are allowed.
-- Ticket branches are optional. When one is used, target its pull request to `dev` first.
-- Update `main` only through a pull request. Do not commit or push directly to `main`.
-- Promote work from `dev` to `main` through a pull request.
-- Include a changeset for every user-visible change that should publish a new version of the `tokenless` CLI.
-- A pull request into `main` may omit a changeset when it should not trigger a release. Merging such a pull request updates `main` without publishing a new version.
-- Do not publish packages, releases, or other artifacts manually unless the user explicitly asks for publication. Let the repository's release automation handle changeset-driven publishing.
+- Land prerelease work on `dev` before `main`; direct `dev` commits are allowed.
+- Ticket branches are optional; target their first PR to `dev`.
+- Update `main` only by PR, normally promoted from `dev`; never commit or push directly.
+- Add a changeset for user-visible CLI changes requiring publication. A `main` PR may omit one only when no release should occur.
+- Never publish packages, releases, or artifacts manually unless explicitly asked; use release automation.
 
 ## External namespaces
 
-Never assume that the repository owns or controls an npm scope, package namespace, domain name, organization, registry namespace, or similarly reserved identifier. Before introducing or depending on a scoped package such as `@tokenless/*`, verify that the user controls that namespace or obtain the user's explicit confirmation. Treat an existing scoped package reference as a local workspace implementation detail, not proof that the namespace is available for publication.
+- Never assume ownership of scopes, package/registry namespaces, domains, or organizations. Verify user control or get explicit confirmation before use. Existing local references prove nothing about publishability.
+
+## Roadmap lifecycle
+
+- Directory defines state: `docs/roadmaps/P[0-3]-*.md` is active, `docs/roadmaps/backlog/P[0-3]-*.md` accepted but inactive, and `docs/roadmaps/archived/P[0-3]-*.md` completed, superseded, cancelled, or abandoned. Exclude each `README.md`.
+- Name every roadmap `P0-<name>.md`, `P1-<name>.md`, `P2-<name>.md`, or `P3-<name>.md`; the filename prefix must match the document's declared priority.
+- Keep `docs/roadmaps/README.md` synchronized with every roadmap add, rename, priority change, move, or state change, and update all repository links when a priority change renames a roadmap.
+- On moves, update all links and lifecycle notes, name any replacement, and preserve history except factual corrections.
+- Use no `active/` directory or roadmap location outside these three states.
 
 ## Testing
 
-Use focused integration or browser E2E tests for behavior that crosses the Playwright runner, local runtime, or provider web sessions. Do not mock visible-session behavior when a browser proof is feasible.
+- Test externally observable behavior through real boundaries: built CLI, packaged TypeScript daemon, filesystem, local Chromium/Playwright, or provider website.
+- Use focused integration or browser E2E for cross-runner/runtime/provider behavior. Prefer browser proof when feasible.
+- Keep default browser E2E to representative core flows. Cover rare crash/restart or failure injection only when required, reproduced, or visibly material; otherwise use focused real-boundary integration.
+- No unit tests, mocks, fakes, stubs, spies, synthetic fetches, fake runtime/browser objects, injected test doubles, or source/doc regex tests.
+
+### Credential and macOS Keychain Safety
+
+- Browser auth stays opaque in the user-controlled managed profile. After explicit user consent, Tokenless may copy a user-selected browser profile only as an opaque local filesystem tree between user-controlled profiles; it must not parse or expose individual authentication values.
+- Never request, inspect, export, log, transmit, decrypt, or dump passwords, cookies, tokens, keys, hidden auth headers, Keychain items, or browser-storage secrets; never use `security`, Keychain APIs, or equivalent tools. An explicitly authorized opaque local profile copy is not secret extraction.
+- Never automate or encourage Keychain approval, including `Allow` or `Always Allow`.
+- Tests, helpers, and test browsers must not trigger Keychain prompts. Any prompt fails the run: stop the browser/test, tell the user to choose `Deny` or `Cancel` without a password, then fix launch settings before retrying.
+- Every production and test Chromium launch must retain `--password-store=basic` and `--use-mock-keychain`, regardless of the configured browser executable.
+- Keychain safety never permits mocked browser boundaries.
+- For browser-launch changes, verify keychain-neutral production and test options, enabled Chromium sandboxing, process cleanup, and focused real-boundary completion without prompts.
+- Regression guard: never remove either keychain-neutral flag from any Chromium launch; inconsistent storage modes caused the prior `Chromium Safe Storage` prompt in provider-less `profiles open` conformance.
+
+### Provider DOM Fixture Policy
+
+- Fixtures must be redacted, provenance-bound reductions captured from real visible provider sessions.
+- Use them only for focused selector, parser, sanitizer, and observed-DOM checks.
+- Never use fixture routes, network interception, or simulated responses in built CLI/daemon E2E; never call fixture evidence E2E/live or use it for support, capability, acceptance, or release claims.
+- Never invent DOM or infer transitions from separate before/after fixtures.
+- Capture each materially distinct capability-relevant real state; redact it, record provenance, add it to the manifest, and preserve variants affecting behavior.
+
+### Real Provider Browser E2E
+
+- Run all browser E2E and provider capability acceptance against the real website, built CLI, packaged daemon, managed browser, and provider network—without fixtures, interception, or simulation.
+- Explicitly gated real E2E must prove provider-side transitions: model/effort changes, uploads, prompt submission, responses, citations, continuation, and native Project create/reuse/instructions/chat.
+- Real provider E2E is a manual local release prerequisite, not CI. PRs include a non-enforced reminder; all applicable cases must pass before release.
+- Invoked suites never skip required cases or retry internally. Sole exception: Claude may skip only for durable provider `claude` jobs blocked by `visible_cloudflare_turnstile` or `visible_cloudflare_interstitial`, as declared in `test/live-provider-capability-matrix.json`. All other unmet prerequisites fail clearly; retry manually.
+- Use the explicitly selected setup-managed profile. Never create test accounts, automate login, or switch profiles silently.
+- Real messages, conversations, Projects, attachments, retained artifacts, and provider cost are allowed; mark them uniquely per run. Cost never justifies fixtures.
+- Assert semantic commands, durable state, visible outcomes, and real protocol results. Never collect screenshots, full DOM, storage, credentials, or unrelated account content.
+- Gate unsafe external integrations behind explicit real integration/E2E tests; never simulate them.
diff --git a/COMMANDS.md b/COMMANDS.md
new file mode 100644
index 0000000..ec2a894
--- /dev/null
+++ b/COMMANDS.md
@@ -0,0 +1,759 @@
+[中文](COMMANDS.zh-CN.md) | [English](COMMANDS.md)
+
+# Tokenless CLI Command Reference
+
+This document is the public inventory of the `tokenless` command-line interface. It separates everyday workflows from lower-level controls and calls out commands that open provider pages, update local state, or only read cached data.
+
+## Command Map
+
+| Command | Purpose | Provider access |
+| --- | --- | --- |
+| `tokenless help` | Show the built-in command summary. | None |
+| `tokenless --version` | Print the installed CLI version. | None |
+| `tokenless install` | Verify the packaged local runtime, selected browser, and daemon. | None |
+| `tokenless setup` | Configure skills, browser, profiles, daemon, and one-time provider sign-in checks. | Yes |
+| `tokenless dashboard` | Open or mint a one-time URL for the authenticated local web control plane. | None |
+| `tokenless doctor` | Read local configuration and runtime health without refreshing providers. | None |
+| `tokenless config` | Read or update persistent Tokenless configuration. | None |
+| `tokenless upgrade` | Upgrade the global CLI, skills, local runtime, and run doctor. | None |
+| `tokenless profiles discover` | Read safe directory/version metadata for known Chromium profiles and classify alignment with the platform Cloak pin. | None |
+| `tokenless profiles add` | Create a clean managed browser profile. | None |
+| `tokenless profiles list` | List profiles and their last saved provider observations. | None |
+| `tokenless profiles status` | Check one provider live and save the observation to the profile registry. | Yes |
+| `tokenless profiles open` | Open a managed profile headed, optionally navigating to one provider. | Optional |
+| `tokenless profiles set-default` | Select the default managed profile. | None |
+| `tokenless profiles reset` | Legacy compatibility command; profile copying is disabled. | None |
+| `tokenless profiles clear` | Delete one or all managed profiles as a human maintenance action. | None |
+| `tokenless profiles remove` | Delete one managed profile with explicit confirmation. | None |
+| `tokenless capabilities list` | List canonical task capabilities and evidence-backed provider routes. | None |
+| `tokenless limits inspect` | Inspect the next-prompt provider/profile capacity estimate from the packaged catalog and local job history. | None |
+| `tokenless run` | Send a prompt and optional files through a visible provider session. | Yes |
+| `tokenless replay` | Report previously unseen daemon outcome summaries for one agent recipient. | None |
+| `tokenless state` | Inspect durable daemon job state. | None |
+| `tokenless resume` | Resume a job waiting for user action in a headed browser. | Yes |
+| `tokenless cancel` | Cancel a daemon job and confirm its canceled state. | None |
+| `tokenless provider-status` | Perform a live provider authentication check. | Yes |
+| `tokenless provider-controls` | Inspect visible model and effort controls. | Yes |
+| `tokenless provider-configure` | Select exact visible model or effort labels. | Yes |
+| `tokenless provider-action` | Execute one low-level visible provider action. | Yes |
+| `tokenless chatgpt-controls` | Inspect ChatGPT model and effort controls. | Yes |
+| `tokenless chatgpt-configure` | Configure ChatGPT-specific visible controls. | Yes |
+| `tokenless snapshot-dom` | Capture and persist a sanitized provider DOM snapshot. | Yes |
+| `tokenless daemon stop` | Gracefully stop a compatible local daemon. | None |
+| `tokenless prompt` | Build a shareable Tokenless prompt without submitting it. | None |
+
+## Conventions
+
+### Provider values
+
+Provider values are:
+
+```text
+chatgpt
+claude
+gemini
+grok
+qwen
+deepseek
+perplexity
+zai
+doubao
+```
+
+ChatGPT, Claude, Gemini, and Grok are supported providers. Qwen / 千问, DeepSeek, Perplexity, Z.ai / GLM, and Doubao / 豆包 are experimental: only their evidence-backed routes and controls are advertised, while unproven continuation and optional capabilities remain unavailable or unknown.
+
+Runtime browser values are `auto`, `chrome`, `chrome-for-testing`, `chromium`, `edge`, `arc`, `brave`, `managed-chromium`, and `cloak`. `auto` prefers an installed system browser and uses the locked managed fallback only when none exists. `cloak` is explicit opt-in. New Tokenless profiles are clean by default and runtime-bound. An explicitly selected local Chromium profile can instead be copied after `--consent-local-profile-copy`; Tokenless treats its contents as an opaque local filesystem tree.
+
+### Short options
+
+Short options are case-sensitive:
+
+- `-P <slug>` is short for `--profile <slug>`.
+- `-p <provider>` is short for `--provider <provider>`.
+- `-f` is short for `--fresh` during setup.
+- `-V` is short for `--version`.
+
+### Common execution options
+
+These options are available where the command needs the corresponding runtime behavior:
+
+| Option | Meaning |
+| --- | --- |
+| `-h`, `--help` | Show usage for the selected command or subcommand. |
+| `--json` | Write the final result as structured JSON. Live progress remains on stderr unless `--quiet` is used. |
+| `--quiet` | Suppress live status events. |
+| `--home <path>` | Use a non-default Tokenless state directory. |
+| `--daemon-url <url>` | Set the preferred loopback daemon URL. If its port is occupied, Tokenless may bind the next free port and records the actual endpoint in SQLite. |
+| `--agent-kind <kind>` | Address a job or replay drain to an explicit agent kind; use with `--agent-session-id`. |
+| `--agent-session-id <id>` | Address a job or replay drain to an explicit agent session; use with `--agent-kind`. |
+| `--browser-visibility <auto\|headed\|headless>` | Choose the browser visibility policy. |
+| `--timeout-ms <ms>` | Override the command or job wait timeout. |
+| `--daemon-start-timeout-ms <ms>` | Override daemon startup waiting. |
+| `--runner-heartbeat-timeout-ms <ms>` | Accepted for compatibility; the embedded Playwright runtime ignores it. |
+| `--cancel-timeout-ms <ms>` | Override cancellation confirmation waiting. |
+| `--target-url <url>` | Start from a provider-approved URL on the selected provider domain. |
+
+Not every common option is accepted by every command. The command sections below list the meaningful options for each workflow.
+
+## Installation, Setup, and Maintenance
+
+### `tokenless help`
+
+Prints the concise built-in usage guide and the link to this reference.
+
+```bash
+tokenless help
+tokenless run --help
+tokenless profiles status --help
+```
+
+Use `-h` or `--help` after any command or subcommand to print its accepted options before doing work.
+
+### `tokenless --version`
+
+Prints the installed package version.
+
+```bash
+tokenless --version
+tokenless -V
+```
+
+### `tokenless install`
+
+Resolves or installs the selected exact browser runtime, saves the runtime preference, upserts the required global Tokenless agent skills, verifies the packaged TypeScript daemon runtime, and ensures that the local daemon matches the installed CLI version.
+
+```bash
+tokenless install --browser auto --json
+tokenless install --browser cloak --json
+tokenless install --browsers chrome,brave --json
+```
+
+Main options:
+
+- `--browser <browser>` selects one browser preference. Managed selections download only during install or setup.
+- `--browsers <list>` verifies a comma-separated browser list.
+- `--repair-browser` replaces the explicitly selected managed-Chromium or Cloak cache only after a newly downloaded replacement passes every verification step; a failed repair restores the previous cache.
+- `--daemon-url`, `--daemon-start-timeout-ms`, `--home`, and `--json` control the local runtime.
+
+This command does not configure a managed profile or check provider sign-in. Run `tokenless setup` afterward.
+
+### `tokenless setup`
+
+Runs the complete onboarding flow: discovers system and cached runtimes, resolves or installs the exact selected browser, creates or selects a runtime-compatible managed profile, saves the verified selection, upserts the global Tokenless agent skills, reconciles the daemon to the installed CLI version, and performs one live sign-in check for every enabled provider. No browser is downloaded by npm postinstall, daemon startup, or ordinary job execution. If no language preference exists, setup detects the system locale, selects `zh-CN` for Chinese locales or `en` otherwise, and persists it in config.
+
+Interactive setup:
+
+```bash
+tokenless setup
+```
+
+Create or reuse a clean profile non-interactively:
+
+```bash
+tokenless setup --profile default --fresh --json
+tokenless setup --anti-detect --profile cloak-default --fresh --json
+tokenless setup --browser managed-chromium --profile managed-default --fresh --json
+```
+
+Main options:
+
+- `--profile <slug>` selects or names the managed profile.
+- `--anti-detect` explicitly selects the catalog-pinned CloakBrowser runtime and confirms a clean Cloak-bound profile in non-interactive setup. Explicit `--browser cloak` carries the same confirmation; a stored Cloak preference alone fails before download.
+- `--provider-whitelist <list>` selects provider membership for that profile during non-interactive setup.
+- `--no-open` completes setup without opening the dashboard.
+- `--browser <browser>` selects `auto`, one exact system browser, `managed-chromium`, or `cloak`.
+- `--no-browser-download` fails instead of downloading a missing managed runtime.
+- `--repair-browser` explicitly reinstalls a selected `managed-chromium` or `cloak` runtime. It cannot be combined with `--no-browser-download`.
+- `--fresh` or `-f` creates a clean managed profile.
+- `--import-browser-profile <key> --consent-local-profile-copy` copies one explicitly selected local Chromium profile into the managed profile without parsing authentication values.
+- `--defaults` selects non-interactive defaults.
+- `--label <name>` sets the profile display label.
+- `--set-default` makes the selected profile the default.
+
+`auto` is the first-run default and prefers an installed Chrome, Brave, Edge, Arc, Chromium, or Chrome for Testing executable. Interactive setup asks whether to use Anti-Detect; declining does not open a separate browser-runtime picker. Normal mode follows an explicit `--browser`, then the saved concrete preference, then deterministic automatic discovery. Setup resolves the result to a concrete `browser` plus a verified `browserExecutablePath` in `config.json`. Later launches verify that cached executable first and scan standard installation paths only when the cache is missing or no longer runnable; a successful fallback refreshes the cache. If no supported system browser exists, setup downloads the locked Chrome for Testing 145 artifact into `$TOKENLESS_HOME/browser/runtimes`. An explicit missing system-browser choice fails with the exact config command and dashboard field needed to supply a path. Cloak is downloaded only after explicit selection, uses the official platform-specific release pin, and is never bundled with Tokenless. The first runtime targets are Apple Silicon macOS and Windows x64 (Intel and AMD); Windows remains prerelease until its real-hardware gates pass.
+
+`browserExecutablePath` may point outside `TOKENLESS_HOME` only for an explicitly selected system browser. Paths for `managed-chromium` and `cloak` are derived from the catalog-pinned runtime under `$TOKENLESS_HOME/browser/runtimes`; an arbitrary config value cannot replace or bypass that managed runtime.
+
+The Anti-Detect question states that accepting it will download and install the verified, platform-pinned CloakBrowser under `TOKENLESS_HOME` when needed; there is no later installation confirmation. After Anti-Detect is selected, setup does not run system-browser executable discovery for runtime selection. It links to the official CloakBrowser project, shows the exact platform artifact and Chromium version, and scans known Chrome, Brave, Edge, Arc, Chromium, and Chrome for Testing profile directories. Discovery reads only the directory key and `Last Version` and classifies an exact four-component match. When compatible profiles exist, setup presents one choice containing `Start clean` and the compatible profile sources. Selecting a profile explicitly authorizes its opaque local copy; there are no separate import or copy-consent questions. When none align, setup skips the source choice and uses a clean profile. An explicitly requested incompatible or unknown-version import fails before download instead of being silently ignored. The installer then downloads, verifies, extracts, version-checks, and smoke-launches Cloak; setup immediately persists `browser: "cloak"` and its managed `browserExecutablePath`. Copying remains opaque: Tokenless does not parse `Local State`, cookies, browser storage, or authentication values. Non-interactive import still requires `--consent-local-profile-copy` because no visible profile-source selection occurred.
+
+Managed profiles record a runtime binding. Setup will not open a profile with a different runtime family or with an older browser than the version that created it. Changing runtime family normally creates a clean profile; an explicit import can populate the new runtime-bound profile from a selected local Chromium profile. The managed profile then preserves its browser-managed session across jobs.
+
+Interactive `setup` asks which providers belong to the selected profile. Non-interactive setup uses `--provider-whitelist`, the existing profile scope, or the persisted default whitelist. Guest access, signed-out pages, unknown state, and sign-in-required pages are recorded observations rather than setup failures; only technical check failures make setup fail. After every setup, Tokenless leaves one headed review tab open for each enabled provider so the user can inspect sign-in state directly. Unless `--json`, `--defaults`, or `--no-open` suppresses an interactive handoff, setup also opens the local dashboard.
+
+The default `providerWhitelist` contains every non-disabled provider except Gemini. Gemini remains available and can be added explicitly with `--provider-whitelist` or through the dashboard.
+
+### `tokenless dashboard`
+
+Starts or discovers the same-home daemon, mints a single-use 60-second bootstrap ticket, and opens one reserved dashboard tab in the selected managed profile:
+
+```bash
+tokenless dashboard
+tokenless dashboard --profile work
+tokenless dashboard --profile work --no-open --json
+```
+
+`--no-open` returns the one-time loopback bootstrap URL without launching a browser. The URL redirects immediately to `/ui/` after use and cannot be reused. The resulting browser session is short-lived, stored in an `HttpOnly` `SameSite=Strict` cookie, and uses exact-Origin plus CSRF checks for mutations. The dashboard never receives the daemon bearer token, provider cookies, browser storage, Keychain data, raw DOM, claim tokens, checkpoints, or private filesystem paths.
+
+The dashboard provides Overview, Profiles, Providers, Capabilities, Jobs, and System/Diagnostics areas. Provider membership, visibility, role label, and an optional credential-free HTTP/HTTPS/SOCKS5 proxy are profile scoped. CLI recovery equivalents remain available:
+
+```bash
+tokenless config --profile work --provider-whitelist chatgpt,claude --browser-visibility headed --json
+tokenless config --profile work --proxy-server socks5://127.0.0.1:1080 --proxy-bypass localhost --json
+tokenless profiles open --profile work --json
+tokenless state --profile work --json
+```
+
+### `tokenless doctor`
+
+Performs a read-only health report over Node.js, installed skills, packaged runtime, daemon identity and version, embedded Playwright runtime, browser preference, resolved runtime family and exact executable version, checksum state, default profile/runtime compatibility, configuration, and cached provider readiness.
+
+```bash
+tokenless doctor --json
+```
+
+`doctor` does not open provider pages, refresh authentication, start the daemon, or repair state. `checks.managedProfile.ok` reports registry/profile health, while `checks.profileRuntime.ok` independently reports whether that profile has a compatible resolvable browser binding. Provider readiness comes from the last saved profile observation. `checks.providerReadiness.ok` reports whether configured providers have recorded observations; `usableProviders` lists the cached providers eligible for implicit routing. Because the daemon is on demand, a normally stopped daemon and embedded browser runtime are reported as healthy stopped state rather than installation damage.
+
+Main options: `--browser`, `--daemon-url`, `--home`, and `--json`.
+
+### `tokenless config`
+
+Reads persistent configuration when called without configuration options:
+
+```bash
+tokenless config --json
+```
+
+Updates one or more persistent values when options are supplied:
+
+```bash
+tokenless config \
+  --language zh-CN \
+  --provider-whitelist chatgpt,claude,gemini,grok,qwen \
+  --browser chrome \
+  --browser-executable-path "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" \
+  --browser-visibility auto \
+  --json
+```
+
+Configurable values:
+
+- `--language <en|zh-CN>`
+- `--provider-whitelist <list>`
+- `--browser <browser>`
+- `--browser-executable-path <absolute-path>` for an explicit system browser
+- `--clear-browser-executable-path` to force discovery on the next resolution
+- `--browser-visibility <auto|headed|headless>`
+- `--proxy-server <http|https|socks5-url>` with optional `--proxy-bypass <comma-separated-list>`
+- `--clear-proxy`
+- `--daemon-url <loopback-url>`
+- `--home <path>`
+
+Add `--profile <slug>` to scope `--provider-whitelist`, `--browser-visibility`, and credential-free proxy settings to one managed profile. Proxy options require `--profile`; `--clear-proxy` removes that profile's endpoint. Global `providerWhitelist` remains a compatibility union for older callers, while routing reads the selected profile's membership.
+
+The persisted JSON key is `providerWhitelist`. Tokenless still reads the legacy `preferredProviders` key and rewrites it as `providerWhitelist` on the next config update. The undocumented legacy `--preferred-providers` flag remains accepted as an alias during migration.
+
+The config shape is:
+
+```json
+{
+  "protocol": "tokenless.config.v1",
+  "updatedAt": "2026-08-02T02:09:40.254Z",
+  "providerWhitelist": [
+    "chatgpt",
+    "claude",
+    "grok",
+    "qwen",
+    "deepseek",
+    "perplexity",
+    "zai",
+    "doubao"
+  ],
+  "profilePreferences": {},
+  "browser": "chrome",
+  "browserExecutablePath": "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+  "browserConnectionMode": "playwright",
+  "browserVisibility": "auto",
+  "daemonUrl": null,
+  "language": "en"
+}
+```
+
+`browserExecutablePath` is a verified cache, not an immutable override: Tokenless executes the browser's version command to validate it, falls back to standard-path discovery if validation fails, and rewrites the cache after a successful fallback. If both checks fail, use the CLI flag above or paste an absolute path into **System → Browser executable path** in the dashboard. The dashboard exposes only whether a path is configured; it does not send the private path back to browser JavaScript.
+
+Human-readable command output and the default provider response language follow `language`; an explicit language request in the prompt takes precedence. Command names, flags, JSON keys, error codes, status values, and other integration terms remain stable. `daemonUrl` is the preferred start endpoint, not mutable runtime status. Tokenless never rewrites it when that port is busy; the daemon records its actual bound endpoint in the SQLite runtime-state row.
+
+The config file also accepts the experimental `browserConnectionMode` value `playwright` or `cdp`; omitted values default to `playwright`. It intentionally has no CLI flag. Edit the JSON value only for capability evaluation, then restart the daemon. CDP does not change the selected profile, browser runtime, visibility policy, or provider mappings.
+
+### `tokenless upgrade`
+
+Runs the supported upgrade pipeline: update the global npm CLI, resolve and verify the installed CLI, invoke that new CLI's shared maintenance module to upsert global agent skills and reconcile the matching daemon, then run doctor.
+
+```bash
+tokenless upgrade
+tokenless upgrade --json
+```
+
+Accepted options are `--json`, `--home`, `--daemon-url`, `--browser`, `--browsers`, and `--daemon-start-timeout-ms`.
+
+### `tokenless daemon stop`
+
+Gracefully stops a compatible daemon after verifying its identity.
+
+```bash
+tokenless daemon stop --json
+```
+
+Options: `--home`, `--daemon-url`, `--timeout-ms`, and `--json`.
+
+The command discovers the actual endpoint from SQLite and does not kill an unverified or incompatible process merely because it occupies the preferred port.
+
+## Managed Profiles
+
+A managed profile is one persistent local browser identity. One profile may hold sessions for all enabled providers.
+
+### `tokenless profiles discover`
+
+Reads safe profile directory/version metadata for Chrome, Brave, Edge, Arc, Chromium, or Chrome for Testing without copying or modifying browser data. Each profile reports `aligned`, `not_aligned`, or `unknown` against the current platform Cloak pin. Discovery does not make a profile importable and does not parse `Local State`.
+
+```bash
+tokenless profiles discover --browser all --json
+tokenless profiles discover --browser edge --browser-user-data-dir /path/to/user-data --json
+```
+
+### `tokenless profiles add`
+
+Creates a clean managed profile or, after explicit consent, copies a selected local Chromium profile:
+
+```bash
+tokenless profiles add -P work --label "Work" --set-default --json
+tokenless profiles add -P cloak-work --browser cloak --import-browser-profile Default --consent-local-profile-copy --set-default --json
+```
+
+The copy remains local and opaque. Tokenless copies filesystem entries but does not inspect or report cookies, storage, passwords, tokens, or Keychain data.
+
+### `tokenless profiles list`
+
+Reads the profile registry and returns every managed profile.
+
+```bash
+tokenless profiles list
+tokenless profiles list --json
+```
+
+This command is fast, read-only, and has no browser side effects. Provider fields are cached observations; use each provider's `checkedAt` to judge freshness.
+
+### `tokenless profiles status`
+
+Performs a live authentication check against one provider, then writes `auth`, visible username, visible subscription, and a new `checkedAt` value to the selected profile.
+
+```bash
+tokenless profiles status -P work -p chatgpt --json
+```
+
+If omitted, the profile resolves to the configured default and the provider falls back to the environment or ChatGPT.
+
+### `tokenless profiles open`
+
+Opens the selected managed profile with a headed browser. Without `--provider`, Tokenless does not resolve `TOKENLESS_PROVIDER`, does not select ChatGPT or any other provider, and does not navigate; Chromium shows the profile's natural initial, default, or restored page. With `--provider`, Tokenless opens that provider and verifies navigation.
+
+```bash
+tokenless profiles open -P work --json
+tokenless profiles open -P work -p claude --json
+```
+
+Use the provider-less form for user-controlled browser maintenance, account switching, or inspecting the managed profile. Use the provider form for sign-in, CAPTCHA, MFA, consent, or provider-specific account switching. It does not replace `profiles status`; run the status command afterward to save a fresh observation.
+
+### `tokenless profiles set-default`
+
+Makes one registered profile the default.
+
+```bash
+tokenless profiles set-default -P work --json
+```
+
+### `tokenless profiles reset`
+
+Replaces an imported managed profile with a fresh opaque copy from its recorded local source. Explicit consent is required again.
+
+```bash
+tokenless profiles reset -P work --consent-local-profile-copy --json
+```
+
+### `tokenless profiles clear`
+
+Quiesces the embedded Playwright runtime and deletes either one managed profile or every managed profile:
+
+```bash
+tokenless profiles clear -P work
+tokenless profiles clear --all
+```
+
+Exactly one of `--profile` and `--all` is required. This human maintenance command does not accept `--json`.
+
+### `tokenless profiles remove`
+
+Deletes one managed profile through the structured, explicitly confirmed form:
+
+```bash
+tokenless profiles remove -P work --confirm-delete --json
+```
+
+`--confirm-delete` is mandatory. Removing or clearing a managed profile deletes only its Tokenless-managed browser data; it does not modify any system-browser profile.
+
+## Running Work and Managing Jobs
+
+### `tokenless capabilities list`
+
+Returns the versioned canonical task-capability catalog without opening a browser:
+
+See the [Capability Matrix](docs/capability-matrix.md) for capability semantics, provider mappings, support states, and the extension process.
+
+```bash
+tokenless capabilities list --json
+```
+
+Each entry describes the caller outcome, parameter schema, lifecycle, side effects, required evidence, output kinds, stability, and declared provider routes. `routeable: true` means at least one checked-in provider strategy has complete implementation and real-provider E2E evidence. Candidate entries remain discoverable with `routeable: false`; they cannot be selected for a run.
+
+Provider controls such as `model.choice`, `effort.choice`, `qwen.mode`, `doubao.mode`, and `doubao.skill` are intentionally absent. They remain provider adapter details rather than canonical caller outcomes.
+
+### `tokenless limits inspect`
+
+Inspect the next prompt against the observed profile subscription, packaged provider knowledge, and immutable local submission history:
+
+```sh
+tokenless limits inspect --profile default --provider chatgpt --json
+```
+
+The projection reports the matched catalog plan and rules, local usage, published and effective allowance, estimated remaining units, cadence, burst allowance, decision, and `eligibleAt`. `unknown` means Tokenless has no enforceable official number and will allow execution; it does not mean unlimited provider capacity. This command is local and read-only and does not open or submit to a provider website.
+
+### `tokenless run`
+
+Builds a managed Playwright job, sends a prompt through the selected visible provider session, and normally waits for the correlated response.
+
+```bash
+tokenless run \
+  -P default \
+  -p chatgpt \
+  --prompt "Review this proposal." \
+  --json
+```
+
+Provider selection:
+
+- Explicit `--provider <provider>` or `TOKENLESS_PROVIDER` is exact and is not replaced based on cached usability.
+- `--capability <capability>` is repeatable and requests canonical caller outcomes rather than provider-specific controls.
+- Tokenless merges explicit capabilities with structural inference: a normal `submit_and_read` run requires `conversation.chat`, `--attach-file` requires `file.upload` plus `image.input`, `audio.input`, or `video.input` when applicable, and `--workspace-mode native` requires `workspace.native`.
+- When no provider is explicit, the configured provider list filters membership. Tokenless then filters for providers that satisfy the full implication-expanded requirement set and ranks routes by fresh cached eligibility and evidence maturity (`supported` before `experimental`); configured list position is the final tie-breaker and cannot override those stronger signals. Stale usable observations remain `unchecked` until the runner performs its live read-only preflight.
+- An explicit provider that cannot satisfy the full requirement set fails before daemon submission instead of silently switching.
+- Unknown and sign-in-required observations are not usable for implicit routing. If no cached provider is usable, the CLI returns `provider_unavailable` with provider observation context before creating a daemon job.
+- A known capability with no complete route returns `task_capability_route_unavailable` before browser mutation. `--capability` currently requires the normal `submit_and_read` action.
+- Successful submissions return and durably store `capabilityRoute`, including normalized requirements, selected strategies, support level, evidence identifiers, and runtime eligibility; `tokenless state` returns the same route.
+- Implicit `submit_and_read` runs may persist an automatic fallback plan. Before mutation, every attempt rechecks known local provider capacity, the visible session, and capability-specific UI without a probe prompt. Classified safe pre-submit capacity, auth, CAPTCHA, rate/plan, maintenance, region, navigation, stable-surface, and capability-availability failures requeue the same job on the next ranked provider only when it satisfies the identical complete requirements and all completed mutations are reconstructable. Exact or mapped continuation, explicit providers, provider-specific controls, non-reconstructable mutations, ambiguous external state, and post-submission failures never switch automatically. JSON state includes ranked `fallback.routes`, structured stop reasons, and `providerAttempts`.
+- The job validator independently derives capabilities from actions, attachment MIME types, and native workspace intent, so internal or agent callers cannot under-declare a fallback requirement. Routed jobs carry `tokenless.context-envelope.v1`; its instructions, references, output/constraint contract, optional upstream state, and delivery hashes are replayed unchanged on every attempt. JSON state exposes only a redacted envelope summary.
+
+Prompt input:
+
+- Use exactly one of `--prompt <text>` or `--prompt-file <path>`.
+- `--project-root <path>` defines the safe root for shareable file context.
+- Repeat `--file <path>` to embed text from files inside the project root into the generated prompt.
+- Use `--context <text>` or `--context-file <path>` for additional shareable turn context.
+- Repeat `--attach-file <path>` to upload real files through the provider page. `--file` and `--attach-file` are different operations.
+
+Provider controls:
+
+- `--model <exact-visible-label>` selects a visible model before submission.
+- `--effort <exact-visible-label>` selects visible reasoning or effort.
+- `--thinking-effort <label>` is an alternative effort option.
+- `--qwen-mode <exact-visible-label>` selects a Qwen-specific composer mode.
+- `--qwen-mode-variant <exact-visible-label>` selects a visible variant of that Qwen mode and requires `--qwen-mode`.
+- `--deepseek-mode <Instant|Expert|Vision>` selects an exact DeepSeek mode.
+- `--deepseek-deepthink <on|off>` controls DeepThink in the active DeepSeek mode.
+- `--deepseek-search <on|off>` controls Search; the control is available only in DeepSeek Instant mode.
+- DeepSeek canonical requirements prepare their required controls before mutation: `search.web` selects Instant and enables Search, `reasoning.extended` enables DeepThink, and `image.input` selects Vision. Explicit incompatible combinations fail before changing the page.
+- `--browser-visibility <auto|headed|headless>` overrides the configured visibility policy.
+
+Identity and continuity:
+
+- `--task-id <id>` supplies durable task identity.
+- `--idempotency-key <id>` supplies the same identity when no task ID is used.
+- `--project-name <name>` and `--chat-name <name>` contribute to derived task identity.
+- `--workspace-mode <auto|native|conversation>` explicitly requests Workspace handling and requires `--project-name`.
+- `--project-instructions <text>` or `--project-instructions-file <path>` supplies optional Workspace instructions.
+- `--agent-kind <kind>` and `--agent-session-id <id>` address the job to one agent recipient. Both are required together; the same values may come from `TOKENLESS_AGENT_KIND` and `TOKENLESS_AGENT_SESSION_ID`.
+
+Execution:
+
+- `--no-wait` submits and returns without waiting for the result.
+- `--long-running` uses the long-running wait budget and cannot be combined with `--no-wait`.
+- `--timeout-ms`, `--cancel-timeout-ms`, and `--daemon-start-timeout-ms` override execution timing. `--runner-heartbeat-timeout-ms` remains accepted for compatibility but no longer controls a standalone runner.
+- `--target-url <url>` selects an approved starting URL on the provider domain.
+
+Workspace modes:
+
+- Routed `run` requests using `auto` or `native` require the canonical `workspace.native` capability. No provider route is currently advertised, so these requests fail before browser mutation until the native Project release gate is complete.
+- The lower-level Claude and Grok adapters implement experimental visible native Project create/reuse behavior for their explicit real-provider acceptance suite; implementation alone is not a router support claim.
+- After `workspace.native` becomes routeable, `native` will require exact native Project creation or reuse and will never degrade to conversation scope. Duplicate exact visible names fail closed.
+- `conversation` requires the conversation-scoped strategy; cross-process restoration is supported only where the real-provider capability matrix proves it.
+- Native results report `created` or `reused`, canonical provider resource identity, provider/profile scope, and the instruction outcome. Conversation results report `fallback`.
+- Project and task conversation targets are persisted as exact SQLite mappings rather than recovered by scanning historical job results.
+
+### `tokenless replay`
+
+Atomically reports outcome summaries that have not yet been delivered to one explicit agent recipient:
+
+```bash
+tokenless replay \
+  --agent-kind codex \
+  --agent-session-id "<stable-session-id>" \
+  --json
+```
+
+The command probes or starts the local daemon on demand. SQLite marks each actionable outcome revision as reported before the response is returned, so the same revision is never proactively reported again—even if the CLI response is lost. A later parked or terminal revision of the same job is a new outcome and may be reported once.
+
+Replay contains only allowlisted metadata and `has_result`, `has_error`, and `has_blocker` flags. It does not include raw result, error, or blocker content. Use `tokenless state --job-id "<jobId>" --json` to retrieve the durable full job whenever needed. Do not submit a replacement job solely because a replay response was missed.
+
+Main options: `--agent-kind`, `--agent-session-id`, `--limit`, `--daemon-url`, `--daemon-start-timeout-ms`, `--home`, and `--json`. The two identity flags may instead be supplied by `TOKENLESS_AGENT_KIND` and `TOKENLESS_AGENT_SESSION_ID`.
+
+### `tokenless state`
+
+Reads durable daemon job state without visiting the provider.
+
+```bash
+tokenless state --task-id task-123 -P default --json
+tokenless state --job-id tlp_... --json
+tokenless state -P default -p chatgpt --limit 10 --json
+```
+
+Provide a task ID, job ID, or profile. Results are filtered to the managed Playwright backend, selected profile, and provider. `--limit` controls the number of returned jobs.
+
+### `tokenless resume`
+
+Resumes the same daemon job after it entered `waiting_for_user`.
+
+```bash
+tokenless resume \
+  --job-id tlp_... \
+  --browser-visibility headed \
+  --json
+```
+
+`--job-id` and `--browser-visibility headed` are required. Resume preserves the original job and task identity.
+
+When provider sign-in, hCaptcha, MFA, or another visible human verification is required, Tokenless reports `waiting_for_user` and explicitly says that your help is needed. Complete the visible step, then query or resume the same job; do not submit a replacement job.
+
+### `tokenless cancel`
+
+Requests cancellation and succeeds only after the daemon confirms the `canceled` state.
+
+```bash
+tokenless cancel --job-id tlp_... --json
+```
+
+Main options: `--job-id`, `--cancel-timeout-ms`, `--daemon-url`, `--home`, and `--json`.
+
+## Provider Inspection and Control
+
+These commands perform live visible-page operations. They do not make `profiles list` fresh unless the command is specifically `profiles status`.
+
+### `tokenless provider-status`
+
+Performs a live provider authentication action and returns the result.
+
+```bash
+tokenless provider-status -P default -p chatgpt --json
+```
+
+For a live check that also updates the profile registry, use `tokenless profiles status`.
+
+### `tokenless provider-controls`
+
+Inspects the provider's visible model and effort choices.
+
+```bash
+tokenless provider-controls -P default -p claude --json
+```
+
+### `tokenless provider-configure`
+
+Selects an exact visible model, effort label, or both.
+
+```bash
+tokenless provider-configure \
+  -P default \
+  -p chatgpt \
+  --model "GPT-5" \
+  --effort "High" \
+  --json
+```
+
+At least one control is required. Labels must match visible UI labels; model fallback lists are not supported by managed visible jobs.
+
+### `tokenless chatgpt-controls`
+
+ChatGPT-specific alias for inspecting model and effort controls.
+
+```bash
+tokenless chatgpt-controls -P default --json
+```
+
+### `tokenless chatgpt-configure`
+
+Selects ChatGPT-specific model or effort controls. It also accepts `--chat-surface chat` as an explicit surface constraint; other ChatGPT surfaces are rejected.
+
+```bash
+tokenless chatgpt-configure \
+  -P default \
+  --model "GPT-5" \
+  --effort "High" \
+  --json
+```
+
+If `--provider` is supplied, it must be `chatgpt`.
+
+### `tokenless provider-action`
+
+Executes exactly one low-level visible action.
+
+```bash
+tokenless provider-action \
+  -P default \
+  -p chatgpt \
+  --action capability.inspect \
+  --json
+```
+
+| Action | Purpose | Required or relevant payload options |
+| --- | --- | --- |
+| `capability.inspect` | Inspect visible, subscription-dependent capabilities. | None |
+| `auth.status` | Inspect visible authentication and account state. | None |
+| `model.inspect` | List visible model controls. | None |
+| `model.select` | Select one exact visible model. | `--model` |
+| `effort.inspect` | List visible effort controls. | None |
+| `effort.select` | Select one exact visible effort. | `--effort` or `--thinking-effort` |
+| `qwen.mode.inspect` | List Qwen-specific visible composer modes. | None; Qwen only |
+| `qwen.mode.select` | Select one Qwen-specific mode and optional visible variant. | `--qwen-mode`; optional `--qwen-mode-variant` |
+| `deepseek.mode.inspect` | Inspect DeepSeek Instant, Expert, and Vision plus their mode-dependent controls. | None; DeepSeek only |
+| `deepseek.mode.select` | Select one exact DeepSeek mode. | `--deepseek-mode` |
+| `deepseek.deepthink.inspect` | Inspect DeepThink in the active DeepSeek mode. | None; DeepSeek only |
+| `deepseek.deepthink.select` | Enable or disable DeepThink. | `--deepseek-deepthink on|off` |
+| `deepseek.search.inspect` | Inspect Search in the active DeepSeek mode. | None; DeepSeek only |
+| `deepseek.search.select` | Enable or disable Search in Instant mode. | `--deepseek-search on|off` |
+| `doubao.mode.inspect` | Inspect Fast, Expert, Work Task Turbo, and visibly restricted Work Task Pro. | None; Doubao only |
+| `doubao.mode.select` | Select one exact Doubao mode. | `--doubao-mode fast|expert|work-task-turbo|work-task-pro` |
+| `doubao.skill.inspect` | Inspect Doubao Web skills and their canonical candidate mappings. | None; Doubao only |
+| `doubao.skill.select` | Select a Doubao skill or restore ordinary chat. | `--doubao-skill <skill>` |
+| `file.upload` | Upload files through visible file controls. | One or more `--attach-file` |
+| `workspace.ensure` | Ensure a native or conversation-scoped Workspace. | `--project-name`; optional `--workspace-mode` and instructions |
+| `prompt.clear` | Clear the visible composer. | None |
+| `prompt.input` | Put text into the visible composer without submitting it. | `--prompt` or `--prompt-file` |
+| `prompt.submit` | Submit the current visible composer. | None |
+| `response.read` | Read the visible correlated response. | None |
+| `snapshot.sanitized` | Return a sanitized structural snapshot. | None |
+| `navigation.check` | Verify that the page is on an approved provider origin. | None |
+| `blocker.check` | Inspect visible blockers such as sign-in or CAPTCHA. | None |
+
+Action payloads are strict: options that do not apply to the selected action are rejected.
+
+Doubao skill ids are `chat`, `document-writing`, `presentation-generation`, `image-generation`, `video-generation`, `deep-research`, `audio-podcast`, `music-generation`, `problem-solving`, `spreadsheet-generation`, and `audio-transcription`. The last value is inspectable but selection returns unavailable when the visible Web UI requires the desktop app. Translation is intentionally excluded from this coding-oriented control surface.
+
+`workspace.ensure` defaults to `--workspace-mode auto` when the mode is omitted.
+
+### `tokenless snapshot-dom`
+
+Captures a sanitized structural provider snapshot through the daemon and persists its metadata and snapshot files under the Tokenless home directory.
+
+```bash
+tokenless snapshot-dom -P default -p chatgpt --json
+```
+
+Use `provider-action --action snapshot.sanitized` when persistence is not needed.
+
+## Prompt Construction
+
+### `tokenless prompt`
+
+Builds the shareable `# Tokenless Request` document without opening a browser or submitting a provider job.
+
+```bash
+tokenless prompt \
+  --project-root /path/to/project \
+  --file src/example.ts \
+  --context "Only the selected files are shareable." \
+  --prompt "Review this implementation." \
+  --output /tmp/tokenless-request.md
+```
+
+Options:
+
+- `--prompt` or `--prompt-file` supplies the user request.
+- `--project-root` defines the allowed file boundary.
+- Repeat `--file` to include file text.
+- `--context` or `--context-file` supplies shareable turn context.
+- `--output` writes the compiled prompt to a file; otherwise it prints to stdout.
+
+The command can also be invoked without the word `prompt` when the first argument is an option, but the explicit form is clearer in documentation and scripts.
+
+## Compatibility Aliases
+
+The following aliases are accepted for compatibility. Prefer the canonical form in new scripts.
+
+| Alias | Canonical form |
+| --- | --- |
+| `tokenless status` | `tokenless state` |
+| `tokenless provider-auth-status` | `tokenless provider-status` |
+| `tokenless inspect-provider-controls` | `tokenless provider-controls` |
+| `tokenless inspect-chatgpt-controls` | `tokenless chatgpt-controls` |
+| `--import-chrome-profile` | `--import-browser-profile` |
+| `--chrome-user-data-dir` | `--browser-user-data-dir` |
+| `--turn-context` | `--context` |
+| `--turn-context-file` | `--context-file` |
+| `--conversation-key` | `--idempotency-key` |
+| `--clean-profile` | `--fresh` |
+
+## Status and Side-Effect Summary
+
+The three similarly named status workflows have different persistence behavior:
+
+```text
+profiles list
+    reads only the saved profile registry
+
+profiles status
+    visits one provider, checks auth/account controls,
+    and saves auth, username, subscription, and checkedAt
+
+provider-status
+    visits one provider and returns a live auth result,
+    but is not the profile-registry refresh workflow
+```
+
+Commands that may open or operate a provider page are `setup`, `profiles status`, `profiles open`, `run`, `resume`, every provider inspection/configuration/action command, and `snapshot-dom`.
+
+## Manual Real-Browser Acceptance
+
+The authenticated provider capability harness keeps a separate persistent profile for every explicitly selected production browser. It derives a test-only home at `<TOKENLESS_HOME>/e2e/live-provider` by default, or uses `TOKENLESS_LIVE_PROVIDER_TEST_HOME` or `--home` when explicitly supplied. The test home must differ from the ordinary Tokenless home and remain outside every repository/worktree. Browser selection `cloak`, for example, resolves stable slug `live-provider-cloak`; the production registry at `<test-home>/browser/profiles.json` maps that slug to the opaque directory `<test-home>/browser/profiles/<uuid>`. The harness validates that directory, its private permissions, lifecycle, executable, and runtime binding before any provider automation. It rejects `auto` because automatic discovery could resolve a different executable across runs, and it never reuses one profile across browser runtimes.
+
+Prepare and manually authenticate one browser-specific profile before running its provider gates:
+
+```bash
+npm run test:e2e:prepare -- --browser cloak
+# Sign in manually in each provider tab, then run the printed daemon-stop command.
+npm run test:e2e -- --browser cloak
+npm run test:e2e:connection-matrix -- --browser cloak
+```
+
+Supported authenticated-profile selections are `chrome`, `brave`, `edge`, `arc`, `chromium`, `chrome-for-testing`, `managed-chromium`, and `cloak`. `prepare` installs or resolves the exact browser, keeps its maintenance skill output inside the test-only home, and creates or reuses only its deterministic profile slug. Its login-page list is the profile's effective provider whitelist: `profilePreferences[slug].enabledProviders` when present, otherwise the top-level `providerWhitelist`. Preparation preserves that configured order and never rewrites either list. It requests every listed provider-home tab in one concurrent Chromium background-tab batch, then exits without waiting for page load, login, or Playwright target observation. The detached daemon remains the browser owner while Chromium persists the dedicated profile normally. The browser may take focus on its initial launch but does not foreground every provider tab in sequence. Preparation does not read the capability matrix, run provider jobs, call `setup` or `profiles status`, automate login, or inspect authentication data. Use `--no-open` for preparation validation without provider navigation or the manual browser handoff. The `run` command uses the live capability matrix to execute declared provider journeys once in Playwright mode; `connection-matrix` runs the same selected profile sequentially in Playwright and CDP modes. Both perform real provider mutations and may incur usage cost.
+
+Browser-runtime and provider-surface acceptance tests are explicit local gates and do not run in CI:
+
+```bash
+npm run test:e2e:browser-runtime
+npm run test:e2e:browser-surfaces
+npm run test:e2e:system-surfaces
+npm run test:e2e:managed-surfaces
+npm run test:e2e:cloak-surfaces
+```
+
+On a machine intentionally prepared without a supported system browser, run `npm run test:e2e:browser-runtime -- --expected-auto managed-chromium` to require proof of the lazy managed fallback. The default command requires `auto` to resolve a system browser. Run both commands on each targeted Windows x64 CPU class; npm forwards these arguments identically from `cmd.exe`, PowerShell, and POSIX shells.
+
+The browser surface gate runs the same real headed, keychain-neutral test profile against system auto-selection, managed Chrome for Testing, and Cloak. Each case always visits every registered provider plus Google Search over the real network before aggregating failures, fails on a detected anti-bot challenge, and reports only public location, title, response status, and structured challenge outcomes. It does not authenticate, submit prompts, read browser storage, capture screenshots, or replace the authenticated built-CLI provider release gate. The three selection-specific commands run only system, managed, or Cloak respectively.
diff --git a/COMMANDS.zh-CN.md b/COMMANDS.zh-CN.md
new file mode 100644
index 0000000..f7a6854
--- /dev/null
+++ b/COMMANDS.zh-CN.md
@@ -0,0 +1,759 @@
+[中文](COMMANDS.zh-CN.md) | [English](COMMANDS.md)
+
+# Tokenless CLI 命令参考
+
+本文档是 `tokenless` 命令行接口的公开命令大全。内容将日常工作流与底层控制分开，并明确标注哪些命令会打开 provider 页面、修改本地状态，或者只读取缓存。
+
+## 命令总览
+
+| 命令 | 用途 | 是否访问 provider |
+| --- | --- | --- |
+| `tokenless help` | 显示内置命令摘要。 | 否 |
+| `tokenless --version` | 输出当前安装的 CLI 版本。 | 否 |
+| `tokenless install` | 验证打包的本地 runtime、所选浏览器和 daemon。 | 否 |
+| `tokenless setup` | 配置 skills、浏览器、profiles、daemon，并执行一次 provider 登录检查。 | 是 |
+| `tokenless dashboard` | 打开已认证的本地 Web 控制台，或生成一次性 URL。 | 否 |
+| `tokenless doctor` | 只读检查本地配置和 runtime 健康状态，不刷新 provider。 | 否 |
+| `tokenless config` | 读取或更新 Tokenless 持久化配置。 | 否 |
+| `tokenless upgrade` | 升级全局 CLI、skills、本地 runtime，并运行 doctor。 | 否 |
+| `tokenless profiles discover` | 读取已知 Chromium profile 的安全目录/版本元数据，并按当前平台 Cloak pin 分类。 | 否 |
+| `tokenless profiles add` | 创建 clean managed browser profile。 | 否 |
+| `tokenless profiles list` | 列出 profiles 及其最后保存的 provider 检查结果。 | 否 |
+| `tokenless profiles status` | 实时检查一家 provider，并把结果保存到 profile registry。 | 是 |
+| `tokenless profiles open` | 以 headed browser 打开 managed profile，可选择是否导航到 provider。 | 可选 |
+| `tokenless profiles set-default` | 设置默认 managed profile。 | 否 |
+| `tokenless profiles reset` | 旧版兼容命令；profile copy 已禁用。 | 否 |
+| `tokenless profiles clear` | 作为人工维护操作删除一个或全部 managed profiles。 | 否 |
+| `tokenless profiles remove` | 通过显式确认删除一个 managed profile。 | 否 |
+| `tokenless capabilities list` | 列出 canonical task capabilities 和已有证据闭环的 provider routes。 | 否 |
+| `tokenless limits inspect` | 根据 packaged catalog 和本地 job 历史查看下一次 prompt 的 provider/profile 容量估算。 | 否 |
+| `tokenless run` | 通过可见 provider session 发送 prompt 和可选文件。 | 是 |
+| `tokenless replay` | 为一个 agent recipient 报告此前未见过的 daemon outcome 摘要。 | 否 |
+| `tokenless state` | 查询 daemon 中持久化的 job 状态。 | 否 |
+| `tokenless resume` | 使用 headed browser 恢复等待用户操作的 job。 | 是 |
+| `tokenless cancel` | 取消 daemon job，并确认其已进入 canceled 状态。 | 否 |
+| `tokenless provider-status` | 实时执行 provider 认证检查。 | 是 |
+| `tokenless provider-controls` | 检查可见的 model 和 effort 控件。 | 是 |
+| `tokenless provider-configure` | 选择精确的可见 model 或 effort label。 | 是 |
+| `tokenless provider-action` | 执行一个底层可见 provider action。 | 是 |
+| `tokenless chatgpt-controls` | 检查 ChatGPT 的 model 和 effort 控件。 | 是 |
+| `tokenless chatgpt-configure` | 配置 ChatGPT 专用的可见控件。 | 是 |
+| `tokenless snapshot-dom` | 捕获并保存经过清理的 provider DOM snapshot。 | 是 |
+| `tokenless daemon stop` | 优雅停止兼容的本地 daemon。 | 否 |
+| `tokenless prompt` | 构建 shareable Tokenless prompt，但不提交。 | 否 |
+
+## 通用约定
+
+### Provider 可选值
+
+Provider 可选值为：
+
+```text
+chatgpt
+claude
+gemini
+grok
+qwen
+deepseek
+perplexity
+zai
+doubao
+```
+
+ChatGPT、Claude、Gemini 和 Grok 是 supported providers。Qwen / 千问、DeepSeek、Perplexity、Z.ai / GLM 和 Doubao / 豆包目前为 experimental：只公开已有证据支撑的 routes 与 controls；尚未证明的 continuation 和可选 capability 保持 unavailable 或 unknown。
+
+Runtime browser 可选值为 `auto`、`chrome`、`chrome-for-testing`、`chromium`、`edge`、`arc`、`brave`、`managed-chromium` 和 `cloak`。`auto` 优先使用已安装的 system browser，仅在没有可用项时使用锁定的 managed fallback；`cloak` 必须显式选择。Tokenless 新建的 profile 默认是 clean 且绑定 runtime。也可以在提供 `--consent-local-profile-copy` 后复制一个明确选定的本机 Chromium profile；Tokenless 会把其中内容作为 opaque 本地文件树处理。
+
+### 短选项
+
+短选项区分大小写：
+
+- `-P <slug>` 是 `--profile <slug>` 的短形式。
+- `-p <provider>` 是 `--provider <provider>` 的短形式。
+- Setup 中的 `-f` 是 `--fresh` 的短形式。
+- `-V` 是 `--version` 的短形式。
+
+### 常用执行选项
+
+以下选项会在命令需要对应 runtime 行为时使用：
+
+| 选项 | 含义 |
+| --- | --- |
+| `-h`, `--help` | 显示所选命令或子命令的用法。 |
+| `--json` | 将最终结果输出为结构化 JSON。除非使用 `--quiet`，实时进度仍写入 stderr。 |
+| `--quiet` | 禁止输出实时状态事件。 |
+| `--home <path>` | 使用非默认的 Tokenless 状态目录。 |
+| `--daemon-url <url>` | 设置首选 loopback daemon URL。若其端口被占用，Tokenless 可顺延到下一个空闲端口，并把实际 endpoint 记录到 SQLite。 |
+| `--agent-kind <kind>` | 将 job 或 replay drain 定向到显式 agent kind；必须与 `--agent-session-id` 同时使用。 |
+| `--agent-session-id <id>` | 将 job 或 replay drain 定向到显式 agent session；必须与 `--agent-kind` 同时使用。 |
+| `--browser-visibility <auto\|headed\|headless>` | 选择浏览器可见性策略。 |
+| `--timeout-ms <ms>` | 覆盖命令或 job 的等待时间。 |
+| `--daemon-start-timeout-ms <ms>` | 覆盖 daemon 启动等待时间。 |
+| `--runner-heartbeat-timeout-ms <ms>` | 为兼容保留；embedded Playwright runtime 会忽略它。 |
+| `--cancel-timeout-ms <ms>` | 覆盖取消确认等待时间。 |
+| `--target-url <url>` | 从所选 provider 域名下允许的 URL 开始执行。 |
+
+并非所有通用选项都适用于所有命令。下面各命令章节只列出对应工作流中有意义的选项。
+
+## 安装、初始化与维护
+
+### `tokenless help`
+
+输出精简的内置用法，以及本命令参考文档的链接。
+
+```bash
+tokenless help
+tokenless run --help
+tokenless profiles status --help
+```
+
+在任意命令或子命令后使用 `-h` 或 `--help`，可以在执行工作前打印其接受的选项。
+
+### `tokenless --version`
+
+输出当前安装的 package 版本。
+
+```bash
+tokenless --version
+tokenless -V
+```
+
+### `tokenless install`
+
+解析或安装所选的精确 browser runtime，保存 runtime preference，upsert 所需的全局 Tokenless agent skills，验证打包的 TypeScript daemon runtime，并确保本地 daemon 与已安装 CLI 版本一致。
+
+```bash
+tokenless install --browser auto --json
+tokenless install --browser cloak --json
+tokenless install --browsers chrome,brave --json
+```
+
+主要选项：
+
+- `--browser <browser>` 选择一个 browser preference。Managed selection 只会在 install 或 setup 期间下载。
+- `--browsers <list>` 验证逗号分隔的浏览器列表。
+- `--repair-browser` 显式替换所选 managed Chromium 或 Cloak cache；只有新下载的 replacement 通过全部校验后才会替换，repair 失败时会恢复原 cache。
+- `--daemon-url`、`--daemon-start-timeout-ms`、`--home` 和 `--json` 控制本地 runtime。
+
+该命令不会配置 managed profile，也不会检查 provider 登录状态。完成后仍需运行 `tokenless setup`。
+
+### `tokenless setup`
+
+执行完整 onboarding：发现 system 与 cached runtimes，解析或安装精确的所选 browser，创建或选择 runtime-compatible managed profile，保存已验证的 selection，upsert 全局 Tokenless agent skills，将 daemon 对齐已安装 CLI 版本，并对所有 enabled providers 各执行一次实时登录检查。npm postinstall、daemon startup 和普通 job execution 都不会下载 browser。如果尚未配置语言，setup 会检测系统 locale：中文 locale 选择 `zh-CN`，其他情况选择 `en`，并将结果写入 config。
+
+交互式 setup：
+
+```bash
+tokenless setup
+```
+
+非交互创建或复用 clean profile：
+
+```bash
+tokenless setup --profile default --fresh --json
+tokenless setup --anti-detect --profile cloak-default --fresh --json
+tokenless setup --browser managed-chromium --profile managed-default --fresh --json
+```
+
+主要选项：
+
+- `--profile <slug>` 选择或命名 managed profile。
+- `--anti-detect` 显式选择 catalog 锁定的 CloakBrowser runtime，并在非交互 setup 中确认使用 clean 且绑定 Cloak 的 profile。显式 `--browser cloak` 具有相同确认语义；仅有已保存的 Cloak preference 会在下载前失败。
+- `--provider-whitelist <list>` 在非交互 setup 中设置该 profile 的 provider membership。
+- `--no-open` 完成 setup，但不打开控制台。
+- `--browser <browser>` 选择 `auto`、一个精确 system browser、`managed-chromium` 或 `cloak`。
+- `--no-browser-download` 在缺少 managed runtime 时直接失败，而不是下载。
+- `--repair-browser` 显式重新安装所选 `managed-chromium` 或 `cloak` runtime；不能与 `--no-browser-download` 同时使用。
+- `--fresh` 或 `-f` 创建 clean managed profile。
+- `--import-browser-profile <key> --consent-local-profile-copy` 把一个明确选定的本机 Chromium profile 复制进 managed profile，并且不解析认证值。
+- `--defaults` 选择非交互默认值。
+- `--label <name>` 设置 profile display label。
+- `--set-default` 将所选 profile 设为默认。
+
+`auto` 是首次运行的默认值，会优先使用已安装的 Chrome、Brave、Edge、Arc、Chromium 或 Chrome for Testing executable。交互式 setup 只询问是否使用 Anti-Detect；拒绝后不会再打开单独的 browser-runtime 选择器。普通模式依次遵循显式 `--browser`、已保存的具体偏好和确定性的自动发现。Setup 会把结果解析为具体的 `browser`，并把验证过的 `browserExecutablePath` 一起保存到 `config.json`。后续启动会先验证这条缓存；仅当缓存缺失或已经不可运行时，才扫描标准安装路径，fallback 成功后还会刷新缓存。没有支持的 system browser 时，setup 才会把锁定的 Chrome for Testing 145 artifact 下载到 `$TOKENLESS_HOME/browser/runtimes`。显式选择但找不到的 system browser 会失败，并给出用于手动设置路径的准确 config 命令和 dashboard 字段。Cloak 仅在用户显式选择后从官方平台 release pin 下载，永远不会被打包进 Tokenless。首批目标平台是 Apple Silicon Mac 与 Windows x64（Intel 和 AMD）；Windows 在真机 gate 通过前仍属于 prerelease。
+
+只有明确选择的 system browser 才允许 `browserExecutablePath` 指向 `TOKENLESS_HOME` 外部。`managed-chromium` 与 `cloak` 的路径由 catalog 锁定的 runtime 决定，并位于 `$TOKENLESS_HOME/browser/runtimes`；config 中的任意路径不能替换或绕过该 managed runtime。
+
+Anti-Detect 问题本身会说明：接受后，如有需要，Tokenless 将在 `TOKENLESS_HOME` 下下载并安装经过验证、按平台固定版本的 CloakBrowser；后面不再询问是否继续安装。选择 Anti-Detect 后，setup 不会为了选择 runtime 而扫描 system-browser executable。它会链接到 CloakBrowser 官方项目，显示当前平台精确的 artifact 和 Chromium 版本，并扫描已知 Chrome、Brave、Edge、Arc、Chromium 与 Chrome for Testing profile 目录。发现阶段只读取目录 key 和 `Last Version`，并按完整四段版本做精确匹配。有兼容 profile 时，setup 只显示一次选择，其中包含 `Start clean` 和兼容 profile 来源；选择某个 profile 本身就构成对 opaque 本地复制的明确授权，不再另外询问是否 import 或是否同意 copy。没有匹配项时会跳过来源选择并使用 clean profile。用户显式要求导入版本不匹配或未知的 profile 时，会在下载前明确失败，而不是静默忽略。Installer 随后依次下载、校验、解包、检查版本并 smoke-launch Cloak；setup 会立即持久化 `browser: "cloak"` 及其 managed `browserExecutablePath`。复制过程保持 opaque：Tokenless 不会解析 `Local State`、cookies、browser storage 或认证值。非交互 import 因为没有发生可见的 profile 来源选择，仍要求 `--consent-local-profile-copy`。
+
+Managed profile 会记录 runtime binding。Setup 不会用不同 runtime family 或低于 profile 创建版本的 browser 打开它。切换 runtime family 通常会创建 clean profile；显式 import 可以从选定的本机 Chromium profile 填充新建且绑定 runtime 的 profile。之后由 managed profile 自己跨 job 保留 browser-managed session。
+
+交互式 `setup` 会询问哪些 provider 属于当前 profile。非交互 setup 会依次使用 `--provider-whitelist`、已有 profile 范围或持久化的默认 whitelist。Guest access、signed-out 页面、unknown state 与 sign-in-required 页面都会作为 observation 记录，而不是 setup failure；只有技术性检查失败才会让 setup 失败。每次 setup 完成后，Tokenless 都会为每个 enabled provider 保留一个 headed 审核 tab，让用户亲自检查登录状态。除非 `--json`、`--defaults` 或 `--no-open` 关闭交互 handoff，setup 还会打开本地控制台。
+
+默认 `providerWhitelist` 包含除 Gemini 外的所有非 `disabled` provider。Gemini 仍然可用，可通过 `--provider-whitelist` 或控制台显式加入。
+
+### `tokenless dashboard`
+
+启动或发现同一 Tokenless home 的 daemon，签发一个 60 秒内有效且只能使用一次的 bootstrap ticket，并在所选 managed profile 中打开一个保留的控制台标签页：
+
+```bash
+tokenless dashboard
+tokenless dashboard --profile work
+tokenless dashboard --profile work --no-open --json
+```
+
+`--no-open` 不启动浏览器，只返回一次性 loopback bootstrap URL。URL 使用后会立刻跳转到 `/ui/`，且不能重复使用。浏览器 session 有有效期，保存在 `HttpOnly`、`SameSite=Strict` cookie 中；所有 mutation 还会校验 exact Origin 和 CSRF。控制台不会收到 daemon bearer token、provider cookies、browser storage、Keychain 数据、raw DOM、claim token、checkpoint 或私有文件路径。
+
+控制台包含 Overview、Profiles、Providers、Capabilities、Jobs 和 System/Diagnostics。Provider membership、visibility、role label，以及不带凭据的 HTTP/HTTPS/SOCKS5 proxy 都按 profile 配置。CLI 恢复入口仍然完整保留：
+
+```bash
+tokenless config --profile work --provider-whitelist chatgpt,claude --browser-visibility headed --json
+tokenless config --profile work --proxy-server socks5://127.0.0.1:1080 --proxy-bypass localhost --json
+tokenless profiles open --profile work --json
+tokenless state --profile work --json
+```
+
+### `tokenless doctor`
+
+只读检查 Node.js、已安装 skills、打包 runtime、daemon identity/version、embedded Playwright runtime、browser preference、解析出的 runtime family 与精确 executable version、checksum 状态、默认 profile/runtime compatibility、配置，以及缓存的 provider readiness。
+
+```bash
+tokenless doctor --json
+```
+
+`doctor` 不会打开 provider 页面、刷新认证状态、启动 daemon 或修复状态。`checks.managedProfile.ok` 表示 registry/profile 本身是否健康，`checks.profileRuntime.ok` 则独立表示该 profile 是否具有可解析且兼容的 browser binding。Provider readiness 来自 profile 中最后保存的检查结果。`checks.providerReadiness.ok` 表示 configured providers 是否已有 recorded observations；`usableProviders` 列出缓存中可用于隐式路由的 providers。因为 daemon 按需运行，正常停止的 daemon 和 embedded browser runtime 会被报告为健康的 stopped 状态，而不是安装损坏。
+
+主要选项：`--browser`、`--daemon-url`、`--home` 和 `--json`。
+
+### `tokenless config`
+
+不传配置选项时，读取持久化配置：
+
+```bash
+tokenless config --json
+```
+
+传入选项时，更新一个或多个持久化值：
+
+```bash
+tokenless config \
+  --language zh-CN \
+  --provider-whitelist chatgpt,claude,gemini,grok,qwen \
+  --browser chrome \
+  --browser-executable-path "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" \
+  --browser-visibility auto \
+  --json
+```
+
+可配置内容：
+
+- `--language <en|zh-CN>`
+- `--provider-whitelist <list>`
+- `--browser <browser>`
+- `--browser-executable-path <绝对路径>`，用于明确选择的 system browser
+- `--clear-browser-executable-path`，让下次解析重新执行 discovery
+- `--browser-visibility <auto|headed|headless>`
+- `--proxy-server <http|https|socks5-url>`，可搭配 `--proxy-bypass <逗号分隔列表>`
+- `--clear-proxy`
+- `--daemon-url <loopback-url>`
+- `--home <path>`
+
+增加 `--profile <slug>` 后，`--provider-whitelist`、`--browser-visibility` 和不带凭据的 proxy 设置会只作用于一个 managed profile。Proxy 选项必须搭配 `--profile`；`--clear-proxy` 会移除该 profile 的 endpoint。全局 `providerWhitelist` 会继续作为旧 caller 的兼容 union；路由会读取当前 profile 的 membership。
+
+持久化 JSON key 现在是 `providerWhitelist`。Tokenless 仍会读取旧 `preferredProviders` key，并在下一次配置更新时将其改写为 `providerWhitelist`。迁移期间，未写入文档的旧 `--preferred-providers` flag 仍作为 alias 接受。
+
+完整 config shape 如下：
+
+```json
+{
+  "protocol": "tokenless.config.v1",
+  "updatedAt": "2026-08-02T02:09:40.254Z",
+  "providerWhitelist": [
+    "chatgpt",
+    "claude",
+    "grok",
+    "qwen",
+    "deepseek",
+    "perplexity",
+    "zai",
+    "doubao"
+  ],
+  "profilePreferences": {},
+  "browser": "chrome",
+  "browserExecutablePath": "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+  "browserConnectionMode": "playwright",
+  "browserVisibility": "auto",
+  "daemonUrl": null,
+  "language": "en"
+}
+```
+
+`browserExecutablePath` 是经过验证的缓存，并不是不可变 override：Tokenless 会执行浏览器的 version command 进行验证；验证失败后会 fallback 到标准路径 discovery，成功时重新写入缓存。如果两种方式都失败，可以使用上面的 CLI flag，或在 dashboard 的 **System → Browser executable path** 中粘贴绝对路径。Dashboard 只会暴露是否已经配置路径，不会把私有路径传回浏览器 JavaScript。
+
+面向用户的命令文案和 provider 默认回复语言都会遵循 `language`；prompt 中明确指定的语言优先。命令名、flags、JSON keys、error codes、status values 和其他 integration terms 保持稳定。`daemonUrl` 是首选启动 endpoint，而不是可变 runtime 状态。首选端口繁忙时 Tokenless 不会改写它；daemon 会把实际绑定 endpoint 记录到 SQLite runtime-state row。
+
+Config 文件还接受实验性的 `browserConnectionMode`，值为 `playwright` 或 `cdp`；省略时默认使用 `playwright`。该设置刻意不提供 CLI flag。仅在 capability evaluation 时编辑这个 JSON 值，之后重启 daemon。CDP 不会改变所选 profile、browser runtime、visibility policy 或 provider mappings。
+
+### `tokenless upgrade`
+
+执行受支持的 upgrade pipeline：更新全局 npm CLI、解析并验证已安装 CLI、调用新 CLI 的共享 maintenance 模块来 upsert 全局 agent skills 并协调匹配版本的 daemon，然后运行 doctor。
+
+```bash
+tokenless upgrade
+tokenless upgrade --json
+```
+
+接受的选项为 `--json`、`--home`、`--daemon-url`、`--browser`、`--browsers` 和 `--daemon-start-timeout-ms`。
+
+### `tokenless daemon stop`
+
+验证 daemon identity 后，优雅停止兼容的 daemon。
+
+```bash
+tokenless daemon stop --json
+```
+
+选项：`--home`、`--daemon-url`、`--timeout-ms` 和 `--json`。
+
+该命令会从 SQLite 发现实际 endpoint，也不会因为某个未验证或不兼容的进程占用了首选端口，就直接杀掉该进程。
+
+## Managed Profiles
+
+一个 managed profile 代表一个持久化的本地 browser identity。一个 profile 可以同时保存所有 enabled providers 的 sessions。
+
+### `tokenless profiles discover`
+
+只读取 Chrome、Brave、Edge、Arc、Chromium 或 Chrome for Testing 的安全 profile 目录/版本元数据，不复制或修改 browser data。每个 profile 都会根据当前平台 Cloak pin 返回 `aligned`、`not_aligned` 或 `unknown`。Discovery 不代表 profile 可以被导入，也不会解析 `Local State`。
+
+```bash
+tokenless profiles discover --browser all --json
+tokenless profiles discover --browser edge --browser-user-data-dir /path/to/user-data --json
+```
+
+### `tokenless profiles add`
+
+创建 clean managed profile，或在明确同意后复制选定的本机 Chromium profile：
+
+```bash
+tokenless profiles add -P work --label "Work" --set-default --json
+tokenless profiles add -P cloak-work --browser cloak --import-browser-profile Default --consent-local-profile-copy --set-default --json
+```
+
+复制只发生在本机，并保持 opaque。Tokenless 会复制文件系统条目，但不会检查或报告 cookies、storage、密码、tokens 或 Keychain 数据。
+
+### `tokenless profiles list`
+
+读取 profile registry，并返回全部 managed profiles。
+
+```bash
+tokenless profiles list
+tokenless profiles list --json
+```
+
+该命令快速、只读且没有浏览器副作用。Provider 字段是缓存的 observation，需要根据各 provider 的 `checkedAt` 判断新旧。
+
+### `tokenless profiles status`
+
+对一家 provider 执行实时认证检查，然后将 `auth`、可见 username、可见 subscription，以及新的 `checkedAt` 写入所选 profile。
+
+```bash
+tokenless profiles status -P work -p chatgpt --json
+```
+
+若省略参数，profile 会解析为已配置的默认 profile；provider 则依次 fallback 到环境配置或 ChatGPT。
+
+### `tokenless profiles open`
+
+以 headed browser 打开所选 managed profile。不传 `--provider` 时，Tokenless 不会解析 `TOKENLESS_PROVIDER`，不会选择 ChatGPT 或任何其他 provider，也不会执行 navigation；Chromium 会显示该 profile 自然的初始页、默认页或恢复页。传 `--provider` 时，Tokenless 会打开该 provider 并验证 navigation。
+
+```bash
+tokenless profiles open -P work --json
+tokenless profiles open -P work -p claude --json
+```
+
+无 provider 形式适合用户维护浏览器、切换账号或检查 managed profile。provider 形式适合处理登录、CAPTCHA、MFA、consent 或 provider 相关账号切换。它不能替代 `profiles status`；操作完成后应再次运行 status 命令，保存最新 observation。
+
+### `tokenless profiles set-default`
+
+将一个已注册 profile 设为默认。
+
+```bash
+tokenless profiles set-default -P work --json
+```
+
+### `tokenless profiles reset`
+
+使用记录的本机来源重新进行一次 opaque copy，并替换已导入的 managed profile。每次都必须再次明确同意。
+
+```bash
+tokenless profiles reset -P work --consent-local-profile-copy --json
+```
+
+### `tokenless profiles clear`
+
+让 embedded Playwright runtime quiesce，并删除一个或全部 managed profiles：
+
+```bash
+tokenless profiles clear -P work
+tokenless profiles clear --all
+```
+
+必须且只能提供 `--profile` 或 `--all` 其中一个。该人工维护命令不接受 `--json`。
+
+### `tokenless profiles remove`
+
+通过结构化、显式确认的方式删除一个 managed profile：
+
+```bash
+tokenless profiles remove -P work --confirm-delete --json
+```
+
+必须提供 `--confirm-delete`。Remove 或 clear managed profile 只会删除 Tokenless 管理的 browser data，不会修改任何 system-browser profile。
+
+## 执行任务与管理 Jobs
+
+### `tokenless capabilities list`
+
+返回带版本的 canonical task-capability catalog，不会打开浏览器：
+
+Capability 语义、provider mapping、support state 与扩展流程见 [Capability Matrix](docs/capability-matrix.zh-CN.md)。
+
+```bash
+tokenless capabilities list --json
+```
+
+每个条目描述 caller outcome、parameter schema、lifecycle、side effects、required evidence、output kinds、stability 和已声明的 provider routes。`routeable: true` 表示至少一个已签入的 provider strategy 具有完整实现和真实 provider E2E 证据。Candidate 条目仍可通过 catalog 发现，但会标记为 `routeable: false`，不能用于 run。
+
+`model.choice`、`effort.choice`、`qwen.mode`、`doubao.mode` 和 `doubao.skill` 等 provider control 不会出现在这里；它们保留为 provider adapter 细节，而不是 canonical caller outcome。
+
+### `tokenless limits inspect`
+
+根据 profile 中已观察到的订阅、packaged provider 知识和不可变的本地提交历史，估算下一次 prompt：
+
+```sh
+tokenless limits inspect --profile default --provider chatgpt --json
+```
+
+结果会报告匹配的 catalog plan 和 rules、本地 usage、公开与生效 allowance、估算剩余额度、cadence、burst allowance、decision 和 `eligibleAt`。`unknown` 表示 Tokenless 没有可执行的官方数值，因此会放行；它不表示 provider 容量无限。该命令只读且只访问本地状态，不会打开 provider 网站或提交 prompt。
+
+### `tokenless run`
+
+构建 managed Playwright job，通过所选的可见 provider session 发送 prompt，并通常等待关联 response。
+
+```bash
+tokenless run \
+  -P default \
+  -p chatgpt \
+  --prompt "Review this proposal." \
+  --json
+```
+
+Provider 选择：
+
+- 显式 `--provider <provider>` 或 `TOKENLESS_PROVIDER` 会保持精确匹配，不会因为缓存可用性而被替换。
+- `--capability <capability>` 可以重复使用，用于请求 canonical caller outcome，而不是 provider 专属控件。
+- Tokenless 会合并显式 capabilities 与结构化推导：普通 `submit_and_read` run 要求 `conversation.chat`，`--attach-file` 要求 `file.upload`，并在适用时增加 `image.input`、`audio.input` 或 `video.input`；`--workspace-mode native` 要求 `workspace.native`。
+- 未显式指定 provider 时，配置的 provider list 会过滤 membership。Tokenless 会再筛出满足完整 implication-expanded requirement set 的 providers，并按照 fresh cached eligibility 和 evidence maturity（`supported` 优先于 `experimental`）对 routes 排序；配置 list 的 position 仅作为最终 tie-breaker，不能覆盖这些更强的信号。过期但曾可用的 observation 会保持为 `unchecked`，直到 runner 执行实时只读 preflight。
+- 显式 provider 无法满足完整 requirement set 时，会在提交 daemon job 前失败，不会静默切换。
+- Unknown 与 sign-in-required observations 不可用于隐式路由。如果没有可用 cached provider，CLI 会在创建 daemon job 前返回带 provider observation context 的 `provider_unavailable`。
+- 已知 capability 如果没有完整 route，会在 browser mutation 前返回 `task_capability_route_unavailable`。`--capability` 当前只支持正常的 `submit_and_read` action。
+- 成功提交会返回并持久化 `capabilityRoute`，其中包含规范化 requirements、所选 strategies、support level、evidence identifiers 和 runtime eligibility；`tokenless state` 会返回同一 route。
+- 隐式 `submit_and_read` run 可以持久化 automatic fallback plan。每次 attempt 都会在 mutation 前只读复核已知本地 provider capacity、可见 session 和 capability-specific UI，不发送 probe prompt。已分类的 safe pre-submit capacity、登录、CAPTCHA、rate/plan、维护、区域、导航、稳定 surface 和 capability availability failure，只有在下一条 ranked route 满足完全相同的完整 requirements，且此前 mutation 都可重建时，才会让同一个 job 重新排队。精确或已映射 continuation、显式 provider、provider-specific controls、不可重建 mutation、ambiguous external state 和 post-submission failure 都绝不会自动切换。JSON state 包含排序后的 `fallback.routes`、结构化停止原因和 `providerAttempts`。
+- Job validator 会再次根据 actions、attachment MIME types 和 native workspace intent 推导 capabilities，因此 internal 或 agent caller 无法少报 fallback requirement。Routed job 携带 `tokenless.context-envelope.v1`，其中的 instructions、references、output/constraint contract、可选 upstream state 和 delivery hashes 会在每次 attempt 原样重放；JSON state 只公开脱敏后的 envelope 摘要。
+
+Prompt 输入：
+
+- 使用 `--prompt <text>` 或 `--prompt-file <path>` 其中一个。
+- `--project-root <path>` 定义 shareable file context 的安全根目录。
+- 可重复使用 `--file <path>`，将 project root 内文件的文本嵌入生成的 prompt。
+- 使用 `--context <text>` 或 `--context-file <path>` 提供额外 shareable turn context。
+- 可重复使用 `--attach-file <path>`，通过 provider 页面上传真实文件。`--file` 与 `--attach-file` 是不同操作。
+
+Provider 控件：
+
+- `--model <exact-visible-label>` 在提交前选择可见 model。
+- `--effort <exact-visible-label>` 选择可见 reasoning 或 effort。
+- `--thinking-effort <label>` 是另一种 effort 参数形式。
+- `--qwen-mode <exact-visible-label>` 选择 Qwen 专属的 composer mode。
+- `--qwen-mode-variant <exact-visible-label>` 选择该 Qwen mode 的可见 variant，并要求同时提供 `--qwen-mode`。
+- `--deepseek-mode <Instant|Expert|Vision>` 选择精确的 DeepSeek mode。
+- `--deepseek-deepthink <on|off>` 控制当前 DeepSeek mode 中的 DeepThink。
+- `--deepseek-search <on|off>` 控制 Search；该控件只在 DeepSeek Instant mode 中可用。
+- DeepSeek canonical requirements 会在 mutation 前准备所需控件：`search.web` 选择 Instant 并启用 Search，`reasoning.extended` 启用 DeepThink，`image.input` 选择 Vision。显式冲突组合会在页面变化前失败。
+- `--browser-visibility <auto|headed|headless>` 覆盖已配置的可见性策略。
+
+Identity 与 continuity：
+
+- `--task-id <id>` 提供持久化 task identity。
+- `--idempotency-key <id>` 在没有 task ID 时提供相同 identity。
+- `--project-name <name>` 和 `--chat-name <name>` 会参与推导 task identity。
+- `--workspace-mode <auto|native|conversation>` 显式请求 Workspace 处理，并要求同时提供 `--project-name`。
+- `--project-instructions <text>` 或 `--project-instructions-file <path>` 提供可选 Workspace instructions。
+- `--agent-kind <kind>` 和 `--agent-session-id <id>` 将 job 定向到一个 agent recipient。两者必须同时提供，也可通过 `TOKENLESS_AGENT_KIND` 与 `TOKENLESS_AGENT_SESSION_ID` 提供。
+
+执行控制：
+
+- `--no-wait` 提交后立即返回，不等待结果。
+- `--long-running` 使用 long-running wait budget，且不能与 `--no-wait` 同时使用。
+- `--timeout-ms`、`--cancel-timeout-ms` 和 `--daemon-start-timeout-ms` 可覆盖执行时间。`--runner-heartbeat-timeout-ms` 为兼容保留，但不再控制 standalone runner。
+- `--target-url <url>` 选择 provider 域名下允许的起始 URL。
+
+Workspace modes：
+
+- 使用 `auto` 或 `native` 的 routed `run` request 都要求 canonical `workspace.native` capability。目前没有 provider route 被公开，因此在 native Project release gate 完成前，这类 request 会在 browser mutation 之前失败。
+- Claude 与 Grok 的 lower-level adapter 已为显式真实 provider acceptance suite 实现实验性的可见原生 Project 创建/复用；仅有 implementation 不构成 router support 声明。
+- `workspace.native` 可路由后，`native` 将强制要求精确创建或复用原生 Project，绝不会降级到 conversation scope；出现重复的精确可见名称时 fail closed。
+- `conversation` 强制使用 conversation-scoped strategy；只有真实 provider capability matrix 已证明的 provider/profile 才支持跨进程恢复。
+- 原生结果会报告 `created` 或 `reused`、canonical provider resource identity、provider/profile scope 和 instruction outcome；conversation 结果会报告 `fallback`。
+- Project 和 task conversation target 会作为精确 SQLite mapping 持久化，不再通过扫描历史 job result 恢复。
+
+### `tokenless replay`
+
+原子报告尚未送达给一个显式 agent recipient 的 outcome 摘要：
+
+```bash
+tokenless replay \
+  --agent-kind codex \
+  --agent-session-id "<stable-session-id>" \
+  --json
+```
+
+该命令会按需探测或启动本地 daemon。SQLite 会在返回响应前把每个 actionable outcome revision 标为已报告，因此同一 revision 永不再次主动报告——即使本次 CLI 响应丢失。同一 job 后续进入新的 parked 或 terminal revision 时，会作为新的 outcome 再报告一次。
+
+Replay 只包含 allowlist metadata，以及 `has_result`、`has_error`、`has_blocker` 标志；不会包含原始 result、error 或 blocker 内容。需要时使用 `tokenless state --job-id "<jobId>" --json` 读取持久化的完整 job。不要仅仅因为漏掉 replay 响应就提交替代 job。
+
+主要选项：`--agent-kind`、`--agent-session-id`、`--limit`、`--daemon-url`、`--daemon-start-timeout-ms`、`--home` 和 `--json`。两个 identity 参数也可由 `TOKENLESS_AGENT_KIND` 与 `TOKENLESS_AGENT_SESSION_ID` 提供。
+
+### `tokenless state`
+
+读取 daemon 中持久化的 job 状态，不访问 provider。
+
+```bash
+tokenless state --task-id task-123 -P default --json
+tokenless state --job-id tlp_... --json
+tokenless state -P default -p chatgpt --limit 10 --json
+```
+
+必须提供 task ID、job ID 或 profile。结果会按 managed Playwright backend、所选 profile 和 provider 过滤。`--limit` 控制返回 job 数量。
+
+### `tokenless resume`
+
+当同一个 daemon job 进入 `waiting_for_user` 后，恢复该 job。
+
+```bash
+tokenless resume \
+  --job-id tlp_... \
+  --browser-visibility headed \
+  --json
+```
+
+必须提供 `--job-id` 和 `--browser-visibility headed`。Resume 会保留原始 job 与 task identity。
+
+当 provider 登录、hCaptcha、MFA 或其他可见人工验证成为必要条件时，Tokenless 会报告 `waiting_for_user`，并明确提示“需要你的协助”。请完成可见步骤，然后查询或恢复同一个 job；不要提交替代 job。
+
+### `tokenless cancel`
+
+请求取消，并且只有在 daemon 确认进入 `canceled` 状态后才算成功。
+
+```bash
+tokenless cancel --job-id tlp_... --json
+```
+
+主要选项：`--job-id`、`--cancel-timeout-ms`、`--daemon-url`、`--home` 和 `--json`。
+
+## Provider 检查与控制
+
+以下命令会实时操作可见 provider 页面。除非使用的就是 `profiles status`，否则它们不会让 `profiles list` 中的缓存结果变新。
+
+### `tokenless provider-status`
+
+实时执行 provider authentication action，并返回检查结果。
+
+```bash
+tokenless provider-status -P default -p chatgpt --json
+```
+
+如果需要实时检查并同时更新 profile registry，请使用 `tokenless profiles status`。
+
+### `tokenless provider-controls`
+
+检查 provider 中可见的 model 和 effort choices。
+
+```bash
+tokenless provider-controls -P default -p claude --json
+```
+
+### `tokenless provider-configure`
+
+选择精确的可见 model、effort label，或同时选择两者。
+
+```bash
+tokenless provider-configure \
+  -P default \
+  -p chatgpt \
+  --model "GPT-5" \
+  --effort "High" \
+  --json
+```
+
+至少需要提供一个 control。Label 必须与可见 UI label 精确匹配；managed visible jobs 不支持 model fallback list。
+
+### `tokenless chatgpt-controls`
+
+用于检查 model 与 effort controls 的 ChatGPT 专用命令。
+
+```bash
+tokenless chatgpt-controls -P default --json
+```
+
+### `tokenless chatgpt-configure`
+
+选择 ChatGPT 专用的 model 或 effort controls。也可以用 `--chat-surface chat` 显式约束使用 chat surface；其他 ChatGPT surfaces 会被拒绝。
+
+```bash
+tokenless chatgpt-configure \
+  -P default \
+  --model "GPT-5" \
+  --effort "High" \
+  --json
+```
+
+如果提供 `--provider`，其值必须是 `chatgpt`。
+
+### `tokenless provider-action`
+
+精确执行一个底层可见 action。
+
+```bash
+tokenless provider-action \
+  -P default \
+  -p chatgpt \
+  --action capability.inspect \
+  --json
+```
+
+| Action | 用途 | 必需或相关 payload 选项 |
+| --- | --- | --- |
+| `capability.inspect` | 检查可见的、由 subscription 决定的 capabilities。 | 无 |
+| `auth.status` | 检查可见 authentication 和 account state。 | 无 |
+| `model.inspect` | 列出可见 model controls。 | 无 |
+| `model.select` | 选择一个精确的可见 model。 | `--model` |
+| `effort.inspect` | 列出可见 effort controls。 | 无 |
+| `effort.select` | 选择一个精确的可见 effort。 | `--effort` 或 `--thinking-effort` |
+| `qwen.mode.inspect` | 列出 Qwen 专属的可见 composer modes。 | 无；仅限 Qwen |
+| `qwen.mode.select` | 选择一个 Qwen 专属 mode 和可选的可见 variant。 | `--qwen-mode`；`--qwen-mode-variant` 可选 |
+| `deepseek.mode.inspect` | 检查 DeepSeek Instant、Expert、Vision 及其随 mode 变化的控件。 | 无；仅限 DeepSeek |
+| `deepseek.mode.select` | 选择一个精确的 DeepSeek mode。 | `--deepseek-mode` |
+| `deepseek.deepthink.inspect` | 检查当前 DeepSeek mode 中的 DeepThink。 | 无；仅限 DeepSeek |
+| `deepseek.deepthink.select` | 启用或关闭 DeepThink。 | `--deepseek-deepthink on|off` |
+| `deepseek.search.inspect` | 检查当前 DeepSeek mode 中的 Search。 | 无；仅限 DeepSeek |
+| `deepseek.search.select` | 在 Instant mode 中启用或关闭 Search。 | `--deepseek-search on|off` |
+| `doubao.mode.inspect` | 检查快速、专家、工作任务 Turbo，以及可见受限的工作任务 Pro。 | 无；仅限 Doubao |
+| `doubao.mode.select` | 选择一个精确的 Doubao mode。 | `--doubao-mode fast|expert|work-task-turbo|work-task-pro` |
+| `doubao.skill.inspect` | 检查 Doubao Web skills 及其 canonical candidate mapping。 | 无；仅限 Doubao |
+| `doubao.skill.select` | 选择一个 Doubao skill，或恢复普通对话。 | `--doubao-skill <skill>` |
+| `file.upload` | 通过可见 file controls 上传文件。 | 一个或多个 `--attach-file` |
+| `workspace.ensure` | 确保存在原生或 conversation-scoped Workspace。 | `--project-name`；`--workspace-mode` 和 instructions 可选 |
+| `prompt.clear` | 清空可见 composer。 | 无 |
+| `prompt.input` | 将文本写入可见 composer，但不提交。 | `--prompt` 或 `--prompt-file` |
+| `prompt.submit` | 提交当前可见 composer。 | 无 |
+| `response.read` | 读取可见的关联 response。 | 无 |
+| `snapshot.sanitized` | 返回经过清理的 structural snapshot。 | 无 |
+| `navigation.check` | 验证页面位于允许的 provider origin。 | 无 |
+| `blocker.check` | 检查登录或 CAPTCHA 等可见 blocker。 | 无 |
+
+Action payload 是严格校验的：与所选 action 无关的选项会被拒绝。
+
+Doubao skill ids 为 `chat`、`document-writing`、`presentation-generation`、`image-generation`、`video-generation`、`deep-research`、`audio-podcast`、`music-generation`、`problem-solving`、`spreadsheet-generation` 与 `audio-transcription`。最后一项可以 inspect，但可见 Web UI 要求桌面版时，select 会返回 unavailable。翻译被明确排除在这个面向 coding 的 control surface 之外。
+
+`workspace.ensure` 在省略 mode 时默认使用 `--workspace-mode auto`。
+
+### `tokenless snapshot-dom`
+
+通过 daemon 捕获经过清理的 provider structural snapshot，并将 metadata 和 snapshot files 保存到 Tokenless home directory。
+
+```bash
+tokenless snapshot-dom -P default -p chatgpt --json
+```
+
+如果不需要持久化，可使用 `provider-action --action snapshot.sanitized`。
+
+## Prompt 构建
+
+### `tokenless prompt`
+
+构建 shareable `# Tokenless Request` 文档，但不打开浏览器，也不提交 provider job。
+
+```bash
+tokenless prompt \
+  --project-root /path/to/project \
+  --file src/example.ts \
+  --context "Only the selected files are shareable." \
+  --prompt "Review this implementation." \
+  --output /tmp/tokenless-request.md
+```
+
+选项：
+
+- `--prompt` 或 `--prompt-file` 提供用户请求。
+- `--project-root` 定义允许读取文件的边界。
+- 重复使用 `--file` 可包含多个文件文本。
+- `--context` 或 `--context-file` 提供 shareable turn context。
+- `--output` 将编译后的 prompt 写入文件；否则输出到 stdout。
+
+当第一个参数本身是选项时，也可以省略 `prompt` 这个命令词；但在文档和脚本中，显式形式更清晰。
+
+## 兼容别名
+
+以下 aliases 为兼容性而保留。新脚本应使用 canonical form。
+
+| Alias | Canonical form |
+| --- | --- |
+| `tokenless status` | `tokenless state` |
+| `tokenless provider-auth-status` | `tokenless provider-status` |
+| `tokenless inspect-provider-controls` | `tokenless provider-controls` |
+| `tokenless inspect-chatgpt-controls` | `tokenless chatgpt-controls` |
+| `--import-chrome-profile` | `--import-browser-profile` |
+| `--chrome-user-data-dir` | `--browser-user-data-dir` |
+| `--turn-context` | `--context` |
+| `--turn-context-file` | `--context-file` |
+| `--conversation-key` | `--idempotency-key` |
+| `--clean-profile` | `--fresh` |
+
+## 状态与副作用总结
+
+三个名称相近的 status 工作流有不同的持久化行为：
+
+```text
+profiles list
+    只读取已保存的 profile registry
+
+profiles status
+    访问一家 provider，检查 auth/account controls，
+    并保存 auth、username、subscription 和 checkedAt
+
+provider-status
+    访问一家 provider 并返回实时 auth 结果，
+    但不是用于刷新 profile registry 的工作流
+```
+
+可能打开或操作 provider 页面的命令包括：`setup`、`profiles status`、`profiles open`、`run`、`resume`、所有 provider inspection/configuration/action 命令，以及 `snapshot-dom`。
+
+## 手动真实浏览器验收
+
+已认证 provider capability harness 会为每个显式选择的 production browser 保留一个独立的持久化 profile。默认 test-only home 是 `<TOKENLESS_HOME>/e2e/live-provider`；也可显式使用 `TOKENLESS_LIVE_PROVIDER_TEST_HOME` 或 `--home`。Test home 必须不同于普通 Tokenless home，并且位于所有 repository/worktree 之外。例如，browser selection `cloak` 会解析为稳定 slug `live-provider-cloak`；production registry `<test-home>/browser/profiles.json` 再把该 slug 映射到 opaque 目录 `<test-home>/browser/profiles/<uuid>`。在启动任何 provider automation 前，harness 会验证该目录、私有权限、lifecycle、executable 和 runtime binding。它拒绝 `auto`，因为 automatic discovery 可能在不同运行中解析到不同 executable；不同 browser runtime 也绝不会共用一个 profile。
+
+先准备并手动登录一个 browser-specific profile，然后再运行 provider gates：
+
+```bash
+npm run test:e2e:prepare -- --browser cloak
+# 在每个 provider tab 中手动登录，然后执行 harness 打印的 daemon-stop 命令。
+npm run test:e2e -- --browser cloak
+npm run test:e2e:connection-matrix -- --browser cloak
+```
+
+已认证 profile 支持 `chrome`、`brave`、`edge`、`arc`、`chromium`、`chrome-for-testing`、`managed-chromium` 和 `cloak`。`prepare` 会安装或解析精确 browser，把 maintenance skill 输出限制在 test-only home 内，并且只创建或复用它的确定性 profile slug。登录页面名单来自该 profile 的有效 provider whitelist：存在 `profilePreferences[slug].enabledProviders` 时使用它，否则使用 top-level `providerWhitelist`。Preparation 保留配置顺序，绝不会改写这两个名单。它会通过一次并发的 Chromium background-tab batch 请求名单中的每个 provider-home tab，然后立即退出，不等待 page load、登录或 Playwright target observation。Detached daemon 会继续持有 browser，Chromium 则照常把状态持久化到 dedicated profile。Browser 首次启动时仍可能取得一次焦点，但不会再按顺序把每个 provider tab 带到前台。Preparation 不读取 capability matrix，不运行 provider jobs，也不会调用 `setup`、`profiles status`、自动登录或检查认证数据。可用 `--no-open` 只验证 preparation，不导航 provider，也不进行人工 browser handoff。`run` 才会使用 live capability matrix，在 Playwright mode 下执行其中声明的 provider journeys；`connection-matrix` 会用同一个 selected profile 依次运行 Playwright 与 CDP mode。两者都会真实修改 provider 侧状态，并可能产生使用费用。
+
+Browser runtime 与 provider surface 验收是显式本地 gate，不会在 CI 中运行：
+
+```bash
+npm run test:e2e:browser-runtime
+npm run test:e2e:browser-surfaces
+npm run test:e2e:system-surfaces
+npm run test:e2e:managed-surfaces
+npm run test:e2e:cloak-surfaces
+```
+
+在特意准备为“没有受支持 system browser”的机器上，运行 `npm run test:e2e:browser-runtime -- --expected-auto managed-chromium`，强制证明 lazy managed fallback。默认命令则要求 `auto` 解析到 system browser。每一种目标 Windows x64 CPU 类型都要分别运行这两条命令；npm 从 `cmd.exe`、PowerShell 和 POSIX shell 转发这些参数时行为一致。
+
+Browser surface gate 会用同一套真实 headed、keychain-neutral test profile 分别测试 system auto-selection、managed Chrome for Testing 和 Cloak。每个 case 都会先通过真实网络访问全部已注册 providers 和 Google Search，再汇总所有失败；检测到 anti-bot challenge 时会失败，并且只报告公开 location、title、response status 与结构化 challenge 结果。它不会登录、提交 prompt、读取 browser storage、截屏，也不能替代使用已认证 profile 的 built-CLI provider release gate。三个 selection-specific 命令分别只运行 system、managed 或 Cloak case。
diff --git a/PRIVACY.md b/PRIVACY.md
index 0af7d2d..d302d5f 100644
--- a/PRIVACY.md
+++ b/PRIVACY.md
@@ -2,12 +2,12 @@
 
 Effective date: 2026-07-20
 
-Tokenless runs locally. It operates visible ChatGPT, Claude, Gemini, and Grok pages through managed Playwright browser profiles and an authenticated local daemon.
+Tokenless runs locally. It operates visible ChatGPT, Claude, Gemini, Grok, and experimental Qwen pages through managed Playwright browser profiles and an authenticated local daemon.
 
 ## Data handling
 
 - Managed browser profiles, provider sign-in state, configuration, job state, logs, and snapshots remain on the user's device.
-- With explicit consent, setup can copy supported ChatGPT, Claude, or Grok sign-in records from an existing Chrome or Brave profile into a separate Tokenless-managed profile. Gemini and shared Google sign-in data are not imported. Passwords, history, bookmarks, payment data, sync data, unrelated site data, and caches are excluded.
+- With explicit consent, setup can copy selected ChatGPT, Claude, Grok, or experimental Qwen sign-in records and limited Chromium compatibility state from an existing Chrome or Brave profile into a separate Tokenless-managed profile. Compatibility state includes Origin Bound Certs, Trust Tokens, TransportSecurity, Visited Links, the Affiliation Database, and the Site Characteristics Database. Gemini and shared Google sign-in data are not imported. Passwords, full history, bookmarks, payment data, sync data, unrelated site storage, and caches are excluded.
 - Authentication values stay opaque to agents. Tokenless does not print, log, export, or send them to a Tokenless service.
 - Browser visibility settings (`auto`, `headed`, and `headless`) only change how the local managed browser is presented. They do not disable Chromium sandboxing, and they keep the same local daemon and managed profile flow.
 - Prompt text, selected files, and visible page actions are sent only to the provider chosen by the user. That provider's privacy, retention, and subscription terms apply.
diff --git a/PROVIDER_GUEST_ACCESS.md b/PROVIDER_GUEST_ACCESS.md
new file mode 100644
index 0000000..f49da80
--- /dev/null
+++ b/PROVIDER_GUEST_ACCESS.md
@@ -0,0 +1,38 @@
+# Provider guest-access routing
+
+This document records signed-out provider behavior observed in a user-provided Chrome Incognito window on 2026-07-25, plus the current experimental Qwen guest route proven through the selected live guest profile. Provider websites can change independently of Tokenless, so runtime decisions must continue to rely on visible page state.
+
+| Provider | Signed-out entry | First submit | Runtime route |
+| --- | --- | --- | --- |
+| ChatGPT | Active composer | Returns a response | Continue as guest |
+| Claude | `/new` redirects to `/login?from=logout`; no composer | Not available | Handoff for sign-in |
+| Gemini | Active composer | Returns a response | Continue as guest |
+| Grok | Active composer, but guest submission is not supported | Replaced by a non-dismissible “Continue your conversation” sign-up wall | Handoff before running the action |
+| Qwen | Active composer in the selected guest profile | Returns a first correlated response | Continue as experimental guest |
+
+None of the 2026-07-25 ChatGPT, Claude, Gemini, or Grok pages exposed a dismissible authentication dialog with a guest-continuation control. The runtime rule below still supports that state when a provider introduces it.
+
+## Provider account map
+
+| Provider | Guest | Free evidence | Paid evidence |
+| --- | --- | --- | --- |
+| ChatGPT | Supported | `Free` | `Go`, `Plus`, `Pro`, `Team`, `Business`, `Enterprise` |
+| Claude | Unsupported | `Free` | `Pro`, `Max`, `Team`, `Enterprise` |
+| Gemini | Supported | Unknown until reliable visible plan evidence is available | Unknown until reliable visible plan evidence is available |
+| Grok | Unsupported | `Auto`, `Expert`, and `Heavy` all visibly unavailable | Any of `Auto`, `Expert`, or `Heavy` visibly available (`SuperGrok`) |
+| Qwen | Experimental supported | Unknown until reliable visible plan evidence is available | Unknown until reliable visible plan evidence is available |
+
+Account labels classify a visible session as `signed_in_free`, `signed_in_paid`, or `signed_in_unknown`. They are diagnostic evidence, not capability authorization.
+
+## Routing rules
+
+1. Setup runs one visible `auth.status` observation per enabled provider and reports `auth`, `access`, and any observed tier. A page that has not stabilized may be reported as `unknown`. Setup does not submit a prompt, open a sign-in handoff, or retry after user login.
+2. A visible sign-in or sign-up affordance is not a blocker by itself when a usable composer remains visible.
+3. ChatGPT and Gemini are supported guest providers; Qwen is an experimental guest provider. Before handoff, Tokenless accepts an exact visible guest-continuation control such as “Continue as guest” or “Continue without signing in”, then checks the page again.
+4. Claude and Grok require authentication for Tokenless jobs. An unauthenticated runtime check hands off before entering or submitting the task.
+5. Before a gated action, an unknown page surface waits for a stable account, guest composer, sign-in surface, challenge, or terminal blocker. An unsupported-guest provider that remains unknown conservatively hands off; a supported-guest provider with no usable surface fails with a retryable technical error.
+6. Challenge, plan, quota, and rate-limit blockers remain separate from authentication routing.
+
+## Capture evidence
+
+Signed-out DOM captures are stored as redacted, provenance-bound candidates under `test-results/provider-guest-captures/`. The fresh-profile real CLI matrix is stored under `test-results/live-provider-guest-access/`, and current provider capability status is summarized in `test/live-provider-capability-matrix.json`. These artifacts are not promoted into the authenticated provider fixture inventory because the current fixture policy requires authenticated visible-session provenance.
diff --git a/README.md b/README.md
index 7d333fd..02c85e2 100644
--- a/README.md
+++ b/README.md
@@ -1,163 +1,168 @@
-[中文](README.zh-CN.md) ｜ [English](README.md)
+<p align="center">
+  <img src="assets/tokenless-wordmark.png" alt="Tokenless" width="560">
+</p>
 
-# Tokenless
+<p align="center">
+  <a href="https://www.npmjs.com/package/tokenless"><img src="https://img.shields.io/npm/v/tokenless?logo=npm&amp;label=version" alt="npm version"></a>
+  <a href="https://www.npmjs.com/package/tokenless"><img src="https://img.shields.io/npm/dm/tokenless?logo=npm&amp;label=downloads" alt="npm monthly downloads"></a>
+</p>
 
-Run AI websites from any agent through one local CLI. Tokenless gives ChatGPT, Claude, Gemini, and Grok one provider-neutral workflow; a public local API is under active development.
+<p align="center">
+  <a href="README.md">English</a> · <a href="README.zh-CN.md">简体中文</a>
+</p>
 
-## Why Tokenless
+<p align="center">
+  <a href="COMMANDS.md">CLI commands</a> · <a href="#install-and-setup">Quick start</a>
+</p>
 
-- **Save tokens.** Use web subscriptions you already pay for instead of another model API call.
-- **Stay safe and visible.** Playwright operates the normal provider website and verifies visible results.
-- **Keep control local.** Tokenless is free and MIT-licensed; the runtime, managed profiles, and sign-in state stay on your machine.
-- **Use one interface.** The CLI targets all four providers, with files, tools, images, and multimodal work converging on the same contract.
+## What Tokenless Does
 
-## Install
+Tokenless gives AI agents one local browser interface for ChatGPT, Claude, Gemini, Grok, Qwen, and experimental DeepSeek, Perplexity, Z.ai, and Doubao adapters—reducing agent-side token use without provider API keys.
 
-Requires Node.js 22.13+ and a supported Chromium browser such as Google Chrome or Brave.
+It goes beyond sending prompts. Tokenless adapts each provider's real web workflows into one local interface for agents:
 
-```bash
-npm install --global tokenless@latest
-```
+- send prompts and read responses or citations;
+- upload files through the provider's own controls;
+- use visible models, reasoning levels, and provider-specific modes;
+- create or reuse Projects and keep each task scoped to the right profile, Project, and conversation; and
+- deliver selected project files and turn context without exposing unrelated files.
 
-Setup installs and verifies the required `tokenless` and `tokenless-install` agent skills. To delegate installation or upgrades, tell your agent:
+Capabilities are enabled only where Tokenless has verified the visible provider workflow. Unsupported or unproven behavior stops with a clear error instead of being guessed. Provider credentials, browser state, and job data stay on the user's machine.
 
-```text
-Use $tokenless-install to install or upgrade Tokenless and run doctor.
-```
+Within one managed profile, Tokenless preserves separate browser tabs for different providers and stable tasks. Project and conversation task identities return to their own tab instead of navigating over another provider or conversation. The local job API defaults to `pagePolicy: "preserve"`; an integration must explicitly request `pagePolicy: "replace"` before Tokenless may reuse an existing tab for a different task.
 
-Other deployment options:
+Each active managed profile owns its own browser instance. Tokenless reuses that instance across the profile's tabs and jobs, and never closes another active profile to make room; up to four profiles may remain active at once.
 
-```bash
-# Run without a global install
-npx tokenless@latest setup
+| Provider | Status | Login |
+| --- | --- | --- |
+| ChatGPT | Available | Not required |
+| Claude | Available | Required |
+| Gemini | Available | Not required |
+| Grok | Available | Required |
+| Qwen / 千问 | Beta | Not required |
+| DeepSeek | Experimental | Required |
+| Perplexity | Experimental | Not required |
+| Z.ai / GLM | Experimental | Not required |
+| Doubao / 豆包 | Experimental | Required |
 
-# Install system-wide; review the script before running it
-curl -fsSL https://raw.githubusercontent.com/jazelly/tokenless/main/deploy/install.sh | sudo bash
-```
+## Install and Setup
 
-## Start
+Install the CLI:
 
-Choose one managed-profile path during setup.
+```bash
+npm install --global tokenless@latest
+```
 
-### 1. Use an existing browser profile (recommended)
+Then follow the interactive setup:
 
 ```bash
 tokenless setup
 ```
 
-Follow the interactive CLI to choose a browser and an existing Chrome or Brave profile. With your approval, Tokenless copies supported sign-in state for ChatGPT, Claude, and Grok into a separate managed profile; Gemini and shared Google sign-in data are not imported. The source profile is unchanged.
-
-### 2. Start with a fresh profile
+Interactive setup first asks whether to use Anti-Detect mode and states that accepting will install the verified platform-pinned CloakBrowser under `TOKENLESS_HOME` when needed. Declining uses the saved normal-browser preference or automatic discovery without a separate runtime picker. When Anti-Detect is selected, setup links to CloakBrowser, shows the exact platform pin, scans only safe directory/version metadata for known Chrome, Brave, Edge, Arc, Chromium, and Chrome for Testing profiles, and marks exact version alignment. If compatible profiles exist, one source choice offers `Start clean` and the compatible profiles; selecting a profile explicitly authorizes its opaque local copy without Tokenless inspecting authentication values. There are no additional import, copy-consent, or installation confirmations. In non-interactive setup, explicit `--anti-detect` or `--browser cloak` authorizes installation; a saved Cloak preference alone cannot start a download, and import still requires `--consent-local-profile-copy`. Setup then asks which providers belong to the selected managed profile, checks only those providers, leaves one headed provider page open per provider for visible sign-in review, and opens the local Tokenless dashboard in a reserved tab. Reopen the dashboard at any time with:
 
 ```bash
-tokenless setup --fresh
+tokenless dashboard
 ```
 
-On a new installation, this creates a clean `default` profile, starts the local runtime, and checks every supported visible provider, opening sign-in pages when needed. It never imports a browser profile implicitly.
+The dashboard is served only by the loopback daemon. It manages browser identities, profile-scoped provider routing, visible readiness and controls, capabilities, durable jobs, user handoffs, and redacted diagnostics. Browser JavaScript never receives the daemon bearer token or provider credentials; `tokenless dashboard` uses a one-time bootstrap ticket to establish a short-lived local UI session.
 
-Verify either path with:
+Installing the package is only the first step. Complete `tokenless setup` before using Tokenless; it selects and verifies an exact browser runtime, creates or reuses a runtime-bound browser profile, prepares the local runtime, checks every enabled provider, and opens one review tab per provider. Normal mode follows an explicit browser, then the saved preference, then automatic discovery; the default `auto` uses an installed Chrome-family browser first and lazily downloads Tokenless-managed Chrome for Testing 145 only when none exists. Anti-Detect mode selects CloakBrowser and is also available non-interactively as `--anti-detect`. Cloak is downloaded from its official release into the private Tokenless cache; its separately licensed binary is not included in the Tokenless npm package or release artifacts.
 
-```bash
-tokenless doctor --json
-```
+Every managed profile is bound to the browser runtime that created it. Tokenless does not silently open a managed profile with a different runtime family. A runtime-family change normally creates a clean profile. With explicit user selection, setup may copy one version-compatible local Chromium profile as an opaque filesystem tree into a new managed profile; Tokenless does not inspect or expose individual cookies, tokens, browser storage, or authentication values. The managed browser then preserves that profile's session across jobs.
+
+On first setup, Tokenless selects English or Simplified Chinese from the system locale and saves the choice as `language` in `~/.tokenless/config.json`. English is the fallback. The preference controls the CLI, dashboard, and default provider response language; an explicit language request in the prompt still wins. Change it later in the dashboard or with `tokenless config --language en` or `tokenless config --language zh-CN`.
+
+The config uses `providerWhitelist` for the provider routing boundary. Its default contains every non-disabled provider except Gemini; Gemini can be enabled explicitly during setup, with `tokenless config --provider-whitelist ...`, or in the dashboard.
+
+Setup resolves `auto` to a concrete `browser` and caches its verified absolute path as `browserExecutablePath` in `$TOKENLESS_HOME/config.json`. Runtime resolution validates that cache first, scans standard installation paths only after a cache miss, and refreshes the field after a successful fallback. Set a custom system-browser path with `tokenless config --browser chrome --browser-executable-path "/absolute/path/to/browser"`; managed Chromium and Cloak paths remain catalog-controlled under `$TOKENLESS_HOME/browser/runtimes`.
 
-## Browser Visibility
+For browser capability evaluation, the config file accepts experimental `browserConnectionMode: "playwright" | "cdp"`; it defaults to `playwright`, has no CLI flag, and takes effect after the daemon restarts.
 
-Tokenless stores browser visibility in config and uses `auto` when the setting is omitted. Set the default with `tokenless config --browser-visibility ...`, and pass the same flag to `tokenless run` only when one job needs a different visibility policy.
+Requires Node.js 22.13+. The first browser-runtime targets are Apple Silicon macOS and x64 Windows; Windows x64 covers Intel and AMD processors. Windows remains prerelease until its real-hardware gates pass.
 
-- `auto` starts headless and opens a headed window only for user-resolvable blockers such as sign-in, CAPTCHA, MFA, consent, or confirmation.
-- `headed` always opens a visible browser window.
-- `headless` never opens a browser window. If a job parks for user action, resume the same job with `tokenless resume --job-id <job-id> --browser-visibility headed --json`; do not submit a replacement job.
-- `profiles open` is always headed.
-- `doctor` is read-only.
-- Chromium sandbox stays enabled in both modes.
-- Auto-escalated windows close after 30 seconds of idle time after the job completes; explicit headed and `profiles open` windows remain open.
+## Run
 
-## Upgrade
+After setup, ask your agent to use Tokenless, or run a quick check yourself:
 
 ```bash
-tokenless upgrade
+tokenless run \
+  --provider chatgpt \
+  --prompt "Review this proposal."
 ```
 
-Upgrade is prompt-free: it installs the latest global CLI, refreshes the Tokenless agent skills, reconciles the packaged local daemon through the newly installed CLI, and finishes with that new CLI's read-only doctor check. The default output is concise and human-readable. Agents and CI should run `tokenless upgrade --json` for one structured result on stdout. Both forms exit nonzero if any required phase or doctor check is unhealthy; no separate noninteractive command is needed.
+Without `--provider`, Tokenless chooses an available configured provider. If you name one, Tokenless uses that exact provider.
 
-## First Request
+Agents can discover the canonical outcome catalog and request one or more evidence-backed capabilities:
 
 ```bash
+tokenless capabilities list --json
+tokenless limits inspect --profile default --provider chatgpt --json
+
 tokenless run \
-  --profile default \
-  --provider chatgpt \
-  --attach-file ./brief.pdf \
-  --prompt "Review this brief and return the key risks." \
-  --json
+  --capability file.upload \
+  --attach-file proposal.pdf \
+  --prompt "Review the attached proposal."
 ```
 
-ChatGPT, Claude, Gemini, and Grok are being unified behind the same workflow. Four-provider parity, end-to-end file upload, and the public local API are under active development.
+Tokenless combines explicit capabilities with requirements inferred from structured inputs. A normal run requires `conversation.chat`, attachments require `file.upload` plus their media-specific input capability, and `--workspace-mode native` requires `workspace.native`. The configured provider list restricts candidate membership. Inside that set, the router removes every provider that cannot satisfy the complete implication-expanded requirement set, then ranks the remaining routes by fresh runtime eligibility and evidence maturity; configured list order is only the final tie-breaker and can never override capability compatibility, runtime eligibility, or evidence maturity. `conversation.chat` and text-file `file.upload` are currently routeable; `workspace.native`, `research.deep`, and other candidate outcomes fail before browser mutation until their complete lifecycle has real-provider E2E closure.
 
-## Roadmap
+For an implicit provider run, Tokenless records the ranked evidence-backed alternatives and rechecks the selected route against current local capacity plus the live provider page before mutation. A classified safe pre-submit provider failure—such as a known capacity window, sign-in, CAPTCHA, rate or plan limits, maintenance, regional unavailability, navigation failure, a missing stable surface, or visibly unavailable capability UI—can atomically move the same job to the next route. Every alternative must satisfy the identical complete capability set. Explicit `--provider`, exact or mapped continuation, provider-specific controls, non-reconstructable mutations, ambiguous state, and any post-submission failure never switch automatically. `tokenless state --json` reports ranked fallback routes, structured stop reasons, and the durable provider-attempt history.
 
-- Complete one Playwright action contract across ChatGPT, Claude, Gemini, and Grok.
-- Make files, model controls, citations, and long-running responses seamless across providers.
-- Expose provider workspaces, files, plugins, connectors, and tools when they are available through visible pages.
-- Support image generation, image input, and broader multimodal workflows.
-- Stabilize the local API so agents can use AI websites as a programmable execution surface.
+Each routed job also stores a versioned provider-neutral context envelope with task identity, normalized requirements, role-bearing instructions, attachment provenance, output constraints, optional upstream agent state, and delivery hashes. The same validated envelope is replayed unchanged across provider attempts; `tokenless state --json` exposes a redacted envelope summary without instruction text or upstream state contents.
 
-Roadmap items are not yet compatibility guarantees.
+Inspect provider-specific availability with `tokenless provider-action --action capability.inspect --provider <provider> --json`.
 
-## How Tokenless Works
+DeepSeek exposes provider-specific `Instant`, `Expert`, and `Vision` modes plus independent `DeepThink` and `Search` controls. Inspect them with `deepseek.mode.inspect`, `deepseek.deepthink.inspect`, and `deepseek.search.inspect`; Search and file availability are mode-dependent and are never inferred from the mode label alone.
 
-`Agent → CLI → local daemon → Playwright worker → managed browser profile → provider website`
+Doubao exposes provider-specific modes and coding-relevant Web skills through `doubao.mode.inspect/select` and `doubao.skill.inspect/select`. The runtime reports visible upgrade and desktop-only restrictions instead of clicking through them. Text-file `file.upload` is experimentally routeable; skill selection is control evidence only until each generated or long-running outcome completes its own real-provider release gate.
 
-The CLI submits provider-neutral actions. The local daemon schedules them, Playwright operates the selected managed profile, and provider adapters verify visible outcomes. Later jobs reuse the same profile. The planned local API will use the same application and job contracts after its authentication and compatibility surface is stable.
+For explicit DeepSeek runs, `search.web` prepares Instant with Search enabled, `reasoning.extended` enables DeepThink, and `image.input` prepares Vision before browser mutation. These canonical routes remain fail-closed until their declared real-provider release gates pass.
 
-### Managed profiles
+## Documentation
 
-A managed profile is one reusable local browser identity. One profile can hold sessions for several providers; use separate profiles for multiple accounts of the same provider.
+- [Documentation index](docs/README.md)
+- [Capability Matrix](docs/capability-matrix.md)
+- [CLI Commands](COMMANDS.md)
+- [Privacy](PRIVACY.md)
+- [Architecture](docs/architecture.md)
 
-```bash
-tokenless profiles discover --browser chrome --json
-tokenless profiles discover --browser brave --json
-tokenless profiles add --profile work --browser chrome --import-browser-profile "Profile 1" --preferred-providers chatgpt,claude --consent-local-profile-copy --set-default
-tokenless profiles add --profile clean --set-default
-tokenless profiles open --profile work --provider claude
-tokenless profiles status --profile work --provider claude
-tokenless profiles reset --profile work
-tokenless profiles clear --profile work
-```
+## Current Status
 
-`profiles discover` is read-only. Import, reset, and clear are explicit operations; jobs never change profile lifecycle automatically.
+Tokenless is currently in private beta. We plan to publish detailed benchmarks of its token savings in the future.
 
-### Interfaces
+## Known Issues
 
-| Interface | Execution path | Status |
-| --- | --- | --- |
-| CLI | Playwright web jobs through the local daemon | Primary interface |
-| Local API | The same provider-neutral Playwright jobs | Planned; not a public compatibility surface yet |
+### Codex sandbox policies can prevent Tokenless from running
 
-## Privacy and Safety
+In Codex, the sandbox policy applied to an agent may block Tokenless from launching a browser or performing required local operations. In a trusted environment, either enable Full Access or approve the operation when Codex asks for permission and choose to allow the same operation in the future.
 
-- Playwright runs locally with visible, persistent managed browser profiles.
-- Consented import copies only supported provider sign-in state; passwords, history, bookmarks, payments, sync data, and caches are excluded.
-- Automation uses visible page controls and checks visible results.
-- CAPTCHA, sign-in, plan limits, consent, and confirmations remain under user control.
-- Selected files are staged locally, integrity-checked, and uploaded through the provider's visible file control.
-- Each request follows the authenticated local daemon and managed Playwright path.
+## FAQ
 
-See the full [privacy policy](PRIVACY.md).
+### Does Tokenless eliminate all token usage?
 
-## Development
+No. It reduces agent-side token usage by routing suitable work to AI providers' websites. Your agent still needs some tokens to decide what to delegate and use the result.
 
-Requires Node.js 22.13+, npm, Rust, and Google Chrome.
+### Is installing the npm package enough?
 
-```bash
-npm run build
-npm run lint
-npm test
-npm run test:e2e
-```
+No. Run `tokenless setup` after installation and follow the setup flow. Tokenless needs a configured browser profile and at least one available provider before it can run tasks.
+
+### Does Tokenless require provider API keys?
+
+No. Tokenless uses providers' visible websites rather than their APIs. Some providers still require you to sign in, and the capabilities available depend on what your account can access on the website.
+
+### Does Tokenless send my entire project to a provider?
+
+No. It sends the prompt, selected files, and task context needed for the delegated work. It does not automatically expose unrelated project files.
+
+### Does every provider support every feature?
+
+No. Tokenless enables only workflows verified against each provider's visible website. Unsupported or unverified capabilities stop with a clear error.
+
+See the [Capability Matrix](docs/capability-matrix.md) for the current provider mappings and evidence rules.
 
-These commands do not publish anything. See [Architecture](docs/architecture.md) for the managed Playwright runtime and [npm publishing](docs/npm-publishing.md) for release procedures.
+### Why does Qwen sometimes report `provider_dns_unavailable`?
 
-## License
+This error means Chromium could not resolve `chat.qwen.ai` before making an HTTP request. Tokenless records this Qwen-specific condition as a retryable suspected rate limit because intermittent provider-edge throttling is one possible cause, but marks it unconfirmed: a DNS failure alone is not proof of an HTTP rate limit.
 
-[MIT](LICENSE)
+Wait and retry the command manually, then check whether the hostname resolves on the current network. Do not count the failure as a passing or skipped provider E2E case, and do not use a test-only DNS override as acceptance evidence. A confirmed rate limit requires provider-visible evidence or an HTTP response such as `429` or `Retry-After`.
diff --git a/README.zh-CN.md b/README.zh-CN.md
index 721e59c..bbb6821 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -1,163 +1,168 @@
-[中文](README.zh-CN.md) ｜ [English](README.md)
+<p align="center">
+  <img src="assets/tokenless-wordmark.png" alt="Tokenless" width="560">
+</p>
 
-# Tokenless
+<p align="center">
+  <a href="https://www.npmjs.com/package/tokenless"><img src="https://img.shields.io/npm/v/tokenless?logo=npm&amp;label=version" alt="npm 版本"></a>
+  <a href="https://www.npmjs.com/package/tokenless"><img src="https://img.shields.io/npm/dm/tokenless?logo=npm&amp;label=downloads" alt="npm 月下载量"></a>
+</p>
 
-让任何智能体通过统一的本地命令行操作 AI 网页。Tokenless 为 ChatGPT、Claude、Gemini 和 Grok 提供一套与服务商无关的流程；公开的本地接口仍在开发中。
+<p align="center">
+  <a href="README.md">English</a> · <a href="README.zh-CN.md">简体中文</a>
+</p>
 
-## 为什么使用 Tokenless
+<p align="center">
+  <a href="COMMANDS.zh-CN.md">CLI 命令</a> · <a href="#安装与初始化">快速开始</a>
+</p>
 
-- **省 token。** 直接使用已经付费的网页订阅，不必为同一次模型调用再次支付接口费用。
-- **安全且可见。** Playwright 操作服务商正常网页，并验证页面上的实际结果。
-- **由本机掌控。** Tokenless 免费、MIT 开源；运行环境、托管配置和登录状态都保存在你的设备上。
-- **一套接口调用四家服务商。** 命令行统一调用四家服务商，文件、工具、图片和多模态能力也将接入同一套协议。
+## Tokenless 能做什么
 
-## 安装
+Tokenless 为 AI Agent 提供一个统一的本地浏览器接口，用来访问 ChatGPT、Claude、Gemini、Grok、Qwen，以及实验阶段的 DeepSeek、Perplexity、Z.ai 和 Doubao / 豆包 adapter，从而减少 Agent 侧 token 消耗，也不需要配置这些服务的 API Key。
 
-需要 Node.js 22.13+ 和 Google Chrome、Brave 等受支持的 Chromium 浏览器。
+它不只是把 prompt 填进网页。Tokenless 会把各家 provider 真正提供的网页工作流适配成一个供 Agent 使用的本地接口：
 
-```bash
-npm install --global tokenless@latest
-```
+- 发送 prompt，并读取回复和引用；
+- 通过 provider 自己的控件上传文件；
+- 使用页面上可见的模型、推理等级和 provider 专属模式；
+- 创建或复用 Projects，并将每个任务限定在正确的 profile、Project 和对话中；以及
+- 传递选定的项目文件和单轮上下文，不暴露无关文件。
 
-设置流程会安装并验证必需的 `tokenless` 和 `tokenless-install` 智能体技能。需要让智能体负责安装或升级时，直接告诉它：
+只有经过 Tokenless 可见验证的 provider 工作流才会启用。未支持或尚未证明的行为会明确报错，不会猜测执行。Provider 登录信息、浏览器状态和 job 数据都保留在用户本机。
 
-```text
-请使用 $tokenless-install 安装或升级 Tokenless，并运行完整检查。
-```
+在同一个 managed profile 中，Tokenless 会为不同 provider 和稳定 task 保留彼此独立的浏览器标签页。Project 和对话会按 task identity 回到自己的标签页，不会覆盖并导航掉另一个 provider 或对话。Local job API 默认使用 `pagePolicy: "preserve"`；只有 integration 显式请求 `pagePolicy: "replace"` 时，Tokenless 才允许把已有标签页改作另一个 task 使用。
 
-其他部署方式：
+每个 active managed profile 都独占自己的 browser instance。Tokenless 会在该 profile 的 tabs 和 jobs 之间持续复用这个 instance，绝不会为了给另一个 profile 腾位置而关闭它；最多可同时保留四个 active profiles。
 
-```bash
-# 不进行全局安装
-npx tokenless@latest setup
+| Provider | 状态 | 是否需要登录 |
+| --- | --- | --- |
+| ChatGPT | 可用 | 不需要 |
+| Claude | 可用 | 需要 |
+| Gemini | 可用 | 不需要 |
+| Grok | 可用 | 需要 |
+| Qwen / 千问 | Beta | 不需要 |
+| DeepSeek | 实验阶段 | 需要 |
+| Perplexity | 实验阶段 | 不需要 |
+| Z.ai / GLM | 实验阶段 | 不需要 |
+| Doubao / 豆包 | 实验阶段 | 需要 |
 
-# 系统级安装；执行前请先审阅脚本
-curl -fsSL https://raw.githubusercontent.com/jazelly/tokenless/main/deploy/install.sh | sudo bash
-```
+## 安装与初始化
 
-## 启动
+安装 CLI：
 
-首次设置时选择一种托管配置方案。
+```bash
+npm install --global tokenless@latest
+```
 
-### 1. 使用现有浏览器配置（推荐）
+然后按照交互式 setup 流程完成初始化：
 
 ```bash
 tokenless setup
 ```
 
-按照交互式命令行选择浏览器和一个现有 Chrome 或 Brave 配置。获得明确同意后，Tokenless 会把 ChatGPT、Claude 和 Grok 中受支持的登录状态复制到独立托管配置；Gemini 和共享的 Google 登录数据不会被导入。原浏览器配置保持不变。
-
-### 2. 使用全新配置启动
+交互式 setup 会先询问是否使用 Anti-Detect 模式，并直接说明接受后会在需要时把经过验证、按平台固定版本的 CloakBrowser 安装到 `TOKENLESS_HOME` 下。拒绝后会使用已保存的普通 browser 偏好或自动发现，不再显示单独的 runtime 选择器。选择 Anti-Detect 后，setup 会链接到 CloakBrowser、显示当前平台的精确锁定版本，只扫描本机已知 Chrome、Brave、Edge、Arc、Chromium 和 Chrome for Testing profile 的安全目录/版本元数据，并标记精确版本是否匹配。有兼容 profile 时，只显示一次来源选择，其中包含 `Start clean` 和兼容 profile；选择某个 profile 本身就明确授权 opaque 本地复制，Tokenless 不会检查认证值。之后不再询问是否 import、是否同意 copy 或是否继续安装。非交互 setup 中，显式 `--anti-detect` 或 `--browser cloak` 授权安装；仅有已保存的 Cloak preference 不会触发下载，import 仍要求 `--consent-local-profile-copy`。之后 setup 才会询问哪些 provider 属于当前 managed profile，只检查这些 provider，为每个 provider 保留一个 headed 页面供用户直接审核登录状态，并在一个保留标签页中打开 Tokenless 本地控制台。之后可随时重新打开控制台：
 
 ```bash
-tokenless setup --fresh
+tokenless dashboard
 ```
 
-首次安装时，此命令会创建干净的 `default` 配置、启动本地运行环境，并检查每个受支持的可见服务商，在需要时打开登录页面。它不会隐式导入现有浏览器配置。
+控制台只由 loopback daemon 提供，可管理浏览器身份、profile 级 provider 路由、可见就绪状态与控件、能力目录、持久任务、用户接管和脱敏诊断信息。浏览器 JavaScript 不会拿到 daemon bearer token 或 provider 登录信息；`tokenless dashboard` 通过一次性 bootstrap ticket 建立短期本地 UI session。
 
-两种方式都可以这样检查：
+安装 npm package 只是第一步。使用 Tokenless 前必须完成 `tokenless setup`；它会选择并验证精确的 browser runtime，创建或复用绑定 runtime 的 browser profile，准备本地运行环境，检查所有已启用的 providers，并为每个 provider 打开一个审核 tab。普通模式依次遵循显式 browser、已保存偏好和自动发现；默认的 `auto` 会优先使用用户已经安装的 Chrome-family browser，只有没有可用浏览器时才 lazy download 由 Tokenless 管理的 Chrome for Testing 145。Anti-Detect 模式会选择 CloakBrowser，非交互流程也可使用 `--anti-detect`。Cloak 会从官方 release 下载到 Tokenless 私有 cache；采用单独许可的 binary 不会进入 Tokenless npm package 或 release artifact。
 
-```bash
-tokenless doctor --json
-```
+每个 managed profile 都会绑定创建它的 browser runtime。Tokenless 不会用不同 runtime family 静默打开 managed profile；切换 runtime family 通常会创建 clean profile。经过用户明确选择后，setup 可以把一个版本兼容的本机 Chromium profile 作为 opaque 文件树复制到新的 managed profile；Tokenless 不会检查或暴露其中单独的 cookies、tokens、browser storage 或认证值。之后由 managed browser 自己跨 job 保留该 profile 的 session。
+
+首次 setup 会根据系统 locale 选择英文或简体中文，并把结果保存到 `~/.tokenless/config.json` 的 `language` 字段；无法识别时使用英文。该偏好同时控制 CLI、控制台和 provider 的默认回复语言；prompt 中明确指定的语言仍然优先。之后可在控制台中修改，也可运行 `tokenless config --language en` 或 `tokenless config --language zh-CN`。
+
+Config 使用 `providerWhitelist` 作为 provider routing 边界。默认值包含除 Gemini 外的所有非 `disabled` provider；可以在 setup 中、通过 `tokenless config --provider-whitelist ...`，或在控制台中显式启用 Gemini。
+
+Setup 会把 `auto` 解析成具体的 `browser`，并把验证过的绝对路径作为 `browserExecutablePath` 缓存到 `$TOKENLESS_HOME/config.json`。Runtime resolution 会先验证缓存，缓存失效后才扫描标准安装路径，并在 fallback 成功时刷新该字段。可以运行 `tokenless config --browser chrome --browser-executable-path "/浏览器的绝对路径"` 设置自定义 system-browser 路径；managed Chromium 与 Cloak 的路径仍由 catalog 控制，并固定在 `$TOKENLESS_HOME/browser/runtimes` 下。
 
-## 浏览器可见性
+为评估 browser capability，config 文件接受实验性的 `browserConnectionMode: "playwright" | "cdp"`；默认值为 `playwright`，不提供 CLI flag，并在 daemon 重启后生效。
 
-Tokenless 会把浏览器可见性保存在配置中；如果没有设置，就默认使用 `auto`。可以通过 `tokenless config --browser-visibility ...` 持久设置默认值；只有某一个任务需要不同可见性时，才把同一个参数传给 `tokenless run`。
+需要 Node.js 22.13+。首批 browser runtime 目标平台是 Apple Silicon Mac 和 Windows x64；Windows x64 同时覆盖 Intel 与 AMD CPU。Windows 在真机 gate 通过前仍属于 prerelease。
 
-- `auto` 先以 headless 启动，只在出现用户可直接处理的阻塞时才打开 headed 窗口，例如登录、CAPTCHA、MFA、授权同意或确认步骤。
-- `headed` 总是打开可见浏览器窗口。
-- `headless` 永远不会打开浏览器窗口。如果任务停在等待用户操作，就用 `tokenless resume --job-id <job-id> --browser-visibility headed --json` 恢复同一个任务；不要提交替代任务。
-- `profiles open` 永远是 headed。
-- `doctor` 只读。
-- Chromium sandbox 在两种模式下都会保持启用。
-- auto 自动升级后的窗口会在任务完成后空闲 30 秒关闭；显式的 headed 窗口和 `profiles open` 打开的窗口会保持打开。
+## 执行
 
-## 升级
+Setup 完成后，可以直接让 Agent 使用 Tokenless，也可以自己快速测试：
 
 ```bash
-tokenless upgrade
+tokenless run \
+  --provider chatgpt \
+  --prompt "Review this proposal."
 ```
 
-升级全程不会提问：它会安装最新的全局 CLI、刷新 Tokenless 智能体技能，通过新安装的 CLI 对打包的本地守护进程进行协调更新，最后运行这个新 CLI 的只读 doctor 检查。默认输出简洁、适合用户阅读；智能体和 CI 应运行 `tokenless upgrade --json`，从标准输出获得一份结构化结果。两种形式都会在任何必需阶段或 doctor 检查不健康时以非零状态退出，因此不需要另设非交互命令。
+不传 `--provider` 时，Tokenless 会选择一个当前可用的 configured provider。显式指定后，Tokenless 只使用该 provider。
 
-## 第一次调用
+Agent 可以发现 canonical outcome catalog，并请求一个或多个已有证据闭环的 capabilities：
 
 ```bash
+tokenless capabilities list --json
+tokenless limits inspect --profile default --provider chatgpt --json
+
 tokenless run \
-  --profile default \
-  --provider chatgpt \
-  --attach-file ./brief.pdf \
-  --prompt "审查这份材料并列出主要风险。" \
-  --json
+  --capability file.upload \
+  --attach-file proposal.pdf \
+  --prompt "Review the attached proposal."
 ```
 
-ChatGPT、Claude、Gemini 和 Grok 正在统一到同一套流程中。四家能力对齐、端到端文件上传和公开本地接口仍在持续开发。
+Tokenless 会合并显式 capability 与结构化输入推导出的要求。普通 run 要求 `conversation.chat`，attachments 要求 `file.upload` 及对应的 media-specific input capability，`--workspace-mode native` 要求 `workspace.native`。配置的 provider list 会限制候选成员。在这个集合内部，Router 会剔除无法满足完整 implication-expanded requirement set 的 provider，再按照新鲜 runtime eligibility 和 evidence maturity 对剩余 routes 排序；配置列表顺序仅作为最终 tie-breaker，绝不会覆盖 capability compatibility、runtime eligibility 或 evidence maturity。目前可路由的是 `conversation.chat` 和 text-file `file.upload`；`workspace.native`、`research.deep` 及其他 candidate outcomes 在完整 lifecycle 通过真实 provider E2E closure 前，会在 browser mutation 之前明确失败。
 
-## 路线图
+对于未显式指定 provider 的 run，Tokenless 会记录排序后的 evidence-backed alternatives，并在 mutation 前根据当前本地 capacity 与真实 provider 页面重新检查当前 route。已知 capacity window、登录、CAPTCHA、限流或套餐限制、维护、区域不可用、导航失败、稳定 surface 缺失或 capability UI 明确不可用等已分类的 safe pre-submit provider failure，可以让同一个 job 原子切换到下一条 route。每个 alternative 都必须满足完全相同的完整 capability set。显式 `--provider`、精确或已映射 continuation、provider-specific controls、不可重建 mutation、外部状态不明确以及任何 post-submission failure 都绝不会自动切换。`tokenless state --json` 会报告排序后的 fallback routes、结构化停止原因和持久化的 provider attempt 历史。
 
-- 完成 ChatGPT、Claude、Gemini 和 Grok 的统一 Playwright 操作协议。
-- 统一文件、模型控制、引用和长时间回答体验。
-- 在可见页面支持的范围内开放服务商工作区、文件、插件、连接器和工具。
-- 支持图片生成、图片输入和更完整的多模态流程。
-- 稳定本地接口，让智能体把 AI 网页作为可编程执行环境。
+每个 routed job 还会保存带版本、provider-neutral 的 context envelope，包含 task identity、规范化 requirements、带 role 的 instructions、attachment provenance、输出约束、可选 upstream agent state 和 delivery hashes；不同 provider attempts 会原样重放同一个已验证 envelope。`tokenless state --json` 只公开不含 instruction 正文与 upstream state 内容的脱敏 envelope 摘要。
 
-路线图内容尚不构成兼容性承诺。
+可以使用 `tokenless provider-action --action capability.inspect --provider <provider> --json` 检查某家 provider 当前可用的具体能力。
 
-## Tokenless 如何工作
+DeepSeek 提供 provider-specific 的 `Instant`、`Expert`、`Vision` mode，以及独立的 `DeepThink` 与 `Search` 控件。可分别使用 `deepseek.mode.inspect`、`deepseek.deepthink.inspect` 和 `deepseek.search.inspect` 检查；Search 与文件能力会随 mode 变化，Tokenless 不会只根据 mode 名称推断能力。
 
-`智能体 → 命令行 → 本地守护进程 → Playwright 运行进程 → 托管浏览器配置 → 服务商网页`
+豆包通过 `doubao.mode.inspect/select` 与 `doubao.skill.inspect/select` 公开 provider-specific modes 和适合 coding 工作流的 Web skills。Runtime 会报告可见的升级限制与 desktop-only 限制，不会强行点击受限流程。Text-file `file.upload` 已作为 experimental route 提供；在每种生成或长任务 outcome 分别通过真实 provider release gate 前，skill selection 仅作为 control evidence。
 
-命令行提交统一操作，本地守护进程负责调度，Playwright 使用所选托管配置操作网页，各服务商适配器验证可见结果。后续任务会复用同一配置。规划中的本地接口会在认证和兼容性边界稳定后，复用同一套应用与任务协议。
+对于显式 DeepSeek run，`search.web` 会在浏览器 mutation 前准备 Instant 并启用 Search，`reasoning.extended` 会启用 DeepThink，`image.input` 会准备 Vision。在声明的真实 provider release gate 通过之前，这些 canonical route 仍会 fail closed。
 
-### 托管配置
+## 文档
 
-一个托管配置代表一个可长期复用的本地浏览器身份。一个配置可以登录多家服务商；同一家服务商的多个账户使用不同配置。
+- [文档索引](docs/README.zh-CN.md)
+- [Capability Matrix](docs/capability-matrix.zh-CN.md)
+- [CLI 命令](COMMANDS.zh-CN.md)
+- [隐私政策](PRIVACY.md)
+- [架构](docs/architecture.md)
 
-```bash
-tokenless profiles discover --browser chrome --json
-tokenless profiles discover --browser brave --json
-tokenless profiles add --profile work --browser chrome --import-browser-profile "Profile 1" --preferred-providers chatgpt,claude --consent-local-profile-copy --set-default
-tokenless profiles add --profile clean --set-default
-tokenless profiles open --profile work --provider claude
-tokenless profiles status --profile work --provider claude
-tokenless profiles reset --profile work
-tokenless profiles clear --profile work
-```
+## 补充说明
 
-`profiles discover` 只读取配置列表。导入、重置和清除都必须显式执行，普通任务不会自动改变配置状态。
+项目目前处于内测阶段。后续计划发布关于 token 节省效果的具体评测数据，供大家参考。
 
-### 调用入口
+## 已知问题
 
-| 入口 | 执行路径 | 状态 |
-| --- | --- | --- |
-| 命令行 | 通过本地守护进程执行 Playwright 网页任务 | 主要入口 |
-| 本地接口 | 执行同一套与服务商无关的 Playwright 任务 | 规划中；尚不是公开兼容性入口 |
+### Codex 的 sandbox policy 可能阻止 Tokenless 运行
 
-## 隐私与安全
+在 Codex 中，Agent 使用的 sandbox policy 可能会阻止 Tokenless 启动浏览器或执行必要的本地操作。在可信环境中，可以将 Codex 设置为 Full Access；也可以在 Codex 弹出授权询问时批准该操作，并选择今后允许相同操作，避免后续重复授权。
 
-- Playwright 在本机运行，并使用可见、可长期复用的托管浏览器配置。
-- 经用户同意的导入只复制受支持服务商的登录状态，不包含密码、历史记录、书签、支付、同步和缓存数据。
-- 自动化只操作可见网页控件，并检查可见结果。
-- 验证码、登录、套餐限制、授权和确认步骤仍由用户控制。
-- 所选文件会在本机暂存并校验完整性，再通过服务商的可见文件控件上传。
-- 每个请求都通过经过认证的本地守护进程和托管 Playwright 路径执行。
+## 常见问题
 
-完整说明见[隐私政策](PRIVACY.md)。
+### Tokenless 会完全消除 token 消耗吗？
 
-## 开发
+不会。Tokenless 会把适合的任务分流到 AI provider 的网页版，从而减少 Agent 侧的 token 消耗；Agent 仍需要使用少量 token 来判断分流内容并处理结果。
 
-需要 Node.js 22.13+、npm、Rust 和 Google Chrome。
+### 只安装 npm package 就可以使用吗？
 
-```bash
-npm run build
-npm run lint
-npm test
-npm run test:e2e
-```
+不可以。安装后还必须运行 `tokenless setup` 并完成 setup 流程。Tokenless 需要配置好的浏览器 profile 和至少一个可用的 provider 才能执行任务。
+
+### Tokenless 需要 provider API Key 吗？
+
+不需要。Tokenless 使用 provider 的可见网页，而不是 provider API。部分 provider 仍要求登录，实际可用能力取决于你的账号在网页上能够使用的功能。
+
+### Tokenless 会把整个项目发送给 provider 吗？
+
+不会。它只发送委派任务所需的 prompt、选定文件和 task context，不会自动暴露无关的项目文件。
+
+### 每个 provider 都支持所有功能吗？
+
+不支持。Tokenless 只启用已经在各 provider 可见网页上验证过的工作流；不支持或尚未验证的能力会明确报错并停止。
+
+当前 provider mappings 与 evidence rules 见 [Capability Matrix](docs/capability-matrix.zh-CN.md)。
 
-以上命令不会发布任何内容。托管 Playwright 运行机制见[架构文档](docs/architecture.md)，发布流程见 [npm 发布文档](docs/npm-publishing.md)。
+### 为什么 Qwen 有时会报告 `provider_dns_unavailable`？
 
-## 许可证
+这个错误表示 Chromium 在发出 HTTP 请求前无法解析 `chat.qwen.ai`。Tokenless 会把 Qwen 的这种情况记录为可重试的疑似 rate limit，因为 provider 边缘节点的间歇性 throttling 是可能原因之一；但同时会明确标记为尚未确认，因为仅凭 DNS 失败无法证明发生了 HTTP rate limit。
 
-[MIT](LICENSE)
+请等待一段时间后手动重试命令，并检查当前网络能否解析该 hostname。不要把这类失败计作 provider E2E 通过或 skip，也不要用测试专用 DNS override 作为验收证据。只有 provider 页面上的可见证据，或 `429`、`Retry-After` 等 HTTP 响应，才能确认 rate limit。
diff --git a/api/fixtures/openapi-success-responses.json b/api/fixtures/openapi-success-responses.json
new file mode 100644
index 0000000..904d6d2
--- /dev/null
+++ b/api/fixtures/openapi-success-responses.json
@@ -0,0 +1,327 @@
+{
+  "openapi": "api/tokenless-daemon-api.openapi.json",
+  "cases": [
+    {
+      "name": "ready",
+      "schema": "#/components/schemas/ReadyResponse",
+      "valid": true,
+      "data": {
+        "version": "0.3.0",
+        "ready": true,
+        "home_dir": "/tmp/tokenless",
+        "pid": 12345,
+        "proof": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+      }
+    },
+    {
+      "name": "browser-runtime-status",
+      "schema": "#/components/schemas/BrowserRuntimeStatus",
+      "valid": true,
+      "data": {
+        "status": "running",
+        "activeProfileCount": 1,
+        "activeJobCount": 2,
+        "pid": 12345
+      }
+    },
+    {
+      "name": "job-view",
+      "schema": "#/components/schemas/JobView",
+      "valid": true,
+      "data": {
+        "job_id": "job-1",
+        "execution_backend": "playwright",
+        "profile_id": "work",
+        "provider": "chatgpt",
+        "action": "visible_provider_actions",
+        "status": "queued",
+        "request_json": {
+          "taskId": "task-1"
+        },
+        "result_json": null,
+        "error_json": null,
+        "blocker_json": null,
+        "provider_attempts_json": [],
+        "provider_submitted_at": null,
+        "eligible_at": null,
+        "created_at": "2026-07-26T00:00:00Z",
+        "updated_at": "2026-07-26T00:00:00Z"
+      }
+    },
+    {
+      "name": "native-workspace-job-view",
+      "schema": "#/components/schemas/JobView",
+      "valid": true,
+      "data": {
+        "job_id": "job-native-project-1",
+        "execution_backend": "playwright",
+        "profile_id": "work",
+        "provider": "claude",
+        "action": "visible_provider_actions",
+        "status": "succeeded",
+        "request_json": {
+          "taskId": "task-project-1"
+        },
+        "result_json": {
+          "schema": "tokenless.playwright-managed-visible-actions-result.v3",
+          "results": [
+            {
+              "action": "workspace.ensure",
+              "result": {
+                "mode": "native",
+                "requestedMode": "native",
+                "resolvedMode": "native",
+                "name": "Tokenless E2E project-1",
+                "scope": {
+                  "provider": "claude",
+                  "profileId": "work"
+                },
+                "identity": {
+                  "provider": "claude",
+                  "name": "Tokenless E2E project-1",
+                  "resourceId": "project-1",
+                  "canonicalUrl": "https://claude.ai/project/project-1"
+                },
+                "resource": {
+                  "kind": "project",
+                  "native": true,
+                  "disposition": "created",
+                  "id": "project-1",
+                  "canonicalUrl": "https://claude.ai/project/project-1"
+                },
+                "native": {
+                  "resourceKind": "project",
+                  "availability": "available",
+                  "canonicalUrl": "https://claude.ai/project/project-1",
+                  "visibleProof": "native-project-url-name-and-composer-visible",
+                  "reason": null,
+                  "updateInstructions": {
+                    "availability": "available",
+                    "visibleProof": "project-instructions-visible",
+                    "reason": null
+                  }
+                },
+                "updateInstructions": {
+                  "availability": "available",
+                  "visibleProof": "project-instructions-visible",
+                  "reason": null
+                },
+                "instructionOutcome": "applied_on_creation",
+                "availability": "available",
+                "visibleProof": "native-project-url-name-and-composer-visible",
+                "reason": null,
+                "fallback": null
+              }
+            }
+          ]
+        },
+        "error_json": null,
+        "blocker_json": null,
+        "provider_attempts_json": [],
+        "provider_submitted_at": "2026-07-26T00:00:30Z",
+        "eligible_at": null,
+        "created_at": "2026-07-26T00:00:00Z",
+        "updated_at": "2026-07-26T00:01:00Z"
+      }
+    },
+    {
+      "name": "native-workspace-result",
+      "schema": "#/components/schemas/WorkspaceEnsureResult",
+      "valid": true,
+      "data": {
+        "mode": "native",
+        "requestedMode": "native",
+        "resolvedMode": "native",
+        "name": "Tokenless E2E project-1",
+        "scope": {
+          "provider": "claude",
+          "profileId": "work"
+        },
+        "identity": {
+          "provider": "claude",
+          "name": "Tokenless E2E project-1",
+          "resourceId": "project-1",
+          "canonicalUrl": "https://claude.ai/project/project-1"
+        },
+        "resource": {
+          "kind": "project",
+          "native": true,
+          "disposition": "created",
+          "id": "project-1",
+          "canonicalUrl": "https://claude.ai/project/project-1"
+        },
+        "native": {
+          "resourceKind": "project",
+          "availability": "available",
+          "canonicalUrl": "https://claude.ai/project/project-1",
+          "visibleProof": "native-project-url-name-and-composer-visible",
+          "reason": null,
+          "updateInstructions": {
+            "availability": "available",
+            "visibleProof": "project-instructions-visible",
+            "reason": null
+          }
+        },
+        "updateInstructions": {
+          "availability": "available",
+          "visibleProof": "project-instructions-visible",
+          "reason": null
+        },
+        "instructionOutcome": "applied_on_creation",
+        "availability": "available",
+        "visibleProof": "native-project-url-name-and-composer-visible",
+        "reason": null,
+        "fallback": null
+      }
+    },
+    {
+      "name": "conversation-workspace-result",
+      "schema": "#/components/schemas/WorkspaceEnsureResult",
+      "valid": true,
+      "data": {
+        "mode": "conversation",
+        "requestedMode": "conversation",
+        "resolvedMode": "conversation",
+        "name": "task-1",
+        "scope": {
+          "provider": "gemini",
+          "profileId": "work"
+        },
+        "identity": {
+          "provider": "gemini",
+          "name": "task-1",
+          "resourceId": null,
+          "canonicalUrl": "https://gemini.google.com/app/conversation-1"
+        },
+        "resource": {
+          "kind": "conversation",
+          "native": false,
+          "disposition": "fallback",
+          "id": null,
+          "canonicalUrl": "https://gemini.google.com/app/conversation-1"
+        },
+        "native": {
+          "resourceKind": "project",
+          "availability": "unavailable",
+          "canonicalUrl": null,
+          "visibleProof": null,
+          "reason": "native_workspace_unavailable",
+          "updateInstructions": {
+            "availability": "unavailable",
+            "visibleProof": null,
+            "reason": "native_workspace_instruction_update_unavailable"
+          }
+        },
+        "updateInstructions": {
+          "availability": "unavailable",
+          "visibleProof": null,
+          "reason": "native_workspace_instruction_update_unavailable"
+        },
+        "instructionOutcome": "not_requested",
+        "availability": "available",
+        "visibleProof": "conversation-composer-visible",
+        "reason": null,
+        "fallback": {
+          "mode": "conversation",
+          "resourceKind": "conversation",
+          "availability": "available"
+        }
+      }
+    },
+    {
+      "name": "provider-project-mapping",
+      "schema": "#/components/schemas/ProviderMappingResolveResponse",
+      "valid": true,
+      "data": {
+        "mapping": {
+          "project": {
+            "provider": "claude",
+            "profile_id": "work",
+            "resource_id": "project-1",
+            "name": "Tokenless E2E project-1",
+            "canonical_url": "https://claude.ai/project/project-1",
+            "first_observed_at": "2026-07-26T00:00:00Z",
+            "last_observed_at": "2026-07-26T00:01:00Z",
+            "last_visible_proof": "native-project-url-name-and-composer-visible",
+            "creation_job_id": "job-native-project-1"
+          },
+          "conversation": {
+            "provider": "claude",
+            "profile_id": "work",
+            "project_resource_id": "project-1",
+            "task_id": "task-project-1",
+            "canonical_url": "https://claude.ai/project/project-1/chat/conversation-1",
+            "proved_job_id": "job-native-project-1",
+            "observed_at": "2026-07-26T00:01:00Z"
+          }
+        }
+      }
+    },
+    {
+      "name": "provider-task-conversation-mapping",
+      "schema": "#/components/schemas/ProviderTaskConversationResolveResponse",
+      "valid": true,
+      "data": {
+        "mapping": {
+          "provider": "chatgpt",
+          "profile_id": "work",
+          "task_id": "task-1",
+          "canonical_url": "https://chatgpt.com/c/conversation-1",
+          "proved_job_id": "job-1",
+          "observed_at": "2026-07-26T00:01:00Z"
+        }
+      }
+    },
+    {
+      "name": "replay-drain",
+      "schema": "#/components/schemas/ReplayDrainResponse",
+      "valid": true,
+      "data": {
+        "jobs": [
+          {
+            "job_id": "job-1",
+            "provider": "chatgpt",
+            "action": "visible_provider_actions",
+            "status": "succeeded",
+            "task_id": "task-1",
+            "updated_at": "2026-07-26T00:00:00Z",
+            "reported_at": "2026-07-26T00:01:00Z",
+            "outcome_kind": "result",
+            "has_result": true,
+            "has_error": false,
+            "has_blocker": false
+          }
+        ]
+      }
+    },
+    {
+      "name": "job-report",
+      "schema": "#/components/schemas/JobReportResponse",
+      "valid": true,
+      "data": {
+        "reported": true,
+        "job": {
+          "job_id": "job-1",
+          "execution_backend": "playwright",
+          "profile_id": "work",
+          "provider": "chatgpt",
+          "action": "visible_provider_actions",
+          "status": "succeeded",
+          "request_json": {
+            "taskId": "task-1"
+          },
+          "result_json": {
+            "text": "complete"
+          },
+          "error_json": null,
+          "blocker_json": null,
+          "provider_attempts_json": [],
+          "provider_submitted_at": "2026-07-26T00:00:30Z",
+          "eligible_at": null,
+          "created_at": "2026-07-26T00:00:00Z",
+          "updated_at": "2026-07-26T00:00:00Z"
+        }
+      }
+    }
+  ]
+}
diff --git a/api/tokenless-daemon-api.openapi.json b/api/tokenless-daemon-api.openapi.json
new file mode 100644
index 0000000..cba09dc
--- /dev/null
+++ b/api/tokenless-daemon-api.openapi.json
@@ -0,0 +1,2458 @@
+{
+  "openapi": "3.1.0",
+  "info": {
+    "title": "Tokenless daemon HTTP API",
+    "version": "1.0.0",
+    "description": "Local loopback daemon HTTP API. Every daemon route, readiness proof, error envelope, job payload, and browser runtime control response belongs to this OpenAPI contract."
+  },
+  "servers": [
+    {
+      "url": "http://127.0.0.1:7331",
+      "description": "Preferred loopback origin. The daemon may bind a higher free port and records the actual origin in local SQLite runtime state."
+    }
+  ],
+  "security": [
+    {
+      "controlBearer": []
+    }
+  ],
+  "paths": {
+    "/ready": {
+      "get": {
+        "operationId": "getReady",
+        "summary": "Read token-bound daemon readiness proof without auth",
+        "security": [],
+        "parameters": [
+          {
+            "name": "challenge",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "pattern": "^[A-Za-z0-9_-]{43}$"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Daemon readiness proof",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ReadyResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalError"
+          }
+        }
+      }
+    },
+    "/control/browser-runtime/status": {
+      "get": {
+        "operationId": "getBrowserRuntimeStatus",
+        "summary": "Read embedded browser runtime status",
+        "responses": {
+          "200": {
+            "description": "Browser runtime status",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/BrowserRuntimeStatus"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalError"
+          }
+        }
+      }
+    },
+    "/control/browser-runtime/quiesce": {
+      "post": {
+        "operationId": "quiesceBrowserRuntime",
+        "summary": "Quiesce the embedded browser runtime",
+        "responses": {
+          "200": {
+            "description": "Browser runtime status after quiesce request",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/BrowserRuntimeStatus"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalError"
+          }
+        }
+      }
+    },
+    "/control/browser-runtime/open-profile": {
+      "post": {
+        "operationId": "openBrowserRuntimeProfile",
+        "summary": "Open a managed profile in the embedded browser runtime without provider navigation",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/OpenBrowserRuntimeProfileRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Opened managed profile runtime status",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OpenBrowserRuntimeProfileResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalError"
+          }
+        }
+      }
+    },
+    "/control/browser-runtime/open-provider-tabs": {
+      "post": {
+        "operationId": "openBrowserRuntimeProviderTabs",
+        "summary": "Request supported provider home pages as one background-tab batch in a managed profile",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/OpenBrowserRuntimeProviderTabsRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Accepted provider background-tab requests; page loading continues asynchronously",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OpenBrowserRuntimeProviderTabsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalError"
+          }
+        }
+      }
+    },
+    "/provider-mappings/resolve": {
+      "get": {
+        "operationId": "resolveProviderProjectMapping",
+        "summary": "Resolve an exact provider Project and optional task conversation mapping",
+        "parameters": [
+          {
+            "name": "provider",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 128
+            }
+          },
+          {
+            "name": "profile_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 128
+            }
+          },
+          {
+            "name": "project_name",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 256
+            }
+          },
+          {
+            "name": "task_id",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 256
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Exact provider Project mapping, with a task-scoped conversation when requested",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProviderMappingResolveResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalError"
+          }
+        }
+      }
+    },
+    "/provider-conversations/resolve": {
+      "get": {
+        "operationId": "resolveProviderTaskConversation",
+        "summary": "Resolve a provider conversation by exact profile and task scope",
+        "parameters": [
+          {
+            "name": "provider",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 128
+            }
+          },
+          {
+            "name": "profile_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 128
+            }
+          },
+          {
+            "name": "task_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 256
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Exact provider task conversation mapping",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProviderTaskConversationResolveResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalError"
+          }
+        }
+      }
+    },
+    "/jobs": {
+      "get": {
+        "operationId": "listJobs",
+        "summary": "List public job views",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/status"
+          },
+          {
+            "$ref": "#/components/parameters/execution_backend"
+          },
+          {
+            "$ref": "#/components/parameters/profile_id"
+          },
+          {
+            "$ref": "#/components/parameters/provider"
+          },
+          {
+            "$ref": "#/components/parameters/task_id"
+          },
+          {
+            "$ref": "#/components/parameters/limit"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Jobs",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/JobView"
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalError"
+          }
+        }
+      },
+      "post": {
+        "operationId": "createJob",
+        "summary": "Create a job",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateJobRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Created job",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/JobView"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalError"
+          }
+        }
+      }
+    },
+    "/provider-capacity": {
+      "get": {
+        "operationId": "getProviderCapacity",
+        "summary": "Project the next prompt against known provider capacity",
+        "parameters": [
+          {
+            "name": "provider",
+            "in": "query",
+            "required": true,
+            "schema": { "type": "string", "minLength": 1 }
+          },
+          {
+            "name": "profile_id",
+            "in": "query",
+            "required": true,
+            "schema": { "type": "string", "minLength": 1, "maxLength": 128 }
+          },
+          {
+            "name": "access_class",
+            "in": "query",
+            "required": true,
+            "schema": { "type": "string", "minLength": 1 }
+          },
+          {
+            "name": "tier_label",
+            "in": "query",
+            "schema": { "type": "string", "minLength": 1, "maxLength": 120 }
+          },
+          {
+            "name": "subscription_label",
+            "in": "query",
+            "schema": { "type": "string", "minLength": 1, "maxLength": 120 }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Provider capacity projection",
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/ProviderCapacityProjection" }
+              }
+            }
+          },
+          "400": { "$ref": "#/components/responses/BadRequest" },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "500": { "$ref": "#/components/responses/InternalError" }
+        }
+      }
+    },
+    "/jobs/{job_id}": {
+      "get": {
+        "operationId": "getJob",
+        "summary": "Read a public job view",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/job_id"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Job",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/JobView"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalError"
+          }
+        }
+      }
+    },
+    "/jobs/{job_id}/resume": {
+      "post": {
+        "operationId": "resumeJob",
+        "summary": "Resume a parked Playwright job",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/job_id"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ResumeJobRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/PublicJob"
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
+          "409": {
+            "$ref": "#/components/responses/Conflict"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalError"
+          }
+        }
+      }
+    },
+    "/control/shutdown": {
+      "post": {
+        "operationId": "shutdownDaemon",
+        "summary": "Request graceful daemon shutdown using bearer authentication",
+        "security": [
+          {
+            "controlBearer": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Shutdown accepted",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ShutdownResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "description": "Shutdown route is not mounted by runtimes that use http_router(store); Axum may return its default 404 body."
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalError"
+          }
+        }
+      }
+    },
+    "/jobs/{job_id}/cancel": {
+      "post": {
+        "operationId": "cancelJob",
+        "summary": "Cancel an active job",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/job_id"
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CancelJobRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/PublicJob"
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
+          "409": {
+            "$ref": "#/components/responses/Conflict"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalError"
+          }
+        }
+      }
+    },
+    "/jobs/{job_id}/report": {
+      "post": {
+        "operationId": "reportJobOutcome",
+        "summary": "Mark one addressed job outcome revision as reported",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/job_id"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AgentRecipientRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Idempotent report receipt and public job view",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/JobReportResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalError"
+          }
+        }
+      }
+    },
+    "/replay/drain": {
+      "post": {
+        "operationId": "drainAgentReplay",
+        "summary": "Atomically report pending outcome summaries for one agent recipient",
+        "description": "Eligible outcome revisions are marked reported in SQLite before this response is returned. A lost response is not replayed automatically; full job state remains queryable by job ID.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ReplayDrainRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Newly reported outcome summaries",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ReplayDrainResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalError"
+          }
+        }
+      }
+    }
+  },
+  "components": {
+    "securitySchemes": {
+      "controlBearer": {
+        "type": "http",
+        "scheme": "bearer",
+        "description": "Bearer token read from the daemon home control token file. /ready is a public challenge endpoint; /control/shutdown uses bearer authentication after the CLI verifies /ready for the same home."
+      }
+    },
+    "parameters": {
+      "job_id": {
+        "name": "job_id",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string",
+          "minLength": 1
+        }
+      },
+      "status": {
+        "name": "status",
+        "in": "query",
+        "required": false,
+        "schema": {
+          "$ref": "#/components/schemas/JobStatus"
+        }
+      },
+      "execution_backend": {
+        "name": "execution_backend",
+        "in": "query",
+        "required": false,
+        "schema": {
+          "$ref": "#/components/schemas/ExecutionBackend"
+        }
+      },
+      "profile_id": {
+        "name": "profile_id",
+        "in": "query",
+        "required": false,
+        "schema": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128
+        }
+      },
+      "provider": {
+        "name": "provider",
+        "in": "query",
+        "required": false,
+        "schema": {
+          "type": "string",
+          "minLength": 1
+        }
+      },
+      "task_id": {
+        "name": "task_id",
+        "in": "query",
+        "required": false,
+        "schema": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256
+        }
+      },
+      "action": {
+        "name": "action",
+        "in": "query",
+        "required": false,
+        "schema": {
+          "type": "string",
+          "minLength": 1
+        }
+      },
+      "limit": {
+        "name": "limit",
+        "in": "query",
+        "required": false,
+        "schema": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 1000,
+          "default": 100
+        }
+      }
+    },
+    "responses": {
+      "PublicJob": {
+        "description": "Public job view",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/JobView"
+            }
+          }
+        }
+      },
+      "BadRequest": {
+        "description": "Invalid request body, path, query, or daemon input",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/DaemonErrorResponse"
+            }
+          }
+        }
+      },
+      "Unauthorized": {
+        "description": "Missing bearer token",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/DaemonErrorResponse"
+            }
+          }
+        }
+      },
+      "Forbidden": {
+        "description": "Rejected bearer token or claim token",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/DaemonErrorResponse"
+            }
+          }
+        }
+      },
+      "NotFound": {
+        "description": "Job or routed endpoint not found",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/DaemonErrorResponse"
+            }
+          }
+        }
+      },
+      "Conflict": {
+        "description": "Claim lease or job state conflict",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/DaemonErrorResponse"
+            }
+          }
+        }
+      },
+      "InternalError": {
+        "description": "Daemon internal failure",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/DaemonErrorResponse"
+            }
+          }
+        }
+      }
+    },
+    "schemas": {
+      "DaemonErrorResponse": {
+        "type": "object",
+        "required": [
+          "error"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "error": {
+            "type": "object",
+            "required": [
+              "code",
+              "message",
+              "retryable"
+            ],
+            "additionalProperties": false,
+            "properties": {
+              "code": {
+                "type": "string",
+                "pattern": "^[a-z][a-z0-9_]{0,127}$"
+              },
+              "message": {
+                "type": "string",
+                "minLength": 1
+              },
+              "retryable": {
+                "type": "boolean"
+              },
+              "details": {
+                "type": "object",
+                "additionalProperties": true
+              }
+            }
+          }
+        }
+      },
+      "ReadyResponse": {
+        "type": "object",
+        "required": [
+          "version",
+          "ready",
+          "home_dir",
+          "pid",
+          "proof"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "version": {
+            "type": "string",
+            "minLength": 1
+          },
+          "ready": {
+            "const": true
+          },
+          "home_dir": {
+            "type": "string",
+            "minLength": 1
+          },
+          "pid": {
+            "type": "integer",
+            "minimum": 1
+          },
+          "proof": {
+            "type": "string",
+            "pattern": "^[A-Za-z0-9_-]{43}$"
+          }
+        }
+      },
+      "BrowserRuntimeStatus": {
+        "type": "object",
+        "required": [
+          "status",
+          "activeProfileCount",
+          "activeJobCount",
+          "pid"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "status": {
+            "enum": [
+              "running",
+              "quiescing",
+              "quiesced",
+              "stopped"
+            ]
+          },
+          "activeProfileCount": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 4
+          },
+          "activeJobCount": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "pid": {
+            "type": "integer",
+            "minimum": 1
+          }
+        }
+      },
+      "BrowserVisibility": {
+        "enum": [
+          "auto",
+          "headed",
+          "headless"
+        ]
+      },
+      "EffectiveBrowserVisibility": {
+        "enum": [
+          "headed",
+          "headless"
+        ]
+      },
+      "OpenBrowserRuntimeProfileRequest": {
+        "type": "object",
+        "required": [
+          "profile_id",
+          "browser_visibility"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "profile_id": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128
+          },
+          "browser_visibility": {
+            "$ref": "#/components/schemas/BrowserVisibility"
+          }
+        }
+      },
+      "OpenBrowserRuntimeProfileResponse": {
+        "type": "object",
+        "required": [
+          "profileId",
+          "browserVisibility",
+          "effectiveBrowserVisibility",
+          "pageCount",
+          "status"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "profileId": {
+            "type": "string",
+            "minLength": 1
+          },
+          "browserVisibility": {
+            "$ref": "#/components/schemas/BrowserVisibility"
+          },
+          "effectiveBrowserVisibility": {
+            "$ref": "#/components/schemas/EffectiveBrowserVisibility"
+          },
+          "pageCount": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "status": {
+            "$ref": "#/components/schemas/BrowserRuntimeStatus"
+          }
+        }
+      },
+      "OpenBrowserRuntimeProviderTabsRequest": {
+        "type": "object",
+        "required": [
+          "profile_id",
+          "providers",
+          "browser_visibility"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "profile_id": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128
+          },
+          "providers": {
+            "type": "array",
+            "minItems": 1,
+            "uniqueItems": true,
+            "items": {
+              "type": "string",
+              "pattern": "^[a-z][a-z0-9-]{0,63}$"
+            }
+          },
+          "browser_visibility": {
+            "$ref": "#/components/schemas/BrowserVisibility"
+          }
+        }
+      },
+      "OpenBrowserRuntimeProviderTabsResponse": {
+        "type": "object",
+        "required": [
+          "profileId",
+          "browserVisibility",
+          "effectiveBrowserVisibility",
+          "pageCount",
+          "tabs",
+          "failures",
+          "status"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "profileId": {
+            "type": "string",
+            "minLength": 1
+          },
+          "browserVisibility": {
+            "$ref": "#/components/schemas/BrowserVisibility"
+          },
+          "effectiveBrowserVisibility": {
+            "$ref": "#/components/schemas/EffectiveBrowserVisibility"
+          },
+          "pageCount": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "tabs": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "required": [
+                "provider",
+                "url",
+                "reused"
+              ],
+              "additionalProperties": false,
+              "properties": {
+                "provider": {
+                  "type": "string"
+                },
+                "url": {
+                  "type": "string",
+                  "format": "uri"
+                },
+                "reused": {
+                  "type": "boolean"
+                }
+              }
+            }
+          },
+          "failures": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "required": [
+                "provider",
+                "code",
+                "message"
+              ],
+              "additionalProperties": false,
+              "properties": {
+                "provider": {
+                  "type": "string"
+                },
+                "code": {
+                  "const": "provider_tab_open_failed"
+                },
+                "message": {
+                  "type": "string",
+                  "minLength": 1
+                }
+              }
+            }
+          },
+          "status": {
+            "$ref": "#/components/schemas/BrowserRuntimeStatus"
+          }
+        }
+      },
+      "ManagedOrLegacyRequestJson": {
+        "oneOf": [
+          {
+            "type": "object",
+            "not": {
+              "required": ["protocol"]
+            }
+          },
+          {
+            "$ref": "#/components/schemas/ManagedPlaywrightJobRequest"
+          }
+        ]
+      },
+      "ManagedPlaywrightJobRequest": {
+        "type": "object",
+        "required": [
+          "protocol",
+          "provider",
+          "target",
+          "taskId",
+          "browserVisibility",
+          "actions"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "protocol": {
+            "const": "tokenless.playwright.job.v3"
+          },
+          "provider": {
+            "type": "string",
+            "pattern": "^[a-z][a-z0-9-]{0,63}$"
+          },
+          "target": {
+            "$ref": "#/components/schemas/ManagedPlaywrightTarget"
+          },
+          "taskId": {
+            "type": ["string", "null"],
+            "maxLength": 256
+          },
+          "capabilityRoute": {
+            "oneOf": [
+              { "type": "null" },
+              { "$ref": "#/components/schemas/TaskCapabilityRoute" }
+            ]
+          },
+          "fallback": {
+            "oneOf": [
+              { "type": "null" },
+              { "$ref": "#/components/schemas/ProviderFallbackPlan" }
+            ]
+          },
+          "context": {
+            "oneOf": [
+              { "type": "null" },
+              { "$ref": "#/components/schemas/ContextEnvelope" }
+            ]
+          },
+          "browserVisibility": {
+            "$ref": "#/components/schemas/BrowserVisibility"
+          },
+          "pagePolicy": {
+            "enum": ["preserve", "replace"]
+          },
+          "actions": {
+            "type": "array",
+            "minItems": 1,
+            "maxItems": 100,
+            "items": {
+              "$ref": "#/components/schemas/VisibleActionRequest"
+            }
+          }
+        }
+      },
+      "ManagedPlaywrightTarget": {
+        "type": "object",
+        "required": ["kind", "url"],
+        "additionalProperties": false,
+        "properties": {
+          "kind": { "const": "provider_home" },
+          "url": { "type": "string", "format": "uri", "maxLength": 2048 }
+        }
+      },
+      "TaskCapabilityRoute": {
+        "type": "object",
+        "required": ["schema", "provider", "requirements", "strategies", "support", "evidence", "runtimeEligibility"],
+        "additionalProperties": false,
+        "properties": {
+          "schema": { "const": "tokenless.task-capability-route.v1" },
+          "provider": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" },
+          "requirements": {
+            "type": "array",
+            "uniqueItems": true,
+            "items": { "type": "string", "minLength": 1 }
+          },
+          "strategies": {
+            "type": "array",
+            "uniqueItems": true,
+            "items": { "type": "string", "minLength": 1 }
+          },
+          "support": { "enum": ["experimental", "supported"] },
+          "evidence": {
+            "type": "array",
+            "minItems": 1,
+            "uniqueItems": true,
+            "items": { "type": "string", "minLength": 1 }
+          },
+          "runtimeEligibility": { "enum": ["eligible", "ineligible", "unchecked"] }
+        }
+      },
+      "ProviderFallbackPlan": {
+        "type": "object",
+        "required": ["protocol", "mode", "replay", "alternatives"],
+        "additionalProperties": false,
+        "properties": {
+          "protocol": { "const": "tokenless.provider-fallback.v1" },
+          "mode": { "const": "automatic" },
+          "replay": { "const": "from_start" },
+          "alternatives": {
+            "type": "array",
+            "minItems": 1,
+            "maxItems": 5,
+            "items": {
+              "type": "object",
+              "required": ["provider", "target", "capabilityRoute"],
+              "additionalProperties": false,
+              "properties": {
+                "provider": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" },
+                "target": { "$ref": "#/components/schemas/ManagedPlaywrightTarget" },
+                "capabilityRoute": { "$ref": "#/components/schemas/TaskCapabilityRoute" }
+              }
+            }
+          }
+        }
+      },
+      "ContextEnvelope": {
+        "type": "object",
+        "required": ["schema", "taskId", "requirements", "instructions", "references", "outputContract", "constraints", "upstream", "delivery"],
+        "additionalProperties": false,
+        "properties": {
+          "schema": { "const": "tokenless.context-envelope.v1" },
+          "taskId": { "type": ["string", "null"], "maxLength": 256 },
+          "requirements": { "type": "array", "uniqueItems": true, "items": { "type": "string", "minLength": 1 } },
+          "instructions": {
+            "type": "array",
+            "maxItems": 32,
+            "items": { "$ref": "#/components/schemas/ContextInstruction" }
+          },
+          "references": {
+            "type": "array",
+            "maxItems": 100,
+            "items": { "$ref": "#/components/schemas/ContextAttachmentReference" }
+          },
+          "outputContract": { "$ref": "#/components/schemas/ContextOutputContract" },
+          "constraints": { "$ref": "#/components/schemas/ContextConstraints" },
+          "upstream": { "$ref": "#/components/schemas/ContextUpstream" },
+          "delivery": { "$ref": "#/components/schemas/ContextDelivery" }
+        }
+      },
+      "ContextInstruction": {
+        "type": "object",
+        "required": ["role", "content", "provenance"],
+        "additionalProperties": false,
+        "properties": {
+          "role": { "enum": ["system", "developer", "user"] },
+          "content": { "type": "string", "minLength": 1, "maxLength": 1000000 },
+          "provenance": { "enum": ["compiled_cli", "caller", "upstream_agent"] }
+        }
+      },
+      "ContextAttachmentReference": {
+        "type": "object",
+        "required": ["kind", "attachmentId", "name", "mediaType", "size", "sha256", "provenance"],
+        "additionalProperties": false,
+        "properties": {
+          "kind": { "const": "attachment" },
+          "attachmentId": { "type": "string", "minLength": 1 },
+          "name": { "type": "string", "minLength": 1 },
+          "mediaType": { "type": "string", "minLength": 1 },
+          "size": { "type": "integer", "minimum": 0 },
+          "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+          "provenance": { "const": "caller_selected_file" }
+        }
+      },
+      "ContextOutputContract": {
+        "type": "object",
+        "required": ["language", "format"],
+        "additionalProperties": false,
+        "properties": {
+          "language": { "type": ["string", "null"], "enum": ["en", "zh-CN", null] },
+          "format": { "type": ["string", "null"], "minLength": 1, "maxLength": 120 }
+        }
+      },
+      "ContextConstraints": {
+        "type": "object",
+        "required": ["tokenBudget", "deadline"],
+        "additionalProperties": false,
+        "properties": {
+          "tokenBudget": { "type": ["integer", "null"], "minimum": 1 },
+          "deadline": { "type": ["string", "null"], "format": "date-time" }
+        }
+      },
+      "ContextUpstream": {
+        "type": "object",
+        "required": ["agentKind", "sessionId", "state"],
+        "additionalProperties": false,
+        "properties": {
+          "agentKind": { "type": ["string", "null"], "minLength": 1, "maxLength": 240 },
+          "sessionId": { "type": ["string", "null"], "minLength": 1, "maxLength": 240 },
+          "state": {
+            "oneOf": [
+              { "type": "null" },
+              { "type": "object", "additionalProperties": true }
+            ]
+          }
+        }
+      },
+      "ContextDelivery": {
+        "type": "object",
+        "required": ["mode", "promptActions"],
+        "additionalProperties": false,
+        "properties": {
+          "mode": { "const": "visible_actions" },
+          "promptActions": {
+            "type": "array",
+            "maxItems": 100,
+            "items": { "$ref": "#/components/schemas/ContextPromptActionReceipt" }
+          }
+        }
+      },
+      "ContextPromptActionReceipt": {
+        "type": "object",
+        "required": ["requestId", "sha256", "bytes"],
+        "additionalProperties": false,
+        "properties": {
+          "requestId": { "type": "string", "minLength": 1 },
+          "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+          "bytes": { "type": "integer", "minimum": 0 }
+        }
+      },
+      "VisibleActionRequest": {
+        "type": "object",
+        "required": ["protocol", "requestId", "provider", "action", "payload"],
+        "additionalProperties": false,
+        "properties": {
+          "protocol": { "const": "tokenless.playwright.visible-action.v3" },
+          "requestId": { "type": "string", "minLength": 1 },
+          "provider": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" },
+          "action": { "type": "string", "minLength": 1 },
+          "payload": { "type": "object" }
+        }
+      },
+      "ExecutionBackend": {
+        "enum": [
+          "playwright"
+        ]
+      },
+      "JobStatus": {
+        "enum": [
+          "queued",
+          "claimed",
+          "running",
+          "waiting_for_user",
+          "succeeded",
+          "failed",
+          "canceled",
+          "timed_out"
+        ]
+      },
+      "JobView": {
+        "type": "object",
+        "required": [
+          "job_id",
+          "execution_backend",
+          "profile_id",
+          "provider",
+          "action",
+          "status",
+          "request_json",
+          "result_json",
+          "error_json",
+          "blocker_json",
+          "provider_attempts_json",
+          "provider_submitted_at",
+          "eligible_at",
+          "created_at",
+          "updated_at"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "job_id": {
+            "type": "string",
+            "minLength": 1
+          },
+          "execution_backend": {
+            "$ref": "#/components/schemas/ExecutionBackend"
+          },
+          "profile_id": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "provider": {
+            "type": "string",
+            "minLength": 1
+          },
+          "action": {
+            "type": "string",
+            "minLength": 1
+          },
+          "status": {
+            "$ref": "#/components/schemas/JobStatus"
+          },
+          "request_json": {
+            "$ref": "#/components/schemas/ManagedOrLegacyRequestJson"
+          },
+          "result_json": {},
+          "error_json": {},
+          "blocker_json": {},
+          "provider_attempts_json": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "required": [
+                "attempt",
+                "provider",
+                "status",
+                "startedAt",
+                "completedAt",
+                "blocker"
+              ],
+              "additionalProperties": false,
+              "properties": {
+                "attempt": { "type": "integer", "minimum": 1 },
+                "provider": { "type": "string", "minLength": 1 },
+                "status": { "type": "string", "minLength": 1 },
+                "startedAt": { "type": "string", "format": "date-time" },
+                "completedAt": { "type": ["string", "null"], "format": "date-time" },
+                "blocker": {}
+              }
+            }
+          },
+          "provider_submitted_at": {
+            "type": ["string", "null"],
+            "format": "date-time"
+          },
+          "eligible_at": {
+            "type": ["string", "null"],
+            "format": "date-time"
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "updated_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "ProviderCapacityProjection": {
+        "type": "object",
+        "required": [
+          "schema", "catalogVersion", "catalogRevision", "provider", "profileId",
+          "evaluatedAt", "subscription", "decision", "eligibleAt", "reason", "rules"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "schema": { "const": "tokenless.provider-capacity-projection.v1" },
+          "catalogVersion": { "type": "integer", "minimum": 1 },
+          "catalogRevision": { "type": "string", "format": "date" },
+          "provider": { "type": "string", "minLength": 1 },
+          "profileId": { "type": "string", "minLength": 1 },
+          "evaluatedAt": { "type": "string", "format": "date-time" },
+          "subscription": {
+            "type": "object",
+            "required": ["accessClass", "observedLabel", "planId", "match"],
+            "additionalProperties": false,
+            "properties": {
+              "accessClass": { "type": "string", "minLength": 1 },
+              "observedLabel": { "type": ["string", "null"] },
+              "planId": { "type": "string", "minLength": 1 },
+              "match": { "enum": ["label", "access_class", "unknown"] }
+            }
+          },
+          "decision": { "enum": ["admit", "defer", "unknown"] },
+          "eligibleAt": { "type": ["string", "null"], "format": "date-time" },
+          "reason": { "type": "string", "minLength": 1 },
+          "rules": {
+            "type": "array",
+            "items": { "$ref": "#/components/schemas/ProviderRuleCapacityProjection" }
+          }
+        }
+      },
+      "ProviderRuleCapacityProjection": {
+        "type": "object",
+        "required": [
+          "ruleId", "knowledge", "action", "windowSeconds", "publishedAllowance",
+          "effectiveAllowance", "usedUnits", "requestedUnits", "remainingUnits",
+          "burstUnits", "cadenceSeconds", "decision", "eligibleAt", "reason"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "ruleId": { "type": "string", "minLength": 1 },
+          "knowledge": { "enum": ["official_exact", "non_numeric"] },
+          "action": { "type": "string", "minLength": 1 },
+          "windowSeconds": { "type": ["integer", "null"], "minimum": 1 },
+          "publishedAllowance": { "type": ["integer", "null"], "minimum": 1 },
+          "effectiveAllowance": { "type": ["integer", "null"], "minimum": 1 },
+          "usedUnits": { "type": ["integer", "null"], "minimum": 0 },
+          "requestedUnits": { "type": "integer", "minimum": 0 },
+          "remainingUnits": { "type": ["integer", "null"], "minimum": 0 },
+          "burstUnits": { "type": ["integer", "null"], "minimum": 1 },
+          "cadenceSeconds": { "type": ["number", "null"], "exclusiveMinimum": 0 },
+          "decision": { "enum": ["admit", "defer", "unknown"] },
+          "eligibleAt": { "type": ["string", "null"], "format": "date-time" },
+          "reason": { "type": "string", "minLength": 1 }
+        }
+      },
+      "ProviderProjectMapping": {
+        "type": "object",
+        "required": [
+          "provider",
+          "profile_id",
+          "resource_id",
+          "name",
+          "canonical_url",
+          "first_observed_at",
+          "last_observed_at",
+          "last_visible_proof",
+          "creation_job_id"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "provider": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128
+          },
+          "profile_id": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128
+          },
+          "resource_id": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256
+          },
+          "name": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256
+          },
+          "canonical_url": {
+            "type": "string",
+            "format": "uri",
+            "pattern": "^https://"
+          },
+          "first_observed_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "last_observed_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "last_visible_proof": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 512
+          },
+          "creation_job_id": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "maxLength": 256
+          }
+        }
+      },
+      "ProviderProjectConversationMapping": {
+        "type": "object",
+        "required": [
+          "provider",
+          "profile_id",
+          "project_resource_id",
+          "task_id",
+          "canonical_url",
+          "proved_job_id",
+          "observed_at"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "provider": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128
+          },
+          "profile_id": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128
+          },
+          "project_resource_id": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256
+          },
+          "task_id": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256
+          },
+          "canonical_url": {
+            "type": "string",
+            "format": "uri",
+            "pattern": "^https://"
+          },
+          "proved_job_id": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256
+          },
+          "observed_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "ProviderTaskConversationMapping": {
+        "type": "object",
+        "required": [
+          "provider",
+          "profile_id",
+          "task_id",
+          "canonical_url",
+          "proved_job_id",
+          "observed_at"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "provider": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128
+          },
+          "profile_id": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128
+          },
+          "task_id": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256
+          },
+          "canonical_url": {
+            "type": "string",
+            "format": "uri",
+            "pattern": "^https://"
+          },
+          "proved_job_id": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256
+          },
+          "observed_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "ProviderMappingResolveResponse": {
+        "type": "object",
+        "required": [
+          "mapping"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "mapping": {
+            "oneOf": [
+              {
+                "type": "object",
+                "required": [
+                  "project",
+                  "conversation"
+                ],
+                "additionalProperties": false,
+                "properties": {
+                  "project": {
+                    "$ref": "#/components/schemas/ProviderProjectMapping"
+                  },
+                  "conversation": {
+                    "oneOf": [
+                      {
+                        "$ref": "#/components/schemas/ProviderProjectConversationMapping"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "type": "null"
+              }
+            ]
+          }
+        }
+      },
+      "ProviderTaskConversationResolveResponse": {
+        "type": "object",
+        "required": [
+          "mapping"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "mapping": {
+            "oneOf": [
+              {
+                "$ref": "#/components/schemas/ProviderTaskConversationMapping"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          }
+        }
+      },
+      "WorkspaceEnsureResult": {
+        "oneOf": [
+          {
+            "$ref": "#/components/schemas/NativeWorkspaceEnsureResult"
+          },
+          {
+            "$ref": "#/components/schemas/ConversationWorkspaceEnsureResult"
+          }
+        ]
+      },
+      "NativeWorkspaceEnsureResult": {
+        "type": "object",
+        "required": [
+          "mode",
+          "requestedMode",
+          "resolvedMode",
+          "name",
+          "scope",
+          "identity",
+          "resource",
+          "native",
+          "updateInstructions",
+          "instructionOutcome",
+          "availability",
+          "visibleProof",
+          "reason",
+          "fallback"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "mode": {
+            "const": "native"
+          },
+          "requestedMode": {
+            "enum": [
+              "auto",
+              "native"
+            ]
+          },
+          "resolvedMode": {
+            "const": "native"
+          },
+          "name": {
+            "type": "string",
+            "minLength": 1
+          },
+          "scope": {
+            "$ref": "#/components/schemas/WorkspaceScope"
+          },
+          "identity": {
+            "type": "object",
+            "required": [
+              "provider",
+              "name",
+              "resourceId",
+              "canonicalUrl"
+            ],
+            "additionalProperties": false,
+            "properties": {
+              "provider": {
+                "type": "string",
+                "minLength": 1
+              },
+              "name": {
+                "type": "string",
+                "minLength": 1
+              },
+              "resourceId": {
+                "type": "string",
+                "minLength": 1
+              },
+              "canonicalUrl": {
+                "type": "string",
+                "format": "uri",
+                "pattern": "^https://"
+              }
+            }
+          },
+          "resource": {
+            "type": "object",
+            "required": [
+              "kind",
+              "native",
+              "disposition",
+              "id",
+              "canonicalUrl"
+            ],
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "project"
+              },
+              "native": {
+                "const": true
+              },
+              "disposition": {
+                "enum": [
+                  "created",
+                  "reused"
+                ]
+              },
+              "id": {
+                "type": "string",
+                "minLength": 1
+              },
+              "canonicalUrl": {
+                "type": "string",
+                "format": "uri",
+                "pattern": "^https://"
+              }
+            }
+          },
+          "native": {
+            "type": "object",
+            "required": [
+              "resourceKind",
+              "availability",
+              "canonicalUrl",
+              "visibleProof",
+              "reason",
+              "updateInstructions"
+            ],
+            "additionalProperties": false,
+            "properties": {
+              "resourceKind": {
+                "const": "project"
+              },
+              "availability": {
+                "const": "available"
+              },
+              "canonicalUrl": {
+                "type": "string",
+                "format": "uri",
+                "pattern": "^https://"
+              },
+              "visibleProof": {
+                "type": "string",
+                "minLength": 1
+              },
+              "reason": {
+                "type": "null"
+              },
+              "updateInstructions": {
+                "$ref": "#/components/schemas/NativeWorkspaceInstructionUpdate"
+              }
+            }
+          },
+          "updateInstructions": {
+            "$ref": "#/components/schemas/NativeWorkspaceInstructionUpdate"
+          },
+          "instructionOutcome": {
+            "$ref": "#/components/schemas/WorkspaceInstructionOutcome"
+          },
+          "availability": {
+            "const": "available"
+          },
+          "visibleProof": {
+            "type": "string",
+            "minLength": 1
+          },
+          "reason": {
+            "type": "null"
+          },
+          "fallback": {
+            "type": "null"
+          }
+        }
+      },
+      "ConversationWorkspaceEnsureResult": {
+        "type": "object",
+        "required": [
+          "mode",
+          "requestedMode",
+          "resolvedMode",
+          "name",
+          "scope",
+          "identity",
+          "resource",
+          "native",
+          "updateInstructions",
+          "instructionOutcome",
+          "availability",
+          "visibleProof",
+          "reason",
+          "fallback"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "mode": {
+            "const": "conversation"
+          },
+          "requestedMode": {
+            "enum": [
+              "auto",
+              "conversation"
+            ]
+          },
+          "resolvedMode": {
+            "const": "conversation"
+          },
+          "name": {
+            "type": "string",
+            "minLength": 1
+          },
+          "scope": {
+            "$ref": "#/components/schemas/WorkspaceScope"
+          },
+          "identity": {
+            "type": "object",
+            "required": [
+              "provider",
+              "name",
+              "resourceId",
+              "canonicalUrl"
+            ],
+            "additionalProperties": false,
+            "properties": {
+              "provider": {
+                "type": "string",
+                "minLength": 1
+              },
+              "name": {
+                "type": "string",
+                "minLength": 1
+              },
+              "resourceId": {
+                "type": "null"
+              },
+              "canonicalUrl": {
+                "oneOf": [
+                  {
+                    "type": "string",
+                    "format": "uri",
+                    "pattern": "^https://"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ]
+              }
+            }
+          },
+          "resource": {
+            "type": "object",
+            "required": [
+              "kind",
+              "native",
+              "disposition",
+              "id",
+              "canonicalUrl"
+            ],
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "conversation"
+              },
+              "native": {
+                "const": false
+              },
+              "disposition": {
+                "const": "fallback"
+              },
+              "id": {
+                "type": "null"
+              },
+              "canonicalUrl": {
+                "oneOf": [
+                  {
+                    "type": "string",
+                    "format": "uri",
+                    "pattern": "^https://"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ]
+              }
+            }
+          },
+          "native": {
+            "type": "object",
+            "required": [
+              "resourceKind",
+              "availability",
+              "canonicalUrl",
+              "visibleProof",
+              "reason",
+              "updateInstructions"
+            ],
+            "additionalProperties": false,
+            "properties": {
+              "resourceKind": {
+                "const": "project"
+              },
+              "availability": {
+                "const": "unavailable"
+              },
+              "canonicalUrl": {
+                "type": "null"
+              },
+              "visibleProof": {
+                "type": "null"
+              },
+              "reason": {
+                "type": "string",
+                "minLength": 1
+              },
+              "updateInstructions": {
+                "$ref": "#/components/schemas/UnavailableWorkspaceInstructionUpdate"
+              }
+            }
+          },
+          "updateInstructions": {
+            "$ref": "#/components/schemas/UnavailableWorkspaceInstructionUpdate"
+          },
+          "instructionOutcome": {
+            "$ref": "#/components/schemas/WorkspaceInstructionOutcome"
+          },
+          "availability": {
+            "const": "available"
+          },
+          "visibleProof": {
+            "type": "string",
+            "minLength": 1
+          },
+          "reason": {
+            "oneOf": [
+              {
+                "type": "string",
+                "minLength": 1
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "fallback": {
+            "oneOf": [
+              {
+                "type": "object",
+                "required": [
+                  "mode",
+                  "resourceKind",
+                  "availability"
+                ],
+                "additionalProperties": false,
+                "properties": {
+                  "mode": {
+                    "const": "conversation"
+                  },
+                  "resourceKind": {
+                    "const": "conversation"
+                  },
+                  "availability": {
+                    "const": "available"
+                  }
+                }
+              },
+              {
+                "type": "null"
+              }
+            ]
+          }
+        }
+      },
+      "WorkspaceScope": {
+        "type": "object",
+        "required": [
+          "provider",
+          "profileId"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "provider": {
+            "type": "string",
+            "minLength": 1
+          },
+          "profileId": {
+            "type": "string",
+            "minLength": 1
+          }
+        }
+      },
+      "WorkspaceInstructionOutcome": {
+        "enum": [
+          "not_requested",
+          "applied_on_creation",
+          "already_equivalent",
+          "skipped_on_reuse",
+          "unavailable"
+        ]
+      },
+      "NativeWorkspaceInstructionUpdate": {
+        "type": "object",
+        "required": [
+          "availability",
+          "visibleProof",
+          "reason"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "availability": {
+            "enum": [
+              "available",
+              "unavailable"
+            ]
+          },
+          "visibleProof": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "reason": {
+            "type": [
+              "string",
+              "null"
+            ]
+          }
+        }
+      },
+      "UnavailableWorkspaceInstructionUpdate": {
+        "type": "object",
+        "required": [
+          "availability",
+          "visibleProof",
+          "reason"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "availability": {
+            "const": "unavailable"
+          },
+          "visibleProof": {
+            "type": "null"
+          },
+          "reason": {
+            "type": "string",
+            "minLength": 1
+          }
+        }
+      },
+      "CreateJobRequest": {
+        "type": "object",
+        "required": [
+          "provider",
+          "action",
+          "request_json"
+        ],
+        "additionalProperties": false,
+        "dependentRequired": {
+          "agent_kind": [
+            "agent_session_id"
+          ],
+          "agent_session_id": [
+            "agent_kind"
+          ]
+        },
+        "properties": {
+          "provider": {
+            "type": "string",
+            "minLength": 1
+          },
+          "action": {
+            "type": "string",
+            "minLength": 1
+          },
+          "request_json": {
+            "$ref": "#/components/schemas/ManagedOrLegacyRequestJson"
+          },
+          "execution_backend": {
+            "$ref": "#/components/schemas/ExecutionBackend"
+          },
+          "profile_id": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128
+          },
+          "agent_kind": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128
+          },
+          "agent_session_id": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256
+          },
+          "job_id": {
+            "type": "string",
+            "minLength": 1
+          }
+        }
+      },
+      "AgentRecipientRequest": {
+        "type": "object",
+        "required": [
+          "agent_kind",
+          "agent_session_id"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "agent_kind": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128
+          },
+          "agent_session_id": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256
+          }
+        }
+      },
+      "ReplayDrainRequest": {
+        "type": "object",
+        "required": [
+          "agent_kind",
+          "agent_session_id"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "agent_kind": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128
+          },
+          "agent_session_id": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256
+          },
+          "limit": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 200,
+            "default": 100
+          }
+        }
+      },
+      "ReplaySummary": {
+        "type": "object",
+        "required": [
+          "job_id",
+          "provider",
+          "action",
+          "status",
+          "task_id",
+          "updated_at",
+          "reported_at",
+          "outcome_kind",
+          "has_result",
+          "has_error",
+          "has_blocker"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "job_id": {
+            "type": "string",
+            "minLength": 1
+          },
+          "provider": {
+            "type": "string",
+            "minLength": 1
+          },
+          "action": {
+            "type": "string",
+            "minLength": 1
+          },
+          "status": {
+            "enum": [
+              "waiting_for_user",
+              "succeeded",
+              "failed",
+              "canceled",
+              "timed_out"
+            ]
+          },
+          "task_id": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "maxLength": 256
+          },
+          "updated_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "reported_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "outcome_kind": {
+            "enum": [
+              "result",
+              "error",
+              "blocker",
+              "none"
+            ]
+          },
+          "has_result": {
+            "type": "boolean"
+          },
+          "has_error": {
+            "type": "boolean"
+          },
+          "has_blocker": {
+            "type": "boolean"
+          }
+        }
+      },
+      "ReplayDrainResponse": {
+        "type": "object",
+        "required": [
+          "jobs"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "jobs": {
+            "type": "array",
+            "maxItems": 200,
+            "items": {
+              "$ref": "#/components/schemas/ReplaySummary"
+            }
+          }
+        }
+      },
+      "JobReportResponse": {
+        "type": "object",
+        "required": [
+          "reported",
+          "job"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "reported": {
+            "type": "boolean"
+          },
+          "job": {
+            "$ref": "#/components/schemas/JobView"
+          }
+        }
+      },
+      "ResumeJobRequest": {
+        "type": "object",
+        "required": [
+          "browser_visibility"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "browser_visibility": {
+            "const": "headed"
+          }
+        }
+      },
+      "CancelJobRequest": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "reason": {}
+        }
+      },
+      "ShutdownResponse": {
+        "type": "object",
+        "required": [
+          "ok",
+          "status",
+          "pid"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "ok": {
+            "const": true
+          },
+          "status": {
+            "const": "shutting_down"
+          },
+          "pid": {
+            "type": "integer",
+            "minimum": 1
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/api/tokenless-ui-api.openapi.json b/api/tokenless-ui-api.openapi.json
new file mode 100644
index 0000000..8d732b5
--- /dev/null
+++ b/api/tokenless-ui-api.openapi.json
@@ -0,0 +1,430 @@
+{
+  "openapi": "3.1.0",
+  "info": {
+    "title": "Tokenless Browser UI API",
+    "version": "1.0.0",
+    "description": "Authenticated, loopback-only API consumed by the bundled Tokenless control plane. Browser JavaScript never receives the daemon bearer token."
+  },
+  "servers": [
+    {
+      "url": "http://127.0.0.1:{port}/ui-api/v1",
+      "variables": { "port": { "default": "7331" } }
+    }
+  ],
+  "security": [{ "uiSession": [] }],
+  "paths": {
+    "/session": {
+      "get": {
+        "operationId": "getUiSession",
+        "responses": {
+          "200": { "$ref": "#/components/responses/Session" },
+          "401": { "$ref": "#/components/responses/Error" }
+        }
+      }
+    },
+    "/snapshot": {
+      "get": {
+        "operationId": "getUiSnapshot",
+        "parameters": [
+          { "name": "If-None-Match", "in": "header", "schema": { "type": "string" } }
+        ],
+        "responses": {
+          "200": { "$ref": "#/components/responses/Snapshot" },
+          "304": { "description": "Snapshot revision is unchanged." },
+          "401": { "$ref": "#/components/responses/Error" }
+        }
+      }
+    },
+    "/config": {
+      "patch": {
+        "operationId": "updateUiConfig",
+        "security": [{ "uiSession": [], "csrf": [] }],
+        "requestBody": { "$ref": "#/components/requestBodies/ConfigUpdate" },
+        "responses": {
+          "200": { "$ref": "#/components/responses/Config" },
+          "400": { "$ref": "#/components/responses/Error" },
+          "403": { "$ref": "#/components/responses/Error" }
+        }
+      }
+    },
+    "/profiles": {
+      "post": {
+        "operationId": "createUiProfile",
+        "security": [{ "uiSession": [], "csrf": [] }],
+        "requestBody": { "$ref": "#/components/requestBodies/ProfileCreate" },
+        "responses": {
+          "201": { "$ref": "#/components/responses/Profile" },
+          "400": { "$ref": "#/components/responses/Error" }
+        }
+      }
+    },
+    "/profiles/{profileId}": {
+      "parameters": [{ "$ref": "#/components/parameters/ProfileId" }],
+      "patch": {
+        "operationId": "updateUiProfile",
+        "security": [{ "uiSession": [], "csrf": [] }],
+        "requestBody": { "$ref": "#/components/requestBodies/ProfileUpdate" },
+        "responses": { "200": { "$ref": "#/components/responses/Profile" }, "400": { "$ref": "#/components/responses/Error" } }
+      },
+      "delete": {
+        "operationId": "removeUiProfile",
+        "security": [{ "uiSession": [], "csrf": [] }],
+        "responses": { "200": { "$ref": "#/components/responses/ProfileRemoval" }, "400": { "$ref": "#/components/responses/Error" } }
+      }
+    },
+    "/profiles/{profileId}/open": {
+      "post": {
+        "operationId": "openUiProfile",
+        "security": [{ "uiSession": [], "csrf": [] }],
+        "parameters": [{ "$ref": "#/components/parameters/ProfileId" }],
+        "responses": { "200": { "$ref": "#/components/responses/RuntimeOpen" }, "400": { "$ref": "#/components/responses/Error" } }
+      }
+    },
+    "/profiles/{profileId}/providers/{providerId}/actions/{action}": {
+      "post": {
+        "operationId": "runUiProviderAction",
+        "security": [{ "uiSession": [], "csrf": [] }],
+        "parameters": [
+          { "$ref": "#/components/parameters/ProfileId" },
+          { "$ref": "#/components/parameters/ProviderId" },
+          { "name": "action", "in": "path", "required": true, "schema": { "type": "string", "enum": ["open", "readiness", "controls"] } }
+        ],
+        "responses": { "202": { "$ref": "#/components/responses/JobSummary" }, "400": { "$ref": "#/components/responses/Error" } }
+      }
+    },
+    "/profiles/{profileId}/providers/{providerId}/selection": {
+      "post": {
+        "operationId": "selectUiProviderControl",
+        "security": [{ "uiSession": [], "csrf": [] }],
+        "parameters": [
+          { "$ref": "#/components/parameters/ProfileId" },
+          { "$ref": "#/components/parameters/ProviderId" }
+        ],
+        "requestBody": { "$ref": "#/components/requestBodies/ProviderSelection" },
+        "responses": { "202": { "$ref": "#/components/responses/JobSummary" }, "400": { "$ref": "#/components/responses/Error" } }
+      }
+    },
+    "/jobs/{jobId}": {
+      "get": {
+        "operationId": "getUiJob",
+        "parameters": [{ "$ref": "#/components/parameters/JobId" }],
+        "responses": { "200": { "$ref": "#/components/responses/JobDetail" }, "404": { "$ref": "#/components/responses/Error" } }
+      }
+    },
+    "/jobs/{jobId}/cancel": {
+      "post": {
+        "operationId": "cancelUiJob",
+        "security": [{ "uiSession": [], "csrf": [] }],
+        "parameters": [{ "$ref": "#/components/parameters/JobId" }],
+        "responses": { "200": { "$ref": "#/components/responses/JobDetail" }, "400": { "$ref": "#/components/responses/Error" } }
+      }
+    },
+    "/jobs/{jobId}/resume": {
+      "post": {
+        "operationId": "resumeUiJob",
+        "security": [{ "uiSession": [], "csrf": [] }],
+        "parameters": [{ "$ref": "#/components/parameters/JobId" }],
+        "responses": { "200": { "$ref": "#/components/responses/JobDetail" }, "400": { "$ref": "#/components/responses/Error" } }
+      }
+    },
+    "/runtime/quiesce": {
+      "post": {
+        "operationId": "quiesceUiRuntime",
+        "security": [{ "uiSession": [], "csrf": [] }],
+        "responses": { "200": { "$ref": "#/components/responses/RuntimeOperation" } }
+      }
+    }
+  },
+  "components": {
+    "securitySchemes": {
+      "uiSession": { "type": "apiKey", "in": "cookie", "name": "tokenless_ui_session" },
+      "csrf": { "type": "apiKey", "in": "header", "name": "X-Tokenless-CSRF" }
+    },
+    "parameters": {
+      "ProfileId": { "name": "profileId", "in": "path", "required": true, "schema": { "$ref": "#/components/schemas/ProfileId" } },
+      "ProviderId": { "name": "providerId", "in": "path", "required": true, "schema": { "$ref": "#/components/schemas/ProviderId" } },
+      "JobId": { "name": "jobId", "in": "path", "required": true, "schema": { "type": "string", "minLength": 1, "maxLength": 256 } }
+    },
+    "requestBodies": {
+      "ConfigUpdate": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConfigUpdate" } } } },
+      "ProfileCreate": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProfileCreate" } } } },
+      "ProfileUpdate": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProfileUpdate" } } } },
+      "ProviderSelection": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProviderSelection" } } } }
+    },
+    "responses": {
+      "Session": { "description": "Active in-memory UI session.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UiSession" } } } },
+      "Snapshot": { "description": "Redacted aggregate dashboard state.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UiSnapshot" } } } },
+      "Config": { "description": "Persisted public configuration.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UiConfig" } } } },
+      "Profile": { "description": "Purpose-built managed profile view.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Profile" } } } },
+      "ProfileRemoval": { "description": "Profile removal acknowledgement.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProfileRemoval" } } } },
+      "JobSummary": { "description": "Redacted durable job summary.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/JobSummary" } } } },
+      "JobDetail": { "description": "Redacted durable job detail.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/JobDetail" } } } },
+      "RuntimeOpen": { "description": "Managed profile browser open result.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RuntimeOpenResult" } } } },
+      "RuntimeOperation": { "description": "Browser runtime operation result.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RuntimeStatus" } } } },
+      "Error": { "description": "Redacted error envelope.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorEnvelope" } } } }
+    },
+    "schemas": {
+      "ProfileId": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]{0,63}$" },
+      "ProviderId": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" },
+      "BrowserVisibility": { "type": "string", "enum": ["auto", "headed", "headless"] },
+      "Proxy": {
+        "type": ["object", "null"],
+        "properties": {
+          "server": { "type": "string", "format": "uri", "pattern": "^(?:https?|socks5)://" },
+          "bypass": { "type": "array", "maxItems": 100, "uniqueItems": true, "items": { "type": "string", "minLength": 1 } }
+        },
+        "required": ["server", "bypass"],
+        "additionalProperties": false
+      },
+      "ProfilePreferences": {
+        "type": "object",
+        "properties": {
+          "profileId": { "$ref": "#/components/schemas/ProfileId" },
+          "roleLabel": { "type": "string", "maxLength": 80 },
+          "enabledProviders": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/components/schemas/ProviderId" } },
+          "browserVisibility": { "$ref": "#/components/schemas/BrowserVisibility" },
+          "proxy": { "$ref": "#/components/schemas/Proxy" }
+        },
+        "required": ["profileId", "roleLabel", "enabledProviders", "browserVisibility", "proxy"],
+        "additionalProperties": false
+      },
+      "UiConfig": {
+        "type": "object",
+        "properties": {
+          "updatedAt": { "type": ["string", "null"], "format": "date-time" },
+          "providerWhitelist": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
+          "browser": { "type": "string" },
+          "browserExecutablePathConfigured": { "type": "boolean" },
+          "browserConnectionMode": { "type": "string", "enum": ["playwright", "cdp"] },
+          "browserVisibility": { "$ref": "#/components/schemas/BrowserVisibility" },
+          "daemonUrl": { "type": ["string", "null"], "format": "uri" },
+          "language": { "type": "string", "enum": ["en", "zh-CN"] }
+        },
+        "required": ["updatedAt", "providerWhitelist", "browser", "browserExecutablePathConfigured", "browserConnectionMode", "browserVisibility", "daemonUrl", "language"],
+        "additionalProperties": false
+      },
+      "RuntimeStatus": {
+        "type": "object",
+        "properties": {
+          "status": { "type": "string" },
+          "activeProfileCount": { "type": "integer", "minimum": 0, "maximum": 4 },
+          "activeJobCount": { "type": "integer", "minimum": 0 },
+          "pid": { "type": "integer", "minimum": 1 }
+        },
+        "required": ["status", "activeProfileCount", "activeJobCount", "pid"],
+        "additionalProperties": true
+      },
+      "DaemonStatus": {
+        "type": "object",
+        "properties": {
+          "version": { "type": "string" },
+          "origin": { "type": "string", "format": "uri" },
+          "uptimeMs": { "type": "integer", "minimum": 0 },
+          "pid": { "type": "integer", "minimum": 1 }
+        },
+        "required": ["version", "origin", "uptimeMs", "pid"],
+        "additionalProperties": false
+      },
+      "RuntimeOpenResult": {
+        "type": "object",
+        "properties": {
+          "profileId": { "type": "string", "format": "uuid" },
+          "browserVisibility": { "$ref": "#/components/schemas/BrowserVisibility" },
+          "effectiveBrowserVisibility": { "type": "string", "enum": ["headed", "headless"] },
+          "pageCount": { "type": "integer", "minimum": 0 },
+          "status": { "$ref": "#/components/schemas/RuntimeStatus" }
+        },
+        "required": ["profileId", "browserVisibility", "effectiveBrowserVisibility", "pageCount", "status"],
+        "additionalProperties": false
+      },
+      "Profile": {
+        "type": "object",
+        "properties": {
+          "slug": { "$ref": "#/components/schemas/ProfileId" },
+          "id": { "type": "string", "format": "uuid" },
+          "label": { "type": "string", "minLength": 1, "maxLength": 80 },
+          "lifecycle": { "type": "string" },
+          "isDefault": { "type": "boolean" },
+          "createdAt": { "type": "string", "format": "date-time" },
+          "updatedAt": { "type": "string", "format": "date-time" },
+          "runtimeBinding": { "type": ["object", "null"] },
+          "import": { "type": ["object", "null"] },
+          "preferences": { "$ref": "#/components/schemas/ProfilePreferences" },
+          "observations": { "type": "array", "items": { "type": "object" } }
+        },
+        "required": ["slug", "id", "label", "lifecycle", "isDefault", "createdAt", "updatedAt", "runtimeBinding", "import", "preferences", "observations"],
+        "additionalProperties": false
+      },
+      "JobSummary": {
+        "type": "object",
+        "properties": {
+          "jobId": { "type": "string" },
+          "profileId": { "type": ["string", "null"] },
+          "profileSlug": { "anyOf": [{ "$ref": "#/components/schemas/ProfileId" }, { "type": "null" }] },
+          "provider": { "type": "string" },
+          "action": { "type": "string" },
+          "status": { "type": "string" },
+          "taskId": { "type": ["string", "null"] },
+          "capabilityRoute": { "type": ["object", "null"] },
+          "agent": { "type": ["object", "null"] },
+          "blocker": {},
+          "createdAt": { "type": "string", "format": "date-time" },
+          "updatedAt": { "type": "string", "format": "date-time" }
+        },
+        "required": ["jobId", "profileId", "profileSlug", "provider", "action", "status", "taskId", "capabilityRoute", "agent", "blocker", "createdAt", "updatedAt"],
+        "additionalProperties": false
+      },
+      "JobDetail": {
+        "allOf": [
+          { "$ref": "#/components/schemas/JobSummary" },
+          {
+            "type": "object",
+            "properties": { "result": {}, "error": {}, "providerAttempts": {} },
+            "required": ["result", "error", "providerAttempts"]
+          }
+        ]
+      },
+      "ProviderProfileState": {
+        "type": "object",
+        "properties": {
+          "profileId": { "$ref": "#/components/schemas/ProfileId" },
+          "enabled": { "type": "boolean" },
+          "observation": { "type": ["object", "null"] },
+          "runtimeEligibility": { "type": "string", "enum": ["eligible", "ineligible"] },
+          "capabilities": { "type": "array", "items": { "type": "object" } },
+          "controls": { "type": "object" }
+        },
+        "required": ["profileId", "enabled", "observation", "runtimeEligibility", "capabilities", "controls"],
+        "additionalProperties": false
+      },
+      "Provider": {
+        "type": "object",
+        "properties": {
+          "id": { "$ref": "#/components/schemas/ProviderId" },
+          "label": { "type": "string" },
+          "stage": { "type": "string" },
+          "homeUrl": { "type": "string", "format": "uri" },
+          "profiles": { "type": "array", "items": { "$ref": "#/components/schemas/ProviderProfileState" } }
+        },
+        "required": ["id", "label", "stage", "homeUrl", "profiles"],
+        "additionalProperties": false
+      },
+      "Capability": {
+        "type": "object",
+        "properties": {
+          "id": { "type": "string" },
+          "title": { "type": "string" },
+          "description": { "type": "string" },
+          "family": { "type": "string" },
+          "lifecycle": { "type": "string" },
+          "stability": { "type": "string" },
+          "requiredEvidence": { "type": "array", "items": { "type": "string" } },
+          "providers": { "type": "array", "items": { "type": "object" } }
+        },
+        "required": ["id", "title", "description", "family", "lifecycle", "stability", "requiredEvidence", "providers"],
+        "additionalProperties": false
+      },
+      "Diagnostic": {
+        "type": "object",
+        "properties": {
+          "id": { "type": "string" },
+          "state": { "type": "string", "enum": ["ok", "action_required", "error"] },
+          "message": { "type": ["string", "null"] }
+        },
+        "required": ["id", "state", "message"],
+        "additionalProperties": false
+      },
+      "UiSnapshot": {
+        "type": "object",
+        "properties": {
+          "schema": { "const": "tokenless.ui-snapshot.v1" },
+          "generatedAt": { "type": "string", "format": "date-time" },
+          "revision": { "type": "string", "minLength": 1 },
+          "daemon": { "$ref": "#/components/schemas/DaemonStatus" },
+          "runtime": { "$ref": "#/components/schemas/RuntimeStatus" },
+          "config": { "$ref": "#/components/schemas/UiConfig" },
+          "profiles": { "type": "array", "items": { "$ref": "#/components/schemas/Profile" } },
+          "providers": { "type": "array", "items": { "$ref": "#/components/schemas/Provider" } },
+          "capabilities": { "type": "array", "items": { "$ref": "#/components/schemas/Capability" } },
+          "jobs": { "type": "array", "items": { "$ref": "#/components/schemas/JobSummary" } },
+          "diagnostics": { "type": "array", "items": { "$ref": "#/components/schemas/Diagnostic" } }
+        },
+        "required": ["schema", "generatedAt", "revision", "daemon", "runtime", "config", "profiles", "providers", "capabilities", "jobs", "diagnostics"],
+        "additionalProperties": false
+      },
+      "UiSession": {
+        "type": "object",
+        "properties": {
+          "csrf": { "type": "string", "minLength": 32 },
+          "expiresAt": { "type": "string", "format": "date-time" }
+        },
+        "required": ["csrf", "expiresAt"],
+        "additionalProperties": false
+      },
+      "ProfileRemoval": {
+        "type": "object",
+        "properties": { "slug": { "$ref": "#/components/schemas/ProfileId" }, "removed": { "const": true } },
+        "required": ["slug", "removed"],
+        "additionalProperties": false
+      },
+      "ErrorEnvelope": {
+        "type": "object",
+        "properties": {
+          "error": {
+            "type": "object",
+            "properties": { "code": { "type": "string" }, "message": { "type": "string" } },
+            "required": ["code", "message"],
+            "additionalProperties": false
+          }
+        },
+        "required": ["error"],
+        "additionalProperties": false
+      },
+      "ConfigUpdate": {
+        "type": "object",
+        "properties": {
+          "browser": { "type": "string" },
+          "browserExecutablePath": { "type": ["string", "null"], "minLength": 1 },
+          "browserVisibility": { "$ref": "#/components/schemas/BrowserVisibility" },
+          "language": { "type": "string", "enum": ["en", "zh-CN"] }
+        },
+        "additionalProperties": false
+      },
+      "ProfileCreate": {
+        "type": "object",
+        "properties": {
+          "slug": { "$ref": "#/components/schemas/ProfileId" },
+          "label": { "type": "string", "minLength": 1, "maxLength": 80 },
+          "roleLabel": { "type": "string", "maxLength": 80 },
+          "enabledProviders": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/components/schemas/ProviderId" } },
+          "browserVisibility": { "$ref": "#/components/schemas/BrowserVisibility" },
+          "proxy": { "$ref": "#/components/schemas/Proxy" },
+          "setDefault": { "type": "boolean" }
+        },
+        "required": ["slug"],
+        "additionalProperties": false
+      },
+      "ProfileUpdate": {
+        "type": "object",
+        "properties": {
+          "label": { "type": "string", "minLength": 1, "maxLength": 80 },
+          "roleLabel": { "type": "string", "maxLength": 80 },
+          "enabledProviders": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/components/schemas/ProviderId" } },
+          "browserVisibility": { "$ref": "#/components/schemas/BrowserVisibility" },
+          "proxy": { "$ref": "#/components/schemas/Proxy" },
+          "setDefault": { "type": "boolean" }
+        },
+        "additionalProperties": false
+      },
+      "ProviderSelection": {
+        "type": "object",
+        "properties": {
+          "kind": { "type": "string", "enum": ["model", "effort"] },
+          "label": { "type": "string", "minLength": 1, "maxLength": 120 }
+        },
+        "required": ["kind", "label"],
+        "additionalProperties": false
+      }
+    }
+  }
+}
diff --git a/assets/tokenless-logo-v1.png b/assets/tokenless-logo-v1.png
new file mode 100644
index 0000000..2e9417f
Binary files /dev/null and b/assets/tokenless-logo-v1.png differ
diff --git a/assets/tokenless-mark.png b/assets/tokenless-mark.png
new file mode 100644
index 0000000..3cf2307
Binary files /dev/null and b/assets/tokenless-mark.png differ
diff --git a/assets/tokenless-wordmark.png b/assets/tokenless-wordmark.png
new file mode 100644
index 0000000..290a92d
Binary files /dev/null and b/assets/tokenless-wordmark.png differ
diff --git a/design/assets/tokenless-local-ui-implemented-1080p.png b/design/assets/tokenless-local-ui-implemented-1080p.png
new file mode 100644
index 0000000..b6979fe
Binary files /dev/null and b/design/assets/tokenless-local-ui-implemented-1080p.png differ
diff --git a/design/assets/tokenless-local-ui-v0-desktop.png b/design/assets/tokenless-local-ui-v0-desktop.png
new file mode 100644
index 0000000..9a6b834
Binary files /dev/null and b/design/assets/tokenless-local-ui-v0-desktop.png differ
diff --git a/design/assets/tokenless-local-ui-v0-mobile.png b/design/assets/tokenless-local-ui-v0-mobile.png
new file mode 100644
index 0000000..c61a5ce
Binary files /dev/null and b/design/assets/tokenless-local-ui-v0-mobile.png differ
diff --git a/design/assets/tokenless-local-ui-v1-desktop-1080p.png b/design/assets/tokenless-local-ui-v1-desktop-1080p.png
new file mode 100644
index 0000000..c098f17
Binary files /dev/null and b/design/assets/tokenless-local-ui-v1-desktop-1080p.png differ
diff --git a/design/tokenless-local-ui-v0.md b/design/tokenless-local-ui-v0.md
new file mode 100644
index 0000000..3dc237d
--- /dev/null
+++ b/design/tokenless-local-ui-v0.md
@@ -0,0 +1,113 @@
+# Tokenless Local UI v0
+
+Status: design review complete; implementation pending approval
+
+## Product position
+
+Tokenless is a localhost operational control center, not a marketing dashboard. The interface optimizes for fast recognition and safe configuration with minimal reading.
+
+- Narrative role: configure one managed profile and understand local runtime state.
+- Viewing distance: laptop-first, with a 390px mobile layout.
+- Visual temperature: quiet, precise, and authoritative.
+- Capacity: five primary operational areas plus System in desktop navigation and mobile overflow.
+
+## Reference synthesis
+
+The design combines interaction patterns rather than reproducing one product:
+
+- [Linear display options](https://linear.app/docs/display-options): compact icon actions, keyboard-oriented interaction, and controls revealed in context.
+- [Vercel project settings](https://vercel.com/docs/project-configuration/project-settings): stable settings hierarchy and focused editing surfaces.
+- [Tailscale local web interface](https://tailscale.com/kb/1325/device-web-interface): a browser-based local configuration surface backed by a local runtime.
+- [Tailscale device filters](https://tailscale.com/docs/features/access-control/device-management/how-to/filter): concise operational state, search, and progressive filtering.
+
+## Brand assets
+
+- Mark: `assets/tokenless-mark.png`
+- Desktop design: `design/assets/tokenless-local-ui-v0-desktop.png`
+- Full HD desktop design: `design/assets/tokenless-local-ui-v1-desktop-1080p.png` (`1920×1080`, 16:9)
+- Mobile design: `design/assets/tokenless-local-ui-v0-mobile.png`
+
+## Design system
+
+- Palette: warm off-white `#F7F6F2`, white surface, graphite `#171716`, muted `#74736D`, hairline `#E5E3DD`, black primary action, green only for healthy/connected state.
+- Typography: compact neutral grotesk; restrained weights; no remote font dependency.
+- Spacing: 4px base with 8px primary rhythm.
+- Radius: 6px controls, 8px maximum surface radius.
+- Elevation: no routine shadows; hierarchy comes from spacing, surface tone, and hairlines.
+- Motion: 160–200ms state transitions; no decorative motion; honor reduced motion.
+- Targets: minimum 44px interactive area.
+
+## Information architecture
+
+Desktop uses a 60px icon rail:
+
+1. Overview
+2. Profiles
+3. Providers
+4. Capabilities
+5. Jobs
+6. System
+
+Mobile keeps the five operational destinations in a bottom icon bar and moves System into the top overflow menu. Profile selection becomes a compact top switcher. The content model remains identical across breakpoints.
+
+The Profiles screen uses master–detail:
+
+- profile list;
+- selected profile inspector;
+- configuration rows for identity, browser, visibility, providers, and proxy;
+- one save action that appears enabled only when the form is dirty.
+
+## Progressive disclosure rules
+
+- Icon-only navigation always has an accessible name; desktop shows a tooltip on hover and keyboard focus.
+- Keep field labels visible. Icons do not replace labels when the value would become ambiguous.
+- Put explanations, timestamps, evidence, and repair details in popovers, drawers, or dialogs.
+- Use a drawer for Proxy details and provider observations.
+- Use dialogs only for destructive confirmation, user handoff, or a blocking error.
+- Do not show helper paragraphs when a label, value, state, or tooltip is sufficient.
+- Do not rely on color alone for status; pair it with an accessible label or icon shape.
+- Provider chips show enabled state with both a quiet fill and a check mark.
+
+## Interaction model
+
+- Navigation: icon rail or mobile bottom bar.
+- Profile switch: list on desktop, drawer-triggering switcher on mobile.
+- Editing: row click opens an inline control or focused drawer.
+- Save: disabled when clean, black when dirty, busy state while persisting, then a short success toast.
+- More actions: three-dot menu for open browser, make default, and remove.
+- Dangerous actions: never appear as a primary inline action.
+- Errors: attach to the affected row first; use a toast only for request-level failure.
+
+## Design critique
+
+Overall: 8.8 / 10
+
+- Philosophy alignment: 9.3 — operational, minimal, and free of dashboard decoration.
+- Visual hierarchy: 9.1 — profile selection, editable values, and save action scan immediately.
+- Craft quality: 8.8 — disciplined spacing and hairlines; real implementation must preserve exact alignment.
+- Functionality: 8.7 — edit and enabled-state affordances are now explicit without adding copy.
+- Originality: 8.0 — intentionally familiar tool UI, differentiated through Tokenless's warm monochrome system.
+
+Implementation checks:
+
+- Provider chips must wrap rather than shrink below touch-target size.
+- Tooltips must work for pointer and keyboard users.
+- Mobile connected state needs an accessible text alternative even when only the dot is visible.
+- The Save button must not imply unsaved changes when the form is clean.
+- Empty, offline, expired-session, loading, error, and disabled states must preserve the same sparse composition.
+
+## Image-generation prompt set
+
+Both designs were generated with the built-in ChatGPT image tool using `assets/tokenless-mark.png` as the brand reference.
+
+Desktop prompt:
+
+> Create a high-fidelity, shippable Tokenless localhost control center focused on editing one managed browser profile. Use a 60px icon-only rail, a compact profile list, and one calm inspector pane. Show only Identity, Browser, Visibility, Providers, Proxy, connection state, and Save changes. Use the Tokenless mark faithfully. Follow a warm off-white monochrome system with hairline separators, compact controls, tooltip-based icon labels, no card wall, no gradients, no charts, no illustrations, no marketing copy, and no remote-brand logos.
+
+Refinement prompt:
+
+> Preserve the desktop design and change only two affordances: add a pencil icon to Identity and show enabled Provider chips with a quiet selected fill plus check marks.
+
+Mobile prompt:
+
+> Translate the approved desktop design into a practical 390×844 mobile web layout. Use a compact top bar, profile switcher, single-column configuration rows, full-width dirty Save action, and a five-icon bottom navigation. Preserve the exact warm monochrome system and add no explanatory copy or new sections.
diff --git a/docs/README.md b/docs/README.md
new file mode 100644
index 0000000..3e18fd3
--- /dev/null
+++ b/docs/README.md
@@ -0,0 +1,38 @@
+# Tokenless Documentation
+
+This index separates user guidance, stable product contracts, implementation architecture, provider research, and future roadmaps so each document has one clear responsibility.
+
+## Start Here
+
+- [README](../README.md) — product overview, installation, and first run.
+- [CLI Commands](../COMMANDS.md) — complete command and option reference.
+- [Capability Matrix](capability-matrix.md) — canonical outcomes, current provider mappings, support states, and extension rules.
+- [Privacy](../PRIVACY.md) — browser-profile, credential, file, and local-data boundaries.
+
+## Concepts and Architecture
+
+- [Architecture](architecture.md) — daemon, managed browser, provider adapter, routing, and control-plane design.
+- [Provider Capability Census](provider-capability-census.md) — provider product reconnaissance and evidence gaps; not a support declaration.
+- [Roadmaps](roadmaps/README.md) — active, backlog, and archived delivery plans.
+
+## Provider and Capability Development
+
+- Start with the [Capability Matrix extension process](capability-matrix.md#adding-a-new-capability).
+- Follow the [Provider DOM Fixture Policy](../test/fixtures/provider-dom/README.md).
+- Declare required real-provider cases in [`live-provider-capability-matrix.json`](../test/live-provider-capability-matrix.json).
+- Implement real journeys in [`live-managed-playwright.e2e.mjs`](../test/live-managed-playwright.e2e.mjs).
+- Keep provider-specific behavior under [`packages/cli/src/providers/`](../packages/cli/src/providers/).
+
+## Adding Documentation
+
+- Put installation and first-run guidance in the paired root READMEs.
+- Put stable user and developer contracts under `docs/` and link them from this index.
+- Put complete CLI syntax in the paired `COMMANDS` references rather than duplicating it across guides.
+- Keep product reconnaissance in the capability census; observed product features are not support declarations.
+- Keep intended work, sequencing, and incomplete acceptance criteria under `docs/roadmaps/`; directory location defines roadmap lifecycle.
+- Add an English and Simplified Chinese partner for every reasonable user-facing document, keep their structure and meaning aligned, and update this index in the same change.
+- Prefer links to one source of truth over copied tables. When a small user-facing summary is useful, name the runtime or source file that remains authoritative.
+
+## Language
+
+User-facing documentation is maintained in English and Simplified Chinese. Use the `*.zh-CN.md` partner for Chinese; internal technical records may remain English when translation adds no user value.
diff --git a/docs/README.zh-CN.md b/docs/README.zh-CN.md
new file mode 100644
index 0000000..eeef18f
--- /dev/null
+++ b/docs/README.zh-CN.md
@@ -0,0 +1,38 @@
+# Tokenless 文档
+
+本索引将用户指南、稳定产品契约、implementation architecture、provider research 与未来 roadmap 分开，使每份文档只有一个明确职责。
+
+## 从这里开始
+
+- [README](../README.zh-CN.md) — 产品概览、安装与首次运行。
+- [CLI 命令](../COMMANDS.zh-CN.md) — 完整 command 与 option reference。
+- [Capability Matrix](capability-matrix.zh-CN.md) — canonical outcomes、当前 provider mappings、support states 与扩展规则。
+- [隐私政策](../PRIVACY.md) — browser profile、credential、file 与本地数据边界。
+
+## 概念与架构
+
+- [架构](architecture.md) — daemon、managed browser、provider adapter、routing 与 control-plane 设计。
+- [Provider Capability Census](provider-capability-census.md) — provider 产品调研与 evidence gaps；不代表 support 声明。
+- [Roadmaps](roadmaps/README.md) — active、backlog 与 archived delivery plans。
+
+## Provider 与 Capability 开发
+
+- 从 [Capability Matrix 扩展流程](capability-matrix.zh-CN.md#新增-capability) 开始。
+- 遵守 [Provider DOM Fixture Policy](../test/fixtures/provider-dom/README.md)。
+- 在 [`live-provider-capability-matrix.json`](../test/live-provider-capability-matrix.json) 声明必需的真实 provider cases。
+- 在 [`live-managed-playwright.e2e.mjs`](../test/live-managed-playwright.e2e.mjs) 实现真实 journeys。
+- Provider-specific behavior 应保留在 [`packages/cli/src/providers/`](../packages/cli/src/providers/) 中。
+
+## 新增文档
+
+- 安装与首次运行指南放在配对的 root README 中。
+- 稳定的用户与开发者契约放在 `docs/` 下，并从本索引链接。
+- 完整 CLI syntax 放在配对的 `COMMANDS` reference 中，避免在不同 guide 重复维护。
+- 产品调研保留在 capability census；观察到产品功能不代表 Tokenless support 声明。
+- 计划工作、执行顺序与未完成 acceptance criteria 放在 `docs/roadmaps/`；目录位置定义 roadmap lifecycle。
+- 每份合理的 user-facing document 都要提供英文与简体中文版本，保持结构和语义对齐，并在同一次 change 中更新本索引。
+- 优先链接到单一 source of truth，不复制大表。如果需要简短的 user-facing summary，要明确哪个 runtime output 或 source file 才是权威来源。
+
+## 语言
+
+User-facing documentation 同时维护英文和简体中文。中文使用对应的 `*.zh-CN.md`；当翻译无法增加用户价值时，内部技术记录可以只保留英文。
diff --git a/docs/architecture.md b/docs/architecture.md
index 0a68882..c216086 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -1,73 +1,156 @@
 # Tokenless Architecture
 
-Tokenless exposes visible AI websites through a provider-neutral local CLI today. Managed Playwright through the authenticated local daemon is the only execution path; a public local API is planned but is not a compatibility surface yet.
+Tokenless exposes visible AI websites through a provider-neutral local CLI and a browser-based local control plane. Managed Playwright through the authenticated local daemon remains the only provider execution path. The machine bearer API and browser session API are separate trust boundaries.
 
 ## Components
 
 1. The `tokenless` CLI handles setup, profile management, job submission, state, cancellation, and diagnostics.
-2. The local Rust daemon stores jobs in SQLite and exposes an authenticated loopback control plane.
+2. The local TypeScript daemon stores jobs in SQLite and exposes an authenticated loopback control plane.
 3. The Playwright worker claims managed-web jobs and runs them in persistent managed browser profiles.
-4. Provider adapters translate shared actions into visible ChatGPT, Claude, Gemini, and Grok page operations.
-5. A public local API is planned as a second interface to the same application and job contracts.
+4. The provider navigation catalog centrally declares each entry URL, automation home, owned origins, known page patterns, and trusted sign-in routes; the provider registry adds access, account-plan, selector, and capability policy for ChatGPT, Claude, Gemini, Grok, Qwen, DeepSeek, Perplexity, Z.ai, and Doubao.
+5. The provider-session state machine turns visible page observations and catalog policy into ready, guest-continuation, handoff, wait, or terminal decisions.
+6. Provider adapters translate shared actions into visible provider page operations after the session decision allows them.
+7. Shared application services expose redacted config, profile, provider, capability, job, runtime, and diagnostic operations to the local control plane.
+8. The bundled TypeScript SPA is served from `/ui/`; its authenticated `/ui-api/v1` surface never exposes the daemon control bearer token to browser JavaScript.
 
 ## Execution path
 
-`tokenless run` submits a managed Playwright job through the local daemon. Tokenless never resends a failed request through another provider or runtime path.
+`tokenless run` submits a managed Playwright job through the local daemon. For an implicit, provider-neutral, pre-submit run, the same durable job may move to another provider only through its capability-ranked fallback plan. It never switches runtime paths, degrades a required capability, or replays after an ambiguous or confirmed submission.
 
 | Interface | Execution path | Authentication | Status |
 | --- | --- | --- | --- |
 | CLI | CLI → daemon → Playwright worker → managed profile → visible provider page | Provider sign-in stored inside the managed profile | Primary interface |
-| Local API | Local API → daemon → Playwright worker → managed profile → visible provider page | Provider sign-in stored inside the managed profile | Planned; schemas and client authentication are not public yet |
+| Local dashboard | Browser → `/ui-api/v1` → shared services/daemon → managed profile → visible provider page | One-time bootstrap ticket plus short-lived UI session; provider sign-in remains inside the managed profile | Local administration interface |
+| Machine API | Trusted local caller → bearer API → daemon → Playwright worker | Daemon bearer token plus provider sign-in inside the managed profile | Local scripting interface |
 
 ## Managed Playwright flow
 
 ```text
 request
-  → resolve provider and managed profile
-  → validate target, actions, files, and limits
+  → derive the complete task capability set
+  → rank compatible providers by live eligibility, evidence maturity, and configured preference
+  → validate target, actions, context envelope, files, and limits
   → create an authenticated daemon job
   → Playwright worker claims the job for that profile
+  → recheck visible session and task-capability eligibility before mutation
   → provider adapter operates visible page controls
   → verify visible postconditions
+  → atomically requeue the same job on the next ranked provider only for a classified safe pre-submit failure
   → complete the daemon job
   → return normalized result and citations
 ```
 
 Jobs use explicit provider and profile identity. Unsupported controls, ambiguous pages, unexpected navigation, authentication blockers, and selector drift fail closed.
 
+The job contract derives requirements again from visible actions, attachment media types, and native workspace intent. A caller cannot under-declare `file.upload`, media input, chat, or native workspace requirements to manufacture an unsafe fallback route. Every alternative carries the identical implication-complete requirement set. Provider-specific conversation and Project URLs, provider controls, exact continuation, non-reconstructable mutations, and post-submission state suppress automatic fallback with a structured reason.
+
+Before opening a provider page, each attempt also projects known profile-scoped provider capacity from the checked-in official-source catalog and durable submission history. A known exhausted window consumes the next full-capability route when one exists; otherwise the same job is durably deferred until its calculated eligibility time. Unknown or non-numeric limits remain explicit uncertainty and never become invented quotas.
+
+Each routed job carries `tokenless.context-envelope.v1`. It records the task identity, normalized requirements, role-bearing instructions, attachment provenance, output and constraint contracts, upstream agent state, and hashes of the prompt actions that actually deliver the context. Provider changes replay the same validated envelope and action payloads from the start.
+
 ## Setup and profiles
 
-`tokenless setup` is the interactive onboarding flow. It installs both agent skills, discovers supported browsers, selects providers, and offers two profile paths:
+`tokenless setup` is the interactive onboarding flow. It first crosses the `BrowserRuntimeManager` seam to discover, install when authorized, and verify one exact runtime. It then selects or creates a clean runtime-compatible profile, collects that profile's provider membership, commits the preference, aligns the global skills and daemon with the installed CLI, and checks only the selected providers. Tokenless never copies an existing Chrome, Brave, or Cloak profile or its authentication state; users sign in through the visible clean managed profile and the browser preserves that managed session across jobs.
+
+`tokenless setup --fresh` is the clean-profile path. Add `--json` for non-interactive setup. On a new installation it creates `default`, selects the first supported browser, uses an explicit or existing provider scope (falling back to every non-disabled provider only when none exists), checks the installed CLI against the latest npm release, runs the same skills-and-daemon maintenance reconciler used by the verified new CLI during `tokenless upgrade`, and checks each enabled provider's visible sign-in status once. Interactive setup then opens the reserved dashboard tab; machine-oriented and `--no-open` runs return `tokenless dashboard` as the later handoff. Ordinary daemon startup uses the Tokenless Daemon API v1 OpenAPI contract: readiness comes from the same-home proof and exact package version on `/ready`, with API version recorded only in OpenAPI `info.version`. Job, action, and local recovery payloads keep internal schema IDs where persisted validation needs them; they are not negotiated across the CLI-daemon boundary. Setup may replace a daemon only when a verified same-home daemon reports a different package version. Foreign, different-home, and unverified listeners remain untouched. Shutdown verifies `/ready` for the same home immediately before sending the bearer token to `/control/shutdown`; Tokenless never kills a process merely because it occupies the configured loopback port. An unavailable npm registry is reported as an advisory check failure rather than making an otherwise runnable local setup fail.
+
+Browser selection is system-first. `auto` uses an installed supported browser and lazily installs catalog-pinned Chrome for Testing 145 only when none exists. `managed-chromium` forces that cache-managed runtime; `cloak` explicitly opts into the platform-specific Cloak release. Managed downloads happen only during setup or install, pass fixed SHA-256, archive-path, executable-version, sandboxed smoke-launch, and atomic-cache checks, and are never performed by npm postinstall, daemon startup, or a job. Cloak binaries are downloaded from the official release and are not redistributed by Tokenless.
+
+Each managed profile stores a runtime binding containing the exact runtime identity, family, browser ID, and creation version. The daemon resolves from this binding and always passes the resulting executable path to Playwright. It never reinterprets the global preference, silently falls back across runtime families, or opens a profile with an older browser. Existing unbound profiles can migrate only to a compatible system/test runtime; a family change provisions a clean profile.
+
+Managed profiles live under the Tokenless home and use unique directories. Jobs reuse them but never import, reset, clear, or replace them automatically. New profiles always start clean; deletion requires an explicit command and confirmation.
+
+Authentication status is a single visible observation, not an enforced login workflow. A provider-specific account control is authenticated evidence; it does not have to be clicked to prove the state. A visible login surface is unauthenticated evidence. For guest-capable providers, an unauthenticated visible composer produces `access: guest`; for providers that require an account it produces `access: sign_in_required`. A page that has not stabilized may be reported honestly as `unknown`. Setup does not retry after login or open a handoff.
+
+Successful account observations retain only the visible account display name, subscription evidence, and the normalized tier class `signed_in_free`, `signed_in_paid`, or `signed_in_unknown`. Plan labels remain diagnostic: they never authorize a capability. Grok derives plan evidence from visible model entitlements: all of `Auto`, `Expert`, and `Heavy` unavailable means `Free`, while any available entitlement means `SuperGrok`.
+
+`profiles status` runs this provider-page inspection and persists the observation. `profiles list` is a registry read: it reports the last saved observation and never refreshes a provider page implicitly.
+
+Normal provider actions do not run the setup authentication report. Before a gated action, the provider-session state machine waits up to 15 seconds for the page to expose a stable account, guest composer, sign-in surface, challenge, or terminal blocker. ChatGPT, Gemini, experimental Qwen, experimental Perplexity, and experimental Z.ai may proceed in guest mode. Claude, Grok, DeepSeek, and experimental Doubao hand off before the adapter enters or submits task content when no authenticated session is established. A visible exact guest-continuation control may be accepted once, followed by a fresh observation.
+
+## Provider architecture and session state machine
+
+`packages/cli/src/providers/registry.ts` is the single production registration point for providers. Each entry is a concrete `BaseProvider` subclass with one provider-owned definition. Shared CLI, daemon, setup, profile, and Playwright code resolves providers through that registry instead of maintaining provider allowlists or branching on concrete provider IDs.
+
+`BaseProvider` owns the public execution template and the invariant ordering for navigation validation, authentication, blocker checks, prompt operations, response observation, and normalized failures. Its protected TypeScript hooks provide the shared DOM implementation and use normal dynamic dispatch, so a provider subclass overrides only behavior that differs. The runner calls the stable public provider contract and does not select child-class methods itself.
 
-- Import one existing Chrome or Brave profile with explicit consent. Only selected provider sign-in state is copied into a separate managed directory; the source remains unchanged.
-- Create a clean managed profile and sign in through the visible provider page.
+Optional behavior is composed through typed structural capability slots. File upload, model and effort selection, workspace handling, diagnostics, conversation continuation, and image generation can be replaced independently without widening the mandatory base-class contract. Provider-specific extensions can register their own typed capability and actions without promoting a provider-only concept into the shared slots; current examples are Qwen's `qwen.mode` and Doubao's `doubao.mode` plus `doubao.skill`. A capability object must satisfy the relevant TypeScript interface; it does not need to inherit from a framework class.
 
-`tokenless setup --fresh` is the clean-profile path. Add `--json` for non-interactive setup. On a new installation it creates `default`, selects the first supported browser and ChatGPT, starts the runtime, and opens the provider when user action is required.
+Adding a provider therefore normally requires:
 
-Managed profiles live under the Tokenless home and use unique directories. Jobs reuse them but never import, reset, clear, or replace them automatically. Import, reset, and deletion require explicit commands and consent.
+1. one provider definition backed by real visible-session evidence;
+2. one `BaseProvider` subclass, with protected hook overrides only for genuine differences;
+3. typed optional capability overrides only when the provider differs from the shared defaults; and
+4. one registry entry.
+
+Observation, account classification, decisions, and resolution live under `packages/cli/src/playwright/provider-session/`. The runner consumes normalized decisions; provider-owned code remains the only place for provider-specific visible-page behavior.
+
+| Provider | Guest policy | Account-name strategy | Plan strategy |
+| --- | --- | --- | --- |
+| ChatGPT | Supported | Visible account control text | `Free`; paid `Go`, `Plus`, `Pro`, `Team`, `Business`, or `Enterprise` |
+| Claude | Sign-in required | Visible account control text | `Free`; paid `Pro`, `Max`, `Team`, or `Enterprise` |
+| Gemini | Supported | Google account ARIA label | Unknown until reliable visible plan evidence is available |
+| Grok | Sign-in required | Visible account control text | Derived from visible model entitlements as `Free` or `SuperGrok` |
+| Qwen | Supported | Visible account control text when signed in | Unknown until reliable visible plan evidence is available |
+| DeepSeek | Sign-in required | Visible account control text | Unknown until reliable visible plan evidence is available |
+| Perplexity | Supported | Visible menu or account control text when signed in | Unknown until reliable visible plan evidence is available |
+| Z.ai | Supported | Visible menu or account control text when signed in | Unknown until reliable visible plan evidence is available |
+| Doubao | Sign-in required | Visible account control image | Unknown until reliable visible plan evidence is available |
+
+The provider-session machine is intentionally separate from the daemon job state machine:
+
+- The provider-session machine handles one page observation cycle: `wait`, `continue_guest`, `ready(guest|account|unknown)`, `handoff`, or `terminal`.
+- The daemon state machine owns durable execution: `queued`, `claimed`, `running`, `waiting_for_user`, `succeeded`, `failed`, `canceled`, and `timed_out`.
+- A provider `handoff` becomes the daemon's durable `waiting_for_user` state. It does not create a replacement job.
+- A plan, quota, rate-limit, maintenance, region, capability-UI, navigation, or surface-readiness failure remains structurally classified and is not collapsed into authentication. A safe pre-submit provider-scoped failure may consume the next capability-compatible fallback route; ambiguous external state and post-submission failures never do.
 
 ## Local control plane
 
-The daemon binds to loopback, stores its bearer token beside its SQLite database, and protects job and control endpoints with that token. The daemon home and token use restrictive filesystem permissions on supported systems.
+The daemon binds to loopback, stores its bearer token beside its SQLite database, and protects job and control endpoints with that token. The daemon home and token use restrictive filesystem permissions on supported systems. User configuration stores a preferred loopback origin. The daemon may scan upward from that port when it is occupied, while a single SQLite runtime-state row records the current actual origin, startup generation, and owner. CLI processes probe that row and coordinate startup through a compare-and-swap lease; no operating-system service actively restarts the daemon.
+
+The bearer-protected machine endpoints remain an internal runtime control plane. Browser administration uses a separate `/ui-api/v1` surface documented in `api/tokenless-ui-api.openapi.json`. An authenticated CLI call mints a random, 60-second, single-use ticket; `/ui/bootstrap` consumes it, sets an `HttpOnly`, `SameSite=Strict`, path-scoped session cookie, and redirects to `/ui/` so the ticket leaves browser history. UI mutations require the exact daemon Origin and a per-session CSRF header. Sessions live only in daemon memory and are invalidated on restart.
 
-These HTTP endpoints are an internal runtime control plane, not the planned browser-facing API. A future web client must keep the daemon bearer token inside a trusted local backend rather than exposing it to browser JavaScript.
+All UI routes enforce the daemon's exact loopback `Host`, a restrictive same-origin CSP, `frame-ancestors 'none'`, `nosniff`, and `Referrer-Policy: no-referrer`. The browser application lives under `packages/cli/src/daemon/ui`: `app.ts` is the single startup interface, the dashboard controller owns state and event orchestration, the HTTP client owns session/CSRF/ETag behavior, and page modules are pure renderers. A dedicated `tsconfig.ui.json` type-checks and emits browser-native ES modules separately from the Node daemon build. Static assets are still bundled in the same npm package, served by the daemon, and load no remote JavaScript, fonts, analytics, or CDN resources. Purpose-built responses redact control tokens, claims, checkpoints, browser storage, raw DOM, legacy source paths, and private file paths. Bounded polling uses revision ETags and defers rendering while a form has uncommitted edits; there is no SSE or WebSocket transport.
 
-Job creation, claim, lease renewal, completion, cancellation, and state queries are daemon-backed. Claims are correlated to one worker and expire safely. CLI cancellation is reported as complete only after the authenticated control endpoint confirms `canceled`.
+The dashboard's reserved page key is `tokenless:control-plane:<daemon-home-id>`. It has a separate registry from provider page leases, cannot be selected by provider `pagePolicy: replace`, is focused rather than duplicated, and is recreated if the user closes it. Closing the tab does not stop the daemon or managed context.
+
+Job creation, claim, lease renewal, completion, cancellation, state queries, and agent replay are daemon-backed. Before readiness is activated, startup reconciles expired claims and durable Playwright checkpoints, then starts the runner. Claims are correlated to one worker and expire safely. CLI cancellation is reported as complete only after the authenticated control endpoint confirms `canceled`.
+
+Jobs may be addressed to an explicit `agent_kind` and `agent_session_id`. SQLite assigns a monotonic outcome revision whenever an externally visible waiting or terminal outcome changes. `POST /replay/drain` selects only unreported actionable revisions for that recipient, marks them reported in the same immediate transaction, and then returns allowlisted metadata. This is intentional at-most-once reporting, not a reliable message queue: no agent acknowledgement is required, and a lost drain response is not proactively repeated. Full job state remains durable and repeatably queryable. Attached CLI commands write the same idempotent receipt before returning an addressed outcome.
 
 Stable task identifiers come from explicit task or idempotency keys, or from agent project and chat names. State output omits capability tokens and does not expose raw authentication data.
 
 ## Browser boundary
 
-- Playwright launches the configured supported Chromium browser with a persistent non-default user-data directory.
+- Each active managed profile owns one browser instance backed by that profile's persistent user-data directory. Providers and conversations use independently keyed tabs inside their profile's browser. The daemon may retain up to four profile-owned instances and never closes one profile to launch another; additional profiles wait for capacity or fail explicitly at a direct open boundary.
+- Playwright launches the exact executable resolved from the profile's runtime binding with a persistent non-default user-data directory. The browser library and managed browser versions are independently pinned.
 - Automation uses approved provider origins, visible page controls, and visible postconditions.
-- Provider sign-in state stays opaque inside the managed profile.
+- Provider credentials and browser sign-in data stay opaque inside the managed profile; only visible account display and subscription labels cross the boundary.
 - Sign-in, CAPTCHA, account limits, payment, consent, and confirmation remain user actions.
 - Every provider adapter has an explicit action and capability contract. Unverified behavior is unavailable rather than guessed.
 - Navigation and target URLs are canonicalized and checked before and after actions.
+- Pages are owned by a logical key derived from provider plus stable task identity, or provider plus job identity when no task exists. The default preserve policy never navigates an unrelated owned page; replacement requires an explicit job policy.
+- The control-plane page is separately reserved and can never be acquired, navigated, or replaced by a provider job.
+
+## Capability and Workspace strategy
+
+The public capability vocabulary, provider mapping rules, evidence ladder, and extension process are defined in the [Capability Matrix](capability-matrix.md). This section describes how that contract is executed by the runtime.
+
+The current visible-action schema includes `capability.inspect`, `workspace.ensure`, Qwen-only `qwen.mode.inspect/select`, DeepSeek control actions, and Doubao-only `doubao.mode.inspect/select` plus `doubao.skill.inspect/select`. Capability inspection reports `available`, `unavailable`, or `unknown` with visible proof, native resource information, fallback information, and experimental stability for every enabled provider. Provider-control results may include canonical candidate mappings, but only independently E2E-closed outcome lifecycles enter the route table.
+
+Subscription labels are diagnostic evidence, not authorization. Runtime decisions prefer an enabled visible control, then an explicit disabled, upgrade, or plan-limit state, and otherwise report `unknown`. Missing selectors never prove that a subscription lacks a capability.
+
+Native Project creation and reuse are capability-gated runtime behavior. The implementation can use exact visible names, report `created` or `reused`, and persist provider resource identity, but `workspace.native` is not currently routeable because the complete real-provider Project gate has not passed. `auto` can report conversation fallback only after stable visible native unavailability, `conversation` requires that strategy, and `native` fails before prompt or file mutation. `--project-name` remains metadata unless the caller opts in with `--workspace-mode`.
+
+Conversation fallback is scoped to one provider, managed profile, and task identifier. Before reusing a previous provider URL, the CLI queries the authenticated daemon and accepts only a successful same-scope job result that passes provider URL validation.
 
 ## Browser visibility policy
 
-Tokenless stores browser visibility in config and defaults omitted values to `auto`. The same policy can be overridden per job, but the runner resolves it into the same managed-browser contract every time.
+Tokenless stores a global browser visibility fallback and profile-scoped visibility preferences, defaulting omitted values to `auto`. The same policy can be overridden per job, but the runner resolves it into the same managed-browser contract every time. Profile preferences also contain provider routing membership, a human role label, and an optional credential-free HTTP/HTTPS/SOCKS5 proxy. Proxy changes require browser quiescence and cause the persistent context to be recreated.
+
+The persistent config stores the concrete `browser` selected by setup together with `browserExecutablePath`. For system browsers, the path is a verified cache: resolution tries it first, requires a runnable executable with a readable Chromium version, falls back to standard installation discovery on failure, and refreshes the cache after a successful fallback. The cache is used only when the requested profile binding matches the configured browser. Managed Chromium and Cloak ignore arbitrary path overrides and resolve their catalog-pinned executable under the versioned `$TOKENLESS_HOME/browser/runtimes` tree.
+
+The persistent config also stores `browserConnectionMode`, with `playwright` as the backward-compatible default and `cdp` as an experimental capability-evaluation mode. This is a daemon-runner setting rather than a job field or CLI flag. Native mode uses `launchPersistentContext`; CDP mode launches the exact profile-bound Chromium executable with an ephemeral loopback DevTools endpoint and then uses `connectOverCDP`. Both modes preserve the same profile, visibility, page-key, provider, and durable-mapping contracts. The daemon must be restarted after this config value changes.
 
 - `auto` starts headless. If the provider page becomes blocked by user-resolvable sign-in, CAPTCHA, MFA, consent, or confirmation, the runner switches the same managed profile into headed mode and marks the job `waiting_for_user`.
 - Terminal errors do not trigger a visible window.
@@ -78,7 +161,7 @@ Tokenless stores browser visibility in config and defaults omitted values to `au
 
 ## File handling
 
-The CLI accepts only intentionally selected regular files. It stages them under the Tokenless home, records bounded metadata and integrity hashes, and passes private staged paths only to the local worker. Provider adapters upload through visible file inputs and verify the resulting filename or other visible postcondition. Daemon results do not expose raw caller paths.
+The CLI accepts only intentionally selected regular files. It stages them under the Tokenless home, records bounded metadata and integrity hashes, and passes private staged paths only to the local worker. Provider adapters use provider-specific visible upload controls or generated file inputs. A hidden `FileList` proves only `selected`; only a visible filename, attachment chip, preview, or equivalent postcondition proves `accepted`. Daemon results do not expose raw caller paths.
 
 ## Long-running and user-handoff states
 
@@ -88,4 +171,4 @@ Managed jobs transition through daemon states such as `queued`, `claimed`, `runn
 
 ## Current delivery status
 
-The managed profile lifecycle, local daemon, Playwright worker, CLI setup flow, readiness handoff, and job APIs are implemented. Provider parity, file-upload acceptance across all four providers, and the public local API remain under active development. The roadmap is a delivery plan, not a compatibility guarantee.
+The managed profile lifecycle, local daemon, Playwright worker, CLI setup flow, readiness reporting, job APIs, and browser-based local control plane are implemented. The UI API is local and purpose-built for the bundled dashboard; it is not a remote administration contract. Provider parity and file-upload acceptance across enabled providers remain under active development. The roadmap is a delivery plan, not a compatibility guarantee.
diff --git a/docs/capability-matrix.md b/docs/capability-matrix.md
new file mode 100644
index 0000000..04077ab
--- /dev/null
+++ b/docs/capability-matrix.md
@@ -0,0 +1,192 @@
+# Capability Matrix
+
+[简体中文](capability-matrix.zh-CN.md)
+
+The Tokenless Capability Matrix is the public contract between caller outcomes and provider implementations. It lets users request work without depending on a provider's button names, and it gives contributors one evidence standard for adding or changing provider support.
+
+This document is normative for capability naming, mapping, support states, and extension. For current product reconnaissance that has not necessarily become Tokenless support, see the [Provider Capability Census](provider-capability-census.md).
+
+## The Three Layers
+
+Tokenless keeps three related layers separate:
+
+1. **Canonical capability catalog** — provider-neutral outcomes a caller may require, such as `conversation.chat`, `file.upload`, or `search.web`.
+2. **Provider routes** — evidence-backed mappings from one canonical capability to one provider strategy.
+3. **Live acceptance matrix** — real-provider cases that must pass through the built CLI, packaged daemon, managed browser, and provider network before a route can be advertised.
+
+A provider-specific control is not automatically a canonical capability. For example, DeepSeek `Search` is an adapter control that may implement `search.web`; DeepSeek `Vision` may implement `image.input`. The public contract describes the outcome, while the adapter owns the provider UI details.
+
+## User Model
+
+List the machine-readable catalog without opening a browser:
+
+```bash
+tokenless capabilities list --json
+```
+
+Request one or more outcomes with repeatable flags:
+
+```bash
+tokenless run \
+  --capability file.upload \
+  --attach-file proposal.pdf \
+  --prompt "Review this proposal."
+```
+
+Tokenless combines explicit requirements with structural inference:
+
+- a normal submit-and-read run requires `conversation.chat`;
+- any attachment requires `file.upload`;
+- image, audio, and video attachments additionally require their matching input capability; and
+- `--workspace-mode native` requires `workspace.native`.
+
+Implications are expanded before provider selection. One provider must satisfy the complete requirement set; Tokenless never silently drops a required outcome.
+
+## Current Routeable Matrix
+
+This table summarizes checked-in routes. The CLI output is the authoritative current list.
+
+| Canonical capability | ChatGPT | Claude | Gemini | Grok | Qwen | DeepSeek | Perplexity | Z.ai | Doubao |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
+| `conversation.chat` | Supported | Supported | Supported | Supported | Experimental | — | Experimental | Experimental | Experimental |
+| `file.upload` | Supported | Supported | — | Supported | — | — | — | — | Experimental |
+
+`—` means no route is advertised. It does not necessarily mean the provider product lacks the feature; the implementation or real-provider evidence may still be incomplete.
+
+Routes are evaluated as a complete requirement set. For example, an image attachment requires both `file.upload` and `image.input`; the `file.upload` row alone does not make image upload routeable.
+
+DeepSeek currently has implemented provider-specific controls and declared release gates for the following candidate mappings:
+
+| DeepSeek behavior | Canonical outcome | Public route state |
+| --- | --- | --- |
+| Instant chat and visible final response | `conversation.chat` | Gate pending |
+| Same-conversation follow-up | `conversation.continue` | Gate pending |
+| File selection in Instant or Vision | `file.upload` | Gate pending |
+| Vision image input | `image.input` | Gate pending |
+| Search in Instant | `search.web` | Gate pending |
+| DeepThink | `reasoning.extended` | Gate pending |
+| Visible source links | `response.citations` | Gate pending |
+
+Perplexity `conversation.chat` is experimental and routeable. Its guest session, prompt draft, submission, completed answer, normalized citations, visible citation links, conversation mapping, and durable state passed through the built CLI, packaged daemon, runtime-bound Cloak profile, and real provider network. File acceptance, continuation, model selection, Deep Research, Spaces, and generated assets remain unadvertised.
+
+Z.ai `conversation.chat` is experimental and routeable. Its guest continuation, prompt draft, submission, completed visible answer, conversation mapping, and durable state passed through the built CLI, packaged daemon, runtime-bound Cloak profile, and real provider network. The configured entry point is now `https://z.ai/chat`; the official entry currently hands a prepared draft to the `https://chat.z.ai` chat runtime, so both origins remain approved. The prior acceptance covered the chat runtime through an E2E-only process-local resolver mapping; the new entry-to-runtime journey remains a manual release rerun. Continuation, files, model or effort selection, and advanced GLM workflows remain unadvertised.
+
+Doubao `file.upload` is experimental and routeable for file selection. Its visible plus control, provider file input, and accepted filename card passed through the built CLI, packaged daemon, runtime-bound Cloak profile, and real provider network. `conversation.chat` remains registered as an experimental signed-in route: readiness and prompt drafting passed in the same product path, and two direct submissions completed with correlated visible marker responses. The required built-product mutation gate is not release-closed because Doubao presented its visible provider-owned verification iframe when the E2E observer was attached. Challenge detection fails closed as `visible_provider_blocker`.
+
+Doubao also exposes provider-specific `doubao.mode` and `doubao.skill` actions. The real non-submission gate inspected, selected, visibly verified, and restored Fast, Expert, Work Task Turbo, and every available coding-relevant Web skill. Work Task Pro is reported unavailable when the visible UI requires an upgrade; Audio Transcription is reported unavailable because the Web entry presents a desktop-app download flow. These controls map to canonical candidates, but selecting a control does not prove the complete outcome lifecycle, so no generation, research, reasoning, background-task, transcription, or spreadsheet route is advertised yet.
+
+Doubao `auth.status` also reads the visible account control and opens only its account menu. A visible `升级到专业版` item is derived as `免费版` / `signed_in_free`; unobserved paid-account states remain `signed_in_unknown` rather than being inferred from the purchase page's default selected offer.
+
+| Doubao control | Canonical outcome candidates | Public route state |
+| --- | --- | --- |
+| Fast | `conversation.chat` | Chat mutation gate pending |
+| Expert | `reasoning.extended` | Control closed; outcome gate pending |
+| Work Task Turbo / Pro | `task.background`, `task.interactive` | Turbo control closed; Pro visibly requires upgrade; outcome gates pending |
+| Help Me Write | `document.generation` | Control closed; artifact gate pending |
+| PPT Generation | `presentation.generation` | Control closed; artifact gate pending |
+| Image Generation | `image.generation` | Control closed; artifact gate pending |
+| Video Generation | `video.generation` | Control closed; artifact gate pending |
+| Deep Research | `research.deep` | Control closed; research lifecycle gate pending |
+| AI Podcast / Music Generation | `audio.generation` | Controls closed; artifact gates pending |
+| Problem Solving | `conversation.chat`, `reasoning.extended` | Control closed; reasoning outcome gate pending |
+| AI Spreadsheet | `spreadsheet.generation`, `data.analyze` | Control closed; artifact and analysis gates pending |
+| Audio Transcription | `audio.transcription` | Unavailable on Web; desktop app required |
+
+## Capability Families
+
+The V1 catalog groups outcomes by durable semantics, not by provider marketing categories:
+
+| Family | Canonical capabilities |
+| --- | --- |
+| Conversation | `conversation.chat`, `conversation.continue` |
+| Input | `file.upload`, `image.input`, `audio.input`, `video.input`, `url.input`, `repository.import` |
+| Retrieval and reasoning | `search.web`, `research.deep`, `reasoning.extended`, `audio.transcription`, `code.execute`, `data.analyze` |
+| Media generation | `image.generation`, `image.edit`, `video.generation`, `audio.generation` |
+| Artifact generation | `document.generation`, `presentation.generation`, `spreadsheet.generation`, `website.generation` |
+| Workspace and knowledge | `workspace.native`, `workspace.instructions`, `workspace.knowledge`, `source.connected` |
+| Evidence and lifecycle | `response.citations`, `artifact.download`, `task.background`, `task.interactive` |
+
+Candidate entries remain visible in the catalog even when they have no route. This makes the intended vocabulary discoverable without overstating support.
+
+## What a Capability Defines
+
+Every canonical capability defines:
+
+- a stable identifier and user-facing outcome;
+- a JSON parameter schema;
+- lifecycle: `immediate`, `interactive`, or `long_running`;
+- externally meaningful side effects;
+- implied, composable, and conflicting capabilities;
+- required visible and durable evidence;
+- normalized output kinds; and
+- catalog stability: `candidate`, `experimental`, or `supported`.
+
+Provider routes separately declare their strategy, evidence identifiers, and `experimental` or `supported` route status. Runtime eligibility is a third dimension: `eligible`, `unchecked`, or `ineligible` for the selected profile at that moment.
+
+These states must not be collapsed. A stable catalog definition may have no provider route, and a supported route may still be temporarily ineligible because the selected profile is signed out, challenged, rate-limited, or missing the required visible control.
+
+## Evidence Ladder
+
+Each provider/capability cell progresses independently:
+
+1. `product_documented` — official provider material describes the product feature.
+2. `live_observed` — a real visible session exposes the relevant state or control.
+3. `implemented` — a provider strategy implements the complete intended lifecycle.
+4. `e2e_closed` — the built CLI and packaged daemon prove the final outcome against the real provider.
+5. `routeable` — the public router may advertise and select the provider route.
+
+A menu item, selector, fixture, or successful manual prompt is not sufficient to claim `e2e_closed`. Fixtures support focused selector, parser, and sanitizer maintenance; real-provider E2E is the acceptance boundary.
+
+## Adding a New Capability
+
+Add a canonical capability when the product needs a new provider-neutral outcome, not merely because one provider added a control or marketing label.
+
+1. **Define the semantics.** State the user outcome, parameters, outputs, lifecycle, side effects, implications, conflicts, and terminal conditions.
+2. **Check for composition first.** Prefer an existing capability or a combination of existing capabilities when it expresses the result without losing meaning.
+3. **Add the catalog definition.** Update `packages/cli/src/providers/task-capabilities.ts` and keep the identifier independent of provider names.
+4. **Implement provider strategies.** Keep selectors and provider-specific controls inside provider adapters and typed capability classes.
+5. **Capture real fixtures.** Save redacted, provenance-bound reductions for every materially distinct selector or parser state. Never invent or splice DOM.
+6. **Declare live acceptance.** Add the real case to `test/live-provider-capability-matrix.json` and implement its journey in `test/live-managed-playwright.e2e.mjs`.
+7. **Close the real boundary.** Run the built CLI, packaged daemon, managed browser, and provider network without fixtures, interception, or simulated responses.
+8. **Add the route last.** Advertise the mapping only after the required lifecycle and evidence close.
+9. **Update public documentation.** Keep this document, both READMEs, command documentation, and the release changeset aligned.
+
+### Admission Questions
+
+Before adding an identifier, answer all of these:
+
+- Is this a user-visible outcome rather than a UI control?
+- Would at least two providers plausibly implement the same semantics?
+- Are success, failure, cancellation, and continuation boundaries testable?
+- Can parameters and outputs be normalized without discarding essential behavior?
+- Does it need a new lifecycle or safety contract rather than a new capability?
+- Would composition of existing capabilities be clearer?
+
+Provider-only concepts may remain namespaced actions such as `deepseek.mode` or `qwen.mode`. They can later implement a canonical capability without entering the public catalog themselves.
+
+## Compatibility and Versioning
+
+The current catalog schema is `tokenless.task-capability-catalog.v1`.
+
+- Adding an independent capability is normally additive.
+- Adding an optional parameter may be additive when existing requests keep identical semantics.
+- Changing the meaning, required parameters, output contract, implications, or safety boundary is breaking; introduce a new capability identifier or catalog schema version.
+- Adding or removing a provider route changes support availability, not the meaning of the canonical capability.
+- Provider UI labels and selectors may change without changing the public capability when the outcome contract remains intact.
+
+Persisted jobs record their normalized capability route and evidence identifiers, so implementations must not reinterpret an existing job under incompatible semantics.
+
+## Sources of Truth
+
+| Concern | Source |
+| --- | --- |
+| Catalog definitions and provider routes | `packages/cli/src/providers/task-capabilities.ts` |
+| Provider-specific actions and payload contracts | `packages/cli/src/providers/contracts.ts` and `action-catalog.ts` |
+| Provider implementations | `packages/cli/src/providers/` |
+| Real-provider required cases | `test/live-provider-capability-matrix.json` |
+| Real-provider journeys | `test/live-managed-playwright.e2e.mjs` |
+| Fixture rules and inventory | `test/fixtures/provider-dom/README.md` and `manifest.json` |
+| Product reconnaissance | `docs/provider-capability-census.md` |
+| CLI behavior | `COMMANDS.md` |
+
+When documentation and runtime output disagree, treat `tokenless capabilities list --json` and the checked-in source as authoritative, then correct the documentation in the same change.
diff --git a/docs/capability-matrix.zh-CN.md b/docs/capability-matrix.zh-CN.md
new file mode 100644
index 0000000..8701d1a
--- /dev/null
+++ b/docs/capability-matrix.zh-CN.md
@@ -0,0 +1,192 @@
+# Capability Matrix
+
+[English](capability-matrix.md)
+
+Tokenless Capability Matrix 是 caller outcome 与 provider implementation 之间的公共契约。它让用户无需依赖 provider 的按钮名称即可描述任务，也为贡献者新增或修改 provider support 提供统一的证据标准。
+
+本文档是 capability 命名、mapping、support state 与扩展流程的规范性文档。尚未成为 Tokenless support 的产品调研记录见 [Provider Capability Census](provider-capability-census.md)。
+
+## 三层结构
+
+Tokenless 将三个相关层次明确分开：
+
+1. **Canonical capability catalog** — caller 可以要求的 provider-neutral outcome，例如 `conversation.chat`、`file.upload`、`search.web`。
+2. **Provider routes** — 从 canonical capability 到某个 provider strategy 的 evidence-backed mapping。
+3. **Live acceptance matrix** — route 对外发布前，必须通过 built CLI、packaged daemon、managed browser 与真实 provider network 的验收用例。
+
+Provider-specific control 不会自动成为 canonical capability。例如 DeepSeek `Search` 是可能实现 `search.web` 的 adapter control；DeepSeek `Vision` 可能实现 `image.input`。公共契约描述 outcome，adapter 负责 provider UI 细节。
+
+## 用户模型
+
+不打开浏览器即可列出 machine-readable catalog：
+
+```bash
+tokenless capabilities list --json
+```
+
+通过可重复 flag 请求一个或多个 outcome：
+
+```bash
+tokenless run \
+  --capability file.upload \
+  --attach-file proposal.pdf \
+  --prompt "Review this proposal."
+```
+
+Tokenless 会合并显式 requirement 与结构化推导：
+
+- 普通 submit-and-read run 要求 `conversation.chat`；
+- 任意 attachment 要求 `file.upload`；
+- image、audio、video attachment 还会要求对应 input capability；
+- `--workspace-mode native` 要求 `workspace.native`。
+
+Provider selection 前会展开所有 implication。同一家 provider 必须满足完整 requirement set；Tokenless 不会静默丢弃任何必需 outcome。
+
+## 当前可路由矩阵
+
+下表概括 checked-in routes；CLI 输出是当前列表的权威来源。
+
+| Canonical capability | ChatGPT | Claude | Gemini | Grok | Qwen | DeepSeek | Perplexity | Z.ai | Doubao |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
+| `conversation.chat` | Supported | Supported | Supported | Supported | Experimental | — | Experimental | Experimental | Experimental |
+| `file.upload` | Supported | Supported | — | Supported | — | — | — | — | Experimental |
+
+`—` 表示目前没有公开 route，不一定代表 provider 产品没有该功能；也可能是 implementation 或真实 provider evidence 尚未完成。
+
+Route 会按完整 requirement set 评估。例如 image attachment 同时要求 `file.upload` 与 `image.input`；仅有 `file.upload` 这一行并不代表图片上传已经 routeable。
+
+DeepSeek 目前已实现 provider-specific controls，并为以下 candidate mapping 声明了 release gates：
+
+| DeepSeek behavior | Canonical outcome | Public route state |
+| --- | --- | --- |
+| Instant chat 与可见 final response | `conversation.chat` | Gate pending |
+| 同一 conversation 的 follow-up | `conversation.continue` | Gate pending |
+| Instant 或 Vision 文件选择 | `file.upload` | Gate pending |
+| Vision 图片输入 | `image.input` | Gate pending |
+| Instant Search | `search.web` | Gate pending |
+| DeepThink | `reasoning.extended` | Gate pending |
+| 可见 source links | `response.citations` | Gate pending |
+
+Perplexity `conversation.chat` 已作为 experimental route 对外提供。Guest session、prompt draft、submission、completed answer、normalized citations、可见 citation links、conversation mapping 与 durable state 已通过 built CLI、packaged daemon、runtime-bound Cloak profile 和真实 provider network。File acceptance、continuation、model selection、Deep Research、Spaces 与 generated assets 仍不公开。
+
+Z.ai `conversation.chat` 已作为 experimental route 对外提供。Guest continuation、prompt draft、submission、completed visible answer、conversation mapping 与 durable state 已通过 built CLI、packaged daemon、runtime-bound Cloak profile 和真实 provider network。当前配置的 entry point 已改为 `https://z.ai/chat`；该官方入口目前会把已准备的 draft 交给 `https://chat.z.ai` chat runtime，因此两个 origins 都继续获准使用。此前 acceptance 覆盖的是通过仅限 E2E 的 process-local resolver mapping 访问 chat runtime；新的 entry-to-runtime journey 仍需作为手动 release rerun。Continuation、files、model 或 effort selection 及 GLM 高级工作流仍不公开。
+
+Doubao `file.upload` 已作为 experimental route 对外提供文件选择能力。可见加号控件、provider 文件 input 与显示已接收文件名的卡片，均已通过 built CLI、packaged daemon、runtime-bound Cloak profile 和真实 provider network。`conversation.chat` 仍注册为需要登录的 experimental route：同一产品链路中的 readiness 与 prompt drafting 已通过，两次直接提交也得到了关联的可见 marker 回复。由于附着 E2E observer 时豆包显示 provider 自有的可见验证 iframe，所需 built-product mutation gate 尚未达到 release closure；challenge detection 会以 `visible_provider_blocker` fail closed。
+
+豆包还公开 provider-specific 的 `doubao.mode` 与 `doubao.skill` actions。真实 non-submission gate 已检查、选择、在可见 DOM 中确认并恢复快速、专家、工作任务 Turbo，以及每一个适合 coding 工作流且可用的 Web 技能。可见 UI 要求升级时，工作任务 Pro 会报告 unavailable；录音转写的 Web 入口只提供桌面版下载流程，因此也报告 unavailable。这些 controls 会映射到 canonical candidates，但选择控件本身不能证明完整 outcome lifecycle，所以 generation、research、reasoning、background-task、transcription 与 spreadsheet routes 目前均不公开。
+
+豆包 `auth.status` 也会读取可见账号控件，且只打开它的账号菜单。可见的“升级到专业版”会被派生为 `免费版` / `signed_in_free`；尚未观察的付费账号状态仍返回 `signed_in_unknown`，不会把购买页默认选中的报价误当成已购套餐。
+
+| Doubao control | Canonical outcome candidates | Public route state |
+| --- | --- | --- |
+| 快速 | `conversation.chat` | Chat mutation gate pending |
+| 专家 | `reasoning.extended` | Control 已闭环；outcome gate pending |
+| 工作任务 Turbo / Pro | `task.background`, `task.interactive` | Turbo control 已闭环；Pro 可见要求升级；outcome gates pending |
+| 帮我写作 | `document.generation` | Control 已闭环；artifact gate pending |
+| PPT 生成 | `presentation.generation` | Control 已闭环；artifact gate pending |
+| 图像生成 | `image.generation` | Control 已闭环；artifact gate pending |
+| 视频生成 | `video.generation` | Control 已闭环；artifact gate pending |
+| 深入研究 | `research.deep` | Control 已闭环；research lifecycle gate pending |
+| AI 播客 / 音乐生成 | `audio.generation` | Controls 已闭环；artifact gates pending |
+| 解题答疑 | `conversation.chat`, `reasoning.extended` | Control 已闭环；reasoning outcome gate pending |
+| AI 表格 | `spreadsheet.generation`, `data.analyze` | Control 已闭环；artifact 与 analysis gates pending |
+| 录音转写 | `audio.transcription` | Web 不可用；需要桌面版 |
+
+## Capability families
+
+V1 catalog 按持久语义分组，而不是按 provider marketing category 分组：
+
+| Family | Canonical capabilities |
+| --- | --- |
+| Conversation | `conversation.chat`, `conversation.continue` |
+| Input | `file.upload`, `image.input`, `audio.input`, `video.input`, `url.input`, `repository.import` |
+| Retrieval and reasoning | `search.web`, `research.deep`, `reasoning.extended`, `audio.transcription`, `code.execute`, `data.analyze` |
+| Media generation | `image.generation`, `image.edit`, `video.generation`, `audio.generation` |
+| Artifact generation | `document.generation`, `presentation.generation`, `spreadsheet.generation`, `website.generation` |
+| Workspace and knowledge | `workspace.native`, `workspace.instructions`, `workspace.knowledge`, `source.connected` |
+| Evidence and lifecycle | `response.citations`, `artifact.download`, `task.background`, `task.interactive` |
+
+即使 candidate entry 没有 route，也会保留在 catalog 中，方便发现预期 vocabulary，同时避免夸大 support。
+
+## Capability 的定义内容
+
+每个 canonical capability 都定义：
+
+- 稳定 identifier 与 user-facing outcome；
+- JSON parameter schema；
+- lifecycle：`immediate`、`interactive` 或 `long_running`；
+- 对外有意义的 side effects；
+- implied、composable 与 conflicting capabilities；
+- 必需的 visible 与 durable evidence；
+- normalized output kinds；
+- catalog stability：`candidate`、`experimental` 或 `supported`。
+
+Provider route 会另外声明 strategy、evidence identifiers，以及 `experimental` 或 `supported` route status。Runtime eligibility 是第三个维度：当前 selected profile 对应 `eligible`、`unchecked` 或 `ineligible`。
+
+这些状态不能合并。稳定的 catalog definition 可以没有 provider route；supported route 也可能因为 selected profile 未登录、遇到 challenge、被限流或缺少必需 visible control 而暂时 ineligible。
+
+## Evidence ladder
+
+每个 provider/capability cell 独立推进：
+
+1. `product_documented` — provider 官方材料描述了产品能力。
+2. `live_observed` — 真实可见 session 暴露相关状态或控件。
+3. `implemented` — provider strategy 实现了完整预期 lifecycle。
+4. `e2e_closed` — built CLI 与 packaged daemon 在真实 provider 上证明 final outcome。
+5. `routeable` — 公共 router 可以展示并选择该 provider route。
+
+菜单项、selector、fixture 或成功的手工 prompt 都不足以声明 `e2e_closed`。Fixture 用于 focused selector、parser、sanitizer maintenance；真实 provider E2E 才是 acceptance boundary。
+
+## 新增 Capability
+
+只有当产品需要新的 provider-neutral outcome 时才增加 canonical capability，不能因为某家 provider 新增了控件或 marketing label 就直接添加。
+
+1. **定义语义。** 写清 user outcome、parameters、outputs、lifecycle、side effects、implications、conflicts 与 terminal conditions。
+2. **先检查 composition。** 如果现有 capability 或其组合能够完整表达结果，应优先复用。
+3. **新增 catalog definition。** 更新 `packages/cli/src/providers/task-capabilities.ts`，identifier 不得包含 provider 名称。
+4. **实现 provider strategies。** Selector 与 provider-specific control 保留在 provider adapter 和 typed capability class 中。
+5. **采集真实 fixture。** 为每个 materially distinct selector/parser state 保存脱敏且 provenance-bound 的 reduction；不得发明或拼接 DOM。
+6. **声明 live acceptance。** 在 `test/live-provider-capability-matrix.json` 增加真实 case，并在 `test/live-managed-playwright.e2e.mjs` 实现 journey。
+7. **闭环真实 boundary。** 使用 built CLI、packaged daemon、managed browser 与真实 provider network；不得使用 fixture、interception 或 simulated response。
+8. **最后添加 route。** 只有所需 lifecycle 与 evidence 闭环后才发布 mapping。
+9. **更新公共文档。** 同步本文档、两份 README、command documentation 和 release changeset。
+
+### Admission questions
+
+新增 identifier 前必须回答：
+
+- 这是 user-visible outcome，还是 UI control？
+- 是否至少有两家 provider 能够合理实现相同语义？
+- success、failure、cancellation、continuation boundary 是否可测试？
+- parameters 与 outputs 能否在不丢失关键行为的前提下 normalize？
+- 它需要的是新的 capability，还是新的 lifecycle/safety contract？
+- 组合现有 capabilities 是否更清晰？
+
+Provider-only concept 可以保留为 `deepseek.mode`、`qwen.mode` 等 namespaced action。它们可以实现 canonical capability，但自身无需进入公共 catalog。
+
+## Compatibility 与版本管理
+
+当前 catalog schema 是 `tokenless.task-capability-catalog.v1`。
+
+- 新增独立 capability 通常属于 additive change。
+- 新增 optional parameter 在旧 request 语义完全不变时可以是 additive change。
+- 修改含义、required parameters、output contract、implications 或 safety boundary 属于 breaking change；应增加新的 capability identifier 或 catalog schema version。
+- 新增或删除 provider route 改变的是 support availability，不改变 canonical capability 的含义。
+- Provider UI label 与 selector 可以变化；只要 outcome contract 不变，就不需要修改公共 capability。
+
+持久化 job 会记录 normalized capability route 与 evidence identifiers，因此 implementation 不得用不兼容语义重新解释既有 job。
+
+## Sources of truth
+
+| Concern | Source |
+| --- | --- |
+| Catalog definitions 与 provider routes | `packages/cli/src/providers/task-capabilities.ts` |
+| Provider-specific actions 与 payload contracts | `packages/cli/src/providers/contracts.ts`、`action-catalog.ts` |
+| Provider implementations | `packages/cli/src/providers/` |
+| 真实 provider required cases | `test/live-provider-capability-matrix.json` |
+| 真实 provider journeys | `test/live-managed-playwright.e2e.mjs` |
+| Fixture rules 与 inventory | `test/fixtures/provider-dom/README.md`、`manifest.json` |
+| Product reconnaissance | `docs/provider-capability-census.md` |
+| CLI behavior | `COMMANDS.md` |
+
+当文档与 runtime output 不一致时，以 `tokenless capabilities list --json` 和 checked-in source 为准，并在同一次 change 中修正文档。
diff --git a/docs/npm-publishing.md b/docs/npm-publishing.md
index 77be12e..1e7e6cb 100644
--- a/docs/npm-publishing.md
+++ b/docs/npm-publishing.md
@@ -1,36 +1,30 @@
 # npm publishing
 
-Tokenless publishes seven public npm packages as one exact-version set:
+Tokenless publishes one public npm package:
 
 - `tokenless`
-- `tokenless-native-darwin-arm64`
-- `tokenless-native-darwin-x64`
-- `tokenless-native-linux-arm64`
-- `tokenless-native-linux-x64`
-- `tokenless-native-win32-arm64`
-- `tokenless-native-win32-x64`
 
-The release workflow publishes all six native packages on matching GitHub-hosted
-runners before it publishes the universal CLI. It never publishes without the
-tracked `.changeset/publish-pending.json` release marker.
+The package includes the TypeScript CLI, the local TypeScript daemon entrypoint,
+and the managed Playwright runtime. It does not publish platform-specific native
+runtime packages. The release workflow never publishes without the tracked
+`.changeset/publish-pending.json` release marker.
 
 ## Normal release flow
 
 1. Add a changeset with `npm run changeset` and select `tokenless`.
 2. Merge the change containing that changeset into `main`.
 3. `Prepare npm release` opens or updates a version pull request. Its version
-   script consumes the changeset, synchronizes the CLI, native manifests, Rust
-   crate, lockfiles, and writes `.changeset/publish-pending.json`.
+   script consumes the changeset, synchronizes the CLI package and lockfile, and
+   writes `.changeset/publish-pending.json`.
 4. Merge that version pull request.
-5. `Publish npm packages` verifies the marker, publishes the six native
-   packages, then publishes `tokenless`.
-6. After every package is confirmed published, the workflow removes the marker
-   in a second commit. A retry is safe because already-published versions are
+5. `Publish npm packages` verifies the marker and publishes `tokenless`.
+6. After the package is confirmed published, the workflow removes the marker in
+   a second commit. A retry is safe because already-published versions are
    skipped.
 
 ## GitHub setup required from a repository administrator
 
-1. In **Settings → Actions → General**, set workflow permissions to
+1. In **Settings -> Actions -> General**, set workflow permissions to
    **Read and write permissions** and allow GitHub Actions to create pull
    requests.
 2. If `main` is protected, allow `github-actions[bot]` to create the marker
@@ -49,15 +43,14 @@ To manage trusted publishers from a terminal, first use npm 11.15 or later and
 authenticate interactively with 2FA enabled. The command is:
 
 ```bash
-npm trust github <package-name> \
+npm trust github tokenless \
   --repo jazelly/tokenless \
   --file publish-npm.yml \
   --allow-publish \
   --yes
 ```
 
-For each of the seven packages, configure **Settings → Trusted publishing** on
-npmjs.com with:
+Configure **Settings -> Trusted publishing** for `tokenless` on npmjs.com with:
 
 - publisher: GitHub Actions;
 - owner: `jazelly`;
@@ -65,14 +58,5 @@ npmjs.com with:
 - workflow filename: `publish-npm.yml`;
 - allowed action: `npm publish`.
 
-The universal `tokenless` package already exists on npm. The six native package
-names must be bootstrapped before their Trusted Publishing settings can be
-created. For the first release, create a granular npm token with publishing
-access and any required 2FA bypass, store it as the optional GitHub Actions
-secret `NPM_TOKEN`, and let the workflow use it only as a fallback. After the
-native packages exist, configure Trusted Publishing for each one, delete
-`NPM_TOKEN` from GitHub, revoke the bootstrap token, and disallow token-based
-publishing in npm package settings.
-
-Tokenless is MIT-licensed. Keep every package's `license` field set to `MIT`
-and retain the repository's root `LICENSE` file.
+Tokenless is MIT-licensed. Keep the package `license` field set to `MIT` and
+retain the repository's root `LICENSE` file.
diff --git a/docs/provider-capability-census.md b/docs/provider-capability-census.md
new file mode 100644
index 0000000..f509e83
--- /dev/null
+++ b/docs/provider-capability-census.md
@@ -0,0 +1,187 @@
+# Provider Capability Census
+
+Last reviewed: 2026-08-02
+
+This is a product reconnaissance record, not a Tokenless support declaration. Official provider documentation establishes that a product feature exists. Tokenless advertises a route only after the provider adapter implements the complete visible lifecycle and real-provider browser E2E closes the required evidence. The normative naming, mapping, support, and extension rules live in the [Capability Matrix](capability-matrix.md).
+
+The checked-in runtime catalog and provider routing matrix live in `packages/cli/src/providers/task-capabilities.ts`. `tokenless capabilities list --json` exposes that versioned catalog without opening a browser. The current V1 routeable outcomes are:
+
+- `conversation.chat`: ChatGPT, Claude, Gemini, Grok, experimental Qwen, experimental Perplexity, experimental Z.ai, and experimental Doubao;
+- `file.upload`: ChatGPT, Claude, Grok, and experimental Doubao.
+
+All other entries below remain discoverable candidates. In particular, `workspace.native`, `research.deep`, citations as a required production postcondition, continuation as an explicit capability, generated media, and generated work artifacts remain non-routeable until their complete execution contracts are implemented and real-provider E2E-closed.
+
+## Evidence Ladder
+
+Every provider/capability cell progresses independently:
+
+1. `product_documented`: the provider officially describes the web product capability;
+2. `live_observed`: the selected managed profile visibly exposes the relevant controls or state;
+3. `implemented`: a provider strategy can execute the lifecycle through the packaged daemon;
+4. `e2e_closed`: the built product proves the final visible and durable outcome against the real provider; and
+5. `routeable`: the capability router may advertise and select the route for the observed account class.
+
+A visible menu item never advances a capability beyond `live_observed`. Account tier, region, quota, rollout, and workspace policy may keep an officially documented feature unavailable for a specific profile.
+
+## Current Tokenless Providers
+
+The product surface is broader than the current Tokenless evidence. The middle column combines official documentation with prior live product reconnaissance; the final column summarizes the checked-in live acceptance matrix, not the provider's marketing claims.
+
+| Provider | Documented or live-observed web product capabilities relevant to Tokenless | Current Tokenless evidence |
+| --- | --- | --- |
+| ChatGPT | Chat, web search with citations, Deep Research, file and image input, image generation and editing, data analysis, Canvas, agent mode, and Projects with files and instructions | Supported baseline chat, file acceptance, response citations, and same-conversation continuation; native Project, Deep Research, image generation, and agent lifecycles are not yet closed |
+| Claude | Chat, web search, Research, files and images, Projects and project knowledge, Artifacts, model selection, extended thinking, and connectors | Supported baseline chat, model selection, file acceptance, continuation, and citations; native Project, Research, Artifacts, and connector outcomes are not yet routeable |
+| Gemini | Chat, web-grounded answers, Deep Research, file and image input, Deep Think, image/video/music generation, Canvas, Gems, notebooks, connected sources, and GitHub repository import | Supported baseline prompt and cited response for the selected profile; file acceptance, continuation, native workspace, Deep Research, generated media, and connected-source lifecycles are not yet closed |
+| Grok | Chat, X and web search with citations, reasoning modes, image input, and image generation | Supported baseline chat, model and effort selection, file acceptance, continuation, and citations; native Project and generated-image lifecycles are not yet routeable |
+| Qwen | Chat, web search, Deep Research Normal/Advanced, file-assisted research, image generation/editing, video generation, Web Dev, Artifacts, Slides, Learn, and travel planning modes | Experimental baseline chat, effort selection, and provider-specific mode selection; full Deep Research report, file acceptance, continuation, generated media, and native workspace remain unclosed |
+| DeepSeek | Signed-in web chat, Instant/Expert/Vision modes, DeepThink, web search, broad file and image input, and synchronized chat history | Signed-in Instant/Expert/Vision controls and baseline, DeepThink, and Search response states are provenance-captured from the user-controlled Chrome session. Exact mode/toggle actions, correlated final-answer parsing, grounded citation parsing, mode-aware file behavior, and canonical run inference are implemented. Real baseline submission, same-conversation continuation, DeepThink output, and visible Search citations were observed in that session; routes and file/image acceptance remain gated on built-CLI managed-profile E2E |
+| Perplexity | Web search with citations, Pro Search, Advanced Deep Research, file-aware research, Spaces, model selection, image generation/editing, and multi-format asset creation | Experimental guest chat route with built-CLI managed-Cloak closure for readiness, prompt drafting, submission, completed response, normalized and visible citations, conversation mapping, and durable state; file acceptance, continuation, Deep Research, Spaces, model selection, and generated assets remain unadvertised |
+| Z.ai / GLM | GLM-5.2 web chat, 1M context, flexible effort levels, coding, and long-horizon agent strengths | Experimental guest chat route with built-CLI managed-Cloak closure for guest continuation, readiness, prompt drafting, submission, completed visible response, conversation mapping, and durable state; files, continuation, model or effort selection, and advanced GLM workflows remain unadvertised |
+| Doubao / 豆包 | Signed-in Chinese web chat; visible free-account discrimination; Fast, Expert, and Work Task modes; writing, presentation, image, video, deep-research, podcast, music, problem-solving, and spreadsheet Web skills; broad file input; desktop-only recording transcription entry | Experimental signed-in adapter with built-CLI managed-Cloak closure for readiness, prompt drafting, account-name and free-tier inspection, file acceptance, exact mode/skill selection, unavailable-state reporting, and restoration. Text-file `file.upload` is routeable. Advanced skill outcomes remain unadvertised until their full lifecycles close; the chat mutation gate remains release-blocked by a visible provider verification iframe |
+
+Official references:
+
+- [ChatGPT capabilities](https://help.openai.com/en/articles/9260256-chatgpt-capabilities-overview), [Deep Research](https://help.openai.com/en/articles/10500283-deep-research-in-chatgpt), and [Projects](https://help.openai.com/en/articles/10169521-projects-in-chatgpt)
+- [Claude Research](https://support.anthropic.com/en/articles/11088861-using-research-on-claude-ai), [web search](https://support.anthropic.com/en/articles/10684626-enabling-and-using-web-search), [Projects](https://support.anthropic.com/en/articles/9529781-examples-of-projects-you-can-create), and [Artifacts](https://support.anthropic.com/en/articles/9487310-what-are-artifacts-and-how-do-i-use-them)
+- [Gemini Apps capability index](https://support.google.com/gemini) and [Gemini Deep Research](https://support.google.com/gemini/answer/15719111)
+- [Grok web search and citations](https://x.ai/news/grok-1212) and [Grok on the web](https://help.x.com/en/using-x/about-grok)
+- [Qwen Deep Research](https://qwen.ai/blog?id=qwen-deepresearch) and [Qwen Image](https://qwen.ai/blog?id=qwen-image-2.0)
+- [DeepSeek V4 web modes](https://api-docs.deepseek.com/news/news260424), [DeepSeek web search](https://api-docs.deepseek.com/news/news1210/), and [DeepSeek file upload and synchronized history](https://api-docs.deepseek.com/news/news250115/)
+- [Perplexity overview](https://www.perplexity.ai/help-center/en/articles/10352895-how-does-perplexity-work), [Spaces](https://hub-prod.perplexity.ai/hub/faq/what-are-spaces), and [generated assets](https://www.perplexity.ai/help-center/en/articles/12528830-creating-assets-with-perplexity-overview)
+- [GLM-5.2 on Z.ai](https://z.ai/blog/glm-5.2)
+- [Doubao official feature introduction](https://www.doubao.com/legal/feature_intro)
+- [Doubao paid service agreement](https://www.doubao.com/legal/ey01)
+
+## Candidate Web Providers
+
+| Candidate | Canonical web entry | Officially documented or currently confirmed surface | Recommended evaluation |
+| --- | --- | --- | --- |
+| Kimi | `https://www.kimi.com/` | Web chat, built-in web search and deep thinking, large file inputs, asynchronous Deep Research with clarification, progress, citations and multi-format reports, general Agent, Agent Swarm, Docs, Sheets, Slides, Websites, image generation, and coding products | P1. Best next provider for proving the complete `research.deep`, background-task, and generated-artifact contracts |
+| Mistral Le Chat | `https://chat.mistral.ai/` | Web search and citations, Deep Research, Think mode, Projects and Libraries, files, code interpreter, image generation/editing, Canvas, agents, and MCP connectors | P1. Broad capability match with relatively clear official documentation; useful second adapter for research and artifact semantics |
+| Meta AI | `https://www.meta.ai/` | Web chat, voice, personalization, image generation and editing, multi-reference composition, search-grounded image creation, Discover, and limited document editor/import experiments | P2 image-first candidate. Do not infer Deep Research, stable file analysis, or document workflow from experiments |
+| Microsoft Copilot | `https://copilot.microsoft.com/` | Web chat, Quick/Think Deeper/Smart modes, Deep Research, file upload, image generation/editing, Pages, connectors, voice, and browser-related experiences | Blocked in the 2026-08-01 Cloak precheck: the signed-out surface exposed Microsoft, Apple, and Google sign-in choices but no guest composer. Resume only with an explicitly selected setup-managed signed-in profile |
+| Tencent Yuanbao | `https://yuanbao.tencent.com/` | Web product, Tencent-enhanced web search, multi-format file reading, reasoning/model surfaces, and the broader Tencent content ecosystem | P2. Valuable Chinese search and file route; advanced artifact and workspace claims need official and live closure |
+| MiniMax Agent | `https://agent.minimax.io/` | Long-horizon planning, web and application generation, code execution, multimedia understanding and generation, and MCP integrations | P3 specialist adapter. Its autonomous-agent lifecycle is materially different from chat and should not be forced into the baseline provider contract |
+
+Official candidate references:
+
+- [Kimi overview](https://www.kimi.com/help/getting-started/overview), [Kimi Deep Research](https://www.kimi.com/help/deep-research/deep-research-overview), and [Kimi Agent](https://www.kimi.com/help/agent/agent-overview)
+- [Perplexity overview](https://www.perplexity.ai/help-center/en/articles/10352895-how-does-perplexity-work), [Spaces](https://hub-prod.perplexity.ai/hub/faq/what-are-spaces), [image generation](https://www.perplexity.ai/help-center/en/articles/10354781-generating-images-with-perplexity), and [generated assets](https://www.perplexity.ai/help-center/en/articles/12528830-creating-assets-with-perplexity-overview)
+- [Mistral Le Chat research and Projects](https://mistral.ai/news/le-chat-dives-deep/) and [Le Chat product surface](https://mistral.ai/news/all-new-le-chat/)
+- [DeepSeek V4 web modes](https://api-docs.deepseek.com/news/news260424) and [DeepSeek updates](https://api-docs.deepseek.com/updates/)
+- [Meta AI web product](https://about.fb.com/news/2025/04/introducing-meta-ai-app-new-way-access-ai-assistant/) and [Muse Image on meta.ai](https://ai.meta.com/blog/introducing-muse-image-muse-video-msl/)
+- [Microsoft Copilot capabilities](https://support.microsoft.com/en-gb/microsoft-copilot), [Deep Research](https://support.microsoft.com/en-us/Microsoft-Copilot/deep-research-in-microsoft-copilot), and [file upload](https://support.microsoft.com/en-US/microsoft-copilot/file-upload-in-microsoft-copilot)
+- [Tencent Yuanbao web search](https://cloud.tencent.com/product/wsa) and [desktop file support](https://yuanbao.tencent.com/evt/dl)
+- [MiniMax Agent](https://www.minimax.io/news/minimax-agent)
+
+## 2026-08-01 to 2026-08-02 Cloak Expansion Checkpoint
+
+- Perplexity passed the real non-submission and mutation journeys through the built CLI, packaged daemon, runtime-bound Cloak profile, and provider network. Guest readiness, prompt drafting, completed response, normalized and visible citations, conversation mapping, and durable state are closed; `conversation.chat` is advertised as experimental. A later regression run declined the visible optional-cookie dialog but then reached `provider_sign_in_required`; no login was attempted, and that account-state-dependent rerun remains parked.
+- Z.ai passed its real non-submission and mutation journeys through the built CLI, packaged daemon, runtime-bound Cloak profile, and provider network. Guest continuation, readiness, prompt drafting, completed response, conversation mapping, and durable state are closed; `conversation.chat` is advertised as experimental. The configured entry point is now `https://z.ai/chat`; the official page currently prepares a draft and hands it to the `chat.z.ai` runtime, so the navigation catalog approves both origins. Prior acceptance covered that runtime through a strict E2E-only process-local resolver mapping; the entry-to-runtime journey remains a manual release rerun.
+- Doubao was added as an experimental signed-in adapter after a user completed login in the runtime-bound Cloak profile. The expanded real non-submission journey passed readiness, prompt drafting, visible account-name and free-tier inspection, visible file acceptance, three available mode selections, nine Web skill selections, explicit upgrade/desktop-only unavailable states, and restoration through the built CLI and packaged daemon. `file.upload` is advertised as experimental. Two direct submissions through the same anti-detect configuration produced completed correlated marker responses, but the built-product mutation journey reached Doubao's visible provider verification iframe and correctly stopped as `visible_provider_blocker`; the chat gate remains a release prerequisite rather than being skipped or simulated.
+- Microsoft Copilot loaded without a challenge on both checks but exposed a sign-in surface and no guest composer. Per the authentication-skip policy, no login was attempted and no adapter was registered.
+
+## Canonical Capability Schema
+
+The caller catalog must describe outcomes, not provider controls. `qwen.mode`, `deepseek.mode`, `deepseek.deepthink`, `deepseek.search`, `doubao.mode`, `doubao.skill`, `model.choice`, `effort.choice`, DOM selectors, and marketing model names stay inside provider strategy adapters. Doubao control inspection reports candidate mappings without making them routes: Expert maps to `reasoning.extended`; Work Task maps to background and interactive task semantics; the Web skills map to research, media, document, presentation, spreadsheet, data-analysis, and audio-transcription outcomes. The DeepSeek adapter already prepares `reasoning.extended` as Instant plus DeepThink, `search.web` as Instant plus Search, and `image.input` as Vision before mutation. Those routes remain unadvertised until each complete visible lifecycle is independently E2E-closed through the built CLI and packaged daemon.
+
+### Proposed Capability Families
+
+| Family | Candidate canonical capabilities |
+| --- | --- |
+| Conversation | `conversation.chat`, `conversation.continue` |
+| Inputs | `file.upload`, `image.input`, `audio.input`, `video.input`, `url.input`, `repository.import` |
+| Retrieval and reasoning | `search.web`, `research.deep`, `reasoning.extended`, `audio.transcription`, `code.execute`, `data.analyze` |
+| Media generation | `image.generation`, `image.edit`, `video.generation`, `audio.generation` |
+| Artifact generation | `document.generation`, `presentation.generation`, `spreadsheet.generation`, `website.generation` |
+| Workspace and knowledge | `workspace.native`, `workspace.instructions`, `workspace.knowledge`, `source.connected` |
+| Evidence and lifecycle | `response.citations`, `artifact.download`, `task.background`, `task.interactive` |
+
+This is a candidate vocabulary. A capability becomes public only when at least one provider has a complete semantics and real-provider closure. Similar provider labels do not establish equivalent behavior.
+
+Keep the first public catalog small. Real-time voice conversations, persistent personalization or memory, arbitrary autonomous web actions, connector writes, and iterative artifact editing or sharing require separate safety and lifecycle contracts. The schema may add those outcomes later, but provider marketing labels such as “agent,” “canvas,” or “memory” must not enter V1 as underspecified generic capabilities.
+
+### Task Requirement
+
+CLI may use a repeatable capability identifier for the simple case. MCP and the internal contract need structured parameters:
+
+```ts
+type TaskCapabilityRequirement = Readonly<{
+  capability: TaskCapabilityId
+  parameters?: Readonly<Record<string, unknown>>
+}>
+
+type CapabilityRunRequest = Readonly<{
+  profile?: string
+  providerConstraint?: ProviderId
+  requirements: readonly TaskCapabilityRequirement[]
+  prompt: string
+  attachments?: readonly AttachmentInput[]
+  workspace?: WorkspaceIntent
+  requestedOutputs?: readonly OutputRequirement[]
+}>
+```
+
+All V1 requirements are mandatory. Attachments infer the corresponding input capabilities. Requested output kinds infer generation capabilities. The router must find one provider strategy set that satisfies every explicit and inferred requirement, including the requested parameter subset.
+
+Each catalog definition includes:
+
+```ts
+type TaskCapabilityDefinition = Readonly<{
+  id: TaskCapabilityId
+  title: string
+  description: string
+  family: CapabilityFamily
+  parametersSchema: JsonSchema
+  lifecycle: 'immediate' | 'interactive' | 'long_running'
+  sideEffects: readonly CapabilitySideEffect[]
+  implies: readonly TaskCapabilityId[]
+  composesWith: readonly TaskCapabilityId[]
+  conflictsWith: readonly TaskCapabilityId[]
+  requiredEvidence: readonly CapabilityEvidenceRequirement[]
+  outputKinds: readonly OutputKind[]
+  stability: 'candidate' | 'experimental' | 'supported'
+}>
+```
+
+The provider matrix maps the canonical definition to a provider-owned strategy and declares which parameter subset it can satisfy. Unsupported parameters eliminate that route before mutation.
+
+## Minimum Lifecycle Contracts
+
+### `research.deep`
+
+Mode selection and the first correlated response are insufficient. Closure requires:
+
+1. select the provider research strategy;
+2. submit the scoped research request and optional sources;
+3. surface clarification as `waiting_for_user` or apply an explicit caller policy;
+4. approve or start a visible research plan when required;
+5. preserve the same durable job while research runs in the background;
+6. detect provider progress, limits, cancellation, and terminal failure;
+7. read the completed final report rather than an intermediate message;
+8. prove visible citations or source links; and
+9. return report text plus any downloadable report artifacts.
+
+### Generated Media and Files
+
+- `image.generation`: prove a completed visible image result and return a bounded artifact reference; text claiming that an image was created is not closure.
+- `image.edit`: prove that the edited result belongs to the submitted source image and instruction.
+- `video.generation` and `audio.generation`: handle long-running progress and return the completed playable or downloadable artifact.
+- `audio.transcription`: prove source-audio correlation and return the completed visible transcript rather than a file-selection or desktop-download prompt.
+- `file.upload`: a populated `FileList` proves selection only; a visible provider attachment state proves acceptance.
+
+### Generated Work Artifacts
+
+Document, presentation, spreadsheet, and website capabilities must declare their output format and prove a completed preview or downloadable artifact. A prose answer containing Markdown, code, or slide suggestions does not satisfy an artifact-generation capability.
+
+## Routing Consequences
+
+- Product documentation expands reconnaissance; it never makes a route eligible.
+- The router considers only implemented and real-E2E-closed provider strategies.
+- Account, region, rollout, and quota are runtime eligibility checks.
+- One V1 provider must satisfy the full requirement set.
+- Provider ranking happens only after full-set capability compatibility. Fresh runtime eligibility wins over unchecked state, supported evidence wins over experimental evidence, and configured provider preference breaks the remaining tie.
+- Stale cached access is `unchecked`, not trusted as live eligibility. Every attempt performs a read-only visible session and capability-UI preflight before mutation; no probe prompt is allowed.
+- The job contract independently derives requirements from actions, attachment MIME types, and native workspace intent. A route that omits an action-required capability is invalid even when an internal caller supplied it.
+- Automatic fallback consumes the ranked list without capability degradation. When no provider satisfies `research.deep` or another mandatory capability, routing stops with `task_capability_route_unavailable` rather than falling back to plain chat.
+- The result records the canonical requirements, selected provider, provider strategies, runtime observations, evidence, ranked remaining routes, structured attempt failures, and durable attempt history.
diff --git a/docs/provider-rate-limits.md b/docs/provider-rate-limits.md
new file mode 100644
index 0000000..4548902
--- /dev/null
+++ b/docs/provider-rate-limits.md
@@ -0,0 +1,78 @@
+# Provider Rate-Limit Knowledge and Runtime Policy
+
+Last reviewed: 2026-08-02
+
+## Scope
+
+Tokenless maintains its best current knowledge of consumer Web provider limits in [`packages/cli/catalog/provider-rate-limits.v1.json`](../packages/cli/catalog/provider-rate-limits.v1.json). The catalog does not describe provider API limits, does not correlate one external account across browser profiles, and does not claim to reproduce private provider enforcement.
+
+One managed browser profile is one independent provider-capacity scope. Reaching a real provider limit remains an expected recoverable condition.
+
+## Current Schedulable Knowledge
+
+| Provider | Official exact numeric rules retained | Runtime interpretation and remaining uncertainty |
+| --- | --- | --- |
+| ChatGPT | GPT-5.5 Instant for Go/Plus: 160 messages per 3 hours; Go manual Thinking: 10 messages per 5 hours; signed-in uploads: 80 files per 3 hours; Free uploads: 3 files per day | Dynamic Free messages, guarded Pro/Business access, Enterprise/Edu message limits, guest limits, and provider-native model fallback behavior |
+| Claude | None | Five-hour session shape, weekly windows, relative Pro/Max/Team multipliers, dynamic usage, and Enterprise consumption behavior |
+| Gemini | None | Five-hour and weekly window shapes, relative paid-plan multipliers, compute-based dynamic usage, Workspace limits, and native fallback behavior |
+| Grok | None | Qualitative higher-limit statements and unknown numeric consumer Web limits |
+| Qwen | None | Unknown numeric consumer Web limits and the published usage-policy constraints |
+| DeepSeek | None | Unknown numeric consumer Web limits; API concurrency numbers are explicitly excluded |
+| Perplexity | Free Pro Search: 3/day; Enterprise Pro Search: 400/week; Enterprise Max Pro Search: 4000/week | Exact rules remain observe-only until the run can distinguish Pro Search; general/Best-mode behavior, consumer paid weekly ranges, feature usage, uploads, and heavy-usage reductions remain non-numeric |
+| Z.ai / GLM | None | Unknown numeric consumer Web limits; separate GLM Coding Plan quotas are explicitly excluded |
+| Doubao / 豆包 | None | Unknown numeric signed-in consumer Web limits; API and enterprise product quotas are explicitly excluded |
+
+The catalog links every fact to an official source. Its current primary sources are OpenAI Help, Anthropic Help, Google Gemini Help, xAI pricing, the Qwen usage policy, the DeepSeek user agreement, Perplexity Help, the official Z.ai GLM announcement, and the Doubao feature introduction. Exact numbers are executable only when the catalog contains `official_exact` evidence; relative, dynamic, qualitative, guarded, consumption-based, and unknown allowances remain non-numeric at runtime.
+
+## Runtime Interpretation
+
+The runtime resolves the currently observed profile subscription label to a canonical catalog plan. Exact visible labels take precedence; `signed_in_free` may select the provider's Free family; an indistinguishable paid or unknown plan remains `unknown` and never inherits the provider's highest allowance.
+
+For an exact rule, Tokenless:
+
+1. reads immutable `provider_submitted_at` facts from the existing SQLite `jobs` table;
+2. derives prompt and attachment units from each structured job request;
+3. isolates provider, profile, model family, mode, action, and matching window;
+4. applies a 90% scheduling allowance only when the published allowance is at least 20 units;
+5. applies GCRA cadence with a bounded 5% burst, clamped to 2–8 units; and
+6. returns `admit` or an explainable `defer` with `eligibleAt`.
+
+For every non-numeric or unmatched rule, Tokenless returns `unknown` and allows execution. This preserves uncertainty without manufacturing quotas.
+
+Before provider mutation, known deferral first consumes an already-filtered automatic provider fallback plan. If no in-scope fallback remains, the same job returns to `queued` with `eligible_at`. A visible rate or plan blocker before submission receives bounded local backoff. Proven or ambiguous post-submission work is never replayed on another provider or profile.
+
+The configured provider list is a filter only. Its order does not alter capability, subscription, capacity, fairness, or recovery scoring.
+
+## Durable Facts and Diagnostics
+
+Rate-limit state stays in the existing `jobs` table:
+
+- `provider_submitted_at` is nullable, immutable, and written immediately after visible prompt submission succeeds;
+- `eligible_at` prevents an early claim after a capacity deferral;
+- `provider`, `profile_id`, and `request_json` retain the dimensions needed to reconstruct local usage; and
+- `(provider, profile_id, provider_submitted_at)` supports bounded history queries.
+
+No separate rate-limit ledger table exists.
+
+Inspect the next prompt projection with:
+
+```sh
+tokenless limits inspect --profile <slug> --provider <provider> --json
+```
+
+The output includes the matched plan, match confidence, catalog revision, applicable rules, published and effective allowances, locally observed usage, remaining estimate, cadence, burst allowance, decision, and next eligible time.
+
+## Validation Boundary
+
+Rate-limit acceptance is algorithmic. The focused integration test uses the built CLI, built daemon, real HTTP boundary, real profile registry, and real SQLite history with controlled timestamps. It verifies subscription matching, exact and non-numeric knowledge, model-pool isolation, sliding windows, remaining capacity, burst cadence, deferral time, and the CLI diagnostic.
+
+It deliberately does not spam provider websites to discover or exhaust quotas. Real provider blockers remain normal runtime evidence, not a release test load generator.
+
+## Maintenance
+
+- Update official source retrieval and review dates when facts are rechecked.
+- Preserve uncertainty when an official page stops publishing a number.
+- Add a new exact number only with official exact evidence.
+- Keep runtime policy parameters separate from provider facts under `runtimePolicy`.
+- Run the packaged catalog check and focused rate-limit simulation after every catalog or policy change.
+- Add a changeset when a fact or policy change materially changes scheduling.
diff --git a/docs/roadmaps/P0-browser-connection-mode-capability-evaluation.md b/docs/roadmaps/P0-browser-connection-mode-capability-evaluation.md
new file mode 100644
index 0000000..bdd20d8
--- /dev/null
+++ b/docs/roadmaps/P0-browser-connection-mode-capability-evaluation.md
@@ -0,0 +1,109 @@
+# Browser Connection Mode Capability Evaluation
+
+Status: active, implementation and available-capability comparison complete | Priority: P0 | Last reviewed: 2026-08-01
+
+## Outcome
+
+Determine whether Playwright's native persistent-context connection or `connectOverCDP` is the better Tokenless browser-control boundary by running the same capabilities against both modes. The default remains `playwright` until the evidence supports a separate product decision.
+
+This work protects capability fidelity, not an assumed notion of more realistic clicking. CDP is an opt-in persistent configuration value and is not a per-command CLI flag.
+
+## Configuration Contract
+
+`~/.tokenless/config.json` accepts:
+
+```json
+{
+  "browserConnectionMode": "playwright"
+}
+```
+
+The supported values are `playwright` and `cdp`. Omitted values resolve to `playwright` for backward compatibility. The daemon reads the value when it creates its embedded browser runner, so changing it requires the daemon to be restarted. Profiles, browser runtime bindings, visibility policy, provider mappings, and job contracts do not change.
+
+In `cdp` mode Tokenless launches the exact profile-bound Chromium executable with a loopback-only ephemeral DevTools endpoint, connects through Playwright, owns the browser process, and closes or terminates that process during cleanup. Every production and test executable retains `--password-store=basic` and `--use-mock-keychain`, matching Playwright mode. Chromium sandboxing remains enabled.
+
+## Capability Matrix
+
+The local browser matrix uses a real packaged Playwright build, real local Chromium, filesystem input, a loopback website, real pages, and real browser events. It does not use browser/runtime mocks or synthetic network interception.
+
+| Capability | `playwright` | `cdp` | Evidence boundary |
+| --- | --- | --- | --- |
+| locator click/fill | Passed | Passed | Real Chromium DOM and visible input value |
+| DOM read | Passed | Passed | Real Chromium locator text |
+| page navigation | Passed | Passed | Loopback document navigation and URL |
+| direct `setInputFiles` | Passed | Passed | Real filesystem file and browser `FileList` |
+| file chooser | Passed | Passed | Real `filechooser` event and selected file |
+| popup | Passed | Passed | Real popup target and loaded document |
+| download | Passed | Passed | Real browser download event and completed transfer |
+| clipboard permissions | Passed | Passed | Real browser permission grant and Clipboard API round trip |
+| visibility switching | Passed | Passed | Headless context replaced by a headed context |
+| context loss/reconstruction | Passed | Passed | Closed real context replaced and logical page key reacquired |
+| same-profile multiple tabs | Passed | Passed | Independent real pages and stable logical page-key reuse |
+
+The real-provider matrix is declared in `test/live-provider-capability-matrix.json`. `test/run-live-connection-mode-matrix.mjs` runs one continuous journey for each selected provider in `playwright` and `cdp`, sequentially against the explicitly selected setup-managed profile. Each journey executes the provider's required capability cases in declaration order with one stable task ID and one managed page. Every browser inspection barrier asserts the same opaque Chromium target ID, so a hidden page replacement fails the journey. The harness preserves and restores the user's original connection mode and writes a bounded status report under `test-results/live-browser-connection-matrix/`.
+
+The capability cases remain fine-grained sequential subtests for failure attribution and submission budgets; they are steps, not page-allocation boundaries. A failed capability does not suppress later capability evidence on the same page, except when a declared durable provider blocker makes the remaining journey unavailable. A provider journey may navigate the same page from its home surface into a conversation or native Project. Separate providers use separate pages because they have different origins and account state. Separate connection modes use separate browser runs because changing the mode requires daemon/browser restart.
+
+| Provider capability family | Required comparison |
+| --- | --- |
+| Session readiness and CAPTCHA/blocker handoff | Same account observation, visible blocker result, and user-resolvable handoff behavior |
+| Prompt and DOM controls | Same draft, clear, model, effort, and provider-specific mode outcomes |
+| File upload | Same visible attachment acceptance from a real file |
+| Conversation workflow | Same submissions, responses, citations, continuation, durable mapping, and two-process reuse |
+| Native Project workflow | Same create/reuse, instructions, attachment, response, Project identity, and durable mappings |
+| Browser/process recovery | Same failure classification and successful reconstruction on the next retry or resume |
+
+The click and upload evidence is deliberately layered. The local Chromium matrix performs real locator clicks, direct `setInputFiles`, and a real button-triggered `filechooser` event. The provider journey then performs the actual provider control clicks and upload action through the built CLI and packaged daemon, and requires the real provider page to show the selected attachment. Neither layer uses fixture routes, interception, or simulated browser objects.
+
+## Test Results
+
+Local real-browser matrix on macOS arm64, 2026-08-01:
+
+- Build: passed.
+- Six browser integration cases: passed, three in each connection mode.
+- Keychain prompt: none observed.
+- Chromium sandbox: no disabling flag added; test-only profile retained both keychain-neutral flags.
+- Initial CDP cleanup defect found and fixed: closing the default attached context could leave the owned Chromium process alive. Context closure now enters one idempotent cleanup lane, waits before relaunch, and terminates a non-exiting owned process.
+- A CDP history-navigation wait observed the destination URL but did not receive Playwright's expected `load` completion within 30 seconds. Tokenless does not depend on history-back for its navigation contract; the common matrix verifies explicit document navigation. This remains a fidelity difference to monitor rather than a supported-capability failure.
+
+Real-provider comparison used the existing explicitly selected `default` setup-managed profile. The old profile was bound in place to its already configured `system:chrome` runtime through the same validated `ManagedProfileRegistry.bindRuntime` path used by setup. No profile data was imported, copied, reset, or replaced. The harness restored `browserConnectionMode: "playwright"` after every run. No Keychain prompt was observed.
+
+The first full run exposed an E2E evidence defect: the external observer selected the first page with a matching URL, so same-profile tabs could produce false negatives even when the runner action succeeded. The inspection barrier was upgraded to v2 and now carries the runner page's opaque Chromium target ID. The observer requires both exact target ID and canonical URL. After that correction, both modes produced identical non-submission results:
+
+| Non-submission result per mode | `playwright` | `cdp` |
+| --- | ---: | ---: |
+| Passed | 11 | 11 |
+| Failed on current provider/account state | 4 | 4 |
+| Allowed Claude Cloudflare skips | 4 | 4 |
+
+The eleven passes in each mode cover ChatGPT readiness, prompt draft/clear, and file selection; Gemini readiness and prompt draft/clear; Grok readiness, prompt draft/clear, and file selection; and Qwen readiness, prompt draft/clear, and effort selection. The four identical failures are Grok model/effort declarations that no longer match the current visible controls and DeepSeek readiness/draft cases blocked by sign-in. Claude's four non-submission cases hit the one declared Cloudflare known-issue skip in both modes.
+
+Mutation results:
+
+- ChatGPT's complete two-turn conversation workflow, including a real attachment, submission, responses, citations, continuation, and durable mapping, passed in native Playwright. The first CDP matrix attempt hit a 15-second submit-control readiness timeout; a manual no-internal-retry CDP rerun of the exact case passed in 126 seconds, comparable to Playwright's 121 seconds. The failure was not reproducible and is treated as provider/attachment readiness variance, not a demonstrated CDP capability loss.
+- Gemini workspace response and citation closure passed in both modes.
+- Claude conversation workflow failed authentication in both modes.
+- Grok conversation workflow failed the same attachment-content postcondition in both modes.
+- Qwen mode/workspace failed on the same visible plan/quota blocker in both modes.
+
+Project results were unavailable rather than connection-mode failures. Claude native Project failed authentication in both modes. Grok native Project failed because the create control was not visible in Playwright and because the later CDP run observed sign-in required. Neither mode has current native Project acceptance evidence from this profile.
+
+Current conclusion: CDP did not reduce any locally testable browser capability, produced exact parity across the available real-provider non-submission matrix, and passed the available ChatGPT and Gemini mutation workflows. The evidence is insufficient to change the default because native Project coverage, authenticated Claude/Grok coverage, and a real packaged browser-process crash/reconnect case remain open. Keep `playwright` as the default and `cdp` as an experimental config-only evaluation mode.
+
+Final repository verification built successfully. The expanded parallel `npm test` run reported 72 of 78 passing because one package-contract `prepack` deleted and rebuilt `packages/cli/dist` while six tests in other files tried to execute it; all six failures were missing-artifact or empty-output failures. Re-running the affected package-contract and provider-control files serially after one build passed 16 of 16. The connection-mode browser and daemon cases passed in the complete run. This is a test-orchestration race, not a connection-mode product failure.
+
+The provider E2E was subsequently simplified from one top-level test and implicit page per capability case to one continuous test and exact page target per provider. The obsolete case-level page allocation was removed, signed-in readiness is reused within the journey, and completed observer connections are closed instead of retained until suite teardown. Post-refactor verification passed the six local real-Chromium cases and the complete Gemini non-submission journey in both modes. The target-identity invariant passed across all Gemini steps in each mode. A wider rerun also recorded current external prerequisites independently of connection mode: ChatGPT, Grok, and DeepSeek were signed out in the selected profile, Claude hit its declared Cloudflare blocker, and Qwen DNS resolution failed. A concurrent build removed `dist` during the first unisolated CDP attempt; rebuilding serially and rerunning the focused CDP journey passed.
+
+## Acceptance Criteria
+
+- The configuration default preserves existing production behavior and no operational CLI flag is added.
+- Both modes pass build, config filesystem validation, daemon `profiles open`, and the local real-Chromium matrix without Keychain prompts.
+- Both modes run every applicable real-provider case without fixtures, interception, retries, or unauthorized profile switching.
+- Each provider and connection-mode run uses one stable task/page journey, and every step proves exact Chromium target continuity.
+- Results identify capability differences by observable outcome, not by protocol reputation.
+- CDP remains experimental until all applicable real-provider gates pass and browser crash/reconnect behavior is proven at the packaged daemon boundary.
+- Any later default change is a separate product decision with its own changeset and migration note.
+
+## Lifecycle
+
+Keep this roadmap active until the two-mode real-provider run is complete and a connection-mode decision is recorded. Archive it after the decision, preserving the measured results and linking any follow-up implementation roadmap.
diff --git a/docs/roadmaps/P0-browser-runtime-selection-and-cloak.md b/docs/roadmaps/P0-browser-runtime-selection-and-cloak.md
new file mode 100644
index 0000000..3922bf3
--- /dev/null
+++ b/docs/roadmaps/P0-browser-runtime-selection-and-cloak.md
@@ -0,0 +1,304 @@
+# Browser Runtime Selection and Cloak Integration
+
+Status: in progress | Priority: P0 | Last reviewed: 2026-08-01
+
+Depends on: Tokenless setup, managed profile lifecycle, the Playwright runner, the packaged daemon, browser E2E infrastructure, and real-provider acceptance gates
+
+Supports: [Real Provider Browser E2E and Native Projects](P0-real-provider-browser-e2e-and-native-projects.md), [Provider Expansion and Parity](P0-provider-expansion.md), and [Concurrency and Session Scheduling](P0-concurrency-and-session-scheduling.md)
+
+## Outcome
+
+Tokenless selects and launches one exact Chromium-family runtime for every managed profile while continuing to use Playwright as the browser-control layer. The default path uses a compatible browser already installed by the user. If no supported system browser exists, setup may lazily install a Tokenless-managed Chrome for Testing runtime. CloakBrowser is an explicit opt-in choice that setup downloads from Cloak's official release source, verifies, caches, and launches through the same runtime interface.
+
+The implementation must improve browser realism without silently changing a profile's browser family, corrupting a profile through a browser downgrade, weakening Chromium sandboxing, accessing browser secrets, or redistributing a Cloak binary in a Tokenless package or release artifact.
+
+## Review Snapshot
+
+Plan identity: `P0-browser-runtime-selection-and-cloak.md` | Lifecycle: active | Delivery status: in progress | Audited: 2026-08-01
+
+The plan is saved in the root of `docs/roadmaps/`, which is the repository's authoritative active-roadmap location, and is linked from `docs/roadmaps/README.md` under the name **Browser Runtime Selection and Cloak Integration**.
+
+| Plan area | Marked complete | Audit interpretation |
+| --- | ---: | --- |
+| Runtime foundation | 5 / 5 | Production catalog, manager, exact executable resolution, transactional installation, and independent Playwright pin exist. |
+| Durable selection and profile binding | 6 / 6 | Production config/profile paths implement exact runtime binding, clean family changes, downgrade protection, and no profile/auth-state copying. |
+| Setup and daemon integration | 6 / 6 | Interactive and non-interactive setup, lazy download policy, atomic persistence ordering, and daemon resolution paths exist. |
+| Safe Chromium profile inventory | 5 / 5 | Setup enumerates known Chromium profile directories without browser state, resolves safe version metadata, classifies exact platform-pin alignment, presents bilingual results, and requires a clean-profile confirmation before download. |
+| Exact Playwright launch | 4 / 4 | The resolved executable and launch policy reach Playwright/CDP; sandboxing, test-only keychain neutrality, and cleanup are preserved. |
+| Inspection, recovery, and documentation | 5 / 5 | Doctor, cache reuse/repair, bilingual docs, licensing, and cross-platform release-gate launchers exist. |
+| Real-boundary acceptance | 10 / 15 | macOS positive runtime paths and the locally executable fail-closed paths are proven. Five environment-dependent release gates remain open; implementation completion is not release completion. |
+
+The unchecked acceptance items are authoritative: macOS `auto` fallback on a host with no system browser, Windows x64 Intel, Windows x64 AMD, Windows Chrome 150 profile-inventory classification, and authenticated provider closure across the selected runtimes. Public-surface results remain observational even though the latest strict Cloak run completed successfully; they do not replace authenticated provider acceptance.
+
+Detailed Windows AMD64 execution, source-browser version cases, evidence requirements, and completion state are tracked in the active [Windows AMD64 Cloak Setup Acceptance Test Plan](P0-windows-amd64-cloak-setup-acceptance-test-plan.md). This parent roadmap remains the product-support authority; the test plan is its AMD-hardware evidence ledger. Intel-hardware acceptance remains a separate unchecked gate in this parent roadmap.
+
+## Product Decisions
+
+### Target platforms
+
+The first release target set is intentionally narrow:
+
+| Platform | Architecture | System browsers | Managed fallback | Cloak |
+| --- | --- | --- | --- | --- |
+| macOS | Apple Silicon (`darwin-arm64`) | Chrome, Edge, Brave, Arc, Chromium | Chrome for Testing 145 | Cloak 145 |
+| Windows | Intel/AMD 64-bit (`win32-x64`) | Chrome, Edge, Brave, Chromium | Chrome for Testing 145 | Cloak 146 |
+
+Intel macOS, Windows ARM, and Linux are out of scope for the first supported release. Unsupported platforms fail clearly before download or profile mutation.
+
+### Locked runtime catalog
+
+The catalog is owned by production code and records exact version, official source, archive checksum, executable layout, and launch policy for every managed runtime.
+
+| Runtime | Platform | Locked version | Distribution decision |
+| --- | --- | --- | --- |
+| Cloak | `darwin-arm64` | `145.0.7632.109.2` | Download from the official Cloak GitHub release during explicit setup selection; do not bundle or redistribute. |
+| Cloak | `win32-x64` | `146.0.7680.177.5` | Download from the official Cloak GitHub release during explicit setup selection; do not bundle or redistribute. |
+| Managed Chrome for Testing | `darwin-arm64` | Chromium `145.0.7632.6` | Download lazily during setup when selected or when `auto` finds no supported system browser. |
+| Managed Chrome for Testing | `win32-x64` | Chromium `145.0.7632.6` | Download lazily during setup when selected or when `auto` finds no supported system browser. |
+
+The managed fallback is described accurately as Chrome for Testing, even when a user-facing choice uses the shorter label "Tokenless-managed Chromium." Playwright's library version and the managed browser catalog are independent pins; upgrading Playwright must not implicitly change the selected browser runtime.
+
+### Cloak support and profile-version classification
+
+Tokenless v1 supports only the no-license-key Cloak artifacts pinned in the production catalog. The upstream release list may contain newer Pro builds, but their existence does not make them Tokenless-supported. Tokenless does not request, store, or manage a Cloak license key in this scope.
+
+| Platform | Supported Cloak artifact | Cloak browser version used for profile classification | Current Tokenless decision |
+| --- | --- | --- | --- |
+| `darwin-arm64` | `145.0.7632.109.2` | `145.0.7632.109` | Supported and locked. |
+| `win32-x64` | `146.0.7680.177.5` | `146.0.7680.177` | Supported and locked. |
+
+The fifth component is Cloak's artifact revision; Chromium profile comparison uses the four-component browser version. A candidate is version-aligned only when its owning browser's complete four-component version equals the platform catalog entry's `browserVersion`. A major-only value such as `150` is insufficient for a positive match. A Windows profile last used by any Chromium 150 build is not aligned with the currently supported Windows Cloak 146 runtime.
+
+Version alignment is informational and does not make a profile importable by Tokenless. Tokenless may enumerate only non-secret metadata: browser identity, executable version, user-data root, and validated profile directory key. It must not read `Local State`, `Preferences`, cookies, tokens, browser storage, encryption keys, account names, emails, avatars, or authentication state for this flow. It must not copy a profile directory or open the source browser's profile with Cloak. The safe follow-up is to create a clean Cloak-bound profile and let the user sign in visibly.
+
+### Selection semantics
+
+Tokenless exposes these durable browser preferences:
+
+- `auto`: the default. Prefer a supported installed system browser; if none exists, install and select the locked managed fallback during setup.
+- `chrome`, `edge`, `brave`, `arc`, or `chromium`: require that exact system browser. A missing explicit selection fails; it never silently falls back.
+- `managed-chromium`: require the catalog-pinned Tokenless-managed Chrome for Testing runtime.
+- `cloak`: explicitly opt in to the catalog-pinned Cloak runtime for the current platform.
+
+`--no-browser-download` prevents setup from downloading a missing managed runtime and turns the condition into an actionable failure. npm install, package postinstall, daemon startup, and ordinary job execution never download a browser. Browser installation is a setup operation; the daemon only resolves and launches already-provisioned runtimes.
+
+### Profile/runtime compatibility
+
+Every managed profile is bound to the exact runtime family that created it:
+
+```json
+{
+  "runtimeBinding": {
+    "runtimeId": "system:chrome",
+    "family": "system",
+    "browserId": "chrome",
+    "createdWithVersion": "150.0.7871.187",
+    "profileFormat": 1
+  }
+}
+```
+
+The invariant is strict:
+
+- Tokenless never opens one managed profile with a different runtime family through automatic fallback.
+- Changing from a system browser to managed Chrome for Testing or Cloak provisions a new clean managed profile.
+- Removing a system browser does not cause its existing profile to open with the managed fallback.
+- System browser in-family updates remain supported, but the observed version is recorded and downgrade compatibility fails closed.
+- Tokenless never copies a local Chrome, Brave, or Cloak profile into a managed profile. This includes opaque file copies: cookies, tokens, browser storage, Keychain-linked state, and other authentication data are never migrated by Tokenless.
+- Users authenticate inside the clean Tokenless-managed profile through the visible browser. The browser owns that profile's session afterward, and Tokenless may reuse the same runtime-bound profile without reading its authentication data.
+
+## Architecture
+
+### Deep runtime module
+
+One `BrowserRuntimeManager` module owns runtime discovery, selection, installation, verification, caching, and profile-compatible resolution. Its external interface remains small:
+
+```ts
+interface BrowserRuntimeManager {
+  discover(): Promise<BrowserCandidate[]>
+  ensure(selection: BrowserSelection, options?: EnsureRuntimeOptions): Promise<ResolvedBrowserRuntime>
+  resolveForProfile(profile: ManagedProfileRecord): Promise<ResolvedBrowserRuntime>
+  inspect(selectionOrProfile: BrowserSelection | ManagedProfileRecord): Promise<BrowserRuntimeInspection>
+}
+```
+
+The module contains three real adapters behind internal seams:
+
+- `SystemBrowserAdapter` discovers supported installed browsers and their actual executable versions.
+- `ManagedChromiumAdapter` installs and resolves the locked Chrome for Testing runtime.
+- `CloakBrowserAdapter` installs and resolves the platform-specific Cloak runtime with its dedicated launch policy.
+
+Callers receive a fully resolved launch target instead of reinterpreting a browser ID:
+
+```ts
+type ResolvedBrowserRuntime = {
+  runtimeId: string
+  family: 'system' | 'managed-chromium' | 'cloak'
+  browserId: string
+  executablePath: string
+  actualVersion: string
+  expectedVersion: string | null
+  source: 'system' | 'tokenless-cache'
+  managed: boolean
+  checksumVerified: boolean | null
+  launchPolicy: 'standard' | 'cloak'
+}
+```
+
+Setup, config, profiles, doctor, daemon, and the Playwright context manager must cross this seam. Browser-specific download paths, checksums, archive layouts, and launch arguments must not be duplicated across those callers.
+
+### Cache and installation transaction
+
+Managed artifacts live below the Tokenless home rather than inside the npm package:
+
+```text
+~/.tokenless/browser/
+├── runtimes/
+│   ├── cloak/<platform>/<version>/
+│   └── managed-chromium/<platform>/<version>/
+├── installed.json
+└── install.writer.sqlite
+```
+
+An install transaction:
+
+1. obtains the browser install writer lock;
+2. downloads the exact catalog artifact into a unique temporary directory;
+3. verifies the SHA-256 checksum before extraction;
+4. rejects unsafe archive paths and extracts into another temporary directory;
+5. verifies the expected executable exists and runs `--version`;
+6. performs a real, sandboxed smoke launch with a disposable keychain-neutral profile;
+7. writes the installed-runtime manifest; and
+8. atomically renames the verified runtime into its final cache directory.
+
+Interrupted or failed installs leave the prior verified runtime intact. Offline setup reuses a verified cached runtime. A checksum, version, executable-layout, smoke-launch, or platform mismatch fails closed and must not update config or profile selection.
+
+### Setup transaction
+
+Setup performs browser work before daemon readiness:
+
+1. read config and stop or quiesce a running local daemon when the selected runtime/profile may change;
+2. ask whether to enable Anti-Detect mode and state in that question that accepting will download and install the verified platform-pinned CloakBrowser under `TOKENLESS_HOME` when needed;
+3. when Anti-Detect is declined, follow an explicit browser, then the saved normal-browser preference, then deterministic automatic discovery without asking the user to choose a runtime implementation;
+4. when Cloak is selected, enumerate safe metadata for known local Chromium profiles across Chrome, Brave, Edge, Arc, Chromium, and Chrome for Testing where that browser exists on the platform;
+5. classify exact four-component alignment against the platform Cloak catalog entry and show both aligned and non-aligned candidates without reading browser secrets;
+6. when aligned candidates exist, present one profile-source choice containing `Start clean` and the aligned profiles; selecting a profile explicitly authorizes its opaque local copy, with no separate import, copy-consent, or installation confirmation;
+7. when no candidate aligns, select a clean Cloak profile without asking a profile-source question;
+8. resolve or install the selected runtime, verify it, and immediately persist the concrete browser and executable path;
+9. provision or select a compatible managed profile, recheck Cloak/profile version compatibility at the copy boundary, and perform an explicitly authorized opaque copy when selected;
+10. persist profile preferences and the provider whitelist;
+11. start the daemon, verify runtime/profile readiness, and leave one headed review tab open for every enabled provider.
+
+The Anti-Detect question carries the installation disclosure; there is no later installation confirmation. English and Simplified Chinese flows carry equivalent meaning. In non-interactive setup, explicit `--anti-detect` or `--browser cloak` authorizes installation, while an inherited Cloak preference without either flag fails before download with `setup_cloak_confirmation_required`. Non-interactive profile import additionally requires `--consent-local-profile-copy` because no visible profile-source selection occurred.
+
+### Playwright launch contract
+
+Playwright remains the automation layer, but it always launches the exact `executablePath` supplied by `ResolvedBrowserRuntime`. Production code must not switch back to `channel: 'chrome'` or `channel: 'msedge'` after setup has resolved a particular executable.
+
+The standard policy preserves the browser-managed session while supplying the arguments required for Tokenless operation. The Cloak policy also avoids Playwright defaults that disable or overwrite browser-managed fingerprint behavior. Both policies preserve Chromium sandboxing and process cleanup.
+
+Every production and test Chromium launch retains `--password-store=basic` and `--use-mock-keychain`, regardless of its configured executable. A managed profile therefore keeps one keychain-neutral storage mode across Playwright and CDP launches, and no test may trigger or automate a macOS Keychain prompt.
+
+## Delivery Plan and Alignment Ledger
+
+This ledger is updated as implementation and evidence land. A checked code item means the production path exists; a checked evidence item means the stated real-boundary proof has been inspected and recorded.
+
+### Milestone 1: Runtime foundation
+
+- [x] Add the typed platform/version/checksum catalog for supported managed runtimes.
+- [x] Add `BrowserRuntimeManager` and the system, managed-Chromium, and Cloak adapters.
+- [x] Resolve actual executable versions and always return an exact executable path.
+- [x] Add safe cache layout, writer locking, checksum verification, archive extraction, version verification, smoke launch, and atomic installation.
+- [x] Pin the Playwright library independently from the browser catalog.
+
+### Milestone 2: Durable selection and profile binding
+
+- [x] Add `auto`, `managed-chromium`, and `cloak` to the durable browser selection contract.
+- [x] Migrate config and managed-profile records without silently rebinding existing profiles.
+- [x] Add runtime binding to newly provisioned profiles.
+- [x] Fail before browser launch when a profile/runtime family or downgrade invariant is violated.
+- [x] Create a clean profile when setup changes runtime family.
+- [x] Remove browser-profile and authentication-state copy paths; legacy copy flags fail closed with `browser_profile_copy_disabled`.
+
+### Milestone 3: Setup and daemon integration
+
+- [x] Make setup enumerate system and cached candidates and explain download requirements.
+- [x] Implement system-first `auto` behavior and explicit-choice fail-closed behavior.
+- [x] Add `--no-browser-download` and localized English/Chinese setup messages.
+- [x] Complete installation and profile selection before starting the daemon.
+- [x] Persist config only after runtime and profile verification succeed.
+- [x] Make the daemon resolve the profile-bound runtime without downloading or reselecting.
+
+### Milestone 3A: Safe Chromium profile inventory
+
+- [x] Replace `Local State`-based setup discovery with directory-only profile enumeration that cannot read account or browser-secret fields.
+- [x] Cover known Chrome, Brave, Edge, Arc, Chromium, and Chrome for Testing roots on supported macOS and Windows platforms.
+- [x] Map every candidate to its safe profile `Last Version`, falling back to the exact owning installed-browser version when needed; never infer Chrome's version for another Chromium browser.
+- [x] Classify candidates against the production Cloak catalog and present aligned and non-aligned results in equivalent English and Simplified Chinese output, including the official CloakBrowser reference.
+- [x] Add the safe second setup choice to continue with a clean Cloak profile; keep profile/authentication-state import absent and legacy copy flags fail-closed.
+
+### Milestone 4: Exact Playwright launch
+
+- [x] Pass `ResolvedBrowserRuntime.executablePath` through the daemon and runner to the context manager.
+- [x] Remove normal-path channel-based executable re-resolution.
+- [x] Add a dedicated Cloak launch policy without weakening sandboxing.
+- [x] Preserve test-only keychain-neutral flags and verify clean child-process shutdown.
+
+### Milestone 5: Inspection, recovery, and documentation
+
+- [x] Extend doctor output with preference, runtime family, actual/expected version, executable source, checksum state, and profile compatibility.
+- [x] Support verified-cache reuse and explicit repair/reinstall through setup; a failed replacement restores the previous cache.
+- [x] Align `README.md`, `README.zh-CN.md`, CLI package documentation, command reference, and changeset.
+- [x] Document Cloak licensing accurately: Tokenless downloads from the official source on user selection and does not redistribute the proprietary binary.
+- [x] Make every live browser release-gate command portable across POSIX shells and Windows `cmd.exe` by setting gate variables inside Node launchers.
+
+### Milestone 6: Real-boundary acceptance
+
+Windows AMD64 execution for the following gates is specified and recorded in the active [Windows AMD64 Cloak Setup Acceptance Test Plan](P0-windows-amd64-cloak-setup-acceptance-test-plan.md). The Intel gate remains tracked only in this parent roadmap.
+
+- [x] macOS Apple Silicon: the built-CLI browser-runtime gate proved `auto` resolves an installed system browser without a managed download and records its exact runtime.
+- [ ] macOS Apple Silicon: no system browser causes `auto` to install and launch managed Chrome for Testing 145.
+- [x] macOS Apple Silicon: the direct manager and built-CLI gates completed download, checksum, extraction, version, sandboxed smoke launch, atomic cache commit, profile binding, and doctor inspection for managed Chrome for Testing `145.0.7632.6`.
+- [x] macOS Apple Silicon: the direct manager and built-CLI gates completed the same install, repair, profile-binding, and doctor checks for Cloak `145.0.7632.109.2`; the production daemon resolved and launched that exact runtime, while authenticated built-CLI provider closure remains pending below.
+- [ ] Windows x64 on Intel hardware: system, managed, and Cloak paths pass the same setup/runtime checks.
+- [ ] Windows x64 on AMD hardware: system, managed, and Cloak paths pass the same setup/runtime checks.
+- [ ] Windows x64 with a real Chrome 150 profile: setup lists only safe directory/version metadata, classifies it as non-aligned with Cloak 146, offers a clean Cloak profile instead of import, and leaves the source profile unchanged.
+- [x] Offline-style rerun with downloads disabled reused the previously verified managed Chrome for Testing runtime and performed no download.
+- [x] Corrupted managed-cache checksum or browser-version metadata fails closed without changing config or the profile registry.
+- [x] Built-CLI profile open preserves the exact `profile_runtime_mismatch` and `profile_browser_downgrade_blocked` errors and fails without changing config, registry, or profile-directory contents.
+- [x] Post-download checksum mismatch, an archive containing unsafe paths, and an artifact whose executable reports the wrong version fail in the shared production verifier before cache commit or config/profile mutation.
+- [x] A real unsupported `darwin-x64` process failed before download, config, profile, or cache mutation.
+- [x] Test-only installer and surface gates remained keychain-neutral, production Cloak launched without a Keychain prompt, sandboxing stayed enabled, and spawned processes were cleaned up.
+- [ ] Built-CLI real-provider gates run against ChatGPT, Claude, Gemini, Qwen, DeepSeek, Grok, Grok Cloud, and Google surfaces using system, managed, and Cloak runtimes where the selected profile is authenticated.
+- [x] macOS CAPTCHA/challenge outcomes are recorded for system Chrome, managed Chrome for Testing, and Cloak; the evidence is explicitly observational and does not claim guaranteed CAPTCHA bypass.
+
+### Evidence recorded on 2026-08-01
+
+- The browser surface matrix used system Chrome `150.0.7871.187`, managed Chrome for Testing `145.0.7632.6`, and Cloak `145.0.7632.109.2` with Playwright, real headed browser processes, keychain-neutral isolated test profiles, the real provider network, and no observer process.
+- In each Cloak run, ChatGPT, Claude, Gemini, Grok Cloud, Qwen, and DeepSeek completed navigation with real HTTP responses and no detected reCAPTCHA, Cloudflare, hCaptcha, or verification-title challenge.
+- In the repeatable sequential comparison, system Chrome reached a Claude Cloudflare interstitial, a DeepSeek Human Verification page, and Google `/sorry/`; managed Chrome for Testing reached Google `/sorry/`; Cloak reached the normal provider surfaces and Google Search. Cloak returned HTTP 200 search results with no detected challenge in three consecutive runs, including runs after both other runtimes had been blocked.
+- The built CLI and production daemon successfully resolved and launched the exact profile-bound Cloak runtime. A subsequent durable `auth.status` job timed out in the provider action scheduler, so this evidence does not close authenticated provider actions, prompt submission, or response generation.
+- The official Windows x64 Chrome for Testing `145.0.7632.6` and Cloak `146.0.7680.177.5` archives were downloaded on macOS for static verification; both matched the catalog SHA-256 values and contained the expected executable layout. This is artifact evidence only and does not replace Windows launch acceptance.
+- An invalid local Anti-Detect setup check launched the production Cloak target instead of a keychain-neutral E2E target and triggered a macOS Keychain prompt. The user selected Deny, the browser and test daemon were stopped, and that run was discarded. `e2eInspection` launches now retain Playwright's `--password-store=basic` and `--use-mock-keychain` defaults while production launch options remain unchanged. Subsequent focused runtime and surface gates completed without a Keychain prompt, closing the regression gate.
+- The built-CLI browser-runtime gate mutated only its temporary verified Cloak cache and proved that mismatched checksum and browser-version manifest fields return `browser_runtime_cache_invalid` while config and the profile registry remain byte-for-byte unchanged.
+- The same gate created real temporary registry profiles with mismatched and downgrade bindings, called `profiles open` through the built CLI and packaged daemon, received the exact domain errors, and proved that config, registry, and profile-directory contents remained unchanged. This gate exposed and fixed both generic `daemon_store_error` wrapping and a redundant same-value daemon URL write before it passed.
+- The cross-platform Node launcher then reran the complete built-CLI browser-runtime gate successfully in 69 seconds. The checked-in npm release-gate commands no longer depend on POSIX-only `VAR=value command` syntax; live Windows execution remains required before declaring Windows support.
+- The same launcher attempted a fresh Cloak-only surface gate. The suite failed without retry at Qwen navigation because the machine's active DNS resolver returned Qwen's CNAME but no final address (`ERR_NAME_NOT_RESOLVED`). Qwen's official page and public DNS still identified `https://chat.qwen.ai/` and resolved its current addresses, so the endpoint was not changed and no test-only DNS override was introduced. This run is recorded as failed external-prerequisite evidence, not as provider or CAPTCHA acceptance.
+- A gate audit found that provider challenge outcomes were recorded but not asserted. The surface gate now fails when any enabled provider renders a detected reCAPTCHA, Cloudflare, hCaptcha, or verification-title challenge; navigation success alone can no longer produce a false pass.
+- A checksum-verified official Node.js `v22.13.1` `darwin-x64` binary ran under Rosetta as a real unsupported process and invoked the built CLI with `install --browser cloak`. The CLI returned exit code 1 with exact code `browser_runtime_platform_unsupported`; the dedicated Tokenless home remained empty, proving that config, profile, browser cache, and download state were not created. The temporary Node and home directories were removed after inspection.
+- After the system resolver recovered, the stricter Cloak-only surface gate passed with Cloak browser `145.0.7632.109`: ChatGPT, Claude, Gemini, Grok Cloud, Qwen, and DeepSeek all completed real navigation with no detected challenge, and Google rendered search results with no reCAPTCHA signal.
+- A fresh full matrix then visited every enabled provider and Google before evaluating each runtime. System Chrome `150.0.7871.187` failed on the Claude Cloudflare interstitial and Google `/sorry`; managed Chrome for Testing `145.0.7632.6` recorded a Gemini navigation abort and Google `/sorry`; Cloak passed every surface again. The gate was corrected so an early provider failure can no longer prevent later providers or Google from being exercised, and a failed navigation that remains on the prior origin no longer misattributes the prior page's challenge to the next provider.
+- The managed-artifact security integration called the same production verifier used immediately after a real download and before cache commit. With real tar.gz bytes, the real filesystem, the system `tar` executable, and a real version subprocess, it received exact `browser_runtime_checksum_mismatch`, `browser_runtime_archive_unsafe`, and `browser_runtime_version_mismatch` errors. The checksum case created no payload, the unsafe entry escaped nowhere, and config/profile sentinel files remained byte-for-byte unchanged in all three cases. The complete built-CLI browser-runtime gate passed again in 75 seconds after this refactor, proving the official managed Chrome and Cloak positive install paths still work. A later targeted managed-browser surface rerun also visited every provider successfully and isolated its current blockers to the Claude Cloudflare interstitial and Google `/sorry`.
+- The current selected user profile is bound to system Chrome rather than Cloak, and `doctor` reports no usable provider readiness observations for ChatGPT, Claude, Gemini, or Grok. Tokenless must not silently switch that profile or automate provider login. Authenticated cross-runtime closure therefore requires the user to explicitly select a clean runtime-bound profile, sign in visibly, and then invoke the manual provider gates.
+- The official release list now also exposes Cloak Pro Chromium 150 builds for macOS and Windows, but obtaining the current Pro binary requires a Cloak key. The current Tokenless scope remains the no-license-key catalog pins above; Pro 150 is not silently added to the supported set. See the [official CloakBrowser releases](https://github.com/CloakHQ/CloakBrowser/releases).
+- The built CLI's real filesystem inventory found the current macOS Chrome, Brave, Edge, Arc, Chromium, and Chrome for Testing roots without parsing `Local State`. Chrome `150.0.7871.127`, Brave `150.1.92.140`, Arc `150.0.7871.115`, and Chrome for Testing `147.0.7727.15` were non-aligned; Chromium `145.0.7632.109` was exactly aligned with the macOS Cloak pin. Edge had no standard persistent profile directory to list.
+- Historical evidence: a real interactive built-CLI setup used an isolated Tokenless home, selected Anti-Detect, displayed the official project link, exact Cloak/Chromium pin, all discovered candidate classifications, and the former second clean-profile confirmation. Declining returned `setup_cloak_profile_declined` before mutation. That redundant second confirmation has since been superseded by the installation disclosure in the initial Anti-Detect question and the single profile-source choice.
+- The focused built-CLI filesystem integration passed with real `Default` and `Profile 1` directories, an exact aligned `Last Version`, a mismatched Chromium 150 version, and deliberately invalid `Local State` contents. It classified both versions correctly and succeeded without parsing the invalid browser-state file.
+- Historical evidence: the former positive interactive path accepted both Anti-Detect confirmations in an isolated home, reused the checksum-verified Cloak cache with downloads disabled, reported exact Cloak browser `145.0.7632.109`, and reached provider/profile selection. The current flow removes the redundant second confirmation. A separate built-CLI clean-profile boundary against that exact cache created a ready default profile bound to runtime `cloak:darwin-arm64:145.0.7632.109.2`, family/browser `cloak`, and created-with version `145.0.7632.109`.
+- The non-interactive built-CLI contract now proves that a saved Cloak preference alone fails with `setup_cloak_confirmation_required` before runtime/profile mutation, while explicit `--anti-detect` passes consent handling and reaches the expected runtime ensure boundary. The same contract proves that incomplete two- or three-component `Last Version` metadata is `unknown` rather than a false non-aligned result.
+
+## Release Gate
+
+This roadmap remains in progress until every supported-platform path is implemented and the real-boundary acceptance evidence is complete. A macOS-only proof may advance the implementation but cannot establish Windows support. Prototype scripts, fixture checks, source-string assertions, or a browser opening a page are development evidence only and cannot replace built-CLI setup, daemon, profile, and real-provider verification.
+
+No Cloak binary may be included in npm packages, installers, GitHub release artifacts, or repository history. No release may claim profile portability across runtime families, authentication-state migration, or CAPTCHA bypass. No-license-key support must remain distinct from upstream Pro/keyed builds. The release must instead state the exact supported platforms, locked managed-runtime versions, selection rules, clean-profile isolation behavior, and observed provider evidence.
diff --git a/docs/roadmaps/P0-concurrency-and-session-scheduling.md b/docs/roadmaps/P0-concurrency-and-session-scheduling.md
new file mode 100644
index 0000000..668284a
--- /dev/null
+++ b/docs/roadmaps/P0-concurrency-and-session-scheduling.md
@@ -0,0 +1,537 @@
+# Concurrency and Session Scheduling
+
+Status: in progress | Priority: P0
+
+Depends on: Local daemon job persistence, claim leases, managed profile lifecycle, provider access and subscription observation, capability routing, embedded browser-runtime supervision, and exact workspace/conversation identity
+
+Rate-limit slice: implemented and algorithmically verified on 2026-08-01. The versioned catalog, packaged validation, subscription-aware capacity policy, immutable submission facts, cadence admission, bounded deferral, in-scope provider fallback, capability-safe provider preference tie-breaking, CLI diagnostics, and focused real-boundary simulation are delivered. The broader concurrency roadmap remains active for idempotency, bounded queues, conversation lanes, page leases, and multi-profile fairness. See [Provider Rate-Limit Knowledge and Runtime Policy](../provider-rate-limits.md).
+
+## Outcome
+
+Every Tokenless invocation is durably admitted through the local daemon and executed under an explicit concurrency contract. Concurrent callers cannot duplicate a logically idempotent submission, race on one conversation, navigate another job's page, overwrite shared Project context, or overload a provider profile without bounded backpressure.
+
+Before provider mutation, Tokenless should also estimate each candidate provider/profile's current capacity from a maintained subscription-aware knowledge catalog and the existing durable job history. The estimate reduces avoidable rate-limit failures and provides useful cadence and eligibility information without claiming to reproduce private provider enforcement exactly.
+
+The scheduler should allow useful concurrency:
+
+- different managed profiles run independently in their own browser instances;
+- different conversations in the same provider profile may run concurrently when the provider capability and configured limit permit it;
+- the same conversation remains single-writer;
+- shared Project or workspace mutations are serialized; and
+- repository indexing and provider-mirror revisions remain consistent with the task that consumes them.
+
+## Current Behavior Audit
+
+As of 2026-07-30, the current source implements several important foundations:
+
+- `tokenless run` is daemon-only; each invocation creates a local-daemon job before visible provider work begins.
+- Jobs, results, errors, blockers, checkpoints, timestamps, task metadata, backend, and profile scope are persisted in SQLite.
+- `claim-next` uses an atomic FIFO `UPDATE ... RETURNING` transaction scoped to execution backend and profile.
+- Claims have renewable leases; expired safe claims can be requeued, while ambiguous mutating outcomes fail closed.
+- Embedded browser-runtime startup is owned by the daemon and guarded by profile/job identity.
+- The embedded browser runtime can execute multiple managed profiles under daemon-owned limits.
+- The scheduler allows at most one in-flight job per profile, regardless of provider, project, or conversation.
+- Each profile owns one persistent browser context. Its operations are also serialized by a profile lane.
+
+The current page and conversation behavior is more limited:
+
+- A job does not receive a new page by default.
+- `ManagedBrowserContext.page()` returns the first existing page in the profile context and creates a page only when no page exists.
+- Each job navigates that reused page to its resolved target.
+- Without an explicit target or a working conversation mapping, the target is the provider home URL, which normally starts a new provider conversation in the same browser tab.
+- An explicit `--target-url` can target an existing conversation.
+- Successful response-reading jobs with a task ID now persist validated provider/task conversation URLs, and native Workspace jobs can also persist project-scoped conversation mappings. `workspace-mode conversation` and native Workspace target resolution can reuse those exact same-provider, same-profile mappings when the provider capability is proven.
+- Reusing a `taskId` or idempotency key does not deduplicate job creation. Multiple concurrent callers can create multiple jobs that later submit duplicate prompts.
+- There is no project-, workspace-, conversation-, or page-scoped scheduler lane, no queue admission limit, and no user-visible queue position.
+- The `jobs` table already preserves provider, profile, request, result, status, and job timestamps, but it does not preserve one immutable provider-submission timestamp. `updated_at` changes during claims, checkpoints, and completion, while the active submit checkpoint is cleared when a job completes.
+- There is no packaged provider rate-limit catalog, subscription-aware capacity estimate, historical sliding-window projection, cadence admission, or reset-time parsing.
+
+Therefore the current answer is:
+
+> Concurrent calls are durably queued, and calls using the same profile run one at a time. They do not each open a new page. They reuse the first page. Exact conversation reuse is available only through proven provider/profile mappings and explicit Workspace or conversation targeting, while duplicate suppression remains incomplete.
+
+## Concurrency Identity
+
+Scheduling must not derive identity from display names. Introduce durable, versioned identifiers:
+
+| Identity | Purpose |
+| --- | --- |
+| `jobId` | One physical execution attempt recorded by the daemon |
+| `requestId` | One caller request and its observable response |
+| `idempotencyKey` | Deduplicates logically identical caller intent within an explicit scope |
+| `agentSessionId` | Connects the job to the exact originating agent conversation |
+| `projectId` and `worktreeId` | Identify the local project and source-state scope |
+| `providerProfileId` | Identifies the isolated authenticated browser profile |
+| `providerWorkspaceId` | Identifies the exact native Project or conversation-scoped workspace |
+| `conversationId` | Identifies one provider conversation independently of its display title |
+| `pageLeaseId` | Identifies temporary ownership of one live browser page |
+| `contextRevision` | Identifies the exact context or graph mirror consumed by the job |
+
+Human-readable project and chat names remain metadata only.
+
+## Scheduler Lanes
+
+Jobs acquire the narrowest required lanes in a canonical order to prevent deadlocks.
+
+### Profile Lane
+
+Protects one persistent user-data directory and enforces the provider/profile concurrency budget. A profile may own multiple live pages, but only through the scheduler.
+
+### Provider Workspace Lane
+
+Serializes mutations shared by all conversations in a native Project:
+
+- Project creation or selection;
+- instruction updates;
+- knowledge-graph mirror upload or revision activation; and
+- provider resource deletion or replacement.
+
+Once the required context revision is active, independent conversation jobs may proceed concurrently.
+
+### Conversation Lane
+
+Provides strict single-writer ordering for:
+
+- prompt input and attachment preparation;
+- prompt submission;
+- response completion and reading; and
+- conversation-scoped context updates.
+
+Two jobs must never type into, submit to, or navigate the same conversation concurrently.
+
+### Page Lease
+
+Associates one in-memory Playwright `Page` with one conversation lane for the duration of an active job or explicitly retained session. Page handles are not durable identity. The daemon persists the canonical provider URL and conversation identity so a page can be recreated after runner or browser restart.
+
+### Local Project Lane
+
+Serializes source snapshot and graph/mirror revision publication while allowing immutable revision reads. A task consumes one fixed revision even if the repository changes during provider execution.
+
+## Desired Page Model
+
+Use one persistent browser context per managed profile and an explicit page registry inside the runner:
+
+- allocate a fresh page when starting a new conversation;
+- reuse the page already leased to the exact conversation when safe;
+- recover an evicted or restarted page from the persisted canonical conversation URL;
+- never select `pages()[0]` as an implicit job destination;
+- isolate different conversations on different pages when concurrent execution is enabled;
+- close idle pages by bounded LRU and time policies;
+- preserve pages waiting for required user interaction when capacity allows; and
+- expose page capacity and waiting state through daemon job status.
+
+Provider capability determines whether parallel pages are enabled. A conservative provider or account can remain at concurrency one.
+
+## Idempotency and Submission Safety
+
+Idempotency must be enforced transactionally in SQLite, not by caller convention.
+
+- The caller supplies or Tokenless derives an `idempotencyKey` with an explicit scope and expiry.
+- Creating a duplicate active or completed request returns the existing job and result instead of inserting another job.
+- A distinct new request always receives a new key and job.
+- `taskId` groups related work but is not itself assumed to mean deduplication.
+- The daemon records submission intent before browser mutation and persists the canonical provider conversation URL immediately after visible submission.
+- A crash before proven submission may retry from a safe checkpoint.
+- A crash during an ambiguous mutating action must not replay automatically.
+- Exactly-once provider mutation cannot be promised without provider support; Tokenless provides durable deduplication before dispatch and at-most-once replay policy after ambiguous submission.
+
+## Admission, Fairness, and Backpressure
+
+The daemon owns bounded admission rather than allowing an unbounded queue.
+
+- Configure global, per-profile, per-provider, per-project, and per-conversation limits.
+- Reserve capacity for resumed or waiting-for-user jobs so fresh work cannot starve them.
+- Use fair scheduling across projects and profiles while preserving FIFO order inside one conversation.
+- Expose queue position, blocking lane, estimated eligibility, and active limits in machine-readable state.
+- Reject or defer excess work with a retryable, actionable result before staging large attachments.
+- Apply provider-visible rate-limit evidence to reduce concurrency dynamically.
+- Before any provider mutation, an ineligible candidate may be deferred or replaced by another eligible provider/profile candidate inside the caller's routing scope.
+- Never replay or move a request that may already have been submitted to a different provider, profile, Project, or conversation automatically.
+
+Initial safe defaults should be cautious without trying to guarantee that Tokenless never reaches a real provider limit:
+
+- one mutating job per conversation;
+- one active job per provider profile until live evidence proves a higher safe value;
+- up to four active managed profiles and profile-owned browser instances on the current runner; and
+- one shared workspace mutation per provider Project.
+
+Reaching a real provider rate limit is an expected recoverable condition, not a scheduler correctness failure. The scheduler should reduce avoidable limit hits and produce a useful next-eligible estimate, but it does not promise an exact replica of private provider enforcement.
+
+## Provider Rate-Limit Knowledge Catalog
+
+Maintain the best available provider knowledge as a checked-in, versioned JSON catalog at:
+
+```text
+packages/cli/catalog/provider-rate-limits.v1.json
+```
+
+The catalog is external product knowledge, not provider DOM configuration and not runtime usage state. Build validation must copy the validated catalog into the published `dist/src` package so the CLI, daemon, diagnostics, and generated documentation consume one source of truth.
+
+The catalog records facts and uncertainty rather than inventing executable numbers for undocumented limits:
+
+- `official_exact`: an official numeric allowance and window;
+- `official_relative`: an official plan multiplier without a numeric base;
+- `official_dynamic`: an official window or quota whose allowance varies;
+- `official_qualitative`: an official statement such as "higher limits" without a schedulable number;
+- `observed`: a redacted, provenance-bound visible provider observation; and
+- `unknown`: no reliable current knowledge.
+
+The initial schema should have this shape:
+
+```json
+{
+  "schema": "tokenless.provider-rate-limit-catalog.v1",
+  "catalogVersion": 1,
+  "revision": "2026-07-31",
+  "reviewedAt": "2026-07-31",
+  "reviewAfter": "2026-08-31",
+  "runtimePolicy": {
+    "exactAllowanceHeadroomRatio": 0.9,
+    "burstRatio": 0.05
+  },
+  "sources": {
+    "openai-gpt55-chatgpt": {
+      "authority": "official",
+      "url": "https://help.openai.com/en/articles/11909943-gpt-5-3-and-gpt-55-in-chatgpt"
+    }
+  },
+  "providers": {
+    "chatgpt": {
+      "plans": [
+        {
+          "id": "plus",
+          "labels": ["Plus"]
+        }
+      ],
+      "rules": [
+        {
+          "id": "chatgpt.instant.plus-go.messages",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["go", "plus"],
+            "accessClasses": ["signed_in_paid"],
+            "modelFamilies": ["gpt-5.5-instant"],
+            "actions": ["prompt.submit"]
+          },
+          "meter": {
+            "kind": "count",
+            "unit": "message"
+          },
+          "window": {
+            "kind": "provider_managed",
+            "durationSeconds": 10800
+          },
+          "allowance": {
+            "kind": "exact",
+            "count": 160
+          },
+          "limitBehavior": {
+            "kind": "provider_native_fallback",
+            "targetModelFamily": "gpt-5.5-mini"
+          },
+          "evidence": [
+            {
+              "kind": "official_exact",
+              "sourceIds": ["openai-gpt55-chatgpt"]
+            }
+          ]
+        }
+      ]
+    }
+  }
+}
+```
+
+Every rule has a stable ID and independently matches:
+
+- provider and provider profile;
+- canonical subscription plan or plan family;
+- access class when the exact plan is unknown;
+- model family and effort or reasoning mode;
+- metered action or feature, including prompt submission and file upload;
+- count, compute, feature, or unknown meter;
+- rolling, fixed, session, weekly, or dynamic window;
+- exact, relative, dynamic, qualitative, or unknown allowance;
+- provider-native fallback or overage behavior; and
+- evidence URL, retrieval date, review date, validity, and replacement history.
+
+The first catalog covers every currently supported visible provider:
+
+| Provider | Initial schedulable knowledge | Knowledge retained without invented numbers | Official source |
+| --- | --- | --- | --- |
+| ChatGPT | Published message and upload windows where the plan/model rule is exact | Dynamic Free access, reasoning allowances, guardrails, native fallback, and plan-dependent behavior | `https://help.openai.com/en/articles/11909943-gpt-5-3-and-gpt-55-in-chatgpt` and `https://help.openai.com/en/articles/8555545-file-uploads-faq` |
+| Claude | Published five-hour session reset shape | Dynamic usage, weekly limits, Max plan multipliers, conversation length, attachments, model, effort, features, and optional paid overage | `https://support.claude.com/en/articles/11647753-how-do-usage-and-length-limits-work` and `https://support.claude.com/en/articles/11049762-choose-a-claude-plan` |
+| Gemini | Published compute-window and refresh behavior where current documentation states it | Compute-based dynamic allowance, weekly caps, plan multipliers, feature/model effects, and native fallback | `https://support.google.com/gemini/answer/16275805?hl=en` |
+| Grok | None until an official numeric consumer Web rule is available | Qualitative paid-plan statements such as higher limits | `https://x.ai/pricing` |
+| Qwen | None until an official numeric consumer Web rule is available | Unknown numeric Web limits and the prohibition on account creation to evade restrictions | `https://qwen.ai/usagepolicy` |
+| DeepSeek | None until an official numeric consumer Web rule is available | Unknown numeric Web limits; API concurrency limits are excluded | `https://chat.deepseek.com/downloads/DeepSeek%20User%20Agreement.pdf` |
+| Perplexity | Exact published Pro Search counts for Free and Enterprise tiers, retained by mode and observe-only until the run can prove that mode | Consumer paid-plan weekly descriptions, Best mode, feature usage, uploads, and heavy-usage behavior where no single exact allowance is published | `https://www.perplexity.ai/help-center/en/articles/11187416-which-perplexity-subscription-plan-is-right-for-you` |
+
+Catalog maintenance is explicit and reviewable:
+
+- fail validation for duplicate rule IDs, invalid references, malformed windows, or an `official_exact` allowance without official evidence;
+- warn when `reviewAfter` is stale rather than silently changing runtime behavior during a build;
+- never fetch or rewrite catalog data automatically during installation or build;
+- keep retired rules with validity or replacement metadata when history helps explain behavior;
+- update the catalog and generated English/Chinese user-facing documentation together when practical; and
+- include a changeset whenever a catalog or policy change materially changes CLI scheduling behavior.
+
+## Historical Usage Projection
+
+The SQLite `jobs` table remains the durable usage source. Do not introduce a separate rate-limit ledger table in V1.
+
+Add only the minimum missing submission fact to the existing table:
+
+- persist an immutable nullable `provider_submitted_at` when `prompt.submit` is visibly accepted;
+- never derive submission time from mutable `updated_at`;
+- retain `provider`, `profile_id`, and the structured request so the capacity module can derive model, effort, feature, message count, and attachment count;
+- add an index such as `(provider, profile_id, provider_submitted_at)` for bounded window queries; and
+- retain job history for at least the longest active catalog window used by scheduling.
+
+The V1 projection key is:
+
+```text
+(provider, profileId, modelFamily, action)
+```
+
+Tokenless does not correlate one provider account across multiple browser profiles. Each profile is an independent scheduling scope, even if a user manually signs the same external account into two profiles.
+
+For a candidate provider/profile, the capacity module queries submitted jobs inside every matching catalog window and derives metered usage from those jobs. One normal managed job is treated as one message submission; attachment and feature meters are derived from its structured actions and inputs. Ambiguous or externally initiated provider usage cannot be reconstructed and remains outside the local estimate.
+
+The resulting projection is diagnostic as well as schedulable:
+
+```ts
+type ProviderCapacityProjection = {
+  provider: ProviderId
+  profileId: string
+  planId: string
+  planConfidence: "exact_label" | "plan_family" | "paid_unknown" | "unknown"
+  matchedRuleIds: string[]
+  used: number | null
+  allowance: number | null
+  estimatedRemaining: number | null
+  windowStartedAt: string | null
+  estimatedEligibleAt: string | null
+  confidence: "exact_local_history" | "best_effort" | "unknown"
+}
+```
+
+`estimatedRemaining` is explicitly a local estimate. Manual provider use, another Tokenless home, undocumented provider meters, failed uploads that still consume quota, and provider-side policy changes can make it differ from the provider UI.
+
+## Capacity Policy Module
+
+Place one deep module at the scheduler seam. Callers learn one small interface while catalog matching, subscription aliases, SQLite projection, window arithmetic, cadence, visible reset overrides, and explanation generation remain inside its implementation:
+
+```ts
+interface ProviderCapacityPolicy {
+  evaluate(input: CapacityInput): CapacityDecision
+}
+
+type CapacityDecision = {
+  decision: "admit" | "defer" | "unknown"
+  estimatedEligibleAt: string | null
+  projection: ProviderCapacityProjection
+  reasons: string[]
+}
+```
+
+The policy follows these rules:
+
+1. Resolve the most specific catalog rule supported by the currently observed subscription, model, effort, and action.
+2. For an exact numeric rule, calculate a true sliding-window count from `jobs.provider_submitted_at`.
+3. Spread admitted requests with a GCRA or equivalent cadence derived from the window and allowance instead of allowing the entire known quota as an immediate burst.
+4. Use only modest configurable headroom for exact limits; an initial target near 90% is reasonable, but it is Tokenless scheduling policy rather than provider fact.
+5. For relative, dynamic, qualitative, or unknown limits, avoid fabricated counts and allow execution while retaining provider-visible evidence.
+6. Let a freshly observed provider reset time or cooldown override the static estimate for that provider/profile.
+7. Return explanations and estimates; do not claim that admission guarantees provider acceptance.
+
+When the provider visibly reports a rate limit:
+
+- before proven submission, defer the candidate until the visible reset duration when available, otherwise apply a bounded local cooldown;
+- before proven submission, the router may choose another eligible candidate inside the caller's filtered scope;
+- after submission becomes ambiguous or proven, never replay the request elsewhere;
+- record the blocker and observed reset evidence in the existing job result/blocker history rather than a new ledger table; and
+- distinguish a provider-native fallback such as a smaller model from Tokenless routing to another provider.
+
+## Subscription-Aware Matching
+
+Subscription state is crucial matching evidence but never authorization. Normalize visible labels into stable catalog plan IDs while preserving the original label and confidence.
+
+- An exact visible label may select an exact plan rule.
+- A plan-family observation may select only a rule valid for that family.
+- `signed_in_paid` or `paid_unknown` must not be treated as the provider's highest plan.
+- `signed_in_unknown` matches only access-level or unknown-plan rules.
+- A stale plan observation lowers confidence and may trigger fresh read-only inspection before mutation.
+- Plan variants that Tokenless cannot distinguish remain grouped until real visible evidence supports a finer distinction.
+
+## Candidate Routing and Provider Whitelist
+
+Rate-limit awareness participates in the existing capability router rather than creating a second router.
+
+Candidate construction and selection proceed in this order:
+
+1. An explicit caller provider or profile remains a hard constraint.
+2. Otherwise, construct eligible `(provider, profileId)` candidates from configured profiles and current access observations.
+3. Filter out providers not present in `providerWhitelist`; an empty whitelist admits no implicit route.
+4. Apply the same capability support, subscription, blocker, capacity, fairness, and recovery algorithms to the filtered set.
+5. Select an admitted candidate, or return the earliest useful deferral when every remaining candidate is temporarily ineligible.
+
+`providerWhitelist` is only a provider filter. List position does not override capability eligibility, rate-limit capacity, fairness, profile health, or the rest of the selection algorithm. Tokenless never escapes the configured whitelist silently, and providers inside it receive no special rate-limit allowance.
+
+## Recovery and Ownership
+
+The daemon is the source of truth; browser processes and pages are recoverable executors.
+
+- Every lane and page lease uses a fencing token tied to the claimed job lease.
+- A stale runner cannot checkpoint or complete after ownership transfers.
+- Runner restart reconstructs schedulable state from durable jobs, exact target URLs, context revisions, and safe checkpoints.
+- A `waiting_for_user` job retains explicit ownership requirements. The scheduler either reserves its page/profile capacity or records that the page must be reconstructed before resume.
+- Cancellation releases queued lanes immediately and active lanes only after daemon-confirmed termination.
+- Shutdown drains or checkpoints active jobs; it does not silently abandon provider mutations.
+
+## Delivery Phases
+
+### Phase 0: Document and Measure Current Semantics
+
+- Add machine-readable scheduler diagnostics for runner, profile, job, context, page, and queue state.
+- Expose persisted final provider URLs and mapping status in scheduler diagnostics.
+- Close the automatic conversation-continuation contract for explicit default/new/continue policies and prove it through a real visible session.
+- Document that `taskId` is grouping while `idempotencyKey` is deduplication.
+- Document that `updated_at` is not a provider-submission timestamp and audit the structured job inputs needed to derive every catalog meter.
+
+Exit: state output can explain exactly why a job is queued, which page/conversation it targets, and whether it will create or continue a conversation.
+
+### Phase 1: Rate-Limit Catalog and Read-Only Capacity Projection
+
+Implementation status: completed on 2026-08-01.
+
+- Maintain and package the seeded `provider-rate-limits.v1.json` with source, uncertainty, plan, model, feature, window, and review metadata for every supported provider.
+- Add build-time schema validation and stale-review warnings without build-time network fetching.
+- Add immutable `provider_submitted_at` to the existing `jobs` table and write it at proven visible submission.
+- Add the provider/profile/window query and capacity policy module without introducing a usage ledger table.
+- Expose a read-only built CLI diagnostic such as `tokenless limits inspect --provider <id> --profile <id> --json`.
+
+Exit: the built and packed CLI can explain the matched subscription rule, locally observed usage, estimated remaining capacity, confidence, and next eligible time for every supported provider/profile without changing scheduling.
+
+### Phase 2: Transactional Idempotency and Capacity-Aware Admission
+
+Implementation status: the rate-limit admission portion is completed; transactional idempotency, general queue limits, queue position, and pre-staging backpressure remain planned.
+
+- Add scoped idempotency records and unique constraints in the daemon.
+- Return an existing job for duplicate submissions.
+- Add queue limits and pre-staging admission checks.
+- Expose queue position and retryable backpressure results.
+- Apply exact sliding-window projection, modest cadence smoothing, and visible reset overrides before provider mutation.
+- Treat real provider rate-limit responses as recoverable evidence rather than proof that the scheduler is incorrect.
+
+Exit: a concurrent invocation storm with the same idempotency key produces one provider submission and one durable result, while distinct jobs are admitted or deferred with an explainable provider/profile capacity estimate.
+
+### Phase 3: Explicit Conversation Registry
+
+- Persist provider workspace, conversation, canonical URL, profile, task, and agent-session bindings.
+- Separate `new`, `continue`, and `exact` conversation policies.
+- Capture the canonical URL after visible submission and validate it before persistence and reuse.
+- Remove implicit first-page routing from job execution.
+
+Exit: every job can state before execution whether it will allocate a new conversation or continue an exact one.
+
+### Phase 4: Page Registry and Conversation Lanes
+
+- Introduce per-conversation single-writer lanes.
+- Allocate one page per active conversation rather than one implicit page per profile.
+- Add page lease fencing, capacity, idle eviction, and restart recovery.
+- Keep per-profile concurrency one until each provider has live parallel-page evidence.
+
+Exit: jobs for two different conversations can retain distinct pages without cross-navigation, while two jobs for one conversation remain ordered.
+
+### Phase 5: Workspace and Project Coordination
+
+- Serialize native Project and mirror mutations.
+- Pin prompt jobs to an accepted context revision.
+- Allow independent chats in one Project to run concurrently after the revision barrier.
+- Integrate exact agent session and worktree identity.
+
+Exit: two chats in one project can execute concurrently on separate pages while sharing one consistent provider mirror revision.
+
+### Phase 6: Adaptive Multi-Profile Scheduling
+
+- Add evidence-backed provider/profile concurrency caps.
+- Apply fair scheduling, dynamic rate-limit reduction, and capacity reservations.
+- Filter candidates through `providerWhitelist` when configured, then apply the same capacity and fairness algorithm inside that scope.
+- Route an unsubmitted request to another eligible provider/profile candidate only when the caller's constraints and filtered routing scope allow it.
+- Support additional browser-runtime workers only after daemon leases and profile ownership prevent the same persistent profile from opening in two workers.
+- Publish operational metrics without prompt, response, credential, or private path content.
+
+Exit: concurrency scales across profiles and supported providers without weakening profile ownership, isolation, or recovery.
+
+## Acceptance Criteria
+
+- Every visible provider job is created, persisted, claimed, checkpointed, and completed through the local daemon.
+- Concurrent runtime startup results in one verified daemon-owned browser runtime for one Tokenless home.
+- Duplicate concurrent requests with one idempotency key result in one durable job and at most one visible submission.
+- Jobs for the same conversation are strictly serialized.
+- Jobs for different conversations never share an implicit page or navigate each other's page.
+- Different conversations in one Project can run concurrently only after the required workspace/context revision is active.
+- Each successful submission persists a validated canonical provider conversation URL.
+- Browser-runtime restart can recover an exact conversation without relying on a page handle.
+- Queue growth is bounded and backpressure is visible before large attachment staging.
+- The packaged JSON catalog covers every supported provider, distinguishes exact from uncertain knowledge, and preserves official evidence and review dates.
+- Capacity projection uses the existing jobs table plus immutable provider submission time; no separate rate-limit ledger table exists.
+- A provider/profile diagnostic reports the matched subscription rule, local sliding-window usage, estimated remaining capacity, estimated eligibility, and confidence.
+- `providerWhitelist` filters the provider candidate set without overriding capability, capacity, fairness, or recovery policy.
+- Reaching a real provider limit produces a retryable deferral or visible blocker and never causes an ambiguous submission to be replayed elsewhere.
+- Lease fencing prevents stale workers from mutating durable state.
+- Cancellation, timeout, waiting-for-user, and shutdown release or retain lanes according to documented state transitions.
+- Focused integration and browser E2E tests launch concurrent built CLI processes against the real local daemon, real filesystem, real local Chromium, and gated real provider sessions. They assert durable jobs, exact page/conversation outcomes, and visible submissions without mocks or invented provider DOM.
+- Rate-limit estimator acceptance is intentionally limited to the built CLI, built daemon, real HTTP boundary, real SQLite, and controlled historical timestamps. It must not exhaust or spam provider websites to prove a published quota.
+
+## Required Concurrency Proofs
+
+| Scenario | Observable proof |
+| --- | --- |
+| Many callers, same idempotency key | One daemon job and one visible provider submission |
+| Many callers, distinct keys, one conversation | FIFO submissions with no interleaved composer state |
+| Two conversations, one supported profile | Two explicit page leases and no cross-navigation |
+| Two Projects, one profile at capacity | Fair queueing with a visible blocking reason |
+| Two profiles | Independent execution up to the configured global limit |
+| Runner crash before submit | Safe retry from durable checkpoint |
+| Runner crash during submit | Ambiguous outcome fails closed without automatic replay |
+| Browser restart after success | Exact conversation recovery from persisted URL |
+| Waiting-for-user plus fresh work | Documented reservation or reconstruction with no lost job state |
+| Queue limit exceeded | Retryable admission response before attachment staging |
+| Exact published rolling limit | Job-history projection returns the expected local count, remaining estimate, and earliest eligibility |
+| Dynamic or undocumented provider limit | Projection reports unknown or best-effort capacity without inventing an official number |
+| Provider whitelist filter | Every evaluated route stays inside the configured set while capacity selection remains otherwise unchanged |
+| Visible limit before submission | Same job is deferred or another in-scope candidate is selected without duplicate mutation |
+| Visible limit after ambiguous submission | Job fails closed or waits without cross-provider/profile replay |
+
+## Risks and Responses
+
+| Risk | Response |
+| --- | --- |
+| More pages trigger provider limits | Provider/profile caps, modest cadence smoothing, and dynamic reduction from visible evidence |
+| Published rate-limit knowledge becomes stale | Versioned evidence, retrieval and review dates, stale warnings, and visible runtime evidence overriding estimates |
+| Local history misses manual or external usage | Label remaining capacity as a local estimate and treat visible reset/blocker evidence as authoritative for the current provider/profile |
+| Mutable job timestamps distort window counts | Persist one immutable `provider_submitted_at` on the existing job row and never use `updated_at` as submission time |
+| Dynamic limits create false precision | Preserve dynamic, qualitative, and unknown allowance kinds instead of manufacturing numeric quotas |
+| Cross-page UI state is shared inside one profile | Treat profile and workspace mutations as separate scheduler lanes |
+| Durable locks deadlock | Canonical acquisition order, short leases, fencing, and diagnostics |
+| Idempotency suppresses intentional repeated work | Explicit scope/expiry and distinct keys for distinct requests |
+| Browser URL does not uniquely identify a conversation | Require provider-specific validated conversation identity or report exact continuation unavailable |
+| Waiting-for-user jobs exhaust all capacity | Reserved capacity, bounded wait policy, and explicit page reconstruction |
+| Queue becomes a disk or memory sink | Admission limits, quotas, TTLs, and attachment staging after admission |
+| Multi-runner support opens one profile twice | Exclusive durable profile ownership before adding runner processes |
+
+## Non-Goals
+
+- Opening a new browser process for every invocation
+- Assuming every provider safely supports multiple parallel pages
+- Using project or chat display names as lock keys
+- Promising exactly-once mutation when the provider cannot prove it
+- Retrying a failed job in a different provider, profile, Project, or conversation
+- Allowing browser pages to become the source of durable job identity
+- Guaranteeing that Tokenless's estimate exactly matches private provider enforcement
+- Correlating one external provider account across multiple managed browser profiles
+- Adding a separate usage or rate-limit ledger table in V1
+- Treating `providerWhitelist` ordering as a rate-limit or scheduling priority
+- Rotating profiles or providers to evade provider restrictions
diff --git a/docs/roadmaps/P0-context-delivery-and-workspace-alignment.md b/docs/roadmaps/P0-context-delivery-and-workspace-alignment.md
new file mode 100644
index 0000000..53478f6
--- /dev/null
+++ b/docs/roadmaps/P0-context-delivery-and-workspace-alignment.md
@@ -0,0 +1,155 @@
+# Context Delivery and Workspace Alignment
+
+Status: in progress | Priority: P0
+
+Depends on: provider capability inspection, conversation continuation, file staging, and workspace handling
+
+## Outcome
+
+Tokenless can carry the right authorized context into the exact provider Project or conversation, including a completely new chat. The receiving web agent should understand the task, repository rules, relevant files, prior decisions, and completion criteria without relying on a guessed project name or an unstructured prompt dump.
+
+This roadmap concerns how Tokenless represents, filters, transports, verifies, and refreshes context. It does not attempt to reproduce every provider-specific feature.
+
+The first provider-neutral transport contract is implemented as `tokenless.context-envelope.v1` on every managed Playwright job. It binds task identity and the implication-complete capability set to role-bearing instructions, caller-selected attachment provenance, output language/format, token/deadline constraints, optional upstream agent state, and SHA-256 delivery receipts for the exact prompt actions. The job validator proves that instructions are present in delivered prompt actions and that references exactly match staged attachments; automatic provider fallback revalidates and replays the same envelope. Context transport planning, visible per-source acceptance receipts, native workspace mapping, incremental refresh, and source-level budgeting remain the broader phases below.
+
+## Core Contract: Context Envelope
+
+Introduce a versioned provider-neutral `ContextEnvelope`. It should preserve semantic roles even when the destination provider cannot.
+
+| Layer | Examples | Required metadata |
+| --- | --- | --- |
+| Identity | agent session, task, project root, worktree, provider workspace | origin, stable id, scope |
+| Goal | requested outcome and done conditions | author, timestamp, priority |
+| Instructions | repository rules, user constraints, explicitly exported agent instructions | origin, precedence, share policy |
+| Working state | plan, decisions, open questions, changed files, test status | freshness and producing session |
+| Sources | selected files, generated summaries, architecture and graph artifacts | path label, digest, size, provenance |
+| Provider intent | target Project/conversation, desired model or mode, continuation policy | requested and resolved values |
+| Limits | file count, byte budget, context budget, expiry | enforced values and omissions |
+
+The envelope is stored locally as structured data. Provider adapters receive a bounded transport plan, not unrestricted access to the repository or agent transcript.
+
+## Instruction and System-Prompt Policy
+
+Tokenless should preserve an instruction's role and precedence, but it may only transmit material the caller is authorized to share.
+
+Allowed sources include:
+
+- repository-owned instructions such as `AGENTS.md`;
+- user prompts and user-approved task context;
+- Tokenless's public task wrapper;
+- an agent's explicit export of shareable system or workflow instructions; and
+- generated project summaries whose sources and digests are recorded.
+
+Tokenless must not scrape or reconstruct concealed host, platform, developer, safety, or provider system prompts. Secrets, credentials, private chain-of-thought, and unrelated transcript content are excluded.
+
+Destination mapping is capability-based:
+
+1. Native Project or workspace instructions, when visible creation and update are proven.
+2. A provider-supported instruction or preset surface, when the scope and success postcondition are proven.
+3. A generated instruction artifact attached to the Project or conversation.
+4. A clearly delimited prompt preamble for conversation-scoped fallback.
+
+The result reports the actual mapping, such as `native_project_instructions`, `attached_instruction_artifact`, or `conversation_preamble`. A fallback must never be reported as native system-prompt delivery.
+
+## Context Resolution Pipeline
+
+```mermaid
+flowchart LR
+  Sources["Authorized sources"]
+  Resolve["Resolve scope and precedence"]
+  Policy["Redact and apply share policy"]
+  Budget["Select, summarize, and shard"]
+  Map["Map to provider capabilities"]
+  Deliver["Deliver through visible controls"]
+  Verify["Verify visible acceptance"]
+  Receipt["Store context receipt"]
+
+  Sources --> Resolve --> Policy --> Budget --> Map --> Deliver --> Verify --> Receipt
+```
+
+A context receipt records:
+
+- envelope revision and source digests;
+- provider, managed profile, and exact workspace or conversation identity;
+- each delivered artifact and visible acceptance state;
+- instruction mapping and any semantic degradation;
+- omitted sources and reasons;
+- delivery timestamp and expiry; and
+- the job that produced the proof.
+
+## Delivery Phases
+
+### Phase 0: Contract and Threat Model
+
+- Define `ContextEnvelope`, `ContextTransportPlan`, and `ContextReceipt` schemas.
+- Define instruction precedence, shareability labels, expiry, provenance, and redaction.
+- Establish deterministic size and file-count budgeting.
+- Keep raw paths private in daemon and provider-visible results.
+
+Exit: the same input envelope resolves deterministically without provider-specific conditionals in the context core.
+
+### Phase 1: Conversation Bootstrap
+
+- Render a stable, delimited context preamble for a new conversation.
+- Attach selected files with existing integrity and project-root containment checks.
+- Include goal, constraints, done conditions, repository guidance, and omission notices.
+- Capture the exact conversation URL only after visible submission succeeds.
+
+Exit: a new conversation can receive a bounded context package and return a receipt that states what was accepted.
+
+### Phase 2: Native Workspace Alignment
+
+- Use `workspace.ensure` only when native creation or selection is fully proven.
+- Resolve provider workspace identity to a stable provider resource id or canonical URL.
+- Upload or update instruction artifacts before the task prompt.
+- Keep conversation fallback explicit when native workspace support is unavailable.
+
+Exit: Tokenless can distinguish native Project alignment from same-conversation continuity and can prove the selected destination.
+
+### Phase 3: Incremental Context Refresh
+
+- Compare source digests with the last receipt.
+- Upload changed shards only.
+- Retire superseded artifacts when the provider visibly supports safe replacement; otherwise add a versioned manifest that identifies the active revision.
+- Invalidate receipts when the project root, worktree, provider profile, workspace identity, or sharing policy changes.
+
+Exit: repeated tasks avoid re-sending unchanged context while never silently reusing stale or cross-scope material.
+
+### Phase 4: Agent-Aware Context
+
+- Accept exact agent session identity and working directory from the Agent Session Integration roadmap.
+- Import explicitly shareable plan, decision, and task-state exports.
+- Produce a compact continuation capsule for handoff between the local agent and web agent.
+- Return the web result with enough identity and context-revision information for the originating agent to reconcile it.
+
+Exit: context round-trips remain attributable to one agent session, one project/worktree, and one provider workspace.
+
+## Acceptance Criteria
+
+- A new provider chat receives repository guidance and task constraints without depending on earlier conversation history.
+- Every delivered instruction and file has provenance and an explicit sharing decision.
+- The result distinguishes requested context from visibly accepted context.
+- Native workspace, instruction-artifact, and conversation-preamble outcomes are distinguishable in JSON.
+- Context from one project, worktree, profile, or agent session cannot be reused in another scope.
+- A changed source digest invalidates or refreshes the corresponding receipt.
+- Sensitive paths, credentials, hidden prompts, and unrelated transcript content are not transmitted.
+- Real integration or browser E2E tests prove the built CLI, local daemon, filesystem staging, provider page, and visible acceptance outcome.
+
+## Risks and Responses
+
+| Risk | Response |
+| --- | --- |
+| Prompt injection inside repository files | Preserve source boundaries, label untrusted content, and keep authoritative instructions separate |
+| Provider cannot represent instruction roles | Use an explicit artifact or preamble and report semantic degradation |
+| Context package exceeds provider limits | Deterministic budgeting, summaries with provenance, shards, and omission reporting |
+| Stale context remains in a provider Project | Versioned manifests, digests, expiry, and an active-revision marker |
+| A broad transcript leaks unrelated data | Default-deny source selection and explicit agent export instead of ambient transcript scraping |
+| Workspace selected by name is ambiguous | Bind to exact resource identity or fail closed |
+
+## Non-Goals
+
+- Cloning an agent's hidden system prompt
+- Uploading an entire repository or transcript by default
+- Claiming that a prompt preamble is equivalent to a provider-native system role
+- Guessing a Project from its display name
+- Bypassing provider-visible file and workspace controls
diff --git a/docs/roadmaps/P0-local-web-control-plane.md b/docs/roadmaps/P0-local-web-control-plane.md
new file mode 100644
index 0000000..9bbca03
--- /dev/null
+++ b/docs/roadmaps/P0-local-web-control-plane.md
@@ -0,0 +1,408 @@
+# Local Web Control Plane
+
+Status: implemented; real-provider release evidence pending | Priority: P0
+
+Depends on: authenticated loopback daemon, managed profile lifecycle, provider registry and capability catalog, embedded browser-runtime supervision, durable jobs, and browser page ownership
+
+Implementation note (2026-08-01): phases 0–4 and the currently stable phase-5 surfaces are implemented in the bundled CLI package. This includes profile-scoped preferences and migration, shared application services, one-time UI bootstrap and browser sessions, the `/ui-api/v1` contract, reserved control-plane page ownership, first-run Web setup/dashboard handoff, all six administration areas, clean-profile/provider/browser/job mutations, capability-first routing views, freshly observed model/effort controls, revision/ETag polling that preserves unsaved edits, English and Simplified Chinese localization, and redacted diagnostics. The browser application is a modular Svelte 5 application under `packages/cli/src/daemon/ui`, built by its own Vite boundary into deterministic self-hosted assets while remaining part of the CLI release artifact. Its separate Playwright Web E2E covers setup, responsive display at desktop/mobile viewports, configuration and profile persistence, durable work display, polling-safe drafts, and reserved control-plane page ownership; one explicitly gated signed-in provider case proves a real completed provider job is visible without rerunning the full provider matrix. Explicit-consent opaque local profile copying is available through CLI setup and profile flows; the dashboard exposes no import or reset mutation and never receives source paths or authentication values. Scheduler projections and project/context-mirror views remain conditional on the separate roadmaps that own those contracts. The roadmap stays active until the required authenticated real-provider release matrix is run.
+
+## Outcome
+
+Tokenless provides a browser-based control plane served by the local daemon. After an interactive setup completes, Tokenless opens one reserved control-plane tab in the selected managed browser profile. The same interface remains available later for configuration, provider and account readiness, browser profiles, capabilities, jobs, user handoffs, diagnostics, and recovery.
+
+The control plane is the human-facing authority over Tokenless configuration. The CLI remains a complete scripting and recovery interface, but users should not need to inspect JSON files or remember administrative commands for ordinary management.
+
+The first release must let a user answer these questions without opening a terminal:
+
+- Is Tokenless healthy and which daemon and browser are active?
+- Which managed browser identity is selected, and what purpose or role does it serve?
+- Which providers has the user enabled for that profile?
+- What account, access class, and subscription evidence was last observed for each provider?
+- Which capabilities are supported, unavailable, or still unverified for the selected provider/profile?
+- Which jobs are queued, running, waiting for the user, or complete?
+- What action is required when a provider needs sign-in, CAPTCHA, MFA, consent, or confirmation?
+- Which configuration changed, when was it saved, and whether a browser restart is required?
+
+## Product Principles
+
+- **User intent, not geolocation:** never infer provider membership from IP address, locale, language, timezone, or proxy presence. Only providers explicitly enabled by the user belong to the routing scope.
+- **Configured, observed, and usable are different states:** enabling Gemini records intent; a successful live observation records current access; capability and scheduler policy determine runtime eligibility.
+- **One local source of truth:** the UI and CLI call shared application services. The daemon must not spawn the CLI or maintain a second configuration model.
+- **Visible and honest state:** show exact durable states and observation timestamps. Do not invent percentages, token streaming, provider health, or account capabilities.
+- **Local-first:** serve only from a verified loopback origin. Do not introduce a hosted account, telemetry dependency, or remote administration surface.
+- **Credentials remain opaque:** never expose provider cookies, browser storage, Keychain contents, daemon bearer tokens, or hidden provider data to browser JavaScript.
+- **Safe browser ownership:** the control-plane tab is a reserved browser resource and can never be claimed, replaced, or navigated by a provider job.
+- **Simple first release:** use ordinary HTTP and bounded polling before adding SSE or WebSockets.
+
+## Non-Goals
+
+The first control-plane release does not:
+
+- automate provider sign-in, CAPTCHA, MFA, payment, consent, or account creation;
+- detect whether a user is in mainland China or any other region;
+- install, start, configure, or inspect Clash, V2Ray, Xray, sing-box, VPN software, or proxy subscriptions;
+- read browser credentials, cookies, local storage, session storage, or Keychain data;
+- copy an existing Chrome, Brave, or Cloak profile or its authentication state into a managed profile;
+- expose the daemon on the LAN or public Internet;
+- replace provider websites with embedded iframes;
+- make experimental capabilities supported without real-provider E2E closure; or
+- turn the internal daemon bearer contract into a browser API.
+
+## Current Behavior Audit
+
+The current implementation has useful foundations but no browser-facing product surface:
+
+- the daemon binds only to loopback and exposes authenticated job and browser-runtime routes;
+- the daemon owns durable SQLite job state and an embedded Playwright runtime;
+- configuration is stored in `config.json` and currently includes provider scope, browser, visibility, daemon URL, and language;
+- managed profiles have stable IDs, labels, lifecycle state, default selection, legacy provenance where applicable, and cached provider observations;
+- provider descriptors and canonical capability routes are typed and centrally registered;
+- jobs expose durable queued, claimed, running, waiting-for-user, and terminal states;
+- `profiles open` can start a headed managed profile without navigating to a provider; and
+- setup currently selects every non-disabled provider and performs a live observation for each one.
+
+Important gaps are:
+
+- provider selection is not an actual setup choice;
+- most configuration and profile mutations exist only in CLI code;
+- the daemon API has no least-privilege browser session, configuration, profile, provider-readiness, or capability-management resources;
+- the internal daemon bearer token cannot safely be placed in browser JavaScript;
+- setup does not open a durable local status and management page;
+- there is no reserved control-plane page identity in the managed browser page registry;
+- provider and browser errors are not presented as one actionable health model;
+- language bootstrap detects the system locale before first-time `setup`, but a different first command can still read the empty config default and present English before the user has had any chance to choose; and
+- global `preferredProviders` was too coarse for multiple browser identities and its name did not communicate that it was a routing membership filter.
+
+## Product State Model
+
+The UI must preserve separate layers instead of collapsing them into one green or red provider badge.
+
+| Layer | Question | Example states |
+| --- | --- | --- |
+| Configuration | Did the user enable this provider for this profile? | enabled, disabled |
+| Observation | What did the last visible check prove? | guest, signed in, sign-in required, unknown, technical failure |
+| Freshness | When was that observation made? | current, stale, never checked |
+| Capability | Can this provider/profile satisfy this outcome? | supported, experimental, unavailable, unknown |
+| Runtime eligibility | May the router select it now? | eligible, ineligible, deferred |
+| Browser state | Is its managed browser identity available? | closed, opening, ready, waiting for user, quiescing, failed |
+
+Disabling a provider removes it from implicit routing and setup sweeps. It does not erase the provider adapter, cached historical observation, or capability catalog entry. Re-enabling it does not claim it is usable; the UI offers an explicit live check.
+
+Provider configuration should move toward a per-profile routing scope:
+
+```ts
+type ManagedProfilePreferences = {
+  profileId: string
+  roleLabel: string
+  enabledProviders: ProviderId[]
+  browserVisibility: "auto" | "headed" | "headless"
+  proxy: { server: string; bypass: string[] } | null
+}
+```
+
+`roleLabel` is human metadata such as `Personal`, `Work`, or `Research`; it is not authorization or provider identity. The provider account display name and subscription observation remain separate visible evidence.
+
+The initial proxy field accepts only a user-managed local HTTP, HTTPS, or SOCKS5 endpoint. Tokenless does not infer upstream protocols such as VLESS Reality and does not claim that a configured endpoint is reachable until a real browser navigation proves it. Credential-bearing proxies require a later secret-storage design and are not part of the first proxy slice.
+
+## Information Architecture
+
+### Language Bootstrap
+
+Language selection happens before the first user-facing byte is rendered. It is not a step inside setup and it does not depend on geolocation.
+
+Every CLI process uses this precedence before full argument parsing, help, validation, error formatting, or command dispatch:
+
+1. an explicit language supplied through a supported bootstrap override;
+2. a valid persisted `config.language`;
+3. the first recognized system locale from `LC_ALL`, `LC_MESSAGES`, `LANG`, and the runtime locale; and
+4. English when no supported language can be recognized.
+
+Locale detection is an initial guess, not identity or geography. A Chinese locale selects Simplified Chinese because that is the currently supported Chinese surface; an imperfect guess is recoverable through an always-visible language switch. The absence of a completed setup must never force English.
+
+The web control plane follows the same persisted preference. If no language has been persisted yet, the daemon selects the first response language from the browser request language and system locale before serving the initial HTML. The page must not render English first and switch after JavaScript loads. The first screen always exposes `English` and `简体中文` as language choices, and a user selection becomes the persisted preference shared by the CLI, control plane, and default provider response language.
+
+### Overview
+
+The landing page is an operational summary, not a setup wizard and not a marketing dashboard.
+
+It shows:
+
+- daemon version, origin, uptime, and update compatibility;
+- browser runtime state and active managed profiles;
+- the current default profile and its role label;
+- enabled provider readiness with last-checked timestamps;
+- active and waiting jobs;
+- the most important actionable problem; and
+- shortcuts to open the managed browser, inspect a provider, or resume a waiting job.
+
+### Browser Profiles
+
+The profiles area manages isolated browser identities:
+
+- create a clean profile;
+- label its purpose or role;
+- set the default profile;
+- choose its enabled providers;
+- choose browser visibility;
+- configure an optional user-managed proxy endpoint;
+- open the profile without provider navigation;
+- remove a profile through an explicit destructive confirmation.
+
+The UI never offers browser-profile import or authentication-state copy. Users sign in through the visible clean managed profile, whose runtime binding and browser-owned session persist across jobs.
+
+### Providers
+
+The provider area is a profile-scoped matrix. Each provider card shows:
+
+- enabled or disabled membership;
+- supported or experimental product stage;
+- cached access and account observation;
+- observation time and freshness;
+- exact visible account display and subscription evidence when available;
+- canonical capability coverage;
+- current technical or user-resolvable blocker; and
+- actions to open the provider, perform a live readiness check, inspect visible controls, or disable routing.
+
+Opening a provider is a user-visible navigation action. A live check must never submit a prompt, upload a file, change a model, or accept consent.
+
+### Capabilities
+
+The capabilities area starts with caller outcomes such as conversation chat, file upload, native workspace, image generation, and deep research. It must not lead with provider DOM controls.
+
+For each capability, show:
+
+- lifecycle and stability;
+- required visible evidence;
+- providers with an evidence-backed route;
+- providers that are experimental, unavailable, or unknown;
+- account or profile constraints; and
+- the difference between declared product support and current runtime eligibility.
+
+Advanced provider controls such as exact model and effort labels remain a secondary provider-profile screen and must use labels freshly observed from the visible site.
+
+### Jobs
+
+The jobs area reads the durable daemon state and supports:
+
+- filtering by status, profile, provider, task, and agent session;
+- a compact timeline of durable transitions;
+- route and capability decisions;
+- user-action blockers;
+- cancellation of one exact job;
+- headed resume of the same waiting job;
+- final normalized output and citations; and
+- structured, redacted error details and repair actions.
+
+The UI does not display claim tokens, runner checkpoints, staged private file paths, raw DOM, provider cookies, or browser storage.
+
+### System and Diagnostics
+
+System settings cover language, browser target, daemon origin, update compatibility, and browser-runtime controls. Diagnostics combine the existing doctor report with actionable categories:
+
+- configuration;
+- daemon and package compatibility;
+- browser discovery and launch;
+- profile lifecycle and filesystem permissions;
+- provider navigation, DNS, proxy, TLS, authentication, and visible blockers; and
+- job scheduler and recovery state.
+
+Raw diagnostic JSON may be offered as an explicit copy action after redaction. The default presentation should explain what failed, what Tokenless observed, and what the user can safely do next.
+
+## Core User Flows
+
+### Interactive Setup Handoff
+
+1. Setup installs and reconciles the runtime, chooses a browser, creates or reuses a clean managed profile, and starts the daemon.
+2. Setup records the user's provider choices instead of selecting every registered provider.
+3. Setup performs live checks only for the selected providers.
+4. Regardless of whether some provider checks succeed, require sign-in, or fail technically, setup opens the selected managed profile in headed mode.
+5. The browser receives a reserved Tokenless control-plane page and navigates it through a one-time UI bootstrap URL.
+6. The landing page displays the completed setup state and unresolved actions.
+
+Machine-oriented `setup --json`, non-interactive environments, and explicit no-open modes must not launch a visible browser. Their result includes a command that an authorized user can run later to open the control plane.
+
+### Provider Enablement
+
+1. The user enables a provider for one managed profile.
+2. The setting is saved immediately as user intent.
+3. The UI offers a live readiness check and explains that it will visibly open the provider without submitting content.
+4. If the page is ready, Tokenless records the access and account observation.
+5. If user action is required, the same profile and page remain open and the UI shows the exact handoff.
+6. After the user finishes, they explicitly recheck; Tokenless does not poll credentials or scrape hidden browser state.
+7. Technical failure remains distinct from sign-in-required and does not silently disable the provider.
+
+### Waiting Job Handoff
+
+1. A running job reaches `waiting_for_user` with a structured blocker.
+2. The overview and jobs page surface the blocker.
+3. The user opens the exact managed profile and provider page.
+4. After completing the visible action, the user resumes the same job in headed mode.
+5. The job keeps its identity, task, route, and durable history.
+
+## Reserved Browser Page
+
+The control-plane page needs explicit ownership in `ManagedBrowserContext`:
+
+```text
+tokenless:control-plane:<daemon-home-id>
+```
+
+Requirements:
+
+- one reserved control-plane page per active managed browser profile;
+- provider jobs cannot acquire, replace, close, or navigate it;
+- `pagePolicy: replace` selects only replaceable provider pages;
+- the control-plane page may be recreated if the user closes it;
+- reopening focuses the existing page instead of producing duplicates;
+- closing the page does not stop the daemon or browser runtime;
+- quiescing or closing a profile closes the page with that context; and
+- the page origin is the daemon's current recorded loopback origin, including a dynamically selected port.
+
+The daemon UI must not depend on the provider page scheduler to stay alive. Reserved pages and provider page leases are separate registries even though they share one persistent browser context.
+
+## Browser-Facing API and Authentication
+
+Keep the existing bearer-protected daemon API as the trusted machine control contract. Add a separate browser-facing surface under `/ui-api/v1` backed by the same application services.
+
+The browser must never receive the daemon control bearer token. Bootstrap uses a one-time, random, short-lived ticket minted by an authenticated CLI or internal daemon call:
+
+1. the CLI requests a UI bootstrap ticket over the existing authenticated control channel;
+2. Tokenless opens `/ui/bootstrap?ticket=<one-time-ticket>` in the managed browser;
+3. the daemon consumes the ticket once, creates a short-lived UI session, and immediately redirects to `/ui/` so the ticket is removed from browser history;
+4. the session is held in an `HttpOnly`, `SameSite=Strict`, path-scoped cookie; and
+5. mutating UI requests additionally require an exact same-origin check and a per-session CSRF header.
+
+Browser security requirements include:
+
+- verified loopback bind and `Host` validation to resist DNS rebinding;
+- no wildcard CORS and no credentialed cross-origin access;
+- exact `Origin` validation for every mutation;
+- a restrictive Content Security Policy with no remote scripts;
+- `frame-ancestors 'none'`, `X-Content-Type-Options: nosniff`, and `Referrer-Policy: no-referrer`;
+- bounded session expiry and invalidation on daemon restart;
+- no secrets in query strings after the one-time redirect;
+- no daemon token, provider credentials, profile storage, or private filesystem paths in UI responses; and
+- explicit reauthentication through a fresh CLI-minted ticket after expiry.
+
+Static UI assets may be served without authentication, but every personalized read and mutation requires the UI session. The first implementation should use bounded polling with `ETag` or revision cursors for overview, runtime, provider observations, and jobs. Do not add SSE or WebSockets until polling creates a measured product problem.
+
+## Application Service Boundary
+
+Before adding UI routes, extract shared application services from CLI command handlers:
+
+```text
+ConfigService
+ProfileAdminService
+ProviderReadinessService
+CapabilityCatalogService
+BrowserRuntimeService
+JobQueryService
+JobCommandService
+DiagnosticsService
+```
+
+Both CLI and `/ui-api/v1` call these services. Services own validation, authorization-independent domain rules, filesystem locking, daemon coordination, and public redaction. Transport handlers own HTTP parsing, UI-session authorization, CSRF, status codes, and response schemas.
+
+The browser-facing API should initially expose:
+
+- one aggregate overview snapshot;
+- config read and update;
+- profile list, clean create, label, default, and remove;
+- per-profile provider membership and cached observations;
+- explicit provider open, readiness check, and controls inspection;
+- capability catalog and route availability;
+- browser-runtime status and profile open;
+- job list, detail, cancel, and resume; and
+- redacted diagnostics.
+
+Every mutation must be represented in the checked-in OpenAPI contract or a separate checked-in UI API contract before the UI consumes it. UI response schemas should be purpose-built rather than exposing internal persistence records directly.
+
+## Frontend Delivery
+
+Build a bundled TypeScript single-page application under the CLI package and copy its static output into the published package. The browser loads no remote JavaScript, fonts, analytics, or runtime CDN assets.
+
+The implementation should:
+
+- support English and Simplified Chinese from the same message catalog as the CLI where practical;
+- select the response language before rendering the initial HTML so the first screen never flashes the wrong default language;
+- follow keyboard and screen-reader accessible navigation and forms;
+- use native browser controls for basic settings rather than custom widgets;
+- provide deterministic empty, loading, stale, waiting, error, and offline states;
+- preserve user edits only after the daemon confirms the write;
+- identify settings that require browser quiescence or restart before applying them; and
+- remain usable at laptop widths without treating mobile administration as a release requirement.
+
+Visual design requires a separate design target and review before frontend implementation. This roadmap defines product structure and behavior, not a final visual system.
+
+## Delivery Phases
+
+### Phase 0: Shared Services and Contracts
+
+- Extract config, profile, provider-readiness, job, and diagnostic operations from CLI handlers into typed services.
+- Define per-profile provider preferences and a migration from global `preferredProviders` without changing routing silently.
+- Define browser-facing schemas and redaction policy.
+- Add UI bootstrap ticket and session contracts.
+- Add reserved control-plane page ownership to the managed browser context.
+
+### Phase 1: Read-Only Operational Console
+
+- Package and serve the local SPA.
+- Implement authenticated UI bootstrap.
+- Show overview, daemon/browser status, profiles, provider observations, capability catalog, job list, job details, and diagnostics.
+- Add `tokenless dashboard` to start or discover the daemon, open the default managed profile, and focus the reserved console tab.
+- Keep all mutations in the CLI during this phase.
+
+### Phase 2: Setup Handoff and Provider Configuration
+
+- Make interactive setup collect provider membership instead of selecting every provider.
+- Check only selected providers.
+- Open the control plane after setup and display its exact result.
+- Add profile-scoped provider enable/disable, open, readiness check, and visible controls inspection.
+- Preserve sign-in and challenge handling as visible user actions.
+
+### Phase 3: Profile and Browser Administration
+
+- Add clean profile creation, label/role editing, default selection, and removal; do not add profile-copy or authentication-state import.
+- Add browser selection, visibility, runtime open, quiesce, and restart-required flows.
+- Add optional user-managed proxy server and bypass configuration with validation and safe redaction.
+- Prevent mutations while unsafe profile ownership or active jobs make them ambiguous.
+
+### Phase 4: Jobs and User Handoffs
+
+- Add job filtering, detail timelines, cancellation, and same-job headed resume.
+- Surface queue, blocker, capability route, and provider/profile identity without exposing internal claim data.
+- Link waiting jobs to the exact browser profile and provider page.
+- Add bounded revision-based polling and stale/offline recovery.
+
+### Phase 5: Advanced Capability and Routing Management
+
+- Add capability-first routing explanations and provider/profile eligibility.
+- Add freshly observed model and effort selection where supported.
+- Add scheduler capacity and rate-limit projections when the scheduling roadmap implements them.
+- Add agent-session, Project, conversation, and context-mirror views only after their underlying contracts are stable.
+
+## Testing and Evidence
+
+Follow the repository's real-boundary testing policy:
+
+- test the packaged SPA through the real built daemon and a real local Chromium/Playwright page;
+- exercise configuration and profile mutations against real temporary Tokenless homes and real filesystems;
+- keep test-only profile launches keychain-neutral with `--password-store=basic` and `--use-mock-keychain`;
+- verify the control-plane page cannot be selected by provider page acquisition or replacement;
+- verify bootstrap ticket expiry, single use, session invalidation, same-origin enforcement, CSRF rejection, Host validation, CSP, and redaction through real HTTP requests and browser behavior;
+- do not use mocks, fake daemons, fake pages, synthetic fetch implementations, or source-string assertions;
+- run provider readiness, sign-in handoff, capability inspection, and provider-side mutations against the real provider website under the explicit local E2E gate; and
+- treat any Tokenless-triggered Keychain prompt as a failed run and stop the responsible browser.
+
+The first read-only release is accepted when a fresh packaged installation can start the real daemon, open the reserved local console in a keychain-neutral test profile, display real config/profile/job/runtime state, survive provider jobs without losing its tab, and expose no control bearer token or browser secret to page JavaScript.
+
+The provider-configuration release is accepted only after the real selected-profile flow proves that enabling, opening, observing, disabling, and re-enabling a provider changes routing membership and visible state without submitting a prompt or inspecting browser secrets.
+
+## Documentation and Compatibility
+
+- Add `tokenless dashboard` and control-plane behavior to `COMMANDS.md`, `README.md`, and `README.zh-CN.md` when implemented.
+- Keep English and Chinese user-facing structure and meaning aligned.
+- Document UI schemas before treating them as a public local API.
+- Include a changeset for every user-visible release slice.
+- Preserve CLI equivalents for recovery and automation.
+- Do not advertise localhost administration as remote access.
diff --git a/docs/roadmaps/P0-provider-expansion.md b/docs/roadmaps/P0-provider-expansion.md
new file mode 100644
index 0000000..5a7fc1b
--- /dev/null
+++ b/docs/roadmaps/P0-provider-expansion.md
@@ -0,0 +1,214 @@
+# Provider Expansion and Parity
+
+Status: proposed | Priority: P0
+
+Depends on: completed [Provider Architecture and Registry](archived/P0-provider-architecture-and-registry.md), existing managed Playwright, provider action protocol, fixture provenance, and profile lifecycle
+
+## Outcome
+
+Tokenless supports a broader set of high-value AI web providers while preserving one honest capability catalog and provider-neutral contract. Adding a provider must improve user choice without weakening session isolation, visible verification, failure behavior, or maintainability.
+
+## Current Implementation State
+
+As of 2026-08-02:
+
+- the shared registry extraction and OOP provider seam are complete and recorded in the archived [Provider Architecture and Registry](archived/P0-provider-architecture-and-registry.md) roadmap;
+- Qwen / 千问 is registered as an `experimental` provider through one provider module and one registry entry;
+- a fresh real managed guest profile completed prompt input, visible submission, and correlated response reading through the built CLI and TypeScript daemon;
+- the canonical Qwen Studio entry is `https://chat.qwen.ai/`; a real built-CLI run navigated the same visible page to the shared `/c/guest` route and returned an exact correlated marker;
+- navigation or reopen of the shared guest route does not restore the prior visible response, so cross-process continuation remains unavailable;
+- Qwen provenance-bound DOM captures cover the earlier regional surface and the current Qwen Studio completed-response state; and
+- Qwen's provider-specific mode menu is exposed as `qwen.mode`, including runtime enabled/disabled discovery and exact Deep Research Normal/Advanced selection;
+- the visible Auto/Thinking/Fast selector is exposed through the provider-neutral `effort.choice` capability; and
+- the versioned canonical task-capability catalog and evidence-backed provider routing matrix are implemented in the CLI, with `conversation.chat`, `file.upload`, and `workspace.native` as the first routeable outcomes; and
+- unproven Qwen model, file-upload, native workspace, and generated-media lifecycles remain `unknown` or `unavailable` rather than being inferred from visible controls.
+- DeepSeek is registered as an `experimental`, sign-in-required provider with canonical navigation, signed-out session detection, visible chat contracts, capture tooling, and an explicit live acceptance classification;
+- a real signed-out browser observation confirmed that `https://chat.deepseek.com/` redirects to `/sign_in` and exposes email/password, Google, and Apple login choices; and
+- a real signed-in Chrome session captured provenance-bound Instant, Expert, and Vision fixtures and proved that DeepThink is present in all three modes, Search only in Instant, file input in Instant and Vision, and no file input in Expert;
+- exact `deepseek.mode`, `deepseek.deepthink`, and `deepseek.search` inspect/select actions are implemented, including restoration-oriented live acceptance coverage and mode-aware capability results;
+- the authenticated Chrome session completed exact-marker baseline and continuation turns, a DeepThink response with a distinct reasoning container and correlated final answer, and a Search response with visible public source links; reduced response fixtures retain those selector boundaries without private conversation identifiers;
+- the observed file input explicitly accepts representative text, document, and image formats in Instant and Vision, while the declared real-provider gate keeps visible file/image acceptance separate from control presence;
+- the shared blocker observer and DeepSeek provider selectors detect a visible hCaptcha, surface `visible_hcaptcha`, and require user support without attempting challenge interaction; the signed-out login/hCaptcha fixture remains an explicit evidence gap because the temporary signed-out session was closed before a redacted capture and the authenticated Chrome profile must not be logged out to recreate it;
+- generic model selection is no longer advertised for DeepSeek, and the submit selector excludes DeepSeek's visible disabled class; and
+- DeepSeek remains non-routeable until a selected signed-in managed profile independently closes the declared built-CLI and packaged-daemon baseline, continuation, Search/DeepThink, and file/image gates.
+- Perplexity is registered as an experimental guest provider, with readiness, prompt drafting, real submission, completed response, visible normalized citations, conversation mapping, and durable state closed through the built CLI, packaged daemon, runtime-bound Cloak profile, and real provider network;
+- Z.ai is registered as an experimental guest provider. Its canonical entry is `https://z.ai/chat`, while `https://chat.z.ai` remains an approved runtime origin because the official entry currently hands prepared drafts to that runtime. Guest continuation, readiness, prompt drafting, real submission, completed response, conversation mapping, and durable state were previously closed through the managed-Cloak runtime boundary; the updated entry-to-runtime journey remains a manual release rerun; and
+- Doubao is registered as an experimental sign-in-required provider. Its built-CLI managed-Cloak non-submission gate closes readiness, prompt drafting, visible file acceptance, exact Fast/Expert/Work Task mode selection, nine coding-relevant Web skill selections, unavailable-state reporting, and restoration. Text-file `file.upload` is experimental and routeable. The same anti-detect configuration completed two direct correlated marker responses, while the built-product chat mutation release gate remains blocked by a visible provider verification iframe and fails closed as `visible_provider_blocker`; and
+- Microsoft Copilot remains unregistered because both Cloak checks exposed a sign-in surface and no guest composer, and no login was attempted under the authentication-skip policy.
+
+| Qwen capability | Current state | Evidence boundary |
+| --- | --- | --- |
+| Guest access | Experimental, available | Fresh managed signed-out profile |
+| Prompt input and submit | Experimental, available | Built CLI and real visible Qwen session |
+| Response reading | Experimental, available | Exact correlated marker returned |
+| Same-task continuation | Unavailable in the selected guest profile | The shared `/c/guest` route does not restore the prior visible response after navigation or reopen |
+| Conversation workspace fallback | Experimental, available when the composer is visible | Provider-neutral conversation capability |
+| Provider-specific mode selection | Implemented, release-gate completion pending | Built CLI and read-only CDP observer proved Deep Research Advanced selection; the product returned a correlated clarification response with durable success, while the strengthened observer prompt assertion awaits rerun after the visible guest plan limit clears |
+| Effort selection | Experimental, available | Built CLI and read-only CDP observer proved Auto/Thinking/Fast inspection, exact Thinking selection, and Auto restore |
+| Model selection | Unknown | No proven exact-selection postcondition |
+| File and input-image upload | Unknown | No proven visible acceptance postcondition |
+| Native workspace | Unavailable | No proven native creation or exact identity closure |
+| Image generation | Unavailable | No proven generation lifecycle |
+
+| DeepSeek capability | Current state | Evidence boundary |
+| --- | --- | --- |
+| Signed-in composer | Live observed, implementation available | User-controlled authenticated Chrome session; managed-profile E2E still required |
+| Mode selection | Implemented for Instant, Expert, and Vision | Real visible radio controls plus provenance-bound reduced fixtures |
+| DeepThink | Implemented as a provider-specific toggle | Real visible toggle in all three modes and correlated reasoning/final response observed; canonical `reasoning.extended` remains unrouteable pending managed E2E closure |
+| Search | Implemented as a provider-specific toggle in Instant | Grounded response with visible public links observed; canonical `search.web` and citations remain unrouteable pending managed E2E closure |
+| File and image input | Visible in Instant and Vision; absent in Expert | Real input accept list includes text, document, and image formats; visible selection and semantic response gates remain pending |
+| Conversation and continuation | Implemented, release gate pending | Same-conversation two-turn behavior was observed in authenticated Chrome; built-CLI packaged-daemon continuation remains the acceptance boundary |
+| Native workspace | Unavailable | No native workspace observed; conversation fallback only |
+
+| Doubao capability | Current state | Evidence boundary |
+| --- | --- | --- |
+| Signed-in composer | Experimental, available | Runtime-bound Cloak profile through built CLI and packaged daemon |
+| File upload | Experimental, routeable for text files | Visible plus control, provider input, and accepted filename card passed the real non-submission gate |
+| Mode selection | Experimental provider control | Fast, Expert, and Work Task Turbo selected and restored; Work Task Pro reports visible upgrade requirement |
+| Skill selection | Experimental provider control | Writing, presentation, image, video, deep research, podcast, music, problem solving, and spreadsheet skills selected and restored |
+| Audio transcription | Unavailable on Web | The visible Web entry presents a Doubao desktop-app download flow |
+| Generated and long-running outcomes | Candidate only | Control selection is closed; terminal artifacts, citations, progress, clarification, and background durability are not |
+| Chat mutation | Release gate blocked | Provider verification iframe is classified as `visible_provider_blocker`; no bypass or simulation |
+
+The maintained [Provider Capability Census](../provider-capability-census.md) records official product surfaces, current Tokenless evidence, candidate providers, and the proposed canonical capability schema.
+
+The next evaluation wave is:
+
+1. Kimi web, prioritizing the complete asynchronous Deep Research lifecycle;
+2. Mistral Le Chat, prioritizing a second independent research/Project/artifact implementation; and
+3. DeepSeek Chat signed-in closure, prioritizing the compact baseline first, then mode selection, search, and files as independent capabilities.
+
+Meta AI, Microsoft Copilot, Tencent Yuanbao, and MiniMax Agent remain scored candidates. Meta AI is currently strongest as an image-generation/editing candidate rather than a Deep Research provider. MiniMax Agent requires a distinct long-horizon agent lifecycle and must not distort the baseline chat contract. This is a discovery order, not a claim that every candidate is already suitable for automation or will ship.
+
+Official product entry points:
+
+- [Qwen / 千问](https://chat.qwen.ai/)
+- [Kimi](https://www.kimi.com/)
+- [Z.ai / GLM](https://z.ai/chat)
+- [Zhipu Qingyan / 智谱清言](https://chatglm.cn/)
+- [DeepSeek Chat](https://chat.deepseek.com/)
+- [Perplexity](https://www.perplexity.ai/)
+- [Mistral Le Chat](https://chat.mistral.ai/)
+- [Doubao](https://www.doubao.com/)
+- [Meta AI](https://www.meta.ai/)
+- [Microsoft Copilot](https://copilot.microsoft.com/)
+- [Tencent Yuanbao](https://yuanbao.tencent.com/)
+- [MiniMax Agent](https://agent.minimax.io/)
+
+## Why This Matters
+
+- Chinese-speaking users should be able to reuse the web products and subscriptions they already value.
+- Provider diversity improves routing choice across coding, research, long-context, multimodal, and document-heavy tasks.
+- A larger provider set reduces dependence on any single provider's UI, availability, or product decisions.
+- Parity work forces shared contracts to describe real differences rather than assuming one provider's interface is universal.
+
+## Provider Selection Scorecard
+
+Candidates are ranked from current, real-session evidence. Model popularity alone is insufficient.
+
+| Dimension | Evidence |
+| --- | --- |
+| User value | Strong current models or agent workflows that complement existing providers |
+| Web availability | A stable user-facing web product in the target regions |
+| Session viability | Authentication can remain opaque inside an isolated managed profile |
+| Core workflow | A visible composer, submission action, stable result, and safe continuation path |
+| Context capability | Visible file upload, long-context handling, native project or memory surfaces, or an honest fallback |
+| Coding utility | Useful visible workflows for repository analysis, implementation, or web development |
+| Testability | Sanitized real-session evidence can prove selectors and postconditions without exposing user data |
+| Policy fit | The intended visible automation can be operated responsibly under applicable product constraints |
+| Operational quality | Rate-limit, sign-in, CAPTCHA, interruption, and long-running states can be detected and surfaced |
+
+Development cost is not a deciding advantage. Prefer robust, high-value integrations even when they require deeper adapter work.
+
+## Provider-Neutral Baseline
+
+A provider does not become generally supported until it closes the baseline:
+
+- approved origins and canonical target validation;
+- managed-profile launch and visible session status;
+- `prompt.input`, `prompt.submit`, and stable visible answer reading;
+- conversation URL capture and same-scope continuation;
+- cancellation, timeout, waiting-for-user, and long-running behavior;
+- normalized result and visible citations when the provider exposes them;
+- explicit capability inspection;
+- safe model or mode preservation, with verified selection only where proven; and
+- real integration or browser E2E coverage through the built product.
+
+File upload, native Project creation, generated-media lifecycles, deep research final-report orchestration, agent mode, and other advanced controls remain capability-gated. Qwen Deep Research mode selection is provider-specific and proves the first correlated visible response, which may be a clarification phase; it does not make the full multi-turn research lifecycle provider-neutral. A provider may ship the baseline while an advanced capability remains `unknown` or `unavailable`.
+
+## Delivery Phases
+
+### Phase 0: Candidate Reconnaissance
+
+- Record canonical origins, route classes, account states, model or mode surfaces, composer behavior, result structure, attachment controls, and workspace-like concepts.
+- Review product and automation constraints before implementation.
+- Capture only sanitized, provenance-bound DOM evidence from a dedicated visible session.
+- Publish a scorecard and select one provider for the first implementation slice.
+
+Exit: the candidate has an approved origin model, an evidence plan, and no unresolved boundary that would require credentials, private APIs, or invented fixtures.
+
+### Phase 1: Shared Registry Extraction — completed 2026-07-27
+
+- Follow the object model, capability composition, registry seam, TypeScript daemon negotiation, and phased migration defined in the archived [Provider Architecture and Registry](archived/P0-provider-architecture-and-registry.md).
+- Replace duplicated provider allowlists with one typed provider registry consumed by config, runtime validation, profile handling, navigation, capture tooling, and tests.
+- Represent every provider as a concrete `BaseProvider` subclass.
+- Keep provider-specific selectors and behavior inside provider-owned subclasses and optional capability implementations.
+- Make unsupported capabilities explicit data rather than scattered conditionals.
+- Remove provider-ID conditionals from shared runner, session, account, and action implementations.
+- Keep new provider knowledge in the TypeScript provider registry and out of removed runtime paths.
+
+Exit: adding a provider requires one provider subclass and one registry entry, does not require shared production-logic changes, and no longer requires manually synchronizing independent allowlists across the CLI, daemon-facing contracts, helpers, and test matrices.
+
+### Phase 2: First Chinese Provider Baseline — Qwen experimental baseline completed 2026-07-27
+
+- Implement the highest-ranked first-wave provider.
+- Prove sign-in states, composer readiness, prompt submission, stable completion, and conversation continuation.
+- Add explicit waiting and failure states for sign-in, CAPTCHA, rate limits, plan gates, and selector drift.
+- Keep the provider experimental until the live matrix is complete.
+
+Exit: a real managed browser session can complete and continue a prompt through the built CLI with normalized results and no simulated provider behavior.
+
+### Phase 3: First-Wave Coverage
+
+- Repeat the baseline for the remaining first-wave providers.
+- Compare differences and evolve shared contracts only where the concept is genuinely provider-neutral.
+- Add file acceptance, model or mode selection, and workspace behavior independently when visible proof exists.
+
+Exit: Kimi, Z.ai, Perplexity, Mistral Le Chat, and DeepSeek each have an explicit support state and evidence-backed capability matrix, even when the correct state is unavailable or parked.
+
+### Phase 4: Continuous Parity
+
+- Run a scheduled live compatibility matrix across supported account states where safe.
+- Detect route or selector drift and mark affected capabilities unavailable until re-proven.
+- Re-score candidates as provider products evolve.
+- Add second-wave providers one at a time without weakening the baseline.
+
+Exit: support is an ongoing evidence process rather than a one-time adapter merge.
+
+## Acceptance Criteria
+
+- Provider identity is normalized through a single registry.
+- Every supported origin, navigation target, and returned conversation URL is validated.
+- Each advertised action has a captured visible success postcondition from a real provider session.
+- Unsupported or ambiguous controls fail closed with actionable machine-readable reasons.
+- No test introduces fake provider pages, synthetic network responses, or invented DOM fixtures.
+- Documentation distinguishes provider support from model availability and from advanced capability support.
+- Existing providers continue to pass the same baseline contract after each expansion.
+
+## Risks and Responses
+
+| Risk | Response |
+| --- | --- |
+| Fast UI and product drift | Provenance-bound fixtures, live smoke coverage, isolated adapters, and rapid capability disablement |
+| Region, account, or plan variation | Account-state capability matrix and `unknown` when evidence is incomplete |
+| Model names change faster than adapters | Discover visible labels at runtime and avoid hard-coding marketing names as capability guarantees |
+| Candidate lacks a safe automation surface | Park the candidate and preserve the scorecard; do not bypass the visible boundary |
+| Shared abstraction becomes ChatGPT-shaped | Require multiple-provider evidence before promoting behavior into the shared contract |
+
+## Non-Goals
+
+- Calling model APIs instead of the provider's visible web product
+- Guaranteeing a specific model name, entitlement, quota, or release schedule
+- Reaching parity by using hidden endpoints or exporting browser credentials
+- Treating a visible control as proof that the resulting mutation succeeded
+- Shipping all listed candidates simultaneously
diff --git a/docs/roadmaps/P0-real-provider-browser-e2e-and-native-projects.md b/docs/roadmaps/P0-real-provider-browser-e2e-and-native-projects.md
new file mode 100644
index 0000000..23a3fa5
--- /dev/null
+++ b/docs/roadmaps/P0-real-provider-browser-e2e-and-native-projects.md
@@ -0,0 +1,358 @@
+# Real Provider Browser E2E and Native Projects
+
+Status: in progress | Priority: P0
+
+Depends on: the completed [Provider Architecture and Registry](archived/P0-provider-architecture-and-registry.md), the managed Playwright runtime, durable daemon jobs, managed profile lifecycle, attachment staging, and conversation continuation
+
+Supports: [Provider Expansion and Parity](P0-provider-expansion.md) and [Context Delivery and Workspace Alignment](P0-context-delivery-and-workspace-alignment.md)
+
+## Outcome
+
+Tokenless proves every advertised visible-provider capability through the built CLI, packaged daemon, real managed Chromium, and the real provider website. Tests verify the CLI result, an independent visible DOM observation, and durable daemon state for the same run.
+
+Claude and Grok additionally support native Project creation, exact reuse, Project-scoped chat, instructions on creation, attachment submission, and conversation continuation. Native Project support remains unavailable for other providers until each provider closes the same real-session evidence bar.
+
+## Evidence Policy
+
+All browser E2E and visible-provider capability acceptance tests use real provider sessions:
+
+- no provider DOM fixture routes;
+- no provider network interception;
+- no simulated provider responses;
+- no fake pages, locators, browser contexts, daemons, or provider state;
+- no runtime skip for a temporary page, network, selector, or account failure; and
+- no capability claim based only on a selector, menu, static DOM state, or CLI result.
+
+The only runtime skip exception is the checked-in Claude Cloudflare known issue declared in `test/live-provider-capability-matrix.json`. It may apply only to provider `claude`, only when the durable job payload is `waiting_for_user`, and only when the structured blocker code is `visible_cloudflare_turnstile` or `visible_cloudflare_interstitial`. Sign-in-required states, authentication unavailability, timeouts, selector or UI drift, other challenge families, other blocker codes, and every other provider remain hard failures.
+
+Redacted, provenance-bound provider DOM captures remain development aids for selectors, parsers, and already-observed DOM variants. They are not E2E, do not close provider transitions, and do not count toward capability acceptance.
+
+Provider E2E runs manually on this machine through the dedicated live-provider profile harness. Every explicit production browser selection resolves one stable slug such as `live-provider-cloak` under the test-only `<TOKENLESS_HOME>/e2e/live-provider` home. The production profile registry remains authoritative for mapping that slug to its opaque UUID directory, and the harness verifies directory containment, private permissions, ready lifecycle, exact executable, and runtime binding before provider automation. `auto` and cross-runtime profile reuse are forbidden because they cannot preserve one stable browser/profile storage contract across runs.
+
+The harness separates `prepare` from `run`. Preparation installs or resolves the selected browser, creates or reuses only its browser-specific profile, and resolves the configured effective provider whitelist from the profile override or top-level fallback without rewriting either list. It preserves that order, requests every listed provider-home tab through one concurrent Chromium background-target batch, and returns without waiting for page load, login, or Playwright target observation. The detached daemon remains the browser owner while Chromium persists the dedicated profile normally. Preparation does not consult the capability matrix or submit provider jobs. The browser may take focus on its initial launch, but preparation never foregrounds each provider tab sequentially. It does not run setup authentication checks, automate login, or inspect authentication data. The authenticated run then injects the resolved test home and slug into the existing built-CLI provider suite, where the capability matrix defines the journeys under test. It does not create a separate test account or silently select another profile. Provider-side mutations, retained test artifacts, and usage cost are acceptable. Every artifact uses a recognizable Tokenless E2E prefix, run ID, and timestamp.
+
+The live E2E suite starts one daemon-owned, headed browser for the explicitly selected profile and reuses that browser across every selected provider case. Playwright owns the browser lifecycle on every platform; each independent observer attaches through the loopback CDP endpoint for one case and then disconnects without closing or relaunching the product browser. The suite has no macOS-specific `open` launcher or foreground-application manipulation. The operating system may activate the browser on its one initial headed launch.
+
+## Current Closure
+
+On 2026-08-01, the focused real-provider fallback gate passed against the explicitly selected `default` managed profile bound to system Chrome 150. Claude encountered the durable `visible_cloudflare_interstitial` blocker before submission; the same job ID atomically requeued to ChatGPT, ChatGPT returned the correlated unique marker, and the final CLI and SQLite state recorded ordered attempts `claude: blocked` then `chatgpt: succeeded`. The run used the real provider sites, packaged daemon, keychain-neutral headed browser launch, and independent CDP observation for both attempts, with no fixture, interception, simulation, skip, or internal retry.
+
+The fallback gate now requires the complete multi-capability set `conversation.chat + file.upload`: both routes must satisfy both capabilities, the independent observer must prove both real provider attempts, the runtime protocol must report visible staged-attachment acceptance, and the correlated response must return a marker available only inside the file. The earlier conversation-only pass remains valid historical evidence for durable switching but does not satisfy this stronger gate; a fresh run is required before release.
+
+The strengthened gate was exercised again on 2026-08-01 and correctly reached the second provider under the same job ID, but the selected profile did not meet the file prerequisite. ChatGPT exposed a guest menu where `Add photos` was available while general `Add files` required login, and Grok reported `provider_sign_in_required`. The run therefore has no positive `conversation.chat + file.upload` acceptance result. The runtime now opens menu-backed upload capability UI during read-only preflight, treats sign-in-gated file controls as unavailable, prefers the visible file chooser over unrelated hidden inputs, and refuses to submit when it has only file-input selection without visible provider acceptance. A future positive gate must use an explicitly selected profile whose fallback provider is visibly eligible for general file upload; no login automation or silent profile switch is permitted.
+
+As of 2026-07-29, the implementation, capability matrix, CDP observer boundary, durable mappings, native Project strategies, public contracts, and manual gate commands are in place. Real runs additionally established these capability boundaries:
+
+- the selected Gemini guest profile does not restore prior-turn context when a second CLI process opens the mapped conversation URL;
+- the selected Qwen guest profile uses the shared `/c/guest` route, which does not restore the prior visible response after navigation or reopen; and
+- both combinations are therefore explicitly unavailable in the checked-in matrix rather than being counted as continuation support.
+
+The previous complete manual gate attempts produced:
+
+- non-submission: 16 invoked cases, 3 passed and 13 failed;
+- mutation: 20 invoked cases, 5 passed and 15 failed; and
+- Project: 2 invoked cases, 0 passed and 2 failed.
+
+All three gates ran with zero skipped cases and no internal retry. This predates the narrow Claude Cloudflare known-issue skip classification now declared in the matrix; the release bar remains zero skips except for that exact durable blocker condition. Gemini and Qwen provided real mutation closure for every capability required by their matrix entries at that time. That earlier mutation run passed Gemini submit/read, citations, and conversation workspace plus Qwen submit/read and conversation workspace. It failed all ChatGPT, Claude, and Grok cases with `e2e_provider_auth_unavailable` because the selected setup-managed profile was not authenticated for those providers.
+
+On 2026-07-31, the mutation cases were consolidated around provider submissions rather than capability-by-capability messages. ChatGPT, Claude, and Grok now prove attachment acceptance, response reading, citations, conversation fallback, durable mapping, and cross-process continuation in one two-turn workflow. Gemini proves response reading, citations, conversation fallback, and durable mapping in one submission. Qwen proves Deep Research mode selection, response reading, conversation fallback, and durable mapping in one submission. The matrix records and the harness enforces an exact per-case submission budget. The full manual gate budget is now 12 submissions: 8 in the mutation gate and 4 in the two native Project cases, down from 28. This structural reduction is not provider acceptance evidence; the consolidated cases required a fresh manual real-provider run.
+
+A fresh same-machine run on 2026-07-31 then produced:
+
+- non-submission: 17 invoked cases, 6 passed and 11 failed;
+- mutation: 5 invoked cases, 1 passed and 4 failed; and
+- Project: 2 invoked cases, 0 passed and 2 failed.
+
+All three gates ran with zero skipped cases and no internal retry. Qwen resolved successfully and passed all three non-submission cases, while Gemini passed both non-submission cases and its real mutation workflow. ChatGPT, Claude, and Grok remained unauthenticated in the selected setup-managed profile. ChatGPT additionally failed visible attachment observation, Claude model inspection encountered a navigation-destroyed execution context, and Qwen mutation stopped before submission because the independent observer did not see Deep Research Advanced selected. These results replace DNS instability as the current Qwen blocker without treating either failure as acceptance evidence.
+
+Qwen closure now starts from its canonical `https://chat.qwen.ai/` chat surface. A real built-CLI run proved that the provider accepts the prompt, navigates the same visible page to `/c/guest`, and returns the exact marker. Qwen Studio exposes its textarea before the guest backend is ready, so the adapter waits only until the initial page lifecycle is three seconds old before first input; an already hydrated conversation incurs no additional delay. The real mutation gate then passed both required Qwen cases through independent CDP observation and durable state.
+
+The subsequent non-submission gate encountered intermittent system DNS failure for `chat.qwen.ai` after the same hostname had resolved for the successful mutation gate. Navigation reports this explicitly as retryable `provider_dns_unavailable`. For operational handling, the durable error details classify the Qwen-specific signal as `suspected_rate_limit` while keeping `rateLimitConfirmed: false`: provider-edge throttling is plausible, but a Chromium name-resolution failure alone is not rate-limit proof. A same-machine probe on 2026-07-31 subsequently resolved the hostname and received HTTP 200, so no HTTP rate-limit evidence was present at that time. No test-only DNS override is used or counted as acceptance evidence.
+
+On 2026-07-30, Qwen-specific mode work added `qwen.mode.inspect/select`, runtime enabled/disabled mode discovery, exact Deep Research Normal/Advanced selection, Auto/Thinking/Fast effort controls, and a required real mutation case that selects Deep Research Advanced before prompt submission and response reading. A built-CLI action produced the visible `qwen-mode-and-variant-visible` postcondition for Deep Research Advanced. A separate development capture recorded the selected Deep Research Advanced state through a read-only CDP observer and added the redacted reduction to the fixture manifest; its one-off public-DNS host resolution is recorded in provenance and the fixture does not count as acceptance. After system DNS recovered, built-CLI plus read-only-CDP runs proved Auto/Thinking/Fast inspection, exact Thinking selection, visible selection, durable success, and Auto restoration. A real Deep Research Advanced run then proved exact mode and variant selection through the observer while the product submitted the unique prompt, read a correlated visible clarification response, and persisted durable SQLite success. The checked-in case was strengthened to require the observer to see the unique submitted prompt as well. A subsequent fresh run failed clearly with `provider_plan_limited` before that stronger assertion could be rerun; it was not retried inside the suite or converted into fixture evidence. The implementation therefore closes the product mode-selection and first-response behavior but still requires the next manual gate run for full matrix acceptance. It does not claim Qwen's complete multi-turn final-report lifecycle.
+
+The roadmap remains in progress. Before release, the operator must restore the required selected-profile authentication for ChatGPT, Claude, and Grok, ensure stable system DNS resolution for `chat.qwen.ai`, manually rerun every applicable gate, and obtain a complete pass. Claude and Grok native Project implementation also remains provisional until real authenticated sessions supply the required DOM development captures and close creation, exact reuse, instructions, Project chat, and continuation.
+
+## Actor and Oracle Boundary
+
+The product remains the only actor:
+
+- the built CLI submits every job;
+- the packaged daemon owns job state and the managed browser;
+- production provider actions perform all navigation, input, clicking, selection, upload, submission, Project operations, and response reading; and
+- no test observer calls production action implementations.
+
+A second Playwright client connects to the product-launched Chromium through CDP only as a test observer. It may:
+
+- locate the target page;
+- read accessible roles and visible marker content;
+- inspect visible attachment, Project, conversation, response, and citation outcomes; and
+- report bounded semantic observations needed for the core flow.
+
+It must not intercept network traffic, install routes, modify page state, or perform product actions. Observer assertions must not import production provider selectors or action implementations.
+
+E2E evidence must not include screenshots, full DOM dumps, cookies, local storage, session storage, credentials, or unrelated account content.
+
+## Milestone 1: Real-Provider Browser E2E Foundation
+
+### Phase 1: Checked-In Capability Matrix
+
+Add one machine-readable capability matrix as the source of truth for live coverage. Each entry records:
+
+- provider;
+- provider stage;
+- required account class or subscription condition;
+- capability and visible action;
+- non-submission, mutation, or Project gate;
+- required observable CLI, DOM, and durable-state closure;
+- supported, unavailable, or unknown expectation; and
+- a checked-in reason for every unavailable combination.
+
+The test loader validates that:
+
+- every registered provider and declared visible capability has a matrix entry;
+- every supported entry maps to a real E2E case;
+- unavailable entries have an explicit reason;
+- every case declares an exact provider-submission budget of zero, one, or two;
+- the only known-issue skip is declared with a recognized provider, machine-readable reason, and safe structured blocker codes;
+- response reading and citation extraction remain separate capabilities; and
+- runtime conditions cannot silently convert a required case into a skip outside the declared Claude Cloudflare durable blocker exception.
+
+When the suite is invoked, every required case runs exactly once. The suite has no internal retry and no skip path for missing activation, unavailable authentication, provider failure, blocker state, or another unmet prerequisite. The sole exception is a runtime skip for Claude when the completed job payload is durably `waiting_for_user` with structured blocker code `visible_cloudflare_turnstile` or `visible_cloudflare_interstitial`. Each other condition fails with a clear machine-readable reason. Retry happens only when the operator manually runs the suite again.
+
+Exit: capability declarations and live acceptance coverage cannot drift independently.
+
+### Phase 2: Test-Only CDP Inspection
+
+Under explicit `TOKENLESS_E2E_BROWSER_INSPECTION=1` activation:
+
+- launch the selected headed browser once through Playwright and reuse it across the suite;
+- launch the managed Chromium profile with an ephemeral remote debugging port and an explicit loopback address;
+- preserve the managed profile as a non-default user data directory;
+- discover the current endpoint from the profile's `DevToolsActivePort`;
+- reject stale endpoint files by validating the current browser lifecycle;
+- require the daemon and target browser context to start in inspection mode rather than reusing a context launched without it; and
+- disconnect the observer without closing the product browser.
+
+Normal product runs never expose a debugging port.
+
+Before the first provider action, the job waits at a test-only barrier identified by run ID, job ID, and a random nonce:
+
+1. the product navigates to the real provider target;
+2. the observer connects and confirms the expected page and origin;
+3. the observer releases the matching barrier;
+4. the product executes the first action; and
+5. an unreleased barrier fails explicitly after 30 seconds.
+
+Barrier state is bounded to the current run and removed during cleanup. A stale release cannot unblock another job.
+
+Exit: the observer deterministically sees the real page before product actions begin, without changing product behavior outside the gated test run.
+
+### Phase 3: Built CLI Harness
+
+Run the built CLI as an asynchronous child process against:
+
+- the harness-resolved test-only Tokenless home;
+- the real SQLite job store;
+- the packaged TypeScript daemon;
+- the deterministic browser-specific profile prepared through the live-provider harness;
+- the real Chromium installation; and
+- the real provider website and current authenticated account state in that profile.
+
+Every core case correlates one unique task and marker across:
+
+1. built CLI JSON and exit status;
+2. independent visible DOM observation; and
+3. daemon API and SQLite durable job state.
+
+The harness records bounded structured CLI, observer, daemon API, and SQLite evidence on both success and failure. It does not capture screenshots or full DOM. An authentication or provider failure fails the required case with a clear reason; it does not become a skip.
+
+Exit: a test can prove one product-owned provider workflow through all real system boundaries without a fixture or simulated response.
+
+### Phase 4: Existing Capability Closure
+
+The initial required matrix is:
+
+| Capability | Required real-provider closure |
+| --- | --- |
+| Auth, capability inspection, navigation, blocker inspection, sanitized snapshot | Every provider that declares the action |
+| Prompt input and clear | Every provider that declares composer support; observer sees the unique draft and its removal |
+| Model and effort inspection and selection | Inspect the current choice, select a real alternate, verify the visible selection, and restore the original choice |
+| Provider-specific Qwen mode | Inspect enabled and disabled modes, select Deep Research Advanced, verify the visible mode and variant, submit a real prompt, read the correlated response, and restore Chat |
+| File upload | Verify a visible attachment and submit it with a correlated prompt |
+| Prompt submission and response reading | Submit a unique marker and read a real provider response correlated to that marker |
+| Citation extraction | For providers that declare it, use a source-seeking prompt and verify real visible citation controls and normalized results |
+| Conversation continuation | A second CLI process uses the same task ID; DOM and durable state prove both turns share the exact conversation |
+| Conversation workspace fallback | Project metadata and task identity resolve to the same real conversation without being reported as native |
+
+The live suite has explicit gates:
+
+- **Non-submission gate:** auth, capability inspection, navigation, blocker state, model and effort change with restoration, draft input and clear, and attachment selection with draft cleanup.
+- **Mutation gate:** prompt submission, attachment submission, real response reading, citations, conversation continuation, and Qwen Deep Research mode closure.
+- **Project gate:** native Project creation, reuse, instructions, Project chat, and Project-scoped continuation.
+
+These gates select which manually invoked command performs provider-side mutations; they do not skip cases inside an invoked suite.
+
+Exit: every currently advertised visible capability has real-provider acceptance evidence through the capability matrix.
+
+## Milestone 2: Claude and Grok Native Projects
+
+### Phase 1: Development Evidence
+
+Capture complete, redacted, provenance-bound Claude and Grok DOM states for:
+
+- Project list empty and populated;
+- create form;
+- successful creation;
+- exact Project open;
+- Project instructions;
+- new Project chat;
+- existing Project conversation; and
+- ambiguous or unavailable states observed during real testing.
+
+These captures guide provider-owned selectors and parsers. They never replace the real Project E2E closure.
+
+Exit: implementation is grounded in genuine observed provider states without claiming that static captures prove a transition.
+
+### Phase 2: Native Workspace Semantics
+
+Extend the existing `workspace.ensure` action rather than adding a parallel command:
+
+- `native`: find an exact visible name, create when absent, reuse when exactly one match exists, fail on ambiguity, and never fall back;
+- `auto`: prefer native for Claude and Grok, fall back only after stable evidence that native Projects are unavailable, and return a retryable failure for transient UI, navigation, network, blocker, or selector errors; and
+- `conversation`: preserve the current conversation-scoped behavior.
+
+Define explicit error codes and retryability for stable unavailability, ambiguous identity, visible UI drift, navigation failure, network failure, account gating, and blocker states. `auto` must never hide a regression as a conversation fallback.
+
+On creation, apply `--project-instructions` and verify the visible result. On reuse, do not silently overwrite existing instructions. Report whether instructions were:
+
+- not requested;
+- applied on creation;
+- already equivalent;
+- skipped on reuse; or
+- unavailable.
+
+For a combined run, action ordering is:
+
+1. `workspace.ensure`;
+2. verify canonical Project URL, exact Project identity, and Project composer;
+3. model selection;
+4. effort selection;
+5. file upload;
+6. prompt input;
+7. prompt submission; and
+8. response reading.
+
+Exit: every later action executes on the verified Project surface rather than provider home.
+
+### Phase 3: Result Contract
+
+Make `WorkspaceEnsureResult` a discriminated union:
+
+- `mode: "native" | "conversation"`;
+- `resource.kind: "project" | "conversation"`;
+- `resource.native: boolean`;
+- `resource.disposition: "created" | "reused" | "fallback"`;
+- exact provider and profile scope;
+- stable provider resource identity when available;
+- canonical Project or conversation URL;
+- visible proof;
+- requested and resolved mode; and
+- instruction outcome.
+
+Preserve the existing conversation result semantics. Update JSON contract coverage, API examples, paired English and Chinese CLI documentation, and any success-response fixtures that describe the public result.
+
+Exit: callers can distinguish native creation, native reuse, and explicit conversation fallback without interpreting prose.
+
+### Phase 4: Durable Project and Conversation Identity
+
+Persist native Project identity independently from human-readable names:
+
+- Project key: provider, managed profile ID, and provider Project resource ID derived from a validated canonical URL;
+- Project metadata: visible name, canonical URL, creation or observation timestamps, and last visible proof;
+- Conversation key: provider, managed profile ID, Project resource ID, and task ID; and
+- Conversation value: validated canonical conversation URL and the job that visibly proved it.
+
+An exact-name lookup with multiple visible matches fails closed. Display names never become primary keys.
+
+Persist a visibly proven Project mapping immediately after the successful `workspace.ensure` action checkpoint, even if a later upload or prompt action fails. Persist a conversation mapping only after visible submission yields a validated conversation URL.
+
+Subsequent CLI processes resolve:
+
+1. an explicit trusted target URL;
+2. the exact Project-scoped task conversation mapping;
+3. the exact Project mapping; or
+4. provider home when no authorized mapping exists.
+
+Exit: retries and later CLI invocations recover the exact Project and conversation without scanning arbitrary historical result payloads or crossing provider, profile, Project, or task scope.
+
+### Phase 5: Native Project Live Acceptance
+
+For both Claude and Grok, using the explicitly selected dedicated live-provider profile:
+
+1. generate a run-scoped unique Project identity;
+2. run `workspace.ensure --workspace-mode native` and require `created`;
+3. run the same ensure again and require `reused`;
+4. verify the canonical URL, exact visible Project name, and instruction outcome through the observer;
+5. in that Project, select and verify model and effort when supported, upload a marker file, submit the first marker prompt, and read the real response;
+6. start a second CLI process with the same Project identity and task ID and submit a follow-up;
+7. verify both turns in the same Project conversation; and
+8. verify Project mapping, conversation mapping, job results, task ID, marker, and canonical URLs through the daemon API and SQLite.
+
+Real Projects, conversations, messages, attachments, and provider usage are expected test artifacts. Cleanup is optional and must occur only after acceptance evidence is durable; inability to clean up does not weaken or skip the test.
+
+Exit: Claude and Grok native Project support is proven through a fresh real creation, exact reuse, Project-scoped work, and cross-process continuation.
+
+## Release and Documentation
+
+- Milestone 1 is internal test infrastructure and does not require a changeset by itself.
+- Milestone 2 changes user-visible CLI behavior and JSON results, so it requires a changeset.
+- Update paired English and Chinese user documentation together.
+- Provider browser E2E does not run in CI. Pull requests carry a non-enforced reminder for the author to run the applicable local E2E.
+- Every applicable provider E2E must pass manually before release. The release process relies on this checklist rather than an automated CI enforcement.
+- E2E suites do not retry internally. An operator may manually rerun the complete applicable suite after investigating a clear failure.
+- Run `npm run test:e2e:fallback` with the explicitly selected managed profile, daemon URL, primary provider, and fallback provider environment variables to prove that a real visible primary blocker atomically requeues one durable `conversation.chat + file.upload` job, visibly accepts the staged file on the capability-compatible fallback provider, and returns the correlated marker. This focused suite has no fixture route, interception, synthetic provider response, retry, or skip.
+- Do not manually publish packages or releases; repository automation owns changeset-driven publication.
+
+## Acceptance Criteria
+
+- No fixture-based test is named or counted as browser E2E.
+- Every advertised visible capability has a required real-provider matrix entry.
+- Every required real-provider case proves CLI, visible DOM, and durable state for the same task and marker.
+- An invoked E2E suite has no skipped cases and no internal retry, except for the checked-in Claude Cloudflare durable blocker known issue.
+- Authentication or dedicated-profile preparation problems fail with a clear reason.
+- All applicable E2E suites pass manually before release, without requiring CI enforcement.
+- CDP inspection is test-only, loopback-only, read-only, and absent from normal runs.
+- Runtime provider failures fail required tests rather than silently skipping them unless they match the declared Claude Cloudflare durable blocker known issue.
+- Runtime provider fallback evidence proves one unchanged job ID, an implication-complete capability set, a structured primary blocker, ordered durable attempt history, independently observed provider attempts, protocol-level visible attachment acceptance, the fallback provider's correlated visible response, and the same final state through the built CLI.
+- Claude and Grok native Project creation and reuse are both exercised against fresh real Project identities.
+- Model, effort, upload, prompt, submit, and read actions execute after native Project alignment.
+- Project and conversation mappings use exact provider resource scope rather than display names.
+- `auto` fallback cannot convert transient or ambiguous native failures into conversation success.
+- Public native and conversation result shapes remain explicit and documented.
+
+## Risks and Responses
+
+| Risk | Response |
+| --- | --- |
+| Provider UI drift | Fail the required live case, retain bounded diagnostics, capture the new real DOM variant for development, and update the provider-owned adapter |
+| Account or subscription variation | Use the selected dedicated live-provider profile, run applicable declared capabilities, and fail clearly when authentication or account state cannot satisfy a required case |
+| CDP endpoint is stale or unavailable | Start the daemon and browser context in inspection mode, validate lifecycle identity, and fail explicitly |
+| Observer changes product behavior | Keep it read-only, prohibit routes and actions, and assert through independent accessible roles and markers |
+| Provider rate limits or usage cost | Fail clearly, investigate, and manually rerun the suite when appropriate; use explicit gates, bounded concurrency, and real artifacts rather than fixtures |
+| Duplicate Project names | Resolve a stable provider resource identity or fail closed |
+| Project creation succeeds but a later action fails | Persist the Project mapping at the successful workspace action checkpoint |
+| Native UI is temporarily broken | Return a retryable failure and do not fall back under `auto` |
+
+## Non-Goals
+
+- Fixture-based provider E2E
+- Provider network interception or simulated provider responses
+- Private provider APIs
+- CAPTCHA or authentication bypass
+- Automatic login
+- Automatic account or profile provisioning for E2E
+- Provider browser E2E in CI
+- Internal E2E retry or runtime skip outside the declared Claude Cloudflare durable blocker known issue
+- Native Project support for ChatGPT, Gemini, or Qwen without the same real-session closure
+- Making crash/restart, abrupt process death, port competition, replay, or acknowledgement edge cases part of the default browser E2E acceptance bar
diff --git a/docs/roadmaps/P0-web-agent-harness.md b/docs/roadmaps/P0-web-agent-harness.md
new file mode 100644
index 0000000..7a0e437
--- /dev/null
+++ b/docs/roadmaps/P0-web-agent-harness.md
@@ -0,0 +1,598 @@
+# Web Agent Harness
+
+Status: proposed | Priority: P0 | First provider: ChatGPT
+
+Depends on: the typed visible-provider capability seam, durable daemon jobs and conversation lanes, the Context Envelope contract, and real ChatGPT Project, instruction, upload, and continuation evidence
+
+Related: [Agent Session Integrations](P1-agent-session-integrations.md) owns the northbound local MCP server and exact caller-session binding; this roadmap owns the southbound MCP client and the web-model tool loop
+
+Packaging direction: independently buildable workspace package first; separate Harness project only after the provider-turn interface and real agent loop are stable
+
+## Outcome
+
+Tokenless treats visible AI websites as model providers, not as the agent harness itself. A caller can start one durable agent run whose model turns happen through a real provider website while the harness owns instruction delivery, tool discovery, authorization, execution, result return, loop limits, recovery, and the final run result.
+
+The current repository remains the Web Provider API project. It converts evidence-backed visible website workflows into durable, provider-neutral jobs and results. Today's CLI, daemon, capability, and planned P1 integration interfaces are different ways to call that same Web Provider layer; they do not add an agent loop. The new harness is not another provider capability implementation. It begins as a separate package built specifically on top of the Web Provider interface.
+
+The first complete path is ChatGPT because it is the current strategic target for persistent Projects, instructions, files, exact conversation continuation, and tool-loop instruction following. This is a sequencing decision, not a permanent claim that other providers cannot support agent runs.
+
+V1 proves one bounded loop:
+
+1. create or resolve an exact ChatGPT Project and a fresh conversation;
+2. deliver an explicit, versioned harness instruction set and the task context through visible provider surfaces;
+3. submit the user goal through the existing provider runtime;
+4. parse a schema-valid tool request from the complete visible response;
+5. authorize and execute configured local MCP tools;
+6. return bounded structured tool results to the same conversation; and
+7. repeat until ChatGPT returns a schema-valid final result or the run reaches a waiting or terminal state.
+
+## AI Turn Versus Agent Run
+
+A normal AI turn is one request followed by one generated response. It may use provider-native features, but Tokenless treats the completed provider response as the output.
+
+An agent run adds a host-controlled loop around those turns:
+
+```text
+goal
+  -> model turn
+  -> inspect result
+  -> authorize tool calls
+  -> execute tools
+  -> append tool results
+  -> next model turn
+  -> final result
+```
+
+The model proposes actions. The harness decides whether they are valid and authorized, executes them outside the provider page, and controls whether another turn is allowed. Agency therefore belongs to the Tokenless harness even when ChatGPT supplies the planning and text generation.
+
+Provider-native Agent, Research, apps, connectors, or other modes remain visible provider capabilities. They are not silently treated as Tokenless tool executions and do not bypass local policy.
+
+## Two-Layer Architecture
+
+```mermaid
+flowchart TB
+  Caller["Caller"]
+  Skills["Activated skills<br/>instructions + tool guidance"]
+  MCP["Configured MCP servers"]
+  Harness["Layer 2: Web Agent Harness<br/>skill injection + MCP tool loop + approval"]
+  Provider["Layer 1: Web Provider API<br/>Projects + files + conversations + turns"]
+  Playwright["Playwright provider adapters"]
+  Websites["Visible AI provider websites"]
+
+  Caller --> Harness
+  Skills --> Harness
+  Harness <--> MCP
+  Harness <--> Provider
+  Provider <--> Playwright
+  Playwright <--> Websites
+```
+
+The seam is deliberately above DOM operations. The harness never receives a Playwright `Page`, selector, browser profile path, provider credential, or raw provider action menu. The provider runtime never receives an MCP client, tool approval policy, or agent-loop state.
+
+Authorization, local tools, MCP clients, instruction compilation, and loop persistence are internal modules of Layer 2. They are not additional product layers.
+
+## The Two Modules and Eventual Projects
+
+The intended end state contains two independently useful projects:
+
+| Module and eventual project | Owns | Does not own |
+| --- | --- | --- |
+| Web Provider API | Playwright provider adapters, managed browser execution, Projects, files, conversations, visible model controls, durable provider turns, routing, scheduling, scaling, evidence, and the versioned Web Provider interface | Skill injection, MCP tool execution, approvals, or an agent loop |
+| Web Agent Harness | Agent runs, web-specific instruction delivery, skill injection, visible tool-call protocol, southbound MCP clients, registered local tools, approvals, loop policy, and harness-owned run state | Provider DOM, browser profiles, selectors, credentials, or direct Playwright operations |
+
+The repository is not split while both interfaces are still moving. The delivery sequence is:
+
+1. keep the existing Web Provider API implementation in this repository;
+2. add the harness as an independently buildable workspace package, provisionally `packages/web-agent-harness/`;
+3. make that package depend only on a versioned provider-turn client and shared wire schemas;
+4. prove the complete ChatGPT tool loop and stabilize the cross-package interface; and
+5. extract the harness package into its own project only when doing so is a mechanical repository move rather than an architectural rewrite.
+
+No external package scope, registry namespace, or final package name is assumed by this roadmap. Those names require separate ownership verification before publication.
+
+### Package Dependency Rule
+
+The allowed dependency direction is:
+
+```text
+web-agent-harness package
+  -> provider-turn client + versioned wire schemas
+  -> authenticated daemon HTTP interface
+  -> Web Provider API implementation
+  -> Playwright and visible provider website
+```
+
+The harness package must not import from provider adapters, Playwright, daemon job-store implementation, profile management, DOM locators, or CLI command modules. The Web Provider API implementation must not import harness prompt, MCP, skill, approval, or loop modules.
+
+The provider-turn client is an adapter over the durable daemon interface, not a wrapper that exposes internal classes. Opaque provider job, workspace, conversation, and evidence identifiers cross the seam; database handles, tables, browser objects, and internal state-machine values do not.
+
+The harness owns its AgentRun persistence schema and migrations behind its own module. It may initially be hosted in the same installation or process topology, but the Web Provider implementation never reads harness tables and the harness never reads provider tables. Correlation happens through public opaque identifiers.
+
+### Web-Harness Specificity
+
+This is not a generic model-API harness with a Web Provider adapter added afterward. Its loop is designed around the actual Web Provider interface:
+
+- model output arrives as a complete visible webpage response rather than a native function-call event stream;
+- skills and the MCP calling contract must be injected through proven Project instructions, files, or a visible conversation bootstrap;
+- the current tool catalog and per-turn nonce must fit provider message and file limits;
+- MCP tool requests must be parsed from the visible response protocol;
+- tool results must be returned as the next message in the exact same provider conversation;
+- Projects, attachments, citations, provider blockers, slow turns, and conversation recovery remain part of the loop; and
+- each provider becomes harness-capable only after its complete real website loop is proven.
+
+The harness is therefore Web-Provider-aware but DOM-agnostic. It understands Web Provider semantics and limitations while all selectors, clicks, browser profiles, and provider-specific visible operations remain below the Web Provider interface.
+
+### Extractability Tests
+
+The package shape is correct when all of these deletion and replacement checks hold:
+
+- deleting the harness package leaves current CLI and daemon provider jobs working;
+- running the Web Provider API project without the harness does not load MCP clients, skills, or agent-loop state;
+- changing Playwright or provider-adapter implementation behind the Web Provider interface does not change harness code;
+- moving the harness package to another repository requires dependency and release wiring, not source reorganization; and
+- provider and harness release versions can advance independently under explicit protocol compatibility rules.
+
+## Layer 1: Web Provider API
+
+The existing provider architecture becomes a deep model-turn module. Its interface exposes provider outcomes rather than general browser automation.
+
+All currently exposed operations belong to this layer: they are structured wrappers around supported, real-E2E-verified web workflows. P1 may expose those operations through MCP and bind them to an external session, but that still does not make P1 an Agent Harness.
+
+The provider runtime owns:
+
+- resolving the exact provider, managed profile, native Project or conversation workspace, and conversation;
+- visibly creating, selecting, and verifying Projects and conversations;
+- delivering approved instructions and files through provider-supported visible controls;
+- applying provider-owned model, effort, mode, and attachment strategies;
+- submitting one correlated message and waiting for one complete response;
+- reading bounded response text, citations, artifacts, and visible completion evidence;
+- continuing the exact conversation on the next harness turn; and
+- classifying authentication, CAPTCHA, plan, availability, navigation, and selector blockers.
+
+The conceptual external interface stays small and preserves the provider runtime's asynchronous job semantics:
+
+```ts
+type ProviderTurnRequest = {
+  route: CapabilityRoute
+  workspace: ProviderWorkspaceRef
+  conversation: ProviderConversationIntent
+  instructions: InstructionDeliveryPlan
+  message: AgentMessage
+  attachments: ContextArtifactRef[]
+  correlation: TurnCorrelation
+}
+
+type ProviderTurnRef = {
+  jobId: string
+}
+
+type ProviderTurnState =
+  | { status: 'queued' | 'running' | 'waiting_for_user' }
+  | { status: 'succeeded'; result: VisibleProviderResponse }
+  | { status: 'failed' | 'cancelled'; error: ProviderTurnError }
+
+interface ProviderTurnClient {
+  submit(request: ProviderTurnRequest): Promise<ProviderTurnRef>
+  read(ref: ProviderTurnRef): Promise<ProviderTurnState>
+  resume(ref: ProviderTurnRef): Promise<ProviderTurnState>
+  cancel(ref: ProviderTurnRef): Promise<ProviderTurnState>
+}
+```
+
+This is a design target, not a commitment to those exact TypeScript names. The important constraint is that callers ask for one verified provider turn and do not orchestrate individual clicks.
+
+Raw visible actions remain internal interfaces used by provider adapters. They are not part of the public Web Provider interface, are not MCP tools, and are not made available to the web model.
+
+The provider runtime does not own:
+
+- agent instructions or skill precedence;
+- tool discovery, schema projection, or tool-call parsing;
+- approval, filesystem, network, or side-effect policy;
+- MCP server processes, credentials, or protocol sessions;
+- loop termination, turn budgets, or final agent-run semantics; or
+- automatic application of provider-generated artifacts to the local project.
+
+## Layer 2: Web Agent Harness
+
+The harness is a deep module at the caller-to-model seam. Its external interface accepts one `AgentRunSpec` and returns a durable run handle or terminal `AgentRunResult`.
+
+An `AgentRunSpec` contains:
+
+- the user goal and optional structured output requirement;
+- an exact caller/session/project binding when available;
+- a Context Envelope and selected attachments;
+- activated instruction and skill revisions;
+- an explicit tool-set reference, not an ambient global tool dump;
+- approval policy and local resource scopes;
+- provider/profile constraints and required provider capabilities; and
+- hard limits for turns, tool calls, wall time, input and output bytes, and parallelism.
+
+The harness implementation owns:
+
+- compiling instruction layers with explicit precedence and provenance;
+- freezing a bounded tool-catalog snapshot for the run;
+- creating a fresh provider conversation for each new run;
+- driving provider turns through the provider runtime interface;
+- parsing and validating the visible control protocol;
+- authorizing and dispatching tool calls;
+- delimiting, truncating, storing, and returning tool results;
+- persisting checkpoints before every external mutation;
+- stopping on final, denial, limit, cancellation, ambiguity, or unrecoverable failure; and
+- returning final text, artifacts, citations, provider identity, and a bounded audit trail without private reasoning.
+
+The harness does not know provider selectors, daemon internals, or MCP transport internals. It depends on the provider-turn client and tool-runtime interfaces.
+
+## Provider Eligibility for Agent Runs
+
+Normal chat support does not imply agent-harness support. The runtime catalog should distinguish at least:
+
+| Level | Minimum proven behavior |
+| --- | --- |
+| `qa` | Submit one prompt and return one correlated complete response |
+| `continuable` | Reopen and continue the exact durable conversation without identity ambiguity |
+| `harness_agent` | Deliver the required instruction fidelity, follow the control protocol, complete tool-result round trips, and reach a bounded final result through real browser E2E |
+
+An `agent.run` route requires every capability needed by that run, including normal chat, exact continuation, the selected instruction-delivery mode, attachments or native workspace when requested, and a real-E2E-closed harness protocol route.
+
+ChatGPT is the only initial `harness_agent` candidate. Claude, Gemini, Grok, Qwen, DeepSeek, and future providers remain `qa` or `continuable` until the same real-boundary criteria close independently. Similar UI labels or one successful demonstration do not establish parity.
+
+Once the first provider turn mutates a conversation, the run is pinned to that provider, profile, workspace, conversation, instruction revision, and tool-catalog revision. Mid-run provider fallback is not allowed because model state, tool decisions, and prior mutations are not portable.
+
+## Instruction Delivery, Not Hidden Prompt Injection
+
+Tokenless must not claim a native `system` role when a provider website does not expose one. It records the actual visible delivery method:
+
+| Fidelity | Meaning |
+| --- | --- |
+| `project_instruction` | Versioned harness instructions are installed in a Tokenless-owned Project or merged into another Project with explicit approval and visible verification |
+| `conversation_bootstrap` | Instructions are delivered as a visible first conversation message and verified through the resulting conversation |
+| `unsupported` | The required instruction semantics cannot be delivered or verified safely |
+
+Project instructions are preferred for the stable harness contract when the exact Project is Tokenless-owned or the user explicitly approved the update. Tokenless never overwrites unrelated user instructions. Dynamic task context, tool schemas, run nonce, and limits belong in the fresh conversation bootstrap so Project instructions do not churn on every run.
+
+Instruction compilation uses this precedence:
+
+1. immutable Tokenless safety and control-protocol contract;
+2. explicit user and organization policy;
+3. activated skill instructions;
+4. tool catalog and per-tool usage guidance;
+5. task goal and Context Envelope; and
+6. prior tool results, which are always marked as untrusted data.
+
+Lower layers cannot grant permissions, add tools, or rewrite higher-layer policy. Instructions are source-attributed and content-addressed. A run stores the exact instruction revision that was visibly delivered.
+
+## Visible Web-Agent Control Protocol
+
+Tokenless's visible-site interface does not receive the native function-call events available through model APIs, and it does not inspect private provider traffic to obtain them. V1 therefore uses one explicit visible text protocol. Every complete model response must contain exactly one envelope of one of these kinds:
+
+- `tool_calls`: one or more requested calls; or
+- `final`: the final Markdown result and declared artifacts.
+
+The conceptual envelope is:
+
+```json
+{
+  "protocol": "tokenless.web-agent/v1",
+  "kind": "tool_calls",
+  "runId": "run_opaque",
+  "turn": 2,
+  "nonce": "per_turn_opaque_nonce",
+  "calls": [
+    {
+      "id": "call_opaque",
+      "tool": "mcp.filesystem.read_text_file",
+      "arguments": {
+        "path": "README.md"
+      }
+    }
+  ]
+}
+```
+
+The actual framing must be unambiguous in rendered page text and survive provider Markdown rendering. The parser accepts only the declared protocol version, current run and turn, current nonce, unique call ids, registered tool names, and arguments valid against the frozen JSON Schema.
+
+The nonce detects stale or replayed envelopes; it is not authorization. Valid model output is still untrusted input.
+
+Malformed output receives at most one bounded protocol-repair turn containing validation errors but no new authority. A second malformed response fails the run. Unknown tools, invalid arguments, denied calls, and tool execution errors return structured results to the model so it may recover within the remaining turn budget.
+
+Tool results use the same versioned framing and preserve the original call ids. Large or binary results are stored as local artifacts and represented by bounded metadata or approved excerpts. Tool output is delimited as untrusted data and cannot modify the tool catalog, instruction precedence, or authorization policy.
+
+## Durable Agent Loop
+
+```mermaid
+stateDiagram-v2
+  [*] --> preparing
+  preparing --> awaiting_provider
+  awaiting_provider --> validating_response
+  validating_response --> awaiting_approval: authorized decision required
+  validating_response --> executing_tools: calls allowed by policy
+  validating_response --> succeeded: valid final envelope
+  validating_response --> repairing_protocol: invalid envelope
+  repairing_protocol --> awaiting_provider
+  awaiting_approval --> executing_tools: approved
+  awaiting_approval --> returning_results: denied
+  executing_tools --> returning_results
+  returning_results --> awaiting_provider
+  preparing --> waiting_for_user: provider or setup blocker
+  awaiting_provider --> waiting_for_user: auth, CAPTCHA, consent, or ambiguity
+  executing_tools --> waiting_for_user: elicitation or ambiguous mutation
+  waiting_for_user --> preparing: explicitly resumed
+  preparing --> failed
+  validating_response --> failed
+  executing_tools --> failed
+  awaiting_provider --> cancelled
+  awaiting_approval --> cancelled
+  executing_tools --> cancelled
+  succeeded --> [*]
+  failed --> [*]
+  cancelled --> [*]
+```
+
+Hard limits are correctness controls, not optional tuning. V1 has finite defaults for provider turns, total tool calls, calls per turn, tool-result bytes, wall time, and approval wait. Repeating the same invalid or denied call consumes the budget and eventually terminates clearly.
+
+Read-only calls in one model response may execute concurrently only when their locally verified policy and resource scopes do not conflict. Mutating calls execute serially by default. The model cannot increase concurrency.
+
+## Tool Runtime
+
+The tool runtime is a separate deep module with at least two real adapters: MCP tools and registered local tools. Its interface accepts an already parsed call plus authorization context and returns a bounded `ToolOutcome`.
+
+Every tool descriptor records:
+
+- a stable, collision-free canonical name;
+- source kind and exact server or local adapter identity;
+- input and optional output JSON Schemas;
+- locally assigned read/write, network, destructive, and credential effects;
+- allowed filesystem roots, network destinations, or resource scopes;
+- timeout, result-size, and concurrency limits;
+- idempotency, resumability, and cancellation behavior; and
+- provenance for descriptions and annotations.
+
+Tool descriptions help the model choose a tool. They do not grant authority. MCP annotations are treated as untrusted unless local configuration explicitly trusts that server and independently constrains the tool.
+
+### MCP Directionality
+
+Tokenless participates in MCP in two different directions:
+
+| Direction | Tokenless role | Owner |
+| --- | --- | --- |
+| Northbound | MCP server exposing `tokenless_run`, job reads, resume, and cancel to Codex or another caller | [Agent Session Integrations](P1-agent-session-integrations.md) |
+| Southbound | MCP host/client discovering and calling tools requested by the web model | This roadmap |
+
+The two directions share durable run identity and policy types but not transport sessions, credentials, tools, or approval decisions. A northbound caller invoking Tokenless never becomes trusted to approve arbitrary southbound actions implicitly.
+
+### Southbound MCP V1
+
+V1 supports explicitly configured local `stdio` servers through the official MCP TypeScript SDK v2, with an explicit legacy, pinned modern `2026-07-28`, or opt-in auto-negotiation mode:
+
+- Tokenless launches each server with a minimal allowlisted environment and an explicit working directory;
+- each server receives one isolated MCP client and transport binding;
+- modern discovery or the configured legacy initialization and capability negotiation must complete before its tools enter the catalog;
+- `tools/list` is snapshotted and namespaced by a stable local server alias;
+- `tools/call` arguments and structured results are schema-validated and size-bounded;
+- server stderr is bounded diagnostic data and never becomes model context automatically;
+- roots and other client capabilities expose only explicitly approved resources;
+- server-initiated sampling is disabled in V1 to prevent a recursive model loop; and
+- elicitation becomes `waiting_for_user`; the web model never supplies credentials or sensitive answers on the user's behalf.
+
+MCP prompts and resources are not automatically exposed as tools. A later phase may map selected resources into the Context Envelope and selected prompts into skill instructions with explicit provenance.
+
+Remote Streamable HTTP is deferred until Tokenless has a concrete remote-server use case and can implement the current MCP authorization requirements, OAuth discovery, PKCE, resource/audience binding, secure token storage, consent, and origin protections without leaking credentials to the provider page.
+
+### Registered Local Tools
+
+Local tools use the same `ToolDescriptor`, authorization, execution, and result contracts as MCP tools. They are typed adapters over a narrow operation, not arbitrary shell text returned by the model.
+
+Each local tool must declare exact resource scopes and side effects. Filesystem operations are rooted and symlink-safe. Process and network tools require explicit allowlists. V1 does not provide a generic unrestricted shell tool.
+
+### Skills
+
+A skill is an instruction package, not an executable authority. Activating a skill may:
+
+- add versioned instructions and examples to the instruction compiler;
+- request named tools already present in the configured tool registry;
+- narrow recommended usage or default limits; and
+- contribute output validation or artifact-handling guidance.
+
+A skill cannot launch a process, add an MCP server, widen a filesystem root, approve a tool call, or bypass a higher-priority policy merely by being installed or mentioned. Missing required tools fail skill activation with a repair instruction.
+
+## Authorization and Containment
+
+Tool arguments are proposed by an untrusted web model, even when the user trusts the provider and MCP server.
+
+Authorization is evaluated inside Tokenless immediately before execution against the frozen run policy and the current resource state:
+
+- read-only, locally scoped calls may be pre-authorized by explicit policy;
+- local writes, network mutations, external messages, purchases, credential flows, destructive operations, and scope expansion require explicit approval unless a prior reviewed rule covers that exact operation;
+- approvals bind the run id, call id, tool identity, argument digest, target scope, and expiry;
+- any argument change invalidates the approval;
+- denial is returned to the model as a normal structured tool result;
+- headless operation never converts missing approval into approval; and
+- server or model descriptions, annotations, and claims cannot downgrade the locally assigned risk.
+
+The local web control plane should display pending calls, exact targets, redacted sensitive fields, why approval is required, the requesting provider conversation, and the effect of allow-once, deny, or cancel. CLI and northbound MCP callers may observe and resolve approvals through the same durable application contract.
+
+Tokenless never requests, reads, logs, or sends browser credentials, cookies, storage secrets, Keychain items, MCP OAuth tokens, or the daemon bearer token to the web model. MCP authentication occurs out of band through user-controlled flows.
+
+## Durability, Idempotency, and Recovery
+
+One durable `AgentRun` owns ordered child records:
+
+- `AgentTurn` for each provider request and correlated response;
+- `InstructionRevision` and `ToolCatalogRevision` frozen for the run;
+- `ToolCall` for the model proposal and validation outcome;
+- `ApprovalDecision` bound to the exact call digest;
+- `ToolExecution` for dispatch, completion, error, or ambiguity; and
+- final artifacts, citations, provider identity, and completion evidence.
+
+Persist intent before every provider or tool mutation. A tool call id is unique within a run and cannot produce a second execution record accidentally.
+
+Recovery follows explicit evidence:
+
+- a read-only call may be repeated only when its locally declared semantics and observed state make that safe;
+- a mutating call with proven non-dispatch may be retried;
+- a mutating call with ambiguous dispatch waits for user resolution and is never replayed automatically;
+- a completed tool result may be returned to the same provider conversation again only when the prior visible submission is proven absent;
+- an ambiguous provider submission uses the existing at-most-once replay policy; and
+- resume reuses the same provider conversation, instruction revision, catalog revision, and limits.
+
+Cancellation stops future turns and requests MCP cancellation where supported. It does not claim to reverse an external side effect or guarantee that a server lacking cancellation stopped its work.
+
+## Delivery Phases
+
+### Phase 0: Seams, Contracts, and Package Skeleton
+
+- Define `AgentRunSpec`, `AgentRun`, `AgentTurn`, `ProviderTurnRequest`, `ProviderTurnRef`, `ProviderTurnState`, `ProviderTurnClient`, `InstructionDeliveryPlan`, `ToolDescriptor`, `ToolCall`, `ToolOutcome`, and approval-policy schemas.
+- Keep visible browser actions behind provider adapters and expose one provider-turn interface to the harness.
+- Add an independently buildable harness workspace package with no imports from provider, Playwright, daemon-storage, profile, DOM, or CLI implementation modules.
+- Add a provider-turn client adapter over the authenticated durable daemon interface and version the wire schemas it consumes.
+- Give the harness ownership of its AgentRun state and migrations; correlate provider jobs only through opaque public identifiers.
+- Define `qa`, `continuable`, and `harness_agent` evidence without enabling a route from product reconnaissance alone.
+- Define parent/child durable identity, limits, checkpoints, and failure codes.
+- Document northbound and southbound MCP directionality in public diagnostics.
+
+Exit: the built CLI can execute today's normal ChatGPT QA flow through the provider-turn interface with unchanged visible behavior; removing the harness package leaves that flow intact; and the independently built harness can persist a no-tool AgentRun using only the provider-turn client.
+
+### Phase 1: ChatGPT Instruction and Control Protocol
+
+- Create or resolve an exact ChatGPT Project and a fresh conversation per run.
+- Add explicit Project-instruction merge, preview, revision, and rollback behavior without overwriting unrelated instructions.
+- Implement the versioned visible response envelope, per-turn nonce, strict parser, final result, and one bounded repair turn.
+- Freeze and report instruction and Context Envelope revisions.
+- Prove exact continuation in the same conversation.
+
+Exit: real ChatGPT returns a schema-valid final envelope and can complete a two-turn protocol repair through the built CLI, packaged daemon, managed profile, and visible website.
+
+### Phase 2: Southbound MCP V1 and Approval
+
+- Implement the MCP host/client module for configured local `stdio` servers.
+- Negotiate capabilities, snapshot and namespace tool schemas, and expose only the selected bounded tool set to ChatGPT.
+- Add locally assigned effects, scopes, limits, allow, deny, and approval-wait behavior.
+- Execute schema-valid calls, preserve call ids, and return bounded structured results to the same ChatGPT conversation.
+- Disable server sampling and surface elicitation as user input required.
+
+Exit: ChatGPT requests a real read-only MCP filesystem operation inside an approved root, receives the real result, and produces a correlated final answer; a real mutating tool pauses before execution and proceeds only after exact approval.
+
+### Phase 3: Durable Loop, Failure, and Recovery
+
+- Persist every turn, call, approval, execution, result, and evidence transition.
+- Enforce turn, call, byte, wall-time, and concurrency limits.
+- Handle unknown tools, invalid arguments, denial, timeout, server failure, provider blocker, cancellation, and ambiguous mutation.
+- Resume the same run and conversation after daemon, runner, browser, or MCP process restart when evidence makes continuation safe.
+- Return structured state through CLI, daemon, local control plane, and the northbound MCP adapter.
+
+Exit: focused real-process restart checks prove no duplicate provider submission or tool mutation, and every ambiguous external mutation stops for user resolution.
+
+### Phase 4: Registered Local Tools and Skills
+
+- Add the local tool adapter with the same schemas, policy, audit, and result contracts as MCP.
+- Support explicitly activated, content-addressed skill instruction bundles.
+- Validate skill-required tool references before provider mutation.
+- Keep arbitrary shell execution, implicit process launch, and permission widening out of the skill interface.
+- Add artifact references for large local and MCP outputs.
+
+Exit: one ChatGPT run uses both an MCP tool and a registered local tool under one policy, while an activated skill changes instructions without changing executable authority.
+
+### Phase 5: Caller Integrations and Approval UX
+
+- Add `agent.run` to the canonical caller capability catalog only after the ChatGPT route is E2E-closed.
+- Expose agent-run creation, state, pending approvals, resume, cancel, final result, and audit summary through the CLI and northbound local MCP server.
+- Add approval and recovery surfaces to the local web control plane without exposing the daemon bearer token to browser JavaScript.
+- Bind Codex and later callers through exact `AgentSessionBinding` records from the related roadmap.
+
+Exit: a Codex session can explicitly start a Tokenless web-agent run, resolve a pending tool approval, and receive the final result in the same originating session without gaining direct browser or southbound MCP authority.
+
+### Phase 6: Additional Providers and Remote MCP
+
+- Evaluate each provider independently for instruction fidelity, exact continuation, protocol adherence, and bounded real tool loops.
+- Add provider routes only after real browser E2E closes all required outcomes.
+- Add authenticated Streamable HTTP MCP only with complete authorization, consent, token handling, and transport-security behavior.
+- Add selected MCP resources, prompts, tasks, or tool-search behavior only after their semantics fit the same policy and durability model.
+
+Exit: a second provider or remote MCP transport satisfies the same interface and evidence contracts without ChatGPT, transport, or provider fields leaking into the harness interface.
+
+## Real-Boundary Verification
+
+All support and release claims use the built CLI, packaged TypeScript daemon, real SQLite state, managed browser, explicitly selected setup-managed profile, real ChatGPT website, provider network, and real MCP server processes.
+
+The initial acceptance flow must prove:
+
+- visible instruction installation or conversation bootstrap with exact revision evidence;
+- fresh conversation creation and exact continuation;
+- a schema-valid read-only tool request, real MCP execution, result return, and final answer that uses a unique canary from the tool result;
+- a mutating tool request that cannot execute before exact approval;
+- denial, invalid arguments, unknown tool, timeout, and bounded protocol repair;
+- prompt-injection text inside tool output cannot widen policy or execute an unapproved tool;
+- daemon and MCP process restart does not duplicate a provider submission or tool mutation;
+- final text, artifacts, citations, conversation identity, calls, approvals, and execution outcomes are durably correlated; and
+- the profile test target retains keychain-neutral flags, production Chromium sandboxing remains enabled, processes are cleaned up, and no Keychain prompt appears.
+
+No provider fixtures, route interception, simulated responses, invented DOM, fake runtime, synthetic fetch, or source-regex test can close `harness_agent` support. Redacted real DOM fixtures may still support focused selector or parser maintenance under the repository fixture policy, but they are not agent-loop acceptance evidence.
+
+Real E2E does not automate login, CAPTCHA, MFA, consent, or Keychain approval and does not collect screenshots, full DOM, storage, credentials, or unrelated account content.
+
+## Acceptance Criteria
+
+- The harness and provider runtime communicate only through the provider-turn interface; harness code contains no provider selectors or page operations.
+- The harness is an independently buildable workspace package and imports no provider adapter, Playwright, daemon storage, profile, DOM, or CLI implementation module.
+- Provider Integration and Harness own separate persistence schemas and correlate only through versioned public identifiers.
+- Removing the harness package leaves all normal provider CLI, daemon, and browser execution behavior working.
+- Extracting the harness to another repository requires no provider source move and no harness source reorganization.
+- The provider runtime can still execute a normal one-turn QA job without loading MCP or agent-harness modules.
+- ChatGPT is the only initial `harness_agent` route, and its support is backed by a complete real visible tool loop.
+- Every new agent run uses a fresh conversation and freezes exact instruction, context, tool-catalog, provider, profile, workspace, and limit revisions.
+- Project instructions are changed only in a Tokenless-owned Project or after explicit preview and approval; unrelated instructions are never overwritten.
+- Visible instruction delivery is reported honestly and is never mislabeled as a native system role.
+- Every model response is validated against one versioned control envelope before any tool action.
+- Tool names and arguments must match the frozen schema snapshot; parser success never implies authorization.
+- MCP annotations and model claims never override locally assigned effects or approval policy.
+- V1 launches only explicitly configured local `stdio` MCP servers with bounded environment, roots, processes, logs, and results.
+- Skills contribute instructions and tool requirements but cannot execute or authorize operations.
+- No mutating call executes without a matching explicit policy rule or exact approval digest.
+- Every provider and tool mutation has durable pre-dispatch intent and unambiguous completion or waiting state.
+- Ambiguous external mutations are never retried automatically.
+- Turn, call, time, byte, and parallelism limits prevent infinite or unbounded loops.
+- Mid-run provider fallback, arbitrary shell execution, secret delivery, and implicit approval are absent from V1.
+- Final results contain bounded user-facing output and evidence, not hidden chain-of-thought or unrelated provider content.
+
+## Risks and Responses
+
+| Risk | Response |
+| --- | --- |
+| A provider follows the control protocol inconsistently | Provider-specific real E2E, strict validation, one repair turn, finite limits, and honest `qa` fallback |
+| Visible instructions are weaker than a native system role | Record fidelity, prefer approved Project instructions, enforce safety in the local runtime, and never claim semantic parity |
+| Tool output injects instructions into the model | Delimit it as untrusted data and make local policy authoritative even if the next model turn is compromised |
+| The model invents a tool or malformed arguments | Frozen schema snapshot, strict validation, structured error result, and bounded recovery |
+| MCP tool annotations understate side effects | Treat annotations as hints and assign effects and scopes through reviewed local policy |
+| A crash duplicates an external mutation | Persist intent first, use call ids and evidence, and stop on ambiguous dispatch |
+| Tool catalogs are too large for a web prompt | Require an explicit selected tool set and byte budget; add tool search only after V1 evidence |
+| Project instructions collide with user content | Use Tokenless-owned Projects by default and require previewed merge or conversation bootstrap elsewhere |
+| Provider state changes during a long loop | Pin exact identity, re-check visible preconditions each turn, and wait rather than switch providers |
+| A local MCP server receives excessive ambient authority | Explicit configuration, minimal environment, scoped roots, bounded processes, and per-call policy |
+| Remote MCP leaks or misuses credentials | Defer it until full authorization and secure token lifecycle support exists; never pass credentials through the web model |
+| Skills become an authority bypass | Keep skills instruction-only and resolve every executable action through the same tool registry and policy |
+
+## Non-Goals
+
+- Exposing general browser RPA, selectors, raw DOM, or low-level provider actions to the web model
+- Depending on provider private APIs, hidden function-call events, response streaming, or network interception
+- Claiming that a visible user or Project instruction is a native system message
+- Extracting or cloning provider, caller, or agent hidden prompts or private reasoning
+- Letting ChatGPT approve its own tool calls or answer MCP credential prompts
+- Automating login, CAPTCHA, MFA, Keychain approval, purchases, or external consent
+- Providing unrestricted shell execution or converting arbitrary generated text into a command
+- Treating installed skills as trusted executable code or ambient permission
+- Multi-agent handoffs, delegation, autonomous planning graphs, or cross-provider continuation in V1
+- Automatically applying generated code, patches, messages, or destructive changes without the applicable local review and approval
+- Advertising Claude, Gemini, Grok, Qwen, DeepSeek, or another provider as agent-harness capable before its independent real-browser loop closes
+- Splitting repositories or publishing the harness package before the provider-turn interface and first real agent loop are stable
+- Assuming ownership of an npm scope, package name, organization, or other external namespace for the future extracted project
+
+## Primary References
+
+- [OpenAI Agents SDK runner lifecycle and tool loop](https://openai.github.io/openai-agents-js/guides/running-agents/)
+- [ChatGPT Projects, files, and Project instructions](https://help.openai.com/en/articles/10169521-using-projects-in-chatgpt)
+- [MCP versioning and modern/legacy compatibility](https://modelcontextprotocol.io/specification/2026-07-28/basic/versioning)
+- [MCP tools, schemas, results, annotations, and trust guidance](https://modelcontextprotocol.io/specification/2026-07-28/server/tools)
+- [MCP stdio and Streamable HTTP transports](https://modelcontextprotocol.io/specification/2026-07-28/basic/transports)
+- [MCP elicitation and input-required behavior](https://modelcontextprotocol.io/specification/2026-07-28/client/elicitation)
+- [MCP security best practices](https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices)
diff --git a/docs/roadmaps/P0-windows-amd64-cloak-setup-acceptance-test-plan.md b/docs/roadmaps/P0-windows-amd64-cloak-setup-acceptance-test-plan.md
new file mode 100644
index 0000000..d5b2daa
--- /dev/null
+++ b/docs/roadmaps/P0-windows-amd64-cloak-setup-acceptance-test-plan.md
@@ -0,0 +1,188 @@
+# Windows AMD64 Cloak Setup Acceptance Test Plan
+
+Status: ready for execution | Priority: P0 | Last reviewed: 2026-08-01
+
+Type: active real-boundary test plan
+
+Tracks: [Browser Runtime Selection and Cloak Integration](P0-browser-runtime-selection-and-cloak.md)
+
+## Objective
+
+Prove the complete Anti-Detect setup path on a clean Windows AMD x86-64 system using the built Tokenless CLI, the official locked CloakBrowser artifact, real browser profile roots, the real filesystem, and real browser processes.
+
+This plan verifies setup behavior and records release evidence. It does not add browser support, import a source browser profile, automate browser login, or claim CAPTCHA bypass. The implementation is complete enough to begin this plan, but Windows support remains unaccepted until the exit criteria below pass.
+
+## Supported Test Baseline
+
+| Item | Locked expectation |
+| --- | --- |
+| Operating system | Current supported Windows 10 or Windows 11 x64 |
+| CPU coverage | AMD x86-64 (`AMD64` hardware, Node `x64`) |
+| Tokenless Cloak artifact | `146.0.7680.177.5` |
+| Cloak Chromium version | `146.0.7680.177` |
+| Cloak source | [Official CloakBrowser release](https://github.com/CloakHQ/CloakBrowser/releases/tag/chromium-v146.0.7680.177.5) |
+| Tokenless delivery | User-approved setup download into the private Tokenless cache; never bundled in Tokenless artifacts |
+| Playwright role | Existing browser-control layer using the exact resolved Cloak executable |
+
+This plan is deliberately AMD-only. AMD64 is the 64-bit x86 architecture and resolves to the Tokenless `win32-x64` catalog entry. Windows ARM64, 32-bit Windows x86, and independent Intel-hardware certification are outside this test plan.
+
+## Source Browser Matrix
+
+Each version case uses a blank source browser profile and a fresh Tokenless home. The 145 and 150 cases are deliberate negative alignment tests against Windows Cloak Chromium `146.0.7680.177`.
+
+| Case | Source browser | Product version | Underlying Chromium | Expected setup classification |
+| --- | --- | --- | --- | --- |
+| `WIN-CLOAK-CHROME-150` | Google Chrome | A real `150.0.7871.x` build | `150.0.7871.x` | `not version-aligned` |
+| `WIN-CLOAK-CHROME-145` | Google Chrome | Prefer `145.0.7632.160` | `145.0.7632.160` | `not version-aligned` |
+| `WIN-CLOAK-BRAVE-150` | Brave | [`1.92.144`](https://github.com/brave/brave-browser/releases/tag/v1.92.144) | `150.0.7871.186` | `not version-aligned` |
+| `WIN-CLOAK-BRAVE-145` | Brave | [`1.87.192`](https://github.com/brave/brave-browser/releases/tag/v1.87.192) | `145.0.7632.160` | `not version-aligned` |
+| `WIN-CLOAK-ARC-150` | Arc | `1.116.0` | `150.0.7871.182` | `not version-aligned` |
+| `WIN-CLOAK-ARC-145` | Arc | `1.96.0` | `145.0.7632.160` | `not version-aligned` |
+| `WIN-CLOAK-EXACT-146` | Chrome or Chromium | Exact build | `146.0.7680.177` | `version-aligned (reference only)` |
+| `WIN-CLOAK-PATCH-MISMATCH` | Arc | `1.100.0` | `146.0.7680.178` | `not version-aligned` |
+
+Arc mappings come from the [official Arc for Windows release notes](https://resources.arc.net/hc/en-us/articles/22513842649623-Arc-for-Windows-2023-2026-Release-Notes). Arc `1.94.1`, `1.95.0`, and `1.96.0` cover Chromium 145 patch levels `.76`, `.117`, and `.160`; Arc `1.114.0`, `1.115.0`, and `1.116.0` cover Chromium 150 patch levels `.115`, `.125`, and `.182`.
+
+## Safety and Isolation Rules
+
+- Use a blank, non-authenticated source browser profile. Do not test browser downgrades against a real signed-in profile.
+- Close the source browser before inventory and setup so its root metadata is stable.
+- Use a unique, initially absent `--home` directory for every case.
+- Never inspect, export, copy, log, or compare cookies, tokens, passwords, browser storage, Keychain-equivalent state, account details, or source profile contents.
+- Record only the browser identity, user-data root, `Default` or `Profile N` directory key, safe root-level `Last Version`, Tokenless result codes, managed-runtime metadata, and process outcome.
+- Never download archived browsers from an untrusted third-party source. If an official old Windows build is unavailable, mark the version case blocked and use an existing official installation or a clean VM snapshot.
+- Setup must leave every source browser profile untouched and must create a separate clean Cloak-bound managed profile.
+
+## Standard Windows Roots
+
+Interactive setup scans these standard roots:
+
+| Browser | Root |
+| --- | --- |
+| Chrome | `%LOCALAPPDATA%\Google\Chrome\User Data` |
+| Brave | `%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data` |
+| Arc package | `%LOCALAPPDATA%\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data` |
+| Arc standalone | `%LOCALAPPDATA%\TheBrowserCompany\Arc\User Data` |
+
+Only `Default` and `Profile N` directories are candidates. Setup reads the root-level `Last Version` file and does not parse `Local State`, `Preferences`, or any profile storage.
+
+## Clean Execution Procedure
+
+Run from a clean checkout in PowerShell:
+
+```powershell
+npm install
+npm run build
+
+$TokenlessCli = (Resolve-Path ".\packages\cli\dist\src\tokenless.mjs").Path
+$CaseHome = "$env:LOCALAPPDATA\Tokenless-Test\WIN-CLOAK-CHROME-150"
+
+node $TokenlessCli profiles discover --browser all --json
+node $TokenlessCli setup --home $CaseHome --fresh
+node $TokenlessCli doctor --home $CaseHome --json
+```
+
+Change `$CaseHome` to the case ID for every run. Never reuse a Tokenless home across cases.
+
+For a diagnostic custom browser root, use one explicit browser:
+
+```powershell
+node $TokenlessCli profiles discover --browser chrome --browser-user-data-dir "C:\Browser-Test\Chrome150" --json
+```
+
+Custom-root discovery does not make that root part of interactive setup. Release acceptance must exercise the applicable standard root.
+
+## Interactive Expectations
+
+For each case:
+
+1. Setup asks whether to use Anti-Detect mode. Select `Yes`.
+2. The Anti-Detect question states that accepting will download and install the verified platform-pinned CloakBrowser under `TOKENLESS_HOME` when needed; no later installation confirmation appears.
+3. Setup identifies and links to CloakBrowser and reports artifact `146.0.7680.177.5` with Chromium `146.0.7680.177`.
+4. Setup lists every safely discovered profile candidate with `aligned`, `not_aligned`, or `unknown` compatibility.
+5. If aligned candidates exist, one choice offers `Start clean` and only the aligned profile sources. Selecting a profile explicitly authorizes its opaque copy; there are no separate import or copy-consent questions. If none align, setup uses a clean profile without asking.
+6. Setup downloads the official artifact when absent, verifies SHA-256, safely extracts it, verifies the executable-reported version, commits the private cache atomically, and creates a managed profile bound to the exact Cloak runtime.
+7. A selected source profile is version-checked again at the copy boundary and copied only as an opaque filesystem tree without inspecting authentication values.
+8. Setup continues to provider selection and visible sign-in review.
+9. `doctor --json` reports the exact verified runtime, expected and actual versions, cache/checksum state, and profile runtime binding.
+
+Equivalent English and Simplified Chinese prompt text is acceptable; the meaning and decisions must be identical.
+
+## Per-Case Assertions
+
+Every matrix case must prove:
+
+- the expected standard root is found;
+- only safe directory/version metadata is returned;
+- every source profile under one root receives that root's safe version result;
+- the expected exact compatibility classification is returned;
+- no candidate is offered as an importable authentication profile;
+- declining the second confirmation causes no managed-runtime or profile mutation;
+- accepting it creates a separate clean Cloak-bound profile;
+- the source browser root is not opened with Cloak and is not copied;
+- the setup-selected executable is the verified cached `146.0.7680.177.5` artifact rather than a system Chromium;
+- the managed Chromium sandbox remains enabled and all Tokenless-owned processes clean up normally.
+
+The first cache-miss run must prove the download path. At least one later case must reuse the verified cache with `--no-browser-download`, and one deliberate missing-cache run with that flag must fail with `browser_runtime_download_required`.
+
+## AMD64 Hardware Run
+
+- [ ] Build and package boundaries complete on a clean Windows AMD x86-64 host.
+- [ ] Official Cloak download, checksum, extraction, version verification, cache commit, clean profile binding, launch, doctor, and cleanup pass.
+- [ ] At least Chrome 150, one Brave case, one Arc case, exact 146, and patch-mismatch classifications pass.
+
+### Complete Version Matrix
+
+- [ ] Chrome 150 is non-aligned.
+- [ ] Chrome 145 is non-aligned.
+- [ ] Brave 150 is non-aligned.
+- [ ] Brave 145 is non-aligned.
+- [ ] Arc 150 is non-aligned.
+- [ ] Arc 145 is non-aligned.
+- [ ] Exact Chromium `146.0.7680.177` is aligned for reference only.
+- [ ] Arc Chromium `146.0.7680.178` is non-aligned.
+- [ ] Decline, cache-miss download, verified-cache reuse, and downloads-disabled failure paths pass.
+- [ ] Source profile roots remain unimported and unmodified by Tokenless.
+
+## Known Limitations to Observe
+
+### One version per user-data root
+
+Chrome-family profiles do not carry independent browser versions for this flow. One user-data root has one root-level `Last Version`, so `Default` and `Profile 1` cannot be classified as Chrome 145 and Chrome 150 independently when they share the same root. Use a clean VM snapshot or a separate blank root for version switching, and do not downgrade a real profile.
+
+### Brave version semantics
+
+Brave may store a product-shaped `Last Version`, such as `150.1.92.144`, instead of its underlying Chromium build. The 145 and 150 negative cases remain unambiguous against Cloak 146, but a Brave build whose underlying Chromium is exactly `146.0.7680.177` may be classified as a false negative. Record the observed safe value and result. Do not treat a Brave positive-alignment claim as closed until Tokenless can prove the owning Chromium build through a safe real boundary.
+
+### Arc archived installers
+
+The official release notes establish the product-to-Chromium mappings, but the current official installer may update to the latest Arc build. Exact historical cases require an existing official installation or clean VM snapshot; an unavailable trusted artifact blocks that individual case rather than authorizing a third-party download.
+
+## Evidence Record
+
+Append one dated subsection per machine and case. Record:
+
+- Windows edition/build, `process.arch`, and confirmation that the CPU vendor is AMD;
+- Tokenless commit SHA and Node/npm versions;
+- source browser product and safely reported version;
+- standard root and candidate directory keys;
+- setup compatibility result and confirmation path;
+- Cloak source URL, expected artifact/browser versions, checksum outcome, and cache source;
+- managed profile runtime binding and `doctor --json` result;
+- launch, sandbox, cleanup, and exact failure-code outcomes; and
+- pass, fail, or blocked with a concise reason.
+
+Do not attach source profile contents, browser storage, credentials, full DOM, unrelated account information, or provider screenshots to this roadmap.
+
+## Exit Criteria
+
+This active test plan is complete only when:
+
+1. the core Cloak setup/runtime path passes on Windows AMD x86-64 hardware;
+2. every source-browser matrix classification is either passed or explicitly blocked only by unavailable official historical installation media;
+3. exact 146 alignment and one-patch mismatch behavior are proven;
+4. decline, fresh download, verified-cache reuse, and downloads-disabled failure paths are proven;
+5. clean profile isolation, exact runtime binding, sandboxing, and process cleanup pass without source-profile access or mutation; and
+6. the corresponding Windows gates in the parent browser-runtime roadmap are updated from the evidence here.
+
+When all exit criteria pass, move this document to `docs/roadmaps/archived/`, update `docs/roadmaps/README.md`, and retain it as the permanent Windows acceptance record.
diff --git a/docs/roadmaps/P1-agent-session-integrations.md b/docs/roadmaps/P1-agent-session-integrations.md
new file mode 100644
index 0000000..cdcb6bc
--- /dev/null
+++ b/docs/roadmaps/P1-agent-session-integrations.md
@@ -0,0 +1,388 @@
+# Agent Session Integrations
+
+Status: proposed | Priority: P1 | First integration: northbound local MCP server, then Codex
+
+Depends on: stable local job identity, typed provider capabilities, and the Context Envelope contract
+
+Related: [Web Agent Harness](P0-web-agent-harness.md) owns the independently buildable harness package, skill injection, southbound MCP client, tool authorization, and web-model tool loop
+
+## Outcome
+
+Tokenless binds work to the exact conversation and filesystem scope of the local agent that requested it. Provider routing no longer guesses a project from names or the process's incidental current directory.
+
+The product surface is an agent-neutral, capability-first routing protocol with a local MCP server as its primary explicit agent tool surface. Callers state the outcome they require; Tokenless selects a provider and provider-specific strategy. A Codex plugin is the first deep lifecycle integration, not a Codex-only architecture.
+
+## Current Implementation State
+
+As of 2026-07-31, the first CLI routing slice is complete:
+
+- `tokenless capabilities list --json` returns the versioned canonical catalog, parameter schemas, lifecycle and evidence contracts, stability, and declared provider routes without opening a browser;
+- `tokenless run --capability <capability>` accepts repeatable canonical requirements;
+- normal runs infer `conversation.chat`, attachments infer `file.upload` plus their media-specific input capability, and native Workspace intent infers `workspace.native`;
+- explicit and inferred requirements are merged before any daemon submission or browser mutation;
+- implicit selection filters the configured provider scope by the complete requirement set and cached profile eligibility;
+- explicit provider constraints fail rather than switching when the provider lacks an E2E-closed route; and
+- the selected capability route is persisted with the daemon job and returned by `tokenless state`; and
+- implicit normal runs persist compatible alternatives and the daemon can atomically requeue the same logical job after a provider-scoped visible blocker while preserving durable attempt history;
+- `conversation.chat`, `file.upload`, and `workspace.native` are the only currently routeable task outcomes.
+
+Candidate catalog entries remain non-routeable. The complete Deep Research lifecycle, required-citation postcondition, explicit continuation contract, generated artifact lifecycles, structured capability parameters, MCP transport, and scheduler-aware route selection remain planned work.
+
+## Capability-First Routing
+
+A provider-neutral `--mode` flag would unify spelling without unifying meaning. Qwen composer modes, provider reasoning controls, research variants, image creation surfaces, and future provider-specific controls do not share one stable semantic type. A raw string flag would still let an agent pass a valid Qwen label to the wrong provider, use a disabled account-tier option, or reuse a stale label after the provider DOM changes.
+
+The caller-facing interface should instead accept canonical task capabilities such as:
+
+| Capability | Caller intent |
+| --- | --- |
+| `conversation.chat` | Submit a normal chat request and read the correlated response |
+| `research.deep` | Produce a provider-native deep research result that meets the documented evidence contract |
+| `image.generation` | Produce an image result through a proven visible provider flow |
+| `file.upload` | Deliver caller-selected files and prove visible provider acceptance |
+| `workspace.native` | Use a proven native provider Project or equivalent named workspace |
+| `conversation.continue` | Continue the exact durable provider conversation |
+| `response.citations` | Require visible citation evidence in the provider response |
+
+This initial list is illustrative, not an automatic support declaration. A capability enters the public catalog only after its minimum semantics, inputs, success evidence, composability, and failure behavior are defined.
+
+`qwen.mode`, `model.choice`, and provider DOM selectors remain provider strategy details. A future `research.deep` route may use a Qwen strategy that selects the visible Deep Research mode, but the current implementation rejects that capability because Qwen's final-report lifecycle is not closed. If Qwen or another provider later proves the same canonical outcome, it can satisfy the task capability through a different adapter without changing the caller interface.
+
+Do not claim equivalence merely because two providers use similar labels. A canonical capability represents a minimum externally observable outcome, not the presence of a menu item.
+
+## Capability Catalog and Provider Matrix
+
+Maintain two related but distinct product records:
+
+The maintained [Provider Capability Census](../provider-capability-census.md) supplies current product reconnaissance and the candidate vocabulary. It does not grant runtime support.
+
+### Canonical Capability Catalog
+
+The catalog defines what callers may request:
+
+| Field | Purpose |
+| --- | --- |
+| `id` | Stable canonical capability identifier |
+| `title` and `description` | Agent- and human-readable intent |
+| `inputSchema` | Capability-specific structured inputs |
+| `sideEffects` | Whether the capability reads, uploads, submits, creates, or persists provider state |
+| `composesWith` and `conflictsWith` | Valid multi-capability requests |
+| `requiredEvidence` | Minimum visible and durable outcomes needed for success |
+| `stability` | Experimental or supported |
+
+### Provider Capability Matrix
+
+The provider matrix defines how, and whether, each provider satisfies each canonical capability:
+
+| Field | Purpose |
+| --- | --- |
+| `provider` and `capability` | Matrix key |
+| `strategy` | Provider-owned implementation, such as the Qwen Deep Research mode strategy |
+| `support` | `supported`, `experimental`, `unavailable`, or `unknown` |
+| `accountConstraints` | Known tier or authentication constraints without treating labels as authorization |
+| `runtimeInspection` | Visible controls and blockers that must be checked for the selected profile |
+| `evidence` | Real-provider E2E closure required before routing is advertised |
+| `reason` | Structured explanation when unavailable or unknown |
+
+The checked-in live E2E matrix remains an acceptance and evidence plan; it is not imported as runtime product configuration. Runtime declarations live with the typed provider and capability registry. Built-interface checks should verify that the externally listed capability routes and the real-provider acceptance matrix do not drift.
+
+## Router Module
+
+The router is a deep module at the caller-to-provider seam. Its small interface accepts:
+
+- one or more required canonical capabilities;
+- the selected managed profile;
+- an optional explicit provider constraint when the user actually requested one; and
+- structured task inputs such as prompt, files, workspace intent, and output requirements.
+
+Its implementation owns:
+
+- the canonical catalog;
+- provider strategy mappings;
+- provider stage and support evidence;
+- configured provider preferences;
+- cached profile access observations;
+- fresh read-only capability inspection when needed; and
+- deterministic failure explanations.
+
+The router returns one `CapabilityRoute` containing the selected provider, profile, matched strategies, route reason, evidence status, and any blocker. Execution uses that exact route and re-checks visible preconditions before the first mutation.
+
+### Deterministic Routing Policy
+
+1. Validate the requested capability set and infer structurally required capabilities. Attachments imply `file.upload`; native workspace intent implies `workspace.native`.
+2. If the caller supplied an explicit provider constraint, evaluate only that provider and fail rather than silently switching.
+3. Otherwise, use profile membership or `providerWhitelist` as the complete provider filter; the persisted default contains every non-disabled provider except Gemini.
+4. Remove providers without implemented and real-E2E-closed mappings for every required capability.
+5. Evaluate current profile access, visible availability, blockers, subscription-aware capacity, and plan limits through read-only inspection and the scheduler capacity policy.
+6. Select an eligible provider through the general capacity, fairness, and route-selection algorithm.
+7. If no single provider satisfies the complete request, fail with every evaluated provider and structured reasons.
+
+V1 never splits one successful execution across multiple providers and never submits trial prompts while routing. Runtime fallback replays the authorized request from the beginning only before submission and only when completed mutations are reconstructable; it does not treat provider-local partial work as portable completion. `providerWhitelist` defines candidate membership and supplies the final deterministic tie-breaker after capability compatibility, runtime eligibility, rate-limit capacity, evidence maturity, fairness, and profile health. Fallback never escapes the configured provider set.
+
+`providerWhitelist` defines membership rather than preference. Its order affects only otherwise equivalent routes; the public routing contract must keep that precedence explicit.
+
+For example, if `research.deep` is currently closed only for Qwen:
+
+- whitelist `[chatgpt, qwen]` routes to Qwen;
+- whitelist `[chatgpt, claude]` fails without escaping the configured scope;
+- the default whitelist routes to Qwen if the selected profile can use the proven strategy; and
+- an explicit `provider=chatgpt` constraint fails rather than switching to Qwen.
+
+Provider-specific tuning remains secondary. A canonical capability uses a documented default provider strategy. Add cross-provider parameters only when their semantics can be defined honestly. Advanced low-level CLI controls may remain for diagnostics and explicit human use, but agents should not need them for the primary flow.
+
+The planned CLI interface is deliberately small:
+
+```bash
+tokenless capabilities list --json
+
+tokenless run \
+  --capability research.deep \
+  "Research this topic"
+
+tokenless run \
+  --capability research.deep \
+  --attach-file evidence.pdf \
+  "Research this topic using the attached evidence"
+```
+
+`--capability` is repeatable. A run without the flag infers `conversation.chat`; attachments additionally infer `file.upload`. Explicit and inferred requirements are merged before routing, so the caller does not repeat information already present in structured task inputs.
+
+## Why MCP
+
+The CLI remains the human, scripting, diagnostics, and recovery interface. MCP becomes the preferred agent interface because it provides:
+
+- typed capability identifiers and structured inputs instead of shell quoting and flag routing;
+- a discoverable capability catalog;
+- structured route decisions, results, and repair instructions;
+- durable job identifiers for polling, resume, and cancellation; and
+- a place to enforce provider, profile, capability, evidence, and freshness constraints before browser actions start.
+
+MCP does not make provider-specific semantics generic. It lets the router hide them behind a capability-first interface.
+
+This roadmap uses MCP only as a northbound transport: Tokenless is an MCP server called by Codex or another agent host. It does not own the separate southbound role in which the Web Agent Harness is the MCP host/client executing tools requested by a web model. That role, its credentials, approvals, tool schemas, and durable loop belong to [Web Agent Harness](P0-web-agent-harness.md).
+
+This roadmap is therefore an integration interface, not an early Agent Harness. Its tools expose the Web Provider layer's durable web operations and bind them to an external session. It does not inject skills into the web model, teach the web model an MCP calling protocol, execute the requested MCP tools, return their results to the provider conversation, or own the agent loop. When the separate harness package is available, an agent-run interface calls that package; harness logic does not move into this P1 adapter.
+
+## Minimal MCP Tool Surface
+
+The first MCP version should expose a small stable tool list instead of one tool per provider or per visible mode:
+
+| Tool | Mutation | Purpose |
+| --- | --- | --- |
+| `tokenless_list_capabilities` | No | Return the canonical catalog, schemas, and current declared provider coverage |
+| `tokenless_run` | Yes | Accept required capabilities and task inputs, resolve one route, and submit one durable job |
+| `tokenless_get_job` | No | Read durable state, structured visible-action evidence, response text, and repair instructions |
+| `tokenless_resume_job` | Yes | Resume the same waiting job after user-resolvable auth, CAPTCHA, consent, or confirmation |
+| `tokenless_cancel_job` | Yes | Cancel one exact durable job |
+
+Do not expose a generic arbitrary `provider-action` or raw provider-mode MCP tool in v1. It would reproduce the CLI's low-level action vocabulary without making common agent workflows safer. Add narrowly scoped advanced tools later only when an agent workflow cannot be represented by catalog, run, state, resume, and cancel.
+
+The MCP server is a thin trusted local adapter over the same daemon job and provider capability contracts. It does not own another browser, attach through CDP, automate login, or receive provider credentials. The daemon remains the only Playwright actor.
+
+Keep the MCP tool schemas stable across account state. The canonical capability identifiers may be a schema enum for a published product version, while runtime provider eligibility belongs in route results rather than a connection-specific tool list. Tool-list change notifications are reserved for actual product tool additions or removals. This avoids depending on every MCP host refreshing dynamic schemas correctly and remains compatible with stateless transports.
+
+Tool results use structured output schemas and also provide concise text fallbacks for compatible hosts. Tool annotations identify read-only and mutating operations, but are hints rather than authorization; user approval policy remains the MCP host's responsibility.
+
+```mermaid
+sequenceDiagram
+  participant Agent as Agent through MCP host
+  participant MCP as Tokenless MCP adapter
+  participant Daemon as Tokenless daemon
+  participant Provider as Real provider website
+
+  Agent->>MCP: tokenless_list_capabilities()
+  MCP-->>Agent: Canonical capability catalog
+  Agent->>MCP: tokenless_run(capabilities, task inputs)
+  MCP->>Daemon: Resolve candidate scope and submit routing inspection
+  Daemon->>Provider: Read visible eligibility without mutation
+  Provider-->>Daemon: Current controls, access, and blockers
+  Daemon->>Daemon: Select one evidence-backed CapabilityRoute
+  Daemon->>Provider: Re-check route and execute visible strategy
+  Daemon-->>MCP: Durable job id, provider route, and state
+  MCP-->>Agent: Structured result
+```
+
+The adapter should call internal typed APIs or the authenticated daemon contract directly, not spawn CLI subprocesses and parse their output. Package the first `stdio` server with the existing CLI distribution rather than creating a new package namespace.
+
+Official MCP references:
+
+- [MCP tools, input schemas, structured output, annotations, and errors](https://modelcontextprotocol.io/specification/2025-11-25/server/tools)
+- [MCP transports](https://modelcontextprotocol.io/specification/2025-11-25/basic/transports)
+
+## MCP Trust Boundary
+
+- Start with local `stdio` transport launched by the MCP host. Consider authenticated loopback transport only after a concrete multi-process need exists.
+- Never return the daemon bearer token, browser profile paths, cookies, storage, raw DOM, or unrelated account data to the model.
+- Resolve file inputs against declared MCP roots or explicit absolute paths and apply the existing regular-file, size, count, staging, and provenance rules.
+- Bind calls to explicit agent session metadata when the host supplies it. Missing binding may reduce routing features but must not silently guess another session.
+- Treat tool descriptions, annotations, and client-provided metadata as untrusted inputs at the daemon boundary.
+- Preserve existing manual-user handoff for sign-in, CAPTCHA, MFA, plan upgrade, consent, and confirmation.
+
+## Stable Agent Session Binding
+
+Introduce a versioned `AgentSessionBinding`:
+
+| Field | Purpose |
+| --- | --- |
+| `agentKind` | Identifies the producer, initially `codex` |
+| `sessionId` | Stable conversation or thread identity supplied by the agent |
+| `turnId` | Optional turn identity for request/result correlation |
+| `cwd` | Exact working directory reported by the agent |
+| `projectRoot` | Canonical project root resolved from `cwd` |
+| `worktreeId` | Canonical realpath plus repository/worktree identity |
+| `repository` | Optional VCS remote identity with credentials removed |
+| `branch` and `head` | Optional source-state evidence, not project identity |
+| `transcriptRef` | Optional local reference with explicit access policy |
+| `startedAt` and `observedAt` | Freshness and lifecycle evidence |
+| `producerVersion` | Adapter and schema compatibility |
+
+The durable lookup key is `agentKind + sessionId`. Project, worktree, and provider-workspace bindings are associated records and can change over a session's lifetime.
+
+## Why Codex First
+
+Current Codex lifecycle hooks provide the fields needed for exact first-party binding:
+
+- `session_id`;
+- `cwd`;
+- an optional `transcript_path`;
+- lifecycle events such as `SessionStart`, `UserPromptSubmit`, `Stop`, and `SessionEnd`; and
+- plugin-local writable data through `PLUGIN_DATA`.
+
+Codex also defines `CODEX_HOME` as its state root, with `~/.codex` as the default. Directly scanning that directory is not the primary integration path. Hook metadata is narrower, more explicit, and better aligned with the active conversation.
+
+The transcript path is a convenience reference, but its format is not a stable hook interface. Transcript reading must therefore be optional, consented, version-detected, and replaceable.
+
+Official references:
+
+- [Codex hooks](https://learn.chatgpt.com/docs/hooks)
+- [Codex configuration and state locations](https://learn.chatgpt.com/docs/config-file/config-advanced#config-and-state-locations)
+- [Codex plugins](https://developers.openai.com/plugins)
+
+## Codex Integration Shape
+
+The installable Codex plugin should bundle:
+
+- a Tokenless routing skill for explicit user or agent invocation;
+- trusted lifecycle hooks that register and refresh session binding;
+- configuration for the local Tokenless MCP server;
+- schemas for context export and Tokenless result import; and
+- clear permission, privacy, and uninstall behavior.
+
+The primary flow is:
+
+1. `SessionStart` sends `session_id`, `cwd`, and adapter version to the local Tokenless control plane.
+2. Tokenless canonicalizes the working directory, resolves the project root and worktree, and persists the binding.
+3. An explicit Tokenless invocation includes the same session id and optional turn id.
+4. Tokenless resolves the provider workspace from the exact session/project binding.
+5. The web result returns to the requesting session with job id, context revision, provider conversation identity, and artifacts.
+6. `SessionEnd` marks the binding inactive without deleting retained user-approved history.
+
+Hooks register identity; they do not submit prompts or upload files implicitly.
+
+## Delivery Phases
+
+### Phase 0: Capability Catalog and Routing Protocol
+
+- Define the canonical capability catalog, provider capability matrix, `CapabilityRoute`, `AgentSessionBinding`, lifecycle events, and schema versioning.
+- Separate agent identity, filesystem identity, provider workspace identity, and task identity.
+- Define collision, resume, fork, worktree-change, and stale-session behavior.
+- Define capability composition, conflicts, provider preference scope, explicit provider constraints, stale observations, account blockers, and route failure behavior.
+- Add built CLI commands to list canonical capabilities and submit repeated required capability identifiers.
+
+Exit: the built CLI can list the catalog and deterministically route a multi-capability request to one eligible provider without caller-supplied provider details.
+
+### Phase 1: Local MCP Server
+
+- Add a local `stdio` MCP entry point backed by the packaged Tokenless daemon and existing durable jobs.
+- Expose only list-capabilities, run, get-job, resume-job, and cancel-job.
+- Publish strict input and structured output schemas generated from or checked against the internal contracts.
+- Accept canonical required capabilities and keep provider-specific controls behind the router module.
+- Return the chosen provider route, typed blockers, candidate rejection reasons, and retry or repair instructions.
+- Add MCP protocol conformance and real daemon-bound integration coverage without provider simulations.
+
+Exit: an MCP client can request `research.deep` without naming Qwen, observe an evidence-backed Qwen route, poll the durable result, and receive a pre-mutation error when no provider in the configured scope is eligible.
+
+### Phase 2: Explicit Codex Binding
+
+- Add a Tokenless command that accepts Codex `session_id` and `cwd`.
+- Resolve realpath, repository root, worktree, branch, and current revision.
+- Persist the binding in the local daemon.
+- Route jobs by exact binding and expose the resolved identity in state output without leaking raw private paths.
+
+Exit: two Codex sessions in different worktrees or directories resolve to different bindings even when project names are identical.
+
+### Phase 3: Codex Plugin and Lifecycle Hooks
+
+- Package the routing skill and minimal hook definitions as a plugin.
+- Configure the local MCP server as the explicit Tokenless tool surface.
+- Register on `SessionStart` and refresh only on meaningful lifecycle changes.
+- Require the user to review and trust plugin hooks.
+- Keep prompt submission explicit and observable.
+
+Exit: starting or resuming a Codex session creates or refreshes the exact binding with no project-name guess.
+
+### Phase 4: Authorized Context Export
+
+- Add an explicit action that exports the current goal, user prompt, plan, relevant repository guidance, and selected files into a Context Envelope.
+- Treat `transcript_path` as optional and unstable.
+- When transcript import is enabled, use versioned readers, bounded selection, and a preview or manifest before sharing.
+- Never import authentication state, hidden prompts, private reasoning, or unrelated sessions.
+
+Exit: the user can inspect what session context will be sent, and Tokenless works correctly when no transcript is available.
+
+### Phase 5: Additional Agent Adapters
+
+- Publish the protocol and adapter conformance suite.
+- Add other mainstream coding agents through their stable lifecycle, extension, or invocation surfaces.
+- Keep product-specific logic in adapters while preserving shared identity and context contracts.
+
+Exit: a second agent can complete the same exact-binding and context-handoff workflow without Codex-specific fields leaking into core contracts.
+
+## Acceptance Criteria
+
+- Session matching uses an agent-supplied stable id, never chat title or project display name.
+- Callers request canonical task capabilities; provider-specific actions and mode labels stay inside provider strategy adapters.
+- Routing honors an explicit provider constraint, otherwise filters candidates by the configured preferred-provider set, otherwise considers all enabled providers; the normal capability, capacity, fairness, and health algorithms run after that filter.
+- One V1 route must satisfy the complete requested capability set through one provider.
+- Runtime presence alone never makes a route supported; provider mapping and real-provider E2E closure are both required.
+- MCP mutation tools reject unknown, conflicting, unsupported, unavailable, and blocked capability requests before browser mutation.
+- MCP tool schemas and structured outputs are versioned and validated against the internal daemon contracts.
+- The first MCP release has no arbitrary low-level provider-action escape hatch.
+- Working directory and project root are canonicalized and checked for changes.
+- Worktrees and concurrent sessions are distinct.
+- Session resume preserves identity; session fork creates a distinct identity with explicit lineage when available.
+- A missing or stale binding fails with a repair instruction instead of falling back to name guessing.
+- Hook registration is local, bounded, reviewable, and idempotent.
+- Transcript access is off by default and the core workflow does not depend on its file format.
+- Plugin removal or binding revocation stops future integration without deleting unrelated Tokenless state.
+- Integration tests exercise the built CLI/daemon and a real Codex hook payload or supported Codex process boundary; no fake agent implementation is treated as product proof.
+
+## Risks and Responses
+
+| Risk | Response |
+| --- | --- |
+| Codex internal storage format changes | Prefer stable hook fields; isolate optional transcript readers by detected version |
+| Session id is accidentally exposed to providers | Keep it local and use a separate opaque provider-facing correlation id |
+| Hooks become surprising background automation | Limit hooks to identity registration and require explicit task submission |
+| Same repository has multiple worktrees or subdirectory sessions | Bind canonical `cwd`, project root, and worktree identity separately |
+| Agent lacks lifecycle hooks | Use explicit invocation metadata and report reduced lifecycle capability |
+| Plugin surface changes | Keep the agent-neutral local protocol independently usable |
+| MCP host caches tools or ignores list-change notifications | Keep the v1 tool list stable and return runtime provider eligibility in route results |
+| Agent invents or edits a provider option label | Accept canonical capability identifiers and keep provider labels out of the primary MCP interface |
+| Provider whitelist cannot satisfy the request | Fail with candidate reasons; do not silently escape the configured scope |
+| Provider availability changes during routing | Re-check visible route preconditions before the first mutation |
+| Similar provider features do not have equivalent outcomes | Define capability semantics by required evidence and keep non-equivalent strategies provider-specific |
+| Tool annotations are treated as authorization | Enforce authorization and mutation policy inside Tokenless; annotations remain hints |
+
+## Non-Goals
+
+- Parsing all files under `CODEX_HOME` as a stable public database
+- Reading Codex authentication material, logs, or unrelated sessions
+- Uploading a Codex transcript by default
+- Making provider project names the source of identity
+- Requiring every supported agent to install the same plugin format
+- Flattening provider-specific controls into one universal mode taxonomy
+- Generating one MCP tool for every provider mode or visible menu item
+- Splitting one V1 request across several providers
+- Silently routing outside the user's configured preferred-provider scope
+- Exposing the daemon bearer token or browser debugging access to the MCP client
diff --git a/docs/roadmaps/P1-project-knowledge-graph-and-provider-mirroring.md b/docs/roadmaps/P1-project-knowledge-graph-and-provider-mirroring.md
new file mode 100644
index 0000000..b779584
--- /dev/null
+++ b/docs/roadmaps/P1-project-knowledge-graph-and-provider-mirroring.md
@@ -0,0 +1,168 @@
+# Project Knowledge Graph and Provider Mirroring
+
+Status: proposed | Priority: P1
+
+Depends on: Context Envelope, exact agent session binding, provider file acceptance, and workspace alignment
+
+## Outcome
+
+Tokenless builds a local, source-attributable graph of a software project and maintains a bounded, user-approved context mirror inside the exact provider Project or conversation used by a web coding agent.
+
+The web agent should receive enough durable project knowledge to plan and implement work without repeatedly rediscovering repository rules, architecture, symbols, tests, and workflows. The local repository remains authoritative.
+
+## Local Knowledge Graph
+
+The graph uses stable, content-addressed nodes and typed edges.
+
+### Initial Node Types
+
+- repository, worktree, directory, and file;
+- symbol, module, package, command, configuration key, and environment variable;
+- architecture decision, rule, instruction, and documentation section;
+- test, fixture, generated artifact, and provider adapter; and
+- task, decision, and context revision.
+
+### Initial Edge Types
+
+- `contains`, `defines`, `imports`, `references`, and `depends_on`;
+- `governed_by`, `configures`, and `generated_from`;
+- `tested_by`, `documents`, and `implements`;
+- `changed_in`, `relevant_to`, and `supersedes`; and
+- `mirrored_as` and `accepted_by`.
+
+Every derived node or edge records source paths, digests, extractor version, confidence, and freshness. Low-confidence relationships remain distinguishable from parser-proven relationships.
+
+## Two Representations
+
+The local graph and provider mirror serve different purposes:
+
+1. **Local graph:** structured, queryable, incremental, and optimized for exact retrieval.
+2. **Provider context bundle:** bounded, human-readable artifacts optimized for provider file limits and model comprehension.
+
+The first provider bundle should contain:
+
+- `PROJECT_CONTEXT.md`: project purpose, stack, entry points, and current revision;
+- `PROJECT_RULES.md`: applicable repository and directory instructions with scope;
+- `ARCHITECTURE_MAP.md`: components, boundaries, execution flows, and key dependencies;
+- `SYMBOL_INDEX.md`: high-value modules, symbols, commands, and ownership;
+- `TEST_AND_WORKFLOW_GUIDE.md`: real build, test, lint, and release workflows;
+- `TASK_CONTEXT.md`: current goal, relevant subgraph, selected files, decisions, and done conditions; and
+- `TOKENLESS_MANIFEST.json`: schema version, project/worktree identity, source digests, shard hashes, exclusions, and active revision.
+
+Large artifacts are deterministically sharded. The manifest identifies the active bundle and makes stale copies detectable even when the provider cannot delete or replace earlier uploads safely.
+
+## Indexing and Sharing Policy
+
+Indexing is local-first and respects:
+
+- repository boundaries and canonical paths;
+- `.gitignore` plus Tokenless-specific include and exclude rules;
+- maximum file size, binary detection, generated-file policy, and symlink containment;
+- secret and credential scanning before artifact generation;
+- explicit handling for untracked and ignored files;
+- source licenses and user-defined sharing restrictions; and
+- per-artifact provenance and redaction notices.
+
+Local indexing permission does not imply provider upload permission. Before first mirror creation or a material scope expansion, Tokenless must show a manifest-level preview and obtain explicit approval.
+
+## Provider Mirror Identity
+
+A mirror is keyed by:
+
+- local project and worktree identity;
+- agent session binding or an explicit standalone project binding;
+- provider and managed profile;
+- exact provider workspace resource or conversation identity; and
+- graph and bundle revision.
+
+Display names are descriptive only. If exact provider workspace identity is unavailable, Tokenless uses an explicit conversation-scoped mirror or fails according to the requested workspace mode.
+
+## Delivery Phases
+
+### Phase 0: Graph Schema and Repository Inventory
+
+- Define versioned node, edge, provenance, exclusion, and extractor schemas.
+- Inventory languages, package managers, build systems, documentation, instructions, and repository boundaries.
+- Define stable ids and incremental invalidation rules.
+- Add an inspect command that explains why a file or relationship is included or excluded.
+
+Exit: an inventory is deterministic, reviewable, and never crosses the canonical project root.
+
+### Phase 1: Local Structural Graph
+
+- Parse repository layout, manifests, imports, symbols, commands, tests, instructions, and documentation.
+- Prefer parser- or tool-backed relationships; use labeled heuristics only as fallback.
+- Cache by content digest and re-index only affected nodes and reverse dependencies.
+- Support exact and relevance-ranked graph queries for downstream context selection.
+
+Exit: a local query can explain the source and confidence of every returned node and edge.
+
+### Phase 2: Provider Context Bundle
+
+- Render deterministic Markdown artifacts and the machine-readable manifest.
+- Select a task-relevant subgraph under explicit byte, file-count, and context budgets.
+- Record omitted or summarized material.
+- Run secret, path, and policy checks before staging.
+
+Exit: rebuilding an unchanged project produces the same artifact hashes, and a reviewer can trace every statement to local sources.
+
+### Phase 3: Visible Provider Mirroring
+
+- Resolve the exact native Project or conversation from the session/workspace binding.
+- Upload the bundle through provider-visible controls.
+- Require visible attachment acceptance, not only file selection.
+- Store a receipt linking provider artifacts to local bundle hashes.
+- Upload only changed shards when safe; otherwise publish a new complete revision with an active manifest.
+
+Exit: Tokenless can prove which bundle revision the exact provider workspace visibly accepted.
+
+### Phase 4: Web Coding Task Bootstrap
+
+- Generate `TASK_CONTEXT.md` from the agent session, current goal, selected subgraph, and source state.
+- Start or continue the exact provider conversation after the project bundle is ready.
+- Ask the web agent to confirm the active manifest revision before substantial work.
+- Return generated code, patches, files, decisions, and citations as explicit artifacts for local review.
+
+Exit: a real web-agent task can use the mirrored repository rules and architecture, produce a reviewable artifact, and return it to the originating local session.
+
+### Phase 5: Incremental and Multi-Provider Operation
+
+- Refresh mirrors from file and graph changes.
+- Keep provider-specific file limits and replacement behavior in capability contracts.
+- Maintain independent receipts per provider/profile/workspace.
+- Measure retrieval quality, stale-context failures, upload volume, and task success using real tasks.
+
+Exit: one local graph can safely feed multiple independent provider mirrors without sharing identity or receipts across scopes.
+
+## Acceptance Criteria
+
+- The local graph is deterministic, incremental, and source-attributable.
+- Repository rules retain directory scope and precedence.
+- Ignored, excluded, secret-bearing, oversized, and out-of-root content cannot enter the provider bundle silently.
+- Provider artifacts are bounded, versioned, and tied to exact source digests.
+- A visible provider receipt proves attachment acceptance and workspace identity.
+- A new web-agent conversation can identify the active project revision, applicable rules, key architecture, and task completion criteria from the mirror.
+- Stale or ambiguous mirrors are detected before task submission.
+- Provider results return as reviewable artifacts and are never applied to the local repository implicitly.
+- Focused integration or browser E2E tests use the real filesystem, built CLI/daemon, and visible provider session without mocks or invented provider DOM.
+
+## Risks and Responses
+
+| Risk | Response |
+| --- | --- |
+| Graph is large but not useful | Optimize for task-relevant retrieval and measure answer/task quality, not node count |
+| Generated summary invents architecture | Require source citations, confidence, and deterministic structural extraction for factual claims |
+| Provider retains stale files | Active manifest, immutable revisions, expiry, and pre-task revision confirmation |
+| Secrets enter generated artifacts | Layered ignore rules, detection, reviewable manifest, and fail-closed staging |
+| Source changes during indexing or upload | Snapshot digests before extraction and revalidate before receipt |
+| Provider file limits differ | Capability-aware sharding and explicit omissions |
+| Web agent output is treated as trusted code | Return artifacts for local diff, tests, and review; never auto-apply |
+
+## Non-Goals
+
+- Replacing source control, language servers, or local build tools
+- Uploading the full repository automatically
+- Treating embeddings alone as a knowledge graph
+- Letting provider copies become the source of truth
+- Using hidden provider storage or upload APIs
+- Applying provider-generated changes without local verification
diff --git a/docs/roadmaps/README.md b/docs/roadmaps/README.md
new file mode 100644
index 0000000..419fa6a
--- /dev/null
+++ b/docs/roadmaps/README.md
@@ -0,0 +1,136 @@
+# Tokenless Roadmaps
+
+Status: active product direction | Last reviewed: 2026-08-01
+
+This directory contains long-horizon product and engineering roadmaps. It is separate from `plans/`, which contains bounded implementation plans for individual pieces of work.
+
+Roadmaps describe intended outcomes, sequencing, evidence, and acceptance criteria. They are not release promises, fixed dates, or compatibility guarantees. A capability becomes supported only after the implementation and real-boundary verification required by the relevant roadmap are complete.
+
+## Lifecycle and Directory Structure
+
+The roadmap's directory is the source of truth for its lifecycle:
+
+```text
+docs/roadmaps/
+├── README.md             # Index and lifecycle rules
+├── P[0-3]-*.md           # Active roadmaps
+├── backlog/
+│   ├── README.md         # Backlog index
+│   └── P[0-3]-*.md       # Accepted but intentionally inactive roadmaps
+└── archived/
+    ├── README.md         # Archive index
+    └── P[0-3]-*.md       # Completed, superseded, cancelled, or retired roadmaps
+```
+
+There is intentionally no `active/` directory. Every root-level Markdown file other than this index is active. An active roadmap can still have an internal delivery status such as `proposed`; lifecycle placement describes whether the direction is currently active, while the document status describes its delivery maturity.
+
+Move a roadmap to:
+
+- [`backlog/`](backlog/README.md) when the direction is accepted but intentionally not being pursued;
+- [`archived/`](archived/README.md) when it is completed, superseded, cancelled, or no longer planned; or
+- this directory's root when it becomes active.
+
+Every roadmap filename must begin with its product priority (`P0-`, `P1-`, `P2-`, or `P3-`), and that prefix must match the priority declared in the document. A priority change therefore requires a rename. Every addition, rename, move, priority change, or lifecycle change must update this index, all repository links, and the roadmap's lifecycle or disposition note. A superseded roadmap must link to its replacement. Archived roadmaps retain their historical content.
+
+## Active Roadmaps
+
+| Roadmap | Outcome | Current priority |
+| --- | --- | --- |
+| [Browser Runtime Selection and Cloak Integration](P0-browser-runtime-selection-and-cloak.md) | Use an exact profile-bound Chromium runtime, prefer the user's installed browser, provide a locked managed fallback, add explicit verified Cloak installation, and classify local Chromium profile versions without reading or copying browser secrets. | P0 |
+| [Windows AMD64 Cloak Setup Acceptance Test Plan](P0-windows-amd64-cloak-setup-acceptance-test-plan.md) | Execute and record the clean Windows AMD x86-64 Anti-Detect setup matrix for Chrome, Brave, and Arc 145/150 profiles, exact Cloak 146 alignment, verified installation, isolation, and recovery paths. | P0 |
+| [Browser Connection Mode Capability Evaluation](P0-browser-connection-mode-capability-evaluation.md) | Compare native Playwright and CDP connections against the same local-browser and real-provider capability matrices without changing the default. | P0 |
+| [Real Provider Browser E2E and Native Projects](P0-real-provider-browser-e2e-and-native-projects.md) | Prove every advertised visible capability against real provider websites and add real Claude and Grok native Project creation, reuse, and continuation. | P0 |
+| [Provider Expansion and Parity](P0-provider-expansion.md) | Add high-value AI web providers and maintain an evidence-backed capability catalog and routing matrix across them. | P0 |
+| [Context Delivery and Workspace Alignment](P0-context-delivery-and-workspace-alignment.md) | Carry authorized task, repository, instruction, and file context into the exact provider Project or conversation, including a new chat. | P0 |
+| [Web Agent Harness](P0-web-agent-harness.md) | Build a ChatGPT-first, Web-Provider-specific harness package that injects skills and an MCP calling protocol over the current Web Provider API, ready for later extraction into its own project. | P0 |
+| [Concurrency and Session Scheduling](P0-concurrency-and-session-scheduling.md) | Persist every invocation through the local daemon and schedule exact project, workspace, conversation, profile, and page lanes safely under concurrent load. | P0 |
+| [Local Web Control Plane](P0-local-web-control-plane.md) | Provide a secure localhost console for setup handoff, browser identities, provider configuration, capabilities, jobs, diagnostics, and user recovery. | P0 |
+| [Agent Session Integrations](P1-agent-session-integrations.md) | Expose the current Web Provider operations through a northbound local MCP interface, then bind jobs to exact agent sessions with Codex as the first deep lifecycle integration; this is not the Web Agent Harness. | P1 |
+| [Project Knowledge Graph and Provider Mirroring](P1-project-knowledge-graph-and-provider-mirroring.md) | Build a local project graph and maintain an approved, provider-ready project context mirror for web-based coding agents. | P1 |
+
+Priority describes product importance, not a promise that all work proceeds serially.
+
+## Backlog and Archive
+
+- [Backlog](backlog/README.md): no roadmap is currently backlogged.
+- [Archive](archived/README.md): Provider Architecture and Registry was completed and the Daemon Fastify HTTP API direction was cancelled on 2026-07-27.
+
+## How the Roadmaps Fit Together
+
+```mermaid
+flowchart LR
+  Caller["Trusted local caller<br/>HTTP create + polling"]
+  UI["Local web control plane<br/>profiles + providers + jobs"]
+  API["Local daemon API<br/>auth + schemas + job reads"]
+  Session["Agent session binding<br/>session id + working directory"]
+  Scheduler["Durable scheduler<br/>identity + lanes + backpressure"]
+  Context["Context envelope<br/>provenance + policy + limits"]
+  Harness["Web agent harness<br/>instructions + durable tool loop"]
+  Tools["Tool runtime<br/>southbound MCP + local tools"]
+  Graph["Project knowledge graph<br/>rules + architecture + symbols"]
+  Browser["Browser runtime manager<br/>system + managed + Cloak"]
+  Provider["Provider adapters<br/>visible capabilities"]
+  Workspace["Provider workspace mirror<br/>Project or conversation"]
+  Task["Web-agent task<br/>exact session and project context"]
+
+  Caller --> API
+  UI --> API
+  Session --> API
+  API --> Scheduler
+  Scheduler --> Context
+  Graph --> Context
+  API --> Harness
+  Session --> Harness
+  Context --> Harness
+  Harness --> Scheduler
+  Harness --> Tools
+  Tools --> Harness
+  Context --> Provider
+  Browser --> Provider
+  Provider --> Scheduler
+  Scheduler --> Workspace
+  Graph --> Workspace
+  Workspace --> Task
+```
+
+The shared contracts should be built before provider-specific shortcuts:
+
+1. Use the completed typed provider registry, `BaseProvider` execution skeleton, and provider-owned capability classes documented in the archived [Provider Architecture and Registry](archived/P0-provider-architecture-and-registry.md) roadmap.
+2. Establish exact, profile-bound browser runtime selection and verified system, managed, and Cloak launch paths.
+3. Establish the real-provider browser E2E evidence plane and close Claude and Grok native Project identity before depending on those capabilities for broader context delivery.
+4. Define stable provider capability, context-envelope, agent-session, and mirror-manifest contracts.
+5. Add the authenticated local web control plane over shared application services without exposing the daemon bearer token to browser JavaScript.
+6. Keep the daemon's small built-in HTTP server and make polling the explicit asynchronous caller and UI contract.
+7. Make the local daemon the durable authority for idempotency, admission, scheduling lanes, conversation identity, and recovery.
+8. Build the ChatGPT-first web agent harness as an independently buildable package over exact provider turns, durable checkpoints, explicit approvals, southbound MCP tools, and finite loop limits; defer repository extraction until the interface is stable.
+9. Expand provider coverage using the same visible-session and evidence requirements as the existing providers; agent-harness eligibility closes independently from normal QA support.
+10. Add exact session binding, beginning with Codex lifecycle hooks and explicit invocation metadata.
+11. Produce a local project graph and synchronize bounded, reviewable context artifacts into the bound provider workspace.
+
+## Shared Product Principles
+
+- **Visible provider boundary:** operate provider websites through visible controls and visible postconditions. Do not depend on private provider APIs.
+- **Harness-owned agency:** provider websites supply verified model turns; Tokenless owns instruction precedence, tool authorization, execution, durable looping, and termination.
+- **Directional MCP roles:** the northbound Tokenless MCP server is a caller interface; southbound MCP clients are separately configured tool adapters and never inherit caller authority.
+- **Evidence before availability:** selectors or menu presence are not success. A capability is supported only when a real visible-session sequence proves the final outcome.
+- **Fail closed:** ambiguous identity, navigation, attachment state, workspace selection, or context delivery must return an explicit unavailable or unknown result.
+- **Exact identity over names:** use provider/profile/resource identifiers and agent/session/worktree identity. Human-readable project and chat names are metadata, not primary keys.
+- **Daemon-owned concurrency:** every invocation is durably admitted, deduplicated, scheduled, leased, checkpointed, and completed through the local daemon.
+- **Conversation single-writer:** one conversation accepts at most one mutating job at a time; unrelated conversations may run concurrently only within explicit profile and provider limits.
+- **Local-first and consent-based:** indexing, session binding, and staging happen locally. Upload only the bounded artifacts a user or authorized agent has approved.
+- **Provenance-preserving context:** every instruction and source must retain its origin, scope, freshness, and sharing policy.
+- **No hidden-prompt extraction:** Tokenless may carry instructions explicitly supplied or exported by the caller. It must not scrape concealed platform, developer, or provider prompts.
+- **Real-boundary testing:** provider and agent integrations require focused integration or browser E2E evidence through the built CLI, daemon, filesystem, lifecycle hook, and real visible provider session.
+- **Honest degradation:** when a provider cannot represent a system instruction, Project, graph artifact, or other semantic layer natively, report the fallback instead of claiming parity.
+
+## Roadmap Maintenance
+
+Each roadmap should be updated when:
+
+- a phase is implemented or intentionally parked;
+- a capability contract changes;
+- live provider evidence changes a priority or invalidates an assumption;
+- a new privacy, policy, or provider constraint is discovered; or
+- implementation work reveals that an acceptance criterion is incomplete.
+
+Implementation issues and PRs should link to the relevant roadmap and identify the phase and acceptance criterion they advance.
diff --git a/docs/roadmaps/archived/P0-provider-architecture-and-registry.md b/docs/roadmaps/archived/P0-provider-architecture-and-registry.md
new file mode 100644
index 0000000..be88c51
--- /dev/null
+++ b/docs/roadmaps/archived/P0-provider-architecture-and-registry.md
@@ -0,0 +1,1621 @@
+# Provider Architecture and Registry
+
+Status: completed | Priority: P0
+
+Disposition: completed on 2026-07-27 and archived after the registry seam was proven by adding Qwen / 千问 without changing shared provider execution logic
+
+Depends on: completion of the TypeScript daemon consolidation, managed Playwright, provider action contracts, managed profiles, fixture provenance, and the existing four-provider behavior baseline
+
+Enables: [Provider Expansion and Parity](../P0-provider-expansion.md), [Context Delivery and Workspace Alignment](../P0-context-delivery-and-workspace-alignment.md), and [Project Knowledge Graph and Provider Mirroring](../P1-project-knowledge-graph-and-provider-mirroring.md)
+
+## Delivered Outcome
+
+Tokenless has one explicit TypeScript registration point for every visible web provider and one clean object-oriented provider seam. Every provider is represented by a concrete `BaseProvider` subclass. The base class owns the provider execution skeleton and mandatory conversation workflow, while provider-specific and optional behavior is supplied by capability classes.
+
+Adding a provider normally changes only:
+
+- one provider implementation module;
+- one explicit registry entry;
+- provenance-bound provider evidence;
+- focused real-browser integration coverage;
+- user-facing documentation; and
+- a changeset when the addition is release-worthy.
+
+Adding a provider must not require editing shared browser-runtime logic, duplicating provider allowlists, or adding provider-ID conditionals to common modules.
+
+The decisive acceptance question is:
+
+> Apart from the new provider subclass, its single registry entry, real evidence, browser E2E coverage, documentation, and release metadata, did adding the provider require any shared production-logic change?
+
+The answer must be no before this architecture is considered complete.
+
+## Completion Record
+
+The architecture was completed in TypeScript and proved against Qwen / 千问 as the first new provider. The production delta from the pre-Qwen baseline is one concrete provider module plus one import and constructor entry in the registry. No shared runner, runtime, profile, navigation, capability, daemon, or protocol implementation required a Qwen-specific change.
+
+The implementation differs from some proposed filenames below, but preserves the intended ownership boundaries:
+
+- `packages/cli/src/providers/registry.ts` is the single explicit registration point;
+- `packages/cli/src/providers/base-provider.ts` owns the common execution seam;
+- `packages/cli/src/providers/capability-set.ts` owns capability composition and dispatch;
+- `packages/cli/src/providers/action-catalog.ts` is the exhaustive action lifecycle source;
+- `packages/cli/src/providers/navigation-policy.ts` is the shared URL classifier;
+- `packages/cli/src/providers/capabilities/` contains shared mandatory-operation helpers and optional capability implementations;
+- each provider is a concrete `BaseProvider` subclass in its own module; and
+- `packages/cli/src/playwright/runner-service.ts` orchestrates jobs through provider methods without owning selectors.
+
+| Acceptance criterion | Completed implementation or evidence |
+| --- | --- |
+| Concrete provider subclasses | ChatGPT, Claude, Gemini, Grok, and Qwen are concrete `BaseProvider` subclasses. |
+| Mandatory execution skeleton | `BaseProvider` owns session, prompt, and response Template Methods with protected default hooks and runtime child-class dispatch. |
+| Optional capability composition | Model, effort, attachment, workspace, image, and diagnostics are keyed structural capability slots dispatched through `ProviderCapabilitySet`, with machine-readable unavailable or unknown states. |
+| Runner/provider boundary | The runner resolves providers through the registry and does not read provider selector tables. |
+| No shared provider-ID branching | Concrete behavior is owned by provider modules and provider-owned inspector or choice-policy classes. |
+| One production registration list | `providers/registry.ts` constructs the complete provider set once. |
+| Registry-derived policy | CLI normalization, setup ordering, runtime validation, profile import policy, navigation, execution, and daemon readiness consume registry metadata. |
+| Shared navigation policy | Target, wake, redirect, checkpoint, and continuation validation reuse `ProviderNavigationPolicy`. |
+| Provider-owned special cases | Grok entitlement and choice semantics remain Grok-owned; Gemini account interpretation remains Gemini-owned; Qwen Slate input handling remains Qwen-owned. |
+| Explicit unsupported states | Unproven capabilities fail closed through structured availability and reason fields. |
+| Wire compatibility | Legacy v1/v2 request schemas remain unchanged for the four legacy providers. |
+| Extensible protocol | Playwright job and visible-action v3 accept registry providers while runtime validation rejects unsupported providers. |
+| Daemon negotiation | Authenticated readiness advertises `supported_providers` from the execution registry; incompatible owned daemons are safely replaced. |
+| Deleted-runtime isolation | No provider registry or new provider knowledge was added to phased-out runtime paths. |
+| Compatibility-shim removal | The old Playwright adapter directory, provider table, duplicated URL helpers, and provider strategy strings were removed. |
+| Existing-provider regression boundary | Provenance-bound real-Chromium provider fixtures, daemon lifecycle, conformance, protocol, build, lint, and repository integration coverage preserve the existing baseline. |
+| First-provider seam proof | A fresh Qwen guest profile completed prompt input, submit, exact-marker response reading, and a second same-task continuation through the built CLI and real TypeScript daemon. |
+
+The Qwen integration remains `experimental`; architecture completion proves the extension seam, not every optional Qwen capability. Ongoing provider rollout and promotion criteria remain active in [Provider Expansion and Parity](../P0-provider-expansion.md).
+
+## Scope
+
+This roadmap is the detailed architecture and implementation plan for the provider seam. It does not itself commit Tokenless to shipping any candidate provider or advanced capability. Provider selection and release sequencing remain in [Provider Expansion and Parity](../P0-provider-expansion.md).
+
+This work covers:
+
+- the provider object model;
+- one provider registry;
+- provider navigation and identity policy;
+- typed provider actions;
+- mandatory session, prompt, and response behavior;
+- optional model, effort, attachment, workspace, and image capabilities;
+- runner interaction with provider objects;
+- provider-owned recovery state;
+- TypeScript daemon provider negotiation;
+- removal of provider knowledge from deleted runtime paths; and
+- real-boundary verification.
+
+This work does not cover:
+
+- hidden provider endpoints;
+- model APIs;
+- runtime-loaded third-party provider plugins;
+- filesystem auto-discovery of provider code;
+- invented provider DOM;
+- mock provider pages;
+- automatic publication of a new provider; or
+- guaranteeing that every provider exposes every optional capability.
+
+## Design Principles
+
+### One registration point, not one giant configuration file
+
+The source of truth is an explicit TypeScript registry of concrete provider objects. Each provider owns its descriptor, selectors, account interpretation, visible interaction strategies, and capability implementations.
+
+The registry is not a large JSON file containing every possible selector or behavior flag. A large data-only provider table would become a shallow module with optional-field growth and shared conditional logic.
+
+### Inheritance for the workflow, composition for capabilities
+
+Every provider extends `BaseProvider`. The base class defines the stable execution skeleton and mandatory conversation workflow.
+
+Optional or varying behavior is composed through capability classes:
+
+- `ProviderSessionCapability`;
+- `PromptCapability`;
+- `ResponseCapability`;
+- `ChoiceCapability`;
+- `AttachmentCapability`;
+- `WorkspaceCapability`;
+- `ImageGenerationCapability`; and
+- `DiagnosticsCapability`.
+
+This preserves a common object-oriented framework without forcing providers to implement unsupported methods.
+
+### No provider-ID conditionals in shared implementation
+
+Shared implementation must not branch on concrete provider IDs:
+
+```ts
+if (provider.id === 'grok') {
+  // Provider-specific behavior does not belong here.
+}
+```
+
+Grok entitlement interpretation belongs in `GrokEntitlementAccountInspector`. Gemini account interpretation belongs in `GoogleAriaAccountInspector`. A future Qwen editor strategy belongs in the Qwen provider module.
+
+Only behavior proven to be provider-neutral belongs in the base class or shared capability implementation.
+
+### The runner owns durable orchestration
+
+The runner owns:
+
+- job claims and leases;
+- checkpoints;
+- cancellation;
+- timeouts;
+- browser visibility;
+- user handoff;
+- action replay policy;
+- recovery; and
+- durable job completion.
+
+Providers own:
+
+- visible page meaning;
+- provider navigation classification;
+- session observation;
+- composer interaction;
+- submission controls;
+- response progress and completion;
+- provider-specific capabilities; and
+- visible success proof.
+
+The runner must not read provider selectors or infer provider page semantics.
+
+### Visible evidence remains authoritative
+
+Selectors identify candidates; they do not prove success. Every mutating capability must return a visible postcondition:
+
+- prompt text is visible after input;
+- the attachment is visibly accepted rather than merely selected;
+- the exact model or effort choice is visibly selected;
+- the exact workspace identity is visibly resolved;
+- a generated image is visibly present; and
+- a response is visibly new and no longer busy.
+
+Ambiguity produces `unknown`, `unavailable`, handoff, or a fail-closed error.
+
+### Deleted runtimes receive no new provider architecture
+
+The provider registry is TypeScript-only. Deleted runtimes must not receive a generated registry, new provider allowlists, or new capability logic. New provider support becomes generally available only through the authoritative TypeScript daemon.
+
+## Target Module Shape
+
+```mermaid
+flowchart LR
+  Module["Concrete provider module<br/>descriptor + capability implementations"]
+  Registry["ProviderRegistry<br/>single registration point"]
+  CLI["CLI, setup, and config"]
+  Profiles["Managed profiles and import policy"]
+  Navigation["Target and navigation validation"]
+  Runner["Managed runner"]
+  Daemon["TypeScript daemon readiness"]
+  Evidence["Provider contract evidence"]
+
+  Module --> Registry
+  Registry --> CLI
+  Registry --> Profiles
+  Registry --> Navigation
+  Registry --> Runner
+  Registry --> Daemon
+  Registry --> Evidence
+```
+
+```mermaid
+classDiagram
+  class ProviderRegistry {
+    -providersById
+    -providersByOrigin
+    +list()
+    +resolve()
+    +require()
+    +matchUrl()
+    +canonicalTarget()
+  }
+
+  class BaseProvider {
+    +descriptor
+    +navigation
+    +resolveSession()
+    +prepareAction()
+    +executeAction()
+    +observeAction()
+    +inspectCapabilities()
+  }
+
+  class ChatGptProvider
+  class ClaudeProvider
+  class GeminiProvider
+  class GrokProvider
+  class FutureProvider
+
+  class ProviderSessionCapability
+  class PromptCapability
+  class ResponseCapability
+  class ProviderCapabilitySet
+
+  ProviderRegistry --> BaseProvider
+  BaseProvider <|-- ChatGptProvider
+  BaseProvider <|-- ClaudeProvider
+  BaseProvider <|-- GeminiProvider
+  BaseProvider <|-- GrokProvider
+  BaseProvider <|-- FutureProvider
+  BaseProvider *-- ProviderSessionCapability
+  BaseProvider *-- PromptCapability
+  BaseProvider *-- ResponseCapability
+  BaseProvider *-- ProviderCapabilitySet
+```
+
+## Proposed Source Layout
+
+```text
+packages/cli/src/providers/
+├── contracts.ts
+├── action-catalog.ts
+├── base-provider.ts
+├── provider-registry.ts
+├── provider-navigation.ts
+├── capability-set.ts
+│
+├── capabilities/
+│   ├── session.ts
+│   ├── prompt.ts
+│   ├── response.ts
+│   ├── choices.ts
+│   ├── attachments.ts
+│   ├── workspace.ts
+│   ├── image-generation.ts
+│   └── diagnostics.ts
+│
+├── dom/
+│   ├── dom-locators.ts
+│   ├── dom-evidence.ts
+│   └── dom-provider-tools.ts
+│
+├── chatgpt-provider.ts
+├── claude-provider.ts
+├── gemini-provider.ts
+├── grok-provider.ts
+└── index.ts
+```
+
+Files should remain deep enough to hide meaningful behavior. Do not split every selector strategy or one-method helper into a separate shallow module.
+
+## Provider Descriptor
+
+The descriptor contains stable provider identity and policy. It does not expose the provider's complete DOM implementation.
+
+```ts
+export type ProviderStage =
+  | 'experimental'
+  | 'supported'
+  | 'disabled'
+
+export type ProviderDescriptor<TId extends string> = Readonly<{
+  id: TId
+  label: string
+  stage: ProviderStage
+  setupOrder: number
+
+  navigation: {
+    homeUrl: string
+    origins: readonly string[]
+    trustedSignInOrigins: readonly {
+      origin: string
+      pathPrefixes?: readonly string[]
+    }[]
+  }
+
+  profileImport: {
+    cookieDomains: readonly string[]
+  }
+}>
+```
+
+The descriptor becomes the only production source for:
+
+- provider ID;
+- label;
+- support stage;
+- setup order;
+- canonical home URL;
+- approved origins;
+- trusted sign-in origins; and
+- profile-import cookie domains.
+
+Provider selectors, account-tier interpretation, prompt strategies, and response semantics remain private to the provider's capability implementations.
+
+## Provider Navigation Policy
+
+`ProviderNavigationPolicy` is an immutable value object constructed from the descriptor.
+
+```ts
+export class ProviderNavigationPolicy {
+  constructor(
+    definition: ProviderDescriptor<string>['navigation'],
+  )
+
+  homeTarget(): CanonicalProviderTarget
+
+  canonicalTarget(
+    value?: unknown,
+  ): CanonicalProviderTarget
+
+  classify(
+    value: unknown,
+  ): ProviderNavigationClassification
+
+  assertCurrentPageAllowed(
+    value: unknown,
+  ): CanonicalProviderTarget
+}
+```
+
+Classification is explicit:
+
+```ts
+export type ProviderNavigationClassification =
+  | {
+      kind: 'approved'
+      target: CanonicalProviderTarget
+    }
+  | {
+      kind: 'trusted_sign_in'
+      origin: string
+    }
+  | {
+      kind: 'rejected'
+      reason: 'invalid_url' | 'unsupported_provider_navigation'
+    }
+```
+
+The policy enforces:
+
+- HTTPS;
+- no username or password;
+- no unexpected port;
+- bounded input length;
+- canonical paths;
+- approved provider origins;
+- explicit trusted sign-in origins; and
+- provider-origin pairing.
+
+Runtime, job validation, checkpoint recovery, conversation continuation, and browser visibility switching must all call the same policy.
+
+## Typed Provider Actions
+
+The wire envelope and validated internal action are different types.
+
+```ts
+export type VisibleActionEnvelope = {
+  protocol: string
+  requestId: string
+  provider: string
+  action: string
+  payload: unknown
+}
+```
+
+Validation converts the envelope into a discriminated union:
+
+```ts
+export type ProviderActionRequest =
+  | {
+      action: 'prompt.input'
+      payload: { text: string }
+    }
+  | {
+      action: 'prompt.clear'
+      payload: Record<never, never>
+    }
+  | {
+      action: 'prompt.submit'
+      payload: Record<never, never>
+    }
+  | {
+      action: 'response.read'
+      payload: Record<never, never>
+    }
+  | {
+      action: 'file.upload'
+      payload: { attachments: readonly AttachmentInput[] }
+    }
+  | {
+      action: 'workspace.ensure'
+      payload: WorkspaceEnsureRequest
+    }
+```
+
+Capability implementations never receive unvalidated `Record<string, unknown>` payloads.
+
+## Action Catalog
+
+The existing gated, mutating, and reconstructable action sets become one typed catalog.
+
+```ts
+export type ActionMutation =
+  | 'read'
+  | 'reconstructable'
+  | 'non_replayable'
+
+export type ActionCompletion =
+  | 'immediate'
+  | 'provider_response'
+  | 'long_running'
+
+export type ProviderActionDefinition = Readonly<{
+  action: VisibleAction
+  gated: boolean
+  mutation: ActionMutation
+  completion: ActionCompletion
+  requiredCapability: ProviderCapabilityId
+}>
+```
+
+Example:
+
+```ts
+export const ACTION_CATALOG = {
+  'auth.status': {
+    action: 'auth.status',
+    gated: false,
+    mutation: 'read',
+    completion: 'immediate',
+    requiredCapability: 'session.inspect',
+  },
+
+  'prompt.input': {
+    action: 'prompt.input',
+    gated: true,
+    mutation: 'reconstructable',
+    completion: 'immediate',
+    requiredCapability: 'conversation.core',
+  },
+
+  'prompt.submit': {
+    action: 'prompt.submit',
+    gated: true,
+    mutation: 'non_replayable',
+    completion: 'provider_response',
+    requiredCapability: 'conversation.core',
+  },
+
+  'file.upload': {
+    action: 'file.upload',
+    gated: true,
+    mutation: 'reconstructable',
+    completion: 'immediate',
+    requiredCapability: 'attachment.file',
+  },
+} satisfies Record<VisibleAction, ProviderActionDefinition>
+```
+
+The runner uses this catalog for gating, checkpoint safety, replay policy, and completion behavior. Adding a provider never changes the action catalog. Adding a genuinely new provider-neutral action changes it once.
+
+## Base Provider
+
+### External interface
+
+The external interface remains intentionally small:
+
+```ts
+export abstract class BaseProvider<TId extends string> {
+  readonly descriptor: ProviderDescriptor<TId>
+  readonly navigation: ProviderNavigationPolicy
+
+  public get id(): TId
+
+  public resolveSession(
+    context: ProviderExecutionContext,
+    options: ProviderSessionOptions,
+  ): Promise<ProviderSessionResolution>
+
+  public prepareAction(
+    context: ProviderExecutionContext,
+    request: ProviderActionRequest,
+  ): Promise<ProviderActionPreparation | null>
+
+  public executeAction(
+    context: ProviderExecutionContext,
+    request: ProviderActionRequest,
+    preparation?: ProviderActionPreparation,
+  ): Promise<ProviderActionResult>
+
+  public observeAction(
+    context: ProviderExecutionContext,
+    request: ProviderActionRequest,
+    preparation: ProviderActionPreparation | null,
+  ): Promise<ProviderActionObservation>
+
+  public inspectCapabilities(
+    context: ProviderExecutionContext,
+  ): Promise<CapabilityInspectResult>
+}
+```
+
+The runner depends on this interface rather than concrete providers, selectors, or account strategies.
+
+### Construction
+
+```ts
+export type BaseProviderOptions<TId extends string> = {
+  descriptor: ProviderDescriptor<TId>
+  session: ProviderSessionCapability
+  prompt: PromptCapability
+  response: ResponseCapability
+  optionalCapabilities?: readonly ProviderActionCapability[]
+}
+```
+
+```ts
+export abstract class BaseProvider<TId extends string> {
+  readonly descriptor: ProviderDescriptor<TId>
+  readonly navigation: ProviderNavigationPolicy
+
+  private readonly sessionCapability: ProviderSessionCapability
+  private readonly promptCapability: PromptCapability
+  private readonly responseCapability: ResponseCapability
+  private readonly capabilitySet: ProviderCapabilitySet
+
+  protected constructor(options: BaseProviderOptions<TId>) {
+    this.descriptor = options.descriptor
+    this.navigation = new ProviderNavigationPolicy(
+      options.descriptor.navigation,
+    )
+    this.sessionCapability = options.session
+    this.promptCapability = options.prompt
+    this.responseCapability = options.response
+    this.capabilitySet = ProviderCapabilitySet.create(
+      options.optionalCapabilities ?? [],
+    )
+  }
+}
+```
+
+Construction validates:
+
+- provider ID format;
+- home URL ownership;
+- unique capability IDs;
+- unique action handlers;
+- mandatory capabilities;
+- descriptor/provider identity agreement;
+- support-stage requirements; and
+- complete advertised capability state.
+
+### Shared dispatch
+
+`BaseProvider` owns provider-neutral action dispatch:
+
+```ts
+public async executeAction(
+  context: ProviderExecutionContext,
+  request: ProviderActionRequest,
+  preparation?: ProviderActionPreparation,
+): Promise<ProviderActionResult> {
+  context.throwIfAborted()
+  this.navigation.assertCurrentPageAllowed(context.page.url())
+
+  switch (request.action) {
+    case 'auth.status':
+      return await this.sessionCapability.inspectAccount(context)
+
+    case 'prompt.input':
+      return await this.promptCapability.input(
+        context,
+        request.payload.text,
+      )
+
+    case 'prompt.clear':
+      return await this.promptCapability.clear(context)
+
+    case 'prompt.submit':
+      return await this.promptCapability.submit(context)
+
+    case 'response.read':
+      return await this.responseCapability.read(context)
+
+    default:
+      return await this.capabilitySet.execute(context, request)
+  }
+}
+```
+
+The dispatch may branch on provider-neutral action identity. It must never branch on concrete provider identity.
+
+## Mandatory Capabilities
+
+### Provider session capability
+
+`ProviderSessionCapability` owns visible authentication, account, blocker, guest, and composer semantics.
+
+```ts
+export abstract class ProviderSessionCapability {
+  abstract observe(
+    context: ProviderExecutionContext,
+  ): Promise<ProviderSessionObservation>
+
+  abstract inspectAccount(
+    context: ProviderExecutionContext,
+  ): Promise<AuthStatusResult>
+
+  abstract continueAsGuest(
+    context: ProviderExecutionContext,
+  ): Promise<boolean>
+
+  abstract isComposerReady(
+    context: ProviderExecutionContext,
+  ): Promise<boolean>
+
+  async resolve(
+    context: ProviderExecutionContext,
+    options: ProviderSessionOptions,
+  ): Promise<ProviderSessionResolution> {
+    // Shared observation, decision, bounded wait, and guest-continuation flow.
+  }
+}
+```
+
+The default DOM implementation composes explicit strategies:
+
+```ts
+export class DomSessionCapability
+  extends ProviderSessionCapability {
+  constructor(options: {
+    accessPolicy: ProviderAccessPolicy
+    composerLocators: DomLocatorPlan
+    loginLocators: DomLocatorPlan
+    accountLocators: DomLocatorPlan
+    blockerDetector: ProviderBlockerDetector
+    accountInspector: ProviderAccountInspector
+    guestContinuation?: GuestContinuationStrategy
+  })
+}
+```
+
+Account implementations include:
+
+- `MenuTextAccountInspector`;
+- `GoogleAriaAccountInspector`; and
+- `GrokEntitlementAccountInspector`.
+
+This replaces string strategy switches such as `planStrategy === 'grok-entitlements'`.
+
+### Prompt capability
+
+```ts
+export abstract class PromptCapability {
+  abstract isReady(
+    context: ProviderExecutionContext,
+  ): Promise<boolean>
+
+  abstract input(
+    context: ProviderExecutionContext,
+    text: string,
+  ): Promise<PromptInputResult>
+
+  abstract clear(
+    context: ProviderExecutionContext,
+  ): Promise<PromptClearResult>
+
+  abstract submit(
+    context: ProviderExecutionContext,
+  ): Promise<PromptSubmitResult>
+}
+```
+
+The default DOM implementation:
+
+```ts
+export class DomPromptCapability
+  extends PromptCapability {
+  constructor(options: {
+    composer: DomLocatorPlan
+    submit: DomLocatorPlan
+    inputStrategy?: PromptInputStrategy
+    timeoutMs?: number
+  })
+}
+```
+
+Default input behavior:
+
+1. Find a visible composer.
+2. Attempt Playwright `fill()`.
+3. Verify visible DOM value or text.
+4. Re-resolve controls replaced during hydration.
+5. Use real keyboard selection and typing as a fallback.
+6. Verify the final visible value.
+7. Return a stable proof or a structured error.
+
+A provider with a special editor supplies its own `PromptInputStrategy`.
+
+### Response capability
+
+Response completion semantics move out of the runner.
+
+```ts
+export type ProviderResponseCursor = {
+  schema: string
+  value: JsonValue
+}
+
+export type ResponseObservation =
+  | {
+      state: 'pending'
+      visibleProof: string
+    }
+  | {
+      state: 'ready'
+      visibleProof: string
+    }
+  | {
+      state: 'blocked'
+      blockers: readonly VisibleBlocker[]
+    }
+```
+
+```ts
+export abstract class ResponseCapability {
+  abstract captureCursor(
+    context: ProviderExecutionContext,
+  ): Promise<ProviderResponseCursor>
+
+  abstract validateCursor(
+    value: unknown,
+  ): ProviderResponseCursor
+
+  abstract observe(
+    context: ProviderExecutionContext,
+    cursor: ProviderResponseCursor,
+  ): Promise<ResponseObservation>
+
+  abstract read(
+    context: ProviderExecutionContext,
+  ): Promise<ResponseReadResult>
+}
+```
+
+`DomResponseCapability` accepts:
+
+- answer locator plans;
+- busy indicator locator plans;
+- response text readers;
+- citation readers; and
+- completion strategies.
+
+The runner no longer reads `answerSelectors` or `busySelectors`.
+
+## Optional Capability Interface
+
+```ts
+export abstract class ProviderActionCapability {
+  abstract readonly id: ProviderCapabilityId
+  abstract readonly actions: readonly VisibleAction[]
+
+  abstract inspect(
+    context: ProviderExecutionContext,
+  ): Promise<ProviderCapabilityInspection>
+
+  abstract execute(
+    context: ProviderExecutionContext,
+    request: ProviderActionRequest,
+  ): Promise<ProviderActionResult>
+}
+```
+
+```ts
+export class ProviderCapabilitySet {
+  private readonly byId:
+    Map<ProviderCapabilityId, ProviderActionCapability>
+
+  private readonly byAction:
+    Map<VisibleAction, ProviderActionCapability>
+
+  static create(
+    capabilities: readonly ProviderActionCapability[],
+  ): ProviderCapabilitySet
+
+  inspectAll(
+    context: ProviderExecutionContext,
+  ): Promise<CapabilityInspectResult>
+
+  execute(
+    context: ProviderExecutionContext,
+    request: ProviderActionRequest,
+  ): Promise<ProviderActionResult>
+}
+```
+
+The capability set enforces:
+
+- unique capability IDs;
+- unique action ownership;
+- agreement with the action catalog;
+- standardized unsupported results;
+- explicit `available`, `unavailable`, or `unknown`; and
+- no raw error for an absent optional capability.
+
+## Model and Effort Choices
+
+Model and effort selection share one reusable class:
+
+```ts
+export class DomChoiceCapability
+  extends ProviderActionCapability {
+  constructor(options: {
+    capabilityId:
+      | 'model.selection'
+      | 'effort.selection'
+    inspectAction: VisibleAction
+    selectAction: VisibleAction
+    trigger: DomLocatorPlan
+    choiceReader: ChoiceReader
+    choiceSelector: ChoiceSelectionStrategy
+  })
+}
+```
+
+The default reader extracts:
+
+- exact visible label;
+- selected state;
+- enabled state; and
+- optional visible description.
+
+Provider-specific visual entitlement semantics use provider-owned readers, such as `GrokChoiceReader`.
+
+## Attachments, Files, and Input Images
+
+Files and input images share integrity, path, selection, and acceptance behavior. They differ by intent and sometimes by visible route.
+
+```ts
+export type AttachmentIntent =
+  | 'context_file'
+  | 'image_input'
+
+export type AttachmentUploadRequest = {
+  intent: AttachmentIntent
+  attachments: readonly AttachmentInput[]
+}
+```
+
+```ts
+export abstract class AttachmentCapability
+  extends ProviderActionCapability {
+  abstract inspect(
+    context: ProviderExecutionContext,
+    intent: AttachmentIntent,
+  ): Promise<ProviderCapabilityInspection>
+
+  abstract upload(
+    context: ProviderExecutionContext,
+    request: AttachmentUploadRequest,
+  ): Promise<FileUploadResult>
+}
+```
+
+`DomAttachmentCapability` owns:
+
+- safe staged-path resolution;
+- root containment;
+- regular-file verification;
+- name, size, media type, and hash checks;
+- visible upload triggers;
+- visible local-upload menu choices;
+- file chooser operation;
+- generated file inputs where justified;
+- visible filename, chip, preview, or equivalent acceptance proof;
+- `selected` versus `accepted`; and
+- cancellation.
+
+If a provider has separate file and image routes, it supplies two route strategies to the same capability rather than duplicating shared safety behavior.
+
+## Workspace and Project Operations
+
+Provider-neutral callers request outcomes rather than provider UI steps.
+
+```ts
+export abstract class WorkspaceCapability
+  extends ProviderActionCapability {
+  abstract inspect(
+    context: ProviderExecutionContext,
+  ): Promise<ProviderCapabilityInspection>
+
+  abstract ensure(
+    context: ProviderExecutionContext,
+    request: WorkspaceEnsureRequest,
+  ): Promise<WorkspaceEnsureResult>
+
+  abstract updateInstructions(
+    context: ProviderExecutionContext,
+    request: WorkspaceInstructionRequest,
+  ): Promise<WorkspaceInstructionResult>
+}
+```
+
+`ensure()` hides:
+
+- opening the provider's Project or workspace surface;
+- listing or searching resources;
+- resolving exact identity;
+- handling ambiguous duplicate names;
+- creating a resource;
+- selecting or opening it;
+- validating the final provider resource;
+- capturing canonical identity or URL; and
+- reporting conversation fallback honestly.
+
+Implementations may include:
+
+- `ConversationWorkspaceCapability`;
+- `ChatGptWorkspaceCapability`;
+- `ClaudeWorkspaceCapability`;
+- `GeminiWorkspaceCapability`; and
+- `UnsupportedNativeWorkspaceCapability`.
+
+Do not expose `clickCreateProjectButton()` or other UI steps as shared interfaces.
+
+## Image Generation
+
+Image generation is a separate long-running capability rather than an alias for ordinary prompt response.
+
+```ts
+export type ImageGenerationRequest = {
+  prompt: string
+  inputImages: readonly AttachmentInput[]
+  options: {
+    count?: number
+    aspectRatio?: string
+    mode?: string
+  }
+}
+
+export type ImageGenerationCursor = {
+  schema: string
+  value: JsonValue
+}
+```
+
+```ts
+export abstract class ImageGenerationCapability
+  extends ProviderActionCapability {
+  abstract inspect(
+    context: ProviderExecutionContext,
+  ): Promise<ProviderCapabilityInspection>
+
+  abstract prepare(
+    context: ProviderExecutionContext,
+    request: ImageGenerationRequest,
+  ): Promise<ImageGenerationCursor>
+
+  abstract start(
+    context: ProviderExecutionContext,
+    request: ImageGenerationRequest,
+  ): Promise<ImageGenerationStartResult>
+
+  abstract observe(
+    context: ProviderExecutionContext,
+    cursor: ImageGenerationCursor,
+  ): Promise<ImageGenerationObservation>
+
+  abstract read(
+    context: ProviderExecutionContext,
+    cursor: ImageGenerationCursor,
+  ): Promise<ImageGenerationResult>
+}
+```
+
+The first supported implementation must:
+
+- operate visible controls;
+- prove a visibly new image result;
+- preserve input-image acceptance evidence;
+- distinguish pending, blocked, unavailable, and complete;
+- avoid private generation endpoints;
+- use visible download controls when download is supported; and
+- return bounded artifact metadata without leaking browser credentials or hidden URLs.
+
+## Concrete Providers
+
+Concrete providers inherit `BaseProvider` and compose capabilities.
+
+### ChatGPT
+
+```ts
+export class ChatGptProvider
+  extends BaseProvider<'chatgpt'> {
+  constructor() {
+    super({
+      descriptor: CHATGPT_DESCRIPTOR,
+
+      session: new DomSessionCapability({
+        accessPolicy: chatGptAccessPolicy,
+        composerLocators: chatGptComposerLocators,
+        loginLocators: chatGptLoginLocators,
+        accountLocators: chatGptAccountLocators,
+        accountInspector: new MenuTextAccountInspector({
+          freePlans: ['Free'],
+          paidPlans: [
+            'Go',
+            'Plus',
+            'Pro',
+            'Team',
+            'Business',
+            'Enterprise',
+          ],
+        }),
+        blockerDetector: new DomBlockerDetector(
+          chatGptBlockerLocators,
+        ),
+      }),
+
+      prompt: new DomPromptCapability({
+        composer: chatGptComposerLocators,
+        submit: chatGptSubmitLocators,
+      }),
+
+      response: new DomResponseCapability({
+        answers: chatGptAnswerLocators,
+        busyIndicators: chatGptBusyLocators,
+      }),
+
+      optionalCapabilities: [
+        new DomChoiceCapability(chatGptModelOptions),
+        new DomChoiceCapability(chatGptEffortOptions),
+        new DomAttachmentCapability(chatGptAttachmentOptions),
+        new ConversationWorkspaceCapability(),
+      ],
+    })
+  }
+}
+```
+
+### Claude
+
+Claude validates the sign-in-required policy and provider-specific Project behavior while reusing common DOM prompt and response implementations.
+
+### Gemini
+
+Gemini supplies `GoogleAriaAccountInspector` instead of adding a Google-specific branch to shared session code.
+
+### Grok
+
+Grok supplies:
+
+- `GrokEntitlementAccountInspector`;
+- `GrokChoiceReader`; and
+- any Grok-specific visible locator strategies.
+
+No Grok-specific branch remains in shared account, choice, session, or runner implementation.
+
+### Future providers
+
+A future Qwen, Kimi, Zhipu Qingyan, DeepSeek, Doubao, or Yuanbao provider follows the same construction pattern.
+
+If a candidate requires changing `BaseProvider` or shared runner logic to implement a provider-specific behavior, the behavior remains in the candidate's capability implementation instead.
+
+If multiple providers reveal a genuinely shared concept, evolve the shared interface in a separate architecture change with full existing-provider regression evidence.
+
+## Provider Registry
+
+The single registration point is explicit:
+
+```ts
+export const providerInstances = [
+  new ChatGptProvider(),
+  new ClaudeProvider(),
+  new GeminiProvider(),
+  new GrokProvider(),
+] as const
+
+export type ProviderId =
+  typeof providerInstances[number]['id']
+
+export const providerRegistry =
+  ProviderRegistry.create(providerInstances)
+```
+
+The registry interface:
+
+```ts
+export class ProviderRegistry<
+  TProviders extends readonly BaseProvider<string>[],
+> {
+  static create<
+    TProviders extends readonly BaseProvider<string>[],
+  >(
+    providers: TProviders,
+  ): ProviderRegistry<TProviders>
+
+  list(options?: {
+    stages?: readonly ProviderStage[]
+  }): readonly ProviderDescriptor<string>[]
+
+  resolve(
+    value: unknown,
+  ): BaseProvider<string> | null
+
+  require(
+    value: unknown,
+  ): BaseProvider<string>
+
+  matchUrl(
+    value: unknown,
+  ): BaseProvider<string> | null
+
+  canonicalTarget(
+    providerId: string,
+    value?: unknown,
+  ): CanonicalProviderTarget
+}
+```
+
+Construction validates:
+
+- unique provider IDs;
+- origin ownership conflicts;
+- home URL ownership;
+- descriptor/provider ID agreement;
+- stage and baseline consistency;
+- deterministic setup order; and
+- complete provider capability declarations.
+
+Filesystem auto-discovery is intentionally rejected. Explicit registration is deterministic, reviewable, package-safe, and type-safe.
+
+## Runner Interaction
+
+The runner resolves one concrete provider:
+
+```ts
+const provider =
+  providerRegistry.require(request.provider)
+```
+
+Existing direct selector work:
+
+```ts
+countVisibleAnswers(page, provider.answerSelectors)
+hasVisibleBusyIndicator(page, provider.busySelectors)
+anyVisibleComposer(page, provider.composerSelectors)
+resolveProviderSession(page, provider)
+```
+
+becomes provider-interface work:
+
+```ts
+provider.prepareAction(context, action)
+provider.observeAction(context, action, preparation)
+provider.resolveSession(context, options)
+```
+
+The target execution sequence is:
+
+1. Resolve the provider from the registry.
+2. Canonicalize and validate the target through provider navigation policy.
+3. Read gating, mutation, replay, and completion semantics from the action catalog.
+4. Resolve the visible provider session when the action is gated.
+5. Capture read-only preparation state.
+6. Persist the started checkpoint.
+7. Execute the action.
+8. Observe provider completion when required.
+9. Let the runner handle cancellation, timeout, browser visibility switching, and user handoff.
+10. Persist the completed checkpoint.
+11. Return the normalized result.
+
+## Checkpoint and Recovery State
+
+### Initial migration
+
+The first object-oriented migration preserves the existing checkpoint shape and externally observable behavior. A response baseline remains numeric where compatibility requires it, but it is produced and interpreted by `ResponseCapability`.
+
+### General provider action preparation
+
+After behavior parity, version the runner checkpoint to support:
+
+```ts
+export type ProviderActionPreparation = {
+  provider: ProviderId
+  action: VisibleAction
+  schema: string
+  value: JsonValue
+}
+```
+
+This supports:
+
+- response cursors;
+- image generation cursors;
+- long-running provider operations;
+- workspace mutation verification; and
+- future provider-specific continuation state.
+
+Preparation state must be:
+
+- JSON serializable;
+- bounded in bytes;
+- versioned by schema;
+- free of raw DOM;
+- free of credentials and cookies;
+- validated by the owning provider during recovery; and
+- rejected fail-closed when it cannot be trusted.
+
+Non-replayable actions retain strict ambiguity protection. A crash during an uncertain submission never causes automatic duplicate submission.
+
+## TypeScript Daemon Authority
+
+Implementation assumes the TypeScript daemon is the authoritative executor.
+
+Rules:
+
+- do not add provider logic under deleted daemon/runtime paths;
+- do not generate cross-runtime provider catalogs;
+- do not add new providers to deleted runtime allowlists;
+- do not make new provider support depend on platform-specific runtime packages;
+- keep new providers experimental until the TypeScript daemon path has real-boundary proof; and
+- remove remaining stale provider membership from deleted runtime paths.
+
+The TypeScript daemon and embedded browser runtime consume the same registry instance. Readiness reports the same provider set the executor can actually run:
+
+```json
+{
+  "supported_providers": [
+    "chatgpt",
+    "claude",
+    "gemini",
+    "grok"
+  ]
+}
+```
+
+Client behavior:
+
+- submit normally when the target provider is advertised;
+- safely reconcile or restart an owned stale daemon when the provider is not advertised;
+- treat a legacy daemon without provider negotiation as supporting only the explicitly documented legacy set; and
+- never infer provider support solely from job/action protocol overlap.
+
+## Protocol Evolution
+
+The structural refactor preserves existing visible action v1/v2 request and response behavior.
+
+Before the first new provider ships:
+
+1. Preserve existing v1/v2 artifacts unchanged.
+2. Introduce a new request protocol whose provider ID is a bounded extensible string.
+3. Keep request fields closed and typed.
+4. Validate generic HTTPS safety in the machine-readable schema.
+5. Validate provider membership and provider-origin pairing through the runtime registry.
+6. Negotiate supported providers through daemon readiness.
+7. Require the new protocol for newly added providers.
+8. Retain existing-provider compatibility for supported older protocols.
+
+This prevents every future provider addition from mutating an immutable provider enum and host matrix.
+
+## Delivery Plan
+
+### Phase 0: Complete the in-flight daemon refactor
+
+- Land the TypeScript daemon consolidation on `dev`.
+- Make the TypeScript daemon the authoritative execution path.
+- Remove or freeze overlapping deleted-runtime work.
+- Record the observable four-provider baseline.
+- Record current CLI JSON behavior and daemon conformance.
+- Begin provider architecture work only from a clean, integrated state.
+
+Exit: the provider architecture branch does not compete with active daemon lifecycle changes.
+
+### Phase 1: Introduce typed contracts and the action catalog
+
+- Add `providers/contracts.ts`.
+- Separate external wire envelopes from validated internal action unions.
+- Add `providers/action-catalog.ts`.
+- Replace runner-local gated, mutating, and reconstructable sets with catalog metadata.
+- Preserve all existing action names, payloads, results, and replay behavior.
+
+Exit: every action has one exhaustive lifecycle definition and no provider behavior has changed.
+
+### Phase 2: Introduce descriptor, navigation policy, and registry
+
+- Add `ProviderDescriptor`.
+- Add `ProviderNavigationPolicy`.
+- Add `ProviderRegistry`.
+- Move provider identity, label, stage, setup order, home URL, approved origins, trusted sign-in origins, and cookie domains into provider descriptors.
+- Migrate CLI provider normalization to registry lookup.
+- Migrate runtime wake URLs and URL validation.
+- Migrate profile provider validation and import policy.
+- Keep the existing provider module as a temporary compatibility re-export only.
+- Do not edit deleted-runtime provider allowlists.
+
+Exit: TypeScript production code has one provider registration list.
+
+### Phase 3: Introduce `BaseProvider` and mandatory capabilities
+
+- Add `BaseProvider`.
+- Add `ProviderCapabilitySet`.
+- Extract shared DOM locator and evidence behavior.
+- Add session, prompt, and response capability classes.
+- Move session observation, account inspection, blockers, guest continuation, prompt input, prompt clear, prompt submit, response observation, response reading, and citations behind the provider seam.
+- Replace runner selector access with provider methods.
+- Preserve checkpoint and wire behavior.
+
+Exit: a `BaseProvider` instance can perform the complete baseline conversation workflow and the runner reads no provider selectors.
+
+### Phase 4: Convert the existing providers
+
+Convert in this order:
+
+1. ChatGPT as the reference implementation.
+2. Claude to prove sign-in-required policy.
+3. Gemini to prove custom account inspection.
+4. Grok to prove custom entitlement and choice behavior.
+
+For each provider:
+
+- create the concrete subclass;
+- compose mandatory capabilities;
+- run provenance-bound browser coverage;
+- run built CLI and daemon integration;
+- replace its registry entry; and
+- delete the superseded implementation rather than retaining permanent parallel paths.
+
+Exit: all four providers are `BaseProvider` subclasses and shared modules contain no provider-ID conditionals.
+
+### Phase 5: Extract optional capabilities
+
+Extract in this order:
+
+1. model choices;
+2. effort choices;
+3. file and input-image attachments;
+4. conversation workspace fallback;
+5. diagnostics and sanitized snapshots.
+
+Move corresponding behavior out of the monolithic DOM adapter. Standardize capability inspection and unavailable outcomes.
+
+Exit: the existing provider DOM adapter is deleted or reduced to a temporary re-export with no implementation ownership.
+
+### Phase 6: Generalize checkpoint preparation
+
+- Move response cursor creation and interpretation fully into `ResponseCapability`.
+- Add provider-owned action preparation state.
+- Version the runner checkpoint.
+- Validate provider preparation state on recovery.
+- Generalize completion observation for response, image, and future long-running actions.
+- Preserve strict non-replayable action safety.
+
+Exit: the runner orchestrates lifecycle without understanding provider DOM completion semantics.
+
+### Phase 7: Add workspace and image contracts
+
+Keep these user-visible changes separate from the structural refactor.
+
+Workspace:
+
+- exact native identity;
+- ensure;
+- select/open as internal steps;
+- instruction update;
+- visible final postcondition; and
+- explicit conversation fallback.
+
+Images:
+
+- input-image acceptance;
+- generation preparation;
+- visible start;
+- completion observation;
+- visible result collection; and
+- visible download where proven.
+
+Exit: each advertised advanced capability has real visible-session proof and a changeset.
+
+### Phase 8: Add TypeScript daemon provider negotiation
+
+- Return `supported_providers` from readiness using the runtime registry.
+- Verify provider support before job submission.
+- safely reconcile owned stale daemons;
+- remove remaining deleted-runtime provider knowledge;
+- introduce the extensible provider request protocol; and
+- prove cross-version behavior.
+
+Exit: an old daemon cannot silently accept a provider it cannot execute.
+
+### Phase 9: Prove the seam with the first new provider
+
+Implement the highest-ranked candidate from the provider expansion roadmap.
+
+Expected production changes:
+
+- the provider subclass;
+- one registry line; and
+- no shared provider execution logic.
+
+Expected non-production changes:
+
+- real evidence;
+- focused browser E2E;
+- documentation;
+- capability matrix; and
+- changeset.
+
+Exit: a new provider closes the baseline through the built CLI without modifying `BaseProvider`, the runner, runtime allowlists, profile allowlists, or shared capability semantics.
+
+### Phase 10: Remove compatibility shims
+
+- Delete old provider config exports.
+- Delete old adapter registry exports.
+- Delete duplicated URL helpers.
+- Delete provider-specific strategy strings.
+- Delete stale test helper provider tables where runtime metadata can be consumed safely.
+- Update architecture documentation.
+- Keep explicit test expectations where they represent evidence rather than production registration logic.
+
+Exit: there is one provider seam, one registry, and no shadow source of truth.
+
+## Migration Map
+
+| Current responsibility | Target owner |
+| --- | --- |
+| Provider IDs and labels | Concrete provider descriptors |
+| Home URLs and approved hosts | `ProviderNavigationPolicy` |
+| Trusted sign-in navigation | `ProviderNavigationPolicy` |
+| Setup ordering | Provider descriptor |
+| Profile cookie domains | Provider descriptor |
+| Action gating and replay sets | `ACTION_CATALOG` |
+| Session observation and decisions | `ProviderSessionCapability` |
+| Account plan strategy strings | Account inspector classes |
+| Composer input and clear | `PromptCapability` |
+| Submit control | `PromptCapability` |
+| Answer count and busy state | `ResponseCapability` |
+| Response text and citations | `ResponseCapability` |
+| Model and effort choices | `DomChoiceCapability` |
+| Grok disabled-choice semantics | `GrokChoiceReader` |
+| File and image input | `AttachmentCapability` |
+| Workspace fallback/native behavior | `WorkspaceCapability` |
+| Image generation | `ImageGenerationCapability` |
+| Provider dispatch | `ProviderRegistry` and `BaseProvider` |
+| Supported provider readiness | TypeScript daemon from registry |
+
+## Verification Strategy
+
+Repository testing rules apply throughout:
+
+- no unit tests;
+- no mocked visible sessions;
+- no fake pages, locators, browser contexts, runners, or daemons;
+- no invented provider DOM;
+- no source-string tests that assert implementation shape; and
+- no hidden provider APIs.
+
+### Structural phases
+
+Run:
+
+```text
+npm run lint
+npm test
+npm run test:ts-daemon-conformance
+```
+
+Verify through:
+
+- the built CLI process;
+- the real TypeScript daemon;
+- the real filesystem;
+- a real local Chromium session; and
+- provenance-bound captured provider DOM where allowed.
+
+### Provider baseline contract
+
+Every provider must prove:
+
+- approved target navigation;
+- trusted sign-in navigation classification;
+- signed-out state;
+- authenticated account evidence;
+- guest policy;
+- stable composer readiness;
+- visible prompt input;
+- visible prompt clear;
+- visible submit control;
+- visibly new response completion;
+- normalized response text and citations;
+- challenge and terminal blockers;
+- timeout and cancellation behavior; and
+- same-scope conversation continuation.
+
+### Optional capability coverage
+
+Where advertised:
+
+- model inspection and exact selection;
+- effort inspection and exact selection;
+- visible file acceptance;
+- visible input-image acceptance;
+- exact workspace identity;
+- native workspace creation or explicit fallback;
+- workspace instruction update;
+- image generation start;
+- image generation completion; and
+- visible image result collection.
+
+### Live compatibility matrix
+
+A provider moves from `experimental` to `supported` only after gated real-session coverage proves the baseline in appropriate account states.
+
+The full existing-provider matrix runs before:
+
+- removing the old provider path;
+- changing a shared capability interface;
+- changing checkpoint semantics;
+- changing provider navigation rules; or
+- promoting a new provider.
+
+## Release and Documentation
+
+Pure structural phases do not need a changeset when externally observable behavior is unchanged.
+
+Add a changeset for:
+
+- a new provider;
+- a new visible action;
+- a newly available provider capability;
+- changed CLI output;
+- changed fallback semantics; or
+- changed compatibility requirements.
+
+Keep paired user-facing documentation aligned:
+
+- `README.md` and `README.zh-CN.md`;
+- `COMMANDS.md` and `COMMANDS.zh-CN.md`; and
+- package-level user documentation where applicable.
+
+Internal architecture and roadmap documentation may remain English.
+
+## Acceptance Criteria
+
+- Every provider is a concrete `BaseProvider` subclass.
+- `BaseProvider` defines the mandatory provider execution skeleton.
+- Session, prompt, and response are mandatory capabilities.
+- Model, effort, attachment, workspace, image, and diagnostic behavior are capability classes.
+- The runner depends only on the provider seam and action lifecycle metadata.
+- The runner reads no provider selectors.
+- Shared code contains no concrete provider-ID conditionals.
+- TypeScript production code has one explicit provider registration list.
+- Provider identity, origin, setup order, profile policy, and support stage come from the registry.
+- Provider navigation validation is reused by CLI, jobs, runner, checkpoints, and continuation.
+- Grok-specific behavior exists only in Grok-owned implementations.
+- Unsupported capabilities return explicit machine-readable states.
+- Existing provider wire behavior remains compatible through structural migration.
+- Existing providers pass the same real-boundary baseline after every shared change.
+- TypeScript daemon readiness reports providers from the same registry used for execution.
+- Deleted runtime paths contain no new provider architecture.
+- A first new provider closes the baseline without changing shared production logic.
+
+## Risks and Responses
+
+| Risk | Response |
+| --- | --- |
+| `BaseProvider` becomes a god class | Keep the external interface small and compose optional capability classes |
+| Capability interfaces become speculative | Add shared capability semantics only with multi-provider visible evidence |
+| Provider-specific behavior leaks into shared code | Use provider-owned strategies and reject concrete provider-ID conditionals |
+| Registry becomes a giant selector table | Store implementation inside provider modules, not the descriptor |
+| Runner still understands provider DOM | Move readiness, response cursor, and completion observation behind the provider seam |
+| Structural refactor changes behavior | Migrate in phases, preserve wire contracts, and run real-boundary coverage after every provider conversion |
+| New provider mutates immutable schemas | Use an extensible provider request protocol plus runtime registry validation |
+| Old daemon appears compatible but lacks a provider | Negotiate `supported_providers` from the authoritative TypeScript registry |
+| Deleted-runtime transition creates duplicate sources of truth | Freeze deleted-runtime provider knowledge and do not create cross-runtime registry generation |
+| Advanced capability claims parity without proof | Keep capability states explicit and require visible final postconditions |
+
+## Non-Goals
+
+- A base class with abstract methods for every possible future provider feature
+- Requiring every provider to implement unsupported Project or image operations
+- Automatic provider fallback after failure
+- Provider selection based only on model popularity
+- Filesystem scanning for provider classes
+- Runtime installation of untrusted provider code
+- Shared conditional logic keyed by provider ID
+- Hidden API access
+- Mock-based visible-provider verification
+- Changing all provider protocols and advanced capabilities in one structural pull request
diff --git a/docs/roadmaps/archived/P1-daemon-fastify-http-api.md b/docs/roadmaps/archived/P1-daemon-fastify-http-api.md
new file mode 100644
index 0000000..a540bcd
--- /dev/null
+++ b/docs/roadmaps/archived/P1-daemon-fastify-http-api.md
@@ -0,0 +1,254 @@
+# Daemon Fastify HTTP API
+
+Status: cancelled | Priority: P1
+
+Disposition: cancelled after the daemon v1 clean break removed the remote-worker
+HTTP surface and kept the small built-in Node HTTP server. Adding Fastify would
+increase the protocol and dependency surface without serving a current product
+need. This document is preserved as historical design context only.
+
+Depends on: Local daemon job persistence, claim leases, the Tokenless Daemon API v1 OpenAPI contract, and embedded browser-runtime supervision
+
+## Outcome
+
+The Tokenless daemon exposes its existing durable asynchronous job workflow through a maintainable Fastify server. Trusted local callers can submit a job over HTTP, poll one stable job resource, observe coarse durable status, and retrieve the final provider result after completion.
+
+The first supported interaction model is deliberately simple:
+
+1. create a job with `POST /jobs`;
+2. retain the returned `job_id`;
+3. poll `GET /jobs/{job_id}`;
+4. continue while the job is non-terminal;
+5. handle `waiting_for_user` through the returned blocker; and
+6. read the complete result or error from the terminal job.
+
+Fastify replaces the bare `node:http` routing implementation. It does not replace the SQLite job store, runner ownership model, claim fencing, provider action protocol, or visible provider execution boundary.
+
+## Decision Summary
+
+- Use Fastify for daemon routing, request lifecycle, schema integration, authentication hooks, and graceful shutdown.
+- Keep ordinary HTTP request/response semantics for job creation and polling.
+- Treat SQLite job state as the durable source of truth.
+- Keep the existing daemon API paths, status codes, authentication, and error envelopes compatible during the migration.
+- Report provider work coarsely as `running`; do not claim token-level, percentage, or partial-response progress.
+- Return the provider response only after the job reaches `succeeded`.
+- Do not add SSE, WebSocket, DOM response streaming, provider-network interception, or provider-specific streaming adapters in this roadmap.
+
+## Current Behavior Audit
+
+The daemon already provides the required product foundations:
+
+- `POST /jobs` creates a durable job and wakes the embedded Playwright runtime when required.
+- `GET /jobs/{job_id}` returns a public job view.
+- `GET /jobs` lists public job views with status, backend, profile, provider, task, and limit filters.
+- Jobs persist request, result, error, blocker, checkpoint, resume state, and timestamps in SQLite.
+- Public job views omit claim tokens, runner checkpoints, resume payloads, and claim-expiry internals.
+- The runner transitions jobs through `queued`, `claimed`, `running`, `waiting_for_user`, and terminal states.
+- The current client waits by polling `GET /jobs/{job_id}` every 250 milliseconds by default.
+- The daemon binds only to loopback and protects job and control routes with the home-scoped bearer token.
+- `/health` and challenge-bound `/ready` behavior are already defined by the OpenAPI contract and cross-version conformance tests.
+
+The missing piece is not asynchronous execution. It is a maintainable HTTP implementation and an explicitly supported polling contract for callers outside the CLI command path.
+
+## Polling Contract
+
+### Job Creation
+
+`POST /jobs` retains its existing request and response semantics for protocol compatibility. The migration does not change the successful response from `200` to `202`, rename fields, introduce a new path prefix, or remove the claim token required by existing producer and worker flows.
+
+A future caller-specific facade may adopt `202 Accepted` and omit internal ownership material, but it must be introduced through an explicit Tokenless Daemon API revision rather than silently changing existing responses.
+
+### Job Read
+
+`GET /jobs/{job_id}` remains the canonical polling resource. Its public response contains:
+
+- stable job identity and execution scope;
+- current durable status;
+- the original request;
+- `blocker_json` when user intervention is required;
+- `result_json` after successful completion;
+- `error_json` after failure, cancellation, or timeout; and
+- creation and last-update timestamps.
+
+Responses should include `Cache-Control: no-store`. A non-terminal response may include a conservative `Retry-After` hint without changing the JSON contract.
+
+### Status Semantics
+
+| Status | Caller meaning |
+| --- | --- |
+| `queued` | The job is durably admitted and waiting for an eligible runner. |
+| `claimed` | A runner owns a live lease and is preparing execution. |
+| `running` | Visible provider work is in progress; no partial answer is promised. |
+| `waiting_for_user` | Execution requires explicit user action described by `blocker_json`. |
+| `succeeded` | The complete provider result is available in `result_json`. |
+| `failed` | Execution ended with an error in `error_json`. |
+| `canceled` | Cancellation was durably confirmed. |
+| `timed_out` | Execution exceeded its supported time boundary. |
+
+Callers must treat the terminal states as authoritative. They must not infer provider completion from elapsed time, response length, browser visibility, or provider-specific DOM behavior.
+
+## Fastify Architecture
+
+### Server Lifecycle
+
+The daemon owns one Fastify instance and continues to expose the underlying Node server where existing lifecycle code or integration tests require it.
+
+- Validate the configured host before listening and reject non-loopback binds.
+- Configure the existing two-megabyte HTTP body limit.
+- Start with `fastify.listen({ host, port })`.
+- Stop accepting new requests with `fastify.close()`.
+- Coordinate browser-runtime quiescence, Fastify shutdown, and `JobStore` closure without abandoning active ownership recovery.
+- Preserve signal and authenticated `/control/shutdown` behavior.
+
+### Route Organization
+
+Split the current monolithic request dispatcher into bounded Fastify plugins:
+
+```text
+packages/cli/src/daemon/
+├── server.ts
+├── auth.ts
+├── schemas.ts
+└── routes/
+    ├── health.ts
+    ├── jobs.ts
+    └── control.ts
+```
+
+- `health.ts` owns unauthenticated `/health` and `/ready`.
+- `jobs.ts` owns job creation, listing, lookup, claim, completion, and resume.
+- `control.ts` owns browser-runtime control, worker claim-next, lifecycle mutations, cancellation, and shutdown.
+- `auth.ts` owns bearer parsing and delegates constant-time verification to `JobStore`.
+- `schemas.ts` owns transport-level parameter, query, body, and response schemas.
+
+Domain rules remain outside Fastify handlers. `JobStore` continues to enforce state transitions, claim tokens, leases, execution-backend constraints, and durable persistence.
+
+### Validation and Errors
+
+Fastify schemas should reject malformed transport shapes and prevent accidental response-field disclosure. Existing domain validators remain responsible for semantics that require stable Tokenless error codes.
+
+The server must normalize:
+
+- invalid or missing JSON;
+- oversized bodies;
+- invalid path and query parameters;
+- missing or rejected bearer tokens;
+- unknown routes;
+- state conflicts;
+- missing jobs; and
+- unexpected internal failures
+
+into the existing status codes and documented error envelope. Fastify default error payloads must not leak through compatibility routes.
+
+### API Source of Truth
+
+`api/tokenless-daemon-api.openapi.json` remains the implemented HTTP contract. Fastify route schemas and serializers must stay aligned with it.
+
+This archived roadmap predates the clean-break OpenAPI simplification. Any later caller-specific API or richer progress resource requires an explicit Tokenless Daemon API revision.
+
+## Security Boundary
+
+This remains a local-loopback control plane, not a remotely exposed web service.
+
+- Bind only to verified loopback hosts.
+- Require the daemon bearer token on every non-diagnostic route.
+- Do not enable wildcard CORS.
+- Do not place bearer tokens in URLs.
+- Do not expose claim tokens, checkpoints, resume payloads, credentials, or private browser state through public job reads.
+- Do not infer that adopting Fastify authorizes LAN, public Internet, or hosted-browser access.
+
+A future local web UI or remote companion integration must define its own origin, session, CSRF, and least-privilege authorization model.
+
+## Delivery Phases
+
+### Phase 0: Freeze Observable HTTP Behavior
+
+- Record the current route, status, authentication, body-limit, response, error, readiness, and shutdown behavior in real daemon-process integration tests.
+- Identify every cross-version client expectation before changing the server implementation.
+- Document polling as the supported asynchronous result flow.
+
+Exit: the existing daemon behavior has real-process conformance coverage sufficient to detect a transport regression.
+
+### Phase 1: Introduce Fastify with Route Parity
+
+- Add Fastify as a runtime dependency.
+- Replace the manual `node:http` dispatcher with the Fastify lifecycle.
+- Register health, job, and control route plugins.
+- Preserve loopback enforcement, body limits, authentication, and graceful shutdown.
+- Keep request and response JSON unchanged.
+
+Exit: the full current daemon conformance suite passes against Fastify without client changes.
+
+### Phase 2: Schema and Error Hardening
+
+- Add route schemas for parameters, queries, bodies, and responses.
+- Add response serializers that prevent internal job fields from crossing public routes.
+- Normalize Fastify parse, validation, body-limit, not-found, and internal errors into the existing daemon contract.
+- Add `Cache-Control: no-store` and an optional polling hint where compatible.
+
+Exit: malformed, unauthorized, oversized, conflicting, and successful requests produce the documented stable contract through a built daemon process.
+
+### Phase 3: Public Polling Documentation
+
+- Document authenticated local HTTP submission and polling for both Chinese-speaking and English-speaking users.
+- Provide minimal `curl`, Node `fetch`, and terminal-state examples without exposing the bearer token in logs or URLs.
+- Explain that `running` is coarse provider progress and that only `succeeded` contains a complete response.
+- Add a changeset because the supported external CLI/daemon surface becomes user-visible.
+
+Exit: a trusted local caller can implement the full asynchronous flow from public documentation without relying on CLI internals.
+
+## Acceptance Criteria
+
+- The daemon HTTP implementation uses Fastify and no longer contains a manual method-and-path dispatcher.
+- Existing Tokenless Daemon API v1 clients continue to operate without request or response changes.
+- `POST /jobs` durably creates a job and returns before visible provider completion.
+- `GET /jobs/{job_id}` returns the latest durable state throughout execution.
+- Polling observes `waiting_for_user` blockers and every terminal outcome.
+- `succeeded` returns the same complete managed provider result consumed by the CLI.
+- Public job reads never expose claim tokens, checkpoints, resume payloads, or claim-expiry internals.
+- Non-loopback binding remains rejected.
+- Missing and rejected authentication remain distinguishable under the existing error contract.
+- Shutdown closes HTTP admission, browser-runtime work, and SQLite ownership in the documented order.
+- Focused integration tests exercise the built daemon process, real HTTP socket, real filesystem, and real SQLite store without mocks, fakes, Fastify injection, or source-string assertions.
+- Cross-version conformance passes in every supported client/daemon direction.
+
+## Required Evidence
+
+| Scenario | Observable proof |
+| --- | --- |
+| Create and poll | A real HTTP client creates a job, polls the same id, and observes durable status. |
+| Successful completion | A managed job reaches `succeeded` and returns its complete `result_json`. |
+| User handover | Polling exposes `waiting_for_user` and the durable blocker without creating a replacement job. |
+| Failure and cancellation | Polling returns the correct terminal status and error payload. |
+| Daemon restart | A persisted job remains queryable from the restarted built daemon. |
+| Authentication | Missing and invalid bearer tokens are rejected; diagnostic routes remain available as documented. |
+| Body limit | Oversized and malformed requests preserve the documented response semantics. |
+| Compatibility | Historical supported clients operate against the Fastify daemon and the current client operates against historical supported daemons. |
+| Shutdown | Authenticated shutdown stops new admission and closes runtime and store resources cleanly. |
+
+Provider browser E2E coverage is not required solely to prove the Fastify transport migration because provider execution behavior is unchanged. Existing gated real-provider suites remain the authority for visible provider completion.
+
+## Risks and Responses
+
+| Risk | Response |
+| --- | --- |
+| Fastify defaults change status codes or error bodies | Install a Tokenless error handler and verify exact real-socket conformance. |
+| Schema serializers drop compatibility fields | Compare every success response against the OpenAPI fixtures through the built daemon. |
+| Fastify shutdown races browser-runtime recovery | Keep one daemon-owned close sequence and exercise active-job shutdown. |
+| Runtime dependency size or startup time increases | Measure packaged startup and retain only Fastify core for this roadmap. |
+| Callers poll too aggressively | Document a conservative interval and provide a compatible `Retry-After` hint. |
+| `running` is mistaken for precise provider progress | Define it explicitly as coarse visible-provider execution with no partial-result promise. |
+| A local HTTP API is mistaken for a public web API | Preserve loopback-only binding, bearer authentication, and default-deny cross-origin behavior. |
+
+## Non-Goals
+
+- Server-Sent Events
+- WebSocket
+- Streaming or partial AI responses
+- DOM mutation observation or periodic response extraction
+- Provider-specific progress percentages
+- Interception of provider network traffic or private APIs
+- Remote, LAN, or public daemon binding
+- A hosted web application authentication model
+- A new job database or queue implementation
+- Changes to provider action execution or completion detection
diff --git a/docs/roadmaps/archived/README.md b/docs/roadmaps/archived/README.md
new file mode 100644
index 0000000..ce33a8a
--- /dev/null
+++ b/docs/roadmaps/archived/README.md
@@ -0,0 +1,28 @@
+# Archived Roadmaps
+
+This directory contains roadmaps that are completed, superseded, cancelled, or no longer planned.
+
+Archived roadmaps are retained as decision history and are not active product commitments. Each archived roadmap must state its disposition near the top:
+
+- `completed`, including the completion date or release when known;
+- `superseded`, with a link to the replacement roadmap;
+- `cancelled`, with a concise reason; or
+- `retired`, with a concise explanation of why the direction is no longer planned.
+
+When archiving a roadmap:
+
+- add it to the archive section of the parent [roadmap index](../README.md);
+- update all repository links to its new path;
+- add or update its disposition note; and
+- preserve its historical content unless correcting an objective factual error.
+
+An archived roadmap may return to the parent directory only when the direction is explicitly reactivated and its assumptions and acceptance criteria have been reviewed.
+
+Archived roadmap filenames retain the `P0-` through `P3-` product-priority prefix declared in the document.
+
+## Archived Roadmaps
+
+| Roadmap | Disposition |
+| --- | --- |
+| [Daemon Fastify HTTP API](P1-daemon-fastify-http-api.md) | Cancelled 2026-07-27 after the daemon v1 clean break kept the smaller built-in HTTP server and moved worker coordination in-process. |
+| [Provider Architecture and Registry](P0-provider-architecture-and-registry.md) | Completed 2026-07-27 after the OOP provider seam, single registry, daemon negotiation, compatibility cleanup, and first new-provider proof were accepted. |
diff --git a/docs/roadmaps/backlog/README.md b/docs/roadmaps/backlog/README.md
new file mode 100644
index 0000000..f9a97d6
--- /dev/null
+++ b/docs/roadmaps/backlog/README.md
@@ -0,0 +1,18 @@
+# Roadmap Backlog
+
+This directory contains accepted product or engineering roadmap ideas that are intentionally not active.
+
+The directory is the lifecycle source of truth. A roadmap belongs here when its direction remains potentially valuable but the repository is not currently committing planning or implementation attention to it. Backlog placement is not a delivery promise; the required `P0-` through `P3-` filename prefix records product importance, not active sequencing.
+
+When adding or moving a roadmap here:
+
+- add it to the backlog section of the parent [roadmap index](../README.md);
+- update all repository links to its new path;
+- make its lifecycle note consistent with backlog placement; and
+- retain its outcome, context, constraints, and prior decisions.
+
+Move a roadmap back to the parent directory when it becomes active. Move it to [`../archived/`](../archived/README.md) when it is completed, superseded, cancelled, or no longer planned.
+
+## Backlogged Roadmaps
+
+None.
diff --git a/legacy/README.md b/legacy/README.md
deleted file mode 100644
index 64f9bf4..0000000
--- a/legacy/README.md
+++ /dev/null
@@ -1,9 +0,0 @@
-# Legacy Tokenless path
-
-This directory archives the former browser-extension and Chrome Native Messaging host path.
-
-The active Tokenless product is the managed Playwright workflow:
-
-`Agent → CLI or local API → local daemon → Playwright worker → managed browser profile → provider website`
-
-Nothing under `legacy/` is part of the default workspace build, published npm packages, or user-facing setup. Keep it for historical reference and optional local experiments only.
diff --git a/legacy/docs/chrome-web-store-release.md b/legacy/docs/chrome-web-store-release.md
deleted file mode 100644
index b69921e..0000000
--- a/legacy/docs/chrome-web-store-release.md
+++ /dev/null
@@ -1,46 +0,0 @@
-# Chrome Web Store release checklist
-
-This checklist is for the release owner. It is not part of ordinary user setup.
-The exact package, listing, privacy, distribution, and reviewer copy lives in
-[the Chrome Web Store submission source of truth](chrome-web-store/submission.md).
-Update that document before changing the Dashboard.
-
-## One-time identity binding
-
-1. Build the review package with `npm run pack:extension --workspace tokenless-browser-session-bridge`.
-2. Upload `legacy/extension/dist/tokenless-browser-session-bridge.zip` to the Chrome Web Store Developer Dashboard as an unpublished item.
-3. Record the assigned item ID and download its public key from the Package tab.
-4. Add that public key as the `key` field of `legacy/extension/extension/manifest.json` so unpacked development builds use the same stable ID.
-5. Update `packages/cli/src/default-extension-id.ts` to the assigned item ID.
-6. Run `npm run verify:extension-release -- --extension-id "<item-id>"`.
-7. Build the extension again, load it unpacked, and verify that `chrome://extensions` reports the same ID before publishing.
-
-The native-host manifest authorizes exactly this extension ID. Do not change the Store identity without changing the bundled CLI default in the same release.
-
-## Each release
-
-1. Run `npm test` and `npm run test:e2e`.
-2. Run `npm run pack:extension --workspace tokenless-browser-session-bridge`.
-3. Verify the zip contains the Manifest V3 production files and icons, but no source maps or declaration files.
-4. Upload the zip, complete every Dashboard field from
-   [the submission source of truth](chrome-web-store/submission.md), and verify
-   the live dedicated privacy-policy URL.
-5. Review permission disclosures for `debugger`, `nativeMessaging`, `scripting`,
-   `sidePanel`, and the explicit provider host permissions. Confirm the named
-   `tabs` permission is absent and the packaged service worker uses debugger
-   only for validated `Input.dispatchMouseEvent` clicks and always detaches.
-6. Run `npm run verify:extension-release` and submit only after it succeeds.
-7. Confirm the released `tokenless` CLI uses the Store item ID by default and
-   that the reviewer command also passes the ID explicitly.
-8. Use deferred publishing and wait for explicit publication approval.
-
-## User-facing promise
-
-Once the Store version is live, the supported setup is:
-
-```bash
-# User installs and enables the Tokenless extension from the Chrome Web Store.
-npx tokenless setup
-```
-
-`setup` must be the only local configuration command a normal user needs. It writes the Native Messaging registration and succeeds only when the installed extension has connected.
diff --git a/legacy/docs/chrome-web-store/reviewer-setup.md b/legacy/docs/chrome-web-store/reviewer-setup.md
deleted file mode 100644
index fcec0b6..0000000
--- a/legacy/docs/chrome-web-store/reviewer-setup.md
+++ /dev/null
@@ -1,157 +0,0 @@
-# Tokenless Chrome Web Store Reviewer Setup
-
-Use this document to prepare and verify the exact reviewer instructions for the
-single Tokenless extension.
-
-The exact Dashboard copy and release gate are maintained in
-[the Chrome Web Store submission source of truth](submission.md). If this
-walkthrough and that document differ, update this walkthrough before review.
-
-## Release inputs
-
-Fill these values only after the primary Chrome Web Store draft creates its
-package key and permanent extension ID:
-
-| Value | Final value |
-| --- | --- |
-| Chrome Web Store extension ID | `cgiocagnojoiblhlkmdjacklcmpbbimf` |
-| Released npm CLI version | `{{TOKENLESS_NPM_VERSION}}` |
-| Privacy policy URL | `https://vertile.ai/products/tokenless/privacy` |
-| Support email | `hello@vertile.ai` |
-
-## Reviewer prerequisites
-
-- Chrome or another supported Chromium browser.
-- Node.js 22.13 or later.
-- Internet access to npm and a provider website.
-- A normal account the reviewer is already signed in to on ChatGPT, Claude, or
-  Gemini. Vertile does not supply, request, or retain reviewer credentials.
-
-## Clean-machine verification
-
-Run this before every Store submission from a clean Chromium profile and a
-fresh local Tokenless home:
-
-```bash
-export TOKENLESS_HOME="$(mktemp -d)"
-npx tokenless@{{TOKENLESS_NPM_VERSION}} setup \
-  --provider chatgpt \
-  --extension-id cgiocagnojoiblhlkmdjacklcmpbbimf \
-  --json
-npx tokenless@{{TOKENLESS_NPM_VERSION}} doctor --json
-```
-
-Expected setup result:
-
-- setup starts or confirms the local Rust daemon;
-- setup registers the Native Messaging host for the Store extension ID;
-- setup opens only the selected provider's HTTPS page when no bridge is live;
-- setup reports a live extension bridge;
-- no provider sign-in, CAPTCHA, or rate limit is bypassed.
-
-The explicit extension ID is deliberate. Keep it in reviewer instructions even
-after the released CLI default has been corrected.
-
-After normal provider sign-in, run:
-
-```bash
-npx tokenless@{{TOKENLESS_NPM_VERSION}} run \
-  --provider chatgpt \
-  --project-name "Chrome Web Store review" \
-  --chat-name "Visible UI check" \
-  --prompt "Reply with exactly: TOKENLESS_REVIEW_OK" \
-  --json
-```
-
-Expected run result:
-
-- the selected ChatGPT page visibly receives the prompt;
-- the CLI returns `TOKENLESS_REVIEW_OK` in the visible result;
-- no task page, extension runner page, private provider API, cookie, browser
-  storage value, or hidden authorisation header is used;
-- failure to sign in or a visible provider block is reported as a normal error.
-
-## Reviewer walkthrough
-
-1. Click the extension action. Confirm the Tokenless side panel opens.
-2. In **Activity**, confirm the panel only presents scalar local job metadata;
-   it must not show prompts, answer bodies, claim tokens, cookies, or browser
-   storage values.
-3. In **Settings**, confirm routing order, browser preference, daemon URL, and
-   language preference are local controls.
-4. Select the provider normally through its visible web UI. Tokenless must use
-   the visible Chat surface and must not submit on ChatGPT Work.
-5. Run the sample command above and observe the visible provider UI action.
-6. Disable the extension or remove the Native Messaging manifest and repeat.
-   Setup must fail with an actionable bridge error rather than claim success.
-
-## Security assertions for review
-
-The reviewer may inspect the primary extension manifest and package. Confirm:
-
-- Manifest V3 only.
-- Host permissions limited to `chatgpt.com`, `chat.openai.com`,
-  `gemini.google.com`, `claude.ai`, and `grok.com`.
-- The `debugger` permission is used only for one validated visible ChatGPT
-  control click at a time. The extension sends a pressed and released
-  `Input.dispatchMouseEvent`, then detaches; it never uses Network, Storage,
-  Fetch, Runtime, DOM, or Page CDP commands.
-- No `tabs`, `cookies`, `history`, `webRequest`, or `webRequestBlocking`
-  permission. The five provider host permissions provide URL access only for
-  matching provider tabs.
-- No remote executable code.
-- No extension page is opened automatically to act as a task runner.
-- Native Messaging is local and explicitly set up by the user.
-
-## Evidence package before submission
-
-Prepare these assets in the Store dashboard, without user data:
-
-1. 1280×800 screenshot: Tokenless Activity panel with deterministic sample
-   local history.
-2. 1280×800 screenshot: Settings panel showing provider order, language
-   controls, and local-only wording.
-3. A copy of [the submission source of truth](submission.md), with the final
-   npm version substituted in the Dashboard test instructions.
-4. Verification evidence: `npm test`, clean-profile setup, and the sample
-   visible-session run.
-
-Do not include provider accounts, user prompts, real answers, API keys,
-cookies, local database files, hidden browser state, or personally identifying
-information in screenshots or attachments. Do not use a provider page as a
-public Store-listing screenshot: it adds no extension UI evidence and creates
-unnecessary account-content and provider-branding risk. Reviewers can validate
-the visible provider flow through the supplied test instructions instead.
-
-### Reproducible listing screenshots
-
-After building the primary extension, generate the extension-owned listing
-screenshots and promotional images from deterministic sample data:
-
-```bash
-npm run build --workspace tokenless-browser-session-bridge
-node scripts/capture-cws-screenshots.mjs
-```
-
-The output directory contains two 1280×800 screenshots, the required 440×280
-small promo tile, an optional 1400×560 marquee image, and a 128×128 Store icon.
-The capture script uses only the canonical logo under `legacy/extension/assets`,
-a local static server, and a mock Native Messaging response; it never opens a
-provider page or includes a real account, prompt, or answer. Inspect the PNGs
-before uploading and regenerate them after any Settings UI or brand change.
-
-## Final release gate
-
-Do not click **Submit for review** until all are true:
-
-- primary ZIP was rebuilt after the Store ID/public key was bound;
-- `npm run verify:extension-release` passes with the permanent Store ID;
-- the published npm CLI uses that same default extension ID;
-- all six matching native runtime packages and the universal `tokenless` CLI
-  are publicly available on npm before entering review instructions that use
-  `npx tokenless@{{TOKENLESS_NPM_VERSION}}`;
-- primary extension version, npm version, Store listing, permissions, privacy
-  declarations, and public privacy policy describe the same released behavior;
-- `npm test` and the clean-profile reviewer walkthrough pass;
-- Chrome Web Store listing uses deferred publishing unless an automatic public
-  release has been explicitly approved.
diff --git a/legacy/docs/chrome-web-store/submission.md b/legacy/docs/chrome-web-store/submission.md
deleted file mode 100644
index a1ea2b6..0000000
--- a/legacy/docs/chrome-web-store/submission.md
+++ /dev/null
@@ -1,534 +0,0 @@
-# Tokenless Chrome Web Store Submission Source of Truth
-
-This is the canonical source for the Tokenless Chrome Web Store package,
-listing, privacy declarations, reviewer instructions, distribution settings,
-and release gate. Update this file first, then make the package, public privacy
-policy, and Developer Dashboard match it.
-
-The older local files `submission-copy.md` and `privacy-policy.md` are excluded
-from Git and are not release records. They must not be used as the source for a
-submission.
-
-## Authority and change control
-
-For a release, the following must agree:
-
-1. this document;
-2. `legacy/extension/extension/manifest.json` and the ZIP built from it;
-3. the Chrome Web Store Developer Dashboard;
-4. the public policy at
-   `https://vertile.ai/products/tokenless/privacy`; and
-5. the released `tokenless` CLI and Native Messaging packages used by the
-   reviewer.
-
-Do not upload a package, change Dashboard fields, submit for review, cancel a
-review, or publish without explicit release-owner approval. Use deferred
-publishing unless automatic publication is explicitly approved.
-
-## Current verified state
-
-Last inspected in the Chrome Web Store Developer Dashboard: **16 July 2026**.
-
-| Field | Verified value |
-| --- | --- |
-| Publisher | Vertile AI |
-| Item name | Tokenless |
-| Item ID | `cgiocagnojoiblhlkmdjacklcmpbbimf` |
-| Item type | Extension |
-| Dashboard status | Draft; unpublished |
-| Dashboard package version | `0.1.5` |
-| Dashboard package revision | `main.crx`, draft revision 3 |
-| Verified CRX uploads | Not enabled |
-| Local ZIP | `legacy/extension/dist/tokenless-browser-session-bridge.zip` |
-| Inspected local ZIP SHA-256 | `1d6cd185a3e172f55fb74a40a5e3ec9581b8df7ba06ac8f3b1916dae5d6dd452` |
-| Local ZIP manifest version | `0.1.5` |
-| Public npm CLI | `tokenless@0.1.2` |
-| Public privacy policy | Reachable, but stale; deployed page was last modified 12 July 2026 |
-
-The Dashboard displayed `Error submitting item.` during the inspection. Its
-Status page said only that the draft is unpublished. The Distribution and Test
-instructions forms did not render reliably during the inspection, so their
-current Dashboard values are **not verified**. They must be checked manually
-before submission.
-
-## Release blockers found on 16 July 2026
-
-The item is not ready to submit or publish.
-
-1. **The public privacy policy is stale.** The enriched local policy is at
-   `../vertile-landing/app/products/tokenless/privacy/privacy.md`, dated
-   15 July 2026, but the live page still serves the older 12 July deployment.
-   Deploy the current policy and verify the public page without authentication.
-2. **The public CLI points to the wrong Store item by default.** The published
-   `tokenless@0.1.2` contains default extension ID
-   `afpfljlnhlpkbkmgonoanbmcdmmf`, not this item's ID. Publish a new exact-version
-   CLI/native package set containing `cgiocagnojoiblhlkmdjacklcmpbbimf` before
-   public release. Reviewer commands must pass `--extension-id` explicitly even
-   after that fix.
-3. **The named `tabs` permission is broader than necessary.** Chrome documents
-   that provider host permissions already allow access to the sensitive URL
-   properties of matching tabs, while tab creation, activation, and messaging
-   do not require the named permission. Remove `tabs` from the next manifest and
-   prove the extension contract still passes. This better satisfies the Chrome
-   Web Store minimum-permission policy.
-4. **A changed package needs a higher manifest version.** Because `0.1.5` is
-   already uploaded, the next corrected ZIP must use at least `0.1.6`.
-5. **The manifest summary and Store description need replacement.** The current
-   summary is implementation jargon, and the current description incorrectly
-   calls the local companion optional even though it is required to receive
-   local workflow jobs.
-6. **Support is incomplete.** The Dashboard has no support URL. Use the public
-   issue tracker below and confirm the publisher contact email is monitored.
-7. **Distribution and Test instructions are unverified.** Confirm their saved
-   values and resolve the generic Dashboard submission error before requesting
-   review.
-
-## Package source of truth
-
-### Identity
-
-- Manifest: `legacy/extension/extension/manifest.json`
-- Permanent Store item ID: `cgiocagnojoiblhlkmdjacklcmpbbimf`
-- CLI default ID source: `packages/cli/src/default-extension-id.ts`
-- Build command:
-
-  ```bash
-  npm run pack:extension --workspace tokenless-browser-session-bridge
-  ```
-
-- Release verification:
-
-  ```bash
-  npm run verify:extension-release -- --extension-id cgiocagnojoiblhlkmdjacklcmpbbimf
-  ```
-
-The manifest public key, computed extension ID, CLI default ID, Native Messaging
-allowlist, Dashboard item, and reviewer commands must all identify the same
-extension.
-
-### Required next-package manifest values
-
-| Field | Required value |
-| --- | --- |
-| `manifest_version` | `3` |
-| `name` and `short_name` | `Tokenless` |
-| `version` | At least `0.1.6` |
-| `description` | `Route local AI requests through the visible ChatGPT, Claude, and Gemini pages you already use.` |
-| `homepage_url` | `https://github.com/jazelly/tokenless` |
-| Required permissions | `debugger`, `nativeMessaging`, `scripting`, `sidePanel` |
-| Named permission to remove | `tabs` |
-| Host permissions | Only the four origins below |
-| Background | Manifest V3 module service worker |
-| User interface | Extension action opens `settings/index.html` as a side panel |
-
-Required host permissions and content-script matches:
-
-```text
-https://chatgpt.com/*
-https://chat.openai.com/*
-https://gemini.google.com/*
-https://claude.ai/*
-```
-
-The package must contain no source maps, TypeScript declarations, remote code,
-debugger companion extension, task runner page, obsolete execution surface, or
-`externally_connectable` entry.
-
-## Store listing
-
-These are the exact target Dashboard values for the next submission.
-
-### Name
-
-```text
-Tokenless
-```
-
-### Summary
-
-This value comes from the packaged manifest description:
-
-```text
-Route local AI requests through the visible ChatGPT, Claude, and Gemini pages you already use.
-```
-
-### Detailed description
-
-```text
-Tokenless routes AI requests from local agents and tools through the ChatGPT, Claude, or Gemini web page you choose and are already signed in to. It submits each request through the provider's visible interface and returns the displayed response to the requesting local workflow.
-
-This lets local workflows use supported web-based AI chats without exporting browser sign-in data or calling private provider APIs. The Tokenless CLI and local runtime are required to receive local workflow jobs. They are installed and configured explicitly by the user; the extension never silently downloads, installs, or updates executable software.
-
-How it works:
-
-1. Install the Tokenless extension and the Tokenless CLI/local runtime.
-2. Choose a supported provider and sign in through that provider's normal website.
-3. A local agent or tool sends a request to Tokenless.
-4. The extension opens or reuses only the selected provider's approved page, visibly submits the request, reads the response displayed there, and returns that response to the local workflow.
-
-Tokenless requests access only to chatgpt.com, chat.openai.com, claude.ai, and gemini.google.com. It does not export browser cookies, extract localStorage or sessionStorage authentication tokens, read hidden authentication headers, inspect provider network traffic, or call private provider APIs. It does not bypass provider sign-in, CAPTCHA, rate limits, subscriptions, permissions, or visible confirmations.
-
-On ChatGPT only, Tokenless may briefly attach Chrome's debugger API when a visible model or Intelligence control requires a trusted browser click. It validates the requesting ChatGPT tab and visible click coordinates, sends one mouse press and release, and immediately detaches. It does not use debugger access to inspect network traffic, cookies, browser storage, authentication data, hidden page content, or private provider APIs.
-
-All executable extension code is bundled in the reviewed Manifest V3 package. Tokenless does not load or execute remotely hosted code.
-
-Tokenless is not made by, affiliated with, endorsed by, or officially supported by OpenAI, Anthropic, Google, ChatGPT, Claude, or Gemini.
-```
-
-### Classification and URLs
-
-| Field | Target value |
-| --- | --- |
-| Category | Developer Tools |
-| Language | English |
-| Official URL | `https://vertile.ai` |
-| Homepage URL | `https://github.com/jazelly/tokenless` |
-| Support URL | `https://github.com/jazelly/tokenless/issues` |
-| Mature content | No |
-| Global promo video | Blank |
-
-### Listing assets
-
-| Dashboard asset | Canonical local file | Required dimensions |
-| --- | --- | --- |
-| Store icon | `legacy/extension/assets/chrome-web-store/store-icon-128x128.png` | 128×128 |
-| Activity screenshot | `legacy/extension/assets/chrome-web-store/activity-1280x800.png` | 1280×800 |
-| Settings screenshot | `legacy/extension/assets/chrome-web-store/settings-1280x800.png` | 1280×800 |
-| Small promo tile | `legacy/extension/assets/chrome-web-store/small-promo-440x280.png` | 440×280 |
-| Marquee promo tile | `legacy/extension/assets/chrome-web-store/marquee-1400x560.png` | 1400×560 |
-
-Regenerate the assets after any side-panel or brand change:
-
-```bash
-npm run build --workspace tokenless-browser-session-bridge
-node scripts/capture-cws-screenshots.mjs
-```
-
-Inspect every image before upload. It must contain only deterministic sample
-data and extension-owned UI, with no real provider account, prompt, answer,
-credential, or browser state.
-
-## Privacy practices
-
-### Single purpose description
-
-```text
-Tokenless lets users route AI requests from local agents and tools through supported web-based AI chats they are already signed in to. It submits each request through the selected provider's visible web interface and returns the response displayed there to the requesting local workflow.
-```
-
-This is one narrow workflow. Activity history, routing preferences, Native
-Messaging, tab orchestration, and the bounded ChatGPT debugger click are
-supporting functions of that purpose, not separate purposes.
-
-### Permission justifications
-
-#### debugger
-
-```text
-Tokenless uses the debugger permission only when a visible ChatGPT model or Intelligence control requires a trusted browser input event. Before attaching, Tokenless verifies that the request came from the top frame of an approved ChatGPT tab, confirms that the tab URL matches the requesting page, and validates that the click coordinates are within the visible viewport. It sends only one mouse-pressed and mouse-released Input.dispatchMouseEvent sequence, serializes clicks per tab, and immediately detaches on success or failure. Tokenless does not use debugger access to inspect network traffic, cookies, browser storage, authentication data, hidden page content, or private provider APIs, and it does not enable Network, Storage, Fetch, Runtime, DOM, or Page debugging domains.
-```
-
-#### nativeMessaging
-
-```text
-Required to communicate with the Tokenless Native Messaging host that the user explicitly installs on the same computer. The host transfers locally created Tokenless jobs and their local completion status through a versioned local protocol. It is not used to export browser cookies, browser storage, authentication tokens, or hidden provider API credentials.
-```
-
-#### scripting
-
-```text
-Required only to inject Tokenless's bundled provider content script into an approved provider tab when the statically declared content script is not yet available, such as a supported page that was already open when the extension was installed or updated. The script interacts only with the provider's user-visible web UI to perform the user's requested action. All executable code is included in the submitted Manifest V3 package; Tokenless does not load or execute remotely hosted code.
-```
-
-#### sidePanel
-
-```text
-Required to show Tokenless's local Activity and Settings interface from the extension action. The panel shows local connection state, routing preferences, language preference, and bounded redacted job history. It does not display provider cookies, browser storage values, prompt bodies, answer bodies, or claim tokens.
-```
-
-#### Host permissions
-
-```text
-Host access is limited to chatgpt.com, chat.openai.com, gemini.google.com, and claude.ai. It is required so Tokenless can locate supported visible controls, submit the user-requested prompt, and read the displayed response only on the provider page the user selected. Tokenless does not request access to arbitrary websites, general browsing history, provider cookies, browser storage authentication data, or private provider APIs.
-```
-
-#### tabs
-
-The next package must not request the named `tabs` permission, so the next
-Dashboard must not present a `tabs` justification field. The current `0.1.5`
-Dashboard justification is preserved in the inspection snapshot below only.
-
-### Remote code
-
-Select **No, I am not using remote code**.
-
-The Dashboard disables the justification field for this answer. The reviewed
-package contains all executable JavaScript. It does not load external scripts
-or WebAssembly, execute fetched strings, use `eval()` or equivalent execution,
-or interpret remote instructions as code. Provider-page DOM data and local job
-messages are data, not executable code.
-
-### User data categories
-
-Chrome treats local processing as handling user data. Use these declarations:
-
-| Dashboard category | Select | Reason |
-| --- | --- | --- |
-| Personally identifiable information | No | Tokenless does not request or extract identity fields; incidental identity text remains part of the user's communication or visible website content. |
-| Health information | No | Tokenless has no health-data feature and does not identify or extract health fields. |
-| Financial and payment information | No | Tokenless has no payment-data feature and does not identify or extract payment fields. |
-| Authentication information | No | Provider authentication remains in the browser; Tokenless does not read passwords, cookies, storage tokens, or hidden headers. |
-| Personal communications | Yes | Prompts and displayed AI answers are the user's AI-chat communications. |
-| Location | No | Tokenless does not request or derive location. |
-| Web history | Yes | Tokenless uses the selected supported provider URL to validate and coordinate the requested provider tab. |
-| User activity | No | Tokenless does not collect the user's clicks, keystrokes, scrolling, or browsing behaviour. A temporary programmatic click coordinate is generated for one requested visible control and is not user-activity telemetry. |
-| Website content | Yes | Tokenless reads supported visible provider UI, displayed answers, visible source links, and explicitly requested sanitised snapshots. |
-
-Prompts or displayed answers can incidentally contain identity, health, or
-financial information chosen by the user. Tokenless does not classify or use
-those as separate data products; the public privacy policy must nevertheless
-warn users not to submit information they are not authorised to disclose.
-
-### Use and transfer
-
-The declared data is used only to provide the single purpose and associated
-local security, reliability, and support functions. It is processed between the
-extension, Native Messaging host, CLI, and daemon on the user's device. The
-prompt and deliberately supplied context are sent through HTTPS to the provider
-selected by the user through that provider's normal web page. The provider's
-terms and privacy policy govern its handling. Vertile does not operate a hosted
-Tokenless workflow service that receives prompts, page content, answers, or
-provider credentials.
-
-### Required certifications
-
-Certify all three statements in the Dashboard:
-
-- data is not sold or transferred outside the approved use cases;
-- data is not used or transferred for purposes unrelated to the item's single
-  purpose; and
-- data is not used or transferred to determine creditworthiness or for lending.
-
-### Public privacy policy
-
-Dashboard URL:
-
-```text
-https://vertile.ai/products/tokenless/privacy
-```
-
-Canonical website source:
-
-```text
-../vertile-landing/app/products/tokenless/privacy/privacy.md
-```
-
-Before submission, verify that the public page:
-
-- is reachable without authentication and returns HTTP 200 after redirects;
-- displays the current effective or last-updated date;
-- states the same single purpose and data categories as this document;
-- explains the local runtime, Native Messaging, approved hosts, debugger use,
-  local retention/deletion, provider transfer, and lack of Vertile-hosted
-  workflow collection;
-- contains an affirmative Chrome Web Store Limited Use statement; and
-- provides a monitored privacy contact and applicable complaint route.
-
-## Distribution
-
-These are the target values. The current Dashboard values remain unverified.
-
-| Field | Target value |
-| --- | --- |
-| Visibility | Public |
-| Regions | All regions where Chrome Web Store distribution is available |
-| Payments | None through Chrome Web Store |
-| Publish timing | Deferred publishing |
-
-If business or legal requirements need a narrower region list, update this file
-before changing the Dashboard. Do not silently diverge.
-
-## Test instructions for reviewers
-
-### Prerequisites
-
-- Chrome or a supported Chromium browser.
-- Node.js 22.13 or later.
-- Internet access to npm and one supported provider website.
-- A normal ChatGPT, Claude, or Gemini account that the reviewer is already
-  authorised to use. Vertile does not supply, request, or retain credentials.
-
-### Exact Dashboard copy
-
-Replace `{{TOKENLESS_NPM_VERSION}}` only with a version already public on npm
-whose six native packages are also public at that exact version. Keep the
-explicit extension ID even after the CLI default is corrected.
-
-```text
-Tokenless routes requests from local tools through the visible ChatGPT, Claude, or Gemini page selected by the user. It requires a user-installed local runtime and a normal provider account. Vertile does not supply, request, or retain provider credentials.
-
-Prerequisites: Chrome/Chromium, Node.js 22.13+, internet access to npm, and a normal account already signed in to one supported provider website.
-
-1. Install this reviewed extension in Chrome.
-2. In a terminal, run:
-   npx tokenless@{{TOKENLESS_NPM_VERSION}} setup --provider chatgpt --extension-id cgiocagnojoiblhlkmdjacklcmpbbimf --json
-3. If ChatGPT asks, sign in normally through the visible website. The setup command installs or confirms the local runtime, registers Native Messaging for this exact extension ID, opens only the selected provider page if needed, and waits for the extension bridge.
-4. Click the Tokenless extension action. Confirm the side panel reports "Native host ready". Activity shows only bounded local job metadata; prompt bodies, answer bodies, cookies, browser-storage values, and claim tokens are not shown.
-5. Run:
-   npx tokenless@{{TOKENLESS_NPM_VERSION}} run --provider chatgpt --project-name "Chrome Web Store review" --chat-name "Visible UI check" --prompt "Reply with exactly: TOKENLESS_REVIEW_OK" --json
-6. Expected result: Chrome visibly submits the prompt on chatgpt.com and the command returns TOKENLESS_REVIEW_OK from the answer displayed on that page.
-
-Expected limitations: Tokenless stops rather than bypassing provider sign-in, CAPTCHA, rate limits, subscription limits, permissions, or other visible provider blocks. It does not read cookies, localStorage/sessionStorage authentication tokens, hidden headers, network traffic, or private provider APIs.
-
-Debugger verification: if a visible ChatGPT model or Intelligence control requires a trusted click, Tokenless attaches only to the validated ChatGPT tab, sends one Input.dispatchMouseEvent press/release pair at visible coordinates, and immediately detaches. It does not enable Network, Storage, Fetch, Runtime, DOM, or Page debugging domains.
-```
-
-### Reviewer evidence before submission
-
-Run from a clean Chrome profile and fresh Tokenless home:
-
-```bash
-export TOKENLESS_HOME="$(mktemp -d)"
-npx tokenless@{{TOKENLESS_NPM_VERSION}} setup \
-  --provider chatgpt \
-  --extension-id cgiocagnojoiblhlkmdjacklcmpbbimf \
-  --json
-npx tokenless@{{TOKENLESS_NPM_VERSION}} doctor --json
-```
-
-Then execute the exact sample request from the Dashboard copy. Record the npm
-version, operating system, Chrome version, extension version, and pass/fail
-result without recording provider credentials, real prompts, or account data.
-
-## Dashboard inspection snapshot: 16 July 2026
-
-This section preserves what was actually present before the recommended fixes.
-It is evidence, not the target copy.
-
-### Store listing snapshot
-
-- Summary from package:
-  `Visible bridge for user-authorized ChatGPT, Gemini, and Claude web sessions.`
-- Category: Developer Tools.
-- Language: English.
-- Official URL: `vertile.ai`.
-- Homepage URL: `https://github.com/jazelly/tokenless`.
-- Support URL: blank.
-- Mature content: off.
-- Uploaded assets: Store icon, two screenshots, small promo tile, and marquee
-  promo tile. Global promo video was blank.
-- The detailed description was the older local-companion copy. It described the
-  companion as optional, then stated that Tokenless cannot receive jobs without
-  it. Replace it with the target description above.
-
-### Privacy snapshot
-
-Single purpose:
-
-```text
-Tokenless connects local workflows to supported AI services by submitting prompts and reading visible answers through provider web pages selected by the user.
-```
-
-The Dashboard contained justifications for `debugger`, `nativeMessaging`,
-`scripting`, `tabs`, `sidePanel`, and host permissions. The debugger,
-nativeMessaging, sidePanel, and host explanations substantially matched the
-target text above. The scripting text was accurate but did not explain the
-specific already-open-tab reinjection path. The `tabs` explanation described
-finding, opening, validating, and focusing provider tabs, but did not establish
-why the named `tabs` permission was necessary in addition to host access.
-
-Remote code was set to **No** and its justification box was disabled.
-
-Selected data categories:
-
-- Personal communications: yes.
-- Web history: yes.
-- Website content: yes.
-- Personally identifiable information: no.
-- Health information: no.
-- Financial and payment information: no.
-- Authentication information: no.
-- Location: no.
-- User activity: no.
-
-All three Limited Use certifications were selected. The privacy policy URL was
-`https://vertile.ai/products/tokenless/privacy`.
-
-## Reviewer-oriented assessment
-
-### Must fix before the next submission
-
-1. Deploy the current public privacy policy.
-2. Remove the unnecessary named `tabs` permission, bump the manifest version,
-   rebuild the ZIP, and rerun extension contract tests.
-3. Put the target summary in the manifest and the target description in the
-   Dashboard.
-4. Publish a CLI/native package set with the correct default Store ID, or the
-   normal user setup advertised by the listing will fail. Keep the explicit ID
-   in reviewer instructions regardless.
-5. Add and verify the Test instructions and support URL.
-6. Inspect Distribution and resolve the Dashboard's generic submission error.
-7. Verify the final Dashboard, ZIP, npm artifacts, and live policy agree before
-   submitting.
-
-### Likely reviewer questions and the evidence that answers them
-
-| Reviewer question | Required evidence |
-| --- | --- |
-| Why does this extension add value instead of merely opening a website? | It receives a local user-requested job, visibly submits it through an approved provider UI, reads the displayed response, and returns it to the requesting local workflow. |
-| Why is Native Messaging necessary? | The local CLI/daemon is the source and destination of workflow jobs; the host is explicitly installed and communicates only on-device. |
-| Why is debugger necessary? | Some visible ChatGPT controls reject an ordinary DOM click. Source and tests prove one validated `Input.dispatchMouseEvent` press/release pair and immediate detach. |
-| Does debugger expose network or credentials? | The service worker sends only the two Input-domain commands and never enables Network, Storage, Fetch, Runtime, DOM, or Page. |
-| Is remote code executed? | No. Build output is self-contained, has no remote scripts/WASM/eval, and the ZIP inventory is reviewable. |
-| Why are broad hosts needed? | They are not broad: four explicit provider origins only. Each is a supported provider selected by the user. |
-| What user data is handled? | Prompts/answers, the approved provider URL, and visible supported page content, processed locally except for the intentional HTTPS submission to the selected provider. |
-| Can Vertile read prompts or answers? | No hosted Tokenless workflow service receives them. Human access occurs only if a user deliberately includes specific data in a support request or another policy exception applies. |
-| Is the companion hidden or silently installed? | No. The listing says the local runtime is required, and installation/configuration is explicitly initiated by the user. |
-
-### Residual review risk
-
-Even after these fixes, `debugger`, Native Messaging, and persistent provider
-host permissions justify a deeper manual review. That delay is expected. The
-best mitigation is not weaker wording; it is exact minimum permissions,
-self-contained code, a reproducible reviewer flow, and complete agreement among
-the package, listing, privacy declarations, public policy, and runtime.
-
-## Final release gate
-
-Do not submit until every box can be checked from fresh evidence:
-
-- [ ] Next manifest version is greater than `0.1.5`.
-- [ ] Manifest summary matches this document.
-- [ ] Named `tabs` permission has been removed and tests still pass.
-- [ ] `npm run pack:extension --workspace tokenless-browser-session-bridge`
-      produces the inspected ZIP.
-- [ ] ZIP contains only expected production files and no remote code or source
-      maps.
-- [ ] `npm run verify:extension-release -- --extension-id
-      cgiocagnojoiblhlkmdjacklcmpbbimf` passes.
-- [ ] Full test suite, extension contract tests, and clean-profile reviewer flow
-      pass.
-- [ ] A public `tokenless` CLI and all six native packages exist at the exact
-      reviewer version and use this Store ID by default.
-- [ ] Store listing fields and assets match this document.
-- [ ] Privacy fields and certifications match this document.
-- [ ] Live privacy policy is the current enriched policy and is reachable
-      without authentication.
-- [ ] Support URL and monitored contact information are present.
-- [ ] Distribution values are confirmed.
-- [ ] Test instructions are saved with all placeholders replaced.
-- [ ] Dashboard no longer reports a submission error.
-- [ ] Deferred publishing is selected.
-- [ ] Release owner has explicitly approved submission.
-
-## Policy references
-
-- [Chrome Web Store Program Policies](https://developer.chrome.com/docs/webstore/program-policies/policies)
-- [Fill out the privacy fields](https://developer.chrome.com/docs/webstore/cws-dashboard-privacy/)
-- [User Data FAQ](https://developer.chrome.com/docs/webstore/program-policies/user-data-faq)
-- [Limited Use](https://developer.chrome.com/docs/webstore/program-policies/limited-use)
-- [Manifest V3 requirements](https://developer.chrome.com/docs/webstore/program-policies/mv3-requirements)
-- [Chrome tabs API permissions](https://developer.chrome.com/docs/extensions/reference/api/tabs)
-- [Chrome debugger API](https://developer.chrome.com/docs/extensions/reference/api/debugger)
-- [Chrome Web Store review process](https://developer.chrome.com/docs/webstore/review-process)
-- [Update a Chrome Web Store item](https://developer.chrome.com/docs/webstore/update)
diff --git a/legacy/docs/handoff-visible-provider-web-automation.md b/legacy/docs/handoff-visible-provider-web-automation.md
deleted file mode 100644
index e3392e6..0000000
--- a/legacy/docs/handoff-visible-provider-web-automation.md
+++ /dev/null
@@ -1,973 +0,0 @@
-# Visible Provider Web Automation Initiative Handoff
-
-**Status:** P0 architecture handoff; must precede further visible-provider work
-**Last updated:** 2026-07-17  
-**Working branch at the checkpoint:** `codex/claude-visible-adapter`  
-**Scope:** Managed Playwright profiles and visible-provider automation for ChatGPT, Claude, Gemini, and Grok
-
-## P0 decision: managed Playwright profiles
-
-This is the current implementation direction and supersedes the extension-mode
-runtime described later in this handoff. The extension material remains as a
-record of the adapters, evidence, and behavior that must be migrated; it is not
-the target architecture.
-
-Visible mode will replace the Native Messaging host and browser extension with
-a daemon-backed Playwright worker. The worker will control visible, persistent
-managed Chromium profiles below `~/.tokenless/browser/profiles/`. A named profile
-represents one browser identity such as `personal` or `work` and may hold one
-session for every supported provider. Multiple accounts for the same provider
-use different named profiles.
-
-This work is **P0**. Do not deepen the extension transport, add new
-extension-only features, or treat the current extension checkpoint as the
-release path before this migration is complete.
-
-### Target architecture
-
-```mermaid
-flowchart LR
-    A["CLI or local client"] --> B["Tokenless daemon"]
-    B --> C["Local Playwright worker"]
-    C --> D["Named persistent browser profile"]
-    D --> E["Provider Playwright adapter"]
-    E --> F["Visible provider DOM"]
-
-    G["Consented local browser profile copy"] --> D
-    H["Authorized live browser acceptance"] --> I["Redacted evidence and fixtures"]
-    I --> E
-```
-
-The Rust daemon remains the durable local control plane for jobs, history,
-leases, state, and cancellation. Direct mode remains isolated and unchanged.
-The Playwright worker replaces only the extension/native transport and owns the
-visible browser processes.
-
-### Profile and CLI contract
-
-Add the following profile administration commands:
-
-```text
-tokenless profiles add --profile <slug> [--label <text>] [--set-default]
-tokenless profiles discover [--browser <chrome|brave>] [--browser-user-data-dir <dir>] --json
-tokenless profiles list
-tokenless profiles clear (--profile <slug>|--all)
-tokenless profiles status --profile <slug> [--provider <id>]
-tokenless profiles open --profile <slug> [--provider <id>]
-tokenless profiles reset [--profile <slug>] [--preferred-providers <list>]
-tokenless profiles set-default --profile <slug>
-tokenless profiles remove --profile <slug> --confirm-delete
-```
-
-Every visible command, including `run`, provider actions, provider controls,
-provider status, and `snapshot-dom`, accepts `--profile <slug>`. Selection uses
-the explicit profile first and then the configured default. It fails before job
-creation when neither resolves to a registered profile.
-
-`tokenless profiles discover --json` is read-only and lists local Chrome or Brave roots
-with exact profile directory keys; it does not create a Tokenless profile,
-copy profile data, or touch the managed-profile registry. `tokenless setup` is
-the canonical interactive onboarding entry: it installs and checks the two
-GitHub-backed Tokenless skills, detects installed browsers, asks the user to
-select or explicitly re-import a managed profile, records preferred providers,
-starts the daemon and worker, opens provider pages, and reports visible
-authentication readiness. Noninteractive initial setup must explicitly choose
-either `--fresh` or both `--import-browser-profile <directory-key>` and
-`--consent-local-profile-copy`.
-
-Store bounded profile metadata in `~/.tokenless/browser/profiles.json`, guarded
-by the existing cross-process SQLite lock. Public profile slugs never become
-filesystem targets: each profile directory is derived from an internal UUID.
-Registry records contain identifiers, labels, lifecycle/import state,
-timestamps, and bounded last-observed visible authentication status, but no
-cookie or storage values.
-
-Profile routing in this P0 is explicit or default. Stable profile identifiers
-and daemon job fields must make later project-affinity routing additive rather
-than requiring another storage migration.
-
-### Consented profile import
-
-Importing a browser profile is an explicit user setup operation. The
-consent UI names the exact source and destination, explains that authentication
-state may be copied, and states that the copy remains entirely local and is
-never sent to Tokenless or another remote service. Jobs and live tests reuse the
-already-imported managed profile indefinitely; they must not re-import, refresh,
-copy from the source browser, or remove that managed profile. A later re-import
-occurs only when the user explicitly selects it in setup or passes the explicit
-re-import flags.
-
-The implementation must:
-
-- use installed Chrome through `playwright-core`, `channel: "chrome"`, or the
-  selected Brave executable, always with `headless: false` and a non-default
-  persistent user-data directory;
-- discover the source root and profile directory from platform-standard browser
-  locations and `Local State`, using an exact directory key such as `Default`
-  or `Profile 1` rather than an ambiguous display name;
-- permit a best-effort read-only copy while the source browser is open; setup
-  does not claim source quiescence or snapshot consistency, and an unusable copy
-  is reported for explicit user recovery;
-- copy into a private staging directory, reject links and path escapes, never
-  mutate the source, and atomically promote a complete result;
-- copy root encryption metadata and only requested ChatGPT, Claude, or Grok
-  cookie rows selected by audited host and partition allowlists, while keeping
-  cookie contents opaque;
-- never import Gemini/Google authentication, broad X/Twitter sessions, or
-  shared Local Storage, IndexedDB, Session Storage, or Service Worker state;
-- exclude caches, crash data, downloads, browsing history, bookmarks, saved
-  passwords, autofill/payment databases, and installed extensions;
-- disable browser sync in the managed clone so it cannot change the user's
-  ordinary synced profile; and
-- delete incomplete staging data on every failure.
-
-After import, Tokenless verifies only visible provider DOM. It keeps the managed
-profile and opens visible sign-in pages for providers that remain logged out.
-Copy failure is reported rather than silently switching execution paths or
-creating a replacement profile. Reauthentication in the selected managed
-profile persists across future runs.
-
-Profile data remains until explicit removal. Removal first stops the exact
-managed browser, resolves and verifies its registered UUID directory beneath
-Tokenless home, and requires `--confirm-delete` before deleting it.
-
-The revised credential boundary is:
-
-- an explicitly consented, provider-scoped local cookie copy is allowed for
-  ChatGPT, Claude, and Grok;
-- Tokenless reads host and partition metadata only for allowlist decisions,
-  treats cookie contents as opaque, and never prints, logs, returns, diagnoses,
-  or transmits copied authentication values;
-- Playwright adapters continue to operate through visible provider DOM and do
-  not use cookie/storage export APIs, hidden request interception, private
-  provider APIs, or a remote debugging TCP endpoint; and
-- raw authenticated captures remain ephemeral and only reviewed, reduced,
-  redacted evidence may enter the repository.
-
-### Daemon and worker behavior
-
-Add `profile_id` to visible daemon jobs and expose exact profile filtering in
-job state. Add authenticated worker operations for claim-by-profile,
-mark-running, lease renewal, completion, and cancellation observation. Preserve
-historical jobs; any queued pre-cutover visible job fails explicitly with
-`legacy_visible_transport_removed` rather than being silently replayed.
-
-Run one detached `tokenless-playwright-runner` per Tokenless home. It maintains
-a private PID/session/heartbeat marker and log, lazily launches one persistent
-Chrome context per active profile, and keeps its windows open. If the user
-closes a browser, the active job fails retryably and the next action relaunches
-that profile.
-
-Execution is single-flight inside each profile. Different profiles may run in
-parallel, with a fixed initial limit of four active profile browsers; additional
-jobs remain queued in the daemon. The worker renews claims while waiting on a
-provider, observes daemon cancellation, aborts the corresponding page work, and
-cleans staged attachments deterministically.
-
-Move provider configuration, navigation policy, action vocabulary, selectors,
-and visible postconditions out of the extension into Playwright adapter
-modules. Preserve exact-label model/effort behavior, fail-closed navigation,
-CAPTCHA/rate-limit/upgrade handling, response correlation, visible citations,
-and sanitized snapshots.
-
-Attachments remain staged as private, regular, non-symlink files with bounded
-size and SHA-256 descriptors. The worker resolves the bundle by job id and uses
-Playwright `setInputFiles`; raw caller paths remain absent from daemon job JSON.
-
-### Test strategy and P0 acceptance
-
-#### Deterministic coverage
-
-Add unit and integration coverage for:
-
-- Chrome discovery, source-profile enumeration, explicit consent, canonical
-  path validation, copy inclusion/exclusion rules, atomic promotion, interrupted
-  cleanup, and proof that the source is not modified;
-- Chrome-running, unreadable-source, inconsistent-copy, unusable-encryption,
-  and zero-authenticated-provider fallbacks;
-- clean profiles, partial imports, explicit/default selection, unknown profiles,
-  profile deletion, browser closure, worker restart, and relaunch;
-- same-profile serialization, cross-profile parallelism, the four-profile cap,
-  daemon lease renewal, cancellation, stale completion, and legacy queued jobs;
-- every existing ChatGPT, Claude, Gemini, and Grok action driven through the
-  real Playwright adapters against retained authenticated DOM fixtures;
-- full-chain CLI -> daemon -> worker -> real browser-page flows for prompt
-  input, controls, upload, submission, response reading, snapshots, navigation
-  drift, cancellation, and cleanup; and
-- static contract checks rejecting Playwright cookie/storage export, credential
-  logging, private provider routes, source-profile writes, unsanitized traces,
-  and remote CDP endpoints.
-
-#### Authorized local Chrome-profile acceptance
-
-Add this separately gated command:
-
-```text
-npm run test:e2e:live-managed-playwright
-```
-
-It never runs in ordinary CI and requires every explicit gate below:
-
-```text
-TOKENLESS_LIVE_MANAGED_PLAYWRIGHT=1
-TOKENLESS_LIVE_PROVIDER_MUTATIONS=1
-TOKENLESS_LIVE_MANAGED_PLAYWRIGHT_HOME=<existing-tokenless-home>
-TOKENLESS_LIVE_MANAGED_PLAYWRIGHT_PROFILE=<managed-profile-slug>
-```
-
-The suite resolves the configured user-imported managed profile with `tokenless profiles list`
-before provider actions. Expired authentication is reported by normal visible
-auth checks. The suite must not call `profiles add`, `profiles remove`, Chrome
-profile discovery, or any import/copy path.
-It requires authenticated managed sessions for **ChatGPT, Claude, Gemini, and
-Grok**. Missing or expired authentication for any provider fails the P0
-acceptance run rather than silently reducing coverage.
-
-For every provider, the live suite must:
-
-1. confirm authenticated state through visible DOM;
-2. inspect the exact model inventory and selected state;
-3. exercise a reversible available model selection and restore the original in
-   `finally` (reselect the current choice if no alternate is safely available);
-4. inspect and exercise effort where supported, restoring the original, and
-   require a truthful unsupported result where effort is provider-coupled;
-5. input and clear a visible draft;
-6. upload a generated, non-sensitive marker text file through the visible file
-   control;
-7. submit one unique marker prompt with the attachment and require a visible,
-   correlated answer; and
-8. verify allowed provider navigation and the absence of login, CAPTCHA,
-   upgrade, rate-limit, and selector-drift blockers.
-
-The suite uses bounded timeouts and generated marker data only. It must not use
-private user files, existing chats, Projects, history, connectors, or skills.
-In `finally`, it writes partial sanitized evidence when needed and leaves the
-managed profile intact. It must not delete the managed profile, refresh it from
-Chrome, or verify Chrome source hashes because live execution no longer reads a
-Chrome source profile. Provider-side smoke conversations may remain and must
-carry a unique recognizable test marker.
-
-Retain only sanitized evidence under
-`test-results/live-managed-playwright/<timestamp>/`: step results, timings,
-Chrome/OS/Playwright versions, a provider/action matrix, cropped screenshots of
-the operated control/uploaded filename/marker response, and redacted selector
-diagnostics. Do not retain full-page text, account identity, cookies, storage,
-private conversation history, or opaque private route identifiers.
-
-Reviewed adapter-relevant DOM from a live run may be promoted into deterministic
-fixtures with provenance and hashes. Raw captures are never promoted
-automatically. P0 is not complete until the deterministic suite is green and
-one successful all-four-provider local acceptance run is recorded in this
-handoff.
-
-### Cutover and cleanup
-
-Visible mode becomes Playwright-only immediately; there is no legacy extension
-flag. Remove the extension and control-extension packages, native-host binary
-and protocol, Chrome Web Store paths, extension ids, bridge marker, manifests,
-and extension-specific tests after their reusable adapter behavior has moved.
-
-Keep the platform native packages for the Rust daemon but package only
-`tokenless-daemon`. During setup or upgrade, remove only native-host files and
-registry values whose resolved targets belong to the active Tokenless home, and
-tell users to uninstall the obsolete browser extension manually.
-
-Migrate configuration to preferred providers, daemon URL, and default managed
-profile. Update architecture, README, privacy policy, install skill, package
-contracts, and release verification to describe the new boundary. Do not
-publish any package, extension, or release as part of this implementation.
-
-## Executive summary
-
-The remainder of this document describes the extension implementation at the
-2026-07-17 checkpoint. It is migration input and historical evidence beneath
-the P0 decision above.
-
-Tokenless is intended to become a local, provider-neutral execution layer over
-the AI website sessions that a user already has open in their browser.
-
-The product is not a cookie extractor, a private-API client, or a clone of each
-provider frontend. It uses a browser extension to operate the provider's
-visible web UI after the user grants host permission. The CLI, daemon, native
-host, extension service worker, and content adapters form one end-to-end local
-runtime:
-
-```mermaid
-flowchart LR
-    A["CLI or local client"] --> B["Tokenless daemon"]
-    B --> C["Native Messaging host"]
-    C --> D["MV3 extension service worker"]
-    D --> E["Provider content adapter"]
-    E --> F["Visible provider DOM"]
-
-    G["Authorized Chrome observation"] --> H["Redacted real-DOM fixtures"]
-    H --> I["Deterministic local behavior harness"]
-    I --> E
-```
-
-ChatGPT remains the reference adapter. The current increment extends the same
-approach to Claude, Gemini, and Grok, introduces a unified action vocabulary,
-captures authenticated real DOM for all four providers, and brings the five
-priority action areas close to a coherent local acceptance boundary:
-
-1. sign-in status;
-2. model selection;
-3. thinking-effort selection;
-4. file upload; and
-5. prompt input and submission.
-
-The current work is substantial but not product-complete. The authenticated DOM
-corpus and most core adapters exist. Several focused tests passed during
-development. The last safety change and the new captured-DOM adapter E2E still
-need one clean, serialized regression run. Projects, history, skills, and
-connectors remain future product initiatives rather than completed features.
-
-## Product thesis
-
-### User outcome
-
-A local agent should be able to ask Tokenless to perform a provider-web action
-without knowing the provider's current DOM, model-menu structure, file-input
-implementation, or account-specific entitlement details.
-
-The caller should use one conceptual API. Tokenless should translate that API
-into provider-specific visible UI interactions, verify a visible postcondition,
-and return a bounded, privacy-safe result.
-
-### Why this product exists
-
-- Reuse a user's existing web subscription or Free web access when appropriate.
-- Avoid an unnecessary second paid API request for suitable interactive work.
-- Keep provider credentials inside the browser.
-- Give local agents a stable interface while provider websites continue to
-  change.
-- Preserve an honest distinction between a provider feature being documented,
-  visible, implemented, locally accepted, and live-provider accepted.
-
-### Product invariants at the extension checkpoint
-
-- Operate only through user-visible browser UI.
-- Never extract provider cookies, passwords, browser-storage tokens, hidden
-  authorization headers, or private provider API calls.
-- Treat the current visible UI and visible entitlement gates as authoritative.
-- Use exact visible labels; do not guess model IDs or fuzzy-match partial names.
-- Verify a visible postcondition after every mutation.
-- Fail closed on selector drift, ambiguous state, login gates, CAPTCHA, limits,
-  upgrade prompts, navigation drift, or unsupported semantics.
-- Keep raw authenticated captures ephemeral. Store only reduced, redacted DOM
-  evidence.
-- Do not allow an unrelated later request to inherit a stale visible file.
-- Do not publish packages, extensions, or releases without explicit approval.
-
-## Evidence and acceptance model
-
-The project needs a consistent vocabulary because several different kinds of
-proof are easy to conflate.
-
-| Level | Meaning | What it does not prove |
-| --- | --- | --- |
-| Documented | The provider's official documentation describes a feature or Free entry point. | It does not prove the current account, quota, entitlement, DOM, or runtime state. |
-| Observed DOM | Relevant markup was visible in an authorized browser session and was reduced into a redacted fixture. | It does not prove that Tokenless can operate it. |
-| Implemented | A content adapter or runtime path can inspect or interact with the captured contract. | It does not prove the complete local transport or provider acceptance. |
-| Locally accepted | Deterministic local DOM tests verify the action and its visible postcondition. | It does not prove a real provider accepted a live mutation. |
-| Full-chain accepted | CLI, daemon, native host, extension, and local provider DOM complete the action. | It is still not a live provider mutation. |
-| Live accepted | An explicitly authorized test account completes the action on the provider website. | It does not make the DOM stable forever or guarantee every plan/locale. |
-| Released | Builds, tests, privacy review, documentation, feature gating, and release approval are complete. | It does not eliminate ongoing DOM drift. |
-
-The current user requirement deliberately prioritizes **local acceptance using
-real captured DOM**, not live prompt submission, live file upload, or live
-Project creation. Live mutating smoke tests should be a separate, explicitly
-authorized test-account gate.
-
-## Current authenticated DOM corpus
-
-On 2026-07-17, clean provider tabs were inspected through the user's signed-in
-Chrome profile. Account identities, emails, history titles, message contents,
-private route identifiers, scripts, and styles were not retained.
-
-The fixture corpus is under:
-
-```text
-test/fixtures/provider-dom/<provider>/<account-state>/<scenario>.html
-```
-
-There are five authenticated scenarios for each of four providers, for a total
-of twenty HTML fixtures:
-
-- `session-status`
-- `model-menu-open`
-- `thinking-effort-menu-open`
-- `file-input-ready`
-- `composer-idle`
-
-Every HTML fixture has a same-basename `.provenance.json` sidecar containing the
-provider, observed account/plan state, sanitized public URL, observation date,
-evidence selectors, redaction notes, and the HTML SHA-256.
-
-The fixtures intentionally contain no provider JavaScript and no synthetic
-behavior. Deterministic click/state behavior belongs in the test harness so the
-repository can distinguish captured evidence from locally modeled transitions.
-
-Existing signed-out, public, and legacy deterministic fixtures remain in the
-repository. Authenticated evidence supplements rather than replaces them.
-
-### Observed account state
-
-| Provider | Authenticated observation | Safe conclusion |
-| --- | --- | --- |
-| ChatGPT | Signed in; Plus was visible. | The captured controls existed on one Plus account. This is not authenticated Free-plan proof. |
-| Claude | Signed in; Free plan was visible. | This is direct Free-account DOM evidence for the captured controls. Runtime limits still win. |
-| Gemini | Signed in; no reliable plan label was visible. | Authentication is observed; plan remains unknown. A `Pro` model label is not a subscription label. |
-| Grok | Signed in; no reliable plan label was visible. | Authentication is observed; plan remains unknown. Fast was the only confirmed executable profile in the captured entitlement state. |
-
-### Published Free baseline
-
-Official documentation confirms that every provider has a Free web entry point,
-but this is product documentation rather than current-account evidence:
-
-- [ChatGPT Free Tier](https://help.openai.com/en/articles/9275245-using-chatgpt-s-free-tier)
-- [Claude plans](https://support.anthropic.com/en/articles/11049762-choosing-a-claude-ai-plan)
-- [Gemini Apps limits](https://support.google.com/gemini/answer/16275805?hl=en-AG)
-- [Grok pricing](https://x.ai/pricing)
-
-Only Claude currently has both an official Free route and authenticated Free
-DOM evidence in this corpus. Genuine Free-account coverage for ChatGPT, Gemini,
-and Grok remains future work.
-
-## Unified provider-web action model
-
-The initial versioned vocabulary is defined in
-`packages/extension/extension/shared/visible-provider-actions.ts`.
-
-### Current action vocabulary
-
-- `auth.status`
-- `model.inspect`
-- `model.select`
-- `effort.inspect`
-- `effort.select`
-- `file.upload`
-- `skill.upload`
-- `connector.inspect`
-- `connector.select`
-- `prompt.input`
-- `prompt.submit`
-- `project.inspect`
-- `project.open`
-- `history.inspect`
-- `history.open`
-
-The current schema gives the nine requested product domains a common home, but
-the enrichment domains are not semantically complete. The eventual product API
-still needs explicit operations such as `project.find`, `project.create`,
-project options/configuration, `history.find`, connector addition, and skill
-management. These should not be disguised as generic selector clicks.
-
-### Core action status
-
-| Action area | ChatGPT | Claude | Gemini | Grok |
-| --- | --- | --- | --- | --- |
-| Auth status | Implemented with privacy-safe visible signals | Implemented; Free plan captured | Implemented; plan deliberately unknown | Implemented; plan deliberately unknown |
-| Model inspect/select | Dynamic visible labels and selected-state verification | Model menu plus visible Upgrade gating | Mode menu; nested `.selected` is authoritative | Exact profile rows; visible Upgrade state makes unconfirmed rows unavailable |
-| Thinking effort | Dynamic account-dependent labels | Model-dependent Extended/effort/Thinking controls | Independent Extended thinking row | No independent control; explicitly model-coupled/unsupported |
-| File upload | Exact `#upload-files` input | Exact authenticated upload input | Dynamic `Filedata` input after visible upload-menu preparation | Exact authenticated `input[name="files"]` |
-| Prompt input | Exact visible composer | Exact visible composer | Exact rich-text composer | Exact ProseMirror composer |
-| Prompt submit | Local visible-submit harness exists | Local visible-submit harness exists | Local visible-submit harness exists | Local visible-submit and signup-gate harnesses exist |
-
-### Enrichment action status
-
-| Product area | Current checkpoint | Product-complete target |
-| --- | --- | --- |
-| Skills | Contract vocabulary and some observed menu entry points only. | Inspect, upload/install, enable/disable, manage, and report unsupported semantics per provider. |
-| Connectors | Inspect/select vocabulary and observed entry points only. | Inspect existing connectors, add with explicit user approval, handle OAuth handoff, verify final visible connection. |
-| Projects | Existing strict target-URL isolation for ChatGPT and Claude; rough inspect/open vocabulary. | Find, create, open, verify identity, inspect/configure options, and prove isolation on every provider that supports it. |
-| History | Rough inspect/open vocabulary; some search/history controls observed. | Privacy-bounded search/find/open without harvesting or persisting an account's entire private history. |
-
-## Provider-specific checkpoint
-
-### ChatGPT
-
-Substantially implemented:
-
-- signed-in status through the visible account control;
-- dynamic model inventory and exact selection;
-- dynamic Intelligence/effort labels without a fixed five-level assumption;
-- exact generic file input;
-- visible prompt input and submission harnesses;
-- existing strict Project URL transition isolation.
-
-Still missing or incomplete:
-
-- authenticated Free-account fixtures;
-- current usage/quota inspection;
-- Project discovery, creation, picker, and options;
-- unified skills/connectors/history behavior;
-- locale, responsive layout, experiment, and account-tier variants;
-- final clean regression after the current changes.
-
-### Claude
-
-Substantially implemented:
-
-- direct authenticated Free-plan evidence;
-- exact model inventory and selection;
-- visible Upgrade-row gating;
-- model-dependent Extended, effort, and Thinking controls;
-- exact file input and composer;
-- existing strict Project URL transition isolation.
-
-Still missing or incomplete:
-
-- native Project discovery/create/picker behavior;
-- skills and connector workflows beyond observed menus;
-- history search/open behavior;
-- usage/limit states and broader Free-account variants;
-- final clean full-chain regression.
-
-### Gemini
-
-Substantially implemented:
-
-- privacy-safe signed-in detection with plan left unknown;
-- exact mode inventory and selection;
-- correct use of nested `.selected` rather than keyboard-highlight
-  `data-active`;
-- Extended thinking handling;
-- exact rich-text composer;
-- dynamic file-input preparation through the visible Upload and tools menu.
-
-Still missing or incomplete:
-
-- trustworthy plan/usage status;
-- broader file-chooser lifecycle and upload-limit cases;
-- Gems/Project-equivalent isolation semantics;
-- Drive/connector behavior;
-- history search/open behavior;
-- authenticated Free/no-plan fixture coverage;
-- final captured-DOM and full-chain regression.
-
-### Grok
-
-Substantially implemented:
-
-- privacy-safe signed-in detection with plan left unknown;
-- exact Fast/Auto/Expert/Heavy inventory;
-- visible Upgrade evidence overriding misleading `aria-disabled="false"`;
-- Fast confirmed as the executable captured state;
-- independent effort correctly rejected as model-coupled;
-- exact file input and composer;
-- observed Projects, History, Search, Skills, and connector entry points.
-
-Still missing or incomplete:
-
-- authenticated Free-plan evidence;
-- reliable paid/Free entitlement variants;
-- Project find/create/open/options;
-- history search/open behavior;
-- skills and connector actions;
-- authenticated generation and limit-state fixtures;
-- final captured-DOM and full-chain regression.
-
-## Transport and runtime checkpoint
-
-The intended execution chain is present:
-
-```text
-provider-action / provider-status / provider-controls / run
-    -> loopback daemon job
-    -> Native Messaging claimed job
-    -> extension bridge request
-    -> unified visible-provider runtime
-    -> provider content adapter
-```
-
-Relevant implementation areas include:
-
-- `packages/cli/src/tokenless.mts`
-- `packages/daemon/src/native_host.rs`
-- `packages/extension/extension/shared/bridge-protocol.ts`
-- `packages/extension/extension/shared/visible-provider-actions.ts`
-- `packages/extension/extension/shared/visible-provider-capabilities.ts`
-- `packages/extension/extension/background/visible-provider-action-runtime.ts`
-- `packages/extension/extension/background/service-worker.ts`
-- `packages/extension/extension/content/provider-content.ts`
-
-### File transport
-
-The existing attachment path stages regular non-symlink files in a private
-local bundle, computes size and SHA-256, sends path-free descriptors through the
-daemon and extension protocols, streams bounded bytes through the native host,
-reconstructs browser `File` objects, installs one exact provider `FileList`, and
-requires new visible filename evidence.
-
-The current safe semantic boundary is:
-
-- `run --attach-file ... --prompt ...` is the atomic file-plus-prompt operation;
-- standalone `provider-action --action file.upload` leaves a file visibly
-  attached for manual/local follow-up;
-- `prompt.input` may reuse the validated provider tab to draft text;
-- an independent later `prompt.submit` must not silently inherit the prior
-  upload request's attachment ledger;
-- a bare extension-owned runtime envelope cannot upload bytes without an active
-  daemon/native claim and must fail closed.
-
-If the product later needs composable standalone upload and submit actions, it
-requires an explicit, bounded action-session/correlation design. Provider-wide
-implicit affinity is not sufficient because it could submit a stale file from
-an unrelated request.
-
-### Runtime work that remains
-
-- MV3 service-worker suspension and restart recovery;
-- deterministic multi-tab and multi-window selection;
-- explicit action/session correlation;
-- navigation and SPA rerender resilience;
-- bounded retry, timeout, cancellation, and cleanup semantics per action;
-- idempotency and duplicate-request behavior across restarts;
-- native framing/backpressure and large-bundle stress coverage;
-- privacy-safe action traces and drift diagnostics.
-
-## Verification checkpoint
-
-### Reported green checkpoints during development
-
-- Authenticated fixture integrity/provenance suite: 3/3.
-- Focused ChatGPT/Claude auth and control suite: 3/3.
-- Extension contract plus focused controls at one checkpoint: 20/20.
-- Four-provider attachment-content suite: all reported top-level tests passed.
-- Multiple extension lint/build, CLI build/lint, unified action contract,
-  runtime, service-worker, and native-route focused runs passed at intermediate
-  checkpoints.
-- A real local Rust/native/MV3 attachment E2E passed before the final
-  stale-attachment safety adjustment.
-
-### Not yet a final green release proof
-
-- `test/provider-dom-adapter.e2e.test.mjs` was added to merge authenticated
-  captured scenarios and drive the real content adapter. Its first run occurred
-  while another concurrent build had cleaned and only partially regenerated
-  `dist`, so the content script did not load. This was not a selector assertion
-  failure, but the test still needs a clean rerun.
-- The native/file E2E needs to be rerun after removal of unsafe automatic
-  attachment-ledger inheritance.
-- The final unified focused suite has not been recorded as one clean run after
-  all last edits.
-- The final extension build, CLI build, Rust formatting/tests, root full suite,
-  and `git diff --check` have not been recorded together from the final tree.
-- Some documentation still described older Gemini/Claude upload/model evidence
-  and the pre-native unified file boundary at the pause point.
-
-The branch therefore represents an advanced implementation checkpoint, not a
-merge-ready or release-ready assertion.
-
-## Initiative portfolio
-
-| ID | Initiative | Product outcome | Current status | Major remaining work |
-| --- | --- | --- | --- | --- |
-| I0 | Visible-session safety foundation | All automation stays in visible, user-authorized UI. | Largely established | Continue privacy review for history, connectors, debugging, and traces. |
-| I1 | Authenticated and signed-out DOM lab | Real DOM evidence drives deterministic local acceptance. | Authenticated core corpus captured | Automate capture/redaction, add variants, rerun direct captured-DOM E2E, add drift lifecycle. |
-| I2 | Unified provider-web API | Clients use one truthful provider-neutral action model. | Core v1 vocabulary exists | Complete enrichment semantics, session model, errors, usage schema, and acceptance levels. |
-| I3 | Priority action parity | Auth, model, effort, file, and prompt work across four providers. | Substantially implemented | Final regression, more entitlement states, failure/recovery cases, clean capability alignment. |
-| I4 | Free-plan and entitlement intelligence | Tokenless reports what the current account can actually do. | Documentation baseline plus one authenticated Free provider | Real Free profiles for three providers, visible usage/limit extraction, quota and upgrade-state matrix. |
-| I5 | Reliable local execution platform | CLI/native/extension actions survive real browser/runtime conditions. | Main chain exists | MV3 restart, navigation, concurrency, idempotency, cancellation, session affinity, stress tests. |
-| I6 | Provider-native Projects | Agents can find/create/open/configure a verified isolated workspace. | Existing URL isolation for ChatGPT/Claude only | Product API, confirmation UX, provider adapters, local fixtures, isolation proofs. |
-| I7 | History navigation | Agents can find and reopen a requested chat safely. | Entry points observed; rough vocabulary | Query semantics, bounded metadata, privacy policy, adapters, tests. |
-| I8 | Skills | Provider-native reusable skills can be inspected and managed. | Menu evidence and rough upload vocabulary | Define provider-neutral semantics, distinguish from files, implement each provider or return unsupported. |
-| I9 | Connectors | Existing connectors can be inspected and selected; new ones use explicit OAuth handoff. | Entry points observed; rough inspect/select vocabulary | Addition flow, consent boundaries, OAuth UX, visible verification, revocation/error states. |
-| I10 | Drift, observability, and operations | Failures are diagnosable without leaking private content. | Selector fail-closed behavior exists | Registry/versioning, traces, fixture provenance links, capture tooling, alerts, feature flags, kill switches. |
-| I11 | Release readiness | A tested, documented, reversible provider/action matrix can ship safely. | Not reached | Clean full suite, security review, packaging, canary plan, rollback, explicit publication approval. |
-
-## Major initiatives still ahead
-
-### 1. Automated DOM evidence lifecycle
-
-Create a capture tool that can acquire only authorized visible DOM, reduce it to
-an adapter-relevant surface, redact identities/private content, scan for PII and
-secrets, attach provenance, hash the artifact, and compare it with prior
-fixtures. Raw snapshots should remain ephemeral.
-
-The evidence matrix eventually needs:
-
-- signed-out and signed-in states;
-- actual Free and paid tiers;
-- model/effort menus;
-- enabled, disabled, upgrade, quota, and error states;
-- file chooser ready, accepted, rejected, and limit states;
-- prompt idle, submitting, streaming, complete, and failed states;
-- Project, history, skill, and connector workflows;
-- locale, viewport, responsive layout, and experiment variants.
-
-### 2. Truthful capability and entitlement model
-
-The capability system should evolve beyond one `verified` bit. It should be able
-to express:
-
-- implemented versus locally accepted versus live accepted;
-- authenticated requirement;
-- currently available versus visible-but-upgrade-gated;
-- independent versus coupled controls;
-- account/tier/locale uncertainty;
-- runtime limits and visible usage;
-- reversible versus externally consequential mutations;
-- provider/action kill-switch state.
-
-### 3. Explicit action-session and transaction semantics
-
-Standalone actions need a safe way to share one visible provider tab and one
-bounded mutation context. The design must answer:
-
-- how a caller obtains and resumes a session;
-- when a tab may be reused;
-- how a file attachment is correlated with a later prompt;
-- how sessions expire or are canceled;
-- how service-worker restarts recover or invalidate state;
-- how concurrent callers avoid cross-contamination;
-- what becomes one atomic transaction.
-
-Until that exists, atomic file-plus-prompt execution should remain a single
-`run` request.
-
-### 4. Provider-native Project workflows
-
-Projects need a first-class domain model rather than a generic navigation label.
-The API should cover find, create, open, inspect identity, inspect/configure
-options, and verify isolation before prompt submission.
-
-Project creation changes provider state and should require an explicit caller
-intent and visible confirmation. Cross-Project or ordinary-chat navigation must
-fail closed.
-
-### 5. Privacy-bounded history workflows
-
-History search must not become bulk account scraping. Define the minimal query
-and result fields, maximum result count, user-visible scope, persistence rules,
-and logging policy before implementing adapters.
-
-### 6. Skills and connectors
-
-Provider meanings differ. A Claude skill, a Grok skill, a ChatGPT plugin/tool,
-and a Gemini Gem are not automatically equivalent. The unified API should
-preserve common intent while returning unsupported or provider-specific
-constraints honestly.
-
-Adding a connector may invoke OAuth or grant access to external data. Tokenless
-must never silently complete that authorization. It should bring the user to a
-visible consent boundary and verify only what the user explicitly approved.
-
-### 7. Browser/runtime hardening
-
-Build a resilience matrix for service-worker suspension, extension reload,
-browser restart, stale nodes, SPA transitions, multiple tabs, background tabs,
-slow rendering, provider challenges, navigation drift, duplicate jobs,
-cancellation, and partial attachment cleanup.
-
-### 8. Observability and maintenance
-
-Add structured, privacy-safe traces that identify the provider, action, adapter
-version, failed step, selector contract, and expected visible proof without
-recording prompts, file contents, account identities, history titles, or hidden
-credentials.
-
-Each provider/action should have a feature flag and kill switch so a provider
-DOM rollout can be disabled without shipping unsafe guesses.
-
-## Open product decisions
-
-1. What exactly should capability state mean: implemented, locally accepted,
-   full-chain accepted, live accepted, or released?
-2. What is the explicit provider action-session/correlation contract?
-3. Should the current private v1 vocabulary be expanded before it becomes a
-   compatibility promise?
-4. What bounded visible usage/quota schema can work across providers?
-5. Which real Free/test accounts and browser profiles will maintain the tier
-   matrix?
-6. What user confirmation is required for Project creation, connector addition,
-   skill installation, and other durable mutations?
-7. What minimal history metadata may cross the extension boundary, and may any
-   of it be persisted?
-8. How should localization map exact visible labels without guessing?
-9. How frequently should fixtures be recaptured, and what drift blocks a
-   release?
-10. Which browsers beyond Chromium are in scope, and when?
-
-## Recommended sequencing
-
-### Phase A — Close the current priority-action increment
-
-1. Freeze concurrent writers and inspect the complete working-tree diff.
-2. Run one clean extension build so `dist` is not partially regenerated.
-3. Rerun authenticated fixture integrity and captured-DOM adapter E2E.
-4. Rerun core auth/model/effort/prompt and attachment suites.
-5. Rerun unified contract/runtime/service-worker/native-route tests.
-6. Rerun the native file E2E after the stale-file inheritance safety change.
-7. Run extension and CLI lint/build, Rust format/tests, root full tests, and
-   `git diff --check`.
-8. Reconcile the capability manifest and documentation with the actual final
-   acceptance evidence.
-9. Perform a privacy/security diff review.
-10. Commit and merge the coherent increment; do not publish.
-
-### Phase B — Harden the core execution platform
-
-- explicit action sessions and transactions;
-- MV3 restart and browser navigation resilience;
-- multiple-tab/concurrent-caller isolation;
-- cancellation, retry, timeout, and cleanup contracts;
-- actual Free-account and entitlement-state matrix;
-- privacy-safe traces, selector drift diagnostics, flags, and kill switches;
-- an explicitly authorized live test-account smoke suite.
-
-### Phase C — Complete the product surface
-
-1. Projects: find/create/open/options/isolation.
-2. History: search/find/open with privacy limits.
-3. Skills: inspect/upload/manage with provider-specific capability truth.
-4. Connectors: inspect/select/add plus visible OAuth handoff.
-5. Usage/limits: visible plan, quota, rate-limit, and upgrade-state reporting.
-
-### Phase D — Operate and release
-
-- automated evidence recapture and drift comparison;
-- locale, viewport, experiment, and tier variants;
-- provider/action quality dashboard;
-- canary and rollback strategy;
-- troubleshooting and support matrix;
-- final package/extension verification;
-- explicit publication approval.
-
-## Definition of done for one provider action
-
-An action is release-ready only when all applicable items are true:
-
-- The provider behavior and visible postcondition are specified.
-- Signed-out, signed-in, entitlement, and failure states are understood.
-- Redacted real DOM plus provenance exists.
-- The real content adapter runs against the captured DOM contract.
-- Deterministic local mutation behavior verifies the visible postcondition.
-- CLI/native/daemon/extension full-chain coverage passes when applicable.
-- Selector drift, navigation drift, limits, and ambiguous states fail closed.
-- No private browser credential or private provider API is used.
-- Returned data is bounded and privacy-reviewed.
-- Capability state and documentation match the acceptance evidence.
-- Lint, builds, Rust checks, focused tests, and the full suite pass cleanly.
-- A kill switch exists for a mutating provider action.
-- Publication, if any, has explicit approval.
-
-## Resume checklist
-
-Start by treating the current tree as uncommitted work owned by this initiative.
-Do not discard or overwrite it.
-
-Suggested first inspection:
-
-```text
-git status --short
-git diff --stat
-git diff --check
-```
-
-Then run a clean, serialized verification sequence. At minimum, include:
-
-```text
-npm run lint --workspace tokenless-browser-session-bridge
-npm run build --workspace tokenless-browser-session-bridge
-
-node --test test/provider-dom-authenticated-fixtures.test.mjs
-node --test test/provider-dom-adapter.e2e.test.mjs
-node --test test/claude-chatgpt-visible-controls.test.mjs
-node --test test/visible-attachment-content.test.mjs
-node --test test/visible-provider-action-contract.test.mjs
-node --test test/visible-provider-action-runtime.test.mjs
-node --test test/visible-provider-action-service-worker.test.mjs
-node --test test/visible-provider-action-native-route.test.mjs
-node --test test/visible-provider-controls-cli.test.mjs
-node --test test/extension-contract.test.mjs
-
-cargo fmt --manifest-path packages/daemon/Cargo.toml -- --check
-cargo test --manifest-path packages/daemon/Cargo.toml
-npm test
-```
-
-Run the repository's extension/native E2E command as a separate explicit step;
-it may have environment prerequisites and should be rerun after all builds are
-stable.
-
-After verification:
-
-- update stale README/evidence claims;
-- review every capability marked verified;
-- scan fixtures and response schemas for private content;
-- inspect the final diff for unrelated changes;
-- commit and merge only when the checkpoint is coherent;
-- wait for explicit approval before publication.
-
-## Important files
-
-### Product and evidence
-
-- `docs/visible-provider-evidence.md`
-- `test/fixtures/provider-dom/`
-- `test/provider-dom-authenticated-fixtures.test.mjs`
-- `test/provider-dom-adapter.e2e.test.mjs`
-
-### Unified contract and capabilities
-
-- `packages/extension/extension/shared/visible-provider-actions.ts`
-- `packages/extension/extension/shared/visible-provider-capabilities.ts`
-- `packages/extension/extension/shared/bridge-protocol.ts`
-- `packages/extension/src/protocol.ts`
-- `packages/extension/src/providers.ts`
-
-### Execution runtime
-
-- `packages/extension/extension/background/visible-provider-action-runtime.ts`
-- `packages/extension/extension/background/service-worker.ts`
-- `packages/extension/extension/content/provider-content.ts`
-- `packages/daemon/src/native_host.rs`
-- `packages/cli/src/tokenless.mts`
-
-### Focused acceptance
-
-- `test/claude-chatgpt-visible-controls.test.mjs`
-- `test/visible-attachment-content.test.mjs`
-- `test/visible-provider-action-contract.test.mjs`
-- `test/visible-provider-action-runtime.test.mjs`
-- `test/visible-provider-action-service-worker.test.mjs`
-- `test/visible-provider-action-native-route.test.mjs`
-- `test/visible-provider-controls-cli.test.mjs`
-- `test/extension-contract.test.mjs`
-- `test/daemon-visible-session.e2e.mjs`
-
-## Explicit non-goals
-
-- Exporting or transmitting provider cookies, credentials, browser-storage
-  tokens, or hidden authorization material.
-- Importing Gemini/Google authentication, broad X/Twitter sessions, or shared
-  browser storage into a managed profile.
-- Calling undocumented or private provider APIs.
-- Bypassing subscriptions, paywalls, rate limits, CAPTCHA, or upgrade gates.
-- Rebuilding complete provider websites locally.
-- Storing raw authenticated DOM or unrelated private account content.
-- Claiming Free-plan support from marketing documentation alone.
-- Guessing that every provider has equivalent models, effort, Projects, skills,
-  connectors, or history behavior.
-- Silently submitting prompts, uploading files, creating Projects, or
-  authorizing connectors during evidence capture.
-- Replacing official provider APIs for unattended server-side or high-volume
-  workloads.
-- Publishing artifacts as part of this checkpoint.
-
-## Final handoff state
-
-The project has moved from a ChatGPT-heavy prototype toward a real four-provider
-visible-session platform. The most important architectural pieces now exist:
-authenticated DOM evidence, a unified action contract, truthful provider
-capabilities, provider-specific core adapters, path-free native file transport,
-and local deterministic testing.
-
-The next owner should first close and verify this core increment. The larger
-product opportunity is then to turn the current action runtime and DOM evidence
-lab into a continuously maintained platform: explicit sessions, Project and
-history workflows, skills and connectors, Free-tier/usage intelligence, drift
-automation, resilient browser execution, privacy-safe observability, and a
-release-quality provider/action matrix.
diff --git a/legacy/docs/visible-provider-evidence.md b/legacy/docs/visible-provider-evidence.md
deleted file mode 100644
index 4f32d33..0000000
--- a/legacy/docs/visible-provider-evidence.md
+++ /dev/null
@@ -1,302 +0,0 @@
-# Visible provider evidence
-
-Tokenless visible-session adapters operate only through provider UI that a user
-can see and authorize in the browser. They do not read provider cookies,
-`localStorage` or `sessionStorage` credentials, hidden authorization headers,
-or private provider APIs.
-
-Provider products and DOM can change. Runtime code treats the current visible
-UI as authoritative and fails closed when a required control or state cannot be
-verified.
-
-## Evidence states
-
-Three states must not be conflated:
-
-- **Observed DOM** means a control was visible in a user-authorized browser
-  session and its adapter-relevant markup was reduced into a redacted fixture.
-  Observation alone does not enable an action.
-- **Implemented** means an extension content path can inspect or operate that
-  control. Implementation alone does not prove the provider accepted the
-  resulting action.
-- **Accepted** means the named implementation boundary has a focused automated
-  proof. A reduced-DOM selector test, a full extension/native-host fixture E2E,
-  and a live provider mutation are different acceptance boundaries and are
-  described separately.
-
-The unified visible-provider capability manifest is the runtime source of
-truth. An action is exposed only when its manifest state is `verified`;
-`pending_evidence` and `unsupported` actions fail closed. Adding an observed
-fixture never changes that state by itself.
-
-## Published Free access baseline
-
-Provider documentation confirms that all four products have a Free web entry
-point, but published availability is not proof of the current browser account,
-its remaining quota, or a particular visible control:
-
-| Provider | Current official Free-web baseline | Tokenless interpretation |
-| --- | --- | --- |
-| ChatGPT | The [Free Tier FAQ](https://help.openai.com/en/articles/9275245-using-chatgpt-s-free-tier) lists model access, web tools, and file/image uploads with tighter limits; [Projects](https://help.openai.com/en/articles/10169521-projects-in-chatgpt) are also available with Free-specific file limits. | Free sessions can be useful, but the captured authenticated session was Plus and the current visible menu/limit always wins. |
-| Claude | Anthropic lists a [$0 Free plan](https://support.anthropic.com/en/articles/11049762-choosing-a-claude-ai-plan), and its [file-upload documentation](https://support.anthropic.com/en/articles/8241126-what-kinds-of-documents-can-i-upload-to-claude-ai) covers visible chat attachments. | The captured authenticated session visibly reported Free; model and effort availability is still read from that session's DOM. |
-| Gemini | Google's [Gemini Apps limits](https://support.google.com/gemini/answer/16275805?hl=en-AG) document no-AI-plan access to multiple modes and Extended thinking; [file uploads](https://support.google.com/gemini/answer/14903178?hl=en-SG) require sign-in and apply stricter limits without Pro or Ultra. | The captured session was signed in but had no reliable plan label, so Tokenless reports its plan as unknown. |
-| Grok | xAI lists a limited [$0 Free plan](https://x.ai/pricing), while the [Grok overview](https://docs.x.ai/grok/overview) documents visible file use and higher paid limits. | The captured session's plan remains unknown; visible Upgrade evidence makes unavailable model profiles fail closed. |
-
-These sources answer whether a Free route exists. They do not authorize
-Tokenless to infer authentication, plan, quota, model entitlement, or upload
-acceptance without current visible DOM evidence.
-
-## Authenticated fixture corpus
-
-On 2026-07-17, four new, blank provider tabs were inspected through the user's
-signed-in Chrome profile. No account name, email, chat title, message content,
-or private route was retained. No prompt was submitted and no file was
-uploaded. Temporary model or thinking selections used to inspect visible state
-were restored.
-
-The fixtures live under:
-
-```text
-test/fixtures/provider-dom/<provider>/<account-state>/<scenario>.html
-```
-
-Each HTML file has a same-basename `.provenance.json` sidecar containing the
-provider, account state, observed plan or `unknown`, scenario, sanitized public
-route, evidence selectors, redaction notes, and a SHA-256 of the HTML. The
-authenticated fixtures are static reduced DOM: they contain no provider
-JavaScript and no synthetic behavior.
-
-Five priority scenarios are retained for every provider:
-
-- `session-status`
-- `model-menu-open`
-- `thinking-effort-menu-open`
-- `file-input-ready`
-- `composer-idle`
-
-The account and plan observations are deliberately narrow:
-
-| Provider | Fixture account state | Visible plan evidence | What may be inferred |
-| --- | --- | --- | --- |
-| ChatGPT | `signed-in-paid` | Plus | These controls were visible on one Plus account. This is not authenticated Free-plan proof. |
-| Claude | `signed-in-free` | Free plan | The retained auth, model, effort, file-input, and composer controls were visible on one Free account. Limits remain provider-controlled. |
-| Gemini | `signed-in-unknown` | None | The account was signed in. A current model label does not establish the account's plan. |
-| Grok | `signed-in-unknown` | None | The account was signed in. Published Free availability and visible upsells do not identify this account's plan. |
-
-Existing unauthenticated, public-share, and deterministic harness fixtures are
-preserved separately. Their provider DOM and their synthetic test transitions
-must not be cited as authenticated provider acceptance.
-
-## Unified visible action contract
-
-The versioned action vocabulary covers:
-
-- `auth.status`
-- `model.inspect` and `model.select`
-- `effort.inspect` and `effort.select`
-- `file.upload` and `skill.upload`
-- connector inspection and selection
-- `prompt.input` and `prompt.submit`
-- project inspection and opening
-- history inspection and opening
-
-The first implementation priority is authentication status, model selection,
-thinking effort, file upload, and prompt input.
-
-`tokenless provider-status` and its `provider-auth-status` alias inspect only
-visible sign-in signals. The response may expose an allowlisted plan label such
-as Free or Plus, but never account identity. Ambiguous or contradictory visible
-signals return `unknown`.
-
-Model and effort requests use complete visible labels after whitespace and case
-normalization. `--effort` is an exact provider-visible label for every provider;
-ChatGPT's chat-surface and trusted-debugger controls remain ChatGPT-specific.
-Ordered model fallbacks are tried only when their exact rows are visibly
-available, and the selected state must be verified after interaction.
-
-Repeated `run --attach-file <path>` arguments use the existing visible
-attachment transport. The CLI stages regular non-symlink files into a private
-bundle and sends path-free size/SHA-256 descriptors. The native host streams
-bounded bytes for the claimed job, and the content script reconstructs browser
-`File` objects for one exact provider input. Submission requires new visible
-filename evidence. The standalone unified `file.upload` action remains
-capability-gated because a direct action request does not itself provide that
-daemon/native byte context.
-
-Project-isolated submission currently accepts an exact existing ChatGPT or
-Claude Project URL and permits only the corresponding same-Project
-conversation transition. Project discovery, creation, and picker automation
-are separate actions and remain capability-gated.
-
-## ChatGPT
-
-The [ChatGPT Free Tier FAQ](https://help.openai.com/en/articles/9275245-using-chatgpt-s-free-tier-faq)
-documents a Free offering, while the authenticated account inspected here
-visibly reported Plus. Published Free availability is product documentation,
-not evidence that the authenticated fixture came from a Free account.
-
-### Observed DOM
-
-The authenticated fixtures retain:
-
-- `[data-testid="accounts-profile-button"][role="button"]` as the positive
-  signed-in signal, with account identity redacted and only Plus retained;
-- `div#prompt-textarea[contenteditable="true"][role="textbox"]` and its
-  textarea fallback;
-- `button[data-testid="composer-plus-btn"][aria-label="Add files and more"]`;
-- `input#upload-files[type="file"][multiple]` as the generic file input;
-- the composer Intelligence pill, `menuitemradio` effort rows, model submenu,
-  and `aria-checked` selected state.
-
-This account showed three current effort labels: Instant, Medium, and High.
-That observation replaces any fixed five-level assumption but does not define
-a provider-wide count or order. Model primary labels remain separate from
-secondary lifecycle text.
-
-### Implementation and acceptance
-
-Authentication, exact model inspection/selection, exact effort
-inspection/selection, and prompt input are implemented in the content adapter.
-The ChatGPT/Claude focused control suite and extension build are green for the
-captured dynamic menu structure. Unified action exposure still follows the
-capability manifest and its bridge-level tests.
-
-The existing attachment pipeline uses only `#upload-files` and requires visible
-filename confirmation. Image-only inputs are not generic attachment fallbacks.
-No real file was uploaded during the authenticated DOM observation.
-
-An exact target such as
-`https://chatgpt.com/g/<g-p-project-id>/project` may transition only to
-`/g/<same-g-p-project-id>/c/<conversation-id>`. Tokenless does not yet create or
-select a Project through the unified action API.
-
-## Claude
-
-[Claude pricing](https://claude.com/pricing) documents a Free web plan, and the
-authenticated session inspected here also visibly displayed `Free plan`. This
-is direct evidence that the retained controls were present on that Free
-account; it is not a promise of fixed quotas or universal model availability.
-
-### Observed DOM
-
-The authenticated fixtures retain:
-
-- `button[data-testid="user-menu-button"]` plus a separate visible Free-plan
-  label;
-- `button[data-testid="model-selector-dropdown"][aria-label^="Model: "]`;
-- visible `menuitemradio` model rows, with `aria-checked` selection;
-- `div[data-testid="chat-input"][contenteditable="true"][role="textbox"]`;
-- `input#chat-input-file-upload-onpage[data-testid="file-upload"][aria-label="Upload files"][type="file"][multiple]`;
-- exact Chats, Projects, and Customize navigation links.
-
-Fable 5 and Opus 4.8 carried visible Upgrade evidence, while Sonnet 5 and Haiku
-4.5 were enabled on the observed account. Availability therefore fails closed
-on the visible Upgrade descendant rather than relying only on `aria-disabled`.
-
-Effort is model-dependent. Haiku exposed an Extended switch. In a temporary
-Sonnet state, the UI exposed Low, Medium, High, Extra, and Max effort rows plus
-a Thinking switch. The session was restored to Haiku after inspection.
-
-The Add menu also visibly contained Skills and Add connector entries, but menu
-presence is only observed DOM; skill upload and connector actions are not
-accepted by that observation.
-
-### Implementation and acceptance
-
-Claude authentication, exact model selection, model-dependent effort, and
-prompt input are implemented. Focused authenticated-fixture control tests and
-the extension build are green. The older full-chain fixture separately accepts
-prompt submission, conversation navigation, streaming completion, stable-answer
-selection, blocker detection, and selector-drift failure.
-
-The attachment receiver is implemented for the exact input and accepted by
-local extension/native-host fixture coverage, with visible filename evidence
-required before submission. No provider-owned file upload was performed during
-the authenticated capture.
-
-An exact `https://claude.ai/project/<project-id>` target may transition only to
-`/project/<same-project-id>/chat/<conversation-id>`. Native project discovery,
-creation, and picker actions remain capability-gated.
-
-## Gemini
-
-[Gemini Apps availability](https://support.google.com/gemini/answer/13278668?hl=en)
-documents that some web features can be used without signing in. The new
-authenticated fixture proves a signed-in session through its visible Google
-account SignOutOptions link, but no reliable plan label was present. The account
-state is therefore `signed-in-unknown`, not Free or paid.
-
-### Observed DOM
-
-The authenticated fixtures retain:
-
-- `rich-textarea div.ql-editor[data-gramm="false"][contenteditable="true"][role="textbox"][aria-multiline="true"][aria-label="Enter a prompt for Gemini"]`;
-- `button[data-test-id="bard-mode-menu-button"][aria-haspopup]`;
-- `gem-menu-item[role="menuitem"][data-mode-id]` and each primary `.label`;
-- `gem-menu-item-content.selected` as committed model state;
-- the independent Extended thinking row;
-- `button[aria-label="Upload and tools"]` and the exact local uploader item;
-- the dynamically created `input[type="file"][name="Filedata"][multiple]`.
-
-`data-active="true"` is keyboard highlight, not committed selection. Adapters
-must use the nested `.selected` state. The exact file input appeared only after
-the local upload item opened a file chooser; the chooser was intercepted and no
-file was selected.
-
-### Implementation and acceptance
-
-Gemini prompt input, model inventory/selection, Extended thinking handling, and
-dynamic file-input preparation have content-adapter implementations. Runtime
-exposure remains action-specific: an authenticated selector fixture does not
-substitute for a provider-owned upload or generation-completion proof.
-
-The current authenticated sidebar exposed chat search but did not establish a
-safe Project or Gem isolation workflow. Those actions remain capability-gated.
-
-## Grok
-
-[Grok pricing](https://x.ai/pricing) and the
-[Grok overview](https://docs.x.ai/grok/overview) document a Free offering. The
-authenticated account inspected here had no reliable visible plan label, so
-its fixture remains `signed-in-unknown`. Tokenless does not infer this account's
-plan from published pricing, a composer, or an upsell.
-
-### Observed DOM
-
-The authenticated fixtures retain:
-
-- `a[href="/skills-and-connectors"]` as a positive signed-in signal;
-- `div.tiptap.ProseMirror[contenteditable="true"][role="textbox"][aria-label="Ask Grok anything"][aria-multiline="true"]`;
-- `button#model-select-trigger[aria-label="Model select"][aria-haspopup="menu"]`;
-- model rows as `[role="menuitem"][data-radix-collection-item]` with primary
-  `span.font-semibold` labels;
-- `button[data-testid="attach-button"][aria-label="Attach"][aria-haspopup="menu"]`;
-- `input[type="file"][name="files"][multiple]`;
-- visible Projects, History, Search, Skills, and connector entry points.
-
-Fast was the selected executable model on this account. Auto, Expert, and Heavy
-were visible rows and reported `aria-disabled="false"`, but the same menu showed
-an Upgrade action and those rows led to the upsell. The adapter therefore treats
-only the selected Fast row as available while that Upgrade prompt is visible.
-This is account-specific entitlement evidence, not proof of a Free plan.
-
-Expert and Heavy describe thinking depth as model profiles. No independent
-effort control was observed, so a separate Grok effort request fails closed as
-coupled to model selection.
-
-### Implementation and acceptance
-
-Grok authentication, prompt input, exact model inventory/selection, model-coupled
-effort rejection, and the exact attachment input have content-adapter paths.
-Availability uses the visible Upgrade evidence rather than trusting
-`aria-disabled="false"` alone.
-
-The signed-out harness still proves that an interactive anonymous composer may
-end at the visible signup paywall. Authenticated generation completion remains
-separate from the new static DOM evidence because no authenticated prompt was
-submitted during capture.
-
-Project creation UI and history controls were observed, including a New Project
-dialog, but no project was created. Project, history, skill, and connector
-actions remain capability-gated until their implementations and focused visible
-state transitions are accepted.
diff --git a/legacy/extension/.gitignore b/legacy/extension/.gitignore
deleted file mode 100644
index 849ddff..0000000
--- a/legacy/extension/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-dist/
diff --git a/legacy/extension/README.md b/legacy/extension/README.md
deleted file mode 100644
index f87c703..0000000
--- a/legacy/extension/README.md
+++ /dev/null
@@ -1,14 +0,0 @@
-# Legacy browser extension
-
-Archived Manifest V3 extension and protocol helpers for the former Native Messaging path.
-
-This package is not part of the active Tokenless workspace, default build, or user-facing product. The active path is managed Playwright automation through the local daemon.
-
-Build locally only when experimenting with the archive:
-
-```bash
-npm install --prefix legacy/extension
-npm run build --prefix legacy/extension
-```
-
-Load `legacy/extension/dist/extension` as an unpacked Chromium extension only for legacy experiments.
diff --git a/legacy/extension/assets/chrome-web-store/activity-1280x800.png b/legacy/extension/assets/chrome-web-store/activity-1280x800.png
deleted file mode 100644
index ae16964..0000000
Binary files a/legacy/extension/assets/chrome-web-store/activity-1280x800.png and /dev/null differ
diff --git a/legacy/extension/assets/chrome-web-store/marquee-1400x560.png b/legacy/extension/assets/chrome-web-store/marquee-1400x560.png
deleted file mode 100644
index 12a2ab4..0000000
Binary files a/legacy/extension/assets/chrome-web-store/marquee-1400x560.png and /dev/null differ
diff --git a/legacy/extension/assets/chrome-web-store/settings-1280x800.png b/legacy/extension/assets/chrome-web-store/settings-1280x800.png
deleted file mode 100644
index 614fb27..0000000
Binary files a/legacy/extension/assets/chrome-web-store/settings-1280x800.png and /dev/null differ
diff --git a/legacy/extension/assets/chrome-web-store/small-promo-440x280.png b/legacy/extension/assets/chrome-web-store/small-promo-440x280.png
deleted file mode 100644
index fc455d7..0000000
Binary files a/legacy/extension/assets/chrome-web-store/small-promo-440x280.png and /dev/null differ
diff --git a/legacy/extension/assets/chrome-web-store/store-icon-128x128.png b/legacy/extension/assets/chrome-web-store/store-icon-128x128.png
deleted file mode 100644
index ad8d411..0000000
Binary files a/legacy/extension/assets/chrome-web-store/store-icon-128x128.png and /dev/null differ
diff --git a/legacy/extension/assets/tokenless_logo.png b/legacy/extension/assets/tokenless_logo.png
deleted file mode 100644
index 20cc77a..0000000
Binary files a/legacy/extension/assets/tokenless_logo.png and /dev/null differ
diff --git a/legacy/extension/assets/tokenless_logo_128_128.png b/legacy/extension/assets/tokenless_logo_128_128.png
deleted file mode 100644
index 6edb198..0000000
Binary files a/legacy/extension/assets/tokenless_logo_128_128.png and /dev/null differ
diff --git a/legacy/extension/default-extension-id.mjs b/legacy/extension/default-extension-id.mjs
deleted file mode 100644
index deb73da..0000000
--- a/legacy/extension/default-extension-id.mjs
+++ /dev/null
@@ -1,2 +0,0 @@
-// Archived Chrome Web Store extension id. Not used by the Playwright product path.
-export const DEFAULT_EXTENSION_ID = 'cgiocagnojoiblhlkmdjacklcmpbbimf'
diff --git a/legacy/extension/default-extension-id.ts b/legacy/extension/default-extension-id.ts
deleted file mode 100644
index d514cf3..0000000
--- a/legacy/extension/default-extension-id.ts
+++ /dev/null
@@ -1,2 +0,0 @@
-// Update this when the distributed Tokenless extension id changes.
-export const DEFAULT_EXTENSION_ID = 'cgiocagnojoiblhlkmdjacklcmpbbimf'
diff --git a/legacy/extension/extension/background/native-daemon-bridge.ts b/legacy/extension/extension/background/native-daemon-bridge.ts
deleted file mode 100644
index 136cdcd..0000000
--- a/legacy/extension/extension/background/native-daemon-bridge.ts
+++ /dev/null
@@ -1,245 +0,0 @@
-import {
-  createNativeMessage,
-  isNativeMessage,
-  NATIVE_MESSAGE_TYPES,
-} from '../shared/native-protocol.js'
-import type { NativeMessage } from '../shared/native-protocol.js'
-
-export type NativeDaemonBridgeTiming = {
-  handshakeTimeoutMs: number
-  reconnectInitialDelayMs: number
-  reconnectMaxDelayMs: number
-}
-
-export type NativeDaemonBridgeOptions = {
-  connectNative: () => chrome.runtime.Port
-  onMessage: (port: chrome.runtime.Port, message: NativeMessage) => void
-  onDisconnect?: (port: chrome.runtime.Port) => void
-  readRuntimeLastError?: () => unknown
-  timing?: Partial<NativeDaemonBridgeTiming>
-  setTimer?: typeof setTimeout
-  clearTimer?: typeof clearTimeout
-}
-
-const DEFAULT_TIMING: NativeDaemonBridgeTiming = Object.freeze({
-  handshakeTimeoutMs: 5000,
-  reconnectInitialDelayMs: 250,
-  reconnectMaxDelayMs: 30000,
-})
-
-export class NativeDaemonBridge {
-  readonly #connectNative: NativeDaemonBridgeOptions['connectNative']
-  readonly #onMessage: NativeDaemonBridgeOptions['onMessage']
-  readonly #onDisconnect: NonNullable<NativeDaemonBridgeOptions['onDisconnect']>
-  readonly #readRuntimeLastError: NonNullable<NativeDaemonBridgeOptions['readRuntimeLastError']>
-  readonly #timing: NativeDaemonBridgeTiming
-  readonly #setTimer: typeof setTimeout
-  readonly #clearTimer: typeof clearTimeout
-  #port: chrome.runtime.Port | null = null
-  #connected = false
-  #stopped = false
-  #handshakeTimer: ReturnType<typeof setTimeout> | null = null
-  #reconnectTimer: ReturnType<typeof setTimeout> | null = null
-  #nextReconnectDelayMs: number
-
-  constructor(options: NativeDaemonBridgeOptions) {
-    this.#connectNative = options.connectNative
-    this.#onMessage = options.onMessage
-    this.#onDisconnect = options.onDisconnect ?? (() => undefined)
-    this.#readRuntimeLastError = options.readRuntimeLastError ?? (() => chrome.runtime.lastError)
-    this.#timing = normalizeTiming(options.timing)
-    const setTimer = options.setTimer ?? globalThis.setTimeout
-    const clearTimer = options.clearTimer ?? globalThis.clearTimeout
-    this.#setTimer = ((...args: Parameters<typeof setTimeout>) => (
-      Reflect.apply(setTimer, globalThis, args)
-    )) as typeof setTimeout
-    this.#clearTimer = ((...args: Parameters<typeof clearTimeout>) => {
-      Reflect.apply(clearTimer, globalThis, args)
-    }) as typeof clearTimeout
-    this.#nextReconnectDelayMs = this.#timing.reconnectInitialDelayMs
-  }
-
-  start() {
-    this.#stopped = false
-    if (this.#port || this.#reconnectTimer) return
-    this.#connect()
-  }
-
-  stop() {
-    this.#stopped = true
-    this.#clearHandshakeTimer()
-    this.#clearReconnectTimer()
-    const port = this.#port
-    this.#port = null
-    this.#connected = false
-    if (port) {
-      this.#notifyDisconnect(port)
-      disconnectQuietly(port)
-    }
-  }
-
-  isConnectedPort(port: chrome.runtime.Port) {
-    return this.#port === port && this.#connected
-  }
-
-  postIfConnected(port: chrome.runtime.Port, message: NativeMessage) {
-    if (!this.isConnectedPort(port)) return false
-    try {
-      port.postMessage(message)
-      return true
-    } catch {
-      this.#failPort(port)
-      return false
-    }
-  }
-
-  reconnectIfCurrent(port: chrome.runtime.Port) {
-    if (this.#port === port) this.#failPort(port)
-  }
-
-  #connect() {
-    if (this.#stopped || this.#port || this.#reconnectTimer) return
-
-    let port: chrome.runtime.Port
-    try {
-      port = this.#connectNative()
-    } catch {
-      this.#scheduleReconnect()
-      return
-    }
-
-    this.#port = port
-    this.#connected = false
-    try {
-      port.onMessage.addListener((message) => this.#handleMessage(port, message))
-      port.onDisconnect.addListener(() => {
-        this.#consumeRuntimeLastError()
-        this.#handleDisconnect(port)
-      })
-      this.#handshakeTimer = this.#setTimer(() => {
-        if (this.#port === port && !this.#connected) {
-          this.#failPort(port)
-        }
-      }, this.#timing.handshakeTimeoutMs)
-      port.postMessage(createNativeMessage(NATIVE_MESSAGE_TYPES.DAEMON_CONNECT))
-    } catch {
-      this.#failPort(port)
-    }
-  }
-
-  #handleMessage(port: chrome.runtime.Port, message: unknown) {
-    if (this.#port !== port) return
-
-    if (!isNativeMessage(message)) {
-      this.#failPort(port)
-      return
-    }
-
-    if (!this.#connected) {
-      if (message.type === NATIVE_MESSAGE_TYPES.DAEMON_CONNECTED && message.ok === true) {
-        this.#connected = true
-        this.#clearHandshakeTimer()
-        this.#nextReconnectDelayMs = this.#timing.reconnectInitialDelayMs
-        return
-      }
-      this.#failPort(port)
-      return
-    }
-
-    if (message.type === NATIVE_MESSAGE_TYPES.DAEMON_ERROR) {
-      this.#failPort(port)
-      return
-    }
-
-    if (message.type === NATIVE_MESSAGE_TYPES.DAEMON_CONNECTED) return
-    this.#onMessage(port, message)
-  }
-
-  #handleDisconnect(port: chrome.runtime.Port) {
-    if (this.#port !== port) return
-    this.#port = null
-    this.#connected = false
-    this.#clearHandshakeTimer()
-    this.#notifyDisconnect(port)
-    this.#scheduleReconnect()
-  }
-
-  #consumeRuntimeLastError() {
-    try {
-      void this.#readRuntimeLastError()
-    } catch {
-      // Error reporting must not interrupt reconnect cleanup.
-    }
-  }
-
-  #failPort(port: chrome.runtime.Port) {
-    if (this.#port !== port) return
-    this.#port = null
-    this.#connected = false
-    this.#clearHandshakeTimer()
-    this.#notifyDisconnect(port)
-    disconnectQuietly(port)
-    this.#scheduleReconnect()
-  }
-
-  #notifyDisconnect(port: chrome.runtime.Port) {
-    try {
-      this.#onDisconnect(port)
-    } catch {
-      // Consumer cleanup must not interrupt bridge reconnection.
-    }
-  }
-
-  #scheduleReconnect() {
-    if (this.#stopped || this.#port || this.#reconnectTimer) return
-    const delayMs = this.#nextReconnectDelayMs
-    this.#nextReconnectDelayMs = Math.min(
-      this.#timing.reconnectMaxDelayMs,
-      Math.max(this.#timing.reconnectInitialDelayMs, delayMs * 2)
-    )
-    this.#reconnectTimer = this.#setTimer(() => {
-      this.#reconnectTimer = null
-      this.#connect()
-    }, delayMs)
-  }
-
-  #clearHandshakeTimer() {
-    if (!this.#handshakeTimer) return
-    this.#clearTimer(this.#handshakeTimer)
-    this.#handshakeTimer = null
-  }
-
-  #clearReconnectTimer() {
-    if (!this.#reconnectTimer) return
-    this.#clearTimer(this.#reconnectTimer)
-    this.#reconnectTimer = null
-  }
-}
-
-function normalizeTiming(value: Partial<NativeDaemonBridgeTiming> | undefined): NativeDaemonBridgeTiming {
-  const handshakeTimeoutMs = positiveNumber(value?.handshakeTimeoutMs, DEFAULT_TIMING.handshakeTimeoutMs)
-  const reconnectInitialDelayMs = positiveNumber(
-    value?.reconnectInitialDelayMs,
-    DEFAULT_TIMING.reconnectInitialDelayMs
-  )
-  return {
-    handshakeTimeoutMs,
-    reconnectInitialDelayMs,
-    reconnectMaxDelayMs: Math.max(
-      reconnectInitialDelayMs,
-      positiveNumber(value?.reconnectMaxDelayMs, DEFAULT_TIMING.reconnectMaxDelayMs)
-    ),
-  }
-}
-
-function positiveNumber(value: unknown, fallback: number) {
-  return typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : fallback
-}
-
-function disconnectQuietly(port: chrome.runtime.Port) {
-  try {
-    port.disconnect()
-  } catch {
-    // The native process may already be gone.
-  }
-}
diff --git a/legacy/extension/extension/background/service-worker.ts b/legacy/extension/extension/background/service-worker.ts
deleted file mode 100644
index bdcf9c8..0000000
--- a/legacy/extension/extension/background/service-worker.ts
+++ /dev/null
@@ -1,1510 +0,0 @@
-import {
-  BRIDGE_ACTIONS,
-  capabilitiesPayload,
-  createBridgeRequest,
-  createBridgeResponse,
-  validateBridgeRequest,
-} from '../shared/bridge-protocol.js'
-import { getProviderById, getProviderForUrl } from '../shared/provider-config.js'
-import {
-  areProviderTransitionSourcesEquivalent,
-  canonicalProviderUrl,
-  isCanonicalProviderLandingTarget,
-  isApprovedProviderTransition,
-  isProviderConversationUrl,
-  isSafeProviderAuthority,
-  providerTransitionSource,
-  safeProviderTargetUrl,
-} from '../shared/provider-navigation-policy.js'
-import {
-  createNativeMessage,
-  isNativeMessage,
-  MAX_VISIBLE_ATTACHMENT_CHUNK_BYTES,
-  NATIVE_MESSAGE_TYPES,
-  NATIVE_PROTOCOL_VERSION,
-  VISIBLE_ATTACHMENT_PROTOCOL_VERSION,
-} from '../shared/native-protocol.js'
-import { NativeDaemonBridge } from './native-daemon-bridge.js'
-import {
-  VISIBLE_PROVIDER_ACTIONS,
-  createVisibleProviderActionRequest,
-  createVisibleProviderActionResponse,
-  createVisibleProviderRuntimeEnvelope,
-} from '../shared/visible-provider-actions.js'
-import {
-  failedVisibleProviderRuntimeResponse,
-  isTrustedVisibleProviderRuntimeSender,
-  isVisibleProviderRuntimeMessage,
-  rejectedVisibleProviderRuntimeResponse,
-  runVisibleProviderRuntimeEnvelope,
-} from './visible-provider-action-runtime.js'
-import type { BridgeRequest } from '../shared/bridge-protocol.js'
-import type { NativeAttachmentDescriptor, NativeMessage } from '../shared/native-protocol.js'
-import type { ProviderConfig } from '../shared/provider-config.js'
-
-type BridgeRuntimeError = Error & {
-  code?: string
-  retryable?: boolean
-}
-type ExtensionRecord = Record<string, any>
-type DaemonAttachmentContext = {
-  port: chrome.runtime.Port
-  jobId: string
-  claimToken: string
-}
-
-const NATIVE_HOST_NAME = 'dev.tokenless.native_host'
-const DAEMON_JOB_RESPONSE_TYPE = 'tokenless.daemon.job_result'
-const NATIVE_REQUEST_TIMEOUT_MS = 10000
-const PROVIDER_LANDING_TIMEOUT_MS = 8000
-const PROVIDER_LANDING_POLL_MS = 250
-const PROVIDER_CONTENT_READY_TYPE = 'tokenless.provider_content_ready'
-const TRUSTED_CLICK_REQUEST_TYPE = 'tokenless.bridge.trusted_click'
-const DEBUGGER_PROTOCOL_VERSION = '1.3'
-const POST_SUBMIT_TARGET_TRANSITION_FLAG = 'allowPostSubmitTargetTransition'
-const POST_SUBMIT_TARGET_TRANSITION_PROOF = 'postSubmitTargetTransitionProof'
-const activeDebuggerTabs = new Set<number>()
-const CONTENT_ATTACHMENT_MESSAGE_TYPES = Object.freeze({
-  PREPARE: 'tokenless.bridge.attachment_prepare',
-  CHUNK: 'tokenless.bridge.attachment_chunk',
-  COMMIT: 'tokenless.bridge.attachment_commit',
-  COMMIT_BATCH: 'tokenless.bridge.attachment_commit_batch',
-  ABORT: 'tokenless.bridge.attachment_abort',
-})
-const SAFE_NATIVE_IDENTIFIER = /^[A-Za-z0-9_-]{1,64}$/
-let daemonJobQueue: Promise<void> = Promise.resolve()
-const handledDaemonJobs = new Set<string>()
-const handledDaemonJobOrder: string[] = []
-const MAX_HANDLED_DAEMON_JOBS = 1024
-const MAX_VISIBLE_PROVIDER_RUNTIME_AFFINITIES = 4
-const visibleProviderRuntimeTabAffinity = new Map<string, number>()
-const pendingNativeBridgeRequests = new Map<string, {
-  port: chrome.runtime.Port
-  expectedType: string
-  timeout: ReturnType<typeof setTimeout>
-  resolve: (message: NativeMessage) => void
-  reject: (error: BridgeRuntimeError) => void
-}>()
-const daemonBridge = new NativeDaemonBridge({
-  connectNative: () => chrome.runtime.connectNative(NATIVE_HOST_NAME),
-  onMessage: handleDaemonBridgeMessage,
-  onDisconnect: rejectPersistentNativeRequests,
-  readRuntimeLastError: () => chrome.runtime.lastError,
-})
-
-chrome.runtime.onInstalled.addListener(() => {
-  startDaemonBridge()
-  enableSidePanelAction()
-})
-
-chrome.runtime.onStartup.addListener(() => {
-  startDaemonBridge()
-  enableSidePanelAction()
-})
-
-chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
-  if (isProviderContentReadyMessage(message)) {
-    if (!getProviderForUrl(sender.tab?.url ?? '')) return false
-
-    startDaemonBridge()
-    sendResponse({ ok: true })
-    return false
-  }
-  if (isVisibleProviderRuntimeMessage(message)) {
-    if (!isTrustedVisibleProviderRuntimeSender(sender, chrome.runtime.id)) {
-      sendResponse(rejectedVisibleProviderRuntimeResponse(message))
-      return false
-    }
-    runVisibleProviderRuntimeEnvelope(message, {
-      acquireProviderTab: acquireVisibleProviderRuntimeTab,
-      async validateProviderLanding(tabId, provider, request) {
-        await validateProviderLanding(tabId, provider, request)
-      },
-      sendToProviderTab,
-      async uploadVisibleAttachments() {
-        throw bridgeError(
-          'attachment_transport_unavailable',
-          'Visible file upload requires an active daemon-native bridge claim.',
-          false
-        )
-      },
-    }).then(sendResponse).catch(() => {
-      sendResponse(failedVisibleProviderRuntimeResponse(message))
-    })
-    return true
-  }
-  if (objectRecord(message).type !== TRUSTED_CLICK_REQUEST_TYPE) return false
-
-  dispatchTrustedChatGptClick(objectRecord(message).request, sender)
-    .then(sendResponse)
-    .catch(() => sendResponse({ ok: false, code: 'debugger_control_unavailable' }))
-  return true
-})
-
-async function acquireVisibleProviderRuntimeTab(
-  provider: ProviderConfig,
-  options: { forceNew: boolean },
-  targetUrl?: string
-) {
-  let tab = options.forceNew
-    ? undefined
-    : await visibleProviderRuntimeAffinityTab(provider, targetUrl)
-  tab ??= await getOrCreateProviderTab(provider, targetUrl, { forceNew: options.forceNew })
-  await focusTab(tab)
-  let landed: chrome.tabs.Tab
-  try {
-    landed = await waitForProviderTabLoaded(tab.id, provider, targetUrl)
-  } catch (error) {
-    clearVisibleProviderRuntimeAffinity(provider.id, tab.id)
-    throw error
-  }
-  if (landed.id === undefined) {
-    throw bridgeError('tab_unavailable', 'Provider tab is not available.', true)
-  }
-  rememberVisibleProviderRuntimeAffinity(provider.id, landed.id)
-  return landed.id
-}
-
-async function visibleProviderRuntimeAffinityTab(provider: ProviderConfig, targetUrl?: string) {
-  const tabId = visibleProviderRuntimeTabAffinity.get(provider.id)
-  if (tabId === undefined) return undefined
-  try {
-    const tab = assertProviderTabContext(await chrome.tabs.get(tabId), provider, targetUrl)
-    if (tab.id === undefined) throw new Error('affinity tab has no id')
-    return tab
-  } catch {
-    clearVisibleProviderRuntimeAffinity(provider.id, tabId)
-    return undefined
-  }
-}
-
-function rememberVisibleProviderRuntimeAffinity(providerId: string, tabId: number) {
-  visibleProviderRuntimeTabAffinity.delete(providerId)
-  visibleProviderRuntimeTabAffinity.set(providerId, tabId)
-  while (visibleProviderRuntimeTabAffinity.size > MAX_VISIBLE_PROVIDER_RUNTIME_AFFINITIES) {
-    const oldest = visibleProviderRuntimeTabAffinity.keys().next().value
-    if (typeof oldest !== 'string') break
-    visibleProviderRuntimeTabAffinity.delete(oldest)
-  }
-}
-
-function clearVisibleProviderRuntimeAffinity(providerId: string, tabId?: number) {
-  if (tabId !== undefined && visibleProviderRuntimeTabAffinity.get(providerId) !== tabId) return
-  visibleProviderRuntimeTabAffinity.delete(providerId)
-}
-
-function visibleActionContextRequest(contextRequest: BridgeRequest, bridgeRequest: BridgeRequest): BridgeRequest {
-  return {
-    ...contextRequest,
-    targetUrl: bridgeRequest.targetUrl,
-    idempotencyKey: bridgeRequest.idempotencyKey,
-    metadata: bridgeRequest.metadata,
-  }
-}
-
-startDaemonBridge()
-enableSidePanelAction()
-
-function enableSidePanelAction() {
-  chrome.sidePanel.setPanelBehavior({ openPanelOnActionClick: true }).catch(() => undefined)
-}
-
-async function runBridgeRequest(
-  request: BridgeRequest,
-  attachmentContext?: DaemonAttachmentContext
-) {
-  try {
-    if (request.action === BRIDGE_ACTIONS.CAPABILITIES) {
-      return createBridgeResponse(request, { ok: true, result: capabilitiesPayload() })
-    }
-
-    const provider = getProviderById(request.provider)
-    if (!provider) {
-      return createBridgeResponse(request, {
-        ok: false,
-        error: { code: 'unsupported_provider', message: 'Provider is not supported.', retryable: false },
-      })
-    }
-
-    if (request.action === BRIDGE_ACTIONS.VISIBLE_PROVIDER_ACTION) {
-      const visibleAction = request.visibleAction
-      if (!visibleAction) {
-        return createBridgeResponse(request, {
-          ok: false,
-          error: {
-            code: 'invalid_visible_action_request',
-            message: 'Unified visible provider action request is missing.',
-            retryable: false,
-          },
-        })
-      }
-      const runtimeResponse = await runVisibleProviderRuntimeEnvelope(createVisibleProviderRuntimeEnvelope(visibleAction), {
-        acquireProviderTab: (runtimeProvider, options) => (
-          acquireVisibleProviderRuntimeTab(runtimeProvider, options, request.targetUrl)
-        ),
-        async validateProviderLanding(tabId, runtimeProvider, contextRequest) {
-          await validateProviderLanding(
-            tabId,
-            runtimeProvider,
-            visibleActionContextRequest(contextRequest, request)
-          )
-        },
-        async sendToProviderTab(tabId, runtimeProvider, contextRequest, message) {
-          const visibleContext = visibleActionContextRequest(contextRequest, request)
-          return sendToProviderTab(tabId, runtimeProvider, visibleContext, {
-            ...message,
-            request: visibleContext,
-          })
-        },
-        async uploadVisibleAttachments(tabId, runtimeProvider, contextRequest, attachments) {
-          const visibleContext = visibleActionContextRequest(contextRequest, request)
-          visibleContext.attachments = [...attachments]
-          await deliverVisibleAttachments(
-            tabId,
-            runtimeProvider,
-            visibleContext,
-            attachmentContext
-          )
-        },
-      })
-      if (!runtimeResponse.ok && visibleAction.action === VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD) {
-        clearVisibleProviderRuntimeAffinity(provider.id)
-      }
-      return runtimeResponse
-    }
-
-    if (request.action === BRIDGE_ACTIONS.OPEN) {
-      const tab = await getOrCreateProviderTab(provider, request.targetUrl)
-      const landedTab = await waitForProviderTabLoaded(tab.id, provider, request.targetUrl)
-      return createBridgeResponse(request, {
-        ok: true,
-        result: { tabId: landedTab.id, url: publicProviderUrl(landedTab.url ?? provider.homeUrl) || provider.homeUrl },
-      })
-    }
-
-    const tab = await getOrCreateProviderTab(provider, request.targetUrl, {
-      forceNew: hasVisibleAttachments(request),
-    })
-    await focusTab(tab)
-    const landedTab = await waitForProviderTabLoaded(tab.id, provider, request.targetUrl)
-    const preSubmitUrl = landedTab.pendingUrl || landedTab.url || provider.homeUrl
-
-    if (request.action === BRIDGE_ACTIONS.INSPECT_AUTH) {
-      const result = await sendToProviderTab(landedTab.id, provider, request, {
-        type: 'tokenless.bridge.inspect_auth',
-        request,
-      })
-      return createBridgeResponse(request, {
-        ok: true,
-        result: normalizeVisibleAuthInspection(request, provider, result),
-      })
-    }
-
-    if (
-      request.action === BRIDGE_ACTIONS.INSPECT_CONTROLS ||
-      request.action === BRIDGE_ACTIONS.INSPECT_CHATGPT_CONTROLS
-    ) {
-      await validateProviderLanding(landedTab.id, provider, request)
-      const result = await sendToProviderTab(landedTab.id, provider, request, {
-        type: request.action === BRIDGE_ACTIONS.INSPECT_CONTROLS
-          ? 'tokenless.bridge.inspect_controls'
-          : 'tokenless.bridge.inspect_chatgpt_controls',
-        request,
-      })
-      return createBridgeResponse(request, { ok: true, result })
-    }
-
-    if (
-      request.action === BRIDGE_ACTIONS.CONFIGURE_CONTROLS ||
-      request.action === BRIDGE_ACTIONS.CONFIGURE_CHATGPT
-    ) {
-      await validateProviderLanding(landedTab.id, provider, request)
-      const result = await sendToProviderTab(landedTab.id, provider, request, {
-        type: request.action === BRIDGE_ACTIONS.CONFIGURE_CONTROLS
-          ? 'tokenless.bridge.configure_controls'
-          : 'tokenless.bridge.configure_chatgpt',
-        request,
-      })
-      if (result?.status === 'blocked') {
-        const legacyChatGptAction = request.action === BRIDGE_ACTIONS.CONFIGURE_CHATGPT
-        return createBridgeResponse(request, {
-          ok: false,
-          error: {
-            code: result.stopReason || (legacyChatGptAction ? 'chatgpt_controls_unavailable' : 'provider_controls_unavailable'),
-            message: result.message || (legacyChatGptAction
-              ? 'ChatGPT controls could not be configured.'
-              : `${provider.label} controls could not be configured.`),
-            retryable: Boolean(result.retryable),
-          },
-        })
-      }
-      return createBridgeResponse(request, { ok: true, result })
-    }
-
-    if (request.action === BRIDGE_ACTIONS.SUBMIT) {
-      await validateProviderLanding(landedTab.id, provider, request)
-      const result = await submitVisiblePrompt(landedTab.id, provider, request, attachmentContext)
-      if (isModelControlBlock(result)) return modelControlBlockResponse(request, result)
-      return createBridgeResponse(request, { ok: true, result: publicSubmitResult(result) })
-    }
-
-    if (request.action === BRIDGE_ACTIONS.READ) {
-      await validateProviderLanding(landedTab.id, provider, request)
-      const result = await sendToProviderTab(landedTab.id, provider, request, { type: 'tokenless.bridge.read', request })
-      return createBridgeResponse(request, { ok: true, result })
-    }
-
-    if (request.action === BRIDGE_ACTIONS.SNAPSHOT_DOM) {
-      const result = await sendToProviderTab(landedTab.id, provider, request, { type: 'tokenless.bridge.snapshot_dom', request })
-      return createBridgeResponse(request, { ok: true, result })
-    }
-
-    if (request.action === BRIDGE_ACTIONS.SUBMIT_AND_READ) {
-      await validateProviderLanding(landedTab.id, provider, request)
-      const submit = await submitVisiblePrompt(landedTab.id, provider, request, attachmentContext)
-      if (isModelControlBlock(submit)) return modelControlBlockResponse(request, submit)
-      const readDelayMs = Math.min(Number(request.readDelayMs ?? 2500), 30000)
-      await delay(readDelayMs)
-      const readRequest = postSubmitReadRequest(provider, request, submit, preSubmitUrl)
-      await validateProviderLanding(landedTab.id, provider, readRequest)
-      const read = await sendToProviderTab(landedTab.id, provider, readRequest, {
-        type: 'tokenless.bridge.read',
-        request: readRequest,
-      })
-      return createBridgeResponse(request, { ok: true, result: { submit: publicSubmitResult(submit), read } })
-    }
-
-    return createBridgeResponse(request, {
-      ok: false,
-      error: { code: 'unsupported_action', message: 'Action is not supported.', retryable: false },
-    })
-  } catch (error) {
-    const bridgeRuntimeError = error as Partial<BridgeRuntimeError>
-    return createBridgeResponse(request, {
-      ok: false,
-      error: {
-        code: bridgeRuntimeError.code || 'bridge_runtime_error',
-        message: bridgeRuntimeError.message || 'Bridge runtime failed.',
-        retryable: Boolean(bridgeRuntimeError.retryable),
-      },
-    })
-  }
-}
-
-function normalizeVisibleAuthInspection(
-  bridgeRequest: BridgeRequest,
-  provider: ProviderConfig,
-  result: ExtensionRecord
-) {
-  if (
-    result?.status !== 'inspected' ||
-    result?.provider !== provider.id ||
-    result?.visible !== true
-  ) {
-    throw bridgeError(
-      'visible_auth_status_unavailable',
-      'Provider content did not return a verified visible auth status.',
-      false
-    )
-  }
-  const actionRequest = createVisibleProviderActionRequest({
-    requestId: bridgeRequest.requestId,
-    provider: provider.id,
-    action: VISIBLE_PROVIDER_ACTIONS.AUTH_STATUS,
-    payload: {},
-  })
-  const normalized = createVisibleProviderActionResponse(actionRequest, {
-    ok: true,
-    result: result.auth,
-  })
-  if (!normalized.ok) {
-    throw bridgeError(
-      'invalid_visible_auth_status',
-      'Provider content returned an invalid visible auth status.',
-      false
-    )
-  }
-  return {
-    status: 'inspected',
-    provider: provider.id,
-    visible: true,
-    auth: normalized.result,
-  }
-}
-
-async function submitVisiblePrompt(
-  tabId: number | undefined,
-  provider: ProviderConfig,
-  request: BridgeRequest,
-  attachmentContext: DaemonAttachmentContext | undefined
-) {
-  const attachments = request.attachments as NativeAttachmentDescriptor[] | undefined
-  if (!attachments?.length) {
-    return sendToProviderTab(tabId, provider, request, { type: 'tokenless.bridge.submit', request })
-  }
-
-  const prepared = await sendToProviderTab(tabId, provider, request, {
-    type: 'tokenless.bridge.prepare_submit',
-    request,
-  })
-  if (prepared?.status === 'blocked') return prepared
-  if (prepared?.status !== 'prepared') {
-    throw bridgeError(
-      'attachment_content_protocol_mismatch',
-      'Provider page did not prepare model controls and the visible composer before attachment delivery.',
-      false
-    )
-  }
-
-  try {
-    await deliverVisibleAttachments(tabId, provider, request, attachmentContext)
-    const result = await sendToProviderTab(tabId, provider, request, {
-      type: 'tokenless.bridge.submit',
-      request,
-    })
-    if (result?.status !== 'submitted') await abortVisibleAttachments(tabId, provider, request, attachments)
-    return result
-  } catch (error) {
-    await abortVisibleAttachments(tabId, provider, request, attachments)
-    throw error
-  }
-}
-
-async function deliverVisibleAttachments(
-  tabId: number | undefined,
-  provider: ProviderConfig,
-  request: BridgeRequest,
-  context: DaemonAttachmentContext | undefined
-) {
-  const attachments = request.attachments as NativeAttachmentDescriptor[] | undefined
-  if (!attachments?.length) return
-  if (!context) {
-    throw bridgeError(
-      'attachment_transport_unavailable',
-      'Visible attachments require an active daemon-native bridge claim.',
-      false
-    )
-  }
-  for (const descriptor of attachments) {
-    await deliverVisibleAttachment(tabId, provider, request, context, descriptor)
-  }
-  const committed = await sendToProviderTab(tabId, provider, request, {
-    type: CONTENT_ATTACHMENT_MESSAGE_TYPES.COMMIT_BATCH,
-    request,
-    requestId: request.requestId,
-    attachmentIds: attachments.map((descriptor) => descriptor.attachmentId),
-  })
-  requireContentAttachmentStatus(committed, 'attached', attachments[0]!)
-}
-
-async function abortVisibleAttachments(
-  tabId: number | undefined,
-  provider: ProviderConfig,
-  request: BridgeRequest,
-  attachments: NativeAttachmentDescriptor[]
-) {
-  await Promise.all(attachments.map((descriptor) => sendToProviderTab(tabId, provider, request, {
-    type: CONTENT_ATTACHMENT_MESSAGE_TYPES.ABORT,
-    request,
-    requestId: request.requestId,
-    attachmentId: descriptor.attachmentId,
-  }).catch(() => undefined)))
-}
-
-async function deliverVisibleAttachment(
-  tabId: number | undefined,
-  provider: ProviderConfig,
-  request: BridgeRequest,
-  context: DaemonAttachmentContext,
-  descriptor: NativeAttachmentDescriptor
-) {
-  let handleId: string | undefined
-  try {
-    const prepared = await sendToProviderTab(tabId, provider, request, {
-      type: CONTENT_ATTACHMENT_MESSAGE_TYPES.PREPARE,
-      request,
-      requestId: request.requestId,
-      attachmentId: descriptor.attachmentId,
-      name: descriptor.name,
-      mimeType: descriptor.type,
-      size: descriptor.size,
-      sha256: descriptor.sha256,
-    })
-    requireContentAttachmentStatus(prepared, 'prepared', descriptor)
-
-    const openedMessage = await persistentNativeRequest(context.port, NATIVE_MESSAGE_TYPES.ATTACHMENT_OPEN, {
-      jobId: context.jobId,
-      claimToken: context.claimToken,
-      bundleId: descriptor.bundleId,
-      attachmentId: descriptor.attachmentId,
-    })
-    const opened = validateOpenedAttachment(openedMessage, descriptor)
-    handleId = opened.handleId
-    const maxBytes = Math.min(opened.maxChunkBytes, MAX_VISIBLE_ATTACHMENT_CHUNK_BYTES)
-    let offset = 0
-
-    while (true) {
-      const readMessage = await persistentNativeRequest(context.port, NATIVE_MESSAGE_TYPES.ATTACHMENT_READ, {
-        jobId: context.jobId,
-        claimToken: context.claimToken,
-        handleId,
-        offset,
-        maxBytes,
-      })
-      const chunk = validateAttachmentChunk(readMessage, handleId, offset, descriptor.size, maxBytes)
-      if (chunk.nextOffset > offset) {
-        const received = await sendToProviderTab(tabId, provider, request, {
-          type: CONTENT_ATTACHMENT_MESSAGE_TYPES.CHUNK,
-          request,
-          requestId: request.requestId,
-          attachmentId: descriptor.attachmentId,
-          offset,
-          dataBase64: chunk.dataBase64,
-        })
-        requireContentAttachmentStatus(received, 'chunk_received', descriptor)
-      }
-      offset = chunk.nextOffset
-      if (chunk.eof) break
-    }
-
-    const closedMessage = await persistentNativeRequest(context.port, NATIVE_MESSAGE_TYPES.ATTACHMENT_CLOSE, {
-      jobId: context.jobId,
-      claimToken: context.claimToken,
-      handleId,
-    })
-    validateClosedAttachment(closedMessage, handleId)
-    handleId = undefined
-
-  } catch (error) {
-    if (handleId) {
-      await persistentNativeRequest(context.port, NATIVE_MESSAGE_TYPES.ATTACHMENT_CLOSE, {
-        jobId: context.jobId,
-        claimToken: context.claimToken,
-        handleId,
-      }).catch(() => undefined)
-    }
-    throw error
-  }
-}
-
-function requireContentAttachmentStatus(
-  response: ExtensionRecord,
-  expectedStatus: string,
-  descriptor: NativeAttachmentDescriptor
-) {
-  if (response?.status === expectedStatus) return
-  if (response?.status === 'blocked') {
-    throw bridgeError(
-      stringOrUndefined(response.stopReason) ?? 'attachment_upload_blocked',
-      stringOrUndefined(response.message) ?? `Visible attachment ${descriptor.name} was blocked by the provider page.`,
-      Boolean(response.retryable)
-    )
-  }
-  throw bridgeError(
-    'attachment_content_protocol_mismatch',
-    `Provider page did not acknowledge ${descriptor.name} with ${expectedStatus}.`,
-    false
-  )
-}
-
-function validateOpenedAttachment(message: NativeMessage, descriptor: NativeAttachmentDescriptor) {
-  const result = objectRecord(message.result)
-  const handleId = stringOrUndefined(result.handleId)
-  const maxChunkBytes = result.maxChunkBytes
-  if (
-    !handleId ||
-    !SAFE_NATIVE_IDENTIFIER.test(handleId) ||
-    result.protocol !== VISIBLE_ATTACHMENT_PROTOCOL_VERSION ||
-    result.bundleId !== descriptor.bundleId ||
-    result.attachmentId !== descriptor.attachmentId ||
-    result.name !== descriptor.name ||
-    result.type !== descriptor.type ||
-    result.size !== descriptor.size ||
-    result.sha256 !== descriptor.sha256 ||
-    typeof maxChunkBytes !== 'number' ||
-    !Number.isSafeInteger(maxChunkBytes) ||
-    maxChunkBytes < 1 ||
-    maxChunkBytes > MAX_VISIBLE_ATTACHMENT_CHUNK_BYTES
-  ) {
-    throw bridgeError(
-      'attachment_native_protocol_mismatch',
-      'Native host returned an invalid or mismatched visible attachment handle.',
-      false
-    )
-  }
-  return { handleId, maxChunkBytes }
-}
-
-function validateAttachmentChunk(
-  message: NativeMessage,
-  handleId: string,
-  expectedOffset: number,
-  expectedSize: number,
-  maxBytes: number
-) {
-  const result = objectRecord(message.result)
-  const dataBase64 = typeof result.dataBase64 === 'string' ? result.dataBase64 : ''
-  const byteLength = strictBase64ByteLength(dataBase64)
-  const nextOffset = result.nextOffset
-  const eof = result.eof
-  if (
-    result.handleId !== handleId ||
-    result.offset !== expectedOffset ||
-    byteLength === null ||
-    byteLength > maxBytes ||
-    typeof nextOffset !== 'number' ||
-    !Number.isSafeInteger(nextOffset) ||
-    nextOffset !== expectedOffset + byteLength ||
-    nextOffset > expectedSize ||
-    typeof eof !== 'boolean' ||
-    (eof ? nextOffset !== expectedSize : byteLength === 0 || nextOffset >= expectedSize)
-  ) {
-    throw bridgeError(
-      'attachment_native_protocol_mismatch',
-      'Native host returned a malformed or non-sequential visible attachment chunk.',
-      false
-    )
-  }
-  return { dataBase64, nextOffset, eof }
-}
-
-function validateClosedAttachment(message: NativeMessage, handleId: string) {
-  const result = objectRecord(message.result)
-  if (result.handleId !== handleId || result.status !== 'closed') {
-    throw bridgeError(
-      'attachment_native_protocol_mismatch',
-      'Native host did not confirm the verified visible attachment handle was closed.',
-      false
-    )
-  }
-}
-
-function strictBase64ByteLength(value: string) {
-  if (value === '') return 0
-  if (value.length % 4 !== 0 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) {
-    return null
-  }
-  const padding = value.endsWith('==') ? 2 : value.endsWith('=') ? 1 : 0
-  return (value.length / 4) * 3 - padding
-}
-
-function postSubmitReadRequest(
-  provider: ProviderConfig,
-  request: BridgeRequest,
-  submit: ExtensionRecord,
-  preSubmitUrl: string
-) {
-  const effectiveTargetUrl = request.targetUrl ?? preSubmitUrl
-  const transitionSource = providerTransitionSource(provider, effectiveTargetUrl)
-  const readRequest: BridgeRequest = {
-    ...request,
-    targetUrl: effectiveTargetUrl,
-    answerBaseline: submit?.answerBaseline,
-  }
-  if (
-    submit?.status === 'submitted' &&
-    transitionSource
-  ) {
-    readRequest[POST_SUBMIT_TARGET_TRANSITION_FLAG] = true
-    readRequest[POST_SUBMIT_TARGET_TRANSITION_PROOF] = {
-      requestId: request.requestId,
-      provider: provider.id,
-      targetUrl: canonicalProviderUrl(effectiveTargetUrl),
-      sourceKind: transitionSource.kind,
-      customGptId: transitionSource.customGptId,
-      projectId: transitionSource.projectId,
-      answerBaseline: submit.answerBaseline,
-      nonce: internalTransitionNonce(),
-    }
-  }
-  return readRequest
-}
-
-function publicSubmitResult(submit: ExtensionRecord) {
-  if (!submit || typeof submit !== 'object' || Array.isArray(submit)) return submit
-  const { answerBaseline: _answerBaseline, ...publicSubmit } = submit
-  return publicSubmit
-}
-
-function internalTransitionNonce() {
-  return globalThis.crypto?.randomUUID?.() ?? `transition-${Date.now()}-${Math.random().toString(16).slice(2)}`
-}
-
-function startDaemonBridge() {
-  daemonBridge.start()
-}
-
-function isModelControlBlock(result: ExtensionRecord) {
-  return result?.status === 'blocked' && result?.stopReason === 'model_control_unavailable'
-}
-
-function modelControlBlockResponse(request: BridgeRequest, result: ExtensionRecord) {
-  return createBridgeResponse(request, {
-    ok: false,
-    error: {
-      code: 'model_control_unavailable',
-      message: result.message || 'The requested visible model is unavailable.',
-      retryable: false,
-    },
-  })
-}
-
-function isProviderContentReadyMessage(message: unknown) {
-  return objectRecord(message).type === PROVIDER_CONTENT_READY_TYPE
-}
-
-async function dispatchTrustedChatGptClick(request: unknown, sender: chrome.runtime.MessageSender) {
-  const payload = objectRecord(request)
-  const tab = sender.tab
-  const tabId = tab?.id
-  const tabUrl = tab?.url
-  const provider = getProviderForUrl(tabUrl ?? '')
-  const expectedUrl = canonicalProviderUrl(payload.expectedUrl)
-  if (
-    provider?.id !== 'chatgpt' ||
-    !Number.isInteger(tabId) ||
-    Number(tabId) < 0 ||
-    sender.frameId !== 0 ||
-    payload.provider !== 'chatgpt' ||
-    expectedUrl === '' ||
-    expectedUrl !== canonicalProviderUrl(tabUrl)
-  ) {
-    return { ok: false, code: 'debugger_control_context_mismatch' }
-  }
-  const x = boundedViewportCoordinate(payload.x, payload.viewportWidth)
-  const y = boundedViewportCoordinate(payload.y, payload.viewportHeight)
-  if (x === null || y === null) return { ok: false, code: 'debugger_control_invalid_coordinate' }
-  const numericTabId = Number(tabId)
-  if (activeDebuggerTabs.has(numericTabId)) return { ok: false, code: 'debugger_control_busy' }
-
-  const target = { tabId: numericTabId }
-  let attached = false
-  activeDebuggerTabs.add(numericTabId)
-  try {
-    const currentTab = await chrome.tabs.get(numericTabId).catch(() => undefined)
-    if (canonicalProviderUrl(currentTab?.url) !== expectedUrl) {
-      return { ok: false, code: 'debugger_control_tab_rejected' }
-    }
-    await chrome.debugger.attach(target, DEBUGGER_PROTOCOL_VERSION)
-    attached = true
-    const attachedTab = await chrome.tabs.get(numericTabId).catch(() => undefined)
-    if (canonicalProviderUrl(attachedTab?.url) !== expectedUrl) {
-      return { ok: false, code: 'debugger_control_tab_rejected' }
-    }
-    // This privileged path is deliberately restricted to one visible mouse
-    // click. Never enable or send Network, Storage, Fetch, Runtime, DOM, or
-    // Page commands through the Tokenless bridge.
-    await chrome.debugger.sendCommand(target, 'Input.dispatchMouseEvent', {
-      type: 'mousePressed', x, y, button: 'left', buttons: 1, clickCount: 1,
-    })
-    await chrome.debugger.sendCommand(target, 'Input.dispatchMouseEvent', {
-      type: 'mouseReleased', x, y, button: 'left', buttons: 0, clickCount: 1,
-    })
-    return { ok: true }
-  } catch {
-    return { ok: false, code: 'debugger_control_input_failed' }
-  } finally {
-    if (attached) await chrome.debugger.detach(target).catch(() => undefined)
-    activeDebuggerTabs.delete(numericTabId)
-  }
-}
-
-function boundedViewportCoordinate(value: unknown, viewport: unknown) {
-  if (typeof value !== 'number' || typeof viewport !== 'number') return null
-  const coordinate = value
-  const extent = viewport
-  if (
-    !Number.isFinite(coordinate) ||
-    !Number.isFinite(extent) ||
-    coordinate < 0 ||
-    coordinate >= extent ||
-    extent <= 0 ||
-    extent > 10000
-  ) return null
-  const rounded = Math.round(coordinate)
-  return rounded >= 0 && rounded < extent ? rounded : null
-}
-
-function handleDaemonBridgeMessage(port: chrome.runtime.Port, message: ExtensionRecord) {
-  if (settlePersistentNativeRequest(port, message)) return
-  if (!isNativeMessage(message) || message.type !== NATIVE_MESSAGE_TYPES.DAEMON_JOB || !message.ok) return
-  const job = objectRecord(message.result).job
-  const identity = daemonJobIdentity(job)
-  if (!identity || handledDaemonJobs.has(identity.key)) return
-  handledDaemonJobs.add(identity.key)
-  daemonJobQueue = daemonJobQueue
-    .catch(() => undefined)
-    .then(() => runClaimedDaemonJob(job, port))
-    .then(
-      () => recordHandledDaemonJob(identity),
-      () => {
-        handledDaemonJobs.delete(identity.key)
-      }
-    )
-}
-
-function persistentNativeRequest(
-  port: chrome.runtime.Port,
-  type: string,
-  payload: ExtensionRecord
-): Promise<NativeMessage> {
-  return new Promise((resolve, reject) => {
-    const requestId = persistentNativeRequestId()
-    const timeout = setTimeout(() => {
-      const pending = pendingNativeBridgeRequests.get(requestId)
-      if (!pending) return
-      pendingNativeBridgeRequests.delete(requestId)
-      reject(bridgeError('native_host_timeout', `Native host did not respond to ${type}.`, true))
-    }, NATIVE_REQUEST_TIMEOUT_MS)
-    pendingNativeBridgeRequests.set(requestId, {
-      port,
-      expectedType: type,
-      timeout,
-      resolve,
-      reject,
-    })
-    const posted = daemonBridge.postIfConnected(port, createNativeMessage(type, {
-      ...stripUndefined(payload),
-      requestId,
-    }))
-    if (!posted) {
-      clearTimeout(timeout)
-      pendingNativeBridgeRequests.delete(requestId)
-      reject(bridgeError(
-        'native_bridge_disconnected',
-        `Persistent native bridge disconnected before ${type} could be sent.`,
-        true
-      ))
-    }
-  })
-}
-
-function settlePersistentNativeRequest(port: chrome.runtime.Port, message: ExtensionRecord) {
-  if (!isNativeMessage(message) || typeof message.requestId !== 'string') return false
-  const pending = pendingNativeBridgeRequests.get(message.requestId)
-  if (!pending) return false
-  pendingNativeBridgeRequests.delete(message.requestId)
-  clearTimeout(pending.timeout)
-  if (pending.port !== port || pending.expectedType !== message.type) {
-    pending.reject(bridgeError(
-      'native_protocol_mismatch',
-      `Persistent native response did not match ${pending.expectedType}.`,
-      false
-    ))
-    return true
-  }
-  if (message.ok !== true) {
-    const nativeError = objectRecord(message.error)
-    pending.reject(bridgeError(
-      stringOrUndefined(nativeError.code) ?? 'native_host_error',
-      stringOrUndefined(nativeError.message) ?? `Native host rejected ${pending.expectedType}.`,
-      Boolean(nativeError.retryable)
-    ))
-    return true
-  }
-  pending.resolve(message)
-  return true
-}
-
-function rejectPersistentNativeRequests(port: chrome.runtime.Port) {
-  for (const [requestId, pending] of pendingNativeBridgeRequests) {
-    if (pending.port !== port) continue
-    pendingNativeBridgeRequests.delete(requestId)
-    clearTimeout(pending.timeout)
-    pending.reject(bridgeError(
-      'native_bridge_disconnected',
-      'Persistent native bridge disconnected during visible attachment transfer.',
-      true
-    ))
-  }
-}
-
-function persistentNativeRequestId() {
-  let requestId = ''
-  do {
-    requestId = `native-${globalThis.crypto?.randomUUID?.() ?? `${Date.now()}-${Math.random().toString(16).slice(2)}`}`
-  } while (pendingNativeBridgeRequests.has(requestId))
-  return requestId
-}
-
-function recordHandledDaemonJob(identity: { key: string }) {
-  handledDaemonJobOrder.push(identity.key)
-  while (handledDaemonJobOrder.length > MAX_HANDLED_DAEMON_JOBS) {
-    const oldest = handledDaemonJobOrder.shift()
-    if (oldest) handledDaemonJobs.delete(oldest)
-  }
-}
-
-function daemonJobIdentity(job: unknown) {
-  const claimedJob = objectRecord(job)
-  const jobId = stringOrUndefined(claimedJob.job_id)
-  const claimToken = stringOrUndefined(claimedJob.claim_token)
-  if (!jobId || !claimToken) return null
-  return { key: `${jobId}\u0000${claimToken}`, jobId, claimToken }
-}
-
-async function runClaimedDaemonJob(job: unknown, port: chrome.runtime.Port) {
-  const claimedJob = objectRecord(job)
-  const jobId = stringOrUndefined(claimedJob.job_id)
-  const claimToken = stringOrUndefined(claimedJob.claim_token)
-  if (!jobId || !claimToken) {
-    return daemonRunResponse({
-      ok: false,
-      job: claimedJob,
-      error: {
-        code: 'invalid_daemon_job',
-        message: 'Claimed daemon job is missing job_id or claim_token.',
-        retryable: false,
-      },
-    })
-  }
-
-  let normalized: ReturnType<typeof normalizeBridgeResponse>
-  try {
-    const bridgeRequest = daemonJobToBridgeRequest(claimedJob)
-    const validation = validateBridgeRequest(bridgeRequest)
-    if (validation.ok === false) {
-      throw bridgeError(validation.error.code, validation.error.message, validation.error.retryable)
-    }
-    const bridgeResponse = await runBridgeRequest(validation.request, { port, jobId, claimToken })
-    normalized = normalizeBridgeResponse(bridgeResponse)
-  } catch (error) {
-    const serialized = normalizeRuntimeError(error, 'daemon_run_failed', 'Daemon job run failed.')
-    const completion = await completeClaimedDaemonJob({
-      port,
-      jobId,
-      claimToken,
-      error: serialized,
-    })
-    return daemonRunResponse({
-      ok: false,
-      job: completion?.result ?? claimedJob,
-      error: serialized,
-    })
-  }
-
-  const completion = await completeClaimedDaemonJob({
-    port,
-    jobId,
-    claimToken,
-    result: normalized.ok ? normalized.result : undefined,
-    error: normalized.ok ? undefined : normalized.error,
-  })
-  return daemonRunResponse({
-    ok: normalized.ok,
-    job: completion.result ?? claimedJob,
-    bridge: normalized,
-    result: normalized.result,
-    error: normalized.error,
-  })
-}
-
-async function completeClaimedDaemonJob({
-  port,
-  jobId,
-  claimToken,
-  result,
-  error,
-}: {
-  port: chrome.runtime.Port
-  jobId: string
-  claimToken: string
-  result?: unknown
-  error?: unknown
-}) {
-  let retryDelayMs = 100
-  while (daemonBridge.isConnectedPort(port)) {
-    let completion: ExtensionRecord | undefined
-    let completionError: unknown
-    try {
-      completion = await completeDaemonJob({ jobId, claimToken, result, error })
-      if (completion?.ok === true) {
-        await confirmDaemonBridgeReady(port, jobId, claimToken)
-        return completion
-      }
-      completionError = completion?.error
-    } catch (caught) {
-      completionError = caught
-    }
-
-    // The short-lived completion host may have committed the terminal state
-    // before its response was lost. A correlated READY probe is safe because
-    // the persistent native host releases the claim only after it verifies the
-    // daemon job is terminal.
-    try {
-      await confirmDaemonBridgeReady(port, jobId, claimToken)
-      return { ok: true, result: undefined, reconciled: true }
-    } catch {
-      if (!daemonBridge.isConnectedPort(port)) break
-    }
-
-    const normalizedError = normalizeRuntimeError(
-      completionError,
-      'daemon_completion_failed',
-      'Daemon job completion failed.'
-    )
-    if (normalizedError.retryable === false) {
-      daemonBridge.reconnectIfCurrent(port)
-      throw bridgeError(normalizedError.code, normalizedError.message, false)
-    }
-    await delay(retryDelayMs)
-    retryDelayMs = Math.min(5000, retryDelayMs * 2)
-  }
-  throw bridgeError(
-    'native_bridge_disconnected',
-    'Persistent native bridge disconnected before daemon completion was confirmed.',
-    true
-  )
-}
-
-async function confirmDaemonBridgeReady(
-  port: chrome.runtime.Port,
-  jobId: string,
-  claimToken: string
-) {
-  const message = await persistentNativeRequest(port, NATIVE_MESSAGE_TYPES.DAEMON_READY, {
-    jobId,
-    claimToken,
-  })
-  const result = objectRecord(message.result)
-  if (result.status !== 'ready' || result.jobId !== jobId) {
-    throw bridgeError(
-      'native_protocol_mismatch',
-      'Native host did not confirm the completed daemon claim was released.',
-      false
-    )
-  }
-}
-
-function daemonJobToBridgeRequest(job: ExtensionRecord): BridgeRequest {
-  const requestJson = objectRecord(job.request_json)
-  return createBridgeRequest({
-    requestId: stringOrUndefined(requestJson.requestId) ?? stringOrUndefined(job.job_id),
-    provider: job.provider,
-    action: job.action,
-    prompt: requestJson.prompt,
-    targetUrl: requestJson.targetUrl,
-    idempotencyKey: requestJson.idempotencyKey ?? stringOrUndefined(job.job_id),
-    conversation: requestJson.conversation,
-    readDelayMs: requestJson.readDelayMs,
-    readTimeoutMs: requestJson.readTimeoutMs,
-    submitTimeoutMs: requestJson.submitTimeoutMs,
-    includeText: requestJson.includeText,
-    maxTextChars: requestJson.maxTextChars,
-    chatSurface: requestJson.chatSurface,
-    model: requestJson.model,
-    modelFallbacks: requestJson.modelFallbacks,
-    effort: requestJson.effort,
-    attachments: requestJson.attachments,
-    visibleAction: requestJson.visibleAction,
-    metadata: requestJson.metadata,
-  })
-}
-
-async function completeDaemonJob({
-  daemonUrl,
-  jobId,
-  claimToken,
-  result,
-  error,
-}: {
-  daemonUrl?: string | undefined
-  jobId: string
-  claimToken: string
-  result?: unknown
-  error?: unknown
-}) {
-  return nativeRequest({
-    type: NATIVE_MESSAGE_TYPES.DAEMON_COMPLETE_JOB,
-    daemonUrl,
-    jobId,
-    claimToken,
-    result,
-    error,
-  })
-}
-
-function nativeRequest(message: ExtensionRecord): Promise<any> {
-  return new Promise((resolve, reject) => {
-    const port = chrome.runtime.connectNative(NATIVE_HOST_NAME)
-    let settled = false
-    const timeout = setTimeout(() => {
-      if (!settled) {
-        settled = true
-        port.disconnect()
-        reject(bridgeError('native_host_timeout', `Native host did not respond to ${message.type}.`, true))
-      }
-    }, NATIVE_REQUEST_TIMEOUT_MS)
-    port.onMessage.addListener((response) => {
-      if (settled) return
-      if (!isNativeMessage(response) || response.type !== message.type) {
-        settled = true
-        clearTimeout(timeout)
-        port.disconnect()
-        reject(bridgeError(
-          'native_protocol_mismatch',
-          `Native host response must use ${NATIVE_PROTOCOL_VERSION} and match ${message.type}.`,
-          false
-        ))
-        return
-      }
-      settled = true
-      clearTimeout(timeout)
-      resolve(response)
-      port.disconnect()
-    })
-    port.onDisconnect.addListener(() => {
-      if (!settled) {
-        clearTimeout(timeout)
-        reject(bridgeError('native_host_disconnected', chrome.runtime.lastError?.message || 'Native host disconnected.', true))
-      }
-    })
-    port.postMessage(createNativeMessage(message.type, stripUndefined(message)))
-  })
-}
-
-function normalizeBridgeResponse(response: ExtensionRecord) {
-  if (!response?.ok) {
-    return {
-      ok: false,
-      result: null,
-      error: response?.error || {
-        code: 'bridge_failed',
-        message: 'Browser session bridge failed.',
-        retryable: true,
-      },
-    }
-  }
-
-  const submit = response.result?.submit
-  const read = response.result?.read ?? response.result
-  if (submit?.status === 'blocked') {
-    return {
-      ok: false,
-      result: response.result,
-      error: { code: submit.stopReason, message: submit.message || 'Provider submit was blocked.', retryable: true },
-    }
-  }
-  if (read?.status === 'blocked') {
-    return {
-      ok: false,
-      result: response.result,
-      error: { code: read.stopReason, message: read.message || 'Provider read was blocked.', retryable: true },
-    }
-  }
-  return {
-    ok: true,
-    result: {
-      ...response.result,
-      text: read?.text,
-      provider: read?.provider ?? response.provider,
-    },
-    error: null,
-  }
-}
-
-function daemonRunResponse({
-  ok,
-  job,
-  bridge,
-  result,
-  error,
-}: {
-  ok: boolean
-  job: unknown
-  bridge?: unknown
-  result?: unknown
-  error?: unknown
-}) {
-  return {
-    type: DAEMON_JOB_RESPONSE_TYPE,
-    ok,
-    status: ok ? 'completed' : 'failed',
-    job: publicDaemonJob(job),
-    bridge: bridge ?? null,
-    result: ok ? result ?? null : null,
-    error: ok ? null : normalizeRuntimeError(error, 'daemon_run_failed', 'Daemon job run failed.'),
-  }
-}
-
-function publicDaemonJob(job: unknown): unknown {
-  if (!job || typeof job !== 'object' || Array.isArray(job)) {
-    return job
-  }
-  const { claim_token: _claimTokenSnake, claimToken: _claimTokenCamel, ...publicJob } = job as ExtensionRecord
-  return publicJob
-}
-
-function normalizeRuntimeError(error: unknown, fallbackCode: string, fallbackMessage: string) {
-  const candidate = error as Partial<BridgeRuntimeError> | null | undefined
-  return {
-    code: typeof candidate?.code === 'string' ? candidate.code : fallbackCode,
-    message: typeof candidate?.message === 'string' ? candidate.message : fallbackMessage,
-    retryable: Boolean(candidate?.retryable),
-  }
-}
-
-function objectRecord(value: unknown): ExtensionRecord {
-  if (value && typeof value === 'object' && !Array.isArray(value)) {
-    return value as ExtensionRecord
-  }
-  return {}
-}
-
-function stringOrUndefined(value: unknown) {
-  return typeof value === 'string' && value.trim() ? value : undefined
-}
-
-function stripUndefined(value: ExtensionRecord) {
-  return Object.fromEntries(Object.entries(value).filter((entry) => entry[1] !== undefined))
-}
-
-async function getOrCreateProviderTab(
-  provider: ProviderConfig,
-  targetUrl: unknown,
-  options: { forceNew?: boolean } = {}
-) {
-  const requestedUrl = safeProviderUrl(provider, targetUrl)
-  if (options.forceNew) return chrome.tabs.create({ url: requestedUrl, active: true })
-  const candidates: chrome.tabs.Tab[] = []
-  for (const host of provider.hosts) {
-    candidates.push(...await chrome.tabs.query({ url: `https://${host}/*` }))
-  }
-  if (targetUrl !== undefined) {
-    const requestedKey = canonicalProviderUrl(requestedUrl)
-    const exactCandidate = candidates.find((tab) => (
-      tab.id !== undefined && canonicalProviderUrl(tab.url ?? '') === requestedKey
-    ))
-    if (exactCandidate) {
-      return exactCandidate
-    }
-    return chrome.tabs.create({ url: requestedUrl, active: true })
-  }
-  const visibleCandidate = candidates.find((tab) => (
-    tab.id !== undefined &&
-    (
-      isCanonicalProviderLandingTarget(provider, tab.url ?? '') ||
-      providerTransitionSource(provider, tab.url ?? '') !== null ||
-      isProviderConversationUrl(provider, tab.url ?? '')
-    )
-  ))
-  if (visibleCandidate) {
-    return visibleCandidate
-  }
-  return chrome.tabs.create({ url: requestedUrl, active: true })
-}
-
-function hasVisibleAttachments(request: BridgeRequest) {
-  return Array.isArray(request.attachments) && request.attachments.length > 0
-}
-
-async function focusTab(tab: chrome.tabs.Tab) {
-  if (tab.windowId !== undefined) {
-    await chrome.windows.update(tab.windowId, { focused: true })
-  }
-  if (tab.id !== undefined) {
-    await chrome.tabs.update(tab.id, { active: true })
-  }
-}
-
-async function sendToProviderTab(
-  tabId: number | undefined,
-  provider: ProviderConfig,
-  request: BridgeRequest,
-  message: Record<string, unknown>
-): Promise<any> {
-  if (tabId === undefined) {
-    throw bridgeError('tab_unavailable', 'Provider tab is not available.', true)
-  }
-  for (let attempt = 0; attempt < 3; attempt += 1) {
-    await validateProviderTabContext(tabId, provider, request)
-    try {
-      return await chrome.tabs.sendMessage(tabId, message)
-    } catch (error) {
-      if (attempt === 2) {
-        const message = error instanceof Error ? error.message : 'Provider content script is unavailable.'
-        throw bridgeError('content_script_unavailable', message || 'Provider content script is unavailable.', true)
-      }
-      await validateProviderTabContext(tabId, provider, request)
-      await chrome.scripting.executeScript({
-        target: { tabId },
-        files: ['content/provider-content.js'],
-      })
-      await delay(250)
-    }
-  }
-  throw bridgeError('content_script_unavailable', 'Provider content script is unavailable.', true)
-}
-
-async function waitForProviderTabLoaded(
-  tabId: number | undefined,
-  provider: ProviderConfig,
-  targetUrl: unknown,
-  timeoutMs = PROVIDER_LANDING_TIMEOUT_MS
-) {
-  if (tabId === undefined) {
-    throw bridgeError('tab_unavailable', 'Provider tab is not available.', true)
-  }
-  const deadline = Date.now() + timeoutMs
-  let lastUrl = ''
-  while (Date.now() < deadline) {
-    const tab = await chrome.tabs.get(tabId)
-    lastUrl = tab.pendingUrl || tab.url || lastUrl
-    if (tab.status === 'complete') {
-      return assertProviderTabContext(tab, provider, targetUrl)
-    }
-    await delay(PROVIDER_LANDING_POLL_MS)
-  }
-  throw bridgeError(
-    'provider_landing_timeout',
-    `Timed out waiting for ${provider.label} to load. Last URL: ${redactUrlForError(lastUrl) || 'unknown'}`,
-    true
-  )
-}
-
-async function validateProviderLanding(tabId: number | undefined, provider: ProviderConfig, request: BridgeRequest) {
-  const validation = await sendToProviderTab(
-    tabId,
-    provider,
-    request,
-    { type: 'tokenless.bridge.validate_landing', request }
-  )
-  if (validation?.status === 'ready') {
-    return validation
-  }
-  if (validation?.status === 'blocked') {
-    throw bridgeError(
-      validation.stopReason || 'provider_landing_blocked',
-      validation.message || `${provider.label} page is not ready for Tokenless.`,
-      true
-    )
-  }
-  throw bridgeError('provider_landing_unavailable', `${provider.label} page did not report a usable chat surface.`, true)
-}
-
-async function validateProviderTabContext(tabId: number, provider: ProviderConfig, request: BridgeRequest) {
-  return assertProviderTabContext(
-    await chrome.tabs.get(tabId),
-    provider,
-    request.targetUrl,
-    hasPostSubmitTargetTransitionProof(provider, request)
-  )
-}
-
-function hasPostSubmitTargetTransitionProof(provider: ProviderConfig, request: BridgeRequest) {
-  if (
-    request[POST_SUBMIT_TARGET_TRANSITION_FLAG] !== true ||
-    !providerTransitionSource(provider, request.targetUrl)
-  ) {
-    return false
-  }
-  const proof = objectRecord(request[POST_SUBMIT_TARGET_TRANSITION_PROOF])
-  const proofBaseline = objectRecord(proof.answerBaseline)
-  const requestBaseline = objectRecord(request.answerBaseline)
-  const transitionSource = providerTransitionSource(provider, request.targetUrl)
-  return (
-    Boolean(transitionSource) &&
-    proof.requestId === request.requestId &&
-    proof.provider === provider.id &&
-    proof.targetUrl === canonicalProviderUrl(request.targetUrl) &&
-    proof.sourceKind === transitionSource?.kind &&
-    proof.customGptId === transitionSource?.customGptId &&
-    proof.projectId === transitionSource?.projectId &&
-    typeof proof.nonce === 'string' &&
-    proof.nonce.length >= 16 &&
-    Number.isInteger(proofBaseline.count) &&
-    proofBaseline.count >= 0 &&
-    typeof proofBaseline.lastText === 'string' &&
-    proofBaseline.count === requestBaseline.count &&
-    proofBaseline.lastText === requestBaseline.lastText
-  )
-}
-
-function assertProviderTabContext(
-  tab: chrome.tabs.Tab,
-  provider: ProviderConfig,
-  targetUrl: unknown,
-  allowPostSubmitTargetTransition = false
-) {
-  const currentUrl = tab.pendingUrl || tab.url || ''
-  const currentProvider = getProviderForUrl(currentUrl)
-  if (
-    !currentProvider ||
-    currentProvider.id !== provider.id ||
-    !isSafeProviderAuthority(provider, currentUrl)
-  ) {
-    throw bridgeError(
-      'provider_tab_mismatch',
-      `Provider tab is no longer on the requested ${provider.label} origin.`,
-      false
-    )
-  }
-  const targetMayTransition = (
-    allowPostSubmitTargetTransition &&
-    isApprovedProviderTransition(provider, targetUrl, currentUrl)
-  )
-  const canonicalLandingEquivalent = areProviderTransitionSourcesEquivalent(provider, targetUrl, currentUrl)
-  if (
-    targetUrl === undefined &&
-    !providerTransitionSource(provider, currentUrl) &&
-    !isProviderConversationUrl(provider, currentUrl)
-  ) {
-    throw bridgeError(
-      'target_tab_mismatch',
-      `Provider tab is not on an approved ${provider.label} landing or conversation URL.`,
-      false
-    )
-  }
-  if (
-    targetUrl !== undefined &&
-    !targetMayTransition &&
-    !canonicalLandingEquivalent &&
-    canonicalProviderUrl(currentUrl) !== canonicalProviderUrl(safeProviderUrl(provider, targetUrl))
-  ) {
-    throw bridgeError(
-      'target_tab_mismatch',
-      `Provider tab is no longer on the requested ${provider.label} target.`,
-      false
-    )
-  }
-  return tab
-}
-
-function safeProviderUrl(provider: ProviderConfig, targetUrl: unknown) {
-  if (targetUrl === undefined) return provider.homeUrl
-  let parsed: URL
-  try {
-    parsed = new URL(String(targetUrl))
-  } catch {
-    throw bridgeError('invalid_target_url', 'Target URL must be a valid absolute URL.', false)
-  }
-  const normalized = safeProviderTargetUrl(provider, parsed.href)
-  if (!normalized) {
-    throw bridgeError('target_url_provider_mismatch', 'Target URL must belong to the selected provider.', false)
-  }
-  return normalized
-}
-
-function delay(ms: number) {
-  return new Promise((resolve) => setTimeout(resolve, ms))
-}
-
-function redactUrlForError(url: string) {
-  return publicProviderUrl(url)
-}
-
-function publicProviderUrl(url: string) {
-  try {
-    const parsed = new URL(url)
-    return `${parsed.origin}${parsed.pathname}`
-  } catch {
-    return ''
-  }
-}
-
-function bridgeError(code: string, message: string, retryable: boolean) {
-  const error: BridgeRuntimeError = new Error(message)
-  error.code = code
-  error.retryable = retryable
-  return error
-}
diff --git a/legacy/extension/extension/background/visible-provider-action-runtime.ts b/legacy/extension/extension/background/visible-provider-action-runtime.ts
deleted file mode 100644
index 52390b8..0000000
--- a/legacy/extension/extension/background/visible-provider-action-runtime.ts
+++ /dev/null
@@ -1,502 +0,0 @@
-import { BRIDGE_ACTIONS, createBridgeRequest } from '../shared/bridge-protocol.js'
-import { getProviderById } from '../shared/provider-config.js'
-import {
-  VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION,
-  VISIBLE_PROVIDER_ACTIONS,
-  VISIBLE_PROVIDER_RUNTIME_REQUEST_TYPE,
-  authorizeVisibleProviderAction,
-  createVisibleProviderActionResponse,
-  validateVisibleProviderActionRequest,
-} from '../shared/visible-provider-actions.js'
-import { getVisibleProviderActionCapabilities } from '../shared/visible-provider-capabilities.js'
-import type { BridgeRequest } from '../shared/bridge-protocol.js'
-import type { NativeAttachmentDescriptor } from '../shared/native-protocol.js'
-import type { ProviderConfig } from '../shared/provider-config.js'
-import type {
-  VisibleAuthStatusResult,
-  VisibleProviderActionRequest,
-  VisibleProviderActionResponse,
-} from '../shared/visible-provider-actions.js'
-
-export const VISIBLE_PROVIDER_CONTENT_ACTION_TYPE = 'tokenless.bridge.visible_provider_action' as const
-
-export type VisibleProviderRuntimeDependencies = {
-  acquireProviderTab(provider: ProviderConfig, options: { forceNew: boolean }): Promise<number>
-  validateProviderLanding(tabId: number, provider: ProviderConfig, request: BridgeRequest): Promise<void>
-  sendToProviderTab(
-    tabId: number,
-    provider: ProviderConfig,
-    contextRequest: BridgeRequest,
-    message: Record<string, unknown>
-  ): Promise<unknown>
-  uploadVisibleAttachments(
-    tabId: number,
-    provider: ProviderConfig,
-    contextRequest: BridgeRequest,
-    attachments: readonly NativeAttachmentDescriptor[]
-  ): Promise<void>
-}
-
-type RuntimeSender = {
-  id?: string | undefined
-  tab?: unknown
-  url?: string | undefined
-}
-
-type AuthProbe = {
-  state: VisibleAuthStatusResult['state']
-  response: VisibleProviderActionResponse
-  verified: boolean
-}
-
-export function isVisibleProviderRuntimeMessage(message: unknown) {
-  return isPlainRecord(message) && message.type === VISIBLE_PROVIDER_RUNTIME_REQUEST_TYPE
-}
-
-export function visibleProviderActionRequiresCleanTab(action: string) {
-  return action === VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD
-}
-
-export function isTrustedVisibleProviderRuntimeSender(sender: RuntimeSender, extensionId: string) {
-  if (!extensionId || sender.id !== extensionId || sender.tab !== undefined) return false
-  if (sender.url === undefined) return true
-  try {
-    const parsed = new URL(sender.url)
-    return (
-      parsed.protocol === 'chrome-extension:' &&
-      parsed.hostname === extensionId &&
-      parsed.username === '' &&
-      parsed.password === '' &&
-      parsed.port === ''
-    )
-  } catch {
-    return false
-  }
-}
-
-export function rejectedVisibleProviderRuntimeResponse(message: unknown): VisibleProviderActionResponse {
-  return failureResponse(
-    requestCandidate(message),
-    'visible_action_sender_rejected',
-    'Visible provider actions may be requested only by an extension-owned page.',
-    false
-  )
-}
-
-export function failedVisibleProviderRuntimeResponse(message: unknown): VisibleProviderActionResponse {
-  return failureResponse(
-    requestCandidate(message),
-    'visible_action_runtime_failed',
-    'Visible provider action runtime failed before a verified result was produced.',
-    true
-  )
-}
-
-export async function runVisibleProviderRuntimeEnvelope(
-  envelope: unknown,
-  dependencies: VisibleProviderRuntimeDependencies
-): Promise<VisibleProviderActionResponse> {
-  if (
-    !isPlainRecord(envelope) ||
-    !hasExactKeys(envelope, ['type', 'request']) ||
-    envelope.type !== VISIBLE_PROVIDER_RUNTIME_REQUEST_TYPE
-  ) {
-    return failureResponse(
-      requestCandidate(envelope),
-      'invalid_visible_action_runtime_envelope',
-      'Visible provider runtime envelope is invalid.',
-      false
-    )
-  }
-
-  const validation = validateVisibleProviderActionRequest(envelope.request)
-  if (validation.ok === false) {
-    return failureResponse(
-      requestCandidate(envelope),
-      validation.error.code,
-      validation.error.message,
-      validation.error.retryable
-    )
-  }
-  const request = validation.request
-  const provider = getProviderById(request.provider)
-  const manifest = getVisibleProviderActionCapabilities(request.provider)
-  if (!provider || !manifest) {
-    return failureResponse(request, 'unsupported_provider', 'Visible provider is not supported.', false)
-  }
-
-  // Run the complete schema/capability preflight before opening a provider tab.
-  // Authenticated is used only to postpone the live session check; pending,
-  // unsupported, label, and upload-limit failures still stop without UI effects.
-  const preflight = authorizeVisibleProviderAction(request, manifest, { authState: 'authenticated' })
-  if (preflight.ok === false) {
-    return failureResponse(request, preflight.error.code, preflight.error.message, preflight.error.retryable)
-  }
-
-  try {
-    const tabId = await dependencies.acquireProviderTab(provider, {
-      forceNew: visibleProviderActionRequiresCleanTab(request.action),
-    })
-    const contextRequest = bridgeContextRequest(request)
-    const auth = await deriveVisibleAuthStatus(tabId, provider, contextRequest, request, dependencies)
-    const authorization = authorizeVisibleProviderAction(request, manifest, { authState: auth.state })
-    if (authorization.ok === false) {
-      return failureResponse(
-        request,
-        authorization.error.code,
-        authorization.error.message,
-        authorization.error.retryable
-      )
-    }
-    if (request.action === VISIBLE_PROVIDER_ACTIONS.AUTH_STATUS) {
-      return auth.verified
-        ? auth.response
-        : failureResponse(
-          request,
-          'visible_auth_status_unavailable',
-          'Provider content did not return a verified privacy-safe auth status.',
-          false
-        )
-    }
-
-    await dependencies.validateProviderLanding(tabId, provider, contextRequest)
-    return dispatchVisibleProviderAction(tabId, provider, request, dependencies)
-  } catch (error) {
-    const candidate = error && typeof error === 'object'
-      ? error as Record<string, unknown>
-      : {}
-    return failureResponse(
-      request,
-      safeErrorCode(candidate.code, 'visible_action_runtime_failed'),
-      'Visible provider action runtime failed before a verified result was produced.',
-      candidate.retryable !== false
-    )
-  }
-}
-
-async function deriveVisibleAuthStatus(
-  tabId: number,
-  provider: ProviderConfig,
-  contextRequest: BridgeRequest,
-  sourceRequest: VisibleProviderActionRequest,
-  dependencies: VisibleProviderRuntimeDependencies
-): Promise<AuthProbe> {
-  const request: VisibleProviderActionRequest = {
-    ...sourceRequest,
-    action: VISIBLE_PROVIDER_ACTIONS.AUTH_STATUS,
-    payload: {},
-  }
-  const unknown = createVisibleProviderActionResponse(request, {
-    ok: true,
-    result: { state: 'unknown' },
-  })
-  try {
-    const response = await dependencies.sendToProviderTab(tabId, provider, contextRequest, {
-      type: 'tokenless.bridge.inspect_auth',
-      request: contextRequest,
-    })
-    if (
-      !isPlainRecord(response) ||
-      response.status !== 'inspected' ||
-      response.provider !== provider.id ||
-      response.visible !== true ||
-      !isPlainRecord(response.auth)
-    ) {
-      return { state: 'unknown', response: unknown, verified: false }
-    }
-    const normalized = createVisibleProviderActionResponse(request, { ok: true, result: response.auth })
-    if (!normalized.ok || !isPlainRecord(normalized.result)) {
-      return { state: 'unknown', response: unknown, verified: false }
-    }
-    const state = normalized.result.state
-    if (state !== 'authenticated' && state !== 'unauthenticated' && state !== 'unknown') {
-      return { state: 'unknown', response: unknown, verified: false }
-    }
-    return { state, response: normalized, verified: true }
-  } catch {
-    return { state: 'unknown', response: unknown, verified: false }
-  }
-}
-
-async function dispatchVisibleProviderAction(
-  tabId: number,
-  provider: ProviderConfig,
-  request: VisibleProviderActionRequest,
-  dependencies: VisibleProviderRuntimeDependencies
-): Promise<VisibleProviderActionResponse> {
-  const contextRequest = bridgeContextRequest(request)
-  if (request.action === VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD) {
-    const attachments = request.payload.attachments as NativeAttachmentDescriptor[]
-    await dependencies.uploadVisibleAttachments(tabId, provider, contextRequest, attachments)
-    return createVisibleProviderActionResponse(request, {
-      ok: true,
-      result: {
-        attachments: attachments.map((attachment) => ({
-          attachmentId: attachment.attachmentId,
-          name: attachment.name,
-          visible: true,
-        })),
-      },
-    })
-  }
-  if (
-    request.action === VISIBLE_PROVIDER_ACTIONS.MODEL_INSPECT ||
-    request.action === VISIBLE_PROVIDER_ACTIONS.EFFORT_INSPECT
-  ) {
-    const response = await dependencies.sendToProviderTab(tabId, provider, contextRequest, {
-      type: 'tokenless.bridge.inspect_controls',
-      request: contextRequest,
-    })
-    return normalizeLegacyInspection(request, response)
-  }
-  if (
-    request.action === VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT ||
-    request.action === VISIBLE_PROVIDER_ACTIONS.EFFORT_SELECT
-  ) {
-    const response = await dependencies.sendToProviderTab(tabId, provider, contextRequest, {
-      type: 'tokenless.bridge.configure_controls',
-      request: contextRequest,
-    })
-    return normalizeLegacySelection(request, response)
-  }
-  if (request.action === VISIBLE_PROVIDER_ACTIONS.PROMPT_SUBMIT) {
-    const response = await dependencies.sendToProviderTab(tabId, provider, contextRequest, {
-      type: 'tokenless.bridge.submit',
-      request: contextRequest,
-    })
-    if (!isPlainRecord(response) || response.status !== 'submitted') {
-      return contentBlockedResponse(request, response, 'visible_prompt_submit_unconfirmed')
-    }
-    return createVisibleProviderActionResponse(request, {
-      ok: true,
-      result: { submissionProof: `visible-submit-${request.requestId}`, visible: true },
-    })
-  }
-  if (request.action === VISIBLE_PROVIDER_ACTIONS.PROMPT_INPUT) {
-    const response = await dependencies.sendToProviderTab(tabId, provider, contextRequest, {
-      type: 'tokenless.bridge.input_prompt',
-      request: contextRequest,
-    })
-    if (
-      !isPlainRecord(response) ||
-      response.status !== 'input' ||
-      response.provider !== provider.id ||
-      response.visible !== true ||
-      typeof response.inputProof !== 'string'
-    ) {
-      return contentBlockedResponse(request, response, 'visible_prompt_input_unconfirmed')
-    }
-    return createVisibleProviderActionResponse(request, {
-      ok: true,
-      result: { inputProof: response.inputProof, visible: true },
-    })
-  }
-
-  const response = await dependencies.sendToProviderTab(tabId, provider, contextRequest, {
-    type: VISIBLE_PROVIDER_CONTENT_ACTION_TYPE,
-    request,
-  })
-  return normalizeGenericContentResponse(request, response)
-}
-
-function normalizeLegacyInspection(
-  request: VisibleProviderActionRequest,
-  response: unknown
-): VisibleProviderActionResponse {
-  if (!isPlainRecord(response) || response.status !== 'inspected' || !isPlainRecord(response.controls)) {
-    return contentBlockedResponse(request, response, 'visible_control_inspection_unconfirmed')
-  }
-  const source = request.action === VISIBLE_PROVIDER_ACTIONS.MODEL_INSPECT
-    ? response.controls.models
-    : response.controls.efforts
-  if (!Array.isArray(source) || source.length > 100) {
-    return failureResponse(
-      request,
-      'invalid_visible_action_result',
-      'Provider content returned an invalid control inventory.',
-      false
-    )
-  }
-  const choices: Array<{ label: unknown; selected: unknown; enabled: unknown }> = []
-  for (const item of source) {
-    if (!isPlainRecord(item)) {
-      return failureResponse(
-        request,
-        'invalid_visible_action_result',
-        'Provider content returned an invalid control inventory.',
-        false
-      )
-    }
-    choices.push({ label: item.label, selected: item.selected, enabled: item.available })
-  }
-  return createVisibleProviderActionResponse(request, { ok: true, result: { choices } })
-}
-
-function normalizeLegacySelection(
-  request: VisibleProviderActionRequest,
-  response: unknown
-): VisibleProviderActionResponse {
-  if (!isPlainRecord(response) || response.status !== 'configured') {
-    return contentBlockedResponse(request, response, 'visible_control_selection_unconfirmed')
-  }
-  const selection = request.action === VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT
-    ? response.model
-    : response.effort
-  if (
-    !isPlainRecord(selection) ||
-    (selection.status !== 'selected' && selection.status !== 'fallback_selected') ||
-    typeof selection.applied !== 'string'
-  ) {
-    return failureResponse(
-      request,
-      'invalid_visible_action_result',
-      'Provider content did not confirm one exact visible control selection.',
-      false
-    )
-  }
-  return createVisibleProviderActionResponse(request, {
-    ok: true,
-    result: { label: selection.applied, visible: true },
-  })
-}
-
-function normalizeGenericContentResponse(
-  request: VisibleProviderActionRequest,
-  response: unknown
-): VisibleProviderActionResponse {
-  if (!isMatchingContentResponse(response, request)) {
-    return failureResponse(
-      request,
-      'invalid_visible_action_result',
-      'Provider content response did not match the visible action request.',
-      false
-    )
-  }
-  if (response.ok === true) {
-    return createVisibleProviderActionResponse(request, { ok: true, result: response.result })
-  }
-  return failureResponse(
-    request,
-    safeErrorCode(isPlainRecord(response.error) ? response.error.code : undefined, 'visible_action_content_blocked'),
-    'Provider content blocked the requested visible action.',
-    false
-  )
-}
-
-function contentBlockedResponse(
-  request: VisibleProviderActionRequest,
-  response: unknown,
-  fallbackCode: string
-) {
-  const candidate = isPlainRecord(response) ? response : {}
-  return failureResponse(
-    request,
-    safeErrorCode(candidate.stopReason, fallbackCode),
-    'Provider content did not produce the required visible confirmation.',
-    candidate.retryable === true
-  )
-}
-
-function bridgeContextRequest(request: VisibleProviderActionRequest): BridgeRequest {
-  const payload = request.payload
-  if (request.action === VISIBLE_PROVIDER_ACTIONS.MODEL_INSPECT) {
-    return createBridgeRequest({ requestId: request.requestId, provider: request.provider, action: BRIDGE_ACTIONS.INSPECT_CONTROLS })
-  }
-  if (request.action === VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT) {
-    return createBridgeRequest({
-      requestId: request.requestId,
-      provider: request.provider,
-      action: BRIDGE_ACTIONS.CONFIGURE_CONTROLS,
-      model: payload.label,
-      modelFallbacks: payload.fallbacks,
-    })
-  }
-  if (request.action === VISIBLE_PROVIDER_ACTIONS.EFFORT_INSPECT) {
-    return createBridgeRequest({ requestId: request.requestId, provider: request.provider, action: BRIDGE_ACTIONS.INSPECT_CONTROLS })
-  }
-  if (request.action === VISIBLE_PROVIDER_ACTIONS.EFFORT_SELECT) {
-    return createBridgeRequest({
-      requestId: request.requestId,
-      provider: request.provider,
-      action: BRIDGE_ACTIONS.CONFIGURE_CONTROLS,
-      effort: payload.label,
-    })
-  }
-  if (request.action === VISIBLE_PROVIDER_ACTIONS.PROMPT_SUBMIT) {
-    return createBridgeRequest({
-      requestId: request.requestId,
-      provider: request.provider,
-      action: BRIDGE_ACTIONS.SUBMIT,
-      prompt: payload.text,
-    })
-  }
-  if (request.action === VISIBLE_PROVIDER_ACTIONS.PROMPT_INPUT) {
-    const contextRequest = createBridgeRequest({
-      requestId: request.requestId,
-      provider: request.provider,
-      action: BRIDGE_ACTIONS.SUBMIT,
-      prompt: payload.text,
-    })
-    contextRequest.mode = payload.mode
-    return contextRequest
-  }
-  if (request.action === VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD) {
-    return createBridgeRequest({
-      requestId: request.requestId,
-      provider: request.provider,
-      action: BRIDGE_ACTIONS.VISIBLE_PROVIDER_ACTION,
-      visibleAction: request,
-      attachments: payload.attachments,
-    })
-  }
-  return createBridgeRequest({
-    requestId: request.requestId,
-    provider: request.provider,
-    action: BRIDGE_ACTIONS.OPEN,
-  })
-}
-
-function isMatchingContentResponse(
-  response: unknown,
-  request: VisibleProviderActionRequest
-): response is Record<string, any> {
-  return (
-    isPlainRecord(response) &&
-    response.protocol === VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION &&
-    response.requestId === request.requestId &&
-    response.provider === request.provider &&
-    response.action === request.action &&
-    typeof response.ok === 'boolean'
-  )
-}
-
-function failureResponse(
-  request: Partial<VisibleProviderActionRequest> | null | undefined,
-  code: string,
-  message: string,
-  retryable: boolean
-) {
-  return createVisibleProviderActionResponse(request, {
-    ok: false,
-    error: { code: safeErrorCode(code, 'visible_action_failed'), message, retryable },
-  })
-}
-
-function requestCandidate(envelope: unknown): Partial<VisibleProviderActionRequest> | null {
-  if (!isPlainRecord(envelope) || !isPlainRecord(envelope.request)) return null
-  return envelope.request as Partial<VisibleProviderActionRequest>
-}
-
-function safeErrorCode(value: unknown, fallback: string) {
-  return typeof value === 'string' && /^[a-z][a-z0-9_]{0,63}$/.test(value) ? value : fallback
-}
-
-function isPlainRecord(value: unknown): value is Record<string, any> {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) return false
-  const prototype = Object.getPrototypeOf(value)
-  return prototype === Object.prototype || prototype === null
-}
-
-function hasExactKeys(value: Record<string, unknown>, expected: readonly string[]) {
-  return Object.keys(value).length === expected.length && expected.every((key) => Object.hasOwn(value, key))
-}
diff --git a/legacy/extension/extension/content/provider-content.ts b/legacy/extension/extension/content/provider-content.ts
deleted file mode 100644
index e92f6a4..0000000
--- a/legacy/extension/extension/content/provider-content.ts
+++ /dev/null
@@ -1,3162 +0,0 @@
-import { getProviderForUrl } from '../shared/provider-config.js'
-import {
-  areProviderTransitionSourcesEquivalent,
-  canonicalProviderUrl,
-  hasSafeProviderAuthority,
-  isApprovedProviderTransition,
-  isProviderConversationUrl,
-  providerTransitionSource,
-} from '../shared/provider-navigation-policy.js'
-import type { ProviderConfig } from '../shared/provider-config.js'
-
-(() => {
-type ContentRecord = Record<string, any>
-type ContentProvider = ProviderConfig
-
-type AnswerEntry = {
-  element: HTMLElement
-  text: string
-}
-
-const globalState = globalThis as typeof globalThis & {
-  __TOKENLESS_PROVIDER_CONTENT_LOADED__?: boolean
-}
-
-if (globalState.__TOKENLESS_PROVIDER_CONTENT_LOADED__) {
-  return
-}
-globalState.__TOKENLESS_PROVIDER_CONTENT_LOADED__ = true
-const PROVIDER_CONTENT_READY_TYPE = 'tokenless.provider_content_ready'
-const POST_SUBMIT_TARGET_TRANSITION_FLAG = 'allowPostSubmitTargetTransition'
-const POST_SUBMIT_TARGET_TRANSITION_PROOF = 'postSubmitTargetTransitionProof'
-const SAFE_STRUCTURAL_STATE_VALUES = new Set([
-  'assertive',
-  'both',
-  'false',
-  'grammar',
-  'horizontal',
-  'inherit',
-  'inline',
-  'mixed',
-  'none',
-  'off',
-  'page',
-  'plaintext-only',
-  'polite',
-  'spelling',
-  'step',
-  'true',
-  'vertical',
-])
-const SAFE_INPUT_TYPES = new Set([
-  'button',
-  'checkbox',
-  'email',
-  'number',
-  'password',
-  'radio',
-  'search',
-  'submit',
-  'tel',
-  'text',
-  'url',
-])
-const SAFE_EMPTY_ATTRIBUTE_NAMES = new Set(['disabled', 'hidden', 'open'])
-const MAX_VISIBLE_SOURCES = 24
-const ATTACHMENT_MESSAGE_TYPES = Object.freeze({
-  ABORT: 'tokenless.bridge.attachment_abort',
-  CHUNK: 'tokenless.bridge.attachment_chunk',
-  COMMIT: 'tokenless.bridge.attachment_commit',
-  COMMIT_BATCH: 'tokenless.bridge.attachment_commit_batch',
-  PREPARE: 'tokenless.bridge.attachment_prepare',
-})
-const MAX_ATTACHMENTS_PER_REQUEST = 100
-const MAX_ATTACHMENT_BYTES_PER_REQUEST = 512 * 1024 * 1024
-const MAX_ATTACHMENT_CHUNK_BYTES = 512 * 1024
-const MAX_ATTACHMENT_REQUEST_LEDGERS = 32
-const MAX_ACTIVE_ATTACHMENT_TRANSFERS = 16
-const ATTACHMENT_TRANSFER_TTL_MS = 10 * 60 * 1000
-const ATTACHMENT_EVIDENCE_TIMEOUT_MS = 5000
-const TRACKING_QUERY_PARAMETER = /^(?:utm_[a-z0-9_]+|fbclid|gclid|dclid|msclkid)$/i
-const SAFE_STATE_ATTRIBUTE_NAMES = new Set([
-  'aria-busy',
-  'aria-checked',
-  'aria-current',
-  'aria-disabled',
-  'aria-expanded',
-  'aria-haspopup',
-  'aria-hidden',
-  'aria-live',
-  'aria-modal',
-  'aria-multiline',
-  'aria-pressed',
-  'aria-readonly',
-  'aria-required',
-  'aria-selected',
-  'contenteditable',
-])
-
-type AttachmentTransfer = {
-  attachmentId: string
-  chunks: ArrayBuffer[]
-  digest: IncrementalSha256
-  mimeType: string
-  name: string
-  receivedBytes: number
-  requestId: string
-  sha256: string
-  size: number
-  updatedAt: number
-}
-
-type AttachmentLedgerEntry = {
-  committed: boolean
-  committedInput?: HTMLInputElement
-  size: number
-}
-
-type AttachmentRequestLedger = {
-  attachments: Map<string, AttachmentLedgerEntry>
-  declaredBytes: number
-  updatedAt: number
-}
-
-type PreparedSubmission = {
-  configuration: ContentRecord | undefined
-  updatedAt: number
-  url: string
-}
-
-const attachmentTransfers = new Map<string, AttachmentTransfer>()
-const attachmentRequestLedgers = new Map<string, AttachmentRequestLedger>()
-const preparedSubmissions = new Map<string, PreparedSubmission>()
-let attachmentSurfaceRequiresReload = false
-
-chrome.runtime.onMessage.addListener((message, _sender, sendResponse) => {
-  handleMessage(message).then(sendResponse)
-  return true
-})
-
-void wakeBackgroundBridge()
-
-const submissionBaselines = new Map()
-
-async function wakeBackgroundBridge() {
-  if (!getProviderForUrl(location.href)) return
-  try {
-    await chrome.runtime.sendMessage({
-      type: PROVIDER_CONTENT_READY_TYPE,
-      provider: getProviderForUrl(location.href)?.id,
-      url: publicPageUrl(location.href),
-    })
-  } catch {
-    // The background service worker may be restarting; the CLI can retry.
-  }
-}
-
-async function handleMessage(message: ContentRecord) {
-  const provider = getProviderForUrl(location.href)
-  if (!provider) {
-    return {
-      status: 'blocked',
-      stopReason: 'unsupported_origin',
-      message: 'Current page is not a supported provider origin.',
-    }
-  }
-  const contextBlocker = validateExecutionContext(provider, message?.request, message?.type)
-  if (contextBlocker) {
-    return contextBlocker
-  }
-
-  if (message?.type === 'tokenless.bridge.submit') {
-    pruneAttachmentState()
-    if (attachmentSurfaceRequiresReload) {
-      return attachmentBlocked(
-        provider,
-        'attachment_cleanup_required',
-        'A partially attached request was aborted. Reload the provider page before submitting another prompt.'
-      )
-    }
-    if (hasCommittedAttachmentForDifferentRequest(message.request?.requestId)) {
-      poisonAttachmentSurface()
-      return attachmentBlocked(
-        provider,
-        'attachment_cleanup_required',
-        'A visible attachment belongs to a different request. Reload the provider page before submitting.'
-      )
-    }
-    const incompleteAttachment = activeAttachmentForRequest(message.request?.requestId)
-    if (incompleteAttachment) {
-      return attachmentBlocked(provider, 'attachment_incomplete', 'An attachment is still being received and the prompt cannot be submitted.')
-    }
-    return submitPrompt(provider, message.request)
-  }
-  if (message?.type === 'tokenless.bridge.prepare_submit') {
-    return preparePromptSubmission(provider, message.request)
-  }
-  if (message?.type === 'tokenless.bridge.read') {
-    return readLatestAnswer(provider, message.request)
-  }
-  if (message?.type === 'tokenless.bridge.input_prompt') {
-    return inputVisiblePrompt(provider, message.request)
-  }
-  if (message?.type === 'tokenless.bridge.snapshot_dom') {
-    return snapshotDom(provider, message.request)
-  }
-  if (message?.type === 'tokenless.bridge.inspect_auth') {
-    return inspectVisibleAuthStatus(provider, message.request)
-  }
-  if (
-    message?.type === 'tokenless.bridge.inspect_controls' ||
-    message?.type === 'tokenless.bridge.inspect_chatgpt_controls'
-  ) {
-    return inspectProviderControls(provider, message.request)
-  }
-  if (
-    message?.type === 'tokenless.bridge.configure_controls' ||
-    message?.type === 'tokenless.bridge.configure_chatgpt'
-  ) {
-    return configureProviderControls(provider, message.request)
-  }
-  if (message?.type === ATTACHMENT_MESSAGE_TYPES.PREPARE) {
-    return prepareVisibleAttachment(provider, message)
-  }
-  if (message?.type === ATTACHMENT_MESSAGE_TYPES.CHUNK) {
-    return receiveVisibleAttachmentChunk(provider, message)
-  }
-  if (message?.type === ATTACHMENT_MESSAGE_TYPES.COMMIT) {
-    return commitVisibleAttachment(provider, message)
-  }
-  if (message?.type === ATTACHMENT_MESSAGE_TYPES.COMMIT_BATCH) {
-    return commitVisibleAttachmentBatch(provider, message)
-  }
-  if (message?.type === ATTACHMENT_MESSAGE_TYPES.ABORT) {
-    return abortVisibleAttachment(provider, message)
-  }
-  if (message?.type === 'tokenless.bridge.validate_landing') {
-    return validateLanding(provider, message.request, message.type)
-  }
-
-  return {
-    status: 'blocked',
-    stopReason: 'unsupported_message',
-    message: 'Content bridge message is not supported.',
-  }
-}
-
-async function prepareVisibleAttachment(provider: ContentProvider, message: ContentRecord) {
-  pruneAttachmentState()
-  if (attachmentSurfaceRequiresReload) {
-    return attachmentBlocked(
-      provider,
-      'attachment_cleanup_required',
-      'Reload the provider page before attaching files after a partial attachment failure.'
-    )
-  }
-  const identity = validateAttachmentIdentity(message)
-  if (!identity) {
-    return attachmentBlocked(provider, 'invalid_attachment_message', 'Attachment request identifiers are invalid or do not match.')
-  }
-  if (hasCommittedAttachmentForDifferentRequest(identity.requestId)) {
-    poisonAttachmentSurface()
-    return attachmentBlocked(
-      provider,
-      'attachment_cleanup_required',
-      'A visible attachment belongs to a different request. Reload the provider page before attaching another file.'
-    )
-  }
-  const metadata = validateAttachmentMetadata(message)
-  if (!metadata) {
-    return attachmentBlocked(provider, 'invalid_attachment_metadata', 'Attachment name, MIME type, size, or SHA-256 metadata is invalid.')
-  }
-  const surface = await resolveProviderAttachmentSurface(provider, metadata.name, metadata.mimeType)
-  if (surface.status === 'blocked') return surface
-
-  const transferKey = attachmentTransferKey(identity.requestId, identity.attachmentId)
-  if (attachmentTransfers.has(transferKey)) {
-    return attachmentBlocked(provider, 'attachment_already_prepared', 'Attachment transfer is already prepared for this request.')
-  }
-  let ledger = attachmentRequestLedgers.get(identity.requestId)
-  if (!ledger) {
-    if (attachmentRequestLedgers.size >= MAX_ATTACHMENT_REQUEST_LEDGERS) {
-      return attachmentBlocked(provider, 'attachment_capacity_exceeded', 'Too many attachment requests are active on this page.')
-    }
-    ledger = { attachments: new Map(), declaredBytes: 0, updatedAt: Date.now() }
-    attachmentRequestLedgers.set(identity.requestId, ledger)
-  }
-  if (ledger.attachments.has(identity.attachmentId)) {
-    return attachmentBlocked(provider, 'attachment_replay_blocked', 'Attachment identifier was already used for this request.')
-  }
-  if (
-    ledger.attachments.size >= MAX_ATTACHMENTS_PER_REQUEST ||
-    ledger.declaredBytes + metadata.size > MAX_ATTACHMENT_BYTES_PER_REQUEST
-  ) {
-    return attachmentBlocked(provider, 'attachment_request_limit_exceeded', 'Attachment count or declared bytes exceed the per-request limit.')
-  }
-  if (attachmentTransfers.size >= MAX_ACTIVE_ATTACHMENT_TRANSFERS) {
-    return attachmentBlocked(provider, 'attachment_capacity_exceeded', 'Too many attachment transfers are active on this page.')
-  }
-
-  const now = Date.now()
-  ledger.attachments.set(identity.attachmentId, { committed: false, size: metadata.size })
-  ledger.declaredBytes += metadata.size
-  ledger.updatedAt = now
-  attachmentTransfers.set(transferKey, {
-    ...identity,
-    ...metadata,
-    chunks: [],
-    digest: new IncrementalSha256(),
-    receivedBytes: 0,
-    updatedAt: now,
-  })
-  return {
-    status: 'prepared',
-    provider: provider.id,
-    requestId: identity.requestId,
-    attachmentId: identity.attachmentId,
-    expectedBytes: metadata.size,
-  }
-}
-
-function receiveVisibleAttachmentChunk(provider: ContentProvider, message: ContentRecord) {
-  pruneAttachmentState()
-  const identity = validateAttachmentIdentity(message)
-  if (!identity) {
-    return attachmentBlocked(provider, 'invalid_attachment_message', 'Attachment request identifiers are invalid or do not match.')
-  }
-  const transfer = attachmentTransfers.get(attachmentTransferKey(identity.requestId, identity.attachmentId))
-  if (!transfer) {
-    return attachmentBlocked(provider, 'attachment_not_prepared', 'Attachment transfer was not prepared or has expired.')
-  }
-  if (!Number.isSafeInteger(message.offset) || message.offset < 0 || message.offset !== transfer.receivedBytes) {
-    return attachmentBlocked(provider, 'attachment_offset_mismatch', 'Attachment chunk offset is not the next expected byte.')
-  }
-  const chunk = decodeAttachmentChunk(message.dataBase64)
-  if (!chunk) {
-    return attachmentBlocked(provider, 'invalid_attachment_chunk', 'Attachment chunk is not valid bounded base64 data.')
-  }
-  if (transfer.receivedBytes + chunk.byteLength > transfer.size) {
-    return attachmentBlocked(provider, 'attachment_size_mismatch', 'Attachment chunk exceeds the declared attachment size.')
-  }
-  if (activeAttachmentBufferBytes() + chunk.byteLength > MAX_ATTACHMENT_BYTES_PER_REQUEST) {
-    return attachmentBlocked(provider, 'attachment_capacity_exceeded', 'Buffered attachment bytes exceed the page limit.')
-  }
-
-  transfer.chunks.push(chunk)
-  transfer.digest.update(new Uint8Array(chunk))
-  transfer.receivedBytes += chunk.byteLength
-  transfer.updatedAt = Date.now()
-  const ledger = attachmentRequestLedgers.get(identity.requestId)
-  if (ledger) ledger.updatedAt = transfer.updatedAt
-  return {
-    status: 'chunk_received',
-    provider: provider.id,
-    requestId: identity.requestId,
-    attachmentId: identity.attachmentId,
-    receivedBytes: transfer.receivedBytes,
-    expectedBytes: transfer.size,
-  }
-}
-
-async function commitVisibleAttachment(provider: ContentProvider, message: ContentRecord) {
-  const identity = validateAttachmentIdentity(message)
-  if (!identity) {
-    return attachmentBlocked(provider, 'invalid_attachment_message', 'Attachment request identifiers are invalid or do not match.')
-  }
-  return commitVisibleAttachmentIds(provider, identity.requestId, [identity.attachmentId])
-}
-
-async function commitVisibleAttachmentBatch(provider: ContentProvider, message: ContentRecord) {
-  const requestId = boundedAttachmentIdentifier(message.requestId)
-  if (
-    !requestId ||
-    message.request?.requestId !== requestId ||
-    !Array.isArray(message.attachmentIds) ||
-    message.attachmentIds.length < 1 ||
-    message.attachmentIds.length > MAX_ATTACHMENTS_PER_REQUEST
-  ) {
-    return attachmentBlocked(provider, 'invalid_attachment_message', 'Attachment batch identifiers are invalid or do not match.')
-  }
-  const attachmentIds = message.attachmentIds.map(boundedAttachmentIdentifier)
-  if (attachmentIds.some((value: string | null) => !value)) {
-    return attachmentBlocked(provider, 'invalid_attachment_message', 'Attachment batch contains an invalid identifier.')
-  }
-  const uniqueIds = new Set(attachmentIds as string[])
-  if (uniqueIds.size !== attachmentIds.length) {
-    return attachmentBlocked(provider, 'invalid_attachment_message', 'Attachment batch identifiers must be unique.')
-  }
-  return commitVisibleAttachmentIds(provider, requestId, attachmentIds as string[])
-}
-
-async function commitVisibleAttachmentIds(
-  provider: ContentProvider,
-  requestId: string,
-  attachmentIds: string[]
-) {
-  pruneAttachmentState()
-  const requestLedger = attachmentRequestLedgers.get(requestId)
-  if (
-    !requestLedger ||
-    requestLedger.attachments.size !== attachmentIds.length ||
-    attachmentIds.some((attachmentId) => !requestLedger.attachments.has(attachmentId))
-  ) {
-    releaseAttachmentTransfers([...attachmentTransfers.values()].filter((transfer) => transfer.requestId === requestId))
-    return attachmentBlocked(
-      provider,
-      'attachment_batch_mismatch',
-      'Every attachment prepared for this request must be committed together.'
-    )
-  }
-  const transfers: AttachmentTransfer[] = []
-  for (const attachmentId of attachmentIds) {
-    const transfer = attachmentTransfers.get(attachmentTransferKey(requestId, attachmentId))
-    if (!transfer) {
-      releaseAttachmentTransfers(transfers)
-      return attachmentBlocked(provider, 'attachment_not_prepared', 'Attachment transfer was not prepared or has expired.')
-    }
-    transfers.push(transfer)
-    if (transfer.receivedBytes !== transfer.size) {
-      releaseAttachmentTransfers(transfers)
-      return attachmentBlocked(provider, 'attachment_incomplete', 'Attachment bytes are incomplete and cannot be committed.')
-    }
-  }
-
-  let batchInput: HTMLInputElement | undefined
-  let batchRoot: HTMLElement | undefined
-  const files: File[] = []
-  const evidenceBaselines: Array<{ name: string; baseline: Set<HTMLElement> }> = []
-  try {
-    for (const transfer of transfers) {
-      const surface = await resolveProviderAttachmentSurface(provider, transfer.name, transfer.mimeType)
-      if (surface.status === 'blocked') {
-        releaseAttachmentTransfers(transfers)
-        return surface
-      }
-      if (!batchInput) {
-        batchInput = surface.input
-        batchRoot = surface.root
-        if (surface.input.files && surface.input.files.length > 0) {
-          releaseAttachmentTransfers(transfers)
-          return attachmentBlocked(
-            provider,
-            'attachment_surface_not_clean',
-            'The provider file input already contains a file that does not belong to this request.'
-          )
-        }
-      } else if (surface.input !== batchInput || surface.root !== batchRoot) {
-        releaseAttachmentTransfers(transfers)
-        return attachmentBlocked(provider, 'attachment_surface_changed', 'The provider attachment surface changed during the request.')
-      }
-      const file = new File(transfer.chunks, transfer.name, { type: transfer.mimeType, lastModified: 0 })
-      const actualSha256 = transfer.digest.hexDigest()
-      if (actualSha256 !== transfer.sha256) {
-        releaseAttachmentTransfers(transfers)
-        return attachmentBlocked(provider, 'attachment_hash_mismatch', 'Attachment bytes do not match the declared SHA-256 digest.')
-      }
-      files.push(file)
-      evidenceBaselines.push({
-        name: transfer.name,
-        baseline: new Set(visibleFilenameEvidence(surface.root, transfer.name)),
-      })
-    }
-    if (!batchInput || !batchRoot) throw new Error('attachment surface unavailable')
-    const dataTransfer = new DataTransfer()
-    for (const file of files) dataTransfer.items.add(file)
-    batchInput.files = dataTransfer.files
-    batchInput.dispatchEvent(new Event('input', { bubbles: true, composed: true }))
-    batchInput.dispatchEvent(new Event('change', { bubbles: true, composed: true }))
-  } catch {
-    releaseAttachmentTransfers(transfers)
-    poisonAttachmentSurface()
-    return attachmentBlocked(provider, 'attachment_injection_failed', 'The exact visible provider file input rejected the attachment.')
-  }
-
-  const committedInput = batchInput
-  const committedRoot = batchRoot
-  if (!committedInput || !committedRoot) {
-    releaseAttachmentTransfers(transfers)
-    poisonAttachmentSurface()
-    return attachmentBlocked(provider, 'attachment_injection_failed', 'The provider attachment surface disappeared during injection.')
-  }
-  const evidence = await waitForNewFilenameEvidenceBatch(committedRoot, evidenceBaselines)
-  if (!evidence) {
-    clearAttachmentInput(committedInput)
-    poisonAttachmentSurface()
-    return attachmentBlocked(provider, 'attachment_unconfirmed', 'The provider did not show every attachment filename near the composer.')
-  }
-
-  const ledger = attachmentRequestLedgers.get(requestId)
-  for (const transfer of transfers) {
-    attachmentTransfers.delete(attachmentTransferKey(requestId, transfer.attachmentId))
-    const ledgerEntry = ledger?.attachments.get(transfer.attachmentId)
-    if (ledgerEntry) {
-      ledgerEntry.committed = true
-      ledgerEntry.committedInput = committedInput
-    }
-  }
-  if (ledger) ledger.updatedAt = Date.now()
-  const attached = transfers.map((transfer) => ({
-    attachmentId: transfer.attachmentId,
-    name: transfer.name,
-    size: transfer.size,
-    mimeType: transfer.mimeType,
-    sha256: transfer.sha256,
-    visible: true,
-  }))
-  return attachmentIds.length === 1 ? {
-    status: 'attached',
-    provider: provider.id,
-    requestId,
-    ...attached[0],
-  } : { status: 'attached', provider: provider.id, requestId, attachments: attached }
-}
-
-function abortVisibleAttachment(provider: ContentProvider, message: ContentRecord) {
-  pruneAttachmentState()
-  const identity = validateAttachmentIdentity(message)
-  if (!identity) {
-    return attachmentBlocked(provider, 'invalid_attachment_message', 'Attachment request identifiers are invalid or do not match.')
-  }
-  const transfer = attachmentTransfers.get(attachmentTransferKey(identity.requestId, identity.attachmentId))
-  const ledger = attachmentRequestLedgers.get(identity.requestId)
-  const ledgerEntry = ledger?.attachments.get(identity.attachmentId)
-  if (transfer) releaseAttachmentTransfer(transfer, true)
-  if (ledgerEntry?.committed) poisonAttachmentSurface()
-  return {
-    status: 'aborted',
-    provider: provider.id,
-    requestId: identity.requestId,
-    attachmentId: identity.attachmentId,
-    released: Boolean(transfer || ledgerEntry),
-    requiresReload: Boolean(ledgerEntry?.committed),
-  }
-}
-
-function validateAttachmentIdentity(message: ContentRecord) {
-  const requestId = boundedAttachmentIdentifier(message.requestId)
-  const attachmentId = boundedAttachmentIdentifier(message.attachmentId)
-  if (!requestId || !attachmentId || message.request?.requestId !== requestId) return null
-  return { requestId, attachmentId }
-}
-
-function validateAttachmentMetadata(message: ContentRecord) {
-  const name = typeof message.name === 'string' ? message.name : ''
-  const mimeType = typeof message.mimeType === 'string' ? message.mimeType.toLowerCase() : ''
-  const sha256 = typeof message.sha256 === 'string' ? message.sha256.toLowerCase() : ''
-  const size = message.size
-  if (
-    name.length < 1 ||
-    name.length > 255 ||
-    name.trim() !== name ||
-    /[\\/\u0000-\u001f\u007f]/.test(name) ||
-    name === '.' ||
-    name === '..' ||
-    !/^[a-z0-9!#$&^_.+\-]+\/[a-z0-9!#$&^_.+\-]+$/i.test(mimeType) ||
-    !Number.isSafeInteger(size) ||
-    size < 0 ||
-    size > MAX_ATTACHMENT_BYTES_PER_REQUEST ||
-    !/^[a-f0-9]{64}$/.test(sha256)
-  ) {
-    return null
-  }
-  return { mimeType, name, sha256, size }
-}
-
-function boundedAttachmentIdentifier(value: unknown) {
-  if (typeof value !== 'string' || value.length < 1 || value.length > 256 || value.trim() !== value) return null
-  return /[\u0000-\u001f\u007f]/.test(value) ? null : value
-}
-
-function decodeAttachmentChunk(value: unknown) {
-  if (
-    typeof value !== 'string' ||
-    value.length < 4 ||
-    value.length > Math.ceil(MAX_ATTACHMENT_CHUNK_BYTES / 3) * 4 ||
-    value.length % 4 !== 0 ||
-    !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)
-  ) {
-    return null
-  }
-  try {
-    const binary = atob(value)
-    if (binary.length < 1 || binary.length > MAX_ATTACHMENT_CHUNK_BYTES) return null
-    const bytes = new Uint8Array(binary.length)
-    for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index)
-    return bytes.buffer
-  } catch {
-    return null
-  }
-}
-
-function attachmentTransferKey(requestId: string, attachmentId: string) {
-  return `${requestId}\u0000${attachmentId}`
-}
-
-function activeAttachmentBufferBytes() {
-  let total = 0
-  for (const transfer of attachmentTransfers.values()) total += transfer.receivedBytes
-  return total
-}
-
-function activeAttachmentForRequest(requestId: unknown) {
-  if (typeof requestId !== 'string') return null
-  return [...attachmentTransfers.values()].find((transfer) => transfer.requestId === requestId) ?? null
-}
-
-function releaseAttachmentRequestLedger(requestId: unknown) {
-  if (typeof requestId === 'string') attachmentRequestLedgers.delete(requestId)
-}
-
-function pruneAttachmentState(now = Date.now()) {
-  for (const transfer of attachmentTransfers.values()) {
-    if (now - transfer.updatedAt > ATTACHMENT_TRANSFER_TTL_MS) releaseAttachmentTransfer(transfer, true)
-  }
-  for (const [requestId, ledger] of attachmentRequestLedgers) {
-    if (now - ledger.updatedAt <= ATTACHMENT_TRANSFER_TTL_MS) continue
-    if ([...ledger.attachments.values()].some((entry) => entry.committed)) {
-      poisonAttachmentSurface()
-      return
-    }
-    attachmentRequestLedgers.delete(requestId)
-  }
-}
-
-function prunePreparedSubmissions(now = Date.now()) {
-  for (const [key, prepared] of preparedSubmissions) {
-    if (now - prepared.updatedAt > ATTACHMENT_TRANSFER_TTL_MS) preparedSubmissions.delete(key)
-  }
-}
-
-function hasCommittedAttachmentForDifferentRequest(requestId: unknown) {
-  if (typeof requestId !== 'string') return false
-  for (const [ledgerRequestId, ledger] of attachmentRequestLedgers) {
-    if (
-      ledgerRequestId !== requestId &&
-      [...ledger.attachments.values()].some((entry) => entry.committed)
-    ) {
-      return true
-    }
-  }
-  return false
-}
-
-function poisonAttachmentSurface() {
-  attachmentSurfaceRequiresReload = true
-  for (const ledger of attachmentRequestLedgers.values()) {
-    for (const entry of ledger.attachments.values()) {
-      if (entry.committedInput?.isConnected) clearAttachmentInput(entry.committedInput)
-    }
-  }
-  attachmentTransfers.clear()
-  attachmentRequestLedgers.clear()
-  preparedSubmissions.clear()
-}
-
-function releaseAttachmentTransfer(transfer: AttachmentTransfer, releaseLedgerEntry: boolean) {
-  attachmentTransfers.delete(attachmentTransferKey(transfer.requestId, transfer.attachmentId))
-  if (!releaseLedgerEntry) return
-  const ledger = attachmentRequestLedgers.get(transfer.requestId)
-  const entry = ledger?.attachments.get(transfer.attachmentId)
-  if (!ledger || !entry || entry.committed) return
-  ledger.attachments.delete(transfer.attachmentId)
-  ledger.declaredBytes -= entry.size
-  ledger.updatedAt = Date.now()
-  if (ledger.attachments.size === 0) attachmentRequestLedgers.delete(transfer.requestId)
-}
-
-function releaseAttachmentTransfers(transfers: AttachmentTransfer[]) {
-  for (const transfer of transfers) releaseAttachmentTransfer(transfer, true)
-}
-
-async function resolveProviderAttachmentSurface(provider: ContentProvider, name: string, mimeType: string): Promise<
-  | { input: HTMLInputElement; root: HTMLElement; status: 'ready' }
-  | ContentRecord> {
-  const selector = providerAttachmentInputSelector(provider)
-  if (!selector) {
-    return attachmentBlocked(provider, 'attachment_input_unavailable', `${provider.label} has no authenticated exact file input selector captured yet.`)
-  }
-  if (provider.id === 'gemini') await prepareGeminiAttachmentInput(selector)
-  const matches = [...document.querySelectorAll(selector)]
-    .filter((element): element is HTMLInputElement => element instanceof HTMLInputElement && element.isConnected)
-  const input = matches[0]
-  if (matches.length !== 1 || !input || input.disabled) {
-    return attachmentBlocked(provider, 'attachment_input_unavailable', 'Exactly one enabled provider file input was not found.')
-  }
-  if (!attachmentAcceptedByInput(input, name, mimeType)) {
-    return attachmentBlocked(provider, 'attachment_type_unavailable', 'The provider file input does not visibly accept this attachment type.')
-  }
-  const composer = findFirstVisible(provider.composerSelectors)
-  const root = composer
-    ? nearestAttachmentSurfaceRoot(input, composer) ?? (
-      provider.id === 'gemini' ? nearestGeminiAttachmentSurfaceRoot(composer) : null
-    )
-    : null
-  if (!composer || !root) {
-    return attachmentBlocked(provider, 'attachment_surface_unavailable', 'The exact provider file input was not found near a visible composer.')
-  }
-  return { input, root, status: 'ready' }
-}
-
-function providerAttachmentInputSelector(provider: ContentProvider) {
-  if (provider.id === 'chatgpt') return 'input#upload-files[type="file"][multiple]'
-  if (provider.id === 'claude') {
-    return 'input#chat-input-file-upload-onpage[data-testid="file-upload"][aria-label="Upload files"][type="file"][multiple]'
-  }
-  if (provider.id === 'gemini') return 'input[type="file"][name="Filedata"][multiple]'
-  if (provider.id === 'grok') return 'input[type="file"][name="files"][multiple]'
-  return null
-}
-
-async function prepareGeminiAttachmentInput(selector: string) {
-  if (document.querySelector(selector)) return
-  const trigger = findFirstVisible([
-    'button[aria-label="Upload and tools"]',
-  ])
-  if (!trigger || !isEnabledVisible(trigger)) return
-  trigger.click()
-  for (let attempt = 0; attempt < 20; attempt += 1) {
-    if (document.querySelector(selector)) return
-    const localUpload = findFirstVisible([
-      'button[role="menuitem"][data-test-id="local-images-files-uploader-button"][aria-label^="Upload files"]',
-    ])
-    if (localUpload && isEnabledVisible(localUpload)) {
-      localUpload.click()
-      break
-    }
-    await delay(100)
-  }
-  for (let attempt = 0; attempt < 20 && !document.querySelector(selector); attempt += 1) {
-    await delay(100)
-  }
-}
-
-function nearestGeminiAttachmentSurfaceRoot(composer: HTMLElement) {
-  const trigger = findFirstVisible(['button[aria-label="Upload and tools"]'])
-  if (!trigger) return null
-  const triggerAncestors = new Set<Element>()
-  let triggerAncestor: Element | null = trigger
-  for (let distance = 0; triggerAncestor && distance <= 8; distance += 1) {
-    triggerAncestors.add(triggerAncestor)
-    triggerAncestor = triggerAncestor.parentElement
-  }
-  let composerAncestor: Element | null = composer
-  for (let distance = 0; composerAncestor && distance <= 8; distance += 1) {
-    if (
-      triggerAncestors.has(composerAncestor) &&
-      composerAncestor !== document.body &&
-      composerAncestor !== document.documentElement &&
-      composerAncestor instanceof HTMLElement &&
-      isVisible(composerAncestor)
-    ) {
-      return composerAncestor
-    }
-    composerAncestor = composerAncestor.parentElement
-  }
-  return null
-}
-
-function attachmentAcceptedByInput(input: HTMLInputElement, name: string, mimeType: string) {
-  const accept = input.getAttribute('accept')?.trim()
-  if (!accept) return true
-  const lowerName = name.toLowerCase()
-  const lowerType = mimeType.toLowerCase()
-  return accept.split(',').some((rawToken) => {
-    const token = rawToken.trim().toLowerCase()
-    if (!token) return false
-    if (token.startsWith('.')) return lowerName.endsWith(token)
-    if (token.endsWith('/*')) return lowerType.startsWith(token.slice(0, -1))
-    return token === lowerType
-  })
-}
-
-function nearestAttachmentSurfaceRoot(input: HTMLInputElement, composer: HTMLElement) {
-  const composerAncestors = new Map<Element, number>()
-  let composerAncestor: Element | null = composer
-  for (let distance = 0; composerAncestor && distance <= 8; distance += 1) {
-    composerAncestors.set(composerAncestor, distance)
-    composerAncestor = composerAncestor.parentElement
-  }
-  let inputAncestor: Element | null = input
-  for (let distance = 0; inputAncestor && distance <= 8; distance += 1) {
-    const composerDistance = composerAncestors.get(inputAncestor)
-    if (
-      composerDistance !== undefined &&
-      inputAncestor !== document.body &&
-      inputAncestor !== document.documentElement &&
-      inputAncestor instanceof HTMLElement &&
-      isVisible(inputAncestor)
-    ) {
-      return inputAncestor
-    }
-    inputAncestor = inputAncestor.parentElement
-  }
-  return null
-}
-
-const SHA256_ROUND_CONSTANTS = new Uint32Array([
-  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
-  0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
-  0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
-  0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
-  0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
-  0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
-  0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
-  0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
-])
-
-class IncrementalSha256 {
-  private readonly state = new Uint32Array([
-    0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
-    0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
-  ])
-  private readonly block = new Uint8Array(64)
-  private blockLength = 0
-  private byteLength = 0
-
-  update(data: Uint8Array) {
-    this.byteLength += data.byteLength
-    let offset = 0
-    if (this.blockLength > 0) {
-      const copied = Math.min(64 - this.blockLength, data.byteLength)
-      this.block.set(data.subarray(0, copied), this.blockLength)
-      this.blockLength += copied
-      offset = copied
-      if (this.blockLength === 64) {
-        this.transform(this.block)
-        this.blockLength = 0
-      }
-    }
-    while (offset + 64 <= data.byteLength) {
-      this.transform(data.subarray(offset, offset + 64))
-      offset += 64
-    }
-    if (offset < data.byteLength) {
-      const remaining = data.subarray(offset)
-      this.block.set(remaining, 0)
-      this.blockLength = remaining.byteLength
-    }
-  }
-
-  hexDigest() {
-    const digest = this.copy()
-    digest.finish()
-    return [...digest.state].map((word) => word.toString(16).padStart(8, '0')).join('')
-  }
-
-  private copy() {
-    const copy = new IncrementalSha256()
-    copy.state.set(this.state)
-    copy.block.set(this.block)
-    copy.blockLength = this.blockLength
-    copy.byteLength = this.byteLength
-    return copy
-  }
-
-  private finish() {
-    const bitLength = this.byteLength * 8
-    this.block[this.blockLength] = 0x80
-    this.blockLength += 1
-    if (this.blockLength > 56) {
-      this.block.fill(0, this.blockLength)
-      this.transform(this.block)
-      this.blockLength = 0
-    }
-    this.block.fill(0, this.blockLength, 56)
-    const high = Math.floor(bitLength / 0x100000000)
-    const low = bitLength >>> 0
-    this.block[56] = high >>> 24
-    this.block[57] = high >>> 16
-    this.block[58] = high >>> 8
-    this.block[59] = high
-    this.block[60] = low >>> 24
-    this.block[61] = low >>> 16
-    this.block[62] = low >>> 8
-    this.block[63] = low
-    this.transform(this.block)
-    this.blockLength = 0
-  }
-
-  private transform(block: Uint8Array) {
-    const schedule = new Uint32Array(64)
-    for (let index = 0; index < 16; index += 1) {
-      const offset = index * 4
-      schedule[index] = (
-        (block[offset]! << 24) |
-        (block[offset + 1]! << 16) |
-        (block[offset + 2]! << 8) |
-        block[offset + 3]!
-      ) >>> 0
-    }
-    for (let index = 16; index < 64; index += 1) {
-      const prior15 = schedule[index - 15]!
-      const prior2 = schedule[index - 2]!
-      const small0 = rotateRight(prior15, 7) ^ rotateRight(prior15, 18) ^ (prior15 >>> 3)
-      const small1 = rotateRight(prior2, 17) ^ rotateRight(prior2, 19) ^ (prior2 >>> 10)
-      schedule[index] = (schedule[index - 16]! + small0 + schedule[index - 7]! + small1) >>> 0
-    }
-
-    let a = this.state[0]!
-    let b = this.state[1]!
-    let c = this.state[2]!
-    let d = this.state[3]!
-    let e = this.state[4]!
-    let f = this.state[5]!
-    let g = this.state[6]!
-    let h = this.state[7]!
-    for (let index = 0; index < 64; index += 1) {
-      const big1 = rotateRight(e, 6) ^ rotateRight(e, 11) ^ rotateRight(e, 25)
-      const choose = (e & f) ^ (~e & g)
-      const temporary1 = (h + big1 + choose + SHA256_ROUND_CONSTANTS[index]! + schedule[index]!) >>> 0
-      const big0 = rotateRight(a, 2) ^ rotateRight(a, 13) ^ rotateRight(a, 22)
-      const majority = (a & b) ^ (a & c) ^ (b & c)
-      const temporary2 = (big0 + majority) >>> 0
-      h = g
-      g = f
-      f = e
-      e = (d + temporary1) >>> 0
-      d = c
-      c = b
-      b = a
-      a = (temporary1 + temporary2) >>> 0
-    }
-    this.state[0] = (this.state[0]! + a) >>> 0
-    this.state[1] = (this.state[1]! + b) >>> 0
-    this.state[2] = (this.state[2]! + c) >>> 0
-    this.state[3] = (this.state[3]! + d) >>> 0
-    this.state[4] = (this.state[4]! + e) >>> 0
-    this.state[5] = (this.state[5]! + f) >>> 0
-    this.state[6] = (this.state[6]! + g) >>> 0
-    this.state[7] = (this.state[7]! + h) >>> 0
-  }
-}
-
-function rotateRight(value: number, bits: number) {
-  return (value >>> bits) | (value << (32 - bits))
-}
-
-function visibleFilenameEvidence(root: HTMLElement, name: string) {
-  const candidates = [root, ...root.querySelectorAll('*')]
-    .filter((element): element is HTMLElement => element instanceof HTMLElement && isVisible(element))
-    .filter((element) => elementShowsFilename(element, name))
-  return candidates.filter((candidate) => (
-    !candidates.some((other) => other !== candidate && candidate.contains(other))
-  ))
-}
-
-function elementShowsFilename(element: HTMLElement, name: string) {
-  const expected = normalizedFilenameEvidence(name)
-  const values = [element.getAttribute('aria-label'), element.getAttribute('title')]
-  if (typeof element.innerText === 'string') values.push(...element.innerText.split(/[\r\n]+/))
-  return values.some((value) => typeof value === 'string' && normalizedFilenameEvidence(value) === expected)
-}
-
-function normalizedFilenameEvidence(value: string) {
-  return normalizeText(value).normalize('NFKC').toLocaleLowerCase()
-}
-
-async function waitForNewFilenameEvidenceBatch(
-  root: HTMLElement,
-  evidenceBaselines: Array<{ name: string; baseline: Set<HTMLElement> }>
-) {
-  const deadline = Date.now() + ATTACHMENT_EVIDENCE_TIMEOUT_MS
-  while (Date.now() < deadline) {
-    const everyFilenameVisible = evidenceBaselines.every(({ name, baseline }) => (
-      visibleFilenameEvidence(root, name).some((element) => !baseline.has(element))
-    ))
-    if (everyFilenameVisible) return true
-    await delay(100)
-  }
-  return false
-}
-
-function clearAttachmentInput(input: HTMLInputElement) {
-  try {
-    input.files = new DataTransfer().files
-    input.dispatchEvent(new Event('input', { bubbles: true, composed: true }))
-    input.dispatchEvent(new Event('change', { bubbles: true, composed: true }))
-  } catch {
-    // A provider may replace or lock the input after accepting a file. Submission still remains blocked.
-  }
-}
-
-function attachmentBlocked(provider: ContentProvider, stopReason: string, message: string) {
-  return { status: 'blocked', stopReason, message, provider: provider.id }
-}
-
-async function validateLanding(
-  provider: ContentProvider,
-  request: ContentRecord = {},
-  messageType = 'tokenless.bridge.validate_landing'
-) {
-  const timeoutMs = Math.min(Number(request.landingTimeoutMs ?? 5000), 30000)
-  const deadline = Date.now() + timeoutMs
-  while (Date.now() < deadline) {
-    const contextBlocker = validateExecutionContext(provider, request, messageType)
-    if (contextBlocker) return contextBlocker
-    await dismissProviderInterruptions(provider)
-    const blocker = detectBlocker(provider)
-    if (blocker) {
-      return blocker
-    }
-    const chatSurface = chatSurfaceStatus(provider, {
-      requireComposer: allowsPostSubmitTargetTransition(provider, request, messageType),
-    })
-    if (chatSurface.ready) {
-      const finalContextBlocker = validateExecutionContext(provider, request, messageType)
-      if (finalContextBlocker) return finalContextBlocker
-      return {
-        status: 'ready',
-        provider: provider.id,
-        visible: true,
-        checks: chatSurface.checks,
-        url: publicPageUrl(location.href),
-        title: document.title,
-      }
-    }
-    await delay(250)
-  }
-  return {
-    status: 'blocked',
-    stopReason: 'provider_landing_unavailable',
-    message: provider.id === 'chatgpt'
-      ? 'ChatGPT page loaded, but no visible composer and send button were found.'
-      : 'Provider page loaded, but no visible chat surface was found.',
-    provider: provider.id,
-    url: publicPageUrl(location.href),
-  }
-}
-
-async function snapshotDom(provider: ContentProvider, request: ContentRecord = {}) {
-  await dismissProviderInterruptions(provider)
-  const contextBlocker = validateExecutionContext(provider, request)
-  if (contextBlocker) return contextBlocker
-  const includeTextValidation = resolveIncludeText(request)
-  if (includeTextValidation.ok === false) {
-    return {
-      status: 'blocked',
-      stopReason: 'invalid_include_text',
-      message: 'Snapshot includeText must be a boolean when provided.',
-      provider: provider.id,
-    }
-  }
-  const includeText = includeTextValidation.value ?? false
-  const maxTextChars = Math.min(Number(request.maxTextChars ?? request.metadata?.maxTextChars ?? 4000), 100000)
-  const sourceRoot = document.documentElement
-  const clone = document.documentElement.cloneNode(true) as Element
-
-  sanitizeTextNodes(sourceRoot, clone, { includeText })
-  redactAttributes(sourceRoot, clone, { includeText })
-  removeCommentNodes(clone)
-
-  clone.querySelectorAll([
-    'script',
-    'style',
-    'link',
-    'meta',
-    'noscript',
-    'template',
-    'iframe',
-    'object',
-    'embed',
-  ].join(',')).forEach((node) => node.remove())
-
-  return {
-    status: 'snapshotted',
-    provider: provider.id,
-    url: publicPageUrl(location.href),
-    title: '[text]',
-    capturedAt: new Date().toISOString(),
-    sanitized: true,
-    includeText,
-    html: `<!doctype html>\n${clone.outerHTML}`,
-    selectorProbes: selectorProbeSnapshot(provider, { includeText }),
-    visibleText: includeText
-      ? visibleTextSnapshot(document.body).slice(0, maxTextChars)
-      : undefined,
-  }
-}
-
-async function preparePromptSubmission(provider: ContentProvider, request: ContentRecord): Promise<ContentRecord> {
-  prunePreparedSubmissions()
-  await dismissProviderInterruptions(provider)
-  const blocker = detectBlocker(provider)
-  if (blocker) return blocker
-
-  const configuration: ContentRecord | undefined = provider.id === 'chatgpt' || hasRequestedModelControl(request)
-    ? await configureProviderControls(provider, request)
-    : undefined
-  if (configuration?.status === 'blocked') return configuration
-
-  const composer = await waitForComposer(provider, request)
-  if (!composer || !isVisibleConnected(composer)) return selectorDrift('composer')
-  const contextBlocker = validateExecutionContext(provider, request)
-  if (contextBlocker) return contextBlocker
-
-  preparedSubmissions.set(requestKey(request), {
-    configuration,
-    updatedAt: Date.now(),
-    url: canonicalProviderUrl(location.href),
-  })
-  while (preparedSubmissions.size > MAX_ATTACHMENT_REQUEST_LEDGERS) {
-    const oldest = preparedSubmissions.keys().next().value
-    if (typeof oldest !== 'string') break
-    preparedSubmissions.delete(oldest)
-  }
-  return {
-    status: 'prepared',
-    provider: provider.id,
-    configuration,
-    url: publicPageUrl(location.href),
-  }
-}
-
-async function submitPrompt(provider: ContentProvider, request: ContentRecord) {
-  await dismissProviderInterruptions(provider)
-  const blocker = detectBlocker(provider)
-  if (blocker) {
-    return blocker
-  }
-
-  const key = requestKey(request)
-  const prepared = preparedSubmissions.get(key)
-  preparedSubmissions.delete(key)
-  let configuration = prepared?.configuration
-  if (!prepared || prepared.url !== canonicalProviderUrl(location.href)) {
-    const preparation: ContentRecord = await preparePromptSubmission(provider, request)
-    if (preparation?.status === 'blocked') return preparation
-    configuration = preparation.configuration
-    preparedSubmissions.delete(key)
-  }
-
-  const composer = await waitForComposer(provider, request)
-  if (!composer || !isVisibleConnected(composer)) {
-    return selectorDrift('composer')
-  }
-
-  const composerContextBlocker = validateExecutionContext(provider, request)
-  if (composerContextBlocker) return composerContextBlocker
-
-  focusComposer(composer)
-  if (!isVisibleConnected(composer)) {
-    return selectorDrift('composer')
-  }
-  setComposerText(composer, request.prompt)
-  await delay(150)
-
-  const submitButton = await waitForActionableSubmit(provider, request)
-  const submitContextBlocker = validateExecutionContext(provider, request)
-  if (submitContextBlocker) return submitContextBlocker
-  const lateBlocker = detectBlocker(provider)
-  if (lateBlocker) return lateBlocker
-  if (!isActionableSubmit(submitButton)) {
-    return selectorDrift('submit')
-  }
-
-  const answerBaseline = answerSnapshot(provider)
-  const preSubmitUrl = publicPageUrl(location.href)
-  if (!isActionableSubmit(submitButton)) {
-    return selectorDrift('submit')
-  }
-  submissionBaselines.set(requestKey(request), answerBaseline)
-  submitButton.click()
-  const submission = await waitForVisibleSubmission(provider, request, answerBaseline, preSubmitUrl)
-  if (!submission) {
-    return {
-      status: 'blocked',
-      stopReason: 'submission_unconfirmed',
-      message: 'The provider send control did not produce a visible submission signal.',
-      provider: provider.id,
-    }
-  }
-  releaseAttachmentRequestLedger(request.requestId)
-  return {
-    status: 'submitted',
-    provider: provider.id,
-    visible: true,
-    configuration,
-    answerBaseline,
-    submission,
-    url: publicPageUrl(location.href),
-  }
-}
-
-async function inputVisiblePrompt(provider: ContentProvider, request: ContentRecord = {}) {
-  await dismissProviderInterruptions(provider)
-  const blocker = detectBlocker(provider)
-  if (blocker) return blocker
-  if (typeof request.prompt !== 'string' || request.prompt.trim().length === 0 || request.mode !== 'replace') {
-    return {
-      status: 'blocked',
-      stopReason: 'invalid_prompt_input',
-      message: 'Prompt input requires nonempty exact text and replace mode.',
-      provider: provider.id,
-    }
-  }
-  const composer = await waitForComposer(provider, request)
-  if (!composer || !isVisibleConnected(composer)) return selectorDrift('composer')
-  focusComposer(composer)
-  setComposerText(composer, request.prompt)
-  await delay(150)
-  const visibleText = normalizeText(
-    (composer as HTMLTextAreaElement).value ?? composer.innerText ?? composer.textContent ?? ''
-  )
-  if (visibleText !== normalizeText(request.prompt)) {
-    return {
-      status: 'blocked',
-      stopReason: 'prompt_input_unconfirmed',
-      message: 'The visible composer did not retain the exact requested prompt text.',
-      provider: provider.id,
-    }
-  }
-  return {
-    status: 'input',
-    provider: provider.id,
-    visible: true,
-    inputProof: boundedAttachmentIdentifier(request.requestId) ?? 'visible-prompt-input',
-  }
-}
-
-function inspectVisibleAuthStatus(provider: ContentProvider, request: ContentRecord = {}) {
-  const contextBlocker = validateExecutionContext(provider, request)
-  if (contextBlocker) return contextBlocker
-
-  const authenticatedSignal = visibleAuthenticatedSignal(provider)
-  const unauthenticatedSignal = visibleUnauthenticatedSignal(provider)
-  const state = authenticatedSignal && !unauthenticatedSignal
-    ? 'authenticated'
-    : unauthenticatedSignal && !authenticatedSignal
-      ? 'unauthenticated'
-      : 'unknown'
-  const plan = state === 'authenticated' && authenticatedSignal
-    ? visibleProviderPlan(provider, authenticatedSignal)
-    : null
-
-  return {
-    status: 'inspected',
-    provider: provider.id,
-    visible: true,
-    auth: {
-      state,
-      ...(plan ? { plan } : {}),
-    },
-    url: publicPageUrl(location.href),
-  }
-}
-
-function visibleAuthenticatedSignal(provider: ContentProvider) {
-  const selectors = provider.id === 'chatgpt'
-    ? ['[data-testid="accounts-profile-button"][role="button"]']
-    : provider.id === 'claude'
-      ? ['button[data-testid="user-menu-button"]']
-      : provider.id === 'gemini'
-        ? ['a[href*="accounts.google.com/SignOutOptions"]']
-        : provider.id === 'grok'
-          ? ['a[href="/skills-and-connectors"]']
-          : []
-  return findFirstVisible(selectors)
-}
-
-function visibleUnauthenticatedSignal(provider: ContentProvider) {
-  const selectors = provider.id === 'chatgpt'
-    ? [
-        'a[href^="/auth/login"]',
-        'a[href^="/auth/signup"]',
-        'button[data-testid="login-button"]',
-        'button[data-testid="signup-button"]',
-      ]
-    : provider.id === 'claude'
-      ? [
-          'button[data-testid="login-with-google"]',
-          'form input[placeholder="Enter your email"]',
-          'a[href^="/login"]',
-        ]
-      : provider.id === 'gemini'
-        ? [
-            'a[href*="accounts.google.com/ServiceLogin"][aria-label^="Sign in"]',
-            'a[href*="accounts.google.com/ServiceLogin"]',
-          ]
-        : provider.id === 'grok'
-          ? ['a[href^="/login"]', 'button[data-testid="login-button"]']
-          : []
-  return findFirstVisible(selectors) ?? (
-    provider.id === 'grok' ? findFirstVisibleControlByExactLabels(['Sign in', 'Sign up']) : null
-  )
-}
-
-function findFirstVisibleControlByExactLabels(labels: string[]) {
-  const expected = new Set(labels.map((label) => normalizeText(label).toLocaleLowerCase('en-US')))
-  return ([...document.querySelectorAll('a,button,[role="button"]')] as HTMLElement[])
-    .find((node) => (
-      isVisible(node) &&
-      expected.has(normalizeText(node.innerText || node.textContent || '').toLocaleLowerCase('en-US'))
-    )) ?? null
-}
-
-function visibleProviderPlan(provider: ContentProvider, authenticatedSignal: HTMLElement) {
-  // Only extract a plan when the provider has an observed, provider-specific
-  // visible plan signal. Gemini and Grok account controls can sit beside model
-  // rows named "Pro" or "Free"; treating those nearby labels as account plans
-  // would turn ordinary UI into false subscription evidence.
-  if (provider.id !== 'chatgpt' && provider.id !== 'claude') return null
-
-  const candidates = [
-    authenticatedSignal.getAttribute('aria-label') ?? '',
-    authenticatedSignal.getAttribute('title') ?? '',
-    authenticatedSignal.innerText || authenticatedSignal.textContent || '',
-  ]
-  const nearbyNodes = [
-    authenticatedSignal.previousElementSibling,
-    authenticatedSignal.nextElementSibling,
-    ...authenticatedSignal.querySelectorAll('span, p, div'),
-  ]
-  const parent = authenticatedSignal.parentElement
-  if (parent && parent !== document.body && parent !== document.documentElement) {
-    nearbyNodes.push(...parent.querySelectorAll('span, p, div, button'))
-  }
-  for (const node of nearbyNodes) {
-    if (!(node instanceof HTMLElement) || !isVisible(node)) continue
-    const label = visibleControlLabel(node)
-    if (label.length <= 32 && /^(?:Free|Plus|Pro|Team|Business|Enterprise|Edu)(?: plan)?$/i.test(label)) {
-      candidates.push(label)
-    }
-  }
-
-  const names = provider.id === 'claude'
-    ? ['Free', 'Pro', 'Team', 'Enterprise']
-    : ['Free', 'Plus', 'Pro', 'Team', 'Business', 'Enterprise', 'Edu']
-  const allowedNames = names.join('|')
-  const terminalPlan = new RegExp(`(?:^|[,;|()]\\s*)(${allowedNames})(?:\\s+plan)?\\s*$`, 'i')
-  const exactPlan = new RegExp(`^(${allowedNames})(?:\\s+plan)?$`, 'i')
-  for (const candidate of candidates) {
-    const match = normalizeText(candidate).match(terminalPlan) ?? normalizeText(candidate).match(exactPlan)
-    const name = names.find((allowed) => allowed.toLocaleLowerCase('en-US') === match?.[1]?.toLocaleLowerCase('en-US'))
-    if (name) return { label: name, free: name === 'Free' }
-  }
-  return null
-}
-
-const MAX_VISIBLE_RESPONSE_WAIT_MS = 2 * 60 * 60 * 1000
-
-function hasRequestedModelControl(request: ContentRecord = {}) {
-  return request.model !== undefined || request.modelFallbacks !== undefined || request.effort !== undefined
-}
-
-async function inspectProviderControls(provider: ContentProvider, request: ContentRecord = {}) {
-  if (provider.id === 'chatgpt') return inspectChatGptControls(provider, request)
-  if (provider.id === 'claude') return inspectClaudeControls(provider, request)
-  if (provider.id === 'gemini') return inspectGeminiControls(provider, request)
-  if (provider.id === 'grok') return inspectGrokControls(provider, request)
-  const contextBlocker = validateExecutionContext(provider, request)
-  if (contextBlocker) return contextBlocker
-  return {
-    status: 'inspected',
-    provider: provider.id,
-    visible: true,
-    controls: { available: false, efforts: [], models: [] },
-    url: publicPageUrl(location.href),
-  }
-}
-
-async function configureProviderControls(provider: ContentProvider, request: ContentRecord = {}) {
-  if (provider.id === 'chatgpt') return configureChatGptControls(provider, request)
-  if (provider.id === 'claude') return configureClaudeControls(provider, request)
-  if (provider.id === 'gemini') return configureGeminiControls(provider, request)
-  if (provider.id === 'grok') return configureGrokControls(provider, request)
-  const contextBlocker = validateExecutionContext(provider, request)
-  if (contextBlocker) return contextBlocker
-  return {
-    status: 'blocked',
-    stopReason: 'model_control_unavailable',
-    message: `${provider.label} model controls are unavailable on the current visible page.`,
-    provider: provider.id,
-    requested: typeof request.model === 'string' ? request.model : null,
-  }
-}
-
-type VisibleModelChoice = {
-  element: HTMLElement
-  label: string
-  selected: boolean
-  available: boolean
-}
-
-type VisibleEffortChoice = VisibleModelChoice
-
-type ClaudeEffortChoice = VisibleEffortChoice & {
-  kind: 'radio' | 'switch'
-}
-
-async function inspectClaudeControls(provider: ContentProvider, request: ContentRecord = {}) {
-  const contextBlocker = validateExecutionContext(provider, request)
-  if (contextBlocker) return contextBlocker
-  const opened = await openClaudeModelMenu()
-  if (!opened) return unavailableModelInspection(provider)
-  try {
-    const models = claudeModelChoices(opened.menu)
-    const efforts = await claudeEffortChoices(opened.menu)
-    return {
-      status: 'inspected',
-      provider: provider.id,
-      visible: true,
-      controls: {
-        available: models.length > 0 || efforts.length > 0,
-        models: models.map(({ label, selected, available }) => ({ label, selected, available })),
-        efforts: efforts.map(({ label, selected, available }) => ({
-          id: visibleChoiceId(label),
-          label,
-          selected,
-          available,
-        })),
-      },
-      url: publicPageUrl(location.href),
-    }
-  } finally {
-    dismissClaudeMenus()
-  }
-}
-
-async function configureClaudeControls(provider: ContentProvider, request: ContentRecord = {}) {
-  const contextBlocker = validateExecutionContext(provider, request)
-  if (contextBlocker) return contextBlocker
-  const model = request.model === undefined
-    ? { status: 'preserved' }
-    : await selectClaudeModel(request.model, request.modelFallbacks)
-  if (model.status === 'unavailable') {
-    return {
-      status: 'blocked',
-      stopReason: 'model_control_unavailable',
-      message: 'The requested model is not an enabled exact label in the visible Claude model menu.',
-      provider: provider.id,
-      model,
-    }
-  }
-  const effort = request.effort === undefined
-    ? { status: 'preserved' }
-    : await selectClaudeEffort(request.effort)
-  if (effort.status === 'unavailable') {
-    return {
-      status: 'blocked',
-      stopReason: 'effort_control_unavailable',
-      message: 'The requested thinking or effort option is not an enabled exact label for the visible Claude model.',
-      provider: provider.id,
-      model,
-      effort,
-    }
-  }
-  return {
-    status: 'configured',
-    provider: provider.id,
-    visible: true,
-    model,
-    effort,
-    url: publicPageUrl(location.href),
-  }
-}
-
-async function selectClaudeModel(requested: unknown, fallbacks: unknown) {
-  const requestedLabels = requestedModelLabels(requested, fallbacks)
-  for (let fallbackIndex = 0; fallbackIndex < requestedLabels.length; fallbackIndex += 1) {
-    const label = requestedLabels[fallbackIndex]
-    if (!label) continue
-    const opened = await openClaudeModelMenu()
-    if (!opened) break
-    const choice = claudeModelChoices(opened.menu)
-      .find((candidate) => candidate.available && modelLabelMatches(candidate.label, label))
-    if (!choice) {
-      dismissClaudeMenus()
-      continue
-    }
-    if (!choice.selected) choice.element.click()
-    const verified = await waitForClaudeModelSelection(choice.label)
-    dismissClaudeMenus()
-    if (!verified) continue
-    return selectedModelResult(requestedLabels, choice.label, fallbackIndex)
-  }
-  dismissClaudeMenus()
-  return unavailableModelResult(requestedLabels)
-}
-
-async function waitForClaudeModelSelection(label: string) {
-  for (let attempt = 0; attempt < 20; attempt += 1) {
-    const opened = await openClaudeModelMenu()
-    const selected = opened
-      ? claudeModelChoices(opened.menu).some((choice) => (
-          choice.selected && modelLabelMatches(choice.label, label)
-        ))
-      : false
-    if (selected) return true
-    dismissClaudeMenus()
-    await delay(100)
-  }
-  return false
-}
-
-async function selectClaudeEffort(requested: unknown) {
-  const wanted = typeof requested === 'string' ? normalizeText(requested) : ''
-  if (!wanted) return { status: 'unavailable', requested: null, applied: null }
-  const opened = await openClaudeModelMenu()
-  if (!opened) return { status: 'unavailable', requested: wanted, applied: null }
-  try {
-    const choices = await claudeEffortChoices(opened.menu)
-    const choice = choices.find((candidate) => (
-      candidate.available && modelLabelMatches(candidate.label, wanted)
-    ))
-    if (!choice) return { status: 'unavailable', requested: wanted, applied: null }
-    if (!choice.selected) choice.element.click()
-    const verified = await waitForClaudeEffortSelection(choice.label, choice.kind)
-    return verified
-      ? { status: 'selected', requested: wanted, applied: choice.label }
-      : { status: 'unavailable', requested: wanted, applied: null }
-  } finally {
-    dismissClaudeMenus()
-  }
-}
-
-async function waitForClaudeEffortSelection(label: string, kind: ClaudeEffortChoice['kind']) {
-  for (let attempt = 0; attempt < 20; attempt += 1) {
-    const opened = await openClaudeModelMenu()
-    const choices = opened ? await claudeEffortChoices(opened.menu) : []
-    if (choices.some((choice) => (
-      choice.kind === kind && choice.selected && modelLabelMatches(choice.label, label)
-    ))) return true
-    dismissClaudeMenus()
-    await delay(100)
-  }
-  return false
-}
-
-async function openClaudeModelMenu() {
-  const trigger = findFirstVisible([
-    'button[data-testid="model-selector-dropdown"][aria-label^="Model: "]',
-  ])
-  if (!trigger || !isEnabledVisible(trigger)) return null
-  if (trigger.getAttribute('aria-expanded') !== 'true') trigger.click()
-  for (let attempt = 0; attempt < 20; attempt += 1) {
-    const menu = ([...document.querySelectorAll('[role="menu"]')] as HTMLElement[])
-      .find((candidate) => isVisible(candidate) && isClaudeModelMenu(candidate))
-    if (menu) return { trigger, menu }
-    await delay(100)
-  }
-  return null
-}
-
-function isClaudeModelMenu(menu: HTMLElement) {
-  return claudeModelChoices(menu).some((choice) => /\d/u.test(choice.label))
-}
-
-function claudeModelChoices(menu: HTMLElement): VisibleModelChoice[] {
-  return ([...menu.querySelectorAll('[role="menuitemradio"]')] as HTMLElement[])
-    .filter((item) => isVisible(item))
-    .map((element) => ({
-      element,
-      label: primaryVisibleControlLabel(element),
-      selected: element.getAttribute('aria-checked') === 'true',
-      available: isEnabledVisible(element) && !hasExactVisibleDescendantLabel(element, 'Upgrade'),
-    }))
-    .filter((choice) => choice.label.length > 0 && /\d/u.test(choice.label))
-}
-
-async function claudeEffortChoices(modelMenu: HTMLElement): Promise<ClaudeEffortChoice[]> {
-  const choices = claudeSwitchChoices(modelMenu)
-  const trigger = findClaudeEffortSubmenuTrigger(modelMenu)
-  const effortMenu = trigger ? await openClaudeEffortMenu(trigger, modelMenu) : null
-  if (effortMenu) choices.unshift(...menuRadioItems(effortMenu).map((element) => ({
-    element,
-    label: primaryVisibleControlLabel(element),
-    selected: element.getAttribute('aria-checked') === 'true',
-    available: isEnabledVisible(element),
-    kind: 'radio' as const,
-  })))
-  return choices.filter((choice) => choice.label.length > 0)
-}
-
-function claudeSwitchChoices(menu: HTMLElement): ClaudeEffortChoice[] {
-  return ([...menu.querySelectorAll('[role="switch"]')] as HTMLElement[])
-    .filter((element) => isVisible(element))
-    .map((element) => {
-      const menuItem = element.closest('[role="menuitem"]')
-      return {
-        element,
-        label: normalizeText(
-          element.getAttribute('aria-label') ||
-          (menuItem instanceof HTMLElement ? primaryVisibleControlLabel(menuItem) : '')
-        ),
-        selected: element.getAttribute('aria-checked') === 'true',
-        available: isEnabledVisible(element),
-        kind: 'switch' as const,
-      }
-    })
-}
-
-function findClaudeEffortSubmenuTrigger(menu: HTMLElement) {
-  return ([...menu.querySelectorAll('[role="menuitem"][aria-haspopup="menu"]')] as HTMLElement[])
-    .find((item) => {
-      const primary = primaryVisibleControlLabel(item)
-      const accessible = normalizeText(item.getAttribute('aria-label') || visibleControlLabel(item))
-      return modelLabelMatches(primary, 'Effort') || /^Effort(?:\s|$)/iu.test(accessible)
-    })
-}
-
-async function openClaudeEffortMenu(trigger: HTMLElement, modelMenu: HTMLElement) {
-  const existing = visibleClaudeEffortMenu(modelMenu)
-  if (existing) return existing
-  trigger.click()
-  for (let attempt = 0; attempt < 20; attempt += 1) {
-    const menu = visibleClaudeEffortMenu(modelMenu)
-    if (menu) return menu
-    await delay(100)
-  }
-  return null
-}
-
-function visibleClaudeEffortMenu(modelMenu: HTMLElement) {
-  return ([...document.querySelectorAll('[role="menu"]')] as HTMLElement[])
-    .find((candidate) => (
-      candidate !== modelMenu &&
-      isVisible(candidate) &&
-      menuRadioItems(candidate).length > 0 &&
-      !isClaudeModelMenu(candidate)
-    )) ?? null
-}
-
-function dismissClaudeMenus() {
-  dismissProviderMenus()
-  dismissProviderMenus()
-}
-
-async function inspectGeminiControls(provider: ContentProvider, request: ContentRecord = {}) {
-  const contextBlocker = validateExecutionContext(provider, request)
-  if (contextBlocker) return contextBlocker
-  const opened = await openGeminiModelMenu()
-  if (!opened) return unavailableModelInspection(provider)
-  try {
-    const models = geminiModelChoices(opened.menu)
-    const efforts = geminiEffortChoices(opened.menu)
-    return inspectedModelControls(provider, models, efforts)
-  } finally {
-    dismissProviderMenus()
-  }
-}
-
-async function configureGeminiControls(provider: ContentProvider, request: ContentRecord = {}) {
-  const contextBlocker = validateExecutionContext(provider, request)
-  if (contextBlocker) return contextBlocker
-  if (request.model === undefined && request.effort === undefined) return configuredPreservingModel(provider)
-  const model = request.model === undefined
-    ? { status: 'preserved' }
-    : await selectGeminiModel(request.model, request.modelFallbacks)
-  if (model.status === 'unavailable') return configuredOrBlockedModel(provider, model)
-  const effort = request.effort === undefined
-    ? { status: 'preserved' }
-    : await selectGeminiEffort(request.effort)
-  if (effort.status === 'unavailable') {
-    return {
-      status: 'blocked',
-      stopReason: 'effort_control_unavailable',
-      message: 'The requested effort is not an available exact label in the visible Gemini mode menu.',
-      provider: provider.id,
-      model,
-      effort,
-    }
-  }
-  return {
-    status: 'configured',
-    provider: provider.id,
-    visible: true,
-    model,
-    effort,
-    url: publicPageUrl(location.href),
-  }
-}
-
-async function selectGeminiModel(requested: unknown, fallbacks: unknown) {
-  const requestedLabels = requestedModelLabels(requested, fallbacks)
-  for (let fallbackIndex = 0; fallbackIndex < requestedLabels.length; fallbackIndex += 1) {
-    const label = requestedLabels[fallbackIndex]
-    if (!label) continue
-    const opened = await openGeminiModelMenu()
-    if (!opened) break
-    const choice = geminiModelChoices(opened.menu)
-      .find((candidate) => candidate.available && modelLabelMatches(candidate.label, label))
-    if (!choice) {
-      dismissProviderMenus()
-      continue
-    }
-    if (!choice.selected) choice.element.click()
-    const verified = await waitForGeminiModelSelection(choice.label)
-    dismissProviderMenus()
-    if (!verified) continue
-    return selectedModelResult(requestedLabels, choice.label, fallbackIndex)
-  }
-  dismissProviderMenus()
-  return unavailableModelResult(requestedLabels)
-}
-
-async function waitForGeminiModelSelection(label: string) {
-  for (let attempt = 0; attempt < 20; attempt += 1) {
-    const opened = await openGeminiModelMenu()
-    const selected = opened
-      ? geminiModelChoices(opened.menu).some((choice) => choice.selected && modelLabelMatches(choice.label, label))
-      : false
-    if (selected) return true
-    dismissProviderMenus()
-    await delay(100)
-  }
-  return false
-}
-
-async function openGeminiModelMenu() {
-  const trigger = findFirstVisible([
-    'button[data-test-id="bard-mode-menu-button"][aria-haspopup]',
-  ])
-  if (!trigger || !isEnabledVisible(trigger)) return null
-  if (trigger.getAttribute('aria-expanded') !== 'true') trigger.click()
-  for (let attempt = 0; attempt < 20; attempt += 1) {
-    const menu = ([...document.querySelectorAll('[role="menu"]')] as HTMLElement[])
-      .find((candidate) => (
-        isVisible(candidate) &&
-        candidate.querySelector('gem-menu-item[role="menuitem"][data-mode-id]') !== null
-      ))
-    if (menu) return { trigger, menu }
-    await delay(100)
-  }
-  return null
-}
-
-function geminiModelChoices(menu: HTMLElement): VisibleModelChoice[] {
-  return ([...menu.querySelectorAll('gem-menu-item[role="menuitem"][data-mode-id]')] as HTMLElement[])
-    .filter((item) => isVisible(item))
-    .map((element) => ({
-      element,
-      label: normalizeText(element.querySelector('.label')?.textContent || primaryVisibleControlLabel(element)),
-      // data-active is only the keyboard-highlighted row. Gemini exposes the
-      // committed selection on its nested menu-item content instead.
-      selected: (
-        element.querySelector('gem-menu-item-content.selected, .selected') !== null ||
-        element.getAttribute('aria-checked') === 'true'
-      ),
-      available: isEnabledVisible(element),
-    }))
-    .filter((choice) => choice.label.length > 0)
-}
-
-function geminiEffortChoices(menu: HTMLElement): VisibleEffortChoice[] {
-  return ([...menu.querySelectorAll('gem-menu-item[role="menuitem"]:not([data-mode-id])')] as HTMLElement[])
-    .filter((item) => isVisible(item))
-    .map((element) => ({
-      element,
-      label: normalizeText(element.querySelector('.label')?.textContent || primaryVisibleControlLabel(element)),
-      selected: (
-        element.querySelector('gem-menu-item-content.selected, .selected') !== null ||
-        element.getAttribute('aria-checked') === 'true'
-      ),
-      available: isEnabledVisible(element),
-    }))
-    .filter((choice) => modelLabelMatches(choice.label, 'Extended thinking'))
-}
-
-async function selectGeminiEffort(requested: unknown) {
-  const label = typeof requested === 'string' ? normalizeText(requested) : ''
-  if (!label) return { status: 'unavailable', requested: null, applied: null }
-  const opened = await openGeminiModelMenu()
-  if (!opened) return { status: 'unavailable', requested: label, applied: null }
-  let appliedLabel: string | null = null
-  try {
-    const choice = geminiEffortChoices(opened.menu)
-      .find((candidate) => candidate.available && modelLabelMatches(candidate.label, label))
-    if (!choice) return { status: 'unavailable', requested: label, applied: null }
-    appliedLabel = choice.label
-    if (!choice.selected) choice.element.click()
-  } finally {
-    dismissProviderMenus()
-  }
-  if (!appliedLabel) return { status: 'unavailable', requested: label, applied: null }
-  for (let attempt = 0; attempt < 20; attempt += 1) {
-    const verification = await openGeminiModelMenu()
-    const selected = verification
-      ? geminiEffortChoices(verification.menu)
-        .some((choice) => choice.selected && modelLabelMatches(choice.label, appliedLabel))
-      : false
-    dismissProviderMenus()
-    if (selected) return { status: 'selected', requested: label, applied: appliedLabel }
-    await delay(100)
-  }
-  return { status: 'unavailable', requested: label, applied: null }
-}
-
-async function inspectGrokControls(provider: ContentProvider, request: ContentRecord = {}) {
-  const contextBlocker = validateExecutionContext(provider, request)
-  if (contextBlocker) return contextBlocker
-  const opened = await openGrokModelMenu()
-  if (!opened) return unavailableModelInspection(provider)
-  try {
-    return inspectedModelControls(provider, grokModelChoices(opened.menu, opened.trigger))
-  } finally {
-    dismissProviderMenus()
-  }
-}
-
-async function configureGrokControls(provider: ContentProvider, request: ContentRecord = {}) {
-  const contextBlocker = validateExecutionContext(provider, request)
-  if (contextBlocker) return contextBlocker
-  if (request.effort !== undefined) {
-    return {
-      status: 'blocked',
-      stopReason: 'effort_coupled_to_model',
-      message: 'Grok exposes thinking depth through exact model profiles such as Expert or Heavy, not a separate effort control.',
-      provider: provider.id,
-      requested: typeof request.effort === 'string' ? request.effort : null,
-    }
-  }
-  if (request.model === undefined) return configuredPreservingModel(provider)
-  const selection = await selectGrokModel(request.model, request.modelFallbacks)
-  return configuredOrBlockedModel(provider, selection)
-}
-
-async function selectGrokModel(requested: unknown, fallbacks: unknown) {
-  const requestedLabels = requestedModelLabels(requested, fallbacks)
-  for (let fallbackIndex = 0; fallbackIndex < requestedLabels.length; fallbackIndex += 1) {
-    const label = requestedLabels[fallbackIndex]
-    if (!label) continue
-    const opened = await openGrokModelMenu()
-    if (!opened) break
-    const choice = grokModelChoices(opened.menu, opened.trigger)
-      .find((candidate) => candidate.available && modelLabelMatches(candidate.label, label))
-    if (!choice) {
-      dismissProviderMenus()
-      continue
-    }
-    if (!choice.selected) choice.element.click()
-    const verified = await waitForGrokModelSelection(opened.trigger, choice.label)
-    dismissProviderMenus()
-    if (!verified) continue
-    return selectedModelResult(requestedLabels, choice.label, fallbackIndex)
-  }
-  dismissProviderMenus()
-  return unavailableModelResult(requestedLabels)
-}
-
-async function waitForGrokModelSelection(trigger: HTMLElement, label: string) {
-  for (let attempt = 0; attempt < 20; attempt += 1) {
-    if (modelLabelMatches(visibleControlLabel(trigger), label)) return true
-    await delay(100)
-  }
-  return false
-}
-
-async function openGrokModelMenu() {
-  const trigger = findFirstVisible([
-    'button#model-select-trigger[aria-label="Model select"][aria-haspopup="menu"]',
-  ])
-  if (!trigger || !isEnabledVisible(trigger)) return null
-  if (trigger.getAttribute('aria-expanded') !== 'true') trigger.click()
-  for (let attempt = 0; attempt < 20; attempt += 1) {
-    const menu = ([...document.querySelectorAll('[role="menu"]')] as HTMLElement[])
-      .find((candidate) => (
-        isVisible(candidate) &&
-        candidate.querySelector('[role="menuitem"][data-radix-collection-item] span.font-semibold') !== null
-      ))
-    if (menu) return { trigger, menu }
-    await delay(100)
-  }
-  return null
-}
-
-function grokModelChoices(menu: HTMLElement, trigger: HTMLElement): VisibleModelChoice[] {
-  const selectedLabel = visibleControlLabel(trigger)
-  const upgradePromptVisible = ([...menu.querySelectorAll('[role="menuitem"]')] as HTMLElement[])
-    .some((item) => {
-      if (!isVisible(item) || item.querySelector('span.font-semibold')) return false
-      const text = normalizeText(item.innerText || item.textContent || '').toLocaleLowerCase('en-US')
-      return Boolean(item.querySelector('button')) && /(?:upgrade|unlock|try for|claim offer)/u.test(text)
-    })
-  return ([...menu.querySelectorAll('[role="menuitem"][data-radix-collection-item]')] as HTMLElement[])
-    .filter((item) => isVisible(item))
-    .map((element) => {
-      const label = normalizeText(element.querySelector('span.font-semibold')?.textContent || '')
-      const selected = modelLabelMatches(selectedLabel, label)
-      return {
-        element,
-        label,
-        selected,
-        // On Grok Free the paid rows are not aria-disabled. The same menu shows
-        // an upgrade prompt and clicking those rows opens the upgrade dialog.
-        available: isEnabledVisible(element) && (!upgradePromptVisible || selected),
-      }
-    })
-    .filter((choice) => choice.label.length > 0)
-}
-
-function requestedModelLabels(requested: unknown, fallbacks: unknown) {
-  return [requested, ...(Array.isArray(fallbacks) ? fallbacks : [])]
-    .filter((label): label is string => typeof label === 'string' && label.trim().length > 0)
-    .map((label) => normalizeText(label))
-}
-
-function selectedModelResult(requestedLabels: string[], applied: string, fallbackIndex: number) {
-  return {
-    status: fallbackIndex === 0 ? 'selected' : 'fallback_selected',
-    requested: requestedLabels[0] ?? null,
-    applied,
-    fallback: fallbackIndex === 0 ? null : applied,
-  }
-}
-
-function unavailableModelResult(requestedLabels: string[]) {
-  return { status: 'unavailable', requested: requestedLabels[0] ?? null, applied: null }
-}
-
-function inspectedModelControls(
-  provider: ContentProvider,
-  models: VisibleModelChoice[],
-  efforts: VisibleEffortChoice[] = []
-) {
-  return {
-    status: 'inspected',
-    provider: provider.id,
-    visible: true,
-    controls: {
-      available: models.length > 0,
-      efforts: efforts.map(({ label, selected, available }) => ({
-        id: label,
-        label,
-        selected,
-        available,
-      })),
-      models: models.map(({ label, selected, available }) => ({ label, selected, available })),
-    },
-    url: publicPageUrl(location.href),
-  }
-}
-
-function unavailableModelInspection(provider: ContentProvider) {
-  return inspectedModelControls(provider, [])
-}
-
-function configuredPreservingModel(provider: ContentProvider) {
-  return {
-    status: 'configured',
-    provider: provider.id,
-    visible: true,
-    model: { status: 'preserved' },
-    url: publicPageUrl(location.href),
-  }
-}
-
-function configuredOrBlockedModel(provider: ContentProvider, model: ContentRecord) {
-  if (model.status === 'unavailable') {
-    return {
-      status: 'blocked',
-      stopReason: 'model_control_unavailable',
-      message: `The requested model is not an available exact label in the visible ${provider.label} model menu.`,
-      provider: provider.id,
-      model,
-    }
-  }
-  return {
-    status: 'configured',
-    provider: provider.id,
-    visible: true,
-    model,
-    url: publicPageUrl(location.href),
-  }
-}
-
-function dismissProviderMenus() {
-  document.dispatchEvent(new KeyboardEvent('keydown', {
-    key: 'Escape',
-    code: 'Escape',
-    bubbles: true,
-    cancelable: true,
-  }))
-}
-
-async function inspectChatGptControls(provider: ContentProvider, request: ContentRecord = {}) {
-  if (provider.id !== 'chatgpt') {
-    return {
-      status: 'blocked',
-      stopReason: 'chatgpt_controls_unsupported',
-      message: 'ChatGPT controls are only available on ChatGPT.',
-      provider: provider.id,
-    }
-  }
-  const contextBlocker = validateExecutionContext(provider, request)
-  if (contextBlocker) return contextBlocker
-  const surface = chatGptSurfaceSnapshot()
-  const opened = await openChatGptIntelligenceMenu(request)
-  if (!opened) {
-    return {
-      status: 'inspected',
-      provider: provider.id,
-      visible: true,
-      surface,
-      controls: { available: false, efforts: [], models: [] },
-      url: publicPageUrl(location.href),
-    }
-  }
-  try {
-    const effortItems = chatGptEffortChoices(opened.menu)
-    const modelTrigger = findVisibleMenuSubmenuTrigger(opened.menu)
-    const modelMenu = modelTrigger ? await openChatGptModelMenu(modelTrigger, opened.menu, request) : null
-    return {
-      status: 'inspected',
-      provider: provider.id,
-      visible: true,
-      surface,
-      controls: {
-        available: true,
-        efforts: effortItems.map((item) => ({
-          id: visibleChoiceId(item.label),
-          label: item.label,
-          selected: item.choice.getAttribute('aria-checked') === 'true',
-          available: isEnabledVisible(item.choice),
-        })),
-        models: modelMenu
-          ? menuRadioItems(modelMenu).map((item) => ({
-              label: primaryVisibleControlLabel(item),
-              selected: item.getAttribute('aria-checked') === 'true',
-              available: isEnabledVisible(item),
-            }))
-          : [],
-      },
-      url: publicPageUrl(location.href),
-    }
-  } finally {
-    dismissChatGptMenus()
-  }
-}
-
-async function configureChatGptControls(provider: ContentProvider, request: ContentRecord = {}) {
-  if (provider.id !== 'chatgpt') {
-    return {
-      status: 'blocked',
-      stopReason: 'chatgpt_controls_unsupported',
-      message: 'ChatGPT controls are only available on ChatGPT.',
-      provider: provider.id,
-    }
-  }
-  const contextBlocker = validateExecutionContext(provider, request)
-  if (contextBlocker) return contextBlocker
-
-  const surface = await ensureChatGptChatSurface(request)
-  if (surface.status === 'blocked') return surface
-  const model = request.model === undefined
-    ? { status: 'preserved' }
-    : await selectChatGptModel(request.model, request.modelFallbacks, request)
-  if (model.status === 'unavailable') {
-    return {
-      status: 'blocked',
-      stopReason: 'model_control_unavailable',
-      message: 'The requested model is not an available exact label in the visible ChatGPT model menu.',
-      provider: provider.id,
-      model,
-    }
-  }
-  const effort = request.effort === undefined
-    ? { status: 'preserved' }
-    : await selectChatGptEffort(request.effort, request)
-  if (effort.status === 'unavailable') {
-    return {
-      status: 'blocked',
-      stopReason: 'effort_control_unavailable',
-      message: 'The requested effort is not an enabled exact label in the visible ChatGPT Intelligence menu.',
-      provider: provider.id,
-      model,
-      effort,
-    }
-  }
-  return {
-    status: 'configured',
-    provider: provider.id,
-    visible: true,
-    surface,
-    model,
-    effort,
-    url: publicPageUrl(location.href),
-  }
-}
-
-function chatGptSurfaceSnapshot() {
-  const radios = visibleChatGptSurfaceRadios()
-  if (radios.length !== 2) {
-    return { status: 'not_present', available: false, selected: null }
-  }
-  const chatRadio = radios[0]
-  if (!chatRadio) return { status: 'not_present', available: false, selected: null }
-  return {
-    status: chatRadio.getAttribute('aria-checked') === 'true' ? 'chat_selected' : 'work_selected',
-    available: true,
-    selected: radios.findIndex((radio) => radio.getAttribute('aria-checked') === 'true'),
-  }
-}
-
-async function ensureChatGptChatSurface(request: ContentRecord = {}) {
-  const radios = visibleChatGptSurfaceRadios()
-  if (radios.length !== 2) {
-    return { status: 'not_present', available: false, selected: null }
-  }
-  const chatRadio = radios[0]
-  if (!chatRadio) return { status: 'not_present', available: false, selected: null }
-  if (chatRadio.getAttribute('aria-checked') === 'true') {
-    return { status: 'chat_selected', available: true, selected: 0 }
-  }
-  await activateChatGptControl(chatRadio, request)
-  for (let attempt = 0; attempt < 8; attempt += 1) {
-    if (chatRadio.getAttribute('aria-checked') === 'true') {
-      return { status: 'chat_selected', available: true, selected: 0, changed: true }
-    }
-    await delay(100)
-  }
-  return {
-    status: 'blocked',
-    stopReason: 'chat_surface_unavailable',
-    message: 'ChatGPT Work surface was selected and Tokenless could not switch to the Chat surface.',
-    provider: 'chatgpt',
-  }
-}
-
-function visibleChatGptSurfaceRadios() {
-  return [...document.querySelectorAll('[role="radio"]')]
-    .filter((node) => isVisible(node))
-    .filter((node) => node.closest('[role="menu"]') === null) as HTMLElement[]
-}
-
-async function selectChatGptModel(requested: unknown, fallbacks: unknown, request: ContentRecord = {}) {
-  const requestedLabels = requestedModelLabels(requested, fallbacks)
-  const opened = await openChatGptIntelligenceMenu(request)
-  if (!opened) return { status: 'unavailable', requested: requestedLabels[0] ?? null, applied: null }
-  try {
-    const trigger = findVisibleMenuSubmenuTrigger(opened.menu)
-    const modelMenu = trigger ? await openChatGptModelMenu(trigger, opened.menu, request) : null
-    if (!modelMenu) return { status: 'unavailable', requested: requestedLabels[0] ?? null, applied: null }
-    const choices = menuRadioItems(modelMenu)
-    for (let fallbackIndex = 0; fallbackIndex < requestedLabels.length; fallbackIndex += 1) {
-      const label = requestedLabels[fallbackIndex]
-      if (!label) continue
-      const choice = choices.find((item) => (
-        isEnabledVisible(item) && modelLabelMatches(primaryVisibleControlLabel(item), label)
-      ))
-      if (!choice) continue
-      const applied = primaryVisibleControlLabel(choice)
-      if (choice.getAttribute('aria-checked') !== 'true') {
-        await activateChatGptControl(choice, request)
-        if (!await waitForChatGptModelSelection(applied, request)) continue
-      }
-      return {
-        status: fallbackIndex === 0 ? 'selected' : 'fallback_selected',
-        requested: requestedLabels[0],
-        applied,
-        fallback: fallbackIndex === 0 ? null : label,
-      }
-    }
-    return {
-      status: 'unavailable',
-      requested: requestedLabels[0] ?? null,
-      applied: null,
-    }
-  } finally {
-    dismissChatGptMenus()
-  }
-}
-
-async function waitForChatGptModelSelection(label: string, request: ContentRecord) {
-  for (let attempt = 0; attempt < 20; attempt += 1) {
-    const opened = await openChatGptIntelligenceMenu(request)
-    const trigger = opened ? findVisibleMenuSubmenuTrigger(opened.menu) : undefined
-    const modelMenu = opened && trigger
-      ? await openChatGptModelMenu(trigger, opened.menu, request)
-      : null
-    const selected = modelMenu
-      ? menuRadioItems(modelMenu).some((item) => (
-          item.getAttribute('aria-checked') === 'true' &&
-          modelLabelMatches(primaryVisibleControlLabel(item), label)
-        ))
-      : false
-    if (selected) return true
-    dismissChatGptMenus()
-    await delay(100)
-  }
-  return false
-}
-
-async function selectChatGptEffort(requested: unknown, request: ContentRecord = {}) {
-  const wanted = typeof requested === 'string' ? normalizeText(requested) : ''
-  const opened = await openChatGptIntelligenceMenu(request)
-  if (!wanted || !opened) return { status: 'unavailable', requested: wanted || null, applied: null }
-  try {
-    const choices = chatGptEffortChoices(opened.menu)
-    const selection = choices.find(({ choice, label }) => (
-      isEnabledVisible(choice) && modelLabelMatches(label, wanted)
-    ))
-    if (!selection) return { status: 'unavailable', requested: wanted, applied: null }
-    if (selection.choice.getAttribute('aria-checked') !== 'true') {
-      await activateChatGptControl(selection.choice, request)
-      if (!await waitForChatGptEffortSelection(selection.label, request)) {
-        return { status: 'unavailable', requested: wanted, applied: null }
-      }
-    }
-    return {
-      status: 'selected',
-      requested: wanted,
-      applied: selection.label,
-    }
-  } finally {
-    dismissChatGptMenus()
-  }
-}
-
-async function waitForChatGptEffortSelection(label: string, request: ContentRecord) {
-  for (let attempt = 0; attempt < 20; attempt += 1) {
-    const opened = await openChatGptIntelligenceMenu(request)
-    const selected = opened
-      ? chatGptEffortChoices(opened.menu).some(({ choice, label: candidate }) => (
-          choice.getAttribute('aria-checked') === 'true' && modelLabelMatches(candidate, label)
-        ))
-      : false
-    if (selected) return true
-    dismissChatGptMenus()
-    await delay(100)
-  }
-  return false
-}
-
-async function openChatGptIntelligenceMenu(request: ContentRecord = {}) {
-  const main = document.querySelector('main')
-  const composer = findFirstVisible(PROVIDER_CHATGPT.composerSelectors)
-  const trigger = main && composer
-    ? nearestChatGptMenuTrigger(main, composer)
-    : undefined
-  if (!trigger) return null
-  if (trigger.getAttribute('aria-expanded') !== 'true') await activateChatGptControl(trigger, request)
-  for (let attempt = 0; attempt < 20; attempt += 1) {
-    const menus = [...document.querySelectorAll('[role="menu"]')]
-      .filter((candidate) => isVisible(candidate)) as HTMLElement[]
-    const menu = menus.find((candidate) => candidate.getAttribute('aria-labelledby') === trigger.id)
-      ?? menus.find((candidate) => (
-        chatGptEffortChoices(candidate).length > 0 && findVisibleMenuSubmenuTrigger(candidate) !== undefined
-      ))
-    if (menu) return { trigger, menu }
-    await delay(100)
-  }
-  return null
-}
-
-async function openChatGptModelMenu(trigger: HTMLElement, parentMenu: HTMLElement, request: ContentRecord = {}) {
-  await activateChatGptControl(trigger, request)
-  for (let attempt = 0; attempt < 20; attempt += 1) {
-    const menu = [...document.querySelectorAll('[role="menu"]')]
-      .find((candidate) => candidate !== parentMenu && isVisible(candidate)) as HTMLElement | undefined
-    if (menu) return menu
-    await delay(100)
-  }
-  return null
-}
-
-const PROVIDER_CHATGPT = getProviderForUrl('https://chatgpt.com/')!
-
-function nearestChatGptMenuTrigger(main: Element, composer: HTMLElement) {
-  const composerRect = composer.getBoundingClientRect()
-  const candidates = [...main.querySelectorAll('button[aria-expanded][aria-haspopup="menu"]')]
-    .filter((node) => isEnabledVisible(node as HTMLElement)) as HTMLElement[]
-  const composerPills = candidates.filter((candidate) => candidate.className.includes('__composer-pill'))
-  const ranked = composerPills.length > 0 ? composerPills : candidates
-  return ranked.sort((left, right) => (
-    distanceToRect(left.getBoundingClientRect(), composerRect) - distanceToRect(right.getBoundingClientRect(), composerRect)
-  ))[0]
-}
-
-function distanceToRect(
-  left: Pick<DOMRect, 'bottom' | 'left' | 'right' | 'top'>,
-  right: Pick<DOMRect, 'bottom' | 'left' | 'right' | 'top'>
-) {
-  const leftX = (left.left + left.right) / 2
-  const leftY = (left.top + left.bottom) / 2
-  const rightX = (right.left + right.right) / 2
-  const rightY = (right.top + right.bottom) / 2
-  return Math.hypot(leftX - rightX, leftY - rightY)
-}
-
-async function activateChatGptControl(node: HTMLElement, request: ContentRecord) {
-  if (await requestTrustedChatGptClick(node, request)) return true
-  node.click()
-  return false
-}
-
-async function requestTrustedChatGptClick(node: HTMLElement, request: ContentRecord) {
-  if (typeof chrome.runtime.sendMessage !== 'function') {
-    return false
-  }
-  const rect = node.getBoundingClientRect()
-  if (!rectIntersectsViewport(rect)) return false
-  const x = Math.round(rect.left + rect.width / 2)
-  const y = Math.round(rect.top + rect.height / 2)
-  if (x < 0 || y < 0 || x >= window.innerWidth || y >= window.innerHeight) return false
-  try {
-    const response = await chrome.runtime.sendMessage({
-      type: 'tokenless.bridge.trusted_click',
-      request: {
-        provider: 'chatgpt',
-        expectedUrl: publicPageUrl(location.href),
-        x,
-        y,
-        viewportWidth: window.innerWidth,
-        viewportHeight: window.innerHeight,
-      },
-    })
-    return response?.ok === true
-  } catch {
-    return false
-  }
-}
-
-function findVisibleMenuSubmenuTrigger(menu: HTMLElement) {
-  return [...menu.querySelectorAll('[role="menuitem"]')]
-    .find((node) => isVisible(node) && node.getAttribute('aria-haspopup') === 'menu') as HTMLElement | undefined
-}
-
-function menuRadioItems(menu: HTMLElement) {
-  return [...menu.querySelectorAll('[role="menuitemradio"]')]
-    .filter((node) => isVisible(node)) as HTMLElement[]
-}
-
-function chatGptEffortChoices(menu: HTMLElement) {
-  return menuRadioItems(menu).map((choice) => ({
-    choice,
-    label: primaryVisibleControlLabel(choice),
-  }))
-}
-
-function isEnabledVisible(node: HTMLElement) {
-  return isVisible(node) && node.getAttribute('aria-disabled') !== 'true' && !(node as HTMLButtonElement).disabled
-}
-
-function visibleControlLabel(node: HTMLElement) {
-  return normalizeText(node.innerText || node.textContent || '')
-}
-
-function firstVisibleLine(node: HTMLElement) {
-  return (node.innerText || node.textContent || '')
-    .split(/\r?\n/u)
-    .map((line) => normalizeText(line))
-    .find(Boolean) ?? ''
-}
-
-function primaryVisibleControlLabel(node: HTMLElement) {
-  const descendantLabels = [...node.querySelectorAll('span, p')]
-    .filter((candidate): candidate is HTMLElement => candidate instanceof HTMLElement && isVisible(candidate))
-    .filter((candidate) => ![...candidate.querySelectorAll('span, p')].some((descendant) => (
-      descendant !== candidate && normalizeText(descendant.textContent || '').length > 0
-    )))
-    .map((candidate) => normalizeText(candidate.innerText || candidate.textContent || ''))
-    .filter(Boolean)
-  return descendantLabels[0] ?? firstVisibleLine(node)
-}
-
-function visibleChoiceId(label: string) {
-  return normalizeText(label).toLocaleLowerCase('en-US').replace(/\s+/gu, '_')
-}
-
-function hasExactVisibleDescendantLabel(node: HTMLElement, label: string) {
-  return [...node.querySelectorAll('*')].some((candidate) => (
-    candidate instanceof HTMLElement &&
-    isVisible(candidate) &&
-    modelLabelMatches(candidate.innerText || candidate.textContent || '', label)
-  ))
-}
-
-function modelLabelMatches(available: string, requested: string) {
-  return normalizeText(available).toLocaleLowerCase('en-US') === normalizeText(requested).toLocaleLowerCase('en-US')
-}
-
-function dismissChatGptMenus() {
-  dismissProviderMenus()
-  dismissProviderMenus()
-}
-
-async function readLatestAnswer(provider: ContentProvider, request: ContentRecord = {}) {
-  await dismissProviderInterruptions(provider)
-  const blocker = detectBlocker(provider)
-  if (blocker) {
-    return blocker
-  }
-  if (allowsPostSubmitTargetTransition(provider, request, 'tokenless.bridge.read')) {
-    const chatSurface = chatSurfaceStatus(provider, { requireComposer: true })
-    if (!chatSurface.ready) {
-      return {
-        status: 'blocked',
-        stopReason: 'post_submit_surface_unavailable',
-        message: 'The provider conversation no longer has a visible chat composer.',
-        provider: provider.id,
-      }
-    }
-  }
-
-  const timeoutMs = Math.min(Number(request.readTimeoutMs ?? 60000), MAX_VISIBLE_RESPONSE_WAIT_MS)
-  const baseline = request.answerBaseline ?? submissionBaselines.get(requestKey(request))
-  const waitResult = await waitForStableAnswer(provider, timeoutMs, baseline)
-  if (waitResult.blocker) return waitResult.blocker
-  const answer = waitResult.answer
-  const contextBlocker = validateExecutionContext(provider, request, 'tokenless.bridge.read')
-  if (contextBlocker) return contextBlocker
-  const lateBlocker = detectBlocker(provider)
-  if (lateBlocker) return lateBlocker
-  if (!answer) {
-    return {
-      status: 'blocked',
-      stopReason: 'response_unavailable',
-      message: 'No visible provider response was found.',
-      provider: provider.id,
-    }
-  }
-
-  return {
-    status: 'read',
-    provider: provider.id,
-    text: answer.text,
-    chars: answer.text.length,
-    // Sources are extracted only from visible links rendered inside the final
-    // assistant response. This keeps research results attributable without
-    // collecting browser history, provider storage, or hidden network data.
-    sources: visibleAnswerSources(provider, answer.element),
-    url: publicPageUrl(location.href),
-  }
-}
-
-function requestKey(request: ContentRecord = {}) {
-  return request.requestId || request.jobId || '__latest__'
-}
-
-function detectBlocker(provider: ContentProvider) {
-  const blocker = findFirstVisible(provider.blockerSelectors)
-  if (!blocker) {
-    return null
-  }
-  return {
-    status: 'blocked',
-    stopReason: 'provider_blocker_visible',
-    message: normalizeText(blocker.innerText || blocker.getAttribute('aria-label') || 'Provider blocker is visible.'),
-    provider: provider.id,
-  }
-}
-
-function chatSurfaceStatus(
-  provider: ContentProvider,
-  { requireComposer = false }: { requireComposer?: boolean } = {}
-) {
-  const visibleComposer = findFirstVisible(provider.composerSelectors)
-  const visibleSubmit = findFirstVisible(provider.submitSelectors)
-  if (provider.id === 'chatgpt') {
-    return {
-      // Current ChatGPT omits its send button until text is present. Landing and
-      // post-submit validation therefore require the visible composer; submission
-      // itself still waits for an actionable send button after inserting the prompt.
-      ready: Boolean(visibleComposer),
-      checks: {
-        composer: Boolean(visibleComposer),
-        sendButton: Boolean(visibleSubmit),
-      },
-    }
-  }
-  const visibleAnswer = findFirstVisible(provider.answerSelectors)
-  return {
-    ready: requireComposer ? Boolean(visibleComposer) : Boolean(visibleComposer || visibleAnswer),
-    checks: {
-      composer: Boolean(visibleComposer),
-      sendButton: Boolean(visibleSubmit),
-      answer: Boolean(visibleAnswer),
-    },
-  }
-}
-
-function findFirstVisible(selectors: readonly string[]): HTMLElement | null {
-  for (const selector of selectors) {
-    let nodes
-    try {
-      nodes = document.querySelectorAll(selector)
-    } catch {
-      continue
-    }
-    for (const node of nodes) {
-      if (isVisible(node)) {
-        return node as HTMLElement
-      }
-    }
-  }
-  return null
-}
-
-async function waitForComposer(provider: ContentProvider, request: ContentRecord = {}) {
-  const timeoutMs = Math.min(Number(request.composerTimeoutMs ?? 15000), 60000)
-  const deadline = Date.now() + timeoutMs
-  while (Date.now() < deadline) {
-    await dismissProviderInterruptions(provider)
-    const composer = findFirstVisible(provider.composerSelectors)
-    if (composer) {
-      return composer
-    }
-    await delay(250)
-  }
-  return findFirstVisible(provider.composerSelectors)
-}
-
-async function dismissProviderInterruptions(provider: ContentProvider) {
-  if (provider.id !== 'chatgpt') {
-    return
-  }
-  document.dispatchEvent(new KeyboardEvent('keydown', {
-    key: 'Escape',
-    code: 'Escape',
-    keyCode: 27,
-    which: 27,
-    bubbles: true,
-    cancelable: true,
-  }))
-  const dismissLabels = [
-    'close',
-    'dismiss',
-    'not now',
-    'maybe later',
-    'continue logged out',
-    'continue without logging in',
-    'stay logged out',
-    'skip',
-  ]
-  for (const button of [...document.querySelectorAll('button,[role="button"]')] as HTMLElement[]) {
-    if (!isVisible(button)) continue
-    const label = normalizeText([
-      button.getAttribute('aria-label'),
-      button.getAttribute('data-testid'),
-      button.innerText,
-      button.textContent,
-    ].filter(Boolean).join(' ')).toLowerCase()
-    if (dismissLabels.some((dismissLabel) => label.includes(dismissLabel))) {
-      button.click()
-      await delay(150)
-      return
-    }
-  }
-}
-
-function isVisible(node: Element) {
-  if (!node.isConnected) return false
-  const visibilityApi = node as Element & {
-    checkVisibility?: (options?: { checkOpacity?: boolean; checkVisibilityCSS?: boolean }) => boolean
-  }
-  try {
-    if (
-      typeof visibilityApi.checkVisibility === 'function' &&
-      !visibilityApi.checkVisibility({ checkOpacity: true, checkVisibilityCSS: true })
-    ) {
-      return false
-    }
-  } catch {
-    // Fall through to the explicit ancestor checks for older provider browsers.
-  }
-
-  for (let current: Element | null = node; current; current = current.parentElement) {
-    const style = window.getComputedStyle?.(current)
-    if (
-      !style ||
-      style.display === 'none' ||
-      style.visibility === 'hidden' ||
-      style.visibility === 'collapse' ||
-      style.contentVisibility === 'hidden' ||
-      Number(style.opacity) === 0
-    ) {
-      return false
-    }
-  }
-
-  const rect = node.getBoundingClientRect?.()
-  return Boolean(rect && rectIntersectsViewport(rect))
-}
-
-function rectIntersectsViewport(rect: Pick<DOMRect, 'bottom' | 'height' | 'left' | 'right' | 'top' | 'width'>) {
-  return (
-    rect.width > 0 &&
-    rect.height > 0 &&
-    rect.bottom > 0 &&
-    rect.right > 0 &&
-    rect.top < window.innerHeight &&
-    rect.left < window.innerWidth
-  )
-}
-
-function isVisibleConnected(node: Element | null): node is HTMLElement {
-  return Boolean(node?.isConnected && isVisible(node))
-}
-
-function focusComposer(composer: HTMLElement) {
-  composer.focus()
-  if (composer.isContentEditable) {
-    const selection = window.getSelection()
-    const range = document.createRange()
-    range.selectNodeContents(composer)
-    range.collapse(false)
-    selection?.removeAllRanges()
-    selection?.addRange(range)
-  }
-}
-
-function setComposerText(composer: HTMLElement & { value?: string }, text: string) {
-  if ('value' in composer) {
-    composer.value = text
-    composer.dispatchEvent(new InputEvent('input', { bubbles: true, inputType: 'insertText', data: text }))
-    composer.dispatchEvent(new Event('change', { bubbles: true }))
-    return
-  }
-
-  composer.textContent = ''
-  composer.dispatchEvent(new InputEvent('input', {
-    bubbles: true,
-    cancelable: true,
-    inputType: 'deleteContentBackward',
-    data: null,
-  }))
-  document.execCommand?.('insertText', false, text)
-  if (!normalizeText(composer.innerText || composer.textContent || '').includes(text.trim())) {
-    composer.textContent = text
-  }
-  composer.dispatchEvent(new InputEvent('input', {
-    bubbles: true,
-    cancelable: true,
-    inputType: 'insertText',
-    data: text,
-  }))
-}
-
-async function waitForActionableSubmit(provider: ContentProvider, request: ContentRecord = {}) {
-  const timeoutMs = Math.min(Number(request.submitTimeoutMs ?? 5000), 30000)
-  const deadline = Date.now() + timeoutMs
-  while (Date.now() < deadline) {
-    const button = findFirstVisible(provider.submitSelectors)
-    if (isActionableSubmit(button)) {
-      return button
-    }
-    await delay(100)
-  }
-  const button = findFirstVisible(provider.submitSelectors)
-  return isActionableSubmit(button) ? button : null
-}
-
-async function waitForVisibleSubmission(
-  provider: ContentProvider,
-  request: ContentRecord,
-  baseline: ContentRecord,
-  preSubmitUrl: string
-) {
-  const timeoutMs = Math.min(Number(request.submissionConfirmTimeoutMs ?? 5000), 30000)
-  const expectedPrompt = normalizeText(String(request.prompt ?? ''))
-  const deadline = Date.now() + timeoutMs
-  while (Date.now() < deadline) {
-    const composer = findFirstVisible(provider.composerSelectors)
-    const composerText = normalizeText(composer?.innerText || composer?.textContent || '')
-    const answers = answerSnapshot(provider)
-    const urlChanged = publicPageUrl(location.href) !== preSubmitUrl
-    const busy = isProviderBusy(provider)
-    const answerAdded = answers.count > baseline.count
-    const composerChanged = Boolean(expectedPrompt && composerText !== expectedPrompt)
-    const submitSettled = !isActionableSubmit(findFirstVisible(provider.submitSelectors))
-    if (urlChanged || busy || answerAdded || composerChanged || submitSettled) {
-      return {
-        urlChanged,
-        busy,
-        answerCount: answers.count,
-        composerChanged,
-        submitSettled,
-      }
-    }
-    await delay(100)
-  }
-  return null
-}
-
-function isActionableSubmit(node: HTMLElement | null): node is HTMLElement {
-  return Boolean(
-    isVisibleConnected(node) &&
-    !(node as HTMLButtonElement).disabled &&
-    node.getAttribute('aria-disabled') !== 'true'
-  )
-}
-
-async function waitForStableAnswer(provider: ContentProvider, timeoutMs: number, baseline: ContentRecord | undefined) {
-  const deadline = Date.now() + timeoutMs
-  let lastText = ''
-  let stableSince = 0
-  while (Date.now() < deadline) {
-    const blocker = detectBlocker(provider)
-    if (blocker) return { answer: null, blocker }
-    const answer = latestAnswer(provider, baseline)
-    const text = answer?.text ?? ''
-    const busy = isProviderBusy(provider)
-    if (text && text === lastText) {
-      if (stableSince === 0) stableSince = Date.now()
-      if (!busy && Date.now() - stableSince >= 600) return { answer, blocker: null }
-    } else {
-      lastText = text
-      stableSince = text ? Date.now() : 0
-    }
-    await delay(150)
-  }
-  return { answer: latestAnswer(provider, baseline), blocker: detectBlocker(provider) }
-}
-
-function isProviderBusy(provider: ContentProvider) {
-  const selectorMatch = Boolean(provider.busySelectors?.some((selector) => {
-    try {
-      return [...document.querySelectorAll(selector)].some((node) => isVisible(node))
-    } catch {
-      return false
-    }
-  }))
-  if (selectorMatch) {
-    return true
-  }
-  const labels = provider.busyTextLabels ?? []
-  if (labels.length === 0) {
-    return false
-  }
-  return ([...document.querySelectorAll('button,[role="button"]')] as HTMLElement[]).some((node) => {
-    if (!isVisible(node)) return false
-    const label = normalizeText([
-      node.getAttribute('aria-label'),
-      node.textContent,
-      node.innerText,
-    ].filter(Boolean).join(' ')).toLowerCase()
-    return labels.some((busyLabel: string) => label.includes(busyLabel))
-  })
-}
-
-function latestAnswer(provider: ContentProvider, baseline: ContentRecord | undefined): AnswerEntry | null {
-  const answers = answerEntries(provider)
-  if (baseline?.count !== undefined) {
-    if (answers.length < baseline.count) {
-      return null
-    }
-    if (answers.length === baseline.count) {
-      const lastAnswer = answers.at(-1) ?? null
-      return lastAnswer && lastAnswer.text !== baseline.lastText ? lastAnswer : null
-    }
-    return answers.at(-1) ?? null
-  }
-  return answers.at(-1) ?? null
-}
-
-function answerSnapshot(provider: ContentProvider) {
-  const answers = answerEntries(provider)
-  return {
-    count: answers.length,
-    lastText: answers.at(-1)?.text ?? '',
-  }
-}
-
-function answerEntries(provider: ContentProvider): AnswerEntry[] {
-  for (const selector of provider.answerSelectors) {
-    const answers = [...document.querySelectorAll(selector)]
-      .filter((node) => isVisible(node))
-      .map((node) => {
-        const element = node as HTMLElement
-        return {
-          element,
-          text: normalizeText(element.innerText || element.textContent || ''),
-        }
-      })
-      .filter((answer) => isLikelyAssistantAnswer(answer.text))
-    if (answers.length > 0) {
-      return answers
-    }
-  }
-  return []
-}
-
-function visibleAnswerSources(provider: ContentProvider, answer: HTMLElement) {
-  const seen = new Set<string>()
-  const sources: Array<{ url: string; title?: string; domain: string }> = []
-  for (const anchor of [...answer.querySelectorAll('a[href]')] as HTMLAnchorElement[]) {
-    const source = visiblePublicSource(provider, anchor)
-    if (!source || seen.has(source.url)) continue
-    seen.add(source.url)
-    sources.push(source)
-    if (sources.length >= MAX_VISIBLE_SOURCES) break
-  }
-  return sources
-}
-
-function visiblePublicSource(provider: ContentProvider, anchor: HTMLAnchorElement) {
-  if (!isVisible(anchor)) return null
-  let parsed: URL
-  try {
-    parsed = new URL(anchor.href)
-  } catch {
-    return null
-  }
-  if (
-    parsed.protocol !== 'https:' ||
-    parsed.username !== '' ||
-    parsed.password !== '' ||
-    parsed.port !== '' ||
-    provider.hosts.includes(parsed.hostname.toLowerCase())
-  ) {
-    return null
-  }
-  parsed.hash = ''
-  for (const name of [...parsed.searchParams.keys()]) {
-    if (TRACKING_QUERY_PARAMETER.test(name)) parsed.searchParams.delete(name)
-  }
-  const title = normalizeText(
-    anchor.getAttribute('aria-label') ||
-    anchor.getAttribute('title') ||
-    anchor.innerText ||
-    anchor.textContent ||
-    ''
-  ).slice(0, 240)
-  return {
-    url: parsed.toString(),
-    ...(title ? { title } : {}),
-    domain: parsed.hostname.toLowerCase(),
-  }
-}
-
-function isLikelyAssistantAnswer(text: string) {
-  if (!text) return false
-  // ChatGPT may render its source-chip row inside an assistant message before
-  // the actual response. It is not an answer and must not satisfy the read
-  // loop merely because it is visible. Keep short legitimate answers intact.
-  const words = text.toLocaleLowerCase().match(/[\p{L}\p{N}]+/gu) ?? []
-  const sourceChipWords = new Set([
-    'open', 'reddit', 'github', 'openai', 'status', 'source', 'sources',
-    'link', 'links', 'web', 'website', 'search', 'result', 'results',
-  ])
-  return !(words.length >= 3 && words.every((word) => sourceChipWords.has(word)))
-}
-
-function selectorProbeSnapshot(provider: ContentProvider, { includeText = false }: { includeText?: boolean } = {}) {
-  return {
-    composers: probeSelectors(provider.composerSelectors, { includeText }),
-    submits: probeSelectors(provider.submitSelectors, { includeText }),
-    answers: probeSelectors(provider.answerSelectors, { includeText }),
-    blockers: probeSelectors(provider.blockerSelectors, { includeText }),
-    busy: probeSelectors(provider.busySelectors ?? [], { includeText }),
-  }
-}
-
-function probeSelectors(selectors: readonly string[] = [], { includeText = false }: { includeText?: boolean } = {}) {
-  return selectors.map((selector) => {
-    let count = 0
-    let firstText = ''
-    let error = null
-    try {
-      const matches = [...document.querySelectorAll(selector)]
-      count = matches.length
-      const firstMatch = matches.find((node) => isVisible(node)) as HTMLElement | undefined
-      const rawText = normalizeText(firstMatch?.innerText || firstMatch?.textContent || '')
-      firstText = includeText ? rawText.slice(0, 240) : (rawText ? '[text]' : '')
-    } catch (probeError) {
-      error = probeError instanceof Error ? probeError.message : String(probeError)
-    }
-    return { selector, count, firstText, error }
-  })
-}
-
-function sanitizeTextNodes(
-  sourceRoot: Node,
-  cloneRoot: Node,
-  { includeText = false }: { includeText?: boolean } = {}
-) {
-  const sourceNodes = collectNodes(sourceRoot, NodeFilter.SHOW_TEXT)
-  const cloneNodes = collectNodes(cloneRoot, NodeFilter.SHOW_TEXT)
-  for (let index = 0; index < cloneNodes.length; index += 1) {
-    const sourceNode = sourceNodes[index]
-    const cloneNode = cloneNodes[index]
-    if (!sourceNode || !cloneNode || !cloneNode.nodeValue?.trim()) continue
-    cloneNode.nodeValue = includeText
-      ? (isVisibleTextNode(sourceNode) ? cloneNode.nodeValue : '')
-      : '[text]'
-  }
-}
-
-function removeCommentNodes(root: Node) {
-  for (const comment of collectNodes(root, NodeFilter.SHOW_COMMENT)) {
-    comment.parentNode?.removeChild(comment)
-  }
-}
-
-function collectNodes(root: Node, whatToShow: number) {
-  const walker = document.createTreeWalker(root, whatToShow)
-  const nodes: Node[] = []
-  while (walker.nextNode()) nodes.push(walker.currentNode)
-  return nodes
-}
-
-function isVisibleTextNode(node: Node) {
-  if (!node.nodeValue?.trim() || !(node.parentElement instanceof Element) || !isVisible(node.parentElement)) {
-    return false
-  }
-  const range = document.createRange()
-  range.selectNodeContents(node)
-  return [...range.getClientRects()].some((rect) => rectIntersectsViewport(rect))
-}
-
-function visibleTextSnapshot(root: Element | null) {
-  if (!root) return ''
-  return normalizeText(
-    collectNodes(root, NodeFilter.SHOW_TEXT)
-      .filter((node) => isVisibleTextNode(node))
-      .map((node) => node.nodeValue || '')
-      .join(' ')
-  )
-}
-
-function redactAttributes(
-  sourceRoot: Element,
-  cloneRoot: Element,
-  { includeText = false }: { includeText?: boolean } = {}
-) {
-  const structuralAttributes = new Set([
-    'aria-busy',
-    'aria-checked',
-    'aria-controls',
-    'aria-current',
-    'aria-describedby',
-    'aria-disabled',
-    'aria-expanded',
-    'aria-haspopup',
-    'aria-hidden',
-    'aria-labelledby',
-    'aria-live',
-    'aria-modal',
-    'aria-multiline',
-    'aria-owns',
-    'aria-pressed',
-    'aria-readonly',
-    'aria-required',
-    'aria-selected',
-    'class',
-    'contenteditable',
-    'disabled',
-    'hidden',
-    'id',
-    'open',
-    'role',
-    'tabindex',
-    'type',
-  ])
-  const textLikeAttributes = new Set([
-    'aria-description',
-    'aria-label',
-    'alt',
-    'content',
-    'label',
-    'placeholder',
-    'title',
-  ])
-  const sourceNodes = [sourceRoot, ...sourceRoot.querySelectorAll('*')]
-  const cloneNodes = [cloneRoot, ...cloneRoot.querySelectorAll('*')]
-  cloneNodes.forEach((node: Element, index) => {
-    const sourceNode = sourceNodes[index]
-    for (const attr of [...node.attributes]) {
-      const name = attr.name.toLowerCase()
-      if (structuralAttributes.has(name)) {
-        sanitizeStructuralAttribute(node, attr.name, name, attr.value)
-        continue
-      }
-      if (textLikeAttributes.has(name)) {
-        if (includeText && sourceNode && isVisible(sourceNode)) {
-          continue
-        }
-        if (attr.value.trim()) {
-          node.setAttribute(attr.name, '[text]')
-        }
-        continue
-      }
-      node.removeAttribute(attr.name)
-    }
-  })
-}
-
-function sanitizeStructuralAttribute(
-  node: Element,
-  originalName: string,
-  name: string,
-  value: string
-) {
-  if (!value.trim()) return
-  if (SAFE_EMPTY_ATTRIBUTE_NAMES.has(name)) {
-    node.setAttribute(originalName, '')
-    return
-  }
-  const normalized = value.trim().toLowerCase()
-  if (
-    (SAFE_STATE_ATTRIBUTE_NAMES.has(name) && SAFE_STRUCTURAL_STATE_VALUES.has(normalized)) ||
-    (name === 'type' && SAFE_INPUT_TYPES.has(normalized)) ||
-    (name === 'tabindex' && /^-?\d{1,3}$/.test(normalized))
-  ) {
-    node.setAttribute(originalName, normalized)
-    return
-  }
-  node.setAttribute(originalName, '[structural]')
-}
-
-function resolveIncludeText(request: ContentRecord):
-  | { ok: true; value: boolean | undefined }
-  | { ok: false } {
-  if (request.includeText !== undefined) {
-    return typeof request.includeText === 'boolean'
-      ? { ok: true, value: request.includeText }
-      : { ok: false }
-  }
-  const metadata = request.metadata
-  if (!metadata || typeof metadata !== 'object' || Array.isArray(metadata)) {
-    return { ok: true, value: undefined }
-  }
-  if (metadata.includeText === undefined) {
-    return { ok: true, value: undefined }
-  }
-  return typeof metadata.includeText === 'boolean'
-    ? { ok: true, value: metadata.includeText }
-    : { ok: false }
-}
-
-function validateExecutionContext(
-  provider: ContentProvider,
-  request: ContentRecord = {},
-  messageType?: string
-) {
-  const currentProvider = getProviderForUrl(location.href)
-  if (!currentProvider) {
-    return {
-      status: 'blocked',
-      stopReason: 'unsupported_origin',
-      message: 'Current page is not a supported provider origin.',
-    }
-  }
-  if (request.provider !== provider.id || currentProvider.id !== provider.id) {
-    return {
-      status: 'blocked',
-      stopReason: 'provider_context_mismatch',
-      message: 'Current page does not match the requested provider.',
-      provider: currentProvider.id,
-    }
-  }
-  if (
-    request.targetUrl === undefined &&
-    !providerTransitionSource(provider, location.href) &&
-    !isProviderConversationUrl(provider, location.href)
-  ) {
-    return {
-      status: 'blocked',
-      stopReason: 'target_context_mismatch',
-      message: 'Current page is not an approved provider landing or conversation URL.',
-      provider: currentProvider.id,
-    }
-  }
-  if (
-    request.targetUrl !== undefined &&
-    !matchesExpectedTarget(location.href, request.targetUrl, provider) &&
-    !areProviderTransitionSourcesEquivalent(provider, location.href, request.targetUrl) &&
-    !allowsPostSubmitTargetTransition(provider, request, messageType)
-  ) {
-    return {
-      status: 'blocked',
-      stopReason: 'target_context_mismatch',
-      message: 'Current page does not match the requested provider target.',
-      provider: currentProvider.id,
-    }
-  }
-  return null
-}
-
-function allowsPostSubmitTargetTransition(
-  provider: ContentProvider,
-  request: ContentRecord,
-  messageType: string | undefined
-) {
-  if (
-    ![
-      'tokenless.bridge.read',
-      'tokenless.bridge.validate_landing',
-    ].includes(messageType ?? '') ||
-    request[POST_SUBMIT_TARGET_TRANSITION_FLAG] !== true ||
-    !isApprovedProviderTransition(provider, request.targetUrl, location.href)
-  ) {
-    return false
-  }
-  const storedBaseline = submissionBaselines.get(requestKey(request))
-  const suppliedBaseline = request.answerBaseline
-  const proof = request[POST_SUBMIT_TARGET_TRANSITION_PROOF]
-  const transitionSource = providerTransitionSource(provider, request.targetUrl)
-  if (
-    !validAnswerBaseline(suppliedBaseline) ||
-    !proof ||
-    typeof proof !== 'object' ||
-    Array.isArray(proof) ||
-    proof.requestId !== request.requestId ||
-    proof.provider !== provider.id ||
-    proof.targetUrl !== canonicalProviderUrl(request.targetUrl) ||
-    proof.sourceKind !== transitionSource?.kind ||
-    proof.customGptId !== transitionSource?.customGptId ||
-    proof.projectId !== transitionSource?.projectId ||
-    typeof proof.nonce !== 'string' ||
-    proof.nonce.length < 16 ||
-    !validAnswerBaseline(proof.answerBaseline) ||
-    proof.answerBaseline.count !== suppliedBaseline.count ||
-    proof.answerBaseline.lastText !== suppliedBaseline.lastText
-  ) {
-    return false
-  }
-  return !storedBaseline || (
-    storedBaseline.count === suppliedBaseline.count &&
-    storedBaseline.lastText === suppliedBaseline.lastText
-  )
-}
-
-function validAnswerBaseline(value: unknown): value is { count: number; lastText: string } {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) return false
-  const baseline = value as ContentRecord
-  return (
-    Number.isInteger(baseline.count) &&
-    baseline.count >= 0 &&
-    typeof baseline.lastText === 'string'
-  )
-}
-
-function matchesExpectedTarget(currentUrl: string, targetUrl: unknown, provider: ContentProvider) {
-  try {
-    const current = new URL(currentUrl)
-    const target = new URL(String(targetUrl))
-    return (
-      hasSafeProviderAuthority(provider, current) &&
-      hasSafeProviderAuthority(provider, target) &&
-      canonicalProviderUrl(current.href) === canonicalProviderUrl(target.href)
-    )
-  } catch {
-    return false
-  }
-}
-
-function publicPageUrl(url: string) {
-  try {
-    const parsed = new URL(url)
-    return `${parsed.origin}${parsed.pathname}`
-  } catch {
-    return ''
-  }
-}
-
-function selectorDrift(target: string) {
-  return {
-    status: 'blocked',
-    stopReason: 'selector_drift',
-    message: `Provider ${target} selector was not found or was not actionable.`,
-  }
-}
-
-function normalizeText(text: string) {
-  return text.replace(/\s+\n/g, '\n').replace(/\n{3,}/g, '\n\n').trim()
-}
-
-function delay(ms: number) {
-  return new Promise((resolve) => setTimeout(resolve, ms))
-}
-
-})()
diff --git a/legacy/extension/extension/icons/tokenless-128.png b/legacy/extension/extension/icons/tokenless-128.png
deleted file mode 100644
index ad8d411..0000000
Binary files a/legacy/extension/extension/icons/tokenless-128.png and /dev/null differ
diff --git a/legacy/extension/extension/icons/tokenless-16.png b/legacy/extension/extension/icons/tokenless-16.png
deleted file mode 100644
index 999b616..0000000
Binary files a/legacy/extension/extension/icons/tokenless-16.png and /dev/null differ
diff --git a/legacy/extension/extension/icons/tokenless-32.png b/legacy/extension/extension/icons/tokenless-32.png
deleted file mode 100644
index 7659555..0000000
Binary files a/legacy/extension/extension/icons/tokenless-32.png and /dev/null differ
diff --git a/legacy/extension/extension/icons/tokenless-48.png b/legacy/extension/extension/icons/tokenless-48.png
deleted file mode 100644
index 7f35eaa..0000000
Binary files a/legacy/extension/extension/icons/tokenless-48.png and /dev/null differ
diff --git a/legacy/extension/extension/manifest.json b/legacy/extension/extension/manifest.json
deleted file mode 100644
index 216119d..0000000
--- a/legacy/extension/extension/manifest.json
+++ /dev/null
@@ -1,60 +0,0 @@
-{
-  "manifest_version": 3,
-  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu5BmI93mXNt60DyYEi+1p72YpJn/j9Mqk/s7u4TrhT2dDL85vrJxccNBvWYtu1ieovHEfXckWkO5rZy2jC/0jEQ6XfiYWrYaDAWYSU7HCLc6IpOiWjW2qfhOVXsCF4WHqCz0KrgL1jGlI8NstKUmMaahvnvrd6kPJwP/sd+ea/rZLM5Vv1PZ1EC5zv7/IH9XeAX9T99s5vz6M3TVtIWobfP+ymnW986UjBOkjw8nd9jNsvTnTH1l8zVedCrAC+kNYBxMP4kcanM0cSh4Khgz9yus+8sYU8EEs1fa/bnOue4jJ1+52IIOMpZVM0JuGFCe58m8lzzva0P0+rqU79eYMwIDAQAB",
-  "name": "Tokenless",
-  "short_name": "Tokenless",
-  "version": "0.1.5",
-  "description": "Visible bridge for user-authorized ChatGPT, Claude, Gemini, and Grok web sessions.",
-  "homepage_url": "https://github.com/jazelly/tokenless",
-  "icons": {
-    "16": "icons/tokenless-16.png",
-    "32": "icons/tokenless-32.png",
-    "48": "icons/tokenless-48.png",
-    "128": "icons/tokenless-128.png"
-  },
-  "permissions": [
-    "debugger",
-    "nativeMessaging",
-    "scripting",
-    "tabs",
-    "sidePanel"
-  ],
-  "host_permissions": [
-    "https://chatgpt.com/*",
-    "https://chat.openai.com/*",
-    "https://gemini.google.com/*",
-    "https://claude.ai/*",
-    "https://grok.com/*"
-  ],
-  "background": {
-    "service_worker": "background/service-worker.js",
-    "type": "module"
-  },
-  "content_scripts": [
-    {
-      "matches": [
-        "https://chatgpt.com/*",
-        "https://chat.openai.com/*",
-        "https://gemini.google.com/*",
-        "https://claude.ai/*",
-        "https://grok.com/*"
-      ],
-      "js": [
-        "content/provider-content.js"
-      ],
-      "run_at": "document_idle"
-    }
-  ],
-  "side_panel": {
-    "default_path": "settings/index.html"
-  },
-  "action": {
-    "default_title": "Open Tokenless settings",
-    "default_icon": {
-      "16": "icons/tokenless-16.png",
-      "32": "icons/tokenless-32.png",
-      "48": "icons/tokenless-48.png",
-      "128": "icons/tokenless-128.png"
-    }
-  }
-}
diff --git a/legacy/extension/extension/settings/index.css b/legacy/extension/extension/settings/index.css
deleted file mode 100644
index 87b99d4..0000000
--- a/legacy/extension/extension/settings/index.css
+++ /dev/null
@@ -1,679 +0,0 @@
-:root {
-  color-scheme: light;
-  font-family: "Instrument Sans", "Avenir Next", "Helvetica Neue", sans-serif;
-  background: #fdf8f7;
-  color: #1c1b1b;
-  font-synthesis: none;
-}
-
-* {
-  box-sizing: border-box;
-}
-
-body {
-  margin: 0;
-  min-width: 320px;
-}
-
-main {
-  display: grid;
-  gap: 24px;
-  margin: 0;
-  min-height: 100vh;
-  padding: 24px;
-  width: 100%;
-}
-
-h1,
-h2,
-p {
-  margin: 0;
-}
-
-.hero,
-.section-heading,
-.job-heading,
-.provider-row,
-.form-actions {
-  align-items: center;
-  display: flex;
-  justify-content: space-between;
-}
-
-.hero,
-.section-heading,
-.job-heading,
-.provider-row,
-.form-actions {
-  gap: 16px;
-  min-width: 0;
-}
-
-.hero {
-  align-items: center;
-  border-bottom: 1px solid #ddd9d0;
-  padding-bottom: 16px;
-}
-
-.hero-leading {
-  align-items: center;
-  display: flex;
-  gap: 10px;
-  min-width: 0;
-}
-
-.brand {
-  align-items: center;
-  display: flex;
-  flex: 0 0 auto;
-  gap: 8px;
-}
-
-.brand img {
-  border-radius: 7px;
-  display: block;
-}
-
-.brand span {
-  font-size: 15px;
-  font-weight: 700;
-  letter-spacing: -0.02em;
-}
-
-.hero-actions {
-  align-items: center;
-  display: flex;
-  gap: 8px;
-}
-
-.language-switch {
-  align-items: center;
-  border: 1px solid #ddd9d0;
-  border-radius: 8px;
-  display: flex;
-  gap: 2px;
-  padding: 2px;
-}
-
-.language-button {
-  background: transparent;
-  border-color: transparent;
-  color: #77756d;
-  font-family: "IBM Plex Mono", "SFMono-Regular", Consolas, monospace;
-  font-size: 10px;
-  font-weight: 600;
-  min-height: 24px;
-  padding: 3px 6px;
-}
-
-.language-button:hover:not(:disabled) {
-  background: #f1edec;
-  color: #474741;
-}
-
-.language-button.is-active {
-  background: #20201d;
-  color: #fdf8f7;
-}
-
-.language-default-button {
-  background: transparent;
-  border-color: transparent;
-  color: #77756d;
-  font-size: 10px;
-  font-weight: 600;
-  min-height: 24px;
-  padding: 3px 6px;
-}
-
-.language-default-button:hover:not(:disabled) {
-  background: #f1edec;
-  color: #474741;
-}
-
-.language-default-button.is-active {
-  background: #20201d;
-  color: #fdf8f7;
-}
-
-.locale-preference {
-  align-items: center;
-  background: #f7f3f1;
-  border: 1px solid #ddd9d0;
-  border-radius: 8px;
-  display: flex;
-  gap: 16px;
-  justify-content: space-between;
-  padding: 12px 14px;
-}
-
-.locale-copy {
-  display: grid;
-  gap: 4px;
-}
-
-.locale-copy strong {
-  font-family: "IBM Plex Mono", "SFMono-Regular", Consolas, monospace;
-  font-size: 10px;
-  letter-spacing: 0.08em;
-  text-transform: uppercase;
-}
-
-.locale-copy span {
-  color: #77756d;
-  font-size: 12px;
-  line-height: 1.4;
-}
-
-.view-tabs {
-  display: flex;
-  gap: 4px;
-}
-
-.hero[data-view="settings"] #refresh {
-  visibility: hidden;
-}
-
-.view-tab {
-  background: transparent;
-  border-color: transparent;
-  color: #77756d;
-  font-size: 12px;
-  min-height: 30px;
-  padding: 5px 8px;
-}
-
-.view-tab:hover:not(:disabled) {
-  background: #f1edec;
-  color: #474741;
-}
-
-.view-tab.is-active {
-  background: #20201d;
-  color: #fdf8f7;
-}
-
-.panel[hidden] {
-  display: none;
-}
-
-.eyebrow,
-.provider-heading,
-.field > span:first-child {
-  color: #77756d;
-  font-family: "IBM Plex Mono", "SFMono-Regular", Consolas, monospace;
-  font-size: 10px;
-  font-weight: 600;
-  letter-spacing: 0.1em;
-  line-height: 1.2;
-  text-transform: uppercase;
-}
-
-.eyebrow {
-  margin-bottom: 8px;
-}
-
-h1 {
-  font-size: 26px;
-  font-weight: 600;
-  letter-spacing: -0.035em;
-  line-height: 1;
-}
-
-.lede {
-  color: #605e57;
-  font-size: 13px;
-  line-height: 1.5;
-  margin-top: 10px;
-  max-width: 340px;
-}
-
-.status,
-.badge {
-  border: 1px solid #ddd9d0;
-  border-radius: 8px;
-  flex: 0 0 auto;
-  font-family: "IBM Plex Mono", "SFMono-Regular", Consolas, monospace;
-  font-size: 10px;
-  font-weight: 600;
-  letter-spacing: 0.03em;
-  line-height: 1;
-  padding: 8px 9px;
-  text-transform: uppercase;
-}
-
-.status {
-  border: 0;
-  border-radius: 50%;
-  font-size: 0;
-  height: 9px;
-  padding: 0;
-  width: 9px;
-}
-
-.status[data-tone="ready"] {
-  background: #287a5a;
-}
-
-.status[data-tone="error"] {
-  background: #b54735;
-}
-
-.status[data-tone="loading"] {
-  background: #af6b17;
-}
-
-.panel {
-  background: transparent;
-  border: 0;
-  display: grid;
-  gap: 16px;
-  min-width: 0;
-  padding: 0;
-}
-
-.section-heading {
-  align-items: flex-start;
-}
-
-h2 {
-  font-size: 15px;
-  font-weight: 600;
-  letter-spacing: -0.01em;
-  line-height: 1.25;
-}
-
-.section-heading p,
-.field-help,
-.provider-copy span,
-.job-meta,
-.job-id,
-.notice,
-.state-card,
-.safety-note span {
-  color: #77756d;
-  font-size: 12px;
-  line-height: 1.5;
-}
-
-.section-heading p {
-  margin-top: 5px;
-}
-
-button,
-input,
-select {
-  font: inherit;
-}
-
-button {
-  border: 1px solid transparent;
-  border-radius: 8px;
-  cursor: pointer;
-  font-size: 12px;
-  font-weight: 600;
-  min-height: 34px;
-  padding: 7px 10px;
-}
-
-button:disabled {
-  cursor: default;
-  opacity: 0.45;
-}
-
-button:focus-visible,
-input:focus-visible,
-select:focus-visible {
-  outline: 2px solid #20201d;
-  outline-offset: 2px;
-}
-
-.primary-button {
-  background: #20201d;
-  color: #fdf8f7;
-}
-
-.primary-button:hover:not(:disabled) {
-  background: #080806;
-}
-
-.secondary-button,
-.row-button {
-  background: transparent;
-  border-color: #c8c7be;
-  color: #474741;
-}
-
-.secondary-button:hover:not(:disabled),
-.row-button:hover:not(:disabled) {
-  background: #f1edec;
-  border-color: #787770;
-}
-
-.row-button[data-tone="danger"]:hover:not(:disabled) {
-  background: #fff0ed;
-  border-color: #b54735;
-  color: #9d3d2c;
-}
-
-.configuration-form,
-.provider-editor,
-.history {
-  display: grid;
-  gap: 12px;
-}
-
-.provider-editor,
-.history,
-.form-grid,
-.state-card,
-.job-card {
-  background: #f7f3f1;
-  border: 1px solid #ddd9d0;
-  border-radius: 8px;
-}
-
-.provider-editor {
-  gap: 14px;
-  padding: 16px;
-}
-
-.form-grid {
-  display: grid;
-  gap: 12px;
-  grid-template-columns: repeat(2, minmax(0, 1fr));
-  padding: 16px;
-}
-
-.field {
-  display: grid;
-  gap: 7px;
-}
-
-input,
-select {
-  background: #fdf8f7;
-  border: 1px solid #c8c7be;
-  border-radius: 8px;
-  color: #1c1b1b;
-  font-size: 13px;
-  min-height: 38px;
-  min-width: 0;
-  padding: 8px 10px;
-  width: 100%;
-}
-
-.provider-list {
-  display: grid;
-  gap: 8px;
-}
-
-.provider-row {
-  background: #fdf8f7;
-  border: 1px solid #ddd9d0;
-  border-radius: 8px;
-  min-height: 58px;
-  padding: 10px 12px;
-}
-
-.provider-row[data-preferred="true"] {
-  border-color: #77756d;
-}
-
-.provider-identity {
-  align-items: center;
-  display: flex;
-  gap: 10px;
-  min-width: 0;
-}
-
-.provider-rank {
-  align-items: center;
-  background: #20201d;
-  border-radius: 50%;
-  color: #fdf8f7;
-  display: inline-flex;
-  flex: 0 0 24px;
-  font-family: "IBM Plex Mono", "SFMono-Regular", Consolas, monospace;
-  font-size: 10px;
-  font-weight: 600;
-  height: 24px;
-  justify-content: center;
-}
-
-.provider-copy {
-  display: grid;
-  gap: 1px;
-  min-width: 0;
-}
-
-.provider-copy strong {
-  font-size: 13px;
-}
-
-.provider-controls {
-  display: flex;
-  flex: 0 0 auto;
-  flex-wrap: wrap;
-  gap: 6px;
-}
-
-.row-button {
-  min-height: 28px;
-  padding: 4px 7px;
-}
-
-.provider-controls .row-button {
-  align-items: center;
-  display: inline-flex;
-  font-family: "IBM Plex Mono", "SFMono-Regular", Consolas, monospace;
-  font-size: 15px;
-  justify-content: center;
-  min-width: 30px;
-  padding: 3px 6px;
-}
-
-.provider-controls .row-button:last-child {
-  font-family: "Instrument Sans", "Avenir Next", "Helvetica Neue", sans-serif;
-  font-size: 12px;
-  min-width: auto;
-}
-
-.provider-add {
-  display: grid;
-  gap: 8px;
-  grid-template-columns: minmax(0, 1fr) auto;
-}
-
-.provider-add-disabled {
-  display: contents;
-}
-
-.provider-add-disabled > select:disabled,
-.provider-add-disabled > button:disabled {
-  cursor: not-allowed;
-  opacity: 0.5;
-}
-
-.provider-add-disabled::after {
-  background: #20201d;
-  border-radius: 6px;
-  color: #fdf8f7;
-  content: attr(data-tooltip);
-  font-size: 11px;
-  left: 0;
-  line-height: 1.35;
-  max-width: 220px;
-  opacity: 0;
-  padding: 7px 9px;
-  pointer-events: none;
-  position: absolute;
-  top: calc(100% + 6px);
-  transform: translateY(-2px);
-  transition: opacity 120ms ease, transform 120ms ease;
-  visibility: hidden;
-  z-index: 1;
-}
-
-.provider-add-disabled:hover::after,
-.provider-add-disabled:focus-within::after {
-  opacity: 1;
-  transform: translateY(0);
-  visibility: visible;
-}
-
-.form-actions {
-  border-top: 1px solid #ddd9d0;
-  padding-top: 14px;
-}
-
-.notice[data-tone="error"] {
-  color: #9d3d2c;
-}
-
-.notice[data-tone="success"] {
-  color: #246448;
-}
-
-.state-card {
-  border-style: dashed;
-  padding: 18px;
-  text-align: center;
-}
-
-.state-card[data-state="error"] {
-  background: #fff0ed;
-  border-color: #e6bdb6;
-  color: #9d3d2c;
-}
-
-.safety-note {
-  background: #f7f3f1;
-  border: 1px solid #ddd9d0;
-  border-radius: 8px;
-  display: grid;
-  gap: 5px;
-  padding: 13px 14px;
-}
-
-.safety-note strong {
-  color: #474741;
-  font-size: 12px;
-}
-
-.history {
-  padding: 8px;
-}
-
-.job-card {
-  background: #fdf8f7;
-  display: grid;
-  gap: 9px;
-  padding: 13px;
-}
-
-.job-heading {
-  align-items: flex-start;
-}
-
-.job-title {
-  font-size: 13px;
-  font-weight: 600;
-  overflow-wrap: anywhere;
-}
-
-.job-badges {
-  display: flex;
-  flex: 0 0 auto;
-  flex-wrap: wrap;
-  gap: 5px;
-  justify-content: flex-end;
-}
-
-.badge {
-  color: #605e57;
-  font-size: 9px;
-  padding: 5px 6px;
-  text-transform: capitalize;
-}
-
-.badge[data-status="succeeded"] {
-  background: #eaf4ee;
-  border-color: #bad6c3;
-  color: #246448;
-}
-
-.badge[data-status="failed"],
-.badge[data-status="timed_out"],
-.badge[data-status="canceled"] {
-  background: #fff0ed;
-  border-color: #e6bdb6;
-  color: #9d3d2c;
-}
-
-.job-meta {
-  display: flex;
-  flex-wrap: wrap;
-  gap: 4px 12px;
-}
-
-.job-id {
-  font-family: "IBM Plex Mono", "SFMono-Regular", Consolas, monospace;
-  font-size: 10px;
-  overflow-wrap: anywhere;
-}
-
-.project-link {
-  border-top: 1px solid #ddd9d0;
-  padding-top: 16px;
-}
-
-.project-link a {
-  align-items: center;
-  color: #474741;
-  display: inline-flex;
-  font-family: "IBM Plex Mono", "SFMono-Regular", Consolas, monospace;
-  font-family: "IBM Plex Mono", "SFMono-Regular", Consolas, monospace;
-  font-size: 10px;
-  font-weight: 600;
-  gap: 8px;
-  letter-spacing: 0.08em;
-  text-transform: uppercase;
-}
-
-.project-link a:hover {
-  color: #080806;
-}
-
-.project-link svg {
-  height: 16px;
-  width: 16px;
-}
-
-.external-mark {
-  color: #77756d;
-  font-size: 14px;
-  line-height: 1;
-}
-
-@media (max-width: 380px) {
-  main {
-    gap: 20px;
-    padding: 18px;
-  }
-
-  .section-heading,
-  .form-actions {
-    align-items: flex-start;
-    flex-direction: column;
-  }
-
-  .form-grid {
-    grid-template-columns: 1fr;
-  }
-
-  .provider-row {
-    align-items: flex-start;
-    flex-direction: column;
-  }
-}
diff --git a/legacy/extension/extension/settings/index.html b/legacy/extension/extension/settings/index.html
deleted file mode 100644
index c2eb026..0000000
--- a/legacy/extension/extension/settings/index.html
+++ /dev/null
@@ -1,75 +0,0 @@
-<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1">
-    <title>Tokenless</title>
-    <link rel="stylesheet" href="index.css">
-  </head>
-  <body>
-    <main>
-      <header class="hero" data-view="activity">
-        <div class="hero-leading">
-          <div class="brand" aria-label="Tokenless">
-            <img src="../icons/tokenless-48.png" alt="" width="32" height="32">
-            <span>Tokenless</span>
-          </div>
-          <span id="page-status" class="status" data-tone="loading" role="status">Connecting…</span>
-          <nav class="view-tabs" data-i18n-aria-label="navigation.label">
-            <button type="button" class="view-tab is-active" data-view="activity" data-i18n="navigation.activity" aria-selected="true">Activity</button>
-            <button type="button" class="view-tab" data-view="settings" data-i18n="navigation.settings" aria-selected="false">Settings</button>
-          </nav>
-        </div>
-        <div class="hero-actions">
-          <button id="refresh" type="button" class="secondary-button" data-i18n="action.refresh">Refresh</button>
-        </div>
-      </header>
-
-      <section class="panel" data-view-panel="settings" aria-labelledby="configuration-heading" hidden>
-        <div class="section-heading">
-          <div>
-            <h2 id="configuration-heading" data-i18n="settings.routing">Routing</h2>
-            <p data-i18n="settings.routingDescription">Provider preferences are stored locally on this computer.</p>
-          </div>
-        </div>
-        <div class="locale-preference">
-          <div class="locale-copy">
-            <strong data-i18n="language.label">Language</strong>
-            <span data-i18n="language.description">Uses Chrome's language until you choose an override.</span>
-          </div>
-          <div class="language-switch" role="group" data-i18n-aria-label="language.label">
-            <button type="button" class="language-button" data-locale="en" aria-pressed="false">EN</button>
-            <button type="button" class="language-button" data-locale="zh-CN" aria-pressed="false">中文</button>
-            <button type="button" class="language-default-button" data-use-browser-language="true" aria-pressed="true" data-i18n="language.useChromeDefault">Use Chrome default</button>
-          </div>
-        </div>
-        <div id="configuration" aria-live="polite">
-          <div class="state-card" data-state="loading">Loading configuration…</div>
-        </div>
-      </section>
-
-      <section class="panel" data-view-panel="activity" aria-labelledby="history-heading">
-        <div class="section-heading">
-          <div>
-            <h2 id="history-heading" data-i18n="activity.recent">Recent activity</h2>
-            <p data-i18n="activity.description">Newest local jobs first. Prompts and answers are never shown here.</p>
-          </div>
-        </div>
-        <div id="history" class="history" aria-live="polite">
-          <div class="state-card" data-state="loading">Loading daemon history…</div>
-        </div>
-      </section>
-
-      <aside class="project-link">
-        <a href="https://github.com/jazelly/tokenless" target="_blank" rel="noreferrer">
-          <svg aria-hidden="true" viewBox="0 0 16 16" fill="currentColor">
-            <path d="M8 0a8 8 0 0 0-2.53 15.59c.4.07.55-.17.55-.38v-1.49c-2.23.49-2.7-.95-2.7-.95-.36-.93-.89-1.18-.89-1.18-.73-.5.06-.49.06-.49.8.06 1.23.83 1.23.83.72 1.23 1.87.88 2.33.67.07-.52.28-.88.51-1.08-1.78-.2-3.65-.89-3.65-3.96 0-.88.31-1.59.83-2.15-.08-.2-.36-1.02.08-2.12 0 0 .68-.22 2.2.82A7.7 7.7 0 0 1 8 4.8c.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.52.56.83 1.27.83 2.15 0 3.08-1.88 3.75-3.66 3.95.29.25.54.73.54 1.48v2.2c0 .21.14.45.55.38A8 8 0 0 0 8 0Z" />
-          </svg>
-          <span data-i18n="github.link">View Tokenless on GitHub</span>
-          <span class="external-mark" aria-hidden="true">↗</span>
-        </a>
-      </aside>
-    </main>
-    <script type="module" src="index.js"></script>
-  </body>
-</html>
diff --git a/legacy/extension/extension/settings/index.ts b/legacy/extension/extension/settings/index.ts
deleted file mode 100644
index 70cbadd..0000000
--- a/legacy/extension/extension/settings/index.ts
+++ /dev/null
@@ -1,789 +0,0 @@
-import {
-  createNativeMessage,
-  isNativeMessage,
-  NATIVE_MESSAGE_TYPES,
-  NATIVE_PROTOCOL_VERSION,
-} from '../shared/native-protocol.js'
-import { listProviders } from '../shared/provider-config.js'
-import {
-  configWritePayload,
-  normalizeHistoryEntries,
-  normalizeProviderOrder,
-} from './model.js'
-import type { HistoryEntry } from './model.js'
-
-type SettingsRecord = Record<string, any>
-type NoticeTone = 'error' | 'loading' | 'success'
-type ProviderControlAction = 'up' | 'down' | 'remove'
-type ProviderFocusIntent = {
-  providerId?: string
-  action?: ProviderControlAction
-  fallback?: 'provider-add' | 'save'
-}
-type Locale = 'en' | 'zh-CN'
-type PageStatusTone = 'error' | 'loading' | 'ready'
-
-const translations: Record<Locale, Record<string, string>> = {
-  en: {
-    'navigation.label': 'Tokenless panel views',
-    'navigation.activity': 'Activity',
-    'navigation.settings': 'Settings',
-    'language.label': 'Language',
-    'language.description': 'Uses Chrome\'s language until you choose an override.',
-    'language.useChromeDefault': 'Use Chrome default',
-    'settings.routing': 'Routing',
-    'settings.routingDescription': 'Provider preferences are stored locally on this computer.',
-    'activity.recent': 'Recent activity',
-    'activity.description': 'Newest local jobs first. Prompts and answers are never shown here.',
-    'github.link': 'View Tokenless on GitHub',
-    'provider.preference': 'Provider preference',
-    'provider.noPreference': 'No preference saved. New jobs default to ChatGPT.',
-    'provider.preferred': 'Preferred provider',
-    'provider.fallback': 'Fallback provider',
-    'provider.moveUp': 'Move {provider} up',
-    'provider.moveDown': 'Move {provider} down',
-    'provider.removeAction': 'Remove',
-    'provider.remove': 'Remove {provider}',
-    'provider.select': 'Provider to add',
-    'provider.add': 'Add provider',
-    'provider.addUnavailable': 'Adding providers is temporarily unavailable.',
-    'settings.browserPreference': 'Browser preference',
-    'settings.browserPlaceholder': 'Auto-detect Chromium',
-    'settings.browserHelp': 'Optional supported Chromium browser; otherwise Tokenless detects one deterministically.',
-    'settings.daemonUrl': 'Daemon URL',
-    'settings.daemonHelp': 'The loopback address of the local Tokenless daemon.',
-    'settings.save': 'Save settings',
-    'settings.saving': 'Saving…',
-    'settings.unsaved': 'Unsaved changes',
-    'settings.saved': 'Settings saved.',
-    'settings.savingNotice': 'Saving settings…',
-    'settings.unavailable': 'Configuration is unavailable.',
-    'settings.saveFailed': 'Settings could not be saved.',
-    'history.loading': 'Loading daemon history…',
-    'history.unavailable': 'Daemon history is unavailable.',
-    'history.empty': 'No daemon jobs yet.',
-    'history.project': 'Project: {value}',
-    'history.action': 'Action: {value}',
-    'history.updated': 'Updated: {value}',
-    'history.task': 'Task: {value}',
-    'history.jobId': 'Job ID: {value}',
-    'configuration.loading': 'Loading configuration…',
-    'status.connecting': 'Connecting…',
-    'status.nativeHostReady': 'Native host ready',
-    'status.nativeHostUnavailable': 'Native host unavailable',
-    'status.partiallyLoaded': 'Partially loaded',
-    'status.refreshingHistory': 'Refreshing history…',
-    'status.historyRefreshFailed': 'History refresh failed',
-    'status.saveFailed': 'Save failed',
-    'action.refresh': 'Refresh',
-    'action.refreshing': 'Refreshing…',
-    'value.unknown': 'Unknown',
-    'action.submit_and_read': 'Submit and read',
-    'action.submit': 'Submit',
-    'action.read': 'Read',
-    'action.open': 'Open',
-    'job.queued': 'Queued',
-    'job.claimed': 'Claimed',
-    'job.running': 'Running',
-    'job.succeeded': 'Succeeded',
-    'job.failed': 'Failed',
-    'job.canceled': 'Canceled',
-    'job.timed_out': 'Timed out',
-    'error.readConfig': 'The native host could not read configuration.',
-    'error.saveConfig': 'The native host could not save configuration.',
-    'error.listHistory': 'The native host could not list daemon history.',
-    'error.nativeTimeout': 'Native host did not respond to {type}.',
-    'error.nativeProtocol': 'Native host response must use {protocol} and match {type}.',
-    'error.nativeDisconnected': 'Native host disconnected.',
-  },
-  'zh-CN': {
-    'navigation.label': 'Tokenless 侧栏视图',
-    'navigation.activity': '动态',
-    'navigation.settings': '设置',
-    'language.label': '语言',
-    'language.description': '在选择覆盖语言前，跟随 Chrome 的语言。',
-    'language.useChromeDefault': '使用 Chrome 默认语言',
-    'settings.routing': '路由',
-    'settings.routingDescription': 'Provider 偏好仅保存在这台电脑上。',
-    'activity.recent': '最近动态',
-    'activity.description': '最新本地任务优先显示；这里不会显示 prompt 或回答。',
-    'github.link': '在 GitHub 查看 Tokenless',
-    'provider.preference': 'Provider 偏好',
-    'provider.noPreference': '尚未保存偏好。新任务默认使用 ChatGPT。',
-    'provider.preferred': '首选 Provider',
-    'provider.fallback': '备用 Provider',
-    'provider.moveUp': '将 {provider} 上移',
-    'provider.moveDown': '将 {provider} 下移',
-    'provider.removeAction': '移除',
-    'provider.remove': '移除 {provider}',
-    'provider.select': '选择要添加的 Provider',
-    'provider.add': '添加 Provider',
-    'provider.addUnavailable': '暂不支持添加 Provider。',
-    'settings.browserPreference': '浏览器偏好',
-    'settings.browserPlaceholder': '自动检测 Chromium',
-    'settings.browserHelp': '可选的受支持 Chromium 浏览器；否则 Tokenless 会按固定顺序自动检测。',
-    'settings.daemonUrl': 'Daemon URL',
-    'settings.daemonHelp': '本地 Tokenless daemon 的 loopback 地址。',
-    'settings.save': '保存设置',
-    'settings.saving': '正在保存…',
-    'settings.unsaved': '尚未保存的更改',
-    'settings.saved': '设置已保存。',
-    'settings.savingNotice': '正在保存设置…',
-    'settings.unavailable': '配置暂时不可用。',
-    'settings.saveFailed': '无法保存设置。',
-    'history.loading': '正在加载 daemon 历史记录…',
-    'history.unavailable': 'Daemon 历史记录暂时不可用。',
-    'history.empty': '尚无 daemon 任务。',
-    'history.project': '项目：{value}',
-    'history.action': '操作：{value}',
-    'history.updated': '更新：{value}',
-    'history.task': '任务：{value}',
-    'history.jobId': '任务 ID：{value}',
-    'configuration.loading': '正在加载配置…',
-    'status.connecting': '正在连接…',
-    'status.nativeHostReady': 'Native host 已就绪',
-    'status.nativeHostUnavailable': 'Native host 不可用',
-    'status.partiallyLoaded': '部分内容未加载',
-    'status.refreshingHistory': '正在刷新历史记录…',
-    'status.historyRefreshFailed': '历史记录刷新失败',
-    'status.saveFailed': '保存失败',
-    'action.refresh': '刷新',
-    'action.refreshing': '正在刷新…',
-    'value.unknown': '未知',
-    'action.submit_and_read': '提交并读取',
-    'action.submit': '提交',
-    'action.read': '读取',
-    'action.open': '打开',
-    'job.queued': '排队中',
-    'job.claimed': '已领取',
-    'job.running': '运行中',
-    'job.succeeded': '已完成',
-    'job.failed': '失败',
-    'job.canceled': '已取消',
-    'job.timed_out': '已超时',
-    'error.readConfig': 'Native host 无法读取配置。',
-    'error.saveConfig': 'Native host 无法保存配置。',
-    'error.listHistory': 'Native host 无法读取 daemon 历史记录。',
-    'error.nativeTimeout': 'Native host 未响应 {type}。',
-    'error.nativeProtocol': 'Native host 响应必须使用 {protocol} 并匹配 {type}。',
-    'error.nativeDisconnected': 'Native host 已断开连接。',
-  },
-}
-
-const NATIVE_HOST_NAME = 'dev.tokenless.native_host'
-const NATIVE_REQUEST_TIMEOUT_MS = 10000
-const providers = listProviders()
-const supportedProviderIds = providers.map((provider) => provider.id)
-const configuration = document.querySelector<HTMLElement>('#configuration')
-const history = document.querySelector<HTMLElement>('#history')
-const refreshButton = document.querySelector<HTMLButtonElement>('#refresh')
-const pageStatus = document.querySelector<HTMLElement>('#page-status')
-const hero = document.querySelector<HTMLElement>('.hero')
-const viewButtons = Array.from(document.querySelectorAll<HTMLButtonElement>('[data-view]'))
-const viewPanels = Array.from(document.querySelectorAll<HTMLElement>('[data-view-panel]'))
-const localeButtons = Array.from(document.querySelectorAll<HTMLButtonElement>('[data-locale]'))
-const browserLanguageButton = document.querySelector<HTMLButtonElement>('[data-use-browser-language]')
-
-let providerOrder: string[] = []
-let browserPreference = ''
-let daemonUrl = ''
-let isSaving = false
-let isHistoryRefreshing = false
-let localePreference = readLocalePreference()
-let locale = localePreference ?? chromeLocale()
-let lastHistoryEntries: HistoryEntry[] | null = null
-let currentStatusKey = 'status.connecting'
-let currentStatusTone: PageStatusTone = 'loading'
-
-applyLocale()
-
-viewButtons.forEach((button) => {
-  button.addEventListener('click', () => {
-    setActiveView(button.dataset.view)
-  })
-})
-
-localeButtons.forEach((button) => {
-  button.addEventListener('click', () => {
-    setLocale(button.dataset.locale)
-  })
-})
-
-browserLanguageButton?.addEventListener('click', () => {
-  useChromeLocale()
-})
-
-refreshButton?.addEventListener('click', () => {
-  void refreshHistory()
-})
-
-setActiveView('activity')
-void loadInitialSettings()
-
-function setActiveView(view: string | undefined) {
-  if (view !== 'activity' && view !== 'settings') return
-  if (hero) hero.dataset.view = view
-  viewButtons.forEach((button) => {
-    const active = button.dataset.view === view
-    button.classList.toggle('is-active', active)
-    button.setAttribute('aria-selected', String(active))
-  })
-  viewPanels.forEach((panel) => {
-    panel.hidden = panel.dataset.viewPanel !== view
-  })
-}
-
-async function loadInitialSettings() {
-  isHistoryRefreshing = true
-  setRefreshState(true)
-  setPageStatus('status.connecting', 'loading')
-  renderConfigurationState(t('configuration.loading'), 'loading')
-  renderHistoryState(t('history.loading'), 'loading')
-
-  const [configResult, historyResult] = await Promise.allSettled([
-    loadConfig(),
-    loadHistory(),
-  ])
-
-  isHistoryRefreshing = false
-  setRefreshState(false)
-  const failures = [configResult, historyResult].filter((result) => result.status === 'rejected')
-  if (failures.length === 0) {
-    setPageStatus('status.nativeHostReady', 'ready')
-  } else {
-    setPageStatus(failures.length === 2 ? 'status.nativeHostUnavailable' : 'status.partiallyLoaded', 'error')
-  }
-}
-
-async function refreshHistory() {
-  if (isHistoryRefreshing) return
-  isHistoryRefreshing = true
-  setRefreshState(true)
-  setPageStatus('status.refreshingHistory', 'loading')
-  renderHistoryState(t('history.loading'), 'loading')
-  try {
-    await loadHistory()
-    setPageStatus('status.nativeHostReady', 'ready')
-  } catch {
-    setPageStatus('status.historyRefreshFailed', 'error')
-  } finally {
-    isHistoryRefreshing = false
-    setRefreshState(false)
-  }
-}
-
-async function loadConfig() {
-  try {
-    const response = await nativeRequest(NATIVE_MESSAGE_TYPES.READ_CONFIG)
-    if (!response.ok) {
-      throw new Error(response.error?.message || t('error.readConfig'))
-    }
-    const config = objectRecord(response.result)
-    providerOrder = normalizeProviderOrder(config.preferredProviders, supportedProviderIds)
-    browserPreference = stringValue(config.browser)
-    daemonUrl = stringValue(config.daemonUrl)
-    renderConfigEditor()
-  } catch (error) {
-    renderConfigurationState(errorMessage(error, t('settings.unavailable')), 'error')
-    throw error
-  }
-}
-
-function renderConfigEditor(
-  message?: string,
-  tone: NoticeTone = 'success',
-  focusIntent?: ProviderFocusIntent
-) {
-  if (!configuration) return
-  const form = document.createElement('form')
-  form.className = 'configuration-form'
-
-  const providerEditor = document.createElement('div')
-  providerEditor.className = 'provider-editor'
-  const providerHeading = document.createElement('div')
-  providerHeading.className = 'provider-heading'
-  providerHeading.textContent = t('provider.preference')
-  providerEditor.append(providerHeading)
-
-  const providerList = document.createElement('div')
-  providerList.className = 'provider-list'
-  if (providerOrder.length === 0) {
-    providerList.append(stateNode(t('provider.noPreference'), 'empty'))
-  } else {
-    providerList.append(...providerOrder.map(renderProviderRow))
-  }
-  providerEditor.append(providerList)
-
-  const addRow = renderProviderAddRow()
-  if (addRow) providerEditor.append(addRow)
-
-  const formGrid = document.createElement('div')
-  formGrid.className = 'form-grid'
-  const browserField = textField({
-    label: t('settings.browserPreference'),
-    value: browserPreference,
-    placeholder: t('settings.browserPlaceholder'),
-    help: t('settings.browserHelp'),
-    onInput: (value) => { browserPreference = value },
-  })
-  const daemonField = textField({
-    label: t('settings.daemonUrl'),
-    value: daemonUrl,
-    placeholder: 'http://127.0.0.1:7331',
-    help: t('settings.daemonHelp'),
-    inputMode: 'url',
-    onInput: (value) => { daemonUrl = value },
-  })
-  formGrid.append(browserField, daemonField)
-
-  const actions = document.createElement('div')
-  actions.className = 'form-actions'
-  const notice = document.createElement('span')
-  notice.className = 'notice'
-  if (message) {
-    notice.textContent = message
-    notice.dataset.tone = tone
-  }
-  const save = document.createElement('button')
-  save.type = 'submit'
-  save.className = 'primary-button'
-  save.disabled = isSaving
-  save.textContent = isSaving ? t('settings.saving') : t('settings.save')
-  actions.append(notice, save)
-
-  form.append(providerEditor, formGrid, actions)
-  form.addEventListener('submit', (event) => {
-    event.preventDefault()
-    void saveConfig()
-  })
-  configuration.replaceChildren(form)
-  if (focusIntent) restoreProviderFocus(focusIntent)
-}
-
-function renderProviderRow(providerId: string, index: number) {
-  const row = document.createElement('div')
-  row.className = 'provider-row'
-  row.dataset.preferred = String(index === 0)
-  row.dataset.providerId = providerId
-
-  const identity = document.createElement('div')
-  identity.className = 'provider-identity'
-  const rank = document.createElement('span')
-  rank.className = 'provider-rank'
-  rank.textContent = String(index + 1)
-  const copy = document.createElement('div')
-  copy.className = 'provider-copy'
-  const label = document.createElement('strong')
-  label.textContent = providerLabel(providerId)
-  const description = document.createElement('span')
-  description.textContent = index === 0 ? t('provider.preferred') : t('provider.fallback')
-  copy.append(label, description)
-  identity.append(rank, copy)
-
-  const controls = document.createElement('div')
-  controls.className = 'provider-controls'
-  const providerName = providerLabel(providerId)
-  controls.append(
-    rowButton('↑', t('provider.moveUp', { provider: providerName }), providerId, 'up', () => moveProvider(index, -1), index === 0),
-    rowButton('↓', t('provider.moveDown', { provider: providerName }), providerId, 'down', () => moveProvider(index, 1), index === providerOrder.length - 1),
-    rowButton(t('provider.removeAction'), t('provider.remove', { provider: providerName }), providerId, 'remove', () => removeProvider(index), false, 'danger')
-  )
-  row.append(identity, controls)
-  return row
-}
-
-function renderProviderAddRow() {
-  const remaining = supportedProviderIds.filter((providerId) => !providerOrder.includes(providerId))
-  if (remaining.length === 0) return null
-  const row = document.createElement('div')
-  row.className = 'provider-add'
-  const select = document.createElement('select')
-  select.setAttribute('aria-label', t('provider.select'))
-  select.disabled = true
-  select.replaceChildren(...remaining.map((providerId) => {
-    const option = document.createElement('option')
-    option.value = providerId
-    option.textContent = providerLabel(providerId)
-    return option
-  }))
-  const add = document.createElement('button')
-  add.type = 'button'
-  add.className = 'secondary-button'
-  add.textContent = t('provider.add')
-  add.disabled = true
-  const disabledControl = document.createElement('span')
-  disabledControl.className = 'provider-add-disabled'
-  disabledControl.dataset.tooltip = t('provider.addUnavailable')
-  disabledControl.setAttribute('aria-label', t('provider.addUnavailable'))
-  disabledControl.append(select, add)
-  row.append(disabledControl)
-  return row
-}
-
-async function saveConfig() {
-  if (isSaving) return
-  isSaving = true
-  renderConfigEditor(t('settings.savingNotice'), 'loading')
-  try {
-    const response = await nativeRequest(NATIVE_MESSAGE_TYPES.WRITE_CONFIG, configWritePayload({
-      providerOrder,
-      browser: browserPreference,
-      daemonUrl,
-    }))
-    if (!response.ok) {
-      throw new Error(response.error?.message || t('error.saveConfig'))
-    }
-    const config = objectRecord(response.result)
-    providerOrder = normalizeProviderOrder(config.preferredProviders, supportedProviderIds)
-    browserPreference = stringValue(config.browser)
-    daemonUrl = stringValue(config.daemonUrl)
-    isSaving = false
-    renderConfigEditor(t('settings.saved'), 'success')
-    setPageStatus('status.nativeHostReady', 'ready')
-  } catch (error) {
-    isSaving = false
-    renderConfigEditor(errorMessage(error, t('settings.saveFailed')), 'error')
-    setPageStatus('status.saveFailed', 'error')
-  }
-}
-
-async function loadHistory() {
-  try {
-    const response = await nativeRequest(NATIVE_MESSAGE_TYPES.LIST_HISTORY, { limit: 100 })
-    if (!response.ok) {
-      throw new Error(response.error?.message || t('error.listHistory'))
-    }
-    renderHistory(response.result)
-  } catch (error) {
-    renderHistoryState(errorMessage(error, t('history.unavailable')), 'error')
-    throw error
-  }
-}
-
-function renderHistory(value: unknown) {
-  if (!history) return
-  const entries = normalizeHistoryEntries(value)
-  lastHistoryEntries = entries
-  if (entries.length === 0) {
-    renderHistoryState(t('history.empty'), 'empty')
-    return
-  }
-
-  renderHistoryEntries(entries)
-}
-
-function renderHistoryEntries(entries: HistoryEntry[]) {
-  history?.replaceChildren(...entries.map(renderHistoryJob))
-}
-
-function renderHistoryJob(entry: HistoryEntry) {
-  const article = document.createElement('article')
-  article.className = 'job-card'
-  const heading = document.createElement('div')
-  heading.className = 'job-heading'
-  const title = document.createElement('div')
-  title.className = 'job-title'
-  title.textContent = entry.chatName
-  const badges = document.createElement('div')
-  badges.className = 'job-badges'
-  badges.append(badgeNode(providerLabel(entry.provider)), badgeNode(localizeJobStatus(entry.status), entry.status))
-  heading.append(title, badges)
-
-  const meta = document.createElement('div')
-  meta.className = 'job-meta'
-  meta.append(
-    textNode(t('history.project', { value: entry.projectName })),
-    textNode(t('history.action', { value: formatAction(entry.action) })),
-    textNode(t('history.updated', { value: formatDate(entry.updatedAt) })),
-    textNode(t('history.task', { value: entry.taskId }))
-  )
-  const jobId = document.createElement('div')
-  jobId.className = 'job-id'
-  jobId.textContent = t('history.jobId', { value: entry.jobId })
-  article.append(heading, meta, jobId)
-  return article
-}
-
-function badgeNode(text: string, status?: string) {
-  const badge = document.createElement('span')
-  badge.className = 'badge'
-  badge.textContent = text.replaceAll('_', ' ')
-  if (status) badge.dataset.status = status
-  return badge
-}
-
-function textField({
-  label,
-  value,
-  placeholder,
-  help,
-  inputMode,
-  onInput,
-}: {
-  label: string
-  value: string
-  placeholder: string
-  help: string
-  inputMode?: 'url'
-  onInput: (value: string) => void
-}) {
-  const field = document.createElement('label')
-  field.className = 'field'
-  const title = document.createElement('span')
-  title.textContent = label
-  const input = document.createElement('input')
-  input.type = 'text'
-  input.value = value
-  input.placeholder = placeholder
-  if (inputMode) input.inputMode = inputMode
-  input.addEventListener('input', () => onInput(input.value.trim()))
-  const helpNode = document.createElement('span')
-  helpNode.className = 'field-help'
-  helpNode.textContent = help
-  field.append(title, input, helpNode)
-  return field
-}
-
-function rowButton(
-  label: string,
-  accessibleLabel: string,
-  providerId: string,
-  action: ProviderControlAction,
-  onClick: () => void,
-  disabled: boolean,
-  tone?: 'danger'
-) {
-  const button = document.createElement('button')
-  button.type = 'button'
-  button.className = 'row-button'
-  button.textContent = label
-  button.setAttribute('aria-label', accessibleLabel)
-  button.dataset.providerId = providerId
-  button.dataset.providerAction = action
-  button.disabled = disabled
-  if (tone) button.dataset.tone = tone
-  button.addEventListener('click', onClick)
-  return button
-}
-
-function moveProvider(index: number, delta: number) {
-  const nextIndex = index + delta
-  if (nextIndex < 0 || nextIndex >= providerOrder.length) return
-  const next = [...providerOrder]
-  const [providerId] = next.splice(index, 1)
-  if (!providerId) return
-  next.splice(nextIndex, 0, providerId)
-  providerOrder = next
-  renderConfigEditor(t('settings.unsaved'), 'loading', {
-    providerId,
-    action: delta < 0 ? 'up' : 'down',
-  })
-}
-
-function removeProvider(index: number) {
-  const focusProviderId = providerOrder[index + 1] ?? providerOrder[index - 1]
-  providerOrder = providerOrder.filter((_, providerIndex) => providerIndex !== index)
-  renderConfigEditor(t('settings.unsaved'), 'loading', focusProviderId
-    ? { providerId: focusProviderId, action: 'remove' }
-    : { fallback: 'provider-add' })
-}
-
-function restoreProviderFocus(intent: ProviderFocusIntent) {
-  if (!configuration) return
-  const buttons = [...configuration.querySelectorAll<HTMLButtonElement>('.row-button')]
-  const preferred = buttons.find((button) => (
-    button.dataset.providerId === intent.providerId &&
-    button.dataset.providerAction === intent.action &&
-    !button.disabled
-  ))
-  const sameProvider = buttons.find((button) => (
-    button.dataset.providerId === intent.providerId && !button.disabled
-  ))
-  const fallback = intent.fallback === 'save'
-    ? configuration.querySelector<HTMLButtonElement>('button[type="submit"]')
-    : configuration.querySelector<HTMLElement>('.provider-add select, .provider-add button, button[type="submit"]')
-  ;(preferred ?? sameProvider ?? fallback)?.focus()
-}
-
-function providerLabel(providerId: string) {
-  return providers.find((provider) => provider.id === providerId)?.label ?? providerId
-}
-
-function renderConfigurationState(message: string, state: 'empty' | 'error' | 'loading') {
-  configuration?.replaceChildren(stateNode(message, state))
-}
-
-function renderHistoryState(message: string, state: 'empty' | 'error' | 'loading') {
-  history?.replaceChildren(stateNode(message, state))
-}
-
-function stateNode(message: string, state: 'empty' | 'error' | 'loading') {
-  const node = document.createElement('div')
-  node.className = 'state-card'
-  node.dataset.state = state
-  node.textContent = message
-  if (state === 'error') node.setAttribute('role', 'alert')
-  return node
-}
-
-function setPageStatus(key: string, tone: PageStatusTone) {
-  if (!pageStatus) return
-  currentStatusKey = key
-  currentStatusTone = tone
-  pageStatus.textContent = t(key)
-  pageStatus.dataset.tone = tone
-}
-
-function setRefreshState(refreshing: boolean) {
-  if (!refreshButton) return
-  refreshButton.disabled = refreshing
-  refreshButton.textContent = refreshing ? t('action.refreshing') : t('action.refresh')
-}
-
-function nativeRequest(type: string, payload: SettingsRecord = {}): Promise<any> {
-  return new Promise((resolve, reject) => {
-    let port: chrome.runtime.Port
-    try {
-      port = chrome.runtime.connectNative(NATIVE_HOST_NAME)
-    } catch (error) {
-      reject(error)
-      return
-    }
-    let settled = false
-    const timeout = setTimeout(() => {
-      if (settled) return
-      settled = true
-      port.disconnect()
-      reject(new Error(t('error.nativeTimeout', { type })))
-    }, NATIVE_REQUEST_TIMEOUT_MS)
-    port.onMessage.addListener((response) => {
-      if (settled) return
-      if (!isNativeMessage(response) || response.type !== type) {
-        settled = true
-        clearTimeout(timeout)
-        port.disconnect()
-        reject(new Error(t('error.nativeProtocol', { protocol: NATIVE_PROTOCOL_VERSION, type })))
-        return
-      }
-      settled = true
-      clearTimeout(timeout)
-      resolve(response)
-      port.disconnect()
-    })
-    port.onDisconnect.addListener(() => {
-      if (settled) return
-      settled = true
-      clearTimeout(timeout)
-      reject(new Error(chrome.runtime.lastError?.message || t('error.nativeDisconnected')))
-    })
-    port.postMessage(createNativeMessage(type, payload))
-  })
-}
-
-function objectRecord(value: unknown): SettingsRecord {
-  return value && typeof value === 'object' && !Array.isArray(value)
-    ? value as SettingsRecord
-    : {}
-}
-
-function stringValue(value: unknown) {
-  return typeof value === 'string' ? value.trim() : ''
-}
-
-function formatDate(value: string) {
-  if (!value) return t('value.unknown')
-  const date = new Date(value)
-  return Number.isNaN(date.getTime()) ? value : date.toLocaleString(locale)
-}
-
-function formatAction(value: string) {
-  return translationFor(`action.${value}`) ?? value.replaceAll('_', ' ')
-}
-
-function localizeJobStatus(value: string) {
-  return translationFor(`job.${value}`) ?? value.replaceAll('_', ' ')
-}
-
-function textNode(value: string) {
-  const node = document.createElement('span')
-  node.textContent = value
-  return node
-}
-
-function errorMessage(error: unknown, fallback: string) {
-  return error instanceof Error && error.message ? error.message : fallback
-}
-
-function readLocalePreference(): Locale | null {
-  try {
-    const saved = localStorage.getItem('tokenless.settings.locale')
-    return saved === 'en' || saved === 'zh-CN' ? saved : null
-  } catch {
-    return null
-  }
-}
-
-function setLocale(value: string | undefined) {
-  if (value !== 'en' && value !== 'zh-CN') return
-  localePreference = value
-  locale = value
-  try {
-    localStorage.setItem('tokenless.settings.locale', locale)
-  } catch {
-    // The extension remains usable if local storage is unavailable.
-  }
-  applyLocale()
-  renderConfigEditor()
-  if (lastHistoryEntries) renderHistoryEntries(lastHistoryEntries)
-  setPageStatus(currentStatusKey, currentStatusTone)
-  setRefreshState(isHistoryRefreshing)
-}
-
-function useChromeLocale() {
-  localePreference = null
-  locale = chromeLocale()
-  try {
-    localStorage.removeItem('tokenless.settings.locale')
-  } catch {
-    // The extension remains usable if local storage is unavailable.
-  }
-  applyLocale()
-  renderConfigEditor()
-  if (lastHistoryEntries) renderHistoryEntries(lastHistoryEntries)
-  setPageStatus(currentStatusKey, currentStatusTone)
-  setRefreshState(isHistoryRefreshing)
-}
-
-function applyLocale() {
-  document.documentElement.lang = locale
-  document.querySelectorAll<HTMLElement>('[data-i18n]').forEach((node) => {
-    const key = node.dataset.i18n
-    if (key) node.textContent = t(key)
-  })
-  document.querySelectorAll<HTMLElement>('[data-i18n-aria-label]').forEach((node) => {
-    const key = node.dataset.i18nAriaLabel
-    if (key) node.setAttribute('aria-label', t(key))
-  })
-  localeButtons.forEach((button) => {
-    const selected = button.dataset.locale === localePreference
-    button.classList.toggle('is-active', selected)
-    button.setAttribute('aria-pressed', String(selected))
-  })
-  const usingChromeDefault = localePreference === null
-  browserLanguageButton?.classList.toggle('is-active', usingChromeDefault)
-  browserLanguageButton?.setAttribute('aria-pressed', String(usingChromeDefault))
-}
-
-function chromeLocale(): Locale {
-  const chromeLanguage = chrome.i18n?.getUILanguage?.() ?? navigator.language
-  return chromeLanguage.toLowerCase().startsWith('zh') ? 'zh-CN' : 'en'
-}
-
-function t(key: string, values: Record<string, string> = {}) {
-  const template = translations[locale][key] ?? translations.en[key] ?? key
-  return template.replace(/\{(\w+)\}/g, (_, name: string) => values[name] ?? `{${name}}`)
-}
-
-function translationFor(key: string) {
-  return translations[locale][key] ?? translations.en[key]
-}
diff --git a/legacy/extension/extension/settings/model.ts b/legacy/extension/extension/settings/model.ts
deleted file mode 100644
index f11c7aa..0000000
--- a/legacy/extension/extension/settings/model.ts
+++ /dev/null
@@ -1,102 +0,0 @@
-type SettingsRecord = Record<string, unknown>
-
-export type HistoryEntry = {
-  jobId: string
-  taskId: string
-  projectName: string
-  chatName: string
-  provider: string
-  action: string
-  status: string
-  updatedAt: string
-}
-
-export function configWritePayload({
-  providerOrder,
-  browser,
-  daemonUrl,
-}: {
-  providerOrder: readonly string[]
-  browser: string
-  daemonUrl: string
-}) {
-  return {
-    preferredProviders: [...providerOrder],
-    browser: stringValue(browser) || null,
-    daemonUrl: stringValue(daemonUrl) || null,
-  }
-}
-
-export function normalizeProviderOrder(value: unknown, supportedProviderIds: readonly string[]) {
-  if (!Array.isArray(value)) return []
-  const seen = new Set<string>()
-  const normalized: string[] = []
-  for (const providerId of value) {
-    if (typeof providerId !== 'string' || !supportedProviderIds.includes(providerId) || seen.has(providerId)) continue
-    seen.add(providerId)
-    normalized.push(providerId)
-  }
-  return normalized
-}
-
-export function normalizeHistoryEntries(value: unknown): HistoryEntry[] {
-  if (!Array.isArray(value)) return []
-  return value
-    .map(normalizeHistoryEntry)
-    .filter((entry): entry is HistoryEntry => entry !== null)
-}
-
-function normalizeHistoryEntry(value: unknown): HistoryEntry | null {
-  const job = objectRecord(value)
-  const jobId = stringValue(job.job_id)
-  if (!jobId) return null
-  const metadata = objectRecord(job.metadata)
-  const request = objectRecord(job.request_json)
-  const requestMetadata = objectRecord(request.metadata)
-  return {
-    jobId,
-    taskId: firstString(
-      metadata.taskId,
-      metadata.idempotencyKey,
-      requestMetadata.taskId,
-      request.taskId,
-      requestMetadata.idempotencyKey,
-      request.idempotencyKey,
-      jobId
-    ),
-    projectName: firstString(
-      metadata.projectName,
-      requestMetadata.projectName,
-      request.projectName,
-      'Unspecified project'
-    ),
-    chatName: firstString(
-      metadata.chatName,
-      requestMetadata.chatName,
-      request.chatName,
-      'Unspecified chat'
-    ),
-    provider: firstString(job.provider, 'unknown'),
-    action: firstString(job.action, 'unknown'),
-    status: firstString(job.status, 'unknown'),
-    updatedAt: firstString(job.updated_at, job.created_at, ''),
-  }
-}
-
-function objectRecord(value: unknown): SettingsRecord {
-  return value && typeof value === 'object' && !Array.isArray(value)
-    ? value as SettingsRecord
-    : {}
-}
-
-function stringValue(value: unknown) {
-  return typeof value === 'string' ? value.trim() : ''
-}
-
-function firstString(...values: unknown[]) {
-  for (const value of values) {
-    const normalized = stringValue(value)
-    if (normalized) return normalized
-  }
-  return ''
-}
diff --git a/legacy/extension/extension/shared/bridge-protocol.ts b/legacy/extension/extension/shared/bridge-protocol.ts
deleted file mode 100644
index 7bcbdb2..0000000
--- a/legacy/extension/extension/shared/bridge-protocol.ts
+++ /dev/null
@@ -1,477 +0,0 @@
-import { getProviderById, listProviders } from './provider-config.js'
-import { safeProviderTargetUrl } from './provider-navigation-policy.js'
-import {
-  isNativeAttachmentDescriptor,
-  MAX_VISIBLE_ATTACHMENTS,
-  MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES,
-  VISIBLE_ATTACHMENT_PROTOCOL_VERSION,
-} from './native-protocol.js'
-import type { NativeAttachmentDescriptor } from './native-protocol.js'
-import { visibleProviderActionCapabilitiesPayload } from './visible-provider-capabilities.js'
-import {
-  VISIBLE_PROVIDER_ACTIONS,
-  validateVisibleProviderActionRequest,
-} from './visible-provider-actions.js'
-import type { VisibleProviderActionRequest } from './visible-provider-actions.js'
-
-export const BRIDGE_PROTOCOL_VERSION = 'tokenless.browser-session-bridge.v1'
-
-export const BRIDGE_ACTIONS = Object.freeze({
-  CAPABILITIES: 'capabilities',
-  OPEN: 'open',
-  SUBMIT: 'submit',
-  READ: 'read',
-  SNAPSHOT_DOM: 'snapshot_dom',
-  SUBMIT_AND_READ: 'submit_and_read',
-  INSPECT_CONTROLS: 'inspect_controls',
-  CONFIGURE_CONTROLS: 'configure_controls',
-  INSPECT_AUTH: 'inspect_auth',
-  VISIBLE_PROVIDER_ACTION: 'visible_provider_action',
-  INSPECT_CHATGPT_CONTROLS: 'inspect_chatgpt_controls',
-  CONFIGURE_CHATGPT: 'configure_chatgpt',
-})
-
-const ACTIONS = new Set(Object.values(BRIDGE_ACTIONS))
-
-export type BridgeRequest = Record<string, any> & {
-  protocol: typeof BRIDGE_PROTOCOL_VERSION
-  requestId: string
-  action: string
-  visibleAction?: VisibleProviderActionRequest
-}
-
-type BridgeError = {
-  code: string
-  message: string
-  retryable: boolean
-}
-
-type BridgeValidation =
-  | { ok: true; request: BridgeRequest }
-  | { ok: false; error: BridgeError }
-
-type VisibleProviderBridgeValidation =
-  | { ok: true; request: VisibleProviderActionRequest }
-  | { ok: false; error: BridgeError }
-
-type BridgeResult =
-  | { ok: true; result?: unknown }
-  | { ok: false; error?: Partial<BridgeError> }
-
-export function createBridgeRequest(input: Record<string, any> = {}): BridgeRequest {
-  return {
-    protocol: BRIDGE_PROTOCOL_VERSION,
-    requestId: input.requestId ?? cryptoRandomId(),
-    provider: input.provider,
-    action: input.action,
-    prompt: input.prompt,
-    targetUrl: input.targetUrl,
-    idempotencyKey: input.idempotencyKey,
-    conversation: input.conversation,
-    readDelayMs: input.readDelayMs,
-    readTimeoutMs: input.readTimeoutMs,
-    submitTimeoutMs: input.submitTimeoutMs,
-    includeText: input.includeText,
-    maxTextChars: input.maxTextChars,
-    chatSurface: input.chatSurface,
-    model: input.model,
-    modelFallbacks: input.modelFallbacks,
-    effort: input.effort,
-    attachments: input.attachments,
-    visibleAction: input.visibleAction,
-    metadata: input.metadata,
-  }
-}
-
-export function createBridgeResponse(request: Partial<BridgeRequest> | null | undefined, result: BridgeResult) {
-  const ok = Boolean(result?.ok)
-  const payload = result as Record<string, any>
-  return {
-    protocol: BRIDGE_PROTOCOL_VERSION,
-    requestId: request?.requestId ?? null,
-    ok,
-    provider: request?.provider ?? null,
-    action: request?.action ?? null,
-    result: ok ? payload.result ?? null : null,
-    error: ok ? null : normalizeError(payload.error),
-  }
-}
-
-export function validateBridgeRequest(payload: unknown): BridgeValidation {
-  if (!payload || typeof payload !== 'object') {
-    return invalid('invalid_request', 'Bridge request must be an object.')
-  }
-  const request = payload as Record<string, any>
-  if (request.protocol !== BRIDGE_PROTOCOL_VERSION) {
-    return invalid('unsupported_protocol', 'Bridge protocol version is not supported.')
-  }
-  if (typeof request.requestId !== 'string' || request.requestId.trim() === '') {
-    return invalid('invalid_request_id', 'Bridge requestId must be a nonempty string.')
-  }
-  if (!ACTIONS.has(request.action)) {
-    return invalid('unsupported_action', 'Bridge action is not supported.')
-  }
-  const visibleActionValidation = request.action === BRIDGE_ACTIONS.VISIBLE_PROVIDER_ACTION
-    ? validateVisibleProviderBridgeAction(request)
-    : null
-  if (visibleActionValidation?.ok === false) return visibleActionValidation
-  const attachmentError = validateAttachments(request)
-  if (attachmentError) return attachmentError
-  if (request.action === BRIDGE_ACTIONS.CAPABILITIES) {
-    return valid(normalizeRequest(request))
-  }
-  const provider = getProviderById(request.provider)
-  if (!provider) {
-    return invalid('unsupported_provider', 'Bridge provider is not supported.')
-  }
-  const providerControls = validateProviderControls(request, provider.id)
-  if (providerControls) return providerControls
-  if (request.targetUrl !== undefined) {
-    if (typeof request.targetUrl !== 'string' || request.targetUrl.trim() === '') {
-      return invalid('invalid_target_url', 'Bridge targetUrl must be a nonempty absolute URL when provided.')
-    }
-    try {
-      // Syntax parsing classifies the public error only. The original raw string
-      // still goes through the strict provider policy below, so URL normalization
-      // cannot turn an unsafe requested target into an allowlisted one.
-      new URL(request.targetUrl)
-    } catch {
-      return invalid('invalid_target_url', 'Bridge targetUrl must be a nonempty absolute URL when provided.')
-    }
-    if (!safeProviderTargetUrl(provider, request.targetUrl)) {
-      return invalid(
-        'target_url_provider_mismatch',
-        'Bridge targetUrl must be a strict HTTPS URL belonging to the selected provider.'
-      )
-    }
-  }
-  if (
-    (request.action === BRIDGE_ACTIONS.SUBMIT || request.action === BRIDGE_ACTIONS.SUBMIT_AND_READ) &&
-    (typeof request.prompt !== 'string' || request.prompt.trim() === '')
-  ) {
-    return invalid('invalid_prompt', 'Bridge prompt must be a nonempty string for submit actions.')
-  }
-  if (request.readDelayMs !== undefined && (!Number.isFinite(Number(request.readDelayMs)) || Number(request.readDelayMs) < 0)) {
-    return invalid('invalid_read_delay', 'Bridge readDelayMs must be a nonnegative number.')
-  }
-  if (request.readTimeoutMs !== undefined && (!Number.isFinite(Number(request.readTimeoutMs)) || Number(request.readTimeoutMs) < 0)) {
-    return invalid('invalid_read_timeout', 'Bridge readTimeoutMs must be a nonnegative number.')
-  }
-  if (request.submitTimeoutMs !== undefined && (!Number.isFinite(Number(request.submitTimeoutMs)) || Number(request.submitTimeoutMs) < 0)) {
-    return invalid('invalid_submit_timeout', 'Bridge submitTimeoutMs must be a nonnegative number.')
-  }
-  if (request.maxTextChars !== undefined && (!Number.isFinite(Number(request.maxTextChars)) || Number(request.maxTextChars) < 0)) {
-    return invalid('invalid_max_text_chars', 'Bridge maxTextChars must be a nonnegative number.')
-  }
-  const includeText = resolveIncludeText(request)
-  if (includeText.ok === false) {
-    return invalid('invalid_include_text', 'Bridge includeText must be a boolean when provided.')
-  }
-  const normalized = normalizeRequest(request)
-  if (visibleActionValidation?.ok === true) normalized.visibleAction = visibleActionValidation.request
-  return valid(normalized)
-}
-
-export function capabilitiesPayload() {
-  return {
-    protocol: BRIDGE_PROTOCOL_VERSION,
-    providers: listProviders().map((provider) => ({
-      id: provider.id,
-      label: provider.label,
-      homeUrl: provider.homeUrl,
-      matchPatterns: [...provider.matchPatterns],
-    })),
-    actions: [...ACTIONS],
-    attachments: {
-      protocol: VISIBLE_ATTACHMENT_PROTOCOL_VERSION,
-      actions: [BRIDGE_ACTIONS.SUBMIT, BRIDGE_ACTIONS.SUBMIT_AND_READ, BRIDGE_ACTIONS.VISIBLE_PROVIDER_ACTION],
-      maxFiles: MAX_VISIBLE_ATTACHMENTS,
-      maxRequestBytes: MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES,
-    },
-    visibleProviderActions: visibleProviderActionCapabilitiesPayload(),
-    safety: {
-      visibleOnly: true,
-      exportsCookies: false,
-      callsPrivateProviderApis: false,
-      requiresHostPermission: true,
-    },
-  }
-}
-
-function normalizeRequest(payload: Record<string, any>): BridgeRequest {
-  const includeText = resolveIncludeText(payload)
-  return {
-    protocol: payload.protocol,
-    requestId: payload.requestId,
-    provider: payload.provider,
-    action: payload.action,
-    prompt: payload.prompt,
-    targetUrl: payload.targetUrl,
-    idempotencyKey: payload.idempotencyKey,
-    conversation: payload.conversation,
-    readDelayMs: payload.readDelayMs === undefined ? undefined : Number(payload.readDelayMs),
-    readTimeoutMs: payload.readTimeoutMs === undefined ? undefined : Number(payload.readTimeoutMs),
-    submitTimeoutMs: payload.submitTimeoutMs === undefined ? undefined : Number(payload.submitTimeoutMs),
-    includeText: includeText.ok ? includeText.value : undefined,
-    maxTextChars: payload.maxTextChars === undefined ? undefined : Number(payload.maxTextChars),
-    chatSurface: payload.chatSurface,
-    model: typeof payload.model === 'string' ? payload.model.trim() : payload.model,
-    modelFallbacks: Array.isArray(payload.modelFallbacks)
-      ? payload.modelFallbacks.map((model: unknown) => typeof model === 'string' ? model.trim() : model)
-      : payload.modelFallbacks,
-    effort: typeof payload.effort === 'string' ? payload.effort.trim() : payload.effort,
-    attachments: Array.isArray(payload.attachments)
-      ? payload.attachments.map(normalizeAttachmentDescriptor)
-      : payload.attachments,
-    visibleAction: payload.visibleAction,
-    metadata: payload.metadata,
-  }
-}
-
-function validateVisibleProviderBridgeAction(payload: Record<string, any>): VisibleProviderBridgeValidation {
-  const allowedFields = new Set([
-    'protocol',
-    'requestId',
-    'provider',
-    'action',
-    'targetUrl',
-    'idempotencyKey',
-    'attachments',
-    'visibleAction',
-    'metadata',
-  ])
-  const unsupportedFields = Object.keys(payload).filter((key) => (
-    payload[key] !== undefined && !allowedFields.has(key)
-  ))
-  if (unsupportedFields.length > 0) {
-    return invalid(
-      'invalid_visible_action_bridge_shape',
-      'Unified visible provider bridge requests contain unsupported wrapper fields.'
-    )
-  }
-
-  const validation = validateVisibleProviderActionRequest(payload.visibleAction)
-  if (validation.ok === false) {
-    return invalid(validation.error.code, validation.error.message)
-  }
-  if (
-    validation.request.requestId !== payload.requestId ||
-    validation.request.provider !== payload.provider
-  ) {
-    return invalid(
-      'visible_action_bridge_mismatch',
-      'Unified visible provider action requestId and provider must match the bridge wrapper.'
-    )
-  }
-
-  const nestedAttachments = validation.request.action === VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD
-    ? validation.request.payload.attachments
-    : undefined
-  if (nestedAttachments !== undefined) {
-    if (
-      !Array.isArray(payload.attachments) ||
-      !Array.isArray(nestedAttachments) ||
-      !sameAttachmentDescriptors(payload.attachments, nestedAttachments)
-    ) {
-      return invalid(
-        'visible_action_attachment_mismatch',
-        'Standalone visible file upload descriptors must match the native bridge descriptors exactly.'
-      )
-    }
-  } else if (payload.attachments !== undefined) {
-    return invalid(
-      'attachments_unsupported_for_action',
-      'Native visible attachment transport is available only to file.upload in the unified action bridge.'
-    )
-  }
-  return { ok: true, request: validation.request }
-}
-
-function validateAttachments(payload: Record<string, any>): BridgeValidation | null {
-  if (payload.attachments === undefined) return null
-  if (
-    payload.action !== BRIDGE_ACTIONS.SUBMIT &&
-    payload.action !== BRIDGE_ACTIONS.SUBMIT_AND_READ &&
-    payload.action !== BRIDGE_ACTIONS.VISIBLE_PROVIDER_ACTION
-  ) {
-    return invalid(
-      'attachments_unsupported_for_action',
-      'Visible attachments are accepted only by submit actions.'
-    )
-  }
-  if (!Array.isArray(payload.attachments) || payload.attachments.length === 0) {
-    return invalid('invalid_attachments', 'attachments must be a nonempty array when provided.')
-  }
-  if (payload.attachments.length > MAX_VISIBLE_ATTACHMENTS) {
-    return invalid(
-      'too_many_attachments',
-      `attachments may contain at most ${MAX_VISIBLE_ATTACHMENTS} visible files.`
-    )
-  }
-
-  let bundleId: string | undefined
-  let totalBytes = 0
-  const attachmentIds = new Set<string>()
-  for (const value of payload.attachments) {
-    if (!isNativeAttachmentDescriptor(value)) {
-      return invalid('invalid_attachment', 'Every visible attachment descriptor must be valid and contain no unknown fields.')
-    }
-    if (bundleId === undefined) bundleId = value.bundleId
-    if (value.bundleId !== bundleId) {
-      return invalid('attachment_bundle_mismatch', 'Visible attachments in one request must share one bundleId.')
-    }
-    if (attachmentIds.has(value.attachmentId)) {
-      return invalid('duplicate_attachment', 'Visible attachment identities must be unique within a request.')
-    }
-    attachmentIds.add(value.attachmentId)
-    if (value.size > MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES) {
-      return invalid(
-        'attachment_too_large',
-        `Each visible attachment may contain at most ${MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES} bytes.`
-      )
-    }
-    totalBytes += value.size
-    if (!Number.isSafeInteger(totalBytes) || totalBytes > MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES) {
-      return invalid(
-        'attachments_too_large',
-        `Visible attachments may contain at most ${MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES} bytes in total.`
-      )
-    }
-  }
-  return null
-}
-
-function sameAttachmentDescriptors(left: unknown[], right: unknown[]) {
-  if (left.length !== right.length) return false
-  const fields = ['protocol', 'bundleId', 'attachmentId', 'name', 'type', 'size', 'sha256'] as const
-  return left.every((candidate, index) => {
-    const expected = right[index]
-    if (!candidate || typeof candidate !== 'object' || !expected || typeof expected !== 'object') return false
-    const leftRecord = candidate as Record<string, unknown>
-    const rightRecord = expected as Record<string, unknown>
-    return fields.every((field) => leftRecord[field] === rightRecord[field])
-  })
-}
-
-function normalizeAttachmentDescriptor(value: NativeAttachmentDescriptor): NativeAttachmentDescriptor {
-  return {
-    protocol: value.protocol,
-    bundleId: value.bundleId,
-    attachmentId: value.attachmentId,
-    name: value.name,
-    type: value.type,
-    size: value.size,
-    sha256: value.sha256,
-  }
-}
-
-function validateProviderControls(
-  payload: Record<string, any>,
-  providerId: string
-): BridgeValidation | null {
-  const hasModelControls = payload.model !== undefined || payload.modelFallbacks !== undefined
-  const hasEffortControl = payload.effort !== undefined
-  const hasChatGptOnlyControls = (
-    payload.chatSurface !== undefined
-  )
-  const legacyChatGptAction = (
-    payload.action === BRIDGE_ACTIONS.INSPECT_CHATGPT_CONTROLS ||
-    payload.action === BRIDGE_ACTIONS.CONFIGURE_CHATGPT
-  )
-  if (legacyChatGptAction && providerId !== 'chatgpt') {
-    return invalid('chatgpt_controls_unsupported', 'Legacy ChatGPT control actions require the ChatGPT provider.')
-  }
-  const controlConfigurationAction = (
-    payload.action === BRIDGE_ACTIONS.SUBMIT ||
-    payload.action === BRIDGE_ACTIONS.SUBMIT_AND_READ ||
-    payload.action === BRIDGE_ACTIONS.CONFIGURE_CONTROLS ||
-    payload.action === BRIDGE_ACTIONS.CONFIGURE_CHATGPT
-  )
-  if ((hasModelControls || hasEffortControl) && !controlConfigurationAction) {
-    return invalid(
-      'controls_unsupported_for_action',
-      'Visible provider controls are accepted only by submit or configure actions.'
-    )
-  }
-  if (hasChatGptOnlyControls && providerId !== 'chatgpt') {
-    return invalid(
-      'chatgpt_controls_unsupported',
-      'Chat surface controls are available only for ChatGPT.'
-    )
-  }
-  if (payload.chatSurface !== undefined && payload.chatSurface !== 'chat') {
-    return invalid('invalid_chat_surface', 'ChatGPT chatSurface must be "chat" when provided.')
-  }
-  if (payload.model !== undefined && !isControlLabel(payload.model)) {
-    return invalid('invalid_model', 'Model must be a nonempty visible UI label up to 120 characters.')
-  }
-  if (payload.modelFallbacks !== undefined) {
-    if (!Array.isArray(payload.modelFallbacks) || payload.modelFallbacks.length > 8 || !payload.modelFallbacks.every(isControlLabel)) {
-      return invalid('invalid_model_fallbacks', 'modelFallbacks must contain at most eight nonempty visible UI labels.')
-    }
-    if (payload.model === undefined) {
-      return invalid('model_fallback_requires_model', 'modelFallbacks require a primary visible UI model label.')
-    }
-  }
-  if (payload.effort !== undefined && !isControlLabel(payload.effort)) {
-    return invalid('invalid_effort', 'Effort must be an exact nonempty visible UI label up to 120 characters.')
-  }
-  return null
-}
-
-function isControlLabel(value: unknown) {
-  return (
-    typeof value === 'string' &&
-    value.trim().length > 0 &&
-    value.trim().length <= 120 &&
-    !/[\u0000-\u001f\u007f]/u.test(value)
-  )
-}
-
-function resolveIncludeText(payload: Record<string, any>):
-  | { ok: true; value: boolean | undefined }
-  | { ok: false } {
-  if (payload.includeText !== undefined) {
-    return typeof payload.includeText === 'boolean'
-      ? { ok: true, value: payload.includeText }
-      : { ok: false }
-  }
-  const metadata = payload.metadata
-  if (!metadata || typeof metadata !== 'object' || Array.isArray(metadata)) {
-    return { ok: true, value: undefined }
-  }
-  const metadataIncludeText = (metadata as Record<string, unknown>).includeText
-  if (metadataIncludeText === undefined) {
-    return { ok: true, value: undefined }
-  }
-  return typeof metadataIncludeText === 'boolean'
-    ? { ok: true, value: metadataIncludeText }
-    : { ok: false }
-}
-
-function valid(request: BridgeRequest): BridgeValidation {
-  return { ok: true, request }
-}
-
-function invalid(code: string, message: string): { ok: false; error: BridgeError } {
-  return { ok: false, error: { code, message, retryable: false } }
-}
-
-function normalizeError(error: Partial<BridgeError> | null | undefined): BridgeError {
-  if (!error || typeof error !== 'object') {
-    return { code: 'bridge_error', message: 'Bridge request failed.', retryable: true }
-  }
-  return {
-    code: typeof error.code === 'string' ? error.code : 'bridge_error',
-    message: typeof error.message === 'string' ? error.message : 'Bridge request failed.',
-    retryable: Boolean(error.retryable),
-  }
-}
-
-function cryptoRandomId() {
-  const cryptoApi = globalThis.crypto
-  if (cryptoApi?.randomUUID) {
-    return cryptoApi.randomUUID()
-  }
-  return `bridge-${Date.now()}-${Math.random().toString(16).slice(2)}`
-}
diff --git a/legacy/extension/extension/shared/native-protocol.ts b/legacy/extension/extension/shared/native-protocol.ts
deleted file mode 100644
index 466de26..0000000
--- a/legacy/extension/extension/shared/native-protocol.ts
+++ /dev/null
@@ -1,84 +0,0 @@
-export const NATIVE_PROTOCOL_VERSION = 'tokenless.native.v1' as const
-export const VISIBLE_ATTACHMENT_PROTOCOL_VERSION = 'tokenless.visible-attachment.v1' as const
-export const MAX_VISIBLE_ATTACHMENT_CHUNK_BYTES = 512 * 1024
-export const MAX_VISIBLE_ATTACHMENTS = 100
-export const MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES = 512 * 1024 * 1024
-
-export const NATIVE_MESSAGE_TYPES = Object.freeze({
-  DAEMON_CONNECT: 'tokenless.native.daemon_connect',
-  DAEMON_CONNECTED: 'tokenless.native.daemon_connected',
-  DAEMON_JOB: 'tokenless.native.daemon_job',
-  DAEMON_READY: 'tokenless.native.daemon_ready',
-  DAEMON_COMPLETE_JOB: 'tokenless.native.daemon_complete_job',
-  ATTACHMENT_OPEN: 'tokenless.native.attachment_open',
-  ATTACHMENT_READ: 'tokenless.native.attachment_read',
-  ATTACHMENT_CLOSE: 'tokenless.native.attachment_close',
-  DAEMON_ERROR: 'tokenless.native.daemon_error',
-  READ_CONFIG: 'tokenless.native.read_config',
-  WRITE_CONFIG: 'tokenless.native.write_config',
-  LIST_HISTORY: 'tokenless.native.list_history',
-})
-
-export type NativeAttachmentDescriptor = {
-  protocol: typeof VISIBLE_ATTACHMENT_PROTOCOL_VERSION
-  bundleId: string
-  attachmentId: string
-  name: string
-  type: string
-  size: number
-  sha256: string
-}
-
-export type NativeMessage = Record<string, unknown> & {
-  protocol: typeof NATIVE_PROTOCOL_VERSION
-  type: string
-}
-
-export function createNativeMessage(
-  type: string,
-  payload: Record<string, unknown> = {}
-): NativeMessage {
-  return Object.fromEntries(
-    Object.entries({
-      ...payload,
-      protocol: NATIVE_PROTOCOL_VERSION,
-      type,
-    }).filter(([, value]) => value !== undefined)
-  ) as NativeMessage
-}
-
-export function isNativeMessage(value: unknown): value is NativeMessage {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) return false
-  const candidate = value as Partial<NativeMessage>
-  return candidate.protocol === NATIVE_PROTOCOL_VERSION && typeof candidate.type === 'string'
-}
-
-export function isNativeAttachmentDescriptor(value: unknown): value is NativeAttachmentDescriptor {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) return false
-  const descriptor = value as Partial<NativeAttachmentDescriptor> & Record<string, unknown>
-  const keys = Object.keys(descriptor)
-  if (keys.some((key) => !['protocol', 'bundleId', 'attachmentId', 'name', 'type', 'size', 'sha256'].includes(key))) {
-    return false
-  }
-  return descriptor.protocol === VISIBLE_ATTACHMENT_PROTOCOL_VERSION &&
-    safeAttachmentId(descriptor.bundleId) &&
-    safeAttachmentId(descriptor.attachmentId) &&
-    typeof descriptor.name === 'string' &&
-    descriptor.name.length > 0 &&
-    !descriptor.name.includes('\0') &&
-    !descriptor.name.includes('/') &&
-    !descriptor.name.includes('\\') &&
-    new TextEncoder().encode(descriptor.name).byteLength <= 512 &&
-    typeof descriptor.type === 'string' &&
-    /^[A-Za-z0-9!#$&^_.+-]+\/[A-Za-z0-9!#$&^_.+-]+$/.test(descriptor.type) &&
-    new TextEncoder().encode(descriptor.type).byteLength <= 255 &&
-    typeof descriptor.size === 'number' &&
-    Number.isSafeInteger(descriptor.size) &&
-    descriptor.size >= 0 &&
-    typeof descriptor.sha256 === 'string' &&
-    /^[a-f0-9]{64}$/.test(descriptor.sha256)
-}
-
-function safeAttachmentId(value: unknown): value is string {
-  return typeof value === 'string' && /^[A-Za-z0-9_-]{1,64}$/.test(value)
-}
diff --git a/legacy/extension/extension/shared/provider-config.ts b/legacy/extension/extension/shared/provider-config.ts
deleted file mode 100644
index 4e92836..0000000
--- a/legacy/extension/extension/shared/provider-config.ts
+++ /dev/null
@@ -1,171 +0,0 @@
-export const PROVIDER_IDS = Object.freeze({
-  CHATGPT: 'chatgpt',
-  GEMINI: 'gemini',
-  CLAUDE: 'claude',
-  GROK: 'grok',
-})
-
-export type ProviderId = typeof PROVIDER_IDS[keyof typeof PROVIDER_IDS]
-
-export type ProviderConfig = {
-  readonly id: ProviderId
-  readonly label: string
-  readonly homeUrl: string
-  readonly hosts: readonly string[]
-  readonly matchPatterns: readonly string[]
-  readonly composerSelectors: readonly string[]
-  readonly submitSelectors: readonly string[]
-  readonly answerSelectors: readonly string[]
-  readonly blockerSelectors: readonly string[]
-  readonly busySelectors?: readonly string[]
-  readonly busyTextLabels?: readonly string[]
-}
-
-const PROVIDERS: readonly ProviderConfig[] = Object.freeze([
-  Object.freeze({
-    id: PROVIDER_IDS.CHATGPT,
-    label: 'ChatGPT',
-    homeUrl: 'https://chatgpt.com/',
-    hosts: Object.freeze(['chatgpt.com', 'chat.openai.com']),
-    matchPatterns: Object.freeze(['https://chatgpt.com/*', 'https://chat.openai.com/*']),
-    composerSelectors: Object.freeze([
-      'div#prompt-textarea[contenteditable="true"]',
-      '#prompt-textarea[contenteditable="true"]',
-      '[data-testid="composer"] [contenteditable="true"]',
-      'div[contenteditable="true"][data-id="root"]',
-      'div.ProseMirror[contenteditable="true"]',
-      'div[role="textbox"][contenteditable="true"]',
-      'textarea[placeholder*="Message" i]',
-      'textarea[data-testid="prompt-textarea"]',
-      'textarea',
-    ]),
-    submitSelectors: Object.freeze([
-      'button[data-testid="send-button"]',
-      'button[data-testid="composer-send-button"]',
-      'button[aria-label="Send prompt"]',
-      'button[aria-label="Send message"]',
-      'button[aria-label*="Send" i]',
-      'button[type="submit"]',
-    ]),
-    answerSelectors: Object.freeze([
-      '[data-message-author-role="assistant"]',
-      'article[data-testid*="conversation-turn"]',
-      'main article',
-    ]),
-    blockerSelectors: Object.freeze([
-      'iframe[src*="captcha"]',
-      '[aria-label*="captcha" i]',
-    ]),
-    busySelectors: Object.freeze([
-      'button[data-testid="stop-button"]',
-      'button[aria-label*="Stop generating" i]',
-    ]),
-    busyTextLabels: Object.freeze(['stop generating']),
-  }),
-  Object.freeze({
-    id: PROVIDER_IDS.GEMINI,
-    label: 'Gemini',
-    homeUrl: 'https://gemini.google.com/app',
-    hosts: Object.freeze(['gemini.google.com']),
-    matchPatterns: Object.freeze(['https://gemini.google.com/*']),
-    composerSelectors: Object.freeze([
-      'rich-textarea div.ql-editor[data-gramm="false"][contenteditable="true"][role="textbox"][aria-multiline="true"][aria-label="Enter a prompt for Gemini"]',
-    ]),
-    submitSelectors: Object.freeze([
-      'button[aria-label="Send message"]',
-    ]),
-    answerSelectors: Object.freeze([
-      'response-container message-content',
-    ]),
-    blockerSelectors: Object.freeze([
-      'iframe[src^="https://www.google.com/recaptcha/"][title="reCAPTCHA"]',
-    ]),
-    busySelectors: Object.freeze([
-      'button[aria-label="Stop response"]',
-    ]),
-    busyTextLabels: Object.freeze(['stop response']),
-  }),
-  Object.freeze({
-    id: PROVIDER_IDS.CLAUDE,
-    label: 'Claude',
-    homeUrl: 'https://claude.ai/new',
-    hosts: Object.freeze(['claude.ai']),
-    matchPatterns: Object.freeze(['https://claude.ai/*']),
-    composerSelectors: Object.freeze([
-      'div[data-testid="chat-input"][contenteditable="true"][role="textbox"]',
-      'div[aria-label="Write your prompt to Claude"][contenteditable="true"][role="textbox"]',
-      'div[contenteditable="true"][role="textbox"]',
-      'div.ProseMirror[contenteditable="true"]',
-      'textarea',
-    ]),
-    submitSelectors: Object.freeze([
-      'button[data-cds="Button"][aria-label="Send message"]',
-      'button[aria-label="Send message"]',
-      'button[aria-label*="Send"]',
-      'button[type="submit"]',
-    ]),
-    answerSelectors: Object.freeze([
-      '[data-testid="virtual-message-list"] .font-claude-response-body',
-      'main .font-claude-response-body',
-      '.font-claude-response-body',
-    ]),
-    blockerSelectors: Object.freeze([
-      'iframe[src*="captcha"]',
-      'button[data-testid="login-with-google"]',
-      'form:has(input[placeholder="Enter your email"]) button[data-testid="continue"]',
-      'input[placeholder="Enter your email"]',
-    ]),
-    busySelectors: Object.freeze([
-      '[data-testid="virtual-message-list"] [data-is-streaming="true"]',
-      'button[aria-label*="Stop" i]',
-    ]),
-    busyTextLabels: Object.freeze(['stop']),
-  }),
-  Object.freeze({
-    id: PROVIDER_IDS.GROK,
-    label: 'Grok',
-    homeUrl: 'https://grok.com/',
-    hosts: Object.freeze(['grok.com']),
-    matchPatterns: Object.freeze(['https://grok.com/*']),
-    composerSelectors: Object.freeze([
-      'div.tiptap.ProseMirror[contenteditable="true"][role="textbox"][aria-label="Ask Grok anything"][aria-multiline="true"]',
-      'textarea[aria-label="Ask Grok anything"][placeholder="What do you want to know?"]',
-    ]),
-    submitSelectors: Object.freeze([
-      'button[data-testid="chat-submit"][aria-label="Submit"][type="submit"]',
-    ]),
-    answerSelectors: Object.freeze([
-      'div[data-testid="assistant-message"]',
-    ]),
-    blockerSelectors: Object.freeze([
-      'div[data-testid="anon-paywall-sign-up-card"]',
-    ]),
-  }),
-])
-
-export function listProviders(): ProviderConfig[] {
-  return [...PROVIDERS]
-}
-
-export function getProviderById(providerId: unknown): ProviderConfig | null {
-  return PROVIDERS.find((provider) => provider.id === providerId) ?? null
-}
-
-export function getProviderForUrl(url: string): ProviderConfig | null {
-  let parsed
-  try {
-    parsed = new URL(url)
-  } catch {
-    return null
-  }
-  const host = parsed.hostname.toLowerCase()
-  if (
-    parsed.protocol !== 'https:' ||
-    parsed.username !== '' ||
-    parsed.password !== '' ||
-    parsed.port !== ''
-  ) {
-    return null
-  }
-  return PROVIDERS.find((provider) => provider.hosts.includes(host)) ?? null
-}
diff --git a/legacy/extension/extension/shared/provider-navigation-policy.ts b/legacy/extension/extension/shared/provider-navigation-policy.ts
deleted file mode 100644
index 48f1e82..0000000
--- a/legacy/extension/extension/shared/provider-navigation-policy.ts
+++ /dev/null
@@ -1,372 +0,0 @@
-import type { ProviderConfig, ProviderId } from './provider-config.js'
-
-export type ProviderTransitionSource =
-  | { kind: 'root'; customGptId: undefined; projectId: undefined }
-  | { kind: 'custom_gpt'; customGptId: string; projectId: undefined }
-  | { kind: 'project'; customGptId: undefined; projectId: string }
-
-export type ProviderConversationRoute =
-  | { kind: 'standard'; customGptId: undefined; projectId: undefined }
-  | { kind: 'custom_gpt'; customGptId: string; projectId: undefined }
-  | { kind: 'project'; customGptId: undefined; projectId: string }
-
-export type ProviderTargetScope = Readonly<{
-  kind: 'landing' | 'conversation' | 'custom_gpt' | 'project' | 'path'
-  key: string
-  id?: string
-}>
-
-export type CanonicalProviderTarget = Readonly<{
-  providerId: ProviderId
-  href: string
-  origin: string
-  pathname: string
-  scope: ProviderTargetScope
-}>
-
-const RESERVED_PROVIDER_PATH_PREFIXES = [
-  'about', 'account', 'accounts', 'admin', 'administrator', 'api', 'auth',
-  'authentication', 'authorize', 'billing', 'checkout', 'help', 'login',
-  'logout', 'oauth', 'password', 'payment', 'payments', 'plan', 'plans',
-  'preferences', 'pricing', 'privacy', 'profile', 'recover', 'register',
-  'reset', 'security', 'settings', 'signin', 'signup', 'sso', 'subscription',
-  'support', 'terms', 'upgrade',
-]
-
-// Provider route identifiers never require these bytes. Rejecting them before URL
-// parsing prevents browser normalization from turning a different raw target into
-// an allowlisted path. Encoded percent is rejected to prevent a second decode from
-// revealing one of the other forbidden bytes.
-const FORBIDDEN_RAW_URL = /[\\\u0000-\u001f\u007f\s]|%(?:00|0[1-9a-f]|1[0-9a-f]|20|23|25|2f|3f|5c|7f)/i
-const MALFORMED_PERCENT_ESCAPE = /%(?![0-9a-f]{2})/i
-
-export function safeProviderTargetUrl(provider: ProviderConfig, targetUrl: unknown) {
-  const parsed = parseProviderTarget(provider, targetUrl === undefined ? provider.homeUrl : targetUrl)
-  return parsed ? parsed.href : null
-}
-
-export function canonicalProviderTarget(
-  provider: ProviderConfig,
-  targetUrl: unknown
-): CanonicalProviderTarget | null {
-  const parsed = parseProviderTarget(provider, targetUrl === undefined ? provider.homeUrl : targetUrl)
-  if (!parsed) return null
-  const pathname = canonicalPathname(parsed.pathname)
-  return Object.freeze({
-    providerId: provider.id,
-    href: `${parsed.origin}${pathname}`,
-    origin: parsed.origin,
-    pathname,
-    scope: providerTargetScope(provider, pathname),
-  })
-}
-
-export function isSafeProviderAuthority(provider: ProviderConfig, value: string) {
-  const parsed = parseStrictHttpsUrl(value, { allowQuery: true, allowFragment: true })
-  return Boolean(parsed && hasSafeProviderAuthority(provider, parsed))
-}
-
-export function hasSafeProviderAuthority(provider: ProviderConfig, parsed: URL) {
-  return (
-    parsed.protocol === 'https:' &&
-    parsed.username === '' &&
-    parsed.password === '' &&
-    parsed.port === '' &&
-    provider.hosts.includes(parsed.hostname.toLowerCase())
-  )
-}
-
-export function canonicalProviderUrl(value: unknown) {
-  const parsed = parseStrictHttpsUrl(value, { allowQuery: true, allowFragment: true })
-  if (!parsed) return ''
-  return `${parsed.origin}${canonicalPathname(parsed.pathname)}`
-}
-
-export function isCanonicalProviderLandingTarget(provider: ProviderConfig, targetUrl: unknown) {
-  const target = parseProviderRoute(provider, targetUrl)
-  const home = parseProviderTarget(provider, provider.homeUrl)
-  return Boolean(
-    target &&
-    home &&
-    canonicalPathname(target.pathname) === canonicalPathname(home.pathname)
-  )
-}
-
-export function providerTransitionSource(
-  provider: ProviderConfig,
-  value: unknown
-): ProviderTransitionSource | null {
-  if (isCanonicalProviderLandingTarget(provider, value)) {
-    return { kind: 'root', customGptId: undefined, projectId: undefined }
-  }
-  const parsed = parseProviderRoute(provider, value)
-  if (!parsed) return null
-  const segments = canonicalPathSegments(parsed.pathname)
-  if (provider.id === 'chatgpt') {
-    const projectId = (
-      segments.length === 3 &&
-      segments[0] === 'g' &&
-      segments[2] === 'project' &&
-      isChatGptProjectId(segments[1])
-    ) ? segments[1] : undefined
-    if (projectId) {
-      return { kind: 'project', customGptId: undefined, projectId }
-    }
-    const customGptId = segments.length === 2 && segments[0] === 'g' ? segments[1] : undefined
-    if (!isCustomGptId(customGptId) || isChatGptProjectId(customGptId)) return null
-    return { kind: 'custom_gpt', customGptId: customGptId as string, projectId: undefined }
-  }
-  if (
-    provider.id === 'claude' &&
-    segments.length === 2 &&
-    segments[0] === 'project' &&
-    isOpaqueProviderId(segments[1])
-  ) {
-    return { kind: 'project', customGptId: undefined, projectId: segments[1] as string }
-  }
-  return null
-}
-
-export function areProviderTransitionSourcesEquivalent(
-  provider: ProviderConfig,
-  leftUrl: unknown,
-  rightUrl: unknown
-) {
-  const left = providerTransitionSource(provider, leftUrl)
-  const right = providerTransitionSource(provider, rightUrl)
-  return Boolean(
-    left &&
-    right &&
-    left.kind === right.kind &&
-    left.customGptId === right.customGptId &&
-    left.projectId === right.projectId
-  )
-}
-
-export function isApprovedProviderTransition(
-  provider: ProviderConfig,
-  sourceUrl: unknown,
-  destinationUrl: unknown
-) {
-  const source = providerTransitionSource(provider, sourceUrl)
-  const destination = providerConversationRoute(provider, destinationUrl)
-  if (!source || !destination) return false
-  if (source.kind === 'custom_gpt') {
-    return destination.kind === 'custom_gpt' && destination.customGptId === source.customGptId
-  }
-  if (source.kind === 'project') {
-    return destination.kind === 'project' && destination.projectId === source.projectId
-  }
-  return destination.kind === 'standard'
-}
-
-export function isProviderConversationUrl(provider: ProviderConfig, value: unknown) {
-  return providerConversationRoute(provider, value) !== null
-}
-
-export function providerConversationRoute(
-  provider: ProviderConfig,
-  value: unknown
-): ProviderConversationRoute | null {
-  const parsed = parseProviderRoute(provider, value)
-  if (!parsed) return null
-  const segments = canonicalPathSegments(parsed.pathname)
-  if (provider.id === 'chatgpt') {
-    if (segments.length === 2 && segments[0] === 'c') {
-      return isOpaqueProviderId(segments[1])
-        ? { kind: 'standard', customGptId: undefined, projectId: undefined }
-        : null
-    }
-    if (
-      segments.length === 4 &&
-      segments[0] === 'g' &&
-      segments[2] === 'c' &&
-      isCustomGptId(segments[1]) &&
-      isOpaqueProviderId(segments[3])
-    ) {
-      return isChatGptProjectId(segments[1])
-        ? { kind: 'project', customGptId: undefined, projectId: segments[1] as string }
-        : { kind: 'custom_gpt', customGptId: segments[1] as string, projectId: undefined }
-    }
-    return null
-  }
-  if (provider.id === 'claude') {
-    if (segments.length === 2 && segments[0] === 'chat' && isOpaqueProviderId(segments[1])) {
-      return { kind: 'standard', customGptId: undefined, projectId: undefined }
-    }
-    return (
-      segments.length === 4 &&
-      segments[0] === 'project' &&
-      segments[2] === 'chat' &&
-      isOpaqueProviderId(segments[1]) &&
-      isOpaqueProviderId(segments[3])
-    )
-      ? { kind: 'project', customGptId: undefined, projectId: segments[1] as string }
-      : null
-  }
-  if (provider.id === 'gemini') {
-    return segments.length === 2 && segments[0] === 'app' && isOpaqueProviderId(segments[1])
-      ? { kind: 'standard', customGptId: undefined, projectId: undefined }
-      : null
-  }
-  if (provider.id === 'grok') {
-    return segments.length === 2 && segments[0] === 'c' && isOpaqueProviderId(segments[1])
-      ? { kind: 'standard', customGptId: undefined, projectId: undefined }
-      : null
-  }
-  return null
-}
-
-function parseProviderTarget(provider: ProviderConfig, value: unknown) {
-  const parsed = parseStrictHttpsUrl(value)
-  return parsed && hasSafeProviderAuthority(provider, parsed) ? parsed : null
-}
-
-// Browser pages may add their own query or fragment after a safe target is opened.
-// Route recognition ignores those values, while safeProviderTargetUrl remains the
-// sole fail-closed validator for caller-supplied targets.
-function parseProviderRoute(provider: ProviderConfig, value: unknown) {
-  const parsed = parseStrictHttpsUrl(value, { allowQuery: true, allowFragment: true })
-  return parsed && hasSafeProviderAuthority(provider, parsed) ? parsed : null
-}
-
-function parseStrictHttpsUrl(
-  value: unknown,
-  {
-    allowQuery = false,
-    allowFragment = false,
-  }: { allowQuery?: boolean; allowFragment?: boolean } = {}
-) {
-  if (typeof value !== 'string' || value === '' || value.trim() !== value) return null
-  if ((!allowQuery && value.includes('?')) || (!allowFragment && value.includes('#'))) return null
-  const routeEnd = value.search(/[?#]/)
-  const routeInput = routeEnd < 0 ? value : value.slice(0, routeEnd)
-  if (FORBIDDEN_RAW_URL.test(routeInput) || MALFORMED_PERCENT_ESCAPE.test(routeInput)) return null
-  let parsed: URL
-  try {
-    parsed = new URL(value)
-  } catch {
-    return null
-  }
-  if (
-    parsed.protocol !== 'https:' ||
-    parsed.username !== '' ||
-    parsed.password !== '' ||
-    parsed.port !== '' ||
-    (!allowQuery && parsed.search !== '') ||
-    (!allowFragment && parsed.hash !== '')
-  ) {
-    return null
-  }
-  const rawAuthority = rawUrlAuthority(value)
-  if (!rawAuthority || rawAuthority.toLowerCase() !== parsed.hostname.toLowerCase()) return null
-  return parsed
-}
-
-function rawUrlAuthority(value: string) {
-  const scheme = value.indexOf('://')
-  if (scheme < 0 || value.slice(0, scheme).toLowerCase() !== 'https') return ''
-  const start = scheme + 3
-  const relativeEnd = value.slice(start).search(/[/?#]/)
-  return relativeEnd < 0 ? value.slice(start) : value.slice(start, start + relativeEnd)
-}
-
-function providerTargetScope(provider: ProviderConfig, pathname: string): ProviderTargetScope {
-  const segments = canonicalPathSegments(pathname)
-  const key = (kind: ProviderTargetScope['kind'], id?: string) => (
-    id === undefined ? `${provider.id}:${kind}` : `${provider.id}:${kind}:${id}`
-  )
-
-  const home = parseProviderTarget(provider, provider.homeUrl)
-  if (home && pathname === canonicalPathname(home.pathname)) {
-    return Object.freeze({ kind: 'landing', key: key('landing') })
-  }
-
-  if (provider.id === 'chatgpt' && segments[0] === 'g' && isCustomGptId(segments[1])) {
-    const id = segments[1] as string
-    if (isChatGptProjectId(id)) {
-      const isProjectLanding = segments.length === 3 && segments[2] === 'project'
-      const isProjectConversation = (
-        segments.length === 4 &&
-        segments[2] === 'c' &&
-        isOpaqueProviderId(segments[3])
-      )
-      if (isProjectLanding || isProjectConversation) {
-        return Object.freeze({ kind: 'project', key: key('project', id), id })
-      }
-    } else {
-      return Object.freeze({ kind: 'custom_gpt', key: key('custom_gpt', id), id })
-    }
-  }
-
-  if (
-    provider.id === 'claude' &&
-    segments[0] === 'project' &&
-    isOpaqueProviderId(segments[1])
-  ) {
-    const id = segments[1] as string
-    const isProjectLanding = segments.length === 2
-    const isProjectConversation = (
-      segments.length === 4 &&
-      segments[2] === 'chat' &&
-      isOpaqueProviderId(segments[3])
-    )
-    if (isProjectLanding || isProjectConversation) {
-      return Object.freeze({ kind: 'project', key: key('project', id), id })
-    }
-  }
-
-  const conversationId = providerConversationId(provider, segments)
-  if (conversationId) {
-    return Object.freeze({
-      kind: 'conversation',
-      key: key('conversation', conversationId),
-      id: conversationId,
-    })
-  }
-
-  return Object.freeze({ kind: 'path', key: key('path', pathname), id: pathname })
-}
-
-function providerConversationId(provider: ProviderConfig, segments: string[]) {
-  let candidate: string | undefined
-  if (provider.id === 'chatgpt' && segments.length === 2 && segments[0] === 'c') candidate = segments[1]
-  if (provider.id === 'claude' && segments.length === 2 && segments[0] === 'chat') candidate = segments[1]
-  if (provider.id === 'gemini' && segments.length === 2 && segments[0] === 'app') candidate = segments[1]
-  if (provider.id === 'grok' && segments.length === 2 && segments[0] === 'c') candidate = segments[1]
-  return isOpaqueProviderId(candidate) ? candidate : undefined
-}
-
-function isCustomGptId(value: string | undefined) {
-  return Boolean(value?.startsWith('g-') && isOpaqueProviderId(value.slice(2)))
-}
-
-function isChatGptProjectId(value: string | undefined) {
-  return Boolean(value?.startsWith('g-p-') && isOpaqueProviderId(value.slice(4)))
-}
-
-function isOpaqueProviderId(value: string | undefined) {
-  if (
-    !value ||
-    value.length < 8 ||
-    value.length > 128 ||
-    !/^[A-Za-z0-9_-]+$/.test(value) ||
-    !/\d/.test(value)
-  ) {
-    return false
-  }
-  const compact = value.toLowerCase().replace(/[-_]/g, '')
-  return !RESERVED_PROVIDER_PATH_PREFIXES.some((prefix) => compact.startsWith(prefix))
-}
-
-function canonicalPathSegments(pathname: string) {
-  return canonicalPathname(pathname).split('/').filter(Boolean)
-}
-
-function canonicalPathname(pathname: string) {
-  const normalizedEscapes = pathname.replace(/%([0-9a-f]{2})/gi, (_match, byte: string) => {
-    const character = String.fromCharCode(Number.parseInt(byte, 16))
-    return /^[A-Za-z0-9._~-]$/.test(character) ? character : `%${byte.toUpperCase()}`
-  })
-  return normalizedEscapes.replace(/\/+$/, '') || '/'
-}
diff --git a/legacy/extension/extension/shared/visible-provider-actions.ts b/legacy/extension/extension/shared/visible-provider-actions.ts
deleted file mode 100644
index 6a91e27..0000000
--- a/legacy/extension/extension/shared/visible-provider-actions.ts
+++ /dev/null
@@ -1,763 +0,0 @@
-import {
-  isNativeAttachmentDescriptor,
-  MAX_VISIBLE_ATTACHMENTS,
-  MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES,
-} from './native-protocol.js'
-import { getProviderById } from './provider-config.js'
-import type { NativeAttachmentDescriptor } from './native-protocol.js'
-import type { ProviderId } from './provider-config.js'
-
-export const VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION = 'tokenless.visible-provider-action.v1' as const
-export const VISIBLE_PROVIDER_RUNTIME_REQUEST_TYPE = 'tokenless.visible-provider-action.request' as const
-
-export const VISIBLE_PROVIDER_ACTIONS = Object.freeze({
-  AUTH_STATUS: 'auth.status',
-  MODEL_INSPECT: 'model.inspect',
-  MODEL_SELECT: 'model.select',
-  EFFORT_INSPECT: 'effort.inspect',
-  EFFORT_SELECT: 'effort.select',
-  FILE_UPLOAD: 'file.upload',
-  SKILL_UPLOAD: 'skill.upload',
-  CONNECTOR_INSPECT: 'connector.inspect',
-  CONNECTOR_SELECT: 'connector.select',
-  PROMPT_INPUT: 'prompt.input',
-  PROMPT_SUBMIT: 'prompt.submit',
-  PROJECT_INSPECT: 'project.inspect',
-  PROJECT_OPEN: 'project.open',
-  HISTORY_INSPECT: 'history.inspect',
-  HISTORY_OPEN: 'history.open',
-})
-
-export type VisibleProviderAction = typeof VISIBLE_PROVIDER_ACTIONS[keyof typeof VISIBLE_PROVIDER_ACTIONS]
-export type VisibleProviderCapabilityState = 'verified' | 'pending_evidence' | 'unsupported'
-
-export const VISIBLE_PROVIDER_ACTION_METADATA: Readonly<Record<VisibleProviderAction, {
-  domain: 'auth' | 'model' | 'effort' | 'file' | 'skill' | 'connector' | 'prompt' | 'project' | 'history'
-  mutatesVisibleUi: boolean
-  priority: 'core' | 'enrichment'
-}>> = Object.freeze({
-  [VISIBLE_PROVIDER_ACTIONS.AUTH_STATUS]: Object.freeze({ domain: 'auth', mutatesVisibleUi: false, priority: 'core' }),
-  [VISIBLE_PROVIDER_ACTIONS.MODEL_INSPECT]: Object.freeze({ domain: 'model', mutatesVisibleUi: false, priority: 'core' }),
-  [VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT]: Object.freeze({ domain: 'model', mutatesVisibleUi: true, priority: 'core' }),
-  [VISIBLE_PROVIDER_ACTIONS.EFFORT_INSPECT]: Object.freeze({ domain: 'effort', mutatesVisibleUi: false, priority: 'core' }),
-  [VISIBLE_PROVIDER_ACTIONS.EFFORT_SELECT]: Object.freeze({ domain: 'effort', mutatesVisibleUi: true, priority: 'core' }),
-  [VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD]: Object.freeze({ domain: 'file', mutatesVisibleUi: true, priority: 'core' }),
-  [VISIBLE_PROVIDER_ACTIONS.SKILL_UPLOAD]: Object.freeze({ domain: 'skill', mutatesVisibleUi: true, priority: 'enrichment' }),
-  [VISIBLE_PROVIDER_ACTIONS.CONNECTOR_INSPECT]: Object.freeze({ domain: 'connector', mutatesVisibleUi: false, priority: 'enrichment' }),
-  [VISIBLE_PROVIDER_ACTIONS.CONNECTOR_SELECT]: Object.freeze({ domain: 'connector', mutatesVisibleUi: true, priority: 'enrichment' }),
-  [VISIBLE_PROVIDER_ACTIONS.PROMPT_INPUT]: Object.freeze({ domain: 'prompt', mutatesVisibleUi: true, priority: 'core' }),
-  [VISIBLE_PROVIDER_ACTIONS.PROMPT_SUBMIT]: Object.freeze({ domain: 'prompt', mutatesVisibleUi: true, priority: 'core' }),
-  [VISIBLE_PROVIDER_ACTIONS.PROJECT_INSPECT]: Object.freeze({ domain: 'project', mutatesVisibleUi: false, priority: 'enrichment' }),
-  [VISIBLE_PROVIDER_ACTIONS.PROJECT_OPEN]: Object.freeze({ domain: 'project', mutatesVisibleUi: true, priority: 'enrichment' }),
-  [VISIBLE_PROVIDER_ACTIONS.HISTORY_INSPECT]: Object.freeze({ domain: 'history', mutatesVisibleUi: false, priority: 'enrichment' }),
-  [VISIBLE_PROVIDER_ACTIONS.HISTORY_OPEN]: Object.freeze({ domain: 'history', mutatesVisibleUi: true, priority: 'enrichment' }),
-})
-
-const ACTIONS = Object.freeze(Object.values(VISIBLE_PROVIDER_ACTIONS)) as readonly VisibleProviderAction[]
-const ACTION_SET = new Set<string>(ACTIONS)
-const MAX_REQUEST_ID_CHARS = 128
-const MAX_VISIBLE_LABEL_CHARS = 120
-const MAX_PROMPT_UTF8_BYTES = 1024 * 1024
-const EMPTY_PAYLOAD_ACTIONS = new Set<VisibleProviderAction>([
-  VISIBLE_PROVIDER_ACTIONS.AUTH_STATUS,
-  VISIBLE_PROVIDER_ACTIONS.MODEL_INSPECT,
-  VISIBLE_PROVIDER_ACTIONS.EFFORT_INSPECT,
-  VISIBLE_PROVIDER_ACTIONS.CONNECTOR_INSPECT,
-  VISIBLE_PROVIDER_ACTIONS.PROJECT_INSPECT,
-  VISIBLE_PROVIDER_ACTIONS.HISTORY_INSPECT,
-])
-const CHOICE_INSPECTION_ACTIONS = new Set<VisibleProviderAction>([
-  VISIBLE_PROVIDER_ACTIONS.MODEL_INSPECT,
-  VISIBLE_PROVIDER_ACTIONS.EFFORT_INSPECT,
-  VISIBLE_PROVIDER_ACTIONS.CONNECTOR_INSPECT,
-  VISIBLE_PROVIDER_ACTIONS.PROJECT_INSPECT,
-  VISIBLE_PROVIDER_ACTIONS.HISTORY_INSPECT,
-])
-const SELECTION_RESULT_ACTIONS = new Set<VisibleProviderAction>([
-  VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT,
-  VISIBLE_PROVIDER_ACTIONS.EFFORT_SELECT,
-  VISIBLE_PROVIDER_ACTIONS.CONNECTOR_SELECT,
-  VISIBLE_PROVIDER_ACTIONS.PROJECT_OPEN,
-  VISIBLE_PROVIDER_ACTIONS.HISTORY_OPEN,
-])
-
-const SELECT_ACTION_DEPENDENCIES: Readonly<Partial<Record<VisibleProviderAction, VisibleProviderAction>>> = Object.freeze({
-  [VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT]: VISIBLE_PROVIDER_ACTIONS.MODEL_INSPECT,
-  [VISIBLE_PROVIDER_ACTIONS.EFFORT_SELECT]: VISIBLE_PROVIDER_ACTIONS.EFFORT_INSPECT,
-  [VISIBLE_PROVIDER_ACTIONS.CONNECTOR_SELECT]: VISIBLE_PROVIDER_ACTIONS.CONNECTOR_INSPECT,
-  [VISIBLE_PROVIDER_ACTIONS.PROJECT_OPEN]: VISIBLE_PROVIDER_ACTIONS.PROJECT_INSPECT,
-  [VISIBLE_PROVIDER_ACTIONS.HISTORY_OPEN]: VISIBLE_PROVIDER_ACTIONS.HISTORY_INSPECT,
-})
-
-export type VisibleProviderActionError = {
-  code: string
-  message: string
-  retryable: boolean
-}
-
-export type VisibleProviderActionRequest = {
-  protocol: typeof VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION
-  requestId: string
-  provider: ProviderId
-  action: VisibleProviderAction
-  payload: Record<string, unknown>
-}
-
-export type VisibleProviderRuntimeEnvelope = {
-  type: typeof VISIBLE_PROVIDER_RUNTIME_REQUEST_TYPE
-  request: VisibleProviderActionRequest
-}
-
-export type VisibleProviderActionResponse = {
-  protocol: typeof VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION
-  requestId: string | null
-  provider: ProviderId | null
-  action: VisibleProviderAction | null
-  ok: boolean
-  result: unknown
-  error: VisibleProviderActionError | null
-}
-
-export type VisibleAuthStatusResult = {
-  state: 'authenticated' | 'unauthenticated' | 'unknown'
-  plan?: {
-    label: string
-    free: boolean | null
-  }
-  usage?: readonly {
-    label: string
-    value: string
-  }[]
-}
-
-export type VisibleProviderChoice = {
-  label: string
-  selected: boolean
-  enabled: boolean
-  description?: string
-}
-
-export type VisibleProviderChoiceResult = {
-  choices: readonly VisibleProviderChoice[]
-}
-
-export type VisibleProviderUploadResult = {
-  attachments: readonly {
-    attachmentId: string
-    name: string
-    visible: true
-  }[]
-}
-
-export type VisiblePromptInputResult = {
-  inputProof: string
-  visible: true
-}
-
-export type VisiblePromptSubmitResult = {
-  submissionProof: string
-  visible: true
-}
-
-export type VisibleProviderCapabilityConstraints = {
-  allowedLabels?: readonly string[]
-  maxItems?: number
-  maxBytes?: number
-}
-
-export type VisibleProviderActionCapability = {
-  state: VisibleProviderCapabilityState
-  requiresAuthentication: boolean
-  evidence: readonly string[]
-  reason: string | null
-  constraints: Readonly<VisibleProviderCapabilityConstraints>
-}
-
-export type VisibleProviderCapabilityManifest = {
-  protocol: typeof VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION
-  provider: ProviderId
-  actions: Readonly<Record<VisibleProviderAction, VisibleProviderActionCapability>>
-  safety: {
-    visibleUiOnly: true
-    readsPrivateProviderApis: false
-    readsBrowserCredentials: false
-    exactVisibleSelection: true
-  }
-}
-
-export type VisibleProviderCapabilityDeclaration = {
-  state: VisibleProviderCapabilityState
-  requiresAuthentication?: boolean
-  evidence?: readonly string[]
-  reason?: string
-  constraints?: VisibleProviderCapabilityConstraints
-}
-
-export type VisibleProviderActionContext = {
-  authState: VisibleAuthStatusResult['state']
-}
-
-type ValidationSuccess = { ok: true; request: VisibleProviderActionRequest }
-type ValidationFailure = { ok: false; error: VisibleProviderActionError }
-export type VisibleProviderActionValidation = ValidationSuccess | ValidationFailure
-export type VisibleProviderActionAuthorization =
-  | (ValidationSuccess & { capability: VisibleProviderActionCapability })
-  | ValidationFailure
-
-export function listVisibleProviderActions(): VisibleProviderAction[] {
-  return [...ACTIONS]
-}
-
-export function createVisibleProviderActionRequest(
-  input: Omit<Partial<VisibleProviderActionRequest>, 'protocol'> & Record<string, unknown>
-): VisibleProviderActionRequest {
-  return {
-    protocol: VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION,
-    requestId: typeof input.requestId === 'string' ? input.requestId : cryptoRandomId(),
-    provider: input.provider as ProviderId,
-    action: input.action as VisibleProviderAction,
-    payload: isPlainRecord(input.payload) ? input.payload : {},
-  }
-}
-
-export function createVisibleProviderRuntimeEnvelope(
-  request: VisibleProviderActionRequest
-): VisibleProviderRuntimeEnvelope {
-  return { type: VISIBLE_PROVIDER_RUNTIME_REQUEST_TYPE, request }
-}
-
-export function validateVisibleProviderActionRequest(payload: unknown): VisibleProviderActionValidation {
-  if (!isPlainRecord(payload)) return invalid('invalid_visible_action_request', 'Visible provider action request must be an object.')
-  if (!hasExactKeys(payload, ['protocol', 'requestId', 'provider', 'action', 'payload'])) {
-    return invalid('invalid_visible_action_request', 'Visible provider action request contains missing or unsupported fields.')
-  }
-  if (payload.protocol !== VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION) {
-    return invalid('unsupported_visible_action_protocol', 'Visible provider action protocol version is not supported.')
-  }
-  if (!isBoundedIdentifier(payload.requestId, MAX_REQUEST_ID_CHARS)) {
-    return invalid('invalid_visible_action_request_id', 'Visible provider action requestId is invalid.')
-  }
-  if (!getProviderById(payload.provider)) {
-    return invalid('unsupported_provider', 'Visible provider action provider is not supported.')
-  }
-  if (typeof payload.action !== 'string' || !ACTION_SET.has(payload.action)) {
-    return invalid('unsupported_visible_action', 'Visible provider action is not supported by this protocol.')
-  }
-  if (!isPlainRecord(payload.payload)) {
-    return invalid('invalid_visible_action_payload', 'Visible provider action payload must be an object.')
-  }
-
-  const action = payload.action as VisibleProviderAction
-  const normalizedPayload = validateAndNormalizePayload(action, payload.payload)
-  if (normalizedPayload.ok === false) return normalizedPayload
-  return {
-    ok: true,
-    request: {
-      protocol: VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION,
-      requestId: payload.requestId,
-      provider: payload.provider as ProviderId,
-      action,
-      payload: normalizedPayload.value,
-    },
-  }
-}
-
-export function authorizeVisibleProviderAction(
-  payload: unknown,
-  manifest: VisibleProviderCapabilityManifest,
-  context: VisibleProviderActionContext = { authState: 'unknown' }
-): VisibleProviderActionAuthorization {
-  const validation = validateVisibleProviderActionRequest(payload)
-  if (validation.ok === false) return validation
-  if (
-    manifest.protocol !== VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION ||
-    manifest.provider !== validation.request.provider
-  ) {
-    return invalid('visible_action_capability_mismatch', 'Visible provider capability manifest does not match the request.')
-  }
-  const capability = manifest.actions[validation.request.action]
-  if (!capability || capability.state !== 'verified') {
-    const state = capability?.state ?? 'pending_evidence'
-    return invalid(
-      state === 'unsupported' ? 'visible_action_unsupported' : 'visible_action_pending_evidence',
-      capability?.reason ?? 'Visible provider action has no verified DOM implementation.'
-    )
-  }
-  if (!['authenticated', 'unauthenticated', 'unknown'].includes(context.authState)) {
-    return invalid('invalid_visible_action_context', 'Visible provider action authentication context is invalid.')
-  }
-  if (capability.requiresAuthentication && context.authState !== 'authenticated') {
-    return invalid(
-      'visible_action_auth_required',
-      'Visible provider action requires a visibly authenticated provider session.'
-    )
-  }
-  const constraintError = validateCapabilityConstraints(validation.request, capability.constraints)
-  if (constraintError) return constraintError
-  return { ...validation, capability }
-}
-
-export function createVisibleProviderCapabilityManifest(
-  provider: ProviderId,
-  declarations: Partial<Record<VisibleProviderAction, VisibleProviderCapabilityDeclaration>> = {}
-): VisibleProviderCapabilityManifest {
-  if (!getProviderById(provider)) throw new TypeError(`Unsupported visible provider capability manifest: ${String(provider)}.`)
-  for (const key of Object.keys(declarations)) {
-    if (!ACTION_SET.has(key)) throw new TypeError(`Unsupported visible provider action capability: ${key}.`)
-  }
-
-  const actions = Object.fromEntries(ACTIONS.map((action) => {
-    const declaration = declarations[action] ?? {
-      state: 'pending_evidence' as const,
-      reason: 'No verified visible DOM implementation has been registered.',
-    }
-    return [action, normalizeCapability(action, declaration)]
-  })) as Record<VisibleProviderAction, VisibleProviderActionCapability>
-
-  for (const [action, dependency] of Object.entries(SELECT_ACTION_DEPENDENCIES) as [VisibleProviderAction, VisibleProviderAction][]) {
-    if (actions[action].state === 'verified' && actions[dependency].state !== 'verified') {
-      throw new TypeError(`${action} cannot be verified until ${dependency} is verified.`)
-    }
-  }
-
-  return Object.freeze({
-    protocol: VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION,
-    provider,
-    actions: Object.freeze(actions),
-    safety: Object.freeze({
-      visibleUiOnly: true as const,
-      readsPrivateProviderApis: false as const,
-      readsBrowserCredentials: false as const,
-      exactVisibleSelection: true as const,
-    }),
-  })
-}
-
-export function createVisibleProviderActionResponse(
-  request: Partial<VisibleProviderActionRequest> | null | undefined,
-  result: { ok: true; result?: unknown } | { ok: false; error?: Partial<VisibleProviderActionError> }
-): VisibleProviderActionResponse {
-  const requestedAction = typeof request?.action === 'string' && ACTION_SET.has(request.action)
-    ? request.action
-    : null
-  const normalizedResult = result.ok === true && requestedAction
-    ? normalizeSuccessfulResult(requestedAction, result.result)
-    : null
-  const ok = result.ok === true && normalizedResult?.ok === true
-  const invalidResultMessage = normalizedResult?.ok === false
-    ? normalizedResult.message
-    : 'Visible provider action returned an invalid result.'
-  return {
-    protocol: VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION,
-    requestId: typeof request?.requestId === 'string' ? request.requestId : null,
-    provider: getProviderById(request?.provider) ? request?.provider ?? null : null,
-    action: requestedAction,
-    ok,
-    result: ok ? normalizedResult.value : null,
-    error: ok
-      ? null
-      : result.ok === true
-        ? normalizeError({
-          code: 'invalid_visible_action_result',
-          message: invalidResultMessage,
-          retryable: false,
-        })
-        : normalizeError(result.error),
-  }
-}
-
-function normalizeSuccessfulResult(
-  action: VisibleProviderAction,
-  value: unknown
-): { ok: true; value: Record<string, unknown> } | { ok: false; message: string } {
-  if (!isPlainRecord(value)) return invalidResult(`${action} result must be an object.`)
-  if (action === VISIBLE_PROVIDER_ACTIONS.AUTH_STATUS) return normalizeAuthStatusResult(value)
-  if (CHOICE_INSPECTION_ACTIONS.has(action)) return normalizeChoiceResult(action, value)
-  if (action === VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD || action === VISIBLE_PROVIDER_ACTIONS.SKILL_UPLOAD) {
-    if (!hasExactKeys(value, ['attachments']) || !Array.isArray(value.attachments) || value.attachments.length < 1 || value.attachments.length > MAX_VISIBLE_ATTACHMENTS) {
-      return invalidResult(`${action} result must contain a nonempty bounded attachments array.`)
-    }
-    const attachments: Array<{ attachmentId: string; name: string; visible: true }> = []
-    for (const item of value.attachments) {
-      if (
-        !isPlainRecord(item) ||
-        !hasExactKeys(item, ['attachmentId', 'name', 'visible']) ||
-        !isBoundedIdentifier(item.attachmentId, 256) ||
-        !isBoundedVisibleText(item.name, 255) ||
-        item.visible !== true
-      ) {
-        return invalidResult(`${action} result contains an invalid visible attachment proof.`)
-      }
-      attachments.push({ attachmentId: item.attachmentId, name: item.name, visible: true })
-    }
-    return { ok: true, value: { attachments } }
-  }
-  if (SELECTION_RESULT_ACTIONS.has(action)) {
-    if (!hasExactKeys(value, ['label', 'visible']) || !isVisibleLabel(value.label) || value.visible !== true) {
-      return invalidResult(`${action} result must confirm one exact visible label.`)
-    }
-    return { ok: true, value: { label: normalizeVisibleLabel(value.label), visible: true } }
-  }
-  if (action === VISIBLE_PROVIDER_ACTIONS.PROMPT_INPUT) {
-    if (!hasExactKeys(value, ['inputProof', 'visible']) || !isBoundedIdentifier(value.inputProof, 256) || value.visible !== true) {
-      return invalidResult('prompt.input result must contain only a bounded inputProof and visible confirmation.')
-    }
-    return { ok: true, value: { inputProof: value.inputProof, visible: true } }
-  }
-  if (action === VISIBLE_PROVIDER_ACTIONS.PROMPT_SUBMIT) {
-    if (!hasExactKeys(value, ['submissionProof', 'visible']) || !isBoundedIdentifier(value.submissionProof, 256) || value.visible !== true) {
-      return invalidResult('prompt.submit result must contain only a bounded submissionProof and visible confirmation.')
-    }
-    return { ok: true, value: { submissionProof: value.submissionProof, visible: true } }
-  }
-  return invalidResult(`${action} has no success-result contract.`)
-}
-
-function normalizeAuthStatusResult(
-  value: Record<string, unknown>
-): { ok: true; value: Record<string, unknown> } | { ok: false; message: string } {
-  if (!hasOnlyKeys(value, ['state', 'plan', 'usage']) || !['authenticated', 'unauthenticated', 'unknown'].includes(String(value.state))) {
-    return invalidResult('auth.status result contains an invalid state or unsupported fields.')
-  }
-  const normalized: Record<string, unknown> = { state: value.state }
-  if (value.plan !== undefined) {
-    if (
-      !isPlainRecord(value.plan) ||
-      !hasExactKeys(value.plan, ['label', 'free']) ||
-      !isVisibleLabel(value.plan.label) ||
-      (typeof value.plan.free !== 'boolean' && value.plan.free !== null)
-    ) {
-      return invalidResult('auth.status plan must contain only a visible label and boolean-or-null free status.')
-    }
-    normalized.plan = { label: normalizeVisibleLabel(value.plan.label), free: value.plan.free }
-  }
-  if (value.usage !== undefined) {
-    if (!Array.isArray(value.usage) || value.usage.length > 32) {
-      return invalidResult('auth.status usage must be a bounded array of visible label/value rows.')
-    }
-    const usage: Array<{ label: string; value: string }> = []
-    for (const row of value.usage) {
-      if (
-        !isPlainRecord(row) ||
-        !hasExactKeys(row, ['label', 'value']) ||
-        !isVisibleLabel(row.label) ||
-        !isBoundedVisibleText(row.value, 500)
-      ) {
-        return invalidResult('auth.status usage contains an invalid or unsupported row.')
-      }
-      usage.push({ label: normalizeVisibleLabel(row.label), value: row.value.trim().normalize('NFKC') })
-    }
-    normalized.usage = usage
-  }
-  return { ok: true, value: normalized }
-}
-
-function normalizeChoiceResult(
-  action: VisibleProviderAction,
-  value: Record<string, unknown>
-): { ok: true; value: Record<string, unknown> } | { ok: false; message: string } {
-  if (!hasExactKeys(value, ['choices']) || !Array.isArray(value.choices) || value.choices.length > 100) {
-    return invalidResult(`${action} result must contain only a bounded choices array.`)
-  }
-  const choices: VisibleProviderChoice[] = []
-  for (const choice of value.choices) {
-    if (
-      !isPlainRecord(choice) ||
-      !hasOnlyKeys(choice, ['label', 'selected', 'enabled', 'description']) ||
-      !Object.hasOwn(choice, 'label') ||
-      !Object.hasOwn(choice, 'selected') ||
-      !Object.hasOwn(choice, 'enabled') ||
-      !isVisibleLabel(choice.label) ||
-      typeof choice.selected !== 'boolean' ||
-      typeof choice.enabled !== 'boolean' ||
-      (choice.description !== undefined && !isBoundedVisibleText(choice.description, 500))
-    ) {
-      return invalidResult(`${action} result contains an invalid visible choice.`)
-    }
-    choices.push({
-      label: normalizeVisibleLabel(choice.label),
-      selected: choice.selected,
-      enabled: choice.enabled,
-      ...(typeof choice.description === 'string'
-        ? { description: choice.description.trim().normalize('NFKC') }
-        : {}),
-    })
-  }
-  return { ok: true, value: { choices } }
-}
-
-function invalidResult(message: string): { ok: false; message: string } {
-  return { ok: false, message }
-}
-
-function validateAndNormalizePayload(
-  action: VisibleProviderAction,
-  payload: Record<string, unknown>
-): { ok: true; value: Record<string, unknown> } | ValidationFailure {
-  if (EMPTY_PAYLOAD_ACTIONS.has(action)) {
-    return Object.keys(payload).length === 0
-      ? { ok: true, value: {} }
-      : invalid('invalid_visible_action_payload', `${action} does not accept payload fields.`)
-  }
-  if (action === VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT) {
-    if (!hasOnlyKeys(payload, ['label', 'fallbacks']) || !isVisibleLabel(payload.label)) {
-      return invalid('invalid_model_selection', 'model.select requires one exact visible model label.')
-    }
-    if (payload.fallbacks !== undefined) {
-      if (
-        !Array.isArray(payload.fallbacks) ||
-        payload.fallbacks.length > 8 ||
-        !payload.fallbacks.every(isVisibleLabel)
-      ) {
-        return invalid('invalid_model_selection', 'Model fallbacks must contain at most eight exact visible labels.')
-      }
-      const labels = [payload.label, ...payload.fallbacks].map((label) => normalizeVisibleLabel(label as string))
-      if (new Set(labels).size !== labels.length) {
-        return invalid('invalid_model_selection', 'Primary and fallback model labels must be unique.')
-      }
-    }
-    return {
-      ok: true,
-      value: {
-        label: normalizeVisibleLabel(payload.label as string),
-        ...(Array.isArray(payload.fallbacks)
-          ? { fallbacks: payload.fallbacks.map((label) => normalizeVisibleLabel(label as string)) }
-          : {}),
-      },
-    }
-  }
-  if (
-    action === VISIBLE_PROVIDER_ACTIONS.EFFORT_SELECT ||
-    action === VISIBLE_PROVIDER_ACTIONS.CONNECTOR_SELECT ||
-    action === VISIBLE_PROVIDER_ACTIONS.PROJECT_OPEN ||
-    action === VISIBLE_PROVIDER_ACTIONS.HISTORY_OPEN
-  ) {
-    if (!hasExactKeys(payload, ['label']) || !isVisibleLabel(payload.label)) {
-      return invalid('invalid_visible_selection', `${action} requires one exact visible label.`)
-    }
-    return { ok: true, value: { label: normalizeVisibleLabel(payload.label as string) } }
-  }
-  if (action === VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD || action === VISIBLE_PROVIDER_ACTIONS.SKILL_UPLOAD) {
-    return validateUploadPayload(action, payload)
-  }
-  if (action === VISIBLE_PROVIDER_ACTIONS.PROMPT_INPUT || action === VISIBLE_PROVIDER_ACTIONS.PROMPT_SUBMIT) {
-    if (
-      !hasExactKeys(payload, ['text', 'mode']) ||
-      typeof payload.text !== 'string' ||
-      payload.text.trim().length === 0 ||
-      new TextEncoder().encode(payload.text).byteLength > MAX_PROMPT_UTF8_BYTES ||
-      payload.mode !== 'replace'
-    ) {
-      return invalid(
-        'invalid_prompt_action',
-        `${action} requires nonempty text up to ${MAX_PROMPT_UTF8_BYTES} UTF-8 bytes and mode "replace".`
-      )
-    }
-    return { ok: true, value: { text: payload.text, mode: 'replace' } }
-  }
-  return invalid('unsupported_visible_action', 'Visible provider action has no payload contract.')
-}
-
-function validateUploadPayload(
-  action: VisibleProviderAction,
-  payload: Record<string, unknown>
-): { ok: true; value: Record<string, unknown> } | ValidationFailure {
-  if (!hasExactKeys(payload, ['attachments']) || !Array.isArray(payload.attachments) || payload.attachments.length < 1) {
-    return invalid('invalid_visible_upload', `${action} requires a nonempty attachments array.`)
-  }
-  if (payload.attachments.length > MAX_VISIBLE_ATTACHMENTS) {
-    return invalid('too_many_visible_uploads', `Visible upload may contain at most ${MAX_VISIBLE_ATTACHMENTS} files.`)
-  }
-  let bundleId: string | undefined
-  let totalBytes = 0
-  const attachmentIds = new Set<string>()
-  const normalized: NativeAttachmentDescriptor[] = []
-  for (const value of payload.attachments) {
-    if (!isNativeAttachmentDescriptor(value)) {
-      return invalid('invalid_visible_upload', 'Every visible upload descriptor must be path-free, valid, and contain no unknown fields.')
-    }
-    bundleId ??= value.bundleId
-    if (value.bundleId !== bundleId) {
-      return invalid('visible_upload_bundle_mismatch', 'Visible upload descriptors must share one bundleId.')
-    }
-    if (attachmentIds.has(value.attachmentId)) {
-      return invalid('duplicate_visible_upload', 'Visible upload attachment identities must be unique.')
-    }
-    attachmentIds.add(value.attachmentId)
-    totalBytes += value.size
-    if (!Number.isSafeInteger(totalBytes) || totalBytes > MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES) {
-      return invalid(
-        'visible_upload_too_large',
-        `Visible upload may contain at most ${MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES} bytes in total.`
-      )
-    }
-    normalized.push({
-      protocol: value.protocol,
-      bundleId: value.bundleId,
-      attachmentId: value.attachmentId,
-      name: value.name,
-      type: value.type,
-      size: value.size,
-      sha256: value.sha256,
-    })
-  }
-  return { ok: true, value: { attachments: normalized } }
-}
-
-function normalizeCapability(
-  action: VisibleProviderAction,
-  declaration: VisibleProviderCapabilityDeclaration
-): VisibleProviderActionCapability {
-  if (!['verified', 'pending_evidence', 'unsupported'].includes(declaration.state)) {
-    throw new TypeError(`${action} has an invalid capability state.`)
-  }
-  const evidence = declaration.evidence === undefined ? [] : [...declaration.evidence]
-  if (!evidence.every(isEvidenceIdentifier) || new Set(evidence).size !== evidence.length) {
-    throw new TypeError(`${action} evidence must contain unique bounded identifiers.`)
-  }
-  const reason = declaration.reason?.trim() || null
-  if (declaration.state === 'verified' && evidence.length === 0) {
-    throw new TypeError(`${action} requires DOM evidence before it can be verified.`)
-  }
-  if (declaration.state !== 'verified' && !reason) {
-    throw new TypeError(`${action} requires a reason while it is not verified.`)
-  }
-  const constraints = normalizeCapabilityConstraints(action, declaration.constraints ?? {})
-  return Object.freeze({
-    state: declaration.state,
-    requiresAuthentication: declaration.requiresAuthentication === true,
-    evidence: Object.freeze(evidence),
-    reason,
-    constraints,
-  })
-}
-
-function normalizeCapabilityConstraints(
-  action: VisibleProviderAction,
-  constraints: VisibleProviderCapabilityConstraints
-): Readonly<VisibleProviderCapabilityConstraints> {
-  if (!isPlainRecord(constraints) || !hasOnlyKeys(constraints, ['allowedLabels', 'maxItems', 'maxBytes'])) {
-    throw new TypeError(`${action} contains invalid capability constraints.`)
-  }
-  const normalized: VisibleProviderCapabilityConstraints = {}
-  if (constraints.allowedLabels !== undefined) {
-    if (
-      !Array.isArray(constraints.allowedLabels) ||
-      constraints.allowedLabels.length < 1 ||
-      constraints.allowedLabels.length > 100 ||
-      !constraints.allowedLabels.every(isVisibleLabel)
-    ) {
-      throw new TypeError(`${action} allowedLabels are invalid.`)
-    }
-    const labels = constraints.allowedLabels.map(normalizeVisibleLabel)
-    if (new Set(labels).size !== labels.length) throw new TypeError(`${action} allowedLabels must be unique.`)
-    normalized.allowedLabels = Object.freeze(labels)
-  }
-  if (constraints.maxItems !== undefined) {
-    if (!Number.isSafeInteger(constraints.maxItems) || constraints.maxItems < 1 || constraints.maxItems > MAX_VISIBLE_ATTACHMENTS) {
-      throw new TypeError(`${action} maxItems is invalid.`)
-    }
-    normalized.maxItems = constraints.maxItems
-  }
-  if (constraints.maxBytes !== undefined) {
-    if (!Number.isSafeInteger(constraints.maxBytes) || constraints.maxBytes < 1 || constraints.maxBytes > MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES) {
-      throw new TypeError(`${action} maxBytes is invalid.`)
-    }
-    normalized.maxBytes = constraints.maxBytes
-  }
-  return Object.freeze(normalized)
-}
-
-function validateCapabilityConstraints(
-  request: VisibleProviderActionRequest,
-  constraints: Readonly<VisibleProviderCapabilityConstraints>
-): ValidationFailure | null {
-  const label = request.payload.label
-  if (
-    constraints.allowedLabels &&
-    typeof label === 'string' &&
-    (
-      !constraints.allowedLabels.includes(label) ||
-      (
-        Array.isArray(request.payload.fallbacks) &&
-        request.payload.fallbacks.some((fallback) => (
-          typeof fallback !== 'string' || !constraints.allowedLabels?.includes(fallback)
-        ))
-      )
-    )
-  ) {
-    return invalid('visible_action_choice_unavailable', 'Requested visible label is not declared by this provider capability.')
-  }
-  const attachments = request.payload.attachments
-  if (Array.isArray(attachments)) {
-    if (constraints.maxItems !== undefined && attachments.length > constraints.maxItems) {
-      return invalid('visible_action_limit_exceeded', 'Visible upload exceeds the provider capability file-count limit.')
-    }
-    const totalBytes = attachments.reduce((total, value) => total + Number((value as NativeAttachmentDescriptor).size), 0)
-    if (constraints.maxBytes !== undefined && totalBytes > constraints.maxBytes) {
-      return invalid('visible_action_limit_exceeded', 'Visible upload exceeds the provider capability byte limit.')
-    }
-  }
-  return null
-}
-
-function isVisibleLabel(value: unknown): value is string {
-  return (
-    typeof value === 'string' &&
-    value.trim().length > 0 &&
-    value.trim().length <= MAX_VISIBLE_LABEL_CHARS &&
-    !/[\u0000-\u001f\u007f]/u.test(value)
-  )
-}
-
-function isBoundedVisibleText(value: unknown, maxChars: number): value is string {
-  return (
-    typeof value === 'string' &&
-    value.trim().length > 0 &&
-    value.trim().length <= maxChars &&
-    !/[\u0000-\u001f\u007f]/u.test(value)
-  )
-}
-
-function normalizeVisibleLabel(value: string) {
-  return value.trim().normalize('NFKC')
-}
-
-function isEvidenceIdentifier(value: unknown): value is string {
-  return typeof value === 'string' && value.length >= 1 && value.length <= 200 && value.trim() === value && !/[\u0000-\u001f\u007f]/u.test(value)
-}
-
-function isBoundedIdentifier(value: unknown, maxChars: number): value is string {
-  return typeof value === 'string' && value.length >= 1 && value.length <= maxChars && value.trim() === value && !/[\u0000-\u001f\u007f]/u.test(value)
-}
-
-function isPlainRecord(value: unknown): value is Record<string, unknown> {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) return false
-  const prototype = Object.getPrototypeOf(value)
-  return prototype === Object.prototype || prototype === null
-}
-
-function hasOnlyKeys(value: Record<string, unknown>, allowed: readonly string[]) {
-  const allowedSet = new Set(allowed)
-  return Object.keys(value).every((key) => allowedSet.has(key))
-}
-
-function hasExactKeys(value: Record<string, unknown>, expected: readonly string[]) {
-  return Object.keys(value).length === expected.length && expected.every((key) => Object.hasOwn(value, key))
-}
-
-function invalid(code: string, message: string): ValidationFailure {
-  return { ok: false, error: { code, message, retryable: false } }
-}
-
-function normalizeError(error: Partial<VisibleProviderActionError> | undefined): VisibleProviderActionError {
-  return {
-    code: typeof error?.code === 'string' ? error.code : 'visible_action_failed',
-    message: typeof error?.message === 'string' ? error.message : 'Visible provider action failed.',
-    retryable: error?.retryable === true,
-  }
-}
-
-function cryptoRandomId() {
-  return globalThis.crypto?.randomUUID?.() ?? `visible-action-${Date.now()}-${Math.random().toString(16).slice(2)}`
-}
diff --git a/legacy/extension/extension/shared/visible-provider-capabilities.ts b/legacy/extension/extension/shared/visible-provider-capabilities.ts
deleted file mode 100644
index c334723..0000000
--- a/legacy/extension/extension/shared/visible-provider-capabilities.ts
+++ /dev/null
@@ -1,116 +0,0 @@
-import { PROVIDER_IDS, getProviderById } from './provider-config.js'
-import {
-  VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION,
-  VISIBLE_PROVIDER_ACTIONS,
-  createVisibleProviderCapabilityManifest,
-  listVisibleProviderActions,
-} from './visible-provider-actions.js'
-import type { ProviderId } from './provider-config.js'
-import type {
-  VisibleProviderAction,
-  VisibleProviderCapabilityDeclaration,
-  VisibleProviderCapabilityManifest,
-} from './visible-provider-actions.js'
-
-const verified = (
-  evidence: string,
-  options: Omit<VisibleProviderCapabilityDeclaration, 'state' | 'evidence'> = {}
-): VisibleProviderCapabilityDeclaration => ({
-  state: 'verified',
-  evidence: [evidence],
-  ...options,
-})
-
-const CHATGPT_CAPABILITIES = createVisibleProviderCapabilityManifest(PROVIDER_IDS.CHATGPT, {
-  [VISIBLE_PROVIDER_ACTIONS.AUTH_STATUS]: verified('chatgpt:signed-in-paid:session-status:2026-07-17'),
-  [VISIBLE_PROVIDER_ACTIONS.MODEL_INSPECT]: verified('chatgpt:signed-in-paid:model-menu-open:2026-07-17'),
-  [VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT]: verified('chatgpt:model-selection:authenticated-browser-and-local-e2e:2026-07-17', { requiresAuthentication: true }),
-  [VISIBLE_PROVIDER_ACTIONS.EFFORT_INSPECT]: verified('chatgpt:signed-in-paid:thinking-effort-menu-open:2026-07-17', { requiresAuthentication: true }),
-  [VISIBLE_PROVIDER_ACTIONS.EFFORT_SELECT]: verified('chatgpt:effort-selection:authenticated-dom-and-local-e2e:2026-07-17', { requiresAuthentication: true }),
-  [VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD]: verified(
-    'chatgpt:signed-in-paid:file-input-ready-and-native-local-e2e:2026-07-17',
-    { requiresAuthentication: true }
-  ),
-  [VISIBLE_PROVIDER_ACTIONS.PROMPT_INPUT]: verified('chatgpt:signed-in-paid:composer-input:2026-07-17'),
-  [VISIBLE_PROVIDER_ACTIONS.PROMPT_SUBMIT]: verified('chatgpt:visible-submit:accepted-browser-e2e'),
-})
-
-const GEMINI_CAPABILITIES = createVisibleProviderCapabilityManifest(PROVIDER_IDS.GEMINI, {
-  [VISIBLE_PROVIDER_ACTIONS.AUTH_STATUS]: verified('gemini:signed-in-unknown:session-status:2026-07-17'),
-  [VISIBLE_PROVIDER_ACTIONS.MODEL_INSPECT]: verified('gemini:signed-in-unknown:model-menu-open:2026-07-17'),
-  [VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT]: verified('gemini:model-selection:authenticated-browser-and-local-e2e:2026-07-17', { requiresAuthentication: true }),
-  [VISIBLE_PROVIDER_ACTIONS.EFFORT_INSPECT]: verified('gemini:signed-in-unknown:thinking-effort-menu-open:2026-07-17', { requiresAuthentication: true }),
-  [VISIBLE_PROVIDER_ACTIONS.EFFORT_SELECT]: verified('gemini:effort-selection:authenticated-browser-and-local-e2e:2026-07-17', { requiresAuthentication: true }),
-  [VISIBLE_PROVIDER_ACTIONS.PROMPT_INPUT]: verified('gemini:signed-in-unknown:composer-input:2026-07-17'),
-  [VISIBLE_PROVIDER_ACTIONS.PROMPT_SUBMIT]: verified('gemini:visible-submit:accepted-local-adapter-e2e'),
-  [VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD]: verified(
-    'gemini:signed-in-unknown:file-input-ready-and-native-local-e2e:2026-07-17',
-    { requiresAuthentication: true }
-  ),
-})
-
-const CLAUDE_CAPABILITIES = createVisibleProviderCapabilityManifest(PROVIDER_IDS.CLAUDE, {
-  [VISIBLE_PROVIDER_ACTIONS.AUTH_STATUS]: verified('claude:signed-in-free:session-status:2026-07-17'),
-  [VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD]: verified(
-    'claude:signed-in-free:file-input-ready-and-native-local-e2e:2026-07-17',
-    { requiresAuthentication: true }
-  ),
-  [VISIBLE_PROVIDER_ACTIONS.PROMPT_INPUT]: verified('claude:signed-in-free:composer-input:2026-07-17', { requiresAuthentication: true }),
-  [VISIBLE_PROVIDER_ACTIONS.PROMPT_SUBMIT]: verified('claude:visible-submit:accepted-local-adapter-e2e', { requiresAuthentication: true }),
-  [VISIBLE_PROVIDER_ACTIONS.MODEL_INSPECT]: verified('claude:signed-in-free:model-menu-open:2026-07-17', { requiresAuthentication: true }),
-  [VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT]: verified('claude:model-selection:authenticated-browser-and-local-e2e:2026-07-17', { requiresAuthentication: true }),
-  [VISIBLE_PROVIDER_ACTIONS.EFFORT_INSPECT]: verified('claude:signed-in-free:thinking-effort-menu-open:2026-07-17', { requiresAuthentication: true }),
-  [VISIBLE_PROVIDER_ACTIONS.EFFORT_SELECT]: verified('claude:effort-selection:authenticated-browser-and-local-e2e:2026-07-17', { requiresAuthentication: true }),
-})
-
-const GROK_CAPABILITIES = createVisibleProviderCapabilityManifest(PROVIDER_IDS.GROK, {
-  [VISIBLE_PROVIDER_ACTIONS.AUTH_STATUS]: verified('grok:signed-in-unknown:session-status:2026-07-17'),
-  [VISIBLE_PROVIDER_ACTIONS.MODEL_INSPECT]: verified('grok:signed-in-unknown:model-menu-open:2026-07-17'),
-  [VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT]: verified('grok:model-selection:authenticated-entitlement-fail-closed-and-local-e2e:2026-07-17', { requiresAuthentication: true }),
-  [VISIBLE_PROVIDER_ACTIONS.EFFORT_INSPECT]: {
-    state: 'unsupported',
-    requiresAuthentication: true,
-    evidence: ['grok:signed-in-unknown:thinking-effort-menu-open:2026-07-17'],
-    reason: 'Grok couples thinking effort to visible model profiles and exposes no independent effort control.',
-  },
-  [VISIBLE_PROVIDER_ACTIONS.EFFORT_SELECT]: {
-    state: 'unsupported',
-    requiresAuthentication: true,
-    evidence: ['grok:signed-in-unknown:thinking-effort-menu-open:2026-07-17'],
-    reason: 'Grok couples thinking effort to visible model profiles and exposes no independent effort control.',
-  },
-  [VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD]: verified(
-    'grok:signed-in-unknown:file-input-ready-and-native-local-e2e:2026-07-17',
-    { requiresAuthentication: true }
-  ),
-  [VISIBLE_PROVIDER_ACTIONS.PROMPT_INPUT]: verified('grok:signed-in-unknown:composer-input:2026-07-17'),
-  [VISIBLE_PROVIDER_ACTIONS.PROMPT_SUBMIT]: verified('grok:visible-submit:accepted-local-adapter-e2e', { requiresAuthentication: true }),
-})
-
-const CAPABILITIES: Readonly<Record<ProviderId, VisibleProviderCapabilityManifest>> = Object.freeze({
-  [PROVIDER_IDS.CHATGPT]: CHATGPT_CAPABILITIES,
-  [PROVIDER_IDS.GEMINI]: GEMINI_CAPABILITIES,
-  [PROVIDER_IDS.CLAUDE]: CLAUDE_CAPABILITIES,
-  [PROVIDER_IDS.GROK]: GROK_CAPABILITIES,
-})
-
-export function getVisibleProviderActionCapabilities(providerId: unknown): VisibleProviderCapabilityManifest | null {
-  const provider = getProviderById(providerId)
-  return provider ? CAPABILITIES[provider.id] : null
-}
-
-export function listVisibleProviderActionCapabilities(): VisibleProviderCapabilityManifest[] {
-  return Object.values(CAPABILITIES)
-}
-
-export function visibleProviderActionCapabilitiesPayload() {
-  return {
-    protocol: VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION,
-    actions: listVisibleProviderActions(),
-    providers: listVisibleProviderActionCapabilities(),
-  }
-}
-
-export function isVisibleProviderActionVerified(providerId: unknown, action: VisibleProviderAction) {
-  return getVisibleProviderActionCapabilities(providerId)?.actions[action]?.state === 'verified'
-}
diff --git a/legacy/extension/package.json b/legacy/extension/package.json
deleted file mode 100644
index 5239b04..0000000
--- a/legacy/extension/package.json
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  "name": "tokenless-browser-session-bridge",
-  "version": "0.1.4",
-  "description": "Visible browser-session bridge extension and protocol for user-authorized web AI sessions.",
-  "private": true,
-  "type": "module",
-  "license": "MIT",
-  "exports": {
-    ".": "./dist/src/index.js",
-    "./protocol": "./dist/src/protocol.js",
-    "./providers": "./dist/src/providers.js"
-  },
-  "files": [
-    "dist/extension",
-    "dist/src",
-    "README.md",
-    "package.json"
-  ],
-  "scripts": {
-    "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json && node dist/src/build-extension.mjs",
-    "lint": "tsc -p tsconfig.json --noEmit",
-    "pack:extension": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json && node dist/src/build-extension.mjs --zip",
-    "prepack": "npm run build"
-  },
-  "engines": {
-    "node": ">=22"
-  }
-}
diff --git a/legacy/extension/src/build-extension.mts b/legacy/extension/src/build-extension.mts
deleted file mode 100644
index fe52d19..0000000
--- a/legacy/extension/src/build-extension.mts
+++ /dev/null
@@ -1,201 +0,0 @@
-import { createHash } from 'node:crypto'
-import fs from 'node:fs'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { spawnSync } from 'node:child_process'
-
-const packageRoot = path.resolve(fileURLToPath(new URL('../..', import.meta.url)))
-const extensionRoot = path.join(packageRoot, 'extension')
-const distRoot = path.join(packageRoot, 'dist')
-const distExtensionRoot = path.join(distRoot, 'extension')
-
-await fs.promises.mkdir(distExtensionRoot, { recursive: true })
-await copyStaticExtensionFiles(extensionRoot, distExtensionRoot)
-await prepareContentScripts(distExtensionRoot)
-await removeDevelopmentArtifacts(distExtensionRoot)
-
-const manifestPath = path.join(distExtensionRoot, 'manifest.json')
-const manifest = JSON.parse(await fs.promises.readFile(manifestPath, 'utf8')) as Record<string, any>
-verifyManifest(manifest)
-
-const files = await listFiles(distExtensionRoot)
-verifyExtensionArtifacts(files)
-const manifestRecord = {
-  package: 'tokenless-browser-session-bridge',
-  builtAt: new Date().toISOString(),
-  manifestVersion: manifest.manifest_version,
-  version: manifest.version,
-  files: files.map((file) => ({
-    path: portableRelativePath(distExtensionRoot, file),
-    sha256: hashFile(file),
-  })),
-}
-
-await fs.promises.writeFile(
-  path.join(distRoot, 'extension-build-manifest.json'),
-  `${JSON.stringify(manifestRecord, null, 2)}\n`
-)
-
-if (process.argv.includes('--zip')) {
-  const zipPath = path.join(distRoot, 'tokenless-browser-session-bridge.zip')
-  await fs.promises.rm(zipPath, { force: true })
-  const result = spawnSync('zip', ['-qr', zipPath, '.'], {
-    cwd: distExtensionRoot,
-    encoding: 'utf8',
-  })
-  if (result.status !== 0) {
-    throw new Error(result.stderr || 'zip command failed')
-  }
-}
-
-console.log(JSON.stringify({
-  status: 'built',
-  extension: distExtensionRoot,
-  files: files.length,
-}, null, 2))
-
-function verifyManifest(manifest: Record<string, any>) {
-  if (manifest.manifest_version !== 3) {
-    throw new Error('extension manifest must use Manifest V3')
-  }
-  if (!manifest.background?.service_worker) {
-    throw new Error('extension manifest must declare a background service worker')
-  }
-  const expectedIcons = ['icons/tokenless-16.png', 'icons/tokenless-32.png', 'icons/tokenless-48.png', 'icons/tokenless-128.png']
-  const iconPaths = Object.values(manifest.icons ?? {})
-  if (iconPaths.length !== expectedIcons.length || expectedIcons.some((icon) => !iconPaths.includes(icon))) {
-    throw new Error('extension manifest must declare the Tokenless production icon set')
-  }
-  if (manifest.homepage_url !== 'https://github.com/jazelly/tokenless') {
-    throw new Error('extension manifest must declare the public Tokenless homepage')
-  }
-  if (!Array.isArray(manifest.content_scripts) || manifest.content_scripts.length !== 1) {
-    throw new Error('extension manifest must declare exactly one provider content script')
-  }
-  const expectedHosts = new Set([
-    'https://chatgpt.com/*',
-    'https://chat.openai.com/*',
-    'https://gemini.google.com/*',
-    'https://claude.ai/*',
-    'https://grok.com/*',
-  ])
-  const hostPermissions = new Set(manifest.host_permissions || [])
-  if (
-    hostPermissions.size !== expectedHosts.size ||
-    [...expectedHosts].some((host) => !hostPermissions.has(host))
-  ) {
-    throw new Error('extension manifest host permissions must be restricted to approved provider origins')
-  }
-  const contentMatches = new Set(manifest.content_scripts[0]?.matches || [])
-  if (
-    contentMatches.size !== expectedHosts.size ||
-    [...expectedHosts].some((host) => !contentMatches.has(host))
-  ) {
-    throw new Error('extension content scripts must be restricted to approved provider origins')
-  }
-  const forbiddenPermissions = new Set(['cookies', 'webRequest', 'webRequestBlocking'])
-  const permissions = new Set(manifest.permissions || [])
-  if (!permissions.has('debugger')) {
-    throw new Error('extension manifest must request debugger for trusted ChatGPT clicks')
-  }
-  for (const permission of forbiddenPermissions) {
-    if (permissions.has(permission)) {
-      throw new Error(`extension manifest must not request ${permission}`)
-    }
-  }
-  if (manifest.side_panel?.default_path !== 'settings/index.html') {
-    throw new Error('extension manifest must declare the Tokenless side panel')
-  }
-  if (manifest.externally_connectable) {
-    throw new Error('extension manifest must not allow external origins to drive the bridge')
-  }
-  if (manifest.options_ui !== undefined) {
-    throw new Error('extension manifest must expose Settings only through the Tokenless side panel')
-  }
-}
-
-function verifyExtensionArtifacts(files: string[]) {
-  const relativeFiles = files.map((file) => portableRelativePath(distExtensionRoot, file))
-  const forbidden = relativeFiles.find((file) => (
-    file.startsWith('task/') ||
-    file.startsWith('sidepanel/') ||
-    file.startsWith('daemon/') ||
-    file.includes('runner') ||
-    file.endsWith('.map') ||
-    file.endsWith('.d.ts')
-  ))
-  if (forbidden) {
-    throw new Error(`extension build must not contain obsolete execution surface: ${forbidden}`)
-  }
-  if (!relativeFiles.includes('settings/index.html') || !relativeFiles.includes('settings/index.js')) {
-    throw new Error('extension build must contain the Settings page')
-  }
-  for (const icon of ['icons/tokenless-16.png', 'icons/tokenless-32.png', 'icons/tokenless-48.png', 'icons/tokenless-128.png']) {
-    if (!relativeFiles.includes(icon)) throw new Error(`extension build must contain ${icon}`)
-  }
-}
-
-async function listFiles(root: string): Promise<string[]> {
-  const entries = await fs.promises.readdir(root, { withFileTypes: true })
-  const files: string[] = []
-  for (const entry of entries) {
-    const fullPath = path.join(root, entry.name)
-    if (entry.isDirectory()) {
-      files.push(...await listFiles(fullPath))
-    } else if (entry.isFile()) {
-      files.push(fullPath)
-    }
-  }
-  return files.sort()
-}
-
-function hashFile(file: string) {
-  return createHash('sha256').update(fs.readFileSync(file)).digest('hex')
-}
-
-function portableRelativePath(root: string, file: string) {
-  return path.relative(root, file).split(path.sep).join('/')
-}
-
-async function copyStaticExtensionFiles(sourceRoot: string, targetRoot: string) {
-  const entries = await fs.promises.readdir(sourceRoot, { withFileTypes: true })
-  for (const entry of entries) {
-    const sourcePath = path.join(sourceRoot, entry.name)
-    const targetPath = path.join(targetRoot, entry.name)
-    if (entry.isDirectory()) {
-      await fs.promises.mkdir(targetPath, { recursive: true })
-      await copyStaticExtensionFiles(sourcePath, targetPath)
-    } else if (entry.isFile() && !entry.name.endsWith('.ts')) {
-      await fs.promises.copyFile(sourcePath, targetPath)
-    }
-  }
-}
-
-async function prepareContentScripts(distExtensionRoot: string) {
-  const contentScriptPath = path.join(distExtensionRoot, 'content', 'provider-content.js')
-  const modulePaths = [
-    path.join(distExtensionRoot, 'shared', 'provider-config.js'),
-    path.join(distExtensionRoot, 'shared', 'provider-navigation-policy.js'),
-    contentScriptPath,
-  ]
-  const modules = await Promise.all(modulePaths.map((modulePath) => fs.promises.readFile(modulePath, 'utf8')))
-  await fs.promises.writeFile(
-    contentScriptPath,
-    modules.map(classicContentScriptModule).join('\n')
-  )
-}
-
-function classicContentScriptModule(source: string) {
-  return source
-    .replace(/^import[\s\S]*?from ['"][^'"]+['"];\r?\n/gm, '')
-    .replace(/^export\s+(?=(const|function|class)\b)/gm, '')
-    .replace(/^export\s*\{\};?\r?\n/gm, '')
-    .replace(/\n\/\/# sourceMappingURL=.*$/m, '')
-}
-
-async function removeDevelopmentArtifacts(distExtensionRoot: string) {
-  const files = await listFiles(distExtensionRoot)
-  await Promise.all(files
-    .filter((file) => file.endsWith('.map') || file.endsWith('.d.ts'))
-    .map((file) => fs.promises.rm(file)))
-}
diff --git a/legacy/extension/src/index.ts b/legacy/extension/src/index.ts
deleted file mode 100644
index 7e6c339..0000000
--- a/legacy/extension/src/index.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-export {
-  BRIDGE_ACTIONS,
-  BRIDGE_PROTOCOL_VERSION,
-  createBridgeRequest,
-  createBridgeResponse,
-  validateBridgeRequest,
-} from './protocol.js'
-
-export {
-  PROVIDER_IDS,
-  getProviderById,
-  getProviderForUrl,
-  listProviders,
-} from './providers.js'
diff --git a/legacy/extension/src/protocol.ts b/legacy/extension/src/protocol.ts
deleted file mode 100644
index 33983cb..0000000
--- a/legacy/extension/src/protocol.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-export {
-  BRIDGE_ACTIONS,
-  BRIDGE_PROTOCOL_VERSION,
-  createBridgeRequest,
-  createBridgeResponse,
-  validateBridgeRequest,
-} from '../extension/shared/bridge-protocol.js'
-export {
-  VISIBLE_PROVIDER_ACTION_METADATA,
-  VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION,
-  VISIBLE_PROVIDER_ACTIONS,
-  VISIBLE_PROVIDER_RUNTIME_REQUEST_TYPE,
-  authorizeVisibleProviderAction,
-  createVisibleProviderActionRequest,
-  createVisibleProviderActionResponse,
-  createVisibleProviderRuntimeEnvelope,
-  createVisibleProviderCapabilityManifest,
-  listVisibleProviderActions,
-  validateVisibleProviderActionRequest,
-} from '../extension/shared/visible-provider-actions.js'
-export type {
-  VisibleAuthStatusResult,
-  VisibleProviderAction,
-  VisibleProviderActionCapability,
-  VisibleProviderActionContext,
-  VisibleProviderActionError,
-  VisibleProviderActionRequest,
-  VisibleProviderActionResponse,
-  VisibleProviderRuntimeEnvelope,
-  VisibleProviderCapabilityDeclaration,
-  VisibleProviderCapabilityManifest,
-  VisibleProviderCapabilityState,
-  VisibleProviderChoiceResult,
-  VisibleProviderChoice,
-  VisibleProviderUploadResult,
-  VisiblePromptInputResult,
-  VisiblePromptSubmitResult,
-} from '../extension/shared/visible-provider-actions.js'
diff --git a/legacy/extension/src/providers.ts b/legacy/extension/src/providers.ts
deleted file mode 100644
index c111496..0000000
--- a/legacy/extension/src/providers.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-export {
-  PROVIDER_IDS,
-  getProviderById,
-  getProviderForUrl,
-  listProviders,
-} from '../extension/shared/provider-config.js'
-export {
-  getVisibleProviderActionCapabilities,
-  isVisibleProviderActionVerified,
-  listVisibleProviderActionCapabilities,
-  visibleProviderActionCapabilitiesPayload,
-} from '../extension/shared/visible-provider-capabilities.js'
diff --git a/legacy/extension/tsconfig.json b/legacy/extension/tsconfig.json
deleted file mode 100644
index 42f1470..0000000
--- a/legacy/extension/tsconfig.json
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "compilerOptions": {
-    "composite": true,
-    "rootDir": ".",
-    "outDir": "dist",
-    "types": ["node", "chrome"]
-  },
-  "include": ["src/**/*.ts", "src/**/*.mts", "extension/**/*.ts"]
-}
diff --git a/legacy/native-host/README.md b/legacy/native-host/README.md
deleted file mode 100644
index 988901e..0000000
--- a/legacy/native-host/README.md
+++ /dev/null
@@ -1,8 +0,0 @@
-# Legacy Native Messaging host
-
-Archived Chrome Native Messaging host entry point and implementation snapshot.
-
-- `tokenless-native-host.rs` — former binary entry point
-- `native_host.rs` — implementation snapshot taken when the host was removed from the active daemon build
-
-The active daemon crate no longer builds or ships `tokenless-native-host`. A working copy of attachment cleanup and protocol constants remains inside `packages/daemon/src/native_host.rs` only because the HTTP control plane still shares those helpers. That module is not a user-facing Native Messaging product surface.
diff --git a/legacy/native-host/native_host.rs b/legacy/native-host/native_host.rs
deleted file mode 100644
index d54d7fa..0000000
--- a/legacy/native-host/native_host.rs
+++ /dev/null
@@ -1,2605 +0,0 @@
-use crate::config::{write_json_atomic_secure, ConfigStore, ConfigUpdate};
-use crate::{ClaimNextJob, CompleteJob, DaemonError, Job, JobStatus, JobStore, JobSummary, Result};
-use base64::{engine::general_purpose::STANDARD, Engine as _};
-use chrono::{SecondsFormat, Utc};
-use fs2::FileExt;
-use serde::{Deserialize, Serialize};
-use serde_json::{json, Map, Value};
-use sha2::{Digest, Sha256};
-use std::collections::{HashMap, HashSet};
-use std::env;
-use std::ffi::OsString;
-use std::fs::{self, File, OpenOptions};
-use std::io::{ErrorKind, Read, Write};
-use std::path::{Path, PathBuf};
-use std::sync::mpsc::{self, RecvTimeoutError};
-use std::thread;
-use std::time::{Duration, Instant, SystemTime};
-use uuid::Uuid;
-
-pub const NATIVE_PROTOCOL: &str = "tokenless.native.v1";
-pub const BRIDGE_MARKER_PROTOCOL: &str = "tokenless.extension-bridge-state.v1";
-pub const BRIDGE_MARKER_FILE_NAME: &str = "extension-bridge.json";
-pub const MAX_NATIVE_INPUT_BYTES: usize = 16 * 1024 * 1024;
-pub const MAX_NATIVE_OUTPUT_BYTES: usize = 1024 * 1024;
-pub const NATIVE_INPUT_QUEUE_CAPACITY: usize = 4;
-pub const VISIBLE_ATTACHMENT_PROTOCOL: &str = "tokenless.visible-attachment.v1";
-pub const MAX_VISIBLE_ATTACHMENT_CHUNK_BYTES: usize = 512 * 1024;
-const MAX_VISIBLE_ATTACHMENTS: usize = 100;
-const MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES: u64 = 512 * 1024 * 1024;
-
-const BRIDGE_POLL_INTERVAL: Duration = Duration::from_millis(250);
-const BRIDGE_ERROR_INTERVAL: Duration = Duration::from_secs(1);
-const BRIDGE_HEARTBEAT_INTERVAL: Duration = Duration::from_secs(2);
-const CLAIM_RENEW_INTERVAL: Duration = Duration::from_secs(10);
-const EVENT_LOOP_INTERVAL: Duration = Duration::from_millis(50);
-const HISTORY_LIMIT: usize = 60;
-const BRIDGE_MARKER_LOCK_FILE_NAME: &str = ".extension-bridge.lock";
-const VISIBLE_ATTACHMENT_DIRECTORY: &str = "attachments";
-const VISIBLE_ATTACHMENT_ORPHAN_TTL: Duration = Duration::from_secs(24 * 60 * 60);
-const MAX_OPEN_ATTACHMENT_HANDLES: usize = 32;
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct BridgeMarker {
-    pub protocol: String,
-    pub session_id: String,
-    pub pid: u32,
-    pub connected_at: String,
-    pub heartbeat_at: String,
-}
-
-#[derive(Debug, Clone, Serialize)]
-struct CompactJobSummary {
-    job_id: String,
-    provider: String,
-    action: String,
-    status: JobStatus,
-    created_at: String,
-    updated_at: String,
-}
-
-impl CompactJobSummary {
-    fn from_job(job: &Job) -> Self {
-        Self {
-            job_id: limited(&job.job_id, 256),
-            provider: limited(&job.provider, 64),
-            action: limited(&job.action, 128),
-            status: job.status,
-            created_at: limited(&job.created_at, 64),
-            updated_at: limited(&job.updated_at, 64),
-        }
-    }
-
-    fn from_summary(summary: &JobSummary) -> Self {
-        Self {
-            job_id: summary.job_id.clone(),
-            provider: summary.provider.clone(),
-            action: summary.action.clone(),
-            status: summary.status,
-            created_at: summary.created_at.clone(),
-            updated_at: summary.updated_at.clone(),
-        }
-    }
-}
-
-#[derive(Debug, Clone, Default, Serialize)]
-#[serde(rename_all = "camelCase")]
-struct HistoryMetadata {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    task_id: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    project_name: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    chat_name: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    idempotency_key: Option<String>,
-}
-
-#[derive(Debug, Clone, Serialize)]
-struct HistorySummary {
-    #[serde(flatten)]
-    job: CompactJobSummary,
-    metadata: HistoryMetadata,
-}
-
-impl HistorySummary {
-    fn from_summary(summary: &JobSummary) -> Self {
-        Self {
-            job: CompactJobSummary::from_summary(summary),
-            metadata: HistoryMetadata {
-                task_id: summary.task_id.clone(),
-                project_name: summary.project_name.clone(),
-                chat_name: summary.chat_name.clone(),
-                idempotency_key: summary.idempotency_key.clone(),
-            },
-        }
-    }
-}
-
-#[derive(Debug, Clone)]
-struct ActiveClaim {
-    job_id: String,
-    claim_token: String,
-    renewal_failed: bool,
-    request_json: Value,
-}
-
-#[derive(Debug, Clone, Deserialize)]
-#[serde(rename_all = "camelCase", deny_unknown_fields)]
-struct VisibleAttachmentDescriptor {
-    protocol: String,
-    bundle_id: String,
-    attachment_id: String,
-    name: String,
-    #[serde(rename = "type")]
-    media_type: String,
-    size: u64,
-    sha256: String,
-}
-
-#[derive(Debug)]
-struct AttachmentHandle {
-    job_id: String,
-    claim_token: String,
-    descriptor: VisibleAttachmentDescriptor,
-    file: File,
-    next_offset: u64,
-    digest: Sha256,
-    integrity_verified: bool,
-}
-
-#[derive(Debug)]
-struct BridgeState {
-    provider: Option<String>,
-    action: Option<String>,
-    has_capacity: bool,
-    current_claim: Option<ActiveClaim>,
-    next_poll: Instant,
-    next_heartbeat: Instant,
-    next_renewal: Instant,
-    _ownership_lock: fs::File,
-}
-
-pub struct NativeHost {
-    store: JobStore,
-    config_store: ConfigStore,
-    marker_path: PathBuf,
-    session_id: String,
-    connected_at: String,
-    bridge: Option<BridgeState>,
-    attachment_handles: HashMap<String, AttachmentHandle>,
-}
-
-impl NativeHost {
-    pub fn new(store: JobStore) -> Self {
-        let _ = store.active_request_jsons().and_then(|requests| {
-            let active_bundle_ids = visible_attachment_bundle_ids(&requests)?;
-            cleanup_orphaned_visible_attachment_bundles(
-                store.home_dir(),
-                VISIBLE_ATTACHMENT_ORPHAN_TTL,
-                &active_bundle_ids,
-            )
-        });
-        Self {
-            config_store: ConfigStore::new(store.home_dir()),
-            marker_path: store.home_dir().join(BRIDGE_MARKER_FILE_NAME),
-            store,
-            session_id: Uuid::new_v4().to_string(),
-            connected_at: timestamp(),
-            bridge: None,
-            attachment_handles: HashMap::new(),
-        }
-    }
-
-    pub fn handle_message(&mut self, message: Value) -> Value {
-        let request_type = message
-            .get("type")
-            .and_then(Value::as_str)
-            .map(|value| limited(value, 160))
-            .unwrap_or_else(|| "tokenless.native.error".to_owned());
-        let request_id = message
-            .get("requestId")
-            .and_then(Value::as_str)
-            .map(|value| limited(value, 256));
-        match self.validate_and_handle(&message, &request_type) {
-            Ok((response_type, result)) => {
-                success_response(&response_type, result, request_id.as_deref())
-            }
-            Err(error) => error_response(&request_type, &error, request_id.as_deref()),
-        }
-    }
-
-    fn validate_and_handle(
-        &mut self,
-        message: &Value,
-        request_type: &str,
-    ) -> Result<(String, Value)> {
-        let object = message.as_object().ok_or_else(|| {
-            DaemonError::InvalidInput("native message must be a JSON object".to_owned())
-        })?;
-        if object.get("protocol").and_then(Value::as_str) != Some(NATIVE_PROTOCOL) {
-            return Err(DaemonError::InvalidInput(format!(
-                "missing or unsupported native protocol; expected {NATIVE_PROTOCOL}"
-            )));
-        }
-
-        match request_type {
-            "tokenless.native.ping" => Ok((
-                "tokenless.native.pong".to_owned(),
-                json!({
-                    "status": "ready",
-                    "version": env!("CARGO_PKG_VERSION"),
-                }),
-            )),
-            "tokenless.native.daemon_connect" => {
-                let provider = optional_nonempty_string(object, "provider")?;
-                let action = optional_nonempty_string(object, "action")?;
-                self.connect_bridge(provider, action)?;
-                Ok((
-                    "tokenless.native.daemon_connected".to_owned(),
-                    json!({
-                        "status": "connected",
-                        "sessionId": self.session_id,
-                    }),
-                ))
-            }
-            "tokenless.native.daemon_ready" => {
-                let job_id = required_string(object, "jobId")?;
-                let claim_token = required_string(object, "claimToken")?;
-                self.mark_bridge_ready(&job_id, &claim_token)?;
-                Ok((
-                    request_type.to_owned(),
-                    json!({ "status": "ready", "jobId": job_id }),
-                ))
-            }
-            "tokenless.native.daemon_complete_job" => {
-                let job_id = required_string(object, "jobId")?;
-                let claim_token = required_string(object, "claimToken")?;
-                let completion = match (object.get("result"), object.get("error")) {
-                    (Some(result), None) => CompleteJob::Succeeded {
-                        result_json: result.clone(),
-                    },
-                    (None, Some(error)) => CompleteJob::Failed {
-                        error_json: error.clone(),
-                    },
-                    _ => {
-                        return Err(DaemonError::InvalidInput(
-                            "pass exactly one of result or error".to_owned(),
-                        ))
-                    }
-                };
-                let job = self.store.complete_job(&job_id, &claim_token, completion)?;
-                self.close_attachment_handles_for_job(&job_id);
-                let _ = cleanup_visible_attachment_bundles_for_request(
-                    self.store.home_dir(),
-                    &job.request_json,
-                );
-                Ok((
-                    request_type.to_owned(),
-                    serde_json::to_value(CompactJobSummary::from_job(&job))?,
-                ))
-            }
-            "tokenless.native.attachment_open" => {
-                ensure_only_fields(
-                    object,
-                    &[
-                        "protocol",
-                        "type",
-                        "requestId",
-                        "jobId",
-                        "claimToken",
-                        "bundleId",
-                        "attachmentId",
-                    ],
-                )?;
-                self.open_visible_attachment(object)
-                    .map(|result| (request_type.to_owned(), result))
-            }
-            "tokenless.native.attachment_read" => {
-                ensure_only_fields(
-                    object,
-                    &[
-                        "protocol",
-                        "type",
-                        "requestId",
-                        "jobId",
-                        "claimToken",
-                        "handleId",
-                        "offset",
-                        "maxBytes",
-                    ],
-                )?;
-                self.read_visible_attachment(object)
-                    .map(|result| (request_type.to_owned(), result))
-            }
-            "tokenless.native.attachment_close" => {
-                ensure_only_fields(
-                    object,
-                    &[
-                        "protocol",
-                        "type",
-                        "requestId",
-                        "jobId",
-                        "claimToken",
-                        "handleId",
-                    ],
-                )?;
-                self.close_visible_attachment(object)
-                    .map(|result| (request_type.to_owned(), result))
-            }
-            "tokenless.native.read_config" => Ok((
-                request_type.to_owned(),
-                serde_json::to_value(self.config_store.read()?)?,
-            )),
-            "tokenless.native.write_config" => {
-                let update = config_update(object)?;
-                Ok((
-                    request_type.to_owned(),
-                    serde_json::to_value(self.config_store.write(update)?)?,
-                ))
-            }
-            "tokenless.native.list_history" => {
-                let limit = object
-                    .get("limit")
-                    .and_then(Value::as_u64)
-                    .map(|value| usize::try_from(value).unwrap_or(usize::MAX))
-                    .unwrap_or(50)
-                    .clamp(1, HISTORY_LIMIT);
-                let summaries = self
-                    .store
-                    .list_job_summaries(Some(limit))?
-                    .iter()
-                    .map(HistorySummary::from_summary)
-                    .collect::<Vec<_>>();
-                Ok((request_type.to_owned(), serde_json::to_value(summaries)?))
-            }
-            _ => Err(DaemonError::InvalidInput(format!(
-                "unsupported native message type: {request_type}"
-            ))),
-        }
-    }
-
-    fn connect_bridge(&mut self, provider: Option<String>, action: Option<String>) -> Result<()> {
-        if self.bridge.is_none() {
-            let now = Instant::now();
-            let ownership_lock = self.acquire_bridge_ownership()?;
-            self.write_marker_unlocked()?;
-            self.bridge = Some(BridgeState {
-                provider,
-                action,
-                has_capacity: true,
-                current_claim: None,
-                next_poll: now,
-                next_heartbeat: now + BRIDGE_HEARTBEAT_INTERVAL,
-                next_renewal: now + CLAIM_RENEW_INTERVAL,
-                _ownership_lock: ownership_lock,
-            });
-        }
-        Ok(())
-    }
-
-    fn mark_bridge_ready(&mut self, job_id: &str, claim_token: &str) -> Result<()> {
-        let bridge = self.bridge.as_ref().ok_or_else(|| {
-            DaemonError::InvalidInput("daemon bridge is not connected".to_owned())
-        })?;
-        let active = bridge.current_claim.clone().ok_or_else(|| {
-            DaemonError::InvalidInput("daemon bridge has no active claim".to_owned())
-        })?;
-        if active.job_id != job_id
-            || !crate::constant_time_eq(active.claim_token.as_bytes(), claim_token.as_bytes())
-        {
-            return Err(DaemonError::ClaimRejected(job_id.to_owned()));
-        }
-        let completed = self.store.get_job(job_id)?;
-        if !matches!(
-            completed.status,
-            JobStatus::Succeeded | JobStatus::Failed | JobStatus::Canceled | JobStatus::TimedOut
-        ) {
-            return Err(DaemonError::InvalidInput(
-                "daemon bridge cannot release a claim before the job is terminal".to_owned(),
-            ));
-        }
-        self.close_attachment_handles_for_job(job_id);
-        let _ = cleanup_visible_attachment_bundles_for_request(
-            self.store.home_dir(),
-            &active.request_json,
-        );
-        let bridge = self.bridge.as_mut().ok_or_else(|| {
-            DaemonError::InvalidInput("daemon bridge is not connected".to_owned())
-        })?;
-        bridge.current_claim = None;
-        bridge.has_capacity = true;
-        bridge.next_poll = Instant::now();
-        Ok(())
-    }
-
-    fn require_active_attachment_claim(
-        &mut self,
-        object: &Map<String, Value>,
-    ) -> Result<ActiveClaim> {
-        let job_id = required_string(object, "jobId")?;
-        let claim_token = required_string(object, "claimToken")?;
-        let active = self
-            .bridge
-            .as_ref()
-            .ok_or_else(|| {
-                DaemonError::InvalidInput("visible attachment bridge is not connected".to_owned())
-            })?
-            .current_claim
-            .clone()
-            .ok_or_else(|| {
-                DaemonError::InvalidInput(
-                    "visible attachment bridge has no active claim".to_owned(),
-                )
-            })?;
-        if active.job_id != job_id
-            || !crate::constant_time_eq(active.claim_token.as_bytes(), claim_token.as_bytes())
-        {
-            return Err(DaemonError::ClaimRejected(job_id));
-        }
-        if active.renewal_failed {
-            return Err(DaemonError::ClaimExpired(active.job_id));
-        }
-        self.store
-            .renew_claim(&active.job_id, &active.claim_token)?;
-        if let Some(bridge) = self.bridge.as_mut() {
-            bridge.next_renewal = Instant::now() + CLAIM_RENEW_INTERVAL;
-        }
-        Ok(active)
-    }
-
-    fn open_visible_attachment(&mut self, object: &Map<String, Value>) -> Result<Value> {
-        let active = self.require_active_attachment_claim(object)?;
-        let bundle_id = required_safe_attachment_id(object, "bundleId")?;
-        let attachment_id = required_safe_attachment_id(object, "attachmentId")?;
-        let descriptor = visible_attachment_descriptors(&active.request_json)?
-            .into_iter()
-            .find(|descriptor| {
-                descriptor.bundle_id == bundle_id && descriptor.attachment_id == attachment_id
-            })
-            .ok_or_else(|| {
-                DaemonError::InvalidInput(
-                    "visible attachment is not declared by the active job".to_owned(),
-                )
-            })?;
-        if self.attachment_handles.len() >= MAX_OPEN_ATTACHMENT_HANDLES {
-            return Err(DaemonError::InvalidInput(format!(
-                "visible attachment handle limit is {MAX_OPEN_ATTACHMENT_HANDLES}"
-            )));
-        }
-        if self.attachment_handles.values().any(|handle| {
-            handle.job_id == active.job_id
-                && handle.descriptor.bundle_id == descriptor.bundle_id
-                && handle.descriptor.attachment_id == descriptor.attachment_id
-        }) {
-            return Err(DaemonError::InvalidInput(
-                "visible attachment is already open for the active job".to_owned(),
-            ));
-        }
-        let file = open_staged_visible_attachment(self.store.home_dir(), &descriptor)?;
-        let handle_id = Uuid::new_v4().to_string();
-        self.attachment_handles.insert(
-            handle_id.clone(),
-            AttachmentHandle {
-                job_id: active.job_id,
-                claim_token: active.claim_token,
-                descriptor: descriptor.clone(),
-                file,
-                next_offset: 0,
-                digest: Sha256::new(),
-                integrity_verified: false,
-            },
-        );
-        Ok(json!({
-            "handleId": handle_id,
-            "protocol": VISIBLE_ATTACHMENT_PROTOCOL,
-            "bundleId": descriptor.bundle_id,
-            "attachmentId": descriptor.attachment_id,
-            "name": descriptor.name,
-            "type": descriptor.media_type,
-            "size": descriptor.size,
-            "sha256": descriptor.sha256,
-            "maxChunkBytes": MAX_VISIBLE_ATTACHMENT_CHUNK_BYTES,
-        }))
-    }
-
-    fn read_visible_attachment(&mut self, object: &Map<String, Value>) -> Result<Value> {
-        let active = self.require_active_attachment_claim(object)?;
-        let handle_id = required_string(object, "handleId")?;
-        if !safe_attachment_id(&handle_id) {
-            return Err(DaemonError::InvalidInput(
-                "visible attachment handleId is invalid".to_owned(),
-            ));
-        }
-        let offset = required_u64(object, "offset")?;
-        let max_bytes = required_u64(object, "maxBytes")?;
-        if max_bytes == 0 || max_bytes > MAX_VISIBLE_ATTACHMENT_CHUNK_BYTES as u64 {
-            return Err(DaemonError::InvalidInput(format!(
-                "visible attachment maxBytes must be between 1 and {MAX_VISIBLE_ATTACHMENT_CHUNK_BYTES}"
-            )));
-        }
-        let handle = self.attachment_handles.get_mut(&handle_id).ok_or_else(|| {
-            DaemonError::InvalidInput("visible attachment handle does not exist".to_owned())
-        })?;
-        if handle.job_id != active.job_id
-            || !crate::constant_time_eq(
-                handle.claim_token.as_bytes(),
-                active.claim_token.as_bytes(),
-            )
-        {
-            return Err(DaemonError::ClaimRejected(active.job_id));
-        }
-        if offset != handle.next_offset {
-            return Err(DaemonError::InvalidInput(format!(
-                "visible attachment reads must be sequential; expected offset {}",
-                handle.next_offset
-            )));
-        }
-        if handle.file.metadata()?.len() != handle.descriptor.size {
-            return Err(DaemonError::InvalidInput(
-                "visible attachment size changed after opening".to_owned(),
-            ));
-        }
-        let remaining = handle.descriptor.size.saturating_sub(handle.next_offset);
-        let read_bytes = remaining.min(max_bytes) as usize;
-        let mut bytes = vec![0_u8; read_bytes];
-        if read_bytes > 0 {
-            handle.file.read_exact(&mut bytes)?;
-            handle.digest.update(&bytes);
-            handle.next_offset = handle
-                .next_offset
-                .checked_add(read_bytes as u64)
-                .ok_or_else(|| {
-                    DaemonError::InvalidInput("visible attachment offset overflowed".to_owned())
-                })?;
-        }
-        let eof = handle.next_offset == handle.descriptor.size;
-        if eof {
-            let actual_sha256 = hex_lower(&handle.digest.clone().finalize());
-            if !crate::constant_time_eq(
-                actual_sha256.as_bytes(),
-                handle.descriptor.sha256.as_bytes(),
-            ) {
-                return Err(DaemonError::InvalidInput(
-                    "visible attachment SHA-256 integrity check failed".to_owned(),
-                ));
-            }
-        }
-        let result = json!({
-            "handleId": handle_id,
-            "offset": offset,
-            "nextOffset": handle.next_offset,
-            "eof": eof,
-            "dataBase64": STANDARD.encode(bytes),
-        });
-        if encoded_message_size(&success_response(
-            "tokenless.native.attachment_read",
-            result.clone(),
-            None,
-        ))? > MAX_NATIVE_OUTPUT_BYTES
-        {
-            return Err(DaemonError::InvalidInput(
-                "visible attachment chunk exceeded the native output frame".to_owned(),
-            ));
-        }
-        if eof {
-            handle.integrity_verified = true;
-        }
-        Ok(result)
-    }
-
-    fn close_visible_attachment(&mut self, object: &Map<String, Value>) -> Result<Value> {
-        let active = self.require_active_attachment_claim(object)?;
-        let handle_id = required_string(object, "handleId")?;
-        let handle = self.attachment_handles.get(&handle_id).ok_or_else(|| {
-            DaemonError::InvalidInput("visible attachment handle does not exist".to_owned())
-        })?;
-        if handle.job_id != active.job_id
-            || !crate::constant_time_eq(
-                handle.claim_token.as_bytes(),
-                active.claim_token.as_bytes(),
-            )
-        {
-            return Err(DaemonError::ClaimRejected(active.job_id));
-        }
-        if handle.next_offset != handle.descriptor.size || !handle.integrity_verified {
-            return Err(DaemonError::InvalidInput(
-                "visible attachment cannot close before a complete, integrity-verified read"
-                    .to_owned(),
-            ));
-        }
-        self.attachment_handles.remove(&handle_id);
-        Ok(json!({ "handleId": handle_id, "status": "closed" }))
-    }
-
-    fn close_attachment_handles_for_job(&mut self, job_id: &str) {
-        self.attachment_handles
-            .retain(|_, handle| handle.job_id != job_id);
-    }
-
-    fn tick(&mut self) -> Result<Vec<Value>> {
-        let mut messages = Vec::new();
-        let now = Instant::now();
-        let Some(bridge) = self.bridge.as_ref() else {
-            return Ok(messages);
-        };
-        let heartbeat_due = now >= bridge.next_heartbeat;
-        let renewal_due = now >= bridge.next_renewal;
-        let poll_due = now >= bridge.next_poll && bridge.has_capacity;
-
-        if heartbeat_due {
-            if let Some(bridge) = self.bridge.as_mut() {
-                bridge.next_heartbeat = now + BRIDGE_HEARTBEAT_INTERVAL;
-            }
-            if !self.heartbeat_marker()? {
-                self.bridge = None;
-                return Ok(vec![bridge_error_push(
-                    "bridge_superseded",
-                    "A newer extension bridge session replaced this native host.",
-                    false,
-                )]);
-            }
-        }
-
-        if renewal_due {
-            let active = self
-                .bridge
-                .as_ref()
-                .and_then(|bridge| bridge.current_claim.clone());
-            if let Some(active) = active.filter(|claim| !claim.renewal_failed) {
-                match self.store.renew_claim(&active.job_id, &active.claim_token) {
-                    Ok(_) => {}
-                    Err(DaemonError::InvalidJobState { .. }) => {
-                        // Completion can happen through a separate short-lived native host.
-                    }
-                    Err(error) => {
-                        if let Some(claim) = self
-                            .bridge
-                            .as_mut()
-                            .and_then(|bridge| bridge.current_claim.as_mut())
-                        {
-                            claim.renewal_failed = true;
-                        }
-                        messages.push(error_push(&error));
-                    }
-                }
-            }
-            if let Some(bridge) = self.bridge.as_mut() {
-                bridge.next_renewal = now + CLAIM_RENEW_INTERVAL;
-            }
-        }
-
-        if poll_due {
-            match self.poll_bridge_now() {
-                Ok(Some(message)) => messages.push(message),
-                Ok(None) => {}
-                Err(error) => {
-                    if let Some(bridge) = self.bridge.as_mut() {
-                        bridge.next_poll = now + BRIDGE_ERROR_INTERVAL;
-                    }
-                    messages.push(error_push(&error));
-                }
-            }
-        }
-        Ok(messages)
-    }
-
-    fn poll_bridge_now(&mut self) -> Result<Option<Value>> {
-        let Some(bridge) = self.bridge.as_ref() else {
-            return Ok(None);
-        };
-        if !bridge.has_capacity {
-            return Ok(None);
-        }
-        let query = ClaimNextJob {
-            provider: bridge.provider.clone(),
-            action: bridge.action.clone(),
-        };
-        let Some(claimed) = self.store.claim_next_job(query)? else {
-            if let Some(bridge) = self.bridge.as_mut() {
-                bridge.next_poll = Instant::now() + BRIDGE_POLL_INTERVAL;
-            }
-            return Ok(None);
-        };
-        let running = self
-            .store
-            .mark_running(&claimed.job_id, &claimed.claim_token)?;
-        let push = success_response(
-            "tokenless.native.daemon_job",
-            json!({ "job": running.with_claim_token() }),
-            None,
-        );
-        let encoded_size = encoded_message_size(&push)?;
-        if encoded_size > MAX_NATIVE_OUTPUT_BYTES {
-            self.store.complete_job(
-                &running.job_id,
-                &running.claim_token,
-                CompleteJob::Failed {
-                    error_json: json!({
-                        "code": "native_message_too_large",
-                        "message": "Claimed job exceeds the Chrome Native Messaging output limit.",
-                        "retryable": false,
-                        "maxBytes": MAX_NATIVE_OUTPUT_BYTES,
-                        "actualBytes": encoded_size,
-                    }),
-                },
-            )?;
-            if let Some(bridge) = self.bridge.as_mut() {
-                bridge.has_capacity = true;
-                bridge.current_claim = None;
-                bridge.next_poll = Instant::now();
-            }
-            return Ok(Some(bridge_error_push(
-                "native_message_too_large",
-                "A daemon job was failed because its native message exceeded 1 MiB.",
-                false,
-            )));
-        }
-
-        if let Some(bridge) = self.bridge.as_mut() {
-            bridge.has_capacity = false;
-            bridge.current_claim = Some(ActiveClaim {
-                job_id: running.job_id.clone(),
-                claim_token: running.claim_token.clone(),
-                renewal_failed: false,
-                request_json: running.request_json.clone(),
-            });
-            bridge.next_renewal = Instant::now() + CLAIM_RENEW_INTERVAL;
-        }
-        Ok(Some(push))
-    }
-
-    fn write_marker_unlocked(&self) -> Result<()> {
-        let now = timestamp();
-        write_json_atomic_secure(
-            &self.marker_path,
-            &BridgeMarker {
-                protocol: BRIDGE_MARKER_PROTOCOL.to_owned(),
-                session_id: self.session_id.clone(),
-                pid: std::process::id(),
-                connected_at: self.connected_at.clone(),
-                heartbeat_at: now,
-            },
-        )
-    }
-
-    fn marker_belongs_to_session_unlocked(&self) -> Result<bool> {
-        let bytes = match fs::read(&self.marker_path) {
-            Ok(bytes) => bytes,
-            Err(error) if error.kind() == ErrorKind::NotFound => return Ok(false),
-            Err(error) => return Err(error.into()),
-        };
-        let marker: BridgeMarker = serde_json::from_slice(&bytes)?;
-        Ok(marker.protocol == BRIDGE_MARKER_PROTOCOL && marker.session_id == self.session_id)
-    }
-
-    fn heartbeat_marker(&self) -> Result<bool> {
-        if !self.marker_belongs_to_session_unlocked()? {
-            return Ok(false);
-        }
-        self.write_marker_unlocked()?;
-        Ok(true)
-    }
-
-    fn acquire_bridge_ownership(&self) -> Result<fs::File> {
-        let lock_path = self.store.home_dir().join(BRIDGE_MARKER_LOCK_FILE_NAME);
-        let mut options = OpenOptions::new();
-        options.read(true).write(true).create(true);
-        open_secure_file(&mut options);
-        let lock = options.open(&lock_path)?;
-        crate::restrict_file_permissions(&lock_path)?;
-        match lock.try_lock_exclusive() {
-            Ok(()) => Ok(lock),
-            Err(error) if error.kind() == ErrorKind::WouldBlock => Err(DaemonError::BridgeBusy),
-            Err(error) => Err(error.into()),
-        }
-    }
-
-    pub fn disconnect(&mut self) -> Result<()> {
-        let Some(bridge) = self.bridge.take() else {
-            return Ok(());
-        };
-        if self.marker_belongs_to_session_unlocked()? {
-            match fs::remove_file(&self.marker_path) {
-                Ok(()) => sync_parent(self.store.home_dir())?,
-                Err(error) if error.kind() == ErrorKind::NotFound => {}
-                Err(error) => return Err(error.into()),
-            }
-        }
-        drop(bridge);
-        Ok(())
-    }
-}
-
-impl Drop for NativeHost {
-    fn drop(&mut self) {
-        let _ = self.disconnect();
-    }
-}
-
-enum InputEvent {
-    Message(Value),
-    End,
-    Error(DaemonError),
-}
-
-pub fn run_native_host<R, W>(store: JobStore, mut reader: R, mut writer: W) -> Result<()>
-where
-    R: Read + Send + 'static,
-    W: Write,
-{
-    let (sender, receiver) = mpsc::sync_channel(NATIVE_INPUT_QUEUE_CAPACITY);
-    thread::spawn(move || loop {
-        match read_native_message(&mut reader) {
-            Ok(Some(message)) => {
-                if sender.send(InputEvent::Message(message)).is_err() {
-                    break;
-                }
-            }
-            Ok(None) => {
-                let _ = sender.send(InputEvent::End);
-                break;
-            }
-            Err(error) => {
-                let _ = sender.send(InputEvent::Error(error));
-                break;
-            }
-        }
-    });
-
-    let mut host = NativeHost::new(store);
-    loop {
-        match receiver.recv_timeout(EVENT_LOOP_INTERVAL) {
-            Ok(InputEvent::Message(message)) => {
-                let response = host.handle_message(message);
-                write_with_fallback(&mut writer, &response)?;
-            }
-            Ok(InputEvent::End) | Err(RecvTimeoutError::Disconnected) => {
-                host.disconnect()?;
-                return Ok(());
-            }
-            Ok(InputEvent::Error(error)) => {
-                let response = error_response("tokenless.native.error", &error, None);
-                write_with_fallback(&mut writer, &response)?;
-                host.disconnect()?;
-                return Ok(());
-            }
-            Err(RecvTimeoutError::Timeout) => {}
-        }
-        match host.tick() {
-            Ok(messages) => {
-                for message in messages {
-                    write_with_fallback(&mut writer, &message)?;
-                }
-            }
-            Err(error) => write_with_fallback(&mut writer, &error_push(&error))?,
-        }
-    }
-}
-
-pub fn run_native_host_stdio(store: JobStore) -> Result<()> {
-    run_native_host(store, std::io::stdin(), std::io::stdout())
-}
-
-pub fn read_native_message(reader: &mut impl Read) -> Result<Option<Value>> {
-    let mut header = [0_u8; 4];
-    let mut header_bytes = 0;
-    while header_bytes < header.len() {
-        match reader.read(&mut header[header_bytes..]) {
-            Ok(0) if header_bytes == 0 => return Ok(None),
-            Ok(0) => {
-                return Err(std::io::Error::new(
-                    ErrorKind::UnexpectedEof,
-                    "native message ended during length header",
-                )
-                .into())
-            }
-            Ok(read) => header_bytes += read,
-            Err(error) if error.kind() == ErrorKind::Interrupted => {}
-            Err(error) => return Err(error.into()),
-        }
-    }
-    let length = u32::from_le_bytes(header) as usize;
-    if length > MAX_NATIVE_INPUT_BYTES {
-        return Err(DaemonError::InvalidInput(format!(
-            "native input frame exceeds {MAX_NATIVE_INPUT_BYTES} bytes"
-        )));
-    }
-    let mut body = vec![0_u8; length];
-    reader.read_exact(&mut body)?;
-    Ok(Some(serde_json::from_slice(&body)?))
-}
-
-pub fn write_native_message(writer: &mut impl Write, message: &Value) -> Result<()> {
-    let body = serde_json::to_vec(message)?;
-    if body.len() > MAX_NATIVE_OUTPUT_BYTES {
-        return Err(DaemonError::InvalidInput(format!(
-            "native output frame exceeds {MAX_NATIVE_OUTPUT_BYTES} bytes"
-        )));
-    }
-    let length = u32::try_from(body.len()).map_err(|_| {
-        DaemonError::InvalidInput("native output frame length exceeds u32".to_owned())
-    })?;
-    writer.write_all(&length.to_le_bytes())?;
-    writer.write_all(&body)?;
-    writer.flush()?;
-    Ok(())
-}
-
-pub fn resolve_native_host_home(
-    tokenless_home: Option<OsString>,
-    executable: &Path,
-) -> Result<PathBuf> {
-    if let Some(home) = tokenless_home.filter(|value| !value.is_empty()) {
-        return Ok(PathBuf::from(home));
-    }
-    let bin_dir = executable.parent().ok_or_else(|| {
-        DaemonError::InvalidInput(format!(
-            "cannot infer Tokenless home from {}",
-            executable.display()
-        ))
-    })?;
-    if !bin_dir
-        .file_name()
-        .and_then(|value| value.to_str())
-        .is_some_and(|value| value.eq_ignore_ascii_case("bin"))
-    {
-        return Err(DaemonError::InvalidInput(format!(
-            "native host executable must be installed under <home>/bin: {}",
-            executable.display()
-        )));
-    }
-    bin_dir.parent().map(Path::to_path_buf).ok_or_else(|| {
-        DaemonError::InvalidInput(format!(
-            "cannot infer Tokenless home from {}",
-            executable.display()
-        ))
-    })
-}
-
-pub fn resolve_native_host_home_from_environment() -> Result<PathBuf> {
-    resolve_native_host_home(env::var_os("TOKENLESS_HOME"), &env::current_exe()?)
-}
-
-fn visible_attachment_descriptors(request: &Value) -> Result<Vec<VisibleAttachmentDescriptor>> {
-    let Some(attachments) = request.get("attachments") else {
-        return Ok(Vec::new());
-    };
-    let values = attachments.as_array().ok_or_else(|| {
-        DaemonError::InvalidInput("visible attachment descriptors must be an array".to_owned())
-    })?;
-    if values.is_empty() || values.len() > MAX_VISIBLE_ATTACHMENTS {
-        return Err(DaemonError::InvalidInput(format!(
-            "visible attachment requests must contain between 1 and {MAX_VISIBLE_ATTACHMENTS} files"
-        )));
-    }
-    let mut descriptors = Vec::with_capacity(values.len());
-    let mut attachment_ids = HashSet::new();
-    let mut bundle_id: Option<String> = None;
-    let mut total_bytes = 0_u64;
-    for value in values {
-        let descriptor: VisibleAttachmentDescriptor = serde_json::from_value(value.clone())
-            .map_err(|_| {
-                DaemonError::InvalidInput(
-                    "visible attachment descriptor has invalid or unknown fields".to_owned(),
-                )
-            })?;
-        validate_visible_attachment_descriptor(&descriptor)?;
-        if bundle_id
-            .as_ref()
-            .is_some_and(|expected| expected != &descriptor.bundle_id)
-        {
-            return Err(DaemonError::InvalidInput(
-                "visible attachments in one request must share one bundle identifier".to_owned(),
-            ));
-        }
-        bundle_id.get_or_insert_with(|| descriptor.bundle_id.clone());
-        if !attachment_ids.insert(descriptor.attachment_id.clone()) {
-            return Err(DaemonError::InvalidInput(
-                "visible attachment descriptor identity is duplicated".to_owned(),
-            ));
-        }
-        if descriptor.size > MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES {
-            return Err(DaemonError::InvalidInput(format!(
-                "visible attachment size exceeds {MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES} bytes"
-            )));
-        }
-        total_bytes = total_bytes.checked_add(descriptor.size).ok_or_else(|| {
-            DaemonError::InvalidInput("visible attachment aggregate size overflowed".to_owned())
-        })?;
-        if total_bytes > MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES {
-            return Err(DaemonError::InvalidInput(format!(
-                "visible attachment aggregate size exceeds {MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES} bytes"
-            )));
-        }
-        descriptors.push(descriptor);
-    }
-    Ok(descriptors)
-}
-
-fn validate_visible_attachment_descriptor(descriptor: &VisibleAttachmentDescriptor) -> Result<()> {
-    if descriptor.protocol != VISIBLE_ATTACHMENT_PROTOCOL {
-        return Err(DaemonError::InvalidInput(format!(
-            "visible attachment protocol must be {VISIBLE_ATTACHMENT_PROTOCOL}"
-        )));
-    }
-    if !safe_attachment_id(&descriptor.bundle_id) || !safe_attachment_id(&descriptor.attachment_id)
-    {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment descriptor contains an unsafe identifier".to_owned(),
-        ));
-    }
-    if descriptor.name.is_empty()
-        || descriptor.name.as_bytes().len() > 512
-        || descriptor.name.contains('\0')
-        || descriptor.name.contains('/')
-        || descriptor.name.contains('\\')
-    {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment descriptor contains an unsafe name".to_owned(),
-        ));
-    }
-    if !safe_media_type(&descriptor.media_type) {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment descriptor contains an invalid media type".to_owned(),
-        ));
-    }
-    if descriptor.size > 9_007_199_254_740_991 {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment descriptor size exceeds a safe integer".to_owned(),
-        ));
-    }
-    if descriptor.sha256.len() != 64
-        || !descriptor
-            .sha256
-            .bytes()
-            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
-    {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment descriptor contains an invalid SHA-256".to_owned(),
-        ));
-    }
-    Ok(())
-}
-
-fn safe_media_type(value: &str) -> bool {
-    if value.is_empty() || value.len() > 255 || !value.is_ascii() {
-        return false;
-    }
-    let mut parts = value.split('/');
-    let Some(primary) = parts.next() else {
-        return false;
-    };
-    let Some(subtype) = parts.next() else {
-        return false;
-    };
-    if parts.next().is_some() || primary.is_empty() || subtype.is_empty() {
-        return false;
-    }
-    primary
-        .bytes()
-        .chain(subtype.bytes())
-        .all(|byte| byte.is_ascii_alphanumeric() || b"!#$&^_.+-".contains(&byte))
-}
-
-fn safe_attachment_id(value: &str) -> bool {
-    (1..=64).contains(&value.len())
-        && value
-            .bytes()
-            .all(|byte| byte.is_ascii_alphanumeric() || byte == b'_' || byte == b'-')
-}
-
-fn required_safe_attachment_id(object: &Map<String, Value>, field: &'static str) -> Result<String> {
-    let value = required_string(object, field)?;
-    if !safe_attachment_id(&value) {
-        return Err(DaemonError::InvalidInput(format!(
-            "visible attachment {field} contains unsafe characters"
-        )));
-    }
-    Ok(value)
-}
-
-fn required_u64(object: &Map<String, Value>, field: &'static str) -> Result<u64> {
-    object.get(field).and_then(Value::as_u64).ok_or_else(|| {
-        DaemonError::InvalidInput(format!(
-            "visible attachment {field} must be a nonnegative integer"
-        ))
-    })
-}
-
-fn ensure_only_fields(object: &Map<String, Value>, allowed: &[&str]) -> Result<()> {
-    for field in object.keys() {
-        if !allowed.contains(&field.as_str()) {
-            return Err(DaemonError::InvalidInput(format!(
-                "unsupported native message field: {field}"
-            )));
-        }
-    }
-    Ok(())
-}
-
-fn open_staged_visible_attachment(
-    home_dir: &Path,
-    descriptor: &VisibleAttachmentDescriptor,
-) -> Result<File> {
-    validate_visible_attachment_descriptor(descriptor)?;
-    let expected_root = home_dir.join(VISIBLE_ATTACHMENT_DIRECTORY);
-    require_regular_non_symlink_directory(&expected_root, "visible attachment root")?;
-    let root = fs::canonicalize(&expected_root)?;
-    if root != expected_root || !root.starts_with(home_dir) {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment root escaped Tokenless home".to_owned(),
-        ));
-    }
-    let expected_bundle = root.join(&descriptor.bundle_id);
-    require_regular_non_symlink_directory(&expected_bundle, "visible attachment bundle")?;
-    let bundle = fs::canonicalize(&expected_bundle)?;
-    if bundle != expected_bundle || !bundle.starts_with(&root) {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment bundle escaped its staging root".to_owned(),
-        ));
-    }
-    let expected_file = bundle.join(format!("{}.bin", descriptor.attachment_id));
-    let before = fs::symlink_metadata(&expected_file)?;
-    if before.file_type().is_symlink() || !before.is_file() {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment staging entry must be a regular non-symlink file".to_owned(),
-        ));
-    }
-    let canonical_file = fs::canonicalize(&expected_file)?;
-    if canonical_file != expected_file || !canonical_file.starts_with(&bundle) {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment staging entry escaped its bundle".to_owned(),
-        ));
-    }
-    let mut options = OpenOptions::new();
-    options.read(true);
-    open_attachment_file_without_following(&mut options);
-    let file = options.open(&canonical_file)?;
-    let opened = file.metadata()?;
-    let after = fs::symlink_metadata(&expected_file)?;
-    if after.file_type().is_symlink()
-        || !after.is_file()
-        || opened.len() != descriptor.size
-        || after.len() != descriptor.size
-        || !same_opened_file_identity(&opened, &before)
-        || !same_opened_file_identity(&opened, &after)
-    {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment staging entry changed while opening".to_owned(),
-        ));
-    }
-    Ok(file)
-}
-
-fn require_regular_non_symlink_directory(path: &Path, label: &str) -> Result<()> {
-    let metadata = fs::symlink_metadata(path)?;
-    if metadata.file_type().is_symlink() || !metadata.is_dir() {
-        return Err(DaemonError::InvalidInput(format!(
-            "{label} must be a regular non-symlink directory"
-        )));
-    }
-    Ok(())
-}
-
-#[cfg(unix)]
-fn open_attachment_file_without_following(options: &mut OpenOptions) {
-    use std::os::unix::fs::OpenOptionsExt;
-
-    options.custom_flags(libc::O_NOFOLLOW);
-}
-
-#[cfg(windows)]
-fn open_attachment_file_without_following(options: &mut OpenOptions) {
-    use std::os::windows::fs::OpenOptionsExt;
-
-    const FILE_FLAG_OPEN_REPARSE_POINT: u32 = 0x0020_0000;
-    options.custom_flags(FILE_FLAG_OPEN_REPARSE_POINT);
-}
-
-#[cfg(not(any(unix, windows)))]
-fn open_attachment_file_without_following(_options: &mut OpenOptions) {}
-
-#[cfg(unix)]
-fn same_opened_file_identity(left: &fs::Metadata, right: &fs::Metadata) -> bool {
-    use std::os::unix::fs::MetadataExt;
-
-    left.dev() == right.dev() && left.ino() == right.ino()
-}
-
-#[cfg(not(unix))]
-fn same_opened_file_identity(left: &fs::Metadata, right: &fs::Metadata) -> bool {
-    left.len() == right.len()
-        && left.modified().ok() == right.modified().ok()
-        && left.created().ok() == right.created().ok()
-}
-
-pub(crate) fn cleanup_visible_attachment_bundles_for_request(
-    home_dir: &Path,
-    request: &Value,
-) -> Result<usize> {
-    let bundles = visible_attachment_descriptors(request)?
-        .into_iter()
-        .map(|descriptor| descriptor.bundle_id)
-        .collect::<HashSet<_>>();
-    let mut removed = 0;
-    for bundle_id in bundles {
-        if remove_visible_attachment_bundle(home_dir, &bundle_id)? {
-            removed += 1;
-        }
-    }
-    Ok(removed)
-}
-
-fn visible_attachment_bundle_ids(requests: &[Value]) -> Result<HashSet<String>> {
-    let mut bundle_ids = HashSet::new();
-    for request in requests {
-        bundle_ids.extend(
-            visible_attachment_descriptors(request)?
-                .into_iter()
-                .map(|descriptor| descriptor.bundle_id),
-        );
-    }
-    Ok(bundle_ids)
-}
-
-fn cleanup_orphaned_visible_attachment_bundles(
-    home_dir: &Path,
-    ttl: Duration,
-    active_bundle_ids: &HashSet<String>,
-) -> Result<usize> {
-    let expected_root = home_dir.join(VISIBLE_ATTACHMENT_DIRECTORY);
-    let root_metadata = match fs::symlink_metadata(&expected_root) {
-        Ok(metadata) => metadata,
-        Err(error) if error.kind() == ErrorKind::NotFound => return Ok(0),
-        Err(error) => return Err(error.into()),
-    };
-    if root_metadata.file_type().is_symlink() || !root_metadata.is_dir() {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment root must be a regular non-symlink directory".to_owned(),
-        ));
-    }
-    let root = fs::canonicalize(&expected_root)?;
-    if root != expected_root || !root.starts_with(home_dir) {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment root escaped Tokenless home".to_owned(),
-        ));
-    }
-    let now = SystemTime::now();
-    let mut removed = 0;
-    for entry in fs::read_dir(&root)? {
-        let entry = entry?;
-        let name = entry.file_name();
-        let Some(bundle_id) = name.to_str() else {
-            continue;
-        };
-        if !safe_attachment_id(bundle_id) || active_bundle_ids.contains(bundle_id) {
-            continue;
-        }
-        let metadata = fs::symlink_metadata(entry.path())?;
-        if metadata.file_type().is_symlink() || !metadata.is_dir() {
-            continue;
-        }
-        let expired = metadata
-            .modified()
-            .ok()
-            .and_then(|modified| now.duration_since(modified).ok())
-            .is_some_and(|age| age >= ttl);
-        if expired && remove_visible_attachment_bundle(home_dir, bundle_id)? {
-            removed += 1;
-        }
-    }
-    Ok(removed)
-}
-
-fn remove_visible_attachment_bundle(home_dir: &Path, bundle_id: &str) -> Result<bool> {
-    if !safe_attachment_id(bundle_id) {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment bundle identifier is unsafe".to_owned(),
-        ));
-    }
-    let expected_root = home_dir.join(VISIBLE_ATTACHMENT_DIRECTORY);
-    let root = match fs::canonicalize(&expected_root) {
-        Ok(root) => root,
-        Err(error) if error.kind() == ErrorKind::NotFound => return Ok(false),
-        Err(error) => return Err(error.into()),
-    };
-    if root != expected_root || !root.starts_with(home_dir) {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment root escaped Tokenless home".to_owned(),
-        ));
-    }
-    let expected_bundle = root.join(bundle_id);
-    let metadata = match fs::symlink_metadata(&expected_bundle) {
-        Ok(metadata) => metadata,
-        Err(error) if error.kind() == ErrorKind::NotFound => return Ok(false),
-        Err(error) => return Err(error.into()),
-    };
-    if metadata.file_type().is_symlink() || !metadata.is_dir() {
-        return Err(DaemonError::InvalidInput(
-            "refusing to remove an unsafe visible attachment bundle".to_owned(),
-        ));
-    }
-    let bundle = fs::canonicalize(&expected_bundle)?;
-    if bundle != expected_bundle || !bundle.starts_with(&root) {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment bundle escaped its staging root".to_owned(),
-        ));
-    }
-    let mut entries = Vec::new();
-    for entry in fs::read_dir(&bundle)? {
-        let entry = entry?;
-        let name = entry.file_name();
-        let Some(name) = name.to_str() else {
-            return Err(DaemonError::InvalidInput(
-                "visible attachment bundle contains an invalid entry".to_owned(),
-            ));
-        };
-        let Some(attachment_id) = name.strip_suffix(".bin") else {
-            return Err(DaemonError::InvalidInput(
-                "visible attachment bundle contains an unexpected entry".to_owned(),
-            ));
-        };
-        if !safe_attachment_id(attachment_id) {
-            return Err(DaemonError::InvalidInput(
-                "visible attachment bundle contains an unsafe entry".to_owned(),
-            ));
-        }
-        let entry_metadata = fs::symlink_metadata(entry.path())?;
-        if entry_metadata.is_dir() {
-            return Err(DaemonError::InvalidInput(
-                "visible attachment bundle contains a nested directory".to_owned(),
-            ));
-        }
-        entries.push(entry.path());
-    }
-    for entry in entries {
-        fs::remove_file(entry)?;
-    }
-    fs::remove_dir(bundle)?;
-    Ok(true)
-}
-
-fn hex_lower(bytes: &[u8]) -> String {
-    const HEX: &[u8; 16] = b"0123456789abcdef";
-    let mut result = String::with_capacity(bytes.len() * 2);
-    for byte in bytes {
-        result.push(HEX[(byte >> 4) as usize] as char);
-        result.push(HEX[(byte & 0x0f) as usize] as char);
-    }
-    result
-}
-
-fn config_update(object: &Map<String, Value>) -> Result<ConfigUpdate> {
-    let preferred_providers = match object.get("preferredProviders") {
-        None => None,
-        Some(Value::Array(values)) => Some(
-            values
-                .iter()
-                .map(|value| {
-                    value.as_str().map(str::to_owned).ok_or_else(|| {
-                        DaemonError::InvalidInput(
-                            "preferredProviders must contain only strings".to_owned(),
-                        )
-                    })
-                })
-                .collect::<Result<Vec<_>>>()?,
-        ),
-        Some(_) => {
-            return Err(DaemonError::InvalidInput(
-                "preferredProviders must be an array".to_owned(),
-            ))
-        }
-    };
-    Ok(ConfigUpdate {
-        preferred_providers,
-        browser: optional_nullable_string(object, "browser")?,
-        daemon_url: optional_nullable_string(object, "daemonUrl")?,
-    })
-}
-
-fn optional_nullable_string(
-    object: &Map<String, Value>,
-    field: &'static str,
-) -> Result<Option<Option<String>>> {
-    match object.get(field) {
-        None => Ok(None),
-        Some(Value::Null) => Ok(Some(None)),
-        Some(Value::String(value)) => Ok(Some(Some(value.clone()))),
-        Some(_) => Err(DaemonError::InvalidInput(format!(
-            "{field} must be a string or null"
-        ))),
-    }
-}
-
-fn optional_nonempty_string(
-    object: &Map<String, Value>,
-    field: &'static str,
-) -> Result<Option<String>> {
-    match object.get(field) {
-        None | Some(Value::Null) => Ok(None),
-        Some(Value::String(value)) if !value.trim().is_empty() => Ok(Some(value.trim().to_owned())),
-        _ => Err(DaemonError::InvalidInput(format!(
-            "{field} must be a nonempty string"
-        ))),
-    }
-}
-
-fn required_string(object: &Map<String, Value>, field: &'static str) -> Result<String> {
-    match object.get(field) {
-        Some(Value::String(value)) if !value.trim().is_empty() => Ok(value.clone()),
-        _ => Err(DaemonError::InvalidInput(format!(
-            "{field} must be a nonempty string"
-        ))),
-    }
-}
-
-fn success_response(response_type: &str, result: Value, request_id: Option<&str>) -> Value {
-    let mut response = json!({
-        "protocol": NATIVE_PROTOCOL,
-        "type": response_type,
-        "ok": true,
-        "result": result,
-    });
-    if let (Some(request_id), Some(object)) = (request_id, response.as_object_mut()) {
-        object.insert("requestId".to_owned(), Value::String(request_id.to_owned()));
-    }
-    response
-}
-
-fn error_response(request_type: &str, error: &DaemonError, request_id: Option<&str>) -> Value {
-    let (code, retryable) = error_code(error);
-    let mut response = json!({
-        "protocol": NATIVE_PROTOCOL,
-        "type": request_type,
-        "ok": false,
-        "error": {
-            "code": code,
-            "message": limited(&error.to_string(), 1024),
-            "retryable": retryable,
-        },
-    });
-    if let (Some(request_id), Some(object)) = (request_id, response.as_object_mut()) {
-        object.insert("requestId".to_owned(), Value::String(request_id.to_owned()));
-    }
-    response
-}
-
-fn error_push(error: &DaemonError) -> Value {
-    let (code, retryable) = error_code(error);
-    bridge_error_push(code, &limited(&error.to_string(), 1024), retryable)
-}
-
-fn bridge_error_push(code: &str, message: &str, retryable: bool) -> Value {
-    json!({
-        "protocol": NATIVE_PROTOCOL,
-        "type": "tokenless.native.daemon_error",
-        "ok": false,
-        "error": {
-            "code": code,
-            "message": message,
-            "retryable": retryable,
-        },
-    })
-}
-
-fn error_code(error: &DaemonError) -> (&'static str, bool) {
-    match error {
-        DaemonError::InvalidInput(message) if message.contains("protocol") => {
-            ("unsupported_native_protocol", false)
-        }
-        DaemonError::InvalidInput(message) if message.contains("frame exceeds") => {
-            ("native_message_too_large", false)
-        }
-        DaemonError::InvalidInput(_) | DaemonError::Json(_) => ("invalid_native_message", false),
-        DaemonError::ClaimExpired(_) => ("claim_expired", false),
-        DaemonError::ClaimRejected(_) => ("claim_rejected", false),
-        DaemonError::BridgeBusy => ("bridge_busy", true),
-        DaemonError::JobNotFound(_) => ("job_not_found", false),
-        DaemonError::InvalidJobState { .. } => ("invalid_job_state", false),
-        DaemonError::Sqlite(_) => ("native_store_error", true),
-        DaemonError::Io(_) => ("native_io_error", true),
-        _ => ("native_host_error", false),
-    }
-}
-
-fn write_with_fallback(writer: &mut impl Write, message: &Value) -> Result<()> {
-    match write_native_message(writer, message) {
-        Ok(()) => Ok(()),
-        Err(DaemonError::InvalidInput(_)) => write_native_message(
-            writer,
-            &bridge_error_push(
-                "native_message_too_large",
-                "Native host response exceeded the Chrome output limit.",
-                false,
-            ),
-        ),
-        Err(error) => Err(error),
-    }
-}
-
-fn encoded_message_size(message: &Value) -> Result<usize> {
-    Ok(serde_json::to_vec(message)?.len())
-}
-
-fn limited(value: &str, max_chars: usize) -> String {
-    let mut chars = value.chars();
-    let limited = chars.by_ref().take(max_chars).collect::<String>();
-    if chars.next().is_some() {
-        format!("{limited}…")
-    } else {
-        limited
-    }
-}
-
-fn timestamp() -> String {
-    Utc::now().to_rfc3339_opts(SecondsFormat::Millis, true)
-}
-
-#[cfg(unix)]
-fn open_secure_file(options: &mut OpenOptions) {
-    use std::os::unix::fs::OpenOptionsExt;
-
-    options.mode(0o600);
-}
-
-#[cfg(not(unix))]
-fn open_secure_file(_options: &mut OpenOptions) {}
-
-#[cfg(unix)]
-fn sync_parent(parent: &Path) -> Result<()> {
-    fs::File::open(parent)?.sync_all()?;
-    Ok(())
-}
-
-#[cfg(not(unix))]
-fn sync_parent(_parent: &Path) -> Result<()> {
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::{CompleteJob, CreateJob};
-    use std::io::Cursor;
-
-    const TEST_ATTACHMENT_BUNDLE_ID: &str = "bundle-one";
-    const TEST_ATTACHMENT_ID: &str = "attachment-one";
-
-    struct ActiveAttachmentTest {
-        _tempdir: tempfile::TempDir,
-        store: JobStore,
-        host: NativeHost,
-        job_id: String,
-        claim_token: String,
-        bundle_path: PathBuf,
-    }
-
-    impl ActiveAttachmentTest {
-        fn open(&mut self) -> Value {
-            let job_id = self.job_id.clone();
-            let claim_token = self.claim_token.clone();
-            self.host.handle_message(json!({
-                "protocol": NATIVE_PROTOCOL,
-                "type": "tokenless.native.attachment_open",
-                "jobId": job_id,
-                "claimToken": claim_token,
-                "bundleId": TEST_ATTACHMENT_BUNDLE_ID,
-                "attachmentId": TEST_ATTACHMENT_ID,
-            }))
-        }
-
-        fn read(&mut self, handle_id: &str, offset: u64, max_bytes: u64) -> Value {
-            let job_id = self.job_id.clone();
-            let claim_token = self.claim_token.clone();
-            self.host.handle_message(json!({
-                "protocol": NATIVE_PROTOCOL,
-                "type": "tokenless.native.attachment_read",
-                "jobId": job_id,
-                "claimToken": claim_token,
-                "handleId": handle_id,
-                "offset": offset,
-                "maxBytes": max_bytes,
-            }))
-        }
-
-        fn close(&mut self, handle_id: &str) -> Value {
-            let job_id = self.job_id.clone();
-            let claim_token = self.claim_token.clone();
-            self.host.handle_message(json!({
-                "protocol": NATIVE_PROTOCOL,
-                "type": "tokenless.native.attachment_close",
-                "jobId": job_id,
-                "claimToken": claim_token,
-                "handleId": handle_id,
-            }))
-        }
-
-        fn complete(&mut self, completion: CompleteJob) -> Value {
-            let job_id = self.job_id.clone();
-            let claim_token = self.claim_token.clone();
-            let mut message = json!({
-                "protocol": NATIVE_PROTOCOL,
-                "type": "tokenless.native.daemon_complete_job",
-                "jobId": job_id,
-                "claimToken": claim_token,
-            });
-            let object = message.as_object_mut().unwrap();
-            match completion {
-                CompleteJob::Succeeded { result_json } => {
-                    object.insert("result".to_owned(), result_json);
-                }
-                CompleteJob::Failed { error_json } => {
-                    object.insert("error".to_owned(), error_json);
-                }
-            }
-            self.host.handle_message(message)
-        }
-    }
-
-    fn active_attachment_test(bytes: &[u8], declared_sha256: Option<&str>) -> ActiveAttachmentTest {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let bundle_path = store
-            .home_dir()
-            .join(VISIBLE_ATTACHMENT_DIRECTORY)
-            .join(TEST_ATTACHMENT_BUNDLE_ID);
-        fs::create_dir_all(&bundle_path).unwrap();
-        fs::write(bundle_path.join(format!("{TEST_ATTACHMENT_ID}.bin")), bytes).unwrap();
-        let sha256 = declared_sha256
-            .map(str::to_owned)
-            .unwrap_or_else(|| hex_lower(&Sha256::digest(bytes)));
-        let job = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({
-                    "prompt": "attach this",
-                    "attachments": [{
-                        "protocol": VISIBLE_ATTACHMENT_PROTOCOL,
-                        "bundleId": TEST_ATTACHMENT_BUNDLE_ID,
-                        "attachmentId": TEST_ATTACHMENT_ID,
-                        "name": "evidence.txt",
-                        "type": "text/plain",
-                        "size": bytes.len(),
-                        "sha256": sha256,
-                    }],
-                }),
-            ))
-            .unwrap();
-        let mut host = NativeHost::new(store.clone());
-        host.connect_bridge(None, None).unwrap();
-        let push = host.poll_bridge_now().unwrap().unwrap();
-        assert_eq!(push["result"]["job"]["job_id"], job.job_id);
-        let claim_token = push["result"]["job"]["claim_token"]
-            .as_str()
-            .unwrap()
-            .to_owned();
-
-        ActiveAttachmentTest {
-            _tempdir: tempdir,
-            store,
-            host,
-            job_id: job.job_id,
-            claim_token,
-            bundle_path,
-        }
-    }
-
-    fn assert_native_error_contains(response: &Value, code: &str, message: &str) {
-        assert_eq!(response["ok"], false);
-        assert_eq!(response["error"]["code"], code);
-        assert!(
-            response["error"]["message"]
-                .as_str()
-                .unwrap()
-                .contains(message),
-            "unexpected native error: {response}"
-        );
-    }
-
-    fn test_attachment_descriptor(bundle_id: &str, attachment_id: &str, size: u64) -> Value {
-        json!({
-            "protocol": VISIBLE_ATTACHMENT_PROTOCOL,
-            "bundleId": bundle_id,
-            "attachmentId": attachment_id,
-            "name": format!("{attachment_id}.txt"),
-            "type": "text/plain",
-            "size": size,
-            "sha256": "0".repeat(64),
-        })
-    }
-
-    #[test]
-    fn visible_attachment_request_limits_are_revalidated_by_native_host() {
-        let empty = visible_attachment_descriptors(&json!({ "attachments": [] })).unwrap_err();
-        assert!(empty.to_string().contains("between 1 and 100"));
-
-        let mixed_bundles = visible_attachment_descriptors(&json!({
-            "attachments": [
-                test_attachment_descriptor("bundle-one", "first", 1),
-                test_attachment_descriptor("bundle-two", "second", 1),
-            ],
-        }))
-        .unwrap_err();
-        assert!(mixed_bundles.to_string().contains("share one bundle"));
-
-        let duplicate = visible_attachment_descriptors(&json!({
-            "attachments": [
-                test_attachment_descriptor("bundle-one", "duplicate", 1),
-                test_attachment_descriptor("bundle-one", "duplicate", 1),
-            ],
-        }))
-        .unwrap_err();
-        assert!(duplicate.to_string().contains("duplicated"));
-
-        let oversized = visible_attachment_descriptors(&json!({
-            "attachments": [
-                test_attachment_descriptor("bundle-one", "first", 300 * 1024 * 1024),
-                test_attachment_descriptor("bundle-one", "second", 300 * 1024 * 1024),
-            ],
-        }))
-        .unwrap_err();
-        assert!(oversized.to_string().contains("aggregate size"));
-
-        let too_many = (0..=MAX_VISIBLE_ATTACHMENTS)
-            .map(|index| {
-                test_attachment_descriptor("bundle-one", &format!("attachment-{index}"), 0)
-            })
-            .collect::<Vec<_>>();
-        let too_many =
-            visible_attachment_descriptors(&json!({ "attachments": too_many })).unwrap_err();
-        assert!(too_many.to_string().contains("between 1 and 100"));
-    }
-
-    #[test]
-    fn visible_attachment_multi_read_must_verify_integrity_before_close() {
-        let bytes = b"visible attachment split across several reads";
-        let mut fixture = active_attachment_test(bytes, None);
-        let opened = fixture.open();
-        assert_eq!(opened["ok"], true);
-        let handle_id = opened["result"]["handleId"].as_str().unwrap().to_owned();
-
-        let premature = fixture.close(&handle_id);
-        assert_native_error_contains(
-            &premature,
-            "invalid_native_message",
-            "complete, integrity-verified read",
-        );
-        assert!(fixture.host.attachment_handles.contains_key(&handle_id));
-
-        let first = fixture.read(&handle_id, 0, 5);
-        assert_eq!(first["ok"], true);
-        assert_eq!(first["result"]["nextOffset"], 5);
-        assert_eq!(first["result"]["eof"], false);
-        let after_first = fixture.close(&handle_id);
-        assert_native_error_contains(
-            &after_first,
-            "invalid_native_message",
-            "complete, integrity-verified read",
-        );
-
-        let second = fixture.read(&handle_id, 5, 7);
-        assert_eq!(second["ok"], true);
-        assert_eq!(second["result"]["nextOffset"], 12);
-        assert_eq!(second["result"]["eof"], false);
-        let final_chunk = fixture.read(&handle_id, 12, MAX_VISIBLE_ATTACHMENT_CHUNK_BYTES as u64);
-        assert_eq!(final_chunk["ok"], true);
-        assert_eq!(final_chunk["result"]["nextOffset"], bytes.len());
-        assert_eq!(final_chunk["result"]["eof"], true);
-
-        let mut reconstructed = STANDARD
-            .decode(first["result"]["dataBase64"].as_str().unwrap())
-            .unwrap();
-        reconstructed.extend(
-            STANDARD
-                .decode(second["result"]["dataBase64"].as_str().unwrap())
-                .unwrap(),
-        );
-        reconstructed.extend(
-            STANDARD
-                .decode(final_chunk["result"]["dataBase64"].as_str().unwrap())
-                .unwrap(),
-        );
-        assert_eq!(reconstructed, bytes);
-        assert!(
-            fixture.host.attachment_handles[&handle_id].integrity_verified,
-            "EOF must record a successful size and SHA-256 verification"
-        );
-
-        let closed = fixture.close(&handle_id);
-        assert_eq!(closed["ok"], true);
-        assert_eq!(closed["result"]["status"], "closed");
-        assert!(!fixture.host.attachment_handles.contains_key(&handle_id));
-        assert!(fixture.bundle_path.exists());
-
-        let early_ready = fixture.host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.daemon_ready",
-            "requestId": "ready-before-terminal",
-            "jobId": fixture.job_id,
-            "claimToken": fixture.claim_token,
-        }));
-        assert_native_error_contains(
-            &early_ready,
-            "invalid_native_message",
-            "before the job is terminal",
-        );
-        assert!(fixture.bundle_path.exists());
-        assert!(fixture
-            .host
-            .bridge
-            .as_ref()
-            .unwrap()
-            .current_claim
-            .is_some());
-
-        let completed = fixture.complete(CompleteJob::Succeeded {
-            result_json: json!({ "status": "submitted" }),
-        });
-        assert_eq!(completed["ok"], true);
-        assert_eq!(completed["result"]["status"], "succeeded");
-        assert_eq!(
-            fixture.store.get_job(&fixture.job_id).unwrap().status,
-            JobStatus::Succeeded
-        );
-        assert!(!fixture.bundle_path.exists());
-        let ready = fixture.host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.daemon_ready",
-            "requestId": "ready-after-terminal",
-            "jobId": fixture.job_id,
-            "claimToken": fixture.claim_token,
-        }));
-        assert_eq!(ready["ok"], true);
-        assert_eq!(ready["requestId"], "ready-after-terminal");
-    }
-
-    #[test]
-    fn visible_attachment_rejects_wrong_claim_and_undeclared_descriptor() {
-        let bytes = b"claim-bound bytes";
-        let mut fixture = active_attachment_test(bytes, None);
-        let job_id = fixture.job_id.clone();
-        let claim_token = fixture.claim_token.clone();
-
-        let undeclared = fixture.host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.attachment_open",
-            "jobId": job_id,
-            "claimToken": claim_token,
-            "bundleId": TEST_ATTACHMENT_BUNDLE_ID,
-            "attachmentId": "not-declared",
-        }));
-        assert_native_error_contains(
-            &undeclared,
-            "invalid_native_message",
-            "not declared by the active job",
-        );
-
-        let wrong_claim = fixture.host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.attachment_open",
-            "jobId": fixture.job_id,
-            "claimToken": "wrong-claim-token",
-            "bundleId": TEST_ATTACHMENT_BUNDLE_ID,
-            "attachmentId": TEST_ATTACHMENT_ID,
-        }));
-        assert_native_error_contains(&wrong_claim, "claim_rejected", "claim rejected");
-        assert!(fixture.host.attachment_handles.is_empty());
-
-        let opened = fixture.open();
-        assert_eq!(opened["ok"], true);
-        let handle_id = opened["result"]["handleId"].as_str().unwrap().to_owned();
-        let wrong_read_claim = fixture.host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.attachment_read",
-            "jobId": fixture.job_id,
-            "claimToken": "wrong-claim-token",
-            "handleId": handle_id,
-            "offset": 0,
-            "maxBytes": bytes.len(),
-        }));
-        assert_native_error_contains(&wrong_read_claim, "claim_rejected", "claim rejected");
-        assert_eq!(fixture.host.attachment_handles[&handle_id].next_offset, 0);
-
-        let read = fixture.read(&handle_id, 0, bytes.len() as u64);
-        assert_eq!(read["ok"], true);
-        assert_eq!(read["result"]["eof"], true);
-        assert_eq!(fixture.close(&handle_id)["ok"], true);
-        assert_eq!(
-            fixture.complete(CompleteJob::Succeeded {
-                result_json: json!({ "status": "submitted" }),
-            })["ok"],
-            true
-        );
-    }
-
-    #[test]
-    fn visible_attachment_wrong_offset_does_not_advance_or_poison_handle() {
-        let bytes = b"strictly sequential bytes";
-        let mut fixture = active_attachment_test(bytes, None);
-        let opened = fixture.open();
-        let handle_id = opened["result"]["handleId"].as_str().unwrap().to_owned();
-
-        let wrong_offset = fixture.read(&handle_id, 1, bytes.len() as u64);
-        assert_native_error_contains(&wrong_offset, "invalid_native_message", "expected offset 0");
-        let handle = &fixture.host.attachment_handles[&handle_id];
-        assert_eq!(handle.next_offset, 0);
-        assert!(!handle.integrity_verified);
-
-        let read = fixture.read(&handle_id, 0, bytes.len() as u64);
-        assert_eq!(read["ok"], true);
-        assert_eq!(read["result"]["eof"], true);
-        assert_eq!(fixture.close(&handle_id)["ok"], true);
-        assert_eq!(
-            fixture.complete(CompleteJob::Succeeded {
-                result_json: json!({ "status": "submitted" }),
-            })["ok"],
-            true
-        );
-    }
-
-    #[test]
-    fn visible_attachment_corrupt_hash_cannot_close_and_terminal_failure_cleans_up() {
-        let bytes = b"these bytes do not match the declared digest";
-        let mut fixture = active_attachment_test(bytes, Some(&"0".repeat(64)));
-        let opened = fixture.open();
-        assert_eq!(opened["ok"], true);
-        let handle_id = opened["result"]["handleId"].as_str().unwrap().to_owned();
-
-        let corrupt = fixture.read(&handle_id, 0, bytes.len() as u64);
-        assert_native_error_contains(
-            &corrupt,
-            "invalid_native_message",
-            "SHA-256 integrity check failed",
-        );
-        let handle = &fixture.host.attachment_handles[&handle_id];
-        assert_eq!(handle.next_offset, bytes.len() as u64);
-        assert!(!handle.integrity_verified);
-
-        let close = fixture.close(&handle_id);
-        assert_native_error_contains(
-            &close,
-            "invalid_native_message",
-            "complete, integrity-verified read",
-        );
-        assert!(fixture.host.attachment_handles.contains_key(&handle_id));
-
-        let failed = fixture.complete(CompleteJob::Failed {
-            error_json: json!({
-                "code": "attachment_integrity_failed",
-                "message": "The staged attachment failed verification.",
-            }),
-        });
-        assert_eq!(failed["ok"], true);
-        assert_eq!(failed["result"]["status"], "failed");
-        assert!(fixture.host.attachment_handles.is_empty());
-        assert_eq!(
-            fixture.store.get_job(&fixture.job_id).unwrap().status,
-            JobStatus::Failed
-        );
-        assert!(!fixture.bundle_path.exists());
-    }
-
-    #[test]
-    fn orphan_cleanup_preserves_expired_bundle_for_active_queued_job() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let attachment_root = store.home_dir().join(VISIBLE_ATTACHMENT_DIRECTORY);
-        let active_bundle = attachment_root.join("active-bundle");
-        let orphan_bundle = attachment_root.join("orphan-bundle");
-        fs::create_dir_all(&active_bundle).unwrap();
-        fs::create_dir_all(&orphan_bundle).unwrap();
-        fs::write(active_bundle.join("active-attachment.bin"), b"active").unwrap();
-        fs::write(orphan_bundle.join("orphan-attachment.bin"), b"orphan").unwrap();
-        store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({
-                    "prompt": "keep active upload",
-                    "attachments": [{
-                        "protocol": VISIBLE_ATTACHMENT_PROTOCOL,
-                        "bundleId": "active-bundle",
-                        "attachmentId": "active-attachment",
-                        "name": "active.txt",
-                        "type": "text/plain",
-                        "size": 6,
-                        "sha256": "0".repeat(64),
-                    }],
-                }),
-            ))
-            .unwrap();
-        let active_bundle_ids =
-            visible_attachment_bundle_ids(&store.active_request_jsons().unwrap()).unwrap();
-
-        let removed = cleanup_orphaned_visible_attachment_bundles(
-            store.home_dir(),
-            Duration::ZERO,
-            &active_bundle_ids,
-        )
-        .unwrap();
-
-        assert_eq!(removed, 1);
-        assert!(active_bundle.exists());
-        assert!(!orphan_bundle.exists());
-    }
-
-    #[test]
-    fn framing_round_trip_versions_request_and_response() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let request = json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.ping",
-            "requestId": "ping-1"
-        });
-        let mut encoded = Vec::new();
-        write_native_message(&mut encoded, &request).unwrap();
-        let mut output = Vec::new();
-        run_native_host(store, Cursor::new(encoded), &mut output).unwrap();
-        let response = read_native_message(&mut Cursor::new(output))
-            .unwrap()
-            .unwrap();
-        assert_eq!(response["protocol"], NATIVE_PROTOCOL);
-        assert_eq!(response["type"], "tokenless.native.pong");
-        assert_eq!(response["requestId"], "ping-1");
-        assert_eq!(response["ok"], true);
-    }
-
-    #[test]
-    fn malformed_json_frame_returns_structured_error_without_panicking() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let mut input = 1_u32.to_le_bytes().to_vec();
-        input.push(b'{');
-        let mut output = Vec::new();
-
-        run_native_host(store, Cursor::new(input), &mut output).unwrap();
-
-        let response = read_native_message(&mut Cursor::new(output))
-            .unwrap()
-            .unwrap();
-        assert_eq!(response["protocol"], NATIVE_PROTOCOL);
-        assert_eq!(response["type"], "tokenless.native.error");
-        assert_eq!(response["ok"], false);
-        assert_eq!(response["error"]["code"], "invalid_native_message");
-    }
-
-    #[test]
-    fn rejects_explicitly_wrong_native_protocol() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let mut host = NativeHost::new(JobStore::open(tempdir.path()).unwrap());
-        let response = host.handle_message(json!({
-            "protocol": "tokenless.native.v999",
-            "type": "tokenless.native.ping",
-        }));
-        assert_eq!(response["protocol"], NATIVE_PROTOCOL);
-        assert_eq!(response["ok"], false);
-        assert_eq!(response["error"]["code"], "unsupported_native_protocol");
-
-        let missing = host.handle_message(json!({
-            "type": "tokenless.native.read_config",
-        }));
-        assert_eq!(missing["protocol"], NATIVE_PROTOCOL);
-        assert_eq!(missing["ok"], false);
-        assert_eq!(missing["error"]["code"], "unsupported_native_protocol");
-    }
-
-    #[test]
-    fn framing_enforces_input_and_output_boundaries() {
-        let exact = Value::String("x".repeat(MAX_NATIVE_OUTPUT_BYTES - 2));
-        let mut output = Vec::new();
-        write_native_message(&mut output, &exact).unwrap();
-        assert_eq!(output.len(), MAX_NATIVE_OUTPUT_BYTES + 4);
-
-        let oversized = Value::String("x".repeat(MAX_NATIVE_OUTPUT_BYTES - 1));
-        let mut rejected_output = Vec::new();
-        assert!(matches!(
-            write_native_message(&mut rejected_output, &oversized),
-            Err(DaemonError::InvalidInput(_))
-        ));
-        assert!(rejected_output.is_empty());
-
-        let mut oversized_header = Cursor::new(
-            u32::try_from(MAX_NATIVE_INPUT_BYTES + 1)
-                .unwrap()
-                .to_le_bytes()
-                .to_vec(),
-        );
-        assert!(matches!(
-            read_native_message(&mut oversized_header),
-            Err(DaemonError::InvalidInput(_))
-        ));
-    }
-
-    #[test]
-    fn bridge_pushes_one_running_job_until_ready() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let first = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "one" }),
-            ))
-            .unwrap();
-        let second = store
-            .create_job(CreateJob::new(
-                "claude",
-                "submit",
-                json!({ "prompt": "two" }),
-            ))
-            .unwrap();
-        let mut host = NativeHost::new(store.clone());
-        let connected = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.daemon_connect",
-        }));
-        assert_eq!(connected["ok"], true);
-
-        let first_push = host.poll_bridge_now().unwrap().unwrap();
-        assert_eq!(first_push["type"], "tokenless.native.daemon_job");
-        assert_eq!(first_push["result"]["job"]["job_id"], first.job_id);
-        assert_eq!(first_push["result"]["job"]["status"], "running");
-        let first_claim_token = first_push["result"]["job"]["claim_token"]
-            .as_str()
-            .unwrap()
-            .to_owned();
-        assert!(host.poll_bridge_now().unwrap().is_none());
-        assert_eq!(
-            store.get_job(&second.job_id).unwrap().status,
-            JobStatus::Queued
-        );
-
-        store
-            .complete_job(
-                &first.job_id,
-                &first_claim_token,
-                CompleteJob::Succeeded {
-                    result_json: json!({ "status": "submitted" }),
-                },
-            )
-            .unwrap();
-
-        let ready = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.daemon_ready",
-            "jobId": first.job_id,
-            "claimToken": first_claim_token,
-        }));
-        assert_eq!(ready["ok"], true);
-        assert_eq!(ready["result"]["jobId"], first.job_id);
-        let second_push = host.poll_bridge_now().unwrap().unwrap();
-        assert_eq!(second_push["result"]["job"]["job_id"], second.job_id);
-    }
-
-    #[test]
-    fn daemon_ready_strictly_correlates_and_stale_or_duplicate_ready_cannot_release_claim() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let first = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "one" }),
-            ))
-            .unwrap();
-        let second = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "two" }),
-            ))
-            .unwrap();
-        let mut host = NativeHost::new(store.clone());
-        host.connect_bridge(None, None).unwrap();
-        let first_push = host.poll_bridge_now().unwrap().unwrap();
-        let first_token = first_push["result"]["job"]["claim_token"]
-            .as_str()
-            .unwrap()
-            .to_owned();
-
-        let bare = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.daemon_ready",
-        }));
-        assert_eq!(bare["ok"], false);
-        let wrong = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.daemon_ready",
-            "jobId": first.job_id,
-            "claimToken": "wrong-token",
-        }));
-        assert_eq!(wrong["ok"], false);
-        assert_eq!(wrong["error"]["code"], "claim_rejected");
-        let padded = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.daemon_ready",
-            "jobId": first.job_id,
-            "claimToken": format!(" {first_token} "),
-        }));
-        assert_eq!(padded["ok"], false);
-        assert_eq!(padded["error"]["code"], "claim_rejected");
-        assert!(host.poll_bridge_now().unwrap().is_none());
-        assert_eq!(
-            host.bridge
-                .as_ref()
-                .unwrap()
-                .current_claim
-                .as_ref()
-                .unwrap()
-                .job_id,
-            first.job_id
-        );
-
-        store
-            .complete_job(
-                &first.job_id,
-                &first_token,
-                CompleteJob::Succeeded {
-                    result_json: json!({ "status": "submitted" }),
-                },
-            )
-            .unwrap();
-
-        let accepted = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.daemon_ready",
-            "jobId": first.job_id,
-            "claimToken": first_token,
-        }));
-        assert_eq!(accepted["ok"], true);
-        let second_push = host.poll_bridge_now().unwrap().unwrap();
-        let second_token = second_push["result"]["job"]["claim_token"]
-            .as_str()
-            .unwrap()
-            .to_owned();
-        assert_eq!(second_push["result"]["job"]["job_id"], second.job_id);
-
-        let stale_duplicate = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.daemon_ready",
-            "jobId": first.job_id,
-            "claimToken": first_token,
-        }));
-        assert_eq!(stale_duplicate["ok"], false);
-        assert!(host.poll_bridge_now().unwrap().is_none());
-        assert_eq!(
-            host.bridge
-                .as_ref()
-                .unwrap()
-                .current_claim
-                .as_ref()
-                .unwrap()
-                .claim_token,
-            second_token
-        );
-    }
-
-    #[test]
-    fn oversized_claimed_job_is_failed_and_bridge_continues() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let oversized = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "x".repeat(MAX_NATIVE_OUTPUT_BYTES) }),
-            ))
-            .unwrap();
-        let next = store
-            .create_job(CreateJob::new(
-                "claude",
-                "submit",
-                json!({ "prompt": "small" }),
-            ))
-            .unwrap();
-        let mut host = NativeHost::new(store.clone());
-        host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.daemon_connect",
-        }));
-
-        let error_push = host.poll_bridge_now().unwrap().unwrap();
-        assert_eq!(error_push["type"], "tokenless.native.daemon_error");
-        assert_eq!(error_push["error"]["code"], "native_message_too_large");
-        assert!(encoded_message_size(&error_push).unwrap() <= MAX_NATIVE_OUTPUT_BYTES);
-        let failed = store.get_job(&oversized.job_id).unwrap();
-        assert_eq!(failed.status, JobStatus::Failed);
-        assert_eq!(
-            failed.error_json.unwrap()["code"],
-            "native_message_too_large"
-        );
-
-        let next_push = host.poll_bridge_now().unwrap().unwrap();
-        assert_eq!(next_push["result"]["job"]["job_id"], next.job_id);
-    }
-
-    #[test]
-    fn native_config_history_and_completion_are_compact() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let mut host = NativeHost::new(store.clone());
-        let config = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.write_config",
-            "preferredProviders": ["claude", "chatgpt"],
-            "browser": "brave",
-            "daemonUrl": "http://localhost:7331/",
-        }));
-        assert_eq!(config["ok"], true);
-        assert_eq!(config["result"]["protocol"], "tokenless.config.v1");
-        assert_eq!(config["result"]["browser"], "brave");
-        let cleared = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.write_config",
-            "browser": null,
-            "daemonUrl": null,
-        }));
-        assert_eq!(cleared["result"]["browser"], Value::Null);
-        assert_eq!(cleared["result"]["daemonUrl"], Value::Null);
-        assert_eq!(
-            cleared["result"]["preferredProviders"],
-            json!(["claude", "chatgpt"])
-        );
-
-        let job = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({
-                    "prompt": "private".repeat(100_000),
-                    "metadata": {
-                        "taskId": "task-1",
-                        "projectName": "Tokenless",
-                        "secret": "must-not-leak",
-                    }
-                }),
-            ))
-            .unwrap();
-        let history = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.list_history",
-            "limit": 60,
-        }));
-        assert_eq!(history["ok"], true);
-        assert_eq!(history["result"][0]["job_id"], job.job_id);
-        assert_eq!(history["result"][0]["metadata"]["taskId"], "task-1");
-        assert!(history["result"][0].get("request_json").is_none());
-        assert!(history["result"][0].get("result_json").is_none());
-        assert!(history["result"][0].get("claim_token").is_none());
-        assert!(serde_json::to_string(&history)
-            .unwrap()
-            .find("must-not-leak")
-            .is_none());
-        assert!(encoded_message_size(&history).unwrap() < 10_000);
-
-        let claimed = store
-            .claim_next_job(ClaimNextJob::default())
-            .unwrap()
-            .unwrap();
-        store
-            .mark_running(&claimed.job_id, &claimed.claim_token)
-            .unwrap();
-        let completed = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.daemon_complete_job",
-            "jobId": claimed.job_id,
-            "claimToken": claimed.claim_token,
-            "result": { "snapshot": "x".repeat(MAX_NATIVE_OUTPUT_BYTES) },
-        }));
-        assert_eq!(completed["ok"], true);
-        assert_eq!(completed["result"]["status"], "succeeded");
-        assert!(completed["result"].get("result_json").is_none());
-        assert!(encoded_message_size(&completed).unwrap() < 10_000);
-
-        let failed = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "another private prompt" }),
-            ))
-            .unwrap();
-        let failed_claim = store
-            .claim_next_job(ClaimNextJob::default())
-            .unwrap()
-            .unwrap();
-        assert_eq!(failed_claim.job_id, failed.job_id);
-        store
-            .mark_running(&failed_claim.job_id, &failed_claim.claim_token)
-            .unwrap();
-        store
-            .complete_job(
-                &failed_claim.job_id,
-                &failed_claim.claim_token,
-                CompleteJob::Failed {
-                    error_json: json!({
-                        "code": "attacker-controlled-private-code",
-                        "message": "attacker-controlled-private-message",
-                        "payload": "x".repeat(MAX_NATIVE_INPUT_BYTES),
-                    }),
-                },
-            )
-            .unwrap();
-        let redacted_history = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.list_history",
-        }));
-        let serialized = serde_json::to_string(&redacted_history).unwrap();
-        assert_eq!(redacted_history["ok"], true);
-        assert!(!serialized.contains("attacker-controlled-private"));
-        assert!(redacted_history["result"][0].get("error_json").is_none());
-        assert!(redacted_history["result"][0].get("error_code").is_none());
-        assert!(encoded_message_size(&redacted_history).unwrap() < 10_000);
-    }
-
-    #[test]
-    fn native_history_is_stably_newest_first() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let older = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "older" }),
-            ))
-            .unwrap();
-        thread::sleep(Duration::from_millis(2));
-        let newer = store
-            .create_job(CreateJob::new(
-                "claude",
-                "submit",
-                json!({ "prompt": "newer" }),
-            ))
-            .unwrap();
-        let mut host = NativeHost::new(store);
-
-        let history = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.list_history",
-        }));
-
-        assert_eq!(history["result"][0]["job_id"], newer.job_id);
-        assert_eq!(history["result"][1]["job_id"], older.job_id);
-    }
-
-    #[test]
-    fn bridge_ownership_is_exclusive_without_blocking_short_lived_hosts() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let marker_path = store.home_dir().join(BRIDGE_MARKER_FILE_NAME);
-        let first = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "owned by first bridge" }),
-            ))
-            .unwrap();
-        let second = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "available to next bridge" }),
-            ))
-            .unwrap();
-        let mut old_host = NativeHost::new(store.clone());
-        old_host
-            .connect_bridge(None, None)
-            .expect("old bridge connects");
-        let first_push = old_host.poll_bridge_now().unwrap().unwrap();
-        let first_claim_token = first_push["result"]["job"]["claim_token"]
-            .as_str()
-            .unwrap()
-            .to_owned();
-        let old_marker: BridgeMarker =
-            serde_json::from_slice(&fs::read(&marker_path).unwrap()).unwrap();
-        assert_eq!(old_marker.protocol, BRIDGE_MARKER_PROTOCOL);
-        assert_eq!(old_marker.session_id, old_host.session_id);
-
-        thread::sleep(Duration::from_millis(2));
-        old_host.bridge.as_mut().unwrap().next_heartbeat = Instant::now();
-        assert!(old_host.tick().unwrap().is_empty());
-        let heartbeated: BridgeMarker =
-            serde_json::from_slice(&fs::read(&marker_path).unwrap()).unwrap();
-        assert_ne!(heartbeated.heartbeat_at, old_marker.heartbeat_at);
-
-        let mut new_host = NativeHost::new(store.clone());
-        assert!(matches!(
-            new_host.connect_bridge(None, None),
-            Err(DaemonError::BridgeBusy)
-        ));
-        let unchanged_marker: BridgeMarker =
-            serde_json::from_slice(&fs::read(&marker_path).unwrap()).unwrap();
-        assert_eq!(unchanged_marker.session_id, old_marker.session_id);
-
-        let started = Instant::now();
-        let mut short_lived = NativeHost::new(store.clone());
-        let config = short_lived.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.read_config",
-        }));
-        assert_eq!(config["ok"], true);
-        drop(short_lived);
-        assert!(started.elapsed() < Duration::from_secs(1));
-
-        old_host.disconnect().unwrap();
-        assert!(!marker_path.exists());
-        let abandoned = store.get_job(&first.job_id).unwrap();
-        assert_eq!(abandoned.status, JobStatus::Running);
-        assert_eq!(abandoned.claim_token, first_claim_token);
-
-        new_host
-            .connect_bridge(None, None)
-            .expect("new bridge connects after ownership is released");
-        let new_marker: BridgeMarker =
-            serde_json::from_slice(&fs::read(&marker_path).unwrap()).unwrap();
-        assert_ne!(new_marker.session_id, old_marker.session_id);
-        let second_push = new_host.poll_bridge_now().unwrap().unwrap();
-        assert_eq!(second_push["result"]["job"]["job_id"], second.job_id);
-        assert_eq!(
-            store.get_job(&first.job_id).unwrap().status,
-            JobStatus::Running
-        );
-        new_host.disconnect().unwrap();
-        assert!(!marker_path.exists());
-    }
-
-    #[test]
-    fn connected_bridge_renews_the_active_claim() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store =
-            JobStore::open_with_claim_lease(tempdir.path(), Duration::from_millis(150)).unwrap();
-        let job = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "renew me" }),
-            ))
-            .unwrap();
-        let mut host = NativeHost::new(store.clone());
-        host.connect_bridge(None, None).unwrap();
-        host.poll_bridge_now().unwrap().unwrap();
-        let initial_expiry = store
-            .get_job(&job.job_id)
-            .unwrap()
-            .claim_expires_at_ms
-            .unwrap();
-
-        thread::sleep(Duration::from_millis(25));
-        host.bridge.as_mut().unwrap().next_renewal = Instant::now();
-        assert!(host.tick().unwrap().is_empty());
-        let renewed_expiry = store
-            .get_job(&job.job_id)
-            .unwrap()
-            .claim_expires_at_ms
-            .unwrap();
-        assert!(renewed_expiry > initial_expiry);
-    }
-
-    #[test]
-    fn native_host_home_prefers_env_then_installed_bin_layout() {
-        assert_eq!(
-            resolve_native_host_home(
-                Some(OsString::from("/explicit/tokenless")),
-                Path::new("/installed/tokenless/bin/tokenless-native-host")
-            )
-            .unwrap(),
-            PathBuf::from("/explicit/tokenless")
-        );
-        assert_eq!(
-            resolve_native_host_home(
-                None,
-                Path::new("/installed/tokenless/bin/tokenless-native-host.exe")
-            )
-            .unwrap(),
-            PathBuf::from("/installed/tokenless")
-        );
-        assert!(resolve_native_host_home(
-            None,
-            Path::new("/checkout/target/release/tokenless-native-host")
-        )
-        .is_err());
-    }
-}
diff --git a/legacy/native-host/tokenless-native-host.rs b/legacy/native-host/tokenless-native-host.rs
deleted file mode 100644
index 3f8a7c9..0000000
--- a/legacy/native-host/tokenless-native-host.rs
+++ /dev/null
@@ -1,24 +0,0 @@
-use tokenless_daemon::native_host::{
-    resolve_native_host_home_from_environment, run_native_host_stdio,
-};
-use tokenless_daemon::{native_binary_build_info, JobStore, Result};
-
-fn main() {
-    if let Err(error) = run() {
-        eprintln!("{error}");
-        std::process::exit(1);
-    }
-}
-
-fn run() -> Result<()> {
-    let arguments = std::env::args_os().skip(1).collect::<Vec<_>>();
-    if arguments.len() == 1 && arguments[0] == "--tokenless-build-info" {
-        println!(
-            "{}",
-            serde_json::to_string(&native_binary_build_info("tokenless-native-host"))?
-        );
-        return Ok(());
-    }
-    let home = resolve_native_host_home_from_environment()?;
-    run_native_host_stdio(JobStore::open(home)?)
-}
diff --git a/legacy/scripts/capture-cws-screenshots.mjs b/legacy/scripts/capture-cws-screenshots.mjs
deleted file mode 100644
index d02794a..0000000
--- a/legacy/scripts/capture-cws-screenshots.mjs
+++ /dev/null
@@ -1,271 +0,0 @@
-import { chromium } from 'playwright'
-import http from 'node:http'
-import fs from 'node:fs/promises'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-const extensionRoot = path.join(root, 'legacy/extension/dist/extension')
-const outputDirectory = path.join(root, 'legacy/extension/assets/chrome-web-store')
-const contentTypes = {
-  '.css': 'text/css',
-  '.html': 'text/html',
-  '.js': 'text/javascript',
-}
-
-await fs.mkdir(outputDirectory, { recursive: true })
-
-const server = http.createServer(async (request, response) => {
-  const relativePath = decodeURIComponent(new URL(request.url, 'http://127.0.0.1').pathname)
-    .replace(/^\/+/, '')
-  const filePath = path.join(extensionRoot, relativePath || 'settings/index.html')
-  if (!filePath.startsWith(`${extensionRoot}${path.sep}`)) {
-    response.writeHead(400)
-    response.end()
-    return
-  }
-
-  try {
-    const body = await fs.readFile(filePath)
-    response.writeHead(200, {
-      'content-type': contentTypes[path.extname(filePath)] ?? 'application/octet-stream',
-    })
-    response.end(body)
-  } catch {
-    response.writeHead(404)
-    response.end()
-  }
-})
-
-await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve))
-
-const browser = await chromium.launch({ headless: true })
-const context = await browser.newContext({ viewport: { width: 1280, height: 800 } })
-await context.addInitScript(() => {
-  function chromeEvent() {
-    const listeners = []
-    return {
-      addListener(listener) {
-        listeners.push(listener)
-      },
-      emit(value) {
-        for (const listener of listeners) listener(value)
-      },
-    }
-  }
-
-  Object.defineProperty(globalThis, 'chrome', {
-    configurable: true,
-    value: {
-      runtime: {
-        lastError: undefined,
-        connectNative(hostName) {
-          if (hostName !== 'dev.tokenless.native_host') throw new Error(`Unexpected host: ${hostName}`)
-          const onMessage = chromeEvent()
-          return {
-            onMessage,
-            onDisconnect: chromeEvent(),
-            disconnect() {},
-            postMessage(message) {
-              const config = {
-                protocol: 'tokenless.config.v1',
-                preferredProviders: ['chatgpt', 'claude'],
-                browser: 'chrome',
-                daemonUrl: 'http://127.0.0.1:7331',
-              }
-              const history = [
-                {
-                  job_id: 'sample-job-002',
-                  provider: 'chatgpt',
-                  action: 'submit_and_read',
-                  status: 'succeeded',
-                  metadata: {
-                    projectName: 'Sample local history',
-                    chatName: 'Visible UI verification',
-                    taskId: 'sample:visible-ui-verification',
-                  },
-                  updated_at: '2026-07-12T08:00:00Z',
-                },
-                {
-                  job_id: 'sample-job-001',
-                  provider: 'claude',
-                  action: 'submit_and_read',
-                  status: 'failed',
-                  metadata: {
-                    projectName: 'Sample local history',
-                    chatName: 'Provider block example',
-                    taskId: 'sample:provider-block-example',
-                  },
-                  updated_at: '2026-07-12T07:55:00Z',
-                },
-              ]
-              const result = message.type === 'tokenless.native.read_config' ? config : history
-              queueMicrotask(() => onMessage.emit({
-                protocol: 'tokenless.native.v1',
-                type: message.type,
-                ok: true,
-                result,
-              }))
-            },
-          }
-        },
-      },
-    },
-  })
-})
-
-try {
-  const page = await context.newPage()
-  const address = server.address()
-  await page.goto(`http://127.0.0.1:${address.port}/settings/index.html`, { waitUntil: 'domcontentloaded' })
-  await page.locator('.job-card').first().waitFor()
-  await page.screenshot({
-    path: path.join(outputDirectory, 'activity-1280x800.png'),
-  })
-
-  await page.getByRole('button', { name: 'Settings', exact: true }).click()
-  await page.getByRole('heading', { name: 'Routing', exact: true }).waitFor()
-  await page.screenshot({
-    path: path.join(outputDirectory, 'settings-1280x800.png'),
-  })
-
-  const logo = await fs.readFile(path.join(
-    root,
-    'legacy/extension/assets/tokenless_logo.png'
-  ))
-  const logoDataUrl = `data:image/png;base64,${logo.toString('base64')}`
-  await capturePromoImage(browser, {
-    width: 440,
-    height: 280,
-    logoDataUrl,
-    outputPath: path.join(outputDirectory, 'small-promo-440x280.png'),
-  })
-  await capturePromoImage(browser, {
-    width: 1400,
-    height: 560,
-    logoDataUrl,
-    outputPath: path.join(outputDirectory, 'marquee-1400x560.png'),
-  })
-  await fs.copyFile(
-    path.join(extensionRoot, 'icons/tokenless-128.png'),
-    path.join(outputDirectory, 'store-icon-128x128.png')
-  )
-} finally {
-  await browser.close()
-  await new Promise((resolve) => server.close(resolve))
-}
-
-console.log(JSON.stringify({
-  status: 'captured',
-  outputDirectory,
-  screenshots: [
-    'activity-1280x800.png',
-    'settings-1280x800.png',
-    'small-promo-440x280.png',
-    'marquee-1400x560.png',
-    'store-icon-128x128.png',
-  ],
-}, null, 2))
-
-async function capturePromoImage(browser, { width, height, logoDataUrl, outputPath }) {
-  const promoContext = await browser.newContext({ viewport: { width, height } })
-  try {
-    const page = await promoContext.newPage()
-    await page.setContent(`<!doctype html>
-      <html lang="en">
-        <head>
-          <meta charset="utf-8">
-          <style>
-            * { box-sizing: border-box; }
-            html, body { height: 100%; margin: 0; }
-            body {
-              background:
-                radial-gradient(circle at 82% 18%, rgba(255, 199, 47, 0.26), transparent 28%),
-                radial-gradient(circle at 12% 92%, rgba(255, 141, 34, 0.18), transparent 31%),
-                #15130f;
-              color: #fffaf0;
-              font-family: "Avenir Next", "Helvetica Neue", Arial, sans-serif;
-              overflow: hidden;
-            }
-            .frame {
-              align-items: center;
-              display: flex;
-              gap: clamp(22px, 5vw, 72px);
-              height: 100%;
-              padding: clamp(30px, 7vw, 92px);
-              position: relative;
-            }
-            .frame::before,
-            .frame::after {
-              border: 1px solid rgba(255, 199, 47, 0.22);
-              border-radius: 999px;
-              content: "";
-              position: absolute;
-            }
-            .frame::before {
-              height: 76%;
-              right: -8%;
-              top: -34%;
-              width: 38%;
-            }
-            .frame::after {
-              bottom: -46%;
-              height: 74%;
-              left: -13%;
-              width: 36%;
-            }
-            .logo-shell {
-              background: #fff;
-              border-radius: clamp(22px, 4vw, 48px);
-              box-shadow: 0 22px 70px rgba(0, 0, 0, 0.42), 0 0 0 1px rgba(255, 255, 255, 0.12);
-              flex: 0 0 auto;
-              height: clamp(112px, 29vw, 220px);
-              overflow: hidden;
-              width: clamp(112px, 29vw, 220px);
-            }
-            .logo-shell img { display: block; height: 100%; width: 100%; }
-            .copy { max-width: 760px; position: relative; z-index: 1; }
-            .name {
-              color: #ffc72f;
-              font-size: clamp(16px, 2.2vw, 26px);
-              font-weight: 800;
-              letter-spacing: 0.16em;
-              margin-bottom: clamp(8px, 2vw, 18px);
-              text-transform: uppercase;
-            }
-            h1 {
-              font-size: clamp(30px, 5.2vw, 68px);
-              letter-spacing: -0.045em;
-              line-height: 0.98;
-              margin: 0;
-              max-width: 820px;
-            }
-            p {
-              color: #d8d0c2;
-              font-size: clamp(13px, 1.8vw, 22px);
-              line-height: 1.35;
-              margin: clamp(12px, 2.4vw, 24px) 0 0;
-            }
-            @media (max-width: 600px) {
-              .frame { padding: 30px; }
-              .name { letter-spacing: 0.1em; }
-              h1 { line-height: 1.02; }
-            }
-          </style>
-        </head>
-        <body>
-          <main class="frame">
-            <div class="logo-shell"><img src="${logoDataUrl}" alt=""></div>
-            <div class="copy">
-              <div class="name">Tokenless</div>
-              <h1>Save agent tokens.</h1>
-              <p>Use the web AI you already have—without leaving your agent workflow.</p>
-            </div>
-          </main>
-        </body>
-      </html>`)
-    await page.screenshot({ path: outputPath })
-  } finally {
-    await promoContext.close()
-  }
-}
diff --git a/legacy/scripts/verify-extension-release.mjs b/legacy/scripts/verify-extension-release.mjs
deleted file mode 100644
index 0a8547c..0000000
--- a/legacy/scripts/verify-extension-release.mjs
+++ /dev/null
@@ -1,65 +0,0 @@
-import { createHash } from 'node:crypto'
-import fs from 'node:fs'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-const manifestPath = path.join(root, 'legacy/extension/extension/manifest.json')
-const defaultIdPath = path.join(root, 'legacy/extension/default-extension-id.ts')
-const suppliedId = option('--extension-id')
-const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'))
-const publicKey = typeof manifest.key === 'string' ? manifest.key.trim() : ''
-
-if (!publicKey) {
-  throw new Error(
-    'Extension release identity is not bound. Upload the review zip to Chrome Web Store, copy its Package public key into manifest.json as "key", then rerun this command.'
-  )
-}
-
-const computedId = chromeExtensionId(publicKey)
-const configuredId = readConfiguredId(defaultIdPath)
-if (suppliedId && suppliedId !== computedId) {
-  throw new Error(`Provided extension ID ${suppliedId} does not match the manifest public key (${computedId}).`)
-}
-if (configuredId !== computedId) {
-  throw new Error(
-    `DEFAULT_EXTENSION_ID is ${configuredId}, but the manifest public key resolves to ${computedId}. Update legacy/extension/default-extension-id.ts in the same release.`
-  )
-}
-
-console.log(JSON.stringify({
-  ok: true,
-  extensionId: computedId,
-  manifest: path.relative(root, manifestPath),
-}, null, 2))
-
-function option(name) {
-  const index = process.argv.indexOf(name)
-  if (index < 0) return null
-  const value = process.argv[index + 1]
-  if (!value || value.startsWith('--')) throw new Error(`${name} requires a value.`)
-  if (!/^[a-p]{32}$/.test(value)) throw new Error(`${name} must be a 32-character Chrome extension ID.`)
-  return value
-}
-
-function readConfiguredId(file) {
-  const source = fs.readFileSync(file, 'utf8')
-  const value = source.match(/DEFAULT_EXTENSION_ID\s*=\s*'([a-p]{32})'/)?.[1]
-  if (!value) throw new Error(`Cannot read DEFAULT_EXTENSION_ID from ${file}.`)
-  return value
-}
-
-function chromeExtensionId(base64PublicKey) {
-  let key
-  try {
-    key = Buffer.from(base64PublicKey, 'base64')
-  } catch {
-    throw new Error('manifest key must be a base64-encoded Chrome Web Store public key.')
-  }
-  if (key.length === 0) throw new Error('manifest key must be a nonempty base64-encoded public key.')
-  return createHash('sha256')
-    .update(key)
-    .digest('hex')
-    .slice(0, 32)
-    .replace(/[0-9a-f]/g, (nibble) => String.fromCharCode('a'.charCodeAt(0) + Number.parseInt(nibble, 16)))
-}
diff --git a/legacy/test/claude-chatgpt-visible-controls.test.mjs b/legacy/test/claude-chatgpt-visible-controls.test.mjs
deleted file mode 100644
index 898b14a..0000000
--- a/legacy/test/claude-chatgpt-visible-controls.test.mjs
+++ /dev/null
@@ -1,431 +0,0 @@
-import assert from 'node:assert/strict'
-import fs from 'node:fs'
-import path from 'node:path'
-import test from 'node:test'
-import { fileURLToPath } from 'node:url'
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-const providerContentPath = path.join(root, 'legacy/extension/dist/extension/content/provider-content.js')
-
-test('ChatGPT and Claude auth probes use compound visible signals without returning account identity', { timeout: 30000 }, async () => {
-  const { chromium } = await import('playwright')
-  const browser = await chromium.launch({ headless: true })
-  const sessions = []
-  try {
-    const chatGptSignedIn = await openProviderFixture(browser, 'https://chatgpt.com/', readFixture(
-      'test/fixtures/provider-dom/chatgpt/signed-in-paid/session-status.html'
-    )
-      .replace('[redacted account identity], Plus', 'private-marker, Plus')
-      .replace('role="button"', 'role="button" style="width:40px;height:40px"'))
-    sessions.push(chatGptSignedIn)
-    const chatGptAuth = await inspectAuth(chatGptSignedIn.page, 'chatgpt')
-    assert.deepEqual(chatGptAuth.auth, {
-      state: 'authenticated',
-      plan: { label: 'Plus', free: false },
-    })
-    assert.doesNotMatch(JSON.stringify(chatGptAuth), /private-marker/)
-
-    const claudeSignedIn = await openProviderFixture(browser, 'https://claude.ai/new', readFixture(
-      'test/fixtures/provider-dom/claude/signed-in-free/session-status.html'
-    ).replace('[redacted account identity]', 'private-marker'))
-    sessions.push(claudeSignedIn)
-    const claudeAuth = await inspectAuth(claudeSignedIn.page, 'claude')
-    assert.deepEqual(claudeAuth.auth, {
-      state: 'authenticated',
-      plan: { label: 'Free', free: true },
-    })
-    assert.doesNotMatch(JSON.stringify(claudeAuth), /private-marker/)
-
-    const chatGptSignedOut = await openProviderFixture(browser, 'https://chatgpt.com/', `
-      <!doctype html><html><body>
-        <a href="/auth/login">Log in</a>
-        <a href="/auth/signup">Sign up</a>
-      </body></html>
-    `)
-    sessions.push(chatGptSignedOut)
-    assert.deepEqual((await inspectAuth(chatGptSignedOut.page, 'chatgpt')).auth, {
-      state: 'unauthenticated',
-    })
-
-    const claudeSignedOut = await openProviderFixture(browser, 'https://claude.ai/new', `
-      <!doctype html><html><body>
-        <form><input placeholder="Enter your email"><button data-testid="continue">Continue</button></form>
-      </body></html>
-    `)
-    sessions.push(claudeSignedOut)
-    assert.deepEqual((await inspectAuth(claudeSignedOut.page, 'claude')).auth, {
-      state: 'unauthenticated',
-    })
-
-    const geminiPlanLookalike = await openProviderFixture(browser, 'https://gemini.google.com/app', `
-      <!doctype html><html><body>
-        <div><a href="https://accounts.google.com/SignOutOptions">Account</a><button>Pro</button></div>
-      </body></html>
-    `)
-    sessions.push(geminiPlanLookalike)
-    assert.deepEqual((await inspectAuth(geminiPlanLookalike.page, 'gemini')).auth, {
-      state: 'authenticated',
-    })
-
-    const grokPlanLookalike = await openProviderFixture(browser, 'https://grok.com/', `
-      <!doctype html><html><body>
-        <div><a href="/skills-and-connectors">Skills and connectors</a><span>Free</span></div>
-      </body></html>
-    `)
-    sessions.push(grokPlanLookalike)
-    assert.deepEqual((await inspectAuth(grokPlanLookalike.page, 'grok')).auth, {
-      state: 'authenticated',
-    })
-
-    const conflicting = await openProviderFixture(browser, 'https://chatgpt.com/', `
-      <!doctype html><html><body>
-        <div data-testid="accounts-profile-button" role="button" aria-label="Account menu, Plus plan">Plus</div>
-        <a href="/auth/login">Log in</a>
-      </body></html>
-    `)
-    sessions.push(conflicting)
-    assert.deepEqual((await inspectAuth(conflicting.page, 'chatgpt')).auth, { state: 'unknown' })
-
-    for (const session of sessions) assert.deepEqual(session.pageErrors, [])
-  } finally {
-    await Promise.all(sessions.map((session) => session.context.close()))
-    await browser.close()
-  }
-})
-
-test('Claude inventories model-dependent controls, blocks Upgrade rows, and verifies exact model and effort selections', { timeout: 30000 }, async () => {
-  const { chromium } = await import('playwright')
-  const browser = await chromium.launch({ headless: true })
-  const claude = await openProviderFixture(browser, 'https://claude.ai/new', claudeControlsFixture())
-  try {
-    const initial = await inspectControls(claude.page, 'claude')
-    assert.deepEqual(initial.controls.models, [
-      { label: 'Fable 5', selected: false, available: false },
-      { label: 'Opus 4.8', selected: false, available: false },
-      { label: 'Sonnet 5', selected: false, available: true },
-      { label: 'Haiku 4.5', selected: true, available: true },
-    ])
-    assert.deepEqual(initial.controls.efforts, [
-      { id: 'extended', label: 'Extended', selected: false, available: true },
-    ])
-
-    const upgradeBlocked = await configureControls(claude.page, 'claude', { model: 'Fable 5' })
-    assert.equal(upgradeBlocked.status, 'blocked')
-    assert.equal(upgradeBlocked.stopReason, 'model_control_unavailable')
-    assert.equal(await claude.page.locator('[data-testid="model-selector-dropdown"]').getAttribute('aria-label'), 'Model: Haiku 4.5')
-
-    const selected = await configureControls(claude.page, 'claude', {
-      model: 'Sonnet 5',
-      effort: 'High',
-    })
-    assert.equal(selected.status, 'configured')
-    assert.equal(selected.model.applied, 'Sonnet 5')
-    assert.equal(selected.effort.applied, 'High')
-    assert.equal(await claude.page.locator('[data-testid="model-selector-dropdown"]').getAttribute('aria-label'), 'Model: Sonnet 5 High')
-
-    const sonnet = await inspectControls(claude.page, 'claude')
-    assert.deepEqual(sonnet.controls.efforts.map(({ id, label, selected }) => ({ id, label, selected })), [
-      { id: 'low', label: 'Low', selected: false },
-      { id: 'medium', label: 'Medium', selected: false },
-      { id: 'high', label: 'High', selected: true },
-      { id: 'extra', label: 'Extra', selected: false },
-      { id: 'max', label: 'Max', selected: false },
-      { id: 'thinking', label: 'Thinking', selected: true },
-    ])
-
-    const extended = await configureControls(claude.page, 'claude', {
-      model: 'Haiku 4.5',
-      effort: 'Extended',
-    })
-    assert.equal(extended.status, 'configured')
-    assert.equal(extended.effort.applied, 'Extended')
-    const haiku = await inspectControls(claude.page, 'claude')
-    assert.equal(haiku.controls.efforts.find((choice) => choice.label === 'Extended')?.selected, true)
-
-    const partial = await configureControls(claude.page, 'claude', { model: 'Sonnet' })
-    assert.equal(partial.status, 'blocked')
-    assert.equal(partial.stopReason, 'model_control_unavailable')
-    assert.deepEqual(claude.pageErrors, [])
-  } finally {
-    await claude.context.close()
-    await browser.close()
-  }
-})
-
-test('ChatGPT uses the current dynamic Intelligence labels and strips model descriptions from exact selection', { timeout: 30000 }, async () => {
-  const { chromium } = await import('playwright')
-  const browser = await chromium.launch({ headless: true })
-  const chatgpt = await openProviderFixture(browser, 'https://chatgpt.com/', chatGptControlsFixture())
-  try {
-    const inspected = await inspectControls(chatgpt.page, 'chatgpt')
-    assert.deepEqual(inspected.controls.efforts, [
-      { id: 'instant', label: 'Instant', selected: false, available: true },
-      { id: 'medium', label: 'Medium', selected: false, available: true },
-      { id: 'high', label: 'High', selected: true, available: true },
-    ])
-    assert.deepEqual(inspected.controls.models.map((model) => model.label), [
-      'GPT-5.6 Sol',
-      'GPT-5.5',
-      'GPT-5.4',
-      'GPT-5.3',
-      'o3',
-    ])
-
-    const selected = await configureControls(chatgpt.page, 'chatgpt', {
-      model: 'GPT-5.4',
-      effort: 'Instant',
-    })
-    assert.equal(selected.status, 'configured')
-    assert.equal(selected.model.applied, 'GPT-5.4')
-    assert.equal(selected.effort.applied, 'Instant')
-    assert.equal(await chatgpt.page.locator('#intelligence').innerText(), '5.4 Instant')
-
-    const missingEffort = await configureControls(chatgpt.page, 'chatgpt', { effort: 'Pro' })
-    assert.equal(missingEffort.status, 'blocked')
-    assert.equal(missingEffort.stopReason, 'effort_control_unavailable')
-    assert.equal(await chatgpt.page.locator('#intelligence').innerText(), '5.4 Instant')
-
-    const partialModel = await configureControls(chatgpt.page, 'chatgpt', { model: 'GPT-5' })
-    assert.equal(partialModel.status, 'blocked')
-    assert.equal(partialModel.stopReason, 'model_control_unavailable')
-    assert.deepEqual(chatgpt.pageErrors, [])
-  } finally {
-    await chatgpt.context.close()
-    await browser.close()
-  }
-})
-
-async function inspectAuth(page, provider) {
-  return page.evaluate(({ provider }) => globalThis.__dispatchTokenlessMessage({
-    type: 'tokenless.bridge.inspect_auth',
-    request: { provider, requestId: `${provider}-auth-status` },
-  }), { provider })
-}
-
-async function inspectControls(page, provider) {
-  return page.evaluate(({ provider }) => globalThis.__dispatchTokenlessMessage({
-    type: 'tokenless.bridge.inspect_controls',
-    request: { provider, requestId: `${provider}-controls-inspect` },
-  }), { provider })
-}
-
-async function configureControls(page, provider, controls) {
-  return page.evaluate(({ provider, controls }) => globalThis.__dispatchTokenlessMessage({
-    type: 'tokenless.bridge.configure_controls',
-    request: { provider, requestId: `${provider}-controls-configure`, ...controls },
-  }), { provider, controls })
-}
-
-async function openProviderFixture(browser, url, html) {
-  const context = await browser.newContext({ viewport: { width: 1000, height: 800 } })
-  await context.addInitScript(() => {
-    const listeners = []
-    Object.defineProperty(globalThis, 'chrome', {
-      configurable: true,
-      value: {
-        runtime: {
-          onMessage: { addListener(listener) { listeners.push(listener) } },
-        },
-      },
-    })
-    Object.defineProperty(globalThis, '__dispatchTokenlessMessage', {
-      configurable: true,
-      value(message) {
-        return new Promise((resolve, reject) => {
-          const listener = listeners[0]
-          if (!listener) return reject(new Error('Provider content listener is not installed.'))
-          let responded = false
-          const keepOpen = listener(message, {}, (response) => {
-            responded = true
-            resolve(response)
-          })
-          if (keepOpen !== true && !responded) reject(new Error('Provider content response channel closed.'))
-        })
-      },
-    })
-  })
-  const page = await context.newPage()
-  const pageErrors = []
-  page.on('pageerror', (error) => pageErrors.push(error.message))
-  const origin = new URL(url).origin
-  await page.route(`${origin}/**`, (route) => route.fulfill({
-    status: 200,
-    contentType: 'text/html',
-    body: html,
-  }))
-  await page.goto(url, { waitUntil: 'domcontentloaded' })
-  await page.addScriptTag({ path: providerContentPath })
-  return { context, page, pageErrors }
-}
-
-function readFixture(relativePath) {
-  return fs.readFileSync(path.join(root, relativePath), 'utf8')
-}
-
-function claudeControlsFixture() {
-  return `<!doctype html><html><body>
-    <main>
-      <button data-testid="user-menu-button" aria-label="Account settings, Free plan">Account settings</button>
-      <button data-testid="model-selector-dropdown" aria-label="Model: Haiku 4.5" aria-haspopup="menu" aria-expanded="false">Haiku 4.5</button>
-      <div data-testid="chat-input" contenteditable="true" role="textbox" aria-label="Write your prompt to Claude"></div>
-    </main>
-    <script>
-      const trigger = document.querySelector('[data-testid="model-selector-dropdown"]')
-      let model = 'Haiku 4.5'
-      let effort = 'Medium'
-      let extended = false
-      let thinking = true
-      const closeMenus = () => {
-        document.querySelectorAll('[role="menu"]').forEach((menu) => menu.remove())
-        trigger.setAttribute('aria-expanded', 'false')
-      }
-      const updateTrigger = () => {
-        const suffix = model === 'Sonnet 5' ? ' ' + effort : ''
-        trigger.setAttribute('aria-label', 'Model: ' + model + suffix)
-        trigger.textContent = model
-      }
-      const span = (text) => {
-        const node = document.createElement('span')
-        node.textContent = text
-        node.style.display = 'block'
-        return node
-      }
-      const addSwitch = (menu, label, selected, update) => {
-        const item = document.createElement('div')
-        item.setAttribute('role', 'menuitem')
-        item.append(span(label))
-        const control = document.createElement('button')
-        control.setAttribute('role', 'switch')
-        control.setAttribute('aria-label', label)
-        control.setAttribute('aria-checked', String(selected()))
-        control.addEventListener('click', () => {
-          update()
-          control.setAttribute('aria-checked', String(selected()))
-        })
-        item.append(control)
-        menu.append(item)
-      }
-      const effortMenu = () => {
-        document.querySelector('[role="menu"][aria-label="Effort"]')?.remove()
-        const menu = document.createElement('div')
-        menu.setAttribute('role', 'menu')
-        menu.setAttribute('aria-label', 'Effort')
-        for (const label of ['Low', 'Medium', 'High', 'Extra', 'Max']) {
-          const item = document.createElement('button')
-          item.setAttribute('role', 'menuitemradio')
-          item.setAttribute('aria-checked', String(label === effort))
-          item.append(span(label))
-          if (label === 'Medium') item.append(span('Default'))
-          item.addEventListener('click', () => { effort = label; closeMenus(); updateTrigger() })
-          menu.append(item)
-        }
-        document.body.append(menu)
-      }
-      const modelMenu = () => {
-        closeMenus()
-        trigger.setAttribute('aria-expanded', 'true')
-        const menu = document.createElement('div')
-        menu.setAttribute('role', 'menu')
-        menu.setAttribute('aria-label', 'Model selection')
-        for (const label of ['Fable 5', 'Opus 4.8', 'Sonnet 5', 'Haiku 4.5']) {
-          const item = document.createElement('button')
-          item.setAttribute('role', 'menuitemradio')
-          item.setAttribute('aria-checked', String(label === model))
-          item.append(span(label))
-          if (label === 'Fable 5' || label === 'Opus 4.8') {
-            item.append(span('Pro'))
-            item.append(span('Upgrade'))
-          }
-          item.addEventListener('click', () => { model = label; closeMenus(); updateTrigger() })
-          menu.append(item)
-        }
-        if (model === 'Sonnet 5') {
-          const submenu = document.createElement('button')
-          submenu.setAttribute('role', 'menuitem')
-          submenu.setAttribute('aria-haspopup', 'menu')
-          submenu.append(span('Effort'))
-          submenu.append(span(effort))
-          submenu.addEventListener('click', effortMenu)
-          menu.append(submenu)
-          addSwitch(menu, 'Thinking', () => thinking, () => { thinking = !thinking })
-        } else if (model === 'Haiku 4.5') {
-          addSwitch(menu, 'Extended', () => extended, () => { extended = !extended })
-        }
-        document.body.append(menu)
-      }
-      trigger.addEventListener('click', modelMenu)
-      document.addEventListener('keydown', (event) => { if (event.key === 'Escape') closeMenus() })
-      updateTrigger()
-    </script>
-  </body></html>`
-}
-
-function chatGptControlsFixture() {
-  return `<!doctype html><html><body>
-    <div data-testid="accounts-profile-button" role="button" aria-label="Account menu, Plus plan">Plus</div>
-    <main>
-      <div id="prompt-textarea" role="textbox" contenteditable="true" style="width:600px;height:40px"></div>
-      <button id="intelligence" class="__composer-pill-fixture" aria-expanded="false" aria-haspopup="menu">High</button>
-    </main>
-    <script>
-      const trigger = document.querySelector('#intelligence')
-      let model = 'GPT-5.6 Sol'
-      let effort = 'High'
-      const closeMenus = () => {
-        document.querySelectorAll('[role="menu"]').forEach((menu) => menu.remove())
-        trigger.setAttribute('aria-expanded', 'false')
-      }
-      const updateTrigger = () => {
-        trigger.textContent = model === 'GPT-5.6 Sol' ? effort : model.replace('GPT-', '') + ' ' + effort
-      }
-      const span = (text) => {
-        const node = document.createElement('span')
-        node.textContent = text
-        node.style.display = 'block'
-        return node
-      }
-      const modelMenu = () => {
-        document.querySelector('[role="menu"][aria-label="Models"]')?.remove()
-        const menu = document.createElement('div')
-        menu.setAttribute('role', 'menu')
-        menu.setAttribute('aria-label', 'Models')
-        for (const label of ['GPT-5.6 Sol', 'GPT-5.5', 'GPT-5.4', 'GPT-5.3', 'o3']) {
-          const item = document.createElement('button')
-          item.setAttribute('role', 'menuitemradio')
-          item.setAttribute('aria-checked', String(label === model))
-          item.append(span(label))
-          if (label === 'GPT-5.4') item.append(span('Leaving on July 23'))
-          item.addEventListener('click', () => { model = label; closeMenus(); updateTrigger() })
-          menu.append(item)
-        }
-        document.body.append(menu)
-      }
-      const intelligenceMenu = () => {
-        closeMenus()
-        trigger.setAttribute('aria-expanded', 'true')
-        const menu = document.createElement('div')
-        menu.setAttribute('role', 'menu')
-        menu.setAttribute('aria-labelledby', trigger.id)
-        for (const label of ['Instant', 'Medium', 'High']) {
-          const item = document.createElement('button')
-          item.setAttribute('role', 'menuitemradio')
-          item.setAttribute('aria-checked', String(label === effort))
-          item.append(span(label))
-          if (label === 'Instant') item.append(span('5.5'))
-          item.addEventListener('click', () => { effort = label; closeMenus(); updateTrigger() })
-          menu.append(item)
-        }
-        const submenu = document.createElement('button')
-        submenu.setAttribute('role', 'menuitem')
-        submenu.setAttribute('aria-haspopup', 'menu')
-        submenu.append(span(model))
-        submenu.addEventListener('click', modelMenu)
-        menu.append(submenu)
-        document.body.append(menu)
-      }
-      trigger.addEventListener('click', intelligenceMenu)
-      document.addEventListener('keydown', (event) => { if (event.key === 'Escape') closeMenus() })
-      updateTrigger()
-    </script>
-  </body></html>`
-}
diff --git a/legacy/test/daemon-visible-session.e2e.mjs b/legacy/test/daemon-visible-session.e2e.mjs
deleted file mode 100644
index 2500b9e..0000000
--- a/legacy/test/daemon-visible-session.e2e.mjs
+++ /dev/null
@@ -1,2376 +0,0 @@
-import assert from 'node:assert/strict'
-import { spawn, spawnSync } from 'node:child_process'
-import { createHash, createPublicKey } from 'node:crypto'
-import fs from 'node:fs/promises'
-import https from 'node:https'
-import net from 'node:net'
-import os from 'node:os'
-import path from 'node:path'
-import test from 'node:test'
-import { fileURLToPath } from 'node:url'
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-const extensionPath = path.join(root, 'legacy/extension/dist/extension')
-const chatGptRealDomFixturePath = path.join(root, 'test/fixtures/chatgpt-real-dom-fixture.html')
-const claudeRealDomFixturePath = path.join(root, 'test/fixtures/claude-real-dom-fixture.html')
-const geminiRealDomFixturePath = path.join(root, 'test/fixtures/gemini-real-dom-fixture.html')
-const grokRealDomFixturePath = path.join(root, 'test/fixtures/grok-real-dom-fixture.html')
-const providerAttachmentDomFixturePath = path.join(root, 'test/fixtures/provider-attachment-dom-fixture.html')
-const testResultsRoot = path.join(root, 'test-results', 'tokenless-e2e', 'runs')
-
-test('daemon job completes through extension service worker and ChatGPT real-DOM fixture without task page', {
-  skip: process.env.TOKENLESS_E2E !== '1' ? 'set TOKENLESS_E2E=1 to run fixture browser E2E' : false,
-  timeout: 180000,
-}, async () => {
-  const { chromium } = await import('playwright')
-  const {
-    createDaemonJob,
-    getDaemonJob,
-    installNativeHost,
-    nativeMessagingHostDirs,
-    NATIVE_HOST_NAME,
-    readLiveBridgeMarker,
-  } = await import('../../packages/cli/dist/src/index.js')
-  const { DEFAULT_EXTENSION_ID } = await import('../extension/default-extension-id.mjs')
-
-  const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'tokenless-daemon-e2e-'))
-  const artifactDir = await createArtifactDir()
-  const userDataDir = path.join(tempRoot, 'profile')
-  const tokenlessHome = path.join(tempRoot, 'tokenless-home')
-  const port = await freePort()
-  const daemonUrl = `http://127.0.0.1:${port}`
-  const prompt = 'Tokenless daemon E2E DOM prompt 93742'
-  const events = []
-  const observedUrls = []
-  let manifestBackup = []
-  let registryBackup = []
-  let daemon
-  let context
-  let providerFixture
-
-  try {
-    daemon = startDaemon({ homeDir: tokenlessHome, port })
-    await waitForDaemonReady(daemonUrl, daemon)
-    events.push({ at: new Date().toISOString(), event: 'daemon_ready', daemonUrl })
-
-    // Install before the first browser process starts. Chromium discovers
-    // user-level Native Messaging manifests at startup.
-    const manifestHome = userDataDir
-    const browsers = fixtureNativeHostBrowsers()
-    registryBackup = snapshotWindowsNativeHostRegistry(
-      browsers,
-      NATIVE_HOST_NAME,
-      windowsNativeHostManifestPath(tokenlessHome, NATIVE_HOST_NAME)
-    )
-    manifestBackup = await snapshotFiles(browsers.flatMap((browser) => (
-      nativeMessagingHostDirs(browser, manifestHome).map((dir) => path.join(dir, `${NATIVE_HOST_NAME}.json`))
-    )))
-    const installed = await installNativeHost({
-      homeDir: tokenlessHome,
-      manifestHome,
-      extensionId: DEFAULT_EXTENSION_ID,
-      browsers,
-    })
-    assert.ok(installed.manifests.length >= 1)
-    events.push({
-      at: new Date().toISOString(),
-      event: 'native_host_installed',
-      manifests: installed.manifests,
-      executable: installed.nativeHostExecutable,
-    })
-
-    const chatGptFixture = await fs.readFile(chatGptRealDomFixturePath, 'utf8')
-    providerFixture = await startHttpsFixtureServer({
-      body: chatGptFixture,
-      events,
-      providerHost: 'chatgpt.com',
-    })
-    events.push({
-      at: new Date().toISOString(),
-      event: 'provider_fixture_https_started',
-      port: providerFixture.port,
-      realProviderDom: true,
-    })
-
-    context = await launchTokenlessContext(
-      chromium,
-      userDataDir,
-      tokenlessHome,
-      daemonUrl,
-      providerFixture,
-      'chatgpt.com'
-    )
-    observeContextUrls(context, observedUrls)
-    const extensionId = await discoverExtensionId(context)
-    assert.equal(extensionId, DEFAULT_EXTENSION_ID)
-    events.push({ at: new Date().toISOString(), event: 'extension_discovered', extensionId })
-
-    await ensureDaemonBridgeStarted(context)
-    const bridgeMarker = await waitForBridgeMarker({ tokenlessHome, readLiveBridgeMarker, context })
-    events.push({
-      at: new Date().toISOString(),
-      event: 'daemon_bridge_ready',
-      sessionId: bridgeMarker.sessionId,
-    })
-    const pagesBeforeRun = new Set(context.pages())
-
-    const cliRun = await runProcess(process.execPath, [
-      path.join(root, 'packages/cli/dist/src/tokenless.mjs'),
-      'run',
-      '--prompt',
-      prompt,
-      '--provider',
-      'chatgpt',
-      '--home',
-      tokenlessHome,
-      '--daemon-url',
-      daemonUrl,
-      '--target-url',
-      'https://chatgpt.com/',
-      '--model',
-      'GPT-5.5',
-      '--model-fallback',
-      'o3',
-      '--effort',
-      'high',
-      '--read-delay-ms',
-      '0',
-      '--read-timeout-ms',
-      '10000',
-      '--no-open',
-      '--json',
-    ], { cwd: root })
-
-    assert.equal(cliRun.status, 0, cliRun.stderr || cliRun.stdout)
-    const cliPayload = JSON.parse(cliRun.stdout)
-    assert.equal(cliPayload.transport, 'daemon')
-    assert.equal(cliPayload.provider, 'chatgpt')
-    assert.equal(cliPayload.taskUrl, undefined)
-    assert.equal(cliPayload.runnerUrl, undefined)
-    assert.deepEqual(cliPayload.result?.result?.read?.sources, [{
-      url: 'https://example.com/tokenless-fixture-source?keep=fixture',
-      title: 'Fixture citation',
-      domain: 'example.com',
-    }])
-    assert.match(
-      cliPayload.compactOutput,
-      /Sources:\n- Fixture citation: https:\/\/example\.com\/tokenless-fixture-source\?keep=fixture/
-    )
-    assert.doesNotMatch(cliRun.stdout, /taskUrl|task\/task\.html|runnerUrl|daemon\/runner\.html/)
-
-    const created = await getDaemonJob({
-      daemonUrl,
-      homeDir: tokenlessHome,
-      jobId: cliPayload.jobId,
-    })
-    assert.ok(['queued', 'claimed', 'succeeded'].includes(created.status), JSON.stringify(created, null, 2))
-    assert.equal(created.claim_token, undefined)
-    assert.match(created.request_json.prompt, /Tokenless daemon E2E DOM prompt 93742/)
-    await fs.writeFile(path.join(artifactDir, 'cli-daemon-run-payload.json'), `${JSON.stringify(cliPayload, null, 2)}\n`, 'utf8')
-    events.push({ at: new Date().toISOString(), event: 'cli_daemon_job_created', jobId: created.job_id })
-
-    const completed = await waitForDaemonJobStatus({
-      daemonUrl,
-      homeDir: tokenlessHome,
-      jobId: created.job_id,
-      statuses: ['succeeded', 'failed'],
-      daemon,
-      getDaemonJob,
-    })
-    await fs.writeFile(
-      path.join(artifactDir, 'daemon-terminal-job.json'),
-      `${JSON.stringify(completed, null, 2)}\n`,
-      'utf8'
-    )
-    if (completed.status !== 'succeeded') {
-      const failedProviderPage = context.pages().find((page) => page.url().startsWith('https://chatgpt.com/'))
-      if (failedProviderPage) {
-        await failedProviderPage.screenshot({
-          path: path.join(artifactDir, '00-chatgpt-fixture-failure.png'),
-          fullPage: true,
-        })
-        const providerDiagnostic = await failedProviderPage.evaluate(() => {
-          const describe = (selector) => [...document.querySelectorAll(selector)].map((node) => {
-            const rect = node.getBoundingClientRect()
-            const style = getComputedStyle(node)
-            return {
-              selector,
-              connected: node.isConnected,
-              checkVisibility: node.checkVisibility?.({ checkOpacity: true, checkVisibilityCSS: true }) ?? null,
-              rect: { left: rect.left, top: rect.top, right: rect.right, bottom: rect.bottom, width: rect.width, height: rect.height },
-              style: { display: style.display, visibility: style.visibility, opacity: style.opacity, contentVisibility: style.contentVisibility },
-            }
-          })
-          return {
-            url: location.href,
-            viewport: { width: innerWidth, height: innerHeight },
-            readyState: document.readyState,
-            composer: describe('#prompt-textarea'),
-            send: describe('[data-testid="composer-send-button"]'),
-          }
-        })
-        await fs.writeFile(
-          path.join(artifactDir, 'provider-failure-diagnostic.json'),
-          `${JSON.stringify(providerDiagnostic, null, 2)}\n`,
-          'utf8'
-        )
-      }
-    }
-    assert.equal(completed.status, 'succeeded')
-    assert.equal(completed.claim_token, undefined)
-    assert.match(completed.result_json.text, /visible ChatGPT real-DOM fixture answer/)
-    assert.match(completed.result_json.text, /Tokenless daemon E2E DOM prompt 93742/)
-    assert.doesNotMatch(completed.result_json.text, /stale ChatGPT real-DOM fixture answer/)
-    assert.doesNotMatch(completed.result_json.text, /_streaming/)
-    assert.deepEqual(completed.result_json.read.sources, [{
-      url: 'https://example.com/tokenless-fixture-source?keep=fixture',
-      title: 'Fixture citation',
-      domain: 'example.com',
-    }])
-    assert.equal(completed.result_json.submit.configuration.surface.status, 'chat_selected')
-    assert.equal(completed.result_json.submit.configuration.model.status, 'selected')
-    assert.equal(completed.result_json.submit.configuration.model.applied, 'GPT-5.5')
-    assert.equal(completed.result_json.submit.configuration.effort.status, 'selected')
-    assert.equal(completed.result_json.submit.configuration.effort.applied, 'High')
-
-    const providerPage = context.pages().find((page) => page.url().startsWith('https://chatgpt.com/'))
-    assert.ok(providerPage, `extension did not open the visible ChatGPT page: ${JSON.stringify(context.pages().map((page) => page.url()))}`)
-    await providerPage.bringToFront()
-    await providerPage.screenshot({
-      path: path.join(artifactDir, '01-chatgpt-fixture-opened-by-extension.png'),
-      animations: 'disabled',
-    })
-    assert.match(await providerPage.locator('[data-message-author-role="user"]').last().innerText(), /Tokenless daemon E2E DOM prompt 93742/)
-    assert.match(await providerPage.locator('[data-message-author-role="assistant"]').last().innerText(), /visible ChatGPT real-DOM fixture answer/)
-    const pageUrlsAfterSuccess = context.pages().map((page) => page.url())
-    assert.ok(pageUrlsAfterSuccess.every((url) => !url.includes('/task/task.html')), JSON.stringify(pageUrlsAfterSuccess, null, 2))
-    assert.ok(pageUrlsAfterSuccess.every((url) => !url.includes('/daemon/runner.html')), JSON.stringify(pageUrlsAfterSuccess, null, 2))
-    assert.ok(pageUrlsAfterSuccess.every((url) => !url.includes('/settings/')), JSON.stringify(pageUrlsAfterSuccess, null, 2))
-    const pagesOpenedByRun = context.pages().filter((page) => !pagesBeforeRun.has(page))
-    assert.deepEqual(pagesOpenedByRun.map((page) => page.url()), [providerPage.url()],
-      'task execution must open exactly one visible provider page')
-    assertNoTaskPageObserved(observedUrls)
-    assertNoRunnerPageObserved(observedUrls)
-
-    const pagesBeforeControlInspection = new Set(context.pages())
-    const controlInspection = spawnSync(process.execPath, [
-      path.join(root, 'packages/cli/dist/src/tokenless.mjs'),
-      'chatgpt-controls',
-      '--home',
-      tokenlessHome,
-      '--daemon-url',
-      daemonUrl,
-      '--target-url',
-      providerPage.url(),
-      '--no-open',
-      '--json',
-    ], {
-      cwd: root,
-      encoding: 'utf8',
-      timeout: 30000,
-    })
-    assert.equal(controlInspection.status, 0, controlInspection.stderr || controlInspection.stdout)
-    const controlInspectionPayload = JSON.parse(controlInspection.stdout)
-    const controls = controlInspectionPayload.result?.result?.controls ?? controlInspectionPayload.result?.controls
-    assert.equal(controls.available, true)
-    assert.deepEqual(controls.efforts.map((item) => item.id), ['instant', 'medium', 'high', 'extra_high', 'pro'])
-    assert.deepEqual(controls.models.map((item) => item.label), ['GPT-5.6 Sol', 'GPT-5.5', 'GPT-5.4', 'GPT-5.3', 'o3'])
-    assert.deepEqual(
-      context.pages().filter((page) => !pagesBeforeControlInspection.has(page)).map((page) => page.url()),
-      [],
-      'chatgpt-controls must reuse the visible provider tab without opening another page'
-    )
-
-    const pagesBeforeSnapshot = new Set(context.pages())
-    const snapshotRun = spawnSync(process.execPath, [
-      path.join(root, 'packages/cli/dist/src/tokenless.mjs'),
-      'snapshot-dom',
-      '--provider',
-      'chatgpt',
-      '--home',
-      tokenlessHome,
-      '--daemon-url',
-      daemonUrl,
-      '--target-url',
-      providerPage.url(),
-      '--no-open',
-      '--timeout-ms',
-      '15000',
-      '--json',
-    ], {
-      cwd: root,
-      encoding: 'utf8',
-      timeout: 30000,
-    })
-    assert.equal(snapshotRun.status, 0, snapshotRun.stderr || snapshotRun.stdout)
-    const snapshotPayload = JSON.parse(snapshotRun.stdout)
-    assert.equal(snapshotPayload.transport, 'daemon')
-    assert.equal(snapshotPayload.snapshot.sanitized, true)
-    assert.equal(snapshotPayload.snapshot.visibleTextPath, null)
-    const snapshotHtml = await fs.readFile(snapshotPayload.snapshot.htmlPath, 'utf8')
-    assert.doesNotMatch(snapshotHtml, /Tokenless daemon E2E DOM prompt 93742/)
-    assert.doesNotMatch(snapshotHtml, /visible ChatGPT real-DOM fixture answer/)
-    assert.deepEqual(
-      context.pages().filter((page) => !pagesBeforeSnapshot.has(page)).map((page) => page.url()),
-      [],
-      'snapshot-dom must reuse the provider tab without opening another page'
-    )
-    events.push({
-      at: new Date().toISOString(),
-      event: 'snapshot_completed_without_new_page',
-      jobId: snapshotPayload.jobId,
-      htmlPath: snapshotPayload.snapshot.htmlPath,
-    })
-
-    const invalid = await createDaemonJob({
-      daemonUrl,
-      homeDir: tokenlessHome,
-      provider: 'chatgpt',
-      action: 'unsupported_for_e2e',
-      requestJson: {
-        requestId: 'daemon-e2e-invalid-request',
-        targetUrl: 'https://chatgpt.com/',
-        prompt: 'This invalid action must fail before provider submission.',
-      },
-    })
-    await ensureDaemonBridgeStarted(context)
-    events.push({ at: new Date().toISOString(), event: 'daemon_bridge_ready', jobId: invalid.job_id })
-    const failedCompleted = await waitForDaemonJobStatus({
-      daemonUrl,
-      homeDir: tokenlessHome,
-      jobId: invalid.job_id,
-      statuses: ['failed'],
-      daemon,
-      getDaemonJob,
-    })
-    assert.equal(failedCompleted.status, 'failed')
-    assert.equal(failedCompleted.claim_token, undefined)
-    assert.equal(failedCompleted.claimToken, undefined)
-    assert.equal(failedCompleted.error_json.code, 'unsupported_action')
-    const pageUrlsAfterFailure = context.pages().map((page) => page.url())
-    assert.ok(pageUrlsAfterFailure.every((url) => !url.includes('/task/task.html')), JSON.stringify(pageUrlsAfterFailure, null, 2))
-    assert.ok(pageUrlsAfterFailure.every((url) => !url.includes('/daemon/runner.html')), JSON.stringify(pageUrlsAfterFailure, null, 2))
-    assertNoTaskPageObserved(observedUrls)
-    assertNoRunnerPageObserved(observedUrls)
-
-    const settingsPageOpenedAutomatically = observedUrls.some((entry) => entry.url.includes('/settings/'))
-    assert.equal(settingsPageOpenedAutomatically, false, JSON.stringify(observedUrls, null, 2))
-    const settingsPage = await context.newPage()
-    await settingsPage.goto(`chrome-extension://${extensionId}/settings/index.html`)
-    await settingsPage.locator('#history .job-id').getByText(`Job ID: ${created.job_id}`, { exact: true })
-      .waitFor({ timeout: 10000 })
-    await settingsPage.screenshot({ path: path.join(artifactDir, '02-settings-history-opened-explicitly.png'), fullPage: true })
-
-    await providerPage.bringToFront()
-    await providerPage.screenshot({
-      path: path.join(artifactDir, '03-chatgpt-fixture-after-daemon.png'),
-      animations: 'disabled',
-    })
-    await fs.writeFile(path.join(artifactDir, 'daemon-completed-job.json'), `${JSON.stringify(completed, null, 2)}\n`, 'utf8')
-    await fs.writeFile(path.join(artifactDir, 'daemon-failed-job.json'), `${JSON.stringify(failedCompleted, null, 2)}\n`, 'utf8')
-    await fs.writeFile(path.join(artifactDir, 'observed-urls.json'), `${JSON.stringify(observedUrls, null, 2)}\n`, 'utf8')
-    await fs.writeFile(path.join(artifactDir, 'summary.json'), `${JSON.stringify({
-      ok: true,
-      artifactDir,
-      mode: 'daemon-fixture-chatgpt',
-      fixture: true,
-      realProviderDom: true,
-      extensionId,
-      daemonUrl,
-      jobId: created.job_id,
-      provider: 'chatgpt',
-      targetUrl: 'https://chatgpt.com/',
-      prompt,
-      taskPageOpened: observedUrls.some((entry) => entry.url.includes('/task/task.html')),
-      runnerPageOpened: observedUrls.some((entry) => entry.url.includes('/daemon/runner.html')),
-      settingsPageOpenedAutomatically,
-      settingsPageOpenedExplicitly: true,
-      observedUrlCount: observedUrls.length,
-      events,
-    }, null, 2)}\n`, 'utf8')
-    console.log(`Tokenless daemon fixture E2E artifacts: ${artifactDir}`)
-  } finally {
-    const cleanupErrors = []
-    await attemptCleanup(cleanupErrors, 'write observed URL artifacts', async () => {
-      await fs.writeFile(path.join(artifactDir, 'observed-urls.json'), `${JSON.stringify(observedUrls, null, 2)}\n`, 'utf8')
-      if (context) {
-        await fs.writeFile(path.join(artifactDir, 'pages.json'), `${JSON.stringify(
-          context.pages().map((page) => ({ url: page.url() })),
-          null,
-          2
-        )}\n`, 'utf8')
-      }
-      await fs.writeFile(path.join(artifactDir, 'events.json'), `${JSON.stringify(events, null, 2)}\n`, 'utf8')
-    })
-    await attemptCleanup(cleanupErrors, 'close browser context', async () => context?.close())
-    await attemptCleanup(cleanupErrors, 'close provider fixture', async () => providerFixture?.close())
-    const manifestsRestored = await attemptCleanup(
-      cleanupErrors,
-      'restore native host manifests',
-      async () => restoreFiles(manifestBackup)
-    )
-    const registryRestored = await attemptCleanup(
-      cleanupErrors,
-      'restore native host registry',
-      async () => restoreWindowsNativeHostRegistry(registryBackup)
-    )
-    await attemptCleanup(cleanupErrors, 'stop daemon', async () => {
-      if (daemon) await stopDaemon(daemon)
-    })
-    if (manifestsRestored && registryRestored) {
-      await attemptCleanup(cleanupErrors, 'remove temporary E2E state', async () => {
-        await fs.rm(tempRoot, { recursive: true, force: true })
-      })
-    }
-    if (cleanupErrors.length > 0) {
-      throw new AggregateError(cleanupErrors, 'Tokenless fixture E2E cleanup failed')
-    }
-  }
-})
-
-test('visible attachment bytes traverse CLI, daemon, native host, extension, and ChatGPT DOM before prompt submission', {
-  skip: process.env.TOKENLESS_E2E !== '1' ? 'set TOKENLESS_E2E=1 to run fixture browser E2E' : false,
-  timeout: 180000,
-}, async () => {
-  const { chromium } = await import('playwright')
-  const {
-    getDaemonJob,
-    installNativeHost,
-    nativeMessagingHostDirs,
-    NATIVE_HOST_NAME,
-    readLiveBridgeMarker,
-  } = await import('../../packages/cli/dist/src/index.js')
-  const { DEFAULT_EXTENSION_ID } = await import('../extension/default-extension-id.mjs')
-
-  const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'tokenless-attachment-e2e-'))
-  const userDataDir = path.join(tempRoot, 'profile')
-  const tokenlessHome = path.join(tempRoot, 'tokenless-home')
-  const nativePackageRoot = path.join(
-    root,
-    'packages/cli/npm',
-    `tokenless-native-${process.platform}-${process.arch}`
-  )
-  const privateSourceMarker = 'private-source-path-must-not-cross-57419'
-  const sourceDir = path.join(tempRoot, privateSourceMarker)
-  const sourcePath = path.join(sourceDir, 'visible-e2e-note.txt')
-  const attachmentBytes = Buffer.from([
-    'Tokenless visible attachment E2E bytes.\n',
-    'This payload proves the browser FileList received the exact source bytes.\n',
-    'Unicode: π, 中文, مرحبا.\n',
-  ].join(''), 'utf8')
-  const expectedSha256 = createHash('sha256').update(attachmentBytes).digest('hex')
-  const prompt = 'Read the locally attached E2E note 57419.'
-  const port = await freePort()
-  const daemonUrl = `http://127.0.0.1:${port}`
-  const events = []
-  let manifestBackup = []
-  let registryBackup = []
-  let daemon
-  let context
-  let providerFixture
-
-  try {
-    await fs.mkdir(sourceDir, { recursive: true })
-    await fs.writeFile(sourcePath, attachmentBytes)
-
-    daemon = startDaemon({ homeDir: tokenlessHome, port })
-    await waitForDaemonReady(daemonUrl, daemon)
-
-    // Install before Chromium starts so the real Manifest V3 service worker can
-    // connect to the real Rust native host for this isolated test profile.
-    const browsers = fixtureNativeHostBrowsers()
-    registryBackup = snapshotWindowsNativeHostRegistry(
-      browsers,
-      NATIVE_HOST_NAME,
-      windowsNativeHostManifestPath(tokenlessHome, NATIVE_HOST_NAME)
-    )
-    manifestBackup = await snapshotFiles(browsers.flatMap((browser) => (
-      nativeMessagingHostDirs(browser, userDataDir).map((dir) => path.join(dir, `${NATIVE_HOST_NAME}.json`))
-    )))
-    const installed = await installNativeHost({
-      homeDir: tokenlessHome,
-      manifestHome: userDataDir,
-      extensionId: DEFAULT_EXTENSION_ID,
-      browsers,
-      packageRoot: nativePackageRoot,
-    })
-    assert.ok(installed.manifests.length >= 1)
-
-    providerFixture = await startHttpsFixtureServer({
-      body: await fs.readFile(providerAttachmentDomFixturePath, 'utf8'),
-      events,
-      providerHost: 'chatgpt.com',
-    })
-    context = await launchTokenlessContext(
-      chromium,
-      userDataDir,
-      tokenlessHome,
-      daemonUrl,
-      providerFixture,
-      'chatgpt.com'
-    )
-    assert.equal(await discoverExtensionId(context), DEFAULT_EXTENSION_ID)
-    await ensureDaemonBridgeStarted(context)
-    await waitForBridgeMarker({ tokenlessHome, readLiveBridgeMarker, context })
-
-    const cliRun = await runProcess(process.execPath, [
-      path.join(root, 'packages/cli/dist/src/tokenless.mjs'),
-      'run',
-      '--prompt',
-      prompt,
-      '--provider',
-      'chatgpt',
-      '--attach-file',
-      sourcePath,
-      '--home',
-      tokenlessHome,
-      '--daemon-url',
-      daemonUrl,
-      '--target-url',
-      'https://chatgpt.com/',
-      '--read-delay-ms',
-      '0',
-      '--read-timeout-ms',
-      '10000',
-      '--no-open',
-      '--json',
-    ], { cwd: root })
-    assert.equal(cliRun.status, 0, `${cliRun.stderr}\n${cliRun.stdout}`)
-
-    const cliPayload = JSON.parse(cliRun.stdout)
-    assert.equal(cliPayload.transport, 'daemon')
-    assert.equal(cliPayload.provider, 'chatgpt')
-    assert.match(cliPayload.compactOutput, /visible attachment fixture answer/)
-    const completed = await waitForDaemonJobStatus({
-      daemonUrl,
-      homeDir: tokenlessHome,
-      jobId: cliPayload.jobId,
-      statuses: ['succeeded', 'failed'],
-      daemon,
-      getDaemonJob,
-    })
-    assert.equal(completed.status, 'succeeded', JSON.stringify(completed.error_json, null, 2))
-    assert.match(completed.result_json.text, /visible attachment fixture answer/)
-
-    const attachments = completed.request_json.attachments
-    assert.equal(attachments.length, 1)
-    const descriptor = attachments[0]
-    assert.deepEqual(Object.keys(descriptor).sort(), [
-      'attachmentId',
-      'bundleId',
-      'name',
-      'protocol',
-      'sha256',
-      'size',
-      'type',
-    ])
-    assert.deepEqual(descriptor, {
-      protocol: 'tokenless.visible-attachment.v1',
-      bundleId: descriptor.bundleId,
-      attachmentId: descriptor.attachmentId,
-      name: path.basename(sourcePath),
-      type: 'text/plain',
-      size: attachmentBytes.byteLength,
-      sha256: expectedSha256,
-    })
-
-    const providerPage = context.pages().find((page) => page.url().startsWith('https://chatgpt.com/'))
-    assert.ok(providerPage, `extension did not open the ChatGPT fixture: ${JSON.stringify(context.pages().map((page) => page.url()))}`)
-    const visibleEvidence = await providerPage.evaluate(async () => {
-      const input = document.querySelector('input#upload-files[type="file"][multiple]')
-      const file = input?.files?.[0]
-      if (!file) return null
-      const bytes = [...new Uint8Array(await file.arrayBuffer())]
-      const digest = await crypto.subtle.digest('SHA-256', new Uint8Array(bytes))
-      const sha256 = [...new Uint8Array(digest)]
-        .map((byte) => byte.toString(16).padStart(2, '0'))
-        .join('')
-      const fixture = globalThis.__attachmentFixture
-      return {
-        assistantText: document.querySelector('[data-message-author-role="assistant"]')?.textContent ?? '',
-        bytes,
-        chipText: document.querySelector('#attachment-evidence .attachment-chip')?.textContent ?? '',
-        events: [...fixture.events],
-        file: { name: file.name, size: file.size, type: file.type, sha256 },
-        records: fixture.records,
-        submissions: fixture.submissions,
-        userText: document.querySelector('[data-message-author-role="user"]')?.textContent ?? '',
-      }
-    })
-    assert.ok(visibleEvidence, 'the exact ChatGPT file input must retain a FileList entry')
-    assert.deepEqual(visibleEvidence.file, {
-      name: path.basename(sourcePath),
-      size: attachmentBytes.byteLength,
-      type: 'text/plain',
-      sha256: expectedSha256,
-    })
-    assert.deepEqual(visibleEvidence.bytes, [...attachmentBytes])
-    assert.equal(visibleEvidence.chipText, path.basename(sourcePath))
-    assert.deepEqual(visibleEvidence.records, [{
-      bytes: [...attachmentBytes],
-      name: path.basename(sourcePath),
-      size: attachmentBytes.byteLength,
-      type: 'text/plain',
-    }])
-    assert.equal(visibleEvidence.submissions.length, 1)
-    assert.equal(visibleEvidence.submissions[0].fileName, path.basename(sourcePath))
-    assert.equal(visibleEvidence.submissions[0].submittedAfterVisibleAttachment, true)
-    assert.match(visibleEvidence.submissions[0].prompt, /Read the locally attached E2E note 57419/)
-    assert.match(visibleEvidence.userText, /Read the locally attached E2E note 57419/)
-    assert.match(visibleEvidence.assistantText, /visible attachment fixture answer/)
-    const chipVisibleIndex = visibleEvidence.events.indexOf('chip-visible')
-    const submitIndex = visibleEvidence.events.indexOf('submit')
-    assert.ok(chipVisibleIndex >= 0, JSON.stringify(visibleEvidence.events))
-    assert.ok(submitIndex > chipVisibleIndex, JSON.stringify(visibleEvidence.events))
-    assert.ok(
-      visibleEvidence.events.slice(chipVisibleIndex + 1, submitIndex).includes('prompt-input'),
-      JSON.stringify(visibleEvidence.events)
-    )
-
-    const stagedBundlePath = path.join(tokenlessHome, 'attachments', descriptor.bundleId)
-    const stagedFilePath = path.join(stagedBundlePath, `${descriptor.attachmentId}.bin`)
-    await waitForPathAbsent(stagedBundlePath)
-    assert.equal(await pathExists(stagedBundlePath), false, 'terminal completion must remove the staged bundle')
-    assert.equal(await pathExists(sourcePath), true, 'terminal cleanup must not remove the source file')
-
-    const pagesBeforeUnifiedFile = new Set(context.pages())
-    const unifiedFileRun = await runProcess(process.execPath, [
-      path.join(root, 'packages/cli/dist/src/tokenless.mjs'),
-      'provider-action',
-      '--action',
-      'file.upload',
-      '--provider',
-      'chatgpt',
-      '--attach-file',
-      sourcePath,
-      '--task-id',
-      'unified-file-upload-e2e-57419',
-      '--home',
-      tokenlessHome,
-      '--daemon-url',
-      daemonUrl,
-      '--target-url',
-      'https://chatgpt.com/',
-      '--no-open',
-      '--json',
-    ], { cwd: root })
-    assert.equal(unifiedFileRun.status, 0, `${unifiedFileRun.stderr}\n${unifiedFileRun.stdout}`)
-    const unifiedFilePayload = JSON.parse(unifiedFileRun.stdout)
-    const unifiedFileJob = await waitForDaemonJobStatus({
-      daemonUrl,
-      homeDir: tokenlessHome,
-      jobId: unifiedFilePayload.jobId,
-      statuses: ['succeeded', 'failed'],
-      daemon,
-      getDaemonJob,
-    })
-    assert.equal(unifiedFileJob.status, 'succeeded', JSON.stringify(unifiedFileJob.error_json, null, 2))
-    assert.equal(unifiedFileJob.action, 'visible_provider_action')
-    assert.deepEqual(unifiedFileJob.request_json.visibleAction, {
-      protocol: 'tokenless.visible-provider-action.v1',
-      requestId: 'unified-file-upload-e2e-57419',
-      provider: 'chatgpt',
-      action: 'file.upload',
-      payload: { attachments: unifiedFileJob.request_json.attachments },
-    })
-    assert.deepEqual(unifiedFileJob.result_json.attachments, [{
-      attachmentId: unifiedFileJob.request_json.attachments[0].attachmentId,
-      name: path.basename(sourcePath),
-      visible: true,
-    }])
-    const unifiedFilePages = context.pages().filter((page) => !pagesBeforeUnifiedFile.has(page))
-    assert.equal(unifiedFilePages.length, 1, 'standalone file.upload must create exactly one clean provider page')
-    const unifiedProviderPage = unifiedFilePages[0]
-    assert.ok(unifiedProviderPage.url().startsWith('https://chatgpt.com/'))
-    const unifiedFileEvidence = await unifiedProviderPage.evaluate(async () => {
-      const file = document.querySelector('input#upload-files[type="file"][multiple]')?.files?.[0]
-      if (!file) return null
-      return {
-        bytes: [...new Uint8Array(await file.arrayBuffer())],
-        chipText: document.querySelector('#attachment-evidence .attachment-chip')?.textContent ?? '',
-        events: [...globalThis.__attachmentFixture.events],
-        file: { name: file.name, size: file.size, type: file.type },
-        submissions: [...globalThis.__attachmentFixture.submissions],
-      }
-    })
-    assert.ok(unifiedFileEvidence, 'standalone file.upload must retain the exact FileList bytes')
-    assert.deepEqual(unifiedFileEvidence.file, {
-      name: path.basename(sourcePath),
-      size: attachmentBytes.byteLength,
-      type: 'text/plain',
-    })
-    assert.deepEqual(unifiedFileEvidence.bytes, [...attachmentBytes])
-    assert.equal(unifiedFileEvidence.chipText, path.basename(sourcePath))
-    assert.deepEqual(unifiedFileEvidence.submissions, [], 'file.upload must not implicitly submit a prompt')
-
-    const pagesBeforeUnifiedInput = context.pages().length
-    const unifiedInputRun = await runProcess(process.execPath, [
-      path.join(root, 'packages/cli/dist/src/tokenless.mjs'),
-      'provider-action',
-      '--action',
-      'prompt.input',
-      '--provider',
-      'chatgpt',
-      '--prompt',
-      'Draft beside the unified E2E attachment.',
-      '--task-id',
-      'unified-prompt-input-e2e-57419',
-      '--home',
-      tokenlessHome,
-      '--daemon-url',
-      daemonUrl,
-      '--target-url',
-      'https://chatgpt.com/',
-      '--no-open',
-      '--json',
-    ], { cwd: root })
-    assert.equal(unifiedInputRun.status, 0, `${unifiedInputRun.stderr}\n${unifiedInputRun.stdout}`)
-    assert.equal(context.pages().length, pagesBeforeUnifiedInput, 'prompt.input must reuse the file.upload affinity page')
-    assert.equal(
-      await unifiedProviderPage.locator('#prompt-textarea').innerText(),
-      'Draft beside the unified E2E attachment.'
-    )
-
-    const unifiedSubmitRun = await runProcess(process.execPath, [
-      path.join(root, 'packages/cli/dist/src/tokenless.mjs'),
-      'provider-action',
-      '--action',
-      'prompt.submit',
-      '--provider',
-      'chatgpt',
-      '--prompt',
-      'Submit the unified E2E attachment 57419.',
-      '--task-id',
-      'unified-prompt-submit-e2e-57419',
-      '--home',
-      tokenlessHome,
-      '--daemon-url',
-      daemonUrl,
-      '--target-url',
-      'https://chatgpt.com/',
-      '--no-open',
-      '--json',
-    ], { cwd: root })
-    assert.equal(unifiedSubmitRun.status, 0, `${unifiedSubmitRun.stderr}\n${unifiedSubmitRun.stdout}`)
-    assert.equal(context.pages().length, pagesBeforeUnifiedInput, 'prompt.submit must reuse the file.upload affinity page')
-    const unifiedSubmitPayload = JSON.parse(unifiedSubmitRun.stdout)
-    assert.deepEqual(unifiedSubmitPayload.result?.result, {
-      submissionProof: 'visible-submit-unified-prompt-submit-e2e-57419',
-      visible: true,
-      provider: 'chatgpt',
-    })
-    const unifiedSubmissionEvidence = await unifiedProviderPage.evaluate(() => ({
-      events: [...globalThis.__attachmentFixture.events],
-      submissions: [...globalThis.__attachmentFixture.submissions],
-      userText: document.querySelector('[data-message-author-role="user"]')?.textContent ?? '',
-    }))
-    assert.equal(unifiedSubmissionEvidence.submissions.length, 1)
-    assert.equal(unifiedSubmissionEvidence.submissions[0].fileName, path.basename(sourcePath))
-    assert.equal(unifiedSubmissionEvidence.submissions[0].submittedAfterVisibleAttachment, true)
-    assert.match(unifiedSubmissionEvidence.userText, /Submit the unified E2E attachment 57419/)
-    assert.ok(
-      unifiedSubmissionEvidence.events.indexOf('submit') > unifiedSubmissionEvidence.events.indexOf('chip-visible'),
-      JSON.stringify(unifiedSubmissionEvidence.events)
-    )
-
-    const externallyVisible = JSON.stringify({
-      cliPayload,
-      cliStderr: cliRun.stderr,
-      daemonStdout: daemon.stdoutText,
-      daemonStderr: daemon.stderrText,
-      fixture: visibleEvidence,
-      request: completed.request_json,
-      result: completed.result_json,
-      unifiedFilePayload,
-      unifiedFileResult: unifiedFileJob.result_json,
-      unifiedInputPayload: JSON.parse(unifiedInputRun.stdout),
-      unifiedSubmitPayload,
-    })
-    assertNoPrivateAttachmentPaths(externallyVisible, [sourceDir, sourcePath, stagedBundlePath, stagedFilePath])
-    assert.doesNotMatch(externallyVisible, /sourcePath|stagedPath|private-source-path-must-not-cross-57419/)
-  } finally {
-    const cleanupErrors = []
-    await attemptCleanup(cleanupErrors, 'close browser context', async () => context?.close())
-    await attemptCleanup(cleanupErrors, 'close provider fixture', async () => providerFixture?.close())
-    const manifestsRestored = await attemptCleanup(
-      cleanupErrors,
-      'restore native host manifests',
-      async () => restoreFiles(manifestBackup)
-    )
-    const registryRestored = await attemptCleanup(
-      cleanupErrors,
-      'restore native host registry',
-      async () => restoreWindowsNativeHostRegistry(registryBackup)
-    )
-    await attemptCleanup(cleanupErrors, 'stop daemon', async () => {
-      if (daemon) await stopDaemon(daemon)
-    })
-    if (manifestsRestored && registryRestored) {
-      await attemptCleanup(cleanupErrors, 'remove temporary E2E state', async () => {
-        await fs.rm(tempRoot, { recursive: true, force: true })
-      })
-    }
-    if (cleanupErrors.length > 0) {
-      throw new AggregateError(cleanupErrors, 'Tokenless visible attachment E2E cleanup failed')
-    }
-  }
-})
-
-test('daemon job completes through extension service worker and Claude real-DOM fixture without internal pages', {
-  skip: process.env.TOKENLESS_E2E !== '1' ? 'set TOKENLESS_E2E=1 to run fixture browser E2E' : false,
-  timeout: 180000,
-}, async () => {
-  const { chromium } = await import('playwright')
-  const {
-    getDaemonJob,
-    installNativeHost,
-    nativeMessagingHostDirs,
-    NATIVE_HOST_NAME,
-    readLiveBridgeMarker,
-  } = await import('../../packages/cli/dist/src/index.js')
-  const { DEFAULT_EXTENSION_ID } = await import('../extension/default-extension-id.mjs')
-
-  const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'tokenless-claude-daemon-e2e-'))
-  const artifactDir = await createArtifactDir()
-  const userDataDir = path.join(tempRoot, 'profile')
-  const tokenlessHome = path.join(tempRoot, 'tokenless-home')
-  const port = await freePort()
-  const daemonUrl = `http://127.0.0.1:${port}`
-  const prompt = 'Tokenless Claude daemon E2E DOM prompt 68421'
-  const targetUrl = 'https://claude.ai/new'
-  const conversationUrl = 'https://claude.ai/chat/123e4567-e89b-12d3-a456-426614174001'
-  const events = []
-  const observedUrls = []
-  let manifestBackup = []
-  let registryBackup = []
-  let daemon
-  let context
-  let providerFixture
-
-  try {
-    daemon = startDaemon({ homeDir: tokenlessHome, port })
-    await waitForDaemonReady(daemonUrl, daemon)
-    events.push({ at: new Date().toISOString(), event: 'daemon_ready', daemonUrl })
-
-    const browsers = fixtureNativeHostBrowsers()
-    registryBackup = snapshotWindowsNativeHostRegistry(
-      browsers,
-      NATIVE_HOST_NAME,
-      windowsNativeHostManifestPath(tokenlessHome, NATIVE_HOST_NAME)
-    )
-    manifestBackup = await snapshotFiles(browsers.flatMap((browser) => (
-      nativeMessagingHostDirs(browser, userDataDir).map((dir) => path.join(dir, `${NATIVE_HOST_NAME}.json`))
-    )))
-    const installed = await installNativeHost({
-      homeDir: tokenlessHome,
-      manifestHome: userDataDir,
-      extensionId: DEFAULT_EXTENSION_ID,
-      browsers,
-    })
-    assert.ok(installed.manifests.length >= 1)
-    events.push({
-      at: new Date().toISOString(),
-      event: 'native_host_installed',
-      manifests: installed.manifests,
-      executable: installed.nativeHostExecutable,
-    })
-
-    const claudeFixture = await fs.readFile(claudeRealDomFixturePath, 'utf8')
-    providerFixture = await startHttpsFixtureServer({
-      body: claudeFixture,
-      events,
-      providerHost: 'claude.ai',
-    })
-    context = await launchTokenlessContext(
-      chromium,
-      userDataDir,
-      tokenlessHome,
-      daemonUrl,
-      providerFixture,
-      'claude.ai'
-    )
-    observeContextUrls(context, observedUrls)
-    const extensionId = await discoverExtensionId(context)
-    assert.equal(extensionId, DEFAULT_EXTENSION_ID)
-
-    await ensureDaemonBridgeStarted(context)
-    const bridgeMarker = await waitForBridgeMarker({ tokenlessHome, readLiveBridgeMarker, context })
-    assert.equal(bridgeMarker.protocol, 'tokenless.extension-bridge-state.v1')
-    events.push({
-      at: new Date().toISOString(),
-      event: 'daemon_bridge_ready',
-      sessionId: bridgeMarker.sessionId,
-    })
-    const pagesBeforeRun = new Set(context.pages())
-    const observedUrlCountBeforeRun = observedUrls.length
-
-    const cliRun = await runProcess(process.execPath, [
-      path.join(root, 'packages/cli/dist/src/tokenless.mjs'),
-      'run',
-      '--prompt',
-      prompt,
-      '--provider',
-      'claude',
-      '--home',
-      tokenlessHome,
-      '--daemon-url',
-      daemonUrl,
-      '--target-url',
-      targetUrl,
-      '--read-delay-ms',
-      '0',
-      '--read-timeout-ms',
-      '10000',
-      '--no-open',
-      '--json',
-    ], { cwd: root })
-
-    assert.equal(cliRun.status, 0, cliRun.stderr || cliRun.stdout)
-    const cliPayload = JSON.parse(cliRun.stdout)
-    assert.equal(cliPayload.transport, 'daemon')
-    assert.equal(cliPayload.provider, 'claude')
-    assert.equal(cliPayload.taskUrl, undefined)
-    assert.equal(cliPayload.runnerUrl, undefined)
-    assert.match(cliPayload.compactOutput, /visible Claude real-DOM fixture answer/)
-    assert.match(cliPayload.compactOutput, /Tokenless Claude daemon E2E DOM prompt 68421/)
-    assert.doesNotMatch(cliRun.stdout, /taskUrl|task\/task\.html|runnerUrl|daemon\/runner\.html/)
-
-    const created = await getDaemonJob({
-      daemonUrl,
-      homeDir: tokenlessHome,
-      jobId: cliPayload.jobId,
-    })
-    assert.ok(['queued', 'claimed', 'succeeded'].includes(created.status), JSON.stringify(created, null, 2))
-    assert.equal(created.claim_token, undefined)
-    assert.match(created.request_json.prompt, /Tokenless Claude daemon E2E DOM prompt 68421/)
-    events.push({ at: new Date().toISOString(), event: 'cli_daemon_job_created', jobId: created.job_id })
-
-    const completed = await waitForDaemonJobStatus({
-      daemonUrl,
-      homeDir: tokenlessHome,
-      jobId: created.job_id,
-      statuses: ['succeeded', 'failed'],
-      daemon,
-      getDaemonJob,
-    })
-    await fs.writeFile(
-      path.join(artifactDir, 'claude-daemon-terminal-job.json'),
-      `${JSON.stringify(completed, null, 2)}\n`,
-      'utf8'
-    )
-    assert.equal(completed.status, 'succeeded', JSON.stringify(completed, null, 2))
-    assert.equal(completed.claim_token, undefined)
-    assert.equal(completed.result_json.read.url, conversationUrl)
-    assert.match(completed.result_json.text, /visible Claude real-DOM fixture answer/)
-    assert.match(completed.result_json.text, /Tokenless Claude daemon E2E DOM prompt 68421/)
-    assert.doesNotMatch(completed.result_json.text, /stale Claude real-DOM fixture answer/)
-    assert.doesNotMatch(completed.result_json.text, /_streaming/)
-
-    const providerPage = context.pages().find((page) => page.url().startsWith('https://claude.ai/'))
-    assert.ok(providerPage, `extension did not open the visible Claude page: ${JSON.stringify(context.pages().map((page) => page.url()))}`)
-    assert.equal(providerPage.url(), conversationUrl)
-    await providerPage.bringToFront()
-    await providerPage.screenshot({
-      path: path.join(artifactDir, '01-claude-fixture-after-daemon.png'),
-      animations: 'disabled',
-    })
-    const userMessage = providerPage.locator(
-      '[data-testid="virtual-message-list"] [data-role="user"]'
-    ).last()
-    assert.match(await userMessage.innerText(), /Tokenless Claude daemon E2E DOM prompt 68421/)
-    const assistantMessage = providerPage.locator(
-      '[data-testid="virtual-message-list"] .font-claude-response-body'
-    ).last()
-    assert.match(await assistantMessage.innerText(), /visible Claude real-DOM fixture answer/)
-    assert.match(await assistantMessage.innerText(), /Tokenless Claude daemon E2E DOM prompt 68421/)
-    assert.equal(await providerPage.locator('[data-is-streaming="true"]').count(), 0)
-
-    const pageUrlsAfterSuccess = context.pages().map((page) => page.url())
-    assert.ok(pageUrlsAfterSuccess.every((url) => !url.includes('/task/task.html')), JSON.stringify(pageUrlsAfterSuccess, null, 2))
-    assert.ok(pageUrlsAfterSuccess.every((url) => !url.includes('/daemon/runner.html')), JSON.stringify(pageUrlsAfterSuccess, null, 2))
-    assert.ok(pageUrlsAfterSuccess.every((url) => !url.includes('/settings/')), JSON.stringify(pageUrlsAfterSuccess, null, 2))
-    const pagesOpenedByRun = context.pages().filter((page) => !pagesBeforeRun.has(page))
-    assert.deepEqual(
-      pagesOpenedByRun.map((page) => page.url()),
-      [conversationUrl],
-      'Claude task execution must open exactly one visible provider page'
-    )
-    const urlsObservedDuringRun = observedUrls
-      .slice(observedUrlCountBeforeRun)
-      .map((entry) => entry.url)
-    assert.ok(
-      urlsObservedDuringRun.every((url) => url === 'about:blank' || url.startsWith('https://claude.ai/')),
-      `Claude task execution opened a non-provider page: ${JSON.stringify(urlsObservedDuringRun, null, 2)}`
-    )
-    assertNoTaskPageObserved(observedUrls)
-    assertNoRunnerPageObserved(observedUrls)
-    assert.equal(
-      observedUrls.some((entry) => entry.url.includes('/settings/')),
-      false,
-      JSON.stringify(observedUrls, null, 2)
-    )
-
-    await fs.writeFile(path.join(artifactDir, 'claude-observed-urls.json'), `${JSON.stringify(observedUrls, null, 2)}\n`, 'utf8')
-    await fs.writeFile(path.join(artifactDir, 'claude-summary.json'), `${JSON.stringify({
-      ok: true,
-      mode: 'daemon-fixture-claude',
-      fixture: true,
-      realProviderDom: true,
-      extensionId,
-      daemonUrl,
-      jobId: completed.job_id,
-      provider: 'claude',
-      targetUrl,
-      conversationUrl,
-      prompt,
-      taskPageOpened: observedUrls.some((entry) => entry.url.includes('/task/task.html')),
-      runnerPageOpened: observedUrls.some((entry) => entry.url.includes('/daemon/runner.html')),
-      settingsPageOpened: observedUrls.some((entry) => entry.url.includes('/settings/')),
-      events,
-    }, null, 2)}\n`, 'utf8')
-    console.log(`Tokenless Claude daemon fixture E2E artifacts: ${artifactDir}`)
-  } finally {
-    const cleanupErrors = []
-    await attemptCleanup(cleanupErrors, 'write Claude observed URL artifacts', async () => {
-      await fs.writeFile(path.join(artifactDir, 'claude-observed-urls.json'), `${JSON.stringify(observedUrls, null, 2)}\n`, 'utf8')
-    })
-    await attemptCleanup(cleanupErrors, 'close browser context', async () => context?.close())
-    await attemptCleanup(cleanupErrors, 'close provider fixture', async () => providerFixture?.close())
-    const manifestsRestored = await attemptCleanup(
-      cleanupErrors,
-      'restore native host manifests',
-      async () => restoreFiles(manifestBackup)
-    )
-    const registryRestored = await attemptCleanup(
-      cleanupErrors,
-      'restore native host registry',
-      async () => restoreWindowsNativeHostRegistry(registryBackup)
-    )
-    await attemptCleanup(cleanupErrors, 'stop daemon', async () => {
-      if (daemon) await stopDaemon(daemon)
-    })
-    if (manifestsRestored && registryRestored) {
-      await attemptCleanup(cleanupErrors, 'remove temporary Claude E2E state', async () => {
-        await fs.rm(tempRoot, { recursive: true, force: true })
-      })
-    }
-    if (cleanupErrors.length > 0) {
-      throw new AggregateError(cleanupErrors, 'Tokenless Claude fixture E2E cleanup failed')
-    }
-  }
-})
-
-test('daemon job completes through extension service worker and Gemini real-DOM fixture without internal pages', {
-  skip: process.env.TOKENLESS_E2E !== '1' ? 'set TOKENLESS_E2E=1 to run fixture browser E2E' : false,
-  timeout: 180000,
-}, async () => {
-  const { chromium } = await import('playwright')
-  const {
-    getDaemonJob,
-    installNativeHost,
-    nativeMessagingHostDirs,
-    NATIVE_HOST_NAME,
-    readLiveBridgeMarker,
-  } = await import('../../packages/cli/dist/src/index.js')
-  const { DEFAULT_EXTENSION_ID } = await import('../extension/default-extension-id.mjs')
-
-  const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'tokenless-gemini-daemon-e2e-'))
-  const artifactDir = await createArtifactDir()
-  const userDataDir = path.join(tempRoot, 'profile')
-  const tokenlessHome = path.join(tempRoot, 'tokenless-home')
-  const port = await freePort()
-  const daemonUrl = `http://127.0.0.1:${port}`
-  const prompt = 'Tokenless Gemini daemon E2E DOM prompt 52963'
-  const targetUrl = 'https://gemini.google.com/app'
-  const conversationUrl = 'https://gemini.google.com/app/4b9f2c7d1e6a'
-  const events = []
-  const observedUrls = []
-  let manifestBackup = []
-  let registryBackup = []
-  let daemon
-  let context
-  let providerFixture
-
-  try {
-    daemon = startDaemon({ homeDir: tokenlessHome, port })
-    await waitForDaemonReady(daemonUrl, daemon)
-    events.push({ at: new Date().toISOString(), event: 'daemon_ready', daemonUrl })
-
-    const browsers = fixtureNativeHostBrowsers()
-    registryBackup = snapshotWindowsNativeHostRegistry(
-      browsers,
-      NATIVE_HOST_NAME,
-      windowsNativeHostManifestPath(tokenlessHome, NATIVE_HOST_NAME)
-    )
-    manifestBackup = await snapshotFiles(browsers.flatMap((browser) => (
-      nativeMessagingHostDirs(browser, userDataDir).map((dir) => path.join(dir, `${NATIVE_HOST_NAME}.json`))
-    )))
-    const installed = await installNativeHost({
-      homeDir: tokenlessHome,
-      manifestHome: userDataDir,
-      extensionId: DEFAULT_EXTENSION_ID,
-      browsers,
-    })
-    assert.ok(installed.manifests.length >= 1)
-    events.push({
-      at: new Date().toISOString(),
-      event: 'native_host_installed',
-      manifests: installed.manifests,
-      executable: installed.nativeHostExecutable,
-    })
-
-    const geminiFixture = await fs.readFile(geminiRealDomFixturePath, 'utf8')
-    providerFixture = await startHttpsFixtureServer({
-      body: geminiFixture,
-      events,
-      providerHost: 'gemini.google.com',
-    })
-    context = await launchTokenlessContext(
-      chromium,
-      userDataDir,
-      tokenlessHome,
-      daemonUrl,
-      providerFixture,
-      'gemini.google.com'
-    )
-    observeContextUrls(context, observedUrls)
-    const extensionId = await discoverExtensionId(context)
-    assert.equal(extensionId, DEFAULT_EXTENSION_ID)
-
-    await ensureDaemonBridgeStarted(context)
-    const bridgeMarker = await waitForBridgeMarker({ tokenlessHome, readLiveBridgeMarker, context })
-    assert.equal(bridgeMarker.protocol, 'tokenless.extension-bridge-state.v1')
-    events.push({
-      at: new Date().toISOString(),
-      event: 'daemon_bridge_ready',
-      sessionId: bridgeMarker.sessionId,
-    })
-    const pagesBeforeRun = new Set(context.pages())
-    const observedUrlCountBeforeRun = observedUrls.length
-
-    const cliRun = await runProcess(process.execPath, [
-      path.join(root, 'packages/cli/dist/src/tokenless.mjs'),
-      'run',
-      '--prompt',
-      prompt,
-      '--provider',
-      'gemini',
-      '--home',
-      tokenlessHome,
-      '--daemon-url',
-      daemonUrl,
-      '--target-url',
-      targetUrl,
-      '--read-delay-ms',
-      '0',
-      '--read-timeout-ms',
-      '10000',
-      '--no-open',
-      '--json',
-    ], { cwd: root })
-
-    assert.equal(cliRun.status, 0, cliRun.stderr || cliRun.stdout)
-    const cliPayload = JSON.parse(cliRun.stdout)
-    assert.equal(cliPayload.transport, 'daemon')
-    assert.equal(cliPayload.provider, 'gemini')
-    assert.equal(cliPayload.taskUrl, undefined)
-    assert.equal(cliPayload.runnerUrl, undefined)
-    assert.equal(cliPayload.result?.result?.submit?.provider, 'gemini')
-    assert.equal(cliPayload.result?.result?.submit?.url, targetUrl)
-    assert.equal(cliPayload.result?.result?.read?.provider, 'gemini')
-    assert.equal(cliPayload.result?.result?.read?.url, conversationUrl)
-    assert.match(cliPayload.compactOutput, /visible Gemini real-DOM fixture answer/)
-    assert.match(cliPayload.compactOutput, /Tokenless Gemini daemon E2E DOM prompt 52963/)
-    assert.doesNotMatch(cliRun.stdout, /taskUrl|task\/task\.html|runnerUrl|daemon\/runner\.html/)
-
-    const created = await getDaemonJob({
-      daemonUrl,
-      homeDir: tokenlessHome,
-      jobId: cliPayload.jobId,
-    })
-    assert.ok(['queued', 'claimed', 'succeeded'].includes(created.status), JSON.stringify(created, null, 2))
-    assert.equal(created.provider, 'gemini')
-    assert.equal(created.claim_token, undefined)
-    assert.equal(created.request_json.targetUrl, targetUrl)
-    assert.match(created.request_json.prompt, /Tokenless Gemini daemon E2E DOM prompt 52963/)
-    events.push({ at: new Date().toISOString(), event: 'cli_daemon_job_created', jobId: created.job_id })
-
-    const completed = await waitForDaemonJobStatus({
-      daemonUrl,
-      homeDir: tokenlessHome,
-      jobId: created.job_id,
-      statuses: ['succeeded', 'failed'],
-      daemon,
-      getDaemonJob,
-    })
-    await fs.writeFile(
-      path.join(artifactDir, 'gemini-daemon-terminal-job.json'),
-      `${JSON.stringify(completed, null, 2)}\n`,
-      'utf8'
-    )
-    assert.equal(completed.status, 'succeeded', JSON.stringify(completed, null, 2))
-    assert.equal(completed.provider, 'gemini')
-    assert.equal(completed.claim_token, undefined)
-    assert.equal(completed.result_json.provider, 'gemini')
-    assert.equal(completed.result_json.submit.provider, 'gemini')
-    assert.equal(completed.result_json.submit.url, targetUrl)
-    assert.equal(completed.result_json.read.provider, 'gemini')
-    assert.equal(completed.result_json.read.url, conversationUrl)
-    assert.match(completed.result_json.text, /visible Gemini real-DOM fixture answer/)
-    assert.match(completed.result_json.text, /Tokenless Gemini daemon E2E DOM prompt 52963/)
-    assert.doesNotMatch(completed.result_json.text, /stale Gemini real-DOM fixture answer/)
-    assert.doesNotMatch(completed.result_json.text, /_streaming/)
-
-    const providerPage = context.pages().find((page) => page.url().startsWith('https://gemini.google.com/'))
-    assert.ok(providerPage, `extension did not open the visible Gemini page: ${JSON.stringify(context.pages().map((page) => page.url()))}`)
-    assert.equal(providerPage.url(), conversationUrl)
-    await providerPage.bringToFront()
-    await providerPage.screenshot({
-      path: path.join(artifactDir, '01-gemini-fixture-after-daemon.png'),
-      animations: 'disabled',
-    })
-    const userMessage = providerPage.locator('user-query .query-text').last()
-    assert.match(await userMessage.innerText(), /Tokenless Gemini daemon E2E DOM prompt 52963/)
-    const assistantMessage = providerPage.locator('response-container message-content').last()
-    assert.match(await assistantMessage.innerText(), /visible Gemini real-DOM fixture answer/)
-    assert.match(await assistantMessage.innerText(), /Tokenless Gemini daemon E2E DOM prompt 52963/)
-    assert.equal(await providerPage.locator('button[aria-label="Stop response"]').count(), 0)
-
-    const pageUrlsAfterSuccess = context.pages().map((page) => page.url())
-    assert.ok(pageUrlsAfterSuccess.every((url) => !url.includes('/task/task.html')), JSON.stringify(pageUrlsAfterSuccess, null, 2))
-    assert.ok(pageUrlsAfterSuccess.every((url) => !url.includes('/daemon/runner.html')), JSON.stringify(pageUrlsAfterSuccess, null, 2))
-    assert.ok(pageUrlsAfterSuccess.every((url) => !url.includes('/settings/')), JSON.stringify(pageUrlsAfterSuccess, null, 2))
-    const pagesOpenedByRun = context.pages().filter((page) => !pagesBeforeRun.has(page))
-    assert.deepEqual(
-      pagesOpenedByRun.map((page) => page.url()),
-      [conversationUrl],
-      'Gemini task execution must open exactly one visible provider page'
-    )
-    const urlsObservedDuringRun = observedUrls
-      .slice(observedUrlCountBeforeRun)
-      .map((entry) => entry.url)
-    assert.ok(
-      urlsObservedDuringRun.every((url) => url === 'about:blank' || url.startsWith('https://gemini.google.com/')),
-      `Gemini task execution opened a non-provider page: ${JSON.stringify(urlsObservedDuringRun, null, 2)}`
-    )
-    assertNoTaskPageObserved(observedUrls)
-    assertNoRunnerPageObserved(observedUrls)
-    assert.equal(
-      observedUrls.some((entry) => entry.url.includes('/settings/')),
-      false,
-      JSON.stringify(observedUrls, null, 2)
-    )
-
-    await fs.writeFile(path.join(artifactDir, 'gemini-cli-daemon-run-payload.json'), `${JSON.stringify(cliPayload, null, 2)}\n`, 'utf8')
-    await fs.writeFile(path.join(artifactDir, 'gemini-observed-urls.json'), `${JSON.stringify(observedUrls, null, 2)}\n`, 'utf8')
-    await fs.writeFile(path.join(artifactDir, 'gemini-summary.json'), `${JSON.stringify({
-      ok: true,
-      mode: 'daemon-fixture-gemini',
-      fixture: true,
-      realProviderDom: true,
-      extensionId,
-      daemonUrl,
-      jobId: completed.job_id,
-      provider: 'gemini',
-      targetUrl,
-      conversationUrl,
-      prompt,
-      taskPageOpened: observedUrls.some((entry) => entry.url.includes('/task/task.html')),
-      runnerPageOpened: observedUrls.some((entry) => entry.url.includes('/daemon/runner.html')),
-      settingsPageOpened: observedUrls.some((entry) => entry.url.includes('/settings/')),
-      observedProviderOnly: urlsObservedDuringRun.every((url) => (
-        url === 'about:blank' || url.startsWith('https://gemini.google.com/')
-      )),
-      events,
-    }, null, 2)}\n`, 'utf8')
-    console.log(`Tokenless Gemini daemon fixture E2E artifacts: ${artifactDir}`)
-  } finally {
-    const cleanupErrors = []
-    await attemptCleanup(cleanupErrors, 'write Gemini observed URL artifacts', async () => {
-      await fs.writeFile(path.join(artifactDir, 'gemini-observed-urls.json'), `${JSON.stringify(observedUrls, null, 2)}\n`, 'utf8')
-    })
-    await attemptCleanup(cleanupErrors, 'close browser context', async () => context?.close())
-    await attemptCleanup(cleanupErrors, 'close provider fixture', async () => providerFixture?.close())
-    const manifestsRestored = await attemptCleanup(
-      cleanupErrors,
-      'restore native host manifests',
-      async () => restoreFiles(manifestBackup)
-    )
-    const registryRestored = await attemptCleanup(
-      cleanupErrors,
-      'restore native host registry',
-      async () => restoreWindowsNativeHostRegistry(registryBackup)
-    )
-    await attemptCleanup(cleanupErrors, 'stop daemon', async () => {
-      if (daemon) await stopDaemon(daemon)
-    })
-    if (manifestsRestored && registryRestored) {
-      await attemptCleanup(cleanupErrors, 'remove temporary Gemini E2E state', async () => {
-        await fs.rm(tempRoot, { recursive: true, force: true })
-      })
-    }
-    if (cleanupErrors.length > 0) {
-      throw new AggregateError(cleanupErrors, 'Tokenless Gemini fixture E2E cleanup failed')
-    }
-  }
-})
-
-test('daemon job completes through extension service worker and Grok real-DOM fixture without internal pages', {
-  skip: process.env.TOKENLESS_E2E !== '1' ? 'set TOKENLESS_E2E=1 to run fixture browser E2E' : false,
-  timeout: 180000,
-}, async () => {
-  const { chromium } = await import('playwright')
-  const {
-    getDaemonJob,
-    installNativeHost,
-    nativeMessagingHostDirs,
-    NATIVE_HOST_NAME,
-    readLiveBridgeMarker,
-  } = await import('../../packages/cli/dist/src/index.js')
-  const { DEFAULT_EXTENSION_ID } = await import('../extension/default-extension-id.mjs')
-
-  const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'tokenless-grok-daemon-e2e-'))
-  const artifactDir = await createArtifactDir()
-  const userDataDir = path.join(tempRoot, 'profile')
-  const tokenlessHome = path.join(tempRoot, 'tokenless-home')
-  const port = await freePort()
-  const daemonUrl = `http://127.0.0.1:${port}`
-  const prompt = 'Tokenless Grok daemon E2E DOM prompt 73184'
-  const targetUrl = 'https://grok.com/'
-  const conversationUrl = 'https://grok.com/c/123e4567-e89b-12d3-a456-426614174003'
-  const events = []
-  const observedUrls = []
-  let manifestBackup = []
-  let registryBackup = []
-  let daemon
-  let context
-  let providerFixture
-
-  try {
-    daemon = startDaemon({ homeDir: tokenlessHome, port })
-    await waitForDaemonReady(daemonUrl, daemon)
-    events.push({ at: new Date().toISOString(), event: 'daemon_ready', daemonUrl })
-
-    const browsers = fixtureNativeHostBrowsers()
-    registryBackup = snapshotWindowsNativeHostRegistry(
-      browsers,
-      NATIVE_HOST_NAME,
-      windowsNativeHostManifestPath(tokenlessHome, NATIVE_HOST_NAME)
-    )
-    manifestBackup = await snapshotFiles(browsers.flatMap((browser) => (
-      nativeMessagingHostDirs(browser, userDataDir).map((dir) => path.join(dir, `${NATIVE_HOST_NAME}.json`))
-    )))
-    const installed = await installNativeHost({
-      homeDir: tokenlessHome,
-      manifestHome: userDataDir,
-      extensionId: DEFAULT_EXTENSION_ID,
-      browsers,
-    })
-    assert.ok(installed.manifests.length >= 1)
-    events.push({
-      at: new Date().toISOString(),
-      event: 'native_host_installed',
-      manifests: installed.manifests,
-      executable: installed.nativeHostExecutable,
-    })
-
-    const grokFixture = await fs.readFile(grokRealDomFixturePath, 'utf8')
-    providerFixture = await startHttpsFixtureServer({
-      body: grokFixture,
-      events,
-      providerHost: 'grok.com',
-    })
-    context = await launchTokenlessContext(
-      chromium,
-      userDataDir,
-      tokenlessHome,
-      daemonUrl,
-      providerFixture,
-      'grok.com'
-    )
-    observeContextUrls(context, observedUrls)
-    const extensionId = await discoverExtensionId(context)
-    assert.equal(extensionId, DEFAULT_EXTENSION_ID)
-
-    await ensureDaemonBridgeStarted(context)
-    const bridgeMarker = await waitForBridgeMarker({ tokenlessHome, readLiveBridgeMarker, context })
-    assert.equal(bridgeMarker.protocol, 'tokenless.extension-bridge-state.v1')
-    events.push({
-      at: new Date().toISOString(),
-      event: 'daemon_bridge_ready',
-      sessionId: bridgeMarker.sessionId,
-    })
-    const pagesBeforeRun = new Set(context.pages())
-    const observedUrlCountBeforeRun = observedUrls.length
-
-    const cliRun = await runProcess(process.execPath, [
-      path.join(root, 'packages/cli/dist/src/tokenless.mjs'),
-      'run',
-      '--prompt',
-      prompt,
-      '--provider',
-      'grok',
-      '--home',
-      tokenlessHome,
-      '--daemon-url',
-      daemonUrl,
-      '--target-url',
-      targetUrl,
-      '--read-delay-ms',
-      '0',
-      '--read-timeout-ms',
-      '10000',
-      '--no-open',
-      '--json',
-    ], { cwd: root })
-
-    assert.equal(cliRun.status, 0, cliRun.stderr || cliRun.stdout)
-    const cliPayload = JSON.parse(cliRun.stdout)
-    assert.equal(cliPayload.transport, 'daemon')
-    assert.equal(cliPayload.provider, 'grok')
-    assert.equal(cliPayload.taskUrl, undefined)
-    assert.equal(cliPayload.runnerUrl, undefined)
-    assert.equal(cliPayload.result?.result?.submit?.provider, 'grok')
-    assert.equal(cliPayload.result?.result?.submit?.url, conversationUrl)
-    assert.equal(cliPayload.result?.result?.read?.provider, 'grok')
-    assert.equal(cliPayload.result?.result?.read?.url, conversationUrl)
-    assert.match(cliPayload.compactOutput, /visible Grok real-DOM fixture answer/)
-    assert.match(cliPayload.compactOutput, /Tokenless Grok daemon E2E DOM prompt 73184/)
-    assert.doesNotMatch(cliRun.stdout, /taskUrl|task\/task\.html|runnerUrl|daemon\/runner\.html/)
-    assert.doesNotMatch(cliRun.stdout, /claim_token|claimToken/)
-
-    const created = await getDaemonJob({
-      daemonUrl,
-      homeDir: tokenlessHome,
-      jobId: cliPayload.jobId,
-    })
-    assert.ok(['queued', 'claimed', 'succeeded'].includes(created.status), JSON.stringify(created, null, 2))
-    assert.equal(created.provider, 'grok')
-    assert.equal(created.claim_token, undefined)
-    assert.equal(created.claimToken, undefined)
-    assert.doesNotMatch(JSON.stringify(created), /claim_token|claimToken/)
-    assert.equal(created.request_json.targetUrl, targetUrl)
-    assert.match(created.request_json.prompt, /Tokenless Grok daemon E2E DOM prompt 73184/)
-    events.push({ at: new Date().toISOString(), event: 'cli_daemon_job_created', jobId: created.job_id })
-
-    const completed = await waitForDaemonJobStatus({
-      daemonUrl,
-      homeDir: tokenlessHome,
-      jobId: created.job_id,
-      statuses: ['succeeded', 'failed'],
-      daemon,
-      getDaemonJob,
-    })
-    await fs.writeFile(
-      path.join(artifactDir, 'grok-daemon-terminal-job.json'),
-      `${JSON.stringify(completed, null, 2)}\n`,
-      'utf8'
-    )
-    assert.equal(completed.status, 'succeeded', JSON.stringify(completed, null, 2))
-    assert.equal(completed.provider, 'grok')
-    assert.equal(completed.claim_token, undefined)
-    assert.equal(completed.claimToken, undefined)
-    assert.doesNotMatch(JSON.stringify(completed), /claim_token|claimToken/)
-    assert.equal(completed.result_json.provider, 'grok')
-    assert.equal(completed.result_json.submit.provider, 'grok')
-    assert.equal(completed.result_json.submit.url, conversationUrl)
-    assert.equal(completed.result_json.read.provider, 'grok')
-    assert.equal(completed.result_json.read.url, conversationUrl)
-    assert.match(completed.result_json.text, /visible Grok real-DOM fixture answer/)
-    assert.match(completed.result_json.text, /Tokenless Grok daemon E2E DOM prompt 73184/)
-    assert.doesNotMatch(completed.result_json.text, /stale Grok real-DOM fixture answer/)
-
-    const providerPage = context.pages().find((page) => page.url().startsWith('https://grok.com/'))
-    assert.ok(providerPage, `extension did not open the visible Grok page: ${JSON.stringify(context.pages().map((page) => page.url()))}`)
-    assert.equal(providerPage.url(), conversationUrl)
-    await providerPage.bringToFront()
-    await providerPage.screenshot({
-      path: path.join(artifactDir, '01-grok-fixture-after-daemon.png'),
-      animations: 'disabled',
-    })
-    const userMessage = providerPage.locator('[data-testid="user-message"]').last()
-    assert.match(await userMessage.innerText(), /Tokenless Grok daemon E2E DOM prompt 73184/)
-    const assistantMessage = providerPage.locator('[data-testid="assistant-message"]').last()
-    assert.match(await assistantMessage.innerText(), /visible Grok real-DOM fixture answer/)
-    assert.match(await assistantMessage.innerText(), /Tokenless Grok daemon E2E DOM prompt 73184/)
-
-    const pageUrlsAfterSuccess = context.pages().map((page) => page.url())
-    assert.ok(pageUrlsAfterSuccess.every((url) => !url.includes('/task/task.html')), JSON.stringify(pageUrlsAfterSuccess, null, 2))
-    assert.ok(pageUrlsAfterSuccess.every((url) => !url.includes('/daemon/runner.html')), JSON.stringify(pageUrlsAfterSuccess, null, 2))
-    assert.ok(pageUrlsAfterSuccess.every((url) => !url.includes('/settings/')), JSON.stringify(pageUrlsAfterSuccess, null, 2))
-    const pagesOpenedByRun = context.pages().filter((page) => !pagesBeforeRun.has(page))
-    assert.deepEqual(
-      pagesOpenedByRun.map((page) => page.url()),
-      [conversationUrl],
-      'Grok task execution must open exactly one visible provider page'
-    )
-    const urlsObservedDuringRun = observedUrls
-      .slice(observedUrlCountBeforeRun)
-      .map((entry) => entry.url)
-    assert.ok(
-      urlsObservedDuringRun.every((url) => url === 'about:blank' || url.startsWith('https://grok.com/')),
-      `Grok task execution opened a non-provider page: ${JSON.stringify(urlsObservedDuringRun, null, 2)}`
-    )
-    assertNoTaskPageObserved(observedUrls)
-    assertNoRunnerPageObserved(observedUrls)
-    assert.equal(
-      observedUrls.some((entry) => entry.url.includes('/settings/')),
-      false,
-      JSON.stringify(observedUrls, null, 2)
-    )
-
-    await fs.writeFile(path.join(artifactDir, 'grok-cli-daemon-run-payload.json'), `${JSON.stringify(cliPayload, null, 2)}\n`, 'utf8')
-    await fs.writeFile(path.join(artifactDir, 'grok-observed-urls.json'), `${JSON.stringify(observedUrls, null, 2)}\n`, 'utf8')
-    await fs.writeFile(path.join(artifactDir, 'grok-summary.json'), `${JSON.stringify({
-      ok: true,
-      mode: 'daemon-fixture-grok',
-      fixture: true,
-      realProviderDom: true,
-      extensionId,
-      daemonUrl,
-      jobId: completed.job_id,
-      provider: 'grok',
-      targetUrl,
-      conversationUrl,
-      prompt,
-      taskPageOpened: observedUrls.some((entry) => entry.url.includes('/task/task.html')),
-      runnerPageOpened: observedUrls.some((entry) => entry.url.includes('/daemon/runner.html')),
-      settingsPageOpened: observedUrls.some((entry) => entry.url.includes('/settings/')),
-      observedProviderOnly: urlsObservedDuringRun.every((url) => (
-        url === 'about:blank' || url.startsWith('https://grok.com/')
-      )),
-      events,
-    }, null, 2)}\n`, 'utf8')
-    console.log(`Tokenless Grok daemon fixture E2E artifacts: ${artifactDir}`)
-  } finally {
-    const cleanupErrors = []
-    await attemptCleanup(cleanupErrors, 'write Grok observed URL artifacts', async () => {
-      await fs.writeFile(path.join(artifactDir, 'grok-observed-urls.json'), `${JSON.stringify(observedUrls, null, 2)}\n`, 'utf8')
-    })
-    await attemptCleanup(cleanupErrors, 'close browser context', async () => context?.close())
-    await attemptCleanup(cleanupErrors, 'close provider fixture', async () => providerFixture?.close())
-    const manifestsRestored = await attemptCleanup(
-      cleanupErrors,
-      'restore native host manifests',
-      async () => restoreFiles(manifestBackup)
-    )
-    const registryRestored = await attemptCleanup(
-      cleanupErrors,
-      'restore native host registry',
-      async () => restoreWindowsNativeHostRegistry(registryBackup)
-    )
-    await attemptCleanup(cleanupErrors, 'stop daemon', async () => {
-      if (daemon) await stopDaemon(daemon)
-    })
-    if (manifestsRestored && registryRestored) {
-      await attemptCleanup(cleanupErrors, 'remove temporary Grok E2E state', async () => {
-        await fs.rm(tempRoot, { recursive: true, force: true })
-      })
-    }
-    if (cleanupErrors.length > 0) {
-      throw new AggregateError(cleanupErrors, 'Tokenless Grok fixture E2E cleanup failed')
-    }
-  }
-})
-
-test('an already-open browser extension reconnects after setup installs its native host', {
-  skip: process.env.TOKENLESS_E2E !== '1' ? 'set TOKENLESS_E2E=1 to run fixture browser E2E' : false,
-  timeout: 90000,
-}, async () => {
-  const { chromium } = await import('playwright')
-  const {
-    installNativeHost,
-    nativeMessagingHostDirs,
-    NATIVE_HOST_NAME,
-    readLiveBridgeMarker,
-  } = await import('../../packages/cli/dist/src/index.js')
-  const { DEFAULT_EXTENSION_ID } = await import('../extension/default-extension-id.mjs')
-
-  const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'tokenless-setup-reconnect-e2e-'))
-  const userDataDir = path.join(tempRoot, 'profile')
-  const tokenlessHome = path.join(tempRoot, 'tokenless-home')
-  const events = []
-  let context
-  let providerFixture
-  let manifestBackup = []
-  let registryBackup = []
-
-  try {
-    const chatGptFixture = await fs.readFile(chatGptRealDomFixturePath, 'utf8')
-    providerFixture = await startHttpsFixtureServer({
-      body: chatGptFixture,
-      events,
-      providerHost: 'chatgpt.com',
-    })
-    context = await launchTokenlessContext(
-      chromium,
-      userDataDir,
-      tokenlessHome,
-      'http://127.0.0.1:7331',
-      providerFixture,
-      'chatgpt.com'
-    )
-    const extensionId = await discoverExtensionId(context)
-    assert.equal(extensionId, DEFAULT_EXTENSION_ID)
-
-    await ensureDaemonBridgeStarted(context)
-    await delay(500)
-    assert.equal(await readLiveBridgeMarker({ homeDir: tokenlessHome }), null)
-
-    const browsers = fixtureNativeHostBrowsers()
-    registryBackup = snapshotWindowsNativeHostRegistry(
-      browsers,
-      NATIVE_HOST_NAME,
-      windowsNativeHostManifestPath(tokenlessHome, NATIVE_HOST_NAME)
-    )
-    manifestBackup = await snapshotFiles(browsers.flatMap((browser) => (
-      nativeMessagingHostDirs(browser, userDataDir).map((dir) => path.join(dir, `${NATIVE_HOST_NAME}.json`))
-    )))
-    await installNativeHost({
-      homeDir: tokenlessHome,
-      manifestHome: userDataDir,
-      extensionId,
-      browsers,
-    })
-
-    const providerPage = await context.newPage()
-    await providerPage.goto('https://chatgpt.com/')
-    await ensureDaemonBridgeStarted(context)
-    const marker = await waitForBridgeMarker({ tokenlessHome, readLiveBridgeMarker, context })
-    assert.equal(marker.protocol, 'tokenless.extension-bridge-state.v1')
-    assert.ok(marker.pid > 0)
-  } finally {
-    const cleanupErrors = []
-    await attemptCleanup(cleanupErrors, 'close browser context', async () => context?.close())
-    await attemptCleanup(cleanupErrors, 'close provider fixture', async () => providerFixture?.close())
-    const manifestsRestored = await attemptCleanup(
-      cleanupErrors,
-      'restore native host manifests',
-      async () => restoreFiles(manifestBackup)
-    )
-    const registryRestored = await attemptCleanup(
-      cleanupErrors,
-      'restore native host registry',
-      async () => restoreWindowsNativeHostRegistry(registryBackup)
-    )
-    if (manifestsRestored && registryRestored) {
-      await attemptCleanup(cleanupErrors, 'remove temporary setup reconnect state', async () => {
-        await fs.rm(tempRoot, { recursive: true, force: true })
-      })
-    }
-    if (cleanupErrors.length > 0) {
-      throw new AggregateError(cleanupErrors, 'Tokenless setup reconnect E2E cleanup failed')
-    }
-  }
-})
-
-test('Windows native host registry restore planning preserves concurrent state', () => {
-  const installedDefaultValue = {
-    exists: true,
-    type: 'REG_SZ',
-    data: 'C:\\tokenless-test\\dev.tokenless.native_host.json',
-  }
-  const currentTestValue = {
-    keyExisted: true,
-    defaultValue: installedDefaultValue,
-  }
-  const previousDefaultValue = {
-    exists: true,
-    type: 'REG_EXPAND_SZ',
-    data: '%USERPROFILE%\\existing-native-host.json',
-  }
-
-  assert.deepEqual(windowsNativeHostRegistryRestorePlan({
-    keyExisted: true,
-    defaultValue: previousDefaultValue,
-    installedDefaultValue,
-  }, currentTestValue), {
-    action: 'restore_default',
-    deleteKeyIfEmpty: false,
-    value: previousDefaultValue,
-  })
-  assert.deepEqual(windowsNativeHostRegistryRestorePlan({
-    keyExisted: true,
-    defaultValue: missingWindowsRegistryDefaultValue(),
-    installedDefaultValue,
-  }, currentTestValue), {
-    action: 'delete_default',
-    deleteKeyIfEmpty: false,
-  })
-  assert.deepEqual(windowsNativeHostRegistryRestorePlan({
-    keyExisted: false,
-    defaultValue: missingWindowsRegistryDefaultValue(),
-    installedDefaultValue,
-  }, currentTestValue), {
-    action: 'delete_default',
-    deleteKeyIfEmpty: true,
-  })
-  assert.deepEqual(windowsNativeHostRegistryRestorePlan({
-    keyExisted: false,
-    defaultValue: missingWindowsRegistryDefaultValue(),
-    installedDefaultValue,
-  }, {
-    keyExisted: true,
-    defaultValue: { ...installedDefaultValue, data: 'C:\\another-process\\manifest.json' },
-  }), {
-    action: 'none',
-    deleteKeyIfEmpty: false,
-  })
-})
-
-test('Windows native host registry parsing retains type/data and validates structured state', () => {
-  const key = 'HKEY_CURRENT_USER\\Software\\TokenlessRegistryTest'
-  assert.deepEqual(parseWindowsRegistryDefaultValue([
-    key,
-    '    (Default)    REG_EXPAND_SZ    %USERPROFILE%\\existing native host.json',
-  ].join('\r\n'), key), {
-    exists: true,
-    type: 'REG_EXPAND_SZ',
-    data: '%USERPROFILE%\\existing native host.json',
-  })
-  assert.deepEqual(parseWindowsRegistryState(
-    '{"keyExisted":true,"defaultValueExisted":false,"keyIsEmpty":true}',
-    key
-  ), {
-    keyExisted: true,
-    defaultValueExisted: false,
-    keyIsEmpty: true,
-  })
-  assert.throws(
-    () => parseWindowsRegistryState(
-      '{"keyExisted":true,"defaultValueExisted":true,"keyIsEmpty":true}',
-      key
-    ),
-    /invalid state/
-  )
-})
-
-function observeContextUrls(context, observedUrls) {
-  const record = (event, url) => {
-    observedUrls.push({ at: new Date().toISOString(), event, url })
-  }
-  for (const page of context.pages()) {
-    record('existing_page', page.url())
-    page.on('framenavigated', (frame) => {
-      if (frame === page.mainFrame()) {
-        record('navigation', frame.url())
-      }
-    })
-  }
-  context.on('page', (page) => {
-    record('page', page.url())
-    page.on('framenavigated', (frame) => {
-      if (frame === page.mainFrame()) {
-        record('navigation', frame.url())
-      }
-    })
-  })
-}
-
-function assertNoTaskPageObserved(observedUrls) {
-  assert.ok(
-    observedUrls.every((entry) => !entry.url.includes('/task/task.html')),
-    JSON.stringify(observedUrls, null, 2)
-  )
-}
-
-function assertNoRunnerPageObserved(observedUrls) {
-  assert.ok(
-    observedUrls.every((entry) => !entry.url.includes('/daemon/runner.html')),
-    JSON.stringify(observedUrls, null, 2)
-  )
-}
-
-async function createArtifactDir() {
-  const stamp = new Date().toISOString().replace(/[:.]/g, '-')
-  const artifactDir = path.join(testResultsRoot, `${stamp}-${process.pid}-daemon`)
-  await fs.mkdir(artifactDir, { recursive: true })
-  return artifactDir
-}
-
-async function runProcess(command, args, options = {}) {
-  return new Promise((resolve, reject) => {
-    const child = spawn(command, args, {
-      ...options,
-      stdio: ['ignore', 'pipe', 'pipe'],
-    })
-    let stdout = ''
-    let stderr = ''
-    child.stdout.on('data', (chunk) => { stdout += chunk.toString('utf8') })
-    child.stderr.on('data', (chunk) => { stderr += chunk.toString('utf8') })
-    child.once('error', reject)
-    child.once('close', (status) => resolve({ status, stdout, stderr }))
-  })
-}
-
-async function launchTokenlessContext(
-  chromium,
-  userDataDir,
-  tokenlessHome,
-  daemonUrl,
-  providerFixture,
-  providerHost
-) {
-  const headed = process.env.TOKENLESS_E2E_HEADED === '1'
-  const options = {
-    headless: !headed,
-    env: {
-      ...process.env,
-      TOKENLESS_HOME: tokenlessHome,
-      TOKENLESS_DAEMON_URL: daemonUrl,
-    },
-    args: [
-      `--disable-extensions-except=${extensionPath}`,
-      `--load-extension=${extensionPath}`,
-      `--host-resolver-rules=MAP ${providerHost}:443 127.0.0.1:${providerFixture.port},EXCLUDE localhost`,
-      `--ignore-certificate-errors-spki-list=${providerFixture.spkiSha256}`,
-      '--disable-quic',
-      '--no-first-run',
-      '--no-default-browser-check',
-    ],
-  }
-  if (process.env.TOKENLESS_E2E_CHANNEL) {
-    options.channel = process.env.TOKENLESS_E2E_CHANNEL
-  } else if (!headed) {
-    // Playwright's `chromium` channel opts into new headless mode, which is the
-    // bundled full browser required for Manifest V3 extension service workers.
-    options.channel = 'chromium'
-  }
-  return chromium.launchPersistentContext(userDataDir, options)
-}
-
-async function startHttpsFixtureServer({ body, events, providerHost }) {
-  const { generate } = await import('selfsigned')
-  const notBeforeDate = new Date()
-  const notAfterDate = new Date(notBeforeDate.getTime() + 24 * 60 * 60 * 1000)
-  const certificate = await generate([{ name: 'commonName', value: providerHost }], {
-    algorithm: 'sha256',
-    keySize: 2048,
-    notBeforeDate,
-    notAfterDate,
-    extensions: [
-      { name: 'basicConstraints', cA: false, critical: true },
-      { name: 'keyUsage', digitalSignature: true, keyEncipherment: true, critical: true },
-      { name: 'extKeyUsage', serverAuth: true },
-      { name: 'subjectAltName', altNames: [{ type: 2, value: providerHost }] },
-    ],
-  })
-  const publicKeyDer = createPublicKey(certificate.public).export({ type: 'spki', format: 'der' })
-  const spkiSha256 = createHash('sha256').update(publicKeyDer).digest('base64')
-
-  const server = https.createServer({ key: certificate.private, cert: certificate.cert }, (request, response) => {
-    const host = request.headers.host?.toLowerCase() ?? null
-    events.push({
-      at: new Date().toISOString(),
-      event: 'provider_fixture_request_served',
-      host,
-      method: request.method ?? null,
-      path: request.url ?? null,
-    })
-    if (host !== providerHost && host !== `${providerHost}:443`) {
-      response.writeHead(421, { 'content-type': 'text/plain; charset=utf-8' })
-      response.end('Misdirected Request')
-      return
-    }
-    if (request.url === '/favicon.ico') {
-      response.writeHead(204, { 'cache-control': 'no-store' })
-      response.end()
-      return
-    }
-    response.writeHead(200, {
-      'cache-control': 'no-store',
-      'content-type': 'text/html; charset=utf-8',
-      'x-content-type-options': 'nosniff',
-    })
-    response.end(body)
-  })
-  await new Promise((resolve, reject) => {
-    server.once('error', reject)
-    server.listen(0, '127.0.0.1', resolve)
-  })
-  const address = server.address()
-  assert.ok(address && typeof address !== 'string')
-
-  return {
-    port: address.port,
-    spkiSha256,
-    async close() {
-      server.closeAllConnections?.()
-      await new Promise((resolve) => server.close(resolve))
-    },
-  }
-}
-
-async function attemptCleanup(errors, label, action) {
-  try {
-    await action()
-    return true
-  } catch (error) {
-    errors.push(new Error(`${label}: ${error instanceof Error ? error.message : String(error)}`, {
-      cause: error,
-    }))
-    return false
-  }
-}
-
-async function waitForBridgeMarker({ tokenlessHome, readLiveBridgeMarker, context }) {
-  const deadline = Date.now() + 15000
-  let lastRawMarker = null
-  while (Date.now() < deadline) {
-    const marker = await readLiveBridgeMarker({ homeDir: tokenlessHome })
-    if (marker) return marker
-    lastRawMarker = await fs.readFile(path.join(tokenlessHome, 'extension-bridge.json'), 'utf8').catch(() => null)
-    await delay(100)
-  }
-  const workers = context.serviceWorkers()
-  const nativeDiagnostic = workers[0]
-    ? await workers[0].evaluate((hostName) => new Promise((resolve) => {
-        const port = chrome.runtime.connectNative(hostName)
-        const timeout = setTimeout(() => {
-          port.disconnect()
-          resolve({ status: 'timeout' })
-        }, 2000)
-        port.onMessage.addListener((message) => {
-          clearTimeout(timeout)
-          port.disconnect()
-          resolve({ status: 'message', message })
-        })
-        port.onDisconnect.addListener(() => {
-          clearTimeout(timeout)
-          resolve({ status: 'disconnected', error: chrome.runtime.lastError?.message ?? null })
-        })
-        port.postMessage({
-          protocol: 'tokenless.native.v1',
-          type: 'tokenless.native.daemon_connect',
-        })
-      }), 'dev.tokenless.native_host')
-    : null
-  throw new Error(
-    `Rust extension bridge did not become live; service workers: ${JSON.stringify(workers.map((worker) => worker.url()))}; last raw marker: ${lastRawMarker}; native diagnostic: ${JSON.stringify(nativeDiagnostic)}`
-  )
-}
-
-async function ensureDaemonBridgeStarted(context) {
-  await getServiceWorker(context)
-}
-
-async function getServiceWorker(context) {
-  let [worker] = context.serviceWorkers()
-  if (!worker) {
-    worker = await context.waitForEvent('serviceworker', { timeout: 10000 })
-  }
-  return worker
-}
-
-async function discoverExtensionId(context) {
-  let [worker] = context.serviceWorkers()
-  if (!worker) {
-    worker = await context.waitForEvent('serviceworker', { timeout: 10000 })
-  }
-  const url = new URL(worker.url())
-  assert.equal(url.protocol, 'chrome-extension:')
-  return url.hostname
-}
-
-function fixtureNativeHostBrowsers() {
-  return process.platform === 'win32' ? ['chrome-for-testing'] : ['profile']
-}
-
-function windowsNativeHostManifestPath(homeDir, hostName) {
-  return path.join(homeDir, 'native-messaging', `${hostName}.json`)
-}
-
-function snapshotWindowsNativeHostRegistry(browsers, hostName, installedManifestPath) {
-  if (process.platform !== 'win32') return []
-  const installedDefaultValue = {
-    exists: true,
-    type: 'REG_SZ',
-    data: installedManifestPath,
-  }
-  return windowsNativeHostRegistryKeys(browsers, hostName).map((key) => {
-    const previous = inspectWindowsNativeHostRegistryKey(key)
-    return {
-      key,
-      keyExisted: previous.keyExisted,
-      defaultValue: previous.defaultValue,
-      installedDefaultValue,
-    }
-  })
-}
-
-function restoreWindowsNativeHostRegistry(entries) {
-  if (process.platform !== 'win32') return
-  for (const entry of [...entries].reverse()) {
-    const current = inspectWindowsNativeHostRegistryKey(entry.key)
-    const plan = windowsNativeHostRegistryRestorePlan(entry, current)
-    if (plan.action === 'none') continue
-    if (plan.action === 'restore_default') {
-      setWindowsNativeHostRegistryDefault(entry.key, plan.value)
-      continue
-    }
-    deleteWindowsNativeHostRegistryDefault(entry.key)
-    if (!plan.deleteKeyIfEmpty) continue
-    const withoutTestDefault = inspectWindowsNativeHostRegistryKey(entry.key)
-    if (withoutTestDefault.keyExisted && withoutTestDefault.keyIsEmpty) {
-      deleteEmptyWindowsNativeHostRegistryKey(entry.key)
-    }
-  }
-}
-
-function inspectWindowsNativeHostRegistryKey(key) {
-  const state = inspectWindowsNativeHostRegistryState(key)
-  if (!state.keyExisted) {
-    return {
-      keyExisted: false,
-      defaultValue: missingWindowsRegistryDefaultValue(),
-      keyIsEmpty: false,
-    }
-  }
-  if (!state.defaultValueExisted) {
-    return {
-      keyExisted: true,
-      defaultValue: missingWindowsRegistryDefaultValue(),
-      keyIsEmpty: state.keyIsEmpty,
-    }
-  }
-  const defaultQuery = spawnWindowsRegistry(['QUERY', key, '/ve'])
-  assertWindowsRegistryCommandSucceeded(defaultQuery, `inspect native host registry default value ${key}`)
-  return {
-    keyExisted: true,
-    defaultValue: parseWindowsRegistryDefaultValue(defaultQuery.stdout, key),
-    keyIsEmpty: state.keyIsEmpty,
-  }
-}
-
-function inspectWindowsNativeHostRegistryState(key) {
-  const inspected = spawnSync('powershell.exe', [
-    '-NoLogo',
-    '-NoProfile',
-    '-NonInteractive',
-    '-Command',
-    [
-      "$ErrorActionPreference = 'Stop'",
-      '$fullPath = $env:TOKENLESS_TEST_REGISTRY_KEY',
-      "$prefix = 'HKCU\\'",
-      "if (-not $fullPath.StartsWith($prefix, [StringComparison]::OrdinalIgnoreCase)) { throw 'Expected an HKCU registry key.' }",
-      '$relativePath = $fullPath.Substring($prefix.Length)',
-      '$registryKey = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey($relativePath, $false)',
-      'if ($null -eq $registryKey) {',
-      "  [Console]::Out.Write('{\"keyExisted\":false,\"defaultValueExisted\":false,\"keyIsEmpty\":false}')",
-      '  exit 0',
-      '}',
-      'try {',
-      '  $valueNames = @($registryKey.GetValueNames())',
-      '  $subkeyNames = @($registryKey.GetSubKeyNames())',
-      '  $result = [ordered]@{',
-      '    keyExisted = $true',
-      "    defaultValueExisted = ($valueNames -contains '')",
-      '    keyIsEmpty = ($valueNames.Count -eq 0 -and $subkeyNames.Count -eq 0)',
-      '  }',
-      '  [Console]::Out.Write(($result | ConvertTo-Json -Compress))',
-      '} finally {',
-      '  $registryKey.Dispose()',
-      '}',
-    ].join('\n'),
-  ], {
-    encoding: 'utf8',
-    windowsHide: true,
-    env: {
-      ...process.env,
-      TOKENLESS_TEST_REGISTRY_KEY: key,
-    },
-  })
-  assertWindowsRegistryCommandSucceeded(inspected, `inspect native host registry state ${key}`)
-  return parseWindowsRegistryState(inspected.stdout, key)
-}
-
-function windowsNativeHostRegistryRestorePlan(entry, current) {
-  if (
-    !current.keyExisted ||
-    !sameWindowsRegistryDefaultValue(current.defaultValue, entry.installedDefaultValue)
-  ) {
-    return { action: 'none', deleteKeyIfEmpty: false }
-  }
-  if (entry.defaultValue.exists) {
-    return {
-      action: 'restore_default',
-      deleteKeyIfEmpty: false,
-      value: entry.defaultValue,
-    }
-  }
-  return {
-    action: 'delete_default',
-    deleteKeyIfEmpty: !entry.keyExisted,
-  }
-}
-
-function setWindowsNativeHostRegistryDefault(key, value) {
-  const restored = spawnWindowsRegistry([
-    'ADD',
-    key,
-    '/ve',
-    '/t',
-    value.type,
-    '/d',
-    value.data,
-    '/f',
-  ])
-  assertWindowsRegistryCommandSucceeded(restored, `restore native host registry default value ${key}`)
-}
-
-function deleteWindowsNativeHostRegistryDefault(key) {
-  const deleted = spawnWindowsRegistry(['DELETE', key, '/ve', '/f'])
-  if (deleted.status === 0) return
-  const current = inspectWindowsNativeHostRegistryKey(key)
-  if (!current.keyExisted || !current.defaultValue.exists) return
-  assertWindowsRegistryCommandSucceeded(deleted, `delete test native host registry default value ${key}`)
-}
-
-function deleteEmptyWindowsNativeHostRegistryKey(key) {
-  const current = inspectWindowsNativeHostRegistryKey(key)
-  if (!current.keyExisted || !current.keyIsEmpty) return
-  const deleted = spawnWindowsRegistry(['DELETE', key, '/f'])
-  if (deleted.status === 0) return
-  const afterDelete = inspectWindowsNativeHostRegistryKey(key)
-  if (!afterDelete.keyExisted) return
-  assertWindowsRegistryCommandSucceeded(deleted, `delete empty test-created native host registry key ${key}`)
-}
-
-function spawnWindowsRegistry(args) {
-  return spawnSync('reg.exe', args, { encoding: 'utf8' })
-}
-
-function assertWindowsRegistryCommandSucceeded(result, action) {
-  if (result.error) {
-    throw new Error(`Could not ${action}: ${result.error.message}`, { cause: result.error })
-  }
-  if (result.status !== 0) {
-    throw new Error(`Could not ${action}: ${result.stderr || result.stdout || `exit ${result.status}`}`)
-  }
-}
-
-function missingWindowsRegistryDefaultValue() {
-  return { exists: false, type: null, data: null }
-}
-
-function parseWindowsRegistryDefaultValue(output, key) {
-  for (const line of output.split(/\r?\n/)) {
-    const match = line.match(/\s(REG_[A-Z0-9_]+)(?:\s+(.*))?$/i)
-    if (!match) continue
-    return {
-      exists: true,
-      type: match[1].toUpperCase(),
-      data: (match[2] ?? '').trimEnd(),
-    }
-  }
-  throw new Error(`Native host registry key ${key} returned an unparseable default value.`)
-}
-
-function parseWindowsRegistryState(output, key) {
-  let state
-  try {
-    state = JSON.parse(output)
-  } catch (error) {
-    throw new Error(`Native host registry key ${key} returned an unparseable state.`, { cause: error })
-  }
-  if (
-    typeof state?.keyExisted !== 'boolean' ||
-    typeof state?.defaultValueExisted !== 'boolean' ||
-    typeof state?.keyIsEmpty !== 'boolean' ||
-    (!state.keyExisted && (state.defaultValueExisted || state.keyIsEmpty)) ||
-    (state.defaultValueExisted && state.keyIsEmpty)
-  ) {
-    throw new Error(`Native host registry key ${key} returned an invalid state.`)
-  }
-  return state
-}
-
-function sameWindowsRegistryDefaultValue(left, right) {
-  return Boolean(
-    left?.exists &&
-    right?.exists &&
-    left.type === right.type &&
-    left.data === right.data
-  )
-}
-
-function windowsNativeHostRegistryKeys(browsers, hostName) {
-  const roots = {
-    chrome: 'HKCU\\Software\\Google\\Chrome\\NativeMessagingHosts',
-    'chrome-for-testing': 'HKCU\\Software\\Google\\Chrome\\NativeMessagingHosts',
-    chromium: 'HKCU\\Software\\Chromium\\NativeMessagingHosts',
-    edge: 'HKCU\\Software\\Microsoft\\Edge\\NativeMessagingHosts',
-    brave: 'HKCU\\Software\\BraveSoftware\\Brave-Browser\\NativeMessagingHosts',
-    arc: 'HKCU\\Software\\The Browser Company\\Arc\\NativeMessagingHosts',
-  }
-  return [...new Set(browsers
-    .map((browser) => roots[browser])
-    .filter(Boolean)
-    .map((root) => `${root}\\${hostName}`))]
-}
-
-async function snapshotFiles(files) {
-  return Promise.all(files.map(async (file) => {
-    const previous = await fs.readFile(file, 'utf8').catch((error) => {
-      if (error.code === 'ENOENT') return null
-      throw error
-    })
-    return { file, previous }
-  }))
-}
-
-async function restoreFiles(entries) {
-  for (const entry of entries.reverse()) {
-    if (entry.previous === null) {
-      await fs.rm(entry.file, { force: true })
-    } else {
-      await fs.writeFile(entry.file, entry.previous)
-    }
-  }
-}
-
-function startDaemon({ homeDir, port }) {
-  const child = spawn('cargo', [
-    'run',
-    '--quiet',
-    '--manifest-path',
-    path.join(root, 'packages/daemon/Cargo.toml'),
-    '--bin',
-    'tokenless-daemon',
-    '--',
-    '--home',
-    homeDir,
-    'serve',
-    '--host',
-    '127.0.0.1',
-    '--port',
-    String(port),
-  ], {
-    cwd: root,
-    detached: process.platform !== 'win32',
-    env: { ...process.env, TOKENLESS_HOME: homeDir },
-    stdio: ['ignore', 'pipe', 'pipe'],
-  })
-  child.stdoutText = ''
-  child.stderrText = ''
-  child.stdout.on('data', (chunk) => {
-    child.stdoutText += chunk.toString('utf8')
-  })
-  child.stderr.on('data', (chunk) => {
-    child.stderrText += chunk.toString('utf8')
-  })
-  return child
-}
-
-async function stopDaemon(child) {
-  if (child.exitCode !== null || child.signalCode !== null) return
-  if (process.platform !== 'win32' && child.pid) {
-    try {
-      process.kill(-child.pid, 'SIGTERM')
-    } catch {
-      child.kill('SIGTERM')
-    }
-  } else {
-    child.kill('SIGTERM')
-  }
-  await new Promise((resolve) => {
-    const timeout = setTimeout(resolve, 3000)
-    child.once('exit', () => {
-      clearTimeout(timeout)
-      resolve()
-    })
-  })
-}
-
-async function waitForDaemonReady(daemonUrl, child) {
-  const started = Date.now()
-  let lastError
-  while (Date.now() - started < 120000) {
-    if (child.exitCode !== null) {
-      throw new Error(`daemon exited with ${child.exitCode}: ${child.stderrText}`)
-    }
-    try {
-      const response = await fetch(`${daemonUrl}/health`)
-      if (response.ok) return
-      lastError = new Error(`ready returned ${response.status}`)
-    } catch (error) {
-      lastError = error
-    }
-    await delay(250)
-  }
-  throw new Error(`daemon did not become ready: ${lastError?.message || 'timeout'}\n${child.stderrText}`)
-}
-
-async function waitForDaemonJobStatus({ daemonUrl, homeDir, jobId, statuses, daemon: child, getDaemonJob }) {
-  const started = Date.now()
-  const expected = new Set(statuses)
-  let lastJob
-  let lastError
-  while (Date.now() - started < 120000) {
-    if (child.exitCode !== null) {
-      throw new Error(`daemon exited with ${child.exitCode}: ${child.stderrText}`)
-    }
-    try {
-      lastJob = await getDaemonJob({ daemonUrl, homeDir, jobId })
-      if (expected.has(lastJob.status)) return lastJob
-    } catch (error) {
-      lastError = error
-    }
-    await delay(250)
-  }
-  throw new Error(`daemon job ${jobId} did not reach ${statuses.join(', ')}; last=${JSON.stringify(lastJob)} error=${lastError?.message || 'timeout'}\n${child.stderrText}`)
-}
-
-async function waitForPathAbsent(targetPath, timeoutMs = 5000) {
-  const deadline = Date.now() + timeoutMs
-  while (Date.now() < deadline) {
-    if (!await pathExists(targetPath)) return
-    await delay(50)
-  }
-}
-
-async function pathExists(targetPath) {
-  try {
-    await fs.stat(targetPath)
-    return true
-  } catch (error) {
-    if (error.code === 'ENOENT') return false
-    throw error
-  }
-}
-
-function assertNoPrivateAttachmentPaths(value, privatePaths) {
-  const normalizedValue = value
-    .replaceAll('\\\\', '/')
-    .replaceAll('\\', '/')
-    .toLowerCase()
-  for (const privatePath of privatePaths) {
-    const normalizedPath = privatePath.replaceAll('\\', '/').toLowerCase()
-    assert.equal(
-      normalizedValue.includes(normalizedPath),
-      false,
-      `private attachment path crossed the visible bridge: ${privatePath}`
-    )
-  }
-}
-
-function freePort() {
-  return new Promise((resolve, reject) => {
-    const server = net.createServer()
-    server.listen(0, '127.0.0.1', () => {
-      const address = server.address()
-      server.close(() => {
-        if (!address || typeof address === 'string') {
-          reject(new Error('failed to allocate a loopback port'))
-          return
-        }
-        resolve(address.port)
-      })
-    })
-    server.on('error', reject)
-  })
-}
-
-function delay(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms))
-}
diff --git a/legacy/test/extension-contract.test.mjs b/legacy/test/extension-contract.test.mjs
deleted file mode 100644
index 4080678..0000000
--- a/legacy/test/extension-contract.test.mjs
+++ /dev/null
@@ -1,3794 +0,0 @@
-import assert from 'node:assert/strict'
-import fs from 'node:fs'
-import http from 'node:http'
-import path from 'node:path'
-import test from 'node:test'
-import { fileURLToPath, pathToFileURL } from 'node:url'
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-const extensionSource = path.join(root, 'legacy/extension/extension')
-const extensionDist = path.join(root, 'legacy/extension/dist/extension')
-
-test('primary manifest owns trusted debugger clicks without broad browser permissions', () => {
-  const manifest = readJson('legacy/extension/extension/manifest.json')
-
-  assert.equal(manifest.manifest_version, 3)
-  assert.equal(manifest.version, '0.1.5')
-  assert.equal(manifest.name, 'Tokenless')
-  assert.equal(manifest.options_ui, undefined)
-  assert.equal(manifest.action.default_title, 'Open Tokenless settings')
-  assert.deepEqual(manifest.side_panel, { default_path: 'settings/index.html' })
-  assert.equal(manifest.externally_connectable, undefined)
-  assert.equal(manifest.content_scripts.length, 1)
-  assert.ok(manifest.permissions.includes('nativeMessaging'))
-  assert.ok(manifest.permissions.includes('sidePanel'))
-  assert.ok(manifest.permissions.includes('debugger'))
-  assert.ok(!manifest.permissions.includes('cookies'))
-  assert.ok(!manifest.permissions.includes('history'))
-  assert.ok(!manifest.permissions.includes('webRequest'))
-  assert.ok(!manifest.permissions.includes('webRequestBlocking'))
-  assert.deepEqual(manifest.content_scripts[0].matches, manifest.host_permissions)
-  assert.ok(manifest.host_permissions.every((pattern) => pattern.startsWith('https://')))
-  assert.ok(manifest.host_permissions.includes('https://grok.com/*'))
-  assert.deepEqual(manifest.host_permissions, [
-    'https://chatgpt.com/*',
-    'https://chat.openai.com/*',
-    'https://gemini.google.com/*',
-    'https://claude.ai/*',
-    'https://grok.com/*',
-  ])
-})
-
-test('extension build and package contain Settings and no debugger companion artifact', () => {
-  const sourceArtifacts = listRelativeFiles(extensionSource)
-  const builtArtifacts = listRelativeFiles(extensionDist)
-  const buildManifest = readJson('legacy/extension/dist/extension-build-manifest.json')
-  const extensionPackage = readJson('legacy/extension/package.json')
-  const recordedArtifacts = buildManifest.files.map((entry) => entry.path)
-
-  for (const artifacts of [sourceArtifacts, builtArtifacts, recordedArtifacts]) {
-    assert.ok(artifacts.some((file) => file === 'settings/index.html'))
-    assert.ok(artifacts.some((file) => file === 'settings/index.ts' || file === 'settings/index.js'))
-    assert.ok(artifacts.every((file) => !file.startsWith('task/')), artifacts.join('\n'))
-    assert.ok(artifacts.every((file) => !file.startsWith('sidepanel/')), artifacts.join('\n'))
-    assert.ok(artifacts.every((file) => !file.startsWith('daemon/')), artifacts.join('\n'))
-    assert.ok(artifacts.every((file) => !file.includes('runner')), artifacts.join('\n'))
-  }
-  assert.equal(extensionPackage.exports['./web-client'], undefined)
-  assert.ok(!extensionPackage.files.includes('dist/debugger-control'))
-  assert.equal(buildManifest.debuggerControl, undefined)
-  assert.equal(fs.existsSync(path.join(root, 'legacy/extension/control-extension')), false)
-  assert.equal(fs.existsSync(path.join(root, 'legacy/extension/dist/debugger-control')), false)
-  assert.equal(fs.existsSync(path.join(root, 'legacy/extension/dist/tokenless-debugger-control.zip')), false)
-  assert.equal(fs.existsSync(path.join(root, 'legacy/extension/src/web-client.ts')), false)
-  assert.equal(fs.existsSync(path.join(root, 'legacy/extension/dist/src/web-client.js')), false)
-  for (const obsoleteDirectory of ['task', 'sidepanel', 'daemon']) {
-    assert.equal(fs.existsSync(path.join(extensionSource, obsoleteDirectory)), false)
-    assert.equal(fs.existsSync(path.join(extensionDist, obsoleteDirectory)), false)
-  }
-})
-
-test('CLI, bridge, and build sources contain no companion extension plumbing', () => {
-  const removedField = ['debugger', 'ControlExtensionId'].join('')
-  const removedFlag = ['--debugger', '-control-extension-id'].join('')
-  const cli = readText('packages/cli/src/tokenless.mts')
-  const bridge = readText('legacy/extension/extension/shared/bridge-protocol.ts')
-  const build = readText('legacy/extension/src/build-extension.mts')
-
-  assert.ok(!cli.includes(removedField))
-  assert.ok(!cli.includes(removedFlag))
-  assert.ok(!bridge.includes(removedField))
-  assert.ok(!build.includes('control-extension'))
-  assert.ok(!build.includes('tokenless-debugger-control.zip'))
-})
-
-test('native messages are constructed and validated with tokenless.native.v1', async () => {
-  const {
-    createNativeMessage,
-    isNativeMessage,
-    NATIVE_MESSAGE_TYPES,
-    NATIVE_PROTOCOL_VERSION,
-  } = await import('../legacy/extension/dist/extension/shared/native-protocol.js')
-
-  assert.equal(NATIVE_PROTOCOL_VERSION, 'tokenless.native.v1')
-  for (const type of Object.values(NATIVE_MESSAGE_TYPES)) {
-    const message = createNativeMessage(type, { optional: undefined })
-    assert.deepEqual(message, { protocol: NATIVE_PROTOCOL_VERSION, type })
-    assert.equal(isNativeMessage(message), true)
-  }
-  assert.equal(isNativeMessage({ protocol: 'tokenless.native.v0', type: NATIVE_MESSAGE_TYPES.READ_CONFIG }), false)
-  assert.equal(isNativeMessage({ type: NATIVE_MESSAGE_TYPES.READ_CONFIG }), false)
-})
-
-test('provider navigation policy centralizes approved visible-session routes', async () => {
-  const { getProviderById } = await import('../legacy/extension/dist/extension/shared/provider-config.js')
-  const {
-    areProviderTransitionSourcesEquivalent,
-    canonicalProviderUrl,
-    isApprovedProviderTransition,
-    isProviderConversationUrl,
-  } = await import('../legacy/extension/dist/extension/shared/provider-navigation-policy.js')
-  const chatgpt = getProviderById('chatgpt')
-  const claude = getProviderById('claude')
-  const gemini = getProviderById('gemini')
-  const grok = getProviderById('grok')
-  assert.ok(chatgpt)
-  assert.ok(claude)
-  assert.ok(gemini)
-  assert.ok(grok)
-
-  assert.equal(canonicalProviderUrl('https://chatgpt.com/g/g-12345678/'), 'https://chatgpt.com/g/g-12345678')
-  assert.equal(isApprovedProviderTransition(chatgpt, 'https://chatgpt.com/', 'https://chatgpt.com/c/12345678'), true)
-  assert.equal(isApprovedProviderTransition(chatgpt, 'https://chatgpt.com/g/g-12345678', 'https://chatgpt.com/g/g-12345678/c/abcdefgh9'), true)
-  assert.equal(isApprovedProviderTransition(chatgpt, 'https://chatgpt.com/g/g-12345678', 'https://chatgpt.com/c/abcdefgh9'), false)
-  assert.equal(isProviderConversationUrl(chatgpt, 'https://chatgpt.com/settings'), false)
-  assert.equal(areProviderTransitionSourcesEquivalent(chatgpt, 'https://chatgpt.com/', 'https://chat.openai.com/'), true)
-  assert.equal(isApprovedProviderTransition(claude, 'https://claude.ai/new', 'https://claude.ai/chat/123e4567-e89b-12d3-a456-426614174001'), true)
-  assert.equal(isProviderConversationUrl(claude, 'https://claude.ai/chat/settings123'), false)
-  assert.equal(claude.composerSelectors[0], 'div[data-testid="chat-input"][contenteditable="true"][role="textbox"]')
-  assert.equal(claude.answerSelectors.includes('[data-testid="virtual-message-list"] .font-claude-response-body'), true)
-  assert.equal(claude.busySelectors.includes('[data-testid="virtual-message-list"] [data-is-streaming="true"]'), true)
-  assert.equal(isApprovedProviderTransition(gemini, 'https://gemini.google.com/app', 'https://gemini.google.com/app/4b9f2c7d1e6a'), true)
-  assert.equal(isProviderConversationUrl(gemini, 'https://gemini.google.com/app/settings123'), false)
-  assert.equal(
-    gemini.composerSelectors[0],
-    'rich-textarea div.ql-editor[data-gramm="false"][contenteditable="true"][role="textbox"][aria-multiline="true"][aria-label="Enter a prompt for Gemini"]'
-  )
-  assert.deepEqual(gemini.submitSelectors, ['button[aria-label="Send message"]'])
-  assert.deepEqual(gemini.answerSelectors, ['response-container message-content'])
-  assert.deepEqual(gemini.busySelectors, ['button[aria-label="Stop response"]'])
-  assert.equal(gemini.blockerSelectors.some((selector) => selector.includes('accounts.google.com')), false)
-  assert.equal(isApprovedProviderTransition(grok, 'https://grok.com/', 'https://grok.com/c/123e4567-e89b-12d3-a456-426614174003'), true)
-  assert.equal(isProviderConversationUrl(grok, 'https://grok.com/c/settings'), false)
-  assert.equal(isProviderConversationUrl(grok, 'https://grok.com/c/settings123'), false)
-  assert.deepEqual(grok.composerSelectors, [
-    'div.tiptap.ProseMirror[contenteditable="true"][role="textbox"][aria-label="Ask Grok anything"][aria-multiline="true"]',
-    'textarea[aria-label="Ask Grok anything"][placeholder="What do you want to know?"]',
-  ])
-  assert.deepEqual(grok.submitSelectors, [
-    'button[data-testid="chat-submit"][aria-label="Submit"][type="submit"]',
-  ])
-  assert.deepEqual(grok.answerSelectors, ['div[data-testid="assistant-message"]'])
-  assert.deepEqual(grok.blockerSelectors, ['div[data-testid="anon-paywall-sign-up-card"]'])
-  assert.equal(grok.busySelectors, undefined)
-  assert.equal(grok.busyTextLabels, undefined)
-})
-
-test('daemon bridge requires a v1 handshake and reconnects with bounded backoff', async () => {
-  const { NativeDaemonBridge } = await import(
-    '../legacy/extension/dist/extension/background/native-daemon-bridge.js'
-  )
-  const scheduler = createManualScheduler()
-  const ports = []
-  const delivered = []
-  let runtimeLastErrorReads = 0
-  const bridge = new NativeDaemonBridge({
-    connectNative() {
-      const port = createBehaviorNativePort()
-      ports.push(port)
-      return port
-    },
-    onMessage(_port, message) {
-      delivered.push(message)
-    },
-    readRuntimeLastError() {
-      runtimeLastErrorReads += 1
-      return { message: 'Access to the specified native messaging host is forbidden.' }
-    },
-    timing: {
-      handshakeTimeoutMs: 100,
-      reconnectInitialDelayMs: 10,
-      reconnectMaxDelayMs: 40,
-    },
-    setTimer: scheduler.setTimer,
-    clearTimer: scheduler.clearTimer,
-  })
-
-  bridge.start()
-  bridge.start()
-  assert.equal(ports.length, 1, 'duplicate starts must share the pending port')
-  assert.deepEqual(ports[0].posted, [{
-    protocol: 'tokenless.native.v1',
-    type: 'tokenless.native.daemon_connect',
-  }])
-
-  await ports[0].onMessage.emit({
-    type: 'tokenless.native.daemon_connected',
-    ok: true,
-  })
-  assert.equal(ports[0].disconnectCount, 1, 'missing protocol must reject the handshake')
-  assert.deepEqual(scheduler.pendingDelays(), [10])
-
-  scheduler.runDelay(10)
-  await ports[1].onMessage.emit({
-    protocol: 'tokenless.native.v0',
-    type: 'tokenless.native.daemon_connected',
-    ok: true,
-  })
-  assert.equal(ports[1].disconnectCount, 1, 'wrong protocol must reject the handshake')
-  assert.deepEqual(scheduler.pendingDelays(), [20])
-
-  scheduler.runDelay(20)
-  await ports[2].onMessage.emit({
-    protocol: 'tokenless.native.v1',
-    type: 'tokenless.native.daemon_connect',
-    ok: false,
-    error: { code: 'daemon_unavailable' },
-  })
-  assert.equal(ports[2].disconnectCount, 1, 'ok:false daemon_connect must reject the handshake')
-  assert.deepEqual(scheduler.pendingDelays(), [40])
-
-  scheduler.runDelay(40)
-  scheduler.runDelay(100)
-  assert.equal(ports[3].disconnectCount, 1, 'handshake timeout must close the port')
-  assert.deepEqual(scheduler.pendingDelays(), [40], 'reconnect delay must stay capped')
-
-  scheduler.runDelay(40)
-  await ports[4].onMessage.emit(nativeSuccess('tokenless.native.daemon_connected', {
-    status: 'connected',
-  }))
-  assert.deepEqual(scheduler.pendingDelays(), [], 'successful handshake must clear its timeout')
-
-  await ports[4].onMessage.emit({
-    protocol: 'tokenless.native.v1',
-    type: 'tokenless.native.daemon_error',
-    ok: false,
-    error: { code: 'bridge_superseded', message: 'A newer bridge won.' },
-  })
-  assert.equal(ports[4].disconnectCount, 1)
-  assert.deepEqual(scheduler.pendingDelays(), [10], 'successful handshake must reset backoff')
-
-  bridge.start()
-  assert.equal(ports.length, 5, 'start must not bypass an existing reconnect timer')
-  scheduler.runDelay(10)
-  await ports[5].onMessage.emit(nativeSuccess('tokenless.native.daemon_connected', {
-    status: 'connected',
-  }))
-  await ports[5].onDisconnect.emit()
-  assert.deepEqual(scheduler.pendingDelays(), [10], 'physical disconnect must reconnect from base delay')
-  assert.equal(runtimeLastErrorReads, 6, 'every disconnect must consume runtime.lastError in its callback')
-
-  scheduler.runDelay(10)
-  await ports[6].onMessage.emit(nativeSuccess('tokenless.native.daemon_connected', {
-    status: 'connected',
-  }))
-  const recoveredJob = nativeSuccess('tokenless.native.daemon_job', { job: { job_id: 'job-recovered' } })
-  await ports[6].onMessage.emit(recoveredJob)
-  assert.deepEqual(delivered, [recoveredJob], 'messages flow only after a recovered handshake')
-  assert.ok(ports.every((port) => port.posted.every((message) => (
-    message.protocol === 'tokenless.native.v1' && message.type === 'tokenless.native.daemon_connect'
-  ))))
-
-  bridge.stop()
-  assert.deepEqual(scheduler.pendingDelays(), [])
-  assert.equal(runtimeLastErrorReads, 7, 'intentional shutdown disconnects must also consume runtime.lastError')
-})
-
-test('Settings model normalizes redacted daemon history and explicit configuration clears', async () => {
-  const {
-    configWritePayload,
-    normalizeHistoryEntries,
-    normalizeProviderOrder,
-  } = await import('../legacy/extension/dist/extension/settings/model.js')
-  const privateMarker = 'private-claim-marker'
-  const entries = normalizeHistoryEntries([
-    {
-      job_id: 'job-202',
-      claim_token: privateMarker,
-      provider: 'chatgpt',
-      action: 'submit_and_read',
-      status: 'succeeded',
-      metadata: {
-        projectName: 'Tokenless',
-        chatName: 'Background-only execution',
-        taskId: 'project:Tokenless:chat:Background-only execution',
-      },
-      updated_at: '2026-07-10T01:02:03Z',
-    },
-    {
-      job_id: 'job-legacy',
-      provider: 'gemini',
-      action: 'read',
-      status: 'queued',
-      request_json: {
-        metadata: {
-          projectName: 'Legacy project',
-          chatName: 'Compatible history',
-          idempotencyKey: 'legacy-task',
-        },
-      },
-      created_at: '2026-07-09T01:02:03Z',
-    },
-  ])
-
-  assert.deepEqual(entries, [
-    {
-      jobId: 'job-202',
-      taskId: 'project:Tokenless:chat:Background-only execution',
-      projectName: 'Tokenless',
-      chatName: 'Background-only execution',
-      provider: 'chatgpt',
-      action: 'submit_and_read',
-      status: 'succeeded',
-      updatedAt: '2026-07-10T01:02:03Z',
-    },
-    {
-      jobId: 'job-legacy',
-      taskId: 'legacy-task',
-      projectName: 'Legacy project',
-      chatName: 'Compatible history',
-      provider: 'gemini',
-      action: 'read',
-      status: 'queued',
-      updatedAt: '2026-07-09T01:02:03Z',
-    },
-  ])
-  assert.doesNotMatch(JSON.stringify(entries), new RegExp(privateMarker))
-  assert.deepEqual(
-    normalizeProviderOrder(['claude', 'chatgpt', 'claude', 'unsupported'], ['chatgpt', 'gemini', 'claude']),
-    ['claude', 'chatgpt']
-  )
-  assert.deepEqual(configWritePayload({
-    providerOrder: ['gemini', 'chatgpt'],
-    browser: '',
-    daemonUrl: '   ',
-  }), {
-    preferredProviders: ['gemini', 'chatgpt'],
-    browser: null,
-    daemonUrl: null,
-  })
-  assert.deepEqual(configWritePayload({
-    providerOrder: ['chatgpt'],
-    browser: ' chrome ',
-    daemonUrl: ' http://127.0.0.1:7331 ',
-  }), {
-    preferredProviders: ['chatgpt'],
-    browser: 'chrome',
-    daemonUrl: 'http://127.0.0.1:7331',
-  })
-})
-
-test('built Settings UI renders, saves, refreshes, redacts, and reports failures', { timeout: 30000 }, async () => {
-  const { chromium } = await import('playwright')
-  const server = await startStaticServer(extensionDist)
-  const browser = await chromium.launch({ headless: true })
-
-  try {
-    const initialHistory = [{
-      job_id: 'job-initial',
-      claim_token: 'private-claim-marker',
-      provider: 'gemini',
-      action: 'submit_and_read',
-      status: 'succeeded',
-      metadata: {
-        projectName: 'Tokenless',
-        chatName: 'Settings behavior',
-        taskId: 'task-settings-behavior',
-      },
-      request_json: {
-        prompt: 'private-prompt-marker',
-        result: 'private-result-marker',
-      },
-      updated_at: '2026-07-10T01:02:03Z',
-    }]
-    const refreshedHistory = [{
-      job_id: 'job-refreshed',
-      provider: 'chatgpt',
-      action: 'read',
-      status: 'queued',
-      metadata: {
-        projectName: 'Tokenless',
-        chatName: 'History only refresh',
-        taskId: 'task-history-refresh',
-      },
-      updated_at: '2026-07-10T02:03:04Z',
-    }]
-    const loaded = await openSettingsPage(browser, server.url, [
-      { response: nativeSuccess('tokenless.native.read_config', {
-        preferredProviders: ['gemini', 'chatgpt'],
-        browser: 'Chrome Beta',
-        daemonUrl: 'http://127.0.0.1:7331',
-      }) },
-      { response: nativeSuccess('tokenless.native.list_history', initialHistory) },
-      { response: nativeSuccess('tokenless.native.write_config', {
-        preferredProviders: ['chatgpt', 'gemini'],
-        browser: null,
-        daemonUrl: null,
-      }) },
-      { response: nativeSuccess('tokenless.native.list_history', refreshedHistory), delayMs: 150 },
-      { response: nativeFailure('tokenless.native.list_history', 'History service offline.') },
-    ])
-
-    try {
-      const { page, pageErrors } = loaded
-      await page.getByText('Native host ready', { exact: true }).waitFor()
-      await page.getByRole('button', { name: 'Settings', exact: true }).click()
-      await page.getByText('Language', { exact: true }).waitFor()
-      await page.getByRole('button', { name: '中文', exact: true }).click()
-      await page.getByRole('button', { name: '设置', exact: true }).waitFor()
-      await page.getByText('语言', { exact: true }).waitFor()
-      await page.getByRole('button', { name: 'EN', exact: true }).click()
-      await page.getByRole('button', { name: 'Settings', exact: true }).waitFor()
-      assert.deepEqual(await page.locator('.provider-copy strong').allTextContents(), ['Gemini', 'ChatGPT'])
-      assert.equal(await page.getByLabel('Browser preference').inputValue(), 'Chrome Beta')
-      assert.equal(await page.getByLabel('Daemon URL').inputValue(), 'http://127.0.0.1:7331')
-      const visibleText = await page.locator('body').innerText()
-      assert.doesNotMatch(visibleText, /private-claim-marker|private-prompt-marker|private-result-marker/)
-      assert.equal(await page.getByRole('button', { name: 'Move Gemini up', exact: true }).isDisabled(), true)
-      assert.equal(await page.getByRole('button', { name: 'Move Gemini down', exact: true }).isEnabled(), true)
-      assert.equal(await page.getByRole('button', { name: 'Remove Gemini', exact: true }).isEnabled(), true)
-      assert.equal(await page.getByRole('button', { name: 'Move ChatGPT up', exact: true }).isEnabled(), true)
-      assert.equal(await page.getByRole('button', { name: 'Move ChatGPT down', exact: true }).isDisabled(), true)
-      assert.equal(await page.getByRole('button', { name: 'Remove ChatGPT', exact: true }).isEnabled(), true)
-      assert.equal(await page.getByRole('combobox', { name: 'Provider to add', exact: true }).count(), 1)
-      assert.equal(await page.getByRole('combobox', { name: 'Provider to add', exact: true }).isDisabled(), true)
-      assert.equal(await page.getByRole('button', { name: 'Add provider', exact: true }).isDisabled(), true)
-      assert.equal(await page.getByRole('button', { name: 'Save settings', exact: true }).count(), 1)
-      assert.equal(await page.locator('#refresh').count(), 1)
-
-      await page.getByLabel('Browser preference').fill('   ')
-      await page.getByLabel('Daemon URL').fill('')
-      const moveChatGptUp = page.getByRole('button', { name: 'Move ChatGPT up', exact: true })
-      await moveChatGptUp.focus()
-      await page.keyboard.press('Enter')
-      assert.deepEqual(await page.locator('.provider-copy strong').allTextContents(), ['ChatGPT', 'Gemini'])
-      assert.deepEqual(await page.evaluate(() => ({
-        providerId: document.activeElement?.getAttribute('data-provider-id'),
-        action: document.activeElement?.getAttribute('data-provider-action'),
-      })), { providerId: 'chatgpt', action: 'down' })
-      await page.getByRole('button', { name: 'Save settings', exact: true }).click()
-      await page.getByText('Settings saved.', { exact: true }).waitFor()
-
-      const writeRequest = await page.evaluate(() => globalThis.__nativeMock.requests[2])
-      assert.deepEqual(writeRequest, {
-        protocol: 'tokenless.native.v1',
-        type: 'tokenless.native.write_config',
-        preferredProviders: ['chatgpt', 'gemini'],
-        browser: null,
-        daemonUrl: null,
-      })
-
-      await page.getByLabel('Browser preference').fill('firefox')
-      await page.getByLabel('Daemon URL').fill('http://127.0.0.1:7444')
-      await page.getByRole('button', { name: 'Move Gemini up', exact: true }).click()
-      await page.getByRole('button', { name: 'Activity', exact: true }).click()
-      await page.getByText('Settings behavior', { exact: true }).waitFor()
-      assert.equal(await page.getByText('Project: Tokenless', { exact: true }).count(), 1)
-      assert.equal(await page.getByText('Task: task-settings-behavior', { exact: true }).count(), 1)
-      const refresh = page.getByRole('button', { name: 'Refresh', exact: true })
-      await refresh.click()
-      await page.getByRole('button', { name: 'Refreshing…', exact: true }).waitFor()
-      assert.equal(await page.getByRole('button', { name: 'Refreshing…', exact: true }).isDisabled(), true)
-      assert.equal(await page.locator('#configuration button[type="submit"]').isEnabled(), true)
-      assert.equal(await page.getByLabel('Browser preference').inputValue(), 'firefox')
-      assert.equal(await page.getByLabel('Daemon URL').inputValue(), 'http://127.0.0.1:7444')
-      assert.deepEqual(await page.locator('.provider-copy strong').allTextContents(), ['Gemini', 'ChatGPT'])
-      await page.getByText('Loading daemon history…', { exact: true }).waitFor()
-      await page.getByText('History only refresh', { exact: true }).waitFor()
-      assert.equal(await page.getByLabel('Browser preference').inputValue(), 'firefox')
-      assert.deepEqual(await page.locator('.provider-copy strong').allTextContents(), ['Gemini', 'ChatGPT'])
-
-      const requestTypes = await page.evaluate(() => globalThis.__nativeMock.requests.map((request) => request.type))
-      assert.deepEqual(requestTypes, [
-        'tokenless.native.read_config',
-        'tokenless.native.list_history',
-        'tokenless.native.write_config',
-        'tokenless.native.list_history',
-      ])
-
-      await page.getByRole('button', { name: 'Refresh', exact: true }).click()
-      await page.getByText('History service offline.', { exact: true }).waitFor()
-      assert.equal(await page.locator('#page-status').textContent(), 'History refresh failed')
-      assert.equal(await page.getByLabel('Browser preference').inputValue(), 'firefox')
-      assert.deepEqual(await page.locator('.provider-copy strong').allTextContents(), ['Gemini', 'ChatGPT'])
-
-      await page.setViewportSize({ width: 320, height: 844 })
-      const horizontalOverflow = await page.evaluate(() => document.documentElement.scrollWidth - window.innerWidth)
-      assert.ok(horizontalOverflow <= 0, `Settings overflowed the narrow viewport by ${horizontalOverflow}px`)
-      assert.deepEqual(pageErrors, [])
-    } finally {
-      await loaded.context.close()
-    }
-
-    const loading = await openSettingsPage(browser, server.url, [{}, {}])
-    try {
-      const { page, pageErrors } = loading
-      await page.getByRole('button', { name: 'Settings', exact: true }).click()
-      await page.getByText('Loading configuration…', { exact: true }).waitFor()
-      await page.evaluate(([configResponse, historyResponse]) => {
-        globalThis.__nativeMock.respond(0, configResponse)
-        globalThis.__nativeMock.respond(1, historyResponse)
-      }, [
-        nativeSuccess('tokenless.native.read_config', {
-          preferredProviders: [],
-          browser: null,
-          daemonUrl: null,
-        }),
-        nativeSuccess('tokenless.native.list_history', []),
-      ])
-      await page.getByText('Native host ready', { exact: true }).waitFor()
-      await page.getByText('No preference saved. New jobs default to ChatGPT.', { exact: true }).waitFor()
-      await page.getByRole('button', { name: 'Activity', exact: true }).click()
-      await page.getByText('Loading daemon history…', { exact: true }).waitFor({ state: 'hidden' })
-      await page.getByText('No daemon jobs yet.', { exact: true }).waitFor()
-      assert.equal(await page.getByRole('button', { name: 'Refresh', exact: true }).isEnabled(), true)
-      assert.deepEqual(pageErrors, [])
-    } finally {
-      await loading.context.close()
-    }
-
-    const partial = await openSettingsPage(browser, server.url, [
-      { response: nativeFailure('tokenless.native.read_config', 'Configuration permission denied.') },
-      { response: nativeSuccess('tokenless.native.list_history', refreshedHistory) },
-    ])
-    try {
-      const { page, pageErrors } = partial
-      await page.getByText('Partially loaded', { exact: true }).waitFor()
-      await page.getByRole('button', { name: 'Settings', exact: true }).click()
-      await page.getByText('Configuration permission denied.', { exact: true }).waitFor()
-      await page.getByRole('button', { name: 'Activity', exact: true }).click()
-      await page.getByText('History only refresh', { exact: true }).waitFor()
-      assert.equal(await page.locator('#configuration [role="alert"]').count(), 1)
-      assert.deepEqual(pageErrors, [])
-    } finally {
-      await partial.context.close()
-    }
-  } finally {
-    await browser.close()
-    await server.close()
-  }
-})
-
-test('provider content uses only visible controls and snapshots a fail-closed real DOM', { timeout: 30000 }, async () => {
-  const { chromium } = await import('playwright')
-  const browser = await chromium.launch({ headless: true })
-
-  try {
-    const chatgpt = await openProviderFixture(
-      browser,
-      'https://chatgpt.com/c/123e4567-e89b-12d3-a456-426614174007?secret-query-marker=yes#secret-hash-marker',
-      `
-      <!doctype html>
-      <html data-document-secret="secret-document-marker">
-        <head><title>secret-title-marker</title></head>
-        <body>
-          <!-- secret-comment-marker -->
-          <div style="opacity:0">
-            <div id="prompt-textarea" contenteditable="true">ancestor-opacity-composer-marker</div>
-          </div>
-          <div style="content-visibility:hidden">
-            <div id="content-hidden-composer" role="textbox" contenteditable="true">content-hidden-composer-marker</div>
-          </div>
-          <div style="position:fixed;left:-9999px;top:0">
-            <div id="offscreen-composer" role="textbox" contenteditable="true">offscreen-composer-marker</div>
-          </div>
-          <div id="visible-composer" role="textbox" contenteditable="true"></div>
-          <div style="visibility:hidden">
-            <button data-testid="send-button" onclick="globalThis.__clicked.push('ancestor-hidden')">Ancestor hidden send</button>
-          </div>
-          <div style="content-visibility:hidden">
-            <button data-testid="send-button" onclick="globalThis.__clicked.push('content-hidden')">Content hidden send</button>
-          </div>
-          <div style="position:fixed;left:-9999px;top:0">
-            <button data-testid="send-button" onclick="globalThis.__clicked.push('offscreen')">Offscreen send</button>
-          </div>
-          <button data-testid="send-button" onclick="globalThis.__clicked.push('visible'); this.disabled = true; this.setAttribute('aria-disabled', 'true')">Visible send</button>
-          <div style="opacity:0">
-            <div aria-label="captcha hidden-blocker-marker">hidden-blocker-text-marker</div>
-          </div>
-          <p id="visible-copy">visible-snapshot-copy</p>
-          <div style="display:none">
-            <div
-              id="secret-id-marker"
-              class="secret-class-marker"
-              data-secret="secret-data-marker"
-              onclick="secret-event-marker"
-              title="secret-attribute-marker"
-            >secret-text-marker</div>
-            <form action="/secret-form-marker">
-              <input name="secret-name-marker" value="secret-value-marker" data-auth="secret-auth-marker">
-              <button formaction="/secret-formaction-marker" type="button">secret-form-control-marker</button>
-            </form>
-            <a href="/secret-url-marker" aria-label="secret-label-marker">secret-link-marker</a>
-          </div>
-          <script>globalThis.__clicked = []</script>
-        </body>
-      </html>
-    `)
-
-    try {
-      const request = {
-        provider: 'chatgpt',
-        requestId: 'visible-controls',
-        prompt: 'visible prompt only',
-        composerTimeoutMs: 100,
-        submitTimeoutMs: 100,
-      }
-      const submit = await chatgpt.page.evaluate((contentRequest) => (
-        globalThis.__dispatchTokenlessMessage({ type: 'tokenless.bridge.submit', request: contentRequest })
-      ), request)
-      assert.equal(submit.status, 'submitted')
-      assert.equal(submit.provider, 'chatgpt')
-      assert.equal(await chatgpt.page.locator('#prompt-textarea').textContent(), 'ancestor-opacity-composer-marker')
-      assert.equal(await chatgpt.page.locator('#content-hidden-composer').textContent(), 'content-hidden-composer-marker')
-      assert.equal(await chatgpt.page.locator('#offscreen-composer').textContent(), 'offscreen-composer-marker')
-      assert.match(await chatgpt.page.locator('#visible-composer').textContent(), /visible prompt only/)
-      assert.deepEqual(await chatgpt.page.evaluate(() => globalThis.__clicked), ['visible'])
-
-      const snapshot = await chatgpt.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-        type: 'tokenless.bridge.snapshot_dom',
-        request: {
-          provider: 'chatgpt',
-          requestId: 'snapshot-default-redaction',
-          metadata: { includeText: false },
-        },
-      }))
-      assert.equal(snapshot.status, 'snapshotted')
-      assert.equal(snapshot.sanitized, true)
-      assert.equal(snapshot.includeText, false)
-      assert.equal(snapshot.visibleText, undefined)
-      assert.equal(snapshot.url, 'https://chatgpt.com/c/123e4567-e89b-12d3-a456-426614174007')
-      assert.match(snapshot.html, /\[text\]/)
-      assert.match(snapshot.html, /\[structural\]/)
-      assert.doesNotMatch(snapshot.html, /secret-(?:document|title|id|class|data|event|attribute|text|form|name|value|auth|formaction|url|label|link|composer|blocker)/i)
-      assert.doesNotMatch(snapshot.html, /\s(?:data-[^=\s]*|style|on\w+|value|name|action|formaction|href)=/i)
-      assert.doesNotMatch(snapshot.html, /secret-comment-marker/)
-      assert.doesNotMatch(
-        JSON.stringify(snapshot),
-        /secret-(?:query|hash|title|comment|document|id|class|data|event|attribute|text|form|name|value|auth|formaction|url|label|link)|(?:ancestor-opacity|content-hidden|offscreen|hidden-blocker)-(?:composer|text)?-?marker/i
-      )
-
-      const textSnapshot = await chatgpt.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-        type: 'tokenless.bridge.snapshot_dom',
-        request: {
-          provider: 'chatgpt',
-          requestId: 'snapshot-visible-text-only',
-          includeText: true,
-        },
-      }))
-      assert.equal(textSnapshot.status, 'snapshotted')
-      assert.equal(textSnapshot.title, '[text]')
-      assert.match(textSnapshot.html, /visible prompt only/)
-      assert.match(textSnapshot.html, /visible-snapshot-copy/)
-      assert.match(textSnapshot.visibleText, /visible prompt only/)
-      assert.doesNotMatch(
-        JSON.stringify(textSnapshot),
-        /secret-(?:query|hash|title|comment|id|class|data|event|attribute|text|form|name|value|auth|formaction|url|label|link)|(?:ancestor-opacity|content-hidden|offscreen|hidden-blocker)-(?:composer|text)?-?marker/i
-      )
-
-      const malformed = await chatgpt.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-        type: 'tokenless.bridge.snapshot_dom',
-        request: { provider: 'chatgpt', requestId: 'snapshot-malformed', includeText: 'false' },
-      }))
-      assert.equal(malformed.status, 'blocked')
-      assert.equal(malformed.stopReason, 'invalid_include_text')
-
-      const wrongProvider = await chatgpt.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-        type: 'tokenless.bridge.read',
-        request: { provider: 'gemini', requestId: 'wrong-provider', readTimeoutMs: 0 },
-      }))
-      assert.equal(wrongProvider.status, 'blocked')
-      assert.equal(wrongProvider.stopReason, 'provider_context_mismatch')
-
-      const wrongTarget = await chatgpt.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-        type: 'tokenless.bridge.read',
-        request: {
-          provider: 'chatgpt',
-          requestId: 'wrong-target',
-          targetUrl: 'https://chatgpt.com/another-conversation',
-          readTimeoutMs: 0,
-        },
-      }))
-      assert.equal(wrongTarget.status, 'blocked')
-      assert.equal(wrongTarget.stopReason, 'target_context_mismatch')
-      const preSubmitPathDrift = await chatgpt.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-        type: 'tokenless.bridge.submit',
-        request: {
-          provider: 'chatgpt',
-          requestId: 'pre-submit-path-drift',
-          targetUrl: 'https://chatgpt.com/',
-          prompt: 'Must not submit after pre-submit path drift.',
-          composerTimeoutMs: 100,
-          submitTimeoutMs: 100,
-        },
-      }))
-      assert.equal(preSubmitPathDrift.status, 'blocked')
-      assert.equal(preSubmitPathDrift.stopReason, 'target_context_mismatch')
-      assert.deepEqual(chatgpt.pageErrors, [])
-    } finally {
-      await chatgpt.context.close()
-    }
-
-    const claude = await openProviderFixture(
-      browser,
-      'https://claude.ai/new',
-      readText('test/fixtures/claude-real-dom-fixture.html')
-    )
-    try {
-      await claude.page.evaluate(() => {
-        const ordinaryContinue = document.createElement('button')
-        ordinaryContinue.id = 'ordinary-claude-continue'
-        ordinaryContinue.type = 'button'
-        ordinaryContinue.dataset.testid = 'continue'
-        ordinaryContinue.textContent = 'Continue writing'
-        document.querySelector('header')?.append(ordinaryContinue)
-      })
-      const submit = await claude.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-        type: 'tokenless.bridge.submit',
-        request: {
-          provider: 'claude',
-          requestId: 'claude-disabled-send',
-          targetUrl: 'https://claude.ai/new',
-          prompt: 'Enable the visible send button.',
-          composerTimeoutMs: 100,
-          submitTimeoutMs: 100,
-          readTimeoutMs: 2000,
-        },
-      }))
-      assert.equal(submit.status, 'submitted')
-      assert.equal(await claude.page.locator('#ordinary-claude-continue').isVisible(), true)
-      assert.equal(await claude.page.locator('.message-row[data-role="user"]').count(), 2)
-      assert.equal(
-        await claude.page.locator('[data-testid="chat-input"]').getAttribute('aria-label'),
-        'Write your prompt to Claude'
-      )
-      assert.equal(await claude.page.locator('[data-testid="file-upload"]').count(), 1)
-      const request = {
-        provider: 'claude',
-        requestId: 'claude-disabled-send',
-        targetUrl: 'https://claude.ai/new',
-        prompt: 'Enable the visible send button.',
-        readTimeoutMs: 2000,
-      }
-      await claude.page.waitForURL(
-        'https://claude.ai/chat/123e4567-e89b-12d3-a456-426614174001'
-      )
-      await claude.page.evaluate(() => {
-        const answers = [...document.querySelectorAll('.font-claude-response-body')]
-        const answer = answers.at(-1)
-        const loginCitation = document.createElement('a')
-        loginCitation.href = '/login'
-        loginCitation.textContent = 'Authentication guide'
-        answer?.append(' ', loginCitation)
-      })
-      const proof = postSubmitTransitionProof(request, submit.answerBaseline, 'claude-transition-proof-001')
-      const read = await claude.page.evaluate(({ contentRequest, answerBaseline, transitionProof }) => (
-        globalThis.__dispatchTokenlessMessage({
-          type: 'tokenless.bridge.read',
-          request: {
-            ...contentRequest,
-            answerBaseline,
-            allowPostSubmitTargetTransition: true,
-            postSubmitTargetTransitionProof: transitionProof,
-          },
-        })
-      ), { contentRequest: request, answerBaseline: submit.answerBaseline, transitionProof: proof })
-      assert.equal(read.status, 'read')
-      assert.match(read.text, /visible Claude real-DOM fixture answer for: Enable the visible send button\./)
-      assert.match(read.text, /Authentication guide/)
-      assert.doesNotMatch(read.text, /stale Claude real-DOM fixture answer/)
-      assert.doesNotMatch(read.text, /_streaming/)
-      assert.equal(read.url, 'https://claude.ai/chat/123e4567-e89b-12d3-a456-426614174001')
-      for (const unsafePath of ['/chat/settings', '/chat/settings123']) {
-        await claude.page.evaluate((pathname) => {
-          history.replaceState({}, '', pathname)
-          const answers = [...document.querySelectorAll('.font-claude-response-body')]
-          const answer = answers.at(-1)
-          if (answer) answer.textContent = 'Misleading Claude settings answer'
-        }, unsafePath)
-        const blocked = await dispatchPostSubmitRead(claude.page, request, submit.answerBaseline, proof)
-        assert.equal(blocked.status, 'blocked')
-        assert.equal(blocked.stopReason, 'target_context_mismatch')
-        assert.doesNotMatch(JSON.stringify(blocked), /Misleading Claude settings answer/)
-      }
-      assert.deepEqual(claude.pageErrors, [])
-    } finally {
-      await claude.context.close()
-    }
-
-    const claudeLoginBlocker = await openProviderFixture(
-      browser,
-      'https://claude.ai/new',
-      readText('test/fixtures/claude-real-dom-fixture.html')
-    )
-    try {
-      await claudeLoginBlocker.page.evaluate(() => {
-        const loginForm = document.createElement('form')
-        loginForm.setAttribute('aria-label', 'Sign in to Claude')
-        loginForm.style.cssText = 'position:fixed;left:300px;top:80px;z-index:50;padding:20px;background:white'
-
-        const email = document.createElement('input')
-        email.placeholder = 'Enter your email'
-        email.setAttribute('aria-label', 'Email address')
-
-        const continueButton = document.createElement('button')
-        continueButton.type = 'button'
-        continueButton.dataset.testid = 'continue'
-        continueButton.textContent = 'Continue'
-
-        loginForm.append(email, continueButton)
-        document.body.append(loginForm)
-      })
-      const blocked = await claudeLoginBlocker.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-        type: 'tokenless.bridge.submit',
-        request: {
-          provider: 'claude',
-          requestId: 'claude-visible-login-blocker',
-          targetUrl: 'https://claude.ai/new',
-          prompt: 'This prompt must not be submitted through a visible login form.',
-          composerTimeoutMs: 100,
-          submitTimeoutMs: 100,
-        },
-      }))
-      assert.equal(blocked.status, 'blocked')
-      assert.equal(blocked.stopReason, 'provider_blocker_visible')
-      assert.match(blocked.message, /Continue/)
-      assert.equal(await claudeLoginBlocker.page.locator('.message-row[data-role="user"]').count(), 1)
-      assert.deepEqual(claudeLoginBlocker.pageErrors, [])
-    } finally {
-      await claudeLoginBlocker.context.close()
-    }
-
-    for (const driftTarget of ['composer', 'submit']) {
-      const claudeSelectorDrift = await openProviderFixture(
-        browser,
-        'https://claude.ai/new',
-        readText('test/fixtures/claude-real-dom-fixture.html')
-      )
-      try {
-        await claudeSelectorDrift.page.evaluate((target) => {
-          if (target === 'composer') {
-            const composer = document.querySelector('[data-testid="chat-input"]')
-            composer.id = 'drifted-claude-composer'
-            composer.removeAttribute('data-testid')
-            composer.removeAttribute('aria-label')
-            composer.removeAttribute('role')
-            composer.className = 'fixture-drifted-composer'
-            return
-          }
-          const send = document.querySelector('button[aria-label="Send message"]')
-          send.id = 'drifted-claude-submit'
-          send.removeAttribute('aria-label')
-          send.removeAttribute('data-cds')
-        }, driftTarget)
-        const blocked = await claudeSelectorDrift.page.evaluate((target) => globalThis.__dispatchTokenlessMessage({
-          type: 'tokenless.bridge.submit',
-          request: {
-            provider: 'claude',
-            requestId: `claude-${target}-selector-drift`,
-            targetUrl: 'https://claude.ai/new',
-            prompt: `This prompt must not pass the drifted Claude ${target} contract.`,
-            composerTimeoutMs: 100,
-            submitTimeoutMs: 100,
-          },
-        }), driftTarget)
-        assert.equal(blocked.status, 'blocked')
-        assert.equal(blocked.stopReason, 'selector_drift')
-        assert.match(blocked.message, new RegExp(`Provider ${driftTarget} selector`))
-        assert.equal(await claudeSelectorDrift.page.locator('.message-row[data-role="user"]').count(), 1)
-        assert.deepEqual(claudeSelectorDrift.pageErrors, [])
-      } finally {
-        await claudeSelectorDrift.context.close()
-      }
-    }
-
-    const claudeAnswerDrift = await openProviderFixture(
-      browser,
-      'https://claude.ai/new',
-      readText('test/fixtures/claude-real-dom-fixture.html')
-    )
-    try {
-      const answerDriftRequest = {
-        provider: 'claude',
-        requestId: 'claude-answer-selector-drift',
-        targetUrl: 'https://claude.ai/new',
-        prompt: 'Answer selector contract drift.',
-        readTimeoutMs: 0,
-      }
-      const submit = await claudeAnswerDrift.page.evaluate((request) => globalThis.__dispatchTokenlessMessage({
-        type: 'tokenless.bridge.submit',
-        request: {
-          ...request,
-          composerTimeoutMs: 100,
-          submitTimeoutMs: 100,
-        },
-      }), answerDriftRequest)
-      assert.equal(submit.status, 'submitted')
-      await claudeAnswerDrift.page.waitForURL(
-        'https://claude.ai/chat/123e4567-e89b-12d3-a456-426614174001'
-      )
-      await claudeAnswerDrift.page.evaluate(() => {
-        for (const answer of document.querySelectorAll('.font-claude-response-body')) {
-          answer.classList.remove('font-claude-response-body')
-          answer.setAttribute('data-answer-contract', 'drifted')
-        }
-      })
-      const proof = postSubmitTransitionProof(
-        answerDriftRequest,
-        submit.answerBaseline,
-        'claude-answer-drift-proof-001'
-      )
-      const blocked = await dispatchPostSubmitRead(
-        claudeAnswerDrift.page,
-        answerDriftRequest,
-        submit.answerBaseline,
-        proof
-      )
-      assert.equal(blocked.status, 'blocked')
-      assert.equal(blocked.stopReason, 'response_unavailable')
-      assert.doesNotMatch(JSON.stringify(blocked), /visible Claude real-DOM fixture answer/)
-      assert.deepEqual(claudeAnswerDrift.pageErrors, [])
-    } finally {
-      await claudeAnswerDrift.context.close()
-    }
-
-    const gemini = await openProviderFixture(
-      browser,
-      'https://gemini.google.com/app',
-      readText('test/fixtures/gemini-real-dom-fixture.html')
-    )
-    try {
-      assert.equal(await gemini.page.locator('button[aria-label="Send message"]').count(), 0)
-      assert.equal(await gemini.page.locator('a[aria-label="Sign in"][href^="https://accounts.google.com/ServiceLogin"]').isVisible(), true)
-      assert.equal(await gemini.page.locator('button[data-test-id="bard-mode-menu-button"][aria-label^="Open mode picker, currently "]').isVisible(), true)
-      assert.equal(await gemini.page.locator('button[aria-label="Upload & tools"][aria-haspopup="menu"]').isVisible(), true)
-      const request = {
-        provider: 'gemini',
-        requestId: 'gemini-conversation-transition',
-        targetUrl: 'https://gemini.google.com/app',
-        prompt: 'Start the visible Gemini conversation.',
-        composerTimeoutMs: 100,
-        submitTimeoutMs: 100,
-        readTimeoutMs: 2000,
-      }
-      const submit = await gemini.page.evaluate((contentRequest) => (
-        globalThis.__dispatchTokenlessMessage({ type: 'tokenless.bridge.submit', request: contentRequest })
-      ), request)
-      assert.equal(submit.status, 'submitted')
-      assert.deepEqual(submit.answerBaseline, {
-        count: 1,
-        lastText: 'stale Gemini real-DOM fixture answer that must not be read',
-      })
-      assert.equal(await gemini.page.locator('button[aria-label="Stop response"]').isVisible(), true)
-      assert.match(
-        await gemini.page.locator('response-container message-content').last().textContent(),
-        /answer_streaming/
-      )
-      assert.equal(await gemini.page.locator('button[aria-label="Send message"]').count(), 0)
-      assert.equal(await gemini.page.locator('user-query').count(), 2)
-      assert.match(await gemini.page.locator('user-query').last().textContent(), /Start the visible Gemini conversation\./)
-      const proof = postSubmitTransitionProof(request, submit.answerBaseline, 'gemini-transition-proof-001')
-      const read = await gemini.page.evaluate(({ contentRequest, answerBaseline, transitionProof }) => (
-        globalThis.__dispatchTokenlessMessage({
-          type: 'tokenless.bridge.read',
-          request: {
-            ...contentRequest,
-            answerBaseline,
-            allowPostSubmitTargetTransition: true,
-            postSubmitTargetTransitionProof: transitionProof,
-          },
-        })
-      ), { contentRequest: request, answerBaseline: submit.answerBaseline, transitionProof: proof })
-      assert.equal(read.status, 'read')
-      assert.equal(
-        read.text,
-        'visible Gemini real-DOM fixture answer for: Start the visible Gemini conversation.'
-      )
-      assert.doesNotMatch(read.text, /stale Gemini real-DOM fixture answer/)
-      assert.doesNotMatch(read.text, /_streaming/)
-      assert.equal(read.url, 'https://gemini.google.com/app/4b9f2c7d1e6a')
-      assert.equal(await gemini.page.locator('button[aria-label="Stop response"]').count(), 0)
-      for (const unsafePath of ['/app/settings', '/app/settings123']) {
-        await gemini.page.evaluate((pathname) => {
-          history.replaceState({}, '', pathname)
-          const answers = [...document.querySelectorAll('response-container message-content')]
-          const answer = answers.at(-1)
-          if (answer) answer.textContent = 'Misleading Gemini settings answer'
-        }, unsafePath)
-        const blocked = await dispatchPostSubmitRead(gemini.page, request, submit.answerBaseline, proof)
-        assert.equal(blocked.status, 'blocked')
-        assert.equal(blocked.stopReason, 'target_context_mismatch')
-        assert.doesNotMatch(JSON.stringify(blocked), /Misleading Gemini settings answer/)
-      }
-      assert.deepEqual(gemini.pageErrors, [])
-    } finally {
-      await gemini.context.close()
-    }
-
-    const geminiChallengeBlocker = await openProviderFixture(
-      browser,
-      'https://gemini.google.com/app',
-      readText('test/fixtures/gemini-real-dom-fixture.html')
-    )
-    try {
-      await geminiChallengeBlocker.context.route(
-        'https://www.google.com/recaptcha/**',
-        (route) => route.fulfill({ status: 200, contentType: 'text/html', body: '<!doctype html>' })
-      )
-      await geminiChallengeBlocker.page.evaluate(() => {
-        const dialog = document.createElement('div')
-        dialog.setAttribute('role', 'dialog')
-        dialog.setAttribute('aria-modal', 'true')
-        dialog.setAttribute('aria-label', 'Complete the security challenge')
-
-        const challenge = document.createElement('iframe')
-        challenge.src = 'https://www.google.com/recaptcha/api2/anchor'
-        challenge.title = 'reCAPTCHA'
-        challenge.style.cssText = 'display:block;width:280px;height:80px;border:0'
-
-        dialog.append(challenge)
-        document.body.append(dialog)
-      })
-      const blocked = await geminiChallengeBlocker.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-        type: 'tokenless.bridge.submit',
-        request: {
-          provider: 'gemini',
-          requestId: 'gemini-visible-challenge-blocker',
-          targetUrl: 'https://gemini.google.com/app',
-          prompt: 'This prompt must not be submitted through a visible challenge.',
-          composerTimeoutMs: 100,
-          submitTimeoutMs: 100,
-        },
-      }))
-      assert.equal(blocked.status, 'blocked')
-      assert.equal(blocked.stopReason, 'provider_blocker_visible')
-      assert.equal(await geminiChallengeBlocker.page.locator('user-query').count(), 1)
-      assert.equal(await geminiChallengeBlocker.page.locator('button[aria-label="Send message"]').count(), 0)
-      assert.deepEqual(geminiChallengeBlocker.pageErrors, [])
-    } finally {
-      await geminiChallengeBlocker.context.close()
-    }
-
-    for (const driftTarget of ['composer', 'submit']) {
-      const geminiSelectorDrift = await openProviderFixture(
-        browser,
-        'https://gemini.google.com/app',
-        readText('test/fixtures/gemini-real-dom-fixture.html')
-      )
-      try {
-        await geminiSelectorDrift.page.evaluate((target) => {
-          if (target === 'composer') {
-            const composer = document.querySelector('rich-textarea .ql-editor')
-            composer.id = 'drifted-gemini-composer'
-            composer.removeAttribute('data-gramm')
-            composer.removeAttribute('aria-label')
-            composer.className = 'fixture-drifted-composer'
-            return
-          }
-
-          const sendSlot = document.querySelector('#send-slot')
-          const observer = new MutationObserver(() => {
-            const send = sendSlot.querySelector('button[aria-label="Send message"]')
-            if (!send) return
-            send.id = 'drifted-gemini-submit'
-            send.removeAttribute('aria-label')
-            observer.disconnect()
-          })
-          observer.observe(sendSlot, { childList: true })
-        }, driftTarget)
-        const blocked = await geminiSelectorDrift.page.evaluate((target) => globalThis.__dispatchTokenlessMessage({
-          type: 'tokenless.bridge.submit',
-          request: {
-            provider: 'gemini',
-            requestId: `gemini-${target}-selector-drift`,
-            targetUrl: 'https://gemini.google.com/app',
-            prompt: `This prompt must not pass the drifted Gemini ${target} contract.`,
-            composerTimeoutMs: 100,
-            submitTimeoutMs: 100,
-          },
-        }), driftTarget)
-        assert.equal(blocked.status, 'blocked')
-        assert.equal(blocked.stopReason, 'selector_drift')
-        assert.match(blocked.message, new RegExp(`Provider ${driftTarget} selector`))
-        assert.equal(await geminiSelectorDrift.page.locator('user-query').count(), 1)
-        assert.deepEqual(geminiSelectorDrift.pageErrors, [])
-      } finally {
-        await geminiSelectorDrift.context.close()
-      }
-    }
-
-    const geminiAnswerDrift = await openProviderFixture(
-      browser,
-      'https://gemini.google.com/app',
-      readText('test/fixtures/gemini-real-dom-fixture.html')
-    )
-    try {
-      const answerDriftRequest = {
-        provider: 'gemini',
-        requestId: 'gemini-answer-selector-drift',
-        targetUrl: 'https://gemini.google.com/app',
-        prompt: 'Answer selector contract drift.',
-        readTimeoutMs: 0,
-      }
-      const submit = await geminiAnswerDrift.page.evaluate((request) => globalThis.__dispatchTokenlessMessage({
-        type: 'tokenless.bridge.submit',
-        request: {
-          ...request,
-          composerTimeoutMs: 100,
-          submitTimeoutMs: 100,
-        },
-      }), answerDriftRequest)
-      assert.equal(submit.status, 'submitted')
-      await geminiAnswerDrift.page.waitForURL('https://gemini.google.com/app/4b9f2c7d1e6a')
-      await geminiAnswerDrift.page.evaluate(() => {
-        for (const answer of document.querySelectorAll('response-container message-content')) {
-          const drifted = document.createElement('div')
-          drifted.dataset.answerContract = 'drifted'
-          drifted.textContent = answer.textContent
-          answer.replaceWith(drifted)
-        }
-      })
-      const proof = postSubmitTransitionProof(
-        answerDriftRequest,
-        submit.answerBaseline,
-        'gemini-answer-drift-proof-001'
-      )
-      const blocked = await dispatchPostSubmitRead(
-        geminiAnswerDrift.page,
-        answerDriftRequest,
-        submit.answerBaseline,
-        proof
-      )
-      assert.equal(blocked.status, 'blocked')
-      assert.equal(blocked.stopReason, 'response_unavailable')
-      assert.doesNotMatch(JSON.stringify(blocked), /visible Gemini real-DOM fixture answer/)
-      assert.deepEqual(geminiAnswerDrift.pageErrors, [])
-    } finally {
-      await geminiAnswerDrift.context.close()
-    }
-
-    const grok = await openProviderFixture(
-      browser,
-      'https://grok.com/',
-      readText('test/fixtures/grok-real-dom-fixture.html')
-    )
-    try {
-      assert.equal(await grok.page.getByRole('button', { name: 'Sign in', exact: true }).isVisible(), true)
-      assert.equal(await grok.page.locator('button#model-select-trigger[aria-label="Model select"][aria-haspopup="menu"]').isVisible(), true)
-      assert.equal(await grok.page.locator('button[data-testid="attach-button"][aria-label="Attach"][aria-haspopup="menu"]').isVisible(), true)
-      assert.equal(await grok.page.locator('input[type="file"][name="files"][multiple]').count(), 1)
-      const request = {
-        provider: 'grok',
-        requestId: 'grok-conversation-transition',
-        targetUrl: 'https://grok.com/',
-        prompt: 'Start the visible Grok conversation.',
-        composerTimeoutMs: 100,
-        submitTimeoutMs: 100,
-        readTimeoutMs: 2000,
-      }
-      const submit = await grok.page.evaluate((contentRequest) => (
-        globalThis.__dispatchTokenlessMessage({ type: 'tokenless.bridge.submit', request: contentRequest })
-      ), request)
-      assert.equal(submit.status, 'submitted')
-      assert.deepEqual(submit.answerBaseline, {
-        count: 1,
-        lastText: 'stale Grok real-DOM fixture answer that must not be read',
-      })
-      assert.equal(await grok.page.locator('[data-testid="user-message"]').count(), 2)
-      assert.equal(
-        await grok.page.locator('[data-testid="user-message"]').last().textContent(),
-        'Start the visible Grok conversation.'
-      )
-      assert.equal(await grok.page.locator('button[data-testid="chat-submit"]').isDisabled(), true)
-      await grok.page.waitForURL('https://grok.com/c/123e4567-e89b-12d3-a456-426614174003')
-      const proof = postSubmitTransitionProof(request, submit.answerBaseline, 'grok-transition-proof-001')
-      const read = await dispatchPostSubmitRead(grok.page, request, submit.answerBaseline, proof)
-      assert.equal(read.status, 'read')
-      assert.equal(
-        read.text,
-        'visible Grok real-DOM fixture answer for: Start the visible Grok conversation.'
-      )
-      assert.doesNotMatch(read.text, /stale Grok real-DOM fixture answer/)
-      assert.equal(read.url, 'https://grok.com/c/123e4567-e89b-12d3-a456-426614174003')
-      for (const unsafePath of ['/c/settings', '/c/settings123']) {
-        await grok.page.evaluate((pathname) => {
-          history.replaceState({}, '', pathname)
-          const answer = document.querySelectorAll('[data-testid="assistant-message"]')
-          answer[answer.length - 1].textContent = 'Misleading Grok settings answer'
-        }, unsafePath)
-        const blocked = await dispatchPostSubmitRead(grok.page, request, submit.answerBaseline, proof)
-        assert.equal(blocked.status, 'blocked')
-        assert.equal(blocked.stopReason, 'target_context_mismatch')
-        assert.doesNotMatch(JSON.stringify(blocked), /Misleading Grok settings answer/)
-      }
-      assert.deepEqual(grok.pageErrors, [])
-    } finally {
-      await grok.context.close()
-    }
-
-    const grokTextarea = await openProviderFixture(
-      browser,
-      'https://grok.com/',
-      readText('test/fixtures/grok-real-dom-fixture.html')
-    )
-    try {
-      await grokTextarea.page.evaluate(() => {
-        const contenteditable = document.querySelector('div[aria-label="Ask Grok anything"]')
-        const textarea = document.createElement('textarea')
-        textarea.setAttribute('aria-label', 'Ask Grok anything')
-        textarea.placeholder = 'What do you want to know?'
-        contenteditable.replaceWith(textarea)
-      })
-      const request = {
-        provider: 'grok',
-        requestId: 'grok-textarea-composer',
-        targetUrl: 'https://grok.com/',
-        prompt: 'Use the observed Grok textarea composer.',
-        composerTimeoutMs: 100,
-        submitTimeoutMs: 100,
-        readTimeoutMs: 2000,
-      }
-      const submit = await grokTextarea.page.evaluate((contentRequest) => (
-        globalThis.__dispatchTokenlessMessage({ type: 'tokenless.bridge.submit', request: contentRequest })
-      ), request)
-      assert.equal(submit.status, 'submitted')
-      assert.equal(
-        await grokTextarea.page.locator('[data-testid="user-message"]').last().textContent(),
-        'Use the observed Grok textarea composer.'
-      )
-      await grokTextarea.page.waitForURL('https://grok.com/c/123e4567-e89b-12d3-a456-426614174003')
-      const proof = postSubmitTransitionProof(request, submit.answerBaseline, 'grok-textarea-proof-001')
-      const read = await dispatchPostSubmitRead(grokTextarea.page, request, submit.answerBaseline, proof)
-      assert.equal(read.status, 'read')
-      assert.equal(
-        read.text,
-        'visible Grok real-DOM fixture answer for: Use the observed Grok textarea composer.'
-      )
-      assert.deepEqual(grokTextarea.pageErrors, [])
-    } finally {
-      await grokTextarea.context.close()
-    }
-
-    const grokAnonymousPaywall = await openProviderFixture(
-      browser,
-      'https://grok.com/',
-      readText('test/fixtures/grok-real-dom-fixture.html')
-    )
-    try {
-      await grokAnonymousPaywall.page.evaluate(() => {
-        globalThis.__fixtureGrokAnonymousPaywallDelayMs = 200
-      })
-      const request = {
-        provider: 'grok',
-        requestId: 'grok-anonymous-paywall',
-        targetUrl: 'https://grok.com/',
-        prompt: 'Reach the visible anonymous Grok account gate.',
-        composerTimeoutMs: 100,
-        submitTimeoutMs: 100,
-        readTimeoutMs: 2000,
-      }
-      const submit = await grokAnonymousPaywall.page.evaluate((contentRequest) => (
-        globalThis.__dispatchTokenlessMessage({ type: 'tokenless.bridge.submit', request: contentRequest })
-      ), request)
-      assert.equal(submit.status, 'submitted')
-      assert.equal(await grokAnonymousPaywall.page.locator('[data-testid="user-message"]').count(), 2)
-      assert.equal(await grokAnonymousPaywall.page.locator('[data-testid="assistant-message"]').count(), 1)
-      const blockerWaitStartedAt = Date.now()
-      const blocked = await grokAnonymousPaywall.page.evaluate(({ contentRequest, answerBaseline }) => (
-        globalThis.__dispatchTokenlessMessage({
-          type: 'tokenless.bridge.read',
-          request: { ...contentRequest, answerBaseline },
-        })
-      ), { contentRequest: request, answerBaseline: submit.answerBaseline })
-      assert.equal(blocked.status, 'blocked')
-      assert.equal(blocked.stopReason, 'provider_blocker_visible')
-      assert.match(blocked.message, /Continue your conversation/)
-      assert.ok(Date.now() - blockerWaitStartedAt < 1500, 'late Grok paywall must interrupt answer waiting')
-      assert.deepEqual(grokAnonymousPaywall.pageErrors, [])
-    } finally {
-      await grokAnonymousPaywall.context.close()
-    }
-
-    for (const driftTarget of ['composer', 'submit']) {
-      const grokSelectorDrift = await openProviderFixture(
-        browser,
-        'https://grok.com/',
-        readText('test/fixtures/grok-real-dom-fixture.html')
-      )
-      try {
-        await grokSelectorDrift.page.evaluate((target) => {
-          if (target === 'composer') {
-            const composer = document.querySelector('div[aria-label="Ask Grok anything"]')
-            composer.id = 'drifted-grok-composer'
-            composer.className = 'fixture-drifted-composer'
-            composer.removeAttribute('aria-label')
-            composer.removeAttribute('aria-multiline')
-            composer.removeAttribute('role')
-            return
-          }
-          const send = document.querySelector('button[data-testid="chat-submit"]')
-          send.id = 'drifted-grok-submit'
-          send.removeAttribute('data-testid')
-          send.removeAttribute('aria-label')
-          send.removeAttribute('type')
-        }, driftTarget)
-        const blocked = await grokSelectorDrift.page.evaluate((target) => globalThis.__dispatchTokenlessMessage({
-          type: 'tokenless.bridge.submit',
-          request: {
-            provider: 'grok',
-            requestId: `grok-${target}-selector-drift`,
-            targetUrl: 'https://grok.com/',
-            prompt: `This prompt must not pass the drifted Grok ${target} contract.`,
-            composerTimeoutMs: 100,
-            submitTimeoutMs: 100,
-          },
-        }), driftTarget)
-        assert.equal(blocked.status, 'blocked')
-        assert.equal(blocked.stopReason, 'selector_drift')
-        assert.match(blocked.message, new RegExp(`Provider ${driftTarget} selector`))
-        assert.equal(await grokSelectorDrift.page.locator('[data-testid="user-message"]').count(), 1)
-        assert.deepEqual(grokSelectorDrift.pageErrors, [])
-      } finally {
-        await grokSelectorDrift.context.close()
-      }
-    }
-
-    const grokAnswerDrift = await openProviderFixture(
-      browser,
-      'https://grok.com/',
-      readText('test/fixtures/grok-real-dom-fixture.html')
-    )
-    try {
-      const answerDriftRequest = {
-        provider: 'grok',
-        requestId: 'grok-answer-selector-drift',
-        targetUrl: 'https://grok.com/',
-        prompt: 'Answer selector contract drift.',
-        readTimeoutMs: 0,
-      }
-      const submit = await grokAnswerDrift.page.evaluate((request) => globalThis.__dispatchTokenlessMessage({
-        type: 'tokenless.bridge.submit',
-        request: {
-          ...request,
-          composerTimeoutMs: 100,
-          submitTimeoutMs: 100,
-        },
-      }), answerDriftRequest)
-      assert.equal(submit.status, 'submitted')
-      await grokAnswerDrift.page.waitForURL('https://grok.com/c/123e4567-e89b-12d3-a456-426614174003')
-      await grokAnswerDrift.page.evaluate(() => {
-        for (const answer of document.querySelectorAll('[data-testid="assistant-message"]')) {
-          answer.dataset.testid = 'drifted-assistant-message'
-        }
-      })
-      const proof = postSubmitTransitionProof(
-        answerDriftRequest,
-        submit.answerBaseline,
-        'grok-answer-drift-proof-001'
-      )
-      const blocked = await dispatchPostSubmitRead(
-        grokAnswerDrift.page,
-        answerDriftRequest,
-        submit.answerBaseline,
-        proof
-      )
-      assert.equal(blocked.status, 'blocked')
-      assert.equal(blocked.stopReason, 'response_unavailable')
-      assert.doesNotMatch(JSON.stringify(blocked), /visible Grok real-DOM fixture answer/)
-      assert.deepEqual(grokAnswerDrift.pageErrors, [])
-    } finally {
-      await grokAnswerDrift.context.close()
-    }
-
-    const landingTransition = await openProviderFixture(browser, 'https://chatgpt.com/', `
-      <!doctype html>
-      <html>
-        <body>
-          <div id="landing-composer" role="textbox" contenteditable="true"></div>
-          <button id="landing-send" data-testid="send-button">Send</button>
-          <main id="answers"></main>
-          <script>
-            document.querySelector('#landing-send').addEventListener('click', () => {
-              history.pushState({}, '', '/c/123e4567-e89b-12d3-a456-426614174002?private-query-marker=yes#private-hash-marker')
-              const answer = document.createElement('div')
-              answer.setAttribute('data-message-author-role', 'assistant')
-              answer.textContent = 'Landing transition answer'
-              document.querySelector('#answers').append(answer)
-            })
-          </script>
-        </body>
-      </html>
-    `)
-    try {
-      const request = {
-        provider: 'chatgpt',
-        requestId: 'landing-transition',
-        targetUrl: 'https://chat.openai.com/',
-        prompt: 'Start a new conversation.',
-        composerTimeoutMs: 100,
-        submitTimeoutMs: 100,
-        readTimeoutMs: 2000,
-      }
-      const submit = await landingTransition.page.evaluate((contentRequest) => (
-        globalThis.__dispatchTokenlessMessage({ type: 'tokenless.bridge.submit', request: contentRequest })
-      ), request)
-      assert.equal(submit.status, 'submitted')
-      assert.equal(submit.url, 'https://chatgpt.com/c/123e4567-e89b-12d3-a456-426614174002')
-
-      const exactRead = await landingTransition.page.evaluate(({ contentRequest, answerBaseline }) => (
-        globalThis.__dispatchTokenlessMessage({
-          type: 'tokenless.bridge.read',
-          request: { ...contentRequest, answerBaseline },
-        })
-      ), { contentRequest: request, answerBaseline: submit.answerBaseline })
-      assert.equal(exactRead.status, 'blocked')
-      assert.equal(exactRead.stopReason, 'target_context_mismatch')
-
-      const transitionProof = postSubmitTransitionProof(request, submit.answerBaseline)
-      const transitionValidation = await dispatchPostSubmitValidation(
-        landingTransition.page,
-        request,
-        submit.answerBaseline,
-        transitionProof
-      )
-      assert.equal(transitionValidation.status, 'ready')
-      const read = await landingTransition.page.evaluate(({ contentRequest, answerBaseline, proof }) => (
-        globalThis.__dispatchTokenlessMessage({
-          type: 'tokenless.bridge.read',
-          request: {
-            ...contentRequest,
-            answerBaseline,
-            allowPostSubmitTargetTransition: true,
-            postSubmitTargetTransitionProof: proof,
-          },
-        })
-      ), { contentRequest: request, answerBaseline: submit.answerBaseline, proof: transitionProof })
-      assert.equal(read.status, 'read')
-      assert.equal(read.text, 'Landing transition answer')
-      assert.equal(read.url, 'https://chatgpt.com/c/123e4567-e89b-12d3-a456-426614174002')
-      assert.deepEqual(landingTransition.pageErrors, [])
-    } finally {
-      await landingTransition.context.close()
-    }
-
-    const customGptTransition = await openProviderFixture(browser, 'https://chatgpt.com/g/g-pmuQfob8d', `
-      <!doctype html>
-      <html>
-        <body>
-          <div role="textbox" contenteditable="true"></div>
-          <button data-testid="send-button">Send</button>
-          <main id="answers"></main>
-          <script>
-            document.querySelector('[data-testid="send-button"]').addEventListener('click', () => {
-              history.pushState({}, '', '/g/g-pmuQfob8d/c/123e4567-e89b-12d3-a456-426614174003')
-              const answer = document.createElement('div')
-              answer.setAttribute('data-message-author-role', 'assistant')
-              answer.textContent = 'Custom GPT conversation answer'
-              document.querySelector('#answers').append(answer)
-            })
-          </script>
-        </body>
-      </html>
-    `)
-    try {
-      const request = {
-        provider: 'chatgpt',
-        requestId: 'custom-gpt-transition',
-        targetUrl: 'https://chatgpt.com/g/g-pmuQfob8d',
-        prompt: 'Start the custom GPT conversation.',
-        composerTimeoutMs: 100,
-        submitTimeoutMs: 100,
-        readTimeoutMs: 2000,
-      }
-      const submit = await customGptTransition.page.evaluate((contentRequest) => (
-        globalThis.__dispatchTokenlessMessage({ type: 'tokenless.bridge.submit', request: contentRequest })
-      ), request)
-      const proof = postSubmitTransitionProof(request, submit.answerBaseline, 'custom-gpt-transition-proof')
-      const validation = await dispatchPostSubmitValidation(
-        customGptTransition.page,
-        request,
-        submit.answerBaseline,
-        proof
-      )
-      assert.equal(validation.status, 'ready')
-      const read = await customGptTransition.page.evaluate(({ contentRequest, answerBaseline, transitionProof }) => (
-        globalThis.__dispatchTokenlessMessage({
-          type: 'tokenless.bridge.read',
-          request: {
-            ...contentRequest,
-            answerBaseline,
-            allowPostSubmitTargetTransition: true,
-            postSubmitTargetTransitionProof: transitionProof,
-          },
-        })
-      ), { contentRequest: request, answerBaseline: submit.answerBaseline, transitionProof: proof })
-      assert.equal(read.status, 'read')
-      assert.equal(read.text, 'Custom GPT conversation answer')
-      assert.equal(read.url, 'https://chatgpt.com/g/g-pmuQfob8d/c/123e4567-e89b-12d3-a456-426614174003')
-      await customGptTransition.page.evaluate(() => {
-        history.replaceState({}, '', '/g/g-otherGPT9/c/123e4567-e89b-12d3-a456-426614174008')
-        const answer = document.querySelector('[data-message-author-role="assistant"]')
-        if (answer) answer.textContent = 'Mismatched custom GPT answer'
-      })
-      const mismatchedRead = await dispatchPostSubmitRead(
-        customGptTransition.page,
-        request,
-        submit.answerBaseline,
-        proof
-      )
-      assert.equal(mismatchedRead.status, 'blocked')
-      assert.equal(mismatchedRead.stopReason, 'target_context_mismatch')
-      assert.doesNotMatch(JSON.stringify(mismatchedRead), /Mismatched custom GPT answer/)
-      assert.deepEqual(customGptTransition.pageErrors, [])
-    } finally {
-      await customGptTransition.context.close()
-    }
-
-    const projectTransition = await openProviderFixture(
-      browser,
-      'https://chatgpt.com/g/g-p-12345678/project',
-      `
-        <!doctype html>
-        <html>
-          <body>
-            <div role="textbox" contenteditable="true"></div>
-            <button data-testid="send-button">Send</button>
-            <main id="answers"></main>
-            <script>
-              document.querySelector('[data-testid="send-button"]').addEventListener('click', () => {
-                history.pushState({}, '', '/g/g-p-12345678/c/123e4567-e89b-12d3-a456-426614174010')
-                const answer = document.createElement('div')
-                answer.setAttribute('data-message-author-role', 'assistant')
-                answer.textContent = 'Project-isolated conversation answer'
-                document.querySelector('#answers').append(answer)
-              })
-            </script>
-          </body>
-        </html>
-      `
-    )
-    try {
-      const request = {
-        provider: 'chatgpt',
-        requestId: 'project-transition',
-        targetUrl: 'https://chatgpt.com/g/g-p-12345678/project',
-        prompt: 'Start a project-isolated conversation.',
-        composerTimeoutMs: 100,
-        submitTimeoutMs: 100,
-        readTimeoutMs: 2000,
-      }
-      const submit = await projectTransition.page.evaluate((contentRequest) => (
-        globalThis.__dispatchTokenlessMessage({ type: 'tokenless.bridge.submit', request: contentRequest })
-      ), request)
-      assert.equal(submit.status, 'submitted')
-      const proof = postSubmitTransitionProof(request, submit.answerBaseline, 'project-transition-proof-001')
-      const validation = await dispatchPostSubmitValidation(
-        projectTransition.page,
-        request,
-        submit.answerBaseline,
-        proof
-      )
-      assert.equal(validation.status, 'ready')
-      const read = await dispatchPostSubmitRead(
-        projectTransition.page,
-        request,
-        submit.answerBaseline,
-        proof
-      )
-      assert.equal(read.status, 'read')
-      assert.equal(read.text, 'Project-isolated conversation answer')
-      await projectTransition.page.evaluate(() => {
-        history.replaceState({}, '', '/g/g-p-87654321/c/123e4567-e89b-12d3-a456-426614174011')
-        const answer = document.querySelector('[data-message-author-role="assistant"]')
-        if (answer) answer.textContent = 'Cross-project answer must remain private'
-      })
-      const crossProjectRead = await dispatchPostSubmitRead(
-        projectTransition.page,
-        request,
-        submit.answerBaseline,
-        proof
-      )
-      assert.equal(crossProjectRead.status, 'blocked')
-      assert.equal(crossProjectRead.stopReason, 'target_context_mismatch')
-      assert.doesNotMatch(JSON.stringify(crossProjectRead), /Cross-project answer must remain private/)
-      assert.deepEqual(projectTransition.pageErrors, [])
-    } finally {
-      await projectTransition.context.close()
-    }
-
-    const rootToCustomGpt = await openProviderFixture(browser, 'https://chatgpt.com/', `
-      <!doctype html>
-      <html>
-        <body>
-          <div role="textbox" contenteditable="true"></div>
-          <button data-testid="send-button">Send</button>
-          <main id="answers"></main>
-          <script>
-            document.querySelector('[data-testid="send-button"]').addEventListener('click', () => {
-              history.pushState({}, '', '/g/g-pmuQfob8d/c/123e4567-e89b-12d3-a456-426614174009')
-              const answer = document.createElement('div')
-              answer.setAttribute('data-message-author-role', 'assistant')
-              answer.textContent = 'Root to custom GPT answer'
-              document.querySelector('#answers').append(answer)
-            })
-          </script>
-        </body>
-      </html>
-    `)
-    try {
-      const request = {
-        provider: 'chatgpt',
-        requestId: 'root-to-custom-gpt',
-        targetUrl: 'https://chatgpt.com/',
-        prompt: 'Root may not authorize a custom GPT conversation.',
-        composerTimeoutMs: 100,
-        submitTimeoutMs: 100,
-        readTimeoutMs: 100,
-      }
-      const submit = await rootToCustomGpt.page.evaluate((contentRequest) => (
-        globalThis.__dispatchTokenlessMessage({ type: 'tokenless.bridge.submit', request: contentRequest })
-      ), request)
-      const proof = postSubmitTransitionProof(request, submit.answerBaseline, 'root-custom-negative-proof')
-      const read = await dispatchPostSubmitRead(rootToCustomGpt.page, request, submit.answerBaseline, proof)
-      assert.equal(read.status, 'blocked')
-      assert.equal(read.stopReason, 'target_context_mismatch')
-      assert.doesNotMatch(JSON.stringify(read), /Root to custom GPT answer/)
-      assert.deepEqual(rootToCustomGpt.pageErrors, [])
-    } finally {
-      await rootToCustomGpt.context.close()
-    }
-
-    const unsafeSpaTransition = await openProviderFixture(browser, 'https://chatgpt.com/', `
-      <!doctype html>
-      <html>
-        <body>
-          <div role="textbox" contenteditable="true"></div>
-          <button data-testid="send-button">Send</button>
-          <main id="answers"></main>
-          <script>
-            document.querySelector('[data-testid="send-button"]').addEventListener('click', () => {
-              history.pushState({}, '', '/c/settings')
-              const misleading = document.createElement('div')
-              misleading.setAttribute('data-message-author-role', 'assistant')
-              misleading.textContent = 'Misleading settings answer'
-              document.querySelector('#answers').append(misleading)
-            })
-          </script>
-        </body>
-      </html>
-    `)
-    try {
-      const request = {
-        provider: 'chatgpt',
-        requestId: 'unsafe-spa-transition',
-        targetUrl: 'https://chatgpt.com/',
-        prompt: 'Never authorize a settings page.',
-        composerTimeoutMs: 100,
-        submitTimeoutMs: 100,
-        readTimeoutMs: 100,
-      }
-      const submit = await unsafeSpaTransition.page.evaluate((contentRequest) => (
-        globalThis.__dispatchTokenlessMessage({ type: 'tokenless.bridge.submit', request: contentRequest })
-      ), request)
-      assert.equal(submit.status, 'submitted')
-      const proof = postSubmitTransitionProof(request, submit.answerBaseline, 'unsafe-spa-transition-proof')
-      const read = await unsafeSpaTransition.page.evaluate(({ contentRequest, answerBaseline, transitionProof }) => (
-        globalThis.__dispatchTokenlessMessage({
-          type: 'tokenless.bridge.read',
-          request: {
-            ...contentRequest,
-            answerBaseline,
-            allowPostSubmitTargetTransition: true,
-            postSubmitTargetTransitionProof: transitionProof,
-          },
-        })
-      ), { contentRequest: request, answerBaseline: submit.answerBaseline, transitionProof: proof })
-      assert.equal(read.status, 'blocked')
-      assert.equal(read.stopReason, 'target_context_mismatch')
-      assert.doesNotMatch(JSON.stringify(read), /Misleading settings answer/)
-      await unsafeSpaTransition.page.evaluate(() => {
-        history.replaceState({}, '', '/c/settings123')
-      })
-      const suffixedRead = await dispatchPostSubmitRead(
-        unsafeSpaTransition.page,
-        request,
-        submit.answerBaseline,
-        proof
-      )
-      assert.equal(suffixedRead.status, 'blocked')
-      assert.equal(suffixedRead.stopReason, 'target_context_mismatch')
-      assert.doesNotMatch(JSON.stringify(suffixedRead), /Misleading settings answer/)
-      assert.deepEqual(unsafeSpaTransition.pageErrors, [])
-    } finally {
-      await unsafeSpaTransition.context.close()
-    }
-
-    const fullNavigation = await openProviderFixture(browser, 'https://chat.openai.com/', `
-      <!doctype html>
-      <html>
-        <body>
-          <div role="textbox" contenteditable="true"></div>
-          <button data-testid="send-button">Send</button>
-          <script>
-            document.querySelector('[data-testid="send-button"]').addEventListener('click', (event) => {
-              event.currentTarget.disabled = true
-              event.currentTarget.setAttribute('aria-disabled', 'true')
-              setTimeout(() => {
-                location.assign('https://chatgpt.com/c/123e4567-e89b-12d3-a456-426614174004?navigation-secret=yes#navigation-secret')
-              }, 25)
-            })
-          </script>
-        </body>
-      </html>
-    `)
-    try {
-      await fullNavigation.context.route('https://chatgpt.com/**', (route) => route.fulfill({
-        status: 200,
-        contentType: 'text/html',
-        body: `
-          <!doctype html>
-          <html>
-            <body>
-              <div role="textbox" contenteditable="true"></div>
-              <button data-testid="send-button">Send</button>
-              <div data-message-author-role="assistant">Full navigation answer</div>
-            </body>
-          </html>
-        `,
-      }))
-      const request = {
-        provider: 'chatgpt',
-        requestId: 'full-navigation-transition',
-        targetUrl: 'https://chat.openai.com/',
-        prompt: 'Navigate across the ChatGPT landing alias.',
-        composerTimeoutMs: 100,
-        submitTimeoutMs: 100,
-        readTimeoutMs: 2000,
-      }
-      const navigation = fullNavigation.page.waitForURL('https://chatgpt.com/c/123e4567-e89b-12d3-a456-426614174004?navigation-secret=yes#navigation-secret')
-      const submit = await fullNavigation.page.evaluate((contentRequest) => (
-        globalThis.__dispatchTokenlessMessage({ type: 'tokenless.bridge.submit', request: contentRequest })
-      ), request)
-      assert.equal(submit.status, 'submitted')
-      await navigation
-      await fullNavigation.page.addScriptTag({
-        path: path.join(extensionDist, 'content/provider-content.js'),
-      })
-      const proof = postSubmitTransitionProof(request, submit.answerBaseline, 'full-navigation-proof-0001')
-      const transitionValidation = await dispatchPostSubmitValidation(
-        fullNavigation.page,
-        request,
-        submit.answerBaseline,
-        proof
-      )
-      assert.equal(transitionValidation.status, 'ready')
-      const read = await fullNavigation.page.evaluate(({ contentRequest, answerBaseline, transitionProof }) => (
-        globalThis.__dispatchTokenlessMessage({
-          type: 'tokenless.bridge.read',
-          request: {
-            ...contentRequest,
-            answerBaseline,
-            allowPostSubmitTargetTransition: true,
-            postSubmitTargetTransitionProof: transitionProof,
-          },
-        })
-      ), { contentRequest: request, answerBaseline: submit.answerBaseline, transitionProof: proof })
-      assert.equal(read.status, 'read')
-      assert.equal(read.text, 'Full navigation answer')
-      assert.equal(read.url, 'https://chatgpt.com/c/123e4567-e89b-12d3-a456-426614174004')
-      await fullNavigation.page.evaluate(() => {
-        document.querySelector('[role="textbox"]')?.remove()
-        document.querySelector('[data-testid="send-button"]')?.remove()
-        const answer = document.querySelector('[data-message-author-role="assistant"]')
-        if (answer) answer.textContent = 'Misleading answer without a composer'
-      })
-      const missingSurfaceRequest = { ...request, landingTimeoutMs: 100 }
-      const missingSurfaceValidation = await dispatchPostSubmitValidation(
-        fullNavigation.page,
-        missingSurfaceRequest,
-        submit.answerBaseline,
-        proof
-      )
-      assert.equal(missingSurfaceValidation.status, 'blocked')
-      assert.equal(missingSurfaceValidation.stopReason, 'provider_landing_unavailable')
-      const missingSurfaceRead = await dispatchPostSubmitRead(
-        fullNavigation.page,
-        request,
-        submit.answerBaseline,
-        proof
-      )
-      assert.equal(missingSurfaceRead.status, 'blocked')
-      assert.equal(missingSurfaceRead.stopReason, 'post_submit_surface_unavailable')
-      assert.doesNotMatch(JSON.stringify(missingSurfaceRead), /Misleading answer without a composer/)
-      assert.deepEqual(fullNavigation.pageErrors, [])
-    } finally {
-      await fullNavigation.context.close()
-    }
-
-    const unsafeFullNavigation = await openProviderFixture(browser, 'https://chat.openai.com/', `
-      <!doctype html>
-      <html>
-        <body>
-          <div role="textbox" contenteditable="true"></div>
-          <button data-testid="send-button">Send</button>
-          <script>
-            document.querySelector('[data-testid="send-button"]').addEventListener('click', (event) => {
-              event.currentTarget.disabled = true
-              event.currentTarget.setAttribute('aria-disabled', 'true')
-              setTimeout(() => {
-                location.assign('https://chatgpt.com/auth/login')
-              }, 25)
-            })
-          </script>
-        </body>
-      </html>
-    `)
-    try {
-      await unsafeFullNavigation.context.route('https://chatgpt.com/**', (route) => route.fulfill({
-        status: 200,
-        contentType: 'text/html',
-        body: `
-          <!doctype html>
-          <html>
-            <body>
-              <div data-message-author-role="assistant">Misleading login answer</div>
-            </body>
-          </html>
-        `,
-      }))
-      const request = {
-        provider: 'chatgpt',
-        requestId: 'unsafe-full-navigation',
-        targetUrl: 'https://chat.openai.com/',
-        prompt: 'Never authorize a login page.',
-        composerTimeoutMs: 100,
-        submitTimeoutMs: 100,
-        readTimeoutMs: 100,
-      }
-      const navigation = unsafeFullNavigation.page.waitForURL('https://chatgpt.com/auth/login')
-      const submit = await unsafeFullNavigation.page.evaluate((contentRequest) => (
-        globalThis.__dispatchTokenlessMessage({ type: 'tokenless.bridge.submit', request: contentRequest })
-      ), request)
-      assert.equal(submit.status, 'submitted')
-      await navigation
-      await unsafeFullNavigation.page.addScriptTag({
-        path: path.join(extensionDist, 'content/provider-content.js'),
-      })
-      const proof = postSubmitTransitionProof(request, submit.answerBaseline, 'unsafe-full-navigation-proof')
-      const read = await unsafeFullNavigation.page.evaluate(({ contentRequest, answerBaseline, transitionProof }) => (
-        globalThis.__dispatchTokenlessMessage({
-          type: 'tokenless.bridge.read',
-          request: {
-            ...contentRequest,
-            answerBaseline,
-            allowPostSubmitTargetTransition: true,
-            postSubmitTargetTransitionProof: transitionProof,
-          },
-        })
-      ), { contentRequest: request, answerBaseline: submit.answerBaseline, transitionProof: proof })
-      assert.equal(read.status, 'blocked')
-      assert.equal(read.stopReason, 'target_context_mismatch')
-      assert.doesNotMatch(JSON.stringify(read), /Misleading login answer/)
-      assert.deepEqual(unsafeFullNavigation.pageErrors, [])
-    } finally {
-      await unsafeFullNavigation.context.close()
-    }
-
-    const conversationTransition = await openProviderFixture(browser, 'https://chatgpt.com/c/existing', `
-      <!doctype html>
-      <html>
-        <body>
-          <div role="textbox" contenteditable="true"></div>
-          <button data-testid="send-button">Send</button>
-          <main id="answers"></main>
-          <script>
-            document.querySelector('[data-testid="send-button"]').addEventListener('click', () => {
-              history.pushState({}, '', '/c/unexpected-conversation')
-              const answer = document.createElement('div')
-              answer.setAttribute('data-message-author-role', 'assistant')
-              answer.textContent = 'Must remain blocked'
-              document.querySelector('#answers').append(answer)
-            })
-          </script>
-        </body>
-      </html>
-    `)
-    try {
-      const request = {
-        provider: 'chatgpt',
-        requestId: 'conversation-transition',
-        targetUrl: 'https://chatgpt.com/c/existing',
-        prompt: 'Stay in this conversation.',
-        composerTimeoutMs: 100,
-        submitTimeoutMs: 100,
-        readTimeoutMs: 100,
-      }
-      const submit = await conversationTransition.page.evaluate((contentRequest) => (
-        globalThis.__dispatchTokenlessMessage({ type: 'tokenless.bridge.submit', request: contentRequest })
-      ), request)
-      assert.equal(submit.status, 'submitted')
-      const transitionProof = postSubmitTransitionProof(request, submit.answerBaseline)
-      const read = await conversationTransition.page.evaluate(({ contentRequest, answerBaseline, proof }) => (
-        globalThis.__dispatchTokenlessMessage({
-          type: 'tokenless.bridge.read',
-          request: {
-            ...contentRequest,
-            answerBaseline,
-            allowPostSubmitTargetTransition: true,
-            postSubmitTargetTransitionProof: proof,
-          },
-        })
-      ), { contentRequest: request, answerBaseline: submit.answerBaseline, proof: transitionProof })
-      assert.equal(read.status, 'blocked')
-      assert.equal(read.stopReason, 'target_context_mismatch')
-      assert.deepEqual(conversationTransition.pageErrors, [])
-    } finally {
-      await conversationTransition.context.close()
-    }
-  } finally {
-    await browser.close()
-  }
-})
-
-test('provider reads return only visible external citations from the final assistant answer', { timeout: 30000 }, async () => {
-  const { chromium } = await import('playwright')
-  const browser = await chromium.launch({ headless: true })
-  const chatgpt = await openProviderFixture(browser, 'https://chatgpt.com/c/123e4567-e89b-12d3-a456-426614174005', `
-    <!doctype html>
-    <html><body>
-      <div data-message-author-role="assistant">
-        Latest visible research answer.
-        <a href="https://www.reddit.com/r/OpenAI/comments/abc123/latest/?utm_source=chatgpt.com&keep=yes#citation">Reddit evidence</a>
-        <a href="https://www.reddit.com/r/OpenAI/comments/abc123/latest/?keep=yes">Duplicate source</a>
-        <a href="https://chatgpt.com/c/private-conversation">Internal provider link</a>
-        <a href="http://example.com/not-https">Insecure source</a>
-      </div>
-    </body></html>
-  `)
-  try {
-    const read = await chatgpt.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-      type: 'tokenless.bridge.read',
-      request: {
-        provider: 'chatgpt',
-        requestId: 'visible-external-citations',
-        readTimeoutMs: 2000,
-      },
-    }))
-    assert.equal(read.status, 'read')
-    assert.equal(read.text, 'Latest visible research answer. Reddit evidence Duplicate source Internal provider link Insecure source')
-    assert.deepEqual(read.sources, [{
-      url: 'https://www.reddit.com/r/OpenAI/comments/abc123/latest/?keep=yes',
-      title: 'Reddit evidence',
-      domain: 'www.reddit.com',
-    }])
-    assert.deepEqual(chatgpt.pageErrors, [])
-  } finally {
-    await chatgpt.context.close()
-    await browser.close()
-  }
-})
-
-test('ChatGPT controls inventory dynamic visible labels and fail closed before submission', { timeout: 30000 }, async () => {
-  const { chromium } = await import('playwright')
-  const browser = await chromium.launch({ headless: true })
-  const chatgpt = await openProviderFixture(browser, 'https://chatgpt.com/', `
-    <!doctype html>
-    <html><body>
-      <div role="banner">
-        <div id="surface-toggle">
-          <button role="radio" aria-checked="false" data-state="off">聊天</button>
-          <button role="radio" aria-checked="true" data-state="on">工作</button>
-        </div>
-      </div>
-      <main>
-        <button id="worked" aria-expanded="false" aria-haspopup="menu" style="position: fixed; right: 4px; top: 4px">已工作 31 秒</button>
-        <div id="prompt-textarea" role="textbox" contenteditable="true" style="height: 42px; width: 600px"></div>
-        <button id="intelligence" aria-expanded="false" aria-haspopup="menu">中等</button>
-        <button data-testid="send-button" disabled>发送</button>
-      </main>
-      <script>
-        const radios = [...document.querySelectorAll('[role="radio"]')]
-        radios.forEach((radio, selectedIndex) => radio.addEventListener('click', () => {
-          radios.forEach((candidate, index) => {
-            const selected = index === selectedIndex
-            candidate.setAttribute('aria-checked', String(selected))
-            candidate.setAttribute('data-state', selected ? 'on' : 'off')
-          })
-        }))
-        const composer = document.querySelector('#prompt-textarea')
-        const send = document.querySelector('[data-testid="send-button"]')
-        composer.addEventListener('input', () => { send.disabled = composer.textContent.trim().length === 0 })
-        send.addEventListener('click', () => {
-          send.disabled = true
-          send.setAttribute('aria-disabled', 'true')
-        })
-        const trigger = document.querySelector('#intelligence')
-        const decoy = document.querySelector('#worked')
-        let model = 'GPT-5.6 Sol'
-        let effort = 1
-        const effortLabels = ['Instant', 'Medium', 'High']
-        const closeMenus = () => document.querySelectorAll('[role="menu"]').forEach((menu) => menu.remove())
-        document.addEventListener('keydown', (event) => { if (event.key === 'Escape') closeMenus() })
-        function updateTrigger() {
-          trigger.textContent = model === 'GPT-5.6 Sol' ? effortLabels[effort] : model.replace('GPT-', '') + ' ' + effortLabels[effort]
-          trigger.setAttribute('aria-expanded', 'false')
-        }
-        function modelMenu(parent) {
-          const menu = document.createElement('div')
-          menu.setAttribute('role', 'menu')
-          for (const candidate of ['GPT-5.6 Sol', 'GPT-5.5', 'o3']) {
-            const item = document.createElement('button')
-            item.setAttribute('role', 'menuitemradio')
-            item.setAttribute('aria-checked', String(candidate === model))
-            item.textContent = candidate
-            item.addEventListener('click', () => { model = candidate; closeMenus(); updateTrigger() })
-            menu.append(item)
-          }
-          document.body.append(menu)
-          return menu
-        }
-        function intelligenceMenu() {
-          closeMenus()
-          const menu = document.createElement('div')
-          menu.setAttribute('role', 'menu')
-          menu.setAttribute('aria-labelledby', trigger.id)
-          for (const [index, label] of effortLabels.entries()) {
-            const item = document.createElement('button')
-            item.setAttribute('role', 'menuitemradio')
-            item.setAttribute('aria-checked', String(index === effort))
-            item.textContent = label
-            item.addEventListener('click', () => { effort = index; closeMenus(); updateTrigger() })
-            menu.append(item)
-          }
-          const submenu = document.createElement('button')
-          submenu.setAttribute('role', 'menuitem')
-          submenu.setAttribute('aria-haspopup', 'menu')
-          submenu.textContent = model
-          submenu.addEventListener('click', () => modelMenu(menu))
-          menu.append(submenu)
-          document.body.append(menu)
-        }
-        trigger.addEventListener('click', intelligenceMenu)
-        decoy.addEventListener('click', () => { throw new Error('The worked-time menu is not the Intelligence control.') })
-        updateTrigger()
-      </script>
-    </body></html>
-  `)
-  try {
-    const inspect = await chatgpt.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-      type: 'tokenless.bridge.inspect_controls',
-      request: { provider: 'chatgpt', requestId: 'controls-inspect' },
-    }))
-    assert.equal(inspect.status, 'inspected')
-    assert.deepEqual(inspect.controls.efforts.map((item) => item.id), ['instant', 'medium', 'high'])
-    assert.deepEqual(inspect.controls.efforts.map((item) => item.available), [true, true, true])
-    assert.deepEqual(inspect.controls.models.map((item) => item.label), ['GPT-5.6 Sol', 'GPT-5.5', 'o3'])
-    const legacyInspect = await chatgpt.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-      type: 'tokenless.bridge.inspect_chatgpt_controls',
-      request: { provider: 'chatgpt', requestId: 'controls-legacy-inspect' },
-    }))
-    assert.deepEqual(legacyInspect.controls.models.map((item) => item.label), ['GPT-5.6 Sol', 'GPT-5.5', 'o3'])
-
-    const configure = await chatgpt.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-      type: 'tokenless.bridge.configure_controls',
-      request: {
-        provider: 'chatgpt',
-        requestId: 'controls-configure',
-        chatSurface: 'chat',
-        model: 'GPT-5.4',
-        modelFallbacks: ['GPT-5.5'],
-        effort: 'High',
-      },
-    }))
-    assert.equal(configure.status, 'configured')
-    assert.equal(configure.surface.status, 'chat_selected')
-    assert.equal(configure.model.status, 'fallback_selected')
-    assert.equal(configure.model.applied, 'GPT-5.5')
-    assert.equal(configure.effort.status, 'selected')
-    assert.equal(configure.effort.applied, 'High')
-    assert.equal(await chatgpt.page.locator('[role="radio"]').nth(0).getAttribute('aria-checked'), 'true')
-    assert.match(await chatgpt.page.locator('#intelligence').innerText(), /5\.5/)
-
-    const submit = await chatgpt.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-      type: 'tokenless.bridge.submit',
-      request: {
-        provider: 'chatgpt',
-        requestId: 'controls-submit',
-        prompt: 'This prompt must not be submitted with an unavailable model.',
-        chatSurface: 'chat',
-        model: 'GPT-5',
-        effort: 'High',
-        composerTimeoutMs: 100,
-        submitTimeoutMs: 100,
-      },
-    }))
-    assert.equal(submit.status, 'blocked')
-    assert.equal(submit.stopReason, 'model_control_unavailable')
-    assert.equal(submit.model.status, 'unavailable')
-    assert.equal(await chatgpt.page.locator('#prompt-textarea').textContent(), '')
-    assert.match(await chatgpt.page.locator('#intelligence').innerText(), /5\.5/)
-    assert.deepEqual(chatgpt.pageErrors, [])
-  } finally {
-    await chatgpt.context.close()
-    await browser.close()
-  }
-})
-
-test('generic controls report unavailable and block model selection when a provider adapter has no model DOM contract', { timeout: 30000 }, async () => {
-  const { chromium } = await import('playwright')
-  const browser = await chromium.launch({ headless: true })
-  const gemini = await openProviderFixture(browser, 'https://gemini.google.com/app', `
-    <!doctype html><html><body>
-      <rich-textarea><div class="ql-editor" data-gramm="false" contenteditable="true" role="textbox" aria-multiline="true" aria-label="Enter a prompt for Gemini"></div></rich-textarea>
-      <button aria-label="Send message">Send</button>
-    </body></html>
-  `)
-  try {
-    const inspect = await gemini.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-      type: 'tokenless.bridge.inspect_controls',
-      request: { provider: 'gemini', requestId: 'gemini-controls-inspect' },
-    }))
-    assert.equal(inspect.status, 'inspected')
-    assert.equal(inspect.controls.available, false)
-
-    const configure = await gemini.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-      type: 'tokenless.bridge.configure_controls',
-      request: { provider: 'gemini', requestId: 'gemini-controls-configure', model: 'Flash' },
-    }))
-    assert.equal(configure.status, 'blocked')
-    assert.equal(configure.stopReason, 'model_control_unavailable')
-
-    const submit = await gemini.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-      type: 'tokenless.bridge.submit',
-      request: {
-        provider: 'gemini',
-        requestId: 'gemini-controls-submit',
-        model: 'Flash',
-        prompt: 'Must remain out of the composer.',
-      },
-    }))
-    assert.equal(submit.status, 'blocked')
-    assert.equal(submit.stopReason, 'model_control_unavailable')
-    assert.equal(await gemini.page.locator('[role="textbox"]').textContent(), '')
-    assert.deepEqual(gemini.pageErrors, [])
-  } finally {
-    await gemini.context.close()
-    await browser.close()
-  }
-})
-
-test('Gemini and Grok model adapters inventory real DOM labels, switch visibly, and require exact matches', { timeout: 30000 }, async () => {
-  const { chromium } = await import('playwright')
-  const browser = await chromium.launch({ headless: true })
-  const gemini = await openProviderFixture(
-    browser,
-    'https://gemini.google.com/app',
-    readText('test/fixtures/gemini-real-dom-fixture.html')
-  )
-  const grok = await openProviderFixture(
-    browser,
-    'https://grok.com/',
-    readText('test/fixtures/grok-real-dom-fixture.html')
-  )
-  try {
-    await gemini.page.evaluate(() => {
-      globalThis.__fixtureGeminiEnabledModels = ['3.5 Flash', '3.5 Thinking', '3.1 Pro']
-    })
-    const geminiInspect = await gemini.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-      type: 'tokenless.bridge.inspect_controls',
-      request: { provider: 'gemini', requestId: 'gemini-model-inspect' },
-    }))
-    assert.deepEqual(
-      geminiInspect.controls.models.map(({ label, selected, available }) => ({ label, selected, available })),
-      [
-        { label: '3.5 Flash', selected: true, available: true },
-        { label: '3.5 Thinking', selected: false, available: true },
-        { label: '3.1 Pro', selected: false, available: true },
-      ]
-    )
-    assert.deepEqual(
-      geminiInspect.controls.efforts.map(({ label, selected, available }) => ({ label, selected, available })),
-      [{ label: 'Extended thinking', selected: false, available: true }]
-    )
-    const geminiSelection = await gemini.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-      type: 'tokenless.bridge.configure_controls',
-      request: { provider: 'gemini', requestId: 'gemini-model-select', model: '3.5 thinking' },
-    }))
-    assert.equal(geminiSelection.status, 'configured')
-    assert.equal(geminiSelection.model.status, 'selected')
-    assert.equal(geminiSelection.model.applied, '3.5 Thinking')
-    assert.equal(await gemini.page.locator('[data-test-id="bard-mode-menu-button"]').innerText(), 'Thinking')
-
-    const geminiEffort = await gemini.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-      type: 'tokenless.bridge.configure_controls',
-      request: { provider: 'gemini', requestId: 'gemini-effort-select', effort: 'extended thinking' },
-    }))
-    assert.equal(geminiEffort.status, 'configured')
-    assert.equal(geminiEffort.effort.status, 'selected')
-    assert.equal(geminiEffort.effort.applied, 'Extended thinking')
-
-    const geminiEffortInspect = await gemini.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-      type: 'tokenless.bridge.inspect_controls',
-      request: { provider: 'gemini', requestId: 'gemini-effort-inspect' },
-    }))
-    assert.equal(geminiEffortInspect.controls.efforts[0].selected, true)
-
-    const geminiExactFailure = await gemini.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-      type: 'tokenless.bridge.configure_controls',
-      request: { provider: 'gemini', requestId: 'gemini-model-exact', model: '3.5' },
-    }))
-    assert.equal(geminiExactFailure.status, 'blocked')
-    assert.equal(geminiExactFailure.stopReason, 'model_control_unavailable')
-
-    const grokInspect = await grok.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-      type: 'tokenless.bridge.inspect_controls',
-      request: { provider: 'grok', requestId: 'grok-model-inspect' },
-    }))
-    assert.deepEqual(grokInspect.controls.models.map((model) => model.label), ['Fast', 'Auto', 'Expert', 'Heavy'])
-    assert.equal(grokInspect.controls.models.find((model) => model.label === 'Fast')?.selected, true)
-
-    const grokSelection = await grok.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-      type: 'tokenless.bridge.configure_controls',
-      request: { provider: 'grok', requestId: 'grok-model-select', model: 'heavy' },
-    }))
-    assert.equal(grokSelection.status, 'configured')
-    assert.equal(grokSelection.model.status, 'selected')
-    assert.equal(grokSelection.model.applied, 'Heavy')
-    assert.equal(await grok.page.locator('#model-select-trigger').innerText(), 'Heavy')
-
-    const grokFallback = await grok.page.evaluate(() => globalThis.__dispatchTokenlessMessage({
-      type: 'tokenless.bridge.configure_controls',
-      request: {
-        provider: 'grok',
-        requestId: 'grok-model-fallback',
-        model: 'Not a visible model',
-        modelFallbacks: ['auto'],
-      },
-    }))
-    assert.equal(grokFallback.status, 'configured')
-    assert.equal(grokFallback.model.status, 'fallback_selected')
-    assert.equal(grokFallback.model.applied, 'Auto')
-    assert.equal(await grok.page.locator('#model-select-trigger').innerText(), 'Auto')
-    assert.deepEqual(gemini.pageErrors, [])
-    assert.deepEqual(grok.pageErrors, [])
-  } finally {
-    await gemini.context.close()
-    await grok.context.close()
-    await browser.close()
-  }
-})
-
-test('background enables the Settings side panel and jobs create only approved provider tabs', async () => {
-  const previousChrome = globalThis.chrome
-  const installed = createChromeEvent()
-  const startup = createChromeEvent()
-  const runtimeMessage = createChromeEvent()
-  const ports = []
-  const createdTabs = []
-  const providerMessages = []
-  const sidePanelCalls = []
-  let nextTabId = 1
-  const unifiedAttachmentDescriptor = {
-    protocol: 'tokenless.visible-attachment.v1',
-    bundleId: 'unified-native-bundle',
-    attachmentId: 'unified-native-file',
-    name: 'unified-evidence.txt',
-    type: 'text/plain',
-    size: 5,
-    sha256: '2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824',
-  }
-
-  function connectNative(name) {
-    assert.equal(name, 'dev.tokenless.native_host')
-    const port = createNativePort()
-    ports.push(port)
-    return port
-  }
-
-  function createNativePort() {
-    const onMessage = createChromeEvent()
-    const onDisconnect = createChromeEvent()
-    const posted = []
-    return {
-      onMessage,
-      onDisconnect,
-      posted,
-      postMessage(message) {
-        posted.push(message)
-        if (message.type === 'tokenless.native.attachment_open') {
-          queueMicrotask(() => {
-            void onMessage.emit(nativeSuccess(message.type, {
-              ...unifiedAttachmentDescriptor,
-              handleId: 'unifiedhandle',
-              maxChunkBytes: 65536,
-            }, message.requestId))
-          })
-        } else if (message.type === 'tokenless.native.attachment_read') {
-          queueMicrotask(() => {
-            void onMessage.emit(nativeSuccess(message.type, {
-              handleId: 'unifiedhandle',
-              offset: 0,
-              dataBase64: 'aGVsbG8=',
-              nextOffset: 5,
-              eof: true,
-            }, message.requestId))
-          })
-        } else if (message.type === 'tokenless.native.attachment_close') {
-          queueMicrotask(() => {
-            void onMessage.emit(nativeSuccess(message.type, {
-              handleId: 'unifiedhandle',
-              status: 'closed',
-            }, message.requestId))
-          })
-        } else if (message.type === 'tokenless.native.daemon_ready') {
-          queueMicrotask(() => {
-            void onMessage.emit(nativeSuccess(message.type, {
-              status: 'ready',
-              jobId: message.jobId,
-            }, message.requestId))
-          })
-        } else if (message.type === 'tokenless.native.daemon_complete_job') {
-          queueMicrotask(() => {
-            void onMessage.emit({
-              protocol: 'tokenless.native.v1',
-              type: message.type,
-              ok: true,
-              result: {
-                job_id: message.jobId,
-                provider: 'chatgpt',
-                action: 'submit_and_read',
-                status: message.error ? 'failed' : 'succeeded',
-              },
-            })
-          })
-        }
-      },
-      disconnect() {},
-    }
-  }
-
-  globalThis.chrome = {
-    runtime: {
-      onMessage: runtimeMessage,
-      onInstalled: installed,
-      onStartup: startup,
-      connectNative,
-      lastError: undefined,
-    },
-    sidePanel: {
-      async setPanelBehavior(options) {
-        sidePanelCalls.push(options)
-      },
-    },
-    scripting: {
-      async executeScript() {
-        throw new Error('content script should already be available in this contract test')
-      },
-    },
-    tabs: {
-      async query() {
-        return []
-      },
-      async create(details) {
-        const tab = {
-          id: nextTabId,
-          windowId: 1,
-          active: Boolean(details.active),
-          status: 'complete',
-          url: String(details.url),
-        }
-        nextTabId += 1
-        createdTabs.push(tab)
-        return tab
-      },
-      async get(tabId) {
-        return createdTabs.find((tab) => tab.id === tabId)
-      },
-      async update(tabId, details) {
-        const tab = createdTabs.find((candidate) => candidate.id === tabId)
-        if (tab) Object.assign(tab, details)
-        return tab
-      },
-      async sendMessage(tabId, message) {
-        providerMessages.push({ tabId, message })
-        if (message.type === 'tokenless.bridge.validate_landing') {
-          if (message.request?.requestId === 'job-provider-drift') {
-            const tab = createdTabs.find((candidate) => candidate.id === tabId)
-            if (tab) tab.url = 'https://gemini.google.com/app'
-          }
-          if (message.request?.requestId === 'job-chatgpt-alias-transition') {
-            const tab = createdTabs.find((candidate) => candidate.id === tabId)
-            if (tab) tab.url = 'https://chatgpt.com/'
-          }
-          return { status: 'ready' }
-        }
-        if (message.type === 'tokenless.bridge.submit') {
-          if (message.request?.requestId === 'job-visible-provider') {
-            const tab = createdTabs.find((candidate) => candidate.id === tabId)
-            if (tab) tab.url = 'https://chatgpt.com/c/123e4567-e89b-12d3-a456-426614174002?private-query=yes#private-hash'
-          }
-          if (message.request?.requestId === 'job-chatgpt-alias-transition') {
-            const tab = createdTabs.find((candidate) => candidate.id === tabId)
-            if (tab) tab.url = 'https://chatgpt.com/c/123e4567-e89b-12d3-a456-426614174005'
-          }
-          if (message.request?.requestId === 'job-unsafe-provider-path') {
-            const tab = createdTabs.find((candidate) => candidate.id === tabId)
-            if (tab) tab.url = 'https://chatgpt.com/c/settings123'
-          }
-          if (message.request?.requestId === 'job-custom-gpt-transition') {
-            const tab = createdTabs.find((candidate) => candidate.id === tabId)
-            if (tab) tab.url = 'https://chatgpt.com/g/g-pmuQfob8d/c/123e4567-e89b-12d3-a456-426614174010'
-          }
-          if (message.request?.requestId === 'job-custom-gpt-mismatch') {
-            const tab = createdTabs.find((candidate) => candidate.id === tabId)
-            if (tab) tab.url = 'https://chatgpt.com/g/g-otherGPT9/c/123e4567-e89b-12d3-a456-426614174011'
-          }
-          if (message.request?.requestId === 'job-root-custom-mismatch') {
-            const tab = createdTabs.find((candidate) => candidate.id === tabId)
-            if (tab) tab.url = 'https://chatgpt.com/g/g-pmuQfob8d/c/123e4567-e89b-12d3-a456-426614174012'
-          }
-          return {
-            status: 'submitted',
-            answerBaseline: { count: 1, lastText: 'old-private-answer-marker' },
-          }
-        }
-        if (message.type === 'tokenless.bridge.read') {
-          return {
-            status: 'complete',
-            provider: 'chatgpt',
-            text: 'Visible DOM answer',
-            url: 'https://chatgpt.com/',
-          }
-        }
-        if (message.type === 'tokenless.bridge.inspect_auth') {
-          return {
-            status: 'inspected',
-            provider: message.request.provider,
-            visible: true,
-            auth: { state: 'authenticated', plan: { label: 'Free', free: true } },
-          }
-        }
-        if (message.type === 'tokenless.bridge.inspect_controls') {
-          return {
-            status: 'inspected',
-            provider: message.request.provider,
-            controls: { available: false, efforts: [], models: [] },
-          }
-        }
-        if (message.type === 'tokenless.bridge.configure_controls') {
-          const response = {
-            status: 'configured',
-            provider: message.request.provider,
-          }
-          if (message.request.model) {
-            response.model = { status: 'selected', requested: message.request.model, applied: message.request.model }
-          }
-          if (message.request.effort) {
-            response.effort = { status: 'selected', requested: message.request.effort, applied: message.request.effort }
-          }
-          return response
-        }
-        if (message.type === 'tokenless.bridge.attachment_prepare') {
-          return {
-            status: 'prepared',
-            provider: message.request.provider,
-            requestId: message.requestId,
-            attachmentId: message.attachmentId,
-          }
-        }
-        if (message.type === 'tokenless.bridge.attachment_chunk') {
-          return {
-            status: 'chunk_received',
-            provider: message.request.provider,
-            requestId: message.requestId,
-            attachmentId: message.attachmentId,
-          }
-        }
-        if (message.type === 'tokenless.bridge.attachment_commit_batch') {
-          return {
-            status: 'attached',
-            provider: message.request.provider,
-            requestId: message.requestId,
-            attachments: message.attachmentIds.map((attachmentId) => ({ attachmentId, visible: true })),
-          }
-        }
-        if (message.type === 'tokenless.bridge.input_prompt') {
-          return {
-            status: 'input',
-            provider: message.request.provider,
-            visible: true,
-            inputProof: `input-${message.request.requestId}`,
-          }
-        }
-        throw new Error(`Unexpected provider message: ${message.type}`)
-      },
-    },
-    windows: {
-      async update() {},
-    },
-  }
-
-  try {
-    const serviceWorkerUrl = pathToFileURL(path.join(extensionDist, 'background/service-worker.js'))
-    serviceWorkerUrl.searchParams.set('contract', String(Date.now()))
-    await import(serviceWorkerUrl.href)
-
-    assert.equal(ports.length, 1, 'service worker should establish one long-lived native port')
-    const daemonPort = ports[0]
-    assert.deepEqual(daemonPort.posted[0], {
-      protocol: 'tokenless.native.v1',
-      type: 'tokenless.native.daemon_connect',
-    })
-    await daemonPort.onMessage.emit(nativeSuccess('tokenless.native.daemon_connected', {
-      status: 'connected',
-      sessionId: 'contract-session',
-    }))
-    assert.deepEqual(sidePanelCalls, [{ openPanelOnActionClick: true }])
-    assert.deepEqual(createdTabs, [])
-
-    await installed.emit({ reason: 'install' })
-    await startup.emit()
-    await delay(0)
-    assert.deepEqual(sidePanelCalls, [
-      { openPanelOnActionClick: true },
-      { openPanelOnActionClick: true },
-      { openPanelOnActionClick: true },
-    ], 'startup hooks configure the side panel without opening a tab')
-    assert.deepEqual(createdTabs, [], 'install and startup must not open tabs')
-    const sidePanelCallsBeforeJobs = sidePanelCalls.length
-
-    const visibleJobMessage = {
-      protocol: 'tokenless.native.v1',
-      type: 'tokenless.native.daemon_job',
-      ok: true,
-      result: {
-        job: {
-          job_id: 'job-visible-provider',
-          claim_token: 'provider-private-marker',
-          provider: 'chatgpt',
-          action: 'submit_and_read',
-          status: 'claimed',
-          request_json: {
-            prompt: 'Read this through visible DOM.',
-            targetUrl: 'https://chatgpt.com/',
-            readDelayMs: 0,
-            allowPostSubmitTargetTransition: true,
-            postSubmitTargetTransitionProof: { nonce: 'daemon-forged-proof' },
-            metadata: { taskId: 'task-visible-provider' },
-          },
-        },
-      },
-    }
-    await daemonPort.onMessage.emit(visibleJobMessage)
-
-    await waitFor(() => daemonPort.posted.filter((message) => message.type === 'tokenless.native.daemon_ready').length === 1)
-    const daemonReady = daemonPort.posted.find((message) => message.type === 'tokenless.native.daemon_ready')
-    assert.match(daemonReady.requestId, /^native-/)
-    const { requestId: _correlationId, ...publicDaemonReady } = daemonReady
-    assert.deepEqual(publicDaemonReady, {
-      protocol: 'tokenless.native.v1',
-      type: 'tokenless.native.daemon_ready',
-      jobId: 'job-visible-provider',
-      claimToken: 'provider-private-marker',
-    })
-    assert.deepEqual(createdTabs.map((tab) => tab.url), ['https://chatgpt.com/c/123e4567-e89b-12d3-a456-426614174002?private-query=yes#private-hash'])
-    assert.ok(createdTabs.every((tab) => /^https:\/\/(chatgpt\.com|chat\.openai\.com|gemini\.google\.com|claude\.ai)\//.test(tab.url)))
-    assert.deepEqual(
-      providerMessages.map(({ message }) => message.type),
-      [
-        'tokenless.bridge.validate_landing',
-        'tokenless.bridge.submit',
-        'tokenless.bridge.validate_landing',
-        'tokenless.bridge.read',
-      ]
-    )
-    assert.deepEqual(
-      providerMessages.map(({ message }) => message.request?.allowPostSubmitTargetTransition),
-      [undefined, undefined, true, true],
-      'only the service worker may add the landing-transition flag, and only after submit'
-    )
-    assert.equal(providerMessages[0].message.request?.postSubmitTargetTransitionProof, undefined)
-    assert.equal(providerMessages[1].message.request?.postSubmitTargetTransitionProof, undefined)
-    for (const messageIndex of [2, 3]) {
-      assert.deepEqual(
-        {
-          requestId: providerMessages[messageIndex].message.request?.postSubmitTargetTransitionProof?.requestId,
-          provider: providerMessages[messageIndex].message.request?.postSubmitTargetTransitionProof?.provider,
-          targetUrl: providerMessages[messageIndex].message.request?.postSubmitTargetTransitionProof?.targetUrl,
-          answerBaseline: providerMessages[messageIndex].message.request?.postSubmitTargetTransitionProof?.answerBaseline,
-        },
-        {
-          requestId: 'job-visible-provider',
-          provider: 'chatgpt',
-          targetUrl: 'https://chatgpt.com/',
-          answerBaseline: { count: 1, lastText: 'old-private-answer-marker' },
-        }
-      )
-      assert.ok(providerMessages[messageIndex].message.request?.postSubmitTargetTransitionProof?.nonce.length >= 16)
-    }
-    assert.doesNotMatch(JSON.stringify(providerMessages), /provider-private-marker/)
-    assert.equal(sidePanelCalls.length, sidePanelCallsBeforeJobs, 'job execution must not change Settings state')
-
-    const messagesAfterFirstJob = daemonPort.posted.length
-    await daemonPort.onMessage.emit(structuredClone(visibleJobMessage))
-    await delay(25)
-    assert.equal(daemonPort.posted.length, messagesAfterFirstJob, 'duplicate claimed jobs must not emit duplicate ready')
-
-    await daemonPort.onMessage.emit({
-      protocol: 'tokenless.native.v1',
-      type: 'tokenless.native.daemon_job',
-      ok: true,
-      result: {
-        job: {
-          job_id: 'job-rejected-target',
-          claim_token: 'rejected-private-marker',
-          provider: 'chatgpt',
-          action: 'submit_and_read',
-          status: 'claimed',
-          request_json: {
-            prompt: 'Do not open this target.',
-            targetUrl: 'chrome-extension://extension-id/settings/index.html',
-            readDelayMs: 0,
-          },
-        },
-      },
-    })
-
-    await waitFor(() => daemonPort.posted.filter((message) => message.type === 'tokenless.native.daemon_ready').length === 2)
-    assert.deepEqual(createdTabs.map((tab) => tab.url), ['https://chatgpt.com/c/123e4567-e89b-12d3-a456-426614174002?private-query=yes#private-hash'])
-    assert.equal(sidePanelCalls.length, sidePanelCallsBeforeJobs)
-
-    await daemonPort.onMessage.emit({
-      protocol: 'tokenless.native.v1',
-      type: 'tokenless.native.daemon_job',
-      ok: true,
-      result: {
-        job: {
-          job_id: 'job-provider-drift',
-          claim_token: 'drift-private-marker',
-          provider: 'chatgpt',
-          action: 'submit_and_read',
-          status: 'claimed',
-          request_json: {
-            prompt: 'Must not submit after cross-provider navigation.',
-            readDelayMs: 0,
-          },
-        },
-      },
-    })
-    await waitFor(() => daemonPort.posted.filter((message) => message.type === 'tokenless.native.daemon_ready').length === 3)
-    const driftMessages = providerMessages.filter(({ message }) => message.request?.requestId === 'job-provider-drift')
-    assert.deepEqual(driftMessages.map(({ message }) => message.type), ['tokenless.bridge.validate_landing'])
-
-    await daemonPort.onMessage.emit({
-      protocol: 'tokenless.native.v1',
-      type: 'tokenless.native.daemon_job',
-      ok: true,
-      result: {
-        job: {
-          job_id: 'job-chatgpt-alias-transition',
-          claim_token: 'alias-private-marker',
-          provider: 'chatgpt',
-          action: 'submit_and_read',
-          status: 'claimed',
-          request_json: {
-            prompt: 'Allow only the ChatGPT landing alias to transition.',
-            targetUrl: 'https://chat.openai.com/',
-            readDelayMs: 0,
-          },
-        },
-      },
-    })
-    await waitFor(() => daemonPort.posted.filter((message) => message.type === 'tokenless.native.daemon_ready').length === 4)
-    const aliasMessages = providerMessages.filter(({ message }) => (
-      message.request?.requestId === 'job-chatgpt-alias-transition'
-    ))
-    assert.deepEqual(
-      aliasMessages.map(({ message }) => ({
-        type: message.type,
-        allowTransition: message.request?.allowPostSubmitTargetTransition,
-      })),
-      [
-        { type: 'tokenless.bridge.validate_landing', allowTransition: undefined },
-        { type: 'tokenless.bridge.submit', allowTransition: undefined },
-        { type: 'tokenless.bridge.validate_landing', allowTransition: true },
-        { type: 'tokenless.bridge.read', allowTransition: true },
-      ]
-    )
-
-    await daemonPort.onMessage.emit({
-      protocol: 'tokenless.native.v1',
-      type: 'tokenless.native.daemon_job',
-      ok: true,
-      result: {
-        job: {
-          job_id: 'job-submit-only-baseline-private',
-          claim_token: 'submit-private-marker',
-          provider: 'chatgpt',
-          action: 'submit',
-          status: 'claimed',
-          request_json: {
-            prompt: 'Do not persist the prior answer baseline.',
-          },
-        },
-      },
-    })
-    await waitFor(() => daemonPort.posted.filter((message) => message.type === 'tokenless.native.daemon_ready').length === 5)
-
-    await daemonPort.onMessage.emit({
-      protocol: 'tokenless.native.v1',
-      type: 'tokenless.native.daemon_job',
-      ok: true,
-      result: {
-        job: {
-          job_id: 'job-unsafe-provider-path',
-          claim_token: 'unsafe-path-private-marker',
-          provider: 'chatgpt',
-          action: 'submit_and_read',
-          status: 'claimed',
-          request_json: {
-            prompt: 'Do not read misleading provider settings content.',
-            targetUrl: 'https://chatgpt.com/',
-            readDelayMs: 0,
-          },
-        },
-      },
-    })
-    await waitFor(() => daemonPort.posted.filter((message) => message.type === 'tokenless.native.daemon_ready').length === 6)
-    const unsafePathMessages = providerMessages.filter(({ message }) => (
-      message.request?.requestId === 'job-unsafe-provider-path'
-    ))
-    assert.deepEqual(
-      unsafePathMessages.map(({ message }) => message.type),
-      ['tokenless.bridge.validate_landing', 'tokenless.bridge.submit']
-    )
-
-    for (const job of [
-      {
-        job_id: 'job-custom-gpt-transition',
-        claim_token: 'custom-positive-private-marker',
-        targetUrl: 'https://chatgpt.com/g/g-pmuQfob8d',
-      },
-      {
-        job_id: 'job-custom-gpt-mismatch',
-        claim_token: 'custom-mismatch-private-marker',
-        targetUrl: 'https://chatgpt.com/g/g-pmuQfob8d',
-      },
-      {
-        job_id: 'job-root-custom-mismatch',
-        claim_token: 'root-custom-private-marker',
-        targetUrl: 'https://chatgpt.com/',
-      },
-    ]) {
-      await daemonPort.onMessage.emit({
-        protocol: 'tokenless.native.v1',
-        type: 'tokenless.native.daemon_job',
-        ok: true,
-        result: {
-          job: {
-            ...job,
-            provider: 'chatgpt',
-            action: 'submit_and_read',
-            status: 'claimed',
-            request_json: {
-              prompt: 'Verify custom GPT source and destination binding.',
-              targetUrl: job.targetUrl,
-              readDelayMs: 0,
-            },
-          },
-        },
-      })
-    }
-    await waitFor(() => daemonPort.posted.filter((message) => message.type === 'tokenless.native.daemon_ready').length === 9)
-    const customPositiveMessages = providerMessages.filter(({ message }) => (
-      message.request?.requestId === 'job-custom-gpt-transition'
-    ))
-    assert.deepEqual(
-      customPositiveMessages.map(({ message }) => message.type),
-      [
-        'tokenless.bridge.validate_landing',
-        'tokenless.bridge.submit',
-        'tokenless.bridge.validate_landing',
-        'tokenless.bridge.read',
-      ]
-    )
-    for (const blockedJobId of ['job-custom-gpt-mismatch', 'job-root-custom-mismatch']) {
-      const blockedMessages = providerMessages.filter(({ message }) => message.request?.requestId === blockedJobId)
-      assert.deepEqual(
-        blockedMessages.map(({ message }) => message.type),
-        ['tokenless.bridge.validate_landing', 'tokenless.bridge.submit']
-      )
-    }
-
-    for (const job of [
-      { jobId: 'job-auth-inspect', action: 'inspect_auth', requestJson: {} },
-      { jobId: 'job-generic-controls-inspect', action: 'inspect_controls', requestJson: {} },
-      { jobId: 'job-generic-controls-configure', action: 'configure_controls', requestJson: { model: 'Flash' } },
-      {
-        jobId: 'job-unified-auth',
-        action: 'visible_provider_action',
-        requestJson: {
-          requestId: 'job-unified-auth',
-          visibleAction: {
-            protocol: 'tokenless.visible-provider-action.v1',
-            requestId: 'job-unified-auth',
-            provider: 'gemini',
-            action: 'auth.status',
-            payload: {},
-          },
-        },
-      },
-      {
-        jobId: 'job-unified-model-select',
-        action: 'visible_provider_action',
-        requestJson: {
-          requestId: 'job-unified-model-select',
-          visibleAction: {
-            protocol: 'tokenless.visible-provider-action.v1',
-            requestId: 'job-unified-model-select',
-            provider: 'gemini',
-            action: 'model.select',
-            payload: { label: '3.1 Pro' },
-          },
-        },
-      },
-      {
-        jobId: 'job-unified-effort-select',
-        provider: 'claude',
-        action: 'visible_provider_action',
-        requestJson: {
-          requestId: 'job-unified-effort-select',
-          visibleAction: {
-            protocol: 'tokenless.visible-provider-action.v1',
-            requestId: 'job-unified-effort-select',
-            provider: 'claude',
-            action: 'effort.select',
-            payload: { label: 'Extended' },
-          },
-        },
-      },
-      {
-        jobId: 'job-unified-prompt-submit',
-        provider: 'chatgpt',
-        action: 'visible_provider_action',
-        requestJson: {
-          requestId: 'job-unified-prompt-submit',
-          visibleAction: {
-            protocol: 'tokenless.visible-provider-action.v1',
-            requestId: 'job-unified-prompt-submit',
-            provider: 'chatgpt',
-            action: 'prompt.submit',
-            payload: { text: 'Standalone unified submit.', mode: 'replace' },
-          },
-        },
-      },
-    ]) {
-      await daemonPort.onMessage.emit({
-        protocol: 'tokenless.native.v1',
-        type: 'tokenless.native.daemon_job',
-        ok: true,
-        result: {
-          job: {
-            job_id: job.jobId,
-            claim_token: `${job.jobId}-private-marker`,
-            provider: job.provider ?? 'gemini',
-            action: job.action,
-            status: 'claimed',
-            request_json: job.requestJson,
-          },
-        },
-      })
-    }
-    await waitFor(() => daemonPort.posted.filter((message) => message.type === 'tokenless.native.daemon_ready').length === 16)
-    for (const [jobId, expectedTypes] of [
-      ['job-auth-inspect', ['tokenless.bridge.inspect_auth']],
-      ['job-generic-controls-inspect', ['tokenless.bridge.validate_landing', 'tokenless.bridge.inspect_controls']],
-      ['job-generic-controls-configure', ['tokenless.bridge.validate_landing', 'tokenless.bridge.configure_controls']],
-      ['job-unified-auth', ['tokenless.bridge.inspect_auth']],
-      ['job-unified-model-select', ['tokenless.bridge.inspect_auth', 'tokenless.bridge.validate_landing', 'tokenless.bridge.configure_controls']],
-      ['job-unified-effort-select', ['tokenless.bridge.inspect_auth', 'tokenless.bridge.validate_landing', 'tokenless.bridge.configure_controls']],
-      ['job-unified-prompt-submit', ['tokenless.bridge.inspect_auth', 'tokenless.bridge.validate_landing', 'tokenless.bridge.submit']],
-    ]) {
-      const routed = providerMessages.filter(({ message }) => message.request?.requestId === jobId)
-      assert.deepEqual(routed.map(({ message }) => message.type), expectedTypes)
-    }
-
-    await daemonPort.onMessage.emit({
-      protocol: 'tokenless.native.v1',
-      type: 'tokenless.native.daemon_job',
-      ok: true,
-      result: {
-        job: {
-          job_id: 'job-unified-file-upload',
-          claim_token: 'job-unified-file-upload-private-marker',
-          provider: 'chatgpt',
-          action: 'visible_provider_action',
-          status: 'claimed',
-          request_json: {
-            requestId: 'job-unified-file-upload',
-            targetUrl: 'https://chatgpt.com/',
-            attachments: [unifiedAttachmentDescriptor],
-            visibleAction: {
-              protocol: 'tokenless.visible-provider-action.v1',
-              requestId: 'job-unified-file-upload',
-              provider: 'chatgpt',
-              action: 'file.upload',
-              payload: { attachments: [unifiedAttachmentDescriptor] },
-            },
-          },
-        },
-      },
-    })
-    await waitFor(() => daemonPort.posted.filter((message) => message.type === 'tokenless.native.daemon_ready').length === 17)
-    const unifiedFileMessages = providerMessages.filter(({ message }) => (
-      message.request?.requestId === 'job-unified-file-upload'
-    ))
-    assert.deepEqual(unifiedFileMessages.map(({ message }) => message.type), [
-      'tokenless.bridge.inspect_auth',
-      'tokenless.bridge.validate_landing',
-      'tokenless.bridge.attachment_prepare',
-      'tokenless.bridge.attachment_chunk',
-      'tokenless.bridge.attachment_commit_batch',
-    ])
-    assert.equal(new Set(unifiedFileMessages.map(({ tabId }) => tabId)).size, 1)
-    const unifiedFileTabId = unifiedFileMessages[0].tabId
-    const tabsAfterUnifiedFile = createdTabs.length
-
-    await daemonPort.onMessage.emit({
-      protocol: 'tokenless.native.v1',
-      type: 'tokenless.native.daemon_job',
-      ok: true,
-      result: {
-        job: {
-          job_id: 'job-unified-prompt-input',
-          claim_token: 'job-unified-prompt-input-private-marker',
-          provider: 'chatgpt',
-          action: 'visible_provider_action',
-          status: 'claimed',
-          request_json: {
-            requestId: 'job-unified-prompt-input',
-            targetUrl: 'https://chatgpt.com/',
-            visibleAction: {
-              protocol: 'tokenless.visible-provider-action.v1',
-              requestId: 'job-unified-prompt-input',
-              provider: 'chatgpt',
-              action: 'prompt.input',
-              payload: { text: 'Draft beside the uploaded file.', mode: 'replace' },
-            },
-          },
-        },
-      },
-    })
-    await waitFor(() => daemonPort.posted.filter((message) => message.type === 'tokenless.native.daemon_ready').length === 18)
-    const unifiedPromptMessages = providerMessages.filter(({ message }) => (
-      message.request?.requestId === 'job-unified-prompt-input'
-    ))
-    assert.deepEqual(unifiedPromptMessages.map(({ message }) => message.type), [
-      'tokenless.bridge.inspect_auth',
-      'tokenless.bridge.validate_landing',
-      'tokenless.bridge.input_prompt',
-    ])
-    assert.ok(unifiedPromptMessages.every(({ tabId }) => tabId === unifiedFileTabId))
-    assert.equal(createdTabs.length, tabsAfterUnifiedFile, 'prompt.input must reuse the clean file.upload affinity tab')
-
-    const allNativeMessages = ports.flatMap((port) => port.posted)
-    assert.ok(allNativeMessages.length >= 5)
-    assert.ok(allNativeMessages.every((message) => message.protocol === 'tokenless.native.v1'))
-    const completionMessages = allNativeMessages.filter((message) => (
-      message.type === 'tokenless.native.daemon_complete_job'
-    ))
-    assert.doesNotMatch(
-      JSON.stringify(completionMessages),
-      /old-private-answer-marker|answerBaseline|postSubmitTargetTransitionProof/,
-      'submission correlation state must never reach public daemon results'
-    )
-    assert.ok(allNativeMessages.some((message) => (
-      message.type === 'tokenless.native.daemon_complete_job' &&
-      message.jobId === 'job-visible-provider' &&
-      message.claimToken === 'provider-private-marker' &&
-      message.result?.text === 'Visible DOM answer'
-    )))
-    const authCompletion = allNativeMessages.find((message) => (
-      message.type === 'tokenless.native.daemon_complete_job' &&
-      message.jobId === 'job-auth-inspect'
-    ))
-    assert.deepEqual(authCompletion?.result?.auth, {
-      state: 'authenticated',
-      plan: { label: 'Free', free: true },
-    })
-    assert.doesNotMatch(JSON.stringify(authCompletion), /email|accountId|cookie|localStorage|sessionStorage/i)
-    const unifiedAuthCompletion = allNativeMessages.find((message) => (
-      message.type === 'tokenless.native.daemon_complete_job' &&
-      message.jobId === 'job-unified-auth'
-    ))
-    assert.deepEqual(unifiedAuthCompletion?.result, {
-      state: 'authenticated',
-      plan: { label: 'Free', free: true },
-      text: undefined,
-      provider: 'gemini',
-    })
-    const unifiedModelCompletion = allNativeMessages.find((message) => (
-      message.type === 'tokenless.native.daemon_complete_job' &&
-      message.jobId === 'job-unified-model-select'
-    ))
-    assert.deepEqual(unifiedModelCompletion?.result, {
-      label: '3.1 Pro',
-      visible: true,
-      text: undefined,
-      provider: 'gemini',
-    })
-    const unifiedEffortCompletion = allNativeMessages.find((message) => (
-      message.type === 'tokenless.native.daemon_complete_job' &&
-      message.jobId === 'job-unified-effort-select'
-    ))
-    assert.deepEqual(unifiedEffortCompletion?.result, {
-      label: 'Extended',
-      visible: true,
-      text: undefined,
-      provider: 'claude',
-    })
-    assert.doesNotMatch(
-      JSON.stringify([
-        unifiedAuthCompletion?.result,
-        unifiedModelCompletion?.result,
-        unifiedEffortCompletion?.result,
-      ]),
-      /email|accountId|cookie|localStorage|sessionStorage|private-marker/i
-    )
-    const unifiedFileCompletion = allNativeMessages.find((message) => (
-      message.type === 'tokenless.native.daemon_complete_job' &&
-      message.jobId === 'job-unified-file-upload'
-    ))
-    assert.deepEqual(unifiedFileCompletion?.result, {
-      attachments: [{
-        attachmentId: 'unified-native-file',
-        name: 'unified-evidence.txt',
-        visible: true,
-      }],
-      text: undefined,
-      provider: 'chatgpt',
-    })
-    const unifiedPromptCompletion = allNativeMessages.find((message) => (
-      message.type === 'tokenless.native.daemon_complete_job' &&
-      message.jobId === 'job-unified-prompt-input'
-    ))
-    assert.deepEqual(unifiedPromptCompletion?.result, {
-      inputProof: 'input-job-unified-prompt-input',
-      visible: true,
-      text: undefined,
-      provider: 'chatgpt',
-    })
-    const unifiedSubmitCompletion = allNativeMessages.find((message) => (
-      message.type === 'tokenless.native.daemon_complete_job' &&
-      message.jobId === 'job-unified-prompt-submit'
-    ))
-    assert.deepEqual(unifiedSubmitCompletion?.result, {
-      submissionProof: 'visible-submit-job-unified-prompt-submit',
-      visible: true,
-      text: undefined,
-      provider: 'chatgpt',
-    })
-    assert.doesNotMatch(
-      JSON.stringify([
-        unifiedFileCompletion?.result,
-        unifiedPromptCompletion?.result,
-        unifiedSubmitCompletion?.result,
-      ]),
-      /Draft beside|Standalone unified submit|bundleId|sha256|sourcePath|stagedPath|cookie|localStorage|sessionStorage/i
-    )
-    assert.ok(allNativeMessages.some((message) => (
-      message.type === 'tokenless.native.daemon_complete_job' &&
-      message.jobId === 'job-rejected-target' &&
-      message.error?.code === 'target_url_provider_mismatch'
-    )))
-    assert.ok(allNativeMessages.some((message) => (
-      message.type === 'tokenless.native.daemon_complete_job' &&
-      message.jobId === 'job-provider-drift' &&
-      message.error?.code === 'provider_tab_mismatch'
-    )))
-    assert.ok(allNativeMessages.some((message) => (
-      message.type === 'tokenless.native.daemon_complete_job' &&
-      message.jobId === 'job-unsafe-provider-path' &&
-      message.error?.code === 'target_tab_mismatch'
-    )))
-    for (const blockedJobId of ['job-custom-gpt-mismatch', 'job-root-custom-mismatch']) {
-      assert.ok(allNativeMessages.some((message) => (
-        message.type === 'tokenless.native.daemon_complete_job' &&
-        message.jobId === blockedJobId &&
-        message.error?.code === 'target_tab_mismatch'
-      )))
-    }
-    assert.deepEqual(
-      allNativeMessages
-        .filter((message) => message.type === 'tokenless.native.daemon_ready')
-        .map(({ jobId, claimToken }) => ({ jobId, claimToken })),
-      [
-        { jobId: 'job-visible-provider', claimToken: 'provider-private-marker' },
-        { jobId: 'job-rejected-target', claimToken: 'rejected-private-marker' },
-        { jobId: 'job-provider-drift', claimToken: 'drift-private-marker' },
-        { jobId: 'job-chatgpt-alias-transition', claimToken: 'alias-private-marker' },
-        { jobId: 'job-submit-only-baseline-private', claimToken: 'submit-private-marker' },
-        { jobId: 'job-unsafe-provider-path', claimToken: 'unsafe-path-private-marker' },
-        { jobId: 'job-custom-gpt-transition', claimToken: 'custom-positive-private-marker' },
-        { jobId: 'job-custom-gpt-mismatch', claimToken: 'custom-mismatch-private-marker' },
-        { jobId: 'job-root-custom-mismatch', claimToken: 'root-custom-private-marker' },
-        { jobId: 'job-auth-inspect', claimToken: 'job-auth-inspect-private-marker' },
-        { jobId: 'job-generic-controls-inspect', claimToken: 'job-generic-controls-inspect-private-marker' },
-        { jobId: 'job-generic-controls-configure', claimToken: 'job-generic-controls-configure-private-marker' },
-        { jobId: 'job-unified-auth', claimToken: 'job-unified-auth-private-marker' },
-        { jobId: 'job-unified-model-select', claimToken: 'job-unified-model-select-private-marker' },
-        { jobId: 'job-unified-effort-select', claimToken: 'job-unified-effort-select-private-marker' },
-        { jobId: 'job-unified-prompt-submit', claimToken: 'job-unified-prompt-submit-private-marker' },
-        { jobId: 'job-unified-file-upload', claimToken: 'job-unified-file-upload-private-marker' },
-        { jobId: 'job-unified-prompt-input', claimToken: 'job-unified-prompt-input-private-marker' },
-      ]
-    )
-  } finally {
-    globalThis.chrome = previousChrome
-  }
-})
-
-test('background and provider content preserve visible-session safety boundaries', () => {
-  const serviceWorker = readText('legacy/extension/extension/background/service-worker.ts')
-  const contentScript = readText('legacy/extension/extension/content/provider-content.ts')
-  const settingsScript = readText('legacy/extension/extension/settings/index.ts')
-  const builtContentScript = readText('legacy/extension/dist/extension/content/provider-content.js')
-
-  assert.doesNotMatch(serviceWorker, /onMessageExternal|externally_connectable/)
-  assert.doesNotMatch(serviceWorker, /task\/task\.html|runner\.html|chrome\.runtime\.getURL/)
-  assert.doesNotMatch(settingsScript, /chrome\.tabs\.create/)
-  assert.match(serviceWorker, /getOrCreateProviderTab/)
-  assert.match(serviceWorker, /focusTab\(tab\)/)
-  assert.match(serviceWorker, /chrome\.tabs\.sendMessage/)
-  assert.match(serviceWorker, /validateProviderLanding/)
-  assert.match(serviceWorker, /isSafeProviderAuthority/)
-  assert.match(serviceWorker, /chrome\.runtime\.onMessage\.addListener/)
-  assert.match(serviceWorker, /tokenless\.provider_content_ready/)
-  assert.match(contentScript, /chrome\.runtime\.sendMessage/)
-  assert.match(contentScript, /tokenless\.provider_content_ready/)
-
-  for (const source of [serviceWorker, contentScript]) {
-    assert.doesNotMatch(source, /chrome\.cookies|document\.cookie|localStorage|sessionStorage/)
-    assert.doesNotMatch(source, /provider.*fetch|fetch.*provider/i)
-  }
-
-  assert.match(contentScript, /__TOKENLESS_PROVIDER_CONTENT_LOADED__/)
-  assert.doesNotMatch(builtContentScript, /\nexport \{\};/)
-  assert.doesNotMatch(builtContentScript, /^import /m)
-  assert.ok(
-    contentScript.indexOf('__TOKENLESS_PROVIDER_CONTENT_LOADED__') < contentScript.search(/const SAFE_STRUCTURAL_STATE_VALUES\b/),
-    'duplicate-injection guard must run before content-script declarations'
-  )
-  assert.doesNotMatch(contentScript, /const PROVIDERS\b/)
-  assert.doesNotMatch(contentScript, /function providerTransitionSource\b/)
-  assert.match(serviceWorker, /dispatchTrustedChatGptClick/)
-  assert.match(serviceWorker, /Input\.dispatchMouseEvent/)
-  assert.doesNotMatch(
-    serviceWorker,
-    /sendCommand\([^\n]*(?:Network|Storage|Fetch|Runtime|DOM|Page)\./
-  )
-  assert.doesNotMatch(serviceWorker, /chrome\.cookies|localStorage|sessionStorage/)
-  assert.doesNotMatch(contentScript, /debuggerControlExtensionId|debugger-control-extension-id/)
-})
-
-test('primary extension validates, serializes, dispatches, and detaches trusted ChatGPT clicks', async () => {
-  const previousChrome = globalThis.chrome
-  const runtimeMessage = createChromeEvent()
-  const nativePort = createBehaviorNativePort()
-  const calls = []
-  let blockAttach = false
-  let releaseAttach
-  let blockDetach = false
-  let releaseDetach
-  let failCommand = false
-  let currentTabUrl = 'https://chatgpt.com/c/visible-chat?private=yes#fragment'
-  let changeUrlOnAttach = false
-  globalThis.chrome = {
-    runtime: {
-      onMessage: runtimeMessage,
-      onInstalled: createChromeEvent(),
-      onStartup: createChromeEvent(),
-      connectNative() {
-        return nativePort
-      },
-      lastError: undefined,
-    },
-    sidePanel: {
-      async setPanelBehavior() {},
-    },
-    tabs: {
-      async get(tabId) {
-        return tabId === 42
-          ? { id: 42, url: currentTabUrl }
-          : undefined
-      },
-    },
-    debugger: {
-      async attach(target, version) {
-        calls.push({ kind: 'attach', target, version })
-        if (changeUrlOnAttach) currentTabUrl = 'https://chatgpt.com/c/navigated-away'
-        if (blockAttach) await new Promise((resolve) => { releaseAttach = resolve })
-      },
-      async sendCommand(target, command, params) {
-        calls.push({ kind: 'command', target, command, params })
-        if (failCommand) throw new Error('simulated input failure')
-      },
-      async detach(target) {
-        calls.push({ kind: 'detach', target })
-        if (blockDetach) await new Promise((resolve) => { releaseDetach = resolve })
-      },
-    },
-  }
-  try {
-    const workerUrl = pathToFileURL(path.join(extensionDist, 'background/service-worker.js'))
-    workerUrl.searchParams.set('contract', String(Date.now()))
-    await import(workerUrl.href)
-    await nativePort.onMessage.emit(nativeSuccess('tokenless.native.daemon_connected', { status: 'connected' }))
-    assert.equal(runtimeMessage.listeners().length, 1)
-    const listener = runtimeMessage.listeners()[0]
-    const sender = { frameId: 0, tab: { id: 42, url: 'https://chatgpt.com/c/visible-chat?sender=yes' } }
-    const request = {
-      type: 'tokenless.bridge.trusted_click',
-      request: {
-        provider: 'chatgpt',
-        expectedUrl: 'https://chatgpt.com/c/visible-chat#content-script-fragment',
-        x: 320,
-        y: 640,
-        viewportWidth: 1280,
-        viewportHeight: 800,
-      },
-    }
-
-    for (const [rejectedRequest, rejectedSender, code] of [
-      [request, { frameId: 0, tab: { id: 42, url: 'https://gemini.google.com/app' } }, 'debugger_control_context_mismatch'],
-      [{ ...request, request: { ...request.request, expectedUrl: 'https://chatgpt.com/c/other-chat' } }, sender, 'debugger_control_context_mismatch'],
-      [{ ...request, request: { ...request.request, x: 1280 } }, sender, 'debugger_control_invalid_coordinate'],
-      [{ ...request, request: { ...request.request, x: null } }, sender, 'debugger_control_invalid_coordinate'],
-      [{ ...request, request: { ...request.request, x: false } }, sender, 'debugger_control_invalid_coordinate'],
-      [{ ...request, request: { ...request.request, x: '' } }, sender, 'debugger_control_invalid_coordinate'],
-      [{ ...request, request: { ...request.request, x: -0.4 } }, sender, 'debugger_control_invalid_coordinate'],
-      [request, { ...sender, frameId: 1 }, 'debugger_control_context_mismatch'],
-      [request, { tab: sender.tab }, 'debugger_control_context_mismatch'],
-    ]) {
-      const rejected = await invokeChromeMessageListener(listener, rejectedRequest, rejectedSender)
-      assert.deepEqual(rejected, { ok: false, code })
-    }
-    assert.deepEqual(calls, [], 'invalid requests must not attach a debugger')
-
-    currentTabUrl = 'https://chatgpt.com/c/navigated-before-attach'
-    const rejectedBeforeAttach = await invokeChromeMessageListener(listener, request, sender)
-    assert.deepEqual(rejectedBeforeAttach, { ok: false, code: 'debugger_control_tab_rejected' })
-    assert.deepEqual(calls, [], 'a pre-attach URL mismatch must not attach a debugger')
-
-    currentTabUrl = 'https://chatgpt.com/c/visible-chat'
-    changeUrlOnAttach = true
-    const rejectedAfterAttach = await invokeChromeMessageListener(listener, request, sender)
-    assert.deepEqual(rejectedAfterAttach, { ok: false, code: 'debugger_control_tab_rejected' })
-    assert.deepEqual(calls, [
-      { kind: 'attach', target: { tabId: 42 }, version: '1.3' },
-      { kind: 'detach', target: { tabId: 42 } },
-    ], 'a post-attach URL mismatch must detach without dispatching Input')
-    calls.length = 0
-    currentTabUrl = 'https://chatgpt.com/c/visible-chat'
-    changeUrlOnAttach = false
-
-    blockAttach = true
-    blockDetach = true
-    const pending = invokeChromeMessageListener(listener, request, sender)
-    while (!calls.some((call) => call.kind === 'attach')) await delay(0)
-    const busy = await invokeChromeMessageListener(listener, request, sender)
-    assert.deepEqual(busy, { ok: false, code: 'debugger_control_busy' })
-    releaseAttach()
-    while (!calls.some((call) => call.kind === 'detach')) await delay(0)
-    const busyWhileDetaching = await invokeChromeMessageListener(listener, request, sender)
-    assert.deepEqual(busyWhileDetaching, { ok: false, code: 'debugger_control_busy' })
-    releaseDetach()
-    const response = await pending
-    assert.deepEqual(response, { ok: true })
-    assert.deepEqual(calls, [
-      { kind: 'attach', target: { tabId: 42 }, version: '1.3' },
-      {
-        kind: 'command',
-        target: { tabId: 42 },
-        command: 'Input.dispatchMouseEvent',
-        params: { type: 'mousePressed', x: 320, y: 640, button: 'left', buttons: 1, clickCount: 1 },
-      },
-      {
-        kind: 'command',
-        target: { tabId: 42 },
-        command: 'Input.dispatchMouseEvent',
-        params: { type: 'mouseReleased', x: 320, y: 640, button: 'left', buttons: 0, clickCount: 1 },
-      },
-      { kind: 'detach', target: { tabId: 42 } },
-    ])
-
-    blockAttach = false
-    blockDetach = false
-    failCommand = true
-    const failed = await invokeChromeMessageListener(listener, request, sender)
-    assert.deepEqual(failed, { ok: false, code: 'debugger_control_input_failed' })
-    assert.deepEqual(calls.slice(-3), [
-      { kind: 'attach', target: { tabId: 42 }, version: '1.3' },
-      {
-        kind: 'command',
-        target: { tabId: 42 },
-        command: 'Input.dispatchMouseEvent',
-        params: { type: 'mousePressed', x: 320, y: 640, button: 'left', buttons: 1, clickCount: 1 },
-      },
-      { kind: 'detach', target: { tabId: 42 } },
-    ], 'an Input command error must still detach')
-  } finally {
-    globalThis.chrome = previousChrome
-  }
-})
-
-test('browser bridge advertises sanitized DOM snapshot action', async () => {
-  const {
-    BRIDGE_ACTIONS,
-    BRIDGE_PROTOCOL_VERSION,
-    capabilitiesPayload,
-    validateBridgeRequest,
-  } = await import('../legacy/extension/dist/extension/shared/bridge-protocol.js')
-
-  assert.equal(BRIDGE_ACTIONS.SNAPSHOT_DOM, 'snapshot_dom')
-  assert.ok(capabilitiesPayload().actions.includes('snapshot_dom'))
-  assert.equal(BRIDGE_ACTIONS.INSPECT_CONTROLS, 'inspect_controls')
-  assert.equal(BRIDGE_ACTIONS.INSPECT_AUTH, 'inspect_auth')
-  assert.equal(BRIDGE_ACTIONS.CONFIGURE_CONTROLS, 'configure_controls')
-  assert.ok(capabilitiesPayload().actions.includes('inspect_controls'))
-  assert.ok(capabilitiesPayload().actions.includes('inspect_auth'))
-  assert.ok(capabilitiesPayload().actions.includes('configure_controls'))
-  assert.equal(BRIDGE_ACTIONS.INSPECT_CHATGPT_CONTROLS, 'inspect_chatgpt_controls')
-  assert.equal(BRIDGE_ACTIONS.CONFIGURE_CHATGPT, 'configure_chatgpt')
-  assert.ok(capabilitiesPayload().actions.includes('inspect_chatgpt_controls'))
-  assert.ok(capabilitiesPayload().actions.includes('configure_chatgpt'))
-  const baseRequest = {
-    protocol: BRIDGE_PROTOCOL_VERSION,
-    requestId: 'snapshot-1',
-    provider: 'chatgpt',
-    action: 'snapshot_dom',
-  }
-  assert.equal(validateBridgeRequest(baseRequest).ok, true)
-  assert.equal(validateBridgeRequest({ ...baseRequest, provider: 'claude', action: 'inspect_auth' }).ok, true)
-  const chatGptControls = validateBridgeRequest({
-    ...baseRequest,
-    action: 'configure_chatgpt',
-    chatSurface: 'chat',
-    model: 'GPT-5.6 Sol',
-    modelFallbacks: ['GPT-5.5', 'o3'],
-    effort: 'High',
-  })
-  assert.equal(chatGptControls.ok, true)
-  assert.equal(chatGptControls.request.effort, 'High')
-  const providerControls = validateBridgeRequest({
-    ...baseRequest,
-    provider: 'gemini',
-    action: 'configure_controls',
-    model: '  Flash  ',
-    modelFallbacks: ['  Pro  '],
-    effort: 'Extended thinking',
-  })
-  assert.equal(providerControls.ok, true)
-  assert.equal(providerControls.request.model, 'Flash')
-  assert.deepEqual(providerControls.request.modelFallbacks, ['Pro'])
-  assert.equal(providerControls.request.effort, 'Extended thinking')
-  assert.equal(validateBridgeRequest({
-    ...baseRequest,
-    provider: 'grok',
-    action: 'inspect_controls',
-  }).ok, true)
-  for (const malformedControls of [
-    { ...baseRequest, chatSurface: 'work' },
-    { ...baseRequest, effort: 'maximum' },
-    { ...baseRequest, model: '' },
-    { ...baseRequest, modelFallbacks: 'GPT-5.5' },
-    { ...baseRequest, modelFallbacks: Array.from({ length: 9 }, () => 'GPT-5.5') },
-    { ...baseRequest, provider: 'gemini', action: 'read', model: 'Flash' },
-    { ...baseRequest, provider: 'gemini', action: 'configure_controls', modelFallbacks: ['Pro'] },
-    { ...baseRequest, provider: 'grok', action: 'configure_controls', model: 'Fast\nExpert' },
-    { ...baseRequest, provider: 'gemini', action: 'inspect_chatgpt_controls' },
-  ]) {
-    const validation = validateBridgeRequest(malformedControls)
-    assert.equal(validation.ok, false)
-  }
-  const daemonSuppliedTransition = validateBridgeRequest({
-    ...baseRequest,
-    allowPostSubmitTargetTransition: true,
-    postSubmitTargetTransitionProof: { nonce: 'daemon-forged-proof' },
-  })
-  assert.equal(daemonSuppliedTransition.ok, true)
-  assert.equal(daemonSuppliedTransition.request.allowPostSubmitTargetTransition, undefined)
-  assert.equal(daemonSuppliedTransition.request.postSubmitTargetTransitionProof, undefined)
-  assert.equal(validateBridgeRequest({ ...baseRequest, includeText: false }).ok, true)
-  const metadataFallback = validateBridgeRequest({ ...baseRequest, metadata: { includeText: true } })
-  assert.equal(metadataFallback.ok, true)
-  assert.equal(metadataFallback.request.includeText, true)
-  for (const malformed of [
-    { ...baseRequest, includeText: 'false' },
-    { ...baseRequest, includeText: 0 },
-    { ...baseRequest, includeText: null },
-    { ...baseRequest, metadata: { includeText: 'true' } },
-  ]) {
-    const validation = validateBridgeRequest(malformed)
-    assert.equal(validation.ok, false)
-    assert.equal(validation.error.code, 'invalid_include_text')
-  }
-  for (const malformedTarget of [null, false, '', 'not-an-absolute-url']) {
-    const validation = validateBridgeRequest({ ...baseRequest, targetUrl: malformedTarget })
-    assert.equal(validation.ok, false)
-    assert.equal(validation.error.code, 'invalid_target_url')
-  }
-  for (const mismatchedTarget of [
-    'https://gemini.google.com/app',
-    'https://user:password@chatgpt.com/',
-    'https://chatgpt.com:444/',
-  ]) {
-    const validation = validateBridgeRequest({ ...baseRequest, targetUrl: mismatchedTarget })
-    assert.equal(validation.ok, false)
-    assert.equal(validation.error.code, 'target_url_provider_mismatch')
-  }
-})
-
-function postSubmitTransitionProof(request, answerBaseline, nonce = 'contract-transition-proof-0001') {
-  const target = new URL(request.targetUrl)
-  const pathname = target.pathname.replace(/\/+$/, '') || '/'
-  const segments = pathname.split('/').filter(Boolean)
-  const customGptId = (
-    request.provider === 'chatgpt' &&
-    segments.length === 2 &&
-    segments[0] === 'g'
-  ) ? segments[1] : undefined
-  const projectId = request.provider === 'chatgpt' &&
-    segments.length === 3 &&
-    segments[0] === 'g' &&
-    segments[1]?.startsWith('g-p-') &&
-    segments[2] === 'project'
-      ? segments[1]
-      : request.provider === 'claude' &&
-          segments.length === 2 &&
-          segments[0] === 'project'
-        ? segments[1]
-        : undefined
-  return {
-    requestId: request.requestId,
-    provider: request.provider,
-    targetUrl: `${target.origin}${pathname}`,
-    sourceKind: projectId ? 'project' : customGptId ? 'custom_gpt' : 'root',
-    customGptId,
-    projectId,
-    answerBaseline,
-    nonce,
-  }
-}
-
-function dispatchPostSubmitRead(page, request, answerBaseline, proof) {
-  return page.evaluate(({ contentRequest, baseline, transitionProof }) => (
-    globalThis.__dispatchTokenlessMessage({
-      type: 'tokenless.bridge.read',
-      request: {
-        ...contentRequest,
-        answerBaseline: baseline,
-        allowPostSubmitTargetTransition: true,
-        postSubmitTargetTransitionProof: transitionProof,
-      },
-    })
-  ), { contentRequest: request, baseline: answerBaseline, transitionProof: proof })
-}
-
-function dispatchPostSubmitValidation(page, request, answerBaseline, proof) {
-  return page.evaluate(({ contentRequest, baseline, transitionProof }) => (
-    globalThis.__dispatchTokenlessMessage({
-      type: 'tokenless.bridge.validate_landing',
-      request: {
-        ...contentRequest,
-        answerBaseline: baseline,
-        allowPostSubmitTargetTransition: true,
-        postSubmitTargetTransitionProof: transitionProof,
-      },
-    })
-  ), { contentRequest: request, baseline: answerBaseline, transitionProof: proof })
-}
-
-function createChromeEvent() {
-  const listeners = []
-  return {
-    addListener(listener) {
-      listeners.push(listener)
-    },
-    async emit(...args) {
-      await Promise.all(listeners.map((listener) => listener(...args)))
-    },
-    listeners() {
-      return [...listeners]
-    },
-  }
-}
-
-function invokeChromeMessageListener(listener, message, sender) {
-  return new Promise((resolve, reject) => {
-    let completed = false
-    const timeout = setTimeout(() => {
-      if (!completed) reject(new Error('Chrome message listener did not respond.'))
-    }, 1000)
-    const keepOpen = listener(message, sender, (response) => {
-      completed = true
-      clearTimeout(timeout)
-      resolve(response)
-    })
-    if (keepOpen !== true && !completed) {
-      clearTimeout(timeout)
-      reject(new Error('Chrome message listener did not keep the response channel open.'))
-    }
-  })
-}
-
-function createManualScheduler() {
-  let nextId = 1
-  const tasks = new Map()
-  return {
-    setTimer(callback, delayMs) {
-      assert.equal(this, globalThis, 'timer callbacks must be invoked with the Web API receiver')
-      const id = nextId
-      nextId += 1
-      tasks.set(id, { callback, delayMs: Number(delayMs) })
-      return id
-    },
-    clearTimer(id) {
-      assert.equal(this, globalThis, 'timer clear callbacks must be invoked with the Web API receiver')
-      tasks.delete(id)
-    },
-    pendingDelays() {
-      return [...tasks.values()].map((task) => task.delayMs)
-    },
-    runDelay(delayMs) {
-      const match = [...tasks.entries()].find(([, task]) => task.delayMs === delayMs)
-      assert.ok(match, `No scheduled timer has delay ${delayMs}ms; pending: ${JSON.stringify(this.pendingDelays())}`)
-      const [id, task] = match
-      tasks.delete(id)
-      task.callback()
-    },
-  }
-}
-
-function createBehaviorNativePort() {
-  const onMessage = createChromeEvent()
-  const onDisconnect = createChromeEvent()
-  return {
-    onMessage,
-    onDisconnect,
-    posted: [],
-    disconnectCount: 0,
-    postMessage(message) {
-      this.posted.push(message)
-    },
-    disconnect() {
-      this.disconnectCount += 1
-      void onDisconnect.emit()
-    },
-  }
-}
-
-function nativeSuccess(type, result, requestId) {
-  return Object.fromEntries(Object.entries({
-    protocol: 'tokenless.native.v1',
-    type,
-    requestId,
-    ok: true,
-    result,
-  }).filter(([, value]) => value !== undefined))
-}
-
-function nativeFailure(type, message, code = 'native_test_error') {
-  return {
-    protocol: 'tokenless.native.v1',
-    type,
-    ok: false,
-    error: { code, message, retryable: false },
-  }
-}
-
-async function openSettingsPage(browser, baseUrl, plans) {
-  const context = await browser.newContext({ viewport: { width: 900, height: 900 } })
-  const page = await context.newPage()
-  const pageErrors = []
-  page.on('pageerror', (error) => pageErrors.push(error.message))
-  await page.addInitScript((initialPlans) => {
-    function chromeEvent() {
-      const listeners = []
-      return {
-        addListener(listener) {
-          listeners.push(listener)
-        },
-        emit(value) {
-          for (const listener of [...listeners]) listener(value)
-        },
-      }
-    }
-
-    const mock = {
-      plans: structuredClone(initialPlans),
-      requests: [],
-      ports: [],
-      respond(index, response) {
-        const port = this.ports[index]
-        if (!port || port.disconnected) throw new Error(`Native request ${index} is not pending.`)
-        port.onMessage.emit(structuredClone(response))
-      },
-    }
-
-    Object.defineProperty(globalThis, '__nativeMock', {
-      configurable: true,
-      value: mock,
-    })
-    Object.defineProperty(globalThis, 'chrome', {
-      configurable: true,
-      value: {
-        runtime: {
-          lastError: undefined,
-          connectNative(hostName) {
-            if (hostName !== 'dev.tokenless.native_host') {
-              throw new Error(`Unexpected native host: ${hostName}`)
-            }
-            const onMessage = chromeEvent()
-            const onDisconnect = chromeEvent()
-            const port = {
-              onMessage,
-              onDisconnect,
-              disconnected: false,
-              postMessage(message) {
-                if (port.disconnected) throw new Error('Native port is disconnected.')
-                const requestIndex = mock.requests.push(structuredClone(message)) - 1
-                mock.ports[requestIndex] = port
-                const plan = mock.plans[requestIndex] ?? {}
-                if (Object.hasOwn(plan, 'response')) {
-                  setTimeout(() => {
-                    if (!port.disconnected) onMessage.emit(structuredClone(plan.response))
-                  }, Number(plan.delayMs ?? 0))
-                }
-              },
-              disconnect() {
-                if (port.disconnected) return
-                port.disconnected = true
-                onDisconnect.emit()
-              },
-            }
-            return port
-          },
-        },
-      },
-    })
-  }, plans)
-  await page.goto(`${baseUrl}/settings/index.html`, { waitUntil: 'domcontentloaded' })
-  return { context, page, pageErrors }
-}
-
-async function openProviderFixture(browser, url, html) {
-  const context = await browser.newContext({ viewport: { width: 900, height: 700 } })
-  await context.addInitScript(() => {
-    const listeners = []
-    const runtimeMessages = []
-    Object.defineProperty(globalThis, '__tokenlessRuntimeMessages', {
-      configurable: true,
-      value: runtimeMessages,
-    })
-    Object.defineProperty(globalThis, 'chrome', {
-      configurable: true,
-      value: {
-        runtime: {
-          onMessage: {
-            addListener(listener) {
-              listeners.push(listener)
-            },
-          },
-          async sendMessage(message) {
-            runtimeMessages.push(structuredClone(message))
-            return message?.type === 'tokenless.bridge.trusted_click'
-              ? { ok: false, code: 'debugger_control_unavailable' }
-              : { ok: true }
-          },
-        },
-      },
-    })
-    Object.defineProperty(globalThis, '__dispatchTokenlessMessage', {
-      configurable: true,
-      value(message) {
-        return new Promise((resolve, reject) => {
-          const listener = listeners[0]
-          if (!listener) {
-            reject(new Error('Provider content listener is not installed.'))
-            return
-          }
-          let responded = false
-          const keepChannelOpen = listener(message, {}, (response) => {
-            responded = true
-            resolve(response)
-          })
-          if (keepChannelOpen !== true && !responded) {
-            reject(new Error('Provider content listener did not keep the response channel open.'))
-          }
-        })
-      },
-    })
-  })
-  const page = await context.newPage()
-  const pageErrors = []
-  page.on('pageerror', (error) => pageErrors.push(error.message))
-  const parsed = new URL(url)
-  await page.route(`${parsed.origin}/**`, (route) => route.fulfill({
-    status: 200,
-    contentType: 'text/html',
-    body: html,
-  }))
-  await page.goto(url, { waitUntil: 'domcontentloaded' })
-  await page.addScriptTag({ path: path.join(extensionDist, 'content/provider-content.js') })
-  return { context, page, pageErrors }
-}
-
-async function startStaticServer(directory) {
-  const absoluteRoot = path.resolve(directory)
-  const server = http.createServer((request, response) => {
-    let filePath
-    try {
-      const pathname = decodeURIComponent(new URL(request.url ?? '/', 'http://127.0.0.1').pathname)
-      filePath = path.resolve(absoluteRoot, pathname.replace(/^\/+/, ''))
-    } catch {
-      response.writeHead(400).end('Bad request')
-      return
-    }
-    if (filePath !== absoluteRoot && !filePath.startsWith(`${absoluteRoot}${path.sep}`)) {
-      response.writeHead(403).end('Forbidden')
-      return
-    }
-    fs.readFile(filePath, (error, contents) => {
-      if (error) {
-        response.writeHead(error.code === 'ENOENT' ? 404 : 500).end(error.code === 'ENOENT' ? 'Not found' : 'Read failed')
-        return
-      }
-      response.writeHead(200, { 'content-type': contentType(filePath) })
-      response.end(contents)
-    })
-  })
-
-  await new Promise((resolve, reject) => {
-    server.once('error', reject)
-    server.listen(0, '127.0.0.1', resolve)
-  })
-  const address = server.address()
-  assert.ok(address && typeof address === 'object')
-  return {
-    url: `http://127.0.0.1:${address.port}`,
-    close: () => new Promise((resolve, reject) => {
-      server.close((error) => error ? reject(error) : resolve())
-    }),
-  }
-}
-
-function contentType(filePath) {
-  if (filePath.endsWith('.html')) return 'text/html; charset=utf-8'
-  if (filePath.endsWith('.js')) return 'text/javascript; charset=utf-8'
-  if (filePath.endsWith('.css')) return 'text/css; charset=utf-8'
-  if (filePath.endsWith('.json') || filePath.endsWith('.map')) return 'application/json; charset=utf-8'
-  return 'application/octet-stream'
-}
-
-function listRelativeFiles(directory) {
-  if (!fs.existsSync(directory)) return []
-  return fs.readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
-    const absolute = path.join(directory, entry.name)
-    if (entry.isDirectory()) {
-      return listRelativeFiles(absolute).map((file) => path.posix.join(entry.name, file))
-    }
-    return entry.isFile() ? [entry.name] : []
-  }).sort()
-}
-
-function readJson(relativePath) {
-  return JSON.parse(readText(relativePath))
-}
-
-function readText(relativePath) {
-  return fs.readFileSync(path.join(root, relativePath), 'utf8')
-}
-
-async function waitFor(predicate, timeoutMs = 2000) {
-  const deadline = Date.now() + timeoutMs
-  while (Date.now() < deadline) {
-    if (predicate()) return
-    await delay(5)
-  }
-  throw new Error('Timed out waiting for extension background behavior.')
-}
-
-function delay(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms))
-}
diff --git a/legacy/test/live-chatgpt.e2e.mjs b/legacy/test/live-chatgpt.e2e.mjs
deleted file mode 100644
index f43b657..0000000
--- a/legacy/test/live-chatgpt.e2e.mjs
+++ /dev/null
@@ -1,262 +0,0 @@
-import assert from 'node:assert/strict'
-import { spawnSync } from 'node:child_process'
-import fs from 'node:fs/promises'
-import os from 'node:os'
-import path from 'node:path'
-import test from 'node:test'
-import { fileURLToPath } from 'node:url'
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-const extensionPath = path.join(root, 'legacy/extension/dist/extension')
-const testResultsRoot = path.join(root, 'test-results', 'tokenless-live-chatgpt', 'runs')
-
-test('live ChatGPT DOM is driven by Tokenless extension without fixture routing', {
-  skip: process.env.TOKENLESS_LIVE_CHATGPT !== '1' ? 'set TOKENLESS_LIVE_CHATGPT=1 to run live ChatGPT E2E' : false,
-  timeout: 180000,
-}, async () => {
-  const { chromium } = await import('playwright')
-  const {
-    installNativeHost,
-    nativeMessagingHostDirs,
-    NATIVE_HOST_NAME,
-    readLiveBridgeMarker,
-  } = await import('../../packages/cli/dist/src/index.js')
-  const { DEFAULT_EXTENSION_ID } = await import('../extension/default-extension-id.mjs')
-
-  const artifactDir = await createArtifactDir()
-  const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'tokenless-live-chatgpt-'))
-  const userDataDir = process.env.TOKENLESS_LIVE_USER_DATA_DIR
-    ? path.resolve(process.env.TOKENLESS_LIVE_USER_DATA_DIR)
-    : path.join(tempRoot, 'profile')
-  const tokenlessHome = path.join(tempRoot, 'tokenless-home')
-  const prompt = process.env.TOKENLESS_LIVE_PROMPT || [
-    'Tokenless live DOM smoke test.',
-    'Reply with exactly: TOKENLESS_LIVE_DOM_OK_48291',
-  ].join('\n')
-  const events = []
-  let manifestBackup = []
-  let context = null
-
-  try {
-    const manifestHome = userDataDir
-    const browsers = ['profile']
-    manifestBackup = await snapshotFiles(browsers.flatMap((browser) => (
-      nativeMessagingHostDirs(browser, manifestHome).map((dir) => path.join(dir, `${NATIVE_HOST_NAME}.json`))
-    )))
-    const installed = await installNativeHost({
-      homeDir: tokenlessHome,
-      manifestHome,
-      extensionId: DEFAULT_EXTENSION_ID,
-      browsers,
-    })
-    events.push({
-      at: new Date().toISOString(),
-      event: 'native_host_installed',
-      manifests: installed.manifests,
-      executable: installed.nativeHostExecutable,
-    })
-
-    context = await launchTokenlessContext(chromium, userDataDir, tokenlessHome)
-    const extensionId = await discoverExtensionId(context)
-    assert.equal(extensionId, DEFAULT_EXTENSION_ID)
-    events.push({ at: new Date().toISOString(), event: 'extension_discovered', extensionId })
-    const bridgeMarker = await waitForBridgeMarker(tokenlessHome, readLiveBridgeMarker)
-    events.push({
-      at: new Date().toISOString(),
-      event: 'daemon_bridge_ready',
-      sessionId: bridgeMarker.sessionId,
-    })
-    const timeoutMs = Number(process.env.TOKENLESS_LIVE_TIMEOUT_MS || 120000)
-    const cliRun = spawnSync(process.execPath, [
-      path.join(root, 'packages/cli/dist/src/tokenless.mjs'),
-      'run',
-      '--prompt',
-      prompt,
-      '--provider',
-      'chatgpt',
-      '--home',
-      tokenlessHome,
-      '--target-url',
-      'https://chatgpt.com/',
-      '--read-delay-ms',
-      '1500',
-      '--read-timeout-ms',
-      String(process.env.TOKENLESS_LIVE_READ_TIMEOUT_MS || 90000),
-      '--timeout-ms',
-      String(timeoutMs),
-      '--no-open',
-      '--json',
-    ], {
-      cwd: root,
-      encoding: 'utf8',
-      timeout: timeoutMs + 30000,
-    })
-    const result = JSON.parse(cliRun.stdout || '{}')
-    events.push({
-      at: new Date().toISOString(),
-      event: 'cli_finished',
-      exitCode: cliRun.status,
-      jobId: result.jobId,
-      ok: result.ok,
-      error: result.error,
-    })
-    await fs.writeFile(path.join(artifactDir, 'cli-result.json'), `${JSON.stringify(result, null, 2)}\n`, 'utf8')
-
-    const realChatGptPage = context.pages().find((page) => page.url().startsWith('https://chatgpt.com/'))
-    if (realChatGptPage) {
-      await realChatGptPage.bringToFront()
-      await realChatGptPage.screenshot({
-        path: path.join(artifactDir, '01-real-chatgpt-after-result.png'),
-        animations: 'disabled',
-      })
-    }
-    assert.ok(realChatGptPage, `extension did not open ChatGPT: ${JSON.stringify(context.pages().map((page) => page.url()))}`)
-    await fs.writeFile(path.join(artifactDir, 'real-chatgpt-text.txt'), await realChatGptPage.locator('body').innerText().catch(() => ''), 'utf8')
-    const pageUrls = context.pages().map((page) => page.url())
-    assert.ok(pageUrls.every((url) => !url.startsWith('chrome-extension://')), JSON.stringify(pageUrls, null, 2))
-
-    await writeSummary(artifactDir, {
-      ok: cliRun.status === 0 && result.ok,
-      artifactDir,
-      mode: 'live-chatgpt',
-      fixture: false,
-      extensionId,
-      jobId: result.jobId,
-      provider: 'chatgpt',
-      targetUrl: 'https://chatgpt.com/',
-      prompt,
-      compactOutput: result.compactOutput,
-      error: result.error,
-      pageUrls,
-      events,
-    })
-
-    assert.equal(cliRun.status, 0, cliRun.stderr || cliRun.stdout)
-    assert.equal(result.ok, true, JSON.stringify(result, null, 2))
-    assert.match(result.compactOutput || '', /TOKENLESS_LIVE_DOM_OK_48291/)
-  } finally {
-    const cleanupErrors = []
-    await attemptCleanup(cleanupErrors, 'write live E2E artifacts', async () => {
-      if (context) {
-        await fs.writeFile(path.join(artifactDir, 'pages.json'), `${JSON.stringify(
-          context.pages().map((page) => ({ url: page.url() })),
-          null,
-          2
-        )}\n`, 'utf8')
-      }
-      await fs.writeFile(path.join(artifactDir, 'events.json'), `${JSON.stringify(events, null, 2)}\n`, 'utf8')
-    })
-    await attemptCleanup(cleanupErrors, 'close live browser context', async () => context?.close())
-    await attemptCleanup(cleanupErrors, 'restore live native host manifests', async () => restoreFiles(manifestBackup))
-    await attemptCleanup(cleanupErrors, 'stop installed daemon', async () => stopInstalledDaemon(tokenlessHome))
-    await attemptCleanup(cleanupErrors, 'remove temporary live E2E state', async () => {
-      await fs.rm(tempRoot, { recursive: true, force: true })
-    })
-    if (cleanupErrors.length > 0) {
-      throw new AggregateError(cleanupErrors, 'Tokenless live ChatGPT E2E cleanup failed')
-    }
-  }
-})
-
-async function launchTokenlessContext(chromium, userDataDir, tokenlessHome) {
-  const options = {
-    headless: false,
-    env: {
-      ...process.env,
-      TOKENLESS_HOME: tokenlessHome,
-    },
-    args: [
-      `--disable-extensions-except=${extensionPath}`,
-      `--load-extension=${extensionPath}`,
-      '--no-first-run',
-      '--no-default-browser-check',
-    ],
-  }
-  if (process.env.TOKENLESS_LIVE_CHANNEL) {
-    options.channel = process.env.TOKENLESS_LIVE_CHANNEL
-  }
-  return chromium.launchPersistentContext(userDataDir, options)
-}
-
-async function createArtifactDir() {
-  const stamp = new Date().toISOString().replace(/[:.]/g, '-')
-  const artifactDir = path.join(testResultsRoot, `${stamp}-${process.pid}`)
-  await fs.mkdir(artifactDir, { recursive: true })
-  return artifactDir
-}
-
-async function writeSummary(artifactDir, payload) {
-  await fs.writeFile(path.join(artifactDir, 'summary.json'), `${JSON.stringify(payload, null, 2)}\n`, 'utf8')
-  console.log(`Tokenless live ChatGPT artifacts: ${artifactDir}`)
-}
-
-async function attemptCleanup(errors, label, action) {
-  try {
-    await action()
-  } catch (error) {
-    errors.push(new Error(`${label}: ${error instanceof Error ? error.message : String(error)}`, {
-      cause: error,
-    }))
-  }
-}
-
-async function snapshotFiles(files) {
-  return Promise.all(files.map(async (file) => {
-    const previous = await fs.readFile(file, 'utf8').catch((error) => {
-      if (error.code === 'ENOENT') return null
-      throw error
-    })
-    return { file, previous }
-  }))
-}
-
-async function restoreFiles(entries) {
-  for (const entry of entries.reverse()) {
-    if (entry.previous === null) {
-      await fs.rm(entry.file, { force: true })
-    } else {
-      await fs.writeFile(entry.file, entry.previous)
-    }
-  }
-}
-
-async function discoverExtensionId(context) {
-  let [worker] = context.serviceWorkers()
-  if (!worker) {
-    worker = await context.waitForEvent('serviceworker', { timeout: 10000 })
-  }
-  const url = new URL(worker.url())
-  assert.equal(url.protocol, 'chrome-extension:')
-  return url.hostname
-}
-
-async function stopInstalledDaemon(homeDir) {
-  const record = await fs.readFile(path.join(homeDir, 'daemon.pid.json'), 'utf8')
-    .then((body) => JSON.parse(body))
-    .catch(() => null)
-  if (!Number.isInteger(record?.pid)) return
-  try {
-    process.kill(record.pid, 'SIGTERM')
-  } catch {
-    return
-  }
-  const deadline = Date.now() + 5000
-  while (Date.now() < deadline) {
-    try {
-      process.kill(record.pid, 0)
-    } catch {
-      return
-    }
-    await new Promise((resolve) => setTimeout(resolve, 100))
-  }
-}
-
-async function waitForBridgeMarker(homeDir, readLiveBridgeMarker) {
-  const deadline = Date.now() + 15000
-  while (Date.now() < deadline) {
-    const marker = await readLiveBridgeMarker({ homeDir })
-    if (marker) return marker
-    await new Promise((resolve) => setTimeout(resolve, 100))
-  }
-  throw new Error('Rust extension bridge did not become live before the live ChatGPT run.')
-}
diff --git a/legacy/test/native-daemon-host.test.mjs b/legacy/test/native-daemon-host.test.mjs
deleted file mode 100644
index 80e5ce4..0000000
--- a/legacy/test/native-daemon-host.test.mjs
+++ /dev/null
@@ -1,1063 +0,0 @@
-import assert from 'node:assert/strict'
-import { spawn, spawnSync } from 'node:child_process'
-import { createHmac } from 'node:crypto'
-import fs from 'node:fs'
-import http from 'node:http'
-import net from 'node:net'
-import os from 'node:os'
-import path from 'node:path'
-import test from 'node:test'
-import { fileURLToPath, pathToFileURL } from 'node:url'
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-const cliEntry = path.join(root, 'packages/cli/dist/src/tokenless.mjs')
-const cliIndex = path.join(root, 'packages/cli/dist/src/index.js')
-
-test('daemon client accepts loopback only', async () => {
-  const { daemonUrl } = await importCli()
-  for (const url of [
-    'http://192.168.1.10:7331',
-    'https://127.0.0.1:7331',
-    'http://example.com:7331',
-    'not-a-url',
-  ]) {
-    assert.throws(() => daemonUrl(url), /loopback HTTP URL/)
-  }
-  assert.equal(daemonUrl('http://127.0.0.1:7331/'), 'http://127.0.0.1:7331')
-  assert.equal(daemonUrl('http://localhost:7331'), 'http://localhost:7331')
-  assert.equal(daemonUrl('http://[::1]:7331'), 'http://[::1]:7331')
-})
-
-test('ready probe rejects either daemon or native protocol mismatch', async () => {
-  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-ready-protocol-'))
-  const { DAEMON_PROTOCOL, NATIVE_PROTOCOL, probeDaemonReady } = await importCli()
-  const token = 'ready-protocol-test-token'
-  fs.writeFileSync(path.join(homeDir, 'daemon.token'), `${token}\n`, { mode: 0o600 })
-  let readyBody = {
-    ready: true,
-    home_dir: fs.realpathSync(homeDir),
-    daemon_protocol: DAEMON_PROTOCOL,
-    native_protocol: NATIVE_PROTOCOL,
-  }
-  const server = http.createServer((request, response) => {
-    const challenge = new URL(request.url, 'http://127.0.0.1').searchParams.get('challenge')
-    response.writeHead(200, { 'content-type': 'application/json' })
-    response.end(JSON.stringify(signedReadyBody(readyBody, challenge, token)))
-  })
-  await new Promise((resolve, reject) => {
-    server.once('error', reject)
-    server.listen(0, '127.0.0.1', resolve)
-  })
-  const address = server.address()
-  const daemonUrl = `http://127.0.0.1:${address.port}`
-  try {
-    readyBody = { ...readyBody, daemon_protocol: 'tokenless.daemon.v999' }
-    const daemonMismatch = await probeDaemonReady({ homeDir, daemonUrl })
-    assert.equal(daemonMismatch.ok, false)
-    assert.equal(daemonMismatch.code, 'daemon_protocol_mismatch')
-
-    readyBody = {
-      ...readyBody,
-      daemon_protocol: DAEMON_PROTOCOL,
-      native_protocol: 'tokenless.native.v999',
-    }
-    const nativeMismatch = await probeDaemonReady({ homeDir, daemonUrl })
-    assert.equal(nativeMismatch.ok, false)
-    assert.equal(nativeMismatch.code, 'native_protocol_mismatch')
-  } finally {
-    await new Promise((resolve) => server.close(resolve))
-    fs.rmSync(homeDir, { recursive: true, force: true })
-  }
-})
-
-test('spoofed ready proof cannot capture bearer token or job prompt through CLI or exported client', async () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-ready-spoof-')))
-  const victimToken = 'victim-home-token'
-  const secretPrompt = 'NEVER_SEND_PROMPT_TO_UNPROVED_DAEMON'
-  fs.writeFileSync(path.join(homeDir, 'daemon.token'), `${victimToken}\n`, { mode: 0o600 })
-  const configured = spawnSync(process.execPath, [
-    cliEntry,
-    'profiles',
-    'add',
-    '--profile',
-    'default',
-    '--set-default',
-    '--home',
-    homeDir,
-    '--json',
-  ], { cwd: root, encoding: 'utf8' })
-  assert.equal(configured.status, 0, configured.stderr || configured.stdout)
-  const captured = []
-  const server = http.createServer(async (request, response) => {
-    const requestUrl = new URL(request.url, 'http://127.0.0.1')
-    const body = await streamText(request)
-    captured.push({
-      url: requestUrl.pathname,
-      authorization: request.headers.authorization,
-      body,
-    })
-    if (requestUrl.pathname === '/ready') {
-      respondJson(response, 200, signedReadyBody({
-        ready: true,
-        home_dir: fs.realpathSync(homeDir),
-        daemon_protocol: 'tokenless.daemon.v1',
-        native_protocol: 'tokenless.native.v1',
-      }, requestUrl.searchParams.get('challenge'), 'attacker-token'))
-      return
-    }
-    respondJson(response, 200, {})
-  })
-  await new Promise((resolve, reject) => {
-    server.once('error', reject)
-    server.listen(0, '127.0.0.1', resolve)
-  })
-  const address = server.address()
-  const daemonUrl = `http://127.0.0.1:${address.port}`
-  try {
-    const child = spawn(process.execPath, [
-      cliEntry,
-      'run',
-      '--prompt',
-      secretPrompt,
-      '--home',
-      homeDir,
-      '--daemon-url',
-      daemonUrl,
-      '--no-open',
-      '--json',
-    ], { cwd: root, stdio: ['ignore', 'pipe', 'pipe'] })
-    const completed = await waitForChild(child)
-    assert.equal(completed.code, 1, completed.stderr)
-    assert.equal(JSON.parse(completed.stdout).error.code, 'daemon_ready_proof_mismatch')
-
-    const { createDaemonJob } = await importCli()
-    await assert.rejects(
-      createDaemonJob({
-        homeDir,
-        daemonUrl,
-        provider: 'chatgpt',
-        action: 'submit_and_read',
-        requestJson: { prompt: secretPrompt },
-      }),
-      (error) => error.code === 'daemon_ready_proof_mismatch'
-    )
-    assert.equal(captured.every((request) => request.authorization === undefined), true)
-    assert.equal(captured.every((request) => !request.body.includes(secretPrompt)), true)
-    assert.deepEqual([...new Set(captured.map((request) => request.url))], ['/ready'])
-  } finally {
-    await new Promise((resolve) => server.close(resolve))
-    fs.rmSync(homeDir, { recursive: true, force: true })
-  }
-})
-
-test('ready proof is bound to each fresh challenge and rejects replay', async () => {
-  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-ready-replay-'))
-  const token = 'replay-test-token'
-  fs.writeFileSync(path.join(homeDir, 'daemon.token'), `${token}\n`, { mode: 0o600 })
-  let replayedBody
-  const server = http.createServer((request, response) => {
-    const challenge = new URL(request.url, 'http://127.0.0.1').searchParams.get('challenge')
-    replayedBody ??= signedReadyBody({
-      ready: true,
-      home_dir: fs.realpathSync(homeDir),
-      daemon_protocol: 'tokenless.daemon.v1',
-      native_protocol: 'tokenless.native.v1',
-    }, challenge, token)
-    respondJson(response, 200, replayedBody)
-  })
-  await new Promise((resolve, reject) => {
-    server.once('error', reject)
-    server.listen(0, '127.0.0.1', resolve)
-  })
-  const address = server.address()
-  const daemonUrl = `http://127.0.0.1:${address.port}`
-  try {
-    const { probeDaemonReady } = await importCli()
-    assert.equal((await probeDaemonReady({ homeDir, daemonUrl })).ok, true)
-    const replay = await probeDaemonReady({ homeDir, daemonUrl })
-    assert.equal(replay.ok, false)
-    assert.equal(replay.code, 'daemon_ready_proof_missing')
-  } finally {
-    await new Promise((resolve) => server.close(resolve))
-    fs.rmSync(homeDir, { recursive: true, force: true })
-  }
-})
-
-test('ensureDaemonReady starts one packaged Rust daemon under concurrent callers and verifies home identity', async () => {
-  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-auto-daemon-'))
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const { DAEMON_PROTOCOL, ensureDaemonReady, probeDaemonReady } = await importCli()
-  let pid
-  try {
-    const results = await Promise.all([
-      ensureDaemonReady({ homeDir, daemonUrl }),
-      ensureDaemonReady({ homeDir, daemonUrl }),
-    ])
-    assert.equal(results.filter((result) => result.started).length, 1)
-    pid = results.find((result) => result.pid)?.pid
-    assert.ok(Number.isInteger(pid))
-    assert.equal(new Set(results.map((result) => result.pid)).size, 1)
-    assert.equal(fs.existsSync(path.join(homeDir, 'daemon.pid.json')), true)
-    assert.equal(fs.existsSync(path.join(homeDir, 'daemon.log')), true)
-    const ready = await probeDaemonReady({ homeDir, daemonUrl })
-    assert.equal(ready.ok, true)
-    assert.equal(ready.body.daemon_protocol, DAEMON_PROTOCOL)
-    assert.equal(ready.body.native_protocol, 'tokenless.native.v1')
-    assert.equal(ready.actualHome, fs.realpathSync(homeDir))
-
-    const wrongHome = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-wrong-home-'))
-    try {
-      fs.copyFileSync(path.join(homeDir, 'daemon.token'), path.join(wrongHome, 'daemon.token'))
-      const mismatch = await probeDaemonReady({ homeDir: wrongHome, daemonUrl })
-      assert.equal(mismatch.ok, false)
-      assert.equal(mismatch.code, 'daemon_home_mismatch')
-      await assert.rejects(
-        ensureDaemonReady({ homeDir: wrongHome, daemonUrl }),
-        (error) => error.code === 'daemon_home_mismatch'
-      )
-    } finally {
-      fs.rmSync(wrongHome, { recursive: true, force: true })
-    }
-  } finally {
-    await stopPid(pid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-  }
-})
-
-// These cases preserve assertions for the retired extension-as-default CLI.
-// The managed replacement is covered by playwright-cli-managed.test.mjs.
-test.skip('legacy extension default: --no-open fails before job creation when bridge is absent', async () => {
-  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-no-bridge-'))
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  let pid
-  try {
-    const result = spawnSync(process.execPath, [
-      cliEntry,
-      'run',
-      '--prompt',
-      'must not queue',
-      '--home',
-      homeDir,
-      '--daemon-url',
-      daemonUrl,
-      '--no-open',
-      '--no-wait',
-      '--json',
-    ], { cwd: root, encoding: 'utf8' })
-    assert.equal(result.status, 1, result.stderr)
-    const payload = JSON.parse(result.stdout)
-    assert.equal(payload.error.code, 'extension_bridge_unavailable')
-    assert.match(payload.error.message, /No live Tokenless extension bridge/)
-    assert.equal(payload.statusLog.some((event) => event.event === 'bridge_missing'), true)
-    assert.doesNotMatch(result.stdout, /taskUrl|chrome-extension:\/\//)
-
-    const ready = await fetch(`${daemonUrl}/health`).then((response) => response.json())
-    pid = JSON.parse(fs.readFileSync(path.join(homeDir, 'daemon.pid.json'), 'utf8')).pid
-    assert.equal(ready.home_dir, fs.realpathSync(homeDir))
-    const jobs = await fetch(`${daemonUrl}/jobs`, {
-      headers: daemonAuthorization(homeDir),
-    }).then((response) => response.json())
-    assert.deepEqual(jobs, [])
-    assert.equal(fs.existsSync(path.join(homeDir, 'jobs')), false)
-  } finally {
-    await stopPid(pid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-  }
-})
-
-test('long-running jobs stay attached instead of degrading into detached work', () => {
-  const result = spawnSync(process.execPath, [
-    cliEntry,
-    'run',
-    '--prompt',
-    'wait for the visible provider result',
-    '--long-running',
-    '--no-wait',
-    '--json',
-  ], { cwd: root, encoding: 'utf8' })
-  assert.equal(result.status, 1, result.stderr)
-  const payload = JSON.parse(result.stdout)
-  assert.equal(payload.error.code, 'long_running_requires_wait')
-  assert.match(payload.error.message, /cannot be combined with --no-wait/)
-})
-
-test.skip('legacy extension default: live bridge wake and state metadata', async () => {
-  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-live-bridge-'))
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const { ensureDaemonReady } = await importCli()
-  let pid
-  try {
-    const daemon = await ensureDaemonReady({ homeDir, daemonUrl })
-    pid = daemon.pid
-    writeLiveBridge(homeDir)
-    const run = spawnSync(process.execPath, [
-      cliEntry,
-      'run',
-      '--prompt',
-      'hello through daemon only',
-      '--project-name',
-      'Tokenless',
-      '--chat-name',
-      'Daemon state',
-      '--home',
-      homeDir,
-      '--daemon-url',
-      daemonUrl,
-      '--no-open',
-      '--no-wait',
-      '--json',
-    ], {
-      cwd: root,
-      env: { ...process.env, TOKENLESS_EXTENSION_ID: '' },
-      encoding: 'utf8',
-    })
-    assert.equal(run.status, 0, run.stderr)
-    const payload = JSON.parse(run.stdout)
-    assert.equal(payload.ok, true)
-    assert.equal(payload.transport, 'daemon')
-    assert.equal(payload.provider, 'chatgpt')
-    assert.equal(payload.taskId, 'project:Tokenless:chat:Daemon state')
-    assert.equal(payload.statusLog.some((event) => event.event === 'bridge_ready'), true)
-    assert.equal(payload.statusLog.some((event) => event.event === 'provider_opened'), false)
-    assert.doesNotMatch(run.stdout, /taskUrl|requestPath|chrome-extension:\/\//)
-
-    const daemonJob = await fetch(`${daemonUrl}/jobs/${encodeURIComponent(payload.jobId)}`, {
-      headers: daemonAuthorization(homeDir),
-    }).then((response) => response.json())
-    assert.equal(daemonJob.status, 'queued')
-    assert.equal(daemonJob.request_json.targetUrl, 'https://chatgpt.com/')
-    assert.equal(daemonJob.request_json.taskId, payload.taskId)
-    assert.match(daemonJob.request_json.prompt, /hello through daemon only/)
-    assert.equal(fs.existsSync(path.join(homeDir, 'jobs')), false)
-
-    const state = spawnSync(process.execPath, [
-      cliEntry,
-      'state',
-      '--task-id',
-      payload.taskId,
-      '--home',
-      homeDir,
-      '--daemon-url',
-      daemonUrl,
-      '--json',
-    ], { cwd: root, encoding: 'utf8' })
-    assert.equal(state.status, 0, state.stderr)
-    const statePayload = JSON.parse(state.stdout)
-    assert.equal(statePayload.transport, 'daemon')
-    assert.equal(statePayload.latest.jobId, payload.jobId)
-    assert.equal(statePayload.latest.status, 'queued')
-    assert.equal(statePayload.latest.state.actor, 'tokenless-daemon')
-    assert.equal(statePayload.latest.result, null)
-    assert.equal(statePayload.latest.prompt, undefined)
-    assert.equal(statePayload.latest.claimToken, undefined)
-  } finally {
-    await stopPid(pid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-  }
-})
-
-test.skip('legacy extension default: task filtering and failed error_json state', async () => {
-  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-error-state-'))
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const { createDaemonJob, ensureDaemonReady } = await importCli()
-  let pid
-  try {
-    const daemon = await ensureDaemonReady({ homeDir, daemonUrl })
-    pid = daemon.pid
-    const failed = await createDaemonJob({
-      homeDir,
-      daemonUrl,
-      provider: 'chatgpt',
-      action: 'submit_and_read',
-      requestJson: {
-        taskId: 'task-with-preserved-error',
-        metadata: { taskId: 'task-with-preserved-error' },
-      },
-    })
-    const claimed = await claimNextJob(homeDir, daemonUrl, 'submit_and_read')
-    assert.equal(claimed.job.job_id, failed.job_id)
-    const expectedError = {
-      code: 'provider_blocker_visible',
-      message: 'Visible provider asked for user action.',
-      retryable: false,
-    }
-    await failJob(homeDir, daemonUrl, claimed.job, expectedError)
-
-    // Newer unrelated jobs would hide the target under the old finite local scan.
-    for (let index = 0; index < 12; index += 1) {
-      await createDaemonJob({
-        homeDir,
-        daemonUrl,
-        provider: 'chatgpt',
-        action: 'submit_and_read',
-        requestJson: { taskId: `unrelated-${index}` },
-      })
-    }
-    await createDaemonJob({
-      homeDir,
-      daemonUrl,
-      provider: 'claude',
-      action: 'submit_and_read',
-      requestJson: { taskId: 'task-with-preserved-error' },
-    })
-    const state = spawnSync(process.execPath, [
-      cliEntry,
-      'state',
-      '--task-id',
-      'task-with-preserved-error',
-      '--limit',
-      '1',
-      '--home',
-      homeDir,
-      '--daemon-url',
-      daemonUrl,
-      '--json',
-    ], { cwd: root, encoding: 'utf8' })
-    assert.equal(state.status, 0, state.stderr)
-    const payload = JSON.parse(state.stdout)
-    assert.equal(payload.latest.jobId, failed.job_id)
-    assert.equal(payload.latest.status, 'failed')
-    assert.deepEqual(payload.latest.error, expectedError)
-    assert.deepEqual(payload.latest.state.error, expectedError)
-    assert.deepEqual(payload.latest.result.error, expectedError)
-    assert.equal(payload.latest.result.value, null)
-  } finally {
-    await stopPid(pid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-  }
-})
-
-test('cancel command reports only daemon-confirmed cancellation', async () => {
-  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-explicit-cancel-'))
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const { createDaemonJob, ensureDaemonReady, getDaemonJob } = await importCli()
-  let pid
-  try {
-    const daemon = await ensureDaemonReady({ homeDir, daemonUrl })
-    pid = daemon.pid
-    const created = await createDaemonJob({
-      homeDir,
-      daemonUrl,
-      provider: 'chatgpt',
-      action: 'submit_and_read',
-      requestJson: { taskId: 'explicit-cancel' },
-    })
-    const canceled = spawnSync(process.execPath, [
-      cliEntry,
-      'cancel',
-      '--job-id',
-      created.job_id,
-      '--home',
-      homeDir,
-      '--daemon-url',
-      daemonUrl,
-      '--json',
-    ], { cwd: root, encoding: 'utf8' })
-    assert.equal(canceled.status, 0, canceled.stderr)
-    const payload = JSON.parse(canceled.stdout)
-    assert.equal(payload.status, 'canceled')
-    assert.equal(payload.error.code, 'job_canceled')
-    assert.equal(payload.error.reason.code, 'user_requested')
-    assert.equal((await getDaemonJob({ homeDir, daemonUrl, jobId: created.job_id })).status, 'canceled')
-
-    const repeated = spawnSync(process.execPath, [
-      cliEntry,
-      'cancel',
-      '--job-id',
-      created.job_id,
-      '--home',
-      homeDir,
-      '--daemon-url',
-      daemonUrl,
-      '--json',
-    ], { cwd: root, encoding: 'utf8' })
-    assert.equal(repeated.status, 1)
-    assert.equal(JSON.parse(repeated.stdout).error.code, 'job_cancel_failed')
-    assert.match(JSON.parse(repeated.stdout).error.message, /not confirmed.*may still be running or may already have completed/)
-  } finally {
-    await stopPid(pid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-  }
-})
-
-test.skip('legacy extension default: interrupt cancellation against extension jobs', {
-  skip: process.platform === 'win32' && 'POSIX signal delivery is not portable to Windows child processes.',
-}, async () => {
-  for (const scenario of [
-    { signal: 'SIGINT', cancelMode: 'delayed-success', cancelTimeoutMs: 1000, expectedCode: 'job_interrupted', expectedEvent: 'cancel_confirmed' },
-    { signal: 'SIGTERM', cancelMode: 'hang', cancelTimeoutMs: 100, expectedCode: 'job_cancel_failed', expectedEvent: 'cancel_failed' },
-  ]) {
-    const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-signal-cancel-'))
-    const fake = await startSignalDaemon(homeDir, scenario.cancelMode)
-    writeLiveBridge(homeDir)
-    const child = spawn(process.execPath, [
-      cliEntry,
-      'run',
-      '--prompt',
-      'wait for a cancellation signal',
-      '--home',
-      homeDir,
-      '--daemon-url',
-      fake.daemonUrl,
-      '--no-open',
-      '--timeout-ms',
-      '10000',
-      '--cancel-timeout-ms',
-      String(scenario.cancelTimeoutMs),
-      '--json',
-    ], { cwd: root, stdio: ['ignore', 'pipe', 'pipe'] })
-    const completion = waitForChild(child)
-    try {
-      await waitUntil(() => fake.pollingStarted, 5000, 'CLI did not begin polling the fake daemon job.')
-      assert.equal(child.kill(scenario.signal), true)
-      const completed = await completion
-      assert.equal(completed.code, 1, completed.stderr)
-      const payload = JSON.parse(completed.stdout)
-      assert.equal(payload.error.code, scenario.expectedCode)
-      assert.equal(payload.statusLog.some((event) => event.event === scenario.expectedEvent), true)
-      if (scenario.cancelMode === 'delayed-success') {
-        assert.match(payload.error.message, /cancellation was confirmed/)
-      } else {
-        assert.match(payload.error.message, /not confirmed.*may still be running or may already have completed/)
-        assert.equal(fake.jobStatus, 'running')
-        const explicit = spawn(process.execPath, [
-          cliEntry,
-          'cancel',
-          '--job-id',
-          'signal-job',
-          '--home',
-          homeDir,
-          '--daemon-url',
-          fake.daemonUrl,
-          '--cancel-timeout-ms',
-          '100',
-          '--json',
-        ], { cwd: root, stdio: ['ignore', 'pipe', 'pipe'] })
-        const explicitResult = await waitForChild(explicit)
-        assert.equal(explicitResult.code, 1, explicitResult.stderr)
-        assert.equal(JSON.parse(explicitResult.stdout).error.code, 'job_cancel_failed')
-      }
-    } finally {
-      if (child.exitCode === null) child.kill('SIGKILL')
-      await fake.close()
-      fs.rmSync(homeDir, { recursive: true, force: true })
-    }
-  }
-})
-
-test.skip('legacy extension default: bridge wake URL policy', async () => {
-  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-provider-wake-'))
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const launcher = createFakeBrowserLauncher(homeDir)
-  const { ensureDaemonReady } = await importCli()
-  let pid
-  try {
-    const daemon = await ensureDaemonReady({ homeDir, daemonUrl })
-    pid = daemon.pid
-    const env = fakeBrowserEnv(homeDir, launcher)
-    const run = spawnSync(process.execPath, [
-      cliEntry,
-      'run',
-      '--prompt',
-      'wake ChatGPT safely',
-      '--browser',
-      'profile',
-      '--home',
-      homeDir,
-      '--daemon-url',
-      daemonUrl,
-      '--bridge-timeout-ms',
-      '3000',
-      '--no-wait',
-      '--json',
-    ], { cwd: root, env, encoding: 'utf8' })
-    assert.equal(run.status, 0, run.stderr)
-    const payload = JSON.parse(run.stdout)
-    assert.equal(fs.readFileSync(path.join(homeDir, 'opened-url.txt'), 'utf8'), 'https://chatgpt.com/')
-    const opened = payload.statusLog.find((event) => event.event === 'provider_opened')
-    assert.equal(opened.providerUrl, 'https://chatgpt.com/')
-    assert.equal(opened.browser, 'profile')
-    assert.doesNotMatch(run.stdout, /taskUrl|chrome-extension:\/\/|file:\/\//)
-
-    fs.rmSync(path.join(homeDir, 'extension-bridge.json'), { force: true })
-    fs.rmSync(path.join(homeDir, 'opened-url.txt'), { force: true })
-    const rejected = spawnSync(process.execPath, [
-      cliEntry,
-      'run',
-      '--prompt',
-      'do not open attacker URL',
-      '--target-url',
-      'https://example.com/attack',
-      '--browser',
-      'profile',
-      '--home',
-      homeDir,
-      '--daemon-url',
-      daemonUrl,
-      '--no-wait',
-      '--json',
-    ], { cwd: root, env, encoding: 'utf8' })
-    assert.equal(rejected.status, 1)
-    assert.equal(JSON.parse(rejected.stdout).error.code, 'invalid_provider_url')
-    assert.equal(fs.existsSync(path.join(homeDir, 'opened-url.txt')), false)
-  } finally {
-    await stopPid(pid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-  }
-})
-
-test.skip('legacy extension default: extension snapshot persistence', async () => {
-  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-daemon-snapshot-'))
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const { ensureDaemonReady } = await importCli()
-  let pid
-  let child
-  try {
-    const daemon = await ensureDaemonReady({ homeDir, daemonUrl })
-    pid = daemon.pid
-    writeLiveBridge(homeDir)
-    child = spawn(process.execPath, [
-      cliEntry,
-      'snapshot-dom',
-      '--provider',
-      'chatgpt',
-      '--include-text',
-      '--home',
-      homeDir,
-      '--daemon-url',
-      daemonUrl,
-      '--no-open',
-      '--timeout-ms',
-      '10000',
-      '--json',
-    ], { cwd: root, stdio: ['ignore', 'pipe', 'pipe'] })
-    const job = await waitForQueuedJob(homeDir, daemonUrl, child)
-    const claimed = await claimNextJob(homeDir, daemonUrl, 'snapshot_dom')
-    assert.equal(claimed.job.job_id, job.job_id)
-    await completeJob(homeDir, daemonUrl, claimed.job, {
-      status: 'snapshotted',
-      provider: 'chatgpt',
-      url: 'https://chatgpt.com/',
-      title: 'Visible ChatGPT',
-      capturedAt: new Date().toISOString(),
-      sanitized: true,
-      includeText: true,
-      html: '<!doctype html><html><body>[redacted]</body></html>',
-      selectorProbes: { composer: true },
-      visibleText: 'Visible safe text',
-    })
-    const completed = await waitForChild(child)
-    assert.equal(completed.code, 0, completed.stderr)
-    const payload = JSON.parse(completed.stdout)
-    assert.equal(payload.transport, 'daemon')
-    assert.equal(payload.snapshot.sanitized, true)
-    assert.equal(fs.existsSync(payload.snapshot.htmlPath), true)
-    assert.equal(fs.existsSync(payload.snapshot.selectorProbesPath), true)
-    assert.equal(fs.existsSync(payload.snapshot.visibleTextPath), true)
-    assert.match(fs.readFileSync(payload.snapshot.htmlPath, 'utf8'), /\[redacted\]/)
-    assert.doesNotMatch(completed.stdout, /taskUrl|chrome-extension:\/\//)
-  } finally {
-    if (child && child.exitCode === null) child.kill('SIGTERM')
-    await stopPid(pid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-  }
-})
-
-test('legacy extension install remains available without defining managed Playwright readiness', async () => {
-  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-doctor-'))
-  const manifestHome = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-doctor-manifest-'))
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const launcher = createFakeBrowserLauncher(homeDir)
-  const env = fakeBrowserEnv(homeDir, launcher)
-  let pid
-  try {
-    const install = spawnSync(process.execPath, [
-      cliEntry,
-      'install',
-      '--extension-id',
-      'abcdefghijklmnopabcdefghijklmnop',
-      '--browser',
-      'profile',
-      '--manifest-home',
-      manifestHome,
-      '--home',
-      homeDir,
-      '--daemon-url',
-      daemonUrl,
-      '--json',
-    ], { cwd: root, env, encoding: 'utf8' })
-    assert.equal(install.status, 0, install.stderr)
-    const installed = JSON.parse(install.stdout)
-    pid = installed.daemon.pid
-    assert.equal(installed.runtime, 'rust')
-    assert.equal(installed.nativeHost.runtime, 'rust')
-    assert.match(installed.nativeHost.executable, /tokenless-native-host(?:\.exe)?$/)
-    assert.match(installed.daemon.executable, /tokenless-daemon(?:\.exe)?$/)
-    assert.equal(installed.nativeHost.manifests.length, 1)
-    const manifest = JSON.parse(fs.readFileSync(installed.nativeHost.manifests[0], 'utf8'))
-    assert.equal(manifest.path, installed.nativeHost.executable)
-    assert.deepEqual(manifest.allowed_origins, ['chrome-extension://abcdefghijklmnopabcdefghijklmnop/'])
-
-    assert.equal(installed.nextStep.includes('tokenless setup'), true)
-  } finally {
-    await stopPid(pid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-    fs.rmSync(manifestHome, { recursive: true, force: true })
-  }
-})
-
-test.skip('legacy extension default: setup confirms extension bridge', async () => {
-  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-setup-'))
-  const manifestHome = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-setup-manifest-'))
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const launcher = createFakeBrowserLauncher(homeDir)
-  const env = fakeBrowserEnv(homeDir, launcher)
-  let pid
-  try {
-    const setup = spawnSync(process.execPath, [
-      cliEntry,
-      'setup',
-      '--extension-id',
-      'abcdefghijklmnopabcdefghijklmnop',
-      '--browser',
-      'profile',
-      '--manifest-home',
-      manifestHome,
-      '--home',
-      homeDir,
-      '--daemon-url',
-      daemonUrl,
-      '--bridge-timeout-ms',
-      '3000',
-      '--json',
-    ], { cwd: root, env, encoding: 'utf8' })
-    assert.equal(setup.status, 0, setup.stderr || setup.stdout)
-    const payload = JSON.parse(setup.stdout)
-    pid = payload.daemon.pid
-    assert.equal(payload.ok, true)
-    assert.equal(payload.status, 'ready')
-    assert.equal(payload.provider, 'chatgpt')
-    assert.equal(payload.providerOpened, true)
-    assert.equal(payload.extensionBridge.ready, true)
-    assert.equal(payload.extensionBridge.sessionId, 'fake-browser-bridge')
-    assert.equal(fs.readFileSync(path.join(homeDir, 'opened-url.txt'), 'utf8'), 'https://chatgpt.com/')
-    assert.equal(fs.existsSync(path.join(homeDir, 'bin', process.platform === 'win32' ? 'tokenless-native-host.exe' : 'tokenless-native-host')), true)
-  } finally {
-    await stopPid(pid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-    fs.rmSync(manifestHome, { recursive: true, force: true })
-  }
-})
-
-test.skip('legacy extension default: setup fails without extension bridge', async () => {
-  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-setup-missing-'))
-  const manifestHome = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-setup-missing-manifest-'))
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const launcher = createNoBridgeFakeBrowserLauncher(homeDir)
-  const env = fakeBrowserEnv(homeDir, launcher)
-  let pid
-  try {
-    const setup = spawnSync(process.execPath, [
-      cliEntry,
-      'setup',
-      '--extension-id',
-      'abcdefghijklmnopabcdefghijklmnop',
-      '--browser',
-      'profile',
-      '--manifest-home',
-      manifestHome,
-      '--home',
-      homeDir,
-      '--daemon-url',
-      daemonUrl,
-      '--bridge-timeout-ms',
-      '150',
-      '--json',
-    ], { cwd: root, env, encoding: 'utf8' })
-    assert.equal(setup.status, 1, setup.stderr || setup.stdout)
-    const payload = JSON.parse(setup.stdout)
-    assert.equal(payload.ok, false)
-    assert.equal(payload.error.code, 'extension_setup_incomplete')
-    assert.match(payload.error.message, /Install or enable the Tokenless extension/i)
-    const openedUrlPath = path.join(homeDir, 'opened-url.txt')
-    await waitUntil(
-      () => fs.existsSync(openedUrlPath),
-      2000,
-      'Expected setup to open the selected provider page before reporting bridge setup failure.'
-    )
-    assert.equal(fs.readFileSync(openedUrlPath, 'utf8'), 'https://chatgpt.com/')
-    pid = JSON.parse(fs.readFileSync(path.join(homeDir, 'daemon.pid.json'), 'utf8')).pid
-  } finally {
-    await stopPid(pid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-    fs.rmSync(manifestHome, { recursive: true, force: true })
-  }
-})
-
-function importCli() {
-  return import(pathToFileURL(cliIndex).href)
-}
-
-function writeLiveBridge(homeDir) {
-  fs.writeFileSync(path.join(homeDir, 'extension-bridge.json'), JSON.stringify({
-    protocol: 'tokenless.extension-bridge-state.v1',
-    pid: process.pid,
-    sessionId: `test-${Date.now()}`,
-    connectedAt: new Date().toISOString(),
-    heartbeatAt: new Date().toISOString(),
-  }))
-}
-
-function createFakeBrowserLauncher(homeDir) {
-  const script = path.join(homeDir, 'fake-chromium.mjs')
-  fs.writeFileSync(script, `#!/usr/bin/env node
-import fs from 'node:fs'
-import path from 'node:path'
-const home = process.env.TOKENLESS_TEST_BRIDGE_HOME
-fs.writeFileSync(process.env.TOKENLESS_TEST_OPEN_LOG, process.argv[2])
-fs.writeFileSync(path.join(home, 'extension-bridge.json'), JSON.stringify({
-  protocol: 'tokenless.extension-bridge-state.v1',
-  pid: Number(process.env.TOKENLESS_TEST_BRIDGE_PID),
-  sessionId: 'fake-browser-bridge',
-  connectedAt: new Date().toISOString(),
-  heartbeatAt: new Date().toISOString()
-}))
-`)
-  fs.chmodSync(script, 0o755)
-  return script
-}
-
-function createNoBridgeFakeBrowserLauncher(homeDir) {
-  const script = path.join(homeDir, 'fake-chromium-without-bridge.mjs')
-  fs.writeFileSync(script, `#!/usr/bin/env node
-import fs from 'node:fs'
-fs.writeFileSync(process.env.TOKENLESS_TEST_OPEN_LOG, process.argv[2])
-`)
-  fs.chmodSync(script, 0o755)
-  return script
-}
-
-function fakeBrowserEnv(homeDir, launcher) {
-  return {
-    ...process.env,
-    TOKENLESS_BROWSER_EXECUTABLE: launcher,
-    TOKENLESS_TEST_BRIDGE_HOME: homeDir,
-    TOKENLESS_TEST_OPEN_LOG: path.join(homeDir, 'opened-url.txt'),
-    TOKENLESS_TEST_BRIDGE_PID: String(process.pid),
-  }
-}
-
-async function claimNextJob(homeDir, daemonUrl, action) {
-  const token = fs.readFileSync(path.join(homeDir, 'daemon.token'), 'utf8').trim()
-  const response = await fetch(`${daemonUrl}/control/jobs/claim-next?action=${encodeURIComponent(action)}`, {
-    method: 'POST',
-    headers: { authorization: `Bearer ${token}` },
-  })
-  assert.equal(response.ok, true)
-  return response.json()
-}
-
-async function completeJob(homeDir, daemonUrl, job, result) {
-  const response = await fetch(`${daemonUrl}/jobs/${encodeURIComponent(job.job_id)}/complete`, {
-    method: 'POST',
-    headers: { ...daemonAuthorization(homeDir), 'content-type': 'application/json' },
-    body: JSON.stringify({ claim_token: job.claim_token, result_json: result }),
-  })
-  assert.equal(response.ok, true, await response.text())
-}
-
-async function failJob(homeDir, daemonUrl, job, error) {
-  const response = await fetch(`${daemonUrl}/jobs/${encodeURIComponent(job.job_id)}/complete`, {
-    method: 'POST',
-    headers: { ...daemonAuthorization(homeDir), 'content-type': 'application/json' },
-    body: JSON.stringify({ claim_token: job.claim_token, error_json: error }),
-  })
-  assert.equal(response.ok, true, await response.text())
-}
-
-async function waitForQueuedJob(homeDir, daemonUrl, child) {
-  const deadline = Date.now() + 10000
-  while (Date.now() < deadline) {
-    if (child.exitCode !== null) throw new Error(`CLI exited before creating job: ${await streamText(child.stderr)}`)
-    const jobs = await fetch(`${daemonUrl}/jobs`, {
-      headers: daemonAuthorization(homeDir),
-    }).then((response) => response.json()).catch(() => [])
-    if (jobs[0]) return jobs[0]
-    await delay(50)
-  }
-  throw new Error('Timed out waiting for daemon job.')
-}
-
-function daemonAuthorization(homeDir) {
-  const token = fs.readFileSync(path.join(homeDir, 'daemon.token'), 'utf8').trim()
-  return { authorization: `Bearer ${token}` }
-}
-
-async function waitForChild(child) {
-  let stdout = ''
-  let stderr = ''
-  child.stdout.on('data', (chunk) => { stdout += chunk.toString('utf8') })
-  child.stderr.on('data', (chunk) => { stderr += chunk.toString('utf8') })
-  const code = await new Promise((resolve, reject) => {
-    child.once('error', reject)
-    child.once('close', resolve)
-  })
-  return { code, stdout, stderr }
-}
-
-async function streamText(stream) {
-  let text = ''
-  for await (const chunk of stream) text += chunk.toString('utf8')
-  return text
-}
-
-async function startSignalDaemon(homeDir, cancelMode) {
-  const token = 'fake-daemon-control-token'
-  fs.writeFileSync(path.join(homeDir, 'daemon.token'), `${token}\n`, { mode: 0o600 })
-  let created = false
-  let pollingStarted = false
-  let jobStatus = 'running'
-  let requestJson = {}
-  const job = (status = jobStatus, error = null) => ({
-    job_id: 'signal-job',
-    claim_token: 'signal-claim',
-    provider: 'chatgpt',
-    action: 'submit_and_read',
-    status,
-    request_json: requestJson,
-    result_json: null,
-    error_json: error,
-    created_at: new Date().toISOString(),
-    updated_at: new Date().toISOString(),
-  })
-  const server = http.createServer(async (request, response) => {
-    const requestUrl = new URL(request.url, 'http://127.0.0.1')
-    if (requestUrl.pathname === '/ready') {
-      respondJson(response, 200, signedReadyBody({
-        ready: true,
-        home_dir: fs.realpathSync(homeDir),
-        daemon_protocol: 'tokenless.daemon.v1',
-        native_protocol: 'tokenless.native.v1',
-      }, requestUrl.searchParams.get('challenge'), token))
-      return
-    }
-    if (request.headers.authorization !== `Bearer ${token}`) {
-      respondJson(response, 401, { error: { message: 'missing bearer token' } })
-      return
-    }
-    if (request.method === 'POST' && requestUrl.pathname === '/jobs') {
-      const payload = JSON.parse(await streamText(request))
-      requestJson = payload.request_json
-      created = true
-      respondJson(response, 200, job('queued'))
-      return
-    }
-    if (request.method === 'GET' && requestUrl.pathname === '/jobs/signal-job') {
-      pollingStarted = true
-      respondJson(response, 200, job())
-      return
-    }
-    if (request.method === 'POST' && requestUrl.pathname === '/control/jobs/signal-job/cancel') {
-      const payload = JSON.parse((await streamText(request)) || '{}')
-      if (cancelMode === 'hang') {
-        response.writeHead(200, { 'content-type': 'application/json' })
-        response.flushHeaders()
-        return
-      }
-      if (cancelMode === 'failure') {
-        respondJson(response, 503, { error: { message: 'injected cancellation failure' } })
-        return
-      }
-      jobStatus = 'canceled'
-      if (cancelMode === 'delayed-success') await delay(200)
-      respondJson(response, 200, job('canceled', { code: 'job_canceled', reason: payload.reason }))
-      return
-    }
-    respondJson(response, 404, { error: { message: 'not found' } })
-  })
-  await new Promise((resolve, reject) => {
-    server.once('error', reject)
-    server.listen(0, '127.0.0.1', resolve)
-  })
-  const address = server.address()
-  return {
-    daemonUrl: `http://127.0.0.1:${address.port}`,
-    get created() { return created },
-    get pollingStarted() { return pollingStarted },
-    get jobStatus() { return jobStatus },
-    close: () => new Promise((resolve) => server.close(resolve)),
-  }
-}
-
-function respondJson(response, status, payload) {
-  response.writeHead(status, { 'content-type': 'application/json' })
-  response.end(JSON.stringify(payload))
-}
-
-function signedReadyBody(body, challenge, token) {
-  const proofProtocol = 'tokenless.daemon-ready-proof.v1'
-  const fields = [
-    proofProtocol,
-    challenge ?? '',
-    body.daemon_protocol,
-    body.native_protocol,
-    body.home_dir,
-  ]
-  const chunks = []
-  for (const field of fields) {
-    const value = Buffer.from(field, 'utf8')
-    const length = Buffer.alloc(4)
-    length.writeUInt32BE(value.length)
-    chunks.push(length, value)
-  }
-  return {
-    ...body,
-    ready_proof_protocol: proofProtocol,
-    ready_challenge: challenge,
-    ready_proof: createHmac('sha256', token).update(Buffer.concat(chunks)).digest('base64url'),
-  }
-}
-
-async function waitUntil(predicate, timeoutMs, message) {
-  const deadline = Date.now() + timeoutMs
-  while (Date.now() < deadline) {
-    if (predicate()) return
-    await delay(20)
-  }
-  throw new Error(message)
-}
-
-async function freePort() {
-  const server = net.createServer()
-  await new Promise((resolve, reject) => {
-    server.once('error', reject)
-    server.listen(0, '127.0.0.1', resolve)
-  })
-  const address = server.address()
-  const port = typeof address === 'object' && address ? address.port : 0
-  await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()))
-  return port
-}
-
-async function stopPid(pid) {
-  if (!Number.isInteger(pid)) return
-  try {
-    process.kill(pid, 'SIGTERM')
-  } catch {
-    return
-  }
-  const deadline = Date.now() + 3000
-  while (Date.now() < deadline) {
-    try {
-      process.kill(pid, 0)
-      await delay(25)
-    } catch {
-      return
-    }
-  }
-  try { process.kill(pid, 'SIGKILL') } catch {}
-}
-
-function delay(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms))
-}
diff --git a/legacy/test/provider-dom-adapter.e2e.test.mjs b/legacy/test/provider-dom-adapter.e2e.test.mjs
deleted file mode 100644
index cb66fb4..0000000
--- a/legacy/test/provider-dom-adapter.e2e.test.mjs
+++ /dev/null
@@ -1,170 +0,0 @@
-import assert from 'node:assert/strict'
-import fs from 'node:fs'
-import path from 'node:path'
-import test from 'node:test'
-import { fileURLToPath } from 'node:url'
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-const contentScript = path.join(root, 'legacy/extension/dist/extension/content/provider-content.js')
-const fixtureRoot = path.join(root, 'test/fixtures/provider-dom')
-
-const providers = [
-  {
-    id: 'chatgpt',
-    state: 'signed-in-paid',
-    url: 'https://chatgpt.com/',
-    model: 'GPT-5.6 Sol',
-    composer: '#prompt-textarea',
-    auth: { state: 'authenticated', plan: { label: 'Plus', free: false } },
-  },
-  {
-    id: 'claude',
-    state: 'signed-in-free',
-    url: 'https://claude.ai/new',
-    model: 'Haiku 4.5',
-    composer: '[data-testid="chat-input"]',
-    auth: { state: 'authenticated', plan: { label: 'Free', free: true } },
-  },
-  {
-    id: 'gemini',
-    state: 'signed-in-unknown',
-    url: 'https://gemini.google.com/app',
-    model: '3.1 Pro',
-    composer: 'rich-textarea [role="textbox"]',
-    auth: { state: 'authenticated' },
-  },
-  {
-    id: 'grok',
-    state: 'signed-in-unknown',
-    url: 'https://grok.com/',
-    model: 'Fast',
-    composer: '[role="textbox"][aria-label="Ask Grok anything"]',
-    auth: { state: 'authenticated' },
-  },
-]
-
-test('captured authenticated DOM drives priority auth, model, and prompt adapter actions', { timeout: 60000 }, async (t) => {
-  const { chromium } = await import('playwright')
-  const browser = await chromium.launch({ headless: true })
-  t.after(() => browser.close())
-
-  for (const provider of providers) {
-    await t.test(provider.id, async () => {
-      const modelSession = await openCapturedFixture(browser, provider, ['session-status', 'model-menu-open'])
-      try {
-        const auth = await dispatch(modelSession.page, {
-          type: 'tokenless.bridge.inspect_auth',
-          request: { provider: provider.id, requestId: `${provider.id}-captured-auth` },
-        })
-        assert.deepEqual(auth.auth, provider.auth)
-        assert.doesNotMatch(JSON.stringify(auth), /redacted account identity/i)
-
-        const inventory = await dispatch(modelSession.page, {
-          type: 'tokenless.bridge.inspect_controls',
-          request: { provider: provider.id, requestId: `${provider.id}-captured-model-inspect` },
-        })
-        const capturedModel = inventory.controls.models.find((choice) => choice.label === provider.model)
-        assert.deepEqual(capturedModel, {
-          label: provider.model,
-          selected: true,
-          available: true,
-        })
-
-        const configured = await dispatch(modelSession.page, {
-          type: 'tokenless.bridge.configure_controls',
-          request: {
-            provider: provider.id,
-            requestId: `${provider.id}-captured-model-select`,
-            model: provider.model.toLocaleLowerCase('en-US'),
-          },
-        })
-        assert.equal(configured.status, 'configured')
-        assert.equal(configured.model.applied, provider.model)
-        assert.deepEqual(modelSession.pageErrors, [])
-      } finally {
-        await modelSession.context.close()
-      }
-
-      const promptSession = await openCapturedFixture(browser, provider, ['session-status', 'composer-idle'])
-      try {
-        const prompt = `Captured DOM prompt proof for ${provider.id}`
-        const input = await dispatch(promptSession.page, {
-          type: 'tokenless.bridge.input_prompt',
-          request: {
-            provider: provider.id,
-            requestId: `${provider.id}-captured-prompt-input`,
-            prompt,
-            mode: 'replace',
-          },
-        })
-        assert.equal(input.status, 'input')
-        assert.equal(input.visible, true)
-        assert.equal(await promptSession.page.locator(provider.composer).first().evaluate((node) => (
-          'value' in node && typeof node.value === 'string' && node.value.length > 0
-            ? node.value
-            : node.innerText
-        )), prompt)
-        assert.deepEqual(promptSession.pageErrors, [])
-      } finally {
-        await promptSession.context.close()
-      }
-    })
-  }
-})
-
-async function openCapturedFixture(browser, provider, scenarios) {
-  const html = mergedFixture(provider, scenarios)
-  const context = await browser.newContext({ viewport: { width: 1100, height: 850 } })
-  await context.addInitScript(() => {
-    const listeners = []
-    Object.defineProperty(globalThis, 'chrome', {
-      configurable: true,
-      value: {
-        runtime: {
-          onMessage: { addListener(listener) { listeners.push(listener) } },
-        },
-      },
-    })
-    Object.defineProperty(globalThis, '__dispatchTokenlessMessage', {
-      configurable: true,
-      value(message) {
-        return new Promise((resolve, reject) => {
-          const listener = listeners[0]
-          if (!listener) return reject(new Error('Provider content listener is not installed.'))
-          let responded = false
-          const keepOpen = listener(message, {}, (response) => {
-            responded = true
-            resolve(response)
-          })
-          if (keepOpen !== true && !responded) reject(new Error('Provider content response channel closed.'))
-        })
-      },
-    })
-  })
-  const page = await context.newPage()
-  const pageErrors = []
-  page.on('pageerror', (error) => pageErrors.push(error.message))
-  const origin = new URL(provider.url).origin
-  await page.route(`${origin}/**`, (route) => route.fulfill({
-    status: 200,
-    contentType: 'text/html',
-    body: html,
-  }))
-  await page.goto(provider.url, { waitUntil: 'domcontentloaded' })
-  await page.addScriptTag({ path: contentScript })
-  return { context, page, pageErrors }
-}
-
-function mergedFixture(provider, scenarios) {
-  const bodies = scenarios.map((scenario) => {
-    const filename = path.join(fixtureRoot, provider.id, provider.state, `${scenario}.html`)
-    const match = fs.readFileSync(filename, 'utf8').match(/<body[^>]*>([\s\S]*?)<\/body>/iu)
-    assert.ok(match, `fixture body missing: ${filename}`)
-    return match[1]
-  })
-  return `<!doctype html><html lang="en"><head><meta charset="utf-8"></head><body>${bodies.join('\n')}</body></html>`
-}
-
-function dispatch(page, message) {
-  return page.evaluate((payload) => globalThis.__dispatchTokenlessMessage(payload), message)
-}
diff --git a/legacy/test/provider-url-policy.test.mjs b/legacy/test/provider-url-policy.test.mjs
deleted file mode 100644
index c226dad..0000000
--- a/legacy/test/provider-url-policy.test.mjs
+++ /dev/null
@@ -1,231 +0,0 @@
-import assert from 'node:assert/strict'
-import test from 'node:test'
-
-const extensionPolicyUrl = new URL(
-  '../legacy/extension/dist/extension/shared/provider-navigation-policy.js',
-  import.meta.url
-)
-const extensionProvidersUrl = new URL(
-  '../legacy/extension/dist/extension/shared/provider-config.js',
-  import.meta.url
-)
-const cliUrl = new URL('../packages/cli/dist/src/index.js', import.meta.url)
-
-test('CLI and extension accept only strict queryless provider targets', async () => {
-  const { providerWakeUrl } = await import(cliUrl)
-  const { getProviderById } = await import(extensionProvidersUrl)
-  const { safeProviderTargetUrl } = await import(extensionPolicyUrl)
-  const accepted = {
-    chatgpt: [
-      'https://chatgpt.com/',
-      'https://chat.openai.com/c/12345678',
-      'https://chatgpt.com/g/g-p-12345678/project',
-      'https://chatgpt.com/g/g-p-12345678/c/abcdefgh9',
-    ],
-    claude: [
-      'https://claude.ai/new',
-      'https://claude.ai/chat/123e4567-e89b-12d3-a456-426614174001',
-      'https://claude.ai/project/123e4567-e89b-12d3-a456-426614174002',
-    ],
-    gemini: [
-      'https://gemini.google.com/app',
-      'https://gemini.google.com/app/4b9f2c7d1e6a',
-    ],
-    grok: [
-      'https://grok.com/',
-      'https://grok.com/c/123e4567-e89b-12d3-a456-426614174003',
-    ],
-  }
-
-  for (const [providerId, targets] of Object.entries(accepted)) {
-    const provider = getProviderById(providerId)
-    assert.ok(provider)
-    for (const target of targets) {
-      assert.equal(providerWakeUrl(providerId, target), new URL(target).href, `${providerId}: ${target}`)
-      assert.equal(safeProviderTargetUrl(provider, target), new URL(target).href, `${providerId}: ${target}`)
-    }
-  }
-})
-
-test('CLI and extension reject URL parser ambiguities and non-canonical authority', async () => {
-  const { providerWakeUrl } = await import(cliUrl)
-  const { getProviderById } = await import(extensionProvidersUrl)
-  const { safeProviderTargetUrl } = await import(extensionPolicyUrl)
-  const provider = getProviderById('chatgpt')
-  assert.ok(provider)
-
-  const rejected = [
-    'http://chatgpt.com/c/12345678',
-    'https://user@chatgpt.com/c/12345678',
-    'https://user:password@chatgpt.com/c/12345678',
-    'https://chatgpt.com:443/c/12345678',
-    'https://chatgpt.com:444/c/12345678',
-    'https://example.com/c/12345678',
-    'https://chatgpt.com/c/12345678?',
-    'https://chatgpt.com/c/12345678?model=auto',
-    'https://chatgpt.com/c/12345678#',
-    'https://chatgpt.com/c/12345678#composer',
-    'https://chatgpt.com/c\\12345678',
-    'https://chatgpt.com/c/%2fsettings',
-    'https://chatgpt.com/c/%252fsettings',
-    'https://chatgpt.com/c/%5Csettings',
-    'https://chatgpt.com/c/%00settings',
-    'https://chatgpt.com/c/%0Asettings',
-    'https://chatgpt.com/c/%7fsettings',
-    'https://chatgpt.com/c/%3fmodel=auto',
-    'https://chatgpt.com/c/%23composer',
-    'https://chatgpt.com/c/%not-an-escape',
-    ' https://chatgpt.com/c/12345678',
-    'https://chatgpt.com/c/12345678\n',
-  ]
-
-  for (const target of rejected) {
-    assert.equal(safeProviderTargetUrl(provider, target), null, target)
-    assert.throws(() => providerWakeUrl('chatgpt', target), /Provider target URL|Target URL/, target)
-  }
-  assert.equal(safeProviderTargetUrl(provider, { toString: () => 'https://chatgpt.com/' }), null)
-  assert.equal(safeProviderTargetUrl(provider, null), null)
-  assert.throws(
-    () => providerWakeUrl('chatgpt', { toString: () => 'https://chatgpt.com/' }),
-    /Provider target URL/
-  )
-  assert.throws(() => providerWakeUrl('chatgpt', null), /Provider target URL/)
-})
-
-test('canonical provider targets expose stable conversation and project scopes', async () => {
-  const { getProviderById } = await import(extensionProvidersUrl)
-  const {
-    canonicalProviderTarget,
-    canonicalProviderUrl,
-    isProviderConversationUrl,
-  } = await import(extensionPolicyUrl)
-  const chatgpt = getProviderById('chatgpt')
-  const claude = getProviderById('claude')
-  assert.ok(chatgpt)
-  assert.ok(claude)
-
-  const encodedConversation = canonicalProviderTarget(
-    chatgpt,
-    'https://chatgpt.com/%63/12345678/'
-  )
-  assert.deepEqual(
-    {
-      href: encodedConversation?.href,
-      pathname: encodedConversation?.pathname,
-      scope: encodedConversation?.scope,
-    },
-    {
-      href: 'https://chatgpt.com/c/12345678',
-      pathname: '/c/12345678',
-      scope: {
-        kind: 'conversation',
-        key: 'chatgpt:conversation:12345678',
-        id: '12345678',
-      },
-    }
-  )
-
-  const chatGptProject = canonicalProviderTarget(
-    chatgpt,
-    'https://chatgpt.com/g/g-p-12345678/project'
-  )
-  const chatGptProjectConversation = canonicalProviderTarget(
-    chatgpt,
-    'https://chatgpt.com/g/g-p-12345678/c/abcdefgh9'
-  )
-  assert.equal(chatGptProject?.scope.kind, 'project')
-  assert.equal(chatGptProjectConversation?.scope.kind, 'project')
-  assert.equal(chatGptProject?.scope.key, chatGptProjectConversation?.scope.key)
-
-  const claudeProject = canonicalProviderTarget(
-    claude,
-    'https://claude.ai/project/123e4567-e89b-12d3-a456-426614174002'
-  )
-  const claudeProjectChat = canonicalProviderTarget(
-    claude,
-    'https://claude.ai/project/123e4567-e89b-12d3-a456-426614174002/chat/abcdefg9'
-  )
-  assert.equal(claudeProject?.scope.kind, 'project')
-  assert.equal(claudeProject?.scope.key, claudeProjectChat?.scope.key)
-
-  for (const target of [
-    'https://chatgpt.com/g/g-p-12345678',
-    'https://chatgpt.com/g/g-p-12345678/project/files',
-    'https://chatgpt.com/g/g-p-12345678/c',
-    'https://chatgpt.com/g/g-p-12345678/c/short',
-    'https://chatgpt.com/g/g-p-12345678/c/abcdefgh9/files',
-    'https://chatgpt.com/g/g-p-12345678/files',
-  ]) {
-    const unknownProjectRoute = canonicalProviderTarget(chatgpt, target)
-    assert.equal(unknownProjectRoute?.scope.kind, 'path', target)
-    assert.notEqual(unknownProjectRoute?.scope.key, chatGptProject?.scope.key, target)
-  }
-
-  for (const target of [
-    'https://claude.ai/project/123e4567-e89b-12d3-a456-426614174002/files',
-    'https://claude.ai/project/123e4567-e89b-12d3-a456-426614174002/chat',
-    'https://claude.ai/project/123e4567-e89b-12d3-a456-426614174002/chat/short',
-    'https://claude.ai/project/123e4567-e89b-12d3-a456-426614174002/chat/abcdefg9/files',
-  ]) {
-    const unknownProjectRoute = canonicalProviderTarget(claude, target)
-    assert.equal(unknownProjectRoute?.scope.kind, 'path', target)
-    assert.notEqual(unknownProjectRoute?.scope.key, claudeProject?.scope.key, target)
-  }
-
-  assert.equal(
-    canonicalProviderTarget(chatgpt, 'https://chatgpt.com/c/12345678?model=auto'),
-    null
-  )
-  assert.equal(
-    canonicalProviderTarget(claude, 'https://claude.ai/project/123e4567-e89b-12d3-a456-426614174002#files'),
-    null
-  )
-  const liveConversationWithPrivateLocationState =
-    'https://chatgpt.com/c/12345678?draft=hello%20world#composer'
-  assert.equal(isProviderConversationUrl(chatgpt, liveConversationWithPrivateLocationState), true)
-  assert.equal(
-    canonicalProviderUrl(liveConversationWithPrivateLocationState),
-    'https://chatgpt.com/c/12345678'
-  )
-})
-
-test('provider transitions keep ChatGPT and Claude conversations inside the requested project', async () => {
-  const { getProviderById } = await import(extensionProvidersUrl)
-  const {
-    areProviderTransitionSourcesEquivalent,
-    isApprovedProviderTransition,
-    isProviderConversationUrl,
-    providerTransitionSource,
-  } = await import(extensionPolicyUrl)
-  const chatgpt = getProviderById('chatgpt')
-  const claude = getProviderById('claude')
-  assert.ok(chatgpt)
-  assert.ok(claude)
-
-  const chatGptProject = 'https://chatgpt.com/g/g-p-12345678/project'
-  const chatGptProjectChat = 'https://chatgpt.com/g/g-p-12345678/c/abcdefgh9'
-  const anotherChatGptProjectChat = 'https://chatgpt.com/g/g-p-87654321/c/abcdefgh9'
-  assert.deepEqual(providerTransitionSource(chatgpt, chatGptProject), {
-    kind: 'project',
-    customGptId: undefined,
-    projectId: 'g-p-12345678',
-  })
-  assert.equal(isProviderConversationUrl(chatgpt, chatGptProjectChat), true)
-  assert.equal(isApprovedProviderTransition(chatgpt, chatGptProject, chatGptProjectChat), true)
-  assert.equal(isApprovedProviderTransition(chatgpt, chatGptProject, anotherChatGptProjectChat), false)
-  assert.equal(isApprovedProviderTransition(chatgpt, chatGptProject, 'https://chatgpt.com/c/abcdefgh9'), false)
-  assert.equal(areProviderTransitionSourcesEquivalent(chatgpt, chatGptProject, chatGptProject), true)
-
-  const claudeProject = 'https://claude.ai/project/123e4567-e89b-12d3-a456-426614174002'
-  const claudeProjectChat = `${claudeProject}/chat/abcdefg9`
-  const anotherClaudeProjectChat = 'https://claude.ai/project/223e4567-e89b-12d3-a456-426614174002/chat/abcdefg9'
-  assert.deepEqual(providerTransitionSource(claude, claudeProject), {
-    kind: 'project',
-    customGptId: undefined,
-    projectId: '123e4567-e89b-12d3-a456-426614174002',
-  })
-  assert.equal(isProviderConversationUrl(claude, claudeProjectChat), true)
-  assert.equal(isApprovedProviderTransition(claude, claudeProject, claudeProjectChat), true)
-  assert.equal(isApprovedProviderTransition(claude, claudeProject, anotherClaudeProjectChat), false)
-  assert.equal(isApprovedProviderTransition(claude, claudeProject, 'https://claude.ai/chat/abcdefg9'), false)
-})
diff --git a/legacy/test/visible-attachment-content.test.mjs b/legacy/test/visible-attachment-content.test.mjs
deleted file mode 100644
index c3a4e7f..0000000
--- a/legacy/test/visible-attachment-content.test.mjs
+++ /dev/null
@@ -1,624 +0,0 @@
-import assert from 'node:assert/strict'
-import { createHash } from 'node:crypto'
-import fs from 'node:fs'
-import path from 'node:path'
-import test from 'node:test'
-import { fileURLToPath } from 'node:url'
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-const contentScript = path.join(root, 'legacy/extension/dist/extension/content/provider-content.js')
-const fixture = fs.readFileSync(
-  path.join(root, 'test/fixtures/provider-attachment-dom-fixture.html'),
-  'utf8'
-)
-
-const providers = [
-  { id: 'chatgpt', input: '#upload-files', url: 'https://chatgpt.com/' },
-  { id: 'claude', input: '#chat-input-file-upload-onpage', url: 'https://claude.ai/new' },
-  { id: 'gemini', input: 'input[name="Filedata"]', url: 'https://gemini.google.com/app' },
-  { id: 'grok', input: 'input[name="files"]', url: 'https://grok.com/' },
-]
-
-test('visible attachment receiver verifies chunks and uses only exact provider inputs', async (t) => {
-  const { chromium } = await import('playwright')
-  const browser = await chromium.launch({ headless: true })
-  t.after(() => browser.close())
-
-  for (const provider of providers) {
-    await t.test(provider.id, async () => {
-      const session = await openAttachmentFixture(browser, provider.url)
-      try {
-        const bytes = Buffer.from(`verified attachment bytes for ${provider.id};`.repeat(6))
-        const requestId = `attachment-${provider.id}`
-        const attachmentId = `file-${provider.id}`
-        const name = `${provider.id}-proof.txt`
-        const request = { provider: provider.id, requestId, targetUrl: provider.url }
-
-        assert.deepEqual(await dispatch(session.page, {
-          type: 'tokenless.bridge.attachment_prepare',
-          request,
-          requestId,
-          attachmentId,
-          name,
-          mimeType: 'text/plain',
-          size: bytes.length,
-          sha256: sha256(bytes),
-        }), {
-          status: 'prepared',
-          provider: provider.id,
-          requestId,
-          attachmentId,
-          expectedBytes: bytes.length,
-        })
-
-        const wrongOffset = await dispatch(session.page, {
-          type: 'tokenless.bridge.attachment_chunk',
-          request,
-          requestId,
-          attachmentId,
-          offset: 1,
-          dataBase64: bytes.subarray(0, 4).toString('base64'),
-        })
-        assert.equal(wrongOffset.status, 'blocked')
-        assert.equal(wrongOffset.stopReason, 'attachment_offset_mismatch')
-
-        const split = Math.min(7, bytes.length)
-        const firstChunk = await dispatch(session.page, {
-          type: 'tokenless.bridge.attachment_chunk',
-          request,
-          requestId,
-          attachmentId,
-          offset: 0,
-          dataBase64: bytes.subarray(0, split).toString('base64'),
-        })
-        assert.equal(firstChunk.status, 'chunk_received')
-        assert.equal(firstChunk.receivedBytes, split)
-        const secondChunk = await dispatch(session.page, {
-          type: 'tokenless.bridge.attachment_chunk',
-          request,
-          requestId,
-          attachmentId,
-          offset: split,
-          dataBase64: bytes.subarray(split).toString('base64'),
-        })
-        assert.equal(secondChunk.status, 'chunk_received')
-        assert.equal(secondChunk.receivedBytes, bytes.length)
-
-        const committed = await dispatch(session.page, {
-          type: 'tokenless.bridge.attachment_commit',
-          request,
-          requestId,
-          attachmentId,
-        })
-        assert.equal(committed.status, 'attached')
-        assert.equal(committed.visible, true)
-        assert.equal(committed.name, name)
-        assert.equal(committed.sha256, sha256(bytes))
-
-        const state = await session.page.evaluate(() => ({
-          events: globalThis.__attachmentFixture.events,
-          records: globalThis.__attachmentFixture.records,
-          decoyFiles: document.querySelector('[data-decoy-file-input]').files.length,
-        }))
-        assert.deepEqual(state.events.slice(0, 2), ['input', 'change'])
-        assert.equal(state.events.includes('chip-visible'), true)
-        assert.deepEqual(state.records, [{
-          bytes: [...bytes],
-          name,
-          size: bytes.length,
-          type: 'text/plain',
-        }])
-        assert.equal(state.decoyFiles, 0)
-        await assertVisibleFilename(session.page, name)
-        assert.deepEqual(session.pageErrors, [])
-      } finally {
-        await session.context.close()
-      }
-    })
-  }
-})
-
-test('visible attachment batch commit installs every file atomically in one FileList', async (t) => {
-  const { chromium } = await import('playwright')
-  const browser = await chromium.launch({ headless: true })
-  t.after(() => browser.close())
-  const session = await openAttachmentFixture(browser, 'https://chatgpt.com/')
-  try {
-    const requestId = 'attachment-atomic-batch'
-    const request = { provider: 'chatgpt', requestId, targetUrl: 'https://chatgpt.com/' }
-    const files = [
-      { attachmentId: 'atomic-first', name: 'first-proof.txt', bytes: Buffer.from('first atomic bytes') },
-      { attachmentId: 'atomic-second', name: 'second-proof.txt', bytes: Buffer.from('second atomic bytes') },
-    ]
-
-    for (const file of files) {
-      assert.equal((await dispatch(session.page, {
-        type: 'tokenless.bridge.attachment_prepare',
-        request,
-        requestId,
-        attachmentId: file.attachmentId,
-        name: file.name,
-        mimeType: 'text/plain',
-        size: file.bytes.length,
-        sha256: sha256(file.bytes),
-      })).status, 'prepared')
-      assert.equal((await dispatch(session.page, {
-        type: 'tokenless.bridge.attachment_chunk',
-        request,
-        requestId,
-        attachmentId: file.attachmentId,
-        offset: 0,
-        dataBase64: file.bytes.toString('base64'),
-      })).status, 'chunk_received')
-    }
-
-    assert.deepEqual(await session.page.evaluate(() => ({
-      chips: document.querySelectorAll('.attachment-chip').length,
-      events: [...globalThis.__attachmentFixture.events],
-      files: document.querySelector('#upload-files').files.length,
-    })), { chips: 0, events: [], files: 0 }, 'prepare and chunk must not mutate the provider input')
-
-    const committed = await dispatch(session.page, {
-      type: 'tokenless.bridge.attachment_commit_batch',
-      request,
-      requestId,
-      attachmentIds: files.map((file) => file.attachmentId),
-    })
-    assert.equal(committed.status, 'attached')
-    assert.deepEqual(committed.attachments.map(({ attachmentId, name }) => ({ attachmentId, name })), [
-      { attachmentId: 'atomic-first', name: 'first-proof.txt' },
-      { attachmentId: 'atomic-second', name: 'second-proof.txt' },
-    ])
-
-    const state = await session.page.evaluate(async () => {
-      const input = document.querySelector('#upload-files')
-      const files = [...input.files]
-      return {
-        bytes: await Promise.all(files.map(async (file) => [...new Uint8Array(await file.arrayBuffer())])),
-        events: [...globalThis.__attachmentFixture.events],
-        fileNames: files.map((file) => file.name),
-        records: globalThis.__attachmentFixture.records,
-      }
-    })
-    assert.deepEqual(state.fileNames, files.map((file) => file.name))
-    assert.deepEqual(state.bytes, files.map((file) => [...file.bytes]))
-    assert.deepEqual(state.records.map(({ name }) => name), files.map((file) => file.name))
-    assert.deepEqual(state.events, ['input', 'change', 'chip-visible', 'chip-visible'])
-    assert.deepEqual(session.pageErrors, [])
-  } finally {
-    await session.context.close()
-  }
-})
-
-test('visible attachment batch refuses a provider input that already contains a user file', async (t) => {
-  const { chromium } = await import('playwright')
-  const browser = await chromium.launch({ headless: true })
-  t.after(() => browser.close())
-  const session = await openAttachmentFixture(browser, 'https://chatgpt.com/')
-  try {
-    await session.page.evaluate(() => {
-      const transfer = new DataTransfer()
-      transfer.items.add(new File(['user-owned'], 'user-owned.txt', { type: 'text/plain' }))
-      document.querySelector('#upload-files').files = transfer.files
-    })
-    const bytes = Buffer.from('tokenless bytes must not replace the user file')
-    const requestId = 'attachment-dirty-input'
-    const attachmentId = 'tokenless-file'
-    const request = { provider: 'chatgpt', requestId, targetUrl: 'https://chatgpt.com/' }
-    assert.equal((await dispatch(session.page, {
-      type: 'tokenless.bridge.attachment_prepare',
-      request,
-      requestId,
-      attachmentId,
-      name: 'tokenless.txt',
-      mimeType: 'text/plain',
-      size: bytes.length,
-      sha256: sha256(bytes),
-    })).status, 'prepared')
-    assert.equal((await dispatch(session.page, {
-      type: 'tokenless.bridge.attachment_chunk',
-      request,
-      requestId,
-      attachmentId,
-      offset: 0,
-      dataBase64: bytes.toString('base64'),
-    })).status, 'chunk_received')
-
-    const refused = await dispatch(session.page, {
-      type: 'tokenless.bridge.attachment_commit_batch',
-      request,
-      requestId,
-      attachmentIds: [attachmentId],
-    })
-    assert.equal(refused.status, 'blocked')
-    assert.equal(refused.stopReason, 'attachment_surface_not_clean')
-    assert.deepEqual(await session.page.evaluate(() => ({
-      events: [...globalThis.__attachmentFixture.events],
-      fileNames: [...document.querySelector('#upload-files').files].map((file) => file.name),
-      records: globalThis.__attachmentFixture.records,
-    })), { events: [], fileNames: ['user-owned.txt'], records: [] })
-    assert.deepEqual(session.pageErrors, [])
-  } finally {
-    await session.context.close()
-  }
-})
-
-test('model configuration is prepared before an attachment mutates the provider composer', async (t) => {
-  const { chromium } = await import('playwright')
-  const browser = await chromium.launch({ headless: true })
-  t.after(() => browser.close())
-  const session = await openAttachmentFixture(browser, 'https://chatgpt.com/')
-  try {
-    const bytes = Buffer.from('model-before-attachment proof')
-    const requestId = 'model-before-attachment'
-    const attachmentId = 'model-order-file'
-    const request = {
-      provider: 'chatgpt',
-      requestId,
-      targetUrl: 'https://chatgpt.com/',
-      model: 'GPT-5.5',
-    }
-    const preparedSubmit = await dispatch(session.page, {
-      type: 'tokenless.bridge.prepare_submit',
-      request,
-    })
-    assert.equal(preparedSubmit.status, 'prepared')
-    assert.equal(preparedSubmit.configuration.model.status, 'selected')
-    assert.equal(preparedSubmit.configuration.model.applied, 'GPT-5.5')
-
-    assert.equal((await dispatch(session.page, {
-      type: 'tokenless.bridge.attachment_prepare',
-      request,
-      requestId,
-      attachmentId,
-      name: 'model-order.txt',
-      mimeType: 'text/plain',
-      size: bytes.length,
-      sha256: sha256(bytes),
-    })).status, 'prepared')
-    assert.equal((await dispatch(session.page, {
-      type: 'tokenless.bridge.attachment_chunk',
-      request,
-      requestId,
-      attachmentId,
-      offset: 0,
-      dataBase64: bytes.toString('base64'),
-    })).status, 'chunk_received')
-    assert.equal((await dispatch(session.page, {
-      type: 'tokenless.bridge.attachment_commit_batch',
-      request,
-      requestId,
-      attachmentIds: [attachmentId],
-    })).status, 'attached')
-
-    assert.deepEqual(await session.page.evaluate(() => globalThis.__attachmentFixture.events), [
-      'model-selected:GPT-5.5',
-      'input',
-      'change',
-      'chip-visible',
-    ])
-    assert.deepEqual(session.pageErrors, [])
-  } finally {
-    await session.context.close()
-  }
-})
-
-test('visible attachment receiver fails closed for hash drift, aborts, and missing Gemini upload DOM', async (t) => {
-  const { chromium } = await import('playwright')
-  const browser = await chromium.launch({ headless: true })
-  t.after(() => browser.close())
-
-  const claude = await openAttachmentFixture(browser, 'https://claude.ai/new')
-  try {
-    const bytes = Buffer.from('hash mismatch must never reach the provider input')
-    const requestId = 'attachment-hash-drift'
-    const attachmentId = 'file-hash-drift'
-    const request = { provider: 'claude', requestId, targetUrl: 'https://claude.ai/new' }
-    assert.equal((await dispatch(claude.page, {
-      type: 'tokenless.bridge.attachment_prepare',
-      request,
-      requestId,
-      attachmentId,
-      name: 'hash-drift.txt',
-      mimeType: 'text/plain',
-      size: bytes.length,
-      sha256: '0'.repeat(64),
-    })).status, 'prepared')
-    assert.equal((await dispatch(claude.page, {
-      type: 'tokenless.bridge.attachment_chunk',
-      request,
-      requestId,
-      attachmentId,
-      offset: 0,
-      dataBase64: bytes.toString('base64'),
-    })).status, 'chunk_received')
-    const rejected = await dispatch(claude.page, {
-      type: 'tokenless.bridge.attachment_commit',
-      request,
-      requestId,
-      attachmentId,
-    })
-    assert.equal(rejected.status, 'blocked')
-    assert.equal(rejected.stopReason, 'attachment_hash_mismatch')
-    assert.deepEqual(
-      await claude.page.evaluate(() => ({
-        events: globalThis.__attachmentFixture.events,
-        records: globalThis.__attachmentFixture.records,
-      })),
-      { events: [], records: [] }
-    )
-
-    const abortRequestId = 'attachment-abort'
-    const abortAttachmentId = 'file-abort'
-    const abortRequest = { provider: 'claude', requestId: abortRequestId, targetUrl: 'https://claude.ai/new' }
-    const prepareAbort = {
-      type: 'tokenless.bridge.attachment_prepare',
-      request: abortRequest,
-      requestId: abortRequestId,
-      attachmentId: abortAttachmentId,
-      name: 'abort.txt',
-      mimeType: 'text/plain',
-      size: 1,
-      sha256: sha256(Buffer.from('x')),
-    }
-    assert.equal((await dispatch(claude.page, prepareAbort)).status, 'prepared')
-    const aborted = await dispatch(claude.page, {
-      type: 'tokenless.bridge.attachment_abort',
-      request: abortRequest,
-      requestId: abortRequestId,
-      attachmentId: abortAttachmentId,
-    })
-    assert.equal(aborted.status, 'aborted')
-    assert.equal(aborted.released, true)
-    assert.equal((await dispatch(claude.page, prepareAbort)).status, 'prepared')
-    const prematureSubmit = await dispatch(claude.page, {
-      type: 'tokenless.bridge.submit',
-      request: { ...abortRequest, prompt: 'must not submit with an incomplete attachment' },
-    })
-    assert.equal(prematureSubmit.status, 'blocked')
-    assert.equal(prematureSubmit.stopReason, 'attachment_incomplete')
-    assert.equal((await dispatch(claude.page, {
-      type: 'tokenless.bridge.attachment_abort',
-      request: abortRequest,
-      requestId: abortRequestId,
-      attachmentId: abortAttachmentId,
-    })).status, 'aborted')
-  } finally {
-    await claude.context.close()
-  }
-
-  const gemini = await openAttachmentFixture(browser, 'https://gemini.google.com/app')
-  try {
-    await gemini.page.locator('button[aria-label="Upload and tools"]').evaluate((node) => node.remove())
-    const requestId = 'attachment-gemini-uncaptured'
-    const blocked = await dispatch(gemini.page, {
-      type: 'tokenless.bridge.attachment_prepare',
-      request: { provider: 'gemini', requestId, targetUrl: 'https://gemini.google.com/app' },
-      requestId,
-      attachmentId: 'file-gemini-uncaptured',
-      name: 'gemini.txt',
-      mimeType: 'text/plain',
-      size: 0,
-      sha256: sha256(Buffer.alloc(0)),
-    })
-    assert.equal(blocked.status, 'blocked')
-    assert.equal(blocked.stopReason, 'attachment_input_unavailable')
-    assert.deepEqual(gemini.pageErrors, [])
-  } finally {
-    await gemini.context.close()
-  }
-})
-
-test('aborting an already-visible attachment poisons later submit until the provider page reloads', async (t) => {
-  const { chromium } = await import('playwright')
-  const browser = await chromium.launch({ headless: true })
-  t.after(() => browser.close())
-  const session = await openAttachmentFixture(browser, 'https://chatgpt.com/')
-  try {
-    const bytes = Buffer.from('must never leak into a later request')
-    const requestId = 'attachment-partial-failure'
-    const attachmentId = 'file-already-visible'
-    const request = { provider: 'chatgpt', requestId, targetUrl: 'https://chatgpt.com/' }
-    assert.equal((await dispatch(session.page, {
-      type: 'tokenless.bridge.attachment_prepare',
-      request,
-      requestId,
-      attachmentId,
-      name: 'partial-failure.txt',
-      mimeType: 'text/plain',
-      size: bytes.length,
-      sha256: sha256(bytes),
-    })).status, 'prepared')
-    assert.equal((await dispatch(session.page, {
-      type: 'tokenless.bridge.attachment_chunk',
-      request,
-      requestId,
-      attachmentId,
-      offset: 0,
-      dataBase64: bytes.toString('base64'),
-    })).status, 'chunk_received')
-    assert.equal((await dispatch(session.page, {
-      type: 'tokenless.bridge.attachment_commit',
-      request,
-      requestId,
-      attachmentId,
-    })).status, 'attached')
-
-    const aborted = await dispatch(session.page, {
-      type: 'tokenless.bridge.attachment_abort',
-      request,
-      requestId,
-      attachmentId,
-    })
-    assert.equal(aborted.status, 'aborted')
-    assert.equal(aborted.released, true)
-    assert.equal(aborted.requiresReload, true)
-    assert.equal(await session.page.locator('#upload-files').evaluate((input) => input.files.length), 0)
-
-    const laterRequest = {
-      provider: 'chatgpt',
-      requestId: 'later-request',
-      targetUrl: 'https://chatgpt.com/',
-      prompt: 'This must not inherit the earlier file.',
-    }
-    const submit = await dispatch(session.page, {
-      type: 'tokenless.bridge.submit',
-      request: laterRequest,
-    })
-    assert.equal(submit.status, 'blocked')
-    assert.equal(submit.stopReason, 'attachment_cleanup_required')
-    const prepare = await dispatch(session.page, {
-      type: 'tokenless.bridge.attachment_prepare',
-      request: laterRequest,
-      requestId: laterRequest.requestId,
-      attachmentId: 'later-file',
-      name: 'later.txt',
-      mimeType: 'text/plain',
-      size: 0,
-      sha256: sha256(Buffer.alloc(0)),
-    })
-    assert.equal(prepare.status, 'blocked')
-    assert.equal(prepare.stopReason, 'attachment_cleanup_required')
-    assert.deepEqual(session.pageErrors, [])
-  } finally {
-    await session.context.close()
-  }
-})
-
-test('an unconfirmed submit keeps the committed attachment ledger so abort poisons the page', async (t) => {
-  const { chromium } = await import('playwright')
-  const browser = await chromium.launch({ headless: true })
-  t.after(() => browser.close())
-  const session = await openAttachmentFixture(browser, 'https://chatgpt.com/')
-  try {
-    const bytes = Buffer.from('must remain tracked until visible submit succeeds')
-    const requestId = 'attachment-submit-unconfirmed'
-    const attachmentId = 'file-submit-unconfirmed'
-    const request = {
-      provider: 'chatgpt',
-      requestId,
-      targetUrl: 'https://chatgpt.com/',
-      prompt: 'The fixture will suppress this visible submission.',
-      submissionConfirmTimeoutMs: 10,
-    }
-    assert.equal((await dispatch(session.page, {
-      type: 'tokenless.bridge.attachment_prepare',
-      request,
-      requestId,
-      attachmentId,
-      name: 'submit-unconfirmed.txt',
-      mimeType: 'text/plain',
-      size: bytes.length,
-      sha256: sha256(bytes),
-    })).status, 'prepared')
-    assert.equal((await dispatch(session.page, {
-      type: 'tokenless.bridge.attachment_chunk',
-      request,
-      requestId,
-      attachmentId,
-      offset: 0,
-      dataBase64: bytes.toString('base64'),
-    })).status, 'chunk_received')
-    assert.equal((await dispatch(session.page, {
-      type: 'tokenless.bridge.attachment_commit_batch',
-      request,
-      requestId,
-      attachmentIds: [attachmentId],
-    })).status, 'attached')
-    await session.page.evaluate(() => {
-      globalThis.__attachmentFixture.suppressVisibleSubmit = true
-    })
-
-    const submit = await dispatch(session.page, {
-      type: 'tokenless.bridge.submit',
-      request,
-    })
-    assert.equal(submit.status, 'blocked')
-    assert.equal(submit.stopReason, 'submission_unconfirmed')
-    assert.equal(await session.page.locator('#upload-files').evaluate((input) => input.files.length), 1)
-
-    const abort = await dispatch(session.page, {
-      type: 'tokenless.bridge.attachment_abort',
-      request,
-      requestId,
-      attachmentId,
-    })
-    assert.equal(abort.status, 'aborted')
-    assert.equal(abort.released, true)
-    assert.equal(abort.requiresReload, true)
-    assert.equal(await session.page.locator('#upload-files').evaluate((input) => input.files.length), 0)
-    const later = await dispatch(session.page, {
-      type: 'tokenless.bridge.submit',
-      request: {
-        provider: 'chatgpt',
-        requestId: 'after-unconfirmed-submit',
-        targetUrl: 'https://chatgpt.com/',
-        prompt: 'must be blocked until reload',
-      },
-    })
-    assert.equal(later.status, 'blocked')
-    assert.equal(later.stopReason, 'attachment_cleanup_required')
-    assert.deepEqual(session.pageErrors, [])
-  } finally {
-    await session.context.close()
-  }
-})
-
-function sha256(bytes) {
-  return createHash('sha256').update(bytes).digest('hex')
-}
-
-async function dispatch(page, message) {
-  return page.evaluate((payload) => globalThis.__dispatchTokenlessMessage(payload), message)
-}
-
-async function assertVisibleFilename(page, name) {
-  await page.locator('.attachment-chip').filter({ hasText: name }).waitFor({ state: 'visible' })
-}
-
-async function openAttachmentFixture(browser, url) {
-  const context = await browser.newContext({ viewport: { width: 900, height: 700 } })
-  await context.addInitScript(() => {
-    const listeners = []
-    Object.defineProperty(globalThis, 'chrome', {
-      configurable: true,
-      value: {
-        runtime: {
-          async sendMessage() {},
-          onMessage: {
-            addListener(listener) {
-              listeners.push(listener)
-            },
-          },
-        },
-      },
-    })
-    Object.defineProperty(globalThis, '__dispatchTokenlessMessage', {
-      configurable: true,
-      value(message) {
-        return new Promise((resolve, reject) => {
-          const listener = listeners[0]
-          if (!listener) return reject(new Error('Provider content listener is not installed.'))
-          let responded = false
-          const keepOpen = listener(message, {}, (response) => {
-            responded = true
-            resolve(response)
-          })
-          if (keepOpen !== true && !responded) reject(new Error('Provider content listener closed early.'))
-        })
-      },
-    })
-  })
-  const page = await context.newPage()
-  const pageErrors = []
-  page.on('pageerror', (error) => pageErrors.push(error.message))
-  const origin = new URL(url).origin
-  await page.route(`${origin}/**`, (route) => route.fulfill({
-    status: 200,
-    contentType: 'text/html',
-    body: fixture,
-  }))
-  await page.goto(url, { waitUntil: 'domcontentloaded' })
-  await page.addScriptTag({ path: contentScript })
-  return { context, page, pageErrors }
-}
diff --git a/legacy/test/visible-attachment-extension.test.mjs b/legacy/test/visible-attachment-extension.test.mjs
deleted file mode 100644
index 5497dba..0000000
--- a/legacy/test/visible-attachment-extension.test.mjs
+++ /dev/null
@@ -1,516 +0,0 @@
-import assert from 'node:assert/strict'
-import path from 'node:path'
-import test from 'node:test'
-import { fileURLToPath, pathToFileURL } from 'node:url'
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-const extensionDist = path.join(root, 'legacy/extension/dist/extension')
-
-const descriptor = Object.freeze({
-  protocol: 'tokenless.visible-attachment.v1',
-  bundleId: 'bundle-visible-1',
-  attachmentId: 'attachment-visible-1',
-  name: 'hello.txt',
-  type: 'text/plain',
-  size: 5,
-  sha256: '2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824',
-})
-const emptyDescriptor = Object.freeze({
-  ...descriptor,
-  attachmentId: 'attachment-empty',
-  name: 'empty.txt',
-  size: 0,
-  sha256: 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
-})
-
-test('bridge validation bounds and normalizes staged visible attachment descriptors', async () => {
-  const {
-    BRIDGE_PROTOCOL_VERSION,
-    capabilitiesPayload,
-    createBridgeRequest,
-    validateBridgeRequest,
-  } = await import('../legacy/extension/dist/extension/shared/bridge-protocol.js')
-  const {
-    MAX_VISIBLE_ATTACHMENTS,
-    MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES,
-  } = await import('../legacy/extension/dist/extension/shared/native-protocol.js')
-  const base = {
-    protocol: BRIDGE_PROTOCOL_VERSION,
-    requestId: 'attachment-contract-1',
-    provider: 'chatgpt',
-    action: 'submit',
-    prompt: 'Use the attached file.',
-  }
-
-  const created = createBridgeRequest({ ...base, attachments: [descriptor] })
-  const valid = validateBridgeRequest(created)
-  assert.equal(valid.ok, true)
-  assert.deepEqual(valid.request.attachments, [descriptor])
-  assert.notEqual(valid.request.attachments[0], descriptor, 'normalization copies the descriptor')
-  assert.deepEqual(capabilitiesPayload().attachments, {
-    protocol: 'tokenless.visible-attachment.v1',
-    actions: ['submit', 'submit_and_read', 'visible_provider_action'],
-    maxFiles: 100,
-    maxRequestBytes: 512 * 1024 * 1024,
-  })
-  assert.equal(MAX_VISIBLE_ATTACHMENTS, 100)
-  assert.equal(MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES, 512 * 1024 * 1024)
-
-  const malformedCases = [
-    [{ ...base, action: 'capabilities', attachments: [descriptor] }, 'attachments_unsupported_for_action'],
-    [{ ...base, action: 'read', attachments: [descriptor] }, 'attachments_unsupported_for_action'],
-    [{ ...base, attachments: [] }, 'invalid_attachments'],
-    [{ ...base, attachments: [{ ...descriptor, sourcePath: 'C:\\private\\hello.txt' }] }, 'invalid_attachment'],
-    [{ ...base, attachments: [{ ...descriptor, name: '../hello.txt' }] }, 'invalid_attachment'],
-    [{ ...base, attachments: [descriptor, { ...descriptor, attachmentId: 'attachment-2', bundleId: 'other' }] }, 'attachment_bundle_mismatch'],
-    [{ ...base, attachments: [descriptor, { ...descriptor }] }, 'duplicate_attachment'],
-    [{
-      ...base,
-      attachments: Array.from({ length: MAX_VISIBLE_ATTACHMENTS + 1 }, (_, index) => ({
-        ...descriptor,
-        attachmentId: `attachment-${index}`,
-      })),
-    }, 'too_many_attachments'],
-    [{ ...base, attachments: [{ ...descriptor, size: MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES + 1 }] }, 'attachment_too_large'],
-    [{
-      ...base,
-      attachments: [
-        { ...descriptor, size: MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES / 2 + 1 },
-        {
-          ...descriptor,
-          attachmentId: 'attachment-2',
-          size: MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES / 2,
-        },
-      ],
-    }, 'attachments_too_large'],
-  ]
-  for (const [request, expectedCode] of malformedCases) {
-    const validation = validateBridgeRequest(request)
-    assert.equal(validation.ok, false)
-    assert.equal(validation.error.code, expectedCode)
-  }
-})
-
-test('persistent daemon bridge delivers correlated native request errors without dropping the bridge', async () => {
-  const { NativeDaemonBridge } = await import(
-    '../legacy/extension/dist/extension/background/native-daemon-bridge.js'
-  )
-  const port = createNativePort()
-  const delivered = []
-  const bridge = new NativeDaemonBridge({
-    connectNative: () => port,
-    onMessage(_port, message) {
-      delivered.push(message)
-    },
-    timing: { handshakeTimeoutMs: 1000 },
-  })
-  bridge.start()
-  await port.onMessage.emit(nativeSuccess('tokenless.native.daemon_connected', { status: 'connected' }))
-  const rejectedOpen = {
-    protocol: 'tokenless.native.v1',
-    type: 'tokenless.native.attachment_open',
-    requestId: 'native-open-1',
-    ok: false,
-    error: { code: 'invalid_input', message: 'Rejected descriptor.', retryable: false },
-  }
-  await port.onMessage.emit(rejectedOpen)
-  assert.deepEqual(delivered, [rejectedOpen])
-  assert.equal(port.disconnectCount, 0)
-  bridge.stop()
-})
-
-test('background streams attachment chunks through the persistent native claim and fails closed on malformed offsets', async () => {
-  const previousChrome = globalThis.chrome
-  const installed = createChromeEvent()
-  const startup = createChromeEvent()
-  const runtimeMessage = createChromeEvent()
-  const ports = []
-  const providerMessages = []
-  const createdTabs = []
-  const completedJobs = new Set()
-  const completionAttempts = new Map()
-  let nextTabId = 1
-
-  function connectNative(name) {
-    assert.equal(name, 'dev.tokenless.native_host')
-    const isPersistent = ports.length === 0
-    const port = createNativePort((message) => {
-      if (isPersistent) respondToPersistentMessage(port, message)
-      else if (message.type === 'tokenless.native.daemon_complete_job') {
-        const attempts = (completionAttempts.get(message.jobId) ?? 0) + 1
-        completionAttempts.set(message.jobId, attempts)
-        if (message.jobId === 'attachment-completion-retry' && attempts === 1) {
-          queueMicrotask(() => void port.onMessage.emit(nativeFailure(
-            message.type,
-            'daemon_unavailable',
-            'Retry completion without resubmitting.',
-            true,
-            message.requestId
-          )))
-        } else {
-          completedJobs.add(message.jobId)
-          queueMicrotask(() => void port.onMessage.emit(nativeSuccess(message.type, {
-            job_id: message.jobId,
-            provider: 'chatgpt',
-            action: 'submit',
-            status: message.error ? 'failed' : 'succeeded',
-          }, message.requestId)))
-        }
-      }
-    })
-    ports.push(port)
-    return port
-  }
-
-  function respondToPersistentMessage(port, message) {
-    const respond = (result) => queueMicrotask(() => (
-      void port.onMessage.emit(nativeSuccess(message.type, result, message.requestId))
-    ))
-    if (message.type === 'tokenless.native.attachment_open') {
-      const openedDescriptor = message.attachmentId === emptyDescriptor.attachmentId
-        ? emptyDescriptor
-        : descriptor
-      respond({
-        handleId: `handle-${message.attachmentId}`,
-        protocol: openedDescriptor.protocol,
-        bundleId: message.bundleId,
-        attachmentId: message.attachmentId,
-        name: openedDescriptor.name,
-        type: openedDescriptor.type,
-        size: openedDescriptor.size,
-        sha256: openedDescriptor.sha256,
-        maxChunkBytes: 4,
-      })
-    } else if (message.type === 'tokenless.native.attachment_read') {
-      if (message.handleId === `handle-${emptyDescriptor.attachmentId}`) {
-        respond({ handleId: message.handleId, offset: 0, nextOffset: 0, eof: true, dataBase64: '' })
-      } else if (message.handleId === 'handle-attachment-malformed') {
-        respond({
-          handleId: message.handleId,
-          offset: message.offset,
-          nextOffset: message.offset + 2,
-          eof: false,
-          dataBase64: 'aA==',
-        })
-      } else if (message.offset === 0) {
-        respond({ handleId: message.handleId, offset: 0, nextOffset: 4, eof: false, dataBase64: 'aGVsbA==' })
-      } else {
-        respond({ handleId: message.handleId, offset: 4, nextOffset: 5, eof: true, dataBase64: 'bw==' })
-      }
-    } else if (message.type === 'tokenless.native.attachment_close') {
-      respond({ handleId: message.handleId, status: 'closed' })
-    } else if (message.type === 'tokenless.native.daemon_ready') {
-      if (completedJobs.has(message.jobId)) {
-        respond({ status: 'ready', jobId: message.jobId })
-      } else {
-        queueMicrotask(() => void port.onMessage.emit(nativeFailure(
-          message.type,
-          'invalid_native_message',
-          'Job is not terminal.',
-          false,
-          message.requestId
-        )))
-      }
-    }
-  }
-
-  globalThis.chrome = {
-    runtime: {
-      onInstalled: installed,
-      onStartup: startup,
-      onMessage: runtimeMessage,
-      connectNative,
-      lastError: undefined,
-      async sendMessage() {
-        return { ok: false }
-      },
-    },
-    sidePanel: {
-      async setPanelBehavior() {},
-    },
-    scripting: {
-      async executeScript() {
-        throw new Error('content script should already be available')
-      },
-    },
-    tabs: {
-      async query() {
-        return createdTabs
-      },
-      async create(details) {
-        const tab = {
-          id: nextTabId++,
-          windowId: 1,
-          active: Boolean(details.active),
-          status: 'complete',
-          url: String(details.url),
-        }
-        createdTabs.push(tab)
-        return tab
-      },
-      async get(tabId) {
-        return createdTabs.find((tab) => tab.id === tabId)
-      },
-      async update(tabId, details) {
-        const tab = createdTabs.find((candidate) => candidate.id === tabId)
-        if (tab) Object.assign(tab, details)
-        return tab
-      },
-      async sendMessage(tabId, message) {
-        providerMessages.push({ tabId, message })
-        if (message.type === 'tokenless.bridge.validate_landing') return { status: 'ready' }
-        if (message.type === 'tokenless.bridge.prepare_submit') {
-          return {
-            status: 'prepared',
-            configuration: message.request.model
-              ? { model: { status: 'selected', applied: message.request.model } }
-              : undefined,
-          }
-        }
-        if (message.type === 'tokenless.bridge.attachment_prepare') return { status: 'prepared' }
-        if (message.type === 'tokenless.bridge.attachment_chunk') return { status: 'chunk_received' }
-        if (message.type === 'tokenless.bridge.attachment_commit_batch') return { status: 'attached' }
-        if (message.type === 'tokenless.bridge.attachment_abort') return { status: 'aborted' }
-        if (message.type === 'tokenless.bridge.submit') {
-          if (message.request.requestId === 'attachment-submit-blocked') {
-            return { status: 'blocked', stopReason: 'submission_unconfirmed' }
-          }
-          return { status: 'submitted', answerBaseline: { count: 0, lastText: '' } }
-        }
-        throw new Error(`Unexpected content message: ${message.type}`)
-      },
-    },
-    windows: { async update() {} },
-  }
-
-  try {
-    const serviceWorkerUrl = pathToFileURL(path.join(extensionDist, 'background/service-worker.js'))
-    serviceWorkerUrl.searchParams.set('attachment-contract', String(Date.now()))
-    await import(serviceWorkerUrl.href)
-    const daemonPort = ports[0]
-    await daemonPort.onMessage.emit(nativeSuccess('tokenless.native.daemon_connected', { status: 'connected' }))
-
-    await daemonPort.onMessage.emit(daemonJob('attachment-good', descriptor, { model: 'GPT-5.5' }))
-    await waitFor(() => daemonPort.posted.some((message) => (
-      message.type === 'tokenless.native.daemon_ready' && message.jobId === 'attachment-good'
-    )))
-
-    const successfulContentMessages = providerMessages.filter(({ message }) => (
-      message.request?.requestId === 'attachment-good'
-    ))
-    assert.deepEqual(successfulContentMessages.map(({ message }) => message.type), [
-      'tokenless.bridge.validate_landing',
-      'tokenless.bridge.prepare_submit',
-      'tokenless.bridge.attachment_prepare',
-      'tokenless.bridge.attachment_chunk',
-      'tokenless.bridge.attachment_chunk',
-      'tokenless.bridge.attachment_commit_batch',
-      'tokenless.bridge.submit',
-    ])
-    assert.equal(successfulContentMessages[1].message.request.model, 'GPT-5.5')
-    assert.equal(successfulContentMessages[2].message.mimeType, 'text/plain')
-    assert.deepEqual(successfulContentMessages[5].message.attachmentIds, [descriptor.attachmentId])
-    assert.deepEqual(
-      successfulContentMessages.filter(({ message }) => message.type === 'tokenless.bridge.attachment_chunk')
-        .map(({ message }) => [message.offset, message.dataBase64]),
-      [[0, 'aGVsbA=='], [4, 'bw==']]
-    )
-    assert.deepEqual(
-      daemonPort.posted.filter(({ type }) => type.startsWith('tokenless.native.attachment_')).map(({ type }) => type),
-      [
-        'tokenless.native.attachment_open',
-        'tokenless.native.attachment_read',
-        'tokenless.native.attachment_read',
-        'tokenless.native.attachment_close',
-      ]
-    )
-    assert.equal(ports.length, 2, 'attachment state stays on the persistent port; only completion uses a short-lived port')
-
-    await daemonPort.onMessage.emit(daemonJob('attachment-submit-blocked', emptyDescriptor))
-    await waitFor(() => daemonPort.posted.some((message) => (
-      message.type === 'tokenless.native.daemon_ready' && message.jobId === 'attachment-submit-blocked'
-    )))
-    const blockedSubmitMessages = providerMessages.filter(({ message }) => (
-      message.request?.requestId === 'attachment-submit-blocked'
-    ))
-    assert.deepEqual(blockedSubmitMessages.map(({ message }) => message.type), [
-      'tokenless.bridge.validate_landing',
-      'tokenless.bridge.prepare_submit',
-      'tokenless.bridge.attachment_prepare',
-      'tokenless.bridge.attachment_commit_batch',
-      'tokenless.bridge.submit',
-      'tokenless.bridge.attachment_abort',
-    ])
-    assert.equal(
-      blockedSubmitMessages.findIndex(({ message }) => message.type === 'tokenless.bridge.attachment_abort') >
-        blockedSubmitMessages.findIndex(({ message }) => message.type === 'tokenless.bridge.submit'),
-      true,
-      'a post-commit submit failure must abort the visible file and poison the content page'
-    )
-    const blockedCompletion = ports.flatMap((port) => port.posted).find((message) => (
-      message.type === 'tokenless.native.daemon_complete_job' && message.jobId === 'attachment-submit-blocked'
-    ))
-    assert.equal(blockedCompletion.error.code, 'submission_unconfirmed')
-
-    await daemonPort.onMessage.emit(daemonJob('attachment-completion-retry', emptyDescriptor))
-    await waitFor(() => (
-      completionAttempts.get('attachment-completion-retry') === 2 &&
-      daemonPort.posted.filter((message) => (
-        message.type === 'tokenless.native.daemon_ready' &&
-        message.jobId === 'attachment-completion-retry'
-      )).length === 2
-    ))
-    assert.equal(completionAttempts.get('attachment-completion-retry'), 2)
-    assert.equal(providerMessages.filter(({ message }) => (
-      message.request?.requestId === 'attachment-completion-retry' &&
-      message.type === 'tokenless.bridge.submit'
-    )).length, 1, 'completion retry must not repeat the visible submit')
-
-    await daemonPort.onMessage.emit(daemonJob('attachment-empty-job', emptyDescriptor))
-    await waitFor(() => daemonPort.posted.some((message) => (
-      message.type === 'tokenless.native.daemon_ready' && message.jobId === 'attachment-empty-job'
-    )))
-    const emptyContentMessages = providerMessages.filter(({ message }) => (
-      message.request?.requestId === 'attachment-empty-job'
-    ))
-    assert.deepEqual(emptyContentMessages.map(({ message }) => message.type), [
-      'tokenless.bridge.validate_landing',
-      'tokenless.bridge.prepare_submit',
-      'tokenless.bridge.attachment_prepare',
-      'tokenless.bridge.attachment_commit_batch',
-      'tokenless.bridge.submit',
-    ])
-
-    const malformedDescriptor = { ...descriptor, attachmentId: 'attachment-malformed' }
-    await daemonPort.onMessage.emit(daemonJob('attachment-malformed-job', malformedDescriptor))
-    await waitFor(() => daemonPort.posted.some((message) => (
-      message.type === 'tokenless.native.daemon_ready' && message.jobId === 'attachment-malformed-job'
-    )))
-    const malformedContentMessages = providerMessages.filter(({ message }) => (
-      message.request?.requestId === 'attachment-malformed-job'
-    ))
-    assert.deepEqual(malformedContentMessages.map(({ message }) => message.type), [
-      'tokenless.bridge.validate_landing',
-      'tokenless.bridge.prepare_submit',
-      'tokenless.bridge.attachment_prepare',
-      'tokenless.bridge.attachment_abort',
-    ])
-    assert.ok(!malformedContentMessages.some(({ message }) => message.type === 'tokenless.bridge.submit'))
-    const malformedCompletion = ports.flatMap((port) => port.posted).find((message) => (
-      message.type === 'tokenless.native.daemon_complete_job' && message.jobId === 'attachment-malformed-job'
-    ))
-    assert.equal(malformedCompletion.error.code, 'attachment_native_protocol_mismatch')
-
-    await daemonPort.onMessage.emit(daemonJob(
-      'attachment-partial-multifile-job',
-      [descriptor, malformedDescriptor]
-    ))
-    await waitFor(() => daemonPort.posted.some((message) => (
-      message.type === 'tokenless.native.daemon_ready' && message.jobId === 'attachment-partial-multifile-job'
-    )))
-    const partialContentMessages = providerMessages.filter(({ message }) => (
-      message.request?.requestId === 'attachment-partial-multifile-job'
-    ))
-    assert.deepEqual(partialContentMessages.map(({ message }) => message.type), [
-      'tokenless.bridge.validate_landing',
-      'tokenless.bridge.prepare_submit',
-      'tokenless.bridge.attachment_prepare',
-      'tokenless.bridge.attachment_chunk',
-      'tokenless.bridge.attachment_chunk',
-      'tokenless.bridge.attachment_prepare',
-      'tokenless.bridge.attachment_abort',
-      'tokenless.bridge.attachment_abort',
-    ])
-    assert.equal(
-      partialContentMessages.filter(({ message }) => (
-        message.type === 'tokenless.bridge.attachment_abort' &&
-        message.attachmentId === descriptor.attachmentId
-      )).length,
-      1,
-      'a failed multi-file delivery explicitly aborts the first attachment'
-    )
-    assert.ok(!partialContentMessages.some(({ message }) => message.type === 'tokenless.bridge.submit'))
-    assert.doesNotMatch(JSON.stringify(ports.flatMap((port) => port.posted)), /[A-Z]:\\|sourcePath|private\\hello/)
-  } finally {
-    globalThis.chrome = previousChrome
-  }
-})
-
-function daemonJob(jobId, attachment, requestOverrides = {}) {
-  return nativeSuccess('tokenless.native.daemon_job', {
-    job: {
-      job_id: jobId,
-      claim_token: `${jobId}-claim`,
-      provider: 'chatgpt',
-      action: 'submit',
-      status: 'claimed',
-      request_json: {
-        prompt: 'Use the visible attachment.',
-        attachments: Array.isArray(attachment) ? attachment : [attachment],
-        ...requestOverrides,
-      },
-    },
-  })
-}
-
-function nativeSuccess(type, result, requestId) {
-  return Object.fromEntries(Object.entries({
-    protocol: 'tokenless.native.v1',
-    type,
-    requestId,
-    ok: true,
-    result,
-  }).filter(([, value]) => value !== undefined))
-}
-
-function nativeFailure(type, code, message, retryable, requestId) {
-  return {
-    protocol: 'tokenless.native.v1',
-    type,
-    requestId,
-    ok: false,
-    error: { code, message, retryable },
-  }
-}
-
-function createNativePort(onPostMessage = () => undefined) {
-  const onMessage = createChromeEvent()
-  const onDisconnect = createChromeEvent()
-  return {
-    onMessage,
-    onDisconnect,
-    posted: [],
-    disconnectCount: 0,
-    postMessage(message) {
-      this.posted.push(message)
-      onPostMessage(message)
-    },
-    disconnect() {
-      this.disconnectCount += 1
-    },
-  }
-}
-
-function createChromeEvent() {
-  const callbacks = []
-  return {
-    addListener(callback) {
-      callbacks.push(callback)
-    },
-    listeners() {
-      return [...callbacks]
-    },
-    async emit(...args) {
-      for (const callback of callbacks) await callback(...args)
-    },
-  }
-}
-
-async function waitFor(predicate, timeoutMs = 3000) {
-  const deadline = Date.now() + timeoutMs
-  while (Date.now() < deadline) {
-    if (predicate()) return
-    await new Promise((resolve) => setTimeout(resolve, 10))
-  }
-  assert.fail('Timed out waiting for attachment bridge state.')
-}
diff --git a/legacy/test/visible-provider-action-contract.test.mjs b/legacy/test/visible-provider-action-contract.test.mjs
deleted file mode 100644
index 9313935..0000000
--- a/legacy/test/visible-provider-action-contract.test.mjs
+++ /dev/null
@@ -1,354 +0,0 @@
-import assert from 'node:assert/strict'
-import test from 'node:test'
-
-const ACTION_MODULE = '../legacy/extension/dist/extension/shared/visible-provider-actions.js'
-const CAPABILITY_MODULE = '../legacy/extension/dist/extension/shared/visible-provider-capabilities.js'
-const BRIDGE_MODULE = '../legacy/extension/dist/extension/shared/bridge-protocol.js'
-
-function attachment(overrides = {}) {
-  return {
-    protocol: 'tokenless.visible-attachment.v1',
-    bundleId: 'bundle-action-contract',
-    attachmentId: 'attachment-action-contract',
-    name: 'evidence.txt',
-    type: 'text/plain',
-    size: 5,
-    sha256: '2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824',
-    ...overrides,
-  }
-}
-
-test('visible-provider contract covers every requested domain and bridge capabilities expose it', async () => {
-  const {
-    VISIBLE_PROVIDER_ACTION_METADATA,
-    VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION,
-    VISIBLE_PROVIDER_ACTIONS,
-    listVisibleProviderActions,
-  } = await import(ACTION_MODULE)
-  const { capabilitiesPayload } = await import(BRIDGE_MODULE)
-
-  assert.deepEqual(
-    new Set(Object.values(VISIBLE_PROVIDER_ACTION_METADATA).map(({ domain }) => domain)),
-    new Set(['auth', 'model', 'effort', 'file', 'skill', 'connector', 'prompt', 'project', 'history']),
-  )
-  for (const coreAction of [
-    VISIBLE_PROVIDER_ACTIONS.AUTH_STATUS,
-    VISIBLE_PROVIDER_ACTIONS.MODEL_INSPECT,
-    VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT,
-    VISIBLE_PROVIDER_ACTIONS.EFFORT_INSPECT,
-    VISIBLE_PROVIDER_ACTIONS.EFFORT_SELECT,
-    VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD,
-    VISIBLE_PROVIDER_ACTIONS.PROMPT_INPUT,
-    VISIBLE_PROVIDER_ACTIONS.PROMPT_SUBMIT,
-  ]) {
-    assert.equal(VISIBLE_PROVIDER_ACTION_METADATA[coreAction].priority, 'core')
-  }
-  assert.equal(listVisibleProviderActions().length, 15)
-  assert.equal(capabilitiesPayload().visibleProviderActions.protocol, VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION)
-  assert.deepEqual(capabilitiesPayload().visibleProviderActions.actions, listVisibleProviderActions())
-})
-
-test('provider manifests are total and match authenticated DOM plus accepted local adapter evidence', async () => {
-  const { VISIBLE_PROVIDER_ACTIONS, listVisibleProviderActions } = await import(ACTION_MODULE)
-  const {
-    getVisibleProviderActionCapabilities,
-    isVisibleProviderActionVerified,
-    listVisibleProviderActionCapabilities,
-  } = await import(CAPABILITY_MODULE)
-
-  const manifests = listVisibleProviderActionCapabilities()
-  assert.deepEqual(manifests.map(({ provider }) => provider).sort(), ['chatgpt', 'claude', 'gemini', 'grok'])
-  for (const manifest of manifests) {
-    assert.deepEqual(Object.keys(manifest.actions).sort(), listVisibleProviderActions().sort())
-    assert.deepEqual(manifest.safety, {
-      visibleUiOnly: true,
-      readsPrivateProviderApis: false,
-      readsBrowserCredentials: false,
-      exactVisibleSelection: true,
-    })
-    for (const capability of Object.values(manifest.actions)) {
-      if (capability.state === 'verified') assert.ok(capability.evidence.length > 0)
-      else assert.ok(capability.reason)
-    }
-  }
-
-  for (const provider of ['chatgpt', 'claude', 'gemini', 'grok']) {
-    const capabilityManifest = getVisibleProviderActionCapabilities(provider)
-    for (const action of [
-      VISIBLE_PROVIDER_ACTIONS.AUTH_STATUS,
-      VISIBLE_PROVIDER_ACTIONS.MODEL_INSPECT,
-      VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT,
-      VISIBLE_PROVIDER_ACTIONS.PROMPT_INPUT,
-      VISIBLE_PROVIDER_ACTIONS.PROMPT_SUBMIT,
-    ]) {
-      assert.equal(isVisibleProviderActionVerified(provider, action), true, `${provider} ${action}`)
-    }
-    assert.equal(isVisibleProviderActionVerified(provider, VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD), true, `${provider} file.upload`)
-    assert.match(
-      capabilityManifest.actions[VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD].evidence.join(' '),
-      /file-input-ready-and-native-local-e2e/,
-      `${provider} file.upload evidence`,
-    )
-    for (const action of [
-      VISIBLE_PROVIDER_ACTIONS.SKILL_UPLOAD,
-      VISIBLE_PROVIDER_ACTIONS.CONNECTOR_INSPECT,
-      VISIBLE_PROVIDER_ACTIONS.CONNECTOR_SELECT,
-      VISIBLE_PROVIDER_ACTIONS.PROJECT_INSPECT,
-      VISIBLE_PROVIDER_ACTIONS.PROJECT_OPEN,
-      VISIBLE_PROVIDER_ACTIONS.HISTORY_INSPECT,
-      VISIBLE_PROVIDER_ACTIONS.HISTORY_OPEN,
-    ]) {
-      assert.equal(capabilityManifest.actions[action].state, 'pending_evidence', `${provider} ${action}`)
-    }
-  }
-
-  for (const provider of ['chatgpt', 'claude', 'gemini']) {
-    assert.equal(isVisibleProviderActionVerified(provider, VISIBLE_PROVIDER_ACTIONS.EFFORT_INSPECT), true, `${provider} effort.inspect`)
-    assert.equal(isVisibleProviderActionVerified(provider, VISIBLE_PROVIDER_ACTIONS.EFFORT_SELECT), true, `${provider} effort.select`)
-  }
-
-  const grokCapabilities = getVisibleProviderActionCapabilities('grok')
-  assert.equal(grokCapabilities.actions[VISIBLE_PROVIDER_ACTIONS.EFFORT_INSPECT].state, 'unsupported')
-  assert.equal(grokCapabilities.actions[VISIBLE_PROVIDER_ACTIONS.EFFORT_SELECT].state, 'unsupported')
-  assert.match(grokCapabilities.actions[VISIBLE_PROVIDER_ACTIONS.EFFORT_SELECT].reason, /couples thinking effort to visible model profiles/i)
-  assert.match(
-    grokCapabilities.actions[VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT].evidence.join(' '),
-    /authenticated-entitlement-fail-closed/,
-  )
-
-  assert.equal(getVisibleProviderActionCapabilities('unknown-provider'), null)
-})
-
-test('request validation is discriminated, path-free, bounded, and exact-key only', async () => {
-  const {
-    VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION,
-    VISIBLE_PROVIDER_ACTIONS,
-    validateVisibleProviderActionRequest,
-  } = await import(ACTION_MODULE)
-  const base = {
-    protocol: VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION,
-    requestId: 'visible-action-request',
-    provider: 'chatgpt',
-  }
-
-  const model = validateVisibleProviderActionRequest({
-    ...base,
-    action: VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT,
-    payload: { label: '  GPT-5  ', fallbacks: ['GPT-4.1'] },
-  })
-  assert.equal(model.ok, true)
-  assert.deepEqual(model.request.payload, { label: 'GPT-5', fallbacks: ['GPT-4.1'] })
-
-  const upload = validateVisibleProviderActionRequest({
-    ...base,
-    action: VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD,
-    payload: { attachments: [attachment()] },
-  })
-  assert.equal(upload.ok, true)
-  assert.equal(Object.hasOwn(upload.request.payload.attachments[0], 'path'), false)
-
-  for (const malformed of [
-    { ...base, action: VISIBLE_PROVIDER_ACTIONS.AUTH_STATUS, payload: { accountEmail: 'secret@example.test' } },
-    { ...base, action: VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT, payload: { label: 'GPT-5', guessedId: 'private-model-id' } },
-    { ...base, action: VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT, payload: { label: 'GPT-5', fallbacks: ['ＧＰＴ－５'] } },
-    { ...base, action: VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD, payload: { attachments: [{ ...attachment(), path: 'C:\\secret.txt' }] } },
-    { ...base, action: VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD, payload: { attachments: [attachment(), attachment()] } },
-    { ...base, action: VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD, payload: { attachments: [attachment(), attachment({ attachmentId: 'second', bundleId: 'other' })] } },
-    { ...base, action: VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD, payload: { attachments: [attachment({ size: 512 * 1024 * 1024 }), attachment({ attachmentId: 'second' })] } },
-    { ...base, action: VISIBLE_PROVIDER_ACTIONS.HISTORY_OPEN, payload: { label: 'Conversation', href: 'https://example.test/private' } },
-    { ...base, action: VISIBLE_PROVIDER_ACTIONS.AUTH_STATUS, payload: {}, unexpected: true },
-  ]) {
-    assert.equal(validateVisibleProviderActionRequest(malformed).ok, false)
-  }
-})
-
-test('prompt submit is atomic and cannot submit an ambient or appended provider draft', async () => {
-  const {
-    VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION,
-    VISIBLE_PROVIDER_ACTIONS,
-    validateVisibleProviderActionRequest,
-  } = await import(ACTION_MODULE)
-  const base = {
-    protocol: VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION,
-    requestId: 'prompt-action-request',
-    provider: 'grok',
-    action: VISIBLE_PROVIDER_ACTIONS.PROMPT_SUBMIT,
-  }
-  assert.equal(validateVisibleProviderActionRequest({
-    ...base,
-    payload: { text: 'Submit exactly this prompt.', mode: 'replace' },
-  }).ok, true)
-  for (const payload of [
-    {},
-    { text: '', mode: 'replace' },
-    { text: 'ambient draft', mode: 'append' },
-    { text: 'ambient draft' },
-    { mode: 'replace' },
-  ]) {
-    const validation = validateVisibleProviderActionRequest({ ...base, payload })
-    assert.equal(validation.ok, false)
-    assert.equal(validation.error.code, 'invalid_prompt_action')
-  }
-})
-
-test('success responses are action-specific and reject account identity or hidden navigation fields', async () => {
-  const {
-    VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION,
-    VISIBLE_PROVIDER_ACTIONS,
-    createVisibleProviderActionResponse,
-  } = await import(ACTION_MODULE)
-  const request = (action) => ({
-    protocol: VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION,
-    requestId: `result-${action}`,
-    provider: 'chatgpt',
-    action,
-    payload: {},
-  })
-  const auth = createVisibleProviderActionResponse(request(VISIBLE_PROVIDER_ACTIONS.AUTH_STATUS), {
-    ok: true,
-    result: {
-      state: 'authenticated',
-      plan: { label: 'Free', free: true },
-      usage: [{ label: 'Messages', value: 'Available' }],
-    },
-  })
-  assert.equal(auth.ok, true)
-  assert.deepEqual(auth.result, {
-    state: 'authenticated',
-    plan: { label: 'Free', free: true },
-    usage: [{ label: 'Messages', value: 'Available' }],
-  })
-
-  for (const result of [
-    { state: 'authenticated', email: 'secret@example.test' },
-    { state: 'authenticated', cookies: ['secret'] },
-    { state: 'authenticated', plan: { label: 'Free', free: true, accountId: 'private' } },
-    Object.assign(Object.create({ state: 'authenticated' }), {}),
-  ]) {
-    const rejected = createVisibleProviderActionResponse(request(VISIBLE_PROVIDER_ACTIONS.AUTH_STATUS), { ok: true, result })
-    assert.equal(rejected.ok, false)
-    assert.equal(rejected.error.code, 'invalid_visible_action_result')
-  }
-
-  const history = createVisibleProviderActionResponse(request(VISIBLE_PROVIDER_ACTIONS.HISTORY_INSPECT), {
-    ok: true,
-    result: { choices: [{ label: 'Visible conversation', selected: false, enabled: true }] },
-  })
-  assert.equal(history.ok, true)
-  const historyLeak = createVisibleProviderActionResponse(request(VISIBLE_PROVIDER_ACTIONS.HISTORY_INSPECT), {
-    ok: true,
-    result: { choices: [{ label: 'Visible conversation', selected: false, enabled: true, privateId: 'hidden' }] },
-  })
-  assert.equal(historyLeak.ok, false)
-
-  const prompt = createVisibleProviderActionResponse(request(VISIBLE_PROVIDER_ACTIONS.PROMPT_SUBMIT), {
-    ok: true,
-    result: { submissionProof: 'visible-user-message-1', visible: true },
-  })
-  assert.equal(prompt.ok, true)
-  const promptLeak = createVisibleProviderActionResponse(request(VISIBLE_PROVIDER_ACTIONS.PROMPT_SUBMIT), {
-    ok: true,
-    result: { submissionProof: 'visible-user-message-1', visible: true, prompt: 'private prompt echo' },
-  })
-  assert.equal(promptLeak.ok, false)
-})
-
-test('authorization gates verified uploads by auth and fails closed on provider mismatch, labels, and limits', async () => {
-  const {
-    VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION,
-    VISIBLE_PROVIDER_ACTIONS,
-    authorizeVisibleProviderAction,
-    createVisibleProviderCapabilityManifest,
-  } = await import(ACTION_MODULE)
-  const { getVisibleProviderActionCapabilities } = await import(CAPABILITY_MODULE)
-  const request = (provider, action, payload) => ({
-    protocol: VISIBLE_PROVIDER_ACTION_PROTOCOL_VERSION,
-    requestId: `${provider}-${action}`,
-    provider,
-    action,
-    payload,
-  })
-
-  const verifiedAuth = authorizeVisibleProviderAction(
-    request('chatgpt', VISIBLE_PROVIDER_ACTIONS.AUTH_STATUS, {}),
-    getVisibleProviderActionCapabilities('chatgpt'),
-  )
-  assert.equal(verifiedAuth.ok, true)
-
-  const unauthenticatedFile = authorizeVisibleProviderAction(
-    request('chatgpt', VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD, { attachments: [attachment()] }),
-    getVisibleProviderActionCapabilities('chatgpt'),
-  )
-  assert.equal(unauthenticatedFile.ok, false)
-  assert.equal(unauthenticatedFile.error.code, 'visible_action_auth_required')
-  const authenticatedFile = authorizeVisibleProviderAction(
-    request('chatgpt', VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD, { attachments: [attachment()] }),
-    getVisibleProviderActionCapabilities('chatgpt'),
-    { authState: 'authenticated' },
-  )
-  assert.equal(authenticatedFile.ok, true)
-
-  const providerMismatch = authorizeVisibleProviderAction(
-    request('gemini', VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT, { label: 'Flash' }),
-    getVisibleProviderActionCapabilities('chatgpt'),
-  )
-  assert.equal(providerMismatch.ok, false)
-  assert.equal(providerMismatch.error.code, 'visible_action_capability_mismatch')
-
-  const authenticatedModel = request('chatgpt', VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT, { label: 'GPT-5' })
-  const chatGptCapabilities = getVisibleProviderActionCapabilities('chatgpt')
-  assert.equal(authorizeVisibleProviderAction(authenticatedModel, chatGptCapabilities).error.code, 'visible_action_auth_required')
-  assert.equal(authorizeVisibleProviderAction(authenticatedModel, chatGptCapabilities, { authState: 'authenticated' }).ok, true)
-
-  const constrained = createVisibleProviderCapabilityManifest('chatgpt', {
-    [VISIBLE_PROVIDER_ACTIONS.MODEL_INSPECT]: {
-      state: 'verified',
-      evidence: ['test:model-inspect'],
-      constraints: { allowedLabels: ['GPT-5'] },
-    },
-    [VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT]: {
-      state: 'verified',
-      evidence: ['test:model-select'],
-      constraints: { allowedLabels: ['GPT-5'] },
-    },
-    [VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD]: {
-      state: 'verified',
-      evidence: ['test:file-upload'],
-      constraints: { maxItems: 1, maxBytes: 5 },
-    },
-  })
-  assert.equal(authorizeVisibleProviderAction(
-    request('chatgpt', VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT, { label: 'GPT-5' }),
-    constrained,
-  ).ok, true)
-  assert.equal(authorizeVisibleProviderAction(
-    request('chatgpt', VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT, { label: 'GPT-4.1' }),
-    constrained,
-  ).error.code, 'visible_action_choice_unavailable')
-  assert.equal(authorizeVisibleProviderAction(
-    request('chatgpt', VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT, { label: 'GPT-5', fallbacks: ['GPT-4.1'] }),
-    constrained,
-  ).error.code, 'visible_action_choice_unavailable')
-  assert.equal(authorizeVisibleProviderAction(
-    request('chatgpt', VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD, {
-      attachments: [attachment(), attachment({ attachmentId: 'second' })],
-    }),
-    constrained,
-  ).error.code, 'visible_action_limit_exceeded')
-})
-
-test('capability construction requires evidence and verified inspection dependencies', async () => {
-  const {
-    VISIBLE_PROVIDER_ACTIONS,
-    createVisibleProviderCapabilityManifest,
-  } = await import(ACTION_MODULE)
-  assert.throws(() => createVisibleProviderCapabilityManifest('chatgpt', {
-    [VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD]: { state: 'verified' },
-  }), /requires DOM evidence/)
-  assert.throws(() => createVisibleProviderCapabilityManifest('chatgpt', {
-    [VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT]: { state: 'verified', evidence: ['test:model-select'] },
-  }), /cannot be verified until model.inspect is verified/)
-  assert.throws(() => createVisibleProviderCapabilityManifest('chatgpt', {
-    [VISIBLE_PROVIDER_ACTIONS.HISTORY_OPEN]: { state: 'verified', evidence: ['test:history-open'] },
-  }), /cannot be verified until history.inspect is verified/)
-})
diff --git a/legacy/test/visible-provider-action-native-route.test.mjs b/legacy/test/visible-provider-action-native-route.test.mjs
deleted file mode 100644
index 201963d..0000000
--- a/legacy/test/visible-provider-action-native-route.test.mjs
+++ /dev/null
@@ -1,86 +0,0 @@
-import assert from 'node:assert/strict'
-import test from 'node:test'
-
-const BRIDGE_MODULE = '../legacy/extension/dist/extension/shared/bridge-protocol.js'
-const ACTION_MODULE = '../legacy/extension/dist/extension/shared/visible-provider-actions.js'
-
-const descriptor = Object.freeze({
-  protocol: 'tokenless.visible-attachment.v1',
-  bundleId: 'native-route-bundle',
-  attachmentId: 'native-route-file',
-  name: 'evidence.txt',
-  type: 'text/plain',
-  size: 5,
-  sha256: '2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824',
-})
-
-test('bridge accepts one strict nested v1 action and correlates its wrapper', async () => {
-  const bridge = await import(BRIDGE_MODULE)
-  const actions = await import(ACTION_MODULE)
-  const visibleAction = actions.createVisibleProviderActionRequest({
-    requestId: 'native-route-model',
-    provider: 'gemini',
-    action: actions.VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT,
-    payload: { label: '3.1 Pro' },
-  })
-  const request = bridge.createBridgeRequest({
-    requestId: visibleAction.requestId,
-    provider: visibleAction.provider,
-    action: bridge.BRIDGE_ACTIONS.VISIBLE_PROVIDER_ACTION,
-    visibleAction,
-  })
-  const validation = bridge.validateBridgeRequest(request)
-  assert.equal(validation.ok, true)
-  assert.deepEqual(validation.request.visibleAction, visibleAction)
-  assert.ok(bridge.capabilitiesPayload().actions.includes('visible_provider_action'))
-})
-
-test('bridge rejects nested identity drift, unknown wrapper fields, and non-v1 shapes', async () => {
-  const bridge = await import(BRIDGE_MODULE)
-  const actions = await import(ACTION_MODULE)
-  const visibleAction = actions.createVisibleProviderActionRequest({
-    requestId: 'native-route-auth',
-    provider: 'claude',
-    action: actions.VISIBLE_PROVIDER_ACTIONS.AUTH_STATUS,
-    payload: {},
-  })
-  const base = bridge.createBridgeRequest({
-    requestId: visibleAction.requestId,
-    provider: visibleAction.provider,
-    action: bridge.BRIDGE_ACTIONS.VISIBLE_PROVIDER_ACTION,
-    visibleAction,
-  })
-
-  assert.equal(bridge.validateBridgeRequest({ ...base, requestId: 'wrapper-drift' }).error.code, 'visible_action_bridge_mismatch')
-  assert.equal(bridge.validateBridgeRequest({ ...base, provider: 'gemini' }).error.code, 'visible_action_bridge_mismatch')
-  assert.equal(bridge.validateBridgeRequest({ ...base, prompt: 'must-not-cross-wrapper' }).error.code, 'invalid_visible_action_bridge_shape')
-  assert.equal(bridge.validateBridgeRequest({
-    ...base,
-    visibleAction: { ...visibleAction, privateToken: 'must-not-be-accepted' },
-  }).error.code, 'invalid_visible_action_request')
-})
-
-test('standalone file upload requires path-free native descriptors to match nested payload exactly', async () => {
-  const bridge = await import(BRIDGE_MODULE)
-  const actions = await import(ACTION_MODULE)
-  const visibleAction = actions.createVisibleProviderActionRequest({
-    requestId: 'native-route-file',
-    provider: 'chatgpt',
-    action: actions.VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD,
-    payload: { attachments: [descriptor] },
-  })
-  const base = bridge.createBridgeRequest({
-    requestId: visibleAction.requestId,
-    provider: visibleAction.provider,
-    action: bridge.BRIDGE_ACTIONS.VISIBLE_PROVIDER_ACTION,
-    visibleAction,
-    attachments: [descriptor],
-  })
-  assert.equal(bridge.validateBridgeRequest(base).ok, true)
-
-  const mismatched = structuredClone(base)
-  mismatched.attachments = [{ ...mismatched.attachments[0], name: 'different.txt' }]
-  assert.equal(bridge.validateBridgeRequest(mismatched).error.code, 'visible_action_attachment_mismatch')
-  assert.equal(bridge.validateBridgeRequest({ ...base, attachments: undefined }).error.code, 'visible_action_attachment_mismatch')
-  assert.doesNotMatch(JSON.stringify(base), /sourcePath|stagedPath|^[A-Za-z]:\\|cookie|localStorage|sessionStorage/i)
-})
diff --git a/legacy/test/visible-provider-action-runtime.test.mjs b/legacy/test/visible-provider-action-runtime.test.mjs
deleted file mode 100644
index b03e0b6..0000000
--- a/legacy/test/visible-provider-action-runtime.test.mjs
+++ /dev/null
@@ -1,271 +0,0 @@
-import assert from 'node:assert/strict'
-import test from 'node:test'
-
-const ACTION_MODULE = '../legacy/extension/dist/extension/shared/visible-provider-actions.js'
-const RUNTIME_MODULE = '../legacy/extension/dist/extension/background/visible-provider-action-runtime.js'
-
-async function runtimeRequest(provider, action, payload, overrides = {}) {
-  const actions = await import(ACTION_MODULE)
-  return actions.createVisibleProviderRuntimeEnvelope(actions.createVisibleProviderActionRequest({
-    requestId: `runtime-${provider}-${action}`,
-    provider,
-    action,
-    payload,
-    ...overrides,
-  }))
-}
-
-function runtimeFixture({ auth = { state: 'authenticated' }, content, upload } = {}) {
-  const calls = []
-  const dependencies = {
-    async acquireProviderTab(provider, options) {
-      calls.push({ kind: 'acquire', provider: provider.id, options })
-      return 42
-    },
-    async validateProviderLanding(tabId, provider, request) {
-      calls.push({ kind: 'landing', tabId, provider: provider.id, request })
-    },
-    async sendToProviderTab(tabId, provider, contextRequest, message) {
-      calls.push({ kind: 'content', tabId, provider: provider.id, contextRequest, message })
-      if (message.type === 'tokenless.bridge.inspect_auth') {
-        return { status: 'inspected', provider: provider.id, visible: true, auth }
-      }
-      if (content) return content({ tabId, provider, contextRequest, message })
-      throw new Error(`Unexpected content action: ${message.type}`)
-    },
-    async uploadVisibleAttachments(tabId, provider, contextRequest, attachments) {
-      calls.push({ kind: 'upload', tabId, provider: provider.id, contextRequest, attachments })
-      if (upload) return upload({ tabId, provider, contextRequest, attachments })
-      throw new Error('Unexpected visible attachment upload')
-    },
-  }
-  return { calls, dependencies }
-}
-
-test('runtime auth.status uses the content auth action and emits only privacy-safe plan usage', async () => {
-  const { VISIBLE_PROVIDER_ACTIONS } = await import(ACTION_MODULE)
-  const { runVisibleProviderRuntimeEnvelope } = await import(RUNTIME_MODULE)
-  const fixture = runtimeFixture({
-    auth: {
-      state: 'authenticated',
-      plan: { label: 'Free', free: true },
-      usage: [{ label: 'Messages', value: 'Available' }],
-    },
-  })
-  const response = await runVisibleProviderRuntimeEnvelope(
-    await runtimeRequest('claude', VISIBLE_PROVIDER_ACTIONS.AUTH_STATUS, {}),
-    fixture.dependencies,
-  )
-  assert.equal(response.ok, true)
-  assert.deepEqual(response.result, {
-    state: 'authenticated',
-    plan: { label: 'Free', free: true },
-    usage: [{ label: 'Messages', value: 'Available' }],
-  })
-  assert.deepEqual(fixture.calls.map(({ kind, message }) => message?.type ?? kind), [
-    'acquire',
-    'tokenless.bridge.inspect_auth',
-  ])
-  assert.doesNotMatch(JSON.stringify(response), /email|cookie|localStorage|sessionStorage/i)
-})
-
-test('runtime model.inspect maps existing controls into the v1 choice result', async () => {
-  const { VISIBLE_PROVIDER_ACTIONS } = await import(ACTION_MODULE)
-  const { runVisibleProviderRuntimeEnvelope } = await import(RUNTIME_MODULE)
-  const fixture = runtimeFixture({
-    auth: { state: 'unauthenticated' },
-    content({ message }) {
-      assert.equal(message.type, 'tokenless.bridge.inspect_controls')
-      return {
-        status: 'inspected',
-        controls: {
-          models: [
-            { label: 'Flash', selected: true, available: true, privateModeId: 'must-not-escape' },
-            { label: 'Pro', selected: false, available: false },
-          ],
-          efforts: [],
-        },
-      }
-    },
-  })
-  const response = await runVisibleProviderRuntimeEnvelope(
-    await runtimeRequest('gemini', VISIBLE_PROVIDER_ACTIONS.MODEL_INSPECT, {}),
-    fixture.dependencies,
-  )
-  assert.equal(response.ok, true)
-  assert.deepEqual(response.result, {
-    choices: [
-      { label: 'Flash', selected: true, enabled: true },
-      { label: 'Pro', selected: false, enabled: false },
-    ],
-  })
-  assert.doesNotMatch(JSON.stringify(response), /privateModeId|must-not-escape/)
-  assert.deepEqual(fixture.calls.map(({ kind, message }) => message?.type ?? kind), [
-    'acquire',
-    'tokenless.bridge.inspect_auth',
-    'landing',
-    'tokenless.bridge.inspect_controls',
-  ])
-  assert.deepEqual(fixture.calls[0].options, { forceNew: false })
-})
-
-test('runtime gates auth-required model selection before landing or mutation', async () => {
-  const { VISIBLE_PROVIDER_ACTIONS } = await import(ACTION_MODULE)
-  const { runVisibleProviderRuntimeEnvelope } = await import(RUNTIME_MODULE)
-  const signedOut = runtimeFixture({ auth: { state: 'unauthenticated' } })
-  const envelope = await runtimeRequest('chatgpt', VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT, { label: 'GPT-5' })
-  const blocked = await runVisibleProviderRuntimeEnvelope(envelope, signedOut.dependencies)
-  assert.equal(blocked.ok, false)
-  assert.equal(blocked.error.code, 'visible_action_auth_required')
-  assert.deepEqual(signedOut.calls.map(({ kind, message }) => message?.type ?? kind), [
-    'acquire',
-    'tokenless.bridge.inspect_auth',
-  ])
-
-  const signedIn = runtimeFixture({
-    auth: { state: 'authenticated', plan: { label: 'Plus', free: false } },
-    content({ contextRequest, message }) {
-      assert.equal(message.type, 'tokenless.bridge.configure_controls')
-      assert.equal(contextRequest.model, 'GPT-5')
-      return {
-        status: 'configured',
-        model: { status: 'selected', requested: 'GPT-5', applied: 'GPT-5' },
-      }
-    },
-  })
-  const selected = await runVisibleProviderRuntimeEnvelope(envelope, signedIn.dependencies)
-  assert.equal(selected.ok, true)
-  assert.deepEqual(selected.result, { label: 'GPT-5', visible: true })
-})
-
-test('runtime prompt.input replaces visible text without invoking submit', async () => {
-  const { VISIBLE_PROVIDER_ACTIONS } = await import(ACTION_MODULE)
-  const { runVisibleProviderRuntimeEnvelope } = await import(RUNTIME_MODULE)
-  const fixture = runtimeFixture({
-    auth: { state: 'authenticated' },
-    content({ contextRequest, message }) {
-      assert.equal(message.type, 'tokenless.bridge.input_prompt')
-      assert.equal(contextRequest.prompt, 'Exact visible draft')
-      assert.equal(contextRequest.mode, 'replace')
-      return {
-        status: 'input',
-        provider: 'grok',
-        visible: true,
-        inputProof: 'runtime-grok-prompt.input',
-      }
-    },
-  })
-  const response = await runVisibleProviderRuntimeEnvelope(
-    await runtimeRequest('grok', VISIBLE_PROVIDER_ACTIONS.PROMPT_INPUT, {
-      text: 'Exact visible draft',
-      mode: 'replace',
-    }),
-    fixture.dependencies,
-  )
-  assert.equal(response.ok, true)
-  assert.deepEqual(response.result, { inputProof: 'runtime-grok-prompt.input', visible: true })
-  assert.equal(fixture.calls.some(({ message }) => message?.type === 'tokenless.bridge.submit'), false)
-  assert.deepEqual(fixture.calls[0].options, { forceNew: false })
-})
-
-test('runtime prompt.submit reuses visible submit but strips prompt and internal baseline', async () => {
-  const { VISIBLE_PROVIDER_ACTIONS } = await import(ACTION_MODULE)
-  const { runVisibleProviderRuntimeEnvelope } = await import(RUNTIME_MODULE)
-  const fixture = runtimeFixture({
-    auth: { state: 'authenticated' },
-    content({ contextRequest, message }) {
-      assert.equal(message.type, 'tokenless.bridge.submit')
-      assert.equal(contextRequest.prompt, 'Private runtime prompt')
-      return {
-        status: 'submitted',
-        answerBaseline: { count: 7, lastText: 'private prior answer' },
-        submission: { busy: true },
-      }
-    },
-  })
-  const response = await runVisibleProviderRuntimeEnvelope(
-    await runtimeRequest('chatgpt', VISIBLE_PROVIDER_ACTIONS.PROMPT_SUBMIT, {
-      text: 'Private runtime prompt',
-      mode: 'replace',
-    }),
-    fixture.dependencies,
-  )
-  assert.equal(response.ok, true)
-  assert.deepEqual(response.result, {
-    submissionProof: 'visible-submit-runtime-chatgpt-prompt.submit',
-    visible: true,
-  })
-  assert.doesNotMatch(JSON.stringify(response), /Private runtime prompt|private prior answer|answerBaseline/)
-})
-
-test('file.upload delegates path-free descriptors to the native-backed visible uploader', async () => {
-  const { VISIBLE_PROVIDER_ACTIONS } = await import(ACTION_MODULE)
-  const { runVisibleProviderRuntimeEnvelope } = await import(RUNTIME_MODULE)
-  const fixture = runtimeFixture({
-    upload({ contextRequest, attachments }) {
-      assert.equal(contextRequest.action, 'visible_provider_action')
-      assert.equal(contextRequest.visibleAction.action, 'file.upload')
-      assert.equal(attachments.length, 1)
-      assert.equal(attachments[0].name, 'evidence.txt')
-    },
-  })
-  const response = await runVisibleProviderRuntimeEnvelope(
-    await runtimeRequest('chatgpt', VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD, {
-      attachments: [{
-        protocol: 'tokenless.visible-attachment.v1',
-        bundleId: 'runtime-bundle',
-        attachmentId: 'runtime-file',
-        name: 'evidence.txt',
-        type: 'text/plain',
-        size: 5,
-        sha256: '2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824',
-      }],
-    }),
-    fixture.dependencies,
-  )
-  assert.equal(response.ok, true)
-  assert.deepEqual(response.result, {
-    attachments: [{ attachmentId: 'runtime-file', name: 'evidence.txt', visible: true }],
-  })
-  assert.deepEqual(fixture.calls.map(({ kind, message }) => message?.type ?? kind), [
-    'acquire',
-    'tokenless.bridge.inspect_auth',
-    'landing',
-    'upload',
-  ])
-  assert.deepEqual(fixture.calls[0].options, { forceNew: true })
-  assert.doesNotMatch(JSON.stringify(response), /bundleId|sha256|sourcePath|stagedPath/i)
-})
-
-test('runtime sender boundary rejects provider content scripts and foreign extension origins', async () => {
-  const {
-    isTrustedVisibleProviderRuntimeSender,
-    isVisibleProviderRuntimeMessage,
-    rejectedVisibleProviderRuntimeResponse,
-    visibleProviderActionRequiresCleanTab,
-  } = await import(RUNTIME_MODULE)
-  const { VISIBLE_PROVIDER_ACTIONS } = await import(ACTION_MODULE)
-  const envelope = await runtimeRequest('gemini', VISIBLE_PROVIDER_ACTIONS.MODEL_INSPECT, {})
-  assert.equal(isVisibleProviderRuntimeMessage(envelope), true)
-  assert.equal(visibleProviderActionRequiresCleanTab(VISIBLE_PROVIDER_ACTIONS.FILE_UPLOAD), true)
-  assert.equal(visibleProviderActionRequiresCleanTab(VISIBLE_PROVIDER_ACTIONS.MODEL_SELECT), false)
-  assert.equal(visibleProviderActionRequiresCleanTab(VISIBLE_PROVIDER_ACTIONS.EFFORT_SELECT), false)
-  assert.equal(visibleProviderActionRequiresCleanTab(VISIBLE_PROVIDER_ACTIONS.PROMPT_INPUT), false)
-  assert.equal(visibleProviderActionRequiresCleanTab(VISIBLE_PROVIDER_ACTIONS.PROMPT_SUBMIT), false)
-  assert.equal(isTrustedVisibleProviderRuntimeSender({
-    id: 'tokenless-extension',
-    url: 'chrome-extension://tokenless-extension/settings/index.html',
-  }, 'tokenless-extension'), true)
-  assert.equal(isTrustedVisibleProviderRuntimeSender({
-    id: 'tokenless-extension',
-    tab: { id: 7, url: 'https://gemini.google.com/app' },
-    url: 'https://gemini.google.com/app',
-  }, 'tokenless-extension'), false)
-  assert.equal(isTrustedVisibleProviderRuntimeSender({
-    id: 'foreign-extension',
-    url: 'chrome-extension://foreign-extension/page.html',
-  }, 'tokenless-extension'), false)
-  const response = rejectedVisibleProviderRuntimeResponse(envelope)
-  assert.equal(response.ok, false)
-  assert.equal(response.error.code, 'visible_action_sender_rejected')
-})
diff --git a/legacy/test/visible-provider-action-service-worker.test.mjs b/legacy/test/visible-provider-action-service-worker.test.mjs
deleted file mode 100644
index f3e8fef..0000000
--- a/legacy/test/visible-provider-action-service-worker.test.mjs
+++ /dev/null
@@ -1,187 +0,0 @@
-import assert from 'node:assert/strict'
-import path from 'node:path'
-import test from 'node:test'
-import { fileURLToPath, pathToFileURL } from 'node:url'
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-const extensionDist = path.join(root, 'packages', 'extension', 'dist', 'extension')
-const ACTION_MODULE = '../legacy/extension/dist/extension/shared/visible-provider-actions.js'
-
-test('service worker exposes the v1 runtime route only to extension-owned pages', async () => {
-  const previousChrome = globalThis.chrome
-  const runtimeMessage = chromeEvent()
-  const createdTabs = []
-  const providerMessages = []
-  let nextTabId = 1
-
-  const nativePort = {
-    onMessage: chromeEvent(),
-    onDisconnect: chromeEvent(),
-    posted: [],
-    postMessage(message) {
-      this.posted.push(message)
-    },
-    disconnect() {},
-  }
-
-  globalThis.chrome = {
-    runtime: {
-      id: 'tokenless-test-extension',
-      lastError: undefined,
-      onInstalled: chromeEvent(),
-      onStartup: chromeEvent(),
-      onMessage: runtimeMessage,
-      connectNative(name) {
-        assert.equal(name, 'dev.tokenless.native_host')
-        return nativePort
-      },
-      async sendMessage() {
-        throw new Error('debugger companion is outside this test')
-      },
-    },
-    sidePanel: {
-      async setPanelBehavior() {},
-    },
-    scripting: {
-      async executeScript() {
-        throw new Error('content script should already be present')
-      },
-    },
-    tabs: {
-      async query() {
-        return []
-      },
-      async create(details) {
-        const tab = {
-          id: nextTabId++,
-          windowId: 1,
-          active: details.active === true,
-          status: 'complete',
-          url: String(details.url),
-        }
-        createdTabs.push(tab)
-        return tab
-      },
-      async get(tabId) {
-        return createdTabs.find((tab) => tab.id === tabId)
-      },
-      async update(tabId, details) {
-        const tab = createdTabs.find((candidate) => candidate.id === tabId)
-        Object.assign(tab, details)
-        return tab
-      },
-      async sendMessage(tabId, message) {
-        providerMessages.push({ tabId, message })
-        if (message.type === 'tokenless.bridge.inspect_auth') {
-          return {
-            status: 'inspected',
-            provider: 'gemini',
-            visible: true,
-            auth: { state: 'unauthenticated' },
-          }
-        }
-        if (message.type === 'tokenless.bridge.validate_landing') return { status: 'ready' }
-        if (message.type === 'tokenless.bridge.inspect_controls') {
-          return {
-            status: 'inspected',
-            controls: {
-              models: [{ label: 'Flash', selected: true, available: true }],
-              efforts: [],
-            },
-          }
-        }
-        throw new Error(`Unexpected provider message: ${message.type}`)
-      },
-    },
-    windows: {
-      async update() {},
-    },
-  }
-
-  try {
-    const serviceWorkerUrl = pathToFileURL(path.join(extensionDist, 'background', 'service-worker.js'))
-    serviceWorkerUrl.searchParams.set('visible-provider-runtime', String(Date.now()))
-    await import(serviceWorkerUrl.href)
-    await nativePort.onMessage.emit({
-      protocol: 'tokenless.native.v1',
-      type: 'tokenless.native.daemon_connected',
-      ok: true,
-      result: {
-        status: 'connected',
-        sessionId: 'visible-provider-runtime-test',
-      },
-    })
-    assert.equal(runtimeMessage.listeners.length, 1)
-
-    const actions = await import(ACTION_MODULE)
-    const envelope = actions.createVisibleProviderRuntimeEnvelope(actions.createVisibleProviderActionRequest({
-      requestId: 'service-worker-model-inspect',
-      provider: 'gemini',
-      action: actions.VISIBLE_PROVIDER_ACTIONS.MODEL_INSPECT,
-      payload: {},
-    }))
-
-    const untrusted = await invokeListener(runtimeMessage.listeners[0], envelope, {
-      id: 'tokenless-test-extension',
-      tab: { id: 99, url: 'https://gemini.google.com/app' },
-      url: 'https://gemini.google.com/app',
-    })
-    assert.equal(untrusted.ok, false)
-    assert.equal(untrusted.error.code, 'visible_action_sender_rejected')
-    assert.deepEqual(createdTabs, [], 'provider content scripts must not trigger tab creation')
-
-    const response = await invokeListener(runtimeMessage.listeners[0], envelope, {
-      id: 'tokenless-test-extension',
-      url: 'chrome-extension://tokenless-test-extension/settings/index.html',
-    })
-    assert.equal(response.ok, true)
-    assert.deepEqual(response.result, {
-      choices: [{ label: 'Flash', selected: true, enabled: true }],
-    })
-    assert.deepEqual(createdTabs.map(({ url }) => url), ['https://gemini.google.com/app'])
-    assert.deepEqual(providerMessages.map(({ message }) => message.type), [
-      'tokenless.bridge.inspect_auth',
-      'tokenless.bridge.validate_landing',
-      'tokenless.bridge.inspect_controls',
-    ])
-    assert.deepEqual(nativePort.posted, [{
-      protocol: 'tokenless.native.v1',
-      type: 'tokenless.native.daemon_connect',
-    }])
-  } finally {
-    globalThis.chrome = previousChrome
-  }
-})
-
-function chromeEvent() {
-  const listeners = []
-  return {
-    listeners,
-    addListener(listener) {
-      listeners.push(listener)
-    },
-    async emit(message) {
-      for (const listener of listeners) await listener(message)
-    },
-  }
-}
-
-function invokeListener(listener, message, sender) {
-  return new Promise((resolve, reject) => {
-    const timeout = setTimeout(() => reject(new Error('runtime listener timed out')), 5000)
-    const sendResponse = (response) => {
-      clearTimeout(timeout)
-      resolve(response)
-    }
-    try {
-      const asynchronous = listener(message, sender, sendResponse)
-      if (asynchronous !== true && asynchronous !== false && asynchronous !== undefined) {
-        clearTimeout(timeout)
-        reject(new Error('runtime listener returned an invalid keepalive value'))
-      }
-    } catch (error) {
-      clearTimeout(timeout)
-      reject(error)
-    }
-  })
-}
diff --git a/package-lock.json b/package-lock.json
index 41bc8fe..6230b95 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -13,8 +13,10 @@
       ],
       "devDependencies": {
         "@changesets/cli": "^2.31.0",
-        "@playwright/test": "^1.53.0",
+        "@playwright/test": "1.61.1",
         "@types/node": "^26.1.1",
+        "ajv": "^8.20.0",
+        "ajv-formats": "^3.0.1",
         "selfsigned": "^5.5.0",
         "typescript": "^7.0.2"
       },
@@ -274,6 +276,40 @@
         "prettier": "^2.7.1"
       }
     },
+    "node_modules/@emnapi/core": {
+      "version": "2.0.0-alpha.3",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-2.0.0-alpha.3.tgz",
+      "integrity": "sha512-AZypUeJ/yByuxyS7BlSNRDOMLMlROYtjYdIAuBmJssVz1UJDSeYxLrdizhXCFYhedC5bqd/ASy8EuNXbVVXp9g==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/wasi-threads": "2.0.1",
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@emnapi/runtime": {
+      "version": "2.0.0-alpha.3",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-2.0.0-alpha.3.tgz",
+      "integrity": "sha512-hFPAhMUjJD9BSyCANEISPOogeXC9Zo9ZQl7L6vKnaVsMkCtzznaW/naYypeyl0Gv5rYfWYsZbpixTMpjDJzQeA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@emnapi/wasi-threads": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-2.0.1.tgz",
+      "integrity": "sha512-9DsSk+o5NBX0CCJT8s0EROGSGxjR/tKu6aBTaVyq+SjAEQH4XcdcRxPBRzsBLizTTJ49MJjF+jgu3qnO9GLQcQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
     "node_modules/@inquirer/external-editor": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/@inquirer/external-editor/-/external-editor-1.0.3.tgz",
@@ -296,6 +332,66 @@
         }
       }
     },
+    "node_modules/@jridgewell/gen-mapping": {
+      "version": "0.3.13",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
+      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.0",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
+    },
+    "node_modules/@jridgewell/remapping": {
+      "version": "2.3.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
+      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.3.5",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
+    },
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
+      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.5.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
+      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.31",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
+      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/resolve-uri": "^3.1.0",
+        "@jridgewell/sourcemap-codec": "^1.4.14"
+      }
+    },
+    "node_modules/@lucide/svelte": {
+      "version": "1.28.0",
+      "resolved": "https://registry.npmjs.org/@lucide/svelte/-/svelte-1.28.0.tgz",
+      "integrity": "sha512-C1Ge84KW2z4q44/WDIEo/2KC2jby5u6mSlta7q+p6g7u0ld8sC/w1fMBiSswF+4bxAl9jlzzaVTpp79qqkiy5g==",
+      "dev": true,
+      "license": "ISC",
+      "peerDependencies": {
+        "svelte": "^5"
+      }
+    },
     "node_modules/@manypkg/find-root": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/@manypkg/find-root/-/find-root-1.1.0.tgz",
@@ -368,6 +464,28 @@
         "node": ">=6 <7 || >=8"
       }
     },
+    "node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.2.2.tgz",
+      "integrity": "sha512-JfB4kuJQjaoHuCTseIINHtHWeJnvgEcxjwA5t/Y00ZgaOO1Crz3fjT/p8kT28zA/Caz7oiUMn3d6H2yOVCVwuw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@tybys/wasm-util": "^0.10.3"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=23.5.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "peerDependencies": {
+        "@emnapi/core": "^1.7.1 || ^2.0.0-alpha.3",
+        "@emnapi/runtime": "^1.7.1 || ^2.0.0-alpha.3"
+      }
+    },
     "node_modules/@noble/hashes": {
       "version": "1.4.0",
       "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.4.0.tgz",
@@ -419,6 +537,16 @@
         "node": ">= 8"
       }
     },
+    "node_modules/@oxc-project/types": {
+      "version": "0.142.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.142.0.tgz",
+      "integrity": "sha512-7W+2q5AKQVU36fkaryontrHn3YDt1RyUYXatw9i5H8ocYe2sPKSFB6eS8WNPeRKiN1qAWWZUPm7gwFzJGrccqQ==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/Boshen"
+      }
+    },
     "node_modules/@peculiar/asn1-cms": {
       "version": "2.8.0",
       "resolved": "https://registry.npmjs.org/@peculiar/asn1-cms/-/asn1-cms-2.8.0.tgz",
@@ -604,321 +732,665 @@
         "node": ">=18"
       }
     },
-    "node_modules/@types/node": {
-      "version": "26.1.1",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.1.tgz",
-      "integrity": "sha512-nxAkRSVkN1Y0JC1W8ky/fTfkGsMmcrRsbx+3XoZE+rMOX71kLYTV7fLXpqud1GpbpP5TuffXFqfX7fH2GgZREw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~8.3.0"
-      }
-    },
-    "node_modules/@typescript/typescript-aix-ppc64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-aix-ppc64/-/typescript-aix-ppc64-7.0.2.tgz",
-      "integrity": "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==",
+    "node_modules/@rolldown/binding-android-arm64": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.1.tgz",
+      "integrity": "sha512-02hOeOSryYxVrOIphmLAsqnCJWxwlzFk+pEt/N/i6OgT3lShHO7xGCU5cpgchRDHboAEbSjzgGh+O/u1GswQmA==",
       "cpu": [
-        "ppc64"
+        "arm64"
       ],
       "dev": true,
-      "license": "Apache-2.0",
+      "license": "MIT",
       "optional": true,
       "os": [
-        "aix"
+        "android"
       ],
       "engines": {
-        "node": ">=16.20.0"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@typescript/typescript-darwin-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-arm64/-/typescript-darwin-arm64-7.0.2.tgz",
-      "integrity": "sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA==",
+    "node_modules/@rolldown/binding-darwin-arm64": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.1.tgz",
+      "integrity": "sha512-fMsTOnN0OjFm3CyppWPitKnc8UlliVARUULW6cfU6AIqjdtgmSFWSk9vecHzZduv/yMWIHDlRhM1e8Iff9uAfA==",
       "cpu": [
         "arm64"
       ],
       "dev": true,
-      "license": "Apache-2.0",
+      "license": "MIT",
       "optional": true,
       "os": [
         "darwin"
       ],
       "engines": {
-        "node": ">=16.20.0"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@typescript/typescript-darwin-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-x64/-/typescript-darwin-x64-7.0.2.tgz",
-      "integrity": "sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA==",
+    "node_modules/@rolldown/binding-darwin-x64": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.1.tgz",
+      "integrity": "sha512-1wjKdz/XLGKHaTNHjQveQ/B23TKx4ItAqm1JbyVuvNPc4Ze0Fb48s49TAd/2zcplPl8okE/UbTgmlVfwT7eFeQ==",
       "cpu": [
         "x64"
       ],
       "dev": true,
-      "license": "Apache-2.0",
+      "license": "MIT",
       "optional": true,
       "os": [
         "darwin"
       ],
       "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-freebsd-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-arm64/-/typescript-freebsd-arm64-7.0.2.tgz",
-      "integrity": "sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@typescript/typescript-freebsd-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-x64/-/typescript-freebsd-x64-7.0.2.tgz",
-      "integrity": "sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw==",
+    "node_modules/@rolldown/binding-freebsd-x64": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.1.tgz",
+      "integrity": "sha512-Fa0jHR07E7YBN4vOEsbVf2briYNsuOowfLJaXULZM0ldMlaCaj2LJgLMbMe4iacRyZmvR8efFhgR9wKuGclQUg==",
       "cpu": [
         "x64"
       ],
       "dev": true,
-      "license": "Apache-2.0",
+      "license": "MIT",
       "optional": true,
       "os": [
         "freebsd"
       ],
       "engines": {
-        "node": ">=16.20.0"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@typescript/typescript-linux-arm": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm/-/typescript-linux-arm-7.0.2.tgz",
-      "integrity": "sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ==",
+    "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.1.tgz",
+      "integrity": "sha512-pzkgu1SSHGgRRyRZ4fbmSgmajbVt+epaLP99NDjFft69v/ypfTi6swBMiVdh2EkQ0OSnHE1lZDM7DRGkyAzUpA==",
       "cpu": [
         "arm"
       ],
       "dev": true,
-      "license": "Apache-2.0",
+      "license": "MIT",
       "optional": true,
       "os": [
         "linux"
       ],
       "engines": {
-        "node": ">=16.20.0"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@typescript/typescript-linux-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm64/-/typescript-linux-arm64-7.0.2.tgz",
-      "integrity": "sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ==",
+    "node_modules/@rolldown/binding-linux-arm64-gnu": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.1.tgz",
+      "integrity": "sha512-QI5SEDY8cbiYWHx0VO4vIc3UlS6a32vXHjU8Qy/17adEmZIPuByJg13UEvo9c/UCiUkdcVWY83C+b+JrwnNyUg==",
       "cpu": [
         "arm64"
       ],
       "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-loong64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-loong64/-/typescript-linux-loong64-7.0.2.tgz",
-      "integrity": "sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ==",
-      "cpu": [
-        "loong64"
+      "libc": [
+        "glibc"
       ],
-      "dev": true,
-      "license": "Apache-2.0",
+      "license": "MIT",
       "optional": true,
       "os": [
         "linux"
       ],
       "engines": {
-        "node": ">=16.20.0"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@typescript/typescript-linux-mips64el": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-mips64el/-/typescript-linux-mips64el-7.0.2.tgz",
-      "integrity": "sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA==",
+    "node_modules/@rolldown/binding-linux-arm64-musl": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.1.tgz",
+      "integrity": "sha512-Sm41FyCeXqmYcERoYOCbGIL5hNfd8w9LQ7Y61Bev48HkcjaJqV/iiVOaiDxjVTRMS+QKrZmD8cfPt4uMVnvM+A==",
       "cpu": [
-        "mips64el"
+        "arm64"
       ],
       "dev": true,
-      "license": "Apache-2.0",
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
       "optional": true,
       "os": [
         "linux"
       ],
       "engines": {
-        "node": ">=16.20.0"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@typescript/typescript-linux-ppc64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-ppc64/-/typescript-linux-ppc64-7.0.2.tgz",
-      "integrity": "sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA==",
+    "node_modules/@rolldown/binding-linux-ppc64-gnu": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.1.tgz",
+      "integrity": "sha512-2x+WhXTGl9yJYPbltW/BSEPTVz9OIWQyER4N+gJEDWkkn904eRcBzELqh/Hf7K0w/ubGbKNMv0ZC+94QK/IFEg==",
       "cpu": [
         "ppc64"
       ],
       "dev": true,
-      "license": "Apache-2.0",
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
       "optional": true,
       "os": [
         "linux"
       ],
       "engines": {
-        "node": ">=16.20.0"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@typescript/typescript-linux-riscv64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-riscv64/-/typescript-linux-riscv64-7.0.2.tgz",
-      "integrity": "sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ==",
+    "node_modules/@rolldown/binding-linux-s390x-gnu": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.1.tgz",
+      "integrity": "sha512-eEjmQpuRQayHPWWnywaWHkFT3ToPbP3RYy42VVd/B9aBGDA+Ol25EIWHxKQST3IiWJjikCWUF7KtbfqwZrzVwQ==",
       "cpu": [
-        "riscv64"
+        "s390x"
       ],
       "dev": true,
-      "license": "Apache-2.0",
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
       "optional": true,
       "os": [
         "linux"
       ],
       "engines": {
-        "node": ">=16.20.0"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@typescript/typescript-linux-s390x": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-s390x/-/typescript-linux-s390x-7.0.2.tgz",
-      "integrity": "sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw==",
+    "node_modules/@rolldown/binding-linux-x64-gnu": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.1.tgz",
+      "integrity": "sha512-/Orga1fZYkLc/56jBICcHrKchl8Z2UKdDSr3LG9ToWO1lQ6a4Livk9Xz+9WN91zsz5QR3XQz2NNoSDEvP6qadw==",
       "cpu": [
-        "s390x"
+        "x64"
       ],
       "dev": true,
-      "license": "Apache-2.0",
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
       "optional": true,
       "os": [
         "linux"
       ],
       "engines": {
-        "node": ">=16.20.0"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@typescript/typescript-linux-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-x64/-/typescript-linux-x64-7.0.2.tgz",
-      "integrity": "sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A==",
+    "node_modules/@rolldown/binding-linux-x64-musl": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.1.tgz",
+      "integrity": "sha512-xxBJRL+0q0Kce7orznGWLuylHDY65vuARXZRpX+hPdv+DqK2c3NlCsVA98tlWzWNEE7yPqA/1NQ5nnCrj49Y5A==",
       "cpu": [
         "x64"
       ],
       "dev": true,
-      "license": "Apache-2.0",
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
       "optional": true,
       "os": [
         "linux"
       ],
       "engines": {
-        "node": ">=16.20.0"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@typescript/typescript-netbsd-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-arm64/-/typescript-netbsd-arm64-7.0.2.tgz",
-      "integrity": "sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA==",
+    "node_modules/@rolldown/binding-openharmony-arm64": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.1.tgz",
+      "integrity": "sha512-M6AdXIXw3s+/8XpKMzdGDEXGS1S7kwUsy+rcTIUIOx5Ge4nXKCtAFHFV9YKkXvGcC5WMoTjAteLzlsQROVI0Yw==",
       "cpu": [
         "arm64"
       ],
       "dev": true,
-      "license": "Apache-2.0",
+      "license": "MIT",
       "optional": true,
       "os": [
-        "netbsd"
+        "openharmony"
       ],
       "engines": {
-        "node": ">=16.20.0"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@typescript/typescript-netbsd-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-x64/-/typescript-netbsd-x64-7.0.2.tgz",
-      "integrity": "sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA==",
-      "cpu": [
-        "x64"
-      ],
+    "node_modules/@rolldown/binding-wasm32-wasi": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.2.1.tgz",
+      "integrity": "sha512-/TX0SoRGojHzSAHpfVBbavRVSazg5U3h3Y3VXfcc0cdugq6kxdqw8LPGFiPr+/7gE/60zRcsOY2Vi9b9eT0jww==",
       "dev": true,
-      "license": "Apache-2.0",
+      "license": "MIT",
       "optional": true,
-      "os": [
-        "netbsd"
-      ],
+      "dependencies": {
+        "@emnapi/core": "2.0.0-alpha.3",
+        "@emnapi/runtime": "2.0.0-alpha.3",
+        "@napi-rs/wasm-runtime": "^1.2.0"
+      },
       "engines": {
-        "node": ">=16.20.0"
+        "node": "^20.19.0 || ^22.13.0 || >=23.5.0"
       }
     },
-    "node_modules/@typescript/typescript-openbsd-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-arm64/-/typescript-openbsd-arm64-7.0.2.tgz",
-      "integrity": "sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ==",
+    "node_modules/@rolldown/binding-win32-arm64-msvc": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.1.tgz",
+      "integrity": "sha512-EvRrivJieyHG+AO9lleZWgq+g0+S7oV2C51yuqlcyU/R9net+sI4Pj0F+lUoP2bEr6TWX3SqFaaS0SzfLxSzkw==",
       "cpu": [
         "arm64"
       ],
       "dev": true,
-      "license": "Apache-2.0",
+      "license": "MIT",
       "optional": true,
       "os": [
-        "openbsd"
+        "win32"
       ],
       "engines": {
-        "node": ">=16.20.0"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@typescript/typescript-openbsd-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-x64/-/typescript-openbsd-x64-7.0.2.tgz",
-      "integrity": "sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg==",
+    "node_modules/@rolldown/binding-win32-x64-msvc": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.1.tgz",
+      "integrity": "sha512-Z4eCmn5QJ/5+azF9knpLWKfVd9aidn0mAe9TpJgvBLId9Ax3t0+JVxBmT25Bv7NBbVW1TZyKjQjQReouMeH5UQ==",
       "cpu": [
         "x64"
       ],
       "dev": true,
-      "license": "Apache-2.0",
+      "license": "MIT",
       "optional": true,
       "os": [
-        "openbsd"
+        "win32"
       ],
       "engines": {
-        "node": ">=16.20.0"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@typescript/typescript-sunos-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-sunos-x64/-/typescript-sunos-x64-7.0.2.tgz",
-      "integrity": "sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g==",
-      "cpu": [
-        "x64"
-      ],
+    "node_modules/@rolldown/pluginutils": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz",
+      "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
       "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "sunos"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
+      "license": "MIT"
+    },
+    "node_modules/@sveltejs/acorn-typescript": {
+      "version": "1.0.11",
+      "resolved": "https://registry.npmjs.org/@sveltejs/acorn-typescript/-/acorn-typescript-1.0.11.tgz",
+      "integrity": "sha512-LFuZUkjJ9iF7JZye/aG5XM0SFcQ5VyL0oVX4WJ9dc0Va3R3s0OauX1BESVCb+YN/ol8TAfqGDDAQsTG627Y5kw==",
+      "dev": true,
+      "license": "MIT",
+      "peerDependencies": {
+        "acorn": "^8.9.0"
+      }
+    },
+    "node_modules/@sveltejs/load-config": {
+      "version": "0.2.1",
+      "resolved": "https://registry.npmjs.org/@sveltejs/load-config/-/load-config-0.2.1.tgz",
+      "integrity": "sha512-5m3B2cbqQ4TbwW6Xkh66Ntw6dD7gNc77cCxABTTesWcq9jxIzMgTk97pZx5vEtvQx8iokgi7GIphqZe+PGwcZA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 18.0.0"
+      }
+    },
+    "node_modules/@sveltejs/vite-plugin-svelte": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/@sveltejs/vite-plugin-svelte/-/vite-plugin-svelte-7.2.0.tgz",
+      "integrity": "sha512-1SpkuMSRLfugrVX+IrKfE1RUegzo8AQzKQ6qQPfVzbcWi5IhuTPaKb5ZrLpucleFznkc4/RTeSPoRnGWFxX+EQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "deepmerge": "^4.3.1",
+        "magic-string": "^0.30.21",
+        "obug": "^2.1.0",
+        "vitefu": "^1.1.2"
+      },
+      "engines": {
+        "node": "^20.19 || ^22.12 || >=24"
+      },
+      "peerDependencies": {
+        "svelte": "^5.46.4",
+        "vite": "^8.0.0-beta.7 || ^8.0.0"
+      }
+    },
+    "node_modules/@tybys/wasm-util": {
+      "version": "0.10.3",
+      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz",
+      "integrity": "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@types/estree": {
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
+      "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/node": {
+      "version": "26.1.1",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.1.tgz",
+      "integrity": "sha512-nxAkRSVkN1Y0JC1W8ky/fTfkGsMmcrRsbx+3XoZE+rMOX71kLYTV7fLXpqud1GpbpP5TuffXFqfX7fH2GgZREw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~8.3.0"
+      }
+    },
+    "node_modules/@types/trusted-types": {
+      "version": "2.0.7",
+      "resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz",
+      "integrity": "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@typescript/typescript-aix-ppc64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-aix-ppc64/-/typescript-aix-ppc64-7.0.2.tgz",
+      "integrity": "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-darwin-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-arm64/-/typescript-darwin-arm64-7.0.2.tgz",
+      "integrity": "sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-darwin-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-x64/-/typescript-darwin-x64-7.0.2.tgz",
+      "integrity": "sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-freebsd-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-arm64/-/typescript-freebsd-arm64-7.0.2.tgz",
+      "integrity": "sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-freebsd-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-x64/-/typescript-freebsd-x64-7.0.2.tgz",
+      "integrity": "sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-arm": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm/-/typescript-linux-arm-7.0.2.tgz",
+      "integrity": "sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm64/-/typescript-linux-arm64-7.0.2.tgz",
+      "integrity": "sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-loong64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-loong64/-/typescript-linux-loong64-7.0.2.tgz",
+      "integrity": "sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-mips64el": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-mips64el/-/typescript-linux-mips64el-7.0.2.tgz",
+      "integrity": "sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-ppc64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-ppc64/-/typescript-linux-ppc64-7.0.2.tgz",
+      "integrity": "sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-riscv64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-riscv64/-/typescript-linux-riscv64-7.0.2.tgz",
+      "integrity": "sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-s390x": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-s390x/-/typescript-linux-s390x-7.0.2.tgz",
+      "integrity": "sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-x64/-/typescript-linux-x64-7.0.2.tgz",
+      "integrity": "sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-netbsd-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-arm64/-/typescript-netbsd-arm64-7.0.2.tgz",
+      "integrity": "sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-netbsd-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-x64/-/typescript-netbsd-x64-7.0.2.tgz",
+      "integrity": "sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-openbsd-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-arm64/-/typescript-openbsd-arm64-7.0.2.tgz",
+      "integrity": "sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-openbsd-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-x64/-/typescript-openbsd-x64-7.0.2.tgz",
+      "integrity": "sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-sunos-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-sunos-x64/-/typescript-sunos-x64-7.0.2.tgz",
+      "integrity": "sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
     },
     "node_modules/@typescript/typescript-win32-arm64": {
       "version": "7.0.2",
@@ -954,6 +1426,54 @@
         "node": ">=16.20.0"
       }
     },
+    "node_modules/acorn": {
+      "version": "8.18.0",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.18.0.tgz",
+      "integrity": "sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "acorn": "bin/acorn"
+      },
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/ajv": {
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
+      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^3.0.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/ajv-formats": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz",
+      "integrity": "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "ajv": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/ansi-colors": {
       "version": "4.1.3",
       "resolved": "https://registry.npmjs.org/ansi-colors/-/ansi-colors-4.1.3.tgz",
@@ -981,6 +1501,16 @@
       "dev": true,
       "license": "Python-2.0"
     },
+    "node_modules/aria-query": {
+      "version": "5.3.1",
+      "resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.1.tgz",
+      "integrity": "sha512-Z/ZeOgVl7bcSYZ/u/rh0fOpvEpq//LZmdbkXyc7syVzjPAhfOa9ebsdTSjEBDU4vs5nC98Kfduj1uFo0qyET3g==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/array-union": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/array-union/-/array-union-2.1.0.tgz",
@@ -1006,6 +1536,16 @@
         "node": ">=12.0.0"
       }
     },
+    "node_modules/axobject-query": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/axobject-query/-/axobject-query-4.1.0.tgz",
+      "integrity": "sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/better-path-resolve": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/better-path-resolve/-/better-path-resolve-1.0.0.tgz",
@@ -1049,6 +1589,32 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/chokidar": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-4.0.3.tgz",
+      "integrity": "sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "readdirp": "^4.0.1"
+      },
+      "engines": {
+        "node": ">= 14.16.0"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
+    "node_modules/clsx": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/clsx/-/clsx-2.1.1.tgz",
+      "integrity": "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/cross-spawn": {
       "version": "7.0.6",
       "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
@@ -1064,6 +1630,16 @@
         "node": ">= 8"
       }
     },
+    "node_modules/deepmerge": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz",
+      "integrity": "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/detect-indent": {
       "version": "6.1.0",
       "resolved": "https://registry.npmjs.org/detect-indent/-/detect-indent-6.1.0.tgz",
@@ -1074,6 +1650,23 @@
         "node": ">=8"
       }
     },
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/devalue": {
+      "version": "5.9.0",
+      "resolved": "https://registry.npmjs.org/devalue/-/devalue-5.9.0.tgz",
+      "integrity": "sha512-RWrqdArjvPbsATEhOPUo6Wndc/iWnkWKlhIrdlF3zMMYo/c3CVtoaVAyLtWxz5h8nSlkHzxnzV2uLydPXmtF+A==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/dir-glob": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/dir-glob/-/dir-glob-3.0.1.tgz",
@@ -1101,6 +1694,13 @@
         "node": ">=8.6"
       }
     },
+    "node_modules/esm-env": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/esm-env/-/esm-env-1.2.2.tgz",
+      "integrity": "sha512-Epxrv+Nr/CaL4ZcFGPJIYLWFom+YeV1DqMLHJoEd9SYRxNbaFruBwfEX/kkHUJf55j2+TUbmDcmuilbP1TmXHA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/esprima": {
       "version": "4.0.1",
       "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
@@ -1115,6 +1715,24 @@
         "node": ">=4"
       }
     },
+    "node_modules/esrap": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/esrap/-/esrap-2.3.0.tgz",
+      "integrity": "sha512-GQ/7RN8uOtEfNpzZzBMTzW9JBcX42oaSVtPzdF+6cEL8pqIL094iUpr9jzYGn4O4P/1S60dJ6izyT8F4LYARng==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.4.15"
+      },
+      "peerDependencies": {
+        "@typescript-eslint/types": "^8.2.0"
+      },
+      "peerDependenciesMeta": {
+        "@typescript-eslint/types": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/extendable-error": {
       "version": "0.1.7",
       "resolved": "https://registry.npmjs.org/extendable-error/-/extendable-error-0.1.7.tgz",
@@ -1122,6 +1740,13 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/fast-deep-equal": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
+      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/fast-glob": {
       "version": "3.3.3",
       "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.3.tgz",
@@ -1139,6 +1764,23 @@
         "node": ">=8.6.0"
       }
     },
+    "node_modules/fast-uri": {
+      "version": "3.1.4",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz",
+      "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
     "node_modules/fastq": {
       "version": "1.20.1",
       "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.1.tgz",
@@ -1317,6 +1959,16 @@
         "node": ">=0.12.0"
       }
     },
+    "node_modules/is-reference": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/is-reference/-/is-reference-3.0.3.tgz",
+      "integrity": "sha512-ixkJoqQvAP88E6wLydLGGqCJsrFUnqoH6HnaczB8XmDH1oaWU+xxdptvikTgaEhtZ53Ky6YXiBuUI2WXLMCwjw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.6"
+      }
+    },
     "node_modules/is-subdir": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/is-subdir/-/is-subdir-1.2.0.tgz",
@@ -1370,6 +2022,13 @@
         "js-yaml": "bin/js-yaml.js"
       }
     },
+    "node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/jsonfile": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-4.0.0.tgz",
@@ -1380,6 +2039,286 @@
         "graceful-fs": "^4.1.6"
       }
     },
+    "node_modules/lightningcss": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.33.0.tgz",
+      "integrity": "sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA==",
+      "dev": true,
+      "license": "MPL-2.0",
+      "dependencies": {
+        "detect-libc": "^2.0.3"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      },
+      "optionalDependencies": {
+        "lightningcss-android-arm64": "1.33.0",
+        "lightningcss-darwin-arm64": "1.33.0",
+        "lightningcss-darwin-x64": "1.33.0",
+        "lightningcss-freebsd-x64": "1.33.0",
+        "lightningcss-linux-arm-gnueabihf": "1.33.0",
+        "lightningcss-linux-arm64-gnu": "1.33.0",
+        "lightningcss-linux-arm64-musl": "1.33.0",
+        "lightningcss-linux-x64-gnu": "1.33.0",
+        "lightningcss-linux-x64-musl": "1.33.0",
+        "lightningcss-win32-arm64-msvc": "1.33.0",
+        "lightningcss-win32-x64-msvc": "1.33.0"
+      }
+    },
+    "node_modules/lightningcss-android-arm64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.33.0.tgz",
+      "integrity": "sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-darwin-arm64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.33.0.tgz",
+      "integrity": "sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-darwin-x64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.33.0.tgz",
+      "integrity": "sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-freebsd-x64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.33.0.tgz",
+      "integrity": "sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm-gnueabihf": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.33.0.tgz",
+      "integrity": "sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-gnu": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.33.0.tgz",
+      "integrity": "sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-musl": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.33.0.tgz",
+      "integrity": "sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-gnu": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.33.0.tgz",
+      "integrity": "sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-musl": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.33.0.tgz",
+      "integrity": "sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-arm64-msvc": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.33.0.tgz",
+      "integrity": "sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-x64-msvc": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.33.0.tgz",
+      "integrity": "sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/locate-character": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/locate-character/-/locate-character-3.0.0.tgz",
+      "integrity": "sha512-SW13ws7BjaeJ6p7Q6CO2nchbYEc3X3J6WrmTTDto7yMPqVSZTUyY5Tjbid+Ab8gLnATtygYtiDIJGQRRn2ZOiA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/locate-path": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz",
@@ -1400,6 +2339,16 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/magic-string": {
+      "version": "0.30.21",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
+      "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.5"
+      }
+    },
     "node_modules/merge2": {
       "version": "1.4.1",
       "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz",
@@ -1434,6 +2383,39 @@
         "node": ">=4"
       }
     },
+    "node_modules/nanoid": {
+      "version": "3.3.16",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
+      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "bin": {
+        "nanoid": "bin/nanoid.cjs"
+      },
+      "engines": {
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+      }
+    },
+    "node_modules/obug": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.4.tgz",
+      "integrity": "sha512-4a+OsYv9UktOJKE+l1A4OufDgdRF9PifWj+tJnHURo/P+WOxpG4GzUFL9qCalmWauao6ogiG+QvnCovwPoyAWA==",
+      "dev": true,
+      "funding": [
+        "https://github.com/sponsors/sxzz",
+        "https://opencollective.com/debug"
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
     "node_modules/outdent": {
       "version": "0.5.0",
       "resolved": "https://registry.npmjs.org/outdent/-/outdent-0.5.0.tgz",
@@ -1619,7 +2601,36 @@
         "playwright-core": "cli.js"
       },
       "engines": {
-        "node": ">=18"
+        "node": ">=18"
+      }
+    },
+    "node_modules/postcss": {
+      "version": "8.5.25",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.25.tgz",
+      "integrity": "sha512-DTPx3RWSSnWyzLxQnlH0rJP+EW5ekl16ZU4/psbIhA0e53kJfdgaN5vKM+xP7yJtXVu+nfdVFmlgFDEKAe4Pyw==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/postcss"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "nanoid": "^3.3.16",
+        "picocolors": "^1.1.1",
+        "source-map-js": "^1.2.1"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14"
       }
     },
     "node_modules/prettier": {
@@ -1736,6 +2747,20 @@
         "js-yaml": "bin/js-yaml.js"
       }
     },
+    "node_modules/readdirp": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-4.1.2.tgz",
+      "integrity": "sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14.18.0"
+      },
+      "funding": {
+        "type": "individual",
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
     "node_modules/reflect-metadata": {
       "version": "0.2.2",
       "resolved": "https://registry.npmjs.org/reflect-metadata/-/reflect-metadata-0.2.2.tgz",
@@ -1743,6 +2768,16 @@
       "dev": true,
       "license": "Apache-2.0"
     },
+    "node_modules/require-from-string": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
+      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/resolve-from": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-5.0.0.tgz",
@@ -1764,6 +2799,40 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/rolldown": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.1.tgz",
+      "integrity": "sha512-4FKJhg8d3OiyQOA6Q1Q0hoFFpW9/OoX+VsHzpECsdsIZoOArrAK90gl59YK/Z+gnDel45bgJZK03ozH/9bCqEw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@oxc-project/types": "=0.142.0",
+        "@rolldown/pluginutils": "^1.0.0"
+      },
+      "bin": {
+        "rolldown": "bin/cli.mjs"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "optionalDependencies": {
+        "@rolldown/binding-android-arm64": "1.2.1",
+        "@rolldown/binding-darwin-arm64": "1.2.1",
+        "@rolldown/binding-darwin-x64": "1.2.1",
+        "@rolldown/binding-freebsd-x64": "1.2.1",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.2.1",
+        "@rolldown/binding-linux-arm64-gnu": "1.2.1",
+        "@rolldown/binding-linux-arm64-musl": "1.2.1",
+        "@rolldown/binding-linux-ppc64-gnu": "1.2.1",
+        "@rolldown/binding-linux-s390x-gnu": "1.2.1",
+        "@rolldown/binding-linux-x64-gnu": "1.2.1",
+        "@rolldown/binding-linux-x64-musl": "1.2.1",
+        "@rolldown/binding-openharmony-arm64": "1.2.1",
+        "@rolldown/binding-wasm32-wasi": "1.2.1",
+        "@rolldown/binding-win32-arm64-msvc": "1.2.1",
+        "@rolldown/binding-win32-x64-msvc": "1.2.1"
+      }
+    },
     "node_modules/run-parallel": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz",
@@ -1788,6 +2857,19 @@
         "queue-microtask": "^1.2.2"
       }
     },
+    "node_modules/sade": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/sade/-/sade-1.8.1.tgz",
+      "integrity": "sha512-xal3CZX1Xlo/k4ApwCFrHVACi9fBqJ7V+mwhBsuf/1IOKbBy098Fex+Wa/5QMubw09pSZ/u8EY8PWgevJsXp1A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "mri": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/safer-buffer": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
@@ -1868,6 +2950,16 @@
         "node": ">=8"
       }
     },
+    "node_modules/source-map-js": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
+      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/spawndamnit": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/spawndamnit/-/spawndamnit-3.0.1.tgz",
@@ -1909,6 +3001,34 @@
         "node": ">=4"
       }
     },
+    "node_modules/svelte": {
+      "version": "5.56.8",
+      "resolved": "https://registry.npmjs.org/svelte/-/svelte-5.56.8.tgz",
+      "integrity": "sha512-PY8LOw7xP6c8IOiVqdo0sbbZVYhXRSfklOQLAUyGBKqjTX0wx/z4l/9J+PmBpmlLnxzEb1NqltxQ5/wZme/Cmg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/remapping": "^2.3.4",
+        "@jridgewell/sourcemap-codec": "^1.5.0",
+        "@sveltejs/acorn-typescript": "^1.0.10",
+        "@types/estree": "^1.0.5",
+        "@types/trusted-types": "^2.0.7",
+        "acorn": "^8.12.1",
+        "aria-query": "5.3.1",
+        "axobject-query": "^4.1.0",
+        "clsx": "^2.1.1",
+        "devalue": "^5.8.1",
+        "esm-env": "^1.2.1",
+        "esrap": "^2.2.12",
+        "is-reference": "^3.0.3",
+        "locate-character": "^3.0.0",
+        "magic-string": "^0.30.11",
+        "zimmerframe": "^1.1.2"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/term-size": {
       "version": "2.2.1",
       "resolved": "https://registry.npmjs.org/term-size/-/term-size-2.2.1.tgz",
@@ -1922,118 +3042,70 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/to-regex-range": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
-      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
+    "node_modules/tinyglobby": {
+      "version": "0.2.17",
+      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
+      "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "is-number": "^7.0.0"
+        "fdir": "^6.5.0",
+        "picomatch": "^4.0.4"
       },
       "engines": {
-        "node": ">=8.0"
-      }
-    },
-    "node_modules/tokenless": {
-      "resolved": "packages/cli",
-      "link": true
-    },
-    "node_modules/tokenless-native-darwin-arm64": {
-      "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/tokenless-native-darwin-arm64/-/tokenless-native-darwin-arm64-0.3.0.tgz",
-      "integrity": "sha512-AVMugii5/mN+KvJzZtAdiIFSP7TCdroXPyDtZhYFN9L0rCtuPbPgowFuxvqLHAKloMKFPcD8nZ55Sk/B2xwBaw==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=22"
-      }
-    },
-    "node_modules/tokenless-native-darwin-x64": {
-      "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/tokenless-native-darwin-x64/-/tokenless-native-darwin-x64-0.3.0.tgz",
-      "integrity": "sha512-ap64ZpZcf1c9XE3j5c2Lx0cxI6x3ISgrK2j2cwmeu0aeL/CvRuo3Q60MMkb+4jYxXBFd/+5GfxETcOSqFNYF0A==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=22"
+        "node": ">=12.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/SuperchupuDev"
       }
     },
-    "node_modules/tokenless-native-linux-arm64": {
-      "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/tokenless-native-linux-arm64/-/tokenless-native-linux-arm64-0.3.0.tgz",
-      "integrity": "sha512-P8JmJsy68TmFKpqLIEtmQtjnxpuxn+4FF2pa7q/d+MTYuX/yd8THD0sFt5cTSGd7SiFfdopp996N+aL4PXdG/w==",
-      "cpu": [
-        "arm64"
-      ],
+    "node_modules/tinyglobby/node_modules/fdir": {
+      "version": "6.5.0",
+      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
+      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
+      "dev": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
       "engines": {
-        "node": ">=22"
+        "node": ">=12.0.0"
+      },
+      "peerDependencies": {
+        "picomatch": "^3 || ^4"
+      },
+      "peerDependenciesMeta": {
+        "picomatch": {
+          "optional": true
+        }
       }
     },
-    "node_modules/tokenless-native-linux-x64": {
-      "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/tokenless-native-linux-x64/-/tokenless-native-linux-x64-0.3.0.tgz",
-      "integrity": "sha512-k3caCUwKHVumFru28wzG+J5Q2TCFLcKKZs80ZnoZQq6y+cnMli3m28joaCugVMqEvgJ3yv4QjmPJoDKqlNNcbA==",
-      "cpu": [
-        "x64"
-      ],
+    "node_modules/tinyglobby/node_modules/picomatch": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
+      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
+      "dev": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
       "engines": {
-        "node": ">=22"
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
-    "node_modules/tokenless-native-win32-arm64": {
-      "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/tokenless-native-win32-arm64/-/tokenless-native-win32-arm64-0.3.0.tgz",
-      "integrity": "sha512-M+eu/hqqKnriXdpcXnmWnBz8wnBHaCXKxnocE6cBLXAVmm7WNjDPmizqnwPbAXIWVLboBze6WFN/ybGgO/EoCQ==",
-      "cpu": [
-        "arm64"
-      ],
+    "node_modules/to-regex-range": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
+      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
+      "dev": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
+      "dependencies": {
+        "is-number": "^7.0.0"
+      },
       "engines": {
-        "node": ">=22"
+        "node": ">=8.0"
       }
     },
-    "node_modules/tokenless-native-win32-x64": {
-      "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/tokenless-native-win32-x64/-/tokenless-native-win32-x64-0.3.0.tgz",
-      "integrity": "sha512-f0efCbQaBPml7O2MCktHgOAzDhE+3ubCBwg9d+v76ztBNxy7ceCMKi5Eq9sQYt6eMirIVV4VlXDSuIDhTNAzdQ==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=22"
-      }
+    "node_modules/tokenless": {
+      "resolved": "packages/cli",
+      "link": true
     },
     "node_modules/tslib": {
       "version": "2.8.1",
@@ -2114,6 +3186,132 @@
         "node": ">= 4.0.0"
       }
     },
+    "node_modules/vite": {
+      "version": "8.2.0",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.2.0.tgz",
+      "integrity": "sha512-pn+CFpM0lwDeKwmOq1ZaBK/9sjorZcgqxki6MbY/jPEVd9vichIlmlD4HmQ5wdP5EgqQCFRaACBxMC7uEGc6lQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "lightningcss": "^1.33.0",
+        "picomatch": "^4.0.5",
+        "postcss": "^8.5.23",
+        "rolldown": "~1.2.0",
+        "tinyglobby": "^0.2.17"
+      },
+      "bin": {
+        "vite": "bin/vite.js"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "funding": {
+        "url": "https://github.com/vitejs/vite?sponsor=1"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      },
+      "peerDependencies": {
+        "@types/node": "^20.19.0 || >=22.12.0",
+        "@vitejs/devtools": "^0.4.0",
+        "esbuild": "^0.27.0 || ^0.28.0",
+        "jiti": ">=1.21.0",
+        "less": "^4.0.0",
+        "sass": "^1.70.0",
+        "sass-embedded": "^1.70.0",
+        "stylus": ">=0.54.8",
+        "sugarss": "^5.0.0",
+        "terser": "^5.16.0",
+        "tsx": "^4.8.1",
+        "yaml": "^2.4.2"
+      },
+      "peerDependenciesMeta": {
+        "@types/node": {
+          "optional": true
+        },
+        "@vitejs/devtools": {
+          "optional": true
+        },
+        "esbuild": {
+          "optional": true
+        },
+        "jiti": {
+          "optional": true
+        },
+        "less": {
+          "optional": true
+        },
+        "sass": {
+          "optional": true
+        },
+        "sass-embedded": {
+          "optional": true
+        },
+        "stylus": {
+          "optional": true
+        },
+        "sugarss": {
+          "optional": true
+        },
+        "terser": {
+          "optional": true
+        },
+        "tsx": {
+          "optional": true
+        },
+        "yaml": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vite/node_modules/fsevents": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/vite/node_modules/picomatch": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
+      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/vitefu": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/vitefu/-/vitefu-1.1.3.tgz",
+      "integrity": "sha512-ub4okH7Z5KLjb6hDyjqrGXqWtWvoYdU3IGm/NorpgHncKoLTCfRIbvlhBm7r0YstIaQRYlp4yEbFqDcKSzXSSg==",
+      "dev": true,
+      "license": "MIT",
+      "workspaces": [
+        "tests/deps/*",
+        "tests/projects/*",
+        "tests/projects/workspace/packages/*"
+      ],
+      "peerDependencies": {
+        "vite": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "vite": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/which": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
@@ -2130,26 +3328,90 @@
         "node": ">= 8"
       }
     },
+    "node_modules/zimmerframe": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/zimmerframe/-/zimmerframe-1.1.4.tgz",
+      "integrity": "sha512-B58NGBEoc8Y9MWWCQGl/gq9xBCe4IiKM0a2x7GZdQKOW5Exr8S1W24J6OgM1njK8xCRGvAJIL/MxXHf6SkmQKQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "packages/cli": {
       "name": "tokenless",
       "version": "0.3.0",
       "license": "MIT",
       "dependencies": {
-        "playwright-core": "^1.53.0"
+        "playwright-core": "1.61.1"
       },
       "bin": {
         "tokenless": "dist/src/tokenless.mjs"
       },
+      "devDependencies": {
+        "@lucide/svelte": "1.28.0",
+        "@sveltejs/vite-plugin-svelte": "7.2.0",
+        "svelte": "5.56.8",
+        "svelte-check": "4.7.4",
+        "vite": "8.2.0"
+      },
       "engines": {
         "node": ">=22.13.0"
+      }
+    },
+    "packages/cli/node_modules/fdir": {
+      "version": "6.5.0",
+      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
+      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.0.0"
       },
-      "optionalDependencies": {
-        "tokenless-native-darwin-arm64": "0.3.0",
-        "tokenless-native-darwin-x64": "0.3.0",
-        "tokenless-native-linux-arm64": "0.3.0",
-        "tokenless-native-linux-x64": "0.3.0",
-        "tokenless-native-win32-arm64": "0.3.0",
-        "tokenless-native-win32-x64": "0.3.0"
+      "peerDependencies": {
+        "picomatch": "^3 || ^4"
+      },
+      "peerDependenciesMeta": {
+        "picomatch": {
+          "optional": true
+        }
+      }
+    },
+    "packages/cli/node_modules/svelte-check": {
+      "version": "4.7.4",
+      "resolved": "https://registry.npmjs.org/svelte-check/-/svelte-check-4.7.4.tgz",
+      "integrity": "sha512-IW9ot9YqAoyv8FvyN+eb4ZTe8zgcKZrJLNYU6dzSKkGwEBsSPc4K7lmQ8bKn8W2YMXM6WDfZSSVOaGtekyUfOQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/trace-mapping": "^0.3.25",
+        "@sveltejs/load-config": "^0.2.1",
+        "chokidar": "^4.0.1",
+        "fdir": "^6.2.0",
+        "picocolors": "^1.0.0",
+        "sade": "^1.7.4"
+      },
+      "bin": {
+        "svelte-check": "bin/svelte-check"
+      },
+      "engines": {
+        "node": ">= 18.0.0"
+      },
+      "peerDependencies": {
+        "svelte": "^4.0.0 || ^5.0.0-next.0",
+        "typescript": "^5.0.0 || ^6.0.0"
+      }
+    },
+    "packages/cli/node_modules/typescript": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz",
+      "integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "peer": true,
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
       }
     }
   }
diff --git a/package.json b/package.json
index 87d61e5..55dfafd 100644
--- a/package.json
+++ b/package.json
@@ -9,13 +9,27 @@
     "build": "npm run build --workspaces --if-present && npm run build:scripts",
     "build:scripts": "node -e \"require('node:fs').rmSync('dist/scripts',{recursive:true,force:true})\" && tsc -p tsconfig.scripts.json",
     "changeset": "changeset",
-    "lint": "npm run lint --workspaces --if-present && tsc -p tsconfig.scripts.json --noEmit",
+    "lint": "npm run api:check && npm run lint --workspaces --if-present && tsc -p tsconfig.scripts.json --noEmit",
+    "api:check": "node scripts/check-api-contract.mjs",
     "release:version": "node scripts/release/version.mjs",
+    "prototype:cloakbrowser": "node scripts/prototypes/cloakbrowser-spike.mjs",
     "sync:skill": "npm run build:scripts && node dist/scripts/sync-tokenless-skill.mjs",
     "test": "npm run build && node dist/scripts/test-all.mjs",
-    "test:e2e": "npm run build && TOKENLESS_E2E=1 node --test test/**/*.e2e.mjs",
-    "test:e2e:live-managed-playwright-m1": "npm run build && node --test --test-concurrency=1 test/live-managed-playwright-prompt-actions.e2e.mjs",
-    "test:e2e:live-managed-playwright": "npm run build && node --test --test-concurrency=1 test/live-managed-playwright.e2e.mjs"
+    "test:ts-daemon-conformance": "npm run build && node --test --test-concurrency=1 test/ts-daemon-conformance.test.mjs",
+    "test:e2e:web": "npm run build && node --test --test-concurrency=1 test/local-web-ui.e2e.mjs",
+    "test:e2e:web-provider": "npm run build && node test/run-gated-e2e.mjs web-ui-provider",
+    "test:e2e": "npm run build && node test/run-live-provider-e2e.mjs run --gate all",
+    "test:e2e:prepare": "npm run build && node test/run-live-provider-e2e.mjs prepare",
+    "test:e2e:browser-runtime": "npm run build && node test/run-gated-e2e.mjs browser-runtime",
+    "test:e2e:browser-surfaces": "npm run build && node test/run-live-browser-surface-matrix.mjs",
+    "test:e2e:system-surfaces": "npm run build && node test/run-live-browser-surface-matrix.mjs --selection auto",
+    "test:e2e:managed-surfaces": "npm run build && node test/run-live-browser-surface-matrix.mjs --selection managed-chromium",
+    "test:e2e:cloak-surfaces": "npm run build && node test/run-live-browser-surface-matrix.mjs --selection cloak",
+    "test:e2e:connection-matrix": "npm run build && node test/run-live-provider-e2e.mjs connection-matrix --gate all",
+    "test:e2e:non-submission": "node test/run-live-provider-e2e.mjs run --gate non_submission",
+    "test:e2e:mutation": "node test/run-live-provider-e2e.mjs run --gate mutation",
+    "test:e2e:project": "node test/run-live-provider-e2e.mjs run --gate project",
+    "test:e2e:fallback": "node test/run-gated-e2e.mjs provider-fallback"
   },
   "workspaces": [
     "packages/*"
@@ -26,8 +40,10 @@
   "packageManager": "npm@10",
   "devDependencies": {
     "@changesets/cli": "^2.31.0",
-    "@playwright/test": "^1.53.0",
+    "@playwright/test": "1.61.1",
     "@types/node": "^26.1.1",
+    "ajv": "^8.20.0",
+    "ajv-formats": "^3.0.1",
     "selfsigned": "^5.5.0",
     "typescript": "^7.0.2"
   }
diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
index ae8a137..89f0703 100644
--- a/packages/cli/CHANGELOG.md
+++ b/packages/cli/CHANGELOG.md
@@ -10,9 +10,9 @@
 
 - 6d52df5: Ship the current Tokenless reliability release as one patch:
 
-  - Archive the browser extension and Native Messaging host under `legacy/`, leaving the managed Playwright daemon as the active runtime.
+  - Retire the browser extension and Native Messaging host, leaving the managed Playwright daemon as the active runtime.
   - Remove the experimental direct runtime, direct broker, account/project routing commands, direct public exports, and direct-only documentation so managed Playwright through the authenticated local daemon is the only execution path.
-  - Provision and verify the local Rust daemon before provider sign-in, restart only process-correlated stale daemons, and keep doctor diagnostics read-only.
+  - Provision and verify the local daemon before provider sign-in, restart only process-correlated stale daemons, and keep doctor diagnostics read-only.
   - Add prompt-free `tokenless upgrade` with concise human progress and structured `--json` output to update the global CLI, refresh Tokenless agent skills, reconcile the packaged daemon through the verified new CLI, and report its final doctor result.
   - Keep animated setup progress stable on one terminal line, including in narrow and hosted terminals.
   - Make setup check every supported visible provider, preserve ChatGPT as the default run provider, reject obsolete setup-only provider filters, and document the supported browser-profile import scope.
diff --git a/packages/cli/README.md b/packages/cli/README.md
index 0878693..596bf6c 100644
--- a/packages/cli/README.md
+++ b/packages/cli/README.md
@@ -1,134 +1,143 @@
 # Tokenless CLI
 
-`tokenless` gives agents provider-neutral CLI access to visible ChatGPT, Claude, Gemini, and Grok sessions. A local daemon, Playwright worker, and persistent managed browser profiles handle execution. A public local API is planned but is not a compatibility surface yet.
+`tokenless` gives agents local CLI access to visible AI websites through managed Playwright browser profiles. Provider credentials and browser state stay on the user's machine.
+
+[Commands](https://github.com/jazelly/tokenless/blob/main/COMMANDS.md) · [Capability Matrix](https://github.com/jazelly/tokenless/blob/main/docs/capability-matrix.md) · [Capability Matrix 中文](https://github.com/jazelly/tokenless/blob/main/docs/capability-matrix.zh-CN.md) · [中文命令参考](https://github.com/jazelly/tokenless/blob/main/COMMANDS.zh-CN.md) · [Privacy](https://github.com/jazelly/tokenless/blob/main/PRIVACY.md)
 
 ## Install
 
-Requires Node.js 22.13+ and a supported Chromium browser such as Google Chrome or Brave.
+Requires Node.js 22.13+. The first browser-runtime targets are Apple Silicon macOS and x64 Windows. Windows remains prerelease until its real-hardware gates pass.
 
 ```bash
 npm install --global tokenless@latest
+tokenless setup
+tokenless doctor --json
 ```
 
-Setup installs and verifies both required agent skills.
-
-## Start
+`setup` first resolves an exact browser runtime, creates or selects a runtime-bound managed profile, then installs the required agent skills, prepares the local daemon, checks every enabled provider once, and leaves one headed provider review tab open for each enabled provider. Normal mode uses an explicit browser, then the saved preference, then automatic discovery; `auto` prefers an installed system browser and lazily downloads Tokenless-managed Chrome for Testing 145 only when none exists. Interactive setup asks whether to use Anti-Detect mode and states that accepting will install the verified platform-pinned CloakBrowser under `TOKENLESS_HOME` when needed. Declining does not open a separate runtime picker. Before download, the Cloak flow links to the official project, shows the platform pin, scans only safe directory/version metadata for known local Chromium profiles, and classifies exact version alignment. If compatible profiles exist, one source choice offers `Start clean` and those profiles; selecting a profile explicitly authorizes its opaque local copy without a separate import, copy-consent, or installation confirmation. For non-interactive setup, explicit `--anti-detect` or `--browser cloak` authorizes installation; a stored Cloak preference alone fails before download, and import still requires `--consent-local-profile-copy`. Tokenless downloads Cloak from its official release and does not redistribute it. On first setup it also detects `en` or `zh-CN` from the system locale; use `tokenless config --language <en|zh-CN>` to override the saved preference.
 
-### Use an existing browser profile (recommended)
+For a clean non-interactive profile:
 
 ```bash
-tokenless setup
+tokenless setup --fresh --json
 ```
 
-The interactive flow chooses a browser and providers, discovers existing Chrome or Brave profiles, asks for explicit copy consent, creates a separate managed profile, starts the local runtime, and checks provider sign-in.
+Fresh setup creates or reuses a profile only when its runtime binding is compatible, resolves the selected browser, and uses the persisted `providerWhitelist`. Its default contains every provider whose registry stage is not `disabled` except Gemini; add Gemini explicitly with `--provider-whitelist` or through the dashboard. A runtime-family change creates a clean profile instead of opening existing data with another browser. The default includes experimental Qwen, DeepSeek, Perplexity, Z.ai, and Doubao. Setup reports sign-in state without opening a sign-in handoff.
 
-### Start clean
+## Run
 
 ```bash
-tokenless setup --fresh
+tokenless run \
+  --profile default \
+  --provider chatgpt \
+  --prompt "Review this proposal." \
+  --json
 ```
 
-This non-interactive path creates a clean managed `default` profile on a new installation or reuses the registered default, selects the first supported browser and ChatGPT when needed, starts the runtime, and opens the provider when user action is required. It does not import a local browser profile.
+If no provider is explicit, Tokenless uses the first configured provider with a cached guest or signed-in observation. If none is usable, it fails before creating a job and reports how to refresh access.
 
-Verify either path:
+List canonical task outcomes and their evidence-backed provider routes:
 
 ```bash
-tokenless doctor --json
+tokenless capabilities list --json
 ```
 
-Without a global install:
+The public [Capability Matrix](https://github.com/jazelly/tokenless/blob/main/docs/capability-matrix.md) explains the outcome vocabulary, current provider mappings, evidence ladder, and extension process.
+
+`--capability` is repeatable. Tokenless also infers `conversation.chat` for a normal run, `file.upload` plus the media-specific input capability from attachments, and `workspace.native` from native Workspace intent. One provider must satisfy the entire merged requirement set:
 
 ```bash
-npx tokenless@latest setup
+tokenless run \
+  --capability file.upload \
+  --attach-file proposal.pdf \
+  --prompt "Review the attached proposal." \
+  --json
 ```
 
-System-wide installer:
+The catalog also contains future candidate outcomes so agents can inspect a stable vocabulary. A candidate is not routeable until its provider strategy and complete real-provider lifecycle are implemented and E2E-closed.
+
+Implicit normal runs persist compatible provider alternatives. Before prompt submission, a provider-scoped auth, CAPTCHA, capacity, or plan blocker can atomically requeue the same durable job on the next provider whose real-E2E-closed route satisfies the run's complete requirements. Explicit providers, exact continuation, provider-specific controls, completed non-reconstructable mutations, and ambiguous submissions fail closed instead. Inspect `providerAttempts` and `fallback` through JSON state output.
+
+## Providers
+
+| Provider | Stage | Signed-out use |
+| --- | --- | --- |
+| ChatGPT | Supported | Guest supported |
+| Claude | Supported | Sign-in required |
+| Gemini | Supported | Guest supported |
+| Grok | Supported | Sign-in required |
+| Qwen / 千问 | Experimental | Guest supported |
+| DeepSeek | Experimental | Sign-in required |
+| Perplexity | Experimental | Guest supported |
+| Z.ai / GLM | Experimental | Guest supported |
+| Doubao / 豆包 | Experimental | Sign-in required |
+
+Prompt submission and response reading are the shared baseline. Files, citations, model or effort controls, conversation continuation, and Workspaces depend on the visible provider, profile, and account state. Doubao text-file selection is experimentally routeable; its advanced modes and Web skills are exposed as provider controls without advertising their still-unclosed outcome lifecycles.
+
+Inspect the current runtime capability state:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/jazelly/tokenless/main/deploy/install.sh | sudo bash
+tokenless provider-action \
+  --profile default \
+  --provider chatgpt \
+  --action capability.inspect \
+  --json
 ```
 
-Because this executes with `sudo`, [review the installer source](https://github.com/jazelly/tokenless/blob/main/deploy/install.sh) first. Run setup afterward as the normal desktop user so the managed profile has the correct ownership.
+Unsupported, ambiguous, or unproven behavior fails closed.
 
-## Managed Playwright Automation
+## Qwen Modes
 
-`tokenless run` always submits a managed Playwright job through the authenticated local daemon.
+Qwen exposes provider-specific modes through `qwen.mode.inspect` and `qwen.mode.select`:
 
 ```bash
 tokenless run \
-  --profile default \
-  --provider chatgpt \
-  --project-name "Website redesign" \
-  --chat-name "Navbar review" \
-  --project-root /path/to/project \
-  --attach-file ./brief.pdf \
-  --prompt "Review the navigation against this brief." \
+  --provider qwen \
+  --qwen-mode "Deep Research" \
+  --qwen-mode-variant "Advanced" \
+  --prompt "Proceed with a standalone report on this topic; use official sources." \
   --json
 ```
 
-The shared Playwright action contract covers:
+The experimental capability proves exact mode selection and the first correlated visible response. It does not yet claim Qwen's complete multi-turn final-report lifecycle. Auto, Thinking, and Fast remain effort choices selected with `--effort`.
 
-- visible authentication and blocker checks;
-- exact-label model and effort inspection and selection;
-- integrity-checked file upload through the visible page control;
-- prompt submission, correlated response reading, and visible citations;
-- fail-closed navigation checks and sanitized structural snapshots.
+## Doubao Modes and Skills
 
-Four-provider parity and end-to-end upload acceptance are still being completed. Unsupported or unverified actions fail explicitly.
+Doubao exposes exact provider controls through `doubao.mode.inspect/select` and `doubao.skill.inspect/select`. Stable English action payloads select the Chinese visible UI labels, and every selection requires a visible selected-state postcondition. Work Task Pro reports `upgrade_required`; Audio Transcription reports `desktop_app_required` because the Web entry offers a desktop-app download instead of a Web workflow. Translation is intentionally outside the coding-oriented skill inventory. Canonical mappings remain candidates until their complete generation, research, reasoning, transcription, or task lifecycle passes a separate real-provider gate.
 
-## Browser Visibility Policy
+## Workspaces
 
-Tokenless stores browser visibility in config and defaults omitted values to `auto`.
+`--project-name` is task metadata unless `--workspace-mode` is present.
 
-```bash
-tokenless config --browser-visibility auto --json
-tokenless run --browser-visibility headed --json
-tokenless run --browser-visibility headless --json
-```
+- `auto` prefers a proven native Project and falls back only after stable visible evidence that native Projects are unavailable.
+- `native` requires exact native creation or reuse.
+- `conversation` requires the conversation strategy.
 
-- Use `tokenless config --browser-visibility ...` to set the persistent default. Pass the same flag to `tokenless run` only when a single job needs an explicit visibility intent.
-- `auto` starts headless and escalates to headed only for user-resolvable blockers such as sign-in, CAPTCHA, MFA, consent, or confirmation. Terminal errors do not open a visible window.
-- `headless` never opens a visible window. If the job parks waiting for user action, resume the same daemon job with `tokenless resume --job-id <job-id> --browser-visibility headed --json`; do not resubmit, replace, or change the job/task identity.
-- `profiles open` is always headed. `doctor` is read-only. Chromium sandbox stays enabled in both modes.
-- Auto-escalated windows close after 30 seconds of idle time after the job completes. Explicit headed and `profiles open` windows remain open.
+Native Project behavior is implemented experimentally for the explicit Claude and Grok real-provider gate, but `workspace.native` is not advertised as a router route until that complete gate passes. All Workspace behavior remains capability-gated.
 
 ## Managed Profiles
 
-A profile is one persistent local browser identity. One profile can hold sessions for all supported providers; use separate profiles for multiple accounts of the same provider.
+One managed profile can hold sessions for all enabled providers. Use separate profiles for multiple accounts of the same provider.
+
+The managed runtime keeps different providers and stable task identities in separate tabs. Re-entering the same project or conversation task returns to its tab; a job can overwrite an existing tab only by explicitly setting `pagePolicy` to `replace` through the local job API.
 
 ```bash
-tokenless profiles discover --browser chrome --json
-tokenless profiles discover --browser brave --json
-tokenless profiles add --profile work --label "Work" --set-default
-tokenless profiles list
+tokenless profiles list --json
+tokenless profiles open --profile work
 tokenless profiles open --profile work --provider claude
-tokenless profiles status --profile work --provider claude
-tokenless profiles set-default --profile work
-tokenless profiles reset --profile work
-tokenless profiles clear --profile work
+tokenless profiles status --profile work --provider claude --json
 ```
 
-`profiles discover` is read-only. Import with `profiles add --browser <chrome|brave> --import-browser-profile <directory-key> --preferred-providers <list> --consent-local-profile-copy` only after explicit user choice. Imported provider sign-in state remains local and opaque to agents. Jobs reuse registered profiles without refreshing them from the source.
-
-## Local API
+New profiles are bound to the exact runtime that created them. They start clean unless the user explicitly selects a version-compatible local Chromium profile for opaque filesystem copy. Tokenless does not inspect or expose individual cookies, tokens, browser storage, or authentication values. The managed browser then keeps that profile's session across jobs.
 
-The planned local API will expose the same daemon jobs and provider-neutral action contract as the CLI. Authentication, request schemas, and compatibility guarantees are under active development; the daemon's HTTP endpoints remain an internal control plane.
+## Browser and Local Runtime
 
-## Browser Boundary
+Browser visibility defaults to `auto`: jobs start headless and open a visible window only for user-resolvable blockers. Use `headed` or `headless` for an explicit policy. A waiting headless job must be resumed, not resubmitted:
 
-- Playwright uses a visible, persistent, non-default user-data directory.
-- Web automation operates through visible provider pages and visible postconditions.
-- Authentication state stays opaque inside the selected managed profile.
-- CAPTCHA, sign-in, rate limits, upgrade prompts, and confirmations remain under user control.
-- Selected regular files are staged privately and sent through Playwright file inputs; raw caller paths do not enter daemon job JSON.
-- Every request follows the authenticated local daemon and managed Playwright path.
-
-## Roadmap
+```bash
+tokenless resume --job-id <job-id> --browser-visibility headed --json
+```
 
-- Complete Playwright parity for ChatGPT, Claude, Gemini, and Grok.
-- Finish seamless files, model controls, citations, and long-running work.
-- Add provider workspaces, files, plugins, connectors, and tools when they are available through visible pages.
-- Add image and broader multimodal workflows.
-- Stabilize the local API as a public compatibility surface.
+Every request uses the authenticated loopback daemon and a persistent non-default browser profile. Credentials remain opaque to agents. Sign-in, CAPTCHA, consent, payment, plan, and confirmation steps remain under user control.
 
-See [Architecture](../../docs/architecture.md) for the managed runtime design.
+See the [command reference](https://github.com/jazelly/tokenless/blob/main/COMMANDS.md) for all commands and options, and [Architecture](https://github.com/jazelly/tokenless/blob/main/docs/architecture.md) for runtime details.
diff --git a/packages/cli/catalog/provider-rate-limits.v1.json b/packages/cli/catalog/provider-rate-limits.v1.json
new file mode 100644
index 0000000..a673c6e
--- /dev/null
+++ b/packages/cli/catalog/provider-rate-limits.v1.json
@@ -0,0 +1,1975 @@
+{
+  "schema": "tokenless.provider-rate-limit-catalog.v1",
+  "catalogVersion": 1,
+  "revision": "2026-08-02",
+  "reviewedAt": "2026-08-02",
+  "reviewAfter": "2026-09-02",
+  "scope": {
+    "productSurface": "consumer_web",
+    "capacityScope": "provider_profile",
+    "excludes": [
+      "provider_api_rate_limits",
+      "provider_account_correlation_across_profiles",
+      "storage_and_context_window_limits_unless_they_affect_rate_limit_interpretation"
+    ]
+  },
+  "factPolicy": {
+    "unknownValues": "preserve_unknown",
+    "numericValues": "require_official_exact_evidence",
+    "relativeValues": "require_named_reference_allowance",
+    "runtimeUse": "best_effort_only"
+  },
+  "runtimePolicy": {
+    "exactAllowanceHeadroomRatio": 0.9,
+    "headroomMinimumAllowance": 20,
+    "burstRatio": 0.05,
+    "minimumBurstUnits": 2,
+    "maximumBurstUnits": 8,
+    "providerDefaults": {
+      "chatgpt": {
+        "modelFamily": "gpt-5.5-instant",
+        "promptAction": "prompt.submit"
+      },
+      "claude": {
+        "modelFamily": "*",
+        "promptAction": "interactive.usage"
+      },
+      "gemini": {
+        "modelFamily": "*",
+        "promptAction": "interactive.usage"
+      },
+      "grok": {
+        "modelFamily": "*",
+        "promptAction": "interactive.usage"
+      },
+      "qwen": {
+        "modelFamily": "*",
+        "promptAction": "interactive.usage"
+      },
+      "deepseek": {
+        "modelFamily": "*",
+        "promptAction": "interactive.usage"
+      },
+      "perplexity": {
+        "modelFamily": "*",
+        "promptAction": "interactive.usage"
+      },
+      "zai": {
+        "modelFamily": "*",
+        "promptAction": "interactive.usage"
+      },
+      "doubao": {
+        "modelFamily": "*",
+        "promptAction": "interactive.usage"
+      }
+    }
+  },
+  "sources": {
+    "openai-gpt55-chatgpt": {
+      "publisher": "OpenAI",
+      "title": "GPT-5.5 in ChatGPT",
+      "url": "https://help.openai.com/en/articles/11909943-gpt-5-3-and-gpt-55-in-chatgpt",
+      "authority": "official",
+      "retrievedAt": "2026-07-31"
+    },
+    "openai-file-uploads": {
+      "publisher": "OpenAI",
+      "title": "File Uploads FAQ",
+      "url": "https://help.openai.com/en/articles/8555545-file-uploads-faq",
+      "authority": "official",
+      "retrievedAt": "2026-07-31"
+    },
+    "openai-free-tier": {
+      "publisher": "OpenAI",
+      "title": "ChatGPT Free Tier FAQ",
+      "url": "https://help.openai.com/en/articles/9275245",
+      "authority": "official",
+      "retrievedAt": "2026-07-31"
+    },
+    "anthropic-free": {
+      "publisher": "Anthropic",
+      "title": "Get started with Claude",
+      "url": "https://support.claude.com/en/articles/8114491-get-started-with-claude",
+      "authority": "official",
+      "retrievedAt": "2026-07-31"
+    },
+    "anthropic-pro": {
+      "publisher": "Anthropic",
+      "title": "What is the Pro plan?",
+      "url": "https://support.claude.com/en/articles/8325606-what-is-the-pro-plan",
+      "authority": "official",
+      "retrievedAt": "2026-07-31"
+    },
+    "anthropic-max": {
+      "publisher": "Anthropic",
+      "title": "What is the Max plan?",
+      "url": "https://support.claude.com/en/articles/11049741-what-is-the-max-plan",
+      "authority": "official",
+      "retrievedAt": "2026-07-31"
+    },
+    "anthropic-team": {
+      "publisher": "Anthropic",
+      "title": "What is the Team plan?",
+      "url": "https://support.claude.com/en/articles/9266767-what-is-the-team-plan",
+      "authority": "official",
+      "retrievedAt": "2026-07-31"
+    },
+    "anthropic-usage": {
+      "publisher": "Anthropic",
+      "title": "How do usage and length limits work?",
+      "url": "https://support.claude.com/en/articles/11647753-how-do-usage-and-length-limits-work",
+      "authority": "official",
+      "retrievedAt": "2026-07-31"
+    },
+    "anthropic-credits": {
+      "publisher": "Anthropic",
+      "title": "Manage usage credits for paid Claude plans",
+      "url": "https://support.claude.com/en/articles/12429409-manage-usage-credits-for-paid-claude-plans",
+      "authority": "official",
+      "retrievedAt": "2026-07-31"
+    },
+    "google-gemini-limits": {
+      "publisher": "Google",
+      "title": "Gemini Apps limits and upgrades for Google AI subscribers",
+      "url": "https://support.google.com/gemini/answer/16275805?hl=en",
+      "authority": "official",
+      "retrievedAt": "2026-07-31"
+    },
+    "xai-pricing": {
+      "publisher": "xAI",
+      "title": "Pricing: Compare Grok Plans",
+      "url": "https://x.ai/pricing",
+      "authority": "official",
+      "retrievedAt": "2026-07-31"
+    },
+    "qwen-usage-policy": {
+      "publisher": "Qwen",
+      "title": "Usage Policy",
+      "url": "https://qwen.ai/usagepolicy",
+      "authority": "official",
+      "retrievedAt": "2026-07-31"
+    },
+    "deepseek-user-agreement": {
+      "publisher": "DeepSeek",
+      "title": "DeepSeek User Agreement",
+      "url": "https://chat.deepseek.com/downloads/DeepSeek%20User%20Agreement.pdf",
+      "authority": "official",
+      "retrievedAt": "2026-08-01"
+    },
+    "perplexity-plan-comparison": {
+      "publisher": "Perplexity",
+      "title": "Which Perplexity Subscription Plan is right for you?",
+      "url": "https://www.perplexity.ai/help-center/en/articles/11187416-which-perplexity-subscription-plan-is-right-for-you",
+      "authority": "official",
+      "retrievedAt": "2026-08-01"
+    },
+    "perplexity-pro": {
+      "publisher": "Perplexity",
+      "title": "What is Perplexity Pro?",
+      "url": "https://www.perplexity.ai/help-center/en/articles/10352901-what-is-perplexity-pro",
+      "authority": "official",
+      "retrievedAt": "2026-08-01"
+    },
+    "zai-glm52": {
+      "publisher": "Z.ai",
+      "title": "GLM-5.2: Built for Long-Horizon Tasks",
+      "url": "https://z.ai/blog/glm-5.2",
+      "authority": "official",
+      "retrievedAt": "2026-08-02"
+    },
+    "doubao-feature-intro": {
+      "publisher": "Doubao",
+      "title": "Feature Introduction",
+      "url": "https://www.doubao.com/legal/feature_intro",
+      "authority": "official",
+      "retrievedAt": "2026-08-02"
+    }
+  },
+  "providers": {
+    "chatgpt": {
+      "label": "ChatGPT",
+      "plans": [
+        {
+          "id": "free",
+          "family": "free",
+          "labels": ["Free"]
+        },
+        {
+          "id": "go",
+          "family": "individual_paid",
+          "labels": ["Go"]
+        },
+        {
+          "id": "plus",
+          "family": "individual_paid",
+          "labels": ["Plus"]
+        },
+        {
+          "id": "pro",
+          "family": "individual_paid",
+          "labels": ["Pro"]
+        },
+        {
+          "id": "business",
+          "family": "organization_paid",
+          "labels": ["Business", "Team"]
+        },
+        {
+          "id": "enterprise",
+          "family": "organization_paid",
+          "labels": ["Enterprise"]
+        },
+        {
+          "id": "edu",
+          "family": "organization_paid",
+          "labels": ["Edu", "Education"]
+        },
+        {
+          "id": "unknown",
+          "family": "unknown",
+          "labels": []
+        }
+      ],
+      "usageDrivers": [
+        "selected_model",
+        "manual_thinking_selection",
+        "tool_or_feature",
+        "system_capacity",
+        "abuse_prevention_guardrails"
+      ],
+      "runtimeSignals": [
+        {
+          "kind": "reset_time_shown_at_limit",
+          "appliesTo": ["free"],
+          "sourceIds": ["openai-free-tier"]
+        },
+        {
+          "kind": "rolling_file_quota_remaining_not_shown",
+          "appliesTo": ["free", "go", "plus", "pro", "business", "enterprise", "edu"],
+          "sourceIds": ["openai-file-uploads"]
+        }
+      ],
+      "rules": [
+        {
+          "id": "chatgpt.gpt-5.5.free.messages",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["free"],
+            "accessClasses": ["signed_in_free"],
+            "modelFamilies": ["gpt-5.5-instant"],
+            "actions": ["prompt.submit"]
+          },
+          "meter": {
+            "kind": "count",
+            "unit": "message"
+          },
+          "window": {
+            "kind": "provider_managed",
+            "durationSeconds": 18000
+          },
+          "allowance": {
+            "kind": "dynamic"
+          },
+          "limitBehavior": {
+            "kind": "provider_managed"
+          },
+          "evidence": [
+            {
+              "kind": "official_dynamic",
+              "sourceIds": ["openai-gpt55-chatgpt"]
+            }
+          ],
+          "notes": [
+            "The allowance may vary with market, system conditions, guardrails, and individual usage."
+          ]
+        },
+        {
+          "id": "chatgpt.gpt-5.5.go-plus.messages",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["go", "plus"],
+            "accessClasses": ["signed_in_paid"],
+            "modelFamilies": ["gpt-5.5-instant"],
+            "actions": ["prompt.submit"]
+          },
+          "meter": {
+            "kind": "count",
+            "unit": "message"
+          },
+          "window": {
+            "kind": "provider_managed",
+            "durationSeconds": 10800
+          },
+          "allowance": {
+            "kind": "exact",
+            "count": 160
+          },
+          "limitBehavior": {
+            "kind": "provider_native_fallback",
+            "targetModelFamily": "gpt-5.5-mini"
+          },
+          "evidence": [
+            {
+              "kind": "official_exact",
+              "sourceIds": ["openai-gpt55-chatgpt"]
+            }
+          ],
+          "notes": []
+        },
+        {
+          "id": "chatgpt.gpt-5.5.go.manual-thinking.messages",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["go"],
+            "accessClasses": ["signed_in_paid"],
+            "modelFamilies": ["gpt-5.5-thinking"],
+            "modes": ["manual_thinking"],
+            "actions": ["prompt.submit"]
+          },
+          "meter": {
+            "kind": "count",
+            "unit": "message"
+          },
+          "window": {
+            "kind": "provider_managed",
+            "durationSeconds": 18000
+          },
+          "allowance": {
+            "kind": "exact",
+            "count": 10
+          },
+          "limitBehavior": {
+            "kind": "block_until_reset"
+          },
+          "evidence": [
+            {
+              "kind": "official_exact",
+              "sourceIds": ["openai-gpt55-chatgpt"]
+            }
+          ],
+          "notes": [
+            "Automatic switching from Instant to Thinking does not count toward this manual Thinking allowance."
+          ]
+        },
+        {
+          "id": "chatgpt.gpt-5.pro-business.messages",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["pro", "business"],
+            "accessClasses": ["signed_in_paid"],
+            "modelFamilies": ["gpt-5-family"],
+            "actions": ["prompt.submit"]
+          },
+          "meter": {
+            "kind": "guardrail",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "none"
+          },
+          "allowance": {
+            "kind": "guardrailed_unlimited"
+          },
+          "limitBehavior": {
+            "kind": "temporary_restriction_possible"
+          },
+          "evidence": [
+            {
+              "kind": "official_qualitative",
+              "sourceIds": ["openai-gpt55-chatgpt"]
+            }
+          ],
+          "notes": [
+            "Unlimited access remains subject to abuse guardrails and can be temporarily restricted."
+          ]
+        },
+        {
+          "id": "chatgpt.files.all-signed-in.rolling",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["free", "go", "plus", "pro", "business", "enterprise", "edu", "unknown"],
+            "accessClasses": ["signed_in_free", "signed_in_paid", "signed_in_unknown"],
+            "modelFamilies": ["*"],
+            "actions": ["file.upload"]
+          },
+          "meter": {
+            "kind": "count",
+            "unit": "file"
+          },
+          "window": {
+            "kind": "rolling",
+            "durationSeconds": 10800
+          },
+          "allowance": {
+            "kind": "exact",
+            "count": 80
+          },
+          "limitBehavior": {
+            "kind": "block_until_reset"
+          },
+          "evidence": [
+            {
+              "kind": "official_exact",
+              "sourceIds": ["openai-file-uploads"]
+            }
+          ],
+          "notes": [
+            "OpenAI may lower this limit during peak hours.",
+            "Failed upload attempts can sometimes count toward the rolling cap.",
+            "Shared storage caps are separate and are not represented as rate limits here."
+          ]
+        },
+        {
+          "id": "chatgpt.files.free.daily",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["free"],
+            "accessClasses": ["signed_in_free"],
+            "modelFamilies": ["*"],
+            "actions": ["file.upload"]
+          },
+          "meter": {
+            "kind": "count",
+            "unit": "file"
+          },
+          "window": {
+            "kind": "provider_daily",
+            "durationSeconds": 86400
+          },
+          "allowance": {
+            "kind": "exact",
+            "count": 3
+          },
+          "limitBehavior": {
+            "kind": "block_until_reset"
+          },
+          "evidence": [
+            {
+              "kind": "official_exact",
+              "sourceIds": ["openai-file-uploads"]
+            }
+          ],
+          "notes": [
+            "This plan-specific daily cap applies in addition to the general rolling upload cap."
+          ]
+        },
+        {
+          "id": "chatgpt.guest.numeric-limits-unknown",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["unknown"],
+            "accessClasses": ["guest"],
+            "modelFamilies": ["*"],
+            "actions": ["prompt.submit", "file.upload"]
+          },
+          "meter": {
+            "kind": "unknown",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "unknown"
+          },
+          "allowance": {
+            "kind": "unknown"
+          },
+          "limitBehavior": {
+            "kind": "provider_managed"
+          },
+          "evidence": [
+            {
+              "kind": "unknown",
+              "sourceIds": ["openai-free-tier"]
+            }
+          ],
+          "notes": [
+            "Signed-in Free limits are not assumed to apply to guest sessions."
+          ]
+        },
+        {
+          "id": "chatgpt.enterprise-edu.numeric-messages-unknown",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["enterprise", "edu", "unknown"],
+            "accessClasses": ["signed_in_paid", "signed_in_unknown"],
+            "modelFamilies": ["*"],
+            "actions": ["prompt.submit"]
+          },
+          "meter": {
+            "kind": "unknown",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "unknown"
+          },
+          "allowance": {
+            "kind": "unknown"
+          },
+          "limitBehavior": {
+            "kind": "provider_managed"
+          },
+          "evidence": [
+            {
+              "kind": "unknown",
+              "sourceIds": ["openai-gpt55-chatgpt"]
+            }
+          ],
+          "notes": [
+            "No single exact consumer Web message allowance is encoded for these plans."
+          ]
+        }
+      ]
+    },
+    "claude": {
+      "label": "Claude",
+      "plans": [
+        {
+          "id": "free",
+          "family": "free",
+          "labels": ["Free"]
+        },
+        {
+          "id": "pro",
+          "family": "individual_paid",
+          "labels": ["Pro"]
+        },
+        {
+          "id": "max_5x",
+          "family": "individual_paid",
+          "labels": ["Max 5x"]
+        },
+        {
+          "id": "max_20x",
+          "family": "individual_paid",
+          "labels": ["Max 20x"]
+        },
+        {
+          "id": "max_unknown",
+          "family": "individual_paid",
+          "labels": ["Max"]
+        },
+        {
+          "id": "team_standard",
+          "family": "organization_paid",
+          "labels": ["Team Standard"]
+        },
+        {
+          "id": "team_premium",
+          "family": "organization_paid",
+          "labels": ["Team Premium"]
+        },
+        {
+          "id": "team_unknown",
+          "family": "organization_paid",
+          "labels": ["Team"]
+        },
+        {
+          "id": "enterprise_seat",
+          "family": "organization_paid",
+          "labels": ["Enterprise"]
+        },
+        {
+          "id": "enterprise_usage_based",
+          "family": "organization_paid",
+          "labels": ["Enterprise Usage-Based"]
+        },
+        {
+          "id": "unknown",
+          "family": "unknown",
+          "labels": []
+        }
+      ],
+      "usageDrivers": [
+        "message_length",
+        "attachment_size",
+        "conversation_length",
+        "selected_model",
+        "effort_level",
+        "tools_and_connectors",
+        "research",
+        "artifact_creation"
+      ],
+      "sharedConsumption": {
+        "kind": "shared_across_product_surfaces",
+        "surfaces": ["claude.ai", "claude_code", "claude_desktop"],
+        "sourceIds": ["anthropic-usage"]
+      },
+      "runtimeSignals": [
+        {
+          "kind": "usage_progress_and_reset_visible",
+          "appliesTo": ["pro", "max_5x", "max_20x", "team_standard", "team_premium", "enterprise_seat"],
+          "sourceIds": ["anthropic-pro", "anthropic-max", "anthropic-team"]
+        }
+      ],
+      "rules": [
+        {
+          "id": "claude.free.session",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["free"],
+            "accessClasses": ["signed_in_free"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "compute",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "session",
+            "durationSeconds": 18000
+          },
+          "allowance": {
+            "kind": "dynamic"
+          },
+          "limitBehavior": {
+            "kind": "block_until_reset"
+          },
+          "evidence": [
+            {
+              "kind": "official_dynamic",
+              "sourceIds": ["anthropic-free", "anthropic-usage"]
+            }
+          ],
+          "notes": [
+            "The number of messages varies with demand and usage drivers."
+          ]
+        },
+        {
+          "id": "claude.pro.session",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["pro"],
+            "accessClasses": ["signed_in_paid"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "compute",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "session",
+            "durationSeconds": 18000
+          },
+          "allowance": {
+            "kind": "relative",
+            "basisRuleId": "claude.free.session",
+            "minimumMultiplier": 5
+          },
+          "limitBehavior": {
+            "kind": "block_or_optional_paid_overage"
+          },
+          "evidence": [
+            {
+              "kind": "official_relative",
+              "sourceIds": ["anthropic-pro", "anthropic-credits"]
+            }
+          ],
+          "notes": [
+            "Anthropic describes Pro as at least five times Free usage per session during peak hours.",
+            "Usage credits are user-enabled paid overage and must never be assumed or enabled automatically."
+          ]
+        },
+        {
+          "id": "claude.pro.weekly-all-models",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["pro"],
+            "accessClasses": ["signed_in_paid"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "compute",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "account_fixed_weekly",
+            "durationSeconds": 604800
+          },
+          "allowance": {
+            "kind": "dynamic"
+          },
+          "limitBehavior": {
+            "kind": "block_or_optional_paid_overage"
+          },
+          "evidence": [
+            {
+              "kind": "official_dynamic",
+              "sourceIds": ["anthropic-pro"]
+            }
+          ],
+          "notes": [
+            "The account receives a fixed weekly reset day and time visible in Settings > Usage."
+          ]
+        },
+        {
+          "id": "claude.max-5x.session",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["max_5x"],
+            "accessClasses": ["signed_in_paid"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "compute",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "session",
+            "durationSeconds": 18000
+          },
+          "allowance": {
+            "kind": "relative",
+            "basisRuleId": "claude.pro.session",
+            "multiplier": 5
+          },
+          "limitBehavior": {
+            "kind": "block_or_optional_paid_overage"
+          },
+          "evidence": [
+            {
+              "kind": "official_relative",
+              "sourceIds": ["anthropic-max", "anthropic-credits"]
+            }
+          ],
+          "notes": []
+        },
+        {
+          "id": "claude.max-unknown.session",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["max_unknown"],
+            "accessClasses": ["signed_in_paid"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "compute",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "session",
+            "durationSeconds": 18000
+          },
+          "allowance": {
+            "kind": "relative_range",
+            "basisRuleId": "claude.pro.session",
+            "minimumMultiplier": 5,
+            "maximumMultiplier": 20
+          },
+          "limitBehavior": {
+            "kind": "block_or_optional_paid_overage"
+          },
+          "evidence": [
+            {
+              "kind": "official_relative",
+              "sourceIds": ["anthropic-max", "anthropic-credits"]
+            }
+          ],
+          "notes": [
+            "Use this range when the visible account label says Max but does not distinguish Max 5x from Max 20x."
+          ]
+        },
+        {
+          "id": "claude.max-20x.session",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["max_20x"],
+            "accessClasses": ["signed_in_paid"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "compute",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "session",
+            "durationSeconds": 18000
+          },
+          "allowance": {
+            "kind": "relative",
+            "basisRuleId": "claude.pro.session",
+            "multiplier": 20
+          },
+          "limitBehavior": {
+            "kind": "block_or_optional_paid_overage"
+          },
+          "evidence": [
+            {
+              "kind": "official_relative",
+              "sourceIds": ["anthropic-max", "anthropic-credits"]
+            }
+          ],
+          "notes": []
+        },
+        {
+          "id": "claude.max.weekly-all-models",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["max_5x", "max_20x", "max_unknown"],
+            "accessClasses": ["signed_in_paid"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "compute",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "account_fixed_weekly",
+            "durationSeconds": 604800
+          },
+          "allowance": {
+            "kind": "dynamic"
+          },
+          "limitBehavior": {
+            "kind": "block_or_optional_paid_overage"
+          },
+          "evidence": [
+            {
+              "kind": "official_dynamic",
+              "sourceIds": ["anthropic-max"]
+            }
+          ],
+          "notes": []
+        },
+        {
+          "id": "claude.max.weekly-sonnet",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["max_5x", "max_20x", "max_unknown"],
+            "accessClasses": ["signed_in_paid"],
+            "modelFamilies": ["claude-sonnet"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "compute",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "account_fixed_weekly",
+            "durationSeconds": 604800
+          },
+          "allowance": {
+            "kind": "dynamic"
+          },
+          "limitBehavior": {
+            "kind": "block_or_optional_paid_overage"
+          },
+          "evidence": [
+            {
+              "kind": "official_dynamic",
+              "sourceIds": ["anthropic-max"]
+            }
+          ],
+          "notes": [
+            "This model-specific pool exists in addition to the all-model weekly pool."
+          ]
+        },
+        {
+          "id": "claude.team-standard.session",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["team_standard"],
+            "accessClasses": ["signed_in_paid"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "compute",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "session",
+            "durationSeconds": 18000
+          },
+          "allowance": {
+            "kind": "relative",
+            "basisRuleId": "claude.pro.session",
+            "multiplier": 1.25
+          },
+          "limitBehavior": {
+            "kind": "block_or_optional_paid_overage"
+          },
+          "evidence": [
+            {
+              "kind": "official_relative",
+              "sourceIds": ["anthropic-team"]
+            }
+          ],
+          "notes": [
+            "Team usage limits are per member rather than pooled across the organization."
+          ]
+        },
+        {
+          "id": "claude.team-unknown.session",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["team_unknown"],
+            "accessClasses": ["signed_in_paid"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "compute",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "session",
+            "durationSeconds": 18000
+          },
+          "allowance": {
+            "kind": "relative_range",
+            "basisRuleId": "claude.pro.session",
+            "minimumMultiplier": 1.25,
+            "maximumMultiplier": 6.25
+          },
+          "limitBehavior": {
+            "kind": "block_or_optional_paid_overage"
+          },
+          "evidence": [
+            {
+              "kind": "official_relative",
+              "sourceIds": ["anthropic-team"]
+            }
+          ],
+          "notes": [
+            "Use this range when the visible account label says Team but does not distinguish Standard from Premium."
+          ]
+        },
+        {
+          "id": "claude.team-premium.session",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["team_premium"],
+            "accessClasses": ["signed_in_paid"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "compute",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "session",
+            "durationSeconds": 18000
+          },
+          "allowance": {
+            "kind": "relative",
+            "basisRuleId": "claude.pro.session",
+            "multiplier": 6.25
+          },
+          "limitBehavior": {
+            "kind": "block_or_optional_paid_overage"
+          },
+          "evidence": [
+            {
+              "kind": "official_relative",
+              "sourceIds": ["anthropic-team"]
+            }
+          ],
+          "notes": [
+            "Team usage limits are per member rather than pooled across the organization."
+          ]
+        },
+        {
+          "id": "claude.team.weekly",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["team_standard", "team_premium", "team_unknown"],
+            "accessClasses": ["signed_in_paid"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "compute",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "account_fixed_weekly",
+            "durationSeconds": 604800
+          },
+          "allowance": {
+            "kind": "dynamic"
+          },
+          "limitBehavior": {
+            "kind": "block_or_optional_paid_overage"
+          },
+          "evidence": [
+            {
+              "kind": "official_dynamic",
+              "sourceIds": ["anthropic-team"]
+            }
+          ],
+          "notes": [
+            "Standard seats have an all-model weekly pool; Premium seats also have a second model-specific weekly pool."
+          ]
+        },
+        {
+          "id": "claude.enterprise-unknown.numeric-limits",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["enterprise_seat", "unknown"],
+            "accessClasses": ["signed_in_paid", "signed_in_unknown"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "compute",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "unknown"
+          },
+          "allowance": {
+            "kind": "unknown"
+          },
+          "limitBehavior": {
+            "kind": "provider_managed"
+          },
+          "evidence": [
+            {
+              "kind": "unknown",
+              "sourceIds": ["anthropic-usage"]
+            }
+          ],
+          "notes": []
+        },
+        {
+          "id": "claude.enterprise-usage-based.consumption",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["enterprise_usage_based"],
+            "accessClasses": ["signed_in_paid"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "compute",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "none"
+          },
+          "allowance": {
+            "kind": "consumption_based"
+          },
+          "limitBehavior": {
+            "kind": "billing_and_provider_managed"
+          },
+          "evidence": [
+            {
+              "kind": "official_qualitative",
+              "sourceIds": ["anthropic-usage"]
+            }
+          ],
+          "notes": []
+        }
+      ]
+    },
+    "gemini": {
+      "label": "Gemini",
+      "plans": [
+        {
+          "id": "no_google_ai_plan",
+          "family": "free",
+          "labels": ["No Google AI plan", "Standard"]
+        },
+        {
+          "id": "ai_plus",
+          "family": "individual_paid",
+          "labels": ["Google AI Plus", "AI Plus"]
+        },
+        {
+          "id": "ai_pro",
+          "family": "individual_paid",
+          "labels": ["Google AI Pro", "AI Pro"]
+        },
+        {
+          "id": "ai_ultra_5x",
+          "family": "individual_paid",
+          "labels": ["Google AI Ultra 5x", "AI Ultra 5x"]
+        },
+        {
+          "id": "ai_ultra_20x",
+          "family": "individual_paid",
+          "labels": ["Google AI Ultra 20x", "AI Ultra 20x"]
+        },
+        {
+          "id": "ai_ultra_unknown",
+          "family": "individual_paid",
+          "labels": ["Google AI Ultra", "AI Ultra"]
+        },
+        {
+          "id": "workspace",
+          "family": "organization_paid",
+          "labels": ["Google Workspace"]
+        },
+        {
+          "id": "unknown",
+          "family": "unknown",
+          "labels": []
+        }
+      ],
+      "usageDrivers": [
+        "prompt_complexity",
+        "selected_model",
+        "feature",
+        "conversation_length",
+        "system_capacity"
+      ],
+      "runtimeSignals": [
+        {
+          "kind": "near_limit_and_reset_time_notifications",
+          "appliesTo": ["no_google_ai_plan", "ai_plus", "ai_pro", "ai_ultra_5x", "ai_ultra_20x", "ai_ultra_unknown"],
+          "sourceIds": ["google-gemini-limits"]
+        }
+      ],
+      "rules": [
+        {
+          "id": "gemini.personal.standard.five-hour",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["no_google_ai_plan"],
+            "accessClasses": ["signed_in_free", "signed_in_unknown"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "compute",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "provider_managed",
+            "durationSeconds": 18000
+          },
+          "allowance": {
+            "kind": "dynamic"
+          },
+          "limitBehavior": {
+            "kind": "block_or_feature_unavailable"
+          },
+          "evidence": [
+            {
+              "kind": "official_dynamic",
+              "sourceIds": ["google-gemini-limits"]
+            }
+          ],
+          "notes": [
+            "Limits may change without notice and free access may be reduced first during high demand."
+          ]
+        },
+        {
+          "id": "gemini.guest.numeric-limits-unknown",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["unknown"],
+            "accessClasses": ["guest"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "compute",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "unknown"
+          },
+          "allowance": {
+            "kind": "unknown"
+          },
+          "limitBehavior": {
+            "kind": "provider_managed"
+          },
+          "evidence": [
+            {
+              "kind": "unknown",
+              "sourceIds": ["google-gemini-limits"]
+            }
+          ],
+          "notes": [
+            "The cited personal-account plan limits are not assumed to apply to guest sessions."
+          ]
+        },
+        {
+          "id": "gemini.personal.ai-plus.five-hour",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["ai_plus"],
+            "accessClasses": ["signed_in_paid"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "compute",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "provider_managed",
+            "durationSeconds": 18000
+          },
+          "allowance": {
+            "kind": "relative",
+            "basisRuleId": "gemini.personal.standard.five-hour",
+            "multiplier": 2
+          },
+          "limitBehavior": {
+            "kind": "provider_native_fallback",
+            "targetModelFamily": "gemini-flash-lite"
+          },
+          "evidence": [
+            {
+              "kind": "official_relative",
+              "sourceIds": ["google-gemini-limits"]
+            }
+          ],
+          "notes": []
+        },
+        {
+          "id": "gemini.personal.ai-pro.five-hour",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["ai_pro"],
+            "accessClasses": ["signed_in_paid"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "compute",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "provider_managed",
+            "durationSeconds": 18000
+          },
+          "allowance": {
+            "kind": "relative",
+            "basisRuleId": "gemini.personal.standard.five-hour",
+            "multiplier": 4
+          },
+          "limitBehavior": {
+            "kind": "provider_native_fallback",
+            "targetModelFamily": "gemini-flash-lite"
+          },
+          "evidence": [
+            {
+              "kind": "official_relative",
+              "sourceIds": ["google-gemini-limits"]
+            }
+          ],
+          "notes": []
+        },
+        {
+          "id": "gemini.personal.ai-ultra-5x.five-hour",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["ai_ultra_5x"],
+            "accessClasses": ["signed_in_paid"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "compute",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "provider_managed",
+            "durationSeconds": 18000
+          },
+          "allowance": {
+            "kind": "relative",
+            "basisRuleId": "gemini.personal.ai-pro.five-hour",
+            "multiplier": 5
+          },
+          "limitBehavior": {
+            "kind": "provider_native_fallback",
+            "targetModelFamily": "gemini-flash-lite"
+          },
+          "evidence": [
+            {
+              "kind": "official_relative",
+              "sourceIds": ["google-gemini-limits"]
+            }
+          ],
+          "notes": []
+        },
+        {
+          "id": "gemini.personal.ai-ultra-20x.five-hour",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["ai_ultra_20x"],
+            "accessClasses": ["signed_in_paid"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "compute",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "provider_managed",
+            "durationSeconds": 18000
+          },
+          "allowance": {
+            "kind": "relative",
+            "basisRuleId": "gemini.personal.ai-pro.five-hour",
+            "multiplier": 20
+          },
+          "limitBehavior": {
+            "kind": "provider_native_fallback",
+            "targetModelFamily": "gemini-flash-lite"
+          },
+          "evidence": [
+            {
+              "kind": "official_relative",
+              "sourceIds": ["google-gemini-limits"]
+            }
+          ],
+          "notes": []
+        },
+        {
+          "id": "gemini.personal.weekly",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["no_google_ai_plan", "ai_plus", "ai_pro", "ai_ultra_5x", "ai_ultra_20x", "ai_ultra_unknown"],
+            "accessClasses": ["signed_in_free", "signed_in_paid", "signed_in_unknown"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "compute",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "provider_managed_weekly",
+            "durationSeconds": 604800
+          },
+          "allowance": {
+            "kind": "dynamic"
+          },
+          "limitBehavior": {
+            "kind": "block_or_native_fallback"
+          },
+          "evidence": [
+            {
+              "kind": "official_dynamic",
+              "sourceIds": ["google-gemini-limits"]
+            }
+          ],
+          "notes": [
+            "The five-hour allowance refreshes until the weekly cap is reached."
+          ]
+        },
+        {
+          "id": "gemini.workspace-and-unknown.numeric-limits",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["workspace", "ai_ultra_unknown", "unknown"],
+            "accessClasses": ["signed_in_paid", "signed_in_unknown"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "compute",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "unknown"
+          },
+          "allowance": {
+            "kind": "unknown"
+          },
+          "limitBehavior": {
+            "kind": "provider_managed"
+          },
+          "evidence": [
+            {
+              "kind": "unknown",
+              "sourceIds": ["google-gemini-limits"]
+            }
+          ],
+          "notes": [
+            "The cited personal-account article does not define a single exact Workspace allowance."
+          ]
+        }
+      ]
+    },
+    "grok": {
+      "label": "Grok",
+      "plans": [
+        {
+          "id": "free",
+          "family": "free",
+          "labels": ["Free"]
+        },
+        {
+          "id": "supergrok_lite",
+          "family": "individual_paid",
+          "labels": ["SuperGrok Lite"]
+        },
+        {
+          "id": "supergrok",
+          "family": "individual_paid",
+          "labels": ["SuperGrok"]
+        },
+        {
+          "id": "supergrok_heavy",
+          "family": "individual_paid",
+          "labels": ["SuperGrok Heavy"]
+        },
+        {
+          "id": "business",
+          "family": "organization_paid",
+          "labels": ["Business"]
+        },
+        {
+          "id": "enterprise",
+          "family": "organization_paid",
+          "labels": ["Enterprise"]
+        },
+        {
+          "id": "unknown",
+          "family": "unknown",
+          "labels": []
+        }
+      ],
+      "usageDrivers": [],
+      "runtimeSignals": [],
+      "rules": [
+        {
+          "id": "grok.supergrok.qualitative-higher-limits",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["supergrok"],
+            "accessClasses": ["signed_in_paid"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "unknown",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "unknown"
+          },
+          "allowance": {
+            "kind": "qualitative",
+            "statement": "higher_rate_limits_across_all_features"
+          },
+          "limitBehavior": {
+            "kind": "provider_managed"
+          },
+          "evidence": [
+            {
+              "kind": "official_qualitative",
+              "sourceIds": ["xai-pricing"]
+            }
+          ],
+          "notes": [
+            "No numeric consumer Web allowance or reset window is published on the cited pricing page."
+          ]
+        },
+        {
+          "id": "grok.consumer-web.numeric-limits-unknown",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["free", "supergrok_lite", "supergrok", "supergrok_heavy", "business", "enterprise", "unknown"],
+            "accessClasses": ["signed_in_free", "signed_in_paid", "signed_in_unknown"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "unknown",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "unknown"
+          },
+          "allowance": {
+            "kind": "unknown"
+          },
+          "limitBehavior": {
+            "kind": "provider_managed"
+          },
+          "evidence": [
+            {
+              "kind": "unknown",
+              "sourceIds": ["xai-pricing"]
+            }
+          ],
+          "notes": [
+            "Organization plans may negotiate custom rate limits, but no numeric default is encoded."
+          ]
+        }
+      ]
+    },
+    "qwen": {
+      "label": "Qwen / 千问",
+      "plans": [
+        {
+          "id": "guest",
+          "family": "guest",
+          "labels": []
+        },
+        {
+          "id": "signed_in_unknown",
+          "family": "unknown",
+          "labels": []
+        },
+        {
+          "id": "unknown",
+          "family": "unknown",
+          "labels": []
+        }
+      ],
+      "usageDrivers": [],
+      "runtimeSignals": [],
+      "rules": [
+        {
+          "id": "qwen.consumer-web.numeric-limits-unknown",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["guest", "signed_in_unknown", "unknown"],
+            "accessClasses": ["guest", "signed_in_unknown", "unknown"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "unknown",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "unknown"
+          },
+          "allowance": {
+            "kind": "unknown"
+          },
+          "limitBehavior": {
+            "kind": "provider_managed"
+          },
+          "evidence": [
+            {
+              "kind": "unknown",
+              "sourceIds": ["qwen-usage-policy"]
+            }
+          ],
+          "notes": [
+            "No official numeric Qwen consumer Web allowance was found in the cited policy.",
+            "Qwen policy prohibits creating multiple accounts to evade restrictions."
+          ]
+        }
+      ]
+    },
+    "deepseek": {
+      "label": "DeepSeek",
+      "plans": [
+        {
+          "id": "free",
+          "family": "free",
+          "labels": ["Free"]
+        },
+        {
+          "id": "signed_in_unknown",
+          "family": "unknown",
+          "labels": []
+        },
+        {
+          "id": "unknown",
+          "family": "unknown",
+          "labels": []
+        }
+      ],
+      "usageDrivers": [
+        "selected_mode",
+        "deepthink",
+        "search",
+        "system_capacity"
+      ],
+      "runtimeSignals": [],
+      "rules": [
+        {
+          "id": "deepseek.consumer-web.numeric-limits-unknown",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["free", "signed_in_unknown", "unknown"],
+            "accessClasses": ["signed_in_free", "signed_in_unknown", "unknown"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage", "file.upload"]
+          },
+          "meter": {
+            "kind": "unknown",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "unknown"
+          },
+          "allowance": {
+            "kind": "unknown"
+          },
+          "limitBehavior": {
+            "kind": "provider_managed"
+          },
+          "evidence": [
+            {
+              "kind": "unknown",
+              "sourceIds": ["deepseek-user-agreement"]
+            }
+          ],
+          "notes": [
+            "No official numeric consumer Web allowance was found.",
+            "DeepSeek API concurrency documentation is intentionally excluded from this consumer Web rule."
+          ]
+        }
+      ]
+    },
+    "perplexity": {
+      "label": "Perplexity",
+      "plans": [
+        {
+          "id": "standard",
+          "family": "free",
+          "labels": ["Standard", "Free"]
+        },
+        {
+          "id": "pro",
+          "family": "individual_paid",
+          "labels": ["Pro", "Perplexity Pro"]
+        },
+        {
+          "id": "education_pro",
+          "family": "individual_paid",
+          "labels": ["Education Pro"]
+        },
+        {
+          "id": "max",
+          "family": "individual_paid",
+          "labels": ["Max", "Perplexity Max"]
+        },
+        {
+          "id": "enterprise_pro",
+          "family": "organization_paid",
+          "labels": ["Enterprise Pro"]
+        },
+        {
+          "id": "enterprise_max",
+          "family": "organization_paid",
+          "labels": ["Enterprise Max"]
+        },
+        {
+          "id": "unknown",
+          "family": "unknown",
+          "labels": []
+        }
+      ],
+      "usageDrivers": [
+        "search_mode",
+        "selected_model",
+        "feature",
+        "system_capacity"
+      ],
+      "runtimeSignals": [
+        {
+          "kind": "advanced_model_access_may_tighten_during_heavy_usage",
+          "appliesTo": ["pro", "education_pro", "max", "enterprise_pro", "enterprise_max"],
+          "sourceIds": ["perplexity-pro"]
+        }
+      ],
+      "rules": [
+        {
+          "id": "perplexity.standard.pro-search.daily",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["standard"],
+            "accessClasses": ["signed_in_free"],
+            "modelFamilies": ["*"],
+            "modes": ["pro_search"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "count",
+            "unit": "search"
+          },
+          "window": {
+            "kind": "provider_managed",
+            "durationSeconds": 86400
+          },
+          "allowance": {
+            "kind": "exact",
+            "count": 3
+          },
+          "limitBehavior": {
+            "kind": "provider_managed"
+          },
+          "evidence": [
+            {
+              "kind": "official_exact",
+              "sourceIds": ["perplexity-plan-comparison"]
+            }
+          ],
+          "notes": [
+            "This rule applies to Pro Search, not practically unlimited basic searches or Best mode."
+          ]
+        },
+        {
+          "id": "perplexity.enterprise-pro.pro-search.weekly",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["enterprise_pro"],
+            "accessClasses": ["signed_in_paid"],
+            "modelFamilies": ["*"],
+            "modes": ["pro_search"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "count",
+            "unit": "search"
+          },
+          "window": {
+            "kind": "provider_managed",
+            "durationSeconds": 604800
+          },
+          "allowance": {
+            "kind": "exact",
+            "count": 400
+          },
+          "limitBehavior": {
+            "kind": "provider_managed"
+          },
+          "evidence": [
+            {
+              "kind": "official_exact",
+              "sourceIds": ["perplexity-plan-comparison"]
+            }
+          ],
+          "notes": []
+        },
+        {
+          "id": "perplexity.enterprise-max.pro-search.weekly",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["enterprise_max"],
+            "accessClasses": ["signed_in_paid"],
+            "modelFamilies": ["*"],
+            "modes": ["pro_search"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "count",
+            "unit": "search"
+          },
+          "window": {
+            "kind": "provider_managed",
+            "durationSeconds": 604800
+          },
+          "allowance": {
+            "kind": "exact",
+            "count": 4000
+          },
+          "limitBehavior": {
+            "kind": "provider_managed"
+          },
+          "evidence": [
+            {
+              "kind": "official_exact",
+              "sourceIds": ["perplexity-plan-comparison"]
+            }
+          ],
+          "notes": []
+        },
+        {
+          "id": "perplexity.consumer-web.general-usage",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["standard", "pro", "education_pro", "max", "enterprise_pro", "enterprise_max", "unknown"],
+            "accessClasses": ["guest", "signed_in_free", "signed_in_paid", "signed_in_unknown", "unknown"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage", "file.upload"]
+          },
+          "meter": {
+            "kind": "unknown",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "unknown"
+          },
+          "allowance": {
+            "kind": "unknown"
+          },
+          "limitBehavior": {
+            "kind": "provider_managed"
+          },
+          "evidence": [
+            {
+              "kind": "official_dynamic",
+              "sourceIds": ["perplexity-plan-comparison", "perplexity-pro"]
+            }
+          ],
+          "notes": [
+            "Consumer Pro, Education Pro, and Max are described with average or advanced weekly limits but no single exact allowance.",
+            "Best mode is described as available without quota limits, while advanced-model access can tighten during heavy usage."
+          ]
+        }
+      ]
+    },
+    "zai": {
+      "label": "Z.ai / GLM",
+      "plans": [
+        {
+          "id": "guest",
+          "family": "guest",
+          "labels": []
+        },
+        {
+          "id": "signed_in_unknown",
+          "family": "unknown",
+          "labels": []
+        },
+        {
+          "id": "unknown",
+          "family": "unknown",
+          "labels": []
+        }
+      ],
+      "usageDrivers": [
+        "selected_model",
+        "selected_mode",
+        "system_capacity"
+      ],
+      "runtimeSignals": [],
+      "rules": [
+        {
+          "id": "zai.consumer-web.numeric-limits-unknown",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["guest", "signed_in_unknown", "unknown"],
+            "accessClasses": ["guest", "signed_in_unknown", "unknown"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "unknown",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "unknown"
+          },
+          "allowance": {
+            "kind": "unknown"
+          },
+          "limitBehavior": {
+            "kind": "provider_managed"
+          },
+          "evidence": [
+            {
+              "kind": "unknown",
+              "sourceIds": ["zai-glm52"]
+            }
+          ],
+          "notes": [
+            "The official product announcement confirms consumer Web availability but publishes no numeric Web allowance or reset window.",
+            "GLM Coding Plan quotas are intentionally excluded because they are separate from Z.ai consumer Web chat."
+          ]
+        }
+      ]
+    },
+    "doubao": {
+      "label": "Doubao / 豆包",
+      "plans": [
+        {
+          "id": "signed_in_unknown",
+          "family": "unknown",
+          "labels": []
+        },
+        {
+          "id": "unknown",
+          "family": "unknown",
+          "labels": []
+        }
+      ],
+      "usageDrivers": [
+        "selected_model",
+        "selected_mode",
+        "system_capacity"
+      ],
+      "runtimeSignals": [],
+      "rules": [
+        {
+          "id": "doubao.consumer-web.numeric-limits-unknown",
+          "status": "active",
+          "scope": "provider_profile",
+          "appliesTo": {
+            "planIds": ["signed_in_unknown", "unknown"],
+            "accessClasses": ["signed_in_unknown", "unknown"],
+            "modelFamilies": ["*"],
+            "actions": ["interactive.usage"]
+          },
+          "meter": {
+            "kind": "unknown",
+            "unit": "usage"
+          },
+          "window": {
+            "kind": "unknown"
+          },
+          "allowance": {
+            "kind": "unknown"
+          },
+          "limitBehavior": {
+            "kind": "provider_managed"
+          },
+          "evidence": [
+            {
+              "kind": "unknown",
+              "sourceIds": ["doubao-feature-intro"]
+            }
+          ],
+          "notes": [
+            "The official consumer Web feature page publishes no numeric allowance or reset window.",
+            "API and enterprise product quotas are intentionally excluded from this consumer Web rule."
+          ]
+        }
+      ]
+    }
+  }
+}
diff --git a/packages/cli/npm/tokenless-native-darwin-arm64/.npmignore b/packages/cli/npm/tokenless-native-darwin-arm64/.npmignore
deleted file mode 100644
index e703ffa..0000000
--- a/packages/cli/npm/tokenless-native-darwin-arm64/.npmignore
+++ /dev/null
@@ -1,4 +0,0 @@
-*
-!bin/
-!bin/**
-!package.json
diff --git a/packages/cli/npm/tokenless-native-darwin-arm64/package.json b/packages/cli/npm/tokenless-native-darwin-arm64/package.json
deleted file mode 100644
index 6574a0a..0000000
--- a/packages/cli/npm/tokenless-native-darwin-arm64/package.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "name": "tokenless-native-darwin-arm64",
-  "version": "0.3.0",
-  "description": "Tokenless Rust runtime for darwin-arm64.",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/jazelly/tokenless.git"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "os": [
-    "darwin"
-  ],
-  "cpu": [
-    "arm64"
-  ],
-  "files": [
-    "bin"
-  ],
-  "exports": {
-    "./package.json": "./package.json"
-  },
-  "scripts": {
-    "prepack": "node ../../scripts/verify-native-package.mjs"
-  },
-  "tokenlessRuntime": {
-    "protocol": "tokenless.native-package.v1",
-    "platform": "darwin",
-    "arch": "arm64"
-  },
-  "engines": {
-    "node": ">=22"
-  }
-}
diff --git a/packages/cli/npm/tokenless-native-darwin-x64/.npmignore b/packages/cli/npm/tokenless-native-darwin-x64/.npmignore
deleted file mode 100644
index e703ffa..0000000
--- a/packages/cli/npm/tokenless-native-darwin-x64/.npmignore
+++ /dev/null
@@ -1,4 +0,0 @@
-*
-!bin/
-!bin/**
-!package.json
diff --git a/packages/cli/npm/tokenless-native-darwin-x64/package.json b/packages/cli/npm/tokenless-native-darwin-x64/package.json
deleted file mode 100644
index cef4627..0000000
--- a/packages/cli/npm/tokenless-native-darwin-x64/package.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "name": "tokenless-native-darwin-x64",
-  "version": "0.3.0",
-  "description": "Tokenless Rust runtime for darwin-x64.",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/jazelly/tokenless.git"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "os": [
-    "darwin"
-  ],
-  "cpu": [
-    "x64"
-  ],
-  "files": [
-    "bin"
-  ],
-  "exports": {
-    "./package.json": "./package.json"
-  },
-  "scripts": {
-    "prepack": "node ../../scripts/verify-native-package.mjs"
-  },
-  "tokenlessRuntime": {
-    "protocol": "tokenless.native-package.v1",
-    "platform": "darwin",
-    "arch": "x64"
-  },
-  "engines": {
-    "node": ">=22"
-  }
-}
diff --git a/packages/cli/npm/tokenless-native-linux-arm64/.npmignore b/packages/cli/npm/tokenless-native-linux-arm64/.npmignore
deleted file mode 100644
index e703ffa..0000000
--- a/packages/cli/npm/tokenless-native-linux-arm64/.npmignore
+++ /dev/null
@@ -1,4 +0,0 @@
-*
-!bin/
-!bin/**
-!package.json
diff --git a/packages/cli/npm/tokenless-native-linux-arm64/package.json b/packages/cli/npm/tokenless-native-linux-arm64/package.json
deleted file mode 100644
index e35f6d2..0000000
--- a/packages/cli/npm/tokenless-native-linux-arm64/package.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "name": "tokenless-native-linux-arm64",
-  "version": "0.3.0",
-  "description": "Tokenless Rust runtime for linux-arm64.",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/jazelly/tokenless.git"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "os": [
-    "linux"
-  ],
-  "cpu": [
-    "arm64"
-  ],
-  "files": [
-    "bin"
-  ],
-  "exports": {
-    "./package.json": "./package.json"
-  },
-  "scripts": {
-    "prepack": "node ../../scripts/verify-native-package.mjs"
-  },
-  "tokenlessRuntime": {
-    "protocol": "tokenless.native-package.v1",
-    "platform": "linux",
-    "arch": "arm64"
-  },
-  "engines": {
-    "node": ">=22"
-  }
-}
diff --git a/packages/cli/npm/tokenless-native-linux-x64/.npmignore b/packages/cli/npm/tokenless-native-linux-x64/.npmignore
deleted file mode 100644
index e703ffa..0000000
--- a/packages/cli/npm/tokenless-native-linux-x64/.npmignore
+++ /dev/null
@@ -1,4 +0,0 @@
-*
-!bin/
-!bin/**
-!package.json
diff --git a/packages/cli/npm/tokenless-native-linux-x64/package.json b/packages/cli/npm/tokenless-native-linux-x64/package.json
deleted file mode 100644
index 173ac43..0000000
--- a/packages/cli/npm/tokenless-native-linux-x64/package.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "name": "tokenless-native-linux-x64",
-  "version": "0.3.0",
-  "description": "Tokenless Rust runtime for linux-x64.",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/jazelly/tokenless.git"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "os": [
-    "linux"
-  ],
-  "cpu": [
-    "x64"
-  ],
-  "files": [
-    "bin"
-  ],
-  "exports": {
-    "./package.json": "./package.json"
-  },
-  "scripts": {
-    "prepack": "node ../../scripts/verify-native-package.mjs"
-  },
-  "tokenlessRuntime": {
-    "protocol": "tokenless.native-package.v1",
-    "platform": "linux",
-    "arch": "x64"
-  },
-  "engines": {
-    "node": ">=22"
-  }
-}
diff --git a/packages/cli/npm/tokenless-native-win32-arm64/.npmignore b/packages/cli/npm/tokenless-native-win32-arm64/.npmignore
deleted file mode 100644
index e703ffa..0000000
--- a/packages/cli/npm/tokenless-native-win32-arm64/.npmignore
+++ /dev/null
@@ -1,4 +0,0 @@
-*
-!bin/
-!bin/**
-!package.json
diff --git a/packages/cli/npm/tokenless-native-win32-arm64/package.json b/packages/cli/npm/tokenless-native-win32-arm64/package.json
deleted file mode 100644
index 329b924..0000000
--- a/packages/cli/npm/tokenless-native-win32-arm64/package.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "name": "tokenless-native-win32-arm64",
-  "version": "0.3.0",
-  "description": "Tokenless Rust runtime for win32-arm64.",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/jazelly/tokenless.git"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "os": [
-    "win32"
-  ],
-  "cpu": [
-    "arm64"
-  ],
-  "files": [
-    "bin"
-  ],
-  "exports": {
-    "./package.json": "./package.json"
-  },
-  "scripts": {
-    "prepack": "node ../../scripts/verify-native-package.mjs"
-  },
-  "tokenlessRuntime": {
-    "protocol": "tokenless.native-package.v1",
-    "platform": "win32",
-    "arch": "arm64"
-  },
-  "engines": {
-    "node": ">=22"
-  }
-}
diff --git a/packages/cli/npm/tokenless-native-win32-x64/.npmignore b/packages/cli/npm/tokenless-native-win32-x64/.npmignore
deleted file mode 100644
index e703ffa..0000000
--- a/packages/cli/npm/tokenless-native-win32-x64/.npmignore
+++ /dev/null
@@ -1,4 +0,0 @@
-*
-!bin/
-!bin/**
-!package.json
diff --git a/packages/cli/npm/tokenless-native-win32-x64/package.json b/packages/cli/npm/tokenless-native-win32-x64/package.json
deleted file mode 100644
index dfa6bd0..0000000
--- a/packages/cli/npm/tokenless-native-win32-x64/package.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "name": "tokenless-native-win32-x64",
-  "version": "0.3.0",
-  "description": "Tokenless Rust runtime for win32-x64.",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/jazelly/tokenless.git"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "os": [
-    "win32"
-  ],
-  "cpu": [
-    "x64"
-  ],
-  "files": [
-    "bin"
-  ],
-  "exports": {
-    "./package.json": "./package.json"
-  },
-  "scripts": {
-    "prepack": "node ../../scripts/verify-native-package.mjs"
-  },
-  "tokenlessRuntime": {
-    "protocol": "tokenless.native-package.v1",
-    "platform": "win32",
-    "arch": "x64"
-  },
-  "engines": {
-    "node": ">=22"
-  }
-}
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 26314b7..3eaf08b 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -23,24 +23,22 @@
     "tokenless": "dist/src/tokenless.mjs"
   },
   "scripts": {
-    "build": "npm run build:js && npm run build:native",
-    "build:js": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json && node -e \"require('node:fs').chmodSync('dist/src/tokenless.mjs',0o755)\"",
-    "build:native": "node scripts/build-rust-binaries.mjs",
-    "lint": "tsc -p tsconfig.json --noEmit",
+    "build": "npm run build:js",
+    "build:js": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json && vite build --config vite.ui.config.ts --logLevel error && node -e \"const fs=require('node:fs'); fs.mkdirSync('dist/src/providers',{recursive:true}); fs.copyFileSync('../../assets/tokenless-mark.png','dist/src/daemon/ui/mark.png'); fs.copyFileSync('catalog/provider-rate-limits.v1.json','dist/src/providers/provider-rate-limits.v1.json'); fs.chmodSync('dist/src/tokenless.mjs',0o755); fs.chmodSync('dist/src/daemon/daemon-entry.mjs',0o755)\" && node dist/src/providers/rate-limit-catalog-check.mjs",
+    "lint": "tsc -p tsconfig.json --noEmit && svelte-check --tsconfig ./tsconfig.ui.json",
     "prepack": "npm run build:js"
   },
   "dependencies": {
-    "playwright-core": "^1.53.0"
-  },
-  "optionalDependencies": {
-    "tokenless-native-darwin-arm64": "0.3.0",
-    "tokenless-native-darwin-x64": "0.3.0",
-    "tokenless-native-linux-arm64": "0.3.0",
-    "tokenless-native-linux-x64": "0.3.0",
-    "tokenless-native-win32-arm64": "0.3.0",
-    "tokenless-native-win32-x64": "0.3.0"
+    "playwright-core": "1.61.1"
   },
   "engines": {
     "node": ">=22.13.0"
+  },
+  "devDependencies": {
+    "@lucide/svelte": "1.28.0",
+    "@sveltejs/vite-plugin-svelte": "7.2.0",
+    "svelte": "5.56.8",
+    "svelte-check": "4.7.4",
+    "vite": "8.2.0"
   }
 }
diff --git a/packages/cli/scripts/build-rust-binaries.mjs b/packages/cli/scripts/build-rust-binaries.mjs
deleted file mode 100644
index 082d6ff..0000000
--- a/packages/cli/scripts/build-rust-binaries.mjs
+++ /dev/null
@@ -1,66 +0,0 @@
-import { execFileSync } from 'node:child_process'
-import fs from 'node:fs'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-const cliRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-const daemonManifest = path.resolve(cliRoot, '../daemon/Cargo.toml')
-const daemonRoot = path.dirname(daemonManifest)
-const executableSuffix = process.platform === 'win32' ? '.exe' : ''
-const binaryNames = ['tokenless-daemon']
-const supportedTuples = new Set([
-  'darwin-arm64',
-  'darwin-x64',
-  'linux-arm64',
-  'linux-x64',
-  'win32-arm64',
-  'win32-x64',
-])
-const tuple = `${process.platform}-${process.arch}`
-if (!supportedTuples.has(tuple)) {
-  throw new Error(`Cannot build a Tokenless native package for ${tuple}.`)
-}
-const packageName = `tokenless-native-${tuple}`
-const packageRoot = path.join(cliRoot, 'npm', packageName)
-const cliManifest = JSON.parse(fs.readFileSync(path.join(cliRoot, 'package.json'), 'utf8'))
-const packageManifest = JSON.parse(fs.readFileSync(path.join(packageRoot, 'package.json'), 'utf8'))
-if (
-  packageManifest.name !== packageName ||
-  packageManifest.version !== cliManifest.version ||
-  packageManifest.os?.[0] !== process.platform ||
-  packageManifest.cpu?.[0] !== process.arch ||
-  packageManifest.tokenlessRuntime?.protocol !== 'tokenless.native-package.v1'
-) {
-  throw new Error(`Native package manifest does not match ${tuple}: ${packageRoot}`)
-}
-
-execFileSync('cargo', [
-  'build',
-  '--release',
-  '--manifest-path',
-  daemonManifest,
-  '--bins',
-], {
-  cwd: daemonRoot,
-  stdio: 'inherit',
-})
-
-const destinationDir = path.join(packageRoot, 'bin')
-fs.rmSync(destinationDir, { recursive: true, force: true })
-fs.mkdirSync(destinationDir, { recursive: true, mode: 0o755 })
-
-for (const name of binaryNames) {
-  const fileName = `${name}${executableSuffix}`
-  const source = path.join(daemonRoot, 'target', 'release', fileName)
-  const destination = path.join(destinationDir, fileName)
-  if (!fs.existsSync(source)) {
-    throw new Error(`Rust build did not produce ${source}.`)
-  }
-  fs.copyFileSync(source, destination)
-  if (process.platform !== 'win32') fs.chmodSync(destination, 0o755)
-}
-
-execFileSync(process.execPath, [path.join(cliRoot, 'scripts', 'verify-native-package.mjs')], {
-  cwd: packageRoot,
-  stdio: 'inherit',
-})
diff --git a/packages/cli/scripts/verify-native-package.mjs b/packages/cli/scripts/verify-native-package.mjs
deleted file mode 100644
index 4d7c038..0000000
--- a/packages/cli/scripts/verify-native-package.mjs
+++ /dev/null
@@ -1,102 +0,0 @@
-import { execFileSync } from 'node:child_process'
-import fs from 'node:fs'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-export const NATIVE_BINARY_BUILD_INFO_PROTOCOL = 'tokenless.native-binary-build-info.v1'
-
-const scriptPath = fileURLToPath(import.meta.url)
-const cliRoot = path.resolve(path.dirname(scriptPath), '..')
-
-export function verifyNativePackage(packageRoot = process.cwd()) {
-  const manifest = readJson(path.join(packageRoot, 'package.json'), 'native package manifest')
-  const cliManifest = readJson(path.join(cliRoot, 'package.json'), 'tokenless package manifest')
-  const platform = manifest.os?.[0]
-  const arch = manifest.cpu?.[0]
-  const expectedName = `tokenless-native-${platform}-${arch}`
-  if (
-    manifest.name !== expectedName ||
-    manifest.version !== cliManifest.version ||
-    !Array.isArray(manifest.os) || manifest.os.length !== 1 ||
-    !Array.isArray(manifest.cpu) || manifest.cpu.length !== 1 ||
-    manifest.tokenlessRuntime?.protocol !== 'tokenless.native-package.v1' ||
-    manifest.tokenlessRuntime?.platform !== platform ||
-    manifest.tokenlessRuntime?.arch !== arch
-  ) {
-    throw new Error(`Native package manifest does not match tokenless@${cliManifest.version}: ${packageRoot}`)
-  }
-  if (platform !== process.platform || arch !== process.arch) {
-    throw new Error(`Native package ${manifest.name} must be packed on ${platform}-${arch}, not ${process.platform}-${process.arch}.`)
-  }
-
-  const suffix = platform === 'win32' ? '.exe' : ''
-  for (const binaryName of ['tokenless-daemon']) {
-    const binary = path.join(packageRoot, 'bin', `${binaryName}${suffix}`)
-    const stat = fs.statSync(binary)
-    if (!stat.isFile() || stat.size < 100_000) {
-      throw new Error(`Native package binary is missing or implausibly small: ${binary}`)
-    }
-    const prefix = fs.readFileSync(binary).subarray(0, 2).toString('binary')
-    if (prefix === '#!') throw new Error(`Native package contains a script instead of a Rust binary: ${binary}`)
-    if (platform === 'win32' && prefix !== 'MZ') throw new Error(`Windows native binary is not PE format: ${binary}`)
-    if (platform !== 'win32' && (stat.mode & 0o111) === 0) throw new Error(`Native binary is not executable: ${binary}`)
-
-    let rawBuildInfo
-    try {
-      rawBuildInfo = execFileSync(binary, ['--tokenless-build-info'], {
-        encoding: 'utf8',
-        timeout: 5_000,
-        maxBuffer: 64 * 1024,
-        stdio: ['ignore', 'pipe', 'pipe'],
-        windowsHide: true,
-      })
-    } catch (error) {
-      throw new Error(`Native binary did not return build identity within 5 seconds: ${binary}`, { cause: error })
-    }
-    let buildInfo
-    try {
-      buildInfo = JSON.parse(rawBuildInfo)
-    } catch (error) {
-      throw new Error(`Native binary returned invalid build identity JSON: ${binary}`, { cause: error })
-    }
-    validateNativeBuildInfo(buildInfo, {
-      binary: binaryName,
-      version: manifest.version,
-      platform,
-      arch,
-    })
-  }
-}
-
-export function validateNativeBuildInfo(buildInfo, expected) {
-  const expectedBuildInfo = {
-    protocol: NATIVE_BINARY_BUILD_INFO_PROTOCOL,
-    binary: expected.binary,
-    version: expected.version,
-    platform: expected.platform,
-    arch: expected.arch,
-  }
-  if (
-    !buildInfo ||
-    typeof buildInfo !== 'object' ||
-    Array.isArray(buildInfo) ||
-    JSON.stringify(Object.keys(buildInfo).sort()) !== JSON.stringify(Object.keys(expectedBuildInfo).sort()) ||
-    Object.entries(expectedBuildInfo).some(([key, value]) => buildInfo[key] !== value)
-  ) {
-    throw new Error(
-      `Native binary build identity mismatch: expected ${expected.binary}@${expected.version} for ${expected.platform}-${expected.arch}.`
-    )
-  }
-}
-
-function readJson(file, label) {
-  try {
-    return JSON.parse(fs.readFileSync(file, 'utf8'))
-  } catch (error) {
-    throw new Error(`Cannot read ${label}: ${file}`, { cause: error })
-  }
-}
-
-if (process.argv[1] && path.resolve(process.argv[1]) === scriptPath) {
-  verifyNativePackage()
-}
diff --git a/packages/cli/src/application/services.ts b/packages/cli/src/application/services.ts
new file mode 100644
index 0000000..5723544
--- /dev/null
+++ b/packages/cli/src/application/services.ts
@@ -0,0 +1,765 @@
+import { createHash, randomUUID } from 'node:crypto'
+import path from 'node:path'
+
+import {
+  readTokenlessConfig,
+  normalizeManagedProfileProxy,
+  writeTokenlessConfig,
+  type ManagedProfilePreferences,
+  type TokenlessConfig,
+} from '../job-store.js'
+import { tokenlessPackageVersion } from '../platform-package.js'
+import { BrowserRuntimeManager } from '../browser-runtime/manager.js'
+import { isSystemBrowserId, normalizeBrowserSelection } from '../browser-runtime/types.js'
+import { normalizeBrowserVisibility } from '../browser-visibility.js'
+import {
+  createManagedPlaywrightJobRequest,
+  MANAGED_PLAYWRIGHT_JOB_ACTION,
+  PLAYWRIGHT_EXECUTION_BACKEND,
+} from '../playwright/job-contract.js'
+import { VISIBLE_ACTIONS } from '../providers/contracts.js'
+import {
+  listProviderDescriptors,
+  listProviderInstances,
+  listProviderTaskCapabilityRoutes,
+  listTaskCapabilityDefinitions,
+  type ProviderAccessClass,
+  type ProviderId,
+} from '../providers/registry.js'
+import {
+  ManagedProfileRegistry,
+  type ManagedProfileRecord,
+} from '../playwright/profiles/registry.js'
+import { publicView, type Job, type JobStore, type JobView } from '../daemon/job-store.js'
+import type { BrowserRuntimeController } from '../daemon/browser-runtime-controller.js'
+
+export type UiApplicationServicesOptions = {
+  store: JobStore
+  runtimeController?: BrowserRuntimeController | undefined
+  origin: () => string
+  startedAt: number
+}
+
+export class TokenlessApplicationServices {
+  readonly store: JobStore
+  readonly profiles: ManagedProfileRegistry
+  readonly runtimeManager: BrowserRuntimeManager
+
+  private readonly runtimeController: BrowserRuntimeController | undefined
+  private readonly origin: () => string
+  private readonly startedAt: number
+
+  constructor(options: UiApplicationServicesOptions) {
+    this.store = options.store
+    this.profiles = new ManagedProfileRegistry(options.store.homeDir)
+    this.runtimeManager = new BrowserRuntimeManager({ homeDir: options.store.homeDir })
+    this.runtimeController = options.runtimeController
+    this.origin = options.origin
+    this.startedAt = options.startedAt
+  }
+
+  async snapshot() {
+    await this.reconcileProviderObservations()
+    const [config, profileData, jobs] = await Promise.all([
+      this.migratedConfig(),
+      this.profiles.read(),
+      Promise.resolve(this.store.listJobs({ limit: 200 })),
+    ])
+    const profiles = Object.values(profileData.profiles)
+      .filter((profile) => profile.lifecycle !== 'removed')
+      .sort((left, right) => left.slug.localeCompare(right.slug))
+    const runtime = this.runtimeController?.status() ?? {
+      status: 'stopped' as const,
+      activeProfileCount: 0,
+      activeJobCount: 0,
+      pid: process.pid,
+    }
+    const providers = listProviderDescriptors()
+      .sort((left, right) => left.setupOrder - right.setupOrder)
+      .map((provider) => ({
+        id: provider.id,
+        label: provider.label,
+        stage: provider.stage,
+        homeUrl: provider.navigation.entryUrl,
+      }))
+    const capabilityRoutes = listProviderTaskCapabilityRoutes()
+    const body = {
+      schema: 'tokenless.ui-snapshot.v1',
+      generatedAt: new Date().toISOString(),
+      daemon: {
+        version: tokenlessPackageVersion(),
+        origin: this.origin(),
+        uptimeMs: Math.max(0, Date.now() - this.startedAt),
+        pid: process.pid,
+      },
+      runtime,
+      config: publicConfig(config),
+      profiles: profiles.map((profile) => publicProfile(
+        profile,
+        profileData.defaultProfile,
+        profilePreferences(config, profile),
+      )),
+      providers: providers.map((provider) => ({
+        ...provider,
+        profiles: profiles.map((profile) => providerProfileState(
+          provider.id,
+          profile,
+          profilePreferences(config, profile),
+          capabilityRoutes,
+          jobs,
+        )),
+      })),
+      capabilities: listTaskCapabilityDefinitions().map((capability) => ({
+        id: capability.id,
+        title: capability.title,
+        description: capability.description,
+        family: capability.family,
+        lifecycle: capability.lifecycle,
+        stability: capability.stability,
+        requiredEvidence: capability.requiredEvidence,
+        providers: capabilityRoutes
+          .filter((route) => route.capability === capability.id)
+          .map((route) => ({
+            provider: route.provider,
+            support: route.support,
+            strategy: route.strategy,
+            evidence: route.evidence,
+          })),
+      })),
+      jobs: jobs.map((job) => publicJobSummary(job, profiles)),
+      diagnostics: await this.diagnostics(config, profiles, runtime),
+    }
+    return {
+      ...body,
+      revision: revisionFor({
+        ...body,
+        generatedAt: null,
+        daemon: { ...body.daemon, uptimeMs: 0 },
+      }),
+    }
+  }
+
+  async job(jobId: string) {
+    return publicJobDetail(this.store.getJob(jobId), await this.profiles.listProfiles())
+  }
+
+  async updateConfig(input: Record<string, unknown>) {
+    requireKnownFields(input, ['browser', 'browserExecutablePath', 'browserVisibility', 'language'])
+    const current = await this.migratedConfig()
+    let browser = input.browser === undefined
+      ? current.browser
+      : normalizeBrowserSelection(input.browser)
+    if (!browser) throw applicationError('invalid_browser', 'Browser selection is invalid.')
+    const executablePathProvided = Object.hasOwn(input, 'browserExecutablePath')
+    let browserExecutablePath = executablePathProvided
+      ? applicationBrowserExecutablePath(input.browserExecutablePath)
+      : browser === current.browser ? current.browserExecutablePath : null
+    if (executablePathProvided && browserExecutablePath && !isSystemBrowserId(browser)) {
+      throw applicationError(
+        'browser_executable_path_requires_system_browser',
+        'Browser executable path requires an explicit system browser such as chrome or brave.',
+      )
+    }
+    const browserVisibility = input.browserVisibility === undefined
+      ? current.browserVisibility
+      : normalizeBrowserVisibility(input.browserVisibility)
+    if (!browserVisibility) throw applicationError('invalid_browser_visibility', 'Browser visibility is invalid.')
+    const language = input.language === undefined ? current.language : input.language
+    if (language !== 'en' && language !== 'zh-CN') {
+      throw applicationError('invalid_language', 'Language must be en or zh-CN.')
+    }
+    const shouldResolveBrowser = (browserExecutablePath !== null && executablePathProvided) ||
+      (browser !== current.browser && isSystemBrowserId(browser))
+    if (shouldResolveBrowser) {
+      const runtime = await this.runtimeManager.ensure(browser, {
+        allowDownload: false,
+        browserExecutablePath,
+      })
+      browser = runtime.selection
+      browserExecutablePath = runtime.executablePath
+    }
+    const browserRuntimeChanged = browser !== current.browser ||
+      browserExecutablePath !== current.browserExecutablePath
+    if (browserRuntimeChanged && this.runtimeController?.status().activeJobCount) {
+      throw applicationError('browser_mutation_unsafe', 'Browser selection cannot change while browser jobs are active.')
+    }
+    if (browserRuntimeChanged) await this.runtimeController?.quiesce()
+    return publicConfig(await writeTokenlessConfig({
+      homeDir: this.store.homeDir,
+      browser,
+      browserExecutablePath,
+      browserVisibility,
+      language,
+    }))
+  }
+
+  async createProfile(input: Record<string, unknown>) {
+    requireKnownFields(input, ['slug', 'label', 'roleLabel', 'enabledProviders', 'browserVisibility', 'proxy', 'setDefault'])
+    const slug = requiredSlug(input.slug)
+    const config = await this.migratedConfig()
+    const label = optionalLabel(input.label)
+    const preferences = {
+      roleLabel: optionalRoleLabel(input.roleLabel) ?? '',
+      enabledProviders: input.enabledProviders === undefined
+        ? config.providerWhitelist
+        : providerList(input.enabledProviders),
+      browserVisibility: input.browserVisibility === undefined
+        ? config.browserVisibility
+        : requiredVisibility(input.browserVisibility),
+      proxy: input.proxy === undefined ? null : validateProxy(input.proxy),
+    }
+    const runtime = await this.runtimeManager.ensure(config.browser, {
+      allowDownload: false,
+      browserExecutablePath: config.browserExecutablePath,
+    })
+    if (
+      config.browser !== runtime.selection ||
+      config.browserExecutablePath !== runtime.executablePath
+    ) {
+      await writeTokenlessConfig({
+        homeDir: this.store.homeDir,
+        browser: runtime.selection,
+        browserExecutablePath: runtime.executablePath,
+      })
+    }
+    const profile = await this.profiles.addProfile({
+      slug,
+      label: label ?? slug,
+      labelOrigin: label === undefined ? 'slug' : 'user',
+      lifecycle: 'ready',
+      setDefault: input.setDefault === true,
+      runtimeBinding: runtimeBinding(runtime),
+    })
+    try {
+      await this.updateProfilePreferences(profile, preferences)
+      return publicProfile(profile, (await this.profiles.read()).defaultProfile, profilePreferences(await this.migratedConfig(), profile))
+    } catch (error) {
+      await this.profiles.removeProfile(slug, { confirmDelete: true }).catch(() => undefined)
+      throw error
+    }
+  }
+
+  async updateProfile(slug: string, input: Record<string, unknown>) {
+    requireKnownFields(input, ['label', 'roleLabel', 'enabledProviders', 'browserVisibility', 'proxy', 'setDefault'])
+    let profile = await this.profiles.resolveProfile(slug)
+    const label = input.label === undefined ? undefined : requiredLabel(input.label)
+    const current = profilePreferences(await this.migratedConfig(), profile)
+    const next = {
+      roleLabel: input.roleLabel === undefined ? current.roleLabel : optionalRoleLabel(input.roleLabel) ?? '',
+      enabledProviders: input.enabledProviders === undefined
+        ? current.enabledProviders
+        : providerList(input.enabledProviders),
+      browserVisibility: input.browserVisibility === undefined
+        ? current.browserVisibility
+        : requiredVisibility(input.browserVisibility),
+      proxy: input.proxy === undefined ? current.proxy : validateProxy(input.proxy),
+    }
+    if (JSON.stringify(next.proxy) !== JSON.stringify(current.proxy)) {
+      if (this.runtimeController?.status().activeJobCount) {
+        throw applicationError('profile_proxy_mutation_unsafe', 'Proxy settings cannot change while browser jobs are active.')
+      }
+      await this.runtimeController?.quiesce()
+    }
+    if (label !== undefined) profile = await this.profiles.updateLabel(slug, label)
+    if (input.setDefault === true) profile = await this.profiles.setDefault(slug)
+    await this.updateProfilePreferences(profile, next)
+    return publicProfile(profile, (await this.profiles.read()).defaultProfile, profilePreferences(await this.migratedConfig(), profile))
+  }
+
+  async removeProfile(slug: string) {
+    const status = this.runtimeController?.status()
+    if (status?.activeJobCount) {
+      throw applicationError('profile_mutation_unsafe', 'A profile cannot be removed while browser jobs are active.')
+    }
+    await this.runtimeController?.quiesce()
+    const profile = await this.profiles.removeProfile(slug, { confirmDelete: true })
+    const config = await this.migratedConfig()
+    const profilePreferences = { ...config.profilePreferences }
+    delete profilePreferences[slug]
+    await writeTokenlessConfig({ homeDir: this.store.homeDir, profilePreferences })
+    return { slug: profile.slug, removed: true }
+  }
+
+  async providerAction(slug: string, providerValue: string, action: 'open' | 'readiness' | 'controls') {
+    const profile = await this.profiles.resolveProfile(slug)
+    const provider = listProviderInstances().find((candidate) => candidate.id === providerValue)
+    if (!provider || provider.descriptor.stage === 'disabled') {
+      throw applicationError('provider_not_supported', 'Provider is not supported.')
+    }
+    const preferences = profilePreferences(await this.migratedConfig(), profile)
+    if (!preferences.enabledProviders.includes(provider.id)) {
+      throw applicationError('provider_not_enabled', 'Enable the provider for this profile before opening it.')
+    }
+    const visibleAction = action === 'readiness'
+      ? VISIBLE_ACTIONS.AUTH_STATUS
+      : action === 'controls'
+        ? VISIBLE_ACTIONS.CAPABILITY_INSPECT
+        : VISIBLE_ACTIONS.NAVIGATION_CHECK
+    const actions = action === 'controls'
+      ? [
+          { action: VISIBLE_ACTIONS.CAPABILITY_INSPECT, payload: {} },
+          { action: VISIBLE_ACTIONS.MODEL_INSPECT, payload: {} },
+          { action: VISIBLE_ACTIONS.EFFORT_INSPECT, payload: {} },
+        ]
+      : [{ action: visibleAction, payload: {} }]
+    const request = createManagedPlaywrightJobRequest({
+      provider: provider.id,
+      browserVisibility: action === 'readiness' ? preferences.browserVisibility : 'headed',
+      taskId: `ui:${action}:${randomUUID()}`,
+      actions,
+    })
+    const job = this.store.createJob({
+      provider: provider.id,
+      action: MANAGED_PLAYWRIGHT_JOB_ACTION,
+      request_json: request,
+      execution_backend: PLAYWRIGHT_EXECUTION_BACKEND,
+      profile_id: profile.id,
+    })
+    await this.runtimeController?.wake()
+    return publicJobSummary(publicView(job), [profile])
+  }
+
+  async providerSelection(
+    slug: string,
+    providerValue: string,
+    input: Record<string, unknown>,
+  ) {
+    requireKnownFields(input, ['kind', 'label'])
+    const kind = input.kind
+    if (kind !== 'model' && kind !== 'effort') {
+      throw applicationError('provider_selection_invalid', 'Selection kind must be model or effort.')
+    }
+    const label = requiredText(input.label, 'label', 120)
+    const profile = await this.profiles.resolveProfile(slug)
+    const provider = listProviderInstances().find((candidate) => candidate.id === providerValue)
+    if (!provider || provider.descriptor.stage === 'disabled') {
+      throw applicationError('provider_not_supported', 'Provider is not supported.')
+    }
+    const preferences = profilePreferences(await this.migratedConfig(), profile)
+    if (!preferences.enabledProviders.includes(provider.id)) {
+      throw applicationError('provider_not_enabled', 'Enable the provider for this profile before changing controls.')
+    }
+    const request = createManagedPlaywrightJobRequest({
+      provider: provider.id,
+      browserVisibility: 'headed',
+      taskId: `ui:${kind}-select:${randomUUID()}`,
+      actions: [{
+        action: kind === 'model' ? VISIBLE_ACTIONS.MODEL_SELECT : VISIBLE_ACTIONS.EFFORT_SELECT,
+        payload: { label },
+      }],
+    })
+    const job = this.store.createJob({
+      provider: provider.id,
+      action: MANAGED_PLAYWRIGHT_JOB_ACTION,
+      request_json: request,
+      execution_backend: PLAYWRIGHT_EXECUTION_BACKEND,
+      profile_id: profile.id,
+    })
+    await this.runtimeController?.wake()
+    return publicJobSummary(job, [profile])
+  }
+
+  async openProfile(slug: string) {
+    const profile = await this.profiles.resolveProfile(slug)
+    if (!this.runtimeController) throw applicationError('browser_runtime_unavailable', 'Browser runtime is unavailable.')
+    const preferences = profilePreferences(await this.migratedConfig(), profile)
+    return await this.runtimeController.openProfile(profile.id, preferences.browserVisibility)
+  }
+
+  async quiesceRuntime() {
+    return await this.runtimeController?.quiesce() ?? {
+      status: 'stopped', activeProfileCount: 0, activeJobCount: 0, pid: process.pid,
+    }
+  }
+
+  async cancelJob(jobId: string) {
+    return publicJobDetail(await this.store.cancelJob(jobId, { source: 'ui' }), await this.profiles.listProfiles())
+  }
+
+  async resumeJob(jobId: string) {
+    const job = this.store.resumeJob(jobId, { browser_visibility: 'headed' })
+    await this.runtimeController?.wake()
+    return publicJobDetail(job, await this.profiles.listProfiles())
+  }
+
+  private async migratedConfig() {
+    const config = await readTokenlessConfig(this.store.homeDir)
+    const profiles = await this.profiles.listProfiles()
+    const missing = profiles.filter((profile) => !config.profilePreferences[profile.slug])
+    if (missing.length === 0) return config
+    const enabledProviders = config.providerWhitelist
+    const profilePreferences = { ...config.profilePreferences }
+    for (const profile of missing) {
+      profilePreferences[profile.slug] = {
+        profileId: profile.slug,
+        roleLabel: '',
+        enabledProviders,
+        browserVisibility: config.browserVisibility,
+        proxy: null,
+      }
+    }
+    return await writeTokenlessConfig({ homeDir: this.store.homeDir, profilePreferences })
+  }
+
+  private async updateProfilePreferences(
+    profile: ManagedProfileRecord,
+    next: Omit<ManagedProfilePreferences, 'profileId'>,
+  ) {
+    const config = await this.migratedConfig()
+    const profilePreferences = {
+      ...config.profilePreferences,
+      [profile.slug]: { profileId: profile.slug, ...next },
+    }
+    const providerWhitelist = [...new Set(Object.values(profilePreferences)
+      .flatMap((preferences) => preferences.enabledProviders))]
+    await writeTokenlessConfig({
+      homeDir: this.store.homeDir,
+      profilePreferences,
+      providerWhitelist,
+    })
+  }
+
+  private async diagnostics(
+    config: TokenlessConfig,
+    profiles: ManagedProfileRecord[],
+    runtime: ReturnType<BrowserRuntimeController['status']>,
+  ) {
+    const browser = await this.runtimeManager.inspect(config.browser, {
+      browserExecutablePath: config.browserExecutablePath,
+    })
+    return [
+      {
+        id: 'configuration',
+        state: config.updatedAt ? 'ok' : 'action_required',
+        message: config.updatedAt ? 'Configuration is persisted.' : 'Setup has not persisted configuration yet.',
+      },
+      {
+        id: 'browser-runtime',
+        state: browser.ok ? 'ok' : 'error',
+        message: browser.ok ? `${browser.runtime?.displayName ?? config.browser} is available.` : browser.message,
+      },
+      {
+        id: 'profiles',
+        state: profiles.some((profile) => profile.lifecycle === 'ready') ? 'ok' : 'action_required',
+        message: profiles.length === 0 ? 'No managed profile is configured.' : `${profiles.length} managed profile(s) registered.`,
+      },
+      {
+        id: 'scheduler',
+        state: runtime.status === 'quiescing' ? 'action_required' : 'ok',
+        message: `${runtime.activeJobCount} active browser job(s).`,
+      },
+    ]
+  }
+
+  private async reconcileProviderObservations() {
+    const profiles = await this.profiles.listProfiles()
+    const byId = new Map(profiles.map((profile) => [profile.id, profile]))
+    for (const job of this.store.listJobs({ status: 'succeeded', limit: 200 })) {
+      const request = record(job.request_json)
+      if (!job.profile_id || !request || typeof request.taskId !== 'string' || !request.taskId.startsWith('ui:readiness:')) continue
+      const profile = byId.get(job.profile_id)
+      if (!profile) continue
+      const result = record(job.result_json)
+      const responses = Array.isArray(result?.responses) ? result.responses : []
+      const response = responses.find((entry) => record(entry)?.action === VISIBLE_ACTIONS.AUTH_STATUS)
+      const responseRecord = record(response)
+      const observation = responseRecord?.ok === true ? record(responseRecord.result) : null
+      if (!observation || !['authenticated', 'unauthenticated', 'unknown'].includes(String(observation.state))) continue
+      const current = profile.lastObservedAuth[job.provider as ProviderId]
+      if (current && Date.parse(current.checkedAt) >= Date.parse(job.updated_at)) continue
+      const account = record(observation.account)
+      const tier = record(account?.tier)
+      await this.profiles.updateProviderStatus(profile.slug, {
+        provider: job.provider as ProviderId,
+        auth: observation.state as 'authenticated' | 'unauthenticated' | 'unknown',
+        access: observation.access as ProviderAccessClass,
+        checkedAt: job.updated_at,
+        ...(observation.state === 'authenticated' && account && tier ? {
+          account: {
+            name: typeof account.name === 'string' ? account.name : null,
+            subscription: typeof account.subscription === 'string' ? account.subscription : null,
+            tier: {
+              class: tier.class as 'signed_in_free' | 'signed_in_paid' | 'signed_in_unknown',
+              label: typeof tier.label === 'string' ? tier.label : null,
+            },
+          },
+        } : {}),
+      })
+    }
+  }
+
+}
+
+function publicConfig(config: TokenlessConfig) {
+  return {
+    updatedAt: config.updatedAt,
+    providerWhitelist: config.providerWhitelist,
+    browser: config.browser,
+    browserExecutablePathConfigured: config.browserExecutablePath !== null,
+    browserConnectionMode: config.browserConnectionMode,
+    browserVisibility: config.browserVisibility,
+    daemonUrl: config.daemonUrl,
+    language: config.language,
+  }
+}
+
+function applicationBrowserExecutablePath(value: unknown) {
+  if (value === null) return null
+  const executablePath = typeof value === 'string' ? value.trim() : ''
+  if (!executablePath || !path.isAbsolute(executablePath)) {
+    throw applicationError(
+      'invalid_browser_executable_path',
+      'Browser executable path must be null or an absolute path.',
+    )
+  }
+  return path.normalize(executablePath)
+}
+
+function publicProfile(
+  profile: ManagedProfileRecord,
+  defaultSlug: string | null,
+  preferences: ManagedProfilePreferences,
+) {
+  return {
+    slug: profile.slug,
+    id: profile.id,
+    label: profile.label,
+    lifecycle: profile.lifecycle,
+    isDefault: profile.slug === defaultSlug,
+    createdAt: profile.createdAt,
+    updatedAt: profile.updatedAt,
+    runtimeBinding: profile.runtimeBinding ?? null,
+    import: profile.import ? {
+      browser: profile.import.browser ?? null,
+      profileName: profile.label,
+      importedAt: profile.import.importedAt,
+    } : null,
+    preferences,
+    observations: Object.values(profile.lastObservedAuth).map((status) => status ? {
+      provider: status.provider,
+      auth: status.auth,
+      access: status.access,
+      checkedAt: status.checkedAt,
+      account: status.auth === 'authenticated' ? status.account ?? null : null,
+    } : null).filter(Boolean),
+  }
+}
+
+function providerProfileState(
+  provider: ProviderId,
+  profile: ManagedProfileRecord,
+  preferences: ManagedProfilePreferences,
+  routes: ReturnType<typeof listProviderTaskCapabilityRoutes>,
+  jobs: Job[],
+) {
+  const observation = profile.lastObservedAuth[provider]
+  return {
+    profileId: profile.slug,
+    enabled: preferences.enabledProviders.includes(provider),
+    observation: observation ? {
+      auth: observation.auth,
+      access: observation.access,
+      checkedAt: observation.checkedAt,
+      account: observation.auth === 'authenticated' ? observation.account ?? null : null,
+    } : null,
+    runtimeEligibility: preferences.enabledProviders.includes(provider) && usableAccess(observation?.access)
+      ? 'eligible'
+      : 'ineligible',
+    capabilities: routes.filter((route) => route.provider === provider).map((route) => ({
+      id: route.capability,
+      support: route.support,
+    })),
+    controls: latestProviderControls(jobs, profile.id, provider),
+  }
+}
+
+function latestProviderControls(jobs: Job[], profileId: string, provider: ProviderId) {
+  const job = jobs.find((candidate) => {
+    const request = record(candidate.request_json)
+    return candidate.profile_id === profileId &&
+      candidate.provider === provider &&
+      candidate.status === 'succeeded' &&
+      typeof request?.taskId === 'string' &&
+      request.taskId.startsWith('ui:controls:')
+  })
+  const result = record(job?.result_json)
+  const responses = Array.isArray(result?.responses) ? result.responses : []
+  const choice = (action: string) => {
+    const response = responses.find((entry) => record(entry)?.action === action)
+    const envelope = record(response)
+    const value = envelope?.ok === true ? record(envelope.result) : null
+    if (!value || value.supported !== true || !Array.isArray(value.choices)) return null
+    return value.choices.flatMap((entry) => {
+      const candidate = record(entry)
+      return typeof candidate?.label === 'string'
+        ? [{ label: candidate.label, selected: candidate.selected === true, enabled: candidate.enabled === true }]
+        : []
+    })
+  }
+  return {
+    checkedAt: job?.updated_at ?? null,
+    model: choice(VISIBLE_ACTIONS.MODEL_INSPECT),
+    effort: choice(VISIBLE_ACTIONS.EFFORT_INSPECT),
+  }
+}
+
+function publicJobSummary(job: JobView | Job, profiles: ManagedProfileRecord[] = []) {
+  const request = record(job.request_json)
+  return {
+    jobId: job.job_id,
+    profileId: job.profile_id,
+    profileSlug: profiles.find((profile) => profile.id === job.profile_id)?.slug ?? null,
+    provider: job.provider,
+    action: job.action,
+    status: job.status,
+    taskId: typeof request?.taskId === 'string' ? request.taskId : null,
+    capabilityRoute: record(request?.capabilityRoute),
+    agent: 'agent_kind' in job && job.agent_kind && job.agent_session_id
+      ? { kind: job.agent_kind, sessionId: job.agent_session_id }
+      : null,
+    blocker: publicError(job.blocker_json),
+    createdAt: job.created_at,
+    updatedAt: job.updated_at,
+  }
+}
+
+function publicJobDetail(job: JobView | Job, profiles: ManagedProfileRecord[] = []) {
+  return {
+    ...publicJobSummary(job, profiles),
+    result: redactPublicValue(job.result_json),
+    error: publicError(job.error_json),
+    providerAttempts: redactPublicValue(job.provider_attempts_json),
+  }
+}
+
+function publicError(value: unknown) {
+  return redactPublicValue(value)
+}
+
+function redactPublicValue(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(redactPublicValue)
+  if (typeof value === 'string') return redactPrivatePaths(value)
+  const object = record(value)
+  if (!object) return value
+  const redacted: Record<string, unknown> = {}
+  for (const [key, entry] of Object.entries(object)) {
+    if (/token|cookie|authorization|storage|checkpoint|claim|directory|paths?$/i.test(key)) continue
+    redacted[key] = redactPublicValue(entry)
+  }
+  return redacted
+}
+
+function redactPrivatePaths(value: string) {
+  return value
+    .replace(/(^|[\s("'=])\/(?:Users|home|private|var|tmp|opt|Volumes)\/[^\s"'<>]*/g, '$1[redacted path]')
+    .replace(/(^|[\s("'=])[A-Za-z]:\\[^\s"'<>]*/g, '$1[redacted path]')
+}
+
+function profilePreferences(config: TokenlessConfig, profile: ManagedProfileRecord): ManagedProfilePreferences {
+  return config.profilePreferences[profile.slug] ?? {
+    profileId: profile.slug,
+    roleLabel: '',
+    enabledProviders: config.providerWhitelist,
+    browserVisibility: config.browserVisibility,
+    proxy: null,
+  }
+}
+
+function supportedProviderIds() {
+  return listProviderDescriptors().filter((provider) => provider.stage !== 'disabled').map((provider) => provider.id)
+}
+
+function providerList(value: unknown): string[] {
+  if (!Array.isArray(value)) throw applicationError('invalid_provider_list', 'Enabled providers must be an array.')
+  const supported = new Set(supportedProviderIds())
+  const providers = [...new Set(value.filter((entry): entry is string => typeof entry === 'string')
+    .map((entry) => entry.trim().toLowerCase()))]
+  if (providers.some((provider) => !supported.has(provider as ProviderId))) {
+    throw applicationError('invalid_provider_list', 'Enabled providers include an unsupported provider.')
+  }
+  return providers
+}
+
+function validateProxy(value: unknown): ManagedProfilePreferences['proxy'] {
+  const proxy = normalizeManagedProfileProxy(value)
+  if (proxy === undefined) {
+    throw applicationError('invalid_proxy', 'Proxy must use HTTP, HTTPS, or SOCKS5 without embedded credentials.')
+  }
+  return proxy
+}
+
+function requiredVisibility(value: unknown) {
+  const visibility = normalizeBrowserVisibility(value)
+  if (!visibility) throw applicationError('invalid_browser_visibility', 'Browser visibility is invalid.')
+  return visibility
+}
+
+function requiredSlug(value: unknown) {
+  if (typeof value !== 'string' || !/^[a-z0-9][a-z0-9-]{0,63}$/.test(value)) {
+    throw applicationError('invalid_profile_slug', 'Profile slug must use lowercase letters, numbers, and hyphens.')
+  }
+  return value
+}
+
+function optionalLabel(value: unknown) {
+  if (value === undefined || value === null || value === '') return undefined
+  return requiredLabel(value)
+}
+
+function requiredLabel(value: unknown) {
+  if (typeof value !== 'string' || !value.trim() || value.trim().length > 80) {
+    throw applicationError('invalid_profile_label', 'Profile label must be between 1 and 80 characters.')
+  }
+  return value.trim().replace(/\s+/g, ' ')
+}
+
+function optionalRoleLabel(value: unknown) {
+  if (value === undefined || value === null || value === '') return undefined
+  if (typeof value !== 'string' || value.trim().length > 80) {
+    throw applicationError('invalid_role_label', 'Role label must be at most 80 characters.')
+  }
+  return value.trim().replace(/\s+/g, ' ')
+}
+
+function requiredText(value: unknown, field: string, maxLength: number) {
+  if (typeof value !== 'string' || !value.trim() || value.length > maxLength) {
+    throw applicationError(`invalid_${field}`, `${field} is invalid.`)
+  }
+  return value.trim()
+}
+
+function requireKnownFields(input: Record<string, unknown>, allowed: string[]) {
+  const accepted = new Set(allowed)
+  const unknown = Object.keys(input).filter((key) => !accepted.has(key))
+  if (unknown.length > 0) {
+    throw applicationError('invalid_fields', `Unsupported field${unknown.length === 1 ? '' : 's'}: ${unknown.join(', ')}.`)
+  }
+}
+
+function usableAccess(value: unknown) {
+  return value === 'guest' || value === 'signed_in_free' || value === 'signed_in_paid' || value === 'signed_in_unknown'
+}
+
+function runtimeBinding(runtime: Awaited<ReturnType<BrowserRuntimeManager['ensure']>>) {
+  return {
+    runtimeId: runtime.runtimeId,
+    family: runtime.family,
+    browserId: runtime.browserId,
+    createdWithVersion: runtime.actualVersion,
+    profileFormat: 1 as const,
+  }
+}
+
+function revisionFor(value: unknown) {
+  return createHash('sha256').update(JSON.stringify(value)).digest('base64url').slice(0, 24)
+}
+
+function record(value: unknown): Record<string, unknown> | null {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : null
+}
+
+function applicationError(code: string, message: string) {
+  return Object.assign(new Error(message), { code, status: 400 })
+}
diff --git a/packages/cli/src/browser-connection-mode.ts b/packages/cli/src/browser-connection-mode.ts
new file mode 100644
index 0000000..565292b
--- /dev/null
+++ b/packages/cli/src/browser-connection-mode.ts
@@ -0,0 +1,14 @@
+export const BROWSER_CONNECTION_MODES = Object.freeze([
+  'playwright',
+  'cdp',
+] as const)
+
+export type BrowserConnectionMode = (typeof BROWSER_CONNECTION_MODES)[number]
+
+export function normalizeBrowserConnectionMode(value: unknown): BrowserConnectionMode | null {
+  if (typeof value !== 'string') return null
+  const normalized = value.trim().toLowerCase()
+  return BROWSER_CONNECTION_MODES.includes(normalized as BrowserConnectionMode)
+    ? normalized as BrowserConnectionMode
+    : null
+}
diff --git a/packages/cli/src/browser-runtime/catalog.ts b/packages/cli/src/browser-runtime/catalog.ts
new file mode 100644
index 0000000..3479356
--- /dev/null
+++ b/packages/cli/src/browser-runtime/catalog.ts
@@ -0,0 +1,89 @@
+import type {
+  BrowserRuntimePlatform,
+  ManagedBrowserFamily,
+} from './types.js'
+
+export type ManagedBrowserArchiveFormat = 'tar.gz' | 'zip'
+
+export type ManagedBrowserCatalogEntry = {
+  family: ManagedBrowserFamily
+  browserId: ManagedBrowserFamily
+  displayName: string
+  platform: BrowserRuntimePlatform
+  artifactVersion: string
+  browserVersion: string
+  downloadUrl: string
+  sha256: string
+  archiveFormat: ManagedBrowserArchiveFormat
+  executableRelativePath: string
+}
+
+const MANAGED_BROWSER_CATALOG = Object.freeze({
+  'managed-chromium:darwin-arm64': {
+    family: 'managed-chromium',
+    browserId: 'managed-chromium',
+    displayName: 'Tokenless-managed Chromium',
+    platform: 'darwin-arm64',
+    artifactVersion: '145.0.7632.6',
+    browserVersion: '145.0.7632.6',
+    downloadUrl: 'https://storage.googleapis.com/chrome-for-testing-public/145.0.7632.6/mac-arm64/chrome-mac-arm64.zip',
+    sha256: '3dbf04e28a02079148e9c7417840a0c1d3903361eceeee7e7eb59ef77021bdb2',
+    archiveFormat: 'zip',
+    executableRelativePath: 'chrome-mac-arm64/Google Chrome for Testing.app/Contents/MacOS/Google Chrome for Testing',
+  },
+  'managed-chromium:win32-x64': {
+    family: 'managed-chromium',
+    browserId: 'managed-chromium',
+    displayName: 'Tokenless-managed Chromium',
+    platform: 'win32-x64',
+    artifactVersion: '145.0.7632.6',
+    browserVersion: '145.0.7632.6',
+    downloadUrl: 'https://storage.googleapis.com/chrome-for-testing-public/145.0.7632.6/win64/chrome-win64.zip',
+    sha256: '08476e6fe550ccbc0d11d1ab030292fc4e32d4987400c77b2d1905a6bd13b4f6',
+    archiveFormat: 'zip',
+    executableRelativePath: 'chrome-win64/chrome.exe',
+  },
+  'cloak:darwin-arm64': {
+    family: 'cloak',
+    browserId: 'cloak',
+    displayName: 'CloakBrowser',
+    platform: 'darwin-arm64',
+    artifactVersion: '145.0.7632.109.2',
+    browserVersion: '145.0.7632.109',
+    downloadUrl: 'https://github.com/CloakHQ/CloakBrowser/releases/download/chromium-v145.0.7632.109.2/cloakbrowser-darwin-arm64.tar.gz',
+    sha256: '505582aa1bd3971c577f70e0cbbe016431702bdb693529abfd943b5bd9120c1c',
+    archiveFormat: 'tar.gz',
+    executableRelativePath: 'Chromium.app/Contents/MacOS/Chromium',
+  },
+  'cloak:win32-x64': {
+    family: 'cloak',
+    browserId: 'cloak',
+    displayName: 'CloakBrowser',
+    platform: 'win32-x64',
+    artifactVersion: '146.0.7680.177.5',
+    browserVersion: '146.0.7680.177',
+    downloadUrl: 'https://github.com/CloakHQ/CloakBrowser/releases/download/chromium-v146.0.7680.177.5/cloakbrowser-windows-x64.zip',
+    sha256: 'b213795cb32c3169f766c74ce1d0275fc89d3df256de39c04da7fb4c23b7fdbe',
+    archiveFormat: 'zip',
+    executableRelativePath: 'chrome.exe',
+  },
+} satisfies Record<string, ManagedBrowserCatalogEntry>)
+
+export function managedBrowserCatalogEntry(
+  family: ManagedBrowserFamily,
+  platform = currentBrowserRuntimePlatform(),
+): ManagedBrowserCatalogEntry {
+  const entry = MANAGED_BROWSER_CATALOG[`${family}:${platform}` as keyof typeof MANAGED_BROWSER_CATALOG]
+  if (!entry) throw new Error(`No managed browser catalog entry exists for ${family} on ${platform}.`)
+  return entry
+}
+
+export function currentBrowserRuntimePlatform(): BrowserRuntimePlatform {
+  const key = `${process.platform}-${process.arch}`
+  if (key === 'darwin-arm64' || key === 'win32-x64') return key
+  throw new Error(`Unsupported Tokenless browser platform: ${key}. Supported platforms are darwin-arm64 and win32-x64.`)
+}
+
+export function allManagedBrowserCatalogEntries(): readonly ManagedBrowserCatalogEntry[] {
+  return Object.values(MANAGED_BROWSER_CATALOG)
+}
diff --git a/packages/cli/src/browser-runtime/index.ts b/packages/cli/src/browser-runtime/index.ts
new file mode 100644
index 0000000..e01b07a
--- /dev/null
+++ b/packages/cli/src/browser-runtime/index.ts
@@ -0,0 +1,29 @@
+export {
+  allManagedBrowserCatalogEntries,
+  currentBrowserRuntimePlatform,
+  managedBrowserCatalogEntry,
+} from './catalog.js'
+
+export { BrowserRuntimeManager } from './manager.js'
+
+export {
+  BROWSER_SELECTIONS,
+  SYSTEM_BROWSER_IDS,
+  isSystemBrowserId,
+  normalizeBrowserSelection,
+} from './types.js'
+
+export type {
+  BrowserCandidate,
+  BrowserLaunchPolicy,
+  BrowserRuntimeBinding,
+  BrowserRuntimeFamily,
+  BrowserRuntimeInspection,
+  BrowserRuntimePlatform,
+  BrowserRuntimeProgress,
+  BrowserSelection,
+  EnsureBrowserRuntimeOptions,
+  ManagedBrowserFamily,
+  ResolvedBrowserRuntime,
+  SystemBrowserId,
+} from './types.js'
diff --git a/packages/cli/src/browser-runtime/manager.ts b/packages/cli/src/browser-runtime/manager.ts
new file mode 100644
index 0000000..7ec2c30
--- /dev/null
+++ b/packages/cli/src/browser-runtime/manager.ts
@@ -0,0 +1,944 @@
+import { spawn } from 'node:child_process'
+import { createHash, randomUUID } from 'node:crypto'
+import { createReadStream, createWriteStream } from 'node:fs'
+import fs from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+import { pipeline } from 'node:stream/promises'
+import { Readable, Transform } from 'node:stream'
+import { chromium } from 'playwright-core'
+import { tokenlessError } from '../playwright/errors.js'
+import { withPrivateSqliteWriterLock } from '../playwright/profiles/sqlite-lock.js'
+import {
+  currentBrowserRuntimePlatform,
+  managedBrowserCatalogEntry,
+  type ManagedBrowserCatalogEntry,
+} from './catalog.js'
+import {
+  SYSTEM_BROWSER_IDS,
+  isSystemBrowserId,
+  normalizeBrowserSelection,
+  type BrowserCandidate,
+  type BrowserRuntimeBinding,
+  type BrowserRuntimeInspection,
+  type BrowserRuntimePlatform,
+  type BrowserRuntimeProgress,
+  type BrowserSelection,
+  type EnsureBrowserRuntimeOptions,
+  type ManagedBrowserFamily,
+  type ResolvedBrowserRuntime,
+  type SystemBrowserId,
+} from './types.js'
+
+const RUNTIME_MANIFEST_FILE = 'runtime.json'
+const INSTALLED_INDEX_FILE = 'installed.json'
+const MAX_ARCHIVE_LIST_BYTES = 32 * 1024 * 1024
+const MAX_DOWNLOAD_BYTES = 800 * 1024 * 1024
+const DOWNLOAD_TIMEOUT_MS = 15 * 60_000
+const ARCHIVE_TIMEOUT_MS = 10 * 60_000
+const VERSION_TIMEOUT_MS = 15_000
+const SMOKE_LAUNCH_TIMEOUT_MS = 45_000
+
+type RuntimeManifest = {
+  version: 1
+  runtimeId: string
+  family: ManagedBrowserFamily
+  browserId: ManagedBrowserFamily
+  platform: BrowserRuntimePlatform
+  artifactVersion: string
+  browserVersion: string
+  sha256: string
+  downloadUrl: string
+  executableRelativePath: string
+  installedAt: string
+  checksumVerified: true
+  smokeLaunchVerified: true
+}
+
+type ProfileWithRuntimeBinding = {
+  slug: string
+  runtimeBinding?: BrowserRuntimeBinding | undefined
+}
+
+type BrowserRuntimeManagerOptions = {
+  homeDir: string
+}
+
+export class BrowserRuntimeManager {
+  readonly homeDir: string
+  readonly browserRoot: string
+  readonly runtimesRoot: string
+  readonly installLockFile: string
+  readonly installedIndexFile: string
+
+  constructor(options: BrowserRuntimeManagerOptions) {
+    this.homeDir = path.resolve(options.homeDir)
+    this.browserRoot = path.join(this.homeDir, 'browser')
+    this.runtimesRoot = path.join(this.browserRoot, 'runtimes')
+    this.installLockFile = path.join(this.browserRoot, 'install.writer.sqlite')
+    this.installedIndexFile = path.join(this.browserRoot, INSTALLED_INDEX_FILE)
+  }
+
+  async discover(): Promise<BrowserCandidate[]> {
+    const platform = supportedPlatform()
+    const system = (await Promise.all(SYSTEM_BROWSER_IDS.map(async (browserId) => (
+      await this.resolveSystemBrowser(browserId, platform).catch(() => null)
+    )))).filter((candidate): candidate is ResolvedBrowserRuntime => candidate !== null)
+
+    const managed = (await Promise.all((['managed-chromium', 'cloak'] as const).map(async (family) => (
+      await this.resolveCachedManagedRuntime(managedBrowserCatalogEntry(family, platform)).catch(() => null)
+    )))).filter((candidate): candidate is ResolvedBrowserRuntime => candidate !== null)
+
+    return [...system, ...managed].map(runtimeCandidate)
+  }
+
+  async ensure(
+    requested: BrowserSelection | string,
+    options: EnsureBrowserRuntimeOptions = {},
+  ): Promise<ResolvedBrowserRuntime> {
+    const selection = normalizeBrowserSelection(requested)
+    if (!selection) {
+      throw tokenlessError(
+        'invalid_browser',
+        'Browser must be auto, a supported system browser, managed-chromium, or cloak.',
+      )
+    }
+    const platform = supportedPlatform()
+    if (options.repair === true && selection !== 'managed-chromium' && selection !== 'cloak') {
+      throw tokenlessError(
+        'browser_runtime_repair_requires_managed_selection',
+        'Browser runtime repair requires an explicit managed-chromium or cloak selection.',
+      )
+    }
+    if (selection === 'auto') {
+      for (const browserId of SYSTEM_BROWSER_IDS) {
+        const resolved = await this.resolveSystemBrowser(browserId, platform).catch(() => null)
+        if (resolved) return resolved
+      }
+      return await this.ensureManagedRuntime('managed-chromium', platform, options)
+    }
+    if (selection === 'profile') return await this.resolveTestProfile(platform)
+    if (isSystemBrowserId(selection)) {
+      return await this.requireSystemBrowser(selection, platform, options.browserExecutablePath)
+    }
+    return await this.ensureManagedRuntime(selection, platform, options)
+  }
+
+  async resolveForProfile(
+    profile: ProfileWithRuntimeBinding,
+    options: EnsureBrowserRuntimeOptions = {},
+  ): Promise<ResolvedBrowserRuntime> {
+    const binding = profile.runtimeBinding
+    if (!binding) {
+      throw tokenlessError(
+        'profile_runtime_binding_required',
+        `Managed profile '${profile.slug}' predates browser runtime binding. Rerun tokenless setup and explicitly select a compatible browser.`,
+      )
+    }
+    const selection = selectionForBinding(binding)
+    const runtime = await this.ensure(selection, { ...options, allowDownload: false })
+    if (runtime.runtimeId !== binding.runtimeId || runtime.family !== binding.family || runtime.browserId !== binding.browserId) {
+      throw tokenlessError(
+        'profile_runtime_mismatch',
+        `Managed profile '${profile.slug}' is bound to ${binding.runtimeId}, but Tokenless resolved ${runtime.runtimeId}.`,
+      )
+    }
+    if (compareBrowserVersions(runtime.actualVersion, binding.createdWithVersion) < 0) {
+      throw tokenlessError(
+        'profile_browser_downgrade_blocked',
+        `Managed profile '${profile.slug}' was created with browser ${binding.createdWithVersion}; refusing to open it with older browser ${runtime.actualVersion}.`,
+      )
+    }
+    return runtime
+  }
+
+  async inspect(
+    selectionOrProfile: BrowserSelection | string | ProfileWithRuntimeBinding,
+    options: EnsureBrowserRuntimeOptions = {},
+  ): Promise<BrowserRuntimeInspection> {
+    try {
+      const runtime = typeof selectionOrProfile === 'object'
+        ? await this.resolveForProfile(selectionOrProfile, options)
+        : await this.ensure(selectionOrProfile, { ...options, allowDownload: false })
+      return {
+        ok: true,
+        selection: runtime.selection,
+        runtime,
+        code: null,
+        message: null,
+      }
+    } catch (error) {
+      return {
+        ok: false,
+        selection: typeof selectionOrProfile === 'object'
+          ? null
+          : normalizeBrowserSelection(selectionOrProfile),
+        runtime: null,
+        code: errorCode(error),
+        message: error instanceof Error ? error.message : String(error),
+      }
+    }
+  }
+
+  private async ensureManagedRuntime(
+    family: ManagedBrowserFamily,
+    platform: BrowserRuntimePlatform,
+    options: EnsureBrowserRuntimeOptions,
+  ) {
+    const entry = managedBrowserCatalogEntry(family, platform)
+    const cached = options.repair === true
+      ? null
+      : await this.resolveCachedManagedRuntime(entry).catch((error) => {
+          if (errorCode(error) === 'browser_runtime_not_installed') return null
+          throw error
+        })
+    if (cached) return cached
+    if (options.allowDownload !== true) {
+      throw tokenlessError(
+        'browser_runtime_download_required',
+        `${entry.displayName} ${entry.artifactVersion} is not installed. Run tokenless setup with browser downloads enabled.`,
+      )
+    }
+    return await withPrivateSqliteWriterLock(this.installLockFile, async () => {
+      if (options.repair !== true) {
+        const afterLock = await this.resolveCachedManagedRuntime(entry).catch((error) => {
+          if (errorCode(error) === 'browser_runtime_not_installed') return null
+          throw error
+        })
+        if (afterLock) return afterLock
+        return await this.installManagedRuntime(entry, options)
+      }
+      return await this.reinstallManagedRuntime(entry, options)
+    }, options.signal ? { signal: options.signal } : {})
+  }
+
+  private async reinstallManagedRuntime(
+    entry: ManagedBrowserCatalogEntry,
+    options: EnsureBrowserRuntimeOptions,
+  ) {
+    const finalDirectory = this.managedRuntimeDirectory(entry)
+    const backupDirectory = path.join(
+      path.dirname(finalDirectory),
+      `.${path.basename(finalDirectory)}.repair-${randomUUID()}`,
+    )
+    let backupCreated = false
+    try {
+      await fs.rename(finalDirectory, backupDirectory)
+      backupCreated = true
+    } catch (error) {
+      if (!isErrno(error, 'ENOENT')) throw error
+    }
+    try {
+      const runtime = await this.installManagedRuntime(entry, options)
+      if (backupCreated) await fs.rm(backupDirectory, { recursive: true, force: true })
+      return runtime
+    } catch (error) {
+      if (backupCreated) {
+        await fs.rm(finalDirectory, { recursive: true, force: true }).catch(() => undefined)
+        await fs.rename(backupDirectory, finalDirectory).catch(() => undefined)
+      }
+      throw error
+    }
+  }
+
+  private async installManagedRuntime(
+    entry: ManagedBrowserCatalogEntry,
+    options: EnsureBrowserRuntimeOptions,
+  ): Promise<ResolvedBrowserRuntime> {
+    const finalDirectory = this.managedRuntimeDirectory(entry)
+    const temporaryRoot = path.join(this.browserRoot, `.install-${randomUUID()}`)
+    const payloadDirectory = path.join(temporaryRoot, 'payload')
+    const archivePath = path.join(temporaryRoot, `browser.${entry.archiveFormat}`)
+    const emit = (phase: Parameters<NonNullable<EnsureBrowserRuntimeOptions['onProgress']>>[0]['phase']) => {
+      options.onProgress?.({
+        phase,
+        family: entry.family,
+        displayName: entry.displayName,
+        version: entry.artifactVersion,
+      })
+    }
+
+    await fs.mkdir(temporaryRoot, { recursive: false, mode: 0o700 })
+    try {
+      emit('download')
+      await downloadArtifact(entry.downloadUrl, archivePath, options.signal)
+      await verifyAndExtractManagedBrowserArtifact({
+        entry,
+        archivePath,
+        payloadDirectory,
+        temporaryRoot,
+        ...(options.signal ? { signal: options.signal } : {}),
+        onPhase: emit,
+      })
+      const installedAt = new Date().toISOString()
+      const manifest: RuntimeManifest = {
+        version: 1,
+        runtimeId: managedRuntimeId(entry),
+        family: entry.family,
+        browserId: entry.browserId,
+        platform: entry.platform,
+        artifactVersion: entry.artifactVersion,
+        browserVersion: entry.browserVersion,
+        sha256: entry.sha256,
+        downloadUrl: entry.downloadUrl,
+        executableRelativePath: entry.executableRelativePath,
+        installedAt,
+        checksumVerified: true,
+        smokeLaunchVerified: true,
+      }
+      await writeJsonAtomic(path.join(payloadDirectory, RUNTIME_MANIFEST_FILE), manifest)
+      await fs.mkdir(path.dirname(finalDirectory), { recursive: true, mode: 0o700 })
+      emit('install')
+      await fs.rename(payloadDirectory, finalDirectory)
+      await this.updateInstalledIndex(manifest)
+      return await this.resolveCachedManagedRuntime(entry)
+    } catch (error) {
+      throw isBrowserRuntimeError(error)
+        ? error
+        : tokenlessError(
+            'browser_runtime_install_failed',
+            `Cannot install ${entry.displayName} ${entry.artifactVersion}.`,
+            { cause: error, retryable: isRetryableInstallError(error) },
+          )
+    } finally {
+      await fs.rm(temporaryRoot, { recursive: true, force: true }).catch(() => undefined)
+    }
+  }
+
+  private async resolveCachedManagedRuntime(
+    entry: ManagedBrowserCatalogEntry,
+  ): Promise<ResolvedBrowserRuntime> {
+    const runtimeDirectory = this.managedRuntimeDirectory(entry)
+    const manifestPath = path.join(runtimeDirectory, RUNTIME_MANIFEST_FILE)
+    let manifest: RuntimeManifest
+    try {
+      const runtimeMetadata = await fs.lstat(runtimeDirectory)
+      if (!runtimeMetadata.isDirectory() || runtimeMetadata.isSymbolicLink()) {
+        throw tokenlessError('browser_runtime_cache_invalid', 'Managed browser runtime cache is not a real directory.')
+      }
+      manifest = parseRuntimeManifest(JSON.parse(await fs.readFile(manifestPath, 'utf8')), entry)
+    } catch (error) {
+      if (isErrno(error, 'ENOENT')) {
+        throw tokenlessError('browser_runtime_not_installed', `${entry.displayName} is not installed.`)
+      }
+      if (isBrowserRuntimeError(error)) throw error
+      throw tokenlessError('browser_runtime_cache_invalid', `${entry.displayName} cache metadata is invalid.`, { cause: error })
+    }
+    const executablePath = path.join(runtimeDirectory, manifest.executableRelativePath)
+    await assertExecutableInside(runtimeDirectory, executablePath)
+    const actualVersion = await browserExecutableVersion(executablePath)
+    if (actualVersion !== entry.browserVersion) {
+      throw tokenlessError(
+        'browser_runtime_version_mismatch',
+        `${entry.displayName} cache reported browser ${actualVersion}; expected ${entry.browserVersion}.`,
+      )
+    }
+    return {
+      selection: entry.family,
+      runtimeId: manifest.runtimeId,
+      family: entry.family,
+      browserId: entry.browserId,
+      displayName: entry.displayName,
+      platform: entry.platform,
+      executablePath,
+      actualVersion,
+      expectedVersion: entry.browserVersion,
+      artifactVersion: entry.artifactVersion,
+      source: 'tokenless-cache',
+      managed: true,
+      checksumVerified: true,
+      launchPolicy: entry.family === 'cloak' ? 'cloak' : 'standard',
+    }
+  }
+
+  private async requireSystemBrowser(
+    browserId: SystemBrowserId,
+    platform: BrowserRuntimePlatform,
+    browserExecutablePath: string | null | undefined,
+  ) {
+    if (browserExecutablePath) {
+      const cached = await this.resolveSystemBrowserAtPath(
+        browserId,
+        platform,
+        browserExecutablePath,
+      ).catch(() => null)
+      if (cached) return cached
+    }
+    const runtime = await this.resolveSystemBrowser(browserId, platform)
+    if (runtime) return runtime
+    throw tokenlessError(
+      'browser_executable_not_found',
+      `Browser executable for '${browserId}' was not found. Set it with tokenless config --browser ${browserId} --browser-executable-path "/absolute/path/to/browser" --json, or open tokenless dashboard and update System > Browser executable path.`,
+    )
+  }
+
+  private async resolveSystemBrowser(
+    browserId: SystemBrowserId,
+    platform: BrowserRuntimePlatform,
+  ): Promise<ResolvedBrowserRuntime | null> {
+    const executablePath = await systemBrowserExecutable(browserId, platform)
+    if (!executablePath) return null
+    return await this.resolveSystemBrowserAtPath(browserId, platform, executablePath)
+  }
+
+  private async resolveSystemBrowserAtPath(
+    browserId: SystemBrowserId,
+    platform: BrowserRuntimePlatform,
+    executablePath: string,
+  ): Promise<ResolvedBrowserRuntime> {
+    if (!path.isAbsolute(executablePath)) {
+      throw tokenlessError(
+        'browser_executable_path_invalid',
+        'Browser executable path must be absolute.',
+      )
+    }
+    await assertExecutable(executablePath)
+    const actualVersion = await browserExecutableVersion(executablePath)
+    return {
+      selection: browserId,
+      runtimeId: `system:${browserId}`,
+      family: 'system',
+      browserId,
+      displayName: systemBrowserDisplayName(browserId),
+      platform,
+      executablePath,
+      actualVersion,
+      expectedVersion: null,
+      artifactVersion: null,
+      source: 'system',
+      managed: false,
+      checksumVerified: null,
+      launchPolicy: 'standard',
+    }
+  }
+
+  private async resolveTestProfile(platform: BrowserRuntimePlatform): Promise<ResolvedBrowserRuntime> {
+    const executablePath = process.env.TOKENLESS_BROWSER_EXECUTABLE?.trim()
+    if (!executablePath) {
+      throw tokenlessError(
+        'browser_not_found',
+        'The profile browser is test-only and requires TOKENLESS_BROWSER_EXECUTABLE.',
+      )
+    }
+    await assertExecutable(executablePath)
+    return {
+      selection: 'profile',
+      runtimeId: 'test:profile',
+      family: 'test',
+      browserId: 'profile',
+      displayName: 'test browser profile',
+      platform,
+      executablePath,
+      actualVersion: await browserExecutableVersion(executablePath),
+      expectedVersion: null,
+      artifactVersion: null,
+      source: 'system',
+      managed: false,
+      checksumVerified: null,
+      launchPolicy: 'test-profile',
+    }
+  }
+
+  private managedRuntimeDirectory(entry: ManagedBrowserCatalogEntry) {
+    return path.join(this.runtimesRoot, entry.family, entry.platform, entry.artifactVersion)
+  }
+
+  private async updateInstalledIndex(manifest: RuntimeManifest) {
+    let current: { version: 1; runtimes: Record<string, RuntimeManifest> } = { version: 1, runtimes: {} }
+    try {
+      const parsed = JSON.parse(await fs.readFile(this.installedIndexFile, 'utf8')) as unknown
+      if (isRecord(parsed) && parsed.version === 1 && isRecord(parsed.runtimes)) {
+        current = { version: 1, runtimes: parsed.runtimes as Record<string, RuntimeManifest> }
+      }
+    } catch (error) {
+      if (!isErrno(error, 'ENOENT')) throw error
+    }
+    await writeJsonAtomic(this.installedIndexFile, {
+      version: 1,
+      runtimes: {
+        ...current.runtimes,
+        [manifest.runtimeId]: manifest,
+      },
+    })
+  }
+}
+
+export async function verifyAndExtractManagedBrowserArtifact(options: {
+  entry: ManagedBrowserCatalogEntry
+  archivePath: string
+  payloadDirectory: string
+  temporaryRoot: string
+  signal?: AbortSignal
+  onPhase?: (phase: BrowserRuntimeProgress['phase']) => void
+}) {
+  const { entry, archivePath, payloadDirectory, temporaryRoot } = options
+  const executablePath = path.join(payloadDirectory, entry.executableRelativePath)
+
+  options.onPhase?.('verify')
+  const actualChecksum = await sha256File(archivePath)
+  if (actualChecksum !== entry.sha256) {
+    throw tokenlessError(
+      'browser_runtime_checksum_mismatch',
+      `${entry.displayName} download checksum mismatch; refusing to extract the artifact.`,
+      { details: { expected: entry.sha256, actual: actualChecksum } },
+    )
+  }
+
+  options.onPhase?.('extract')
+  await fs.mkdir(payloadDirectory, { recursive: false, mode: 0o700 })
+  await validateArchivePaths(archivePath)
+  await runCommand('tar', ['-xf', archivePath, '-C', payloadDirectory], {
+    timeoutMs: ARCHIVE_TIMEOUT_MS,
+    maxOutputBytes: MAX_ARCHIVE_LIST_BYTES,
+  })
+  await normalizeCloakWindowsArchive(entry, payloadDirectory)
+  if (process.platform !== 'win32') await fs.chmod(executablePath, 0o755)
+  await assertExecutableInside(payloadDirectory, executablePath)
+  if (process.platform === 'darwin') {
+    await runCommand('/usr/bin/xattr', ['-cr', payloadDirectory], {
+      timeoutMs: VERSION_TIMEOUT_MS,
+      maxOutputBytes: 256 * 1024,
+    }).catch(() => undefined)
+  }
+
+  options.onPhase?.('version')
+  const actualVersion = await browserExecutableVersion(executablePath)
+  if (actualVersion !== entry.browserVersion) {
+    throw tokenlessError(
+      'browser_runtime_version_mismatch',
+      `${entry.displayName} reported browser ${actualVersion}; expected ${entry.browserVersion}.`,
+    )
+  }
+
+  options.onPhase?.('smoke-launch')
+  await smokeLaunchBrowser(executablePath, entry.family, temporaryRoot, options.signal)
+  return { executablePath, actualVersion }
+}
+
+function supportedPlatform() {
+  try {
+    return currentBrowserRuntimePlatform()
+  } catch (error) {
+    throw tokenlessError(
+      'browser_runtime_platform_unsupported',
+      error instanceof Error ? error.message : String(error),
+    )
+  }
+}
+
+function managedRuntimeId(entry: ManagedBrowserCatalogEntry) {
+  return `${entry.family}:${entry.platform}:${entry.artifactVersion}`
+}
+
+function selectionForBinding(binding: BrowserRuntimeBinding): BrowserSelection {
+  if (binding.family === 'managed-chromium') return 'managed-chromium'
+  if (binding.family === 'cloak') return 'cloak'
+  if (binding.family === 'test') return 'profile'
+  if (isSystemBrowserId(binding.browserId)) return binding.browserId
+  throw tokenlessError('profile_runtime_binding_invalid', `Profile runtime binding '${binding.runtimeId}' is invalid.`)
+}
+
+function runtimeCandidate(runtime: ResolvedBrowserRuntime): BrowserCandidate {
+  return {
+    selection: runtime.selection,
+    runtimeId: runtime.runtimeId,
+    family: runtime.family,
+    browserId: runtime.browserId,
+    displayName: runtime.displayName,
+    platform: runtime.platform,
+    version: runtime.actualVersion,
+    source: runtime.source,
+    executablePath: runtime.executablePath,
+    managed: runtime.managed,
+    installed: true,
+    downloadRequired: false,
+  }
+}
+
+async function systemBrowserExecutable(
+  browserId: SystemBrowserId,
+  platform: BrowserRuntimePlatform,
+) {
+  if (platform === 'darwin-arm64') {
+    const applicationNames: Record<SystemBrowserId, string> = {
+      chrome: 'Google Chrome.app',
+      brave: 'Brave Browser.app',
+      edge: 'Microsoft Edge.app',
+      arc: 'Arc.app',
+      chromium: 'Chromium.app',
+      'chrome-for-testing': 'Google Chrome for Testing.app',
+    }
+    const executableNames: Record<SystemBrowserId, string> = {
+      chrome: 'Google Chrome',
+      brave: 'Brave Browser',
+      edge: 'Microsoft Edge',
+      arc: 'Arc',
+      chromium: 'Chromium',
+      'chrome-for-testing': 'Google Chrome for Testing',
+    }
+    for (const applicationsRoot of ['/Applications', path.join(os.homedir(), 'Applications')]) {
+      const executablePath = path.join(
+        applicationsRoot,
+        applicationNames[browserId],
+        'Contents',
+        'MacOS',
+        executableNames[browserId],
+      )
+      if (await isExecutable(executablePath)) return executablePath
+    }
+    return null
+  }
+
+  if (browserId === 'arc') return null
+  const relativeExecutables: Record<Exclude<SystemBrowserId, 'arc'>, readonly string[]> = {
+    chrome: ['Google/Chrome/Application/chrome.exe'],
+    brave: ['BraveSoftware/Brave-Browser/Application/brave.exe'],
+    edge: ['Microsoft/Edge/Application/msedge.exe'],
+    chromium: ['Chromium/Application/chrome.exe'],
+    'chrome-for-testing': ['Google/Chrome for Testing/Application/chrome.exe'],
+  }
+  const roots = [process.env.LOCALAPPDATA, process.env.PROGRAMFILES, process.env['PROGRAMFILES(X86)']]
+    .filter((value): value is string => Boolean(value))
+  for (const root of roots) {
+    for (const relativePath of relativeExecutables[browserId]) {
+      const executablePath = path.join(root, relativePath)
+      if (await isExecutable(executablePath)) return executablePath
+    }
+  }
+  return null
+}
+
+function systemBrowserDisplayName(browserId: SystemBrowserId) {
+  const names: Record<SystemBrowserId, string> = {
+    chrome: 'Google Chrome',
+    brave: 'Brave Browser',
+    edge: 'Microsoft Edge',
+    arc: 'Arc',
+    chromium: 'Chromium',
+    'chrome-for-testing': 'Google Chrome for Testing',
+  }
+  return names[browserId]
+}
+
+async function browserExecutableVersion(executablePath: string) {
+  let output: string
+  if (process.platform === 'win32') {
+    const result = await runCommand('powershell', [
+      '-NoProfile',
+      '-NonInteractive',
+      '-Command',
+      '[System.Diagnostics.FileVersionInfo]::GetVersionInfo($env:TOKENLESS_BROWSER_EXE).ProductVersion',
+    ], {
+      timeoutMs: VERSION_TIMEOUT_MS,
+      maxOutputBytes: 256 * 1024,
+      env: { ...process.env, TOKENLESS_BROWSER_EXE: executablePath },
+    })
+    output = result.stdout
+  } else {
+    output = (await runCommand(executablePath, ['--version'], {
+      timeoutMs: VERSION_TIMEOUT_MS,
+      maxOutputBytes: 256 * 1024,
+    })).stdout
+  }
+  const match = output.match(/\d+\.\d+\.\d+\.\d+(?:\.\d+)?/)
+  if (!match) {
+    throw tokenlessError(
+      'browser_runtime_version_unreadable',
+      `Cannot determine browser version for ${executablePath}.`,
+    )
+  }
+  return match[0]
+}
+
+async function downloadArtifact(url: string, destination: string, signal: AbortSignal | undefined) {
+  const controller = new AbortController()
+  const timeout = setTimeout(() => controller.abort(), DOWNLOAD_TIMEOUT_MS)
+  const abort = () => controller.abort()
+  signal?.addEventListener('abort', abort, { once: true })
+  try {
+    const response = await fetch(url, { redirect: 'follow', signal: controller.signal })
+    if (!response.ok || !response.body) {
+      throw tokenlessError(
+        'browser_runtime_download_failed',
+        `Browser download failed with HTTP ${response.status}.`,
+        { retryable: response.status >= 500 || response.status === 429 },
+      )
+    }
+    let downloadedBytes = 0
+    const limit = new Transform({
+      transform(chunk: Buffer, _encoding, callback) {
+        downloadedBytes += chunk.length
+        if (downloadedBytes > MAX_DOWNLOAD_BYTES) {
+          callback(tokenlessError('browser_runtime_download_too_large', 'Browser download exceeded the maximum accepted size.'))
+          return
+        }
+        callback(null, chunk)
+      },
+    })
+    const readable = Readable.fromWeb(response.body as never)
+    await pipeline(readable, limit, createWriteStream(destination, { flags: 'wx', mode: 0o600 }))
+  } catch (error) {
+    if (isBrowserRuntimeError(error)) throw error
+    const aborted = controller.signal.aborted || signal?.aborted
+    throw tokenlessError(
+      aborted ? 'browser_runtime_download_aborted' : 'browser_runtime_download_failed',
+      aborted ? 'Browser download was aborted.' : 'Browser download failed.',
+      { cause: error, retryable: !aborted },
+    )
+  } finally {
+    clearTimeout(timeout)
+    signal?.removeEventListener('abort', abort)
+  }
+}
+
+async function sha256File(file: string) {
+  const hash = createHash('sha256')
+  for await (const chunk of createReadStream(file)) hash.update(chunk)
+  return hash.digest('hex')
+}
+
+async function validateArchivePaths(archivePath: string) {
+  const listing = await runCommand('tar', ['-tf', archivePath], {
+    timeoutMs: ARCHIVE_TIMEOUT_MS,
+    maxOutputBytes: MAX_ARCHIVE_LIST_BYTES,
+  })
+  const entries = listing.stdout.split(/\r?\n/).filter(Boolean)
+  if (entries.length === 0) {
+    throw tokenlessError('browser_runtime_archive_invalid', 'Browser archive is empty.')
+  }
+  for (const entry of entries) {
+    const normalized = entry.replaceAll('\\', '/')
+    const segments = normalized.split('/')
+    if (
+      normalized.startsWith('/') ||
+      /^[a-zA-Z]:\//.test(normalized) ||
+      segments.includes('..') ||
+      normalized.includes('\u0000')
+    ) {
+      throw tokenlessError('browser_runtime_archive_unsafe', `Browser archive contains an unsafe path: ${entry}`)
+    }
+  }
+}
+
+async function normalizeCloakWindowsArchive(
+  entry: ManagedBrowserCatalogEntry,
+  payloadDirectory: string,
+) {
+  if (entry.family !== 'cloak' || entry.platform !== 'win32-x64') return
+  if (await isExecutable(path.join(payloadDirectory, entry.executableRelativePath))) return
+  const children = await fs.readdir(payloadDirectory, { withFileTypes: true })
+  if (children.length !== 1 || !children[0]!.isDirectory() || children[0]!.isSymbolicLink()) return
+  const wrapperDirectory = path.join(payloadDirectory, children[0]!.name)
+  if (!await isExecutable(path.join(wrapperDirectory, entry.executableRelativePath))) return
+  for (const child of await fs.readdir(wrapperDirectory)) {
+    await fs.rename(path.join(wrapperDirectory, child), path.join(payloadDirectory, child))
+  }
+  await fs.rmdir(wrapperDirectory)
+}
+
+async function smokeLaunchBrowser(
+  executablePath: string,
+  family: ManagedBrowserFamily,
+  temporaryRoot: string,
+  signal: AbortSignal | undefined,
+) {
+  if (signal?.aborted) throw tokenlessError('browser_runtime_install_aborted', 'Browser installation was aborted.')
+  const smokeProfile = path.join(temporaryRoot, 'smoke-profile')
+  const timeoutController = new AbortController()
+  const timeout = setTimeout(() => timeoutController.abort(), SMOKE_LAUNCH_TIMEOUT_MS)
+  const abort = () => timeoutController.abort()
+  signal?.addEventListener('abort', abort, { once: true })
+  let context: Awaited<ReturnType<typeof chromium.launchPersistentContext>> | undefined
+  try {
+    const launch = chromium.launchPersistentContext(smokeProfile, {
+      executablePath,
+      headless: true,
+      chromiumSandbox: true,
+      args: [
+        '--password-store=basic',
+        '--use-mock-keychain',
+        '--disable-sync',
+        '--no-first-run',
+        '--no-default-browser-check',
+      ],
+      ...(family === 'cloak'
+        ? { ignoreDefaultArgs: ['--enable-automation', '--enable-unsafe-swiftshader'] }
+        : {}),
+      timeout: SMOKE_LAUNCH_TIMEOUT_MS,
+    })
+    context = await Promise.race([
+      launch,
+      new Promise<never>((_resolve, reject) => {
+        timeoutController.signal.addEventListener('abort', () => {
+          reject(tokenlessError('browser_runtime_smoke_launch_timeout', 'Browser smoke launch timed out.'))
+        }, { once: true })
+      }),
+    ])
+    const page = context.pages()[0] ?? await context.newPage()
+    if (await page.evaluate(() => navigator.userAgent.length > 0) !== true) {
+      throw tokenlessError('browser_runtime_smoke_launch_failed', 'Browser smoke launch did not produce a usable page.')
+    }
+  } catch (error) {
+    if (isBrowserRuntimeError(error)) throw error
+    throw tokenlessError('browser_runtime_smoke_launch_failed', 'Browser smoke launch failed.', { cause: error })
+  } finally {
+    clearTimeout(timeout)
+    signal?.removeEventListener('abort', abort)
+    await context?.close().catch(() => undefined)
+    await fs.rm(smokeProfile, { recursive: true, force: true }).catch(() => undefined)
+  }
+}
+
+async function assertExecutableInside(root: string, executablePath: string) {
+  const canonicalRoot = await fs.realpath(root)
+  const canonicalExecutable = await fs.realpath(executablePath).catch((error) => {
+    throw tokenlessError('browser_runtime_executable_missing', `Browser executable is missing: ${executablePath}.`, { cause: error })
+  })
+  if (!isPathInside(canonicalRoot, canonicalExecutable)) {
+    throw tokenlessError('browser_runtime_executable_unsafe', 'Browser executable resolves outside its runtime cache.')
+  }
+  await assertExecutable(canonicalExecutable)
+}
+
+async function assertExecutable(executablePath: string) {
+  try {
+    const metadata = await fs.stat(executablePath)
+    if (!metadata.isFile()) throw new Error('not a regular file')
+    await fs.access(executablePath, process.platform === 'win32' ? 0 : 1)
+  } catch (error) {
+    throw tokenlessError('browser_runtime_executable_missing', `Browser executable is not runnable: ${executablePath}.`, { cause: error })
+  }
+}
+
+async function isExecutable(executablePath: string) {
+  try {
+    await assertExecutable(executablePath)
+    return true
+  } catch {
+    return false
+  }
+}
+
+function parseRuntimeManifest(value: unknown, entry: ManagedBrowserCatalogEntry): RuntimeManifest {
+  if (!isRecord(value)) throw tokenlessError('browser_runtime_cache_invalid', 'Managed browser runtime manifest is malformed.')
+  const expected: RuntimeManifest = {
+    version: 1,
+    runtimeId: managedRuntimeId(entry),
+    family: entry.family,
+    browserId: entry.browserId,
+    platform: entry.platform,
+    artifactVersion: entry.artifactVersion,
+    browserVersion: entry.browserVersion,
+    sha256: entry.sha256,
+    downloadUrl: entry.downloadUrl,
+    executableRelativePath: entry.executableRelativePath,
+    installedAt: typeof value.installedAt === 'string' ? value.installedAt : '',
+    checksumVerified: true,
+    smokeLaunchVerified: true,
+  }
+  for (const [key, expectedValue] of Object.entries(expected)) {
+    if (value[key] !== expectedValue) {
+      throw tokenlessError('browser_runtime_cache_invalid', `Managed browser runtime manifest field '${key}' is invalid.`)
+    }
+  }
+  if (!expected.installedAt || Number.isNaN(Date.parse(expected.installedAt))) {
+    throw tokenlessError('browser_runtime_cache_invalid', 'Managed browser runtime install timestamp is invalid.')
+  }
+  return expected
+}
+
+async function writeJsonAtomic(file: string, value: unknown) {
+  await fs.mkdir(path.dirname(file), { recursive: true, mode: 0o700 })
+  const temporary = `${file}.${randomUUID()}.tmp`
+  try {
+    await fs.writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600, flag: 'wx' })
+    await fs.rename(temporary, file)
+  } finally {
+    await fs.rm(temporary, { force: true }).catch(() => undefined)
+  }
+}
+
+async function runCommand(
+  command: string,
+  args: readonly string[],
+  options: {
+    timeoutMs: number
+    maxOutputBytes: number
+    env?: NodeJS.ProcessEnv
+  },
+) {
+  return await new Promise<{ stdout: string; stderr: string }>((resolvePromise, reject) => {
+    const child = spawn(command, [...args], {
+      stdio: ['ignore', 'pipe', 'pipe'],
+      ...(options.env ? { env: options.env } : {}),
+    })
+    const stdout: Buffer[] = []
+    const stderr: Buffer[] = []
+    let outputBytes = 0
+    let settled = false
+    const finish = (error?: Error) => {
+      if (settled) return
+      settled = true
+      clearTimeout(timeout)
+      if (error) reject(error)
+      else resolvePromise({ stdout: Buffer.concat(stdout).toString('utf8'), stderr: Buffer.concat(stderr).toString('utf8') })
+    }
+    const collect = (target: Buffer[], chunk: Buffer) => {
+      outputBytes += chunk.length
+      if (outputBytes > options.maxOutputBytes) {
+        child.kill('SIGKILL')
+        finish(tokenlessError('browser_runtime_command_output_limit', `Command output exceeded its limit: ${command}.`))
+        return
+      }
+      target.push(chunk)
+    }
+    child.stdout.on('data', (chunk: Buffer) => collect(stdout, chunk))
+    child.stderr.on('data', (chunk: Buffer) => collect(stderr, chunk))
+    child.once('error', (error) => finish(error))
+    child.once('close', (code, signal) => {
+      if (code === 0) finish()
+      else finish(new Error(`${command} exited with ${code ?? signal}: ${Buffer.concat(stderr).toString('utf8').trim()}`))
+    })
+    const timeout = setTimeout(() => {
+      child.kill('SIGKILL')
+      finish(new Error(`${command} timed out after ${options.timeoutMs}ms.`))
+    }, options.timeoutMs)
+  })
+}
+
+function compareBrowserVersions(left: string, right: string) {
+  const leftParts = left.split('.').map(Number)
+  const rightParts = right.split('.').map(Number)
+  for (let index = 0; index < Math.max(leftParts.length, rightParts.length); index += 1) {
+    const difference = (leftParts[index] ?? 0) - (rightParts[index] ?? 0)
+    if (difference !== 0) return difference < 0 ? -1 : 1
+  }
+  return 0
+}
+
+function isPathInside(root: string, candidate: string) {
+  const relative = path.relative(root, candidate)
+  return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative))
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value && typeof value === 'object' && !Array.isArray(value))
+}
+
+function isErrno(error: unknown, code: string) {
+  return Boolean(error && typeof error === 'object' && 'code' in error && error.code === code)
+}
+
+function errorCode(error: unknown) {
+  return error && typeof error === 'object' && 'code' in error && typeof error.code === 'string'
+    ? error.code
+    : 'browser_runtime_unexpected_error'
+}
+
+function isBrowserRuntimeError(error: unknown) {
+  return error instanceof Error && error.name === 'TokenlessPlaywrightError'
+}
+
+function isRetryableInstallError(error: unknown) {
+  return errorCode(error) === 'browser_runtime_download_failed'
+}
diff --git a/packages/cli/src/browser-runtime/types.ts b/packages/cli/src/browser-runtime/types.ts
new file mode 100644
index 0000000..18b5139
--- /dev/null
+++ b/packages/cli/src/browser-runtime/types.ts
@@ -0,0 +1,113 @@
+export const SYSTEM_BROWSER_IDS = Object.freeze([
+  'chrome',
+  'brave',
+  'edge',
+  'arc',
+  'chromium',
+  'chrome-for-testing',
+] as const)
+
+export const BROWSER_SELECTIONS = Object.freeze([
+  'auto',
+  ...SYSTEM_BROWSER_IDS,
+  'managed-chromium',
+  'cloak',
+  'profile',
+] as const)
+
+export type SystemBrowserId = (typeof SYSTEM_BROWSER_IDS)[number]
+export type BrowserSelection = (typeof BROWSER_SELECTIONS)[number]
+export type ManagedBrowserFamily = 'managed-chromium' | 'cloak'
+export type BrowserRuntimeFamily = 'system' | ManagedBrowserFamily | 'test'
+export type BrowserLaunchPolicy = 'standard' | 'cloak' | 'test-profile'
+export type BrowserRuntimePlatform = 'darwin-arm64' | 'win32-x64'
+
+export type BrowserRuntimeBinding = {
+  runtimeId: string
+  family: BrowserRuntimeFamily
+  browserId: string
+  createdWithVersion: string
+  profileFormat: 1
+}
+
+export type BrowserCandidate = {
+  selection: BrowserSelection
+  runtimeId: string
+  family: BrowserRuntimeFamily
+  browserId: string
+  displayName: string
+  platform: BrowserRuntimePlatform
+  version: string
+  source: 'system' | 'tokenless-cache'
+  executablePath: string
+  managed: boolean
+  installed: boolean
+  downloadRequired: boolean
+}
+
+export type ResolvedBrowserRuntime = {
+  selection: BrowserSelection
+  runtimeId: string
+  family: BrowserRuntimeFamily
+  browserId: string
+  displayName: string
+  platform: BrowserRuntimePlatform
+  executablePath: string
+  actualVersion: string
+  expectedVersion: string | null
+  artifactVersion: string | null
+  source: 'system' | 'tokenless-cache'
+  managed: boolean
+  checksumVerified: boolean | null
+  launchPolicy: BrowserLaunchPolicy
+}
+
+export type BrowserRuntimeInspection = {
+  ok: boolean
+  selection: BrowserSelection | null
+  runtime: ResolvedBrowserRuntime | null
+  code: string | null
+  message: string | null
+}
+
+export type BrowserRuntimeProgress = {
+  phase: 'download' | 'verify' | 'extract' | 'version' | 'smoke-launch' | 'install'
+  family: ManagedBrowserFamily
+  displayName: string
+  version: string
+}
+
+export type EnsureBrowserRuntimeOptions = {
+  allowDownload?: boolean
+  repair?: boolean
+  browserExecutablePath?: string | null
+  signal?: AbortSignal
+  onProgress?: (progress: BrowserRuntimeProgress) => void
+}
+
+export function normalizeBrowserSelection(value: unknown): BrowserSelection | null {
+  if (typeof value !== 'string') return null
+  const normalized = value.trim().toLowerCase().replace(/[_\s]+/g, '-')
+  if (!normalized) return null
+  const aliases: Record<string, BrowserSelection> = {
+    'google-chrome': 'chrome',
+    googlechrome: 'chrome',
+    'chrome-testing': 'chrome-for-testing',
+    'chrome-for-testing-legacy': 'chrome-for-testing',
+    'chromium-browser': 'chromium',
+    'microsoft-edge': 'edge',
+    msedge: 'edge',
+    'brave-browser': 'brave',
+    managed: 'managed-chromium',
+    'tokenless-chromium': 'managed-chromium',
+    cloakbrowser: 'cloak',
+  }
+  const selection = aliases[normalized] ?? normalized
+  return BROWSER_SELECTIONS.includes(selection as BrowserSelection)
+    ? selection as BrowserSelection
+    : null
+}
+
+export function isSystemBrowserId(value: unknown): value is SystemBrowserId {
+  return typeof value === 'string' && SYSTEM_BROWSER_IDS.includes(value as SystemBrowserId)
+}
diff --git a/packages/cli/src/daemon-client.ts b/packages/cli/src/daemon-client.ts
index bf334b9..c0a3d7c 100644
--- a/packages/cli/src/daemon-client.ts
+++ b/packages/cli/src/daemon-client.ts
@@ -2,9 +2,11 @@ import fs from 'node:fs/promises'
 import path from 'node:path'
 
 import { tokenlessHome } from './job-store.js'
+import { DaemonRuntimeState } from './daemon/runtime-state.js'
+import type { ProviderCapacityProjection } from './providers/rate-limit-policy.js'
 
 export const DEFAULT_DAEMON_URL = 'http://127.0.0.1:7331'
-export const MAX_NATIVE_MESSAGE_BYTES = 900 * 1024
+export const MAX_DAEMON_REQUEST_BYTES = 900 * 1024
 const DEFAULT_DAEMON_REQUEST_TIMEOUT_MS = 5_000
 const DEFAULT_CANCEL_REQUEST_TIMEOUT_MS = 3_000
 
@@ -15,55 +17,96 @@ export type DaemonClientOptions = {
   signal?: AbortSignal | undefined
 }
 
+export type DaemonJobStatus = 'queued' | 'claimed' | 'running' | 'waiting_for_user' | 'succeeded' | 'failed' | 'canceled' | 'timed_out'
+
 export type DaemonJob = {
   job_id: string
-  execution_backend?: 'legacy_extension' | 'playwright'
+  execution_backend?: 'playwright'
   profile_id?: string | null
   provider: string
   action: string
-  status: string
+  status: DaemonJobStatus
   request_json: unknown
   result_json: unknown | null
   error_json: unknown | null
   blocker_json: unknown | null
+  provider_attempts_json: unknown
+  provider_submitted_at: string | null
+  eligible_at: string | null
   created_at: string
   updated_at: string
 }
 
-export type DaemonClaimedJob = DaemonJob & {
-  claim_token: string
-}
-
 export type CreateDaemonJobOptions = DaemonClientOptions & {
   provider: string
   action: string
   requestJson?: unknown
-  executionBackend?: 'legacy_extension' | 'playwright' | undefined
+  executionBackend?: 'playwright' | undefined
   profileId?: string | undefined
+  agentKind?: string | undefined
+  agentSessionId?: string | undefined
   jobId?: string | undefined
-  claimToken?: string | undefined
 }
 
-export type ClaimNextDaemonJobOptions = DaemonClientOptions & {
-  provider?: string | undefined
-  action?: string | undefined
-  executionBackend?: 'legacy_extension' | 'playwright' | undefined
-  profileId?: string | undefined
+export type AgentRecipientOptions = {
+  agentKind: string
+  agentSessionId: string
 }
 
+export type DaemonReplaySummary = {
+  job_id: string
+  provider: string
+  action: string
+  status: 'waiting_for_user' | 'succeeded' | 'failed' | 'canceled' | 'timed_out'
+  task_id: string | null
+  updated_at: string
+  reported_at: string
+  outcome_kind: 'result' | 'error' | 'blocker' | 'none'
+  has_result: boolean
+  has_error: boolean
+  has_blocker: boolean
+}
+
+export type DrainDaemonReplayOptions = DaemonClientOptions & AgentRecipientOptions & {
+  limit?: number | undefined
+}
+
+export type MarkDaemonJobReportedOptions = GetDaemonJobOptions & AgentRecipientOptions
+
 export type GetDaemonJobOptions = DaemonClientOptions & {
   jobId: string
 }
 
 export type ListDaemonJobsOptions = DaemonClientOptions & {
   status?: string | undefined
-  executionBackend?: 'legacy_extension' | 'playwright' | undefined
+  executionBackend?: 'playwright' | undefined
   profileId?: string | undefined
   provider?: string | undefined
   taskId?: string | undefined
   limit?: number | undefined
 }
 
+export type ResolveProviderMappingOptions = DaemonClientOptions & {
+  provider: string
+  profileId: string
+  projectName: string
+  taskId?: string | undefined
+}
+
+export type ResolveProviderConversationOptions = DaemonClientOptions & {
+  provider: string
+  profileId: string
+  taskId: string
+}
+
+export type GetProviderCapacityOptions = DaemonClientOptions & {
+  provider: string
+  profileId: string
+  accessClass: string
+  tierLabel?: string | null | undefined
+  subscriptionLabel?: string | null | undefined
+}
+
 export type CancelDaemonJobOptions = GetDaemonJobOptions & {
   reason?: unknown
 }
@@ -72,24 +115,84 @@ export type ResumeDaemonJobOptions = GetDaemonJobOptions & {
   browserVisibility: 'headed'
 }
 
-export type CompleteDaemonJobOptions = DaemonClientOptions & {
-  jobId: string
-  claimToken: string
-  result?: unknown
-  error?: unknown
-}
-
 export type WaitDaemonJobResultOptions = GetDaemonJobOptions & {
   timeoutMs?: number | undefined
   pollMs?: number | undefined
   heartbeatMs?: number | undefined
   onStatus?: ((event: Record<string, unknown>) => unknown) | undefined
+  agentKind?: string | undefined
+  agentSessionId?: string | undefined
+}
+
+export type ShutdownDaemonOptions = {
+  daemonUrl?: string | undefined
+  requestTimeoutMs?: number | undefined
+  signal?: AbortSignal | undefined
+  controlToken: string
+}
+
+export type ShutdownDaemonResponse = {
+  ok: boolean
+  status: 'shutting_down'
+  pid?: number | undefined
+}
+
+export type BrowserRuntimeStatus = {
+  status: 'running' | 'quiescing' | 'quiesced' | 'stopped'
+  activeProfileCount: number
+  activeJobCount: number
+  pid: number
+}
+
+export type BrowserRuntimeOpenProfileOptions = DaemonClientOptions & {
+  profileId: string
+  browserVisibility: 'auto' | 'headed' | 'headless'
+}
+
+export type BrowserRuntimeOpenProfileResponse = {
+  profileId: string
+  browserVisibility: 'auto' | 'headed' | 'headless'
+  effectiveBrowserVisibility: 'headed' | 'headless'
+  pageCount: number
+  status: BrowserRuntimeStatus
+}
+
+export type BrowserRuntimeOpenProviderTabsOptions = DaemonClientOptions & {
+  profileId: string
+  providers: readonly string[]
+  browserVisibility: 'auto' | 'headed' | 'headless'
+}
+
+export type BrowserRuntimeOpenProviderTabsResponse = BrowserRuntimeOpenProfileResponse & {
+  tabs: readonly {
+    provider: string
+    url: string
+    reused: boolean
+  }[]
+  failures: readonly {
+    provider: string
+    code: 'provider_tab_open_failed'
+    message: string
+  }[]
+}
+
+export type OpenDashboardOptions = DaemonClientOptions & {
+  profileId?: string | undefined
+  open?: boolean | undefined
+}
+
+export type OpenDashboardResponse = {
+  ticket: string
+  bootstrapUrl: string
+  expiresAt: string
+  opened: null | (BrowserRuntimeOpenProfileResponse & { url: string, reused: boolean })
 }
 
 type DaemonError = Error & {
   code?: string
   retryable?: boolean
   status?: number
+  details?: unknown
 }
 
 export function daemonUrl(explicitUrl?: string) {
@@ -127,13 +230,21 @@ export async function createDaemonJob({
   requestJson = {},
   executionBackend,
   profileId,
+  agentKind,
+  agentSessionId,
   jobId,
-  claimToken,
 }: CreateDaemonJobOptions) {
-  assertNativeMessageSize({ provider, action, request_json: requestJson })
-  const token = await authenticatedDaemonToken({ daemonUrl: explicitDaemonUrl, homeDir, requestTimeoutMs })
-  return daemonRequest<DaemonClaimedJob>({
-    daemonUrl: explicitDaemonUrl,
+  assertAgentRecipientPair(agentKind, agentSessionId)
+  assertDaemonRequestSize({
+    provider,
+    action,
+    request_json: requestJson,
+    agent_kind: agentKind,
+    agent_session_id: agentSessionId,
+  })
+  const daemon = await authenticatedDaemonAccess({ daemonUrl: explicitDaemonUrl, homeDir, requestTimeoutMs })
+  return daemonRequest<DaemonJob>({
+    daemonUrl: daemon.daemonUrl,
     path: '/jobs',
     body: {
       provider,
@@ -141,10 +252,60 @@ export async function createDaemonJob({
       request_json: requestJson,
       execution_backend: executionBackend,
       profile_id: profileId,
+      agent_kind: agentKind,
+      agent_session_id: agentSessionId,
       job_id: jobId,
-      claim_token: claimToken,
     },
-    token,
+    token: daemon.token,
+    timeoutMs: requestTimeoutMs,
+    signal,
+  })
+}
+
+export async function drainDaemonReplay({
+  daemonUrl: explicitDaemonUrl,
+  homeDir,
+  requestTimeoutMs,
+  signal,
+  agentKind,
+  agentSessionId,
+  limit,
+}: DrainDaemonReplayOptions) {
+  assertAgentRecipientPair(agentKind, agentSessionId)
+  const daemon = await authenticatedDaemonAccess({ daemonUrl: explicitDaemonUrl, homeDir, requestTimeoutMs })
+  return daemonRequest<{ jobs: DaemonReplaySummary[] }>({
+    daemonUrl: daemon.daemonUrl,
+    path: '/replay/drain',
+    body: {
+      agent_kind: agentKind,
+      agent_session_id: agentSessionId,
+      limit,
+    },
+    token: daemon.token,
+    timeoutMs: requestTimeoutMs,
+    signal,
+  })
+}
+
+export async function markDaemonJobReported({
+  daemonUrl: explicitDaemonUrl,
+  homeDir,
+  requestTimeoutMs,
+  signal,
+  jobId,
+  agentKind,
+  agentSessionId,
+}: MarkDaemonJobReportedOptions) {
+  assertAgentRecipientPair(agentKind, agentSessionId)
+  const daemon = await authenticatedDaemonAccess({ daemonUrl: explicitDaemonUrl, homeDir, requestTimeoutMs })
+  return daemonRequest<{ reported: boolean; job: DaemonJob }>({
+    daemonUrl: daemon.daemonUrl,
+    path: `/jobs/${encodeURIComponent(jobId)}/report`,
+    body: {
+      agent_kind: agentKind,
+      agent_session_id: agentSessionId,
+    },
+    token: daemon.token,
     timeoutMs: requestTimeoutMs,
     signal,
   })
@@ -162,7 +323,7 @@ export async function listDaemonJobs({
   taskId,
   limit = 100,
 }: ListDaemonJobsOptions = {}) {
-  const token = await authenticatedDaemonToken({ daemonUrl: explicitDaemonUrl, homeDir, requestTimeoutMs })
+  const daemon = await authenticatedDaemonAccess({ daemonUrl: explicitDaemonUrl, homeDir, requestTimeoutMs })
   const query = new URLSearchParams()
   if (status) query.set('status', status)
   if (executionBackend) query.set('execution_backend', executionBackend)
@@ -171,10 +332,10 @@ export async function listDaemonJobs({
   if (taskId) query.set('task_id', taskId)
   query.set('limit', String(Math.max(1, Math.min(1000, Number(limit) || 100))))
   return daemonRequest<DaemonJob[]>({
-    daemonUrl: explicitDaemonUrl,
+    daemonUrl: daemon.daemonUrl,
     method: 'GET',
     path: `/jobs?${query.toString()}`,
-    token,
+    token: daemon.token,
     timeoutMs: requestTimeoutMs,
     signal,
   })
@@ -187,93 +348,261 @@ export async function getDaemonJob({
   signal,
   jobId,
 }: GetDaemonJobOptions) {
-  const token = await authenticatedDaemonToken({ daemonUrl: explicitDaemonUrl, homeDir, requestTimeoutMs })
+  const daemon = await authenticatedDaemonAccess({ daemonUrl: explicitDaemonUrl, homeDir, requestTimeoutMs })
   return daemonRequest<DaemonJob>({
-    daemonUrl: explicitDaemonUrl,
+    daemonUrl: daemon.daemonUrl,
     method: 'GET',
     path: `/jobs/${encodeURIComponent(jobId)}`,
-    token,
+    token: daemon.token,
     timeoutMs: requestTimeoutMs,
     signal,
   })
 }
 
-export async function claimNextDaemonJob({
+export async function getProviderCapacity({
   daemonUrl: explicitDaemonUrl,
   homeDir,
   requestTimeoutMs,
   signal,
   provider,
-  action,
-  executionBackend,
   profileId,
-}: ClaimNextDaemonJobOptions = {}) {
-  const token = await authenticatedDaemonToken({ daemonUrl: explicitDaemonUrl, homeDir, requestTimeoutMs })
-  const query = new URLSearchParams()
-  if (executionBackend) query.set('execution_backend', executionBackend)
-  if (profileId) query.set('profile_id', profileId)
-  if (provider) query.set('provider', provider)
-  if (action) query.set('action', action)
-  const suffix = query.size > 0 ? `?${query.toString()}` : ''
+  accessClass,
+  tierLabel,
+  subscriptionLabel,
+}: GetProviderCapacityOptions) {
+  const daemon = await authenticatedDaemonAccess({ daemonUrl: explicitDaemonUrl, homeDir, requestTimeoutMs })
+  const query = new URLSearchParams({
+    provider,
+    profile_id: profileId,
+    access_class: accessClass,
+  })
+  if (tierLabel) query.set('tier_label', tierLabel)
+  if (subscriptionLabel) query.set('subscription_label', subscriptionLabel)
+  return daemonRequest<ProviderCapacityProjection>({
+    daemonUrl: daemon.daemonUrl,
+    method: 'GET',
+    path: `/provider-capacity?${query.toString()}`,
+    token: daemon.token,
+    timeoutMs: requestTimeoutMs,
+    signal,
+  })
+}
 
-  return daemonRequest<{ job: DaemonClaimedJob | null }>({
-    daemonUrl: explicitDaemonUrl,
-    path: `/control/jobs/claim-next${suffix}`,
-    token,
+export async function resolveProviderMapping({
+  daemonUrl: explicitDaemonUrl,
+  homeDir,
+  requestTimeoutMs,
+  signal,
+  provider,
+  profileId,
+  projectName,
+  taskId,
+}: ResolveProviderMappingOptions) {
+  const daemon = await authenticatedDaemonAccess({ daemonUrl: explicitDaemonUrl, homeDir, requestTimeoutMs })
+  const query = new URLSearchParams({
+    provider,
+    profile_id: profileId,
+    project_name: projectName,
+  })
+  if (taskId) query.set('task_id', taskId)
+  return daemonRequest<{
+    mapping: {
+      project: {
+        provider: string
+        profile_id: string
+        resource_id: string
+        name: string
+        canonical_url: string
+      }
+      conversation: {
+        provider: string
+        profile_id: string
+        project_resource_id: string
+        task_id: string
+        canonical_url: string
+      } | null
+    } | null
+  }>({
+    daemonUrl: daemon.daemonUrl,
+    method: 'GET',
+    path: `/provider-mappings/resolve?${query.toString()}`,
+    token: daemon.token,
     timeoutMs: requestTimeoutMs,
     signal,
   })
 }
 
-export async function completeDaemonJob({
+export async function resolveProviderConversation({
   daemonUrl: explicitDaemonUrl,
   homeDir,
   requestTimeoutMs,
   signal,
+  provider,
+  profileId,
+  taskId,
+}: ResolveProviderConversationOptions) {
+  const daemon = await authenticatedDaemonAccess({ daemonUrl: explicitDaemonUrl, homeDir, requestTimeoutMs })
+  const query = new URLSearchParams({
+    provider,
+    profile_id: profileId,
+    task_id: taskId,
+  })
+  return daemonRequest<{
+    mapping: {
+      provider: string
+      profile_id: string
+      task_id: string
+      canonical_url: string
+      proved_job_id: string
+      observed_at: string
+    } | null
+  }>({
+    daemonUrl: daemon.daemonUrl,
+    method: 'GET',
+    path: `/provider-conversations/resolve?${query.toString()}`,
+    token: daemon.token,
+    timeoutMs: requestTimeoutMs,
+    signal,
+  })
+}
+
+export async function cancelDaemonJob({
+  daemonUrl: explicitDaemonUrl,
+  homeDir,
+  requestTimeoutMs = DEFAULT_CANCEL_REQUEST_TIMEOUT_MS,
+  signal,
   jobId,
-  claimToken,
-  result,
-  error,
-}: CompleteDaemonJobOptions) {
-  const hasResult = result !== undefined
-  const hasError = error !== undefined
-  if (hasResult === hasError) {
+  reason,
+}: CancelDaemonJobOptions) {
+  const daemon = await authenticatedDaemonAccess({ daemonUrl: explicitDaemonUrl, homeDir, requestTimeoutMs })
+  return daemonRequest<DaemonJob>({
+    daemonUrl: daemon.daemonUrl,
+    path: `/jobs/${encodeURIComponent(jobId)}/cancel`,
+    ...(reason === undefined ? {} : { body: { reason } }),
+    token: daemon.token,
+    timeoutMs: requestTimeoutMs,
+    signal,
+  })
+}
+
+export async function shutdownDaemon({
+  daemonUrl: explicitDaemonUrl,
+  requestTimeoutMs,
+  signal,
+  controlToken,
+}: ShutdownDaemonOptions) {
+  if (typeof controlToken !== 'string' || !controlToken) {
     throw daemonClientError(
-      'invalid_daemon_completion',
-      'Pass exactly one of result or error when completing a daemon job.',
+      'daemon_shutdown_token_invalid',
+      'A non-empty daemon control token is required to stop the daemon.',
       false
     )
   }
-
-  const token = await authenticatedDaemonToken({ daemonUrl: explicitDaemonUrl, homeDir, requestTimeoutMs })
-  return daemonRequest<DaemonJob>({
+  return daemonRequest<ShutdownDaemonResponse>({
     daemonUrl: explicitDaemonUrl,
-    path: `/jobs/${encodeURIComponent(jobId)}/complete`,
+    path: '/control/shutdown',
+    token: controlToken,
+    timeoutMs: requestTimeoutMs,
+    signal,
+  })
+}
+
+export async function browserRuntimeStatus({
+  daemonUrl: explicitDaemonUrl,
+  homeDir,
+  requestTimeoutMs,
+  signal,
+}: DaemonClientOptions = {}) {
+  const daemon = await authenticatedDaemonAccess({ daemonUrl: explicitDaemonUrl, homeDir, requestTimeoutMs })
+  return daemonRequest<BrowserRuntimeStatus>({
+    daemonUrl: daemon.daemonUrl,
+    method: 'GET',
+    path: '/control/browser-runtime/status',
+    token: daemon.token,
+    timeoutMs: requestTimeoutMs,
+    signal,
+  })
+}
+
+export async function quiesceBrowserRuntime({
+  daemonUrl: explicitDaemonUrl,
+  homeDir,
+  requestTimeoutMs,
+  signal,
+}: DaemonClientOptions = {}) {
+  const daemon = await authenticatedDaemonAccess({ daemonUrl: explicitDaemonUrl, homeDir, requestTimeoutMs })
+  return daemonRequest<BrowserRuntimeStatus>({
+    daemonUrl: daemon.daemonUrl,
+    path: '/control/browser-runtime/quiesce',
+    token: daemon.token,
+    timeoutMs: requestTimeoutMs,
+    signal,
+  })
+}
+
+export async function openBrowserRuntimeProfile({
+  daemonUrl: explicitDaemonUrl,
+  homeDir,
+  requestTimeoutMs,
+  signal,
+  profileId,
+  browserVisibility,
+}: BrowserRuntimeOpenProfileOptions) {
+  const daemon = await authenticatedDaemonAccess({ daemonUrl: explicitDaemonUrl, homeDir, requestTimeoutMs })
+  return daemonRequest<BrowserRuntimeOpenProfileResponse>({
+    daemonUrl: daemon.daemonUrl,
+    path: '/control/browser-runtime/open-profile',
     body: {
-      claim_token: claimToken,
-      result_json: hasResult ? result : undefined,
-      error_json: hasError ? error : undefined,
+      profile_id: profileId,
+      browser_visibility: browserVisibility,
     },
-    token,
+    token: daemon.token,
     timeoutMs: requestTimeoutMs,
     signal,
   })
 }
 
-export async function cancelDaemonJob({
+export async function openBrowserRuntimeProviderTabs({
   daemonUrl: explicitDaemonUrl,
   homeDir,
-  requestTimeoutMs = DEFAULT_CANCEL_REQUEST_TIMEOUT_MS,
+  requestTimeoutMs,
   signal,
-  jobId,
-  reason,
-}: CancelDaemonJobOptions) {
-  const token = await authenticatedDaemonToken({ daemonUrl: explicitDaemonUrl, homeDir, requestTimeoutMs })
-  return daemonRequest<DaemonJob>({
-    daemonUrl: explicitDaemonUrl,
-    path: `/control/jobs/${encodeURIComponent(jobId)}/cancel`,
-    ...(reason === undefined ? {} : { body: { reason } }),
-    token,
+  profileId,
+  providers,
+  browserVisibility,
+}: BrowserRuntimeOpenProviderTabsOptions) {
+  const daemon = await authenticatedDaemonAccess({ daemonUrl: explicitDaemonUrl, homeDir, requestTimeoutMs })
+  return daemonRequest<BrowserRuntimeOpenProviderTabsResponse>({
+    daemonUrl: daemon.daemonUrl,
+    path: '/control/browser-runtime/open-provider-tabs',
+    body: {
+      profile_id: profileId,
+      providers,
+      browser_visibility: browserVisibility,
+    },
+    token: daemon.token,
+    timeoutMs: requestTimeoutMs,
+    signal,
+  })
+}
+
+export async function openTokenlessDashboard({
+  daemonUrl: explicitDaemonUrl,
+  homeDir,
+  requestTimeoutMs,
+  signal,
+  profileId,
+  open = true,
+}: OpenDashboardOptions = {}) {
+  const daemon = await authenticatedDaemonAccess({ daemonUrl: explicitDaemonUrl, homeDir, requestTimeoutMs })
+  return daemonRequest<OpenDashboardResponse>({
+    daemonUrl: daemon.daemonUrl,
+    path: '/control/ui-bootstrap',
+    body: {
+      ...(profileId ? { profile_id: profileId } : {}),
+      open,
+    },
+    token: daemon.token,
     timeoutMs: requestTimeoutMs,
     signal,
   })
@@ -294,12 +623,12 @@ export async function resumeDaemonJob({
       false
     )
   }
-  const token = await authenticatedDaemonToken({ daemonUrl: explicitDaemonUrl, homeDir, requestTimeoutMs })
+  const daemon = await authenticatedDaemonAccess({ daemonUrl: explicitDaemonUrl, homeDir, requestTimeoutMs })
   return daemonRequest<DaemonJob>({
-    daemonUrl: explicitDaemonUrl,
+    daemonUrl: daemon.daemonUrl,
     path: `/jobs/${encodeURIComponent(jobId)}/resume`,
     body: { browser_visibility: browserVisibility },
-    token,
+    token: daemon.token,
     timeoutMs: requestTimeoutMs,
     signal,
   })
@@ -315,7 +644,10 @@ export async function waitDaemonJobResult({
   pollMs = 250,
   heartbeatMs = 30000,
   onStatus,
+  agentKind,
+  agentSessionId,
 }: WaitDaemonJobResultOptions) {
+  assertAgentRecipientPair(agentKind, agentSessionId)
   const startedAt = Date.now()
   let lastStatus: string | undefined
   let lastHeartbeatAt = startedAt
@@ -345,6 +677,15 @@ export async function waitDaemonJobResult({
       })
     }
     if (job.status === 'succeeded') {
+      await markOutcomeReportedIfAddressed({
+        daemonUrl: explicitDaemonUrl,
+        homeDir,
+        requestTimeoutMs,
+        signal,
+        jobId,
+        agentKind,
+        agentSessionId,
+      })
       return {
         ok: true,
         status: job.status,
@@ -354,6 +695,15 @@ export async function waitDaemonJobResult({
       }
     }
     if (job.status === 'failed' || job.status === 'canceled' || job.status === 'timed_out') {
+      await markOutcomeReportedIfAddressed({
+        daemonUrl: explicitDaemonUrl,
+        homeDir,
+        requestTimeoutMs,
+        signal,
+        jobId,
+        agentKind,
+        agentSessionId,
+      })
       return {
         ok: false,
         status: job.status,
@@ -366,6 +716,15 @@ export async function waitDaemonJobResult({
       }
     }
     if (job.status === 'waiting_for_user') {
+      await markOutcomeReportedIfAddressed({
+        daemonUrl: explicitDaemonUrl,
+        homeDir,
+        requestTimeoutMs,
+        signal,
+        jobId,
+        agentKind,
+        agentSessionId,
+      })
       return {
         ok: null,
         status: job.status,
@@ -402,17 +761,49 @@ export async function waitDaemonJobResult({
   )
 }
 
+async function markOutcomeReportedIfAddressed({
+  agentKind,
+  agentSessionId,
+  ...options
+}: GetDaemonJobOptions & {
+  agentKind?: string | undefined
+  agentSessionId?: string | undefined
+}) {
+  if (agentKind === undefined || agentSessionId === undefined) return
+  await markDaemonJobReported({
+    ...options,
+    agentKind,
+    agentSessionId,
+  })
+}
+
+function assertAgentRecipientPair(agentKind: string | undefined, agentSessionId: string | undefined) {
+  if ((agentKind === undefined) !== (agentSessionId === undefined)) {
+    throw daemonClientError(
+      'agent_recipient_incomplete',
+      'agentKind and agentSessionId must be provided together.',
+      false
+    )
+  }
+  if (agentKind !== undefined && agentKind.trim() === '') {
+    throw daemonClientError('agent_kind_invalid', 'agentKind must be a non-empty string.', false)
+  }
+  if (agentSessionId !== undefined && agentSessionId.trim() === '') {
+    throw daemonClientError('agent_session_id_invalid', 'agentSessionId must be a non-empty string.', false)
+  }
+}
+
 function userHandoverAction(job: DaemonJob) {
   const blocker = jsonRecord(job.blocker_json)
   const browser = jsonRecord(blocker.browser)
   const windowOpen = browser.windowOpen !== false
   return {
     message: windowOpen
-      ? 'The visible managed browser is open. Manually complete the provider verification or sign-in there, then query the same Tokenless task again.'
-      : 'This headless job requires user interaction and no browser window is open. Resume the same job with headed visibility.',
+      ? 'Your help is needed: complete provider sign-in or verification in the visible browser. Tokenless will preserve this job and continue afterward.'
+      : 'Your help is needed, but no browser window is open. Resume this same job in headed mode; do not create a replacement job.',
     resumeCommand: windowOpen ? jobIdStateCommand(job) : jobIdHeadedResumeCommand(job),
     queryGuidance: windowOpen
-      ? 'Run tokenless state --job-id <jobId> --json after the user confirms completion.'
+      ? 'After completing sign-in or verification, query this same job; Tokenless will continue from its saved checkpoint.'
       : 'Do not submit a replacement job; resume this exact job with headed visibility.',
   }
 }
@@ -494,8 +885,14 @@ async function daemonRequest<T>({
     throw daemonClientError('daemon_unavailable', 'Tokenless daemon is not reachable on the configured loopback URL.', true)
   }
   if (!response.ok) {
-    const message = errorMessageFromBody(responseBody) || `Tokenless daemon request failed with HTTP ${response.status}.`
-    throw daemonClientError('daemon_request_failed', message, response.status >= 500, response.status)
+    const serverError = daemonServerErrorFromBody(responseBody)
+    throw daemonClientError(
+      serverError?.code ?? 'daemon_request_failed',
+      serverError?.message ?? `Tokenless daemon request failed with HTTP ${response.status}.`,
+      serverError?.retryable ?? response.status >= 500,
+      response.status,
+      serverError?.details
+    )
   }
   return responseBody as T
 }
@@ -510,19 +907,34 @@ async function readJsonResponse(response: Response) {
   }
 }
 
-function errorMessageFromBody(body: unknown) {
+function daemonServerErrorFromBody(body: unknown) {
   if (!body || typeof body !== 'object') return null
   const error = (body as { error?: unknown }).error
   if (!error || typeof error !== 'object') return null
-  const message = (error as { message?: unknown }).message
-  return typeof message === 'string' && message.trim() ? message : null
+  const envelope = error as { code?: unknown; message?: unknown; retryable?: unknown; details?: unknown }
+  if (
+    typeof envelope.code === 'string' &&
+    envelope.code.trim() &&
+    typeof envelope.message === 'string' &&
+    envelope.message.trim() &&
+    typeof envelope.retryable === 'boolean'
+  ) {
+    return {
+      code: envelope.code,
+      message: envelope.message,
+      retryable: envelope.retryable,
+      details: envelope.details,
+    }
+  }
+  return null
 }
 
-function daemonClientError(code: string, message: string, retryable: boolean, status?: number) {
+function daemonClientError(code: string, message: string, retryable: boolean, status?: number, details?: unknown) {
   const error = new Error(message) as DaemonError
   error.code = code
   error.retryable = retryable
   if (status !== undefined) error.status = status
+  if (details !== undefined) error.details = details
   return error
 }
 
@@ -550,7 +962,7 @@ function stripUndefined(value: Record<string, unknown>) {
   return Object.fromEntries(Object.entries(value).filter((entry) => entry[1] !== undefined))
 }
 
-function assertNativeMessageSize(value: unknown) {
+function assertDaemonRequestSize(value: unknown) {
   let serialized: string
   try {
     serialized = JSON.stringify(value)
@@ -558,10 +970,10 @@ function assertNativeMessageSize(value: unknown) {
     throw daemonClientError('invalid_daemon_request', 'Tokenless request must be JSON serializable.', false)
   }
   const bytes = Buffer.byteLength(serialized, 'utf8')
-  if (bytes > MAX_NATIVE_MESSAGE_BYTES) {
+  if (bytes > MAX_DAEMON_REQUEST_BYTES) {
     throw daemonClientError(
-      'native_message_too_large',
-      `Tokenless request is ${bytes} bytes; keep it below ${MAX_NATIVE_MESSAGE_BYTES} bytes. Attach fewer or smaller files.`,
+      'daemon_request_too_large',
+      `Tokenless request is ${bytes} bytes; keep it below ${MAX_DAEMON_REQUEST_BYTES} bytes. Attach fewer or smaller files.`,
       false
     )
   }
@@ -648,27 +1060,51 @@ function errorText(error: unknown) {
   return error instanceof Error && error.message ? error.message : String(error)
 }
 
-async function authenticatedDaemonToken({
+async function authenticatedDaemonAccess({
   daemonUrl: explicitDaemonUrl,
   homeDir = tokenlessHome(),
   requestTimeoutMs,
 }: DaemonClientOptions) {
   const token = await readDaemonToken({ homeDir })
   const { probeDaemonReady } = await import('./runtime.js')
-  const ready = await probeDaemonReady({
-    daemonUrl: explicitDaemonUrl,
-    homeDir,
-    daemonToken: token,
-    timeoutMs: Math.min(normalizedTimeoutMs(requestTimeoutMs), 1_000),
-  })
-  if (!ready.ok) {
-    throw daemonClientError(
-      ready.code ?? 'daemon_identity_unverified',
-      ready.message ?? 'Tokenless daemon identity could not be verified; refusing to send its control token.',
-      ready.code === 'daemon_unavailable'
-    )
+  const timeoutMs = Math.min(normalizedTimeoutMs(requestTimeoutMs), 1_000)
+  let lastReady: Awaited<ReturnType<typeof probeDaemonReady>> | null = null
+  for (const candidateUrl of await daemonEndpointCandidates({ explicitDaemonUrl, homeDir })) {
+    const ready = await probeDaemonReady({
+      daemonUrl: candidateUrl,
+      homeDir,
+      daemonToken: token,
+      timeoutMs,
+    })
+    lastReady = ready
+    if (ready.ok) return { token, daemonUrl: ready.url }
   }
-  return token
+  const failedReady = lastReady && !lastReady.ok ? lastReady : null
+  throw daemonClientError(
+    failedReady?.code ?? 'daemon_identity_unverified',
+    failedReady?.message ?? 'Tokenless daemon identity could not be verified; refusing to send its control token.',
+    failedReady?.code === 'daemon_unavailable'
+  )
+}
+
+async function daemonEndpointCandidates({
+  explicitDaemonUrl,
+  homeDir,
+}: {
+  explicitDaemonUrl?: string | undefined
+  homeDir: string
+}) {
+  const preferredUrl = daemonUrl(explicitDaemonUrl)
+  const urls: string[] = []
+  const state = await DaemonRuntimeState.openIfExists(homeDir)
+  try {
+    const endpoint = state?.endpoint()
+    if (endpoint?.origin) urls.push(endpoint.origin)
+  } finally {
+    state?.close()
+  }
+  urls.push(preferredUrl)
+  return [...new Set(urls)]
 }
 
 function combinedRequestSignal(timeoutMs: number | undefined, signal?: AbortSignal) {
diff --git a/packages/cli/src/daemon/browser-runtime-controller.ts b/packages/cli/src/daemon/browser-runtime-controller.ts
new file mode 100644
index 0000000..22dba99
--- /dev/null
+++ b/packages/cli/src/daemon/browser-runtime-controller.ts
@@ -0,0 +1,290 @@
+import process from 'node:process'
+
+import { createInProcessDaemonClient } from './in-process-daemon-client.js'
+import {
+  ManagedPlaywrightRunnerService,
+  type ManagedProfileOpenResult,
+  type ManagedProviderTabsOpenResult,
+} from '../playwright/runner-service.js'
+import { isClaimRecoveryError, tokenlessError } from '../playwright/errors.js'
+import { resolveE2EBrowserInspectionConfig } from '../playwright/e2e-inspection.js'
+import type { E2EBrowserInspectionConfig } from '../playwright/e2e-inspection.js'
+import { readTokenlessConfig, writeTokenlessConfig, type TokenlessConfig } from '../job-store.js'
+import { BrowserRuntimeManager } from '../browser-runtime/manager.js'
+import type { JobStore } from './job-store.js'
+import type { ManagedBrowserLaunchTarget } from '../playwright/browser/context-manager.js'
+import type { ManagedBrowserProfile } from '../playwright/browser/context-manager.js'
+import type { BrowserVisibility } from '../browser-visibility.js'
+
+export type BrowserRuntimeState = 'running' | 'quiescing' | 'quiesced' | 'stopped'
+
+export type BrowserRuntimeStatus = {
+  status: BrowserRuntimeState
+  activeProfileCount: number
+  activeJobCount: number
+  pid: number
+}
+
+type BrowserRuntimeControllerOptions = {
+  store: JobStore
+  onFatalError?: ((error: unknown) => void | Promise<void>) | undefined
+}
+
+type RunnerInstance = {
+  service: ManagedPlaywrightRunnerService
+  abortController: AbortController
+  loop: Promise<void>
+}
+
+export class BrowserRuntimeController {
+  private readonly store: JobStore
+  private readonly onFatalError: ((error: unknown) => void | Promise<void>) | undefined
+  private runner: RunnerInstance | null = null
+  private state: BrowserRuntimeState = 'stopped'
+  private terminal = false
+  private quiesceRequested = false
+  private quiesceFailure: unknown
+  private lane: Promise<unknown> = Promise.resolve()
+
+  constructor(options: BrowserRuntimeControllerOptions) {
+    this.store = options.store
+    this.onFatalError = options.onFatalError
+  }
+
+  status(): BrowserRuntimeStatus {
+    const runner = this.runner
+    return {
+      status: this.state,
+      activeProfileCount: runner?.service.activeProfileCount() ?? 0,
+      activeJobCount: runner?.service.activeJobCount() ?? 0,
+      pid: process.pid,
+    }
+  }
+
+  async start(): Promise<BrowserRuntimeStatus> {
+    return await this.wake()
+  }
+
+  async wake(): Promise<BrowserRuntimeStatus> {
+    if (this.quiesceFailure) return this.status()
+    if (this.quiesceRequested) return this.status()
+    return await this.enqueue(async () => {
+      if (this.terminal) return this.status()
+      if (this.quiesceFailure) return this.status()
+      if (this.quiesceRequested) return this.status()
+      if (this.state === 'quiescing') return this.status()
+      if (this.runner && this.state === 'running') return this.status()
+      this.runner = await this.createRunner()
+      this.state = 'running'
+      return this.status()
+    })
+  }
+
+  async openProfile(profileId: string, browserVisibility: BrowserVisibility): Promise<ManagedProfileOpenResult & {
+    status: BrowserRuntimeStatus
+  }> {
+    return await this.enqueue(async () => {
+      const runner = await this.ensureRunningInLane()
+      const opened = await runner.service.openProfile(profileId, browserVisibility)
+      return {
+        ...opened,
+        status: this.status(),
+      }
+    })
+  }
+
+  async openProviderTabs(
+    profileId: string,
+    providers: readonly string[],
+    browserVisibility: BrowserVisibility,
+  ): Promise<ManagedProviderTabsOpenResult & { status: BrowserRuntimeStatus }> {
+    return await this.enqueue(async () => {
+      const runner = await this.ensureRunningInLane()
+      const opened = await runner.service.openProviderTabs(profileId, providers, browserVisibility)
+      return {
+        ...opened,
+        status: this.status(),
+      }
+    })
+  }
+
+  async openControlPlane(profileId: string, bootstrapUrl: string) {
+    return await this.enqueue(async () => {
+      const runner = await this.ensureRunningInLane()
+      const opened = await runner.service.openControlPlane(profileId, bootstrapUrl)
+      return { ...opened, status: this.status() }
+    })
+  }
+
+  async quiesce(): Promise<BrowserRuntimeStatus> {
+    this.quiesceRequested = true
+    return await this.enqueue(async () => {
+      if (this.quiesceFailure) {
+        this.quiesceRequested = false
+        throw this.quiesceFailure
+      }
+      if (this.terminal) {
+        this.quiesceRequested = false
+        return this.status()
+      }
+      const runner = this.runner
+      if (!runner) {
+        this.state = 'quiesced'
+        this.quiesceRequested = false
+        return this.status()
+      }
+      this.state = 'quiescing'
+      runner.abortController.abort()
+      runner.service.stop()
+      const results = await this.settleRunner(runner)
+      if (this.runner === runner) this.runner = null
+      this.throwIfRunnerFailedToRecover(results)
+      if (!this.terminal) this.state = 'quiesced'
+      this.quiesceRequested = false
+      return this.status()
+    })
+  }
+
+  async shutdown(): Promise<BrowserRuntimeStatus> {
+    return await this.enqueue(async () => {
+      this.terminal = true
+      const runner = this.runner
+      if (runner) {
+        this.state = 'quiescing'
+        runner.abortController.abort()
+        runner.service.stop()
+        await this.settleRunner(runner)
+        if (this.runner === runner) this.runner = null
+      }
+      this.state = 'stopped'
+      return this.status()
+    })
+  }
+
+  private async createRunner(): Promise<RunnerInstance> {
+    const runtimeManager = new BrowserRuntimeManager({ homeDir: this.store.homeDir })
+    const config = await readTokenlessConfig(this.store.homeDir)
+    const e2eInspection = resolveE2EBrowserInspectionConfig(this.store.homeDir)
+    const resolvedTargets = new Map<string, Promise<ManagedBrowserLaunchTarget>>()
+    const browserResolver = async (profile: ManagedBrowserProfile) => {
+      const cacheKey = profile.runtimeBinding?.runtimeId ?? `unbound:${profile.id}`
+      let pending = resolvedTargets.get(cacheKey)
+      if (!pending) {
+        pending = this.resolveBrowserLaunchTarget(profile, runtimeManager, config, e2eInspection)
+        resolvedTargets.set(cacheKey, pending)
+        pending.catch(() => resolvedTargets.delete(cacheKey))
+      }
+      return await pending
+    }
+    const service = new ManagedPlaywrightRunnerService({
+      homeDir: this.store.homeDir,
+      daemonClient: createInProcessDaemonClient(this.store),
+      browserConnectionMode: config.browserConnectionMode,
+      browserResolver,
+      recoverAbortedClaim: (job) => this.store.recoverActiveClaim(job.job_id, job.claim_token),
+    })
+    const abortController = new AbortController()
+    const runner: RunnerInstance = {
+      service,
+      abortController,
+      loop: Promise.resolve(),
+    }
+    runner.loop = service.runUntilStopped(abortController.signal)
+      .catch((error) => {
+        if (isClaimRecoveryError(error)) throw error
+        if (abortController.signal.aborted || this.terminal) return
+        if (this.runner === runner) {
+          this.runner = null
+          this.state = this.terminal ? 'stopped' : 'quiesced'
+        }
+        void this.onFatalError?.(error)
+      })
+    return runner
+  }
+
+  private async ensureRunningInLane(): Promise<RunnerInstance> {
+    if (this.terminal) {
+      throw tokenlessError('browser_runtime_stopped', 'Tokenless browser runtime is stopped.')
+    }
+    if (this.quiesceFailure) throw this.quiesceFailure
+    if (this.quiesceRequested || this.state === 'quiescing') {
+      throw tokenlessError('browser_runtime_quiescing', 'Tokenless browser runtime is quiescing.', { retryable: true })
+    }
+    if (this.runner && this.state === 'running') return this.runner
+    this.runner = await this.createRunner()
+    this.state = 'running'
+    return this.runner
+  }
+
+  private async resolveBrowserLaunchTarget(
+    profile: ManagedBrowserProfile,
+    runtimeManager: BrowserRuntimeManager,
+    config: TokenlessConfig,
+    e2eInspection: E2EBrowserInspectionConfig | null,
+  ): Promise<ManagedBrowserLaunchTarget> {
+    const runtime = profile.runtimeBinding
+      ? await runtimeManager.resolveForProfile({
+          slug: profile.id,
+          runtimeBinding: profile.runtimeBinding,
+        }, {
+          browserExecutablePath: profile.runtimeBinding.browserId === config.browser
+            ? config.browserExecutablePath
+            : null,
+        })
+      : await this.resolveLegacyTestProfileRuntime(runtimeManager)
+    if (
+      runtime.family !== 'test' &&
+      runtime.selection === config.browser &&
+      runtime.executablePath !== config.browserExecutablePath
+    ) {
+      await writeTokenlessConfig({
+        homeDir: this.store.homeDir,
+        browserExecutablePath: runtime.executablePath,
+      })
+      config.browserExecutablePath = runtime.executablePath
+    }
+    return {
+      id: runtime.browserId,
+      executablePath: runtime.executablePath,
+      runtimeId: runtime.runtimeId,
+      launchPolicy: runtime.launchPolicy,
+      ...(e2eInspection ? {
+        e2eInspection: true,
+        ...(e2eInspection.hostResolverRule
+          ? { e2eHostResolverRule: e2eInspection.hostResolverRule.chromiumValue }
+          : {}),
+      } : {}),
+    }
+  }
+
+  private async resolveLegacyTestProfileRuntime(runtimeManager: BrowserRuntimeManager) {
+    const configuredBrowser = (await readTokenlessConfig(this.store.homeDir)).browser
+    if (configuredBrowser === 'profile') {
+      return await runtimeManager.ensure('profile', { allowDownload: false })
+    }
+    return await runtimeManager.resolveForProfile({ slug: '<unbound>' })
+  }
+
+  private async settleRunner(runner: RunnerInstance) {
+    const shutdown = runner.service.shutdown().catch(() => undefined)
+    return await Promise.allSettled([runner.loop, shutdown])
+  }
+
+  private throwIfRunnerFailedToRecover(results: PromiseSettledResult<unknown>[]) {
+    const failed = results.find((result) => (
+      result.status === 'rejected' &&
+      isClaimRecoveryError(result.reason)
+    ))
+    if (failed?.status !== 'rejected') return
+    this.quiesceFailure = failed.reason
+    this.state = 'quiescing'
+    this.quiesceRequested = false
+    throw failed.reason
+  }
+
+  private enqueue<T>(operation: () => Promise<T> | T): Promise<T> {
+    const next = this.lane.catch(() => undefined).then(operation)
+    this.lane = next.catch(() => undefined)
+    return next
+  }
+}
diff --git a/packages/cli/src/daemon/daemon-entry.mts b/packages/cli/src/daemon/daemon-entry.mts
new file mode 100644
index 0000000..c6b7e97
--- /dev/null
+++ b/packages/cli/src/daemon/daemon-entry.mts
@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+import { daemonBuildInfo } from './server.js'
+import { startDaemon } from './lifecycle.js'
+
+async function main() {
+  const args = process.argv.slice(2)
+  if (args.length === 1 && args[0] === '--tokenless-build-info') {
+    console.log(JSON.stringify(daemonBuildInfo('tokenless-daemon')))
+    return
+  }
+  const options = parseArgs(args)
+  await startDaemon(options)
+}
+
+function parseArgs(args: string[]) {
+  let homeDir: string | undefined
+  let host = '127.0.0.1'
+  let port = 7331
+  let startupOwnerToken: string | undefined
+  let startupGeneration: number | undefined
+  const positional: string[] = []
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index]
+    if (arg === undefined) continue
+    if (arg === '--home') {
+      homeDir = requireValue(args, ++index, '--home')
+    } else if (arg === '--host') {
+      host = requireValue(args, ++index, '--host')
+    } else if (arg === '--port') {
+      port = parsePort(requireValue(args, ++index, '--port'))
+    } else if (arg === '--startup-owner-token') {
+      startupOwnerToken = requireValue(args, ++index, '--startup-owner-token')
+    } else if (arg === '--startup-generation') {
+      startupGeneration = parsePositiveInteger(requireValue(args, ++index, '--startup-generation'), '--startup-generation')
+    } else {
+      positional.push(arg)
+    }
+  }
+  if (positional.length === 1 && positional[0] === 'serve') {
+    return { homeDir, host, port, startupOwnerToken, startupGeneration }
+  }
+  if (positional.length === 0) return { homeDir, host, port, startupOwnerToken, startupGeneration }
+  throw new Error('usage: daemon-entry.mjs [--home <path>] [serve] [--host <loopback>] [--port <port>]')
+}
+
+function requireValue(args: string[], index: number, flag: string) {
+  const value = args[index]
+  if (!value) throw new Error(`${flag} requires a value`)
+  return value
+}
+
+function parsePort(value: string) {
+  const port = Number(value)
+  if (!Number.isInteger(port) || port < 0 || port > 65535) throw new Error('--port must be a valid TCP port')
+  return port
+}
+
+function parsePositiveInteger(value: string, flag: string) {
+  const parsed = Number(value)
+  if (!Number.isSafeInteger(parsed) || parsed <= 0) throw new Error(`${flag} must be a positive integer`)
+  return parsed
+}
+
+main().catch((error) => {
+  console.error(error instanceof Error && error.message ? error.message : String(error))
+  process.exit(1)
+})
diff --git a/packages/cli/src/daemon/errors.ts b/packages/cli/src/daemon/errors.ts
new file mode 100644
index 0000000..27a63b1
--- /dev/null
+++ b/packages/cli/src/daemon/errors.ts
@@ -0,0 +1,250 @@
+import { TokenlessPlaywrightError } from '../playwright/errors.js'
+
+export type JobStatus =
+  | 'queued'
+  | 'claimed'
+  | 'running'
+  | 'waiting_for_user'
+  | 'succeeded'
+  | 'failed'
+  | 'canceled'
+  | 'timed_out'
+
+type DaemonErrorKind =
+  | 'io'
+  | 'random'
+  | 'sqlite'
+  | 'json'
+  | 'missing_home'
+  | 'invalid_input'
+  | 'non_loopback_bind'
+  | 'invalid_status'
+  | 'job_not_found'
+  | 'claim_rejected'
+  | 'claim_expired'
+  | 'bridge_busy'
+  | 'control_auth_missing'
+  | 'control_auth_rejected'
+  | 'invalid_job_state'
+  | 'product'
+
+export class DaemonError extends Error {
+  readonly kind: DaemonErrorKind
+  readonly jobId?: string | undefined
+  readonly statusValue?: string | undefined
+  readonly expected?: string | undefined
+  readonly actual?: JobStatus | undefined
+  readonly host?: string | undefined
+  readonly cause?: unknown
+  readonly productCode?: string | undefined
+  readonly productRetryable?: boolean | undefined
+  readonly productDetails?: unknown
+
+  constructor(kind: DaemonErrorKind, message: string, options: {
+    jobId?: string | undefined
+    statusValue?: string | undefined
+    expected?: string | undefined
+    actual?: JobStatus | undefined
+    host?: string | undefined
+    cause?: unknown
+    productCode?: string | undefined
+    productRetryable?: boolean | undefined
+    productDetails?: unknown
+  } = {}) {
+    super(message)
+    this.name = 'DaemonError'
+    this.kind = kind
+    this.jobId = options.jobId
+    this.statusValue = options.statusValue
+    this.expected = options.expected
+    this.actual = options.actual
+    this.host = options.host
+    this.cause = options.cause
+    this.productCode = options.productCode
+    this.productRetryable = options.productRetryable
+    this.productDetails = options.productDetails
+  }
+}
+
+export function ioError(error: unknown) {
+  return new DaemonError('io', `I/O error: ${errorText(error)}`, { cause: error })
+}
+
+export function sqliteError(error: unknown) {
+  return new DaemonError('sqlite', `SQLite error: ${errorText(error)}`, { cause: error })
+}
+
+export function jsonError(error: unknown) {
+  return new DaemonError('json', `JSON error: ${errorText(error)}`, { cause: error })
+}
+
+export function missingHomeError() {
+  return new DaemonError(
+    'missing_home',
+    'cannot resolve Tokenless home; pass --home or set TOKENLESS_HOME/HOME'
+  )
+}
+
+export function invalidInput(message: string) {
+  return new DaemonError('invalid_input', `invalid input: ${message}`)
+}
+
+export function nonLoopbackBind(host: string) {
+  return new DaemonError(
+    'non_loopback_bind',
+    `refusing to bind daemon to non-loopback host ${host}; Tokenless daemon is a local control plane`,
+    { host }
+  )
+}
+
+export function invalidStatus(status: string) {
+  return new DaemonError('invalid_status', `invalid job status: ${status}`, { statusValue: status })
+}
+
+export function jobNotFound(jobId: string) {
+  return new DaemonError('job_not_found', `job not found: ${jobId}`, { jobId })
+}
+
+export function claimRejected(jobId: string) {
+  return new DaemonError('claim_rejected', `claim rejected for job: ${jobId}`, { jobId })
+}
+
+export function claimExpired(jobId: string) {
+  return new DaemonError('claim_expired', `claim lease expired for job: ${jobId}`, { jobId })
+}
+
+export function controlAuthMissing() {
+  return new DaemonError('control_auth_missing', 'missing bearer token')
+}
+
+export function controlAuthRejected() {
+  return new DaemonError('control_auth_rejected', 'invalid bearer token')
+}
+
+export function invalidJobState(jobId: string, expected: string, actual: JobStatus) {
+  return new DaemonError(
+    'invalid_job_state',
+    `invalid state for job ${jobId}: expected ${expected}, found ${actual}`,
+    { jobId, expected, actual }
+  )
+}
+
+export function toDaemonError(error: unknown) {
+  if (error instanceof DaemonError) return error
+  if (error instanceof TokenlessPlaywrightError) {
+    return new DaemonError('product', error.message, {
+      cause: error,
+      productCode: error.code,
+      productRetryable: error.retryable,
+      productDetails: error.details,
+    })
+  }
+  return sqliteError(error)
+}
+
+export function daemonErrorStatus(error: DaemonError) {
+  switch (error.kind) {
+    case 'invalid_input':
+    case 'non_loopback_bind':
+    case 'invalid_status':
+      return 400
+    case 'control_auth_missing':
+      return 401
+    case 'job_not_found':
+      return 404
+    case 'claim_rejected':
+    case 'control_auth_rejected':
+      return 403
+    case 'claim_expired':
+    case 'invalid_job_state':
+    case 'bridge_busy':
+      return 409
+    case 'product':
+      return 409
+    case 'io':
+    case 'random':
+    case 'sqlite':
+    case 'json':
+    case 'missing_home':
+      return 500
+  }
+}
+
+export function daemonErrorCodeRetryable(error: DaemonError) {
+  switch (error.kind) {
+    case 'io':
+      return { code: 'daemon_io_error', retryable: true }
+    case 'random':
+      return { code: 'daemon_random_error', retryable: true }
+    case 'sqlite':
+      return { code: 'daemon_store_error', retryable: true }
+    case 'json':
+      return { code: 'daemon_json_error', retryable: false }
+    case 'missing_home':
+      return { code: 'daemon_home_missing', retryable: false }
+    case 'invalid_input':
+      return { code: 'invalid_input', retryable: false }
+    case 'non_loopback_bind':
+      return { code: 'non_loopback_bind', retryable: false }
+    case 'invalid_status':
+      return { code: 'invalid_status', retryable: false }
+    case 'job_not_found':
+      return { code: 'job_not_found', retryable: false }
+    case 'claim_rejected':
+      return { code: 'claim_rejected', retryable: false }
+    case 'claim_expired':
+      return { code: 'claim_expired', retryable: false }
+    case 'bridge_busy':
+      return { code: 'bridge_busy', retryable: true }
+    case 'control_auth_missing':
+      return { code: 'control_auth_missing', retryable: false }
+    case 'control_auth_rejected':
+      return { code: 'control_auth_rejected', retryable: false }
+    case 'invalid_job_state':
+      return { code: 'invalid_job_state', retryable: false }
+    case 'product':
+      return {
+        code: error.productCode ?? 'tokenless_product_error',
+        retryable: error.productRetryable ?? false,
+      }
+  }
+}
+
+export function daemonErrorBody(error: DaemonError) {
+  const { code, retryable } = daemonErrorCodeRetryable(error)
+  const envelope: Record<string, unknown> = {
+    code,
+    message: error.message,
+    retryable,
+  }
+  const details = daemonErrorDetails(error)
+  if (details) envelope.details = details
+  return { error: envelope }
+}
+
+function daemonErrorDetails(error: DaemonError) {
+  switch (error.kind) {
+    case 'non_loopback_bind':
+      return { host: error.host }
+    case 'invalid_status':
+      return { status: error.statusValue }
+    case 'job_not_found':
+    case 'claim_rejected':
+    case 'claim_expired':
+      return { job_id: error.jobId }
+    case 'invalid_job_state':
+      return {
+        job_id: error.jobId,
+        expected: error.expected,
+        actual: error.actual,
+      }
+    case 'product':
+      return error.productDetails ?? null
+    default:
+      return null
+  }
+}
+
+function errorText(error: unknown) {
+  return error instanceof Error && error.message ? error.message : String(error)
+}
diff --git a/packages/cli/src/daemon/in-process-daemon-client.ts b/packages/cli/src/daemon/in-process-daemon-client.ts
new file mode 100644
index 0000000..5ec855c
--- /dev/null
+++ b/packages/cli/src/daemon/in-process-daemon-client.ts
@@ -0,0 +1,219 @@
+import { daemonErrorBody, toDaemonError } from './errors.js'
+import { JobStore, publicView, withClaimToken } from './job-store.js'
+import { claimRecoveryError, tokenlessError } from '../playwright/errors.js'
+import type { Job } from './job-store.js'
+import type {
+  DaemonClaimedJob,
+  DaemonJob,
+  ManagedDaemonClient,
+} from '../playwright/daemon-client.js'
+
+export function createInProcessDaemonClient(store: JobStore): ManagedDaemonClient {
+  return {
+    getJob: (options) => inProcessDaemonRequest(options.signal, () => publicJobView(store.getJob(options.jobId))),
+    claimNextJob: (options) => inProcessClaimNextRequest(store, options.signal, () => store.claimNextJob(
+        {
+          provider: options.provider,
+          action: options.action,
+          job_id_prefix: options.jobIdPrefix,
+        },
+        options.executionBackend,
+        options.profileId ?? null
+    )),
+    markJobRunning: (options) => claimRequest(options, () => publicJobView(store.markRunning(options.jobId, options.claimToken))),
+    projectJobProviderCapacity: (options) => claimRequest(options, () => store.projectJobProviderCapacity(
+      options.jobId,
+      options.claimToken,
+      {
+        access_class: options.accessClass,
+        tier_label: options.tierLabel,
+        subscription_label: options.subscriptionLabel,
+      },
+    )),
+    deferJobForProviderCapacity: (options) => claimRequest(options, () => publicJobView(
+      store.deferJobForProviderCapacity(options.jobId, options.claimToken, options.projection)
+    )),
+    recordProviderSubmission: (options) => claimRequest(options, () => publicJobView(
+      store.recordProviderSubmission(options.jobId, options.claimToken)
+    )),
+    deferObservedProviderLimit: (options) => claimRequest(options, () => publicJobView(
+      store.deferObservedProviderLimit(
+        options.jobId,
+        options.claimToken,
+        options.blocker,
+        options.delaySeconds,
+      )
+    )),
+    markJobWaitingForUser: (options) => waitingForUserRequest(options, () => publicJobView(
+      store.markWaitingForUser(options.jobId, options.claimToken, options.blocker)
+    )),
+    checkpointJob: (options) => checkpointRequest(options, () => publicJobView(
+      store.checkpointJob(options.jobId, options.claimToken, options.checkpoint)
+    )),
+    parkJob: (options) => parkRequest(options, () => publicJobView(
+      store.parkJob(options.jobId, options.claimToken, options.blocker, options.checkpoint)
+    )),
+    fallbackJob: (options) => fallbackRequest(options, () => publicJobView(store.fallbackJob({
+      job_id: options.jobId,
+      claim_token: options.claimToken,
+      provider: options.provider,
+      request_json: options.request,
+      blocker_json: options.blocker,
+    }))),
+    renewJobClaim: (options) => claimRequest(options, () => publicJobView(store.renewClaim(options.jobId, options.claimToken))),
+    completeJob: (options) => completeRequest(options, () => {
+      const hasResult = options.result !== undefined && options.result !== null
+      const hasError = options.error !== undefined && options.error !== null
+      if (hasResult === hasError) {
+        throw tokenlessError('invalid_daemon_completion', 'Pass exactly one of result or error when completing a daemon job.')
+      }
+      return publicJobView(store.completeJob(
+        options.jobId,
+        options.claimToken,
+        hasResult ? { result_json: options.result } : { error_json: options.error }
+      ))
+    }),
+    upsertProviderProject: (options) => claimRequest(options, () => {
+      assertCurrentClaim(store, options.jobId, options.claimToken)
+      return store.upsertProviderProject({
+        provider: options.provider,
+        profile_id: options.profileId,
+        resource_id: options.resourceId,
+        name: options.name,
+        canonical_url: options.canonicalUrl,
+        visible_proof: options.visibleProof,
+        job_id: options.jobId,
+        created: options.created,
+      })
+    }),
+    upsertProviderConversation: (options) => claimRequest(options, () => {
+      assertCurrentClaim(store, options.jobId, options.claimToken)
+      return store.upsertProviderConversation({
+        provider: options.provider,
+        profile_id: options.profileId,
+        project_resource_id: options.projectResourceId,
+        task_id: options.taskId,
+        canonical_url: options.canonicalUrl,
+        job_id: options.jobId,
+      })
+    }),
+    upsertProviderTaskConversation: (options) => claimRequest(options, () => {
+      assertCurrentClaim(store, options.jobId, options.claimToken)
+      return store.upsertProviderTaskConversation({
+        provider: options.provider,
+        profile_id: options.profileId,
+        task_id: options.taskId,
+        canonical_url: options.canonicalUrl,
+        job_id: options.jobId,
+      })
+    }),
+  }
+}
+
+type ClaimLifecycleDaemonJobOptions = Parameters<ManagedDaemonClient['markJobRunning']>[0]
+type WaitingForUserDaemonJobOptions = Parameters<ManagedDaemonClient['markJobWaitingForUser']>[0]
+type CheckpointDaemonJobOptions = Parameters<ManagedDaemonClient['checkpointJob']>[0]
+type ParkDaemonJobOptions = Parameters<ManagedDaemonClient['parkJob']>[0]
+type FallbackDaemonJobOptions = Parameters<ManagedDaemonClient['fallbackJob']>[0]
+type CompleteDaemonJobOptions = Parameters<ManagedDaemonClient['completeJob']>[0]
+
+function claimRequest<T>(options: ClaimLifecycleDaemonJobOptions, operation: () => T): Promise<T> {
+  return inProcessDaemonRequest(options.signal, operation)
+}
+
+function waitingForUserRequest<T>(options: WaitingForUserDaemonJobOptions, operation: () => T): Promise<T> {
+  return inProcessDaemonRequest(options.signal, operation)
+}
+
+function checkpointRequest<T>(options: CheckpointDaemonJobOptions, operation: () => T): Promise<T> {
+  return inProcessDaemonRequest(options.signal, operation)
+}
+
+function parkRequest<T>(options: ParkDaemonJobOptions, operation: () => T): Promise<T> {
+  return inProcessDaemonRequest(options.signal, operation)
+}
+
+function fallbackRequest<T>(options: FallbackDaemonJobOptions, operation: () => T): Promise<T> {
+  return inProcessDaemonRequest(options.signal, operation)
+}
+
+function completeRequest<T>(options: CompleteDaemonJobOptions, operation: () => T): Promise<T> {
+  return inProcessDaemonRequest(options.signal, operation)
+}
+
+async function inProcessDaemonRequest<T>(signal: AbortSignal | undefined, operation: () => T | Promise<T>): Promise<T> {
+  if (signal?.aborted) throw daemonRequestAbortedError()
+  try {
+    const result = await operation()
+    if (signal?.aborted) throw daemonRequestAbortedError()
+    return result
+  } catch (error) {
+    if (error instanceof Error && error.name === 'TokenlessPlaywrightError') throw error
+    throw daemonStoreError(error)
+  }
+}
+
+async function inProcessClaimNextRequest(
+  store: JobStore,
+  signal: AbortSignal | undefined,
+  operation: () => Job | null
+): Promise<{ job: DaemonClaimedJob | null }> {
+  if (signal?.aborted) throw daemonRequestAbortedError()
+  let job: Job | null = null
+  try {
+    job = operation()
+    if (signal?.aborted) {
+      if (job) {
+        try {
+          store.recoverActiveClaim(job.job_id, job.claim_token)
+        } catch (error) {
+          throw claimRecoveryError(error)
+        }
+      }
+      throw daemonRequestAbortedError()
+    }
+    return { job: nullableClaimedView(job) }
+  } catch (error) {
+    if (error instanceof Error && error.name === 'TokenlessPlaywrightError') throw error
+    throw daemonStoreError(error)
+  }
+}
+
+function nullableClaimedView(job: Job | null): DaemonClaimedJob | null {
+  return job ? claimedView(job) : null
+}
+
+function publicJobView(job: Job): DaemonJob {
+  return publicView(job)
+}
+
+function claimedView(job: Job): DaemonClaimedJob {
+  return withClaimToken(job)
+}
+
+function daemonStoreError(error: unknown) {
+  const envelope = daemonErrorBody(toDaemonError(error)).error
+  const code = typeof envelope.code === 'string' ? envelope.code : 'daemon_request_failed'
+  const message = typeof envelope.message === 'string' ? envelope.message : 'Tokenless daemon request failed.'
+  const retryable = typeof envelope.retryable === 'boolean' ? envelope.retryable : false
+  return tokenlessError(
+    code,
+    message,
+    {
+      retryable,
+      ...(envelope.details === undefined ? {} : { details: envelope.details }),
+      cause: error,
+    }
+  )
+}
+
+function daemonRequestAbortedError() {
+  return tokenlessError('daemon_request_timeout', 'Tokenless daemon request timed out or was aborted.', { retryable: true })
+}
+
+function assertCurrentClaim(store: JobStore, jobId: string, claimToken: string) {
+  const job = store.getJob(jobId)
+  if (job.claim_token !== claimToken || (job.status !== 'claimed' && job.status !== 'running' && job.status !== 'waiting_for_user')) {
+    throw tokenlessError('daemon_claim_rejected', 'The daemon job claim is not active.', { retryable: false })
+  }
+}
diff --git a/packages/cli/src/daemon/job-store.ts b/packages/cli/src/daemon/job-store.ts
new file mode 100644
index 0000000..15feb4a
--- /dev/null
+++ b/packages/cli/src/daemon/job-store.ts
@@ -0,0 +1,2256 @@
+import { randomBytes, randomUUID } from 'node:crypto'
+import fsSync from 'node:fs'
+import fs from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+import { DatabaseSync, type SQLInputValue } from 'node:sqlite'
+
+import {
+  removeStagedVisibleAttachmentBundle,
+  validateVisibleAttachmentDescriptor,
+} from '../visible-attachments.js'
+import {
+  providerCapacityPolicy,
+  providerRateLimitCatalog,
+  type ProviderCapacityProjection,
+} from '../providers/rate-limit-policy.js'
+import {
+  claimExpired,
+  claimRejected,
+  controlAuthRejected,
+  invalidInput,
+  invalidJobState,
+  invalidStatus,
+  ioError,
+  jobNotFound,
+  jsonError,
+  missingHomeError,
+  sqliteError,
+  toDaemonError,
+  type JobStatus,
+} from './errors.js'
+
+export type { JobStatus } from './errors.js'
+
+export type ExecutionBackend = 'playwright'
+
+export type Job = {
+  job_id: string
+  claim_token: string
+  execution_backend: ExecutionBackend
+  profile_id: string | null
+  agent_kind: string | null
+  agent_session_id: string | null
+  provider: string
+  action: string
+  status: JobStatus
+  request_json: unknown
+  result_json: unknown | null
+  error_json: unknown | null
+  blocker_json: unknown | null
+  checkpoint_json: unknown | null
+  resume_json: unknown | null
+  provider_attempts_json: unknown
+  provider_submitted_at: string | null
+  eligible_at: string | null
+  created_at: string
+  updated_at: string
+  claim_expires_at_ms: number | null
+}
+
+export type JobView = Omit<
+  Job,
+  'claim_token' | 'checkpoint_json' | 'resume_json' | 'claim_expires_at_ms' | 'agent_kind' | 'agent_session_id'
+>
+export type JobWithClaimToken = Omit<Job, 'claim_expires_at_ms' | 'agent_kind' | 'agent_session_id'>
+
+export type CreateJobInput = {
+  provider: string
+  action: string
+  request_json: unknown
+  execution_backend?: ExecutionBackend | undefined
+  profile_id?: string | null | undefined
+  agent_kind?: string | null | undefined
+  agent_session_id?: string | null | undefined
+  job_id?: string | undefined
+  claim_token?: string | undefined
+}
+
+export type AgentRecipient = {
+  agent_kind: string
+  agent_session_id: string
+}
+
+export type ReplaySummary = {
+  job_id: string
+  provider: string
+  action: string
+  status: Extract<JobStatus, 'waiting_for_user' | 'succeeded' | 'failed' | 'canceled' | 'timed_out'>
+  task_id: string | null
+  updated_at: string
+  reported_at: string
+  outcome_kind: 'result' | 'error' | 'blocker' | 'none'
+  has_result: boolean
+  has_error: boolean
+  has_blocker: boolean
+}
+
+export type ListJobsInput = {
+  status?: JobStatus | undefined
+  execution_backend?: ExecutionBackend | undefined
+  profile_id?: string | undefined
+  provider?: string | undefined
+  task_id?: string | undefined
+  limit?: number | undefined
+}
+
+export type ClaimNextInput = {
+  provider?: string | undefined
+  action?: string | undefined
+  job_id_prefix?: string | undefined
+}
+
+export type ProviderCapacitySubscription = {
+  access_class: string
+  tier_label?: string | null | undefined
+  subscription_label?: string | null | undefined
+}
+
+export type ProjectProviderCapacityInput = ProviderCapacitySubscription & {
+  provider: string
+  profile_id: string
+  request_json: unknown
+}
+
+export type ProviderProjectMapping = {
+  provider: string
+  profile_id: string
+  resource_id: string
+  name: string
+  canonical_url: string
+  first_observed_at: string
+  last_observed_at: string
+  last_visible_proof: string
+  creation_job_id: string | null
+}
+
+export type ProviderConversationMapping = {
+  provider: string
+  profile_id: string
+  project_resource_id: string
+  task_id: string
+  canonical_url: string
+  proved_job_id: string
+  observed_at: string
+}
+
+export type ProviderTaskConversationMapping = {
+  provider: string
+  profile_id: string
+  task_id: string
+  canonical_url: string
+  proved_job_id: string
+  observed_at: string
+}
+
+const DATABASE_FILE_NAME = 'tokenless.sqlite3'
+const CONTROL_TOKEN_FILE_NAME = 'daemon.token'
+const DEFAULT_CLAIM_LEASE_MS = 30_000
+const SECRET_TOKEN_BYTES = 32
+const SUMMARY_SCALAR_CHARS = 256
+const PROFILE_ID_CHARS = 128
+const AGENT_KIND_CHARS = 128
+const AGENT_SESSION_ID_CHARS = 256
+const MAX_VISIBLE_ATTACHMENTS = 100
+const MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES = 512 * 1024 * 1024
+const ACTIVE_STATUSES = new Set<JobStatus>(['claimed', 'running', 'waiting_for_user'])
+const JOB_STATUSES = new Set<JobStatus>([
+  'queued',
+  'claimed',
+  'running',
+  'waiting_for_user',
+  'succeeded',
+  'failed',
+  'canceled',
+  'timed_out',
+])
+const EXECUTION_BACKENDS = new Set<ExecutionBackend>(['playwright'])
+
+type RequestSummaryMetadata = {
+  task_id: string | null
+  project_name: string | null
+  chat_name: string | null
+  idempotency_key: string | null
+  task_keys: string[]
+}
+
+export class JobStore {
+  readonly homeDir: string
+  readonly databasePath: string
+  readonly controlTokenPath: string
+  readonly claimLeaseMs: number
+
+  #db: DatabaseSync
+  #closed = false
+
+  static async open(homeDir = defaultHomeDir(), claimLeaseMs = DEFAULT_CLAIM_LEASE_MS) {
+    await ensureTokenlessHome(homeDir)
+    const canonicalHome = await fs.realpath(homeDir)
+    const store = new JobStore(canonicalHome, Math.max(1, Math.floor(claimLeaseMs)))
+    await ensureControlToken(store.controlTokenPath)
+    store.initialize()
+    return store
+  }
+
+  private constructor(homeDir: string, claimLeaseMs: number) {
+    this.homeDir = homeDir
+    this.databasePath = path.join(homeDir, DATABASE_FILE_NAME)
+    this.controlTokenPath = path.join(homeDir, CONTROL_TOKEN_FILE_NAME)
+    this.claimLeaseMs = claimLeaseMs
+    try {
+      this.#db = new DatabaseSync(this.databasePath)
+      this.#db.exec('PRAGMA foreign_keys = ON;')
+      this.#db.exec('PRAGMA busy_timeout = 5000;')
+    } catch (error) {
+      throw sqliteError(error)
+    }
+  }
+
+  close() {
+    if (this.#closed) return
+    this.#closed = true
+    this.#db.close()
+  }
+
+  controlToken() {
+    try {
+      return fsSync.readFileSync(this.controlTokenPath, 'utf8').trim()
+    } catch (error) {
+      throw ioError(error)
+    }
+  }
+
+  requireControlToken(token: string) {
+    const expected = this.controlToken()
+    if (!constantTimeEqual(Buffer.from(token), Buffer.from(expected))) {
+      throw controlAuthRejected()
+    }
+  }
+
+  createJob(input: CreateJobInput) {
+    const provider = normalizeNonempty(String(input.provider ?? ''), 'provider')
+    const action = normalizeNonempty(String(input.action ?? ''), 'action')
+    const executionBackend = input.execution_backend ?? 'playwright'
+    assertExecutionBackend(executionBackend)
+    const profileId = validateJobBackendProfile(executionBackend, input.profile_id ?? null)
+    const recipient = normalizeOptionalAgentRecipient(input.agent_kind, input.agent_session_id)
+    const jobId = input.job_id === undefined
+      ? randomUUID()
+      : normalizeNonempty(input.job_id, 'job_id')
+    const claimToken = input.claim_token === undefined
+      ? generateSecretToken()
+      : normalizeNonempty(input.claim_token, 'claim_token')
+    const now = nowRfc3339()
+    const summary = requestSummaryMetadata(input.request_json)
+    const requestJson = stringifyJson(input.request_json)
+    const providerAttemptsJson = stringifyJson([providerAttempt(1, provider, 'queued', now)])
+
+    this.transaction(() => {
+      this.run(
+        `INSERT INTO jobs (
+          job_id, claim_token, execution_backend, profile_id, agent_kind, agent_session_id,
+          provider, action, status, request_json,
+          result_json, error_json, blocker_json, created_at, updated_at,
+          provider_attempts_json,
+          summary_task_id, summary_project_name, summary_chat_name,
+          summary_idempotency_key
+        ) VALUES (
+          ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, NULL, NULL, ?, ?,
+          ?, ?, ?, ?, ?
+        )`,
+        jobId,
+        claimToken,
+        executionBackend,
+        profileId,
+        recipient?.agent_kind ?? null,
+        recipient?.agent_session_id ?? null,
+        provider,
+        action,
+        'queued',
+        requestJson,
+        now,
+        now,
+        providerAttemptsJson,
+        summary.task_id,
+        summary.project_name,
+        summary.chat_name,
+        summary.idempotency_key
+      )
+      for (const taskKey of summary.task_keys) {
+        this.run('INSERT INTO job_task_keys (job_id, task_id) VALUES (?, ?)', jobId, taskKey)
+      }
+    })
+
+    return this.getJob(jobId)
+  }
+
+  drainReplaySummaries(recipientInput: AgentRecipient, requestedLimit?: number) {
+    const recipient = normalizeAgentRecipient(recipientInput)
+    const limit = clampLimit(requestedLimit, 100, 200)
+    this.requeueExpiredClaims()
+    return this.transaction(() => {
+      const rows = this.all(
+        `SELECT
+          job_id, provider, action, status, summary_task_id, updated_at,
+          outcome_revision, result_json, error_json, blocker_json
+         FROM jobs
+         WHERE agent_kind = ?
+           AND agent_session_id = ?
+           AND outcome_revision > 0
+           AND (
+             reported_outcome_revision IS NULL
+             OR reported_outcome_revision != outcome_revision
+           )
+           AND (
+             status IN ('succeeded', 'failed', 'canceled', 'timed_out')
+             OR (status = 'waiting_for_user' AND claim_expires_at IS NULL)
+           )
+         ORDER BY updated_at ASC, job_id ASC
+         LIMIT ?`,
+        recipient.agent_kind,
+        recipient.agent_session_id,
+        limit
+      )
+      if (rows.length === 0) return [] satisfies ReplaySummary[]
+      const reportedAt = nowRfc3339()
+      const summaries: ReplaySummary[] = []
+      for (const row of rows) {
+        const result = this.run(
+          `UPDATE jobs
+           SET replay_reported_at = ?, reported_outcome_revision = ?
+           WHERE job_id = ?
+             AND agent_kind = ?
+             AND agent_session_id = ?
+             AND outcome_revision = ?
+             AND (
+               reported_outcome_revision IS NULL
+               OR reported_outcome_revision != outcome_revision
+             )`,
+          reportedAt,
+          Number(row.outcome_revision),
+          String(row.job_id),
+          recipient.agent_kind,
+          recipient.agent_session_id,
+          Number(row.outcome_revision)
+        )
+        if (result.changes !== 1) continue
+        summaries.push(rowToReplaySummary(row, reportedAt))
+      }
+      return summaries
+    })
+  }
+
+  markJobReported(jobId: string, recipientInput: AgentRecipient) {
+    const recipient = normalizeAgentRecipient(recipientInput)
+    this.requeueExpiredClaims()
+    const normalizedJobId = normalizeNonempty(jobId, 'job_id')
+    return this.transaction(() => {
+      const row = this.get(
+        `SELECT agent_kind, agent_session_id, outcome_revision, reported_outcome_revision,
+                status, claim_expires_at
+         FROM jobs
+         WHERE job_id = ?`,
+        normalizedJobId
+      )
+      if (!row) throw jobNotFound(normalizedJobId)
+      if (
+        row.agent_kind !== recipient.agent_kind ||
+        row.agent_session_id !== recipient.agent_session_id
+      ) {
+        throw jobNotFound(normalizedJobId)
+      }
+      const outcomeRevision = Number(row.outcome_revision)
+      const reportable = outcomeRevision > 0 && (
+        row.status === 'succeeded' ||
+        row.status === 'failed' ||
+        row.status === 'canceled' ||
+        row.status === 'timed_out' ||
+        row.status === 'waiting_for_user'
+      )
+      if (!reportable || Number(row.reported_outcome_revision) === outcomeRevision) {
+        return {
+          job: this.getJobWithoutRecovery(normalizedJobId),
+          reported: false,
+        }
+      }
+      const result = this.run(
+        `UPDATE jobs
+         SET replay_reported_at = ?, reported_outcome_revision = outcome_revision
+         WHERE job_id = ?
+           AND agent_kind = ?
+           AND agent_session_id = ?
+           AND outcome_revision = ?
+           AND (
+             reported_outcome_revision IS NULL
+             OR reported_outcome_revision != outcome_revision
+           )`,
+        nowRfc3339(),
+        normalizedJobId,
+        recipient.agent_kind,
+        recipient.agent_session_id,
+        outcomeRevision
+      )
+      return {
+        job: this.getJobWithoutRecovery(normalizedJobId),
+        reported: result.changes === 1,
+      }
+    })
+  }
+
+  listJobs(query: ListJobsInput = {}) {
+    this.requeueExpiredClaims()
+    if (query.status !== undefined) assertJobStatus(query.status)
+    if (query.execution_backend !== undefined) assertExecutionBackend(query.execution_backend)
+    const profileId = query.profile_id === undefined ? undefined : normalizeProfileId(query.profile_id, 'profile_id')
+    const provider = query.provider === undefined ? undefined : normalizeNonempty(query.provider, 'provider')
+    const taskId = query.task_id === undefined ? undefined : normalizeSummaryFilter(query.task_id, 'task_id')
+    const limit = clampLimit(query.limit, 100, 1000)
+
+    let sql = `SELECT
+      jobs.job_id, jobs.claim_token, jobs.execution_backend, jobs.profile_id,
+      jobs.agent_kind, jobs.agent_session_id,
+      jobs.provider, jobs.action, jobs.status, jobs.request_json, jobs.result_json,
+      jobs.error_json, jobs.blocker_json, jobs.checkpoint_json, jobs.resume_json,
+      jobs.provider_attempts_json,
+      jobs.provider_submitted_at, jobs.eligible_at,
+      jobs.created_at, jobs.updated_at, jobs.claim_expires_at
+      FROM jobs`
+    const params: SQLInputValue[] = []
+    if (taskId !== undefined) {
+      sql += ` INNER JOIN job_task_keys AS matched_task
+        ON matched_task.job_id = jobs.job_id
+        AND matched_task.task_id = ?`
+      params.push(taskId)
+    }
+    sql += ' WHERE 1 = 1'
+    if (query.status !== undefined) {
+      sql += ' AND jobs.status = ?'
+      params.push(query.status)
+    }
+    if (query.execution_backend !== undefined) {
+      sql += ' AND jobs.execution_backend = ?'
+      params.push(query.execution_backend)
+    }
+    if (profileId !== undefined) {
+      sql += ' AND jobs.profile_id = ?'
+      params.push(profileId)
+    }
+    if (provider !== undefined) {
+      sql += ' AND jobs.provider = ?'
+      params.push(provider)
+    }
+    sql += ' ORDER BY jobs.created_at DESC, jobs.job_id DESC LIMIT ?'
+    params.push(limit)
+    return this.all(sql, ...params).map(rowToJob)
+  }
+
+  getJob(jobId: string) {
+    this.requeueExpiredClaims()
+    return this.getJobWithoutRecovery(jobId)
+  }
+
+  upsertProviderProject(input: {
+    provider: string
+    profile_id: string
+    resource_id: string
+    name: string
+    canonical_url: string
+    visible_proof: string
+    job_id: string
+    created: boolean
+  }): ProviderProjectMapping {
+    const provider = mappingText(input.provider, 'provider', 128)
+    const profileId = mappingText(input.profile_id, 'profile_id', PROFILE_ID_CHARS)
+    const resourceId = mappingText(input.resource_id, 'resource_id', 256)
+    const name = mappingText(input.name, 'name', 256)
+    const canonicalUrl = canonicalMappingUrl(input.canonical_url)
+    const visibleProof = mappingText(input.visible_proof, 'visible_proof', 512)
+    const jobId = mappingText(input.job_id, 'job_id', 256)
+    this.getJob(jobId)
+    const now = nowRfc3339()
+    this.run(
+      `INSERT INTO provider_projects (
+        provider, profile_id, resource_id, name, canonical_url,
+        first_observed_at, last_observed_at, last_visible_proof, creation_job_id
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(provider, profile_id, resource_id) DO UPDATE SET
+        name = excluded.name,
+        canonical_url = excluded.canonical_url,
+        last_observed_at = excluded.last_observed_at,
+        last_visible_proof = excluded.last_visible_proof,
+        creation_job_id = COALESCE(provider_projects.creation_job_id, excluded.creation_job_id)`,
+      provider,
+      profileId,
+      resourceId,
+      name,
+      canonicalUrl,
+      now,
+      now,
+      visibleProof,
+      input.created ? jobId : null,
+    )
+    return this.getProviderProject(provider, profileId, resourceId)
+  }
+
+  upsertProviderConversation(input: {
+    provider: string
+    profile_id: string
+    project_resource_id: string
+    task_id: string
+    canonical_url: string
+    job_id: string
+  }): ProviderConversationMapping {
+    const provider = mappingText(input.provider, 'provider', 128)
+    const profileId = mappingText(input.profile_id, 'profile_id', PROFILE_ID_CHARS)
+    const projectResourceId = mappingText(input.project_resource_id, 'project_resource_id', 256)
+    const taskId = mappingText(input.task_id, 'task_id', 256)
+    const canonicalUrl = canonicalMappingUrl(input.canonical_url)
+    const jobId = mappingText(input.job_id, 'job_id', 256)
+    this.getProviderProject(provider, profileId, projectResourceId)
+    this.getJob(jobId)
+    const now = nowRfc3339()
+    this.run(
+      `INSERT INTO provider_conversations (
+        provider, profile_id, project_resource_id, task_id,
+        canonical_url, proved_job_id, observed_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(provider, profile_id, project_resource_id, task_id) DO UPDATE SET
+        canonical_url = excluded.canonical_url,
+        proved_job_id = excluded.proved_job_id,
+        observed_at = excluded.observed_at`,
+      provider,
+      profileId,
+      projectResourceId,
+      taskId,
+      canonicalUrl,
+      jobId,
+      now,
+    )
+    return this.getProviderConversation(provider, profileId, projectResourceId, taskId)
+  }
+
+  upsertProviderTaskConversation(input: {
+    provider: string
+    profile_id: string
+    task_id: string
+    canonical_url: string
+    job_id: string
+  }): ProviderTaskConversationMapping {
+    const provider = mappingText(input.provider, 'provider', 128)
+    const profileId = mappingText(input.profile_id, 'profile_id', PROFILE_ID_CHARS)
+    const taskId = mappingText(input.task_id, 'task_id', 256)
+    const canonicalUrl = canonicalMappingUrl(input.canonical_url)
+    const jobId = mappingText(input.job_id, 'job_id', 256)
+    this.getJob(jobId)
+    const now = nowRfc3339()
+    this.run(
+      `INSERT INTO provider_task_conversations (
+        provider, profile_id, task_id, canonical_url, proved_job_id, observed_at
+      ) VALUES (?, ?, ?, ?, ?, ?)
+      ON CONFLICT(provider, profile_id, task_id) DO UPDATE SET
+        canonical_url = excluded.canonical_url,
+        proved_job_id = excluded.proved_job_id,
+        observed_at = excluded.observed_at`,
+      provider,
+      profileId,
+      taskId,
+      canonicalUrl,
+      jobId,
+      now,
+    )
+    return this.resolveProviderTaskConversation({ provider, profile_id: profileId, task_id: taskId }) as ProviderTaskConversationMapping
+  }
+
+  resolveProviderTaskConversation(input: {
+    provider: string
+    profile_id: string
+    task_id: string
+  }): ProviderTaskConversationMapping | null {
+    const provider = mappingText(input.provider, 'provider', 128)
+    const profileId = mappingText(input.profile_id, 'profile_id', PROFILE_ID_CHARS)
+    const taskId = mappingText(input.task_id, 'task_id', 256)
+    const row = this.get(
+      `SELECT provider, profile_id, task_id, canonical_url, proved_job_id, observed_at
+       FROM provider_task_conversations
+       WHERE provider = ? AND profile_id = ? AND task_id = ?`,
+      provider,
+      profileId,
+      taskId,
+    )
+    return row ? rowToProviderTaskConversation(row) : null
+  }
+
+  resolveProviderMapping(input: {
+    provider: string
+    profile_id: string
+    project_name: string
+    task_id?: string | null | undefined
+  }): {
+    project: ProviderProjectMapping
+    conversation: ProviderConversationMapping | null
+  } | null {
+    const provider = mappingText(input.provider, 'provider', 128)
+    const profileId = mappingText(input.profile_id, 'profile_id', PROFILE_ID_CHARS)
+    const projectName = mappingText(input.project_name, 'project_name', 256)
+    const projects = this.all(
+      `SELECT
+        provider, profile_id, resource_id, name, canonical_url,
+        first_observed_at, last_observed_at, last_visible_proof, creation_job_id
+       FROM provider_projects
+       WHERE provider = ? AND profile_id = ? AND name = ?
+       ORDER BY resource_id`,
+      provider,
+      profileId,
+      projectName,
+    ).map(rowToProviderProject)
+    if (projects.length === 0) return null
+    if (projects.length > 1) {
+      throw invalidInput('provider project mapping is ambiguous for the exact visible name')
+    }
+    const project = projects[0] as ProviderProjectMapping
+    const taskId = input.task_id === undefined || input.task_id === null
+      ? null
+      : mappingText(input.task_id, 'task_id', 256)
+    return {
+      project,
+      conversation: taskId === null
+        ? null
+        : this.findProviderConversation(provider, profileId, project.resource_id, taskId),
+    }
+  }
+
+  private getProviderProject(provider: string, profileId: string, resourceId: string) {
+    const row = this.get(
+      `SELECT
+        provider, profile_id, resource_id, name, canonical_url,
+        first_observed_at, last_observed_at, last_visible_proof, creation_job_id
+       FROM provider_projects
+       WHERE provider = ? AND profile_id = ? AND resource_id = ?`,
+      provider,
+      profileId,
+      resourceId,
+    )
+    if (!row) throw invalidInput('provider project mapping was not found')
+    return rowToProviderProject(row)
+  }
+
+  private getProviderConversation(provider: string, profileId: string, projectResourceId: string, taskId: string) {
+    const mapping = this.findProviderConversation(provider, profileId, projectResourceId, taskId)
+    if (!mapping) throw invalidInput('provider conversation mapping was not found')
+    return mapping
+  }
+
+  private findProviderConversation(provider: string, profileId: string, projectResourceId: string, taskId: string) {
+    const row = this.get(
+      `SELECT
+        provider, profile_id, project_resource_id, task_id,
+        canonical_url, proved_job_id, observed_at
+       FROM provider_conversations
+       WHERE provider = ? AND profile_id = ? AND project_resource_id = ? AND task_id = ?`,
+      provider,
+      profileId,
+      projectResourceId,
+      taskId,
+    )
+    return row ? rowToProviderConversation(row) : null
+  }
+
+  claimJob(jobId: string, claimToken: string) {
+    const nowMs = nowUnixMillis()
+    this.requeueExpiredClaimsAt(nowMs)
+    const now = nowRfc3339()
+    const expiresAt = saturatingAdd(nowMs, this.claimLeaseMs)
+    const result = this.run(
+      `UPDATE jobs
+       SET status = ?, updated_at = ?, claim_expires_at = ?, eligible_at = NULL
+       WHERE job_id = ? AND claim_token = ? AND status = ?
+         AND (eligible_at IS NULL OR eligible_at <= ?)`,
+      'claimed',
+      now,
+      expiresAt,
+      jobId,
+      claimToken,
+      'queued',
+      now,
+    )
+    if (result.changes === 1) return this.getJobWithoutRecovery(jobId)
+    return this.explainClaimFailure(jobId, claimToken)
+  }
+
+  claimNextJob(
+    query: ClaimNextInput = {},
+    executionBackend: ExecutionBackend = 'playwright',
+    profileIdInput: string | null = null
+  ) {
+    const nowMs = nowUnixMillis()
+    const profileId = profileIdInput === null ? null : normalizeProfileId(profileIdInput, 'profile_id')
+    validateClaimBackendProfile(executionBackend, profileId)
+    const provider = query.provider === undefined ? null : normalizeNonempty(query.provider, 'provider')
+    const action = query.action === undefined ? null : normalizeNonempty(query.action, 'action')
+    const jobIdPrefix = query.job_id_prefix === undefined
+      ? null
+      : mappingText(query.job_id_prefix, 'job_id_prefix', 192)
+    this.requeueExpiredClaimsAt(nowMs)
+    const now = nowRfc3339()
+    const expiresAt = saturatingAdd(nowMs, this.claimLeaseMs)
+    const nextClaimToken = generateSecretToken()
+    const row = this.get(
+      `UPDATE jobs
+       SET status = ?, updated_at = ?, claim_expires_at = ?, claim_token = ?, eligible_at = NULL
+       WHERE job_id = (
+         SELECT job_id
+         FROM jobs
+         WHERE status = ?
+           AND (eligible_at IS NULL OR eligible_at <= ?)
+           AND execution_backend = ?
+           AND ((? IS NULL AND profile_id IS NULL) OR profile_id = ?)
+           AND (? IS NULL OR provider = ?)
+           AND (? IS NULL OR action = ?)
+           AND (? IS NULL OR substr(job_id, 1, length(?)) = ?)
+         ORDER BY created_at ASC, job_id ASC
+         LIMIT 1
+       )
+       RETURNING
+         job_id, claim_token, execution_backend, profile_id, agent_kind, agent_session_id,
+         provider, action, status, request_json, result_json, error_json,
+         blocker_json, checkpoint_json, resume_json, provider_attempts_json,
+         provider_submitted_at, eligible_at,
+         created_at, updated_at, claim_expires_at`,
+      'claimed',
+      now,
+      expiresAt,
+      nextClaimToken,
+      'queued',
+      now,
+      executionBackend,
+      profileId,
+      profileId,
+      provider,
+      provider,
+      action,
+      action,
+      jobIdPrefix,
+      jobIdPrefix,
+      jobIdPrefix
+    )
+    return row ? rowToJob(row) : null
+  }
+
+  projectProviderCapacity(input: ProjectProviderCapacityInput): ProviderCapacityProjection {
+    const provider = normalizeNonempty(input.provider, 'provider')
+    const profileId = normalizeProfileId(input.profile_id, 'profile_id')
+    const accessClass = normalizeNonempty(input.access_class, 'access_class')
+    const now = nowRfc3339()
+    return providerCapacityPolicy.project({
+      provider,
+      profileId,
+      accessClass,
+      tierLabel: normalizeOptionalText(input.tier_label),
+      subscriptionLabel: normalizeOptionalText(input.subscription_label),
+      requestJson: input.request_json,
+      history: this.providerSubmissionHistory(provider, profileId, now),
+      now,
+    })
+  }
+
+  projectJobProviderCapacity(
+    jobId: string,
+    claimToken: string,
+    subscription: ProviderCapacitySubscription,
+  ): ProviderCapacityProjection {
+    const nowMs = nowUnixMillis()
+    const job = this.getJobWithoutRecovery(jobId)
+    assertActiveClaim(job, claimToken, nowMs)
+    if (job.profile_id === null) throw invalidInput('provider capacity requires a profile-scoped job')
+    if (job.provider_submitted_at !== null) {
+      return providerCapacityPolicy.project({
+        provider: job.provider,
+        profileId: job.profile_id,
+        accessClass: normalizeNonempty(subscription.access_class, 'access_class'),
+        tierLabel: normalizeOptionalText(subscription.tier_label),
+        subscriptionLabel: normalizeOptionalText(subscription.subscription_label),
+        requestJson: { actions: [] },
+        history: [],
+      })
+    }
+    return this.projectProviderCapacity({
+      provider: job.provider,
+      profile_id: job.profile_id,
+      access_class: subscription.access_class,
+      tier_label: subscription.tier_label,
+      subscription_label: subscription.subscription_label,
+      request_json: job.request_json,
+    })
+  }
+
+  deferJobForProviderCapacity(jobId: string, claimToken: string, projection: ProviderCapacityProjection) {
+    const nowMs = nowUnixMillis()
+    const job = this.getJobWithoutRecovery(jobId)
+    assertActiveClaim(job, claimToken, nowMs)
+    if (
+      projection.decision !== 'defer' ||
+      projection.provider !== job.provider ||
+      projection.profileId !== job.profile_id ||
+      !projection.eligibleAt
+    ) {
+      throw invalidInput('provider capacity projection cannot defer this job')
+    }
+    return this.deferClaimedJob(job, claimToken, projection.eligibleAt, {
+      code: 'provider_capacity_deferred',
+      projection,
+    }, nowMs)
+  }
+
+  recordProviderSubmission(jobId: string, claimToken: string) {
+    const nowMs = nowUnixMillis()
+    const now = nowRfc3339()
+    const job = this.getJobWithoutRecovery(jobId)
+    assertActiveClaim(job, claimToken, nowMs)
+    if (job.provider_submitted_at !== null) return job
+    const result = this.run(
+      `UPDATE jobs
+       SET provider_submitted_at = ?, updated_at = ?
+       WHERE job_id = ? AND claim_token = ?
+         AND provider_submitted_at IS NULL
+         AND status IN ('claimed', 'running', 'waiting_for_user')
+         AND claim_expires_at > ?`,
+      now,
+      now,
+      jobId,
+      claimToken,
+      nowMs,
+    )
+    if (result.changes === 1) return this.getJobWithoutRecovery(jobId)
+    return this.explainActiveClaimFailure(jobId, claimToken, nowMs)
+  }
+
+  deferObservedProviderLimit(jobId: string, claimToken: string, blockerJson: unknown, delaySeconds = 300) {
+    const nowMs = nowUnixMillis()
+    const job = this.getJobWithoutRecovery(jobId)
+    assertActiveClaim(job, claimToken, nowMs)
+    if (job.provider_submitted_at !== null) {
+      throw invalidInput('a job cannot be rerouted or deferred after provider submission')
+    }
+    const boundedDelayMs = Math.min(3_600_000, Math.max(60_000, Math.floor(delaySeconds * 1000)))
+    return this.deferClaimedJob(
+      job,
+      claimToken,
+      new Date(nowMs + boundedDelayMs).toISOString(),
+      blockerJson,
+      nowMs,
+    )
+  }
+
+  renewClaim(jobId: string, claimToken: string) {
+    const nowMs = nowUnixMillis()
+    const now = nowRfc3339()
+    const expiresAt = saturatingAdd(nowMs, this.claimLeaseMs)
+    const result = this.run(
+      `UPDATE jobs
+       SET claim_expires_at = ?, updated_at = ?
+       WHERE job_id = ?
+         AND claim_token = ?
+         AND status IN ('claimed', 'running', 'waiting_for_user')
+         AND claim_expires_at > ?`,
+      expiresAt,
+      now,
+      jobId,
+      claimToken,
+      nowMs
+    )
+    if (result.changes === 1) return this.getJobWithoutRecovery(jobId)
+    return this.explainActiveClaimFailure(jobId, claimToken, nowMs)
+  }
+
+  markRunning(jobId: string, claimToken: string) {
+    const nowMs = nowUnixMillis()
+    const now = nowRfc3339()
+    const expiresAt = saturatingAdd(nowMs, this.claimLeaseMs)
+    const attempts = updateCurrentProviderAttempt(this.getJobWithoutRecovery(jobId), 'running')
+    const result = this.run(
+      `UPDATE jobs
+       SET status = ?, blocker_json = NULL, claim_expires_at = ?, updated_at = ?,
+           provider_attempts_json = ?
+       WHERE job_id = ?
+         AND claim_token = ?
+         AND status IN ('claimed', 'waiting_for_user')
+         AND claim_expires_at > ?`,
+      'running',
+      expiresAt,
+      now,
+      stringifyJson(attempts),
+      jobId,
+      claimToken,
+      nowMs
+    )
+    if (result.changes === 1) return this.getJobWithoutRecovery(jobId)
+    return this.explainRunningFailure(jobId, claimToken, nowMs)
+  }
+
+  markWaitingForUser(jobId: string, claimToken: string, blockerJson: unknown) {
+    const nowMs = nowUnixMillis()
+    const now = nowRfc3339()
+    const expiresAt = saturatingAdd(nowMs, this.claimLeaseMs)
+    const attempts = updateCurrentProviderAttempt(this.getJobWithoutRecovery(jobId), 'waiting_for_user', blockerJson)
+    const result = this.run(
+      `UPDATE jobs
+       SET status = ?, blocker_json = ?, claim_expires_at = ?, updated_at = ?,
+           provider_attempts_json = ?, outcome_revision = outcome_revision + 1
+       WHERE job_id = ?
+         AND claim_token = ?
+         AND status = 'running'
+         AND claim_expires_at > ?`,
+      'waiting_for_user',
+      stringifyJson(blockerJson),
+      expiresAt,
+      now,
+      stringifyJson(attempts),
+      jobId,
+      claimToken,
+      nowMs
+    )
+    if (result.changes === 1) return this.getJobWithoutRecovery(jobId)
+    return this.explainActiveClaimFailure(jobId, claimToken, nowMs)
+  }
+
+  checkpointJob(jobId: string, claimToken: string, checkpointJson: unknown) {
+    const nowMs = nowUnixMillis()
+    const now = nowRfc3339()
+    const result = this.run(
+      `UPDATE jobs
+       SET checkpoint_json = ?, updated_at = ?
+       WHERE job_id = ?
+         AND claim_token = ?
+         AND execution_backend = 'playwright'
+         AND status IN ('claimed', 'running', 'waiting_for_user')
+         AND claim_expires_at > ?`,
+      stringifyJson(checkpointJson),
+      now,
+      jobId,
+      claimToken,
+      nowMs
+    )
+    if (result.changes === 1) return this.getJobWithoutRecovery(jobId)
+    return this.explainPlaywrightActiveFailure(
+      jobId,
+      claimToken,
+      nowMs,
+      'only playwright jobs can persist browser checkpoints',
+      'claimed, running, or waiting_for_user'
+    )
+  }
+
+  parkJob(jobId: string, claimToken: string, blockerJson: unknown, checkpointJson: unknown) {
+    const nowMs = nowUnixMillis()
+    const now = nowRfc3339()
+    const replacementToken = generateSecretToken()
+    const attempts = updateCurrentProviderAttempt(this.getJobWithoutRecovery(jobId), 'waiting_for_user', blockerJson)
+    const result = this.run(
+      `UPDATE jobs
+       SET status = ?, claim_token = ?, blocker_json = ?,
+           checkpoint_json = ?, resume_json = NULL,
+           claim_expires_at = NULL, updated_at = ?,
+           provider_attempts_json = ?, outcome_revision = outcome_revision + 1
+       WHERE job_id = ?
+         AND claim_token = ?
+         AND execution_backend = 'playwright'
+         AND status IN ('claimed', 'running', 'waiting_for_user')
+         AND claim_expires_at > ?`,
+      'waiting_for_user',
+      replacementToken,
+      stringifyJson(blockerJson),
+      stringifyJson(checkpointJson),
+      now,
+      stringifyJson(attempts),
+      jobId,
+      claimToken,
+      nowMs
+    )
+    if (result.changes === 1) return this.getJobWithoutRecovery(jobId)
+    return this.explainPlaywrightActiveFailure(
+      jobId,
+      claimToken,
+      nowMs,
+      'only playwright jobs can be parked for browser resume',
+      'claimed, running, or waiting_for_user'
+    )
+  }
+
+  fallbackJob(input: {
+    job_id: string
+    claim_token: string
+    provider: string
+    request_json: unknown
+    blocker_json: unknown
+  }) {
+    const nowMs = nowUnixMillis()
+    const now = nowRfc3339()
+    const provider = normalizeNonempty(input.provider, 'provider')
+    const replacementToken = generateSecretToken()
+    const requestJson = stringifyJson(input.request_json)
+    return this.transaction(() => {
+      const job = this.getJobWithoutRecovery(input.job_id)
+      if (job.claim_token !== input.claim_token) throw claimRejected(input.job_id)
+      if (!ACTIVE_STATUSES.has(job.status) || job.claim_expires_at_ms === null || job.claim_expires_at_ms <= nowMs) {
+        throw invalidJobState(job.job_id, 'active claimed playwright job', job.status)
+      }
+      if (job.execution_backend !== 'playwright') throw invalidInput('only playwright jobs can fallback providers')
+      if (job.provider_submitted_at !== null) throw invalidInput('jobs cannot fallback after provider submission')
+      if (job.provider === provider) throw invalidInput('fallback provider must differ from the current provider')
+      const attempts = providerAttempts(job.provider_attempts_json)
+      const current = attempts.at(-1) ?? providerAttempt(1, job.provider, 'queued', job.created_at)
+      const completed = {
+        ...current,
+        status: 'blocked',
+        completedAt: now,
+        blocker: input.blocker_json,
+      }
+      const next = providerAttempt(current.attempt + 1, provider, 'queued', now)
+      const result = this.run(
+        `UPDATE jobs
+         SET provider = ?, request_json = ?, status = 'queued', claim_token = ?,
+             result_json = NULL, error_json = NULL, blocker_json = NULL,
+             checkpoint_json = NULL, resume_json = NULL, claim_expires_at = NULL,
+             eligible_at = NULL,
+             provider_attempts_json = ?, updated_at = ?,
+             outcome_revision = outcome_revision + 1
+         WHERE job_id = ? AND claim_token = ?
+           AND status IN ('claimed', 'running', 'waiting_for_user')
+           AND claim_expires_at > ?`,
+        provider,
+        requestJson,
+        replacementToken,
+        stringifyJson([...attempts.slice(0, -1), completed, next]),
+        now,
+        input.job_id,
+        input.claim_token,
+        nowMs,
+      )
+      if (result.changes !== 1) return this.explainActiveClaimFailure(input.job_id, input.claim_token, nowMs)
+      return this.getJobWithoutRecovery(input.job_id)
+    })
+  }
+
+  resumeJob(jobId: string, resumeJson: unknown) {
+    const nowMs = nowUnixMillis()
+    this.requeueExpiredClaimsAt(nowMs)
+    const now = nowRfc3339()
+    const replacementToken = generateSecretToken()
+    const serializedResume = stringifyJson(resumeJson)
+    return this.transaction(() => {
+      const job = this.getJobWithoutRecovery(jobId)
+      const checkpointPresent = this.exists(
+        'SELECT EXISTS (SELECT 1 FROM jobs WHERE job_id = ? AND checkpoint_json IS NOT NULL) AS present',
+        jobId
+      )
+      if (job.execution_backend !== 'playwright') {
+        throw invalidInput('only playwright jobs can be resumed with browser visibility')
+      }
+      if (
+        (job.status === 'queued' || job.status === 'claimed' || job.status === 'running') &&
+        job.resume_json !== null
+      ) {
+        return job
+      }
+      if (job.status !== 'waiting_for_user' || !checkpointPresent || job.claim_expires_at_ms !== null) {
+        throw invalidJobState(job.job_id, 'parked playwright waiting_for_user', job.status)
+      }
+      const result = this.run(
+        `UPDATE jobs
+         SET status = 'queued', claim_token = ?, resume_json = ?,
+             claim_expires_at = NULL, updated_at = ?
+         WHERE job_id = ?
+           AND execution_backend = 'playwright'
+           AND status = 'waiting_for_user'
+           AND checkpoint_json IS NOT NULL
+           AND claim_expires_at IS NULL`,
+        replacementToken,
+        serializedResume,
+        now,
+        jobId
+      )
+      if (result.changes !== 1) {
+        throw invalidJobState(jobId, 'parked playwright waiting_for_user', job.status)
+      }
+      return this.getJobWithoutRecovery(jobId)
+    })
+  }
+
+  completeJob(jobId: string, claimToken: string, completion: { result_json: unknown } | { error_json: unknown }) {
+    const nowMs = nowUnixMillis()
+    const now = nowRfc3339()
+    const status: JobStatus = 'result_json' in completion ? 'succeeded' : 'failed'
+    const resultJson = 'result_json' in completion ? stringifyJson(completion.result_json) : null
+    const errorJson = 'error_json' in completion ? stringifyJson(completion.error_json) : null
+    const job = this.getJobWithoutRecovery(jobId)
+    const attempts = providerAttempts(job.provider_attempts_json)
+    const current = attempts.at(-1) ?? providerAttempt(1, job.provider, 'queued', job.created_at)
+    const completedAttempts = [
+      ...attempts.slice(0, -1),
+      { ...current, status, completedAt: now },
+    ]
+    const result = this.run(
+      `UPDATE jobs
+       SET status = ?, result_json = ?, error_json = ?, blocker_json = NULL,
+           checkpoint_json = NULL, resume_json = NULL,
+           provider_attempts_json = ?, updated_at = ?, claim_expires_at = NULL,
+           outcome_revision = outcome_revision + 1
+       WHERE job_id = ?
+         AND claim_token = ?
+         AND status IN ('claimed', 'running', 'waiting_for_user')
+         AND claim_expires_at > ?`,
+      status,
+      resultJson,
+      errorJson,
+      stringifyJson(completedAttempts),
+      now,
+      jobId,
+      claimToken,
+      nowMs
+    )
+    if (result.changes === 1) return this.getJobWithoutRecovery(jobId)
+    return this.explainActiveClaimFailure(jobId, claimToken, nowMs)
+  }
+
+  async cancelJob(jobId: string, reason: unknown | undefined) {
+    const now = nowRfc3339()
+    const errorJson = stringifyJson(reason === undefined || reason === null
+      ? { code: 'job_canceled' }
+      : { code: 'job_canceled', reason })
+    const attempts = updateCurrentProviderAttempt(this.getJobWithoutRecovery(jobId), 'canceled', null, now)
+    const result = this.run(
+      `UPDATE jobs
+       SET status = ?, result_json = NULL, error_json = ?, blocker_json = NULL,
+           checkpoint_json = NULL, resume_json = NULL,
+           provider_attempts_json = ?, updated_at = ?, claim_expires_at = NULL,
+           outcome_revision = outcome_revision + 1
+       WHERE job_id = ? AND status IN ('queued', 'claimed', 'running', 'waiting_for_user')`,
+      'canceled',
+      errorJson,
+      stringifyJson(attempts),
+      now,
+      jobId
+    )
+    const job = this.getJobWithoutRecovery(jobId)
+    if (result.changes === 1) {
+      await cleanupVisibleAttachmentBundlesForRequest(this.homeDir, job.request_json).catch(() => undefined)
+      return job
+    }
+    throw invalidJobState(jobId, 'queued, claimed, running, or waiting_for_user', job.status)
+  }
+
+  recoverActiveClaim(jobId: string, claimToken: string) {
+    const now = nowRfc3339()
+    return this.transaction(() => {
+      const row = this.get(
+        `SELECT
+          job_id, claim_token, execution_backend, profile_id, agent_kind, agent_session_id,
+          provider, action, status, request_json, result_json, error_json,
+          blocker_json, checkpoint_json, resume_json, provider_attempts_json,
+          provider_submitted_at, eligible_at,
+          created_at, updated_at, claim_expires_at
+         FROM jobs
+         WHERE job_id = ?`,
+        jobId
+      )
+      if (!row) return null
+      const job = rowToJob(row)
+      if (
+        job.claim_token !== claimToken ||
+        !ACTIVE_STATUSES.has(job.status)
+      ) {
+        return null
+      }
+      if (job.status === 'claimed' || job.status === 'running') {
+        const result = this.run(
+          `UPDATE jobs
+           SET status = 'queued', claim_token = ?, claim_expires_at = NULL,
+               blocker_json = NULL, resume_json = NULL, updated_at = ?
+           WHERE job_id = ?
+             AND claim_token = ?
+             AND status IN ('claimed', 'running')`,
+          generateSecretToken(),
+          now,
+          jobId,
+          claimToken
+        )
+        return result.changes === 1 ? this.getJobWithoutRecovery(jobId) : null
+      }
+      if (job.execution_backend === 'playwright' && row.checkpoint_json !== null) {
+        const result = this.run(
+          `UPDATE jobs
+           SET claim_token = ?, blocker_json = ?,
+               claim_expires_at = NULL, resume_json = NULL,
+               updated_at = ?, outcome_revision = outcome_revision + 1
+           WHERE job_id = ?
+             AND claim_token = ?
+             AND status = 'waiting_for_user'
+             AND execution_backend = 'playwright'
+             AND checkpoint_json IS NOT NULL`,
+          generateSecretToken(),
+          stringifyJson(parkedResumeBlockerJson(job.blocker_json)),
+          now,
+          jobId,
+          claimToken
+        )
+        return result.changes === 1 ? this.getJobWithoutRecovery(jobId) : null
+      }
+      const errorJson = stringifyJson(expiredWaitingClaimErrorJson())
+      const result = this.run(
+        `UPDATE jobs
+         SET status = 'failed', error_json = ?, result_json = NULL,
+             blocker_json = NULL, checkpoint_json = NULL, resume_json = NULL,
+             claim_expires_at = NULL, updated_at = ?,
+             outcome_revision = outcome_revision + 1
+         WHERE job_id = ?
+           AND claim_token = ?
+           AND status = 'waiting_for_user'`,
+        errorJson,
+        now,
+        jobId,
+        claimToken
+      )
+      return result.changes === 1 ? this.getJobWithoutRecovery(jobId) : null
+    })
+  }
+
+  requeueExpiredClaims() {
+    return this.requeueExpiredClaimsAt(nowUnixMillis())
+  }
+
+  private requeueExpiredClaimsAt(nowMs: number) {
+    const now = nowRfc3339()
+    this.parkExpiredCheckpointedWaitingClaimsAt(nowMs)
+    this.failExpiredWaitingClaimsAt(nowMs)
+    const exists = this.exists(
+      `SELECT EXISTS (
+        SELECT 1 FROM jobs
+        WHERE status IN ('claimed', 'running')
+          AND (claim_expires_at IS NULL OR claim_expires_at <= ?)
+      ) AS present`,
+      nowMs
+    )
+    if (!exists) return 0
+    return this.transaction(() => {
+      const expiredJobIds = this.all(
+        `SELECT job_id
+         FROM jobs
+         WHERE status IN ('claimed', 'running')
+           AND (claim_expires_at IS NULL OR claim_expires_at <= ?)
+         ORDER BY job_id ASC`,
+        nowMs
+      ).map((row) => String(row.job_id))
+      let requeued = 0
+      for (const jobId of expiredJobIds) {
+        const result = this.run(
+          `UPDATE jobs
+           SET status = 'queued', claim_token = ?, claim_expires_at = NULL,
+               blocker_json = NULL, resume_json = NULL, updated_at = ?
+           WHERE job_id = ?
+             AND status IN ('claimed', 'running')
+             AND (claim_expires_at IS NULL OR claim_expires_at <= ?)`,
+          generateSecretToken(),
+          now,
+          jobId,
+          nowMs
+        )
+        requeued += Number(result.changes)
+      }
+      return requeued
+    })
+  }
+
+  private parkExpiredCheckpointedWaitingClaimsAt(nowMs: number) {
+    const now = nowRfc3339()
+    const exists = this.exists(
+      `SELECT EXISTS (
+        SELECT 1 FROM jobs
+        WHERE status = 'waiting_for_user'
+          AND execution_backend = 'playwright'
+          AND checkpoint_json IS NOT NULL
+          AND claim_expires_at <= ?
+      ) AS present`,
+      nowMs
+    )
+    if (!exists) return 0
+    return this.transaction(() => {
+      const expiredJobs = this.all(
+        `SELECT job_id, blocker_json
+         FROM jobs
+         WHERE status = 'waiting_for_user'
+           AND execution_backend = 'playwright'
+           AND checkpoint_json IS NOT NULL
+           AND claim_expires_at <= ?
+         ORDER BY job_id ASC`,
+        nowMs
+      )
+      let parked = 0
+      for (const row of expiredJobs) {
+        const result = this.run(
+          `UPDATE jobs
+           SET claim_token = ?, blocker_json = ?,
+               claim_expires_at = NULL, resume_json = NULL,
+               updated_at = ?, outcome_revision = outcome_revision + 1
+           WHERE job_id = ?
+             AND status = 'waiting_for_user'
+             AND execution_backend = 'playwright'
+             AND checkpoint_json IS NOT NULL
+             AND claim_expires_at <= ?`,
+          generateSecretToken(),
+          stringifyJson(parkedResumeBlockerJson(parseOptionalJson(row.blocker_json))),
+          now,
+          String(row.job_id),
+          nowMs
+        )
+        parked += Number(result.changes)
+      }
+      return parked
+    })
+  }
+
+  private failExpiredWaitingClaimsAt(nowMs: number) {
+    const now = nowRfc3339()
+    const errorJson = stringifyJson(expiredWaitingClaimErrorJson())
+    return this.run(
+      `UPDATE jobs
+       SET status = 'failed', error_json = ?, result_json = NULL,
+           blocker_json = NULL, checkpoint_json = NULL, resume_json = NULL,
+           claim_expires_at = NULL, updated_at = ?,
+           outcome_revision = outcome_revision + 1
+       WHERE status = 'waiting_for_user'
+         AND (execution_backend != 'playwright' OR checkpoint_json IS NULL)
+         AND (claim_expires_at IS NULL OR claim_expires_at <= ?)`,
+      errorJson,
+      now,
+      nowMs
+    ).changes
+  }
+
+  private providerSubmissionHistory(providerId: string, profileId: string, now: string) {
+    const provider = providerRateLimitCatalog().providers[providerId]
+    const maximumWindowSeconds = provider?.rules.reduce(
+      (maximum, rule) => Math.max(maximum, rule.window.durationSeconds ?? 0),
+      0,
+    ) ?? 0
+    if (maximumWindowSeconds <= 0) return []
+    const since = new Date(Date.parse(now) - maximumWindowSeconds * 1000).toISOString()
+    return this.all(
+      `SELECT provider_submitted_at, request_json
+       FROM jobs
+       WHERE provider = ? AND profile_id = ?
+         AND provider_submitted_at IS NOT NULL
+         AND provider_submitted_at > ? AND provider_submitted_at <= ?
+       ORDER BY provider_submitted_at ASC, job_id ASC`,
+      providerId,
+      profileId,
+      since,
+      now,
+    ).map((row) => ({
+      submittedAt: String(row.provider_submitted_at),
+      requestJson: parseJson(row.request_json),
+    }))
+  }
+
+  private deferClaimedJob(
+    job: Job,
+    claimToken: string,
+    eligibleAtInput: string,
+    blockerJson: unknown,
+    nowMs: number,
+  ) {
+    const eligibleMs = Date.parse(eligibleAtInput)
+    if (!Number.isFinite(eligibleMs) || eligibleMs <= nowMs) {
+      throw invalidInput('eligible_at must be a future RFC 3339 timestamp')
+    }
+    const now = new Date(nowMs).toISOString()
+    const result = this.run(
+      `UPDATE jobs
+       SET status = 'queued', claim_token = ?, claim_expires_at = NULL,
+           blocker_json = ?, eligible_at = ?, updated_at = ?
+       WHERE job_id = ? AND claim_token = ?
+         AND provider_submitted_at IS NULL
+         AND status IN ('claimed', 'running', 'waiting_for_user')
+         AND claim_expires_at > ?`,
+      generateSecretToken(),
+      stringifyJson(blockerJson),
+      new Date(eligibleMs).toISOString(),
+      now,
+      job.job_id,
+      claimToken,
+      nowMs,
+    )
+    if (result.changes === 1) return this.getJobWithoutRecovery(job.job_id)
+    return this.explainActiveClaimFailure(job.job_id, claimToken, nowMs)
+  }
+
+  private initialize() {
+    this.execWithBusyRetry(`
+      PRAGMA journal_mode = WAL;
+      PRAGMA foreign_keys = ON;
+    `)
+    this.createBaseTables()
+    this.migrateJobsTable()
+    this.createIndexes()
+    restrictFilePermissionsSync(this.databasePath)
+  }
+
+  private createBaseTables() {
+    this.execWithBusyRetry(`
+      CREATE TABLE IF NOT EXISTS jobs (
+        job_id TEXT PRIMARY KEY NOT NULL,
+        claim_token TEXT NOT NULL,
+        execution_backend TEXT NOT NULL DEFAULT 'playwright' CHECK (
+          execution_backend = 'playwright'
+        ),
+        profile_id TEXT CHECK (
+          profile_id IS NULL OR length(profile_id) BETWEEN 1 AND 128
+        ),
+        agent_kind TEXT CHECK (
+          agent_kind IS NULL OR length(agent_kind) BETWEEN 1 AND 128
+        ),
+        agent_session_id TEXT CHECK (
+          agent_session_id IS NULL OR length(agent_session_id) BETWEEN 1 AND 256
+        ),
+        provider TEXT NOT NULL,
+        action TEXT NOT NULL,
+        status TEXT NOT NULL CHECK (
+          status IN (
+            'queued',
+            'claimed',
+            'running',
+            'waiting_for_user',
+            'succeeded',
+            'failed',
+            'canceled',
+            'timed_out'
+          )
+        ),
+        request_json TEXT NOT NULL,
+        result_json TEXT,
+        error_json TEXT,
+        blocker_json TEXT,
+        checkpoint_json TEXT,
+        resume_json TEXT,
+        provider_attempts_json TEXT NOT NULL DEFAULT '[]',
+        provider_submitted_at TEXT,
+        eligible_at TEXT,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        claim_expires_at INTEGER,
+        summary_task_id TEXT CHECK (
+          summary_task_id IS NULL OR length(summary_task_id) <= 256
+        ),
+        summary_project_name TEXT CHECK (
+          summary_project_name IS NULL OR length(summary_project_name) <= 256
+        ),
+        summary_chat_name TEXT CHECK (
+          summary_chat_name IS NULL OR length(summary_chat_name) <= 256
+        ),
+        summary_idempotency_key TEXT CHECK (
+          summary_idempotency_key IS NULL OR length(summary_idempotency_key) <= 256
+        ),
+        replay_reported_at TEXT,
+        outcome_revision INTEGER NOT NULL DEFAULT 0 CHECK (outcome_revision >= 0),
+        reported_outcome_revision INTEGER CHECK (
+          reported_outcome_revision IS NULL OR reported_outcome_revision >= 0
+        ),
+        CHECK (
+          (agent_kind IS NULL AND agent_session_id IS NULL)
+          OR (agent_kind IS NOT NULL AND agent_session_id IS NOT NULL)
+        )
+      );
+      CREATE TABLE IF NOT EXISTS job_task_keys (
+        job_id TEXT NOT NULL REFERENCES jobs(job_id) ON DELETE CASCADE,
+        task_id TEXT NOT NULL CHECK (length(task_id) BETWEEN 1 AND 256),
+        PRIMARY KEY (job_id, task_id)
+      );
+      CREATE TABLE IF NOT EXISTS provider_projects (
+        provider TEXT NOT NULL CHECK (length(provider) BETWEEN 1 AND 128),
+        profile_id TEXT NOT NULL CHECK (length(profile_id) BETWEEN 1 AND 128),
+        resource_id TEXT NOT NULL CHECK (length(resource_id) BETWEEN 1 AND 256),
+        name TEXT NOT NULL CHECK (length(name) BETWEEN 1 AND 256),
+        canonical_url TEXT NOT NULL CHECK (length(canonical_url) BETWEEN 1 AND 2048),
+        first_observed_at TEXT NOT NULL,
+        last_observed_at TEXT NOT NULL,
+        last_visible_proof TEXT NOT NULL CHECK (length(last_visible_proof) BETWEEN 1 AND 512),
+        creation_job_id TEXT REFERENCES jobs(job_id),
+        PRIMARY KEY (provider, profile_id, resource_id)
+      );
+      CREATE TABLE IF NOT EXISTS provider_conversations (
+        provider TEXT NOT NULL,
+        profile_id TEXT NOT NULL,
+        project_resource_id TEXT NOT NULL,
+        task_id TEXT NOT NULL CHECK (length(task_id) BETWEEN 1 AND 256),
+        canonical_url TEXT NOT NULL CHECK (length(canonical_url) BETWEEN 1 AND 2048),
+        proved_job_id TEXT NOT NULL REFERENCES jobs(job_id),
+        observed_at TEXT NOT NULL,
+        PRIMARY KEY (provider, profile_id, project_resource_id, task_id),
+        FOREIGN KEY (provider, profile_id, project_resource_id)
+          REFERENCES provider_projects(provider, profile_id, resource_id)
+          ON DELETE CASCADE
+      );
+      CREATE TABLE IF NOT EXISTS provider_task_conversations (
+        provider TEXT NOT NULL CHECK (length(provider) BETWEEN 1 AND 128),
+        profile_id TEXT NOT NULL CHECK (length(profile_id) BETWEEN 1 AND 128),
+        task_id TEXT NOT NULL CHECK (length(task_id) BETWEEN 1 AND 256),
+        canonical_url TEXT NOT NULL CHECK (length(canonical_url) BETWEEN 1 AND 2048),
+        proved_job_id TEXT NOT NULL REFERENCES jobs(job_id),
+        observed_at TEXT NOT NULL,
+        PRIMARY KEY (provider, profile_id, task_id)
+      );
+    `)
+  }
+
+  private createIndexes() {
+    this.execWithBusyRetry(`
+      CREATE INDEX IF NOT EXISTS jobs_status_created_at_idx
+        ON jobs(status, created_at);
+      CREATE INDEX IF NOT EXISTS jobs_provider_action_idx
+        ON jobs(provider, action);
+      CREATE INDEX IF NOT EXISTS jobs_claim_expires_at_idx
+        ON jobs(claim_expires_at);
+      CREATE INDEX IF NOT EXISTS jobs_backend_profile_status_fifo_idx
+        ON jobs(execution_backend, profile_id, status, created_at, job_id);
+      CREATE INDEX IF NOT EXISTS jobs_backend_profile_status_eligible_fifo_idx
+        ON jobs(execution_backend, profile_id, status, eligible_at, created_at, job_id);
+      CREATE INDEX IF NOT EXISTS jobs_provider_profile_submitted_idx
+        ON jobs(provider, profile_id, provider_submitted_at);
+      CREATE TRIGGER IF NOT EXISTS jobs_provider_submitted_at_immutable
+        BEFORE UPDATE OF provider_submitted_at ON jobs
+        WHEN OLD.provider_submitted_at IS NOT NULL
+          AND NEW.provider_submitted_at IS NOT OLD.provider_submitted_at
+        BEGIN
+          SELECT RAISE(ABORT, 'provider_submitted_at is immutable');
+        END;
+      CREATE INDEX IF NOT EXISTS job_task_keys_task_id_idx
+        ON job_task_keys(task_id, job_id);
+      CREATE INDEX IF NOT EXISTS jobs_replay_outcome_recipient_idx
+        ON jobs(agent_kind, agent_session_id, reported_outcome_revision, outcome_revision, updated_at, job_id);
+      CREATE INDEX IF NOT EXISTS provider_projects_exact_name_idx
+        ON provider_projects(provider, profile_id, name, resource_id);
+      CREATE INDEX IF NOT EXISTS provider_conversations_task_idx
+        ON provider_conversations(provider, profile_id, task_id, project_resource_id);
+      CREATE INDEX IF NOT EXISTS provider_task_conversations_job_idx
+        ON provider_task_conversations(proved_job_id);
+    `)
+  }
+
+  private migrateJobsTable() {
+    this.execWithBusyRetry('BEGIN IMMEDIATE')
+    try {
+      for (const [column, definition] of [
+        ['checkpoint_json', 'TEXT'],
+        ['resume_json', 'TEXT'],
+        ['provider_attempts_json', "TEXT NOT NULL DEFAULT '[]'"],
+        ['provider_submitted_at', 'TEXT'],
+        ['eligible_at', 'TEXT'],
+        ['claim_expires_at', 'INTEGER'],
+        ['summary_task_id', 'TEXT CHECK (summary_task_id IS NULL OR length(summary_task_id) <= 256)'],
+        ['summary_project_name', 'TEXT CHECK (summary_project_name IS NULL OR length(summary_project_name) <= 256)'],
+        ['summary_chat_name', 'TEXT CHECK (summary_chat_name IS NULL OR length(summary_chat_name) <= 256)'],
+        ['summary_idempotency_key', 'TEXT CHECK (summary_idempotency_key IS NULL OR length(summary_idempotency_key) <= 256)'],
+        ['agent_kind', 'TEXT CHECK (agent_kind IS NULL OR length(agent_kind) BETWEEN 1 AND 128)'],
+        ['agent_session_id', 'TEXT CHECK (agent_session_id IS NULL OR length(agent_session_id) BETWEEN 1 AND 256)'],
+        ['replay_reported_at', 'TEXT'],
+        ['outcome_revision', 'INTEGER NOT NULL DEFAULT 0 CHECK (outcome_revision >= 0)'],
+        ['reported_outcome_revision', 'INTEGER CHECK (reported_outcome_revision IS NULL OR reported_outcome_revision >= 0)'],
+      ] as const) {
+        this.ensureJobsColumn(column, definition)
+      }
+      this.exec(`
+        UPDATE jobs
+        SET outcome_revision = 1
+        WHERE outcome_revision = 0
+          AND (
+            status IN ('succeeded', 'failed', 'canceled', 'timed_out')
+            OR status = 'waiting_for_user'
+          )
+      `)
+      const columns = new Set(this.all('PRAGMA table_info(jobs)').map((row) => String(row.name)))
+      if (columns.has('replay_reported_job_updated_at')) {
+        this.exec(`
+          UPDATE jobs
+          SET reported_outcome_revision = outcome_revision
+          WHERE reported_outcome_revision IS NULL
+            AND outcome_revision > 0
+            AND replay_reported_job_updated_at = updated_at
+        `)
+      }
+      this.exec('COMMIT')
+    } catch (error) {
+      try {
+        this.exec('ROLLBACK')
+      } catch {
+        // The transaction may already have been closed by SQLite after an error.
+      }
+      throw error
+    }
+  }
+
+  private ensureJobsColumn(column: string, definition: string) {
+    const columns = new Set(this.all('PRAGMA table_info(jobs)').map((row) => String(row.name)))
+    if (columns.has(column)) return
+    this.exec(`ALTER TABLE jobs ADD COLUMN ${column} ${definition}`)
+  }
+
+  private getJobWithoutRecovery(jobId: string) {
+    const row = this.get(
+      `SELECT
+        job_id, claim_token, execution_backend, profile_id, agent_kind, agent_session_id,
+        provider, action, status, request_json, result_json, error_json,
+        blocker_json, checkpoint_json, resume_json,
+        provider_attempts_json,
+        provider_submitted_at, eligible_at,
+        created_at, updated_at, claim_expires_at
+       FROM jobs
+       WHERE job_id = ?`,
+      jobId
+    )
+    if (!row) throw jobNotFound(jobId)
+    return rowToJob(row)
+  }
+
+  private explainClaimFailure(jobId: string, claimToken: string): never {
+    const job = this.getJobWithoutRecovery(jobId)
+    if (job.claim_token !== claimToken) throw claimRejected(jobId)
+    throw invalidJobState(jobId, 'queued', job.status)
+  }
+
+  private explainActiveClaimFailure(jobId: string, claimToken: string, nowMs: number): never {
+    const job = this.getJobWithoutRecovery(jobId)
+    if (job.claim_token !== claimToken) throw claimRejected(jobId)
+    if (ACTIVE_STATUSES.has(job.status) && (job.claim_expires_at_ms === null || job.claim_expires_at_ms <= nowMs)) {
+      throw claimExpired(jobId)
+    }
+    throw invalidJobState(jobId, 'claimed, running, or waiting_for_user', job.status)
+  }
+
+  private explainRunningFailure(jobId: string, claimToken: string, nowMs: number): never {
+    const job = this.getJobWithoutRecovery(jobId)
+    if (job.claim_token !== claimToken) throw claimRejected(jobId)
+    if (ACTIVE_STATUSES.has(job.status) && (job.claim_expires_at_ms === null || job.claim_expires_at_ms <= nowMs)) {
+      throw claimExpired(jobId)
+    }
+    throw invalidJobState(jobId, 'claimed or waiting_for_user', job.status)
+  }
+
+  private explainPlaywrightActiveFailure(
+    jobId: string,
+    claimToken: string,
+    nowMs: number,
+    backendMessage: string,
+    expected: string
+  ): never {
+    const job = this.getJobWithoutRecovery(jobId)
+    if (job.claim_token !== claimToken) throw claimRejected(jobId)
+    if (ACTIVE_STATUSES.has(job.status) && (job.claim_expires_at_ms === null || job.claim_expires_at_ms <= nowMs)) {
+      throw claimExpired(jobId)
+    }
+    if (job.execution_backend !== 'playwright') throw invalidInput(backendMessage)
+    throw invalidJobState(job.job_id, expected, job.status)
+  }
+
+  private exec(sql: string) {
+    try {
+      this.#db.exec(sql)
+    } catch (error) {
+      throw sqliteError(error)
+    }
+  }
+
+  private execWithBusyRetry(sql: string) {
+    let lastError: unknown
+    for (let attempt = 0; attempt < 100; attempt += 1) {
+      try {
+        this.#db.exec(sql)
+        return
+      } catch (error) {
+        if (!isSqliteBusy(error)) throw sqliteError(error)
+        lastError = error
+        sleepSync(50)
+      }
+    }
+    throw sqliteError(lastError)
+  }
+
+  private run(sql: string, ...params: SQLInputValue[]) {
+    try {
+      return this.#db.prepare(sql).run(...params)
+    } catch (error) {
+      throw toDaemonError(error)
+    }
+  }
+
+  private get(sql: string, ...params: SQLInputValue[]) {
+    try {
+      return this.#db.prepare(sql).get(...params)
+    } catch (error) {
+      throw toDaemonError(error)
+    }
+  }
+
+  private all(sql: string, ...params: SQLInputValue[]) {
+    try {
+      return this.#db.prepare(sql).all(...params)
+    } catch (error) {
+      throw toDaemonError(error)
+    }
+  }
+
+  private exists(sql: string, ...params: SQLInputValue[]) {
+    const row = this.get(sql, ...params)
+    return Boolean(row && Number(Object.values(row)[0]) !== 0)
+  }
+
+  private transaction<T>(callback: () => T) {
+    this.exec('BEGIN IMMEDIATE')
+    try {
+      const result = callback()
+      this.exec('COMMIT')
+      return result
+    } catch (error) {
+      try {
+        this.exec('ROLLBACK')
+      } catch {
+        // Keep the original failure; a rollback failure means the connection is already unusable.
+      }
+      throw error
+    }
+  }
+}
+
+export function publicView(job: Job): JobView {
+  return {
+    job_id: job.job_id,
+    execution_backend: job.execution_backend,
+    profile_id: job.profile_id,
+    provider: job.provider,
+    action: job.action,
+    status: job.status,
+    request_json: job.request_json,
+    result_json: job.result_json,
+    error_json: job.error_json,
+    blocker_json: job.blocker_json,
+    provider_attempts_json: job.provider_attempts_json,
+    provider_submitted_at: job.provider_submitted_at,
+    eligible_at: job.eligible_at,
+    created_at: job.created_at,
+    updated_at: job.updated_at,
+  }
+}
+
+export function withClaimToken(job: Job): JobWithClaimToken {
+  return {
+    job_id: job.job_id,
+    claim_token: job.claim_token,
+    execution_backend: job.execution_backend,
+    profile_id: job.profile_id,
+    provider: job.provider,
+    action: job.action,
+    status: job.status,
+    request_json: job.request_json,
+    result_json: job.result_json,
+    error_json: job.error_json,
+    blocker_json: job.blocker_json,
+    checkpoint_json: job.checkpoint_json,
+    resume_json: job.resume_json,
+    provider_attempts_json: job.provider_attempts_json,
+    provider_submitted_at: job.provider_submitted_at,
+    eligible_at: job.eligible_at,
+    created_at: job.created_at,
+    updated_at: job.updated_at,
+  }
+}
+
+export function defaultHomeDir() {
+  if (process.env.TOKENLESS_HOME) return process.env.TOKENLESS_HOME
+  if (process.env.HOME) return path.join(process.env.HOME, '.tokenless')
+  const home = os.homedir()
+  if (home) return path.join(home, '.tokenless')
+  throw missingHomeError()
+}
+
+async function ensureTokenlessHome(homeDir: string) {
+  try {
+    await fs.mkdir(homeDir, { recursive: true, mode: 0o700 })
+    await fs.chmod(homeDir, 0o700).catch(() => undefined)
+  } catch (error) {
+    throw ioError(error)
+  }
+}
+
+async function ensureControlToken(tokenPath: string) {
+  try {
+    const token = fsSync.existsSync(tokenPath) ? fsSync.readFileSync(tokenPath, 'utf8').trim() : ''
+    if (token) {
+      restrictFilePermissionsSync(tokenPath)
+      return
+    }
+    const descriptor = fsSync.openSync(tokenPath, fsSync.constants.O_CREAT | fsSync.constants.O_EXCL | fsSync.constants.O_WRONLY, 0o600)
+    try {
+      fsSync.writeFileSync(descriptor, `${generateSecretToken()}\n`)
+      fsSync.fsyncSync(descriptor)
+    } finally {
+      fsSync.closeSync(descriptor)
+    }
+    restrictFilePermissionsSync(tokenPath)
+  } catch (error) {
+    const code = (error as NodeJS.ErrnoException).code
+    if (code === 'EEXIST') {
+      restrictFilePermissionsSync(tokenPath)
+      const existing = fsSync.readFileSync(tokenPath, 'utf8').trim()
+      if (!existing) throw invalidInput(`${tokenPath} is empty`)
+      return
+    }
+    throw ioError(error)
+  }
+}
+
+function rowToJob(row: Record<string, unknown>): Job {
+  const executionBackend = String(row.execution_backend)
+  assertExecutionBackend(executionBackend)
+  const status = String(row.status)
+  assertJobStatus(status)
+  return {
+    job_id: String(row.job_id),
+    claim_token: String(row.claim_token),
+    execution_backend: executionBackend,
+    profile_id: nullableString(row.profile_id),
+    agent_kind: nullableString(row.agent_kind),
+    agent_session_id: nullableString(row.agent_session_id),
+    provider: String(row.provider),
+    action: String(row.action),
+    status,
+    request_json: parseJson(row.request_json),
+    result_json: parseOptionalJson(row.result_json),
+    error_json: parseOptionalJson(row.error_json),
+    blocker_json: parseOptionalJson(row.blocker_json),
+    checkpoint_json: parseOptionalJson(row.checkpoint_json),
+    resume_json: parseOptionalJson(row.resume_json),
+    provider_attempts_json: parseJson(row.provider_attempts_json),
+    provider_submitted_at: nullableString(row.provider_submitted_at),
+    eligible_at: nullableString(row.eligible_at),
+    created_at: String(row.created_at),
+    updated_at: String(row.updated_at),
+    claim_expires_at_ms: nullableNumber(row.claim_expires_at),
+  }
+}
+
+type ProviderAttempt = {
+  attempt: number
+  provider: string
+  status: string
+  startedAt: string
+  completedAt: string | null
+  blocker: unknown | null
+}
+
+function providerAttempt(attempt: number, provider: string, status: string, startedAt: string): ProviderAttempt {
+  return { attempt, provider, status, startedAt, completedAt: null, blocker: null }
+}
+
+function providerAttempts(value: unknown): ProviderAttempt[] {
+  if (!Array.isArray(value)) return []
+  return value.filter((entry): entry is ProviderAttempt => Boolean(
+    entry && typeof entry === 'object' &&
+    Number.isSafeInteger((entry as ProviderAttempt).attempt) &&
+    typeof (entry as ProviderAttempt).provider === 'string' &&
+    typeof (entry as ProviderAttempt).status === 'string' &&
+    typeof (entry as ProviderAttempt).startedAt === 'string'
+  ))
+}
+
+function updateCurrentProviderAttempt(
+  job: Job,
+  status: string,
+  blocker: unknown | null = null,
+  completedAt: string | null = null,
+) {
+  const attempts = providerAttempts(job.provider_attempts_json)
+  const current = attempts.at(-1) ?? providerAttempt(1, job.provider, 'queued', job.created_at)
+  return [
+    ...attempts.slice(0, -1),
+    { ...current, status, blocker, completedAt },
+  ]
+}
+
+function rowToProviderProject(row: Record<string, unknown>): ProviderProjectMapping {
+  return {
+    provider: String(row.provider),
+    profile_id: String(row.profile_id),
+    resource_id: String(row.resource_id),
+    name: String(row.name),
+    canonical_url: String(row.canonical_url),
+    first_observed_at: String(row.first_observed_at),
+    last_observed_at: String(row.last_observed_at),
+    last_visible_proof: String(row.last_visible_proof),
+    creation_job_id: nullableString(row.creation_job_id),
+  }
+}
+
+function rowToProviderConversation(row: Record<string, unknown>): ProviderConversationMapping {
+  return {
+    provider: String(row.provider),
+    profile_id: String(row.profile_id),
+    project_resource_id: String(row.project_resource_id),
+    task_id: String(row.task_id),
+    canonical_url: String(row.canonical_url),
+    proved_job_id: String(row.proved_job_id),
+    observed_at: String(row.observed_at),
+  }
+}
+
+function rowToProviderTaskConversation(row: Record<string, unknown>): ProviderTaskConversationMapping {
+  return {
+    provider: String(row.provider),
+    profile_id: String(row.profile_id),
+    task_id: String(row.task_id),
+    canonical_url: String(row.canonical_url),
+    proved_job_id: String(row.proved_job_id),
+    observed_at: String(row.observed_at),
+  }
+}
+
+function mappingText(value: unknown, field: string, maximumLength: number) {
+  const normalized = typeof value === 'string' ? value.trim() : ''
+  if (normalized.length < 1 || normalized.length > maximumLength) {
+    throw invalidInput(`${field} must contain between 1 and ${maximumLength} characters`)
+  }
+  return normalized
+}
+
+function canonicalMappingUrl(value: unknown) {
+  const normalized = mappingText(value, 'canonical_url', 2048)
+  let parsed: URL
+  try {
+    parsed = new URL(normalized)
+  } catch {
+    throw invalidInput('canonical_url must be a valid URL')
+  }
+  if (
+    parsed.protocol !== 'https:' ||
+    parsed.username !== '' ||
+    parsed.password !== '' ||
+    parsed.search !== '' ||
+    parsed.hash !== ''
+  ) {
+    throw invalidInput('canonical_url must be a canonical public HTTPS URL')
+  }
+  return parsed.toString()
+}
+
+function rowToReplaySummary(row: Record<string, unknown>, reportedAt: string): ReplaySummary {
+  const status = String(row.status)
+  assertJobStatus(status)
+  if (
+    status !== 'waiting_for_user' &&
+    status !== 'succeeded' &&
+    status !== 'failed' &&
+    status !== 'canceled' &&
+    status !== 'timed_out'
+  ) {
+    throw invalidJobState(String(row.job_id), 'waiting_for_user or terminal', status)
+  }
+  const hasResult = row.result_json !== null && row.result_json !== undefined
+  const hasError = row.error_json !== null && row.error_json !== undefined
+  const hasBlocker = row.blocker_json !== null && row.blocker_json !== undefined
+  return {
+    job_id: String(row.job_id),
+    provider: String(row.provider),
+    action: String(row.action),
+    status,
+    task_id: nullableString(row.summary_task_id),
+    updated_at: String(row.updated_at),
+    reported_at: reportedAt,
+    outcome_kind: hasResult ? 'result' : hasError ? 'error' : hasBlocker ? 'blocker' : 'none',
+    has_result: hasResult,
+    has_error: hasError,
+    has_blocker: hasBlocker,
+  }
+}
+
+function parseJson(value: unknown) {
+  if (typeof value !== 'string') throw jsonError(new Error('expected JSON text'))
+  try {
+    return JSON.parse(value) as unknown
+  } catch (error) {
+    throw jsonError(error)
+  }
+}
+
+function parseOptionalJson(value: unknown) {
+  if (value === null || value === undefined) return null
+  return parseJson(value)
+}
+
+function stringifyJson(value: unknown) {
+  try {
+    return JSON.stringify(value)
+  } catch (error) {
+    throw jsonError(error)
+  }
+}
+
+async function cleanupVisibleAttachmentBundlesForRequest(homeDir: string, request: unknown) {
+  const bundleIds = visibleAttachmentBundleIdsForRequest(request)
+  if (bundleIds === null) return
+  for (const bundleId of bundleIds) {
+    await removeStagedVisibleAttachmentBundle({ homeDir, bundleId }).catch(() => undefined)
+  }
+}
+
+function visibleAttachmentBundleIdsForRequest(request: unknown) {
+  const requestObject = jsonRecord(request)
+  if (!requestObject || !Object.hasOwn(requestObject, 'attachments')) return new Set<string>()
+  const attachments = requestObject.attachments
+  if (!Array.isArray(attachments) || attachments.length === 0 || attachments.length > MAX_VISIBLE_ATTACHMENTS) {
+    return null
+  }
+  const bundleIds = new Set<string>()
+  const attachmentIds = new Set<string>()
+  let expectedBundleId: string | undefined
+  let totalBytes = 0
+  for (const attachment of attachments) {
+    let descriptor
+    try {
+      descriptor = validateVisibleAttachmentDescriptor(attachment)
+    } catch {
+      return null
+    }
+    if (expectedBundleId !== undefined && descriptor.bundleId !== expectedBundleId) return null
+    expectedBundleId = descriptor.bundleId
+    if (attachmentIds.has(descriptor.attachmentId)) return null
+    attachmentIds.add(descriptor.attachmentId)
+    if (descriptor.size > MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES) return null
+    totalBytes += descriptor.size
+    if (!Number.isSafeInteger(totalBytes) || totalBytes > MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES) return null
+    bundleIds.add(descriptor.bundleId)
+  }
+  return bundleIds
+}
+
+function requestSummaryMetadata(request: unknown): RequestSummaryMetadata {
+  const requestObject = jsonRecord(request)
+  const metadataObject = jsonRecord(requestObject?.metadata)
+  const requestValue = (key: string) => boundedNonemptySummaryValue(requestObject?.[key])
+  const metadataValue = (key: string) => boundedNonemptySummaryValue(metadataObject?.[key])
+  const requestTaskId = requestValue('taskId')
+  const requestIdempotencyKey = requestValue('idempotencyKey')
+  const requestId = requestValue('requestId')
+  const metadataTaskId = metadataValue('taskId')
+  const metadataIdempotencyKey = metadataValue('idempotencyKey')
+  const taskKeys: string[] = []
+  for (const key of [requestTaskId, requestIdempotencyKey, requestId, metadataTaskId, metadataIdempotencyKey]) {
+    if (key && !taskKeys.includes(key)) taskKeys.push(key)
+  }
+  return {
+    task_id: metadataTaskId ?? requestTaskId ?? null,
+    project_name: metadataValue('projectName') ?? requestValue('projectName') ?? null,
+    chat_name: metadataValue('chatName') ?? requestValue('chatName') ?? null,
+    idempotency_key: metadataIdempotencyKey ?? requestIdempotencyKey ?? null,
+    task_keys: taskKeys,
+  }
+}
+
+function parkedResumeBlockerJson(blockerJson: unknown) {
+  const browser = {
+    windowOpen: false,
+    resumeRequired: true,
+  }
+  if (blockerJson && typeof blockerJson === 'object' && !Array.isArray(blockerJson)) {
+    const object = { ...blockerJson as Record<string, unknown> }
+    if (object.browser && typeof object.browser === 'object' && !Array.isArray(object.browser)) {
+      object.browser = {
+        ...object.browser as Record<string, unknown>,
+        windowOpen: false,
+        resumeRequired: true,
+      }
+    } else {
+      object.browser = browser
+    }
+    return object
+  }
+  if (blockerJson !== null) {
+    return { blocker: blockerJson, browser }
+  }
+  return { browser }
+}
+
+function expiredWaitingClaimErrorJson() {
+  return {
+    code: 'playwright_user_handover_lease_lost',
+    message: 'The managed Playwright job lost its lease while waiting for user handover; retry from the same task state instead of replaying partial page actions.',
+    retryable: true,
+  }
+}
+
+function validateJobBackendProfile(executionBackend: ExecutionBackend, profileId: string | null) {
+  assertExecutionBackend(executionBackend)
+  const normalized = profileId === null ? null : normalizeProfileId(profileId, 'profile_id')
+  if (normalized === null) throw invalidInput('playwright jobs require profile_id')
+  return normalized
+}
+
+function validateClaimBackendProfile(executionBackend: ExecutionBackend, profileId: string | null) {
+  assertExecutionBackend(executionBackend)
+  if (profileId === null) throw invalidInput('playwright claims require profile_id')
+}
+
+function assertJobStatus(value: string): asserts value is JobStatus {
+  if (!JOB_STATUSES.has(value as JobStatus)) throw invalidStatus(value)
+}
+
+function assertExecutionBackend(value: string): asserts value is ExecutionBackend {
+  if (!EXECUTION_BACKENDS.has(value as ExecutionBackend)) {
+    throw invalidInput(`invalid execution_backend: ${value}`)
+  }
+}
+
+function normalizeNonempty(value: string, field: string) {
+  const trimmed = value.trim()
+  if (!trimmed) throw invalidInput(`${field} must be a nonempty string`)
+  return trimmed
+}
+
+function normalizeOptionalText(value: string | null | undefined) {
+  if (value === undefined || value === null) return null
+  return normalizeNonempty(String(value), 'optional text').slice(0, 120)
+}
+
+function assertActiveClaim(job: Job, claimToken: string, nowMs: number) {
+  if (job.claim_token !== claimToken) throw claimRejected(job.job_id)
+  if (!ACTIVE_STATUSES.has(job.status)) {
+    throw invalidJobState(job.job_id, 'claimed, running, or waiting_for_user', job.status)
+  }
+  if (job.claim_expires_at_ms === null || job.claim_expires_at_ms <= nowMs) throw claimExpired(job.job_id)
+}
+
+function normalizeSummaryFilter(value: string, field: string) {
+  const normalized = normalizeNonempty(value, field)
+  if (Array.from(normalized).length > SUMMARY_SCALAR_CHARS) {
+    throw invalidInput(`${field} must be at most ${SUMMARY_SCALAR_CHARS} characters`)
+  }
+  return normalized
+}
+
+function normalizeProfileId(value: string, field: string) {
+  const normalized = normalizeNonempty(value, field)
+  if (Array.from(normalized).length > PROFILE_ID_CHARS) {
+    throw invalidInput(`${field} must be at most ${PROFILE_ID_CHARS} characters`)
+  }
+  return normalized
+}
+
+function normalizeOptionalAgentRecipient(
+  agentKind: string | null | undefined,
+  agentSessionId: string | null | undefined
+) {
+  const kindPresent = agentKind !== undefined && agentKind !== null
+  const sessionPresent = agentSessionId !== undefined && agentSessionId !== null
+  if (kindPresent !== sessionPresent) {
+    throw invalidInput('agent_kind and agent_session_id must be provided together')
+  }
+  if (!kindPresent || !sessionPresent) return null
+  return normalizeAgentRecipient({
+    agent_kind: agentKind,
+    agent_session_id: agentSessionId,
+  })
+}
+
+function normalizeAgentRecipient(recipient: AgentRecipient): AgentRecipient {
+  const agentKind = normalizeNonempty(String(recipient.agent_kind ?? ''), 'agent_kind')
+  const agentSessionId = normalizeNonempty(String(recipient.agent_session_id ?? ''), 'agent_session_id')
+  if (Array.from(agentKind).length > AGENT_KIND_CHARS) {
+    throw invalidInput(`agent_kind must be at most ${AGENT_KIND_CHARS} characters`)
+  }
+  if (Array.from(agentSessionId).length > AGENT_SESSION_ID_CHARS) {
+    throw invalidInput(`agent_session_id must be at most ${AGENT_SESSION_ID_CHARS} characters`)
+  }
+  return {
+    agent_kind: agentKind,
+    agent_session_id: agentSessionId,
+  }
+}
+
+function boundedNonemptySummaryValue(value: unknown) {
+  if (typeof value !== 'string') return null
+  const trimmed = value.trim()
+  if (!trimmed) return null
+  return Array.from(trimmed).slice(0, SUMMARY_SCALAR_CHARS).join('')
+}
+
+function clampLimit(value: unknown, fallback: number, max: number) {
+  const numeric = Number(value)
+  const finite = Number.isFinite(numeric) ? Math.floor(numeric) : fallback
+  return Math.max(1, Math.min(max, finite || fallback))
+}
+
+function generateSecretToken() {
+  return randomBytes(SECRET_TOKEN_BYTES).toString('base64url')
+}
+
+function nowRfc3339() {
+  return new Date().toISOString()
+}
+
+function nowUnixMillis() {
+  return Date.now()
+}
+
+function saturatingAdd(left: number, right: number) {
+  const result = left + right
+  return Number.isSafeInteger(result) ? result : Number.MAX_SAFE_INTEGER
+}
+
+function nullableString(value: unknown) {
+  return value === null || value === undefined ? null : String(value)
+}
+
+function nullableNumber(value: unknown) {
+  return value === null || value === undefined ? null : Number(value)
+}
+
+function jsonRecord(value: unknown): Record<string, unknown> | null {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : null
+}
+
+function isSqliteBusy(error: unknown) {
+  const candidate = error as { code?: unknown; errcode?: unknown; message?: unknown }
+  return candidate.code === 'ERR_SQLITE_ERROR' &&
+    (candidate.errcode === 5 || String(candidate.message ?? '').includes('database is locked'))
+}
+
+function sleepSync(ms: number) {
+  const buffer = new SharedArrayBuffer(4)
+  Atomics.wait(new Int32Array(buffer), 0, 0, ms)
+}
+
+function restrictFilePermissionsSync(filePath: string) {
+  if (process.platform === 'win32' || !fsSync.existsSync(filePath)) return
+  try {
+    fsSync.chmodSync(filePath, 0o600)
+  } catch (error) {
+    throw ioError(error)
+  }
+}
+
+function constantTimeEqual(left: Buffer, right: Buffer) {
+  let diff = left.length ^ right.length
+  const maxLength = Math.max(left.length, right.length)
+  for (let index = 0; index < maxLength; index += 1) {
+    diff |= (left[index] ?? 0) ^ (right[index] ?? 0)
+  }
+  return diff === 0
+}
diff --git a/packages/cli/src/daemon/lifecycle.ts b/packages/cli/src/daemon/lifecycle.ts
new file mode 100644
index 0000000..01250c9
--- /dev/null
+++ b/packages/cli/src/daemon/lifecycle.ts
@@ -0,0 +1,149 @@
+import process from 'node:process'
+
+import { JobStore, defaultHomeDir } from './job-store.js'
+import { BrowserRuntimeController } from './browser-runtime-controller.js'
+import { serveHttp, type DaemonServer } from './server.js'
+import { DaemonRuntimeState, createStartupOwnerToken } from './runtime-state.js'
+
+export type StartDaemonOptions = {
+  homeDir?: string | undefined
+  host?: string | undefined
+  port?: number | undefined
+  startupOwnerToken?: string | undefined
+  startupGeneration?: number | undefined
+}
+
+export async function startDaemon({
+  homeDir = defaultHomeDir(),
+  host = '127.0.0.1',
+  port = 7331,
+  startupOwnerToken,
+  startupGeneration,
+}: StartDaemonOptions = {}) {
+  const store = await JobStore.open(homeDir)
+  const runtimeState = await DaemonRuntimeState.open(store.homeDir)
+  if ((startupOwnerToken === undefined) !== (startupGeneration === undefined)) {
+    runtimeState.close()
+    store.close()
+    throw new Error('Daemon startup owner token and generation must be provided together.')
+  }
+  const startupClaim = startupOwnerToken && startupGeneration !== undefined
+    ? { ownerToken: startupOwnerToken, generation: startupGeneration, externallyOwned: true }
+    : acquireDirectStartupClaim(runtimeState)
+  let daemon: DaemonServer | undefined
+  let runnerFatalError: unknown
+  const runtimeController = new BrowserRuntimeController({
+    store,
+    onFatalError: (error) => {
+      runnerFatalError = error
+      process.exitCode = 1
+      console.error(error instanceof Error && error.stack ? error.stack : String(error))
+      setImmediate(() => {
+        void daemon?.close().catch(() => undefined)
+      })
+    },
+  })
+  try {
+    daemon = await serveHttpWithDynamicPort({
+      store,
+      host,
+      startPort: port,
+      runtimeController,
+      beforeClose: async () => {
+        await runtimeController.shutdown()
+        if (daemon) {
+          runtimeState.clearEndpoint({ origin: daemon.origin, pid: process.pid })
+        }
+        runtimeState.close()
+      },
+    })
+    const endpoint = runtimeState.writeEndpointForStartupClaim({
+      origin: daemon.origin,
+      pid: process.pid,
+      ownerToken: startupClaim.ownerToken,
+      generation: startupClaim.generation,
+    })
+    if (!endpoint) {
+      throw new Error('Tokenless daemon startup ownership was superseded before the runtime endpoint was published.')
+    }
+    store.requeueExpiredClaims()
+    await runtimeController.start()
+    daemon.activate()
+  } catch (error) {
+    await runtimeController.shutdown().catch(() => undefined)
+    await daemon?.close().catch(() => undefined)
+    if (!startupClaim.externallyOwned) runtimeState.releaseStartupLease(startupClaim.ownerToken)
+    runtimeState.close()
+    if (!daemon) store.close()
+    throw error
+  }
+  if (runnerFatalError) throw runnerFatalError
+  installProcessShutdownHandlers(daemon)
+  return daemon
+}
+
+function acquireDirectStartupClaim(runtimeState: DaemonRuntimeState) {
+  const ownerToken = createStartupOwnerToken()
+  const lease = runtimeState.tryAcquireStartupLease({
+    ownerToken,
+    leaseMs: 10_000,
+  })
+  if (!lease.acquired || !lease.lease) {
+    throw new Error('Another Tokenless daemon startup or runtime endpoint already owns this home.')
+  }
+  return {
+    ownerToken,
+    generation: lease.lease.generation,
+    externallyOwned: false,
+  }
+}
+
+async function serveHttpWithDynamicPort({
+  store,
+  host,
+  startPort,
+  runtimeController,
+  beforeClose,
+}: {
+  store: JobStore
+  host: string
+  startPort: number
+  runtimeController: BrowserRuntimeController
+  beforeClose: () => Promise<void>
+}) {
+  let port = startPort
+  while (port <= 65535) {
+    try {
+      return await serveHttp({
+        store,
+        host,
+        port,
+        runtimeController,
+        beforeClose,
+      })
+    } catch (error) {
+      if (!isAddressInUse(error) || port === 0) throw error
+      port += 1
+    }
+  }
+  throw new Error(`No available loopback port at or above ${startPort}.`)
+}
+
+function isAddressInUse(error: unknown) {
+  return (error as NodeJS.ErrnoException).code === 'EADDRINUSE'
+}
+
+function installProcessShutdownHandlers(daemon: DaemonServer) {
+  let closing = false
+  const close = async () => {
+    if (closing) return
+    closing = true
+    await daemon.close()
+  }
+  process.once('SIGINT', () => {
+    void close().finally(() => process.exit(130))
+  })
+  process.once('SIGTERM', () => {
+    void close().finally(() => process.exit(143))
+  })
+}
diff --git a/packages/cli/src/daemon/ready-proof.ts b/packages/cli/src/daemon/ready-proof.ts
new file mode 100644
index 0000000..ee795de
--- /dev/null
+++ b/packages/cli/src/daemon/ready-proof.ts
@@ -0,0 +1,37 @@
+import { createHmac } from 'node:crypto'
+
+export const READY_CHALLENGE_BYTES = 32
+export const READY_CHALLENGE_BASE64URL_CHARS = 43
+
+export function isCanonicalReadyChallenge(challenge: string) {
+  if (challenge.length !== READY_CHALLENGE_BASE64URL_CHARS) return false
+  let decoded: Buffer
+  try {
+    decoded = Buffer.from(challenge, 'base64url')
+  } catch {
+    return false
+  }
+  return decoded.length === READY_CHALLENGE_BYTES && decoded.toString('base64url') === challenge
+}
+
+export function daemonReadyProof(token: string, challenge: string, canonicalHome: string) {
+  return createHmac('sha256', token)
+    .update(daemonReadyProofMessage(challenge, canonicalHome))
+    .digest('base64url')
+}
+
+export function daemonReadyProofMessage(challenge: string, canonicalHome: string) {
+  return lengthPrefixedMessage([
+    challenge,
+    canonicalHome,
+  ])
+}
+
+function lengthPrefixedMessage(fields: string[]) {
+  return Buffer.concat(fields.flatMap((field) => {
+    const value = Buffer.from(field, 'utf8')
+    const length = Buffer.allocUnsafe(4)
+    length.writeUInt32BE(value.length)
+    return [length, value]
+  }))
+}
diff --git a/packages/cli/src/daemon/runtime-state.ts b/packages/cli/src/daemon/runtime-state.ts
new file mode 100644
index 0000000..bcaaeb9
--- /dev/null
+++ b/packages/cli/src/daemon/runtime-state.ts
@@ -0,0 +1,528 @@
+import { randomBytes } from 'node:crypto'
+import fsSync from 'node:fs'
+import fs from 'node:fs/promises'
+import net from 'node:net'
+import path from 'node:path'
+import { DatabaseSync, type SQLInputValue } from 'node:sqlite'
+
+import { tokenlessHome } from '../job-store.js'
+
+const DATABASE_FILE_NAME = 'tokenless.sqlite3'
+const RUNTIME_STATE_ID = 'daemon'
+const STARTUP_OWNER_TOKEN_BYTES = 24
+
+type RuntimeRowState = 'starting' | 'running'
+
+export type DaemonRuntimeEndpoint = {
+  generation: number
+  origin: string
+  pid: number | null
+  updatedAt: string
+}
+
+export type DaemonStartupLease = {
+  generation: number
+  ownerToken: string
+  ownerPid: number
+  leaseExpiresAtMs: number
+  createdAt: string
+  updatedAt: string
+}
+
+export type DaemonStartupLeaseResult = {
+  acquired: boolean
+  lease: DaemonStartupLease | null
+}
+
+type RuntimeRow = {
+  generation: number
+  state: RuntimeRowState
+  ownerToken: string | null
+  origin: string | null
+  pid: number | null
+  leaseExpiresAtMs: number
+  createdAt: string
+  updatedAt: string
+}
+
+export class DaemonRuntimeState {
+  readonly homeDir: string
+  readonly databasePath: string
+
+  #db: DatabaseSync
+  #closed = false
+
+  static async open(homeDir = tokenlessHome()) {
+    await ensurePrivateHome(homeDir)
+    const canonicalHome = await fs.realpath(homeDir)
+    const state = new DaemonRuntimeState(canonicalHome)
+    state.initialize()
+    return state
+  }
+
+  static async openIfExists(homeDir = tokenlessHome()) {
+    const databasePath = path.join(homeDir, DATABASE_FILE_NAME)
+    try {
+      await fs.access(databasePath, fsSync.constants.R_OK | fsSync.constants.W_OK)
+    } catch {
+      return null
+    }
+    return await DaemonRuntimeState.open(homeDir)
+  }
+
+  static async readEndpointIfExists(homeDir = tokenlessHome()) {
+    const databasePath = path.join(homeDir, DATABASE_FILE_NAME)
+    try {
+      await fs.access(databasePath, fsSync.constants.R_OK)
+    } catch {
+      return null
+    }
+    let db: DatabaseSync
+    try {
+      db = new DatabaseSync(databasePath, { readOnly: true })
+      db.exec('PRAGMA query_only = ON;')
+    } catch {
+      return null
+    }
+    try {
+      const table = db.prepare(
+        `SELECT name
+         FROM sqlite_schema
+         WHERE type = 'table' AND name = 'daemon_runtime_state'`
+      ).get()
+      if (!table) return null
+      const row = db.prepare(
+        `SELECT generation, state, owner_token, origin, pid, lease_expires_at, created_at, updated_at
+         FROM daemon_runtime_state
+         WHERE id = ?`
+      ).get(RUNTIME_STATE_ID)
+      const parsed = row ? rowToRuntimeRow(row) : null
+      if (!parsed || parsed.state !== 'running' || !parsed.origin) return null
+      return {
+        generation: parsed.generation,
+        origin: normalizeLoopbackHttpOrigin(parsed.origin),
+        pid: parsed.pid,
+        updatedAt: parsed.updatedAt,
+      } satisfies DaemonRuntimeEndpoint
+    } finally {
+      db.close()
+    }
+  }
+
+  private constructor(homeDir: string) {
+    this.homeDir = homeDir
+    this.databasePath = path.join(homeDir, DATABASE_FILE_NAME)
+    try {
+      this.#db = new DatabaseSync(this.databasePath)
+      this.#db.exec('PRAGMA foreign_keys = ON;')
+      this.#db.exec('PRAGMA busy_timeout = 5000;')
+    } catch (error) {
+      throw runtimeStateError('daemon_runtime_state_unavailable', sqliteMessage(error), true)
+    }
+  }
+
+  close() {
+    if (this.#closed) return
+    this.#closed = true
+    this.#db.close()
+  }
+
+  endpoint(): DaemonRuntimeEndpoint | null {
+    const row = this.runtimeRow()
+    if (!row || row.state !== 'running' || !row.origin) return null
+    return {
+      origin: normalizeLoopbackHttpOrigin(row.origin),
+      generation: row.generation,
+      pid: row.pid,
+      updatedAt: row.updatedAt,
+    }
+  }
+
+  writeEndpointForStartupClaim({
+    origin,
+    pid = process.pid,
+    ownerToken,
+    generation,
+  }: {
+    origin: string
+    pid?: number | null | undefined
+    ownerToken: string
+    generation: number
+  }) {
+    const normalizedOrigin = normalizeLoopbackHttpOrigin(origin)
+    const storedPid = pid === null || pid === undefined ? null : normalizePid(pid)
+    const normalizedOwner = normalizeStartupOwnerToken(ownerToken)
+    const normalizedGeneration = normalizePositiveInteger(generation, 'generation')
+    const now = nowRfc3339()
+    return this.transaction(() => {
+      const result = this.run(
+        `UPDATE daemon_runtime_state
+         SET state = 'running',
+             owner_token = NULL,
+             origin = ?,
+             pid = ?,
+             lease_expires_at = ?,
+             updated_at = ?
+         WHERE id = ?
+           AND generation = ?
+           AND state = 'starting'
+           AND owner_token = ?`,
+        normalizedOrigin,
+        storedPid,
+        Number.MAX_SAFE_INTEGER,
+        now,
+        RUNTIME_STATE_ID,
+        normalizedGeneration,
+        normalizedOwner
+      )
+      return result.changes === 1 ? this.endpoint() : null
+    })
+  }
+
+  clearEndpoint({ origin, pid }: { origin?: string | undefined; pid?: number | undefined } = {}) {
+    const normalizedOrigin = origin === undefined ? undefined : normalizeLoopbackHttpOrigin(origin)
+    const normalizedPid = pid === undefined ? undefined : normalizePid(pid)
+    this.transaction(() => {
+      const row = this.runtimeRow()
+      if (!row || row.state !== 'running') return
+      if (normalizedOrigin !== undefined && row.origin !== normalizedOrigin) return
+      if (normalizedPid !== undefined && row.pid !== normalizedPid) return
+      this.run(
+        `UPDATE daemon_runtime_state
+         SET state = 'starting',
+             owner_token = NULL,
+             origin = NULL,
+             pid = NULL,
+             lease_expires_at = 0,
+             updated_at = ?
+         WHERE id = ?`,
+        nowRfc3339(),
+        RUNTIME_STATE_ID
+      )
+    })
+  }
+
+  tryAcquireStartupLease({
+    ownerToken,
+    leaseMs,
+    nowMs = Date.now(),
+    ownerPid = process.pid,
+    takeoverRunning,
+  }: {
+    ownerToken: string
+    leaseMs: number
+    nowMs?: number | undefined
+    ownerPid?: number | undefined
+    takeoverRunning?: DaemonRuntimeEndpoint | undefined
+  }): DaemonStartupLeaseResult {
+    const normalizedOwner = normalizeStartupOwnerToken(ownerToken)
+    const normalizedLeaseMs = normalizeLeaseMs(leaseMs)
+    const normalizedPid = normalizePid(ownerPid)
+    const expiresAt = saturatingAdd(nowMs, normalizedLeaseMs)
+    const now = nowRfc3339()
+    return this.transaction(() => {
+      const existing = this.runtimeRow()
+      const existingPidAlive = existing?.pid !== null && existing?.pid !== undefined && pidIsAlive(existing.pid)
+      const runningTakeoverMatched = existing?.state === 'running' &&
+        takeoverRunning !== undefined &&
+        existing.generation === takeoverRunning.generation &&
+        existing.origin === takeoverRunning.origin &&
+        existing.pid === takeoverRunning.pid
+      const canAcquire = existing === null ||
+        runningTakeoverMatched ||
+        existing.ownerToken === normalizedOwner ||
+        (existing.state === 'starting' && (
+          existing.leaseExpiresAtMs <= nowMs ||
+          !existingPidAlive
+        ))
+      if (!canAcquire) {
+        return { acquired: false, lease: rowToStartupLease(existing) }
+      }
+      const nextGeneration = existing === null ? 1 : existing.generation + 1
+      this.run(
+        `INSERT INTO daemon_runtime_state (
+           id, generation, state, owner_token, origin, pid, lease_expires_at, created_at, updated_at
+         ) VALUES (?, ?, 'starting', ?, NULL, ?, ?, ?, ?)
+         ON CONFLICT(id) DO UPDATE SET
+           generation = excluded.generation,
+           state = 'starting',
+           owner_token = excluded.owner_token,
+           origin = NULL,
+           pid = excluded.pid,
+           lease_expires_at = excluded.lease_expires_at,
+           updated_at = excluded.updated_at`,
+        RUNTIME_STATE_ID,
+        nextGeneration,
+        normalizedOwner,
+        normalizedPid,
+        expiresAt,
+        existing?.createdAt ?? now,
+        now
+      )
+      return { acquired: true, lease: this.startupLease() }
+    })
+  }
+
+  releaseStartupLease(ownerToken: string) {
+    this.run(
+      `UPDATE daemon_runtime_state
+       SET owner_token = NULL,
+           pid = NULL,
+           lease_expires_at = 0,
+           updated_at = ?
+       WHERE id = ? AND state = 'starting' AND owner_token = ?`,
+      nowRfc3339(),
+      RUNTIME_STATE_ID,
+      normalizeStartupOwnerToken(ownerToken)
+    )
+  }
+
+  startupLease() {
+    const row = this.runtimeRow()
+    if (!row || row.state !== 'starting' || !row.ownerToken || !row.pid) return null
+    return rowToStartupLease(row)
+  }
+
+  private initialize() {
+    this.execWithBusyRetry(`
+      PRAGMA journal_mode = WAL;
+      PRAGMA foreign_keys = ON;
+      CREATE TABLE IF NOT EXISTS daemon_runtime_state (
+        id TEXT PRIMARY KEY NOT NULL CHECK (id = 'daemon'),
+        generation INTEGER NOT NULL,
+        state TEXT NOT NULL CHECK (state IN ('starting', 'running')),
+        owner_token TEXT,
+        origin TEXT,
+        pid INTEGER,
+        lease_expires_at INTEGER NOT NULL,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS daemon_runtime_state_lease_idx
+        ON daemon_runtime_state(lease_expires_at);
+    `)
+    restrictFilePermissionsSync(this.databasePath)
+  }
+
+  private runtimeRow() {
+    const row = this.get(
+      `SELECT generation, state, owner_token, origin, pid, lease_expires_at, created_at, updated_at
+       FROM daemon_runtime_state
+       WHERE id = ?`,
+      RUNTIME_STATE_ID
+    )
+    return row ? rowToRuntimeRow(row) : null
+  }
+
+  private exec(sql: string) {
+    try {
+      this.#db.exec(sql)
+    } catch (error) {
+      throw runtimeStateError('daemon_runtime_state_sqlite_failed', sqliteMessage(error), true)
+    }
+  }
+
+  private execWithBusyRetry(sql: string) {
+    let lastError: unknown
+    for (let attempt = 0; attempt < 100; attempt += 1) {
+      try {
+        this.#db.exec(sql)
+        return
+      } catch (error) {
+        if (!isSqliteBusy(error)) {
+          throw runtimeStateError('daemon_runtime_state_sqlite_failed', sqliteMessage(error), true)
+        }
+        lastError = error
+        sleepSync(50)
+      }
+    }
+    throw runtimeStateError('daemon_runtime_state_sqlite_busy', sqliteMessage(lastError), true)
+  }
+
+  private run(sql: string, ...params: SQLInputValue[]) {
+    try {
+      return this.#db.prepare(sql).run(...params)
+    } catch (error) {
+      throw runtimeStateError('daemon_runtime_state_sqlite_failed', sqliteMessage(error), true)
+    }
+  }
+
+  private get(sql: string, ...params: SQLInputValue[]) {
+    try {
+      return this.#db.prepare(sql).get(...params)
+    } catch (error) {
+      throw runtimeStateError('daemon_runtime_state_sqlite_failed', sqliteMessage(error), true)
+    }
+  }
+
+  private transaction<T>(callback: () => T) {
+    this.exec('BEGIN IMMEDIATE')
+    try {
+      const result = callback()
+      this.exec('COMMIT')
+      return result
+    } catch (error) {
+      try {
+        this.exec('ROLLBACK')
+      } catch {
+        // Preserve the original failure.
+      }
+      throw error
+    }
+  }
+}
+
+export function createStartupOwnerToken() {
+  return randomBytes(STARTUP_OWNER_TOKEN_BYTES).toString('base64url')
+}
+
+export function normalizeLoopbackHttpOrigin(value: string) {
+  let parsed: URL
+  try {
+    parsed = new URL(value)
+  } catch {
+    throw runtimeStateError('invalid_daemon_url', 'Tokenless daemon URL must be a valid loopback HTTP URL.', false)
+  }
+  if (parsed.protocol !== 'http:' || !isLoopbackHostname(parsed.hostname)) {
+    throw runtimeStateError('invalid_daemon_url', 'Tokenless daemon URL must be a loopback HTTP URL.', false)
+  }
+  if (parsed.username || parsed.password || parsed.pathname !== '/' || parsed.search || parsed.hash) {
+    throw runtimeStateError('invalid_daemon_url', 'Tokenless daemon URL must be a bare loopback HTTP origin.', false)
+  }
+  return parsed.origin
+}
+
+function rowToRuntimeRow(row: Record<string, unknown>): RuntimeRow {
+  const state = String(row.state)
+  if (state !== 'starting' && state !== 'running') {
+    throw runtimeStateError('daemon_runtime_state_invalid', 'Daemon runtime state row has an invalid state.', true)
+  }
+  return {
+    generation: normalizePositiveInteger(row.generation, 'generation'),
+    state,
+    ownerToken: nullableString(row.owner_token),
+    origin: nullableString(row.origin),
+    pid: nullablePid(row.pid),
+    leaseExpiresAtMs: normalizeUnixMillis(row.lease_expires_at),
+    createdAt: String(row.created_at),
+    updatedAt: String(row.updated_at),
+  }
+}
+
+function rowToStartupLease(row: RuntimeRow): DaemonStartupLease | null {
+  if (!row.ownerToken || !row.pid) return null
+  return {
+    generation: row.generation,
+    ownerToken: normalizeStartupOwnerToken(row.ownerToken),
+    ownerPid: normalizePid(row.pid),
+    leaseExpiresAtMs: row.leaseExpiresAtMs,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  }
+}
+
+async function ensurePrivateHome(homeDir: string) {
+  await fs.mkdir(homeDir, { recursive: true, mode: 0o700 })
+  await fs.chmod(homeDir, 0o700).catch(() => undefined)
+}
+
+function restrictFilePermissionsSync(file: string) {
+  try {
+    fsSync.chmodSync(file, 0o600)
+  } catch {
+    // Best effort on filesystems that do not support POSIX permissions.
+  }
+}
+
+function normalizeStartupOwnerToken(value: string) {
+  const normalized = value.trim()
+  if (!/^[A-Za-z0-9_-]{16,256}$/.test(normalized)) {
+    throw runtimeStateError('invalid_daemon_startup_owner', 'Daemon startup owner token is invalid.', false)
+  }
+  return normalized
+}
+
+function normalizeLeaseMs(value: number) {
+  if (!Number.isFinite(value) || value <= 0 || !Number.isSafeInteger(value)) {
+    throw runtimeStateError('invalid_daemon_startup_lease', 'Daemon startup lease must be a positive integer.', false)
+  }
+  return Math.max(1, Math.floor(value))
+}
+
+function normalizePid(value: number) {
+  return normalizePositiveInteger(value, 'pid')
+}
+
+function nullablePid(value: unknown) {
+  if (value === null || value === undefined) return null
+  return normalizePid(Number(value))
+}
+
+function normalizePositiveInteger(value: unknown, field: string) {
+  const numeric = Number(value)
+  if (!Number.isSafeInteger(numeric) || numeric <= 0) {
+    throw runtimeStateError(`invalid_daemon_${field}`, `Daemon ${field} must be a positive safe integer.`, false)
+  }
+  return Math.floor(numeric)
+}
+
+function normalizeUnixMillis(value: unknown) {
+  const numeric = Number(value)
+  if (!Number.isSafeInteger(numeric) || numeric < 0) {
+    throw runtimeStateError('invalid_daemon_startup_lease', 'Daemon startup lease timestamp is invalid.', false)
+  }
+  return numeric
+}
+
+function nullableString(value: unknown) {
+  return typeof value === 'string' && value.trim() ? value : null
+}
+
+function saturatingAdd(left: number, right: number) {
+  const result = left + right
+  return Number.isSafeInteger(result) && result > 0 ? result : Number.MAX_SAFE_INTEGER
+}
+
+function isLoopbackHostname(hostname: string) {
+  const normalized = hostname.toLowerCase()
+  const ip = net.isIP(normalized)
+  return normalized === 'localhost' ||
+    normalized === '[::1]' ||
+    normalized === '::1' ||
+    (ip === 4 && normalized.startsWith('127.')) ||
+    (ip === 6 && normalized === '::1')
+}
+
+function pidIsAlive(pid: number) {
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === 'EPERM'
+  }
+}
+
+function nowRfc3339() {
+  return new Date().toISOString()
+}
+
+function sqliteMessage(error: unknown) {
+  return error instanceof Error && error.message ? error.message : String(error)
+}
+
+function isSqliteBusy(error: unknown) {
+  const code = (error as { code?: unknown }).code
+  return code === 'ERR_SQLITE_BUSY' || code === 'SQLITE_BUSY' || code === 'SQLITE_LOCKED'
+}
+
+function sleepSync(ms: number) {
+  const view = new Int32Array(new SharedArrayBuffer(4))
+  Atomics.wait(view, 0, 0, ms)
+}
+
+function runtimeStateError(code: string, message: string, retryable: boolean) {
+  const error = new Error(message) as Error & { code?: string; retryable?: boolean }
+  error.code = code
+  error.retryable = retryable
+  return error
+}
diff --git a/packages/cli/src/daemon/server.ts b/packages/cli/src/daemon/server.ts
new file mode 100644
index 0000000..60cc884
--- /dev/null
+++ b/packages/cli/src/daemon/server.ts
@@ -0,0 +1,673 @@
+import http, { type IncomingMessage, type ServerResponse } from 'node:http'
+import net from 'node:net'
+
+import { tokenlessPackageVersion } from '../platform-package.js'
+import { normalizeBrowserVisibility } from '../browser-visibility.js'
+import { listProviderInstances } from '../providers/registry.js'
+import {
+  MANAGED_PLAYWRIGHT_JOB_ACTION,
+  validateManagedPlaywrightJobRequest,
+} from '../playwright/job-contract.js'
+import {
+  daemonReadyProof,
+  isCanonicalReadyChallenge,
+  READY_CHALLENGE_BYTES,
+} from './ready-proof.js'
+import type { BrowserRuntimeController } from './browser-runtime-controller.js'
+import {
+  controlAuthMissing,
+  controlAuthRejected,
+  daemonErrorBody,
+  daemonErrorStatus,
+  invalidInput,
+  nonLoopbackBind,
+  toDaemonError,
+  type DaemonError,
+} from './errors.js'
+import { JobStore, publicView, type ExecutionBackend, type JobStatus } from './job-store.js'
+import { TokenlessApplicationServices } from '../application/services.js'
+import { TokenlessUiServer } from './ui-server.js'
+import { UiSessionManager } from './ui-session.js'
+
+export type DaemonServer = {
+  activate(): void
+  close(): Promise<void>
+  server: http.Server
+  store: JobStore
+  host: string
+  port: number
+  origin: string
+}
+
+const MAX_HTTP_BODY_BYTES = 2 * 1024 * 1024
+const BODY_LIMIT_EXCEEDED_MESSAGE = 'Failed to buffer the request body: length limit exceeded'
+
+type JsonRecord = Record<string, unknown>
+
+class BodyLimitExceededError extends Error {
+  constructor() {
+    super(BODY_LIMIT_EXCEEDED_MESSAGE)
+    this.name = 'BodyLimitExceededError'
+  }
+}
+
+export async function serveHttp({
+  store,
+  host,
+  port,
+  runtimeController,
+  beforeClose,
+}: {
+  store: JobStore
+  host: string
+  port: number
+  runtimeController?: BrowserRuntimeController | undefined
+  beforeClose?: (() => Promise<void>) | undefined
+}) {
+  validateLoopbackHost(host)
+  let active = false
+  const activate = () => {
+    active = true
+  }
+  const deactivate = () => {
+    active = false
+  }
+  let closePromise: Promise<void> | undefined
+  const close = () => {
+    closePromise ??= closeServer(server, store, beforeClose)
+    return closePromise
+  }
+  const startedAt = Date.now()
+  let server: http.Server
+  const origin = () => serverOrigin(host, serverPort(server, port))
+  const uiServer = new TokenlessUiServer({
+    services: new TokenlessApplicationServices({
+      store,
+      runtimeController,
+      origin,
+      startedAt,
+    }),
+    sessions: new UiSessionManager(),
+    origin,
+  })
+  server = http.createServer((request, response) => {
+    void handleRequest(store, close, () => active, deactivate, runtimeController, uiServer, request, response)
+  })
+  await new Promise<void>((resolve, reject) => {
+    const onError = (error: Error) => {
+      server.off('listening', onListening)
+      reject(error)
+    }
+    const onListening = () => {
+      server.off('error', onError)
+      resolve()
+    }
+    server.once('error', onError)
+    server.once('listening', onListening)
+    server.listen(port, host)
+  })
+  return {
+    activate,
+    server,
+    store,
+    host,
+    port: serverPort(server, port),
+    origin: serverOrigin(host, serverPort(server, port)),
+    close,
+  } satisfies DaemonServer
+}
+
+export function validateLoopbackHost(host: string) {
+  const ip = net.isIP(host)
+  const loopback = host === 'localhost' ||
+    host === '::1' ||
+    host === '[::1]' ||
+    (ip === 4 && host.startsWith('127.')) ||
+    (ip === 6 && host === '::1')
+  if (!loopback) throw nonLoopbackBind(host)
+}
+
+export function daemonBuildInfo(binary: string) {
+  return {
+    binary,
+    version: tokenlessPackageVersion(),
+    platform: process.platform === 'darwin' ? 'darwin' : process.platform,
+    arch: process.arch === 'x64' ? 'x64' : process.arch,
+  }
+}
+
+function serverPort(server: http.Server, requestedPort: number) {
+  const address = server.address()
+  if (address && typeof address !== 'string') return address.port
+  return requestedPort
+}
+
+function serverOrigin(host: string, port: number) {
+  const normalizedHost = host === '::1' || host === '[::1]' ? '[::1]' : host
+  return `http://${normalizedHost}:${port}`
+}
+
+async function handleRequest(
+  store: JobStore,
+  closeDaemon: () => Promise<void>,
+  isActive: () => boolean,
+  deactivate: () => void,
+  runtimeController: BrowserRuntimeController | undefined,
+  uiServer: TokenlessUiServer,
+  request: IncomingMessage,
+  response: ServerResponse
+) {
+  try {
+    const url = new URL(request.url || '/', 'http://127.0.0.1')
+    const method = request.method || 'GET'
+    if (method === 'GET' && url.pathname === '/ready') {
+      const challenge = url.searchParams.get('challenge') ?? ''
+      validateReadyChallenge(challenge)
+      const active = isActive()
+      writeJson(response, active ? 200 : 503, {
+        version: tokenlessPackageVersion(),
+        ready: active,
+        home_dir: store.homeDir,
+        pid: process.pid,
+        proof: daemonReadyProof(store.controlToken(), challenge, store.homeDir),
+      })
+      return
+    }
+
+    if (!isActive()) {
+      writeJson(response, 503, {
+        error: {
+          code: 'daemon_starting',
+          message: 'Tokenless daemon startup is not complete.',
+          retryable: true,
+        },
+      })
+      return
+    }
+
+    if (url.pathname === '/ui' || url.pathname.startsWith('/ui/')) {
+      try {
+        await uiServer.handle(request, response, url)
+      } catch (error) {
+        uiServer.writeError(response, error)
+      }
+      return
+    }
+
+    if (url.pathname.startsWith('/ui-api/v1/')) {
+      try {
+        await uiServer.handle(request, response, url)
+      } catch (error) {
+        uiServer.writeError(response, error)
+      }
+      return
+    }
+
+    requireControlAuth(store, request)
+
+    if (method === 'POST' && url.pathname === '/control/ui-bootstrap') {
+      const rawBody = await readBody(request)
+      const body = rawBody ? parseJsonObject(rawBody) : {}
+      if (Object.keys(body).some((key) => key !== 'profile_id' && key !== 'open')) {
+        throw invalidInput('request body must be valid JSON: unknown field')
+      }
+      const ticket = uiServer.mintTicket()
+      const profileId = optionalString(body.profile_id)
+      const opened = body.open === true && profileId
+        ? await runtimeController?.openControlPlane(profileId, ticket.bootstrapUrl)
+        : null
+      writeJson(response, 200, { ...ticket, opened })
+      return
+    }
+
+    if (method === 'GET' && url.pathname === '/control/browser-runtime/status') {
+      writeJson(response, 200, browserRuntimeStatus(runtimeController))
+      return
+    }
+    if (method === 'POST' && url.pathname === '/control/browser-runtime/quiesce') {
+      writeJson(response, 200, await browserRuntimeQuiesce(runtimeController))
+      return
+    }
+    if (method === 'POST' && url.pathname === '/control/browser-runtime/open-profile') {
+      const body = await readJsonObject(request)
+      const openFields = new Set(['profile_id', 'browser_visibility'])
+      if (Object.keys(body).some((key) => !openFields.has(key))) {
+        throw invalidInput('request body must be valid JSON: unknown field')
+      }
+      writeJson(response, 200, await browserRuntimeOpenProfile(
+        runtimeController,
+        requiredString(body.profile_id, 'profile_id'),
+        requiredBrowserVisibility(body.browser_visibility),
+      ))
+      return
+    }
+    if (method === 'POST' && url.pathname === '/control/browser-runtime/open-provider-tabs') {
+      const body = await readJsonObject(request)
+      const openFields = new Set(['profile_id', 'browser_visibility', 'providers'])
+      if (Object.keys(body).some((key) => !openFields.has(key))) {
+        throw invalidInput('request body must be valid JSON: unknown field')
+      }
+      writeJson(response, 200, await browserRuntimeOpenProviderTabs(
+        runtimeController,
+        requiredString(body.profile_id, 'profile_id'),
+        requiredProviderList(body.providers),
+        requiredBrowserVisibility(body.browser_visibility),
+      ))
+      return
+    }
+
+    if (method === 'POST' && url.pathname === '/jobs') {
+      const body = await readJsonObject(request)
+      const createJobFields = new Set([
+        'provider',
+        'action',
+        'request_json',
+        'execution_backend',
+        'profile_id',
+        'agent_kind',
+        'agent_session_id',
+        'job_id',
+      ])
+      if (Object.keys(body).some((key) => !createJobFields.has(key))) {
+        throw invalidInput('request body must be valid JSON: unknown field')
+      }
+      const hasAgentKind = Object.hasOwn(body, 'agent_kind')
+      const hasAgentSessionId = Object.hasOwn(body, 'agent_session_id')
+      if (hasAgentKind !== hasAgentSessionId) {
+        throw invalidInput('agent_kind and agent_session_id must be provided together')
+      }
+      const provider = requiredString(body.provider, 'provider')
+      const action = requiredString(body.action, 'action')
+      const executionBackend = optionalExecutionBackend(body.execution_backend)
+      if (executionBackend === 'playwright' && !supportedProviderSet().has(provider)) {
+        throw invalidInput(`unsupported playwright provider: ${provider}`)
+      }
+      const rawRequestJson = requireField(body, 'request_json')
+      const requestJson = action === MANAGED_PLAYWRIGHT_JOB_ACTION && hasManagedPlaywrightProtocol(rawRequestJson)
+        ? validateManagedPlaywrightRequestInput(rawRequestJson)
+        : rawRequestJson
+      const job = store.createJob({
+        provider,
+        action,
+        request_json: requestJson,
+        execution_backend: executionBackend,
+        profile_id: optionalString(body.profile_id),
+        agent_kind: hasAgentKind ? requiredString(body.agent_kind, 'agent_kind') : undefined,
+        agent_session_id: hasAgentSessionId ? requiredString(body.agent_session_id, 'agent_session_id') : undefined,
+        job_id: optionalString(body.job_id) ?? undefined,
+      })
+      if (job.execution_backend === 'playwright') await runtimeController?.wake()
+      writeJson(response, 200, publicView(job))
+      return
+    }
+
+    if (method === 'GET' && url.pathname === '/provider-mappings/resolve') {
+      const mapping = store.resolveProviderMapping({
+        provider: requiredQueryString(url.searchParams.get('provider'), 'provider'),
+        profile_id: requiredQueryString(url.searchParams.get('profile_id'), 'profile_id'),
+        project_name: requiredQueryString(url.searchParams.get('project_name'), 'project_name'),
+        task_id: optionalQueryString(url.searchParams.get('task_id')),
+      })
+      writeJson(response, 200, { mapping })
+      return
+    }
+
+    if (method === 'GET' && url.pathname === '/provider-conversations/resolve') {
+      const mapping = store.resolveProviderTaskConversation({
+        provider: requiredQueryString(url.searchParams.get('provider'), 'provider'),
+        profile_id: requiredQueryString(url.searchParams.get('profile_id'), 'profile_id'),
+        task_id: requiredQueryString(url.searchParams.get('task_id'), 'task_id'),
+      })
+      writeJson(response, 200, { mapping })
+      return
+    }
+
+    if (method === 'GET' && url.pathname === '/jobs') {
+      const jobs = store.listJobs({
+        status: optionalJobStatus(url.searchParams.get('status')),
+        execution_backend: optionalQueryExecutionBackend(url.searchParams.get('execution_backend')),
+        profile_id: optionalQueryString(url.searchParams.get('profile_id')),
+        provider: optionalQueryString(url.searchParams.get('provider')),
+        task_id: optionalQueryString(url.searchParams.get('task_id')),
+        limit: optionalLimit(url.searchParams.get('limit')),
+      })
+      writeJson(response, 200, jobs.map(publicView))
+      return
+    }
+
+    if (method === 'GET' && url.pathname === '/provider-capacity') {
+      const provider = requiredQueryString(url.searchParams.get('provider'), 'provider')
+      const projection = store.projectProviderCapacity({
+        provider,
+        profile_id: requiredQueryString(url.searchParams.get('profile_id'), 'profile_id'),
+        access_class: requiredQueryString(url.searchParams.get('access_class'), 'access_class'),
+        tier_label: optionalQueryString(url.searchParams.get('tier_label')),
+        subscription_label: optionalQueryString(url.searchParams.get('subscription_label')),
+        request_json: {
+          provider,
+          actions: [{ action: 'prompt.submit', payload: {} }],
+        },
+      })
+      writeJson(response, 200, projection)
+      return
+    }
+
+    if (method === 'POST' && url.pathname === '/replay/drain') {
+      const body = await readJsonObject(request)
+      if (Object.keys(body).some((key) => key !== 'agent_kind' && key !== 'agent_session_id' && key !== 'limit')) {
+        throw invalidInput('request body must be valid JSON: unknown field')
+      }
+      const summaries = store.drainReplaySummaries({
+        agent_kind: requiredString(body.agent_kind, 'agent_kind'),
+        agent_session_id: requiredString(body.agent_session_id, 'agent_session_id'),
+      }, optionalBodyLimit(body.limit))
+      writeJson(response, 200, { jobs: summaries })
+      return
+    }
+
+    const jobRoute = matchJobRoute(url.pathname)
+    if (jobRoute && method === 'GET' && jobRoute.action === null) {
+      writeJson(response, 200, publicView(store.getJob(jobRoute.jobId)))
+      return
+    }
+    if (jobRoute && method === 'POST' && jobRoute.action === 'resume') {
+      const body = await readJsonObject(request)
+      if (Object.keys(body).some((key) => key !== 'browser_visibility')) {
+        throw invalidInput('request body must be valid JSON: unknown field')
+      }
+      if (body.browser_visibility !== 'headed') throw invalidInput('request body must be valid JSON: invalid browser_visibility')
+      const job = store.resumeJob(jobRoute.jobId, { browser_visibility: 'headed' })
+      await runtimeController?.wake()
+      writeJson(response, 200, publicView(job))
+      return
+    }
+    if (jobRoute && method === 'POST' && jobRoute.action === 'cancel') {
+      const rawBody = await readBody(request)
+      const body = rawBody ? parseJsonObject(rawBody) : {}
+      writeJson(response, 200, publicView(await store.cancelJob(jobRoute.jobId, body.reason)))
+      return
+    }
+    if (jobRoute && method === 'POST' && jobRoute.action === 'report') {
+      const body = await readJsonObject(request)
+      if (Object.keys(body).some((key) => key !== 'agent_kind' && key !== 'agent_session_id')) {
+        throw invalidInput('request body must be valid JSON: unknown field')
+      }
+      const result = store.markJobReported(jobRoute.jobId, {
+        agent_kind: requiredString(body.agent_kind, 'agent_kind'),
+        agent_session_id: requiredString(body.agent_session_id, 'agent_session_id'),
+      })
+      writeJson(response, 200, {
+        reported: result.reported,
+        job: publicView(result.job),
+      })
+      return
+    }
+
+    if (method === 'POST' && url.pathname === '/control/shutdown') {
+      deactivate()
+      writeJson(response, 200, { ok: true, status: 'shutting_down', pid: process.pid })
+      setImmediate(() => {
+        void closeDaemon()
+      })
+      return
+    }
+
+    writeJson(response, 404, { error: { message: 'not found' } })
+  } catch (error) {
+    if (error instanceof BodyLimitExceededError) {
+      writeText(response, 413, BODY_LIMIT_EXCEEDED_MESSAGE)
+      return
+    }
+    writeDaemonError(response, toDaemonError(error))
+  }
+}
+
+function hasManagedPlaywrightProtocol(value: unknown) {
+  return Boolean(value && typeof value === 'object' && !Array.isArray(value) && Object.hasOwn(value, 'protocol'))
+}
+
+function validateManagedPlaywrightRequestInput(value: unknown) {
+  try {
+    return validateManagedPlaywrightJobRequest(value)
+  } catch (error) {
+    throw invalidInput(`request_json is invalid: ${error instanceof Error ? error.message : String(error)}`)
+  }
+}
+
+function browserRuntimeStatus(runtimeController: BrowserRuntimeController | undefined) {
+  return runtimeController?.status() ?? {
+    status: 'stopped',
+    activeProfileCount: 0,
+    activeJobCount: 0,
+    pid: process.pid,
+  }
+}
+
+async function browserRuntimeQuiesce(runtimeController: BrowserRuntimeController | undefined) {
+  return await runtimeController?.quiesce() ?? browserRuntimeStatus(runtimeController)
+}
+
+async function browserRuntimeOpenProfile(
+  runtimeController: BrowserRuntimeController | undefined,
+  profileId: string,
+  browserVisibility: ReturnType<typeof requiredBrowserVisibility>
+) {
+  if (!runtimeController) throw invalidInput('browser runtime control is unavailable')
+  return await runtimeController.openProfile(profileId, browserVisibility)
+}
+
+async function browserRuntimeOpenProviderTabs(
+  runtimeController: BrowserRuntimeController | undefined,
+  profileId: string,
+  providers: readonly string[],
+  browserVisibility: ReturnType<typeof requiredBrowserVisibility>,
+) {
+  if (!runtimeController) throw invalidInput('browser runtime control is unavailable')
+  return await runtimeController.openProviderTabs(profileId, providers, browserVisibility)
+}
+
+function requiredBrowserVisibility(value: unknown) {
+  const browserVisibility = normalizeBrowserVisibility(value)
+  if (!browserVisibility) throw invalidInput('browser_visibility must be auto, headed, or headless')
+  return browserVisibility
+}
+
+function requiredProviderList(value: unknown) {
+  if (!Array.isArray(value) || value.length === 0) {
+    throw invalidInput('providers must be a non-empty array')
+  }
+  const supported = supportedProviderSet()
+  const providers: string[] = []
+  for (const entry of value) {
+    if (typeof entry !== 'string' || !supported.has(entry)) {
+      throw invalidInput('providers includes an unsupported provider')
+    }
+    if (providers.includes(entry)) throw invalidInput('providers must not contain duplicates')
+    providers.push(entry)
+  }
+  return providers
+}
+
+function supportedProviders() {
+  return listProviderInstances()
+    .filter((provider) => provider.descriptor.stage !== 'disabled')
+    .map((provider) => String(provider.id))
+}
+
+function supportedProviderSet() {
+  return new Set(supportedProviders())
+}
+
+function requireControlAuth(store: JobStore, request: IncomingMessage) {
+  const authorization = request.headers.authorization
+  if (authorization === undefined) throw controlAuthMissing()
+  const value = Array.isArray(authorization) ? authorization[0] : authorization
+  if (!value || !value.startsWith('Bearer ')) throw controlAuthRejected()
+  store.requireControlToken(value.slice('Bearer '.length))
+}
+
+async function readJsonObject(request: IncomingMessage) {
+  let raw
+  try {
+    raw = await readBody(request)
+  } catch (error) {
+    if (error instanceof BodyLimitExceededError) {
+      throw invalidInput('request body must be valid JSON: Failed to buffer the request body')
+    }
+    throw error
+  }
+  if (!raw) throw invalidInput('request body must be valid JSON: missing request body')
+  return parseJsonObject(raw)
+}
+
+function parseJsonObject(raw: string) {
+  try {
+    const parsed = JSON.parse(raw) as unknown
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+      throw new Error('request body must be a JSON object')
+    }
+    return parsed as JsonRecord
+  } catch (error) {
+    throw invalidInput(`request body must be valid JSON: ${error instanceof Error ? error.message : String(error)}`)
+  }
+}
+
+async function readBody(request: IncomingMessage) {
+  const contentLength = request.headers['content-length']
+  const declaredLength = Array.isArray(contentLength) ? contentLength[0] : contentLength
+  if (declaredLength !== undefined && declaredLength !== '') {
+    const length = Number(declaredLength)
+    if (Number.isFinite(length) && length > MAX_HTTP_BODY_BYTES) throw new BodyLimitExceededError()
+  }
+  const chunks: Buffer[] = []
+  let totalBytes = 0
+  for await (const chunk of request) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    totalBytes += buffer.length
+    if (totalBytes > MAX_HTTP_BODY_BYTES) throw new BodyLimitExceededError()
+    chunks.push(buffer)
+  }
+  const body = Buffer.concat(chunks).toString('utf8')
+  return body
+}
+
+function writeJson(response: ServerResponse, status: number, body: unknown) {
+  const payload = JSON.stringify(body)
+  response.writeHead(status, {
+    'content-type': 'application/json',
+    'content-length': Buffer.byteLength(payload),
+  })
+  response.end(payload)
+}
+
+function writeText(response: ServerResponse, status: number, body: string) {
+  response.writeHead(status, {
+    'content-type': 'text/plain; charset=utf-8',
+    'content-length': Buffer.byteLength(body),
+  })
+  response.end(body)
+}
+
+function writeDaemonError(response: ServerResponse, error: DaemonError) {
+  writeJson(response, daemonErrorStatus(error), daemonErrorBody(error))
+}
+
+function validateReadyChallenge(challenge: string) {
+  if (!isCanonicalReadyChallenge(challenge)) {
+    throw invalidInput(`challenge must be canonical unpadded base64url encoding of ${READY_CHALLENGE_BYTES} bytes`)
+  }
+}
+
+function matchJobRoute(pathname: string) {
+  const match = /^\/jobs\/([^/]+)(?:\/([^/]+))?$/.exec(pathname)
+  if (!match) return null
+  const action = match[2] ?? null
+  if (action !== null && !['resume', 'cancel', 'report'].includes(action)) return null
+  return { jobId: decodeURIComponent(match[1] || ''), action }
+}
+
+function requireField(body: JsonRecord, field: string) {
+  if (!Object.hasOwn(body, field)) throw invalidInput(`missing field ${field}`)
+  return body[field]
+}
+
+function requiredString(value: unknown, field: string) {
+  if (typeof value !== 'string') throw invalidInput(`${field} must be a string`)
+  return value
+}
+
+function optionalString(value: unknown) {
+  if (value === undefined || value === null) return null
+  if (typeof value !== 'string') throw invalidInput('optional string field must be a string')
+  return value
+}
+
+function optionalQueryString(value: string | null) {
+  return value === null ? undefined : value
+}
+
+function requiredQueryString(value: string | null, field: string) {
+  if (value === null || value.trim() === '') throw invalidInput(`missing query parameter ${field}`)
+  return value
+}
+
+function optionalLimit(value: string | null) {
+  if (value === null) return undefined
+  if (!/^(?:0|[1-9][0-9]*)$/.test(value)) {
+    throw invalidInput('query parameters are invalid: Failed to deserialize query string')
+  }
+  const parsed = BigInt(value)
+  if (parsed > 18_446_744_073_709_551_615n) {
+    throw invalidInput('query parameters are invalid: Failed to deserialize query string')
+  }
+  return parsed > BigInt(Number.MAX_SAFE_INTEGER) ? Number.MAX_SAFE_INTEGER : Number(parsed)
+}
+
+function optionalBodyLimit(value: unknown) {
+  if (value === undefined) return undefined
+  if (!Number.isSafeInteger(value) || Number(value) < 1 || Number(value) > 200) {
+    throw invalidInput('limit must be an integer between 1 and 200')
+  }
+  return Number(value)
+}
+
+function optionalJobStatus(value: string | null) {
+  if (value === null) return undefined
+  const statuses: JobStatus[] = ['queued', 'claimed', 'running', 'waiting_for_user', 'succeeded', 'failed', 'canceled', 'timed_out']
+  if (!statuses.includes(value as JobStatus)) throw invalidInput(`invalid status: ${value}`)
+  return value as JobStatus
+}
+
+function optionalExecutionBackend(value: unknown) {
+  if (value === undefined || value === null) return undefined
+  if (value !== 'playwright') {
+    throw invalidInput(`invalid execution_backend: ${String(value)}`)
+  }
+  return value as ExecutionBackend
+}
+
+function optionalQueryExecutionBackend(value: string | null) {
+  if (value === null) return undefined
+  if (value !== 'playwright') {
+    throw invalidInput('query parameters are invalid: Failed to deserialize query string')
+  }
+  return value
+}
+
+async function closeServer(
+  server: http.Server,
+  store: JobStore,
+  beforeClose: (() => Promise<void>) | undefined
+) {
+  const httpClose = new Promise<void>((resolve, reject) => {
+    server.close((error) => {
+      if (error) reject(error)
+      else resolve()
+    })
+  }).catch(() => undefined)
+  const runtimeClose = beforeClose?.() ?? Promise.resolve()
+  const results = await Promise.allSettled([httpClose, runtimeClose])
+  store.close()
+  const failed = results.find((result) => result.status === 'rejected')
+  if (failed?.status === 'rejected') throw failed.reason
+}
diff --git a/packages/cli/src/daemon/ui-server.ts b/packages/cli/src/daemon/ui-server.ts
new file mode 100644
index 0000000..8d7c97e
--- /dev/null
+++ b/packages/cli/src/daemon/ui-server.ts
@@ -0,0 +1,252 @@
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { hasConfiguredTokenlessLanguage, readTokenlessConfig } from '../job-store.js'
+import { TokenlessApplicationServices } from '../application/services.js'
+import { DaemonError, daemonErrorCodeRetryable, daemonErrorStatus } from './errors.js'
+import { UiSessionManager } from './ui-session.js'
+import type { IncomingMessage, ServerResponse } from 'node:http'
+
+type UiServerOptions = {
+  services: TokenlessApplicationServices
+  sessions: UiSessionManager
+  origin: () => string
+}
+
+const UI_ROOT = fileURLToPath(new URL('./ui/', import.meta.url))
+
+export class TokenlessUiServer {
+  private readonly services: TokenlessApplicationServices
+  private readonly sessions: UiSessionManager
+  private readonly origin: () => string
+
+  constructor(options: UiServerOptions) {
+    this.services = options.services
+    this.sessions = options.sessions
+    this.origin = options.origin
+  }
+
+  mintTicket() {
+    return this.sessions.mintTicket(this.origin())
+  }
+
+  async handle(request: IncomingMessage, response: ServerResponse, url: URL) {
+    this.requireHost(request)
+    const method = request.method ?? 'GET'
+    if (method === 'GET' && url.pathname === '/ui/bootstrap') {
+      const ticket = url.searchParams.get('ticket') ?? ''
+      const session = this.sessions.consumeTicket(ticket, response)
+      if (!session) throw uiError('ui_ticket_invalid', 'The dashboard bootstrap ticket is invalid or expired.', 401)
+      this.securityHeaders(response)
+      response.writeHead(303, { location: '/ui/' })
+      response.end()
+      return
+    }
+    if (method === 'GET' && (url.pathname === '/ui' || url.pathname === '/ui/')) {
+      const language = await this.initialLanguage(request)
+      const template = await fs.readFile(path.join(UI_ROOT, 'index.html'), 'utf8')
+      const body = template
+        .replaceAll('__TOKENLESS_LANG__', language)
+        .replaceAll('__TOKENLESS_TITLE__', language === 'zh-CN' ? 'Tokenless 本地控制台' : 'Tokenless local console')
+        .replaceAll('__TOKENLESS_SKIP__', language === 'zh-CN' ? '跳到主要内容' : 'Skip to content')
+        .replaceAll('__TOKENLESS_LANGUAGE_LABEL__', language === 'zh-CN' ? '语言' : 'Language')
+        .replaceAll('__TOKENLESS_EN_SELECTED__', language === 'en' ? 'selected' : '')
+        .replaceAll('__TOKENLESS_ZH_SELECTED__', language === 'zh-CN' ? 'selected' : '')
+      this.writeAsset(response, 200, body, 'text/html; charset=utf-8')
+      return
+    }
+    if (method === 'GET' && url.pathname === '/ui/styles.css') {
+      this.writeAsset(response, 200, await fs.readFile(path.join(UI_ROOT, 'styles.css')), 'text/css; charset=utf-8')
+      return
+    }
+    if (method === 'GET' && url.pathname === '/ui/mark.png') {
+      this.writeAsset(response, 200, await fs.readFile(path.join(UI_ROOT, 'mark.png')), 'image/png')
+      return
+    }
+    const modulePath = method === 'GET' ? uiModulePath(url.pathname) : null
+    if (modulePath) {
+      this.writeAsset(response, 200, await fs.readFile(path.join(UI_ROOT, modulePath)), 'text/javascript; charset=utf-8')
+      return
+    }
+
+    if (!url.pathname.startsWith('/ui-api/v1/')) return false
+    const session = method === 'GET'
+      ? this.sessions.requireSession(request)
+      : this.sessions.requireMutation(request, this.origin())
+    if (method === 'GET' && url.pathname === '/ui-api/v1/session') {
+      this.writeJson(response, 200, {
+        csrf: session.csrf,
+        expiresAt: new Date(session.expiresAt).toISOString(),
+      })
+      return true
+    }
+    if (method === 'GET' && url.pathname === '/ui-api/v1/snapshot') {
+      const snapshot = await this.services.snapshot()
+      const etag = `"${snapshot.revision}"`
+      if (request.headers['if-none-match'] === etag) {
+        this.securityHeaders(response)
+        response.writeHead(304, { etag, 'cache-control': 'no-store' })
+        response.end()
+        return true
+      }
+      this.writeJson(response, 200, snapshot, { etag })
+      return true
+    }
+    const jobMatch = /^\/ui-api\/v1\/jobs\/([^/]+)(?:\/(cancel|resume))?$/.exec(url.pathname)
+    if (jobMatch && method === 'GET' && !jobMatch[2]) {
+      this.writeJson(response, 200, await this.services.job(decodeURIComponent(jobMatch[1] ?? '')))
+      return true
+    }
+    if (jobMatch && method === 'POST' && jobMatch[2] === 'cancel') {
+      this.writeJson(response, 200, await this.services.cancelJob(decodeURIComponent(jobMatch[1] ?? '')))
+      return true
+    }
+    if (jobMatch && method === 'POST' && jobMatch[2] === 'resume') {
+      this.writeJson(response, 200, await this.services.resumeJob(decodeURIComponent(jobMatch[1] ?? '')))
+      return true
+    }
+    if (method === 'PATCH' && url.pathname === '/ui-api/v1/config') {
+      this.writeJson(response, 200, await this.services.updateConfig(await readJson(request)))
+      return true
+    }
+    if (method === 'POST' && url.pathname === '/ui-api/v1/profiles') {
+      this.writeJson(response, 201, await this.services.createProfile(await readJson(request)))
+      return true
+    }
+    const profileMatch = /^\/ui-api\/v1\/profiles\/([^/]+)(?:\/(open))?$/.exec(url.pathname)
+    if (profileMatch && method === 'PATCH' && !profileMatch[2]) {
+      this.writeJson(response, 200, await this.services.updateProfile(
+        decodeURIComponent(profileMatch[1] ?? ''),
+        await readJson(request),
+      ))
+      return true
+    }
+    if (profileMatch && method === 'DELETE' && !profileMatch[2]) {
+      this.writeJson(response, 200, await this.services.removeProfile(decodeURIComponent(profileMatch[1] ?? '')))
+      return true
+    }
+    if (profileMatch && method === 'POST' && profileMatch[2] === 'open') {
+      this.writeJson(response, 200, await this.services.openProfile(decodeURIComponent(profileMatch[1] ?? '')))
+      return true
+    }
+    const providerMatch = /^\/ui-api\/v1\/profiles\/([^/]+)\/providers\/([^/]+)\/actions\/(open|readiness|controls)$/.exec(url.pathname)
+    if (providerMatch && method === 'POST') {
+      this.writeJson(response, 202, await this.services.providerAction(
+        decodeURIComponent(providerMatch[1] ?? ''),
+        decodeURIComponent(providerMatch[2] ?? ''),
+        providerMatch[3] as 'open' | 'readiness' | 'controls',
+      ))
+      return true
+    }
+    const selectionMatch = /^\/ui-api\/v1\/profiles\/([^/]+)\/providers\/([^/]+)\/selection$/.exec(url.pathname)
+    if (selectionMatch && method === 'POST') {
+      this.writeJson(response, 202, await this.services.providerSelection(
+        decodeURIComponent(selectionMatch[1] ?? ''),
+        decodeURIComponent(selectionMatch[2] ?? ''),
+        await readJson(request),
+      ))
+      return true
+    }
+    if (method === 'POST' && url.pathname === '/ui-api/v1/runtime/quiesce') {
+      this.writeJson(response, 200, await this.services.quiesceRuntime())
+      return true
+    }
+    this.writeJson(response, 404, { error: { code: 'ui_route_not_found', message: 'Not found.' } })
+    return true
+  }
+
+  writeError(response: ServerResponse, error: unknown) {
+    if (error instanceof DaemonError) {
+      const status = daemonErrorStatus(error)
+      const code = daemonErrorCodeRetryable(error).code
+      const safeMessage = ['invalid_input', 'invalid_status', 'job_not_found', 'invalid_job_state'].includes(error.kind)
+        ? error.message
+        : 'The dashboard request failed.'
+      this.writeJson(response, status, { error: { code, message: safeMessage } })
+      return
+    }
+    const value = error as { code?: string, status?: number, message?: string }
+    const isPublicError = Number.isInteger(value.status) && (value.status ?? 0) >= 400 && (value.status ?? 0) < 600
+    this.writeJson(response, isPublicError ? value.status! : 400, {
+      error: {
+        code: value.code ?? 'ui_request_failed',
+        message: isPublicError && value.message ? value.message : 'The dashboard request failed.',
+      },
+    })
+  }
+
+  private async initialLanguage(request: IncomingMessage) {
+    if (await hasConfiguredTokenlessLanguage(this.services.store.homeDir)) {
+      return (await readTokenlessConfig(this.services.store.homeDir)).language
+    }
+    const accepted = request.headers['accept-language'] ?? ''
+    return /(^|,)\s*zh(?:-|;|,|$)/i.test(accepted) ? 'zh-CN' : 'en'
+  }
+
+  private requireHost(request: IncomingMessage) {
+    const expected = new URL(this.origin()).host.toLowerCase()
+    const host = (request.headers.host ?? '').toLowerCase()
+    if (host !== expected) throw uiError('ui_host_rejected', 'The request Host is not allowed.', 403)
+  }
+
+  private securityHeaders(response: ServerResponse) {
+    response.setHeader('content-security-policy', "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'")
+    response.setHeader('x-content-type-options', 'nosniff')
+    response.setHeader('referrer-policy', 'no-referrer')
+    response.setHeader('x-frame-options', 'DENY')
+    response.setHeader('cache-control', 'no-store')
+  }
+
+  private writeAsset(response: ServerResponse, status: number, body: string | Buffer, contentType: string) {
+    this.securityHeaders(response)
+    response.writeHead(status, {
+      'content-type': contentType,
+      'content-length': Buffer.byteLength(body),
+    })
+    response.end(body)
+  }
+
+  private writeJson(response: ServerResponse, status: number, body: unknown, headers: Record<string, string> = {}) {
+    const payload = JSON.stringify(body)
+    this.securityHeaders(response)
+    response.writeHead(status, {
+      'content-type': 'application/json; charset=utf-8',
+      'content-length': Buffer.byteLength(payload),
+      ...headers,
+    })
+    response.end(payload)
+  }
+}
+
+function uiModulePath(pathname: string) {
+  const match = /^\/ui\/([a-z0-9-]+(?:\/[a-z0-9-]+)*)\.js$/.exec(pathname)
+  return match ? `${match[1]}.js` : null
+}
+
+async function readJson(request: IncomingMessage) {
+  const chunks: Buffer[] = []
+  let total = 0
+  for await (const chunk of request) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    total += buffer.length
+    if (total > 1024 * 1024) throw uiError('ui_body_too_large', 'Request body is too large.', 413)
+    chunks.push(buffer)
+  }
+  const raw = Buffer.concat(chunks).toString('utf8')
+  if (!raw) return {}
+  let value: unknown
+  try {
+    value = JSON.parse(raw)
+  } catch {
+    throw uiError('ui_json_invalid', 'Request body must be valid JSON.', 400)
+  }
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw uiError('ui_json_invalid', 'Request body must be a JSON object.', 400)
+  }
+  return value as Record<string, unknown>
+}
+
+function uiError(code: string, message: string, status: number) {
+  return Object.assign(new Error(message), { code, status })
+}
diff --git a/packages/cli/src/daemon/ui-session.ts b/packages/cli/src/daemon/ui-session.ts
new file mode 100644
index 0000000..032ebeb
--- /dev/null
+++ b/packages/cli/src/daemon/ui-session.ts
@@ -0,0 +1,104 @@
+import { randomBytes } from 'node:crypto'
+
+import type { IncomingMessage, ServerResponse } from 'node:http'
+
+const TICKET_TTL_MS = 60_000
+const SESSION_TTL_MS = 30 * 60_000
+const COOKIE_NAME = 'tokenless_ui_session'
+
+type Ticket = {
+  expiresAt: number
+}
+
+type UiSession = {
+  id: string
+  csrf: string
+  expiresAt: number
+}
+
+export class UiSessionManager {
+  private readonly tickets = new Map<string, Ticket>()
+  private readonly sessions = new Map<string, UiSession>()
+
+  mintTicket(origin: string) {
+    this.prune()
+    const ticket = secret()
+    const expiresAt = Date.now() + TICKET_TTL_MS
+    this.tickets.set(ticket, { expiresAt })
+    return {
+      ticket,
+      bootstrapUrl: `${origin}/ui/bootstrap?ticket=${encodeURIComponent(ticket)}`,
+      expiresAt: new Date(expiresAt).toISOString(),
+    }
+  }
+
+  consumeTicket(ticket: string, response: ServerResponse) {
+    this.prune()
+    const stored = this.tickets.get(ticket)
+    this.tickets.delete(ticket)
+    if (!stored || stored.expiresAt <= Date.now()) return null
+    const session: UiSession = {
+      id: secret(),
+      csrf: secret(),
+      expiresAt: Date.now() + SESSION_TTL_MS,
+    }
+    this.sessions.set(session.id, session)
+    response.setHeader('set-cookie', serializeCookie(session))
+    return session
+  }
+
+  requireSession(request: IncomingMessage) {
+    this.prune()
+    const id = parseCookie(request.headers.cookie ?? '')[COOKIE_NAME]
+    const session = id ? this.sessions.get(id) : undefined
+    if (!session || session.expiresAt <= Date.now()) {
+      throw uiAuthError('ui_session_required', 'Open the dashboard again from the Tokenless CLI.', 401)
+    }
+    return session
+  }
+
+  requireMutation(request: IncomingMessage, expectedOrigin: string) {
+    const session = this.requireSession(request)
+    if (request.headers.origin !== expectedOrigin) {
+      throw uiAuthError('ui_origin_rejected', 'The request origin is not allowed.', 403)
+    }
+    const csrf = request.headers['x-tokenless-csrf']
+    const value = Array.isArray(csrf) ? csrf[0] : csrf
+    if (!value || value !== session.csrf) {
+      throw uiAuthError('ui_csrf_rejected', 'The request CSRF token is invalid.', 403)
+    }
+    return session
+  }
+
+  private prune() {
+    const now = Date.now()
+    for (const [ticket, value] of this.tickets) {
+      if (value.expiresAt <= now) this.tickets.delete(ticket)
+    }
+    for (const [id, value] of this.sessions) {
+      if (value.expiresAt <= now) this.sessions.delete(id)
+    }
+  }
+}
+
+function serializeCookie(session: UiSession) {
+  const maxAge = Math.floor((session.expiresAt - Date.now()) / 1000)
+  return `${COOKIE_NAME}=${session.id}; HttpOnly; SameSite=Strict; Path=/ui-api/v1; Max-Age=${maxAge}`
+}
+
+function parseCookie(value: string) {
+  return Object.fromEntries(value.split(';').flatMap((part) => {
+    const separator = part.indexOf('=')
+    if (separator < 1) return []
+    return [[part.slice(0, separator).trim(), part.slice(separator + 1).trim()]]
+  }))
+}
+
+function secret() {
+  return randomBytes(32).toString('base64url')
+}
+
+function uiAuthError(code: string, message: string, status: number) {
+  return Object.assign(new Error(message), { code, status })
+}
+
diff --git a/packages/cli/src/daemon/ui/App.svelte b/packages/cli/src/daemon/ui/App.svelte
new file mode 100644
index 0000000..1175790
--- /dev/null
+++ b/packages/cli/src/daemon/ui/App.svelte
@@ -0,0 +1,233 @@
+<script lang="ts">
+  import { onMount } from 'svelte'
+  import { Blocks, LayoutDashboard, ListChecks, PanelsTopLeft, Settings, UsersRound } from '@lucide/svelte'
+  import { DashboardClient } from './dashboard-client.js'
+  import { translate } from './localization.js'
+  import CapabilitiesView from './views/CapabilitiesView.svelte'
+  import JobsView from './views/JobsView.svelte'
+  import OverviewView from './views/OverviewView.svelte'
+  import ProfilesView from './views/ProfilesView.svelte'
+  import ProvidersView from './views/ProvidersView.svelte'
+  import SetupView from './views/SetupView.svelte'
+  import SystemView from './views/SystemView.svelte'
+  import type { JsonRecord, Language, Section } from './types.js'
+
+  const sections = new Set<Section>(['overview', 'profiles', 'providers', 'capabilities', 'jobs', 'system'])
+  const initialLanguage: Language = document.documentElement.lang === 'zh-CN' ? 'zh-CN' : 'en'
+
+  function parseSection(hash: string): Section {
+    const candidate = hash.replace(/^#/, '') as Section
+    return sections.has(candidate) ? candidate : 'overview'
+  }
+
+  let language = $state<Language>(initialLanguage)
+  let snapshot = $state<JsonRecord | null>(null)
+  let offline = $state(false)
+  let busy = $state(false)
+  let fatal = $state('')
+  let toast = $state('')
+  let selectedProfile = $state('')
+  let section = $state<Section>(parseSection(location.hash))
+  let toastTimer = 0
+  let pollTimer = 0
+  const client = new DashboardClient(() => language)
+
+  const navigation = $derived([
+    { id: 'overview' as const, label: t('overview'), icon: LayoutDashboard },
+    { id: 'profiles' as const, label: t('profiles'), icon: UsersRound },
+    { id: 'providers' as const, label: t('providers'), icon: PanelsTopLeft },
+    { id: 'capabilities' as const, label: t('capabilities'), icon: Blocks },
+    { id: 'jobs' as const, label: t('jobs'), icon: ListChecks },
+    { id: 'system' as const, label: t('system'), icon: Settings },
+  ])
+
+  $effect(() => {
+    document.documentElement.lang = language
+    document.title = t('documentTitle')
+    const skipLink = document.querySelector<HTMLAnchorElement>('.skip-link')
+    if (skipLink) skipLink.textContent = t('skipToContent')
+  })
+
+  onMount(() => {
+    const hashChange = () => section = parseSection(location.hash)
+    const visibilityChange = () => { if (!document.hidden) void refresh() }
+    window.addEventListener('hashchange', hashChange)
+    document.addEventListener('visibilitychange', visibilityChange)
+    void initialize()
+    return () => {
+      window.removeEventListener('hashchange', hashChange)
+      document.removeEventListener('visibilitychange', visibilityChange)
+      window.clearTimeout(pollTimer)
+      window.clearTimeout(toastTimer)
+    }
+  })
+
+  async function initialize() {
+    try {
+      await client.authenticate()
+      await refresh()
+      schedulePoll()
+    } catch (error) {
+      fatal = error instanceof Error ? error.message : t('requestFailed')
+    }
+  }
+
+  function schedulePoll() {
+    window.clearTimeout(pollTimer)
+    pollTimer = window.setTimeout(async () => {
+      if (!document.hidden && !busy) await refresh()
+      schedulePoll()
+    }, 3000)
+  }
+
+  async function refresh() {
+    const wasOffline = offline
+    try {
+      const result = await client.snapshot()
+      if (result.snapshot) snapshot = result.snapshot
+      offline = false
+      synchronizeSnapshot()
+    } catch (error) {
+      if ((error as { sessionExpired?: boolean })?.sessionExpired) {
+        fatal = error instanceof Error ? error.message : t('reopen')
+        return
+      }
+      offline = true
+      if (!snapshot || !wasOffline) showToast(t('offlineBody'))
+    }
+  }
+
+  function synchronizeSnapshot() {
+    if (!snapshot) return
+    if (snapshot.config?.language === 'en' || snapshot.config?.language === 'zh-CN') language = snapshot.config.language
+    if (!selectedProfile || !snapshot.profiles.some((profile: JsonRecord) => profile.slug === selectedProfile)) {
+      selectedProfile = snapshot.profiles.find((profile: JsonRecord) => profile.isDefault)?.slug
+        ?? snapshot.profiles[0]?.slug
+        ?? ''
+    }
+  }
+
+  function navigate(next: string) {
+    if (!sections.has(next as Section)) return
+    section = next as Section
+    location.hash = next
+    queueMicrotask(() => document.querySelector<HTMLElement>('#main')?.focus())
+  }
+
+  async function mutate(path: string, body?: unknown, method = 'POST', announce = true) {
+    busy = true
+    try {
+      const result = await client.mutate(path, body, method)
+      await refresh()
+      if (announce) showToast(t('updateSaved'))
+      return result
+    } catch (error) {
+      showToast(error instanceof Error ? error.message : t('requestFailed'))
+      throw error
+    } finally {
+      busy = false
+    }
+  }
+
+  async function setup(config: JsonRecord, profile: JsonRecord) {
+    try {
+      await mutate('/config', config, 'PATCH', false)
+      await mutate('/profiles', profile, 'POST', false)
+      showToast(t('profileCreated'))
+      navigate('profiles')
+    } catch {
+      // The mutation already exposes a localized error through the live region.
+    }
+  }
+
+  function showToast(message: string) {
+    toast = message
+    window.clearTimeout(toastTimer)
+    toastTimer = window.setTimeout(() => toast = '', 3200)
+  }
+
+  function t(key: Parameters<typeof translate>[1]) {
+    return translate(language, key)
+  }
+</script>
+
+{#if fatal}
+  <main class="fatal-state" data-testid="fatal-state">
+    <img src="/ui/mark.png" alt="" />
+    <h1>{t('sessionExpired')}</h1>
+    <p>{fatal}</p>
+    <p>{t('reopen')}</p>
+  </main>
+{:else if !snapshot}
+  <main class="loading-state" aria-live="polite">
+    <img src="/ui/mark.png" alt="" />
+    <span class="spinner"></span>
+    <p>{t('loading')}</p>
+  </main>
+{:else if snapshot.profiles.length === 0}
+  <SetupView {snapshot} {language} {t} {busy} onsetup={setup} />
+{:else}
+  <div class:profiles-active={section === 'profiles'} class="app-shell" data-testid="app-shell">
+    <aside class="rail">
+      <div class="rail-brand"><img src="/ui/mark.png" alt="Tokenless" /></div>
+      <nav aria-label={t('primaryNavigation')}>
+        {#each navigation as item (item.id)}
+          {@const Icon = item.icon}
+          <button
+            class:active={section === item.id}
+            class="rail-button"
+            type="button"
+            aria-label={item.label}
+            aria-current={section === item.id ? 'page' : undefined}
+            title={item.label}
+            data-tooltip={item.label}
+            data-nav={item.id}
+            onclick={() => navigate(item.id)}
+          ><Icon size={19} strokeWidth={1.8} /></button>
+        {/each}
+      </nav>
+      <div class="rail-status" class:offline aria-label={offline ? t('offline') : t('healthy')} title={offline ? t('offline') : t('healthy')}>
+        <span></span>
+      </div>
+    </aside>
+
+    <header class="mobile-header">
+      <div><img src="/ui/mark.png" alt="" /><strong>Tokenless</strong></div>
+      <label class="mobile-profile-select">
+        <span class="sr-only">{t('selectProfile')}</span>
+        <select bind:value={selectedProfile}>{#each snapshot.profiles as profile}<option value={profile.slug}>{profile.label}</option>{/each}</select>
+      </label>
+    </header>
+
+    {#if offline}<div class="offline-banner" role="status">{t('offlineShort')}</div>{/if}
+
+    <main id="main" tabindex="-1" class:profile-main={section === 'profiles'}>
+      {#if section === 'overview'}
+        <OverviewView {snapshot} {selectedProfile} {t} onnavigate={navigate} onmutate={mutate} />
+      {:else if section === 'profiles'}
+        <ProfilesView {snapshot} {selectedProfile} {t} {busy} onselect={(slug) => selectedProfile = slug} onmutate={mutate} />
+      {:else if section === 'providers'}
+        <ProvidersView {snapshot} {selectedProfile} {t} {busy} onselect={(slug) => selectedProfile = slug} onmutate={mutate} />
+      {:else if section === 'capabilities'}
+        <CapabilitiesView {snapshot} {selectedProfile} {language} {t} onselect={(slug) => selectedProfile = slug} />
+      {:else if section === 'jobs'}
+        <JobsView {snapshot} {language} {t} {busy} onget={(path) => client.get(path)} onmutate={mutate} />
+      {:else}
+        <SystemView {snapshot} {language} {t} {busy} onmutate={mutate} ontoast={showToast} />
+      {/if}
+    </main>
+
+    <nav class="mobile-nav" aria-label={t('primaryNavigation')}>
+      {#each navigation as item (item.id)}
+        {@const Icon = item.icon}
+        <button class:active={section === item.id} type="button" aria-label={item.label} aria-current={section === item.id ? 'page' : undefined} data-nav={item.id} onclick={() => navigate(item.id)}>
+          <Icon size={18} strokeWidth={1.8} /><span>{item.label}</span>
+        </button>
+      {/each}
+    </nav>
+  </div>
+{/if}
+
+<div class="toast-region" aria-live="polite" aria-atomic="true">{#if toast}<div class="toast" role="status">{toast}</div>{/if}</div>
+
+<svelte:head><meta name="theme-color" content="#f6f5f2" /></svelte:head>
diff --git a/packages/cli/src/daemon/ui/components/Modal.svelte b/packages/cli/src/daemon/ui/components/Modal.svelte
new file mode 100644
index 0000000..5d78334
--- /dev/null
+++ b/packages/cli/src/daemon/ui/components/Modal.svelte
@@ -0,0 +1,33 @@
+<script lang="ts">
+  import { X } from '@lucide/svelte'
+
+  let {
+    title,
+    closeLabel,
+    onclose,
+    wide = false,
+    children,
+  }: {
+    title: string
+    closeLabel: string
+    onclose: () => void
+    wide?: boolean
+    children: import('svelte').Snippet
+  } = $props()
+
+  function backdropClick(event: MouseEvent) {
+    if (event.target === event.currentTarget) onclose()
+  }
+</script>
+
+<div class="modal-backdrop" role="presentation" onclick={backdropClick} onkeydown={(event) => event.key === 'Escape' && onclose()}>
+  <div class:wide class="modal" role="dialog" aria-modal="true" aria-labelledby="modal-title" data-testid="modal">
+    <header class="modal-header">
+      <h2 id="modal-title">{title}</h2>
+      <button class="icon-button" type="button" aria-label={closeLabel} title={closeLabel} onclick={onclose} data-testid="modal-close">
+        <X size={18} strokeWidth={1.8} />
+      </button>
+    </header>
+    <div class="modal-body">{@render children()}</div>
+  </div>
+</div>
diff --git a/packages/cli/src/daemon/ui/components/PageHeader.svelte b/packages/cli/src/daemon/ui/components/PageHeader.svelte
new file mode 100644
index 0000000..e678e83
--- /dev/null
+++ b/packages/cli/src/daemon/ui/components/PageHeader.svelte
@@ -0,0 +1,22 @@
+<script lang="ts">
+  let {
+    eyebrow = '',
+    title,
+    description = '',
+    actions,
+  }: {
+    eyebrow?: string
+    title: string
+    description?: string
+    actions?: import('svelte').Snippet
+  } = $props()
+</script>
+
+<header class="page-header">
+  <div>
+    {#if eyebrow}<p class="eyebrow">{eyebrow}</p>{/if}
+    <h1>{title}</h1>
+    {#if description}<p class="page-description">{description}</p>{/if}
+  </div>
+  {#if actions}<div class="page-actions">{@render actions()}</div>{/if}
+</header>
diff --git a/packages/cli/src/daemon/ui/components/ProfileForm.svelte b/packages/cli/src/daemon/ui/components/ProfileForm.svelte
new file mode 100644
index 0000000..7127c2a
--- /dev/null
+++ b/packages/cli/src/daemon/ui/components/ProfileForm.svelte
@@ -0,0 +1,124 @@
+<script lang="ts">
+  import { untrack } from 'svelte'
+  import type { JsonRecord } from '../types.js'
+
+  let {
+    snapshot,
+    profile,
+    t,
+    busy,
+    oncancel,
+    onsubmit,
+  }: {
+    snapshot: JsonRecord
+    profile?: JsonRecord
+    t: (key: any) => string
+    busy: boolean
+    oncancel: () => void
+    onsubmit: (value: JsonRecord) => Promise<void>
+  } = $props()
+
+  let slug = $state(untrack(() => profile?.slug ?? ''))
+  let label = $state(untrack(() => profile?.label ?? ''))
+  let roleLabel = $state(untrack(() => profile?.preferences?.roleLabel ?? ''))
+  let browserVisibility = $state(untrack(() => profile?.preferences?.browserVisibility ?? snapshot.config.browserVisibility ?? 'auto'))
+  let enabledProviders = $state<string[]>(untrack(() => profile?.preferences?.enabledProviders
+    ? [...profile.preferences.enabledProviders]
+    : snapshot.providers.filter((provider: JsonRecord) => provider.stage !== 'disabled').map((provider: JsonRecord) => provider.id)))
+  let proxy = $state(untrack(() => profile?.preferences?.proxy?.server ?? ''))
+  let proxyBypass = $state(untrack(() => profile?.preferences?.proxy?.bypass?.join(', ') ?? ''))
+
+  function toggleProvider(provider: string, checked: boolean) {
+    enabledProviders = checked
+      ? [...new Set([...enabledProviders, provider])]
+      : enabledProviders.filter((entry) => entry !== provider)
+  }
+
+  async function submit(event: SubmitEvent) {
+    event.preventDefault()
+    await onsubmit({
+      ...(!profile ? { slug } : {}),
+      label,
+      roleLabel,
+      browserVisibility,
+      enabledProviders,
+      proxy: proxy.trim()
+        ? {
+            server: proxy.trim(),
+            bypass: proxyBypass.split(',').map((entry: string) => entry.trim()).filter(Boolean),
+          }
+        : null,
+    })
+  }
+</script>
+
+<form class="form-stack" onsubmit={submit} data-testid="profile-form">
+  {#if !profile}
+    <label class="field">
+      <span>{t('slug')} <small>{t('required')}</small></span>
+      <input name="slug" bind:value={slug} required pattern={'[a-z0-9](?:[a-z0-9]|-){0,63}'} autocomplete="off" data-testid="profile-slug" />
+    </label>
+  {/if}
+  <label class="field">
+    <span>{t('label')} <small>{t('required')}</small></span>
+    <input name="label" bind:value={label} required maxlength="80" autocomplete="off" data-testid="profile-label" />
+  </label>
+  <label class="field">
+    <span>{t('role')} <small>{t('optional')}</small></span>
+    <input name="roleLabel" bind:value={roleLabel} maxlength="80" autocomplete="off" data-testid="profile-role" />
+  </label>
+
+  <div class="form-grid compact">
+    <label class="field">
+      <span>{t('visibility')}</span>
+      <select bind:value={browserVisibility} data-testid="profile-visibility">
+        <option value="auto">auto</option>
+        <option value="headed">headed</option>
+        <option value="headless">headless</option>
+      </select>
+    </label>
+    <div class="field read-only-field">
+      <span>{t('profileBrowser')}</span>
+      <strong>{profile?.runtimeBinding?.browserId ?? snapshot.config.browser}</strong>
+    </div>
+  </div>
+
+  <fieldset class="fieldset">
+    <legend>{t('providerAccess')}</legend>
+    <div class="provider-pills" data-testid="profile-providers">
+      {#each snapshot.providers as provider (provider.id)}
+        <label class:checked={enabledProviders.includes(provider.id)} class="provider-pill">
+          <input
+            type="checkbox"
+            value={provider.id}
+            checked={enabledProviders.includes(provider.id)}
+            onchange={(event) => toggleProvider(provider.id, event.currentTarget.checked)}
+          />
+          <span>{provider.label}</span>
+        </label>
+      {/each}
+    </div>
+  </fieldset>
+
+  <details class="details-block">
+    <summary>{t('proxySettings')}</summary>
+    <div class="details-content">
+      <label class="field">
+        <span>{t('proxy')}</span>
+        <input bind:value={proxy} placeholder="socks5://127.0.0.1:1080" autocomplete="off" data-testid="profile-proxy" />
+      </label>
+      <label class="field">
+        <span>{t('proxyBypass')}</span>
+        <input bind:value={proxyBypass} autocomplete="off" data-testid="profile-proxy-bypass" />
+      </label>
+      <p class="form-note">{t('proxyRestartNote')}</p>
+    </div>
+  </details>
+
+  <div class="form-actions">
+    <button class="button secondary" type="button" onclick={oncancel}>{t('cancel')}</button>
+    <button class="button primary" type="submit" disabled={busy} data-testid="profile-submit">
+      {profile ? t('save') : t('create')}
+    </button>
+  </div>
+</form>
diff --git a/packages/cli/src/daemon/ui/dashboard-client.ts b/packages/cli/src/daemon/ui/dashboard-client.ts
new file mode 100644
index 0000000..6848a45
--- /dev/null
+++ b/packages/cli/src/daemon/ui/dashboard-client.ts
@@ -0,0 +1,71 @@
+import { translate, translateError } from './localization.js'
+import type { JsonRecord, Language, SnapshotResult } from './types.js'
+
+export class DashboardRequestError extends Error {
+  readonly code: string
+  readonly sessionExpired: boolean
+  readonly status: number | undefined
+
+  constructor(message: string, options: { code?: string, sessionExpired?: boolean, status?: number } = {}) {
+    super(message)
+    this.name = 'DashboardRequestError'
+    this.code = options.code ?? ''
+    this.sessionExpired = options.sessionExpired ?? false
+    this.status = options.status
+  }
+}
+
+export class DashboardClient {
+  private csrf = ''
+  private snapshotEtag = ''
+
+  constructor(private readonly currentLanguage: () => Language) {}
+
+  async authenticate() {
+    const session = await this.request('/session', { method: 'GET' })
+    if (!session) throw new DashboardRequestError(translate(this.currentLanguage(), 'requestFailed'))
+    this.csrf = String(session.csrf)
+  }
+
+  async snapshot(): Promise<SnapshotResult> {
+    const result = await this.request('/snapshot', { method: 'GET' })
+    return result === null ? { changed: false } : { changed: true, snapshot: result }
+  }
+
+  get(path: string) {
+    return this.request(path, { method: 'GET' })
+  }
+
+  mutate(path: string, body: unknown, method = 'POST') {
+    return this.request(path, {
+      method,
+      ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+    })
+  }
+
+  private async request(path: string, options: RequestInit): Promise<JsonRecord | null> {
+    const response = await fetch(`/ui-api/v1${path}`, {
+      ...options,
+      headers: {
+        'content-type': 'application/json',
+        ...(options.method && options.method !== 'GET' ? { 'x-tokenless-csrf': this.csrf } : {}),
+        ...(path === '/snapshot' && this.snapshotEtag ? { 'if-none-match': this.snapshotEtag } : {}),
+        ...(options.headers ?? {}),
+      },
+    })
+    if (response.status === 401) {
+      throw new DashboardRequestError(translate(this.currentLanguage(), 'reopen'), { sessionExpired: true, status: 401 })
+    }
+    if (response.status === 304) return null
+    const body = await response.json().catch(() => ({})) as JsonRecord
+    if (!response.ok) {
+      const code = typeof body?.error?.code === 'string' ? body.error.code : ''
+      throw new DashboardRequestError(
+        translateError(this.currentLanguage(), code, body?.error?.message),
+        { code, status: response.status },
+      )
+    }
+    if (path === '/snapshot') this.snapshotEtag = response.headers.get('etag') ?? ''
+    return body
+  }
+}
diff --git a/packages/cli/src/daemon/ui/formatting.ts b/packages/cli/src/daemon/ui/formatting.ts
new file mode 100644
index 0000000..30883f7
--- /dev/null
+++ b/packages/cli/src/daemon/ui/formatting.ts
@@ -0,0 +1,37 @@
+import type { Language } from './types.js'
+
+export function escapeHtml(value: unknown) {
+  return String(value ?? '').replace(/[&<>'"]/g, (character) => ({
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    "'": '&#39;',
+    '"': '&quot;',
+  })[character]!)
+}
+
+export function formatTime(value: unknown, language: Language) {
+  return value
+    ? new Intl.DateTimeFormat(language, { dateStyle: 'medium', timeStyle: 'short' }).format(new Date(String(value)))
+    : '—'
+}
+
+export function formatAge(value: unknown, language: Language, neverChecked: string) {
+  if (!value) return neverChecked
+  const seconds = Math.max(0, Math.floor((Date.now() - Date.parse(String(value))) / 1000))
+  const unit: Intl.RelativeTimeFormatUnit = seconds < 60
+    ? 'second'
+    : seconds < 3600
+      ? 'minute'
+      : seconds < 86400
+        ? 'hour'
+        : 'day'
+  const amount = unit === 'second'
+    ? seconds
+    : unit === 'minute'
+      ? Math.floor(seconds / 60)
+      : unit === 'hour'
+        ? Math.floor(seconds / 3600)
+        : Math.floor(seconds / 86400)
+  return new Intl.RelativeTimeFormat(language, { numeric: 'auto' }).format(-amount, unit)
+}
diff --git a/packages/cli/src/daemon/ui/index.html b/packages/cli/src/daemon/ui/index.html
new file mode 100644
index 0000000..d70c071
--- /dev/null
+++ b/packages/cli/src/daemon/ui/index.html
@@ -0,0 +1,22 @@
+<!doctype html>
+<html lang="__TOKENLESS_LANG__">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="color-scheme" content="light">
+  <title>__TOKENLESS_TITLE__</title>
+  <link rel="icon" href="/ui/mark.png">
+</head>
+<body>
+  <a class="skip-link" href="#main">__TOKENLESS_SKIP__</a>
+  <div id="app">
+    <main class="boot-state" role="status">
+      <img src="/ui/mark.png" alt="" width="42" height="42">
+      <p>Tokenless</p>
+      <span class="boot-line" aria-hidden="true"></span>
+      <label class="boot-language"><span>__TOKENLESS_LANGUAGE_LABEL__</span><select data-language-switch disabled><option value="en" __TOKENLESS_EN_SELECTED__>English</option><option value="zh-CN" __TOKENLESS_ZH_SELECTED__>简体中文</option></select></label>
+    </main>
+  </div>
+  <script type="module" src="/main.ts"></script>
+</body>
+</html>
diff --git a/packages/cli/src/daemon/ui/localization.ts b/packages/cli/src/daemon/ui/localization.ts
new file mode 100644
index 0000000..8eb1bb9
--- /dev/null
+++ b/packages/cli/src/daemon/ui/localization.ts
@@ -0,0 +1,160 @@
+import type { JsonRecord, Language } from './types.js'
+
+const messages = {
+  en: {
+    overview: 'Overview', profiles: 'Profiles', providers: 'Providers', capabilities: 'Capabilities', jobs: 'Jobs', system: 'System',
+    localConsole: 'Local console', operationalSummary: 'Operational summary', overviewLede: 'The exact daemon, browser, provider, and job state on this machine.',
+    daemon: 'Daemon', browser: 'Browser runtime', activeProfiles: 'Active profiles', waitingJobs: 'Waiting jobs', healthy: 'Healthy',
+    actionRequired: 'Action required', recentJobs: 'Recent jobs', providerReadiness: 'Provider readiness', noJobs: 'No jobs yet', noJobsBody: 'Durable jobs will appear here when Tokenless starts work.',
+    profileManagement: 'Browser identities', profilesLede: 'Manage isolated browser identities, their purpose, provider scope, and runtime behavior.',
+    cleanProfileNote: 'New profiles start clean unless the user explicitly consents to an opaque local profile copy; sign in through the visible managed browser.',
+    createProfile: 'Create profile', label: 'Display label', slug: 'Profile slug', role: 'Purpose or role', visibility: 'Visibility', enabledProviders: 'Enabled providers',
+    save: 'Save', cancel: 'Cancel', open: 'Open', remove: 'Remove', setDefault: 'Set default', default: 'Default', imported: 'Legacy imported', clean: 'Clean',
+    providerConfiguration: 'Provider configuration', providersLede: 'Intent, observed access, evidence, and routing eligibility stay separate.', selectProfile: 'Profile',
+    enabled: 'Enabled', disabled: 'Disabled', neverChecked: 'Never checked', checkNow: 'Check readiness', inspectControls: 'Inspect controls',
+    capabilityCatalog: 'Capability catalog', capabilitiesLede: 'Start from caller outcomes, then see which evidence-backed provider routes can satisfy them.', noRoute: 'No evidenced route',
+    durableJobs: 'Durable jobs', jobsLede: 'Inspect exact state transitions, blockers, normalized results, and recovery actions.', allStatuses: 'All statuses', allProviders: 'All providers', allProfiles: 'All profiles', searchJobs: 'Search task or job', details: 'Details', resume: 'Resume headed',
+    settingsDiagnostics: 'System and diagnostics', systemLede: 'Shared preferences, runtime controls, compatibility, and redacted repair information.', language: 'Language', quiesce: 'Quiesce runtime', copyDiagnostics: 'Copy diagnostics', diagnostics: 'Diagnostics',
+    updateSaved: 'Changes saved.', requestFailed: 'Request failed.', offline: 'Console is offline', offlineBody: 'The daemon stopped responding. Polling will resume automatically.', sessionExpired: 'Dashboard session expired', reopen: 'Run tokenless dashboard again to reauthenticate.',
+    loading: 'Loading current state', empty: 'Nothing to show', confirmRemove: 'Type the profile slug to confirm permanent removal:', create: 'Create', browserSelection: 'Browser for new profiles', browserExecutablePath: 'Browser executable path', browserExecutablePathPlaceholder: '/absolute/path/to/browser', browserExecutablePathConfigured: 'A verified path is cached. Leave blank to keep it, or paste a replacement.', browserExecutablePathHelp: 'Optional for a system browser. Tokenless discovers and verifies it when blank.', defaultVisibility: 'Default visibility', proxy: 'Proxy server', proxyBypass: 'Proxy bypass (comma separated)', proxyRestartNote: 'Changing the proxy first quiesces active browser ownership and recreates this profile context.', none: 'None', openBrowser: 'Open browser', savedAt: 'Saved',
+    stage: 'Stage', lifecycle: 'Lifecycle', evidence: 'Evidence', result: 'Result', error: 'Error', attempts: 'Provider attempts', created: 'Created', updated: 'Updated',
+    primaryNavigation: 'Primary navigation', uptimeUnit: 'min uptime', activeUnit: 'active', configuredUnit: 'configured', durableUnit: 'durable',
+    documentTitle: 'Tokenless local console', skipToContent: 'Skip to content',
+    configPersisted: 'Configuration is persisted.', setupIncomplete: 'Setup has not persisted configuration yet.', browserReady: 'The browser runtime is available.', browserUnavailable: 'The browser runtime is unavailable.', noManagedProfiles: 'No managed profile is configured.', profilesRegistered: 'managed profile(s) registered.', activeBrowserJobs: 'active browser job(s).',
+    setup: 'Setup', setupTitle: 'Set up Tokenless', setupBody: 'Choose a local browser identity. You can change this later.', continue: 'Continue', finishSetup: 'Finish setup', back: 'Back',
+    appearance: 'Appearance', profile: 'Profile', connection: 'Connection', advanced: 'Advanced', edit: 'Edit', more: 'More', close: 'Close',
+    profileBrowser: 'Browser', providersShort: 'Providers', profileReady: 'Ready', lastChecked: 'Last checked', openMenu: 'Open menu',
+    addProfile: 'Add profile', noProfiles: 'No profiles', required: 'Required', optional: 'Optional', profileCreated: 'Profile created.',
+    proxySettings: 'Proxy settings', providerAccess: 'Provider access', deleteProfile: 'Delete profile', deleteWarning: 'This removes the managed local browser identity.',
+    status: 'Status', version: 'Version', runtime: 'Runtime', ready: 'Ready', stopped: 'Stopped', selected: 'Selected',
+    refresh: 'Refresh', search: 'Search', queued: 'Queued', succeeded: 'Succeeded', failed: 'Failed', waiting: 'Waiting',
+    noResults: 'No matching results', copy: 'Copy', copied: 'Copied.', account: 'Account', model: 'Model', effort: 'Effort',
+    useBrowser: 'Use browser', chooseProviders: 'Choose providers', setupProfileHelp: 'A profile keeps provider sessions isolated on this machine.',
+    languageHelp: 'Used by the local console and CLI.', confirmDelete: 'Enter the profile slug to remove it permanently.', unknown: 'Unknown',
+    offlineShort: 'Offline', menu: 'Menu', mainContent: 'Main content', profileList: 'Profile list', navigation: 'Navigation',
+  },
+  'zh-CN': {
+    overview: '概览', profiles: 'Profile', providers: 'Provider', capabilities: '能力', jobs: '任务', system: '系统',
+    localConsole: '本地控制台', operationalSummary: '运行概览', overviewLede: '查看这台机器上 daemon、浏览器、provider 和任务的真实状态。',
+    daemon: 'Daemon', browser: '浏览器运行时', activeProfiles: '活跃 profile', waitingJobs: '等待任务', healthy: '健康',
+    actionRequired: '需要处理', recentJobs: '最近任务', providerReadiness: 'Provider 就绪状态', noJobs: '还没有任务', noJobsBody: 'Tokenless 开始工作后，持久任务会显示在这里。',
+    profileManagement: '浏览器身份', profilesLede: '管理隔离的浏览器身份、用途、provider 范围和运行方式。',
+    cleanProfileNote: '新 profile 默认从 clean 状态开始；只有在用户明确同意后，Tokenless 才会把选定的本地 profile 作为 opaque 文件树复制。也可以直接在可见的 managed browser 中登录。',
+    createProfile: '创建 profile', label: '显示名称', slug: 'Profile slug', role: '用途或角色', visibility: '可见性', enabledProviders: '启用的 provider',
+    save: '保存', cancel: '取消', open: '打开', remove: '移除', setDefault: '设为默认', default: '默认', imported: '旧版导入', clean: '全新',
+    providerConfiguration: 'Provider 配置', providersLede: '用户意图、实际观测、证据和路由资格分别展示，不混成一个状态。', selectProfile: 'Profile',
+    enabled: '已启用', disabled: '已停用', neverChecked: '从未检查', checkNow: '检查就绪状态', inspectControls: '检查控件',
+    capabilityCatalog: '能力目录', capabilitiesLede: '先看调用方需要的结果，再看哪些 provider 路由已有真实证据。', noRoute: '暂无证据路由',
+    durableJobs: '持久任务', jobsLede: '检查精确状态、阻塞原因、标准化结果和恢复操作。', allStatuses: '全部状态', allProviders: '全部 provider', allProfiles: '全部 profile', searchJobs: '搜索 task 或 job', details: '详情', resume: '以 headed 恢复',
+    settingsDiagnostics: '系统与诊断', systemLede: '管理共享偏好、运行时控制、兼容性和已脱敏的修复信息。', language: '语言', quiesce: '静默浏览器运行时', copyDiagnostics: '复制诊断信息', diagnostics: '诊断',
+    updateSaved: '更改已保存。', requestFailed: '请求失败。', offline: '控制台已离线', offlineBody: 'Daemon 暂时没有响应；连接恢复后会自动继续轮询。', sessionExpired: '控制台会话已过期', reopen: '请重新运行 tokenless dashboard 完成认证。',
+    loading: '正在读取当前状态', empty: '暂无内容', confirmRemove: '输入 profile slug 以确认永久移除：', create: '创建', browserSelection: '新 profile 使用的浏览器', browserExecutablePath: '浏览器 executable path', browserExecutablePathPlaceholder: '/浏览器的绝对路径', browserExecutablePathConfigured: '已缓存经过验证的路径。留空会保留，也可以粘贴新路径替换。', browserExecutablePathHelp: 'System browser 可选；留空时 Tokenless 会自动发现并验证。', defaultVisibility: '默认可见性', proxy: 'Proxy server', proxyBypass: 'Proxy bypass（逗号分隔）', proxyRestartNote: '更改 proxy 会先让浏览器运行时进入静默状态，再重建该 profile 的 context。', none: '无', openBrowser: '打开浏览器', savedAt: '保存时间',
+    stage: '阶段', lifecycle: '生命周期', evidence: '证据', result: '结果', error: '错误', attempts: 'Provider 尝试', created: '创建时间', updated: '更新时间',
+    primaryNavigation: '主要导航', uptimeUnit: '分钟运行时间', activeUnit: '活跃', configuredUnit: '已配置', durableUnit: '持久任务',
+    documentTitle: 'Tokenless 本地控制台', skipToContent: '跳到主要内容',
+    configPersisted: '配置已持久化。', setupIncomplete: 'Setup 尚未保存配置。', browserReady: '浏览器运行时可用。', browserUnavailable: '浏览器运行时不可用。', noManagedProfiles: '尚未配置 managed profile。', profilesRegistered: '个 managed profile 已注册。', activeBrowserJobs: '个浏览器任务正在运行。',
+    setup: '设置', setupTitle: '设置 Tokenless', setupBody: '选择一个本地浏览器身份，稍后仍可修改。', continue: '继续', finishSetup: '完成设置', back: '返回',
+    appearance: '外观', profile: 'Profile', connection: '连接', advanced: '高级', edit: '编辑', more: '更多', close: '关闭',
+    profileBrowser: '浏览器', providersShort: 'Provider', profileReady: '就绪', lastChecked: '上次检查', openMenu: '打开菜单',
+    addProfile: '添加 profile', noProfiles: '暂无 profile', required: '必填', optional: '选填', profileCreated: 'Profile 已创建。',
+    proxySettings: 'Proxy 设置', providerAccess: 'Provider 访问', deleteProfile: '删除 profile', deleteWarning: '这会移除本机的 managed browser 身份。',
+    status: '状态', version: '版本', runtime: '运行时', ready: '就绪', stopped: '已停止', selected: '已选择',
+    refresh: '刷新', search: '搜索', queued: '排队中', succeeded: '已完成', failed: '失败', waiting: '等待中',
+    noResults: '没有匹配结果', copy: '复制', copied: '已复制。', account: '账号', model: '模型', effort: '推理强度',
+    useBrowser: '使用浏览器', chooseProviders: '选择 provider', setupProfileHelp: 'Profile 会在这台机器上隔离不同的 provider 会话。',
+    languageHelp: '用于本地控制台和 CLI。', confirmDelete: '输入 profile slug 以永久移除。', unknown: '未知',
+    offlineShort: '离线', menu: '菜单', mainContent: '主要内容', profileList: 'Profile 列表', navigation: '导航',
+  },
+} as const
+
+export type MessageKey = keyof typeof messages.en
+
+const capabilityZh: Record<string, readonly [string, string]> = {
+  'conversation.chat': ['对话', '提交 prompt，并读取与本次提交对应的可见 provider 响应。'],
+  'conversation.continue': ['继续对话', '继续由 Tokenless 精确选中的持久 provider 对话。'],
+  'file.upload': ['上传文件', '附加调用方选择的文件，并证明 provider 已在可见界面接收。'],
+  'image.input': ['图片输入', '把图片作为 provider 输入。'],
+  'audio.input': ['音频输入', '把音频作为 provider 输入。'],
+  'audio.transcription': ['音频转写', '生成与调用方所选音频对应的完整可见文字稿。'],
+  'video.input': ['视频输入', '把视频作为 provider 输入。'],
+  'url.input': ['URL 输入', '把调用方授权的 URL 作为 provider 输入。'],
+  'repository.import': ['导入代码仓库', '通过 provider 原生流程导入已授权的代码仓库。'],
+  'search.web': ['网页搜索', '使用 provider 原生网页检索策略返回有依据的结果。'],
+  'research.deep': ['深度研究', '完成 provider 原生研究流程，并交付带引用的最终报告。'],
+  'reasoning.extended': ['扩展推理', '使用已有证据的 provider 推理策略，而不是直接依赖原始模式标签。'],
+  'code.execute': ['执行代码', '在 provider 所有的可见环境中执行代码。'],
+  'data.analyze': ['数据分析', '通过 provider 原生工作流分析结构化数据。'],
+  'image.generation': ['图片生成', '生成完整的 provider 原生图片产物。'],
+  'image.edit': ['图片编辑', '依据提交的源图片和指令生成对应的完整编辑结果。'],
+  'video.generation': ['视频生成', '生成完整的 provider 原生视频产物。'],
+  'audio.generation': ['音频生成', '生成完整的 provider 原生音频产物。'],
+  'document.generation': ['文档生成', '生成完整的 provider 原生文档产物。'],
+  'presentation.generation': ['演示文稿生成', '生成完整的 provider 原生演示文稿产物。'],
+  'spreadsheet.generation': ['电子表格生成', '生成完整的 provider 原生电子表格产物。'],
+  'website.generation': ['网站生成', '生成完整的 provider 原生网站产物。'],
+  'workspace.native': ['原生 workspace', '创建或复用精确的 provider 原生 Project 或同类 workspace。'],
+  'workspace.instructions': ['Workspace 指令', '通过 provider 原生 workspace 应用指令，并证明其可见效果。'],
+  'workspace.knowledge': ['Workspace 知识', '在精确的 provider 原生 workspace 中持久保存已授权知识。'],
+  'source.connected': ['已连接来源', '读取明确授权的 provider connector 或已连接来源。'],
+  'response.citations': ['响应引用', '要求返回由 provider 响应中可见链接支撑的标准化引用。'],
+  'artifact.download': ['可下载产物', '要求 provider 提供已完成且可下载的产物。'],
+  'task.background': ['后台任务', '允许持久 provider 任务在页面不处于前台时继续运行。'],
+  'task.interactive': ['交互任务', '把 provider 的澄清或确认显示为可恢复的 waiting-for-user 状态。'],
+}
+
+const capabilityFamilyZh: Record<string, string> = {
+  conversation: '对话',
+  input: '输入',
+  retrieval_reasoning: '检索与推理',
+  media_generation: '媒体生成',
+  artifact_generation: '产物生成',
+  workspace_knowledge: 'Workspace 与知识',
+  evidence_lifecycle: '证据与生命周期',
+}
+
+const uiErrorZh: Record<string, string> = {
+  ui_session_required: '请从 Tokenless CLI 重新打开控制台。',
+  ui_origin_rejected: '请求来源不受允许。',
+  ui_csrf_rejected: '请求安全令牌无效。',
+  ui_ticket_invalid: '控制台启动 ticket 无效或已过期。',
+  ui_host_rejected: '请求 Host 不受允许。',
+  ui_body_too_large: '请求内容过大。',
+  ui_json_invalid: '请求内容必须是有效的 JSON object。',
+  invalid_browser: '浏览器选择无效。',
+  invalid_browser_executable_path: '浏览器 executable path 必须为空或使用绝对路径。',
+  browser_executable_path_requires_system_browser: '只有明确选择 Chrome 或 Brave 等 system browser 时才能设置 executable path。',
+  browser_executable_not_found: '找不到浏览器 executable。请粘贴绝对路径，或改选其他浏览器。',
+  invalid_browser_visibility: '浏览器可见性无效。',
+  invalid_language: '语言必须是 en 或 zh-CN。',
+  browser_mutation_unsafe: '仍有浏览器任务运行，暂时不能更改浏览器选择。',
+  browser_runtime_unavailable: '浏览器运行时不可用。',
+  invalid_profile_slug: 'Profile slug 只能使用小写字母、数字和连字符。',
+  invalid_profile_label: 'Profile 名称必须为 1 到 80 个字符。',
+  invalid_role_label: '角色标签不能超过 80 个字符。',
+  profile_mutation_unsafe: '仍有浏览器任务运行，暂时不能移除 profile。',
+  profile_proxy_mutation_unsafe: '仍有浏览器任务运行，暂时不能更改 proxy。',
+  invalid_provider_list: '启用的 provider 列表无效。',
+  provider_not_enabled: '请先为该 profile 启用 provider。',
+  provider_not_supported: '该 provider 暂不受支持。',
+  provider_selection_invalid: '选择类型必须是 model 或 effort。',
+  invalid_proxy: 'Proxy 必须使用不含嵌入凭据的 HTTP、HTTPS 或 SOCKS5 地址。',
+  invalid_fields: '请求包含不受支持的字段。',
+}
+
+export function translate(language: Language, key: MessageKey) {
+  return messages[language][key]
+}
+
+export function translateError(language: Language, code: string, fallback?: string) {
+  if (language === 'zh-CN') return uiErrorZh[code] ?? `${translate(language, 'requestFailed')}${code ? ` (${code})` : ''}`
+  return fallback ?? translate(language, 'requestFailed')
+}
+
+export function capabilityText(language: Language, capability: JsonRecord) {
+  const localized = language === 'zh-CN' ? capabilityZh[String(capability.id)] : undefined
+  return localized ? { title: localized[0], description: localized[1] } : capability
+}
+
+export function capabilityFamilyLabel(language: Language, family: string) {
+  return language === 'zh-CN' ? capabilityFamilyZh[family] ?? family : family.replaceAll('_', ' ')
+}
diff --git a/packages/cli/src/daemon/ui/main.ts b/packages/cli/src/daemon/ui/main.ts
new file mode 100644
index 0000000..51b6b79
--- /dev/null
+++ b/packages/cli/src/daemon/ui/main.ts
@@ -0,0 +1,9 @@
+import { mount } from 'svelte'
+
+import App from './App.svelte'
+import './styles.css'
+
+const target = document.querySelector<HTMLElement>('#app')
+if (!target) throw new Error('Dashboard root element is missing.')
+
+mount(App, { target })
diff --git a/packages/cli/src/daemon/ui/styles.css b/packages/cli/src/daemon/ui/styles.css
new file mode 100644
index 0000000..b10e0dd
--- /dev/null
+++ b/packages/cli/src/daemon/ui/styles.css
@@ -0,0 +1,341 @@
+:root {
+  color-scheme: light;
+  font-family: Inter, ui-sans-serif, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+  font-synthesis: none;
+  --canvas: #f6f5f2;
+  --surface: #ffffff;
+  --surface-muted: #f1f0ed;
+  --surface-strong: #e9e8e4;
+  --ink: #171715;
+  --muted: #73716b;
+  --subtle: #9b9891;
+  --line: #deddd8;
+  --line-soft: #ebeae6;
+  --green: #2f8a57;
+  --red: #b2483f;
+  --amber: #a56b22;
+  --radius: 10px;
+  --shadow: 0 18px 60px rgb(31 30 27 / 12%);
+}
+
+* { box-sizing: border-box; }
+html, body, #app { min-width: 320px; min-height: 100%; margin: 0; }
+body { background: var(--canvas); color: var(--ink); font-size: 14px; }
+button, input, select, textarea { color: inherit; font: inherit; }
+button, select { cursor: pointer; }
+button:disabled, input:disabled, select:disabled { cursor: not-allowed; opacity: .48; }
+button:focus-visible, input:focus-visible, select:focus-visible, summary:focus-visible, [tabindex]:focus-visible { outline: 2px solid var(--ink); outline-offset: 2px; }
+h1, h2, h3, p { margin: 0; }
+h1 { font-size: clamp(25px, 2vw, 34px); font-weight: 630; letter-spacing: -.035em; line-height: 1.08; }
+h2 { font-size: 17px; font-weight: 620; letter-spacing: -.02em; }
+h3 { font-size: 13px; font-weight: 650; }
+small { color: var(--muted); font-size: 11px; font-weight: 450; }
+
+.skip-link { position: fixed; z-index: 1000; left: 12px; top: -50px; padding: 9px 12px; border-radius: 6px; background: var(--ink); color: white; text-decoration: none; }
+.skip-link:focus { top: 12px; }
+.sr-only { position: absolute; width: 1px; height: 1px; overflow: hidden; clip: rect(0, 0, 0, 0); white-space: nowrap; }
+.eyebrow { margin-bottom: 8px; color: var(--muted); font-size: 10px; font-weight: 700; letter-spacing: .14em; text-transform: uppercase; }
+.muted, .form-note { color: var(--muted); }
+.form-note { font-size: 12px; line-height: 1.55; }
+.spacer { flex: 1; }
+
+.app-shell { min-height: 100vh; padding-left: 64px; }
+.rail { position: fixed; z-index: 30; inset: 0 auto 0 0; display: flex; width: 64px; flex-direction: column; align-items: center; border-right: 1px solid var(--line); background: var(--surface); }
+.rail-brand { display: grid; width: 100%; height: 70px; place-items: center; border-bottom: 1px solid var(--line-soft); }
+.rail-brand img { width: 28px; height: 28px; object-fit: contain; }
+.rail nav { display: flex; flex: 1; width: 100%; flex-direction: column; align-items: center; gap: 6px; padding-top: 24px; }
+.rail-button { position: relative; display: grid; width: 40px; height: 40px; place-items: center; border: 0; border-radius: 8px; background: transparent; color: #77746e; }
+.rail-button:hover { background: var(--surface-muted); color: var(--ink); }
+.rail-button.active { background: var(--ink); color: white; }
+.rail-button::after { position: absolute; z-index: 50; left: 48px; padding: 6px 8px; border-radius: 6px; background: var(--ink); color: white; content: attr(data-tooltip); font-size: 11px; opacity: 0; pointer-events: none; transform: translateX(-3px); transition: opacity 120ms, transform 120ms; white-space: nowrap; }
+.rail-button:hover::after, .rail-button:focus-visible::after { opacity: 1; transform: translateX(0); }
+.rail-status { display: grid; width: 64px; height: 64px; place-items: center; border-top: 1px solid var(--line-soft); }
+.rail-status span, .status-dot { width: 7px; height: 7px; border-radius: 999px; background: var(--subtle); }
+.rail-status span { background: var(--green); box-shadow: 0 0 0 4px rgb(47 138 87 / 10%); }
+.rail-status.offline span, .status-dot.error { background: var(--red); }
+.mobile-header, .mobile-nav { display: none; }
+.offline-banner { position: fixed; z-index: 28; top: 10px; left: 50%; padding: 6px 10px; border: 1px solid #d7b493; border-radius: 999px; background: #fff8ef; color: #83521c; font-size: 11px; transform: translateX(-50%); }
+
+main#main { min-height: 100vh; }
+main#main:focus { outline: none; }
+.page { width: min(1480px, 100%); margin: 0 auto; padding: 52px 56px 64px; }
+.page-header { display: flex; min-height: 70px; align-items: flex-start; justify-content: space-between; gap: 28px; margin-bottom: 36px; }
+.page-description { max-width: 600px; margin-top: 10px; color: var(--muted); font-size: 13px; line-height: 1.55; }
+.page-actions { display: flex; align-items: center; gap: 8px; }
+
+.button { display: inline-flex; min-height: 38px; align-items: center; justify-content: center; gap: 7px; padding: 0 14px; border: 1px solid var(--line); border-radius: 7px; background: var(--surface); color: var(--ink); font-size: 12px; font-weight: 600; }
+.button:hover:not(:disabled) { border-color: #b9b7b0; background: #faf9f7; }
+.button.primary { border-color: var(--ink); background: var(--ink); color: white; }
+.button.primary:hover:not(:disabled) { background: #33322f; }
+.button.secondary { background: var(--surface); }
+.button.danger { border-color: #ddc0bc; background: #fff8f7; color: var(--red); }
+.icon-button { display: inline-grid; width: 36px; height: 36px; flex: 0 0 auto; place-items: center; border: 1px solid var(--line); border-radius: 7px; background: var(--surface); }
+.icon-button:hover:not(:disabled) { background: var(--surface-muted); }
+.icon-button.dark { border-color: var(--ink); background: var(--ink); color: white; }
+.text-button { padding: 4px 0; border: 0; background: transparent; color: var(--muted); font-size: 11px; font-weight: 650; }
+.text-button:hover { color: var(--ink); }
+
+.metric-grid { display: grid; grid-template-columns: repeat(4, minmax(0, 1fr)); gap: 12px; }
+.metric-card { display: flex; min-height: 114px; align-items: flex-start; gap: 15px; padding: 22px; border: 1px solid var(--line); border-radius: var(--radius); background: var(--surface); }
+.metric-card > div { min-width: 0; }
+.metric-card small { display: block; margin-bottom: 7px; }
+.metric-card strong { display: block; overflow: hidden; font-size: 22px; font-weight: 620; letter-spacing: -.03em; text-overflow: ellipsis; white-space: nowrap; }
+.metric-card p { margin-top: 4px; color: var(--muted); font-size: 11px; }
+.metric-icon { display: grid; width: 34px; height: 34px; flex: 0 0 auto; place-items: center; border-radius: 8px; background: var(--surface-muted); color: #5f5c56; }
+.overview-grid { display: grid; grid-template-columns: 1.1fr .9fr; gap: 16px; margin-top: 16px; }
+.content-panel { overflow: hidden; border: 1px solid var(--line); border-radius: var(--radius); background: var(--surface); }
+.panel-title { display: flex; min-height: 70px; align-items: center; justify-content: space-between; padding: 0 20px; border-bottom: 1px solid var(--line-soft); }
+.panel-title p { margin-top: 4px; color: var(--muted); font-size: 11px; }
+.row-list { min-width: 0; }
+.data-row { display: flex; width: 100%; min-height: 62px; align-items: center; gap: 13px; padding: 11px 18px; border: 0; border-bottom: 1px solid var(--line-soft); background: transparent; text-align: left; }
+button.data-row:hover { background: #faf9f7; }
+.data-row:last-child { border-bottom: 0; }
+.data-row-main { display: flex; min-width: 0; flex: 1; flex-direction: column; gap: 4px; }
+.data-row-main strong, .data-row-main small { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.data-row-main strong { font-size: 12px; font-weight: 620; }
+.data-row svg { flex: 0 0 auto; color: var(--subtle); }
+.provider-glyph { display: grid; width: 30px; height: 30px; flex: 0 0 auto; place-items: center; border: 1px solid var(--line); border-radius: 7px; background: #fbfaf8; font-size: 12px; font-weight: 700; }
+.provider-glyph.large { width: 38px; height: 38px; font-size: 14px; }
+.status-dot { display: inline-block; flex: 0 0 auto; }
+.status-dot.ok { background: var(--green); }
+.job-state { display: block; width: 8px; height: 8px; flex: 0 0 auto; border-radius: 999px; background: var(--subtle); }
+.job-state.succeeded { background: var(--green); }
+.job-state.failed, .job-state.canceled, .job-state.timed_out { background: var(--red); }
+.job-state.queued, .job-state.claimed, .job-state.running, .job-state.waiting_for_user { background: var(--amber); }
+.mono-label { color: var(--muted); font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 10px; }
+.badge { display: inline-flex; width: fit-content; min-height: 22px; align-items: center; padding: 0 8px; border-radius: 999px; font-size: 10px; font-weight: 650; }
+.badge.neutral { border: 1px solid var(--line); background: var(--surface-muted); color: #615f59; }
+.empty-state { display: flex; min-height: 220px; flex-direction: column; align-items: center; justify-content: center; gap: 8px; padding: 28px; color: var(--muted); text-align: center; }
+.empty-state p { max-width: 260px; font-size: 11px; line-height: 1.5; }
+
+.profiles-layout { display: grid; min-height: 100vh; grid-template-columns: 302px minmax(0, 1fr); background: var(--surface); }
+.profile-master { display: flex; min-width: 0; flex-direction: column; border-right: 1px solid var(--line); background: var(--canvas); }
+.profile-master-header { display: flex; height: 108px; flex: 0 0 auto; align-items: center; justify-content: space-between; padding: 25px 22px 18px; border-bottom: 1px solid var(--line); }
+.profile-master-header h1 { font-size: 23px; }
+.profile-master-list { flex: 1; overflow-y: auto; padding: 10px; }
+.profile-list-item { display: flex; width: 100%; min-height: 60px; align-items: center; gap: 11px; padding: 9px 10px; border: 1px solid transparent; border-radius: 8px; background: transparent; text-align: left; }
+.profile-list-item:hover { background: var(--surface); }
+.profile-list-item.active { border-color: var(--line); background: var(--surface); box-shadow: 0 1px 2px rgb(20 20 18 / 3%); }
+.avatar { display: grid; width: 34px; height: 34px; flex: 0 0 auto; place-items: center; border: 1px solid var(--line); border-radius: 50%; background: var(--surface); color: #67645e; }
+.avatar.large { width: 44px; height: 44px; }
+.profile-list-copy { display: flex; min-width: 0; flex: 1; flex-direction: column; gap: 4px; }
+.profile-list-copy strong, .profile-list-copy small { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.profile-list-copy strong { font-size: 12px; }
+.profile-list-item > svg { color: var(--subtle); }
+.default-star { color: #7d796f !important; }
+.profile-master-note { margin: 10px 14px 16px; padding-top: 13px; border-top: 1px solid var(--line); color: var(--muted); font-size: 10px; line-height: 1.5; }
+.profile-inspector { min-width: 0; background: var(--surface); }
+.inspector-header { display: flex; height: 108px; align-items: center; justify-content: space-between; gap: 20px; padding: 0 36px; border-bottom: 1px solid var(--line); }
+.inspector-title { display: flex; min-width: 0; align-items: center; gap: 14px; }
+.inspector-title h2 { font-size: 21px; }
+.inspector-title p { margin-top: 6px; color: var(--muted); font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 10px; }
+.title-line { display: flex; align-items: center; gap: 9px; }
+.inspector-actions { position: relative; display: flex; gap: 8px; }
+.popover-menu { position: absolute; z-index: 20; top: 43px; right: 0; width: 174px; padding: 6px; border: 1px solid var(--line); border-radius: 8px; background: var(--surface); box-shadow: var(--shadow); }
+.popover-menu button { display: flex; width: 100%; min-height: 34px; align-items: center; gap: 9px; padding: 0 9px; border: 0; border-radius: 5px; background: transparent; font-size: 11px; text-align: left; }
+.popover-menu button:hover { background: var(--surface-muted); }
+.danger-text { color: var(--red); }
+.inspector-content { width: min(820px, calc(100% - 72px)); margin: 0 auto; padding: 40px 0 80px; }
+.settings-section { margin-bottom: 34px; }
+.settings-section-title { display: flex; min-height: 36px; align-items: flex-start; justify-content: space-between; color: var(--muted); }
+.settings-section-title h2, .settings-section-title h3 { color: var(--ink); }
+.settings-list, .provider-settings-list { overflow: hidden; border: 1px solid var(--line); border-radius: var(--radius); }
+.settings-row { display: flex; min-height: 54px; align-items: center; justify-content: space-between; gap: 24px; padding: 0 17px; border-bottom: 1px solid var(--line-soft); }
+.settings-row:last-child { border-bottom: 0; }
+.settings-row > span { color: var(--muted); font-size: 11px; }
+.settings-row strong { overflow: hidden; font-size: 12px; font-weight: 570; text-overflow: ellipsis; white-space: nowrap; }
+.status-value { display: flex; align-items: center; gap: 7px; }
+.provider-setting-row { display: grid; min-height: 58px; grid-template-columns: 32px minmax(0, 1fr) 8px 18px; align-items: center; gap: 12px; padding: 8px 16px; border-bottom: 1px solid var(--line-soft); }
+.provider-setting-row:last-child { border-bottom: 0; }
+.provider-setting-row.disabled { opacity: .5; }
+.provider-setting-row > div:nth-child(2) { display: flex; min-width: 0; flex-direction: column; gap: 4px; }
+.provider-setting-row strong { font-size: 12px; }
+.provider-setting-row small { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.row-check { color: var(--green); }
+
+.provider-card-grid { display: grid; grid-template-columns: repeat(3, minmax(250px, 1fr)); gap: 14px; }
+.provider-card { display: flex; min-height: 280px; flex-direction: column; padding: 20px; border: 1px solid var(--line); border-radius: var(--radius); background: var(--surface); }
+.provider-card.disabled { background: #f8f7f4; }
+.provider-card header { display: flex; align-items: center; gap: 12px; }
+.provider-card header > div { min-width: 0; flex: 1; }
+.provider-card h2 { font-size: 15px; }
+.provider-card header p { margin-top: 4px; color: var(--muted); font-size: 10px; }
+.provider-account { display: flex; min-height: 48px; align-items: center; justify-content: space-between; gap: 12px; margin-top: 18px; border-top: 1px solid var(--line-soft); border-bottom: 1px solid var(--line-soft); font-size: 11px; }
+.provider-account span { color: var(--muted); }
+.provider-account strong { overflow: hidden; font-size: 11px; text-overflow: ellipsis; white-space: nowrap; }
+.provider-meta { display: flex; align-items: center; gap: 8px; margin-top: auto; padding-top: 17px; color: var(--muted); font-size: 10px; }
+.provider-card footer { display: flex; justify-content: flex-end; gap: 7px; margin-top: 13px; }
+.switch input { position: absolute; opacity: 0; pointer-events: none; }
+.switch span { position: relative; display: block; width: 34px; height: 19px; border-radius: 999px; background: #d8d6d0; transition: background 150ms; }
+.switch span::after { position: absolute; top: 3px; left: 3px; width: 13px; height: 13px; border-radius: 50%; background: white; box-shadow: 0 1px 3px rgb(0 0 0 / 18%); content: ''; transition: transform 150ms; }
+.switch input:checked + span { background: var(--ink); }
+.switch input:checked + span::after { transform: translateX(15px); }
+.inline-select select, .filter-bar select { min-height: 38px; padding: 0 34px 0 11px; border: 1px solid var(--line); border-radius: 7px; background: var(--surface); }
+
+.capability-groups { display: grid; gap: 28px; }
+.capability-group > header { display: flex; align-items: center; justify-content: space-between; margin-bottom: 9px; }
+.capability-group > header h2 { font-size: 13px; }
+.capability-group > header span { color: var(--muted); font-size: 11px; }
+.capability-row { min-height: 70px; }
+.capability-row .data-row-main small { max-width: 700px; }
+.capability-route { max-width: 260px; overflow: hidden; color: var(--muted); font-size: 10px; text-overflow: ellipsis; white-space: nowrap; }
+
+.filter-bar { display: flex; gap: 8px; margin-bottom: 12px; }
+.search-field { display: flex; min-height: 38px; min-width: 260px; flex: 1; align-items: center; gap: 8px; padding: 0 10px; border: 1px solid var(--line); border-radius: 7px; background: var(--surface); }
+.search-field svg { color: var(--muted); }
+.search-field input { width: 100%; border: 0; outline: 0; background: transparent; font-size: 12px; }
+.search-field button { display: grid; padding: 0; border: 0; background: transparent; }
+.job-row time { min-width: 142px; color: var(--muted); font-size: 10px; text-align: right; }
+
+.system-grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 16px; }
+.system-card { margin: 0; padding: 20px; border: 1px solid var(--line); border-radius: var(--radius); background: var(--surface); }
+.system-card .settings-section-title { border-bottom: 1px solid var(--line-soft); }
+.system-actions { display: flex; grid-column: 1 / -1; justify-content: flex-end; gap: 8px; }
+.diagnostics-section { margin-top: 42px; }
+.diagnostics-section > header { margin-bottom: 10px; }
+.diagnostics-section > header h2 { font-size: 14px; }
+.diagnostics-section > header p { margin-top: 4px; color: var(--muted); font-size: 10px; }
+.diagnostic-row { cursor: default; }
+
+.field { display: flex; min-width: 0; flex-direction: column; gap: 7px; }
+.field > span, .fieldset legend { color: #595751; font-size: 11px; font-weight: 620; }
+.field > span small { margin-left: 4px; font-size: 9px; font-weight: 450; }
+.field > input, .field > select { width: 100%; min-height: 39px; padding: 0 11px; border: 1px solid var(--line); border-radius: 7px; background: var(--surface); font-size: 12px; }
+.field > input:hover, .field > select:hover { border-color: #bab8b1; }
+.field > small { line-height: 1.45; }
+.compact-field { margin-top: 13px; }
+.compact-field > select { min-height: 34px; }
+.form-stack { display: flex; flex-direction: column; gap: 18px; }
+.form-grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 16px; }
+.form-grid.compact { gap: 12px; }
+.form-actions { display: flex; justify-content: flex-end; gap: 8px; padding-top: 4px; }
+.read-only-field { justify-content: flex-end; padding: 0 12px 8px; border-bottom: 1px solid var(--line); }
+.read-only-field strong { overflow: hidden; font-size: 12px; text-overflow: ellipsis; white-space: nowrap; }
+.fieldset { min-width: 0; margin: 0; padding: 0; border: 0; }
+.fieldset legend { margin-bottom: 10px; }
+.provider-pills { display: flex; flex-wrap: wrap; gap: 7px; }
+.provider-pill { display: inline-flex; min-height: 32px; align-items: center; gap: 5px; padding: 0 10px; border: 1px solid var(--line); border-radius: 999px; background: var(--surface); color: var(--muted); cursor: pointer; font-size: 11px; }
+.provider-pill.checked { border-color: #aaa79f; background: var(--surface-muted); color: var(--ink); }
+.provider-pill input { position: absolute; opacity: 0; pointer-events: none; }
+.details-block { border: 1px solid var(--line); border-radius: 8px; }
+.details-block summary { padding: 13px 14px; cursor: pointer; font-size: 11px; font-weight: 620; }
+.details-content { display: flex; flex-direction: column; gap: 15px; padding: 4px 14px 15px; border-top: 1px solid var(--line-soft); }
+.danger-note { padding: 11px 12px; border: 1px solid #ead1cd; border-radius: 7px; background: #fff8f7; color: var(--red); font-size: 12px; }
+
+.modal-backdrop { position: fixed; z-index: 100; inset: 0; display: grid; place-items: center; padding: 24px; background: rgb(24 23 21 / 28%); backdrop-filter: blur(3px); }
+.modal { width: min(480px, 100%); max-height: min(800px, calc(100vh - 48px)); overflow: hidden; border: 1px solid var(--line); border-radius: 12px; background: var(--surface); box-shadow: var(--shadow); }
+.modal.wide { width: min(660px, 100%); }
+.modal-header { display: flex; min-height: 64px; align-items: center; justify-content: space-between; padding: 0 20px; border-bottom: 1px solid var(--line-soft); }
+.modal-header h2 { font-size: 16px; }
+.modal-body { max-height: calc(100vh - 113px); overflow-y: auto; padding: 20px; }
+.detail-stack { display: flex; flex-direction: column; align-items: flex-start; gap: 18px; }
+.detail-stack > p { color: var(--muted); font-size: 12px; line-height: 1.6; }
+.detail-stack section { width: 100%; }
+.detail-stack section h3 { margin-bottom: 7px; }
+pre { max-width: 100%; max-height: 260px; overflow: auto; margin: 0; padding: 12px; border: 1px solid var(--line); border-radius: 7px; background: #f6f5f2; color: #45433e; font: 10px/1.55 ui-monospace, SFMono-Regular, Menlo, monospace; white-space: pre-wrap; word-break: break-word; }
+.detail-meta { display: flex; align-items: center; gap: 10px; color: var(--muted); font-size: 11px; }
+
+.setup-shell { display: flex; min-height: 100vh; flex-direction: column; align-items: center; padding: 34px 24px 60px; background: var(--canvas); }
+.setup-brand { display: flex; width: min(680px, 100%); align-items: center; gap: 9px; margin-bottom: 24px; font-size: 13px; font-weight: 680; }
+.setup-brand img { width: 26px; height: 26px; }
+.setup-card { width: min(680px, 100%); overflow: hidden; border: 1px solid var(--line); border-radius: 13px; background: var(--surface); box-shadow: 0 12px 40px rgb(31 30 27 / 5%); }
+.setup-header { padding: 32px 34px 26px; border-bottom: 1px solid var(--line-soft); }
+.setup-header h1 { font-size: 28px; }
+.setup-header > p:last-child { margin-top: 9px; color: var(--muted); font-size: 12px; }
+.setup-form { padding: 8px 34px 26px; }
+.setup-row { display: grid; grid-template-columns: 34px minmax(0, 1fr); gap: 15px; padding: 20px 0; border-bottom: 1px solid var(--line-soft); }
+.setup-row.align-start { align-items: start; }
+.setup-icon { display: grid; width: 32px; height: 32px; place-items: center; border-radius: 8px; background: var(--surface-muted); color: #66635d; }
+.setup-fields { display: flex; min-width: 0; flex-direction: column; gap: 14px; }
+.setup-fields.form-grid { display: grid; }
+.setup-providers { margin-top: 3px; }
+.setup-actions { display: flex; align-items: center; justify-content: space-between; padding-top: 24px; }
+.setup-actions > span { color: var(--muted); font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 10px; }
+
+.loading-state, .fatal-state { display: flex; min-height: 100vh; flex-direction: column; align-items: center; justify-content: center; gap: 14px; padding: 30px; text-align: center; }
+.loading-state img, .fatal-state img { width: 42px; height: 42px; }
+.loading-state p, .fatal-state p { max-width: 520px; color: var(--muted); font-size: 12px; line-height: 1.5; }
+.fatal-state h1 { font-size: 22px; }
+.spinner { width: 18px; height: 18px; border: 2px solid var(--line); border-top-color: var(--ink); border-radius: 50%; animation: spin 800ms linear infinite; }
+@keyframes spin { to { transform: rotate(360deg); } }
+.toast-region { position: fixed; z-index: 200; right: 22px; bottom: 22px; pointer-events: none; }
+.toast { max-width: 360px; padding: 11px 14px; border: 1px solid #3b3935; border-radius: 8px; background: var(--ink); box-shadow: 0 10px 30px rgb(0 0 0 / 14%); color: white; font-size: 11px; }
+
+@media (max-width: 1100px) {
+  .page { padding-right: 30px; padding-left: 30px; }
+  .metric-grid { grid-template-columns: repeat(2, minmax(0, 1fr)); }
+  .provider-card-grid { grid-template-columns: repeat(2, minmax(240px, 1fr)); }
+  .profiles-layout { grid-template-columns: 260px minmax(0, 1fr); }
+  .inspector-header { padding: 0 24px; }
+  .inspector-content { width: calc(100% - 48px); }
+}
+
+@media (max-width: 760px) {
+  body { font-size: 13px; }
+  .app-shell { padding: 56px 0 68px; }
+  .rail { display: none; }
+  .mobile-header { position: fixed; z-index: 30; inset: 0 0 auto; display: flex; height: 56px; align-items: center; justify-content: space-between; padding: 0 14px; border-bottom: 1px solid var(--line); background: rgb(255 255 255 / 96%); backdrop-filter: blur(12px); }
+  .mobile-header > div { display: flex; align-items: center; gap: 8px; font-size: 12px; }
+  .mobile-header img { width: 24px; height: 24px; }
+  .mobile-profile-select select { max-width: 148px; min-height: 32px; padding: 0 26px 0 9px; border: 1px solid var(--line); border-radius: 7px; background: var(--surface); font-size: 11px; }
+  .mobile-nav { position: fixed; z-index: 30; inset: auto 0 0; display: grid; height: 68px; grid-template-columns: repeat(6, 1fr); padding: 5px 5px max(5px, env(safe-area-inset-bottom)); border-top: 1px solid var(--line); background: rgb(255 255 255 / 96%); backdrop-filter: blur(12px); }
+  .mobile-nav button { display: flex; min-width: 0; flex-direction: column; align-items: center; justify-content: center; gap: 4px; padding: 0; border: 0; border-radius: 7px; background: transparent; color: var(--muted); }
+  .mobile-nav button.active { background: var(--surface-muted); color: var(--ink); }
+  .mobile-nav span { max-width: 100%; overflow: hidden; font-size: 8px; text-overflow: ellipsis; white-space: nowrap; }
+  .offline-banner { top: 62px; }
+  main#main { min-height: calc(100vh - 124px); }
+  .page { padding: 28px 16px 38px; }
+  .page-header { min-height: 0; margin-bottom: 24px; }
+  .page-header h1 { font-size: 26px; }
+  .page-description { max-width: 310px; font-size: 11px; }
+  .page-actions .icon-label span, .page-actions .icon-label:not(:has(svg)) { display: none; }
+  .metric-grid { grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 8px; }
+  .metric-card { min-height: 106px; gap: 10px; padding: 15px; }
+  .metric-card strong { font-size: 17px; }
+  .metric-icon { width: 30px; height: 30px; }
+  .overview-grid { grid-template-columns: 1fr; gap: 10px; }
+  .profiles-layout { display: block; min-height: auto; }
+  .profile-master { height: 126px; border-right: 0; border-bottom: 1px solid var(--line); }
+  .profile-master-header { height: 54px; padding: 8px 14px; }
+  .profile-master-header .eyebrow { display: none; }
+  .profile-master-header h1 { font-size: 17px; }
+  .profile-master-list { display: flex; gap: 7px; overflow-x: auto; padding: 7px 12px; }
+  .profile-list-item { width: auto; min-width: 156px; min-height: 56px; flex: 0 0 auto; padding: 7px 9px; border-color: var(--line); background: var(--surface); }
+  .profile-list-item.active { border-color: #a9a69e; }
+  .profile-master-note { display: none; }
+  .inspector-header { height: 80px; padding: 0 16px; }
+  .avatar.large { width: 38px; height: 38px; }
+  .inspector-title h2 { font-size: 17px; }
+  .inspector-actions .icon-label span { display: none; }
+  .inspector-actions .button { width: 36px; padding: 0; }
+  .inspector-content { width: calc(100% - 32px); padding: 26px 0 40px; }
+  .settings-section { margin-bottom: 26px; }
+  .provider-card-grid { grid-template-columns: 1fr; }
+  .capability-row { display: grid; grid-template-columns: 34px minmax(0, 1fr) 16px; }
+  .capability-row .badge, .capability-route { display: none; }
+  .filter-bar { display: grid; grid-template-columns: repeat(3, 1fr); }
+  .search-field { min-width: 0; grid-column: 1 / -1; }
+  .filter-bar select { min-width: 0; width: 100%; padding-right: 20px; font-size: 10px; }
+  .job-row { display: grid; grid-template-columns: 8px minmax(0, 1fr) 14px; }
+  .job-row .mono-label, .job-row time { display: none; }
+  .system-grid { grid-template-columns: 1fr; }
+  .system-actions { grid-column: auto; }
+  .modal-backdrop { align-items: end; padding: 0; }
+  .modal, .modal.wide { width: 100%; max-height: calc(100vh - 24px); border-radius: 14px 14px 0 0; }
+  .modal-body { max-height: calc(100vh - 88px); }
+  .form-grid { grid-template-columns: 1fr; }
+  .setup-shell { padding: 22px 14px 38px; }
+  .setup-brand { margin-bottom: 16px; }
+  .setup-header { padding: 25px 21px 20px; }
+  .setup-header h1 { font-size: 25px; }
+  .setup-form { padding: 5px 21px 21px; }
+  .setup-row { grid-template-columns: 30px minmax(0, 1fr); gap: 11px; padding: 17px 0; }
+  .setup-icon { width: 29px; height: 29px; }
+  .setup-fields.form-grid { display: grid; grid-template-columns: 1fr; }
+  .toast-region { right: 12px; bottom: 78px; left: 12px; }
+  .toast { max-width: none; }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  *, *::before, *::after { scroll-behavior: auto !important; transition-duration: .01ms !important; animation-duration: .01ms !important; animation-iteration-count: 1 !important; }
+}
diff --git a/packages/cli/src/daemon/ui/svelte.config.js b/packages/cli/src/daemon/ui/svelte.config.js
new file mode 100644
index 0000000..b1c6ea4
--- /dev/null
+++ b/packages/cli/src/daemon/ui/svelte.config.js
@@ -0,0 +1 @@
+export default {}
diff --git a/packages/cli/src/daemon/ui/types.ts b/packages/cli/src/daemon/ui/types.ts
new file mode 100644
index 0000000..f1d9475
--- /dev/null
+++ b/packages/cli/src/daemon/ui/types.ts
@@ -0,0 +1,18 @@
+export type JsonRecord = Record<string, any>
+
+export type Language = 'en' | 'zh-CN'
+
+export type Section = 'overview' | 'profiles' | 'providers' | 'capabilities' | 'jobs' | 'system'
+
+export type DashboardState = {
+  language: Language
+  offline: boolean
+  section: Section
+  selectedProfile: string
+  snapshot: JsonRecord
+}
+
+export type SnapshotResult = {
+  changed: boolean
+  snapshot?: JsonRecord
+}
diff --git a/packages/cli/src/daemon/ui/views/CapabilitiesView.svelte b/packages/cli/src/daemon/ui/views/CapabilitiesView.svelte
new file mode 100644
index 0000000..88d4cfc
--- /dev/null
+++ b/packages/cli/src/daemon/ui/views/CapabilitiesView.svelte
@@ -0,0 +1,70 @@
+<script lang="ts">
+  import { ChevronRight, Layers3 } from '@lucide/svelte'
+  import Modal from '../components/Modal.svelte'
+  import PageHeader from '../components/PageHeader.svelte'
+  import { capabilityFamilyLabel, capabilityText } from '../localization.js'
+  import type { JsonRecord, Language } from '../types.js'
+
+  let { snapshot, selectedProfile, language, t, onselect }: {
+    snapshot: JsonRecord
+    selectedProfile: string
+    language: Language
+    t: (key: any) => string
+    onselect: (slug: string) => void
+  } = $props()
+
+  let selected = $state<JsonRecord | null>(null)
+  let profile = $derived(snapshot.profiles.find((entry: JsonRecord) => entry.slug === selectedProfile) ?? snapshot.profiles[0])
+  let groups = $derived(Object.entries(snapshot.capabilities.reduce((result: Record<string, JsonRecord[]>, capability: JsonRecord) => {
+    ;(result[capability.family] ??= []).push(capability)
+    return result
+  }, {})) as [string, JsonRecord[]][])
+
+  function providerSummary(capability: JsonRecord) {
+    if (!capability.providers?.length) return t('noRoute')
+    return capability.providers.map((route: JsonRecord) => {
+      const provider = snapshot.providers.find((entry: JsonRecord) => entry.id === route.provider)
+      const state = provider?.profiles?.find((entry: JsonRecord) => entry.profileId === profile?.slug)
+      return `${route.provider} · ${state?.runtimeEligibility ?? 'ineligible'}`
+    }).join(', ')
+  }
+</script>
+
+<section class="page" data-testid="capabilities-view">
+  <PageHeader title={t('capabilities')} description={t('capabilitiesLede')}>
+    {#snippet actions()}
+      <label class="inline-select"><span class="sr-only">{t('selectProfile')}</span><select value={profile?.slug} onchange={(event) => onselect(event.currentTarget.value)}>{#each snapshot.profiles as entry}<option value={entry.slug}>{entry.label}</option>{/each}</select></label>
+    {/snippet}
+  </PageHeader>
+
+  <div class="capability-groups">
+    {#each groups as [family, capabilities] (family)}
+      <section class="capability-group">
+        <header><h2>{capabilityFamilyLabel(language, family)}</h2><span>{capabilities.length}</span></header>
+        <div class="content-panel row-list">
+          {#each capabilities as capability (capability.id)}
+            {@const copy = capabilityText(language, capability)}
+            <button class="data-row capability-row" type="button" onclick={() => selected = capability}>
+              <span class="metric-icon"><Layers3 size={16} /></span>
+              <span class="data-row-main"><strong>{copy.title}</strong><small>{copy.description}</small></span>
+              <span class="badge neutral">{capability.stability}</span>
+              <span class="capability-route">{providerSummary(capability)}</span>
+              <ChevronRight size={15} />
+            </button>
+          {/each}
+        </div>
+      </section>
+    {/each}
+  </div>
+</section>
+
+{#if selected}
+  {@const copy = capabilityText(language, selected)}
+  <Modal title={copy.title} closeLabel={t('close')} onclose={() => selected = null} wide>
+    <div class="detail-stack">
+      <p>{copy.description}</p>
+      <span class="badge neutral">{selected.stability}</span>
+      <section><h3>{t('evidence')}</h3><pre>{JSON.stringify({ required: selected.requiredEvidence, providers: selected.providers }, null, 2)}</pre></section>
+    </div>
+  </Modal>
+{/if}
diff --git a/packages/cli/src/daemon/ui/views/JobsView.svelte b/packages/cli/src/daemon/ui/views/JobsView.svelte
new file mode 100644
index 0000000..8a0a40f
--- /dev/null
+++ b/packages/cli/src/daemon/ui/views/JobsView.svelte
@@ -0,0 +1,76 @@
+<script lang="ts">
+  import { ChevronRight, Clock3, Search, X } from '@lucide/svelte'
+  import Modal from '../components/Modal.svelte'
+  import PageHeader from '../components/PageHeader.svelte'
+  import { formatTime } from '../formatting.js'
+  import type { JsonRecord, Language } from '../types.js'
+
+  let { snapshot, language, t, busy, onget, onmutate }: {
+    snapshot: JsonRecord
+    language: Language
+    t: (key: any) => string
+    busy: boolean
+    onget: (path: string) => Promise<JsonRecord | null>
+    onmutate: (path: string, body?: unknown, method?: string) => Promise<unknown>
+  } = $props()
+
+  let status = $state('')
+  let provider = $state('')
+  let profile = $state('')
+  let search = $state('')
+  let detail = $state<JsonRecord | null>(null)
+  let filtered = $derived(snapshot.jobs.filter((job: JsonRecord) => {
+    const query = search.trim().toLowerCase()
+    return (!status || job.status === status)
+      && (!provider || job.provider === provider)
+      && (!profile || job.profileSlug === profile || job.profileId === profile)
+      && (!query || JSON.stringify([job.jobId, job.taskId, job.provider, job.profileSlug]).toLowerCase().includes(query))
+  }))
+
+  async function showDetail(jobId: string) {
+    detail = await onget(`/jobs/${encodeURIComponent(jobId)}`)
+  }
+
+  async function jobAction(action: 'cancel' | 'resume') {
+    if (!detail) return
+    await onmutate(`/jobs/${encodeURIComponent(detail.jobId)}/${action}`)
+    detail = null
+  }
+</script>
+
+<section class="page" data-testid="jobs-view">
+  <PageHeader title={t('jobs')} description={t('jobsLede')} />
+  <div class="filter-bar">
+    <label class="search-field"><Search size={16} /><input type="search" bind:value={search} placeholder={t('searchJobs')} data-testid="job-search" />{#if search}<button type="button" aria-label={t('close')} onclick={() => search = ''}><X size={14} /></button>{/if}</label>
+    <select bind:value={status} aria-label={t('allStatuses')} data-testid="job-status"><option value="">{t('allStatuses')}</option>{#each ['queued', 'claimed', 'running', 'waiting_for_user', 'succeeded', 'failed', 'canceled', 'timed_out'] as value}<option value={value}>{value}</option>{/each}</select>
+    <select bind:value={provider} aria-label={t('allProviders')}><option value="">{t('allProviders')}</option>{#each snapshot.providers as entry}<option value={entry.id}>{entry.label}</option>{/each}</select>
+    <select bind:value={profile} aria-label={t('allProfiles')}><option value="">{t('allProfiles')}</option>{#each snapshot.profiles as entry}<option value={entry.slug}>{entry.label}</option>{/each}</select>
+  </div>
+
+  <div class="content-panel jobs-list" data-testid="job-list">
+    {#each filtered as job (job.jobId)}
+      <button class="data-row job-row" type="button" onclick={() => showDetail(job.jobId)} data-testid={`job-${job.jobId}`}>
+        <span class={`job-state ${job.status}`}></span>
+        <span class="data-row-main"><strong>{job.taskId ?? job.jobId}</strong><small>{job.provider ?? '—'} · {job.profileSlug ?? '—'}</small></span>
+        <span class="mono-label">{job.status}</span>
+        <time>{formatTime(job.updatedAt, language)}</time>
+        <ChevronRight size={15} />
+      </button>
+    {:else}
+      <div class="empty-state"><Clock3 size={22} /><strong>{t('noResults')}</strong></div>
+    {/each}
+  </div>
+</section>
+
+{#if detail}
+  <Modal title={detail.taskId ?? detail.jobId} closeLabel={t('close')} onclose={() => detail = null} wide>
+    <div class="detail-stack" data-testid="job-detail">
+      <div class="detail-meta"><span class={`job-state ${detail.status}`}></span><strong>{detail.status}</strong><span>{detail.provider ?? '—'}</span><span>{detail.profileSlug ?? detail.profileId ?? '—'}</span></div>
+      <p class="muted">{t('created')}: {formatTime(detail.createdAt, language)}<br />{t('updated')}: {formatTime(detail.updatedAt, language)}</p>
+      {#if detail.status === 'waiting_for_user'}<button class="button primary" type="button" disabled={busy} onclick={() => jobAction('resume')}>{t('resume')}</button>{:else if ['queued', 'claimed', 'running'].includes(detail.status)}<button class="button danger" type="button" disabled={busy} onclick={() => jobAction('cancel')}>{t('cancel')}</button>{/if}
+      <section><h3>{t('result')}</h3><pre>{JSON.stringify(detail.result, null, 2)}</pre></section>
+      <section><h3>{t('error')}</h3><pre>{JSON.stringify(detail.error ?? detail.blocker, null, 2)}</pre></section>
+      <section><h3>{t('attempts')}</h3><pre>{JSON.stringify(detail.providerAttempts, null, 2)}</pre></section>
+    </div>
+  </Modal>
+{/if}
diff --git a/packages/cli/src/daemon/ui/views/OverviewView.svelte b/packages/cli/src/daemon/ui/views/OverviewView.svelte
new file mode 100644
index 0000000..d09be6e
--- /dev/null
+++ b/packages/cli/src/daemon/ui/views/OverviewView.svelte
@@ -0,0 +1,74 @@
+<script lang="ts">
+  import { ArrowUpRight, Bot, Clock3, ExternalLink, Monitor, UserRound } from '@lucide/svelte'
+  import PageHeader from '../components/PageHeader.svelte'
+  import type { JsonRecord } from '../types.js'
+
+  let { snapshot, selectedProfile, t, onnavigate, onmutate }: {
+    snapshot: JsonRecord
+    selectedProfile: string
+    t: (key: any) => string
+    onnavigate: (section: string) => void
+    onmutate: (path: string, body?: unknown, method?: string) => Promise<unknown>
+  } = $props()
+
+  let profile = $derived(snapshot.profiles.find((entry: JsonRecord) => entry.slug === selectedProfile) ?? snapshot.profiles[0])
+  let waiting = $derived(snapshot.jobs.filter((job: JsonRecord) => job.status === 'waiting_for_user'))
+  let running = $derived(snapshot.jobs.filter((job: JsonRecord) => ['queued', 'claimed', 'running'].includes(job.status)))
+  let readyProviders = $derived(snapshot.providers.filter((provider: JsonRecord) => provider.profiles?.some((entry: JsonRecord) => entry.profileId === profile?.slug && entry.enabled && entry.runtimeEligibility === 'eligible')))
+
+  function profileState(provider: JsonRecord) {
+    return provider.profiles?.find((entry: JsonRecord) => entry.profileId === profile?.slug)
+  }
+</script>
+
+<section class="page" data-testid="overview-view">
+  <PageHeader eyebrow="localhost" title={t('overview')} description={t('overviewLede')}>
+    {#snippet actions()}
+      {#if profile}
+        <button class="button primary icon-label" type="button" onclick={() => onmutate(`/profiles/${encodeURIComponent(profile.slug)}/open`)}>
+          <ExternalLink size={15} />{t('openBrowser')}
+        </button>
+      {/if}
+    {/snippet}
+  </PageHeader>
+
+  <div class="metric-grid">
+    <article class="metric-card"><span class="metric-icon"><Bot size={18} /></span><div><small>{t('daemon')}</small><strong>{snapshot.daemon.version}</strong><p>{Math.floor(snapshot.daemon.uptimeMs / 60000)} {t('uptimeUnit')}</p></div></article>
+    <article class="metric-card"><span class="metric-icon"><Monitor size={18} /></span><div><small>{t('runtime')}</small><strong>{snapshot.runtime.status}</strong><p>{snapshot.runtime.activeJobCount} {t('activeUnit')}</p></div></article>
+    <article class="metric-card"><span class="metric-icon"><UserRound size={18} /></span><div><small>{t('profiles')}</small><strong>{snapshot.profiles.length}</strong><p>{profile?.label ?? t('noProfiles')}</p></div></article>
+    <article class="metric-card"><span class="metric-icon"><Clock3 size={18} /></span><div><small>{t('waitingJobs')}</small><strong>{waiting.length}</strong><p>{running.length} {t('activeUnit')}</p></div></article>
+  </div>
+
+  <div class="overview-grid">
+    <section class="content-panel">
+      <header class="panel-title"><div><h2>{t('providerReadiness')}</h2><p>{profile?.label}</p></div><span class="badge neutral">{readyProviders.length}/{snapshot.providers.length}</span></header>
+      <div class="row-list">
+        {#each snapshot.providers as provider (provider.id)}
+          {@const state = profileState(provider)}
+          <button class="data-row" type="button" onclick={() => onnavigate('providers')}>
+            <span class="provider-glyph">{provider.label.slice(0, 1)}</span>
+            <span class="data-row-main"><strong>{provider.label}</strong><small>{state?.observation?.access ?? t('neverChecked')}</small></span>
+            <span class:ok={state?.runtimeEligibility === 'eligible'} class="status-dot"></span>
+            <ArrowUpRight size={15} />
+          </button>
+        {/each}
+      </div>
+    </section>
+
+    <section class="content-panel">
+      <header class="panel-title"><div><h2>{t('recentJobs')}</h2><p>{snapshot.jobs.length} {t('durableUnit')}</p></div><button class="text-button" type="button" onclick={() => onnavigate('jobs')}>{t('details')}</button></header>
+      <div class="row-list">
+        {#each snapshot.jobs.slice(0, 6) as job (job.jobId)}
+          <button class="data-row" type="button" onclick={() => onnavigate('jobs')}>
+            <span class={`job-state ${job.status}`}></span>
+            <span class="data-row-main"><strong>{job.taskId ?? job.jobId}</strong><small>{job.provider ?? '—'} · {job.profileSlug ?? '—'}</small></span>
+            <span class="mono-label">{job.status}</span>
+            <ArrowUpRight size={15} />
+          </button>
+        {:else}
+          <div class="empty-state"><Clock3 size={22} /><strong>{t('noJobs')}</strong><p>{t('noJobsBody')}</p></div>
+        {/each}
+      </div>
+    </section>
+  </div>
+</section>
diff --git a/packages/cli/src/daemon/ui/views/ProfilesView.svelte b/packages/cli/src/daemon/ui/views/ProfilesView.svelte
new file mode 100644
index 0000000..bce4097
--- /dev/null
+++ b/packages/cli/src/daemon/ui/views/ProfilesView.svelte
@@ -0,0 +1,187 @@
+<script lang="ts">
+  import { Check, ChevronRight, Ellipsis, ExternalLink, Plus, Settings2, Star, Trash2, UserRound } from '@lucide/svelte'
+  import Modal from '../components/Modal.svelte'
+  import ProfileForm from '../components/ProfileForm.svelte'
+  import type { JsonRecord } from '../types.js'
+
+  let {
+    snapshot,
+    selectedProfile,
+    t,
+    busy,
+    onselect,
+    onmutate,
+  }: {
+    snapshot: JsonRecord
+    selectedProfile: string
+    t: (key: any) => string
+    busy: boolean
+    onselect: (slug: string) => void
+    onmutate: (path: string, body?: unknown, method?: string) => Promise<unknown>
+  } = $props()
+
+  let editorOpen = $state(false)
+  let creating = $state(false)
+  let deleteOpen = $state(false)
+  let deleteConfirmation = $state('')
+  let menuOpen = $state(false)
+  let profile = $derived(snapshot.profiles.find((entry: JsonRecord) => entry.slug === selectedProfile) ?? snapshot.profiles[0])
+
+  function openEditor(create = false) {
+    creating = create
+    editorOpen = true
+    menuOpen = false
+  }
+
+  async function saveProfile(value: JsonRecord) {
+    const result = await onmutate(
+      creating ? '/profiles' : `/profiles/${encodeURIComponent(profile.slug)}`,
+      value,
+      creating ? 'POST' : 'PATCH',
+    ) as JsonRecord
+    editorOpen = false
+    if (creating && result?.slug) onselect(String(result.slug))
+  }
+
+  async function removeProfile() {
+    if (!profile || deleteConfirmation !== profile.slug) return
+    await onmutate(`/profiles/${encodeURIComponent(profile.slug)}`, undefined, 'DELETE')
+    deleteOpen = false
+    deleteConfirmation = ''
+  }
+
+  function stateFor(provider: JsonRecord) {
+    return provider.profiles?.find((entry: JsonRecord) => entry.profileId === profile?.slug)
+  }
+</script>
+
+<section class="profiles-layout" data-testid="profiles-view">
+  <aside class="profile-master" aria-label={t('profileList')}>
+    <header class="profile-master-header">
+      <div>
+        <p class="eyebrow">Tokenless</p>
+        <h1>{t('profiles')}</h1>
+      </div>
+      <button class="icon-button dark" type="button" aria-label={t('addProfile')} title={t('addProfile')} onclick={() => openEditor(true)} data-testid="add-profile">
+        <Plus size={17} />
+      </button>
+    </header>
+    <div class="profile-master-list">
+      {#each snapshot.profiles as entry (entry.slug)}
+        <button
+          class:active={entry.slug === profile?.slug}
+          class="profile-list-item"
+          type="button"
+          onclick={() => onselect(entry.slug)}
+          data-testid={`profile-item-${entry.slug}`}
+        >
+          <span class="avatar"><UserRound size={17} /></span>
+          <span class="profile-list-copy">
+            <strong>{entry.label}</strong>
+            <small>{entry.preferences?.roleLabel || entry.slug}</small>
+          </span>
+          {#if entry.isDefault}<Star class="default-star" size={13} fill="currentColor" />{:else}<ChevronRight size={15} />{/if}
+        </button>
+      {/each}
+    </div>
+    <p class="profile-master-note">{t('cleanProfileNote')}</p>
+  </aside>
+
+  {#if profile}
+    <div class="profile-inspector">
+      <header class="inspector-header">
+        <div class="inspector-title">
+          <span class="avatar large"><UserRound size={23} /></span>
+          <div>
+            <div class="title-line">
+              <h2>{profile.label}</h2>
+              {#if profile.isDefault}<span class="badge neutral">{t('default')}</span>{/if}
+            </div>
+            <p>{profile.slug}</p>
+          </div>
+        </div>
+        <div class="inspector-actions">
+          <button class="button secondary icon-label" type="button" onclick={() => onmutate(`/profiles/${encodeURIComponent(profile.slug)}/open`)} data-testid="open-profile">
+            <ExternalLink size={15} /> <span>{t('open')}</span>
+          </button>
+          <button class="icon-button" type="button" aria-label={t('openMenu')} title={t('openMenu')} onclick={() => menuOpen = !menuOpen} data-testid="profile-menu">
+            <Ellipsis size={18} />
+          </button>
+          {#if menuOpen}
+            <div class="popover-menu" data-testid="profile-menu-popover">
+              <button type="button" onclick={() => openEditor()}><Settings2 size={15} />{t('edit')}</button>
+              {#if !profile.isDefault}<button type="button" onclick={() => onmutate(`/profiles/${encodeURIComponent(profile.slug)}`, { setDefault: true }, 'PATCH')}><Star size={15} />{t('setDefault')}</button>{/if}
+              <button class="danger-text" type="button" onclick={() => { deleteOpen = true; menuOpen = false }}><Trash2 size={15} />{t('deleteProfile')}</button>
+            </div>
+          {/if}
+        </div>
+      </header>
+
+      <div class="inspector-content">
+        <section class="settings-section">
+          <div class="settings-section-title">
+            <h3>{t('profile')}</h3>
+            <button class="text-button" type="button" onclick={() => openEditor()}>{t('edit')}</button>
+          </div>
+          <div class="settings-list">
+            <div class="settings-row"><span>{t('label')}</span><strong>{profile.label}</strong></div>
+            <div class="settings-row"><span>{t('role')}</span><strong>{profile.preferences?.roleLabel || '—'}</strong></div>
+            <div class="settings-row"><span>{t('profileBrowser')}</span><strong>{profile.runtimeBinding?.browserId ?? snapshot.config.browser}</strong></div>
+            <div class="settings-row"><span>{t('visibility')}</span><strong>{profile.preferences?.browserVisibility ?? 'auto'}</strong></div>
+          </div>
+        </section>
+
+        <section class="settings-section">
+          <div class="settings-section-title">
+            <h3>{t('providersShort')}</h3>
+            <button class="text-button" type="button" onclick={() => openEditor()}>{t('edit')}</button>
+          </div>
+          <div class="provider-settings-list">
+            {#each snapshot.providers as provider (provider.id)}
+              {@const state = stateFor(provider)}
+              <div class:disabled={!state?.enabled} class="provider-setting-row">
+                <div class="provider-glyph">{provider.label.slice(0, 1)}</div>
+                <div>
+                  <strong>{provider.label}</strong>
+                  <small>{state?.observation?.account?.name ?? state?.observation?.access ?? t('neverChecked')}</small>
+                </div>
+                <span class:ok={state?.runtimeEligibility === 'eligible'} class="status-dot" aria-label={state?.runtimeEligibility ?? 'ineligible'}></span>
+                {#if state?.enabled}<Check size={15} class="row-check" />{/if}
+              </div>
+            {/each}
+          </div>
+        </section>
+
+        <section class="settings-section">
+          <div class="settings-section-title"><h3>{t('connection')}</h3></div>
+          <div class="settings-list">
+            <div class="settings-row"><span>{t('proxy')}</span><strong>{profile.preferences?.proxy?.server ?? t('none')}</strong></div>
+            <div class="settings-row"><span>{t('status')}</span><strong class="status-value"><span class="status-dot ok"></span>{profile.lifecycle ?? t('profileReady')}</strong></div>
+          </div>
+        </section>
+      </div>
+    </div>
+  {/if}
+</section>
+
+{#if editorOpen}
+  <Modal title={creating ? t('createProfile') : t('edit')} closeLabel={t('close')} onclose={() => editorOpen = false} wide>
+    <ProfileForm snapshot={snapshot} profile={creating ? undefined : profile} {t} {busy} oncancel={() => editorOpen = false} onsubmit={saveProfile} />
+  </Modal>
+{/if}
+
+{#if deleteOpen}
+  <Modal title={t('deleteProfile')} closeLabel={t('close')} onclose={() => deleteOpen = false}>
+    <div class="form-stack">
+      <p class="danger-note">{t('deleteWarning')}</p>
+      <label class="field">
+        <span>{t('confirmDelete')} <strong>{profile.slug}</strong></span>
+        <input bind:value={deleteConfirmation} autocomplete="off" data-testid="delete-confirmation" />
+      </label>
+      <div class="form-actions">
+        <button class="button secondary" type="button" onclick={() => deleteOpen = false}>{t('cancel')}</button>
+        <button class="button danger" type="button" disabled={busy || deleteConfirmation !== profile.slug} onclick={removeProfile} data-testid="delete-profile">{t('remove')}</button>
+      </div>
+    </div>
+  </Modal>
+{/if}
diff --git a/packages/cli/src/daemon/ui/views/ProvidersView.svelte b/packages/cli/src/daemon/ui/views/ProvidersView.svelte
new file mode 100644
index 0000000..8c6a5a2
--- /dev/null
+++ b/packages/cli/src/daemon/ui/views/ProvidersView.svelte
@@ -0,0 +1,81 @@
+<script lang="ts">
+  import { ExternalLink, RefreshCw, ScanSearch } from '@lucide/svelte'
+  import PageHeader from '../components/PageHeader.svelte'
+  import type { JsonRecord } from '../types.js'
+
+  let { snapshot, selectedProfile, t, busy, onselect, onmutate }: {
+    snapshot: JsonRecord
+    selectedProfile: string
+    t: (key: any) => string
+    busy: boolean
+    onselect: (slug: string) => void
+    onmutate: (path: string, body?: unknown, method?: string, announce?: boolean) => Promise<unknown>
+  } = $props()
+
+  let profile = $derived(snapshot.profiles.find((entry: JsonRecord) => entry.slug === selectedProfile) ?? snapshot.profiles[0])
+
+  function stateFor(provider: JsonRecord) {
+    return provider.profiles?.find((entry: JsonRecord) => entry.profileId === profile?.slug)
+  }
+
+  async function toggle(provider: JsonRecord, enabled: boolean) {
+    const next = new Set<string>(profile.preferences.enabledProviders)
+    if (enabled) next.add(provider.id)
+    else next.delete(provider.id)
+    await onmutate(`/profiles/${encodeURIComponent(profile.slug)}`, { enabledProviders: [...next] }, 'PATCH')
+  }
+
+  async function choose(provider: JsonRecord, kind: 'model' | 'effort', label: string) {
+    if (!label) return
+    await onmutate(`/profiles/${encodeURIComponent(profile.slug)}/providers/${encodeURIComponent(provider.id)}/selection`, { kind, label }, 'POST', false)
+  }
+
+  async function action(provider: JsonRecord, value: 'open' | 'readiness' | 'controls') {
+    await onmutate(`/profiles/${encodeURIComponent(profile.slug)}/providers/${encodeURIComponent(provider.id)}/actions/${value}`, undefined, 'POST', false)
+  }
+</script>
+
+<section class="page" data-testid="providers-view">
+  <PageHeader title={t('providers')} description={t('providersLede')}>
+    {#snippet actions()}
+      <label class="inline-select">
+        <span class="sr-only">{t('selectProfile')}</span>
+        <select value={profile?.slug} onchange={(event) => onselect(event.currentTarget.value)} data-testid="provider-profile">
+          {#each snapshot.profiles as entry}<option value={entry.slug}>{entry.label}</option>{/each}
+        </select>
+      </label>
+    {/snippet}
+  </PageHeader>
+
+  <div class="provider-card-grid">
+    {#each snapshot.providers as provider (provider.id)}
+      {@const state = stateFor(provider)}
+      <article class:disabled={!state?.enabled} class="provider-card">
+        <header>
+          <span class="provider-glyph large">{provider.label.slice(0, 1)}</span>
+          <div><h2>{provider.label}</h2><p>{provider.id}</p></div>
+          <label class="switch" title={state?.enabled ? t('enabled') : t('disabled')}>
+            <input type="checkbox" checked={state?.enabled === true} onchange={(event) => toggle(provider, event.currentTarget.checked)} data-testid={`provider-toggle-${provider.id}`} />
+            <span></span>
+          </label>
+        </header>
+        <div class="provider-account">
+          <span>{t('account')}</span>
+          <strong>{state?.observation?.account?.name ?? state?.observation?.access ?? t('neverChecked')}</strong>
+        </div>
+        {#if state?.controls?.model?.length}
+          <label class="field compact-field"><span>{t('model')}</span><select disabled={!state.enabled || busy} onchange={(event) => choose(provider, 'model', event.currentTarget.value)}>{#each state.controls.model as choice}<option value={choice.label} selected={choice.selected} disabled={!choice.enabled}>{choice.label}</option>{/each}</select></label>
+        {/if}
+        {#if state?.controls?.effort?.length}
+          <label class="field compact-field"><span>{t('effort')}</span><select disabled={!state.enabled || busy} onchange={(event) => choose(provider, 'effort', event.currentTarget.value)}>{#each state.controls.effort as choice}<option value={choice.label} selected={choice.selected} disabled={!choice.enabled}>{choice.label}</option>{/each}</select></label>
+        {/if}
+        <div class="provider-meta"><span class:ok={state?.runtimeEligibility === 'eligible'} class="status-dot"></span><span>{state?.runtimeEligibility ?? 'ineligible'}</span><span class="spacer"></span><span>{provider.stage}</span></div>
+        <footer>
+          <button class="icon-button" type="button" disabled={!state?.enabled || busy} aria-label={t('open')} title={t('open')} onclick={() => action(provider, 'open')}><ExternalLink size={16} /></button>
+          <button class="icon-button" type="button" disabled={!state?.enabled || busy} aria-label={t('checkNow')} title={t('checkNow')} onclick={() => action(provider, 'readiness')}><RefreshCw size={16} /></button>
+          <button class="icon-button" type="button" disabled={!state?.enabled || busy} aria-label={t('inspectControls')} title={t('inspectControls')} onclick={() => action(provider, 'controls')}><ScanSearch size={16} /></button>
+        </footer>
+      </article>
+    {/each}
+  </div>
+</section>
diff --git a/packages/cli/src/daemon/ui/views/SetupView.svelte b/packages/cli/src/daemon/ui/views/SetupView.svelte
new file mode 100644
index 0000000..7a1b2a2
--- /dev/null
+++ b/packages/cli/src/daemon/ui/views/SetupView.svelte
@@ -0,0 +1,138 @@
+<script lang="ts">
+  import { Check, ChevronRight, Globe2, Monitor, UserRound } from '@lucide/svelte'
+  import { untrack } from 'svelte'
+  import type { JsonRecord, Language } from '../types.js'
+
+  let {
+    snapshot,
+    language,
+    t,
+    busy,
+    onsetup,
+  }: {
+    snapshot: JsonRecord
+    language: Language
+    t: (key: any) => string
+    busy: boolean
+    onsetup: (config: JsonRecord, profile: JsonRecord) => Promise<void>
+  } = $props()
+
+  let selectedLanguage = $state<Language>(untrack(() => language))
+  let browser = $state(untrack(() => snapshot.config.browser ?? 'auto'))
+  let browserVisibility = $state(untrack(() => snapshot.config.browserVisibility ?? 'headed'))
+  let slug = $state('default')
+  let label = $state(untrack(() => language === 'zh-CN' ? '默认' : 'Default'))
+  let roleLabel = $state('')
+  let enabledProviders = $state<string[]>(untrack(() => Array.isArray(snapshot.config.providerWhitelist)
+    ? [...snapshot.config.providerWhitelist]
+    : snapshot.providers
+      .filter((provider: JsonRecord) => provider.stage !== 'disabled' && provider.id !== 'gemini')
+      .map((provider: JsonRecord) => provider.id)))
+
+  function toggleProvider(provider: string, checked: boolean) {
+    enabledProviders = checked
+      ? [...new Set([...enabledProviders, provider])]
+      : enabledProviders.filter((entry) => entry !== provider)
+  }
+
+  async function submit(event: SubmitEvent) {
+    event.preventDefault()
+    await onsetup(
+      { language: selectedLanguage, browser, browserVisibility },
+      { slug, label, roleLabel, enabledProviders, browserVisibility, setDefault: true },
+    )
+  }
+</script>
+
+<main class="setup-shell" data-testid="setup-view">
+  <div class="setup-brand">
+    <img src="/ui/mark.png" alt="" />
+    <span>Tokenless</span>
+  </div>
+  <section class="setup-card">
+    <header class="setup-header">
+      <p class="eyebrow">{t('setup')}</p>
+      <h1>{t('setupTitle')}</h1>
+      <p>{t('setupBody')}</p>
+    </header>
+
+    <form class="setup-form" onsubmit={submit}>
+      <div class="setup-row">
+        <div class="setup-icon"><Globe2 size={19} /></div>
+        <label class="field">
+          <span>{t('language')}</span>
+          <select bind:value={selectedLanguage} data-testid="setup-language">
+            <option value="en">English</option>
+            <option value="zh-CN">简体中文</option>
+          </select>
+        </label>
+      </div>
+
+      <div class="setup-row">
+        <div class="setup-icon"><Monitor size={19} /></div>
+        <div class="form-grid compact setup-fields">
+          <label class="field">
+            <span>{t('useBrowser')}</span>
+            <select bind:value={browser} data-testid="setup-browser">
+              {#each ['auto', 'chrome', 'brave', 'edge', 'arc', 'chromium', 'chrome-for-testing', 'managed-chromium', 'cloak'] as option}
+                <option value={option}>{option}</option>
+              {/each}
+            </select>
+          </label>
+          <label class="field">
+            <span>{t('visibility')}</span>
+            <select bind:value={browserVisibility} data-testid="setup-visibility">
+              <option value="auto">auto</option>
+              <option value="headed">headed</option>
+              <option value="headless">headless</option>
+            </select>
+          </label>
+        </div>
+      </div>
+
+      <div class="setup-row align-start">
+        <div class="setup-icon"><UserRound size={19} /></div>
+        <div class="setup-fields">
+          <div class="form-grid compact">
+            <label class="field">
+              <span>{t('slug')}</span>
+              <input bind:value={slug} required pattern={'[a-z0-9](?:[a-z0-9]|-){0,63}'} autocomplete="off" data-testid="setup-slug" />
+            </label>
+            <label class="field">
+              <span>{t('label')}</span>
+              <input bind:value={label} required maxlength="80" autocomplete="off" data-testid="setup-label" />
+            </label>
+          </div>
+          <label class="field">
+            <span>{t('role')} <small>{t('optional')}</small></span>
+            <input bind:value={roleLabel} maxlength="80" autocomplete="off" data-testid="setup-role" />
+          </label>
+          <fieldset class="fieldset setup-providers">
+            <legend>{t('chooseProviders')}</legend>
+            <div class="provider-pills">
+              {#each snapshot.providers as provider (provider.id)}
+                <label class:checked={enabledProviders.includes(provider.id)} class="provider-pill">
+                  <input
+                    type="checkbox"
+                    checked={enabledProviders.includes(provider.id)}
+                    onchange={(event) => toggleProvider(provider.id, event.currentTarget.checked)}
+                  />
+                  {#if enabledProviders.includes(provider.id)}<Check size={13} />{/if}
+                  <span>{provider.label}</span>
+                </label>
+              {/each}
+            </div>
+          </fieldset>
+          <p class="form-note">{t('setupProfileHelp')}</p>
+        </div>
+      </div>
+
+      <div class="setup-actions">
+        <span>localhost</span>
+        <button class="button primary" type="submit" disabled={busy || !enabledProviders.length} data-testid="finish-setup">
+          {t('finishSetup')} <ChevronRight size={16} />
+        </button>
+      </div>
+    </form>
+  </section>
+</main>
diff --git a/packages/cli/src/daemon/ui/views/SystemView.svelte b/packages/cli/src/daemon/ui/views/SystemView.svelte
new file mode 100644
index 0000000..cb6acaa
--- /dev/null
+++ b/packages/cli/src/daemon/ui/views/SystemView.svelte
@@ -0,0 +1,84 @@
+<script lang="ts">
+  import { Clipboard, Moon, PauseCircle, ShieldCheck } from '@lucide/svelte'
+  import { untrack } from 'svelte'
+  import PageHeader from '../components/PageHeader.svelte'
+  import { formatTime } from '../formatting.js'
+  import type { JsonRecord, Language } from '../types.js'
+
+  let { snapshot, language, t, busy, onmutate, ontoast }: {
+    snapshot: JsonRecord
+    language: Language
+    t: (key: any) => string
+    busy: boolean
+    onmutate: (path: string, body?: unknown, method?: string) => Promise<unknown>
+    ontoast: (message: string) => void
+  } = $props()
+
+  let selectedLanguage = $state(untrack(() => snapshot.config.language as Language))
+  let browser = $state(untrack(() => snapshot.config.browser))
+  let browserExecutablePath = $state('')
+  let browserVisibility = $state(untrack(() => snapshot.config.browserVisibility))
+
+  async function save(event: SubmitEvent) {
+    event.preventDefault()
+    const body: JsonRecord = { language: selectedLanguage, browser, browserVisibility }
+    if (browserExecutablePath.trim()) body.browserExecutablePath = browserExecutablePath.trim()
+    await onmutate('/config', body, 'PATCH')
+    browserExecutablePath = ''
+  }
+
+  async function copyDiagnostics() {
+    await navigator.clipboard.writeText(JSON.stringify(snapshot.diagnostics, null, 2))
+    ontoast(t('copied'))
+  }
+
+  function diagnosticMessage(item: JsonRecord) {
+    if (item.id === 'configuration') return snapshot.config.updatedAt ? t('configPersisted') : t('setupIncomplete')
+    if (item.id === 'browser-runtime') return item.state === 'ok' ? t('browserReady') : t('browserUnavailable')
+    if (item.id === 'profiles') return snapshot.profiles.length === 0 ? t('noManagedProfiles') : `${snapshot.profiles.length} ${t('profilesRegistered')}`
+    if (item.id === 'scheduler') return `${snapshot.runtime.activeJobCount} ${t('activeBrowserJobs')}`
+    return item.message
+  }
+</script>
+
+<section class="page" data-testid="system-view">
+  <PageHeader title={t('system')} description={t('systemLede')}>
+    {#snippet actions()}
+      <button class="button secondary icon-label" type="button" onclick={copyDiagnostics}><Clipboard size={15} />{t('copyDiagnostics')}</button>
+    {/snippet}
+  </PageHeader>
+
+  <form class="system-grid" onsubmit={save} data-testid="config-form">
+    <section class="settings-section system-card">
+      <div class="settings-section-title"><h2>{t('appearance')}</h2><Moon size={17} /></div>
+      <div class="form-stack">
+        <label class="field"><span>{t('language')}</span><select bind:value={selectedLanguage} data-testid="config-language"><option value="en">English</option><option value="zh-CN">简体中文</option></select><small>{t('languageHelp')}</small></label>
+      </div>
+    </section>
+    <section class="settings-section system-card">
+      <div class="settings-section-title"><h2>{t('runtime')}</h2><ShieldCheck size={17} /></div>
+      <div class="form-stack">
+        <label class="field"><span>{t('browserSelection')}</span><select bind:value={browser} data-testid="config-browser">{#each ['auto', 'chrome', 'brave', 'edge', 'arc', 'chromium', 'chrome-for-testing', 'managed-chromium', 'cloak'] as value}<option value={value}>{value}</option>{/each}</select></label>
+        <label class="field"><span>{t('browserExecutablePath')}</span><input bind:value={browserExecutablePath} autocomplete="off" placeholder={t('browserExecutablePathPlaceholder')} data-testid="config-browser-executable-path" /><small>{snapshot.config.browserExecutablePathConfigured ? t('browserExecutablePathConfigured') : t('browserExecutablePathHelp')}</small></label>
+        <label class="field"><span>{t('defaultVisibility')}</span><select bind:value={browserVisibility} data-testid="config-visibility"><option value="auto">auto</option><option value="headed">headed</option><option value="headless">headless</option></select></label>
+      </div>
+    </section>
+    <div class="system-actions">
+      <button class="button secondary icon-label" type="button" disabled={busy} onclick={() => onmutate('/runtime/quiesce')}><PauseCircle size={15} />{t('quiesce')}</button>
+      <button class="button primary" type="submit" disabled={busy} data-testid="config-save">{t('save')}</button>
+    </div>
+  </form>
+
+  <section class="diagnostics-section">
+    <header><div><h2>{t('diagnostics')}</h2><p>{formatTime(snapshot.generatedAt, language)}</p></div></header>
+    <div class="content-panel row-list">
+      {#each snapshot.diagnostics as item (item.id)}
+        <div class="data-row diagnostic-row">
+          <span class:ok={item.state === 'ok'} class:error={item.state === 'error'} class="status-dot"></span>
+          <span class="data-row-main"><strong>{item.id}</strong><small>{diagnosticMessage(item)}</small></span>
+          <span class="mono-label">{item.state}</span>
+        </div>
+      {/each}
+    </div>
+  </section>
+</section>
diff --git a/packages/cli/src/index.ts b/packages/cli/src/index.ts
index 92b6bf6..cb1eccf 100644
--- a/packages/cli/src/index.ts
+++ b/packages/cli/src/index.ts
@@ -1,38 +1,66 @@
 import { constants as fsConstants } from 'node:fs'
 import fs from 'node:fs/promises'
 import path from 'node:path'
+import type { TokenlessLanguage } from './localization.js'
 
 export {
   DEFAULT_DAEMON_URL,
-  MAX_NATIVE_MESSAGE_BYTES,
+  MAX_DAEMON_REQUEST_BYTES,
+  browserRuntimeStatus,
   cancelDaemonJob,
-  claimNextDaemonJob,
-  completeDaemonJob,
   createDaemonJob,
   daemonUrl,
+  drainDaemonReplay,
   getDaemonJob,
+  getProviderCapacity,
   listDaemonJobs,
+  markDaemonJobReported,
+  openBrowserRuntimeProfile,
+  openBrowserRuntimeProviderTabs,
+  openTokenlessDashboard,
+  quiesceBrowserRuntime,
   readDaemonToken,
+  resolveProviderConversation,
+  resolveProviderMapping,
   resumeDaemonJob,
+  shutdownDaemon,
   waitDaemonJobResult,
 } from './daemon-client.js'
 
 export type {
-  ClaimNextDaemonJobOptions,
   CancelDaemonJobOptions,
-  CompleteDaemonJobOptions,
   CreateDaemonJobOptions,
-  DaemonClaimedJob,
+  DrainDaemonReplayOptions,
+  DaemonReplaySummary,
   DaemonClientOptions,
   DaemonJob,
   GetDaemonJobOptions,
+  GetProviderCapacityOptions,
   ListDaemonJobsOptions,
+  MarkDaemonJobReportedOptions,
+  BrowserRuntimeStatus,
+  BrowserRuntimeOpenProfileOptions,
+  BrowserRuntimeOpenProfileResponse,
+  BrowserRuntimeOpenProviderTabsOptions,
+  BrowserRuntimeOpenProviderTabsResponse,
+  OpenDashboardOptions,
+  OpenDashboardResponse,
   ResumeDaemonJobOptions,
+  ResolveProviderMappingOptions,
+  ResolveProviderConversationOptions,
+  ShutdownDaemonOptions,
+  ShutdownDaemonResponse,
   WaitDaemonJobResultOptions,
 } from './daemon-client.js'
 
-export type { TokenlessConfig } from './job-store.js'
+export type { ManagedProfilePreferences, TokenlessConfig } from './job-store.js'
 export type { BrowserVisibility, EffectiveBrowserVisibility } from './browser-visibility.js'
+export type { BrowserConnectionMode } from './browser-connection-mode.js'
+
+export {
+  BROWSER_CONNECTION_MODES,
+  normalizeBrowserConnectionMode,
+} from './browser-connection-mode.js'
 
 export {
   BROWSER_VISIBILITIES,
@@ -43,62 +71,69 @@ export {
 export {
   configPath,
   deriveTaskId,
-  NATIVE_HOST_NAME,
   normalizeBrowserId,
-  nativeMessagingHostDir,
-  nativeMessagingHostDirs,
+  normalizeManagedProfileProxy,
   readTokenlessConfig,
-  TOKENLESS_CONFIG_PROTOCOL_VERSION,
+  TOKENLESS_CONFIG_SCHEMA_ID,
   tokenlessHome,
   writeTokenlessConfig,
+  hasConfiguredTokenlessLanguage,
 } from './job-store.js'
 
+export {
+  TOKENLESS_LANGUAGES,
+  detectSystemLanguage,
+  normalizeTokenlessLanguage,
+} from './localization.js'
+
+export type { TokenlessLanguage } from './localization.js'
+
+export {
+  BROWSER_SELECTIONS,
+  SYSTEM_BROWSER_IDS,
+  BrowserRuntimeManager,
+  allManagedBrowserCatalogEntries,
+  currentBrowserRuntimePlatform,
+  managedBrowserCatalogEntry,
+  normalizeBrowserSelection,
+} from './browser-runtime/index.js'
+
+export type {
+  BrowserCandidate,
+  BrowserLaunchPolicy,
+  BrowserRuntimeBinding,
+  BrowserRuntimeFamily,
+  BrowserRuntimeInspection,
+  BrowserRuntimePlatform,
+  BrowserSelection,
+  ResolvedBrowserRuntime,
+} from './browser-runtime/index.js'
+
 export {
   DAEMON_LOG_FILE,
   DAEMON_PID_FILE,
-  DAEMON_PROCESS_PROTOCOL,
-  DAEMON_PROCESS_PROOF_PROTOCOL,
-  DAEMON_PROTOCOL,
-  DAEMON_READY_PROOF_PROTOCOL,
-  EXTENSION_BRIDGE_FILE,
-  EXTENSION_BRIDGE_PROTOCOL,
-  NATIVE_BINARY_BUILD_INFO_PROTOCOL,
-  NATIVE_PROTOCOL,
-  bundledRustBinaryPath,
+  DAEMON_PROCESS_SCHEMA_ID,
+  MANAGED_PLAYWRIGHT_JOB_SCHEMA_ID,
+  MANAGED_PLAYWRIGHT_JOB_SCHEMA_ID_V3,
+  VISIBLE_ACTION_SCHEMA_ID,
+  VISIBLE_ACTION_SCHEMA_ID_V3,
   ensureDaemonReady,
-  inspectNativeHostManifests,
-  inspectRustBinaries,
+  ensureSetupDaemonRunnable,
   inspectManagedRuntime,
-  installNativeHost,
-  installRustRuntime,
-  installedRustBinaryPath,
   openProviderUrl,
   persistDaemonSnapshot,
   probeDaemonReady,
   providerWakeUrl,
-  readLiveBridgeMarker,
-  refreshInstalledRustBinaries,
-  refreshInstalledManagedRuntime,
   resolveChromiumBrowser,
-  resolveDaemonBinary,
-  waitForExtensionBridge,
-  windowsNativeHostRegistryCommands,
+  semanticVersionMajor,
+  stopDaemon,
 } from './runtime.js'
 
-export {
-  NATIVE_PLATFORM_PACKAGE_PROTOCOL,
-  NATIVE_PLATFORM_PACKAGES,
-  nativePlatformPackageName,
-  resolveNativePlatformPackage,
-} from './platform-package.js'
-
-export type { ResolveNativePlatformPackageOptions } from './platform-package.js'
-
 export {
   DEFAULT_MAX_VISIBLE_ATTACHMENT_BYTES,
   DEFAULT_VISIBLE_ATTACHMENT_ORPHAN_TTL_MS,
   VISIBLE_ATTACHMENT_DIRECTORY,
-  VISIBLE_ATTACHMENT_PROTOCOL,
+  VISIBLE_ATTACHMENT_SCHEMA_ID,
   cleanupOrphanedVisibleAttachmentBundles,
   createVisibleAttachmentId,
   removeStagedVisibleAttachmentBundle,
@@ -117,12 +152,11 @@ export type {
 } from './visible-attachments.js'
 
 export type {
-  BridgeMarker,
   ChromiumBrowser,
   DaemonReadyProbe,
   EnsureDaemonOptions,
-  InstallRustRuntimeOptions,
   ManagedRuntimeInspection,
+  StopDaemonResult,
 } from './runtime.js'
 
 const DEFAULT_MAX_FILE_BYTES = 24_000
@@ -135,6 +169,7 @@ type TokenlessPromptOptions = {
   turnContext?: unknown
   maxFileBytes?: number
   maxTotalBytes?: number
+  responseLanguage?: TokenlessLanguage
 }
 
 type CollectedFile = {
@@ -150,6 +185,7 @@ export async function buildTokenlessPrompt({
   turnContext,
   maxFileBytes = DEFAULT_MAX_FILE_BYTES,
   maxTotalBytes = DEFAULT_MAX_TOTAL_BYTES,
+  responseLanguage = 'en',
 }: TokenlessPromptOptions = {}) {
   if (typeof userPrompt !== 'string' || userPrompt.trim() === '') {
     throw new TypeError('userPrompt must be a nonempty string.')
@@ -164,6 +200,11 @@ export async function buildTokenlessPrompt({
     '## User Prompt',
     userPrompt.trim(),
     '',
+    '## Response Language',
+    responseLanguage === 'zh-CN'
+      ? 'Respond in Simplified Chinese unless the user prompt explicitly requests another language.'
+      : 'Respond in English unless the user prompt explicitly requests another language.',
+    '',
     '## Shareable Turn Context',
     sanitizeText(turnContext ?? 'No additional shareable turn context was provided.'),
     '',
diff --git a/packages/cli/src/job-store.ts b/packages/cli/src/job-store.ts
index 6fd28e6..89474ad 100644
--- a/packages/cli/src/job-store.ts
+++ b/packages/cli/src/job-store.ts
@@ -2,31 +2,47 @@ import fs from 'node:fs/promises'
 import os from 'node:os'
 import path from 'node:path'
 import { normalizeBrowserVisibility } from './browser-visibility.js'
+import { normalizeBrowserConnectionMode, type BrowserConnectionMode } from './browser-connection-mode.js'
+import { normalizeTokenlessLanguage, type TokenlessLanguage } from './localization.js'
+import { TOKENLESS_CONFIG_SCHEMA_ID } from './schema-ids.js'
+import { providerRegistry } from './providers/registry.js'
 import type { BrowserVisibility } from './browser-visibility.js'
+import {
+  BROWSER_SELECTIONS,
+  isSystemBrowserId,
+  normalizeBrowserSelection,
+  type BrowserSelection,
+} from './browser-runtime/types.js'
+import { withPrivateSqliteWriterLock } from './playwright/profiles/sqlite-lock.js'
 
-export const TOKENLESS_CONFIG_PROTOCOL_VERSION = 'tokenless.config.v1'
-export const NATIVE_HOST_NAME = 'dev.tokenless.native_host'
+export { TOKENLESS_CONFIG_SCHEMA_ID } from './schema-ids.js'
 
-const SUPPORTED_PROVIDER_IDS = Object.freeze(['chatgpt', 'claude', 'gemini', 'grok'])
-export const SUPPORTED_BROWSER_IDS = Object.freeze([
-  'chrome',
-  'chrome-for-testing',
-  'chromium',
-  'edge',
-  'arc',
-  'brave',
-  'profile',
-])
+export const SUPPORTED_BROWSER_IDS = BROWSER_SELECTIONS
 
 type JsonRecord = Record<string, unknown>
 
 export type TokenlessConfig = {
-  protocol: typeof TOKENLESS_CONFIG_PROTOCOL_VERSION
+  protocol: typeof TOKENLESS_CONFIG_SCHEMA_ID
   updatedAt: string | null
-  preferredProviders: string[]
-  browser: string | null
+  providerWhitelist: string[]
+  profilePreferences: Record<string, ManagedProfilePreferences>
+  browser: BrowserSelection
+  browserExecutablePath: string | null
+  browserConnectionMode: BrowserConnectionMode
   browserVisibility: BrowserVisibility
   daemonUrl: string | null
+  language: TokenlessLanguage
+}
+
+export type ManagedProfilePreferences = {
+  profileId: string
+  roleLabel: string
+  enabledProviders: string[]
+  browserVisibility: BrowserVisibility
+  proxy: {
+    server: string
+    bypass: string[]
+  } | null
 }
 
 export function tokenlessHome(explicitHome = process.env.TOKENLESS_HOME) {
@@ -42,21 +58,7 @@ export function snapshotsDir(homeDir = tokenlessHome()) {
 }
 
 export function normalizeBrowserId(browser: unknown) {
-  if (typeof browser !== 'string') return null
-  const normalized = browser.trim().toLowerCase().replace(/[_\s]+/g, '-')
-  if (!normalized) return null
-  const aliases: Record<string, string> = {
-    'google-chrome': 'chrome',
-    googlechrome: 'chrome',
-    'chrome-testing': 'chrome-for-testing',
-    'chrome-for-testing-legacy': 'chrome-for-testing',
-    'chromium-browser': 'chromium',
-    'microsoft-edge': 'edge',
-    msedge: 'edge',
-    'brave-browser': 'brave',
-  }
-  const browserId = aliases[normalized] ?? normalized
-  return SUPPORTED_BROWSER_IDS.includes(browserId) ? browserId : null
+  return normalizeBrowserSelection(browser)
 }
 
 export function deriveTaskId({
@@ -91,123 +93,275 @@ export async function readTokenlessConfig(homeDir = tokenlessHome()): Promise<To
       `Cannot read Tokenless config at ${file}: ${error instanceof Error ? error.message : String(error)}`
     )
   }
-  if (!isJsonRecord(payload) || payload.protocol !== TOKENLESS_CONFIG_PROTOCOL_VERSION) {
+  if (!isJsonRecord(payload) || payload.protocol !== TOKENLESS_CONFIG_SCHEMA_ID) {
+    throw configError('tokenless_config_invalid', `Invalid Tokenless config at ${file}.`)
+  }
+  if (payload.providerWhitelist !== undefined && !Array.isArray(payload.providerWhitelist)) {
     throw configError('tokenless_config_invalid', `Invalid Tokenless config at ${file}.`)
   }
   if (payload.preferredProviders !== undefined && !Array.isArray(payload.preferredProviders)) {
     throw configError('tokenless_config_invalid', `Invalid Tokenless config at ${file}.`)
   }
+  if (payload.profilePreferences !== undefined && !isJsonRecord(payload.profilePreferences)) {
+    throw configError('tokenless_config_invalid', `Invalid Tokenless config at ${file}.`)
+  }
   if (payload.browser !== undefined && payload.browser !== null && !normalizeBrowserId(payload.browser)) {
     throw configError('tokenless_config_invalid', `Invalid Tokenless config at ${file}.`)
   }
+  if (payload.browserExecutablePath !== undefined && !isConfigBrowserExecutablePath(payload.browserExecutablePath)) {
+    throw configError('tokenless_config_invalid', `Invalid Tokenless config at ${file}.`)
+  }
+  if (payload.browserConnectionMode !== undefined && !normalizeBrowserConnectionMode(payload.browserConnectionMode)) {
+    throw configError('tokenless_config_invalid', `Invalid Tokenless config at ${file}.`)
+  }
   if (payload.browserVisibility !== undefined && !normalizeBrowserVisibility(payload.browserVisibility)) {
     throw configError('tokenless_config_invalid', `Invalid Tokenless config at ${file}.`)
   }
   if (payload.daemonUrl !== undefined && payload.daemonUrl !== null && !normalizeDaemonUrl(payload.daemonUrl)) {
     throw configError('tokenless_config_invalid', `Invalid Tokenless config at ${file}.`)
   }
+  if (payload.language !== undefined && !normalizeTokenlessLanguage(payload.language)) {
+    throw configError('tokenless_config_invalid', `Invalid Tokenless config at ${file}.`)
+  }
+  const browser = normalizeBrowserId(payload.browser) ?? 'auto'
+  const browserExecutablePath = normalizeConfigBrowserExecutablePath(payload.browserExecutablePath)
+  validateConfigBrowserExecutablePathScope(homeDir, browser, browserExecutablePath, file)
   return {
-    protocol: TOKENLESS_CONFIG_PROTOCOL_VERSION,
+    protocol: TOKENLESS_CONFIG_SCHEMA_ID,
     updatedAt: typeof payload.updatedAt === 'string' ? payload.updatedAt : null,
-    preferredProviders: normalizeProviderList(payload.preferredProviders),
-    browser: normalizeBrowserId(payload.browser),
+    providerWhitelist: configuredProviderWhitelist(payload),
+    profilePreferences: normalizeProfilePreferences(payload.profilePreferences),
+    browser,
+    browserExecutablePath,
+    browserConnectionMode: normalizeBrowserConnectionMode(payload.browserConnectionMode) ?? 'playwright',
     browserVisibility: normalizeBrowserVisibility(payload.browserVisibility, 'auto') ?? 'auto',
     daemonUrl: normalizeDaemonUrl(payload.daemonUrl),
+    language: normalizeTokenlessLanguage(payload.language) ?? 'en',
   }
 }
 
 export async function writeTokenlessConfig({
   homeDir = tokenlessHome(),
-  preferredProviders,
+  providerWhitelist,
+  profilePreferences,
   browser,
+  browserExecutablePath,
+  browserConnectionMode,
   browserVisibility,
   daemonUrl,
+  language,
 }: {
   homeDir?: string
-  preferredProviders?: unknown
+  providerWhitelist?: unknown
+  profilePreferences?: unknown
   browser?: unknown
+  browserExecutablePath?: unknown
+  browserConnectionMode?: unknown
   browserVisibility?: unknown
   daemonUrl?: unknown
+  language?: unknown
 } = {}) {
   await fs.mkdir(homeDir, { recursive: true, mode: 0o700 })
   await fs.chmod(homeDir, 0o700).catch(() => undefined)
-  const current = await readTokenlessConfig(homeDir)
-  const config: TokenlessConfig = {
-    protocol: TOKENLESS_CONFIG_PROTOCOL_VERSION,
-    updatedAt: new Date().toISOString(),
-    preferredProviders: preferredProviders === undefined
-      ? current.preferredProviders
-      : normalizeProviderList(preferredProviders),
-    browser: browser === undefined ? current.browser : normalizeBrowserId(browser),
-    browserVisibility: browserVisibility === undefined
-      ? current.browserVisibility
-      : validateConfigBrowserVisibility(browserVisibility),
-    daemonUrl: daemonUrl === undefined ? current.daemonUrl : normalizeDaemonUrl(daemonUrl),
+  const canonicalHome = await fs.realpath(homeDir)
+  return await withPrivateSqliteWriterLock(path.join(canonicalHome, 'config.writer.sqlite'), async () => {
+    const current = await readTokenlessConfig(homeDir)
+    const nextBrowser = browser === undefined ? current.browser : validateConfigBrowser(browser)
+    const config: TokenlessConfig = {
+      protocol: TOKENLESS_CONFIG_SCHEMA_ID,
+      updatedAt: new Date().toISOString(),
+      providerWhitelist: providerWhitelist === undefined
+        ? current.providerWhitelist
+        : normalizeProviderList(providerWhitelist),
+      profilePreferences: profilePreferences === undefined
+        ? current.profilePreferences
+        : validateProfilePreferences(profilePreferences),
+      browser: nextBrowser,
+      browserExecutablePath: browserExecutablePath === undefined
+        ? (nextBrowser === current.browser ? current.browserExecutablePath : null)
+        : validateConfigBrowserExecutablePath(browserExecutablePath),
+      browserConnectionMode: browserConnectionMode === undefined
+        ? current.browserConnectionMode
+        : validateConfigBrowserConnectionMode(browserConnectionMode),
+      browserVisibility: browserVisibility === undefined
+        ? current.browserVisibility
+        : validateConfigBrowserVisibility(browserVisibility),
+      daemonUrl: daemonUrl === undefined ? current.daemonUrl : normalizeDaemonUrl(daemonUrl),
+      language: language === undefined ? current.language : validateConfigLanguage(language),
+    }
+    validateConfigBrowserExecutablePathScope(
+      homeDir,
+      config.browser,
+      config.browserExecutablePath,
+      configPath(homeDir),
+    )
+    await writeJsonAtomic(configPath(homeDir), config, 0o600)
+    return config
+  })
+}
+
+function emptyTokenlessConfig(): TokenlessConfig {
+  return {
+    protocol: TOKENLESS_CONFIG_SCHEMA_ID,
+    updatedAt: null,
+    providerWhitelist: defaultProviderWhitelist(),
+    profilePreferences: {},
+    browser: 'auto',
+    browserExecutablePath: null,
+    browserConnectionMode: 'playwright',
+    browserVisibility: 'auto',
+    daemonUrl: null,
+    language: 'en',
   }
-  await writeJsonAtomic(configPath(homeDir), config, 0o600)
-  return config
 }
 
-export function nativeMessagingHostDir(
-  browser: string,
-  home = os.homedir(),
-  platform: NodeJS.Platform = process.platform
-) {
-  return nativeMessagingHostDirs(browser, home, platform)[0] ?? null
+function defaultProviderWhitelist() {
+  return [...providerRegistry.descriptors()]
+    .filter((provider) => provider.stage !== 'disabled' && provider.id !== 'gemini')
+    .sort((left, right) => left.setupOrder - right.setupOrder)
+    .map((provider) => provider.id)
 }
 
-export function nativeMessagingHostDirs(
-  browser: string,
-  home = os.homedir(),
-  platform: NodeJS.Platform = process.platform
-) {
-  const browserId = normalizeBrowserId(browser)
-  if (!browserId) return []
-  if (browserId === 'profile') return [path.join(home, 'NativeMessagingHosts')]
-  if (platform === 'win32') return []
-
-  if (platform === 'darwin') {
-    const roots: Partial<Record<string, string[][]>> = {
-      chrome: [['Library', 'Application Support', 'Google', 'Chrome', 'NativeMessagingHosts']],
-      // Chrome for Testing 146+ uses ChromeForTesting. Older releases used
-      // Chrome's directory, so one install writes both compatibility manifests.
-      'chrome-for-testing': [
-        ['Library', 'Application Support', 'Google', 'ChromeForTesting', 'NativeMessagingHosts'],
-        ['Library', 'Application Support', 'Google', 'Chrome', 'NativeMessagingHosts'],
-      ],
-      chromium: [['Library', 'Application Support', 'Chromium', 'NativeMessagingHosts']],
-      edge: [['Library', 'Application Support', 'Microsoft Edge', 'NativeMessagingHosts']],
-      arc: [['Library', 'Application Support', 'Arc', 'User Data', 'NativeMessagingHosts']],
-      brave: [['Library', 'Application Support', 'BraveSoftware', 'Brave-Browser', 'NativeMessagingHosts']],
-    }
-    return (roots[browserId] ?? []).map((segments) => path.join(home, ...segments))
+function configuredProviderWhitelist(payload: JsonRecord) {
+  if (payload.providerWhitelist !== undefined) {
+    return normalizeProviderList(payload.providerWhitelist)
+  }
+  const legacyProviders = normalizeProviderList(payload.preferredProviders)
+  return legacyProviders.length > 0 ? legacyProviders : defaultProviderWhitelist()
+}
+
+function validateProfilePreferences(value: unknown) {
+  if (!isJsonRecord(value)) {
+    throw configError('tokenless_config_invalid', 'Invalid Tokenless profile preferences.')
   }
+  return normalizeProfilePreferences(value)
+}
 
-  if (platform === 'linux') {
-    const roots: Partial<Record<string, string[][]>> = {
-      chrome: [['.config', 'google-chrome', 'NativeMessagingHosts']],
-      'chrome-for-testing': [
-        ['.config', 'google-chrome-for-testing', 'NativeMessagingHosts'],
-        ['.config', 'google-chrome', 'NativeMessagingHosts'],
-      ],
-      chromium: [['.config', 'chromium', 'NativeMessagingHosts']],
-      edge: [['.config', 'microsoft-edge', 'NativeMessagingHosts']],
-      brave: [['.config', 'BraveSoftware', 'Brave-Browser', 'NativeMessagingHosts']],
+function normalizeProfilePreferences(value: unknown): Record<string, ManagedProfilePreferences> {
+  if (!isJsonRecord(value)) return {}
+  const preferences: Record<string, ManagedProfilePreferences> = {}
+  for (const [profileId, candidate] of Object.entries(value)) {
+    if (!/^[a-z0-9][a-z0-9-]{0,63}$/.test(profileId) || !isJsonRecord(candidate)) continue
+    const browserVisibility = normalizeBrowserVisibility(candidate.browserVisibility, 'auto')
+    if (!browserVisibility) continue
+    const proxy = normalizeManagedProfileProxy(candidate.proxy)
+    if (candidate.proxy !== undefined && candidate.proxy !== null && proxy === undefined) continue
+    preferences[profileId] = {
+      profileId,
+      roleLabel: normalizeRoleLabel(candidate.roleLabel),
+      enabledProviders: normalizeProviderList(candidate.enabledProviders),
+      browserVisibility,
+      proxy: proxy ?? null,
     }
-    return (roots[browserId] ?? []).map((segments) => path.join(home, ...segments))
   }
+  return preferences
+}
 
-  return []
+function normalizeRoleLabel(value: unknown) {
+  if (typeof value !== 'string') return ''
+  return value.trim().replace(/\s+/g, ' ').slice(0, 80)
 }
 
-function emptyTokenlessConfig(): TokenlessConfig {
-  return {
-    protocol: TOKENLESS_CONFIG_PROTOCOL_VERSION,
-    updatedAt: null,
-    preferredProviders: [],
-    browser: null,
-    browserVisibility: 'auto',
-    daemonUrl: null,
+export function normalizeManagedProfileProxy(value: unknown) {
+  if (value === undefined || value === null) return null
+  if (!isJsonRecord(value) || typeof value.server !== 'string') return undefined
+  let parsed: URL
+  try {
+    parsed = new URL(value.server.trim())
+  } catch {
+    return undefined
+  }
+  if (!['http:', 'https:', 'socks5:'].includes(parsed.protocol) || parsed.username || parsed.password) {
+    return undefined
+  }
+  const bypass = Array.isArray(value.bypass)
+    ? [...new Set(value.bypass.filter((entry): entry is string => typeof entry === 'string')
+      .map((entry) => entry.trim()).filter(Boolean))].slice(0, 100)
+    : []
+  return { server: parsed.toString(), bypass }
+}
+
+function validateConfigBrowser(value: unknown): BrowserSelection {
+  if (value === null || value === undefined || value === '') return 'auto'
+  const browser = normalizeBrowserId(value)
+  if (!browser) {
+    throw configError(
+      'tokenless_config_invalid',
+      'Invalid Tokenless browser; expected auto, a supported system browser, managed-chromium, or cloak.',
+    )
+  }
+  return browser
+}
+
+function isConfigBrowserExecutablePath(value: unknown) {
+  return value === null || (
+    typeof value === 'string' &&
+    value.trim().length > 0 &&
+    path.isAbsolute(value.trim())
+  )
+}
+
+function normalizeConfigBrowserExecutablePath(value: unknown) {
+  return typeof value === 'string' && value.trim() ? path.normalize(value.trim()) : null
+}
+
+function validateConfigBrowserExecutablePath(value: unknown) {
+  if (!isConfigBrowserExecutablePath(value)) {
+    throw configError(
+      'tokenless_config_invalid',
+      'Invalid Tokenless browser executable path; expected null or an absolute path.',
+    )
+  }
+  return normalizeConfigBrowserExecutablePath(value)
+}
+
+function validateConfigBrowserExecutablePathScope(
+  homeDir: string,
+  browser: BrowserSelection,
+  executablePath: string | null,
+  file: string,
+) {
+  if (!executablePath || isSystemBrowserId(browser)) return
+  const managedRuntimeRoot = path.join(path.resolve(homeDir), 'browser', 'runtimes')
+  if (
+    (browser === 'managed-chromium' || browser === 'cloak') &&
+    isPathInside(managedRuntimeRoot, executablePath)
+  ) return
+  throw configError(
+    'tokenless_config_invalid',
+    `Invalid Tokenless browser executable path scope at ${file}.`,
+  )
+}
+
+function isPathInside(root: string, candidate: string) {
+  const relative = path.relative(root, candidate)
+  return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative))
+}
+
+function validateConfigLanguage(value: unknown): TokenlessLanguage {
+  const language = normalizeTokenlessLanguage(value)
+  if (!language) throw configError('tokenless_config_invalid', 'Invalid Tokenless language; expected en or zh-CN.')
+  return language
+}
+
+function validateConfigBrowserConnectionMode(value: unknown): BrowserConnectionMode {
+  const connectionMode = normalizeBrowserConnectionMode(value)
+  if (!connectionMode) {
+    throw configError(
+      'tokenless_config_invalid',
+      'Invalid Tokenless browser connection mode; expected playwright or cdp.',
+    )
+  }
+  return connectionMode
+}
+
+export async function hasConfiguredTokenlessLanguage(homeDir = tokenlessHome()) {
+  try {
+    const payload = JSON.parse(await fs.readFile(configPath(homeDir), 'utf8')) as unknown
+    return isJsonRecord(payload) && Object.hasOwn(payload, 'language')
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return false
+    throw error
   }
 }
 
@@ -232,9 +386,10 @@ function normalizeProviderList(providers: unknown) {
   for (const provider of providers) {
     if (typeof provider !== 'string') continue
     const value = provider.trim().toLowerCase()
-    if (!SUPPORTED_PROVIDER_IDS.includes(value) || seen.has(value)) continue
-    seen.add(value)
-    normalized.push(value)
+    const resolved = providerRegistry.resolve(value)
+    if (!resolved || seen.has(resolved.id)) continue
+    seen.add(resolved.id)
+    normalized.push(resolved.id)
   }
   return normalized
 }
diff --git a/packages/cli/src/localization.ts b/packages/cli/src/localization.ts
new file mode 100644
index 0000000..a3e0ec3
--- /dev/null
+++ b/packages/cli/src/localization.ts
@@ -0,0 +1,228 @@
+export const TOKENLESS_LANGUAGES = Object.freeze(['en', 'zh-CN'] as const)
+
+export type TokenlessLanguage = (typeof TOKENLESS_LANGUAGES)[number]
+
+let activeLanguage: TokenlessLanguage = 'en'
+
+export function normalizeTokenlessLanguage(value: unknown): TokenlessLanguage | null {
+  if (typeof value !== 'string') return null
+  const normalized = value.trim().replace(/_/g, '-').toLowerCase()
+  if (normalized === 'en' || normalized.startsWith('en-')) return 'en'
+  if (normalized === 'zh' || normalized.startsWith('zh-')) return 'zh-CN'
+  return null
+}
+
+export function detectSystemLanguage({
+  env = process.env,
+  locale,
+}: {
+  env?: NodeJS.ProcessEnv
+  locale?: string | undefined
+} = {}): TokenlessLanguage {
+  const candidate = env.LC_ALL ||
+    env.LC_MESSAGES ||
+    env.LANG ||
+    locale ||
+    Intl.DateTimeFormat().resolvedOptions().locale
+  return normalizeTokenlessLanguage(candidate.split('.')[0]) ?? 'en'
+}
+
+export function setActiveLanguage(language: TokenlessLanguage) {
+  activeLanguage = language
+}
+
+export function activeTokenlessLanguage() {
+  return activeLanguage
+}
+
+const ZH_TEXT = new Map<string, string>([
+  ['Tokenless setup', 'Tokenless 设置'],
+  ['Tokenless upgrade', 'Tokenless 升级'],
+  ['Reading config', '读取配置'],
+  ['Checking npm version', '检查 npm 版本'],
+  ['Finding browsers', '查找浏览器'],
+  ['Finding Chromium profiles', '查找 Chromium profiles'],
+  ['Saving preferences', '保存偏好设置'],
+  ['Upserting global Tokenless agent skills', '更新全局 Tokenless agent skills'],
+  ['Reconciling current Tokenless daemon', '协调当前 Tokenless daemon'],
+  ['Updating global CLI', '更新全局 CLI'],
+  ['Verifying installed CLI', '验证已安装的 CLI'],
+  ['Refreshing agent skills', '刷新 agent skills'],
+  ['Updating local runtime', '更新本地 runtime'],
+  ['Running doctor', '运行 doctor'],
+  ['Provider sign-in', 'Provider 登录状态'],
+  ['Managed browser profile', '托管浏览器 profile'],
+  ['Choose a managed profile', '选择一个托管 profile'],
+  ['Create a new managed profile', '创建新的托管 profile'],
+  ['Profile name', 'Profile 名称'],
+  ['Choose a browser', '选择浏览器'],
+  ['Choose the browser Tokenless should use.', '选择 Tokenless 要使用的浏览器。'],
+  ['Anti-Detect mode', 'Anti-Detect 反爬模式'],
+  ['Chromium profile compatibility', 'Chromium profile 兼容性'],
+  ['Preparing automatic browser selection', '准备自动 browser selection'],
+  ['Preparing Tokenless-managed Chromium', '准备由 Tokenless 管理的 Chromium'],
+  ['Preparing CloakBrowser', '准备 CloakBrowser'],
+  ['At least one browser runtime selection is required.', '至少需要选择一个 browser runtime。'],
+  ['Browser runtime repair requires an explicit managed-chromium or cloak selection.', 'Browser runtime repair 需要显式选择 managed-chromium 或 cloak。'],
+  ['--repair-browser cannot be combined with --no-browser-download.', '--repair-browser 不能与 --no-browser-download 同时使用。'],
+  ['Browser must be auto, chrome, chrome-for-testing, chromium, edge, arc, brave, managed-chromium, or cloak.', 'Browser 必须是 auto、chrome、chrome-for-testing、chromium、edge、arc、brave、managed-chromium 或 cloak。'],
+  ['Invalid Tokenless browser; expected auto, a supported system browser, managed-chromium, or cloak.', '无效的 Tokenless browser；应为 auto、受支持的 system browser、managed-chromium 或 cloak。'],
+  ['Invalid Tokenless browser executable path; expected null or an absolute path.', '无效的 Tokenless browser executable path；应为 null 或绝对路径。'],
+  ['Browser executable path must be absolute.', 'Browser executable path 必须是绝对路径。'],
+  ['Keeps sign-ins between jobs inside a Tokenless-managed profile. With explicit consent, setup can copy a selected local profile as an opaque filesystem tree without reading its authentication values.', '登录状态会保留在 Tokenless 管理的 profile 中并跨 job 复用。获得明确同意后，setup 可以把选定的本机 profile 作为 opaque 文件树复制，不读取其中的认证值。'],
+  ['Use Anti-Detect mode? Tokenless will download and install the verified, platform-pinned CloakBrowser under TOKENLESS_HOME if needed.', '是否使用 Anti-Detect 模式？如有需要，Tokenless 将下载并把经过验证、按平台固定版本的 CloakBrowser 安装到 TOKENLESS_HOME 下。'],
+  ['Discovery checks only profile directory names and browser versions; it does not read authentication values.', '发现阶段只检查 profile 目录名和浏览器版本，不读取认证值。'],
+  ['No local Chromium profiles were found.', '未找到本机 Chromium profile。'],
+  ['CloakBrowser profile source', 'CloakBrowser profile 来源'],
+  ['Selecting an existing profile explicitly authorizes Tokenless to copy that entire profile folder into the managed profile as an opaque local filesystem tree. Tokenless does not inspect cookies, tokens, browser storage, or other authentication values.', '选择现有 profile 即明确授权 Tokenless 将整个 profile 文件夹作为 opaque 本地文件树复制到 managed profile。Tokenless 不会检查 cookies、tokens、browser storage 或其他认证值。'],
+  ['Choose how CloakBrowser should initialize its managed profile', '选择 CloakBrowser managed profile 的初始化方式'],
+  ['Start clean', '从 clean profile 开始'],
+  ['No version-compatible local Chromium profile was found; CloakBrowser will use a clean profile.', '未找到版本兼容的本地 Chromium profile；CloakBrowser 将使用 clean profile。'],
+  ['Non-interactive CloakBrowser setup requires explicit --anti-detect or --browser cloak confirmation.', '非交互 CloakBrowser setup 必须通过显式的 --anti-detect 或 --browser cloak 进行确认。'],
+  ['--browser-user-data-dir requires one explicit browser instead of all.', '--browser-user-data-dir 必须指定一个具体浏览器，不能使用 all。'],
+  ['Browser profile discovery supports all, Chrome, Brave, Edge, Arc, Chromium, or Chrome for Testing.', 'Browser profile discovery 支持 all、Chrome、Brave、Edge、Arc、Chromium 或 Chrome for Testing。'],
+  ['Checks visible sign-in state without submitting a prompt.', '检查可见的登录状态，不会提交 prompt。'],
+  ['Setup selection must be one of the displayed numbers.', '设置选项必须是界面显示的编号之一。'],
+  ['Usage', '用法'],
+  ['Advanced Usage', '高级用法'],
+  ['Canonical commands for everyday workflows.', '日常工作流的常用命令。'],
+  ['Less common commands for detailed control and maintenance.', '用于精细控制和维护的进阶命令。'],
+  ['Run', '运行'],
+  ['Setup', '设置'],
+  ['Profile', 'Profile'],
+  ['Provider', 'Provider'],
+  ['Other', '其他'],
+  ['Send work through a visible AI provider.', '通过可见的 AI provider 执行任务。'],
+  ['Get Tokenless ready for first use.', '完成 Tokenless 的首次使用设置。'],
+  ['Manage browser profiles and their sign-in sessions.', '管理浏览器 profile 及其登录 session。'],
+  ['Manage AI providers and their visible controls.', '管理 AI provider 及其可见控件。'],
+  ['Use miscellaneous maintenance and help commands.', '使用其他维护和帮助命令。'],
+  ['Customize, inspect, resume, or cancel jobs.', '自定义、检查、恢复或取消 job。'],
+  ['Automate browser runtime and clean-profile setup.', '自动设置 browser runtime 与 clean profile。'],
+  ['Discover metadata or manage clean browser profiles.', '发现 browser 元数据或管理 clean profile。'],
+  ['Use low-level actions and provider-specific controls.', '使用底层 action 和 provider 专属控件。'],
+  ['Inspect or update persistent Tokenless configuration.', '检查或更新持久化的 Tokenless 配置。'],
+  ['Short options:', '短选项：'],
+  ['Select a managed browser profile.', '选择托管浏览器 profile。'],
+  ['Select an AI provider.', '选择 AI provider。'],
+  ['Command reference:', '命令参考：'],
+  ['Usage:', '用法：'],
+  ['Common options:', '通用选项：'],
+  ['Options:', '选项：'],
+  ['Valid commands:', '可用命令：'],
+  ['error:', '错误：'],
+  ['(none)', '（无）'],
+  ['Tokenless CLI failed.', 'Tokenless CLI 执行失败。'],
+  ['Invalid Tokenless language; expected en or zh-CN.', '无效的 Tokenless language；应为 en 或 zh-CN。'],
+  ['Proxy configuration requires --profile <slug>.', 'Proxy 配置必须提供 --profile <slug>。'],
+  ['--profile can scope only provider membership, browser visibility, and proxy settings.', '--profile 只能限定 provider membership、browser visibility 和 proxy 设置。'],
+  ['--clear-proxy cannot be combined with --proxy-server or --proxy-bypass.', '--clear-proxy 不能与 --proxy-server 或 --proxy-bypass 同时使用。'],
+  ['--browser-executable-path cannot be combined with --clear-browser-executable-path.', '--browser-executable-path 不能与 --clear-browser-executable-path 同时使用。'],
+  ['--browser-executable-path requires an explicit system browser such as chrome or brave.', '--browser-executable-path 必须搭配明确的 system browser，例如 chrome 或 brave。'],
+  ['--browser-executable-path must be an absolute path.', '--browser-executable-path 必须是绝对路径。'],
+  ['--proxy-bypass requires an existing proxy or --proxy-server.', '--proxy-bypass 需要已有 proxy 或同时提供 --proxy-server。'],
+  ['Proxy must use HTTP, HTTPS, or SOCKS5 without embedded credentials.', 'Proxy 必须使用 HTTP、HTTPS 或 SOCKS5，且不能嵌入凭据。'],
+  ['Your help is needed: complete provider sign-in or verification in the visible browser. Tokenless will preserve this job and continue afterward.', '需要你的协助：请在可见浏览器中完成 provider 登录或验证。Tokenless 会保留当前 job，完成后继续。'],
+  ['Your help is needed, but no browser window is open. Resume this same job in headed mode; do not create a replacement job.', '需要你的协助，但当前没有打开浏览器窗口。请以 headed mode 恢复同一个 job，不要创建替代 job。'],
+  ['After completing sign-in or verification, query this same job or task; Tokenless will continue from its saved checkpoint.', '完成登录或验证后，请查询同一个 job 或 task；Tokenless 会从已保存的 checkpoint 继续。'],
+  ['The managed Chromium browser did not exit after shutdown.', '托管 Chromium browser 在关闭后仍未退出。'],
+  ['Too many managed browser profiles are active; existing profile browsers remain open.', '当前 active 的托管 browser profiles 过多；已有 profile browsers 会保持打开。'],
+])
+
+export function localizeText(value: string, language = activeLanguage): string {
+  if (language === 'en') return value
+  const direct = ZH_TEXT.get(value)
+  if (direct) return direct
+
+  return value
+    .replace(/^Unknown Tokenless command: (.+)\.$/, '未知的 Tokenless 命令：$1。')
+    .replace(/^Unknown Tokenless argument: (.+)$/, '未知的 Tokenless 参数：$1')
+    .replace(/^(tokenless(?: [\w-]+)*) does not accept options?: (.+)\.$/, '$1 不接受选项：$2。')
+    .replace(/^(\S+) requires a value\.$/, '$1 需要一个值。')
+    .replace(/^(\S+) is required\.$/, '必须提供 $1。')
+    .replace(/^Provider must be one of: (.+)\.$/, 'Provider 必须是以下值之一：$1。')
+    .replace(/^Provider capacity for (.+) \/ (.+): (.+)\.$/, 'Provider $1 / profile $2 的容量：$3。')
+    .replace(/^Browser must be one of: (.+)\.$/, 'Browser 必须是以下值之一：$1。')
+    .replace(/^Browser must be auto, a supported system browser, managed-chromium, or cloak\.$/, 'Browser 必须是 auto、受支持的 system browser、managed-chromium 或 cloak。')
+    .replace(/^Automatic — (.+)$/, '自动 — $1')
+    .replace(/^Enable (.+) for this profile\?$/, '为此 profile 启用 $1？')
+    .replace(/^CloakBrowser project: (.+)$/, 'CloakBrowser 项目：$1')
+    .replace(/^Supported CloakBrowser on this platform: artifact (.+) \(Chromium (.+)\)\.$/, '当前平台支持的 CloakBrowser：artifact $1（Chromium $2）。')
+    .replace(/^Copy (.+) profile (.+) — version (.+) — (.+)$/, '复制 $1 profile $2 — 版本 $3 — $4')
+    .replace(/^(.+) profile (.+) at (.+): version (.+); version-aligned \(eligible for import\)\.$/, '$1 profile $2（$3）：版本 $4；版本匹配（可导入）。')
+    .replace(/^(.+) profile (.+) at (.+): version (.+); not version-aligned\.$/, '$1 profile $2（$3）：版本 $4；版本不匹配。')
+    .replace(/^(.+) profile (.+) at (.+): version (.+); version unknown\.$/, '$1 profile $2（$3）：版本 $4；版本未知。')
+    .replace(/^Opening (.+) review tab$/, '打开 $1 审核 tab')
+    .replace(/^Opened (\d+) provider review tab\(s\)\.$/, '已打开 $1 个 provider 审核 tab。')
+    .replace(/^Could not open (\d+) provider review tab\(s\)\.$/, '无法打开 $1 个 provider 审核 tab。')
+    .replace(/^Could not keep the provider review browser open\.$/, '无法让 provider 审核浏览器保持打开。')
+    .replace(/^Setup could not open (\d+) provider review tab\(s\) in profile (.+)\.$/, '设置无法在 profile $2 中打开 $1 个 provider 审核 tab。')
+    .replace(/^Setup could not keep provider review tabs open in profile (.+)\.$/, '设置无法让 profile $1 的 provider 审核 tab 保持打开。')
+    .replace(/^Opened the Tokenless dashboard in managed profile '(.+)'.$/, '已在托管 profile「$1」中打开 Tokenless 控制台。')
+    .replace(/^Dashboard ready for managed profile '(.+)': (.+)$/, '托管 profile「$1」的控制台已就绪：$2')
+    .replace(/ — installed system browser$/, ' — 已安装的 system browser')
+    .replace(/ — official download required$/, ' — 需要从官方来源下载')
+    .replace(/ — download required$/, ' — 需要下载')
+    .replace(/ — cached$/, ' — 已缓存')
+    .replace(/^(.+) (\S+): download\.$/, '$1 $2：下载。')
+    .replace(/^(.+) (\S+): verify\.$/, '$1 $2：校验。')
+    .replace(/^(.+) (\S+): extract\.$/, '$1 $2：解包。')
+    .replace(/^(.+) (\S+): version\.$/, '$1 $2：检查版本。')
+    .replace(/^(.+) (\S+): smoke-launch\.$/, '$1 $2：执行 smoke launch。')
+    .replace(/^(.+) (\S+): install\.$/, '$1 $2：安装。')
+    .replace(/^(.+) (\S+) is not installed\. Run tokenless setup with browser downloads enabled\.$/, '$1 $2 尚未安装。请启用 browser download 后重新运行 tokenless setup。')
+    .replace(/^Browser executable for '(.+)' was not found\. Set it with tokenless config --browser (.+) --browser-executable-path "\/absolute\/path\/to\/browser" --json, or open tokenless dashboard and update System > Browser executable path\.$/, "找不到 '$1' 的浏览器 executable。请运行 tokenless config --browser $2 --browser-executable-path \"/浏览器的绝对路径\" --json，或打开 tokenless dashboard，在 System > Browser executable path 中设置。")
+    .replace(/^Managed profile '(.+)' cannot use (.+); create a clean profile for that browser runtime\.$/, "Managed profile '$1' 不能使用 $2；请为该 browser runtime 创建 clean profile。")
+    .replace(/^Unsupported Tokenless browser platform: (.+)\. Supported platforms are darwin-arm64 and win32-x64\.$/, 'Tokenless 不支持 browser platform：$1。支持 darwin-arm64 和 win32-x64。')
+    .replace(/^Managed profile '(.+)' predates browser runtime binding\. Rerun tokenless setup and explicitly select a compatible browser\.$/, "Managed profile '$1' 尚未记录 browser runtime binding。请重新运行 tokenless setup 并显式选择兼容的 browser。")
+    .replace(/^Managed profile '(.+)' is bound to (.+), but Tokenless resolved (.+)\.$/, "Managed profile '$1' 绑定到 $2，但 Tokenless 解析出 $3。")
+    .replace(/^Managed profile '(.+)' was created with browser (.+); refusing to open it with older browser (.+)\.$/, "Managed profile '$1' 由 browser $2 创建；拒绝使用更旧的 browser $3 打开。")
+    .replace(/^Managed profile '(.+)' is already bound to (.+); create a clean profile for (.+)\.$/, "Managed profile '$1' 已绑定到 $2；请为 $3 创建 clean profile。")
+    .replace(/^Browser profile '(.+)' uses Chromium (.+); this platform's supported CloakBrowser requires (.+)\.$/, "Browser profile '$1' 使用 Chromium $2；当前平台支持的 CloakBrowser 要求 $3。")
+    .replace(/^Browser profile '(.+)' uses Chromium (.+); installed CloakBrowser requires (.+)\.$/, "Browser profile '$1' 使用 Chromium $2；已安装的 CloakBrowser 要求 $3。")
+    .replace(/^(.+) download checksum mismatch; refusing to extract the artifact\.$/, '$1 下载文件的 checksum 不匹配；已拒绝解包。')
+    .replace(/^(.+) reported browser (.+); expected (.+)\.$/, '$1 报告 browser $2；预期为 $3。')
+    .replace(/^(.+) cache reported browser (.+); expected (.+)\.$/, '$1 cache 报告 browser $2；预期为 $3。')
+    .replace(/^Cannot install (.+) (.+)\.$/, '无法安装 $1 $2。')
+    .replace(/^Browser download failed with HTTP (.+)\.$/, 'Browser 下载失败，HTTP 状态为 $1。')
+    .replace(/^Browser download failed\.$/, 'Browser 下载失败。')
+    .replace(/^Browser download was aborted\.$/, 'Browser 下载已中止。')
+    .replace(/^Browser archive is empty\.$/, 'Browser archive 为空。')
+    .replace(/^Browser archive contains an unsafe path: (.+)$/, 'Browser archive 包含不安全路径：$1')
+    .replace(/^Browser smoke launch timed out\.$/, 'Browser smoke launch 超时。')
+    .replace(/^Browser smoke launch failed\.$/, 'Browser smoke launch 失败。')
+    .replace(/^Using (.+)\.$/, '正在使用 $1。')
+    .replace(/^Checking providers: (.+)\.$/, '正在检查 provider：$1。')
+    .replace(/^Checking (.+) sign-in$/, '检查 $1 登录状态')
+    .replace(/^Choose the (.+) profile to import$/, '选择要导入的 $1 profile')
+    .replace(/^Choose \[(.+)\]: $/, '请选择 [$1]：')
+    .replace(/^(.+) is authenticated \((.+)\)\.$/, '$1 已通过身份验证（$2）。')
+    .replace(/^(.+) sign-in status: (.+); access: (.+)\.$/, '$1 登录状态：$2；访问级别：$3。')
+    .replace(/^(.+) readiness failed: (.+)\.$/, '$1 就绪检查失败：$2。')
+    .replace(/^Opened managed profile '(.+)' in a headed browser\.$/, "已在 headed 浏览器中打开托管 profile '$1'。")
+    .replace(/^Cleared managed profile '(.+)'\.$/, "已清除托管 profile '$1'。")
+    .replace(/^Cleared (\d+) managed profiles\.$/, '已清除 $1 个托管 profile。')
+    .replace(/^No managed profiles to clear\.$/, '没有可清除的托管 profile。')
+    .replace(/^Could not check npm latest tokenless version: (.+)\.$/, '无法检查 npm 上最新的 tokenless 版本：$1。')
+    .replace(/^tokenless (.+) is available on npm; local CLI is (.+)\.$/, 'npm 上已有 tokenless $1；本地 CLI 为 $2。')
+    .replace(/^tokenless (.+) is up to date with npm\.$/, 'tokenless $1 已与 npm 最新版本一致。')
+    .replace(/^Setting managed profile (.+) as default$/, '正在将托管 profile $1 设为默认值')
+    .replace(/^Import an existing (.+) profile into Tokenless\?$/, '是否将现有的 $1 profile 导入 Tokenless？')
+    .replace(/^Creating managed profile (.+) for import$/, '正在创建用于导入的托管 profile $1')
+    .replace(/^Creating clean managed profile (.+)$/, '正在创建干净的托管 profile $1')
+    .replace(/^Importing (.+) into managed profile (.+)$/, '正在将 $1 导入托管 profile $2')
+    .replace(/ — imported$/, ' — 已导入')
+    .replace(/ — clean$/, ' — 干净')
+    .replace(/ — default$/, ' — 默认')
+    .replace(/^Setup found technical failures for (\d+) provider\(s\) in profile (.+)\.$/, '设置在 profile $2 中发现 $1 个 provider 存在技术故障。')
+    .replace(/^Setup checked provider sign-in status once for profile (.+)\.$/, '设置已为 profile $1 检查一次 provider 登录状态。')
+    .replace(/^Tokenless setup checked (.+) once in profile (.+)\. Provider summary: (.+)\. Counts: authenticated (\d+), unauthenticated (\d+), unknown (\d+), failed (\d+)\.$/, 'Tokenless 设置已在 profile $2 中检查一次 $1。Provider 汇总：$3。数量：authenticated $4、unauthenticated $5、unknown $6、failed $7。')
+    .replace(/^CLI: tokenless (.+); npm latest check unavailable \((.+), non-blocking\)\.$/, 'CLI：tokenless $1；无法检查 npm 最新版本（$2，不阻塞）。')
+    .replace(/^CLI: tokenless (.+); npm latest (.+) is available\.$/, 'CLI：tokenless $1；npm 上已有最新版本 $2。')
+    .replace(/^CLI: tokenless (.+); npm latest (.+) is up to date\.$/, 'CLI：tokenless $1；已是 npm 最新版本 $2。')
+    .replace(/^Daemon: ready on tokenless (.+) \(exact package version required\)\.$/, 'Daemon：已就绪，tokenless $1（要求 package 版本完全一致）。')
+    .replace(/^Tokenless (.+) is up to date\. Skills and local runtime are current; doctor is healthy\.$/, 'Tokenless $1 已是最新版本。Skills 和本地 runtime 均为最新；doctor 状态健康。')
+    .replace(/^Tokenless upgraded from (.+) to (.+)\. Skills and local runtime are current; doctor is healthy\.$/, 'Tokenless 已从 $1 升级到 $2。Skills 和本地 runtime 均为最新；doctor 状态健康。')
+    .replace(/^Tokenless upgrade did not complete\. Rerun tokenless upgrade for a full diagnostic\.$/, 'Tokenless 升级未完成。请重新运行 tokenless upgrade 获取完整诊断。')
+    .replace(/^Tokenless upgrade stopped at (.+)\. Resolve that failure, then rerun tokenless upgrade\.$/, 'Tokenless 升级在 $1 停止。解决该故障后，请重新运行 tokenless upgrade。')
+}
diff --git a/packages/cli/src/maintenance.ts b/packages/cli/src/maintenance.ts
new file mode 100644
index 0000000..cf82f1c
--- /dev/null
+++ b/packages/cli/src/maintenance.ts
@@ -0,0 +1,67 @@
+import { tokenlessHome } from './job-store.js'
+import { ensureSetupDaemonRunnable } from './runtime.js'
+import { installTokenlessSkills } from './setup-workflow.js'
+import { tokenlessPackageVersion } from './platform-package.js'
+
+export type TokenlessMaintenancePhase = 'skills' | 'daemon'
+
+export type TokenlessMaintenanceStepRunner = <T>(
+  phase: TokenlessMaintenancePhase,
+  label: string,
+  task: () => Promise<T>,
+) => Promise<T>
+
+export type ReconcileTokenlessMaintenanceOptions = {
+  homeDir?: string | undefined
+  daemonUrl?: string | undefined
+  daemonStartTimeoutMs?: number | undefined
+  skillHome?: string | undefined
+  runStep?: TokenlessMaintenanceStepRunner | undefined
+}
+
+export async function reconcileTokenlessMaintenance({
+  homeDir = tokenlessHome(),
+  daemonUrl,
+  daemonStartTimeoutMs,
+  skillHome = process.env.TOKENLESS_SETUP_SKILL_HOME,
+  runStep = runMaintenanceStep,
+}: ReconcileTokenlessMaintenanceOptions = {}) {
+  const skillInstall = await runStep(
+    'skills',
+    'Upserting global Tokenless agent skills',
+    () => installTokenlessSkills({
+      ...(skillHome ? { home: skillHome } : {}),
+    }),
+  )
+  const daemon = await runStep(
+    'daemon',
+    'Reconciling current Tokenless daemon',
+    () => ensureSetupDaemonRunnable({
+      homeDir,
+      daemonUrl,
+      ...(daemonStartTimeoutMs === undefined ? {} : { timeoutMs: daemonStartTimeoutMs }),
+    }),
+  )
+
+  return {
+    ok: true,
+    version: tokenlessPackageVersion(),
+    skills: {
+      ok: true,
+      source: skillInstall.check.source,
+      installed: true,
+      upserted: true,
+      checked: true,
+      manifests: Object.values(skillInstall.check.skills).map((skill) => skill.manifest),
+    },
+    daemon,
+  }
+}
+
+async function runMaintenanceStep<T>(
+  _phase: TokenlessMaintenancePhase,
+  _label: string,
+  task: () => Promise<T>,
+) {
+  return await task()
+}
diff --git a/packages/cli/src/npm-registry.ts b/packages/cli/src/npm-registry.ts
new file mode 100644
index 0000000..e68062d
--- /dev/null
+++ b/packages/cli/src/npm-registry.ts
@@ -0,0 +1,118 @@
+const TOKENLESS_LATEST_URL = 'https://registry.npmjs.org/tokenless/latest'
+const DEFAULT_NPM_REGISTRY_TIMEOUT_MS = 2_500
+const MAX_NPM_REGISTRY_RESPONSE_BYTES = 64 * 1024
+const SEMANTIC_VERSION_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/
+
+export type TokenlessLatestVersionResult =
+  | {
+      ok: true
+      packageName: 'tokenless'
+      registryUrl: string
+      latestVersion: string
+    }
+  | {
+      ok: false
+      packageName: 'tokenless'
+      registryUrl: string
+      code: string
+      message: string
+    }
+
+export async function fetchTokenlessLatestVersion({
+  timeoutMs = DEFAULT_NPM_REGISTRY_TIMEOUT_MS,
+}: {
+  timeoutMs?: number | undefined
+} = {}): Promise<TokenlessLatestVersionResult> {
+  const registryUrl = TOKENLESS_LATEST_URL
+  try {
+    const response = await fetch(registryUrl, {
+      headers: {
+        Accept: 'application/json',
+        'User-Agent': 'tokenless-cli',
+      },
+      signal: AbortSignal.timeout(normalizeTimeoutMs(timeoutMs)),
+    })
+    if (!response.ok) {
+      return {
+        ok: false,
+        packageName: 'tokenless',
+        registryUrl,
+        code: 'npm_registry_http_error',
+        message: `npm registry returned HTTP ${response.status} for tokenless/latest.`,
+      }
+    }
+    let body: unknown
+    try {
+      body = JSON.parse(await readResponseText(response, MAX_NPM_REGISTRY_RESPONSE_BYTES)) as unknown
+    } catch (error) {
+      return {
+        ok: false,
+        packageName: 'tokenless',
+        registryUrl,
+        code: 'npm_registry_invalid_response',
+        message: error instanceof Error ? error.message : 'npm registry returned invalid JSON.',
+      }
+    }
+    if (!isRecord(body) || body.name !== 'tokenless' || typeof body.version !== 'string' || !SEMANTIC_VERSION_PATTERN.test(body.version)) {
+      return {
+        ok: false,
+        packageName: 'tokenless',
+        registryUrl,
+        code: 'npm_registry_invalid_response',
+        message: 'npm registry returned an invalid tokenless/latest response.',
+      }
+    }
+    return {
+      ok: true,
+      packageName: 'tokenless',
+      registryUrl,
+      latestVersion: body.version,
+    }
+  } catch (error) {
+    return {
+      ok: false,
+      packageName: 'tokenless',
+      registryUrl,
+      code: error instanceof DOMException && error.name === 'TimeoutError'
+        ? 'npm_registry_timeout'
+        : 'npm_registry_unavailable',
+      message: error instanceof Error ? error.message : 'npm registry is unavailable.',
+    }
+  }
+}
+
+async function readResponseText(response: Response, maxBytes: number) {
+  const contentLength = response.headers.get('content-length')
+  if (contentLength !== null && Number(contentLength) > maxBytes) {
+    throw new Error(`npm registry response exceeded ${maxBytes} bytes.`)
+  }
+  const reader = response.body?.getReader()
+  if (!reader) return await response.text()
+  const chunks: Uint8Array[] = []
+  let totalBytes = 0
+  while (true) {
+    const { done, value } = await reader.read()
+    if (done) break
+    if (value === undefined) continue
+    totalBytes += value.byteLength
+    if (totalBytes > maxBytes) throw new Error(`npm registry response exceeded ${maxBytes} bytes.`)
+    chunks.push(value)
+  }
+  const bytes = new Uint8Array(totalBytes)
+  let offset = 0
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset)
+    offset += chunk.byteLength
+  }
+  return new TextDecoder().decode(bytes)
+}
+
+function normalizeTimeoutMs(value: number) {
+  return Number.isFinite(value) && value > 0 && value <= 2_147_483_647
+    ? Math.floor(value)
+    : DEFAULT_NPM_REGISTRY_TIMEOUT_MS
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value && typeof value === 'object' && !Array.isArray(value))
+}
diff --git a/packages/cli/src/platform-package.ts b/packages/cli/src/platform-package.ts
index d7b59e2..14fa785 100644
--- a/packages/cli/src/platform-package.ts
+++ b/packages/cli/src/platform-package.ts
@@ -1,121 +1,12 @@
-import { createRequire } from 'node:module'
 import fs from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
-export const NATIVE_PLATFORM_PACKAGE_PROTOCOL = 'tokenless.native-package.v1'
-
-export const NATIVE_PLATFORM_PACKAGES = Object.freeze({
-  'darwin-arm64': 'tokenless-native-darwin-arm64',
-  'darwin-x64': 'tokenless-native-darwin-x64',
-  'linux-arm64': 'tokenless-native-linux-arm64',
-  'linux-x64': 'tokenless-native-linux-x64',
-  'win32-arm64': 'tokenless-native-win32-arm64',
-  'win32-x64': 'tokenless-native-win32-x64',
-} as const)
-
-type NativeTuple = keyof typeof NATIVE_PLATFORM_PACKAGES
-
-type NativePackageManifest = {
-  name?: unknown
-  version?: unknown
-  os?: unknown
-  cpu?: unknown
-  tokenlessRuntime?: {
-    protocol?: unknown
-    platform?: unknown
-    arch?: unknown
-  } | undefined
-}
-
-type PlatformPackageError = Error & {
+type PackageError = Error & {
   code?: string
   retryable?: boolean
 }
 
-export type ResolveNativePlatformPackageOptions = {
-  platform?: NodeJS.Platform | undefined
-  arch?: string | undefined
-  expectedVersion?: string | undefined
-  resolvePackageJson?: ((packageName: string) => string) | undefined
-}
-
-export function nativePlatformPackageName(
-  platform: NodeJS.Platform = process.platform,
-  arch: string = process.arch
-) {
-  const tuple = `${platform}-${arch}` as NativeTuple
-  const packageName = NATIVE_PLATFORM_PACKAGES[tuple]
-  if (packageName) return packageName
-  throw platformPackageError(
-    'unsupported_native_platform',
-    `Tokenless has no native runtime for ${platform}-${arch}. Supported platforms: ${Object.keys(NATIVE_PLATFORM_PACKAGES).join(', ')}.`
-  )
-}
-
-export function resolveNativePlatformPackage({
-  platform = process.platform,
-  arch = process.arch,
-  expectedVersion = tokenlessPackageVersion(),
-  resolvePackageJson = defaultResolvePackageJson,
-}: ResolveNativePlatformPackageOptions = {}) {
-  const packageName = nativePlatformPackageName(platform, arch)
-  let manifestPath: string
-  try {
-    manifestPath = resolvePackageJson(packageName)
-  } catch {
-    throw platformPackageError(
-      'native_platform_package_missing',
-      `The optional native runtime ${packageName}@${expectedVersion} is not installed. Reinstall tokenless with optional dependencies enabled. Tokenless never downloads executables at runtime.`
-    )
-  }
-
-  let manifest: NativePackageManifest
-  try {
-    manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8')) as NativePackageManifest
-  } catch {
-    throw platformPackageError(
-      'native_platform_package_invalid',
-      `Cannot read the installed native runtime manifest at ${manifestPath}. Reinstall tokenless.`
-    )
-  }
-  const runtime = manifest.tokenlessRuntime
-  const valid = manifest.name === packageName &&
-    manifest.version === expectedVersion &&
-    Array.isArray(manifest.os) && manifest.os.length === 1 && manifest.os[0] === platform &&
-    Array.isArray(manifest.cpu) && manifest.cpu.length === 1 && manifest.cpu[0] === arch &&
-    runtime?.protocol === NATIVE_PLATFORM_PACKAGE_PROTOCOL &&
-    runtime.platform === platform &&
-    runtime.arch === arch
-  if (!valid) {
-    throw platformPackageError(
-      'native_platform_package_invalid',
-      `Native runtime ${packageName} does not match tokenless@${expectedVersion} for ${platform}-${arch}. Reinstall tokenless.`
-    )
-  }
-  return {
-    name: packageName,
-    version: expectedVersion,
-    platform,
-    arch,
-    root: path.dirname(manifestPath),
-    manifestPath,
-  }
-}
-
-function defaultResolvePackageJson(packageName: string) {
-  // Source builds stage the current native package outside the universal
-  // package. This directory is excluded from the published tokenless tarball.
-  const developmentPath = path.join(cliPackageRoot(), 'npm', packageName, 'package.json')
-  if (fs.existsSync(developmentPath)) return developmentPath
-  const require = createRequire(import.meta.url)
-  try {
-    return require.resolve(`${packageName}/package.json`)
-  } catch (error) {
-    throw error
-  }
-}
-
 export function tokenlessPackageVersion() {
   const manifestPath = path.join(cliPackageRoot(), 'package.json')
   try {
@@ -124,7 +15,7 @@ export function tokenlessPackageVersion() {
   } catch {
     // The deterministic error below is more useful than a JSON parser error.
   }
-  throw platformPackageError(
+  throw packageError(
     'tokenless_package_invalid',
     `Cannot read the tokenless package version at ${manifestPath}. Reinstall tokenless.`
   )
@@ -134,8 +25,8 @@ function cliPackageRoot() {
   return path.resolve(fileURLToPath(new URL('../..', import.meta.url)))
 }
 
-function platformPackageError(code: string, message: string) {
-  const error = new Error(message) as PlatformPackageError
+function packageError(code: string, message: string) {
+  const error = new Error(message) as PackageError
   error.code = code
   error.retryable = false
   return error
diff --git a/packages/cli/src/playwright/actions.ts b/packages/cli/src/playwright/actions.ts
index aee4213..fd02b4c 100644
--- a/packages/cli/src/playwright/actions.ts
+++ b/packages/cli/src/playwright/actions.ts
@@ -1,36 +1,68 @@
 import { randomUUID } from 'node:crypto'
+import {
+  VISIBLE_ACTION_SCHEMA_ID,
+  VISIBLE_ATTACHMENT_SCHEMA_ID,
+} from '../schema-ids.js'
+import {
+  isVisibleAction,
+  validateVisibleActionPayload,
+} from '../providers/action-catalog.js'
+import { VISIBLE_ACTIONS, isVisibleActionProtocolVersion } from '../providers/contracts.js'
 import { tokenlessError } from './errors.js'
-import { getProviderById } from './providers.js'
-import type { ProviderId } from './providers.js'
-
-export const VISIBLE_ACTION_PROTOCOL_VERSION = 'tokenless.playwright.visible-action.v1' as const
-export const VISIBLE_ATTACHMENT_PROTOCOL_VERSION = 'tokenless.visible-attachment.v1' as const
-
-export const VISIBLE_ACTIONS = Object.freeze({
-  AUTH_STATUS: 'auth.status',
-  MODEL_INSPECT: 'model.inspect',
-  MODEL_SELECT: 'model.select',
-  EFFORT_INSPECT: 'effort.inspect',
-  EFFORT_SELECT: 'effort.select',
-  FILE_UPLOAD: 'file.upload',
-  PROMPT_INPUT: 'prompt.input',
-  PROMPT_CLEAR: 'prompt.clear',
-  PROMPT_SUBMIT: 'prompt.submit',
-  RESPONSE_READ: 'response.read',
-  SNAPSHOT_SANITIZED: 'snapshot.sanitized',
-  NAVIGATION_CHECK: 'navigation.check',
-  BLOCKER_CHECK: 'blocker.check',
-})
-
-export type VisibleAction = typeof VISIBLE_ACTIONS[keyof typeof VISIBLE_ACTIONS]
-
-export type VisibleActionRequest = {
-  protocol: typeof VISIBLE_ACTION_PROTOCOL_VERSION
-  requestId: string
-  provider: ProviderId
-  action: VisibleAction
-  payload: Record<string, unknown>
-}
+import { getProviderDescriptorById } from '../providers/registry.js'
+import type {
+  ProviderAccessClass,
+  ProviderAccountTier,
+  ProviderCapabilityId,
+  ProviderCapabilityResourceKind,
+  ProviderCapabilityStability,
+  ProviderId,
+} from '../providers/registry.js'
+
+export {
+  VISIBLE_ACTION_SCHEMA_ID,
+  VISIBLE_ATTACHMENT_SCHEMA_ID,
+} from '../schema-ids.js'
+export { validateAttachmentInput } from '../providers/action-catalog.js'
+export { VISIBLE_ACTIONS, isVisibleActionProtocolVersion } from '../providers/contracts.js'
+export type {
+  AttachmentInput,
+  EmptyVisibleActionPayload,
+  FileUploadActionRequest,
+  FileUploadPayload,
+  PromptInputActionRequest,
+  PromptInputPayload,
+  QwenModeInspectActionRequest,
+  QwenModeSelectActionRequest,
+  VisibleAction,
+  VisibleActionPayloadForAction,
+  VisibleActionProtocolVersion,
+  VisibleActionRequest,
+  VisibleActionRequestForAction,
+  VisibleActionWireRequest,
+  VisibleSelectionPayload,
+  QwenModeSelectionPayload,
+  DeepSeekMode,
+  DeepSeekModeSelectionPayload,
+  DeepSeekToggleSelectionPayload,
+  DoubaoMode,
+  DoubaoModeSelectionPayload,
+  DoubaoSkill,
+  DoubaoSkillSelectionPayload,
+  WorkspaceEnsureActionRequest,
+  WorkspaceEnsurePayload,
+} from '../providers/contracts.js'
+
+import type {
+  AttachmentInput,
+  DeepSeekMode,
+  DoubaoMode,
+  DoubaoSkill,
+  VisibleAction,
+  VisibleActionProtocolVersion,
+  VisibleActionRequest,
+  VisibleActionWireRequest,
+} from '../providers/contracts.js'
 
 export type VisibleActionError = {
   code: string
@@ -40,7 +72,7 @@ export type VisibleActionError = {
 
 export type VisibleActionResponse =
   | {
-    protocol: typeof VISIBLE_ACTION_PROTOCOL_VERSION
+    protocol: VisibleActionProtocolVersion
     requestId: string
     provider: ProviderId
     action: VisibleAction
@@ -49,7 +81,7 @@ export type VisibleActionResponse =
     error: null
   }
   | {
-    protocol: typeof VISIBLE_ACTION_PROTOCOL_VERSION
+    protocol: VisibleActionProtocolVersion
     requestId: string | null
     provider: ProviderId | null
     action: VisibleAction | null
@@ -60,7 +92,53 @@ export type VisibleActionResponse =
 
 export type AuthStatusResult = {
   state: 'authenticated' | 'unauthenticated' | 'unknown'
+  access: ProviderAccessClass
+  visibleProof: string
+  account?: {
+    name: string | null
+    subscription: string | null
+    tier: ProviderAccountTier
+    subscriptionEvidence: {
+      status: 'observed' | 'derived' | 'unknown'
+      source: string | null
+    }
+  }
+}
+
+export type CapabilityInspectResult = {
   visibleProof: string
+  capabilities: Readonly<Record<ProviderCapabilityId, ProviderCapabilityInspection>>
+}
+
+export type ProviderCapabilityInspection = {
+  capability: ProviderCapabilityId
+  availability: 'available' | 'unavailable' | 'unknown'
+  visibleProof: string
+  reason: string | null
+  actions?: readonly VisibleAction[]
+  native: {
+    resourceKind: ProviderCapabilityResourceKind | null
+    availability: 'available' | 'unavailable' | 'unknown'
+    visibleProof: string | null
+    reason: string | null
+    identity?: {
+      provider: ProviderId
+      canonicalUrl: string | null
+    } | null
+    updateInstructions?: {
+      availability: 'available' | 'unavailable' | 'unknown'
+      visibleProof: string | null
+      reason: string | null
+    }
+  }
+  fallback: {
+    resourceKind: ProviderCapabilityResourceKind | null
+    availability: 'available' | 'unavailable' | 'unknown'
+    mode: 'conversation' | null
+    visibleProof: string | null
+    reason: string | null
+  }
+  stability: ProviderCapabilityStability
 }
 
 export type Choice = {
@@ -87,9 +165,147 @@ export type ChoiceSelectResult = {
   reason: 'unsupported_by_provider'
 }
 
+export type QwenModeChoice = {
+  mode: string
+  enabled: boolean
+  selected: boolean
+}
+
+export type QwenModeInspectResult = {
+  supported: true
+  active: {
+    mode: string
+    variant: string | null
+  }
+  modes: readonly QwenModeChoice[]
+} | {
+  supported: false
+  reason: 'unsupported_by_provider' | 'selector_not_available'
+}
+
+export type QwenModeSelectResult = {
+  supported: true
+  selectedMode: string
+  selectedVariant: string | null
+  visibleProof: string
+} | {
+  supported: false
+  reason: 'unsupported_by_provider' | 'selector_not_available' | 'exact_mode_not_found' | 'exact_variant_not_found'
+}
+
+export type DeepSeekModeChoice = {
+  mode: DeepSeekMode
+  enabled: boolean
+  selected: boolean
+  controls: {
+    deepThink: boolean
+    search: boolean
+    fileUpload: boolean
+    imageFileSelection: boolean
+  }
+}
+
+export type DeepSeekModeInspectResult = {
+  supported: true
+  activeMode: DeepSeekMode
+  modes: readonly DeepSeekModeChoice[]
+} | {
+  supported: false
+  reason: 'unsupported_by_provider' | 'selector_not_available'
+}
+
+export type DeepSeekModeSelectResult = {
+  supported: true
+  selectedMode: DeepSeekMode
+  visibleProof: string
+} | {
+  supported: false
+  reason: 'unsupported_by_provider' | 'selector_not_available' | 'exact_mode_not_found'
+}
+
+export type DeepSeekToggleInspectResult = {
+  supported: true
+  activeMode: DeepSeekMode
+  enabled: boolean
+} | {
+  supported: false
+  activeMode: DeepSeekMode | null
+  reason: 'unsupported_by_provider' | 'selector_not_available' | 'unavailable_in_mode'
+}
+
+export type DeepSeekToggleSelectResult = {
+  supported: true
+  activeMode: DeepSeekMode
+  enabled: boolean
+  visibleProof: string
+} | {
+  supported: false
+  activeMode: DeepSeekMode | null
+  reason: 'unsupported_by_provider' | 'selector_not_available' | 'unavailable_in_mode'
+}
+
+export type DoubaoModeChoice = {
+  mode: DoubaoMode
+  nativeLabel: string
+  description: string
+  canonicalCapabilities: readonly string[]
+  enabled: boolean
+  selected: boolean
+  reason: 'upgrade_required' | null
+}
+
+export type DoubaoModeInspectResult = {
+  supported: true
+  activeMode: DoubaoMode
+  modes: readonly DoubaoModeChoice[]
+} | {
+  supported: false
+  reason: 'unsupported_by_provider' | 'selector_not_available'
+}
+
+export type DoubaoModeSelectResult = {
+  supported: true
+  selectedMode: DoubaoMode
+  nativeLabel: string
+  visibleProof: string
+} | {
+  supported: false
+  reason: 'unsupported_by_provider' | 'selector_not_available' | 'exact_mode_not_found' | 'mode_unavailable'
+}
+
+export type DoubaoSkillChoice = {
+  skill: DoubaoSkill
+  nativeLabel: string
+  canonicalCapabilities: readonly string[]
+  enabled: boolean
+  selected: boolean
+  reason: 'desktop_app_required' | null
+}
+
+export type DoubaoSkillInspectResult = {
+  supported: true
+  activeSkill: DoubaoSkill
+  skills: readonly DoubaoSkillChoice[]
+} | {
+  supported: false
+  reason: 'unsupported_by_provider' | 'selector_not_available'
+}
+
+export type DoubaoSkillSelectResult = {
+  supported: true
+  selectedSkill: DoubaoSkill
+  nativeLabel: string
+  visibleProof: string
+} | {
+  supported: false
+  reason: 'unsupported_by_provider' | 'selector_not_available' | 'exact_skill_not_found' | 'skill_unavailable'
+}
+
 export type FileUploadResult = {
+  acceptance: 'selected' | 'accepted'
+  visibleProof: string
   attachments: readonly {
-    protocol: typeof VISIBLE_ATTACHMENT_PROTOCOL_VERSION
+    protocol: typeof VISIBLE_ATTACHMENT_SCHEMA_ID
     bundleId: string
     attachmentId: string
     name: string
@@ -100,6 +316,107 @@ export type FileUploadResult = {
   }[]
 }
 
+type WorkspaceInstructionOutcome =
+  | 'not_requested'
+  | 'applied_on_creation'
+  | 'already_equivalent'
+  | 'skipped_on_reuse'
+  | 'unavailable'
+
+type WorkspaceEnsureResultBase = {
+  requestedMode: 'auto' | 'native' | 'conversation'
+  resolvedMode: 'native' | 'conversation'
+  name: string
+  scope: {
+    provider: ProviderId
+    profileId: string
+  }
+  instructionOutcome: WorkspaceInstructionOutcome
+  availability: 'available'
+  visibleProof: string
+  reason: string | null
+}
+
+export type NativeWorkspaceEnsureResult = WorkspaceEnsureResultBase & {
+  mode: 'native'
+  resolvedMode: 'native'
+  identity: {
+    provider: ProviderId
+    name: string
+    resourceId: string
+    canonicalUrl: string
+  }
+  resource: {
+    kind: 'project'
+    native: true
+    disposition: 'created' | 'reused'
+    id: string
+    canonicalUrl: string
+  }
+  native: {
+    resourceKind: 'project'
+    availability: 'available'
+    canonicalUrl: string
+    visibleProof: string
+    reason: null
+    updateInstructions: {
+      availability: 'available' | 'unavailable'
+      visibleProof: string | null
+      reason: string | null
+    }
+  }
+  updateInstructions: {
+    availability: 'available' | 'unavailable'
+    visibleProof: string | null
+    reason: string | null
+  }
+  fallback: null
+}
+
+export type ConversationWorkspaceEnsureResult = WorkspaceEnsureResultBase & {
+  mode: 'conversation'
+  resolvedMode: 'conversation'
+  identity: {
+    provider: ProviderId
+    name: string
+    resourceId: null
+    canonicalUrl: string | null
+  }
+  resource: {
+    kind: 'conversation'
+    native: false
+    disposition: 'fallback'
+    id: null
+    canonicalUrl: string | null
+  }
+  native: {
+    resourceKind: 'project'
+    availability: 'unavailable'
+    canonicalUrl: null
+    visibleProof: null
+    reason: string
+    updateInstructions: {
+      availability: 'unavailable'
+      visibleProof: null
+      reason: string
+    }
+  }
+  updateInstructions: {
+    availability: 'unavailable'
+    visibleProof: null
+    reason: string
+  }
+  fallback: {
+    mode: 'conversation'
+    resourceKind: 'conversation'
+    availability: 'available'
+  } | null
+}
+
+export type WorkspaceEnsureResult =
+  | NativeWorkspaceEnsureResult
+  | ConversationWorkspaceEnsureResult
+
 export type PromptInputResult = {
   visible: true
   inputProof: string
@@ -127,6 +444,20 @@ export type VisibleCitation = {
 }
 
 export type SnapshotResult = {
+  status: 'snapshotted'
+  provider: ProviderId
+  capturedAt: string
+  url: string
+  title: string
+  sanitized: true
+  includeText: false
+  html: string
+  selectorProbes: {
+    composer: number
+    authenticatedAccount: number
+    login: number
+    blocker: number
+  }
   page: {
     origin: string
   }
@@ -134,6 +465,10 @@ export type SnapshotResult = {
     tag: string
     role?: string
     inputType?: string
+    dataTestId?: string
+    ariaLabel?: string
+    placeholder?: string
+    text?: string
     disabled: boolean
     visible: boolean
   }[]
@@ -154,7 +489,8 @@ export type VisibleBlocker = {
   visibleProof: string
   provider: ProviderId
   url: string
-  family?: 'recaptcha' | 'cloudflare' | 'hcaptcha' | 'arkose' | 'provider_sign_in' | 'rate_limit' | 'plan_limit'
+  family?: 'recaptcha' | 'cloudflare' | 'hcaptcha' | 'arkose' | 'provider_sign_in' | 'rate_limit' | 'plan_limit' | 'availability'
+  retryAfterSeconds?: number | undefined
 }
 
 export type BlockerCheckResult = {
@@ -163,11 +499,28 @@ export type BlockerCheckResult = {
   blockers: readonly VisibleBlocker[]
 }
 
-export type VisibleActionResult =
+type VisibleActionResultBase = {
+  availability?: 'available' | 'unavailable' | 'unknown'
+  reason?: string | null
+}
+
+export type VisibleActionResult = (
+  | CapabilityInspectResult
   | AuthStatusResult
   | ChoiceInspectResult
   | ChoiceSelectResult
+  | QwenModeInspectResult
+  | QwenModeSelectResult
+  | DeepSeekModeInspectResult
+  | DeepSeekModeSelectResult
+  | DeepSeekToggleInspectResult
+  | DeepSeekToggleSelectResult
+  | DoubaoModeInspectResult
+  | DoubaoModeSelectResult
+  | DoubaoSkillInspectResult
+  | DoubaoSkillSelectResult
   | FileUploadResult
+  | WorkspaceEnsureResult
   | PromptInputResult
   | PromptClearResult
   | PromptSubmitResult
@@ -175,40 +528,14 @@ export type VisibleActionResult =
   | SnapshotResult
   | NavigationCheckResult
   | BlockerCheckResult
-
-export type AttachmentInput = {
-  protocol: typeof VISIBLE_ATTACHMENT_PROTOCOL_VERSION
-  bundleId: string
-  attachmentId: string
-  name: string
-  type: string
-  size: number
-  sha256: string
-}
-
-const ACTIONS = Object.freeze(Object.values(VISIBLE_ACTIONS)) as readonly VisibleAction[]
-const ACTION_SET = new Set<string>(ACTIONS)
-const EMPTY_PAYLOAD_ACTIONS = new Set<VisibleAction>([
-  VISIBLE_ACTIONS.AUTH_STATUS,
-  VISIBLE_ACTIONS.MODEL_INSPECT,
-  VISIBLE_ACTIONS.EFFORT_INSPECT,
-  VISIBLE_ACTIONS.PROMPT_CLEAR,
-  VISIBLE_ACTIONS.PROMPT_SUBMIT,
-  VISIBLE_ACTIONS.RESPONSE_READ,
-  VISIBLE_ACTIONS.SNAPSHOT_SANITIZED,
-  VISIBLE_ACTIONS.NAVIGATION_CHECK,
-  VISIBLE_ACTIONS.BLOCKER_CHECK,
-])
+) & VisibleActionResultBase
 const REQUEST_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/
-const LABEL_MAX_BYTES = 512
-const PROMPT_MAX_BYTES = 1024 * 1024
-const SHA256_PATTERN = /^[a-f0-9]{64}$/
 
 export function createVisibleActionRequest(
-  input: Omit<Partial<VisibleActionRequest>, 'protocol'> & Record<string, unknown>
+  input: Omit<Partial<VisibleActionWireRequest>, 'protocol'> & Record<string, unknown>
 ): VisibleActionRequest {
   return validateVisibleActionRequest({
-    protocol: VISIBLE_ACTION_PROTOCOL_VERSION,
+    protocol: VISIBLE_ACTION_SCHEMA_ID,
     requestId: typeof input.requestId === 'string' ? input.requestId : randomUUID(),
     provider: input.provider,
     action: input.action,
@@ -221,94 +548,31 @@ export function validateVisibleActionRequest(input: unknown): VisibleActionReque
     throw tokenlessError('invalid_visible_action_request', 'Visible action request must be an object.')
   }
   requireExactKeys(input, ['protocol', 'requestId', 'provider', 'action', 'payload'], 'invalid_visible_action_request')
-  if (input.protocol !== VISIBLE_ACTION_PROTOCOL_VERSION) {
+  if (!isVisibleActionProtocolVersion(input.protocol)) {
     throw tokenlessError('invalid_visible_action_protocol', 'Visible action protocol version is not supported.')
   }
   if (typeof input.requestId !== 'string' || !REQUEST_ID_PATTERN.test(input.requestId)) {
     throw tokenlessError('invalid_visible_action_request_id', 'Visible action request id is invalid.')
   }
-  const provider = getProviderById(input.provider)
+  const provider = getProviderDescriptorById(input.provider)
   if (!provider) {
     throw tokenlessError('unknown_visible_provider', 'Visible action provider is not supported.')
   }
-  if (typeof input.action !== 'string' || !ACTION_SET.has(input.action)) {
+  if (!isVisibleAction(input.action)) {
     throw tokenlessError('unknown_visible_action', 'Visible action is not supported.')
   }
   if (!isPlainRecord(input.payload)) {
     throw tokenlessError('invalid_visible_action_payload', 'Visible action payload must be an object.')
   }
-  validatePayload(input.action as VisibleAction, input.payload)
+  const action = input.action
+  const payload = validateVisibleActionPayload(action, input.payload)
   return {
-    protocol: VISIBLE_ACTION_PROTOCOL_VERSION,
+    protocol: input.protocol,
     requestId: input.requestId,
     provider: provider.id,
-    action: input.action as VisibleAction,
-    payload: input.payload,
-  }
-}
-
-export function validateAttachmentInput(input: unknown): AttachmentInput {
-  if (!isPlainRecord(input)) throw tokenlessError('invalid_visible_attachment', 'Attachment descriptor must be an object.')
-  requireExactKeys(input, ['protocol', 'bundleId', 'attachmentId', 'name', 'type', 'size', 'sha256'], 'invalid_visible_attachment')
-  if (input.protocol !== VISIBLE_ATTACHMENT_PROTOCOL_VERSION) {
-    throw tokenlessError('invalid_visible_attachment', 'Attachment protocol is invalid.')
-  }
-  if (typeof input.bundleId !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(input.bundleId)) {
-    throw tokenlessError('invalid_visible_attachment', 'Attachment bundle id is invalid.')
-  }
-  if (typeof input.attachmentId !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(input.attachmentId)) {
-    throw tokenlessError('invalid_visible_attachment', 'Attachment id is invalid.')
-  }
-  if (typeof input.name !== 'string' || input.name.length < 1 || Buffer.byteLength(input.name, 'utf8') > 255 || /[/\\\u0000-\u001f\u007f]/.test(input.name)) {
-    throw tokenlessError('invalid_visible_attachment', 'Attachment name is invalid.')
-  }
-  if (typeof input.type !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]{0,126}\/[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]{0,126}$/.test(input.type)) {
-    throw tokenlessError('invalid_visible_attachment', 'Attachment media type is invalid.')
-  }
-  if (typeof input.size !== 'number' || !Number.isSafeInteger(input.size) || input.size < 0 || input.size > 512 * 1024 * 1024) {
-    throw tokenlessError('invalid_visible_attachment', 'Attachment size is invalid.')
-  }
-  if (typeof input.sha256 !== 'string' || !SHA256_PATTERN.test(input.sha256)) {
-    throw tokenlessError('invalid_visible_attachment', 'Attachment sha256 is invalid.')
-  }
-  return input as AttachmentInput
-}
-
-function validatePayload(action: VisibleAction, payload: Record<string, unknown>) {
-  if (EMPTY_PAYLOAD_ACTIONS.has(action)) {
-    requireExactKeys(payload, [], 'invalid_visible_action_payload')
-    return
-  }
-  if (action === VISIBLE_ACTIONS.MODEL_SELECT || action === VISIBLE_ACTIONS.EFFORT_SELECT) {
-    requireExactKeys(payload, ['label'], 'invalid_visible_action_payload')
-    validateVisibleLabel(payload.label)
-    return
-  }
-  if (action === VISIBLE_ACTIONS.PROMPT_INPUT) {
-    requireExactKeys(payload, ['text'], 'invalid_visible_action_payload')
-    if (typeof payload.text !== 'string' || Buffer.byteLength(payload.text, 'utf8') > PROMPT_MAX_BYTES) {
-      throw tokenlessError('invalid_visible_prompt', 'Prompt text is invalid or too large.')
-    }
-    return
-  }
-  if (action === VISIBLE_ACTIONS.FILE_UPLOAD) {
-    requireExactKeys(payload, ['attachments'], 'invalid_visible_action_payload')
-    if (!Array.isArray(payload.attachments) || payload.attachments.length < 1 || payload.attachments.length > 100) {
-      throw tokenlessError('invalid_visible_attachment', 'File upload requires one to one hundred attachments.')
-    }
-    for (const attachment of payload.attachments) validateAttachmentInput(attachment)
-    return
-  }
-  throw tokenlessError('unknown_visible_action', 'Visible action is not supported.')
-}
-
-function validateVisibleLabel(value: unknown) {
-  if (typeof value !== 'string' || !/\S/u.test(value) || Buffer.byteLength(value, 'utf8') > LABEL_MAX_BYTES) {
-    throw tokenlessError('invalid_visible_label', 'Visible selection label is invalid.')
-  }
-  if (/[\u0000-\u001f\u007f]/.test(value)) {
-    throw tokenlessError('invalid_visible_label', 'Visible selection label contains control characters.')
-  }
+    action,
+    payload,
+  } as VisibleActionRequest
 }
 
 function requireExactKeys(record: Record<string, unknown>, keys: readonly string[], code: string) {
diff --git a/packages/cli/src/playwright/adapters/index.ts b/packages/cli/src/playwright/adapters/index.ts
deleted file mode 100644
index c2c00af..0000000
--- a/packages/cli/src/playwright/adapters/index.ts
+++ /dev/null
@@ -1,56 +0,0 @@
-import { createDomProviderAdapter } from './provider-dom-adapter.js'
-import type { ProviderAdapter, ProviderAdapterRegistry, VisibleAdapterContext } from './types.js'
-import type { Page } from 'playwright-core'
-import type { VisibleActionRequest, VisibleActionResponse } from '../actions.js'
-import type { ProviderId } from '../providers.js'
-import { listProviders } from '../providers.js'
-import { errorResponse } from '../errors.js'
-import { VISIBLE_ACTION_PROTOCOL_VERSION } from '../actions.js'
-
-export type { ProviderAdapter, ProviderAdapterRegistry, VisibleAdapterContext } from './types.js'
-
-export function createProviderAdapterRegistry(
-  adapters: readonly ProviderAdapter[] = listProviders().map((provider) => createDomProviderAdapter(provider))
-): ProviderAdapterRegistry {
-  const byProvider = new Map<ProviderId, ProviderAdapter>()
-  for (const adapter of adapters) byProvider.set(adapter.provider.id, adapter)
-  return {
-    list() {
-      return [...byProvider.values()]
-    },
-    get(providerId) {
-      return byProvider.get(providerId) ?? null
-    },
-    async execute(page: Page, request: VisibleActionRequest, context: VisibleAdapterContext): Promise<VisibleActionResponse> {
-      const adapter = byProvider.get(request.provider)
-      if (!adapter) {
-        return {
-          protocol: VISIBLE_ACTION_PROTOCOL_VERSION,
-          requestId: request.requestId,
-          provider: request.provider,
-          action: request.action,
-          ok: false,
-          result: null,
-          error: {
-            code: 'unknown_visible_provider',
-            message: 'Visible provider is not registered.',
-            retryable: false,
-          },
-        }
-      }
-      try {
-        return await adapter.execute(page, request, context)
-      } catch (error) {
-        return {
-          protocol: VISIBLE_ACTION_PROTOCOL_VERSION,
-          requestId: request.requestId,
-          provider: request.provider,
-          action: request.action,
-          ok: false,
-          result: null,
-          error: errorResponse(error),
-        }
-      }
-    },
-  }
-}
diff --git a/packages/cli/src/playwright/adapters/provider-dom-adapter.ts b/packages/cli/src/playwright/adapters/provider-dom-adapter.ts
deleted file mode 100644
index a74f37f..0000000
--- a/packages/cli/src/playwright/adapters/provider-dom-adapter.ts
+++ /dev/null
@@ -1,681 +0,0 @@
-import { createHash } from 'node:crypto'
-import { constants as fsConstants } from 'node:fs'
-import { lstat, open, realpath } from 'node:fs/promises'
-import { basename, join, resolve, sep } from 'node:path'
-import { VISIBLE_ACTIONS, VISIBLE_ACTION_PROTOCOL_VERSION, VISIBLE_ATTACHMENT_PROTOCOL_VERSION, validateAttachmentInput } from '../actions.js'
-import { TokenlessPlaywrightError, tokenlessError } from '../errors.js'
-import { assertProviderUrlAllowed, getProviderForUrl, trustedProviderSignInNavigation } from '../providers.js'
-import type { AttachmentInput, Choice, VisibleActionRequest, VisibleActionResponse, VisibleActionResult, VisibleBlocker, VisibleCitation } from '../actions.js'
-import type { ProviderConfig } from '../providers.js'
-import type { ProviderAdapter, VisibleAdapterContext } from './types.js'
-import type { Locator, Page } from 'playwright-core'
-
-export function createDomProviderAdapter(provider: ProviderConfig): ProviderAdapter {
-  return {
-    provider,
-    async execute(page: Page, request: VisibleActionRequest, context: VisibleAdapterContext): Promise<VisibleActionResponse> {
-      assertNotAborted(context.signal)
-      if (request.provider !== provider.id) {
-        return failure(request, 'provider_mismatch', 'The action provider does not match this adapter.', false)
-      }
-      const pageUrl = page.url()
-      const navigation = assertProviderUrlAllowed(provider, pageUrl)
-      if (!navigation.ok && request.action !== VISIBLE_ACTIONS.NAVIGATION_CHECK) {
-        if (trustedProviderSignInNavigation(provider, pageUrl)) {
-          return failure(request, 'provider_sign_in_navigation', 'Provider sign-in navigation is visible and requires the user.', true)
-        }
-        return failure(request, 'unsupported_provider_navigation', 'The visible page is outside the approved provider origin.', false)
-        }
-      if (request.action === VISIBLE_ACTIONS.AUTH_STATUS) return success(request, await inspectAuth(page, provider, context.signal))
-      if (request.action === VISIBLE_ACTIONS.NAVIGATION_CHECK) return success(request, inspectNavigation(page, provider))
-      if (request.action === VISIBLE_ACTIONS.BLOCKER_CHECK) return success(request, await inspectVisibleBlockers(page, provider))
-      if (request.action === VISIBLE_ACTIONS.MODEL_INSPECT) return success(request, await inspectChoices(page, provider, 'model'))
-      if (request.action === VISIBLE_ACTIONS.MODEL_SELECT) return success(request, await selectChoice(page, provider, 'model', request.payload.label))
-      if (request.action === VISIBLE_ACTIONS.EFFORT_INSPECT) return success(request, await inspectChoices(page, provider, 'effort'))
-      if (request.action === VISIBLE_ACTIONS.EFFORT_SELECT) return success(request, await selectChoice(page, provider, 'effort', request.payload.label))
-      if (request.action === VISIBLE_ACTIONS.FILE_UPLOAD) return success(request, await uploadFiles(page, provider, request.payload.attachments, context))
-      if (request.action === VISIBLE_ACTIONS.PROMPT_INPUT) return success(request, await inputPrompt(page, provider, request.payload.text))
-      if (request.action === VISIBLE_ACTIONS.PROMPT_CLEAR) return success(request, await clearPrompt(page, provider))
-      if (request.action === VISIBLE_ACTIONS.PROMPT_SUBMIT) return success(request, await submitPrompt(page, provider))
-      if (request.action === VISIBLE_ACTIONS.RESPONSE_READ) return success(request, await readResponse(page, provider))
-      if (request.action === VISIBLE_ACTIONS.SNAPSHOT_SANITIZED) return success(request, await sanitizedSnapshot(page))
-      return failure(request, 'unknown_visible_action', 'Visible action is not supported.', false)
-    },
-  }
-}
-
-async function inspectAuth(page: Page, provider: ProviderConfig, signal: AbortSignal | undefined) {
-  for (let attempt = 0; attempt <= 50; attempt += 1) {
-    assertNotAborted(signal)
-    const loginVisible = await anyVisible(page, provider.loginIndicators)
-    if (loginVisible) {
-      return {
-        state: 'unauthenticated' as const,
-        visibleProof: 'login-indicator-visible',
-      }
-    }
-    const authVisible = await anyVisible(page, [...provider.authIndicators, ...provider.composerSelectors])
-    if (authVisible) {
-      return {
-        state: 'authenticated' as const,
-        visibleProof: 'authenticated-control-visible',
-      }
-    }
-    if (attempt < 50) await page.waitForTimeout(100)
-  }
-  return {
-    state: 'unknown' as const,
-    visibleProof: 'no-auth-proof-visible',
-  }
-}
-
-function inspectNavigation(page: Page, provider: ProviderConfig) {
-  const currentProvider = getProviderForUrl(page.url())
-  if (!currentProvider) {
-    return {
-      allowed: false,
-      provider: null,
-      reason: 'unsupported_provider_navigation',
-    }
-  }
-  const policy = assertProviderUrlAllowed(provider, page.url())
-  return {
-    allowed: policy.ok,
-    provider: currentProvider.id,
-    reason: policy.ok ? null : policy.reason,
-  }
-}
-
-export async function inspectVisibleBlockers(page: Page, provider: ProviderConfig) {
-  const blockers = await detectStructuredBlockers(page, provider)
-  const reasons = blockers.map((blocker) => blocker.code)
-  return {
-    blocked: blockers.length > 0,
-    reasons,
-    blockers,
-  }
-}
-
-async function detectStructuredBlockers(page: Page, provider: ProviderConfig): Promise<VisibleBlocker[]> {
-  const url = page.url()
-  const currentUrl = safeUrl(url)
-  const domBlockers = await page.evaluate(() => {
-    type RawBlocker = {
-      kind: 'challenge' | 'auth' | 'terminal'
-      code: string
-      message: string
-      family?: string
-      proof: string
-    }
-    const isVisibleElement = (element: Element | null): element is HTMLElement | SVGElement => {
-      if (!element || !(element instanceof HTMLElement || element instanceof SVGElement)) return false
-      let node: Element | null = element
-      while (node && node instanceof Element) {
-        const style = window.getComputedStyle(node)
-        if (style.visibility === 'hidden' || style.display === 'none' || Number(style.opacity) === 0) return false
-        node = node.parentElement
-      }
-      const rect = element.getBoundingClientRect()
-      return rect.width > 0 && rect.height > 0
-    }
-    const ownText = (element: Element) => Array.from(element.childNodes)
-      .filter((node) => node.nodeType === Node.TEXT_NODE)
-      .map((node) => node.textContent ?? '')
-      .join(' ')
-    const visibleText = () => Array.from(document.body?.querySelectorAll('body, body *') ?? [])
-      .filter(isVisibleElement)
-      .map((element) => element instanceof HTMLInputElement || element instanceof HTMLTextAreaElement
-        ? [element.getAttribute('aria-label'), element.getAttribute('placeholder')].filter(Boolean).join(' ')
-        : [
-            ownText(element),
-            element.getAttribute('aria-label'),
-            element.getAttribute('placeholder'),
-          ].filter(Boolean).join(' '))
-      .join(' ')
-    const text = visibleText().replace(/\s+/g, ' ').slice(0, 20_000)
-    const lowerText = text.toLowerCase()
-    const raw: RawBlocker[] = []
-    const visibleFrames = Array.from(document.querySelectorAll('iframe')).filter(isVisibleElement)
-    const visibleInputs = Array.from(document.querySelectorAll('input, button, a, [role="button"], [role="textbox"]')).filter(isVisibleElement)
-    const visibleWithAttribute = (selector: string) => {
-      try {
-        return Array.from(document.querySelectorAll(selector)).some(isVisibleElement)
-      } catch {
-        return false
-      }
-    }
-    for (const frame of visibleFrames) {
-      const src = (frame.getAttribute('src') ?? '').toLowerCase()
-      const title = (frame.getAttribute('title') ?? '').toLowerCase()
-      if (src.includes('/recaptcha/') || title.includes('recaptcha')) {
-        raw.push({ kind: 'challenge', code: 'visible_recaptcha', family: 'recaptcha', message: 'Visible reCAPTCHA verification is blocking the provider page.', proof: 'visible-recaptcha-frame' })
-      } else if (src.includes('hcaptcha.com') || title.includes('hcaptcha')) {
-        raw.push({ kind: 'challenge', code: 'visible_hcaptcha', family: 'hcaptcha', message: 'Visible hCaptcha verification is blocking the provider page.', proof: 'visible-hcaptcha-frame' })
-      } else if (src.includes('challenges.cloudflare.com') || src.includes('/cdn-cgi/challenge-platform') || title.includes('cloudflare') || title.includes('turnstile')) {
-        raw.push({ kind: 'challenge', code: 'visible_cloudflare_turnstile', family: 'cloudflare', message: 'Visible Cloudflare verification is blocking the provider page.', proof: 'visible-cloudflare-frame' })
-      } else if (src.includes('arkoselabs') || src.includes('funcaptcha') || title.includes('arkose') || title.includes('funcaptcha')) {
-        raw.push({ kind: 'challenge', code: 'visible_arkose_funcaptcha', family: 'arkose', message: 'Visible Arkose/FunCaptcha verification is blocking the provider page.', proof: 'visible-arkose-frame' })
-      }
-    }
-    if (visibleWithAttribute('.cf-turnstile, [data-cf-turnstile], [data-turnstile-widget]')) {
-      raw.push({ kind: 'challenge', code: 'visible_cloudflare_turnstile', family: 'cloudflare', message: 'Visible Cloudflare Turnstile verification is blocking the provider page.', proof: 'visible-turnstile-widget' })
-    }
-    if (/(checking if the site connection is secure|verify you are human|cloudflare ray id|needs to review the security of your connection)/i.test(text)) {
-      raw.push({ kind: 'challenge', code: 'visible_cloudflare_interstitial', family: 'cloudflare', message: 'Visible Cloudflare interstitial is blocking the provider page.', proof: 'visible-cloudflare-interstitial-text' })
-    }
-    if (visibleInputs.some((element) => /log in|sign in|continue with|enter your email|email address/i.test([
-      ownText(element),
-      element.getAttribute('aria-label'),
-      element.getAttribute('placeholder'),
-    ].filter(Boolean).join(' ')))) {
-      raw.push({ kind: 'auth', code: 'provider_sign_in_visible', family: 'provider_sign_in', message: 'Provider sign-in is visible and requires the user.', proof: 'visible-provider-sign-in-control' })
-    }
-    if (/(rate limit|too many requests|try again later|temporarily unavailable)/i.test(lowerText)) {
-      raw.push({ kind: 'terminal', code: 'provider_rate_limited', family: 'rate_limit', message: 'The provider is showing a visible rate limit or temporary capacity blocker.', proof: 'visible-rate-limit-text' })
-    }
-    if (/(upgrade required|upgrade your plan|subscribe to|requires a paid plan|plan limit|usage limit)/i.test(lowerText)) {
-      raw.push({ kind: 'terminal', code: 'provider_plan_limited', family: 'plan_limit', message: 'The provider is showing a visible plan or quota blocker.', proof: 'visible-plan-limit-text' })
-    }
-    return raw
-  })
-  const selectorBlockers: VisibleBlocker[] = []
-  for (const selector of provider.loginIndicators) {
-    if (await firstVisibleFast(page, selector)) {
-      selectorBlockers.push(blocker({
-        provider,
-        url,
-        kind: 'auth',
-        code: 'provider_sign_in_visible',
-        family: 'provider_sign_in',
-        message: 'Provider sign-in is visible and requires the user.',
-        visibleProof: `visible-login-selector:${selectorReason(selector)}`,
-      }))
-      break
-    }
-  }
-  for (const selector of provider.blockerSelectors) {
-    if (!await firstVisibleFast(page, selector)) continue
-    const reason = selectorReason(selector)
-    const terminal = /rate|upgrade|plan|too many requests/i.test(selector)
-    selectorBlockers.push(blocker({
-      provider,
-      url,
-      kind: terminal ? 'terminal' : 'challenge',
-      code: terminal ? (/upgrade|plan/i.test(selector) ? 'provider_plan_limited' : 'provider_rate_limited') : 'visible_provider_blocker',
-      family: terminal ? (/upgrade|plan/i.test(selector) ? 'plan_limit' : 'rate_limit') : undefined,
-      message: terminal
-        ? 'The provider is showing a visible terminal account or capacity blocker.'
-        : 'A visible provider challenge or blocker is present.',
-      visibleProof: `visible-selector:${reason}`,
-    }))
-  }
-  if (currentUrl && isProviderSignInUrl(currentUrl)) {
-    selectorBlockers.push(blocker({
-      provider,
-      url,
-      kind: 'auth',
-      code: 'provider_sign_in_url',
-      family: 'provider_sign_in',
-      message: 'Provider sign-in URL is visible and requires the user.',
-      visibleProof: 'visible-provider-sign-in-url',
-    }))
-  }
-  const all = [
-    ...domBlockers.map((raw) => blocker({
-      provider,
-      url,
-      kind: raw.kind,
-      code: raw.code,
-      family: raw.family as VisibleBlocker['family'],
-      message: raw.message,
-      visibleProof: raw.proof,
-    })),
-    ...selectorBlockers,
-  ]
-  const seen = new Set<string>()
-  return all.filter((candidate) => {
-    const key = `${candidate.kind}:${candidate.code}:${candidate.visibleProof}`
-    if (seen.has(key)) return false
-    seen.add(key)
-    return true
-  })
-}
-
-function blocker(input: {
-  provider: ProviderConfig
-  url: string
-  kind: VisibleBlocker['kind']
-  code: string
-  message: string
-  visibleProof: string
-  family?: VisibleBlocker['family']
-}): VisibleBlocker {
-  const userResolvable = input.kind === 'challenge' || input.kind === 'auth'
-  return {
-    kind: input.kind,
-    code: input.code,
-    message: input.message,
-    userResolvable,
-    retryable: userResolvable,
-    visibleProof: input.visibleProof,
-    provider: input.provider.id,
-    url: sanitizeBlockerUrl(input.url),
-    ...(input.family ? { family: input.family } : {}),
-  }
-}
-
-async function inspectChoices(page: Page, provider: ProviderConfig, kind: 'model' | 'effort') {
-  const selectors = kind === 'model' ? provider.modelControlSelectors : provider.effortControlSelectors
-  if (selectors.length === 0) {
-    return {
-      supported: false as const,
-      reason: 'unsupported_by_provider' as const,
-    }
-  }
-  const trigger = await firstLocator(page, selectors)
-  if (!trigger) {
-    return {
-      supported: false as const,
-      reason: 'selector_not_available' as const,
-    }
-  }
-  await trigger.click({ timeout: 5000 })
-  const choices = await collectVisibleChoices(page)
-  return {
-    supported: true as const,
-    choices,
-  }
-}
-
-async function selectChoice(page: Page, provider: ProviderConfig, kind: 'model' | 'effort', label: unknown) {
-  if (typeof label !== 'string') {
-    throw new Error('Validated request payload unexpectedly lacked a label.')
-  }
-  const inspection = await inspectChoices(page, provider, kind)
-  if (!inspection.supported) return inspection
-  const choice = inspection.choices.find((candidate) => candidate.label === label && candidate.enabled)
-  if (!choice) {
-    return {
-      supported: true as const,
-      selectedLabel: '',
-      visibleProof: 'exact-label-not-found',
-    }
-  }
-  await page.getByText(label, { exact: true }).click({ timeout: 5000 })
-  return {
-    supported: true as const,
-    selectedLabel: label,
-    visibleProof: 'exact-label-selected',
-  }
-}
-
-async function uploadFiles(page: Page, provider: ProviderConfig, value: unknown, context: VisibleAdapterContext) {
-  if (!Array.isArray(value)) throw new Error('Validated request payload unexpectedly lacked attachments.')
-  const attachments = value.map((attachment) => validateAttachmentInput(attachment))
-  const fileInput = await firstLocator(page, provider.fileInputSelectors)
-  if (!fileInput) {
-    throw new Error('No visible provider file input is available.')
-  }
-  const files = await Promise.all(attachments.map((attachment) => resolveAttachmentPayload(context.attachmentRoot, attachment)))
-  await fileInput.setInputFiles(files)
-  return {
-    attachments: attachments.map((attachment) => ({
-      protocol: VISIBLE_ATTACHMENT_PROTOCOL_VERSION,
-      bundleId: attachment.bundleId,
-      attachmentId: attachment.attachmentId,
-      name: basename(attachment.name),
-      type: attachment.type,
-      size: attachment.size,
-      sha256: attachment.sha256,
-      visible: true as const,
-    })),
-  }
-}
-
-async function inputPrompt(page: Page, provider: ProviderConfig, text: unknown) {
-  if (typeof text !== 'string') throw new Error('Validated request payload unexpectedly lacked prompt text.')
-  if (provider.composerSettleMs > 0) await page.waitForTimeout(provider.composerSettleMs)
-  for (let attempt = 0; attempt < 12; attempt += 1) {
-    const composer = await firstLocator(page, provider.composerSelectors)
-    if (composer && await writeExactPrompt(page, composer, text)) {
-      return {
-        visible: true as const,
-        inputProof: 'prompt-text-visible',
-      }
-    }
-    if (attempt < 11) await page.waitForTimeout(1000)
-  }
-  throw new Error('No stable visible prompt input matched the requested text.')
-}
-
-async function clearPrompt(page: Page, provider: ProviderConfig) {
-  await inputPrompt(page, provider, '')
-  return {
-    visible: true as const,
-    inputProof: 'empty' as const,
-  }
-}
-
-async function submitPrompt(page: Page, provider: ProviderConfig) {
-  const button = await firstLocator(page, provider.submitSelectors)
-  if (!button) throw new Error('No visible submit control is available.')
-  await button.click({ timeout: 5000 })
-  return {
-    visible: true as const,
-    submissionProof: 'visible-submit-clicked',
-  }
-}
-
-async function readResponse(page: Page, provider: ProviderConfig) {
-  const answer = await latestLocator(page, provider.answerSelectors)
-  if (!answer) {
-    return {
-      text: '',
-      citations: [],
-      visibleProof: 'no-visible-answer',
-    }
-  }
-  const text = sanitizeVisibleText(await answer.innerText({ timeout: 5000 }))
-  const citations = await answer.locator('a[href]').evaluateAll((anchors) => anchors.slice(0, 24).map((anchor) => ({
-    label: (anchor.textContent ?? '').trim().slice(0, 120),
-    href: anchor instanceof HTMLAnchorElement ? anchor.href : '',
-  })).filter((entry) => entry.href.startsWith('https://'))) as VisibleCitation[]
-  return {
-    text,
-    citations,
-    visibleProof: 'visible-answer-read',
-  }
-}
-
-async function sanitizedSnapshot(page: Page) {
-  return await page.evaluate(() => {
-    const allowedRoles = new Set(['button', 'textbox', 'menuitem', 'option', 'combobox', 'listbox'])
-    const allowedInputTypes = new Set(['button', 'checkbox', 'email', 'file', 'number', 'password', 'radio', 'search', 'submit', 'tel', 'text', 'url'])
-    const controls = Array.from(document.querySelectorAll('button, [role="button"], input, textarea, select, [role="textbox"], [role="menuitem"], [role="option"]'))
-      .slice(0, 80)
-      .map((element) => {
-        const tag = element.tagName.toLowerCase()
-        const rawRole = (element.getAttribute('role') ?? '').toLowerCase()
-        const role = allowedRoles.has(rawRole) ? rawRole : undefined
-        const rawInputType = tag === 'input' ? (element.getAttribute('type') ?? 'text').toLowerCase() : ''
-        const inputType = allowedInputTypes.has(rawInputType) ? rawInputType : undefined
-        return {
-          tag: ['button', 'input', 'textarea', 'select'].includes(tag) ? tag : 'control',
-          ...(role ? { role } : {}),
-          ...(inputType ? { inputType } : {}),
-          disabled: element.hasAttribute('disabled') || element.getAttribute('aria-disabled') === 'true',
-          visible: !element.hasAttribute('hidden') && element.getAttribute('aria-hidden') !== 'true',
-        }
-      })
-    return {
-      page: {
-        origin: location.origin,
-      },
-      controls,
-    }
-  })
-}
-
-async function resolveAttachmentPayload(attachmentRoot: string | undefined, attachment: AttachmentInput) {
-  try {
-    return await resolveAttachmentPayloadUnsafe(attachmentRoot, attachment)
-  } catch (error) {
-    if (error instanceof TokenlessPlaywrightError) throw error
-    throw tokenlessError(
-      'invalid_visible_attachment',
-      'Attachment file cannot be resolved or verified.',
-      { cause: error }
-    )
-  }
-}
-
-async function resolveAttachmentPayloadUnsafe(attachmentRoot: string | undefined, attachment: AttachmentInput) {
-  if (attachmentRoot === undefined) {
-    throw tokenlessError('invalid_visible_attachment_root', 'Attachment root is required for visible file uploads.')
-  }
-  if (attachmentRoot.includes('\u0000')) {
-    throw tokenlessError('invalid_visible_attachment_root', 'Attachment root is invalid.')
-  }
-  const root = await realpath(resolve(attachmentRoot))
-  const file = resolve(root, attachment.bundleId, `${attachment.attachmentId}.bin`)
-  if (!isPathInside(root, file)) {
-    throw tokenlessError('invalid_visible_attachment', 'Attachment path escapes the attachment root.')
-  }
-  const noFollow = fsConstants.O_NOFOLLOW ?? 0
-  let handle: Awaited<ReturnType<typeof open>> | undefined
-  try {
-    const linked = await lstat(file)
-    if (linked.isSymbolicLink() || !linked.isFile()) {
-      throw tokenlessError('invalid_visible_attachment', 'Attachment file must be a regular non-symlink file.')
-    }
-    if (Number(linked.nlink) !== 1) {
-      throw tokenlessError('invalid_visible_attachment', 'Attachment file must not have hard links.')
-    }
-    handle = await open(file, fsConstants.O_RDONLY | noFollow)
-    const opened = await handle.stat()
-    if (!opened.isFile() || opened.dev !== linked.dev || opened.ino !== linked.ino) {
-      throw tokenlessError('invalid_visible_attachment', 'Attachment file changed while it was opened.')
-    }
-    if (Number(opened.nlink) !== 1) {
-      throw tokenlessError('invalid_visible_attachment', 'Attachment file must not have hard links.')
-    }
-    if (opened.size !== attachment.size) {
-      throw tokenlessError('invalid_visible_attachment', 'Attachment file size does not match its descriptor.')
-    }
-    const realFile = await realpath(file)
-    if (!isPathInside(root, realFile)) {
-      throw tokenlessError('invalid_visible_attachment', 'Attachment path escapes the attachment root.')
-    }
-    const buffer = await handle.readFile()
-    const digest = createHash('sha256').update(buffer).digest('hex')
-    if (digest !== attachment.sha256) {
-      throw tokenlessError('invalid_visible_attachment', 'Attachment file digest does not match its descriptor.')
-    }
-    return {
-      name: basename(attachment.name),
-      mimeType: attachment.type,
-      buffer,
-    }
-  } finally {
-    await handle?.close().catch(() => undefined)
-  }
-}
-
-function isPathInside(root: string, candidate: string) {
-  const normalizedRoot = resolve(root)
-  const normalizedCandidate = resolve(candidate)
-  return normalizedCandidate === normalizedRoot || normalizedCandidate.startsWith(`${normalizedRoot}${sep}`)
-}
-
-async function collectVisibleChoices(page: Page): Promise<Choice[]> {
-  const locators = [
-    page.locator('[role="menuitem"], [role="option"], [cmdk-item], button'),
-  ]
-  const choices: Choice[] = []
-  for (const locator of locators) {
-    const values = await locator.evaluateAll((elements) => elements.slice(0, 80).map((element) => {
-      const text = (element.textContent ?? '').replace(/\s+/g, ' ').trim()
-      const ariaSelected = element.getAttribute('aria-selected') === 'true' || element.getAttribute('data-state') === 'checked'
-      const disabled = element.hasAttribute('disabled') || element.getAttribute('aria-disabled') === 'true'
-      return {
-        label: text.slice(0, 120),
-        selected: ariaSelected,
-        enabled: !disabled,
-      }
-    }).filter((entry) => entry.label.length > 0))
-    choices.push(...values)
-  }
-  const seen = new Set<string>()
-  return choices.filter((choice) => {
-    if (seen.has(choice.label)) return false
-    seen.add(choice.label)
-    return true
-  })
-}
-
-async function anyVisible(page: Page, selectors: readonly string[]) {
-  for (const selector of selectors) {
-    if (await firstVisible(page, selector)) return true
-  }
-  return false
-}
-
-async function firstVisible(page: Page, selector: string) {
-  try {
-    return await page.locator(selector).first().isVisible({ timeout: 500 })
-  } catch {
-    return false
-  }
-}
-
-async function firstVisibleFast(page: Page, selector: string) {
-  try {
-    return await page.locator(selector).evaluateAll((elements) => elements.some((element) => {
-      if (!(element instanceof HTMLElement || element instanceof SVGElement)) return false
-      let node: Element | null = element
-      while (node && node instanceof Element) {
-        const style = window.getComputedStyle(node)
-        if (
-          style.visibility === 'hidden' ||
-          style.visibility === 'collapse' ||
-          style.display === 'none' ||
-          Number(style.opacity) === 0
-        ) return false
-        node = node.parentElement
-      }
-      const rect = element.getBoundingClientRect()
-      return rect.width > 0 && rect.height > 0
-    }))
-  } catch {
-    return false
-  }
-}
-
-async function firstLocator(page: Page, selectors: readonly string[]): Promise<Locator | null> {
-  for (const selector of selectors) {
-    const locator = page.locator(selector).filter({ visible: true }).first()
-    try {
-      if (await locator.isVisible({ timeout: 1000 })) return locator
-    } catch {
-      // Try the next selector.
-    }
-  }
-  return null
-}
-
-async function latestLocator(page: Page, selectors: readonly string[]): Promise<Locator | null> {
-  for (const selector of selectors) {
-    const locator = page.locator(selector)
-    try {
-      const count = await locator.count()
-      if (count > 0) return locator.nth(count - 1)
-    } catch {
-      // Try the next selector.
-    }
-  }
-  return null
-}
-
-async function composerHasExactText(locator: Locator, expected: string) {
-  try {
-    return await locator.evaluate((element, value) => {
-      const text = element instanceof HTMLTextAreaElement || element instanceof HTMLInputElement
-        ? element.value
-        : (element.textContent ?? '').replace(/\u00a0/g, ' ')
-      return text === value
-    }, expected)
-  } catch {
-    return false
-  }
-}
-
-async function writeExactPrompt(page: Page, composer: Locator, text: string) {
-  try {
-    await composer.fill(text, { timeout: 2000 })
-    if (await composerHasExactText(composer, text)) return true
-  } catch {
-    // Hydration can replace a visible fallback composer while it is being filled.
-  }
-  try {
-    if (!await composer.isVisible({ timeout: 250 })) return false
-    await composer.click({ timeout: 1000 })
-    await page.keyboard.press(process.platform === 'darwin' ? 'Meta+A' : 'Control+A')
-    await page.keyboard.type(text)
-    return await composerHasExactText(composer, text)
-  } catch {
-    return false
-  }
-}
-
-function sanitizeVisibleText(text: string) {
-  return text.replace(/\s+/g, ' ').trim().slice(0, 32_000)
-}
-
-function selectorReason(selector: string) {
-  if (/captcha/i.test(selector)) return 'captcha'
-  if (/rate limit|too many/i.test(selector)) return 'rate_limit'
-  if (/upgrade|paywall|subscribe/i.test(selector)) return 'upgrade_or_paywall'
-  return 'visible_blocker'
-}
-
-function safeUrl(value: string) {
-  try {
-    return new URL(value)
-  } catch {
-    return null
-  }
-}
-
-function isProviderSignInUrl(url: URL) {
-  const host = url.hostname.toLowerCase()
-  const path = url.pathname.toLowerCase()
-  return host === 'accounts.google.com' ||
-    host === 'auth.openai.com' ||
-    host === 'auth0.openai.com' ||
-    host === 'login.openai.com' ||
-    path.includes('/auth/login') ||
-    path.includes('/login') ||
-    path.includes('/signin') ||
-    path.includes('/sign-in')
-}
-
-function sanitizeBlockerUrl(value: string) {
-  try {
-    const url = new URL(value)
-    return url.origin
-  } catch {
-    return ''
-  }
-}
-
-function success(request: VisibleActionRequest, result: VisibleActionResult): VisibleActionResponse {
-  return {
-    protocol: VISIBLE_ACTION_PROTOCOL_VERSION,
-    requestId: request.requestId,
-    provider: request.provider,
-    action: request.action,
-    ok: true,
-    result,
-    error: null,
-  }
-}
-
-function failure(request: VisibleActionRequest, code: string, message: string, retryable: boolean): VisibleActionResponse {
-  return {
-    protocol: VISIBLE_ACTION_PROTOCOL_VERSION,
-    requestId: request.requestId,
-    provider: request.provider,
-    action: request.action,
-    ok: false,
-    result: null,
-    error: {
-      code,
-      message,
-      retryable,
-    },
-  }
-}
-
-function assertNotAborted(signal: AbortSignal | undefined) {
-  if (signal?.aborted) throw signal.reason instanceof Error ? signal.reason : new Error('Visible provider action was aborted.')
-}
diff --git a/packages/cli/src/playwright/adapters/types.ts b/packages/cli/src/playwright/adapters/types.ts
deleted file mode 100644
index 2c69e5b..0000000
--- a/packages/cli/src/playwright/adapters/types.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-import type { Page } from 'playwright-core'
-import type { VisibleActionRequest, VisibleActionResponse } from '../actions.js'
-import type { ProviderConfig, ProviderId } from '../providers.js'
-
-export type VisibleAdapterContext = {
-  profileId: string
-  operationId: string
-  attachmentRoot?: string
-  signal?: AbortSignal
-  now?: () => Date
-}
-
-export type ProviderAdapter = {
-  readonly provider: ProviderConfig
-  execute(page: Page, request: VisibleActionRequest, context: VisibleAdapterContext): Promise<VisibleActionResponse>
-}
-
-export type ProviderAdapterRegistry = {
-  list(): ProviderAdapter[]
-  get(providerId: ProviderId): ProviderAdapter | null
-  execute(page: Page, request: VisibleActionRequest, context: VisibleAdapterContext): Promise<VisibleActionResponse>
-}
diff --git a/packages/cli/src/playwright/browser/context-manager.ts b/packages/cli/src/playwright/browser/context-manager.ts
index 2cc3180..cc5c4fc 100644
--- a/packages/cli/src/playwright/browser/context-manager.ts
+++ b/packages/cli/src/playwright/browser/context-manager.ts
@@ -1,16 +1,32 @@
 import { chromium } from 'playwright-core'
+import { spawn } from 'node:child_process'
+import fs from 'node:fs/promises'
+import path from 'node:path'
 import {
   normalizeBrowserVisibility,
   resolveEffectiveBrowserVisibility,
 } from '../../browser-visibility.js'
 import { tokenlessError } from '../errors.js'
 import type { BrowserVisibility, EffectiveBrowserVisibility } from '../../browser-visibility.js'
-import type { BrowserContext, Page } from 'playwright-core'
+import type { Browser, BrowserContext, Page } from 'playwright-core'
+import type { ChildProcess } from 'node:child_process'
+import type { BrowserRuntimeBinding } from '../../browser-runtime/types.js'
+import type { BrowserConnectionMode } from '../../browser-connection-mode.js'
 
 export type ManagedBrowserProfile = {
   id: string
+  slug?: string | undefined
   directory: string
   lifecycle?: 'created' | 'importing' | 'ready' | 'removed' | 'failed'
+  runtimeBinding?: BrowserRuntimeBinding | undefined
+  proxy?: { server: string, bypass: readonly string[] } | null | undefined
+  lastObservedAuth?: Partial<Record<string, {
+    access: string
+    account?: {
+      subscription: string | null
+      tier: { class: string, label: string | null }
+    } | undefined
+  }>> | undefined
 }
 
 export type ManagedBrowserContext = {
@@ -18,11 +34,19 @@ export type ManagedBrowserContext = {
   browserVisibility: BrowserVisibility
   effectiveBrowserVisibility: EffectiveBrowserVisibility
   browserContext: BrowserContext
-  page(): Promise<Page>
+  acquirePage(request: ManagedPageRequest): Promise<Page>
+  acquireReservedPage(request: ManagedPageRequest): Promise<Page>
   switchVisibility(visibility: BrowserVisibility): Promise<ManagedBrowserContext>
   close(): Promise<void>
 }
 
+export type ManagedPagePolicy = 'preserve' | 'replace'
+
+export type ManagedPageRequest = {
+  key: string
+  policy?: ManagedPagePolicy | undefined
+}
+
 export type ManagedContextLauncher = (
   userDataDir: string,
   options: PersistentChromeLaunchOptions
@@ -30,18 +54,35 @@ export type ManagedContextLauncher = (
 
 export type PersistentChromeLaunchOptions = NonNullable<Parameters<typeof chromium.launchPersistentContext>[1]>
 
+export const MAX_ACTIVE_BROWSER_PROFILES = 4
+
+const KEYCHAIN_NEUTRAL_CHROMIUM_ARGUMENTS = [
+  '--password-store=basic',
+  '--use-mock-keychain',
+] as const
+
 export type PersistentContextManagerOptions = {
   maxContexts?: number
   launcher?: ManagedContextLauncher
+  connectionMode?: BrowserConnectionMode | undefined
   browser?: ManagedBrowserLaunchTarget
+  browserResolver?: ManagedBrowserResolver
   timers?: PersistentContextManagerTimers | undefined
 }
 
 export type ManagedBrowserLaunchTarget = {
   id: string
   executablePath?: string | undefined
+  e2eInspection?: boolean | undefined
+  e2eHostResolverRule?: string | undefined
+  runtimeId?: string | undefined
+  launchPolicy?: 'standard' | 'cloak' | 'test-profile' | undefined
 }
 
+export type ManagedBrowserResolver = (
+  profile: ManagedBrowserProfile,
+) => Promise<ManagedBrowserLaunchTarget>
+
 export type PersistentContextManagerTimers = {
   setTimeout(callback: () => void, ms: number): unknown
   clearTimeout(handle: unknown): void
@@ -57,9 +98,19 @@ type ActiveContext = {
   requestedVisibility: BrowserVisibility
   effectiveVisibility: EffectiveBrowserVisibility
   browserContext: BrowserContext
+  pagesByKey: Map<string, Page>
+  reservedPagesByKey: Map<string, Page>
+  closeBrowser: () => Promise<void>
+  closePromise?: Promise<void> | undefined
+  browserTarget: ManagedBrowserLaunchTarget
   closing: boolean
 }
 
+type LaunchedManagedContext = {
+  browserContext: BrowserContext
+  closeBrowser: () => Promise<void>
+}
+
 type ScheduledContextClose = {
   handle: unknown
   delayMs: number
@@ -69,7 +120,9 @@ type ScheduledContextClose = {
 export class PersistentContextManager {
   private readonly maxContexts: number
   private readonly launcher: ManagedContextLauncher
+  private readonly connectionMode: BrowserConnectionMode
   private readonly browser: ManagedBrowserLaunchTarget
+  private readonly browserResolver: ManagedBrowserResolver
   private readonly timers: PersistentContextManagerTimers
   private readonly contexts = new Map<string, ActiveContext>()
   private readonly lanes = new Map<string, Promise<unknown>>()
@@ -79,12 +132,17 @@ export class PersistentContextManager {
   private shuttingDown = false
 
   constructor(options: PersistentContextManagerOptions = {}) {
-    this.maxContexts = options.maxContexts ?? 4
+    this.maxContexts = options.maxContexts ?? MAX_ACTIVE_BROWSER_PROFILES
     this.launcher = options.launcher ?? ((userDataDir, launchOptions) => chromium.launchPersistentContext(userDataDir, launchOptions))
+    this.connectionMode = options.connectionMode ?? 'playwright'
     this.browser = normalizeManagedBrowserLaunchTarget(options.browser)
+    this.browserResolver = options.browserResolver ?? (async () => this.browser)
     this.timers = options.timers ?? nativeTimers()
-    if (!Number.isInteger(this.maxContexts) || this.maxContexts < 1 || this.maxContexts > 4) {
-      throw tokenlessError('invalid_context_limit', 'Managed Playwright context limit must be between one and four.')
+    if (!Number.isInteger(this.maxContexts) || this.maxContexts < 1 || this.maxContexts > MAX_ACTIVE_BROWSER_PROFILES) {
+      throw tokenlessError(
+        'invalid_context_limit',
+        `Managed Playwright context limit must be between one and ${MAX_ACTIVE_BROWSER_PROFILES}.`,
+      )
     }
   }
 
@@ -115,7 +173,7 @@ export class PersistentContextManager {
         return await operation(context)
       } catch (error) {
         if (isBrowserClosedError(error)) {
-          await this.closeProfile(profile.id)
+          await this.closeProfile(profile.id).catch(() => undefined)
           throw tokenlessError('playwright_browser_closed', 'The visible managed browser window was closed during the operation.', {
             retryable: true,
             cause: error,
@@ -140,8 +198,16 @@ export class PersistentContextManager {
     this.cancelScheduledClose(profile.id)
     const requestedVisibility = validateRequestedVisibility(visibility)
     const effectiveVisibility = resolveEffectiveBrowserVisibility(requestedVisibility)
+    const browserTarget = normalizeManagedBrowserLaunchTarget(await this.browserResolver(profile))
     const existing = this.contexts.get(profile.id)
-    if (existing && !existing.closing && existing.effectiveVisibility === effectiveVisibility) {
+    if (
+      existing &&
+      !existing.closing &&
+      isManagedBrowserConnected(existing) &&
+      existing.effectiveVisibility === effectiveVisibility &&
+      sameBrowserRuntime(existing.browserTarget, browserTarget) &&
+      sameBrowserProxy(existing.profile.proxy, profile.proxy)
+    ) {
       existing.profile = profile
       existing.requestedVisibility = requestedVisibility
       return this.wrap(existing)
@@ -152,20 +218,43 @@ export class PersistentContextManager {
         throw tokenlessError('playwright_manager_closed', 'Managed Playwright context manager is shutting down.', { retryable: true })
       }
       const current = this.contexts.get(profile.id)
-      if (current && !current.closing && current.effectiveVisibility === effectiveVisibility) {
+      if (
+        current &&
+        !current.closing &&
+        isManagedBrowserConnected(current) &&
+        current.effectiveVisibility === effectiveVisibility &&
+        sameBrowserRuntime(current.browserTarget, browserTarget) &&
+        sameBrowserProxy(current.profile.proxy, profile.proxy)
+      ) {
         current.profile = profile
         current.requestedVisibility = requestedVisibility
         return this.wrap(current)
       }
       if (current && !current.closing) {
         await this.closeActiveContext(profile.id, current)
+      } else if (current?.closePromise) {
+        await current.closePromise
       }
       if (this.contexts.size >= this.maxContexts) {
-        throw tokenlessError('playwright_context_limit_reached', 'Too many managed browser profiles are active.', { retryable: true })
+        throw tokenlessError(
+          'playwright_context_limit_reached',
+          'Too many managed browser profiles are active; existing profile browsers remain open.',
+          { retryable: true },
+        )
       }
-      const browserContext = await this.launcher(profile.directory, managedBrowserLaunchOptions(this.browser, requestedVisibility))
+      if (browserTarget.e2eInspection) {
+        await fs.unlink(path.join(profile.directory, 'DevToolsActivePort')).catch((error) => {
+          if (!isMissingFileError(error)) throw error
+        })
+      }
+      const launched = await this.launchContext(
+        profile.directory,
+        managedBrowserLaunchOptions(browserTarget, requestedVisibility, profile.proxy),
+        browserTarget,
+      )
+      const { browserContext } = launched
       if (this.shuttingDown) {
-        await browserContext.close().catch(() => undefined)
+        await launched.closeBrowser().catch(() => undefined)
         throw tokenlessError('playwright_manager_closed', 'Managed Playwright context manager is shutting down.', { retryable: true })
       }
       const active: ActiveContext = {
@@ -173,11 +262,15 @@ export class PersistentContextManager {
         requestedVisibility,
         effectiveVisibility,
         browserContext,
+        pagesByKey: new Map(),
+        reservedPagesByKey: new Map(),
+        closeBrowser: launched.closeBrowser,
+        browserTarget,
         closing: false,
       }
       this.contexts.set(profile.id, active)
       browserContext.once('close', () => {
-        if (this.contexts.get(profile.id) === active) this.contexts.delete(profile.id)
+        if (!active.closing) void this.closeActiveContext(profile.id, active).catch(() => undefined)
       })
       return this.wrap(active)
     })
@@ -227,7 +320,7 @@ export class PersistentContextManager {
         return
       }
       this.scheduledCloses.delete(profileId)
-      void this.closeActiveContext(profileId, active)
+      void this.closeActiveContext(profileId, active).catch(() => undefined)
     }, delayMs)
     unrefTimer(handle)
     this.scheduledCloses.set(profileId, {
@@ -251,25 +344,104 @@ export class PersistentContextManager {
       browserVisibility: active.requestedVisibility,
       effectiveBrowserVisibility: active.effectiveVisibility,
       browserContext: active.browserContext,
-      async page() {
-        const pages = active.browserContext.pages()
-        if (pages[0]) return pages[0]
-        return await active.browserContext.newPage()
+      async acquirePage(request) {
+        const key = validateManagedPageKey(request.key)
+        const policy = request.policy ?? 'preserve'
+        if (policy !== 'preserve' && policy !== 'replace') {
+          throw tokenlessError('invalid_managed_page_policy', 'Managed browser page policy must be preserve or replace.')
+        }
+        const existing = active.pagesByKey.get(key)
+        if (existing && !existing.isClosed()) return existing
+        if (existing) active.pagesByKey.delete(key)
+
+        const pages = active.browserContext.pages().filter((page) => !page.isClosed())
+        const claimedPages = new Set([
+          ...active.pagesByKey.values(),
+          ...active.reservedPagesByKey.values(),
+        ])
+        const replaceablePages = pages.filter((candidate) => !new Set(active.reservedPagesByKey.values()).has(candidate))
+        const page = policy === 'replace'
+          ? replaceablePages.at(-1) ?? await active.browserContext.newPage()
+          : pages.find((candidate) => !claimedPages.has(candidate) && candidate.url() === 'about:blank')
+            ?? await active.browserContext.newPage()
+        if (policy === 'replace') {
+          for (const [claimedKey, claimedPage] of active.pagesByKey) {
+            if (claimedPage === page) active.pagesByKey.delete(claimedKey)
+          }
+        }
+        active.pagesByKey.set(key, page)
+        page.once('close', () => {
+          if (active.pagesByKey.get(key) === page) active.pagesByKey.delete(key)
+        })
+        return page
+      },
+      async acquireReservedPage(request) {
+        const key = validateManagedPageKey(request.key)
+        if (!key.startsWith('tokenless:control-plane:')) {
+          throw tokenlessError('invalid_reserved_page_key', 'Reserved managed pages require a control-plane key.')
+        }
+        const existing = active.reservedPagesByKey.get(key)
+        if (existing && !existing.isClosed()) return existing
+        if (existing) active.reservedPagesByKey.delete(key)
+        const claimedPages = new Set([
+          ...active.pagesByKey.values(),
+          ...active.reservedPagesByKey.values(),
+        ])
+        const page = active.browserContext.pages()
+          .find((candidate) => !candidate.isClosed() && !claimedPages.has(candidate) && candidate.url() === 'about:blank')
+          ?? await active.browserContext.newPage()
+        active.reservedPagesByKey.set(key, page)
+        page.once('close', () => {
+          if (active.reservedPagesByKey.get(key) === page) active.reservedPagesByKey.delete(key)
+        })
+        return page
       },
       async switchVisibility(visibility) {
         return await manager.switchProfileVisibility(active.profile, visibility)
       },
       async close() {
-        await active.browserContext.close()
+        await manager.closeProfile(active.profile.id)
       },
     }
   }
 
   private async closeActiveContext(profileId: string, active: ActiveContext): Promise<void> {
     this.cancelScheduledClose(profileId)
-    active.closing = true
-    if (this.contexts.get(profileId) === active) this.contexts.delete(profileId)
-    await active.browserContext.close().catch(() => undefined)
+    if (!active.closePromise) {
+      active.closing = true
+      active.closePromise = active.closeBrowser()
+        .then(() => {
+          if (this.contexts.get(profileId) === active) this.contexts.delete(profileId)
+        })
+        .catch((error) => {
+          if (this.contexts.get(profileId) === active) {
+            if (isManagedBrowserConnected(active)) {
+              active.closing = false
+              active.closePromise = undefined
+            } else {
+              this.contexts.delete(profileId)
+            }
+          }
+          throw error
+        })
+    }
+    await active.closePromise
+  }
+
+  private async launchContext(
+    userDataDir: string,
+    launchOptions: PersistentChromeLaunchOptions,
+    browserTarget: ManagedBrowserLaunchTarget,
+  ): Promise<LaunchedManagedContext> {
+    assertKeychainNeutralE2ELaunch(launchOptions, browserTarget)
+    if (this.connectionMode === 'cdp') {
+      return await launchCdpManagedContext(userDataDir, launchOptions, browserTarget)
+    }
+    const browserContext = await this.launcher(userDataDir, launchOptions)
+    return {
+      browserContext,
+      closeBrowser: async () => await browserContext.close(),
+    }
   }
 
   private cancelScheduledClose(profileId: string): void {
@@ -293,42 +465,266 @@ export class PersistentContextManager {
   }
 }
 
+async function launchCdpManagedContext(
+  userDataDir: string,
+  launchOptions: PersistentChromeLaunchOptions,
+  browserTarget: ManagedBrowserLaunchTarget,
+): Promise<LaunchedManagedContext> {
+  const executablePath = browserTarget.executablePath
+  if (!executablePath) {
+    throw tokenlessError(
+      'cdp_browser_executable_required',
+      'CDP connection mode requires an explicit Chromium browser executable path.',
+    )
+  }
+  const endpointFile = path.join(userDataDir, 'DevToolsActivePort')
+  await fs.unlink(endpointFile).catch((error) => {
+    if (!isMissingFileError(error)) throw error
+  })
+  const browserProcess = spawn(executablePath, cdpChromiumArguments(userDataDir, launchOptions, browserTarget), {
+    stdio: 'ignore',
+  })
+  const browserExit = observeChildExit(browserProcess)
+  await waitForChildSpawn(browserProcess)
+
+  let connectedBrowser: Browser | undefined
+  try {
+    const endpoint = await waitForDevToolsEndpoint(endpointFile, browserExit)
+    connectedBrowser = await chromium.connectOverCDP(endpoint)
+    const contexts = connectedBrowser.contexts()
+    if (contexts.length !== 1 || !contexts[0]) {
+      throw new Error('CDP managed browser must expose exactly one persistent context.')
+    }
+    const browser = connectedBrowser
+    let closing: Promise<void> | undefined
+    return {
+      browserContext: contexts[0],
+      closeBrowser() {
+        closing ??= closeCdpManagedBrowser(browser, browserProcess, browserExit)
+        return closing
+      },
+    }
+  } catch (error) {
+    await closeCdpManagedBrowser(connectedBrowser, browserProcess, browserExit).catch(() => undefined)
+    throw error
+  }
+}
+
+function cdpChromiumArguments(
+  userDataDir: string,
+  launchOptions: PersistentChromeLaunchOptions,
+  browserTarget: ManagedBrowserLaunchTarget,
+) {
+  const configuredArgs = launchOptions.args ?? []
+  return [
+    ...baseCdpChromiumArguments(userDataDir, { ...launchOptions, args: [] }, browserTarget),
+    ...(launchOptions.headless ? ['--headless=new'] : []),
+    ...(configuredArgs.some((argument) => argument.startsWith('--remote-debugging-address='))
+      ? []
+      : ['--remote-debugging-address=127.0.0.1']),
+    ...(configuredArgs.some((argument) => argument.startsWith('--remote-debugging-port='))
+      ? []
+      : ['--remote-debugging-port=0']),
+    ...configuredArgs,
+    'about:blank',
+  ]
+}
+
+function baseCdpChromiumArguments(
+  userDataDir: string,
+  launchOptions: PersistentChromeLaunchOptions,
+  browserTarget: ManagedBrowserLaunchTarget,
+) {
+  return [
+    '--disable-background-networking',
+    '--disable-background-timer-throttling',
+    '--disable-backgrounding-occluded-windows',
+    '--disable-breakpad',
+    '--disable-component-update',
+    '--disable-default-apps',
+    '--disable-extensions',
+    '--disable-hang-monitor',
+    '--disable-popup-blocking',
+    '--disable-prompt-on-repost',
+    '--disable-renderer-backgrounding',
+    ...(browserTarget.launchPolicy === 'cloak' ? [] : ['--enable-automation']),
+    '--metrics-recording-only',
+    '--no-service-autorun',
+    ...(launchOptions.args ?? []),
+    `--user-data-dir=${userDataDir}`,
+  ]
+}
+
+async function closeCdpManagedBrowser(
+  browser: Browser | undefined,
+  browserProcess: ChildProcess,
+  browserExit: ReturnType<typeof observeChildExit>,
+) {
+  if (browser?.isConnected()) {
+    try {
+      const session = await browser.newBrowserCDPSession()
+      await session.send('Browser.close')
+    } catch {
+      await browser.close().catch(() => undefined)
+    }
+  }
+  const exited = await Promise.race([
+    browserExit.promise.then(() => true),
+    delay(5_000).then(() => false),
+  ])
+  if (!exited && browserProcess.exitCode === null && browserProcess.signalCode === null) {
+    browserProcess.kill('SIGTERM')
+    const terminated = await Promise.race([
+      browserExit.promise.then(() => true),
+      delay(2_000).then(() => false),
+    ])
+    if (!terminated && browserProcess.exitCode === null && browserProcess.signalCode === null) {
+      browserProcess.kill('SIGKILL')
+      const killed = await Promise.race([
+        browserExit.promise.then(() => true),
+        delay(2_000).then(() => false),
+      ])
+      if (!killed && browserProcess.exitCode === null && browserProcess.signalCode === null) {
+        throw tokenlessError(
+          'playwright_browser_close_failed',
+          'The managed Chromium browser did not exit after shutdown.',
+          { retryable: true },
+        )
+      }
+    }
+  }
+}
+
+async function waitForChildSpawn(child: ChildProcess) {
+  if (child.pid) return
+  await new Promise<void>((resolve, reject) => {
+    child.once('spawn', resolve)
+    child.once('error', reject)
+  })
+}
+
+function observeChildExit(child: ChildProcess) {
+  let result: { code: number | null, signal: NodeJS.Signals | null } | undefined
+  const promise = new Promise<{ code: number | null, signal: NodeJS.Signals | null }>((resolve) => {
+    child.once('exit', (code, signal) => {
+      result = { code, signal }
+      resolve(result)
+    })
+  })
+  return {
+    promise,
+    result: () => result,
+  }
+}
+
+async function waitForDevToolsEndpoint(
+  endpointFile: string,
+  launcherExit: ReturnType<typeof observeChildExit>,
+) {
+  const deadline = Date.now() + 30_000
+  while (Date.now() <= deadline) {
+    const exited = launcherExit.result()
+    if (exited) {
+      throw new Error(`CDP managed browser exited before DevTools was ready (code ${exited.code}, signal ${exited.signal}).`)
+    }
+    try {
+      const [port, websocketPath] = (await fs.readFile(endpointFile, 'utf8')).trim().split(/\r?\n/u)
+      if (/^\d+$/u.test(port ?? '') && /^\/devtools\/browser\/[A-Za-z0-9-]+$/u.test(websocketPath ?? '')) {
+        return `http://127.0.0.1:${port}`
+      }
+    } catch (error) {
+      if (!isMissingFileError(error)) throw error
+    }
+    await delay(50)
+  }
+  throw new Error('Timed out waiting for the CDP managed browser DevTools endpoint.')
+}
+
 export function managedBrowserLaunchOptions(
   browser: ManagedBrowserLaunchTarget = { id: 'chrome' },
-  visibility: BrowserVisibility = 'headed'
+  visibility: BrowserVisibility = 'headed',
+  proxy?: ManagedBrowserProfile['proxy'],
 ): PersistentChromeLaunchOptions {
   const normalized = normalizeManagedBrowserLaunchTarget(browser)
   const effectiveVisibility = resolveEffectiveBrowserVisibility(validateRequestedVisibility(visibility))
   const executable = normalized.id === 'chrome'
-    ? { channel: 'chrome' as const }
+    ? (normalized.executablePath
+        ? { executablePath: normalized.executablePath }
+        : { channel: 'chrome' as const })
     : normalized.id === 'edge'
-      ? { channel: 'msedge' as const }
+      ? (normalized.executablePath
+          ? { executablePath: normalized.executablePath }
+          : { channel: 'msedge' as const })
       : { executablePath: normalized.executablePath as string }
-  return {
+  const launchOptions: PersistentChromeLaunchOptions = {
     ...executable,
     headless: effectiveVisibility === 'headless',
     chromiumSandbox: true,
-    ignoreDefaultArgs: [
-      '--password-store=basic',
-      '--use-mock-keychain',
-    ],
     args: [
       '--disable-sync',
       '--no-first-run',
       '--no-default-browser-check',
+      ...KEYCHAIN_NEUTRAL_CHROMIUM_ARGUMENTS,
+      ...(normalized.e2eInspection
+        ? [
+            '--remote-debugging-address=127.0.0.1',
+            '--remote-debugging-port=0',
+            ...(normalized.e2eHostResolverRule
+              ? [`--host-resolver-rules=${normalized.e2eHostResolverRule}`]
+              : []),
+          ]
+        : []),
     ],
   }
+  if (normalized.launchPolicy === 'cloak') {
+    launchOptions.ignoreDefaultArgs = ['--enable-automation', '--enable-unsafe-swiftshader']
+  }
+  if (proxy) {
+    launchOptions.proxy = {
+      server: proxy.server,
+      ...(proxy.bypass.length > 0 ? { bypass: proxy.bypass.join(',') } : {}),
+    }
+  }
+  return launchOptions
+}
+
+function assertKeychainNeutralE2ELaunch(
+  launchOptions: PersistentChromeLaunchOptions,
+  browserTarget: ManagedBrowserLaunchTarget,
+) {
+  if (!browserTarget.e2eInspection) return
+  const args = new Set(launchOptions.args ?? [])
+  for (const required of KEYCHAIN_NEUTRAL_CHROMIUM_ARGUMENTS) {
+    if (!args.has(required)) {
+      throw tokenlessError(
+        'e2e_keychain_neutral_launch_required',
+        `Browser E2E requires ${required} before the browser process can start.`,
+      )
+    }
+  }
 }
 
 export function chromeLaunchOptions(): PersistentChromeLaunchOptions {
   return managedBrowserLaunchOptions({ id: 'chrome' })
 }
 
+function sameBrowserProxy(
+  left: ManagedBrowserProfile['proxy'],
+  right: ManagedBrowserProfile['proxy'],
+) {
+  if (!left || !right) return !left && !right
+  return left.server === right.server && left.bypass.join('\n') === right.bypass.join('\n')
+}
+
+function isManagedBrowserConnected(active: ActiveContext) {
+  return active.browserContext.browser()?.isConnected() === true
+}
+
 function normalizeManagedBrowserLaunchTarget(
   browser: ManagedBrowserLaunchTarget | undefined
 ): ManagedBrowserLaunchTarget {
   const id = String(browser?.id ?? 'chrome').trim().toLowerCase()
-  if (!['chrome', 'brave', 'edge', 'arc', 'chromium', 'chrome-for-testing', 'profile'].includes(id)) {
+  if (!['chrome', 'brave', 'edge', 'arc', 'chromium', 'chrome-for-testing', 'managed-chromium', 'cloak', 'profile'].includes(id)) {
     throw tokenlessError('unsupported_managed_browser', `Managed Playwright does not support browser '${id}'.`)
   }
   const executablePath = browser?.executablePath?.trim()
@@ -338,7 +734,35 @@ function normalizeManagedBrowserLaunchTarget(
       `Managed Playwright requires an executable path for browser '${id}'.`
     )
   }
-  return executablePath ? { id, executablePath } : { id }
+  const e2eHostResolverRule = browser?.e2eHostResolverRule?.trim()
+  if (e2eHostResolverRule && !browser?.e2eInspection) {
+    throw tokenlessError(
+      'invalid_e2e_host_resolver_rule',
+      'A managed browser host resolver rule is allowed only during E2E inspection.',
+    )
+  }
+  if (e2eHostResolverRule && !/^MAP [a-z0-9.-]+ (?:\d{1,3}\.){3}\d{1,3}$/u.test(e2eHostResolverRule)) {
+    throw tokenlessError(
+      'invalid_e2e_host_resolver_rule',
+      'The E2E host resolver rule must be a normalized MAP hostname IPv4 value.',
+    )
+  }
+  return {
+    id,
+    ...(executablePath ? { executablePath } : {}),
+    ...(browser?.e2eInspection ? { e2eInspection: true } : {}),
+    ...(e2eHostResolverRule ? { e2eHostResolverRule } : {}),
+    ...(browser?.runtimeId ? { runtimeId: browser.runtimeId } : {}),
+    ...(browser?.launchPolicy ? { launchPolicy: browser.launchPolicy } : {}),
+  }
+}
+
+function sameBrowserRuntime(left: ManagedBrowserLaunchTarget, right: ManagedBrowserLaunchTarget) {
+  const inspectionMatches = left.e2eInspection === right.e2eInspection &&
+    left.e2eHostResolverRule === right.e2eHostResolverRule
+  if (!inspectionMatches) return false
+  if (left.runtimeId || right.runtimeId) return left.runtimeId === right.runtimeId
+  return left.id === right.id && left.executablePath === right.executablePath
 }
 
 function normalizeRunWithProfileArgs<T>(
@@ -360,6 +784,21 @@ function normalizeRunWithProfileArgs<T>(
   }
 }
 
+function validateManagedPageKey(value: unknown) {
+  if (
+    typeof value !== 'string' ||
+    value.length === 0 ||
+    Buffer.byteLength(value, 'utf8') > 512 ||
+    /[\u0000-\u001f\u007f]/u.test(value)
+  ) {
+    throw tokenlessError(
+      'invalid_managed_page_key',
+      'Managed browser page key must be a non-empty bounded string without control characters.',
+    )
+  }
+  return value
+}
+
 function validateRequestedVisibility(value: unknown): BrowserVisibility {
   const visibility = normalizeBrowserVisibility(value)
   if (!visibility) {
@@ -393,7 +832,15 @@ function unrefTimer(handle: unknown) {
   }
 }
 
+function delay(ms: number) {
+  return new Promise<void>((resolve) => setTimeout(resolve, ms))
+}
+
 export function isBrowserClosedError(error: unknown) {
   if (!(error instanceof Error)) return false
   return /browser.*closed|context.*closed|target.*closed|page.*closed/i.test(error.message)
 }
+
+function isMissingFileError(error: unknown): error is NodeJS.ErrnoException {
+  return error instanceof Error && 'code' in error && error.code === 'ENOENT'
+}
diff --git a/packages/cli/src/playwright/context-envelope.ts b/packages/cli/src/playwright/context-envelope.ts
new file mode 100644
index 0000000..7afba00
--- /dev/null
+++ b/packages/cli/src/playwright/context-envelope.ts
@@ -0,0 +1,271 @@
+import { createHash } from 'node:crypto'
+import { tokenlessError } from './errors.js'
+import { VISIBLE_ACTIONS } from '../providers/contracts.js'
+import type { TaskCapabilityId } from '../providers/task-capabilities.js'
+import type { VisibleActionRequest } from '../providers/contracts.js'
+
+export const CONTEXT_ENVELOPE_SCHEMA_ID = 'tokenless.context-envelope.v1' as const
+
+export type ContextInstruction = Readonly<{
+  role: 'system' | 'developer' | 'user'
+  content: string
+  provenance: 'compiled_cli' | 'caller' | 'upstream_agent'
+}>
+
+export type ContextReference = Readonly<{
+  kind: 'attachment'
+  attachmentId: string
+  name: string
+  mediaType: string
+  size: number
+  sha256: string
+  provenance: 'caller_selected_file'
+}>
+
+export type ContextEnvelope = Readonly<{
+  schema: typeof CONTEXT_ENVELOPE_SCHEMA_ID
+  taskId: string | null
+  requirements: readonly TaskCapabilityId[]
+  instructions: readonly ContextInstruction[]
+  references: readonly ContextReference[]
+  outputContract: Readonly<{
+    language: 'en' | 'zh-CN' | null
+    format: string | null
+  }>
+  constraints: Readonly<{
+    tokenBudget: number | null
+    deadline: string | null
+  }>
+  upstream: Readonly<{
+    agentKind: string | null
+    sessionId: string | null
+    state: Readonly<Record<string, unknown>> | null
+  }>
+  delivery: Readonly<{
+    mode: 'visible_actions'
+    promptActions: readonly Readonly<{
+      requestId: string
+      sha256: string
+      bytes: number
+    }>[]
+  }>
+}>
+
+export function createContextEnvelope(options: {
+  taskId: string | null
+  requirements: readonly TaskCapabilityId[]
+  actions: readonly VisibleActionRequest[]
+  language?: 'en' | 'zh-CN' | null | undefined
+}): ContextEnvelope {
+  const prompts = promptActions(options.actions)
+  return Object.freeze({
+    schema: CONTEXT_ENVELOPE_SCHEMA_ID,
+    taskId: options.taskId,
+    requirements: Object.freeze([...options.requirements]),
+    instructions: Object.freeze(prompts.map(({ text }) => Object.freeze({
+      role: 'user' as const,
+      content: text,
+      provenance: 'compiled_cli' as const,
+    }))),
+    references: Object.freeze(attachmentReferences(options.actions)),
+    outputContract: Object.freeze({ language: options.language ?? null, format: null }),
+    constraints: Object.freeze({ tokenBudget: null, deadline: null }),
+    upstream: Object.freeze({ agentKind: null, sessionId: null, state: null }),
+    delivery: Object.freeze({
+      mode: 'visible_actions' as const,
+      promptActions: Object.freeze(prompts.map(({ requestId, text }) => Object.freeze({
+        requestId,
+        sha256: sha256(text),
+        bytes: Buffer.byteLength(text, 'utf8'),
+      }))),
+    }),
+  })
+}
+
+export function validateContextEnvelope(
+  value: unknown,
+  expected: {
+    taskId: string | null
+    requirements: readonly TaskCapabilityId[]
+    actions: readonly VisibleActionRequest[]
+  },
+): ContextEnvelope {
+  const input = record(value)
+  if (!input) throw invalidContext('Context envelope must be an object.')
+  requireExactKeys(input, [
+    'schema',
+    'taskId',
+    'requirements',
+    'instructions',
+    'references',
+    'outputContract',
+    'constraints',
+    'upstream',
+    'delivery',
+  ])
+  if (input.schema !== CONTEXT_ENVELOPE_SCHEMA_ID || input.taskId !== expected.taskId) {
+    throw invalidContext('Context envelope identity does not match the managed job.')
+  }
+  if (!sameStringArray(input.requirements, expected.requirements)) {
+    throw invalidContext('Context envelope requirements do not match the capability route.')
+  }
+  if (!Array.isArray(input.instructions) || input.instructions.length > 32) {
+    throw invalidContext('Context envelope instructions must contain at most thirty-two entries.')
+  }
+  const instructions = input.instructions.map(validateInstruction)
+  const prompts = promptActions(expected.actions)
+  const deliveredText = prompts.map(({ text }) => text).join('\n')
+  if (instructions.some((instruction) => !deliveredText.includes(instruction.content))) {
+    throw invalidContext('Every context instruction must be present in a delivered prompt action.')
+  }
+  const expectedReferences = attachmentReferences(expected.actions)
+  if (JSON.stringify(input.references) !== JSON.stringify(expectedReferences)) {
+    throw invalidContext('Context envelope references do not match staged attachment actions.')
+  }
+  const outputContract = validateOutputContract(input.outputContract)
+  const constraints = validateConstraints(input.constraints)
+  const upstream = validateUpstream(input.upstream)
+  const delivery = validateDelivery(input.delivery, prompts)
+  return Object.freeze({
+    schema: CONTEXT_ENVELOPE_SCHEMA_ID,
+    taskId: expected.taskId,
+    requirements: Object.freeze([...expected.requirements]),
+    instructions: Object.freeze(instructions),
+    references: Object.freeze(expectedReferences),
+    outputContract,
+    constraints,
+    upstream,
+    delivery,
+  })
+}
+
+function validateInstruction(value: unknown): ContextInstruction {
+  const input = record(value)
+  if (!input) throw invalidContext('Context instruction must be an object.')
+  requireExactKeys(input, ['role', 'content', 'provenance'])
+  if (input.role !== 'system' && input.role !== 'developer' && input.role !== 'user') {
+    throw invalidContext('Context instruction role is invalid.')
+  }
+  if (typeof input.content !== 'string' || input.content.length === 0 || Buffer.byteLength(input.content, 'utf8') > 1_000_000) {
+    throw invalidContext('Context instruction content is invalid.')
+  }
+  if (input.provenance !== 'compiled_cli' && input.provenance !== 'caller' && input.provenance !== 'upstream_agent') {
+    throw invalidContext('Context instruction provenance is invalid.')
+  }
+  return Object.freeze({ role: input.role, content: input.content, provenance: input.provenance })
+}
+
+function validateOutputContract(value: unknown): ContextEnvelope['outputContract'] {
+  const input = record(value)
+  if (!input) throw invalidContext('Context output contract must be an object.')
+  requireExactKeys(input, ['language', 'format'])
+  if (input.language !== null && input.language !== 'en' && input.language !== 'zh-CN') {
+    throw invalidContext('Context output language is invalid.')
+  }
+  if (input.format !== null && (typeof input.format !== 'string' || input.format.length === 0 || input.format.length > 120)) {
+    throw invalidContext('Context output format is invalid.')
+  }
+  return Object.freeze({ language: input.language, format: input.format as string | null })
+}
+
+function validateConstraints(value: unknown): ContextEnvelope['constraints'] {
+  const input = record(value)
+  if (!input) throw invalidContext('Context constraints must be an object.')
+  requireExactKeys(input, ['tokenBudget', 'deadline'])
+  if (input.tokenBudget !== null && (!Number.isInteger(input.tokenBudget) || Number(input.tokenBudget) <= 0)) {
+    throw invalidContext('Context token budget is invalid.')
+  }
+  if (input.deadline !== null && (typeof input.deadline !== 'string' || !Number.isFinite(Date.parse(input.deadline)))) {
+    throw invalidContext('Context deadline is invalid.')
+  }
+  return Object.freeze({ tokenBudget: input.tokenBudget as number | null, deadline: input.deadline as string | null })
+}
+
+function validateUpstream(value: unknown): ContextEnvelope['upstream'] {
+  const input = record(value)
+  if (!input) throw invalidContext('Context upstream state must be an object.')
+  requireExactKeys(input, ['agentKind', 'sessionId', 'state'])
+  for (const field of ['agentKind', 'sessionId'] as const) {
+    const entry = input[field]
+    if (entry !== null && (typeof entry !== 'string' || entry.length === 0 || entry.length > 240)) {
+      throw invalidContext(`Context upstream ${field} is invalid.`)
+    }
+  }
+  const state = input.state === null ? null : record(input.state)
+  if (input.state !== null && !state) throw invalidContext('Context upstream state must be a JSON object or null.')
+  if (state && Buffer.byteLength(JSON.stringify(state), 'utf8') > 256_000) {
+    throw invalidContext('Context upstream state is too large.')
+  }
+  return Object.freeze({
+    agentKind: input.agentKind as string | null,
+    sessionId: input.sessionId as string | null,
+    state: state ? Object.freeze({ ...state }) : null,
+  })
+}
+
+function validateDelivery(value: unknown, prompts: ReturnType<typeof promptActions>): ContextEnvelope['delivery'] {
+  const input = record(value)
+  if (!input) throw invalidContext('Context delivery receipt must be an object.')
+  requireExactKeys(input, ['mode', 'promptActions'])
+  if (input.mode !== 'visible_actions' || !Array.isArray(input.promptActions)) {
+    throw invalidContext('Context delivery receipt is invalid.')
+  }
+  const expected = prompts.map(({ requestId, text }) => ({
+    requestId,
+    sha256: sha256(text),
+    bytes: Buffer.byteLength(text, 'utf8'),
+  }))
+  if (JSON.stringify(input.promptActions) !== JSON.stringify(expected)) {
+    throw invalidContext('Context delivery receipt does not match prompt actions.')
+  }
+  return Object.freeze({
+    mode: 'visible_actions',
+    promptActions: Object.freeze(expected.map((entry) => Object.freeze(entry))),
+  })
+}
+
+function promptActions(actions: readonly VisibleActionRequest[]) {
+  return actions.flatMap((action) => action.action === VISIBLE_ACTIONS.PROMPT_INPUT
+    ? [{ requestId: action.requestId, text: action.payload.text }]
+    : [])
+}
+
+function attachmentReferences(actions: readonly VisibleActionRequest[]): ContextReference[] {
+  return actions.flatMap((action) => action.action === VISIBLE_ACTIONS.FILE_UPLOAD
+    ? action.payload.attachments.map((attachment) => Object.freeze({
+        kind: 'attachment' as const,
+        attachmentId: attachment.attachmentId,
+        name: attachment.name,
+        mediaType: attachment.type,
+        size: attachment.size,
+        sha256: attachment.sha256,
+        provenance: 'caller_selected_file' as const,
+      }))
+    : [])
+}
+
+function sameStringArray(value: unknown, expected: readonly string[]) {
+  return Array.isArray(value) && value.length === expected.length && value.every((entry, index) => entry === expected[index])
+}
+
+function sha256(value: string) {
+  return createHash('sha256').update(value, 'utf8').digest('hex')
+}
+
+function requireExactKeys(value: Record<string, unknown>, expected: readonly string[]) {
+  const actual = Object.keys(value).sort()
+  const sorted = [...expected].sort()
+  if (actual.length !== sorted.length || actual.some((key, index) => key !== sorted[index])) {
+    throw invalidContext(`Context envelope fields must be exactly: ${expected.join(', ')}.`)
+  }
+}
+
+function record(value: unknown): Record<string, unknown> | null {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null
+  const prototype = Object.getPrototypeOf(value)
+  return prototype === Object.prototype || prototype === null ? value as Record<string, unknown> : null
+}
+
+function invalidContext(message: string) {
+  return tokenlessError('invalid_context_envelope', message)
+}
diff --git a/packages/cli/src/playwright/daemon-client.ts b/packages/cli/src/playwright/daemon-client.ts
index 3ee2600..c9a06d5 100644
--- a/packages/cli/src/playwright/daemon-client.ts
+++ b/packages/cli/src/playwright/daemon-client.ts
@@ -1,29 +1,7 @@
-import fs from 'node:fs/promises'
-import os from 'node:os'
-import path from 'node:path'
-import { tokenlessError } from './errors.js'
-import type { BrowserVisibility } from '../browser-visibility.js'
+import type { DaemonJob } from '../daemon-client.js'
+import type { ProviderCapacityProjection } from '../providers/rate-limit-policy.js'
 
-export const DEFAULT_DAEMON_URL = 'http://127.0.0.1:7331' as const
-const DEFAULT_DAEMON_REQUEST_TIMEOUT_MS = 5_000
-
-export type DaemonJobStatus = 'queued' | 'claimed' | 'running' | 'waiting_for_user' | 'succeeded' | 'failed' | 'canceled' | 'timed_out'
-export type DaemonExecutionBackend = 'legacy_extension' | 'playwright'
-
-export type DaemonJob = {
-  job_id: string
-  execution_backend: DaemonExecutionBackend
-  profile_id: string | null
-  provider: string
-  action: string
-  status: DaemonJobStatus
-  request_json: unknown
-  result_json: unknown | null
-  error_json: unknown | null
-  blocker_json: unknown | null
-  created_at: string
-  updated_at: string
-}
+export type { DaemonJob } from '../daemon-client.js'
 
 export type DaemonClaimedJob = DaemonJob & {
   claim_token: string
@@ -31,381 +9,69 @@ export type DaemonClaimedJob = DaemonJob & {
   resume_json: unknown | null
 }
 
-export type DaemonClientOptions = {
-  daemonUrl?: string | undefined
-  homeDir?: string | undefined
-  requestTimeoutMs?: number | undefined
-  signal?: AbortSignal | undefined
-  token?: string | undefined
-  fetchImpl?: typeof fetch | undefined
-}
-
-export type CreateDaemonJobOptions = DaemonClientOptions & {
-  provider: string
-  action: string
-  requestJson: unknown
-  executionBackend?: DaemonExecutionBackend | undefined
-  profileId?: string | undefined
-  jobId?: string | undefined
-  claimToken?: string | undefined
-}
-
-export type ListDaemonJobsOptions = DaemonClientOptions & {
-  status?: DaemonJobStatus | undefined
-  executionBackend?: DaemonExecutionBackend | undefined
-  profileId?: string | undefined
-  provider?: string | undefined
-  taskId?: string | undefined
-  limit?: number | undefined
-}
-
-export type GetDaemonJobOptions = DaemonClientOptions & {
+type JobOptions = {
   jobId: string
+  signal?: AbortSignal | undefined
 }
 
-export type ClaimNextDaemonJobOptions = DaemonClientOptions & {
-  executionBackend: DaemonExecutionBackend
-  profileId?: string | undefined
-  provider?: string | undefined
-  action?: string | undefined
-}
-
-export type ClaimLifecycleDaemonJobOptions = GetDaemonJobOptions & {
+type ClaimedJobOptions = JobOptions & {
   claimToken: string
 }
 
-export type WaitingForUserDaemonJobOptions = ClaimLifecycleDaemonJobOptions & {
-  blocker: unknown
-}
-
-export type CompleteDaemonJobOptions = ClaimLifecycleDaemonJobOptions & {
-  result?: unknown
-  error?: unknown
-}
-
-export type CheckpointDaemonJobOptions = ClaimLifecycleDaemonJobOptions & {
-  checkpoint: unknown
-}
-
-export type ParkDaemonJobOptions = ClaimLifecycleDaemonJobOptions & {
-  blocker: unknown
-  checkpoint: unknown
-}
-
-export type ResumeDaemonJobOptions = GetDaemonJobOptions & {
-  browserVisibility: Extract<BrowserVisibility, 'headed'>
-}
-
-export type CancelDaemonJobOptions = GetDaemonJobOptions & {
-  reason?: unknown
-}
-
 export type ManagedDaemonClient = {
-  createJob(options: CreateDaemonJobOptions): Promise<DaemonClaimedJob>
-  listJobs(options?: ListDaemonJobsOptions): Promise<DaemonJob[]>
-  getJob(options: GetDaemonJobOptions): Promise<DaemonJob>
-  claimNextJob(options: ClaimNextDaemonJobOptions): Promise<{ job: DaemonClaimedJob | null }>
-  markJobRunning(options: ClaimLifecycleDaemonJobOptions): Promise<DaemonJob>
-  markJobWaitingForUser(options: WaitingForUserDaemonJobOptions): Promise<DaemonJob>
-  checkpointJob(options: CheckpointDaemonJobOptions): Promise<DaemonJob>
-  parkJob(options: ParkDaemonJobOptions): Promise<DaemonJob>
-  resumeJob(options: ResumeDaemonJobOptions): Promise<DaemonJob>
-  renewJobClaim(options: ClaimLifecycleDaemonJobOptions): Promise<DaemonJob>
-  completeJob(options: CompleteDaemonJobOptions): Promise<DaemonJob>
-  cancelJob(options: CancelDaemonJobOptions): Promise<DaemonJob>
-}
-
-export function tokenlessHome(explicitHome = process.env.TOKENLESS_HOME) {
-  return path.resolve(explicitHome || path.join(os.homedir(), '.tokenless'))
-}
-
-export function daemonUrl(explicitUrl?: string | undefined) {
-  const value = explicitUrl || process.env.TOKENLESS_DAEMON_URL || DEFAULT_DAEMON_URL
-  const normalized = value.replace(/\/+$/, '')
-  validateDaemonUrl(normalized)
-  return normalized
-}
-
-export async function readDaemonToken({ homeDir = tokenlessHome() }: Pick<DaemonClientOptions, 'homeDir'> = {}) {
-  let token: string
-  try {
-    token = (await fs.readFile(path.join(homeDir, 'daemon.token'), 'utf8')).trim()
-  } catch (error) {
-    throw tokenlessError('daemon_token_unavailable', 'Tokenless daemon control token is unavailable.', { retryable: true, cause: error })
-  }
-  if (!token) throw tokenlessError('daemon_token_unavailable', 'Tokenless daemon control token is empty.', { retryable: true })
-  return token
-}
-
-export function createDaemonClient(defaults: DaemonClientOptions = {}): ManagedDaemonClient {
-  return {
-    createJob: (options) => createDaemonJob({ ...defaults, ...options }),
-    listJobs: (options = {}) => listDaemonJobs({ ...defaults, ...options }),
-    getJob: (options) => getDaemonJob({ ...defaults, ...options }),
-    claimNextJob: (options) => claimNextDaemonJob({ ...defaults, ...options }),
-    markJobRunning: (options) => markDaemonJobRunning({ ...defaults, ...options }),
-    markJobWaitingForUser: (options) => markDaemonJobWaitingForUser({ ...defaults, ...options }),
-    checkpointJob: (options) => checkpointDaemonJob({ ...defaults, ...options }),
-    parkJob: (options) => parkDaemonJob({ ...defaults, ...options }),
-    resumeJob: (options) => resumeDaemonJob({ ...defaults, ...options }),
-    renewJobClaim: (options) => renewDaemonJobClaim({ ...defaults, ...options }),
-    completeJob: (options) => completeDaemonJob({ ...defaults, ...options }),
-    cancelJob: (options) => cancelDaemonJob({ ...defaults, ...options }),
-  }
-}
-
-export async function createDaemonJob({
-  provider,
-  action,
-  requestJson,
-  executionBackend,
-  profileId,
-  jobId,
-  claimToken,
-  ...options
-}: CreateDaemonJobOptions) {
-  return daemonRequest<DaemonClaimedJob>({
-    ...options,
-    path: '/jobs',
-    body: {
-      provider,
-      action,
-      request_json: requestJson,
-      execution_backend: executionBackend,
-      profile_id: profileId,
-      job_id: jobId,
-      claim_token: claimToken,
-    },
-  })
-}
-
-export async function listDaemonJobs({
-  status,
-  executionBackend,
-  profileId,
-  provider,
-  taskId,
-  limit = 100,
-  ...options
-}: ListDaemonJobsOptions = {}) {
-  const query = new URLSearchParams()
-  if (status) query.set('status', status)
-  if (executionBackend) query.set('execution_backend', executionBackend)
-  if (profileId) query.set('profile_id', profileId)
-  if (provider) query.set('provider', provider)
-  if (taskId) query.set('task_id', taskId)
-  query.set('limit', String(Math.max(1, Math.min(1000, Number(limit) || 100))))
-  return daemonRequest<DaemonJob[]>({
-    ...options,
-    method: 'GET',
-    path: `/jobs?${query.toString()}`,
-  })
-}
-
-export async function getDaemonJob({ jobId, ...options }: GetDaemonJobOptions) {
-  return daemonRequest<DaemonJob>({
-    ...options,
-    method: 'GET',
-    path: `/jobs/${encodeURIComponent(jobId)}`,
-  })
-}
-
-export async function claimNextDaemonJob({
-  executionBackend,
-  profileId,
-  provider,
-  action,
-  ...options
-}: ClaimNextDaemonJobOptions) {
-  const query = new URLSearchParams()
-  query.set('execution_backend', executionBackend)
-  if (profileId) query.set('profile_id', profileId)
-  if (provider) query.set('provider', provider)
-  if (action) query.set('action', action)
-  return daemonRequest<{ job: DaemonClaimedJob | null }>({
-    ...options,
-    path: `/control/jobs/claim-next?${query.toString()}`,
-  })
-}
-
-export async function markDaemonJobRunning({ jobId, claimToken, ...options }: ClaimLifecycleDaemonJobOptions) {
-  return daemonRequest<DaemonJob>({
-    ...options,
-    path: `/control/jobs/${encodeURIComponent(jobId)}/running`,
-    body: { claim_token: claimToken },
-  })
-}
-
-export async function markDaemonJobWaitingForUser({ jobId, claimToken, blocker, ...options }: WaitingForUserDaemonJobOptions) {
-  return daemonRequest<DaemonJob>({
-    ...options,
-    path: `/control/jobs/${encodeURIComponent(jobId)}/waiting-for-user`,
-    body: { claim_token: claimToken, blocker_json: blocker },
-  })
-}
-
-export async function checkpointDaemonJob({ jobId, claimToken, checkpoint, ...options }: CheckpointDaemonJobOptions) {
-  return daemonRequest<DaemonJob>({
-    ...options,
-    path: `/control/jobs/${encodeURIComponent(jobId)}/checkpoint`,
-    body: { claim_token: claimToken, checkpoint_json: checkpoint },
-  })
-}
-
-export async function parkDaemonJob({ jobId, claimToken, blocker, checkpoint, ...options }: ParkDaemonJobOptions) {
-  return daemonRequest<DaemonJob>({
-    ...options,
-    path: `/control/jobs/${encodeURIComponent(jobId)}/park`,
-    body: {
-      claim_token: claimToken,
-      blocker_json: blocker,
-      checkpoint_json: checkpoint,
-    },
-  })
-}
-
-export async function resumeDaemonJob({ jobId, browserVisibility, ...options }: ResumeDaemonJobOptions) {
-  return daemonRequest<DaemonJob>({
-    ...options,
-    path: `/jobs/${encodeURIComponent(jobId)}/resume`,
-    body: { browser_visibility: browserVisibility },
-  })
-}
-
-export async function renewDaemonJobClaim({ jobId, claimToken, ...options }: ClaimLifecycleDaemonJobOptions) {
-  return daemonRequest<DaemonJob>({
-    ...options,
-    path: `/control/jobs/${encodeURIComponent(jobId)}/renew`,
-    body: { claim_token: claimToken },
-  })
-}
-
-export async function completeDaemonJob({
-  jobId,
-  claimToken,
-  result,
-  error,
-  ...options
-}: CompleteDaemonJobOptions) {
-  const hasResult = result !== undefined
-  const hasError = error !== undefined
-  if (hasResult === hasError) {
-    throw tokenlessError('invalid_daemon_completion', 'Pass exactly one of result or error when completing a daemon job.')
-  }
-  return daemonRequest<DaemonJob>({
-    ...options,
-    path: `/jobs/${encodeURIComponent(jobId)}/complete`,
-    body: {
-      claim_token: claimToken,
-      result_json: hasResult ? result : undefined,
-      error_json: hasError ? error : undefined,
-    },
-  })
-}
-
-export async function cancelDaemonJob({ jobId, reason, ...options }: CancelDaemonJobOptions) {
-  return daemonRequest<DaemonJob>({
-    ...options,
-    path: `/control/jobs/${encodeURIComponent(jobId)}/cancel`,
-    ...(reason === undefined ? {} : { body: { reason } }),
-  })
-}
-
-async function daemonRequest<T>({
-  daemonUrl: explicitDaemonUrl,
-  homeDir,
-  requestTimeoutMs = DEFAULT_DAEMON_REQUEST_TIMEOUT_MS,
-  signal,
-  token,
-  fetchImpl = fetch,
-  method = 'POST',
-  path: requestPath,
-  body,
-}: DaemonClientOptions & {
-  method?: 'GET' | 'POST'
-  path: string
-  body?: Record<string, unknown> | undefined
-}) {
-  const bearer = token ?? await readDaemonToken({ homeDir })
-  const headers: Record<string, string> = {
-    accept: 'application/json',
-    authorization: `Bearer ${bearer}`,
-  }
-  const init: RequestInit = {
-    method,
-    headers,
-    signal: combinedRequestSignal(requestTimeoutMs, signal),
-  }
-  if (body) {
-    headers['content-type'] = 'application/json'
-    init.body = JSON.stringify(stripUndefined(body))
-  }
-
-  let response: Response
-  let responseBody: unknown
-  try {
-    response = await fetchImpl(`${daemonUrl(explicitDaemonUrl)}${requestPath}`, init)
-    responseBody = await readJsonResponse(response)
-  } catch (error) {
-    if (error instanceof Error && error.name === 'AbortError') {
-      throw tokenlessError('daemon_request_timeout', 'Tokenless daemon request timed out or was aborted.', { retryable: true, cause: error })
-    }
-    if (error instanceof Error && error.name === 'TokenlessPlaywrightError') throw error
-    throw tokenlessError('daemon_unavailable', 'Tokenless daemon is not reachable on the configured loopback URL.', { retryable: true, cause: error })
-  }
-  if (!response.ok) {
-    throw tokenlessError(
-      'daemon_request_failed',
-      errorMessageFromBody(responseBody) ?? `Tokenless daemon request failed with HTTP ${response.status}.`,
-      { retryable: response.status >= 500 }
-    )
-  }
-  return responseBody as T
-}
-
-async function readJsonResponse(response: Response) {
-  const text = await response.text()
-  if (!text) return null
-  try {
-    return JSON.parse(text) as unknown
-  } catch (error) {
-    throw tokenlessError('daemon_invalid_response', 'Tokenless daemon returned invalid JSON.', { retryable: true, cause: error })
-  }
-}
-
-function errorMessageFromBody(body: unknown) {
-  if (!body || typeof body !== 'object') return null
-  const error = (body as { error?: unknown }).error
-  if (!error || typeof error !== 'object') return null
-  const message = (error as { message?: unknown }).message
-  return typeof message === 'string' && message.trim() ? message : null
-}
-
-function validateDaemonUrl(value: string) {
-  let parsed: URL
-  try {
-    parsed = new URL(value)
-  } catch {
-    throw tokenlessError('invalid_daemon_url', 'Tokenless daemon URL must be a valid loopback HTTP URL.')
-  }
-  if (parsed.protocol !== 'http:' || !isLoopbackHostname(parsed.hostname)) {
-    throw tokenlessError('invalid_daemon_url', 'Tokenless daemon URL must be a loopback HTTP URL.')
-  }
-}
-
-function isLoopbackHostname(hostname: string) {
-  const normalized = hostname.toLowerCase()
-  return normalized === 'localhost' ||
-    normalized === '[::1]' ||
-    normalized === '::1' ||
-    /^127(?:\.\d{1,3}){3}$/.test(normalized)
-}
-
-function combinedRequestSignal(timeoutMs: number, signal?: AbortSignal | undefined) {
-  const timeoutSignal = AbortSignal.timeout(Math.max(1, Math.floor(timeoutMs)))
-  return signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal
-}
-
-function stripUndefined(value: Record<string, unknown>) {
-  return Object.fromEntries(Object.entries(value).filter((entry) => entry[1] !== undefined))
+  claimNextJob(options: {
+    executionBackend: 'playwright'
+    profileId?: string | undefined
+    provider?: string | undefined
+    action?: string | undefined
+    jobIdPrefix?: string | undefined
+    signal?: AbortSignal | undefined
+  }): Promise<{ job: DaemonClaimedJob | null }>
+  getJob(options: JobOptions): Promise<DaemonJob>
+  markJobRunning(options: ClaimedJobOptions): Promise<DaemonJob>
+  projectJobProviderCapacity(options: ClaimedJobOptions & {
+    accessClass: string
+    tierLabel?: string | null | undefined
+    subscriptionLabel?: string | null | undefined
+  }): Promise<ProviderCapacityProjection>
+  deferJobForProviderCapacity(options: ClaimedJobOptions & {
+    projection: ProviderCapacityProjection
+  }): Promise<DaemonJob>
+  recordProviderSubmission(options: ClaimedJobOptions): Promise<DaemonJob>
+  deferObservedProviderLimit(options: ClaimedJobOptions & {
+    blocker: unknown
+    delaySeconds?: number | undefined
+  }): Promise<DaemonJob>
+  markJobWaitingForUser(options: ClaimedJobOptions & { blocker: unknown }): Promise<DaemonJob>
+  checkpointJob(options: ClaimedJobOptions & { checkpoint: unknown }): Promise<DaemonJob>
+  parkJob(options: ClaimedJobOptions & { blocker: unknown, checkpoint: unknown }): Promise<DaemonJob>
+  fallbackJob(options: ClaimedJobOptions & {
+    provider: string
+    request: unknown
+    blocker: unknown
+  }): Promise<DaemonJob>
+  renewJobClaim(options: ClaimedJobOptions): Promise<DaemonJob>
+  completeJob(options: ClaimedJobOptions & { result?: unknown, error?: unknown }): Promise<DaemonJob>
+  upsertProviderProject(options: ClaimedJobOptions & {
+    provider: string
+    profileId: string
+    resourceId: string
+    name: string
+    canonicalUrl: string
+    visibleProof: string
+    created: boolean
+  }): Promise<unknown>
+  upsertProviderConversation(options: ClaimedJobOptions & {
+    provider: string
+    profileId: string
+    projectResourceId: string
+    taskId: string
+    canonicalUrl: string
+  }): Promise<unknown>
+  upsertProviderTaskConversation(options: ClaimedJobOptions & {
+    provider: string
+    profileId: string
+    taskId: string
+    canonicalUrl: string
+  }): Promise<unknown>
 }
diff --git a/packages/cli/src/playwright/e2e-inspection.ts b/packages/cli/src/playwright/e2e-inspection.ts
new file mode 100644
index 0000000..41465af
--- /dev/null
+++ b/packages/cli/src/playwright/e2e-inspection.ts
@@ -0,0 +1,273 @@
+import { createHash, randomUUID } from 'node:crypto'
+import fs from 'node:fs/promises'
+import { isIP } from 'node:net'
+import path from 'node:path'
+import process from 'node:process'
+
+import { tokenlessError } from './errors.js'
+
+export const E2E_BROWSER_INSPECTION_PROTOCOL = 'tokenless.e2e-browser-inspection.v2' as const
+
+export type E2EBrowserInspectionConfig = {
+  protocol: typeof E2E_BROWSER_INSPECTION_PROTOCOL
+  runId: string
+  nonce: string
+  rootDir: string
+  timeoutMs: number
+  hostResolverRule: Readonly<{
+    hostname: string
+    address: string
+    chromiumValue: string
+  }> | null
+}
+
+type ObserverRelease = {
+  protocol: typeof E2E_BROWSER_INSPECTION_PROTOCOL
+  runId: string
+  jobId: string
+  nonce: string
+}
+
+const SAFE_COMPONENT_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/
+const SAFE_NONCE_PATTERN = /^[A-Za-z0-9_-]{32,256}$/
+const DEFAULT_OBSERVER_TIMEOUT_MS = 30_000
+const POLL_INTERVAL_MS = 50
+
+export function resolveE2EBrowserInspectionConfig(
+  homeDir: string | undefined,
+  env: NodeJS.ProcessEnv = process.env,
+): E2EBrowserInspectionConfig | null {
+  const enabled = env.TOKENLESS_E2E_BROWSER_INSPECTION
+  if (enabled === undefined || enabled === '') return null
+  if (enabled !== '1') {
+    throw tokenlessError(
+      'invalid_e2e_browser_inspection',
+      'TOKENLESS_E2E_BROWSER_INSPECTION must be exactly 1 when enabled.',
+      { retryable: false },
+    )
+  }
+  if (!homeDir) {
+    throw tokenlessError(
+      'invalid_e2e_browser_inspection',
+      'E2E browser inspection requires an explicit Tokenless home.',
+      { retryable: false },
+    )
+  }
+  const runId = requiredSafeComponent(env.TOKENLESS_E2E_RUN_ID, 'TOKENLESS_E2E_RUN_ID')
+  const nonce = String(env.TOKENLESS_E2E_NONCE ?? '')
+  if (!SAFE_NONCE_PATTERN.test(nonce)) {
+    throw tokenlessError(
+      'invalid_e2e_browser_inspection',
+      'TOKENLESS_E2E_NONCE must be a 32 to 256 character base64url value.',
+      { retryable: false },
+    )
+  }
+  const timeoutMs = optionalPositiveInteger(
+    env.TOKENLESS_E2E_OBSERVER_TIMEOUT_MS,
+    DEFAULT_OBSERVER_TIMEOUT_MS,
+    'TOKENLESS_E2E_OBSERVER_TIMEOUT_MS',
+  )
+  const hostResolverRule = optionalHostResolverRule(env.TOKENLESS_E2E_HOST_RESOLVER_RULE)
+  const resolvedHome = path.resolve(homeDir)
+  return Object.freeze({
+    protocol: E2E_BROWSER_INSPECTION_PROTOCOL,
+    runId,
+    nonce,
+    rootDir: path.join(resolvedHome, 'e2e', 'browser-inspection', runId),
+    timeoutMs,
+    hostResolverRule,
+  })
+}
+
+function optionalHostResolverRule(value: string | undefined) {
+  if (value === undefined || value.trim() === '') return null
+  const match = /^([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+)=([^=\s]+)$/iu.exec(value.trim())
+  const hostname = match?.[1]?.toLowerCase()
+  const address = match?.[2]
+  if (!hostname || !address || isIP(address) !== 4) {
+    throw tokenlessError(
+      'invalid_e2e_browser_inspection',
+      'TOKENLESS_E2E_HOST_RESOLVER_RULE must be one hostname=IPv4 mapping.',
+      { retryable: false },
+    )
+  }
+  return Object.freeze({
+    hostname,
+    address,
+    chromiumValue: `MAP ${hostname} ${address}`,
+  })
+}
+
+export function e2eInspectionJobDirectory(config: E2EBrowserInspectionConfig, jobId: string) {
+  return path.join(config.rootDir, requiredSafeComponent(jobId, 'job id'))
+}
+
+export function e2eInspectionJobPrefix(config: Pick<E2EBrowserInspectionConfig, 'runId'>) {
+  const runKey = createHash('sha256').update(config.runId).digest('base64url').slice(0, 16)
+  return `tlp_e2e_${runKey}_`
+}
+
+export function createE2EInspectionJobId(env: NodeJS.ProcessEnv = process.env) {
+  if (env.TOKENLESS_E2E_BROWSER_INSPECTION !== '1') return null
+  const runId = requiredSafeComponent(env.TOKENLESS_E2E_RUN_ID, 'TOKENLESS_E2E_RUN_ID')
+  return `${e2eInspectionJobPrefix({ runId })}${randomUUID()}`
+}
+
+export async function waitForE2EBrowserObserver(options: {
+  config: E2EBrowserInspectionConfig
+  jobId: string
+  profileId: string
+  profileDirectory: string
+  provider: string
+  url: string
+  targetId: string
+  signal?: AbortSignal | undefined
+}): Promise<void> {
+  const { config } = options
+  const jobId = requiredSafeComponent(options.jobId, 'job id')
+  const jobDir = e2eInspectionJobDirectory(config, jobId)
+  const waitingPath = path.join(jobDir, 'waiting.json')
+  const releasePath = path.join(jobDir, 'release.json')
+  await fs.mkdir(jobDir, { recursive: true, mode: 0o700 })
+  await writeJsonAtomically(waitingPath, {
+    protocol: config.protocol,
+    runId: config.runId,
+    jobId,
+    nonce: config.nonce,
+    profileId: options.profileId,
+    profileDirectory: options.profileDirectory,
+    provider: options.provider,
+    url: options.url,
+    targetId: requiredTargetId(options.targetId),
+    waitingAt: new Date().toISOString(),
+  })
+  const deadline = Date.now() + config.timeoutMs
+  try {
+    while (Date.now() <= deadline) {
+      throwIfAborted(options.signal)
+      const release = await readRelease(releasePath)
+      if (release && validRelease(release, config, jobId)) return
+      await delay(Math.min(POLL_INTERVAL_MS, Math.max(1, deadline - Date.now())), options.signal)
+    }
+    throw tokenlessError(
+      'e2e_browser_observer_timeout',
+      `Timed out after ${config.timeoutMs}ms waiting for the E2E browser observer.`,
+      { retryable: false },
+    )
+  } finally {
+    await fs.rm(jobDir, { recursive: true, force: true }).catch(() => undefined)
+  }
+}
+
+async function readRelease(releasePath: string): Promise<unknown> {
+  try {
+    return JSON.parse(await fs.readFile(releasePath, 'utf8'))
+  } catch (error) {
+    if (isMissingFileError(error) || error instanceof SyntaxError) return null
+    throw error
+  }
+}
+
+function validRelease(
+  value: unknown,
+  config: E2EBrowserInspectionConfig,
+  jobId: string,
+): value is ObserverRelease {
+  if (!isPlainRecord(value)) return false
+  const keys = Object.keys(value).sort()
+  const expected = ['jobId', 'nonce', 'protocol', 'runId']
+  if (keys.length !== expected.length || keys.some((key, index) => key !== expected[index])) return false
+  return (
+    value.protocol === config.protocol &&
+    value.runId === config.runId &&
+    value.jobId === jobId &&
+    value.nonce === config.nonce
+  )
+}
+
+async function writeJsonAtomically(target: string, value: unknown) {
+  const temporary = `${target}.${process.pid}.tmp`
+  await fs.writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, {
+    encoding: 'utf8',
+    mode: 0o600,
+    flag: 'wx',
+  })
+  await fs.rename(temporary, target)
+}
+
+function requiredSafeComponent(value: unknown, label: string) {
+  const normalized = String(value ?? '')
+  if (!SAFE_COMPONENT_PATTERN.test(normalized)) {
+    throw tokenlessError(
+      'invalid_e2e_browser_inspection',
+      `${label} is invalid for E2E browser inspection.`,
+      { retryable: false },
+    )
+  }
+  return normalized
+}
+
+function requiredTargetId(value: unknown) {
+  const normalized = String(value ?? '')
+  if (!/^[A-Fa-f0-9]{16,128}$/u.test(normalized)) {
+    throw tokenlessError(
+      'invalid_e2e_browser_inspection',
+      'Chromium target id is invalid for E2E browser inspection.',
+      { retryable: false },
+    )
+  }
+  return normalized
+}
+
+function optionalPositiveInteger(value: unknown, fallback: number, label: string) {
+  if (value === undefined || value === '') return fallback
+  const numeric = Number(value)
+  if (!Number.isSafeInteger(numeric) || numeric < 1 || numeric > 300_000) {
+    throw tokenlessError(
+      'invalid_e2e_browser_inspection',
+      `${label} must be a positive integer no greater than 300000.`,
+      { retryable: false },
+    )
+  }
+  return numeric
+}
+
+function throwIfAborted(signal: AbortSignal | undefined) {
+  if (signal?.aborted) {
+    throw tokenlessError('playwright_job_canceled', 'Managed Playwright job was canceled.', { retryable: false })
+  }
+}
+
+function delay(ms: number, signal: AbortSignal | undefined) {
+  return new Promise<void>((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(tokenlessError('playwright_job_canceled', 'Managed Playwright job was canceled.', { retryable: false }))
+      return
+    }
+    const cleanup = () => signal?.removeEventListener('abort', abort)
+    const timer = setTimeout(() => {
+      cleanup()
+      resolve()
+    }, ms)
+    const abort = () => {
+      clearTimeout(timer)
+      cleanup()
+      reject(tokenlessError('playwright_job_canceled', 'Managed Playwright job was canceled.', { retryable: false }))
+    }
+    signal?.addEventListener('abort', abort, { once: true })
+    if (signal) {
+      void Promise.resolve().then(() => {
+        if (!signal.aborted) return
+        abort()
+      })
+    }
+  })
+}
+
+function isMissingFileError(error: unknown): error is NodeJS.ErrnoException {
+  return error instanceof Error && 'code' in error && error.code === 'ENOENT'
+}
+
+function isPlainRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value && typeof value === 'object' && !Array.isArray(value))
+}
diff --git a/packages/cli/src/playwright/errors.ts b/packages/cli/src/playwright/errors.ts
index 8a39373..269b904 100644
--- a/packages/cli/src/playwright/errors.ts
+++ b/packages/cli/src/playwright/errors.ts
@@ -1,25 +1,44 @@
 export class TokenlessPlaywrightError extends Error {
   readonly code: string
   readonly retryable: boolean
+  readonly details?: unknown
 
-  constructor(code: string, message: string, options: { retryable?: boolean; cause?: unknown } = {}) {
+  constructor(code: string, message: string, options: { retryable?: boolean; cause?: unknown; details?: unknown } = {}) {
     super(message, { cause: options.cause })
     this.name = 'TokenlessPlaywrightError'
     this.code = code
     this.retryable = options.retryable ?? false
+    if (options.details !== undefined) this.details = options.details
   }
 }
 
-export function tokenlessError(code: string, message: string, options: { retryable?: boolean; cause?: unknown } = {}) {
+export const CLAIM_RECOVERY_ERROR_CODE = 'playwright_claim_recovery_failed' as const
+
+export function tokenlessError(code: string, message: string, options: { retryable?: boolean; cause?: unknown; details?: unknown } = {}) {
   return new TokenlessPlaywrightError(code, message, options)
 }
 
+export function claimRecoveryError(error: unknown) {
+  return tokenlessError(
+    CLAIM_RECOVERY_ERROR_CODE,
+    'Failed to durably recover an aborted managed Playwright job claim.',
+    { retryable: true, cause: error }
+  )
+}
+
+export function isClaimRecoveryError(error: unknown) {
+  return error instanceof Error &&
+    'code' in error &&
+    (error as { code?: unknown }).code === CLAIM_RECOVERY_ERROR_CODE
+}
+
 export function errorResponse(error: unknown) {
   if (error instanceof TokenlessPlaywrightError) {
     return {
       code: error.code,
       message: error.message,
       retryable: error.retryable,
+      ...(error.details === undefined ? {} : { details: error.details }),
     }
   }
   return {
diff --git a/packages/cli/src/playwright/index.ts b/packages/cli/src/playwright/index.ts
index 94cf12c..d75af37 100644
--- a/packages/cli/src/playwright/index.ts
+++ b/packages/cli/src/playwright/index.ts
@@ -1,14 +1,13 @@
 export * from './actions.js'
-export * from './adapters/index.js'
 export * from '../browser-visibility.js'
 export * from './browser/context-manager.js'
-export * from './daemon-client.js'
 export * from './errors.js'
+export * from './e2e-inspection.js'
 export * from './job-api.js'
 export * from './job-contract.js'
 export * from './profiles/chrome-discovery.js'
-export * from './profiles/import.js'
+export * from './profiles/opaque-copy.js'
 export * from './profiles/registry.js'
-export * from './providers.js'
+export * from './provider-failure-classification.js'
+export * from '../providers/registry.js'
 export * from './runner-service.js'
-export * from './runner-supervisor.js'
diff --git a/packages/cli/src/playwright/job-api.ts b/packages/cli/src/playwright/job-api.ts
index 6ac0403..597d34d 100644
--- a/packages/cli/src/playwright/job-api.ts
+++ b/packages/cli/src/playwright/job-api.ts
@@ -4,18 +4,21 @@ import {
   createManagedPlaywrightJobRequest,
   validateManagedPlaywrightJobRequest,
 } from './job-contract.js'
-import { createDaemonClient } from './daemon-client.js'
+import {
+  cancelDaemonJob,
+  createDaemonJob,
+  getDaemonJob,
+  listDaemonJobs,
+  resumeDaemonJob,
+} from '../daemon-client.js'
 import { tokenlessError } from './errors.js'
-import type { DaemonJob, DaemonJobStatus, ManagedDaemonClient } from './daemon-client.js'
+import type { DaemonJob, DaemonJobStatus } from '../daemon-client.js'
 import type { CreateManagedPlaywrightJobRequestInput, ManagedPlaywrightJobRequest } from './job-contract.js'
-import type { ProviderId } from './providers.js'
+import type { ProviderId } from '../providers/registry.js'
 
 export type ManagedPlaywrightJobApiOptions = {
-  daemonClient?: ManagedDaemonClient | undefined
   daemonUrl?: string | undefined
   homeDir?: string | undefined
-  token?: string | undefined
-  fetchImpl?: typeof fetch | undefined
   requestTimeoutMs?: number | undefined
   signal?: AbortSignal | undefined
 }
@@ -23,8 +26,10 @@ export type ManagedPlaywrightJobApiOptions = {
 export type SubmitManagedPlaywrightJobOptions = ManagedPlaywrightJobApiOptions & {
   profileId: string
   request: ManagedPlaywrightJobRequest | CreateManagedPlaywrightJobRequestInput
+  agentKind?: string | undefined
+  agentSessionId?: string | undefined
+  upstreamState?: Readonly<Record<string, unknown>> | undefined
   jobId?: string | undefined
-  claimToken?: string | undefined
 }
 
 export type ListManagedPlaywrightJobsOptions = ManagedPlaywrightJobApiOptions & {
@@ -47,21 +52,35 @@ export type CancelManagedPlaywrightJobOptions = GetManagedPlaywrightJobOptions &
 export type ResumeManagedPlaywrightJobOptions = GetManagedPlaywrightJobOptions
 
 export async function submitManagedPlaywrightJob(options: SubmitManagedPlaywrightJobOptions) {
-  const request = normalizeJobRequest(options.request)
-  return daemonClient(options).createJob({
+  const normalized = normalizeJobRequest(options.request)
+  const request = options.agentKind === undefined && options.agentSessionId === undefined && options.upstreamState === undefined
+    ? normalized
+    : validateManagedPlaywrightJobRequest({
+        ...normalized,
+        context: {
+          ...normalized.context,
+          upstream: {
+            agentKind: options.agentKind ?? null,
+            sessionId: options.agentSessionId ?? null,
+            state: options.upstreamState ?? null,
+          },
+        },
+      })
+  return createDaemonJob({
     ...daemonOptions(options),
     provider: request.provider,
     action: MANAGED_PLAYWRIGHT_JOB_ACTION,
     requestJson: request,
     executionBackend: PLAYWRIGHT_EXECUTION_BACKEND,
     profileId: options.profileId,
+    agentKind: options.agentKind,
+    agentSessionId: options.agentSessionId,
     jobId: options.jobId,
-    claimToken: options.claimToken,
   })
 }
 
 export async function listManagedPlaywrightJobs(options: ListManagedPlaywrightJobsOptions = {}) {
-  return daemonClient(options).listJobs({
+  return listDaemonJobs({
     ...daemonOptions(options),
     executionBackend: PLAYWRIGHT_EXECUTION_BACKEND,
     profileId: options.profileId,
@@ -73,7 +92,7 @@ export async function listManagedPlaywrightJobs(options: ListManagedPlaywrightJo
 }
 
 export async function getManagedPlaywrightJob(options: GetManagedPlaywrightJobOptions): Promise<DaemonJob> {
-  const job = await daemonClient(options).getJob({
+  const job = await getDaemonJob({
     ...daemonOptions(options),
     jobId: options.jobId,
   })
@@ -83,7 +102,7 @@ export async function getManagedPlaywrightJob(options: GetManagedPlaywrightJobOp
 
 export async function cancelManagedPlaywrightJob(options: CancelManagedPlaywrightJobOptions): Promise<DaemonJob> {
   await getManagedPlaywrightJob(options)
-  return daemonClient(options).cancelJob({
+  return cancelDaemonJob({
     ...daemonOptions(options),
     jobId: options.jobId,
     reason: options.reason,
@@ -92,7 +111,7 @@ export async function cancelManagedPlaywrightJob(options: CancelManagedPlaywrigh
 
 export async function resumeManagedPlaywrightJob(options: ResumeManagedPlaywrightJobOptions): Promise<DaemonJob> {
   await getManagedPlaywrightJob(options)
-  const job = await daemonClient(options).resumeJob({
+  const job = await resumeDaemonJob({
     ...daemonOptions(options),
     jobId: options.jobId,
     browserVisibility: 'headed',
@@ -110,16 +129,10 @@ function normalizeJobRequest(
   return createManagedPlaywrightJobRequest(request)
 }
 
-function daemonClient(options: ManagedPlaywrightJobApiOptions) {
-  return options.daemonClient ?? createDaemonClient(daemonOptions(options))
-}
-
 function daemonOptions(options: ManagedPlaywrightJobApiOptions) {
   return {
     daemonUrl: options.daemonUrl,
     homeDir: options.homeDir,
-    token: options.token,
-    fetchImpl: options.fetchImpl,
     requestTimeoutMs: options.requestTimeoutMs,
     signal: options.signal,
   }
diff --git a/packages/cli/src/playwright/job-contract.ts b/packages/cli/src/playwright/job-contract.ts
index 551ecd7..6c64ac1 100644
--- a/packages/cli/src/playwright/job-contract.ts
+++ b/packages/cli/src/playwright/job-contract.ts
@@ -1,19 +1,38 @@
 import { randomUUID } from 'node:crypto'
 import { normalizeBrowserVisibility } from '../browser-visibility.js'
+import {
+  MANAGED_PLAYWRIGHT_JOB_SCHEMA_ID,
+} from '../schema-ids.js'
 import {
   VISIBLE_ACTIONS,
-  VISIBLE_ACTION_PROTOCOL_VERSION,
+  VISIBLE_ACTION_SCHEMA_ID,
   createVisibleActionRequest,
   validateVisibleActionRequest,
 } from './actions.js'
+import {
+  createContextEnvelope,
+  validateContextEnvelope,
+  type ContextEnvelope,
+} from './context-envelope.js'
 import { tokenlessError } from './errors.js'
-import { getProviderById } from './providers.js'
+import { getVisibleActionCatalogDefinition } from '../providers/action-catalog.js'
+import {
+  TASK_CAPABILITIES,
+  getProviderInstanceById,
+  normalizeTaskCapabilityRequirements,
+  validateTaskCapabilityRoute,
+} from '../providers/registry.js'
 import type { BrowserVisibility } from '../browser-visibility.js'
-import type { VisibleActionRequest } from './actions.js'
-import type { ProviderId } from './providers.js'
+import type { ManagedPagePolicy } from './browser/context-manager.js'
+import type { VisibleActionRequest, VisibleActionWireRequest } from './actions.js'
+import type { ProviderId, ProviderInstance, TaskCapabilityId, TaskCapabilityRoute } from '../providers/registry.js'
+
+export { CONTEXT_ENVELOPE_SCHEMA_ID } from './context-envelope.js'
+export type { ContextEnvelope } from './context-envelope.js'
 
-export const MANAGED_PLAYWRIGHT_JOB_PROTOCOL_VERSION_V1 = 'tokenless.playwright.job.v1' as const
-export const MANAGED_PLAYWRIGHT_JOB_PROTOCOL_VERSION = 'tokenless.playwright.job.v2' as const
+export {
+  MANAGED_PLAYWRIGHT_JOB_SCHEMA_ID,
+} from '../schema-ids.js'
 export const MANAGED_PLAYWRIGHT_JOB_ACTION = 'visible_provider_actions' as const
 export const PLAYWRIGHT_EXECUTION_BACKEND = 'playwright' as const
 
@@ -23,35 +42,65 @@ export type ManagedPlaywrightSafeTarget = {
 }
 
 export type ManagedPlaywrightJobRequest = {
-  protocol: typeof MANAGED_PLAYWRIGHT_JOB_PROTOCOL_VERSION
+  protocol: typeof MANAGED_PLAYWRIGHT_JOB_SCHEMA_ID
   provider: ProviderId
   target: ManagedPlaywrightSafeTarget
   taskId: string | null
+  capabilityRoute: TaskCapabilityRoute | null
+  fallback: ManagedPlaywrightFallbackPlan | null
+  context: ContextEnvelope
   browserVisibility: BrowserVisibility
+  pagePolicy?: ManagedPagePolicy | undefined
   actions: readonly VisibleActionRequest[]
 }
 
+export type ManagedPlaywrightFallbackAlternative = {
+  provider: ProviderId
+  target: ManagedPlaywrightSafeTarget
+  capabilityRoute: TaskCapabilityRoute
+}
+
+export type ManagedPlaywrightFallbackPlan = {
+  protocol: 'tokenless.provider-fallback.v1'
+  mode: 'automatic'
+  replay: 'from_start'
+  alternatives: readonly ManagedPlaywrightFallbackAlternative[]
+}
+
 export type CreateManagedPlaywrightJobRequestInput = {
   provider: ProviderId
   target?: Partial<ManagedPlaywrightSafeTarget> | undefined
   taskId?: string | null | undefined
+  capabilityRoute?: TaskCapabilityRoute | null | undefined
+  fallback?: ManagedPlaywrightFallbackPlan | null | undefined
+  context?: ContextEnvelope | null | undefined
+  contextLanguage?: 'en' | 'zh-CN' | null | undefined
   browserVisibility?: unknown
-  actions: readonly (VisibleActionRequest | (Omit<Partial<VisibleActionRequest>, 'protocol' | 'provider'> & {
+  pagePolicy?: unknown
+  actions: readonly (VisibleActionRequest | (Omit<Partial<VisibleActionWireRequest>, 'protocol' | 'provider'> & {
     requestId?: string | undefined
   }))[]
 }
 
 const CORE_ACTIONS = new Set<string>(Object.values(VISIBLE_ACTIONS))
+const AUTOMATIC_FALLBACK_ACTIONS = new Set<string>([
+  VISIBLE_ACTIONS.FILE_UPLOAD,
+  VISIBLE_ACTIONS.WORKSPACE_ENSURE,
+  VISIBLE_ACTIONS.PROMPT_INPUT,
+  VISIBLE_ACTIONS.PROMPT_CLEAR,
+  VISIBLE_ACTIONS.PROMPT_SUBMIT,
+  VISIBLE_ACTIONS.RESPONSE_READ,
+])
 
 export function createManagedPlaywrightJobRequest(
   input: CreateManagedPlaywrightJobRequestInput
 ): ManagedPlaywrightJobRequest {
-  const provider = getProviderById(input.provider)
+  const provider = getProviderInstanceById(input.provider)
   if (!provider) throw tokenlessError('unknown_playwright_job_provider', 'Managed Playwright job provider is not supported.')
   const target = validateSafeTarget({
     kind: input.target?.kind ?? 'provider_home',
-    url: input.target?.url ?? provider.homeUrl,
-  }, provider.id)
+    url: input.target?.url ?? provider.descriptor.navigation.homeUrl,
+  }, provider)
   const actions = input.actions.map((action) => {
     if (isVisibleActionRequestLike(action)) {
       return validateVisibleActionRequest(action)
@@ -63,11 +112,20 @@ export function createManagedPlaywrightJobRequest(
     })
   })
   return validateManagedPlaywrightJobRequest({
-    protocol: MANAGED_PLAYWRIGHT_JOB_PROTOCOL_VERSION,
+    protocol: MANAGED_PLAYWRIGHT_JOB_SCHEMA_ID,
     provider: provider.id,
     target,
     taskId: validateTaskId(input.taskId ?? null),
+    capabilityRoute: input.capabilityRoute ?? null,
+    fallback: input.fallback ?? null,
+    context: input.context ?? createContextEnvelope({
+      taskId: validateTaskId(input.taskId ?? null),
+      requirements: input.capabilityRoute?.requirements ?? deriveTaskCapabilityRequirements(actions),
+      actions,
+      language: input.contextLanguage,
+    }),
     browserVisibility: validateJobBrowserVisibility(input.browserVisibility ?? 'auto'),
+    ...(input.pagePolicy === undefined ? {} : { pagePolicy: validateManagedPagePolicy(input.pagePolicy) }),
     actions,
   })
 }
@@ -76,44 +134,203 @@ export function validateManagedPlaywrightJobRequest(input: unknown): ManagedPlay
   if (!isPlainRecord(input)) {
     throw tokenlessError('invalid_playwright_job_request', 'Managed Playwright job request must be an object.')
   }
-  if (input.protocol === MANAGED_PLAYWRIGHT_JOB_PROTOCOL_VERSION_V1) {
-    requireExactKeys(input, ['protocol', 'provider', 'target', 'taskId', 'actions'], 'invalid_playwright_job_request')
-  } else {
-    requireExactKeys(input, ['protocol', 'provider', 'target', 'taskId', 'browserVisibility', 'actions'], 'invalid_playwright_job_request')
+  requireKeys(
+    input,
+    ['protocol', 'provider', 'target', 'taskId', 'browserVisibility', 'actions'],
+    ['capabilityRoute', 'fallback', 'context', 'pagePolicy'],
+    'invalid_playwright_job_request',
+  )
+  if (input.protocol !== MANAGED_PLAYWRIGHT_JOB_SCHEMA_ID) {
+    throw tokenlessError(
+      'invalid_playwright_job_protocol',
+      `Managed Playwright job protocol '${String(input.protocol)}' is not supported; expected '${MANAGED_PLAYWRIGHT_JOB_SCHEMA_ID}'.`,
+      {
+        details: {
+          expected: MANAGED_PLAYWRIGHT_JOB_SCHEMA_ID,
+          received: typeof input.protocol === 'string' ? input.protocol : null,
+        },
+      },
+    )
   }
-  if (input.protocol !== MANAGED_PLAYWRIGHT_JOB_PROTOCOL_VERSION && input.protocol !== MANAGED_PLAYWRIGHT_JOB_PROTOCOL_VERSION_V1) {
-    throw tokenlessError('invalid_playwright_job_protocol', 'Managed Playwright job protocol version is not supported.')
-  }
-  const provider = getProviderById(input.provider)
+  const provider = getProviderInstanceById(input.provider)
   if (!provider) throw tokenlessError('unknown_playwright_job_provider', 'Managed Playwright job provider is not supported.')
-  const target = validateSafeTarget(input.target, provider.id)
+  const target = validateSafeTarget(input.target, provider)
   const taskId = validateTaskId(input.taskId)
-  const browserVisibility = input.protocol === MANAGED_PLAYWRIGHT_JOB_PROTOCOL_VERSION_V1
-    ? 'headed'
-    : validateJobBrowserVisibility(input.browserVisibility)
   if (!Array.isArray(input.actions) || input.actions.length < 1 || input.actions.length > 100) {
     throw tokenlessError('invalid_playwright_job_actions', 'Managed Playwright job requires one to one hundred actions.')
   }
   const actions = input.actions.map((action) => validateVisibleActionRequest(action))
   for (const action of actions) {
+    if (action.protocol !== VISIBLE_ACTION_SCHEMA_ID) {
+      throw tokenlessError('invalid_playwright_job_action', 'Managed Playwright job v3 requires visible action v3.')
+    }
     if (action.provider !== provider.id) {
       throw tokenlessError('invalid_playwright_job_provider', 'All visible actions must target the job provider.')
     }
     if (!CORE_ACTIONS.has(action.action)) {
       throw tokenlessError('invalid_playwright_job_action', 'Managed Playwright job contains an unsupported action.')
     }
+    const unavailableCapabilities = getVisibleActionCatalogDefinition(action.action).requiredCapabilities
+      .filter((capability) => provider.declaredCapabilityAvailability(capability) === 'unavailable')
+    if (unavailableCapabilities.length > 0) {
+      throw tokenlessError(
+        'invalid_playwright_job_action_capability',
+        `Managed Playwright provider '${provider.id}' does not declare the capabilities required by action '${action.action}'.`,
+        { details: { provider: provider.id, action: action.action, unavailableCapabilities } },
+      )
+    }
+  }
+  const derivedRequirements = deriveTaskCapabilityRequirements(actions)
+  const capabilityRoute = input.capabilityRoute === undefined || input.capabilityRoute === null
+    ? null
+    : validateJobCapabilityRoute(input.capabilityRoute, provider.id)
+  if (capabilityRoute) assertRouteCoversActionRequirements(capabilityRoute, derivedRequirements)
+  const fallback = input.fallback === undefined || input.fallback === null
+    ? null
+    : validateFallbackPlan(input.fallback, provider, target, capabilityRoute)
+  const contextRequirements = capabilityRoute?.requirements ?? derivedRequirements
+  const context = input.context === undefined || input.context === null
+    ? createContextEnvelope({ taskId, requirements: contextRequirements, actions })
+    : validateContextEnvelope(input.context, { taskId, requirements: contextRequirements, actions })
+  const browserVisibility = validateJobBrowserVisibility(input.browserVisibility)
+  const pagePolicy = input.pagePolicy === undefined ? undefined : validateManagedPagePolicy(input.pagePolicy)
+  if (fallback && actions.some((action) => !AUTOMATIC_FALLBACK_ACTIONS.has(action.action))) {
+    throw tokenlessError('invalid_playwright_job_fallback', 'Automatic provider fallback accepts only portable conversation actions.')
   }
   return {
-    protocol: MANAGED_PLAYWRIGHT_JOB_PROTOCOL_VERSION,
+    protocol: MANAGED_PLAYWRIGHT_JOB_SCHEMA_ID,
     provider: provider.id,
     target,
     taskId,
+    capabilityRoute,
+    fallback,
+    context,
     browserVisibility,
+    ...(pagePolicy === undefined ? {} : { pagePolicy }),
     actions,
   }
 }
 
-function validateSafeTarget(input: unknown, providerId: ProviderId): ManagedPlaywrightSafeTarget {
+function validateFallbackPlan(
+  input: unknown,
+  currentProvider: ProviderInstance,
+  currentTarget: ManagedPlaywrightSafeTarget,
+  currentRoute: TaskCapabilityRoute | null,
+): ManagedPlaywrightFallbackPlan {
+  if (!isPlainRecord(input)) {
+    throw tokenlessError('invalid_playwright_job_fallback', 'Managed Playwright fallback plan must be an object.')
+  }
+  requireExactKeys(input, ['protocol', 'mode', 'replay', 'alternatives'], 'invalid_playwright_job_fallback')
+  if (input.protocol !== 'tokenless.provider-fallback.v1' || input.mode !== 'automatic' || input.replay !== 'from_start') {
+    throw tokenlessError('invalid_playwright_job_fallback', 'Managed Playwright fallback policy is invalid.')
+  }
+  if (!currentRoute) {
+    throw tokenlessError('invalid_playwright_job_fallback', 'Automatic provider fallback requires a capability route.')
+  }
+  if (currentRoute.requirements.includes('conversation.continue')) {
+    throw tokenlessError('invalid_playwright_job_fallback', 'Exact provider conversation continuation cannot fallback automatically.')
+  }
+  if (!isProviderHomeTarget(currentTarget, currentProvider)) {
+    throw tokenlessError('invalid_playwright_job_fallback', 'Automatic provider fallback requires provider-home targets, not provider-specific conversations or Projects.')
+  }
+  if (!Array.isArray(input.alternatives) || input.alternatives.length < 1 || input.alternatives.length > 5) {
+    throw tokenlessError('invalid_playwright_job_fallback', 'Automatic provider fallback requires one to five alternatives.')
+  }
+  const seen = new Set<ProviderId>([currentProvider.id])
+  const alternatives = input.alternatives.map((value) => {
+    if (!isPlainRecord(value)) {
+      throw tokenlessError('invalid_playwright_job_fallback', 'Managed Playwright fallback alternative must be an object.')
+    }
+    requireExactKeys(value, ['provider', 'target', 'capabilityRoute'], 'invalid_playwright_job_fallback')
+    const provider = getProviderInstanceById(value.provider)
+    if (!provider || seen.has(provider.id)) {
+      throw tokenlessError('invalid_playwright_job_fallback', 'Managed Playwright fallback providers must be supported and unique.')
+    }
+    seen.add(provider.id)
+    const route = validateJobCapabilityRoute(value.capabilityRoute, provider.id)
+    if (!sameStringArray(route.requirements, currentRoute.requirements)) {
+      throw tokenlessError('invalid_playwright_job_fallback', 'Every fallback provider must satisfy the same run capability requirements.')
+    }
+    const target = validateSafeTarget(value.target, provider)
+    if (!isProviderHomeTarget(target, provider)) {
+      throw tokenlessError('invalid_playwright_job_fallback', 'Automatic provider fallback alternatives must start from provider-home targets.')
+    }
+    return { provider: provider.id, target, capabilityRoute: route }
+  })
+  for (let index = 1; index < alternatives.length; index += 1) {
+    if (routeMaturityScore(alternatives[index - 1]!.capabilityRoute) < routeMaturityScore(alternatives[index]!.capabilityRoute)) {
+      throw tokenlessError('invalid_playwright_job_fallback', 'Automatic provider fallback alternatives must be ordered by runtime eligibility and evidence maturity.')
+    }
+  }
+  return {
+    protocol: 'tokenless.provider-fallback.v1',
+    mode: 'automatic',
+    replay: 'from_start',
+    alternatives,
+  }
+}
+
+function deriveTaskCapabilityRequirements(actions: readonly VisibleActionRequest[]): readonly TaskCapabilityId[] {
+  const requirements: TaskCapabilityId[] = []
+  for (const action of actions) {
+    if (
+      action.action === VISIBLE_ACTIONS.PROMPT_INPUT ||
+      action.action === VISIBLE_ACTIONS.PROMPT_CLEAR ||
+      action.action === VISIBLE_ACTIONS.PROMPT_SUBMIT ||
+      action.action === VISIBLE_ACTIONS.RESPONSE_READ
+    ) {
+      requirements.push(TASK_CAPABILITIES.CONVERSATION_CHAT)
+    }
+    if (action.action === VISIBLE_ACTIONS.FILE_UPLOAD) {
+      requirements.push(TASK_CAPABILITIES.FILE_UPLOAD)
+      for (const attachment of action.payload.attachments) {
+        if (attachment.type.startsWith('image/')) requirements.push(TASK_CAPABILITIES.IMAGE_INPUT)
+        if (attachment.type.startsWith('audio/')) requirements.push(TASK_CAPABILITIES.AUDIO_INPUT)
+        if (attachment.type.startsWith('video/')) requirements.push(TASK_CAPABILITIES.VIDEO_INPUT)
+      }
+    }
+    if (action.action === VISIBLE_ACTIONS.WORKSPACE_ENSURE && action.payload.mode === 'native') {
+      requirements.push(TASK_CAPABILITIES.WORKSPACE_NATIVE)
+    }
+  }
+  return normalizeTaskCapabilityRequirements(requirements)
+}
+
+function assertRouteCoversActionRequirements(
+  route: TaskCapabilityRoute,
+  derivedRequirements: readonly TaskCapabilityId[],
+) {
+  const missing = derivedRequirements.filter((capability) => !route.requirements.includes(capability))
+  if (missing.length > 0) {
+    throw tokenlessError(
+      'invalid_playwright_job_capability_requirements',
+      `Managed Playwright capability route omits action-required capabilities: ${missing.join(', ')}.`,
+      { details: { provider: route.provider, declared: route.requirements, required: derivedRequirements, missing } },
+    )
+  }
+}
+
+function isProviderHomeTarget(target: ManagedPlaywrightSafeTarget, provider: ProviderInstance) {
+  return canonicalUrl(target.url) === canonicalUrl(provider.descriptor.navigation.homeUrl)
+}
+
+function canonicalUrl(value: string) {
+  const parsed = new URL(value)
+  parsed.search = ''
+  parsed.hash = ''
+  return parsed.toString()
+}
+
+function routeMaturityScore(route: TaskCapabilityRoute) {
+  return (route.runtimeEligibility === 'eligible' ? 20 : route.runtimeEligibility === 'unchecked' ? 10 : 0) +
+    (route.support === 'supported' ? 1 : 0)
+}
+
+function sameStringArray(left: readonly string[], right: readonly string[]) {
+  return left.length === right.length && left.every((value, index) => value === right[index])
+}
+
+function validateSafeTarget(input: unknown, provider: ProviderInstance): ManagedPlaywrightSafeTarget {
   if (!isPlainRecord(input)) {
     throw tokenlessError('invalid_playwright_job_target', 'Managed Playwright job target must be an object.')
   }
@@ -124,6 +341,9 @@ function validateSafeTarget(input: unknown, providerId: ProviderId): ManagedPlay
   if (typeof input.url !== 'string') {
     throw tokenlessError('invalid_playwright_job_target', 'Managed Playwright job target URL is invalid.')
   }
+  if (Buffer.byteLength(input.url, 'utf8') > 2048) {
+    throw tokenlessError('invalid_playwright_job_target', 'Managed Playwright job target URL is too large.')
+  }
   let parsed: URL
   try {
     parsed = new URL(input.url)
@@ -133,9 +353,7 @@ function validateSafeTarget(input: unknown, providerId: ProviderId): ManagedPlay
   if (parsed.protocol !== 'https:' || parsed.username || parsed.password || parsed.hash || parsed.search) {
     throw tokenlessError('invalid_playwright_job_target', 'Managed Playwright job target must be a public HTTPS provider URL without credentials, query, or fragment.')
   }
-  const provider = getProviderById(providerId)
-  const host = parsed.hostname.toLowerCase()
-  if (!provider || !provider.hosts.some((allowed) => host === allowed)) {
+  if (!provider.navigation.canonicalTarget(input.url)) {
     throw tokenlessError('invalid_playwright_job_target', 'Managed Playwright job target host is not owned by the provider.')
   }
   return {
@@ -145,7 +363,7 @@ function validateSafeTarget(input: unknown, providerId: ProviderId): ManagedPlay
 }
 
 function isVisibleActionRequestLike(value: unknown): value is VisibleActionRequest {
-  return isPlainRecord(value) && value.protocol === VISIBLE_ACTION_PROTOCOL_VERSION
+  return isPlainRecord(value) && typeof value.protocol === 'string'
 }
 
 function validateTaskId(value: unknown): string | null {
@@ -164,6 +382,24 @@ function validateJobBrowserVisibility(value: unknown): BrowserVisibility {
   return visibility
 }
 
+function validateManagedPagePolicy(value: unknown): ManagedPagePolicy {
+  if (value !== 'preserve' && value !== 'replace') {
+    throw tokenlessError('invalid_managed_page_policy', 'Managed browser page policy must be preserve or replace.')
+  }
+  return value
+}
+
+function validateJobCapabilityRoute(value: unknown, provider: ProviderId) {
+  try {
+    return validateTaskCapabilityRoute(value, provider)
+  } catch (error) {
+    throw tokenlessError(
+      'invalid_playwright_job_capability_route',
+      error instanceof Error ? error.message : 'Managed Playwright job capability route is invalid.',
+    )
+  }
+}
+
 function requireExactKeys(record: Record<string, unknown>, keys: readonly string[], code: string) {
   const expected = new Set(keys)
   const actual = Object.keys(record)
@@ -172,6 +408,23 @@ function requireExactKeys(record: Record<string, unknown>, keys: readonly string
   }
 }
 
+function requireKeys(
+  record: Record<string, unknown>,
+  requiredKeys: readonly string[],
+  optionalKeys: readonly string[],
+  code: string,
+) {
+  const required = new Set(requiredKeys)
+  const allowed = new Set([...requiredKeys, ...optionalKeys])
+  const actual = Object.keys(record)
+  if (requiredKeys.some((key) => !Object.hasOwn(record, key)) || actual.some((key) => !allowed.has(key))) {
+    throw tokenlessError(
+      code,
+      `Expected required keys ${[...required].join(', ')} and optional keys ${optionalKeys.join(', ') || '(none)'}.`,
+    )
+  }
+}
+
 function isPlainRecord(value: unknown): value is Record<string, unknown> {
   return Boolean(value && typeof value === 'object' && !Array.isArray(value))
 }
diff --git a/packages/cli/src/playwright/profiles/chrome-discovery.ts b/packages/cli/src/playwright/profiles/chrome-discovery.ts
index ae5843b..d2548fe 100644
--- a/packages/cli/src/playwright/profiles/chrome-discovery.ts
+++ b/packages/cli/src/playwright/profiles/chrome-discovery.ts
@@ -1,4 +1,4 @@
-import { access, readFile, stat } from 'node:fs/promises'
+import { readdir, readFile, stat } from 'node:fs/promises'
 import { homedir, platform } from 'node:os'
 import { basename, join, resolve, sep } from 'node:path'
 import { tokenlessError } from '../errors.js'
@@ -10,14 +10,25 @@ export type ChromeProfileCandidate = {
   profileDir: string
   name: string
   isDefault: boolean
+  browserVersion: string | null
 }
 
 export type ChromeUserDataRoot = {
   userDataDir: string
+  browserVersion: string | null
   profiles: readonly ChromeProfileCandidate[]
 }
 
-export type ManagedChromiumBrowserId = 'chrome' | 'brave'
+export const MANAGED_CHROMIUM_BROWSER_IDS = Object.freeze([
+  'chrome',
+  'brave',
+  'edge',
+  'arc',
+  'chromium',
+  'chrome-for-testing',
+] as const)
+
+export type ManagedChromiumBrowserId = typeof MANAGED_CHROMIUM_BROWSER_IDS[number]
 
 export type ChromiumUserDataRoot = ChromeUserDataRoot & {
   browser: ManagedChromiumBrowserId
@@ -43,16 +54,48 @@ export function standardChromiumUserDataDirs(
 ): string[] {
   if (browser === 'chrome') return standardChromeUserDataDirs(osPlatform, home, env)
   if (osPlatform === 'darwin') {
-    return [join(home, 'Library', 'Application Support', 'BraveSoftware', 'Brave-Browser')]
+    const relativePaths: Record<Exclude<ManagedChromiumBrowserId, 'chrome'>, string> = {
+      brave: join('BraveSoftware', 'Brave-Browser'),
+      edge: 'Microsoft Edge',
+      arc: join('Arc', 'User Data'),
+      chromium: 'Chromium',
+      'chrome-for-testing': join('Google', 'Chrome for Testing'),
+    }
+    return [join(home, 'Library', 'Application Support', relativePaths[browser])]
   }
   if (osPlatform === 'win32') {
     const localAppData = env.LOCALAPPDATA
-    return localAppData ? [join(localAppData, 'BraveSoftware', 'Brave-Browser', 'User Data')] : []
+    if (!localAppData) return []
+    const relativePaths: Record<Exclude<ManagedChromiumBrowserId, 'chrome' | 'arc'>, string> = {
+      brave: join('BraveSoftware', 'Brave-Browser', 'User Data'),
+      edge: join('Microsoft', 'Edge', 'User Data'),
+      chromium: join('Chromium', 'User Data'),
+      'chrome-for-testing': join('Google', 'Chrome for Testing', 'User Data'),
+    }
+    if (browser === 'arc') {
+      return [
+        join(localAppData, 'Packages', 'TheBrowserCompany.Arc_ttt1ap7aakyb4', 'LocalCache', 'Local', 'Arc', 'User Data'),
+        join(localAppData, 'TheBrowserCompany', 'Arc', 'User Data'),
+      ]
+    }
+    return [join(localAppData, relativePaths[browser])]
   }
-  return [
-    join(home, '.config', 'BraveSoftware', 'Brave-Browser'),
-    join(home, '.config', 'brave'),
-  ]
+  if (browser === 'arc') return []
+  const relativePaths: Record<Exclude<ManagedChromiumBrowserId, 'chrome' | 'arc'>, readonly string[]> = {
+    brave: [join('BraveSoftware', 'Brave-Browser'), 'brave'],
+    edge: ['microsoft-edge', 'microsoft-edge-stable'],
+    chromium: ['chromium'],
+    'chrome-for-testing': ['chrome-for-testing'],
+  }
+  return relativePaths[browser].map((relativePath) => join(home, '.config', relativePath))
+}
+
+export async function discoverKnownChromiumProfiles(options: {
+  browsers?: readonly ManagedChromiumBrowserId[]
+} = {}): Promise<ChromiumUserDataRoot[]> {
+  const browsers = options.browsers ?? MANAGED_CHROMIUM_BROWSER_IDS
+  const roots = await Promise.all(browsers.map((browser) => discoverChromiumProfiles({ browser })))
+  return roots.flat()
 }
 
 export async function discoverChromeProfiles(options: { userDataDirs?: readonly string[] } = {}): Promise<ChromeUserDataRoot[]> {
@@ -60,7 +103,7 @@ export async function discoverChromeProfiles(options: { userDataDirs?: readonly
     browser: 'chrome',
     ...(options.userDataDirs ? { userDataDirs: options.userDataDirs } : {}),
   })
-  return roots.map(({ userDataDir, profiles }) => ({ userDataDir, profiles }))
+  return roots.map(({ userDataDir, browserVersion, profiles }) => ({ userDataDir, browserVersion, profiles }))
 }
 
 export async function discoverChromiumProfiles(options: {
@@ -71,18 +114,24 @@ export async function discoverChromiumProfiles(options: {
   const discovered: ChromeUserDataRoot[] = []
   for (const root of roots) {
     const userDataDir = resolve(root)
-    const localStatePath = join(userDataDir, 'Local State')
     try {
-      await access(localStatePath)
-      const parsed = JSON.parse(await readFile(localStatePath, 'utf8')) as unknown
-      const profileCache = readProfileCache(parsed)
-      const profiles: ChromeProfileCandidate[] = []
-      for (const [directoryKey, metadata] of Object.entries(profileCache)) {
-        const candidate = await chromeProfileCandidate(userDataDir, directoryKey, metadata)
-        if (candidate) profiles.push(candidate)
-      }
+      const rootStat = await stat(userDataDir)
+      if (!rootStat.isDirectory()) continue
+      const browserVersion = await readChromeProfileVersion(userDataDir)
+      const entries = await readdir(userDataDir, { withFileTypes: true })
+      const profiles = entries
+        .filter((entry) => entry.isDirectory() && isChromiumProfileDirectoryKey(entry.name))
+        .map((entry): ChromeProfileCandidate => ({
+          userDataDir,
+          directoryKey: entry.name,
+          profileDir: resolve(userDataDir, entry.name),
+          name: entry.name,
+          isDefault: entry.name === 'Default',
+          browserVersion,
+        }))
       discovered.push({
         userDataDir,
+        browserVersion,
         profiles: profiles.sort((left, right) => left.directoryKey.localeCompare(right.directoryKey)),
       })
     } catch (error) {
@@ -104,14 +153,24 @@ export async function resolveChromeProfile(userDataDir: string, directoryKey: st
   if (!profileStat.isDirectory()) {
     throw tokenlessError('chrome_profile_not_found', 'Chrome profile directory is not a directory.')
   }
-  const state = await readChromeLocalState(root)
-  const metadata = readProfileCache(state)[key] ?? {}
+  const browserVersion = await readChromeProfileVersion(root)
   return {
     userDataDir: root,
     directoryKey: key,
     profileDir,
-    name: typeof metadata.name === 'string' && metadata.name.trim() ? metadata.name.trim() : key,
-    isDefault: metadata.is_using_default_name === true || key === 'Default',
+    name: key,
+    isDefault: key === 'Default',
+    browserVersion,
+  }
+}
+
+export async function readChromeProfileVersion(userDataDir: string): Promise<string | null> {
+  try {
+    const value = (await readFile(resolve(userDataDir, 'Last Version'), 'utf8')).trim()
+    return /^\d+\.\d+\.\d+\.\d+$/.test(value) ? value : null
+  } catch (error) {
+    if (isIgnorableDiscoveryError(error)) return null
+    throw error
   }
 }
 
@@ -132,60 +191,12 @@ export function validateChromeProfileDirectoryKey(directoryKey: string): string
   return directoryKey
 }
 
-export async function readChromeLocalState(userDataDir: string): Promise<Record<string, unknown>> {
-  const root = resolve(userDataDir)
-  const localStatePath = resolve(root, 'Local State')
-  if (!isPathInside(root, localStatePath)) {
-    throw tokenlessError('chrome_profile_path_escape', 'Chrome Local State path escapes its user data root.')
-  }
-  const localStateStat = await stat(localStatePath)
-  if (!localStateStat.isFile()) {
-    throw tokenlessError('chrome_local_state_missing', 'Chrome Local State is not a regular file.')
-  }
-  const parsed = JSON.parse(await readFile(localStatePath, 'utf8')) as unknown
-  if (!isRecord(parsed)) throw tokenlessError('chrome_local_state_invalid', 'Chrome Local State is malformed.')
-  return parsed
-}
-
-function readProfileCache(localState: unknown): Record<string, Record<string, unknown>> {
-  if (!isRecord(localState)) return {}
-  const profile = localState.profile
-  if (!isRecord(profile)) return {}
-  const infoCache = profile.info_cache
-  if (!isRecord(infoCache)) return {}
-  const cache: Record<string, Record<string, unknown>> = {}
-  for (const [key, metadata] of Object.entries(infoCache)) {
-    if (isRecord(metadata)) cache[key] = metadata
-  }
-  return cache
-}
-
-async function chromeProfileCandidate(userDataDir: string, directoryKey: string, metadata: Record<string, unknown>): Promise<ChromeProfileCandidate | null> {
-  let key: string
-  try {
-    key = validateChromeProfileDirectoryKey(directoryKey)
-  } catch {
-    return null
-  }
-  const profileDir = resolve(userDataDir, key)
-  if (!isPathInside(userDataDir, profileDir)) return null
-  try {
-    const profileStat = await stat(profileDir)
-    if (!profileStat.isDirectory()) return null
-  } catch {
-    return null
-  }
-  return {
-    userDataDir,
-    directoryKey: key,
-    profileDir,
-    name: typeof metadata.name === 'string' && metadata.name.trim() ? metadata.name.trim() : key,
-    isDefault: metadata.is_using_default_name === true || key === 'Default',
-  }
+function isChromiumProfileDirectoryKey(directoryKey: string) {
+  return directoryKey === 'Default' || /^Profile \d+$/.test(directoryKey)
 }
 
 function isIgnorableDiscoveryError(error: unknown) {
-  return error instanceof SyntaxError || (isRecord(error) && (error.code === 'ENOENT' || error.code === 'EACCES'))
+  return isRecord(error) && (error.code === 'ENOENT' || error.code === 'EACCES')
 }
 
 function isRecord(value: unknown): value is Record<string, unknown> {
diff --git a/packages/cli/src/playwright/profiles/import.ts b/packages/cli/src/playwright/profiles/import.ts
deleted file mode 100644
index 9a83438..0000000
--- a/packages/cli/src/playwright/profiles/import.ts
+++ /dev/null
@@ -1,752 +0,0 @@
-import { createHash, randomUUID } from 'node:crypto'
-import { constants as fsConstants } from 'node:fs'
-import { chmod, copyFile, lstat, mkdir, readFile, realpath, rename, rm, writeFile } from 'node:fs/promises'
-import { basename, dirname, join, relative, resolve, sep } from 'node:path'
-import { tokenlessError } from '../errors.js'
-import type { ProviderId } from '../providers.js'
-import { resolveChromeProfile } from './chrome-discovery.js'
-import { isPathInside } from './registry.js'
-
-export type ChromeProfileImportOptions = {
-  sourceUserDataDir: string
-  profileDirectoryKey: string
-  destinationDir: string
-  tokenlessHome: string
-  providers?: readonly ProviderId[]
-  copyFile?: (source: string, destination: string) => Promise<void>
-}
-
-export type ChromeProfileImportResult = {
-  destinationDir: string
-  copiedFiles: number
-  skippedEntries: readonly string[]
-  cookieAuth: ChromeCookieAuthImportResult
-  syncDisabled: true
-}
-
-export type ChromeCookieAuthImportResult = {
-  providers: readonly ChromeCookieAuthProviderResult[]
-  totalCookies: number
-}
-
-export type ChromeCookieAuthProviderResult = {
-  provider: ProviderId
-  cookies: number
-  supported: boolean
-}
-
-type SqliteDatabase = import('node:sqlite').DatabaseSync
-type SqliteValue = null | number | bigint | string | NodeJS.ArrayBufferView
-
-const PROVIDER_COOKIE_AUTH_DOMAINS: Readonly<Record<'chatgpt' | 'claude' | 'grok', readonly string[]>> = Object.freeze({
-  chatgpt: Object.freeze(['chatgpt.com', 'openai.com']),
-  claude: Object.freeze(['claude.ai', 'anthropic.com']),
-  grok: Object.freeze(['grok.com', 'x.ai']),
-})
-
-const PROFILE_EXCLUDE_EXACT = new Set([
-  'Archived History',
-  'AutofillStrikeDatabase',
-  'Bookmarks',
-  'Bookmarks.bak',
-  'BrowserMetrics',
-  'Cache',
-  'Code Cache',
-  'Cookies',
-  'Cookies-journal',
-  'Current Session',
-  'Current Tabs',
-  'Crashpad',
-  'DawnGraphiteCache',
-  'DawnWebGPUCache',
-  'Download Service',
-  'Extension Rules',
-  'Extension Scripts',
-  'Extension State',
-  'Extensions',
-  'Favicons',
-  'GPUCache',
-  'GrShaderCache',
-  'History',
-  'History Provider Cache',
-  'History-journal',
-  'Login Data',
-  'Login Data For Account',
-  'Login Data For Account-journal',
-  'Login Data-journal',
-  'Media History',
-  'Network/Cookies',
-  'Network/Cookies-journal',
-  'Network Action Predictor',
-  'Network Action Predictor-journal',
-  'OptimizationHints',
-  'Payments',
-  'Preferences.backup',
-  'Safe Browsing Cookies',
-  'Safe Browsing Cookies-journal',
-  'Last Session',
-  'Last Tabs',
-  'IndexedDB',
-  'Local Storage',
-  'Service Worker',
-  'Session Storage',
-  'Sessions',
-  'ShaderCache',
-  'Shortcuts',
-  'Sync Data',
-  'Top Sites',
-  'TransportSecurity',
-  'Visited Links',
-  'Web Data',
-  'Web Data-journal',
-])
-
-const ROOT_INCLUDE_EXACT = new Set([
-  'Local State',
-  'First Run',
-])
-const MANAGED_PROFILE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
-
-export async function importChromeProfile(options: ChromeProfileImportOptions): Promise<ChromeProfileImportResult> {
-  const tokenlessHome = resolve(options.tokenlessHome)
-  const destinationDir = resolve(options.destinationDir)
-  const profilesRoot = resolve(tokenlessHome, 'browser', 'profiles')
-  if (dirname(destinationDir) !== profilesRoot || !MANAGED_PROFILE_ID_PATTERN.test(basename(destinationDir))) {
-    throw tokenlessError(
-      'unsafe_managed_profile_destination',
-      'Managed Chrome profile destination must be a UUID directory directly inside Tokenless profiles root.'
-    )
-  }
-  const source = await resolveChromeProfile(options.sourceUserDataDir, options.profileDirectoryKey)
-  const sourceRoot = resolve(source.userDataDir)
-  const sourceProfile = resolve(source.profileDir)
-  if (isPathInside(tokenlessHome, sourceRoot)) {
-    throw tokenlessError('chrome_profile_inside_tokenless_home', 'Refusing to import a Chrome profile from Tokenless home.')
-  }
-  const destinationParent = dirname(destinationDir)
-  await mkdir(destinationParent, { recursive: true, mode: 0o700 })
-  const staging = join(destinationParent, `.staging-${randomUUID()}`)
-  const skippedEntries: string[] = []
-  const copyFileImpl = options.copyFile ?? ((sourcePath, destinationPath) => copyFile(sourcePath, destinationPath, fsConstants.COPYFILE_EXCL))
-  let copiedFiles = 0
-  const cookieAuth = createEmptyCookieAuthResult(options.providers ?? [])
-  try {
-    await mkdir(staging, { mode: 0o700 })
-    const sourceRootReal = await realpath(sourceRoot)
-    const sourceProfileReal = await realpath(sourceProfile)
-    await copySelectedRootFiles(sourceRoot, sourceRootReal, staging, skippedEntries, copyFileImpl, () => {
-      copiedFiles += 1
-    })
-    const stagingProfile = join(staging, source.directoryKey)
-    await mkdir(stagingProfile, { recursive: true, mode: 0o700 })
-    await copyProfileTree(sourceProfile, sourceProfileReal, stagingProfile, skippedEntries, copyFileImpl, () => {
-      copiedFiles += 1
-    })
-    copiedFiles += await importProviderCookies({
-      sourceProfile,
-      stagingProfile,
-      providers: options.providers ?? [],
-      result: cookieAuth,
-    })
-    await disableSyncInClone(staging, source.directoryKey)
-    await rm(destinationDir, { recursive: true, force: true })
-    await rename(staging, destinationDir)
-    await chmod(destinationDir, 0o700)
-    return {
-      destinationDir,
-      copiedFiles,
-      skippedEntries,
-      cookieAuth,
-      syncDisabled: true,
-    }
-  } catch (error) {
-    await rm(staging, { recursive: true, force: true })
-    throw error
-  }
-}
-
-export function shouldCopyChromeEntry(relativeEntry: string, scope: 'root' | 'profile') {
-  const normalized = normalizeRelativeEntry(relativeEntry)
-  if (scope === 'root') return ROOT_INCLUDE_EXACT.has(normalized)
-  if (PROFILE_EXCLUDE_EXACT.has(normalized)) return false
-  const firstSegment = normalized.split('/')[0] ?? normalized
-  if (PROFILE_EXCLUDE_EXACT.has(firstSegment)) return false
-  if (/cache|crash|download|history|bookmark|password|autofill|payment|extension|sync/i.test(normalized)) return false
-  return true
-}
-
-async function copySelectedRootFiles(
-  sourceRoot: string,
-  sourceRootReal: string,
-  staging: string,
-  skippedEntries: string[],
-  copyFileImpl: (source: string, destination: string) => Promise<void>,
-  onFileCopied: () => void
-) {
-  for (const entry of ROOT_INCLUDE_EXACT) {
-    const source = resolve(sourceRoot, entry)
-    const destination = resolve(staging, entry)
-    await copySafeEntry(source, sourceRootReal, destination, 'root', skippedEntries, copyFileImpl, onFileCopied)
-  }
-}
-
-async function copyProfileTree(
-  sourceProfile: string,
-  sourceProfileReal: string,
-  stagingProfile: string,
-  skippedEntries: string[],
-  copyFileImpl: (source: string, destination: string) => Promise<void>,
-  onFileCopied: () => void
-) {
-  await copySafeEntry(sourceProfile, sourceProfileReal, stagingProfile, 'profile', skippedEntries, copyFileImpl, onFileCopied)
-}
-
-async function copySafeEntry(
-  source: string,
-  sourceRootReal: string,
-  destination: string,
-  scope: 'root' | 'profile',
-  skippedEntries: string[],
-  copyFileImpl: (source: string, destination: string) => Promise<void>,
-  onFileCopied: () => void
-) {
-  let sourceStat
-  try {
-    sourceStat = await lstat(source)
-  } catch (error) {
-    if (isMissingFile(error) && scope === 'root') return
-    throw error
-  }
-  if (sourceStat.isSymbolicLink()) {
-    throw tokenlessError('chrome_profile_symlink_rejected', 'Chrome profile import refuses symbolic links.')
-  }
-  const sourceReal = await realpath(source)
-  if (!isPathInside(sourceRootReal, sourceReal)) {
-    throw tokenlessError('chrome_profile_path_escape', 'Chrome profile import refuses path escapes.')
-  }
-  const relativeEntry = relative(sourceRootReal, sourceReal).split(sep).join('/')
-  const scopedRelative = scope === 'profile' ? relativeEntry : basename(source)
-  if (!shouldCopyChromeEntry(scopedRelative, scope)) {
-    skippedEntries.push(scopedRelative)
-    return
-  }
-  if (sourceStat.isDirectory()) {
-    await mkdir(destination, { recursive: true, mode: 0o700 })
-    const entries = await import('node:fs/promises').then((fs) => fs.readdir(source))
-    for (const entry of entries) {
-      await copySafeEntry(join(source, entry), sourceRootReal, join(destination, entry), scope, skippedEntries, copyFileImpl, onFileCopied)
-    }
-    return
-  }
-  if (!sourceStat.isFile()) {
-    skippedEntries.push(scopedRelative)
-    return
-  }
-  await mkdir(dirname(destination), { recursive: true, mode: 0o700 })
-  await copyFileImpl(source, destination)
-  const copied = await lstat(destination)
-  if (!copied.isFile() || copied.isSymbolicLink()) {
-    throw tokenlessError('chrome_profile_copy_failed', 'Chrome profile copy did not produce a regular file.')
-  }
-  await chmod(destination, 0o600)
-  onFileCopied()
-}
-
-async function importProviderCookies({
-  sourceProfile,
-  stagingProfile,
-  providers,
-  result,
-}: {
-  sourceProfile: string
-  stagingProfile: string
-  providers: readonly ProviderId[]
-  result: ChromeCookieAuthImportResult
-}) {
-  const requested = selectedCookieAuthProviders(providers)
-  if (requested.length === 0) return 0
-  let createdDatabases = 0
-  for (const databasePath of ['Cookies', 'Network/Cookies']) {
-    const sourcePath = join(sourceProfile, databasePath)
-    const destinationPath = join(stagingProfile, databasePath)
-    if (!await isReadableRegularFile(sourcePath)) continue
-    const created = await importProviderCookieDatabase({
-      sourcePath,
-      destinationPath,
-      providers: requested,
-      result,
-    })
-    if (created) createdDatabases += 1
-  }
-  return createdDatabases
-}
-
-async function importProviderCookieDatabase({
-  sourcePath,
-  destinationPath,
-  providers,
-  result,
-}: {
-  sourcePath: string
-  destinationPath: string
-  providers: readonly CookieAuthProviderPolicy[]
-  result: ChromeCookieAuthImportResult
-}) {
-  const { DatabaseSync } = await loadSqliteModule()
-  let source: SqliteDatabase | undefined
-  let destination: SqliteDatabase | undefined
-  let sourceTransactionOpen = false
-  try {
-    source = new DatabaseSync(sourcePath, {
-      readOnly: true,
-      enableForeignKeyConstraints: false,
-    })
-    source.exec('BEGIN')
-    sourceTransactionOpen = true
-    const columns = cookieTableColumns(source)
-    if (!columns.includes('host_key')) return false
-    await mkdir(dirname(destinationPath), { recursive: true, mode: 0o700 })
-    destination = new DatabaseSync(destinationPath, {
-      enableForeignKeyConstraints: false,
-    })
-    createCookieDatabaseSchema(source, destination)
-    copyAllowedCookieRows({ source, destination, columns, providers, result })
-    assertImportedCookieRowsMatchPolicy({ destination, columns, providers })
-    destination.exec('PRAGMA optimize')
-    destination.close()
-    destination = undefined
-    await chmod(destinationPath, 0o600)
-    return true
-  } catch (error) {
-    if (isTokenlessError(error)) throw error
-    throw tokenlessError('chrome_cookie_import_failed', 'Cannot import selected provider cookies from Chrome profile.', { cause: error })
-  } finally {
-    if (sourceTransactionOpen) {
-      try {
-        source?.exec('ROLLBACK')
-      } catch {
-        // Preserve the primary import error.
-      }
-    }
-    try {
-      source?.close()
-    } catch {
-      // Preserve the primary import error.
-    }
-    try {
-      destination?.close()
-    } catch {
-      // Preserve the primary import error.
-    }
-  }
-}
-
-function createEmptyCookieAuthResult(providers: readonly ProviderId[]): ChromeCookieAuthImportResult {
-  return {
-    providers: [...new Set(providers)].map((provider) => ({
-      provider,
-      cookies: 0,
-      supported: provider in PROVIDER_COOKIE_AUTH_DOMAINS,
-    })),
-    totalCookies: 0,
-  }
-}
-
-function selectedCookieAuthProviders(providers: readonly ProviderId[]): CookieAuthProviderPolicy[] {
-  const seen = new Set<ProviderId>()
-  const selected: CookieAuthProviderPolicy[] = []
-  for (const provider of providers) {
-    if (seen.has(provider)) continue
-    seen.add(provider)
-    if (provider === 'gemini') continue
-    const domains = PROVIDER_COOKIE_AUTH_DOMAINS[provider as keyof typeof PROVIDER_COOKIE_AUTH_DOMAINS]
-    if (!domains) continue
-    selected.push({ provider, domains })
-  }
-  return selected
-}
-
-type CookieAuthProviderPolicy = {
-  provider: ProviderId
-  domains: readonly string[]
-}
-
-type SqliteTableColumn = {
-  cid: number
-  name: string
-  type: string
-  notNull: boolean
-  primaryKeyRank: number
-}
-
-type SqliteIndexSchema = {
-  name: string
-  table: 'cookies' | 'meta'
-  unique: boolean
-  origin: string
-  partial: boolean
-  columns: readonly string[]
-}
-
-const SAFE_DECLARED_TYPE_PATTERN = /^[A-Za-z][A-Za-z0-9_]*(?:\s+[A-Za-z][A-Za-z0-9_]*)*(?:\s*\(\s*[0-9]+(?:\s*,\s*[0-9]+)?\s*\))?$/
-
-function cookieTableColumns(database: SqliteDatabase) {
-  return readTableColumns(database, 'cookies').map((column) => column.name)
-}
-
-function createCookieDatabaseSchema(source: SqliteDatabase, destination: SqliteDatabase) {
-  for (const table of ['meta', 'cookies'] as const) {
-    const columns = readTableColumns(source, table)
-    if (columns.length === 0) continue
-    const indexes = readIndexSchemas(source, table)
-    destination.exec(createTableSql(table, columns, indexes))
-  }
-  for (const table of ['meta', 'cookies'] as const) {
-    if (!tableExists(destination, table)) continue
-    for (const index of readIndexSchemas(source, table)) {
-      if (!shouldCreateStandaloneIndex(index)) continue
-      destination.exec(createIndexSql(index))
-    }
-  }
-  copyMetadataRows(source, destination)
-  copySqliteSequenceRows(source, destination)
-}
-
-function readTableColumns(database: SqliteDatabase, table: 'cookies' | 'meta'): SqliteTableColumn[] {
-  return database.prepare(`PRAGMA table_info(${quoteSqlIdentifier(table)})`).all()
-    .map((row) => sqliteTableColumn(row))
-    .filter((column): column is SqliteTableColumn => column !== null)
-    .sort((left, right) => left.cid - right.cid)
-}
-
-function sqliteTableColumn(row: unknown): SqliteTableColumn | null {
-  if (!isRecord(row)) return null
-  const cid = sqliteInteger(row.cid)
-  const primaryKeyRank = sqliteInteger(row.pk)
-  if (cid === null || primaryKeyRank === null || typeof row.name !== 'string') return null
-  assertSafeSqlIdentifier(row.name)
-  return {
-    cid,
-    name: row.name,
-    type: safeDeclaredType(row.type),
-    notNull: sqliteBoolean(row.notnull),
-    primaryKeyRank,
-  }
-}
-
-function createTableSql(table: 'cookies' | 'meta', columns: readonly SqliteTableColumn[], indexes: readonly SqliteIndexSchema[]) {
-  const primaryKeyColumns = columns
-    .filter((column) => column.primaryKeyRank > 0)
-    .sort((left, right) => left.primaryKeyRank - right.primaryKeyRank)
-    .map((column) => column.name)
-  const columnDefinitions = columns.map((column) => {
-    const definition = [quoteSqlIdentifier(column.name)]
-    if (column.type) definition.push(column.type)
-    if (column.notNull) definition.push('NOT NULL')
-    return definition.join(' ')
-  })
-  const tableConstraints = []
-  if (primaryKeyColumns.length > 0) {
-    tableConstraints.push(`PRIMARY KEY (${primaryKeyColumns.map(quoteSqlIdentifier).join(', ')})`)
-  }
-  for (const index of indexes) {
-    if (!shouldCreateUniqueTableConstraint(index, primaryKeyColumns)) continue
-    tableConstraints.push(`UNIQUE (${index.columns.map(quoteSqlIdentifier).join(', ')})`)
-  }
-  return `CREATE TABLE ${quoteSqlIdentifier(table)} (${[...columnDefinitions, ...tableConstraints].join(', ')})`
-}
-
-function readIndexSchemas(database: SqliteDatabase, table: 'cookies' | 'meta'): SqliteIndexSchema[] {
-  return database.prepare(`PRAGMA index_list(${quoteSqlIdentifier(table)})`).all()
-    .map((row) => sqliteIndexSchema(database, table, row))
-    .filter((index): index is SqliteIndexSchema => index !== null)
-}
-
-function sqliteIndexSchema(database: SqliteDatabase, table: 'cookies' | 'meta', row: unknown): SqliteIndexSchema | null {
-  if (!isRecord(row) || typeof row.name !== 'string') return null
-  assertSafeSqlIdentifier(row.name)
-  const unique = sqliteBoolean(row.unique)
-  const origin = typeof row.origin === 'string' ? row.origin : ''
-  const partial = sqliteBoolean(row.partial)
-  const columns = database.prepare(`PRAGMA index_info(${quoteSqlIdentifier(row.name)})`).all()
-    .map((entry) => isRecord(entry) && typeof entry.name === 'string' ? entry.name : '')
-    .filter(Boolean)
-  if (columns.length === 0) return null
-  for (const column of columns) assertSafeSqlIdentifier(column)
-  return {
-    name: row.name,
-    table,
-    unique,
-    origin,
-    partial,
-    columns,
-  }
-}
-
-function shouldCreateUniqueTableConstraint(index: SqliteIndexSchema, primaryKeyColumns: readonly string[]) {
-  if (!index.unique || index.origin !== 'u' || index.partial) return false
-  if (!index.name.startsWith('sqlite_autoindex_')) return false
-  return !sameColumns(index.columns, primaryKeyColumns)
-}
-
-function shouldCreateStandaloneIndex(index: SqliteIndexSchema) {
-  if (index.origin === 'pk' || index.origin === 'u' || index.partial) return false
-  if (index.name.toLowerCase().startsWith('sqlite_')) return false
-  return true
-}
-
-function createIndexSql(index: SqliteIndexSchema) {
-  const unique = index.unique ? 'UNIQUE ' : ''
-  return `CREATE ${unique}INDEX ${quoteSqlIdentifier(index.name)} ON ${quoteSqlIdentifier(index.table)} (${index.columns.map(quoteSqlIdentifier).join(', ')})`
-}
-
-function sameColumns(left: readonly string[], right: readonly string[]) {
-  return left.length === right.length && left.every((column, index) => column === right[index])
-}
-
-function safeDeclaredType(value: unknown) {
-  if (value === null || value === undefined) return ''
-  if (typeof value !== 'string') {
-    throw tokenlessError('chrome_cookie_schema_unsupported', 'Chrome cookie database uses an unsupported column type.')
-  }
-  const normalized = value.trim().replace(/\s+/g, ' ')
-  if (!normalized) return ''
-  if (!SAFE_DECLARED_TYPE_PATTERN.test(normalized)) {
-    throw tokenlessError('chrome_cookie_schema_unsupported', 'Chrome cookie database uses an unsupported column type.')
-  }
-  return normalized
-}
-
-function sqliteInteger(value: unknown) {
-  if (typeof value === 'number' && Number.isInteger(value)) return value
-  if (typeof value === 'bigint') return Number(value)
-  return null
-}
-
-function sqliteBoolean(value: unknown) {
-  return value === 1 || value === 1n || value === true
-}
-
-function assertSafeSqlIdentifier(identifier: string) {
-  if (identifier.length === 0 || identifier.includes('\0')) {
-    throw tokenlessError('chrome_cookie_schema_unsupported', 'Chrome cookie database uses an unsupported identifier.')
-  }
-}
-
-function copyMetadataRows(source: SqliteDatabase, destination: SqliteDatabase) {
-  if (!tableExists(source, 'meta') || !tableExists(destination, 'meta')) return
-  const columns = readTableColumns(source, 'meta').map((column) => column.name)
-  if (columns.length === 0) return
-  const quotedColumns = columns.map(quoteSqlIdentifier)
-  const select = source.prepare(`SELECT ${quotedColumns.join(', ')} FROM meta`)
-  const insert = destination.prepare(`INSERT INTO meta (${quotedColumns.join(', ')}) VALUES (${columns.map(() => '?').join(', ')})`)
-  for (const row of select.iterate()) {
-    insert.run(...columns.map((column) => row[column] as SqliteValue))
-  }
-}
-
-function copySqliteSequenceRows(source: SqliteDatabase, destination: SqliteDatabase) {
-  if (!tableExists(source, 'sqlite_sequence') || !tableExists(destination, 'sqlite_sequence')) return
-  const select = source.prepare("SELECT name, seq FROM sqlite_sequence WHERE name IN ('cookies', 'meta')")
-  const insert = destination.prepare('INSERT INTO sqlite_sequence (name, seq) VALUES (?, ?)')
-  for (const row of select.iterate()) {
-    if (!isRecord(row) || typeof row.name !== 'string') continue
-    insert.run(row.name, row.seq as SqliteValue)
-  }
-}
-
-function tableExists(database: SqliteDatabase, table: string) {
-  return Boolean(database.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(table))
-}
-
-function copyAllowedCookieRows({
-  source,
-  destination,
-  columns,
-  providers,
-  result,
-}: {
-  source: SqliteDatabase
-  destination: SqliteDatabase
-  columns: readonly string[]
-  providers: readonly CookieAuthProviderPolicy[]
-  result: ChromeCookieAuthImportResult
-}) {
-  const quotedColumns = columns.map(quoteSqlIdentifier)
-  const select = source.prepare(`SELECT ${quotedColumns.join(', ')} FROM cookies WHERE host_key IS NOT NULL`)
-  select.setReadBigInts(true)
-  const insert = destination.prepare(`INSERT INTO cookies (${quotedColumns.join(', ')}) VALUES (${columns.map(() => '?').join(', ')})`)
-  const hasTopFrameSiteKey = columns.includes('top_frame_site_key')
-  destination.exec('BEGIN IMMEDIATE')
-  try {
-    for (const row of select.iterate()) {
-      const provider = cookieRowProvider(row, providers, hasTopFrameSiteKey)
-      if (!provider) continue
-      insert.run(...columns.map((column) => row[column] as SqliteValue))
-      incrementCookieAuthResult(result, provider)
-    }
-    destination.exec('COMMIT')
-  } catch (error) {
-    destination.exec('ROLLBACK')
-    throw error
-  }
-}
-
-function assertImportedCookieRowsMatchPolicy({
-  destination,
-  columns,
-  providers,
-}: {
-  destination: SqliteDatabase
-  columns: readonly string[]
-  providers: readonly CookieAuthProviderPolicy[]
-}) {
-  const selectedColumns = ['host_key']
-  const hasTopFrameSiteKey = columns.includes('top_frame_site_key')
-  if (hasTopFrameSiteKey) selectedColumns.push('top_frame_site_key')
-  const select = destination.prepare(`SELECT ${selectedColumns.map(quoteSqlIdentifier).join(', ')} FROM cookies`)
-  for (const row of select.iterate()) {
-    if (cookieRowProvider(row, providers, hasTopFrameSiteKey)) continue
-    throw tokenlessError(
-      'chrome_cookie_import_invariant_failed',
-      'Imported Chrome cookie database contains a row outside the selected provider cookie policy.'
-    )
-  }
-}
-
-function cookieRowProvider(row: Record<string, unknown>, providers: readonly CookieAuthProviderPolicy[], hasTopFrameSiteKey: boolean) {
-  const host = normalizeCookieHost(row.host_key)
-  if (!host) return null
-  for (const provider of providers) {
-    if (!domainMatchesAny(host, provider.domains)) continue
-    if (hasTopFrameSiteKey && !partitionKeyMatchesProvider(row.top_frame_site_key, provider.domains)) continue
-    return provider.provider
-  }
-  return null
-}
-
-function partitionKeyMatchesProvider(value: unknown, domains: readonly string[]) {
-  if (value === null || value === undefined || value === '') return true
-  if (typeof value !== 'string') return false
-  const host = normalizePartitionKeyHost(value)
-  return Boolean(host && domainMatchesAny(host, domains))
-}
-
-function normalizePartitionKeyHost(value: string) {
-  const trimmed = value.trim()
-  if (!trimmed) return ''
-  try {
-    return normalizeCookieHost(new URL(trimmed).hostname)
-  } catch {
-    return normalizeCookieHost(trimmed.replace(/^[a-z][a-z0-9+.-]*:\/\//i, '').split('/')[0] ?? '')
-  }
-}
-
-function normalizeCookieHost(value: unknown) {
-  if (typeof value !== 'string') return ''
-  return value.trim().toLowerCase().replace(/^\.+/, '')
-}
-
-function domainMatchesAny(host: string, domains: readonly string[]) {
-  return domains.some((domain) => host === domain || host.endsWith(`.${domain}`))
-}
-
-function incrementCookieAuthResult(result: ChromeCookieAuthImportResult, provider: ProviderId) {
-  const entry = result.providers.find((candidate) => candidate.provider === provider)
-  if (entry) {
-    ;(entry as { cookies: number }).cookies += 1
-    result.totalCookies += 1
-  }
-}
-
-function quoteSqlIdentifier(identifier: string) {
-  return `"${identifier.replaceAll('"', '""')}"`
-}
-
-async function isReadableRegularFile(path: string) {
-  try {
-    const metadata = await lstat(path)
-    return metadata.isFile() && !metadata.isSymbolicLink()
-  } catch (error) {
-    if (isMissingFile(error)) return false
-    throw error
-  }
-}
-
-function loadSqliteModule(): Promise<typeof import('node:sqlite')> {
-  return import('node:sqlite')
-}
-
-async function disableSyncInClone(stagingRoot: string, profileDirectoryKey: string) {
-  const localStatePath = join(stagingRoot, 'Local State')
-  const localState = await readJsonIfPresent(localStatePath)
-  if (localState) {
-    const sync = isRecord(localState.sync) ? localState.sync : {}
-    localState.sync = {
-      ...sync,
-      disabled: true,
-    }
-    await writeJson(localStatePath, localState)
-  }
-  const preferencesPath = join(stagingRoot, profileDirectoryKey, 'Preferences')
-  const preferences = await readJsonIfPresent(preferencesPath)
-  if (preferences) {
-    preferences.sync = {
-      ...(isRecord(preferences.sync) ? preferences.sync : {}),
-      requested: false,
-    }
-    await writeJson(preferencesPath, preferences)
-  }
-}
-
-async function readJsonIfPresent(path: string): Promise<Record<string, unknown> | null> {
-  try {
-    const value = JSON.parse(await readFile(path, 'utf8')) as unknown
-    return isRecord(value) ? value : null
-  } catch (error) {
-    if (isMissingFile(error) || error instanceof SyntaxError) return null
-    throw error
-  }
-}
-
-async function writeJson(path: string, value: Record<string, unknown>) {
-  await writeFile(path, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 })
-  await chmod(path, 0o600)
-}
-
-function normalizeRelativeEntry(value: string) {
-  return value.split('\\').join('/').replace(/^\/+/, '').replace(/\/+$/, '')
-}
-
-function isMissingFile(error: unknown) {
-  return isRecord(error) && error.code === 'ENOENT'
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return Boolean(value && typeof value === 'object' && !Array.isArray(value))
-}
-
-function isTokenlessError(error: unknown) {
-  return Boolean(error && typeof error === 'object' && 'name' in error && error.name === 'TokenlessPlaywrightError')
-}
-
-export async function assertSourceUnchanged(before: readonly { path: string; size: number; mtimeMs: number; sha256?: string; dev?: number; ino?: number }[]) {
-  for (const entry of before) {
-    const after = await lstat(entry.path)
-    if (!after.isFile() || after.isSymbolicLink()) {
-      throw tokenlessError('chrome_source_profile_changed', 'Chrome source profile changed during import.')
-    }
-    if ((entry.dev !== undefined && after.dev !== entry.dev) || (entry.ino !== undefined && after.ino !== entry.ino)) {
-      throw tokenlessError('chrome_source_profile_changed', 'Chrome source profile changed during import.')
-    }
-    if (after.size !== entry.size || after.mtimeMs !== entry.mtimeMs) {
-      throw tokenlessError('chrome_source_profile_changed', 'Chrome source profile changed during import.')
-    }
-    if (entry.sha256 !== undefined) {
-      const digest = createHash('sha256').update(await readFile(entry.path)).digest('hex')
-      if (digest !== entry.sha256) {
-        throw tokenlessError('chrome_source_profile_changed', 'Chrome source profile changed during import.')
-      }
-    }
-  }
-}
diff --git a/packages/cli/src/playwright/profiles/opaque-copy.ts b/packages/cli/src/playwright/profiles/opaque-copy.ts
new file mode 100644
index 0000000..b6a0a86
--- /dev/null
+++ b/packages/cli/src/playwright/profiles/opaque-copy.ts
@@ -0,0 +1,112 @@
+import { randomUUID } from 'node:crypto'
+import { constants as fsConstants } from 'node:fs'
+import { chmod, copyFile, lstat, mkdir, readdir, realpath, rename, rm } from 'node:fs/promises'
+import { basename, dirname, join, resolve } from 'node:path'
+import { tokenlessError } from '../errors.js'
+import { resolveChromeProfile } from './chrome-discovery.js'
+import { isPathInside } from './registry.js'
+
+const ROOT_PROFILE_FILES = Object.freeze(['Local State', 'First Run', 'Last Version'])
+const MANAGED_PROFILE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
+
+export type OpaqueChromiumProfileCopyResult = {
+  destinationDir: string
+  copiedFiles: number
+}
+
+export async function copyOpaqueChromiumProfile(options: {
+  sourceUserDataDir: string
+  profileDirectoryKey: string
+  destinationDir: string
+  tokenlessHome: string
+}): Promise<OpaqueChromiumProfileCopyResult> {
+  const tokenlessHome = resolve(options.tokenlessHome)
+  const destinationDir = resolve(options.destinationDir)
+  const profilesRoot = resolve(tokenlessHome, 'browser', 'profiles')
+  if (dirname(destinationDir) !== profilesRoot || !MANAGED_PROFILE_ID_PATTERN.test(basename(destinationDir))) {
+    throw tokenlessError(
+      'unsafe_managed_profile_destination',
+      'Managed browser profile destination must be a UUID directory directly inside the Tokenless profiles root.',
+    )
+  }
+
+  const source = await resolveChromeProfile(options.sourceUserDataDir, options.profileDirectoryKey)
+  const sourceRoot = resolve(source.userDataDir)
+  if (isPathInside(tokenlessHome, sourceRoot)) {
+    throw tokenlessError('browser_profile_inside_tokenless_home', 'Refusing to copy a browser profile from Tokenless home.')
+  }
+
+  await mkdir(profilesRoot, { recursive: true, mode: 0o700 })
+  const staging = join(profilesRoot, `.staging-${randomUUID()}`)
+  let copiedFiles = 0
+  try {
+    await mkdir(staging, { mode: 0o700 })
+    const sourceRootReal = await realpath(sourceRoot)
+    const sourceProfileReal = await realpath(source.profileDir)
+    for (const file of ROOT_PROFILE_FILES) {
+      copiedFiles += await copyOpaqueEntry({
+        source: join(sourceRoot, file),
+        sourceBoundary: sourceRootReal,
+        destination: join(staging, file),
+        optional: true,
+      })
+    }
+    copiedFiles += await copyOpaqueEntry({
+      source: source.profileDir,
+      sourceBoundary: sourceProfileReal,
+      destination: join(staging, source.directoryKey),
+      optional: false,
+    })
+    await rm(destinationDir, { recursive: true, force: true })
+    await rename(staging, destinationDir)
+    await chmod(destinationDir, 0o700)
+    return { destinationDir, copiedFiles }
+  } catch (error) {
+    await rm(staging, { recursive: true, force: true })
+    throw error
+  }
+}
+
+async function copyOpaqueEntry(options: {
+  source: string
+  sourceBoundary: string
+  destination: string
+  optional: boolean
+}): Promise<number> {
+  let metadata
+  try {
+    metadata = await lstat(options.source)
+  } catch (error) {
+    if (options.optional && isMissingFile(error)) return 0
+    throw error
+  }
+  if (metadata.isSymbolicLink()) {
+    throw tokenlessError('browser_profile_symlink_rejected', 'Browser profile copy refuses symbolic links.')
+  }
+  const sourceReal = await realpath(options.source)
+  if (!isPathInside(options.sourceBoundary, sourceReal)) {
+    throw tokenlessError('browser_profile_path_escape', 'Browser profile copy refuses path escapes.')
+  }
+  if (metadata.isDirectory()) {
+    await mkdir(options.destination, { recursive: true, mode: 0o700 })
+    let copiedFiles = 0
+    for (const entry of await readdir(options.source)) {
+      copiedFiles += await copyOpaqueEntry({
+        source: join(options.source, entry),
+        sourceBoundary: options.sourceBoundary,
+        destination: join(options.destination, entry),
+        optional: false,
+      })
+    }
+    return copiedFiles
+  }
+  if (!metadata.isFile()) return 0
+  await mkdir(dirname(options.destination), { recursive: true, mode: 0o700 })
+  await copyFile(options.source, options.destination, fsConstants.COPYFILE_EXCL)
+  await chmod(options.destination, 0o600)
+  return 1
+}
+
+function isMissingFile(error: unknown) {
+  return Boolean(error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT')
+}
diff --git a/packages/cli/src/playwright/profiles/registry.ts b/packages/cli/src/playwright/profiles/registry.ts
index 4a0a45a..6bc0f7f 100644
--- a/packages/cli/src/playwright/profiles/registry.ts
+++ b/packages/cli/src/playwright/profiles/registry.ts
@@ -3,9 +3,15 @@ import { constants as fsConstants } from 'node:fs'
 import { mkdir, open, readFile, rename, rm, stat, writeFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { dirname, join, resolve, sep } from 'node:path'
+import { getProviderDescriptorById } from '../../providers/registry.js'
 import { tokenlessError } from '../errors.js'
 import { withPrivateSqliteWriterLock } from './sqlite-lock.js'
-import type { ProviderId } from '../providers.js'
+import type {
+  ProviderAccessClass,
+  ProviderAccountTier,
+  ProviderId,
+} from '../../providers/registry.js'
+import type { BrowserRuntimeBinding } from '../../browser-runtime/types.js'
 
 export type ProfileLifecycleState = 'created' | 'importing' | 'ready' | 'removed' | 'failed'
 export type ManagedProfileLabelOrigin = 'slug' | 'import' | 'user'
@@ -13,7 +19,13 @@ export type ManagedProfileLabelOrigin = 'slug' | 'import' | 'user'
 export type ProviderStatus = {
   provider: ProviderId
   auth: 'authenticated' | 'unauthenticated' | 'unknown'
+  access: ProviderAccessClass
   checkedAt: string
+  account?: {
+    name: string | null
+    subscription: string | null
+    tier: ProviderAccountTier
+  }
 }
 
 export type ManagedProfileRecord = {
@@ -25,11 +37,13 @@ export type ManagedProfileRecord = {
   lifecycle: ProfileLifecycleState
   createdAt: string
   updatedAt: string
+  runtimeBinding?: BrowserRuntimeBinding | undefined
   import?: {
     source: string
     profileDirectoryKey: string
     importedAt: string
     browser?: string | undefined
+    browserVersion?: string | undefined
     providers?: readonly ProviderId[] | undefined
   }
   lastObservedAuth: Partial<Record<ProviderId, ProviderStatus>>
@@ -47,6 +61,7 @@ export type AddProfileOptions = {
   labelOrigin?: ManagedProfileLabelOrigin
   setDefault?: boolean
   lifecycle?: ProfileLifecycleState
+  runtimeBinding?: BrowserRuntimeBinding
 }
 
 export type ProfileRegistryPaths = {
@@ -92,6 +107,7 @@ export class ManagedProfileRegistry {
         lifecycle,
         createdAt: now,
         updatedAt: now,
+        ...(options.runtimeBinding ? { runtimeBinding: validateRuntimeBinding(options.runtimeBinding) } : {}),
         lastObservedAuth: {},
       }
       await mkdir(directory, { recursive: true, mode: 0o700 })
@@ -134,6 +150,26 @@ export class ManagedProfileRegistry {
     })
   }
 
+  async updateLabel(slug: string, label: string): Promise<ManagedProfileRecord> {
+    return await this.withWriteLock(async () => {
+      const normalized = normalizeSlug(slug)
+      const data = await this.readUnlocked()
+      const record = data.profiles[normalized]
+      if (!record || record.lifecycle === 'removed') {
+        throw tokenlessError('profile_not_found', `Managed profile '${normalized}' is not registered.`)
+      }
+      const updated: ManagedProfileRecord = {
+        ...record,
+        label: normalizeLabel(label, record.slug),
+        labelOrigin: 'user',
+        updatedAt: new Date().toISOString(),
+      }
+      data.profiles[normalized] = updated
+      await this.writeUnlocked(data)
+      return updated
+    })
+  }
+
   async removeProfile(slug: string, options: { confirmDelete: boolean }): Promise<ManagedProfileRecord> {
     if (!options.confirmDelete) {
       throw tokenlessError('profile_delete_confirmation_required', 'Profile removal requires explicit delete confirmation.')
@@ -194,7 +230,30 @@ export class ManagedProfileRegistry {
     })
   }
 
-  async markImported(slug: string, imported: { source: string; profileDirectoryKey: string; profileName?: string; importedAt?: string; browser?: string; providers?: readonly ProviderId[] }): Promise<ManagedProfileRecord> {
+  async bindRuntime(slug: string, runtimeBinding: BrowserRuntimeBinding): Promise<ManagedProfileRecord> {
+    return await this.withWriteLock(async () => {
+      const data = await this.readUnlocked()
+      const record = data.profiles[normalizeSlug(slug)]
+      if (!record) throw tokenlessError('profile_not_found', 'Managed profile is not registered.')
+      const binding = validateRuntimeBinding(runtimeBinding)
+      if (record.runtimeBinding && !sameRuntimeBinding(record.runtimeBinding, binding)) {
+        throw tokenlessError(
+          'profile_runtime_rebind_blocked',
+          `Managed profile '${record.slug}' is already bound to ${record.runtimeBinding.runtimeId}; create a clean profile for ${binding.runtimeId}.`,
+        )
+      }
+      const updated: ManagedProfileRecord = {
+        ...record,
+        runtimeBinding: binding,
+        updatedAt: new Date().toISOString(),
+      }
+      data.profiles[updated.slug] = updated
+      await this.writeUnlocked(data)
+      return updated
+    })
+  }
+
+  async markImported(slug: string, imported: { source: string; profileDirectoryKey: string; profileName?: string; importedAt?: string; browser?: string; browserVersion?: string | null; providers?: readonly ProviderId[] }): Promise<ManagedProfileRecord> {
     return await this.withWriteLock(async () => {
       const data = await this.readUnlocked()
       const record = data.profiles[normalizeSlug(slug)]
@@ -215,6 +274,7 @@ export class ManagedProfileRegistry {
           profileDirectoryKey: imported.profileDirectoryKey.slice(0, 128),
           importedAt: imported.importedAt === undefined ? now : parseIso(imported.importedAt),
           ...(imported.browser ? { browser: normalizeImportedBrowser(imported.browser) } : {}),
+          ...(imported.browserVersion ? { browserVersion: normalizeImportedBrowserVersion(imported.browserVersion) } : {}),
           ...(imported.providers ? { providers: normalizeImportedProviders(imported.providers) } : {}),
         },
       }
@@ -353,6 +413,7 @@ function parseRegistry(value: unknown, profilesRoot: string): ManagedProfileRegi
       lifecycle: parseLifecycle(record.lifecycle),
       createdAt: parseIso(record.createdAt),
       updatedAt: parseIso(record.updatedAt),
+      ...parseRuntimeBinding(record.runtimeBinding),
       ...importMetadata,
       lastObservedAuth: parseProviderStatuses(record.lastObservedAuth),
     }
@@ -368,6 +429,44 @@ function parseRegistry(value: unknown, profilesRoot: string): ManagedProfileRegi
   }
 }
 
+function parseRuntimeBinding(value: unknown): Pick<ManagedProfileRecord, 'runtimeBinding'> | Record<string, never> {
+  if (value === undefined) return {}
+  return { runtimeBinding: validateRuntimeBinding(value) }
+}
+
+function validateRuntimeBinding(value: unknown): BrowserRuntimeBinding {
+  if (!isRecord(value)) {
+    throw tokenlessError('invalid_profile_registry', 'Managed profile runtime binding is malformed.')
+  }
+  const family = value.family
+  if (family !== 'system' && family !== 'managed-chromium' && family !== 'cloak' && family !== 'test') {
+    throw tokenlessError('invalid_profile_registry', 'Managed profile runtime family is invalid.')
+  }
+  if (
+    typeof value.runtimeId !== 'string' || !value.runtimeId || value.runtimeId.length > 160 ||
+    typeof value.browserId !== 'string' || !value.browserId || value.browserId.length > 64 ||
+    typeof value.createdWithVersion !== 'string' || !/^\d+\.\d+\.\d+\.\d+(?:\.\d+)?$/.test(value.createdWithVersion) ||
+    value.profileFormat !== 1
+  ) {
+    throw tokenlessError('invalid_profile_registry', 'Managed profile runtime binding is invalid.')
+  }
+  return {
+    runtimeId: value.runtimeId,
+    family,
+    browserId: value.browserId,
+    createdWithVersion: value.createdWithVersion,
+    profileFormat: 1,
+  }
+}
+
+function sameRuntimeBinding(left: BrowserRuntimeBinding, right: BrowserRuntimeBinding) {
+  return left.runtimeId === right.runtimeId &&
+    left.family === right.family &&
+    left.browserId === right.browserId &&
+    left.createdWithVersion === right.createdWithVersion &&
+    left.profileFormat === right.profileFormat
+}
+
 function parseLabelOrigin(value: unknown, label: string, slug: string, imported: boolean): ManagedProfileLabelOrigin {
   if (value === 'slug' || value === 'import' || value === 'user') return value
   if (imported && label === slug) return 'import'
@@ -384,12 +483,75 @@ function parseProviderStatuses(value: unknown): Partial<Record<ProviderId, Provi
     statuses[provider] = {
       provider,
       auth,
+      access: parseProviderAccess(status.access, auth),
       checkedAt: parseIso(status.checkedAt),
+      ...parseProviderAccount(status.account),
     }
   }
   return statuses
 }
 
+function parseProviderAccount(value: unknown): Pick<ProviderStatus, 'account'> | Record<string, never> {
+  if (!isRecord(value)) return {}
+  const name = value.name === null
+    ? null
+    : typeof value.name === 'string'
+      ? normalizeProviderAccountValue(value.name)
+      : undefined
+  const subscription = value.subscription === null
+    ? null
+    : typeof value.subscription === 'string'
+      ? normalizeProviderAccountValue(value.subscription)
+      : undefined
+  if (name === undefined || subscription === undefined) return {}
+  const tier = parseProviderAccountTier(value.tier)
+  return {
+    account: {
+      name,
+      subscription,
+      tier,
+    },
+  }
+}
+
+function parseProviderAccess(
+  value: unknown,
+  auth: ProviderStatus['auth'],
+): ProviderStatus['access'] {
+  if (
+    value === 'guest' ||
+    value === 'sign_in_required' ||
+    value === 'signed_in_free' ||
+    value === 'signed_in_paid' ||
+    value === 'signed_in_unknown' ||
+    value === 'unknown'
+  ) return value
+  return auth === 'authenticated' ? 'signed_in_unknown' : 'unknown'
+}
+
+function parseProviderAccountTier(value: unknown): NonNullable<ProviderStatus['account']>['tier'] {
+  if (!isRecord(value)) return { class: 'signed_in_unknown', label: null }
+  const tierClass = value.class
+  if (
+    tierClass !== 'signed_in_free' &&
+    tierClass !== 'signed_in_paid' &&
+    tierClass !== 'signed_in_unknown'
+  ) return { class: 'signed_in_unknown', label: null }
+  const label = value.label === null
+    ? null
+    : typeof value.label === 'string'
+      ? normalizeProviderAccountValue(value.label)
+      : null
+  return {
+    class: tierClass,
+    label,
+  }
+}
+
+function normalizeProviderAccountValue(value: string) {
+  return value.replace(/\s+/g, ' ').trim().slice(0, 120) || null
+}
+
 function parseImportMetadata(value: unknown): Pick<ManagedProfileRecord, 'import'> | Record<string, never> {
   if (!isRecord(value)) return {}
   if (typeof value.source !== 'string' || typeof value.profileDirectoryKey !== 'string') return {}
@@ -399,11 +561,20 @@ function parseImportMetadata(value: unknown): Pick<ManagedProfileRecord, 'import
       profileDirectoryKey: value.profileDirectoryKey.slice(0, 128),
       importedAt: parseIso(value.importedAt),
       ...(typeof value.browser === 'string' ? { browser: normalizeImportedBrowser(value.browser) } : {}),
+      ...(typeof value.browserVersion === 'string' ? { browserVersion: normalizeImportedBrowserVersion(value.browserVersion) } : {}),
       ...(value.providers === undefined ? {} : { providers: normalizeImportedProviders(value.providers) }),
     },
   }
 }
 
+function normalizeImportedBrowserVersion(value: string) {
+  const version = value.trim()
+  if (!/^\d+(?:\.\d+){1,3}$/.test(version)) {
+    throw tokenlessError('invalid_imported_browser_version', 'Imported browser version is invalid.')
+  }
+  return version
+}
+
 function normalizeLabel(label: string | undefined, fallback: string) {
   if (label === undefined) return fallback
   const normalized = label.trim().replace(/\s+/g, ' ')
@@ -454,7 +625,7 @@ function parseIso(value: unknown) {
 }
 
 function isProviderId(value: string): value is ProviderId {
-  return value === 'chatgpt' || value === 'claude' || value === 'gemini' || value === 'grok'
+  return Boolean(getProviderDescriptorById(value))
 }
 
 function isUuid(value: string) {
diff --git a/packages/cli/src/playwright/provider-failure-classification.ts b/packages/cli/src/playwright/provider-failure-classification.ts
new file mode 100644
index 0000000..e11b65b
--- /dev/null
+++ b/packages/cli/src/playwright/provider-failure-classification.ts
@@ -0,0 +1,112 @@
+import { errorResponse } from './errors.js'
+import type { VisibleBlocker } from './actions.js'
+import type { VisibleActionLifecycle } from '../providers/action-catalog.js'
+
+export type ProviderFailureClassification =
+  | 'safe_pre_submit_provider_failure'
+  | 'ambiguous_external_state'
+  | 'post_submission_failure'
+  | 'user_resolvable_local_failure'
+
+export type ClassifiedProviderFailure = Readonly<{
+  classification: ProviderFailureClassification
+  code: string
+  message: string
+  retryable: boolean
+  providerScoped: boolean
+  automaticFallbackEligible: boolean
+  details?: unknown
+}>
+
+const SAFE_PRE_SUBMIT_PROVIDER_CODES = new Set([
+  'provider_capability_unavailable',
+  'provider_dns_unavailable',
+  'provider_navigation_unavailable',
+  'provider_page_unavailable_pre_submit',
+  'provider_region_unavailable',
+  'provider_maintenance',
+  'provider_surface_not_ready',
+  'visible_action_unavailable',
+  'file_upload_unavailable',
+  'prompt_input_visibility_timeout',
+  'prompt_input_failed',
+  'workspace_native_stably_unavailable',
+])
+
+const USER_RESOLVABLE_LOCAL_CODES = new Set([
+  'invalid_visible_attachment',
+  'invalid_visible_attachment_root',
+  'invalid_context_envelope',
+  'playwright_job_canceled',
+  'profile_not_found',
+  'unsafe_attachment_cleanup_root',
+])
+
+export function classifyProviderFailure(options: {
+  error: unknown
+  submitted: boolean
+  actionLifecycle?: VisibleActionLifecycle | null | undefined
+}): ClassifiedProviderFailure {
+  const response = errorResponse(options.error)
+  if (options.submitted) {
+    return classified('post_submission_failure', response, true, false)
+  }
+  if (USER_RESOLVABLE_LOCAL_CODES.has(response.code) || response.code.startsWith('invalid_')) {
+    return classified('user_resolvable_local_failure', response, false, false)
+  }
+  const lifecycle = options.actionLifecycle
+  const reconstructable = !lifecycle?.mutating || lifecycle.reconstructablePreSubmit
+  if (
+    reconstructable &&
+    lifecycle?.completion !== 'records_submission' &&
+    providerPageBecameUnavailable(response.message)
+  ) {
+    return classified('safe_pre_submit_provider_failure', {
+      ...response,
+      code: 'provider_page_unavailable_pre_submit',
+      retryable: true,
+    }, true, true)
+  }
+  if (SAFE_PRE_SUBMIT_PROVIDER_CODES.has(response.code)) {
+    if (reconstructable || response.code === 'workspace_native_stably_unavailable') {
+      return classified('safe_pre_submit_provider_failure', response, true, true)
+    }
+  }
+  return classified('ambiguous_external_state', response, true, false)
+}
+
+function providerPageBecameUnavailable(message: string) {
+  return /(?:target page, context or browser has been closed|target closed|page (?:has )?crashed|page has been closed|browser has been closed|execution context was destroyed|cannot find context with specified id)/iu.test(message)
+}
+
+export function classifyVisibleProviderBlocker(blocker: VisibleBlocker): ClassifiedProviderFailure {
+  const providerScoped = blocker.kind === 'challenge' || blocker.kind === 'auth' || blocker.kind === 'terminal'
+  const eligible = blocker.kind === 'challenge' || blocker.kind === 'auth' ||
+    blocker.family === 'rate_limit' || blocker.family === 'plan_limit' ||
+    blocker.family === 'availability' || blocker.code === 'provider_surface_not_ready'
+  return Object.freeze({
+    classification: eligible ? 'safe_pre_submit_provider_failure' : 'ambiguous_external_state',
+    code: blocker.code,
+    message: blocker.message,
+    retryable: blocker.retryable,
+    providerScoped,
+    automaticFallbackEligible: eligible,
+  })
+}
+
+function classified(
+  classification: ProviderFailureClassification,
+  response: ReturnType<typeof errorResponse>,
+  providerScoped: boolean,
+  automaticFallbackEligible: boolean,
+): ClassifiedProviderFailure {
+  return Object.freeze({
+    classification,
+    code: response.code,
+    message: response.message,
+    retryable: response.retryable,
+    providerScoped,
+    automaticFallbackEligible,
+    ...(response.details === undefined ? {} : { details: response.details }),
+  })
+}
diff --git a/packages/cli/src/playwright/provider-session/account.ts b/packages/cli/src/playwright/provider-session/account.ts
new file mode 100644
index 0000000..a4332d9
--- /dev/null
+++ b/packages/cli/src/playwright/provider-session/account.ts
@@ -0,0 +1,8 @@
+export {
+  inspectProviderAccountSession,
+  providerAccountTier,
+} from '../../providers/account-inspectors.js'
+export type {
+  ProviderAccountInspection,
+  ProviderAccountInspector,
+} from '../../providers/account-inspectors.js'
diff --git a/packages/cli/src/playwright/provider-session/index.ts b/packages/cli/src/playwright/provider-session/index.ts
new file mode 100644
index 0000000..b51707f
--- /dev/null
+++ b/packages/cli/src/playwright/provider-session/index.ts
@@ -0,0 +1,135 @@
+import type { Page } from 'playwright-core'
+import type { ProviderDomDefinition } from '../../providers/provider-definition.js'
+import type { ProviderAccessClass, ProviderAccountTier } from '../../providers/registry.js'
+import { inspectProviderAccountSession } from './account.js'
+import { decideProviderSession, providerSignInRequiredBlocker } from './machine.js'
+import { clickGuestContinuation, observeProviderSession } from './observe.js'
+import type { ProviderSessionResolution } from './types.js'
+
+export type {
+  ProviderAuthenticationState,
+  ProviderSessionDecision,
+  ProviderSessionObservation,
+  ProviderSessionResolution,
+} from './types.js'
+export type { ProviderAccessClass, ProviderAccountTier }
+
+export { observeProviderSession } from './observe.js'
+export { inspectProviderAccountSession } from './account.js'
+
+export async function resolveProviderSession(
+  page: Page,
+  provider: ProviderDomDefinition,
+  {
+    waitForReadyMs = 0,
+    signal,
+  }: {
+    waitForReadyMs?: number
+    signal?: AbortSignal
+  },
+): Promise<ProviderSessionResolution> {
+  const observations = []
+  const deadline = Date.now() + Math.max(0, waitForReadyMs)
+
+  while (true) {
+    if (signal?.aborted) throw signal.reason ?? new Error('Provider session resolution was aborted.')
+    const observation = await observeProviderSession(page, provider)
+    observations.push(observation)
+    const decision = decideProviderSession(provider, observation)
+
+    if (decision.kind === 'continue_guest') {
+      if (!await clickGuestContinuation(page, provider)) {
+        return {
+          decision: {
+            kind: 'handoff',
+            blocker: observation.blockers.find((blocker) => blocker.kind === 'auth') ??
+              providerSignInRequiredBlocker(provider, observation, 'guest-continuation-click-failed'),
+            observation,
+          },
+          observations,
+        }
+      }
+      await page.waitForTimeout(250)
+      continue
+    }
+
+    if (decision.kind === 'wait' && Date.now() < deadline) {
+      await page.waitForTimeout(Math.min(250, Math.max(1, deadline - Date.now())))
+      continue
+    }
+
+    if (decision.kind === 'wait') {
+      const authOffer = observation.blockers.find((blocker) => blocker.kind === 'auth')
+      if (authOffer && provider.access.guest !== 'supported') {
+        return {
+          decision: {
+            kind: 'handoff',
+            blocker: authOffer,
+            observation,
+          },
+          observations,
+        }
+      }
+      if (provider.access.guest === 'unsupported') {
+        return {
+          decision: {
+            kind: 'handoff',
+            blocker: providerSignInRequiredBlocker(
+              provider,
+              observation,
+              'provider-access-policy-after-surface-timeout',
+            ),
+            observation,
+          },
+          observations,
+        }
+      }
+      return {
+        decision: {
+          kind: 'terminal',
+          blocker: providerSurfaceNotReadyBlocker(provider, observation),
+          observation,
+        },
+        observations,
+      }
+    }
+
+    return {
+      decision,
+      observations,
+    }
+  }
+}
+
+function providerSurfaceNotReadyBlocker(
+  provider: ProviderDomDefinition,
+  observation: ProviderSessionResolution['observations'][number],
+) {
+  return {
+    kind: 'terminal' as const,
+    code: 'provider_surface_not_ready',
+    message: 'The provider page did not expose a stable account, guest composer, or sign-in surface before the action deadline.',
+    userResolvable: false,
+    retryable: true,
+    visibleProof: 'provider-session-observation-timeout',
+    provider: provider.id,
+    url: observation.url,
+  }
+}
+
+export async function inspectProviderBlockers(
+  page: Page,
+  provider: ProviderDomDefinition,
+) {
+  const observation = await observeProviderSession(page, provider)
+  const decision = decideProviderSession(provider, observation)
+  const blockers = decision.kind === 'ready' || decision.kind === 'wait' || decision.kind === 'continue_guest'
+    ? []
+    : [decision.blocker]
+  return {
+    blocked: blockers.length > 0,
+    reasons: blockers.map((blocker) => blocker.code),
+    blockers,
+    observation,
+  }
+}
diff --git a/packages/cli/src/playwright/provider-session/machine.ts b/packages/cli/src/playwright/provider-session/machine.ts
new file mode 100644
index 0000000..6cea838
--- /dev/null
+++ b/packages/cli/src/playwright/provider-session/machine.ts
@@ -0,0 +1,107 @@
+import type { ProviderDomDefinition } from '../../providers/provider-definition.js'
+import type {
+  ProviderSessionDecision,
+  ProviderSessionObservation,
+} from './types.js'
+
+export function decideProviderSession(
+  provider: ProviderDomDefinition,
+  observation: ProviderSessionObservation,
+): ProviderSessionDecision {
+  const terminal = observation.blockers.find((blocker) => blocker.kind === 'terminal')
+  if (terminal) {
+    return {
+      kind: 'terminal',
+      blocker: terminal,
+      observation,
+    }
+  }
+
+  const challenge = observation.blockers.find((blocker) => blocker.kind === 'challenge')
+  if (challenge) {
+    return {
+      kind: 'handoff',
+      blocker: challenge,
+      observation,
+    }
+  }
+
+  const requiredAuth = observation.blockers.find((blocker) => (
+    blocker.kind === 'auth' &&
+    blocker.code !== 'provider_sign_in_visible'
+  ))
+  if (requiredAuth) {
+    if (provider.access.guest === 'supported' && observation.guestContinueAvailable) {
+      return {
+        kind: 'continue_guest',
+        observation,
+      }
+    }
+    return {
+      kind: 'handoff',
+      blocker: requiredAuth,
+      observation,
+    }
+  }
+
+  const authOffer = observation.blockers.find((blocker) => blocker.code === 'provider_sign_in_visible')
+  if (observation.authentication === 'unauthenticated' || authOffer) {
+    if (provider.access.guest === 'unsupported') {
+      return {
+        kind: 'handoff',
+        blocker: providerSignInRequiredBlocker(provider, observation),
+        observation,
+      }
+    }
+    if (observation.composerVisible) {
+      return {
+        kind: 'ready',
+        mode: 'guest',
+        observation,
+      }
+    }
+    return {
+      kind: 'wait',
+      reason: 'guest_surface_not_ready',
+      observation,
+    }
+  }
+
+  if (
+    observation.authentication === 'unknown' &&
+    (
+      provider.access.guest === 'unsupported' ||
+      !observation.composerVisible
+    )
+  ) {
+    return {
+      kind: 'wait',
+      reason: 'provider_surface_not_ready',
+      observation,
+    }
+  }
+
+  return {
+    kind: 'ready',
+    mode: observation.authentication === 'authenticated' ? 'account' : 'unknown',
+    observation,
+  }
+}
+
+export function providerSignInRequiredBlocker(
+  provider: ProviderDomDefinition,
+  observation: ProviderSessionObservation,
+  visibleProof = 'provider-access-policy',
+) {
+  return {
+    kind: 'auth' as const,
+    code: 'provider_sign_in_required',
+    message: 'This provider requires sign-in before Tokenless can run the requested action.',
+    userResolvable: true,
+    retryable: true,
+    visibleProof,
+    provider: provider.id,
+    url: observation.url,
+    family: 'provider_sign_in' as const,
+  }
+}
diff --git a/packages/cli/src/playwright/provider-session/observe.ts b/packages/cli/src/playwright/provider-session/observe.ts
new file mode 100644
index 0000000..934ed5b
--- /dev/null
+++ b/packages/cli/src/playwright/provider-session/observe.ts
@@ -0,0 +1,340 @@
+import type { Page } from 'playwright-core'
+import type { VisibleBlocker } from '../actions.js'
+import type { ProviderDomDefinition } from '../../providers/provider-definition.js'
+import type { ProviderSessionObservation } from './types.js'
+
+export async function observeProviderSession(
+  page: Page,
+  provider: ProviderDomDefinition,
+): Promise<ProviderSessionObservation> {
+  const [composerVisible, loginVisible, authenticatedControlVisible, guestContinueAvailable, blockers] = await Promise.all([
+    anyVisible(page, provider.composerSelectors),
+    anyVisible(page, provider.loginIndicators),
+    anyVisible(page, provider.authIndicators),
+    anyNamedControlVisible(page, provider.access.guestContinueControlNames),
+    detectStructuredBlockers(page, provider),
+  ])
+  const authentication = loginVisible
+    ? 'unauthenticated' as const
+    : authenticatedControlVisible
+      ? 'authenticated' as const
+      : 'unknown' as const
+  const access = authentication === 'unauthenticated'
+    ? provider.access.guest === 'supported' && composerVisible
+      ? 'guest' as const
+      : 'sign_in_required' as const
+    : authentication === 'authenticated'
+      ? 'signed_in_unknown' as const
+      : provider.access.guest === 'supported' && composerVisible
+        ? 'guest' as const
+        : 'unknown' as const
+
+  return {
+    provider: provider.id,
+    url: sanitizedNavigationOrigin(provider, page.url()),
+    authentication,
+    access,
+    composerVisible,
+    guestContinueAvailable,
+    blockers,
+  }
+}
+
+export async function clickGuestContinuation(
+  page: Page,
+  provider: ProviderDomDefinition,
+) {
+  for (const name of provider.access.guestContinueControlNames) {
+    for (const role of ['button', 'link'] as const) {
+      const control = page.getByRole(role, { name, exact: true }).first()
+      if (!await control.isVisible({ timeout: 100 }).catch(() => false)) continue
+      if (await control.click({ timeout: 1000 }).then(() => true).catch(() => false)) return true
+    }
+  }
+  return false
+}
+
+async function detectStructuredBlockers(
+  page: Page,
+  provider: ProviderDomDefinition,
+): Promise<VisibleBlocker[]> {
+  const url = page.url()
+  const navigation = provider.navigationPolicy.classify(url)
+  const domBlockers = await page.evaluate(() => {
+    type RawBlocker = {
+      kind: 'challenge' | 'auth' | 'terminal'
+      code: string
+      message: string
+      family?: string
+      proof: string
+      retryAfterSeconds?: number
+    }
+    const isVisibleElement = (element: Element | null): element is HTMLElement | SVGElement => {
+      if (!element || !(element instanceof HTMLElement || element instanceof SVGElement)) return false
+      let node: Element | null = element
+      while (node && node instanceof Element) {
+        const style = window.getComputedStyle(node)
+        if (style.visibility === 'hidden' || style.display === 'none' || Number(style.opacity) === 0) return false
+        node = node.parentElement
+      }
+      const rect = element.getBoundingClientRect()
+      return rect.width > 0 && rect.height > 0
+    }
+    const ownText = (element: Element) => Array.from(element.childNodes)
+      .filter((node) => node.nodeType === Node.TEXT_NODE)
+      .map((node) => node.textContent ?? '')
+      .join(' ')
+    const visibleText = () => Array.from(document.body?.querySelectorAll('body, body *') ?? [])
+      .filter(isVisibleElement)
+      .map((element) => element instanceof HTMLInputElement || element instanceof HTMLTextAreaElement
+        ? [element.getAttribute('aria-label'), element.getAttribute('placeholder')].filter(Boolean).join(' ')
+        : [
+            ownText(element),
+            element.getAttribute('aria-label'),
+            element.getAttribute('placeholder'),
+          ].filter(Boolean).join(' '))
+      .join(' ')
+    const text = visibleText().replace(/\s+/g, ' ').slice(0, 20_000)
+    const lowerText = text.toLowerCase()
+    const retryDuration = lowerText.match(/(?:try again|reset(?:s|ting)?|available again)[^.!]{0,80}?\b(?:in|after)\s+(\d{1,4})\s*(seconds?|minutes?|hours?|days?)\b/i)
+    const retryAfterSeconds = retryDuration
+      ? Math.min(7 * 24 * 60 * 60, Number(retryDuration[1]) * (
+          retryDuration[2]?.startsWith('day') ? 86_400 :
+            retryDuration[2]?.startsWith('hour') ? 3_600 :
+              retryDuration[2]?.startsWith('minute') ? 60 : 1
+        ))
+      : undefined
+    const raw: RawBlocker[] = []
+    const visibleFrames = Array.from(document.querySelectorAll('iframe')).filter(isVisibleElement)
+    const visibleInputs = Array.from(document.querySelectorAll('input, button, a, [role="button"], [role="textbox"]')).filter(isVisibleElement)
+    const visibleWithAttribute = (selector: string) => {
+      try {
+        return Array.from(document.querySelectorAll(selector)).some(isVisibleElement)
+      } catch {
+        return false
+      }
+    }
+    for (const frame of visibleFrames) {
+      const src = (frame.getAttribute('src') ?? '').toLowerCase()
+      const title = (frame.getAttribute('title') ?? '').toLowerCase()
+      if (src.includes('/recaptcha/') || title.includes('recaptcha')) {
+        raw.push({ kind: 'challenge', code: 'visible_recaptcha', family: 'recaptcha', message: 'Visible reCAPTCHA verification is blocking the provider page.', proof: 'visible-recaptcha-frame' })
+      } else if (src.includes('hcaptcha.com') || title.includes('hcaptcha')) {
+        raw.push({ kind: 'challenge', code: 'visible_hcaptcha', family: 'hcaptcha', message: 'Visible hCaptcha verification is blocking the provider page.', proof: 'visible-hcaptcha-frame' })
+      } else if (src.includes('challenges.cloudflare.com') || src.includes('/cdn-cgi/challenge-platform') || title.includes('cloudflare') || title.includes('turnstile')) {
+        raw.push({ kind: 'challenge', code: 'visible_cloudflare_turnstile', family: 'cloudflare', message: 'Visible Cloudflare verification is blocking the provider page.', proof: 'visible-cloudflare-frame' })
+      } else if (src.includes('arkoselabs') || src.includes('funcaptcha') || title.includes('arkose') || title.includes('funcaptcha')) {
+        raw.push({ kind: 'challenge', code: 'visible_arkose_funcaptcha', family: 'arkose', message: 'Visible Arkose/FunCaptcha verification is blocking the provider page.', proof: 'visible-arkose-frame' })
+      }
+    }
+    if (visibleWithAttribute('.cf-turnstile, [data-cf-turnstile], [data-turnstile-widget]')) {
+      raw.push({ kind: 'challenge', code: 'visible_cloudflare_turnstile', family: 'cloudflare', message: 'Visible Cloudflare Turnstile is blocking the provider page.', proof: 'visible-turnstile-widget' })
+    }
+    const cloudflareSecurityVerification = /cloudflare/i.test(text) && (
+      /(performing security verification|security service to protect against malicious bots|verif(?:y|ies) you are not a bot|ray id)/i.test(text)
+    )
+    if (
+      cloudflareSecurityVerification ||
+      /(checking if the site connection is secure|verify you are human|cloudflare ray id|needs to review the security of your connection)/i.test(text)
+    ) {
+      raw.push({ kind: 'challenge', code: 'visible_cloudflare_interstitial', family: 'cloudflare', message: 'Visible Cloudflare interstitial is blocking the provider page.', proof: 'visible-cloudflare-interstitial-text' })
+    }
+    const signInControl = visibleInputs.find((element) => /log in|sign in|continue with|enter your email|email address/i.test([
+      ownText(element),
+      element.getAttribute('aria-label'),
+      element.getAttribute('placeholder'),
+    ].filter(Boolean).join(' ')))
+    if (signInControl) {
+      const blockingSurface = signInControl.closest('dialog, [role="dialog"], [aria-modal="true"]')
+      raw.push(blockingSurface
+        ? { kind: 'auth', code: 'provider_sign_in_required', family: 'provider_sign_in', message: 'A visible sign-in dialog is blocking the requested action.', proof: 'visible-provider-sign-in-dialog' }
+        : { kind: 'auth', code: 'provider_sign_in_visible', family: 'provider_sign_in', message: 'Provider sign-in is visible but may be optional.', proof: 'visible-provider-sign-in-control' })
+    }
+    if (/(not available in (?:your|this) (?:country|region|location)|unsupported region|region is not supported)/i.test(lowerText)) {
+      raw.push({ kind: 'terminal', code: 'provider_region_unavailable', family: 'availability', message: 'The provider is visibly unavailable in the current region.', proof: 'visible-region-unavailable-text' })
+    }
+    if (/(scheduled maintenance|under maintenance|service maintenance|maintenance in progress)/i.test(lowerText)) {
+      raw.push({ kind: 'terminal', code: 'provider_maintenance', family: 'availability', message: 'The provider is visibly under maintenance.', proof: 'visible-provider-maintenance-text' })
+    }
+    if (/(rate limit|too many requests|try again later|temporarily unavailable)/i.test(lowerText)) {
+      raw.push({ kind: 'terminal', code: 'provider_rate_limited', family: 'rate_limit', message: 'The provider is showing a visible rate limit or temporary capacity blocker.', proof: 'visible-rate-limit-text', ...(retryAfterSeconds === undefined ? {} : { retryAfterSeconds }) })
+    }
+    if (/(upgrade required|upgrade your plan|subscribe to|requires a paid plan|plan limit|usage limit)/i.test(lowerText)) {
+      raw.push({ kind: 'terminal', code: 'provider_plan_limited', family: 'plan_limit', message: 'The provider is showing a visible plan or quota blocker.', proof: 'visible-plan-limit-text' })
+    }
+    return raw
+  })
+
+  const selectorBlockers: VisibleBlocker[] = []
+  for (const selector of provider.loginIndicators) {
+    if (!await firstVisibleFast(page, selector)) continue
+    selectorBlockers.push(createBlocker({
+      provider,
+      url,
+      kind: 'auth',
+      code: 'provider_sign_in_visible',
+      family: 'provider_sign_in',
+      message: 'Provider sign-in is visible.',
+      visibleProof: `visible-login-selector:${selectorReason(selector)}`,
+    }))
+    break
+  }
+  for (const selector of provider.blockerSelectors) {
+    if (!await firstVisibleFast(page, selector)) continue
+    const reason = selectorReason(selector)
+    const requiresAuth = provider.loginIndicators.includes(selector)
+    const terminal = /rate|upgrade|plan|too many requests/i.test(selector)
+    const challenge = selectorChallenge(selector)
+    selectorBlockers.push(createBlocker({
+      provider,
+      url,
+      kind: requiresAuth ? 'auth' : (terminal ? 'terminal' : 'challenge'),
+      code: requiresAuth
+        ? 'provider_sign_in_required'
+        : (terminal
+            ? (/upgrade|plan/i.test(selector) ? 'provider_plan_limited' : 'provider_rate_limited')
+            : challenge?.code ?? 'visible_provider_blocker'),
+      family: requiresAuth
+        ? 'provider_sign_in'
+        : (terminal
+            ? (/upgrade|plan/i.test(selector) ? 'plan_limit' : 'rate_limit')
+            : challenge?.family),
+      message: requiresAuth
+        ? 'Provider sign-in is blocking the requested action and requires the user.'
+        : terminal
+          ? 'The provider is showing a visible terminal account or capacity blocker.'
+          : challenge?.message ?? 'A visible provider challenge or blocker is present.',
+      visibleProof: `visible-selector:${reason}`,
+    }))
+  }
+  if (navigation.kind === 'trusted_sign_in') {
+    selectorBlockers.push(createBlocker({
+      provider,
+      url,
+      kind: 'auth',
+      code: 'provider_sign_in_url',
+      family: 'provider_sign_in',
+      message: 'Provider sign-in URL is visible and requires the user.',
+      visibleProof: 'visible-provider-sign-in-url',
+    }))
+  }
+  const all = [
+    ...domBlockers.map((raw) => createBlocker({
+      provider,
+      url,
+      kind: raw.kind,
+      code: raw.code,
+      family: raw.family as VisibleBlocker['family'],
+      message: raw.message,
+      visibleProof: raw.proof,
+      retryAfterSeconds: raw.retryAfterSeconds,
+    })),
+    ...selectorBlockers,
+  ]
+  const seen = new Set<string>()
+  return all.filter((candidate) => {
+    const key = `${candidate.kind}:${candidate.code}:${candidate.visibleProof}`
+    if (seen.has(key)) return false
+    seen.add(key)
+    return true
+  })
+}
+
+function createBlocker(input: {
+  provider: ProviderDomDefinition
+  url: string
+  kind: VisibleBlocker['kind']
+  code: string
+  message: string
+  visibleProof: string
+  family?: VisibleBlocker['family']
+  retryAfterSeconds?: number | undefined
+}): VisibleBlocker {
+  const userResolvable = input.kind === 'challenge' || input.kind === 'auth'
+  return {
+    kind: input.kind,
+    code: input.code,
+    message: input.message,
+    userResolvable,
+    retryable: userResolvable || input.family === 'rate_limit',
+    visibleProof: input.visibleProof,
+    provider: input.provider.id,
+    url: sanitizedNavigationOrigin(input.provider, input.url),
+    ...(input.family ? { family: input.family } : {}),
+    ...(input.retryAfterSeconds === undefined ? {} : { retryAfterSeconds: input.retryAfterSeconds }),
+  }
+}
+
+async function anyVisible(page: Page, selectors: readonly string[]) {
+  for (const selector of selectors) {
+    if (await firstVisibleFast(page, selector)) return true
+  }
+  return false
+}
+
+async function anyNamedControlVisible(page: Page, names: readonly string[]) {
+  for (const name of names) {
+    for (const role of ['button', 'link'] as const) {
+      if (await page.getByRole(role, { name, exact: true }).first().isVisible({ timeout: 100 }).catch(() => false)) return true
+    }
+  }
+  return false
+}
+
+async function firstVisibleFast(page: Page, selector: string) {
+  try {
+    return await page.locator(selector).first().isVisible({ timeout: 100 })
+  } catch {
+    return false
+  }
+}
+
+function selectorReason(selector: string) {
+  if (/captcha/i.test(selector)) return 'captcha'
+  if (/rate limit|too many/i.test(selector)) return 'rate_limit'
+  if (/upgrade|paywall|subscribe/i.test(selector)) return 'upgrade_or_paywall'
+  return 'visible_blocker'
+}
+
+function selectorChallenge(selector: string): Readonly<{
+  code: string
+  family: NonNullable<VisibleBlocker['family']>
+  message: string
+}> | null {
+  if (/hcaptcha/i.test(selector)) {
+    return {
+      code: 'visible_hcaptcha',
+      family: 'hcaptcha',
+      message: 'Visible hCaptcha verification is blocking the provider page.',
+    }
+  }
+  if (/recaptcha/i.test(selector)) {
+    return {
+      code: 'visible_recaptcha',
+      family: 'recaptcha',
+      message: 'Visible reCAPTCHA verification is blocking the provider page.',
+    }
+  }
+  if (/cloudflare|turnstile/i.test(selector)) {
+    return {
+      code: 'visible_cloudflare_turnstile',
+      family: 'cloudflare',
+      message: 'Visible Cloudflare verification is blocking the provider page.',
+    }
+  }
+  if (/arkose|funcaptcha/i.test(selector)) {
+    return {
+      code: 'visible_arkose_funcaptcha',
+      family: 'arkose',
+      message: 'Visible Arkose/FunCaptcha verification is blocking the provider page.',
+    }
+  }
+  return null
+}
+
+function sanitizedNavigationOrigin(provider: ProviderDomDefinition, value: string) {
+  const classification = provider.navigationPolicy.classify(value)
+  if (classification.kind === 'approved') return classification.target.origin
+  if (classification.kind === 'trusted_sign_in') return classification.origin
+  return ''
+}
diff --git a/packages/cli/src/playwright/provider-session/types.ts b/packages/cli/src/playwright/provider-session/types.ts
new file mode 100644
index 0000000..c3f07bc
--- /dev/null
+++ b/packages/cli/src/playwright/provider-session/types.ts
@@ -0,0 +1,45 @@
+import type { VisibleBlocker } from '../actions.js'
+import type { ProviderAccessClass, ProviderId } from '../../providers/registry.js'
+
+export type ProviderAuthenticationState = 'authenticated' | 'unauthenticated' | 'unknown'
+
+export type ProviderSessionObservation = {
+  provider: ProviderId
+  url: string
+  authentication: ProviderAuthenticationState
+  access: ProviderAccessClass
+  composerVisible: boolean
+  guestContinueAvailable: boolean
+  blockers: readonly VisibleBlocker[]
+}
+
+export type ProviderSessionDecision =
+  | {
+    kind: 'ready'
+    mode: 'guest' | 'account' | 'unknown'
+    observation: ProviderSessionObservation
+  }
+  | {
+    kind: 'continue_guest'
+    observation: ProviderSessionObservation
+  }
+  | {
+    kind: 'handoff'
+    blocker: VisibleBlocker
+    observation: ProviderSessionObservation
+  }
+  | {
+    kind: 'terminal'
+    blocker: VisibleBlocker
+    observation: ProviderSessionObservation
+  }
+  | {
+    kind: 'wait'
+    reason: 'guest_surface_not_ready' | 'provider_surface_not_ready'
+    observation: ProviderSessionObservation
+  }
+
+export type ProviderSessionResolution = {
+  decision: ProviderSessionDecision
+  observations: readonly ProviderSessionObservation[]
+}
diff --git a/packages/cli/src/playwright/providers.ts b/packages/cli/src/playwright/providers.ts
deleted file mode 100644
index 404847d..0000000
--- a/packages/cli/src/playwright/providers.ts
+++ /dev/null
@@ -1,423 +0,0 @@
-export const PROVIDER_IDS = Object.freeze({
-  CHATGPT: 'chatgpt',
-  CLAUDE: 'claude',
-  GEMINI: 'gemini',
-  GROK: 'grok',
-})
-
-export type ProviderId = typeof PROVIDER_IDS[keyof typeof PROVIDER_IDS]
-
-export type ProviderConfig = {
-  readonly id: ProviderId
-  readonly label: string
-  readonly homeUrl: string
-  readonly hosts: readonly string[]
-  readonly composerSettleMs: number
-  readonly composerSelectors: readonly string[]
-  readonly submitSelectors: readonly string[]
-  readonly answerSelectors: readonly string[]
-  readonly fileInputSelectors: readonly string[]
-  readonly modelControlSelectors: readonly string[]
-  readonly effortControlSelectors: readonly string[]
-  readonly authIndicators: readonly string[]
-  readonly loginIndicators: readonly string[]
-  readonly blockerSelectors: readonly string[]
-  readonly busySelectors: readonly string[]
-}
-
-type TrustedSignInNavigationPolicy = {
-  readonly host: string
-  readonly pathPrefixes?: readonly string[]
-}
-
-const PROVIDERS: readonly ProviderConfig[] = Object.freeze([
-  Object.freeze({
-    id: PROVIDER_IDS.CHATGPT,
-    label: 'ChatGPT',
-    homeUrl: 'https://chatgpt.com/',
-    hosts: Object.freeze(['chatgpt.com', 'chat.openai.com']),
-    composerSettleMs: 0,
-    composerSelectors: Object.freeze([
-      'div#prompt-textarea[contenteditable="true"]',
-      '#prompt-textarea[contenteditable="true"]',
-      '[data-testid="composer"] [contenteditable="true"]',
-      'div[contenteditable="true"][data-id="root"]',
-      'div.ProseMirror[contenteditable="true"]',
-      'div[role="textbox"][contenteditable="true"]',
-      'textarea[placeholder*="Message" i]',
-      'textarea[data-testid="prompt-textarea"]',
-      'textarea',
-    ]),
-    submitSelectors: Object.freeze([
-      'button[data-testid="send-button"]',
-      'button[data-testid="composer-send-button"]',
-      'button[aria-label="Send prompt"]',
-      'button[aria-label="Send message"]',
-      'button[aria-label*="Send" i]',
-      'button[type="submit"]',
-    ]),
-    answerSelectors: Object.freeze([
-      '[data-message-author-role="assistant"]',
-      'article[data-testid*="conversation-turn"]',
-      'main article',
-    ]),
-    fileInputSelectors: Object.freeze([
-      'input[type="file"]',
-    ]),
-    modelControlSelectors: Object.freeze([
-      'button[data-testid="model-switcher-dropdown-button"]',
-      'button[aria-label*="model" i]',
-      'button:has-text("GPT")',
-    ]),
-    effortControlSelectors: Object.freeze([
-      'button[aria-label*="thinking" i]',
-      'button:has-text("Thinking")',
-    ]),
-    authIndicators: Object.freeze([
-      '[data-testid="composer"]',
-      '#prompt-textarea',
-      'button[data-testid="profile-button"]',
-      'button[aria-label*="account" i]',
-    ]),
-    loginIndicators: Object.freeze([
-      'a[href*="/auth/login"]',
-      'button:has-text("Log in")',
-      'button:has-text("Sign up")',
-    ]),
-    blockerSelectors: Object.freeze([
-      'iframe[src*="captcha"]',
-      '[aria-label*="captcha" i]',
-      'text=/rate limit|too many requests/i',
-      'text=/upgrade required|upgrade your plan/i',
-    ]),
-    busySelectors: Object.freeze([
-      'button[data-testid="stop-button"]',
-      'button[aria-label*="Stop generating" i]',
-    ]),
-  }),
-  Object.freeze({
-    id: PROVIDER_IDS.CLAUDE,
-    label: 'Claude',
-    homeUrl: 'https://claude.ai/new',
-    hosts: Object.freeze(['claude.ai']),
-    composerSettleMs: 8_000,
-    composerSelectors: Object.freeze([
-      'div[data-testid="chat-input"][contenteditable="true"][role="textbox"]',
-      'div[aria-label="Write your prompt to Claude"][contenteditable="true"][role="textbox"]',
-      'div[contenteditable="true"][role="textbox"]',
-      'div.ProseMirror[contenteditable="true"]',
-      'textarea',
-    ]),
-    submitSelectors: Object.freeze([
-      'button[data-cds="Button"][aria-label="Send message"]',
-      'button[aria-label="Send message"]',
-      'button[aria-label*="Send" i]',
-      'button[type="submit"]',
-    ]),
-    answerSelectors: Object.freeze([
-      '[data-testid="virtual-message-list"] .font-claude-response-body',
-      'main .font-claude-response-body',
-      '.font-claude-response-body',
-    ]),
-    fileInputSelectors: Object.freeze([
-      'input[type="file"]',
-    ]),
-    modelControlSelectors: Object.freeze([
-      'button[aria-label*="model" i]',
-      'button:has-text("Claude")',
-    ]),
-    effortControlSelectors: Object.freeze([]),
-    authIndicators: Object.freeze([
-      'div[data-testid="chat-input"]',
-      '[data-testid="user-menu"]',
-      'button[aria-label*="account" i]',
-    ]),
-    loginIndicators: Object.freeze([
-      'button[data-testid="login-with-google"]',
-      'input[placeholder="Enter your email"]',
-      'button:has-text("Continue")',
-    ]),
-    blockerSelectors: Object.freeze([
-      'iframe[src*="captcha"]',
-      'input[placeholder="Enter your email"]',
-      'text=/rate limit|too many requests/i',
-      'text=/upgrade required|upgrade your plan/i',
-    ]),
-    busySelectors: Object.freeze([
-      '[data-testid="virtual-message-list"] [data-is-streaming="true"]',
-      'button[aria-label*="Stop" i]',
-    ]),
-  }),
-  Object.freeze({
-    id: PROVIDER_IDS.GEMINI,
-    label: 'Gemini',
-    homeUrl: 'https://gemini.google.com/app',
-    hosts: Object.freeze(['gemini.google.com']),
-    composerSettleMs: 0,
-    composerSelectors: Object.freeze([
-      'rich-textarea div.ql-editor[data-gramm="false"][contenteditable="true"][role="textbox"][aria-multiline="true"]',
-      'div[contenteditable="true"][role="textbox"]',
-      'textarea',
-    ]),
-    submitSelectors: Object.freeze([
-      'button[aria-label="Send message"]',
-    ]),
-    answerSelectors: Object.freeze([
-      'response-container message-content',
-      'message-content',
-    ]),
-    fileInputSelectors: Object.freeze([
-      'input[type="file"]',
-    ]),
-    modelControlSelectors: Object.freeze([
-      'button[aria-label*="model" i]',
-      'button:has-text("Gemini")',
-    ]),
-    effortControlSelectors: Object.freeze([]),
-    authIndicators: Object.freeze([
-      'rich-textarea',
-      'button[aria-label*="Google Account" i]',
-    ]),
-    loginIndicators: Object.freeze([
-      'a[href*="accounts.google.com"]',
-      'button:has-text("Sign in")',
-    ]),
-    blockerSelectors: Object.freeze([
-      'iframe[src^="https://www.google.com/recaptcha/"][title="reCAPTCHA"]',
-      'text=/rate limit|too many requests/i',
-      'text=/upgrade required|upgrade your plan/i',
-    ]),
-    busySelectors: Object.freeze([
-      'button[aria-label="Stop response"]',
-    ]),
-  }),
-  Object.freeze({
-    id: PROVIDER_IDS.GROK,
-    label: 'Grok',
-    homeUrl: 'https://grok.com/',
-    hosts: Object.freeze(['grok.com']),
-    composerSettleMs: 0,
-    composerSelectors: Object.freeze([
-      'div.tiptap.ProseMirror[contenteditable="true"][role="textbox"][aria-label="Ask Grok anything"][aria-multiline="true"]',
-      'textarea[aria-label="Ask Grok anything"][placeholder="What do you want to know?"]',
-      'div[contenteditable="true"][role="textbox"]',
-      'textarea',
-    ]),
-    submitSelectors: Object.freeze([
-      'button[data-testid="chat-submit"][aria-label="Submit"][type="submit"]',
-      'button[aria-label*="Submit" i]',
-    ]),
-    answerSelectors: Object.freeze([
-      'div[data-testid="assistant-message"]',
-    ]),
-    fileInputSelectors: Object.freeze([
-      'input[type="file"]',
-    ]),
-    modelControlSelectors: Object.freeze([
-      'button[aria-label*="model" i]',
-      'button:has-text("Grok")',
-    ]),
-    effortControlSelectors: Object.freeze([
-      'button[aria-label*="thinking" i]',
-      'button:has-text("Think")',
-    ]),
-    authIndicators: Object.freeze([
-      'div[data-testid="assistant-message"]',
-      'textarea[aria-label="Ask Grok anything"]',
-      'button[data-testid="chat-submit"]',
-    ]),
-    loginIndicators: Object.freeze([
-      'div[data-testid="anon-paywall-sign-up-card"]',
-      'button:has-text("Sign in")',
-      'button:has-text("Subscribe")',
-    ]),
-    blockerSelectors: Object.freeze([
-      'div[data-testid="anon-paywall-sign-up-card"]',
-      'text=/rate limit|too many requests/i',
-      'text=/upgrade required|upgrade your plan/i',
-    ]),
-    busySelectors: Object.freeze([]),
-  }),
-])
-
-const TRUSTED_SIGN_IN_NAVIGATION: Readonly<Record<ProviderId, readonly TrustedSignInNavigationPolicy[]>> = Object.freeze({
-  [PROVIDER_IDS.CHATGPT]: Object.freeze([
-    Object.freeze({ host: 'accounts.google.com' }),
-    Object.freeze({ host: 'auth.openai.com' }),
-    Object.freeze({ host: 'auth0.openai.com' }),
-    Object.freeze({ host: 'login.openai.com' }),
-  ]),
-  [PROVIDER_IDS.CLAUDE]: Object.freeze([
-    Object.freeze({ host: 'accounts.google.com' }),
-  ]),
-  [PROVIDER_IDS.GEMINI]: Object.freeze([
-    Object.freeze({ host: 'accounts.google.com' }),
-  ]),
-  [PROVIDER_IDS.GROK]: Object.freeze([]),
-})
-
-export function listProviders(): ProviderConfig[] {
-  return [...PROVIDERS]
-}
-
-export function getProviderById(providerId: unknown): ProviderConfig | null {
-  return PROVIDERS.find((provider) => provider.id === providerId) ?? null
-}
-
-export function providerHomeUrl(providerId: ProviderId) {
-  const provider = getProviderById(providerId)
-  if (!provider) throw new Error(`Unknown provider id: ${providerId}`)
-  return provider.homeUrl
-}
-
-export function getProviderForUrl(value: unknown): ProviderConfig | null {
-  if (typeof value !== 'string') return null
-  let parsed: URL
-  try {
-    parsed = new URL(value)
-  } catch {
-    return null
-  }
-  if (
-    parsed.protocol !== 'https:' ||
-    parsed.username !== '' ||
-    parsed.password !== '' ||
-    parsed.port !== ''
-  ) {
-    return null
-  }
-  const host = parsed.hostname.toLowerCase()
-  return PROVIDERS.find((provider) => provider.hosts.includes(host)) ?? null
-}
-
-export type CanonicalProviderTarget = {
-  providerId: ProviderId
-  href: string
-  origin: string
-  pathname: string
-}
-
-const FORBIDDEN_RAW_URL = /[\\\u0000-\u001f\u007f\s]|%(?:00|0[1-9a-f]|1[0-9a-f]|20|23|25|2f|3f|5c|7f)/i
-const MALFORMED_PERCENT_ESCAPE = /%(?![0-9a-f]{2})/i
-
-export function canonicalProviderTarget(provider: ProviderConfig, targetUrl: unknown): CanonicalProviderTarget | null {
-  const parsed = parseProviderUrl(provider, targetUrl === undefined ? provider.homeUrl : targetUrl)
-  if (!parsed) return null
-  const pathname = canonicalPathname(parsed.pathname)
-  return {
-    providerId: provider.id,
-    href: `${parsed.origin}${pathname}`,
-    origin: parsed.origin,
-    pathname,
-  }
-}
-
-export function safeProviderTargetUrl(provider: ProviderConfig, targetUrl: unknown): string | null {
-  return canonicalProviderTarget(provider, targetUrl)?.href ?? null
-}
-
-export function assertProviderUrlAllowed(provider: ProviderConfig, targetUrl: unknown) {
-  const target = canonicalObservedProviderTarget(provider, targetUrl)
-  if (!target) {
-    return {
-      ok: false as const,
-      reason: 'unsupported_provider_navigation',
-    }
-  }
-  return {
-    ok: true as const,
-    target,
-  }
-}
-
-export function trustedProviderSignInNavigation(provider: ProviderConfig, targetUrl: unknown) {
-  const parsed = parseTrustedSignInUrl(targetUrl)
-  if (!parsed) return null
-  const host = parsed.hostname.toLowerCase()
-  const policy = TRUSTED_SIGN_IN_NAVIGATION[provider.id].find((entry) => entry.host === host)
-  if (!policy) return null
-  if (policy.pathPrefixes && !policy.pathPrefixes.some((prefix) => parsed.pathname.startsWith(prefix))) return null
-  return {
-    providerId: provider.id,
-    origin: parsed.origin,
-    host,
-  }
-}
-
-function canonicalObservedProviderTarget(provider: ProviderConfig, value: unknown): CanonicalProviderTarget | null {
-  if (typeof value !== 'string' || value.length > 2048) return null
-  const privateStateIndex = [value.indexOf('?'), value.indexOf('#')]
-    .filter((index) => index >= 0)
-    .reduce((earliest, index) => Math.min(earliest, index), value.length)
-  const rawLocation = value.slice(0, privateStateIndex)
-  if (FORBIDDEN_RAW_URL.test(rawLocation) || MALFORMED_PERCENT_ESCAPE.test(rawLocation)) return null
-  let parsed: URL
-  try {
-    parsed = new URL(value)
-  } catch {
-    return null
-  }
-  if (
-    parsed.protocol !== 'https:' ||
-    parsed.username !== '' ||
-    parsed.password !== '' ||
-    parsed.port !== '' ||
-    !provider.hosts.includes(parsed.hostname.toLowerCase())
-  ) {
-    return null
-  }
-  const pathname = canonicalPathname(parsed.pathname)
-  return {
-    providerId: provider.id,
-    href: `${parsed.origin}${pathname}`,
-    origin: parsed.origin,
-    pathname,
-  }
-}
-
-function parseTrustedSignInUrl(value: unknown): URL | null {
-  if (typeof value !== 'string' || value.length > 2048) return null
-  let parsed: URL
-  try {
-    parsed = new URL(value)
-  } catch {
-    return null
-  }
-  if (
-    parsed.protocol !== 'https:' ||
-    parsed.username !== '' ||
-    parsed.password !== '' ||
-    parsed.port !== ''
-  ) {
-    return null
-  }
-  return parsed
-}
-
-function parseProviderUrl(provider: ProviderConfig, value: unknown): URL | null {
-  if (typeof value !== 'string' || value.length > 2048) return null
-  if (FORBIDDEN_RAW_URL.test(value) || MALFORMED_PERCENT_ESCAPE.test(value)) return null
-  let parsed: URL
-  try {
-    parsed = new URL(value)
-  } catch {
-    return null
-  }
-  if (
-    parsed.protocol !== 'https:' ||
-    parsed.username !== '' ||
-    parsed.password !== '' ||
-    parsed.port !== '' ||
-    parsed.search !== '' ||
-    parsed.hash !== '' ||
-    !provider.hosts.includes(parsed.hostname.toLowerCase())
-  ) {
-    return null
-  }
-  return parsed
-}
-
-function canonicalPathname(pathname: string) {
-  const parts = pathname.split('/').filter(Boolean).map((segment) => encodeURIComponent(decodeURIComponent(segment)))
-  return `/${parts.join('/')}`
-}
diff --git a/packages/cli/src/playwright/runner-entry.mts b/packages/cli/src/playwright/runner-entry.mts
deleted file mode 100644
index 5d28429..0000000
--- a/packages/cli/src/playwright/runner-entry.mts
+++ /dev/null
@@ -1,59 +0,0 @@
-import { ManagedPlaywrightRunnerService } from './runner-service.js'
-import { RUNNER_HEARTBEAT_INTERVAL_MS, writeRunnerHeartbeat } from './runner-supervisor.js'
-import { createDaemonClient } from './daemon-client.js'
-import { ManagedProfileRegistry } from './profiles/registry.js'
-
-const args = parseArgs(process.argv.slice(2))
-const abortController = new AbortController()
-const homeDir = requiredArg(args, 'home-dir')
-const sessionId = requiredArg(args, 'session-id')
-const browserId = args.get('browser') ?? 'chrome'
-const browserExecutablePath = args.get('browser-executable')
-
-process.on('SIGINT', () => abortController.abort())
-process.on('SIGTERM', () => abortController.abort())
-
-await writeRunnerHeartbeat({ homeDir, sessionId })
-const heartbeat = setInterval(() => {
-  void writeRunnerHeartbeat({ homeDir, sessionId }).catch(() => undefined)
-}, RUNNER_HEARTBEAT_INTERVAL_MS)
-
-const service = new ManagedPlaywrightRunnerService({
-  homeDir,
-  profileRegistry: new ManagedProfileRegistry(homeDir),
-  daemonClient: createDaemonClient({
-    homeDir,
-    daemonUrl: args.get('daemon-url'),
-  }),
-  browser: {
-    id: browserId,
-    ...(browserExecutablePath ? { executablePath: browserExecutablePath } : {}),
-  },
-})
-
-try {
-  await service.runUntilStopped(abortController.signal)
-} finally {
-  clearInterval(heartbeat)
-  await service.shutdown().catch(() => undefined)
-}
-
-function parseArgs(values: readonly string[]) {
-  const parsed = new Map<string, string>()
-  for (let index = 0; index < values.length; index += 1) {
-    const key = values[index]
-    const value = values[index + 1]
-    if (!key?.startsWith('--') || value === undefined || value.startsWith('--')) {
-      throw new Error('Invalid managed Playwright runner arguments.')
-    }
-    parsed.set(key.slice(2), value)
-    index += 1
-  }
-  return parsed
-}
-
-function requiredArg(args: Map<string, string>, key: string) {
-  const value = args.get(key)
-  if (!value) throw new Error('Missing managed Playwright runner argument.')
-  return value
-}
diff --git a/packages/cli/src/playwright/runner-service.ts b/packages/cli/src/playwright/runner-service.ts
index 9c172b9..79191ba 100644
--- a/packages/cli/src/playwright/runner-service.ts
+++ b/packages/cli/src/playwright/runner-service.ts
@@ -1,21 +1,38 @@
 import fs from 'node:fs/promises'
 import path from 'node:path'
-import { errorResponse, tokenlessError } from './errors.js'
-import { createProviderAdapterRegistry } from './adapters/index.js'
-import { PersistentContextManager } from './browser/context-manager.js'
+import { createHash } from 'node:crypto'
+import {
+  claimRecoveryError,
+  errorResponse,
+  isClaimRecoveryError,
+  tokenlessError,
+} from './errors.js'
+import { RUNNER_CHECKPOINT_SCHEMA_ID, USER_HANDOVER_SCHEMA_ID } from '../schema-ids.js'
+import { MAX_ACTIVE_BROWSER_PROFILES, PersistentContextManager } from './browser/context-manager.js'
+import {
+  e2eInspectionJobPrefix,
+  resolveE2EBrowserInspectionConfig,
+  waitForE2EBrowserObserver,
+} from './e2e-inspection.js'
+import type { E2EBrowserInspectionConfig } from './e2e-inspection.js'
 import type { ManagedBrowserLaunchTarget } from './browser/context-manager.js'
+import type { ManagedBrowserResolver } from './browser/context-manager.js'
 import {
   MANAGED_PLAYWRIGHT_JOB_ACTION,
-  MANAGED_PLAYWRIGHT_JOB_PROTOCOL_VERSION,
+  MANAGED_PLAYWRIGHT_JOB_SCHEMA_ID,
   PLAYWRIGHT_EXECUTION_BACKEND,
   validateManagedPlaywrightJobRequest,
 } from './job-contract.js'
-import { VISIBLE_ACTIONS, VISIBLE_ACTION_PROTOCOL_VERSION } from './actions.js'
-import { inspectVisibleBlockers } from './adapters/provider-dom-adapter.js'
-import { createDaemonClient } from './daemon-client.js'
+import { getVisibleActionLifecycle } from '../providers/action-catalog.js'
+import {
+  classifyProviderFailure,
+  classifyVisibleProviderBlocker,
+  type ClassifiedProviderFailure,
+} from './provider-failure-classification.js'
+import { VISIBLE_ACTIONS, VISIBLE_ACTION_SCHEMA_ID, isVisibleActionProtocolVersion } from './actions.js'
 import { ManagedProfileRegistry } from './profiles/registry.js'
-import { getProviderById, trustedProviderSignInNavigation } from './providers.js'
-import type { ProviderAdapterRegistry } from './adapters/index.js'
+import { readTokenlessConfig } from '../job-store.js'
+import { PROVIDER_CAPABILITIES, TASK_CAPABILITIES, getProviderInstanceById } from '../providers/registry.js'
 import type {
   ManagedBrowserContext,
   ManagedBrowserProfile,
@@ -23,19 +40,25 @@ import type {
 } from './browser/context-manager.js'
 import type { DaemonClaimedJob, DaemonJob, ManagedDaemonClient } from './daemon-client.js'
 import type { ManagedPlaywrightJobRequest } from './job-contract.js'
+import type { ProviderCapabilityId, TaskCapabilityId, TaskCapabilityRoute } from '../providers/registry.js'
 import type { BrowserVisibility } from '../browser-visibility.js'
+import type { BrowserConnectionMode } from '../browser-connection-mode.js'
 import type { VisibleAction, VisibleActionRequest } from './actions.js'
 import type { VisibleActionResponse } from './actions.js'
 import type { VisibleBlocker } from './actions.js'
+import type { NativeWorkspaceEnsureResult } from './actions.js'
+import type { ProviderActionPreparation } from '../providers/contracts.js'
+import type { ProviderCapacityProjection } from '../providers/rate-limit-policy.js'
 import type { BrowserContext, Page } from 'playwright-core'
 
 export type ManagedPlaywrightRunnerServiceOptions = {
   homeDir?: string | undefined
   profileRegistry?: ManagedProfileSource | undefined
-  daemonClient?: ManagedDaemonClient | undefined
+  daemonClient: ManagedDaemonClient
   contextManager?: PersistentContextManagerType | undefined
   browser?: ManagedBrowserLaunchTarget | undefined
-  adapterRegistry?: ProviderAdapterRegistry | undefined
+  browserConnectionMode?: BrowserConnectionMode | undefined
+  browserResolver?: ManagedBrowserResolver | undefined
   pollIdleMs?: number | undefined
   renewIntervalMs?: number | undefined
   cancelPollMs?: number | undefined
@@ -45,6 +68,7 @@ export type ManagedPlaywrightRunnerServiceOptions = {
   userHandoverPollMs?: number | undefined
   autoEscalatedCloseDelayMs?: number | undefined
   attachmentRootForJob?: ((job: DaemonJob) => string | undefined | Promise<string | undefined>) | undefined
+  recoverAbortedClaim?: ((job: DaemonClaimedJob) => Promise<unknown> | unknown) | undefined
   cleanupAttachmentRoot?: boolean | undefined
   now?: (() => Date) | undefined
 }
@@ -55,14 +79,39 @@ export type ManagedProfileSource = {
 
 export type ManagedPlaywrightRunnerIteration =
   | { claimed: false }
-  | { claimed: true, jobId: string, status: 'succeeded' | 'failed' | 'canceled' | 'waiting_for_user' }
+  | { claimed: true, jobId: string, status: 'succeeded' | 'failed' | 'canceled' | 'waiting_for_user' | 'fallback_queued' | 'rate_limit_deferred' }
 
 export type ManagedPlaywrightJobResult = {
-  protocol: typeof MANAGED_PLAYWRIGHT_JOB_PROTOCOL_VERSION
+  protocol: typeof MANAGED_PLAYWRIGHT_JOB_SCHEMA_ID
   provider: string
   responses: readonly VisibleActionResponse[]
 }
 
+export type ManagedProfileOpenResult = {
+  profileId: string
+  browserVisibility: BrowserVisibility
+  effectiveBrowserVisibility: Exclude<BrowserVisibility, 'auto'>
+  pageCount: number
+}
+
+export type ManagedProviderTabsOpenResult = ManagedProfileOpenResult & {
+  tabs: readonly {
+    provider: string
+    url: string
+    reused: boolean
+  }[]
+  failures: readonly {
+    provider: string
+    code: 'provider_tab_open_failed'
+    message: string
+  }[]
+}
+
+export type ManagedControlPlaneOpenResult = ManagedProfileOpenResult & {
+  url: string
+  reused: boolean
+}
+
 type RunnerCheckpointPhase =
   | { state: 'idle' }
   | {
@@ -78,11 +127,11 @@ type RunnerSubmittedActionCheckpoint = {
   actionIndex: number
   requestId: string
   providerUrl: string
-  responseBaseline: number
+  preparation: ProviderActionPreparation
 }
 
 type RunnerCheckpoint = {
-  protocol: typeof RUNNER_CHECKPOINT_PROTOCOL
+  protocol: typeof RUNNER_CHECKPOINT_SCHEMA_ID
   jobId: string
   profileId: string | null
   provider: string
@@ -90,7 +139,7 @@ type RunnerCheckpoint = {
   browserVisibility: BrowserVisibility
   actionCursor: number
   responses: readonly VisibleActionResponse[]
-  responseBaseline: number | null
+  preparation: ProviderActionPreparation | null
   submitted: RunnerSubmittedActionCheckpoint | null
   phase: RunnerCheckpointPhase
 }
@@ -98,7 +147,7 @@ type RunnerCheckpoint = {
 type RunnerExecutionState = {
   actionCursor: number
   responses: VisibleActionResponse[]
-  responseBaseline: number | null
+  preparation: ProviderActionPreparation | null
   submitted: RunnerSubmittedActionCheckpoint | null
 }
 
@@ -108,6 +157,8 @@ type ClearBlockerResult = {
   waitedMs: number
 }
 
+type RunnerProvider = NonNullable<ReturnType<typeof getProviderInstanceById>>
+
 const DEFAULT_RENEW_INTERVAL_MS = 10_000
 const DEFAULT_CANCEL_POLL_MS = 500
 const DEFAULT_POLL_IDLE_MS = 1_000
@@ -117,40 +168,10 @@ const DEFAULT_USER_HANDOVER_TIMEOUT_MS = 10 * 60_000
 const DEFAULT_USER_HANDOVER_POLL_MS = 1_000
 const DEFAULT_AUTO_ESCALATED_CLOSE_DELAY_MS = 30_000
 const SAFE_JOB_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/
-const GATED_ACTIONS = new Set<string>([
-  VISIBLE_ACTIONS.NAVIGATION_CHECK,
-  VISIBLE_ACTIONS.MODEL_INSPECT,
-  VISIBLE_ACTIONS.MODEL_SELECT,
-  VISIBLE_ACTIONS.EFFORT_INSPECT,
-  VISIBLE_ACTIONS.EFFORT_SELECT,
-  VISIBLE_ACTIONS.FILE_UPLOAD,
-  VISIBLE_ACTIONS.PROMPT_INPUT,
-  VISIBLE_ACTIONS.PROMPT_CLEAR,
-  VISIBLE_ACTIONS.PROMPT_SUBMIT,
-  VISIBLE_ACTIONS.RESPONSE_READ,
-])
-const MUTATING_ACTIONS = new Set<string>([
-  VISIBLE_ACTIONS.MODEL_SELECT,
-  VISIBLE_ACTIONS.EFFORT_SELECT,
-  VISIBLE_ACTIONS.FILE_UPLOAD,
-  VISIBLE_ACTIONS.PROMPT_INPUT,
-  VISIBLE_ACTIONS.PROMPT_CLEAR,
-  VISIBLE_ACTIONS.PROMPT_SUBMIT,
-])
-const RECONSTRUCTABLE_PRE_SUBMIT_ACTIONS = new Set<string>([
-  VISIBLE_ACTIONS.MODEL_SELECT,
-  VISIBLE_ACTIONS.EFFORT_SELECT,
-  VISIBLE_ACTIONS.FILE_UPLOAD,
-  VISIBLE_ACTIONS.PROMPT_INPUT,
-  VISIBLE_ACTIONS.PROMPT_CLEAR,
-])
-const RUNNER_CHECKPOINT_PROTOCOL = 'tokenless.playwright.runner-checkpoint.v1' as const
-
 export class ManagedPlaywrightRunnerService {
   private readonly profileRegistry: ManagedProfileSource
   private readonly daemonClient: ManagedDaemonClient
   private readonly contextManager: PersistentContextManagerType
-  private readonly adapterRegistry: ProviderAdapterRegistry
   private readonly pollIdleMs: number
   private readonly renewIntervalMs: number
   private readonly cancelPollMs: number
@@ -160,19 +181,41 @@ export class ManagedPlaywrightRunnerService {
   private readonly userHandoverPollMs: number
   private readonly autoEscalatedCloseDelayMs: number
   private readonly attachmentRootForJob: ((job: DaemonJob) => string | undefined | Promise<string | undefined>) | undefined
+  private readonly recoverAbortedClaim: ((job: DaemonClaimedJob) => Promise<unknown> | unknown) | undefined
   private readonly cleanupAttachmentRoot: boolean
   private readonly now: () => Date
+  private readonly e2eInspection: E2EBrowserInspectionConfig | null
+  private readonly controlPlanePageKey: string
+  private readonly providerTabsByProfile = new Map<string, Map<string, Page>>()
+  private readonly pendingProviderTabsByProfile = new Map<string, Set<string>>()
   private readonly inFlightProfiles = new Set<string>()
   private readonly inFlightJobs = new Set<Promise<void>>()
   private stopped = false
 
   constructor(options: ManagedPlaywrightRunnerServiceOptions) {
-    this.profileRegistry = options.profileRegistry ?? new ManagedProfileRegistry(options.homeDir)
-    this.daemonClient = options.daemonClient ?? createDaemonClient()
+    if (options.profileRegistry) {
+      this.profileRegistry = options.profileRegistry
+    } else {
+      const registry = new ManagedProfileRegistry(options.homeDir)
+      this.profileRegistry = {
+        listProfiles: async () => {
+          const [profiles, config] = await Promise.all([
+            registry.listProfiles(),
+            readTokenlessConfig(options.homeDir),
+          ])
+          return profiles.map((profile) => ({
+            ...profile,
+            proxy: config.profilePreferences[profile.slug]?.proxy ?? null,
+          }))
+        },
+      }
+    }
+    this.daemonClient = options.daemonClient
     this.contextManager = options.contextManager ?? new PersistentContextManager({
+      connectionMode: options.browserConnectionMode ?? 'playwright',
       ...(options.browser ? { browser: options.browser } : {}),
+      ...(options.browserResolver ? { browserResolver: options.browserResolver } : {}),
     })
-    this.adapterRegistry = options.adapterRegistry ?? createProviderAdapterRegistry()
     this.pollIdleMs = normalizedPositiveInteger(options.pollIdleMs, DEFAULT_POLL_IDLE_MS)
     this.renewIntervalMs = normalizedPositiveInteger(options.renewIntervalMs, DEFAULT_RENEW_INTERVAL_MS)
     this.cancelPollMs = normalizedPositiveInteger(options.cancelPollMs, DEFAULT_CANCEL_POLL_MS)
@@ -185,14 +228,175 @@ export class ManagedPlaywrightRunnerService {
     this.attachmentRootForJob = options.attachmentRootForJob ?? (
       defaultAttachmentHomeDir ? (job) => defaultAttachmentRootForJob(defaultAttachmentHomeDir, job) : undefined
     )
+    this.recoverAbortedClaim = options.recoverAbortedClaim
     this.cleanupAttachmentRoot = options.cleanupAttachmentRoot ?? true
     this.now = options.now ?? (() => new Date())
+    this.e2eInspection = resolveE2EBrowserInspectionConfig(options.homeDir)
+    const homeIdentity = createHash('sha256').update(path.resolve(options.homeDir ?? '.')).digest('base64url').slice(0, 20)
+    this.controlPlanePageKey = `tokenless:control-plane:${homeIdentity}`
   }
 
   stop() {
     this.stopped = true
   }
 
+  activeJobCount() {
+    return this.inFlightJobs.size
+  }
+
+  activeProfileCount() {
+    return this.contextManager.activeProfileIds().length
+  }
+
+  async openProfile(profileId: string, browserVisibility: BrowserVisibility): Promise<ManagedProfileOpenResult> {
+    const profile = (await this.profileRegistry.listProfiles())
+      .find((candidate) => candidate.id === profileId && (candidate.lifecycle === undefined || candidate.lifecycle === 'ready'))
+    if (!profile) {
+      throw tokenlessError('profile_not_found', 'Managed profile is not registered or is not ready.')
+    }
+    const managedContext = await this.contextManager.ensureContext(profile, browserVisibility)
+    const pages = managedContext.browserContext.pages()
+    if (pages[0] && managedContext.effectiveBrowserVisibility === 'headed') {
+      await bringToFront(pages[0])
+    }
+    return {
+      profileId: profile.id,
+      browserVisibility: managedContext.browserVisibility,
+      effectiveBrowserVisibility: managedContext.effectiveBrowserVisibility,
+      pageCount: pages.length,
+    }
+  }
+
+  async openProviderTabs(
+    profileId: string,
+    providerIds: readonly string[],
+    browserVisibility: BrowserVisibility,
+  ): Promise<ManagedProviderTabsOpenResult> {
+    const profile = (await this.profileRegistry.listProfiles())
+      .find((candidate) => candidate.id === profileId && (candidate.lifecycle === undefined || candidate.lifecycle === 'ready'))
+    if (!profile) {
+      throw tokenlessError('profile_not_found', 'Managed profile is not registered or is not ready.')
+    }
+    const providers = providerIds.map((providerId) => {
+      const provider = getProviderInstanceById(providerId)
+      if (!provider || provider.descriptor.stage === 'disabled') {
+        throw tokenlessError('unknown_provider', `Provider '${providerId}' is not supported.`)
+      }
+      return provider
+    })
+    const managedContext = await this.contextManager.ensureContext(profile, browserVisibility)
+    const existingPages = managedContext.browserContext.pages()
+    const claimedPages = new Set<Page>()
+    const knownProviderTabs = this.providerTabsByProfile.get(profile.id) ?? new Map<string, Page>()
+    const pendingProviderTabs = this.pendingProviderTabsByProfile.get(profile.id) ?? new Set<string>()
+    this.providerTabsByProfile.set(profile.id, knownProviderTabs)
+    this.pendingProviderTabsByProfile.set(profile.id, pendingProviderTabs)
+    const tabs: ManagedProviderTabsOpenResult['tabs'][number][] = []
+    const missing: RunnerProvider[] = []
+    for (const provider of providers) {
+      const known = knownProviderTabs.get(provider.id)
+      if (known?.isClosed()) knownProviderTabs.delete(provider.id)
+      const existing = known && !known.isClosed()
+        ? known
+        : existingPages.find((page) => !claimedPages.has(page) && providerOwnsPage(provider, page))
+      if (existing) {
+        claimedPages.add(existing)
+        knownProviderTabs.set(provider.id, existing)
+        tabs.push({ provider: provider.id, url: provider.descriptor.navigation.entryUrl, reused: true })
+      } else if (pendingProviderTabs.has(provider.id)) {
+        tabs.push({ provider: provider.id, url: provider.descriptor.navigation.entryUrl, reused: true })
+      } else {
+        missing.push(provider)
+      }
+    }
+
+    const failures: ManagedProviderTabsOpenResult['failures'][number][] = []
+    const initialBlankPage = existingPages.find((page) => (
+      !page.isClosed() && !claimedPages.has(page) && page.url() === 'about:blank'
+    ))
+    const initialProvider = initialBlankPage ? missing.shift() : undefined
+    if (initialProvider && initialBlankPage) {
+      claimedPages.add(initialBlankPage)
+      knownProviderTabs.set(initialProvider.id, initialBlankPage)
+      pendingProviderTabs.add(initialProvider.id)
+      tabs.push({
+        provider: initialProvider.id,
+        url: initialProvider.descriptor.navigation.entryUrl,
+        reused: false,
+      })
+      void initialBlankPage.goto(initialProvider.descriptor.navigation.entryUrl, { waitUntil: 'commit' })
+        .catch(() => knownProviderTabs.delete(initialProvider.id))
+        .finally(() => pendingProviderTabs.delete(initialProvider.id))
+    }
+    if (missing.length > 0) {
+      const browser = managedContext.browserContext.browser()
+      if (!browser) throw tokenlessError('playwright_browser_closed', 'Managed browser is no longer connected.')
+      const session = await browser.newBrowserCDPSession()
+      const requests = missing.map((provider) => {
+        pendingProviderTabs.add(provider.id)
+        tabs.push({ provider: provider.id, url: provider.descriptor.navigation.entryUrl, reused: false })
+        return session.send('Target.createTarget', {
+          url: provider.descriptor.navigation.entryUrl,
+          background: true,
+        }).then(async (created) => {
+          const createdPages = await waitForChromiumTargetPages(
+            managedContext.browserContext,
+            new Set([created.targetId]),
+            10_000,
+          )
+          const page = createdPages.get(created.targetId)
+          if (page) knownProviderTabs.set(provider.id, page)
+        }).finally(() => pendingProviderTabs.delete(provider.id))
+      })
+      void Promise.allSettled(requests).finally(() => session.detach().catch(() => undefined))
+    }
+    if (pendingProviderTabs.size === 0) {
+      this.pendingProviderTabsByProfile.delete(profile.id)
+      if (knownProviderTabs.size === 0) {
+        this.providerTabsByProfile.delete(profile.id)
+      }
+    }
+    const providerOrder = new Map(providerIds.map((provider, index) => [provider, index]))
+    tabs.sort((left, right) => (providerOrder.get(left.provider) ?? 0) - (providerOrder.get(right.provider) ?? 0))
+    failures.sort((left, right) => (providerOrder.get(left.provider) ?? 0) - (providerOrder.get(right.provider) ?? 0))
+    return {
+      profileId: profile.id,
+      browserVisibility: managedContext.browserVisibility,
+      effectiveBrowserVisibility: managedContext.effectiveBrowserVisibility,
+      pageCount: managedContext.browserContext.pages().length,
+      tabs,
+      failures,
+    }
+  }
+
+  async openControlPlane(profileId: string, bootstrapUrl: string): Promise<ManagedControlPlaneOpenResult> {
+    const parsed = new URL(bootstrapUrl)
+    if (
+      parsed.protocol !== 'http:' ||
+      parsed.username ||
+      parsed.password ||
+      !(parsed.hostname === 'localhost' || parsed.hostname === '::1' || parsed.hostname.startsWith('127.'))
+    ) {
+      throw tokenlessError('invalid_control_plane_url', 'Control-plane URL must use a loopback HTTP origin.')
+    }
+    const profile = (await this.profileRegistry.listProfiles())
+      .find((candidate) => candidate.id === profileId && (candidate.lifecycle === undefined || candidate.lifecycle === 'ready'))
+    if (!profile) throw tokenlessError('profile_not_found', 'Managed profile is not registered or is not ready.')
+    const managedContext = await this.contextManager.ensureContext(profile, 'headed')
+    const page = await managedContext.acquireReservedPage({ key: this.controlPlanePageKey, policy: 'preserve' })
+    const reused = page.url() !== 'about:blank'
+    await page.goto(parsed.toString(), { waitUntil: 'domcontentloaded' })
+    await bringToFront(page)
+    return {
+      profileId: profile.id,
+      browserVisibility: managedContext.browserVisibility,
+      effectiveBrowserVisibility: managedContext.effectiveBrowserVisibility,
+      pageCount: managedContext.browserContext.pages().length,
+      url: page.url(),
+      reused,
+    }
+  }
+
   async shutdown() {
     this.stop()
     await this.contextManager.shutdown()
@@ -207,7 +411,12 @@ export class ManagedPlaywrightRunnerService {
         }
       }
     } finally {
-      await Promise.allSettled([...this.inFlightJobs])
+      const results = await Promise.allSettled([...this.inFlightJobs])
+      const recoveryFailure = results.find((result) => (
+        result.status === 'rejected' &&
+        isManagedPlaywrightClaimRecoveryFailure(result.reason)
+      ))
+      if (recoveryFailure?.status === 'rejected') throw recoveryFailure.reason
     }
   }
 
@@ -219,6 +428,7 @@ export class ManagedPlaywrightRunnerService {
         executionBackend: PLAYWRIGHT_EXECUTION_BACKEND,
         profileId: profile.id,
         action: MANAGED_PLAYWRIGHT_JOB_ACTION,
+        jobIdPrefix: this.e2eInspection ? e2eInspectionJobPrefix(this.e2eInspection) : undefined,
         signal,
       })
       if (claimed.job) return await this.executeClaimedJob(profile, claimed.job, signal)
@@ -227,23 +437,26 @@ export class ManagedPlaywrightRunnerService {
   }
 
   private async startAvailableJobs(signal?: AbortSignal | undefined) {
-    if (this.inFlightProfiles.size >= 4) return 0
+    if (this.inFlightProfiles.size >= MAX_ACTIVE_BROWSER_PROFILES) return 0
     let started = 0
     const profiles = await this.claimableProfiles(this.inFlightProfiles)
     for (const profile of profiles) {
-      if (this.stopped || signal?.aborted || this.inFlightProfiles.size >= 4) break
+      if (this.stopped || signal?.aborted || this.inFlightProfiles.size >= MAX_ACTIVE_BROWSER_PROFILES) break
       if (this.inFlightProfiles.has(profile.id)) continue
       const claimed = await this.daemonClient.claimNextJob({
         executionBackend: PLAYWRIGHT_EXECUTION_BACKEND,
         profileId: profile.id,
         action: MANAGED_PLAYWRIGHT_JOB_ACTION,
+        jobIdPrefix: this.e2eInspection ? e2eInspectionJobPrefix(this.e2eInspection) : undefined,
         signal,
       })
       if (!claimed.job) continue
       this.inFlightProfiles.add(profile.id)
       const jobPromise = this.executeClaimedJob(profile, claimed.job, signal)
         .then(() => undefined)
-        .catch(() => undefined)
+        .catch((error) => {
+          if (isClaimRecoveryError(error)) throw error
+        })
         .finally(() => {
           this.inFlightProfiles.delete(profile.id)
           this.inFlightJobs.delete(jobPromise)
@@ -275,6 +488,7 @@ export class ManagedPlaywrightRunnerService {
     let canceled = false
     let renewError: unknown
     let attachmentRoot: string | undefined
+    let providerAttachmentRoot: string | undefined
     let autoEscalatedBrowserContext: BrowserContext | undefined
     let terminalCompletion = false
     const renewTimer = setInterval(() => {
@@ -297,8 +511,51 @@ export class ManagedPlaywrightRunnerService {
 
     try {
       const request = this.validateClaimedJob(profile, job)
+      if (job.provider_submitted_at === null && !checkpointIndicatesSubmission(job.checkpoint_json)) {
+        const subscription = rateLimitSubscription(profile, job.provider)
+        const projection = await this.daemonClient.projectJobProviderCapacity({
+          jobId: job.job_id,
+          claimToken: job.claim_token,
+          accessClass: subscription.accessClass,
+          tierLabel: subscription.tierLabel,
+          subscriptionLabel: subscription.subscriptionLabel,
+          signal,
+        })
+        if (projection.decision === 'defer') {
+          const failure = providerCapacityFailure(projection)
+          const fallbackRequest = safeFallbackRequest(request, initialExecutionState(), failure)
+          if (fallbackRequest) {
+            await this.daemonClient.fallbackJob({
+              jobId: job.job_id,
+              claimToken: job.claim_token,
+              provider: fallbackRequest.provider,
+              request: fallbackRequest,
+              blocker: { code: 'provider_capacity_deferred', projection, failure },
+              signal,
+            })
+            throw new QueuedProviderFallback()
+          }
+          if (!projection.eligibleAt) {
+            throw tokenlessError(
+              'provider_capacity_request_exceeds_known_allowance',
+              'The request exceeds a known provider allowance and cannot become eligible by waiting.',
+              { retryable: false, details: projection },
+            )
+          }
+          await this.daemonClient.deferJobForProviderCapacity({
+            jobId: job.job_id,
+            claimToken: job.claim_token,
+            projection,
+            signal,
+          })
+          throw new DeferredProviderCapacity()
+        }
+      }
       attachmentRoot = await this.attachmentRootForJob?.(job)
-      if (attachmentRoot) assertSafeAttachmentCleanupRoot(attachmentRoot, job.job_id)
+      if (attachmentRoot) {
+        assertSafeAttachmentCleanupRoot(attachmentRoot, job.job_id)
+        providerAttachmentRoot = path.dirname(attachmentRoot)
+      }
       await this.daemonClient.markJobRunning({
         jobId: job.job_id,
         claimToken: job.claim_token,
@@ -308,7 +565,7 @@ export class ManagedPlaywrightRunnerService {
         profile,
         job,
         request,
-        attachmentRoot,
+        providerAttachmentRoot,
         signal,
         () => canceled,
         () => renewError,
@@ -331,6 +588,14 @@ export class ManagedPlaywrightRunnerService {
         attachmentRoot = undefined
         return { claimed: true, jobId: job.job_id, status: 'waiting_for_user' }
       }
+      if (error instanceof QueuedProviderFallback) {
+        attachmentRoot = undefined
+        return { claimed: true, jobId: job.job_id, status: 'fallback_queued' }
+      }
+      if (error instanceof DeferredProviderCapacity) {
+        attachmentRoot = undefined
+        return { claimed: true, jobId: job.job_id, status: 'rate_limit_deferred' }
+      }
       if (canceled || signal.aborted) {
         if (!renewError) {
           return { claimed: true, jobId: job.job_id, status: 'canceled' }
@@ -360,7 +625,8 @@ export class ManagedPlaywrightRunnerService {
       clearInterval(renewTimer)
       clearInterval(cancelTimer)
       controller.abort()
-      if (attachmentRoot && this.cleanupAttachmentRoot) {
+      const recoverClaim = outerSignal?.aborted && !terminalCompletion && !canceled && !renewError
+      if (attachmentRoot && this.cleanupAttachmentRoot && !recoverClaim) {
         await fs.rm(attachmentRoot, { recursive: true, force: true }).catch(() => undefined)
       }
       if ((terminalCompletion || canceled) && autoEscalatedBrowserContext) {
@@ -369,6 +635,13 @@ export class ManagedPlaywrightRunnerService {
           browserContext: autoEscalatedBrowserContext,
         })
       }
+      if (recoverClaim) {
+        try {
+          await this.recoverAbortedClaim?.(job)
+        } catch (error) {
+          throw claimRecoveryError(error)
+        }
+      }
     }
   }
 
@@ -376,10 +649,11 @@ export class ManagedPlaywrightRunnerService {
     const profiles = (await this.profileRegistry.listProfiles())
       .filter((profile) => profile.lifecycle === undefined || profile.lifecycle === 'ready')
     const activeProfileIds = new Set(this.contextManager.activeProfileIds())
-    if (activeProfileIds.size >= 4) {
+    if (activeProfileIds.size >= MAX_ACTIVE_BROWSER_PROFILES) {
       return profiles.filter((profile) => activeProfileIds.has(profile.id) && !inFlightProfiles.has(profile.id))
     }
-    const remainingNewProfileSlots = 4 - activeProfileIds.size - [...inFlightProfiles].filter((profileId) => !activeProfileIds.has(profileId)).length
+    const remainingNewProfileSlots = MAX_ACTIVE_BROWSER_PROFILES - activeProfileIds.size - [...inFlightProfiles]
+      .filter((profileId) => !activeProfileIds.has(profileId)).length
     let newProfiles = 0
     const claimable: ManagedBrowserProfile[] = []
     for (const profile of profiles) {
@@ -427,17 +701,61 @@ export class ManagedPlaywrightRunnerService {
     const restoredCheckpoint = validateRunnerCheckpoint(job.checkpoint_json, profile, job, request)
     const responses = await this.contextManager.runWithProfile(profile, claimBrowserVisibility, async (initialManagedContext) => {
       let managedContext = initialManagedContext
-      let page = await managedContext.page()
-      const provider = getProviderById(request.provider)
+      const pageKey = managedPageKey(job, request)
+      let page = await managedContext.acquirePage({ key: pageKey, policy: request.pagePolicy ?? 'preserve' })
+      const provider = getProviderInstanceById(request.provider)
       if (!provider) throw tokenlessError('unknown_playwright_job_provider', 'Managed Playwright job provider is not supported.')
       const state = executionStateFromCheckpoint(restoredCheckpoint)
+      if (state.submitted !== null && job.provider_submitted_at === null) {
+        await this.daemonClient.recordProviderSubmission({
+          jobId: job.job_id,
+          claimToken: job.claim_token,
+          signal,
+        })
+      }
+      const failOrFallback = async (failure: ClassifiedProviderFailure): Promise<never> => {
+        throwIfStopped(signal, isCanceled, renewalError)
+        const fallbackRequest = safeFallbackRequest(request, state, failure)
+        if (!fallbackRequest) {
+          throw classifiedFailureError(failure, providerFallbackStopReason(request, state, failure))
+        }
+        await this.daemonClient.fallbackJob({
+          jobId: job.job_id,
+          claimToken: job.claim_token,
+          provider: fallbackRequest.provider,
+          request: fallbackRequest,
+          blocker: providerFailurePayload(job, failure, {
+            requestedVisibility: claimBrowserVisibility,
+            effectiveVisibility: managedContext.effectiveBrowserVisibility,
+            windowOpen: claimBrowserVisibility !== 'headless',
+          }),
+        })
+        throw new QueuedProviderFallback()
+      }
       const startUrl = state.submitted?.providerUrl ?? request.target.url
-      await navigateToTarget(page, startUrl, signal, request.actions.some((action) => action.action === VISIBLE_ACTIONS.NAVIGATION_CHECK))
+      try {
+        await navigateToTarget(page, startUrl, signal, request.actions.some((action) => action.action === VISIBLE_ACTIONS.NAVIGATION_CHECK))
+      } catch (error) {
+        const failure = classifyProviderFailure({ error, submitted: state.submitted !== null })
+        await failOrFallback(failure)
+      }
+      if (this.e2eInspection) {
+        await waitForE2EBrowserObserver({
+          config: this.e2eInspection,
+          jobId: job.job_id,
+          profileId: profile.id,
+          profileDirectory: profile.directory,
+          provider: request.provider,
+          url: page.url(),
+          targetId: await chromiumTargetId(managedContext.browserContext, page),
+          signal,
+        })
+      }
       if (restoredCheckpoint && !state.submitted) {
         await reconstructCompletedPreSubmitActions(page, {
+          provider,
           request,
           actionCursor: state.actionCursor,
-          adapterRegistry: this.adapterRegistry,
           profile,
           job,
           attachmentRoot,
@@ -445,13 +763,14 @@ export class ManagedPlaywrightRunnerService {
           now: this.now,
         })
       }
-      const clearBlocker = async (): Promise<number> => {
+      const clearBlocker = async (waitForGuestSurface = false): Promise<number> => {
         const cleared = await this.clearUserResolvableBlocker({
           managedContext,
           page,
           profile,
           job,
           request,
+          pageKey,
           claimBrowserVisibility,
           provider,
           state,
@@ -460,68 +779,175 @@ export class ManagedPlaywrightRunnerService {
           isCanceled,
           renewalError,
           onAutoEscalated,
+          waitForGuestSurface,
         })
         managedContext = cleared.managedContext
         page = cleared.page
         return cleared.waitedMs
       }
+      if (request.capabilityRoute && state.actionCursor === 0 && state.submitted === null) {
+        let failure: ClassifiedProviderFailure | null
+        try {
+          await clearBlocker(true)
+          failure = await inspectAttemptCapabilityEligibility(page, provider, request.capabilityRoute)
+          throwIfStopped(signal, isCanceled, renewalError)
+        } catch (error) {
+          throwRunnerControlFlow(error)
+          throwIfStopped(signal, isCanceled, renewalError)
+          failure = classifyProviderFailure({ error, submitted: false })
+        }
+        if (failure) await failOrFallback(failure)
+      }
       for (let actionIndex = state.actionCursor; actionIndex < request.actions.length; actionIndex += 1) {
         const action = request.actions[actionIndex]
         if (!action) throw tokenlessError('invalid_playwright_runner_checkpoint', 'Managed Playwright runner action cursor is invalid.')
+        const lifecycle = getVisibleActionLifecycle(action.action)
         throwIfStopped(signal, isCanceled, renewalError)
-        if (action.action === VISIBLE_ACTIONS.PROMPT_SUBMIT) {
-          await clearBlocker()
-          state.responseBaseline = await countVisibleAnswers(page, provider.answerSelectors)
+        if (lifecycle.completion === 'records_submission') {
+          try {
+            await clearBlocker(true)
+            state.preparation = await provider.prepareAction(page, action)
+          } catch (error) {
+            throwRunnerControlFlow(error)
+            await failOrFallback(classifyProviderFailure({
+              error,
+              submitted: state.submitted !== null,
+            }))
+          }
         }
-        if (action.action === VISIBLE_ACTIONS.RESPONSE_READ && state.responseBaseline !== null) {
-          await this.waitForNewResponseReady(() => page, {
-            answerSelectors: provider.answerSelectors,
-            busySelectors: provider.busySelectors,
-            baseline: state.responseBaseline,
-            timeoutMs: this.responseWaitTimeoutMs,
-            pollMs: this.responseWaitPollMs,
-            signal,
-            isCanceled,
-            renewalError,
-            clearBlocker,
-          })
+        if (lifecycle.completion === 'reads_response' && state.preparation !== null) {
+          try {
+            await this.waitForPreparedActionReady(() => page, {
+              provider,
+              action,
+              preparation: state.preparation,
+              timeoutMs: this.responseWaitTimeoutMs,
+              pollMs: this.responseWaitPollMs,
+              signal,
+              isCanceled,
+              renewalError,
+              clearBlocker: () => clearBlocker(true),
+            })
+          } catch (error) {
+            throwRunnerControlFlow(error)
+            const failure = classifyProviderFailure({ error, submitted: state.submitted !== null, actionLifecycle: lifecycle })
+            await failOrFallback(failure)
+          }
         }
         if (
-          GATED_ACTIONS.has(action.action) &&
-          action.action !== VISIBLE_ACTIONS.PROMPT_SUBMIT &&
-          action.action !== VISIBLE_ACTIONS.RESPONSE_READ
+          lifecycle.gated &&
+          lifecycle.completion !== 'records_submission' &&
+          lifecycle.completion !== 'reads_response'
         ) {
-          await clearBlocker()
+          try {
+            await clearBlocker(true)
+          } catch (error) {
+            throwRunnerControlFlow(error)
+            await failOrFallback(classifyProviderFailure({
+              error,
+              submitted: state.submitted !== null,
+            }))
+          }
         }
         await this.checkpointJob(profile, job, request, state, checkpointPhaseForAction('started', actionIndex, action, page, provider))
-        const adapterContext = {
+        const providerContext = {
           profileId: profile.id,
           operationId: job.job_id,
           signal,
           now: this.now,
           ...(attachmentRoot === undefined ? {} : { attachmentRoot }),
         }
-        const response = await this.adapterRegistry.execute(page, action, adapterContext)
+        const response = await (async (): Promise<VisibleActionResponse> => {
+          try {
+            return await provider.executeAction(page, action, providerContext)
+          } catch (error) {
+            return await failOrFallback(classifyProviderFailure({
+              error,
+              submitted: state.submitted !== null,
+              actionLifecycle: lifecycle,
+            }))
+          }
+        })()
         if (!response.ok) {
-          throw tokenlessError(response.error.code, response.error.message, { retryable: response.error.retryable })
+          throwIfStopped(signal, isCanceled, renewalError)
+          const error = tokenlessError(response.error.code, response.error.message, { retryable: response.error.retryable })
+          const failure = classifyProviderFailure({
+            error,
+            submitted: state.submitted !== null,
+            actionLifecycle: lifecycle,
+          })
+          await failOrFallback(failure)
         }
         state.responses.push(response)
-        if (action.action === VISIBLE_ACTIONS.PROMPT_SUBMIT) {
+        if (lifecycle.completion === 'records_submission') {
+          if (!state.preparation) {
+            throw tokenlessError('invalid_playwright_runner_checkpoint', 'Managed Playwright runner did not prepare prompt submission completion.')
+          }
           state.submitted = {
             actionIndex,
             requestId: action.requestId,
             providerUrl: validatedCurrentProviderUrl(page, provider, request.target.url),
-            responseBaseline: state.responseBaseline ?? 0,
+            preparation: state.preparation,
           }
+          await this.daemonClient.recordProviderSubmission({
+            jobId: job.job_id,
+            claimToken: job.claim_token,
+            signal,
+          })
         }
-        if (action.action === VISIBLE_ACTIONS.RESPONSE_READ) state.responseBaseline = null
+        if (lifecycle.completion === 'reads_response') state.preparation = null
         state.actionCursor = actionIndex + 1
         await this.checkpointJob(profile, job, request, state, checkpointPhaseForAction('completed', actionIndex, action, page, provider))
+        if (action.action === VISIBLE_ACTIONS.WORKSPACE_ENSURE && isNativeWorkspaceResult(response.result)) {
+          await this.daemonClient.upsertProviderProject({
+            jobId: job.job_id,
+            claimToken: job.claim_token,
+            provider: request.provider,
+            profileId: profile.id,
+            resourceId: response.result.resource.id,
+            name: response.result.name,
+            canonicalUrl: response.result.resource.canonicalUrl,
+            visibleProof: response.result.visibleProof,
+            created: response.result.resource.disposition === 'created',
+            signal,
+          })
+        }
+        if (lifecycle.completion === 'reads_response' && request.taskId) {
+          const workspace = latestNativeWorkspaceResult(state.responses)
+          const conversationUrl = validatedConversationUrl(
+            page.url(),
+            provider,
+            workspace?.resource.canonicalUrl ?? request.target.url,
+          )
+          if (conversationUrl) {
+            await this.daemonClient.upsertProviderTaskConversation({
+              jobId: job.job_id,
+              claimToken: job.claim_token,
+              provider: request.provider,
+              profileId: profile.id,
+              taskId: request.taskId,
+              canonicalUrl: conversationUrl,
+              signal,
+            })
+          }
+          if (workspace && conversationUrl) {
+            await this.daemonClient.upsertProviderConversation({
+              jobId: job.job_id,
+              claimToken: job.claim_token,
+              provider: request.provider,
+              profileId: profile.id,
+              projectResourceId: workspace.resource.id,
+              taskId: request.taskId,
+              canonicalUrl: conversationUrl,
+              signal,
+            })
+          }
+        }
       }
       return state.responses
     })
     return {
-      protocol: MANAGED_PLAYWRIGHT_JOB_PROTOCOL_VERSION,
+      protocol: MANAGED_PLAYWRIGHT_JOB_SCHEMA_ID,
       provider: request.provider,
       responses,
     }
@@ -547,22 +973,72 @@ export class ManagedPlaywrightRunnerService {
     profile: ManagedBrowserProfile
     job: DaemonClaimedJob
     request: ManagedPlaywrightJobRequest
+    pageKey: string
     claimBrowserVisibility: BrowserVisibility
-    provider: NonNullable<ReturnType<typeof getProviderById>>
+    provider: RunnerProvider
     state: RunnerExecutionState
     attachmentRoot: string | undefined
     signal: AbortSignal
     isCanceled: () => boolean
     renewalError: () => unknown
     onAutoEscalated: (context: ManagedBrowserContext) => void
+    waitForGuestSurface: boolean
   }): Promise<ClearBlockerResult> {
     throwIfStopped(options.signal, options.isCanceled, options.renewalError)
-    const initial = await visibleBlockerState(options.page, options.provider)
+    const initial = await visibleBlockerState(
+      options.page,
+      options.provider,
+      options.waitForGuestSurface,
+      options.state.submitted !== null,
+    )
     if (!initial.blocked) {
       return { managedContext: options.managedContext, page: options.page, waitedMs: 0 }
     }
+    const failure = classifyVisibleProviderBlocker(initial.primary)
+    const fallbackRequest = safeFallbackRequest(options.request, options.state, failure)
+    if (fallbackRequest) {
+      await this.daemonClient.fallbackJob({
+        jobId: options.job.job_id,
+        claimToken: options.job.claim_token,
+        provider: fallbackRequest.provider,
+        request: fallbackRequest,
+        blocker: {
+          ...blockerPayload(options.job, initial.blockers, {
+            requestedVisibility: options.claimBrowserVisibility,
+            effectiveVisibility: options.managedContext.effectiveBrowserVisibility,
+            windowOpen: options.claimBrowserVisibility !== 'headless',
+          }),
+          failure,
+        },
+      })
+      throw new QueuedProviderFallback()
+    }
+    const initialCapacityDelay = options.state.submitted === null
+      ? observedCapacityDelaySeconds(initial.primary)
+      : null
+    if (initialCapacityDelay !== null) {
+      await this.daemonClient.deferObservedProviderLimit({
+        jobId: options.job.job_id,
+        claimToken: options.job.claim_token,
+        blocker: {
+          ...blockerPayload(options.job, initial.blockers, {
+            requestedVisibility: options.claimBrowserVisibility,
+            effectiveVisibility: options.managedContext.effectiveBrowserVisibility,
+            windowOpen: options.claimBrowserVisibility !== 'headless',
+          }),
+          failure,
+          retryAfterSeconds: initialCapacityDelay,
+        },
+        delaySeconds: initialCapacityDelay,
+        signal: options.signal,
+      })
+      throw new DeferredProviderCapacity()
+    }
     if (initial.terminal) {
-      throw tokenlessError(initial.primary.code, initial.primary.message, { retryable: initial.primary.retryable })
+      throw classifiedFailureError(
+        failure,
+        providerFallbackStopReason(options.request, options.state, failure),
+      )
     }
     const checkpoint = buildRunnerCheckpoint(
       options.profile,
@@ -576,15 +1052,19 @@ export class ManagedPlaywrightRunnerService {
       claimToken: options.job.claim_token,
       checkpoint,
     })
-    if (options.claimBrowserVisibility === 'headless') {
+    if (options.claimBrowserVisibility === 'headless' || this.e2eInspection) {
       await this.daemonClient.parkJob({
         jobId: options.job.job_id,
         claimToken: options.job.claim_token,
-        blocker: blockerPayload(options.job, initial.blockers, {
-          requestedVisibility: options.claimBrowserVisibility,
-          effectiveVisibility: options.managedContext.effectiveBrowserVisibility,
-          windowOpen: false,
-        }),
+        blocker: {
+          ...blockerPayload(options.job, initial.blockers, {
+            requestedVisibility: options.claimBrowserVisibility,
+            effectiveVisibility: options.managedContext.effectiveBrowserVisibility,
+            windowOpen: options.claimBrowserVisibility !== 'headless',
+          }),
+          failure,
+          fallbackStopped: providerFallbackStopReason(options.request, options.state, failure),
+        },
         checkpoint,
       })
       throw new ParkedPlaywrightJob()
@@ -595,13 +1075,13 @@ export class ManagedPlaywrightRunnerService {
       const url = trustedSwitchUrl(page, options.provider, options.request.target.url)
       managedContext = await managedContext.switchVisibility('headed')
       options.onAutoEscalated(managedContext)
-      page = await managedContext.page()
+      page = await managedContext.acquirePage({ key: options.pageKey, policy: options.request.pagePolicy ?? 'preserve' })
       await navigateToTarget(page, url, options.signal, true)
       if (!options.state.submitted) {
         await reconstructCompletedPreSubmitActions(page, {
+          provider: options.provider,
           request: options.request,
           actionCursor: options.state.actionCursor,
-          adapterRegistry: this.adapterRegistry,
           profile: options.profile,
           job: options.job,
           attachmentRoot: options.attachmentRoot,
@@ -616,19 +1096,53 @@ export class ManagedPlaywrightRunnerService {
     await this.daemonClient.markJobWaitingForUser({
       jobId: options.job.job_id,
       claimToken: options.job.claim_token,
-      blocker: blockerPayload(options.job, initial.blockers, {
-        requestedVisibility: options.claimBrowserVisibility,
-        effectiveVisibility: managedContext.effectiveBrowserVisibility,
-        windowOpen: true,
-      }),
+      blocker: {
+        ...blockerPayload(options.job, initial.blockers, {
+          requestedVisibility: options.claimBrowserVisibility,
+          effectiveVisibility: managedContext.effectiveBrowserVisibility,
+          windowOpen: true,
+        }),
+        failure,
+        fallbackStopped: providerFallbackStopReason(options.request, options.state, failure),
+      },
     })
     const deadline = Date.now() + this.userHandoverTimeoutMs
     while (Date.now() <= deadline) {
       throwIfStopped(options.signal, options.isCanceled, options.renewalError)
       await delay(Math.min(this.userHandoverPollMs, Math.max(1, deadline - Date.now())), options.signal)
-      const latest = await visibleBlockerState(page, options.provider)
+      const latest = await visibleBlockerState(
+        page,
+        options.provider,
+        options.waitForGuestSurface,
+        options.state.submitted !== null,
+      )
       if (latest.terminal) {
-        throw tokenlessError(latest.primary.code, latest.primary.message, { retryable: latest.primary.retryable })
+        const latestFailure = classifyVisibleProviderBlocker(latest.primary)
+        const latestCapacityDelay = options.state.submitted === null
+          ? observedCapacityDelaySeconds(latest.primary)
+          : null
+        if (latestCapacityDelay !== null) {
+          await this.daemonClient.deferObservedProviderLimit({
+            jobId: options.job.job_id,
+            claimToken: options.job.claim_token,
+            blocker: {
+              ...blockerPayload(options.job, latest.blockers, {
+                requestedVisibility: options.claimBrowserVisibility,
+                effectiveVisibility: managedContext.effectiveBrowserVisibility,
+                windowOpen: true,
+              }),
+              failure: latestFailure,
+              retryAfterSeconds: latestCapacityDelay,
+            },
+            delaySeconds: latestCapacityDelay,
+            signal: options.signal,
+          })
+          throw new DeferredProviderCapacity()
+        }
+        throw classifiedFailureError(
+          latestFailure,
+          providerFallbackStopReason(options.request, options.state, latestFailure),
+        )
       }
       if (!latest.blocked && await hasStableComposer(
         page,
@@ -652,12 +1166,12 @@ export class ManagedPlaywrightRunnerService {
     )
   }
 
-  private async waitForNewResponseReady(
+  private async waitForPreparedActionReady(
     getPage: () => Page,
     options: {
-      answerSelectors: readonly string[]
-      busySelectors: readonly string[]
-      baseline: number
+      provider: RunnerProvider
+      action: VisibleActionRequest
+      preparation: ProviderActionPreparation
       timeoutMs: number
       pollMs: number
       signal: AbortSignal
@@ -672,30 +1186,275 @@ export class ManagedPlaywrightRunnerService {
       const waitedMs = await options.clearBlocker()
       deadline += waitedMs
       const page = getPage()
-      const answerCount = await countVisibleAnswers(page, options.answerSelectors)
-      const busy = await hasVisibleBusyIndicator(page, options.busySelectors)
-      if (answerCount > options.baseline && !busy) return
+      if ((await options.provider.observeAction(page, options.action, options.preparation)).state === 'ready') return
       await delay(Math.min(options.pollMs, Math.max(1, deadline - Date.now())), options.signal)
     }
     throw tokenlessError('playwright_response_timeout', 'Timed out waiting for a new visible provider response.', { retryable: true })
   }
 }
 
+async function chromiumTargetId(browserContext: BrowserContext, page: Page) {
+  const session = await browserContext.newCDPSession(page)
+  try {
+    const result = await session.send('Target.getTargetInfo')
+    return result.targetInfo.targetId
+  } finally {
+    await session.detach().catch(() => undefined)
+  }
+}
+
+async function waitForChromiumTargetPages(
+  browserContext: BrowserContext,
+  targetIds: ReadonlySet<string>,
+  timeoutMs: number,
+) {
+  const pagesByTargetId = new Map<string, Page>()
+  const inspectedPages = new Set<Page>()
+  const deadline = Date.now() + timeoutMs
+  while (pagesByTargetId.size < targetIds.size && Date.now() <= deadline) {
+    for (const page of browserContext.pages()) {
+      if (page.isClosed() || inspectedPages.has(page)) continue
+      try {
+        const targetId = await chromiumTargetId(browserContext, page)
+        inspectedPages.add(page)
+        if (targetIds.has(targetId)) pagesByTargetId.set(targetId, page)
+      } catch {
+        if (page.isClosed()) inspectedPages.add(page)
+      }
+    }
+    if (pagesByTargetId.size < targetIds.size) {
+      await delay(Math.min(25, Math.max(1, deadline - Date.now())))
+    }
+  }
+  return pagesByTargetId
+}
+
 export function serializeRunnerError(error: unknown) {
   const response = errorResponse(error)
   return {
     code: response.code,
     message: response.message,
     retryable: response.retryable,
+    ...(response.details === undefined ? {} : { details: response.details }),
   }
 }
 
+export function isManagedPlaywrightClaimRecoveryFailure(error: unknown) {
+  return isClaimRecoveryError(error)
+}
+
 class ParkedPlaywrightJob extends Error {
   constructor() {
     super('Managed Playwright job parked waiting for user.')
   }
 }
 
+class QueuedProviderFallback extends Error {
+  constructor() {
+    super('Managed Playwright job queued a provider fallback attempt.')
+    this.name = 'QueuedProviderFallback'
+  }
+}
+
+class DeferredProviderCapacity extends Error {
+  constructor() {
+    super('Managed Playwright job deferred until provider capacity is available.')
+    this.name = 'DeferredProviderCapacity'
+  }
+}
+
+function throwRunnerControlFlow(error: unknown): void {
+  if (
+    error instanceof ParkedPlaywrightJob ||
+    error instanceof QueuedProviderFallback ||
+    error instanceof DeferredProviderCapacity
+  ) {
+    throw error
+  }
+}
+
+function initialExecutionState(): RunnerExecutionState {
+  return { actionCursor: 0, responses: [], preparation: null, submitted: null }
+}
+
+function providerCapacityFailure(projection: ProviderCapacityProjection): ClassifiedProviderFailure {
+  return Object.freeze({
+    classification: 'safe_pre_submit_provider_failure',
+    code: 'provider_capacity_deferred',
+    message: projection.reason,
+    retryable: true,
+    providerScoped: true,
+    automaticFallbackEligible: true,
+    details: projection,
+  })
+}
+
+function rateLimitSubscription(profile: ManagedBrowserProfile, provider: string) {
+  const observed = profile.lastObservedAuth?.[provider]
+  return {
+    accessClass: observed?.account?.tier.class ?? observed?.access ?? 'unknown',
+    tierLabel: observed?.account?.tier.label ?? null,
+    subscriptionLabel: observed?.account?.subscription ?? null,
+  }
+}
+
+function checkpointIndicatesSubmission(value: unknown) {
+  if (!isPlainRecord(value)) return false
+  if (value.submitted !== null && value.submitted !== undefined) return true
+  const phase = isPlainRecord(value.phase) ? value.phase : null
+  return phase?.state === 'started' && phase.mutating === true
+}
+
+function observedCapacityDelaySeconds(blocker: VisibleBlocker) {
+  if (blocker.family === 'rate_limit') {
+    return blocker.retryAfterSeconds === undefined
+      ? 300
+      : Math.min(3_600, Math.max(60, Math.floor(blocker.retryAfterSeconds)))
+  }
+  if (blocker.family === 'plan_limit') return 3_600
+  return null
+}
+
+function safeFallbackRequest(
+  request: ManagedPlaywrightJobRequest,
+  state: RunnerExecutionState,
+  failure: ClassifiedProviderFailure,
+): ManagedPlaywrightJobRequest | null {
+  const plan = request.fallback
+  const alternative = plan?.alternatives[0]
+  if (!plan || !alternative || !failure.automaticFallbackEligible || state.submitted !== null) return null
+  for (let index = 0; index < state.actionCursor; index += 1) {
+    const action = request.actions[index]
+    if (!action) return null
+    const lifecycle = getVisibleActionLifecycle(action.action)
+    if (lifecycle.mutating && !lifecycle.reconstructablePreSubmit) return null
+  }
+  const remaining = plan.alternatives.slice(1)
+  return validateManagedPlaywrightJobRequest({
+    protocol: request.protocol,
+    provider: alternative.provider,
+    target: alternative.target,
+    taskId: request.taskId,
+    capabilityRoute: alternative.capabilityRoute,
+    fallback: remaining.length === 0 ? null : { ...plan, alternatives: remaining },
+    context: request.context,
+    browserVisibility: request.browserVisibility,
+    ...(request.pagePolicy === undefined ? {} : { pagePolicy: request.pagePolicy }),
+    actions: request.actions.map((action) => ({ ...action, provider: alternative.provider })),
+  })
+}
+
+function providerFallbackStopReason(
+  request: ManagedPlaywrightJobRequest,
+  state: RunnerExecutionState,
+  failure: ClassifiedProviderFailure,
+) {
+  if (!request.fallback) return { code: 'fallback_plan_unavailable' }
+  if (request.fallback.alternatives.length === 0) return { code: 'fallback_alternatives_exhausted' }
+  if (state.submitted !== null) {
+    return {
+      code: 'post_submission_failure',
+      provider: request.provider,
+      submittedAction: state.submitted.requestId,
+    }
+  }
+  if (!failure.automaticFallbackEligible) {
+    return { code: 'unsafe_failure_classification', classification: failure.classification }
+  }
+  for (let index = 0; index < state.actionCursor; index += 1) {
+    const action = request.actions[index]
+    if (!action) return { code: 'invalid_action_cursor' }
+    const lifecycle = getVisibleActionLifecycle(action.action)
+    if (lifecycle.mutating && !lifecycle.reconstructablePreSubmit) {
+      const response = state.responses[index]
+      return {
+        code: 'non_reconstructable_provider_mutation',
+        provider: request.provider,
+        action: action.action,
+        requestId: action.requestId,
+        completedResult: response?.ok === true ? response.result : null,
+      }
+    }
+  }
+  return { code: 'fallback_not_selected' }
+}
+
+function classifiedFailureError(
+  failure: ClassifiedProviderFailure,
+  fallbackStopped: ReturnType<typeof providerFallbackStopReason>,
+) {
+  return tokenlessError(failure.code, failure.message, {
+    retryable: failure.retryable,
+    details: {
+      classification: failure.classification,
+      providerScoped: failure.providerScoped,
+      fallbackStopped,
+      ...(failure.details === undefined ? {} : { causeDetails: failure.details }),
+    },
+  })
+}
+
+async function inspectAttemptCapabilityEligibility(
+  page: Page,
+  provider: RunnerProvider,
+  route: TaskCapabilityRoute,
+): Promise<ClassifiedProviderFailure | null> {
+  const inspection = await provider.inspectCapabilities(page)
+  const observations = route.requirements.map((capability) => {
+    const target = liveInspectionTarget(capability)
+    if (!target) {
+      return {
+        capability,
+        availability: 'unavailable' as const,
+        visibleProof: null,
+        reason: 'task_capability_live_inspection_unimplemented',
+      }
+    }
+    const providerInspection = inspection.capabilities[target.providerCapability]
+    const observed = target.scope === 'native' ? providerInspection?.native : providerInspection
+    return {
+      capability,
+      availability: observed?.availability ?? 'unknown',
+      visibleProof: observed?.visibleProof ?? null,
+      reason: observed?.reason ?? null,
+    }
+  })
+  const unavailable = observations.filter((observation) => observation.availability === 'unavailable')
+  if (unavailable.length === 0) return null
+  return classifyProviderFailure({
+    error: tokenlessError(
+      'provider_capability_unavailable',
+      `Provider '${provider.id}' cannot currently satisfy every required task capability.`,
+      {
+        retryable: true,
+        details: {
+          provider: provider.id,
+          requirements: route.requirements,
+          unavailable,
+          observations,
+        },
+      },
+    ),
+    submitted: false,
+  })
+}
+
+function liveInspectionTarget(capability: TaskCapabilityId): {
+  providerCapability: ProviderCapabilityId
+  scope: 'overall' | 'native'
+} | null {
+  if (capability === TASK_CAPABILITIES.CONVERSATION_CHAT) {
+    return { providerCapability: PROVIDER_CAPABILITIES.CONVERSATION_CONTINUE, scope: 'overall' }
+  }
+  if (capability === TASK_CAPABILITIES.FILE_UPLOAD) {
+    return { providerCapability: PROVIDER_CAPABILITIES.FILE_UPLOAD, scope: 'overall' }
+  }
+  if (capability === TASK_CAPABILITIES.WORKSPACE_NATIVE) {
+    return { providerCapability: PROVIDER_CAPABILITIES.WORKSPACE_ENSURE, scope: 'native' }
+  }
+  return null
+}
+
 function validateResumeVisibility(value: unknown): Extract<BrowserVisibility, 'headed'> | null {
   if (value === null || value === undefined) return null
   if (!isPlainRecord(value) || value.browser_visibility !== 'headed') {
@@ -718,9 +1477,15 @@ function validateRunnerCheckpoint(
   request: ManagedPlaywrightJobRequest
 ): RunnerCheckpoint | null {
   if (value === null || value === undefined) return null
-  if (!isPlainRecord(value) || value.protocol !== RUNNER_CHECKPOINT_PROTOCOL) {
+  if (!isPlainRecord(value) || value.protocol !== RUNNER_CHECKPOINT_SCHEMA_ID) {
     throw tokenlessError('invalid_playwright_runner_checkpoint', 'Managed Playwright runner checkpoint is invalid.')
   }
+  const expectedKeys = ['protocol', 'jobId', 'profileId', 'provider', 'targetUrl', 'browserVisibility', 'actionCursor', 'responses', 'preparation', 'submitted', 'phase']
+  if (!hasExactKeys(value, expectedKeys)) {
+    throw tokenlessError('invalid_playwright_runner_checkpoint', 'Managed Playwright runner checkpoint fields are invalid.')
+  }
+  const provider = getProviderInstanceById(request.provider)
+  if (!provider) throw tokenlessError('unknown_playwright_job_provider', 'Managed Playwright job provider is not supported.')
   const rawActionCursor = value.actionCursor
   if (typeof rawActionCursor !== 'number' || !Number.isInteger(rawActionCursor) || rawActionCursor < 0 || rawActionCursor > request.actions.length) {
     throw tokenlessError('invalid_playwright_runner_checkpoint', 'Managed Playwright runner checkpoint cursor is invalid.')
@@ -739,12 +1504,8 @@ function validateRunnerCheckpoint(
     throw tokenlessError('invalid_playwright_runner_checkpoint', 'Managed Playwright runner checkpoint responses are invalid.')
   }
   const responses = value.responses.map((response, index) => validateCheckpointResponse(response, request.actions[index], index))
-  const rawResponseBaseline = value.responseBaseline
-  if (rawResponseBaseline !== null && (typeof rawResponseBaseline !== 'number' || !Number.isInteger(rawResponseBaseline) || rawResponseBaseline < 0)) {
-    throw tokenlessError('invalid_playwright_runner_checkpoint', 'Managed Playwright runner checkpoint response baseline is invalid.')
-  }
-  const responseBaseline = rawResponseBaseline as number | null
-  const submitted = validateSubmittedCheckpoint(value.submitted, request)
+  const preparation = validateCheckpointPreparation(value.preparation, provider)
+  const submitted = validateSubmittedCheckpoint(value.submitted, request, provider)
   const phase = validateCheckpointPhase(value.phase, request)
   if (phase.state === 'started' && phase.mutating) {
     throw tokenlessError(
@@ -766,7 +1527,7 @@ function validateRunnerCheckpoint(
     )
   }
   return {
-    protocol: RUNNER_CHECKPOINT_PROTOCOL,
+    protocol: RUNNER_CHECKPOINT_SCHEMA_ID,
     jobId: job.job_id,
     profileId: profile.id,
     provider: request.provider,
@@ -774,7 +1535,7 @@ function validateRunnerCheckpoint(
     browserVisibility: request.browserVisibility,
     actionCursor,
     responses,
-    responseBaseline,
+    preparation,
     submitted,
     phase,
   }
@@ -785,7 +1546,12 @@ function validateCheckpointResponse(
   action: VisibleActionRequest | undefined,
   index: number
 ): VisibleActionResponse {
-  if (!action || !isPlainRecord(value) || value.protocol !== VISIBLE_ACTION_PROTOCOL_VERSION || value.ok !== true) {
+  if (
+    !action ||
+    !isPlainRecord(value) ||
+    !isVisibleActionProtocolVersion(value.protocol) ||
+    value.ok !== true
+  ) {
     throw tokenlessError('invalid_playwright_runner_checkpoint', 'Managed Playwright runner checkpoint response is invalid.')
   }
   if (value.requestId !== action.requestId || value.provider !== action.provider || value.action !== action.action || value.error !== null) {
@@ -797,11 +1563,18 @@ function validateCheckpointResponse(
   return value as VisibleActionResponse
 }
 
-function validateSubmittedCheckpoint(value: unknown, request: ManagedPlaywrightJobRequest): RunnerSubmittedActionCheckpoint | null {
+function validateSubmittedCheckpoint(
+  value: unknown,
+  request: ManagedPlaywrightJobRequest,
+  provider: RunnerProvider
+): RunnerSubmittedActionCheckpoint | null {
   if (value === null) return null
   if (!isPlainRecord(value)) {
     throw tokenlessError('invalid_playwright_runner_checkpoint', 'Managed Playwright runner submit checkpoint is invalid.')
   }
+  if (!hasExactKeys(value, ['actionIndex', 'requestId', 'providerUrl', 'preparation'])) {
+    throw tokenlessError('invalid_playwright_runner_checkpoint', 'Managed Playwright runner submit checkpoint fields are invalid.')
+  }
   const rawActionIndex = value.actionIndex
   const actionIndex = typeof rawActionIndex === 'number' && Number.isInteger(rawActionIndex) ? rawActionIndex : -1
   const action = request.actions[actionIndex]
@@ -811,19 +1584,25 @@ function validateSubmittedCheckpoint(value: unknown, request: ManagedPlaywrightJ
   if (typeof value.providerUrl !== 'string') {
     throw tokenlessError('invalid_playwright_runner_checkpoint', 'Managed Playwright runner submit checkpoint URL is invalid.')
   }
-  const provider = getProviderById(request.provider)
-  if (!provider) throw tokenlessError('unknown_playwright_job_provider', 'Managed Playwright job provider is not supported.')
   const providerUrl = validateProviderUrl(value.providerUrl, provider)
-  const rawResponseBaseline = value.responseBaseline
-  if (typeof rawResponseBaseline !== 'number' || !Number.isInteger(rawResponseBaseline) || rawResponseBaseline < 0) {
-    throw tokenlessError('invalid_playwright_runner_checkpoint', 'Managed Playwright runner submit checkpoint baseline is invalid.')
+  const preparation = validateCheckpointPreparation(value.preparation, provider)
+  if (!preparation) {
+    throw tokenlessError('invalid_playwright_runner_checkpoint', 'Managed Playwright runner submit checkpoint preparation is invalid.')
   }
-  const responseBaseline = rawResponseBaseline as number
   return {
     actionIndex,
     requestId: action.requestId,
     providerUrl,
-    responseBaseline,
+    preparation,
+  }
+}
+
+function validateCheckpointPreparation(value: unknown, provider: RunnerProvider): ProviderActionPreparation | null {
+  if (value === null) return null
+  try {
+    return provider.validatePreparation(value as ProviderActionPreparation, { action: VISIBLE_ACTIONS.RESPONSE_READ })
+  } catch {
+    throw tokenlessError('invalid_playwright_runner_checkpoint', 'Managed Playwright runner checkpoint preparation is invalid.')
   }
 }
 
@@ -859,13 +1638,13 @@ function executionStateFromCheckpoint(checkpoint: RunnerCheckpoint | null): Runn
     ? {
       actionCursor: checkpoint.actionCursor,
       responses: [...checkpoint.responses],
-      responseBaseline: checkpoint.submitted ? checkpoint.submitted.responseBaseline : checkpoint.responseBaseline,
+      preparation: checkpoint.submitted ? checkpoint.submitted.preparation : checkpoint.preparation,
       submitted: checkpoint.submitted,
     }
     : {
       actionCursor: 0,
       responses: [],
-      responseBaseline: null,
+      preparation: null,
       submitted: null,
     }
 }
@@ -878,7 +1657,7 @@ function buildRunnerCheckpoint(
   phase: RunnerCheckpointPhase
 ): RunnerCheckpoint {
   return {
-    protocol: RUNNER_CHECKPOINT_PROTOCOL,
+    protocol: RUNNER_CHECKPOINT_SCHEMA_ID,
     jobId: job.job_id,
     profileId: profile.id,
     provider: request.provider,
@@ -886,7 +1665,7 @@ function buildRunnerCheckpoint(
     browserVisibility: request.browserVisibility,
     actionCursor: state.actionCursor,
     responses: state.responses,
-    responseBaseline: state.responseBaseline,
+    preparation: state.preparation,
     submitted: state.submitted,
     phase,
   }
@@ -897,14 +1676,14 @@ function checkpointPhaseForAction(
   actionIndex: number,
   action: VisibleActionRequest,
   page: Page,
-  provider: NonNullable<ReturnType<typeof getProviderById>>
+  provider: RunnerProvider
 ): RunnerCheckpointPhase {
   return {
     state,
     actionIndex,
     requestId: action.requestId,
     action: action.action,
-    mutating: MUTATING_ACTIONS.has(action.action),
+    mutating: getVisibleActionLifecycle(action.action).mutating,
     providerUrl: maybeProviderUrl(page, provider),
   }
 }
@@ -912,9 +1691,9 @@ function checkpointPhaseForAction(
 async function reconstructCompletedPreSubmitActions(
   page: Page,
   options: {
+    provider: RunnerProvider
     request: ManagedPlaywrightJobRequest
     actionCursor: number
-    adapterRegistry: ProviderAdapterRegistry
     profile: ManagedBrowserProfile
     job: DaemonClaimedJob
     attachmentRoot: string | undefined
@@ -932,8 +1711,8 @@ async function reconstructCompletedPreSubmitActions(
         { retryable: false }
       )
     }
-    if (!RECONSTRUCTABLE_PRE_SUBMIT_ACTIONS.has(action.action)) continue
-    const response = await options.adapterRegistry.execute(page, action, {
+    if (!getVisibleActionLifecycle(action.action).reconstructablePreSubmit) continue
+    const response = await options.provider.executeAction(page, action, {
       profileId: options.profile.id,
       operationId: options.job.job_id,
       signal: options.signal,
@@ -948,16 +1727,14 @@ async function reconstructCompletedPreSubmitActions(
 
 function trustedSwitchUrl(
   page: Page,
-  provider: NonNullable<ReturnType<typeof getProviderById>>,
+  provider: RunnerProvider,
   fallbackUrl: string
 ) {
   const pageUrl = currentPageUrl(page)
   if (!pageUrl) return validateProviderUrl(fallbackUrl, provider)
-  const parsed = safeUrl(pageUrl)
-  if (parsed && isProviderApprovedUrl(parsed, provider) && isSafeHttpsNavigationUrl(parsed)) {
-    return parsed.toString()
-  }
-  if (trustedProviderSignInNavigation(provider, pageUrl)) {
+  const classification = provider.navigation.classify(pageUrl)
+  if (classification.kind === 'approved') return classification.target.href
+  if (classification.kind === 'trusted_sign_in') {
     return validateProviderUrl(fallbackUrl, provider)
   }
   throw tokenlessError('unsupported_provider_navigation', 'Cannot resume managed Playwright job from an unsafe provider URL.', { retryable: false })
@@ -965,32 +1742,26 @@ function trustedSwitchUrl(
 
 function validatedCurrentProviderUrl(
   page: Page,
-  provider: NonNullable<ReturnType<typeof getProviderById>>,
+  provider: RunnerProvider,
   fallbackUrl: string
 ) {
   const providerUrl = maybeProviderUrl(page, provider)
   return providerUrl ?? validateProviderUrl(fallbackUrl, provider)
 }
 
-function maybeProviderUrl(page: Page, provider: NonNullable<ReturnType<typeof getProviderById>>) {
+function maybeProviderUrl(page: Page, provider: RunnerProvider) {
   const pageUrl = currentPageUrl(page)
   if (!pageUrl) return null
-  const parsed = safeUrl(pageUrl)
-  return parsed && isProviderApprovedUrl(parsed, provider) && isSafeHttpsNavigationUrl(parsed)
-    ? parsed.toString()
-    : null
+  const classification = provider.navigation.classify(pageUrl)
+  return classification.kind === 'approved' ? classification.target.href : null
 }
 
-function validateProviderUrl(value: string, provider: NonNullable<ReturnType<typeof getProviderById>>) {
-  const parsed = safeUrl(value)
-  if (!parsed || !isProviderApprovedUrl(parsed, provider) || !isSafeHttpsNavigationUrl(parsed)) {
+function validateProviderUrl(value: string, provider: RunnerProvider) {
+  const target = provider.navigation.canonicalTarget(value)
+  if (!target) {
     throw tokenlessError('invalid_playwright_runner_checkpoint', 'Managed Playwright runner checkpoint URL is not a trusted provider URL.')
   }
-  return parsed.toString()
-}
-
-function isSafeHttpsNavigationUrl(url: URL) {
-  return url.protocol === 'https:' && !url.username && !url.password
+  return target.href
 }
 
 async function bringToFront(page: Page) {
@@ -1007,13 +1778,57 @@ async function navigateToTarget(page: unknown, url: string, signal: AbortSignal,
     bringToFront?: () => Promise<unknown>
   }
   if (typeof maybePage.goto === 'function') {
-    await maybePage.goto(url, { waitUntil: 'domcontentloaded' })
+    try {
+      await maybePage.goto(url, { waitUntil: 'domcontentloaded' })
+    } catch (error) {
+      if (signal.aborted) throwIfStopped(signal, () => false)
+      if (String(error).includes('net::ERR_NAME_NOT_RESOLVED')) {
+        throw tokenlessError(
+          'provider_dns_unavailable',
+          'The provider hostname could not be resolved by the current system DNS configuration.',
+          {
+            retryable: true,
+            cause: error,
+            details: dnsUnavailableDetails(url),
+          }
+        )
+      }
+      throw tokenlessError(
+        'provider_navigation_unavailable',
+        'The provider page could not be reached before any provider action started.',
+        {
+          retryable: true,
+          cause: error,
+          details: { url: new URL(url).origin, evidence: 'chromium_navigation_failed' },
+        },
+      )
+    }
   }
   if (foreground && typeof maybePage.bringToFront === 'function') {
     await maybePage.bringToFront()
   }
 }
 
+function dnsUnavailableDetails(url: string) {
+  const hostname = new URL(url).hostname
+  if (hostname === 'chat.qwen.ai') {
+    return {
+      hostname,
+      networkFailure: 'dns_resolution',
+      accessClassification: 'suspected_rate_limit',
+      rateLimitConfirmed: false,
+      evidence: 'chromium_name_not_resolved',
+    }
+  }
+  return {
+    hostname,
+    networkFailure: 'dns_resolution',
+    accessClassification: 'network_unavailable',
+    rateLimitConfirmed: false,
+    evidence: 'chromium_name_not_resolved',
+  }
+}
+
 function throwIfStopped(signal: AbortSignal, isCanceled: () => boolean, renewalError?: () => unknown) {
   const renewError = renewalError?.()
   if (renewError) throw renewError
@@ -1053,10 +1868,15 @@ function assertSafeJobId(jobId: string) {
   }
 }
 
-async function visibleBlockerState(page: Page, provider: NonNullable<ReturnType<typeof getProviderById>>) {
+async function visibleBlockerState(
+  page: Page,
+  provider: RunnerProvider,
+  waitForGuestSurface: boolean,
+  submissionRecorded: boolean,
+) {
   const pageUrl = currentPageUrl(page)
-  const parsedUrl = safeUrl(pageUrl)
-  const navigationBlocker = blockerFromNavigationUrl(parsedUrl, provider)
+  const classification = provider.navigation.classify(pageUrl)
+  const navigationBlocker = blockerFromNavigationClassification(classification, provider)
   if (navigationBlocker) {
     return {
       blocked: true,
@@ -1065,7 +1885,7 @@ async function visibleBlockerState(page: Page, provider: NonNullable<ReturnType<
       blockers: [navigationBlocker],
     }
   }
-  if (!parsedUrl || !isProviderApprovedUrl(parsedUrl, provider) || typeof (page as { evaluate?: unknown }).evaluate !== 'function') {
+  if (classification.kind !== 'approved' || typeof (page as { evaluate?: unknown }).evaluate !== 'function') {
     return {
       blocked: false,
       terminal: false,
@@ -1073,36 +1893,46 @@ async function visibleBlockerState(page: Page, provider: NonNullable<ReturnType<
       blockers: [],
     }
   }
-  const result = await inspectVisibleBlockers(page, provider)
-  const terminal = result.blockers.find((blocker) => blocker.kind === 'terminal')
-  const userResolvable = result.blockers.find((blocker) => blocker.userResolvable)
+  if (submissionRecorded) {
+    const inspection = await provider.inspectBlockers(page)
+    const terminal = inspection.blockers.find((blocker) => blocker.kind === 'terminal')
+    const userResolvable = inspection.blockers.find((blocker) => blocker.kind !== 'terminal')
+    return {
+      blocked: inspection.blocked,
+      terminal: Boolean(terminal),
+      primary: terminal ?? userResolvable ?? inspection.blockers[0] ?? fallbackBlocker(page, provider),
+      blockers: inspection.blockers,
+    }
+  }
+  const resolution = await provider.resolveSession(page, {
+    waitForReadyMs: waitForGuestSurface ? 15_000 : 0,
+  })
+  const decision = resolution.decision
+  const blockers = decision.kind === 'handoff' || decision.kind === 'terminal'
+    ? [decision.blocker]
+    : []
+  const terminal = decision.kind === 'terminal' ? decision.blocker : undefined
+  const userResolvable = decision.kind === 'handoff' ? decision.blocker : undefined
   return {
     blocked: Boolean(userResolvable || terminal),
     terminal: Boolean(terminal),
-    primary: terminal ?? userResolvable ?? result.blockers[0] ?? fallbackBlocker(page, provider),
-    blockers: result.blockers,
+    primary: terminal ?? userResolvable ?? blockers[0] ?? fallbackBlocker(page, provider),
+    blockers,
   }
 }
 
 async function hasStableComposer(
   page: Page,
-  provider: NonNullable<ReturnType<typeof getProviderById>>,
+  provider: RunnerProvider,
   pollMs: number,
   signal: AbortSignal,
   isCanceled: () => boolean,
   renewalError: () => unknown
 ) {
-  if (!await anyVisibleComposer(page, provider)) return false
+  if (!await provider.hasVisibleComposer(page)) return false
   await delay(Math.min(Math.max(pollMs, 50), 500), signal)
   throwIfStopped(signal, isCanceled, renewalError)
-  return await anyVisibleComposer(page, provider)
-}
-
-async function anyVisibleComposer(page: Page, provider: NonNullable<ReturnType<typeof getProviderById>>) {
-  for (const selector of provider.composerSelectors) {
-    if (await page.locator(selector).first().isVisible({ timeout: 100 }).catch(() => false)) return true
-  }
-  return false
+  return await provider.hasVisibleComposer(page)
 }
 
 function blockerPayload(
@@ -1116,7 +1946,7 @@ function blockerPayload(
 ) {
   const primary = blockers.find((blocker) => blocker.userResolvable) ?? blockers[0] ?? null
   return {
-    protocol: 'tokenless.playwright.user-handover.v1',
+    protocol: USER_HANDOVER_SCHEMA_ID,
     jobId: job.job_id,
     taskId: taskIdFromRequest(job.request_json),
     provider: job.provider,
@@ -1126,8 +1956,38 @@ function blockerPayload(
     blockers,
     userAction: {
       message: browser.windowOpen
-        ? 'The visible managed browser is open. Manually complete the provider verification or sign-in there; Tokenless will resume the same unfinished action after the composer is stable.'
-        : 'The managed browser is parked without opening a window. Resume this job in headed mode after you are ready to complete provider verification.',
+        ? 'Your help is needed: complete provider sign-in or verification in the visible browser. Tokenless will resume the same unfinished action after the composer is stable.'
+        : 'Your help is needed, but no browser window is open. Resume this same job in headed mode to complete provider verification.',
+    },
+  }
+}
+
+function providerFailurePayload(
+  job: DaemonClaimedJob,
+  failure: ClassifiedProviderFailure,
+  browser: {
+    requestedVisibility: BrowserVisibility
+    effectiveVisibility: Exclude<BrowserVisibility, 'auto'>
+    windowOpen: boolean
+  },
+) {
+  return {
+    protocol: 'tokenless.provider-attempt-failure.v1',
+    jobId: job.job_id,
+    taskId: taskIdFromRequest(job.request_json),
+    provider: job.provider,
+    profileId: job.profile_id,
+    browser,
+    failure,
+    blocker: {
+      kind: 'terminal',
+      code: failure.code,
+      message: failure.message,
+      userResolvable: false,
+      retryable: failure.retryable,
+      visibleProof: 'structured-provider-attempt-failure',
+      provider: job.provider,
+      url: null,
     },
   }
 }
@@ -1138,24 +1998,41 @@ function taskIdFromRequest(value: unknown) {
   return typeof record.taskId === 'string' ? record.taskId : null
 }
 
-function fallbackBlocker(page: Page, provider: NonNullable<ReturnType<typeof getProviderById>>): VisibleBlocker {
+function managedPageKey(job: DaemonClaimedJob, request: ManagedPlaywrightJobRequest) {
+  return JSON.stringify([
+    request.provider,
+    request.taskId === null ? 'job' : 'task',
+    request.taskId ?? job.job_id,
+  ])
+}
+
+function providerOwnsPage(
+  provider: NonNullable<ReturnType<typeof getProviderInstanceById>>,
+  page: Page,
+) {
+  const classification = provider.navigation.classify(page.url())
+  return classification.kind === 'approved' || classification.kind === 'trusted_sign_in'
+}
+
+function fallbackBlocker(page: Page, provider: RunnerProvider): VisibleBlocker {
   const pageUrl = currentPageUrl(page)
   return {
     kind: 'auth',
     code: 'provider_user_handover_required',
-    message: 'Provider page requires user handover.',
+    message: 'Provider sign-in or verification requires user support.',
     userResolvable: true,
     retryable: true,
     visibleProof: 'visible-page-state',
     provider: provider.id,
-    url: sanitizeBlockerOrigin(pageUrl),
+    url: sanitizedNavigationOrigin(provider, pageUrl),
   }
 }
 
-function blockerFromNavigationUrl(url: URL | null, provider: NonNullable<ReturnType<typeof getProviderById>>): VisibleBlocker | null {
-  if (!url || isProviderApprovedUrl(url, provider)) return null
-  const signInNavigation = trustedProviderSignInNavigation(provider, url.toString())
-  if (!signInNavigation) return null
+function blockerFromNavigationClassification(
+  classification: ReturnType<RunnerProvider['navigation']['classify']>,
+  provider: RunnerProvider
+): VisibleBlocker | null {
+  if (classification.kind !== 'trusted_sign_in') return null
   return {
     kind: 'auth',
     code: 'provider_sign_in_navigation',
@@ -1164,16 +2041,11 @@ function blockerFromNavigationUrl(url: URL | null, provider: NonNullable<ReturnT
     retryable: true,
     visibleProof: 'visible-provider-sign-in-navigation',
     provider: provider.id,
-    url: signInNavigation.origin,
+    url: classification.origin,
     family: 'provider_sign_in',
   }
 }
 
-function isProviderApprovedUrl(url: URL, provider: NonNullable<ReturnType<typeof getProviderById>>) {
-  const host = url.hostname.toLowerCase()
-  return provider.hosts.some((allowedHost) => host === allowedHost)
-}
-
 function currentPageUrl(page: Page) {
   try {
     return typeof (page as { url?: unknown }).url === 'function'
@@ -1184,44 +2056,55 @@ function currentPageUrl(page: Page) {
   }
 }
 
-function safeUrl(value: string) {
-  try {
-    return new URL(value)
-  } catch {
-    return null
+function sanitizedNavigationOrigin(provider: RunnerProvider, value: string) {
+  const classification = provider.navigation.classify(value)
+  if (classification.kind === 'approved') return classification.target.origin
+  if (classification.kind === 'trusted_sign_in') return classification.origin
+  return ''
+}
+
+function isNativeWorkspaceResult(value: unknown): value is NativeWorkspaceEnsureResult {
+  if (!isPlainRecord(value) || value.mode !== 'native') return false
+  const resource = isPlainRecord(value.resource) ? value.resource : null
+  return resource?.kind === 'project' &&
+    resource.native === true &&
+    typeof resource.id === 'string' &&
+    typeof resource.canonicalUrl === 'string' &&
+    (resource.disposition === 'created' || resource.disposition === 'reused')
+}
+
+function latestNativeWorkspaceResult(responses: readonly VisibleActionResponse[]) {
+  for (let index = responses.length - 1; index >= 0; index -= 1) {
+    const response = responses[index]
+    if (response?.ok && response.action === VISIBLE_ACTIONS.WORKSPACE_ENSURE && isNativeWorkspaceResult(response.result)) {
+      return response.result
+    }
   }
+  return null
 }
 
-function sanitizeBlockerOrigin(value: string) {
-  const url = safeUrl(value)
-  return url?.origin ?? ''
+function validatedConversationUrl(
+  value: string,
+  provider: RunnerProvider,
+  projectUrl: string,
+) {
+  const target = provider.navigation.assertCurrentPageAllowed(value)
+  if (!target) return null
+  const canonical = new URL(target.href)
+  canonical.search = ''
+  canonical.hash = ''
+  const href = canonical.toString()
+  return href === projectUrl ? null : href
 }
 
 function isPlainRecord(value: unknown): value is Record<string, unknown> {
   return Boolean(value && typeof value === 'object' && !Array.isArray(value))
 }
 
-async function countVisibleAnswers(page: Page, selectors: readonly string[]) {
-  let total = 0
-  for (const selector of selectors) {
-    const locator = page.locator(selector)
-    const count = await locator.count()
-    for (let index = 0; index < count; index += 1) {
-      if (await locator.nth(index).isVisible({ timeout: 50 }).catch(() => false)) total += 1
-    }
-  }
-  return total
-}
-
-async function hasVisibleBusyIndicator(page: Page, selectors: readonly string[]) {
-  for (const selector of selectors) {
-    const locator = page.locator(selector)
-    const count = await locator.count()
-    for (let index = 0; index < count; index += 1) {
-      if (await locator.nth(index).isVisible({ timeout: 50 }).catch(() => false)) return true
-    }
-  }
-  return false
+function hasExactKeys(input: Record<string, unknown>, keys: readonly string[]) {
+  const actual = Object.keys(input).sort()
+  const expected = [...keys].sort()
+  return actual.length === expected.length && actual.every((key, index) => key === expected[index])
 }
 
 function normalizedPositiveInteger(value: number | undefined, fallback: number) {
diff --git a/packages/cli/src/playwright/runner-supervisor.ts b/packages/cli/src/playwright/runner-supervisor.ts
deleted file mode 100644
index 85d8845..0000000
--- a/packages/cli/src/playwright/runner-supervisor.ts
+++ /dev/null
@@ -1,608 +0,0 @@
-import childProcess from 'node:child_process'
-import { randomUUID } from 'node:crypto'
-import fsSync, { constants as fsConstants } from 'node:fs'
-import fs from 'node:fs/promises'
-import os from 'node:os'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { tokenlessError } from './errors.js'
-import { withPrivateSqliteWriterLock } from './profiles/sqlite-lock.js'
-
-export type RunnerSupervisorState = 'running' | 'stopped' | 'stale' | 'unsafe'
-
-export type RunnerSupervisorStatus = {
-  state: RunnerSupervisorState
-  pid: number | null
-  sessionId: string | null
-  safeToStop: boolean
-  heartbeatAt: string | null
-}
-
-export type RunnerSupervisorStartResult = RunnerSupervisorStatus & {
-  started: boolean
-}
-
-export type RunnerSupervisorOptions = {
-  homeDir?: string | undefined
-  daemonUrl?: string | undefined
-  nodePath?: string | undefined
-  entryPath?: string | undefined
-  spawnDetached?: SpawnDetached | undefined
-  isProcessAlive?: ((pid: number) => boolean | Promise<boolean>) | undefined
-  killProcess?: ((pid: number, signal: NodeJS.Signals) => void | Promise<void>) | undefined
-  sessionId?: string | undefined
-  heartbeatTimeoutMs?: number | undefined
-  now?: (() => Date) | undefined
-  browser?: string | undefined
-  browserExecutablePath?: string | undefined
-}
-
-type SpawnDetached = (command: string, args: readonly string[], options: {
-  cwd: string
-  env: NodeJS.ProcessEnv
-  logFile: string
-}) => Promise<{ pid: number }>
-
-type SupervisorSession = {
-  protocol: 'tokenless.playwright.runner-session.v1'
-  sessionId: string
-  pid: number
-  startedAt: string
-  browser?: string | undefined
-  browserExecutablePath?: string | undefined
-}
-
-type SupervisorHeartbeat = {
-  protocol: 'tokenless.playwright.runner-heartbeat.v1'
-  sessionId: string
-  pid: number
-  updatedAt: string
-}
-
-const RUNNER_DIR = 'playwright-runner'
-const PID_FILE = 'pid.json'
-const SESSION_FILE = 'session.json'
-const HEARTBEAT_FILE = 'heartbeat.json'
-const LOG_FILE = 'runner.log'
-const WRITER_LOCK_FILE = 'runner.writer.sqlite'
-export const RUNNER_HEARTBEAT_INTERVAL_MS = 2_000
-export const RUNNER_HEARTBEAT_FRESHNESS_MS = 15_000
-
-export async function startRunnerSupervisor(options: RunnerSupervisorOptions): Promise<RunnerSupervisorStartResult> {
-  const markers = await ensureRunnerMarkersDir(options.homeDir)
-  return await withPrivateSqliteWriterLock(markers.writerLockFile, async () => {
-    return await startRunnerSupervisorUnlocked(options, markers)
-  })
-}
-
-async function startRunnerSupervisorUnlocked(
-  options: RunnerSupervisorOptions,
-  markers: Awaited<ReturnType<typeof ensureRunnerMarkersDir>>
-): Promise<RunnerSupervisorStartResult> {
-  const current = await runnerSupervisorStatusUnlocked(options, markers)
-  if (current.state === 'running') {
-    const session = await readJson<SupervisorSession>(markers.sessionFile)
-    const requestedBrowser = options.browser ?? 'chrome'
-    const activeBrowser = session?.browser ?? 'chrome'
-    const requestedExecutable = options.browserExecutablePath ?? null
-    const activeExecutable = session?.browserExecutablePath ?? null
-    if (activeBrowser !== requestedBrowser || activeExecutable !== requestedExecutable) {
-      throw tokenlessError(
-        'playwright_runner_browser_mismatch',
-        `The managed Playwright runner is already using ${activeBrowser}; stop it before switching to ${requestedBrowser}.`
-      )
-    }
-    return { ...current, started: false }
-  }
-  if (current.state === 'unsafe') {
-    throw tokenlessError('playwright_runner_identity_unverified', 'A live managed Playwright runner marker is not verified; refusing to overwrite it.')
-  }
-
-  await validateWritableMarkers(markers)
-  const sessionId = options.sessionId ?? randomUUID()
-  const entryPath = options.entryPath ?? fileURLToPath(new URL('./runner-entry.mjs', import.meta.url))
-  const nodePath = options.nodePath ?? process.execPath
-  const args = [
-    entryPath,
-    '--home-dir', markers.homeDir,
-    '--session-id', sessionId,
-    '--browser', options.browser ?? 'chrome',
-    ...(options.browserExecutablePath ? ['--browser-executable', options.browserExecutablePath] : []),
-    ...(options.daemonUrl ? ['--daemon-url', options.daemonUrl] : []),
-  ]
-  const spawned = await (options.spawnDetached ?? defaultSpawnDetached)(nodePath, args, {
-    cwd: process.cwd(),
-    env: process.env,
-    logFile: markers.logFile,
-  })
-  const startedAt = (options.now ?? (() => new Date()))().toISOString()
-  const session: SupervisorSession = {
-    protocol: 'tokenless.playwright.runner-session.v1',
-    sessionId,
-    pid: spawned.pid,
-    startedAt,
-    browser: options.browser ?? 'chrome',
-    ...(options.browserExecutablePath ? { browserExecutablePath: options.browserExecutablePath } : {}),
-  }
-  await writePrivateJson(markers.sessionFile, session)
-  await writePrivateJson(markers.pidFile, session)
-  try {
-    const status = await waitForMatchingHeartbeat(options, markers, sessionId, spawned.pid)
-    return { ...status, started: true }
-  } catch (error) {
-    await cleanupFailedStartHandshake(options, markers, sessionId, spawned.pid)
-    throw error
-  }
-}
-
-export async function stopRunnerSupervisor(options: RunnerSupervisorOptions): Promise<RunnerSupervisorStatus> {
-  const markers = await ensureRunnerMarkersDir(options.homeDir)
-  return await withPrivateSqliteWriterLock(markers.writerLockFile, async () => {
-    const status = await runnerSupervisorStatusUnlocked(options, markers)
-    if (status.state === 'unsafe') {
-      throw tokenlessError('playwright_runner_identity_unverified', 'Managed Playwright runner identity is not verified; refusing to stop the process.')
-    }
-    if (status.state !== 'running' || !status.pid) return status
-    if (!status.safeToStop) {
-      throw tokenlessError('playwright_runner_identity_unverified', 'Managed Playwright runner identity is not verified; refusing to stop the process.')
-    }
-    await (options.killProcess ?? defaultKillProcess)(status.pid, 'SIGTERM')
-    await Promise.all([
-      fs.rm(markers.pidFile, { force: true }),
-      fs.rm(markers.sessionFile, { force: true }),
-      fs.rm(markers.heartbeatFile, { force: true }),
-    ])
-    return {
-      state: 'stopped',
-      pid: null,
-      sessionId: null,
-      safeToStop: false,
-      heartbeatAt: null,
-    }
-  })
-}
-
-export async function runnerSupervisorStatus(options: RunnerSupervisorOptions): Promise<RunnerSupervisorStatus> {
-  const markers = await ensureRunnerMarkersDir(options.homeDir)
-  return await runnerSupervisorStatusUnlocked(options, markers)
-}
-
-export async function runnerSupervisorStatusReadOnly(options: RunnerSupervisorOptions): Promise<RunnerSupervisorStatus> {
-  const markers = await runnerMarkersReadOnly(options.homeDir)
-  if (!markers) return stoppedStatus()
-  return await runnerSupervisorStatusUnlockedReadOnly(options, markers)
-}
-
-async function runnerSupervisorStatusUnlocked(
-  options: RunnerSupervisorOptions,
-  markers: Awaited<ReturnType<typeof ensureRunnerMarkersDir>>
-): Promise<RunnerSupervisorStatus> {
-  let session: SupervisorSession | null
-  try {
-    session = await readJson<SupervisorSession>(markers.sessionFile)
-  } catch (error) {
-    if (isMarkerMalformedError(error)) return unsafeStatus(null, null)
-    throw error
-  }
-  if (!session) return stoppedStatus()
-  if (!isValidSession(session)) {
-    return unsafeStatus(
-      Number.isInteger(session.pid) && session.pid > 0 ? session.pid : null,
-      typeof session.sessionId === 'string' ? session.sessionId : null
-    )
-  }
-  const alive = await (options.isProcessAlive ?? defaultIsProcessAlive)(session.pid)
-  if (!alive) {
-    return {
-      state: 'stale',
-      pid: session.pid,
-      sessionId: session.sessionId,
-      safeToStop: false,
-      heartbeatAt: null,
-    }
-  }
-  let heartbeat: SupervisorHeartbeat | null
-  try {
-    heartbeat = await readJson<SupervisorHeartbeat>(markers.heartbeatFile)
-  } catch (error) {
-    if (!isMarkerMalformedError(error)) throw error
-    heartbeat = null
-  }
-  const heartbeatMatches = heartbeat !== null &&
-    heartbeat.protocol === 'tokenless.playwright.runner-heartbeat.v1' &&
-    heartbeat.sessionId === session.sessionId &&
-    heartbeat.pid === session.pid &&
-    isFreshHeartbeat(heartbeat.updatedAt, options)
-  const heartbeatAt = heartbeatMatches && heartbeat !== null ? heartbeat.updatedAt : null
-  return {
-    state: heartbeatMatches ? 'running' : 'unsafe',
-    pid: session.pid,
-    sessionId: session.sessionId,
-    safeToStop: heartbeatMatches,
-    heartbeatAt,
-  }
-}
-
-async function runnerSupervisorStatusUnlockedReadOnly(
-  options: RunnerSupervisorOptions,
-  markers: NonNullable<Awaited<ReturnType<typeof runnerMarkersReadOnly>>>
-): Promise<RunnerSupervisorStatus> {
-  let session: SupervisorSession | null
-  try {
-    session = await readJsonReadOnly<SupervisorSession>(markers.sessionFile)
-  } catch (error) {
-    if (isMarkerMalformedError(error)) return unsafeStatus(null, null)
-    throw error
-  }
-  if (!session) return stoppedStatus()
-  if (!isValidSession(session)) {
-    return unsafeStatus(
-      Number.isInteger(session.pid) && session.pid > 0 ? session.pid : null,
-      typeof session.sessionId === 'string' ? session.sessionId : null
-    )
-  }
-  const alive = await (options.isProcessAlive ?? defaultIsProcessAlive)(session.pid)
-  if (!alive) {
-    return {
-      state: 'stale',
-      pid: session.pid,
-      sessionId: session.sessionId,
-      safeToStop: false,
-      heartbeatAt: null,
-    }
-  }
-  let heartbeat: SupervisorHeartbeat | null
-  try {
-    heartbeat = await readJsonReadOnly<SupervisorHeartbeat>(markers.heartbeatFile)
-  } catch (error) {
-    if (!isMarkerMalformedError(error)) throw error
-    heartbeat = null
-  }
-  const heartbeatMatches = heartbeat !== null &&
-    heartbeat.protocol === 'tokenless.playwright.runner-heartbeat.v1' &&
-    heartbeat.sessionId === session.sessionId &&
-    heartbeat.pid === session.pid &&
-    isFreshHeartbeat(heartbeat.updatedAt, options)
-  const heartbeatAt = heartbeatMatches && heartbeat !== null ? heartbeat.updatedAt : null
-  return {
-    state: heartbeatMatches ? 'running' : 'unsafe',
-    pid: session.pid,
-    sessionId: session.sessionId,
-    safeToStop: heartbeatMatches,
-    heartbeatAt,
-  }
-}
-
-export async function writeRunnerHeartbeat(options: {
-  homeDir?: string | undefined
-  sessionId: string
-  pid?: number | undefined
-  now?: (() => Date) | undefined
-}) {
-  const markers = await ensureRunnerMarkersDir(options.homeDir)
-  await writePrivateJson(markers.heartbeatFile, {
-    protocol: 'tokenless.playwright.runner-heartbeat.v1',
-    sessionId: options.sessionId,
-    pid: options.pid ?? process.pid,
-    updatedAt: (options.now ?? (() => new Date()))().toISOString(),
-  } satisfies SupervisorHeartbeat)
-}
-
-export async function ensureRunnerMarkersDir(homeDir = tokenlessHome()) {
-  await fs.mkdir(homeDir, { recursive: true, mode: 0o700 })
-  const canonicalHomeDir = await fs.realpath(homeDir)
-  const runnerDir = path.join(canonicalHomeDir, RUNNER_DIR)
-  await fs.mkdir(runnerDir, { recursive: true, mode: 0o700 })
-  await assertPrivateDirectory(runnerDir)
-  const logFile = path.join(runnerDir, LOG_FILE)
-  await ensurePrivateMarkerFile(logFile)
-  return {
-    homeDir: canonicalHomeDir,
-    runnerDir,
-    pidFile: path.join(runnerDir, PID_FILE),
-    sessionFile: path.join(runnerDir, SESSION_FILE),
-    heartbeatFile: path.join(runnerDir, HEARTBEAT_FILE),
-    writerLockFile: path.join(runnerDir, WRITER_LOCK_FILE),
-    logFile,
-  }
-}
-
-async function runnerMarkersReadOnly(homeDir = tokenlessHome()) {
-  const resolvedHomeDir = path.resolve(homeDir)
-  let canonicalHomeDir = resolvedHomeDir
-  try {
-    canonicalHomeDir = await fs.realpath(resolvedHomeDir)
-  } catch (error) {
-    if (isMissingFile(error)) return null
-    throw error
-  }
-  const runnerDir = path.join(canonicalHomeDir, RUNNER_DIR)
-  try {
-    await assertPrivateDirectoryReadOnly(runnerDir)
-  } catch (error) {
-    if (isMissingFile(error)) return null
-    throw error
-  }
-  return {
-    homeDir: canonicalHomeDir,
-    runnerDir,
-    pidFile: path.join(runnerDir, PID_FILE),
-    sessionFile: path.join(runnerDir, SESSION_FILE),
-    heartbeatFile: path.join(runnerDir, HEARTBEAT_FILE),
-    writerLockFile: path.join(runnerDir, WRITER_LOCK_FILE),
-    logFile: path.join(runnerDir, LOG_FILE),
-  }
-}
-
-function tokenlessHome(explicitHome = process.env.TOKENLESS_HOME) {
-  return path.resolve(explicitHome || path.join(os.homedir(), '.tokenless'))
-}
-
-async function defaultSpawnDetached(command: string, args: readonly string[], options: {
-  cwd: string
-  env: NodeJS.ProcessEnv
-  logFile: string
-}) {
-  const logFd = fsSync.openSync(
-    options.logFile,
-    fsConstants.O_WRONLY | fsConstants.O_APPEND | (fsConstants.O_NOFOLLOW ?? 0),
-    0o600
-  )
-  const child = childProcess.spawn(command, args, {
-    cwd: options.cwd,
-    env: options.env,
-    detached: true,
-    stdio: ['ignore', logFd, logFd],
-  })
-  child.unref()
-  return { pid: requirePid(child.pid) }
-}
-
-function requirePid(pid: number | undefined) {
-  if (!Number.isInteger(pid) || !pid) {
-    throw tokenlessError('playwright_runner_spawn_failed', 'Managed Playwright runner did not report a valid pid.', { retryable: true })
-  }
-  return pid
-}
-
-function defaultIsProcessAlive(pid: number) {
-  try {
-    process.kill(pid, 0)
-    return true
-  } catch {
-    return false
-  }
-}
-
-function defaultKillProcess(pid: number, signal: NodeJS.Signals) {
-  process.kill(pid, signal)
-}
-
-async function writePrivateJson(file: string, value: unknown) {
-  await validateMarkerBeforeOverwrite(file)
-  const tmp = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${Date.now()}.${randomUUID()}.tmp`)
-  let wrote = false
-  try {
-    const handle = await fs.open(tmp, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | (fsConstants.O_NOFOLLOW ?? 0), 0o600)
-    try {
-      await handle.writeFile(`${JSON.stringify(value, null, 2)}\n`)
-      await handle.chmod(0o600)
-    } finally {
-      await handle.close()
-    }
-    await assertPrivateFile(tmp)
-    await fs.rename(tmp, file)
-    wrote = true
-    await assertPrivateFile(file)
-  } finally {
-    if (!wrote) await fs.rm(tmp, { force: true }).catch(() => undefined)
-  }
-}
-
-async function readJson<T>(file: string): Promise<T | null> {
-  try {
-    await assertPrivateFile(file)
-    return JSON.parse(await fs.readFile(file, 'utf8')) as T
-  } catch (error) {
-    if (isMarkerPermissionError(error)) throw error
-    if (!isMissingFile(error)) {
-      throw tokenlessError('playwright_runner_marker_malformed', 'Managed Playwright runner marker JSON is malformed.', { cause: error })
-    }
-    return null
-  }
-}
-
-async function readJsonReadOnly<T>(file: string): Promise<T | null> {
-  try {
-    await assertPrivateFileReadOnly(file)
-    return JSON.parse(await fs.readFile(file, 'utf8')) as T
-  } catch (error) {
-    if (isMarkerPermissionError(error)) throw error
-    if (!isMissingFile(error)) {
-      throw tokenlessError('playwright_runner_marker_malformed', 'Managed Playwright runner marker JSON is malformed.', { cause: error })
-    }
-    return null
-  }
-}
-
-async function waitForMatchingHeartbeat(
-  options: RunnerSupervisorOptions,
-  markers: Awaited<ReturnType<typeof ensureRunnerMarkersDir>>,
-  sessionId: string,
-  pid: number
-) {
-  const timeoutMs = Math.max(1, Math.floor(options.heartbeatTimeoutMs ?? RUNNER_HEARTBEAT_FRESHNESS_MS))
-  const startedAt = Date.now()
-  while (Date.now() - startedAt <= timeoutMs) {
-    const status = await runnerSupervisorStatusUnlocked(options, markers)
-    if (status.state === 'running' && status.sessionId === sessionId && status.pid === pid && status.safeToStop) {
-      return status
-    }
-    await new Promise((resolve) => setTimeout(resolve, 100))
-  }
-  throw tokenlessError('playwright_runner_heartbeat_timeout', 'Managed Playwright runner did not report a matching heartbeat.', { retryable: true })
-}
-
-async function cleanupFailedStartHandshake(
-  options: RunnerSupervisorOptions,
-  markers: Awaited<ReturnType<typeof ensureRunnerMarkersDir>>,
-  sessionId: string,
-  pid: number
-) {
-  try {
-    const session = await readJson<SupervisorSession>(markers.sessionFile)
-    if (!session || session.sessionId !== sessionId || session.pid !== pid) return
-    await (options.killProcess ?? defaultKillProcess)(pid, 'SIGTERM')
-    await Promise.all([
-      fs.rm(markers.pidFile, { force: true }),
-      fs.rm(markers.sessionFile, { force: true }),
-      fs.rm(markers.heartbeatFile, { force: true }),
-    ])
-  } catch {
-    // Preserve the heartbeat timeout or identity failure that triggered cleanup.
-  }
-}
-
-async function assertPrivateDirectory(directory: string) {
-  const fileStat = await fs.lstat(directory)
-  if (!fileStat.isDirectory() || fileStat.isSymbolicLink()) {
-    throw tokenlessError('playwright_runner_marker_permissions', 'Managed Playwright runner marker directory is not private.')
-  }
-  assertCurrentUser(fileStat)
-  if (process.platform !== 'win32' && (fileStat.mode & 0o7777) !== 0o700) {
-    throw tokenlessError('playwright_runner_marker_permissions', 'Managed Playwright runner marker directory is not private.')
-  }
-  await fs.chmod(directory, 0o700)
-}
-
-async function assertPrivateDirectoryReadOnly(directory: string) {
-  const fileStat = await fs.lstat(directory)
-  if (!fileStat.isDirectory() || fileStat.isSymbolicLink()) {
-    throw tokenlessError('playwright_runner_marker_permissions', 'Managed Playwright runner marker directory is not private.')
-  }
-  assertCurrentUser(fileStat)
-  if (process.platform !== 'win32' && (fileStat.mode & 0o7777) !== 0o700) {
-    throw tokenlessError('playwright_runner_marker_permissions', 'Managed Playwright runner marker directory is not private.')
-  }
-}
-
-async function assertPrivateFile(file: string) {
-  const fileStat = await fs.lstat(file)
-  if (!fileStat.isFile() || fileStat.isSymbolicLink() || fileStat.nlink !== 1) {
-    throw tokenlessError('playwright_runner_marker_permissions', 'Managed Playwright runner marker file is not private.')
-  }
-  assertCurrentUser(fileStat)
-  if (process.platform !== 'win32' && (fileStat.mode & 0o7777) !== 0o600) {
-    throw tokenlessError('playwright_runner_marker_permissions', 'Managed Playwright runner marker file is not private.')
-  }
-  await fs.chmod(file, 0o600)
-}
-
-async function assertPrivateFileReadOnly(file: string) {
-  const fileStat = await fs.lstat(file)
-  if (!fileStat.isFile() || fileStat.isSymbolicLink() || fileStat.nlink !== 1) {
-    throw tokenlessError('playwright_runner_marker_permissions', 'Managed Playwright runner marker file is not private.')
-  }
-  assertCurrentUser(fileStat)
-  if (process.platform !== 'win32' && (fileStat.mode & 0o7777) !== 0o600) {
-    throw tokenlessError('playwright_runner_marker_permissions', 'Managed Playwright runner marker file is not private.')
-  }
-}
-
-async function ensurePrivateMarkerFile(file: string) {
-  let handle: Awaited<ReturnType<typeof fs.open>> | undefined
-  try {
-    handle = await fs.open(file, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | (fsConstants.O_NOFOLLOW ?? 0), 0o600)
-    await handle.chmod(0o600)
-  } catch (error) {
-    if (!isErrno(error, 'EEXIST')) throw error
-    await assertPrivateFile(file)
-  } finally {
-    await handle?.close().catch(() => undefined)
-  }
-}
-
-async function validateWritableMarkers(markers: Awaited<ReturnType<typeof ensureRunnerMarkersDir>>) {
-  await Promise.all([
-    validateMarkerBeforeOverwrite(markers.sessionFile),
-    validateMarkerBeforeOverwrite(markers.pidFile),
-    validateMarkerBeforeOverwrite(markers.heartbeatFile),
-  ])
-}
-
-async function validateMarkerBeforeOverwrite(file: string) {
-  await assertPrivateDirectory(path.dirname(file))
-  try {
-    await assertPrivateFile(file)
-  } catch (error) {
-    if (isMissingFile(error)) return
-    throw error
-  }
-}
-
-function assertCurrentUser(metadata: { uid: number }) {
-  if (typeof process.getuid === 'function' && metadata.uid !== process.getuid()) {
-    throw tokenlessError('playwright_runner_marker_permissions', 'Managed Playwright runner marker path is not owned by the current user.')
-  }
-}
-
-function stoppedStatus(): RunnerSupervisorStatus {
-  return {
-    state: 'stopped',
-    pid: null,
-    sessionId: null,
-    safeToStop: false,
-    heartbeatAt: null,
-  }
-}
-
-function unsafeStatus(pid: number | null, sessionId: string | null): RunnerSupervisorStatus {
-  return {
-    state: 'unsafe',
-    pid,
-    sessionId,
-    safeToStop: false,
-    heartbeatAt: null,
-  }
-}
-
-function isValidSession(session: SupervisorSession) {
-  return session.protocol === 'tokenless.playwright.runner-session.v1' &&
-    typeof session.sessionId === 'string' &&
-    /^[A-Za-z0-9._:-]{1,128}$/.test(session.sessionId) &&
-    Number.isSafeInteger(session.pid) &&
-    session.pid > 0 &&
-    typeof session.startedAt === 'string' &&
-    Number.isFinite(Date.parse(session.startedAt))
-}
-
-function isFreshHeartbeat(updatedAt: string, options: RunnerSupervisorOptions) {
-  const updatedAtMs = Date.parse(updatedAt)
-  if (!Number.isFinite(updatedAtMs)) return false
-  const nowMs = (options.now ?? (() => new Date()))().getTime()
-  const ageMs = nowMs - updatedAtMs
-  const timeoutMs = Math.max(1, Math.floor(options.heartbeatTimeoutMs ?? RUNNER_HEARTBEAT_FRESHNESS_MS))
-  return ageMs >= 0 && ageMs <= timeoutMs
-}
-
-function isMarkerPermissionError(error: unknown) {
-  return error instanceof Error &&
-    error.name === 'TokenlessPlaywrightError' &&
-    'code' in error &&
-    error.code === 'playwright_runner_marker_permissions'
-}
-
-function isMarkerMalformedError(error: unknown) {
-  return error instanceof Error &&
-    error.name === 'TokenlessPlaywrightError' &&
-    'code' in error &&
-    error.code === 'playwright_runner_marker_malformed'
-}
-
-function isErrno(error: unknown, code: string) {
-  return Boolean(error && typeof error === 'object' && 'code' in error && error.code === code)
-}
-
-function isMissingFile(error: unknown) {
-  return isErrno(error, 'ENOENT')
-}
diff --git a/packages/cli/src/providers/account-inspectors.ts b/packages/cli/src/providers/account-inspectors.ts
new file mode 100644
index 0000000..857b8a9
--- /dev/null
+++ b/packages/cli/src/providers/account-inspectors.ts
@@ -0,0 +1,228 @@
+import type { Locator, Page } from 'playwright-core'
+import type { AuthStatusResult } from '../playwright/actions.js'
+import type { ProviderAccountTier, ProviderDomDefinition } from './provider-definition.js'
+
+export type ProviderAccountInspection = {
+  readonly name: string | null
+  readonly subscription: string | null
+  readonly subscriptionEvidence: {
+    readonly status: 'observed' | 'derived' | 'unknown'
+    readonly source: string | null
+  }
+}
+
+export interface ProviderAccountInspector {
+  inspect(
+    page: Page,
+    provider: ProviderDomDefinition,
+    accountControl: Locator,
+    signal: AbortSignal | undefined,
+  ): Promise<ProviderAccountInspection>
+}
+
+type AccountControlSignal = {
+  readonly ariaLabel: string
+  readonly title: string
+  readonly text: string
+}
+
+export class MenuTextAccountInspector implements ProviderAccountInspector {
+  async inspect(
+    _page: Page,
+    provider: ProviderDomDefinition,
+    accountControl: Locator,
+    _signal: AbortSignal | undefined,
+  ): Promise<ProviderAccountInspection> {
+    const signal = await readAccountControlSignal(accountControl)
+    const lines = accountSignalLines(signal)
+    const subscription = findSubscriptionLabel(lines.planCandidates, provider)
+    return {
+      name: firstAccountName(lines.textLines.length > 0 ? lines.textLines : lines.ariaLines, subscription, provider),
+      subscription,
+      subscriptionEvidence: subscriptionEvidence('observed', subscription, 'account-control-label'),
+    }
+  }
+}
+
+export async function inspectProviderAccountSession(
+  page: Page,
+  provider: ProviderDomDefinition,
+  signal: AbortSignal | undefined,
+): Promise<AuthStatusResult> {
+  for (let attempt = 0; attempt <= 50; attempt += 1) {
+    assertNotAborted(signal)
+    if (isConfiguredSignInNavigation(page.url(), provider)) {
+      return {
+        state: 'unauthenticated',
+        access: 'sign_in_required',
+        visibleProof: 'provider-sign-in-navigation',
+      }
+    }
+    const loginVisible = await anyVisible(page, provider.loginIndicators)
+    if (loginVisible) {
+      const composerVisible = await anyVisible(page, provider.composerSelectors)
+      const guestSupported = provider.access.guest === 'supported'
+      const guest = guestSupported && composerVisible
+      return {
+        state: 'unauthenticated',
+        access: guest
+          ? 'guest'
+          : guestSupported
+            ? 'unknown'
+            : 'sign_in_required',
+        visibleProof: guest
+          ? 'guest-composer-visible'
+          : guestSupported
+            ? 'login-invitation-visible-guest-surface-not-ready'
+            : composerVisible
+              ? 'sign-in-required-despite-composer'
+              : 'login-indicator-visible',
+      }
+    }
+    const accountControl = await firstLocator(page, provider.authIndicators)
+    if (accountControl) {
+      const account = await provider.account.inspector.inspect(page, provider, accountControl, signal)
+      const tier = providerAccountTier(provider, account.subscription)
+      return {
+        state: 'authenticated',
+        access: tier.class,
+        visibleProof: 'authenticated-account-control-visible',
+        account: {
+          ...account,
+          tier: {
+            class: tier.class,
+            label: tier.label,
+          },
+        },
+      }
+    }
+    if (attempt < 50) await page.waitForTimeout(100)
+  }
+  const composerVisible = await anyVisible(page, provider.composerSelectors)
+  const guest = provider.access.guest === 'supported' && composerVisible
+  return {
+    state: guest ? 'unauthenticated' : 'unknown',
+    access: guest ? 'guest' : 'unknown',
+    visibleProof: guest ? 'guest-composer-visible' : 'no-authenticated-account-control',
+  }
+}
+
+export function providerAccountTier(
+  provider: ProviderDomDefinition,
+  subscription: string | null,
+): ProviderAccountTier {
+  if (subscription === null) {
+    return {
+      class: 'signed_in_unknown' as const,
+      label: null,
+    }
+  }
+  const normalized = normalizeAccountText(subscription).replace(/\s+plan$/i, '').toLowerCase()
+  if (provider.account.freePlanLabels.some((label) => label.toLowerCase() === normalized)) {
+    return {
+      class: 'signed_in_free' as const,
+      label: subscription,
+    }
+  }
+  if (provider.account.paidPlanLabels.some((label) => label.toLowerCase() === normalized)) {
+    return {
+      class: 'signed_in_paid' as const,
+      label: subscription,
+    }
+  }
+  return {
+    class: 'signed_in_unknown' as const,
+    label: subscription,
+  }
+}
+
+async function readAccountControlSignal(accountControl: Locator): Promise<AccountControlSignal> {
+  return await accountControl.evaluate((element) => ({
+    ariaLabel: element.getAttribute('aria-label') ?? '',
+    title: element.getAttribute('title') ?? '',
+    text: element instanceof HTMLElement ? element.innerText : (element.textContent ?? ''),
+  })).catch(() => ({ ariaLabel: '', title: '', text: '' }))
+}
+
+function accountSignalLines(signal: AccountControlSignal) {
+  const textLines = signal.text
+    .split(/\r?\n/)
+    .map(normalizeAccountText)
+    .filter(Boolean)
+  const ariaLines = signal.ariaLabel
+    .split(/[,\n·]/)
+    .map(normalizeAccountText)
+    .filter(Boolean)
+  return {
+    textLines,
+    ariaLines,
+    planCandidates: [...textLines, ...ariaLines],
+  }
+}
+
+function subscriptionEvidence(
+  status: ProviderAccountInspection['subscriptionEvidence']['status'],
+  subscription: string | null,
+  source: string | null,
+) {
+  return subscription === null
+    ? {
+        status: 'unknown' as const,
+        source: null,
+      }
+    : {
+        status,
+        source,
+      }
+}
+
+function firstAccountName(lines: readonly string[], subscription: string | null, provider: ProviderDomDefinition) {
+  const candidates = lines.filter((line) => (
+    line !== subscription &&
+    !looksLikeEmail(line) &&
+    !isSubscriptionLabel(line, provider) &&
+    !/^(?:profile image|download apps|get apps and extensions)$/i.test(line) &&
+    /[\p{L}\p{N}]/u.test(line)
+  ))
+  return candidates.find((line) => line.length > 1) ?? candidates[0] ?? null
+}
+
+function findSubscriptionLabel(values: readonly string[], provider: ProviderDomDefinition) {
+  return values.find((line) => isSubscriptionLabel(line, provider)) ?? null
+}
+
+function isSubscriptionLabel(value: string, provider: ProviderDomDefinition) {
+  const normalized = value.replace(/\s+plan$/i, '').trim().toLowerCase()
+  return [
+    ...provider.account.freePlanLabels,
+    ...provider.account.paidPlanLabels,
+  ].some((label) => label.toLowerCase() === normalized)
+}
+
+function looksLikeEmail(value: string) {
+  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value)
+}
+
+function normalizeAccountText(value: string) {
+  return value.replace(/\s+/g, ' ').trim().slice(0, 120)
+}
+
+async function firstLocator(page: Page, selectors: readonly string[]): Promise<Locator | null> {
+  for (const selector of selectors) {
+    const locator = page.locator(selector).first()
+    if (await locator.isVisible({ timeout: 500 }).catch(() => false)) return locator
+  }
+  return null
+}
+
+async function anyVisible(page: Page, selectors: readonly string[]) {
+  return await firstLocator(page, selectors) !== null
+}
+
+function isConfiguredSignInNavigation(value: unknown, provider: ProviderDomDefinition) {
+  return provider.navigationPolicy.classify(value).kind === 'trusted_sign_in'
+}
+
+function assertNotAborted(signal: AbortSignal | undefined) {
+  if (signal?.aborted) throw signal.reason ?? new Error('Provider session inspection was aborted.')
+}
diff --git a/packages/cli/src/providers/action-catalog.ts b/packages/cli/src/providers/action-catalog.ts
new file mode 100644
index 0000000..bb9df5a
--- /dev/null
+++ b/packages/cli/src/providers/action-catalog.ts
@@ -0,0 +1,453 @@
+import { VISIBLE_ATTACHMENT_SCHEMA_ID } from '../schema-ids.js'
+import { tokenlessError } from '../playwright/errors.js'
+import { PROVIDER_CAPABILITIES } from './provider-identity.js'
+import { VISIBLE_ACTIONS } from './contracts.js'
+import type { ProviderCapabilityId } from './provider-identity.js'
+import type {
+  AttachmentInput,
+  EmptyVisibleActionPayload,
+  FileUploadPayload,
+  PromptInputPayload,
+  VisibleAction,
+  VisibleActionPayloadForAction,
+  VisibleSelectionPayload,
+  QwenModeSelectionPayload,
+  DeepSeekModeSelectionPayload,
+  DeepSeekToggleSelectionPayload,
+  DoubaoModeSelectionPayload,
+  DoubaoSkillSelectionPayload,
+  WorkspaceEnsurePayload,
+} from './contracts.js'
+
+export type VisibleActionCompletion = 'immediate' | 'records_submission' | 'reads_response'
+
+export type VisibleActionLifecycle = {
+  readonly gated: boolean
+  readonly mutating: boolean
+  readonly reconstructablePreSubmit: boolean
+  readonly completion: VisibleActionCompletion
+}
+
+export type VisibleActionCatalogDefinition<Action extends VisibleAction = VisibleAction> = {
+  readonly action: Action
+  readonly lifecycle: VisibleActionLifecycle
+  readonly requiredCapabilities: readonly ProviderCapabilityId[]
+  validatePayload(payload: Record<string, unknown>): VisibleActionPayloadForAction<Action>
+}
+
+const immediateReadOnly = Object.freeze({
+  gated: false,
+  mutating: false,
+  reconstructablePreSubmit: false,
+  completion: 'immediate',
+} satisfies VisibleActionLifecycle)
+
+const gatedReadOnly = Object.freeze({
+  gated: true,
+  mutating: false,
+  reconstructablePreSubmit: false,
+  completion: 'immediate',
+} satisfies VisibleActionLifecycle)
+
+const gatedMutation = Object.freeze({
+  gated: true,
+  mutating: true,
+  reconstructablePreSubmit: false,
+  completion: 'immediate',
+} satisfies VisibleActionLifecycle)
+
+const reconstructableGatedMutation = Object.freeze({
+  gated: true,
+  mutating: true,
+  reconstructablePreSubmit: true,
+  completion: 'immediate',
+} satisfies VisibleActionLifecycle)
+
+const submitLifecycle = Object.freeze({
+  gated: true,
+  mutating: true,
+  reconstructablePreSubmit: false,
+  completion: 'records_submission',
+} satisfies VisibleActionLifecycle)
+
+const responseReadLifecycle = Object.freeze({
+  gated: true,
+  mutating: false,
+  reconstructablePreSubmit: false,
+  completion: 'reads_response',
+} satisfies VisibleActionLifecycle)
+
+export const VISIBLE_ACTION_CATALOG = Object.freeze({
+  [VISIBLE_ACTIONS.CAPABILITY_INSPECT]: defineAction({
+    action: VISIBLE_ACTIONS.CAPABILITY_INSPECT,
+    lifecycle: gatedReadOnly,
+    requiredCapabilities: [PROVIDER_CAPABILITIES.CAPABILITY_INSPECT],
+    validatePayload: validateEmptyPayload,
+  }),
+  [VISIBLE_ACTIONS.AUTH_STATUS]: defineAction({
+    action: VISIBLE_ACTIONS.AUTH_STATUS,
+    lifecycle: immediateReadOnly,
+    requiredCapabilities: [],
+    validatePayload: validateEmptyPayload,
+  }),
+  [VISIBLE_ACTIONS.MODEL_INSPECT]: defineAction({
+    action: VISIBLE_ACTIONS.MODEL_INSPECT,
+    lifecycle: gatedReadOnly,
+    requiredCapabilities: [PROVIDER_CAPABILITIES.MODEL_CHOICE],
+    validatePayload: validateEmptyPayload,
+  }),
+  [VISIBLE_ACTIONS.MODEL_SELECT]: defineAction({
+    action: VISIBLE_ACTIONS.MODEL_SELECT,
+    lifecycle: reconstructableGatedMutation,
+    requiredCapabilities: [PROVIDER_CAPABILITIES.MODEL_CHOICE],
+    validatePayload: validateSelectionPayload,
+  }),
+  [VISIBLE_ACTIONS.EFFORT_INSPECT]: defineAction({
+    action: VISIBLE_ACTIONS.EFFORT_INSPECT,
+    lifecycle: gatedReadOnly,
+    requiredCapabilities: [PROVIDER_CAPABILITIES.EFFORT_CHOICE],
+    validatePayload: validateEmptyPayload,
+  }),
+  [VISIBLE_ACTIONS.EFFORT_SELECT]: defineAction({
+    action: VISIBLE_ACTIONS.EFFORT_SELECT,
+    lifecycle: reconstructableGatedMutation,
+    requiredCapabilities: [PROVIDER_CAPABILITIES.EFFORT_CHOICE],
+    validatePayload: validateSelectionPayload,
+  }),
+  [VISIBLE_ACTIONS.QWEN_MODE_INSPECT]: defineAction({
+    action: VISIBLE_ACTIONS.QWEN_MODE_INSPECT,
+    lifecycle: gatedReadOnly,
+    requiredCapabilities: [PROVIDER_CAPABILITIES.QWEN_MODE],
+    validatePayload: validateEmptyPayload,
+  }),
+  [VISIBLE_ACTIONS.QWEN_MODE_SELECT]: defineAction({
+    action: VISIBLE_ACTIONS.QWEN_MODE_SELECT,
+    lifecycle: reconstructableGatedMutation,
+    requiredCapabilities: [PROVIDER_CAPABILITIES.QWEN_MODE],
+    validatePayload: validateQwenModeSelectionPayload,
+  }),
+  [VISIBLE_ACTIONS.DEEPSEEK_MODE_INSPECT]: defineAction({
+    action: VISIBLE_ACTIONS.DEEPSEEK_MODE_INSPECT,
+    lifecycle: gatedReadOnly,
+    requiredCapabilities: [PROVIDER_CAPABILITIES.DEEPSEEK_MODE],
+    validatePayload: validateEmptyPayload,
+  }),
+  [VISIBLE_ACTIONS.DEEPSEEK_MODE_SELECT]: defineAction({
+    action: VISIBLE_ACTIONS.DEEPSEEK_MODE_SELECT,
+    lifecycle: reconstructableGatedMutation,
+    requiredCapabilities: [PROVIDER_CAPABILITIES.DEEPSEEK_MODE],
+    validatePayload: validateDeepSeekModeSelectionPayload,
+  }),
+  [VISIBLE_ACTIONS.DEEPSEEK_DEEPTHINK_INSPECT]: defineAction({
+    action: VISIBLE_ACTIONS.DEEPSEEK_DEEPTHINK_INSPECT,
+    lifecycle: gatedReadOnly,
+    requiredCapabilities: [PROVIDER_CAPABILITIES.DEEPSEEK_DEEPTHINK],
+    validatePayload: validateEmptyPayload,
+  }),
+  [VISIBLE_ACTIONS.DEEPSEEK_DEEPTHINK_SELECT]: defineAction({
+    action: VISIBLE_ACTIONS.DEEPSEEK_DEEPTHINK_SELECT,
+    lifecycle: reconstructableGatedMutation,
+    requiredCapabilities: [PROVIDER_CAPABILITIES.DEEPSEEK_DEEPTHINK],
+    validatePayload: validateDeepSeekToggleSelectionPayload,
+  }),
+  [VISIBLE_ACTIONS.DEEPSEEK_SEARCH_INSPECT]: defineAction({
+    action: VISIBLE_ACTIONS.DEEPSEEK_SEARCH_INSPECT,
+    lifecycle: gatedReadOnly,
+    requiredCapabilities: [PROVIDER_CAPABILITIES.DEEPSEEK_SEARCH],
+    validatePayload: validateEmptyPayload,
+  }),
+  [VISIBLE_ACTIONS.DEEPSEEK_SEARCH_SELECT]: defineAction({
+    action: VISIBLE_ACTIONS.DEEPSEEK_SEARCH_SELECT,
+    lifecycle: reconstructableGatedMutation,
+    requiredCapabilities: [PROVIDER_CAPABILITIES.DEEPSEEK_SEARCH],
+    validatePayload: validateDeepSeekToggleSelectionPayload,
+  }),
+  [VISIBLE_ACTIONS.DOUBAO_MODE_INSPECT]: defineAction({
+    action: VISIBLE_ACTIONS.DOUBAO_MODE_INSPECT,
+    lifecycle: gatedReadOnly,
+    requiredCapabilities: [PROVIDER_CAPABILITIES.DOUBAO_MODE],
+    validatePayload: validateEmptyPayload,
+  }),
+  [VISIBLE_ACTIONS.DOUBAO_MODE_SELECT]: defineAction({
+    action: VISIBLE_ACTIONS.DOUBAO_MODE_SELECT,
+    lifecycle: reconstructableGatedMutation,
+    requiredCapabilities: [PROVIDER_CAPABILITIES.DOUBAO_MODE],
+    validatePayload: validateDoubaoModeSelectionPayload,
+  }),
+  [VISIBLE_ACTIONS.DOUBAO_SKILL_INSPECT]: defineAction({
+    action: VISIBLE_ACTIONS.DOUBAO_SKILL_INSPECT,
+    lifecycle: gatedReadOnly,
+    requiredCapabilities: [PROVIDER_CAPABILITIES.DOUBAO_SKILL],
+    validatePayload: validateEmptyPayload,
+  }),
+  [VISIBLE_ACTIONS.DOUBAO_SKILL_SELECT]: defineAction({
+    action: VISIBLE_ACTIONS.DOUBAO_SKILL_SELECT,
+    lifecycle: reconstructableGatedMutation,
+    requiredCapabilities: [PROVIDER_CAPABILITIES.DOUBAO_SKILL],
+    validatePayload: validateDoubaoSkillSelectionPayload,
+  }),
+  [VISIBLE_ACTIONS.FILE_UPLOAD]: defineAction({
+    action: VISIBLE_ACTIONS.FILE_UPLOAD,
+    lifecycle: reconstructableGatedMutation,
+    requiredCapabilities: [PROVIDER_CAPABILITIES.FILE_UPLOAD],
+    validatePayload: validateFileUploadPayload,
+  }),
+  [VISIBLE_ACTIONS.WORKSPACE_ENSURE]: defineAction({
+    action: VISIBLE_ACTIONS.WORKSPACE_ENSURE,
+    lifecycle: gatedMutation,
+    requiredCapabilities: [PROVIDER_CAPABILITIES.WORKSPACE_ENSURE],
+    validatePayload: validateWorkspaceEnsurePayload,
+  }),
+  [VISIBLE_ACTIONS.PROMPT_INPUT]: defineAction({
+    action: VISIBLE_ACTIONS.PROMPT_INPUT,
+    lifecycle: reconstructableGatedMutation,
+    requiredCapabilities: [PROVIDER_CAPABILITIES.CONVERSATION_CONTINUE],
+    validatePayload: validatePromptInputPayload,
+  }),
+  [VISIBLE_ACTIONS.PROMPT_CLEAR]: defineAction({
+    action: VISIBLE_ACTIONS.PROMPT_CLEAR,
+    lifecycle: reconstructableGatedMutation,
+    requiredCapabilities: [PROVIDER_CAPABILITIES.CONVERSATION_CONTINUE],
+    validatePayload: validateEmptyPayload,
+  }),
+  [VISIBLE_ACTIONS.PROMPT_SUBMIT]: defineAction({
+    action: VISIBLE_ACTIONS.PROMPT_SUBMIT,
+    lifecycle: submitLifecycle,
+    requiredCapabilities: [PROVIDER_CAPABILITIES.CONVERSATION_CONTINUE],
+    validatePayload: validateEmptyPayload,
+  }),
+  [VISIBLE_ACTIONS.RESPONSE_READ]: defineAction({
+    action: VISIBLE_ACTIONS.RESPONSE_READ,
+    lifecycle: responseReadLifecycle,
+    requiredCapabilities: [PROVIDER_CAPABILITIES.CONVERSATION_CONTINUE],
+    validatePayload: validateEmptyPayload,
+  }),
+  [VISIBLE_ACTIONS.SNAPSHOT_SANITIZED]: defineAction({
+    action: VISIBLE_ACTIONS.SNAPSHOT_SANITIZED,
+    lifecycle: immediateReadOnly,
+    requiredCapabilities: [],
+    validatePayload: validateEmptyPayload,
+  }),
+  [VISIBLE_ACTIONS.NAVIGATION_CHECK]: defineAction({
+    action: VISIBLE_ACTIONS.NAVIGATION_CHECK,
+    lifecycle: gatedReadOnly,
+    requiredCapabilities: [],
+    validatePayload: validateEmptyPayload,
+  }),
+  [VISIBLE_ACTIONS.BLOCKER_CHECK]: defineAction({
+    action: VISIBLE_ACTIONS.BLOCKER_CHECK,
+    lifecycle: immediateReadOnly,
+    requiredCapabilities: [],
+    validatePayload: validateEmptyPayload,
+  }),
+} satisfies { readonly [Action in VisibleAction]: VisibleActionCatalogDefinition<Action> })
+
+const ACTIONS = Object.freeze(Object.keys(VISIBLE_ACTION_CATALOG)) as readonly VisibleAction[]
+const ACTION_SET = new Set<string>(ACTIONS)
+
+export function listVisibleActions(): readonly VisibleAction[] {
+  return ACTIONS
+}
+
+export function isVisibleAction(value: unknown): value is VisibleAction {
+  return typeof value === 'string' && ACTION_SET.has(value)
+}
+
+export function getVisibleActionCatalogDefinition<Action extends VisibleAction>(
+  action: Action
+): VisibleActionCatalogDefinition<Action> {
+  return VISIBLE_ACTION_CATALOG[action] as VisibleActionCatalogDefinition<Action>
+}
+
+export function getVisibleActionLifecycle(action: VisibleAction): VisibleActionLifecycle {
+  return VISIBLE_ACTION_CATALOG[action].lifecycle
+}
+
+export function validateVisibleActionPayload<Action extends VisibleAction>(
+  action: Action,
+  payload: Record<string, unknown>
+): VisibleActionPayloadForAction<Action> {
+  return getVisibleActionCatalogDefinition(action).validatePayload(payload)
+}
+
+export function validateAttachmentInput(input: unknown): AttachmentInput {
+  if (!isPlainRecord(input)) throw tokenlessError('invalid_visible_attachment', 'Attachment descriptor must be an object.')
+  requireExactKeys(input, ['protocol', 'bundleId', 'attachmentId', 'name', 'type', 'size', 'sha256'], 'invalid_visible_attachment')
+  if (input.protocol !== VISIBLE_ATTACHMENT_SCHEMA_ID) {
+    throw tokenlessError('invalid_visible_attachment', 'Attachment protocol is invalid.')
+  }
+  if (typeof input.bundleId !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(input.bundleId)) {
+    throw tokenlessError('invalid_visible_attachment', 'Attachment bundle id is invalid.')
+  }
+  if (typeof input.attachmentId !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(input.attachmentId)) {
+    throw tokenlessError('invalid_visible_attachment', 'Attachment id is invalid.')
+  }
+  if (typeof input.name !== 'string' || input.name.length < 1 || Buffer.byteLength(input.name, 'utf8') > 255 || /[/\\\u0000-\u001f\u007f]/.test(input.name)) {
+    throw tokenlessError('invalid_visible_attachment', 'Attachment name is invalid.')
+  }
+  if (typeof input.type !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]{0,126}\/[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]{0,126}$/.test(input.type)) {
+    throw tokenlessError('invalid_visible_attachment', 'Attachment media type is invalid.')
+  }
+  if (typeof input.size !== 'number' || !Number.isSafeInteger(input.size) || input.size < 0 || input.size > 512 * 1024 * 1024) {
+    throw tokenlessError('invalid_visible_attachment', 'Attachment size is invalid.')
+  }
+  if (typeof input.sha256 !== 'string' || !/^[a-f0-9]{64}$/.test(input.sha256)) {
+    throw tokenlessError('invalid_visible_attachment', 'Attachment sha256 is invalid.')
+  }
+  return input as AttachmentInput
+}
+
+function defineAction<Action extends VisibleAction>(
+  definition: VisibleActionCatalogDefinition<Action>
+): VisibleActionCatalogDefinition<Action> {
+  return Object.freeze(definition)
+}
+
+function validateEmptyPayload(payload: Record<string, unknown>): EmptyVisibleActionPayload {
+  requireExactKeys(payload, [], 'invalid_visible_action_payload')
+  return payload as EmptyVisibleActionPayload
+}
+
+function validateSelectionPayload(payload: Record<string, unknown>): VisibleSelectionPayload {
+  requireExactKeys(payload, ['label'], 'invalid_visible_action_payload')
+  validateVisibleLabel(payload.label)
+  return payload as VisibleSelectionPayload
+}
+
+function validateQwenModeSelectionPayload(payload: Record<string, unknown>): QwenModeSelectionPayload {
+  const keys = Object.keys(payload)
+  if (
+    (keys.length !== 1 && keys.length !== 2) ||
+    !Object.hasOwn(payload, 'mode') ||
+    keys.some((key) => key !== 'mode' && key !== 'variant')
+  ) {
+    throw tokenlessError('invalid_visible_action_payload', 'Expected exact keys: mode, optional variant.')
+  }
+  validateVisibleLabel(payload.mode)
+  if (Object.hasOwn(payload, 'variant')) validateVisibleLabel(payload.variant)
+  return payload as QwenModeSelectionPayload
+}
+
+function validateDeepSeekModeSelectionPayload(payload: Record<string, unknown>): DeepSeekModeSelectionPayload {
+  requireExactKeys(payload, ['mode'], 'invalid_visible_action_payload')
+  if (payload.mode !== 'Instant' && payload.mode !== 'Expert' && payload.mode !== 'Vision') {
+    throw tokenlessError('invalid_visible_action_payload', 'DeepSeek mode must be Instant, Expert, or Vision.')
+  }
+  return payload as DeepSeekModeSelectionPayload
+}
+
+function validateDeepSeekToggleSelectionPayload(payload: Record<string, unknown>): DeepSeekToggleSelectionPayload {
+  requireExactKeys(payload, ['enabled'], 'invalid_visible_action_payload')
+  if (typeof payload.enabled !== 'boolean') {
+    throw tokenlessError('invalid_visible_action_payload', 'DeepSeek toggle enabled must be a boolean.')
+  }
+  return payload as DeepSeekToggleSelectionPayload
+}
+
+function validateDoubaoModeSelectionPayload(payload: Record<string, unknown>): DoubaoModeSelectionPayload {
+  requireExactKeys(payload, ['mode'], 'invalid_visible_action_payload')
+  if (
+    payload.mode !== 'fast' &&
+    payload.mode !== 'expert' &&
+    payload.mode !== 'work-task-turbo' &&
+    payload.mode !== 'work-task-pro'
+  ) {
+    throw tokenlessError(
+      'invalid_visible_action_payload',
+      'Doubao mode must be fast, expert, work-task-turbo, or work-task-pro.',
+    )
+  }
+  return payload as DoubaoModeSelectionPayload
+}
+
+function validateDoubaoSkillSelectionPayload(payload: Record<string, unknown>): DoubaoSkillSelectionPayload {
+  requireExactKeys(payload, ['skill'], 'invalid_visible_action_payload')
+  if (!DOUBAO_SKILLS.has(String(payload.skill))) {
+    throw tokenlessError('invalid_visible_action_payload', 'Doubao skill is not recognized.')
+  }
+  return payload as DoubaoSkillSelectionPayload
+}
+
+const DOUBAO_SKILLS = new Set([
+  'chat',
+  'document-writing',
+  'presentation-generation',
+  'image-generation',
+  'video-generation',
+  'deep-research',
+  'audio-podcast',
+  'music-generation',
+  'problem-solving',
+  'spreadsheet-generation',
+  'audio-transcription',
+])
+
+function validateFileUploadPayload(payload: Record<string, unknown>): FileUploadPayload {
+  requireExactKeys(payload, ['attachments'], 'invalid_visible_action_payload')
+  if (!Array.isArray(payload.attachments) || payload.attachments.length < 1 || payload.attachments.length > 100) {
+    throw tokenlessError('invalid_visible_attachment', 'File upload requires one to one hundred attachments.')
+  }
+  for (const attachment of payload.attachments) validateAttachmentInput(attachment)
+  return payload as FileUploadPayload
+}
+
+function validateWorkspaceEnsurePayload(payload: Record<string, unknown>): WorkspaceEnsurePayload {
+  const keys = Object.keys(payload)
+  const expected = new Set(['name', 'mode', 'instructions'])
+  if (
+    (keys.length !== 2 && keys.length !== 3) ||
+    !keys.every((key) => expected.has(key)) ||
+    !Object.hasOwn(payload, 'name') ||
+    !Object.hasOwn(payload, 'mode')
+  ) {
+    throw tokenlessError('invalid_visible_action_payload', 'Expected exact keys: name, mode, optional instructions.')
+  }
+  validateWorkspaceText(payload.name, 'invalid_visible_workspace_name', 'Workspace name is invalid or too large.')
+  if (payload.mode !== 'auto' && payload.mode !== 'native' && payload.mode !== 'conversation') {
+    throw tokenlessError('invalid_visible_workspace_mode', 'Workspace ensure mode is invalid.')
+  }
+  if (Object.hasOwn(payload, 'instructions')) {
+    validateWorkspaceText(payload.instructions, 'invalid_visible_workspace_instructions', 'Workspace instructions are invalid or too large.')
+  }
+  return payload as WorkspaceEnsurePayload
+}
+
+function validatePromptInputPayload(payload: Record<string, unknown>): PromptInputPayload {
+  requireExactKeys(payload, ['text'], 'invalid_visible_action_payload')
+  if (typeof payload.text !== 'string' || Buffer.byteLength(payload.text, 'utf8') > 1024 * 1024) {
+    throw tokenlessError('invalid_visible_prompt', 'Prompt text is invalid or too large.')
+  }
+  return payload as PromptInputPayload
+}
+
+function validateWorkspaceText(value: unknown, code: string, message: string) {
+  if (
+    typeof value !== 'string' ||
+    !/\S/u.test(value) ||
+    Buffer.byteLength(value, 'utf8') > 32 * 1024 ||
+    /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/.test(value)
+  ) {
+    throw tokenlessError(code, message)
+  }
+}
+
+function validateVisibleLabel(value: unknown) {
+  if (typeof value !== 'string' || !/\S/u.test(value) || Buffer.byteLength(value, 'utf8') > 512) {
+    throw tokenlessError('invalid_visible_label', 'Visible selection label is invalid.')
+  }
+  if (/[\u0000-\u001f\u007f]/.test(value)) {
+    throw tokenlessError('invalid_visible_label', 'Visible selection label contains control characters.')
+  }
+}
+
+function requireExactKeys(record: Record<string, unknown>, keys: readonly string[], code: string) {
+  const expected = new Set(keys)
+  const actual = Object.keys(record)
+  if (actual.length !== expected.size || actual.some((key) => !expected.has(key))) {
+    throw tokenlessError(code, `Expected exact keys: ${keys.join(', ') || '(none)'}.`)
+  }
+}
+
+function isPlainRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value && typeof value === 'object' && !Array.isArray(value))
+}
diff --git a/packages/cli/src/providers/base-provider.ts b/packages/cli/src/providers/base-provider.ts
new file mode 100644
index 0000000..38c43a4
--- /dev/null
+++ b/packages/cli/src/providers/base-provider.ts
@@ -0,0 +1,354 @@
+import { VISIBLE_ACTIONS } from './contracts.js'
+import { ProviderCapabilityFailure, ProviderCapabilitySet } from './capability-set.js'
+import { isVisibleAction } from './action-catalog.js'
+import {
+  hasVisibleDomComposer,
+  inspectDomProviderAccount,
+  inspectDomProviderBlockers,
+  inspectProviderWorkflowCapability,
+  resolveDomProviderSession,
+} from './capabilities/session.js'
+import { inputDomPrompt, submitDomPrompt } from './capabilities/prompt.js'
+import {
+  legacyDomResponsePreparationFromBaseline,
+  observeDomResponseCompletion,
+  observeDomResponseAction,
+  observeDomResponseCursor,
+  prepareDomResponseCursor,
+  readDomResponse,
+  validateDomResponsePreparation,
+} from './capabilities/response.js'
+import { createProviderOptionalCapabilities } from './provider-definition.js'
+import { errorResponse } from '../playwright/errors.js'
+import type { Page } from 'playwright-core'
+import type { InspectableProviderActionCapability, ProviderCapability } from './capability-set.js'
+import type { ProviderActionObservation, ProviderActionPreparation, VisibleActionRequest } from './contracts.js'
+import type { ProviderExecutionContext } from './execution-context.js'
+import type { ProviderDomDefinition, ProviderOptionalCapabilityOverrides } from './provider-definition.js'
+import type { ProviderCapabilityId, ProviderId } from './provider-identity.js'
+import type { ResponseCursorObservation } from './capabilities/response.js'
+import type { AuthStatusResult, BlockerCheckResult, VisibleActionResponse, VisibleActionResult } from '../playwright/actions.js'
+import type { ProviderSessionResolution } from '../playwright/provider-session/types.js'
+
+export type BaseProviderCapabilities = ProviderOptionalCapabilityOverrides & Readonly<{
+  extensions?: readonly ProviderCapability[]
+}>
+
+type PromptActionRequest = Extract<VisibleActionRequest, {
+  action:
+    | typeof VISIBLE_ACTIONS.PROMPT_INPUT
+    | typeof VISIBLE_ACTIONS.PROMPT_CLEAR
+    | typeof VISIBLE_ACTIONS.PROMPT_SUBMIT
+}>
+
+export abstract class BaseProvider<TId extends ProviderId = ProviderId> {
+  protected readonly definition: ProviderDomDefinition<TId>
+  private readonly providerCapabilities: ProviderCapabilitySet
+
+  protected constructor(definition: ProviderDomDefinition<TId>, capabilities: BaseProviderCapabilities = {}) {
+    this.definition = definition
+    const { extensions = [], ...overrides } = capabilities
+    const optionalCapabilities = [
+      ...createProviderOptionalCapabilities(definition, overrides),
+      ...extensions,
+    ]
+    assertNoReservedOptionalCapabilities(optionalCapabilities)
+    this.providerCapabilities = new ProviderCapabilitySet(optionalCapabilities)
+  }
+
+  get id() {
+    return this.definition.id
+  }
+
+  get descriptor() {
+    return this.definition.descriptor
+  }
+
+  get navigation() {
+    return this.definition.navigationPolicy
+  }
+
+  resolveSession(
+    page: Page,
+    options: { waitForReadyMs?: number, signal?: AbortSignal } = {},
+  ) {
+    return this.resolveProviderSession(page, options)
+  }
+
+  prepareState(page: Page, options: { signal?: AbortSignal } = {}) {
+    return this.inspectAccount(page, options.signal)
+  }
+
+  captureResponseCursor(page: Page) {
+    return this.prepareResponseCursor(page)
+  }
+
+  observeResponse(page: Page): Promise<ResponseCursorObservation> {
+    return this.observeResponseCursor(page)
+  }
+
+  async inspectCapabilities(page: Page) {
+    const workflow = await this.inspectWorkflowCapability(page)
+    const optional = await this.providerCapabilities.inspectAll(page)
+    return {
+      visibleProof: 'provider-capability-registry',
+      capabilities: {
+        [workflow.capability]: workflow.inspection,
+        ...optional,
+      },
+    }
+  }
+
+  hasVisibleComposer(page: Page) {
+    return this.inspectVisibleComposer(page)
+  }
+
+  declaredCapabilityAvailability(capability: ProviderCapabilityId) {
+    return this.definition.capabilities[capability].availability
+  }
+
+  prepareAction(page: Page, request: VisibleActionRequest): Promise<ProviderActionPreparation | null> {
+    if (request.action === VISIBLE_ACTIONS.PROMPT_SUBMIT) return this.prepareResponseCursor(page)
+    return Promise.resolve(null)
+  }
+
+  validatePreparation(
+    preparation: ProviderActionPreparation,
+    expected: { action: VisibleActionRequest['action'] },
+  ): ProviderActionPreparation {
+    if (expected.action === VISIBLE_ACTIONS.RESPONSE_READ) {
+      this.validateResponsePreparation(preparation)
+      return preparation
+    }
+    throw new Error(`Provider action preparation is not supported for action: ${expected.action}`)
+  }
+
+  observeAction(
+    page: Page,
+    request: VisibleActionRequest,
+    preparation: ProviderActionPreparation,
+  ): Promise<ProviderActionObservation> {
+    if (request.action === VISIBLE_ACTIONS.RESPONSE_READ) return this.observeResponseAction(page, preparation)
+    throw new Error(`Provider action observation is not supported for action: ${request.action}`)
+  }
+
+  observeCompletion(page: Page, baseline: number) {
+    return this.observeResponseCompletion(page, baseline)
+  }
+
+  legacyResponsePreparationFromBaseline(baseline: number): ProviderActionPreparation {
+    return this.createLegacyResponsePreparation(baseline)
+  }
+
+  async executeAction(
+    page: Page,
+    request: VisibleActionRequest,
+    context: ProviderExecutionContext,
+  ): Promise<VisibleActionResponse> {
+    assertNotAborted(context.signal)
+    if (request.provider !== this.id) {
+      return failure(request, 'provider_mismatch', 'The action provider does not match this provider.', false)
+    }
+    const pageUrl = page.url()
+    const navigation = this.navigation.assertCurrentPageAllowed(pageUrl)
+    if (!navigation && request.action !== VISIBLE_ACTIONS.NAVIGATION_CHECK) {
+      const trustedSignIn = this.navigation.classify(pageUrl)
+      if (trustedSignIn.kind === 'trusted_sign_in') {
+        if (request.action === VISIBLE_ACTIONS.AUTH_STATUS) {
+          return success(request, {
+            state: 'unauthenticated',
+            access: 'sign_in_required',
+            visibleProof: 'provider-sign-in-navigation',
+          })
+        }
+        return failure(request, 'provider_sign_in_navigation', 'Provider sign-in navigation is visible and requires the user.', true)
+      }
+      return failure(request, 'unsupported_provider_navigation', 'The visible page is outside the approved provider origin.', false)
+    }
+    try {
+      if (request.action === VISIBLE_ACTIONS.AUTH_STATUS) {
+        return success(request, await this.inspectAccount(page, context.signal))
+      }
+      if (request.action === VISIBLE_ACTIONS.CAPABILITY_INSPECT) {
+        return success(request, await this.inspectCapabilities(page))
+      }
+      if (request.action === VISIBLE_ACTIONS.BLOCKER_CHECK) {
+        return success(request, await this.inspectBlockers(page))
+      }
+      if (
+        request.action === VISIBLE_ACTIONS.PROMPT_INPUT ||
+        request.action === VISIBLE_ACTIONS.PROMPT_CLEAR ||
+        request.action === VISIBLE_ACTIONS.PROMPT_SUBMIT
+      ) {
+        return success(request, await this.executePromptAction(page, request, context))
+      }
+      if (request.action === VISIBLE_ACTIONS.RESPONSE_READ) {
+        return success(request, await this.readResponse(page, context))
+      }
+      if (this.providerCapabilities.supports(request.action)) {
+        return success(request, await this.providerCapabilities.execute(page, request, context))
+      }
+      if (isVisibleAction(request.action)) {
+        return failure(request, 'visible_action_unavailable', 'Visible action is unavailable for this provider.', false)
+      }
+      return failure(request, 'unknown_visible_action', 'Visible action is not supported.', false)
+    } catch (error) {
+      if (error instanceof ProviderCapabilityFailure) {
+        return failure(request, error.code, error.message, error.retryable)
+      }
+      const response = errorResponse(error)
+      return failure(request, response.code, response.message, response.retryable)
+    }
+  }
+
+  protected resolveProviderSession(
+    page: Page,
+    options: { waitForReadyMs?: number, signal?: AbortSignal } = {},
+  ): Promise<ProviderSessionResolution> {
+    return resolveDomProviderSession(this.definition, page, options)
+  }
+
+  protected inspectAccount(page: Page, signal: AbortSignal | undefined): Promise<AuthStatusResult> {
+    return inspectDomProviderAccount(this.definition, page, signal)
+  }
+
+  inspectBlockers(page: Page): Promise<BlockerCheckResult> {
+    return inspectDomProviderBlockers(this.definition, page)
+  }
+
+  protected inspectVisibleComposer(page: Page): Promise<boolean> {
+    return hasVisibleDomComposer(this.definition, page)
+  }
+
+  protected async inspectWorkflowCapability(_page: Page): Promise<{
+    capability: ProviderCapabilityId
+    inspection: Awaited<ReturnType<typeof inspectProviderWorkflowCapability>>
+  }> {
+    const inspection = await inspectProviderWorkflowCapability(this.definition)
+    return {
+      capability: inspection.capability,
+      inspection,
+    }
+  }
+
+  protected inputPrompt(page: Page, text: string, _context: ProviderExecutionContext): Promise<VisibleActionResult> {
+    return inputDomPrompt(this.definition, page, text)
+  }
+
+  protected async clearPrompt(page: Page, context: ProviderExecutionContext): Promise<VisibleActionResult> {
+    await this.inputPrompt(page, '', context)
+    return {
+      visible: true as const,
+      inputProof: 'empty',
+    }
+  }
+
+  protected submitPrompt(page: Page, _context: ProviderExecutionContext): Promise<VisibleActionResult> {
+    return submitDomPrompt(this.definition, page)
+  }
+
+  protected prepareResponseCursor(page: Page): Promise<ProviderActionPreparation<typeof VISIBLE_ACTIONS.RESPONSE_READ>> {
+    return prepareDomResponseCursor(this.definition, page)
+  }
+
+  protected observeResponseCursor(page: Page): Promise<ResponseCursorObservation> {
+    return observeDomResponseCursor(this.definition, page)
+  }
+
+  protected validateResponsePreparation(preparation: unknown) {
+    return validateDomResponsePreparation(this.definition, preparation)
+  }
+
+  protected observeResponseAction(
+    page: Page,
+    preparation: ProviderActionPreparation,
+  ): Promise<ProviderActionObservation> {
+    return observeDomResponseAction(this.definition, page, preparation)
+  }
+
+  protected observeResponseCompletion(page: Page, baseline: number): Promise<boolean> {
+    return observeDomResponseCompletion(this.definition, page, baseline)
+  }
+
+  protected createLegacyResponsePreparation(baseline: number): ProviderActionPreparation<typeof VISIBLE_ACTIONS.RESPONSE_READ> {
+    return legacyDomResponsePreparationFromBaseline(this.definition, baseline)
+  }
+
+  protected readResponse(page: Page, _context: ProviderExecutionContext): Promise<VisibleActionResult> {
+    return readDomResponse(this.definition, page)
+  }
+
+  private executePromptAction(
+    page: Page,
+    request: PromptActionRequest,
+    context: ProviderExecutionContext,
+  ): Promise<VisibleActionResult> {
+    if (request.action === VISIBLE_ACTIONS.PROMPT_INPUT) return this.inputPrompt(page, request.payload.text, context)
+    if (request.action === VISIBLE_ACTIONS.PROMPT_CLEAR) return this.clearPrompt(page, context)
+    return this.submitPrompt(page, context)
+  }
+}
+
+const RESERVED_ACTIONS: ReadonlySet<VisibleActionRequest['action']> = new Set([
+  VISIBLE_ACTIONS.AUTH_STATUS,
+  VISIBLE_ACTIONS.CAPABILITY_INSPECT,
+  VISIBLE_ACTIONS.BLOCKER_CHECK,
+  VISIBLE_ACTIONS.PROMPT_INPUT,
+  VISIBLE_ACTIONS.PROMPT_CLEAR,
+  VISIBLE_ACTIONS.PROMPT_SUBMIT,
+  VISIBLE_ACTIONS.RESPONSE_READ,
+])
+
+const RESERVED_CAPABILITIES: ReadonlySet<ProviderCapabilityId> = new Set([
+  VISIBLE_ACTIONS.CAPABILITY_INSPECT,
+])
+
+function assertNoReservedOptionalCapabilities(capabilities: readonly ProviderCapability[]) {
+  for (const capability of capabilities) {
+    if (RESERVED_CAPABILITIES.has(capability.capability)) {
+      throw new Error(`Provider optional capability cannot use reserved capability id: ${capability.capability}`)
+    }
+    if (!isProviderActionCapability(capability)) continue
+    for (const action of capability.actions) {
+      if (RESERVED_ACTIONS.has(action)) {
+        throw new Error(`Provider optional capability ${capability.capability} cannot own reserved action: ${action}`)
+      }
+    }
+  }
+}
+
+function isProviderActionCapability(capability: ProviderCapability): capability is InspectableProviderActionCapability {
+  return 'actions' in capability && 'execute' in capability
+}
+
+function success(request: VisibleActionRequest, result: VisibleActionResult): VisibleActionResponse {
+  return {
+    protocol: request.protocol,
+    requestId: request.requestId,
+    provider: request.provider,
+    action: request.action,
+    ok: true,
+    result,
+    error: null,
+  }
+}
+
+function failure(request: VisibleActionRequest, code: string, message: string, retryable: boolean): VisibleActionResponse {
+  return {
+    protocol: request.protocol,
+    requestId: request.requestId,
+    provider: request.provider,
+    action: request.action,
+    ok: false,
+    result: null,
+    error: {
+      code,
+      message,
+      retryable,
+    },
+  }
+}
+
+function assertNotAborted(signal: AbortSignal | undefined) {
+  if (signal?.aborted) throw signal.reason instanceof Error ? signal.reason : new Error('Visible provider action was aborted.')
+}
diff --git a/packages/cli/src/providers/capabilities/deepseek-controls.ts b/packages/cli/src/providers/capabilities/deepseek-controls.ts
new file mode 100644
index 0000000..26655c0
--- /dev/null
+++ b/packages/cli/src/providers/capabilities/deepseek-controls.ts
@@ -0,0 +1,329 @@
+import { PROVIDER_CAPABILITIES } from '../provider-identity.js'
+import { VISIBLE_ACTIONS } from '../contracts.js'
+import { DomAttachmentCapability } from './dom-attachment.js'
+import { providerCapabilityFailure } from '../capability-set.js'
+import type { Locator, Page } from 'playwright-core'
+import type { ProviderActionCapability } from '../capability-set.js'
+import type { VisibleActionRequest, DeepSeekMode } from '../contracts.js'
+import type { ProviderExecutionContext } from '../execution-context.js'
+import type { ProviderDomDefinition } from '../provider-definition.js'
+import type {
+  DeepSeekModeChoice,
+  DeepSeekModeInspectResult,
+  DeepSeekModeSelectResult,
+  DeepSeekToggleInspectResult,
+  DeepSeekToggleSelectResult,
+  ProviderCapabilityInspection,
+  FileUploadResult,
+} from '../../playwright/actions.js'
+
+const DEEPSEEK_MODES = Object.freeze(['Instant', 'Expert', 'Vision'] as const)
+const CONTROL_TIMEOUT_MS = 5_000
+const CONTROL_SETTLE_TIMEOUT_MS = 10_000
+
+const MODE_CONTROLS: Readonly<Record<DeepSeekMode, DeepSeekModeChoice['controls']>> = Object.freeze({
+  Instant: Object.freeze({ deepThink: true, search: true, fileUpload: true, imageFileSelection: true }),
+  Expert: Object.freeze({ deepThink: true, search: false, fileUpload: false, imageFileSelection: false }),
+  Vision: Object.freeze({ deepThink: true, search: false, fileUpload: true, imageFileSelection: true }),
+})
+
+type ModeAction =
+  | typeof VISIBLE_ACTIONS.DEEPSEEK_MODE_INSPECT
+  | typeof VISIBLE_ACTIONS.DEEPSEEK_MODE_SELECT
+
+type ToggleAction =
+  | typeof VISIBLE_ACTIONS.DEEPSEEK_DEEPTHINK_INSPECT
+  | typeof VISIBLE_ACTIONS.DEEPSEEK_DEEPTHINK_SELECT
+  | typeof VISIBLE_ACTIONS.DEEPSEEK_SEARCH_INSPECT
+  | typeof VISIBLE_ACTIONS.DEEPSEEK_SEARCH_SELECT
+
+export class DeepSeekAttachmentCapability implements ProviderActionCapability<typeof VISIBLE_ACTIONS.FILE_UPLOAD> {
+  readonly capability = PROVIDER_CAPABILITIES.FILE_UPLOAD
+  readonly actions = Object.freeze([VISIBLE_ACTIONS.FILE_UPLOAD])
+  private readonly delegate: DomAttachmentCapability
+  private readonly provider: ProviderDomDefinition<'deepseek'>
+
+  constructor(provider: ProviderDomDefinition<'deepseek'>) {
+    this.provider = provider
+    this.delegate = new DomAttachmentCapability(provider)
+  }
+
+  async inspect(page: Page): Promise<ProviderCapabilityInspection> {
+    const activeMode = await readActiveMode(page)
+    if (activeMode !== 'Expert') return await this.delegate.inspect(page)
+    const strategy = this.provider.capabilities[this.capability]
+    return {
+      ...strategy,
+      actions: this.actions,
+      availability: 'unavailable',
+      visibleProof: 'deepseek-expert-mode-selected-without-file-control',
+      reason: 'deepseek_file_upload_unavailable_in_expert_mode',
+      native: {
+        ...strategy.native,
+        availability: 'unavailable',
+        visibleProof: 'deepseek-expert-mode-selected-without-file-control',
+        reason: 'deepseek_file_upload_unavailable_in_expert_mode',
+      },
+    }
+  }
+
+  async execute(
+    page: Page,
+    request: Extract<VisibleActionRequest, { action: typeof VISIBLE_ACTIONS.FILE_UPLOAD }>,
+    context: ProviderExecutionContext,
+  ): Promise<FileUploadResult> {
+    if (await readActiveMode(page) === 'Expert') {
+      throw providerCapabilityFailure(
+        'deepseek_file_upload_unavailable_in_expert_mode',
+        'DeepSeek file upload is unavailable while Expert mode is selected.',
+        { retryable: false },
+      )
+    }
+    return await this.delegate.execute(page, request, context)
+  }
+}
+
+export class DeepSeekModeCapability implements ProviderActionCapability<ModeAction> {
+  readonly capability = PROVIDER_CAPABILITIES.DEEPSEEK_MODE
+  readonly actions = Object.freeze([
+    VISIBLE_ACTIONS.DEEPSEEK_MODE_INSPECT,
+    VISIBLE_ACTIONS.DEEPSEEK_MODE_SELECT,
+  ])
+  private readonly provider: ProviderDomDefinition<'deepseek'>
+
+  constructor(provider: ProviderDomDefinition<'deepseek'>) {
+    this.provider = provider
+  }
+
+  async inspect(page: Page): Promise<ProviderCapabilityInspection> {
+    return capabilityInspection(
+      this.provider,
+      this.capability,
+      this.actions,
+      await readActiveMode(page) !== null,
+      'visible-deepseek-mode-controls',
+      'visible_deepseek_mode_controls_not_observed',
+    )
+  }
+
+  async execute(
+    page: Page,
+    request: Extract<VisibleActionRequest, { action: ModeAction }>,
+    context: ProviderExecutionContext,
+  ): Promise<DeepSeekModeInspectResult | DeepSeekModeSelectResult> {
+    if (request.action === VISIBLE_ACTIONS.DEEPSEEK_MODE_INSPECT) {
+      return await inspectModes(page)
+    }
+    return await selectMode(page, request.payload.mode, context.signal)
+  }
+}
+
+export class DeepSeekToggleCapability implements ProviderActionCapability<ToggleAction> {
+  readonly capability: typeof PROVIDER_CAPABILITIES.DEEPSEEK_DEEPTHINK | typeof PROVIDER_CAPABILITIES.DEEPSEEK_SEARCH
+  readonly actions: readonly ToggleAction[]
+  private readonly provider: ProviderDomDefinition<'deepseek'>
+  private readonly label: 'DeepThink' | 'Search'
+
+  constructor(provider: ProviderDomDefinition<'deepseek'>, label: 'DeepThink' | 'Search') {
+    this.provider = provider
+    this.label = label
+    this.capability = label === 'DeepThink'
+      ? PROVIDER_CAPABILITIES.DEEPSEEK_DEEPTHINK
+      : PROVIDER_CAPABILITIES.DEEPSEEK_SEARCH
+    this.actions = label === 'DeepThink'
+      ? Object.freeze([
+        VISIBLE_ACTIONS.DEEPSEEK_DEEPTHINK_INSPECT,
+        VISIBLE_ACTIONS.DEEPSEEK_DEEPTHINK_SELECT,
+      ])
+      : Object.freeze([
+        VISIBLE_ACTIONS.DEEPSEEK_SEARCH_INSPECT,
+        VISIBLE_ACTIONS.DEEPSEEK_SEARCH_SELECT,
+      ])
+  }
+
+  async inspect(page: Page): Promise<ProviderCapabilityInspection> {
+    const control = await visibleToggle(page, this.label)
+    return capabilityInspection(
+      this.provider,
+      this.capability,
+      this.actions,
+      control !== null,
+      `visible-deepseek-${this.label.toLowerCase()}-control`,
+      this.label === 'Search'
+        ? 'visible_deepseek_search_control_not_observed_in_active_mode'
+        : 'visible_deepseek_deepthink_control_not_observed',
+    )
+  }
+
+  async execute(
+    page: Page,
+    request: Extract<VisibleActionRequest, { action: ToggleAction }>,
+    context: ProviderExecutionContext,
+  ): Promise<DeepSeekToggleInspectResult | DeepSeekToggleSelectResult> {
+    if (
+      request.action === VISIBLE_ACTIONS.DEEPSEEK_DEEPTHINK_INSPECT ||
+      request.action === VISIBLE_ACTIONS.DEEPSEEK_SEARCH_INSPECT
+    ) {
+      return await inspectToggle(page, this.label)
+    }
+    return await selectToggle(page, this.label, request.payload.enabled, context.signal)
+  }
+}
+
+async function inspectModes(page: Page): Promise<DeepSeekModeInspectResult> {
+  const activeMode = await readActiveMode(page)
+  if (!activeMode) return { supported: false, reason: 'selector_not_available' }
+  const modes = await Promise.all(DEEPSEEK_MODES.map(async (mode): Promise<DeepSeekModeChoice> => ({
+    mode,
+    enabled: await visibleMode(page, mode) !== null,
+    selected: mode === activeMode,
+    controls: MODE_CONTROLS[mode],
+  })))
+  return { supported: true, activeMode, modes }
+}
+
+async function selectMode(
+  page: Page,
+  mode: DeepSeekMode,
+  signal: AbortSignal | undefined,
+): Promise<DeepSeekModeSelectResult> {
+  assertNotAborted(signal)
+  const control = await visibleMode(page, mode)
+  if (!control) return { supported: false, reason: 'exact_mode_not_found' }
+  if (await control.getAttribute('aria-checked') !== 'true') {
+    await control.click({ timeout: CONTROL_TIMEOUT_MS })
+  }
+  const selected = await waitForMode(page, mode, signal)
+  if (!selected) return { supported: false, reason: 'selector_not_available' }
+  return {
+    supported: true,
+    selectedMode: mode,
+    visibleProof: 'deepseek-mode-radio-selected',
+  }
+}
+
+async function inspectToggle(page: Page, label: 'DeepThink' | 'Search'): Promise<DeepSeekToggleInspectResult> {
+  const activeMode = await readActiveMode(page)
+  if (!activeMode) return { supported: false, activeMode: null, reason: 'selector_not_available' }
+  const control = await visibleToggle(page, label)
+  if (!control) {
+    return {
+      supported: false,
+      activeMode,
+      reason: activeMode && !modeSupportsToggle(activeMode, label)
+        ? 'unavailable_in_mode'
+        : 'selector_not_available',
+    }
+  }
+  return {
+    supported: true,
+    activeMode,
+    enabled: await control.getAttribute('aria-pressed') === 'true',
+  }
+}
+
+async function selectToggle(
+  page: Page,
+  label: 'DeepThink' | 'Search',
+  enabled: boolean,
+  signal: AbortSignal | undefined,
+): Promise<DeepSeekToggleSelectResult> {
+  assertNotAborted(signal)
+  const activeMode = await readActiveMode(page)
+  if (!activeMode) return { supported: false, activeMode: null, reason: 'selector_not_available' }
+  const control = await visibleToggle(page, label)
+  if (!control) {
+    return {
+      supported: false,
+      activeMode,
+      reason: activeMode && !modeSupportsToggle(activeMode, label)
+        ? 'unavailable_in_mode'
+        : 'selector_not_available',
+    }
+  }
+  if ((await control.getAttribute('aria-pressed') === 'true') !== enabled) {
+    await control.click({ timeout: CONTROL_TIMEOUT_MS })
+  }
+  const settled = await waitForToggle(page, control, enabled, signal)
+  if (!settled) return { supported: false, activeMode, reason: 'selector_not_available' }
+  return {
+    supported: true,
+    activeMode,
+    enabled,
+    visibleProof: `deepseek-${label.toLowerCase()}-toggle-${enabled ? 'enabled' : 'disabled'}`,
+  }
+}
+
+async function readActiveMode(page: Page): Promise<DeepSeekMode | null> {
+  for (const mode of DEEPSEEK_MODES) {
+    const control = await visibleMode(page, mode)
+    if (control && await control.getAttribute('aria-checked') === 'true') return mode
+  }
+  return null
+}
+
+async function visibleMode(page: Page, mode: DeepSeekMode): Promise<Locator | null> {
+  const control = page.getByRole('radio', { name: mode, exact: true }).filter({ visible: true }).first()
+  return await control.isVisible({ timeout: 250 }).catch(() => false) ? control : null
+}
+
+async function visibleToggle(page: Page, label: 'DeepThink' | 'Search'): Promise<Locator | null> {
+  const control = page.locator('.ds-toggle-button').filter({ visible: true }).filter({ hasText: new RegExp(`^${label}$`) }).first()
+  return await control.isVisible({ timeout: 250 }).catch(() => false) ? control : null
+}
+
+async function waitForMode(page: Page, mode: DeepSeekMode, signal: AbortSignal | undefined) {
+  const deadline = Date.now() + CONTROL_SETTLE_TIMEOUT_MS
+  do {
+    assertNotAborted(signal)
+    if (await readActiveMode(page) === mode) return true
+    if (Date.now() < deadline) await page.waitForTimeout(100)
+  } while (Date.now() < deadline)
+  return false
+}
+
+async function waitForToggle(page: Page, control: Locator, enabled: boolean, signal: AbortSignal | undefined) {
+  const deadline = Date.now() + CONTROL_SETTLE_TIMEOUT_MS
+  do {
+    assertNotAborted(signal)
+    if ((await control.getAttribute('aria-pressed').catch(() => null) === 'true') === enabled) return true
+    if (Date.now() < deadline) await page.waitForTimeout(100)
+  } while (Date.now() < deadline)
+  return false
+}
+
+function modeSupportsToggle(mode: DeepSeekMode, label: 'DeepThink' | 'Search') {
+  return label === 'DeepThink' ? MODE_CONTROLS[mode].deepThink : MODE_CONTROLS[mode].search
+}
+
+function capabilityInspection(
+  provider: ProviderDomDefinition<'deepseek'>,
+  capability: typeof PROVIDER_CAPABILITIES.DEEPSEEK_MODE | typeof PROVIDER_CAPABILITIES.DEEPSEEK_DEEPTHINK | typeof PROVIDER_CAPABILITIES.DEEPSEEK_SEARCH,
+  actions: readonly ToggleAction[] | readonly ModeAction[],
+  available: boolean,
+  visibleProof: string,
+  unavailableReason: string,
+): ProviderCapabilityInspection {
+  const strategy = provider.capabilities[capability]
+  const availability = available ? 'available' as const : 'unavailable' as const
+  const reason = available ? null : unavailableReason
+  return {
+    ...strategy,
+    actions,
+    availability,
+    visibleProof: available ? visibleProof : 'no-visible-deepseek-control',
+    reason,
+    native: {
+      ...strategy.native,
+      availability,
+      visibleProof: available ? visibleProof : null,
+      reason,
+    },
+  }
+}
+
+function assertNotAborted(signal: AbortSignal | undefined) {
+  if (signal?.aborted) {
+    throw signal.reason instanceof Error ? signal.reason : new Error('DeepSeek control action was aborted.')
+  }
+}
diff --git a/packages/cli/src/providers/capabilities/diagnostics.ts b/packages/cli/src/providers/capabilities/diagnostics.ts
new file mode 100644
index 0000000..28f8f33
--- /dev/null
+++ b/packages/cli/src/providers/capabilities/diagnostics.ts
@@ -0,0 +1,145 @@
+import { countVisibleLocators } from '../dom-locators.js'
+import { assertProviderUrlAllowed } from '../navigation-policy.js'
+import { PROVIDER_CAPABILITIES } from '../provider-identity.js'
+import { VISIBLE_ACTIONS } from '../contracts.js'
+import type { Page } from 'playwright-core'
+import type { ProviderActionCapability } from '../capability-set.js'
+import type { VisibleActionRequest } from '../contracts.js'
+import type { ProviderExecutionContext } from '../execution-context.js'
+import type { ProviderDomDefinition } from '../provider-definition.js'
+import type { NavigationCheckResult, ProviderCapabilityInspection, SnapshotResult } from '../../playwright/actions.js'
+
+type DiagnosticsAction = typeof VISIBLE_ACTIONS.NAVIGATION_CHECK | typeof VISIBLE_ACTIONS.SNAPSHOT_SANITIZED
+
+export class DiagnosticsCapability implements ProviderActionCapability<DiagnosticsAction> {
+  readonly capability = PROVIDER_CAPABILITIES.DIAGNOSTICS
+  readonly actions = Object.freeze([
+    VISIBLE_ACTIONS.NAVIGATION_CHECK,
+    VISIBLE_ACTIONS.SNAPSHOT_SANITIZED,
+  ])
+  private readonly provider: ProviderDomDefinition
+
+  constructor(provider: ProviderDomDefinition) {
+    this.provider = provider
+  }
+
+  async execute(
+    page: Page,
+    request: Extract<VisibleActionRequest, { action: DiagnosticsAction }>,
+    _context: ProviderExecutionContext,
+  ): Promise<NavigationCheckResult | SnapshotResult> {
+    if (request.action === VISIBLE_ACTIONS.NAVIGATION_CHECK) return inspectNavigation(page, this.provider)
+    return await sanitizedSnapshot(page, this.provider)
+  }
+
+  async inspect(_page: Page): Promise<ProviderCapabilityInspection> {
+    return {
+      ...this.provider.capabilities[PROVIDER_CAPABILITIES.DIAGNOSTICS],
+      actions: this.actions,
+    }
+  }
+}
+
+async function inspectNavigation(page: Page, provider: ProviderDomDefinition): Promise<NavigationCheckResult> {
+  const classification = provider.navigationPolicy.classify(page.url())
+  if (classification.kind !== 'approved') {
+    return {
+      allowed: false,
+      provider: null,
+      reason: classification.kind === 'rejected'
+        ? classification.reason
+        : 'unsupported_provider_navigation',
+    }
+  }
+  const policy = assertProviderUrlAllowed(provider, page.url())
+  return {
+    allowed: policy.ok,
+    provider: provider.id,
+    reason: policy.ok ? null : policy.reason,
+  }
+}
+
+async function sanitizedSnapshot(page: Page, provider: ProviderDomDefinition): Promise<SnapshotResult> {
+  const selectorProbes = {
+    composer: await countVisibleLocators(page, provider.composerSelectors),
+    authenticatedAccount: await countVisibleLocators(page, provider.authIndicators),
+    login: await countVisibleLocators(page, provider.loginIndicators),
+    blocker: await countVisibleLocators(page, provider.blockerSelectors),
+  }
+  return await page.evaluate((providerSnapshot) => {
+    const allowedRoles = new Set(['button', 'textbox', 'menuitem', 'option', 'combobox', 'listbox'])
+    const allowedInputTypes = new Set(['button', 'checkbox', 'email', 'file', 'number', 'password', 'radio', 'search', 'submit', 'tel', 'text', 'url'])
+    const operationalText = /^(?:log in|sign in|sign up(?: for free)?|continue(?: with email| as guest| without signing in| without an account| your conversation)?|stay in guest mode|use without an account|accept(?: all)?|i agree|agree|not now|close|dismiss|start chatting|ask anything|send message|enter your email)$/i
+    const safeOperationalText = (value: string | null) => {
+      const normalized = (value ?? '').replace(/\s+/g, ' ').trim().slice(0, 120)
+      return operationalText.test(normalized) ? normalized : undefined
+    }
+    const controls = Array.from(document.querySelectorAll('button, [role="button"], input, textarea, select, [role="textbox"], [role="menuitem"], [role="option"]'))
+      .slice(0, 80)
+      .map((element) => {
+        const tag = element.tagName.toLowerCase()
+        const rawRole = (element.getAttribute('role') ?? '').toLowerCase()
+        const role = allowedRoles.has(rawRole) ? rawRole : undefined
+        const rawInputType = tag === 'input' ? (element.getAttribute('type') ?? 'text').toLowerCase() : ''
+        const inputType = allowedInputTypes.has(rawInputType) ? rawInputType : undefined
+        const dataTestId = (element.getAttribute('data-testid') ?? '').replace(/[^A-Za-z0-9._:-]/g, '').slice(0, 100) || undefined
+        const ariaLabel = safeOperationalText(element.getAttribute('aria-label'))
+        const placeholder = safeOperationalText(element.getAttribute('placeholder'))
+        const text = safeOperationalText(element.textContent)
+        return {
+          tag: ['button', 'input', 'textarea', 'select'].includes(tag) ? tag : 'control',
+          ...(role ? { role } : {}),
+          ...(inputType ? { inputType } : {}),
+          ...(dataTestId ? { dataTestId } : {}),
+          ...(ariaLabel ? { ariaLabel } : {}),
+          ...(placeholder ? { placeholder } : {}),
+          ...(text ? { text } : {}),
+          disabled: element.hasAttribute('disabled') || element.getAttribute('aria-disabled') === 'true',
+          visible: !element.hasAttribute('hidden') && element.getAttribute('aria-hidden') !== 'true',
+        }
+      })
+    const escapeAttribute = (value: string) => value
+      .replace(/&/g, '&amp;')
+      .replace(/"/g, '&quot;')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;')
+    const html = [
+      `<tokenless-sanitized-dom provider="${escapeAttribute(providerSnapshot.id)}">`,
+      ...controls.map((control) => {
+        const attributes = [
+          `tag="${escapeAttribute(control.tag)}"`,
+          ...(control.role ? [`role="${escapeAttribute(control.role)}"`] : []),
+          ...(control.inputType ? [`input-type="${escapeAttribute(control.inputType)}"`] : []),
+          ...(control.dataTestId ? [`data-testid="${escapeAttribute(control.dataTestId)}"`] : []),
+          ...(control.ariaLabel ? [`aria-label="${escapeAttribute(control.ariaLabel)}"`] : []),
+          ...(control.placeholder ? [`placeholder="${escapeAttribute(control.placeholder)}"`] : []),
+          ...(control.text ? [`text="${escapeAttribute(control.text)}"`] : []),
+          `disabled="${control.disabled ? 'true' : 'false'}"`,
+          `visible="${control.visible ? 'true' : 'false'}"`,
+        ]
+        return `  <control ${attributes.join(' ')} />`
+      }),
+      '</tokenless-sanitized-dom>',
+    ].join('\n')
+    const currentUrl = new URL(location.href)
+    return {
+      status: 'snapshotted' as const,
+      provider: providerSnapshot.id,
+      capturedAt: new Date().toISOString(),
+      url: currentUrl.origin,
+      title: providerSnapshot.label,
+      sanitized: true as const,
+      includeText: false as const,
+      html,
+      selectorProbes: providerSnapshot.selectorProbes,
+      page: {
+        origin: location.origin,
+      },
+      controls,
+    }
+  }, {
+    id: provider.id,
+    label: provider.label,
+    selectorProbes,
+  })
+}
diff --git a/packages/cli/src/providers/capabilities/dom-attachment.ts b/packages/cli/src/providers/capabilities/dom-attachment.ts
new file mode 100644
index 0000000..ef8c467
--- /dev/null
+++ b/packages/cli/src/providers/capabilities/dom-attachment.ts
@@ -0,0 +1,387 @@
+import { createHash } from 'node:crypto'
+import { constants as fsConstants } from 'node:fs'
+import { lstat, open, realpath } from 'node:fs/promises'
+import { basename, resolve, sep } from 'node:path'
+import {
+  firstEnabledLocator,
+  firstFileInputLocator,
+  firstUnavailableLocator,
+} from '../dom-locators.js'
+import { PROVIDER_CAPABILITIES } from '../provider-identity.js'
+import { TokenlessPlaywrightError, tokenlessError } from '../../playwright/errors.js'
+import { VISIBLE_ACTIONS } from '../contracts.js'
+import { providerCapabilityFailure } from '../capability-set.js'
+import { VISIBLE_ATTACHMENT_SCHEMA_ID, validateAttachmentInput } from '../../playwright/actions.js'
+import type { FileChooser, Locator, Page } from 'playwright-core'
+import type { ProviderActionCapability } from '../capability-set.js'
+import type { VisibleActionRequest } from '../contracts.js'
+import type { ProviderExecutionContext } from '../execution-context.js'
+import type { ProviderDomDefinition } from '../provider-definition.js'
+import type { AttachmentInput, FileUploadResult, ProviderCapabilityInspection } from '../../playwright/actions.js'
+
+type AttachmentAction = typeof VISIBLE_ACTIONS.FILE_UPLOAD
+
+export class DomAttachmentCapability implements ProviderActionCapability<AttachmentAction> {
+  readonly capability = PROVIDER_CAPABILITIES.FILE_UPLOAD
+  readonly actions = Object.freeze([VISIBLE_ACTIONS.FILE_UPLOAD])
+  private readonly provider: ProviderDomDefinition
+
+  constructor(provider: ProviderDomDefinition) {
+    this.provider = provider
+  }
+
+  async execute(
+    page: Page,
+    request: Extract<VisibleActionRequest, { action: AttachmentAction }>,
+    context: ProviderExecutionContext,
+  ): Promise<FileUploadResult> {
+    return await uploadFiles(page, this.provider, request.payload.attachments, context)
+  }
+
+  async inspect(page: Page): Promise<ProviderCapabilityInspection> {
+    const strategy = this.provider.capabilities[PROVIDER_CAPABILITIES.FILE_UPLOAD]
+    const evidence = await inspectFileUploadAvailability(page, this.provider)
+    return {
+      ...strategy,
+      actions: this.actions,
+      availability: evidence.availability,
+      visibleProof: evidence.visibleProof,
+      reason: evidence.reason,
+      native: {
+        ...strategy.native,
+        availability: evidence.availability,
+        visibleProof: evidence.availability === 'unknown' ? strategy.native.visibleProof : evidence.visibleProof,
+        reason: evidence.reason,
+      },
+    }
+  }
+}
+
+async function uploadFiles(
+  page: Page,
+  provider: ProviderDomDefinition,
+  value: readonly AttachmentInput[],
+  context: ProviderExecutionContext,
+): Promise<FileUploadResult> {
+  const attachments = value.map((attachment) => validateAttachmentInput(attachment))
+  const files = await Promise.all(attachments.map((attachment) => resolveAttachmentPayload(context.attachmentRoot, attachment)))
+  const visibleEvidenceBeforeUpload = await visibleAttachmentEvidence(page, attachments)
+  let fileInput: Locator | null = null
+  const chooser = await openProviderFileChooser(page, provider)
+  if (chooser) {
+    await chooser.setFiles(files)
+  } else {
+    fileInput = await firstFileInputLocator(page, provider.fileInputSelectors)
+  }
+  if (!fileInput && !chooser) {
+    throw providerCapabilityFailure(
+      'file_upload_unavailable',
+      'No visible provider file upload control is available for this account.',
+      { retryable: false },
+    )
+  }
+  if (fileInput) {
+    await fileInput.setInputFiles(files)
+  }
+  const acceptedProof = await waitForVisibleAttachmentProof(page, attachments, visibleEvidenceBeforeUpload, context.signal)
+  if (!acceptedProof) {
+    throw providerCapabilityFailure(
+      'file_upload_unavailable',
+      'The provider did not visibly accept the selected attachment.',
+      { retryable: true },
+    )
+  }
+  return {
+    acceptance: 'accepted' as const,
+    visibleProof: acceptedProof,
+    attachments: attachments.map((attachment) => ({
+      protocol: VISIBLE_ATTACHMENT_SCHEMA_ID,
+      bundleId: attachment.bundleId,
+      attachmentId: attachment.attachmentId,
+      name: basename(attachment.name),
+      type: attachment.type,
+      size: attachment.size,
+      sha256: attachment.sha256,
+      visible: true as const,
+    })),
+  }
+}
+
+async function resolveAttachmentPayload(attachmentRoot: string | undefined, attachment: AttachmentInput) {
+  try {
+    return await resolveAttachmentPayloadUnsafe(attachmentRoot, attachment)
+  } catch (error) {
+    if (error instanceof TokenlessPlaywrightError) throw error
+    throw tokenlessError(
+      'invalid_visible_attachment',
+      'Attachment file cannot be resolved or verified.',
+      { cause: error },
+    )
+  }
+}
+
+async function openProviderFileChooser(page: Page, provider: ProviderDomDefinition): Promise<FileChooser | null> {
+  const trigger = await firstEnabledLocator(page, provider.fileUploadTriggerSelectors)
+  const waitForEvent = (page as Page & {
+    waitForEvent?: (event: 'filechooser', options?: { timeout?: number }) => Promise<FileChooser>
+  }).waitForEvent
+  if (trigger) {
+    const expanded = await trigger.getAttribute('aria-expanded').catch(() => null)
+    if (expanded !== 'true') {
+      const directChooser = typeof waitForEvent === 'function'
+        ? waitForEvent.call(page, 'filechooser', { timeout: 1000 }).catch(() => null)
+        : Promise.resolve(null)
+      await trigger.click({ timeout: 5000 }).catch(() => undefined)
+      const chooser = await directChooser
+      if (chooser) return chooser
+    }
+  }
+  const localUpload = await waitForEnabledLocator(page, provider.fileUploadLocalSelectors, 5000)
+  if (!localUpload) return null
+
+  if (typeof waitForEvent !== 'function') {
+    await localUpload.click({ timeout: 5000 }).catch(() => undefined)
+    return null
+  }
+  const chooser = waitForEvent.call(page, 'filechooser', { timeout: 5000 }).catch(() => null)
+  await localUpload.click({ timeout: 5000 }).catch(() => undefined)
+  return await chooser
+}
+
+async function waitForEnabledLocator(page: Page, selectors: readonly string[], timeoutMs: number) {
+  const deadline = Date.now() + timeoutMs
+  while (Date.now() <= deadline) {
+    const locator = await firstEnabledLocator(page, selectors)
+    if (locator) return locator
+    await waitForPageTimeout(page, 100)
+  }
+  return null
+}
+
+async function inspectFileUploadAvailability(page: Page, provider: ProviderDomDefinition) {
+  let unavailable = await firstUnavailableLocator(page, provider.fileUploadLocalSelectors)
+  if (unavailable) {
+    return {
+      availability: 'unavailable' as const,
+      visibleProof: 'visible-upload-control-disabled-or-upgrade',
+      reason: 'visible_upload_control_disabled_or_requires_upgrade',
+    }
+  }
+  const localUpload = await firstEnabledLocator(page, provider.fileUploadLocalSelectors)
+  if (localUpload) {
+    return {
+      availability: 'available' as const,
+      visibleProof: 'visible-local-upload-control-enabled',
+      reason: null,
+    }
+  }
+  const trigger = await firstEnabledLocator(page, provider.fileUploadTriggerSelectors)
+  if (trigger) {
+    const menuLike = await trigger.evaluate((element) => (
+      element.getAttribute('aria-haspopup') === 'menu' || element.hasAttribute('aria-expanded')
+    )).catch(() => false)
+    if (menuLike && await trigger.getAttribute('aria-expanded').catch(() => null) !== 'true') {
+      await trigger.click({ timeout: 5000 }).catch(() => undefined)
+    }
+    if (menuLike) {
+      await waitForPageTimeout(page, 500)
+      unavailable = await firstUnavailableLocator(page, provider.fileUploadLocalSelectors)
+      if (unavailable) {
+        return {
+          availability: 'unavailable' as const,
+          visibleProof: 'visible-upload-control-disabled-or-sign-in',
+          reason: 'visible_upload_control_disabled_or_requires_sign_in',
+        }
+      }
+      const openedLocalUpload = await firstEnabledLocator(page, provider.fileUploadLocalSelectors)
+      if (openedLocalUpload) {
+        return {
+          availability: 'available' as const,
+          visibleProof: 'visible-local-upload-control-enabled',
+          reason: null,
+        }
+      }
+    }
+    return {
+      availability: 'unknown' as const,
+      visibleProof: 'visible-upload-trigger-without-file-acceptance-control',
+      reason: 'visible_upload_trigger_does_not_prove_file_acceptance',
+    }
+  }
+  const input = await firstFileInputLocator(page, provider.fileInputSelectors)
+  if (input) {
+    return {
+      availability: 'unknown' as const,
+      visibleProof: 'hidden-file-input-present-without-visible-upload-control',
+      reason: 'hidden_file_input_is_not_visible_availability_evidence',
+    }
+  }
+  return {
+    availability: 'unknown' as const,
+    visibleProof: 'no-visible-upload-control',
+    reason: 'visible_upload_control_not_observed',
+  }
+}
+
+async function visibleAttachmentEvidence(page: Page, attachments: readonly AttachmentInput[]) {
+  const evaluate = (page as Page & {
+    evaluate?: (callback: (expectedNames: string[]) => string[], expectedNames: string[]) => Promise<unknown>
+  }).evaluate
+  if (typeof evaluate !== 'function') return new Set<string>()
+  const names = attachments.map((attachment) => basename(attachment.name))
+  const result = await evaluate.call(page, (expectedNames) => {
+    const isVisibleElement = (element: Element | null): element is HTMLElement | SVGElement => {
+      if (!element || !(element instanceof HTMLElement || element instanceof SVGElement)) return false
+      let node: Element | null = element
+      while (node && node instanceof Element) {
+        const style = window.getComputedStyle(node)
+        if (
+          style.visibility === 'hidden' ||
+          style.visibility === 'collapse' ||
+          style.display === 'none' ||
+          Number(style.opacity) === 0
+        ) return false
+        node = node.parentElement
+      }
+      const rect = element.getBoundingClientRect()
+      return rect.width > 0 && rect.height > 0
+    }
+    const selectors = [
+      '[data-testid*="attachment" i]',
+      '[data-testid*="upload" i]',
+      '[data-testid*="file" i]',
+      '[aria-label*="attachment" i]',
+      '[aria-label*="upload" i]',
+      '[aria-label*="file" i]',
+      '[class*="attachment-node-"]',
+      '[title]',
+      '[role="listitem"]',
+      '[role="status"]',
+      'li',
+    ]
+    const elements = selectors.flatMap((selector) => {
+      try {
+        return Array.from(document.querySelectorAll(selector))
+      } catch {
+        return []
+      }
+    })
+    const seen = new Set<Element>()
+    return elements
+      .filter((element) => {
+        if (seen.has(element) || !isVisibleElement(element)) return false
+        seen.add(element)
+        return true
+      })
+      .slice(0, 200)
+      .flatMap((element) => {
+        const visibleText = [
+          element.textContent ?? '',
+          element.getAttribute('aria-label') ?? '',
+          element.getAttribute('title') ?? '',
+        ].join(' ').replace(/\s+/g, ' ').trim()
+        if (!expectedNames.every((name) => visibleText.includes(name))) return []
+        const tag = element.tagName.toLowerCase()
+        const role = element.getAttribute('role') ?? ''
+        const testId = element.getAttribute('data-testid') ?? ''
+        return [`${tag}|${role}|${testId}|${visibleText.slice(0, 240)}`]
+      })
+  }, names).catch(() => [])
+  return new Set(Array.isArray(result) ? result.filter((entry): entry is string => typeof entry === 'string') : [])
+}
+
+async function visibleAttachmentProof(
+  page: Page,
+  attachments: readonly AttachmentInput[],
+  evidenceBeforeUpload: ReadonlySet<string>,
+) {
+  const evidence = await visibleAttachmentEvidence(page, attachments)
+  for (const entry of evidence) {
+    if (!evidenceBeforeUpload.has(entry)) return 'visible-attachment-filename'
+  }
+  return null
+}
+
+async function waitForVisibleAttachmentProof(
+  page: Page,
+  attachments: readonly AttachmentInput[],
+  evidenceBeforeUpload: ReadonlySet<string>,
+  signal: AbortSignal | undefined,
+) {
+  for (let attempt = 0; attempt <= 75; attempt += 1) {
+    assertNotAborted(signal)
+    const proof = await visibleAttachmentProof(page, attachments, evidenceBeforeUpload)
+    if (proof) return proof
+    if (attempt < 75) await waitForPageTimeout(page, 200)
+  }
+  return null
+}
+
+async function waitForPageTimeout(page: Page, ms: number) {
+  const waitForTimeout = (page as Page & { waitForTimeout?: (timeout: number) => Promise<void> }).waitForTimeout
+  if (typeof waitForTimeout === 'function') {
+    await waitForTimeout.call(page, ms).catch(() => undefined)
+  }
+}
+
+async function resolveAttachmentPayloadUnsafe(attachmentRoot: string | undefined, attachment: AttachmentInput) {
+  if (attachmentRoot === undefined) {
+    throw tokenlessError('invalid_visible_attachment_root', 'Attachment root is required for visible file uploads.')
+  }
+  if (attachmentRoot.includes('\u0000')) {
+    throw tokenlessError('invalid_visible_attachment_root', 'Attachment root is invalid.')
+  }
+  const root = await realpath(resolve(attachmentRoot))
+  const file = resolve(root, attachment.bundleId, `${attachment.attachmentId}.bin`)
+  if (!isPathInside(root, file)) {
+    throw tokenlessError('invalid_visible_attachment', 'Attachment path escapes the attachment root.')
+  }
+  const noFollow = fsConstants.O_NOFOLLOW ?? 0
+  let handle: Awaited<ReturnType<typeof open>> | undefined
+  try {
+    const linked = await lstat(file)
+    if (linked.isSymbolicLink() || !linked.isFile()) {
+      throw tokenlessError('invalid_visible_attachment', 'Attachment file must be a regular non-symlink file.')
+    }
+    if (Number(linked.nlink) !== 1) {
+      throw tokenlessError('invalid_visible_attachment', 'Attachment file must not have hard links.')
+    }
+    handle = await open(file, fsConstants.O_RDONLY | noFollow)
+    const opened = await handle.stat()
+    if (!opened.isFile() || opened.dev !== linked.dev || opened.ino !== linked.ino) {
+      throw tokenlessError('invalid_visible_attachment', 'Attachment file changed while it was opened.')
+    }
+    if (Number(opened.nlink) !== 1) {
+      throw tokenlessError('invalid_visible_attachment', 'Attachment file must not have hard links.')
+    }
+    if (opened.size !== attachment.size) {
+      throw tokenlessError('invalid_visible_attachment', 'Attachment file size does not match its descriptor.')
+    }
+    const realFile = await realpath(file)
+    if (!isPathInside(root, realFile)) {
+      throw tokenlessError('invalid_visible_attachment', 'Attachment path escapes the attachment root.')
+    }
+    const buffer = await handle.readFile()
+    const digest = createHash('sha256').update(buffer).digest('hex')
+    if (digest !== attachment.sha256) {
+      throw tokenlessError('invalid_visible_attachment', 'Attachment file digest does not match its descriptor.')
+    }
+    return {
+      name: basename(attachment.name),
+      mimeType: attachment.type,
+      buffer,
+    }
+  } finally {
+    await handle?.close().catch(() => undefined)
+  }
+}
+
+function isPathInside(root: string, candidate: string) {
+  const normalizedRoot = resolve(root)
+  const normalizedCandidate = resolve(candidate)
+  return normalizedCandidate === normalizedRoot || normalizedCandidate.startsWith(`${normalizedRoot}${sep}`)
+}
+
+function assertNotAborted(signal: AbortSignal | undefined) {
+  if (signal?.aborted) throw signal.reason ?? new Error('Visible provider action was aborted.')
+}
diff --git a/packages/cli/src/providers/capabilities/dom-choice.ts b/packages/cli/src/providers/capabilities/dom-choice.ts
new file mode 100644
index 0000000..f3953b9
--- /dev/null
+++ b/packages/cli/src/providers/capabilities/dom-choice.ts
@@ -0,0 +1,261 @@
+import { firstVisibleLocator } from '../dom-locators.js'
+import { PROVIDER_CAPABILITIES } from '../provider-identity.js'
+import type { Locator, Page } from 'playwright-core'
+import type { ProviderActionCapability } from '../capability-set.js'
+import type { VisibleAction, VisibleActionRequest } from '../contracts.js'
+import type { ProviderExecutionContext } from '../execution-context.js'
+import type { ProviderDomDefinition } from '../provider-definition.js'
+import type { Choice, ChoiceInspectResult, ChoiceSelectResult, ProviderCapabilityInspection } from '../../playwright/actions.js'
+
+type ChoiceKind = 'model' | 'effort'
+type DomChoiceAction = Extract<VisibleAction, 'model.inspect' | 'model.select' | 'effort.inspect' | 'effort.select'>
+
+type DomChoiceOptions =
+  | Readonly<{
+    capability: typeof PROVIDER_CAPABILITIES.MODEL_CHOICE
+    kind: 'model'
+    inspectAction: 'model.inspect'
+    selectAction: 'model.select'
+  }>
+  | Readonly<{
+    capability: typeof PROVIDER_CAPABILITIES.EFFORT_CHOICE
+    kind: 'effort'
+    inspectAction: 'effort.inspect'
+    selectAction: 'effort.select'
+  }>
+
+type ActionsFor<Options extends DomChoiceOptions> = Options['inspectAction'] | Options['selectAction']
+
+export class DomChoiceCapability<Options extends DomChoiceOptions = DomChoiceOptions>
+  implements ProviderActionCapability<ActionsFor<Options>> {
+  readonly capability: Options['capability']
+  readonly actions: readonly ActionsFor<Options>[]
+  private readonly provider: ProviderDomDefinition
+  private readonly kind: ChoiceKind
+  private readonly inspectAction: Options['inspectAction']
+  private readonly selectAction: Options['selectAction']
+
+  constructor(
+    provider: ProviderDomDefinition,
+    options: Options,
+  ) {
+    this.provider = provider
+    this.capability = options.capability
+    this.kind = options.kind
+    this.inspectAction = options.inspectAction
+    this.selectAction = options.selectAction
+    this.actions = Object.freeze([options.inspectAction, options.selectAction])
+  }
+
+  async execute(
+    page: Page,
+    request: Extract<VisibleActionRequest, { action: DomChoiceAction }>,
+    _context: ProviderExecutionContext,
+  ): Promise<ChoiceInspectResult | ChoiceSelectResult> {
+    if (request.action === this.inspectAction) return await inspectChoices(page, this.provider, this.kind)
+    if (request.action === this.selectAction) {
+      if (!('label' in request.payload) || typeof request.payload.label !== 'string') {
+        throw new Error('Validated choice request unexpectedly lacked a label.')
+      }
+      return await selectChoice(page, this.provider, this.kind, request.payload.label)
+    }
+    throw new Error(`Provider choice capability ${this.capability} received unsupported action: ${request.action}`)
+  }
+
+  async inspect(page: Page): Promise<ProviderCapabilityInspection> {
+    const selectors = this.kind === 'model' ? this.provider.modelControlSelectors : this.provider.effortControlSelectors
+    const strategy = this.provider.capabilities[this.capability]
+    if (selectors.length === 0) {
+      return {
+        ...strategy,
+        actions: this.actions,
+        availability: 'unavailable' as const,
+        visibleProof: 'provider-choice-control-unsupported',
+        reason: 'unsupported_by_provider',
+        native: {
+          ...strategy.native,
+          availability: 'unavailable' as const,
+          visibleProof: null,
+          reason: 'unsupported_by_provider',
+        },
+      }
+    }
+    const trigger = await firstVisibleLocator(page, selectors)
+    const availability = trigger ? 'available' as const : 'unknown' as const
+    const visibleProof = trigger ? 'visible-choice-control-enabled' : 'no-visible-choice-control'
+    const reason = trigger ? null : 'visible_choice_control_not_observed'
+    return {
+      ...strategy,
+      actions: this.actions,
+      availability,
+      visibleProof,
+      reason,
+      native: {
+        ...strategy.native,
+        availability,
+        visibleProof,
+        reason,
+      },
+    }
+  }
+}
+
+async function inspectChoices(page: Page, provider: ProviderDomDefinition, kind: ChoiceKind): Promise<ChoiceInspectResult> {
+  const selectors = kind === 'model' ? provider.modelControlSelectors : provider.effortControlSelectors
+  if (selectors.length === 0) {
+    return {
+      supported: false as const,
+      reason: 'unsupported_by_provider' as const,
+    }
+  }
+  const trigger = await firstVisibleLocator(page, selectors)
+  if (!trigger) {
+    return {
+      supported: false as const,
+      reason: 'selector_not_available' as const,
+    }
+  }
+  await trigger.click({ timeout: 5000 })
+  await page.waitForTimeout(300)
+  const choices = await collectVisibleChoices(page, provider, trigger)
+  return {
+    supported: true as const,
+    choices,
+  }
+}
+
+async function selectChoice(
+  page: Page,
+  provider: ProviderDomDefinition,
+  kind: ChoiceKind,
+  label: string,
+): Promise<ChoiceSelectResult | ChoiceInspectResult> {
+  if (typeof label !== 'string') {
+    throw new Error('Validated request payload unexpectedly lacked a label.')
+  }
+  const inspection = await inspectChoices(page, provider, kind)
+  if (!inspection.supported) return inspection
+  const choice = inspection.choices.find((candidate) => candidate.label === label && candidate.enabled)
+  if (!choice) {
+    return {
+      supported: true as const,
+      selectedLabel: '',
+      visibleProof: 'exact-label-not-found',
+    }
+  }
+  const option = await exactVisibleChoiceLocator(page, label)
+  if (!option) {
+    return {
+      supported: true as const,
+      selectedLabel: '',
+      visibleProof: 'exact-label-not-found',
+    }
+  }
+  await option.click({ timeout: 5000 })
+  const visible = await waitForSelectedLabel(page, provider, kind, label)
+  return {
+    supported: true as const,
+    selectedLabel: visible ? label : '',
+    visibleProof: visible ? 'exact-label-selected' : 'selected-label-not-visible',
+  }
+}
+
+async function exactVisibleChoiceLocator(page: Page, label: string): Promise<Locator | null> {
+  const candidates = page.locator([
+    '[role="menuitem"]',
+    '[role="menuitemradio"]',
+    '[role="option"]',
+    '[cmdk-item]',
+    '.ant-select-item-option',
+  ].join(',')).filter({ visible: true })
+  const count = Math.min(await candidates.count(), 80)
+  for (let index = 0; index < count; index += 1) {
+    const candidate = candidates.nth(index)
+    const text = await candidate.evaluate((element) => (
+      element.querySelector('.label')?.textContent ??
+      element.getAttribute('aria-label') ??
+      element.textContent ??
+      ''
+    ).replace(/\s+/gu, ' ').trim())
+    if (text === label) return candidate
+  }
+  return null
+}
+
+async function waitForSelectedLabel(
+  page: Page,
+  provider: ProviderDomDefinition,
+  kind: ChoiceKind,
+  label: string,
+) {
+  const selectors = kind === 'model' ? provider.modelControlSelectors : provider.effortControlSelectors
+  const deadline = Date.now() + 5000
+  while (Date.now() <= deadline) {
+    const trigger = await firstVisibleLocator(page, selectors)
+    if (trigger) {
+      const text = await trigger.evaluate((element) => (
+        `${element.textContent ?? ''} ${element.getAttribute('aria-label') ?? ''}`
+      ).replace(/\s+/gu, ' ').trim()).catch(() => '')
+      if (text === label || text.includes(label)) return true
+    }
+    await page.waitForTimeout(100)
+  }
+  return false
+}
+
+async function collectVisibleChoices(page: Page, provider: ProviderDomDefinition, trigger: Locator): Promise<Choice[]> {
+  const controlledId = await trigger.getAttribute('aria-controls')
+  const controlledRoot = controlledId
+    ? page.locator(`[id="${controlledId.replace(/["\\]/gu, '\\$&')}"]`).filter({ visible: true })
+    : null
+  const overlayRoot = page.locator('[role="menu"], [role="listbox"], [role="dialog"]').filter({ visible: true }).last()
+  const root = controlledRoot && await controlledRoot.count() > 0 ? controlledRoot : overlayRoot
+  const locators = [
+    root.locator('[role="menuitem"], [role="option"], [cmdk-item], button').filter({ visible: true }),
+    page.locator('.ant-select-dropdown').filter({ visible: true })
+      .locator('.ant-select-item-option').filter({ visible: true }),
+  ]
+  const choices: Choice[] = []
+  for (const locator of locators) {
+    const values = await locator.evaluateAll((elements, choiceAvailability) => elements.slice(0, 80).map((element) => {
+      const labelElement = element.querySelector('.label')
+      const text = (labelElement?.textContent ?? element.getAttribute('aria-label') ?? element.textContent ?? '').replace(/\s+/g, ' ').trim()
+      const ariaSelected = element.getAttribute('aria-selected') === 'true' ||
+        element.getAttribute('data-state') === 'checked' ||
+        element.classList.contains('selected') ||
+        element.querySelector('[aria-label="Selected"]') !== null
+      const dataDisabled = element.getAttribute('data-disabled')
+      const classTokens = new Set((element.getAttribute('class') ?? '').split(/\s+/).filter(Boolean))
+      const style = element instanceof HTMLElement ? window.getComputedStyle(element) : null
+      const explicitlyUnavailable = choiceAvailability.unavailableClassTokens.some((token) => classTokens.has(token))
+      const mutedUnavailable = choiceAvailability.mutedUnavailableClassToken !== null &&
+        classTokens.has(choiceAvailability.mutedUnavailableClassToken) &&
+        (
+          (choiceAvailability.mutedOpacityClassToken !== null && classTokens.has(choiceAvailability.mutedOpacityClassToken)) ||
+          (style !== null && Number(style.opacity) < 1)
+        )
+      const unrelatedAccountControl = /(?:sign|log) in|upgrade|subscribe/i.test(text) ||
+        /(?:sign|log)[-_]?in|upgrade|subscribe/i.test(element.getAttribute('data-testid') ?? element.getAttribute('data-test-id') ?? '')
+      const disabled = (
+        element.hasAttribute('disabled') ||
+        element.getAttribute('aria-disabled') === 'true' ||
+        (dataDisabled !== null && dataDisabled !== 'false') ||
+        explicitlyUnavailable ||
+        mutedUnavailable ||
+        unrelatedAccountControl
+      )
+      return {
+        label: text.slice(0, 120),
+        selected: ariaSelected,
+        enabled: !disabled,
+      }
+    }).filter((entry) => entry.label.length > 0), provider.choiceAvailability)
+    choices.push(...values)
+  }
+  const seen = new Set<string>()
+  return choices.filter((choice) => {
+    if (seen.has(choice.label)) return false
+    seen.add(choice.label)
+    return true
+  })
+}
diff --git a/packages/cli/src/providers/capabilities/doubao-controls.ts b/packages/cli/src/providers/capabilities/doubao-controls.ts
new file mode 100644
index 0000000..5e930e2
--- /dev/null
+++ b/packages/cli/src/providers/capabilities/doubao-controls.ts
@@ -0,0 +1,541 @@
+import { DomAttachmentCapability } from './dom-attachment.js'
+import { PROVIDER_CAPABILITIES } from '../provider-identity.js'
+import { VISIBLE_ACTIONS } from '../contracts.js'
+import type { Locator, Page } from 'playwright-core'
+import type { ProviderActionCapability } from '../capability-set.js'
+import type {
+  DoubaoMode,
+  DoubaoSkill,
+  VisibleActionRequest,
+} from '../contracts.js'
+import type { ProviderExecutionContext } from '../execution-context.js'
+import type { ProviderCapabilityStrategy, ProviderDomDefinition } from '../provider-definition.js'
+import type {
+  DoubaoModeChoice,
+  DoubaoModeInspectResult,
+  DoubaoModeSelectResult,
+  DoubaoSkillChoice,
+  DoubaoSkillInspectResult,
+  DoubaoSkillSelectResult,
+  FileUploadResult,
+  ProviderCapabilityInspection,
+} from '../../playwright/actions.js'
+
+const CONTROL_TIMEOUT_MS = 5_000
+const CONTROL_SETTLE_TIMEOUT_MS = 10_000
+const MODE_TRIGGER_SELECTOR = 'button[aria-haspopup="menu"][aria-expanded]:has([data-valid-btn="mode-select-action-btn"])'
+const MODE_ITEM_SELECTOR = '[role="menuitem"]'
+const DEFAULT_COMPOSER_SELECTOR = 'textarea.semi-input-textarea'
+const ACTIVE_SKILL_SELECTOR = 'div[data-input-engine-action-source="actionbar"][data-value]'
+const MORE_SKILLS = new Set<DoubaoSkill>([
+  'music-generation',
+  'problem-solving',
+  'spreadsheet-generation',
+  'audio-transcription',
+])
+
+const MODE_DEFINITIONS: readonly Readonly<{
+  mode: DoubaoMode
+  nativeLabel: string
+  description: string
+  canonicalCapabilities: readonly string[]
+}>[] = Object.freeze([
+  Object.freeze({ mode: 'fast', nativeLabel: '快速', description: '适用于大部分情况', canonicalCapabilities: Object.freeze(['conversation.chat']) }),
+  Object.freeze({ mode: 'expert', nativeLabel: '专家', description: '研究级智能模型', canonicalCapabilities: Object.freeze(['reasoning.extended']) }),
+  Object.freeze({ mode: 'work-task-turbo', nativeLabel: '工作任务 Turbo', description: '执行 agent 任务 - 2.1 Turbo', canonicalCapabilities: Object.freeze(['task.background', 'task.interactive']) }),
+  Object.freeze({ mode: 'work-task-pro', nativeLabel: '工作任务 Pro', description: '执行 agent 任务 - 2.1 Pro', canonicalCapabilities: Object.freeze(['task.background', 'task.interactive']) }),
+])
+
+const SKILL_DEFINITIONS: readonly Readonly<{
+  skill: DoubaoSkill
+  nativeLabel: string
+  nativeValue: string | null
+  canonicalCapabilities: readonly string[]
+  selectable: boolean
+}>[] = Object.freeze([
+  skill('chat', '普通对话', null, ['conversation.chat']),
+  skill('document-writing', '帮我写作', '2', ['document.generation']),
+  skill('presentation-generation', 'PPT 生成', '5000', ['presentation.generation']),
+  skill('image-generation', '图像生成', '3', ['image.generation']),
+  skill('video-generation', '视频生成', '17', ['video.generation']),
+  skill('deep-research', '深入研究', '25', ['research.deep']),
+  skill('audio-podcast', 'AI 播客', '26', ['audio.generation']),
+  skill('music-generation', '音乐生成', '9', ['audio.generation']),
+  skill('problem-solving', '解题答疑', '11', ['conversation.chat', 'reasoning.extended']),
+  skill('spreadsheet-generation', 'AI 表格', '5003', ['spreadsheet.generation', 'data.analyze']),
+  skill('audio-transcription', '录音转写', null, ['audio.transcription'], false),
+])
+
+type DoubaoModeAction =
+  | typeof VISIBLE_ACTIONS.DOUBAO_MODE_INSPECT
+  | typeof VISIBLE_ACTIONS.DOUBAO_MODE_SELECT
+
+type DoubaoSkillAction =
+  | typeof VISIBLE_ACTIONS.DOUBAO_SKILL_INSPECT
+  | typeof VISIBLE_ACTIONS.DOUBAO_SKILL_SELECT
+
+export class DoubaoAttachmentCapability implements ProviderActionCapability<typeof VISIBLE_ACTIONS.FILE_UPLOAD> {
+  readonly capability = PROVIDER_CAPABILITIES.FILE_UPLOAD
+  readonly actions = Object.freeze([VISIBLE_ACTIONS.FILE_UPLOAD])
+  private readonly delegate: DomAttachmentCapability
+  private readonly provider: ProviderDomDefinition<'doubao'>
+
+  constructor(provider: ProviderDomDefinition<'doubao'>) {
+    this.provider = provider
+    this.delegate = new DomAttachmentCapability(provider)
+  }
+
+  async inspect(page: Page): Promise<ProviderCapabilityInspection> {
+    const strategy = this.provider.capabilities[this.capability]
+    const trigger = await waitForVisibleUploadTrigger(page)
+    if (!trigger) return capabilityInspection(strategy, this.actions, false, 'no-visible-doubao-upload-trigger', 'visible_upload_control_not_observed')
+    await trigger.click({ timeout: CONTROL_TIMEOUT_MS }).catch(() => undefined)
+    const input = await waitForFileInput(page)
+    await page.keyboard.press('Escape').catch(() => undefined)
+    return capabilityInspection(
+      strategy,
+      this.actions,
+      input !== null,
+      input ? 'visible-doubao-upload-trigger-and-local-file-input' : 'visible-doubao-upload-trigger-without-local-file-input',
+      'visible_doubao_upload_input_not_observed',
+    )
+  }
+
+  async execute(
+    page: Page,
+    request: Extract<VisibleActionRequest, { action: typeof VISIBLE_ACTIONS.FILE_UPLOAD }>,
+    context: ProviderExecutionContext,
+  ): Promise<FileUploadResult> {
+    return await this.delegate.execute(page, request, context)
+  }
+}
+
+export class DoubaoModeCapability implements ProviderActionCapability<DoubaoModeAction> {
+  readonly capability = PROVIDER_CAPABILITIES.DOUBAO_MODE
+  readonly actions = Object.freeze([
+    VISIBLE_ACTIONS.DOUBAO_MODE_INSPECT,
+    VISIBLE_ACTIONS.DOUBAO_MODE_SELECT,
+  ])
+  private readonly provider: ProviderDomDefinition<'doubao'>
+
+  constructor(provider: ProviderDomDefinition<'doubao'>) {
+    this.provider = provider
+  }
+
+  async inspect(page: Page): Promise<ProviderCapabilityInspection> {
+    const strategy = this.provider.capabilities[this.capability]
+    const trigger = await waitForModeTrigger(page)
+    return capabilityInspection(
+      strategy,
+      this.actions,
+      trigger !== null,
+      trigger ? 'visible-doubao-mode-control' : 'no-visible-doubao-mode-control',
+      'visible_doubao_mode_control_not_observed',
+    )
+  }
+
+  async execute(
+    page: Page,
+    request: Extract<VisibleActionRequest, { action: DoubaoModeAction }>,
+    context: ProviderExecutionContext,
+  ): Promise<DoubaoModeInspectResult | DoubaoModeSelectResult> {
+    if (request.action === VISIBLE_ACTIONS.DOUBAO_MODE_INSPECT) return await inspectModes(page, context.signal)
+    return await selectMode(page, request.payload.mode, context.signal)
+  }
+}
+
+export class DoubaoSkillCapability implements ProviderActionCapability<DoubaoSkillAction> {
+  readonly capability = PROVIDER_CAPABILITIES.DOUBAO_SKILL
+  readonly actions = Object.freeze([
+    VISIBLE_ACTIONS.DOUBAO_SKILL_INSPECT,
+    VISIBLE_ACTIONS.DOUBAO_SKILL_SELECT,
+  ])
+  private readonly provider: ProviderDomDefinition<'doubao'>
+
+  constructor(provider: ProviderDomDefinition<'doubao'>) {
+    this.provider = provider
+  }
+
+  async inspect(page: Page): Promise<ProviderCapabilityInspection> {
+    const strategy = this.provider.capabilities[this.capability]
+    const visible = await visibleDefaultComposer(page) !== null || await activeSkill(page) !== null
+    return capabilityInspection(
+      strategy,
+      this.actions,
+      visible,
+      visible ? 'visible-doubao-skill-control-surface' : 'no-visible-doubao-skill-control-surface',
+      'visible_doubao_skill_control_not_observed',
+    )
+  }
+
+  async execute(
+    page: Page,
+    request: Extract<VisibleActionRequest, { action: DoubaoSkillAction }>,
+    context: ProviderExecutionContext,
+  ): Promise<DoubaoSkillInspectResult | DoubaoSkillSelectResult> {
+    if (request.action === VISIBLE_ACTIONS.DOUBAO_SKILL_INSPECT) return await inspectSkills(page, context.signal)
+    return await selectSkill(page, request.payload.skill, context.signal)
+  }
+}
+
+async function inspectModes(page: Page, signal: AbortSignal | undefined): Promise<DoubaoModeInspectResult> {
+  assertNotAborted(signal)
+  const trigger = await waitForModeTrigger(page)
+  if (!trigger) return { supported: false, reason: 'selector_not_available' }
+  const active = modeFromLabel(normalizeText(await trigger.innerText()))
+  if (!active) return { supported: false, reason: 'selector_not_available' }
+  await trigger.click({ timeout: CONTROL_TIMEOUT_MS })
+  await page.locator(MODE_ITEM_SELECTOR).filter({ visible: true }).first().waitFor({ state: 'visible', timeout: CONTROL_TIMEOUT_MS })
+  const observed = await collectStableModeItems(page, signal)
+  await page.keyboard.press('Escape').catch(() => undefined)
+  await page.waitForTimeout(300)
+  return {
+    supported: true,
+    activeMode: active,
+    modes: MODE_DEFINITIONS.map((definition): DoubaoModeChoice => {
+      const item = observed.get(definition.mode)
+      const upgradeRequired = definition.mode === 'work-task-pro' && item?.includes('升级') === true
+      return {
+        mode: definition.mode,
+        nativeLabel: definition.nativeLabel,
+        description: definition.description,
+        canonicalCapabilities: definition.canonicalCapabilities,
+        enabled: item !== undefined && !upgradeRequired,
+        selected: definition.mode === active,
+        reason: upgradeRequired ? 'upgrade_required' : null,
+      }
+    }),
+  }
+}
+
+async function selectMode(
+  page: Page,
+  mode: DoubaoMode,
+  signal: AbortSignal | undefined,
+): Promise<DoubaoModeSelectResult> {
+  assertNotAborted(signal)
+  const definition = MODE_DEFINITIONS.find((candidate) => candidate.mode === mode)
+  if (!definition) return { supported: false, reason: 'exact_mode_not_found' }
+  const inspected = await inspectModes(page, signal)
+  if (!inspected.supported) return inspected
+  const choice = inspected.modes.find((candidate) => candidate.mode === mode)
+  if (!choice?.enabled) return { supported: false, reason: 'mode_unavailable' }
+  if (inspected.activeMode === mode) {
+    return { supported: true, selectedMode: mode, nativeLabel: definition.nativeLabel, visibleProof: 'doubao-mode-trigger-visible' }
+  }
+  const trigger = await waitForModeTrigger(page)
+  if (!trigger) return { supported: false, reason: 'selector_not_available' }
+  await trigger.click({ timeout: CONTROL_TIMEOUT_MS })
+  await page.locator(MODE_ITEM_SELECTOR).filter({ visible: true }).first().waitFor({
+    state: 'visible',
+    timeout: CONTROL_TIMEOUT_MS,
+  })
+  await page.waitForTimeout(500)
+  const item = exactModeItem(page, definition.nativeLabel)
+  await item.waitFor({ state: 'visible', timeout: CONTROL_TIMEOUT_MS }).catch(() => undefined)
+  if (await item.count() === 0) return { supported: false, reason: 'exact_mode_not_found' }
+  await item.click({ timeout: CONTROL_TIMEOUT_MS })
+  const selected = await waitForActiveMode(page, mode, signal)
+  if (!selected) return { supported: false, reason: 'selector_not_available' }
+  return { supported: true, selectedMode: mode, nativeLabel: definition.nativeLabel, visibleProof: 'doubao-mode-trigger-visible' }
+}
+
+async function inspectSkills(page: Page, signal: AbortSignal | undefined): Promise<DoubaoSkillInspectResult> {
+  assertNotAborted(signal)
+  const active = await activeSkill(page) ?? 'chat'
+  if (active === 'chat' && await visibleDefaultComposer(page) === null) {
+    return { supported: false, reason: 'selector_not_available' }
+  }
+  const observed = new Set<DoubaoSkill>()
+  for (const definition of SKILL_DEFINITIONS.filter((candidate) => !MORE_SKILLS.has(candidate.skill) && candidate.skill !== 'chat')) {
+    if (await exactButton(page, definition.nativeLabel).count() > 0) observed.add(definition.skill)
+  }
+  const more = await waitForExactButton(page, '更多')
+  if (more) {
+    await more.click({ timeout: CONTROL_TIMEOUT_MS })
+    for (const skillId of await collectStableMoreSkills(page, signal)) observed.add(skillId)
+    await page.keyboard.press('Escape').catch(() => undefined)
+  }
+  return {
+    supported: true,
+    activeSkill: active,
+    skills: SKILL_DEFINITIONS.map((definition): DoubaoSkillChoice => ({
+      skill: definition.skill,
+      nativeLabel: definition.nativeLabel,
+      canonicalCapabilities: definition.canonicalCapabilities,
+      enabled: definition.skill === 'chat' || (definition.selectable && observed.has(definition.skill)),
+      selected: definition.skill === active,
+      reason: definition.skill === 'audio-transcription' && observed.has(definition.skill)
+        ? 'desktop_app_required'
+        : null,
+    })),
+  }
+}
+
+async function selectSkill(
+  page: Page,
+  requested: DoubaoSkill,
+  signal: AbortSignal | undefined,
+): Promise<DoubaoSkillSelectResult> {
+  assertNotAborted(signal)
+  const definition = SKILL_DEFINITIONS.find((candidate) => candidate.skill === requested)
+  if (!definition) return { supported: false, reason: 'exact_skill_not_found' }
+  if (!definition.selectable) return { supported: false, reason: 'skill_unavailable' }
+  const current = await activeSkill(page) ?? 'chat'
+  if (current === requested) return selectedSkillResult(definition)
+  if (current !== 'chat' && !await exitActiveSkill(page, signal)) {
+    return { supported: false, reason: 'selector_not_available' }
+  }
+  if (requested === 'chat') {
+    const composer = await waitForDefaultComposer(page, signal)
+    return composer ? selectedSkillResult(definition) : { supported: false, reason: 'selector_not_available' }
+  }
+  if (!await waitForDefaultComposer(page, signal)) return { supported: false, reason: 'selector_not_available' }
+  await page.waitForTimeout(400)
+  let trigger = await waitForExactButton(page, definition.nativeLabel, 2_000)
+  if (!trigger && MORE_SKILLS.has(requested)) {
+    const more = await waitForExactButton(page, '更多')
+    if (!more) return { supported: false, reason: 'selector_not_available' }
+    await more.click({ timeout: CONTROL_TIMEOUT_MS })
+    trigger = await waitForExactButton(page, definition.nativeLabel)
+  }
+  if (!trigger) return { supported: false, reason: 'exact_skill_not_found' }
+  await trigger.click({ timeout: CONTROL_TIMEOUT_MS })
+  const selected = await waitForSkill(page, definition, signal)
+  return selected ? selectedSkillResult(definition) : { supported: false, reason: 'selector_not_available' }
+}
+
+async function exitActiveSkill(page: Page, signal: AbortSignal | undefined) {
+  const current = await activeSkillDefinition(page)
+  if (!current?.nativeValue) return false
+  const token = activeSkillToken(page, current)
+  const exit = token.locator('xpath=ancestor-or-self::div[contains(concat(" ", normalize-space(@class), " "), " cursor-pointer ")][1]')
+  if (await exit.count() === 0) return false
+  await exit.click({ timeout: CONTROL_TIMEOUT_MS })
+  return await waitForDefaultComposer(page, signal) !== null
+}
+
+async function activeSkill(page: Page): Promise<DoubaoSkill | null> {
+  return (await activeSkillDefinition(page))?.skill ?? null
+}
+
+async function activeSkillDefinition(page: Page) {
+  for (const definition of SKILL_DEFINITIONS) {
+    if (!definition.nativeValue) continue
+    if (await activeSkillToken(page, definition).count() > 0) return definition
+  }
+  return null
+}
+
+function activeSkillToken(page: Page, definition: (typeof SKILL_DEFINITIONS)[number]) {
+  return page.locator(`${ACTIVE_SKILL_SELECTOR}[data-value="${definition.nativeValue}"]`)
+    .filter({ visible: true })
+    .filter({ hasText: new RegExp(`^${escapeRegExp(definition.nativeLabel)}$`) })
+    .last()
+}
+
+async function waitForSkill(
+  page: Page,
+  definition: (typeof SKILL_DEFINITIONS)[number],
+  signal: AbortSignal | undefined,
+) {
+  const deadline = Date.now() + CONTROL_SETTLE_TIMEOUT_MS
+  do {
+    assertNotAborted(signal)
+    if (await activeSkillToken(page, definition).count() > 0) return true
+    await page.waitForTimeout(100)
+  } while (Date.now() < deadline)
+  return false
+}
+
+async function waitForActiveMode(page: Page, mode: DoubaoMode, signal: AbortSignal | undefined) {
+  const deadline = Date.now() + CONTROL_SETTLE_TIMEOUT_MS
+  do {
+    assertNotAborted(signal)
+    const trigger = await visibleModeTrigger(page)
+    if (trigger && modeFromLabel(normalizeText(await trigger.innerText())) === mode) return trigger
+    await page.waitForTimeout(100)
+  } while (Date.now() < deadline)
+  return null
+}
+
+async function collectModeItems(page: Page) {
+  const entries = await page.locator(MODE_ITEM_SELECTOR).filter({ visible: true }).allTextContents()
+  const result = new Map<DoubaoMode, string>()
+  for (const entry of entries) {
+    const text = normalizeText(entry)
+    const mode = modeFromLabel(text)
+    if (mode) result.set(mode, text)
+  }
+  return result
+}
+
+async function collectStableModeItems(page: Page, signal: AbortSignal | undefined) {
+  const deadline = Date.now() + CONTROL_TIMEOUT_MS
+  let observed = new Map<DoubaoMode, string>()
+  do {
+    assertNotAborted(signal)
+    observed = await collectModeItems(page)
+    if (observed.size === MODE_DEFINITIONS.length) {
+      await page.waitForTimeout(300)
+      return await collectModeItems(page)
+    }
+    await page.waitForTimeout(100)
+  } while (Date.now() < deadline)
+  return observed
+}
+
+async function collectStableMoreSkills(page: Page, signal: AbortSignal | undefined) {
+  const definitions = SKILL_DEFINITIONS.filter((candidate) => MORE_SKILLS.has(candidate.skill))
+  const deadline = Date.now() + CONTROL_TIMEOUT_MS
+  let observed = new Set<DoubaoSkill>()
+  do {
+    assertNotAborted(signal)
+    observed = new Set<DoubaoSkill>()
+    for (const definition of definitions) {
+      if (await exactButton(page, definition.nativeLabel).count() > 0) observed.add(definition.skill)
+    }
+    if (observed.size === definitions.length) {
+      await page.waitForTimeout(300)
+      return observed
+    }
+    await page.waitForTimeout(100)
+  } while (Date.now() < deadline)
+  return observed
+}
+
+function modeFromLabel(label: string): DoubaoMode | null {
+  return MODE_DEFINITIONS.find((definition) => label.startsWith(definition.nativeLabel))?.mode ?? null
+}
+
+function exactModeItem(page: Page, label: string) {
+  return page.locator(MODE_ITEM_SELECTOR).filter({ visible: true }).filter({ hasText: new RegExp(`^${escapeRegExp(label)}`) }).last()
+}
+
+async function waitForModeTrigger(page: Page) {
+  const deadline = Date.now() + CONTROL_SETTLE_TIMEOUT_MS
+  do {
+    const trigger = await visibleModeTrigger(page)
+    if (trigger) return trigger
+    await page.waitForTimeout(100)
+  } while (Date.now() < deadline)
+  return null
+}
+
+async function visibleModeTrigger(page: Page) {
+  const trigger = page.locator(MODE_TRIGGER_SELECTOR).filter({ visible: true }).last()
+  return await trigger.count() > 0 ? trigger : null
+}
+
+async function waitForVisibleUploadTrigger(page: Page) {
+  const deadline = Date.now() + CONTROL_SETTLE_TIMEOUT_MS
+  do {
+    const trigger = page.locator('div.max-w-full.min-w-0.flex-1.relative.flex.items-center.h-36 > div:first-child > button[data-dbx-name="button"]')
+      .filter({ visible: true })
+      .last()
+    if (await trigger.count() > 0) return trigger
+    await page.waitForTimeout(100)
+  } while (Date.now() < deadline)
+  return null
+}
+
+async function waitForFileInput(page: Page) {
+  const deadline = Date.now() + CONTROL_TIMEOUT_MS
+  do {
+    const input = page.locator('input[type="file"][multiple][accept*=".pdf"][accept*="py"]').last()
+    if (await input.count() > 0) return input
+    await page.waitForTimeout(100)
+  } while (Date.now() < deadline)
+  return null
+}
+
+async function waitForDefaultComposer(page: Page, signal: AbortSignal | undefined) {
+  const deadline = Date.now() + CONTROL_SETTLE_TIMEOUT_MS
+  do {
+    assertNotAborted(signal)
+    const composer = await visibleDefaultComposer(page)
+    if (composer) return composer
+    await page.waitForTimeout(100)
+  } while (Date.now() < deadline)
+  return null
+}
+
+async function visibleDefaultComposer(page: Page) {
+  const composer = page.locator(DEFAULT_COMPOSER_SELECTOR).filter({ visible: true }).last()
+  return await composer.count() > 0 ? composer : null
+}
+
+async function waitForExactButton(page: Page, label: string, timeoutMs = CONTROL_TIMEOUT_MS) {
+  const deadline = Date.now() + timeoutMs
+  do {
+    const button = exactButton(page, label)
+    if (await button.count() > 0) return button
+    await page.waitForTimeout(100)
+  } while (Date.now() < deadline)
+  return null
+}
+
+function exactButton(page: Page, label: string) {
+  return page.getByRole('button', { name: label, exact: true }).filter({ visible: true }).last()
+}
+
+function selectedSkillResult(definition: (typeof SKILL_DEFINITIONS)[number]): DoubaoSkillSelectResult {
+  return {
+    supported: true,
+    selectedSkill: definition.skill,
+    nativeLabel: definition.nativeLabel,
+    visibleProof: definition.skill === 'chat' ? 'doubao-default-composer-visible' : 'doubao-active-skill-token-visible',
+  }
+}
+
+function skill(
+  skillId: DoubaoSkill,
+  nativeLabel: string,
+  nativeValue: string | null,
+  canonicalCapabilities: readonly string[],
+  selectable = true,
+) {
+  return Object.freeze({
+    skill: skillId,
+    nativeLabel,
+    nativeValue,
+    canonicalCapabilities: Object.freeze([...canonicalCapabilities]),
+    selectable,
+  })
+}
+
+function capabilityInspection(
+  strategy: ProviderCapabilityStrategy,
+  actions: readonly (typeof VISIBLE_ACTIONS)[keyof typeof VISIBLE_ACTIONS][],
+  available: boolean,
+  visibleProof: string,
+  unavailableReason: string,
+): ProviderCapabilityInspection {
+  const availability = available ? 'available' as const : 'unknown' as const
+  const reason = available ? null : unavailableReason
+  return {
+    ...strategy,
+    actions,
+    availability,
+    visibleProof,
+    reason,
+    native: {
+      ...strategy.native,
+      availability,
+      visibleProof,
+      reason,
+    },
+  }
+}
+
+function normalizeText(value: string) {
+  return value.replace(/\s+/gu, ' ').trim()
+}
+
+function escapeRegExp(value: string) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
+function assertNotAborted(signal: AbortSignal | undefined) {
+  if (signal?.aborted) throw signal.reason instanceof Error ? signal.reason : new Error('Doubao control action was aborted.')
+}
diff --git a/packages/cli/src/providers/capabilities/image-generation.ts b/packages/cli/src/providers/capabilities/image-generation.ts
new file mode 100644
index 0000000..d52db07
--- /dev/null
+++ b/packages/cli/src/providers/capabilities/image-generation.ts
@@ -0,0 +1,91 @@
+import { providerCapabilityFailure } from '../capability-set.js'
+import { PROVIDER_CAPABILITIES } from '../provider-identity.js'
+import type { Page } from 'playwright-core'
+import type { ProviderCapability } from '../capability-set.js'
+import type { ProviderExecutionContext } from '../execution-context.js'
+import type { ProviderDomDefinition } from '../provider-definition.js'
+import type { ProviderCapabilityInspection } from '../../playwright/actions.js'
+
+export type ImageGenerationCursor = {
+  readonly schema: 'tokenless.provider.image-generation-cursor.v1'
+  readonly value: {
+    readonly operationId: string
+    readonly startedAt: string
+  }
+}
+
+export type ImageGenerationInspection = {
+  readonly availability: 'available' | 'unavailable' | 'unknown'
+  readonly visibleProof: string | null
+  readonly reason: string | null
+}
+
+export type ImageGenerationStart = {
+  readonly operationId: string
+  readonly cursor: ImageGenerationCursor
+  readonly visibleProof: string
+}
+
+export type ImageGenerationObservation = {
+  readonly state: 'running' | 'completed' | 'failed' | 'unknown'
+  readonly visibleProof: string | null
+  readonly reason: string | null
+}
+
+export type ImageGenerationRead = {
+  readonly images: readonly {
+    readonly url: string | null
+    readonly alt: string | null
+    readonly visibleProof: string
+  }[]
+  readonly visibleProof: string | null
+}
+
+export interface ImageGenerationCapability extends ProviderCapability {
+  inspect(page: Page, context?: ProviderExecutionContext): Promise<ProviderCapabilityInspection & ImageGenerationInspection>
+  cursor(page: Page, context: ProviderExecutionContext): Promise<ImageGenerationCursor>
+  start(page: Page, prompt: string, context: ProviderExecutionContext): Promise<ImageGenerationStart>
+  observe(page: Page, operationId: string, context: ProviderExecutionContext): Promise<ImageGenerationObservation>
+  read(page: Page, operationId: string, context: ProviderExecutionContext): Promise<ImageGenerationRead>
+}
+
+export class UnsupportedImageGenerationCapability implements ImageGenerationCapability {
+  readonly capability = PROVIDER_CAPABILITIES.IMAGE_GENERATION
+  private readonly provider: ProviderDomDefinition
+
+  constructor(provider: ProviderDomDefinition) {
+    this.provider = provider
+  }
+
+  async inspect(_page: Page, _context?: ProviderExecutionContext): Promise<ProviderCapabilityInspection & ImageGenerationInspection> {
+    const strategy = this.provider.capabilities[PROVIDER_CAPABILITIES.IMAGE_GENERATION]
+    return {
+      ...strategy,
+      actions: [],
+    }
+  }
+
+  async cursor(_page: Page, _context: ProviderExecutionContext): Promise<ImageGenerationCursor> {
+    throw unsupportedImageGeneration()
+  }
+
+  async start(_page: Page, _prompt: string, _context: ProviderExecutionContext): Promise<ImageGenerationStart> {
+    throw unsupportedImageGeneration()
+  }
+
+  async observe(_page: Page, _operationId: string, _context: ProviderExecutionContext): Promise<ImageGenerationObservation> {
+    throw unsupportedImageGeneration()
+  }
+
+  async read(_page: Page, _operationId: string, _context: ProviderExecutionContext): Promise<ImageGenerationRead> {
+    throw unsupportedImageGeneration()
+  }
+}
+
+function unsupportedImageGeneration() {
+  return providerCapabilityFailure(
+    'image_generation_unavailable',
+    'Visible image generation is not available without real-provider acceptance evidence.',
+    { retryable: false },
+  )
+}
diff --git a/packages/cli/src/providers/capabilities/native-project-workspace.ts b/packages/cli/src/providers/capabilities/native-project-workspace.ts
new file mode 100644
index 0000000..e5add47
--- /dev/null
+++ b/packages/cli/src/providers/capabilities/native-project-workspace.ts
@@ -0,0 +1,397 @@
+import { ConversationWorkspaceCapability } from './workspace.js'
+import { ProviderCapabilityFailure, providerCapabilityFailure } from '../capability-set.js'
+import { firstVisibleLocator, waitForVisibleLocator } from '../dom-locators.js'
+import { PROVIDER_CAPABILITIES } from '../provider-identity.js'
+import { VISIBLE_ACTIONS } from '../contracts.js'
+import type { Locator, Page } from 'playwright-core'
+import type { ProviderActionCapability } from '../capability-set.js'
+import type { VisibleActionRequest } from '../contracts.js'
+import type { ProviderExecutionContext } from '../execution-context.js'
+import type { ProviderDomDefinition } from '../provider-definition.js'
+import type {
+  NativeWorkspaceEnsureResult,
+  ProviderCapabilityInspection,
+  WorkspaceEnsurePayload,
+  WorkspaceEnsureResult,
+} from '../../playwright/actions.js'
+
+type WorkspaceAction = typeof VISIBLE_ACTIONS.WORKSPACE_ENSURE
+
+export type NativeProjectWorkspaceStrategy = Readonly<{
+  listUrl: string
+  projectPath: RegExp
+  projectLinkSelectors: readonly string[]
+  createTriggerSelectors: readonly string[]
+  nameInputSelectors: readonly string[]
+  instructionsInputSelectors: readonly string[]
+  createSubmitSelectors: readonly string[]
+  instructionOpenSelectors: readonly string[]
+  instructionSaveSelectors: readonly string[]
+  stableUnavailableSelectors: readonly string[]
+}>
+
+export class NativeProjectWorkspaceCapability implements ProviderActionCapability<WorkspaceAction> {
+  readonly capability = PROVIDER_CAPABILITIES.WORKSPACE_ENSURE
+  readonly actions = Object.freeze([VISIBLE_ACTIONS.WORKSPACE_ENSURE])
+  private readonly conversation: ConversationWorkspaceCapability
+
+  constructor(
+    private readonly provider: ProviderDomDefinition,
+    private readonly strategy: NativeProjectWorkspaceStrategy,
+  ) {
+    this.conversation = new ConversationWorkspaceCapability(provider)
+  }
+
+  async execute(
+    page: Page,
+    request: Extract<VisibleActionRequest, { action: WorkspaceAction }>,
+    context: ProviderExecutionContext,
+  ): Promise<WorkspaceEnsureResult> {
+    if (request.payload.mode === 'conversation') {
+      return await this.conversation.execute(page, request, context)
+    }
+    try {
+      return await this.ensureNative(page, request.payload, context)
+    } catch (error) {
+      if (
+        request.payload.mode === 'auto' &&
+        error instanceof ProviderCapabilityFailure &&
+        error.code === 'workspace_native_stably_unavailable'
+      ) {
+        return await this.conversation.execute(page, {
+          ...request,
+          payload: { ...request.payload, mode: 'auto' },
+        }, context)
+      }
+      throw error
+    }
+  }
+
+  async inspect(page: Page): Promise<ProviderCapabilityInspection> {
+    const strategy = this.provider.capabilities[PROVIDER_CAPABILITIES.WORKSPACE_ENSURE]
+    const currentProject = projectIdentity(page.url(), this.provider, this.strategy)
+    const createVisible = await firstVisibleLocator(page, this.strategy.createTriggerSelectors, 250)
+    const availability = currentProject || createVisible ? 'available' as const : 'unknown' as const
+    return {
+      ...strategy,
+      actions: this.actions,
+      availability,
+      visibleProof: currentProject ? 'native-project-url-visible' : createVisible ? 'native-project-create-control-visible' : 'native-project-runtime-evidence-required',
+      reason: availability === 'available' ? null : 'native_project_runtime_evidence_required',
+      native: {
+        ...strategy.native,
+        availability,
+        identity: {
+          provider: this.provider.id,
+          canonicalUrl: currentProject?.canonicalUrl ?? null,
+        },
+        updateInstructions: {
+          availability: 'unknown' as const,
+          visibleProof: null,
+          reason: 'native_project_instruction_runtime_evidence_required',
+        },
+      },
+      fallback: {
+        ...strategy.fallback,
+        availability: 'available' as const,
+        visibleProof: 'conversation-composer-runtime-check',
+        reason: null,
+      },
+    }
+  }
+
+  private async ensureNative(
+    page: Page,
+    payload: WorkspaceEnsurePayload,
+    context: ProviderExecutionContext,
+  ): Promise<NativeWorkspaceEnsureResult> {
+    let identity = await alignedProjectIdentity(page, this.provider, this.strategy, payload.name)
+    let disposition: 'created' | 'reused'
+    let instructionOutcome: NativeWorkspaceEnsureResult['instructionOutcome']
+    let instructionProof: string | null = null
+    if (identity) {
+      disposition = 'reused'
+      instructionOutcome = payload.instructions === undefined ? 'not_requested' : 'skipped_on_reuse'
+    } else {
+      await navigate(page, this.strategy.listUrl, context.signal)
+      const matches = await exactProjectLinks(page, this.strategy.projectLinkSelectors, payload.name)
+      if (matches.length > 1) {
+        throw providerCapabilityFailure(
+          'workspace_native_ambiguous_identity',
+          `More than one visible native Project exactly matches '${payload.name}'.`,
+          { retryable: false },
+        )
+      }
+      if (matches.length === 1) {
+        disposition = 'reused'
+        await clickAndWaitForProject(page, matches[0] as Locator, this.provider, this.strategy, context.signal)
+        instructionOutcome = payload.instructions === undefined ? 'not_requested' : 'skipped_on_reuse'
+      } else {
+        const unavailable = await firstVisibleLocator(page, this.strategy.stableUnavailableSelectors, 250)
+        if (unavailable) {
+          throw providerCapabilityFailure(
+            'workspace_native_stably_unavailable',
+            'The provider visibly reports that native Projects are unavailable for this account.',
+            { retryable: false },
+          )
+        }
+        const create = await waitForVisibleLocator(page, this.strategy.createTriggerSelectors, 10_000)
+        if (!create) {
+          throw providerCapabilityFailure(
+            'workspace_native_ui_drift',
+            'The native Project create control was not visible.',
+            { retryable: true },
+          )
+        }
+        await click(create, 'workspace_native_create_navigation_failed')
+        const nameInput = await waitForVisibleLocator(page, this.strategy.nameInputSelectors, 10_000)
+        if (!nameInput) {
+          throw providerCapabilityFailure(
+            'workspace_native_ui_drift',
+            'The native Project name input was not visible.',
+            { retryable: true },
+          )
+        }
+        await nameInput.fill(payload.name)
+        const instructionInput = payload.instructions === undefined
+          ? null
+          : await firstVisibleLocator(page, this.strategy.instructionsInputSelectors, 1_000)
+        if (instructionInput && payload.instructions !== undefined) {
+          await instructionInput.fill(payload.instructions)
+          instructionProof = 'native-project-instructions-filled-on-create'
+        }
+        await submitProjectCreation(page, this.provider, this.strategy, context.signal)
+        disposition = 'created'
+        if (payload.instructions === undefined) {
+          instructionOutcome = 'not_requested'
+        } else if (instructionInput) {
+          instructionOutcome = 'applied_on_creation'
+        } else {
+          const applied = await applyProjectInstructions(page, payload.instructions, this.strategy)
+          instructionOutcome = applied ? 'applied_on_creation' : 'unavailable'
+          instructionProof = applied ? 'native-project-instructions-visible-after-create' : null
+        }
+      }
+      identity = projectIdentity(page.url(), this.provider, this.strategy)
+    }
+
+    if (!identity) {
+      throw providerCapabilityFailure(
+        'workspace_native_identity_unavailable',
+        'The provider did not expose a validated canonical Project URL after Project alignment.',
+        { retryable: true },
+      )
+    }
+    const nameVisible = await exactVisibleText(page, payload.name)
+    if (!nameVisible) {
+      throw providerCapabilityFailure(
+        'workspace_native_identity_unavailable',
+        'The exact native Project name was not visibly confirmed.',
+        { retryable: true },
+      )
+    }
+    const composer = await waitForVisibleLocator(page, this.provider.composerSelectors, 10_000)
+    if (!composer) {
+      throw providerCapabilityFailure(
+        'workspace_native_composer_unavailable',
+        'The native Project conversation composer was not visible.',
+        { retryable: true },
+      )
+    }
+    const updateInstructions = instructionOutcome === 'unavailable'
+      ? {
+          availability: 'unavailable' as const,
+          visibleProof: null,
+          reason: 'native_project_instruction_control_unavailable',
+        }
+      : {
+          availability: 'available' as const,
+          visibleProof: instructionProof,
+          reason: null,
+        }
+    return {
+      mode: 'native',
+      requestedMode: payload.mode,
+      resolvedMode: 'native',
+      name: payload.name,
+      scope: {
+        provider: this.provider.id,
+        profileId: context.profileId,
+      },
+      identity: {
+        provider: this.provider.id,
+        name: payload.name,
+        resourceId: identity.resourceId,
+        canonicalUrl: identity.canonicalUrl,
+      },
+      resource: {
+        kind: 'project',
+        native: true,
+        disposition,
+        id: identity.resourceId,
+        canonicalUrl: identity.canonicalUrl,
+      },
+      native: {
+        resourceKind: 'project',
+        availability: 'available',
+        canonicalUrl: identity.canonicalUrl,
+        visibleProof: 'native-project-url-name-and-composer-visible',
+        reason: null,
+        updateInstructions,
+      },
+      updateInstructions,
+      instructionOutcome,
+      availability: 'available',
+      visibleProof: 'native-project-url-name-and-composer-visible',
+      reason: null,
+      fallback: null,
+    }
+  }
+}
+
+async function exactProjectLinks(page: Page, selectors: readonly string[], name: string) {
+  const matches: Locator[] = []
+  const hrefs = new Set<string>()
+  for (const selector of selectors) {
+    const locator = page.locator(selector)
+    for (let index = 0; index < await locator.count(); index += 1) {
+      const candidate = locator.nth(index)
+      if (!await candidate.isVisible({ timeout: 100 }).catch(() => false)) continue
+      const exactName = candidate.getByText(name, { exact: true })
+      const exactCandidateText = (await candidate.textContent().catch(() => null))?.trim() === name
+      if (!exactCandidateText && await exactName.count() === 0) continue
+      const href = await candidate.getAttribute('href')
+      if (!href || hrefs.has(href)) continue
+      hrefs.add(href)
+      matches.push(candidate)
+    }
+  }
+  return matches
+}
+
+async function submitProjectCreation(
+  page: Page,
+  provider: ProviderDomDefinition,
+  strategy: NativeProjectWorkspaceStrategy,
+  signal?: AbortSignal,
+) {
+  for (let step = 0; step < 3; step += 1) {
+    const identity = projectIdentity(page.url(), provider, strategy)
+    if (identity) return
+    if (signal?.aborted) throw providerCapabilityFailure('workspace_native_navigation_failed', 'Native Project creation was aborted.', { retryable: true })
+    const submit = await waitForVisibleLocator(page, strategy.createSubmitSelectors, 10_000)
+    if (!submit) {
+      throw providerCapabilityFailure(
+        'workspace_native_ui_drift',
+        'The native Project create or continue control was not visible.',
+        { retryable: true },
+      )
+    }
+    await click(submit, 'workspace_native_create_failed')
+    await page.waitForTimeout(500)
+  }
+  if (!projectIdentity(page.url(), provider, strategy)) {
+    throw providerCapabilityFailure(
+      'workspace_native_create_failed',
+      'Native Project creation did not reach a validated Project URL.',
+      { retryable: true },
+    )
+  }
+}
+
+async function applyProjectInstructions(page: Page, instructions: string, strategy: NativeProjectWorkspaceStrategy) {
+  const open = await firstVisibleLocator(page, strategy.instructionOpenSelectors, 1_000)
+  if (!open) return false
+  await click(open, 'workspace_native_instruction_failed')
+  const input = await waitForVisibleLocator(page, strategy.instructionsInputSelectors, 5_000)
+  if (!input) return false
+  await input.fill(instructions)
+  const save = await waitForVisibleLocator(page, strategy.instructionSaveSelectors, 5_000)
+  if (!save) return false
+  await click(save, 'workspace_native_instruction_failed')
+  return true
+}
+
+async function clickAndWaitForProject(
+  page: Page,
+  link: Locator,
+  provider: ProviderDomDefinition,
+  strategy: NativeProjectWorkspaceStrategy,
+  signal?: AbortSignal,
+) {
+  await click(link, 'workspace_native_navigation_failed')
+  const deadline = Date.now() + 15_000
+  while (Date.now() <= deadline) {
+    if (projectIdentity(page.url(), provider, strategy)) return
+    if (signal?.aborted) break
+    await page.waitForTimeout(100)
+  }
+  throw providerCapabilityFailure(
+    'workspace_native_navigation_failed',
+    'Opening the exact native Project did not reach a validated Project URL.',
+    { retryable: true },
+  )
+}
+
+async function navigate(page: Page, url: string, signal?: AbortSignal) {
+  if (signal?.aborted) {
+    throw providerCapabilityFailure('workspace_native_navigation_failed', 'Native Project navigation was aborted.', { retryable: true })
+  }
+  try {
+    await page.goto(url, { waitUntil: 'domcontentloaded', timeout: 30_000 })
+  } catch {
+    throw providerCapabilityFailure(
+      'workspace_native_navigation_failed',
+      'The native Project list could not be opened.',
+      { retryable: true },
+    )
+  }
+}
+
+function projectIdentity(
+  value: string,
+  provider: ProviderDomDefinition,
+  strategy: NativeProjectWorkspaceStrategy,
+) {
+  const target = provider.navigationPolicy.assertCurrentPageAllowed(value)
+  if (!target) return null
+  const match = strategy.projectPath.exec(target.pathname)
+  const resourceId = match?.groups?.resourceId ?? match?.[1]
+  if (!resourceId || !/^[A-Za-z0-9_-]{4,256}$/u.test(resourceId)) return null
+  const canonical = new URL(target.href)
+  canonical.pathname = (match?.[0] ?? canonical.pathname).replace(/\/$/u, '')
+  canonical.search = ''
+  canonical.hash = ''
+  return {
+    resourceId,
+    canonicalUrl: canonical.toString(),
+  }
+}
+
+async function alignedProjectIdentity(
+  page: Page,
+  provider: ProviderDomDefinition,
+  strategy: NativeProjectWorkspaceStrategy,
+  name: string,
+) {
+  const identity = projectIdentity(page.url(), provider, strategy)
+  if (!identity || !await exactVisibleText(page, name)) return null
+  const composer = await firstVisibleLocator(page, provider.composerSelectors, 250)
+  return composer ? identity : null
+}
+
+async function exactVisibleText(page: Page, value: string) {
+  const text = page.getByText(value, { exact: true })
+  for (let index = 0; index < await text.count(); index += 1) {
+    if (await text.nth(index).isVisible({ timeout: 100 }).catch(() => false)) return true
+  }
+  return false
+}
+
+async function click(locator: Locator, code: string) {
+  try {
+    await locator.click({ timeout: 10_000 })
+  } catch {
+    throw providerCapabilityFailure(code, 'A required native Project control could not be activated.', { retryable: true })
+  }
+}
diff --git a/packages/cli/src/providers/capabilities/prompt.ts b/packages/cli/src/providers/capabilities/prompt.ts
new file mode 100644
index 0000000..137ea95
--- /dev/null
+++ b/packages/cli/src/providers/capabilities/prompt.ts
@@ -0,0 +1,157 @@
+import { VISIBLE_ACTIONS } from '../contracts.js'
+import { tokenlessError } from '../../playwright/errors.js'
+import { countVisibleLocators, firstVisibleLocator, waitForEnabledLocator, waitForVisibleLocator } from '../dom-locators.js'
+import type { Locator, Page } from 'playwright-core'
+import type { ProviderDomDefinition } from '../provider-definition.js'
+
+const PROMPT_CONTROL_VISIBILITY_TIMEOUT_MS = 15_000
+const PROMPT_SUBMISSION_ACCEPTANCE_TIMEOUT_MS = 10_000
+
+export type PromptAction =
+  | typeof VISIBLE_ACTIONS.PROMPT_INPUT
+  | typeof VISIBLE_ACTIONS.PROMPT_CLEAR
+  | typeof VISIBLE_ACTIONS.PROMPT_SUBMIT
+
+export async function inputDomPrompt(provider: ProviderDomDefinition, page: Page, text: string) {
+  const deadline = Date.now() + PROMPT_CONTROL_VISIBILITY_TIMEOUT_MS
+  let composerObserved = false
+  do {
+    const composer = await waitForVisibleLocator(
+      page,
+      provider.composerSelectors,
+      Math.max(1, deadline - Date.now()),
+    )
+    if (!composer) break
+    composerObserved = true
+    if (await writePrompt(page, composer, text)) {
+      return {
+        visible: true as const,
+        inputProof: 'prompt-text-visible',
+      }
+    }
+    if (Date.now() < deadline) {
+      await page.waitForTimeout(Math.min(100, Math.max(1, deadline - Date.now())))
+    }
+  } while (Date.now() < deadline)
+
+  if (!composerObserved) {
+    throw tokenlessError(
+      'prompt_input_visibility_timeout',
+      `Timed out after ${PROMPT_CONTROL_VISIBILITY_TIMEOUT_MS}ms waiting for a visible prompt input.`,
+      { retryable: true },
+    )
+  }
+  throw tokenlessError(
+    'prompt_input_failed',
+    'The visible prompt input remained empty after input.',
+    { retryable: true },
+  )
+}
+
+export async function submitDomPrompt(
+  provider: ProviderDomDefinition,
+  page: Page,
+) {
+  const button = await waitForEnabledLocator(page, provider.submitSelectors, PROMPT_CONTROL_VISIBILITY_TIMEOUT_MS)
+  if (!button) {
+    throw tokenlessError(
+      'prompt_submit_actionability_timeout',
+      `Timed out after ${PROMPT_CONTROL_VISIBILITY_TIMEOUT_MS}ms waiting for an enabled visible prompt submit control.`,
+      { retryable: true },
+    )
+  }
+  const baseline = {
+    answerCount: await countVisibleLocators(page, provider.answerSelectors),
+    url: page.url(),
+  }
+  try {
+    await button.click({ timeout: 5000 })
+  } catch (error) {
+    throw tokenlessError(
+      'prompt_submit_failed',
+      'The visible prompt submit control could not be clicked.',
+      { retryable: true, cause: error },
+    )
+  }
+  const deadline = Date.now() + PROMPT_SUBMISSION_ACCEPTANCE_TIMEOUT_MS
+  do {
+    if (await submissionTransitionIsVisible(provider, page, button, baseline)) {
+      return {
+        visible: true as const,
+        submissionProof: 'visible-submission-transition',
+      }
+    }
+    if (Date.now() < deadline) {
+      await page.waitForTimeout(Math.min(100, Math.max(1, deadline - Date.now())))
+    }
+  } while (Date.now() < deadline)
+  throw tokenlessError(
+    'prompt_submit_not_accepted',
+    `No visible provider submission transition followed the click within ${PROMPT_SUBMISSION_ACCEPTANCE_TIMEOUT_MS}ms.`,
+    { retryable: true },
+  )
+}
+
+async function submissionTransitionIsVisible(
+  provider: ProviderDomDefinition,
+  page: Page,
+  clickedButton: Locator,
+  baseline: { answerCount: number, url: string },
+) {
+  if (page.url() !== baseline.url) return true
+  if (await countVisibleLocators(page, provider.answerSelectors) > baseline.answerCount) return true
+  if (await countVisibleLocators(page, provider.busySelectors) > 0) return true
+  if (!await clickedButton.isVisible({ timeout: 50 }).catch(() => false)) return true
+  if (!await clickedButton.isEnabled({ timeout: 50 }).catch(() => false)) return true
+  const composer = await firstVisibleLocator(page, provider.composerSelectors, 50)
+  if (!composer || await composerIsVisiblyEmpty(composer)) return true
+  return false
+}
+
+async function composerHasExpectedPresence(locator: Locator, expectEmpty: boolean) {
+  try {
+    return await locator.evaluate((element, shouldBeEmpty) => {
+      const text = element instanceof HTMLTextAreaElement || element instanceof HTMLInputElement
+        ? element.value
+        : (element.textContent ?? '')
+      const hasVisibleText = text.replace(/[\s\u00a0\u200b-\u200d\u2060\ufeff]/gu, '').length > 0
+      return shouldBeEmpty ? !hasVisibleText : hasVisibleText
+    }, expectEmpty)
+  } catch {
+    return false
+  }
+}
+
+async function composerIsVisiblyEmpty(locator: Locator) {
+  return await locator.evaluate((element) => {
+    if (element instanceof HTMLTextAreaElement || element instanceof HTMLInputElement) {
+      return normalizedPromptText(element.value).length === 0
+    }
+    const clone = element.cloneNode(true) as Element
+    clone.querySelectorAll('[data-slate-placeholder="true"], [data-slate-zero-width]').forEach((node) => node.remove())
+    return normalizedPromptText(clone.textContent ?? '').length === 0
+
+    function normalizedPromptText(value: string) {
+      return value.replace(/[\s\u00a0\u200b-\u200d\u2060\ufeff]/gu, '')
+    }
+  }).catch(() => false)
+}
+
+async function writePrompt(page: Page, composer: Locator, text: string) {
+  const expectEmpty = text.length === 0
+  try {
+    await composer.fill(text, { timeout: 2000 })
+    if (await composerHasExpectedPresence(composer, expectEmpty)) return true
+  } catch {
+    // Hydration can replace a visible fallback composer while it is being filled.
+  }
+  try {
+    if (!await composer.isVisible({ timeout: 250 })) return false
+    await composer.click({ timeout: 1000 })
+    await page.keyboard.press(process.platform === 'darwin' ? 'Meta+A' : 'Control+A')
+    await page.keyboard.type(text)
+    return await composerHasExpectedPresence(composer, expectEmpty)
+  } catch {
+    return false
+  }
+}
diff --git a/packages/cli/src/providers/capabilities/qwen-mode.ts b/packages/cli/src/providers/capabilities/qwen-mode.ts
new file mode 100644
index 0000000..c24ee66
--- /dev/null
+++ b/packages/cli/src/providers/capabilities/qwen-mode.ts
@@ -0,0 +1,255 @@
+import { firstVisibleLocator, waitForVisibleLocator } from '../dom-locators.js'
+import { PROVIDER_CAPABILITIES } from '../provider-identity.js'
+import { VISIBLE_ACTIONS } from '../contracts.js'
+import type { Locator, Page } from 'playwright-core'
+import type { ProviderActionCapability } from '../capability-set.js'
+import type { VisibleActionRequest } from '../contracts.js'
+import type { ProviderExecutionContext } from '../execution-context.js'
+import type { ProviderDomDefinition } from '../provider-definition.js'
+import type {
+  ProviderCapabilityInspection,
+  QwenModeChoice,
+  QwenModeInspectResult,
+  QwenModeSelectResult,
+} from '../../playwright/actions.js'
+
+const MODE_TRIGGER_SELECTORS = Object.freeze([
+  '[role="button"][aria-label="Select Mode"]',
+])
+const MODE_MENU_ITEM_SELECTOR = '[role="menuitem"].mode-select-common-item'
+const MORE_MENU_ITEM_SELECTOR = '[role="menuitem"][aria-haspopup="true"]'
+const ACTIVE_MODE_SELECTOR = '.mode-select'
+const THINKING_CONTROL_SELECTOR = '.qwen-select-thinking'
+const DEEP_RESEARCH_VARIANT_TRIGGER_SELECTOR = '.message-input-column-footer-submode'
+const MODE_MENU_TIMEOUT_MS = 5_000
+const MODE_SETTLE_TIMEOUT_MS = 10_000
+const NON_MODE_LABELS = new Set(['Tools'])
+
+type QwenModeAction =
+  | typeof VISIBLE_ACTIONS.QWEN_MODE_INSPECT
+  | typeof VISIBLE_ACTIONS.QWEN_MODE_SELECT
+
+export class QwenModeCapability implements ProviderActionCapability<QwenModeAction> {
+  readonly capability = PROVIDER_CAPABILITIES.QWEN_MODE
+  readonly actions = Object.freeze([
+    VISIBLE_ACTIONS.QWEN_MODE_INSPECT,
+    VISIBLE_ACTIONS.QWEN_MODE_SELECT,
+  ])
+  private readonly provider: ProviderDomDefinition<'qwen'>
+
+  constructor(provider: ProviderDomDefinition<'qwen'>) {
+    this.provider = provider
+  }
+
+  async inspect(page: Page): Promise<ProviderCapabilityInspection> {
+    const trigger = await firstVisibleLocator(page, MODE_TRIGGER_SELECTORS)
+    const strategy = this.provider.capabilities[this.capability]
+    const availability = trigger ? 'available' as const : 'unknown' as const
+    const visibleProof = trigger ? 'visible-qwen-mode-control-enabled' : 'no-visible-qwen-mode-control'
+    const reason = trigger ? null : 'visible_qwen_mode_control_not_observed'
+    return {
+      ...strategy,
+      actions: this.actions,
+      availability,
+      visibleProof,
+      reason,
+      native: {
+        ...strategy.native,
+        availability,
+        visibleProof,
+        reason,
+      },
+    }
+  }
+
+  async execute(
+    page: Page,
+    request: Extract<VisibleActionRequest, { action: QwenModeAction }>,
+    context: ProviderExecutionContext,
+  ): Promise<QwenModeInspectResult | QwenModeSelectResult> {
+    if (request.action === VISIBLE_ACTIONS.QWEN_MODE_INSPECT) {
+      return await inspectQwenModes(page, context.signal)
+    }
+    return await selectQwenMode(page, this.provider, request.payload.mode, request.payload.variant, context.signal)
+  }
+}
+
+async function inspectQwenModes(page: Page, signal: AbortSignal | undefined): Promise<QwenModeInspectResult> {
+  assertNotAborted(signal)
+  const trigger = await firstVisibleLocator(page, MODE_TRIGGER_SELECTORS)
+  if (!trigger) return { supported: false, reason: 'selector_not_available' }
+  const active = await readActiveMode(page)
+  const modes = await openAndCollectModes(page, trigger, signal)
+  await page.keyboard.press('Escape').catch(() => undefined)
+  return {
+    supported: true,
+    active,
+    modes: [
+      {
+        mode: 'Chat',
+        enabled: true,
+        selected: active.mode === 'Chat',
+      },
+      ...modes.map((mode) => ({
+        ...mode,
+        selected: active.mode === mode.mode,
+      })),
+    ],
+  }
+}
+
+async function selectQwenMode(
+  page: Page,
+  provider: ProviderDomDefinition<'qwen'>,
+  mode: string,
+  variant: string | undefined,
+  signal: AbortSignal | undefined,
+): Promise<QwenModeSelectResult> {
+  assertNotAborted(signal)
+  if (mode === 'Chat') {
+    if (variant !== undefined) return { supported: false, reason: 'exact_variant_not_found' }
+    await page.goto(provider.homeUrl, { waitUntil: 'domcontentloaded', timeout: 30_000 })
+    const thinking = await waitForVisibleLocator(page, [THINKING_CONTROL_SELECTOR], MODE_SETTLE_TIMEOUT_MS)
+    if (!thinking) return { supported: false, reason: 'selector_not_available' }
+    return {
+      supported: true,
+      selectedMode: 'Chat',
+      selectedVariant: null,
+      visibleProof: 'qwen-chat-mode-visible',
+    }
+  }
+
+  const trigger = await firstVisibleLocator(page, MODE_TRIGGER_SELECTORS)
+  if (!trigger) return { supported: false, reason: 'selector_not_available' }
+  const modes = await openAndCollectModes(page, trigger, signal)
+  const requested = modes.find((candidate) => candidate.mode === mode && candidate.enabled)
+  if (!requested) {
+    await page.keyboard.press('Escape').catch(() => undefined)
+    return { supported: false, reason: 'exact_mode_not_found' }
+  }
+
+  const item = visibleExactModeItem(page, mode)
+  await item.click({ timeout: MODE_MENU_TIMEOUT_MS })
+  await waitForActiveMode(page, mode, signal)
+
+  let selectedVariant: string | null = null
+  if (variant !== undefined) {
+    if (mode !== 'Deep Research') return { supported: false, reason: 'exact_variant_not_found' }
+    const variantTrigger = page.locator(DEEP_RESEARCH_VARIANT_TRIGGER_SELECTOR).filter({ visible: true }).last()
+    if (await variantTrigger.count() === 0) return { supported: false, reason: 'selector_not_available' }
+    await variantTrigger.click({ timeout: MODE_MENU_TIMEOUT_MS })
+    const variantItem = page.locator('[role="menuitem"]').filter({ visible: true }).filter({
+      hasText: new RegExp(`^${escapeRegExp(variant)}`),
+    }).last()
+    await variantItem.waitFor({ state: 'visible', timeout: MODE_MENU_TIMEOUT_MS }).catch(() => undefined)
+    if (await variantItem.count() === 0 || await isDisabled(variantItem)) {
+      await page.keyboard.press('Escape').catch(() => undefined)
+      return { supported: false, reason: 'exact_variant_not_found' }
+    }
+    await variantItem.click({ timeout: MODE_MENU_TIMEOUT_MS })
+    await waitForActiveMode(page, `${mode} ${variant}`, signal)
+    selectedVariant = variant
+  } else if (mode === 'Deep Research') {
+    selectedVariant = (await readActiveMode(page)).variant
+  }
+
+  return {
+    supported: true,
+    selectedMode: mode,
+    selectedVariant,
+    visibleProof: selectedVariant
+      ? 'qwen-mode-and-variant-visible'
+      : 'qwen-mode-visible',
+  }
+}
+
+async function openAndCollectModes(
+  page: Page,
+  trigger: Locator,
+  signal: AbortSignal | undefined,
+): Promise<QwenModeChoice[]> {
+  assertNotAborted(signal)
+  await trigger.click({ timeout: MODE_MENU_TIMEOUT_MS })
+  await page.locator(MODE_MENU_ITEM_SELECTOR).filter({ visible: true }).first().waitFor({
+    state: 'visible',
+    timeout: MODE_MENU_TIMEOUT_MS,
+  })
+  await page.waitForTimeout(300)
+  const direct = await collectVisibleModeItems(page)
+  const more = page.locator(MORE_MENU_ITEM_SELECTOR).filter({ visible: true }).filter({ hasText: /^More$/ }).last()
+  if (await more.count() > 0) {
+    await more.hover({ timeout: MODE_MENU_TIMEOUT_MS })
+    await page.waitForTimeout(250)
+  }
+  const all = [...direct, ...await collectVisibleModeItems(page)]
+  const seen = new Set<string>()
+  return all.filter((choice) => {
+    if (
+      NON_MODE_LABELS.has(choice.mode) ||
+      choice.mode.startsWith('Upload attachment') ||
+      seen.has(choice.mode)
+    ) return false
+    seen.add(choice.mode)
+    return true
+  })
+}
+
+async function collectVisibleModeItems(page: Page): Promise<QwenModeChoice[]> {
+  return await page.locator(MODE_MENU_ITEM_SELECTOR).filter({ visible: true }).evaluateAll((elements) => (
+    elements.map((element) => ({
+      mode: (element.textContent ?? '').replace(/\s+/gu, ' ').trim().slice(0, 120),
+      enabled: !(
+        element.hasAttribute('disabled') ||
+        element.getAttribute('aria-disabled') === 'true' ||
+        element.classList.contains('ant-dropdown-menu-item-disabled')
+      ),
+      selected: false,
+    })).filter((choice) => choice.mode.length > 0)
+  ))
+}
+
+function visibleExactModeItem(page: Page, mode: string) {
+  return page.locator(MODE_MENU_ITEM_SELECTOR).filter({ visible: true }).filter({ hasText: new RegExp(`^${escapeRegExp(mode)}$`) }).last()
+}
+
+async function readActiveMode(page: Page): Promise<{ mode: string, variant: string | null }> {
+  const active = page.locator(ACTIVE_MODE_SELECTOR).filter({ visible: true }).last()
+  if (await active.count() === 0) return { mode: 'Chat', variant: null }
+  const label = (await active.innerText()).replace(/\s+/gu, ' ').trim()
+  if (!label) return { mode: 'Chat', variant: null }
+  if (label.startsWith('Deep Research ')) {
+    return {
+      mode: 'Deep Research',
+      variant: label.slice('Deep Research '.length) || null,
+    }
+  }
+  return { mode: label, variant: null }
+}
+
+async function waitForActiveMode(page: Page, expected: string, signal: AbortSignal | undefined) {
+  const deadline = Date.now() + MODE_SETTLE_TIMEOUT_MS
+  while (Date.now() <= deadline) {
+    assertNotAborted(signal)
+    const active = await readActiveMode(page)
+    const value = active.variant ? `${active.mode} ${active.variant}` : active.mode
+    if (value === expected || value.startsWith(`${expected} `)) return
+    await page.waitForTimeout(100)
+  }
+  throw new Error(`Timed out waiting for visible Qwen mode: ${expected}`)
+}
+
+async function isDisabled(locator: Locator) {
+  return await locator.evaluate((element) => (
+    element.hasAttribute('disabled') ||
+    element.getAttribute('aria-disabled') === 'true' ||
+    element.classList.contains('ant-dropdown-menu-item-disabled')
+  ))
+}
+
+function escapeRegExp(value: string) {
+  return value.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&')
+}
+
+function assertNotAborted(signal: AbortSignal | undefined) {
+  if (signal?.aborted) throw signal.reason instanceof Error ? signal.reason : new Error('Qwen mode action was aborted.')
+}
diff --git a/packages/cli/src/providers/capabilities/response.ts b/packages/cli/src/providers/capabilities/response.ts
new file mode 100644
index 0000000..5c3eb6b
--- /dev/null
+++ b/packages/cli/src/providers/capabilities/response.ts
@@ -0,0 +1,149 @@
+import { VISIBLE_ACTIONS, validateProviderActionPreparation } from '../contracts.js'
+import { countVisibleLocators, latestLocator } from '../dom-locators.js'
+import { createHash } from 'node:crypto'
+import type { Page } from 'playwright-core'
+import type { ProviderDomDefinition } from '../provider-definition.js'
+import type { ProviderActionObservation, ProviderActionPreparation } from '../contracts.js'
+import type { VisibleCitation } from '../../playwright/actions.js'
+
+export const RESPONSE_CURSOR_SCHEMA = 'tokenless.provider.response-cursor.v2'
+
+export type ResponseCursorObservation = {
+  answerCount: number
+  latestAnswerFingerprint: string | null
+  busy: boolean
+}
+
+export async function prepareDomResponseCursor(provider: ProviderDomDefinition, page: Page): Promise<ProviderActionPreparation<typeof VISIBLE_ACTIONS.RESPONSE_READ>> {
+  const observation = await observeDomResponseCursor(provider, page)
+  return createResponsePreparation(provider, observation.answerCount, observation.latestAnswerFingerprint)
+}
+
+export function legacyDomResponsePreparationFromBaseline(
+  provider: ProviderDomDefinition,
+  baseline: number,
+): ProviderActionPreparation<typeof VISIBLE_ACTIONS.RESPONSE_READ> {
+  return createResponsePreparation(provider, validateBaseline(baseline), null)
+}
+
+export async function observeDomResponseCursor(provider: ProviderDomDefinition, page: Page): Promise<ResponseCursorObservation> {
+  const latestAnswer = await latestLocator(page, provider.answerSelectors)
+  return {
+    answerCount: await countVisibleLocators(page, provider.answerSelectors),
+    latestAnswerFingerprint: latestAnswer
+      ? fingerprintAnswer(await latestAnswer.innerText({ timeout: 1000 }).catch(() => ''))
+      : null,
+    busy: await countVisibleLocators(page, provider.busySelectors) > 0,
+  }
+}
+
+export async function observeDomResponseAction(
+  provider: ProviderDomDefinition,
+  page: Page,
+  preparation: ProviderActionPreparation,
+): Promise<ProviderActionObservation> {
+  const baseline = validateDomResponsePreparation(provider, preparation)
+  const observation = await observeDomResponseCursor(provider, page)
+  const hasNewAnswer = (
+    observation.answerCount > baseline.answerCount &&
+    observation.latestAnswerFingerprint !== null
+  ) ||
+    (
+      baseline.latestAnswerFingerprint !== null &&
+      observation.latestAnswerFingerprint !== null &&
+      observation.latestAnswerFingerprint !== baseline.latestAnswerFingerprint
+    )
+  return {
+    state: hasNewAnswer && !observation.busy ? 'ready' as const : 'pending' as const,
+  }
+}
+
+export async function observeDomResponseCompletion(provider: ProviderDomDefinition, page: Page, baseline: number) {
+  return (await observeDomResponseAction(provider, page, legacyDomResponsePreparationFromBaseline(provider, baseline))).state === 'ready'
+}
+
+export function validateDomResponsePreparation(provider: ProviderDomDefinition, preparation: unknown) {
+  const validated = validateProviderActionPreparation(preparation, {
+    provider: provider.id,
+    action: VISIBLE_ACTIONS.RESPONSE_READ,
+    schema: RESPONSE_CURSOR_SCHEMA,
+  })
+  if (!isPlainRecord(validated.value) || !hasExactKeys(validated.value, ['answerCount', 'latestAnswerFingerprint'])) {
+    throw new Error('Response cursor value is invalid.')
+  }
+  return {
+    answerCount: validateBaseline(validated.value.answerCount),
+    latestAnswerFingerprint: validateFingerprint(validated.value.latestAnswerFingerprint),
+  }
+}
+
+export async function readDomResponse(provider: ProviderDomDefinition, page: Page) {
+  const answer = await latestLocator(page, provider.answerSelectors)
+  if (!answer) {
+    return {
+      text: '',
+      citations: [],
+      visibleProof: 'no-visible-answer',
+    }
+  }
+  const text = sanitizeVisibleText(await answer.innerText({ timeout: 5000 }))
+  const citations = await answer.locator('a[href]').evaluateAll((anchors) => anchors.slice(0, 24).map((anchor) => ({
+    label: (anchor.textContent ?? '').trim().slice(0, 120),
+    href: anchor instanceof HTMLAnchorElement ? anchor.href : '',
+  })).filter((entry) => entry.href.startsWith('https://'))) as VisibleCitation[]
+  return {
+    text,
+    citations,
+    visibleProof: 'visible-answer-read',
+  }
+}
+
+function createResponsePreparation(
+  provider: ProviderDomDefinition,
+  answerCount: number,
+  latestAnswerFingerprint: string | null,
+): ProviderActionPreparation<typeof VISIBLE_ACTIONS.RESPONSE_READ> {
+  return Object.freeze({
+    provider: provider.id,
+    action: VISIBLE_ACTIONS.RESPONSE_READ,
+    schema: RESPONSE_CURSOR_SCHEMA,
+    value: Object.freeze({
+      answerCount: validateBaseline(answerCount),
+      latestAnswerFingerprint: validateFingerprint(latestAnswerFingerprint),
+    }),
+  })
+}
+
+function sanitizeVisibleText(text: string) {
+  return text.replace(/\s+/g, ' ').trim().slice(0, 32_000)
+}
+
+function validateBaseline(value: unknown) {
+  if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0) {
+    throw new Error('Response cursor baseline is invalid.')
+  }
+  return value
+}
+
+function fingerprintAnswer(text: string) {
+  const normalized = sanitizeVisibleText(text)
+  return normalized ? createHash('sha256').update(normalized).digest('hex') : null
+}
+
+function validateFingerprint(value: unknown) {
+  if (value === null) return null
+  if (typeof value !== 'string' || !/^[a-f0-9]{64}$/.test(value)) {
+    throw new Error('Response cursor fingerprint is invalid.')
+  }
+  return value
+}
+
+function hasExactKeys(input: Record<string, unknown>, keys: readonly string[]) {
+  const actual = Object.keys(input).sort()
+  const expected = [...keys].sort()
+  return actual.length === expected.length && actual.every((key, index) => key === expected[index])
+}
+
+function isPlainRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value && typeof value === 'object' && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype)
+}
diff --git a/packages/cli/src/providers/capabilities/session.ts b/packages/cli/src/providers/capabilities/session.ts
new file mode 100644
index 0000000..24c03fb
--- /dev/null
+++ b/packages/cli/src/providers/capabilities/session.ts
@@ -0,0 +1,85 @@
+import { PROVIDER_CAPABILITIES } from '../provider-identity.js'
+import { inspectProviderAccountSession } from '../account-inspectors.js'
+import { inspectProviderBlockers, resolveProviderSession } from '../../playwright/provider-session/index.js'
+import { firstVisibleLocator } from '../dom-locators.js'
+import { VISIBLE_ACTIONS } from '../contracts.js'
+import type { Page } from 'playwright-core'
+import type { ProviderCapability } from '../capability-set.js'
+import type { AuthStatusResult, BlockerCheckResult, ProviderCapabilityInspection } from '../../playwright/actions.js'
+import type { ProviderDomDefinition } from '../provider-definition.js'
+import type { ProviderSessionResolution } from '../../playwright/provider-session/types.js'
+
+export function resolveDomProviderSession(
+  provider: ProviderDomDefinition,
+  page: Page,
+  {
+    waitForReadyMs = 0,
+    signal,
+  }: {
+    waitForReadyMs?: number
+    signal?: AbortSignal
+  } = {},
+): Promise<ProviderSessionResolution> {
+  return resolveProviderSession(page, provider, {
+    waitForReadyMs,
+    ...(signal === undefined ? {} : { signal }),
+  })
+}
+
+export function inspectDomProviderAccount(
+  provider: ProviderDomDefinition,
+  page: Page,
+  signal: AbortSignal | undefined,
+): Promise<AuthStatusResult> {
+  return inspectProviderAccountSession(page, provider, signal)
+}
+
+export function inspectDomProviderBlockers(provider: ProviderDomDefinition, page: Page): Promise<BlockerCheckResult> {
+  return inspectProviderBlockers(page, provider)
+}
+
+export async function hasVisibleDomComposer(provider: ProviderDomDefinition, page: Page) {
+  return await firstVisibleLocator(page, provider.composerSelectors, 100) !== null
+}
+
+export async function inspectProviderWorkflowCapability(provider: ProviderDomDefinition): Promise<ProviderCapabilityInspection> {
+  return {
+    ...provider.capabilities[PROVIDER_CAPABILITIES.CAPABILITY_INSPECT],
+    actions: [VISIBLE_ACTIONS.CAPABILITY_INSPECT, VISIBLE_ACTIONS.BLOCKER_CHECK],
+  }
+}
+
+export class ConversationContinueCapability implements ProviderCapability {
+  readonly capability = PROVIDER_CAPABILITIES.CONVERSATION_CONTINUE
+  private readonly provider: ProviderDomDefinition
+
+  constructor(provider: ProviderDomDefinition) {
+    this.provider = provider
+  }
+
+  async inspect(page: Page): Promise<ProviderCapabilityInspection> {
+    const strategy = this.provider.capabilities[PROVIDER_CAPABILITIES.CONVERSATION_CONTINUE]
+    const composer = await firstVisibleLocator(page, this.provider.composerSelectors)
+    const availability = composer ? 'available' as const : 'unknown' as const
+    const visibleProof = composer ? 'conversation-composer-visible' : 'no-visible-conversation-composer'
+    const reason = composer ? null : 'visible_composer_not_observed'
+    return {
+      ...strategy,
+      actions: [
+        VISIBLE_ACTIONS.PROMPT_INPUT,
+        VISIBLE_ACTIONS.PROMPT_CLEAR,
+        VISIBLE_ACTIONS.PROMPT_SUBMIT,
+        VISIBLE_ACTIONS.RESPONSE_READ,
+      ],
+      availability,
+      visibleProof,
+      reason,
+      native: {
+        ...strategy.native,
+        availability,
+        visibleProof,
+        reason,
+      },
+    }
+  }
+}
diff --git a/packages/cli/src/providers/capabilities/workspace.ts b/packages/cli/src/providers/capabilities/workspace.ts
new file mode 100644
index 0000000..2674740
--- /dev/null
+++ b/packages/cli/src/providers/capabilities/workspace.ts
@@ -0,0 +1,144 @@
+import { providerCapabilityFailure } from '../capability-set.js'
+import { firstVisibleLocator, waitForVisibleLocator } from '../dom-locators.js'
+import { PROVIDER_CAPABILITIES } from '../provider-identity.js'
+import { tokenlessError } from '../../playwright/errors.js'
+import { VISIBLE_ACTIONS } from '../contracts.js'
+import type { Page } from 'playwright-core'
+import type { ProviderActionCapability } from '../capability-set.js'
+import type { VisibleActionRequest } from '../contracts.js'
+import type { ProviderExecutionContext } from '../execution-context.js'
+import type { ProviderDomDefinition } from '../provider-definition.js'
+import type { ProviderCapabilityInspection, WorkspaceEnsurePayload, WorkspaceEnsureResult } from '../../playwright/actions.js'
+
+type WorkspaceAction = typeof VISIBLE_ACTIONS.WORKSPACE_ENSURE
+
+export class ConversationWorkspaceCapability implements ProviderActionCapability<WorkspaceAction> {
+  readonly capability = PROVIDER_CAPABILITIES.WORKSPACE_ENSURE
+  readonly actions = Object.freeze([VISIBLE_ACTIONS.WORKSPACE_ENSURE])
+  private readonly provider: ProviderDomDefinition
+
+  constructor(provider: ProviderDomDefinition) {
+    this.provider = provider
+  }
+
+  async execute(
+    page: Page,
+    request: Extract<VisibleActionRequest, { action: WorkspaceAction }>,
+    _context: ProviderExecutionContext,
+  ): Promise<WorkspaceEnsureResult> {
+    if (request.payload.mode === 'native') {
+      throw providerCapabilityFailure(
+        'workspace_native_unavailable',
+        'Native workspace creation is unavailable for this provider.',
+        { retryable: false },
+      )
+    }
+    return await ensureWorkspace(page, this.provider, request.payload, _context.profileId)
+  }
+
+  async inspect(page: Page): Promise<ProviderCapabilityInspection> {
+    const strategy = this.provider.capabilities[PROVIDER_CAPABILITIES.WORKSPACE_ENSURE]
+    const composer = await firstVisibleLocator(page, this.provider.composerSelectors)
+    const availability = composer ? 'available' as const : 'unknown' as const
+    const visibleProof = composer ? 'conversation-composer-visible' : 'no-visible-conversation-composer'
+    const reason = composer ? strategy.reason : 'visible_composer_not_observed'
+    return {
+      ...strategy,
+      actions: this.actions,
+      availability,
+      visibleProof,
+      reason,
+      native: {
+        ...strategy.native,
+        identity: {
+          provider: this.provider.id,
+          canonicalUrl: this.provider.navigationPolicy.canonicalTarget(this.provider.homeUrl)?.href ?? null,
+        },
+        updateInstructions: {
+          availability: 'unavailable' as const,
+          visibleProof: null,
+          reason: 'native_workspace_instruction_update_unavailable',
+        },
+      },
+      fallback: {
+        ...strategy.fallback,
+        availability,
+        visibleProof,
+        reason: composer ? null : 'visible_composer_not_observed',
+      },
+    }
+  }
+}
+
+async function ensureWorkspace(
+  page: Page,
+  provider: ProviderDomDefinition,
+  payload: WorkspaceEnsurePayload,
+  profileId: string,
+): Promise<WorkspaceEnsureResult> {
+  const name = payload.name
+  const mode = payload.mode
+  if (typeof name !== 'string' || (mode !== 'auto' && mode !== 'conversation')) {
+    throw new Error('Validated request payload unexpectedly lacked workspace fields.')
+  }
+  const composer = await waitForVisibleLocator(page, provider.composerSelectors, 10_000)
+  if (!composer) {
+    throw tokenlessError(
+      'workspace_conversation_unavailable',
+      'No visible conversation composer is available for workspace fallback.',
+      { retryable: true },
+    )
+  }
+  const requestedMode = mode === 'auto' ? 'auto' as const : 'conversation' as const
+  const canonicalUrl = provider.navigationPolicy.assertCurrentPageAllowed(page.url())?.href ??
+    provider.navigationPolicy.canonicalTarget(provider.homeUrl)?.href ??
+    null
+  const native = {
+    resourceKind: 'project' as const,
+    availability: 'unavailable' as const,
+    canonicalUrl: null,
+    visibleProof: null,
+    reason: 'no_real_provider_native_workspace_creation_closure',
+    updateInstructions: {
+      availability: 'unavailable' as const,
+      visibleProof: null,
+      reason: 'native_workspace_instruction_update_unavailable',
+    },
+  }
+  return {
+    mode: 'conversation' as const,
+    requestedMode,
+    resolvedMode: 'conversation' as const,
+    name,
+    scope: {
+      provider: provider.id,
+      profileId,
+    },
+    identity: {
+      provider: provider.id,
+      name,
+      resourceId: null,
+      canonicalUrl,
+    },
+    resource: {
+      kind: 'conversation' as const,
+      native: false as const,
+      disposition: 'fallback' as const,
+      id: null,
+      canonicalUrl,
+    },
+    native,
+    updateInstructions: native.updateInstructions,
+    instructionOutcome: payload.instructions === undefined ? 'not_requested' as const : 'unavailable' as const,
+    availability: 'available' as const,
+    visibleProof: 'conversation-composer-visible',
+    reason: mode === 'auto' ? 'auto_fell_back_to_conversation' : null,
+    fallback: mode === 'auto'
+      ? {
+          mode: 'conversation' as const,
+          resourceKind: 'conversation' as const,
+          availability: 'available' as const,
+        }
+      : null,
+  }
+}
diff --git a/packages/cli/src/providers/capability-set.ts b/packages/cli/src/providers/capability-set.ts
new file mode 100644
index 0000000..c63fa56
--- /dev/null
+++ b/packages/cli/src/providers/capability-set.ts
@@ -0,0 +1,88 @@
+import { tokenlessError } from '../playwright/errors.js'
+import type { Page } from 'playwright-core'
+import type { ProviderCapabilityId } from './provider-identity.js'
+import type { VisibleAction, VisibleActionRequest } from './contracts.js'
+import type { ProviderExecutionContext } from './execution-context.js'
+import type { ProviderCapabilityInspection, VisibleActionResult } from '../playwright/actions.js'
+
+export interface ProviderCapability {
+  readonly capability: ProviderCapabilityId
+  inspect(page: Page): Promise<ProviderCapabilityInspection>
+}
+
+export interface ProviderActionCapability<Action extends VisibleAction = VisibleAction> {
+  readonly capability: string
+  readonly actions: readonly Action[]
+  execute(page: Page, request: Extract<VisibleActionRequest, { action: Action }>, context: ProviderExecutionContext): Promise<VisibleActionResult>
+}
+
+export interface InspectableProviderActionCapability<Action extends VisibleAction = VisibleAction>
+  extends ProviderCapability, Omit<ProviderActionCapability<Action>, 'capability'> {}
+
+export class ProviderCapabilityFailure extends Error {
+  readonly code: string
+  readonly retryable: boolean
+
+  constructor(code: string, message: string, options: { retryable: boolean }) {
+    super(message)
+    this.name = 'ProviderCapabilityFailure'
+    this.code = code
+    this.retryable = options.retryable
+  }
+}
+
+export function providerCapabilityFailure(code: string, message: string, options: { retryable: boolean }) {
+  return new ProviderCapabilityFailure(code, message, options)
+}
+
+export class ProviderCapabilitySet {
+  private readonly capabilities: readonly ProviderCapability[]
+  private readonly byAction: ReadonlyMap<VisibleAction, InspectableProviderActionCapability>
+
+  constructor(capabilities: readonly ProviderCapability[]) {
+    const byAction = new Map<VisibleAction, InspectableProviderActionCapability>()
+    const byCapability = new Set<ProviderCapabilityId>()
+    for (const capability of capabilities) {
+      if (!capability.capability) throw new Error('Provider capability id is required.')
+      if (byCapability.has(capability.capability)) {
+        throw new Error(`Provider capability is registered more than once: ${capability.capability}`)
+      }
+      byCapability.add(capability.capability)
+      if (!isProviderActionCapability(capability)) continue
+      const local = new Set<VisibleAction>()
+      for (const action of capability.actions) {
+        if (local.has(action)) throw new Error(`Duplicate action in provider capability: ${action}`)
+        local.add(action)
+        if (byAction.has(action)) throw new Error(`Provider action is registered more than once: ${action}`)
+        byAction.set(action, capability)
+      }
+    }
+    this.capabilities = Object.freeze([...capabilities])
+    this.byAction = byAction
+    Object.freeze(this)
+  }
+
+  supports(action: VisibleAction) {
+    return this.byAction.has(action)
+  }
+
+  async execute(page: Page, request: VisibleActionRequest, context: ProviderExecutionContext): Promise<VisibleActionResult> {
+    const capability = this.byAction.get(request.action)
+    if (!capability) {
+      throw tokenlessError('unknown_visible_action', 'Visible action is not supported.', { retryable: false })
+    }
+    return await capability.execute(page, request as never, context)
+  }
+
+  async inspectAll(page: Page) {
+    const entries = await Promise.all(this.capabilities.map(async (capability) => [
+      capability.capability,
+      await capability.inspect(page),
+    ] as const))
+    return Object.fromEntries(entries) as Readonly<Record<ProviderCapabilityId, ProviderCapabilityInspection>>
+  }
+}
+
+function isProviderActionCapability(capability: ProviderCapability): capability is InspectableProviderActionCapability {
+  return 'actions' in capability && 'execute' in capability
+}
diff --git a/packages/cli/src/providers/chatgpt-provider.ts b/packages/cli/src/providers/chatgpt-provider.ts
new file mode 100644
index 0000000..234847d
--- /dev/null
+++ b/packages/cli/src/providers/chatgpt-provider.ts
@@ -0,0 +1,124 @@
+import { BaseProvider } from './base-provider.js'
+import {
+  DEFAULT_CHOICE_AVAILABILITY,
+  defineDescriptor,
+  defineProvider,
+  providerCapabilities,
+} from './provider-definition.js'
+import { MenuTextAccountInspector } from './account-inspectors.js'
+import { PROVIDER_NAVIGATION_CATALOG } from './provider-navigation-catalog.js'
+
+export class ChatGptProvider extends BaseProvider<'chatgpt'> {
+  constructor() {
+    const descriptor = defineDescriptor({
+      id: 'chatgpt',
+      label: 'ChatGPT',
+      stage: 'supported',
+      setupOrder: 0,
+      protocolCompatibility: Object.freeze({
+        legacyRequests: true,
+      }),
+      navigation: PROVIDER_NAVIGATION_CATALOG.chatgpt,
+      profileImport: Object.freeze({
+        cookieDomains: Object.freeze(['chatgpt.com', 'openai.com']),
+      }),
+      controls: Object.freeze({
+        chatSurface: true,
+      }),
+    })
+    const provider = defineProvider({
+      descriptor,
+      access: Object.freeze({
+        guest: 'supported',
+        guestContinueControlNames: Object.freeze([
+          'Continue as guest',
+          'Stay in guest mode',
+          'Continue without signing in',
+          'Continue without an account',
+          'Use without an account',
+        ]),
+      }),
+      account: Object.freeze({
+        inspector: new MenuTextAccountInspector(),
+        freePlanLabels: Object.freeze(['Free']),
+        paidPlanLabels: Object.freeze(['Go', 'Plus', 'Pro', 'Team', 'Business', 'Enterprise']),
+      }),
+      composerSelectors: Object.freeze([
+        'div#prompt-textarea[contenteditable="true"]',
+        '#prompt-textarea[contenteditable="true"]',
+        '[data-testid="composer"] [contenteditable="true"]',
+        'div[contenteditable="true"][data-id="root"]',
+        'div.ProseMirror[contenteditable="true"]',
+        'div[role="textbox"][contenteditable="true"]',
+        'textarea[placeholder*="Message" i]',
+        'textarea[data-testid="prompt-textarea"]',
+        'textarea',
+      ]),
+      submitSelectors: Object.freeze([
+        'button[data-testid="send-button"]',
+        'button[data-testid="composer-send-button"]',
+        'button[aria-label="Send prompt"]',
+        'button[aria-label="Send message"]',
+        'button[aria-label*="Send" i]',
+        'button[type="submit"]',
+      ]),
+      answerSelectors: Object.freeze([
+        '[data-message-author-role="assistant"]',
+        'article[data-testid*="conversation-turn"]',
+        'main article',
+      ]),
+      fileInputSelectors: Object.freeze([
+        'input#upload-files[type="file"]',
+        'input[type="file"]',
+      ]),
+      fileUploadTriggerSelectors: Object.freeze([
+        'button[data-testid="composer-plus-btn"]',
+        'button[aria-label="Add files and more"]',
+        'button[aria-label*="Add photos" i]',
+        'button[aria-label*="Add files" i]',
+        'button[aria-label*="Attach" i]',
+        'button[aria-label*="Upload" i]',
+      ]),
+      fileUploadLocalSelectors: Object.freeze([
+        '[role="menuitem"]:has-text("Upload from computer")',
+        '.__menu-item:has-text("Upload from computer")',
+        '[role="menuitem"]:has-text("Add photos & files")',
+        '[role="menuitem"]:has-text("Add photos and files")',
+        '[role="menuitem"]:has-text("Add files or photos")',
+        '[role="menuitem"]:has-text("Add files")',
+        '[role="menuitem"]:has-text("Upload files")',
+        'button[role="menuitem"][aria-label*="Upload files" i]',
+      ]),
+      modelControlSelectors: Object.freeze([
+        'button[data-testid="model-switcher-dropdown-button"]',
+        'button[aria-label*="model" i]',
+        'button:has-text("GPT")',
+      ]),
+      effortControlSelectors: Object.freeze([
+        'button[aria-label*="thinking" i]',
+        'button:has-text("Thinking")',
+      ]),
+      authIndicators: Object.freeze([
+        '[data-testid="accounts-profile-button"][role="button"]:not([aria-label="Open profile menu"])',
+      ]),
+      loginIndicators: Object.freeze([
+        'a[href*="/auth/login"]',
+        'button:has-text("Log in")',
+        'button:has-text("Sign up")',
+      ]),
+      blockerSelectors: Object.freeze([
+        'iframe[src*="captcha"]',
+        '[aria-label*="captcha" i]',
+        'text=/rate limit|too many requests/i',
+        'text=/upgrade required|upgrade your plan/i',
+      ]),
+      busySelectors: Object.freeze([
+        'button[data-testid="stop-button"]',
+        'button[aria-label*="Stop generating" i]',
+      ]),
+      choiceAvailability: DEFAULT_CHOICE_AVAILABILITY,
+      capabilities: providerCapabilities(),
+    })
+    super(provider)
+  }
+}
diff --git a/packages/cli/src/providers/choice-availability.ts b/packages/cli/src/providers/choice-availability.ts
new file mode 100644
index 0000000..b50ff22
--- /dev/null
+++ b/packages/cli/src/providers/choice-availability.ts
@@ -0,0 +1,11 @@
+import type { ProviderChoiceAvailabilityPolicy } from './provider-definition.js'
+
+export class DefaultChoiceAvailability implements ProviderChoiceAvailabilityPolicy {
+  readonly unavailableClassTokens = Object.freeze([])
+  readonly mutedUnavailableClassToken = null
+  readonly mutedOpacityClassToken = null
+
+  constructor() {
+    Object.freeze(this)
+  }
+}
diff --git a/packages/cli/src/providers/claude-provider.ts b/packages/cli/src/providers/claude-provider.ts
new file mode 100644
index 0000000..228ba48
--- /dev/null
+++ b/packages/cli/src/providers/claude-provider.ts
@@ -0,0 +1,139 @@
+import { BaseProvider } from './base-provider.js'
+import {
+  DEFAULT_CHOICE_AVAILABILITY,
+  defineDescriptor,
+  defineProvider,
+  providerCapabilities,
+} from './provider-definition.js'
+import { MenuTextAccountInspector } from './account-inspectors.js'
+import { NativeProjectWorkspaceCapability } from './capabilities/native-project-workspace.js'
+import { PROVIDER_NAVIGATION_CATALOG } from './provider-navigation-catalog.js'
+
+export class ClaudeProvider extends BaseProvider<'claude'> {
+  constructor() {
+    const descriptor = defineDescriptor({
+      id: 'claude',
+      label: 'Claude',
+      stage: 'supported',
+      setupOrder: 1,
+      protocolCompatibility: Object.freeze({
+        legacyRequests: true,
+      }),
+      navigation: PROVIDER_NAVIGATION_CATALOG.claude,
+      profileImport: Object.freeze({
+        cookieDomains: Object.freeze(['claude.ai', 'anthropic.com']),
+      }),
+      controls: Object.freeze({
+        chatSurface: false,
+      }),
+    })
+    const provider = defineProvider({
+      descriptor,
+      access: Object.freeze({
+        guest: 'unsupported',
+        guestContinueControlNames: Object.freeze([]),
+      }),
+      account: Object.freeze({
+        inspector: new MenuTextAccountInspector(),
+        freePlanLabels: Object.freeze(['Free']),
+        paidPlanLabels: Object.freeze(['Pro', 'Max', 'Team', 'Enterprise']),
+      }),
+      composerSelectors: Object.freeze([
+        'div[data-testid="chat-input"][contenteditable="true"][role="textbox"]',
+        'div[aria-label="Write your prompt to Claude"][contenteditable="true"][role="textbox"]',
+        'div[contenteditable="true"][role="textbox"]',
+        'div.ProseMirror[contenteditable="true"]',
+        'textarea',
+      ]),
+      submitSelectors: Object.freeze([
+        'button[data-cds="Button"][aria-label="Send message"]',
+        'button[aria-label="Send message"]',
+        'button[aria-label*="Send" i]',
+        'button[type="submit"]',
+      ]),
+      answerSelectors: Object.freeze([
+        '[data-testid="virtual-message-list"] .font-claude-response-body',
+        'main .font-claude-response-body',
+        '.font-claude-response-body',
+      ]),
+      fileInputSelectors: Object.freeze([
+        'input#chat-input-file-upload-onpage[data-testid="file-upload"][type="file"]',
+        'input[data-testid="file-upload"][type="file"]',
+        'input[type="file"]',
+      ]),
+      fileUploadTriggerSelectors: Object.freeze([
+        'button[aria-label="Add files, connectors, and more"]',
+      ]),
+      fileUploadLocalSelectors: Object.freeze([
+        '[role="menuitem"]:has-text("Add files or photos")',
+      ]),
+      modelControlSelectors: Object.freeze([
+        'button[aria-label*="model" i]',
+        'button:has-text("Claude")',
+      ]),
+      effortControlSelectors: Object.freeze([]),
+      authIndicators: Object.freeze([
+        'button[data-testid="user-menu-button"]',
+      ]),
+      loginIndicators: Object.freeze([
+        'button[data-testid="login-with-google"]',
+        'input[placeholder="Enter your email"]',
+        'button:has-text("Continue")',
+      ]),
+      blockerSelectors: Object.freeze([
+        'iframe[src*="captcha"]',
+        'iframe[src*="challenges.cloudflare.com"]',
+        'input[placeholder="Enter your email"]',
+        'text=/rate limit|too many requests/i',
+        'text=/upgrade required|upgrade your plan/i',
+      ]),
+      busySelectors: Object.freeze([
+        '[data-testid="virtual-message-list"] [data-is-streaming="true"]',
+        'button[aria-label*="Stop" i]',
+      ]),
+      choiceAvailability: DEFAULT_CHOICE_AVAILABILITY,
+      capabilities: providerCapabilities({ nativeWorkspace: true }),
+    })
+    super(provider, {
+      workspace: new NativeProjectWorkspaceCapability(provider, {
+        listUrl: 'https://claude.ai/projects',
+        projectPath: /^\/project\/(?<resourceId>[A-Za-z0-9_-]+)(?:\/|$)/u,
+        projectLinkSelectors: Object.freeze([
+          'ul[aria-label="Projects"] a[href*="/project/"]',
+          'a[href*="/project/"]',
+        ]),
+        createTriggerSelectors: Object.freeze([
+          'button:has-text("New project")',
+          'button:has-text("Create project")',
+        ]),
+        nameInputSelectors: Object.freeze([
+          'input[aria-label="Project name"]',
+          'input[placeholder*="project name" i]',
+          '[role="dialog"] input[type="text"]',
+        ]),
+        instructionsInputSelectors: Object.freeze([
+          'textarea[aria-label*="project instructions" i]',
+          'textarea[placeholder*="instructions" i]',
+          '[role="dialog"] textarea',
+        ]),
+        createSubmitSelectors: Object.freeze([
+          '[role="dialog"] button:has-text("Create project")',
+          '[role="dialog"] button:has-text("Create")',
+        ]),
+        instructionOpenSelectors: Object.freeze([
+          'button:has-text("Set project instructions")',
+          'button:has-text("Add instructions")',
+          'button:has-text("Edit instructions")',
+        ]),
+        instructionSaveSelectors: Object.freeze([
+          '[role="dialog"] button:has-text("Save")',
+          'button:has-text("Save instructions")',
+        ]),
+        stableUnavailableSelectors: Object.freeze([
+          'text=/projects (?:are )?(?:not available|unavailable) on your plan/i',
+          'text=/upgrade to (?:create|use) projects/i',
+        ]),
+      }),
+    })
+  }
+}
diff --git a/packages/cli/src/providers/contracts.ts b/packages/cli/src/providers/contracts.ts
new file mode 100644
index 0000000..25cc7e8
--- /dev/null
+++ b/packages/cli/src/providers/contracts.ts
@@ -0,0 +1,356 @@
+import {
+  VISIBLE_ACTION_SCHEMA_ID_V3,
+  VISIBLE_ATTACHMENT_SCHEMA_ID,
+} from '../schema-ids.js'
+import type { ProviderId } from './provider-identity.js'
+
+export type VisibleActionProtocolVersion = typeof VISIBLE_ACTION_SCHEMA_ID_V3
+
+export function isVisibleActionProtocolVersion(value: unknown): value is VisibleActionProtocolVersion {
+  return value === VISIBLE_ACTION_SCHEMA_ID_V3
+}
+
+export const VISIBLE_ACTIONS = Object.freeze({
+  CAPABILITY_INSPECT: 'capability.inspect',
+  AUTH_STATUS: 'auth.status',
+  MODEL_INSPECT: 'model.inspect',
+  MODEL_SELECT: 'model.select',
+  EFFORT_INSPECT: 'effort.inspect',
+  EFFORT_SELECT: 'effort.select',
+  QWEN_MODE_INSPECT: 'qwen.mode.inspect',
+  QWEN_MODE_SELECT: 'qwen.mode.select',
+  DEEPSEEK_MODE_INSPECT: 'deepseek.mode.inspect',
+  DEEPSEEK_MODE_SELECT: 'deepseek.mode.select',
+  DEEPSEEK_DEEPTHINK_INSPECT: 'deepseek.deepthink.inspect',
+  DEEPSEEK_DEEPTHINK_SELECT: 'deepseek.deepthink.select',
+  DEEPSEEK_SEARCH_INSPECT: 'deepseek.search.inspect',
+  DEEPSEEK_SEARCH_SELECT: 'deepseek.search.select',
+  DOUBAO_MODE_INSPECT: 'doubao.mode.inspect',
+  DOUBAO_MODE_SELECT: 'doubao.mode.select',
+  DOUBAO_SKILL_INSPECT: 'doubao.skill.inspect',
+  DOUBAO_SKILL_SELECT: 'doubao.skill.select',
+  FILE_UPLOAD: 'file.upload',
+  WORKSPACE_ENSURE: 'workspace.ensure',
+  PROMPT_INPUT: 'prompt.input',
+  PROMPT_CLEAR: 'prompt.clear',
+  PROMPT_SUBMIT: 'prompt.submit',
+  RESPONSE_READ: 'response.read',
+  SNAPSHOT_SANITIZED: 'snapshot.sanitized',
+  NAVIGATION_CHECK: 'navigation.check',
+  BLOCKER_CHECK: 'blocker.check',
+})
+
+export type VisibleAction = typeof VISIBLE_ACTIONS[keyof typeof VISIBLE_ACTIONS]
+
+export type JsonValue =
+  | null
+  | boolean
+  | number
+  | string
+  | readonly JsonValue[]
+  | { readonly [key: string]: JsonValue }
+
+export type ProviderActionPreparation<Action extends VisibleAction = VisibleAction> = Readonly<{
+  provider: ProviderId
+  action: Action
+  schema: string
+  value: JsonValue
+}>
+
+export type ProviderActionObservation = Readonly<{
+  state: 'pending' | 'ready'
+}>
+
+export type AttachmentInput = {
+  protocol: typeof VISIBLE_ATTACHMENT_SCHEMA_ID
+  bundleId: string
+  attachmentId: string
+  name: string
+  type: string
+  size: number
+  sha256: string
+}
+
+export type EmptyVisibleActionPayload = Record<string, never>
+export type VisibleSelectionPayload = {
+  label: string
+}
+export type QwenModeSelectionPayload = {
+  mode: string
+  variant?: string
+}
+export type DeepSeekMode = 'Instant' | 'Expert' | 'Vision'
+export type DeepSeekModeSelectionPayload = {
+  mode: DeepSeekMode
+}
+export type DeepSeekToggleSelectionPayload = {
+  enabled: boolean
+}
+export type DoubaoMode = 'fast' | 'expert' | 'work-task-turbo' | 'work-task-pro'
+export type DoubaoModeSelectionPayload = {
+  mode: DoubaoMode
+}
+export type DoubaoSkill =
+  | 'chat'
+  | 'document-writing'
+  | 'presentation-generation'
+  | 'image-generation'
+  | 'video-generation'
+  | 'deep-research'
+  | 'audio-podcast'
+  | 'music-generation'
+  | 'problem-solving'
+  | 'spreadsheet-generation'
+  | 'audio-transcription'
+export type DoubaoSkillSelectionPayload = {
+  skill: DoubaoSkill
+}
+export type FileUploadPayload = {
+  attachments: readonly AttachmentInput[]
+}
+export type WorkspaceEnsurePayload = {
+  name: string
+  mode: 'auto' | 'native' | 'conversation'
+  instructions?: string
+}
+export type PromptInputPayload = {
+  text: string
+}
+
+export type VisibleActionRequestEnvelope<
+  Action extends VisibleAction = VisibleAction,
+  Payload extends object = Record<string, unknown>,
+> = {
+  protocol: VisibleActionProtocolVersion
+  requestId: string
+  provider: ProviderId
+  action: Action
+  payload: Payload
+}
+
+export type CapabilityInspectActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.CAPABILITY_INSPECT,
+  EmptyVisibleActionPayload
+>
+export type AuthStatusActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.AUTH_STATUS,
+  EmptyVisibleActionPayload
+>
+export type ModelInspectActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.MODEL_INSPECT,
+  EmptyVisibleActionPayload
+>
+export type ModelSelectActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.MODEL_SELECT,
+  VisibleSelectionPayload
+>
+export type EffortInspectActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.EFFORT_INSPECT,
+  EmptyVisibleActionPayload
+>
+export type EffortSelectActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.EFFORT_SELECT,
+  VisibleSelectionPayload
+>
+export type QwenModeInspectActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.QWEN_MODE_INSPECT,
+  EmptyVisibleActionPayload
+>
+export type QwenModeSelectActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.QWEN_MODE_SELECT,
+  QwenModeSelectionPayload
+>
+export type DeepSeekModeInspectActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.DEEPSEEK_MODE_INSPECT,
+  EmptyVisibleActionPayload
+>
+export type DeepSeekModeSelectActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.DEEPSEEK_MODE_SELECT,
+  DeepSeekModeSelectionPayload
+>
+export type DeepSeekDeepThinkInspectActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.DEEPSEEK_DEEPTHINK_INSPECT,
+  EmptyVisibleActionPayload
+>
+export type DeepSeekDeepThinkSelectActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.DEEPSEEK_DEEPTHINK_SELECT,
+  DeepSeekToggleSelectionPayload
+>
+export type DeepSeekSearchInspectActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.DEEPSEEK_SEARCH_INSPECT,
+  EmptyVisibleActionPayload
+>
+export type DeepSeekSearchSelectActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.DEEPSEEK_SEARCH_SELECT,
+  DeepSeekToggleSelectionPayload
+>
+export type DoubaoModeInspectActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.DOUBAO_MODE_INSPECT,
+  EmptyVisibleActionPayload
+>
+export type DoubaoModeSelectActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.DOUBAO_MODE_SELECT,
+  DoubaoModeSelectionPayload
+>
+export type DoubaoSkillInspectActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.DOUBAO_SKILL_INSPECT,
+  EmptyVisibleActionPayload
+>
+export type DoubaoSkillSelectActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.DOUBAO_SKILL_SELECT,
+  DoubaoSkillSelectionPayload
+>
+export type FileUploadActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.FILE_UPLOAD,
+  FileUploadPayload
+>
+export type WorkspaceEnsureActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.WORKSPACE_ENSURE,
+  WorkspaceEnsurePayload
+>
+export type PromptInputActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.PROMPT_INPUT,
+  PromptInputPayload
+>
+export type PromptClearActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.PROMPT_CLEAR,
+  EmptyVisibleActionPayload
+>
+export type PromptSubmitActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.PROMPT_SUBMIT,
+  EmptyVisibleActionPayload
+>
+export type ResponseReadActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.RESPONSE_READ,
+  EmptyVisibleActionPayload
+>
+export type SnapshotSanitizedActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.SNAPSHOT_SANITIZED,
+  EmptyVisibleActionPayload
+>
+export type NavigationCheckActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.NAVIGATION_CHECK,
+  EmptyVisibleActionPayload
+>
+export type BlockerCheckActionRequest = VisibleActionRequestEnvelope<
+  typeof VISIBLE_ACTIONS.BLOCKER_CHECK,
+  EmptyVisibleActionPayload
+>
+
+export type VisibleActionRequest =
+  | CapabilityInspectActionRequest
+  | AuthStatusActionRequest
+  | ModelInspectActionRequest
+  | ModelSelectActionRequest
+  | EffortInspectActionRequest
+  | EffortSelectActionRequest
+  | QwenModeInspectActionRequest
+  | QwenModeSelectActionRequest
+  | DeepSeekModeInspectActionRequest
+  | DeepSeekModeSelectActionRequest
+  | DeepSeekDeepThinkInspectActionRequest
+  | DeepSeekDeepThinkSelectActionRequest
+  | DeepSeekSearchInspectActionRequest
+  | DeepSeekSearchSelectActionRequest
+  | DoubaoModeInspectActionRequest
+  | DoubaoModeSelectActionRequest
+  | DoubaoSkillInspectActionRequest
+  | DoubaoSkillSelectActionRequest
+  | FileUploadActionRequest
+  | WorkspaceEnsureActionRequest
+  | PromptInputActionRequest
+  | PromptClearActionRequest
+  | PromptSubmitActionRequest
+  | ResponseReadActionRequest
+  | SnapshotSanitizedActionRequest
+  | NavigationCheckActionRequest
+  | BlockerCheckActionRequest
+
+export type VisibleActionWireRequest = VisibleActionRequestEnvelope<VisibleAction, Record<string, unknown>>
+export type VisibleActionRequestForAction<Action extends VisibleAction> = Extract<VisibleActionRequest, { action: Action }>
+export type VisibleActionPayloadForAction<Action extends VisibleAction> = VisibleActionRequestForAction<Action>['payload']
+
+const MAX_PREPARATION_JSON_BYTES = 4096
+const MAX_PREPARATION_JSON_DEPTH = 8
+const MAX_PREPARATION_ARRAY_LENGTH = 64
+const MAX_PREPARATION_OBJECT_KEYS = 32
+const MAX_PREPARATION_KEY_LENGTH = 128
+const MAX_PREPARATION_STRING_LENGTH = 2048
+const UNSAFE_PREPARATION_KEYS = new Set(['__proto__', 'constructor', 'prototype'])
+
+export function validateProviderActionPreparation(
+  input: unknown,
+  expected: {
+    provider: ProviderId
+    action: VisibleAction
+    schema: string
+  },
+): ProviderActionPreparation {
+  if (!isPlainRecord(input)) throw new Error('Provider action preparation must be an object.')
+  if (!hasExactKeys(input, ['provider', 'action', 'schema', 'value'])) {
+    throw new Error('Provider action preparation fields are invalid.')
+  }
+  if (input.provider !== expected.provider || input.action !== expected.action || input.schema !== expected.schema) {
+    throw new Error('Provider action preparation target is invalid.')
+  }
+  const value = validateBoundedJsonValue(input.value)
+  const preparation = Object.freeze({
+    provider: input.provider,
+    action: input.action,
+    schema: input.schema,
+    value,
+  }) as ProviderActionPreparation
+  const bytes = Buffer.byteLength(JSON.stringify(preparation), 'utf8')
+  if (bytes > MAX_PREPARATION_JSON_BYTES) {
+    throw new Error('Provider action preparation is too large.')
+  }
+  return preparation
+}
+
+export function validateBoundedJsonValue(input: unknown): JsonValue {
+  const seen = new WeakSet<object>()
+  return validateBoundedJsonValueAt(input, 0, seen)
+}
+
+function validateBoundedJsonValueAt(input: unknown, depth: number, seen: WeakSet<object>): JsonValue {
+  if (depth > MAX_PREPARATION_JSON_DEPTH) throw new Error('JSON value is too deep.')
+  if (input === null || typeof input === 'boolean' || typeof input === 'string') {
+    if (typeof input === 'string' && input.length > MAX_PREPARATION_STRING_LENGTH) {
+      throw new Error('JSON string value is too large.')
+    }
+    return input
+  }
+  if (typeof input === 'number') {
+    if (!Number.isFinite(input)) throw new Error('JSON number value is invalid.')
+    return input
+  }
+  if (Array.isArray(input)) {
+    if (input.length > MAX_PREPARATION_ARRAY_LENGTH) throw new Error('JSON array value is too large.')
+    if (seen.has(input)) throw new Error('JSON value must not contain cycles.')
+    seen.add(input)
+    return Object.freeze(input.map((entry) => validateBoundedJsonValueAt(entry, depth + 1, seen)))
+  }
+  if (!isPlainRecord(input)) throw new Error('JSON value is invalid.')
+  if (seen.has(input)) throw new Error('JSON value must not contain cycles.')
+  seen.add(input)
+  const entries = Object.entries(input)
+  if (entries.length > MAX_PREPARATION_OBJECT_KEYS) throw new Error('JSON object value has too many keys.')
+  const output: Record<string, JsonValue> = {}
+  for (const [key, value] of entries) {
+    if (key.length === 0 || key.length > MAX_PREPARATION_KEY_LENGTH || UNSAFE_PREPARATION_KEYS.has(key)) {
+      throw new Error('JSON object key is invalid.')
+    }
+    output[key] = validateBoundedJsonValueAt(value, depth + 1, seen)
+  }
+  return Object.freeze(output)
+}
+
+function hasExactKeys(input: Record<string, unknown>, keys: readonly string[]) {
+  const actual = Object.keys(input).sort()
+  const expected = [...keys].sort()
+  return actual.length === expected.length && actual.every((key, index) => key === expected[index])
+}
+
+function isPlainRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value && typeof value === 'object' && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype)
+}
diff --git a/packages/cli/src/providers/deepseek-provider.ts b/packages/cli/src/providers/deepseek-provider.ts
new file mode 100644
index 0000000..210c9c0
--- /dev/null
+++ b/packages/cli/src/providers/deepseek-provider.ts
@@ -0,0 +1,113 @@
+import { BaseProvider } from './base-provider.js'
+import {
+  DEFAULT_CHOICE_AVAILABILITY,
+  defineDescriptor,
+  defineProvider,
+  providerCapabilities,
+} from './provider-definition.js'
+import { MenuTextAccountInspector } from './account-inspectors.js'
+import { waitForVisibleLocator } from './dom-locators.js'
+import {
+  DeepSeekAttachmentCapability,
+  DeepSeekModeCapability,
+  DeepSeekToggleCapability,
+} from './capabilities/deepseek-controls.js'
+import type { Page } from 'playwright-core'
+import { PROVIDER_NAVIGATION_CATALOG } from './provider-navigation-catalog.js'
+
+const DEEPSEEK_SESSION_HYDRATION_TIMEOUT_MS = 10_000
+
+export class DeepSeekProvider extends BaseProvider<'deepseek'> {
+  constructor() {
+    const descriptor = defineDescriptor({
+      id: 'deepseek',
+      label: 'DeepSeek',
+      stage: 'experimental',
+      setupOrder: 5,
+      protocolCompatibility: Object.freeze({
+        legacyRequests: false,
+      }),
+      navigation: PROVIDER_NAVIGATION_CATALOG.deepseek,
+      profileImport: Object.freeze({
+        cookieDomains: Object.freeze(['deepseek.com']),
+      }),
+      controls: Object.freeze({
+        chatSurface: false,
+      }),
+    })
+    const provider = defineProvider({
+      descriptor,
+      access: Object.freeze({
+        guest: 'unsupported',
+        guestContinueControlNames: Object.freeze([]),
+      }),
+      account: Object.freeze({
+        inspector: new MenuTextAccountInspector(),
+        freePlanLabels: Object.freeze(['Free']),
+        paidPlanLabels: Object.freeze([]),
+      }),
+      composerSelectors: Object.freeze([
+        'textarea[name="search"][placeholder="Message DeepSeek"]',
+      ]),
+      submitSelectors: Object.freeze([
+        'div[role="button"].ds-button.ds-button--primary:not(.ds-button--disabled)',
+      ]),
+      answerSelectors: Object.freeze([
+        '.ds-markdown.ds-assistant-message-main-content',
+        '.ds-message > .ds-markdown',
+      ]),
+      fileInputSelectors: Object.freeze([
+        'input[type="file"][multiple]',
+      ]),
+      fileUploadTriggerSelectors: Object.freeze([
+        'div[role="button"].ds-button.ds-button--iconLabelPrimary',
+      ]),
+      fileUploadLocalSelectors: Object.freeze([]),
+      modelControlSelectors: Object.freeze([]),
+      effortControlSelectors: Object.freeze([]),
+      authIndicators: Object.freeze([
+        'textarea[name="search"][placeholder="Message DeepSeek"]',
+      ]),
+      loginIndicators: Object.freeze([
+        'input[placeholder="Phone number / email address"]',
+        'input[type="password"][placeholder="Password"]',
+        'div[role="button"]:has-text("Log in")',
+      ]),
+      blockerSelectors: Object.freeze([
+        'iframe[src*="hcaptcha.com" i]',
+        'iframe[title*="hcaptcha" i]',
+        '.h-captcha',
+        'text=/server is busy|server busy|please try again later/i',
+        'text=/rate limit|too many requests/i',
+      ]),
+      busySelectors: Object.freeze([
+        'button[aria-label*="Stop" i]',
+        'div[role="button"][aria-label*="Stop" i]',
+        '.ds-loading',
+      ]),
+      choiceAvailability: DEFAULT_CHOICE_AVAILABILITY,
+      capabilities: providerCapabilities({ deepSeekControls: true }),
+    })
+    super(provider, {
+      fileUpload: new DeepSeekAttachmentCapability(provider),
+      extensions: Object.freeze([
+        new DeepSeekModeCapability(provider),
+        new DeepSeekToggleCapability(provider, 'DeepThink'),
+        new DeepSeekToggleCapability(provider, 'Search'),
+      ]),
+    })
+  }
+
+  protected override async inspectAccount(page: Page, signal: AbortSignal | undefined) {
+    await waitForVisibleLocator(
+      page,
+      [
+        ...this.definition.loginIndicators,
+        ...this.definition.authIndicators,
+        ...this.definition.composerSelectors,
+      ],
+      DEEPSEEK_SESSION_HYDRATION_TIMEOUT_MS,
+    )
+    return await super.inspectAccount(page, signal)
+  }
+}
diff --git a/packages/cli/src/providers/dom-locators.ts b/packages/cli/src/providers/dom-locators.ts
new file mode 100644
index 0000000..4b71a20
--- /dev/null
+++ b/packages/cli/src/providers/dom-locators.ts
@@ -0,0 +1,137 @@
+import type { Locator, Page } from 'playwright-core'
+
+export async function firstVisibleLocator(page: Page, selectors: readonly string[], timeoutMs = 1000): Promise<Locator | null> {
+  for (const selector of selectors) {
+    const locator = page.locator(selector).filter({ visible: true }).first()
+    try {
+      if (await locator.isVisible({ timeout: timeoutMs })) return locator
+    } catch {
+      // Try the next selector.
+    }
+  }
+  return null
+}
+
+export async function waitForVisibleLocator(page: Page, selectors: readonly string[], timeoutMs: number): Promise<Locator | null> {
+  if (selectors.length === 0) return null
+  const deadline = Date.now() + timeoutMs
+  do {
+    for (const selector of selectors) {
+      const locator = page.locator(selector).filter({ visible: true }).first()
+      try {
+        if (await locator.isVisible({ timeout: 100 })) return locator
+      } catch {
+        // A provider can replace controls while the page hydrates. Re-observe until the deadline.
+      }
+    }
+    if (Date.now() < deadline) {
+      await page.waitForTimeout(Math.min(100, Math.max(1, deadline - Date.now())))
+    }
+  } while (Date.now() < deadline)
+  return null
+}
+
+export async function latestLocator(page: Page, selectors: readonly string[]): Promise<Locator | null> {
+  for (const selector of selectors) {
+    const locator = page.locator(selector)
+    try {
+      const count = await locator.count()
+      if (count > 0) return locator.nth(count - 1)
+    } catch {
+      // Try the next selector.
+    }
+  }
+  return null
+}
+
+export async function countVisibleLocators(page: Page, selectors: readonly string[]) {
+  let total = 0
+  for (const selector of selectors) {
+    const locator = page.locator(selector)
+    const count = await locator.count()
+    for (let index = 0; index < count; index += 1) {
+      if (await locator.nth(index).isVisible({ timeout: 50 }).catch(() => false)) total += 1
+    }
+  }
+  return total
+}
+
+export async function anyVisibleLocator(page: Page, selectors: readonly string[], timeoutMs = 100) {
+  for (const selector of selectors) {
+    if (await page.locator(selector).first().isVisible({ timeout: timeoutMs }).catch(() => false)) return true
+  }
+  return false
+}
+
+export async function firstEnabledLocator(page: Page, selectors: readonly string[]): Promise<Locator | null> {
+  for (const selector of selectors) {
+    const locator = page.locator(selector).filter({ visible: true }).first()
+    try {
+      if (await locator.isVisible({ timeout: 500 }) && !await locatorIsUnavailable(locator)) return locator
+    } catch {
+      // Try the next selector.
+    }
+  }
+  return null
+}
+
+export async function waitForEnabledLocator(page: Page, selectors: readonly string[], timeoutMs: number): Promise<Locator | null> {
+  if (selectors.length === 0) return null
+  const deadline = Date.now() + timeoutMs
+  do {
+    const locator = await firstEnabledLocator(page, selectors)
+    if (locator) return locator
+    if (Date.now() < deadline) {
+      await page.waitForTimeout(Math.min(100, Math.max(1, deadline - Date.now())))
+    }
+  } while (Date.now() < deadline)
+  return null
+}
+
+export async function firstUnavailableLocator(page: Page, selectors: readonly string[]): Promise<Locator | null> {
+  for (const selector of selectors) {
+    const locator = page.locator(selector).filter({ visible: true }).first()
+    try {
+      if (await locator.isVisible({ timeout: 500 }) && await locatorIsUnavailable(locator)) return locator
+    } catch {
+      // Try the next selector.
+    }
+  }
+  return null
+}
+
+export async function firstFileInputLocator(page: Page, selectors: readonly string[]): Promise<Locator | null> {
+  for (const selector of selectors) {
+    const locator = page.locator(selector).first()
+    try {
+      const count = typeof (locator as Locator & { count?: unknown }).count === 'function'
+        ? await locator.count()
+        : (await locator.isVisible({ timeout: 250 }) ? 1 : 0)
+      if (count > 0 && await fileInputAcceptsUserFiles(locator)) return locator
+    } catch {
+      // Try the next selector.
+    }
+  }
+  return null
+}
+
+export async function fileInputAcceptsUserFiles(locator: Locator) {
+  return await locator.evaluate((element) => (
+    element instanceof HTMLInputElement &&
+    element.type === 'file' &&
+    !element.disabled &&
+    element.getAttribute('aria-disabled') !== 'true'
+  )).catch(() => true)
+}
+
+async function locatorIsUnavailable(locator: Locator) {
+  return await locator.evaluate((element) => {
+    const text = (element.textContent ?? '').replace(/\s+/g, ' ').toLowerCase()
+    const aria = (element.getAttribute('aria-label') ?? '').toLowerCase()
+    const dataDisabled = element.getAttribute('data-disabled')
+    return element.hasAttribute('disabled') ||
+      element.getAttribute('aria-disabled') === 'true' ||
+      (dataDisabled !== null && dataDisabled !== 'false') ||
+      /upgrade|subscribe|requires paid|plan limit|log in|sign in/.test(`${text} ${aria}`)
+  }).catch(() => false)
+}
diff --git a/packages/cli/src/providers/doubao-account-inspector.ts b/packages/cli/src/providers/doubao-account-inspector.ts
new file mode 100644
index 0000000..4cad1de
--- /dev/null
+++ b/packages/cli/src/providers/doubao-account-inspector.ts
@@ -0,0 +1,67 @@
+import type { Locator, Page } from 'playwright-core'
+import {
+  MenuTextAccountInspector,
+  type ProviderAccountInspection,
+  type ProviderAccountInspector,
+} from './account-inspectors.js'
+import type { ProviderDomDefinition } from './provider-definition.js'
+
+export class DoubaoAccountInspector implements ProviderAccountInspector {
+  async inspect(
+    page: Page,
+    provider: ProviderDomDefinition,
+    accountControl: Locator,
+    signal: AbortSignal | undefined,
+  ): Promise<ProviderAccountInspection> {
+    const base = await new MenuTextAccountInspector().inspect(page, provider, accountControl, signal)
+    const subscription = await inspectDoubaoSubscription(page, accountControl, signal)
+    if (subscription === null) {
+      return {
+        ...base,
+        subscription: null,
+        subscriptionEvidence: {
+          status: 'unknown',
+          source: null,
+        },
+      }
+    }
+    return {
+      ...base,
+      subscription,
+      subscriptionEvidence: {
+        status: 'derived',
+        source: 'upgrade-to-professional-menu-item',
+      },
+    }
+  }
+}
+
+async function inspectDoubaoSubscription(
+  page: Page,
+  accountControl: Locator,
+  signal: AbortSignal | undefined,
+): Promise<'免费版' | null> {
+  const upgradeItem = page.getByRole('menuitem', { name: '升级到专业版', exact: true })
+  let openedHere = false
+  try {
+    if (!await upgradeItem.isVisible({ timeout: 300 }).catch(() => false)) {
+      assertNotAborted(signal)
+      await accountControl.click({ timeout: 2000 })
+      openedHere = true
+    }
+    for (let attempt = 0; attempt <= 10; attempt += 1) {
+      assertNotAborted(signal)
+      if (await upgradeItem.isVisible({ timeout: 100 }).catch(() => false)) return '免费版'
+      if (attempt < 10) await page.waitForTimeout(100)
+    }
+    return null
+  } catch {
+    return null
+  } finally {
+    if (openedHere) await page.keyboard.press('Escape').catch(() => undefined)
+  }
+}
+
+function assertNotAborted(signal: AbortSignal | undefined) {
+  if (signal?.aborted) throw signal.reason ?? new Error('Provider session inspection was aborted.')
+}
diff --git a/packages/cli/src/providers/doubao-provider.ts b/packages/cli/src/providers/doubao-provider.ts
new file mode 100644
index 0000000..ba18662
--- /dev/null
+++ b/packages/cli/src/providers/doubao-provider.ts
@@ -0,0 +1,98 @@
+import { BaseProvider } from './base-provider.js'
+import { DoubaoAccountInspector } from './doubao-account-inspector.js'
+import {
+  DEFAULT_CHOICE_AVAILABILITY,
+  defineDescriptor,
+  defineProvider,
+  providerCapabilities,
+} from './provider-definition.js'
+import type { ProviderExecutionContext } from './execution-context.js'
+import type { Page } from 'playwright-core'
+import {
+  DoubaoAttachmentCapability,
+  DoubaoModeCapability,
+  DoubaoSkillCapability,
+} from './capabilities/doubao-controls.js'
+import { PROVIDER_NAVIGATION_CATALOG } from './provider-navigation-catalog.js'
+
+export class DoubaoProvider extends BaseProvider<'doubao'> {
+  constructor() {
+    const descriptor = defineDescriptor({
+      id: 'doubao',
+      label: 'Doubao / 豆包',
+      stage: 'experimental',
+      setupOrder: 8,
+      protocolCompatibility: Object.freeze({
+        legacyRequests: false,
+      }),
+      navigation: PROVIDER_NAVIGATION_CATALOG.doubao,
+      profileImport: Object.freeze({
+        cookieDomains: Object.freeze(['doubao.com']),
+      }),
+      controls: Object.freeze({
+        chatSurface: false,
+      }),
+    })
+    const provider = defineProvider({
+      descriptor,
+      access: Object.freeze({
+        guest: 'unsupported',
+        guestContinueControlNames: Object.freeze([]),
+      }),
+      account: Object.freeze({
+        inspector: new DoubaoAccountInspector(),
+        freePlanLabels: Object.freeze(['免费版']),
+        paidPlanLabels: Object.freeze(['标准套餐', '加强套餐', '高级套餐']),
+      }),
+      composerSelectors: Object.freeze([
+        'textarea.semi-input-textarea',
+      ]),
+      submitSelectors: Object.freeze([
+        'button.bg-dbx-text-highlight[aria-label=""]',
+      ]),
+      answerSelectors: Object.freeze([
+        'div[data-message-id].grid',
+      ]),
+      fileInputSelectors: Object.freeze([
+        'input[type="file"][multiple][accept*=".pdf"][accept*="py"]',
+      ]),
+      fileUploadTriggerSelectors: Object.freeze([
+        'div.max-w-full.min-w-0.flex-1.relative.flex.items-center.h-36 > div:first-child > button[data-dbx-name="button"]',
+      ]),
+      fileUploadLocalSelectors: Object.freeze([]),
+      modelControlSelectors: Object.freeze([]),
+      effortControlSelectors: Object.freeze([]),
+      authIndicators: Object.freeze([
+        '#flow_chat_sidebar button.w-full.h-full:has(img)',
+      ]),
+      loginIndicators: Object.freeze([
+        'text=/受区域限制，请先登录再使用豆包/',
+        'text=/^登录$/',
+      ]),
+      blockerSelectors: Object.freeze([
+        'iframe[src*="rmc.bytedance.com/verifycenter/captcha" i]',
+        'iframe[src*="recaptcha" i]',
+        'iframe[src*="hcaptcha.com" i]',
+        'iframe[src*="challenges.cloudflare.com" i]',
+        'text=/请求过于频繁|稍后再试|服务繁忙|达到.*上限|额度已用完/',
+      ]),
+      busySelectors: Object.freeze([
+        'div.flex.flex-col.flex-grow.max-w-full.min-w-0:has(> div[data-message-id].grid):not(:has(button[aria-label="朗读"]))',
+      ]),
+      choiceAvailability: DEFAULT_CHOICE_AVAILABILITY,
+      capabilities: providerCapabilities({ doubaoControls: true }),
+    })
+    super(provider, {
+      fileUpload: new DoubaoAttachmentCapability(provider),
+      extensions: Object.freeze([
+        new DoubaoModeCapability(provider),
+        new DoubaoSkillCapability(provider),
+      ]),
+    })
+  }
+
+  protected override async submitPrompt(page: Page, context: ProviderExecutionContext) {
+    await page.waitForTimeout(400)
+    return await super.submitPrompt(page, context)
+  }
+}
diff --git a/packages/cli/src/providers/execution-context.ts b/packages/cli/src/providers/execution-context.ts
new file mode 100644
index 0000000..fc35972
--- /dev/null
+++ b/packages/cli/src/providers/execution-context.ts
@@ -0,0 +1,35 @@
+import type { Page } from 'playwright-core'
+import type { ProviderDomDefinition } from './provider-definition.js'
+import type { VisibleActionRequest } from './contracts.js'
+
+export type ProviderExecutionContext = {
+  profileId: string
+  operationId: string
+  attachmentRoot?: string
+  signal?: AbortSignal
+  now?: () => Date
+}
+
+export type BoundProviderExecutionContext = ProviderExecutionContext & {
+  readonly provider: ProviderDomDefinition
+  readonly page: Page
+}
+
+export function createProviderExecutionContext(
+  provider: ProviderDomDefinition,
+  page: Page,
+  context: ProviderExecutionContext,
+): BoundProviderExecutionContext {
+  return Object.freeze({
+    ...context,
+    provider,
+    page,
+  })
+}
+
+export function assertProviderRequest(
+  provider: ProviderDomDefinition,
+  request: VisibleActionRequest,
+) {
+  return request.provider === provider.id
+}
diff --git a/packages/cli/src/providers/gemini-account-inspector.ts b/packages/cli/src/providers/gemini-account-inspector.ts
new file mode 100644
index 0000000..4ed7068
--- /dev/null
+++ b/packages/cli/src/providers/gemini-account-inspector.ts
@@ -0,0 +1,34 @@
+import type { Locator, Page } from 'playwright-core'
+import type { ProviderAccountInspection, ProviderAccountInspector } from './account-inspectors.js'
+import type { ProviderDomDefinition } from './provider-definition.js'
+
+export class GeminiAccountInspector implements ProviderAccountInspector {
+  async inspect(
+    _page: Page,
+    _provider: ProviderDomDefinition,
+    accountControl: Locator,
+    _signal: AbortSignal | undefined,
+  ): Promise<ProviderAccountInspection> {
+    const ariaLabel = await accountControl.evaluate((element) => (
+      element.getAttribute('aria-label') ?? ''
+    )).catch(() => '')
+    return {
+      name: geminiGoogleAccountName(ariaLabel),
+      subscription: null,
+      subscriptionEvidence: {
+        status: 'unknown',
+        source: null,
+      },
+    }
+  }
+}
+
+function geminiGoogleAccountName(ariaLabel: string) {
+  const normalized = normalizeAccountText(ariaLabel)
+  const match = normalized.match(/^Google Account:\s*(.+?)(?:\s*\(|$)/i)
+  return match ? normalizeAccountText(match[1] ?? '') || null : null
+}
+
+function normalizeAccountText(value: string) {
+  return value.replace(/\s+/g, ' ').trim().slice(0, 120)
+}
diff --git a/packages/cli/src/providers/gemini-provider.ts b/packages/cli/src/providers/gemini-provider.ts
new file mode 100644
index 0000000..2c70049
--- /dev/null
+++ b/packages/cli/src/providers/gemini-provider.ts
@@ -0,0 +1,99 @@
+import { BaseProvider } from './base-provider.js'
+import {
+  DEFAULT_CHOICE_AVAILABILITY,
+  defineDescriptor,
+  defineProvider,
+  providerCapabilities,
+} from './provider-definition.js'
+import { GeminiAccountInspector } from './gemini-account-inspector.js'
+import { PROVIDER_NAVIGATION_CATALOG } from './provider-navigation-catalog.js'
+
+export class GeminiProvider extends BaseProvider<'gemini'> {
+  constructor() {
+    const descriptor = defineDescriptor({
+      id: 'gemini',
+      label: 'Gemini',
+      stage: 'supported',
+      setupOrder: 2,
+      protocolCompatibility: Object.freeze({
+        legacyRequests: true,
+      }),
+      navigation: PROVIDER_NAVIGATION_CATALOG.gemini,
+      profileImport: Object.freeze({
+        cookieDomains: Object.freeze([]),
+      }),
+      controls: Object.freeze({
+        chatSurface: false,
+      }),
+    })
+    const provider = defineProvider({
+      descriptor,
+      access: Object.freeze({
+        guest: 'supported',
+        guestContinueControlNames: Object.freeze([
+          'Continue as guest',
+          'Stay in guest mode',
+          'Continue without signing in',
+          'Continue without an account',
+          'Use without an account',
+        ]),
+      }),
+      account: Object.freeze({
+        inspector: new GeminiAccountInspector(),
+        freePlanLabels: Object.freeze([]),
+        paidPlanLabels: Object.freeze([]),
+      }),
+      composerSelectors: Object.freeze([
+        'rich-textarea div.ql-editor[data-gramm="false"][contenteditable="true"][role="textbox"][aria-multiline="true"]',
+        'div[contenteditable="true"][role="textbox"]',
+        'textarea',
+      ]),
+      submitSelectors: Object.freeze([
+        'button[aria-label="Send message"]',
+      ]),
+      answerSelectors: Object.freeze([
+        'response-container message-content',
+        'message-content',
+      ]),
+      fileInputSelectors: Object.freeze([
+        'input[type="file"][name="Filedata"]',
+        'input[type="file"]',
+      ]),
+      fileUploadTriggerSelectors: Object.freeze([
+        'button[aria-label="Upload and tools"]',
+      ]),
+      fileUploadLocalSelectors: Object.freeze([
+        'button[role="menuitem"][data-test-id="local-images-files-uploader-button"][aria-label^="Upload files"]',
+        '[role="menuitem"][aria-label^="Upload files"]',
+        '[role="menuitem"]:has-text("Upload files")',
+      ]),
+      modelControlSelectors: Object.freeze([
+        'button[data-test-id="bard-mode-menu-button"]',
+        'button[aria-label*="model" i]',
+        'button:has-text("Gemini")',
+      ]),
+      effortControlSelectors: Object.freeze([]),
+      authIndicators: Object.freeze([
+        'a[href^="https://accounts.google.com/SignOutOptions"]',
+      ]),
+      loginIndicators: Object.freeze([
+        'a[href*="accounts.google.com/ServiceLogin"]',
+        'a[href*="/signin"]',
+        'a[aria-label="Sign in"]',
+        'button[aria-label="Sign in"]',
+        'button:has-text("Sign in")',
+      ]),
+      blockerSelectors: Object.freeze([
+        'iframe[src^="https://www.google.com/recaptcha/"][title="reCAPTCHA"]',
+        'text=/rate limit|too many requests/i',
+        'text=/upgrade required|upgrade your plan/i',
+      ]),
+      busySelectors: Object.freeze([
+        'button[aria-label="Stop response"]',
+      ]),
+      choiceAvailability: DEFAULT_CHOICE_AVAILABILITY,
+      capabilities: providerCapabilities(),
+    })
+    super(provider)
+  }
+}
diff --git a/packages/cli/src/providers/grok-account-inspector.ts b/packages/cli/src/providers/grok-account-inspector.ts
new file mode 100644
index 0000000..5549421
--- /dev/null
+++ b/packages/cli/src/providers/grok-account-inspector.ts
@@ -0,0 +1,123 @@
+import type { Locator, Page } from 'playwright-core'
+import {
+  MenuTextAccountInspector,
+  type ProviderAccountInspection,
+  type ProviderAccountInspector,
+} from './account-inspectors.js'
+import type { ProviderDomDefinition } from './provider-definition.js'
+
+export class GrokEntitlementAccountInspector implements ProviderAccountInspector {
+  async inspect(
+    page: Page,
+    provider: ProviderDomDefinition,
+    accountControl: Locator,
+    signal: AbortSignal | undefined,
+  ): Promise<ProviderAccountInspection> {
+    const base = await new MenuTextAccountInspector().inspect(page, provider, accountControl, signal)
+    const entitlement = await inspectGrokSubscription(page, provider, signal)
+    if (entitlement === null) {
+      return {
+        ...base,
+        subscription: null,
+        subscriptionEvidence: {
+          status: 'unknown',
+          source: null,
+        },
+      }
+    }
+    return {
+      ...base,
+      subscription: entitlement,
+      subscriptionEvidence: {
+        status: 'derived',
+        source: 'model-entitlement-rows',
+      },
+    }
+  }
+}
+
+async function inspectGrokSubscription(
+  page: Page,
+  provider: ProviderDomDefinition,
+  signal: AbortSignal | undefined,
+): Promise<'Free' | 'SuperGrok' | null> {
+  const trigger = await firstLocator(page, provider.modelControlSelectors)
+  if (!trigger) return null
+
+  let openedHere = false
+  try {
+    const expanded = await trigger.getAttribute('aria-expanded').catch(() => null)
+    if (expanded !== 'true') {
+      await trigger.click({ timeout: 2000 })
+      openedHere = true
+    }
+    for (let attempt = 0; attempt <= 10; attempt += 1) {
+      assertNotAborted(signal)
+      const rows = await collectGrokEntitlementRows(page)
+      if (rows.length === 3) {
+        return rows.every((row) => row.unavailable) ? 'Free' : 'SuperGrok'
+      }
+      if (attempt < 10) await page.waitForTimeout(100)
+    }
+    return null
+  } catch {
+    return null
+  } finally {
+    if (openedHere) {
+      await trigger.click({ timeout: 1000 }).catch(() => undefined)
+    }
+  }
+}
+
+async function collectGrokEntitlementRows(page: Page): Promise<Array<{ label: string, unavailable: boolean }>> {
+  return await page.locator('[role="menuitem"][data-radix-collection-item]').evaluateAll((elements) => {
+    const entitlementLabels = new Set(['auto', 'expert', 'heavy'])
+    return elements.flatMap((element) => {
+      if (!(element instanceof HTMLElement)) return []
+      const rect = element.getBoundingClientRect()
+      const style = window.getComputedStyle(element)
+      if (
+        rect.width === 0 ||
+        rect.height === 0 ||
+        style.display === 'none' ||
+        style.visibility === 'hidden' ||
+        Number(style.opacity) === 0
+      ) return []
+      const label = (element.querySelector('.font-semibold')?.textContent ?? '')
+        .replace(/\s+/g, ' ')
+        .trim()
+      if (!entitlementLabels.has(label.toLowerCase())) return []
+      const classTokens = new Set((element.getAttribute('class') ?? '').split(/\s+/).filter(Boolean))
+      const dataDisabled = element.getAttribute('data-disabled')
+      const explicitlyDisabled = (
+        element.hasAttribute('disabled') ||
+        element.getAttribute('aria-disabled') === 'true' ||
+        (dataDisabled !== null && dataDisabled !== 'false') ||
+        Boolean(element.querySelector(':disabled, [aria-disabled="true"], [data-disabled]:not([data-disabled="false"])'))
+      )
+      const visuallyUnavailable = (
+        classTokens.has('cursor-not-allowed') ||
+        (
+          classTokens.has('text-secondary') &&
+          (classTokens.has('opacity-75') || Number(style.opacity) < 1)
+        )
+      )
+      return [{
+        label,
+        unavailable: explicitlyDisabled || visuallyUnavailable,
+      }]
+    })
+  })
+}
+
+async function firstLocator(page: Page, selectors: readonly string[]): Promise<Locator | null> {
+  for (const selector of selectors) {
+    const locator = page.locator(selector).first()
+    if (await locator.isVisible({ timeout: 500 }).catch(() => false)) return locator
+  }
+  return null
+}
+
+function assertNotAborted(signal: AbortSignal | undefined) {
+  if (signal?.aborted) throw signal.reason ?? new Error('Provider session inspection was aborted.')
+}
diff --git a/packages/cli/src/providers/grok-choice-availability.ts b/packages/cli/src/providers/grok-choice-availability.ts
new file mode 100644
index 0000000..4424fa9
--- /dev/null
+++ b/packages/cli/src/providers/grok-choice-availability.ts
@@ -0,0 +1,11 @@
+import type { ProviderChoiceAvailabilityPolicy } from './provider-definition.js'
+
+export class GrokChoiceAvailability implements ProviderChoiceAvailabilityPolicy {
+  readonly unavailableClassTokens = Object.freeze(['cursor-not-allowed'])
+  readonly mutedUnavailableClassToken = 'text-secondary'
+  readonly mutedOpacityClassToken = 'opacity-75'
+
+  constructor() {
+    Object.freeze(this)
+  }
+}
diff --git a/packages/cli/src/providers/grok-provider.ts b/packages/cli/src/providers/grok-provider.ts
new file mode 100644
index 0000000..1fe53d8
--- /dev/null
+++ b/packages/cli/src/providers/grok-provider.ts
@@ -0,0 +1,131 @@
+import { BaseProvider } from './base-provider.js'
+import {
+  defineDescriptor,
+  defineProvider,
+  providerCapabilities,
+} from './provider-definition.js'
+import { GrokEntitlementAccountInspector } from './grok-account-inspector.js'
+import { GrokChoiceAvailability } from './grok-choice-availability.js'
+import { NativeProjectWorkspaceCapability } from './capabilities/native-project-workspace.js'
+import { PROVIDER_NAVIGATION_CATALOG } from './provider-navigation-catalog.js'
+
+export class GrokProvider extends BaseProvider<'grok'> {
+  constructor() {
+    const descriptor = defineDescriptor({
+      id: 'grok',
+      label: 'Grok',
+      stage: 'supported',
+      setupOrder: 3,
+      protocolCompatibility: Object.freeze({
+        legacyRequests: true,
+      }),
+      navigation: PROVIDER_NAVIGATION_CATALOG.grok,
+      profileImport: Object.freeze({
+        cookieDomains: Object.freeze(['grok.com', 'x.ai']),
+      }),
+      controls: Object.freeze({
+        chatSurface: false,
+      }),
+    })
+    const provider = defineProvider({
+      descriptor,
+      access: Object.freeze({
+        guest: 'unsupported',
+        guestContinueControlNames: Object.freeze([]),
+      }),
+      account: Object.freeze({
+        inspector: new GrokEntitlementAccountInspector(),
+        freePlanLabels: Object.freeze(['Free']),
+        paidPlanLabels: Object.freeze(['SuperGrok']),
+      }),
+      composerSelectors: Object.freeze([
+        'div.tiptap.ProseMirror[contenteditable="true"][role="textbox"][aria-label="Ask Grok anything"][aria-multiline="true"]',
+        'textarea[aria-label="Ask Grok anything"][placeholder="What do you want to know?"]',
+        'div[contenteditable="true"][role="textbox"]',
+        'textarea',
+      ]),
+      submitSelectors: Object.freeze([
+        'button[data-testid="chat-submit"][aria-label="Submit"][type="submit"]',
+        'button[aria-label*="Submit" i]',
+      ]),
+      answerSelectors: Object.freeze([
+        'div[data-testid="assistant-message"]',
+      ]),
+      fileInputSelectors: Object.freeze([
+        'input[type="file"][name="files"]',
+        'input[type="file"]',
+      ]),
+      fileUploadTriggerSelectors: Object.freeze([
+        'button[data-testid="attach-button"][aria-label="Attach"]',
+        'button[aria-label="Attach"]',
+      ]),
+      fileUploadLocalSelectors: Object.freeze([
+        '[role="menuitem"]:has-text("Upload a file")',
+      ]),
+      modelControlSelectors: Object.freeze([
+        'button#model-select-trigger[aria-label="Model select"][aria-haspopup="menu"]',
+        'button[aria-label*="model" i]',
+        'button:has-text("Grok")',
+      ]),
+      effortControlSelectors: Object.freeze([
+        'button[aria-label*="thinking" i]',
+        'button:has-text("Think")',
+      ]),
+      authIndicators: Object.freeze([
+        'button:has(img[alt="pfp"])',
+      ]),
+      loginIndicators: Object.freeze([
+        'div[data-testid="anon-paywall-sign-up-card"]',
+        'button:has-text("Sign in")',
+      ]),
+      blockerSelectors: Object.freeze([
+        'div[data-testid="anon-paywall-sign-up-card"]',
+        'text=/rate limit|too many requests/i',
+        'text=/upgrade required|upgrade your plan/i',
+      ]),
+      busySelectors: Object.freeze([]),
+      choiceAvailability: new GrokChoiceAvailability(),
+      capabilities: providerCapabilities({ nativeWorkspace: true }),
+    })
+    super(provider, {
+      workspace: new NativeProjectWorkspaceCapability(provider, {
+        listUrl: 'https://grok.com/',
+        projectPath: /^\/(?:project|projects)\/(?<resourceId>[A-Za-z0-9_-]+)(?:\/|$)/u,
+        projectLinkSelectors: Object.freeze([
+          'a[href*="/project/"]',
+          'a[href*="/projects/"]',
+        ]),
+        createTriggerSelectors: Object.freeze([
+          'button:has-text("New Project")',
+          'button:has-text("Create Project")',
+          'a:has-text("New Project")',
+        ]),
+        nameInputSelectors: Object.freeze([
+          'input[aria-label="Project name"]',
+        ]),
+        instructionsInputSelectors: Object.freeze([
+          'textarea[aria-label="Project Instructions"]',
+          'textarea[placeholder*="instructions" i]',
+        ]),
+        createSubmitSelectors: Object.freeze([
+          '[role="dialog"][aria-label="New Project"] button:has-text("Next")',
+          '[role="dialog"] button:has-text("Create Project")',
+          '[role="dialog"] button:has-text("Create")',
+        ]),
+        instructionOpenSelectors: Object.freeze([
+          'button:has-text("Project Instructions")',
+          'button:has-text("Add instructions")',
+          'button:has-text("Edit instructions")',
+        ]),
+        instructionSaveSelectors: Object.freeze([
+          '[role="dialog"] button:has-text("Save")',
+          'button:has-text("Save instructions")',
+        ]),
+        stableUnavailableSelectors: Object.freeze([
+          'text=/projects (?:are )?(?:not available|unavailable) on your plan/i',
+          'text=/upgrade to (?:create|use) projects/i',
+        ]),
+      }),
+    })
+  }
+}
diff --git a/packages/cli/src/providers/navigation-policy.ts b/packages/cli/src/providers/navigation-policy.ts
new file mode 100644
index 0000000..00b1dfc
--- /dev/null
+++ b/packages/cli/src/providers/navigation-policy.ts
@@ -0,0 +1,239 @@
+import type { ProviderId } from './provider-identity.js'
+
+export type ProviderPageKind = 'entry' | 'chat_runtime' | 'conversation' | 'project_list' | 'project'
+
+export type ProviderPagePattern = Readonly<{
+  kind: ProviderPageKind
+  urlPattern: string
+}>
+
+export type ProviderNavigationDefinition = Readonly<{
+  entryUrl: string
+  homeUrl: string
+  origins: readonly string[]
+  pagePatterns: readonly ProviderPagePattern[]
+  trustedSignInOrigins: readonly Readonly<{
+    origin: string
+    pathPrefixes?: readonly string[]
+  }>[]
+}>
+
+export type CanonicalProviderTarget = {
+  providerId: ProviderId
+  href: string
+  origin: string
+  pathname: string
+}
+
+export type ProviderNavigationClassification =
+  | {
+    kind: 'approved'
+    target: CanonicalProviderTarget
+  }
+  | {
+    kind: 'trusted_sign_in'
+    providerId: ProviderId
+    origin: string
+    host: string
+  }
+  | {
+    kind: 'rejected'
+    reason: 'invalid_url' | 'unsupported_provider_navigation'
+  }
+
+export type ProviderNavigationPolicyOwner = {
+  readonly id?: ProviderId
+  readonly homeUrl: string
+  readonly navigationPolicy: ProviderNavigationPolicy
+}
+
+const FORBIDDEN_RAW_URL = /[\\\u0000-\u001f\u007f\s]|%(?:00|0[1-9a-f]|1[0-9a-f]|20|23|25|2f|3f|5c|7f)/i
+const MALFORMED_PERCENT_ESCAPE = /%(?![0-9a-f]{2})/i
+
+export class ProviderNavigationPolicy {
+  readonly providerId: ProviderId
+  readonly entryUrl: string
+  readonly homeUrl: string
+  readonly origins: readonly string[]
+  readonly pagePatterns: readonly ProviderPagePattern[]
+  readonly trustedSignInOrigins: ProviderNavigationDefinition['trustedSignInOrigins']
+
+  constructor(providerId: ProviderId, definition: ProviderNavigationDefinition) {
+    this.providerId = providerId
+    this.entryUrl = definition.entryUrl
+    this.homeUrl = definition.homeUrl
+    this.origins = Object.freeze([...definition.origins])
+    this.pagePatterns = Object.freeze(definition.pagePatterns.map((pattern) => Object.freeze({ ...pattern })))
+    this.trustedSignInOrigins = Object.freeze(definition.trustedSignInOrigins.map((entry) => Object.freeze({
+      origin: entry.origin,
+      ...(entry.pathPrefixes ? { pathPrefixes: Object.freeze([...entry.pathPrefixes]) } : {}),
+    })))
+    Object.freeze(this)
+  }
+
+  homeTarget(): CanonicalProviderTarget {
+    const target = this.canonicalTarget(this.homeUrl)
+    if (!target) throw new Error(`Invalid provider home URL for ${this.providerId}.`)
+    return target
+  }
+
+  canonicalTarget(value?: unknown): CanonicalProviderTarget | null {
+    const parsed = parseProviderTargetUrl(value === undefined ? this.homeUrl : value, this.origins)
+    if (!parsed) return null
+    return canonicalProviderTargetFromUrl(this.providerId, parsed)
+  }
+
+  classify(value: unknown): ProviderNavigationClassification {
+    const approved = parseObservedProviderUrl(value, this.origins)
+    if (approved) {
+      return {
+        kind: 'approved',
+        target: canonicalProviderTargetFromUrl(this.providerId, approved),
+      }
+    }
+    const trusted = parseTrustedSignInUrl(value)
+    if (trusted) {
+      const origin = trusted.origin.toLowerCase()
+      const policy = this.trustedSignInOrigins.find((entry) => entry.origin.toLowerCase() === origin)
+      if (policy && (!policy.pathPrefixes || policy.pathPrefixes.some((prefix) => trusted.pathname.startsWith(prefix)))) {
+        return {
+          kind: 'trusted_sign_in',
+          providerId: this.providerId,
+          origin: trusted.origin,
+          host: trusted.hostname.toLowerCase(),
+        }
+      }
+    }
+    return {
+      kind: typeof value === 'string' ? 'rejected' : 'rejected',
+      reason: typeof value === 'string' ? 'unsupported_provider_navigation' : 'invalid_url',
+    }
+  }
+
+  assertCurrentPageAllowed(value: unknown): CanonicalProviderTarget | null {
+    const classification = this.classify(value)
+    return classification.kind === 'approved' ? classification.target : null
+  }
+}
+
+export function canonicalProviderTarget(
+  provider: ProviderNavigationPolicyOwner,
+  targetUrl: unknown,
+): CanonicalProviderTarget | null {
+  return provider.navigationPolicy.canonicalTarget(targetUrl === undefined ? provider.homeUrl : targetUrl)
+}
+
+export function safeProviderTargetUrl(provider: ProviderNavigationPolicyOwner, targetUrl: unknown): string | null {
+  return canonicalProviderTarget(provider, targetUrl)?.href ?? null
+}
+
+export function assertProviderUrlAllowed(provider: ProviderNavigationPolicyOwner, targetUrl: unknown) {
+  const target = provider.navigationPolicy.assertCurrentPageAllowed(targetUrl)
+  if (!target) {
+    return {
+      ok: false as const,
+      reason: 'unsupported_provider_navigation',
+    }
+  }
+  return {
+    ok: true as const,
+    target,
+  }
+}
+
+export function trustedProviderSignInNavigation(provider: ProviderNavigationPolicyOwner, targetUrl: unknown) {
+  const classification = provider.navigationPolicy.classify(targetUrl)
+  return classification.kind === 'trusted_sign_in' ? classification : null
+}
+
+function parseObservedProviderUrl(value: unknown, origins: readonly string[]): URL | null {
+  if (typeof value !== 'string' || value.length > 2048) return null
+  const privateStateIndex = [value.indexOf('?'), value.indexOf('#')]
+    .filter((index) => index >= 0)
+    .reduce((earliest, index) => Math.min(earliest, index), value.length)
+  const rawLocation = value.slice(0, privateStateIndex)
+  if (FORBIDDEN_RAW_URL.test(rawLocation) || MALFORMED_PERCENT_ESCAPE.test(rawLocation)) return null
+  let parsed: URL
+  try {
+    parsed = new URL(value)
+  } catch {
+    return null
+  }
+  if (
+    parsed.protocol !== 'https:' ||
+    parsed.username !== '' ||
+    parsed.password !== '' ||
+    parsed.port !== '' ||
+    !origins.some((origin) => origin.toLowerCase() === parsed.origin.toLowerCase())
+  ) {
+    return null
+  }
+  return parsed
+}
+
+function parseTrustedSignInUrl(value: unknown): URL | null {
+  if (typeof value !== 'string' || value.length > 2048) return null
+  let parsed: URL
+  try {
+    parsed = new URL(value)
+  } catch {
+    return null
+  }
+  if (
+    parsed.protocol !== 'https:' ||
+    parsed.username !== '' ||
+    parsed.password !== '' ||
+    parsed.port !== ''
+  ) {
+    return null
+  }
+  return parsed
+}
+
+function parseProviderTargetUrl(value: unknown, origins: readonly string[]): URL | null {
+  if (typeof value !== 'string' || value.length > 2048 || value === '' || value.trim() !== value) return null
+  if (FORBIDDEN_RAW_URL.test(value) || MALFORMED_PERCENT_ESCAPE.test(value)) return null
+  let parsed: URL
+  try {
+    parsed = new URL(value)
+  } catch {
+    return null
+  }
+  if (
+    parsed.protocol !== 'https:' ||
+    parsed.username !== '' ||
+    parsed.password !== '' ||
+    parsed.port !== '' ||
+    parsed.search !== '' ||
+    parsed.hash !== '' ||
+    !origins.some((origin) => origin.toLowerCase() === parsed.origin.toLowerCase())
+  ) {
+    return null
+  }
+  const rawAuthority = providerUrlAuthority(value)
+  if (!rawAuthority || rawAuthority.toLowerCase() !== parsed.hostname.toLowerCase()) return null
+  return parsed
+}
+
+function canonicalProviderTargetFromUrl(providerId: ProviderId, parsed: URL): CanonicalProviderTarget {
+  const pathname = canonicalPathname(parsed.pathname)
+  return {
+    providerId,
+    href: `${parsed.origin}${pathname}`,
+    origin: parsed.origin,
+    pathname,
+  }
+}
+
+function canonicalPathname(pathname: string) {
+  const parts = pathname.split('/').filter(Boolean).map((segment) => encodeURIComponent(decodeURIComponent(segment)))
+  return `/${parts.join('/')}`
+}
+
+function providerUrlAuthority(value: string) {
+  const scheme = value.indexOf('://')
+  if (scheme < 0 || value.slice(0, scheme).toLowerCase() !== 'https') return ''
+  const start = scheme + 3
+  const relativeEnd = value.slice(start).search(/[/?#]/)
+  return relativeEnd < 0 ? value.slice(start) : value.slice(start, start + relativeEnd)
+}
diff --git a/packages/cli/src/providers/perplexity-provider.ts b/packages/cli/src/providers/perplexity-provider.ts
new file mode 100644
index 0000000..2d0b184
--- /dev/null
+++ b/packages/cli/src/providers/perplexity-provider.ts
@@ -0,0 +1,101 @@
+import { BaseProvider } from './base-provider.js'
+import {
+  DEFAULT_CHOICE_AVAILABILITY,
+  defineDescriptor,
+  defineProvider,
+  providerCapabilities,
+} from './provider-definition.js'
+import { MenuTextAccountInspector } from './account-inspectors.js'
+import type { Page } from 'playwright-core'
+import type { ProviderExecutionContext } from './execution-context.js'
+import { PROVIDER_NAVIGATION_CATALOG } from './provider-navigation-catalog.js'
+
+export class PerplexityProvider extends BaseProvider<'perplexity'> {
+  constructor() {
+    const descriptor = defineDescriptor({
+      id: 'perplexity',
+      label: 'Perplexity',
+      stage: 'experimental',
+      setupOrder: 6,
+      protocolCompatibility: Object.freeze({
+        legacyRequests: false,
+      }),
+      navigation: PROVIDER_NAVIGATION_CATALOG.perplexity,
+      profileImport: Object.freeze({
+        cookieDomains: Object.freeze(['perplexity.ai']),
+      }),
+      controls: Object.freeze({
+        chatSurface: false,
+      }),
+    })
+    const provider = defineProvider({
+      descriptor,
+      access: Object.freeze({
+        guest: 'supported',
+        guestContinueControlNames: Object.freeze([]),
+      }),
+      account: Object.freeze({
+        inspector: new MenuTextAccountInspector(),
+        freePlanLabels: Object.freeze(['Standard', 'Free']),
+        paidPlanLabels: Object.freeze([
+          'Pro',
+          'Perplexity Pro',
+          'Education Pro',
+          'Max',
+          'Perplexity Max',
+          'Enterprise Pro',
+          'Enterprise Max',
+        ]),
+      }),
+      composerSelectors: Object.freeze([
+        '#ask-input[contenteditable="true"][role="textbox"]',
+        '[contenteditable="true"][role="textbox"][data-lexical-editor="true"]',
+      ]),
+      submitSelectors: Object.freeze([
+        'button[aria-label="Submit"]',
+      ]),
+      answerSelectors: Object.freeze([
+        '.prose[data-renderer="lm"]',
+      ]),
+      fileInputSelectors: Object.freeze([
+        'input[type="file"][multiple]',
+      ]),
+      fileUploadTriggerSelectors: Object.freeze([
+        'button[aria-label="Add files or tools"]',
+      ]),
+      fileUploadLocalSelectors: Object.freeze([]),
+      modelControlSelectors: Object.freeze([
+        'button[aria-label="Model"]',
+      ]),
+      effortControlSelectors: Object.freeze([]),
+      authIndicators: Object.freeze([]),
+      loginIndicators: Object.freeze([
+        'button:has-text("Sign In")',
+      ]),
+      blockerSelectors: Object.freeze([
+        'iframe[src*="recaptcha" i]',
+        'iframe[src*="hcaptcha.com" i]',
+        'iframe[src*="challenges.cloudflare.com" i]',
+        'text=/rate limit|too many requests/i',
+        'text=/upgrade required|upgrade your plan/i',
+      ]),
+      busySelectors: Object.freeze([
+        'button[aria-label*="Stop" i]',
+      ]),
+      choiceAvailability: DEFAULT_CHOICE_AVAILABILITY,
+      capabilities: providerCapabilities(),
+    })
+    super(provider)
+  }
+
+  protected override async inputPrompt(page: Page, text: string, context: ProviderExecutionContext) {
+    const declineOptional = page
+      .getByRole('dialog')
+      .filter({ hasText: 'Cookie Policy' })
+      .getByRole('button', { name: 'Decline optional', exact: true })
+    if (await declineOptional.isVisible().catch(() => false)) {
+      await declineOptional.click({ timeout: 5_000 })
+    }
+    return super.inputPrompt(page, text, context)
+  }
+}
diff --git a/packages/cli/src/providers/provider-definition.ts b/packages/cli/src/providers/provider-definition.ts
new file mode 100644
index 0000000..e1f7d47
--- /dev/null
+++ b/packages/cli/src/providers/provider-definition.ts
@@ -0,0 +1,495 @@
+import { PROVIDER_CAPABILITIES } from './provider-identity.js'
+import { ConversationContinueCapability } from './capabilities/session.js'
+import { DomAttachmentCapability } from './capabilities/dom-attachment.js'
+import { DomChoiceCapability } from './capabilities/dom-choice.js'
+import { ConversationWorkspaceCapability } from './capabilities/workspace.js'
+import { DiagnosticsCapability } from './capabilities/diagnostics.js'
+import { UnsupportedImageGenerationCapability } from './capabilities/image-generation.js'
+import { DefaultChoiceAvailability } from './choice-availability.js'
+import { ProviderNavigationPolicy } from './navigation-policy.js'
+import { VISIBLE_ACTIONS } from './contracts.js'
+import type { Locator, Page } from 'playwright-core'
+import type { InspectableProviderActionCapability, ProviderCapability } from './capability-set.js'
+import type { ImageGenerationCapability } from './capabilities/image-generation.js'
+import type { VisibleAction } from './contracts.js'
+import type { ProviderCapabilityId, ProviderId, ProviderStage } from './provider-identity.js'
+import type { ProviderNavigationDefinition } from './navigation-policy.js'
+
+export type ProviderCapabilityAvailability = 'available' | 'unavailable' | 'unknown'
+export type ProviderCapabilityResourceKind = 'visible_action' | 'file_attachment' | 'project' | 'conversation'
+export type ProviderCapabilityStability = 'experimental'
+export type ProviderGuestAccess = 'supported' | 'unsupported'
+export type ProviderAccessClass =
+  | 'guest'
+  | 'sign_in_required'
+  | 'signed_in_free'
+  | 'signed_in_paid'
+  | 'signed_in_unknown'
+  | 'unknown'
+export type ProviderAccountTier = {
+  class: 'signed_in_free' | 'signed_in_paid' | 'signed_in_unknown'
+  label: string | null
+}
+
+export type ProviderDescriptor<TId extends string = string> = Readonly<{
+  id: TId
+  label: string
+  stage: ProviderStage
+  setupOrder: number
+  protocolCompatibility: Readonly<{
+    legacyRequests: boolean
+  }>
+  navigation: ProviderNavigationDefinition
+  profileImport: Readonly<{
+    cookieDomains: readonly string[]
+  }>
+  controls: Readonly<{
+    chatSurface: boolean
+  }>
+}>
+
+export type ProviderAccessPolicy = {
+  readonly guest: ProviderGuestAccess
+  readonly guestContinueControlNames: readonly string[]
+}
+
+export type ProviderAccountInspection = {
+  readonly name: string | null
+  readonly subscription: string | null
+  readonly subscriptionEvidence: {
+    readonly status: 'observed' | 'derived' | 'unknown'
+    readonly source: string | null
+  }
+}
+
+export interface ProviderAccountInspector {
+  inspect(
+    page: Page,
+    provider: ProviderDomDefinition,
+    accountControl: Locator,
+    signal: AbortSignal | undefined,
+  ): Promise<ProviderAccountInspection>
+}
+
+export type ProviderAccountPolicy = {
+  readonly inspector: ProviderAccountInspector
+  readonly freePlanLabels: readonly string[]
+  readonly paidPlanLabels: readonly string[]
+}
+
+export type ProviderChoiceAvailabilityPolicy = {
+  readonly unavailableClassTokens: readonly string[]
+  readonly mutedUnavailableClassToken: string | null
+  readonly mutedOpacityClassToken: string | null
+}
+
+export type ProviderCapabilityStrategy = {
+  readonly capability: ProviderCapabilityId
+  readonly availability: ProviderCapabilityAvailability
+  readonly visibleProof: string
+  readonly reason: string | null
+  readonly native: {
+    readonly resourceKind: ProviderCapabilityResourceKind | null
+    readonly availability: ProviderCapabilityAvailability
+    readonly visibleProof: string | null
+    readonly reason: string | null
+  }
+  readonly fallback: {
+    readonly resourceKind: ProviderCapabilityResourceKind | null
+    readonly availability: ProviderCapabilityAvailability
+    readonly mode: 'conversation' | null
+    readonly visibleProof: string | null
+    readonly reason: string | null
+  }
+  readonly stability: ProviderCapabilityStability
+}
+
+export type ProviderDomDefinition<TId extends ProviderId = ProviderId> = ProviderDescriptor<TId> & {
+  readonly descriptor: ProviderDescriptor<TId>
+  readonly navigationPolicy: ProviderNavigationPolicy
+  readonly homeUrl: string
+  readonly access: ProviderAccessPolicy
+  readonly account: ProviderAccountPolicy
+  readonly composerSelectors: readonly string[]
+  readonly submitSelectors: readonly string[]
+  readonly answerSelectors: readonly string[]
+  readonly fileInputSelectors: readonly string[]
+  readonly fileUploadTriggerSelectors: readonly string[]
+  readonly fileUploadLocalSelectors: readonly string[]
+  readonly modelControlSelectors: readonly string[]
+  readonly effortControlSelectors: readonly string[]
+  readonly authIndicators: readonly string[]
+  readonly loginIndicators: readonly string[]
+  readonly blockerSelectors: readonly string[]
+  readonly busySelectors: readonly string[]
+  readonly choiceAvailability: ProviderChoiceAvailabilityPolicy
+  readonly capabilities: Readonly<Record<ProviderCapabilityId, ProviderCapabilityStrategy>>
+}
+
+export const DEFAULT_CHOICE_AVAILABILITY = new DefaultChoiceAvailability() satisfies ProviderChoiceAvailabilityPolicy
+
+type CapabilityWithId<Id extends ProviderCapabilityId, Capability extends ProviderCapability> =
+  Omit<Capability, 'capability'> & Readonly<{ capability: Id }>
+
+type ActionCapabilityWithId<Id extends ProviderCapabilityId, Action extends VisibleAction> =
+  CapabilityWithId<Id, InspectableProviderActionCapability<Action>>
+
+export type ProviderOptionalCapabilities = Readonly<{
+  fileUpload: ActionCapabilityWithId<
+    typeof PROVIDER_CAPABILITIES.FILE_UPLOAD,
+    typeof VISIBLE_ACTIONS.FILE_UPLOAD
+  >
+  workspace: ActionCapabilityWithId<
+    typeof PROVIDER_CAPABILITIES.WORKSPACE_ENSURE,
+    typeof VISIBLE_ACTIONS.WORKSPACE_ENSURE
+  >
+  conversationContinue: CapabilityWithId<
+    typeof PROVIDER_CAPABILITIES.CONVERSATION_CONTINUE,
+    ProviderCapability
+  >
+  modelChoice: ActionCapabilityWithId<
+    typeof PROVIDER_CAPABILITIES.MODEL_CHOICE,
+    typeof VISIBLE_ACTIONS.MODEL_INSPECT | typeof VISIBLE_ACTIONS.MODEL_SELECT
+  >
+  effortChoice: ActionCapabilityWithId<
+    typeof PROVIDER_CAPABILITIES.EFFORT_CHOICE,
+    typeof VISIBLE_ACTIONS.EFFORT_INSPECT | typeof VISIBLE_ACTIONS.EFFORT_SELECT
+  >
+  diagnostics: ActionCapabilityWithId<
+    typeof PROVIDER_CAPABILITIES.DIAGNOSTICS,
+    typeof VISIBLE_ACTIONS.NAVIGATION_CHECK | typeof VISIBLE_ACTIONS.SNAPSHOT_SANITIZED
+  >
+  imageGeneration: CapabilityWithId<
+    typeof PROVIDER_CAPABILITIES.IMAGE_GENERATION,
+    ImageGenerationCapability
+  >
+}>
+
+export type ProviderOptionalCapabilityOverrides = Partial<ProviderOptionalCapabilities>
+
+const OPTIONAL_CAPABILITY_ORDER: readonly (keyof ProviderOptionalCapabilities)[] = Object.freeze([
+  'fileUpload',
+  'workspace',
+  'conversationContinue',
+  'modelChoice',
+  'effortChoice',
+  'diagnostics',
+  'imageGeneration',
+])
+
+export function createProviderOptionalCapabilities(
+  provider: ProviderDomDefinition,
+  overrides: ProviderOptionalCapabilityOverrides = {},
+): readonly ProviderCapability[] {
+  const capabilities: ProviderOptionalCapabilities = {
+    fileUpload: new DomAttachmentCapability(provider),
+    workspace: new ConversationWorkspaceCapability(provider),
+    conversationContinue: new ConversationContinueCapability(provider),
+    modelChoice: new DomChoiceCapability(provider, {
+      capability: PROVIDER_CAPABILITIES.MODEL_CHOICE,
+      kind: 'model',
+      inspectAction: VISIBLE_ACTIONS.MODEL_INSPECT,
+      selectAction: VISIBLE_ACTIONS.MODEL_SELECT,
+    }),
+    effortChoice: new DomChoiceCapability(provider, {
+      capability: PROVIDER_CAPABILITIES.EFFORT_CHOICE,
+      kind: 'effort',
+      inspectAction: VISIBLE_ACTIONS.EFFORT_INSPECT,
+      selectAction: VISIBLE_ACTIONS.EFFORT_SELECT,
+    }),
+    diagnostics: new DiagnosticsCapability(provider),
+    imageGeneration: new UnsupportedImageGenerationCapability(provider),
+    ...overrides,
+  }
+  return OPTIONAL_CAPABILITY_ORDER.map((key) => capabilities[key])
+}
+
+export function providerCapabilities(options: {
+  nativeWorkspace?: boolean
+  qwenMode?: boolean
+  deepSeekControls?: boolean
+  doubaoControls?: boolean
+} = {}): Readonly<Record<ProviderCapabilityId, ProviderCapabilityStrategy>> {
+  return Object.freeze({
+    [PROVIDER_CAPABILITIES.CAPABILITY_INSPECT]: Object.freeze({
+      capability: PROVIDER_CAPABILITIES.CAPABILITY_INSPECT,
+      availability: 'available',
+      visibleProof: 'provider-capability-registry',
+      reason: null,
+      native: Object.freeze({
+        resourceKind: 'visible_action',
+        availability: 'available',
+        visibleProof: 'provider-capability-registry',
+        reason: null,
+      }),
+      fallback: Object.freeze({
+        resourceKind: null,
+        availability: 'unavailable',
+        mode: null,
+        visibleProof: null,
+        reason: 'native_visible_action_has_no_fallback',
+      }),
+      stability: 'experimental',
+    }),
+    [PROVIDER_CAPABILITIES.MODEL_CHOICE]: Object.freeze({
+      capability: PROVIDER_CAPABILITIES.MODEL_CHOICE,
+      availability: 'unknown',
+      visibleProof: 'runtime-visible-model-control-evidence-required',
+      reason: 'availability_depends_on_visible_provider_controls',
+      native: Object.freeze({
+        resourceKind: 'visible_action',
+        availability: 'unknown',
+        visibleProof: 'runtime-visible-model-control-evidence-required',
+        reason: null,
+      }),
+      fallback: Object.freeze({
+        resourceKind: null,
+        availability: 'unavailable',
+        mode: null,
+        visibleProof: null,
+        reason: 'no_provider_neutral_choice_fallback',
+      }),
+      stability: 'experimental',
+    }),
+    [PROVIDER_CAPABILITIES.EFFORT_CHOICE]: Object.freeze({
+      capability: PROVIDER_CAPABILITIES.EFFORT_CHOICE,
+      availability: 'unknown',
+      visibleProof: 'runtime-visible-effort-control-evidence-required',
+      reason: 'availability_depends_on_visible_provider_controls',
+      native: Object.freeze({
+        resourceKind: 'visible_action',
+        availability: 'unknown',
+        visibleProof: 'runtime-visible-effort-control-evidence-required',
+        reason: null,
+      }),
+      fallback: Object.freeze({
+        resourceKind: null,
+        availability: 'unavailable',
+        mode: null,
+        visibleProof: null,
+        reason: 'no_provider_neutral_choice_fallback',
+      }),
+      stability: 'experimental',
+    }),
+    [PROVIDER_CAPABILITIES.FILE_UPLOAD]: Object.freeze({
+      capability: PROVIDER_CAPABILITIES.FILE_UPLOAD,
+      availability: 'unknown',
+      visibleProof: 'runtime-visible-upload-evidence-required',
+      reason: 'availability_depends_on_visible_provider_controls',
+      native: Object.freeze({
+        resourceKind: 'file_attachment',
+        availability: 'unknown',
+        visibleProof: 'runtime-visible-upload-evidence-required',
+        reason: null,
+      }),
+      fallback: Object.freeze({
+        resourceKind: null,
+        availability: 'unavailable',
+        mode: null,
+        visibleProof: null,
+        reason: 'no_provider_neutral_file_upload_fallback',
+      }),
+      stability: 'experimental',
+    }),
+    [PROVIDER_CAPABILITIES.WORKSPACE_ENSURE]: Object.freeze({
+      capability: PROVIDER_CAPABILITIES.WORKSPACE_ENSURE,
+      availability: 'available',
+      visibleProof: options.nativeWorkspace ? 'native-project-provider-strategy-registered' : 'conversation-fallback-declared',
+      reason: options.nativeWorkspace ? null : 'native_workspace_unavailable',
+      native: Object.freeze({
+        resourceKind: 'project',
+        availability: options.nativeWorkspace ? 'unknown' : 'unavailable',
+        visibleProof: options.nativeWorkspace ? 'runtime-native-project-evidence-required' : null,
+        reason: options.nativeWorkspace ? 'runtime_native_project_evidence_required' : 'native_workspace_unavailable',
+      }),
+      fallback: Object.freeze({
+        resourceKind: 'conversation',
+        availability: 'available',
+        mode: 'conversation',
+        visibleProof: 'conversation-composer-visible',
+        reason: null,
+      }),
+      stability: 'experimental',
+    }),
+    [PROVIDER_CAPABILITIES.CONVERSATION_CONTINUE]: Object.freeze({
+      capability: PROVIDER_CAPABILITIES.CONVERSATION_CONTINUE,
+      availability: 'unknown',
+      visibleProof: 'runtime-visible-composer-evidence-required',
+      reason: 'availability_depends_on_visible_composer',
+      native: Object.freeze({
+        resourceKind: 'conversation',
+        availability: 'unknown',
+        visibleProof: 'runtime-visible-composer-evidence-required',
+        reason: null,
+      }),
+      fallback: Object.freeze({
+        resourceKind: null,
+        availability: 'unavailable',
+        mode: null,
+        visibleProof: null,
+        reason: 'conversation_continuation_is_the_native_visible_outcome',
+      }),
+      stability: 'experimental',
+    }),
+    [PROVIDER_CAPABILITIES.DIAGNOSTICS]: Object.freeze({
+      capability: PROVIDER_CAPABILITIES.DIAGNOSTICS,
+      availability: 'available',
+      visibleProof: 'provider-diagnostics-actions-registered',
+      reason: null,
+      native: Object.freeze({
+        resourceKind: 'visible_action',
+        availability: 'available',
+        visibleProof: 'provider-diagnostics-actions-registered',
+        reason: null,
+      }),
+      fallback: Object.freeze({
+        resourceKind: null,
+        availability: 'unavailable',
+        mode: null,
+        visibleProof: null,
+        reason: 'diagnostics_actions_have_no_fallback',
+      }),
+      stability: 'experimental',
+    }),
+    [PROVIDER_CAPABILITIES.IMAGE_GENERATION]: Object.freeze({
+      capability: PROVIDER_CAPABILITIES.IMAGE_GENERATION,
+      availability: 'unavailable',
+      visibleProof: 'unsupported-image-generation-capability',
+      reason: 'no_real_provider_visible_image_generation_closure',
+      native: Object.freeze({
+        resourceKind: null,
+        availability: 'unavailable',
+        visibleProof: null,
+        reason: 'image_generation_not_advertised_without_provider_evidence',
+      }),
+      fallback: Object.freeze({
+        resourceKind: null,
+        availability: 'unavailable',
+        mode: null,
+        visibleProof: null,
+        reason: 'no_provider_neutral_image_generation_fallback',
+      }),
+      stability: 'experimental',
+    }),
+    [PROVIDER_CAPABILITIES.QWEN_MODE]: Object.freeze({
+      capability: PROVIDER_CAPABILITIES.QWEN_MODE,
+      availability: options.qwenMode ? 'unknown' : 'unavailable',
+      visibleProof: options.qwenMode
+        ? 'runtime-visible-qwen-mode-control-evidence-required'
+        : 'qwen-mode-provider-strategy-unavailable',
+      reason: options.qwenMode ? 'availability_depends_on_visible_provider_controls' : 'unsupported_by_provider',
+      native: Object.freeze({
+        resourceKind: options.qwenMode ? 'visible_action' : null,
+        availability: options.qwenMode ? 'unknown' : 'unavailable',
+        visibleProof: options.qwenMode ? 'runtime-visible-qwen-mode-control-evidence-required' : null,
+        reason: options.qwenMode ? null : 'unsupported_by_provider',
+      }),
+      fallback: Object.freeze({
+        resourceKind: null,
+        availability: 'unavailable',
+        mode: null,
+        visibleProof: null,
+        reason: 'no_provider_neutral_qwen_mode_fallback',
+      }),
+      stability: 'experimental',
+    }),
+    [PROVIDER_CAPABILITIES.DEEPSEEK_MODE]: deepSeekCapabilityStrategy(
+      PROVIDER_CAPABILITIES.DEEPSEEK_MODE,
+      options.deepSeekControls === true,
+    ),
+    [PROVIDER_CAPABILITIES.DEEPSEEK_DEEPTHINK]: deepSeekCapabilityStrategy(
+      PROVIDER_CAPABILITIES.DEEPSEEK_DEEPTHINK,
+      options.deepSeekControls === true,
+    ),
+    [PROVIDER_CAPABILITIES.DEEPSEEK_SEARCH]: deepSeekCapabilityStrategy(
+      PROVIDER_CAPABILITIES.DEEPSEEK_SEARCH,
+      options.deepSeekControls === true,
+    ),
+    [PROVIDER_CAPABILITIES.DOUBAO_MODE]: providerSpecificControlStrategy(
+      PROVIDER_CAPABILITIES.DOUBAO_MODE,
+      'doubao',
+      options.doubaoControls === true,
+    ),
+    [PROVIDER_CAPABILITIES.DOUBAO_SKILL]: providerSpecificControlStrategy(
+      PROVIDER_CAPABILITIES.DOUBAO_SKILL,
+      'doubao',
+      options.doubaoControls === true,
+    ),
+  })
+}
+
+function providerSpecificControlStrategy(
+  capability: ProviderCapabilityId,
+  provider: string,
+  enabled: boolean,
+): ProviderCapabilityStrategy {
+  return Object.freeze({
+    capability,
+    availability: enabled ? 'unknown' : 'unavailable',
+    visibleProof: enabled
+      ? `runtime-visible-${provider}-control-evidence-required`
+      : `${provider}-provider-strategy-unavailable`,
+    reason: enabled ? 'availability_depends_on_visible_provider_controls' : 'unsupported_by_provider',
+    native: Object.freeze({
+      resourceKind: enabled ? 'visible_action' : null,
+      availability: enabled ? 'unknown' : 'unavailable',
+      visibleProof: enabled ? `runtime-visible-${provider}-control-evidence-required` : null,
+      reason: enabled ? null : 'unsupported_by_provider',
+    }),
+    fallback: Object.freeze({
+      resourceKind: null,
+      availability: 'unavailable',
+      mode: null,
+      visibleProof: null,
+      reason: `no_provider_neutral_${provider}_control_fallback`,
+    }),
+    stability: 'experimental',
+  })
+}
+
+function deepSeekCapabilityStrategy(
+  capability: ProviderCapabilityId,
+  enabled: boolean,
+): ProviderCapabilityStrategy {
+  return Object.freeze({
+    capability,
+    availability: enabled ? 'unknown' : 'unavailable',
+    visibleProof: enabled
+      ? 'runtime-visible-deepseek-control-evidence-required'
+      : 'deepseek-provider-strategy-unavailable',
+    reason: enabled ? 'availability_depends_on_visible_provider_controls' : 'unsupported_by_provider',
+    native: Object.freeze({
+      resourceKind: enabled ? 'visible_action' : null,
+      availability: enabled ? 'unknown' : 'unavailable',
+      visibleProof: enabled ? 'runtime-visible-deepseek-control-evidence-required' : null,
+      reason: enabled ? null : 'unsupported_by_provider',
+    }),
+    fallback: Object.freeze({
+      resourceKind: null,
+      availability: 'unavailable',
+      mode: null,
+      visibleProof: null,
+      reason: 'no_provider_neutral_deepseek_control_fallback',
+    }),
+    stability: 'experimental',
+  })
+}
+
+export function defineDescriptor<TId extends ProviderId>(descriptor: ProviderDescriptor<TId>): ProviderDescriptor<TId> {
+  return Object.freeze(descriptor)
+}
+
+export function defineProvider<TId extends ProviderId>(
+  provider: Omit<ProviderDomDefinition<TId>, keyof ProviderDescriptor<TId> | 'navigationPolicy' | 'homeUrl'> & {
+    descriptor: ProviderDescriptor<TId>
+  }
+): ProviderDomDefinition<TId> {
+  const navigationPolicy = new ProviderNavigationPolicy(provider.descriptor.id, provider.descriptor.navigation)
+  return Object.freeze({
+    ...provider.descriptor,
+    ...provider,
+    descriptor: provider.descriptor,
+    navigationPolicy,
+    homeUrl: provider.descriptor.navigation.homeUrl,
+  })
+}
diff --git a/packages/cli/src/providers/provider-identity.ts b/packages/cli/src/providers/provider-identity.ts
new file mode 100644
index 0000000..d3a5ee1
--- /dev/null
+++ b/packages/cli/src/providers/provider-identity.ts
@@ -0,0 +1,27 @@
+export type ProviderId = string
+export type ProviderStage = 'experimental' | 'supported' | 'disabled'
+
+export const PROVIDER_ID_PATTERN = /^[a-z][a-z0-9-]{0,63}$/
+
+export function isProviderIdSyntax(value: unknown): value is ProviderId {
+  return typeof value === 'string' && PROVIDER_ID_PATTERN.test(value)
+}
+
+export const PROVIDER_CAPABILITIES = Object.freeze({
+  CAPABILITY_INSPECT: 'capability.inspect',
+  MODEL_CHOICE: 'model.choice',
+  EFFORT_CHOICE: 'effort.choice',
+  FILE_UPLOAD: 'file.upload',
+  WORKSPACE_ENSURE: 'workspace.ensure',
+  CONVERSATION_CONTINUE: 'conversation.continue',
+  DIAGNOSTICS: 'diagnostics',
+  IMAGE_GENERATION: 'image.generation',
+  QWEN_MODE: 'qwen.mode',
+  DEEPSEEK_MODE: 'deepseek.mode',
+  DEEPSEEK_DEEPTHINK: 'deepseek.deepthink',
+  DEEPSEEK_SEARCH: 'deepseek.search',
+  DOUBAO_MODE: 'doubao.mode',
+  DOUBAO_SKILL: 'doubao.skill',
+})
+
+export type ProviderCapabilityId = typeof PROVIDER_CAPABILITIES[keyof typeof PROVIDER_CAPABILITIES]
diff --git a/packages/cli/src/providers/provider-navigation-catalog.ts b/packages/cli/src/providers/provider-navigation-catalog.ts
new file mode 100644
index 0000000..68c6f04
--- /dev/null
+++ b/packages/cli/src/providers/provider-navigation-catalog.ts
@@ -0,0 +1,142 @@
+import type {
+  ProviderNavigationDefinition,
+  ProviderPagePattern,
+} from './navigation-policy.js'
+
+export type ProviderNavigationCatalogId =
+  | 'chatgpt'
+  | 'claude'
+  | 'gemini'
+  | 'grok'
+  | 'qwen'
+  | 'deepseek'
+  | 'perplexity'
+  | 'zai'
+  | 'doubao'
+
+function pages(...patterns: ProviderPagePattern[]) {
+  return Object.freeze(patterns.map((pattern) => Object.freeze(pattern)))
+}
+
+function navigation(definition: ProviderNavigationDefinition): ProviderNavigationDefinition {
+  return Object.freeze({
+    entryUrl: definition.entryUrl,
+    homeUrl: definition.homeUrl,
+    origins: Object.freeze([...definition.origins]),
+    pagePatterns: Object.freeze(definition.pagePatterns.map((pattern) => Object.freeze({ ...pattern }))),
+    trustedSignInOrigins: Object.freeze(definition.trustedSignInOrigins.map((entry) => Object.freeze({
+      origin: entry.origin,
+      ...(entry.pathPrefixes ? { pathPrefixes: Object.freeze([...entry.pathPrefixes]) } : {}),
+    }))),
+  })
+}
+
+// Page patterns are declared only from current adapter routes or redacted real-session provenance.
+// A missing pattern means the route shape is not yet known; it does not broaden the origin allowlist.
+export const PROVIDER_NAVIGATION_CATALOG = Object.freeze({
+  chatgpt: navigation({
+    entryUrl: 'https://chatgpt.com/',
+    homeUrl: 'https://chatgpt.com/',
+    origins: ['https://chatgpt.com', 'https://chat.openai.com'],
+    pagePatterns: pages(
+      { kind: 'entry', urlPattern: 'https://chatgpt.com/' },
+      { kind: 'conversation', urlPattern: 'https://chatgpt.com/c/:conversationId' },
+    ),
+    trustedSignInOrigins: [
+      { origin: 'https://accounts.google.com' },
+      { origin: 'https://auth.openai.com' },
+      { origin: 'https://auth0.openai.com' },
+      { origin: 'https://login.openai.com' },
+    ],
+  }),
+  claude: navigation({
+    entryUrl: 'https://claude.ai/new',
+    homeUrl: 'https://claude.ai/new',
+    origins: ['https://claude.ai'],
+    pagePatterns: pages(
+      { kind: 'entry', urlPattern: 'https://claude.ai/new' },
+      { kind: 'conversation', urlPattern: 'https://claude.ai/chat/:conversationId' },
+      { kind: 'project_list', urlPattern: 'https://claude.ai/projects' },
+      { kind: 'project', urlPattern: 'https://claude.ai/project/:projectId' },
+    ),
+    trustedSignInOrigins: [{ origin: 'https://accounts.google.com' }],
+  }),
+  gemini: navigation({
+    entryUrl: 'https://gemini.google.com/app',
+    homeUrl: 'https://gemini.google.com/app',
+    origins: ['https://gemini.google.com'],
+    pagePatterns: pages(
+      { kind: 'entry', urlPattern: 'https://gemini.google.com/app' },
+      { kind: 'conversation', urlPattern: 'https://gemini.google.com/app/:conversationId' },
+    ),
+    trustedSignInOrigins: [{ origin: 'https://accounts.google.com' }],
+  }),
+  grok: navigation({
+    entryUrl: 'https://grok.com/',
+    homeUrl: 'https://grok.com/',
+    origins: ['https://grok.com'],
+    pagePatterns: pages(
+      { kind: 'entry', urlPattern: 'https://grok.com/' },
+      { kind: 'project', urlPattern: 'https://grok.com/project/:projectId' },
+      { kind: 'project', urlPattern: 'https://grok.com/projects/:projectId' },
+    ),
+    trustedSignInOrigins: [
+      {
+        origin: 'https://accounts.x.ai',
+        pathPrefixes: ['/check-login'],
+      },
+    ],
+  }),
+  qwen: navigation({
+    entryUrl: 'https://chat.qwen.ai/',
+    homeUrl: 'https://chat.qwen.ai/',
+    origins: ['https://chat.qwen.ai'],
+    pagePatterns: pages(
+      { kind: 'entry', urlPattern: 'https://chat.qwen.ai/' },
+      { kind: 'conversation', urlPattern: 'https://chat.qwen.ai/c/:conversationId' },
+    ),
+    trustedSignInOrigins: [],
+  }),
+  deepseek: navigation({
+    entryUrl: 'https://chat.deepseek.com/',
+    homeUrl: 'https://chat.deepseek.com/',
+    origins: ['https://chat.deepseek.com'],
+    pagePatterns: pages(
+      { kind: 'entry', urlPattern: 'https://chat.deepseek.com/' },
+      { kind: 'conversation', urlPattern: 'https://chat.deepseek.com/a/chat/s/:conversationId' },
+    ),
+    trustedSignInOrigins: [
+      { origin: 'https://accounts.google.com' },
+      { origin: 'https://appleid.apple.com' },
+    ],
+  }),
+  perplexity: navigation({
+    entryUrl: 'https://www.perplexity.ai/',
+    homeUrl: 'https://www.perplexity.ai/',
+    origins: ['https://www.perplexity.ai'],
+    pagePatterns: pages(
+      { kind: 'entry', urlPattern: 'https://www.perplexity.ai/' },
+    ),
+    trustedSignInOrigins: [],
+  }),
+  zai: navigation({
+    entryUrl: 'https://z.ai/chat',
+    homeUrl: 'https://chat.z.ai/',
+    origins: ['https://z.ai', 'https://chat.z.ai'],
+    pagePatterns: pages(
+      { kind: 'entry', urlPattern: 'https://z.ai/chat' },
+      { kind: 'chat_runtime', urlPattern: 'https://chat.z.ai/' },
+      { kind: 'conversation', urlPattern: 'https://chat.z.ai/c/:conversationId' },
+    ),
+    trustedSignInOrigins: [],
+  }),
+  doubao: navigation({
+    entryUrl: 'https://www.doubao.com/chat/',
+    homeUrl: 'https://www.doubao.com/chat/',
+    origins: ['https://www.doubao.com'],
+    pagePatterns: pages(
+      { kind: 'entry', urlPattern: 'https://www.doubao.com/chat/' },
+    ),
+    trustedSignInOrigins: [],
+  }),
+} satisfies Readonly<Record<ProviderNavigationCatalogId, ProviderNavigationDefinition>>)
diff --git a/packages/cli/src/providers/qwen-provider.ts b/packages/cli/src/providers/qwen-provider.ts
new file mode 100644
index 0000000..f285337
--- /dev/null
+++ b/packages/cli/src/providers/qwen-provider.ts
@@ -0,0 +1,207 @@
+import { BaseProvider } from './base-provider.js'
+import { waitForVisibleLocator } from './dom-locators.js'
+import {
+  DEFAULT_CHOICE_AVAILABILITY,
+  defineDescriptor,
+  defineProvider,
+  providerCapabilities,
+} from './provider-definition.js'
+import { MenuTextAccountInspector } from './account-inspectors.js'
+import { tokenlessError } from '../playwright/errors.js'
+import { QwenModeCapability } from './capabilities/qwen-mode.js'
+import type { Locator, Page } from 'playwright-core'
+import type { ProviderExecutionContext } from './execution-context.js'
+import type { ProviderDomDefinition } from './provider-definition.js'
+import { PROVIDER_NAVIGATION_CATALOG } from './provider-navigation-catalog.js'
+
+const QWEN_PROMPT_CONTROL_VISIBILITY_TIMEOUT_MS = 15_000
+const QWEN_APP_HYDRATION_AGE_MS = 3_000
+
+export class QwenProvider extends BaseProvider<'qwen'> {
+  constructor() {
+    const descriptor = defineDescriptor({
+      id: 'qwen',
+      label: 'Qwen / 千问',
+      stage: 'experimental',
+      setupOrder: 4,
+      protocolCompatibility: Object.freeze({
+        legacyRequests: false,
+      }),
+      navigation: PROVIDER_NAVIGATION_CATALOG.qwen,
+      profileImport: Object.freeze({
+        cookieDomains: Object.freeze(['qwen.ai']),
+      }),
+      controls: Object.freeze({
+        chatSurface: false,
+      }),
+    })
+    const provider = defineProvider({
+      descriptor,
+      access: Object.freeze({
+        guest: 'supported',
+        guestContinueControlNames: Object.freeze([]),
+      }),
+      account: Object.freeze({
+        inspector: new MenuTextAccountInspector(),
+        freePlanLabels: Object.freeze([]),
+        paidPlanLabels: Object.freeze([]),
+      }),
+      composerSelectors: Object.freeze([
+        'textarea.message-input-textarea',
+      ]),
+      submitSelectors: Object.freeze([
+        'button.send-button',
+      ]),
+      answerSelectors: Object.freeze([
+        '.qwen-chat-message-assistant .chat-response-message .qwen-markdown',
+        '.qwen-chat-message-assistant .qwen-markdown',
+      ]),
+      fileInputSelectors: Object.freeze([]),
+      fileUploadTriggerSelectors: Object.freeze([]),
+      fileUploadLocalSelectors: Object.freeze([]),
+      modelControlSelectors: Object.freeze([]),
+      effortControlSelectors: Object.freeze([
+        '.qwen-select-thinking',
+      ]),
+      authIndicators: Object.freeze([]),
+      loginIndicators: Object.freeze([
+        'button:has-text("Log in")',
+        'button:has-text("Sign up")',
+        'button:has-text("登录")',
+      ]),
+      blockerSelectors: Object.freeze([]),
+      busySelectors: Object.freeze([
+        'button.stop-button',
+        '.qwen-chat-message-awaiting-response',
+      ]),
+      choiceAvailability: DEFAULT_CHOICE_AVAILABILITY,
+      capabilities: providerCapabilities({ qwenMode: true }),
+    })
+    super(provider, {
+      extensions: Object.freeze([
+        new QwenModeCapability(provider),
+      ]),
+    })
+  }
+
+  protected override async inputPrompt(page: Page, text: string, _context: ProviderExecutionContext) {
+    const deadline = Date.now() + QWEN_PROMPT_CONTROL_VISIBILITY_TIMEOUT_MS
+    await waitForQwenAppHydration(page, deadline)
+    let composerObserved = false
+    do {
+      const composer = await waitForVisibleLocator(
+        page,
+        this.definition.composerSelectors,
+        Math.max(1, deadline - Date.now()),
+      )
+      if (!composer) break
+      composerObserved = true
+      if (await writeQwenPrompt(page, composer, this.definition, text, deadline)) {
+        return {
+          visible: true as const,
+          inputProof: 'prompt-text-visible',
+        }
+      }
+      if (Date.now() < deadline) {
+        await page.waitForTimeout(Math.min(100, Math.max(1, deadline - Date.now())))
+      }
+    } while (Date.now() < deadline)
+
+    if (!composerObserved) {
+      throw tokenlessError(
+        'prompt_input_visibility_timeout',
+        `Timed out after ${QWEN_PROMPT_CONTROL_VISIBILITY_TIMEOUT_MS}ms waiting for a visible prompt input.`,
+        { retryable: true },
+      )
+    }
+    throw tokenlessError(
+      'prompt_input_failed',
+      'The visible prompt input remained empty after input.',
+      { retryable: true },
+    )
+  }
+}
+
+async function waitForQwenAppHydration(page: Page, deadline: number) {
+  const pageAgeMs = await page.evaluate(() => performance.now()).catch(() => 0)
+  const remainingHydrationMs = Math.max(0, QWEN_APP_HYDRATION_AGE_MS - pageAgeMs)
+  if (remainingHydrationMs > 0) {
+    await page.waitForTimeout(Math.min(remainingHydrationMs, Math.max(1, deadline - Date.now())))
+  }
+}
+
+async function writeQwenPrompt(
+  page: Page,
+  composer: Locator,
+  provider: ProviderDomDefinition,
+  text: string,
+  deadline: number,
+) {
+  await composer.fill(text, { timeout: Math.min(2000, Math.max(1, deadline - Date.now())) }).catch(() => undefined)
+  if (await qwenComposerHasExpectedText(page, provider, text, deadline)) return true
+
+  const freshComposer = await waitForVisibleLocator(
+    page,
+    provider.composerSelectors,
+    Math.max(1, deadline - Date.now()),
+  )
+  if (!freshComposer) return false
+  try {
+    await focusQwenComposer(freshComposer)
+  } catch {
+    return false
+  }
+  await page.keyboard.press(process.platform === 'darwin' ? 'Meta+A' : 'Control+A').catch(() => undefined)
+  await page.keyboard.press('Backspace').catch(() => undefined)
+  const clearedComposer = await waitForVisibleLocator(
+    page,
+    provider.composerSelectors,
+    Math.max(1, deadline - Date.now()),
+  )
+  if (!clearedComposer) return false
+  try {
+    await focusQwenComposer(clearedComposer)
+  } catch {
+    return false
+  }
+  if (text.length > 0) {
+    await page.keyboard.insertText(text).catch(() => undefined)
+  }
+  return await qwenComposerHasExpectedText(page, provider, text, deadline)
+}
+
+async function focusQwenComposer(composer: Locator) {
+  await composer.scrollIntoViewIfNeeded({ timeout: 1000 }).catch(() => undefined)
+  await composer.click({ timeout: 1000 })
+}
+
+async function qwenComposerHasExpectedText(
+  page: Page,
+  provider: ProviderDomDefinition,
+  expected: string,
+  deadline: number,
+) {
+  const composer = await waitForVisibleLocator(
+    page,
+    provider.composerSelectors,
+    Math.max(1, deadline - Date.now()),
+  )
+  if (!composer) return false
+  return await composer.evaluate((element, value) => {
+    const normalizeSlateText = (input: string) => input
+      .replace(/[\u200b-\u200d\u2060\ufeff]/g, '')
+      .replace(/\u00a0/g, ' ')
+      .replace(/\s+/g, ' ')
+      .trim()
+    const text = element instanceof HTMLTextAreaElement || element instanceof HTMLInputElement
+      ? element.value
+      : (() => {
+          const clone = element.cloneNode(true) as Element
+          clone.querySelectorAll('[data-slate-placeholder="true"], [data-slate-zero-width]').forEach((node) => node.remove())
+          return clone.textContent ?? ''
+        })()
+    const normalized = normalizeSlateText(text)
+    const expected = normalizeSlateText(value)
+    return expected.length === 0 ? normalized.length === 0 : normalized === expected
+  }, expected).catch(() => false)
+}
diff --git a/packages/cli/src/providers/rate-limit-catalog-check.mts b/packages/cli/src/providers/rate-limit-catalog-check.mts
new file mode 100644
index 0000000..d8633ef
--- /dev/null
+++ b/packages/cli/src/providers/rate-limit-catalog-check.mts
@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+
+import { providerRateLimitCatalog } from './rate-limit-policy.js'
+import { listProviderDescriptors } from './registry.js'
+
+const catalog = providerRateLimitCatalog()
+const supportedProviders = listProviderDescriptors()
+  .filter((provider) => provider.stage !== 'disabled')
+  .map((provider) => provider.id)
+const missingProviders = supportedProviders.filter((provider) => !catalog.providers[provider])
+if (missingProviders.length > 0) {
+  throw new Error(`provider rate-limit catalog is missing supported providers: ${missingProviders.join(', ')}`)
+}
+const providerCount = Object.keys(catalog.providers).length
+const planCount = Object.values(catalog.providers).reduce((count, provider) => count + provider.plans.length, 0)
+const ruleCount = Object.values(catalog.providers).reduce((count, provider) => count + provider.rules.length, 0)
+
+process.stdout.write(`${catalog.schema} ${catalog.revision}: ${providerCount} providers, ${planCount} plans, ${ruleCount} rules\n`)
+if (Date.now() > Date.parse(`${catalog.reviewAfter}T23:59:59.999Z`)) {
+  process.stderr.write(`warning: provider rate-limit catalog review was due after ${catalog.reviewAfter}\n`)
+}
diff --git a/packages/cli/src/providers/rate-limit-policy.ts b/packages/cli/src/providers/rate-limit-policy.ts
new file mode 100644
index 0000000..d0e5cc3
--- /dev/null
+++ b/packages/cli/src/providers/rate-limit-policy.ts
@@ -0,0 +1,601 @@
+import fs from 'node:fs'
+import { fileURLToPath } from 'node:url'
+
+const CATALOG_SCHEMA = 'tokenless.provider-rate-limit-catalog.v1'
+const PROJECTION_SCHEMA = 'tokenless.provider-capacity-projection.v1'
+
+type JsonRecord = Record<string, unknown>
+
+type CatalogPlan = {
+  id: string
+  family: string
+  labels: readonly string[]
+}
+
+type CatalogRule = {
+  id: string
+  status: string
+  appliesTo: {
+    planIds: readonly string[]
+    accessClasses: readonly string[]
+    modelFamilies: readonly string[]
+    modes?: readonly string[] | undefined
+    actions: readonly string[]
+  }
+  window: {
+    kind: string
+    durationSeconds?: number | undefined
+  }
+  allowance: JsonRecord & {
+    kind: string
+    count?: number | undefined
+  }
+}
+
+type CatalogProvider = {
+  label: string
+  plans: readonly CatalogPlan[]
+  rules: readonly CatalogRule[]
+}
+
+type RuntimeProviderDefault = {
+  modelFamily: string
+  promptAction: string
+}
+
+export type ProviderRateLimitCatalog = {
+  schema: typeof CATALOG_SCHEMA
+  catalogVersion: number
+  revision: string
+  reviewedAt: string
+  reviewAfter: string
+  runtimePolicy: {
+    exactAllowanceHeadroomRatio: number
+    headroomMinimumAllowance: number
+    burstRatio: number
+    minimumBurstUnits: number
+    maximumBurstUnits: number
+    providerDefaults: Readonly<Record<string, RuntimeProviderDefault>>
+  }
+  sources: Readonly<Record<string, JsonRecord>>
+  providers: Readonly<Record<string, CatalogProvider>>
+}
+
+export type ProviderRateLimitHistoryEvent = {
+  submittedAt: string
+  requestJson: unknown
+}
+
+export type ProviderCapacityInput = {
+  provider: string
+  profileId: string
+  accessClass: string
+  tierLabel?: string | null | undefined
+  subscriptionLabel?: string | null | undefined
+  requestJson: unknown
+  history: readonly ProviderRateLimitHistoryEvent[]
+  now?: string | Date | undefined
+}
+
+export type ProviderRuleCapacityProjection = {
+  ruleId: string
+  knowledge: 'official_exact' | 'non_numeric'
+  action: string
+  windowSeconds: number | null
+  publishedAllowance: number | null
+  effectiveAllowance: number | null
+  usedUnits: number | null
+  requestedUnits: number
+  remainingUnits: number | null
+  burstUnits: number | null
+  cadenceSeconds: number | null
+  decision: 'admit' | 'defer' | 'unknown'
+  eligibleAt: string | null
+  reason: string
+}
+
+export type ProviderCapacityProjection = {
+  schema: typeof PROJECTION_SCHEMA
+  catalogVersion: number
+  catalogRevision: string
+  provider: string
+  profileId: string
+  evaluatedAt: string
+  subscription: {
+    accessClass: string
+    observedLabel: string | null
+    planId: string
+    match: 'label' | 'access_class' | 'unknown'
+  }
+  decision: 'admit' | 'defer' | 'unknown'
+  eligibleAt: string | null
+  reason: string
+  rules: readonly ProviderRuleCapacityProjection[]
+}
+
+export interface ProviderCapacityPolicy {
+  project(input: ProviderCapacityInput): ProviderCapacityProjection
+}
+
+let catalogCache: ProviderRateLimitCatalog | undefined
+
+export function providerRateLimitCatalog(): ProviderRateLimitCatalog {
+  catalogCache ??= readAndValidateCatalog()
+  return catalogCache
+}
+
+export function validateProviderRateLimitCatalog(input: unknown): ProviderRateLimitCatalog {
+  const root = record(input, 'catalog')
+  if (root.schema !== CATALOG_SCHEMA) fail(`catalog.schema must equal ${CATALOG_SCHEMA}`)
+  positiveInteger(root.catalogVersion, 'catalog.catalogVersion')
+  isoDate(root.revision, 'catalog.revision')
+  isoDate(root.reviewedAt, 'catalog.reviewedAt')
+  isoDate(root.reviewAfter, 'catalog.reviewAfter')
+
+  const runtimePolicy = record(root.runtimePolicy, 'catalog.runtimePolicy')
+  ratio(runtimePolicy.exactAllowanceHeadroomRatio, 'runtimePolicy.exactAllowanceHeadroomRatio')
+  positiveInteger(runtimePolicy.headroomMinimumAllowance, 'runtimePolicy.headroomMinimumAllowance')
+  ratio(runtimePolicy.burstRatio, 'runtimePolicy.burstRatio')
+  positiveInteger(runtimePolicy.minimumBurstUnits, 'runtimePolicy.minimumBurstUnits')
+  positiveInteger(runtimePolicy.maximumBurstUnits, 'runtimePolicy.maximumBurstUnits')
+  if (Number(runtimePolicy.minimumBurstUnits) > Number(runtimePolicy.maximumBurstUnits)) {
+    fail('runtimePolicy.minimumBurstUnits must not exceed maximumBurstUnits')
+  }
+  const providerDefaults = record(runtimePolicy.providerDefaults, 'runtimePolicy.providerDefaults')
+
+  const sources = record(root.sources, 'catalog.sources')
+  if (Object.keys(sources).length === 0) fail('catalog.sources must not be empty')
+  for (const [sourceId, sourceValue] of Object.entries(sources)) {
+    const source = record(sourceValue, `sources.${sourceId}`)
+    nonemptyString(source.publisher, `sources.${sourceId}.publisher`)
+    nonemptyString(source.title, `sources.${sourceId}.title`)
+    const url = nonemptyString(source.url, `sources.${sourceId}.url`)
+    if (!url.startsWith('https://')) fail(`sources.${sourceId}.url must use HTTPS`)
+    if (source.authority !== 'official') fail(`sources.${sourceId}.authority must be official`)
+    isoDate(source.retrievedAt, `sources.${sourceId}.retrievedAt`)
+  }
+
+  const providers = record(root.providers, 'catalog.providers')
+  if (Object.keys(providers).length === 0) fail('catalog.providers must not be empty')
+  const allRuleIds = new Set<string>()
+  for (const [providerId, providerValue] of Object.entries(providers)) {
+    const provider = record(providerValue, `providers.${providerId}`)
+    nonemptyString(provider.label, `providers.${providerId}.label`)
+    const plans = array(provider.plans, `providers.${providerId}.plans`)
+    const planIds = new Set<string>()
+    for (const [index, planValue] of plans.entries()) {
+      const plan = record(planValue, `providers.${providerId}.plans[${index}]`)
+      const planId = nonemptyString(plan.id, `providers.${providerId}.plans[${index}].id`)
+      if (planIds.has(planId)) fail(`provider ${providerId} has duplicate plan ${planId}`)
+      planIds.add(planId)
+      nonemptyString(plan.family, `providers.${providerId}.plans[${index}].family`)
+      stringArray(plan.labels, `providers.${providerId}.plans[${index}].labels`)
+    }
+    if (!planIds.has('unknown')) fail(`provider ${providerId} must declare an unknown plan`)
+    const defaults = record(providerDefaults[providerId], `runtimePolicy.providerDefaults.${providerId}`)
+    nonemptyString(defaults.modelFamily, `runtimePolicy.providerDefaults.${providerId}.modelFamily`)
+    nonemptyString(defaults.promptAction, `runtimePolicy.providerDefaults.${providerId}.promptAction`)
+
+    const rules = array(provider.rules, `providers.${providerId}.rules`)
+    for (const [index, ruleValue] of rules.entries()) {
+      const path = `providers.${providerId}.rules[${index}]`
+      const rule = record(ruleValue, path)
+      const ruleId = nonemptyString(rule.id, `${path}.id`)
+      if (allRuleIds.has(ruleId)) fail(`duplicate rule id ${ruleId}`)
+      allRuleIds.add(ruleId)
+      nonemptyString(rule.status, `${path}.status`)
+      const appliesTo = record(rule.appliesTo, `${path}.appliesTo`)
+      const rulePlanIds = stringArray(appliesTo.planIds, `${path}.appliesTo.planIds`)
+      if (rulePlanIds.some((planId) => !planIds.has(planId))) fail(`${ruleId} references an unknown plan`)
+      stringArray(appliesTo.accessClasses, `${path}.appliesTo.accessClasses`)
+      stringArray(appliesTo.modelFamilies, `${path}.appliesTo.modelFamilies`)
+      stringArray(appliesTo.actions, `${path}.appliesTo.actions`)
+      if (appliesTo.modes !== undefined) stringArray(appliesTo.modes, `${path}.appliesTo.modes`)
+      const window = record(rule.window, `${path}.window`)
+      nonemptyString(window.kind, `${path}.window.kind`)
+      if (window.durationSeconds !== undefined) positiveInteger(window.durationSeconds, `${path}.window.durationSeconds`)
+      const allowance = record(rule.allowance, `${path}.allowance`)
+      const allowanceKind = nonemptyString(allowance.kind, `${path}.allowance.kind`)
+      if (allowanceKind === 'exact') {
+        positiveInteger(allowance.count, `${path}.allowance.count`)
+        const evidence = array(rule.evidence, `${path}.evidence`)
+        if (!evidence.some((entry) => record(entry, `${path}.evidence`).kind === 'official_exact')) {
+          fail(`${ruleId} has an exact allowance without official_exact evidence`)
+        }
+      }
+    }
+  }
+
+  walkSourceReferences(root, new Set(Object.keys(sources)))
+  for (const providerValue of Object.values(providers)) {
+    for (const ruleValue of array(record(providerValue, 'provider').rules, 'provider.rules')) {
+      const allowance = record(record(ruleValue, 'rule').allowance, 'rule.allowance')
+      if (typeof allowance.basisRuleId === 'string' && !allRuleIds.has(allowance.basisRuleId)) {
+        fail(`allowance references unknown basis rule ${allowance.basisRuleId}`)
+      }
+    }
+  }
+  return root as ProviderRateLimitCatalog
+}
+
+export const providerCapacityPolicy: ProviderCapacityPolicy = Object.freeze({
+  project(input: ProviderCapacityInput): ProviderCapacityProjection {
+    const catalog = providerRateLimitCatalog()
+    const provider = catalog.providers[input.provider]
+    const now = normalizeNow(input.now)
+    const tierLabel = normalizeObservedLabel(input.tierLabel)
+    const subscriptionLabel = normalizeObservedLabel(input.subscriptionLabel)
+    const observedLabel = tierLabel ?? subscriptionLabel
+    if (!provider) return unknownProjection(catalog, input, now, observedLabel, 'Provider is not present in the rate-limit catalog.')
+    const subscription = resolvePlan(provider, input.accessClass, [tierLabel, subscriptionLabel])
+    const defaults = catalog.runtimePolicy.providerDefaults[input.provider]
+    if (!defaults) return unknownProjection(catalog, input, now, observedLabel, 'Provider runtime defaults are unavailable.')
+    const requestContext = requestRateContext(input.provider, input.requestJson, defaults)
+    const matchingRules = provider.rules.filter((rule) => rule.status === 'active' &&
+      rule.appliesTo.planIds.includes(subscription.planId) &&
+      rule.appliesTo.accessClasses.includes(input.accessClass) &&
+      ruleMatchesContext(rule, requestContext))
+    const rules = matchingRules.map((rule) => projectRule(catalog, rule, input, requestContext, now))
+    const deferred = rules.filter((rule) => rule.decision === 'defer')
+    const numeric = rules.filter((rule) => rule.knowledge === 'official_exact')
+    const unknown = rules.filter((rule) => rule.decision === 'unknown')
+    const eligibleAt = deferred.reduce<string | null>((latest, rule) => laterIso(latest, rule.eligibleAt), null)
+    const decision: ProviderCapacityProjection['decision'] = deferred.length > 0
+      ? 'defer'
+      : unknown.length > 0 ? 'unknown' : numeric.length > 0 ? 'admit' : 'unknown'
+    const reason = deferred.length > 0
+      ? 'At least one known provider allowance requires a later eligible time.'
+      : unknown.length > 0
+        ? 'At least one applicable allowance is non-numeric; Tokenless preserves the uncertainty and allows execution.'
+        : numeric.length > 0
+          ? 'Known numeric provider allowances have capacity for this request.'
+          : 'No enforceable numeric allowance is known; Tokenless preserves the uncertainty and allows execution.'
+    return {
+      schema: PROJECTION_SCHEMA,
+      catalogVersion: catalog.catalogVersion,
+      catalogRevision: catalog.revision,
+      provider: input.provider,
+      profileId: input.profileId,
+      evaluatedAt: now.toISOString(),
+      subscription: {
+        accessClass: input.accessClass,
+        observedLabel: subscription.observedLabel ?? observedLabel,
+        planId: subscription.planId,
+        match: subscription.match,
+      },
+      decision,
+      eligibleAt,
+      reason,
+      rules,
+    }
+  },
+})
+
+function projectRule(
+  catalog: ProviderRateLimitCatalog,
+  rule: CatalogRule,
+  input: ProviderCapacityInput,
+  requestContext: RequestRateContext,
+  now: Date,
+): ProviderRuleCapacityProjection {
+  const requestedUnits = unitsForRule(rule, requestContext)
+  const action = rule.appliesTo.actions.join(',')
+  if (
+    rule.allowance.kind !== 'exact' ||
+    typeof rule.allowance.count !== 'number' ||
+    typeof rule.window.durationSeconds !== 'number' ||
+    !Number.isSafeInteger(rule.allowance.count) ||
+    !Number.isSafeInteger(rule.window.durationSeconds)
+  ) {
+    return {
+      ruleId: rule.id,
+      knowledge: 'non_numeric',
+      action,
+      windowSeconds: rule.window.durationSeconds ?? null,
+      publishedAllowance: null,
+      effectiveAllowance: null,
+      usedUnits: null,
+      requestedUnits,
+      remainingUnits: null,
+      burstUnits: null,
+      cadenceSeconds: null,
+      decision: 'unknown',
+      eligibleAt: null,
+      reason: `Catalog allowance '${rule.allowance.kind}' is intentionally not converted into a numeric limit.`,
+    }
+  }
+
+  const publishedAllowance = rule.allowance.count
+  const windowSeconds = rule.window.durationSeconds
+  const scheduledAllowance = publishedAllowance >= catalog.runtimePolicy.headroomMinimumAllowance
+    ? Math.max(1, Math.floor(publishedAllowance * catalog.runtimePolicy.exactAllowanceHeadroomRatio))
+    : publishedAllowance
+  const effectiveAllowance = Math.min(publishedAllowance, Math.max(scheduledAllowance, requestedUnits))
+  const burstUnits = Math.min(
+    catalog.runtimePolicy.maximumBurstUnits,
+    Math.max(catalog.runtimePolicy.minimumBurstUnits, Math.ceil(effectiveAllowance * catalog.runtimePolicy.burstRatio)),
+  )
+  const cadenceMs = windowSeconds * 1000 / effectiveAllowance
+  const windowStartMs = now.getTime() - windowSeconds * 1000
+  const usageTimestamps: number[] = []
+  for (const event of input.history) {
+    const eventMs = Date.parse(event.submittedAt)
+    if (!Number.isFinite(eventMs) || eventMs <= windowStartMs || eventMs > now.getTime()) continue
+    const eventContext = requestRateContext(input.provider, event.requestJson, catalog.runtimePolicy.providerDefaults[input.provider]!)
+    const units = ruleMatchesContext(rule, eventContext) ? unitsForRule(rule, eventContext) : 0
+    for (let unit = 0; unit < units; unit += 1) usageTimestamps.push(eventMs)
+  }
+  usageTimestamps.sort((left, right) => left - right)
+  const usedUnits = usageTimestamps.length
+  const remainingUnits = Math.max(0, effectiveAllowance - usedUnits)
+  const slidingEligibleMs = slidingWindowEligibleAt(
+    usageTimestamps,
+    requestedUnits,
+    effectiveAllowance,
+    windowSeconds * 1000,
+    now.getTime(),
+  )
+  const cadenceEligibleMs = gcraEligibleAt(
+    usageTimestamps,
+    requestedUnits,
+    cadenceMs,
+    burstUnits,
+    now.getTime(),
+  )
+  const eligibleMs = Math.max(slidingEligibleMs, cadenceEligibleMs)
+  const deferred = requestedUnits > 0 && eligibleMs > now.getTime()
+  return {
+    ruleId: rule.id,
+    knowledge: 'official_exact',
+    action,
+    windowSeconds,
+    publishedAllowance,
+    effectiveAllowance,
+    usedUnits,
+    requestedUnits,
+    remainingUnits,
+    burstUnits,
+    cadenceSeconds: cadenceMs / 1000,
+    decision: deferred ? 'defer' : 'admit',
+    eligibleAt: deferred && Number.isFinite(eligibleMs)
+      ? new Date(Math.max(eligibleMs, now.getTime() + 1_000)).toISOString()
+      : null,
+    reason: deferred
+      ? Number.isFinite(eligibleMs)
+        ? 'Known sliding-window capacity or smoothed burst cadence would be exceeded.'
+        : 'The request itself exceeds the published allowance and has no time-based eligibility estimate.'
+      : 'Known sliding-window capacity and burst cadence permit the request.',
+  }
+}
+
+type RequestRateContext = {
+  modelFamily: string
+  modes: ReadonlySet<string>
+  promptUnits: number
+  fileUnits: number
+  promptAction: string
+}
+
+function requestRateContext(provider: string, requestJson: unknown, defaults: RuntimeProviderDefault): RequestRateContext {
+  const actions = isRecord(requestJson) && Array.isArray(requestJson.actions) ? requestJson.actions : []
+  let promptUnits = 0
+  let fileUnits = 0
+  let selectedModel: string | null = null
+  for (const value of actions) {
+    if (!isRecord(value)) continue
+    if (value.action === 'prompt.submit') promptUnits += 1
+    if (value.action === 'file.upload') {
+      const payload = isRecord(value.payload) ? value.payload : null
+      fileUnits += payload && Array.isArray(payload.attachments) ? payload.attachments.length : 1
+    }
+    if (value.action === 'model.select' && isRecord(value.payload) && typeof value.payload.label === 'string') {
+      selectedModel = value.payload.label
+    }
+  }
+  const modelFamily = selectedModel ? modelFamilyFromLabel(provider, selectedModel, defaults.modelFamily) : defaults.modelFamily
+  const modes = new Set<string>()
+  if (/thinking/i.test(modelFamily) || (selectedModel && /thinking/i.test(selectedModel))) modes.add('manual_thinking')
+  return { modelFamily, modes, promptUnits, fileUnits, promptAction: defaults.promptAction }
+}
+
+function modelFamilyFromLabel(provider: string, label: string, fallback: string) {
+  const normalized = label.toLowerCase().replace(/[^a-z0-9]+/g, ' ').trim()
+  if (provider === 'chatgpt') {
+    if (normalized.includes('5 5') && normalized.includes('thinking')) return 'gpt-5.5-thinking'
+    if (normalized.includes('5 5')) return 'gpt-5.5-instant'
+    if (normalized.includes('gpt 5')) return 'gpt-5-family'
+  }
+  if (provider === 'claude' && normalized.includes('sonnet')) return 'claude-sonnet'
+  return fallback
+}
+
+function ruleMatchesContext(rule: CatalogRule, context: RequestRateContext) {
+  const modelMatches = rule.appliesTo.modelFamilies.includes('*') ||
+    rule.appliesTo.modelFamilies.some((family) => family === context.modelFamily ||
+      (family.endsWith('-family') && context.modelFamily.startsWith(family.slice(0, -'-family'.length))))
+  if (!modelMatches) return false
+  if (rule.appliesTo.modes && !rule.appliesTo.modes.some((mode) => context.modes.has(mode))) return false
+  return unitsForRule(rule, context) > 0
+}
+
+function unitsForRule(rule: CatalogRule, context: RequestRateContext) {
+  let units = 0
+  for (const action of rule.appliesTo.actions) {
+    if (action === 'file.upload') units += context.fileUnits
+    if (action === 'prompt.submit' || action === context.promptAction || action === 'interactive.usage') {
+      units += context.promptUnits
+    }
+  }
+  return units
+}
+
+function slidingWindowEligibleAt(
+  usageTimestamps: readonly number[],
+  requestedUnits: number,
+  allowance: number,
+  windowMs: number,
+  nowMs: number,
+) {
+  const overflow = usageTimestamps.length + requestedUnits - allowance
+  if (overflow <= 0) return nowMs
+  const releaseTimestamp = usageTimestamps[overflow - 1]
+  if (releaseTimestamp === undefined) return Number.POSITIVE_INFINITY
+  return releaseTimestamp + windowMs + 1
+}
+
+function gcraEligibleAt(
+  usageTimestamps: readonly number[],
+  requestedUnits: number,
+  cadenceMs: number,
+  burstUnits: number,
+  nowMs: number,
+) {
+  if (requestedUnits <= 0 || !Number.isFinite(cadenceMs) || cadenceMs <= 0) return nowMs
+  let theoreticalArrivalMs = usageTimestamps[0] ?? nowMs
+  for (const timestamp of usageTimestamps) theoreticalArrivalMs = Math.max(theoreticalArrivalMs, timestamp) + cadenceMs
+  const burstToleranceMs = Math.max(0, burstUnits - requestedUnits) * cadenceMs
+  return Math.max(nowMs, theoreticalArrivalMs - burstToleranceMs)
+}
+
+function resolvePlan(provider: CatalogProvider, accessClass: string, observedLabels: readonly (string | null)[]) {
+  for (const observedLabel of observedLabels) {
+    if (!observedLabel) continue
+    const normalized = comparableLabel(observedLabel)
+    const match = provider.plans.find((plan) => plan.labels.some((label) => comparableLabel(label) === normalized))
+      ?? provider.plans.find((plan) => plan.labels.some((label) => normalized.endsWith(comparableLabel(label))))
+    if (match) return { planId: match.id, match: 'label' as const, observedLabel }
+  }
+  if (accessClass === 'signed_in_free') {
+    const free = provider.plans.find((plan) => plan.family === 'free')
+    if (free) return { planId: free.id, match: 'access_class' as const, observedLabel: null }
+  }
+  if (accessClass === 'guest') {
+    const guest = provider.plans.find((plan) => plan.family === 'guest')
+    if (guest) return { planId: guest.id, match: 'access_class' as const, observedLabel: null }
+  }
+  return { planId: 'unknown', match: 'unknown' as const, observedLabel: null }
+}
+
+function unknownProjection(
+  catalog: ProviderRateLimitCatalog,
+  input: ProviderCapacityInput,
+  now: Date,
+  observedLabel: string | null,
+  reason: string,
+): ProviderCapacityProjection {
+  return {
+    schema: PROJECTION_SCHEMA,
+    catalogVersion: catalog.catalogVersion,
+    catalogRevision: catalog.revision,
+    provider: input.provider,
+    profileId: input.profileId,
+    evaluatedAt: now.toISOString(),
+    subscription: { accessClass: input.accessClass, observedLabel, planId: 'unknown', match: 'unknown' },
+    decision: 'unknown',
+    eligibleAt: null,
+    reason,
+    rules: [],
+  }
+}
+
+function readAndValidateCatalog() {
+  const candidates = [
+    fileURLToPath(new URL('./provider-rate-limits.v1.json', import.meta.url)),
+    fileURLToPath(new URL('../../catalog/provider-rate-limits.v1.json', import.meta.url)),
+  ]
+  const catalogPath = candidates.find((candidate) => fs.existsSync(candidate))
+  if (!catalogPath) throw new Error(`Provider rate-limit catalog was not found at ${candidates.join(' or ')}`)
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(fs.readFileSync(catalogPath, 'utf8'))
+  } catch (error) {
+    throw new Error(`Provider rate-limit catalog could not be read: ${error instanceof Error ? error.message : String(error)}`)
+  }
+  return validateProviderRateLimitCatalog(parsed)
+}
+
+function walkSourceReferences(value: unknown, sourceIds: ReadonlySet<string>, path = 'catalog') {
+  if (Array.isArray(value)) {
+    value.forEach((entry, index) => walkSourceReferences(entry, sourceIds, `${path}[${index}]`))
+    return
+  }
+  if (!isRecord(value)) return
+  for (const [key, entry] of Object.entries(value)) {
+    if (key === 'sourceIds') {
+      for (const sourceId of stringArray(entry, `${path}.sourceIds`)) {
+        if (!sourceIds.has(sourceId)) fail(`${path}.sourceIds references unknown source ${sourceId}`)
+      }
+    } else {
+      walkSourceReferences(entry, sourceIds, `${path}.${key}`)
+    }
+  }
+}
+
+function normalizeNow(value: string | Date | undefined) {
+  const date = value === undefined ? new Date() : value instanceof Date ? new Date(value.getTime()) : new Date(value)
+  if (!Number.isFinite(date.getTime())) throw new Error('Provider capacity evaluation time must be a valid timestamp.')
+  return date
+}
+
+function normalizeObservedLabel(value: string | null | undefined) {
+  if (typeof value !== 'string') return null
+  return value.replace(/\s+/g, ' ').trim().slice(0, 120) || null
+}
+
+function comparableLabel(value: string) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, '')
+}
+
+function laterIso(left: string | null, right: string | null) {
+  if (!left) return right
+  if (!right) return left
+  return Date.parse(left) >= Date.parse(right) ? left : right
+}
+
+function isRecord(value: unknown): value is JsonRecord {
+  return Boolean(value && typeof value === 'object' && !Array.isArray(value))
+}
+
+function record(value: unknown, path: string): JsonRecord {
+  if (!isRecord(value)) fail(`${path} must be an object`)
+  return value
+}
+
+function array(value: unknown, path: string): unknown[] {
+  if (!Array.isArray(value) || value.length === 0) fail(`${path} must be a non-empty array`)
+  return value
+}
+
+function stringArray(value: unknown, path: string): string[] {
+  if (!Array.isArray(value)) fail(`${path} must be an array`)
+  return value.map((entry, index) => nonemptyString(entry, `${path}[${index}]`))
+}
+
+function nonemptyString(value: unknown, path: string) {
+  if (typeof value !== 'string' || value.trim() === '') fail(`${path} must be a non-empty string`)
+  return value
+}
+
+function positiveInteger(value: unknown, path: string) {
+  if (!Number.isSafeInteger(value) || Number(value) <= 0) fail(`${path} must be a positive integer`)
+  return Number(value)
+}
+
+function ratio(value: unknown, path: string) {
+  if (typeof value !== 'number' || !Number.isFinite(value) || value <= 0 || value > 1) {
+    fail(`${path} must be greater than zero and no greater than one`)
+  }
+  return value
+}
+
+function isoDate(value: unknown, path: string) {
+  const date = nonemptyString(value, path)
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(date) || !Number.isFinite(Date.parse(`${date}T00:00:00Z`))) {
+    fail(`${path} must be an ISO date`)
+  }
+  return date
+}
+
+function fail(message: string): never {
+  throw new Error(`Invalid provider rate-limit catalog: ${message}`)
+}
diff --git a/packages/cli/src/providers/registry.ts b/packages/cli/src/providers/registry.ts
new file mode 100644
index 0000000..9a80979
--- /dev/null
+++ b/packages/cli/src/providers/registry.ts
@@ -0,0 +1,300 @@
+import { ChatGptProvider } from './chatgpt-provider.js'
+import { ClaudeProvider } from './claude-provider.js'
+import { DeepSeekProvider } from './deepseek-provider.js'
+import { DoubaoProvider } from './doubao-provider.js'
+import { GeminiProvider } from './gemini-provider.js'
+import { GrokProvider } from './grok-provider.js'
+import { PerplexityProvider } from './perplexity-provider.js'
+import { QwenProvider } from './qwen-provider.js'
+import { ZaiProvider } from './zai-provider.js'
+import { PROVIDER_CAPABILITIES, isProviderIdSyntax } from './provider-identity.js'
+import type { BaseProvider } from './base-provider.js'
+import type {
+  CanonicalProviderTarget,
+  ProviderNavigationPolicy,
+} from './navigation-policy.js'
+import type {
+  ProviderAccessClass,
+  ProviderAccountTier,
+  ProviderCapabilityAvailability,
+  ProviderCapabilityResourceKind,
+  ProviderCapabilityStability,
+  ProviderDescriptor,
+  ProviderGuestAccess,
+} from './provider-definition.js'
+import type { ProviderCapabilityId, ProviderId, ProviderStage } from './provider-identity.js'
+
+export { PROVIDER_CAPABILITIES, isProviderIdSyntax } from './provider-identity.js'
+export {
+  TASK_CAPABILITIES,
+  TASK_CAPABILITY_CATALOG_SCHEMA_ID,
+  TASK_CAPABILITY_ROUTE_SCHEMA_ID,
+  TaskCapabilityRequestError,
+  listProviderTaskCapabilityRoutes,
+  listTaskCapabilityDefinitions,
+  normalizeTaskCapabilityRequirements,
+  resolveTaskCapabilityRoute,
+  resolveTaskCapabilityRoutes,
+  taskCapabilityDefinition,
+  validateTaskCapabilityRoute,
+} from './task-capabilities.js'
+export {
+  ProviderNavigationPolicy,
+  assertProviderUrlAllowed,
+  canonicalProviderTarget,
+  safeProviderTargetUrl,
+  trustedProviderSignInNavigation,
+} from './navigation-policy.js'
+export { PROVIDER_NAVIGATION_CATALOG } from './provider-navigation-catalog.js'
+export type {
+  CanonicalProviderTarget,
+  ProviderNavigationClassification,
+  ProviderNavigationDefinition,
+  ProviderPageKind,
+  ProviderPagePattern,
+} from './navigation-policy.js'
+export type { ProviderNavigationCatalogId } from './provider-navigation-catalog.js'
+export type {
+  ProviderAccessClass,
+  ProviderAccountTier,
+  ProviderCapabilityAvailability,
+  ProviderCapabilityResourceKind,
+  ProviderCapabilityStability,
+  ProviderDescriptor,
+  ProviderGuestAccess,
+} from './provider-definition.js'
+export type { ProviderCapabilityId, ProviderId, ProviderStage } from './provider-identity.js'
+export type {
+  JsonSchema,
+  ProviderTaskCapabilityRoute,
+  TaskCapabilityDefinition,
+  TaskCapabilityFamily,
+  TaskCapabilityId,
+  TaskCapabilityLifecycle,
+  TaskCapabilityOutputKind,
+  TaskCapabilityRoute,
+  TaskCapabilityRouteCandidate,
+  TaskCapabilityRouteDecision,
+  TaskCapabilityRouteFailure,
+  TaskCapabilityRouteEvaluation,
+  TaskCapabilityRoutesDecision,
+  TaskCapabilitySideEffect,
+  TaskCapabilityStability,
+} from './task-capabilities.js'
+
+export type ProviderInstance = BaseProvider<ProviderId>
+
+export class ProviderRegistry<TProviders extends readonly ProviderInstance[]> {
+  private readonly providers: TProviders
+  private readonly byId: ReadonlyMap<string, TProviders[number]>
+  private readonly originOwner: ReadonlyMap<string, TProviders[number]>
+
+  private constructor(providers: TProviders) {
+    this.providers = Object.freeze([...providers]) as unknown as TProviders
+    this.byId = new Map(providers.map((provider) => [provider.id, provider]))
+    this.originOwner = new Map(providers.flatMap((provider) => (
+      provider.descriptor.navigation.origins.map((origin) => [origin.toLowerCase(), provider] as const)
+    )))
+    Object.freeze(this)
+  }
+
+  static create<TProviders extends readonly ProviderInstance[]>(providers: TProviders): ProviderRegistry<TProviders> {
+    validateProviders(providers)
+    return new ProviderRegistry(providers)
+  }
+
+  list(options: { stages?: readonly ProviderStage[] } = {}): readonly TProviders[number][] {
+    if (!options.stages) return this.providers
+    const stages = new Set(options.stages)
+    return this.providers.filter((provider) => stages.has(provider.descriptor.stage))
+  }
+
+  descriptors(options: { stages?: readonly ProviderStage[] } = {}): readonly ProviderDescriptor<ProviderId>[] {
+    return this.list(options).map((provider) => provider.descriptor)
+  }
+
+  resolve(value: unknown): TProviders[number] | null {
+    if (typeof value !== 'string') return null
+    return this.byId.get(value) ?? null
+  }
+
+  require(value: unknown): TProviders[number] {
+    const provider = this.resolve(value)
+    if (!provider) throw new Error(`Unknown provider id: ${String(value)}`)
+    return provider
+  }
+
+  matchUrl(value: unknown): TProviders[number] | null {
+    if (typeof value !== 'string') return null
+    let parsed: URL
+    try {
+      parsed = new URL(value)
+    } catch {
+      return null
+    }
+    if (
+      parsed.protocol !== 'https:' ||
+      parsed.username !== '' ||
+      parsed.password !== '' ||
+      parsed.port !== ''
+    ) {
+      return null
+    }
+    return this.originOwner.get(parsed.origin.toLowerCase()) ?? null
+  }
+
+  canonicalTarget(providerId: unknown, value?: unknown): CanonicalProviderTarget | null {
+    return this.resolve(providerId)?.navigation.canonicalTarget(value) ?? null
+  }
+}
+
+export const providerInstances = Object.freeze([
+  new ChatGptProvider(),
+  new ClaudeProvider(),
+  new GeminiProvider(),
+  new GrokProvider(),
+  new QwenProvider(),
+  new DeepSeekProvider(),
+  new PerplexityProvider(),
+  new ZaiProvider(),
+  new DoubaoProvider(),
+] satisfies readonly ProviderInstance[])
+
+export const providerRegistry = ProviderRegistry.create(providerInstances)
+
+export function listProviderInstances(): ProviderInstance[] {
+  return [...providerRegistry.list()]
+}
+
+export function getProviderInstanceById(providerId: unknown): ProviderInstance | null {
+  return providerRegistry.resolve(providerId)
+}
+
+export function listProviderDescriptors(): ProviderDescriptor<ProviderId>[] {
+  return [...providerRegistry.descriptors()]
+}
+
+export function getProviderDescriptorById(providerId: unknown): ProviderDescriptor<ProviderId> | null {
+  return providerRegistry.resolve(providerId)?.descriptor ?? null
+}
+
+export function getProviderInstanceForUrl(value: unknown): ProviderInstance | null {
+  return providerRegistry.matchUrl(value)
+}
+
+export function getProviderDescriptorForUrl(value: unknown): ProviderDescriptor<ProviderId> | null {
+  return providerRegistry.matchUrl(value)?.descriptor ?? null
+}
+
+function validateProviders(providers: readonly ProviderInstance[]) {
+  const ids = new Set<string>()
+  const origins = new Map<string, ProviderId>()
+  const setupOrders = new Map<number, ProviderId>()
+  for (const instance of providers) {
+    const provider = instance
+    if (provider.id !== provider.descriptor.id) throw new Error('Provider descriptor id does not match provider id.')
+    if (provider.navigation.providerId !== provider.id) throw new Error('Provider navigation policy owner is invalid.')
+    if (ids.has(provider.id)) throw new Error(`Duplicate provider id: ${provider.id}`)
+    ids.add(provider.id)
+    validateProviderDescriptor(provider.descriptor)
+    if (setupOrders.has(provider.descriptor.setupOrder)) {
+      throw new Error(`Duplicate provider setup order: ${provider.descriptor.setupOrder}`)
+    }
+    setupOrders.set(provider.descriptor.setupOrder, provider.id)
+    for (const origin of provider.descriptor.navigation.origins) {
+      const normalized = origin.toLowerCase()
+      const owner = origins.get(normalized)
+      if (owner) throw new Error(`Provider origin ${origin} is already owned by ${owner}.`)
+      origins.set(normalized, provider.id)
+    }
+  }
+}
+
+function validateProviderDescriptor(descriptor: ProviderDescriptor<ProviderId>) {
+  if (!isProviderIdSyntax(descriptor.id) || !descriptor.label) throw new Error('Provider descriptor identity is invalid.')
+  if (descriptor.stage !== 'experimental' && descriptor.stage !== 'supported' && descriptor.stage !== 'disabled') {
+    throw new Error(`Provider ${descriptor.id} stage is invalid.`)
+  }
+  if (!Number.isSafeInteger(descriptor.setupOrder) || descriptor.setupOrder < 0) {
+    throw new Error(`Provider ${descriptor.id} setup order is invalid.`)
+  }
+  if (descriptor.protocolCompatibility?.legacyRequests !== true && descriptor.protocolCompatibility?.legacyRequests !== false) {
+    throw new Error(`Provider ${descriptor.id} protocol compatibility policy is invalid.`)
+  }
+  if (descriptor.controls?.chatSurface !== true && descriptor.controls?.chatSurface !== false) {
+    throw new Error(`Provider ${descriptor.id} controls policy is invalid.`)
+  }
+  const entry = parseDescriptorUrl(descriptor.navigation.entryUrl, { allowPath: true })
+  if (!entry) throw new Error(`Provider ${descriptor.id} entry URL is invalid.`)
+  const home = parseDescriptorUrl(descriptor.navigation.homeUrl, { allowPath: true })
+  if (!home) throw new Error(`Provider ${descriptor.id} automation home URL is invalid.`)
+  const originSet = new Set<string>()
+  for (const origin of descriptor.navigation.origins) {
+    const parsed = parseDescriptorUrl(origin)
+    if (!parsed || parsed.href !== parsed.origin + '/') throw new Error(`Provider ${descriptor.id} origin is invalid.`)
+    originSet.add(parsed.origin.toLowerCase())
+  }
+  if (!originSet.has(entry.origin.toLowerCase())) throw new Error(`Provider ${descriptor.id} entry URL origin is not owned.`)
+  if (!originSet.has(home.origin.toLowerCase())) throw new Error(`Provider ${descriptor.id} automation home URL origin is not owned.`)
+  const pagePatternSet = new Set<string>()
+  let ownsEntryPattern = false
+  let ownsAutomationHomePattern = false
+  for (const page of descriptor.navigation.pagePatterns) {
+    const parsed = parseDescriptorUrl(page.urlPattern, { allowPath: true })
+    if (!parsed || !validPagePatternPath(parsed.pathname)) {
+      throw new Error(`Provider ${descriptor.id} page URL pattern is invalid.`)
+    }
+    if (!originSet.has(parsed.origin.toLowerCase())) {
+      throw new Error(`Provider ${descriptor.id} page URL pattern origin is not owned.`)
+    }
+    const key = `${page.kind}:${page.urlPattern}`
+    if (pagePatternSet.has(key)) throw new Error(`Provider ${descriptor.id} page URL pattern is duplicated.`)
+    pagePatternSet.add(key)
+    if (page.kind === 'entry' && page.urlPattern === descriptor.navigation.entryUrl) ownsEntryPattern = true
+    if (page.urlPattern === descriptor.navigation.homeUrl) ownsAutomationHomePattern = true
+  }
+  if (!ownsEntryPattern) throw new Error(`Provider ${descriptor.id} entry URL has no entry page pattern.`)
+  if (!ownsAutomationHomePattern) {
+    throw new Error(`Provider ${descriptor.id} automation home URL has no page pattern.`)
+  }
+  for (const entry of descriptor.navigation.trustedSignInOrigins) {
+    const parsed = parseDescriptorUrl(entry.origin)
+    if (!parsed || parsed.href !== parsed.origin + '/') {
+      throw new Error(`Provider ${descriptor.id} trusted sign-in origin is invalid.`)
+    }
+    if (entry.pathPrefixes?.some((prefix) => !prefix.startsWith('/'))) {
+      throw new Error(`Provider ${descriptor.id} trusted sign-in path prefix is invalid.`)
+    }
+  }
+  for (const domain of descriptor.profileImport.cookieDomains) {
+    if (!/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/.test(domain)) {
+      throw new Error(`Provider ${descriptor.id} profile cookie domain is invalid.`)
+    }
+  }
+}
+
+function parseDescriptorUrl(value: string, options: { allowPath?: boolean } = {}) {
+  let parsed: URL
+  try {
+    parsed = new URL(value)
+  } catch {
+    return null
+  }
+  if (
+    parsed.protocol !== 'https:' ||
+    parsed.username !== '' ||
+    parsed.password !== '' ||
+    parsed.port !== '' ||
+    parsed.search !== '' ||
+    parsed.hash !== ''
+  ) return null
+  if (!options.allowPath && parsed.pathname !== '/') return null
+  return parsed
+}
+
+function validPagePatternPath(pathname: string) {
+  return pathname.split('/').filter(Boolean).every((segment) => (
+    /^:[A-Za-z][A-Za-z0-9]*$/.test(segment) ||
+    /^[A-Za-z0-9._~-]+$/.test(segment)
+  ))
+}
diff --git a/packages/cli/src/providers/task-capabilities.ts b/packages/cli/src/providers/task-capabilities.ts
new file mode 100644
index 0000000..564b877
--- /dev/null
+++ b/packages/cli/src/providers/task-capabilities.ts
@@ -0,0 +1,781 @@
+import { isProviderIdSyntax } from './provider-identity.js'
+import type { ProviderId } from './provider-identity.js'
+
+export const TASK_CAPABILITY_CATALOG_SCHEMA_ID = 'tokenless.task-capability-catalog.v1'
+export const TASK_CAPABILITY_ROUTE_SCHEMA_ID = 'tokenless.task-capability-route.v1'
+
+export const TASK_CAPABILITIES = Object.freeze({
+  CONVERSATION_CHAT: 'conversation.chat',
+  CONVERSATION_CONTINUE: 'conversation.continue',
+  FILE_UPLOAD: 'file.upload',
+  IMAGE_INPUT: 'image.input',
+  AUDIO_INPUT: 'audio.input',
+  AUDIO_TRANSCRIPTION: 'audio.transcription',
+  VIDEO_INPUT: 'video.input',
+  URL_INPUT: 'url.input',
+  REPOSITORY_IMPORT: 'repository.import',
+  SEARCH_WEB: 'search.web',
+  RESEARCH_DEEP: 'research.deep',
+  REASONING_EXTENDED: 'reasoning.extended',
+  CODE_EXECUTE: 'code.execute',
+  DATA_ANALYZE: 'data.analyze',
+  IMAGE_GENERATION: 'image.generation',
+  IMAGE_EDIT: 'image.edit',
+  VIDEO_GENERATION: 'video.generation',
+  AUDIO_GENERATION: 'audio.generation',
+  DOCUMENT_GENERATION: 'document.generation',
+  PRESENTATION_GENERATION: 'presentation.generation',
+  SPREADSHEET_GENERATION: 'spreadsheet.generation',
+  WEBSITE_GENERATION: 'website.generation',
+  WORKSPACE_NATIVE: 'workspace.native',
+  WORKSPACE_INSTRUCTIONS: 'workspace.instructions',
+  WORKSPACE_KNOWLEDGE: 'workspace.knowledge',
+  SOURCE_CONNECTED: 'source.connected',
+  RESPONSE_CITATIONS: 'response.citations',
+  ARTIFACT_DOWNLOAD: 'artifact.download',
+  TASK_BACKGROUND: 'task.background',
+  TASK_INTERACTIVE: 'task.interactive',
+})
+
+export type TaskCapabilityId = typeof TASK_CAPABILITIES[keyof typeof TASK_CAPABILITIES]
+export type TaskCapabilityFamily =
+  | 'conversation'
+  | 'input'
+  | 'retrieval_reasoning'
+  | 'media_generation'
+  | 'artifact_generation'
+  | 'workspace_knowledge'
+  | 'evidence_lifecycle'
+export type TaskCapabilityLifecycle = 'immediate' | 'interactive' | 'long_running'
+export type TaskCapabilityStability = 'candidate' | 'experimental' | 'supported'
+export type TaskCapabilitySideEffect =
+  | 'read_provider_state'
+  | 'upload_content'
+  | 'submit_prompt'
+  | 'create_provider_resource'
+  | 'persist_provider_state'
+  | 'share_external_reference'
+  | 'generate_artifact'
+export type TaskCapabilityOutputKind =
+  | 'text'
+  | 'citation'
+  | 'file'
+  | 'image'
+  | 'audio'
+  | 'video'
+  | 'document'
+  | 'presentation'
+  | 'spreadsheet'
+  | 'website'
+
+export type JsonSchema = Readonly<Record<string, unknown>>
+
+export type TaskCapabilityDefinition = Readonly<{
+  id: TaskCapabilityId
+  title: string
+  description: string
+  family: TaskCapabilityFamily
+  parametersSchema: JsonSchema
+  lifecycle: TaskCapabilityLifecycle
+  sideEffects: readonly TaskCapabilitySideEffect[]
+  implies: readonly TaskCapabilityId[]
+  composesWith: readonly TaskCapabilityId[]
+  conflictsWith: readonly TaskCapabilityId[]
+  requiredEvidence: readonly string[]
+  outputKinds: readonly TaskCapabilityOutputKind[]
+  stability: TaskCapabilityStability
+}>
+
+export type ProviderTaskCapabilityRoute = Readonly<{
+  provider: ProviderId
+  capability: TaskCapabilityId
+  support: 'experimental' | 'supported'
+  strategy: string
+  evidence: readonly string[]
+}>
+
+export type TaskCapabilityRouteCandidate = Readonly<{
+  provider: ProviderId
+  runtimeEligibility: 'eligible' | 'ineligible' | 'unchecked'
+  reason?: string | null
+  preferenceRank?: number
+}>
+
+export type TaskCapabilityRouteEvaluation = Readonly<{
+  provider: ProviderId
+  runtimeEligibility: TaskCapabilityRouteCandidate['runtimeEligibility']
+  compatible: boolean
+  missingCapabilities: readonly TaskCapabilityId[]
+  support: 'experimental' | 'supported' | null
+  rank: number | null
+  score: Readonly<{
+    runtimeEligibility: number
+    evidenceMaturity: number
+    providerPreference: number
+  }> | null
+  reason: string | null
+}>
+
+export type TaskCapabilityRoute = Readonly<{
+  schema: typeof TASK_CAPABILITY_ROUTE_SCHEMA_ID
+  provider: ProviderId
+  requirements: readonly TaskCapabilityId[]
+  strategies: readonly string[]
+  support: 'experimental' | 'supported'
+  evidence: readonly string[]
+  runtimeEligibility: TaskCapabilityRouteCandidate['runtimeEligibility']
+}>
+
+export type TaskCapabilityRouteFailure = Readonly<{
+  ok: false
+  code: 'task_capability_route_unavailable'
+  message: string
+  requirements: readonly TaskCapabilityId[]
+  evaluated: readonly TaskCapabilityRouteEvaluation[]
+}>
+
+export type TaskCapabilityRouteDecision =
+  | Readonly<{
+      ok: true
+      route: TaskCapabilityRoute
+      evaluated: readonly TaskCapabilityRouteEvaluation[]
+    }>
+  | TaskCapabilityRouteFailure
+
+export type TaskCapabilityRoutesDecision =
+  | Readonly<{
+      ok: true
+      routes: readonly TaskCapabilityRoute[]
+      evaluated: readonly TaskCapabilityRouteEvaluation[]
+    }>
+  | TaskCapabilityRouteFailure
+
+export class TaskCapabilityRequestError extends Error {
+  readonly code: 'invalid_task_capability'
+  readonly capability: string
+
+  constructor(capability: string) {
+    super(`Unknown task capability: ${capability}`)
+    this.name = 'TaskCapabilityRequestError'
+    this.code = 'invalid_task_capability'
+    this.capability = capability
+  }
+}
+
+const EMPTY_PARAMETERS_SCHEMA = Object.freeze({
+  type: 'object',
+  additionalProperties: false,
+  properties: Object.freeze({}),
+})
+
+const TASK_CAPABILITY_CATALOG = Object.freeze([
+  defineCapability({
+    id: TASK_CAPABILITIES.CONVERSATION_CHAT,
+    title: 'Chat',
+    description: 'Submit a prompt and read the correlated visible provider response.',
+    family: 'conversation',
+    lifecycle: 'interactive',
+    sideEffects: ['submit_prompt', 'persist_provider_state'],
+    requiredEvidence: ['visible_submission', 'correlated_visible_response', 'durable_job'],
+    outputKinds: ['text'],
+    stability: 'supported',
+  }),
+  defineCapability({
+    id: TASK_CAPABILITIES.CONVERSATION_CONTINUE,
+    title: 'Continue conversation',
+    description: 'Continue the exact durable provider conversation selected by Tokenless.',
+    family: 'conversation',
+    lifecycle: 'interactive',
+    sideEffects: ['submit_prompt', 'persist_provider_state'],
+    implies: [TASK_CAPABILITIES.CONVERSATION_CHAT],
+    requiredEvidence: ['exact_conversation_identity', 'visible_two_turns', 'durable_mapping'],
+    outputKinds: ['text'],
+  }),
+  defineCapability({
+    id: TASK_CAPABILITIES.FILE_UPLOAD,
+    title: 'Upload file',
+    description: 'Attach caller-selected files and prove visible provider acceptance.',
+    family: 'input',
+    lifecycle: 'immediate',
+    sideEffects: ['upload_content'],
+    requiredEvidence: ['visible_provider_attachment'],
+    outputKinds: [],
+    stability: 'supported',
+  }),
+  inputCapability(TASK_CAPABILITIES.IMAGE_INPUT, 'Image input', 'Deliver an image as provider input.'),
+  inputCapability(TASK_CAPABILITIES.AUDIO_INPUT, 'Audio input', 'Deliver audio as provider input.'),
+  defineCapability({
+    id: TASK_CAPABILITIES.AUDIO_TRANSCRIPTION,
+    title: 'Audio transcription',
+    description: 'Produce a completed visible transcript correlated to caller-selected audio.',
+    family: 'retrieval_reasoning',
+    lifecycle: 'interactive',
+    sideEffects: ['upload_content', 'submit_prompt', 'persist_provider_state'],
+    implies: [TASK_CAPABILITIES.AUDIO_INPUT],
+    requiredEvidence: ['source_audio_correlation', 'completed_visible_transcript'],
+    outputKinds: ['text'],
+  }),
+  inputCapability(TASK_CAPABILITIES.VIDEO_INPUT, 'Video input', 'Deliver video as provider input.'),
+  defineCapability({
+    id: TASK_CAPABILITIES.URL_INPUT,
+    title: 'URL input',
+    description: 'Deliver a caller-authorized URL as provider input.',
+    family: 'input',
+    parametersSchema: objectParameters({
+      url: { type: 'string', format: 'uri', maxLength: 2048 },
+    }, ['url']),
+    lifecycle: 'immediate',
+    sideEffects: ['share_external_reference'],
+    requiredEvidence: ['visible_provider_url_acceptance'],
+    outputKinds: [],
+  }),
+  defineCapability({
+    id: TASK_CAPABILITIES.REPOSITORY_IMPORT,
+    title: 'Repository import',
+    description: 'Import an authorized repository through a native provider flow.',
+    family: 'input',
+    parametersSchema: objectParameters({
+      repository: { type: 'string', minLength: 1, maxLength: 2048 },
+      revision: { type: 'string', minLength: 1, maxLength: 240 },
+    }, ['repository']),
+    lifecycle: 'interactive',
+    sideEffects: ['read_provider_state', 'persist_provider_state', 'share_external_reference'],
+    requiredEvidence: ['authorized_repository_identity', 'visible_provider_import'],
+    outputKinds: [],
+  }),
+  defineCapability({
+    id: TASK_CAPABILITIES.SEARCH_WEB,
+    title: 'Web search',
+    description: 'Use a provider-native web retrieval strategy and return grounded results.',
+    family: 'retrieval_reasoning',
+    lifecycle: 'interactive',
+    sideEffects: ['submit_prompt'],
+    requiredEvidence: ['visible_search_strategy', 'grounded_visible_response'],
+    outputKinds: ['text', 'citation'],
+  }),
+  defineCapability({
+    id: TASK_CAPABILITIES.RESEARCH_DEEP,
+    title: 'Deep research',
+    description: 'Complete a provider-native research lifecycle through final cited report delivery.',
+    family: 'retrieval_reasoning',
+    parametersSchema: objectParameters({
+      clarificationPolicy: enumProperty(['wait_for_user', 'include_everything']),
+      sourceScope: { type: 'string', maxLength: 4000 },
+    }),
+    lifecycle: 'long_running',
+    sideEffects: ['submit_prompt', 'persist_provider_state', 'generate_artifact'],
+    implies: [
+      TASK_CAPABILITIES.SEARCH_WEB,
+      TASK_CAPABILITIES.RESPONSE_CITATIONS,
+      TASK_CAPABILITIES.TASK_BACKGROUND,
+      TASK_CAPABILITIES.TASK_INTERACTIVE,
+    ],
+    requiredEvidence: ['research_plan', 'terminal_report', 'visible_citations', 'durable_background_job'],
+    outputKinds: ['text', 'citation', 'document'],
+  }),
+  defineCapability({
+    id: TASK_CAPABILITIES.REASONING_EXTENDED,
+    title: 'Extended reasoning',
+    description: 'Use a proven provider reasoning strategy rather than a raw provider mode label.',
+    family: 'retrieval_reasoning',
+    parametersSchema: objectParameters({
+      intensity: enumProperty(['balanced', 'high', 'maximum']),
+    }),
+    lifecycle: 'interactive',
+    sideEffects: ['submit_prompt'],
+    requiredEvidence: ['selected_reasoning_strategy', 'correlated_visible_response'],
+    outputKinds: ['text'],
+  }),
+  reasoningCapability(TASK_CAPABILITIES.CODE_EXECUTE, 'Code execution', 'Execute code in a provider-owned visible environment.'),
+  reasoningCapability(TASK_CAPABILITIES.DATA_ANALYZE, 'Data analysis', 'Analyze structured data through a provider-native workflow.'),
+  generationCapability(TASK_CAPABILITIES.IMAGE_GENERATION, 'Image generation', 'image', 'image'),
+  defineCapability({
+    id: TASK_CAPABILITIES.IMAGE_EDIT,
+    title: 'Image editing',
+    description: 'Produce a completed edited image correlated to the submitted source image and instruction.',
+    family: 'media_generation',
+    parametersSchema: objectParameters({
+      format: { type: 'string', minLength: 1, maxLength: 40 },
+    }),
+    lifecycle: 'interactive',
+    sideEffects: ['upload_content', 'submit_prompt', 'generate_artifact', 'persist_provider_state'],
+    implies: [TASK_CAPABILITIES.IMAGE_INPUT],
+    requiredEvidence: ['source_image_correlation', 'completed_visible_artifact', 'bounded_artifact_reference'],
+    outputKinds: ['image'],
+  }),
+  generationCapability(TASK_CAPABILITIES.VIDEO_GENERATION, 'Video generation', 'video', 'video', 'long_running'),
+  generationCapability(TASK_CAPABILITIES.AUDIO_GENERATION, 'Audio generation', 'audio', 'audio', 'long_running'),
+  generationCapability(TASK_CAPABILITIES.DOCUMENT_GENERATION, 'Document generation', 'document', 'document', 'long_running'),
+  generationCapability(TASK_CAPABILITIES.PRESENTATION_GENERATION, 'Presentation generation', 'presentation', 'presentation', 'long_running'),
+  generationCapability(TASK_CAPABILITIES.SPREADSHEET_GENERATION, 'Spreadsheet generation', 'spreadsheet', 'spreadsheet', 'long_running'),
+  generationCapability(TASK_CAPABILITIES.WEBSITE_GENERATION, 'Website generation', 'website', 'website', 'long_running'),
+  defineCapability({
+    id: TASK_CAPABILITIES.WORKSPACE_NATIVE,
+    title: 'Native workspace',
+    description: 'Create or reuse an exact native provider Project or equivalent workspace.',
+    family: 'workspace_knowledge',
+    parametersSchema: objectParameters({
+      name: { type: 'string', minLength: 1, maxLength: 240 },
+    }, ['name']),
+    lifecycle: 'interactive',
+    sideEffects: ['create_provider_resource', 'persist_provider_state'],
+    requiredEvidence: ['exact_workspace_identity', 'created_or_reused', 'durable_mapping'],
+    outputKinds: [],
+  }),
+  defineCapability({
+    id: TASK_CAPABILITIES.WORKSPACE_INSTRUCTIONS,
+    title: 'Workspace instructions',
+    description: 'Apply instructions through a native provider workspace and prove their visible effect.',
+    family: 'workspace_knowledge',
+    parametersSchema: objectParameters({
+      instructions: { type: 'string', minLength: 1, maxLength: 32768 },
+    }, ['instructions']),
+    lifecycle: 'interactive',
+    sideEffects: ['create_provider_resource', 'persist_provider_state'],
+    implies: [TASK_CAPABILITIES.WORKSPACE_NATIVE],
+    requiredEvidence: ['visible_instruction_application'],
+    outputKinds: [],
+  }),
+  defineCapability({
+    id: TASK_CAPABILITIES.WORKSPACE_KNOWLEDGE,
+    title: 'Workspace knowledge',
+    description: 'Persist authorized knowledge in an exact native provider workspace.',
+    family: 'workspace_knowledge',
+    lifecycle: 'interactive',
+    sideEffects: ['upload_content', 'persist_provider_state'],
+    implies: [TASK_CAPABILITIES.WORKSPACE_NATIVE],
+    requiredEvidence: ['visible_workspace_knowledge', 'durable_mapping'],
+    outputKinds: [],
+  }),
+  defineCapability({
+    id: TASK_CAPABILITIES.SOURCE_CONNECTED,
+    title: 'Connected source',
+    description: 'Read from an explicitly authorized provider connector or connected source.',
+    family: 'workspace_knowledge',
+    parametersSchema: objectParameters({
+      source: { type: 'string', minLength: 1, maxLength: 120 },
+    }, ['source']),
+    lifecycle: 'interactive',
+    sideEffects: ['read_provider_state'],
+    requiredEvidence: ['authorized_source_identity', 'visible_source_use'],
+    outputKinds: ['text', 'citation'],
+  }),
+  defineCapability({
+    id: TASK_CAPABILITIES.RESPONSE_CITATIONS,
+    title: 'Response citations',
+    description: 'Require normalized citations backed by links visible in the provider response.',
+    family: 'evidence_lifecycle',
+    lifecycle: 'interactive',
+    sideEffects: [],
+    requiredEvidence: ['normalized_citation', 'visible_source_link'],
+    outputKinds: ['citation'],
+  }),
+  defineCapability({
+    id: TASK_CAPABILITIES.ARTIFACT_DOWNLOAD,
+    title: 'Downloadable artifact',
+    description: 'Require a completed provider artifact that can be downloaded.',
+    family: 'evidence_lifecycle',
+    lifecycle: 'long_running',
+    sideEffects: [],
+    requiredEvidence: ['completed_artifact', 'download_reference'],
+    outputKinds: ['file'],
+  }),
+  defineCapability({
+    id: TASK_CAPABILITIES.TASK_BACKGROUND,
+    title: 'Background task',
+    description: 'Allow a durable provider task to continue without keeping the page foregrounded.',
+    family: 'evidence_lifecycle',
+    lifecycle: 'long_running',
+    sideEffects: ['persist_provider_state'],
+    requiredEvidence: ['durable_background_job', 'terminal_state'],
+    outputKinds: [],
+  }),
+  defineCapability({
+    id: TASK_CAPABILITIES.TASK_INTERACTIVE,
+    title: 'Interactive task',
+    description: 'Surface provider clarification or confirmation as a resumable waiting-for-user state.',
+    family: 'evidence_lifecycle',
+    lifecycle: 'interactive',
+    sideEffects: ['persist_provider_state'],
+    requiredEvidence: ['waiting_for_user', 'same_job_resume'],
+    outputKinds: [],
+  }),
+] satisfies readonly TaskCapabilityDefinition[])
+
+const PROVIDER_TASK_CAPABILITY_ROUTES = Object.freeze([
+  route('chatgpt', TASK_CAPABILITIES.CONVERSATION_CHAT, 'supported', 'visible-conversation', ['conversation-workflow']),
+  route('chatgpt', TASK_CAPABILITIES.FILE_UPLOAD, 'supported', 'visible-file-attachment', ['conversation-workflow']),
+  route('claude', TASK_CAPABILITIES.CONVERSATION_CHAT, 'supported', 'visible-conversation', ['conversation-workflow']),
+  route('claude', TASK_CAPABILITIES.FILE_UPLOAD, 'supported', 'visible-file-attachment', ['conversation-workflow', 'native-project']),
+  route('gemini', TASK_CAPABILITIES.CONVERSATION_CHAT, 'supported', 'visible-conversation', ['workspace-response-citations']),
+  route('grok', TASK_CAPABILITIES.CONVERSATION_CHAT, 'supported', 'visible-conversation', ['conversation-workflow']),
+  route('grok', TASK_CAPABILITIES.FILE_UPLOAD, 'supported', 'visible-file-attachment', ['conversation-workflow', 'native-project']),
+  route('qwen', TASK_CAPABILITIES.CONVERSATION_CHAT, 'experimental', 'visible-conversation', ['qwen-mode-workspace']),
+  route('perplexity', TASK_CAPABILITIES.CONVERSATION_CHAT, 'experimental', 'visible-conversation', ['workspace-response-citations']),
+  route('zai', TASK_CAPABILITIES.CONVERSATION_CHAT, 'experimental', 'visible-conversation', ['workspace-response-baseline']),
+  route('doubao', TASK_CAPABILITIES.CONVERSATION_CHAT, 'experimental', 'visible-conversation', ['workspace-response-baseline']),
+  route('doubao', TASK_CAPABILITIES.FILE_UPLOAD, 'experimental', 'visible-file-attachment', ['file-selection']),
+] satisfies readonly ProviderTaskCapabilityRoute[])
+
+const DEFINITION_BY_ID = new Map(TASK_CAPABILITY_CATALOG.map((definition) => [definition.id, definition]))
+const ROUTE_BY_KEY = new Map(PROVIDER_TASK_CAPABILITY_ROUTES.map((entry) => [routeKey(entry.provider, entry.capability), entry]))
+
+validateCatalog()
+
+export function listTaskCapabilityDefinitions(): readonly TaskCapabilityDefinition[] {
+  return TASK_CAPABILITY_CATALOG
+}
+
+export function listProviderTaskCapabilityRoutes(
+  capability?: TaskCapabilityId,
+): readonly ProviderTaskCapabilityRoute[] {
+  return capability === undefined
+    ? PROVIDER_TASK_CAPABILITY_ROUTES
+    : Object.freeze(PROVIDER_TASK_CAPABILITY_ROUTES.filter((entry) => entry.capability === capability))
+}
+
+export function taskCapabilityDefinition(value: unknown): TaskCapabilityDefinition | null {
+  return typeof value === 'string'
+    ? DEFINITION_BY_ID.get(value as TaskCapabilityId) ?? null
+    : null
+}
+
+export function normalizeTaskCapabilityRequirements(values: readonly unknown[]): readonly TaskCapabilityId[] {
+  const requested: TaskCapabilityId[] = []
+  for (const value of values) {
+    const normalized = typeof value === 'string' ? value.trim() : ''
+    const definition = taskCapabilityDefinition(normalized)
+    if (!definition) throw new TaskCapabilityRequestError(normalized || String(value))
+    if (!requested.includes(definition.id)) requested.push(definition.id)
+  }
+  return expandImpliedCapabilities(requested)
+}
+
+export function resolveTaskCapabilityRoute(options: {
+  requirements: readonly TaskCapabilityId[]
+  candidates: readonly TaskCapabilityRouteCandidate[]
+}): TaskCapabilityRouteDecision {
+  const decision = resolveTaskCapabilityRoutes(options)
+  if (!decision.ok) return decision
+  const route = decision.routes[0]
+  if (!route) {
+    throw new Error('Capability route ranking returned no route for a successful decision.')
+  }
+  return Object.freeze({
+    ok: true,
+    route,
+    evaluated: decision.evaluated,
+  })
+}
+
+export function resolveTaskCapabilityRoutes(options: {
+  requirements: readonly TaskCapabilityId[]
+  candidates: readonly TaskCapabilityRouteCandidate[]
+}): TaskCapabilityRoutesDecision {
+  const requirements = expandImpliedCapabilities(options.requirements)
+  const candidates = options.candidates.map((candidate, index) => ({
+    candidate,
+    preferenceRank: normalizedPreferenceRank(candidate.preferenceRank, index),
+  }))
+  const routeCandidates = candidates.flatMap(({ candidate, preferenceRank }) => {
+    const routes = requirements.map((capability) => ROUTE_BY_KEY.get(routeKey(candidate.provider, capability)) ?? null)
+    const missingCapabilities = requirements.filter((_capability, index) => routes[index] === null)
+    const compatible = missingCapabilities.length === 0
+    const matchedRoutes = routes.filter((entry): entry is ProviderTaskCapabilityRoute => entry !== null)
+    const support = !compatible
+      ? null
+      : matchedRoutes.some((entry) => entry.support === 'experimental') ? 'experimental' as const : 'supported' as const
+    const score = !compatible
+      ? null
+      : Object.freeze({
+          runtimeEligibility: runtimeEligibilityScore(candidate.runtimeEligibility),
+          evidenceMaturity: support === 'supported' ? 1 : 0,
+          providerPreference: -preferenceRank,
+        })
+    const route = compatible && candidate.runtimeEligibility !== 'ineligible' && support
+      ? Object.freeze({
+          schema: TASK_CAPABILITY_ROUTE_SCHEMA_ID,
+          provider: candidate.provider,
+          requirements: Object.freeze([...requirements]),
+          strategies: Object.freeze([...new Set(matchedRoutes.map((entry) => entry.strategy))]),
+          support,
+          evidence: Object.freeze([...new Set(matchedRoutes.flatMap((entry) => entry.evidence))]),
+          runtimeEligibility: candidate.runtimeEligibility,
+        } satisfies TaskCapabilityRoute)
+      : null
+    return [{ candidate, missingCapabilities, compatible, support, score, preferenceRank, route }]
+  })
+  const ranked = routeCandidates
+    .filter((entry): entry is typeof entry & { route: TaskCapabilityRoute, score: NonNullable<typeof entry.score> } => (
+      entry.route !== null && entry.score !== null
+    ))
+    .sort((left, right) => compareRouteScore(left.score, right.score))
+  const rankByProvider = new Map(ranked.map((entry, index) => [entry.candidate.provider, index + 1]))
+  const evaluated = routeCandidates.map((entry) => Object.freeze({
+    provider: entry.candidate.provider,
+    runtimeEligibility: entry.candidate.runtimeEligibility,
+    compatible: entry.compatible,
+    missingCapabilities: Object.freeze(entry.missingCapabilities),
+    support: entry.support,
+    rank: rankByProvider.get(entry.candidate.provider) ?? null,
+    score: entry.score,
+    reason: !entry.compatible
+      ? 'capability_not_e2e_closed'
+      : (entry.candidate.runtimeEligibility === 'ineligible'
+          ? entry.candidate.reason ?? 'provider_runtime_ineligible'
+          : null),
+  } satisfies TaskCapabilityRouteEvaluation))
+
+  if (ranked.length > 0) {
+    return Object.freeze({
+      ok: true,
+      routes: Object.freeze(ranked.map((entry) => entry.route)),
+      evaluated: Object.freeze(evaluated),
+    })
+  }
+
+  return Object.freeze({
+    ok: false,
+    code: 'task_capability_route_unavailable',
+    message: requirements.length === 0
+      ? 'No provider is currently eligible for this request.'
+      : `No provider can satisfy all required task capabilities: ${requirements.join(', ')}.`,
+    requirements: Object.freeze([...requirements]),
+    evaluated: Object.freeze(evaluated),
+  })
+}
+
+function normalizedPreferenceRank(value: number | undefined, fallback: number) {
+  return typeof value === 'number' && Number.isInteger(value) && value >= 0 ? value : fallback
+}
+
+function runtimeEligibilityScore(value: TaskCapabilityRouteCandidate['runtimeEligibility']) {
+  if (value === 'eligible') return 2
+  if (value === 'unchecked') return 1
+  return 0
+}
+
+function compareRouteScore(
+  left: NonNullable<TaskCapabilityRouteEvaluation['score']>,
+  right: NonNullable<TaskCapabilityRouteEvaluation['score']>,
+) {
+  return right.runtimeEligibility - left.runtimeEligibility ||
+    right.evidenceMaturity - left.evidenceMaturity ||
+    right.providerPreference - left.providerPreference
+}
+
+export function validateTaskCapabilityRoute(
+  value: unknown,
+  expectedProvider?: ProviderId,
+): TaskCapabilityRoute {
+  if (!isPlainRecord(value)) throw new TypeError('Task capability route must be an object.')
+  const keys = [
+    'schema',
+    'provider',
+    'requirements',
+    'strategies',
+    'support',
+    'evidence',
+    'runtimeEligibility',
+  ]
+  if (!hasExactKeys(value, keys)) throw new TypeError(`Task capability route requires exact keys: ${keys.join(', ')}.`)
+  if (value.schema !== TASK_CAPABILITY_ROUTE_SCHEMA_ID || !isProviderIdSyntax(value.provider)) {
+    throw new TypeError('Task capability route identity is invalid.')
+  }
+  if (expectedProvider !== undefined && value.provider !== expectedProvider) {
+    throw new TypeError('Task capability route provider does not match the job provider.')
+  }
+  if (!Array.isArray(value.requirements)) throw new TypeError('Task capability route requirements must be an array.')
+  const rawRequirements = value.requirements
+  const requirements = normalizeTaskCapabilityRequirements(rawRequirements)
+  if (
+    requirements.length !== rawRequirements.length ||
+    requirements.some((capability, index) => capability !== rawRequirements[index])
+  ) {
+    throw new TypeError('Task capability route requirements must be normalized and implication-complete.')
+  }
+  if (
+    value.runtimeEligibility !== 'eligible' &&
+    value.runtimeEligibility !== 'ineligible' &&
+    value.runtimeEligibility !== 'unchecked'
+  ) {
+    throw new TypeError('Task capability route runtime eligibility is invalid.')
+  }
+  const decision = resolveTaskCapabilityRoute({
+    requirements,
+    candidates: [{
+      provider: value.provider,
+      runtimeEligibility: value.runtimeEligibility,
+    }],
+  })
+  if (!decision.ok || !sameTaskCapabilityRoute(decision.route, value)) {
+    throw new TypeError('Task capability route does not match the declared provider matrix.')
+  }
+  return decision.route
+}
+
+function defineCapability(
+  definition: Omit<TaskCapabilityDefinition, 'parametersSchema' | 'implies' | 'composesWith' | 'conflictsWith' | 'stability'> &
+    Partial<Pick<TaskCapabilityDefinition, 'parametersSchema' | 'implies' | 'composesWith' | 'conflictsWith' | 'stability'>>,
+): TaskCapabilityDefinition {
+  return Object.freeze({
+    ...definition,
+    parametersSchema: definition.parametersSchema ?? EMPTY_PARAMETERS_SCHEMA,
+    sideEffects: Object.freeze([...definition.sideEffects]),
+    implies: Object.freeze([...(definition.implies ?? [])]),
+    composesWith: Object.freeze([...(definition.composesWith ?? [])]),
+    conflictsWith: Object.freeze([...(definition.conflictsWith ?? [])]),
+    requiredEvidence: Object.freeze([...definition.requiredEvidence]),
+    outputKinds: Object.freeze([...definition.outputKinds]),
+    stability: definition.stability ?? 'candidate',
+  })
+}
+
+function inputCapability(id: TaskCapabilityId, title: string, description: string) {
+  return defineCapability({
+    id,
+    title,
+    description,
+    family: 'input',
+    lifecycle: 'immediate',
+    sideEffects: ['upload_content'],
+    requiredEvidence: ['visible_provider_input_acceptance'],
+    outputKinds: [],
+  })
+}
+
+function reasoningCapability(id: TaskCapabilityId, title: string, description: string) {
+  return defineCapability({
+    id,
+    title,
+    description,
+    family: 'retrieval_reasoning',
+    lifecycle: 'interactive',
+    sideEffects: ['submit_prompt'],
+    requiredEvidence: ['visible_strategy_execution', 'correlated_visible_response'],
+    outputKinds: ['text'],
+  })
+}
+
+function generationCapability(
+  id: TaskCapabilityId,
+  title: string,
+  subject: string,
+  outputKind: TaskCapabilityOutputKind,
+  lifecycle: TaskCapabilityLifecycle = 'interactive',
+) {
+  return defineCapability({
+    id,
+    title,
+    description: `Produce a completed provider-native ${subject} artifact.`,
+    family: outputKind === 'image' || outputKind === 'audio' || outputKind === 'video'
+      ? 'media_generation'
+      : 'artifact_generation',
+    parametersSchema: objectParameters({
+      format: { type: 'string', minLength: 1, maxLength: 40 },
+    }),
+    lifecycle,
+    sideEffects: ['submit_prompt', 'generate_artifact', 'persist_provider_state'],
+    requiredEvidence: ['completed_visible_artifact', 'bounded_artifact_reference'],
+    outputKinds: [outputKind],
+  })
+}
+
+function objectParameters(
+  properties: Readonly<Record<string, unknown>>,
+  required: readonly string[] = [],
+): JsonSchema {
+  return Object.freeze({
+    type: 'object',
+    additionalProperties: false,
+    properties: Object.freeze({ ...properties }),
+    ...(required.length === 0 ? {} : { required: Object.freeze([...required]) }),
+  })
+}
+
+function enumProperty(values: readonly string[]) {
+  return Object.freeze({ type: 'string', enum: Object.freeze([...values]) })
+}
+
+function route(
+  provider: ProviderId,
+  capability: TaskCapabilityId,
+  support: ProviderTaskCapabilityRoute['support'],
+  strategy: string,
+  evidence: readonly string[],
+): ProviderTaskCapabilityRoute {
+  return Object.freeze({
+    provider,
+    capability,
+    support,
+    strategy,
+    evidence: Object.freeze([...evidence]),
+  })
+}
+
+function routeKey(provider: ProviderId, capability: TaskCapabilityId) {
+  return `${provider}:${capability}`
+}
+
+function expandImpliedCapabilities(input: readonly TaskCapabilityId[]) {
+  const expanded: TaskCapabilityId[] = []
+  const visit = (capability: TaskCapabilityId) => {
+    if (expanded.includes(capability)) return
+    const definition = DEFINITION_BY_ID.get(capability)
+    if (!definition) throw new TaskCapabilityRequestError(capability)
+    expanded.push(capability)
+    for (const implied of definition.implies) visit(implied)
+  }
+  for (const capability of input) visit(capability)
+  return Object.freeze(expanded)
+}
+
+function validateCatalog() {
+  if (DEFINITION_BY_ID.size !== TASK_CAPABILITY_CATALOG.length) {
+    throw new Error('Task capability catalog contains duplicate ids.')
+  }
+  for (const definition of TASK_CAPABILITY_CATALOG) {
+    for (const implied of definition.implies) {
+      if (!DEFINITION_BY_ID.has(implied)) {
+        throw new Error(`Task capability ${definition.id} implies unknown capability ${implied}.`)
+      }
+    }
+  }
+  if (ROUTE_BY_KEY.size !== PROVIDER_TASK_CAPABILITY_ROUTES.length) {
+    throw new Error('Provider task capability matrix contains duplicate routes.')
+  }
+  for (const entry of PROVIDER_TASK_CAPABILITY_ROUTES) {
+    if (!isProviderIdSyntax(entry.provider) || !DEFINITION_BY_ID.has(entry.capability)) {
+      throw new Error('Provider task capability route identity is invalid.')
+    }
+    if (entry.evidence.length === 0 || !entry.strategy) {
+      throw new Error(`Provider task capability route ${routeKey(entry.provider, entry.capability)} lacks evidence.`)
+    }
+  }
+}
+
+function hasExactKeys(value: Record<string, unknown>, keys: readonly string[]) {
+  const actual = Object.keys(value).sort()
+  const expected = [...keys].sort()
+  return actual.length === expected.length && actual.every((key, index) => key === expected[index])
+}
+
+function isPlainRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value && typeof value === 'object' && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype)
+}
+
+function sameTaskCapabilityRoute(expected: TaskCapabilityRoute, actual: Record<string, unknown>) {
+  return actual.schema === expected.schema &&
+    actual.provider === expected.provider &&
+    actual.support === expected.support &&
+    actual.runtimeEligibility === expected.runtimeEligibility &&
+    sameStringArray(actual.requirements, expected.requirements) &&
+    sameStringArray(actual.strategies, expected.strategies) &&
+    sameStringArray(actual.evidence, expected.evidence)
+}
+
+function sameStringArray(actual: unknown, expected: readonly string[]) {
+  return Array.isArray(actual) &&
+    actual.length === expected.length &&
+    actual.every((value, index) => value === expected[index])
+}
diff --git a/packages/cli/src/providers/zai-provider.ts b/packages/cli/src/providers/zai-provider.ts
new file mode 100644
index 0000000..f8906dd
--- /dev/null
+++ b/packages/cli/src/providers/zai-provider.ts
@@ -0,0 +1,76 @@
+import { MenuTextAccountInspector } from './account-inspectors.js'
+import { BaseProvider } from './base-provider.js'
+import {
+  DEFAULT_CHOICE_AVAILABILITY,
+  defineDescriptor,
+  defineProvider,
+  providerCapabilities,
+} from './provider-definition.js'
+import { PROVIDER_NAVIGATION_CATALOG } from './provider-navigation-catalog.js'
+
+export class ZaiProvider extends BaseProvider<'zai'> {
+  constructor() {
+    const descriptor = defineDescriptor({
+      id: 'zai',
+      label: 'Z.ai / GLM',
+      stage: 'experimental',
+      setupOrder: 7,
+      protocolCompatibility: Object.freeze({
+        legacyRequests: false,
+      }),
+      navigation: PROVIDER_NAVIGATION_CATALOG.zai,
+      profileImport: Object.freeze({
+        cookieDomains: Object.freeze(['z.ai']),
+      }),
+      controls: Object.freeze({
+        chatSurface: false,
+      }),
+    })
+    const provider = defineProvider({
+      descriptor,
+      access: Object.freeze({
+        guest: 'supported',
+        guestContinueControlNames: Object.freeze(['Skip for now']),
+      }),
+      account: Object.freeze({
+        inspector: new MenuTextAccountInspector(),
+        freePlanLabels: Object.freeze([]),
+        paidPlanLabels: Object.freeze([]),
+      }),
+      composerSelectors: Object.freeze([
+        '#chat-input[placeholder="How can I help you today?"]',
+      ]),
+      submitSelectors: Object.freeze([
+        'button.sendMessageButton[type="submit"]',
+      ]),
+      answerSelectors: Object.freeze([
+        '.chat-assistant.markdown-prose',
+      ]),
+      fileInputSelectors: Object.freeze([]),
+      fileUploadTriggerSelectors: Object.freeze([]),
+      fileUploadLocalSelectors: Object.freeze([]),
+      modelControlSelectors: Object.freeze([]),
+      effortControlSelectors: Object.freeze([]),
+      authIndicators: Object.freeze([]),
+      loginIndicators: Object.freeze([
+        'button:has-text("Continue with Google")',
+        'button:has-text("Continue with Email")',
+        'button:has-text("Continue with Github")',
+      ]),
+      blockerSelectors: Object.freeze([
+        'iframe[src*="recaptcha" i]',
+        'iframe[src*="hcaptcha.com" i]',
+        'iframe[src*="challenges.cloudflare.com" i]',
+        'text=/rate limit|too many requests/i',
+        'text=/service unavailable|server is busy/i',
+        'text=/upgrade required|upgrade your plan/i',
+      ]),
+      busySelectors: Object.freeze([
+        'div[class*="message-"]:has(.chat-assistant.markdown-prose):not(:has(button.regenerate-response-button))',
+      ]),
+      choiceAvailability: DEFAULT_CHOICE_AVAILABILITY,
+      capabilities: providerCapabilities(),
+    })
+    super(provider)
+  }
+}
diff --git a/packages/cli/src/runtime.ts b/packages/cli/src/runtime.ts
index e5d7781..b83ad8f 100644
--- a/packages/cli/src/runtime.ts
+++ b/packages/cli/src/runtime.ts
@@ -1,57 +1,79 @@
 import { spawn } from 'node:child_process'
-import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto'
+import { randomBytes, timingSafeEqual } from 'node:crypto'
 import fsSync from 'node:fs'
 import fs from 'node:fs/promises'
-import os from 'node:os'
+import net from 'node:net'
 import path from 'node:path'
+import { fileURLToPath } from 'node:url'
 
 import {
-  NATIVE_HOST_NAME,
-  nativeMessagingHostDirs,
   normalizeBrowserId,
   snapshotsDir,
   tokenlessHome,
 } from './job-store.js'
-import { daemonUrl as normalizeDaemonUrl, readDaemonToken } from './daemon-client.js'
-import { resolveNativePlatformPackage, tokenlessPackageVersion } from './platform-package.js'
-
-export const EXTENSION_BRIDGE_PROTOCOL = 'tokenless.extension-bridge-state.v1'
-export const DAEMON_PROTOCOL = 'tokenless.daemon.v1'
-export const NATIVE_PROTOCOL = 'tokenless.native.v1'
-export const DAEMON_PROCESS_PROTOCOL = 'tokenless.daemon-process.v1'
-export const DAEMON_READY_PROOF_PROTOCOL = 'tokenless.daemon-ready-proof.v1'
-export const DAEMON_PROCESS_PROOF_PROTOCOL = 'tokenless.daemon-process-proof.v1'
-export const EXTENSION_BRIDGE_FILE = 'extension-bridge.json'
+import { daemonUrl as normalizeDaemonUrl, readDaemonToken, shutdownDaemon } from './daemon-client.js'
+import { getProviderInstanceById, getProviderInstanceForUrl, listProviderDescriptors } from './providers/registry.js'
+import {
+  DAEMON_PROCESS_SCHEMA_ID,
+  DAEMON_SNAPSHOT_SCHEMA_ID,
+} from './schema-ids.js'
+import { tokenlessPackageVersion } from './platform-package.js'
+import { daemonReadyProof } from './daemon/ready-proof.js'
+import { BrowserRuntimeManager } from './browser-runtime/manager.js'
+import {
+  DaemonRuntimeState,
+  createStartupOwnerToken,
+  type DaemonRuntimeEndpoint,
+} from './daemon/runtime-state.js'
+
+export {
+  DAEMON_PROCESS_SCHEMA_ID,
+  DAEMON_SNAPSHOT_SCHEMA_ID,
+  MANAGED_PLAYWRIGHT_JOB_SCHEMA_ID,
+  MANAGED_PLAYWRIGHT_JOB_SCHEMA_ID_V3,
+  VISIBLE_ACTION_SCHEMA_ID,
+  VISIBLE_ACTION_SCHEMA_ID_V3,
+} from './schema-ids.js'
 export const DAEMON_PID_FILE = 'daemon.pid.json'
 export const DAEMON_LOG_FILE = 'daemon.log'
-export const NATIVE_BINARY_BUILD_INFO_PROTOCOL = 'tokenless.native-binary-build-info.v1'
 
-const DAEMON_BINARY_NAME = 'tokenless-daemon'
-const NATIVE_HOST_BINARY_NAME = 'tokenless-native-host'
-const DEFAULT_BRIDGE_MAX_AGE_MS = 15_000
-const BRIDGE_CLOCK_TOLERANCE_MS = 5_000
+const DAEMON_ENTRY_NAME = 'daemon-entry.mjs'
 const DEFAULT_DAEMON_START_TIMEOUT_MS = 10_000
+const DEFAULT_DAEMON_STOP_TIMEOUT_MS = 5_000
+const MAX_TIMEOUT_MS = 2_147_483_647
 const BUILD_INFO_TIMEOUT_MS = 2_000
 const BUILD_INFO_OUTPUT_LIMIT_BYTES = 16_384
-const SUPPORTED_PROVIDERS = new Set(['chatgpt', 'claude', 'gemini', 'grok'])
 
 type RuntimeError = Error & {
   code?: string
   retryable?: boolean
+  status?: number
 }
 
 type JsonRecord = Record<string, any>
 
-export type DaemonReadyProbe = {
-  ok: boolean
+type DaemonReadyProbeBase = {
   reachable: boolean
   url: string
   expectedHome: string
-  actualHome?: string | undefined
   body?: JsonRecord | undefined
+}
+
+export type DaemonReadyProbe = (DaemonReadyProbeBase & {
+  ok: true
+  reachable: true
+  actualHome: string
+  identityVerified: true
+  sameHomeVerified: true
+  body: JsonRecord
+}) | (DaemonReadyProbeBase & {
+  ok: false
+  actualHome?: string | undefined
+  identityVerified?: boolean | undefined
+  sameHomeVerified?: boolean | undefined
   code?: string | undefined
   message?: string | undefined
-}
+})
 
 export type ManagedRuntimeInspection = {
   ok: boolean
@@ -66,31 +88,14 @@ export type ManagedRuntimeInspection = {
     error?: string | null | undefined
     code?: string | undefined
   }
-  packaged: {
-    ok: boolean
-    path: string | null
-    hash: string | null
-    buildInfo: JsonRecord | null
-    error: string | null
-    code?: string | undefined
-  }
-  installed: {
+  daemon: {
     ok: boolean
     path: string
-    hash: string | null
     executable: boolean
-    matchesBundled: boolean
     buildInfo: JsonRecord | null
     error: string | null
     code?: string | undefined
   }
-  daemon: {
-    ok: boolean
-    path: string
-    hash: string | null
-    bundledHash: string | null
-    matchesBundled: boolean
-  }
 }
 
 export type ChromiumBrowser = {
@@ -107,70 +112,29 @@ export type EnsureDaemonOptions = {
   binaryPath?: string | undefined
   bundledRoot?: string | undefined
   timeoutMs?: number | undefined
+  requiredProvider?: string | undefined
 }
 
-export type BridgeMarker = {
-  path: string
-  protocol: string
-  pid: number
-  sessionId: string
-  connectedAt: string
-  heartbeatAt: string
-  heartbeatAgeMs: number
-  raw: JsonRecord
-}
-
-export type InstallRustRuntimeOptions = {
-  homeDir?: string | undefined
-  packageRoot?: string | undefined
-  platform?: NodeJS.Platform | undefined
-  arch?: string | undefined
-}
-
-export function bundledRustBinaryPath(
-  name: string = DAEMON_BINARY_NAME,
-  packageRoot?: string,
-  platform: NodeJS.Platform = process.platform,
-  arch: string = process.arch
-) {
-  const nativeRoot = packageRoot ?? resolveNativePlatformPackage({ platform, arch }).root
-  return path.join(nativeRoot, 'bin', executableName(name, platform))
+export type StopDaemonResult = {
+  ok: true
+  status: 'not_running' | 'stopped'
+  url: string
+  homeDir: string
+  pid?: number | undefined
+  response?: JsonRecord | undefined
+  compactOutput: string
 }
 
-export function installedRustBinaryPath(
-  homeDir = tokenlessHome(),
-  name: string = DAEMON_BINARY_NAME,
-  platform: NodeJS.Platform = process.platform
-) {
-  return path.join(homeDir, 'bin', executableName(name, platform))
+export type SetupDaemonReadyResult = Awaited<ReturnType<typeof ensureDaemonReady>> & {
+  expectedVersion: string
+  expectedMajor: number | null
+  runningVersion: string | null
+  runningMajor: number | null
+  versionCompatible: boolean
 }
 
-export async function resolveDaemonBinary({
-  homeDir = tokenlessHome(),
-  binaryPath,
-  bundledRoot,
-}: Pick<EnsureDaemonOptions, 'homeDir' | 'binaryPath' | 'bundledRoot'> = {}) {
-  const candidates = [
-    binaryPath,
-    installedRustBinaryPath(homeDir, DAEMON_BINARY_NAME),
-  ].filter((candidate): candidate is string => Boolean(candidate))
-
-  for (const candidate of candidates) {
-    if (await isExecutable(candidate)) return path.resolve(candidate)
-  }
-  let bundledError: unknown
-  try {
-    const bundled = bundledRustBinaryPath(DAEMON_BINARY_NAME, bundledRoot)
-    candidates.push(bundled)
-    if (await isExecutable(bundled)) return path.resolve(bundled)
-  } catch (error) {
-    bundledError = error
-  }
-  throw runtimeError(
-    'daemon_binary_missing',
-    `Tokenless Rust daemon is not installed. Reinstall tokenless with optional dependencies enabled, then run "tokenless setup" or "tokenless doctor". Checked: ${candidates.join(', ')}${bundledError instanceof Error ? `. ${bundledError.message}` : ''}`,
-    false
-  )
+export function bundledTypeScriptDaemonEntryPath(packageRoot?: string) {
+  return path.join(packageRoot ?? cliPackageRoot(), 'dist', 'src', 'daemon', DAEMON_ENTRY_NAME)
 }
 
 export async function probeDaemonReady({
@@ -229,7 +193,7 @@ export async function probeDaemonReady({
     }
   }
 
-  if (!response.ok || body?.ready !== true) {
+  if (!response.ok) {
     return {
       ok: false,
       reachable: true,
@@ -237,7 +201,7 @@ export async function probeDaemonReady({
       expectedHome,
       body,
       code: 'daemon_not_ready',
-      message: `Tokenless daemon /ready returned HTTP ${response.status} without ready=true.`,
+      message: `Tokenless daemon /ready returned HTTP ${response.status}.`,
     }
   }
 
@@ -248,68 +212,87 @@ export async function probeDaemonReady({
       reachable: true,
       url,
       expectedHome,
+      identityVerified: false,
       body,
       code: proofError.code,
       message: proofError.message,
     }
   }
+  const identityVerified = true
 
-  const processProofError = validateDaemonProcessProof(body, readyChallenge, proofToken)
-  if (processProofError) {
-    body.daemon_process_identity_error = processProofError
-  }
-
-  if (body.daemon_protocol !== DAEMON_PROTOCOL) {
+  const readyHome = readyHomeFromBody(body)
+  if (!readyHome) {
     return {
       ok: false,
       reachable: true,
       url,
       expectedHome,
+      identityVerified,
+      sameHomeVerified: false,
       body,
-      code: 'daemon_protocol_mismatch',
-      message: `Tokenless daemon protocol is ${String(body.daemon_protocol ?? 'missing')}; expected ${DAEMON_PROTOCOL}. Reinstall Tokenless before running jobs.`,
+      code: 'daemon_identity_missing',
+      message: 'Tokenless daemon /ready did not identify its home directory.',
     }
   }
-
-  if (body.native_protocol !== NATIVE_PROTOCOL) {
+  const actualHome = await canonicalPath(readyHome)
+  if (actualHome !== expectedHome) {
     return {
       ok: false,
       reachable: true,
       url,
       expectedHome,
+      actualHome,
+      identityVerified,
+      sameHomeVerified: false,
       body,
-      code: 'native_protocol_mismatch',
-      message: `Tokenless native protocol is ${String(body.native_protocol ?? 'missing')}; expected ${NATIVE_PROTOCOL}. Reinstall Tokenless before running jobs.`,
+      code: 'daemon_home_mismatch',
+      message: `Daemon at ${url} uses ${actualHome}, not requested Tokenless home ${expectedHome}.`,
     }
   }
+  const sameHomeVerified = true
 
-  const readyHome = readyHomeFromBody(body)
-  if (!readyHome) {
+  const expectedVersion = tokenlessPackageVersion()
+  const runningVersion = typeof body.version === 'string' ? body.version : null
+  if (runningVersion !== expectedVersion) {
     return {
       ok: false,
       reachable: true,
       url,
       expectedHome,
+      actualHome,
+      identityVerified,
+      sameHomeVerified,
       body,
-      code: 'daemon_identity_missing',
-      message: 'Tokenless daemon /ready did not identify its home directory.',
+      code: 'daemon_version_mismatch',
+      message: `Tokenless daemon version is ${runningVersion ?? 'missing'}; expected ${expectedVersion}.`,
     }
   }
-  const actualHome = await canonicalPath(readyHome)
-  if (actualHome !== expectedHome) {
+
+  if (body.ready !== true) {
     return {
       ok: false,
       reachable: true,
       url,
       expectedHome,
       actualHome,
+      identityVerified,
+      sameHomeVerified,
       body,
-      code: 'daemon_home_mismatch',
-      message: `Daemon at ${url} uses ${actualHome}, not requested Tokenless home ${expectedHome}.`,
+      code: 'daemon_not_ready',
+      message: 'Tokenless daemon /ready did not report ready=true.',
     }
   }
 
-  return { ok: true, reachable: true, url, expectedHome, actualHome, body }
+  return {
+    ok: true,
+    reachable: true,
+    url,
+    expectedHome,
+    actualHome,
+    identityVerified,
+    sameHomeVerified,
+    body,
+  }
 }
 
 export async function ensureDaemonReady({
@@ -318,81 +301,124 @@ export async function ensureDaemonReady({
   binaryPath,
   bundledRoot,
   timeoutMs = envNumber('TOKENLESS_DAEMON_START_TIMEOUT_MS', DEFAULT_DAEMON_START_TIMEOUT_MS),
+  requiredProvider,
 }: EnsureDaemonOptions = {}) {
+  assertLocalProviderSupport(requiredProvider)
   await fs.mkdir(homeDir, { recursive: true, mode: 0o700 })
-  const initial = await probeDaemonReady({ daemonUrl, homeDir })
-  if (initial.ok) {
-    const coherence = await ensureRunningDaemonVersionCoherent(initial, { homeDir, bundledRoot, skipInstalledRuntime: Boolean(binaryPath) })
-    if (coherence.ok) return { ...initial, started: false, binaryPath: null, pid: daemonPidFromReady(initial) ?? await readDaemonPid(homeDir) }
-  } else {
-    assertNoDaemonIdentityConflict(initial)
-  }
-
-  const releaseLock = await acquireDaemonStartLock({ homeDir, timeoutMs })
-  let refreshed: string[] = []
+  const preferredUrl = normalizeDaemonUrl(daemonUrl)
+  const runtimeState = await DaemonRuntimeState.open(homeDir)
+  const ownerToken = createStartupOwnerToken()
+  const deadline = Date.now() + timeoutMs
+  let acquiredStartup = false
+  let startupGeneration: number | undefined
   try {
-    const afterLock = await probeDaemonReady({ daemonUrl, homeDir })
-    if (afterLock.ok) {
-      const coherence = await ensureRunningDaemonVersionCoherent(afterLock, { homeDir, bundledRoot, skipInstalledRuntime: Boolean(binaryPath) })
-      if (coherence.ok) {
-        return { ...afterLock, started: false, binaryPath: null, pid: daemonPidFromReady(afterLock) ?? await readDaemonPid(homeDir) }
+    const initial = await probeDaemonEndpointCandidates({ runtimeState, preferredUrl, homeDir })
+    if (initial.ready) {
+      return daemonReadyResult(initial.ready, false, null, await readDaemonPid(homeDir))
+    }
+    if (initial.replaceable) {
+      await stopDaemon({ homeDir, daemonUrl: initial.replaceable.url, timeoutMs })
+    }
+
+    while (!acquiredStartup) {
+      const beforeAcquire = await probeDaemonEndpointCandidates({ runtimeState, preferredUrl, homeDir })
+      if (beforeAcquire.ready) {
+        return daemonReadyResult(beforeAcquire.ready, false, null, await readDaemonPid(homeDir))
+      }
+      if (beforeAcquire.replaceable) {
+        await stopDaemon({ homeDir, daemonUrl: beforeAcquire.replaceable.url, timeoutMs })
+      }
+      const lease = runtimeState.tryAcquireStartupLease({
+        ownerToken,
+        leaseMs: Math.max(1_000, Math.min(timeoutMs, DEFAULT_DAEMON_START_TIMEOUT_MS)),
+        ...(beforeAcquire.failedRunningEndpoint === null ? {} : { takeoverRunning: beforeAcquire.failedRunningEndpoint }),
+      })
+      if (lease.acquired) {
+        acquiredStartup = true
+        startupGeneration = lease.lease?.generation
+        break
+      }
+      if (Date.now() >= deadline) {
+        throw runtimeError(
+          'daemon_start_locked',
+          `Timed out waiting for another Tokenless daemon startup in ${homeDir}.`,
+          true
+        )
       }
-      await stopOwnedDaemonForRefresh({ probe: afterLock, homeDir, reason: coherence.message ?? 'Tokenless daemon runtime is not coherent.' })
-    } else {
-      assertNoDaemonIdentityConflict(afterLock)
+      await delay(Math.min(100, Math.max(1, deadline - Date.now())))
     }
 
-    if (!binaryPath) {
-      refreshed = await refreshInstalledManagedRuntime({ homeDir, packageRoot: bundledRoot })
+    const afterLease = await probeDaemonEndpointCandidates({ runtimeState, preferredUrl, homeDir })
+    if (afterLease.ready) {
+      return daemonReadyResult(afterLease.ready, false, null, await readDaemonPid(homeDir))
     }
-    const executable = await resolveDaemonBinary({ homeDir, binaryPath, bundledRoot })
-    const parsedUrl = new URL(normalizeDaemonUrl(daemonUrl))
+    if (afterLease.replaceable) {
+      await stopDaemon({ homeDir, daemonUrl: afterLease.replaceable.url, timeoutMs })
+    }
+
+    const daemonEntryPath = binaryPath ?? bundledTypeScriptDaemonEntryPath(bundledRoot)
+    await assertDaemonEntryRunnable(daemonEntryPath)
+    const parsedUrl = new URL(preferredUrl)
     const host = daemonBindHost(parsedUrl.hostname)
     const port = parsedUrl.port ? Number(parsedUrl.port) : 80
     const logPath = path.join(homeDir, DAEMON_LOG_FILE)
-    const child = await spawnDaemon({ executable, homeDir, host, port, logPath })
+    if (startupGeneration === undefined) {
+      throw runtimeError('daemon_start_failed', 'Tokenless daemon startup lease did not return a generation.', true)
+    }
+    const child = await spawnDaemon({
+      daemonEntryPath,
+      homeDir,
+      host,
+      port,
+      logPath,
+      startupOwnerToken: ownerToken,
+      startupGeneration,
+    })
     const pidPayload = {
-      protocol: DAEMON_PROCESS_PROTOCOL,
+      protocol: DAEMON_PROCESS_SCHEMA_ID,
       pid: child.pid,
       homeDir: await canonicalPath(homeDir),
       daemonUrl: parsedUrl.origin,
-      binaryPath: executable,
+      binaryPath: process.execPath,
+      daemonEntryPath,
       logPath,
       startedAt: new Date().toISOString(),
     }
     await writeJsonAtomic(path.join(homeDir, DAEMON_PID_FILE), pidPayload, 0o600)
 
     try {
-      const deadline = Date.now() + timeoutMs
-      let lastProbe = afterLock
+      let lastProbe = afterLease.lastProbe
       while (Date.now() < deadline) {
-        lastProbe = await probeDaemonReady({ daemonUrl, homeDir })
-        if (lastProbe.ok) {
-          const coherence = await ensureRunningDaemonVersionCoherent(lastProbe, { homeDir, bundledRoot, skipInstalledRuntime: Boolean(binaryPath) })
-          if (!coherence.ok) {
-            throw runtimeError(
-              coherence.code ?? 'daemon_version_mismatch',
-              coherence.message ?? 'Tokenless daemon runtime is not coherent.',
-              false
-            )
+        const candidate = await probeDaemonEndpointCandidates({ runtimeState, preferredUrl, homeDir })
+        if (candidate.ready) {
+          lastProbe = candidate.ready
+          const actualPid = daemonPidFromReady(lastProbe) ?? child.pid
+          const actualUrl = lastProbe.url
+          const actualPidPayload = {
+            ...pidPayload,
+            pid: actualPid,
+            daemonUrl: actualUrl,
           }
+          await writeJsonAtomic(path.join(homeDir, DAEMON_PID_FILE), actualPidPayload, 0o600)
           child.unref()
           return {
             ...lastProbe,
             started: true,
-            binaryPath: executable,
-            pid: child.pid,
+            binaryPath: process.execPath,
+            daemonEntryPath,
+            pid: actualPid,
             logPath,
           }
         }
-        assertNoDaemonIdentityConflict(lastProbe)
+        lastProbe = candidate.lastProbe
         if (child.exitCode !== null) break
         await delay(100)
       }
 
+      const failedProbe = lastProbe && !lastProbe.ok ? lastProbe : null
       throw runtimeError(
         'daemon_start_failed',
-        `Tokenless Rust daemon did not become ready for ${homeDir}. See ${logPath}. Last check: ${lastProbe.message ?? lastProbe.code ?? 'unknown error'}${refreshed?.length ? ' Refreshed managed runtime before start.' : ''}`,
+        `Tokenless TypeScript daemon did not become ready for ${homeDir}. See ${logPath}. Last check: ${failedProbe?.message ?? failedProbe?.code ?? 'unknown error'}`,
         true
       )
     } catch (error) {
@@ -400,196 +426,190 @@ export async function ensureDaemonReady({
       throw error
     }
   } finally {
-    await releaseLock()
+    if (acquiredStartup) runtimeState.releaseStartupLease(ownerToken)
+    runtimeState.close()
   }
 }
 
-export async function readLiveBridgeMarker({
+export async function ensureSetupDaemonRunnable({
   homeDir = tokenlessHome(),
-  maxAgeMs = envNumber('TOKENLESS_BRIDGE_MAX_AGE_MS', DEFAULT_BRIDGE_MAX_AGE_MS),
-}: {
-  homeDir?: string | undefined
-  maxAgeMs?: number | undefined
-} = {}): Promise<BridgeMarker | null> {
-  const candidates = [
-    path.join(homeDir, EXTENSION_BRIDGE_FILE),
-  ]
-  for (const markerPath of candidates) {
-    let parsed: unknown
-    try {
-      parsed = JSON.parse(await fs.readFile(markerPath, 'utf8')) as unknown
-    } catch {
-      continue
-    }
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) continue
-    const payload = parsed as JsonRecord
-    const marker = normalizeBridgeMarker(markerPath, payload, maxAgeMs)
-    if (marker) return marker
+  daemonUrl,
+  timeoutMs = envNumber('TOKENLESS_DAEMON_START_TIMEOUT_MS', DEFAULT_DAEMON_START_TIMEOUT_MS),
+}: Pick<EnsureDaemonOptions, 'homeDir' | 'daemonUrl' | 'timeoutMs'> = {}): Promise<SetupDaemonReadyResult> {
+  const inspection = await inspectManagedRuntime(homeDir)
+  if (!inspection.daemon.ok) {
+    throw runtimeError(
+      inspection.daemon.code ?? inspection.package.code ?? 'daemon_runtime_unavailable',
+      inspection.daemon.error ?? inspection.package.error ?? 'Bundled TypeScript daemon runtime is unavailable.',
+      false
+    )
   }
-  return null
+  return setupDaemonReadyResult(await ensureDaemonReady({ homeDir, daemonUrl, timeoutMs }))
 }
 
-export async function waitForExtensionBridge({
+export async function stopDaemon({
   homeDir = tokenlessHome(),
-  timeoutMs = envNumber('TOKENLESS_BRIDGE_TIMEOUT_MS', 15_000),
-  pollMs = 100,
+  daemonUrl,
+  timeoutMs,
 }: {
   homeDir?: string | undefined
+  daemonUrl?: string | undefined
   timeoutMs?: number | undefined
-  pollMs?: number | undefined
-} = {}) {
-  const deadline = Date.now() + timeoutMs
-  while (Date.now() < deadline) {
-    const marker = await readLiveBridgeMarker({ homeDir })
-    if (marker) return marker
-    await delay(pollMs)
-  }
-  throw runtimeError(
-    'extension_bridge_timeout',
-    `Tokenless opened the provider page, but the local runtime bridge did not become ready within ${timeoutMs} ms. Run "tokenless doctor --json", then rerun "tokenless setup".`,
-    true
-  )
-}
-
-export function providerWakeUrl(provider: unknown, targetUrl?: unknown) {
-  const providerId = typeof provider === 'string' ? provider.trim().toLowerCase() : ''
-  if (!SUPPORTED_PROVIDERS.has(providerId)) {
-    throw runtimeError('unsupported_provider', 'Provider must be one of: chatgpt, claude, gemini, grok.', false)
-  }
-  const homeUrls: Record<string, string> = {
-    chatgpt: 'https://chatgpt.com/',
-    claude: 'https://claude.ai/new',
-    gemini: 'https://gemini.google.com/app',
-    grok: 'https://grok.com/',
+} = {}): Promise<StopDaemonResult> {
+  const stopTimeoutMs = normalizeStopTimeoutMs(timeoutMs)
+  const preferredUrl = normalizeDaemonUrl(daemonUrl)
+  let url = preferredUrl
+  const runtimeState = await DaemonRuntimeState.openIfExists(homeDir)
+  try {
+    if (runtimeState) {
+      const existing = await probeDaemonEndpointCandidates({ runtimeState, preferredUrl, homeDir })
+      if (existing.ready) url = existing.ready.url
+      else if (existing.replaceable) url = existing.replaceable.url
+    }
+  } finally {
+    runtimeState?.close()
   }
-  if (targetUrl === undefined || targetUrl === '') {
-    return homeUrls[providerId] as string
+  const expectedHome = await canonicalPath(homeDir)
+  const reachable = await probeDaemonReachable(url, Math.min(stopTimeoutMs, 1_000))
+  if (!reachable.reachable) {
+    await clearPersistedEndpointIfOwned(homeDir, { url })
+    return {
+      ok: true,
+      status: 'not_running',
+      url,
+      homeDir: expectedHome,
+      compactOutput: `Tokenless daemon is not running at ${url}.`,
+    }
   }
-
-  const parsed = parseProviderWakeTarget(targetUrl)
-  if (!parsed) {
-    throw runtimeError('invalid_provider_url', 'Provider target URL must be a valid HTTPS URL.', false)
+  const token = await readDaemonToken({ homeDir }).catch((error) => {
+    throw runtimeError(
+      'daemon_stop_identity_unverified',
+      `A service is listening at ${url}, but Tokenless cannot read the local daemon token needed to verify it: ${error instanceof Error ? error.message : String(error)} Stop it manually if it is a Tokenless daemon.`,
+      false
+    )
+  })
+  const ready = await probeDaemonReady({ homeDir, daemonUrl: url, daemonToken: token, timeoutMs: Math.min(stopTimeoutMs, 1_000) })
+  const verifiedStoppableMismatch = !ready.ok && ready.code === 'daemon_version_mismatch'
+  if (!ready.ok && !verifiedStoppableMismatch) {
+    const stillReachable = await probeDaemonReachable(url, Math.min(stopTimeoutMs, 1_000))
+    if (ready.code === 'daemon_unavailable' && !stillReachable.reachable) {
+      return {
+        ok: true,
+        status: 'not_running',
+        url,
+        homeDir: expectedHome,
+        compactOutput: `Tokenless daemon is not running at ${url}.`,
+      }
+    }
+    throw runtimeError(
+      'daemon_stop_identity_unverified',
+      `${ready.message ?? 'Tokenless daemon identity could not be verified.'} Tokenless did not send the control token or stop any process. Stop the service bound to ${url} manually if needed.`,
+      false
+    )
   }
-  const allowedHosts: Record<string, Set<string>> = {
-    chatgpt: new Set(['chatgpt.com', 'chat.openai.com']),
-    claude: new Set(['claude.ai']),
-    gemini: new Set(['gemini.google.com']),
-    grok: new Set(['grok.com']),
+  let response: JsonRecord
+  try {
+    response = await shutdownDaemon({
+      daemonUrl: url,
+      requestTimeoutMs: stopTimeoutMs,
+      controlToken: token,
+    }) as JsonRecord
+  } catch (error) {
+    const status = typeof (error as RuntimeError).status === 'number' ? (error as RuntimeError).status : undefined
+    if (status === 404 || status === 405) {
+      throw runtimeError(
+        'daemon_shutdown_unsupported',
+        `The verified daemon at ${url} does not support bearer-authenticated self-shutdown. Tokenless did not stop any process. Upgrade Tokenless or stop daemon pid ${daemonPidFromReady(ready) ?? '<unknown>'} manually.`,
+        false
+      )
+    }
+    throw error
   }
-  if (
-    !allowedHosts[providerId]?.has(parsed.hostname.toLowerCase())
-  ) {
+  if (response.ok !== true || response.status !== 'shutting_down') {
     throw runtimeError(
-      'invalid_provider_url',
-      `Target URL must use HTTPS and belong to the selected ${providerId} provider.`,
+      'daemon_shutdown_unconfirmed',
+      `The verified daemon at ${url} returned an invalid graceful-shutdown acknowledgement. Tokenless did not kill any process.`,
       false
     )
   }
-  return parsed.href
-}
-
-const FORBIDDEN_PROVIDER_URL_INPUT = /[\\\u0000-\u001f\u007f\s]|%(?:00|0[1-9a-f]|1[0-9a-f]|20|23|25|2f|3f|5c|7f)/i
-const MALFORMED_PROVIDER_URL_ESCAPE = /%(?![0-9a-f]{2})/i
-
-function parseProviderWakeTarget(value: unknown) {
-  if (
-    typeof value !== 'string' ||
-    value === '' ||
-    value.trim() !== value ||
-    value.includes('?') ||
-    value.includes('#') ||
-    FORBIDDEN_PROVIDER_URL_INPUT.test(value) ||
-    MALFORMED_PROVIDER_URL_ESCAPE.test(value)
-  ) {
-    return null
-  }
-  let parsed: URL
-  try {
-    parsed = new URL(value)
-  } catch {
-    return null
+  const pid = typeof response.pid === 'number' && Number.isSafeInteger(response.pid) && response.pid > 0
+    ? response.pid
+    : daemonPidFromReady(ready) ?? undefined
+  const stopped = await waitForDaemonListenerGone(url, stopTimeoutMs)
+  if (!stopped) {
+    throw runtimeError(
+      'daemon_shutdown_unconfirmed',
+      `The verified daemon at ${url} accepted graceful shutdown, but the loopback listener was still reachable after ${stopTimeoutMs}ms. Tokenless did not kill any process. Stop daemon pid ${pid ?? '<unknown>'} manually if needed.`,
+      true
+    )
   }
-  if (
-    parsed.protocol !== 'https:' ||
-    parsed.username !== '' ||
-    parsed.password !== '' ||
-    parsed.port !== '' ||
-    parsed.search !== '' ||
-    parsed.hash !== ''
-  ) {
-    return null
+  if (pid !== undefined) await removePidIfOwned(ready.actualHome ?? expectedHome, pid)
+  await clearPersistedEndpointIfOwned(homeDir, { url, pid })
+  return {
+    ok: true,
+    status: 'stopped',
+    url,
+    homeDir: ready.actualHome ?? expectedHome,
+    ...(pid === undefined ? {} : { pid }),
+    response,
+    compactOutput: `Tokenless daemon stopped at ${url}${pid === undefined ? '' : ` (pid ${pid})`}.`,
   }
-  const rawAuthority = providerUrlAuthority(value)
-  if (!rawAuthority || rawAuthority.toLowerCase() !== parsed.hostname.toLowerCase()) return null
-  return parsed
 }
 
-function providerUrlAuthority(value: string) {
-  const scheme = value.indexOf('://')
-  if (scheme < 0 || value.slice(0, scheme).toLowerCase() !== 'https') return ''
-  const start = scheme + 3
-  const relativeEnd = value.slice(start).search(/[/?#]/)
-  return relativeEnd < 0 ? value.slice(start) : value.slice(start, start + relativeEnd)
+export function providerWakeUrl(provider: unknown, targetUrl?: unknown) {
+  const providerId = typeof provider === 'string' ? provider.trim().toLowerCase() : ''
+  const providerInstance = getProviderInstanceById(providerId)
+  if (!providerInstance) {
+    throw runtimeError('unsupported_provider', `Provider must be one of: ${supportedVisibleProviderList()}.`, false)
+  }
+  const target = providerInstance.navigation.canonicalTarget(targetUrl)
+  if (!target) {
+    throw runtimeError(
+      'invalid_provider_url',
+      `Target URL must use HTTPS and belong to the selected ${providerId} provider.`,
+      false
+    )
+  }
+  return target.href
 }
 
-export async function resolveChromiumBrowser(requested?: unknown): Promise<ChromiumBrowser> {
+export async function resolveChromiumBrowser(
+  requested?: unknown,
+  homeDir = tokenlessHome(),
+): Promise<ChromiumBrowser> {
   const requestedId = requested === undefined || requested === null || requested === ''
-    ? null
+    ? 'auto'
     : normalizeBrowserId(requested)
   if (requested !== undefined && requested !== null && requested !== '' && !requestedId) {
     throw runtimeError(
       'invalid_browser',
-      'Browser must be one of: chrome, chrome-for-testing, chromium, edge, arc, brave.',
+      'Browser must be auto, a supported system browser, managed-chromium, or cloak.',
       false
     )
   }
-  if (requestedId === 'profile') {
-    const executable = process.env.TOKENLESS_BROWSER_EXECUTABLE
-    if (!executable || !(await isExecutable(executable))) {
-      throw runtimeError(
-        'browser_not_found',
-        'The profile browser is test-only and requires TOKENLESS_BROWSER_EXECUTABLE.',
-        false
-      )
-    }
-    return {
-      browser: 'profile',
-      command: executable,
-      argsPrefix: [],
-      displayName: 'test browser profile',
-      playwrightExecutablePath: executable,
-    }
-  }
-
-  const order = requestedId
-    ? [requestedId]
-    : ['chrome', 'brave', 'edge', 'arc', 'chromium']
-  for (const browser of order) {
-    const launch = await browserLaunch(browser)
-    if (launch) return launch
+  const runtime = await new BrowserRuntimeManager({ homeDir }).ensure(requestedId ?? 'auto', {
+    allowDownload: false,
+  })
+  return {
+    browser: runtime.browserId,
+    command: runtime.executablePath,
+    argsPrefix: [],
+    displayName: runtime.displayName,
+    playwrightExecutablePath: runtime.executablePath,
   }
-  throw runtimeError(
-    'chromium_browser_not_found',
-    requestedId
-      ? `Configured Chromium browser "${requestedId}" is not installed or executable.`
-      : 'No supported Chromium browser was found. Install Chrome, Brave, Edge, Arc, or Chromium, then rerun tokenless setup.',
-    false
-  )
 }
 
 export async function openProviderUrl(url: string, browser: ChromiumBrowser) {
   // Re-validate here so future callers cannot turn this into a general URL launcher.
   const parsed = new URL(url)
-  const allowedHosts = new Set(['chatgpt.com', 'chat.openai.com', 'claude.ai', 'gemini.google.com', 'grok.com'])
+  const provider = getProviderInstanceForUrl(parsed.href)
   if (
-    parsed.protocol !== 'https:' ||
-    parsed.username !== '' ||
-    parsed.password !== '' ||
-    !allowedHosts.has(parsed.hostname.toLowerCase())
+    !provider ||
+    provider.navigation.classify(parsed.href).kind !== 'approved'
   ) {
     throw runtimeError(
       'invalid_provider_url',
-      'Tokenless only opens allowlisted ChatGPT, Claude, Gemini, or Grok HTTPS pages.',
+      `Tokenless only opens allowlisted ${supportedVisibleProviderList()} HTTPS pages.`,
       false
     )
   }
@@ -604,230 +624,37 @@ export async function openProviderUrl(url: string, browser: ChromiumBrowser) {
   child.unref()
 }
 
-export async function installRustRuntime({
-  homeDir = tokenlessHome(),
-  packageRoot,
-  platform = process.platform,
-  arch = process.arch,
-}: InstallRustRuntimeOptions = {}) {
-  const binDir = path.join(homeDir, 'bin')
-  await fs.mkdir(binDir, { recursive: true, mode: 0o700 })
-  const daemonSource = bundledRustBinaryPath(DAEMON_BINARY_NAME, packageRoot, platform, arch)
-  const daemonExecutable = installedRustBinaryPath(homeDir, DAEMON_BINARY_NAME, platform)
-  await installExecutable(daemonSource, daemonExecutable)
-  return {
-    runtime: 'rust',
-    daemonExecutable,
-  }
-}
-
-/** @deprecated Native Messaging host install is archived under legacy/. */
-export async function installNativeHost() {
-  throw runtimeError(
-    'legacy_native_host_removed',
-    'The Tokenless Native Messaging host is no longer installed. Use managed Playwright setup via "tokenless setup".',
-    false
-  )
-}
-
-export function windowsNativeHostRegistryCommands({
-  manifestPath,
-  browsers,
-}: {
-  manifestPath: string
-  browsers: string[]
-}) {
-  const roots: Record<string, string> = {
-    chrome: 'HKCU\\Software\\Google\\Chrome\\NativeMessagingHosts',
-    'chrome-for-testing': 'HKCU\\Software\\Google\\Chrome\\NativeMessagingHosts',
-    chromium: 'HKCU\\Software\\Chromium\\NativeMessagingHosts',
-    edge: 'HKCU\\Software\\Microsoft\\Edge\\NativeMessagingHosts',
-    brave: 'HKCU\\Software\\BraveSoftware\\Brave-Browser\\NativeMessagingHosts',
-    arc: 'HKCU\\Software\\The Browser Company\\Arc\\NativeMessagingHosts',
-  }
-  const seen = new Set<string>()
-  const commands: string[][] = []
-  for (const browser of browsers) {
-    const browserId = normalizeBrowserId(browser)
-    const root = browserId ? roots[browserId] : undefined
-    if (!root) continue
-    const key = `${root}\\${NATIVE_HOST_NAME}`
-    if (seen.has(key)) continue
-    seen.add(key)
-    commands.push(['reg.exe', 'ADD', key, '/ve', '/t', 'REG_SZ', '/d', manifestPath, '/f'])
-  }
-  return commands
-}
-
-export async function inspectNativeHostManifests({
-  homeDir = tokenlessHome(),
-  manifestHome,
-  browsers = ['chrome'],
-  platform = process.platform,
-}: {
-  homeDir?: string | undefined
-  manifestHome?: string | undefined
-  browsers?: string[] | undefined
-  platform?: NodeJS.Platform | undefined
-} = {}) {
-  const candidates = platform === 'win32'
-    ? [path.join(homeDir, 'native-messaging', `${NATIVE_HOST_NAME}.json`)]
-    : browsers.flatMap((browser) => {
-        const browserId = normalizeBrowserId(browser)
-        return browserId
-          ? nativeMessagingHostDirs(browserId, manifestHome, platform).map((dir) => path.join(dir, `${NATIVE_HOST_NAME}.json`))
-          : []
-      })
-  const uniqueCandidates = [...new Set(candidates)]
-  const manifests = []
-  for (const manifestPath of uniqueCandidates) {
-    try {
-      const payload = JSON.parse(await fs.readFile(manifestPath, 'utf8')) as JsonRecord
-      const expectedHost = installedRustBinaryPath(homeDir, NATIVE_HOST_BINARY_NAME, platform)
-      const valid = payload.name === NATIVE_HOST_NAME &&
-        payload.type === 'stdio' &&
-        path.resolve(payload.path ?? '') === path.resolve(expectedHost) &&
-        Array.isArray(payload.allowed_origins) &&
-        payload.allowed_origins.length === 1 &&
-        /^chrome-extension:\/\/[a-p]{32}\/$/.test(payload.allowed_origins[0])
-      manifests.push({ path: manifestPath, ok: valid, manifest: payload })
-    } catch {
-      // Missing manifests are summarized through candidate and valid counts below.
-    }
-  }
-  return {
-    ok: manifests.some((entry) => entry.ok),
-    candidates: uniqueCandidates,
-    manifests,
-  }
-}
-
-export async function inspectRustBinaries(homeDir = tokenlessHome()) {
-  return inspectManagedRuntime(homeDir)
-}
-
 export async function inspectManagedRuntime(homeDir = tokenlessHome(), packageRoot?: string | undefined) {
-  const daemon = installedRustBinaryPath(homeDir, DAEMON_BINARY_NAME)
-  const daemonExecutable = await isExecutable(daemon)
-  let bundledDaemon: string | null = null
-  let packageCheck: ManagedRuntimeInspection['package']
-  try {
-    const nativePackage = packageRoot === undefined
-      ? resolveNativePlatformPackage()
-      : {
-          ok: true,
-          name: null,
-          version: tokenlessPackageVersion(),
-          platform: process.platform,
-          arch: process.arch,
-          root: packageRoot,
-          manifestPath: null,
-        }
-    bundledDaemon = path.join(nativePackage.root, 'bin', executableName(DAEMON_BINARY_NAME))
-    packageCheck = {
-      ok: true,
-      ...(nativePackage.name === null ? {} : { name: nativePackage.name }),
-      version: nativePackage.version,
-      platform: nativePackage.platform,
-      arch: nativePackage.arch,
-      root: nativePackage.root,
-      ...(nativePackage.manifestPath === null ? {} : { manifestPath: nativePackage.manifestPath }),
-      error: null,
-    }
-  } catch (error) {
-    const runtimeError = error as RuntimeError
-    packageCheck = {
-      ok: false,
-      error: runtimeError.message ?? String(error),
-      code: runtimeError.code,
-    }
-  }
-  const [daemonHash, bundledDaemonHash, packagedBuildInfo] = await Promise.all([
-    fileHash(daemon),
-    bundledDaemon ? fileHash(bundledDaemon) : null,
-    bundledDaemon ? readNativeBinaryBuildInfo(bundledDaemon, DAEMON_BINARY_NAME) : failedBuildInfo('native_platform_package_missing', 'Native platform package is unavailable.'),
-  ])
-  const matchesBundled = Boolean(bundledDaemonHash) && daemonHash === bundledDaemonHash
-  const installedBuildInfo = matchesBundled && packagedBuildInfo.ok
-    ? {
-        ok: true,
-        buildInfo: packagedBuildInfo.buildInfo,
-        error: null as string | null,
-        code: undefined as string | undefined,
-      }
-    : failedBuildInfo(
-        daemonHash === null ? 'rust_binary_missing' : 'rust_binary_hash_mismatch',
-        daemonHash === null
-          ? `Native runtime executable is missing: ${daemon}`
-          : 'Installed daemon binary hash does not match the verified packaged daemon; refusing to execute it.',
-      )
-  const packagedOk = packageCheck.ok && Boolean(bundledDaemon) && Boolean(bundledDaemonHash) && packagedBuildInfo.ok
-  const installedOk = daemonExecutable && Boolean(daemonHash) && matchesBundled && installedBuildInfo.ok
+  void homeDir
+  const packageDir = packageRoot ?? cliPackageRoot()
+  const daemon = bundledTypeScriptDaemonEntryPath(packageDir)
+  const daemonExecutable = await isReadableFile(daemon)
+  const packageCheck: ManagedRuntimeInspection['package'] = {
+    ok: true,
+    name: 'tokenless',
+    version: tokenlessPackageVersion(),
+    platform: process.platform,
+    arch: process.arch,
+    root: packageDir,
+    manifestPath: path.join(packageDir, 'package.json'),
+    error: null,
+  }
+  const buildInfo = await readTypeScriptDaemonBuildInfo(daemon)
+  const daemonOk = packageCheck.ok && daemonExecutable && buildInfo.ok
   return {
-    ok: packagedOk && installedOk,
+    ok: daemonOk,
     package: packageCheck,
-    packaged: {
-      ok: packagedOk,
-      path: bundledDaemon,
-      hash: bundledDaemonHash,
-      buildInfo: packagedBuildInfo.buildInfo,
-      error: packagedBuildInfo.error,
-      ...(packagedBuildInfo.code === undefined ? {} : { code: packagedBuildInfo.code }),
-    },
-    installed: {
-      ok: installedOk,
+    daemon: {
+      ok: daemonOk,
       path: daemon,
-      hash: daemonHash,
       executable: daemonExecutable,
-      matchesBundled,
-      buildInfo: installedBuildInfo.buildInfo,
-      error: installedBuildInfo.error,
-      ...(installedBuildInfo.code === undefined ? {} : { code: installedBuildInfo.code }),
+      buildInfo: buildInfo.buildInfo,
+      error: buildInfo.error,
+      ...(buildInfo.code === undefined ? {} : { code: buildInfo.code }),
     },
-    daemon: { ok: installedOk, path: daemon, hash: daemonHash, bundledHash: bundledDaemonHash, matchesBundled },
   } satisfies ManagedRuntimeInspection
 }
 
-export async function refreshInstalledRustBinaries({
-  homeDir = tokenlessHome(),
-  packageRoot,
-}: {
-  homeDir?: string | undefined
-  packageRoot?: string | undefined
-} = {}) {
-  return refreshInstalledManagedRuntime({ homeDir, packageRoot })
-}
-
-export async function refreshInstalledManagedRuntime({
-  homeDir = tokenlessHome(),
-  packageRoot,
-}: {
-  homeDir?: string | undefined
-  packageRoot?: string | undefined
-} = {}) {
-  const source = bundledRustBinaryPath(DAEMON_BINARY_NAME, packageRoot)
-  const destination = installedRustBinaryPath(homeDir, DAEMON_BINARY_NAME)
-  const [sourceHash, destinationHash, destinationExecutable, sourceBuildInfo] = await Promise.all([
-    fileHash(source),
-    fileHash(destination),
-    isExecutable(destination),
-    readNativeBinaryBuildInfo(source, DAEMON_BINARY_NAME),
-  ])
-  if (!sourceHash) {
-    throw runtimeError('rust_binary_missing', `Native runtime package is missing executable: ${source}`, false)
-  }
-  if (!sourceBuildInfo.ok) {
-    throw runtimeError(
-      sourceBuildInfo.code ?? 'rust_binary_invalid',
-      sourceBuildInfo.error ?? `Native runtime package has invalid build info: ${source}`,
-      false
-    )
-  }
-  if (sourceHash === destinationHash && destinationExecutable) return []
-  await installExecutable(source, destination)
-  return [destination]
-}
-
 export async function persistDaemonSnapshot({
   homeDir = tokenlessHome(),
   jobId,
@@ -861,7 +688,7 @@ export async function persistDaemonSnapshot({
   await fs.writeFile(probesPath, `${JSON.stringify(snapshot.selectorProbes ?? {}, null, 2)}\n`, { mode: 0o600 })
   if (textPath) await fs.writeFile(textPath, `${snapshot.visibleText}\n`, { mode: 0o600 })
   const metadata = {
-    protocol: 'tokenless.daemon-snapshot.v1',
+    protocol: DAEMON_SNAPSHOT_SCHEMA_ID,
     jobId,
     provider: snapshot.provider ?? provider,
     action: 'snapshot_dom',
@@ -879,20 +706,25 @@ export async function persistDaemonSnapshot({
 }
 
 async function spawnDaemon({
-  executable,
+  daemonEntryPath,
   homeDir,
   host,
   port,
   logPath,
+  startupOwnerToken,
+  startupGeneration,
 }: {
-  executable: string
+  daemonEntryPath: string
   homeDir: string
   host: string
   port: number
   logPath: string
+  startupOwnerToken: string
+  startupGeneration: number
 }) {
   const logFd = fsSync.openSync(logPath, 'a', 0o600)
-  const child = spawn(executable, [
+  const child = spawn(process.execPath, [
+    daemonEntryPath,
     '--home',
     homeDir,
     'serve',
@@ -900,6 +732,10 @@ async function spawnDaemon({
     host,
     '--port',
     String(port),
+    '--startup-owner-token',
+    startupOwnerToken,
+    '--startup-generation',
+    String(startupGeneration),
   ], {
     detached: process.platform !== 'win32',
     env: { ...process.env, TOKENLESS_HOME: homeDir },
@@ -913,125 +749,170 @@ async function spawnDaemon({
   } catch (error) {
     throw runtimeError(
       'daemon_start_failed',
-      `Could not start Tokenless Rust daemon: ${error instanceof Error ? error.message : String(error)}`,
+      `Could not start Tokenless TypeScript daemon: ${error instanceof Error ? error.message : String(error)}`,
       true
     )
   } finally {
     fsSync.closeSync(logFd)
   }
   if (!child.pid) {
-    throw runtimeError('daemon_start_failed', 'Tokenless Rust daemon started without a process id.', true)
+    throw runtimeError('daemon_start_failed', 'Tokenless TypeScript daemon started without a process id.', true)
   }
   return child as typeof child & { pid: number }
 }
 
-async function ensureRunningDaemonVersionCoherent(
-  probe: DaemonReadyProbe,
-  {
-    homeDir,
-    bundledRoot,
-    skipInstalledRuntime = false,
-  }: {
-    homeDir: string
-    bundledRoot?: string | undefined
-    skipInstalledRuntime?: boolean | undefined
-  }
-) {
-  const expectedVersion = tokenlessPackageVersion()
-  const runningVersion = typeof probe.body?.version === 'string' ? probe.body.version : null
-  const runningHash = typeof probe.body?.running_binary_hash === 'string' ? probe.body.running_binary_hash : null
-  if (runningVersion !== expectedVersion) {
-    return {
-      ok: false,
-      code: 'daemon_version_mismatch',
-      message: `Tokenless daemon at ${probe.url} reports version ${runningVersion ?? 'missing'}; expected tokenless@${expectedVersion}.`,
-    }
-  }
-  const runtime = await inspectManagedRuntime(homeDir, bundledRoot)
-  if (!runtime.packaged.ok || !runtime.packaged.hash) {
-    return {
-      ok: false,
-      code: 'managed_runtime_incoherent',
-      message: runtime.packaged.error ??
-        `Tokenless managed runtime binary is not coherent with tokenless@${expectedVersion}.`,
-    }
-  }
-  const processProofError = probe.body?.daemon_process_identity_error
-  if (processProofError !== undefined) {
-    return {
-      ok: false,
-      code: processProofError.code ?? 'daemon_process_identity_unverified',
-      message: processProofError.message ?? 'Tokenless daemon process identity could not be verified.',
-    }
+export function semanticVersionMajor(value: string) {
+  const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.exec(value)
+  if (!match) return null
+  const major = Number(match[1])
+  return Number.isSafeInteger(major) ? major : null
+}
+
+async function probeDaemonReachable(url: string, timeoutMs: number) {
+  const parsed = new URL(url)
+  const host = daemonBindHost(parsed.hostname)
+  const port = parsed.port === ''
+    ? (parsed.protocol === 'https:' ? 443 : 80)
+    : Number(parsed.port)
+  try {
+    await tcpConnect({ host, port, timeoutMs: normalizeStopTimeoutMs(timeoutMs) })
+    return { reachable: true }
+  } catch {
+    return { reachable: false }
   }
-  if (runningHash !== runtime.packaged.hash) {
-    return {
-      ok: false,
-      code: 'daemon_binary_hash_mismatch',
-      message: `Tokenless daemon at ${probe.url} reports binary hash ${runningHash ?? 'missing'}; expected packaged hash ${runtime.packaged.hash}.`,
+}
+
+async function waitForDaemonListenerGone(url: string, timeoutMs: number) {
+  const deadline = Date.now() + timeoutMs
+  do {
+    const reachable = await probeDaemonReachable(url, Math.min(500, Math.max(1, deadline - Date.now())))
+    if (!reachable.reachable) return true
+    await delay(100)
+  } while (Date.now() < deadline)
+  return !(await probeDaemonReachable(url, 250)).reachable
+}
+
+function tcpConnect({ host, port, timeoutMs }: { host: string; port: number; timeoutMs: number }) {
+  return new Promise<void>((resolve, reject) => {
+    const socket = net.createConnection({ host, port })
+    let settled = false
+    const finish = (error?: Error) => {
+      if (settled) return
+      settled = true
+      socket.destroy()
+      if (error) reject(error)
+      else resolve()
     }
+    socket.setTimeout(timeoutMs, () => finish(new Error('timeout')))
+    socket.once('connect', () => finish())
+    socket.once('error', finish)
+  })
+}
+
+function normalizeStopTimeoutMs(value: number | undefined) {
+  const numeric = value === undefined ? DEFAULT_DAEMON_STOP_TIMEOUT_MS : Number(value)
+  if (!Number.isFinite(numeric) || numeric <= 0 || !Number.isInteger(numeric) || numeric > MAX_TIMEOUT_MS) {
+    throw runtimeError(
+      'invalid_daemon_stop_timeout',
+      `daemon stop --timeout-ms must be a finite positive integer no greater than ${MAX_TIMEOUT_MS}.`,
+      false
+    )
   }
-  if (!skipInstalledRuntime && !runtime.ok) {
-    return {
-      ok: false,
-      code: 'managed_runtime_incoherent',
-      message: runtime.installed.error ??
-        `Tokenless managed runtime binary is not coherent with tokenless@${expectedVersion}.`,
-    }
+  return Math.max(1, Math.floor(numeric))
+}
+
+function setupDaemonReadyResult(
+  ready: Awaited<ReturnType<typeof ensureDaemonReady>>
+): SetupDaemonReadyResult {
+  const expectedVersion = tokenlessPackageVersion()
+  const runningVersion = typeof ready.body?.version === 'string' ? ready.body.version : null
+  const expectedMajor = semanticVersionMajor(expectedVersion)
+  const runningMajor = runningVersion === null ? null : semanticVersionMajor(runningVersion)
+  const versionCompatible = runningVersion === expectedVersion
+  return {
+    ...ready,
+    expectedVersion,
+    expectedMajor,
+    runningVersion,
+    runningMajor,
+    versionCompatible,
   }
-  return { ok: true }
 }
 
-async function stopOwnedDaemonForRefresh({
-  probe,
+async function probeDaemonEndpointCandidates({
+  runtimeState,
+  preferredUrl,
   homeDir,
-  reason,
 }: {
-  probe: DaemonReadyProbe
+  runtimeState: DaemonRuntimeState
+  preferredUrl: string
   homeDir: string
-  reason: string
 }) {
-  const pid = daemonPidFromReady(probe)
-  const instanceId = typeof probe.body?.instance_id === 'string' ? probe.body.instance_id : null
-  const processProofError = probe.body?.daemon_process_identity_error
-  if (
-    pid === null ||
-    !instanceId ||
-    processProofError !== undefined ||
-    typeof probe.body?.daemon_process_proof !== 'string' ||
-    probe.body.daemon_process_proof_protocol !== DAEMON_PROCESS_PROOF_PROTOCOL
-  ) {
-    throw runtimeError(
-      'daemon_restart_unsafe',
-      `${reason} The running daemon did not provide a cryptographically verifiable process identity, so Tokenless will not stop it automatically. Stop the existing daemon bound to ${probe.url}, then rerun tokenless setup.`,
-      false
-    )
+  const endpoint = runtimeState.endpoint()
+  const candidates = daemonEndpointCandidates(endpoint, preferredUrl)
+  let replaceable: DaemonReadyProbe | null = null
+  let failedRunningEndpoint: DaemonRuntimeEndpoint | null = null
+  let lastProbe: DaemonReadyProbe | null = null
+  for (const candidateUrl of candidates) {
+    const probe = await probeDaemonReady({ daemonUrl: candidateUrl, homeDir })
+    lastProbe = probe
+    if (probe.ok) return { ready: probe, replaceable: null, failedRunningEndpoint: null, lastProbe: probe }
+    if (!replaceable && shouldReplaceVersionMismatchedDaemon(probe)) replaceable = probe
+    if (
+      !failedRunningEndpoint &&
+      endpoint &&
+      candidateUrl === endpoint.origin &&
+      shouldTakeOverFailedRunningEndpoint(probe)
+    ) {
+      failedRunningEndpoint = endpoint
+    }
   }
-  if (!pidIsAlive(pid)) {
-    await removePidIfOwned(homeDir, pid)
-    return
+  return {
+    ready: null,
+    replaceable,
+    failedRunningEndpoint,
+    lastProbe: lastProbe ?? await probeDaemonReady({ daemonUrl: preferredUrl, homeDir }),
   }
-  try {
-    process.kill(pid, 'SIGTERM')
-  } catch (error) {
-    throw runtimeError(
-      'daemon_restart_failed',
-      `${reason} Tokenless verified daemon process ${pid} but could not stop it: ${error instanceof Error ? error.message : String(error)}`,
-      true
-    )
+}
+
+function daemonEndpointCandidates(endpoint: DaemonRuntimeEndpoint | null, preferredUrl: string) {
+  const urls: string[] = []
+  if (endpoint?.origin) urls.push(endpoint.origin)
+  urls.push(preferredUrl)
+  return [...new Set(urls)]
+}
+
+function shouldTakeOverFailedRunningEndpoint(probe: DaemonReadyProbe) {
+  if (probe.ok) return false
+  if (shouldReplaceVersionMismatchedDaemon(probe)) return false
+  if (probe.reachable && probe.code === 'daemon_not_ready') return false
+  return true
+}
+
+function daemonReadyResult(
+  probe: DaemonReadyProbe & { ok: true },
+  started: boolean,
+  binaryPath: string | null,
+  fallbackPid?: number | null | undefined
+) {
+  return {
+    ...probe,
+    started,
+    binaryPath,
+    pid: daemonPidFromReady(probe) ?? fallbackPid ?? undefined,
   }
-  for (let attempt = 0; attempt < 50; attempt += 1) {
-    if (!pidIsAlive(pid)) {
-      await removePidIfOwned(homeDir, pid)
-      return
-    }
-    await delay(100)
+}
+
+async function clearPersistedEndpointIfOwned(
+  homeDir: string,
+  { url, pid }: { url: string; pid?: number | undefined }
+) {
+  const runtimeState = await DaemonRuntimeState.openIfExists(homeDir)
+  try {
+    runtimeState?.clearEndpoint({ origin: url, pid })
+  } finally {
+    runtimeState?.close()
   }
-  throw runtimeError(
-    'daemon_restart_failed',
-    `${reason} Tokenless verified daemon process ${pid} but it did not exit after SIGTERM.`,
-    true
-  )
 }
 
 function daemonPidFromReady(probe: DaemonReadyProbe) {
@@ -1039,31 +920,30 @@ function daemonPidFromReady(probe: DaemonReadyProbe) {
   return Number.isSafeInteger(pid) && pid > 0 ? pid as number : null
 }
 
-async function readNativeBinaryBuildInfo(binaryPath: string, expectedBinary: string) {
-  if (!(await isExecutable(binaryPath))) {
-    return failedBuildInfo('rust_binary_missing', `Native runtime executable is missing: ${binaryPath}`)
+async function readTypeScriptDaemonBuildInfo(daemonEntryPath: string) {
+  if (!(await isReadableFile(daemonEntryPath))) {
+    return failedBuildInfo('typescript_daemon_entry_missing', `TypeScript daemon entry is missing: ${daemonEntryPath}`)
   }
   let result: Awaited<ReturnType<typeof execFileJson>>
   try {
-    result = await execFileJson(binaryPath, ['--tokenless-build-info'])
+    result = await execFileJson(process.execPath, [daemonEntryPath, '--tokenless-build-info'])
   } catch (error) {
     return failedBuildInfo(
-      'rust_binary_build_info_failed',
+      'typescript_daemon_build_info_failed',
       error instanceof Error ? error.message : String(error)
     )
   }
   const buildInfo = result.value
   const expectedVersion = tokenlessPackageVersion()
   const valid = isRecord(buildInfo) &&
-    buildInfo.protocol === NATIVE_BINARY_BUILD_INFO_PROTOCOL &&
-    buildInfo.binary === expectedBinary &&
+    buildInfo.binary === 'tokenless-daemon' &&
     buildInfo.version === expectedVersion &&
     buildInfo.platform === process.platform &&
     buildInfo.arch === process.arch
   if (!valid) {
     return failedBuildInfo(
-      'rust_binary_build_info_mismatch',
-      `Native runtime build info for ${binaryPath} does not match tokenless@${expectedVersion} on ${process.platform}-${process.arch}.`,
+      'typescript_daemon_build_info_mismatch',
+      `TypeScript daemon build info for ${daemonEntryPath} does not match tokenless@${expectedVersion} on ${process.platform}-${process.arch}.`,
       isRecord(buildInfo) ? buildInfo : null
     )
   }
@@ -1074,80 +954,6 @@ function failedBuildInfo(code: string, error: string, buildInfo: JsonRecord | nu
   return { ok: false, code, error, buildInfo }
 }
 
-async function acquireDaemonStartLock({ homeDir, timeoutMs }: { homeDir: string; timeoutMs: number }) {
-  const lockPath = path.join(homeDir, '.daemon-start.lock')
-  const deadline = Date.now() + timeoutMs
-  while (Date.now() < deadline) {
-    try {
-      await fs.mkdir(lockPath, { mode: 0o700 })
-      return async () => fs.rm(lockPath, { recursive: true, force: true })
-    } catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error
-      const stat = await fs.stat(lockPath).catch(() => null)
-      if (stat && Date.now() - stat.mtimeMs > timeoutMs) {
-        await fs.rm(lockPath, { recursive: true, force: true }).catch(() => undefined)
-        continue
-      }
-      await delay(100)
-    }
-  }
-  throw runtimeError(
-    'daemon_start_locked',
-    `Timed out waiting for another Tokenless daemon startup in ${homeDir}.`,
-    true
-  )
-}
-
-function normalizeBridgeMarker(markerPath: string, payload: JsonRecord, maxAgeMs: number): BridgeMarker | null {
-  const expectedKeys = ['connectedAt', 'heartbeatAt', 'pid', 'protocol', 'sessionId']
-  const actualKeys = Object.keys(payload).sort()
-  if (actualKeys.length !== expectedKeys.length || actualKeys.some((key, index) => key !== expectedKeys[index])) {
-    return null
-  }
-  if (payload.protocol !== EXTENSION_BRIDGE_PROTOCOL) return null
-  const pid = payload.pid
-  const sessionId = payload.sessionId
-  const connectedMs = strictIsoTimestampMs(payload.connectedAt)
-  const heartbeatMs = strictIsoTimestampMs(payload.heartbeatAt)
-  if (
-    !Number.isInteger(pid) ||
-    (pid as number) <= 0 ||
-    (pid as number) > 2_147_483_647 ||
-    typeof sessionId !== 'string' ||
-    !sessionId.trim() ||
-    connectedMs === null ||
-    heartbeatMs === null
-  ) {
-    return null
-  }
-  const now = Date.now()
-  if (
-    connectedMs > now + BRIDGE_CLOCK_TOLERANCE_MS ||
-    heartbeatMs > now + BRIDGE_CLOCK_TOLERANCE_MS ||
-    connectedMs > heartbeatMs + BRIDGE_CLOCK_TOLERANCE_MS
-  ) {
-    return null
-  }
-  const heartbeatAgeMs = Math.max(0, now - heartbeatMs)
-  if (heartbeatAgeMs > maxAgeMs || !pidIsAlive(pid)) return null
-  return {
-    path: markerPath,
-    protocol: EXTENSION_BRIDGE_PROTOCOL,
-    pid,
-    sessionId,
-    connectedAt: new Date(connectedMs).toISOString(),
-    heartbeatAt: new Date(heartbeatMs).toISOString(),
-    heartbeatAgeMs,
-    raw: payload,
-  }
-}
-
-function strictIsoTimestampMs(value: unknown) {
-  if (typeof value !== 'string' || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value)) return null
-  const parsed = Date.parse(value)
-  return Number.isFinite(parsed) && new Date(parsed).toISOString() === value ? parsed : null
-}
-
 function pidIsAlive(pid: number) {
   try {
     process.kill(pid, 0)
@@ -1160,15 +966,31 @@ function pidIsAlive(pid: number) {
   }
 }
 
-function assertNoDaemonIdentityConflict(probe: DaemonReadyProbe) {
-  if (!probe.reachable) return
+function shouldReplaceVersionMismatchedDaemon(probe: DaemonReadyProbe) {
+  return !probe.ok &&
+    probe.code === 'daemon_version_mismatch' &&
+    probe.identityVerified === true &&
+    probe.sameHomeVerified === true
+}
+
+function assertLocalProviderSupport(requiredProvider: string | undefined) {
+  if (!requiredProvider) return
+  const provider = getProviderInstanceById(requiredProvider)
+  if (provider && provider.descriptor.stage !== 'disabled') return
   throw runtimeError(
-    probe.code ?? 'daemon_not_ready',
-    probe.message ?? `Daemon at ${probe.url} is reachable but cannot be used.`,
+    'daemon_provider_unsupported',
+    `This Tokenless build does not support Playwright provider ${requiredProvider}.`,
     false
   )
 }
 
+function supportedVisibleProviderList() {
+  return listProviderDescriptors()
+    .filter((provider) => provider.stage !== 'disabled')
+    .map((provider) => provider.id)
+    .join(', ')
+}
+
 async function readDaemonPid(homeDir: string) {
   try {
     const payload = JSON.parse(await fs.readFile(path.join(homeDir, DAEMON_PID_FILE), 'utf8')) as JsonRecord
@@ -1216,40 +1038,17 @@ function readyHomeFromBody(body: JsonRecord) {
 
 function validateDaemonReadyProof(body: JsonRecord, challenge: string, token: string) {
   if (
-    body.ready_proof_protocol !== DAEMON_READY_PROOF_PROTOCOL ||
-    body.ready_challenge !== challenge ||
-    typeof body.daemon_protocol !== 'string' ||
-    typeof body.native_protocol !== 'string' ||
     typeof body.home_dir !== 'string' ||
-    typeof body.ready_proof !== 'string'
+    typeof body.proof !== 'string'
   ) {
     return {
       code: 'daemon_ready_proof_missing',
       message: 'Tokenless daemon /ready did not return a complete challenge-bound identity proof. Reinstall Tokenless.',
     }
   }
-  let actualProof: Buffer
-  try {
-    actualProof = Buffer.from(body.ready_proof, 'base64url')
-  } catch {
-    actualProof = Buffer.alloc(0)
-  }
-  if (actualProof.length !== 32 || actualProof.toString('base64url') !== body.ready_proof) {
-    return {
-      code: 'daemon_ready_proof_invalid',
-      message: 'Tokenless daemon /ready returned an invalid identity proof.',
-    }
-  }
-  const expectedProof = createHmac('sha256', token)
-    .update(daemonReadyProofMessage([
-      DAEMON_READY_PROOF_PROTOCOL,
-      challenge,
-      body.daemon_protocol,
-      body.native_protocol,
-      body.home_dir,
-    ]))
-    .digest()
-  if (!timingSafeEqual(actualProof, expectedProof)) {
+  const actualProof = Buffer.from(body.proof)
+  const expectedProof = Buffer.from(daemonReadyProof(token, challenge, body.home_dir))
+  if (actualProof.length !== expectedProof.length || !timingSafeEqual(actualProof, expectedProof)) {
     return {
       code: 'daemon_ready_proof_mismatch',
       message: 'Daemon identity proof does not match this Tokenless home; refusing to send its control token.',
@@ -1258,81 +1057,6 @@ function validateDaemonReadyProof(body: JsonRecord, challenge: string, token: st
   return null
 }
 
-function validateDaemonProcessProof(body: JsonRecord, challenge: string, token: string) {
-  if (
-    body.daemon_process_proof_protocol === undefined &&
-    body.daemon_process_proof === undefined &&
-    body.pid === undefined &&
-    body.instance_id === undefined
-  ) {
-    return {
-      code: 'daemon_process_proof_missing',
-      message: 'Tokenless daemon /ready did not return a process identity proof.',
-    }
-  }
-  if (
-    body.daemon_process_proof_protocol !== DAEMON_PROCESS_PROOF_PROTOCOL ||
-    body.ready_challenge !== challenge ||
-    typeof body.daemon_protocol !== 'string' ||
-    typeof body.native_protocol !== 'string' ||
-    typeof body.home_dir !== 'string' ||
-    typeof body.daemon_process_proof !== 'string' ||
-    !Number.isSafeInteger(body.pid) ||
-    body.pid <= 0 ||
-    typeof body.instance_id !== 'string' ||
-    !/^[A-Za-z0-9_-]{22}$/.test(body.instance_id) ||
-    typeof body.running_binary_hash !== 'string' ||
-    !/^[0-9a-f]{64}$/.test(body.running_binary_hash)
-  ) {
-    return {
-      code: 'daemon_process_proof_invalid',
-      message: 'Tokenless daemon /ready returned an incomplete process identity proof.',
-    }
-  }
-  let actualProof: Buffer
-  try {
-    actualProof = Buffer.from(body.daemon_process_proof, 'base64url')
-  } catch {
-    actualProof = Buffer.alloc(0)
-  }
-  if (actualProof.length !== 32 || actualProof.toString('base64url') !== body.daemon_process_proof) {
-    return {
-      code: 'daemon_process_proof_invalid',
-      message: 'Tokenless daemon /ready returned an invalid process identity proof.',
-    }
-  }
-  const expectedProof = createHmac('sha256', token)
-    .update(daemonReadyProofMessage([
-      DAEMON_PROCESS_PROOF_PROTOCOL,
-      challenge,
-      body.daemon_protocol,
-      body.native_protocol,
-      body.home_dir,
-      String(body.pid),
-      body.instance_id,
-      body.running_binary_hash,
-    ]))
-    .digest()
-  if (!timingSafeEqual(actualProof, expectedProof)) {
-    return {
-      code: 'daemon_process_proof_mismatch',
-      message: 'Daemon process identity proof does not match this Tokenless home.',
-    }
-  }
-  return null
-}
-
-function daemonReadyProofMessage(fields: string[]) {
-  const chunks: Buffer[] = []
-  for (const field of fields) {
-    const value = Buffer.from(field, 'utf8')
-    const length = Buffer.allocUnsafe(4)
-    length.writeUInt32BE(value.length)
-    chunks.push(length, value)
-  }
-  return Buffer.concat(chunks)
-}
-
 function daemonBindHost(hostname: string) {
   if (hostname === 'localhost') return '127.0.0.1'
   if (hostname === '[::1]') return '::1'
@@ -1344,18 +1068,6 @@ async function canonicalPath(value: string) {
   return fs.realpath(resolved).catch(() => resolved)
 }
 
-async function installExecutable(source: string, destination: string) {
-  if (!(await isExecutable(source))) {
-    throw runtimeError('rust_binary_missing', `Packaged Rust binary is missing: ${source}`, false)
-  }
-  if (path.resolve(source) === path.resolve(destination)) return
-  await fs.mkdir(path.dirname(destination), { recursive: true, mode: 0o700 })
-  const temporary = `${destination}.${process.pid}.${Date.now()}.tmp`
-  await fs.copyFile(source, temporary)
-  if (process.platform !== 'win32') await fs.chmod(temporary, 0o755)
-  await fs.rename(temporary, destination)
-}
-
 async function isExecutable(file: string) {
   try {
     await fs.access(file, process.platform === 'win32' ? fsSync.constants.F_OK : fsSync.constants.X_OK)
@@ -1365,111 +1077,27 @@ async function isExecutable(file: string) {
   }
 }
 
-function executableName(name: string, platform: NodeJS.Platform = process.platform) {
-  return `${name}${platform === 'win32' ? '.exe' : ''}`
-}
-
-async function browserLaunch(browser: string): Promise<ChromiumBrowser | null> {
-  const displayNames: Record<string, string> = {
-    chrome: 'Google Chrome',
-    'chrome-for-testing': 'Google Chrome for Testing',
-    brave: 'Brave Browser',
-    edge: 'Microsoft Edge',
-    arc: 'Arc',
-    chromium: 'Chromium',
-  }
-  if (process.platform === 'darwin') {
-    const appNames: Record<string, string> = {
-      chrome: 'Google Chrome.app',
-      'chrome-for-testing': 'Google Chrome for Testing.app',
-      brave: 'Brave Browser.app',
-      edge: 'Microsoft Edge.app',
-      arc: 'Arc.app',
-      chromium: 'Chromium.app',
-    }
-    const appName = appNames[browser]
-    if (!appName) return null
-    const appPath = await firstExistingFile([path.join('/Applications', appName), path.join(os.homedir(), 'Applications', appName)])
-    if (!appPath) return null
-    const executableNames: Record<string, string> = {
-      chrome: 'Google Chrome',
-      'chrome-for-testing': 'Google Chrome for Testing',
-      brave: 'Brave Browser',
-      edge: 'Microsoft Edge',
-      arc: 'Arc',
-      chromium: 'Chromium',
-    }
-    const playwrightExecutablePath = path.join(appPath, 'Contents', 'MacOS', executableNames[browser] as string)
-    if (!(await isExecutable(playwrightExecutablePath))) return null
-    return {
-      browser,
-      command: '/usr/bin/open',
-      argsPrefix: ['-a', displayNames[browser] as string],
-      displayName: displayNames[browser] as string,
-      playwrightExecutablePath,
-    }
-  }
-
-  if (process.platform === 'win32') {
-    const relativeExecutables: Record<string, string[]> = {
-      chrome: ['Google/Chrome/Application/chrome.exe'],
-      brave: ['BraveSoftware/Brave-Browser/Application/brave.exe'],
-      edge: ['Microsoft/Edge/Application/msedge.exe'],
-      arc: ['TheBrowserCompany/Arc/Application/Arc.exe'],
-      chromium: ['Chromium/Application/chrome.exe'],
-    }
-    const roots = [process.env.LOCALAPPDATA, process.env.PROGRAMFILES, process.env['PROGRAMFILES(X86)']]
-      .filter((value): value is string => Boolean(value))
-    const candidates = roots.flatMap((root) => (relativeExecutables[browser] ?? []).map((relative) => path.join(root, relative)))
-    const executable = await firstExistingFile(candidates)
-    return executable
-      ? { browser, command: executable, argsPrefix: [], displayName: displayNames[browser] as string, playwrightExecutablePath: executable }
-      : null
-  }
-
-  const executableNames: Record<string, string[]> = {
-    chrome: ['google-chrome', 'google-chrome-stable'],
-    'chrome-for-testing': ['google-chrome-for-testing'],
-    brave: ['brave-browser', 'brave'],
-    edge: ['microsoft-edge', 'microsoft-edge-stable'],
-    arc: ['arc'],
-    chromium: ['chromium', 'chromium-browser'],
-  }
-  const executable = await findOnPath(executableNames[browser] ?? [])
-  return executable
-    ? { browser, command: executable, argsPrefix: [], displayName: displayNames[browser] as string, playwrightExecutablePath: executable }
-    : null
-}
-
-async function firstExistingFile(candidates: string[]) {
-  for (const candidate of candidates) {
-    try {
-      if ((await fs.stat(candidate)).isFile() || (await fs.stat(candidate)).isDirectory()) return candidate
-    } catch {
-      // Keep searching.
-    }
+async function isReadableFile(file: string) {
+  try {
+    await fs.access(file, fsSync.constants.R_OK)
+    return (await fs.stat(file)).isFile()
+  } catch {
+    return false
   }
-  return null
 }
 
-async function findOnPath(names: string[]) {
-  const directories = (process.env.PATH ?? '').split(path.delimiter).filter(Boolean)
-  for (const name of names) {
-    for (const directory of directories) {
-      const candidate = path.join(directory, name)
-      if (await isExecutable(candidate)) return candidate
-    }
-  }
-  return null
+async function assertDaemonEntryRunnable(daemonEntryPath: string) {
+  const buildInfo = await readTypeScriptDaemonBuildInfo(daemonEntryPath)
+  if (buildInfo.ok) return
+  throw runtimeError(
+    buildInfo.code ?? 'typescript_daemon_entry_invalid',
+    buildInfo.error ?? `TypeScript daemon entry is invalid: ${daemonEntryPath}`,
+    false
+  )
 }
 
-async function fileHash(file: string) {
-  try {
-    const contents = await fs.readFile(file)
-    return createHash('sha256').update(contents).digest('hex')
-  } catch {
-    return null
-  }
+function cliPackageRoot() {
+  return path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..')
 }
 
 function unwrapSnapshot(result: unknown): JsonRecord | null {
@@ -1479,6 +1107,16 @@ function unwrapSnapshot(result: unknown): JsonRecord | null {
   if (value.snapshot?.status === 'snapshotted') return value.snapshot
   if (value.result?.status === 'snapshotted') return value.result
   if (value.result?.snapshot?.status === 'snapshotted') return value.result.snapshot
+  const responses = Array.isArray(value.responses)
+    ? value.responses
+    : Array.isArray(value.result?.responses)
+      ? value.result.responses
+      : []
+  for (const response of responses) {
+    if (!response || typeof response !== 'object') continue
+    const snapshot = (response as JsonRecord).result
+    if (snapshot?.status === 'snapshotted') return snapshot
+  }
   return null
 }
 
@@ -1497,19 +1135,6 @@ async function writeJsonAtomic(file: string, payload: unknown, mode: number) {
   await fs.rename(temporary, file)
 }
 
-async function execFile(command: string, args: string[]) {
-  const child = spawn(command, args, { stdio: ['ignore', 'pipe', 'pipe'] })
-  let stderr = ''
-  child.stderr?.on('data', (chunk) => { stderr += chunk.toString('utf8') })
-  const exitCode = await new Promise<number>((resolve, reject) => {
-    child.once('error', reject)
-    child.once('close', (code) => resolve(code ?? 1))
-  })
-  if (exitCode !== 0) {
-    throw runtimeError('native_host_registry_failed', `${command} failed: ${stderr.trim()}`, false)
-  }
-}
-
 async function execFileJson(command: string, args: string[]) {
   const child = spawn(command, args, { stdio: ['ignore', 'pipe', 'pipe'] })
   let stdout = ''
@@ -1521,7 +1146,7 @@ async function execFileJson(command: string, args: string[]) {
     if (outputBytes > BUILD_INFO_OUTPUT_LIMIT_BYTES) {
       child.kill('SIGTERM')
       throw runtimeError(
-        'native_binary_build_info_too_large',
+        'daemon_runtime_build_info_too_large',
         `${command} --tokenless-build-info exceeded ${BUILD_INFO_OUTPUT_LIMIT_BYTES} bytes of output.`,
         false
       )
@@ -1548,7 +1173,7 @@ async function execFileJson(command: string, args: string[]) {
     const timer = setTimeout(() => {
       child.kill('SIGTERM')
       reject(runtimeError(
-        'native_binary_build_info_timeout',
+        'daemon_runtime_build_info_timeout',
         `${command} --tokenless-build-info did not exit within ${BUILD_INFO_TIMEOUT_MS} ms.`,
         false
       ))
@@ -1563,13 +1188,13 @@ async function execFileJson(command: string, args: string[]) {
   })
   if (streamError) throw streamError
   if (exitCode !== 0) {
-    throw runtimeError('native_binary_build_info_failed', `${command} failed: ${stderr.trim()}`, false)
+    throw runtimeError('daemon_runtime_build_info_failed', `${command} failed: ${stderr.trim()}`, false)
   }
   try {
     return { value: JSON.parse(stdout) as unknown }
   } catch (error) {
     throw runtimeError(
-      'native_binary_build_info_invalid',
+      'daemon_runtime_build_info_invalid',
       `${command} returned invalid build info JSON: ${error instanceof Error ? error.message : String(error)}`,
       false
     )
diff --git a/packages/cli/src/schema-ids.ts b/packages/cli/src/schema-ids.ts
new file mode 100644
index 0000000..e825657
--- /dev/null
+++ b/packages/cli/src/schema-ids.ts
@@ -0,0 +1,13 @@
+export const DAEMON_PROCESS_SCHEMA_ID = 'tokenless.daemon-process.v1' as const
+export const DAEMON_SNAPSHOT_SCHEMA_ID = 'tokenless.daemon-snapshot.v1' as const
+export const DAEMON_TASK_STATE_SCHEMA_ID = 'tokenless.daemon-task-state.v1' as const
+export const MANAGED_PLAYWRIGHT_JOB_SCHEMA_ID_V3 = 'tokenless.playwright.job.v3' as const
+export const RELEASE_PENDING_SCHEMA_ID = 'tokenless.release-pending.v1' as const
+export const RUNNER_CHECKPOINT_SCHEMA_ID_V2 = 'tokenless.playwright.runner-checkpoint.v2' as const
+export const TOKENLESS_CONFIG_SCHEMA_ID = 'tokenless.config.v1' as const
+export const USER_HANDOVER_SCHEMA_ID = 'tokenless.playwright.user-handover.v1' as const
+export const VISIBLE_ACTION_SCHEMA_ID_V3 = 'tokenless.playwright.visible-action.v3' as const
+export const VISIBLE_ATTACHMENT_SCHEMA_ID = 'tokenless.visible-attachment.v1' as const
+export const MANAGED_PLAYWRIGHT_JOB_SCHEMA_ID = MANAGED_PLAYWRIGHT_JOB_SCHEMA_ID_V3
+export const RUNNER_CHECKPOINT_SCHEMA_ID = RUNNER_CHECKPOINT_SCHEMA_ID_V2
+export const VISIBLE_ACTION_SCHEMA_ID = VISIBLE_ACTION_SCHEMA_ID_V3
diff --git a/packages/cli/src/setup-presenter.ts b/packages/cli/src/setup-presenter.ts
index 1ef2c03..efdbff4 100644
--- a/packages/cli/src/setup-presenter.ts
+++ b/packages/cli/src/setup-presenter.ts
@@ -1,3 +1,5 @@
+import { localizeText } from './localization.js'
+
 type WritableStream = {
   columns?: number
   write(chunk: string): unknown
@@ -38,7 +40,7 @@ const SPINNER_FRAMES = Object.freeze(['-', '\\', '|', '/'])
 const REPLACE_TERMINAL_LINE = '\u001b[2K\u001b[1G'
 
 export const SETUP_MANAGED_PROFILE_DISCLOSURE = Object.freeze([
-  'Keeps sign-ins between jobs. Imports copy selected provider cookies only; other browser data is excluded.',
+  'Keeps sign-ins between jobs inside a Tokenless-managed profile. With explicit consent, setup can copy a selected local profile as an opaque filesystem tree without reading its authentication values.',
 ])
 
 export const SETUP_READINESS_DISCLOSURE = Object.freeze([
@@ -76,34 +78,25 @@ export class SetupPresenter {
     if (!this.enabled) return
     this.write([
       '',
-      this.paint('brightCyan', 'Tokenless setup'),
+      this.paint('brightCyan', localizeText('Tokenless setup')),
       '',
     ].join('\n'))
   }
 
   explain({ title, lines }: ExplainOptions) {
     if (!this.enabled) return
-    this.write(`${this.paint('bright', title)}\n`)
-    for (const line of lines) this.write(`  ${this.paint('dim', '-')} ${line}\n`)
+    this.write(`${this.paint('bright', localizeText(title))}\n`)
+    for (const line of lines) this.write(`  ${this.paint('dim', '-')} ${localizeText(line)}\n`)
   }
 
   note(message: string) {
     if (!this.enabled) return
-    this.write(`  ${this.paint('cyan', '*')} ${message}\n`)
+    this.write(`  ${this.paint('yellow', '*')} ${localizeText(message)}\n`)
   }
 
   success(message: string) {
     if (!this.enabled) return
-    this.write(`  ${this.paint('green', 'OK')} ${message}\n`)
-  }
-
-  handover(provider: string, detail: string, nextStep = 'Finish in the already-open Tokenless-managed Chrome window/tab, then press Enter here. The same job will resume.') {
-    if (!this.enabled) return
-    this.write([
-      this.paint('yellow', `Visible ${provider} handoff`),
-      `  ${this.paint('dim', '-')} ${detail}`,
-      `  ${this.paint('dim', '-')} ${nextStep}`,
-    ].join('\n') + '\n')
+    this.write(`  ${this.paint('green', 'OK')} ${localizeText(message)}\n`)
   }
 
   async withProgress<T>(message: string, task: () => Promise<T>): Promise<T> {
@@ -115,7 +108,7 @@ export class SetupPresenter {
       const prefix = this.animationEnabled
         ? `${SPINNER_FRAMES[frame++ % SPINNER_FRAMES.length]}`
         : '-'
-      this.writeProgress(prefix, message)
+      this.writeProgress(prefix, localizeText(message))
     }
 
     if (this.animationEnabled) {
@@ -126,20 +119,20 @@ export class SetupPresenter {
     try {
       const result = await task()
       if (timer !== null) this.timers.clearInterval(timer)
-      if (this.animationEnabled) this.finishProgress('OK', message, 'green')
+      if (this.animationEnabled) this.finishProgress('OK', localizeText(message), 'green')
       else this.success(message)
       return result
     } catch (error) {
       if (timer !== null) this.timers.clearInterval(timer)
-      if (this.animationEnabled) this.finishProgress('X', message, 'red')
-      else this.write(`  ${this.paint('red', 'X')} ${message}\n`)
+      if (this.animationEnabled) this.finishProgress('X', localizeText(message), 'red')
+      else this.write(`  ${this.paint('red', 'X')} ${localizeText(message)}\n`)
       throw error
     }
   }
 
   summary(message: string) {
     if (!this.enabled) return
-    this.write(`\n${this.paint('brightGreen', message)}\n`)
+    this.write(`\n${this.paint('brightGreen', localizeText(message))}\n`)
   }
 
   private writeProgress(prefix: string, message: string) {
diff --git a/packages/cli/src/tokenless.mts b/packages/cli/src/tokenless.mts
index 5a3b092..fecb556 100644
--- a/packages/cli/src/tokenless.mts
+++ b/packages/cli/src/tokenless.mts
@@ -6,60 +6,92 @@ import { createInterface } from 'node:readline/promises'
 
 import {
   MANAGED_PLAYWRIGHT_JOB_ACTION,
+  MANAGED_CHROMIUM_BROWSER_IDS,
   PLAYWRIGHT_EXECUTION_BACKEND,
+  TASK_CAPABILITIES,
+  TASK_CAPABILITY_CATALOG_SCHEMA_ID,
   VISIBLE_ACTIONS,
   ManagedProfileRegistry,
+  TaskCapabilityRequestError,
   createManagedPlaywrightJobRequest,
+  createE2EInspectionJobId,
+  copyOpaqueChromiumProfile,
   discoverChromiumProfiles,
-  importChromeProfile,
-  listProviders,
-  providerHomeUrl,
+  discoverKnownChromiumProfiles,
+  getProviderDescriptorById,
+  listProviderTaskCapabilityRoutes,
+  listProviderDescriptors,
+  listTaskCapabilityDefinitions,
+  normalizeTaskCapabilityRequirements,
   readManagedProfileRegistryReadOnly,
+  resolveTaskCapabilityRoutes,
   resolveChromeProfile,
-  runnerSupervisorStatus,
-  runnerSupervisorStatusReadOnly,
-  startRunnerSupervisor,
-  stopRunnerSupervisor,
   submitManagedPlaywrightJob,
   validateChromeProfileDirectoryKey,
   type ManagedProfileRecord,
+  type ManagedChromiumBrowserId,
+  type ChromiumUserDataRoot,
+  type ProviderAccessClass,
+  type ProviderAccountTier,
   type ProviderId,
+  type TaskCapabilityId,
+  type TaskCapabilityRoute,
   type VisibleAction,
 } from './playwright/index.js'
 
 import {
   DEFAULT_DAEMON_URL,
-  MAX_NATIVE_MESSAGE_BYTES,
+  MAX_DAEMON_REQUEST_BYTES,
   buildTokenlessPrompt,
+  browserRuntimeStatus,
+  quiesceBrowserRuntime,
   cancelDaemonJob,
   createDaemonJob,
   daemonUrl,
   deriveTaskId,
+  drainDaemonReplay,
   ensureDaemonReady,
   getDaemonJob,
+  getProviderCapacity,
   inspectManagedRuntime,
   listDaemonJobs,
+  markDaemonJobReported,
   normalizeBrowserId,
+  normalizeManagedProfileProxy,
   normalizeBrowserVisibility,
+  openBrowserRuntimeProfile,
+  openTokenlessDashboard,
   openProviderUrl,
   persistDaemonSnapshot,
   probeDaemonReady,
   providerWakeUrl,
-  readLiveBridgeMarker,
   readTokenlessConfig,
+  hasConfiguredTokenlessLanguage,
   removeStagedVisibleAttachmentBundle,
   resolveChromiumBrowser,
+  resolveProviderConversation,
+  resolveProviderMapping,
   resumeDaemonJob,
+  semanticVersionMajor,
   stageVisibleAttachments,
+  stopDaemon,
   tokenlessHome,
   waitDaemonJobResult,
-  waitForExtensionBridge,
   writeTokenlessConfig,
 } from './index.js'
+import {
+  activeTokenlessLanguage,
+  detectSystemLanguage,
+  localizeText,
+  setActiveLanguage,
+} from './localization.js'
+import { DAEMON_TASK_STATE_SCHEMA_ID } from './schema-ids.js'
 import {
   inspectTokenlessSkills,
-  installTokenlessSkills,
 } from './setup-workflow.js'
+import { reconcileTokenlessMaintenance } from './maintenance.js'
+import { DaemonRuntimeState } from './daemon/runtime-state.js'
+import { fetchTokenlessLatestVersion } from './npm-registry.js'
 import {
   SETUP_MANAGED_PROFILE_DISCLOSURE,
   SETUP_READINESS_DISCLOSURE,
@@ -69,8 +101,42 @@ import {
 } from './setup-presenter.js'
 import { tokenlessPackageVersion } from './platform-package.js'
 import { formatUpgradeProgress, formatUpgradeSummary, runUpgradeCommand } from './upgrade.js'
-
-type CliArgs = Record<string, any> & { attachFiles: string[]; files: string[] }
+import {
+  BrowserRuntimeManager,
+  isSystemBrowserId,
+  managedBrowserCatalogEntry,
+  normalizeBrowserSelection,
+  type BrowserCandidate,
+  type BrowserRuntimeBinding,
+  type BrowserSelection,
+  type ResolvedBrowserRuntime,
+} from './browser-runtime/index.js'
+
+const CLI_ARG_FLAGS: unique symbol = Symbol('tokenless.cliArgFlags')
+
+type CliArgs = Record<string, any> & {
+  attachFiles: string[]
+  capabilities: string[]
+  files: string[]
+  [CLI_ARG_FLAGS]?: Record<string, string[]>
+}
+type CliUsageDetails = {
+  command: string
+  usage: string[]
+  commonOptions: string[]
+  validOptions: string[]
+  invalidOptions?: string[] | undefined
+  validCommands?: string[] | undefined
+}
+type CommandContext = {
+  command: string
+  subcommand?: string | undefined
+}
+type CommandContract = CommandContext & {
+  usage: string[]
+  options: readonly string[]
+  subcommands?: readonly string[] | undefined
+}
 type StatusEvent = Record<string, any>
 type CliError = Error & {
   code?: string
@@ -79,22 +145,24 @@ type CliError = Error & {
   upstreamStatus?: number
   requestId?: string
   statusLog?: StatusEvent[]
+  usage?: CliUsageDetails
+  exitCode?: number
+  context?: Record<string, any>
 }
 type StatusReporter = {
   events: StatusEvent[]
   report(event: StatusEvent): void
   lastStatus(): string | undefined
 }
-type SetupProviderClassification = 'ready' | 'action_required' | 'failed'
+type SetupProviderClassification = 'authenticated' | 'unauthenticated' | 'unknown' | 'failed'
 type SetupProviderReadiness = {
   provider: string
   classification: SetupProviderClassification
   auth: 'authenticated' | 'unauthenticated' | 'unknown'
+  access: ManagedAuthObservation['access']
   status: string
   jobId?: string | undefined
   blocker?: unknown
-  userAction?: Record<string, any> | undefined
-  handoff?: Record<string, any> | undefined
   error?: Record<string, any> | undefined
 }
 type SetupTechnicalFailure = {
@@ -105,17 +173,80 @@ type SetupTechnicalFailure = {
   jobId?: string | undefined
   statusLog?: StatusEvent[] | undefined
 }
+type ManagedAuthObservation = {
+  state: 'authenticated' | 'unauthenticated' | 'unknown'
+  access: ProviderAccessClass
+  account?: {
+    name: string | null
+    subscription: string | null
+    tier: ProviderAccountTier
+  }
+}
+type SetupCliVersionCheck = {
+  packageName: 'tokenless'
+  registryUrl: string
+  currentVersion: string
+  currentMajor: number | null
+  latestVersion: string | null
+  latestMajor: number | null
+  status: 'up_to_date' | 'update_available' | 'check_unavailable'
+  updateAvailable: boolean | null
+  ok: boolean
+  error?: {
+    code: string
+    message: string
+    retryable: boolean
+  } | undefined
+}
+
+type CloakProfileCompatibility = 'aligned' | 'not_aligned' | 'unknown'
+type SetupCloakProfileCandidate = {
+  browser: ManagedChromiumBrowserId
+  browserDisplayName: string
+  userDataDir: string
+  directoryKey: string
+  detectedVersion: string | null
+  versionSource: 'profile' | 'installed_browser' | 'unknown'
+  compatibility: CloakProfileCompatibility
+}
+type SetupCloakProfileInventory = {
+  projectUrl: string
+  artifactVersion: string
+  browserVersion: string
+  candidates: SetupCloakProfileCandidate[]
+}
+type SetupCloakImportSelection = {
+  browser: ManagedChromiumBrowserId
+  userDataDir: string
+  directoryKey: string
+}
 
 const DEFAULT_RUN_TIMEOUT_MS = 180_000
+const CLOAK_BROWSER_PROJECT_URL = 'https://github.com/CloakHQ/CloakBrowser'
 const LONG_RUNNING_READ_TIMEOUT_MS = 2_100_000
 const LONG_RUNNING_JOB_TIMEOUT_MS = 2_160_000
+const PROVIDER_OBSERVATION_FRESHNESS_MS = 5 * 60 * 1000
 const PRIORITY_VISIBLE_PROVIDER_ACTIONS = new Set([
+  'capability.inspect',
   'auth.status',
   'model.inspect',
   'model.select',
   'effort.inspect',
   'effort.select',
+  'qwen.mode.inspect',
+  'qwen.mode.select',
+  'deepseek.mode.inspect',
+  'deepseek.mode.select',
+  'deepseek.deepthink.inspect',
+  'deepseek.deepthink.select',
+  'deepseek.search.inspect',
+  'deepseek.search.select',
+  'doubao.mode.inspect',
+  'doubao.mode.select',
+  'doubao.skill.inspect',
+  'doubao.skill.select',
   'file.upload',
+  'workspace.ensure',
   'prompt.clear',
   'prompt.input',
   'prompt.submit',
@@ -124,27 +255,83 @@ const PRIORITY_VISIBLE_PROVIDER_ACTIONS = new Set([
   'navigation.check',
   'blocker.check',
 ])
-let args: CliArgs = { attachFiles: [], files: [], json: process.argv.includes('--json') }
+const PRIORITY_VISIBLE_PROVIDER_ACTION_LIST = [...PRIORITY_VISIBLE_PROVIDER_ACTIONS].join(', ')
+const VISIBLE_PROVIDER_USAGE = `<${supportedVisibleProviderIds().join('|') || 'provider'}>`
+const COMMAND_CONTRACTS = createCommandContracts()
+const TOP_LEVEL_COMMANDS = new Set(COMMAND_CONTRACTS.filter((contract) => !contract.command.includes(' ')).map((contract) => contract.command))
+const COMMAND_CONTRACT_BY_KEY = new Map(COMMAND_CONTRACTS.map((contract) => [commandContractKey(contract), contract]))
+const TOP_LEVEL_USAGE = [
+  'tokenless <command> [options]',
+  `tokenless run --provider ${VISIBLE_PROVIDER_USAGE} --prompt <text> --json`,
+  'tokenless capabilities list --json',
+  'tokenless limits inspect --profile <slug> --provider <provider> --json',
+  'tokenless replay --agent-kind <kind> --agent-session-id <id> --json',
+  'tokenless profiles <subcommand> [options]',
+  'tokenless dashboard [--no-open] [--json]',
+  'tokenless daemon stop [--json]',
+  'tokenless help',
+]
+let args: CliArgs = { attachFiles: [], capabilities: [], files: [], json: process.argv.includes('--json') }
+
+await initializeCliLanguage(process.argv.slice(2))
 
 try {
   const argv = process.argv.slice(2)
   const versionRequested = argv.length === 1 && (argv[0] === '-V' || argv[0] === '--version')
+  const helpRequested = argv.length === 1 && (argv[0] === '-h' || argv[0] === '--help')
   let command: string
   if (versionRequested) {
     argv.shift()
     command = 'version'
+  } else if (helpRequested) {
+    argv.shift()
+    command = 'help'
   } else {
     command = argv[0]?.startsWith('-') ? 'prompt' : (argv.shift() ?? 'help')
   }
-  const subcommand = command === 'profiles' ? argv.shift() : undefined
-  args = parseArgs(argv)
-  assertCommandRoutingArguments(command, args)
+  const subcommand = (command === 'profiles' || command === 'daemon' || command === 'capabilities' || command === 'limits') && argv[0] && !argv[0].startsWith('-')
+    ? argv.shift()
+    : undefined
+  assertKnownTopLevelCommand(command)
+  args = parseArgs(argv, { command, subcommand })
+  if (helpRequested) {
+    printCommandHelp({ command: 'tokenless' })
+    process.exit(0)
+  }
+  if (args.help === true && !COMMAND_CONTRACT_BY_KEY.has(commandContractKey({ command, subcommand })) && validSubcommandsFor(command).length > 0) {
+    const unsupported = unsupportedArgumentFlags(args, new Set(['help']))
+    if (unsupported.length > 0) {
+      throw commandUsageError(
+        'invalid_option',
+        `${commandDisplayName({ command })} does not accept option${unsupported.length === 1 ? '' : 's'}: ${unsupported.join(', ')}.`,
+        { command },
+        unsupported,
+      )
+    }
+    printCommandHelp({ command })
+    process.exit(0)
+  }
+  assertCommandRoutingArguments(command, subcommand, args)
+  if (args.help === true) {
+    printCommandHelp({ command, subcommand })
+    process.exit(0)
+  }
   if (command === 'version') {
     console.log(tokenlessPackageVersion())
   } else if (command === 'profiles') {
     await profilesCommand(subcommand, args)
+  } else if (command === 'daemon') {
+    await daemonCommand(subcommand, args)
+  } else if (command === 'dashboard') {
+    await dashboardCommand(args)
   } else if (command === 'run') {
     await runCommand(args)
+  } else if (command === 'capabilities') {
+    await capabilitiesCommand(subcommand, args)
+  } else if (command === 'limits') {
+    await limitsCommand(subcommand, args)
+  } else if (command === 'replay') {
+    await replayCommand(args)
   } else if (command === 'provider-status' || command === 'provider-auth-status') {
     await providerStatusCommand(args)
   } else if (command === 'provider-action') {
@@ -171,11 +358,11 @@ try {
     await installCommand(args)
   } else if (command === 'upgrade') {
     const humanOutput = args.json !== true
-    if (humanOutput) console.error('Tokenless upgrade')
+    if (humanOutput) console.error(localizeText('Tokenless upgrade'))
     const result = await runUpgradeCommand(args, humanOutput
-      ? { onProgress: (event) => console.error(formatUpgradeProgress(event)) }
+      ? { onProgress: (event) => console.error(localizeText(formatUpgradeProgress(event))) }
       : undefined)
-    if (humanOutput) console.log(formatUpgradeSummary(result))
+    if (humanOutput) console.log(localizeText(formatUpgradeSummary(result)))
     else printPayload(result, args)
     if (!result.ok) process.exitCode = 1
   } else if (command === 'doctor') {
@@ -194,7 +381,7 @@ try {
     ok: false,
     error: {
       code: cliError.code || 'tokenless_cli_error',
-      message: cliError.message || 'Tokenless CLI failed.',
+      message: localizeText(cliError.message || 'Tokenless CLI failed.'),
       retryable: Boolean(cliError.retryable),
     },
   }
@@ -203,93 +390,131 @@ try {
   if (cliError.requestId) payload.error.requestId = cliError.requestId
   if (typeof cliError.status === 'string' && cliError.status) payload.status = cliError.status
   if (Array.isArray(cliError.statusLog)) payload.statusLog = cliError.statusLog
+  if (cliError.usage) payload.error.usage = cliError.usage
+  if (cliError.context) payload.error.context = cliError.context
   if (args.json) console.log(JSON.stringify(payload, null, 2))
-  else console.error(`${payload.error.code}: ${payload.error.message}`)
-  process.exit(1)
+  else console.error(formatCliError(payload, cliError.usage))
+  process.exit(cliError.exitCode ?? 1)
 }
 
 async function profilesCommand(subcommand: string | undefined, args: CliArgs) {
-  assertProfilesCommandArguments(subcommand, args)
-
   if (subcommand === 'discover') {
-    const browser = normalizeProfileImportBrowser(args.browser)
-    const roots = await discoverChromiumProfiles({
-      browser,
-      ...(args.chromeUserDataDir === undefined ? {} : { userDataDirs: [String(args.chromeUserDataDir)] }),
-    })
+    const browser = normalizeProfileDiscoveryBrowser(args.browser)
+    if (browser === 'all' && args.chromeUserDataDir !== undefined) {
+      throw usageError(
+        'profile_discovery_root_requires_browser',
+        '--browser-user-data-dir requires one explicit browser instead of all.',
+      )
+    }
+    const roots = browser === 'all'
+      ? await discoverKnownChromiumProfiles()
+      : await discoverChromiumProfiles({
+          browser,
+          ...(args.chromeUserDataDir === undefined ? {} : { userDataDirs: [String(args.chromeUserDataDir)] }),
+        })
+    const cloakInventory = buildCloakProfileInventory(roots, [])
     printPayload({
       ok: true,
       browser,
+      cloak: {
+        projectUrl: cloakInventory.projectUrl,
+        artifactVersion: cloakInventory.artifactVersion,
+        browserVersion: cloakInventory.browserVersion,
+      },
       roots: roots.map((root) => ({
+        browser: root.browser,
         userDataDir: root.userDataDir,
+        browserVersion: root.browserVersion,
         profiles: root.profiles.map((profile) => ({
           directoryKey: profile.directoryKey,
           name: profile.name,
           isDefault: profile.isDefault,
+          browserVersion: profile.browserVersion,
+          cloakCompatibility: cloakInventory.candidates.find((candidate) =>
+            candidate.browser === root.browser &&
+            candidate.userDataDir === root.userDataDir &&
+            candidate.directoryKey === profile.directoryKey
+          )?.compatibility ?? 'unknown',
         })),
       })),
     }, args)
     return
   }
 
+  if (
+    (subcommand === 'add' && args.importChromeProfile !== undefined) ||
+    subcommand === 'reset'
+  ) {
+    requireOpaqueProfileCopyConsent(args)
+  }
+
   const homeDir = tokenlessHome(args.home)
   const registry = new ManagedProfileRegistry(homeDir)
 
   if (subcommand === 'add') {
     const slug = requiredAdminValue(args.profile, '--profile')
-    const importKey = args.importChromeProfile === undefined
-      ? undefined
-      : validateChromeProfileDirectoryKey(String(args.importChromeProfile))
-    const importProviders = importKey
-      ? requireProfileImportProviders(args.preferredProviders)
-      : []
-    if (importKey && args.consentLocalProfileCopy !== true) {
-      throw usageError(
-        'profile_import_consent_required',
-        'Importing a local browser profile requires --consent-local-profile-copy.'
+    const profileConfig = await readTokenlessConfig(homeDir)
+    const requestedBrowser = args.browser === undefined
+      ? profileConfig.browser
+      : normalizeCliBrowser(args.browser)
+    const profileRuntime = await new BrowserRuntimeManager({ homeDir }).ensure(
+      requestedBrowser,
+      {
+        allowDownload: false,
+        browserExecutablePath: browserExecutablePathForSelection(profileConfig, requestedBrowser),
+      },
+    )
+    if (
+      args.browser === undefined &&
+      (
+        profileConfig.browser !== profileRuntime.selection ||
+        profileConfig.browserExecutablePath !== profileRuntime.executablePath
       )
+    ) {
+      await writeTokenlessConfig({
+        homeDir,
+        browser: profileRuntime.selection,
+        browserExecutablePath: profileRuntime.executablePath,
+      })
     }
-    const importSource = importKey
-      ? await resolveProfileImportSource(args, importKey)
-      : null
-    const lifecycle = importKey ? 'importing' : 'ready'
+    const importKey = args.importChromeProfile === undefined
+      ? null
+      : validateChromeProfileDirectoryKey(String(args.importChromeProfile))
+    const source = importKey ? await resolveOpaqueProfileSource(args, profileRuntime, importKey) : null
+    if (source) assertCloakProfileImportCompatible(source, profileRuntime)
     let record = await registry.addProfile({
       slug,
-      ...(args.label === undefined
-        ? (importSource ? { label: importSource.profile.name } : {})
-        : { label: String(args.label) }),
-      ...(args.label === undefined && importSource ? { labelOrigin: 'import' as const } : {}),
+      ...(args.label === undefined ? (source ? { label: source.name, labelOrigin: 'import' as const } : {}) : { label: String(args.label) }),
       setDefault: args.setDefault === true,
-      lifecycle,
+      lifecycle: source ? 'importing' : 'ready',
+      runtimeBinding: browserRuntimeBinding(profileRuntime),
     })
-    let imported: Record<string, any> | null = null
+    let copiedFiles: number | null = null
     try {
-      if (importKey && importSource) {
-        imported = await importChromeProfile({
-          sourceUserDataDir: importSource.userDataDir,
-          profileDirectoryKey: importKey,
+      if (source) {
+        const copied = await copyOpaqueChromiumProfile({
+          sourceUserDataDir: source.userDataDir,
+          profileDirectoryKey: source.directoryKey,
           destinationDir: record.directory,
           tokenlessHome: homeDir,
-          providers: importProviders,
         })
+        copiedFiles = copied.copiedFiles
         record = await registry.markImported(record.slug, {
-          source: importSource.userDataDir,
-          profileDirectoryKey: importKey,
-          profileName: importSource.profile.name,
-          browser: importSource.browser,
-          providers: importProviders,
+          source: source.userDataDir,
+          profileDirectoryKey: source.directoryKey,
+          profileName: source.name,
+          browser: source.browser,
+          browserVersion: source.browserVersion,
         })
       }
     } catch (error) {
-      await registry.removeProfile(record.slug, { confirmDelete: true }).catch(async () => {
-        await registry.updateLifecycle(record.slug, 'failed').catch(() => undefined)
-      })
+      await registry.removeProfile(record.slug, { confirmDelete: true }).catch(() => undefined)
       throw error
     }
     printPayload({
       ok: true,
       profile: publicManagedProfile(record, await defaultProfileSlug(registry)),
-      ...(imported ? { import: imported } : {}),
+      ...(copiedFiles === null ? {} : { import: { copiedFiles, opaque: true } }),
     }, args)
     return
   }
@@ -300,57 +525,35 @@ async function profilesCommand(subcommand: string | undefined, args: CliArgs) {
       throw usageError('profile_reset_requires_import', `Managed profile '${record.slug}' was not imported and has no source to reset from.`)
     }
     const config = await readTokenlessConfig(homeDir)
-    const configuredProviders = Array.isArray(config.preferredProviders)
-      ? config.preferredProviders.map(normalizeProvider)
-      : []
-    const providers = args.preferredProviders === undefined
-      ? [...(record.import.providers ?? configuredProviders)]
-      : requireProfileImportProviders(args.preferredProviders)
-    if (providers.length === 0) {
-      throw usageError(
-        'profile_reset_provider_required',
-        'Legacy imported profiles require configured providers or --preferred-providers before reset.'
-      )
-    }
-    const source = await resolveChromeProfile(record.import.source, record.import.profileDirectoryKey)
-    const runner = await stopRunnerSupervisor({ homeDir })
+    const runner = await quiesceBrowserRuntimeForProfileMutation({ homeDir, daemonUrl: config.daemonUrl ?? undefined })
     if (runner.state === 'unsafe') {
-      throw usageError(
-        'profile_reset_runner_unsafe',
-        'Cannot reset the managed profile while its Playwright runner identity is unverified.'
-      )
+      throw usageError('profile_reset_runner_unsafe', 'Cannot reset the managed profile while its Playwright runner identity is unverified.')
     }
-    const failureLifecycle = record.lifecycle === 'ready' ? 'ready' : 'failed'
+    const source = await resolveChromeProfile(record.import.source, record.import.profileDirectoryKey)
     await registry.updateLifecycle(record.slug, 'importing')
     try {
-      const imported = await importChromeProfile({
+      const imported = await copyOpaqueChromiumProfile({
         sourceUserDataDir: source.userDataDir,
         profileDirectoryKey: source.directoryKey,
         destinationDir: record.directory,
         tokenlessHome: homeDir,
-        providers,
       })
       const updated = await registry.markImported(record.slug, {
         source: source.userDataDir,
         profileDirectoryKey: source.directoryKey,
         profileName: source.name,
         ...(record.import.browser ? { browser: record.import.browser } : {}),
-        providers,
+        browserVersion: source.browserVersion,
       })
       printPayload({
         ok: true,
         profile: publicManagedProfile(updated, await defaultProfileSlug(registry)),
-        import: {
-          copiedFiles: imported.copiedFiles,
-          cookieAuth: imported.cookieAuth,
-          syncDisabled: imported.syncDisabled,
-        },
+        import: { copiedFiles: imported.copiedFiles, opaque: true },
         runner,
-        compactOutput: `Reset managed profile '${updated.slug}' from ${source.name}. Imported ${imported.cookieAuth.totalCookies} selected provider cookies for ${providers.join(', ')}.`,
       }, args)
       return
     } catch (error) {
-      await registry.updateLifecycle(record.slug, failureLifecycle).catch(() => undefined)
+      await registry.updateLifecycle(record.slug, 'failed').catch(() => undefined)
       throw error
     }
   }
@@ -367,7 +570,7 @@ async function profilesCommand(subcommand: string | undefined, args: CliArgs) {
     const targets = clearAll
       ? await registry.listProfiles()
       : [await registry.resolveProfile(selectedSlug!)]
-    const runner = await stopRunnerSupervisor({ homeDir })
+    const runner = await quiesceBrowserRuntimeForProfileMutation({ homeDir })
     if (runner.state === 'unsafe') {
       throw usageError(
         'profile_clear_runner_unsafe',
@@ -411,7 +614,7 @@ async function profilesCommand(subcommand: string | undefined, args: CliArgs) {
       throw usageError('profile_delete_confirmation_required', 'Profile removal requires --confirm-delete.')
     }
     await registry.resolveProfile(slug)
-    const runner = await stopRunnerSupervisor({ homeDir })
+    const runner = await quiesceBrowserRuntimeForProfileMutation({ homeDir })
     const record = await registry.removeProfile(slug, { confirmDelete: true })
     printPayload({
       ok: true,
@@ -421,29 +624,37 @@ async function profilesCommand(subcommand: string | undefined, args: CliArgs) {
     return
   }
 
-  if (subcommand === 'status' || subcommand === 'open') {
-    const provider = normalizeProvider(args.provider || process.env.TOKENLESS_PROVIDER || 'chatgpt')
+  if (subcommand === 'status' || (subcommand === 'open' && args.provider !== undefined)) {
+    const provider = normalizeProvider(
+      subcommand === 'open'
+        ? args.provider
+        : (args.provider || process.env.TOKENLESS_PROVIDER || defaultVisibleProviderId())
+    )
     const visibleAction = subcommand === 'status' ? VISIBLE_ACTIONS.AUTH_STATUS : VISIBLE_ACTIONS.NAVIGATION_CHECK
     const result = await executeManagedPlaywrightJob({
       args: subcommand === 'open' ? { ...args, browserVisibility: 'headed' } : args,
       provider,
       request: createManagedPlaywrightJobRequest({
         provider,
-        target: { kind: 'provider_home', url: managedProviderTargetUrl(provider, args.targetUrl) },
+        target: { kind: 'provider_home', url: managedProviderExplicitTargetUrl(provider, args.targetUrl) },
         actions: [{ action: visibleAction, payload: {} }],
       }),
       taskId: args.taskId || `profile:${subcommand}:${randomUUID()}`,
       statusEventAction: `profiles.${subcommand}`,
       noWait: false,
     })
-    const observedAuth = subcommand === 'status'
-      ? authStateFromManagedResult(result.waitResult?.result)
+    const authObservation = subcommand === 'status'
+      ? authObservationFromManagedResult(result.waitResult?.result)
       : null
-    const profile = observedAuth
+    const profile = authObservation
       ? await registry.updateProviderStatus(result.profile.slug, {
           provider,
-          auth: observedAuth,
+          auth: authObservation.state,
+          access: authObservation.access,
           checkedAt: new Date().toISOString(),
+          ...(authObservation.state === 'authenticated' && authObservation.account
+            ? { account: authObservation.account }
+            : {}),
         })
       : result.profile
     printPayload({
@@ -463,10 +674,233 @@ async function profilesCommand(subcommand: string | undefined, args: CliArgs) {
     return
   }
 
+  if (subcommand === 'open') {
+    if (args.targetUrl !== undefined) {
+      throw usageError('profile_open_provider_required', '--target-url requires --provider for profiles open.')
+    }
+    const config = await readTokenlessConfig(homeDir)
+    const configuredDaemonUrl = daemonUrl(args.daemonUrl ?? config.daemonUrl ?? undefined)
+    const statusReporter = createCliStatusReporter(args)
+    const profile = await registry.resolveProfile(args.profile)
+    const daemon = await ensureDaemonReady({
+      homeDir,
+      daemonUrl: configuredDaemonUrl,
+      timeoutMs: optionalNumber(args.daemonStartTimeoutMs),
+    })
+    const actualDaemonUrl = daemon.url
+    statusReporter.report({
+      event: daemon.started ? 'daemon_started' : 'daemon_ready',
+      status: 'ready',
+      daemonUrl: actualDaemonUrl,
+      daemonPid: daemon.pid,
+      backend: PLAYWRIGHT_EXECUTION_BACKEND,
+    })
+    if (args.daemonUrl === undefined && config.daemonUrl !== configuredDaemonUrl) {
+      await writeTokenlessConfig({ homeDir, daemonUrl: configuredDaemonUrl })
+    }
+    const opened = await openBrowserRuntimeProfile({
+      daemonUrl: actualDaemonUrl,
+      homeDir,
+      profileId: profile.id,
+      browserVisibility: 'headed',
+    })
+    const runner = browserRuntimeOpenRunnerStatus(opened.status, daemon.started)
+    statusReporter.report({
+      event: 'managed_profile_opened',
+      status: opened.status.status,
+      backend: PLAYWRIGHT_EXECUTION_BACKEND,
+      action: 'profiles.open',
+      profileId: profile.id,
+      browserVisibility: opened.browserVisibility,
+      effectiveBrowserVisibility: opened.effectiveBrowserVisibility,
+    })
+    printPayload({
+      ok: true,
+      command: 'profiles.open',
+      transport: 'daemon',
+      backend: PLAYWRIGHT_EXECUTION_BACKEND,
+      profile: publicManagedProfile(profile, await defaultProfileSlug(registry)),
+      runner,
+      browser: {
+        requestedVisibility: opened.browserVisibility,
+        effectiveVisibility: opened.effectiveBrowserVisibility,
+        pageCount: opened.pageCount,
+      },
+      compactOutput: `Opened managed profile '${profile.slug}' in a headed browser.`,
+      status: opened.status.status,
+      statusLog: statusReporter.events,
+    }, args)
+    return
+  }
+
   throw usageError('profiles_command_invalid', 'Profiles subcommand must be add, discover, list, status, open, set-default, or remove.')
 }
 
+async function dashboardCommand(args: CliArgs) {
+  const homeDir = tokenlessHome(args.home)
+  const config = await readTokenlessConfig(homeDir)
+  const configuredDaemonUrl = daemonUrl(args.daemonUrl ?? config.daemonUrl ?? undefined)
+  const daemon = await ensureDaemonReady({
+    homeDir,
+    daemonUrl: configuredDaemonUrl,
+    timeoutMs: optionalNumber(args.daemonStartTimeoutMs),
+  })
+  const profile = await new ManagedProfileRegistry(homeDir).resolveProfile(
+    args.profile === undefined ? undefined : String(args.profile),
+  )
+  const dashboard = await openTokenlessDashboard({
+    homeDir,
+    daemonUrl: daemon.url,
+    profileId: profile.id,
+    open: args.noOpen !== true,
+  })
+  printPayload({
+    ok: true,
+    command: 'dashboard',
+    daemon: { url: daemon.url, started: daemon.started, pid: daemon.pid },
+    profile: { slug: profile.slug, id: profile.id, label: profile.label },
+    dashboard: {
+      url: dashboard.bootstrapUrl,
+      expiresAt: dashboard.expiresAt,
+      opened: dashboard.opened !== null,
+      reused: dashboard.opened?.reused ?? false,
+    },
+    compactOutput: args.noOpen === true
+      ? `Dashboard ready for managed profile '${profile.slug}': ${dashboard.bootstrapUrl}`
+      : `Opened the Tokenless dashboard in managed profile '${profile.slug}'.`,
+  }, args)
+}
+
+async function quiesceBrowserRuntimeForProfileMutation({
+  homeDir,
+  daemonUrl: explicitDaemonUrl,
+  startIfUnavailable = true,
+}: {
+  homeDir: string
+  daemonUrl?: string | undefined
+  startIfUnavailable?: boolean | undefined
+}) {
+  const configuredDaemonUrl = daemonUrl(explicitDaemonUrl ?? await profileMutationConfiguredDaemonUrl(homeDir))
+  try {
+    await quiesceBrowserRuntime({ homeDir, daemonUrl: configuredDaemonUrl })
+    return stoppedRunnerStatus()
+  } catch (error) {
+    if (shouldEnsureDaemonBeforeProfileMutationFallback(error)) {
+      if (!startIfUnavailable) return stoppedRunnerStatus()
+      const daemon = await ensureDaemonReady({ homeDir, daemonUrl: configuredDaemonUrl })
+      await quiesceBrowserRuntime({ homeDir, daemonUrl: daemon.url })
+      return stoppedRunnerStatus()
+    }
+    throw error
+  }
+}
+
+async function profileMutationConfiguredDaemonUrl(homeDir: string) {
+  try {
+    return (await readTokenlessConfig(homeDir)).daemonUrl ?? undefined
+  } catch {
+    return undefined
+  }
+}
+
+function stoppedRunnerStatus() {
+  return {
+    state: 'stopped',
+    pid: null,
+    sessionId: null,
+    safeToStop: false,
+    heartbeatAt: null,
+  }
+}
+
+async function embeddedRunnerStatus({
+  homeDir,
+  daemonUrl: configuredDaemonUrl,
+}: {
+  homeDir: string
+  daemonUrl: string
+}) {
+  const status = await browserRuntimeStatus({ homeDir, daemonUrl: configuredDaemonUrl })
+  return {
+    state: status.status === 'running' ? 'running' : 'stopped',
+    pid: status.pid,
+    sessionId: 'embedded',
+    safeToStop: false,
+    heartbeatAt: null,
+    started: false,
+    runtime: 'embedded',
+    runtimeStatus: status.status,
+    activeProfileCount: status.activeProfileCount,
+    activeJobCount: status.activeJobCount,
+  }
+}
+
+function browserRuntimeOpenRunnerStatus(
+  status: Awaited<ReturnType<typeof browserRuntimeStatus>>,
+  started: boolean,
+) {
+  return {
+    state: status.status === 'running' ? 'running' : 'stopped',
+    pid: status.pid,
+    sessionId: 'embedded',
+    safeToStop: false,
+    heartbeatAt: null,
+    started,
+    runtime: 'embedded',
+    runtimeStatus: status.status,
+    activeProfileCount: status.activeProfileCount,
+    activeJobCount: status.activeJobCount,
+  }
+}
+
+async function doctorRunnerStatus({
+  homeDir,
+  daemonUrl: configuredDaemonUrl,
+  daemonReady,
+  daemonHealthy,
+}: {
+  homeDir: string
+  daemonUrl: string
+  daemonReady: boolean
+  daemonHealthy: boolean
+}) {
+  if (daemonReady) {
+    try {
+      const status = await browserRuntimeStatus({ homeDir, daemonUrl: configuredDaemonUrl })
+      return {
+        ok: status.status === 'running',
+        state: status.status === 'running' ? 'running' : 'stopped',
+        pid: status.pid,
+        sessionId: 'embedded',
+        safeToStop: false,
+        heartbeatAt: null,
+        runtime: 'embedded',
+        runtimeStatus: status.status,
+        activeProfileCount: status.activeProfileCount,
+        activeJobCount: status.activeJobCount,
+      }
+    } catch (error) {
+      return { ok: false, state: 'unknown', message: error instanceof Error ? error.message : String(error) }
+    }
+  }
+  return {
+    ok: daemonHealthy,
+    ...stoppedRunnerStatus(),
+    runtime: 'embedded',
+    runtimeStatus: 'stopped',
+  }
+}
+
+function shouldEnsureDaemonBeforeProfileMutationFallback(error: unknown) {
+  const caught = error as CliError
+  return caught.code === 'daemon_unavailable' || caught.code === 'daemon_token_unavailable'
+}
+
 function authStateFromManagedResult(value: unknown): 'authenticated' | 'unauthenticated' | 'unknown' | null {
+  return authObservationFromManagedResult(value)?.state ?? null
+}
+
+function authObservationFromManagedResult(value: unknown): ManagedAuthObservation | null {
   if (!value || typeof value !== 'object') return null
   const responses = (value as { responses?: unknown }).responses
   if (!Array.isArray(responses)) return null
@@ -476,10 +910,65 @@ function authStateFromManagedResult(value: unknown): 'authenticated' | 'unauthen
     (response as { action?: unknown }).action === VISIBLE_ACTIONS.AUTH_STATUS &&
     (response as { ok?: unknown }).ok === true
   ))
-  const state = auth && typeof auth === 'object'
-    ? ((auth as { result?: { state?: unknown } }).result?.state)
+  const result = auth && typeof auth === 'object'
+    ? (auth as { result?: unknown }).result
     : null
-  return state === 'authenticated' || state === 'unauthenticated' || state === 'unknown' ? state : null
+  if (!result || typeof result !== 'object') return null
+  const state = (result as { state?: unknown }).state
+  if (state !== 'authenticated' && state !== 'unauthenticated' && state !== 'unknown') return null
+  const access = managedProviderAccess((result as { access?: unknown }).access, state)
+  if (state !== 'authenticated') return { state, access }
+  const account = managedAuthAccount((result as { account?: unknown }).account)
+  return {
+    state,
+    access,
+    ...(account ? { account } : {}),
+  }
+}
+
+function managedAuthAccount(value: unknown): ManagedAuthObservation['account'] | null {
+  if (!value || typeof value !== 'object') return null
+  const name = managedAuthAccountValue((value as { name?: unknown }).name)
+  const subscription = managedAuthAccountValue((value as { subscription?: unknown }).subscription)
+  if (name === undefined || subscription === undefined) return null
+  const tier = managedAuthAccountTier((value as { tier?: unknown }).tier)
+  return { name, subscription, tier }
+}
+
+function managedProviderAccess(
+  value: unknown,
+  state: ManagedAuthObservation['state'],
+): ManagedAuthObservation['access'] {
+  if (
+    value === 'guest' ||
+    value === 'sign_in_required' ||
+    value === 'signed_in_free' ||
+    value === 'signed_in_paid' ||
+    value === 'signed_in_unknown' ||
+    value === 'unknown'
+  ) return value
+  return state === 'authenticated' ? 'signed_in_unknown' : 'unknown'
+}
+
+function managedAuthAccountTier(value: unknown): NonNullable<ManagedAuthObservation['account']>['tier'] {
+  if (!value || typeof value !== 'object') return { class: 'signed_in_unknown', label: null }
+  const tierClass = (value as { class?: unknown }).class
+  if (
+    tierClass !== 'signed_in_free' &&
+    tierClass !== 'signed_in_paid' &&
+    tierClass !== 'signed_in_unknown'
+  ) return { class: 'signed_in_unknown', label: null }
+  const label = managedAuthAccountValue((value as { label?: unknown }).label)
+  return {
+    class: tierClass,
+    label: label === undefined ? null : label,
+  }
+}
+
+function managedAuthAccountValue(value: unknown): string | null | undefined {
+  if (value === null) return null
+  if (typeof value !== 'string') return undefined
+  return value.replace(/\s+/g, ' ').trim().slice(0, 120) || null
 }
 
 function setupReadinessTechnicalFailure(
@@ -515,10 +1004,6 @@ function setupReadinessCaughtFailure(error: unknown): SetupTechnicalFailure {
   }
 }
 
-function isSetupActionableReadinessFailure(failure: SetupTechnicalFailure) {
-  return failure.code === 'provider_sign_in_navigation'
-}
-
 function setupReadinessErrorPayload(failure: SetupTechnicalFailure) {
   return {
     code: failure.code,
@@ -532,22 +1017,22 @@ function setupReadinessErrorPayload(failure: SetupTechnicalFailure) {
 function setupProviderSummary(readiness: Record<string, SetupProviderReadiness>) {
   const providers = Object.values(readiness)
   const counts = {
-    ready: providers.filter((provider) => provider.classification === 'ready').length,
-    action_required: providers.filter((provider) => provider.classification === 'action_required').length,
+    authenticated: providers.filter((provider) => provider.classification === 'authenticated').length,
+    unauthenticated: providers.filter((provider) => provider.classification === 'unauthenticated').length,
+    unknown: providers.filter((provider) => provider.classification === 'unknown').length,
     failed: providers.filter((provider) => provider.classification === 'failed').length,
     total: providers.length,
   }
   return {
-    status: counts.failed > 0 ? 'failed' : counts.action_required > 0 ? 'waiting_for_user' : 'ready',
+    status: counts.failed > 0 ? 'failed' : 'reported',
     counts,
     providers: Object.fromEntries(providers.map((provider) => [provider.provider, {
       classification: provider.classification,
       auth: provider.auth,
+      access: provider.access,
       status: provider.status,
       ...(provider.jobId === undefined ? {} : { jobId: provider.jobId }),
       ...(provider.error === undefined ? {} : { error: provider.error }),
-      ...(provider.userAction === undefined ? {} : { userAction: provider.userAction }),
-      ...(provider.handoff === undefined ? {} : { handoff: provider.handoff }),
     }])),
   }
 }
@@ -566,250 +1051,221 @@ function firstSetupFailure(readiness: Record<string, SetupProviderReadiness>): S
   return null
 }
 
-function setupReadinessHandoffDetail({
-  provider,
+function setupReportedCompactOutput({
+  providers,
   profile,
-  jobId,
+  readiness,
+  providerSummary,
 }: {
-  provider: string
+  providers: readonly string[]
   profile: ManagedProfileRecord
-  jobId: string
+  readiness: Record<string, SetupProviderReadiness>
+  providerSummary: ReturnType<typeof setupProviderSummary>
 }) {
-  return `Job ${jobId} for ${provider} profile ${profile.slug} needs sign-in or verification in the Tokenless-managed Chrome window/tab. Wait until the ${provider} composer is visible.`
+  const classifications = providers
+    .map((provider) => `${provider}: ${readiness[provider]?.classification ?? 'unknown'}`)
+    .join('; ')
+  return `Tokenless setup checked ${providers.join(', ')} once in profile ${profile.slug}. Provider summary: ${classifications}. Counts: authenticated ${providerSummary.counts.authenticated}, unauthenticated ${providerSummary.counts.unauthenticated}, unknown ${providerSummary.counts.unknown}, failed ${providerSummary.counts.failed}.`
 }
 
-function setupReadinessUserAction({
-  provider,
+function setupFailedCompactOutput({
+  providers,
   profile,
-  jobId,
-  blocker,
+  readiness,
+  providerSummary,
 }: {
-  provider: string
+  providers: readonly string[]
   profile: ManagedProfileRecord
-  jobId: string
-  blocker?: unknown
+  readiness: Record<string, SetupProviderReadiness>
+  providerSummary: ReturnType<typeof setupProviderSummary>
 }) {
+  const classifications = providers
+    .map((provider) => {
+      const result = readiness[provider]
+      return `${provider}: ${result?.classification ?? 'unknown'}${result?.error?.code ? ` (${result.error.code})` : ''}`
+    })
+    .join('; ')
+  return `Tokenless setup checked ${providers.join(', ')} once in profile ${profile.slug}. Provider summary: ${classifications}. Counts: authenticated ${providerSummary.counts.authenticated}, unauthenticated ${providerSummary.counts.unauthenticated}, unknown ${providerSummary.counts.unknown}, failed ${providerSummary.counts.failed}.`
+}
+
+async function setupCliVersionCheck(): Promise<SetupCliVersionCheck> {
+  const currentVersion = tokenlessPackageVersion()
+  const currentMajor = semanticVersionMajor(currentVersion)
+  const latest = await fetchTokenlessLatestVersion()
+  if (!latest.ok) {
+    return {
+      packageName: 'tokenless',
+      registryUrl: latest.registryUrl,
+      currentVersion,
+      currentMajor,
+      latestVersion: null,
+      latestMajor: null,
+      status: 'check_unavailable',
+      updateAvailable: null,
+      ok: false,
+      error: {
+        code: latest.code,
+        message: latest.message,
+        retryable: true,
+      },
+    }
+  }
+  const latestMajor = semanticVersionMajor(latest.latestVersion)
+  const comparison = compareSemanticVersions(currentVersion, latest.latestVersion)
+  const updateAvailable = comparison === null ? latest.latestVersion !== currentVersion : comparison < 0
   return {
-    provider,
-    profile: {
-      slug: profile.slug,
-      id: profile.id,
-    },
-    jobId,
-    blocker,
-    message: `Use the Tokenless-managed Chrome window/tab for ${provider} profile ${profile.slug}. Complete sign-in or verification there, then wait until the ${provider} composer is visible; Tokenless will recheck or resume job ${jobId}.`,
-    resumeCommand: `tokenless state --job-id ${setupShellQuote(jobId)} --profile ${setupShellQuote(profile.slug)} --json`,
-    queryGuidance: 'Do not open ordinary Chrome or submit a replacement setup job; use the managed window/tab opened by Tokenless and query this same job/profile after the user action.',
+    packageName: 'tokenless',
+    registryUrl: latest.registryUrl,
+    currentVersion,
+    currentMajor,
+    latestVersion: latest.latestVersion,
+    latestMajor,
+    status: updateAvailable ? 'update_available' : 'up_to_date',
+    updateAvailable,
+    ok: true,
   }
 }
 
-function setupReadinessFreshRecheckAction({
-  provider,
-  profile,
-  jobId,
-  reason = 'The previous readiness check was inconclusive.',
-}: {
-  provider: string
-  profile: ManagedProfileRecord
-  jobId: string
-  reason?: string
-}) {
-  const recheckCommand = `tokenless profiles status --profile ${setupShellQuote(profile.slug)} --provider ${setupShellQuote(provider)} --json`
-  return {
-    provider,
-    profile: {
-      slug: profile.slug,
-      id: profile.id,
-    },
-    previousJobId: jobId,
-    reason,
-    message: `${reason} Use the Tokenless-managed Chrome window/tab for ${provider} profile ${profile.slug}; complete sign-in or verification until the ${provider} composer is visible, then run a fresh readiness check.`,
-    recheckCommand,
-    queryGuidance: `The completed setup readiness job ${jobId} cannot resume. Run ${recheckCommand} after the visible composer is available.`,
+function noteSetupCliVersion(check: SetupCliVersionCheck, presenter: SetupPresenter) {
+  if (check.status === 'check_unavailable') {
+    presenter.note(`Could not check npm latest tokenless version: ${check.error?.code ?? 'npm_registry_unavailable'}.`)
+  } else if (check.updateAvailable) {
+    presenter.note(`tokenless ${check.latestVersion} is available on npm; local CLI is ${check.currentVersion}.`)
+  } else {
+    presenter.success(`tokenless ${check.currentVersion} is up to date with npm.`)
   }
 }
 
-function setupReadinessFailureUserAction({
-  provider,
-  profile,
-  failure,
-}: {
-  provider: string
-  profile: ManagedProfileRecord
-  failure: SetupTechnicalFailure
-}) {
-  const recheckCommand = `tokenless profiles status --profile ${setupShellQuote(profile.slug)} --provider ${setupShellQuote(provider)} --json`
-  return {
-    provider,
-    profile: {
-      slug: profile.slug,
-      id: profile.id,
-    },
-    previousJobId: failure.jobId,
-    reason: 'The setup auth sweep could not safely inspect the provider page because it left the approved provider origin.',
-    message: `Tokenless will open ${provider} in the managed Chrome profile ${profile.slug}. Complete sign-in or verification until the ${provider} composer is visible, then run a fresh readiness check.`,
-    recheckCommand,
-    queryGuidance: `Run ${recheckCommand} after the visible composer is available.`,
+function setupCliVersionCompact(check: SetupCliVersionCheck) {
+  if (check.status === 'check_unavailable') {
+    return `CLI: tokenless ${check.currentVersion}; npm latest check unavailable (${check.error?.code ?? 'npm_registry_unavailable'}, non-blocking).`
+  }
+  if (check.updateAvailable) {
+    return `CLI: tokenless ${check.currentVersion}; npm latest ${check.latestVersion} is available.`
   }
+  return `CLI: tokenless ${check.currentVersion}; npm latest ${check.latestVersion} is up to date.`
 }
 
-function setupHandoffAction({
-  provider,
-  profile,
-  jobId,
-  status,
-}: {
-  provider: string
-  profile: ManagedProfileRecord
-  jobId: string
-  status: string
-}) {
-  return {
-    provider,
-    profile: {
-      slug: profile.slug,
-      id: profile.id,
-    },
-    jobId,
-    status,
-    message: `Tokenless opened or foregrounded ${provider} in the managed Chrome profile ${profile.slug}. Complete sign-in or verification until the ${provider} composer is visible.`,
-    recheckCommand: `tokenless profiles status --profile ${setupShellQuote(profile.slug)} --provider ${setupShellQuote(provider)} --json`,
-  }
-}
-
-function setupWaitingCompactOutput({
-  providers,
-  profile,
-  userActions,
-  readiness,
-  providerSummary,
-}: {
-  providers: readonly string[]
-  profile: ManagedProfileRecord
-  userActions: Record<string, any>
-  readiness: Record<string, SetupProviderReadiness>
-  providerSummary: ReturnType<typeof setupProviderSummary>
+function setupDaemonCompact(daemon: {
+  runningVersion: string | null
 }) {
-  const providerList = providers.join(', ')
-  const recheck = providers
-    .map((provider) => userActions[provider]?.recheckCommand)
-    .find((command): command is string => typeof command === 'string')
-  const resume = providers
-    .map((provider) => userActions[provider]?.resumeCommand)
-    .find((command): command is string => typeof command === 'string')
-  const classifications = providers
-    .map((provider) => `${provider}: ${readiness[provider]?.classification ?? 'unknown'}`)
-    .join('; ')
-  const pending = providers
-    .filter((provider) => readiness[provider]?.classification === 'action_required')
-    .map((provider) => {
-      const recheckCommand = userActions[provider]?.recheckCommand ?? `tokenless profiles status --profile ${setupShellQuote(profile.slug)} --provider ${setupShellQuote(provider)} --json`
-      const handoffJobId = userActions[provider]?.handoff?.jobId
-      return `${provider} (${handoffJobId ? `handoff job ${handoffJobId}; ` : ''}${recheckCommand})`
-    })
-    .join('; ')
-  return [
-    `Tokenless setup checked ${providerList} in profile ${profile.slug}.`,
-    `Provider summary: ${classifications}. Counts: ready ${providerSummary.counts.ready}, action_required ${providerSummary.counts.action_required}, failed ${providerSummary.counts.failed}.`,
-    'Use the Tokenless-managed Chrome window/tab opened or foregrounded by setup; complete sign-in or verification until the provider composer is visible.',
-    pending ? `Remaining provider actions: ${pending}.` : '',
-    recheck
-      ? `Previous check was inconclusive; run a fresh recheck: ${recheck}`
-      : `Then resume or inspect the same setup job: ${resume ?? `tokenless profiles status --profile ${setupShellQuote(profile.slug)} --provider ${setupShellQuote(providers[0] ?? 'chatgpt')} --json`}`,
-  ].filter(Boolean).join(' ')
+  return `Daemon: ready on tokenless ${daemon.runningVersion ?? 'unknown'} (exact package version required).`
 }
 
-function setupReadyCompactOutput({
-  providers,
-  profile,
-  readiness,
-  providerSummary,
-}: {
-  providers: readonly string[]
-  profile: ManagedProfileRecord
-  readiness: Record<string, SetupProviderReadiness>
-  providerSummary: ReturnType<typeof setupProviderSummary>
-}) {
-  const classifications = providers
-    .map((provider) => `${provider}: ${readiness[provider]?.classification ?? 'unknown'}`)
-    .join('; ')
-  return `Tokenless setup checked ${providers.join(', ')} in profile ${profile.slug}. Provider summary: ${classifications}. Counts: ready ${providerSummary.counts.ready}, action_required ${providerSummary.counts.action_required}, failed ${providerSummary.counts.failed}.`
+function compareSemanticVersions(left: string, right: string) {
+  const leftVersion = parseSemanticVersion(left)
+  const rightVersion = parseSemanticVersion(right)
+  if (!leftVersion || !rightVersion) return null
+  for (const key of ['major', 'minor', 'patch'] as const) {
+    const diff = leftVersion[key] - rightVersion[key]
+    if (diff !== 0) return diff
+  }
+  if (leftVersion.prerelease.length === 0 && rightVersion.prerelease.length > 0) return 1
+  if (leftVersion.prerelease.length > 0 && rightVersion.prerelease.length === 0) return -1
+  for (let index = 0; index < Math.max(leftVersion.prerelease.length, rightVersion.prerelease.length); index += 1) {
+    const leftIdentifier = leftVersion.prerelease[index]
+    const rightIdentifier = rightVersion.prerelease[index]
+    if (leftIdentifier === undefined) return -1
+    if (rightIdentifier === undefined) return 1
+    const diff = comparePrereleaseIdentifier(leftIdentifier, rightIdentifier)
+    if (diff !== 0) return diff
+  }
+  return 0
 }
 
-function setupFailedCompactOutput({
-  providers,
-  profile,
-  readiness,
-  providerSummary,
-  userActions = {},
-}: {
-  providers: readonly string[]
-  profile: ManagedProfileRecord
-  readiness: Record<string, SetupProviderReadiness>
-  providerSummary: ReturnType<typeof setupProviderSummary>
-  userActions?: Record<string, any>
-}) {
-  const classifications = providers
-    .map((provider) => {
-      const result = readiness[provider]
-      return `${provider}: ${result?.classification ?? 'unknown'}${result?.error?.code ? ` (${result.error.code})` : ''}`
-    })
-    .join('; ')
-  const pending = providers
-    .filter((provider) => readiness[provider]?.classification === 'action_required')
-    .map((provider) => {
-      const recheckCommand = userActions[provider]?.recheckCommand ?? `tokenless profiles status --profile ${setupShellQuote(profile.slug)} --provider ${setupShellQuote(provider)} --json`
-      const handoffJobId = userActions[provider]?.handoff?.jobId
-      return `${provider} (${handoffJobId ? `handoff job ${handoffJobId}; ` : ''}${recheckCommand})`
-    })
-    .join('; ')
-  return [
-    `Tokenless setup checked ${providers.join(', ')} in profile ${profile.slug}. Provider summary: ${classifications}. Counts: ready ${providerSummary.counts.ready}, action_required ${providerSummary.counts.action_required}, failed ${providerSummary.counts.failed}.`,
-    pending ? `Action required: ${pending}.` : '',
-  ].filter(Boolean).join(' ')
+function parseSemanticVersion(value: string) {
+  const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.exec(value)
+  if (!match) return null
+  const [major, minor, patch] = [Number(match[1]), Number(match[2]), Number(match[3])]
+  if (![major, minor, patch].every(Number.isSafeInteger)) return null
+  return {
+    major,
+    minor,
+    patch,
+    prerelease: match[4] ? match[4].split('.') : [],
+  }
 }
 
-function setupShellQuote(value: string) {
-  return `'${value.replace(/'/g, `'\\''`)}'`
+function comparePrereleaseIdentifier(left: string, right: string) {
+  const leftNumeric = /^(0|[1-9]\d*)$/.test(left)
+  const rightNumeric = /^(0|[1-9]\d*)$/.test(right)
+  if (leftNumeric && rightNumeric) return Number(left) - Number(right)
+  if (leftNumeric) return -1
+  if (rightNumeric) return 1
+  return left < right ? -1 : (left > right ? 1 : 0)
 }
 
-async function resolveBrowserUserDataDirForImport(
-  value: unknown,
-  profileDirectoryKey: string,
-  browser: 'chrome' | 'brave'
-) {
-  if (value !== undefined) return path.resolve(String(value))
-  const roots = await discoverChromiumProfiles({ browser })
-  const matches = roots.filter((root) => root.profiles.some((profile) => profile.directoryKey === profileDirectoryKey))
-  if (matches.length === 1) return matches[0]!.userDataDir
-  if (matches.length === 0) {
+function normalizeProfileDiscoveryBrowser(value: unknown): ManagedChromiumBrowserId | 'all' {
+  if (typeof value === 'string' && value.trim().toLowerCase() === 'all') return 'all'
+  const browser = value === undefined ? 'chrome' : normalizeCliBrowser(value)
+  if (
+    browser !== 'chrome' &&
+    browser !== 'brave' &&
+    browser !== 'edge' &&
+    browser !== 'arc' &&
+    browser !== 'chromium' &&
+    browser !== 'chrome-for-testing'
+  ) {
     throw usageError(
-      'chrome_profile_not_found',
-      `No ${browser} profile directory key '${profileDirectoryKey}' was discovered. Pass --browser-user-data-dir for the exact browser user data directory.`
+      'profile_discovery_browser_invalid',
+      'Browser profile discovery supports all, Chrome, Brave, Edge, Arc, Chromium, or Chrome for Testing.',
     )
   }
+  return browser
+}
+
+function requireOpaqueProfileCopyConsent(args: CliArgs) {
+  if (args.consentLocalProfileCopy === true) return
   throw usageError(
-    'chrome_profile_ambiguous',
-    `${browser} profile directory key '${profileDirectoryKey}' exists in multiple user data directories; pass --browser-user-data-dir.`
+    'profile_import_consent_required',
+    'Copying a local browser profile requires --consent-local-profile-copy.',
   )
 }
 
-async function resolveProfileImportSource(args: CliArgs, profileDirectoryKey: string) {
-  const browser = normalizeProfileImportBrowser(args.browser)
-  const userDataDir = await resolveBrowserUserDataDirForImport(args.chromeUserDataDir, profileDirectoryKey, browser)
-  return {
+async function resolveOpaqueProfileSource(
+  args: CliArgs,
+  runtime: ResolvedBrowserRuntime,
+  directoryKey: string,
+) {
+  const configuredImportBrowser = MANAGED_CHROMIUM_BROWSER_IDS.includes(
+    args.setupImportBrowser as ManagedChromiumBrowserId,
+  ) ? args.setupImportBrowser as ManagedChromiumBrowserId : null
+  const browser: ManagedChromiumBrowserId = configuredImportBrowser ?? (runtime.family === 'system' &&
+    MANAGED_CHROMIUM_BROWSER_IDS.includes(runtime.browserId as ManagedChromiumBrowserId)
+    ? runtime.browserId as ManagedChromiumBrowserId
+    : 'chrome')
+  return await resolveOpaqueProfileSourceForBrowser(args, browser, directoryKey)
+}
+
+async function resolveOpaqueProfileSourceForBrowser(
+  args: CliArgs,
+  browser: ManagedChromiumBrowserId,
+  directoryKey: string,
+) {
+  const roots = await discoverChromiumProfiles({
     browser,
-    userDataDir,
-    profile: await resolveChromeProfile(userDataDir, profileDirectoryKey),
+    ...(args.chromeUserDataDir === undefined ? {} : { userDataDirs: [path.resolve(String(args.chromeUserDataDir))] }),
+  })
+  const matches = roots.flatMap((root) => root.profiles.map((profile) => ({ ...profile, browser: root.browser })))
+    .filter((profile) => profile.directoryKey === directoryKey)
+  if (matches.length !== 1) {
+    throw usageError(
+      matches.length === 0 ? 'browser_profile_not_found' : 'browser_profile_ambiguous',
+      `Browser profile directory key '${directoryKey}' must resolve to exactly one discovered ${browser} profile.`,
+    )
   }
+  return matches[0]!
 }
 
-function normalizeProfileImportBrowser(value: unknown): 'chrome' | 'brave' {
-  const browser = value === undefined ? 'chrome' : normalizeCliBrowser(value)
-  if (browser !== 'chrome' && browser !== 'brave') {
-    throw usageError('profile_import_browser_invalid', 'Browser profile import currently supports Chrome or Brave.')
-  }
-  return browser
+function assertCloakProfileImportCompatible(
+  source: { directoryKey: string; browserVersion: string | null },
+  runtime: ResolvedBrowserRuntime,
+) {
+  if (runtime.family !== 'cloak' || source.browserVersion === runtime.actualVersion) return
+  throw usageError(
+    'cloak_profile_version_incompatible',
+    `Browser profile '${source.directoryKey}' uses Chromium ${source.browserVersion ?? 'unknown'}; installed CloakBrowser requires ${runtime.actualVersion}.`,
+  )
 }
 
 async function defaultProfileSlug(registry: ManagedProfileRegistry) {
@@ -837,9 +1293,120 @@ function publicManagedProfile(profile: ManagedProfileRecord, defaultSlug: string
     isDefault: profile.slug === defaultSlug,
     createdAt: profile.createdAt,
     updatedAt: profile.updatedAt,
+    runtimeBinding: profile.runtimeBinding ?? null,
     import: profile.import,
     lastObservedAuth: profile.lastObservedAuth,
+    providers: Object.fromEntries(Object.entries(profile.lastObservedAuth).map(([provider, status]) => [
+      provider,
+      {
+        auth: status?.auth,
+        access: status?.access,
+        username: status?.auth === 'authenticated' ? status.account?.name ?? null : null,
+        subscription: status?.auth === 'authenticated' ? status.account?.subscription ?? null : null,
+        tier: status?.auth === 'authenticated' ? status.account?.tier ?? null : null,
+        checkedAt: status?.checkedAt,
+      },
+    ])),
+  }
+}
+
+function resolveDaemonJobCapabilityRoutes({
+  config,
+  profile,
+  explicitProvider,
+  requirements,
+}: {
+  config: Awaited<ReturnType<typeof readTokenlessConfig>>
+  profile: ManagedProfileRecord
+  explicitProvider?: ProviderId | undefined
+  requirements: readonly TaskCapabilityId[]
+}): readonly TaskCapabilityRoute[] {
+  const providers = explicitProvider
+    ? [{
+        provider: explicitProvider,
+        observed: profile.lastObservedAuth?.[explicitProvider] !== undefined,
+        usable: true,
+        runtimeEligibility: 'unchecked' as const,
+        auth: profile.lastObservedAuth?.[explicitProvider]?.auth ?? 'unknown',
+        access: profile.lastObservedAuth?.[explicitProvider]?.access ?? 'unknown',
+        checkedAt: profile.lastObservedAuth?.[explicitProvider]?.checkedAt ?? null,
+        tier: profile.lastObservedAuth?.[explicitProvider]?.account?.tier ?? null,
+      }]
+    : providerObservationContext(implicitProviderCandidates(
+        config.profilePreferences[profile.slug]?.enabledProviders ?? config.providerWhitelist,
+      ), profile)
+  const decision = resolveTaskCapabilityRoutes({
+    requirements,
+    candidates: providers.map((provider, preferenceRank) => ({
+      provider: provider.provider,
+      runtimeEligibility: explicitProvider ? 'unchecked' : provider.runtimeEligibility,
+      reason: provider.usable ? null : `provider_access_${provider.access}`,
+      preferenceRank,
+    })),
+  })
+  if (decision.ok) {
+    return decision.routes
+  }
+
+  const runtimeProviderUnavailable = !explicitProvider && providers.every((provider) => provider.runtimeEligibility === 'ineligible')
+  const providerUnavailable = requirements.length === 0 || runtimeProviderUnavailable
+  const error = usageError(
+    providerUnavailable ? 'provider_unavailable' : decision.code,
+    providerUnavailable
+      ? `No configured provider is currently usable for profile '${profile.slug}'. Run "tokenless setup" or sign in to a provider, then rerun the command.`
+      : decision.message,
+  )
+  error.context = {
+    profile: {
+      slug: profile.slug,
+      id: profile.id,
+    },
+    requirements: decision.requirements,
+    providers: providerUnavailable ? providers : decision.evaluated,
+    usableProviders: explicitProvider
+      ? []
+      : providers.filter((provider) => provider.usable).map((provider) => provider.provider),
+    nextAction: providerUnavailable
+      ? 'Run "tokenless setup" to refresh provider access observations, or pass --provider to target a provider explicitly.'
+      : 'Choose a provider scope with an evidence-backed route, remove unsupported capabilities, or complete the required real-provider E2E closure.',
   }
+  throw error
+}
+
+function implicitProviderCandidates(providerWhitelist: readonly string[]): ProviderId[] {
+  return providerWhitelist.map(normalizeProvider)
+}
+
+function providerObservationContext(
+  providers: readonly ProviderId[],
+  profile: ManagedProfileRecord,
+) {
+  return providers.map((provider) => {
+    const observed = profile.lastObservedAuth?.[provider]
+    const access = observed?.access ?? (observed?.auth === 'authenticated' ? 'signed_in_unknown' : 'unknown')
+    const usable = isUsableProviderAccess(access)
+    const fresh = observationIsFresh(observed?.checkedAt)
+    return {
+      provider,
+      observed: observed !== undefined,
+      usable,
+      runtimeEligibility: usable ? (fresh ? 'eligible' as const : 'unchecked' as const) : 'ineligible' as const,
+      auth: observed?.auth ?? 'unknown',
+      access,
+      checkedAt: observed?.checkedAt ?? null,
+      tier: observed?.account?.tier ?? null,
+    }
+  })
+}
+
+function observationIsFresh(value: unknown) {
+  if (typeof value !== 'string') return false
+  const checkedAt = Date.parse(value)
+  return Number.isFinite(checkedAt) && Date.now() - checkedAt <= PROVIDER_OBSERVATION_FRESHNESS_MS
+}
+
+function isUsableProviderAccess(access: unknown): access is ProviderAccessClass {
+  return access === 'guest' || (typeof access === 'string' && access.startsWith('signed_in_'))
 }
 
 async function runCommand(args: CliArgs) {
@@ -848,6 +1415,53 @@ async function runCommand(args: CliArgs) {
   await executeDaemonJob({ args, action: args.action || 'submit_and_read', prompt })
 }
 
+async function capabilitiesCommand(subcommand: string | undefined, args: CliArgs) {
+  if (subcommand !== 'list') {
+    throw usageError('capabilities_subcommand_required', 'Usage: tokenless capabilities list --json')
+  }
+  printPayload({
+    ok: true,
+    schema: TASK_CAPABILITY_CATALOG_SCHEMA_ID,
+    capabilities: listTaskCapabilityDefinitions().map((definition) => {
+      const routes = listProviderTaskCapabilityRoutes(definition.id)
+      return {
+        ...definition,
+        routeable: routes.length > 0,
+        routes,
+      }
+    }),
+  }, args)
+}
+
+async function replayCommand(args: CliArgs) {
+  const recipient = agentRecipientFromArgs(args, true)
+  const homeDir = tokenlessHome(args.home)
+  const config = await readTokenlessConfig(homeDir)
+  const configuredDaemonUrl = daemonUrl(args.daemonUrl ?? config.daemonUrl ?? undefined)
+  const daemon = await ensureDaemonReady({
+    homeDir,
+    daemonUrl: configuredDaemonUrl,
+    timeoutMs: optionalNumber(args.daemonStartTimeoutMs),
+  })
+  const replay = await drainDaemonReplay({
+    homeDir,
+    daemonUrl: daemon.url,
+    agentKind: recipient.agentKind,
+    agentSessionId: recipient.agentSessionId,
+    limit: args.limit === undefined ? undefined : strictPositiveInteger(args.limit, '--limit'),
+  })
+  printPayload({
+    ok: true,
+    transport: 'daemon',
+    agent: {
+      kind: recipient.agentKind,
+      sessionId: recipient.agentSessionId,
+    },
+    count: replay.jobs.length,
+    jobs: replay.jobs,
+  }, args)
+}
+
 async function chatGptControlsCommand(args: CliArgs) {
   await executeDaemonJob({
     args: { ...args, provider: requiredChatGptProvider(args) },
@@ -877,11 +1491,35 @@ async function visibleProviderActionFromArgs(args: CliArgs) {
   if (!PRIORITY_VISIBLE_PROVIDER_ACTIONS.has(action)) {
     throw usageError(
       'invalid_visible_provider_action',
-      'provider-action --action must be one of: auth.status, model.inspect, model.select, effort.inspect, effort.select, file.upload, prompt.clear, prompt.input, prompt.submit, response.read, snapshot.sanitized, navigation.check, blocker.check.'
+      `provider-action --action must be one of: ${PRIORITY_VISIBLE_PROVIDER_ACTION_LIST}.`
     )
   }
+  if (action.startsWith('qwen.mode.') && normalizeProvider(args.provider) !== 'qwen') {
+    throw usageError('qwen_mode_unsupported', 'qwen.mode actions are available only for the Qwen provider.')
+  }
+  if (action.startsWith('deepseek.') && normalizeProvider(args.provider) !== 'deepseek') {
+    throw usageError('deepseek_control_unsupported', 'deepseek actions are available only for the DeepSeek provider.')
+  }
+  if (action.startsWith('doubao.') && normalizeProvider(args.provider) !== 'doubao') {
+    throw usageError('doubao_control_unsupported', 'doubao actions are available only for the Doubao provider.')
+  }
+
+  if (action === 'capability.inspect') {
+    assertProviderActionPayloadOptions(args, new Set())
+    return { action, payload: {} }
+  }
 
-  if (action === 'auth.status' || action === 'model.inspect' || action === 'effort.inspect') {
+  if (
+    action === 'auth.status' ||
+    action === 'model.inspect' ||
+    action === 'effort.inspect' ||
+    action === 'qwen.mode.inspect' ||
+    action === 'deepseek.mode.inspect' ||
+    action === 'deepseek.deepthink.inspect' ||
+    action === 'deepseek.search.inspect' ||
+    action === 'doubao.mode.inspect' ||
+    action === 'doubao.skill.inspect'
+  ) {
     assertProviderActionPayloadOptions(args, new Set())
     return { action, payload: {} }
   }
@@ -930,6 +1568,72 @@ async function visibleProviderActionFromArgs(args: CliArgs) {
     }
   }
 
+  if (action === 'qwen.mode.select') {
+    assertProviderActionPayloadOptions(args, new Set(['qwenMode', 'qwenModeVariant']))
+    if (args.qwenMode === undefined) {
+      throw usageError('missing_visible_action_qwen_mode', 'qwen.mode.select requires --qwen-mode <exact-visible-mode>.')
+    }
+    return {
+      action,
+      payload: qwenModeSelectionPayload(args),
+    }
+  }
+
+  if (action === 'deepseek.mode.select') {
+    assertProviderActionPayloadOptions(args, new Set(['deepSeekMode']))
+    if (args.deepSeekMode === undefined) {
+      throw usageError('missing_visible_action_deepseek_mode', 'deepseek.mode.select requires --deepseek-mode <Instant|Expert|Vision>.')
+    }
+    return {
+      action,
+      payload: { mode: normalizeDeepSeekMode(args.deepSeekMode) },
+    }
+  }
+
+  if (action === 'deepseek.deepthink.select') {
+    assertProviderActionPayloadOptions(args, new Set(['deepSeekDeepThink']))
+    if (args.deepSeekDeepThink === undefined) {
+      throw usageError('missing_visible_action_deepseek_deepthink', 'deepseek.deepthink.select requires --deepseek-deepthink <on|off>.')
+    }
+    return {
+      action,
+      payload: { enabled: normalizeDeepSeekToggle(args.deepSeekDeepThink, '--deepseek-deepthink') },
+    }
+  }
+
+  if (action === 'deepseek.search.select') {
+    assertProviderActionPayloadOptions(args, new Set(['deepSeekSearch']))
+    if (args.deepSeekSearch === undefined) {
+      throw usageError('missing_visible_action_deepseek_search', 'deepseek.search.select requires --deepseek-search <on|off>.')
+    }
+    return {
+      action,
+      payload: { enabled: normalizeDeepSeekToggle(args.deepSeekSearch, '--deepseek-search') },
+    }
+  }
+
+  if (action === 'doubao.mode.select') {
+    assertProviderActionPayloadOptions(args, new Set(['doubaoMode']))
+    if (args.doubaoMode === undefined) {
+      throw usageError('missing_visible_action_doubao_mode', 'doubao.mode.select requires --doubao-mode <mode>.')
+    }
+    return {
+      action,
+      payload: { mode: normalizeDoubaoMode(args.doubaoMode) },
+    }
+  }
+
+  if (action === 'doubao.skill.select') {
+    assertProviderActionPayloadOptions(args, new Set(['doubaoSkill']))
+    if (args.doubaoSkill === undefined) {
+      throw usageError('missing_visible_action_doubao_skill', 'doubao.skill.select requires --doubao-skill <skill>.')
+    }
+    return {
+      action,
+      payload: { skill: normalizeDoubaoSkill(args.doubaoSkill) },
+    }
+  }
+
   if (action === 'file.upload') {
     assertProviderActionPayloadOptions(args, new Set(['attachFiles']))
     if (args.attachFiles.length < 1) {
@@ -941,10 +1645,18 @@ async function visibleProviderActionFromArgs(args: CliArgs) {
     return { action, payload: {} }
   }
 
+  if (action === 'workspace.ensure') {
+    assertProviderActionPayloadOptions(args, new Set(['projectName', 'projectInstructions', 'projectInstructionsFile', 'workspaceMode']))
+    return {
+      action,
+      payload: await workspaceEnsurePayloadFromArgs(args, args.workspaceMode ?? 'auto'),
+    }
+  }
+
   if (action !== 'prompt.input') {
     throw usageError(
       'invalid_visible_provider_action',
-      'provider-action --action must be one of: auth.status, model.inspect, model.select, effort.inspect, effort.select, file.upload, prompt.clear, prompt.input, prompt.submit, response.read, snapshot.sanitized, navigation.check, blocker.check.'
+      `provider-action --action must be one of: ${PRIORITY_VISIBLE_PROVIDER_ACTION_LIST}.`
     )
   }
 
@@ -973,7 +1685,18 @@ function assertProviderActionPayloadOptions(args: CliArgs, allowed: Set<string>)
     ['modelFallbacks', '--model-fallback'],
     ['effort', '--effort'],
     ['thinkingEffort', '--thinking-effort'],
+    ['qwenMode', '--qwen-mode'],
+    ['qwenModeVariant', '--qwen-mode-variant'],
+    ['deepSeekMode', '--deepseek-mode'],
+    ['deepSeekDeepThink', '--deepseek-deepthink'],
+    ['deepSeekSearch', '--deepseek-search'],
+    ['doubaoMode', '--doubao-mode'],
+    ['doubaoSkill', '--doubao-skill'],
     ['chatSurface', '--chat-surface'],
+    ['projectName', '--project-name'],
+    ['projectInstructions', '--project-instructions'],
+    ['projectInstructionsFile', '--project-instructions-file'],
+    ['workspaceMode', '--workspace-mode'],
   ] as const
   const unsupported: string[] = payloadOptions
     .filter(([key]) => args[key] !== undefined && !allowed.has(key))
@@ -1021,10 +1744,27 @@ async function executeDaemonJob({
   }
   const homeDir = tokenlessHome(args.home)
   const config = await readTokenlessConfig(homeDir)
-  const provider = normalizeProvider(
-    args.provider || process.env.TOKENLESS_PROVIDER || config.preferredProviders[0] || 'chatgpt'
-  )
-  const providerControls = visibleAction ? {} : resolveProviderControls({ args, provider, action })
+  const explicitProvider = args.provider || process.env.TOKENLESS_PROVIDER
+  const explicitProviderId = explicitProvider ? normalizeProvider(explicitProvider) : undefined
+  const taskCapabilities = taskCapabilityRequirementsForExecution(args, action, visibleAction)
+  const explicitProviderControls = explicitProviderId && !visibleAction
+    ? resolveProviderControls({ args, provider: explicitProviderId, action, requirements: taskCapabilities })
+    : undefined
+  const registry = new ManagedProfileRegistry(homeDir)
+  const profileForTarget = await registry.resolveProfile(args.profile)
+  const capabilityRoutes = resolveDaemonJobCapabilityRoutes({
+    config,
+    profile: profileForTarget,
+    explicitProvider: explicitProviderId,
+    requirements: taskCapabilities,
+  })
+  const capabilityRoute = capabilityRoutes[0]
+  if (!capabilityRoute) throw usageError('task_capability_route_unavailable', 'No provider capability route is available.')
+  const provider = capabilityRoute.provider
+  const recordedCapabilityRoute = taskCapabilities.length === 0 ? null : capabilityRoute
+  const providerControls = visibleAction
+    ? {}
+    : explicitProviderControls ?? resolveProviderControls({ args, provider, action, requirements: taskCapabilities })
   const projectName = args.projectName || process.env.TOKENLESS_PROJECT_NAME
   const chatName = args.chatName || process.env.TOKENLESS_CHAT_NAME || (action === 'snapshot_dom' ? 'DOM snapshot' : undefined)
   const taskId = deriveTaskId({
@@ -1034,6 +1774,11 @@ async function executeDaemonJob({
   })
   const requestId = visibleRequestId(visibleAction ? (taskId ?? randomUUID()) : (taskId ?? randomUUID()))
   const managedJobId = managedPlaywrightJobId()
+  const workspaceMode = args.workspaceMode === undefined ? undefined : normalizeWorkspaceMode(args.workspaceMode)
+  const workspace = visibleAction || workspaceMode === undefined
+    ? undefined
+    : await workspaceEnsurePayloadFromArgs(args, workspaceMode)
+  const configuredDaemonUrl = daemonUrl(args.daemonUrl ?? config.daemonUrl ?? undefined)
   let stagedAttachmentBundleId: string | undefined
   let daemonJobSubmissionStarted = false
 
@@ -1052,10 +1797,60 @@ async function executeDaemonJob({
     if (attachments && attachments.some((attachment) => attachment.bundleId !== stagedAttachmentBundleId)) {
       throw usageError('attachment_bundle_invalid', 'Visible attachments must be staged into one private bundle.')
     }
+    const fallbackAlternatives = automaticProviderFallbackAllowed({
+      args,
+      action,
+      explicitProvider: explicitProviderId,
+      visibleAction,
+      taskCapabilities,
+    })
+      ? await Promise.all(capabilityRoutes.slice(1, 6).map(async (route) => {
+          const alternateProvider = route.provider
+          return {
+            provider: alternateProvider,
+            target: {
+              kind: 'provider_home' as const,
+              url: await managedProviderTargetUrl({
+                provider: alternateProvider,
+                explicitTargetUrl: undefined,
+                workspaceMode,
+                taskId,
+                projectName,
+                homeDir,
+                daemonUrl: configuredDaemonUrl,
+                daemonStartTimeoutMs: optionalNumber(args.daemonStartTimeoutMs),
+                profileId: profileForTarget.id,
+              }),
+            },
+            capabilityRoute: route,
+          }
+        }))
+      : []
     const request = createManagedPlaywrightJobRequest({
       provider,
-      target: { kind: 'provider_home', url: managedProviderTargetUrl(provider, args.targetUrl) },
+      target: {
+        kind: 'provider_home',
+        url: await managedProviderTargetUrl({
+          provider,
+          explicitTargetUrl: args.targetUrl,
+          workspaceMode,
+          taskId,
+          projectName,
+          homeDir,
+          daemonUrl: configuredDaemonUrl,
+          daemonStartTimeoutMs: optionalNumber(args.daemonStartTimeoutMs),
+          profileId: profileForTarget.id,
+        }),
+      },
       taskId: taskId ?? null,
+      capabilityRoute: recordedCapabilityRoute,
+      contextLanguage: config.language,
+      fallback: fallbackAlternatives.length === 0 ? null : {
+        protocol: 'tokenless.provider-fallback.v1',
+        mode: 'automatic',
+        replay: 'from_start',
+        alternatives: fallbackAlternatives,
+      },
       actions: managedVisibleActions({
         action,
         provider,
@@ -1064,6 +1859,7 @@ async function executeDaemonJob({
         attachments,
         providerControls,
         visibleAction,
+        workspace,
       }),
     })
 
@@ -1085,11 +1881,16 @@ async function executeDaemonJob({
         : Number(args.timeoutMs),
     })
     const { job, waitResult: result, statusLog } = submitted
+    const resolvedJob = result?.job ?? job
+    const resolvedRequest = objectRecord(resolvedJob.request_json)
+    const resolvedProvider = resolvedJob.provider ?? provider
+    const resolvedCapabilityRoute = resolvedRequest.capabilityRoute ?? recordedCapabilityRoute
     if (result?.status === 'waiting_for_user') {
       printPayload(waitingForUserPayload({
         job,
         taskId,
-        provider,
+        provider: resolvedProvider,
+        capabilityRoute: resolvedCapabilityRoute,
         profile: submitted.profile,
         projectName,
         chatName,
@@ -1117,6 +1918,7 @@ async function executeDaemonJob({
         jobId: job.job_id,
         taskId,
         provider,
+        capabilityRoute: recordedCapabilityRoute,
         backend: PLAYWRIGHT_EXECUTION_BACKEND,
         profile: publicManagedProfile(submitted.profile, submitted.profile.slug),
         snapshot,
@@ -1133,7 +1935,9 @@ async function executeDaemonJob({
       backend: PLAYWRIGHT_EXECUTION_BACKEND,
       jobId: job.job_id,
       taskId,
-      provider,
+      provider: resolvedProvider,
+      capabilityRoute: resolvedCapabilityRoute,
+      providerAttempts: resolvedJob.provider_attempts_json ?? [],
       profile: publicManagedProfile(submitted.profile, submitted.profile.slug),
       projectName,
       chatName,
@@ -1154,6 +1958,34 @@ async function executeDaemonJob({
   }
 }
 
+function automaticProviderFallbackAllowed({
+  args,
+  action,
+  explicitProvider,
+  visibleAction,
+  taskCapabilities,
+}: {
+  args: CliArgs
+  action: string
+  explicitProvider?: ProviderId | undefined
+  visibleAction?: { action: string; payload: Record<string, unknown> } | undefined
+  taskCapabilities: readonly TaskCapabilityId[]
+}) {
+  if (explicitProvider || visibleAction || action !== 'submit_and_read' || taskCapabilities.length === 0) return false
+  if (taskCapabilities.includes(TASK_CAPABILITIES.CONVERSATION_CONTINUE)) return false
+  if (args.targetUrl !== undefined) return false
+  if (args.workspaceMode !== undefined) return false
+  return args.model === undefined &&
+    args.effort === undefined &&
+    args.thinkingEffort === undefined &&
+    args.qwenMode === undefined &&
+    args.qwenModeVariant === undefined &&
+    args.deepSeekMode === undefined &&
+    args.deepSeekDeepThink === undefined &&
+    args.deepSeekSearch === undefined &&
+    args.chatSurface === undefined
+}
+
 async function executeManagedPlaywrightJob({
   args,
   provider,
@@ -1167,7 +1999,7 @@ async function executeManagedPlaywrightJob({
   args: CliArgs
   provider: string
   request: ReturnType<typeof createManagedPlaywrightJobRequest>
-  taskId?: string | undefined
+  taskId?: string | null | undefined
   statusEventAction: string
   noWait: boolean
   timeoutMs?: number | undefined
@@ -1179,56 +2011,55 @@ async function executeManagedPlaywrightJob({
   const configuredDaemonUrl = daemonUrl(args.daemonUrl ?? config.daemonUrl ?? undefined)
   const statusReporter = createCliStatusReporter(args)
   const profile = await new ManagedProfileRegistry(homeDir).resolveProfile(args.profile)
+  const effectiveTaskId = taskId === undefined ? request.taskId : taskId
+  const alignedRequest = request.taskId === effectiveTaskId
+    ? request
+    : createManagedPlaywrightJobRequest({
+        provider: request.provider,
+        target: request.target,
+        taskId: effectiveTaskId,
+        capabilityRoute: request.capabilityRoute,
+        fallback: request.fallback,
+        context: {
+          ...request.context,
+          taskId: effectiveTaskId,
+        },
+        browserVisibility: request.browserVisibility,
+        ...(request.pagePolicy === undefined ? {} : { pagePolicy: request.pagePolicy }),
+        actions: request.actions,
+      })
   const daemon = await ensureDaemonReady({
     homeDir,
     daemonUrl: configuredDaemonUrl,
     timeoutMs: optionalNumber(args.daemonStartTimeoutMs),
+    requiredProvider: provider,
   })
+  const actualDaemonUrl = daemon.url
   statusReporter.report({
     event: daemon.started ? 'daemon_started' : 'daemon_ready',
     status: 'ready',
-    daemonUrl: configuredDaemonUrl,
+    daemonUrl: actualDaemonUrl,
     daemonPid: daemon.pid,
     backend: PLAYWRIGHT_EXECUTION_BACKEND,
   })
-  await writeTokenlessConfig({ homeDir, daemonUrl: configuredDaemonUrl })
-  const injectedRunnerEntry = process.env.TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY
-  const browser = injectedRunnerEntry
-    ? {
-        browser: config.browser ?? 'chrome',
-        displayName: 'injected managed Playwright runner',
-        command: process.execPath,
-        argsPrefix: [],
-      }
-    : await resolveChromiumBrowser(config.browser ?? undefined)
-  const runner = await startRunnerSupervisor({
-    homeDir,
-    daemonUrl: configuredDaemonUrl,
-    browser: browser.browser,
-    ...(browser.browser === 'chrome' || browser.browser === 'edge'
-      ? {}
-      : { browserExecutablePath: browser.playwrightExecutablePath }),
-    ...(injectedRunnerEntry === undefined
-      ? {}
-      : { entryPath: injectedRunnerEntry }),
-    ...(args.runnerHeartbeatTimeoutMs === undefined
-      ? {}
-      : { heartbeatTimeoutMs: Number(args.runnerHeartbeatTimeoutMs) }),
-  })
+  if (args.daemonUrl === undefined && config.daemonUrl !== configuredDaemonUrl) {
+    await writeTokenlessConfig({ homeDir, daemonUrl: configuredDaemonUrl })
+  }
+  const runner = await embeddedRunnerStatus({ homeDir, daemonUrl: actualDaemonUrl })
   statusReporter.report({
-    event: runner.started ? 'playwright_runner_started' : 'playwright_runner_ready',
+    event: 'playwright_runner_ready',
     status: runner.state,
     backend: PLAYWRIGHT_EXECUTION_BACKEND,
     provider,
     action: statusEventAction,
   })
   const job = await submitManagedPlaywrightJob({
-    daemonUrl: configuredDaemonUrl,
+    daemonUrl: actualDaemonUrl,
     homeDir,
     profileId: profile.id,
+    ...agentRecipientFromArgs(args),
     request: {
-      ...request,
-      taskId: taskId ?? null,
+      ...alignedRequest,
       browserVisibility,
     },
     ...(jobId === undefined ? {} : { jobId }),
@@ -1238,7 +2069,7 @@ async function executeManagedPlaywrightJob({
     status: job.status,
     backend: PLAYWRIGHT_EXECUTION_BACKEND,
     jobId: job.job_id,
-    taskId,
+    taskId: effectiveTaskId,
     provider,
     action: job.action,
   })
@@ -1248,17 +2079,18 @@ async function executeManagedPlaywrightJob({
         status: 'no_wait',
         backend: PLAYWRIGHT_EXECUTION_BACKEND,
         jobId: job.job_id,
-        taskId,
+        taskId: effectiveTaskId,
         provider,
         action: job.action,
       }), null)
     : await waitForJobWithInterruptCancellation({
         homeDir,
-        daemonUrl: configuredDaemonUrl,
+        daemonUrl: actualDaemonUrl,
         jobId: job.job_id,
         timeoutMs: timeoutMs ?? DEFAULT_RUN_TIMEOUT_MS,
         cancelTimeoutMs: optionalNumber(args.cancelTimeoutMs),
         statusReporter,
+        ...agentRecipientFromArgs(args),
       })
   return {
     profile,
@@ -1272,18 +2104,31 @@ async function executeManagedPlaywrightJob({
 function visibleAttachmentMediaType(sourcePath: string) {
   const extension = path.extname(sourcePath).toLowerCase()
   return ({
+    '.aac': 'audio/aac',
+    '.avi': 'video/x-msvideo',
     '.csv': 'text/csv',
+    '.flac': 'audio/flac',
     '.gif': 'image/gif',
     '.html': 'text/html',
     '.jpeg': 'image/jpeg',
     '.jpg': 'image/jpeg',
     '.json': 'application/json',
+    '.m4a': 'audio/mp4',
     '.md': 'text/markdown',
+    '.mkv': 'video/x-matroska',
+    '.mov': 'video/quicktime',
+    '.mp3': 'audio/mpeg',
+    '.mp4': 'video/mp4',
+    '.mpeg': 'video/mpeg',
+    '.mpg': 'video/mpeg',
+    '.ogg': 'audio/ogg',
     '.pdf': 'application/pdf',
     '.png': 'image/png',
     '.rtf': 'application/rtf',
     '.txt': 'text/plain',
+    '.wav': 'audio/wav',
     '.webp': 'image/webp',
+    '.webm': 'video/webm',
     '.xml': 'application/xml',
   } as Record<string, string>)[extension] ?? 'application/octet-stream'
 }
@@ -1296,6 +2141,7 @@ function managedVisibleActions({
   attachments,
   providerControls,
   visibleAction,
+  workspace,
 }: {
   action: string
   provider: string
@@ -1304,6 +2150,7 @@ function managedVisibleActions({
   attachments?: readonly Record<string, unknown>[] | undefined
   providerControls: Record<string, any>
   visibleAction?: { action: string; payload: Record<string, unknown> } | undefined
+  workspace?: Record<string, unknown> | undefined
 }) {
   if (visibleAction) {
     return [{
@@ -1325,6 +2172,14 @@ function managedVisibleActions({
     return actions
   }
   if (action === 'inspect_controls' || action === 'inspect_chatgpt_controls') {
+    if (provider === 'deepseek') {
+      actions.push(
+        { requestId: `${requestId}:deepseek-mode`, action: VISIBLE_ACTIONS.DEEPSEEK_MODE_INSPECT, payload: {} },
+        { requestId: `${requestId}:deepseek-deepthink`, action: VISIBLE_ACTIONS.DEEPSEEK_DEEPTHINK_INSPECT, payload: {} },
+        { requestId: `${requestId}:deepseek-search`, action: VISIBLE_ACTIONS.DEEPSEEK_SEARCH_INSPECT, payload: {} },
+      )
+      return actions
+    }
     actions.push(
       { requestId: `${requestId}:model`, action: VISIBLE_ACTIONS.MODEL_INSPECT, payload: {} },
       { requestId: `${requestId}:effort`, action: VISIBLE_ACTIONS.EFFORT_INSPECT, payload: {} },
@@ -1332,6 +2187,15 @@ function managedVisibleActions({
     return actions
   }
   if (action === 'configure_controls' || action === 'configure_chatgpt') {
+    if (providerControls.deepSeekMode !== undefined) {
+      actions.push({ requestId: `${requestId}:deepseek-mode`, action: VISIBLE_ACTIONS.DEEPSEEK_MODE_SELECT, payload: { mode: providerControls.deepSeekMode } })
+    }
+    if (providerControls.deepSeekDeepThink !== undefined) {
+      actions.push({ requestId: `${requestId}:deepseek-deepthink`, action: VISIBLE_ACTIONS.DEEPSEEK_DEEPTHINK_SELECT, payload: { enabled: providerControls.deepSeekDeepThink } })
+    }
+    if (providerControls.deepSeekSearch !== undefined) {
+      actions.push({ requestId: `${requestId}:deepseek-search`, action: VISIBLE_ACTIONS.DEEPSEEK_SEARCH_SELECT, payload: { enabled: providerControls.deepSeekSearch } })
+    }
     if (providerControls.model !== undefined) {
       actions.push({ requestId: `${requestId}:model`, action: VISIBLE_ACTIONS.MODEL_SELECT, payload: { label: providerControls.model } })
     }
@@ -1344,7 +2208,31 @@ function managedVisibleActions({
     actions.push({ requestId, action: VISIBLE_ACTIONS.SNAPSHOT_SANITIZED, payload: {} })
     return actions
   }
-  if (providerControls.model !== undefined) {
+  if (workspace !== undefined) {
+    actions.push({ requestId: `${requestId}:workspace`, action: VISIBLE_ACTIONS.WORKSPACE_ENSURE, payload: workspace })
+  }
+  if (providerControls.qwenMode !== undefined) {
+    actions.push({
+      requestId: `${requestId}:qwen-mode`,
+      action: VISIBLE_ACTIONS.QWEN_MODE_SELECT,
+      payload: {
+        mode: providerControls.qwenMode,
+        ...(providerControls.qwenModeVariant === undefined
+          ? {}
+          : { variant: providerControls.qwenModeVariant }),
+      },
+    })
+  }
+  if (providerControls.deepSeekMode !== undefined) {
+    actions.push({ requestId: `${requestId}:deepseek-mode`, action: VISIBLE_ACTIONS.DEEPSEEK_MODE_SELECT, payload: { mode: providerControls.deepSeekMode } })
+  }
+  if (providerControls.deepSeekDeepThink !== undefined) {
+    actions.push({ requestId: `${requestId}:deepseek-deepthink`, action: VISIBLE_ACTIONS.DEEPSEEK_DEEPTHINK_SELECT, payload: { enabled: providerControls.deepSeekDeepThink } })
+  }
+  if (providerControls.deepSeekSearch !== undefined) {
+    actions.push({ requestId: `${requestId}:deepseek-search`, action: VISIBLE_ACTIONS.DEEPSEEK_SEARCH_SELECT, payload: { enabled: providerControls.deepSeekSearch } })
+  }
+  if (providerControls.model !== undefined) {
     actions.push({ requestId: `${requestId}:model`, action: VISIBLE_ACTIONS.MODEL_SELECT, payload: { label: providerControls.model } })
   }
   if (providerControls.effort !== undefined) {
@@ -1368,9 +2256,67 @@ function managedVisibleActions({
   return actions
 }
 
-function managedProviderTargetUrl(provider: string, targetUrl: unknown) {
-  if (targetUrl === undefined) return providerHomeUrl(provider as any)
-  const candidate = providerWakeUrl(provider, targetUrl)
+async function managedProviderTargetUrl({
+  provider,
+  explicitTargetUrl,
+  workspaceMode,
+  taskId,
+  projectName,
+  homeDir,
+  daemonUrl,
+  daemonStartTimeoutMs,
+  profileId,
+}: {
+  provider: string
+  explicitTargetUrl: unknown
+  workspaceMode?: string | undefined
+  taskId?: string | null | undefined
+  projectName?: string | undefined
+  homeDir: string
+  daemonUrl: string
+  daemonStartTimeoutMs?: number | undefined
+  profileId: string
+}) {
+  if (explicitTargetUrl !== undefined) {
+    const candidate = providerWakeUrl(provider, explicitTargetUrl)
+    const parsed = new URL(candidate)
+    parsed.search = ''
+    parsed.hash = ''
+    return parsed.toString()
+  }
+  if ((workspaceMode === 'auto' || workspaceMode === 'native') && projectName) {
+    const daemon = await ensureDaemonReady({ homeDir, daemonUrl, timeoutMs: daemonStartTimeoutMs, requiredProvider: provider })
+    const mapped = await mappedDaemonTarget({
+      homeDir,
+      daemonUrl: daemon.url,
+      provider,
+      profileId,
+      taskId: taskId ?? undefined,
+      projectName,
+    })
+    if (mapped) return mapped
+  }
+  if (workspaceMode === 'conversation' && taskId) {
+    const daemon = await ensureDaemonReady({ homeDir, daemonUrl, timeoutMs: daemonStartTimeoutMs, requiredProvider: provider })
+    const resolved = await resolveProviderConversation({
+      homeDir,
+      daemonUrl: daemon.url,
+      provider,
+      profileId,
+      taskId,
+    })
+    const candidate = resolved.mapping?.canonical_url
+    if (candidate) return providerWakeUrl(provider, candidate)
+  }
+  const candidate = requireProviderHomeUrl(provider)
+  const parsed = new URL(candidate)
+  parsed.search = ''
+  parsed.hash = ''
+  return parsed.toString()
+}
+
+function managedProviderExplicitTargetUrl(provider: string, targetUrl: unknown) {
+  const candidate = targetUrl === undefined ? requireProviderHomeUrl(provider) : providerWakeUrl(provider, targetUrl)
   const parsed = new URL(candidate)
   parsed.search = ''
   parsed.hash = ''
@@ -1378,7 +2324,7 @@ function managedProviderTargetUrl(provider: string, targetUrl: unknown) {
 }
 
 function managedPlaywrightJobId() {
-  return `tlp_${randomUUID()}`
+  return createE2EInspectionJobId() ?? `tlp_${randomUUID()}`
 }
 
 function visibleRequestId(value: string) {
@@ -1387,66 +2333,16 @@ function visibleRequestId(value: string) {
   return randomUUID()
 }
 
-async function prepareExtensionBridge({
-  args,
-  homeDir,
-  provider,
-  targetUrl,
-  selectedBrowser,
-  statusReporter,
-}: Record<string, any>) {
-  const existing = await readLiveBridgeMarker({ homeDir })
-  if (existing) {
-    statusReporter.report({
-      event: 'bridge_ready',
-      status: 'ready',
-      provider,
-      bridgeSession: existing.sessionId,
-    })
-    return { marker: existing, browser: normalizeBrowserId(selectedBrowser), opened: false }
-  }
-
-  statusReporter.report({ event: 'bridge_missing', status: 'not_ready', provider })
-  if (args.noOpen) {
-    throw usageError(
-      'extension_bridge_unavailable',
-      'No live Tokenless runtime bridge is connected. Remove --no-open so Tokenless can open the selected provider page, or run "tokenless setup" and "tokenless doctor --json".'
-    )
-  }
-
-  const browser = await resolveChromiumBrowser(selectedBrowser)
-  await openProviderUrl(targetUrl, browser)
-  statusReporter.report({
-    event: 'provider_opened',
-    status: 'waiting_for_bridge',
-    provider,
-    browser: browser.browser,
-    providerUrl: targetUrl,
-  })
-  await writeTokenlessConfig({ homeDir, browser: browser.browser })
-  const marker = await waitForExtensionBridge({
-    homeDir,
-    timeoutMs: args.bridgeTimeoutMs === undefined ? undefined : Number(args.bridgeTimeoutMs),
-  })
-  statusReporter.report({
-    event: 'bridge_ready',
-    status: 'ready',
-    provider,
-    browser: browser.browser,
-    bridgeSession: marker.sessionId,
-  })
-  return { marker, browser: browser.browser, opened: true }
-}
-
 async function stateCommand(args: CliArgs) {
   const homeDir = tokenlessHome(args.home)
   const config = await readTokenlessConfig(homeDir)
   const configuredDaemonUrl = daemonUrl(args.daemonUrl ?? config.daemonUrl ?? undefined)
-  await ensureDaemonReady({
+  const daemon = await ensureDaemonReady({
     homeDir,
     daemonUrl: configuredDaemonUrl,
     timeoutMs: optionalNumber(args.daemonStartTimeoutMs),
   })
+  const actualDaemonUrl = daemon.url
   const requestedTaskId = args.taskId || args.idempotencyKey || (args.jobId ? undefined : deriveTaskId({
     projectName: args.projectName || process.env.TOKENLESS_PROJECT_NAME,
     chatName: args.chatName || process.env.TOKENLESS_CHAT_NAME,
@@ -1456,17 +2352,20 @@ async function stateCommand(args: CliArgs) {
       throw usageError('missing_task_id', 'Usage: tokenless state requires --task-id, --job-id, or --profile.')
     }
   }
-  const providerValue = args.provider || process.env.TOKENLESS_PROVIDER || (args.jobId ? undefined : config.preferredProviders[0] || 'chatgpt')
-  const provider = providerValue ? normalizeProvider(providerValue) : undefined
+  const explicitProviderValue = args.provider || process.env.TOKENLESS_PROVIDER
   const registry = new ManagedProfileRegistry(homeDir)
   const daemonJobs = args.jobId
-    ? [await getDaemonJob({ daemonUrl: configuredDaemonUrl, homeDir, jobId: args.jobId })]
+    ? [await getDaemonJob({ daemonUrl: actualDaemonUrl, homeDir, jobId: args.jobId })]
     : null
   const profile = daemonJobs
     ? await resolveProfileForDaemonJob(registry, daemonJobs[0]!, args.profile)
     : await registry.resolveProfile(args.profile)
+  const providerValue = explicitProviderValue || (args.jobId
+    ? undefined
+    : config.profilePreferences[profile.slug]?.enabledProviders[0] || config.providerWhitelist[0] || defaultVisibleProviderId())
+  const provider = providerValue ? normalizeProvider(providerValue) : undefined
   const listedDaemonJobs = daemonJobs ?? await listDaemonJobs({
-        daemonUrl: configuredDaemonUrl,
+        daemonUrl: actualDaemonUrl,
         homeDir,
         taskId: requestedTaskId,
         provider,
@@ -1491,9 +2390,22 @@ async function stateCommand(args: CliArgs) {
     )
   }
   const latest = jobs[0]!
+  const recipient = agentRecipientFromArgs(args)
+  if (recipient.agentKind !== undefined && recipient.agentSessionId !== undefined) {
+    const displayedJobIds = new Set(jobs.map((job) => job.jobId))
+    await Promise.all(listedDaemonJobs
+      .filter((job) => displayedJobIds.has(job.job_id) && isReplayActionableStatus(job.status))
+      .map((job) => markDaemonJobReported({
+        homeDir,
+        daemonUrl: actualDaemonUrl,
+        jobId: job.job_id,
+        agentKind: recipient.agentKind!,
+        agentSessionId: recipient.agentSessionId!,
+      })))
+  }
   printPayload({
     ok: true,
-    protocol: 'tokenless.daemon-task-state.v1',
+    protocol: DAEMON_TASK_STATE_SCHEMA_ID,
     transport: 'daemon',
     backend: PLAYWRIGHT_EXECUTION_BACKEND,
     taskId: requestedTaskId ?? latest.taskId,
@@ -1504,6 +2416,38 @@ async function stateCommand(args: CliArgs) {
   }, args)
 }
 
+async function limitsCommand(subcommand: string | undefined, args: CliArgs) {
+  if (subcommand !== 'inspect') throw usageError('invalid_limits_command', 'Usage: tokenless limits inspect --profile <slug> --provider <provider> --json')
+  const homeDir = tokenlessHome(args.home)
+  const provider = normalizeProvider(requiredAdminValue(args.provider, '--provider'))
+  const registry = new ManagedProfileRegistry(homeDir)
+  const profile = await registry.resolveProfile(args.profile)
+  const observation = profile.lastObservedAuth[provider]
+  const config = await readTokenlessConfig(homeDir)
+  const configuredDaemonUrl = daemonUrl(args.daemonUrl ?? config.daemonUrl ?? undefined)
+  const daemon = await ensureDaemonReady({
+    homeDir,
+    daemonUrl: configuredDaemonUrl,
+    timeoutMs: optionalNumber(args.daemonStartTimeoutMs),
+  })
+  const capacity = await getProviderCapacity({
+    homeDir,
+    daemonUrl: daemon.url,
+    provider,
+    profileId: profile.id,
+    accessClass: observation?.account?.tier.class ?? observation?.access ?? 'unknown',
+    tierLabel: observation?.account?.tier.label ?? null,
+    subscriptionLabel: observation?.account?.subscription ?? null,
+  })
+  const eligible = capacity.eligibleAt ? `; next eligible ${capacity.eligibleAt}` : ''
+  printPayload({
+    ok: true,
+    profile: publicManagedProfile(profile, profile.slug),
+    capacity,
+    compactOutput: `Provider capacity for ${provider} / ${profile.slug}: ${capacity.decision}${eligible}.`,
+  }, args)
+}
+
 async function resolveProfileForDaemonJob(
   registry: ManagedProfileRegistry,
   job: Awaited<ReturnType<typeof getDaemonJob>>,
@@ -1537,12 +2481,13 @@ async function resumeCommand(args: CliArgs) {
   const homeDir = tokenlessHome(args.home)
   const config = await readTokenlessConfig(homeDir)
   const configuredDaemonUrl = daemonUrl(args.daemonUrl ?? config.daemonUrl ?? undefined)
-  await ensureDaemonReady({
+  const daemon = await ensureDaemonReady({
     homeDir,
     daemonUrl: configuredDaemonUrl,
     timeoutMs: optionalNumber(args.daemonStartTimeoutMs),
   })
-  const existing = await getDaemonJob({ homeDir, daemonUrl: configuredDaemonUrl, jobId: args.jobId })
+  const actualDaemonUrl = daemon.url
+  const existing = await getDaemonJob({ homeDir, daemonUrl: actualDaemonUrl, jobId: args.jobId })
   if (existing.execution_backend !== PLAYWRIGHT_EXECUTION_BACKEND || !existing.profile_id) {
     throw usageError('invalid_resume_job', 'tokenless resume accepts only a managed Playwright job with a profile.')
   }
@@ -1550,30 +2495,10 @@ async function resumeCommand(args: CliArgs) {
   const profile = (await registry.listProfiles()).find((candidate) => candidate.id === existing.profile_id)
   if (!profile) throw usageError('resume_profile_not_found', 'The managed profile for this Tokenless job is not available.')
 
-  const injectedRunnerEntry = process.env.TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY
-  const browser = injectedRunnerEntry
-    ? {
-        browser: config.browser ?? 'chrome',
-        displayName: 'injected managed Playwright runner',
-        command: process.execPath,
-        argsPrefix: [],
-      }
-    : await resolveChromiumBrowser(config.browser ?? undefined)
-  const runner = await startRunnerSupervisor({
-    homeDir,
-    daemonUrl: configuredDaemonUrl,
-    browser: browser.browser,
-    ...(browser.browser === 'chrome' || browser.browser === 'edge'
-      ? {}
-      : { browserExecutablePath: browser.playwrightExecutablePath }),
-    ...(injectedRunnerEntry === undefined ? {} : { entryPath: injectedRunnerEntry }),
-    ...(args.runnerHeartbeatTimeoutMs === undefined
-      ? {}
-      : { heartbeatTimeoutMs: Number(args.runnerHeartbeatTimeoutMs) }),
-  })
+  const runner = await embeddedRunnerStatus({ homeDir, daemonUrl: actualDaemonUrl })
   const resumed = await resumeDaemonJob({
     homeDir,
-    daemonUrl: configuredDaemonUrl,
+    daemonUrl: actualDaemonUrl,
     jobId: args.jobId,
     browserVisibility: 'headed',
   })
@@ -1588,11 +2513,12 @@ async function resumeCommand(args: CliArgs) {
   })
   const result = await waitForJobWithInterruptCancellation({
     homeDir,
-    daemonUrl: configuredDaemonUrl,
+    daemonUrl: actualDaemonUrl,
     jobId: resumed.job_id,
     timeoutMs: args.timeoutMs === undefined ? DEFAULT_RUN_TIMEOUT_MS : Number(args.timeoutMs),
     cancelTimeoutMs: optionalNumber(args.cancelTimeoutMs),
     statusReporter,
+    ...agentRecipientFromArgs(args),
   })
   if (result?.status === 'waiting_for_user') {
     printPayload(waitingForUserPayload({
@@ -1627,16 +2553,17 @@ async function cancelCommand(args: CliArgs) {
   const homeDir = tokenlessHome(args.home)
   const config = await readTokenlessConfig(homeDir)
   const configuredDaemonUrl = daemonUrl(args.daemonUrl ?? config.daemonUrl ?? undefined)
-  await ensureDaemonReady({
+  const daemon = await ensureDaemonReady({
     homeDir,
     daemonUrl: configuredDaemonUrl,
     timeoutMs: optionalNumber(args.daemonStartTimeoutMs),
   })
+  const actualDaemonUrl = daemon.url
   let job: Record<string, any>
   try {
     job = await cancelDaemonJob({
       homeDir,
-      daemonUrl: configuredDaemonUrl,
+      daemonUrl: actualDaemonUrl,
       jobId: args.jobId,
       reason: { code: 'user_requested' },
       requestTimeoutMs: optionalNumber(args.cancelTimeoutMs),
@@ -1647,6 +2574,16 @@ async function cancelCommand(args: CliArgs) {
   if (job.status !== 'canceled') {
     throw cancelFailure(args.jobId, new Error(`daemon returned status ${String(job.status)}`))
   }
+  const recipient = agentRecipientFromArgs(args)
+  if (recipient.agentKind !== undefined && recipient.agentSessionId !== undefined) {
+    await markDaemonJobReported({
+      homeDir,
+      daemonUrl: actualDaemonUrl,
+      jobId: job.job_id,
+      agentKind: recipient.agentKind,
+      agentSessionId: recipient.agentSessionId,
+    })
+  }
   printPayload({
     ok: true,
     transport: 'daemon',
@@ -1656,26 +2593,54 @@ async function cancelCommand(args: CliArgs) {
   }, args)
 }
 
+async function daemonCommand(subcommand: string | undefined, args: CliArgs) {
+  const homeDir = tokenlessHome(args.home)
+  const config = await readTokenlessConfig(homeDir)
+  const configuredDaemonUrl = daemonUrl(args.daemonUrl ?? config.daemonUrl ?? undefined)
+  const result = await stopDaemon({
+    homeDir,
+    daemonUrl: configuredDaemonUrl,
+    timeoutMs: args.timeoutMs === undefined ? undefined : strictPositiveInteger(args.timeoutMs, '--timeout-ms'),
+  })
+  printPayload(result, args)
+}
+
 async function installCommand(args: CliArgs) {
   const provisioned = await provisionRuntime(args)
   printPayload({
     ok: true,
-    runtime: 'rust',
-    browser: provisioned.browser.browser,
+    runtime: 'typescript',
+    skills: provisioned.skills,
+    browser: {
+      id: provisioned.browser.browserId,
+      runtimeId: provisioned.browser.runtimeId,
+      family: provisioned.browser.family,
+      version: provisioned.browser.actualVersion,
+      source: provisioned.browser.source,
+    },
     browsers: provisioned.browsers,
     daemon: {
       ready: true,
       started: provisioned.daemon.started,
-      url: provisioned.daemonUrl,
+      url: provisioned.daemon.url,
       pid: provisioned.daemon.pid,
       executable: provisioned.installed.daemonExecutable,
     },
-    nextStep: 'Run "tokenless setup" to configure skills, a managed browser profile, preferred providers, and visible readiness.',
+    nextStep: 'Run "tokenless setup" to configure skills, a managed browser profile, the provider whitelist, and a one-time visible sign-in status report.',
   }, args)
 }
 
 async function setupCommand(args: CliArgs) {
+  if (args.importChromeProfile !== undefined || args.reimportProfile === true) {
+    requireOpaqueProfileCopyConsent(args)
+  }
   const homeDir = tokenlessHome(args.home)
+  let config = await readTokenlessConfig(homeDir)
+  const languageConfigured = await hasConfiguredTokenlessLanguage(homeDir)
+  if (!languageConfigured) {
+    config = await writeTokenlessConfig({ homeDir, language: detectSystemLanguage() })
+  }
+  setActiveLanguage(config.language)
   const setupTerminal = resolveSetupTerminalCapabilities({
     json: args.json === true || args.setupDefaults === true,
     stdin: process.stdin,
@@ -1690,40 +2655,84 @@ async function setupCommand(args: CliArgs) {
   const prompt = setupTerminal.canPrompt ? createSetupPrompt() : null
   try {
     presenter.welcome()
-    const config = await presenter.withProgress('Reading config', () => readTokenlessConfig(homeDir))
+    presenter.success('Reading config')
+    const cliVersion = await presenter.withProgress('Checking npm version', setupCliVersionCheck)
+    noteSetupCliVersion(cliVersion, presenter)
     const configuredDaemonUrl = daemonUrl(args.daemonUrl ?? config.daemonUrl ?? undefined)
-    const skills = await ensureSetupSkills({ args, prompt, presenter })
-    const installedBrowsers = await presenter.withProgress('Finding browsers', discoverSetupBrowsers)
-    const browser = await selectSetupBrowser({ args, config, installedBrowsers, prompt, presenter })
-    const providers = selectSetupProviders({ presenter })
+    const runtimeManager = new BrowserRuntimeManager({ homeDir })
+    const selectedBrowser = await selectSetupBrowser({
+      args,
+      config,
+      runtimeManager,
+      prompt,
+      presenter,
+    })
+    if (
+      config.browser !== selectedBrowser.runtime.selection ||
+      config.browserExecutablePath !== selectedBrowser.runtime.executablePath
+    ) {
+      await quiesceBrowserRuntimeForProfileMutation({
+        homeDir,
+        daemonUrl: configuredDaemonUrl,
+        startIfUnavailable: false,
+      })
+      config = await writeTokenlessConfig({
+        homeDir,
+        browser: selectedBrowser.runtime.selection,
+        browserExecutablePath: selectedBrowser.runtime.executablePath,
+      })
+    }
+    const providers = await selectSetupProviders({ args, config, homeDir, prompt, presenter })
+    const profileArgs = selectedBrowser.cloakImportSelection === null
+      ? args
+      : {
+          ...args,
+          importChromeProfile: selectedBrowser.cloakImportSelection.directoryKey,
+          chromeUserDataDir: selectedBrowser.cloakImportSelection.userDataDir,
+          consentLocalProfileCopy: true,
+          setupImportBrowser: selectedBrowser.cloakImportSelection.browser,
+        }
+    const profile = await ensureSetupManagedProfile({
+      args: profileArgs,
+      homeDir,
+      runtime: selectedBrowser.runtime,
+      prompt,
+      presenter,
+    })
     await presenter.withProgress('Saving preferences', async () => {
-      if (config.browser && config.browser !== browser.browser) {
-        await stopRunnerSupervisor({ homeDir })
+      const current = await readTokenlessConfig(homeDir)
+      const profilePreferences = {
+        ...current.profilePreferences,
+        [profile.slug]: {
+          profileId: profile.slug,
+          roleLabel: current.profilePreferences[profile.slug]?.roleLabel ?? '',
+          enabledProviders: providers,
+          browserVisibility: current.profilePreferences[profile.slug]?.browserVisibility ?? current.browserVisibility,
+          proxy: current.profilePreferences[profile.slug]?.proxy ?? null,
+        },
       }
       await writeTokenlessConfig({
         homeDir,
-        browser: browser.browser,
-        preferredProviders: providers,
+        browser: selectedBrowser.runtime.selection,
+        browserExecutablePath: selectedBrowser.runtime.executablePath,
+        providerWhitelist: [...new Set(Object.values(profilePreferences).flatMap((preferences) => preferences.enabledProviders))],
+        profilePreferences,
         daemonUrl: configuredDaemonUrl,
+        language: config.language,
       })
     })
-    const localRuntime = await presenter.withProgress('Local runtime', () => ensureDaemonReady({
+    const maintenance = await reconcileTokenlessMaintenance({
       homeDir,
       daemonUrl: configuredDaemonUrl,
-      timeoutMs: optionalNumber(args.daemonStartTimeoutMs),
-    }))
-    const profile = await ensureSetupManagedProfile({
-      args,
-      homeDir,
-      browser: browser.browser,
-      providers,
-      prompt,
-      presenter,
+      daemonStartTimeoutMs: optionalNumber(args.daemonStartTimeoutMs),
+      runStep: (_phase, label, task) => presenter.withProgress(label, task),
     })
+    const skills = maintenance.skills
+    const localRuntime = maintenance.daemon
     const registry = new ManagedProfileRegistry(homeDir)
     const readiness: Record<string, SetupProviderReadiness> = {}
-    const userActions: Record<string, any> = {}
     let runner: Record<string, any> | null = null
+    const reviewSessionId = randomUUID()
 
     presenter.explain({
       title: 'Provider sign-in',
@@ -1734,15 +2743,13 @@ async function setupCommand(args: CliArgs) {
       try {
         result = await presenter.withProgress(
           `Checking ${provider} sign-in`,
-          () => runSetupAuthCheck({ args, homeDir, profile, provider, quietStatus: setupTerminal.canPresent }),
+          () => runSetupAuthCheck({ args, homeDir, profile, provider, reviewSessionId, quietStatus: setupTerminal.canPresent }),
         )
       } catch (error) {
         recordSetupReadinessFailure({
-          profile,
           provider,
           failure: setupReadinessCaughtFailure(error),
           readiness,
-          userActions,
           presenter,
         })
         continue
@@ -1754,207 +2761,119 @@ async function setupCommand(args: CliArgs) {
         provider,
         result,
         readiness,
-        userActions,
         presenter,
       })
     }
 
-    const actionableProviders = providers.filter((provider) => readiness[provider]?.classification === 'action_required')
-
-    for (const provider of actionableProviders) {
-      if (!prompt && provider !== actionableProviders[0]) break
-      let handoffResult: Awaited<ReturnType<typeof runSetupHandoffOpenCheck>>
-      try {
-        handoffResult = await presenter.withProgress(
-          `Opening ${provider} handoff`,
-          () => runSetupHandoffOpenCheck({
-            args,
-            homeDir,
-            profile,
-            provider,
-            quietStatus: setupTerminal.canPresent,
-          }),
-        )
-      } catch (error) {
-        recordSetupReadinessFailure({
-          profile,
-          provider,
-          failure: setupReadinessCaughtFailure(error),
-          readiness,
-          userActions,
-          presenter,
-        })
-        continue
-      }
-      runner = handoffResult.runner
-      const handoffFailure = setupReadinessTechnicalFailure(handoffResult)
-      if (handoffFailure) {
-        readiness[provider] = {
-          provider,
-          classification: 'failed',
-          auth: readiness[provider]?.auth ?? 'unknown',
-          status: handoffFailure.status,
-          jobId: handoffFailure.jobId,
-          error: setupReadinessErrorPayload(handoffFailure),
-        }
-        delete userActions[provider]
-        presenter.note(`${provider} handoff failed: ${handoffFailure.code}.`)
-        continue
-      }
-
-      const handoff = setupHandoffAction({
-        provider,
-        profile,
-        jobId: handoffResult.job.job_id,
-        status: handoffResult.waitResult?.status ?? 'unknown',
-      })
-      const currentReadiness = readiness[provider] ?? {
-        provider,
-        classification: 'action_required' as const,
-        auth: 'unknown' as const,
-        status: handoffResult.waitResult?.status ?? 'unknown',
-      }
-      readiness[provider] = {
-        ...currentReadiness,
-        handoff,
-        ...(handoffResult.waitResult?.blocker ? { blocker: handoffResult.waitResult.blocker } : {}),
-      }
-      userActions[provider] = {
-        ...(userActions[provider] ?? {}),
-        handoff,
-      }
-
-      if (!prompt) {
-        presenter.note(`${provider} handoff was opened in managed profile ${profile.slug}.`)
-        break
-      }
-
-      presenter.handover(
-        provider,
-        handoffResult.waitResult?.status === 'waiting_for_user'
-          ? setupReadinessHandoffDetail({ provider, profile, jobId: handoffResult.job.job_id })
-          : handoff.message,
-        'Finish in the Tokenless-managed Chrome window/tab, then press Enter here. Tokenless will submit a fresh readiness check.',
-      )
-      await prompt.pause(`After ${provider} is signed in and the composer is visible in profile ${profile.slug}, press Enter to recheck.`)
-      if (handoffResult.waitResult?.status === 'waiting_for_user') {
-        let resumed: Awaited<ReturnType<typeof waitForSetupJobAfterUser>>
-        try {
-          resumed = await presenter.withProgress(
-            `Waiting for ${provider} handoff`,
-            () => waitForSetupJobAfterUser({
-              homeDir,
-              daemonUrl: configuredDaemonUrl,
-              jobId: handoffResult.job.job_id,
-              timeoutMs: args.timeoutMs === undefined ? 600_000 : Number(args.timeoutMs),
-            }),
-          )
-        } catch (error) {
-          recordSetupReadinessFailure({
-            profile,
-            provider,
-            failure: {
-              ...setupReadinessCaughtFailure(error),
-              jobId: handoffResult.job.job_id,
-            },
-            readiness,
-            userActions,
-            presenter,
-          })
-          continue
-        }
-        const resumedFailure = setupReadinessTechnicalFailure({ ...handoffResult, waitResult: resumed })
-        if (resumedFailure) {
-          readiness[provider] = {
-            provider,
-            classification: 'failed',
-            auth: readiness[provider]?.auth ?? 'unknown',
-            status: resumedFailure.status,
-            jobId: resumedFailure.jobId,
-            error: setupReadinessErrorPayload(resumedFailure),
-          }
-          delete userActions[provider]
-          continue
-        }
-      }
-
-      let recheck: Awaited<ReturnType<typeof runSetupAuthCheck>>
-      try {
-        recheck = await presenter.withProgress(
-          `Re-checking ${provider} sign-in`,
-          () => runSetupAuthCheck({ args, homeDir, profile, provider, quietStatus: setupTerminal.canPresent }),
-        )
-      } catch (error) {
-        recordSetupReadinessFailure({
-          profile,
-          provider,
-          failure: setupReadinessCaughtFailure(error),
-          readiness,
-          userActions,
-          presenter,
-        })
-        continue
-      }
-      runner = recheck.runner
-      await recordSetupSweepResult({
-        registry,
-        profile,
-        provider,
-        result: recheck,
-        readiness,
-        userActions,
-        presenter,
-      })
-    }
+    const reviewTabs = await ensureSetupProviderReviewTabs({
+      args,
+      homeDir,
+      profile,
+      providers,
+      reviewSessionId,
+      daemonUrl: localRuntime.url,
+      presenter,
+    })
 
     const updatedProfile = await registry.resolveProfile(profile.slug)
     const providerSummary = setupProviderSummary(readiness)
-    const status = providerSummary.status
-    const hasActionRequired = providerSummary.counts.action_required > 0
-    const waitingForUser = status === 'waiting_for_user'
+    const status = reviewTabs.failures.length > 0 || reviewTabs.keepOpenError ? 'failed' : providerSummary.status
     const failed = status === 'failed'
     const firstFailure = firstSetupFailure(readiness)
     if (failed) process.exitCode = 1
     presenter.summary(
-      failed
+      reviewTabs.keepOpenError
+        ? `Setup could not keep provider review tabs open in profile ${updatedProfile.slug}.`
+        : reviewTabs.failures.length > 0
+        ? `Setup could not open ${reviewTabs.failures.length} provider review tab(s) in profile ${updatedProfile.slug}.`
+        : failed
         ? `Setup found technical failures for ${providerSummary.counts.failed} provider(s) in profile ${updatedProfile.slug}.`
-        : waitingForUser
-        ? `Setup is waiting for visible user action in profile ${updatedProfile.slug}.`
-        : `Setup is ready for ${providers.join(', ')} with profile ${updatedProfile.slug}.`,
+        : `Setup checked provider sign-in status once for profile ${updatedProfile.slug}.`,
     )
+    const dashboard = setupTerminal.canPrompt && args.noOpen !== true
+      ? await openTokenlessDashboard({
+          homeDir,
+          daemonUrl: localRuntime.url,
+          profileId: updatedProfile.id,
+          open: true,
+        }).then((value) => ({
+          opened: value.opened !== null,
+          reused: value.opened?.reused ?? false,
+          command: 'tokenless dashboard',
+        }), (error) => ({
+          opened: false,
+          command: 'tokenless dashboard',
+          error: { code: (error as CliError).code ?? 'dashboard_open_failed', message: (error as Error).message },
+        }))
+      : { opened: false, command: 'tokenless dashboard' }
     printPayload({
       ok: !failed,
-      completed: status === 'ready',
+      completed: status === 'reported' && reviewTabs.failures.length === 0 && !reviewTabs.keepOpenError,
       status,
-      runtime: 'rust',
+      cli: {
+        packageName: cliVersion.packageName,
+        currentVersion: cliVersion.currentVersion,
+        currentMajor: cliVersion.currentMajor,
+        latestVersion: cliVersion.latestVersion,
+        latestMajor: cliVersion.latestMajor,
+        status: cliVersion.status,
+        updateAvailable: cliVersion.updateAvailable,
+        registry: {
+          ok: cliVersion.ok,
+          url: cliVersion.registryUrl,
+          ...(cliVersion.error === undefined ? {} : { error: cliVersion.error }),
+        },
+      },
+      runtime: 'typescript',
       transport: 'daemon',
       backend: PLAYWRIGHT_EXECUTION_BACKEND,
       skills,
       browser: {
-        id: browser.browser,
-        displayName: browser.displayName,
+        id: selectedBrowser.runtime.selection,
+        antiDetect: selectedBrowser.runtime.selection === 'cloak',
+        detectedChromeVersion: selectedBrowser.detectedChromeVersion,
+        runtimeId: selectedBrowser.runtime.runtimeId,
+        family: selectedBrowser.runtime.family,
+        displayName: selectedBrowser.runtime.displayName,
+        version: selectedBrowser.runtime.actualVersion,
+        expectedVersion: selectedBrowser.runtime.expectedVersion,
+        source: selectedBrowser.runtime.source,
+        executablePath: selectedBrowser.runtime.executablePath,
+        checksumVerified: selectedBrowser.runtime.checksumVerified,
         installed: true,
+        ...(selectedBrowser.cloakProfileInventory === null
+          ? {}
+          : { profileInventory: selectedBrowser.cloakProfileInventory }),
       },
       providers,
       readiness,
+      reviewTabs,
       summary: providerSummary,
       counts: providerSummary.counts,
       ...(firstFailure === null ? {} : { error: setupReadinessErrorPayload(firstFailure) }),
-      ...(hasActionRequired ? { waitingForUser: true, userActions } : {}),
       profile: publicManagedProfile(updatedProfile, await defaultProfileSlug(registry)),
       runner,
       daemon: {
         ready: true,
-        url: configuredDaemonUrl,
+        running: true,
+        status: 'running',
+        url: localRuntime.url,
         started: localRuntime.started,
         pid: localRuntime.pid,
-        version: localRuntime.body?.version,
+        version: localRuntime.runningVersion,
+        expectedVersion: localRuntime.expectedVersion,
+        expectedMajor: localRuntime.expectedMajor,
+        runningMajor: localRuntime.runningMajor,
+        versionCompatible: localRuntime.versionCompatible,
+        compatibility: {
+          ok: localRuntime.versionCompatible,
+          policy: 'exact_package_version',
+        },
       },
+      dashboard,
       compactOutput: failed
-        ? setupFailedCompactOutput({ providers, profile: updatedProfile, readiness, providerSummary, userActions })
-        : waitingForUser
-          ? setupWaitingCompactOutput({ providers, profile: updatedProfile, userActions, readiness, providerSummary })
-          : setupReadyCompactOutput({ providers, profile: updatedProfile, readiness, providerSummary }),
+        ? `${setupFailedCompactOutput({ providers, profile: updatedProfile, readiness, providerSummary })} ${setupCliVersionCompact(cliVersion)} ${setupDaemonCompact(localRuntime)}`
+        : `${setupReportedCompactOutput({ providers, profile: updatedProfile, readiness, providerSummary })} ${setupCliVersionCompact(cliVersion)} ${setupDaemonCompact(localRuntime)}`,
     }, args)
   } finally {
     prompt?.close()
@@ -1967,7 +2886,6 @@ async function recordSetupSweepResult({
   provider,
   result,
   readiness,
-  userActions,
   presenter,
 }: {
   registry: ManagedProfileRegistry
@@ -1979,106 +2897,60 @@ async function recordSetupSweepResult({
     statusLog?: StatusEvent[]
   }
   readiness: Record<string, SetupProviderReadiness>
-  userActions: Record<string, any>
   presenter: SetupPresenter
 }) {
   const failure = setupReadinessTechnicalFailure(result)
   if (failure) {
-    recordSetupReadinessFailure({ profile, provider, failure, readiness, userActions, presenter })
+    recordSetupReadinessFailure({ provider, failure, readiness, presenter })
     return
   }
 
-  const observedAuth = authStateFromManagedResult(result.waitResult?.result)
-  if (observedAuth) {
-    await registry.updateProviderStatus(profile.slug, {
-      provider,
-      auth: observedAuth,
-      checkedAt: new Date().toISOString(),
-    })
-  }
+  const authObservation = authObservationFromManagedResult(result.waitResult?.result) ?? {
+    state: 'unknown',
+    access: 'unknown',
+  } satisfies ManagedAuthObservation
+  await registry.updateProviderStatus(profile.slug, {
+    provider,
+    auth: authObservation.state,
+    access: authObservation.access,
+    checkedAt: new Date().toISOString(),
+    ...(authObservation.state === 'authenticated' && authObservation.account
+      ? { account: authObservation.account }
+      : {}),
+  })
 
   const status = result.waitResult?.status ?? 'unknown'
   const blocker = result.waitResult?.blocker
-  if (observedAuth === 'authenticated') {
-    delete userActions[provider]
-    readiness[provider] = {
-      provider,
-      classification: 'ready',
-      auth: observedAuth,
-      status,
-      jobId: result.job.job_id,
-      ...(blocker ? { blocker } : {}),
-    }
-    presenter.success(`${provider} readiness is authenticated.`)
-    return
-  }
-
-  const userAction = status === 'waiting_for_user'
-    ? setupReadinessUserAction({
-        provider,
-        profile,
-        jobId: result.job.job_id,
-        blocker,
-      })
-    : setupReadinessFreshRecheckAction({
-        provider,
-        profile,
-        jobId: result.job.job_id,
-        reason: observedAuth === 'unauthenticated'
-          ? 'The setup auth sweep completed while the provider was signed out.'
-          : observedAuth === 'unknown'
-            ? 'The setup auth sweep completed but auth status was unknown.'
-            : 'The setup auth sweep completed without an auth status response.',
-      })
-  userActions[provider] = userAction
+  const auth = authObservation.state
   readiness[provider] = {
     provider,
-    classification: 'action_required',
-    auth: observedAuth ?? 'unknown',
+    classification: auth,
+    auth,
+    access: authObservation.access,
     status,
     jobId: result.job.job_id,
     ...(blocker ? { blocker } : {}),
-    userAction,
   }
-  presenter.note(`${provider} readiness requires visible user action in managed profile ${profile.slug}.`)
+  if (auth === 'authenticated') presenter.success(`${provider} is authenticated (${authObservation.access}).`)
+  else presenter.note(`${provider} sign-in status: ${auth}; access: ${authObservation.access}.`)
 }
 
 function recordSetupReadinessFailure({
-  profile,
   provider,
   failure,
   readiness,
-  userActions,
   presenter,
 }: {
-  profile: ManagedProfileRecord
   provider: ProviderId
   failure: SetupTechnicalFailure
   readiness: Record<string, SetupProviderReadiness>
-  userActions: Record<string, any>
   presenter: SetupPresenter
 }) {
-  if (isSetupActionableReadinessFailure(failure)) {
-    const userAction = setupReadinessFailureUserAction({ provider, profile, failure })
-    userActions[provider] = userAction
-    readiness[provider] = {
-      provider,
-      classification: 'action_required',
-      auth: 'unknown',
-      status: failure.status,
-      jobId: failure.jobId,
-      userAction,
-      error: setupReadinessErrorPayload(failure),
-    }
-    presenter.note(`${provider} readiness needs visible sign-in in managed profile ${profile.slug}.`)
-    return
-  }
-
-  delete userActions[provider]
   readiness[provider] = {
     provider,
     classification: 'failed',
     auth: readiness[provider]?.auth ?? 'unknown',
+    access: readiness[provider]?.access ?? 'unknown',
     status: failure.status,
     jobId: failure.jobId,
     error: setupReadinessErrorPayload(failure),
@@ -2089,32 +2961,38 @@ function recordSetupReadinessFailure({
 async function ensureSetupManagedProfile({
   args,
   homeDir,
-  browser,
-  providers,
+  runtime,
   prompt,
   presenter,
 }: {
   args: CliArgs
   homeDir: string
-  browser: string
-  providers: readonly ProviderId[]
+  runtime: ResolvedBrowserRuntime
   prompt: ReturnType<typeof createSetupPrompt> | null
   presenter: SetupPresenter
 }) {
+  const runtimeBinding = browserRuntimeBinding(runtime)
   presenter.explain({
     title: 'Managed browser profile',
     lines: SETUP_MANAGED_PROFILE_DISCLOSURE,
   })
   const registry = new ManagedProfileRegistry(homeDir)
   const existing = await managedProfilesWithDisplayLabels(await registry.listProfiles())
+  const compatibleExisting = existing.filter((profile) => setupProfileRuntimeCompatible(profile, runtime))
   const configuredDefaultProfile = (await registry.read()).defaultProfile
   let slug = args.profile === undefined ? undefined : String(args.profile)
   let selected: ManagedProfileRecord | null = null
   if (slug) {
     selected = existing.find((profile) => profile.slug === slug) ?? null
+    if (selected && !setupProfileRuntimeCompatible(selected, runtime)) {
+      throw usageError(
+        'setup_profile_runtime_mismatch',
+        `Managed profile '${selected.slug}' cannot use ${runtime.runtimeId}; create a clean profile for that browser runtime.`,
+      )
+    }
   } else if (prompt && existing.length > 0) {
     const choices = [
-      ...existing.map((profile) => ({
+      ...compatibleExisting.map((profile) => ({
         label: `${profile.label} (${profile.slug})${profile.import ? ' — imported' : ' — clean'}`,
         value: profile.slug,
       })),
@@ -2123,120 +3001,131 @@ async function ensureSetupManagedProfile({
     const chosen = await prompt.select(
       'Choose a managed profile',
       choices,
-      Math.max(0, existing.findIndex((profile) => profile.slug === configuredDefaultProfile))
+      Math.max(0, choices.findIndex((choice) => choice.value === configuredDefaultProfile))
     )
     if (chosen !== '__new__') {
       slug = chosen
-      selected = existing.find((profile) => profile.slug === slug) ?? null
+      selected = compatibleExisting.find((profile) => profile.slug === slug) ?? null
     }
   } else if (existing.length > 0) {
     try {
-      selected = await registry.resolveProfile()
-      slug = selected.slug
+      const defaultProfile = await registry.resolveProfile()
+      if (setupProfileRuntimeCompatible(defaultProfile, runtime)) {
+        selected = defaultProfile
+        slug = selected.slug
+      }
     } catch {
       // An explicit profile is required below when no default exists.
     }
   }
 
   if (selected) {
-    const reimport = args.reimportProfile === true || (prompt && args.freshProfile !== true
-      ? await prompt.confirm(`Re-import ${selected.slug} from ${browser}? This replaces its managed browser data.`, false)
-      : false)
-    if (reimport) {
-      if (!prompt && args.importChromeProfile === undefined) {
-        throw usageError(
-          'setup_reimport_source_required',
-          'Noninteractive re-import requires --import-browser-profile and explicit copy consent.'
+    if (!selected.runtimeBinding) {
+      await quiesceBrowserRuntimeForProfileMutation({ homeDir, startIfUnavailable: false })
+      selected = await registry.bindRuntime(selected.slug, runtimeBinding)
+    }
+    const selectedProfile = selected
+    if (args.reimportProfile === true || args.importChromeProfile !== undefined) {
+      requireOpaqueProfileCopyConsent(args)
+      const source = args.importChromeProfile === undefined
+        ? (selectedProfile.import
+          ? { ...await resolveChromeProfile(selectedProfile.import.source, selectedProfile.import.profileDirectoryKey), browser: selectedProfile.import.browser ?? 'chrome' }
+          : null)
+        : await resolveOpaqueProfileSource(
+          args,
+          runtime,
+          validateChromeProfileDirectoryKey(String(args.importChromeProfile)),
         )
+      if (!source) {
+        throw usageError('setup_reimport_source_required', `Managed profile '${selectedProfile.slug}' has no recorded import source.`)
       }
-      const source = await selectSetupSourceProfile({ args, browser, prompt })
-      requireSetupCopyAuthorization({ args, prompt })
+      assertCloakProfileImportCompatible(source, runtime)
+      await quiesceBrowserRuntimeForProfileMutation({ homeDir })
+      await registry.updateLifecycle(selectedProfile.slug, 'importing')
       try {
-        return await presenter.withProgress(`Re-importing ${source.name} into managed profile ${selected.slug}`, async () => {
-          await stopRunnerSupervisor({ homeDir })
-          await registry.updateLifecycle(selected.slug, 'importing')
-          await importChromeProfile({
+        await presenter.withProgress(`Copying ${source.name} into managed profile ${selectedProfile.slug}`, () =>
+          copyOpaqueChromiumProfile({
             sourceUserDataDir: source.userDataDir,
             profileDirectoryKey: source.directoryKey,
-            destinationDir: selected.directory,
+            destinationDir: selectedProfile.directory,
             tokenlessHome: homeDir,
-            providers,
-          })
-          return await registry.markImported(selected.slug, {
-            source: source.userDataDir,
-            profileDirectoryKey: source.directoryKey,
-            profileName: source.name,
-            browser: setupProfileImportBrowser(browser),
-            providers,
-          })
+          }))
+        selected = await registry.markImported(selectedProfile.slug, {
+          source: source.userDataDir,
+          profileDirectoryKey: source.directoryKey,
+          profileName: source.name,
+          browser: source.browser,
+          browserVersion: source.browserVersion,
         })
       } catch (error) {
-        await registry.updateLifecycle(selected.slug, 'failed').catch(() => undefined)
+        await registry.updateLifecycle(selectedProfile.slug, 'failed').catch(() => undefined)
         throw error
       }
+      if (args.setDefault === true || prompt) await registry.setDefault(selected.slug)
+      return selected
     }
-    if (selected.lifecycle !== 'ready') {
+    if (selectedProfile.lifecycle !== 'ready') {
       throw usageError(
         'setup_profile_not_ready',
-        `Managed profile '${selected.slug}' is ${selected.lifecycle}; explicitly re-import it or choose another ready profile.`
+        `Managed profile '${selectedProfile.slug}' is ${selectedProfile.lifecycle}; choose another ready profile or create a clean profile.`
       )
     }
     if (args.setDefault === true || prompt) {
-      await presenter.withProgress(`Setting managed profile ${selected.slug} as default`, () => registry.setDefault(selected.slug))
+      await presenter.withProgress(`Setting managed profile ${selectedProfile.slug} as default`, () => registry.setDefault(selectedProfile.slug))
     }
-    return selected
+    return selectedProfile
   }
 
   if (!slug && prompt) slug = await prompt.text('Profile name', existing.length === 0 ? 'default' : 'primary')
-  if (!slug && args.setupDefaults === true) slug = 'default'
+  if (!slug && args.setupDefaults === true) {
+    slug = existing.length === 0 ? 'default' : setupRuntimeProfileSlug(runtime, existing)
+  }
   slug ??= 'default'
   if (args.reimportProfile === true) {
     throw usageError('setup_reimport_profile_not_found', `Cannot re-import unregistered managed profile '${slug}'.`)
   }
-  let source: { userDataDir: string; directoryKey: string; name: string } | null = null
-  if (args.importChromeProfile !== undefined) {
-    source = await selectSetupSourceProfile({ args, browser, prompt: null })
-  } else if (prompt && args.freshProfile !== true) {
-    const discovered = await setupSourceProfiles(browser, args.chromeUserDataDir)
-    if (discovered.length > 0 && await prompt.confirm(`Import an existing ${browser} profile into Tokenless?`, true)) {
-      source = await selectSetupSourceProfile({ args, browser, prompt, discovered })
-    }
-  } else if (args.freshProfile !== true && args.setupDefaults !== true) {
+  const source = args.importChromeProfile === undefined
+    ? null
+    : await resolveOpaqueProfileSource(
+      args,
+      runtime,
+      validateChromeProfileDirectoryKey(String(args.importChromeProfile)),
+    )
+  if (source) assertCloakProfileImportCompatible(source, runtime)
+  if (source) requireOpaqueProfileCopyConsent(args)
+  if (!prompt && args.freshProfile !== true && args.setupDefaults !== true && !source) {
     throw usageError(
       'setup_profile_choice_required',
       'Initial noninteractive setup requires --defaults, --fresh, or --import-browser-profile with explicit copy consent.'
     )
   }
-  if (source) requireSetupCopyAuthorization({ args, prompt })
   let record = await presenter.withProgress(
     source ? `Creating managed profile ${slug} for import` : `Creating clean managed profile ${slug}`,
     () => registry.addProfile({
       slug,
       label: args.label === undefined ? (source?.name ?? slug) : String(args.label),
-      labelOrigin: args.label === undefined && source ? 'import' : (args.label === undefined ? 'slug' : 'user'),
+      labelOrigin: args.label === undefined ? (source ? 'import' : 'slug') : 'user',
       setDefault: true,
       lifecycle: source ? 'importing' : 'ready',
+      runtimeBinding,
     }),
   )
+  if (!source) return record
   try {
-    if (source) {
-      record = await presenter.withProgress(`Importing ${source.name} into managed profile ${slug}`, async () => {
-        await importChromeProfile({
-          sourceUserDataDir: source.userDataDir,
-          profileDirectoryKey: source.directoryKey,
-          destinationDir: record.directory,
-          tokenlessHome: homeDir,
-          providers,
-        })
-        return await registry.markImported(record.slug, {
-          source: source.userDataDir,
-          profileDirectoryKey: source.directoryKey,
-          profileName: source.name,
-          browser: setupProfileImportBrowser(browser),
-          providers,
-        })
-      })
-    }
+    await presenter.withProgress(`Copying ${source.name} into managed profile ${slug}`, () =>
+      copyOpaqueChromiumProfile({
+        sourceUserDataDir: source.userDataDir,
+        profileDirectoryKey: source.directoryKey,
+        destinationDir: record.directory,
+        tokenlessHome: homeDir,
+      }))
+    record = await registry.markImported(record.slug, {
+      source: source.userDataDir,
+      profileDirectoryKey: source.directoryKey,
+      profileName: source.name,
+      browser: source.browser,
+      browserVersion: source.browserVersion,
+    })
     return record
   } catch (error) {
     await registry.removeProfile(record.slug, { confirmDelete: true }).catch(() => undefined)
@@ -2244,257 +3133,406 @@ async function ensureSetupManagedProfile({
   }
 }
 
+function browserRuntimeBinding(runtime: ResolvedBrowserRuntime): BrowserRuntimeBinding {
+  return {
+    runtimeId: runtime.runtimeId,
+    family: runtime.family,
+    browserId: runtime.browserId,
+    createdWithVersion: runtime.actualVersion,
+    profileFormat: 1,
+  }
+}
+
+function setupProfileRuntimeCompatible(
+  profile: ManagedProfileRecord,
+  runtime: ResolvedBrowserRuntime,
+) {
+  const binding = profile.runtimeBinding
+  if (binding) {
+    return binding.runtimeId === runtime.runtimeId &&
+      binding.family === runtime.family &&
+      binding.browserId === runtime.browserId
+  }
+  if (runtime.family !== 'system' && runtime.family !== 'test') return false
+  if (!profile.import?.browser) return true
+  return profile.import.browser === runtime.browserId
+}
+
+function setupRuntimeProfileSlug(
+  runtime: ResolvedBrowserRuntime,
+  existing: readonly ManagedProfileRecord[],
+) {
+  const base = `${runtime.browserId}-default`.replace(/[^a-z0-9_-]+/g, '-').slice(0, 56)
+  const used = new Set(existing.map((profile) => profile.slug))
+  if (!used.has(base)) return base
+  for (let index = 2; index < 10_000; index += 1) {
+    const candidate = `${base}-${index}`.slice(0, 64)
+    if (!used.has(candidate)) return candidate
+  }
+  throw usageError('setup_profile_name_unavailable', `Cannot allocate a managed profile name for ${runtime.runtimeId}.`)
+}
+
 function createSetupPrompt() {
   const terminal = createInterface({ input: process.stdin, output: process.stdout })
   return {
     async text(message: string, defaultValue?: string) {
       const suffix = defaultValue ? ` [${defaultValue}]` : ''
-      const value = (await terminal.question(`${message}${suffix}: `)).trim()
+      const value = (await terminal.question(`${localizeText(message)}${suffix}: `)).trim()
       return value || defaultValue || ''
     },
     async confirm(message: string, defaultValue: boolean) {
       const hint = defaultValue ? 'Y/n' : 'y/N'
-      const value = (await terminal.question(`${message} [${hint}]: `)).trim().toLowerCase()
+      const value = (await terminal.question(`${localizeText(message)} [${hint}]: `)).trim().toLowerCase()
       if (!value) return defaultValue
-      return value === 'y' || value === 'yes'
+      return value === 'y' || value === 'yes' || value === '是' || value === '对'
     },
     async select<T extends string>(
       message: string,
       choices: readonly { label: string; value: T }[],
       defaultIndex = 0
     ): Promise<T> {
-      console.error(message)
-      choices.forEach((choice, index) => console.error(`  ${index + 1}. ${choice.label}`))
-      const answer = (await terminal.question(`Choose [${defaultIndex + 1}]: `)).trim()
+      console.error(localizeText(message))
+      choices.forEach((choice, index) => console.error(`  ${index + 1}. ${localizeText(choice.label)}`))
+      const answer = (await terminal.question(localizeText(`Choose [${defaultIndex + 1}]: `))).trim()
       const index = answer ? Number(answer) - 1 : defaultIndex
       if (!Number.isInteger(index) || !choices[index]) {
         throw usageError('setup_selection_invalid', 'Setup selection must be one of the displayed numbers.')
       }
       return choices[index]!.value
     },
-    async pause(message: string) {
-      await terminal.question(`${message}\nPress Enter when finished: `)
-    },
     close() {
       terminal.close()
     },
   }
 }
 
-async function ensureSetupSkills({
+async function discoverSetupBrowsers(runtimeManager: BrowserRuntimeManager) {
+  return await runtimeManager.discover()
+}
+
+async function discoverSetupCloakProfileInventory(
+  installedBrowsers: readonly BrowserCandidate[],
+): Promise<SetupCloakProfileInventory> {
+  return buildCloakProfileInventory(await discoverKnownChromiumProfiles(), installedBrowsers)
+}
+
+function buildCloakProfileInventory(
+  roots: readonly ChromiumUserDataRoot[],
+  installedBrowsers: readonly BrowserCandidate[],
+): SetupCloakProfileInventory {
+  const cloak = managedBrowserCatalogEntry('cloak')
+  const candidates = roots.flatMap((root) => {
+    const installedVersion = installedBrowsers.find((browser) => browser.browserId === root.browser)?.version ?? null
+    const detectedVersion = root.browserVersion ?? installedVersion
+    const versionSource: SetupCloakProfileCandidate['versionSource'] = root.browserVersion
+      ? 'profile'
+      : installedVersion
+      ? 'installed_browser'
+      : 'unknown'
+    const compatibility: CloakProfileCompatibility = detectedVersion === null
+      ? 'unknown'
+      : detectedVersion === cloak.browserVersion
+      ? 'aligned'
+      : 'not_aligned'
+    return root.profiles.map((profile): SetupCloakProfileCandidate => ({
+      browser: root.browser,
+      browserDisplayName: chromiumProfileBrowserDisplayName(root.browser),
+      userDataDir: root.userDataDir,
+      directoryKey: profile.directoryKey,
+      detectedVersion,
+      versionSource,
+      compatibility,
+    }))
+  }).sort((left, right) =>
+    left.browser.localeCompare(right.browser) ||
+    left.userDataDir.localeCompare(right.userDataDir) ||
+    left.directoryKey.localeCompare(right.directoryKey)
+  )
+  return {
+    projectUrl: CLOAK_BROWSER_PROJECT_URL,
+    artifactVersion: cloak.artifactVersion,
+    browserVersion: cloak.browserVersion,
+    candidates,
+  }
+}
+
+function presentSetupCloakProfileInventory(
+  inventory: SetupCloakProfileInventory,
+  presenter: SetupPresenter,
+) {
+  presenter.explain({
+    title: 'Anti-Detect mode',
+    lines: [
+      `CloakBrowser project: ${inventory.projectUrl}`,
+      `Supported CloakBrowser on this platform: artifact ${inventory.artifactVersion} (Chromium ${inventory.browserVersion}).`,
+      'Discovery checks only profile directory names and browser versions; it does not read authentication values.',
+    ],
+  })
+  if (inventory.candidates.length === 0) {
+    presenter.note('No local Chromium profiles were found.')
+    return
+  }
+  presenter.explain({
+    title: 'Chromium profile compatibility',
+    lines: inventory.candidates.map((candidate) => {
+      const version = candidate.detectedVersion ?? 'unknown'
+      const compatibility = candidate.compatibility === 'aligned'
+        ? 'version-aligned (eligible for import)'
+        : candidate.compatibility === 'not_aligned'
+        ? 'not version-aligned'
+        : 'version unknown'
+      return `${candidate.browserDisplayName} profile ${candidate.directoryKey} at ${candidate.userDataDir}: version ${version}; ${compatibility}.`
+    }),
+  })
+}
+
+async function selectSetupCloakImport({
   args,
+  inventory,
   prompt,
   presenter,
 }: {
   args: CliArgs
+  inventory: SetupCloakProfileInventory
   prompt: ReturnType<typeof createSetupPrompt> | null
   presenter: SetupPresenter
-}) {
-  const skillHome = process.env.TOKENLESS_SETUP_SKILL_HOME
-  let check = await presenter.withProgress('Checking Tokenless agent skills', () => inspectTokenlessSkills(skillHome))
-  let installed = false
-  const refresh = args.refreshSkills === true || (!check.ok && args.skipSkillInstall !== true)
-  if (refresh) {
-    const approved = prompt
-      ? await prompt.confirm(
-          check.ok
-            ? 'Refresh the Tokenless agent skills from github.com/jazelly/tokenless?'
-            : 'Install the Tokenless agent skills from github.com/jazelly/tokenless?',
-          !check.ok
-        )
-      : true
-    if (!approved) {
-      throw usageError('tokenless_skill_install_required', 'Tokenless setup requires the tokenless and tokenless-install skills.')
-    }
-    const result = await presenter.withProgress(
-      'Installing and verifying Tokenless agent skills from GitHub',
-      () => installTokenlessSkills({ ...(skillHome ? { home: skillHome } : {}) }),
+}): Promise<SetupCloakImportSelection | null> {
+  if (args.importChromeProfile !== undefined) {
+    const source = await resolveOpaqueProfileSourceForBrowser(
+      args,
+      'chrome',
+      validateChromeProfileDirectoryKey(String(args.importChromeProfile)),
     )
-    check = result.check
-    installed = true
+    if (source.browserVersion !== inventory.browserVersion) {
+      throw usageError(
+        'cloak_profile_version_incompatible',
+        `Browser profile '${source.directoryKey}' uses Chromium ${source.browserVersion ?? 'unknown'}; this platform's supported CloakBrowser requires ${inventory.browserVersion}.`,
+      )
+    }
+    return {
+      browser: source.browser,
+      userDataDir: source.userDataDir,
+      directoryKey: source.directoryKey,
+    }
   }
-  if (!check.ok) {
-    throw usageError(
-      'tokenless_skill_install_required',
-      'Tokenless setup could not verify tokenless and tokenless-install from github.com/jazelly/tokenless.'
-    )
+
+  const compatible = inventory.candidates.filter((candidate) => candidate.compatibility === 'aligned')
+  if (!prompt || compatible.length === 0) {
+    if (compatible.length === 0) {
+      presenter.note('No version-compatible local Chromium profile was found; CloakBrowser will use a clean profile.')
+    }
+    return null
   }
+  presenter.explain({
+    title: 'CloakBrowser profile source',
+    lines: [
+      'Selecting an existing profile explicitly authorizes Tokenless to copy that entire profile folder into the managed profile as an opaque local filesystem tree. Tokenless does not inspect cookies, tokens, browser storage, or other authentication values.',
+    ],
+  })
+  const selectedIndex = await prompt.select(
+    'Choose how CloakBrowser should initialize its managed profile',
+    [
+      { label: 'Start clean', value: '__clean__' },
+      ...compatible.map((candidate, index) => ({
+        label: `Copy ${candidate.browserDisplayName} profile ${candidate.directoryKey} — version ${candidate.detectedVersion} — ${candidate.userDataDir}`,
+        value: String(index),
+      })),
+    ],
+    0,
+  )
+  if (selectedIndex === '__clean__') return null
+  const selected = compatible[Number(selectedIndex)]
+  if (!selected) throw usageError('setup_selection_invalid', 'Setup selection must be one of the displayed numbers.')
   return {
-    ok: true,
-    source: check.source,
-    installed,
-    checked: true,
-    manifests: Object.values(check.skills).map((skill) => skill.manifest),
+    browser: selected.browser,
+    userDataDir: selected.userDataDir,
+    directoryKey: selected.directoryKey,
   }
 }
 
-async function discoverSetupBrowsers() {
-  const installed: Awaited<ReturnType<typeof resolveChromiumBrowser>>[] = []
-  const candidates = process.env.TOKENLESS_BROWSER_EXECUTABLE
-    ? ['profile']
-    : ['chrome', 'brave', 'edge', 'arc', 'chromium']
-  for (const browser of candidates) {
-    try {
-      installed.push(await resolveChromiumBrowser(browser))
-    } catch {
-      // Setup reports only installed supported browsers.
-    }
+function chromiumProfileBrowserDisplayName(browser: ManagedChromiumBrowserId) {
+  const names: Record<ManagedChromiumBrowserId, string> = {
+    chrome: 'Google Chrome',
+    brave: 'Brave Browser',
+    edge: 'Microsoft Edge',
+    arc: 'Arc',
+    chromium: 'Chromium',
+    'chrome-for-testing': 'Google Chrome for Testing',
   }
-  if (installed.length === 0) {
-    throw usageError(
-      'chromium_browser_not_found',
-      'Tokenless setup needs an installed supported Chromium browser: Chrome, Brave, Edge, Arc, or Chromium.'
-    )
-  }
-  return installed
+  return names[browser]
 }
 
 async function selectSetupBrowser({
   args,
   config,
-  installedBrowsers,
+  runtimeManager,
   prompt,
   presenter,
 }: {
   args: CliArgs
   config: Record<string, any>
-  installedBrowsers: Awaited<ReturnType<typeof discoverSetupBrowsers>>
+  runtimeManager: BrowserRuntimeManager
   prompt: ReturnType<typeof createSetupPrompt> | null
   presenter: SetupPresenter
-}) {
+}): Promise<{
+  selection: BrowserSelection
+  runtime: ResolvedBrowserRuntime
+  detectedChromeVersion: string | null
+  cloakProfileInventory: SetupCloakProfileInventory | null
+  cloakImportSelection: SetupCloakImportSelection | null
+}> {
   const explicit = args.browser === undefined ? null : normalizeCliBrowser(args.browser)
-  const configured = explicit ?? (typeof config.browser === 'string' ? config.browser : null)
-  if (configured) {
-    const installed = installedBrowsers.find((browser) => browser.browser === configured)
-    if (installed && (!prompt || explicit)) {
-      presenter.success(`Using ${installed.displayName}.`)
-      return installed
-    }
-  }
-  if (!prompt) return installedBrowsers[0]!
-  presenter.note('Choose the browser Tokenless should use.')
-  const selected = await prompt.select(
-    'Choose a browser',
-    installedBrowsers.map((browser) => ({ label: browser.displayName, value: browser.browser })),
-    Math.max(0, installedBrowsers.findIndex((browser) => browser.browser === configured))
-  )
-  const browser = installedBrowsers.find((candidate) => candidate.browser === selected)!
-  presenter.success(`Using ${browser.displayName}.`)
-  return browser
-}
-
-function selectSetupProviders({
-  presenter,
-}: {
-  presenter: SetupPresenter
-}): ProviderId[] {
-  const providers = setupVisibleProviders()
-  presenter.success(`Checking providers: ${providers.join(', ')}.`)
-  return providers
-}
-
-function setupVisibleProviders(): ProviderId[] {
-  const providerIds = listProviders().map((provider) => normalizeProvider(provider.id))
-  return requireSetupProviders(providerIds.sort((left, right) => setupProviderSortKey(left) - setupProviderSortKey(right)))
-}
-
-function setupProviderSortKey(provider: ProviderId) {
-  const order: Record<ProviderId, number> = {
-    chatgpt: 0,
-    claude: 1,
-    gemini: 2,
-    grok: 3,
+  const explicitCloakSelection = args.antiDetect === true || explicit === 'cloak'
+  if (args.antiDetect === true && explicit && explicit !== 'cloak') {
+    throw usageError('setup_anti_detect_browser_conflict', '--anti-detect requires --browser cloak when both flags are provided.')
+  }
+  const configured = explicit ?? normalizeBrowserSelection(config.browser) ?? 'auto'
+  let installedBrowsers: Awaited<ReturnType<typeof discoverSetupBrowsers>> = []
+  let cloakImportSelection: SetupCloakImportSelection | null = null
+  let selection: BrowserSelection
+  if (args.antiDetect === true) {
+    selection = 'cloak'
+  } else if (!prompt || explicit) {
+    selection = configured
+  } else {
+    const antiDetect = await prompt.confirm(
+      'Use Anti-Detect mode? Tokenless will download and install the verified, platform-pinned CloakBrowser under TOKENLESS_HOME if needed.',
+      configured === 'cloak',
+    )
+    if (antiDetect) {
+      selection = 'cloak'
+    } else {
+      installedBrowsers = await presenter.withProgress(
+        'Finding browsers',
+        () => discoverSetupBrowsers(runtimeManager),
+      )
+      selection = configured === 'cloak' ? 'auto' : configured
+    }
   }
-  return order[provider]
-}
-
-function requireSetupProviders(providers: ProviderId[]) {
-  if (providers.length === 0) {
-    throw usageError('setup_provider_required', 'Tokenless setup requires at least one supported visible provider.')
+  let cloakProfileInventory: SetupCloakProfileInventory | null = null
+  if (selection === 'cloak') {
+    if (!prompt && !explicitCloakSelection) {
+      throw usageError(
+        'setup_cloak_confirmation_required',
+        'Non-interactive CloakBrowser setup requires explicit --anti-detect or --browser cloak confirmation.',
+      )
+    }
+    cloakProfileInventory = await presenter.withProgress(
+      'Finding Chromium profiles',
+      () => discoverSetupCloakProfileInventory(installedBrowsers),
+    )
+    presentSetupCloakProfileInventory(cloakProfileInventory, presenter)
+    cloakImportSelection = await selectSetupCloakImport({
+      args,
+      inventory: cloakProfileInventory,
+      prompt,
+      presenter,
+    })
   }
-  return providers
+  const automaticRuntime = selection === 'auto'
+    ? installedBrowsers.find((browser) => browser.family === 'system')
+    : null
+  const preparedSelection = selection === 'auto'
+    ? automaticRuntime?.selection ?? 'auto'
+    : selection
+  const discoveredExecutablePath = installedBrowsers.find(
+    (browser) => browser.selection === preparedSelection,
+  )?.executablePath ?? null
+  const runtime = await presenter.withProgress(
+    `Preparing ${setupBrowserSelectionLabel(selection)}`,
+    () => runtimeManager.ensure(preparedSelection, {
+      allowDownload: args.noBrowserDownload !== true,
+      repair: args.repairBrowser === true,
+      browserExecutablePath: browserExecutablePathForSelection(config, preparedSelection) ?? discoveredExecutablePath,
+      onProgress: (progress) => presenter.note(
+        `${progress.displayName} ${progress.version}: ${progress.phase}.`,
+      ),
+    }),
+  )
+  presenter.success(`Using ${runtime.displayName} ${runtime.actualVersion} (${runtime.source}).`)
+  const detectedChromeVersion = installedBrowsers.find((browser) => browser.browserId === 'chrome')?.version ??
+    (runtime.browserId === 'chrome' ? runtime.actualVersion : null)
+  return { selection, runtime, detectedChromeVersion, cloakProfileInventory, cloakImportSelection }
 }
 
-function requireProfileImportProviders(value: unknown): ProviderId[] {
-  if (value === undefined) {
-    throw usageError(
-      'profile_import_provider_required',
-      'Browser profile import requires --preferred-providers so Tokenless can import only selected provider cookies.'
-    )
-  }
-  const providers = parseProviderList(value) as ProviderId[]
-  if (providers.length === 0) {
-    throw usageError('profile_import_provider_required', 'Browser profile import requires at least one --preferred-providers entry.')
-  }
-  return providers
+function setupBrowserSelectionLabel(selection: BrowserSelection) {
+  if (selection === 'auto') return 'automatic browser selection'
+  if (selection === 'managed-chromium') return 'Tokenless-managed Chromium'
+  if (selection === 'cloak') return 'CloakBrowser'
+  return selection
 }
 
-async function selectSetupSourceProfile({
+async function selectSetupProviders({
   args,
-  browser,
+  config,
+  homeDir,
   prompt,
-  discovered,
+  presenter,
 }: {
   args: CliArgs
-  browser: string
+  config: Awaited<ReturnType<typeof readTokenlessConfig>>
+  homeDir: string
   prompt: ReturnType<typeof createSetupPrompt> | null
-  discovered?: Awaited<ReturnType<typeof setupSourceProfiles>>
-}) {
-  const profiles = discovered ?? await setupSourceProfiles(browser, args.chromeUserDataDir)
-  if (args.importChromeProfile !== undefined) {
-    const directoryKey = validateChromeProfileDirectoryKey(String(args.importChromeProfile))
-    const matches = profiles.filter((profile) => profile.directoryKey === directoryKey)
-    if (matches.length !== 1) {
-      throw usageError(
-        matches.length === 0 ? 'browser_profile_not_found' : 'browser_profile_ambiguous',
-        `Browser profile directory key '${directoryKey}' must resolve to exactly one discovered ${browser} profile.`
-      )
+  presenter: SetupPresenter
+}): Promise<ProviderId[]> {
+  const available = setupVisibleProviders()
+  if (args.providerWhitelist !== undefined) {
+    const providers = requireSetupProviders(parseProviderList(args.providerWhitelist) as ProviderId[])
+    presenter.success(`Checking providers: ${providers.join(', ')}.`)
+    return providers
+  }
+  const configuredScope = await setupConfiguredProviderScope({ args, config, homeDir })
+  if (!prompt) {
+    const configured = configuredScope.filter((provider): provider is ProviderId => available.includes(provider as ProviderId))
+    const providers = requireSetupProviders(configured)
+    presenter.success(`Checking providers: ${providers.join(', ')}.`)
+    return providers
+  }
+  const defaults = new Set(configuredScope)
+  const providers: ProviderId[] = []
+  for (const provider of available) {
+    const descriptor = getProviderDescriptorById(provider)
+    if (await prompt.confirm(`Enable ${descriptor?.label ?? provider} for this profile?`, defaults.has(provider))) {
+      providers.push(provider)
     }
-    return matches[0]!
   }
-  if (!prompt || profiles.length === 0) {
-    throw usageError('browser_profile_not_found', `No importable ${browser} browser profile was discovered.`)
-  }
-  const selected = await prompt.select(
-    `Choose the ${browser} profile to import`,
-    profiles.map((profile, index) => ({
-      label: `${profile.name} (${profile.directoryKey})${profile.isDefault ? ' — default' : ''}`,
-      value: String(index),
-    })),
-    Math.max(0, profiles.findIndex((profile) => profile.isDefault))
-  )
-  return profiles[Number(selected)]!
-}
-
-async function setupSourceProfiles(browser: string, explicitUserDataDir: unknown) {
-  const sourceBrowser = setupProfileImportBrowser(browser)
-  if (browser !== 'chrome' && browser !== 'brave' && explicitUserDataDir === undefined) return []
-  const roots = await discoverChromiumProfiles({
-    browser: sourceBrowser,
-    ...(explicitUserDataDir === undefined ? {} : { userDataDirs: [path.resolve(String(explicitUserDataDir))] }),
-  })
-  return roots.flatMap((root) => root.profiles.map((profile) => ({
-    userDataDir: root.userDataDir,
-    directoryKey: profile.directoryKey,
-    name: profile.name,
-    isDefault: profile.isDefault,
-  })))
-}
-
-function setupProfileImportBrowser(browser: string): 'chrome' | 'brave' {
-  return browser === 'brave' ? 'brave' : 'chrome'
+  requireSetupProviders(providers)
+  presenter.success(`Checking providers: ${providers.join(', ')}.`)
+  return providers
 }
 
-function requireSetupCopyAuthorization({
+async function setupConfiguredProviderScope({
   args,
-  prompt,
+  config,
+  homeDir,
 }: {
   args: CliArgs
-  prompt: ReturnType<typeof createSetupPrompt> | null
+  config: Awaited<ReturnType<typeof readTokenlessConfig>>
+  homeDir: string
 }) {
-  if (!prompt && args.consentLocalProfileCopy !== true) {
-    throw usageError('profile_import_consent_required', 'Browser profile import requires explicit local profile copy consent.')
+  try {
+    const profile = await new ManagedProfileRegistry(homeDir).resolveProfile(
+      args.profile === undefined ? undefined : String(args.profile),
+    )
+    return config.profilePreferences[profile.slug]?.enabledProviders ?? config.providerWhitelist
+  } catch {
+    return config.providerWhitelist
+  }
+}
+
+function setupVisibleProviders(): ProviderId[] {
+  const providerIds = listProviderDescriptors()
+    .filter((provider) => provider.stage !== 'disabled')
+    .sort((left, right) => left.setupOrder - right.setupOrder)
+    .map((provider) => provider.id)
+  return requireSetupProviders(providerIds)
+}
+
+function requireSetupProviders(providers: ProviderId[]) {
+  if (providers.length === 0) {
+    throw usageError('setup_provider_required', 'Tokenless setup requires at least one supported visible provider.')
   }
+  return providers
 }
 
 async function runSetupAuthCheck({
@@ -2502,12 +3540,14 @@ async function runSetupAuthCheck({
   homeDir,
   profile,
   provider,
+  reviewSessionId,
   quietStatus = false,
 }: {
   args: CliArgs
   homeDir: string
   profile: ManagedProfileRecord
   provider: ProviderId
+  reviewSessionId: string
   quietStatus?: boolean
 }) {
   return await executeManagedPlaywrightJob({
@@ -2515,122 +3555,165 @@ async function runSetupAuthCheck({
     provider,
     request: createManagedPlaywrightJobRequest({
         provider,
-        target: { kind: 'provider_home', url: managedProviderTargetUrl(provider, args.targetUrl) },
+        target: { kind: 'provider_home', url: managedProviderExplicitTargetUrl(provider, args.targetUrl) },
         actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
       }),
-      taskId: `setup:${provider}:${randomUUID()}`,
+      taskId: `setup-review:${reviewSessionId}:${provider}`,
       statusEventAction: 'setup.auth',
       noWait: false,
       timeoutMs: args.timeoutMs === undefined ? 90_000 : Number(args.timeoutMs),
     })
   }
 
-async function runSetupHandoffOpenCheck({
+async function ensureSetupProviderReviewTabs({
   args,
   homeDir,
   profile,
-  provider,
-  quietStatus = false,
+  providers,
+  reviewSessionId,
+  daemonUrl: actualDaemonUrl,
+  presenter,
 }: {
   args: CliArgs
   homeDir: string
   profile: ManagedProfileRecord
-  provider: ProviderId
-  quietStatus?: boolean
+  providers: readonly ProviderId[]
+  reviewSessionId: string
+  daemonUrl: string
+  presenter: SetupPresenter
 }) {
-  return await executeManagedPlaywrightJob({
-    args: { ...args, home: homeDir, profile: profile.slug, quiet: args.quiet === true || quietStatus },
-    provider,
-    request: createManagedPlaywrightJobRequest({
-      provider,
-      target: { kind: 'provider_home', url: managedProviderTargetUrl(provider, args.targetUrl) },
-      actions: [{ action: VISIBLE_ACTIONS.NAVIGATION_CHECK, payload: {} }],
-    }),
-    taskId: `setup:handoff:${provider}:${randomUUID()}`,
-    statusEventAction: 'setup.handoff',
-    noWait: false,
-    timeoutMs: args.timeoutMs === undefined ? 90_000 : Number(args.timeoutMs),
-  })
+  const opened: ProviderId[] = []
+  const failures: { provider: ProviderId, code: string, message: string }[] = []
+  for (const provider of providers) {
+    try {
+      await presenter.withProgress(`Opening ${provider} review tab`, () => executeManagedPlaywrightJob({
+        args: {
+          ...args,
+          home: homeDir,
+          profile: profile.slug,
+          browserVisibility: 'headed',
+          quiet: true,
+        },
+        provider,
+        request: createManagedPlaywrightJobRequest({
+          provider,
+          target: { kind: 'provider_home', url: managedProviderExplicitTargetUrl(provider, args.targetUrl) },
+          actions: [{ action: VISIBLE_ACTIONS.NAVIGATION_CHECK, payload: {} }],
+        }),
+        taskId: `setup-review:${reviewSessionId}:${provider}`,
+        statusEventAction: 'setup.review',
+        noWait: false,
+        timeoutMs: 30_000,
+      }))
+      opened.push(provider)
+    } catch (error) {
+      failures.push({
+        provider,
+        code: (error as CliError).code ?? 'setup_review_tab_failed',
+        message: error instanceof Error ? error.message : String(error),
+      })
+    }
+  }
+  if (failures.length === 0) {
+    presenter.success(`Opened ${opened.length} provider review tab(s).`)
+  } else {
+    presenter.note(`Could not open ${failures.length} provider review tab(s).`)
+  }
+  let keptOpen: Awaited<ReturnType<typeof openBrowserRuntimeProfile>> | null = null
+  let keepOpenError: { code: string, message: string } | null = null
+  try {
+    await waitForSetupReviewJobsToSettle({ homeDir, daemonUrl: actualDaemonUrl })
+    keptOpen = await openBrowserRuntimeProfile({
+      daemonUrl: actualDaemonUrl,
+      homeDir,
+      profileId: profile.id,
+      browserVisibility: 'headed',
+    })
+  } catch (error) {
+    keepOpenError = {
+      code: (error as CliError).code ?? 'setup_review_browser_closed',
+      message: error instanceof Error ? error.message : String(error),
+    }
+    presenter.note('Could not keep the provider review browser open.')
+  }
+  return {
+    opened,
+    failures,
+    keptOpen: keptOpen !== null,
+    pageCount: keptOpen?.pageCount ?? 0,
+    keepOpenError,
+  }
 }
 
-async function waitForSetupJobAfterUser({
+async function waitForSetupReviewJobsToSettle({
   homeDir,
-  daemonUrl: configuredDaemonUrl,
-  jobId,
-  timeoutMs,
+  daemonUrl: actualDaemonUrl,
 }: {
   homeDir: string
   daemonUrl: string
-  jobId: string
-  timeoutMs: number
 }) {
-  const deadline = Date.now() + timeoutMs
-  while (Date.now() < deadline) {
-    const job = await getDaemonJob({ homeDir, daemonUrl: configuredDaemonUrl, jobId })
-    if (job.status !== 'waiting_for_user') {
-      return await waitDaemonJobResult({
-        homeDir,
-        daemonUrl: configuredDaemonUrl,
-        jobId,
-        timeoutMs: Math.max(1, deadline - Date.now()),
-      })
-    }
-    await new Promise((resolve) => setTimeout(resolve, 500))
-  }
-  const job = await getDaemonJob({ homeDir, daemonUrl: configuredDaemonUrl, jobId })
-  return {
-    ok: null,
-    status: job.status,
-    job,
-    blocker: job.blocker_json,
-    userAction: {
-      message: 'Complete the visible provider verification or sign-in in the already-open managed browser.',
-      resumeCommand: `tokenless state --job-id ${jobId} --json`,
-      queryGuidance: 'Query the same job after completing the visible user action.',
-    },
+  for (let attempt = 0; attempt < 50; attempt += 1) {
+    const status = await browserRuntimeStatus({ homeDir, daemonUrl: actualDaemonUrl })
+    if (status.activeJobCount === 0) return
+    await new Promise((resolve) => setTimeout(resolve, 100))
   }
+  throw usageError('setup_review_jobs_still_active', 'Provider review jobs did not settle before the browser handoff.')
 }
 
 async function provisionRuntime(args: CliArgs) {
   const homeDir = tokenlessHome(args.home)
   const config = await readTokenlessConfig(homeDir)
+  const configuredDaemonUrl = daemonUrl(args.daemonUrl ?? config.daemonUrl ?? undefined)
   const requestedBrowsers = args.browsers === undefined
-    ? [args.browser ?? config.browser ?? undefined]
+    ? [args.browser ?? config.browser]
     : parseList(args.browsers)
-  const resolvedBrowsers: string[] = []
+  const runtimeManager = new BrowserRuntimeManager({ homeDir })
+  const resolvedBrowsers: ResolvedBrowserRuntime[] = []
   for (const requested of requestedBrowsers) {
-    const browser = await resolveChromiumBrowser(requested)
-    if (!resolvedBrowsers.includes(browser.browser)) resolvedBrowsers.push(browser.browser)
+    const selection = normalizeCliBrowser(requested)
+    const browser = await runtimeManager.ensure(selection, {
+      allowDownload: true,
+      repair: args.repairBrowser === true,
+      browserExecutablePath: browserExecutablePathForSelection(config, selection),
+    })
+    if (!resolvedBrowsers.some((candidate) => candidate.runtimeId === browser.runtimeId)) {
+      resolvedBrowsers.push(browser)
+    }
   }
-  const configuredDaemonUrl = daemonUrl(args.daemonUrl ?? config.daemonUrl ?? undefined)
+  if (!resolvedBrowsers[0]) {
+    throw usageError('browser_runtime_selection_required', 'At least one browser runtime selection is required.')
+  }
+  const primaryBrowser = resolvedBrowsers[0]
   await writeTokenlessConfig({
     homeDir,
-    browser: resolvedBrowsers[0],
+    browser: primaryBrowser.selection,
+    browserExecutablePath: primaryBrowser.executablePath,
     daemonUrl: configuredDaemonUrl,
   })
-  const daemon = await ensureDaemonReady({
+  const maintenance = await reconcileTokenlessMaintenance({
     homeDir,
     daemonUrl: configuredDaemonUrl,
-    timeoutMs: optionalNumber(args.daemonStartTimeoutMs),
+    daemonStartTimeoutMs: optionalNumber(args.daemonStartTimeoutMs),
   })
   const runtime = await inspectManagedRuntime(homeDir)
   return {
     homeDir,
     config,
-    browsers: resolvedBrowsers,
-    browser: await resolveChromiumBrowser(resolvedBrowsers[0]),
+    skills: maintenance.skills,
+    browsers: resolvedBrowsers.map((browser) => browser.runtimeId),
+    browser: primaryBrowser,
     installed: {
-      runtime: 'rust',
-      daemonExecutable: runtime.installed.path,
+      runtime: 'typescript',
+      daemonExecutable: runtime.daemon.path,
     },
-    daemon,
-    daemonUrl: configuredDaemonUrl,
+    daemon: maintenance.daemon,
+    daemonUrl: maintenance.daemon.url,
   }
 }
 
 async function doctorCommand(args: CliArgs) {
   const homeDir = tokenlessHome(args.home)
-  let config: Record<string, any> = { preferredProviders: [], browser: null, daemonUrl: null }
+  let config: Record<string, any> = { providerWhitelist: [], browser: null, daemonUrl: null }
   let configCheck: Record<string, any>
   try {
     config = await readTokenlessConfig(homeDir)
@@ -2654,116 +3737,105 @@ async function doctorCommand(args: CliArgs) {
       message: error instanceof Error ? error.message : String(error),
     }
   }
-  const browserId = args.browser ?? config.browser ?? undefined
+  const browserId = args.browser ?? config.browser ?? 'auto'
   const runtime = await inspectManagedRuntime(homeDir)
   const skills = await inspectTokenlessSkills(process.env.TOKENLESS_SETUP_SKILL_HOME)
-  let browser: Record<string, any>
-  try {
-    const resolved = await resolveChromiumBrowser(browserId)
-    browser = { ok: true, id: resolved.browser, displayName: resolved.displayName }
-  } catch (error) {
-    browser = { ok: false, id: normalizeBrowserId(browserId), message: (error as Error).message }
-  }
+  const runtimeManager = new BrowserRuntimeManager({ homeDir })
+  const normalizedBrowserId = normalizeBrowserSelection(browserId) ?? String(browserId)
+  const browserInspection = await runtimeManager.inspect(normalizedBrowserId, {
+    browserExecutablePath: args.browser === undefined
+      ? browserExecutablePathForSelection(config, normalizedBrowserId)
+      : null,
+  })
+  const browser: Record<string, any> = browserInspection.ok && browserInspection.runtime
+    ? {
+        ok: true,
+        preference: normalizeBrowserSelection(browserId),
+        runtimeId: browserInspection.runtime.runtimeId,
+        family: browserInspection.runtime.family,
+        id: browserInspection.runtime.browserId,
+        displayName: browserInspection.runtime.displayName,
+        actualVersion: browserInspection.runtime.actualVersion,
+        expectedVersion: browserInspection.runtime.expectedVersion,
+        source: browserInspection.runtime.source,
+        executablePath: browserInspection.runtime.executablePath,
+        checksumVerified: browserInspection.runtime.checksumVerified,
+      }
+    : {
+        ok: false,
+        preference: normalizeBrowserSelection(browserId),
+        code: browserInspection.code,
+        message: browserInspection.message,
+      }
   let daemon: Record<string, any>
   const daemonLogPath = path.join(homeDir, 'daemon.log')
   const daemonLogExists = await fileExists(daemonLogPath)
+  const runtimeEndpoint = await DaemonRuntimeState.readEndpointIfExists(homeDir)
+  const daemonProbeUrls = [...new Set([
+    runtimeEndpoint?.origin,
+    configuredDaemonUrl,
+  ].filter((value): value is string => typeof value === 'string' && value.length > 0))]
+  let daemonStatusUrl = configuredDaemonUrl
   try {
-    const ready = await probeDaemonReady({
-      homeDir,
-      daemonUrl: configuredDaemonUrl,
-    })
+    let ready: Awaited<ReturnType<typeof probeDaemonReady>> | null = null
+    for (const candidateUrl of daemonProbeUrls) {
+      const candidate = await probeDaemonReady({
+        homeDir,
+        daemonUrl: candidateUrl,
+      })
+      ready = candidate
+      if (candidate.ok) break
+    }
+    if (!ready) {
+      ready = await probeDaemonReady({ homeDir, daemonUrl: configuredDaemonUrl })
+    }
+    daemonStatusUrl = ready.ok ? ready.url : configuredDaemonUrl
     const expectedVersion = tokenlessPackageVersion()
     const runningVersion = typeof ready.body?.version === 'string' ? ready.body.version : null
-    const packagedHash = runtime.packaged.hash
-    const runningHash = typeof ready.body?.running_binary_hash === 'string' ? ready.body.running_binary_hash : null
-    const identityError = ready.body?.daemon_process_identity_error
+    const expectedMajor = semanticVersionMajor(expectedVersion)
+    const runningMajor = runningVersion === null ? null : semanticVersionMajor(runningVersion)
+    const versionCompatible = runningVersion === null ? null : runningVersion === expectedVersion
     if (!ready.ok) {
+      const normallyStopped = ready.code === 'daemon_unavailable'
       daemon = {
-        ok: false,
+        ok: normallyStopped,
         ready: false,
-        url: configuredDaemonUrl,
+        running: false,
+        status: normallyStopped ? 'stopped' : 'unavailable',
+        url: ready.url,
         daemonLogPath,
         daemonLogExists,
         code: ready.code,
         message: ready.message,
         expectedVersion,
         runningVersion,
-        packagedHash,
-        runningHash,
-      }
-    } else if (runningVersion !== expectedVersion) {
-      daemon = {
-        ok: false,
-        ready: true,
-        url: configuredDaemonUrl,
-        daemonLogPath,
-        daemonLogExists,
-        code: 'daemon_version_mismatch',
-        message: `Tokenless daemon reports version ${runningVersion ?? 'missing'}; expected tokenless@${expectedVersion}.`,
-        homeDir: ready.actualHome,
-        expectedVersion,
-        runningVersion,
-        packagedHash,
-        runningHash,
-        pid: ready.body?.pid ?? null,
-        processIdentity: identityError === undefined ? 'verified' : 'unverified',
-      }
-    } else if (identityError !== undefined) {
-      daemon = {
-        ok: false,
-        ready: true,
-        url: configuredDaemonUrl,
-        daemonLogPath,
-        daemonLogExists,
-        code: identityError.code ?? 'daemon_process_identity_unverified',
-        message: identityError.message ?? 'Tokenless daemon process identity could not be verified.',
-        homeDir: ready.actualHome,
-        expectedVersion,
-        runningVersion,
-        packagedHash,
-        runningHash,
-        pid: ready.body?.pid ?? null,
-        processIdentity: 'unverified',
-      }
-    } else if (!packagedHash || runningHash !== packagedHash) {
-      daemon = {
-        ok: false,
-        ready: true,
-        url: configuredDaemonUrl,
-        daemonLogPath,
-        daemonLogExists,
-        code: 'daemon_binary_hash_mismatch',
-        message: `Tokenless daemon binary hash is ${runningHash ?? 'missing'}; expected packaged hash ${packagedHash ?? 'unavailable'}.`,
-        homeDir: ready.actualHome,
-        expectedVersion,
-        runningVersion,
-        packagedHash,
-        runningHash,
-        pid: ready.body?.pid ?? null,
-        processIdentity: 'verified',
+        expectedMajor,
+        runningMajor,
+        versionCompatible,
       }
     } else {
       daemon = {
         ok: true,
         ready: true,
-        url: configuredDaemonUrl,
+        running: true,
+        status: 'running',
+        url: ready.url,
         daemonLogPath,
         daemonLogExists,
         homeDir: ready.actualHome,
-        daemonProtocol: ready.body?.daemon_protocol,
-        nativeProtocol: ready.body?.native_protocol,
         expectedVersion,
         runningVersion,
-        packagedHash,
-        runningHash,
+        expectedMajor,
+        runningMajor,
+        versionCompatible,
         pid: ready.body?.pid ?? null,
-        processIdentity: 'verified',
       }
     }
   } catch (error) {
     daemon = { ok: false, ready: false, url: configuredDaemonUrl, daemonLogPath, daemonLogExists, message: (error as Error).message }
   }
   let managedProfile: Record<string, any> = { ok: false, message: 'Managed profile was not inspected.' }
+  let profileRuntime: Record<string, any> = { ok: false, message: 'Managed profile runtime was not inspected.' }
   let providerReadiness: Record<string, any> = { ok: false, providers: {} }
   try {
     const profileReport = await readManagedProfileReadOnly(homeDir)
@@ -2777,32 +3849,46 @@ async function doctorCommand(args: CliArgs) {
         id: profile.id,
         lifecycle: profile.lifecycle,
         imported: Boolean(profile.import),
+        runtimeBinding: profile.runtimeBinding ?? null,
+        runtime: await runtimeManager.inspect(profile, {
+          browserExecutablePath: profile.runtimeBinding?.browserId === config.browser
+            ? config.browserExecutablePath
+            : null,
+        }),
       }
-      const providers = Array.isArray(config.preferredProviders) ? config.preferredProviders : []
-      const statuses = Object.fromEntries(providers.map((provider) => {
-        const observed = profile.lastObservedAuth?.[provider as ProviderId]
-        return [provider, {
-          ok: observed?.auth === 'authenticated',
-          auth: observed?.auth ?? 'unknown',
-          checkedAt: observed?.checkedAt ?? null,
-        }]
-      }))
+      profileRuntime = managedProfile.runtime
+      const providers = config.profilePreferences[profile.slug]?.enabledProviders ?? config.providerWhitelist
+      const observations = providerObservationContext(providers.map(normalizeProvider), profile)
+      const statuses = Object.fromEntries(observations.map((observation) => [observation.provider, {
+        ok: observation.observed,
+        observed: observation.observed,
+        usable: observation.usable,
+        auth: observation.auth,
+        access: observation.access,
+        tier: observation.tier,
+        checkedAt: observation.checkedAt,
+      }]))
+      const usableProviders = observations
+        .filter((observation) => observation.usable)
+        .map((observation) => observation.provider)
       providerReadiness = {
-        ok: providers.length > 0 && Object.values(statuses).every((status: any) => status.ok === true),
+        ok: providers.length > 0 && observations.every((observation) => observation.observed),
+        usable: usableProviders.length > 0,
+        usableProviders,
         providers: statuses,
       }
     }
   } catch (error) {
     managedProfile = { ok: false, message: error instanceof Error ? error.message : String(error) }
+    profileRuntime = { ok: false, message: error instanceof Error ? error.message : String(error) }
     providerReadiness = { ok: false, providers: {} }
   }
-  let runner: Record<string, any>
-  try {
-    const status = await runnerSupervisorStatusReadOnly({ homeDir })
-    runner = { ok: status.state === 'running', ...status }
-  } catch (error) {
-    runner = { ok: false, state: 'unknown', message: error instanceof Error ? error.message : String(error) }
-  }
+  const runner = await doctorRunnerStatus({
+    homeDir,
+    daemonUrl: daemonStatusUrl,
+    daemonReady: daemon.ready === true,
+    daemonHealthy: daemon.ok === true,
+  })
   const [nodeMajor = 0, nodeMinor = 0] = process.versions.node.split('.').map(Number)
   const nodeOk = nodeMajor > 22 || (nodeMajor === 22 && nodeMinor >= 13)
   const checks = {
@@ -2816,12 +3902,13 @@ async function doctorCommand(args: CliArgs) {
     config: configCheck,
     daemonUrlConfiguration: daemonUrlCheck,
     managedProfile,
+    profileRuntime,
     providerReadiness,
   }
   const ok = Object.values(checks).every((check) => check.ok === true)
   printPayload({
     ok,
-    runtime: 'rust',
+    runtime: 'typescript',
     checks,
   }, args)
   if (!ok) process.exitCode = 1
@@ -2840,24 +3927,133 @@ async function readManagedProfileReadOnly(homeDir: string) {
       message: defaultSlug ? 'Default managed profile is not available.' : 'No default managed profile is configured.',
     }
   }
-  return {
-    ok: true,
-    path: registry.paths.registryFile,
-    profile,
+  return {
+    ok: true,
+    path: registry.paths.registryFile,
+    profile,
+  }
+}
+
+async function configCommand(args: CliArgs) {
+  const homeDir = tokenlessHome(args.home)
+  if (args.profile === undefined && (args.proxyServer !== undefined || args.proxyBypass !== undefined || args.clearProxy === true)) {
+    throw usageError('profile_config_scope_required', 'Proxy configuration requires --profile <slug>.')
+  }
+  if (args.profile !== undefined) {
+    if (
+      args.browser !== undefined ||
+      args.browserExecutablePath !== undefined ||
+      args.clearBrowserExecutablePath === true ||
+      args.daemonUrl !== undefined ||
+      args.language !== undefined
+    ) {
+      throw usageError('profile_config_scope_invalid', '--profile can scope only provider membership, browser visibility, and proxy settings.')
+    }
+    const profile = await new ManagedProfileRegistry(homeDir).resolveProfile(String(args.profile))
+    const current = await readTokenlessConfig(homeDir)
+    const existing = current.profilePreferences[profile.slug] ?? {
+      profileId: profile.slug,
+      roleLabel: '',
+      enabledProviders: current.providerWhitelist,
+      browserVisibility: current.browserVisibility,
+      proxy: null,
+    }
+    const proxy = profileProxyFromConfigArgs(args, existing.proxy)
+    const profilePreferences = {
+      ...current.profilePreferences,
+      [profile.slug]: {
+        ...existing,
+        enabledProviders: args.providerWhitelist === undefined
+          ? existing.enabledProviders
+          : parseProviderList(args.providerWhitelist),
+        browserVisibility: args.browserVisibility === undefined
+          ? existing.browserVisibility
+          : requiredBrowserVisibility(args.browserVisibility),
+        proxy,
+      },
+    }
+    const config = await writeTokenlessConfig({
+      homeDir,
+      profilePreferences,
+      providerWhitelist: [...new Set(Object.values(profilePreferences).flatMap((preferences) => preferences.enabledProviders))],
+    })
+    printPayload({
+      ok: true,
+      configPath: `${homeDir}/config.json`,
+      profile: profile.slug,
+      preferences: config.profilePreferences[profile.slug],
+    }, args)
+    return
+  }
+  if (args.browserExecutablePath !== undefined && args.clearBrowserExecutablePath === true) {
+    throw usageError(
+      'browser_executable_path_options_conflict',
+      '--browser-executable-path cannot be combined with --clear-browser-executable-path.',
+    )
   }
-}
-
-async function configCommand(args: CliArgs) {
-  const homeDir = tokenlessHome(args.home)
-  if (args.preferredProviders !== undefined || args.browser !== undefined || args.browserVisibility !== undefined || args.daemonUrl !== undefined) {
-    const browser = args.browser === undefined ? undefined : normalizeCliBrowser(args.browser)
+  if (
+    args.providerWhitelist !== undefined ||
+    args.browser !== undefined ||
+    args.browserExecutablePath !== undefined ||
+    args.clearBrowserExecutablePath === true ||
+    args.browserVisibility !== undefined ||
+    args.daemonUrl !== undefined ||
+    args.language !== undefined
+  ) {
+    const current = await readTokenlessConfig(homeDir)
+    let browser = args.browser === undefined ? current.browser : normalizeCliBrowser(args.browser)
+    let browserExecutablePath = current.browserExecutablePath
+    if (args.browserExecutablePath !== undefined && !isSystemBrowserId(browser)) {
+      throw usageError(
+        'browser_executable_path_requires_system_browser',
+        '--browser-executable-path requires an explicit system browser such as chrome or brave.',
+      )
+    }
+    if (args.clearBrowserExecutablePath === true) {
+      browserExecutablePath = null
+    } else if (args.browserExecutablePath !== undefined || (args.browser !== undefined && isSystemBrowserId(browser))) {
+      const configuredPath = args.browserExecutablePath === undefined
+        ? browserExecutablePathForSelection(current, browser)
+        : requiredBrowserExecutablePath(args.browserExecutablePath)
+      const runtime = await new BrowserRuntimeManager({ homeDir }).ensure(browser, {
+        allowDownload: false,
+        browserExecutablePath: configuredPath,
+      })
+      browser = runtime.selection
+      browserExecutablePath = runtime.executablePath
+    } else if (args.browser !== undefined && browser !== current.browser) {
+      browserExecutablePath = null
+    }
+    const providerWhitelist = args.providerWhitelist === undefined ? undefined : parseProviderList(args.providerWhitelist)
+    const browserVisibility = args.browserVisibility === undefined ? undefined : requiredBrowserVisibility(args.browserVisibility)
+    const profilePreferences = providerWhitelist === undefined && browserVisibility === undefined
+      ? undefined
+      : Object.fromEntries(Object.entries(current.profilePreferences).map(([profileId, preferences]) => [profileId, {
+          ...preferences,
+          enabledProviders: providerWhitelist ?? preferences.enabledProviders,
+          browserVisibility: browserVisibility ?? preferences.browserVisibility,
+        }]))
+    if (
+      browser !== current.browser ||
+      browserExecutablePath !== current.browserExecutablePath
+    ) {
+      await quiesceBrowserRuntimeForProfileMutation({
+        homeDir,
+        daemonUrl: daemonUrl(args.daemonUrl ?? current.daemonUrl ?? undefined),
+        startIfUnavailable: false,
+      })
+    }
     const config = await writeTokenlessConfig({
       homeDir,
-      preferredProviders: args.preferredProviders === undefined ? undefined : parseProviderList(args.preferredProviders),
+      providerWhitelist,
+      profilePreferences,
       browser,
-      browserVisibility: args.browserVisibility === undefined ? undefined : requiredBrowserVisibility(args.browserVisibility),
+      browserExecutablePath,
+      browserVisibility,
       daemonUrl: args.daemonUrl === undefined ? undefined : daemonUrl(args.daemonUrl),
+      language: args.language,
     })
+    setActiveLanguage(config.language)
     printPayload({ ok: true, configPath: `${homeDir}/config.json`, config }, args)
     return
   }
@@ -2865,6 +4061,48 @@ async function configCommand(args: CliArgs) {
   printPayload({ ok: true, configPath: `${homeDir}/config.json`, config }, args)
 }
 
+function browserExecutablePathForSelection(
+  config: Record<string, any>,
+  selection: unknown,
+) {
+  const normalized = normalizeBrowserSelection(selection)
+  return normalized && normalized === normalizeBrowserSelection(config.browser)
+    ? typeof config.browserExecutablePath === 'string' ? config.browserExecutablePath : null
+    : null
+}
+
+function requiredBrowserExecutablePath(value: unknown) {
+  const executablePath = typeof value === 'string' ? value.trim() : ''
+  if (!executablePath || !path.isAbsolute(executablePath)) {
+    throw usageError(
+      'browser_executable_path_invalid',
+      '--browser-executable-path must be an absolute path.',
+    )
+  }
+  return path.normalize(executablePath)
+}
+
+function profileProxyFromConfigArgs(
+  args: CliArgs,
+  current: { server: string, bypass: string[] } | null,
+) {
+  if (args.clearProxy === true && (args.proxyServer !== undefined || args.proxyBypass !== undefined)) {
+    throw usageError('profile_proxy_options_conflict', '--clear-proxy cannot be combined with --proxy-server or --proxy-bypass.')
+  }
+  if (args.clearProxy === true) return null
+  if (args.proxyServer === undefined && args.proxyBypass === undefined) return current
+  const server = args.proxyServer === undefined ? current?.server : String(args.proxyServer)
+  if (!server) throw usageError('profile_proxy_server_required', '--proxy-bypass requires an existing proxy or --proxy-server.')
+  const bypass = args.proxyBypass === undefined
+    ? current?.bypass ?? []
+    : String(args.proxyBypass).split(',').map((entry) => entry.trim()).filter(Boolean)
+  const proxy = normalizeManagedProfileProxy({ server, bypass })
+  if (proxy === undefined) {
+    throw usageError('invalid_proxy', 'Proxy must use HTTP, HTTPS, or SOCKS5 without embedded credentials.')
+  }
+  return proxy
+}
+
 async function promptCommand(args: CliArgs) {
   const prompt = await promptFromArgs(args)
   if (args.output) await fs.writeFile(args.output, `${prompt}\n`, 'utf8')
@@ -2879,11 +4117,13 @@ async function promptFromArgs(args: CliArgs) {
   const turnContext = args.contextFile || args.turnContextFile
     ? await fs.readFile(args.contextFile || args.turnContextFile, 'utf8')
     : args.context
+  const config = await readTokenlessConfig(tokenlessHome(args.home))
   return buildTokenlessPrompt({
     userPrompt,
     projectRoot: args.projectRoot,
     files: args.files,
     turnContext,
+    responseLanguage: config.language,
   })
 }
 
@@ -2891,26 +4131,36 @@ async function mappedDaemonTarget({
   homeDir,
   daemonUrl,
   provider,
+  profileId,
   taskId,
+  projectName,
 }: {
   homeDir: string
   daemonUrl: string
   provider: string
+  profileId: string
   taskId?: string | undefined
+  projectName: string
 }) {
-  if (!taskId) return null
-  const jobs = await listDaemonJobs({ homeDir, daemonUrl, provider, taskId, limit: 1000 })
-  for (const job of jobs) {
-    if (job.provider !== provider || daemonTaskId(job) !== taskId) continue
-    const candidate = resultUrl(job.result_json)
-    if (!candidate) continue
-    try {
-      return providerWakeUrl(provider, candidate)
-    } catch {
-      // Never open an untrusted URL recovered from job metadata.
-    }
+  const resolved = await resolveProviderMapping({
+    homeDir,
+    daemonUrl,
+    provider,
+    profileId,
+    projectName,
+    ...(taskId ? { taskId } : {}),
+  })
+  const candidate = resolved.mapping?.conversation?.canonical_url ??
+    resolved.mapping?.project.canonical_url
+  if (!candidate) return null
+  try {
+    return providerWakeUrl(provider, candidate)
+  } catch {
+    throw usageError(
+      'provider_mapping_invalid',
+      'The exact provider Project mapping contains an unauthorized target URL.',
+    )
   }
-  return null
 }
 
 function publicDaemonJobState(job: Record<string, any>) {
@@ -2919,12 +4169,18 @@ function publicDaemonJobState(job: Record<string, any>) {
   return {
     jobId: job.job_id,
     taskId: daemonTaskId(job),
-    backend: job.execution_backend ?? 'legacy_extension',
+    backend: job.execution_backend ?? 'playwright',
     profile: job.profile_id === undefined || job.profile_id === null
       ? null
       : { id: job.profile_id },
     provider: job.provider,
     action: job.action,
+    capabilityRoute: request.capabilityRoute ?? null,
+    fallback: fallbackState(request.fallback),
+    context: contextEnvelopeState(request.context),
+    providerAttempts: job.provider_attempts_json ?? [],
+    providerSubmittedAt: job.provider_submitted_at ?? null,
+    eligibleAt: job.eligible_at ?? null,
     browserVisibility: request.browserVisibility,
     projectName: metadata.projectName,
     chatName: metadata.chatName,
@@ -2947,10 +4203,78 @@ function publicDaemonJobState(job: Record<string, any>) {
   }
 }
 
+function contextEnvelopeState(value: unknown) {
+  const context = objectRecord(value)
+  if (context.schema !== 'tokenless.context-envelope.v1') return null
+  const instructions = Array.isArray(context.instructions) ? context.instructions : []
+  const references = Array.isArray(context.references) ? context.references : []
+  const upstream = objectRecord(context.upstream)
+  return {
+    schema: context.schema,
+    taskId: context.taskId,
+    requirements: context.requirements,
+    instructions: instructions.map((entry) => {
+      const instruction = objectRecord(entry)
+      return {
+        role: instruction.role,
+        provenance: instruction.provenance,
+        bytes: typeof instruction.content === 'string' ? Buffer.byteLength(instruction.content, 'utf8') : null,
+      }
+    }),
+    references: references.map((entry) => {
+      const reference = objectRecord(entry)
+      return {
+        kind: reference.kind,
+        attachmentId: reference.attachmentId,
+        name: reference.name,
+        mediaType: reference.mediaType,
+        size: reference.size,
+        sha256: reference.sha256,
+        provenance: reference.provenance,
+      }
+    }),
+    outputContract: context.outputContract,
+    constraints: context.constraints,
+    upstream: {
+      agentKind: upstream.agentKind,
+      sessionId: upstream.sessionId,
+      statePresent: upstream.state !== null && upstream.state !== undefined,
+    },
+    delivery: context.delivery,
+  }
+}
+
+function fallbackState(value: unknown) {
+  const fallback = objectRecord(value)
+  const alternatives = Array.isArray(fallback.alternatives) ? fallback.alternatives : []
+  if (alternatives.length === 0) return null
+  const routes = alternatives.map((entry, index) => {
+    const alternative = objectRecord(entry)
+    const capabilityRoute = objectRecord(alternative.capabilityRoute)
+    return {
+      rank: index + 1,
+      provider: alternative.provider,
+      requirements: capabilityRoute.requirements,
+      support: capabilityRoute.support,
+      runtimeEligibility: capabilityRoute.runtimeEligibility,
+      strategies: capabilityRoute.strategies,
+      evidence: capabilityRoute.evidence,
+    }
+  }).filter((route) => typeof route.provider === 'string')
+  return {
+    protocol: fallback.protocol,
+    mode: fallback.mode,
+    replay: fallback.replay,
+    providers: routes.map((route) => route.provider),
+    routes,
+  }
+}
+
 function waitingForUserPayload({
   job,
   taskId,
   provider,
+  capabilityRoute,
   profile,
   projectName,
   chatName,
@@ -2974,6 +4298,8 @@ function waitingForUserPayload({
     jobId: job.job_id,
     taskId,
     provider,
+    capabilityRoute,
+    providerAttempts: waitResult?.job?.provider_attempts_json ?? job.provider_attempts_json ?? [],
     profile: publicManagedProfile(profile, profile.slug),
     projectName,
     chatName,
@@ -2981,13 +4307,13 @@ function waitingForUserPayload({
     browser,
     userAction: {
       ...(waitResult?.userAction ?? {}),
-      message: windowOpen
-        ? 'The visible managed browser is open. Manually complete the provider verification or sign-in there, then query the same Tokenless task again.'
-        : 'This headless job requires user interaction and no browser window is open. Resume the same job with headed visibility; do not submit a replacement job.',
+      message: localizeText(windowOpen
+        ? 'Your help is needed: complete provider sign-in or verification in the visible browser. Tokenless will preserve this job and continue afterward.'
+        : 'Your help is needed, but no browser window is open. Resume this same job in headed mode; do not create a replacement job.'),
       resumeCommand,
       queryGuidance: windowOpen
-        ? 'Do not submit a replacement job; query the same job/task after user confirmation.'
-        : 'Resume this exact job with headed visibility, then complete the visible verification in the opened browser.',
+        ? localizeText('After completing sign-in or verification, query this same job or task; Tokenless will continue from its saved checkpoint.')
+        : localizeText('Your help is needed, but no browser window is open. Resume this same job in headed mode; do not create a replacement job.'),
     },
     result: publicDaemonResult(waitResult),
     statusLog,
@@ -3046,6 +4372,8 @@ async function waitForJobWithInterruptCancellation({
   timeoutMs,
   cancelTimeoutMs,
   statusReporter,
+  agentKind,
+  agentSessionId,
 }: Record<string, any>) {
   let interrupted = false
   let interruptReject: ((error: Error) => void) | undefined
@@ -3085,6 +4413,8 @@ async function waitForJobWithInterruptCancellation({
       jobId,
       timeoutMs,
       signal: waitAbort.signal,
+      agentKind,
+      agentSessionId,
       onStatus: (event) => statusReporter.report(event),
     }).then(
       (result) => interrupted ? neverSettles : result,
@@ -3133,22 +4463,106 @@ function publicDaemonResult(result: Record<string, any> | null) {
   }
 }
 
-function assertNativeRequestSize(value: unknown) {
+function assertDaemonRequestSize(value: unknown) {
   const bytes = Buffer.byteLength(JSON.stringify(value), 'utf8')
-  if (bytes <= MAX_NATIVE_MESSAGE_BYTES) return
+  if (bytes <= MAX_DAEMON_REQUEST_BYTES) return
   throw usageError(
-    'native_message_too_large',
-    `Tokenless request is ${bytes} bytes; keep it below ${MAX_NATIVE_MESSAGE_BYTES} bytes. Attach fewer or smaller files.`
+    'daemon_request_too_large',
+    `Tokenless request is ${bytes} bytes; keep it below ${MAX_DAEMON_REQUEST_BYTES} bytes. Attach fewer or smaller files.`
   )
 }
 
-function parseArgs(argv: string[]): CliArgs {
-  const parsed: CliArgs = { attachFiles: [], files: [] }
+function createCommandContracts(): CommandContract[] {
+  const visibleJobOptions = [
+    'home', 'json', 'quiet', 'profile', 'provider', 'daemonUrl', 'daemonStartTimeoutMs', 'browserVisibility',
+    'runnerHeartbeatTimeoutMs', 'timeoutMs', 'cancelTimeoutMs', 'targetUrl', 'taskId', 'idempotencyKey',
+    'projectName', 'chatName', 'workspaceMode', 'projectInstructions', 'projectInstructionsFile',
+    'model', 'modelFallbacks', 'effort', 'thinkingEffort', 'qwenMode', 'qwenModeVariant',
+    'deepSeekMode', 'deepSeekDeepThink', 'deepSeekSearch',
+    'chatSurface', 'noWait',
+    'agentKind', 'agentSessionId',
+  ] as const
+  const runOptions = [
+    ...visibleJobOptions, 'prompt', 'promptFile', 'projectRoot', 'context', 'contextFile',
+    'turnContextFile', 'files', 'attachFiles', 'capabilities', 'action', 'longRunning',
+  ] as const
+  const providerInspectOptions = [
+    'home', 'json', 'quiet', 'profile', 'provider', 'daemonUrl', 'daemonStartTimeoutMs',
+    'browserVisibility', 'runnerHeartbeatTimeoutMs', 'timeoutMs', 'cancelTimeoutMs', 'targetUrl',
+    'taskId', 'idempotencyKey', 'noWait', 'agentKind', 'agentSessionId',
+  ] as const
+  const providerConfigureOptions = [
+    ...providerInspectOptions, 'model', 'modelFallbacks', 'effort', 'thinkingEffort', 'chatSurface',
+    'deepSeekMode', 'deepSeekDeepThink', 'deepSeekSearch',
+  ] as const
+
+  const contracts: CommandContract[] = [
+    { command: 'help', usage: ['tokenless help'], options: [] },
+    { command: 'version', usage: ['tokenless --version', 'tokenless -V', 'tokenless version'], options: [] },
+    { command: 'run', usage: [`tokenless run [--capability <capability>] --provider ${VISIBLE_PROVIDER_USAGE} --prompt <text> --json`], options: runOptions },
+    { command: 'capabilities', subcommand: 'list', usage: ['tokenless capabilities list --json'], options: ['json'] },
+    { command: 'limits', subcommand: 'inspect', usage: ['tokenless limits inspect --profile <slug> --provider <provider> --json'], options: ['home', 'json', 'profile', 'provider', 'daemonUrl', 'daemonStartTimeoutMs'] },
+    { command: 'replay', usage: ['tokenless replay --agent-kind <kind> --agent-session-id <id> [--limit <count>] --json'], options: ['home', 'json', 'daemonUrl', 'daemonStartTimeoutMs', 'agentKind', 'agentSessionId', 'limit'] },
+    { command: 'provider-status', usage: ['tokenless provider-status --profile <slug> --provider <provider> --json'], options: providerInspectOptions },
+    { command: 'provider-auth-status', usage: ['tokenless provider-auth-status --profile <slug> --provider <provider> --json'], options: providerInspectOptions },
+    { command: 'provider-controls', usage: ['tokenless provider-controls --profile <slug> --provider <provider> --json'], options: providerInspectOptions },
+    { command: 'inspect-provider-controls', usage: ['tokenless inspect-provider-controls --profile <slug> --provider <provider> --json'], options: providerInspectOptions },
+    { command: 'chatgpt-controls', usage: ['tokenless chatgpt-controls --profile <slug> --json'], options: providerInspectOptions },
+    { command: 'inspect-chatgpt-controls', usage: ['tokenless inspect-chatgpt-controls --profile <slug> --json'], options: providerInspectOptions },
+    { command: 'provider-configure', usage: ['tokenless provider-configure --profile <slug> --provider <provider> [--model <label>] [--effort <label>] --json'], options: providerConfigureOptions },
+    { command: 'chatgpt-configure', usage: ['tokenless chatgpt-configure --profile <slug> [--model <label>] [--effort <label>] --json'], options: providerConfigureOptions },
+    { command: 'provider-action', usage: [`tokenless provider-action --profile <slug> --provider <provider> --action <${PRIORITY_VISIBLE_PROVIDER_ACTION_LIST.replace(/, /g, '|')}> --json`], options: [...providerInspectOptions, 'action', 'prompt', 'promptFile', 'attachFiles', 'projectName', 'projectInstructions', 'projectInstructionsFile', 'workspaceMode', 'model', 'modelFallbacks', 'effort', 'thinkingEffort', 'qwenMode', 'qwenModeVariant', 'deepSeekMode', 'deepSeekDeepThink', 'deepSeekSearch', 'doubaoMode', 'doubaoSkill'] },
+    { command: 'snapshot-dom', usage: ['tokenless snapshot-dom --profile <slug> --provider <provider> --json'], options: providerInspectOptions },
+    { command: 'state', usage: ['tokenless state (--task-id <task-id>|--job-id <job-id>|--profile <slug>) --json'], options: ['home', 'json', 'profile', 'provider', 'daemonUrl', 'daemonStartTimeoutMs', 'taskId', 'idempotencyKey', 'jobId', 'projectName', 'chatName', 'limit', 'agentKind', 'agentSessionId'] },
+    { command: 'status', usage: ['tokenless status (--task-id <task-id>|--job-id <job-id>|--profile <slug>) --json'], options: ['home', 'json', 'profile', 'provider', 'daemonUrl', 'daemonStartTimeoutMs', 'taskId', 'idempotencyKey', 'jobId', 'projectName', 'chatName', 'limit', 'agentKind', 'agentSessionId'] },
+    { command: 'resume', usage: ['tokenless resume --job-id <job-id> --browser-visibility headed --json'], options: ['home', 'json', 'quiet', 'jobId', 'browserVisibility', 'daemonUrl', 'daemonStartTimeoutMs', 'runnerHeartbeatTimeoutMs', 'timeoutMs', 'cancelTimeoutMs', 'agentKind', 'agentSessionId'] },
+    { command: 'cancel', usage: ['tokenless cancel --job-id <job-id> --json'], options: ['home', 'json', 'jobId', 'daemonUrl', 'daemonStartTimeoutMs', 'cancelTimeoutMs', 'agentKind', 'agentSessionId'] },
+    { command: 'setup', usage: ['tokenless setup [--anti-detect|--browser <browser>] [--profile <slug>] [--provider-whitelist <list>] [--no-open] [--no-browser-download] [--repair-browser] [--defaults|--fresh] --json'], options: ['home', 'json', 'quiet', 'profile', 'antiDetect', 'browser', 'providerWhitelist', 'noOpen', 'noBrowserDownload', 'repairBrowser', 'browserVisibility', 'chromeUserDataDir', 'daemonUrl', 'daemonStartTimeoutMs', 'runnerHeartbeatTimeoutMs', 'cancelTimeoutMs', 'timeoutMs', 'targetUrl', 'label', 'setDefault', 'importChromeProfile', 'freshProfile', 'reimportProfile', 'setupDefaults', 'consentLocalProfileCopy'] },
+    { command: 'install', usage: ['tokenless install [--browser <browser>|--browsers <list>] [--repair-browser] --json'], options: ['home', 'json', 'browser', 'browsers', 'repairBrowser', 'daemonUrl', 'daemonStartTimeoutMs'] },
+    { command: 'upgrade', usage: ['tokenless upgrade [--json] [--home <dir>] [--daemon-url <url>] [--browser <browser>|--browsers <list>]'], options: ['json', 'home', 'daemonUrl', 'browser', 'browsers', 'daemonStartTimeoutMs'] },
+    { command: 'doctor', usage: ['tokenless doctor --json'], options: ['home', 'json', 'browser', 'daemonUrl'] },
+    { command: 'config', usage: ['tokenless config [--profile <slug>] [--provider-whitelist <list>] [--browser-visibility <mode>] [--proxy-server <url> --proxy-bypass <list>|--clear-proxy] [--language <en|zh-CN>] [--browser <browser>] [--browser-executable-path <path>|--clear-browser-executable-path] [--daemon-url <url>] --json'], options: ['home', 'json', 'profile', 'language', 'providerWhitelist', 'browser', 'browserExecutablePath', 'clearBrowserExecutablePath', 'browserVisibility', 'proxyServer', 'proxyBypass', 'clearProxy', 'daemonUrl'] },
+    { command: 'dashboard', usage: ['tokenless dashboard [--profile <slug>] [--no-open] [--json]'], options: ['home', 'json', 'profile', 'noOpen', 'daemonUrl', 'daemonStartTimeoutMs'] },
+    { command: 'prompt', usage: ['tokenless --prompt <text> [--context <text>] [--file <path>]'], options: ['json', 'prompt', 'promptFile', 'context', 'contextFile', 'turnContextFile', 'projectRoot', 'files', 'output'] },
+    { command: 'profiles', subcommand: 'add', usage: ['tokenless profiles add --profile <slug> [--label <name>] [--set-default] --json'], options: ['home', 'json', 'profile', 'browser', 'chromeUserDataDir', 'consentLocalProfileCopy', 'importChromeProfile', 'label', 'providerWhitelist', 'setDefault'] },
+    { command: 'profiles', subcommand: 'clear', usage: ['tokenless profiles clear (--profile <slug>|--all)'], options: ['home', 'profile', 'allProfiles'] },
+    { command: 'profiles', subcommand: 'discover', usage: ['tokenless profiles discover [--browser <all|chrome|brave|edge|arc|chromium|chrome-for-testing>] [--browser-user-data-dir <dir>] --json'], options: ['json', 'browser', 'chromeUserDataDir'] },
+    { command: 'profiles', subcommand: 'list', usage: ['tokenless profiles list --json'], options: ['home', 'json'] },
+    { command: 'profiles', subcommand: 'reset', usage: ['tokenless profiles reset [--profile <slug>] --consent-local-profile-copy --json'], options: ['home', 'json', 'profile', 'consentLocalProfileCopy'] },
+    { command: 'profiles', subcommand: 'status', usage: ['tokenless profiles status [--profile <slug>] [--provider <provider>] --json'], options: ['home', 'json', 'quiet', 'profile', 'provider', 'browserVisibility', 'daemonStartTimeoutMs', 'daemonUrl', 'runnerHeartbeatTimeoutMs', 'targetUrl', 'taskId', 'timeoutMs', 'cancelTimeoutMs'] },
+    { command: 'profiles', subcommand: 'open', usage: ['tokenless profiles open [--profile <slug>] [--provider <provider>] --json'], options: ['home', 'json', 'quiet', 'profile', 'provider', 'daemonStartTimeoutMs', 'daemonUrl', 'runnerHeartbeatTimeoutMs', 'targetUrl', 'taskId', 'timeoutMs', 'cancelTimeoutMs'] },
+    { command: 'profiles', subcommand: 'set-default', usage: ['tokenless profiles set-default --profile <slug> --json'], options: ['home', 'json', 'profile'] },
+    { command: 'profiles', subcommand: 'remove', usage: ['tokenless profiles remove --profile <slug> --confirm-delete --json'], options: ['home', 'json', 'profile', 'confirmDelete'] },
+    { command: 'daemon', subcommand: 'stop', usage: ['tokenless daemon stop [--daemon-url <loopback-url>] [--timeout-ms <ms>] --json'], options: ['home', 'json', 'daemonUrl', 'timeoutMs'] },
+  ]
+  return contracts.map((contract) => ({
+    ...contract,
+    options: [...new Set([...contract.options, 'help'])],
+  }))
+}
+
+function commandContractKey(context: CommandContext) {
+  return context.subcommand ? `${context.command} ${context.subcommand}` : context.command
+}
+
+function commandDisplayName(context: CommandContext) {
+  return context.command === 'tokenless' ? 'tokenless' : `tokenless ${commandContractKey(context)}`
+}
+
+function parseArgs(argv: string[], context: CommandContext): CliArgs {
+  const parsed: CliArgs = { attachFiles: [], capabilities: [], files: [] }
+  Object.defineProperty(parsed, CLI_ARG_FLAGS, {
+    value: {},
+    enumerable: false,
+  })
   const valueFlags: Record<string, string> = {
     '--prompt': 'prompt',
     '--prompt-file': 'promptFile',
     '--project-root': 'projectRoot',
     '--project-name': 'projectName',
+    '--project-instructions': 'projectInstructions',
+    '--project-instructions-file': 'projectInstructionsFile',
+    '--workspace-mode': 'workspaceMode',
     '--chat-name': 'chatName',
     '--context': 'context',
     '--context-file': 'contextFile',
@@ -3156,25 +4570,34 @@ function parseArgs(argv: string[]): CliArgs {
     '--turn-context-file': 'turnContextFile',
     '--output': 'output',
     '--provider': 'provider',
+    '-p': 'provider',
     '--profile': 'profile',
+    '-P': 'profile',
     '--label': 'label',
     '--import-chrome-profile': 'importChromeProfile',
     '--import-browser-profile': 'importChromeProfile',
     '--chrome-user-data-dir': 'chromeUserDataDir',
     '--browser-user-data-dir': 'chromeUserDataDir',
-    '--preferred-providers': 'preferredProviders',
+    '--preferred-providers': 'providerWhitelist',
+    '--provider-whitelist': 'providerWhitelist',
     '--action': 'action',
     '--target-url': 'targetUrl',
     '--idempotency-key': 'idempotencyKey',
     '--conversation-key': 'idempotencyKey',
     '--task-id': 'taskId',
     '--job-id': 'jobId',
+    '--agent-kind': 'agentKind',
+    '--agent-session-id': 'agentSessionId',
     '--limit': 'limit',
     '--browser': 'browser',
+    '--browser-executable-path': 'browserExecutablePath',
     '--browser-visibility': 'browserVisibility',
+    '--proxy-server': 'proxyServer',
+    '--proxy-bypass': 'proxyBypass',
     '--browsers': 'browsers',
     '--home': 'home',
     '--daemon-url': 'daemonUrl',
+    '--language': 'language',
     '--timeout-ms': 'timeoutMs',
     '--daemon-start-timeout-ms': 'daemonStartTimeoutMs',
     '--cancel-timeout-ms': 'cancelTimeoutMs',
@@ -3187,13 +4610,27 @@ function parseArgs(argv: string[]): CliArgs {
     '--model-fallback': 'modelFallbacks',
     '--effort': 'effort',
     '--thinking-effort': 'thinkingEffort',
+    '--qwen-mode': 'qwenMode',
+    '--qwen-mode-variant': 'qwenModeVariant',
+    '--deepseek-mode': 'deepSeekMode',
+    '--deepseek-deepthink': 'deepSeekDeepThink',
+    '--deepseek-search': 'deepSeekSearch',
+    '--doubao-mode': 'doubaoMode',
+    '--doubao-skill': 'doubaoSkill',
     '--chat-surface': 'chatSurface',
   }
   const booleanFlags: Record<string, string> = {
     '--include-text': 'includeText',
+    '--help': 'help',
+    '-h': 'help',
     '--json': 'json',
     '--quiet': 'quiet',
+    '--anti-detect': 'antiDetect',
     '--no-open': 'noOpen',
+    '--clear-proxy': 'clearProxy',
+    '--clear-browser-executable-path': 'clearBrowserExecutablePath',
+    '--no-browser-download': 'noBrowserDownload',
+    '--repair-browser': 'repairBrowser',
     '--no-wait': 'noWait',
     '--long-running': 'longRunning',
     '--set-default': 'setDefault',
@@ -3203,60 +4640,78 @@ function parseArgs(argv: string[]): CliArgs {
     '-f': 'freshProfile',
     '--clean-profile': 'freshProfile',
     '--reimport-profile': 'reimportProfile',
-    '--refresh-skills': 'refreshSkills',
-    '--skip-skill-install': 'skipSkillInstall',
     '--defaults': 'setupDefaults',
     '--all': 'allProfiles',
   }
   for (let index = 0; index < argv.length; index += 1) {
     const arg = argv[index] as string
     if (arg === '--file') {
-      const value = requireFlagValue(argv, index, arg)
+      const value = requireFlagValue(argv, index, arg, context)
       parsed.files.push(value)
+      rememberArgFlag(parsed, 'files', arg)
       index += 1
       continue
     }
     if (arg === '--attach-file') {
-      const value = requireFlagValue(argv, index, arg)
+      const value = requireFlagValue(argv, index, arg, context)
       parsed.attachFiles.push(value)
+      rememberArgFlag(parsed, 'attachFiles', arg)
+      index += 1
+      continue
+    }
+    if (arg === '--capability') {
+      const value = requireFlagValue(argv, index, arg, context)
+      parsed.capabilities.push(value)
+      rememberArgFlag(parsed, 'capabilities', arg)
       index += 1
       continue
     }
     const key = valueFlags[arg]
     if (key) {
-      parsed[key] = requireFlagValue(argv, index, arg)
+      parsed[key] = requireFlagValue(argv, index, arg, context)
+      rememberArgFlag(parsed, key, arg)
       index += 1
       continue
     }
     const booleanKey = booleanFlags[arg]
     if (booleanKey) {
       parsed[booleanKey] = true
+      rememberArgFlag(parsed, booleanKey, arg)
       continue
     }
-    throw usageError(
+    throw commandUsageError(
       arg === '--no-daemon' ? 'daemon_only' : 'unknown_argument',
       arg === '--no-daemon'
         ? 'Tokenless run is daemon-only; --no-daemon and local task-page fallback remain removed.'
-        : `Unknown Tokenless argument: ${arg}`
+        : `Unknown Tokenless argument: ${arg}`,
+      context,
+      [arg]
     )
   }
   return parsed
 }
 
-function requireFlagValue(argv: string[], index: number, flag: string) {
+function rememberArgFlag(args: CliArgs, key: string, flag: string) {
+  const flags = args[CLI_ARG_FLAGS]
+  if (!flags) return
+  flags[key] ??= []
+  if (!flags[key]!.includes(flag)) flags[key]!.push(flag)
+}
+
+function requireFlagValue(argv: string[], index: number, flag: string, context: CommandContext) {
   const value = argv[index + 1]
   if (value === undefined || value.startsWith('--')) {
-    throw usageError('missing_argument_value', `${flag} requires a value.`)
+    throw commandUsageError('missing_argument_value', `${flag} requires a value.`, context, [flag])
   }
   return value
 }
 
 function normalizeCliBrowser(browser: unknown) {
   const browserId = normalizeBrowserId(browser)
-  if (!browserId || browserId === 'profile') {
+  if (!browserId || (browserId === 'profile' && !process.env.TOKENLESS_BROWSER_EXECUTABLE)) {
     throw usageError(
       'invalid_browser',
-      'Browser must be one of: chrome, chrome-for-testing, chromium, edge, arc, brave.'
+      'Browser must be auto, chrome, chrome-for-testing, chromium, edge, arc, brave, managed-chromium, or cloak.'
     )
   }
   return browserId
@@ -3270,47 +4725,125 @@ function requiredBrowserVisibility(value: unknown) {
   return visibility
 }
 
+function agentRecipientFromArgs(
+  args: CliArgs,
+  required: true
+): { agentKind: string; agentSessionId: string }
+function agentRecipientFromArgs(
+  args: CliArgs,
+  required?: false
+): { agentKind?: string; agentSessionId?: string }
+function agentRecipientFromArgs(
+  args: CliArgs,
+  required = false
+): { agentKind?: string; agentSessionId?: string } {
+  const rawKind = args.agentKind ?? process.env.TOKENLESS_AGENT_KIND
+  const rawSessionId = args.agentSessionId ?? process.env.TOKENLESS_AGENT_SESSION_ID
+  if (rawKind === undefined && rawSessionId === undefined) {
+    if (required) {
+      throw usageError(
+        'missing_agent_recipient',
+        'Agent replay requires --agent-kind and --agent-session-id, or TOKENLESS_AGENT_KIND and TOKENLESS_AGENT_SESSION_ID.'
+      )
+    }
+    return {}
+  }
+  if (rawKind === undefined || rawSessionId === undefined) {
+    throw usageError(
+      'incomplete_agent_recipient',
+      '--agent-kind and --agent-session-id must be provided together.'
+    )
+  }
+  const agentKind = String(rawKind).trim()
+  const agentSessionId = String(rawSessionId).trim()
+  if (!agentKind || Array.from(agentKind).length > 128) {
+    throw usageError('invalid_agent_kind', '--agent-kind must be a non-empty string of at most 128 characters.')
+  }
+  if (!agentSessionId || Array.from(agentSessionId).length > 256) {
+    throw usageError('invalid_agent_session_id', '--agent-session-id must be a non-empty string of at most 256 characters.')
+  }
+  return { agentKind, agentSessionId }
+}
+
+function isReplayActionableStatus(status: string) {
+  return status === 'waiting_for_user' ||
+    status === 'succeeded' ||
+    status === 'failed' ||
+    status === 'canceled' ||
+    status === 'timed_out'
+}
+
 function normalizeProvider(provider: unknown): ProviderId {
   const normalized = String(provider).trim().toLowerCase()
-  if (!['chatgpt', 'claude', 'gemini', 'grok'].includes(normalized)) {
-    throw usageError('unsupported_provider', 'Provider must be one of: chatgpt, claude, gemini, grok.')
+  const resolved = getProviderDescriptorById(normalized)
+  if (!resolved || resolved.stage === 'disabled') {
+    throw usageError('unsupported_provider', `Provider must be one of: ${supportedVisibleProviderList()}.`)
   }
-  return normalized as ProviderId
+  return resolved.id
 }
 
-function assertProfilesCommandArguments(subcommand: string | undefined, args: CliArgs) {
-  const common = ['files', 'home', 'json', 'profile']
-  const byCommand: Record<string, string[]> = {
-    add: [...common, 'browser', 'chromeUserDataDir', 'consentLocalProfileCopy', 'importChromeProfile', 'label', 'preferredProviders', 'setDefault'],
-    clear: [...common, 'allProfiles'],
-    discover: ['files', 'browser', 'chromeUserDataDir', 'json'],
-    list: ['files', 'home', 'json'],
-    reset: [...common, 'preferredProviders'],
-    status: [...common, 'browserVisibility', 'daemonStartTimeoutMs', 'daemonUrl', 'provider', 'runnerHeartbeatTimeoutMs', 'targetUrl', 'taskId', 'timeoutMs'],
-    open: [...common, 'daemonStartTimeoutMs', 'daemonUrl', 'provider', 'runnerHeartbeatTimeoutMs', 'targetUrl', 'taskId', 'timeoutMs'],
-    'set-default': common,
-    remove: [...common, 'confirmDelete'],
+function requireProviderHomeUrl(provider: unknown) {
+  const descriptor = getProviderDescriptorById(String(provider).trim().toLowerCase())
+  if (!descriptor || descriptor.stage === 'disabled') {
+    throw usageError('unsupported_provider', `Provider must be one of: ${supportedVisibleProviderList()}.`)
   }
-  if (subcommand === undefined || byCommand[subcommand] === undefined) {
-    throw usageError('profiles_command_invalid', 'Profiles subcommand must be add, clear, discover, list, reset, status, open, set-default, or remove.')
-  }
-  if ((subcommand === 'clear' || subcommand === 'reset') && args.json === true) {
-    throw usageError('profile_command_json_unsupported', `Profiles ${subcommand} is a human maintenance command and does not accept --json.`)
+  return descriptor.navigation.homeUrl
+}
+
+function supportedVisibleProviderList() {
+  return supportedVisibleProviderIds().join(', ')
+}
+
+function supportedVisibleProviderIds() {
+  return listProviderDescriptors()
+    .filter((provider) => provider.stage !== 'disabled')
+    .sort((left, right) => left.setupOrder - right.setupOrder)
+    .map((provider) => provider.id)
+}
+
+function defaultVisibleProviderId(): ProviderId {
+  const provider = supportedVisibleProviderIds()[0]
+  if (!provider) {
+    throw usageError('provider_required', 'Tokenless requires at least one enabled visible provider.')
   }
-  assertOnlyArguments(args, new Set(byCommand[subcommand]), `profiles ${subcommand}`)
+  return provider
 }
 
-function assertOnlyArguments(args: CliArgs, allowed: Set<string>, command: string) {
-  const unsupported = Object.entries(args)
-    .filter(([key, value]) => !['attachFiles', 'files'].includes(key) && value !== undefined && !allowed.has(key))
-    .map(([key]) => `--${key.replace(/[A-Z]/g, (character) => `-${character.toLowerCase()}`)}`)
-  if (args.files.length > 0) unsupported.push('--file')
-  if (unsupported.length > 0) {
+function requireLegacyChatGptProviderId(): ProviderId {
+  const candidates = listProviderDescriptors().filter((provider) => (
+    provider.stage !== 'disabled' && provider.controls.chatSurface
+  ))
+  if (candidates.length !== 1) {
     throw usageError(
-      'admin_command_option_invalid',
-      `${command} does not accept option${unsupported.length === 1 ? '' : 's'}: ${unsupported.join(', ')}.`,
+      'chatgpt_controls_unsupported',
+      'ChatGPT compatibility commands require exactly one enabled provider that owns the chat surface.'
     )
   }
+  return candidates[0]!.id
+}
+
+function providerSupportsChatSurface(providerId: string) {
+  const descriptor = getProviderDescriptorById(providerId)
+  return descriptor?.stage !== 'disabled' && descriptor?.controls.chatSurface === true
+}
+
+function unsupportedArgumentFlags(args: CliArgs, allowed: Set<string>) {
+  const flags = args[CLI_ARG_FLAGS] ?? {}
+  const unsupported = Object.entries(args)
+    .filter(([key, value]) => !['attachFiles', 'capabilities', 'files'].includes(key) && value !== undefined && !allowed.has(key))
+    .flatMap(([key]) => flags[key] ?? [optionUsageLabel(key)])
+  if (args.files.length > 0 && !allowed.has('files')) unsupported.push(...(flags.files ?? ['--file']))
+  if (args.attachFiles.length > 0 && !allowed.has('attachFiles')) unsupported.push(...(flags.attachFiles ?? ['--attach-file']))
+  if (args.capabilities.length > 0 && !allowed.has('capabilities')) unsupported.push(...(flags.capabilities ?? ['--capability']))
+  return [...new Set(unsupported)]
+}
+
+function strictPositiveInteger(value: unknown, flag: string) {
+  const numeric = Number(value)
+  if (!Number.isFinite(numeric) || numeric <= 0 || !Number.isInteger(numeric) || numeric > 2_147_483_647) {
+    throw usageError('invalid_timeout', `${flag} must be a finite positive integer no greater than 2147483647.`)
+  }
+  return numeric
 }
 
 function requiredAdminValue(value: unknown, flag: string): string {
@@ -3320,76 +4853,54 @@ function requiredAdminValue(value: unknown, flag: string): string {
   return value
 }
 
-function assertCommandRoutingArguments(command: string, args: CliArgs) {
-  if (command !== 'run' && command !== 'provider-action' && args.attachFiles.length > 0) {
-    throw usageError(
-      'attachment_requires_visible_action',
-      '--attach-file is accepted only by tokenless run or provider-action --action file.upload.'
-    )
-  }
-  const profilesOnly = [
-    ['importChromeProfile', '--import-browser-profile'],
-    ['chromeUserDataDir', '--browser-user-data-dir'],
-    ['setDefault', '--set-default'],
-    ['confirmDelete', '--confirm-delete'],
-    ['consentLocalProfileCopy', '--consent-local-profile-copy'],
-    ['allProfiles', '--all'],
-  ] as const
-  const selectedProfilesOnly = profilesOnly.filter(([key]) => args[key] !== undefined).map(([, flag]) => flag)
-  if (command !== 'profiles' && args.allProfiles === true) {
-    throw usageError('profiles_options_require_profiles_command', '--all is accepted only by the profiles command.')
-  }
-  if (command !== 'profiles' && command !== 'setup' && selectedProfilesOnly.length > 0) {
-    throw usageError(
-      'profiles_options_require_profiles_command',
-      `${selectedProfilesOnly.join(', ')} is accepted only by the profiles command.`,
+function assertCommandRoutingArguments(command: string, subcommand: string | undefined, args: CliArgs) {
+  const context = { command, subcommand }
+  const contract = COMMAND_CONTRACT_BY_KEY.get(commandContractKey(context))
+  if (!contract) {
+    const validCommands = validSubcommandsFor(command)
+    throw commandUsageError(
+      validCommands.length > 0 ? `${command}_command_invalid` : 'unknown_command',
+      validCommands.length > 0
+        ? `${commandDisplayName({ command })} requires one of: ${validCommands.join(', ')}.`
+        : `Unknown Tokenless command: ${commandContractKey(context)}.`,
+      validCommands.length > 0 ? { command } : context,
+      [],
+      validCommands,
     )
   }
-  const browserVisibilityCommands = new Set([
-    'run',
+  const inspectionCommands = new Set([
     'provider-status',
     'provider-auth-status',
-    'provider-action',
     'provider-controls',
     'inspect-provider-controls',
-    'provider-configure',
     'chatgpt-controls',
     'inspect-chatgpt-controls',
-    'chatgpt-configure',
-    'snapshot-dom',
-    'config',
-    'setup',
-    'resume',
   ])
-  if (args.browserVisibility !== undefined && command !== 'profiles' && !browserVisibilityCommands.has(command)) {
-    throw usageError(
-      'browser_visibility_command_invalid',
-      `--browser-visibility is not accepted by tokenless ${command}.`
+  const inspectionControlOptions = selectedArgumentFlags(args, [
+    'model',
+    'modelFallbacks',
+    'effort',
+    'thinkingEffort',
+    'chatSurface',
+  ])
+  if (inspectionCommands.has(command) && inspectionControlOptions.length > 0) {
+    const error = commandUsageError(
+      'controls_unsupported_for_action',
+      'Control selection options are not accepted by provider-controls or chatgpt-controls; use a configure command.',
+      context,
+      inspectionControlOptions,
     )
+    error.exitCode = 1
+    throw error
   }
-  const setupOnly = [
-    ['freshProfile', '--fresh'],
-    ['setupDefaults', '--defaults'],
-    ['reimportProfile', '--reimport-profile'],
-    ['refreshSkills', '--refresh-skills'],
-    ['skipSkillInstall', '--skip-skill-install'],
-  ] as const
-  const selectedSetupOnly = setupOnly.filter(([key]) => args[key] !== undefined).map(([, flag]) => flag)
-  if (command !== 'setup' && selectedSetupOnly.length > 0) {
-    throw usageError('setup_options_require_setup', `${selectedSetupOnly.join(', ')} is accepted only by tokenless setup.`)
-  }
-  if (command === 'setup') {
-    const setupProviderScope = [
-      ['provider', '--provider'],
-      ['preferredProviders', '--preferred-providers'],
-    ] as const
-    const selectedSetupProviderScope = setupProviderScope.filter(([key]) => args[key] !== undefined).map(([, flag]) => flag)
-    if (selectedSetupProviderScope.length > 0) {
-      throw usageError(
-        'setup_provider_selection_unsupported',
-        `tokenless setup checks every supported visible provider; remove ${selectedSetupProviderScope.join(', ')}.`,
-      )
-    }
+  const unsupported = unsupportedArgumentFlags(args, new Set(contract.options))
+  if (unsupported.length > 0) {
+    throw commandUsageError(
+      'invalid_option',
+      `${commandDisplayName(context)} does not accept option${unsupported.length === 1 ? '' : 's'}: ${unsupported.join(', ')}.`,
+      context,
+      unsupported,
+    )
   }
   if (command === 'setup' && args.freshProfile === true) {
     if (args.importChromeProfile !== undefined) {
@@ -3399,8 +4910,19 @@ function assertCommandRoutingArguments(command: string, args: CliArgs) {
       throw usageError('setup_profile_choice_conflict', '--fresh cannot be combined with --reimport-profile.')
     }
   }
-  if (command === 'run') return
-  if (command === 'profiles') return
+  if (command === 'setup' && args.noBrowserDownload === true && args.repairBrowser === true) {
+    throw usageError(
+      'browser_runtime_repair_download_conflict',
+      '--repair-browser cannot be combined with --no-browser-download.',
+    )
+  }
+}
+
+function selectedArgumentFlags(args: CliArgs, keys: string[]) {
+  const flags = args[CLI_ARG_FLAGS] ?? {}
+  return keys.flatMap((key) => (
+    args[key] === undefined ? [] : (flags[key] ?? [optionUsageLabel(key)])
+  ))
 }
 
 function assertVisibleRunArguments(args: CliArgs) {
@@ -3413,11 +4935,68 @@ function assertVisibleRunArguments(args: CliArgs) {
   }
 }
 
+function taskCapabilityRequirementsForExecution(
+  args: CliArgs,
+  action: string,
+  visibleAction: { action: string; payload: Record<string, unknown> } | undefined,
+): readonly TaskCapabilityId[] {
+  if (visibleAction) return []
+  if (args.capabilities.length > 0 && action !== 'submit_and_read') {
+    throw usageError(
+      'task_capability_action_unsupported',
+      '--capability currently requires the submit_and_read run action so Tokenless can prove the requested outcome.',
+    )
+  }
+
+  let explicit: readonly TaskCapabilityId[]
+  try {
+    explicit = normalizeTaskCapabilityRequirements(args.capabilities)
+  } catch (error) {
+    if (!(error instanceof TaskCapabilityRequestError)) throw error
+    const cliError = usageError(error.code, error.message)
+    cliError.context = {
+      capability: error.capability,
+      availableCapabilities: listTaskCapabilityDefinitions().map((definition) => definition.id),
+    }
+    throw cliError
+  }
+
+  if (explicit.includes(TASK_CAPABILITIES.FILE_UPLOAD) && args.attachFiles.length === 0) {
+    throw usageError('task_capability_input_required', 'file.upload requires at least one --attach-file <path>.')
+  }
+  if (
+    explicit.includes(TASK_CAPABILITIES.WORKSPACE_NATIVE) &&
+    (args.workspaceMode === undefined || normalizeWorkspaceMode(args.workspaceMode) !== 'native')
+  ) {
+    throw usageError(
+      'task_capability_input_required',
+      'workspace.native requires --workspace-mode native and --project-name <name>.',
+    )
+  }
+
+  const inferred: TaskCapabilityId[] = []
+  if (action === 'submit_and_read') inferred.push(TASK_CAPABILITIES.CONVERSATION_CHAT)
+  if (args.attachFiles.length > 0) {
+    inferred.push(TASK_CAPABILITIES.FILE_UPLOAD)
+    for (const sourcePath of args.attachFiles) {
+      const mediaType = visibleAttachmentMediaType(sourcePath)
+      if (mediaType.startsWith('image/')) inferred.push(TASK_CAPABILITIES.IMAGE_INPUT)
+      if (mediaType.startsWith('audio/')) inferred.push(TASK_CAPABILITIES.AUDIO_INPUT)
+      if (mediaType.startsWith('video/')) inferred.push(TASK_CAPABILITIES.VIDEO_INPUT)
+    }
+  }
+  if (args.workspaceMode !== undefined && normalizeWorkspaceMode(args.workspaceMode) === 'native') {
+    inferred.push(TASK_CAPABILITIES.WORKSPACE_NATIVE)
+  }
+  return normalizeTaskCapabilityRequirements([...explicit, ...inferred])
+}
+
 function requiredChatGptProvider(args: CliArgs) {
-  if (args.provider !== undefined && normalizeProvider(args.provider) !== 'chatgpt') {
+  const legacyProvider = requireLegacyChatGptProviderId()
+  if (args.provider !== undefined && normalizeProvider(args.provider) !== legacyProvider) {
     throw usageError('chatgpt_controls_unsupported', 'ChatGPT controls require --provider chatgpt or no provider argument.')
   }
-  return 'chatgpt'
+  return legacyProvider
 }
 
 function assertProviderConfigureArguments(args: CliArgs, command: string) {
@@ -3426,13 +5005,16 @@ function assertProviderConfigureArguments(args: CliArgs, command: string) {
     args.modelFallbacks === undefined &&
     args.effort === undefined &&
     args.thinkingEffort === undefined &&
+    args.deepSeekMode === undefined &&
+    args.deepSeekDeepThink === undefined &&
+    args.deepSeekSearch === undefined &&
     args.chatSurface === undefined
   ) {
     throw usageError(
       command === 'chatgpt-configure' ? 'missing_chatgpt_control' : 'missing_provider_control',
       `${command} requires --model${command === 'chatgpt-configure'
         ? ', --effort, or --chat-surface chat'
-        : ' or --effort'}.`
+        : ', --effort, or a DeepSeek control'}.`
     )
   }
 }
@@ -3441,13 +5023,21 @@ function resolveProviderControls({
   args,
   provider,
   action,
+  requirements,
 }: {
   args: CliArgs
   provider: string
   action: string
+  requirements: readonly TaskCapabilityId[]
 }) {
   const hasRequestedModelControl = args.model !== undefined || args.modelFallbacks !== undefined
   const hasRequestedEffortControl = args.effort !== undefined || args.thinkingEffort !== undefined
+  const hasRequestedQwenMode = args.qwenMode !== undefined || args.qwenModeVariant !== undefined
+  const hasRequestedDeepSeekControl = (
+    args.deepSeekMode !== undefined ||
+    args.deepSeekDeepThink !== undefined ||
+    args.deepSeekSearch !== undefined
+  )
   const hasRequestedChatGptControl = (
     args.chatSurface !== undefined
   )
@@ -3456,18 +5046,30 @@ function resolveProviderControls({
     action === 'inspect_controls' ||
     action === 'inspect_chatgpt_controls'
   )
-  if (inspectionAction && (hasRequestedModelControl || hasRequestedEffortControl || hasRequestedChatGptControl)) {
+  if (inspectionAction && (hasRequestedModelControl || hasRequestedEffortControl || hasRequestedQwenMode || hasRequestedDeepSeekControl || hasRequestedChatGptControl)) {
     throw usageError(
       'controls_unsupported_for_action',
       'Control selection options are not accepted by provider-controls or chatgpt-controls; use a configure command.'
     )
   }
-  if (provider !== 'chatgpt' && hasRequestedChatGptControl) {
+  if (!providerSupportsChatSurface(provider) && hasRequestedChatGptControl) {
     throw usageError(
       'chatgpt_controls_unsupported',
       '--chat-surface is available only for ChatGPT.'
     )
   }
+  if (provider !== 'qwen' && hasRequestedQwenMode) {
+    throw usageError(
+      'qwen_mode_unsupported',
+      '--qwen-mode and --qwen-mode-variant are available only for the Qwen provider.'
+    )
+  }
+  if (provider !== 'deepseek' && hasRequestedDeepSeekControl) {
+    throw usageError(
+      'deepseek_control_unsupported',
+      '--deepseek-mode, --deepseek-deepthink, and --deepseek-search are available only for the DeepSeek provider.'
+    )
+  }
   if (inspectionAction) return {}
 
   const model = args.model === undefined
@@ -3485,8 +5087,74 @@ function resolveProviderControls({
     ? undefined
     : normalizeVisibleModelLabel(effortValue, '--effort', 'invalid_effort')
 
-  if (provider !== 'chatgpt') {
-    return { model, modelFallbacks, effort }
+  const qwenMode = args.qwenMode === undefined
+    ? undefined
+    : normalizeVisibleModelLabel(args.qwenMode, '--qwen-mode', 'invalid_qwen_mode')
+  const qwenModeVariant = args.qwenModeVariant === undefined
+    ? undefined
+    : normalizeVisibleModelLabel(args.qwenModeVariant, '--qwen-mode-variant', 'invalid_qwen_mode_variant')
+  if (qwenModeVariant !== undefined && qwenMode === undefined) {
+    throw usageError('qwen_mode_variant_requires_mode', '--qwen-mode-variant requires --qwen-mode.')
+  }
+
+  const requestedCapabilities = new Set(requirements)
+  const requiresDeepSeekSearch = provider === 'deepseek' && requestedCapabilities.has(TASK_CAPABILITIES.SEARCH_WEB)
+  const requiresDeepSeekVision = provider === 'deepseek' && requestedCapabilities.has(TASK_CAPABILITIES.IMAGE_INPUT)
+  const requiresDeepSeekReasoning = provider === 'deepseek' && requestedCapabilities.has(TASK_CAPABILITIES.REASONING_EXTENDED)
+  if (requiresDeepSeekSearch && requiresDeepSeekVision) {
+    throw usageError(
+      'deepseek_capability_combination_unavailable',
+      'DeepSeek search.web requires Instant while image.input requires Vision; one run cannot require both.',
+    )
+  }
+  const inferredDeepSeekMode = provider !== 'deepseek'
+    ? undefined
+    : requiresDeepSeekSearch
+      ? 'Instant' as const
+      : requiresDeepSeekVision
+        ? 'Vision' as const
+        : args.attachFiles.length > 0
+          ? 'Instant' as const
+          : undefined
+  const deepSeekMode = args.deepSeekMode === undefined
+    ? inferredDeepSeekMode
+    : normalizeDeepSeekMode(args.deepSeekMode)
+  const deepSeekDeepThink = args.deepSeekDeepThink === undefined
+    ? (requiresDeepSeekReasoning ? true : undefined)
+    : normalizeDeepSeekToggle(args.deepSeekDeepThink, '--deepseek-deepthink')
+  const deepSeekSearch = args.deepSeekSearch === undefined
+    ? (requiresDeepSeekSearch ? true : undefined)
+    : normalizeDeepSeekToggle(args.deepSeekSearch, '--deepseek-search')
+  if (requiresDeepSeekVision && deepSeekMode !== 'Vision') {
+    throw usageError('deepseek_image_requires_vision', 'DeepSeek image.input requires Vision mode.')
+  }
+  if (requiresDeepSeekSearch && deepSeekSearch !== true) {
+    throw usageError('deepseek_search_required', 'DeepSeek search.web requires Search to remain enabled.')
+  }
+  if (requiresDeepSeekReasoning && deepSeekDeepThink !== true) {
+    throw usageError('deepseek_deepthink_required', 'DeepSeek reasoning.extended requires DeepThink to remain enabled.')
+  }
+  if (provider === 'deepseek' && deepSeekSearch !== undefined && deepSeekMode === undefined) {
+    throw usageError('deepseek_search_requires_instant', '--deepseek-search requires --deepseek-mode Instant or a search.web capability route.')
+  }
+  if (provider === 'deepseek' && deepSeekSearch !== undefined && deepSeekMode !== 'Instant') {
+    throw usageError('deepseek_search_requires_instant', 'DeepSeek Search is available only in Instant mode.')
+  }
+  if (provider === 'deepseek' && args.attachFiles.length > 0 && deepSeekMode === 'Expert') {
+    throw usageError('deepseek_file_unavailable_in_expert', 'DeepSeek file upload is unavailable in Expert mode; use Instant or Vision.')
+  }
+
+  if (!providerSupportsChatSurface(provider)) {
+    return {
+      model,
+      modelFallbacks,
+      effort,
+      qwenMode,
+      qwenModeVariant,
+      deepSeekMode,
+      deepSeekDeepThink,
+      deepSeekSearch,
+    }
   }
 
   const chatSurface = args.chatSurface === undefined ? 'chat' : String(args.chatSurface).trim().toLowerCase()
@@ -3501,6 +5169,65 @@ function resolveProviderControls({
   }
 }
 
+function qwenModeSelectionPayload(args: CliArgs) {
+  const mode = normalizeVisibleModelLabel(args.qwenMode, '--qwen-mode', 'invalid_qwen_mode')
+  const variant = args.qwenModeVariant === undefined
+    ? undefined
+    : normalizeVisibleModelLabel(args.qwenModeVariant, '--qwen-mode-variant', 'invalid_qwen_mode_variant')
+  return {
+    mode,
+    ...(variant === undefined ? {} : { variant }),
+  }
+}
+
+function normalizeDeepSeekMode(value: unknown) {
+  const normalized = String(value).trim().toLowerCase()
+  if (normalized === 'instant') return 'Instant' as const
+  if (normalized === 'expert') return 'Expert' as const
+  if (normalized === 'vision') return 'Vision' as const
+  throw usageError('invalid_deepseek_mode', '--deepseek-mode must be Instant, Expert, or Vision.')
+}
+
+function normalizeDeepSeekToggle(value: unknown, flag: string) {
+  const normalized = String(value).trim().toLowerCase()
+  if (normalized === 'on' || normalized === 'true' || normalized === 'enabled') return true
+  if (normalized === 'off' || normalized === 'false' || normalized === 'disabled') return false
+  throw usageError('invalid_deepseek_toggle', `${flag} must be on or off.`)
+}
+
+function normalizeDoubaoMode(value: unknown) {
+  const normalized = String(value).trim().toLowerCase()
+  if (
+    normalized === 'fast' ||
+    normalized === 'expert' ||
+    normalized === 'work-task-turbo' ||
+    normalized === 'work-task-pro'
+  ) return normalized
+  throw usageError(
+    'invalid_doubao_mode',
+    '--doubao-mode must be fast, expert, work-task-turbo, or work-task-pro.',
+  )
+}
+
+function normalizeDoubaoSkill(value: unknown) {
+  const normalized = String(value).trim().toLowerCase()
+  const skills = new Set([
+    'chat',
+    'document-writing',
+    'presentation-generation',
+    'image-generation',
+    'video-generation',
+    'deep-research',
+    'audio-podcast',
+    'music-generation',
+    'problem-solving',
+    'spreadsheet-generation',
+    'audio-transcription',
+  ])
+  if (skills.has(normalized)) return normalized
+  throw usageError('invalid_doubao_skill', '--doubao-skill is not recognized.')
+}
+
 function normalizeVisibleModelLabel(value: unknown, flag: string, errorCode = 'invalid_model') {
   const normalized = String(value).trim()
   if (normalized.length === 0 || normalized.length > 120 || /[\u0000-\u001f\u007f]/u.test(normalized)) {
@@ -3509,6 +5236,42 @@ function normalizeVisibleModelLabel(value: unknown, flag: string, errorCode = 'i
   return normalized
 }
 
+function normalizeWorkspaceMode(value: unknown) {
+  const normalized = String(value).trim().toLowerCase()
+  if (normalized !== 'auto' && normalized !== 'native' && normalized !== 'conversation') {
+    throw usageError('invalid_workspace_mode', '--workspace-mode must be auto, native, or conversation.')
+  }
+  return normalized
+}
+
+async function workspaceEnsurePayloadFromArgs(args: CliArgs, modeValue: unknown) {
+  const name = args.projectName || process.env.TOKENLESS_PROJECT_NAME
+  if (typeof name !== 'string' || name.trim() === '') {
+    throw usageError('missing_workspace_name', 'workspace.ensure requires --project-name <name>.')
+  }
+  if (args.projectInstructions !== undefined && args.projectInstructionsFile !== undefined) {
+    throw usageError('duplicate_workspace_instructions', 'Use either --project-instructions or --project-instructions-file, not both.')
+  }
+  const instructions = args.projectInstructionsFile === undefined
+    ? args.projectInstructions
+    : await fs.readFile(args.projectInstructionsFile, 'utf8')
+  return {
+    name: normalizeWorkspaceText(name, '--project-name', 'invalid_workspace_name'),
+    mode: normalizeWorkspaceMode(modeValue),
+    ...(instructions === undefined
+      ? {}
+      : { instructions: normalizeWorkspaceText(instructions, '--project-instructions', 'invalid_workspace_instructions') }),
+  }
+}
+
+function normalizeWorkspaceText(value: unknown, flag: string, errorCode: string) {
+  const normalized = String(value).trim()
+  if (normalized.length === 0 || Buffer.byteLength(normalized, 'utf8') > 32 * 1024 || /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/.test(normalized)) {
+    throw usageError(errorCode, `${flag} must be nonempty text up to 32768 bytes without unsupported control characters.`)
+  }
+  return normalized
+}
+
 function normalizeVisibleModelFallbacks(value: unknown) {
   const labels = parseList(value).map((label) => normalizeVisibleModelLabel(label, '--model-fallback'))
   if (labels.length === 0 || labels.length > 8) {
@@ -3577,7 +5340,7 @@ function formatStatusEvent(event: StatusEvent) {
       event.jobId ? `job=${String(event.jobId).slice(0, 8)}` : '',
       event.elapsedMs !== undefined ? `elapsed=${formatElapsed(event.elapsedMs)}` : '',
     ].filter(Boolean).join(' ')
-    return `[tokenless] waiting_for_user ${context} User action is required; inspect the structured result for the safe resume step.`
+    return `[tokenless] waiting_for_user ${context} ${localizeText('Your help is needed: complete provider sign-in or verification in the visible browser. Tokenless will preserve this job and continue afterward.')}`
   }
   const parts = ['[tokenless]', event.event]
   for (const [key, value] of [
@@ -3602,7 +5365,7 @@ function formatStatusEvent(event: StatusEvent) {
 
 function printPayload(payload: Record<string, any>, args: CliArgs) {
   if (args.json) console.log(JSON.stringify(payload, null, 2))
-  else if (payload.compactOutput) console.log(payload.compactOutput)
+  else if (payload.compactOutput) console.log(localizeText(String(payload.compactOutput)))
   else console.log(JSON.stringify(payload, null, 2))
 }
 
@@ -3612,51 +5375,343 @@ function attachStatusLog(error: CliError, statusReporter: StatusReporter) {
   error.statusLog = statusReporter.events
 }
 
+type UsageSection = {
+  title: 'Run' | 'Setup' | 'Profile' | 'Provider' | 'Other'
+  description: string
+  commands: string[]
+}
+
 function usage() {
+  const canonicalSections: UsageSection[] = [
+    {
+      title: 'Run',
+      description: 'Send work through a visible AI provider.',
+      commands: [
+        'tokenless capabilities list --json',
+        `tokenless run --provider ${VISIBLE_PROVIDER_USAGE} --prompt <text> --json`,
+        'tokenless run --capability <capability> --prompt <text> --json',
+      ],
+    },
+    {
+      title: 'Setup',
+      description: 'Get Tokenless ready for first use.',
+      commands: [
+        'tokenless setup',
+        'tokenless dashboard',
+        'tokenless setup --fresh --json',
+      ],
+    },
+    {
+      title: 'Profile',
+      description: 'Manage browser profiles and their sign-in sessions.',
+      commands: [
+        'tokenless profiles list --json',
+        'tokenless profiles status [--profile <slug>] [--provider <provider>] --json',
+        'tokenless profiles open [--profile <slug>] [--provider <provider>] --json',
+      ],
+    },
+    {
+      title: 'Provider',
+      description: 'Manage AI providers and their visible controls.',
+      commands: [
+        `tokenless provider-status --profile <slug> --provider ${VISIBLE_PROVIDER_USAGE} --json`,
+        `tokenless limits inspect --profile <slug> --provider ${VISIBLE_PROVIDER_USAGE} --json`,
+        `tokenless provider-controls --profile <slug> --provider ${VISIBLE_PROVIDER_USAGE} --json`,
+        `tokenless provider-configure --profile <slug> --provider ${VISIBLE_PROVIDER_USAGE} [--model <exact-visible-model>] [--effort <exact-visible-effort>] --json`,
+      ],
+    },
+    {
+      title: 'Other',
+      description: 'Use miscellaneous maintenance and help commands.',
+      commands: [
+        'tokenless daemon stop [--json]',
+        'tokenless doctor --json',
+        'tokenless upgrade [--json]',
+        'tokenless help',
+      ],
+    },
+  ]
+  const advancedSections: UsageSection[] = [
+    {
+      title: 'Run',
+      description: 'Customize, inspect, resume, or cancel jobs.',
+      commands: [
+        'tokenless run --profile <slug> --provider chatgpt --project-name <agent-project> --workspace-mode <auto|native|conversation> --chat-name <agent-chat> --project-root <path> --prompt-file <file> --json',
+        `tokenless run --profile <slug> --provider ${VISIBLE_PROVIDER_USAGE} --model <exact-visible-model> --prompt <text> --json`,
+        'tokenless run --provider chatgpt --model <visible-model> --effort <instant|medium|high|extra_high|pro> --prompt <text> --json',
+        `tokenless run --provider ${VISIBLE_PROVIDER_USAGE} --attach-file <path> [--attach-file <path>] --prompt <text> --json`,
+        'tokenless run --long-running --provider chatgpt --prompt <text> --json',
+        'tokenless state --task-id <task-id> [--profile <slug>] --json',
+        'tokenless resume --job-id <job-id> --browser-visibility headed --json',
+        'tokenless cancel --job-id <job-id> --json',
+      ],
+    },
+    {
+      title: 'Setup',
+      description: 'Automate browser runtime and clean-profile setup.',
+      commands: [
+        'tokenless setup --anti-detect --profile <slug> --fresh --json',
+        'tokenless setup --profile <slug> --browser <browser> --fresh --json',
+        'tokenless setup --browser auto --defaults --json',
+      ],
+    },
+    {
+      title: 'Profile',
+      description: 'Discover metadata or manage clean browser profiles.',
+      commands: [
+        'tokenless profiles add --profile <slug> [--label <name>] [--set-default] --json',
+        'tokenless profiles discover [--browser <all|chrome|brave|edge|arc|chromium|chrome-for-testing>] [--browser-user-data-dir <dir>] --json',
+        'tokenless profiles clear (--profile <slug>|--all)',
+        'tokenless profiles set-default --profile <slug> --json',
+        'tokenless profiles remove --profile <slug> --confirm-delete --json',
+      ],
+    },
+    {
+      title: 'Provider',
+      description: 'Use low-level actions and provider-specific controls.',
+      commands: [
+        `tokenless provider-action --profile <slug> --provider ${VISIBLE_PROVIDER_USAGE} --action <${PRIORITY_VISIBLE_PROVIDER_ACTION_LIST.replace(/, /g, '|')}> [action options] --json`,
+        'tokenless chatgpt-controls --json',
+        'tokenless chatgpt-configure --model <visible-model> --effort <level> --json',
+        'tokenless snapshot-dom --provider chatgpt --json',
+      ],
+    },
+    {
+      title: 'Other',
+      description: 'Inspect or update persistent Tokenless configuration.',
+      commands: [
+        `tokenless config --language <en|zh-CN> --provider-whitelist ${supportedVisibleProviderIds().join(',')} --browser chrome --browser-visibility auto --json`,
+        'tokenless dashboard [--profile <slug>] [--no-open] --json',
+        'tokenless daemon stop --daemon-url <loopback-url> --json',
+      ],
+    },
+  ]
+
   console.error([
-    'Usage:',
-    '  tokenless run --provider chatgpt [--browser-visibility <auto|headed|headless>] --prompt <text> --json',
-    '  tokenless profiles add --profile <slug> [--label <name>] [--set-default] --json',
-    '  tokenless profiles add --profile <slug> --browser <chrome|brave> --import-browser-profile <Default|Profile 1> --preferred-providers <list> [--browser-user-data-dir <dir>] --consent-local-profile-copy [--set-default] --json',
-    '  tokenless profiles discover [--browser <chrome|brave>] [--browser-user-data-dir <dir>] --json',
-    '  tokenless profiles list --json',
-    '  tokenless profiles clear (--profile <slug>|--all)',
-    '  tokenless profiles reset [--profile <slug>] [--preferred-providers <list>]',
-    '  tokenless profiles status|open [--profile <slug>] [--provider <provider>] --json',
-    '  tokenless profiles set-default --profile <slug> --json',
-    '  tokenless profiles remove --profile <slug> --confirm-delete --json',
-    '  tokenless run --profile <slug> --provider chatgpt --project-name <agent-project> --chat-name <agent-chat> --project-root <path> --prompt-file <file> --json',
-    '  tokenless run --profile <slug> --provider <chatgpt|claude|gemini|grok> --model <exact-visible-model> --prompt <text> --json',
-    '  tokenless run --provider chatgpt --model <visible-model> --effort <instant|medium|high|extra_high|pro> --prompt <text> --json',
-    '  tokenless run --provider <chatgpt|claude|gemini|grok> --attach-file <path> [--attach-file <path>] --prompt <text> --json',
-    '  tokenless run --long-running --provider chatgpt --prompt <text> --json',
-    '  tokenless provider-action --profile <slug> --provider <chatgpt|claude|gemini|grok> --action <auth.status|model.inspect|model.select|effort.inspect|effort.select|file.upload|prompt.clear|prompt.input|prompt.submit|response.read|snapshot.sanitized|navigation.check|blocker.check> [action options] --json',
-    '  tokenless provider-status --profile <slug> --provider <chatgpt|claude|gemini|grok> --json',
-    '  tokenless provider-controls --profile <slug> --provider <chatgpt|claude|gemini|grok> --json',
-    '  tokenless provider-configure --profile <slug> --provider <chatgpt|claude|gemini|grok> [--model <exact-visible-model>] [--effort <exact-visible-effort>] --json',
-    '  tokenless chatgpt-controls --json',
-    '  tokenless chatgpt-configure --model <visible-model> --effort <level> --json',
-    '  tokenless state --task-id <task-id> [--profile <slug>] --json',
-    '  tokenless resume --job-id <job-id> --browser-visibility headed --json',
-    '  tokenless cancel --job-id <job-id> --json',
-    '  tokenless snapshot-dom --provider chatgpt --json',
-    '  tokenless config --preferred-providers chatgpt,claude,gemini,grok --browser chrome --browser-visibility auto --json',
-    '  tokenless setup',
-    '  tokenless setup --fresh --json',
-    '  tokenless setup --profile <slug> --browser <browser> (--fresh|-f|--import-browser-profile <key> --consent-local-profile-copy) --json',
-    '  tokenless setup --profile <slug> --reimport-profile --import-browser-profile <key> --consent-local-profile-copy [--refresh-skills]',
-    '  tokenless upgrade [--json]',
-    '  tokenless doctor --json',
+    formatUsageGroup('Usage', 'Canonical commands for everyday workflows.', canonicalSections),
+    '',
+    formatUsageGroup('Advanced Usage', 'Less common commands for detailed control and maintenance.', advancedSections),
+    '',
+    localizeText('Short options:'),
+    `  -P, --profile <slug>        ${localizeText('Select a managed browser profile.')}`,
+    `  -p, --provider <provider>   ${localizeText('Select an AI provider.')}`,
+    '',
+    localizeText('Command reference:'),
+    `  https://github.com/jazelly/tokenless/blob/main/${activeTokenlessLanguage() === 'zh-CN' ? 'COMMANDS.zh-CN.md' : 'COMMANDS.md'}`,
   ].join('\n'))
 }
 
+function formatUsageGroup(title: string, description: string, sections: UsageSection[]) {
+  return [
+    `${localizeText(title)}${localizeText(title) === title ? ':' : '：'}`,
+    `  ${localizeText(description)}`,
+    ...sections.flatMap((section) => [
+      '',
+      `  ${localizeText(section.title)}${localizeText(section.title) === section.title ? ':' : '：'}`,
+      `    ${localizeText(section.description)}`,
+      ...section.commands.map((command) => `    ${command}`),
+    ]),
+  ].join('\n')
+}
+
+function assertKnownTopLevelCommand(command: string) {
+  if (TOP_LEVEL_COMMANDS.has(command)) return
+  throw commandUsageError(
+    'unknown_command',
+    `Unknown Tokenless command: ${command}.`,
+    { command: 'tokenless' },
+    [],
+    [...TOP_LEVEL_COMMANDS].sort(),
+  )
+}
+
+function commandUsageError(
+  code: string,
+  message: string,
+  context: CommandContext,
+  invalidOptions: string[] = [],
+  validCommands?: string[] | undefined,
+): CliError {
+  const error = usageError(code, message)
+  error.usage = usageDetailsForContext(context, invalidOptions, validCommands)
+  error.exitCode = code === 'daemon_only' ? 1 : 2
+  return error
+}
+
+function usageDetailsForContext(
+  context: CommandContext,
+  invalidOptions: string[] = [],
+  validCommands?: string[] | undefined,
+): CliUsageDetails {
+  const contract = COMMAND_CONTRACT_BY_KEY.get(commandContractKey(context))
+  const validSubcommands = validCommands ?? (contract ? [] : validSubcommandsFor(context.command))
+  const validOptions = contract
+    ? contract.options.map(optionUsageLabel)
+    : context.command === 'tokenless'
+      ? ['-h, --help', '--json']
+      : validSubcommands.length > 0
+        ? ['-h, --help']
+        : []
+  return {
+    command: commandDisplayName(context),
+    usage: contract?.usage ?? usageForMissingContract(context),
+    commonOptions: commonOptionsFor(contract?.options ?? (context.command === 'tokenless' || validSubcommands.length > 0 ? ['help', 'json'] : ['help'])),
+    validOptions,
+    ...(invalidOptions.length === 0 ? {} : { invalidOptions }),
+    ...(validSubcommands.length === 0 ? {} : { validCommands: validSubcommands }),
+  }
+}
+
+function usageForMissingContract(context: CommandContext) {
+  const subcommands = validSubcommandsFor(context.command)
+  if (subcommands.length > 0) {
+    return COMMAND_CONTRACTS
+      .filter((contract) => contract.command === context.command && contract.subcommand)
+      .flatMap((contract) => contract.usage)
+  }
+  return TOP_LEVEL_USAGE
+}
+
+function validSubcommandsFor(command: string) {
+  return [...new Set(COMMAND_CONTRACTS
+    .filter((contract) => contract.command === command && contract.subcommand)
+    .map((contract) => contract.subcommand!))]
+    .sort()
+}
+
+function commonOptionsFor(options: readonly string[]) {
+  const common = ['help', 'json', 'home', 'quiet', 'profile', 'provider'] as const
+  return common.filter((option) => options.includes(option)).map(optionUsageLabel)
+}
+
+function optionUsageLabel(option: string) {
+  return ({
+    action: '--action <action>',
+    allProfiles: '--all',
+    attachFiles: '--attach-file <path>',
+    browser: '--browser <browser>',
+    browserExecutablePath: '--browser-executable-path <absolute-path>',
+    browsers: '--browsers <list>',
+    browserVisibility: '--browser-visibility <auto|headed|headless>',
+    capabilities: '--capability <capability>',
+    bridgeTimeoutMs: '--bridge-timeout-ms <ms>',
+    cancelTimeoutMs: '--cancel-timeout-ms <ms>',
+    chatName: '--chat-name <name>',
+    chatSurface: '--chat-surface <surface>',
+    chromeUserDataDir: '--browser-user-data-dir <dir>',
+    confirmDelete: '--confirm-delete',
+    consentLocalProfileCopy: '--consent-local-profile-copy',
+    context: '--context <text>',
+    contextFile: '--context-file <path>',
+    daemonStartTimeoutMs: '--daemon-start-timeout-ms <ms>',
+    daemonUrl: '--daemon-url <url>',
+    effort: '--effort <label>',
+    files: '--file <path>',
+    freshProfile: '--fresh',
+    help: '-h, --help',
+    home: '--home <dir>',
+    idempotencyKey: '--idempotency-key <key>',
+    importChromeProfile: '--import-browser-profile <key>',
+    json: '--json',
+    jobId: '--job-id <job-id>',
+    label: '--label <name>',
+    language: '--language <en|zh-CN>',
+    limit: '--limit <n>',
+    longRunning: '--long-running',
+    model: '--model <label>',
+    modelFallbacks: '--model-fallback <label>',
+    noOpen: '--no-open',
+    antiDetect: '--anti-detect',
+    noBrowserDownload: '--no-browser-download',
+    noWait: '--no-wait',
+    output: '--output <path>',
+    providerWhitelist: '--provider-whitelist <list>',
+    proxyServer: '--proxy-server <url>',
+    proxyBypass: '--proxy-bypass <list>',
+    clearProxy: '--clear-proxy',
+    clearBrowserExecutablePath: '--clear-browser-executable-path',
+    profile: '-P, --profile <slug>',
+    projectInstructions: '--project-instructions <text>',
+    projectInstructionsFile: '--project-instructions-file <path>',
+    projectName: '--project-name <name>',
+    projectRoot: '--project-root <path>',
+    prompt: '--prompt <text>',
+    promptFile: '--prompt-file <path>',
+    provider: '-p, --provider <provider>',
+    quiet: '--quiet',
+    repairBrowser: '--repair-browser',
+    reimportProfile: '--reimport-profile',
+    runnerHeartbeatTimeoutMs: '--runner-heartbeat-timeout-ms <ms>',
+    setDefault: '--set-default',
+    setupDefaults: '--defaults',
+    targetUrl: '--target-url <url>',
+    taskId: '--task-id <task-id>',
+    thinkingEffort: '--thinking-effort <label>',
+    timeoutMs: '--timeout-ms <ms>',
+    turnContextFile: '--turn-context-file <path>',
+    workspaceMode: '--workspace-mode <auto|native|conversation>',
+  } as Record<string, string>)[option] ?? `--${option.replace(/[A-Z]/g, (character) => `-${character.toLowerCase()}`)}`
+}
+
+function printCommandHelp(context: CommandContext) {
+  const details = usageDetailsForContext(context)
+  const optionLines = details.validOptions.filter((option) => !details.commonOptions.includes(option))
+  const lines = [
+    localizeText('Usage:'),
+    ...details.usage.map((entry) => `  ${entry}`),
+    '',
+    localizeText('Common options:'),
+    ...details.commonOptions.map((entry) => `  ${entry}`),
+  ]
+  if (optionLines.length > 0) {
+    lines.push('', localizeText('Options:'), ...optionLines.map((entry) => `  ${entry}`))
+  }
+  if (details.validCommands && details.validCommands.length > 0) {
+    lines.push('', localizeText('Valid commands:'), ...details.validCommands.map((entry) => `  ${entry}`))
+  }
+  console.error(lines.join('\n'))
+}
+
+function formatCliError(payload: Record<string, any>, usageDetails?: CliUsageDetails | undefined) {
+  const error = objectRecord(payload.error)
+  const lines = [`${localizeText('error:')} ${String(error.code || 'tokenless_cli_error')}: ${localizeText(String(error.message || 'Tokenless CLI failed.'))}`]
+  if (!usageDetails) return lines.join('\n')
+  lines.push('', localizeText('Usage:'), ...usageDetails.usage.map((entry) => `  ${entry}`), '', localizeText('Common options:'))
+  if (usageDetails.commonOptions.length > 0) {
+    lines.push(...usageDetails.commonOptions.map((entry) => `  ${entry}`))
+  } else {
+    lines.push(`  ${localizeText('(none)')}`)
+  }
+  if (usageDetails.validCommands && usageDetails.validCommands.length > 0) {
+    lines.push('', localizeText('Valid commands:'), ...usageDetails.validCommands.map((entry) => `  ${entry}`))
+  }
+  return lines.join('\n')
+}
+
 function usageError(code: string, message: string): CliError {
-  const error: CliError = new Error(message)
+  const error: CliError = new Error(localizeText(message))
   error.code = code
   error.retryable = false
   return error
 }
 
+async function initializeCliLanguage(argv: string[]) {
+  const homeFlagIndex = argv.indexOf('--home')
+  const explicitHome = homeFlagIndex >= 0 && argv[homeFlagIndex + 1] && !argv[homeFlagIndex + 1]!.startsWith('-')
+    ? argv[homeFlagIndex + 1]
+    : undefined
+  const homeDir = tokenlessHome(explicitHome)
+  try {
+    if (argv[0] === 'setup' && !await hasConfiguredTokenlessLanguage(homeDir)) {
+      setActiveLanguage(detectSystemLanguage())
+      return
+    }
+    setActiveLanguage((await readTokenlessConfig(homeDir)).language)
+  } catch {
+    setActiveLanguage('en')
+  }
+}
+
 function setupBridgeUnavailable({
   browser,
   provider,
diff --git a/packages/cli/src/upgrade.ts b/packages/cli/src/upgrade.ts
index 85eeaee..62a89a9 100644
--- a/packages/cli/src/upgrade.ts
+++ b/packages/cli/src/upgrade.ts
@@ -6,7 +6,6 @@ import path from 'node:path'
 
 import { tokenlessHome } from './job-store.js'
 import { tokenlessPackageVersion } from './platform-package.js'
-import { installTokenlessSkills } from './setup-workflow.js'
 
 type UpgradeArgs = Record<string, any> & { files?: string[]; attachFiles?: string[] }
 
@@ -37,7 +36,6 @@ type UpgradeDependencies = {
       maxOutputBytes?: number
     }
   ) => Promise<UpgradeProcessResult>
-  installSkills: () => Promise<unknown>
   onProgress?: (event: UpgradeProgressEvent) => void
   lockDir?: string
 }
@@ -82,9 +80,6 @@ export async function runUpgradeCommand(args: UpgradeArgs, dependencies?: Partia
   const homeDir = tokenlessHome(args.home)
   const deps: UpgradeDependencies = {
     runProcess: runBoundedProcess,
-    installSkills: () => installTokenlessSkills({
-      ...(process.env.TOKENLESS_SETUP_SKILL_HOME ? { home: process.env.TOKENLESS_SETUP_SKILL_HOME } : {}),
-    }),
     ...dependencies,
   }
   await fs.mkdir(homeDir, { recursive: true })
@@ -116,10 +111,6 @@ export async function runUpgradeCommand(args: UpgradeArgs, dependencies?: Partia
     result.cli.afterVersion = resolved.version
 
     emitUpgradeProgress(deps, 'skills', 'started')
-    const skills = await runSkillsRefresh(deps)
-    result.phases.skills = skills
-    emitUpgradeProgress(deps, 'skills', skills.ok ? 'succeeded' : 'failed', skills)
-
     emitUpgradeProgress(deps, 'runtimeInstall', 'started')
     const runtimeInstall = await runNewCliJsonPhase({
       deps,
@@ -128,7 +119,10 @@ export async function runUpgradeCommand(args: UpgradeArgs, dependencies?: Partia
       args,
       timeoutMs: NEW_CLI_INSTALL_TIMEOUT_MS,
     })
+    const skills = skillPhaseFromMaintenance(runtimeInstall)
+    result.phases.skills = skills
     result.phases.runtimeInstall = runtimeInstall
+    emitUpgradeProgress(deps, 'skills', skills.ok ? 'succeeded' : 'failed', skills)
     emitUpgradeProgress(deps, 'runtimeInstall', runtimeInstall.ok ? 'succeeded' : 'failed', runtimeInstall)
 
     emitUpgradeProgress(deps, 'doctor', 'started')
@@ -501,22 +495,6 @@ async function resolveVerifiedGlobalTokenless(deps: UpgradeDependencies): Promis
   }
 }
 
-async function runSkillsRefresh(deps: UpgradeDependencies): Promise<PhaseResult> {
-  try {
-    const result = await deps.installSkills()
-    return {
-      ok: true,
-      result,
-    }
-  } catch (error) {
-    return failedPhase(
-      String((error as any)?.code ?? 'tokenless_skill_refresh_failed'),
-      (error as Error).message || 'Tokenless skill refresh failed.',
-      true,
-    )
-  }
-}
-
 async function runNewCliJsonPhase({
   deps,
   entrypoint,
@@ -578,6 +556,28 @@ async function runNewCliJsonPhase({
   }
 }
 
+function skillPhaseFromMaintenance(maintenance: PhaseResult): PhaseResult {
+  if (!maintenance.ok) {
+    return failedPhase(
+      'tokenless_skill_upsert_unconfirmed',
+      'The verified new CLI maintenance command failed before global Tokenless skills could be confirmed.',
+      true,
+    )
+  }
+  const skills = maintenance.payload?.skills
+  if (!skills || skills.ok !== true || skills.upserted !== true) {
+    return failedPhase(
+      'tokenless_skill_upsert_unconfirmed',
+      'The verified new CLI maintenance result did not confirm global Tokenless skill upsert.',
+      true,
+    )
+  }
+  return {
+    ok: true,
+    result: sanitizeReportedValue(skills),
+  }
+}
+
 function forwardedMaintenanceArgs(command: 'install' | 'doctor', args: UpgradeArgs) {
   const forwarded: string[] = []
   appendValueFlag(forwarded, '--home', args.home)
diff --git a/packages/cli/src/visible-attachments.ts b/packages/cli/src/visible-attachments.ts
index b508325..d5ba76a 100644
--- a/packages/cli/src/visible-attachments.ts
+++ b/packages/cli/src/visible-attachments.ts
@@ -3,7 +3,9 @@ import fs from 'node:fs/promises'
 import { createHash, randomUUID } from 'node:crypto'
 import path from 'node:path'
 
-export const VISIBLE_ATTACHMENT_PROTOCOL = 'tokenless.visible-attachment.v1' as const
+import { VISIBLE_ATTACHMENT_SCHEMA_ID as VISIBLE_ATTACHMENT_SCHEMA_ID_VALUE } from './schema-ids.js'
+
+export const VISIBLE_ATTACHMENT_SCHEMA_ID = VISIBLE_ATTACHMENT_SCHEMA_ID_VALUE
 export const VISIBLE_ATTACHMENT_DIRECTORY = 'attachments' as const
 export const DEFAULT_MAX_VISIBLE_ATTACHMENT_BYTES = 512 * 1024 * 1024
 export const DEFAULT_VISIBLE_ATTACHMENT_ORPHAN_TTL_MS = 24 * 60 * 60 * 1000
@@ -23,7 +25,7 @@ type BigIntFileStat = {
 }
 
 export type VisibleAttachmentDescriptor = {
-  protocol: typeof VISIBLE_ATTACHMENT_PROTOCOL
+  protocol: typeof VISIBLE_ATTACHMENT_SCHEMA_ID
   bundleId: string
   attachmentId: string
   name: string
@@ -79,8 +81,8 @@ export function validateVisibleAttachmentDescriptor(value: unknown): VisibleAtta
       throw new TypeError(`Visible attachment descriptor contains unsupported field: ${key}.`)
     }
   }
-  if (descriptor.protocol !== VISIBLE_ATTACHMENT_PROTOCOL) {
-    throw new TypeError(`Visible attachment descriptor protocol must be ${VISIBLE_ATTACHMENT_PROTOCOL}.`)
+  if (descriptor.protocol !== VISIBLE_ATTACHMENT_SCHEMA_ID) {
+    throw new TypeError(`Visible attachment descriptor protocol must be ${VISIBLE_ATTACHMENT_SCHEMA_ID}.`)
   }
   const bundleId = validateSafeId(descriptor.bundleId, 'bundleId')
   const attachmentId = validateSafeId(descriptor.attachmentId, 'attachmentId')
@@ -91,7 +93,7 @@ export function validateVisibleAttachmentDescriptor(value: unknown): VisibleAtta
     throw new TypeError('Visible attachment descriptor sha256 must be 64 lowercase hexadecimal characters.')
   }
   return {
-    protocol: VISIBLE_ATTACHMENT_PROTOCOL,
+    protocol: VISIBLE_ATTACHMENT_SCHEMA_ID,
     bundleId,
     attachmentId,
     name,
@@ -178,7 +180,7 @@ export async function stageVisibleAttachment({
     await verifyOpenedDestinationIdentity({ destination, root, handle: destinationHandle, expectedSize: size })
     staged = true
     return validateVisibleAttachmentDescriptor({
-      protocol: VISIBLE_ATTACHMENT_PROTOCOL,
+      protocol: VISIBLE_ATTACHMENT_SCHEMA_ID,
       bundleId,
       attachmentId,
       name: displayName,
diff --git a/packages/cli/tsconfig.json b/packages/cli/tsconfig.json
index 32385c8..47b2b5f 100644
--- a/packages/cli/tsconfig.json
+++ b/packages/cli/tsconfig.json
@@ -6,5 +6,6 @@
     "outDir": "dist",
     "types": ["node"]
   },
-  "include": ["src/**/*.ts", "src/**/*.mts"]
+  "include": ["src/**/*.ts", "src/**/*.mts"],
+  "exclude": ["src/daemon/ui/**/*.ts"]
 }
diff --git a/packages/cli/tsconfig.ui.json b/packages/cli/tsconfig.ui.json
new file mode 100644
index 0000000..bb1daec
--- /dev/null
+++ b/packages/cli/tsconfig.ui.json
@@ -0,0 +1,18 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "composite": false,
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "lib": ["ES2023", "DOM"],
+    "types": ["svelte", "vite/client"],
+    "allowJs": true,
+    "checkJs": true,
+    "isolatedModules": true,
+    "noEmit": true,
+    "declaration": false,
+    "declarationMap": false,
+    "sourceMap": false
+  },
+  "include": ["src/daemon/ui/**/*.ts", "src/daemon/ui/**/*.svelte"]
+}
diff --git a/packages/cli/vite.ui.config.ts b/packages/cli/vite.ui.config.ts
new file mode 100644
index 0000000..e292298
--- /dev/null
+++ b/packages/cli/vite.ui.config.ts
@@ -0,0 +1,29 @@
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { svelte } from '@sveltejs/vite-plugin-svelte'
+import { defineConfig } from 'vite'
+
+const packageRoot = path.dirname(fileURLToPath(import.meta.url))
+
+export default defineConfig({
+  root: path.join(packageRoot, 'src/daemon/ui'),
+  base: '/ui/',
+  plugins: [svelte()],
+  build: {
+    target: 'es2022',
+    outDir: path.join(packageRoot, 'dist/src/daemon/ui'),
+    emptyOutDir: true,
+    cssCodeSplit: false,
+    sourcemap: false,
+    rollupOptions: {
+      output: {
+        entryFileNames: 'app.js',
+        chunkFileNames: 'chunks/[name]-[hash].js',
+        assetFileNames: (asset) => asset.names.some((name) => name.endsWith('.css'))
+          ? 'styles.css'
+          : 'assets/[name]-[hash][extname]',
+      },
+    },
+  },
+})
diff --git a/packages/daemon/.gitignore b/packages/daemon/.gitignore
deleted file mode 100644
index 2f7896d..0000000
--- a/packages/daemon/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-target/
diff --git a/packages/daemon/Cargo.lock b/packages/daemon/Cargo.lock
deleted file mode 100644
index 7294dee..0000000
--- a/packages/daemon/Cargo.lock
+++ /dev/null
@@ -1,1889 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 4
-
-[[package]]
-name = "ahash"
-version = "0.8.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
-dependencies = [
- "cfg-if",
- "once_cell",
- "version_check",
- "zerocopy",
-]
-
-[[package]]
-name = "android_system_properties"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "anstream"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
-dependencies = [
- "anstyle",
- "anstyle-parse",
- "anstyle-query",
- "anstyle-wincon",
- "colorchoice",
- "is_terminal_polyfill",
- "utf8parse",
-]
-
-[[package]]
-name = "anstyle"
-version = "1.0.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
-
-[[package]]
-name = "anstyle-parse"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
-dependencies = [
- "utf8parse",
-]
-
-[[package]]
-name = "anstyle-query"
-version = "1.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
-dependencies = [
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "anstyle-wincon"
-version = "3.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
-dependencies = [
- "anstyle",
- "once_cell_polyfill",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "async-trait"
-version = "0.1.89"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "atomic-waker"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
-
-[[package]]
-name = "autocfg"
-version = "1.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
-
-[[package]]
-name = "axum"
-version = "0.7.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edca88bc138befd0323b20752846e6587272d3b03b0343c8ea28a6f819e6e71f"
-dependencies = [
- "async-trait",
- "axum-core",
- "bytes",
- "futures-util",
- "http",
- "http-body",
- "http-body-util",
- "hyper",
- "hyper-util",
- "itoa",
- "matchit",
- "memchr",
- "mime",
- "percent-encoding",
- "pin-project-lite",
- "rustversion",
- "serde",
- "serde_json",
- "serde_path_to_error",
- "serde_urlencoded",
- "sync_wrapper",
- "tokio",
- "tower",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
-[[package]]
-name = "axum-core"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09f2bd6146b97ae3359fa0cc6d6b376d9539582c7b4220f041a33ec24c226199"
-dependencies = [
- "async-trait",
- "bytes",
- "futures-util",
- "http",
- "http-body",
- "http-body-util",
- "mime",
- "pin-project-lite",
- "rustversion",
- "sync_wrapper",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
-[[package]]
-name = "base64"
-version = "0.22.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
-
-[[package]]
-name = "bitflags"
-version = "2.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
-
-[[package]]
-name = "block-buffer"
-version = "0.10.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
-dependencies = [
- "generic-array",
-]
-
-[[package]]
-name = "bumpalo"
-version = "3.20.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
-
-[[package]]
-name = "bytes"
-version = "1.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
-
-[[package]]
-name = "cc"
-version = "1.2.66"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5d6cac793997bd970000024b2934968efe83b382de4fdcf4fcb46b6ee4ad996"
-dependencies = [
- "find-msvc-tools",
- "shlex",
-]
-
-[[package]]
-name = "cfg-if"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
-
-[[package]]
-name = "cfg_aliases"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
-
-[[package]]
-name = "chacha20"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.3.0",
- "rand_core",
-]
-
-[[package]]
-name = "chrono"
-version = "0.4.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
-dependencies = [
- "iana-time-zone",
- "num-traits",
- "windows-link",
-]
-
-[[package]]
-name = "clap"
-version = "4.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
-dependencies = [
- "clap_builder",
- "clap_derive",
-]
-
-[[package]]
-name = "clap_builder"
-version = "4.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
-dependencies = [
- "anstream",
- "anstyle",
- "clap_lex",
- "strsim",
-]
-
-[[package]]
-name = "clap_derive"
-version = "4.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "clap_lex"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
-
-[[package]]
-name = "colorchoice"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
-
-[[package]]
-name = "core-foundation-sys"
-version = "0.8.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
-
-[[package]]
-name = "cpufeatures"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "cpufeatures"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "crypto-common"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
-dependencies = [
- "generic-array",
- "typenum",
-]
-
-[[package]]
-name = "digest"
-version = "0.10.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
-dependencies = [
- "block-buffer",
- "crypto-common",
- "subtle",
-]
-
-[[package]]
-name = "displaydoc"
-version = "0.2.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "errno"
-version = "0.3.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
-dependencies = [
- "libc",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "fallible-iterator"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
-
-[[package]]
-name = "fallible-streaming-iterator"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
-
-[[package]]
-name = "fastrand"
-version = "2.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
-
-[[package]]
-name = "find-msvc-tools"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
-
-[[package]]
-name = "form_urlencoded"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
-dependencies = [
- "percent-encoding",
-]
-
-[[package]]
-name = "fs2"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9564fc758e15025b46aa6643b1b77d047d1a56a1aea6e01002ac0c7026876213"
-dependencies = [
- "libc",
- "winapi",
-]
-
-[[package]]
-name = "futures-channel"
-version = "0.3.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
-dependencies = [
- "futures-core",
-]
-
-[[package]]
-name = "futures-core"
-version = "0.3.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
-
-[[package]]
-name = "futures-task"
-version = "0.3.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
-
-[[package]]
-name = "futures-util"
-version = "0.3.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
-dependencies = [
- "futures-core",
- "futures-task",
- "pin-project-lite",
- "slab",
-]
-
-[[package]]
-name = "generic-array"
-version = "0.14.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
-dependencies = [
- "typenum",
- "version_check",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
-dependencies = [
- "cfg-if",
- "js-sys",
- "libc",
- "wasi",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
-dependencies = [
- "cfg-if",
- "js-sys",
- "libc",
- "r-efi",
- "rand_core",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.14.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
-dependencies = [
- "ahash",
-]
-
-[[package]]
-name = "hashlink"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ba4ff7128dee98c7dc9794b6a411377e1404dba1c97deb8d1a55297bd25d8af"
-dependencies = [
- "hashbrown",
-]
-
-[[package]]
-name = "heck"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
-
-[[package]]
-name = "hmac"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
-dependencies = [
- "digest",
-]
-
-[[package]]
-name = "http"
-version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
-dependencies = [
- "bytes",
- "itoa",
-]
-
-[[package]]
-name = "http-body"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
-dependencies = [
- "bytes",
- "http",
-]
-
-[[package]]
-name = "http-body-util"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
-dependencies = [
- "bytes",
- "futures-core",
- "http",
- "http-body",
- "pin-project-lite",
-]
-
-[[package]]
-name = "httparse"
-version = "1.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
-
-[[package]]
-name = "httpdate"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
-
-[[package]]
-name = "hyper"
-version = "1.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498"
-dependencies = [
- "atomic-waker",
- "bytes",
- "futures-channel",
- "futures-core",
- "http",
- "http-body",
- "httparse",
- "httpdate",
- "itoa",
- "pin-project-lite",
- "smallvec",
- "tokio",
- "want",
-]
-
-[[package]]
-name = "hyper-rustls"
-version = "0.27.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
-dependencies = [
- "http",
- "hyper",
- "hyper-util",
- "rustls",
- "tokio",
- "tokio-rustls",
- "tower-service",
- "webpki-roots",
-]
-
-[[package]]
-name = "hyper-util"
-version = "0.1.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
-dependencies = [
- "base64",
- "bytes",
- "futures-channel",
- "futures-util",
- "http",
- "http-body",
- "hyper",
- "ipnet",
- "libc",
- "percent-encoding",
- "pin-project-lite",
- "socket2",
- "tokio",
- "tower-service",
- "tracing",
-]
-
-[[package]]
-name = "iana-time-zone"
-version = "0.1.65"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
-dependencies = [
- "android_system_properties",
- "core-foundation-sys",
- "iana-time-zone-haiku",
- "js-sys",
- "log",
- "wasm-bindgen",
- "windows-core",
-]
-
-[[package]]
-name = "iana-time-zone-haiku"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "icu_collections"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
-dependencies = [
- "displaydoc",
- "potential_utf",
- "utf8_iter",
- "yoke",
- "zerofrom",
- "zerovec",
-]
-
-[[package]]
-name = "icu_locale_core"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
-dependencies = [
- "displaydoc",
- "litemap",
- "tinystr",
- "writeable",
- "zerovec",
-]
-
-[[package]]
-name = "icu_normalizer"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
-dependencies = [
- "icu_collections",
- "icu_normalizer_data",
- "icu_properties",
- "icu_provider",
- "smallvec",
- "zerovec",
-]
-
-[[package]]
-name = "icu_normalizer_data"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
-
-[[package]]
-name = "icu_properties"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
-dependencies = [
- "icu_collections",
- "icu_locale_core",
- "icu_properties_data",
- "icu_provider",
- "zerotrie",
- "zerovec",
-]
-
-[[package]]
-name = "icu_properties_data"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
-
-[[package]]
-name = "icu_provider"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
-dependencies = [
- "displaydoc",
- "icu_locale_core",
- "writeable",
- "yoke",
- "zerofrom",
- "zerotrie",
- "zerovec",
-]
-
-[[package]]
-name = "idna"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
-dependencies = [
- "idna_adapter",
- "smallvec",
- "utf8_iter",
-]
-
-[[package]]
-name = "idna_adapter"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
-dependencies = [
- "icu_normalizer",
- "icu_properties",
-]
-
-[[package]]
-name = "ipnet"
-version = "2.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
-
-[[package]]
-name = "is_terminal_polyfill"
-version = "1.70.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
-
-[[package]]
-name = "itoa"
-version = "1.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
-
-[[package]]
-name = "js-sys"
-version = "0.3.103"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102"
-dependencies = [
- "cfg-if",
- "futures-util",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "libc"
-version = "0.2.186"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
-
-[[package]]
-name = "libsqlite3-sys"
-version = "0.30.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
-dependencies = [
- "cc",
- "pkg-config",
- "vcpkg",
-]
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
-
-[[package]]
-name = "litemap"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
-
-[[package]]
-name = "log"
-version = "0.4.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
-
-[[package]]
-name = "lru-slab"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
-
-[[package]]
-name = "matchit"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
-
-[[package]]
-name = "memchr"
-version = "2.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
-
-[[package]]
-name = "mime"
-version = "0.3.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
-
-[[package]]
-name = "mio"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02bd0af71c67b473010cbbc60715ee815645a4dc942899111f494b4b737d6fda"
-dependencies = [
- "libc",
- "wasi",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "num-traits"
-version = "0.2.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.21.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
-
-[[package]]
-name = "once_cell_polyfill"
-version = "1.70.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
-
-[[package]]
-name = "percent-encoding"
-version = "2.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
-
-[[package]]
-name = "pin-project-lite"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
-
-[[package]]
-name = "pkg-config"
-version = "0.3.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
-
-[[package]]
-name = "potential_utf"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
-dependencies = [
- "zerovec",
-]
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.106"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quinn"
-version = "0.11.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c1a41e437b6bbd489372cd4971de128e85c855f56c57f283d20ff016cf7c0a8"
-dependencies = [
- "bytes",
- "cfg_aliases",
- "pin-project-lite",
- "quinn-proto",
- "quinn-udp",
- "rustc-hash",
- "rustls",
- "socket2",
- "thiserror",
- "tokio",
- "tracing",
- "web-time",
-]
-
-[[package]]
-name = "quinn-proto"
-version = "0.11.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560"
-dependencies = [
- "bytes",
- "getrandom 0.4.3",
- "lru-slab",
- "rand",
- "rand_pcg",
- "ring",
- "rustc-hash",
- "rustls",
- "rustls-pki-types",
- "slab",
- "thiserror",
- "tinyvec",
- "tracing",
- "web-time",
-]
-
-[[package]]
-name = "quinn-udp"
-version = "0.5.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35a133f956daabe89a61a685c2649f13d82d5aa4bd5d12d1277e1072a21c0694"
-dependencies = [
- "cfg_aliases",
- "libc",
- "once_cell",
- "socket2",
- "tracing",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.46"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "r-efi"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
-
-[[package]]
-name = "rand"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
-dependencies = [
- "chacha20",
- "getrandom 0.4.3",
- "rand_core",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
-
-[[package]]
-name = "rand_pcg"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
-dependencies = [
- "rand_core",
-]
-
-[[package]]
-name = "reqwest"
-version = "0.12.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
-dependencies = [
- "base64",
- "bytes",
- "futures-core",
- "http",
- "http-body",
- "http-body-util",
- "hyper",
- "hyper-rustls",
- "hyper-util",
- "js-sys",
- "log",
- "percent-encoding",
- "pin-project-lite",
- "quinn",
- "rustls",
- "rustls-pki-types",
- "serde",
- "serde_json",
- "serde_urlencoded",
- "sync_wrapper",
- "tokio",
- "tokio-rustls",
- "tower",
- "tower-http",
- "tower-service",
- "url",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "web-sys",
- "webpki-roots",
-]
-
-[[package]]
-name = "ring"
-version = "0.17.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
-dependencies = [
- "cc",
- "cfg-if",
- "getrandom 0.2.17",
- "libc",
- "untrusted",
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "rusqlite"
-version = "0.32.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7753b721174eb8ff87a9a0e799e2d7bc3749323e773db92e0984debb00019d6e"
-dependencies = [
- "bitflags",
- "fallible-iterator",
- "fallible-streaming-iterator",
- "hashlink",
- "libsqlite3-sys",
- "smallvec",
-]
-
-[[package]]
-name = "rustc-hash"
-version = "2.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
-
-[[package]]
-name = "rustix"
-version = "1.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
-dependencies = [
- "bitflags",
- "errno",
- "libc",
- "linux-raw-sys",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "rustls"
-version = "0.23.41"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f"
-dependencies = [
- "once_cell",
- "ring",
- "rustls-pki-types",
- "rustls-webpki",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "rustls-pki-types"
-version = "1.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "764899a24af3980067ee14bc143654f297b22eaebfe3c7b6b211920a5a59b046"
-dependencies = [
- "web-time",
- "zeroize",
-]
-
-[[package]]
-name = "rustls-webpki"
-version = "0.103.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
-dependencies = [
- "ring",
- "rustls-pki-types",
- "untrusted",
-]
-
-[[package]]
-name = "rustversion"
-version = "1.0.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
-
-[[package]]
-name = "ryu"
-version = "1.0.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
-
-[[package]]
-name = "serde"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
-dependencies = [
- "serde_core",
- "serde_derive",
-]
-
-[[package]]
-name = "serde_core"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "serde_json"
-version = "1.0.150"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
-dependencies = [
- "itoa",
- "memchr",
- "serde",
- "serde_core",
- "zmij",
-]
-
-[[package]]
-name = "serde_path_to_error"
-version = "0.1.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
-dependencies = [
- "itoa",
- "serde",
- "serde_core",
-]
-
-[[package]]
-name = "serde_urlencoded"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
-dependencies = [
- "form_urlencoded",
- "itoa",
- "ryu",
- "serde",
-]
-
-[[package]]
-name = "sha2"
-version = "0.10.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.2.17",
- "digest",
-]
-
-[[package]]
-name = "shlex"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
-
-[[package]]
-name = "slab"
-version = "0.4.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
-
-[[package]]
-name = "smallvec"
-version = "1.15.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
-
-[[package]]
-name = "socket2"
-version = "0.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51"
-dependencies = [
- "libc",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "stable_deref_trait"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
-
-[[package]]
-name = "strsim"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
-
-[[package]]
-name = "subtle"
-version = "2.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
-
-[[package]]
-name = "syn"
-version = "2.0.118"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "sync_wrapper"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
-dependencies = [
- "futures-core",
-]
-
-[[package]]
-name = "synstructure"
-version = "0.13.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "tempfile"
-version = "3.27.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
-dependencies = [
- "fastrand",
- "getrandom 0.4.3",
- "once_cell",
- "rustix",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "thiserror"
-version = "2.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
-dependencies = [
- "thiserror-impl",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "2.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "tinystr"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
-dependencies = [
- "displaydoc",
- "zerovec",
-]
-
-[[package]]
-name = "tinyvec"
-version = "1.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
-dependencies = [
- "tinyvec_macros",
-]
-
-[[package]]
-name = "tinyvec_macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
-
-[[package]]
-name = "tokenless-daemon"
-version = "0.3.0"
-dependencies = [
- "axum",
- "base64",
- "chrono",
- "clap",
- "fs2",
- "getrandom 0.2.17",
- "hmac",
- "libc",
- "reqwest",
- "rusqlite",
- "serde",
- "serde_json",
- "sha2",
- "tempfile",
- "tokio",
- "url",
- "uuid",
-]
-
-[[package]]
-name = "tokio"
-version = "1.52.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
-dependencies = [
- "bytes",
- "libc",
- "mio",
- "pin-project-lite",
- "socket2",
- "tokio-macros",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "tokio-macros"
-version = "2.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "tokio-rustls"
-version = "0.26.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
-dependencies = [
- "rustls",
- "tokio",
-]
-
-[[package]]
-name = "tower"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
-dependencies = [
- "futures-core",
- "futures-util",
- "pin-project-lite",
- "sync_wrapper",
- "tokio",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
-[[package]]
-name = "tower-http"
-version = "0.6.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
-dependencies = [
- "bitflags",
- "bytes",
- "futures-util",
- "http",
- "http-body",
- "pin-project-lite",
- "tower",
- "tower-layer",
- "tower-service",
- "url",
-]
-
-[[package]]
-name = "tower-layer"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
-
-[[package]]
-name = "tower-service"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
-
-[[package]]
-name = "tracing"
-version = "0.1.44"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
-dependencies = [
- "log",
- "pin-project-lite",
- "tracing-core",
-]
-
-[[package]]
-name = "tracing-core"
-version = "0.1.36"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
-dependencies = [
- "once_cell",
-]
-
-[[package]]
-name = "try-lock"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
-
-[[package]]
-name = "typenum"
-version = "1.20.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
-
-[[package]]
-name = "untrusted"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
-
-[[package]]
-name = "url"
-version = "2.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
-dependencies = [
- "form_urlencoded",
- "idna",
- "percent-encoding",
- "serde",
-]
-
-[[package]]
-name = "utf8_iter"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
-
-[[package]]
-name = "utf8parse"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
-
-[[package]]
-name = "uuid"
-version = "1.23.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf80a72845275afea99e7f2b434723d3bc7e38470fcd1c7ed39a599c73319a53"
-dependencies = [
- "getrandom 0.4.3",
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "vcpkg"
-version = "0.2.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
-
-[[package]]
-name = "version_check"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
-
-[[package]]
-name = "want"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
-dependencies = [
- "try-lock",
-]
-
-[[package]]
-name = "wasi"
-version = "0.11.1+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
-
-[[package]]
-name = "wasm-bindgen"
-version = "0.2.126"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
-dependencies = [
- "cfg-if",
- "once_cell",
- "rustversion",
- "wasm-bindgen-macro",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-futures"
-version = "0.4.76"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c62df1340f32221cb9c54d6a27b030e3dba64361d4a95bed55f9aacb44da291d"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "wasm-bindgen-macro"
-version = "0.2.126"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
-dependencies = [
- "quote",
- "wasm-bindgen-macro-support",
-]
-
-[[package]]
-name = "wasm-bindgen-macro-support"
-version = "0.2.126"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
-dependencies = [
- "bumpalo",
- "proc-macro2",
- "quote",
- "syn",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-shared"
-version = "0.2.126"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "web-sys"
-version = "0.3.103"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8622dcb61c0bcc9fffa6938bed81210af2da9a7e4a1a834b2e37a59b6dfb6141"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "web-time"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "webpki-roots"
-version = "1.0.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf85cb06032201fa7c6f829d7db5a7e5aa45bcc0655327713065f6f0576731bf"
-dependencies = [
- "rustls-pki-types",
-]
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
-
-[[package]]
-name = "windows-core"
-version = "0.62.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
-dependencies = [
- "windows-implement",
- "windows-interface",
- "windows-link",
- "windows-result",
- "windows-strings",
-]
-
-[[package]]
-name = "windows-implement"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "windows-interface"
-version = "0.59.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "windows-link"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
-
-[[package]]
-name = "windows-result"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "windows-strings"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
-dependencies = [
- "windows-targets",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.61.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
-dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_gnullvm",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
-
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
-
-[[package]]
-name = "writeable"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
-
-[[package]]
-name = "yoke"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
-dependencies = [
- "stable_deref_trait",
- "yoke-derive",
- "zerofrom",
-]
-
-[[package]]
-name = "yoke-derive"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
- "synstructure",
-]
-
-[[package]]
-name = "zerocopy"
-version = "0.8.54"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7cbbc0a705a0fd05cc3676525980d2bf5a9bc4adac6d6475209a7887cf59d19"
-dependencies = [
- "zerocopy-derive",
-]
-
-[[package]]
-name = "zerocopy-derive"
-version = "0.8.54"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2e817b7b52d0c7358d3246da9d69935ebb18116b2b102b4230dac079b4862f5"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "zerofrom"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
-dependencies = [
- "zerofrom-derive",
-]
-
-[[package]]
-name = "zerofrom-derive"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
- "synstructure",
-]
-
-[[package]]
-name = "zeroize"
-version = "1.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
-
-[[package]]
-name = "zerotrie"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
-dependencies = [
- "displaydoc",
- "yoke",
- "zerofrom",
-]
-
-[[package]]
-name = "zerovec"
-version = "0.11.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
-dependencies = [
- "yoke",
- "zerofrom",
- "zerovec-derive",
-]
-
-[[package]]
-name = "zerovec-derive"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "zmij"
-version = "1.0.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
diff --git a/packages/daemon/Cargo.toml b/packages/daemon/Cargo.toml
deleted file mode 100644
index f66d795..0000000
--- a/packages/daemon/Cargo.toml
+++ /dev/null
@@ -1,35 +0,0 @@
-[package]
-name = "tokenless-daemon"
-version = "0.3.0"
-edition = "2021"
-description = "Local Tokenless control-plane daemon foundation backed by SQLite."
-license = "MIT"
-
-[lib]
-name = "tokenless_daemon"
-path = "src/lib.rs"
-
-[[bin]]
-name = "tokenless-daemon"
-path = "src/main.rs"
-
-[dependencies]
-axum = "0.7"
-base64 = "0.22"
-chrono = { version = "0.4", default-features = false, features = ["clock", "std"] }
-clap = { version = "4.5", features = ["derive", "env"] }
-fs2 = "0.4"
-getrandom = "0.2"
-hmac = "0.12"
-libc = "0.2"
-rusqlite = { version = "0.32", features = ["bundled"] }
-serde = { version = "1", features = ["derive"] }
-serde_json = "1"
-sha2 = "0.10"
-tokio = { version = "1", features = ["macros", "net", "rt-multi-thread"] }
-tempfile = "3"
-url = "2"
-uuid = { version = "1", features = ["v4"] }
-
-[dev-dependencies]
-reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
diff --git a/packages/daemon/README.md b/packages/daemon/README.md
deleted file mode 100644
index c6c0b12..0000000
--- a/packages/daemon/README.md
+++ /dev/null
@@ -1,115 +0,0 @@
-# Tokenless Daemon
-
-This crate implements the Tokenless local control plane. It has no Node runtime dependency.
-
-The daemon state lives in SQLite at:
-
-- `$TOKENLESS_HOME/tokenless.sqlite3` when `TOKENLESS_HOME` is set
-- `--home <path>/tokenless.sqlite3` when an explicit home is passed to the CLI
-- `~/.tokenless/tokenless.sqlite3` by default
-
-The protected local control token lives next to the database at:
-
-- `$TOKENLESS_HOME/daemon.token` when `TOKENLESS_HOME` is set
-- `--home <path>/daemon.token` when an explicit home is passed to the CLI
-- `~/.tokenless/daemon.token` by default
-
-`JobStore::open` creates the token file when missing. On Unix the daemon home is
-restricted to `0700` and `daemon.token` is restricted to `0600`.
-
-The API supports creating, listing, reading, claiming, canceling, and completing
-jobs. Claims use atomic SQLite updates, rotating per-claim tokens, and renewable
-leases. Expired claims are requeued so a worker crash cannot strand a job.
-
-`claim_token` is treated as a capability. Create responses return it to the
-authenticated creator, and protected claim responses return it to the trusted
-worker. List/get/claim/complete responses expose only a token-free job view.
-
-## Local commands
-
-```sh
-cargo test --manifest-path packages/daemon/Cargo.toml
-cargo build --manifest-path packages/daemon/Cargo.toml
-```
-
-Example:
-
-```sh
-cargo run --manifest-path packages/daemon/Cargo.toml --bin tokenless-daemon -- \
-  --home /tmp/tokenless-home \
-  create --provider chatgpt --action submit_and_read --request-json '{"prompt":"hello"}'
-```
-
-Start the local HTTP daemon:
-
-```sh
-cargo run --manifest-path packages/daemon/Cargo.toml --bin tokenless-daemon -- \
-  --home /tmp/tokenless-home \
-  serve --host 127.0.0.1 --port 7331
-```
-
-The daemon binds to `127.0.0.1:7331` by default.
-It rejects non-loopback bind hosts such as `0.0.0.0` by default because the
-HTTP API is a local control plane.
-
-Available JSON endpoints:
-
-- `GET /health`
-- `GET /ready?challenge=<base64url>`
-- `POST /jobs`
-- `GET /jobs`
-- `GET /jobs/{job_id}`
-- `POST /jobs/{job_id}/claim`
-- `POST /jobs/{job_id}/complete`
-- `POST /control/jobs/claim-next`
-- `POST /control/jobs/{job_id}/cancel`
-
-`GET /health` is an unauthenticated diagnostic and must not be trusted as daemon
-identity. `GET /ready` requires a canonical unpadded base64url challenge that
-decodes to exactly 32 bytes. A valid response identifies the canonical daemon
-home, exposes `tokenless.daemon.v1`, and the binary version, and adds:
-
-```json
-{
-  "ready_proof_protocol": "tokenless.daemon-ready-proof.v1",
-  "ready_challenge": "<exact challenge>",
-  "ready_proof": "<unpadded base64url HMAC-SHA256>"
-}
-```
-
-The HMAC key is the UTF-8 daemon-token string. Missing, padded, noncanonical, or
-wrong-length challenges return `400` without a proof. Every `/jobs` and
-`/control/jobs` request requires `Authorization: Bearer <contents of daemon.token>`.
-
-`GET /jobs` accepts optional `status`, `provider`, `task_id`, and `limit` query
-parameters. Results remain newest-first and `limit` is clamped to `1..=1000`.
-
-## Protected job endpoints
-
-Every endpoint listed above except `/health` and `/ready` requires:
-
-```http
-Authorization: Bearer <contents of daemon.token>
-```
-
-Example:
-
-```sh
-TOKEN="$(tr -d '\n' < /tmp/tokenless-home/daemon.token)"
-curl -sS -X POST \
-  -H "Authorization: Bearer ${TOKEN}" \
-  "http://127.0.0.1:7331/control/jobs/claim-next?provider=chatgpt&action=submit_and_read"
-```
-
-The response is always JSON. When a queued job is claimed, the daemon returns the
-claimed job with `claim_token`. When no queued job matches, the daemon returns
-`200 OK` with `{ "job": null }`.
-
-Missing bearer auth returns `401` JSON. Invalid bearer auth returns `403` JSON.
-Cancellation accepts an empty body or `{ "reason": <structured JSON> }` and
-atomically transitions a queued, claimed, or running job to `canceled`.
-
-Security note: this remains a loopback-only local control plane. The bearer
-token protects all job data and mutations from unrelated local processes; it
-is not remote network auth and should not be copied into logs, telemetry, or
-provider sessions.
diff --git a/packages/daemon/src/config.rs b/packages/daemon/src/config.rs
deleted file mode 100644
index be87126..0000000
--- a/packages/daemon/src/config.rs
+++ /dev/null
@@ -1,305 +0,0 @@
-use crate::{DaemonError, Result};
-use fs2::FileExt;
-use serde::{Deserialize, Serialize};
-use std::fs::{self, OpenOptions};
-use std::io::Write;
-use std::path::{Path, PathBuf};
-use url::Host;
-
-pub const CONFIG_PROTOCOL: &str = "tokenless.config.v1";
-pub const CONFIG_FILE_NAME: &str = "config.json";
-
-const SUPPORTED_PROVIDERS: &[&str] = &["chatgpt", "claude", "gemini", "grok"];
-const SUPPORTED_BROWSERS: &[&str] = &[
-    "chrome",
-    "chrome-for-testing",
-    "chromium",
-    "edge",
-    "arc",
-    "brave",
-    "profile",
-];
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct TokenlessConfig {
-    pub protocol: String,
-    pub updated_at: Option<String>,
-    #[serde(default)]
-    pub preferred_providers: Vec<String>,
-    pub browser: Option<String>,
-    pub daemon_url: Option<String>,
-}
-
-impl Default for TokenlessConfig {
-    fn default() -> Self {
-        Self {
-            protocol: CONFIG_PROTOCOL.to_owned(),
-            updated_at: None,
-            preferred_providers: Vec::new(),
-            browser: None,
-            daemon_url: None,
-        }
-    }
-}
-
-#[derive(Debug, Clone, Default)]
-pub struct ConfigUpdate {
-    pub preferred_providers: Option<Vec<String>>,
-    /// `None` preserves the current value; `Some(None)` explicitly clears it.
-    pub browser: Option<Option<String>>,
-    /// `None` preserves the current value; `Some(None)` explicitly clears it.
-    pub daemon_url: Option<Option<String>>,
-}
-
-#[derive(Debug, Clone)]
-pub struct ConfigStore {
-    path: PathBuf,
-}
-
-impl ConfigStore {
-    pub fn new(home_dir: &Path) -> Self {
-        Self {
-            path: home_dir.join(CONFIG_FILE_NAME),
-        }
-    }
-
-    pub fn path(&self) -> &Path {
-        &self.path
-    }
-
-    pub fn read(&self) -> Result<TokenlessConfig> {
-        let bytes = match fs::read(&self.path) {
-            Ok(bytes) => bytes,
-            Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
-                return Ok(TokenlessConfig::default())
-            }
-            Err(error) => return Err(error.into()),
-        };
-        let mut config: TokenlessConfig = serde_json::from_slice(&bytes)?;
-        if config.protocol != CONFIG_PROTOCOL {
-            return Err(DaemonError::InvalidInput(format!(
-                "{} has unsupported config protocol {}",
-                self.path.display(),
-                config.protocol
-            )));
-        }
-        config.preferred_providers = normalize_providers(config.preferred_providers);
-        config.browser = normalize_optional_browser(config.browser)?;
-        config.daemon_url = normalize_optional_daemon_url(config.daemon_url)?;
-        Ok(config)
-    }
-
-    pub fn write(&self, update: ConfigUpdate) -> Result<TokenlessConfig> {
-        let parent = self.path.parent().ok_or_else(|| {
-            DaemonError::InvalidInput(format!("{} has no parent directory", self.path.display()))
-        })?;
-        fs::create_dir_all(parent)?;
-        let lock_path = self.path.with_extension("json.lock");
-        let mut options = OpenOptions::new();
-        options.read(true).write(true).create(true);
-        open_secure_file(&mut options);
-        let lock = options.open(&lock_path)?;
-        crate::restrict_file_permissions(&lock_path)?;
-        lock.lock_exclusive()?;
-        let current = self.read()?;
-        let config = TokenlessConfig {
-            protocol: CONFIG_PROTOCOL.to_owned(),
-            updated_at: Some(crate::now_rfc3339()),
-            preferred_providers: update
-                .preferred_providers
-                .map(normalize_providers)
-                .unwrap_or(current.preferred_providers),
-            browser: match update.browser {
-                Some(value) => normalize_optional_browser(value)?,
-                None => current.browser,
-            },
-            daemon_url: match update.daemon_url {
-                Some(value) => normalize_optional_daemon_url(value)?,
-                None => current.daemon_url,
-            },
-        };
-        write_json_atomic_secure(&self.path, &config)?;
-        Ok(config)
-    }
-}
-
-#[cfg(unix)]
-fn open_secure_file(options: &mut OpenOptions) {
-    use std::os::unix::fs::OpenOptionsExt;
-
-    options.mode(0o600);
-}
-
-#[cfg(not(unix))]
-fn open_secure_file(_options: &mut OpenOptions) {}
-
-fn normalize_providers(values: Vec<String>) -> Vec<String> {
-    let mut normalized = Vec::new();
-    for value in values {
-        let provider = value.trim().to_ascii_lowercase();
-        if SUPPORTED_PROVIDERS.contains(&provider.as_str()) && !normalized.contains(&provider) {
-            normalized.push(provider);
-        }
-    }
-    normalized
-}
-
-fn normalize_optional_browser(value: Option<String>) -> Result<Option<String>> {
-    value.map(|value| normalize_browser(&value)).transpose()
-}
-
-fn normalize_browser(value: &str) -> Result<String> {
-    let normalized = value.trim().to_ascii_lowercase().replace(['_', ' '], "-");
-    let normalized = match normalized.as_str() {
-        "google-chrome" | "googlechrome" => "chrome",
-        "chrome-testing" | "chrome-for-testing" => "chrome-for-testing",
-        "chrome-for-testing-legacy" => "chrome-for-testing",
-        "chromium-browser" => "chromium",
-        "microsoft-edge" | "msedge" => "edge",
-        "brave-browser" => "brave",
-        other => other,
-    };
-    if SUPPORTED_BROWSERS.contains(&normalized) {
-        Ok(normalized.to_owned())
-    } else {
-        Err(DaemonError::InvalidInput(format!(
-            "unsupported browser: {value}"
-        )))
-    }
-}
-
-fn normalize_optional_daemon_url(value: Option<String>) -> Result<Option<String>> {
-    value.map(|value| normalize_daemon_url(&value)).transpose()
-}
-
-fn normalize_daemon_url(value: &str) -> Result<String> {
-    let normalized = value.trim().trim_end_matches('/');
-    if normalized.len() > 2_048 {
-        return Err(DaemonError::InvalidInput(
-            "daemonUrl must not exceed 2048 bytes".to_owned(),
-        ));
-    }
-    let parsed = url::Url::parse(normalized).map_err(|error| {
-        DaemonError::InvalidInput(format!(
-            "daemonUrl must be a valid loopback HTTP URL: {error}"
-        ))
-    })?;
-    let loopback = match parsed.host() {
-        Some(Host::Domain(host)) => host.eq_ignore_ascii_case("localhost"),
-        Some(Host::Ipv4(address)) => address.is_loopback(),
-        Some(Host::Ipv6(address)) => address.is_loopback(),
-        None => false,
-    };
-    if parsed.scheme() != "http"
-        || !loopback
-        || !parsed.username().is_empty()
-        || parsed.password().is_some()
-    {
-        return Err(DaemonError::InvalidInput(
-            "daemonUrl must be an unauthenticated loopback HTTP URL".to_owned(),
-        ));
-    }
-    Ok(normalized.to_owned())
-}
-
-pub(crate) fn write_json_atomic_secure<T: Serialize>(path: &Path, value: &T) -> Result<()> {
-    let parent = path.parent().ok_or_else(|| {
-        DaemonError::InvalidInput(format!("{} has no parent directory", path.display()))
-    })?;
-    fs::create_dir_all(parent)?;
-    let mut temporary = tempfile::Builder::new()
-        .prefix(".tokenless-state-")
-        .suffix(".tmp")
-        .tempfile_in(parent)?;
-    crate::restrict_file_permissions(temporary.path())?;
-    let mut body = serde_json::to_vec_pretty(value)?;
-    body.push(b'\n');
-    temporary.write_all(&body)?;
-    temporary.as_file_mut().sync_all()?;
-    temporary
-        .persist(path)
-        .map_err(|error| DaemonError::Io(error.error))?;
-    crate::restrict_file_permissions(path)?;
-    sync_parent_directory(parent)?;
-    Ok(())
-}
-
-#[cfg(unix)]
-fn sync_parent_directory(parent: &Path) -> Result<()> {
-    fs::File::open(parent)?.sync_all()?;
-    Ok(())
-}
-
-#[cfg(not(unix))]
-fn sync_parent_directory(_parent: &Path) -> Result<()> {
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn partial_config_updates_preserve_and_normalize_fields() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = ConfigStore::new(tempdir.path());
-        let written = store
-            .write(ConfigUpdate {
-                preferred_providers: Some(vec![
-                    " Claude ".to_owned(),
-                    "chatgpt".to_owned(),
-                    "GROK".to_owned(),
-                    "claude".to_owned(),
-                    "unsupported".to_owned(),
-                ]),
-                browser: Some(Some("google-chrome".to_owned())),
-                daemon_url: Some(Some("http://127.0.0.1:7331/".to_owned())),
-            })
-            .unwrap();
-        assert_eq!(written.preferred_providers, ["claude", "chatgpt", "grok"]);
-        assert_eq!(written.browser.as_deref(), Some("chrome"));
-        assert_eq!(written.daemon_url.as_deref(), Some("http://127.0.0.1:7331"));
-
-        let updated = store
-            .write(ConfigUpdate {
-                preferred_providers: Some(vec!["gemini".to_owned(), "grok".to_owned()]),
-                ..ConfigUpdate::default()
-            })
-            .unwrap();
-        assert_eq!(updated.preferred_providers, ["gemini", "grok"]);
-        assert_eq!(updated.browser.as_deref(), Some("chrome"));
-        assert_eq!(updated.daemon_url.as_deref(), Some("http://127.0.0.1:7331"));
-    }
-
-    #[test]
-    fn config_write_is_secure_and_read_rejects_wrong_protocol() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = ConfigStore::new(tempdir.path());
-        store.write(ConfigUpdate::default()).unwrap();
-
-        #[cfg(unix)]
-        {
-            use std::os::unix::fs::PermissionsExt;
-            assert_eq!(
-                fs::metadata(store.path()).unwrap().permissions().mode() & 0o777,
-                0o600
-            );
-        }
-
-        fs::write(
-            store.path(),
-            r#"{"protocol":"tokenless.config.v999","updatedAt":null,"preferredProviders":[],"browser":null,"daemonUrl":null}"#,
-        )
-        .unwrap();
-        assert!(matches!(store.read(), Err(DaemonError::InvalidInput(_))));
-    }
-
-    #[test]
-    fn legacy_chrome_for_testing_config_is_canonicalized() {
-        assert_eq!(
-            normalize_browser("chrome-for-testing-legacy").unwrap(),
-            "chrome-for-testing"
-        );
-    }
-}
diff --git a/packages/daemon/src/lib.rs b/packages/daemon/src/lib.rs
deleted file mode 100644
index 7c623dd..0000000
--- a/packages/daemon/src/lib.rs
+++ /dev/null
@@ -1,5577 +0,0 @@
-use axum::{
-    body::Bytes,
-    extract::{
-        rejection::{JsonRejection, QueryRejection},
-        Path as AxumPath, Query, State,
-    },
-    http::{header, HeaderMap, StatusCode},
-    response::{IntoResponse, Response},
-    routing::{get, post},
-    Json, Router,
-};
-use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
-use chrono::{SecondsFormat, Utc};
-use hmac::{Hmac, Mac};
-use rusqlite::{
-    params, params_from_iter, types::Value as SqlValue, Connection, OptionalExtension,
-    TransactionBehavior,
-};
-use serde::{Deserialize, Serialize};
-use serde_json::{json, Value};
-use sha2::{Digest, Sha256};
-use std::env;
-use std::fmt;
-use std::fs;
-use std::fs::OpenOptions;
-use std::io::{ErrorKind, Write};
-use std::net::{IpAddr, SocketAddr};
-use std::path::{Path, PathBuf};
-use tokio::net::TcpListener;
-use uuid::Uuid;
-
-pub mod config;
-pub mod native_host;
-
-const DATABASE_FILE_NAME: &str = "tokenless.sqlite3";
-const CONTROL_TOKEN_FILE_NAME: &str = "daemon.token";
-const SECRET_TOKEN_BYTES: usize = 32;
-const SUMMARY_SCALAR_CHARS: usize = 256;
-const PROFILE_ID_CHARS: usize = 128;
-pub const DAEMON_PROTOCOL: &str = "tokenless.daemon.v1";
-pub const DAEMON_READY_PROOF_PROTOCOL: &str = "tokenless.daemon-ready-proof.v1";
-pub const DAEMON_PROCESS_PROOF_PROTOCOL: &str = "tokenless.daemon-process-proof.v1";
-pub const NATIVE_BINARY_BUILD_INFO_PROTOCOL: &str = "tokenless.native-binary-build-info.v1";
-static DAEMON_INSTANCE_ID: std::sync::OnceLock<String> = std::sync::OnceLock::new();
-static DAEMON_SELF_SHA256: std::sync::OnceLock<String> = std::sync::OnceLock::new();
-pub const READY_CHALLENGE_BYTES: usize = 32;
-pub const READY_CHALLENGE_BASE64URL_CHARS: usize = 43;
-pub const DEFAULT_CLAIM_LEASE: std::time::Duration = std::time::Duration::from_secs(30);
-
-pub fn native_binary_build_info(binary: &str) -> Value {
-    let platform = match env::consts::OS {
-        "macos" => "darwin",
-        "windows" => "win32",
-        value => value,
-    };
-    let arch = match env::consts::ARCH {
-        "aarch64" => "arm64",
-        "x86_64" => "x64",
-        value => value,
-    };
-    json!({
-        "protocol": NATIVE_BINARY_BUILD_INFO_PROTOCOL,
-        "binary": binary,
-        "version": env!("CARGO_PKG_VERSION"),
-        "platform": platform,
-        "arch": arch,
-    })
-}
-
-#[derive(Debug)]
-pub enum DaemonError {
-    Io(std::io::Error),
-    Random(getrandom::Error),
-    Sqlite(rusqlite::Error),
-    Json(serde_json::Error),
-    MissingHome,
-    InvalidInput(String),
-    NonLoopbackBind(IpAddr),
-    InvalidStatus(String),
-    JobNotFound(String),
-    ClaimRejected(String),
-    ClaimExpired(String),
-    BridgeBusy,
-    ControlAuthMissing,
-    ControlAuthRejected,
-    InvalidJobState {
-        job_id: String,
-        expected: &'static str,
-        actual: JobStatus,
-    },
-}
-
-impl fmt::Display for DaemonError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::Io(error) => write!(f, "I/O error: {error}"),
-            Self::Random(error) => write!(f, "random token generation error: {error}"),
-            Self::Sqlite(error) => write!(f, "SQLite error: {error}"),
-            Self::Json(error) => write!(f, "JSON error: {error}"),
-            Self::MissingHome => write!(
-                f,
-                "cannot resolve Tokenless home; pass --home or set TOKENLESS_HOME/HOME"
-            ),
-            Self::InvalidInput(message) => write!(f, "invalid input: {message}"),
-            Self::NonLoopbackBind(host) => write!(
-                f,
-                "refusing to bind daemon to non-loopback host {host}; Tokenless daemon is a local control plane"
-            ),
-            Self::InvalidStatus(status) => write!(f, "invalid job status: {status}"),
-            Self::JobNotFound(job_id) => write!(f, "job not found: {job_id}"),
-            Self::ClaimRejected(job_id) => write!(f, "claim rejected for job: {job_id}"),
-            Self::ClaimExpired(job_id) => write!(f, "claim lease expired for job: {job_id}"),
-            Self::BridgeBusy => write!(f, "another extension bridge session is already active"),
-            Self::ControlAuthMissing => write!(f, "missing bearer token"),
-            Self::ControlAuthRejected => write!(f, "invalid bearer token"),
-            Self::InvalidJobState {
-                job_id,
-                expected,
-                actual,
-            } => write!(
-                f,
-                "invalid state for job {job_id}: expected {expected}, found {}",
-                actual.as_str()
-            ),
-        }
-    }
-}
-
-impl std::error::Error for DaemonError {
-    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
-        match self {
-            Self::Io(error) => Some(error),
-            Self::Sqlite(error) => Some(error),
-            Self::Json(error) => Some(error),
-            _ => None,
-        }
-    }
-}
-
-impl From<std::io::Error> for DaemonError {
-    fn from(error: std::io::Error) -> Self {
-        Self::Io(error)
-    }
-}
-
-impl From<getrandom::Error> for DaemonError {
-    fn from(error: getrandom::Error) -> Self {
-        Self::Random(error)
-    }
-}
-
-impl From<rusqlite::Error> for DaemonError {
-    fn from(error: rusqlite::Error) -> Self {
-        Self::Sqlite(error)
-    }
-}
-
-impl From<serde_json::Error> for DaemonError {
-    fn from(error: serde_json::Error) -> Self {
-        Self::Json(error)
-    }
-}
-
-pub type Result<T> = std::result::Result<T, DaemonError>;
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum JobStatus {
-    Queued,
-    Claimed,
-    Running,
-    WaitingForUser,
-    Succeeded,
-    Failed,
-    Canceled,
-    TimedOut,
-}
-
-impl JobStatus {
-    pub fn as_str(self) -> &'static str {
-        match self {
-            Self::Queued => "queued",
-            Self::Claimed => "claimed",
-            Self::Running => "running",
-            Self::WaitingForUser => "waiting_for_user",
-            Self::Succeeded => "succeeded",
-            Self::Failed => "failed",
-            Self::Canceled => "canceled",
-            Self::TimedOut => "timed_out",
-        }
-    }
-
-    fn from_db(value: String) -> Result<Self> {
-        match value.as_str() {
-            "queued" => Ok(Self::Queued),
-            "claimed" => Ok(Self::Claimed),
-            "running" => Ok(Self::Running),
-            "waiting_for_user" => Ok(Self::WaitingForUser),
-            "succeeded" => Ok(Self::Succeeded),
-            "failed" => Ok(Self::Failed),
-            "canceled" => Ok(Self::Canceled),
-            "timed_out" => Ok(Self::TimedOut),
-            _ => Err(DaemonError::InvalidStatus(value)),
-        }
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum ExecutionBackend {
-    LegacyExtension,
-    Playwright,
-}
-
-impl ExecutionBackend {
-    pub fn as_str(self) -> &'static str {
-        match self {
-            Self::LegacyExtension => "legacy_extension",
-            Self::Playwright => "playwright",
-        }
-    }
-
-    fn from_db(value: String) -> Result<Self> {
-        match value.as_str() {
-            "legacy_extension" => Ok(Self::LegacyExtension),
-            "playwright" => Ok(Self::Playwright),
-            _ => Err(DaemonError::InvalidInput(format!(
-                "invalid execution_backend: {value}"
-            ))),
-        }
-    }
-}
-
-#[derive(Debug, Clone)]
-pub struct Job {
-    pub job_id: String,
-    pub claim_token: String,
-    pub execution_backend: ExecutionBackend,
-    pub profile_id: Option<String>,
-    pub provider: String,
-    pub action: String,
-    pub status: JobStatus,
-    pub request_json: Value,
-    pub result_json: Option<Value>,
-    pub error_json: Option<Value>,
-    pub blocker_json: Option<Value>,
-    pub checkpoint_json: Option<Value>,
-    pub resume_json: Option<Value>,
-    pub created_at: String,
-    pub updated_at: String,
-    pub claim_expires_at_ms: Option<i64>,
-}
-
-impl Job {
-    pub fn public_view(&self) -> JobView {
-        JobView {
-            job_id: self.job_id.clone(),
-            execution_backend: self.execution_backend,
-            profile_id: self.profile_id.clone(),
-            provider: self.provider.clone(),
-            action: self.action.clone(),
-            status: self.status,
-            request_json: self.request_json.clone(),
-            result_json: self.result_json.clone(),
-            error_json: self.error_json.clone(),
-            blocker_json: self.blocker_json.clone(),
-            created_at: self.created_at.clone(),
-            updated_at: self.updated_at.clone(),
-        }
-    }
-
-    pub fn with_claim_token(&self) -> JobWithClaimToken {
-        JobWithClaimToken {
-            job_id: self.job_id.clone(),
-            claim_token: self.claim_token.clone(),
-            execution_backend: self.execution_backend,
-            profile_id: self.profile_id.clone(),
-            provider: self.provider.clone(),
-            action: self.action.clone(),
-            status: self.status,
-            request_json: self.request_json.clone(),
-            result_json: self.result_json.clone(),
-            error_json: self.error_json.clone(),
-            blocker_json: self.blocker_json.clone(),
-            checkpoint_json: self.checkpoint_json.clone(),
-            resume_json: self.resume_json.clone(),
-            created_at: self.created_at.clone(),
-            updated_at: self.updated_at.clone(),
-        }
-    }
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct JobView {
-    pub job_id: String,
-    pub execution_backend: ExecutionBackend,
-    pub profile_id: Option<String>,
-    pub provider: String,
-    pub action: String,
-    pub status: JobStatus,
-    pub request_json: Value,
-    pub result_json: Option<Value>,
-    pub error_json: Option<Value>,
-    pub blocker_json: Option<Value>,
-    pub created_at: String,
-    pub updated_at: String,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct JobWithClaimToken {
-    pub job_id: String,
-    pub claim_token: String,
-    pub execution_backend: ExecutionBackend,
-    pub profile_id: Option<String>,
-    pub provider: String,
-    pub action: String,
-    pub status: JobStatus,
-    pub request_json: Value,
-    pub result_json: Option<Value>,
-    pub error_json: Option<Value>,
-    pub blocker_json: Option<Value>,
-    pub checkpoint_json: Option<Value>,
-    pub resume_json: Option<Value>,
-    pub created_at: String,
-    pub updated_at: String,
-}
-
-#[derive(Debug, Clone)]
-pub struct CreateJob {
-    pub provider: String,
-    pub action: String,
-    pub request_json: Value,
-    pub execution_backend: ExecutionBackend,
-    pub profile_id: Option<String>,
-    pub job_id: Option<String>,
-    pub claim_token: Option<String>,
-}
-
-impl CreateJob {
-    pub fn new(
-        provider: impl Into<String>,
-        action: impl Into<String>,
-        request_json: Value,
-    ) -> Self {
-        Self {
-            provider: provider.into(),
-            action: action.into(),
-            request_json,
-            execution_backend: ExecutionBackend::LegacyExtension,
-            profile_id: None,
-            job_id: None,
-            claim_token: None,
-        }
-    }
-}
-
-#[derive(Debug, Clone)]
-pub enum CompleteJob {
-    Succeeded { result_json: Value },
-    Failed { error_json: Value },
-}
-
-#[derive(Debug, Clone)]
-pub struct UserBlocker {
-    pub blocker_json: Value,
-}
-
-#[derive(Debug, Clone)]
-pub struct JobCheckpoint {
-    pub checkpoint_json: Value,
-}
-
-#[derive(Debug, Clone)]
-pub struct ParkJob {
-    pub blocker_json: Value,
-    pub checkpoint_json: Value,
-}
-
-#[derive(Debug, Clone)]
-pub struct ResumeJob {
-    pub resume_json: Value,
-}
-
-#[derive(Debug, Clone, Default)]
-pub struct ListJobs {
-    pub status: Option<JobStatus>,
-    pub execution_backend: Option<ExecutionBackend>,
-    pub profile_id: Option<String>,
-    pub provider: Option<String>,
-    pub task_id: Option<String>,
-    pub limit: Option<usize>,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct JobSummary {
-    pub job_id: String,
-    pub execution_backend: ExecutionBackend,
-    pub profile_id: Option<String>,
-    pub provider: String,
-    pub action: String,
-    pub status: JobStatus,
-    pub created_at: String,
-    pub updated_at: String,
-    pub task_id: Option<String>,
-    pub project_name: Option<String>,
-    pub chat_name: Option<String>,
-    pub idempotency_key: Option<String>,
-}
-
-#[derive(Debug, Clone, Default)]
-struct RequestSummaryMetadata {
-    task_id: Option<String>,
-    project_name: Option<String>,
-    chat_name: Option<String>,
-    idempotency_key: Option<String>,
-    task_keys: Vec<String>,
-}
-
-impl RequestSummaryMetadata {
-    fn from_request(request: &Value) -> Self {
-        let request_object = request.as_object();
-        let metadata_object = request_object
-            .and_then(|object| object.get("metadata"))
-            .and_then(Value::as_object);
-        let request_value = |key: &str| {
-            request_object
-                .and_then(|object| object.get(key))
-                .and_then(Value::as_str)
-                .and_then(bounded_nonempty_summary_value)
-        };
-        let metadata_value = |key: &str| {
-            metadata_object
-                .and_then(|object| object.get(key))
-                .and_then(Value::as_str)
-                .and_then(bounded_nonempty_summary_value)
-        };
-
-        let request_task_id = request_value("taskId");
-        let request_idempotency_key = request_value("idempotencyKey");
-        let request_id = request_value("requestId");
-        let metadata_task_id = metadata_value("taskId");
-        let metadata_idempotency_key = metadata_value("idempotencyKey");
-        let mut task_keys = Vec::new();
-        for key in [
-            request_task_id.as_ref(),
-            request_idempotency_key.as_ref(),
-            request_id.as_ref(),
-            metadata_task_id.as_ref(),
-            metadata_idempotency_key.as_ref(),
-        ]
-        .into_iter()
-        .flatten()
-        {
-            if !task_keys.contains(key) {
-                task_keys.push(key.clone());
-            }
-        }
-
-        Self {
-            task_id: metadata_task_id.clone().or_else(|| request_task_id.clone()),
-            project_name: metadata_value("projectName").or_else(|| request_value("projectName")),
-            chat_name: metadata_value("chatName").or_else(|| request_value("chatName")),
-            idempotency_key: metadata_idempotency_key.or(request_idempotency_key),
-            task_keys,
-        }
-    }
-}
-
-#[derive(Debug, Clone, Default)]
-pub struct ClaimNextJob {
-    pub provider: Option<String>,
-    pub action: Option<String>,
-}
-
-#[derive(Debug, Clone)]
-pub struct JobStore {
-    home_dir: PathBuf,
-    database_path: PathBuf,
-    control_token_path: PathBuf,
-    claim_lease_ms: i64,
-}
-
-impl JobStore {
-    pub fn open(home_dir: impl Into<PathBuf>) -> Result<Self> {
-        Self::open_with_claim_lease(home_dir, DEFAULT_CLAIM_LEASE)
-    }
-
-    pub fn open_with_claim_lease(
-        home_dir: impl Into<PathBuf>,
-        claim_lease: std::time::Duration,
-    ) -> Result<Self> {
-        let home_dir = home_dir.into();
-        ensure_tokenless_home(&home_dir)?;
-        let home_dir = fs::canonicalize(home_dir)?;
-        let database_path = home_dir.join(DATABASE_FILE_NAME);
-        let control_token_path = home_dir.join(CONTROL_TOKEN_FILE_NAME);
-        ensure_control_token(&control_token_path)?;
-        let claim_lease_ms = i64::try_from(claim_lease.as_millis())
-            .unwrap_or(i64::MAX)
-            .max(1);
-        let store = Self {
-            home_dir,
-            database_path,
-            control_token_path,
-            claim_lease_ms,
-        };
-        store.initialize()?;
-        Ok(store)
-    }
-
-    pub fn open_default() -> Result<Self> {
-        Self::open(default_home_dir()?)
-    }
-
-    pub fn home_dir(&self) -> &Path {
-        &self.home_dir
-    }
-
-    pub fn database_path(&self) -> &Path {
-        &self.database_path
-    }
-
-    pub fn control_token_path(&self) -> &Path {
-        &self.control_token_path
-    }
-
-    pub fn control_token(&self) -> Result<String> {
-        read_control_token(&self.control_token_path)
-    }
-
-    pub fn create_job(&self, input: CreateJob) -> Result<Job> {
-        let provider = normalize_nonempty(input.provider, "provider")?;
-        let action = normalize_nonempty(input.action, "action")?;
-        let (execution_backend, profile_id) =
-            validate_job_backend_profile(input.execution_backend, input.profile_id)?;
-        let job_id = input
-            .job_id
-            .map(|value| normalize_nonempty(value, "job_id"))
-            .transpose()?
-            .unwrap_or_else(|| Uuid::new_v4().to_string());
-        let claim_token = match input.claim_token {
-            Some(value) => normalize_nonempty(value, "claim_token")?,
-            None => generate_secret_token()?,
-        };
-        let now = now_rfc3339();
-        let summary = RequestSummaryMetadata::from_request(&input.request_json);
-        let request_json = serde_json::to_string(&input.request_json)?;
-        let mut conn = self.connection()?;
-        let transaction = conn.transaction_with_behavior(TransactionBehavior::Immediate)?;
-
-        transaction.execute(
-            "INSERT INTO jobs (
-                job_id, claim_token, execution_backend, profile_id,
-                provider, action, status, request_json,
-                result_json, error_json, blocker_json, created_at, updated_at,
-                summary_task_id, summary_project_name, summary_chat_name,
-                summary_idempotency_key
-            ) VALUES (
-                ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, NULL, NULL, NULL, ?9, ?9,
-                ?10, ?11, ?12, ?13
-            )",
-            params![
-                job_id,
-                claim_token,
-                execution_backend.as_str(),
-                profile_id,
-                provider,
-                action,
-                JobStatus::Queued.as_str(),
-                request_json,
-                now,
-                summary.task_id,
-                summary.project_name,
-                summary.chat_name,
-                summary.idempotency_key,
-            ],
-        )?;
-        for task_key in summary.task_keys {
-            transaction.execute(
-                "INSERT INTO job_task_keys (job_id, task_id) VALUES (?1, ?2)",
-                params![job_id, task_key],
-            )?;
-        }
-        transaction.commit()?;
-
-        self.get_job(&job_id)
-    }
-
-    pub fn list_jobs(&self, query: ListJobs) -> Result<Vec<Job>> {
-        self.requeue_expired_claims()?;
-        let execution_backend = query.execution_backend;
-        let profile_id = query
-            .profile_id
-            .map(|value| normalize_profile_id(value, "profile_id"))
-            .transpose()?;
-        validate_filter_backend_profile(execution_backend, profile_id.as_deref())?;
-        let provider = query
-            .provider
-            .map(|value| normalize_nonempty(value, "provider"))
-            .transpose()?;
-        let task_id = query
-            .task_id
-            .map(|value| normalize_summary_filter(value, "task_id"))
-            .transpose()?;
-        let conn = self.connection()?;
-        let limit = query.limit.unwrap_or(100).clamp(1, 1000) as i64;
-        let mut sql = String::from(
-            "SELECT
-                jobs.job_id, jobs.claim_token, jobs.execution_backend, jobs.profile_id,
-                jobs.provider, jobs.action, jobs.status, jobs.request_json, jobs.result_json,
-                jobs.error_json, jobs.blocker_json, jobs.checkpoint_json, jobs.resume_json,
-                jobs.created_at, jobs.updated_at, jobs.claim_expires_at
-             FROM jobs",
-        );
-        let mut parameters = Vec::new();
-        if let Some(task_id) = task_id {
-            sql.push_str(
-                " INNER JOIN job_task_keys AS matched_task
-                    ON matched_task.job_id = jobs.job_id
-                   AND matched_task.task_id = ?",
-            );
-            parameters.push(SqlValue::Text(task_id));
-        }
-        sql.push_str(" WHERE 1 = 1");
-        if let Some(status) = query.status {
-            sql.push_str(" AND jobs.status = ?");
-            parameters.push(SqlValue::Text(status.as_str().to_owned()));
-        }
-        if let Some(execution_backend) = execution_backend {
-            sql.push_str(" AND jobs.execution_backend = ?");
-            parameters.push(SqlValue::Text(execution_backend.as_str().to_owned()));
-        }
-        if let Some(profile_id) = profile_id {
-            sql.push_str(" AND jobs.profile_id = ?");
-            parameters.push(SqlValue::Text(profile_id));
-        }
-        if let Some(provider) = provider {
-            sql.push_str(" AND jobs.provider = ?");
-            parameters.push(SqlValue::Text(provider));
-        }
-        sql.push_str(" ORDER BY jobs.created_at DESC, jobs.job_id DESC LIMIT ?");
-        parameters.push(SqlValue::Integer(limit));
-        let mut stmt = conn.prepare(&sql)?;
-        let rows = stmt.query_map(params_from_iter(parameters.iter()), row_to_job)?;
-        collect_jobs(rows)
-    }
-
-    pub fn list_job_summaries(&self, limit: Option<usize>) -> Result<Vec<JobSummary>> {
-        self.requeue_expired_claims()?;
-        let conn = self.connection()?;
-        let limit = limit.unwrap_or(50).clamp(1, 60) as i64;
-        let mut stmt = conn.prepare(
-            "SELECT
-                substr(job_id, 1, 256),
-                execution_backend,
-                substr(profile_id, 1, 128),
-                substr(provider, 1, 64),
-                substr(action, 1, 128),
-                status,
-                substr(created_at, 1, 64),
-                substr(updated_at, 1, 64),
-                substr(summary_task_id, 1, 256),
-                substr(summary_project_name, 1, 256),
-                substr(summary_chat_name, 1, 256),
-                substr(summary_idempotency_key, 1, 256)
-             FROM jobs
-             ORDER BY created_at DESC, job_id DESC
-             LIMIT ?1",
-        )?;
-        let summaries = stmt
-            .query_map(params![limit], row_to_job_summary)?
-            .collect::<std::result::Result<Vec<_>, _>>()?;
-        Ok(summaries)
-    }
-
-    pub fn get_job(&self, job_id: &str) -> Result<Job> {
-        self.requeue_expired_claims()?;
-        let conn = self.connection()?;
-        get_job_with_conn(&conn, job_id)
-    }
-
-    pub fn claim_job(&self, job_id: &str, claim_token: &str) -> Result<Job> {
-        self.claim_job_at(job_id, claim_token, now_unix_millis())
-    }
-
-    fn claim_job_at(&self, job_id: &str, claim_token: &str, now_ms: i64) -> Result<Job> {
-        self.requeue_expired_claims_at(now_ms)?;
-        let now = now_rfc3339();
-        let expires_at = now_ms.saturating_add(self.claim_lease_ms);
-        let conn = self.connection()?;
-        let affected = conn.execute(
-            "UPDATE jobs
-             SET status = ?1, updated_at = ?2, claim_expires_at = ?3
-             WHERE job_id = ?4 AND claim_token = ?5 AND status = ?6",
-            params![
-                JobStatus::Claimed.as_str(),
-                now,
-                expires_at,
-                job_id,
-                claim_token,
-                JobStatus::Queued.as_str()
-            ],
-        )?;
-
-        if affected == 1 {
-            return get_job_with_conn(&conn, job_id);
-        }
-
-        explain_claim_failure(&conn, job_id, claim_token)
-    }
-
-    pub fn claim_next_job(&self, query: ClaimNextJob) -> Result<Option<Job>> {
-        self.claim_next_job_at(query, now_unix_millis())
-    }
-
-    fn claim_next_job_at(&self, query: ClaimNextJob, now_ms: i64) -> Result<Option<Job>> {
-        self.claim_next_job_with_scope_at(query, ExecutionBackend::LegacyExtension, None, now_ms)
-    }
-
-    pub fn claim_next_job_with_scope(
-        &self,
-        query: ClaimNextJob,
-        execution_backend: ExecutionBackend,
-        profile_id: Option<String>,
-    ) -> Result<Option<Job>> {
-        self.claim_next_job_with_scope_at(query, execution_backend, profile_id, now_unix_millis())
-    }
-
-    fn claim_next_job_with_scope_at(
-        &self,
-        query: ClaimNextJob,
-        execution_backend: ExecutionBackend,
-        profile_id: Option<String>,
-        now_ms: i64,
-    ) -> Result<Option<Job>> {
-        let profile_id = profile_id
-            .map(|value| normalize_profile_id(value, "profile_id"))
-            .transpose()?;
-        validate_claim_backend_profile(execution_backend, profile_id.as_deref())?;
-        let provider = query
-            .provider
-            .map(|value| normalize_nonempty(value, "provider"))
-            .transpose()?;
-        let action = query
-            .action
-            .map(|value| normalize_nonempty(value, "action"))
-            .transpose()?;
-        self.requeue_expired_claims_at(now_ms)?;
-        let now = now_rfc3339();
-        let expires_at = now_ms.saturating_add(self.claim_lease_ms);
-        let next_claim_token = generate_secret_token()?;
-        let conn = self.connection()?;
-        let mut stmt = conn.prepare(
-            "UPDATE jobs
-             SET status = ?1, updated_at = ?2, claim_expires_at = ?3, claim_token = ?4
-             WHERE job_id = (
-                SELECT job_id
-                FROM jobs
-                WHERE status = ?5
-                  AND execution_backend = ?6
-                  AND ((?7 IS NULL AND profile_id IS NULL) OR profile_id = ?7)
-                  AND (?8 IS NULL OR provider = ?8)
-                  AND (?9 IS NULL OR action = ?9)
-                ORDER BY created_at ASC, job_id ASC
-                LIMIT 1
-             )
-             RETURNING
-                job_id, claim_token, execution_backend, profile_id,
-                provider, action, status, request_json, result_json, error_json,
-                blocker_json, checkpoint_json, resume_json,
-                created_at, updated_at, claim_expires_at",
-        )?;
-
-        stmt.query_row(
-            params![
-                JobStatus::Claimed.as_str(),
-                now,
-                expires_at,
-                next_claim_token,
-                JobStatus::Queued.as_str(),
-                execution_backend.as_str(),
-                profile_id.as_deref(),
-                provider.as_deref(),
-                action.as_deref(),
-            ],
-            row_to_job,
-        )
-        .optional()
-        .map_err(DaemonError::Sqlite)
-    }
-
-    pub fn renew_claim(&self, job_id: &str, claim_token: &str) -> Result<Job> {
-        self.renew_claim_at(job_id, claim_token, now_unix_millis())
-    }
-
-    fn renew_claim_at(&self, job_id: &str, claim_token: &str, now_ms: i64) -> Result<Job> {
-        let now = now_rfc3339();
-        let expires_at = now_ms.saturating_add(self.claim_lease_ms);
-        let conn = self.connection()?;
-        let affected = conn.execute(
-            "UPDATE jobs
-             SET claim_expires_at = ?1, updated_at = ?2
-             WHERE job_id = ?3
-               AND claim_token = ?4
-               AND status IN ('claimed', 'running', 'waiting_for_user')
-               AND claim_expires_at > ?5",
-            params![expires_at, now, job_id, claim_token, now_ms],
-        )?;
-        if affected == 1 {
-            return get_job_with_conn(&conn, job_id);
-        }
-        explain_active_claim_failure(&conn, job_id, claim_token, now_ms)
-    }
-
-    pub fn mark_running(&self, job_id: &str, claim_token: &str) -> Result<Job> {
-        self.mark_running_at(job_id, claim_token, now_unix_millis())
-    }
-
-    fn mark_running_at(&self, job_id: &str, claim_token: &str, now_ms: i64) -> Result<Job> {
-        let now = now_rfc3339();
-        let expires_at = now_ms.saturating_add(self.claim_lease_ms);
-        let conn = self.connection()?;
-        let affected = conn.execute(
-            "UPDATE jobs
-             SET status = ?1, blocker_json = NULL, claim_expires_at = ?2, updated_at = ?3
-             WHERE job_id = ?4
-               AND claim_token = ?5
-               AND status IN ('claimed', 'waiting_for_user')
-               AND claim_expires_at > ?6",
-            params![
-                JobStatus::Running.as_str(),
-                expires_at,
-                now,
-                job_id,
-                claim_token,
-                now_ms
-            ],
-        )?;
-        if affected == 1 {
-            return get_job_with_conn(&conn, job_id);
-        }
-        let job = get_job_with_conn(&conn, job_id)?;
-        if job.claim_token != claim_token {
-            return Err(DaemonError::ClaimRejected(job_id.to_owned()));
-        }
-        if matches!(
-            job.status,
-            JobStatus::Claimed | JobStatus::Running | JobStatus::WaitingForUser
-        ) && job
-            .claim_expires_at_ms
-            .map(|expires_at| expires_at <= now_ms)
-            .unwrap_or(true)
-        {
-            return Err(DaemonError::ClaimExpired(job_id.to_owned()));
-        }
-        Err(DaemonError::InvalidJobState {
-            job_id: job.job_id,
-            expected: "claimed or waiting_for_user",
-            actual: job.status,
-        })
-    }
-
-    pub fn mark_waiting_for_user(
-        &self,
-        job_id: &str,
-        claim_token: &str,
-        blocker: UserBlocker,
-    ) -> Result<Job> {
-        self.mark_waiting_for_user_at(job_id, claim_token, blocker, now_unix_millis())
-    }
-
-    fn mark_waiting_for_user_at(
-        &self,
-        job_id: &str,
-        claim_token: &str,
-        blocker: UserBlocker,
-        now_ms: i64,
-    ) -> Result<Job> {
-        let now = now_rfc3339();
-        let expires_at = now_ms.saturating_add(self.claim_lease_ms);
-        let blocker_json = serde_json::to_string(&blocker.blocker_json)?;
-        let conn = self.connection()?;
-        let affected = conn.execute(
-            "UPDATE jobs
-             SET status = ?1, blocker_json = ?2, claim_expires_at = ?3, updated_at = ?4
-             WHERE job_id = ?5
-               AND claim_token = ?6
-               AND status = 'running'
-               AND claim_expires_at > ?7",
-            params![
-                JobStatus::WaitingForUser.as_str(),
-                blocker_json,
-                expires_at,
-                now,
-                job_id,
-                claim_token,
-                now_ms
-            ],
-        )?;
-        if affected == 1 {
-            return get_job_with_conn(&conn, job_id);
-        }
-        explain_active_claim_failure(&conn, job_id, claim_token, now_ms)
-    }
-
-    pub fn checkpoint_job(
-        &self,
-        job_id: &str,
-        claim_token: &str,
-        checkpoint: JobCheckpoint,
-    ) -> Result<Job> {
-        self.checkpoint_job_at(job_id, claim_token, checkpoint, now_unix_millis())
-    }
-
-    fn checkpoint_job_at(
-        &self,
-        job_id: &str,
-        claim_token: &str,
-        checkpoint: JobCheckpoint,
-        now_ms: i64,
-    ) -> Result<Job> {
-        let now = now_rfc3339();
-        let checkpoint_json = serde_json::to_string(&checkpoint.checkpoint_json)?;
-        let conn = self.connection()?;
-        let affected = conn.execute(
-            "UPDATE jobs
-             SET checkpoint_json = ?1, updated_at = ?2
-             WHERE job_id = ?3
-               AND claim_token = ?4
-               AND execution_backend = 'playwright'
-               AND status IN ('claimed', 'running', 'waiting_for_user')
-               AND claim_expires_at > ?5",
-            params![checkpoint_json, now, job_id, claim_token, now_ms],
-        )?;
-        if affected == 1 {
-            return get_job_with_conn(&conn, job_id);
-        }
-        let job = get_job_with_conn(&conn, job_id)?;
-        if job.claim_token != claim_token {
-            return Err(DaemonError::ClaimRejected(job_id.to_owned()));
-        }
-        if matches!(
-            job.status,
-            JobStatus::Claimed | JobStatus::Running | JobStatus::WaitingForUser
-        ) && job
-            .claim_expires_at_ms
-            .map(|expires_at| expires_at <= now_ms)
-            .unwrap_or(true)
-        {
-            return Err(DaemonError::ClaimExpired(job_id.to_owned()));
-        }
-        if job.execution_backend != ExecutionBackend::Playwright {
-            return Err(DaemonError::InvalidInput(
-                "only playwright jobs can persist browser checkpoints".to_owned(),
-            ));
-        }
-        Err(DaemonError::InvalidJobState {
-            job_id: job.job_id,
-            expected: "claimed, running, or waiting_for_user",
-            actual: job.status,
-        })
-    }
-
-    pub fn park_job(&self, job_id: &str, claim_token: &str, park: ParkJob) -> Result<Job> {
-        self.park_job_at(job_id, claim_token, park, now_unix_millis())
-    }
-
-    fn park_job_at(
-        &self,
-        job_id: &str,
-        claim_token: &str,
-        park: ParkJob,
-        now_ms: i64,
-    ) -> Result<Job> {
-        let now = now_rfc3339();
-        let replacement_token = generate_secret_token()?;
-        let blocker_json = serde_json::to_string(&park.blocker_json)?;
-        let checkpoint_json = serde_json::to_string(&park.checkpoint_json)?;
-        let conn = self.connection()?;
-        let affected = conn.execute(
-            "UPDATE jobs
-             SET status = ?1, claim_token = ?2, blocker_json = ?3,
-                 checkpoint_json = ?4, resume_json = NULL,
-                 claim_expires_at = NULL, updated_at = ?5
-             WHERE job_id = ?6
-               AND claim_token = ?7
-               AND execution_backend = 'playwright'
-               AND status IN ('claimed', 'running', 'waiting_for_user')
-               AND claim_expires_at > ?8",
-            params![
-                JobStatus::WaitingForUser.as_str(),
-                replacement_token,
-                blocker_json,
-                checkpoint_json,
-                now,
-                job_id,
-                claim_token,
-                now_ms
-            ],
-        )?;
-        if affected == 1 {
-            return get_job_with_conn(&conn, job_id);
-        }
-        let job = get_job_with_conn(&conn, job_id)?;
-        if job.claim_token != claim_token {
-            return Err(DaemonError::ClaimRejected(job_id.to_owned()));
-        }
-        if matches!(
-            job.status,
-            JobStatus::Claimed | JobStatus::Running | JobStatus::WaitingForUser
-        ) && job
-            .claim_expires_at_ms
-            .map(|expires_at| expires_at <= now_ms)
-            .unwrap_or(true)
-        {
-            return Err(DaemonError::ClaimExpired(job_id.to_owned()));
-        }
-        if job.execution_backend != ExecutionBackend::Playwright {
-            return Err(DaemonError::InvalidInput(
-                "only playwright jobs can be parked for browser resume".to_owned(),
-            ));
-        }
-        Err(DaemonError::InvalidJobState {
-            job_id: job.job_id,
-            expected: "claimed, running, or waiting_for_user",
-            actual: job.status,
-        })
-    }
-
-    pub fn resume_job(&self, job_id: &str, resume: ResumeJob) -> Result<Job> {
-        self.resume_job_at(job_id, resume, now_unix_millis())
-    }
-
-    fn resume_job_at(&self, job_id: &str, resume: ResumeJob, now_ms: i64) -> Result<Job> {
-        self.requeue_expired_claims_at(now_ms)?;
-        let now = now_rfc3339();
-        let replacement_token = generate_secret_token()?;
-        let resume_json = serde_json::to_string(&resume.resume_json)?;
-        let mut conn = self.connection()?;
-        let transaction = conn.transaction_with_behavior(TransactionBehavior::Immediate)?;
-        let job = get_job_with_conn(&transaction, job_id)?;
-        if job.execution_backend != ExecutionBackend::Playwright {
-            return Err(DaemonError::InvalidInput(
-                "only playwright jobs can be resumed with browser visibility".to_owned(),
-            ));
-        }
-        if matches!(
-            job.status,
-            JobStatus::Queued | JobStatus::Claimed | JobStatus::Running
-        ) && job.resume_json.is_some()
-        {
-            transaction.commit()?;
-            return Ok(job);
-        }
-        if job.status != JobStatus::WaitingForUser
-            || job.checkpoint_json.is_none()
-            || job.claim_expires_at_ms.is_some()
-        {
-            return Err(DaemonError::InvalidJobState {
-                job_id: job.job_id,
-                expected: "parked playwright waiting_for_user",
-                actual: job.status,
-            });
-        }
-        let affected = transaction.execute(
-            "UPDATE jobs
-             SET status = 'queued', claim_token = ?1, resume_json = ?2,
-                 claim_expires_at = NULL, updated_at = ?3
-             WHERE job_id = ?4
-               AND execution_backend = 'playwright'
-               AND status = 'waiting_for_user'
-               AND checkpoint_json IS NOT NULL
-               AND claim_expires_at IS NULL",
-            params![replacement_token, resume_json, now, job_id],
-        )?;
-        if affected != 1 {
-            return Err(DaemonError::InvalidJobState {
-                job_id: job_id.to_owned(),
-                expected: "parked playwright waiting_for_user",
-                actual: job.status,
-            });
-        }
-        let resumed = get_job_with_conn(&transaction, job_id)?;
-        transaction.commit()?;
-        Ok(resumed)
-    }
-
-    pub fn requeue_expired_claims(&self) -> Result<usize> {
-        self.requeue_expired_claims_at(now_unix_millis())
-    }
-
-    fn requeue_expired_claims_at(&self, now_ms: i64) -> Result<usize> {
-        let now = now_rfc3339();
-        let mut conn = self.connection()?;
-        self.park_expired_checkpointed_waiting_claims_at(now_ms)?;
-        self.fail_expired_waiting_claims_at(now_ms)?;
-        let has_expired = conn.query_row(
-            "SELECT EXISTS (
-                SELECT 1 FROM jobs
-                WHERE status IN ('claimed', 'running')
-                  AND (claim_expires_at IS NULL OR claim_expires_at <= ?1)
-             )",
-            params![now_ms],
-            |row| row.get::<_, bool>(0),
-        )?;
-        if !has_expired {
-            return Ok(0);
-        }
-        let transaction = conn.transaction_with_behavior(TransactionBehavior::Immediate)?;
-        let expired_job_ids = {
-            let mut stmt = transaction.prepare(
-                "SELECT job_id
-                 FROM jobs
-                 WHERE status IN ('claimed', 'running')
-                   AND (claim_expires_at IS NULL OR claim_expires_at <= ?1)
-                 ORDER BY job_id ASC",
-            )?;
-            let rows = stmt
-                .query_map(params![now_ms], |row| row.get::<_, String>(0))?
-                .collect::<std::result::Result<Vec<_>, _>>()?;
-            rows
-        };
-        let mut requeued = 0;
-        for job_id in expired_job_ids {
-            let replacement_token = generate_secret_token()?;
-            requeued += transaction.execute(
-                "UPDATE jobs
-                 SET status = 'queued', claim_token = ?1, claim_expires_at = NULL,
-                     blocker_json = NULL, resume_json = NULL, updated_at = ?2
-                 WHERE job_id = ?3
-                   AND status IN ('claimed', 'running')
-                   AND (claim_expires_at IS NULL OR claim_expires_at <= ?4)",
-                params![replacement_token, now, job_id, now_ms],
-            )?;
-        }
-        transaction.commit()?;
-        Ok(requeued)
-    }
-
-    fn park_expired_checkpointed_waiting_claims_at(&self, now_ms: i64) -> Result<usize> {
-        let now = now_rfc3339();
-        let mut conn = self.connection()?;
-        let has_expired = conn.query_row(
-            "SELECT EXISTS (
-                SELECT 1 FROM jobs
-                WHERE status = 'waiting_for_user'
-                  AND execution_backend = 'playwright'
-                  AND checkpoint_json IS NOT NULL
-                  AND claim_expires_at <= ?1
-             )",
-            params![now_ms],
-            |row| row.get::<_, bool>(0),
-        )?;
-        if !has_expired {
-            return Ok(0);
-        }
-        let transaction = conn.transaction_with_behavior(TransactionBehavior::Immediate)?;
-        let expired_jobs = {
-            let mut stmt = transaction.prepare(
-                "SELECT job_id, blocker_json
-                 FROM jobs
-                 WHERE status = 'waiting_for_user'
-                   AND execution_backend = 'playwright'
-                   AND checkpoint_json IS NOT NULL
-                   AND claim_expires_at <= ?1
-                 ORDER BY job_id ASC",
-            )?;
-            let rows = stmt
-                .query_map(params![now_ms], |row| {
-                    Ok((row.get::<_, String>(0)?, row.get::<_, Option<String>>(1)?))
-                })?
-                .collect::<std::result::Result<Vec<_>, _>>()?;
-            rows
-        };
-        let mut parked = 0;
-        for (job_id, blocker_json) in expired_jobs {
-            let replacement_token = generate_secret_token()?;
-            let parked_blocker_json = serde_json::to_string(&parked_resume_blocker_json(
-                parse_optional_json(blocker_json)?,
-            ))?;
-            parked += transaction.execute(
-                "UPDATE jobs
-                 SET claim_token = ?1, blocker_json = ?2,
-                     claim_expires_at = NULL, resume_json = NULL,
-                     updated_at = ?3
-                 WHERE job_id = ?4
-                   AND status = 'waiting_for_user'
-                   AND execution_backend = 'playwright'
-                   AND checkpoint_json IS NOT NULL
-                   AND claim_expires_at <= ?5",
-                params![replacement_token, parked_blocker_json, now, job_id, now_ms],
-            )?;
-        }
-        transaction.commit()?;
-        Ok(parked)
-    }
-
-    fn fail_expired_waiting_claims_at(&self, now_ms: i64) -> Result<usize> {
-        let now = now_rfc3339();
-        let error_json = serde_json::to_string(&json!({
-            "code": "playwright_user_handover_lease_lost",
-            "message": "The managed Playwright job lost its lease while waiting for user handover; retry from the same task state instead of replaying partial page actions.",
-            "retryable": true
-        }))?;
-        let conn = self.connection()?;
-        conn.execute(
-            "UPDATE jobs
-             SET status = 'failed', error_json = ?1, result_json = NULL,
-                 blocker_json = NULL, checkpoint_json = NULL, resume_json = NULL,
-                 claim_expires_at = NULL, updated_at = ?2
-             WHERE status = 'waiting_for_user'
-               AND (execution_backend != 'playwright' OR checkpoint_json IS NULL)
-               AND (claim_expires_at IS NULL OR claim_expires_at <= ?3)",
-            params![error_json, now, now_ms],
-        )
-        .map_err(DaemonError::Sqlite)
-    }
-
-    pub fn complete_job(
-        &self,
-        job_id: &str,
-        claim_token: &str,
-        completion: CompleteJob,
-    ) -> Result<Job> {
-        self.complete_job_at(job_id, claim_token, completion, now_unix_millis())
-    }
-
-    fn complete_job_at(
-        &self,
-        job_id: &str,
-        claim_token: &str,
-        completion: CompleteJob,
-        now_ms: i64,
-    ) -> Result<Job> {
-        let now = now_rfc3339();
-        let (status, result_json, error_json) = match completion {
-            CompleteJob::Succeeded { result_json } => (
-                JobStatus::Succeeded,
-                Some(serde_json::to_string(&result_json)?),
-                None,
-            ),
-            CompleteJob::Failed { error_json } => (
-                JobStatus::Failed,
-                None,
-                Some(serde_json::to_string(&error_json)?),
-            ),
-        };
-        let conn = self.connection()?;
-        let affected = conn.execute(
-            "UPDATE jobs
-             SET status = ?1, result_json = ?2, error_json = ?3, blocker_json = NULL,
-                 checkpoint_json = NULL, resume_json = NULL,
-                 updated_at = ?4, claim_expires_at = NULL
-             WHERE job_id = ?5
-               AND claim_token = ?6
-               AND status IN ('claimed', 'running', 'waiting_for_user')
-               AND claim_expires_at > ?7",
-            params![
-                status.as_str(),
-                result_json,
-                error_json,
-                now,
-                job_id,
-                claim_token,
-                now_ms
-            ],
-        )?;
-
-        if affected == 1 {
-            return get_job_with_conn(&conn, job_id);
-        }
-
-        explain_active_claim_failure(&conn, job_id, claim_token, now_ms)
-    }
-
-    pub fn cancel_job(&self, job_id: &str, reason: Option<Value>) -> Result<Job> {
-        let now = now_rfc3339();
-        let error_json = serde_json::to_string(&match reason {
-            Some(reason) => json!({ "code": "job_canceled", "reason": reason }),
-            None => json!({ "code": "job_canceled" }),
-        })?;
-        let conn = self.connection()?;
-        let affected = conn.execute(
-            "UPDATE jobs
-             SET status = ?1, result_json = NULL, error_json = ?2, blocker_json = NULL,
-                 checkpoint_json = NULL, resume_json = NULL,
-                 updated_at = ?3, claim_expires_at = NULL
-             WHERE job_id = ?4 AND status IN ('queued', 'claimed', 'running', 'waiting_for_user')",
-            params![JobStatus::Canceled.as_str(), error_json, now, job_id],
-        )?;
-        if affected == 1 {
-            let job = get_job_with_conn(&conn, job_id)?;
-            let _ = native_host::cleanup_visible_attachment_bundles_for_request(
-                self.home_dir(),
-                &job.request_json,
-            );
-            return Ok(job);
-        }
-        let job = get_job_with_conn(&conn, job_id)?;
-        Err(DaemonError::InvalidJobState {
-            job_id: job_id.to_owned(),
-            expected: "queued, claimed, running, or waiting_for_user",
-            actual: job.status,
-        })
-    }
-
-    pub(crate) fn active_request_jsons(&self) -> Result<Vec<Value>> {
-        let conn = self.connection()?;
-        let mut statement = conn.prepare(
-            "SELECT request_json
-             FROM jobs
-             WHERE status IN ('queued', 'claimed', 'running', 'waiting_for_user')",
-        )?;
-        let requests = statement
-            .query_map([], |row| row.get::<_, String>(0))?
-            .map(|request| {
-                let request = request?;
-                serde_json::from_str(&request).map_err(to_sql_error)
-            })
-            .collect::<std::result::Result<Vec<Value>, _>>()?;
-        Ok(requests)
-    }
-
-    fn initialize(&self) -> Result<()> {
-        let mut conn = self.connection()?;
-        let had_task_keys_table = sqlite_table_exists(&conn, "job_task_keys")?;
-        conn.execute_batch(
-            "PRAGMA journal_mode = WAL;
-             PRAGMA foreign_keys = ON;
-             CREATE TABLE IF NOT EXISTS jobs (
-                job_id TEXT PRIMARY KEY NOT NULL,
-                claim_token TEXT NOT NULL,
-                execution_backend TEXT NOT NULL DEFAULT 'legacy_extension' CHECK (
-                    execution_backend IN ('legacy_extension', 'playwright')
-                ),
-                profile_id TEXT CHECK (
-                    profile_id IS NULL OR length(profile_id) BETWEEN 1 AND 128
-                ),
-                provider TEXT NOT NULL,
-                action TEXT NOT NULL,
-                status TEXT NOT NULL CHECK (
-                    status IN (
-                        'queued',
-                        'claimed',
-                        'running',
-                        'waiting_for_user',
-                        'succeeded',
-                        'failed',
-                        'canceled',
-                        'timed_out'
-                    )
-                ),
-                request_json TEXT NOT NULL,
-                result_json TEXT,
-                error_json TEXT,
-                blocker_json TEXT,
-                checkpoint_json TEXT,
-                resume_json TEXT,
-                created_at TEXT NOT NULL,
-                updated_at TEXT NOT NULL,
-                claim_expires_at INTEGER,
-                summary_task_id TEXT CHECK (
-                    summary_task_id IS NULL OR length(summary_task_id) <= 256
-                ),
-                summary_project_name TEXT CHECK (
-                    summary_project_name IS NULL OR length(summary_project_name) <= 256
-                ),
-                summary_chat_name TEXT CHECK (
-                    summary_chat_name IS NULL OR length(summary_chat_name) <= 256
-                ),
-                summary_idempotency_key TEXT CHECK (
-                    summary_idempotency_key IS NULL OR length(summary_idempotency_key) <= 256
-                )
-             );
-             CREATE TABLE IF NOT EXISTS job_task_keys (
-                job_id TEXT NOT NULL REFERENCES jobs(job_id) ON DELETE CASCADE,
-                task_id TEXT NOT NULL CHECK (length(task_id) BETWEEN 1 AND 256),
-                PRIMARY KEY (job_id, task_id)
-             );",
-        )?;
-        self.migrate_jobs_table_shape(&mut conn)?;
-        self.ensure_runtime_state_columns(&mut conn)?;
-        let needs_claim_lease_migration = !sqlite_column_exists(&conn, "jobs", "claim_expires_at")?
-            || conn.query_row(
-                "SELECT EXISTS (
-                        SELECT 1 FROM jobs
-                        WHERE status IN ('claimed', 'running', 'waiting_for_user')
-                          AND claim_expires_at IS NULL
-                     )",
-                [],
-                |row| row.get::<_, bool>(0),
-            )?;
-        if needs_claim_lease_migration {
-            let transaction = conn.transaction_with_behavior(TransactionBehavior::Immediate)?;
-            if !sqlite_column_exists(&transaction, "jobs", "claim_expires_at")? {
-                transaction.execute("ALTER TABLE jobs ADD COLUMN claim_expires_at INTEGER", [])?;
-            }
-            transaction.execute(
-                "UPDATE jobs
-                 SET status = 'queued', claim_token = lower(hex(randomblob(32))),
-                     blocker_json = NULL, resume_json = NULL, updated_at = ?1
-                 WHERE status IN ('claimed', 'running') AND claim_expires_at IS NULL",
-                params![now_rfc3339()],
-            )?;
-            transaction.execute(
-                "UPDATE jobs
-                 SET status = 'failed',
-                     error_json = ?1,
-                     result_json = NULL,
-                     blocker_json = NULL,
-                     checkpoint_json = NULL,
-                     resume_json = NULL,
-                     claim_expires_at = NULL,
-                     updated_at = ?2
-                 WHERE status = 'waiting_for_user'
-                   AND checkpoint_json IS NULL
-                   AND claim_expires_at IS NULL",
-                params![
-                    serde_json::to_string(&json!({
-                        "code": "playwright_user_handover_lease_lost",
-                        "message": "The managed Playwright job had no recoverable waiting lease after database migration.",
-                        "retryable": true
-                    }))?,
-                    now_rfc3339()
-                ],
-            )?;
-            transaction.commit()?;
-        }
-
-        let summary_columns = [
-            (
-                "summary_task_id",
-                "TEXT CHECK (summary_task_id IS NULL OR length(summary_task_id) <= 256)",
-            ),
-            (
-                "summary_project_name",
-                "TEXT CHECK (summary_project_name IS NULL OR length(summary_project_name) <= 256)",
-            ),
-            (
-                "summary_chat_name",
-                "TEXT CHECK (summary_chat_name IS NULL OR length(summary_chat_name) <= 256)",
-            ),
-            (
-                "summary_idempotency_key",
-                "TEXT CHECK (summary_idempotency_key IS NULL OR length(summary_idempotency_key) <= 256)",
-            ),
-        ];
-        let needs_summary_migration =
-            summary_columns
-                .iter()
-                .try_fold(false, |missing, (column, _)| -> Result<bool> {
-                    Ok(missing || !sqlite_column_exists(&conn, "jobs", column)?)
-                })?;
-        if needs_summary_migration || !had_task_keys_table {
-            let transaction = conn.transaction_with_behavior(TransactionBehavior::Immediate)?;
-            for (column, definition) in summary_columns {
-                if !sqlite_column_exists(&transaction, "jobs", column)? {
-                    transaction.execute(
-                        &format!("ALTER TABLE jobs ADD COLUMN {column} {definition}"),
-                        [],
-                    )?;
-                }
-            }
-            backfill_summary_metadata(&transaction)?;
-            transaction.commit()?;
-        }
-        let needs_backend_migration = !sqlite_column_exists(&conn, "jobs", "execution_backend")?
-            || !sqlite_column_exists(&conn, "jobs", "profile_id")?;
-        if needs_backend_migration {
-            let transaction = conn.transaction_with_behavior(TransactionBehavior::Immediate)?;
-            if !sqlite_column_exists(&transaction, "jobs", "execution_backend")? {
-                transaction.execute(
-                    "ALTER TABLE jobs ADD COLUMN execution_backend TEXT NOT NULL
-                        DEFAULT 'legacy_extension'
-                        CHECK (execution_backend IN ('legacy_extension', 'playwright'))",
-                    [],
-                )?;
-            }
-            if !sqlite_column_exists(&transaction, "jobs", "profile_id")? {
-                transaction.execute(
-                    "ALTER TABLE jobs ADD COLUMN profile_id TEXT
-                        CHECK (profile_id IS NULL OR length(profile_id) BETWEEN 1 AND 128)",
-                    [],
-                )?;
-            }
-            transaction.execute(
-                "UPDATE jobs
-                 SET execution_backend = 'legacy_extension', profile_id = NULL
-                 WHERE execution_backend IS NULL
-                    OR execution_backend = ''
-                    OR execution_backend = 'legacy_extension'",
-                [],
-            )?;
-            transaction.commit()?;
-        }
-        conn.execute_batch(
-            "CREATE INDEX IF NOT EXISTS jobs_status_created_at_idx
-                ON jobs(status, created_at);
-             CREATE INDEX IF NOT EXISTS jobs_provider_action_idx
-                ON jobs(provider, action);
-             CREATE INDEX IF NOT EXISTS jobs_claim_expires_at_idx
-                ON jobs(claim_expires_at);
-             CREATE INDEX IF NOT EXISTS jobs_backend_profile_status_fifo_idx
-                ON jobs(execution_backend, profile_id, status, created_at, job_id);
-             CREATE INDEX IF NOT EXISTS job_task_keys_task_id_idx
-                ON job_task_keys(task_id, job_id);",
-        )?;
-        restrict_file_permissions(&self.database_path)?;
-        Ok(())
-    }
-
-    fn ensure_runtime_state_columns(&self, conn: &mut Connection) -> Result<()> {
-        let runtime_columns = [("checkpoint_json", "TEXT"), ("resume_json", "TEXT")];
-        let needs_runtime_migration =
-            runtime_columns
-                .iter()
-                .try_fold(false, |missing, (column, _)| -> Result<bool> {
-                    Ok(missing || !sqlite_column_exists(conn, "jobs", column)?)
-                })?;
-        if !needs_runtime_migration {
-            return Ok(());
-        }
-        let transaction = conn.transaction_with_behavior(TransactionBehavior::Immediate)?;
-        for (column, definition) in runtime_columns {
-            if !sqlite_column_exists(&transaction, "jobs", column)? {
-                transaction.execute(
-                    &format!("ALTER TABLE jobs ADD COLUMN {column} {definition}"),
-                    [],
-                )?;
-            }
-        }
-        transaction.commit()?;
-        Ok(())
-    }
-
-    fn migrate_jobs_table_shape(&self, conn: &mut Connection) -> Result<()> {
-        let create_sql = conn
-            .query_row(
-                "SELECT sql FROM sqlite_schema WHERE type = 'table' AND name = 'jobs'",
-                [],
-                |row| row.get::<_, String>(0),
-            )
-            .optional()?
-            .unwrap_or_default();
-        let has_waiting_status = create_sql.contains("'waiting_for_user'");
-        let has_blocker_json = sqlite_column_exists(conn, "jobs", "blocker_json")?;
-        if has_waiting_status && has_blocker_json {
-            return Ok(());
-        }
-
-        conn.execute_batch("PRAGMA foreign_keys = OFF; PRAGMA legacy_alter_table = ON;")?;
-        let migration_result = (|| -> Result<()> {
-            let transaction = conn.transaction_with_behavior(TransactionBehavior::Immediate)?;
-            transaction.execute_batch(
-                "ALTER TABLE jobs RENAME TO jobs_old;
-                 CREATE TABLE jobs (
-                    job_id TEXT PRIMARY KEY NOT NULL,
-                    claim_token TEXT NOT NULL,
-                    execution_backend TEXT NOT NULL DEFAULT 'legacy_extension' CHECK (
-                        execution_backend IN ('legacy_extension', 'playwright')
-                    ),
-                    profile_id TEXT CHECK (
-                        profile_id IS NULL OR length(profile_id) BETWEEN 1 AND 128
-                    ),
-                    provider TEXT NOT NULL,
-                    action TEXT NOT NULL,
-                    status TEXT NOT NULL CHECK (
-                        status IN (
-                            'queued',
-                            'claimed',
-                            'running',
-                            'waiting_for_user',
-                            'succeeded',
-                            'failed',
-                            'canceled',
-                            'timed_out'
-                        )
-                    ),
-                    request_json TEXT NOT NULL,
-                    result_json TEXT,
-                    error_json TEXT,
-                    blocker_json TEXT,
-                    checkpoint_json TEXT,
-                    resume_json TEXT,
-                    created_at TEXT NOT NULL,
-                    updated_at TEXT NOT NULL,
-                    claim_expires_at INTEGER,
-                    summary_task_id TEXT CHECK (
-                        summary_task_id IS NULL OR length(summary_task_id) <= 256
-                    ),
-                    summary_project_name TEXT CHECK (
-                        summary_project_name IS NULL OR length(summary_project_name) <= 256
-                    ),
-                    summary_chat_name TEXT CHECK (
-                        summary_chat_name IS NULL OR length(summary_chat_name) <= 256
-                    ),
-                    summary_idempotency_key TEXT CHECK (
-                        summary_idempotency_key IS NULL OR length(summary_idempotency_key) <= 256
-                    )
-                 );",
-            )?;
-            let old_has_execution_backend =
-                sqlite_column_exists(&transaction, "jobs_old", "execution_backend")?;
-            let old_has_profile_id = sqlite_column_exists(&transaction, "jobs_old", "profile_id")?;
-            let old_has_claim_expires_at =
-                sqlite_column_exists(&transaction, "jobs_old", "claim_expires_at")?;
-            let old_has_blocker_json =
-                sqlite_column_exists(&transaction, "jobs_old", "blocker_json")?;
-            let old_has_checkpoint_json =
-                sqlite_column_exists(&transaction, "jobs_old", "checkpoint_json")?;
-            let old_has_resume_json =
-                sqlite_column_exists(&transaction, "jobs_old", "resume_json")?;
-            let old_has_summary_task_id =
-                sqlite_column_exists(&transaction, "jobs_old", "summary_task_id")?;
-            let old_has_summary_project_name =
-                sqlite_column_exists(&transaction, "jobs_old", "summary_project_name")?;
-            let old_has_summary_chat_name =
-                sqlite_column_exists(&transaction, "jobs_old", "summary_chat_name")?;
-            let old_has_summary_idempotency_key =
-                sqlite_column_exists(&transaction, "jobs_old", "summary_idempotency_key")?;
-            let select_execution_backend = if old_has_execution_backend {
-                "COALESCE(NULLIF(execution_backend, ''), 'legacy_extension')"
-            } else {
-                "'legacy_extension'"
-            };
-            let select_profile_id = if old_has_profile_id {
-                "profile_id"
-            } else {
-                "NULL"
-            };
-            let select_claim_expires_at = if old_has_claim_expires_at {
-                "claim_expires_at"
-            } else {
-                "NULL"
-            };
-            let select_blocker_json = if old_has_blocker_json {
-                "blocker_json"
-            } else {
-                "NULL"
-            };
-            let select_checkpoint_json = if old_has_checkpoint_json {
-                "checkpoint_json"
-            } else {
-                "NULL"
-            };
-            let select_resume_json = if old_has_resume_json {
-                "resume_json"
-            } else {
-                "NULL"
-            };
-            let select_summary_task_id = if old_has_summary_task_id {
-                "summary_task_id"
-            } else {
-                "NULL"
-            };
-            let select_summary_project_name = if old_has_summary_project_name {
-                "summary_project_name"
-            } else {
-                "NULL"
-            };
-            let select_summary_chat_name = if old_has_summary_chat_name {
-                "summary_chat_name"
-            } else {
-                "NULL"
-            };
-            let select_summary_idempotency_key = if old_has_summary_idempotency_key {
-                "summary_idempotency_key"
-            } else {
-                "NULL"
-            };
-            transaction.execute(
-                &format!(
-                    "INSERT INTO jobs (
-                        job_id, claim_token, execution_backend, profile_id,
-                        provider, action, status, request_json, result_json, error_json,
-                        blocker_json, checkpoint_json, resume_json,
-                        created_at, updated_at, claim_expires_at,
-                        summary_task_id, summary_project_name, summary_chat_name,
-                        summary_idempotency_key
-                     )
-                     SELECT
-                        job_id, claim_token, {select_execution_backend}, {select_profile_id},
-                        provider, action, status, request_json, result_json, error_json,
-                        {select_blocker_json}, {select_checkpoint_json}, {select_resume_json},
-                        created_at, updated_at, {select_claim_expires_at},
-                        {select_summary_task_id}, {select_summary_project_name},
-                        {select_summary_chat_name}, {select_summary_idempotency_key}
-                     FROM jobs_old"
-                ),
-                [],
-            )?;
-            transaction.execute_batch("DROP TABLE jobs_old;")?;
-            transaction.commit()?;
-            Ok(())
-        })();
-        conn.execute_batch("PRAGMA legacy_alter_table = OFF; PRAGMA foreign_keys = ON;")?;
-        migration_result?;
-        let transaction = conn.transaction_with_behavior(TransactionBehavior::Immediate)?;
-        backfill_summary_metadata(&transaction)?;
-        transaction.commit()?;
-        let violations =
-            conn.query_row("SELECT COUNT(*) FROM pragma_foreign_key_check", [], |row| {
-                row.get::<_, i64>(0)
-            })?;
-        if violations != 0 {
-            return Err(DaemonError::InvalidInput(format!(
-                "jobs table migration left {violations} foreign key violation(s)"
-            )));
-        }
-        Ok(())
-    }
-
-    fn connection(&self) -> Result<Connection> {
-        let conn = Connection::open(&self.database_path)?;
-        conn.busy_timeout(std::time::Duration::from_secs(5))?;
-        conn.execute_batch("PRAGMA foreign_keys = ON;")?;
-        Ok(conn)
-    }
-}
-
-#[derive(Debug, Clone)]
-struct HttpState {
-    store: JobStore,
-}
-
-#[derive(Debug, Serialize)]
-struct HealthResponse {
-    protocol: &'static str,
-    daemon_protocol: &'static str,
-    version: &'static str,
-    native_protocol: &'static str,
-    status: &'static str,
-    ready: bool,
-    home_dir: String,
-    pid: u32,
-    instance_id: String,
-    running_binary_hash: String,
-}
-
-#[derive(Debug, Serialize)]
-struct ReadyResponse {
-    #[serde(flatten)]
-    health: HealthResponse,
-    ready_proof_protocol: &'static str,
-    ready_challenge: String,
-    ready_proof: String,
-    daemon_process_proof_protocol: &'static str,
-    daemon_process_proof: String,
-}
-
-#[derive(Debug, Deserialize)]
-struct ReadyQuery {
-    challenge: String,
-}
-
-#[derive(Debug, Deserialize)]
-struct CreateJobRequest {
-    provider: String,
-    action: String,
-    request_json: Value,
-    execution_backend: Option<ExecutionBackend>,
-    profile_id: Option<String>,
-    job_id: Option<String>,
-    claim_token: Option<String>,
-}
-
-#[derive(Debug, Deserialize)]
-struct ClaimJobRequest {
-    claim_token: String,
-}
-
-#[derive(Debug, Deserialize)]
-struct ClaimLifecycleRequest {
-    claim_token: String,
-}
-
-#[derive(Debug, Deserialize)]
-struct WaitingForUserRequest {
-    claim_token: String,
-    blocker_json: Value,
-}
-
-#[derive(Debug, Deserialize)]
-struct CheckpointJobRequest {
-    claim_token: String,
-    checkpoint_json: Value,
-}
-
-#[derive(Debug, Deserialize)]
-struct ParkJobRequest {
-    claim_token: String,
-    blocker_json: Value,
-    checkpoint_json: Value,
-}
-
-#[derive(Debug, Clone, Copy, Deserialize, Serialize)]
-#[serde(rename_all = "snake_case")]
-enum BrowserVisibility {
-    Headed,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct ResumeJobRequest {
-    browser_visibility: BrowserVisibility,
-}
-
-#[derive(Debug, Deserialize)]
-struct CompleteJobRequest {
-    claim_token: String,
-    result_json: Option<Value>,
-    error_json: Option<Value>,
-}
-
-#[derive(Debug, Default, Deserialize)]
-struct CancelJobRequest {
-    reason: Option<Value>,
-}
-
-#[derive(Debug, Deserialize)]
-struct ListJobsQuery {
-    status: Option<JobStatus>,
-    execution_backend: Option<ExecutionBackend>,
-    profile_id: Option<String>,
-    provider: Option<String>,
-    task_id: Option<String>,
-    limit: Option<usize>,
-}
-
-#[derive(Debug, Deserialize)]
-struct ClaimNextQuery {
-    execution_backend: Option<ExecutionBackend>,
-    profile_id: Option<String>,
-    provider: Option<String>,
-    action: Option<String>,
-}
-
-#[derive(Debug, Serialize)]
-struct ClaimNextResponse {
-    job: Option<JobWithClaimToken>,
-}
-
-#[derive(Debug)]
-struct ApiError(DaemonError);
-
-impl From<DaemonError> for ApiError {
-    fn from(error: DaemonError) -> Self {
-        Self(error)
-    }
-}
-
-impl IntoResponse for ApiError {
-    fn into_response(self) -> Response {
-        let status = match self.0 {
-            DaemonError::InvalidInput(_)
-            | DaemonError::NonLoopbackBind(_)
-            | DaemonError::InvalidStatus(_) => StatusCode::BAD_REQUEST,
-            DaemonError::ControlAuthMissing => StatusCode::UNAUTHORIZED,
-            DaemonError::JobNotFound(_) => StatusCode::NOT_FOUND,
-            DaemonError::ClaimRejected(_) | DaemonError::ControlAuthRejected => {
-                StatusCode::FORBIDDEN
-            }
-            DaemonError::ClaimExpired(_) | DaemonError::InvalidJobState { .. } => {
-                StatusCode::CONFLICT
-            }
-            DaemonError::BridgeBusy => StatusCode::CONFLICT,
-            DaemonError::Io(_)
-            | DaemonError::Random(_)
-            | DaemonError::Sqlite(_)
-            | DaemonError::Json(_)
-            | DaemonError::MissingHome => StatusCode::INTERNAL_SERVER_ERROR,
-        };
-        let body = Json(json!({
-            "error": {
-                "message": self.0.to_string()
-            }
-        }));
-        (status, body).into_response()
-    }
-}
-
-type ApiResult<T> = std::result::Result<Json<T>, ApiError>;
-
-pub fn http_router(store: JobStore) -> Router {
-    Router::new()
-        .route("/health", get(health_handler))
-        .route("/ready", get(ready_handler))
-        .route("/jobs", post(create_job_handler).get(list_jobs_handler))
-        .route("/jobs/:job_id", get(get_job_handler))
-        .route("/jobs/:job_id/claim", post(claim_job_handler))
-        .route("/jobs/:job_id/complete", post(complete_job_handler))
-        .route("/jobs/:job_id/resume", post(resume_job_handler))
-        .route("/control/jobs/claim-next", post(claim_next_job_handler))
-        .route(
-            "/control/jobs/:job_id/checkpoint",
-            post(checkpoint_job_handler),
-        )
-        .route("/control/jobs/:job_id/park", post(park_job_handler))
-        .route("/control/jobs/:job_id/running", post(mark_running_handler))
-        .route(
-            "/control/jobs/:job_id/waiting-for-user",
-            post(mark_waiting_for_user_handler),
-        )
-        .route("/control/jobs/:job_id/renew", post(renew_claim_handler))
-        .route("/control/jobs/:job_id/cancel", post(cancel_job_handler))
-        .with_state(HttpState { store })
-}
-
-pub async fn serve_http(store: JobStore, host: IpAddr, port: u16) -> Result<()> {
-    validate_loopback_host(host)?;
-    freeze_daemon_self_sha256()?;
-    let listener = TcpListener::bind(SocketAddr::new(host, port)).await?;
-    serve_http_listener(store, listener).await
-}
-
-pub fn validate_loopback_host(host: IpAddr) -> Result<()> {
-    if !host.is_loopback() {
-        return Err(DaemonError::NonLoopbackBind(host));
-    }
-    Ok(())
-}
-
-pub async fn serve_http_listener(store: JobStore, listener: TcpListener) -> Result<()> {
-    freeze_daemon_self_sha256()?;
-    axum::serve(listener, http_router(store))
-        .await
-        .map_err(DaemonError::Io)
-}
-
-async fn health_handler(State(state): State<HttpState>) -> ApiResult<HealthResponse> {
-    Ok(Json(health_response(&state.store)?))
-}
-
-async fn ready_handler(
-    State(state): State<HttpState>,
-    query: std::result::Result<Query<ReadyQuery>, QueryRejection>,
-) -> ApiResult<ReadyResponse> {
-    let Query(query) = query.map_err(query_rejection_to_api_error)?;
-    validate_ready_challenge(&query.challenge)?;
-    let health = health_response(&state.store)?;
-    let ready_proof = daemon_ready_proof(&state.store, &query.challenge, &health.home_dir)?;
-    let daemon_process_proof = daemon_process_proof(
-        &state.store,
-        &query.challenge,
-        &health.home_dir,
-        health.pid,
-        &health.instance_id,
-        &health.running_binary_hash,
-    )?;
-    Ok(Json(ReadyResponse {
-        health,
-        ready_proof_protocol: DAEMON_READY_PROOF_PROTOCOL,
-        ready_challenge: query.challenge,
-        ready_proof,
-        daemon_process_proof_protocol: DAEMON_PROCESS_PROOF_PROTOCOL,
-        daemon_process_proof,
-    }))
-}
-
-fn health_response(store: &JobStore) -> Result<HealthResponse> {
-    Ok(HealthResponse {
-        protocol: DAEMON_PROTOCOL,
-        daemon_protocol: DAEMON_PROTOCOL,
-        version: env!("CARGO_PKG_VERSION"),
-        native_protocol: native_host::NATIVE_PROTOCOL,
-        status: "ok",
-        ready: true,
-        home_dir: store.home_dir().to_string_lossy().into_owned(),
-        pid: std::process::id(),
-        instance_id: daemon_instance_id().to_owned(),
-        running_binary_hash: daemon_self_sha256()?.to_owned(),
-    })
-}
-
-async fn create_job_handler(
-    State(state): State<HttpState>,
-    headers: HeaderMap,
-    payload: std::result::Result<Json<CreateJobRequest>, JsonRejection>,
-) -> ApiResult<JobWithClaimToken> {
-    require_control_auth(&state.store, &headers)?;
-    let Json(payload) = payload.map_err(json_rejection_to_api_error)?;
-    let mut input = CreateJob::new(payload.provider, payload.action, payload.request_json);
-    if let Some(execution_backend) = payload.execution_backend {
-        input.execution_backend = execution_backend;
-    }
-    input.profile_id = payload.profile_id;
-    input.job_id = payload.job_id;
-    input.claim_token = payload.claim_token;
-    let job = state.store.create_job(input)?;
-    Ok(Json(job.with_claim_token()))
-}
-
-async fn list_jobs_handler(
-    State(state): State<HttpState>,
-    headers: HeaderMap,
-    query: std::result::Result<Query<ListJobsQuery>, QueryRejection>,
-) -> ApiResult<Vec<JobView>> {
-    require_control_auth(&state.store, &headers)?;
-    let Query(query) = query.map_err(query_rejection_to_api_error)?;
-    let jobs = state.store.list_jobs(ListJobs {
-        status: query.status,
-        execution_backend: query.execution_backend,
-        profile_id: query.profile_id,
-        provider: query.provider,
-        task_id: query.task_id,
-        limit: query.limit,
-    })?;
-    Ok(Json(jobs.iter().map(Job::public_view).collect()))
-}
-
-async fn get_job_handler(
-    State(state): State<HttpState>,
-    AxumPath(job_id): AxumPath<String>,
-    headers: HeaderMap,
-) -> ApiResult<JobView> {
-    require_control_auth(&state.store, &headers)?;
-    let job = state.store.get_job(&job_id)?;
-    Ok(Json(job.public_view()))
-}
-
-async fn claim_job_handler(
-    State(state): State<HttpState>,
-    AxumPath(job_id): AxumPath<String>,
-    headers: HeaderMap,
-    payload: std::result::Result<Json<ClaimJobRequest>, JsonRejection>,
-) -> ApiResult<JobView> {
-    require_control_auth(&state.store, &headers)?;
-    let Json(payload) = payload.map_err(json_rejection_to_api_error)?;
-    let job = state.store.claim_job(&job_id, &payload.claim_token)?;
-    Ok(Json(job.public_view()))
-}
-
-async fn complete_job_handler(
-    State(state): State<HttpState>,
-    AxumPath(job_id): AxumPath<String>,
-    headers: HeaderMap,
-    payload: std::result::Result<Json<CompleteJobRequest>, JsonRejection>,
-) -> ApiResult<JobView> {
-    require_control_auth(&state.store, &headers)?;
-    let Json(payload) = payload.map_err(json_rejection_to_api_error)?;
-    let completion = match (payload.result_json, payload.error_json) {
-        (Some(result_json), None) => CompleteJob::Succeeded { result_json },
-        (None, Some(error_json)) => CompleteJob::Failed { error_json },
-        _ => {
-            return Err(DaemonError::InvalidInput(
-                "pass exactly one of result_json or error_json".to_owned(),
-            )
-            .into())
-        }
-    };
-    let job = state
-        .store
-        .complete_job(&job_id, &payload.claim_token, completion)?;
-    Ok(Json(job.public_view()))
-}
-
-async fn resume_job_handler(
-    State(state): State<HttpState>,
-    AxumPath(job_id): AxumPath<String>,
-    headers: HeaderMap,
-    payload: std::result::Result<Json<ResumeJobRequest>, JsonRejection>,
-) -> ApiResult<JobView> {
-    require_control_auth(&state.store, &headers)?;
-    let Json(payload) = payload.map_err(json_rejection_to_api_error)?;
-    let job = state.store.resume_job(
-        &job_id,
-        ResumeJob {
-            resume_json: json!({ "browser_visibility": payload.browser_visibility }),
-        },
-    )?;
-    Ok(Json(job.public_view()))
-}
-
-async fn claim_next_job_handler(
-    State(state): State<HttpState>,
-    headers: HeaderMap,
-    query: std::result::Result<Query<ClaimNextQuery>, QueryRejection>,
-) -> ApiResult<ClaimNextResponse> {
-    require_control_auth(&state.store, &headers)?;
-    let Query(query) = query.map_err(query_rejection_to_api_error)?;
-    let job = state
-        .store
-        .claim_next_job_with_scope(
-            ClaimNextJob {
-                provider: query.provider,
-                action: query.action,
-            },
-            query
-                .execution_backend
-                .unwrap_or(ExecutionBackend::LegacyExtension),
-            query.profile_id,
-        )?
-        .map(|job| job.with_claim_token());
-    Ok(Json(ClaimNextResponse { job }))
-}
-
-async fn checkpoint_job_handler(
-    State(state): State<HttpState>,
-    AxumPath(job_id): AxumPath<String>,
-    headers: HeaderMap,
-    payload: std::result::Result<Json<CheckpointJobRequest>, JsonRejection>,
-) -> ApiResult<JobView> {
-    require_control_auth(&state.store, &headers)?;
-    let Json(payload) = payload.map_err(json_rejection_to_api_error)?;
-    Ok(Json(
-        state
-            .store
-            .checkpoint_job(
-                &job_id,
-                &payload.claim_token,
-                JobCheckpoint {
-                    checkpoint_json: payload.checkpoint_json,
-                },
-            )?
-            .public_view(),
-    ))
-}
-
-async fn park_job_handler(
-    State(state): State<HttpState>,
-    AxumPath(job_id): AxumPath<String>,
-    headers: HeaderMap,
-    payload: std::result::Result<Json<ParkJobRequest>, JsonRejection>,
-) -> ApiResult<JobView> {
-    require_control_auth(&state.store, &headers)?;
-    let Json(payload) = payload.map_err(json_rejection_to_api_error)?;
-    Ok(Json(
-        state
-            .store
-            .park_job(
-                &job_id,
-                &payload.claim_token,
-                ParkJob {
-                    blocker_json: payload.blocker_json,
-                    checkpoint_json: payload.checkpoint_json,
-                },
-            )?
-            .public_view(),
-    ))
-}
-
-async fn mark_running_handler(
-    State(state): State<HttpState>,
-    AxumPath(job_id): AxumPath<String>,
-    headers: HeaderMap,
-    payload: std::result::Result<Json<ClaimLifecycleRequest>, JsonRejection>,
-) -> ApiResult<JobView> {
-    require_control_auth(&state.store, &headers)?;
-    let Json(payload) = payload.map_err(json_rejection_to_api_error)?;
-    Ok(Json(
-        state
-            .store
-            .mark_running(&job_id, &payload.claim_token)?
-            .public_view(),
-    ))
-}
-
-async fn mark_waiting_for_user_handler(
-    State(state): State<HttpState>,
-    AxumPath(job_id): AxumPath<String>,
-    headers: HeaderMap,
-    payload: std::result::Result<Json<WaitingForUserRequest>, JsonRejection>,
-) -> ApiResult<JobView> {
-    require_control_auth(&state.store, &headers)?;
-    let Json(payload) = payload.map_err(json_rejection_to_api_error)?;
-    Ok(Json(
-        state
-            .store
-            .mark_waiting_for_user(
-                &job_id,
-                &payload.claim_token,
-                UserBlocker {
-                    blocker_json: payload.blocker_json,
-                },
-            )?
-            .public_view(),
-    ))
-}
-
-async fn renew_claim_handler(
-    State(state): State<HttpState>,
-    AxumPath(job_id): AxumPath<String>,
-    headers: HeaderMap,
-    payload: std::result::Result<Json<ClaimLifecycleRequest>, JsonRejection>,
-) -> ApiResult<JobView> {
-    require_control_auth(&state.store, &headers)?;
-    let Json(payload) = payload.map_err(json_rejection_to_api_error)?;
-    Ok(Json(
-        state
-            .store
-            .renew_claim(&job_id, &payload.claim_token)?
-            .public_view(),
-    ))
-}
-
-async fn cancel_job_handler(
-    State(state): State<HttpState>,
-    AxumPath(job_id): AxumPath<String>,
-    headers: HeaderMap,
-    payload: Bytes,
-) -> ApiResult<JobView> {
-    require_control_auth(&state.store, &headers)?;
-    let payload = if payload.is_empty() {
-        CancelJobRequest::default()
-    } else {
-        serde_json::from_slice(&payload).map_err(|error| {
-            DaemonError::InvalidInput(format!("request body must be valid JSON: {error}"))
-        })?
-    };
-    Ok(Json(
-        state
-            .store
-            .cancel_job(&job_id, payload.reason)?
-            .public_view(),
-    ))
-}
-
-fn json_rejection_to_api_error(error: JsonRejection) -> ApiError {
-    DaemonError::InvalidInput(format!("request body must be valid JSON: {error}")).into()
-}
-
-fn query_rejection_to_api_error(error: QueryRejection) -> ApiError {
-    DaemonError::InvalidInput(format!("query parameters are invalid: {error}")).into()
-}
-
-pub fn default_home_dir() -> Result<PathBuf> {
-    if let Some(home) = nonempty_os_env("TOKENLESS_HOME") {
-        return Ok(PathBuf::from(home));
-    }
-    if let Some(home) = nonempty_os_env("HOME") {
-        return Ok(PathBuf::from(home).join(".tokenless"));
-    }
-    Err(DaemonError::MissingHome)
-}
-
-fn ensure_tokenless_home(home_dir: &Path) -> Result<()> {
-    fs::create_dir_all(home_dir)?;
-    restrict_dir_permissions(home_dir)?;
-    Ok(())
-}
-
-fn ensure_control_token(path: &Path) -> Result<()> {
-    match read_control_token(path) {
-        Ok(token) if !token.is_empty() => {
-            restrict_file_permissions(path)?;
-            return Ok(());
-        }
-        Ok(_) => {}
-        Err(DaemonError::Io(error)) if error.kind() == ErrorKind::NotFound => {}
-        Err(error) => return Err(error),
-    }
-
-    let token = generate_secret_token()?;
-    match create_control_token_file(path, &token) {
-        Ok(()) => Ok(()),
-        Err(DaemonError::Io(error)) if error.kind() == ErrorKind::AlreadyExists => {
-            restrict_file_permissions(path)?;
-            let existing = read_control_token(path)?;
-            if existing.is_empty() {
-                return Err(DaemonError::InvalidInput(format!(
-                    "{} is empty",
-                    path.display()
-                )));
-            }
-            Ok(())
-        }
-        Err(error) => Err(error),
-    }
-}
-
-fn create_control_token_file(path: &Path, token: &str) -> Result<()> {
-    let mut options = OpenOptions::new();
-    options.write(true).create_new(true);
-    open_token_file_with_secure_mode(&mut options);
-    let mut file = options.open(path)?;
-    file.write_all(token.as_bytes())?;
-    file.write_all(b"\n")?;
-    file.sync_all()?;
-    restrict_file_permissions(path)?;
-    Ok(())
-}
-
-fn read_control_token(path: &Path) -> Result<String> {
-    Ok(fs::read_to_string(path)?.trim().to_owned())
-}
-
-#[cfg(unix)]
-fn open_token_file_with_secure_mode(options: &mut OpenOptions) {
-    use std::os::unix::fs::OpenOptionsExt;
-
-    options.mode(0o600);
-}
-
-#[cfg(not(unix))]
-fn open_token_file_with_secure_mode(_options: &mut OpenOptions) {}
-
-fn generate_secret_token() -> Result<String> {
-    let mut bytes = [0u8; SECRET_TOKEN_BYTES];
-    getrandom::getrandom(&mut bytes)?;
-    Ok(URL_SAFE_NO_PAD.encode(bytes))
-}
-
-fn require_control_auth(
-    store: &JobStore,
-    headers: &HeaderMap,
-) -> std::result::Result<(), ApiError> {
-    let header_value = headers
-        .get(header::AUTHORIZATION)
-        .ok_or(DaemonError::ControlAuthMissing)?;
-    let header_value = header_value
-        .to_str()
-        .map_err(|_| DaemonError::ControlAuthRejected)?;
-    let token = header_value
-        .strip_prefix("Bearer ")
-        .ok_or(DaemonError::ControlAuthRejected)?;
-    let expected = store.control_token()?;
-    if constant_time_eq(token.as_bytes(), expected.as_bytes()) {
-        Ok(())
-    } else {
-        Err(DaemonError::ControlAuthRejected.into())
-    }
-}
-
-pub fn daemon_ready_proof_message(challenge: &str, canonical_home: &str) -> Result<Vec<u8>> {
-    validate_ready_challenge(challenge)?;
-    let fields = [
-        DAEMON_READY_PROOF_PROTOCOL,
-        challenge,
-        DAEMON_PROTOCOL,
-        native_host::NATIVE_PROTOCOL,
-        canonical_home,
-    ];
-    length_prefixed_message(fields)
-}
-
-pub fn daemon_process_proof_message(
-    challenge: &str,
-    canonical_home: &str,
-    pid: u32,
-    instance_id: &str,
-    running_binary_hash: &str,
-) -> Result<Vec<u8>> {
-    validate_ready_challenge(challenge)?;
-    validate_instance_id(instance_id)?;
-    validate_sha256_hex(running_binary_hash)?;
-    let pid_string = pid.to_string();
-    let fields = [
-        DAEMON_PROCESS_PROOF_PROTOCOL,
-        challenge,
-        DAEMON_PROTOCOL,
-        native_host::NATIVE_PROTOCOL,
-        canonical_home,
-        pid_string.as_str(),
-        instance_id,
-        running_binary_hash,
-    ];
-    length_prefixed_message(fields)
-}
-
-fn length_prefixed_message<const N: usize>(fields: [&str; N]) -> Result<Vec<u8>> {
-    let total_capacity = fields
-        .iter()
-        .map(|field| 4_usize.saturating_add(field.len()))
-        .fold(0_usize, usize::saturating_add);
-    let mut message = Vec::with_capacity(total_capacity);
-    for field in fields {
-        let length = u32::try_from(field.len()).map_err(|_| {
-            DaemonError::InvalidInput("ready proof field exceeds u32 byte length".to_owned())
-        })?;
-        message.extend_from_slice(&length.to_be_bytes());
-        message.extend_from_slice(field.as_bytes());
-    }
-    Ok(message)
-}
-
-fn daemon_ready_proof(store: &JobStore, challenge: &str, canonical_home: &str) -> Result<String> {
-    let token = store.control_token()?;
-    let message = daemon_ready_proof_message(challenge, canonical_home)?;
-    hmac_base64url(
-        token.as_bytes(),
-        &message,
-        "daemon token cannot initialize ready proof",
-    )
-}
-
-fn daemon_process_proof(
-    store: &JobStore,
-    challenge: &str,
-    canonical_home: &str,
-    pid: u32,
-    instance_id: &str,
-    running_binary_hash: &str,
-) -> Result<String> {
-    let token = store.control_token()?;
-    let message = daemon_process_proof_message(
-        challenge,
-        canonical_home,
-        pid,
-        instance_id,
-        running_binary_hash,
-    )?;
-    hmac_base64url(
-        token.as_bytes(),
-        &message,
-        "daemon token cannot initialize process proof",
-    )
-}
-
-fn hmac_base64url(token: &[u8], message: &[u8], error_message: &'static str) -> Result<String> {
-    let mut mac = Hmac::<Sha256>::new_from_slice(token)
-        .map_err(|_| DaemonError::InvalidInput(error_message.to_owned()))?;
-    mac.update(message);
-    Ok(URL_SAFE_NO_PAD.encode(mac.finalize().into_bytes()))
-}
-
-fn daemon_instance_id() -> &'static str {
-    DAEMON_INSTANCE_ID
-        .get_or_init(|| {
-            let mut bytes = [0u8; 16];
-            getrandom::getrandom(&mut bytes).expect("daemon instance id randomness");
-            URL_SAFE_NO_PAD.encode(bytes)
-        })
-        .as_str()
-}
-
-fn daemon_self_sha256() -> Result<&'static str> {
-    freeze_daemon_self_sha256()
-}
-
-fn freeze_daemon_self_sha256() -> Result<&'static str> {
-    if let Some(hash) = DAEMON_SELF_SHA256.get() {
-        return Ok(hash.as_str());
-    }
-    let executable = env::current_exe().map_err(DaemonError::Io)?;
-    let bytes = fs::read(executable).map_err(DaemonError::Io)?;
-    let hash = hex_sha256(&bytes);
-    let _ = DAEMON_SELF_SHA256.set(hash);
-    Ok(DAEMON_SELF_SHA256
-        .get()
-        .expect("daemon self hash was just initialized")
-        .as_str())
-}
-
-fn hex_sha256(bytes: &[u8]) -> String {
-    Sha256::digest(bytes)
-        .iter()
-        .map(|byte| format!("{byte:02x}"))
-        .collect()
-}
-
-fn validate_instance_id(instance_id: &str) -> Result<()> {
-    if instance_id.len() != 22
-        || !instance_id
-            .bytes()
-            .all(|byte| byte.is_ascii_alphanumeric() || byte == b'-' || byte == b'_')
-    {
-        return Err(DaemonError::InvalidInput(
-            "daemon instance id must be canonical base64url identity".to_owned(),
-        ));
-    }
-    Ok(())
-}
-
-fn validate_sha256_hex(value: &str) -> Result<()> {
-    if value.len() != 64 || !value.bytes().all(|byte| byte.is_ascii_hexdigit()) {
-        return Err(DaemonError::InvalidInput(
-            "daemon running binary hash must be canonical SHA-256 hex".to_owned(),
-        ));
-    }
-    Ok(())
-}
-
-fn validate_ready_challenge(challenge: &str) -> Result<()> {
-    if challenge.len() != READY_CHALLENGE_BASE64URL_CHARS {
-        return Err(DaemonError::InvalidInput(format!(
-            "challenge must be canonical unpadded base64url encoding of {READY_CHALLENGE_BYTES} bytes"
-        )));
-    }
-    let decoded = URL_SAFE_NO_PAD.decode(challenge).map_err(|_| {
-        DaemonError::InvalidInput(format!(
-            "challenge must be canonical unpadded base64url encoding of {READY_CHALLENGE_BYTES} bytes"
-        ))
-    })?;
-    if decoded.len() != READY_CHALLENGE_BYTES || URL_SAFE_NO_PAD.encode(&decoded) != challenge {
-        return Err(DaemonError::InvalidInput(format!(
-            "challenge must be canonical unpadded base64url encoding of {READY_CHALLENGE_BYTES} bytes"
-        )));
-    }
-    Ok(())
-}
-
-fn constant_time_eq(left: &[u8], right: &[u8]) -> bool {
-    let mut diff = left.len() ^ right.len();
-    let max_len = left.len().max(right.len());
-    for index in 0..max_len {
-        diff |= left.get(index).copied().unwrap_or_default() as usize
-            ^ right.get(index).copied().unwrap_or_default() as usize;
-    }
-    diff == 0
-}
-
-fn normalize_nonempty(value: String, field: &'static str) -> Result<String> {
-    let trimmed = value.trim().to_owned();
-    if trimmed.is_empty() {
-        return Err(DaemonError::InvalidInput(format!(
-            "{field} must be a nonempty string"
-        )));
-    }
-    Ok(trimmed)
-}
-
-fn normalize_summary_filter(value: String, field: &'static str) -> Result<String> {
-    let normalized = normalize_nonempty(value, field)?;
-    if normalized.chars().count() > SUMMARY_SCALAR_CHARS {
-        return Err(DaemonError::InvalidInput(format!(
-            "{field} must be at most {SUMMARY_SCALAR_CHARS} characters"
-        )));
-    }
-    Ok(normalized)
-}
-
-fn normalize_profile_id(value: String, field: &'static str) -> Result<String> {
-    let normalized = normalize_nonempty(value, field)?;
-    if normalized.chars().count() > PROFILE_ID_CHARS {
-        return Err(DaemonError::InvalidInput(format!(
-            "{field} must be at most {PROFILE_ID_CHARS} characters"
-        )));
-    }
-    Ok(normalized)
-}
-
-fn validate_job_backend_profile(
-    execution_backend: ExecutionBackend,
-    profile_id: Option<String>,
-) -> Result<(ExecutionBackend, Option<String>)> {
-    let profile_id = profile_id
-        .map(|value| normalize_profile_id(value, "profile_id"))
-        .transpose()?;
-    match (execution_backend, profile_id) {
-        (ExecutionBackend::LegacyExtension, None) => Ok((execution_backend, None)),
-        (ExecutionBackend::LegacyExtension, Some(_)) => Err(DaemonError::InvalidInput(
-            "legacy_extension jobs must not set profile_id".to_owned(),
-        )),
-        (ExecutionBackend::Playwright, Some(profile_id)) => {
-            Ok((execution_backend, Some(profile_id)))
-        }
-        (ExecutionBackend::Playwright, None) => Err(DaemonError::InvalidInput(
-            "playwright jobs require profile_id".to_owned(),
-        )),
-    }
-}
-
-fn validate_filter_backend_profile(
-    execution_backend: Option<ExecutionBackend>,
-    profile_id: Option<&str>,
-) -> Result<()> {
-    if matches!(execution_backend, Some(ExecutionBackend::LegacyExtension)) && profile_id.is_some()
-    {
-        return Err(DaemonError::InvalidInput(
-            "legacy_extension filters must not set profile_id".to_owned(),
-        ));
-    }
-    Ok(())
-}
-
-fn validate_claim_backend_profile(
-    execution_backend: ExecutionBackend,
-    profile_id: Option<&str>,
-) -> Result<()> {
-    match (execution_backend, profile_id) {
-        (ExecutionBackend::LegacyExtension, None) => Ok(()),
-        (ExecutionBackend::LegacyExtension, Some(_)) => Err(DaemonError::InvalidInput(
-            "legacy_extension claims must not set profile_id".to_owned(),
-        )),
-        (ExecutionBackend::Playwright, Some(_)) => Ok(()),
-        (ExecutionBackend::Playwright, None) => Err(DaemonError::InvalidInput(
-            "playwright claims require profile_id".to_owned(),
-        )),
-    }
-}
-
-fn bounded_nonempty_summary_value(value: &str) -> Option<String> {
-    let trimmed = value.trim();
-    if trimmed.is_empty() {
-        return None;
-    }
-    Some(trimmed.chars().take(SUMMARY_SCALAR_CHARS).collect())
-}
-
-fn row_to_job(row: &rusqlite::Row<'_>) -> rusqlite::Result<Job> {
-    let execution_backend: String = row.get(2)?;
-    let status: String = row.get(6)?;
-    let request_json: String = row.get(7)?;
-    let result_json: Option<String> = row.get(8)?;
-    let error_json: Option<String> = row.get(9)?;
-    let blocker_json: Option<String> = row.get(10)?;
-    let checkpoint_json: Option<String> = row.get(11)?;
-    let resume_json: Option<String> = row.get(12)?;
-    Ok(Job {
-        job_id: row.get(0)?,
-        claim_token: row.get(1)?,
-        execution_backend: ExecutionBackend::from_db(execution_backend).map_err(to_sql_error)?,
-        profile_id: row.get(3)?,
-        provider: row.get(4)?,
-        action: row.get(5)?,
-        status: JobStatus::from_db(status).map_err(to_sql_error)?,
-        request_json: serde_json::from_str(&request_json).map_err(to_sql_error)?,
-        result_json: parse_optional_json(result_json).map_err(to_sql_error)?,
-        error_json: parse_optional_json(error_json).map_err(to_sql_error)?,
-        blocker_json: parse_optional_json(blocker_json).map_err(to_sql_error)?,
-        checkpoint_json: parse_optional_json(checkpoint_json).map_err(to_sql_error)?,
-        resume_json: parse_optional_json(resume_json).map_err(to_sql_error)?,
-        created_at: row.get(13)?,
-        updated_at: row.get(14)?,
-        claim_expires_at_ms: row.get(15)?,
-    })
-}
-
-fn row_to_job_summary(row: &rusqlite::Row<'_>) -> rusqlite::Result<JobSummary> {
-    let execution_backend: String = row.get(1)?;
-    let status: String = row.get(5)?;
-    Ok(JobSummary {
-        job_id: row.get(0)?,
-        execution_backend: ExecutionBackend::from_db(execution_backend).map_err(to_sql_error)?,
-        profile_id: row.get(2)?,
-        provider: row.get(3)?,
-        action: row.get(4)?,
-        status: JobStatus::from_db(status).map_err(to_sql_error)?,
-        created_at: row.get(6)?,
-        updated_at: row.get(7)?,
-        task_id: row.get(8)?,
-        project_name: row.get(9)?,
-        chat_name: row.get(10)?,
-        idempotency_key: row.get(11)?,
-    })
-}
-
-fn collect_jobs<F>(rows: rusqlite::MappedRows<'_, F>) -> Result<Vec<Job>>
-where
-    F: FnMut(&rusqlite::Row<'_>) -> rusqlite::Result<Job>,
-{
-    rows.collect::<std::result::Result<Vec<_>, _>>()
-        .map_err(DaemonError::Sqlite)
-}
-
-fn get_job_with_conn(conn: &Connection, job_id: &str) -> Result<Job> {
-    let mut stmt = conn.prepare(
-        "SELECT
-            job_id, claim_token, execution_backend, profile_id,
-            provider, action, status, request_json, result_json, error_json,
-            blocker_json, checkpoint_json, resume_json,
-            created_at, updated_at, claim_expires_at
-         FROM jobs
-         WHERE job_id = ?1",
-    )?;
-    stmt.query_row(params![job_id], row_to_job)
-        .optional()?
-        .ok_or_else(|| DaemonError::JobNotFound(job_id.to_owned()))
-}
-
-fn explain_claim_failure(conn: &Connection, job_id: &str, claim_token: &str) -> Result<Job> {
-    let job = get_job_with_conn(conn, job_id)?;
-    if job.claim_token != claim_token {
-        return Err(DaemonError::ClaimRejected(job_id.to_owned()));
-    }
-    Err(DaemonError::InvalidJobState {
-        job_id: job_id.to_owned(),
-        expected: "queued",
-        actual: job.status,
-    })
-}
-
-fn explain_active_claim_failure(
-    conn: &Connection,
-    job_id: &str,
-    claim_token: &str,
-    now_ms: i64,
-) -> Result<Job> {
-    let job = get_job_with_conn(conn, job_id)?;
-    if job.claim_token != claim_token {
-        return Err(DaemonError::ClaimRejected(job_id.to_owned()));
-    }
-    if matches!(
-        job.status,
-        JobStatus::Claimed | JobStatus::Running | JobStatus::WaitingForUser
-    ) && job
-        .claim_expires_at_ms
-        .map(|expires_at| expires_at <= now_ms)
-        .unwrap_or(true)
-    {
-        return Err(DaemonError::ClaimExpired(job_id.to_owned()));
-    }
-    Err(DaemonError::InvalidJobState {
-        job_id: job_id.to_owned(),
-        expected: "claimed, running, or waiting_for_user",
-        actual: job.status,
-    })
-}
-
-fn parse_optional_json(value: Option<String>) -> Result<Option<Value>> {
-    value
-        .map(|json| serde_json::from_str(&json).map_err(DaemonError::Json))
-        .transpose()
-}
-
-fn parked_resume_blocker_json(blocker_json: Option<Value>) -> Value {
-    let browser = json!({
-        "windowOpen": false,
-        "resumeRequired": true,
-    });
-    match blocker_json {
-        Some(Value::Object(mut object)) => {
-            match object.get_mut("browser") {
-                Some(Value::Object(browser_object)) => {
-                    browser_object.insert("windowOpen".to_owned(), Value::Bool(false));
-                    browser_object.insert("resumeRequired".to_owned(), Value::Bool(true));
-                }
-                _ => {
-                    object.insert("browser".to_owned(), browser);
-                }
-            }
-            Value::Object(object)
-        }
-        Some(value) => json!({
-            "blocker": value,
-            "browser": browser,
-        }),
-        None => json!({
-            "browser": browser,
-        }),
-    }
-}
-
-fn to_sql_error(error: impl std::error::Error + Send + Sync + 'static) -> rusqlite::Error {
-    rusqlite::Error::FromSqlConversionFailure(0, rusqlite::types::Type::Text, Box::new(error))
-}
-
-fn now_rfc3339() -> String {
-    Utc::now().to_rfc3339_opts(SecondsFormat::Millis, true)
-}
-
-fn now_unix_millis() -> i64 {
-    Utc::now().timestamp_millis()
-}
-
-fn sqlite_column_exists(conn: &Connection, table: &str, column: &str) -> Result<bool> {
-    let sql = format!("PRAGMA table_info({table})");
-    let mut stmt = conn.prepare(&sql)?;
-    let names = stmt
-        .query_map([], |row| row.get::<_, String>(1))?
-        .collect::<std::result::Result<Vec<_>, _>>()?;
-    Ok(names.iter().any(|name| name == column))
-}
-
-fn sqlite_table_exists(conn: &Connection, table: &str) -> Result<bool> {
-    conn.query_row(
-        "SELECT EXISTS (
-            SELECT 1 FROM sqlite_schema WHERE type = 'table' AND name = ?1
-         )",
-        params![table],
-        |row| row.get(0),
-    )
-    .map_err(DaemonError::Sqlite)
-}
-
-fn backfill_summary_metadata(transaction: &rusqlite::Transaction<'_>) -> Result<()> {
-    let mut select = transaction.prepare("SELECT job_id, request_json FROM jobs")?;
-    let mut rows = select.query([])?;
-    while let Some(row) = rows.next()? {
-        let job_id: String = row.get(0)?;
-        let request_json: String = row.get(1)?;
-        let request = serde_json::from_str(&request_json).unwrap_or(Value::Null);
-        let summary = RequestSummaryMetadata::from_request(&request);
-        transaction.execute(
-            "UPDATE jobs
-             SET summary_task_id = ?1, summary_project_name = ?2,
-                 summary_chat_name = ?3, summary_idempotency_key = ?4
-             WHERE job_id = ?5",
-            params![
-                summary.task_id,
-                summary.project_name,
-                summary.chat_name,
-                summary.idempotency_key,
-                job_id,
-            ],
-        )?;
-        transaction.execute(
-            "DELETE FROM job_task_keys WHERE job_id = ?1",
-            params![job_id],
-        )?;
-        for task_key in summary.task_keys {
-            transaction.execute(
-                "INSERT INTO job_task_keys (job_id, task_id) VALUES (?1, ?2)",
-                params![job_id, task_key],
-            )?;
-        }
-    }
-    Ok(())
-}
-
-fn nonempty_os_env(name: &str) -> Option<std::ffi::OsString> {
-    env::var_os(name).filter(|value| !value.is_empty())
-}
-
-#[cfg(unix)]
-fn restrict_dir_permissions(path: &Path) -> Result<()> {
-    use std::os::unix::fs::PermissionsExt;
-
-    let permissions = fs::Permissions::from_mode(0o700);
-    fs::set_permissions(path, permissions)?;
-    Ok(())
-}
-
-#[cfg(not(unix))]
-fn restrict_dir_permissions(_path: &Path) -> Result<()> {
-    Ok(())
-}
-
-#[cfg(unix)]
-fn restrict_file_permissions(path: &Path) -> Result<()> {
-    use std::os::unix::fs::PermissionsExt;
-
-    if path.exists() {
-        let permissions = fs::Permissions::from_mode(0o600);
-        fs::set_permissions(path, permissions)?;
-    }
-    Ok(())
-}
-
-#[cfg(not(unix))]
-fn restrict_file_permissions(_path: &Path) -> Result<()> {
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use serde_json::json;
-    use std::sync::{Arc, Barrier};
-    use std::thread;
-
-    #[test]
-    fn creates_state_under_explicit_home() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-
-        let job = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit_and_read",
-                json!({ "prompt": "hello" }),
-            ))
-            .unwrap();
-
-        assert_eq!(store.home_dir(), fs::canonicalize(tempdir.path()).unwrap());
-        assert_eq!(
-            store.database_path(),
-            fs::canonicalize(tempdir.path())
-                .unwrap()
-                .join(DATABASE_FILE_NAME)
-        );
-        assert!(store.database_path().exists());
-        assert_eq!(job.status, JobStatus::Queued);
-        assert_eq!(job.execution_backend, ExecutionBackend::LegacyExtension);
-        assert_eq!(job.profile_id, None);
-        assert_eq!(job.provider, "chatgpt");
-        assert_eq!(job.action, "submit_and_read");
-        assert_eq!(job.request_json, json!({ "prompt": "hello" }));
-    }
-
-    #[test]
-    fn creates_control_token_file() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-
-        let token = store.control_token().unwrap();
-
-        assert_eq!(
-            store.control_token_path(),
-            fs::canonicalize(tempdir.path())
-                .unwrap()
-                .join(CONTROL_TOKEN_FILE_NAME)
-        );
-        assert!(store.control_token_path().exists());
-        assert!(!token.is_empty());
-
-        #[cfg(unix)]
-        {
-            use std::os::unix::fs::PermissionsExt;
-
-            let mode = fs::metadata(store.control_token_path())
-                .unwrap()
-                .permissions()
-                .mode()
-                & 0o777;
-            assert_eq!(mode, 0o600);
-        }
-    }
-
-    #[test]
-    fn lists_gets_claims_and_completes_job() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let job = store
-            .create_job(CreateJob::new(
-                "claude",
-                "submit",
-                json!({ "prompt": "write tests" }),
-            ))
-            .unwrap();
-
-        let listed = store.list_jobs(ListJobs::default()).unwrap();
-        assert_eq!(listed.len(), 1);
-        assert_eq!(listed[0].job_id, job.job_id);
-
-        let claimed = store.claim_job(&job.job_id, &job.claim_token).unwrap();
-        assert_eq!(claimed.status, JobStatus::Claimed);
-
-        let completed = store
-            .complete_job(
-                &job.job_id,
-                &job.claim_token,
-                CompleteJob::Succeeded {
-                    result_json: json!({ "text": "done" }),
-                },
-            )
-            .unwrap();
-
-        assert_eq!(completed.status, JobStatus::Succeeded);
-        assert_eq!(completed.result_json, Some(json!({ "text": "done" })));
-        assert_eq!(completed.error_json, None);
-    }
-
-    #[test]
-    fn exact_task_and_provider_filters_find_jobs_beyond_the_default_scan_window() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let target = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({
-                    "taskId": "top-task",
-                    "idempotencyKey": "top-idempotency",
-                    "requestId": "top-request",
-                    "metadata": {
-                        "taskId": "metadata-task",
-                        "idempotencyKey": "metadata-idempotency",
-                    }
-                }),
-            ))
-            .unwrap();
-        for index in 0..1_001 {
-            store
-                .create_job(CreateJob::new(
-                    "chatgpt",
-                    "submit",
-                    json!({ "prompt": format!("filler-{index}") }),
-                ))
-                .unwrap();
-        }
-        store
-            .create_job(CreateJob::new(
-                "claude",
-                "submit",
-                json!({ "taskId": "top-task" }),
-            ))
-            .unwrap();
-
-        for task_id in [
-            "top-task",
-            "top-idempotency",
-            "top-request",
-            "metadata-task",
-            "metadata-idempotency",
-        ] {
-            let matches = store
-                .list_jobs(ListJobs {
-                    provider: Some("chatgpt".to_owned()),
-                    task_id: Some(task_id.to_owned()),
-                    limit: Some(1),
-                    ..ListJobs::default()
-                })
-                .unwrap();
-            assert_eq!(matches.len(), 1, "missing exact task key {task_id}");
-            assert_eq!(matches[0].job_id, target.job_id);
-        }
-    }
-
-    #[test]
-    fn summary_query_uses_bounded_scalar_columns_without_loading_payloads() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let job = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({
-                    "prompt": "private-prompt".repeat(100_000),
-                    "taskId": "t".repeat(1_000),
-                    "metadata": {
-                        "projectName": "p".repeat(1_000),
-                        "chatName": "bounded chat",
-                    }
-                }),
-            ))
-            .unwrap();
-        let conn = Connection::open(store.database_path()).unwrap();
-        conn.execute(
-            "UPDATE jobs
-             SET request_json = 'not-json-private-prompt',
-                 result_json = 'not-json-private-result',
-                 error_json = 'not-json-private-error'
-             WHERE job_id = ?1",
-            params![job.job_id],
-        )
-        .unwrap();
-
-        assert!(matches!(
-            store.get_job(&job.job_id),
-            Err(DaemonError::Sqlite(_))
-        ));
-        let summaries = store.list_job_summaries(None).unwrap();
-        assert_eq!(summaries.len(), 1);
-        assert_eq!(summaries[0].job_id, job.job_id);
-        assert_eq!(
-            summaries[0].task_id.as_ref().unwrap().chars().count(),
-            SUMMARY_SCALAR_CHARS
-        );
-        assert_eq!(
-            summaries[0].project_name.as_ref().unwrap().chars().count(),
-            SUMMARY_SCALAR_CHARS
-        );
-        assert_eq!(summaries[0].chat_name.as_deref(), Some("bounded chat"));
-    }
-
-    #[test]
-    fn public_job_view_does_not_serialize_claim_token_or_private_runtime_state() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let job = create_playwright_job(&store, "work", "keep private runtime state");
-        let claimed = store
-            .claim_next_job_with_scope(
-                ClaimNextJob::default(),
-                ExecutionBackend::Playwright,
-                Some("work".to_owned()),
-            )
-            .unwrap()
-            .unwrap();
-        let checkpointed = store
-            .checkpoint_job(
-                &claimed.job_id,
-                &claimed.claim_token,
-                JobCheckpoint {
-                    checkpoint_json: json!({ "page": { "url": "https://example.test" } }),
-                },
-            )
-            .unwrap();
-
-        let view_json = serde_json::to_value(checkpointed.public_view()).unwrap();
-        let claim_json = serde_json::to_value(checkpointed.with_claim_token()).unwrap();
-
-        assert!(view_json.get("claim_token").is_none());
-        assert!(view_json.get("checkpoint_json").is_none());
-        assert!(view_json.get("resume_json").is_none());
-        assert_eq!(claim_json["claim_token"], checkpointed.claim_token);
-        assert_eq!(
-            claim_json["checkpoint_json"],
-            json!({ "page": { "url": "https://example.test" } })
-        );
-        assert_eq!(claim_json["resume_json"], Value::Null);
-        assert_eq!(view_json["execution_backend"], "playwright");
-        assert_eq!(view_json["profile_id"], "work");
-        assert_eq!(claim_json["execution_backend"], "playwright");
-        assert_eq!(claim_json["profile_id"], "work");
-        assert_eq!(job.status, JobStatus::Queued);
-    }
-
-    #[test]
-    fn validates_create_backend_profile_combinations() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-
-        let legacy = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "legacy" }),
-            ))
-            .unwrap();
-        assert_eq!(legacy.execution_backend, ExecutionBackend::LegacyExtension);
-        assert_eq!(legacy.profile_id, None);
-
-        let mut playwright_input =
-            CreateJob::new("chatgpt", "submit", json!({ "prompt": "managed" }));
-        playwright_input.execution_backend = ExecutionBackend::Playwright;
-        playwright_input.profile_id = Some("work".to_owned());
-        let playwright = store.create_job(playwright_input).unwrap();
-        assert_eq!(playwright.execution_backend, ExecutionBackend::Playwright);
-        assert_eq!(playwright.profile_id.as_deref(), Some("work"));
-
-        let mut missing_profile =
-            CreateJob::new("chatgpt", "submit", json!({ "prompt": "invalid" }));
-        missing_profile.execution_backend = ExecutionBackend::Playwright;
-        let error = store.create_job(missing_profile).unwrap_err();
-        assert!(
-            matches!(error, DaemonError::InvalidInput(message) if message.contains("require profile_id"))
-        );
-
-        let mut legacy_with_profile =
-            CreateJob::new("chatgpt", "submit", json!({ "prompt": "invalid" }));
-        legacy_with_profile.profile_id = Some("work".to_owned());
-        let error = store.create_job(legacy_with_profile).unwrap_err();
-        assert!(
-            matches!(error, DaemonError::InvalidInput(message) if message.contains("must not set profile_id"))
-        );
-
-        let mut oversized_profile =
-            CreateJob::new("chatgpt", "submit", json!({ "prompt": "invalid" }));
-        oversized_profile.execution_backend = ExecutionBackend::Playwright;
-        oversized_profile.profile_id = Some("p".repeat(PROFILE_ID_CHARS + 1));
-        let error = store.create_job(oversized_profile).unwrap_err();
-        assert!(matches!(error, DaemonError::InvalidInput(message) if message.contains("at most")));
-    }
-
-    #[test]
-    fn exact_backend_and_profile_filters_isolate_list_results() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let legacy = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "legacy" }),
-            ))
-            .unwrap();
-        let work = create_playwright_job(&store, "work", "work");
-        let personal = create_playwright_job(&store, "personal", "personal");
-
-        let legacy_matches = store
-            .list_jobs(ListJobs {
-                execution_backend: Some(ExecutionBackend::LegacyExtension),
-                ..ListJobs::default()
-            })
-            .unwrap();
-        assert_eq!(legacy_matches.len(), 1);
-        assert_eq!(legacy_matches[0].job_id, legacy.job_id);
-
-        let playwright_matches = store
-            .list_jobs(ListJobs {
-                execution_backend: Some(ExecutionBackend::Playwright),
-                ..ListJobs::default()
-            })
-            .unwrap();
-        assert_eq!(playwright_matches.len(), 2);
-        assert!(playwright_matches
-            .iter()
-            .all(|job| job.execution_backend == ExecutionBackend::Playwright));
-
-        let work_matches = store
-            .list_jobs(ListJobs {
-                profile_id: Some("work".to_owned()),
-                ..ListJobs::default()
-            })
-            .unwrap();
-        assert_eq!(work_matches.len(), 1);
-        assert_eq!(work_matches[0].job_id, work.job_id);
-
-        let personal_matches = store
-            .list_jobs(ListJobs {
-                execution_backend: Some(ExecutionBackend::Playwright),
-                profile_id: Some("personal".to_owned()),
-                ..ListJobs::default()
-            })
-            .unwrap();
-        assert_eq!(personal_matches.len(), 1);
-        assert_eq!(personal_matches[0].job_id, personal.job_id);
-
-        let invalid = store.list_jobs(ListJobs {
-            execution_backend: Some(ExecutionBackend::LegacyExtension),
-            profile_id: Some("work".to_owned()),
-            ..ListJobs::default()
-        });
-        assert!(matches!(invalid, Err(DaemonError::InvalidInput(_))));
-    }
-
-    #[test]
-    fn rejects_claim_with_wrong_token() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let job = store
-            .create_job(CreateJob::new(
-                "gemini",
-                "submit",
-                json!({ "prompt": "hi" }),
-            ))
-            .unwrap();
-
-        let error = store.claim_job(&job.job_id, "wrong-token").unwrap_err();
-
-        assert!(matches!(error, DaemonError::ClaimRejected(_)));
-        assert_eq!(
-            store.get_job(&job.job_id).unwrap().status,
-            JobStatus::Queued
-        );
-    }
-
-    #[test]
-    fn atomic_claim_allows_only_one_winner() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let job = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit_and_read",
-                json!({ "prompt": "race" }),
-            ))
-            .unwrap();
-        let barrier = Arc::new(Barrier::new(2));
-        let mut handles = Vec::new();
-
-        for _ in 0..2 {
-            let home = tempdir.path().to_path_buf();
-            let job_id = job.job_id.clone();
-            let claim_token = job.claim_token.clone();
-            let barrier = Arc::clone(&barrier);
-            handles.push(thread::spawn(move || {
-                let store = JobStore::open(home).unwrap();
-                barrier.wait();
-                store.claim_job(&job_id, &claim_token).is_ok()
-            }));
-        }
-
-        let success_count = handles
-            .into_iter()
-            .map(|handle| handle.join().unwrap())
-            .filter(|claimed| *claimed)
-            .count();
-
-        assert_eq!(success_count, 1);
-        assert_eq!(
-            store.get_job(&job.job_id).unwrap().status,
-            JobStatus::Claimed
-        );
-    }
-
-    #[test]
-    fn claim_next_returns_one_queued_job_and_marks_it_claimed() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let first = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit_and_read",
-                json!({ "prompt": "first" }),
-            ))
-            .unwrap();
-        let second = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit_and_read",
-                json!({ "prompt": "second" }),
-            ))
-            .unwrap();
-
-        let claimed = store
-            .claim_next_job(ClaimNextJob::default())
-            .unwrap()
-            .unwrap();
-
-        assert_eq!(claimed.job_id, first.job_id);
-        assert_ne!(claimed.claim_token, first.claim_token);
-        assert_eq!(claimed.status, JobStatus::Claimed);
-        assert_eq!(
-            store.get_job(&first.job_id).unwrap().status,
-            JobStatus::Claimed
-        );
-        assert_eq!(
-            store.get_job(&second.job_id).unwrap().status,
-            JobStatus::Queued
-        );
-    }
-
-    #[test]
-    fn claim_next_isolates_legacy_and_playwright_backends() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let legacy = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "legacy" }),
-            ))
-            .unwrap();
-        let playwright = create_playwright_job(&store, "work", "managed");
-
-        let legacy_claim = store
-            .claim_next_job(ClaimNextJob::default())
-            .unwrap()
-            .unwrap();
-        assert_eq!(legacy_claim.job_id, legacy.job_id);
-        assert_eq!(
-            legacy_claim.execution_backend,
-            ExecutionBackend::LegacyExtension
-        );
-        assert_eq!(
-            store.get_job(&playwright.job_id).unwrap().status,
-            JobStatus::Queued
-        );
-
-        let playwright_claim = store
-            .claim_next_job_with_scope(
-                ClaimNextJob::default(),
-                ExecutionBackend::Playwright,
-                Some("work".to_owned()),
-            )
-            .unwrap()
-            .unwrap();
-        assert_eq!(playwright_claim.job_id, playwright.job_id);
-        assert_eq!(
-            playwright_claim.execution_backend,
-            ExecutionBackend::Playwright
-        );
-        assert_eq!(playwright_claim.profile_id.as_deref(), Some("work"));
-    }
-
-    #[test]
-    fn claim_next_requires_exact_playwright_profile() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let work = create_playwright_job(&store, "work", "work");
-        let personal = create_playwright_job(&store, "personal", "personal");
-
-        let missing_profile = store.claim_next_job_with_scope(
-            ClaimNextJob::default(),
-            ExecutionBackend::Playwright,
-            None,
-        );
-        assert!(matches!(
-            missing_profile,
-            Err(DaemonError::InvalidInput(message)) if message.contains("require profile_id")
-        ));
-
-        let wrong_profile = store
-            .claim_next_job_with_scope(
-                ClaimNextJob::default(),
-                ExecutionBackend::Playwright,
-                Some("other".to_owned()),
-            )
-            .unwrap();
-        assert!(wrong_profile.is_none());
-
-        let personal_claim = store
-            .claim_next_job_with_scope(
-                ClaimNextJob::default(),
-                ExecutionBackend::Playwright,
-                Some("personal".to_owned()),
-            )
-            .unwrap()
-            .unwrap();
-        assert_eq!(personal_claim.job_id, personal.job_id);
-        assert_eq!(personal_claim.profile_id.as_deref(), Some("personal"));
-        assert_eq!(
-            store.get_job(&work.job_id).unwrap().status,
-            JobStatus::Queued
-        );
-    }
-
-    #[test]
-    fn claim_next_returns_none_when_no_queued_job_exists() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-
-        let claimed = store.claim_next_job(ClaimNextJob::default()).unwrap();
-
-        assert!(claimed.is_none());
-    }
-
-    #[test]
-    fn concurrent_claim_next_allows_only_one_winner() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let job = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit_and_read",
-                json!({ "prompt": "race next" }),
-            ))
-            .unwrap();
-        let barrier = Arc::new(Barrier::new(2));
-        let mut handles = Vec::new();
-
-        for _ in 0..2 {
-            let home = tempdir.path().to_path_buf();
-            let barrier = Arc::clone(&barrier);
-            handles.push(thread::spawn(move || {
-                let store = JobStore::open(home).unwrap();
-                barrier.wait();
-                store
-                    .claim_next_job(ClaimNextJob::default())
-                    .unwrap()
-                    .map(|job| job.job_id)
-            }));
-        }
-
-        let claimed_job_ids = handles
-            .into_iter()
-            .filter_map(|handle| handle.join().unwrap())
-            .collect::<Vec<_>>();
-
-        assert_eq!(claimed_job_ids, vec![job.job_id.clone()]);
-        assert_eq!(
-            store.get_job(&job.job_id).unwrap().status,
-            JobStatus::Claimed
-        );
-    }
-
-    #[test]
-    fn concurrent_profile_scoped_claim_next_allows_only_one_winner() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let job = create_playwright_job(&store, "work", "race");
-        let barrier = Arc::new(Barrier::new(2));
-        let mut handles = Vec::new();
-
-        for _ in 0..2 {
-            let home = tempdir.path().to_path_buf();
-            let barrier = Arc::clone(&barrier);
-            handles.push(thread::spawn(move || {
-                let store = JobStore::open(home).unwrap();
-                barrier.wait();
-                store
-                    .claim_next_job_with_scope(
-                        ClaimNextJob::default(),
-                        ExecutionBackend::Playwright,
-                        Some("work".to_owned()),
-                    )
-                    .unwrap()
-                    .map(|job| job.job_id)
-            }));
-        }
-
-        let claimed_job_ids = handles
-            .into_iter()
-            .filter_map(|handle| handle.join().unwrap())
-            .collect::<Vec<_>>();
-
-        assert_eq!(claimed_job_ids, vec![job.job_id.clone()]);
-        assert_eq!(
-            store.get_job(&job.job_id).unwrap().status,
-            JobStatus::Claimed
-        );
-    }
-
-    #[test]
-    fn lease_renewal_expiry_requeue_and_reclaim_reject_stale_completion() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store =
-            JobStore::open_with_claim_lease(tempdir.path(), std::time::Duration::from_millis(100))
-                .unwrap();
-        let created = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "lease safety" }),
-            ))
-            .unwrap();
-
-        let claimed = store
-            .claim_next_job_at(ClaimNextJob::default(), 1_000)
-            .unwrap()
-            .unwrap();
-        assert_ne!(claimed.claim_token, created.claim_token);
-        assert_eq!(claimed.claim_expires_at_ms, Some(1_100));
-        let running = store
-            .mark_running_at(&claimed.job_id, &claimed.claim_token, 1_050)
-            .unwrap();
-        assert_eq!(running.status, JobStatus::Running);
-        assert_eq!(running.claim_expires_at_ms, Some(1_150));
-        let renewed = store
-            .renew_claim_at(&claimed.job_id, &claimed.claim_token, 1_100)
-            .unwrap();
-        assert_eq!(renewed.claim_expires_at_ms, Some(1_200));
-
-        let expired = store
-            .complete_job_at(
-                &claimed.job_id,
-                &claimed.claim_token,
-                CompleteJob::Succeeded {
-                    result_json: json!({ "text": "too late" }),
-                },
-                1_200,
-            )
-            .unwrap_err();
-        assert!(matches!(expired, DaemonError::ClaimExpired(_)));
-        assert_eq!(store.requeue_expired_claims_at(1_200).unwrap(), 1);
-        assert_eq!(
-            store.get_job(&claimed.job_id).unwrap().status,
-            JobStatus::Queued
-        );
-
-        let reclaimed = store
-            .claim_next_job_at(ClaimNextJob::default(), 1_201)
-            .unwrap()
-            .unwrap();
-        assert_ne!(reclaimed.claim_token, claimed.claim_token);
-        store
-            .mark_running_at(&reclaimed.job_id, &reclaimed.claim_token, 1_202)
-            .unwrap();
-        let stale = store
-            .complete_job_at(
-                &claimed.job_id,
-                &claimed.claim_token,
-                CompleteJob::Succeeded {
-                    result_json: json!({ "text": "stale worker" }),
-                },
-                1_203,
-            )
-            .unwrap_err();
-        assert!(matches!(stale, DaemonError::ClaimRejected(_)));
-        let completed = store
-            .complete_job_at(
-                &reclaimed.job_id,
-                &reclaimed.claim_token,
-                CompleteJob::Succeeded {
-                    result_json: json!({ "text": "current worker" }),
-                },
-                1_204,
-            )
-            .unwrap();
-        assert_eq!(completed.status, JobStatus::Succeeded);
-    }
-
-    #[test]
-    fn waiting_for_user_persists_blocker_renews_resumes_and_expires_retryable() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store =
-            JobStore::open_with_claim_lease(tempdir.path(), std::time::Duration::from_millis(100))
-                .unwrap();
-        let created = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "handover" }),
-            ))
-            .unwrap();
-        let claimed = store
-            .claim_job_at(&created.job_id, &created.claim_token, 1_000)
-            .unwrap();
-        let running = store
-            .mark_running_at(&claimed.job_id, &claimed.claim_token, 1_010)
-            .unwrap();
-        assert_eq!(running.status, JobStatus::Running);
-        let blocker = json!({
-            "protocol": "tokenless.playwright.user-handover.v1",
-            "blocker": { "code": "visible_recaptcha", "kind": "challenge" }
-        });
-        let waiting = store
-            .mark_waiting_for_user_at(
-                &claimed.job_id,
-                &claimed.claim_token,
-                UserBlocker {
-                    blocker_json: blocker.clone(),
-                },
-                1_020,
-            )
-            .unwrap();
-        assert_eq!(waiting.status, JobStatus::WaitingForUser);
-        assert_eq!(waiting.blocker_json, Some(blocker));
-        assert_eq!(
-            store
-                .renew_claim_at(&claimed.job_id, &claimed.claim_token, 1_050)
-                .unwrap()
-                .status,
-            JobStatus::WaitingForUser
-        );
-        let resumed = store
-            .mark_running_at(&claimed.job_id, &claimed.claim_token, 1_060)
-            .unwrap();
-        assert_eq!(resumed.status, JobStatus::Running);
-        assert_eq!(resumed.blocker_json, None);
-
-        let second = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "expire" }),
-            ))
-            .unwrap();
-        let claimed_second = store
-            .claim_job_at(&second.job_id, &second.claim_token, 2_000)
-            .unwrap();
-        store
-            .mark_running_at(&claimed_second.job_id, &claimed_second.claim_token, 2_010)
-            .unwrap();
-        store
-            .mark_waiting_for_user_at(
-                &claimed_second.job_id,
-                &claimed_second.claim_token,
-                UserBlocker {
-                    blocker_json: json!({ "blocker": { "code": "provider_sign_in_visible" } }),
-                },
-                2_020,
-            )
-            .unwrap();
-        assert_eq!(store.requeue_expired_claims_at(2_120).unwrap(), 0);
-        let expired = store.get_job(&claimed_second.job_id).unwrap();
-        assert_eq!(expired.status, JobStatus::Failed);
-        assert_eq!(
-            expired.error_json.unwrap()["code"],
-            "playwright_user_handover_lease_lost"
-        );
-        assert_eq!(expired.blocker_json, None);
-    }
-
-    #[test]
-    fn checkpoint_requires_live_active_claim_and_persists_opaque_json() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store =
-            JobStore::open_with_claim_lease(tempdir.path(), std::time::Duration::from_millis(100))
-                .unwrap();
-        let created = create_playwright_job(&store, "work", "checkpoint auth");
-
-        let queued_rejected = store
-            .checkpoint_job_at(
-                &created.job_id,
-                &created.claim_token,
-                JobCheckpoint {
-                    checkpoint_json: json!({ "step": 0 }),
-                },
-                1_000,
-            )
-            .unwrap_err();
-        assert!(matches!(
-            queued_rejected,
-            DaemonError::InvalidJobState { .. }
-        ));
-
-        let claimed = store
-            .claim_job_at(&created.job_id, &created.claim_token, 1_000)
-            .unwrap();
-        let wrong_token = store
-            .checkpoint_job_at(
-                &claimed.job_id,
-                "wrong-token",
-                JobCheckpoint {
-                    checkpoint_json: json!({ "step": "wrong" }),
-                },
-                1_010,
-            )
-            .unwrap_err();
-        assert!(matches!(wrong_token, DaemonError::ClaimRejected(_)));
-
-        let checkpoint = json!({
-            "opaque": {
-                "frames": [1, 2, 3],
-                "storageState": { "cookies": [] }
-            }
-        });
-        let checkpointed = store
-            .checkpoint_job_at(
-                &claimed.job_id,
-                &claimed.claim_token,
-                JobCheckpoint {
-                    checkpoint_json: checkpoint.clone(),
-                },
-                1_020,
-            )
-            .unwrap();
-        assert_eq!(checkpointed.checkpoint_json, Some(checkpoint.clone()));
-        assert_eq!(
-            serde_json::to_value(checkpointed.public_view())
-                .unwrap()
-                .get("checkpoint_json"),
-            None
-        );
-        assert_eq!(
-            serde_json::to_value(checkpointed.with_claim_token()).unwrap()["checkpoint_json"],
-            checkpoint
-        );
-
-        let expired = store
-            .checkpoint_job_at(
-                &claimed.job_id,
-                &claimed.claim_token,
-                JobCheckpoint {
-                    checkpoint_json: json!({ "step": "late" }),
-                },
-                1_100,
-            )
-            .unwrap_err();
-        assert!(matches!(expired, DaemonError::ClaimExpired(_)));
-    }
-
-    #[test]
-    fn checkpoint_rejects_legacy_jobs() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store =
-            JobStore::open_with_claim_lease(tempdir.path(), std::time::Duration::from_secs(60))
-                .unwrap();
-        let created = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "legacy checkpoint" }),
-            ))
-            .unwrap();
-        let claimed = store
-            .claim_job_at(&created.job_id, &created.claim_token, 1_000)
-            .unwrap();
-
-        let rejected = store
-            .checkpoint_job_at(
-                &claimed.job_id,
-                &claimed.claim_token,
-                JobCheckpoint {
-                    checkpoint_json: json!({ "checkpoint": { "legacy": true } }),
-                },
-                1_010,
-            )
-            .unwrap_err();
-
-        assert!(matches!(
-            rejected,
-            DaemonError::InvalidInput(message) if message.contains("only playwright jobs")
-        ));
-        let conn = Connection::open(store.database_path()).unwrap();
-        let (execution_backend, status, checkpoint_json): (String, String, Option<String>) = conn
-            .query_row(
-                "SELECT execution_backend, status, checkpoint_json FROM jobs WHERE job_id = ?1",
-                params![claimed.job_id],
-                |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?)),
-            )
-            .unwrap();
-        assert_eq!(
-            execution_backend,
-            ExecutionBackend::LegacyExtension.as_str()
-        );
-        assert_eq!(status, JobStatus::Claimed.as_str());
-        assert_eq!(checkpoint_json, None);
-    }
-
-    #[test]
-    fn park_persists_blocker_checkpoint_clears_lease_and_invalidates_claim() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store =
-            JobStore::open_with_claim_lease(tempdir.path(), std::time::Duration::from_secs(60))
-                .unwrap();
-        let created = create_playwright_job(&store, "work", "park");
-        let claimed = store
-            .claim_job_at(&created.job_id, &created.claim_token, 1_000)
-            .unwrap();
-        let running = store
-            .mark_running_at(&claimed.job_id, &claimed.claim_token, 1_010)
-            .unwrap();
-        let blocker = json!({ "blocker": { "code": "provider_sign_in_visible" } });
-        let checkpoint = json!({ "checkpoint": { "page": "provider" } });
-
-        let parked = store
-            .park_job_at(
-                &running.job_id,
-                &running.claim_token,
-                ParkJob {
-                    blocker_json: blocker.clone(),
-                    checkpoint_json: checkpoint.clone(),
-                },
-                1_020,
-            )
-            .unwrap();
-
-        assert_eq!(parked.status, JobStatus::WaitingForUser);
-        assert_eq!(parked.blocker_json, Some(blocker));
-        assert_eq!(parked.checkpoint_json, Some(checkpoint));
-        assert_eq!(parked.resume_json, None);
-        assert_eq!(parked.claim_expires_at_ms, None);
-        assert_ne!(parked.claim_token, running.claim_token);
-        assert!(matches!(
-            store.renew_claim_at(&parked.job_id, &running.claim_token, 1_030),
-            Err(DaemonError::ClaimRejected(_))
-        ));
-    }
-
-    #[test]
-    fn resume_requeues_parked_playwright_job_and_is_idempotent_until_terminal() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store =
-            JobStore::open_with_claim_lease(tempdir.path(), std::time::Duration::from_secs(60))
-                .unwrap();
-        let created = create_playwright_job(&store, "work", "resume");
-        let claimed = store
-            .claim_job_at(&created.job_id, &created.claim_token, 1_000)
-            .unwrap();
-        let parked = store
-            .park_job_at(
-                &claimed.job_id,
-                &claimed.claim_token,
-                ParkJob {
-                    blocker_json: json!({ "blocker": { "code": "visible_recaptcha" } }),
-                    checkpoint_json: json!({ "checkpoint": { "cursor": 7 } }),
-                },
-                1_010,
-            )
-            .unwrap();
-        let resume = ResumeJob {
-            resume_json: json!({ "browser_visibility": "headed" }),
-        };
-
-        let resumed = store
-            .resume_job_at(&parked.job_id, resume.clone(), 1_020)
-            .unwrap();
-        assert_eq!(resumed.status, JobStatus::Queued);
-        assert_eq!(resumed.resume_json, Some(resume.resume_json.clone()));
-        assert_ne!(resumed.claim_token, parked.claim_token);
-        assert_eq!(resumed.checkpoint_json, parked.checkpoint_json);
-        assert_eq!(resumed.blocker_json, parked.blocker_json);
-
-        let repeated_queued = store
-            .resume_job_at(&parked.job_id, resume.clone(), 1_030)
-            .unwrap();
-        assert_eq!(repeated_queued.status, JobStatus::Queued);
-        assert_eq!(repeated_queued.claim_token, resumed.claim_token);
-
-        let reclaimed = store
-            .claim_next_job_with_scope_at(
-                ClaimNextJob::default(),
-                ExecutionBackend::Playwright,
-                Some("work".to_owned()),
-                1_040,
-            )
-            .unwrap()
-            .unwrap();
-        assert_eq!(reclaimed.job_id, parked.job_id);
-        assert_eq!(reclaimed.checkpoint_json, parked.checkpoint_json);
-        assert_eq!(reclaimed.resume_json, Some(resume.resume_json.clone()));
-        let repeated_claimed = store
-            .resume_job_at(&parked.job_id, resume.clone(), 1_050)
-            .unwrap();
-        assert_eq!(repeated_claimed.status, JobStatus::Claimed);
-
-        let running = store
-            .mark_running_at(&reclaimed.job_id, &reclaimed.claim_token, 1_060)
-            .unwrap();
-        assert_eq!(running.status, JobStatus::Running);
-        assert_eq!(running.blocker_json, None);
-        assert_eq!(running.resume_json, Some(resume.resume_json.clone()));
-        let repeated_running = store
-            .resume_job_at(&parked.job_id, resume.clone(), 1_070)
-            .unwrap();
-        assert_eq!(repeated_running.status, JobStatus::Running);
-
-        let completed = store
-            .complete_job_at(
-                &reclaimed.job_id,
-                &reclaimed.claim_token,
-                CompleteJob::Succeeded {
-                    result_json: json!({ "text": "done" }),
-                },
-                1_080,
-            )
-            .unwrap();
-        assert_eq!(completed.status, JobStatus::Succeeded);
-        assert_eq!(completed.checkpoint_json, None);
-        assert_eq!(completed.resume_json, None);
-        assert!(matches!(
-            store.resume_job_at(&parked.job_id, resume, 1_090),
-            Err(DaemonError::InvalidJobState { .. })
-        ));
-    }
-
-    #[test]
-    fn resume_rejects_non_playwright_and_unparked_waiting_jobs() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store =
-            JobStore::open_with_claim_lease(tempdir.path(), std::time::Duration::from_secs(60))
-                .unwrap();
-        let legacy = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "legacy" }),
-            ))
-            .unwrap();
-        assert!(matches!(
-            store.resume_job_at(
-                &legacy.job_id,
-                ResumeJob {
-                    resume_json: json!({ "browser_visibility": "headed" }),
-                },
-                1_000
-            ),
-            Err(DaemonError::InvalidInput(_))
-        ));
-
-        let playwright = create_playwright_job(&store, "work", "not parked");
-        let claimed = store
-            .claim_job_at(&playwright.job_id, &playwright.claim_token, 1_000)
-            .unwrap();
-        store
-            .mark_running_at(&claimed.job_id, &claimed.claim_token, 1_010)
-            .unwrap();
-        let waiting = store
-            .mark_waiting_for_user_at(
-                &claimed.job_id,
-                &claimed.claim_token,
-                UserBlocker {
-                    blocker_json: json!({ "blocker": { "code": "manual" } }),
-                },
-                1_020,
-            )
-            .unwrap();
-        assert_eq!(waiting.status, JobStatus::WaitingForUser);
-        assert_eq!(waiting.checkpoint_json, None);
-        assert!(matches!(
-            store.resume_job_at(
-                &waiting.job_id,
-                ResumeJob {
-                    resume_json: json!({ "browser_visibility": "headed" }),
-                },
-                1_030
-            ),
-            Err(DaemonError::InvalidJobState { .. })
-        ));
-    }
-
-    #[test]
-    fn expired_checkpointed_waiting_job_becomes_parked_instead_of_failed() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store =
-            JobStore::open_with_claim_lease(tempdir.path(), std::time::Duration::from_millis(100))
-                .unwrap();
-        let created = create_playwright_job(&store, "work", "expire checkpointed waiting");
-        let claimed = store
-            .claim_job_at(&created.job_id, &created.claim_token, 1_000)
-            .unwrap();
-        store
-            .mark_running_at(&claimed.job_id, &claimed.claim_token, 1_010)
-            .unwrap();
-        let waiting = store
-            .mark_waiting_for_user_at(
-                &claimed.job_id,
-                &claimed.claim_token,
-                UserBlocker {
-                    blocker_json: json!({
-                        "blocker": { "code": "visible_recaptcha" },
-                        "browser": {
-                            "requestedVisibility": "auto",
-                            "effectiveVisibility": "headed",
-                            "windowOpen": true
-                        }
-                    }),
-                },
-                1_020,
-            )
-            .unwrap();
-        store
-            .checkpoint_job_at(
-                &waiting.job_id,
-                &waiting.claim_token,
-                JobCheckpoint {
-                    checkpoint_json: json!({ "checkpoint": { "safe": true } }),
-                },
-                1_030,
-            )
-            .unwrap();
-
-        assert_eq!(store.requeue_expired_claims_at(1_121).unwrap(), 0);
-        let parked = store.get_job(&waiting.job_id).unwrap();
-        assert_eq!(parked.status, JobStatus::WaitingForUser);
-        assert_eq!(parked.error_json, None);
-        assert_eq!(parked.claim_expires_at_ms, None);
-        assert_eq!(
-            parked.checkpoint_json,
-            Some(json!({ "checkpoint": { "safe": true } }))
-        );
-        assert_eq!(
-            parked.blocker_json.as_ref().unwrap()["browser"],
-            json!({
-                "requestedVisibility": "auto",
-                "effectiveVisibility": "headed",
-                "windowOpen": false,
-                "resumeRequired": true
-            })
-        );
-        assert_ne!(parked.claim_token, waiting.claim_token);
-        assert!(matches!(
-            store.renew_claim_at(&waiting.job_id, &waiting.claim_token, 1_122),
-            Err(DaemonError::ClaimRejected(_))
-        ));
-    }
-
-    #[test]
-    fn expired_legacy_checkpointed_waiting_job_fails_closed() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store =
-            JobStore::open_with_claim_lease(tempdir.path(), std::time::Duration::from_millis(100))
-                .unwrap();
-        let created = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "legacy checkpointed waiting" }),
-            ))
-            .unwrap();
-        let claimed = store
-            .claim_job_at(&created.job_id, &created.claim_token, 1_000)
-            .unwrap();
-        let conn = Connection::open(store.database_path()).unwrap();
-        conn.execute(
-            "UPDATE jobs
-	             SET status = 'waiting_for_user',
-	                 blocker_json = ?1,
-	                 checkpoint_json = ?2,
-	                 claim_expires_at = ?3
-	             WHERE job_id = ?4",
-            params![
-                serde_json::to_string(&json!({ "blocker": { "code": "legacy_wait" } })).unwrap(),
-                serde_json::to_string(&json!({ "checkpoint": { "legacy": true } })).unwrap(),
-                1_050_i64,
-                claimed.job_id
-            ],
-        )
-        .unwrap();
-
-        assert_eq!(store.requeue_expired_claims_at(1_100).unwrap(), 0);
-        let failed = store.get_job(&created.job_id).unwrap();
-        assert_eq!(failed.execution_backend, ExecutionBackend::LegacyExtension);
-        assert_eq!(failed.status, JobStatus::Failed);
-        assert_eq!(
-            failed.error_json.unwrap()["code"],
-            "playwright_user_handover_lease_lost"
-        );
-        assert_eq!(failed.blocker_json, None);
-        assert_eq!(failed.checkpoint_json, None);
-        assert_eq!(failed.resume_json, None);
-        assert_eq!(failed.claim_expires_at_ms, None);
-    }
-
-    #[test]
-    fn migrates_existing_database_and_requeues_unleased_claim() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let database_path = tempdir.path().join(DATABASE_FILE_NAME);
-        let conn = Connection::open(&database_path).unwrap();
-        conn.execute_batch(
-            r#"CREATE TABLE jobs (
-                job_id TEXT PRIMARY KEY NOT NULL,
-                claim_token TEXT NOT NULL,
-                provider TEXT NOT NULL,
-                action TEXT NOT NULL,
-                status TEXT NOT NULL,
-                request_json TEXT NOT NULL,
-                result_json TEXT,
-                error_json TEXT,
-                created_at TEXT NOT NULL,
-                updated_at TEXT NOT NULL
-             );
-             INSERT INTO jobs VALUES (
-                'legacy-job', 'legacy-token', 'chatgpt', 'submit', 'claimed',
-                '{"taskId":"legacy-task","metadata":{"projectName":"Legacy"}}',
-                NULL, NULL, '2025-01-01T00:00:00.000Z',
-                '2025-01-01T00:00:00.000Z'
-             );"#,
-        )
-        .unwrap();
-        drop(conn);
-
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let migrated = store.get_job("legacy-job").unwrap();
-        assert_eq!(migrated.status, JobStatus::Queued);
-        assert_eq!(
-            migrated.execution_backend,
-            ExecutionBackend::LegacyExtension
-        );
-        assert_eq!(migrated.profile_id, None);
-        assert_ne!(migrated.claim_token, "legacy-token");
-        assert_eq!(migrated.claim_expires_at_ms, None);
-        let conn = Connection::open(store.database_path()).unwrap();
-        assert!(sqlite_column_exists(&conn, "jobs", "claim_expires_at").unwrap());
-        assert!(sqlite_column_exists(&conn, "jobs", "execution_backend").unwrap());
-        assert!(sqlite_column_exists(&conn, "jobs", "profile_id").unwrap());
-        assert!(sqlite_column_exists(&conn, "jobs", "checkpoint_json").unwrap());
-        assert!(sqlite_column_exists(&conn, "jobs", "resume_json").unwrap());
-        assert!(sqlite_column_exists(&conn, "jobs", "summary_task_id").unwrap());
-        assert!(sqlite_table_exists(&conn, "job_task_keys").unwrap());
-        let (execution_backend, profile_id): (String, Option<String>) = conn
-            .query_row(
-                "SELECT execution_backend, profile_id FROM jobs WHERE job_id = 'legacy-job'",
-                [],
-                |row| Ok((row.get(0)?, row.get(1)?)),
-            )
-            .unwrap();
-        assert_eq!(execution_backend, "legacy_extension");
-        assert_eq!(profile_id, None);
-        let filtered = store
-            .list_jobs(ListJobs {
-                provider: Some("chatgpt".to_owned()),
-                task_id: Some("legacy-task".to_owned()),
-                ..ListJobs::default()
-            })
-            .unwrap();
-        assert_eq!(filtered.len(), 1);
-        assert_eq!(filtered[0].job_id, "legacy-job");
-        let summary = store.list_job_summaries(None).unwrap().remove(0);
-        assert_eq!(summary.task_id.as_deref(), Some("legacy-task"));
-        assert_eq!(summary.project_name.as_deref(), Some("Legacy"));
-    }
-
-    #[test]
-    fn rebuilds_existing_status_check_for_waiting_and_preserves_task_keys() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let database_path = tempdir.path().join(DATABASE_FILE_NAME);
-        let conn = Connection::open(&database_path).unwrap();
-        conn.execute_batch(
-            r#"CREATE TABLE jobs (
-                job_id TEXT PRIMARY KEY NOT NULL,
-                claim_token TEXT NOT NULL,
-                execution_backend TEXT NOT NULL DEFAULT 'legacy_extension' CHECK (
-                    execution_backend IN ('legacy_extension', 'playwright')
-                ),
-                profile_id TEXT CHECK (
-                    profile_id IS NULL OR length(profile_id) BETWEEN 1 AND 128
-                ),
-                provider TEXT NOT NULL,
-                action TEXT NOT NULL,
-                status TEXT NOT NULL CHECK (
-                    status IN (
-                        'queued',
-                        'claimed',
-                        'running',
-                        'succeeded',
-                        'failed',
-                        'canceled',
-                        'timed_out'
-                    )
-                ),
-                request_json TEXT NOT NULL,
-                result_json TEXT,
-                error_json TEXT,
-                created_at TEXT NOT NULL,
-                updated_at TEXT NOT NULL,
-                claim_expires_at INTEGER,
-                summary_task_id TEXT
-             );
-             CREATE TABLE job_task_keys (
-                job_id TEXT NOT NULL REFERENCES jobs(job_id) ON DELETE CASCADE,
-                task_id TEXT NOT NULL,
-                PRIMARY KEY (job_id, task_id)
-             );
-             INSERT INTO jobs (
-                job_id, claim_token, execution_backend, profile_id, provider,
-                action, status, request_json, result_json, error_json,
-                created_at, updated_at, claim_expires_at, summary_task_id
-             ) VALUES (
-                'modern-old-check', 'token', 'playwright', 'work', 'chatgpt',
-                'visible_provider_actions', 'queued', '{"taskId":"task-1","metadata":{"projectName":"Migrated Project","chatName":"Migrated Chat","idempotencyKey":"idem-1"}}',
-                NULL, NULL, '2026-01-01T00:00:00.000Z',
-                '2026-01-01T00:00:00.000Z', NULL, 'task-1'
-             );
-             INSERT INTO job_task_keys VALUES ('modern-old-check', 'task-1');"#,
-        )
-        .unwrap();
-        drop(conn);
-
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let conn = Connection::open(store.database_path()).unwrap();
-        let create_sql: String = conn
-            .query_row(
-                "SELECT sql FROM sqlite_schema WHERE type = 'table' AND name = 'jobs'",
-                [],
-                |row| row.get(0),
-            )
-            .unwrap();
-        assert!(create_sql.contains("'waiting_for_user'"));
-        assert!(sqlite_column_exists(&conn, "jobs", "blocker_json").unwrap());
-        assert!(sqlite_column_exists(&conn, "jobs", "checkpoint_json").unwrap());
-        assert!(sqlite_column_exists(&conn, "jobs", "resume_json").unwrap());
-        let violations: i64 = conn
-            .query_row("SELECT COUNT(*) FROM pragma_foreign_key_check", [], |row| {
-                row.get(0)
-            })
-            .unwrap();
-        assert_eq!(violations, 0);
-        let claimed = store
-            .claim_next_job_with_scope(
-                ClaimNextJob::default(),
-                ExecutionBackend::Playwright,
-                Some("work".to_owned()),
-            )
-            .unwrap()
-            .unwrap();
-        store
-            .mark_running(&claimed.job_id, &claimed.claim_token)
-            .unwrap();
-        let waiting = store
-            .mark_waiting_for_user(
-                &claimed.job_id,
-                &claimed.claim_token,
-                UserBlocker {
-                    blocker_json: json!({ "blocker": { "code": "visible_recaptcha" } }),
-                },
-            )
-            .unwrap();
-        assert_eq!(waiting.status, JobStatus::WaitingForUser);
-        assert_eq!(
-            store
-                .list_jobs(ListJobs {
-                    status: Some(JobStatus::WaitingForUser),
-                    task_id: Some("task-1".to_owned()),
-                    ..ListJobs::default()
-                })
-                .unwrap()
-                .len(),
-            1
-        );
-        let summary = store.list_job_summaries(None).unwrap().remove(0);
-        assert_eq!(summary.task_id.as_deref(), Some("task-1"));
-        assert_eq!(summary.project_name.as_deref(), Some("Migrated Project"));
-        assert_eq!(summary.chat_name.as_deref(), Some("Migrated Chat"));
-        assert_eq!(summary.idempotency_key.as_deref(), Some("idem-1"));
-    }
-
-    #[test]
-    fn cancel_and_completion_race_has_one_terminal_winner() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let created = store
-            .create_job(CreateJob::new(
-                "claude",
-                "submit",
-                json!({ "prompt": "race cancellation" }),
-            ))
-            .unwrap();
-        let claimed = store
-            .claim_next_job(ClaimNextJob::default())
-            .unwrap()
-            .unwrap();
-        store
-            .mark_running(&claimed.job_id, &claimed.claim_token)
-            .unwrap();
-        let barrier = Arc::new(Barrier::new(2));
-        let complete_home = tempdir.path().to_path_buf();
-        let complete_job_id = created.job_id.clone();
-        let claim_token = claimed.claim_token.clone();
-        let complete_barrier = Arc::clone(&barrier);
-        let complete = thread::spawn(move || {
-            let store = JobStore::open(complete_home).unwrap();
-            complete_barrier.wait();
-            store
-                .complete_job(
-                    &complete_job_id,
-                    &claim_token,
-                    CompleteJob::Succeeded {
-                        result_json: json!({ "text": "done" }),
-                    },
-                )
-                .is_ok()
-        });
-        let cancel_home = tempdir.path().to_path_buf();
-        let cancel_job_id = created.job_id.clone();
-        let cancel_barrier = Arc::clone(&barrier);
-        let cancel = thread::spawn(move || {
-            let store = JobStore::open(cancel_home).unwrap();
-            cancel_barrier.wait();
-            store
-                .cancel_job(&cancel_job_id, Some(json!({ "source": "test" })))
-                .is_ok()
-        });
-
-        let winner_count = [complete.join().unwrap(), cancel.join().unwrap()]
-            .into_iter()
-            .filter(|won| *won)
-            .count();
-        assert_eq!(winner_count, 1);
-        assert!(matches!(
-            store.get_job(&created.job_id).unwrap().status,
-            JobStatus::Succeeded | JobStatus::Canceled
-        ));
-    }
-
-    #[test]
-    fn canceling_queued_job_cleans_staged_visible_attachment_bundle() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let bundle_path = store.home_dir().join("attachments").join("cancel-bundle");
-        fs::create_dir_all(&bundle_path).unwrap();
-        fs::write(bundle_path.join("cancel-attachment.bin"), b"cancel me").unwrap();
-        let job = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({
-                    "prompt": "cancel this upload",
-                    "attachments": [{
-                        "protocol": native_host::VISIBLE_ATTACHMENT_PROTOCOL,
-                        "bundleId": "cancel-bundle",
-                        "attachmentId": "cancel-attachment",
-                        "name": "cancel.txt",
-                        "type": "text/plain",
-                        "size": 9,
-                        "sha256": "0".repeat(64),
-                    }],
-                }),
-            ))
-            .unwrap();
-
-        let canceled = store
-            .cancel_job(&job.job_id, Some(json!({ "source": "test" })))
-            .unwrap();
-
-        assert_eq!(canceled.status, JobStatus::Canceled);
-        assert!(!bundle_path.exists());
-    }
-
-    #[tokio::test]
-    async fn serve_http_rejects_non_loopback_host() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let host = "0.0.0.0".parse().unwrap();
-
-        let error = serve_http(store, host, 0).await.unwrap_err();
-
-        assert!(matches!(error, DaemonError::NonLoopbackBind(rejected) if rejected == host));
-    }
-
-    #[test]
-    fn ready_proof_canonicalization_matches_cross_runtime_vector() {
-        let challenge = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
-        let message = daemon_ready_proof_message(challenge, "/tmp/tokenless").unwrap();
-        assert_eq!(
-            URL_SAFE_NO_PAD.encode(&message),
-            "AAAAH3Rva2VubGVzcy5kYWVtb24tcmVhZHktcHJvb2YudjEAAAArQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQQAAABN0b2tlbmxlc3MuZGFlbW9uLnYxAAAAE3Rva2VubGVzcy5uYXRpdmUudjEAAAAOL3RtcC90b2tlbmxlc3M"
-        );
-        let mut mac = Hmac::<Sha256>::new_from_slice(b"test-token").unwrap();
-        mac.update(&message);
-        assert_eq!(
-            URL_SAFE_NO_PAD.encode(mac.finalize().into_bytes()),
-            "vYXXNpnWk4LydLbkLQct3XG73zkiHyWOCWt5A3Skd_c"
-        );
-    }
-
-    #[test]
-    fn process_proof_canonicalization_binds_pid_and_instance_without_changing_ready_v1() {
-        let challenge = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
-        let ready_message = daemon_ready_proof_message(challenge, "/tmp/tokenless").unwrap();
-        let process_message = daemon_process_proof_message(
-            challenge,
-            "/tmp/tokenless",
-            12345,
-            "AAAAAAAAAAAAAAAAAAAAAA",
-            "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
-        )
-        .unwrap();
-
-        assert_ne!(ready_message, process_message);
-        assert_eq!(
-            URL_SAFE_NO_PAD.encode(&ready_message),
-            "AAAAH3Rva2VubGVzcy5kYWVtb24tcmVhZHktcHJvb2YudjEAAAArQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQQAAABN0b2tlbmxlc3MuZGFlbW9uLnYxAAAAE3Rva2VubGVzcy5uYXRpdmUudjEAAAAOL3RtcC90b2tlbmxlc3M"
-        );
-        let mut expected_fields = [
-            DAEMON_PROCESS_PROOF_PROTOCOL,
-            challenge,
-            DAEMON_PROTOCOL,
-            native_host::NATIVE_PROTOCOL,
-            "/tmp/tokenless",
-            "12345",
-            "AAAAAAAAAAAAAAAAAAAAAA",
-            "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
-        ]
-        .into_iter();
-        let mut offset = 0;
-        while offset < process_message.len() {
-            let length = u32::from_be_bytes(process_message[offset..offset + 4].try_into().unwrap())
-                as usize;
-            offset += 4;
-            let field = std::str::from_utf8(&process_message[offset..offset + length]).unwrap();
-            assert_eq!(Some(field), expected_fields.next());
-            offset += length;
-        }
-        assert!(expected_fields.next().is_none());
-    }
-
-    #[tokio::test]
-    async fn ready_requires_challenge_and_returns_token_bound_hmac_proof() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let token = store.control_token().unwrap();
-        let canonical_home = store.home_dir().to_string_lossy().into_owned();
-        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let base_url = format!("http://{}", listener.local_addr().unwrap());
-        let server_store = store.clone();
-        let server = tokio::spawn(async move {
-            serve_http_listener(server_store, listener).await.unwrap();
-        });
-        let client = reqwest::Client::new();
-
-        let health: Value = client
-            .get(format!("{base_url}/health"))
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        assert_eq!(health["ready"], true);
-        assert!(health.get("ready_proof").is_none());
-        assert!(health.get("ready_challenge").is_none());
-
-        let first_challenge = URL_SAFE_NO_PAD.encode([7_u8; READY_CHALLENGE_BYTES]);
-        let first: Value = client
-            .get(format!("{base_url}/ready?challenge={first_challenge}"))
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        assert_eq!(first["protocol"], DAEMON_PROTOCOL);
-        assert_eq!(first["daemon_protocol"], DAEMON_PROTOCOL);
-        assert_eq!(first["native_protocol"], native_host::NATIVE_PROTOCOL);
-        assert_eq!(first["home_dir"], canonical_home);
-        assert_eq!(first["ready"], true);
-        assert_eq!(first["ready_proof_protocol"], DAEMON_READY_PROOF_PROTOCOL);
-        assert_eq!(first["ready_challenge"], first_challenge);
-        assert_eq!(
-            first["daemon_process_proof_protocol"],
-            DAEMON_PROCESS_PROOF_PROTOCOL
-        );
-        assert_eq!(first["pid"], std::process::id());
-        let instance_id = first["instance_id"].as_str().unwrap();
-        assert_eq!(instance_id.len(), 22);
-        let running_binary_hash = first["running_binary_hash"].as_str().unwrap();
-        assert_eq!(running_binary_hash.len(), 64);
-        assert!(running_binary_hash
-            .bytes()
-            .all(|byte| byte.is_ascii_hexdigit()));
-        let first_proof = first["ready_proof"].as_str().unwrap();
-        assert_eq!(URL_SAFE_NO_PAD.decode(first_proof).unwrap().len(), 32);
-        let first_process_proof = first["daemon_process_proof"].as_str().unwrap();
-        assert_eq!(
-            URL_SAFE_NO_PAD.decode(first_process_proof).unwrap().len(),
-            32
-        );
-
-        let message = daemon_ready_proof_message(&first_challenge, &canonical_home).unwrap();
-        let mut expected_fields = [
-            DAEMON_READY_PROOF_PROTOCOL,
-            first_challenge.as_str(),
-            DAEMON_PROTOCOL,
-            native_host::NATIVE_PROTOCOL,
-            canonical_home.as_str(),
-        ]
-        .into_iter();
-        let mut offset = 0;
-        while offset < message.len() {
-            let length =
-                u32::from_be_bytes(message[offset..offset + 4].try_into().unwrap()) as usize;
-            offset += 4;
-            let field = std::str::from_utf8(&message[offset..offset + length]).unwrap();
-            assert_eq!(Some(field), expected_fields.next());
-            offset += length;
-        }
-        assert!(expected_fields.next().is_none());
-
-        let mut expected_mac = Hmac::<Sha256>::new_from_slice(token.as_bytes()).unwrap();
-        expected_mac.update(&message);
-        assert_eq!(
-            first_proof,
-            URL_SAFE_NO_PAD.encode(expected_mac.finalize().into_bytes())
-        );
-        let process_message = daemon_process_proof_message(
-            &first_challenge,
-            &canonical_home,
-            std::process::id(),
-            instance_id,
-            running_binary_hash,
-        )
-        .unwrap();
-        let mut expected_process_mac = Hmac::<Sha256>::new_from_slice(token.as_bytes()).unwrap();
-        expected_process_mac.update(&process_message);
-        assert_eq!(
-            first_process_proof,
-            URL_SAFE_NO_PAD.encode(expected_process_mac.finalize().into_bytes())
-        );
-        assert!(!serde_json::to_string(&first).unwrap().contains(&token));
-
-        let second_challenge = URL_SAFE_NO_PAD.encode([8_u8; READY_CHALLENGE_BYTES]);
-        let second: Value = client
-            .get(format!("{base_url}/ready?challenge={second_challenge}"))
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        assert_eq!(second["ready_challenge"], second_challenge);
-        assert_ne!(second["ready_proof"], first["ready_proof"]);
-
-        let invalid_paths = vec![
-            "/ready".to_owned(),
-            "/ready?challenge=not-base64!".to_owned(),
-            format!(
-                "/ready?challenge={}",
-                URL_SAFE_NO_PAD.encode([9_u8; READY_CHALLENGE_BYTES - 1])
-            ),
-            format!("/ready?challenge={first_challenge}%3D"),
-        ];
-        for invalid_path in invalid_paths {
-            let response = client
-                .get(format!("{base_url}{invalid_path}"))
-                .send()
-                .await
-                .unwrap();
-            assert_eq!(response.status(), StatusCode::BAD_REQUEST);
-            let body = response.text().await.unwrap();
-            assert!(!body.contains("ready_proof"));
-            assert!(!body.contains(&token));
-        }
-
-        server.abort();
-    }
-
-    #[tokio::test]
-    async fn http_create_list_get_claim_and_complete_flow_uses_temp_home() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let control_token = store.control_token().unwrap();
-        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let base_url = format!("http://{}", listener.local_addr().unwrap());
-        let server = tokio::spawn(async move {
-            serve_http_listener(store, listener).await.unwrap();
-        });
-        let client = reqwest::Client::new();
-
-        let health: Value = client
-            .get(format!("{base_url}/health"))
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        assert_eq!(health["protocol"], "tokenless.daemon.v1");
-        assert_eq!(health["daemon_protocol"], "tokenless.daemon.v1");
-        assert_eq!(health["native_protocol"], "tokenless.native.v1");
-        assert_eq!(health["version"], env!("CARGO_PKG_VERSION"));
-        assert_eq!(health["status"], "ok");
-        assert_eq!(health["ready"], true);
-        assert_eq!(
-            health["home_dir"],
-            fs::canonicalize(tempdir.path())
-                .unwrap()
-                .to_string_lossy()
-                .as_ref()
-        );
-
-        let created: Value = client
-            .post(format!("{base_url}/jobs"))
-            .bearer_auth(&control_token)
-            .json(&json!({
-                "provider": "chatgpt",
-                "action": "submit_and_read",
-                "request_json": {
-                    "prompt": "hello from http",
-                    "metadata": { "taskId": "http-task" }
-                }
-            }))
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        let job_id = created["job_id"].as_str().unwrap().to_owned();
-        let claim_token = created["claim_token"].as_str().unwrap().to_owned();
-        assert_eq!(created["status"], "queued");
-        assert_eq!(created["execution_backend"], "legacy_extension");
-        assert_eq!(created["profile_id"], Value::Null);
-
-        let listed: Value = client
-            .get(format!("{base_url}/jobs"))
-            .bearer_auth(&control_token)
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        assert_eq!(listed.as_array().unwrap().len(), 1);
-        assert_eq!(listed[0]["job_id"], job_id);
-        assert!(listed[0].get("claim_token").is_none());
-
-        let filtered: Value = client
-            .get(format!(
-                "{base_url}/jobs?provider=chatgpt&task_id=http-task&limit=1"
-            ))
-            .bearer_auth(&control_token)
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        assert_eq!(filtered.as_array().unwrap().len(), 1);
-        assert_eq!(filtered[0]["job_id"], job_id);
-
-        let got: Value = client
-            .get(format!("{base_url}/jobs/{job_id}"))
-            .bearer_auth(&control_token)
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        assert_eq!(got["job_id"], job_id);
-        assert!(got.get("claim_token").is_none());
-
-        let rejected_claim = client
-            .post(format!("{base_url}/jobs/{job_id}/claim"))
-            .bearer_auth(&control_token)
-            .json(&json!({ "claim_token": "wrong-token" }))
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(rejected_claim.status(), StatusCode::FORBIDDEN);
-
-        let claimed: Value = client
-            .post(format!("{base_url}/jobs/{job_id}/claim"))
-            .bearer_auth(&control_token)
-            .json(&json!({ "claim_token": claim_token }))
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        assert_eq!(claimed["status"], "claimed");
-        assert!(claimed.get("claim_token").is_none());
-
-        let legacy_checkpoint = client
-            .post(format!("{base_url}/control/jobs/{job_id}/checkpoint"))
-            .bearer_auth(&control_token)
-            .json(&json!({
-                "claim_token": claim_token,
-                "checkpoint_json": { "checkpoint": { "legacy": true } }
-            }))
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(legacy_checkpoint.status(), StatusCode::BAD_REQUEST);
-        let legacy_checkpoint_body: Value = legacy_checkpoint.json().await.unwrap();
-        assert!(legacy_checkpoint_body["error"]["message"]
-            .as_str()
-            .unwrap()
-            .contains("only playwright jobs"));
-
-        let completed: Value = client
-            .post(format!("{base_url}/jobs/{job_id}/complete"))
-            .bearer_auth(&control_token)
-            .json(&json!({
-                    "claim_token": claim_token,
-                "result_json": { "text": "done" }
-            }))
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        assert_eq!(completed["status"], "succeeded");
-        assert_eq!(completed["result_json"], json!({ "text": "done" }));
-        assert!(completed.get("claim_token").is_none());
-        assert!(tempdir.path().join(DATABASE_FILE_NAME).exists());
-
-        server.abort();
-    }
-
-    #[tokio::test]
-    async fn http_create_validation_and_exact_backend_profile_filters() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let control_token = store.control_token().unwrap();
-        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let base_url = format!("http://{}", listener.local_addr().unwrap());
-        let server = tokio::spawn(async move {
-            serve_http_listener(store, listener).await.unwrap();
-        });
-        let client = reqwest::Client::new();
-
-        let missing_profile = client
-            .post(format!("{base_url}/jobs"))
-            .bearer_auth(&control_token)
-            .json(&json!({
-                "provider": "chatgpt",
-                "action": "submit",
-                "execution_backend": "playwright",
-                "request_json": { "prompt": "missing profile" }
-            }))
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(missing_profile.status(), StatusCode::BAD_REQUEST);
-
-        let legacy_with_profile = client
-            .post(format!("{base_url}/jobs"))
-            .bearer_auth(&control_token)
-            .json(&json!({
-                "provider": "chatgpt",
-                "action": "submit",
-                "profile_id": "work",
-                "request_json": { "prompt": "bad legacy profile" }
-            }))
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(legacy_with_profile.status(), StatusCode::BAD_REQUEST);
-
-        let unknown_backend = client
-            .post(format!("{base_url}/jobs"))
-            .bearer_auth(&control_token)
-            .json(&json!({
-                "provider": "chatgpt",
-                "action": "submit",
-                "execution_backend": "selenium",
-                "request_json": { "prompt": "unknown backend" }
-            }))
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(unknown_backend.status(), StatusCode::BAD_REQUEST);
-
-        let created: Value = client
-            .post(format!("{base_url}/jobs"))
-            .bearer_auth(&control_token)
-            .json(&json!({
-                "provider": "chatgpt",
-                "action": "submit",
-                "execution_backend": "playwright",
-                "profile_id": "work",
-                "request_json": { "prompt": "managed profile" }
-            }))
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        assert_eq!(created["execution_backend"], "playwright");
-        assert_eq!(created["profile_id"], "work");
-
-        let filtered: Value = client
-            .get(format!(
-                "{base_url}/jobs?execution_backend=playwright&profile_id=work"
-            ))
-            .bearer_auth(&control_token)
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        assert_eq!(filtered.as_array().unwrap().len(), 1);
-        assert_eq!(filtered[0]["job_id"], created["job_id"]);
-        assert_eq!(filtered[0]["profile_id"], "work");
-
-        let invalid_filter = client
-            .get(format!(
-                "{base_url}/jobs?execution_backend=legacy_extension&profile_id=work"
-            ))
-            .bearer_auth(&control_token)
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(invalid_filter.status(), StatusCode::BAD_REQUEST);
-
-        server.abort();
-    }
-
-    #[tokio::test]
-    async fn every_job_http_endpoint_requires_bearer_auth() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let job = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "must remain queued" }),
-            ))
-            .unwrap();
-        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let base_url = format!("http://{}", listener.local_addr().unwrap());
-        let server_store = store.clone();
-        let server = tokio::spawn(async move {
-            serve_http_listener(server_store, listener).await.unwrap();
-        });
-        let client = reqwest::Client::new();
-
-        let create = client
-            .post(format!("{base_url}/jobs"))
-            .json(&json!({
-                "provider": "chatgpt",
-                "action": "submit",
-                "request_json": { "prompt": "unauthorized" }
-            }))
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(create.status(), StatusCode::UNAUTHORIZED);
-
-        let list = client
-            .get(format!("{base_url}/jobs"))
-            .bearer_auth("wrong-token")
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(list.status(), StatusCode::FORBIDDEN);
-
-        let get = client
-            .get(format!("{base_url}/jobs/{}", job.job_id))
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(get.status(), StatusCode::UNAUTHORIZED);
-
-        let claim = client
-            .post(format!("{base_url}/jobs/{}/claim", job.job_id))
-            .json(&json!({ "claim_token": job.claim_token }))
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(claim.status(), StatusCode::UNAUTHORIZED);
-
-        let complete = client
-            .post(format!("{base_url}/jobs/{}/complete", job.job_id))
-            .json(&json!({
-                "claim_token": job.claim_token,
-                "result_json": { "text": "unauthorized" }
-            }))
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(complete.status(), StatusCode::UNAUTHORIZED);
-        let resume = client
-            .post(format!("{base_url}/jobs/{}/resume", job.job_id))
-            .json(&json!({ "browser_visibility": "headed" }))
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(resume.status(), StatusCode::UNAUTHORIZED);
-        let checkpoint = client
-            .post(format!("{base_url}/control/jobs/{}/checkpoint", job.job_id))
-            .json(&json!({
-                "claim_token": job.claim_token,
-                "checkpoint_json": { "checkpoint": true }
-            }))
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(checkpoint.status(), StatusCode::UNAUTHORIZED);
-        let park = client
-            .post(format!("{base_url}/control/jobs/{}/park", job.job_id))
-            .json(&json!({
-                "claim_token": job.claim_token,
-                "blocker_json": { "blocker": { "code": "visible_recaptcha" } },
-                "checkpoint_json": { "checkpoint": true }
-            }))
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(park.status(), StatusCode::UNAUTHORIZED);
-        let running = client
-            .post(format!("{base_url}/control/jobs/{}/running", job.job_id))
-            .json(&json!({ "claim_token": job.claim_token }))
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(running.status(), StatusCode::UNAUTHORIZED);
-        let waiting = client
-            .post(format!(
-                "{base_url}/control/jobs/{}/waiting-for-user",
-                job.job_id
-            ))
-            .json(&json!({
-                "claim_token": job.claim_token,
-                "blocker_json": { "blocker": { "code": "visible_recaptcha" } }
-            }))
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(waiting.status(), StatusCode::UNAUTHORIZED);
-        let renew = client
-            .post(format!("{base_url}/control/jobs/{}/renew", job.job_id))
-            .json(&json!({ "claim_token": job.claim_token }))
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(renew.status(), StatusCode::UNAUTHORIZED);
-        assert_eq!(
-            store.get_job(&job.job_id).unwrap().status,
-            JobStatus::Queued
-        );
-
-        server.abort();
-    }
-
-    #[tokio::test]
-    async fn http_control_claim_next_requires_bearer_token() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let base_url = format!("http://{}", listener.local_addr().unwrap());
-        let server = tokio::spawn(async move {
-            serve_http_listener(store, listener).await.unwrap();
-        });
-        let client = reqwest::Client::new();
-
-        let missing = client
-            .post(format!("{base_url}/control/jobs/claim-next"))
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(missing.status(), StatusCode::UNAUTHORIZED);
-        assert_json_content_type(&missing);
-        let missing_body: Value = missing.json().await.unwrap();
-        assert_eq!(missing_body["error"]["message"], "missing bearer token");
-
-        let wrong = client
-            .post(format!("{base_url}/control/jobs/claim-next"))
-            .bearer_auth("wrong-token")
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(wrong.status(), StatusCode::FORBIDDEN);
-        assert_json_content_type(&wrong);
-        let wrong_body: Value = wrong.json().await.unwrap();
-        assert_eq!(wrong_body["error"]["message"], "invalid bearer token");
-
-        server.abort();
-    }
-
-    #[tokio::test]
-    async fn http_control_cancel_requires_auth_and_records_structured_reason() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let control_token = store.control_token().unwrap();
-        let job = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "cancel me" }),
-            ))
-            .unwrap();
-        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let base_url = format!("http://{}", listener.local_addr().unwrap());
-        let server_store = store.clone();
-        let server = tokio::spawn(async move {
-            serve_http_listener(server_store, listener).await.unwrap();
-        });
-        let client = reqwest::Client::new();
-
-        let unauthorized = client
-            .post(format!("{base_url}/control/jobs/{}/cancel", job.job_id))
-            .json(&json!({}))
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(unauthorized.status(), StatusCode::UNAUTHORIZED);
-        assert_eq!(
-            store.get_job(&job.job_id).unwrap().status,
-            JobStatus::Queued
-        );
-
-        let canceled: Value = client
-            .post(format!("{base_url}/control/jobs/{}/cancel", job.job_id))
-            .bearer_auth(control_token)
-            .json(&json!({ "reason": { "code": "client_timeout" } }))
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        assert_eq!(canceled["status"], "canceled");
-        assert_eq!(canceled["error_json"]["code"], "job_canceled");
-        assert_eq!(canceled["error_json"]["reason"]["code"], "client_timeout");
-
-        let repeated = client
-            .post(format!("{base_url}/control/jobs/{}/cancel", job.job_id))
-            .bearer_auth(store.control_token().unwrap())
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(repeated.status(), StatusCode::CONFLICT);
-        server.abort();
-    }
-
-    #[tokio::test]
-    async fn http_control_claim_next_returns_token_bearing_job() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let control_token = store.control_token().unwrap();
-        let first = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit_and_read",
-                json!({ "prompt": "first via http" }),
-            ))
-            .unwrap();
-        let second = store
-            .create_job(CreateJob::new(
-                "claude",
-                "submit",
-                json!({ "prompt": "second via http" }),
-            ))
-            .unwrap();
-        let server_store = store.clone();
-        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let base_url = format!("http://{}", listener.local_addr().unwrap());
-        let server = tokio::spawn(async move {
-            serve_http_listener(server_store, listener).await.unwrap();
-        });
-        let client = reqwest::Client::new();
-
-        let response: Value = client
-            .post(format!(
-                "{base_url}/control/jobs/claim-next?provider=chatgpt&action=submit_and_read"
-            ))
-            .bearer_auth(control_token)
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-
-        assert_eq!(response["job"]["job_id"], first.job_id);
-        assert_ne!(response["job"]["claim_token"], first.claim_token);
-        assert_eq!(response["job"]["status"], "claimed");
-        assert_eq!(
-            store.get_job(&first.job_id).unwrap().status,
-            JobStatus::Claimed
-        );
-        assert_eq!(
-            store.get_job(&second.job_id).unwrap().status,
-            JobStatus::Queued
-        );
-
-        server.abort();
-    }
-
-    #[tokio::test]
-    async fn http_control_claim_next_mark_running_and_renew_are_profile_scoped() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store =
-            JobStore::open_with_claim_lease(tempdir.path(), std::time::Duration::from_secs(60))
-                .unwrap();
-        let control_token = store.control_token().unwrap();
-        let work = create_playwright_job(&store, "work", "work");
-        let personal = create_playwright_job(&store, "personal", "personal");
-        let server_store = store.clone();
-        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let base_url = format!("http://{}", listener.local_addr().unwrap());
-        let server = tokio::spawn(async move {
-            serve_http_listener(server_store, listener).await.unwrap();
-        });
-        let client = reqwest::Client::new();
-
-        let missing_profile = client
-            .post(format!(
-                "{base_url}/control/jobs/claim-next?execution_backend=playwright"
-            ))
-            .bearer_auth(&control_token)
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(missing_profile.status(), StatusCode::BAD_REQUEST);
-
-        let claimed: Value = client
-            .post(format!(
-                "{base_url}/control/jobs/claim-next?execution_backend=playwright&profile_id=personal"
-            ))
-            .bearer_auth(&control_token)
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        assert_eq!(claimed["job"]["job_id"], personal.job_id);
-        assert_eq!(claimed["job"]["execution_backend"], "playwright");
-        assert_eq!(claimed["job"]["profile_id"], "personal");
-        let claim_token = claimed["job"]["claim_token"].as_str().unwrap();
-        assert_eq!(
-            store.get_job(&work.job_id).unwrap().status,
-            JobStatus::Queued
-        );
-
-        let running: Value = client
-            .post(format!(
-                "{base_url}/control/jobs/{}/running",
-                personal.job_id
-            ))
-            .bearer_auth(&control_token)
-            .json(&json!({ "claim_token": claim_token }))
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        assert_eq!(running["status"], "running");
-        assert_eq!(running["profile_id"], "personal");
-
-        let renewed: Value = client
-            .post(format!("{base_url}/control/jobs/{}/renew", personal.job_id))
-            .bearer_auth(&control_token)
-            .json(&json!({ "claim_token": claim_token }))
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        assert_eq!(renewed["status"], "running");
-
-        let waiting: Value = client
-            .post(format!(
-                "{base_url}/control/jobs/{}/waiting-for-user",
-                personal.job_id
-            ))
-            .bearer_auth(&control_token)
-            .json(&json!({
-                "claim_token": claim_token,
-                "blocker_json": { "blocker": { "code": "visible_hcaptcha" } }
-            }))
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        assert_eq!(waiting["status"], "waiting_for_user");
-        assert_eq!(
-            waiting["blocker_json"]["blocker"]["code"],
-            "visible_hcaptcha"
-        );
-
-        let resumed: Value = client
-            .post(format!(
-                "{base_url}/control/jobs/{}/running",
-                personal.job_id
-            ))
-            .bearer_auth(&control_token)
-            .json(&json!({ "claim_token": claim_token }))
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        assert_eq!(resumed["status"], "running");
-        assert_eq!(resumed["blocker_json"], Value::Null);
-
-        let wrong_token = client
-            .post(format!("{base_url}/control/jobs/{}/renew", personal.job_id))
-            .bearer_auth(&control_token)
-            .json(&json!({ "claim_token": "wrong-token" }))
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(wrong_token.status(), StatusCode::FORBIDDEN);
-
-        server.abort();
-    }
-
-    #[tokio::test]
-    async fn http_checkpoint_park_resume_keep_private_state_off_public_views() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store =
-            JobStore::open_with_claim_lease(tempdir.path(), std::time::Duration::from_secs(60))
-                .unwrap();
-        let control_token = store.control_token().unwrap();
-        let job = create_playwright_job(&store, "work", "http park resume");
-        let server_store = store.clone();
-        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let base_url = format!("http://{}", listener.local_addr().unwrap());
-        let server = tokio::spawn(async move {
-            serve_http_listener(server_store, listener).await.unwrap();
-        });
-        let client = reqwest::Client::new();
-
-        let claimed: Value = client
-            .post(format!(
-                "{base_url}/control/jobs/claim-next?execution_backend=playwright&profile_id=work"
-            ))
-            .bearer_auth(&control_token)
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        assert_eq!(claimed["job"]["job_id"], job.job_id);
-        assert_eq!(claimed["job"]["checkpoint_json"], Value::Null);
-        assert_eq!(claimed["job"]["resume_json"], Value::Null);
-        let claim_token = claimed["job"]["claim_token"].as_str().unwrap();
-
-        let checkpoint = client
-            .post(format!("{base_url}/control/jobs/{}/checkpoint", job.job_id))
-            .bearer_auth(&control_token)
-            .json(&json!({
-                "claim_token": claim_token,
-                "checkpoint_json": { "checkpoint": { "step": "claimed" } }
-            }))
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json::<Value>()
-            .await
-            .unwrap();
-        assert_eq!(checkpoint["status"], "claimed");
-        assert!(checkpoint.get("claim_token").is_none());
-        assert!(checkpoint.get("checkpoint_json").is_none());
-        assert!(checkpoint.get("resume_json").is_none());
-
-        let parked = client
-            .post(format!("{base_url}/control/jobs/{}/park", job.job_id))
-            .bearer_auth(&control_token)
-            .json(&json!({
-                "claim_token": claim_token,
-                "blocker_json": { "blocker": { "code": "visible_recaptcha" } },
-                "checkpoint_json": { "checkpoint": { "step": "parked" } }
-            }))
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json::<Value>()
-            .await
-            .unwrap();
-        assert_eq!(parked["status"], "waiting_for_user");
-        assert_eq!(
-            parked["blocker_json"]["blocker"]["code"],
-            "visible_recaptcha"
-        );
-        assert!(parked.get("checkpoint_json").is_none());
-        assert!(parked.get("resume_json").is_none());
-        assert!(matches!(
-            store.renew_claim(&job.job_id, claim_token),
-            Err(DaemonError::ClaimRejected(_))
-        ));
-
-        let invalid_extra_field = client
-            .post(format!("{base_url}/jobs/{}/resume", job.job_id))
-            .bearer_auth(&control_token)
-            .json(&json!({
-                "browser_visibility": "headed",
-                "checkpoint_json": { "leak": true }
-            }))
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(invalid_extra_field.status(), StatusCode::BAD_REQUEST);
-
-        let invalid_visibility = client
-            .post(format!("{base_url}/jobs/{}/resume", job.job_id))
-            .bearer_auth(&control_token)
-            .json(&json!({ "browser_visibility": "headless" }))
-            .send()
-            .await
-            .unwrap();
-        assert_eq!(invalid_visibility.status(), StatusCode::BAD_REQUEST);
-
-        let resumed = client
-            .post(format!("{base_url}/jobs/{}/resume", job.job_id))
-            .bearer_auth(&control_token)
-            .json(&json!({ "browser_visibility": "headed" }))
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json::<Value>()
-            .await
-            .unwrap();
-        assert_eq!(resumed["status"], "queued");
-        assert!(resumed.get("checkpoint_json").is_none());
-        assert!(resumed.get("resume_json").is_none());
-
-        let listed: Value = client
-            .get(format!(
-                "{base_url}/jobs?execution_backend=playwright&profile_id=work"
-            ))
-            .bearer_auth(&control_token)
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        assert!(listed[0].get("checkpoint_json").is_none());
-        assert!(listed[0].get("resume_json").is_none());
-
-        let got: Value = client
-            .get(format!("{base_url}/jobs/{}", job.job_id))
-            .bearer_auth(&control_token)
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        assert!(got.get("checkpoint_json").is_none());
-        assert!(got.get("resume_json").is_none());
-
-        let reclaimed: Value = client
-            .post(format!(
-                "{base_url}/control/jobs/claim-next?execution_backend=playwright&profile_id=work"
-            ))
-            .bearer_auth(&control_token)
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        assert_eq!(
-            reclaimed["job"]["checkpoint_json"],
-            json!({ "checkpoint": { "step": "parked" } })
-        );
-        assert_eq!(
-            reclaimed["job"]["resume_json"],
-            json!({ "browser_visibility": "headed" })
-        );
-        assert_ne!(reclaimed["job"]["claim_token"], claim_token);
-
-        let repeat_resume: Value = client
-            .post(format!("{base_url}/jobs/{}/resume", job.job_id))
-            .bearer_auth(&control_token)
-            .json(&json!({ "browser_visibility": "headed" }))
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        assert_eq!(repeat_resume["status"], "claimed");
-
-        let reclaim_token = reclaimed["job"]["claim_token"].as_str().unwrap();
-        let running: Value = client
-            .post(format!("{base_url}/control/jobs/{}/running", job.job_id))
-            .bearer_auth(&control_token)
-            .json(&json!({ "claim_token": reclaim_token }))
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        assert_eq!(running["status"], "running");
-        assert_eq!(running["blocker_json"], Value::Null);
-        assert!(running.get("resume_json").is_none());
-        assert_eq!(
-            store.get_job(&job.job_id).unwrap().resume_json,
-            Some(json!({ "browser_visibility": "headed" }))
-        );
-
-        server.abort();
-    }
-
-    #[tokio::test]
-    async fn http_control_claim_next_returns_null_job_when_queue_is_empty() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let control_token = store.control_token().unwrap();
-        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let base_url = format!("http://{}", listener.local_addr().unwrap());
-        let server = tokio::spawn(async move {
-            serve_http_listener(store, listener).await.unwrap();
-        });
-        let client = reqwest::Client::new();
-
-        let response: Value = client
-            .post(format!("{base_url}/control/jobs/claim-next"))
-            .bearer_auth(control_token)
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-
-        assert_eq!(response, json!({ "job": null }));
-
-        server.abort();
-    }
-
-    #[tokio::test]
-    async fn http_control_concurrent_claim_next_cannot_claim_same_job() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let control_token = store.control_token().unwrap();
-        let job = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit_and_read",
-                json!({ "prompt": "http race next" }),
-            ))
-            .unwrap();
-        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let base_url = format!("http://{}", listener.local_addr().unwrap());
-        let server = tokio::spawn(async move {
-            serve_http_listener(store, listener).await.unwrap();
-        });
-        let client = reqwest::Client::new();
-        let first_request = client
-            .post(format!("{base_url}/control/jobs/claim-next"))
-            .bearer_auth(&control_token)
-            .send();
-        let second_request = client
-            .post(format!("{base_url}/control/jobs/claim-next"))
-            .bearer_auth(&control_token)
-            .send();
-
-        let (first_response, second_response) = tokio::join!(first_request, second_request);
-        let first_body: Value = first_response
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        let second_body: Value = second_response
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
-        let claimed_count = [first_body, second_body]
-            .into_iter()
-            .filter(|body| body["job"]["job_id"] == job.job_id)
-            .count();
-
-        assert_eq!(claimed_count, 1);
-
-        server.abort();
-    }
-
-    #[tokio::test]
-    async fn http_malformed_json_body_returns_json_error() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let control_token = store.control_token().unwrap();
-        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let base_url = format!("http://{}", listener.local_addr().unwrap());
-        let server = tokio::spawn(async move {
-            serve_http_listener(store, listener).await.unwrap();
-        });
-        let client = reqwest::Client::new();
-
-        let response = client
-            .post(format!("{base_url}/jobs"))
-            .bearer_auth(control_token)
-            .header("content-type", "application/json")
-            .body(r#"{"provider":"chatgpt","#)
-            .send()
-            .await
-            .unwrap();
-
-        assert_eq!(response.status(), StatusCode::BAD_REQUEST);
-        assert_json_content_type(&response);
-        let body: Value = response.json().await.unwrap();
-        let message = body["error"]["message"].as_str().unwrap();
-        assert!(message.contains("request body must be valid JSON"));
-
-        server.abort();
-    }
-
-    #[tokio::test]
-    async fn http_invalid_query_returns_json_error() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let control_token = store.control_token().unwrap();
-        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let base_url = format!("http://{}", listener.local_addr().unwrap());
-        let server = tokio::spawn(async move {
-            serve_http_listener(store, listener).await.unwrap();
-        });
-        let client = reqwest::Client::new();
-
-        let response = client
-            .get(format!("{base_url}/jobs?status=not_a_status"))
-            .bearer_auth(control_token)
-            .send()
-            .await
-            .unwrap();
-
-        assert_eq!(response.status(), StatusCode::BAD_REQUEST);
-        assert_json_content_type(&response);
-        let body: Value = response.json().await.unwrap();
-        let message = body["error"]["message"].as_str().unwrap();
-        assert!(message.contains("query parameters are invalid"));
-
-        server.abort();
-    }
-
-    fn create_playwright_job(store: &JobStore, profile_id: &str, prompt: &str) -> Job {
-        let mut input = CreateJob::new("chatgpt", "submit", json!({ "prompt": prompt }));
-        input.execution_backend = ExecutionBackend::Playwright;
-        input.profile_id = Some(profile_id.to_owned());
-        store.create_job(input).unwrap()
-    }
-
-    fn assert_json_content_type(response: &reqwest::Response) {
-        let content_type = response
-            .headers()
-            .get("content-type")
-            .and_then(|value| value.to_str().ok())
-            .unwrap_or_default();
-        assert!(content_type.starts_with("application/json"));
-    }
-}
diff --git a/packages/daemon/src/main.rs b/packages/daemon/src/main.rs
deleted file mode 100644
index b57c863..0000000
--- a/packages/daemon/src/main.rs
+++ /dev/null
@@ -1,186 +0,0 @@
-use clap::{Parser, Subcommand, ValueEnum};
-use serde::Serialize;
-use serde_json::{json, Value};
-use std::net::IpAddr;
-use std::path::PathBuf;
-use tokenless_daemon::{
-    native_binary_build_info, serve_http, CompleteJob, CreateJob, DaemonError, JobStatus, JobStore,
-    ListJobs, Result,
-};
-
-#[derive(Debug, Parser)]
-#[command(name = "tokenless-daemon")]
-#[command(about = "Tokenless local Rust control-plane foundation.")]
-struct Cli {
-    #[arg(long, global = true, env = "TOKENLESS_HOME")]
-    home: Option<PathBuf>,
-
-    #[command(subcommand)]
-    command: Command,
-}
-
-#[derive(Debug, Subcommand)]
-enum Command {
-    Init,
-    Create {
-        #[arg(long)]
-        provider: String,
-        #[arg(long)]
-        action: String,
-        #[arg(long)]
-        request_json: String,
-        #[arg(long)]
-        job_id: Option<String>,
-        #[arg(long)]
-        claim_token: Option<String>,
-    },
-    List {
-        #[arg(long)]
-        status: Option<StatusArg>,
-        #[arg(long)]
-        limit: Option<usize>,
-    },
-    Get {
-        job_id: String,
-    },
-    Claim {
-        job_id: String,
-        #[arg(long)]
-        claim_token: String,
-    },
-    Complete {
-        job_id: String,
-        #[arg(long)]
-        claim_token: String,
-        #[arg(long)]
-        result_json: Option<String>,
-        #[arg(long)]
-        error_json: Option<String>,
-    },
-    Serve {
-        #[arg(long, default_value = "127.0.0.1")]
-        host: IpAddr,
-        #[arg(long, default_value_t = 7331)]
-        port: u16,
-    },
-}
-
-#[derive(Debug, Clone, Copy, ValueEnum)]
-enum StatusArg {
-    Queued,
-    Claimed,
-    Running,
-    WaitingForUser,
-    Succeeded,
-    Failed,
-    Canceled,
-    TimedOut,
-}
-
-impl From<StatusArg> for JobStatus {
-    fn from(value: StatusArg) -> Self {
-        match value {
-            StatusArg::Queued => Self::Queued,
-            StatusArg::Claimed => Self::Claimed,
-            StatusArg::Running => Self::Running,
-            StatusArg::WaitingForUser => Self::WaitingForUser,
-            StatusArg::Succeeded => Self::Succeeded,
-            StatusArg::Failed => Self::Failed,
-            StatusArg::Canceled => Self::Canceled,
-            StatusArg::TimedOut => Self::TimedOut,
-        }
-    }
-}
-
-#[tokio::main]
-async fn main() {
-    if let Err(error) = run().await {
-        eprintln!("{error}");
-        std::process::exit(1);
-    }
-}
-
-async fn run() -> Result<()> {
-    let arguments = std::env::args_os().skip(1).collect::<Vec<_>>();
-    if arguments.len() == 1 && arguments[0] == "--tokenless-build-info" {
-        return print_json(&native_binary_build_info("tokenless-daemon"));
-    }
-    let cli = Cli::parse();
-    let store = match cli.home {
-        Some(home) => JobStore::open(home)?,
-        None => JobStore::open_default()?,
-    };
-
-    match cli.command {
-        Command::Init => print_json(&json!({
-            "home_dir": store.home_dir(),
-            "database_path": store.database_path(),
-            "control_token_path": store.control_token_path(),
-        })),
-        Command::Create {
-            provider,
-            action,
-            request_json,
-            job_id,
-            claim_token,
-        } => {
-            let request_json = parse_json_arg("request-json", &request_json)?;
-            let mut input = CreateJob::new(provider, action, request_json);
-            input.job_id = job_id;
-            input.claim_token = claim_token;
-            print_json(&store.create_job(input)?.with_claim_token())
-        }
-        Command::List { status, limit } => print_json(
-            &store
-                .list_jobs(ListJobs {
-                    status: status.map(Into::into),
-                    limit,
-                    ..ListJobs::default()
-                })?
-                .iter()
-                .map(|job| job.public_view())
-                .collect::<Vec<_>>(),
-        ),
-        Command::Get { job_id } => print_json(&store.get_job(&job_id)?.public_view()),
-        Command::Claim {
-            job_id,
-            claim_token,
-        } => print_json(&store.claim_job(&job_id, &claim_token)?.public_view()),
-        Command::Complete {
-            job_id,
-            claim_token,
-            result_json,
-            error_json,
-        } => {
-            let completion = match (result_json, error_json) {
-                (Some(result_json), None) => CompleteJob::Succeeded {
-                    result_json: parse_json_arg("result-json", &result_json)?,
-                },
-                (None, Some(error_json)) => CompleteJob::Failed {
-                    error_json: parse_json_arg("error-json", &error_json)?,
-                },
-                _ => {
-                    return Err(DaemonError::InvalidInput(
-                        "pass exactly one of --result-json or --error-json".to_owned(),
-                    ))
-                }
-            };
-            print_json(
-                &store
-                    .complete_job(&job_id, &claim_token, completion)?
-                    .public_view(),
-            )
-        }
-        Command::Serve { host, port } => serve_http(store, host, port).await,
-    }
-}
-
-fn parse_json_arg(name: &str, value: &str) -> Result<Value> {
-    serde_json::from_str(value)
-        .map_err(|error| DaemonError::InvalidInput(format!("{name} must be valid JSON: {error}")))
-}
-
-fn print_json(value: &impl Serialize) -> Result<()> {
-    println!("{}", serde_json::to_string_pretty(value)?);
-    Ok(())
-}
diff --git a/packages/daemon/src/native_host.rs b/packages/daemon/src/native_host.rs
deleted file mode 100644
index 1364bca..0000000
--- a/packages/daemon/src/native_host.rs
+++ /dev/null
@@ -1,2609 +0,0 @@
-// Retained inside the daemon crate for shared protocol constants, attachment
-// cleanup, and historical unit coverage. The Chrome Native Messaging binary is
-// archived under legacy/native-host/ and is no longer built or shipped.
-
-use crate::config::{write_json_atomic_secure, ConfigStore, ConfigUpdate};
-use crate::{ClaimNextJob, CompleteJob, DaemonError, Job, JobStatus, JobStore, JobSummary, Result};
-use base64::{engine::general_purpose::STANDARD, Engine as _};
-use chrono::{SecondsFormat, Utc};
-use fs2::FileExt;
-use serde::{Deserialize, Serialize};
-use serde_json::{json, Map, Value};
-use sha2::{Digest, Sha256};
-use std::collections::{HashMap, HashSet};
-use std::env;
-use std::ffi::OsString;
-use std::fs::{self, File, OpenOptions};
-use std::io::{ErrorKind, Read, Write};
-use std::path::{Path, PathBuf};
-use std::sync::mpsc::{self, RecvTimeoutError};
-use std::thread;
-use std::time::{Duration, Instant, SystemTime};
-use uuid::Uuid;
-
-pub const NATIVE_PROTOCOL: &str = "tokenless.native.v1";
-pub const BRIDGE_MARKER_PROTOCOL: &str = "tokenless.extension-bridge-state.v1";
-pub const BRIDGE_MARKER_FILE_NAME: &str = "extension-bridge.json";
-pub const MAX_NATIVE_INPUT_BYTES: usize = 16 * 1024 * 1024;
-pub const MAX_NATIVE_OUTPUT_BYTES: usize = 1024 * 1024;
-pub const NATIVE_INPUT_QUEUE_CAPACITY: usize = 4;
-pub const VISIBLE_ATTACHMENT_PROTOCOL: &str = "tokenless.visible-attachment.v1";
-pub const MAX_VISIBLE_ATTACHMENT_CHUNK_BYTES: usize = 512 * 1024;
-const MAX_VISIBLE_ATTACHMENTS: usize = 100;
-const MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES: u64 = 512 * 1024 * 1024;
-
-const BRIDGE_POLL_INTERVAL: Duration = Duration::from_millis(250);
-const BRIDGE_ERROR_INTERVAL: Duration = Duration::from_secs(1);
-const BRIDGE_HEARTBEAT_INTERVAL: Duration = Duration::from_secs(2);
-const CLAIM_RENEW_INTERVAL: Duration = Duration::from_secs(10);
-const EVENT_LOOP_INTERVAL: Duration = Duration::from_millis(50);
-const HISTORY_LIMIT: usize = 60;
-const BRIDGE_MARKER_LOCK_FILE_NAME: &str = ".extension-bridge.lock";
-const VISIBLE_ATTACHMENT_DIRECTORY: &str = "attachments";
-const VISIBLE_ATTACHMENT_ORPHAN_TTL: Duration = Duration::from_secs(24 * 60 * 60);
-const MAX_OPEN_ATTACHMENT_HANDLES: usize = 32;
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct BridgeMarker {
-    pub protocol: String,
-    pub session_id: String,
-    pub pid: u32,
-    pub connected_at: String,
-    pub heartbeat_at: String,
-}
-
-#[derive(Debug, Clone, Serialize)]
-struct CompactJobSummary {
-    job_id: String,
-    provider: String,
-    action: String,
-    status: JobStatus,
-    created_at: String,
-    updated_at: String,
-}
-
-impl CompactJobSummary {
-    fn from_job(job: &Job) -> Self {
-        Self {
-            job_id: limited(&job.job_id, 256),
-            provider: limited(&job.provider, 64),
-            action: limited(&job.action, 128),
-            status: job.status,
-            created_at: limited(&job.created_at, 64),
-            updated_at: limited(&job.updated_at, 64),
-        }
-    }
-
-    fn from_summary(summary: &JobSummary) -> Self {
-        Self {
-            job_id: summary.job_id.clone(),
-            provider: summary.provider.clone(),
-            action: summary.action.clone(),
-            status: summary.status,
-            created_at: summary.created_at.clone(),
-            updated_at: summary.updated_at.clone(),
-        }
-    }
-}
-
-#[derive(Debug, Clone, Default, Serialize)]
-#[serde(rename_all = "camelCase")]
-struct HistoryMetadata {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    task_id: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    project_name: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    chat_name: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    idempotency_key: Option<String>,
-}
-
-#[derive(Debug, Clone, Serialize)]
-struct HistorySummary {
-    #[serde(flatten)]
-    job: CompactJobSummary,
-    metadata: HistoryMetadata,
-}
-
-impl HistorySummary {
-    fn from_summary(summary: &JobSummary) -> Self {
-        Self {
-            job: CompactJobSummary::from_summary(summary),
-            metadata: HistoryMetadata {
-                task_id: summary.task_id.clone(),
-                project_name: summary.project_name.clone(),
-                chat_name: summary.chat_name.clone(),
-                idempotency_key: summary.idempotency_key.clone(),
-            },
-        }
-    }
-}
-
-#[derive(Debug, Clone)]
-struct ActiveClaim {
-    job_id: String,
-    claim_token: String,
-    renewal_failed: bool,
-    request_json: Value,
-}
-
-#[derive(Debug, Clone, Deserialize)]
-#[serde(rename_all = "camelCase", deny_unknown_fields)]
-struct VisibleAttachmentDescriptor {
-    protocol: String,
-    bundle_id: String,
-    attachment_id: String,
-    name: String,
-    #[serde(rename = "type")]
-    media_type: String,
-    size: u64,
-    sha256: String,
-}
-
-#[derive(Debug)]
-struct AttachmentHandle {
-    job_id: String,
-    claim_token: String,
-    descriptor: VisibleAttachmentDescriptor,
-    file: File,
-    next_offset: u64,
-    digest: Sha256,
-    integrity_verified: bool,
-}
-
-#[derive(Debug)]
-struct BridgeState {
-    provider: Option<String>,
-    action: Option<String>,
-    has_capacity: bool,
-    current_claim: Option<ActiveClaim>,
-    next_poll: Instant,
-    next_heartbeat: Instant,
-    next_renewal: Instant,
-    _ownership_lock: fs::File,
-}
-
-pub struct NativeHost {
-    store: JobStore,
-    config_store: ConfigStore,
-    marker_path: PathBuf,
-    session_id: String,
-    connected_at: String,
-    bridge: Option<BridgeState>,
-    attachment_handles: HashMap<String, AttachmentHandle>,
-}
-
-impl NativeHost {
-    pub fn new(store: JobStore) -> Self {
-        let _ = store.active_request_jsons().and_then(|requests| {
-            let active_bundle_ids = visible_attachment_bundle_ids(&requests)?;
-            cleanup_orphaned_visible_attachment_bundles(
-                store.home_dir(),
-                VISIBLE_ATTACHMENT_ORPHAN_TTL,
-                &active_bundle_ids,
-            )
-        });
-        Self {
-            config_store: ConfigStore::new(store.home_dir()),
-            marker_path: store.home_dir().join(BRIDGE_MARKER_FILE_NAME),
-            store,
-            session_id: Uuid::new_v4().to_string(),
-            connected_at: timestamp(),
-            bridge: None,
-            attachment_handles: HashMap::new(),
-        }
-    }
-
-    pub fn handle_message(&mut self, message: Value) -> Value {
-        let request_type = message
-            .get("type")
-            .and_then(Value::as_str)
-            .map(|value| limited(value, 160))
-            .unwrap_or_else(|| "tokenless.native.error".to_owned());
-        let request_id = message
-            .get("requestId")
-            .and_then(Value::as_str)
-            .map(|value| limited(value, 256));
-        match self.validate_and_handle(&message, &request_type) {
-            Ok((response_type, result)) => {
-                success_response(&response_type, result, request_id.as_deref())
-            }
-            Err(error) => error_response(&request_type, &error, request_id.as_deref()),
-        }
-    }
-
-    fn validate_and_handle(
-        &mut self,
-        message: &Value,
-        request_type: &str,
-    ) -> Result<(String, Value)> {
-        let object = message.as_object().ok_or_else(|| {
-            DaemonError::InvalidInput("native message must be a JSON object".to_owned())
-        })?;
-        if object.get("protocol").and_then(Value::as_str) != Some(NATIVE_PROTOCOL) {
-            return Err(DaemonError::InvalidInput(format!(
-                "missing or unsupported native protocol; expected {NATIVE_PROTOCOL}"
-            )));
-        }
-
-        match request_type {
-            "tokenless.native.ping" => Ok((
-                "tokenless.native.pong".to_owned(),
-                json!({
-                    "status": "ready",
-                    "version": env!("CARGO_PKG_VERSION"),
-                }),
-            )),
-            "tokenless.native.daemon_connect" => {
-                let provider = optional_nonempty_string(object, "provider")?;
-                let action = optional_nonempty_string(object, "action")?;
-                self.connect_bridge(provider, action)?;
-                Ok((
-                    "tokenless.native.daemon_connected".to_owned(),
-                    json!({
-                        "status": "connected",
-                        "sessionId": self.session_id,
-                    }),
-                ))
-            }
-            "tokenless.native.daemon_ready" => {
-                let job_id = required_string(object, "jobId")?;
-                let claim_token = required_string(object, "claimToken")?;
-                self.mark_bridge_ready(&job_id, &claim_token)?;
-                Ok((
-                    request_type.to_owned(),
-                    json!({ "status": "ready", "jobId": job_id }),
-                ))
-            }
-            "tokenless.native.daemon_complete_job" => {
-                let job_id = required_string(object, "jobId")?;
-                let claim_token = required_string(object, "claimToken")?;
-                let completion = match (object.get("result"), object.get("error")) {
-                    (Some(result), None) => CompleteJob::Succeeded {
-                        result_json: result.clone(),
-                    },
-                    (None, Some(error)) => CompleteJob::Failed {
-                        error_json: error.clone(),
-                    },
-                    _ => {
-                        return Err(DaemonError::InvalidInput(
-                            "pass exactly one of result or error".to_owned(),
-                        ))
-                    }
-                };
-                let job = self.store.complete_job(&job_id, &claim_token, completion)?;
-                self.close_attachment_handles_for_job(&job_id);
-                let _ = cleanup_visible_attachment_bundles_for_request(
-                    self.store.home_dir(),
-                    &job.request_json,
-                );
-                Ok((
-                    request_type.to_owned(),
-                    serde_json::to_value(CompactJobSummary::from_job(&job))?,
-                ))
-            }
-            "tokenless.native.attachment_open" => {
-                ensure_only_fields(
-                    object,
-                    &[
-                        "protocol",
-                        "type",
-                        "requestId",
-                        "jobId",
-                        "claimToken",
-                        "bundleId",
-                        "attachmentId",
-                    ],
-                )?;
-                self.open_visible_attachment(object)
-                    .map(|result| (request_type.to_owned(), result))
-            }
-            "tokenless.native.attachment_read" => {
-                ensure_only_fields(
-                    object,
-                    &[
-                        "protocol",
-                        "type",
-                        "requestId",
-                        "jobId",
-                        "claimToken",
-                        "handleId",
-                        "offset",
-                        "maxBytes",
-                    ],
-                )?;
-                self.read_visible_attachment(object)
-                    .map(|result| (request_type.to_owned(), result))
-            }
-            "tokenless.native.attachment_close" => {
-                ensure_only_fields(
-                    object,
-                    &[
-                        "protocol",
-                        "type",
-                        "requestId",
-                        "jobId",
-                        "claimToken",
-                        "handleId",
-                    ],
-                )?;
-                self.close_visible_attachment(object)
-                    .map(|result| (request_type.to_owned(), result))
-            }
-            "tokenless.native.read_config" => Ok((
-                request_type.to_owned(),
-                serde_json::to_value(self.config_store.read()?)?,
-            )),
-            "tokenless.native.write_config" => {
-                let update = config_update(object)?;
-                Ok((
-                    request_type.to_owned(),
-                    serde_json::to_value(self.config_store.write(update)?)?,
-                ))
-            }
-            "tokenless.native.list_history" => {
-                let limit = object
-                    .get("limit")
-                    .and_then(Value::as_u64)
-                    .map(|value| usize::try_from(value).unwrap_or(usize::MAX))
-                    .unwrap_or(50)
-                    .clamp(1, HISTORY_LIMIT);
-                let summaries = self
-                    .store
-                    .list_job_summaries(Some(limit))?
-                    .iter()
-                    .map(HistorySummary::from_summary)
-                    .collect::<Vec<_>>();
-                Ok((request_type.to_owned(), serde_json::to_value(summaries)?))
-            }
-            _ => Err(DaemonError::InvalidInput(format!(
-                "unsupported native message type: {request_type}"
-            ))),
-        }
-    }
-
-    fn connect_bridge(&mut self, provider: Option<String>, action: Option<String>) -> Result<()> {
-        if self.bridge.is_none() {
-            let now = Instant::now();
-            let ownership_lock = self.acquire_bridge_ownership()?;
-            self.write_marker_unlocked()?;
-            self.bridge = Some(BridgeState {
-                provider,
-                action,
-                has_capacity: true,
-                current_claim: None,
-                next_poll: now,
-                next_heartbeat: now + BRIDGE_HEARTBEAT_INTERVAL,
-                next_renewal: now + CLAIM_RENEW_INTERVAL,
-                _ownership_lock: ownership_lock,
-            });
-        }
-        Ok(())
-    }
-
-    fn mark_bridge_ready(&mut self, job_id: &str, claim_token: &str) -> Result<()> {
-        let bridge = self.bridge.as_ref().ok_or_else(|| {
-            DaemonError::InvalidInput("daemon bridge is not connected".to_owned())
-        })?;
-        let active = bridge.current_claim.clone().ok_or_else(|| {
-            DaemonError::InvalidInput("daemon bridge has no active claim".to_owned())
-        })?;
-        if active.job_id != job_id
-            || !crate::constant_time_eq(active.claim_token.as_bytes(), claim_token.as_bytes())
-        {
-            return Err(DaemonError::ClaimRejected(job_id.to_owned()));
-        }
-        let completed = self.store.get_job(job_id)?;
-        if !matches!(
-            completed.status,
-            JobStatus::Succeeded | JobStatus::Failed | JobStatus::Canceled | JobStatus::TimedOut
-        ) {
-            return Err(DaemonError::InvalidInput(
-                "daemon bridge cannot release a claim before the job is terminal".to_owned(),
-            ));
-        }
-        self.close_attachment_handles_for_job(job_id);
-        let _ = cleanup_visible_attachment_bundles_for_request(
-            self.store.home_dir(),
-            &active.request_json,
-        );
-        let bridge = self.bridge.as_mut().ok_or_else(|| {
-            DaemonError::InvalidInput("daemon bridge is not connected".to_owned())
-        })?;
-        bridge.current_claim = None;
-        bridge.has_capacity = true;
-        bridge.next_poll = Instant::now();
-        Ok(())
-    }
-
-    fn require_active_attachment_claim(
-        &mut self,
-        object: &Map<String, Value>,
-    ) -> Result<ActiveClaim> {
-        let job_id = required_string(object, "jobId")?;
-        let claim_token = required_string(object, "claimToken")?;
-        let active = self
-            .bridge
-            .as_ref()
-            .ok_or_else(|| {
-                DaemonError::InvalidInput("visible attachment bridge is not connected".to_owned())
-            })?
-            .current_claim
-            .clone()
-            .ok_or_else(|| {
-                DaemonError::InvalidInput(
-                    "visible attachment bridge has no active claim".to_owned(),
-                )
-            })?;
-        if active.job_id != job_id
-            || !crate::constant_time_eq(active.claim_token.as_bytes(), claim_token.as_bytes())
-        {
-            return Err(DaemonError::ClaimRejected(job_id));
-        }
-        if active.renewal_failed {
-            return Err(DaemonError::ClaimExpired(active.job_id));
-        }
-        self.store
-            .renew_claim(&active.job_id, &active.claim_token)?;
-        if let Some(bridge) = self.bridge.as_mut() {
-            bridge.next_renewal = Instant::now() + CLAIM_RENEW_INTERVAL;
-        }
-        Ok(active)
-    }
-
-    fn open_visible_attachment(&mut self, object: &Map<String, Value>) -> Result<Value> {
-        let active = self.require_active_attachment_claim(object)?;
-        let bundle_id = required_safe_attachment_id(object, "bundleId")?;
-        let attachment_id = required_safe_attachment_id(object, "attachmentId")?;
-        let descriptor = visible_attachment_descriptors(&active.request_json)?
-            .into_iter()
-            .find(|descriptor| {
-                descriptor.bundle_id == bundle_id && descriptor.attachment_id == attachment_id
-            })
-            .ok_or_else(|| {
-                DaemonError::InvalidInput(
-                    "visible attachment is not declared by the active job".to_owned(),
-                )
-            })?;
-        if self.attachment_handles.len() >= MAX_OPEN_ATTACHMENT_HANDLES {
-            return Err(DaemonError::InvalidInput(format!(
-                "visible attachment handle limit is {MAX_OPEN_ATTACHMENT_HANDLES}"
-            )));
-        }
-        if self.attachment_handles.values().any(|handle| {
-            handle.job_id == active.job_id
-                && handle.descriptor.bundle_id == descriptor.bundle_id
-                && handle.descriptor.attachment_id == descriptor.attachment_id
-        }) {
-            return Err(DaemonError::InvalidInput(
-                "visible attachment is already open for the active job".to_owned(),
-            ));
-        }
-        let file = open_staged_visible_attachment(self.store.home_dir(), &descriptor)?;
-        let handle_id = Uuid::new_v4().to_string();
-        self.attachment_handles.insert(
-            handle_id.clone(),
-            AttachmentHandle {
-                job_id: active.job_id,
-                claim_token: active.claim_token,
-                descriptor: descriptor.clone(),
-                file,
-                next_offset: 0,
-                digest: Sha256::new(),
-                integrity_verified: false,
-            },
-        );
-        Ok(json!({
-            "handleId": handle_id,
-            "protocol": VISIBLE_ATTACHMENT_PROTOCOL,
-            "bundleId": descriptor.bundle_id,
-            "attachmentId": descriptor.attachment_id,
-            "name": descriptor.name,
-            "type": descriptor.media_type,
-            "size": descriptor.size,
-            "sha256": descriptor.sha256,
-            "maxChunkBytes": MAX_VISIBLE_ATTACHMENT_CHUNK_BYTES,
-        }))
-    }
-
-    fn read_visible_attachment(&mut self, object: &Map<String, Value>) -> Result<Value> {
-        let active = self.require_active_attachment_claim(object)?;
-        let handle_id = required_string(object, "handleId")?;
-        if !safe_attachment_id(&handle_id) {
-            return Err(DaemonError::InvalidInput(
-                "visible attachment handleId is invalid".to_owned(),
-            ));
-        }
-        let offset = required_u64(object, "offset")?;
-        let max_bytes = required_u64(object, "maxBytes")?;
-        if max_bytes == 0 || max_bytes > MAX_VISIBLE_ATTACHMENT_CHUNK_BYTES as u64 {
-            return Err(DaemonError::InvalidInput(format!(
-                "visible attachment maxBytes must be between 1 and {MAX_VISIBLE_ATTACHMENT_CHUNK_BYTES}"
-            )));
-        }
-        let handle = self.attachment_handles.get_mut(&handle_id).ok_or_else(|| {
-            DaemonError::InvalidInput("visible attachment handle does not exist".to_owned())
-        })?;
-        if handle.job_id != active.job_id
-            || !crate::constant_time_eq(
-                handle.claim_token.as_bytes(),
-                active.claim_token.as_bytes(),
-            )
-        {
-            return Err(DaemonError::ClaimRejected(active.job_id));
-        }
-        if offset != handle.next_offset {
-            return Err(DaemonError::InvalidInput(format!(
-                "visible attachment reads must be sequential; expected offset {}",
-                handle.next_offset
-            )));
-        }
-        if handle.file.metadata()?.len() != handle.descriptor.size {
-            return Err(DaemonError::InvalidInput(
-                "visible attachment size changed after opening".to_owned(),
-            ));
-        }
-        let remaining = handle.descriptor.size.saturating_sub(handle.next_offset);
-        let read_bytes = remaining.min(max_bytes) as usize;
-        let mut bytes = vec![0_u8; read_bytes];
-        if read_bytes > 0 {
-            handle.file.read_exact(&mut bytes)?;
-            handle.digest.update(&bytes);
-            handle.next_offset = handle
-                .next_offset
-                .checked_add(read_bytes as u64)
-                .ok_or_else(|| {
-                    DaemonError::InvalidInput("visible attachment offset overflowed".to_owned())
-                })?;
-        }
-        let eof = handle.next_offset == handle.descriptor.size;
-        if eof {
-            let actual_sha256 = hex_lower(&handle.digest.clone().finalize());
-            if !crate::constant_time_eq(
-                actual_sha256.as_bytes(),
-                handle.descriptor.sha256.as_bytes(),
-            ) {
-                return Err(DaemonError::InvalidInput(
-                    "visible attachment SHA-256 integrity check failed".to_owned(),
-                ));
-            }
-        }
-        let result = json!({
-            "handleId": handle_id,
-            "offset": offset,
-            "nextOffset": handle.next_offset,
-            "eof": eof,
-            "dataBase64": STANDARD.encode(bytes),
-        });
-        if encoded_message_size(&success_response(
-            "tokenless.native.attachment_read",
-            result.clone(),
-            None,
-        ))? > MAX_NATIVE_OUTPUT_BYTES
-        {
-            return Err(DaemonError::InvalidInput(
-                "visible attachment chunk exceeded the native output frame".to_owned(),
-            ));
-        }
-        if eof {
-            handle.integrity_verified = true;
-        }
-        Ok(result)
-    }
-
-    fn close_visible_attachment(&mut self, object: &Map<String, Value>) -> Result<Value> {
-        let active = self.require_active_attachment_claim(object)?;
-        let handle_id = required_string(object, "handleId")?;
-        let handle = self.attachment_handles.get(&handle_id).ok_or_else(|| {
-            DaemonError::InvalidInput("visible attachment handle does not exist".to_owned())
-        })?;
-        if handle.job_id != active.job_id
-            || !crate::constant_time_eq(
-                handle.claim_token.as_bytes(),
-                active.claim_token.as_bytes(),
-            )
-        {
-            return Err(DaemonError::ClaimRejected(active.job_id));
-        }
-        if handle.next_offset != handle.descriptor.size || !handle.integrity_verified {
-            return Err(DaemonError::InvalidInput(
-                "visible attachment cannot close before a complete, integrity-verified read"
-                    .to_owned(),
-            ));
-        }
-        self.attachment_handles.remove(&handle_id);
-        Ok(json!({ "handleId": handle_id, "status": "closed" }))
-    }
-
-    fn close_attachment_handles_for_job(&mut self, job_id: &str) {
-        self.attachment_handles
-            .retain(|_, handle| handle.job_id != job_id);
-    }
-
-    fn tick(&mut self) -> Result<Vec<Value>> {
-        let mut messages = Vec::new();
-        let now = Instant::now();
-        let Some(bridge) = self.bridge.as_ref() else {
-            return Ok(messages);
-        };
-        let heartbeat_due = now >= bridge.next_heartbeat;
-        let renewal_due = now >= bridge.next_renewal;
-        let poll_due = now >= bridge.next_poll && bridge.has_capacity;
-
-        if heartbeat_due {
-            if let Some(bridge) = self.bridge.as_mut() {
-                bridge.next_heartbeat = now + BRIDGE_HEARTBEAT_INTERVAL;
-            }
-            if !self.heartbeat_marker()? {
-                self.bridge = None;
-                return Ok(vec![bridge_error_push(
-                    "bridge_superseded",
-                    "A newer extension bridge session replaced this native host.",
-                    false,
-                )]);
-            }
-        }
-
-        if renewal_due {
-            let active = self
-                .bridge
-                .as_ref()
-                .and_then(|bridge| bridge.current_claim.clone());
-            if let Some(active) = active.filter(|claim| !claim.renewal_failed) {
-                match self.store.renew_claim(&active.job_id, &active.claim_token) {
-                    Ok(_) => {}
-                    Err(DaemonError::InvalidJobState { .. }) => {
-                        // Completion can happen through a separate short-lived native host.
-                    }
-                    Err(error) => {
-                        if let Some(claim) = self
-                            .bridge
-                            .as_mut()
-                            .and_then(|bridge| bridge.current_claim.as_mut())
-                        {
-                            claim.renewal_failed = true;
-                        }
-                        messages.push(error_push(&error));
-                    }
-                }
-            }
-            if let Some(bridge) = self.bridge.as_mut() {
-                bridge.next_renewal = now + CLAIM_RENEW_INTERVAL;
-            }
-        }
-
-        if poll_due {
-            match self.poll_bridge_now() {
-                Ok(Some(message)) => messages.push(message),
-                Ok(None) => {}
-                Err(error) => {
-                    if let Some(bridge) = self.bridge.as_mut() {
-                        bridge.next_poll = now + BRIDGE_ERROR_INTERVAL;
-                    }
-                    messages.push(error_push(&error));
-                }
-            }
-        }
-        Ok(messages)
-    }
-
-    fn poll_bridge_now(&mut self) -> Result<Option<Value>> {
-        let Some(bridge) = self.bridge.as_ref() else {
-            return Ok(None);
-        };
-        if !bridge.has_capacity {
-            return Ok(None);
-        }
-        let query = ClaimNextJob {
-            provider: bridge.provider.clone(),
-            action: bridge.action.clone(),
-        };
-        let Some(claimed) = self.store.claim_next_job(query)? else {
-            if let Some(bridge) = self.bridge.as_mut() {
-                bridge.next_poll = Instant::now() + BRIDGE_POLL_INTERVAL;
-            }
-            return Ok(None);
-        };
-        let running = self
-            .store
-            .mark_running(&claimed.job_id, &claimed.claim_token)?;
-        let push = success_response(
-            "tokenless.native.daemon_job",
-            json!({ "job": running.with_claim_token() }),
-            None,
-        );
-        let encoded_size = encoded_message_size(&push)?;
-        if encoded_size > MAX_NATIVE_OUTPUT_BYTES {
-            self.store.complete_job(
-                &running.job_id,
-                &running.claim_token,
-                CompleteJob::Failed {
-                    error_json: json!({
-                        "code": "native_message_too_large",
-                        "message": "Claimed job exceeds the Chrome Native Messaging output limit.",
-                        "retryable": false,
-                        "maxBytes": MAX_NATIVE_OUTPUT_BYTES,
-                        "actualBytes": encoded_size,
-                    }),
-                },
-            )?;
-            if let Some(bridge) = self.bridge.as_mut() {
-                bridge.has_capacity = true;
-                bridge.current_claim = None;
-                bridge.next_poll = Instant::now();
-            }
-            return Ok(Some(bridge_error_push(
-                "native_message_too_large",
-                "A daemon job was failed because its native message exceeded 1 MiB.",
-                false,
-            )));
-        }
-
-        if let Some(bridge) = self.bridge.as_mut() {
-            bridge.has_capacity = false;
-            bridge.current_claim = Some(ActiveClaim {
-                job_id: running.job_id.clone(),
-                claim_token: running.claim_token.clone(),
-                renewal_failed: false,
-                request_json: running.request_json.clone(),
-            });
-            bridge.next_renewal = Instant::now() + CLAIM_RENEW_INTERVAL;
-        }
-        Ok(Some(push))
-    }
-
-    fn write_marker_unlocked(&self) -> Result<()> {
-        let now = timestamp();
-        write_json_atomic_secure(
-            &self.marker_path,
-            &BridgeMarker {
-                protocol: BRIDGE_MARKER_PROTOCOL.to_owned(),
-                session_id: self.session_id.clone(),
-                pid: std::process::id(),
-                connected_at: self.connected_at.clone(),
-                heartbeat_at: now,
-            },
-        )
-    }
-
-    fn marker_belongs_to_session_unlocked(&self) -> Result<bool> {
-        let bytes = match fs::read(&self.marker_path) {
-            Ok(bytes) => bytes,
-            Err(error) if error.kind() == ErrorKind::NotFound => return Ok(false),
-            Err(error) => return Err(error.into()),
-        };
-        let marker: BridgeMarker = serde_json::from_slice(&bytes)?;
-        Ok(marker.protocol == BRIDGE_MARKER_PROTOCOL && marker.session_id == self.session_id)
-    }
-
-    fn heartbeat_marker(&self) -> Result<bool> {
-        if !self.marker_belongs_to_session_unlocked()? {
-            return Ok(false);
-        }
-        self.write_marker_unlocked()?;
-        Ok(true)
-    }
-
-    fn acquire_bridge_ownership(&self) -> Result<fs::File> {
-        let lock_path = self.store.home_dir().join(BRIDGE_MARKER_LOCK_FILE_NAME);
-        let mut options = OpenOptions::new();
-        options.read(true).write(true).create(true);
-        open_secure_file(&mut options);
-        let lock = options.open(&lock_path)?;
-        crate::restrict_file_permissions(&lock_path)?;
-        match lock.try_lock_exclusive() {
-            Ok(()) => Ok(lock),
-            Err(error) if error.kind() == ErrorKind::WouldBlock => Err(DaemonError::BridgeBusy),
-            Err(error) => Err(error.into()),
-        }
-    }
-
-    pub fn disconnect(&mut self) -> Result<()> {
-        let Some(bridge) = self.bridge.take() else {
-            return Ok(());
-        };
-        if self.marker_belongs_to_session_unlocked()? {
-            match fs::remove_file(&self.marker_path) {
-                Ok(()) => sync_parent(self.store.home_dir())?,
-                Err(error) if error.kind() == ErrorKind::NotFound => {}
-                Err(error) => return Err(error.into()),
-            }
-        }
-        drop(bridge);
-        Ok(())
-    }
-}
-
-impl Drop for NativeHost {
-    fn drop(&mut self) {
-        let _ = self.disconnect();
-    }
-}
-
-enum InputEvent {
-    Message(Value),
-    End,
-    Error(DaemonError),
-}
-
-pub fn run_native_host<R, W>(store: JobStore, mut reader: R, mut writer: W) -> Result<()>
-where
-    R: Read + Send + 'static,
-    W: Write,
-{
-    let (sender, receiver) = mpsc::sync_channel(NATIVE_INPUT_QUEUE_CAPACITY);
-    thread::spawn(move || loop {
-        match read_native_message(&mut reader) {
-            Ok(Some(message)) => {
-                if sender.send(InputEvent::Message(message)).is_err() {
-                    break;
-                }
-            }
-            Ok(None) => {
-                let _ = sender.send(InputEvent::End);
-                break;
-            }
-            Err(error) => {
-                let _ = sender.send(InputEvent::Error(error));
-                break;
-            }
-        }
-    });
-
-    let mut host = NativeHost::new(store);
-    loop {
-        match receiver.recv_timeout(EVENT_LOOP_INTERVAL) {
-            Ok(InputEvent::Message(message)) => {
-                let response = host.handle_message(message);
-                write_with_fallback(&mut writer, &response)?;
-            }
-            Ok(InputEvent::End) | Err(RecvTimeoutError::Disconnected) => {
-                host.disconnect()?;
-                return Ok(());
-            }
-            Ok(InputEvent::Error(error)) => {
-                let response = error_response("tokenless.native.error", &error, None);
-                write_with_fallback(&mut writer, &response)?;
-                host.disconnect()?;
-                return Ok(());
-            }
-            Err(RecvTimeoutError::Timeout) => {}
-        }
-        match host.tick() {
-            Ok(messages) => {
-                for message in messages {
-                    write_with_fallback(&mut writer, &message)?;
-                }
-            }
-            Err(error) => write_with_fallback(&mut writer, &error_push(&error))?,
-        }
-    }
-}
-
-pub fn run_native_host_stdio(store: JobStore) -> Result<()> {
-    run_native_host(store, std::io::stdin(), std::io::stdout())
-}
-
-pub fn read_native_message(reader: &mut impl Read) -> Result<Option<Value>> {
-    let mut header = [0_u8; 4];
-    let mut header_bytes = 0;
-    while header_bytes < header.len() {
-        match reader.read(&mut header[header_bytes..]) {
-            Ok(0) if header_bytes == 0 => return Ok(None),
-            Ok(0) => {
-                return Err(std::io::Error::new(
-                    ErrorKind::UnexpectedEof,
-                    "native message ended during length header",
-                )
-                .into())
-            }
-            Ok(read) => header_bytes += read,
-            Err(error) if error.kind() == ErrorKind::Interrupted => {}
-            Err(error) => return Err(error.into()),
-        }
-    }
-    let length = u32::from_le_bytes(header) as usize;
-    if length > MAX_NATIVE_INPUT_BYTES {
-        return Err(DaemonError::InvalidInput(format!(
-            "native input frame exceeds {MAX_NATIVE_INPUT_BYTES} bytes"
-        )));
-    }
-    let mut body = vec![0_u8; length];
-    reader.read_exact(&mut body)?;
-    Ok(Some(serde_json::from_slice(&body)?))
-}
-
-pub fn write_native_message(writer: &mut impl Write, message: &Value) -> Result<()> {
-    let body = serde_json::to_vec(message)?;
-    if body.len() > MAX_NATIVE_OUTPUT_BYTES {
-        return Err(DaemonError::InvalidInput(format!(
-            "native output frame exceeds {MAX_NATIVE_OUTPUT_BYTES} bytes"
-        )));
-    }
-    let length = u32::try_from(body.len()).map_err(|_| {
-        DaemonError::InvalidInput("native output frame length exceeds u32".to_owned())
-    })?;
-    writer.write_all(&length.to_le_bytes())?;
-    writer.write_all(&body)?;
-    writer.flush()?;
-    Ok(())
-}
-
-pub fn resolve_native_host_home(
-    tokenless_home: Option<OsString>,
-    executable: &Path,
-) -> Result<PathBuf> {
-    if let Some(home) = tokenless_home.filter(|value| !value.is_empty()) {
-        return Ok(PathBuf::from(home));
-    }
-    let bin_dir = executable.parent().ok_or_else(|| {
-        DaemonError::InvalidInput(format!(
-            "cannot infer Tokenless home from {}",
-            executable.display()
-        ))
-    })?;
-    if !bin_dir
-        .file_name()
-        .and_then(|value| value.to_str())
-        .is_some_and(|value| value.eq_ignore_ascii_case("bin"))
-    {
-        return Err(DaemonError::InvalidInput(format!(
-            "native host executable must be installed under <home>/bin: {}",
-            executable.display()
-        )));
-    }
-    bin_dir.parent().map(Path::to_path_buf).ok_or_else(|| {
-        DaemonError::InvalidInput(format!(
-            "cannot infer Tokenless home from {}",
-            executable.display()
-        ))
-    })
-}
-
-pub fn resolve_native_host_home_from_environment() -> Result<PathBuf> {
-    resolve_native_host_home(env::var_os("TOKENLESS_HOME"), &env::current_exe()?)
-}
-
-fn visible_attachment_descriptors(request: &Value) -> Result<Vec<VisibleAttachmentDescriptor>> {
-    let Some(attachments) = request.get("attachments") else {
-        return Ok(Vec::new());
-    };
-    let values = attachments.as_array().ok_or_else(|| {
-        DaemonError::InvalidInput("visible attachment descriptors must be an array".to_owned())
-    })?;
-    if values.is_empty() || values.len() > MAX_VISIBLE_ATTACHMENTS {
-        return Err(DaemonError::InvalidInput(format!(
-            "visible attachment requests must contain between 1 and {MAX_VISIBLE_ATTACHMENTS} files"
-        )));
-    }
-    let mut descriptors = Vec::with_capacity(values.len());
-    let mut attachment_ids = HashSet::new();
-    let mut bundle_id: Option<String> = None;
-    let mut total_bytes = 0_u64;
-    for value in values {
-        let descriptor: VisibleAttachmentDescriptor = serde_json::from_value(value.clone())
-            .map_err(|_| {
-                DaemonError::InvalidInput(
-                    "visible attachment descriptor has invalid or unknown fields".to_owned(),
-                )
-            })?;
-        validate_visible_attachment_descriptor(&descriptor)?;
-        if bundle_id
-            .as_ref()
-            .is_some_and(|expected| expected != &descriptor.bundle_id)
-        {
-            return Err(DaemonError::InvalidInput(
-                "visible attachments in one request must share one bundle identifier".to_owned(),
-            ));
-        }
-        bundle_id.get_or_insert_with(|| descriptor.bundle_id.clone());
-        if !attachment_ids.insert(descriptor.attachment_id.clone()) {
-            return Err(DaemonError::InvalidInput(
-                "visible attachment descriptor identity is duplicated".to_owned(),
-            ));
-        }
-        if descriptor.size > MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES {
-            return Err(DaemonError::InvalidInput(format!(
-                "visible attachment size exceeds {MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES} bytes"
-            )));
-        }
-        total_bytes = total_bytes.checked_add(descriptor.size).ok_or_else(|| {
-            DaemonError::InvalidInput("visible attachment aggregate size overflowed".to_owned())
-        })?;
-        if total_bytes > MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES {
-            return Err(DaemonError::InvalidInput(format!(
-                "visible attachment aggregate size exceeds {MAX_VISIBLE_ATTACHMENT_REQUEST_BYTES} bytes"
-            )));
-        }
-        descriptors.push(descriptor);
-    }
-    Ok(descriptors)
-}
-
-fn validate_visible_attachment_descriptor(descriptor: &VisibleAttachmentDescriptor) -> Result<()> {
-    if descriptor.protocol != VISIBLE_ATTACHMENT_PROTOCOL {
-        return Err(DaemonError::InvalidInput(format!(
-            "visible attachment protocol must be {VISIBLE_ATTACHMENT_PROTOCOL}"
-        )));
-    }
-    if !safe_attachment_id(&descriptor.bundle_id) || !safe_attachment_id(&descriptor.attachment_id)
-    {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment descriptor contains an unsafe identifier".to_owned(),
-        ));
-    }
-    if descriptor.name.is_empty()
-        || descriptor.name.as_bytes().len() > 512
-        || descriptor.name.contains('\0')
-        || descriptor.name.contains('/')
-        || descriptor.name.contains('\\')
-    {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment descriptor contains an unsafe name".to_owned(),
-        ));
-    }
-    if !safe_media_type(&descriptor.media_type) {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment descriptor contains an invalid media type".to_owned(),
-        ));
-    }
-    if descriptor.size > 9_007_199_254_740_991 {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment descriptor size exceeds a safe integer".to_owned(),
-        ));
-    }
-    if descriptor.sha256.len() != 64
-        || !descriptor
-            .sha256
-            .bytes()
-            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
-    {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment descriptor contains an invalid SHA-256".to_owned(),
-        ));
-    }
-    Ok(())
-}
-
-fn safe_media_type(value: &str) -> bool {
-    if value.is_empty() || value.len() > 255 || !value.is_ascii() {
-        return false;
-    }
-    let mut parts = value.split('/');
-    let Some(primary) = parts.next() else {
-        return false;
-    };
-    let Some(subtype) = parts.next() else {
-        return false;
-    };
-    if parts.next().is_some() || primary.is_empty() || subtype.is_empty() {
-        return false;
-    }
-    primary
-        .bytes()
-        .chain(subtype.bytes())
-        .all(|byte| byte.is_ascii_alphanumeric() || b"!#$&^_.+-".contains(&byte))
-}
-
-fn safe_attachment_id(value: &str) -> bool {
-    (1..=64).contains(&value.len())
-        && value
-            .bytes()
-            .all(|byte| byte.is_ascii_alphanumeric() || byte == b'_' || byte == b'-')
-}
-
-fn required_safe_attachment_id(object: &Map<String, Value>, field: &'static str) -> Result<String> {
-    let value = required_string(object, field)?;
-    if !safe_attachment_id(&value) {
-        return Err(DaemonError::InvalidInput(format!(
-            "visible attachment {field} contains unsafe characters"
-        )));
-    }
-    Ok(value)
-}
-
-fn required_u64(object: &Map<String, Value>, field: &'static str) -> Result<u64> {
-    object.get(field).and_then(Value::as_u64).ok_or_else(|| {
-        DaemonError::InvalidInput(format!(
-            "visible attachment {field} must be a nonnegative integer"
-        ))
-    })
-}
-
-fn ensure_only_fields(object: &Map<String, Value>, allowed: &[&str]) -> Result<()> {
-    for field in object.keys() {
-        if !allowed.contains(&field.as_str()) {
-            return Err(DaemonError::InvalidInput(format!(
-                "unsupported native message field: {field}"
-            )));
-        }
-    }
-    Ok(())
-}
-
-fn open_staged_visible_attachment(
-    home_dir: &Path,
-    descriptor: &VisibleAttachmentDescriptor,
-) -> Result<File> {
-    validate_visible_attachment_descriptor(descriptor)?;
-    let expected_root = home_dir.join(VISIBLE_ATTACHMENT_DIRECTORY);
-    require_regular_non_symlink_directory(&expected_root, "visible attachment root")?;
-    let root = fs::canonicalize(&expected_root)?;
-    if root != expected_root || !root.starts_with(home_dir) {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment root escaped Tokenless home".to_owned(),
-        ));
-    }
-    let expected_bundle = root.join(&descriptor.bundle_id);
-    require_regular_non_symlink_directory(&expected_bundle, "visible attachment bundle")?;
-    let bundle = fs::canonicalize(&expected_bundle)?;
-    if bundle != expected_bundle || !bundle.starts_with(&root) {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment bundle escaped its staging root".to_owned(),
-        ));
-    }
-    let expected_file = bundle.join(format!("{}.bin", descriptor.attachment_id));
-    let before = fs::symlink_metadata(&expected_file)?;
-    if before.file_type().is_symlink() || !before.is_file() {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment staging entry must be a regular non-symlink file".to_owned(),
-        ));
-    }
-    let canonical_file = fs::canonicalize(&expected_file)?;
-    if canonical_file != expected_file || !canonical_file.starts_with(&bundle) {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment staging entry escaped its bundle".to_owned(),
-        ));
-    }
-    let mut options = OpenOptions::new();
-    options.read(true);
-    open_attachment_file_without_following(&mut options);
-    let file = options.open(&canonical_file)?;
-    let opened = file.metadata()?;
-    let after = fs::symlink_metadata(&expected_file)?;
-    if after.file_type().is_symlink()
-        || !after.is_file()
-        || opened.len() != descriptor.size
-        || after.len() != descriptor.size
-        || !same_opened_file_identity(&opened, &before)
-        || !same_opened_file_identity(&opened, &after)
-    {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment staging entry changed while opening".to_owned(),
-        ));
-    }
-    Ok(file)
-}
-
-fn require_regular_non_symlink_directory(path: &Path, label: &str) -> Result<()> {
-    let metadata = fs::symlink_metadata(path)?;
-    if metadata.file_type().is_symlink() || !metadata.is_dir() {
-        return Err(DaemonError::InvalidInput(format!(
-            "{label} must be a regular non-symlink directory"
-        )));
-    }
-    Ok(())
-}
-
-#[cfg(unix)]
-fn open_attachment_file_without_following(options: &mut OpenOptions) {
-    use std::os::unix::fs::OpenOptionsExt;
-
-    options.custom_flags(libc::O_NOFOLLOW);
-}
-
-#[cfg(windows)]
-fn open_attachment_file_without_following(options: &mut OpenOptions) {
-    use std::os::windows::fs::OpenOptionsExt;
-
-    const FILE_FLAG_OPEN_REPARSE_POINT: u32 = 0x0020_0000;
-    options.custom_flags(FILE_FLAG_OPEN_REPARSE_POINT);
-}
-
-#[cfg(not(any(unix, windows)))]
-fn open_attachment_file_without_following(_options: &mut OpenOptions) {}
-
-#[cfg(unix)]
-fn same_opened_file_identity(left: &fs::Metadata, right: &fs::Metadata) -> bool {
-    use std::os::unix::fs::MetadataExt;
-
-    left.dev() == right.dev() && left.ino() == right.ino()
-}
-
-#[cfg(not(unix))]
-fn same_opened_file_identity(left: &fs::Metadata, right: &fs::Metadata) -> bool {
-    left.len() == right.len()
-        && left.modified().ok() == right.modified().ok()
-        && left.created().ok() == right.created().ok()
-}
-
-pub(crate) fn cleanup_visible_attachment_bundles_for_request(
-    home_dir: &Path,
-    request: &Value,
-) -> Result<usize> {
-    let bundles = visible_attachment_descriptors(request)?
-        .into_iter()
-        .map(|descriptor| descriptor.bundle_id)
-        .collect::<HashSet<_>>();
-    let mut removed = 0;
-    for bundle_id in bundles {
-        if remove_visible_attachment_bundle(home_dir, &bundle_id)? {
-            removed += 1;
-        }
-    }
-    Ok(removed)
-}
-
-fn visible_attachment_bundle_ids(requests: &[Value]) -> Result<HashSet<String>> {
-    let mut bundle_ids = HashSet::new();
-    for request in requests {
-        bundle_ids.extend(
-            visible_attachment_descriptors(request)?
-                .into_iter()
-                .map(|descriptor| descriptor.bundle_id),
-        );
-    }
-    Ok(bundle_ids)
-}
-
-fn cleanup_orphaned_visible_attachment_bundles(
-    home_dir: &Path,
-    ttl: Duration,
-    active_bundle_ids: &HashSet<String>,
-) -> Result<usize> {
-    let expected_root = home_dir.join(VISIBLE_ATTACHMENT_DIRECTORY);
-    let root_metadata = match fs::symlink_metadata(&expected_root) {
-        Ok(metadata) => metadata,
-        Err(error) if error.kind() == ErrorKind::NotFound => return Ok(0),
-        Err(error) => return Err(error.into()),
-    };
-    if root_metadata.file_type().is_symlink() || !root_metadata.is_dir() {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment root must be a regular non-symlink directory".to_owned(),
-        ));
-    }
-    let root = fs::canonicalize(&expected_root)?;
-    if root != expected_root || !root.starts_with(home_dir) {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment root escaped Tokenless home".to_owned(),
-        ));
-    }
-    let now = SystemTime::now();
-    let mut removed = 0;
-    for entry in fs::read_dir(&root)? {
-        let entry = entry?;
-        let name = entry.file_name();
-        let Some(bundle_id) = name.to_str() else {
-            continue;
-        };
-        if !safe_attachment_id(bundle_id) || active_bundle_ids.contains(bundle_id) {
-            continue;
-        }
-        let metadata = fs::symlink_metadata(entry.path())?;
-        if metadata.file_type().is_symlink() || !metadata.is_dir() {
-            continue;
-        }
-        let expired = metadata
-            .modified()
-            .ok()
-            .and_then(|modified| now.duration_since(modified).ok())
-            .is_some_and(|age| age >= ttl);
-        if expired && remove_visible_attachment_bundle(home_dir, bundle_id)? {
-            removed += 1;
-        }
-    }
-    Ok(removed)
-}
-
-fn remove_visible_attachment_bundle(home_dir: &Path, bundle_id: &str) -> Result<bool> {
-    if !safe_attachment_id(bundle_id) {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment bundle identifier is unsafe".to_owned(),
-        ));
-    }
-    let expected_root = home_dir.join(VISIBLE_ATTACHMENT_DIRECTORY);
-    let root = match fs::canonicalize(&expected_root) {
-        Ok(root) => root,
-        Err(error) if error.kind() == ErrorKind::NotFound => return Ok(false),
-        Err(error) => return Err(error.into()),
-    };
-    if root != expected_root || !root.starts_with(home_dir) {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment root escaped Tokenless home".to_owned(),
-        ));
-    }
-    let expected_bundle = root.join(bundle_id);
-    let metadata = match fs::symlink_metadata(&expected_bundle) {
-        Ok(metadata) => metadata,
-        Err(error) if error.kind() == ErrorKind::NotFound => return Ok(false),
-        Err(error) => return Err(error.into()),
-    };
-    if metadata.file_type().is_symlink() || !metadata.is_dir() {
-        return Err(DaemonError::InvalidInput(
-            "refusing to remove an unsafe visible attachment bundle".to_owned(),
-        ));
-    }
-    let bundle = fs::canonicalize(&expected_bundle)?;
-    if bundle != expected_bundle || !bundle.starts_with(&root) {
-        return Err(DaemonError::InvalidInput(
-            "visible attachment bundle escaped its staging root".to_owned(),
-        ));
-    }
-    let mut entries = Vec::new();
-    for entry in fs::read_dir(&bundle)? {
-        let entry = entry?;
-        let name = entry.file_name();
-        let Some(name) = name.to_str() else {
-            return Err(DaemonError::InvalidInput(
-                "visible attachment bundle contains an invalid entry".to_owned(),
-            ));
-        };
-        let Some(attachment_id) = name.strip_suffix(".bin") else {
-            return Err(DaemonError::InvalidInput(
-                "visible attachment bundle contains an unexpected entry".to_owned(),
-            ));
-        };
-        if !safe_attachment_id(attachment_id) {
-            return Err(DaemonError::InvalidInput(
-                "visible attachment bundle contains an unsafe entry".to_owned(),
-            ));
-        }
-        let entry_metadata = fs::symlink_metadata(entry.path())?;
-        if entry_metadata.is_dir() {
-            return Err(DaemonError::InvalidInput(
-                "visible attachment bundle contains a nested directory".to_owned(),
-            ));
-        }
-        entries.push(entry.path());
-    }
-    for entry in entries {
-        fs::remove_file(entry)?;
-    }
-    fs::remove_dir(bundle)?;
-    Ok(true)
-}
-
-fn hex_lower(bytes: &[u8]) -> String {
-    const HEX: &[u8; 16] = b"0123456789abcdef";
-    let mut result = String::with_capacity(bytes.len() * 2);
-    for byte in bytes {
-        result.push(HEX[(byte >> 4) as usize] as char);
-        result.push(HEX[(byte & 0x0f) as usize] as char);
-    }
-    result
-}
-
-fn config_update(object: &Map<String, Value>) -> Result<ConfigUpdate> {
-    let preferred_providers = match object.get("preferredProviders") {
-        None => None,
-        Some(Value::Array(values)) => Some(
-            values
-                .iter()
-                .map(|value| {
-                    value.as_str().map(str::to_owned).ok_or_else(|| {
-                        DaemonError::InvalidInput(
-                            "preferredProviders must contain only strings".to_owned(),
-                        )
-                    })
-                })
-                .collect::<Result<Vec<_>>>()?,
-        ),
-        Some(_) => {
-            return Err(DaemonError::InvalidInput(
-                "preferredProviders must be an array".to_owned(),
-            ))
-        }
-    };
-    Ok(ConfigUpdate {
-        preferred_providers,
-        browser: optional_nullable_string(object, "browser")?,
-        daemon_url: optional_nullable_string(object, "daemonUrl")?,
-    })
-}
-
-fn optional_nullable_string(
-    object: &Map<String, Value>,
-    field: &'static str,
-) -> Result<Option<Option<String>>> {
-    match object.get(field) {
-        None => Ok(None),
-        Some(Value::Null) => Ok(Some(None)),
-        Some(Value::String(value)) => Ok(Some(Some(value.clone()))),
-        Some(_) => Err(DaemonError::InvalidInput(format!(
-            "{field} must be a string or null"
-        ))),
-    }
-}
-
-fn optional_nonempty_string(
-    object: &Map<String, Value>,
-    field: &'static str,
-) -> Result<Option<String>> {
-    match object.get(field) {
-        None | Some(Value::Null) => Ok(None),
-        Some(Value::String(value)) if !value.trim().is_empty() => Ok(Some(value.trim().to_owned())),
-        _ => Err(DaemonError::InvalidInput(format!(
-            "{field} must be a nonempty string"
-        ))),
-    }
-}
-
-fn required_string(object: &Map<String, Value>, field: &'static str) -> Result<String> {
-    match object.get(field) {
-        Some(Value::String(value)) if !value.trim().is_empty() => Ok(value.clone()),
-        _ => Err(DaemonError::InvalidInput(format!(
-            "{field} must be a nonempty string"
-        ))),
-    }
-}
-
-fn success_response(response_type: &str, result: Value, request_id: Option<&str>) -> Value {
-    let mut response = json!({
-        "protocol": NATIVE_PROTOCOL,
-        "type": response_type,
-        "ok": true,
-        "result": result,
-    });
-    if let (Some(request_id), Some(object)) = (request_id, response.as_object_mut()) {
-        object.insert("requestId".to_owned(), Value::String(request_id.to_owned()));
-    }
-    response
-}
-
-fn error_response(request_type: &str, error: &DaemonError, request_id: Option<&str>) -> Value {
-    let (code, retryable) = error_code(error);
-    let mut response = json!({
-        "protocol": NATIVE_PROTOCOL,
-        "type": request_type,
-        "ok": false,
-        "error": {
-            "code": code,
-            "message": limited(&error.to_string(), 1024),
-            "retryable": retryable,
-        },
-    });
-    if let (Some(request_id), Some(object)) = (request_id, response.as_object_mut()) {
-        object.insert("requestId".to_owned(), Value::String(request_id.to_owned()));
-    }
-    response
-}
-
-fn error_push(error: &DaemonError) -> Value {
-    let (code, retryable) = error_code(error);
-    bridge_error_push(code, &limited(&error.to_string(), 1024), retryable)
-}
-
-fn bridge_error_push(code: &str, message: &str, retryable: bool) -> Value {
-    json!({
-        "protocol": NATIVE_PROTOCOL,
-        "type": "tokenless.native.daemon_error",
-        "ok": false,
-        "error": {
-            "code": code,
-            "message": message,
-            "retryable": retryable,
-        },
-    })
-}
-
-fn error_code(error: &DaemonError) -> (&'static str, bool) {
-    match error {
-        DaemonError::InvalidInput(message) if message.contains("protocol") => {
-            ("unsupported_native_protocol", false)
-        }
-        DaemonError::InvalidInput(message) if message.contains("frame exceeds") => {
-            ("native_message_too_large", false)
-        }
-        DaemonError::InvalidInput(_) | DaemonError::Json(_) => ("invalid_native_message", false),
-        DaemonError::ClaimExpired(_) => ("claim_expired", false),
-        DaemonError::ClaimRejected(_) => ("claim_rejected", false),
-        DaemonError::BridgeBusy => ("bridge_busy", true),
-        DaemonError::JobNotFound(_) => ("job_not_found", false),
-        DaemonError::InvalidJobState { .. } => ("invalid_job_state", false),
-        DaemonError::Sqlite(_) => ("native_store_error", true),
-        DaemonError::Io(_) => ("native_io_error", true),
-        _ => ("native_host_error", false),
-    }
-}
-
-fn write_with_fallback(writer: &mut impl Write, message: &Value) -> Result<()> {
-    match write_native_message(writer, message) {
-        Ok(()) => Ok(()),
-        Err(DaemonError::InvalidInput(_)) => write_native_message(
-            writer,
-            &bridge_error_push(
-                "native_message_too_large",
-                "Native host response exceeded the Chrome output limit.",
-                false,
-            ),
-        ),
-        Err(error) => Err(error),
-    }
-}
-
-fn encoded_message_size(message: &Value) -> Result<usize> {
-    Ok(serde_json::to_vec(message)?.len())
-}
-
-fn limited(value: &str, max_chars: usize) -> String {
-    let mut chars = value.chars();
-    let limited = chars.by_ref().take(max_chars).collect::<String>();
-    if chars.next().is_some() {
-        format!("{limited}…")
-    } else {
-        limited
-    }
-}
-
-fn timestamp() -> String {
-    Utc::now().to_rfc3339_opts(SecondsFormat::Millis, true)
-}
-
-#[cfg(unix)]
-fn open_secure_file(options: &mut OpenOptions) {
-    use std::os::unix::fs::OpenOptionsExt;
-
-    options.mode(0o600);
-}
-
-#[cfg(not(unix))]
-fn open_secure_file(_options: &mut OpenOptions) {}
-
-#[cfg(unix)]
-fn sync_parent(parent: &Path) -> Result<()> {
-    fs::File::open(parent)?.sync_all()?;
-    Ok(())
-}
-
-#[cfg(not(unix))]
-fn sync_parent(_parent: &Path) -> Result<()> {
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::{CompleteJob, CreateJob};
-    use std::io::Cursor;
-
-    const TEST_ATTACHMENT_BUNDLE_ID: &str = "bundle-one";
-    const TEST_ATTACHMENT_ID: &str = "attachment-one";
-
-    struct ActiveAttachmentTest {
-        _tempdir: tempfile::TempDir,
-        store: JobStore,
-        host: NativeHost,
-        job_id: String,
-        claim_token: String,
-        bundle_path: PathBuf,
-    }
-
-    impl ActiveAttachmentTest {
-        fn open(&mut self) -> Value {
-            let job_id = self.job_id.clone();
-            let claim_token = self.claim_token.clone();
-            self.host.handle_message(json!({
-                "protocol": NATIVE_PROTOCOL,
-                "type": "tokenless.native.attachment_open",
-                "jobId": job_id,
-                "claimToken": claim_token,
-                "bundleId": TEST_ATTACHMENT_BUNDLE_ID,
-                "attachmentId": TEST_ATTACHMENT_ID,
-            }))
-        }
-
-        fn read(&mut self, handle_id: &str, offset: u64, max_bytes: u64) -> Value {
-            let job_id = self.job_id.clone();
-            let claim_token = self.claim_token.clone();
-            self.host.handle_message(json!({
-                "protocol": NATIVE_PROTOCOL,
-                "type": "tokenless.native.attachment_read",
-                "jobId": job_id,
-                "claimToken": claim_token,
-                "handleId": handle_id,
-                "offset": offset,
-                "maxBytes": max_bytes,
-            }))
-        }
-
-        fn close(&mut self, handle_id: &str) -> Value {
-            let job_id = self.job_id.clone();
-            let claim_token = self.claim_token.clone();
-            self.host.handle_message(json!({
-                "protocol": NATIVE_PROTOCOL,
-                "type": "tokenless.native.attachment_close",
-                "jobId": job_id,
-                "claimToken": claim_token,
-                "handleId": handle_id,
-            }))
-        }
-
-        fn complete(&mut self, completion: CompleteJob) -> Value {
-            let job_id = self.job_id.clone();
-            let claim_token = self.claim_token.clone();
-            let mut message = json!({
-                "protocol": NATIVE_PROTOCOL,
-                "type": "tokenless.native.daemon_complete_job",
-                "jobId": job_id,
-                "claimToken": claim_token,
-            });
-            let object = message.as_object_mut().unwrap();
-            match completion {
-                CompleteJob::Succeeded { result_json } => {
-                    object.insert("result".to_owned(), result_json);
-                }
-                CompleteJob::Failed { error_json } => {
-                    object.insert("error".to_owned(), error_json);
-                }
-            }
-            self.host.handle_message(message)
-        }
-    }
-
-    fn active_attachment_test(bytes: &[u8], declared_sha256: Option<&str>) -> ActiveAttachmentTest {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let bundle_path = store
-            .home_dir()
-            .join(VISIBLE_ATTACHMENT_DIRECTORY)
-            .join(TEST_ATTACHMENT_BUNDLE_ID);
-        fs::create_dir_all(&bundle_path).unwrap();
-        fs::write(bundle_path.join(format!("{TEST_ATTACHMENT_ID}.bin")), bytes).unwrap();
-        let sha256 = declared_sha256
-            .map(str::to_owned)
-            .unwrap_or_else(|| hex_lower(&Sha256::digest(bytes)));
-        let job = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({
-                    "prompt": "attach this",
-                    "attachments": [{
-                        "protocol": VISIBLE_ATTACHMENT_PROTOCOL,
-                        "bundleId": TEST_ATTACHMENT_BUNDLE_ID,
-                        "attachmentId": TEST_ATTACHMENT_ID,
-                        "name": "evidence.txt",
-                        "type": "text/plain",
-                        "size": bytes.len(),
-                        "sha256": sha256,
-                    }],
-                }),
-            ))
-            .unwrap();
-        let mut host = NativeHost::new(store.clone());
-        host.connect_bridge(None, None).unwrap();
-        let push = host.poll_bridge_now().unwrap().unwrap();
-        assert_eq!(push["result"]["job"]["job_id"], job.job_id);
-        let claim_token = push["result"]["job"]["claim_token"]
-            .as_str()
-            .unwrap()
-            .to_owned();
-
-        ActiveAttachmentTest {
-            _tempdir: tempdir,
-            store,
-            host,
-            job_id: job.job_id,
-            claim_token,
-            bundle_path,
-        }
-    }
-
-    fn assert_native_error_contains(response: &Value, code: &str, message: &str) {
-        assert_eq!(response["ok"], false);
-        assert_eq!(response["error"]["code"], code);
-        assert!(
-            response["error"]["message"]
-                .as_str()
-                .unwrap()
-                .contains(message),
-            "unexpected native error: {response}"
-        );
-    }
-
-    fn test_attachment_descriptor(bundle_id: &str, attachment_id: &str, size: u64) -> Value {
-        json!({
-            "protocol": VISIBLE_ATTACHMENT_PROTOCOL,
-            "bundleId": bundle_id,
-            "attachmentId": attachment_id,
-            "name": format!("{attachment_id}.txt"),
-            "type": "text/plain",
-            "size": size,
-            "sha256": "0".repeat(64),
-        })
-    }
-
-    #[test]
-    fn visible_attachment_request_limits_are_revalidated_by_native_host() {
-        let empty = visible_attachment_descriptors(&json!({ "attachments": [] })).unwrap_err();
-        assert!(empty.to_string().contains("between 1 and 100"));
-
-        let mixed_bundles = visible_attachment_descriptors(&json!({
-            "attachments": [
-                test_attachment_descriptor("bundle-one", "first", 1),
-                test_attachment_descriptor("bundle-two", "second", 1),
-            ],
-        }))
-        .unwrap_err();
-        assert!(mixed_bundles.to_string().contains("share one bundle"));
-
-        let duplicate = visible_attachment_descriptors(&json!({
-            "attachments": [
-                test_attachment_descriptor("bundle-one", "duplicate", 1),
-                test_attachment_descriptor("bundle-one", "duplicate", 1),
-            ],
-        }))
-        .unwrap_err();
-        assert!(duplicate.to_string().contains("duplicated"));
-
-        let oversized = visible_attachment_descriptors(&json!({
-            "attachments": [
-                test_attachment_descriptor("bundle-one", "first", 300 * 1024 * 1024),
-                test_attachment_descriptor("bundle-one", "second", 300 * 1024 * 1024),
-            ],
-        }))
-        .unwrap_err();
-        assert!(oversized.to_string().contains("aggregate size"));
-
-        let too_many = (0..=MAX_VISIBLE_ATTACHMENTS)
-            .map(|index| {
-                test_attachment_descriptor("bundle-one", &format!("attachment-{index}"), 0)
-            })
-            .collect::<Vec<_>>();
-        let too_many =
-            visible_attachment_descriptors(&json!({ "attachments": too_many })).unwrap_err();
-        assert!(too_many.to_string().contains("between 1 and 100"));
-    }
-
-    #[test]
-    fn visible_attachment_multi_read_must_verify_integrity_before_close() {
-        let bytes = b"visible attachment split across several reads";
-        let mut fixture = active_attachment_test(bytes, None);
-        let opened = fixture.open();
-        assert_eq!(opened["ok"], true);
-        let handle_id = opened["result"]["handleId"].as_str().unwrap().to_owned();
-
-        let premature = fixture.close(&handle_id);
-        assert_native_error_contains(
-            &premature,
-            "invalid_native_message",
-            "complete, integrity-verified read",
-        );
-        assert!(fixture.host.attachment_handles.contains_key(&handle_id));
-
-        let first = fixture.read(&handle_id, 0, 5);
-        assert_eq!(first["ok"], true);
-        assert_eq!(first["result"]["nextOffset"], 5);
-        assert_eq!(first["result"]["eof"], false);
-        let after_first = fixture.close(&handle_id);
-        assert_native_error_contains(
-            &after_first,
-            "invalid_native_message",
-            "complete, integrity-verified read",
-        );
-
-        let second = fixture.read(&handle_id, 5, 7);
-        assert_eq!(second["ok"], true);
-        assert_eq!(second["result"]["nextOffset"], 12);
-        assert_eq!(second["result"]["eof"], false);
-        let final_chunk = fixture.read(&handle_id, 12, MAX_VISIBLE_ATTACHMENT_CHUNK_BYTES as u64);
-        assert_eq!(final_chunk["ok"], true);
-        assert_eq!(final_chunk["result"]["nextOffset"], bytes.len());
-        assert_eq!(final_chunk["result"]["eof"], true);
-
-        let mut reconstructed = STANDARD
-            .decode(first["result"]["dataBase64"].as_str().unwrap())
-            .unwrap();
-        reconstructed.extend(
-            STANDARD
-                .decode(second["result"]["dataBase64"].as_str().unwrap())
-                .unwrap(),
-        );
-        reconstructed.extend(
-            STANDARD
-                .decode(final_chunk["result"]["dataBase64"].as_str().unwrap())
-                .unwrap(),
-        );
-        assert_eq!(reconstructed, bytes);
-        assert!(
-            fixture.host.attachment_handles[&handle_id].integrity_verified,
-            "EOF must record a successful size and SHA-256 verification"
-        );
-
-        let closed = fixture.close(&handle_id);
-        assert_eq!(closed["ok"], true);
-        assert_eq!(closed["result"]["status"], "closed");
-        assert!(!fixture.host.attachment_handles.contains_key(&handle_id));
-        assert!(fixture.bundle_path.exists());
-
-        let early_ready = fixture.host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.daemon_ready",
-            "requestId": "ready-before-terminal",
-            "jobId": fixture.job_id,
-            "claimToken": fixture.claim_token,
-        }));
-        assert_native_error_contains(
-            &early_ready,
-            "invalid_native_message",
-            "before the job is terminal",
-        );
-        assert!(fixture.bundle_path.exists());
-        assert!(fixture
-            .host
-            .bridge
-            .as_ref()
-            .unwrap()
-            .current_claim
-            .is_some());
-
-        let completed = fixture.complete(CompleteJob::Succeeded {
-            result_json: json!({ "status": "submitted" }),
-        });
-        assert_eq!(completed["ok"], true);
-        assert_eq!(completed["result"]["status"], "succeeded");
-        assert_eq!(
-            fixture.store.get_job(&fixture.job_id).unwrap().status,
-            JobStatus::Succeeded
-        );
-        assert!(!fixture.bundle_path.exists());
-        let ready = fixture.host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.daemon_ready",
-            "requestId": "ready-after-terminal",
-            "jobId": fixture.job_id,
-            "claimToken": fixture.claim_token,
-        }));
-        assert_eq!(ready["ok"], true);
-        assert_eq!(ready["requestId"], "ready-after-terminal");
-    }
-
-    #[test]
-    fn visible_attachment_rejects_wrong_claim_and_undeclared_descriptor() {
-        let bytes = b"claim-bound bytes";
-        let mut fixture = active_attachment_test(bytes, None);
-        let job_id = fixture.job_id.clone();
-        let claim_token = fixture.claim_token.clone();
-
-        let undeclared = fixture.host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.attachment_open",
-            "jobId": job_id,
-            "claimToken": claim_token,
-            "bundleId": TEST_ATTACHMENT_BUNDLE_ID,
-            "attachmentId": "not-declared",
-        }));
-        assert_native_error_contains(
-            &undeclared,
-            "invalid_native_message",
-            "not declared by the active job",
-        );
-
-        let wrong_claim = fixture.host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.attachment_open",
-            "jobId": fixture.job_id,
-            "claimToken": "wrong-claim-token",
-            "bundleId": TEST_ATTACHMENT_BUNDLE_ID,
-            "attachmentId": TEST_ATTACHMENT_ID,
-        }));
-        assert_native_error_contains(&wrong_claim, "claim_rejected", "claim rejected");
-        assert!(fixture.host.attachment_handles.is_empty());
-
-        let opened = fixture.open();
-        assert_eq!(opened["ok"], true);
-        let handle_id = opened["result"]["handleId"].as_str().unwrap().to_owned();
-        let wrong_read_claim = fixture.host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.attachment_read",
-            "jobId": fixture.job_id,
-            "claimToken": "wrong-claim-token",
-            "handleId": handle_id,
-            "offset": 0,
-            "maxBytes": bytes.len(),
-        }));
-        assert_native_error_contains(&wrong_read_claim, "claim_rejected", "claim rejected");
-        assert_eq!(fixture.host.attachment_handles[&handle_id].next_offset, 0);
-
-        let read = fixture.read(&handle_id, 0, bytes.len() as u64);
-        assert_eq!(read["ok"], true);
-        assert_eq!(read["result"]["eof"], true);
-        assert_eq!(fixture.close(&handle_id)["ok"], true);
-        assert_eq!(
-            fixture.complete(CompleteJob::Succeeded {
-                result_json: json!({ "status": "submitted" }),
-            })["ok"],
-            true
-        );
-    }
-
-    #[test]
-    fn visible_attachment_wrong_offset_does_not_advance_or_poison_handle() {
-        let bytes = b"strictly sequential bytes";
-        let mut fixture = active_attachment_test(bytes, None);
-        let opened = fixture.open();
-        let handle_id = opened["result"]["handleId"].as_str().unwrap().to_owned();
-
-        let wrong_offset = fixture.read(&handle_id, 1, bytes.len() as u64);
-        assert_native_error_contains(&wrong_offset, "invalid_native_message", "expected offset 0");
-        let handle = &fixture.host.attachment_handles[&handle_id];
-        assert_eq!(handle.next_offset, 0);
-        assert!(!handle.integrity_verified);
-
-        let read = fixture.read(&handle_id, 0, bytes.len() as u64);
-        assert_eq!(read["ok"], true);
-        assert_eq!(read["result"]["eof"], true);
-        assert_eq!(fixture.close(&handle_id)["ok"], true);
-        assert_eq!(
-            fixture.complete(CompleteJob::Succeeded {
-                result_json: json!({ "status": "submitted" }),
-            })["ok"],
-            true
-        );
-    }
-
-    #[test]
-    fn visible_attachment_corrupt_hash_cannot_close_and_terminal_failure_cleans_up() {
-        let bytes = b"these bytes do not match the declared digest";
-        let mut fixture = active_attachment_test(bytes, Some(&"0".repeat(64)));
-        let opened = fixture.open();
-        assert_eq!(opened["ok"], true);
-        let handle_id = opened["result"]["handleId"].as_str().unwrap().to_owned();
-
-        let corrupt = fixture.read(&handle_id, 0, bytes.len() as u64);
-        assert_native_error_contains(
-            &corrupt,
-            "invalid_native_message",
-            "SHA-256 integrity check failed",
-        );
-        let handle = &fixture.host.attachment_handles[&handle_id];
-        assert_eq!(handle.next_offset, bytes.len() as u64);
-        assert!(!handle.integrity_verified);
-
-        let close = fixture.close(&handle_id);
-        assert_native_error_contains(
-            &close,
-            "invalid_native_message",
-            "complete, integrity-verified read",
-        );
-        assert!(fixture.host.attachment_handles.contains_key(&handle_id));
-
-        let failed = fixture.complete(CompleteJob::Failed {
-            error_json: json!({
-                "code": "attachment_integrity_failed",
-                "message": "The staged attachment failed verification.",
-            }),
-        });
-        assert_eq!(failed["ok"], true);
-        assert_eq!(failed["result"]["status"], "failed");
-        assert!(fixture.host.attachment_handles.is_empty());
-        assert_eq!(
-            fixture.store.get_job(&fixture.job_id).unwrap().status,
-            JobStatus::Failed
-        );
-        assert!(!fixture.bundle_path.exists());
-    }
-
-    #[test]
-    fn orphan_cleanup_preserves_expired_bundle_for_active_queued_job() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let attachment_root = store.home_dir().join(VISIBLE_ATTACHMENT_DIRECTORY);
-        let active_bundle = attachment_root.join("active-bundle");
-        let orphan_bundle = attachment_root.join("orphan-bundle");
-        fs::create_dir_all(&active_bundle).unwrap();
-        fs::create_dir_all(&orphan_bundle).unwrap();
-        fs::write(active_bundle.join("active-attachment.bin"), b"active").unwrap();
-        fs::write(orphan_bundle.join("orphan-attachment.bin"), b"orphan").unwrap();
-        store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({
-                    "prompt": "keep active upload",
-                    "attachments": [{
-                        "protocol": VISIBLE_ATTACHMENT_PROTOCOL,
-                        "bundleId": "active-bundle",
-                        "attachmentId": "active-attachment",
-                        "name": "active.txt",
-                        "type": "text/plain",
-                        "size": 6,
-                        "sha256": "0".repeat(64),
-                    }],
-                }),
-            ))
-            .unwrap();
-        let active_bundle_ids =
-            visible_attachment_bundle_ids(&store.active_request_jsons().unwrap()).unwrap();
-
-        let removed = cleanup_orphaned_visible_attachment_bundles(
-            store.home_dir(),
-            Duration::ZERO,
-            &active_bundle_ids,
-        )
-        .unwrap();
-
-        assert_eq!(removed, 1);
-        assert!(active_bundle.exists());
-        assert!(!orphan_bundle.exists());
-    }
-
-    #[test]
-    fn framing_round_trip_versions_request_and_response() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let request = json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.ping",
-            "requestId": "ping-1"
-        });
-        let mut encoded = Vec::new();
-        write_native_message(&mut encoded, &request).unwrap();
-        let mut output = Vec::new();
-        run_native_host(store, Cursor::new(encoded), &mut output).unwrap();
-        let response = read_native_message(&mut Cursor::new(output))
-            .unwrap()
-            .unwrap();
-        assert_eq!(response["protocol"], NATIVE_PROTOCOL);
-        assert_eq!(response["type"], "tokenless.native.pong");
-        assert_eq!(response["requestId"], "ping-1");
-        assert_eq!(response["ok"], true);
-    }
-
-    #[test]
-    fn malformed_json_frame_returns_structured_error_without_panicking() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let mut input = 1_u32.to_le_bytes().to_vec();
-        input.push(b'{');
-        let mut output = Vec::new();
-
-        run_native_host(store, Cursor::new(input), &mut output).unwrap();
-
-        let response = read_native_message(&mut Cursor::new(output))
-            .unwrap()
-            .unwrap();
-        assert_eq!(response["protocol"], NATIVE_PROTOCOL);
-        assert_eq!(response["type"], "tokenless.native.error");
-        assert_eq!(response["ok"], false);
-        assert_eq!(response["error"]["code"], "invalid_native_message");
-    }
-
-    #[test]
-    fn rejects_explicitly_wrong_native_protocol() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let mut host = NativeHost::new(JobStore::open(tempdir.path()).unwrap());
-        let response = host.handle_message(json!({
-            "protocol": "tokenless.native.v999",
-            "type": "tokenless.native.ping",
-        }));
-        assert_eq!(response["protocol"], NATIVE_PROTOCOL);
-        assert_eq!(response["ok"], false);
-        assert_eq!(response["error"]["code"], "unsupported_native_protocol");
-
-        let missing = host.handle_message(json!({
-            "type": "tokenless.native.read_config",
-        }));
-        assert_eq!(missing["protocol"], NATIVE_PROTOCOL);
-        assert_eq!(missing["ok"], false);
-        assert_eq!(missing["error"]["code"], "unsupported_native_protocol");
-    }
-
-    #[test]
-    fn framing_enforces_input_and_output_boundaries() {
-        let exact = Value::String("x".repeat(MAX_NATIVE_OUTPUT_BYTES - 2));
-        let mut output = Vec::new();
-        write_native_message(&mut output, &exact).unwrap();
-        assert_eq!(output.len(), MAX_NATIVE_OUTPUT_BYTES + 4);
-
-        let oversized = Value::String("x".repeat(MAX_NATIVE_OUTPUT_BYTES - 1));
-        let mut rejected_output = Vec::new();
-        assert!(matches!(
-            write_native_message(&mut rejected_output, &oversized),
-            Err(DaemonError::InvalidInput(_))
-        ));
-        assert!(rejected_output.is_empty());
-
-        let mut oversized_header = Cursor::new(
-            u32::try_from(MAX_NATIVE_INPUT_BYTES + 1)
-                .unwrap()
-                .to_le_bytes()
-                .to_vec(),
-        );
-        assert!(matches!(
-            read_native_message(&mut oversized_header),
-            Err(DaemonError::InvalidInput(_))
-        ));
-    }
-
-    #[test]
-    fn bridge_pushes_one_running_job_until_ready() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let first = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "one" }),
-            ))
-            .unwrap();
-        let second = store
-            .create_job(CreateJob::new(
-                "claude",
-                "submit",
-                json!({ "prompt": "two" }),
-            ))
-            .unwrap();
-        let mut host = NativeHost::new(store.clone());
-        let connected = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.daemon_connect",
-        }));
-        assert_eq!(connected["ok"], true);
-
-        let first_push = host.poll_bridge_now().unwrap().unwrap();
-        assert_eq!(first_push["type"], "tokenless.native.daemon_job");
-        assert_eq!(first_push["result"]["job"]["job_id"], first.job_id);
-        assert_eq!(first_push["result"]["job"]["status"], "running");
-        let first_claim_token = first_push["result"]["job"]["claim_token"]
-            .as_str()
-            .unwrap()
-            .to_owned();
-        assert!(host.poll_bridge_now().unwrap().is_none());
-        assert_eq!(
-            store.get_job(&second.job_id).unwrap().status,
-            JobStatus::Queued
-        );
-
-        store
-            .complete_job(
-                &first.job_id,
-                &first_claim_token,
-                CompleteJob::Succeeded {
-                    result_json: json!({ "status": "submitted" }),
-                },
-            )
-            .unwrap();
-
-        let ready = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.daemon_ready",
-            "jobId": first.job_id,
-            "claimToken": first_claim_token,
-        }));
-        assert_eq!(ready["ok"], true);
-        assert_eq!(ready["result"]["jobId"], first.job_id);
-        let second_push = host.poll_bridge_now().unwrap().unwrap();
-        assert_eq!(second_push["result"]["job"]["job_id"], second.job_id);
-    }
-
-    #[test]
-    fn daemon_ready_strictly_correlates_and_stale_or_duplicate_ready_cannot_release_claim() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let first = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "one" }),
-            ))
-            .unwrap();
-        let second = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "two" }),
-            ))
-            .unwrap();
-        let mut host = NativeHost::new(store.clone());
-        host.connect_bridge(None, None).unwrap();
-        let first_push = host.poll_bridge_now().unwrap().unwrap();
-        let first_token = first_push["result"]["job"]["claim_token"]
-            .as_str()
-            .unwrap()
-            .to_owned();
-
-        let bare = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.daemon_ready",
-        }));
-        assert_eq!(bare["ok"], false);
-        let wrong = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.daemon_ready",
-            "jobId": first.job_id,
-            "claimToken": "wrong-token",
-        }));
-        assert_eq!(wrong["ok"], false);
-        assert_eq!(wrong["error"]["code"], "claim_rejected");
-        let padded = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.daemon_ready",
-            "jobId": first.job_id,
-            "claimToken": format!(" {first_token} "),
-        }));
-        assert_eq!(padded["ok"], false);
-        assert_eq!(padded["error"]["code"], "claim_rejected");
-        assert!(host.poll_bridge_now().unwrap().is_none());
-        assert_eq!(
-            host.bridge
-                .as_ref()
-                .unwrap()
-                .current_claim
-                .as_ref()
-                .unwrap()
-                .job_id,
-            first.job_id
-        );
-
-        store
-            .complete_job(
-                &first.job_id,
-                &first_token,
-                CompleteJob::Succeeded {
-                    result_json: json!({ "status": "submitted" }),
-                },
-            )
-            .unwrap();
-
-        let accepted = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.daemon_ready",
-            "jobId": first.job_id,
-            "claimToken": first_token,
-        }));
-        assert_eq!(accepted["ok"], true);
-        let second_push = host.poll_bridge_now().unwrap().unwrap();
-        let second_token = second_push["result"]["job"]["claim_token"]
-            .as_str()
-            .unwrap()
-            .to_owned();
-        assert_eq!(second_push["result"]["job"]["job_id"], second.job_id);
-
-        let stale_duplicate = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.daemon_ready",
-            "jobId": first.job_id,
-            "claimToken": first_token,
-        }));
-        assert_eq!(stale_duplicate["ok"], false);
-        assert!(host.poll_bridge_now().unwrap().is_none());
-        assert_eq!(
-            host.bridge
-                .as_ref()
-                .unwrap()
-                .current_claim
-                .as_ref()
-                .unwrap()
-                .claim_token,
-            second_token
-        );
-    }
-
-    #[test]
-    fn oversized_claimed_job_is_failed_and_bridge_continues() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let oversized = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "x".repeat(MAX_NATIVE_OUTPUT_BYTES) }),
-            ))
-            .unwrap();
-        let next = store
-            .create_job(CreateJob::new(
-                "claude",
-                "submit",
-                json!({ "prompt": "small" }),
-            ))
-            .unwrap();
-        let mut host = NativeHost::new(store.clone());
-        host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.daemon_connect",
-        }));
-
-        let error_push = host.poll_bridge_now().unwrap().unwrap();
-        assert_eq!(error_push["type"], "tokenless.native.daemon_error");
-        assert_eq!(error_push["error"]["code"], "native_message_too_large");
-        assert!(encoded_message_size(&error_push).unwrap() <= MAX_NATIVE_OUTPUT_BYTES);
-        let failed = store.get_job(&oversized.job_id).unwrap();
-        assert_eq!(failed.status, JobStatus::Failed);
-        assert_eq!(
-            failed.error_json.unwrap()["code"],
-            "native_message_too_large"
-        );
-
-        let next_push = host.poll_bridge_now().unwrap().unwrap();
-        assert_eq!(next_push["result"]["job"]["job_id"], next.job_id);
-    }
-
-    #[test]
-    fn native_config_history_and_completion_are_compact() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let mut host = NativeHost::new(store.clone());
-        let config = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.write_config",
-            "preferredProviders": ["claude", "chatgpt"],
-            "browser": "brave",
-            "daemonUrl": "http://localhost:7331/",
-        }));
-        assert_eq!(config["ok"], true);
-        assert_eq!(config["result"]["protocol"], "tokenless.config.v1");
-        assert_eq!(config["result"]["browser"], "brave");
-        let cleared = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.write_config",
-            "browser": null,
-            "daemonUrl": null,
-        }));
-        assert_eq!(cleared["result"]["browser"], Value::Null);
-        assert_eq!(cleared["result"]["daemonUrl"], Value::Null);
-        assert_eq!(
-            cleared["result"]["preferredProviders"],
-            json!(["claude", "chatgpt"])
-        );
-
-        let job = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({
-                    "prompt": "private".repeat(100_000),
-                    "metadata": {
-                        "taskId": "task-1",
-                        "projectName": "Tokenless",
-                        "secret": "must-not-leak",
-                    }
-                }),
-            ))
-            .unwrap();
-        let history = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.list_history",
-            "limit": 60,
-        }));
-        assert_eq!(history["ok"], true);
-        assert_eq!(history["result"][0]["job_id"], job.job_id);
-        assert_eq!(history["result"][0]["metadata"]["taskId"], "task-1");
-        assert!(history["result"][0].get("request_json").is_none());
-        assert!(history["result"][0].get("result_json").is_none());
-        assert!(history["result"][0].get("claim_token").is_none());
-        assert!(serde_json::to_string(&history)
-            .unwrap()
-            .find("must-not-leak")
-            .is_none());
-        assert!(encoded_message_size(&history).unwrap() < 10_000);
-
-        let claimed = store
-            .claim_next_job(ClaimNextJob::default())
-            .unwrap()
-            .unwrap();
-        store
-            .mark_running(&claimed.job_id, &claimed.claim_token)
-            .unwrap();
-        let completed = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.daemon_complete_job",
-            "jobId": claimed.job_id,
-            "claimToken": claimed.claim_token,
-            "result": { "snapshot": "x".repeat(MAX_NATIVE_OUTPUT_BYTES) },
-        }));
-        assert_eq!(completed["ok"], true);
-        assert_eq!(completed["result"]["status"], "succeeded");
-        assert!(completed["result"].get("result_json").is_none());
-        assert!(encoded_message_size(&completed).unwrap() < 10_000);
-
-        let failed = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "another private prompt" }),
-            ))
-            .unwrap();
-        let failed_claim = store
-            .claim_next_job(ClaimNextJob::default())
-            .unwrap()
-            .unwrap();
-        assert_eq!(failed_claim.job_id, failed.job_id);
-        store
-            .mark_running(&failed_claim.job_id, &failed_claim.claim_token)
-            .unwrap();
-        store
-            .complete_job(
-                &failed_claim.job_id,
-                &failed_claim.claim_token,
-                CompleteJob::Failed {
-                    error_json: json!({
-                        "code": "attacker-controlled-private-code",
-                        "message": "attacker-controlled-private-message",
-                        "payload": "x".repeat(MAX_NATIVE_INPUT_BYTES),
-                    }),
-                },
-            )
-            .unwrap();
-        let redacted_history = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.list_history",
-        }));
-        let serialized = serde_json::to_string(&redacted_history).unwrap();
-        assert_eq!(redacted_history["ok"], true);
-        assert!(!serialized.contains("attacker-controlled-private"));
-        assert!(redacted_history["result"][0].get("error_json").is_none());
-        assert!(redacted_history["result"][0].get("error_code").is_none());
-        assert!(encoded_message_size(&redacted_history).unwrap() < 10_000);
-    }
-
-    #[test]
-    fn native_history_is_stably_newest_first() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let older = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "older" }),
-            ))
-            .unwrap();
-        thread::sleep(Duration::from_millis(2));
-        let newer = store
-            .create_job(CreateJob::new(
-                "claude",
-                "submit",
-                json!({ "prompt": "newer" }),
-            ))
-            .unwrap();
-        let mut host = NativeHost::new(store);
-
-        let history = host.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.list_history",
-        }));
-
-        assert_eq!(history["result"][0]["job_id"], newer.job_id);
-        assert_eq!(history["result"][1]["job_id"], older.job_id);
-    }
-
-    #[test]
-    fn bridge_ownership_is_exclusive_without_blocking_short_lived_hosts() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store = JobStore::open(tempdir.path()).unwrap();
-        let marker_path = store.home_dir().join(BRIDGE_MARKER_FILE_NAME);
-        let first = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "owned by first bridge" }),
-            ))
-            .unwrap();
-        let second = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "available to next bridge" }),
-            ))
-            .unwrap();
-        let mut old_host = NativeHost::new(store.clone());
-        old_host
-            .connect_bridge(None, None)
-            .expect("old bridge connects");
-        let first_push = old_host.poll_bridge_now().unwrap().unwrap();
-        let first_claim_token = first_push["result"]["job"]["claim_token"]
-            .as_str()
-            .unwrap()
-            .to_owned();
-        let old_marker: BridgeMarker =
-            serde_json::from_slice(&fs::read(&marker_path).unwrap()).unwrap();
-        assert_eq!(old_marker.protocol, BRIDGE_MARKER_PROTOCOL);
-        assert_eq!(old_marker.session_id, old_host.session_id);
-
-        thread::sleep(Duration::from_millis(2));
-        old_host.bridge.as_mut().unwrap().next_heartbeat = Instant::now();
-        assert!(old_host.tick().unwrap().is_empty());
-        let heartbeated: BridgeMarker =
-            serde_json::from_slice(&fs::read(&marker_path).unwrap()).unwrap();
-        assert_ne!(heartbeated.heartbeat_at, old_marker.heartbeat_at);
-
-        let mut new_host = NativeHost::new(store.clone());
-        assert!(matches!(
-            new_host.connect_bridge(None, None),
-            Err(DaemonError::BridgeBusy)
-        ));
-        let unchanged_marker: BridgeMarker =
-            serde_json::from_slice(&fs::read(&marker_path).unwrap()).unwrap();
-        assert_eq!(unchanged_marker.session_id, old_marker.session_id);
-
-        let started = Instant::now();
-        let mut short_lived = NativeHost::new(store.clone());
-        let config = short_lived.handle_message(json!({
-            "protocol": NATIVE_PROTOCOL,
-            "type": "tokenless.native.read_config",
-        }));
-        assert_eq!(config["ok"], true);
-        drop(short_lived);
-        assert!(started.elapsed() < Duration::from_secs(1));
-
-        old_host.disconnect().unwrap();
-        assert!(!marker_path.exists());
-        let abandoned = store.get_job(&first.job_id).unwrap();
-        assert_eq!(abandoned.status, JobStatus::Running);
-        assert_eq!(abandoned.claim_token, first_claim_token);
-
-        new_host
-            .connect_bridge(None, None)
-            .expect("new bridge connects after ownership is released");
-        let new_marker: BridgeMarker =
-            serde_json::from_slice(&fs::read(&marker_path).unwrap()).unwrap();
-        assert_ne!(new_marker.session_id, old_marker.session_id);
-        let second_push = new_host.poll_bridge_now().unwrap().unwrap();
-        assert_eq!(second_push["result"]["job"]["job_id"], second.job_id);
-        assert_eq!(
-            store.get_job(&first.job_id).unwrap().status,
-            JobStatus::Running
-        );
-        new_host.disconnect().unwrap();
-        assert!(!marker_path.exists());
-    }
-
-    #[test]
-    fn connected_bridge_renews_the_active_claim() {
-        let tempdir = tempfile::tempdir().unwrap();
-        let store =
-            JobStore::open_with_claim_lease(tempdir.path(), Duration::from_millis(150)).unwrap();
-        let job = store
-            .create_job(CreateJob::new(
-                "chatgpt",
-                "submit",
-                json!({ "prompt": "renew me" }),
-            ))
-            .unwrap();
-        let mut host = NativeHost::new(store.clone());
-        host.connect_bridge(None, None).unwrap();
-        host.poll_bridge_now().unwrap().unwrap();
-        let initial_expiry = store
-            .get_job(&job.job_id)
-            .unwrap()
-            .claim_expires_at_ms
-            .unwrap();
-
-        thread::sleep(Duration::from_millis(25));
-        host.bridge.as_mut().unwrap().next_renewal = Instant::now();
-        assert!(host.tick().unwrap().is_empty());
-        let renewed_expiry = store
-            .get_job(&job.job_id)
-            .unwrap()
-            .claim_expires_at_ms
-            .unwrap();
-        assert!(renewed_expiry > initial_expiry);
-    }
-
-    #[test]
-    fn native_host_home_prefers_env_then_installed_bin_layout() {
-        assert_eq!(
-            resolve_native_host_home(
-                Some(OsString::from("/explicit/tokenless")),
-                Path::new("/installed/tokenless/bin/tokenless-native-host")
-            )
-            .unwrap(),
-            PathBuf::from("/explicit/tokenless")
-        );
-        assert_eq!(
-            resolve_native_host_home(
-                None,
-                Path::new("/installed/tokenless/bin/tokenless-native-host.exe")
-            )
-            .unwrap(),
-            PathBuf::from("/installed/tokenless")
-        );
-        assert!(resolve_native_host_home(
-            None,
-            Path::new("/checkout/target/release/tokenless-native-host")
-        )
-        .is_err());
-    }
-}
diff --git a/scripts/check-api-contract.mjs b/scripts/check-api-contract.mjs
new file mode 100644
index 0000000..52ed436
--- /dev/null
+++ b/scripts/check-api-contract.mjs
@@ -0,0 +1,249 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import Ajv2020 from 'ajv/dist/2020.js'
+import addFormats from 'ajv-formats'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const openApiPath = path.join(root, 'api/tokenless-daemon-api.openapi.json')
+const uiOpenApiPath = path.join(root, 'api/tokenless-ui-api.openapi.json')
+const fixturePath = path.join(root, 'api/fixtures/openapi-success-responses.json')
+const openApiArtifactPath = 'api/tokenless-daemon-api.openapi.json'
+const uiOpenApiArtifactPath = 'api/tokenless-ui-api.openapi.json'
+const HTTP_METHODS = new Set(['get', 'put', 'post', 'delete', 'options', 'head', 'patch', 'trace'])
+
+const document = await readJson(openApiPath)
+await validateOpenApiDocument(openApiArtifactPath, document)
+console.log(`api:check validated ${openApiArtifactPath}`)
+const uiDocument = await readJson(uiOpenApiPath)
+validateUiOpenApiDocument(uiOpenApiArtifactPath, uiDocument)
+console.log(`api:check validated ${uiOpenApiArtifactPath}`)
+
+async function readJson(filePath) {
+  try {
+    return JSON.parse(await fs.readFile(filePath, 'utf8'))
+  } catch (error) {
+    throw new Error(`${path.relative(root, filePath)} is not valid JSON: ${error.message}`)
+  }
+}
+
+function validateOpenApiDocument(artifactPath, parsed) {
+  if (!isRecord(parsed)) throw new Error(`${artifactPath} must be an object`)
+  if (parsed.openapi !== '3.1.0') throw new Error(`${artifactPath} must be OpenAPI 3.1.0`)
+  if (!isRecord(parsed.info) || typeof parsed.info.title !== 'string' || parsed.info.version !== '1.0.0') {
+    throw new Error(`${artifactPath} must include info.title and API version 1.0.0`)
+  }
+  if (!isRecord(parsed.paths)) throw new Error(`${artifactPath} must include paths`)
+
+  const operationIds = new Set()
+  for (const [route, pathItem] of Object.entries(parsed.paths)) {
+    if (!isRecord(pathItem)) throw new Error(`${artifactPath} ${route} path item must be an object`)
+    const operations = Object.entries(pathItem).filter(([method]) => HTTP_METHODS.has(method))
+    if (operations.length === 0) throw new Error(`${artifactPath} ${route} must define an operation`)
+    for (const [method, operation] of operations) {
+      if (!isRecord(operation) || typeof operation.operationId !== 'string' || !operation.operationId) {
+        throw new Error(`${artifactPath} ${method.toUpperCase()} ${route} must define operationId`)
+      }
+      if (operationIds.has(operation.operationId)) {
+        throw new Error(`${artifactPath} operationId must be unique: ${operation.operationId}`)
+      }
+      operationIds.add(operation.operationId)
+      if (!isRecord(operation.responses) || Object.keys(operation.responses).length === 0) {
+        throw new Error(`${artifactPath} ${method.toUpperCase()} ${route} must define responses`)
+      }
+    }
+  }
+
+  if (!isRecord(parsed.components?.securitySchemes?.controlBearer)) {
+    throw new Error(`${artifactPath} must define controlBearer security scheme`)
+  }
+  if (JSON.stringify(parsed.security) !== JSON.stringify([{ controlBearer: [] }])) {
+    throw new Error(`${artifactPath} must require bearer auth by default`)
+  }
+  const readyOperation = getSingleOperation(parsed.paths['/ready'], '/ready')
+  if (JSON.stringify(readyOperation.security) !== '[]') {
+    throw new Error(`${artifactPath} /ready must explicitly opt out of bearer auth`)
+  }
+  for (const [route, pathItem] of Object.entries(parsed.paths)) {
+    if (route === '/ready') continue
+    for (const [method, operation] of Object.entries(pathItem)) {
+      if (!HTTP_METHODS.has(method)) continue
+      if (operation.security !== undefined && JSON.stringify(operation.security) !== JSON.stringify([{ controlBearer: [] }])) {
+        throw new Error(`${artifactPath} ${method.toUpperCase()} ${route} must use bearer auth`)
+      }
+    }
+  }
+
+  validateOpenApiReferences(artifactPath, parsed)
+  compileOpenApiComponentSchemas(artifactPath, parsed)
+  validateDaemonApiDoesNotExposeProtocolIdentity(artifactPath, parsed)
+  return validateOpenApiFixtures(artifactPath, parsed)
+}
+
+function validateUiOpenApiDocument(artifactPath, parsed) {
+  if (!isRecord(parsed)) throw new Error(`${artifactPath} must be an object`)
+  if (parsed.openapi !== '3.1.0') throw new Error(`${artifactPath} must be OpenAPI 3.1.0`)
+  if (!isRecord(parsed.info) || typeof parsed.info.title !== 'string' || parsed.info.version !== '1.0.0') {
+    throw new Error(`${artifactPath} must include info.title and API version 1.0.0`)
+  }
+  if (!isRecord(parsed.paths)) throw new Error(`${artifactPath} must include paths`)
+  if (!isRecord(parsed.components?.securitySchemes?.uiSession) || !isRecord(parsed.components?.securitySchemes?.csrf)) {
+    throw new Error(`${artifactPath} must define uiSession and csrf security schemes`)
+  }
+  if (JSON.stringify(parsed.security) !== JSON.stringify([{ uiSession: [] }])) {
+    throw new Error(`${artifactPath} must require the UI session by default`)
+  }
+
+  const mutationSecurity = JSON.stringify([{ uiSession: [], csrf: [] }])
+  const operationIds = new Set()
+  for (const [route, pathItem] of Object.entries(parsed.paths)) {
+    if (!isRecord(pathItem)) throw new Error(`${artifactPath} ${route} path item must be an object`)
+    const operations = Object.entries(pathItem).filter(([method]) => HTTP_METHODS.has(method))
+    if (operations.length === 0) throw new Error(`${artifactPath} ${route} must define an operation`)
+    for (const [method, operation] of operations) {
+      if (!isRecord(operation) || typeof operation.operationId !== 'string' || !operation.operationId) {
+        throw new Error(`${artifactPath} ${method.toUpperCase()} ${route} must define operationId`)
+      }
+      if (operationIds.has(operation.operationId)) {
+        throw new Error(`${artifactPath} operationId must be unique: ${operation.operationId}`)
+      }
+      operationIds.add(operation.operationId)
+      if (!isRecord(operation.responses) || Object.keys(operation.responses).length === 0) {
+        throw new Error(`${artifactPath} ${method.toUpperCase()} ${route} must define responses`)
+      }
+      if (method !== 'get' && JSON.stringify(operation.security) !== mutationSecurity) {
+        throw new Error(`${artifactPath} ${method.toUpperCase()} ${route} must require UI session and CSRF security`)
+      }
+    }
+  }
+  validateOpenApiReferences(artifactPath, parsed)
+  compileOpenApiComponentSchemas(artifactPath, parsed)
+}
+
+function getSingleOperation(pathItem, pathName) {
+  if (!isRecord(pathItem)) throw new Error(`${pathName} path item must be an object`)
+  const operations = Object.entries(pathItem).filter(([method]) => HTTP_METHODS.has(method))
+  if (operations.length !== 1) throw new Error(`${pathName} must define exactly one operation`)
+  return operations[0][1]
+}
+
+function validateOpenApiReferences(artifactPath, document) {
+  const visit = (value, trail) => {
+    if (Array.isArray(value)) {
+      value.forEach((item, index) => visit(item, `${trail}/${index}`))
+      return
+    }
+    if (!isRecord(value)) return
+    if (typeof value.$ref === 'string') resolveJsonPointer(document, value.$ref, artifactPath, trail)
+    for (const [key, child] of Object.entries(value)) visit(child, `${trail}/${escapeJsonPointer(key)}`)
+  }
+  visit(document, '')
+}
+
+function compileOpenApiComponentSchemas(artifactPath, document) {
+  const schemas = document.components?.schemas
+  if (!isRecord(schemas)) throw new Error(`${artifactPath} must define components.schemas`)
+  const ajv = newAjv()
+  const defs = Object.fromEntries(Object.entries(schemas).map(([name, schema]) => [name, rewriteOpenApiSchemaRefs(schema)]))
+  for (const [name, schema] of Object.entries(defs)) {
+    try {
+      ajv.compile({
+        $schema: 'https://json-schema.org/draft/2020-12/schema',
+        $defs: defs,
+        $ref: `#/$defs/${escapeJsonPointer(name)}`,
+      })
+    } catch (error) {
+      throw new Error(`${artifactPath} component schema ${name} is invalid: ${error.message}`)
+    }
+  }
+}
+
+function validateDaemonApiDoesNotExposeProtocolIdentity(artifactPath, document) {
+  const schemas = document.components?.schemas
+  for (const schemaName of ['ReadyResponse', 'DaemonErrorResponse', 'BrowserRuntimeStatus']) {
+    const serialized = JSON.stringify(schemas?.[schemaName])
+    if (serialized.includes('"protocol"')) {
+      throw new Error(`${artifactPath} ${schemaName} must not expose a daemon API identity field`)
+    }
+  }
+}
+
+async function validateOpenApiFixtures(artifactPath, document) {
+  const fixture = await readJson(fixturePath)
+  if (fixture.openapi !== artifactPath) {
+    throw new Error(`api fixture ${path.relative(root, fixturePath)} targets ${fixture.openapi}, expected ${artifactPath}`)
+  }
+  if (!Array.isArray(fixture.cases)) throw new Error('openapi success response fixture must include cases')
+  const schemas = document.components?.schemas
+  if (!isRecord(schemas)) throw new Error(`${artifactPath} must define components.schemas`)
+  const defs = Object.fromEntries(Object.entries(schemas).map(([name, schema]) => [name, rewriteOpenApiSchemaRefs(schema)]))
+  const ajv = newAjv()
+  for (const testCase of fixture.cases) {
+    if (!isRecord(testCase) || typeof testCase.name !== 'string' || typeof testCase.schema !== 'string') {
+      throw new Error('openapi success response fixture case is malformed')
+    }
+    const schema = rewriteOpenApiSchemaRefs(resolveJsonPointer(document, testCase.schema, artifactPath, `fixture ${testCase.name}`))
+    const validate = ajv.compile({
+      $schema: 'https://json-schema.org/draft/2020-12/schema',
+      $ref: '#/$defs/Fixture',
+      $defs: {
+        ...defs,
+        Fixture: schema,
+      },
+    })
+    const valid = validate(testCase.data)
+    if (valid !== testCase.valid) {
+      throw new Error(`openapi fixture ${testCase.name} expected valid=${testCase.valid}; errors=${JSON.stringify(validate.errors)}`)
+    }
+  }
+}
+
+function rewriteOpenApiSchemaRefs(value) {
+  if (Array.isArray(value)) return value.map(rewriteOpenApiSchemaRefs)
+  if (!isRecord(value)) return value
+  return Object.fromEntries(Object.entries(value).map(([key, child]) => {
+    if (key === '$ref' && typeof child === 'string' && child.startsWith('#/components/schemas/')) {
+      return [key, `#/$defs/${child.slice('#/components/schemas/'.length)}`]
+    }
+    return [key, rewriteOpenApiSchemaRefs(child)]
+  }))
+}
+
+function resolveJsonPointer(document, ref, artifactPath, trail) {
+  if (!ref.startsWith('#/')) {
+    throw new Error(`${artifactPath} external OpenAPI $ref is not supported at ${trail}: ${ref}`)
+  }
+  let current = document
+  for (const rawPart of ref.slice(2).split('/')) {
+    const part = rawPart.replace(/~1/g, '/').replace(/~0/g, '~')
+    if (!isRecord(current) && !Array.isArray(current)) {
+      throw new Error(`${artifactPath} unresolved $ref at ${trail}: ${ref}`)
+    }
+    current = current[part]
+    if (current === undefined) throw new Error(`${artifactPath} unresolved $ref at ${trail}: ${ref}`)
+  }
+  return current
+}
+
+function escapeJsonPointer(value) {
+  return value.replace(/~/g, '~0').replace(/\//g, '~1')
+}
+
+function newAjv() {
+  const ajv = new Ajv2020({ allErrors: true, strict: true, strictRequired: false })
+  ajv.addKeyword({
+    keyword: 'x-tokenless-maxUtf8Bytes',
+    type: 'string',
+    schemaType: 'number',
+    validate(limit, value) {
+      return Buffer.byteLength(value, 'utf8') <= limit
+    },
+  })
+  addFormats(ajv)
+  return ajv
+}
+
+function isRecord(value) {
+  return Boolean(value && typeof value === 'object' && !Array.isArray(value))
+}
diff --git a/scripts/prototypes/cloakbrowser-spike.NOTES.md b/scripts/prototypes/cloakbrowser-spike.NOTES.md
new file mode 100644
index 0000000..925aa35
--- /dev/null
+++ b/scripts/prototypes/cloakbrowser-spike.NOTES.md
@@ -0,0 +1,104 @@
+# CloakBrowser spike notes
+
+This is a throwaway prototype. Delete it and remove the `prototype:cloakbrowser`
+package script after the feasibility question is answered.
+
+## Question
+
+Can Tokenless drive the official no-key CloakBrowser `145.0.7632.109.2` binary
+across every declared provider through the production daemon/runner, and can
+the same browser launch path reach ordinary Google Search without a CAPTCHA
+blocker?
+
+## Scope
+
+- Pins the official `145.0.7632.109.2` release on Linux x64, macOS arm64,
+  macOS x64, and Windows x64.
+- Rejects Linux arm64 because that exact 145 release has no Linux arm64 asset.
+- Uses an isolated runtime cache and a fresh, disposable guest profile.
+- Probes ChatGPT, Claude, Gemini, Grok, Qwen, and DeepSeek with real
+  `auth.status`, `blocker.check`, `prompt.input`, and conditional
+  `prompt.clear` plus `submit-and-read` jobs through the built CLI.
+- Uses a separate, isolated Playwright context with the same Cloak binary for
+  ordinary Google Search because Google Search is not an authorized Tokenless
+  provider origin.
+- Does not load `test/live-managed-playwright.e2e.mjs`, create an observer
+  Playwright client, or attach an external CDP connection.
+- Supports bounded `--observe-google-ms=<milliseconds>` and
+  `--observe-ms=<milliseconds>` periods for direct macOS accessibility and
+  process inspection.
+- Does not touch the user's configured Tokenless home, managed profile,
+  Keychain, browser credentials, or browser storage.
+
+## Result
+
+Run on 2026-08-01 on `darwin-arm64` with wrapper `0.5.3` and the official
+no-key macOS binary `145.0.7632.109.2`.
+
+### Google Search
+
+- A fresh Cloak context navigated to a normal Google Search for
+  `OpenAI API documentation`.
+- Google returned HTTP 200 at `/search`; real result links and page navigation
+  were visibly rendered.
+- No `/sorry/` redirect, reCAPTCHA iframe, unusual-traffic warning, or consent
+  blocker appeared. The machine result records `captchaTriggered: false`.
+- Direct macOS accessibility observation independently confirmed the visible
+  result page.
+
+This proves one ordinary search succeeded without triggering a challenge. It
+does not prove that Cloak can solve reCAPTCHA, because no challenge appeared,
+and it is not a CAPTCHA-rate measurement.
+
+### Provider sweep
+
+| Provider | Guest result | Conversation result | Visible blocker |
+| --- | --- | --- | --- |
+| ChatGPT | Guest composer; readiness, draft, and clear succeeded | ChatGPT visibly returned the exact marker, but the durable job failed with `playwright_response_timeout` | None |
+| Claude | Signed-out page loaded; readiness returned | Not submitted; `provider_sign_in_required` | Sign-in only; no CAPTCHA or Cloudflare |
+| Gemini | Readiness, draft, and clear succeeded | Exact marker response and durable state succeeded | None |
+| Grok | Homepage, guest composer, model selector, and attachment control rendered | Not submitted; runtime returned `provider_sign_in_required` | Sign-in only; no CAPTCHA or Cloudflare |
+| Qwen | Guest composer; readiness, draft, and clear succeeded | Exact marker response and durable state succeeded | None |
+| DeepSeek | Signed-out page loaded; readiness returned | Not submitted; `provider_sign_in_required` | Sign-in only; no CAPTCHA |
+
+Grok also exposed a transient navigation race during its prompt action:
+`page.evaluate: Execution context was destroyed, most likely because of a
+navigation`. The final CLI handoff was the expected sign-in requirement. This
+is a runtime timing issue to qualify with a signed-in Cloak profile, not a
+fingerprint or CAPTCHA block.
+
+### Runtime evidence
+
+- The binary launched and reported `Chromium 145.0.7632.109`.
+- The current dirty worktree built successfully.
+- All six provider origins were reached through the production Tokenless
+  daemon/runner and its own `playwright-core` persistent context.
+- The browser used `--remote-debugging-pipe`; renderer processes carried a
+  generated Cloak `--fingerprint` value.
+- Test-only `--password-store=basic` and `--use-mock-keychain` flags remained
+  present, Chromium sandboxing remained enabled, and no Keychain prompt
+  appeared.
+- No CAPTCHA was observed on Google Search or any of the six provider pages.
+- Direct observation confirmed the exact ChatGPT, Gemini, and Qwen marker
+  responses, plus the real Grok, Claude, and DeepSeek signed-out surfaces.
+- The disposable Google context, Tokenless daemon, runner, browser, and guest
+  profile were removed after the observation period.
+
+## Verdict and next boundary
+
+CloakBrowser 145 is compatible with Tokenless's production Playwright runtime
+on macOS arm64 across all six declared provider origins. Gemini and Qwen passed
+the complete guest submit/read/durable-state loop. ChatGPT completed visibly
+but revealed a response-completion detector issue. Claude, Grok, and DeepSeek
+reached their real pages without an anti-bot challenge but require a signed-in
+profile for conversation acceptance.
+
+The user's existing managed profile was imported from Chrome 150, while this
+Cloak build is Chromium 145. Opening that profile in place would risk profile
+schema mutation; copying it would violate browser-secret handling rules.
+Signed-in acceptance should therefore use a dedicated Cloak-managed profile
+that the user signs into manually. Linux and Windows still require native
+execution tests even though exact 145 download assets exist.
+
+The machine-readable result is written to
+`test-results/cloakbrowser-spike/last-run.json`.
diff --git a/scripts/prototypes/cloakbrowser-spike.mjs b/scripts/prototypes/cloakbrowser-spike.mjs
new file mode 100644
index 0000000..01c0ab3
--- /dev/null
+++ b/scripts/prototypes/cloakbrowser-spike.mjs
@@ -0,0 +1,592 @@
+#!/usr/bin/env node
+/**
+ * PROTOTYPE — delete after the CloakBrowser feasibility question is answered.
+ *
+ * Question: can Tokenless drive the official no-key CloakBrowser legacy binary
+ * across every declared provider through the production daemon/runner, and can
+ * the same launch path reach ordinary Google Search without a CAPTCHA blocker?
+ */
+
+import { spawn } from 'node:child_process'
+import { constants as fsConstants } from 'node:fs'
+import fs from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { chromium } from 'playwright-core'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..')
+const artifactRoot = path.join(root, 'test-results', 'cloakbrowser-spike')
+const runtimeCache = path.join(artifactRoot, 'runtime-cache')
+const tokenlessHome = path.join(artifactRoot, 'tokenless-home')
+const googleProfile = path.join(artifactRoot, 'google-search-profile')
+const resultFile = path.join(artifactRoot, 'last-run.json')
+const profileSlug = 'cloak-spike'
+const wrapperVersion = '0.5.3'
+const observeMs = parseDurationArg(process.argv.slice(2), '--observe-ms=')
+const googleObserveMs = parseDurationArg(process.argv.slice(2), '--observe-google-ms=')
+const providers = Object.freeze(['chatgpt', 'claude', 'gemini', 'grok', 'qwen', 'deepseek'])
+
+const legacyBrowserVersion = '145.0.7632.109.2'
+const supportedLegacyPlatforms = new Set([
+  'darwin-arm64',
+  'darwin-x64',
+  'linux-x64',
+  'win32-x64',
+])
+
+const platformKey = `${process.platform}-${process.arch}`
+const browserVersion = supportedLegacyPlatforms.has(platformKey)
+  ? legacyBrowserVersion
+  : undefined
+const state = {
+  prototype: 'cloakbrowser-legacy-no-key',
+  platform: platformKey,
+  wrapperVersion,
+  browserVersion: browserVersion ?? null,
+  browserPath: null,
+  browserLaunchVersion: null,
+  providerCases: providers.map((provider) => `${provider}: readiness, draft, blocker, conditional submit-and-read`),
+  providerResults: [],
+  googleSearch: null,
+  directObservation: null,
+  status: 'starting',
+  startedAt: new Date().toISOString(),
+  finishedAt: null,
+  error: null,
+}
+
+const cloakEnv = {
+  ...process.env,
+  CLOAKBROWSER_AUTO_UPDATE: 'false',
+  CLOAKBROWSER_CACHE_DIR: runtimeCache,
+  CLOAKBROWSER_LICENSE_KEY: '',
+  ...(browserVersion ? { CLOAKBROWSER_VERSION: browserVersion } : {}),
+}
+
+try {
+  if (!browserVersion) {
+    throw new Error(`No official no-key CloakBrowser legacy binary is mapped for ${platformKey}.`)
+  }
+
+  await fs.mkdir(artifactRoot, { recursive: true, mode: 0o700 })
+  await fs.mkdir(runtimeCache, { recursive: true, mode: 0o700 })
+  render('downloading', 'Acquire the official signed no-key CloakBrowser binary.')
+  await cloakCli(['install'], { env: cloakEnv })
+
+  const diagnostics = await cloakCli(['info', '--quick', '--json'], {
+    env: cloakEnv,
+    capture: true,
+  })
+  const info = parseJsonOutput(diagnostics.stdout)
+  const binary = info?.binary
+  if (!binary || binary.version !== browserVersion || binary.tier !== 'free') {
+    throw new Error(`Unexpected CloakBrowser diagnostics: ${JSON.stringify(binary ?? null)}`)
+  }
+  if (typeof binary.path !== 'string' || !binary.path) {
+    throw new Error('CloakBrowser diagnostics did not return an executable path.')
+  }
+  await fs.access(binary.path, fsConstants.X_OK)
+  state.browserPath = binary.path
+
+  await assertNotQuarantined(binary.path)
+  const versionProbe = await run(binary.path, ['--version'], { capture: true })
+  state.browserLaunchVersion = versionProbe.stdout.trim()
+  render('building', 'Build the current dirty worktree without changing browser runtime code.')
+  await run('npm', ['run', 'build'], { cwd: root })
+
+  render('google-search', 'Run a real Google Search in an isolated CloakBrowser Playwright context.')
+  state.googleSearch = await runGoogleSearchProbe(binary.path, googleObserveMs)
+
+  render('preparing', 'Create an isolated Tokenless home and one clean guest profile for every provider.')
+  await fs.rm(tokenlessHome, { recursive: true, force: true })
+  await fs.mkdir(tokenlessHome, { recursive: true, mode: 0o700 })
+  await fs.writeFile(path.join(tokenlessHome, 'config.json'), `${JSON.stringify({
+    protocol: 'tokenless.config.v1',
+    updatedAt: new Date().toISOString(),
+    providerWhitelist: providers,
+    browser: 'profile',
+    browserVisibility: 'auto',
+    daemonUrl: null,
+  }, null, 2)}\n`, { mode: 0o600 })
+
+  const cliEntry = path.join(root, 'packages/cli/dist/src/tokenless.mjs')
+  await run(process.execPath, [
+    cliEntry,
+    'profiles',
+    'add',
+    '--profile', profileSlug,
+    '--set-default',
+    '--home', tokenlessHome,
+    '--json',
+  ], {
+    cwd: root,
+    env: {
+      ...cloakEnv,
+      TOKENLESS_BROWSER_EXECUTABLE: binary.path,
+    },
+  })
+
+  render('provider-sweep', 'Probe every declared provider through the production daemon/runner browser path.')
+  state.providerResults = await runProviderSweep(cliEntry, binary.path)
+
+  if (observeMs > 0) {
+    await holdForDirectObservation(cliEntry, binary.path, observeMs)
+  }
+
+  state.status = 'completed'
+  render('completed', 'CloakBrowser completed the all-provider and Google Search sweep.')
+} catch (error) {
+  state.status = 'failed'
+  state.error = error instanceof Error ? error.message : String(error)
+  render('failed', state.error)
+  if (observeMs > 0 && state.providerResults.length > 0 && state.browserPath) {
+    try {
+      await holdForDirectObservation(
+        path.join(root, 'packages/cli/dist/src/tokenless.mjs'),
+        state.browserPath,
+        observeMs,
+        false,
+      )
+    } catch (observationError) {
+      state.directObservation = {
+        requestedMs: observeMs,
+        status: 'failed',
+        error: observationError instanceof Error ? observationError.message : String(observationError),
+      }
+    }
+    state.status = 'failed'
+  }
+  process.exitCode = 1
+} finally {
+  await stopScratchDaemon().catch(() => undefined)
+  await fs.rm(tokenlessHome, { recursive: true, force: true }).catch(() => undefined)
+  await fs.rm(googleProfile, { recursive: true, force: true }).catch(() => undefined)
+  state.finishedAt = new Date().toISOString()
+  await fs.mkdir(artifactRoot, { recursive: true, mode: 0o700 })
+  await fs.writeFile(resultFile, `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 })
+  console.log(`\nPrototype result: ${resultFile}`)
+}
+
+async function runProviderSweep(cliEntry, browserPath) {
+  const results = []
+  for (const provider of providers) {
+    render('provider', `Probe ${provider} through the production runtime.`)
+    const draftMarker = `TOKENLESS_CLOAK_${provider.toUpperCase()}_DRAFT_${Date.now()}`
+    const auth = await runProviderAction(cliEntry, browserPath, provider, 'auth.status')
+    const blocker = await runProviderAction(cliEntry, browserPath, provider, 'blocker.check')
+    const promptInput = await runProviderAction(
+      cliEntry,
+      browserPath,
+      provider,
+      'prompt.input',
+      ['--prompt', draftMarker],
+    )
+    const promptClear = promptInput.succeeded
+      ? await runProviderAction(cliEntry, browserPath, provider, 'prompt.clear')
+      : { action: 'prompt.clear', status: 'not_attempted', succeeded: false, reason: 'prompt_input_failed' }
+    const canSubmit = promptInput.succeeded && promptClear.succeeded && blocker.result?.blocked !== true
+    const conversation = canSubmit
+      ? await runProviderConversation(cliEntry, browserPath, provider)
+      : {
+          status: 'not_attempted',
+          succeeded: false,
+          reason: blocker.result?.blocked === true ? 'visible_provider_blocker' : 'prompt_surface_unavailable',
+        }
+    results.push({
+      provider,
+      reached: Boolean(auth.payload || blocker.payload || promptInput.payload),
+      auth,
+      blocker,
+      promptInput,
+      promptClear,
+      conversation,
+    })
+    state.providerResults = [...results]
+  }
+  return results
+}
+
+async function runProviderAction(cliEntry, browserPath, provider, action, extraArgs = []) {
+  const command = await run(process.execPath, [
+    cliEntry,
+    'provider-action',
+    '--provider', provider,
+    '--action', action,
+    ...extraArgs,
+    '--profile', profileSlug,
+    '--home', tokenlessHome,
+    '--browser-visibility', 'headed',
+    '--timeout-ms', '120000',
+    '--json',
+  ], {
+    cwd: root,
+    env: {
+      ...cloakEnv,
+      TOKENLESS_BROWSER_EXECUTABLE: browserPath,
+    },
+    capture: true,
+    allowFailure: true,
+  })
+  const payload = parseOptionalJsonOutput(command.stdout)
+  const succeeded = payload?.ok === true && payload?.status === 'succeeded'
+  return {
+    action,
+    exitCode: command.code,
+    status: payload?.status ?? 'failed',
+    succeeded,
+    result: responseResult(payload, action),
+    blocker: payload?.blocker ?? null,
+    error: succeeded || payload ? payload?.error ?? null : compactCommandError(command),
+    payload: payload ? { ok: payload.ok, jobId: payload.jobId ?? null } : null,
+  }
+}
+
+async function runProviderConversation(cliEntry, browserPath, provider) {
+  const marker = `TOKENLESS_CLOAK_${provider.toUpperCase()}_E2E_${Date.now()}`
+  const taskId = `cloak-${provider}-e2e-${Date.now()}`
+  const command = await run(process.execPath, [
+    cliEntry,
+    'run',
+    '--provider', provider,
+    '--profile', profileSlug,
+    '--task-id', taskId,
+    '--prompt', `Reply with exactly ${marker} and no other text.`,
+    '--home', tokenlessHome,
+    '--browser-visibility', 'headed',
+    '--timeout-ms', '300000',
+    '--json',
+  ], {
+    cwd: root,
+    env: {
+      ...cloakEnv,
+      TOKENLESS_BROWSER_EXECUTABLE: browserPath,
+    },
+    capture: true,
+    allowFailure: true,
+  })
+  const payload = parseOptionalJsonOutput(command.stdout)
+  if (!payload) {
+    return {
+      taskId,
+      marker,
+      exitCode: command.code,
+      status: 'failed',
+      succeeded: false,
+      error: compactCommandError(command),
+    }
+  }
+  if (payload.status !== 'succeeded' || typeof payload.jobId !== 'string') {
+    return {
+      taskId,
+      marker,
+      jobId: payload.jobId ?? null,
+      exitCode: command.code,
+      status: payload.status ?? 'failed',
+      succeeded: false,
+      blocker: payload.blocker ?? null,
+      error: payload.error ?? null,
+    }
+  }
+
+  const response = responseResult(payload, 'response.read')
+  const responseMatched = typeof response?.text === 'string' && response.text.includes(marker)
+  const durableCommand = await run(process.execPath, [
+    cliEntry,
+    'state',
+    '--job-id', payload.jobId,
+    '--home', tokenlessHome,
+    '--json',
+  ], {
+    cwd: root,
+    env: {
+      ...cloakEnv,
+      TOKENLESS_BROWSER_EXECUTABLE: browserPath,
+    },
+    capture: true,
+    allowFailure: true,
+  })
+  const durablePayload = parseOptionalJsonOutput(durableCommand.stdout)
+  return {
+    taskId,
+    marker,
+    jobId: payload.jobId,
+    exitCode: command.code,
+    status: payload.status,
+    succeeded: responseMatched && durablePayload?.latest?.status === 'succeeded',
+    responseMatched,
+    durableStatus: durablePayload?.latest?.status ?? null,
+  }
+}
+
+async function runGoogleSearchProbe(browserPath, durationMs) {
+  await fs.rm(googleProfile, { recursive: true, force: true })
+  await fs.mkdir(googleProfile, { recursive: true, mode: 0o700 })
+  const context = await chromium.launchPersistentContext(googleProfile, {
+    executablePath: browserPath,
+    headless: false,
+    chromiumSandbox: true,
+    args: [
+      '--password-store=basic',
+      '--use-mock-keychain',
+      '--disable-sync',
+      '--no-first-run',
+      '--no-default-browser-check',
+    ],
+  })
+  try {
+    const page = context.pages()[0] ?? await context.newPage()
+    const query = 'OpenAI API documentation'
+    const target = new URL('https://www.google.com/search')
+    target.searchParams.set('q', query)
+    const response = await page.goto(target.toString(), {
+      waitUntil: 'domcontentloaded',
+      timeout: 120_000,
+    })
+    await page.waitForLoadState('load', { timeout: 30_000 }).catch(() => undefined)
+    await page.waitForTimeout(3_000)
+    const finalUrl = new URL(page.url())
+    const challenge = await googleChallenge(page)
+    const resultsVisible = challenge === null && await anyVisible(page, [
+      '#search',
+      '#rso',
+      'a h3',
+    ])
+    const result = {
+      query,
+      httpStatus: response?.status() ?? null,
+      finalOrigin: finalUrl.origin,
+      finalPath: finalUrl.pathname,
+      title: await page.title(),
+      resultsVisible,
+      challenge,
+      captchaTriggered: challenge?.family === 'recaptcha',
+    }
+    state.googleSearch = result
+    if (durationMs > 0) {
+      render('observing-google', `The real Google Search window will remain open for ${durationMs}ms.`)
+      await delay(durationMs)
+    }
+    return result
+  } finally {
+    await context.close().catch(() => undefined)
+    await fs.rm(googleProfile, { recursive: true, force: true }).catch(() => undefined)
+  }
+}
+
+async function googleChallenge(page) {
+  if (page.url().includes('/sorry/')) {
+    return { family: 'recaptcha', code: 'google_sorry_url' }
+  }
+  if (await anyVisible(page, [
+    'iframe[src*="recaptcha"]',
+    'form#captcha-form',
+    '.g-recaptcha',
+    'text=/our systems have detected unusual traffic/i',
+  ])) {
+    return { family: 'recaptcha', code: 'visible_google_recaptcha' }
+  }
+  if (await anyVisible(page, [
+    'text=/before you continue to google/i',
+    'form[action*="consent.google"]',
+  ])) {
+    return { family: 'consent', code: 'visible_google_consent' }
+  }
+  return null
+}
+
+async function anyVisible(page, selectors) {
+  for (const selector of selectors) {
+    if (await page.locator(selector).first().isVisible().catch(() => false)) return true
+  }
+  return false
+}
+
+async function holdForDirectObservation(cliEntry, browserPath, durationMs, openProvider = true) {
+  if (openProvider) {
+    const command = await run(process.execPath, [
+      cliEntry,
+      'profiles',
+      'open',
+      '--profile', profileSlug,
+      '--provider', 'grok',
+      '--home', tokenlessHome,
+      '--timeout-ms', '120000',
+      '--json',
+    ], {
+      cwd: root,
+      env: {
+        ...cloakEnv,
+        TOKENLESS_BROWSER_EXECUTABLE: browserPath,
+      },
+      capture: true,
+    })
+    const payload = parseJsonOutput(command.stdout)
+    if (payload?.ok !== true) {
+      throw new Error(`Could not retain the managed Grok window for observation: ${command.stdout}`)
+    }
+  }
+
+  state.directObservation = {
+    requestedMs: durationMs,
+    status: 'available',
+    observer: 'macOS accessibility and process inspection only',
+    externalObserverPlaywright: false,
+    externalCdpAttach: false,
+    googleProbeOwnsItsContext: true,
+  }
+  render('observing', `The runtime-managed CloakBrowser window will remain open for ${durationMs}ms.`)
+  await delay(durationMs)
+  state.directObservation.status = 'completed'
+}
+
+function responseResult(payload, actionName) {
+  const responses = payload?.result?.result?.responses ??
+    payload?.result?.responses ??
+    payload?.latest?.result?.value?.responses
+  if (!Array.isArray(responses)) return null
+  return [...responses].reverse()
+    .find((response) => response?.ok === true && response.action === actionName)?.result ?? null
+}
+
+function render(status, message) {
+  state.status = status
+  console.log(`\n[CloakBrowser spike] ${status}`)
+  console.log(message)
+  console.log(JSON.stringify({
+    platform: state.platform,
+    wrapperVersion: state.wrapperVersion,
+    browserVersion: state.browserVersion,
+    browserPath: state.browserPath,
+    browserLaunchVersion: state.browserLaunchVersion,
+    providerCases: state.providerCases,
+    providerResults: state.providerResults.map((result) => ({
+      provider: result.provider,
+      reached: result.reached,
+      authStatus: result.auth.status,
+      authState: result.auth.result?.state ?? null,
+      blockerStatus: result.blocker.status,
+      blocked: result.blocker.result?.blocked ?? null,
+      promptInputStatus: result.promptInput.status,
+      promptClearStatus: result.promptClear.status,
+      conversationStatus: result.conversation.status,
+      conversationSucceeded: result.conversation.succeeded,
+    })),
+    googleSearch: state.googleSearch,
+    directObservation: state.directObservation,
+  }, null, 2))
+}
+
+function parseDurationArg(args, prefix) {
+  const entry = args.find((value) => value.startsWith(prefix))
+  if (!entry) return 0
+  const value = Number(entry.slice(prefix.length))
+  if (!Number.isInteger(value) || value < 0 || value > 600_000) {
+    throw new Error(`${prefix.slice(0, -1)} must be an integer from 0 through 600000.`)
+  }
+  return value
+}
+
+function delay(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds))
+}
+
+async function cloakCli(args, options = {}) {
+  return await run('npm', [
+    'exec',
+    '--yes',
+    `--package=cloakbrowser@${wrapperVersion}`,
+    '--',
+    'cloakbrowser',
+    ...args,
+  ], { cwd: root, ...options })
+}
+
+async function assertNotQuarantined(binaryPath) {
+  if (process.platform !== 'darwin') return
+  const appIndex = binaryPath.indexOf('.app/')
+  const target = appIndex === -1 ? binaryPath : binaryPath.slice(0, appIndex + 4)
+  const result = await run('/usr/bin/xattr', ['-p', 'com.apple.quarantine', target], {
+    capture: true,
+    allowFailure: true,
+  })
+  if (result.code === 0 && result.stdout.trim()) {
+    throw new Error(
+      `macOS quarantined ${target}. The prototype will not remove quarantine automatically; open it manually and rerun.`,
+    )
+  }
+}
+
+async function stopScratchDaemon() {
+  const cliEntry = path.join(root, 'packages/cli/dist/src/tokenless.mjs')
+  try {
+    await fs.access(cliEntry)
+  } catch {
+    return
+  }
+  await run(process.execPath, [
+    cliEntry,
+    'daemon',
+    'stop',
+    '--home', tokenlessHome,
+    '--timeout-ms', '60000',
+    '--json',
+  ], {
+    cwd: root,
+    env: cloakEnv,
+    capture: true,
+    allowFailure: true,
+  })
+}
+
+function parseJsonOutput(output) {
+  const start = output.indexOf('{')
+  const end = output.lastIndexOf('}')
+  if (start === -1 || end < start) throw new Error(`Expected JSON output, received: ${output}`)
+  return JSON.parse(output.slice(start, end + 1))
+}
+
+function parseOptionalJsonOutput(output) {
+  if (!output.includes('{')) return null
+  try {
+    return parseJsonOutput(output)
+  } catch {
+    return null
+  }
+}
+
+function compactCommandError(command) {
+  const message = command.stderr.trim() || command.stdout.trim()
+  return message ? message.slice(0, 1_000) : `Command exited with code ${command.code}.`
+}
+
+function run(command, args, options = {}) {
+  return new Promise((resolve, reject) => {
+    const capture = options.capture === true
+    const child = spawn(command, args, {
+      cwd: options.cwd ?? root,
+      env: options.env ?? process.env,
+      stdio: capture ? ['ignore', 'pipe', 'pipe'] : 'inherit',
+    })
+    let stdout = ''
+    let stderr = ''
+    if (capture) {
+      child.stdout.setEncoding('utf8')
+      child.stderr.setEncoding('utf8')
+      child.stdout.on('data', (chunk) => { stdout += chunk })
+      child.stderr.on('data', (chunk) => { stderr += chunk })
+    }
+    child.on('error', reject)
+    child.on('exit', (code, signal) => {
+      const result = { code: code ?? 1, signal, stdout, stderr }
+      if (result.code === 0 || options.allowFailure) {
+        resolve(result)
+        return
+      }
+      reject(new Error(
+        `${command} ${args.join(' ')} failed with ${signal ?? `exit code ${result.code}`}` +
+        (stderr.trim() ? `\n${stderr.trim()}` : ''),
+      ))
+    })
+  })
+}
diff --git a/scripts/release/extract-changelog-section.mjs b/scripts/release/extract-changelog-section.mjs
new file mode 100644
index 0000000..61d00fd
--- /dev/null
+++ b/scripts/release/extract-changelog-section.mjs
@@ -0,0 +1,36 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..')
+
+export function extractChangelogSection(changelog, version) {
+  if (typeof version !== 'string' || version.length === 0) {
+    throw new Error('A release version is required.')
+  }
+
+  const headings = [...changelog.matchAll(/^##\s+(.+?)\s*$/gm)]
+  const matches = headings
+    .map((match, index) => ({ match, next: headings[index + 1] }))
+    .filter(({ match }) => match[1] === version)
+
+  if (matches.length !== 1) {
+    throw new Error(`Could not find exactly one changelog section for version ${version}.`)
+  }
+
+  const [{ match, next }] = matches
+  const end = next ? next.index : changelog.length
+  return `${changelog.slice(match.index, end).trimEnd()}\n`
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const version = process.argv[2]
+  const outputPath = process.argv[3]
+  if (!version || !outputPath) {
+    throw new Error('Usage: node scripts/release/extract-changelog-section.mjs <version> <output-file>')
+  }
+
+  const changelogPath = path.join(root, 'packages', 'cli', 'CHANGELOG.md')
+  const changelog = fs.readFileSync(changelogPath, 'utf8')
+  fs.writeFileSync(outputPath, extractChangelogSection(changelog, version))
+}
diff --git a/scripts/release/pending-schema.mjs b/scripts/release/pending-schema.mjs
new file mode 100644
index 0000000..a3bf6d1
--- /dev/null
+++ b/scripts/release/pending-schema.mjs
@@ -0,0 +1 @@
+export const RELEASE_PENDING_SCHEMA_ID = 'tokenless.release-pending.v1'
diff --git a/scripts/release/verify-pending.mjs b/scripts/release/verify-pending.mjs
index 41e9adf..03598a6 100644
--- a/scripts/release/verify-pending.mjs
+++ b/scripts/release/verify-pending.mjs
@@ -1,6 +1,7 @@
 import fs from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { RELEASE_PENDING_SCHEMA_ID } from './pending-schema.mjs'
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..')
 const pendingPath = path.join(root, '.changeset', 'publish-pending.json')
@@ -12,7 +13,7 @@ if (!fs.existsSync(pendingPath)) {
 }
 
 const pending = readJson(pendingPath)
-if (pending.protocol !== 'tokenless.release-pending.v1' || pending.package !== 'tokenless') {
+if (pending.protocol !== RELEASE_PENDING_SCHEMA_ID || pending.package !== 'tokenless') {
   throw new Error('Invalid Tokenless release marker.')
 }
 if (typeof pending.version !== 'string' || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(pending.version)) {
@@ -22,24 +23,8 @@ if (typeof pending.version !== 'string' || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(
 const cliPackage = readJson(path.join(root, 'packages', 'cli', 'package.json'))
 assertVersion(cliPackage, pending.version, 'packages/cli/package.json')
 
-const nativeRoot = path.join(root, 'packages', 'cli', 'npm')
-const nativePackages = fs.readdirSync(nativeRoot, { withFileTypes: true })
-  .filter((entry) => entry.isDirectory() && entry.name.startsWith('tokenless-native-'))
-  .map((entry) => readJson(path.join(nativeRoot, entry.name, 'package.json')))
-  .sort((left, right) => left.name.localeCompare(right.name))
-
-if (nativePackages.length !== 6) throw new Error(`Expected six native packages, found ${nativePackages.length}.`)
-for (const nativePackage of nativePackages) {
-  assertVersion(nativePackage, pending.version, nativePackage.name)
-  if (cliPackage.optionalDependencies?.[nativePackage.name] !== pending.version) {
-    throw new Error(`${nativePackage.name} is not pinned to ${pending.version} by the universal CLI.`)
-  }
-}
-
-const cargoVersion = packageVersion(path.join(root, 'packages', 'daemon', 'Cargo.toml'))
-const lockVersion = packageVersion(path.join(root, 'packages', 'daemon', 'Cargo.lock'))
-if (cargoVersion !== pending.version || lockVersion !== pending.version) {
-  throw new Error(`Rust runtime version must match ${pending.version}; found Cargo.toml=${cargoVersion}, Cargo.lock=${lockVersion}.`)
+if (cliPackage.optionalDependencies !== undefined) {
+  throw new Error('packages/cli/package.json must not declare native optional dependencies.')
 }
 
 writeOutput({ publish: 'true', version: pending.version })
@@ -55,20 +40,6 @@ function assertVersion(manifest, version, label) {
   }
 }
 
-function packageVersion(file) {
-  const source = fs.readFileSync(file, 'utf8')
-  const packageBlockPattern = path.basename(file) === 'Cargo.lock'
-    ? /(?:^|\n)\[\[package\]\][\s\S]*?(?=\n\[\[package\]\]|\s*$)/g
-    : /(?:^|\n)\[package\][\s\S]*?(?=\n\[|\s*$)/g
-  const matches = [...source.matchAll(packageBlockPattern)]
-    .map((match) => match[0])
-    .filter((block) => /^\s*name\s*=\s*"tokenless-daemon"\s*$/m.test(block))
-  if (matches.length !== 1) throw new Error(`Could not find exactly one Tokenless package in ${file}.`)
-  const version = matches[0].match(/^\s*version\s*=\s*"([^"]+)"\s*$/m)?.[1]
-  if (!version) throw new Error(`Could not find the Tokenless package version in ${file}.`)
-  return version
-}
-
 function writeOutput(values) {
   const body = Object.entries(values).map(([key, value]) => `${key}=${value}`).join('\n')
   if (outputPath) fs.appendFileSync(outputPath, `${body}\n`)
diff --git a/scripts/release/version.mjs b/scripts/release/version.mjs
index 6e9a301..a040df3 100644
--- a/scripts/release/version.mjs
+++ b/scripts/release/version.mjs
@@ -2,6 +2,7 @@ import { execFileSync } from 'node:child_process'
 import fs from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { RELEASE_PENDING_SCHEMA_ID } from './pending-schema.mjs'
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..')
 
@@ -27,33 +28,11 @@ export function runReleaseVersion(root) {
   const version = cliPackage.version
   assertVersion(version)
 
-  const nativeRoot = path.join(root, 'packages', 'cli', 'npm')
-  const nativePackagePaths = fs.readdirSync(nativeRoot, { withFileTypes: true })
-    .filter((entry) => entry.isDirectory() && entry.name.startsWith('tokenless-native-'))
-    .map((entry) => path.join(nativeRoot, entry.name, 'package.json'))
-    .sort()
-
-  if (nativePackagePaths.length !== 6) {
-    throw new Error(`Expected six native package manifests, found ${nativePackagePaths.length}.`)
-  }
-
-  for (const nativePackagePath of nativePackagePaths) {
-    const nativePackage = readJson(nativePackagePath)
-    nativePackage.version = version
-    if (typeof nativePackage.name !== 'string' || !nativePackage.name.startsWith('tokenless-native-')) {
-      throw new Error(`Invalid native package manifest: ${nativePackagePath}`)
-    }
-    cliPackage.optionalDependencies[nativePackage.name] = version
-    writeJson(nativePackagePath, nativePackage)
-  }
-
   writeJson(cliPackagePath, cliPackage)
-  updateCargoPackageVersion(path.join(root, 'packages', 'daemon', 'Cargo.toml'), version)
-  updateCargoPackageVersion(path.join(root, 'packages', 'daemon', 'Cargo.lock'), version)
   updatePackageLock(path.join(root, 'package-lock.json'), cliPackage, version)
 
   writeJson(pendingPath, {
-    protocol: 'tokenless.release-pending.v1',
+    protocol: RELEASE_PENDING_SCHEMA_ID,
     package: cliPackage.name,
     version,
   })
@@ -73,41 +52,12 @@ function assertVersion(value) {
   }
 }
 
-export function updateCargoPackageVersion(file, version) {
-  const source = fs.readFileSync(file, 'utf8')
-  const packageBlockPattern = path.basename(file) === 'Cargo.lock'
-    ? /(?:^|\n)\[\[package\]\][\s\S]*?(?=\n\[\[package\]\]|\s*$)/g
-    : /(?:^|\n)\[package\][\s\S]*?(?=\n\[|\s*$)/g
-  let synchronized = 0
-  const updated = source.replace(packageBlockPattern, (block) => {
-    if (!/^\s*name\s*=\s*"tokenless-daemon"\s*$/m.test(block)) return block
-    if (!/^\s*version\s*=\s*"[^"]+"\s*$/m.test(block)) {
-      throw new Error(`Could not find the Tokenless package version in ${file}`)
-    }
-    synchronized += 1
-    return block.replace(/^(\s*version\s*=\s*")[^"]+(".*)$/m, `$1${version}$2`)
-  })
-  if (synchronized !== 1) throw new Error(`Could not synchronize Tokenless version in ${file}`)
-  fs.writeFileSync(file, updated)
-}
-
 export function updatePackageLock(file, cliPackage, version) {
   const lock = readJson(file)
   const workspace = lock.packages?.['packages/cli']
   if (!workspace) throw new Error('package-lock.json does not contain packages/cli')
   workspace.version = version
-  workspace.optionalDependencies = { ...cliPackage.optionalDependencies }
-  for (const packageName of Object.keys(workspace.optionalDependencies).sort()) {
-    if (!packageName.startsWith('tokenless-native-')) continue
-    if (workspace.optionalDependencies[packageName] !== version) {
-      throw new Error(`${packageName} must be pinned to ${version} by packages/cli`)
-    }
-    const lockEntry = lock.packages?.[`node_modules/${packageName}`]
-    if (!lockEntry) throw new Error(`package-lock.json does not contain node_modules/${packageName}`)
-    lockEntry.version = version
-    delete lockEntry.resolved
-    delete lockEntry.integrity
-  }
+  delete workspace.optionalDependencies
   writeJson(file, lock)
 }
 
diff --git a/skills-lock.json b/skills-lock.json
new file mode 100644
index 0000000..1ecd335
--- /dev/null
+++ b/skills-lock.json
@@ -0,0 +1,12 @@
+{
+  "version": 1,
+  "skills": {
+    "tokenless": {
+      "source": "jazelly/tokenless",
+      "ref": "main",
+      "sourceType": "github",
+      "skillPath": "skills/tokenless/SKILL.md",
+      "computedHash": "96aa3578e15c602e6cfe845100868e24b50a506ee5e84027f94254af6981dbf4"
+    }
+  }
+}
diff --git a/skills/tokenless-install/SKILL.md b/skills/tokenless-install/SKILL.md
index 0e6d700..79845b2 100644
--- a/skills/tokenless-install/SKILL.md
+++ b/skills/tokenless-install/SKILL.md
@@ -1,11 +1,11 @@
 ---
 name: tokenless-install
-description: Install, upgrade, repair, and verify Tokenless, its agent skills, local Playwright runtime, and managed browser profiles. Use for initial noninteractive setup, fresh or import onboarding, browser sign-in handoff, upgrades, failed doctor checks, or installation integrity checks.
+description: Install, upgrade, repair, and verify Tokenless, its agent skills, and local Playwright runtime. Use only when the user explicitly asks for installation, upgrade, repair, browser sign-in handoff, a failed doctor check, or an installation integrity check.
 ---
 
 # Tokenless installation and maintenance
 
-Complete this workflow before using the `tokenless` skill. Execute every CLI step yourself. Never run interactive setup prompts: this skill runs inside an agent session where a human cannot answer CLI questions. Collect any required choices in chat, then pass them as flags. Report status, manual actions, and final results in the user's preferred language, inferred from the conversation.
+Use this workflow only for the maintenance task the user explicitly requested; it is not a prerequisite for every provider job. Execute the documented noninteractive maintenance and verification commands yourself. Managed-profile initialization and import are user-run workflows outside the agent session: never initiate either one or traverse providers on the user's behalf. Report status, manual actions, and final results in the user's preferred language, inferred from the conversation.
 
 ## Install
 
@@ -23,44 +23,22 @@ Complete this workflow before using the `tokenless` skill. Execute every CLI ste
    npm install --global tokenless@latest
    ```
 
-   Do not run profile setup as root. Setup installs and verifies both Tokenless agent skills, detects supported browsers, starts the local daemon and Playwright worker, and checks provider readiness.
+   After installation, invoke only the global `tokenless` command. Never run the
+   Tokenless CLI through `npx tokenless` or `npx tokenless@latest`.
 
-3. Choose one noninteractive profile strategy in chat, then run the matching command. Never run bare `tokenless setup`.
-
-   **Fresh managed profile (default when the user does not ask to import):**
-
-   ```bash
-   tokenless setup --fresh --json
-   ```
-
-   On first use this creates `default`, selects the first supported browser and ChatGPT, starts the runtime, and opens the provider when visible sign-in is needed. It never imports an existing browser profile.
-
-   **Import an existing browser profile (only after explicit user choice in chat):**
+3. Reconcile the global skills and matching local daemon:
 
    ```bash
-   tokenless profiles discover --browser chrome --json
+   tokenless install --json
    ```
 
-   Ask the user which discovered `directoryKey` and which providers to import. Then run:
-
-   ```bash
-   tokenless setup \
-     --browser chrome \
-     --preferred-providers chatgpt \
-     --import-browser-profile "Default" \
-     --consent-local-profile-copy \
-     --json
-   ```
-
-   Pass `--browser brave` when that is the chosen browser. Add `--browser-user-data-dir <dir>` when discover reports ambiguity. Do not invent consent: `--consent-local-profile-copy` is allowed only after the user explicitly agrees in chat to copy selected provider sign-in state into a separate managed profile. The source browser profile stays unchanged.
-
 4. Verify the installation:
 
    ```bash
    tokenless doctor --json
    ```
 
-Report success only when `doctor` exits successfully and returns `ok: true`. Summarize skill, browser, managed profile, daemon, worker, and provider readiness without exposing account identity or authentication data.
+Report success only when `install` confirms `skills.upserted: true` and a ready matching daemon, then `doctor` exits successfully and returns `ok: true`. Summarize skill, browser, managed profile, daemon, worker, and provider readiness without exposing account identity or authentication data. If verification reports that no managed profile exists, report that the CLI installation completed but provider readiness is pending user-run profile initialization. Do not start that workflow for the user.
 
 ## User handoff
 
@@ -80,7 +58,7 @@ Use `profiles open` only for headed browser handoff. It always opens a visible b
 
 ## Upgrade
 
-When `tokenless upgrade` is available, it is the canonical upgrade path. The command itself is prompt-free and does not read answers from stdin. Agents must use its structured automation form instead of composing separate npm, skill, setup, runtime, or doctor commands:
+When `tokenless upgrade` is available, it is the canonical upgrade path. The command itself is prompt-free and does not read answers from stdin. Agents must use its structured automation form instead of composing separate npm, skill, runtime, or doctor commands:
 
 ```bash
 tokenless upgrade --json
@@ -90,11 +68,12 @@ The command owns this order:
 
 1. Install `tokenless@latest` globally with npm.
 2. Resolve and verify the installed package, version, binary declaration, and exact CLI entrypoint before handing off to new code.
-3. Refresh both GitHub-backed Tokenless agent skills.
-4. Use that verified new CLI to reconcile the packaged daemon and local runtime.
-5. Use the same new CLI to run the final read-only `doctor --json` check.
+3. Use that verified new CLI's shared maintenance reconciler to upsert both
+   GitHub-backed Tokenless agent skills globally and reconcile the matching
+   packaged daemon runtime.
+4. Use the same new CLI to run the final read-only `doctor --json` check.
 
-Do not run setup before or after an upgrade unless the returned doctor result identifies a profile or provider problem that specifically requires setup. Upgrade does not run provider setup, sign in, re-import, reset, or replace a managed profile.
+Do not initialize, import, reset, or replace a managed profile before or after an upgrade. If the returned doctor result identifies a profile or provider problem, report it as a user-run follow-up. Upgrade does not sign in to providers or alter managed profiles.
 
 For a pre-upgrade CLI that reports `upgrade` as an unknown command, bootstrap the canonical command exactly once:
 
@@ -115,9 +94,9 @@ Run `tokenless doctor --json` first and use its exact failed check as the repair
 
 - Node.js failure: require Node.js 22.13 or newer.
 - CLI, daemon, or Playwright worker failure: run `tokenless upgrade --json`, then inspect its nested doctor result.
-- Browser failure: require a supported installed browser selected by setup; do not silently substitute another browser.
-- Missing default profile: run fresh setup to create one. For an invalid existing profile, report it instead of replacing it automatically.
-- Profile import failure: report the copy error, obtain fresh chat consent, rediscover if needed, then retry only with `--import-browser-profile`, `--preferred-providers`, `--consent-local-profile-copy`, and `--json`. Never mutate the source profile.
+- Browser failure: require a supported installed browser selected by the user; do not silently substitute another browser.
+- Missing default profile: report that the user must initialize a managed profile manually. Do not create one for them.
+- Profile import failure: report the copy error and tell the user that import must be retried manually. Never inspect, copy, or mutate the source profile.
 - Provider unauthenticated or visibly blocked: run `tokenless profiles open --profile <slug> --provider <id>`, use the user handoff, then rerun `profiles status` and `doctor`.
 - Unknown or contradictory output: report the exact failed check and stop instead of guessing, weakening validation, or switching runtime paths.
 
diff --git a/skills/tokenless/SKILL.md b/skills/tokenless/SKILL.md
index 92f3fa2..1dc1dfd 100644
--- a/skills/tokenless/SKILL.md
+++ b/skills/tokenless/SKILL.md
@@ -1,17 +1,15 @@
 ---
 name: tokenless
-description: Route shareable Q&A, analysis, review, research, writing, and file-based tasks through a user's visible ChatGPT, Claude, Gemini, or Grok website using Tokenless Playwright automation to save API tokens.
+description: Use when any tasks can be completed without directly write to the workspace. Call the tokenless CLI to route tasks to AI provider websitesto save token.
 ---
 
 # Tokenless agent workflow
 
-Use `tokenless` as the entrypoint. Do not reproduce provider-specific Playwright or DOM work yourself.
+Require the globally installed `tokenless` command on `PATH` and use it as the entrypoint. Never invoke Tokenless through `npx tokenless` or `npx tokenless@latest`. Do not reproduce provider-specific Playwright or DOM work yourself.
 
-Tokenless sends visible jobs through its authenticated local Rust daemon and Playwright worker into a persistent managed Chromium profile selected during `tokenless setup`. Keep provider authentication opaque inside that profile, operate only visible page controls, and use only documented Tokenless CLI or local API surfaces.
+Tokenless sends visible jobs through its authenticated local TypeScript daemon and Playwright worker into a user-configured persistent managed Chromium profile. Keep provider authentication opaque inside that profile, operate only visible page controls, and use only documented Tokenless CLI or local API surfaces.
 
-## Installation prerequisite
-
-Require the `tokenless-install` skill to finish setup, upgrades, repairs, and `doctor` verification before provider work. If the CLI, daemon, Playwright worker, configured browser, managed profile, or visible provider session is not ready, use `tokenless-install`; do not improvise installation or weaken a failed check.
+You MUST not initiate installation, onboarding, profile creation, or profile import before provider work.
 
 ## Resolve provider and profile
 
@@ -20,15 +18,9 @@ tokenless config --json
 tokenless profiles list --json
 ```
 
-Use an explicitly requested provider and profile first, then configured defaults. ChatGPT is the provider default. Fail before submitting work if no managed profile resolves; use `tokenless-install` to repair it.
-
-Before the first job for a chosen pair, confirm readiness:
+Use an explicitly requested provider and profile first, then configured defaults. ChatGPT is the provider default. Fail before submitting work if no managed profile resolves, and tell the user that they must initialize one manually before retrying. Do not create or import a profile on the user's behalf.
 
-```bash
-tokenless profiles status --profile "<managed-profile>" --provider chatgpt --json
-```
-
-If status shows unauthenticated or blocked readiness, hand off to `tokenless-install` instead of submitting a job.
+Do not run an authentication-status check before provider work. Providers may expose usable free or anonymous prompt controls without an authenticated account. Let the visible `prompt.input` and `prompt.submit` actions establish readiness by waiting for their controls directly.
 
 ## Build only shareable context
 
@@ -52,6 +44,8 @@ Include only the request, explicit shareable context, and intentionally selected
 tokenless run \
   --profile "<managed-profile>" \
   --provider chatgpt \
+  --agent-kind "<agent kind>" \
+  --agent-session-id "<stable agent session id>" \
   --project-name "<agent project name>" \
   --chat-name "<agent task name>" \
   --project-root "/absolute/path/to/project" \
@@ -63,6 +57,18 @@ Omit `--browser-visibility` in ordinary jobs so the configured default applies.
 
 Repeat `--attach-file <path>` only for files the user intends to share. Tokenless stages regular files privately, verifies integrity, uploads through the visible page control, and keeps raw local paths out of daemon job results.
 
+File results distinguish `selected` from `accepted`. Treat only `accepted` as provider-visible attachment proof; `selected` means the local chooser or hidden file input received the file but the current fixture contract did not prove a visible provider acknowledgement.
+
+`--project-name` remains task metadata unless the user explicitly requests Workspace behavior. For the experimental provider-neutral Workspace flow, pass one of:
+
+```bash
+tokenless run --project-name "<name>" --workspace-mode auto ...
+tokenless run --project-name "<name>" --workspace-mode native ...
+tokenless run --project-name "<name>" --workspace-mode conversation ...
+```
+
+`auto` may report a conversation fallback, `native` fails when fixture-proven native creation is unavailable, and `conversation` requests the conversation strategy. Never describe a conversation fallback as a native provider Project. Inspect the current full capability map with `tokenless provider-action --action capability.inspect --provider <provider> --json`.
+
 Use `provider-controls` to discover exact visible labels before requesting a model or effort setting:
 
 ```bash
@@ -75,17 +81,42 @@ For work expected to exceed three minutes, keep the daemon job attached and add
 
 Retain the returned `jobId` and `taskId`, and pass `--task-id "<taskId>"` on later turns for the same task. Continue waiting while a run reports `queued`, `claimed`, `running`, or `daemon_waiting`. If it reports `waiting_for_user`, stop the agent task immediately and inspect `blocker.browser.windowOpen`: when true, tell the user to complete the visible verification or sign-in in the already-open managed browser window, keep the same `jobId`/`taskId`, and query the same task only after the user confirms; when false, run `tokenless resume --job-id "<jobId>" --browser-visibility headed --json` for that exact job, then complete the opened visible browser handoff; never retry, reimport, resubmit, or create a replacement job. Do not claim completion until the daemon reports `succeeded`. Stop on `failed`, `canceled`, `timed_out`, `blocked`, or `ui_mismatch` and report the exact visible blocker.
 
+If a run fails with `prompt_input_visibility_timeout` or `prompt_submit_visibility_timeout`, report which visible control did not appear within the bounded wait. Do not reinterpret that result as proof that authentication is required. If it fails with `prompt_input_failed` or `prompt_submit_failed`, report that the control appeared but the visible input or click operation failed.
+
 If sign-in, CAPTCHA, plan limits, consent, or confirmation requires the user, state the completed work, exact visible action, and next verification in the user's preferred language. Never request credentials or browser state.
 
 Use `profiles open` only for headed browser handoff. It always opens a visible browser window.
 
+## Recover after an agent restart
+
+Keep one stable `agent kind` and `agent session id` for the lifetime of an agent session. Pass both flags on addressed jobs, or set `TOKENLESS_AGENT_KIND` and `TOKENLESS_AGENT_SESSION_ID` so `run`, `state`, `resume`, `cancel`, and replay use the same recipient.
+
+After the agent process restarts, drain previously unseen outcome summaries once:
+
+```bash
+tokenless replay \
+  --agent-kind "<agent kind>" \
+  --agent-session-id "<stable agent session id>" \
+  --json
+```
+
+Tokenless probes or starts its local daemon on demand. Replay is deliberately at-most-once per actionable outcome revision: SQLite marks the revision reported before the CLI returns it, without waiting for an agent acknowledgement. Never expect the same revision to be proactively reported again. A later parked or terminal revision of the same job may be reported once as a new outcome.
+
+Replay contains only job identity, status, timestamps, and result/error/blocker availability flags. It never contains the full outcome. Retrieve durable full state only when useful:
+
+```bash
+tokenless state --job-id "<jobId>" --json
+```
+
+The full job remains in SQLite even after its summary is reported. If a replay response was lost, query a known `jobId` or `taskId`; do not create a replacement job solely to recover the result. Attached commands with the same agent identity record delivery at the CLI boundary automatically, so already returned outcomes do not later appear as unseen replay.
+
 ## Query daemon-backed state
 
 ```bash
 tokenless state --task-id "<returned taskId>" --json
 ```
 
-Use `latest.status`, `latest.state`, `latest.result`, `latest.error`, and `jobs` as the source of truth. State comes from the authenticated Rust daemon, not a local task-page or JSON fallback.
+Use `latest.status`, `latest.state`, `latest.result`, `latest.error`, and `jobs` as the source of truth. State comes from the authenticated local daemon, not a local task-page or JSON fallback.
 
 Cancel only through daemon-confirmed cancellation:
 
diff --git a/test/browser-runtime-artifact-security.test.mjs b/test/browser-runtime-artifact-security.test.mjs
new file mode 100644
index 0000000..b0853bc
--- /dev/null
+++ b/test/browser-runtime-artifact-security.test.mjs
@@ -0,0 +1,170 @@
+import assert from 'node:assert/strict'
+import { createHash } from 'node:crypto'
+import fs from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+import test from 'node:test'
+import { gzipSync } from 'node:zlib'
+
+import { verifyAndExtractManagedBrowserArtifact } from '../packages/cli/dist/src/browser-runtime/manager.js'
+
+test('managed browser artifact verification fails closed across real archive and executable boundaries', async () => {
+  const temporaryRoot = await fs.realpath(os.tmpdir())
+  const root = await fs.mkdtemp(path.join(temporaryRoot, 'tokenless-browser-artifact-security-'))
+  const stateDirectory = path.join(root, 'state')
+  const configPath = path.join(stateDirectory, 'config.json')
+  const registryPath = path.join(stateDirectory, 'profiles.json')
+  const configSentinel = Buffer.from('{"browser":"sentinel"}\n')
+  const registrySentinel = Buffer.from('{"profiles":["sentinel"]}\n')
+  try {
+    await fs.mkdir(stateDirectory, { recursive: true, mode: 0o700 })
+    await fs.writeFile(configPath, configSentinel, { mode: 0o600 })
+    await fs.writeFile(registryPath, registrySentinel, { mode: 0o600 })
+
+    const checksumCase = await prepareCase(root, 'checksum', createTarGz([
+      fileEntry('artifact.txt', Buffer.from('real archive bytes\n')),
+    ]))
+    await assertVerificationFailure({
+      testCase: checksumCase,
+      entry: artifactEntry({ sha256: '0'.repeat(64) }),
+      expectedCode: 'browser_runtime_checksum_mismatch',
+    })
+    await assert.rejects(fs.stat(checksumCase.payloadDirectory), { code: 'ENOENT' })
+    await assertStateUnchanged()
+
+    const unsafeCase = await prepareCase(root, 'unsafe-path', createTarGz([
+      fileEntry('../escaped-browser-artifact', Buffer.from('must not escape\n')),
+    ]))
+    await assertVerificationFailure({
+      testCase: unsafeCase,
+      entry: artifactEntry({ sha256: await sha256(unsafeCase.archive) }),
+      expectedCode: 'browser_runtime_archive_unsafe',
+    })
+    await assert.rejects(fs.stat(path.join(unsafeCase.caseDirectory, 'escaped-browser-artifact')), { code: 'ENOENT' })
+    await assert.rejects(fs.stat(path.join(root, 'escaped-browser-artifact')), { code: 'ENOENT' })
+    await assertStateUnchanged()
+
+    const executableRelativePath = process.platform === 'win32'
+      ? 'chrome.exe'
+      : 'Chromium.app/Contents/MacOS/Chromium'
+    const executableBytes = process.platform === 'win32'
+      ? await fs.readFile(path.join(process.env.SystemRoot ?? 'C:\\Windows', 'System32', 'where.exe'))
+      : Buffer.from('#!/bin/sh\nprintf "Chromium 1.2.3.4\\n"\n')
+    const versionCase = await prepareCase(root, 'wrong-version', createTarGz([
+      ...directoryEntries(executableRelativePath),
+      fileEntry(executableRelativePath, executableBytes, 0o755),
+    ]))
+    await assertVerificationFailure({
+      testCase: versionCase,
+      entry: artifactEntry({
+        sha256: await sha256(versionCase.archive),
+        executableRelativePath,
+      }),
+      expectedCode: 'browser_runtime_version_mismatch',
+    })
+    await assertStateUnchanged()
+  } finally {
+    await fs.rm(root, { recursive: true, force: true })
+  }
+
+  async function assertStateUnchanged() {
+    assert.deepEqual(await fs.readFile(configPath), configSentinel)
+    assert.deepEqual(await fs.readFile(registryPath), registrySentinel)
+  }
+})
+
+async function assertVerificationFailure({ testCase, entry, expectedCode }) {
+  await assert.rejects(
+    verifyAndExtractManagedBrowserArtifact({
+      entry,
+      archivePath: testCase.archive,
+      payloadDirectory: testCase.payloadDirectory,
+      temporaryRoot: testCase.caseDirectory,
+    }),
+    (error) => error?.code === expectedCode,
+  )
+}
+
+async function prepareCase(root, slug, archiveBytes) {
+  const caseDirectory = path.join(root, slug)
+  const archive = path.join(caseDirectory, 'browser.tar.gz')
+  const payloadDirectory = path.join(caseDirectory, 'payload')
+  await fs.mkdir(caseDirectory, { recursive: false, mode: 0o700 })
+  await fs.writeFile(archive, archiveBytes, { mode: 0o600 })
+  return { caseDirectory, archive, payloadDirectory }
+}
+
+function artifactEntry(overrides = {}) {
+  return {
+    family: 'cloak',
+    browserId: 'cloak',
+    displayName: 'Browser artifact security integration target',
+    platform: process.platform === 'win32' ? 'win32-x64' : 'darwin-arm64',
+    artifactVersion: 'integration-security-case',
+    browserVersion: '9.9.9.9',
+    downloadUrl: 'https://example.invalid/browser.tar.gz',
+    sha256: '0'.repeat(64),
+    archiveFormat: 'tar.gz',
+    executableRelativePath: process.platform === 'win32'
+      ? 'chrome.exe'
+      : 'Chromium.app/Contents/MacOS/Chromium',
+    ...overrides,
+  }
+}
+
+function directoryEntries(filePath) {
+  const segments = filePath.split('/')
+  const entries = []
+  for (let index = 1; index < segments.length; index += 1) {
+    entries.push(directoryEntry(`${segments.slice(0, index).join('/')}/`))
+  }
+  return entries
+}
+
+function fileEntry(name, content, mode = 0o644) {
+  return { name, content, mode, type: '0' }
+}
+
+function directoryEntry(name) {
+  return { name, content: Buffer.alloc(0), mode: 0o755, type: '5' }
+}
+
+function createTarGz(entries) {
+  const blocks = []
+  for (const entry of entries) {
+    const header = Buffer.alloc(512)
+    writeString(header, entry.name, 0, 100)
+    writeOctal(header, entry.mode, 100, 8)
+    writeOctal(header, 0, 108, 8)
+    writeOctal(header, 0, 116, 8)
+    writeOctal(header, entry.content.length, 124, 12)
+    writeOctal(header, 0, 136, 12)
+    header.fill(0x20, 148, 156)
+    header[156] = entry.type.charCodeAt(0)
+    writeString(header, 'ustar\0', 257, 6)
+    writeString(header, '00', 263, 2)
+    const checksum = header.reduce((sum, byte) => sum + byte, 0).toString(8).padStart(6, '0')
+    writeString(header, checksum, 148, 6)
+    header[154] = 0
+    header[155] = 0x20
+    blocks.push(header, entry.content)
+    const padding = (512 - (entry.content.length % 512)) % 512
+    if (padding > 0) blocks.push(Buffer.alloc(padding))
+  }
+  blocks.push(Buffer.alloc(1024))
+  return gzipSync(Buffer.concat(blocks))
+}
+
+function writeString(buffer, value, offset, length) {
+  buffer.write(value, offset, Math.min(Buffer.byteLength(value), length), 'utf8')
+}
+
+function writeOctal(buffer, value, offset, length) {
+  const encoded = value.toString(8).padStart(length - 1, '0').slice(-(length - 1))
+  buffer.write(encoded, offset, length - 1, 'ascii')
+  buffer[offset + length - 1] = 0
+}
+
+function sha256(file) {
+  return fs.readFile(file).then((content) => createHash('sha256').update(content).digest('hex'))
+}
diff --git a/test/daemon-lifecycle.test.mjs b/test/daemon-lifecycle.test.mjs
index 2b594e0..4971f6d 100644
--- a/test/daemon-lifecycle.test.mjs
+++ b/test/daemon-lifecycle.test.mjs
@@ -1,11 +1,12 @@
 import assert from 'node:assert/strict'
-import { createHash, createHmac, randomUUID } from 'node:crypto'
+import { createHash, createHmac, randomBytes, randomUUID } from 'node:crypto'
 import { spawn, spawnSync } from 'node:child_process'
 import fs from 'node:fs'
 import http from 'node:http'
 import net from 'node:net'
 import os from 'node:os'
 import path from 'node:path'
+import { DatabaseSync } from 'node:sqlite'
 import test from 'node:test'
 import { fileURLToPath, pathToFileURL } from 'node:url'
 
@@ -13,129 +14,89 @@ const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
 const cliDir = path.join(root, 'packages/cli')
 const cliEntry = path.join(cliDir, 'dist/src/tokenless.mjs')
 const cliIndex = path.join(cliDir, 'dist/src/index.js')
+const cliPlaywrightIndex = path.join(cliDir, 'dist/src/playwright/index.js')
+const tsDaemonEntry = path.join(cliDir, 'dist/src/daemon/daemon-entry.mjs')
 const packageVersion = JSON.parse(fs.readFileSync(path.join(cliDir, 'package.json'), 'utf8')).version
 
-test('ensureDaemonReady installs the packaged daemon and reports the running version and process proof', async () => {
+test('ensureDaemonReady installs the packaged daemon and reports OpenAPI v1 readiness', async () => {
   const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-daemon-first-install-')))
   const daemonUrl = `http://127.0.0.1:${await freePort()}`
   let pid
   try {
     const runtime = await importCli()
-    const ready = await runtime.ensureDaemonReady({ homeDir, daemonUrl, timeoutMs: 10_000 })
+    const ready = await runtime.ensureDaemonReady({ homeDir, daemonUrl, timeoutMs: 10_000, requiredProvider: 'chatgpt' })
     pid = ready.pid
     assert.equal(ready.started, true)
+    assert.equal(ready.identityVerified, true)
+    assert.equal(Object.hasOwn(ready.body, 'protocol'), false)
     assert.equal(ready.body.version, packageVersion)
-    assert.equal(ready.body.daemon_process_proof_protocol, runtime.DAEMON_PROCESS_PROOF_PROTOCOL)
-    assert.equal(ready.body.daemon_process_identity_error, undefined)
+    assert.equal(ready.binaryPath, process.execPath)
+    assert.equal(fs.existsSync(ready.daemonEntryPath), true)
+    assert.equal(typeof ready.body.proof, 'string')
     assert.equal(Number.isInteger(ready.body.pid), true)
     assert.equal(ready.body.pid, pid)
-    assert.match(ready.body.running_binary_hash, /^[0-9a-f]{64}$/)
-    assert.equal(fs.existsSync(runtime.installedRustBinaryPath(homeDir)), true)
-
     const inspection = await runtime.inspectManagedRuntime(homeDir)
     assert.equal(inspection.ok, true)
-    assert.equal(inspection.packaged.buildInfo.version, packageVersion)
-    assert.equal(inspection.installed.matchesBundled, true)
-    assert.equal(ready.body.running_binary_hash, inspection.packaged.hash)
+    assert.equal(inspection.daemon.buildInfo.version, packageVersion)
+    assert.equal(Object.hasOwn(inspection.daemon.buildInfo, 'protocol'), false)
+    assert.equal(inspection.daemon.path, ready.daemonEntryPath)
   } finally {
     if (pid) await stopPid(pid)
     fs.rmSync(homeDir, { recursive: true, force: true })
   }
 })
 
-test('ensureDaemonReady refuses to restart a stale daemon without process correlation', async () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-daemon-foreign-')))
-  const token = 'foreign-control-token'
-  fs.writeFileSync(path.join(homeDir, 'daemon.token'), `${token}\n`, { mode: 0o600 })
-  let readyRequests = 0
-  const server = await startForeignReadyServer({
-    homeDir,
-    token,
-    version: '0.0.0-stale',
-    includeProcessProof: false,
-    onReady: () => { readyRequests += 1 },
-  })
-  try {
-    const runtime = await importCli()
-    await assert.rejects(
-      runtime.ensureDaemonReady({ homeDir, daemonUrl: server.url, timeoutMs: 1000 }),
-      (error) => error.code === 'daemon_restart_unsafe' && /will not stop it automatically/.test(error.message)
-    )
-    assert.equal(server.listening(), true)
-    assert.equal(readyRequests > 0, true)
-  } finally {
-    await server.close()
-    fs.rmSync(homeDir, { recursive: true, force: true })
-  }
-})
-
-test('ensureDaemonReady restarts a process-correlated stale daemon after refreshing runtime', async () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-daemon-safe-restart-')))
+test('ensureDaemonReady never restarts a healthy daemon for a provider absent from the local registry', async () => {
+  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-daemon-provider-reconcile-')))
   const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const token = 'safe-restart-control-token'
-  fs.writeFileSync(path.join(homeDir, 'daemon.token'), `${token}\n`, { mode: 0o600 })
-  const stale = await startChildStaleDaemon({ homeDir, token, daemonUrl, includeProcessProof: true })
-  let restartedPid
+  const runtime = await importCli()
+  let pid
   try {
-    const runtime = await importCli()
-    const ready = await runtime.ensureDaemonReady({ homeDir, daemonUrl, timeoutMs: 10_000 })
-    restartedPid = ready.pid
-    assert.equal(ready.started, true)
+    const ready = await runtime.ensureDaemonReady({ homeDir, daemonUrl, timeoutMs: 10_000, requiredProvider: 'chatgpt' })
+    pid = ready.pid
     assert.equal(ready.body.version, packageVersion)
-    assert.notEqual(restartedPid, stale.pid)
-    assert.equal(await processExited(stale.child), true)
+
+    await assert.rejects(
+      runtime.ensureDaemonReady({ homeDir, daemonUrl, timeoutMs: 10_000, requiredProvider: 'not-a-provider' }),
+      (error) => {
+        assert.equal(error.code, 'daemon_provider_unsupported')
+        assert.match(error.message, /not-a-provider/)
+        return true
+      }
+    )
+    assert.equal(await pidExited(pid), false)
+    const afterFailure = await runtime.probeDaemonReady({ homeDir, daemonUrl, timeoutMs: 500 })
+    assert.equal(afterFailure.ok, true)
+    assert.equal(afterFailure.body.pid, pid)
   } finally {
-    if (restartedPid) await stopPid(restartedPid)
-    stale.child.kill('SIGTERM')
+    if (pid) await stopPid(pid)
     fs.rmSync(homeDir, { recursive: true, force: true })
   }
 })
 
-test('ensureDaemonReady restarts a same-version daemon whose process proof binds a different binary hash', async () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-daemon-same-version-hash-')))
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const token = 'same-version-hash-control-token'
-  fs.writeFileSync(path.join(homeDir, 'daemon.token'), `${token}\n`, { mode: 0o600 })
-  const stale = await startChildStaleDaemon({
-    homeDir,
-    token,
-    daemonUrl,
-    version: packageVersion,
-    includeProcessProof: true,
-    runningBinaryHash: '0'.repeat(64),
-  })
-  let restartedPid
-  try {
-    const runtime = await importCli()
-    const ready = await runtime.ensureDaemonReady({ homeDir, daemonUrl, timeoutMs: 10_000 })
-    restartedPid = ready.pid
-    const inspection = await runtime.inspectManagedRuntime(homeDir)
-    assert.equal(ready.started, true)
-    assert.equal(ready.body.version, packageVersion)
-    assert.equal(ready.body.running_binary_hash, inspection.packaged.hash)
-    assert.notEqual(restartedPid, stale.pid)
-    assert.equal(await processExited(stale.child), true)
-  } finally {
-    if (restartedPid) await stopPid(restartedPid)
-    stale.child.kill('SIGTERM')
-    fs.rmSync(homeDir, { recursive: true, force: true })
-  }
+test('built client rejects oversized daemon requests', async () => {
+  const runtime = await importCli()
+  await assert.rejects(
+    runtime.createDaemonJob({
+      daemonUrl: 'http://127.0.0.1:9',
+      provider: 'chatgpt',
+      action: 'prompt.submit',
+      requestJson: {
+        prompt: 'x'.repeat(runtime.MAX_DAEMON_REQUEST_BYTES + 1),
+      },
+    }),
+    (error) => {
+      assert.equal(error.code, 'daemon_request_too_large')
+      assert.match(error.message, new RegExp(`keep it below ${runtime.MAX_DAEMON_REQUEST_BYTES} bytes`))
+      return true
+    }
+  )
 })
 
-test('concurrent ensureDaemonReady serializes stale daemon stop, refresh, and start under the lifecycle lock', async () => {
+test('concurrent ensureDaemonReady serializes one fresh daemon start through SQLite runtime state', async () => {
   const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-daemon-concurrent-lock-')))
   const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const token = 'concurrent-lifecycle-control-token'
-  fs.writeFileSync(path.join(homeDir, 'daemon.token'), `${token}\n`, { mode: 0o600 })
-  const stale = await startChildStaleDaemon({
-    homeDir,
-    token,
-    daemonUrl,
-    includeProcessProof: true,
-    runningBinaryHash: '1'.repeat(64),
-  })
   const runtime = await importCli()
-  const lockPath = path.join(homeDir, '.daemon-start.lock')
   let startedPid
   try {
     const results = await Promise.all([
@@ -147,68 +108,273 @@ test('concurrent ensureDaemonReady serializes stale daemon stop, refresh, and st
     startedPid = started[0].pid
     assert.equal(results.every((result) => result.body.version === packageVersion), true)
     assert.equal(new Set(results.map((result) => result.pid)).size, 1)
-    assert.equal(await processExited(stale.child), true)
-    assert.equal(fs.existsSync(lockPath), false)
+    assert.equal(new Set(results.map((result) => result.url)).size, 1)
+    assert.equal(readPersistedRuntimeOrigin(homeDir), results[0].url)
+    assert.equal(fs.existsSync(path.join(homeDir, '.daemon-start.lock')), false)
   } finally {
     if (startedPid) await stopPid(startedPid)
-    stale.child.kill('SIGTERM')
     fs.rmSync(homeDir, { recursive: true, force: true })
   }
 })
 
-test('ensureDaemonReady terminates a spawned daemon and removes its pid marker when identity coherence fails', async () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-daemon-spawn-cleanup-')))
+test('repeated concurrent ensureDaemonReady never takes over a freshly published endpoint', async () => {
+  const runtime = await importCli()
+  for (let iteration = 0; iteration < 5; iteration += 1) {
+    const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), `tokenless-daemon-concurrent-repeat-${iteration}-`)))
+    const daemonUrl = `http://127.0.0.1:${await freePort()}`
+    let pid
+    try {
+      const results = await Promise.all([
+        runtime.ensureDaemonReady({ homeDir, daemonUrl, timeoutMs: 10_000 }),
+        runtime.ensureDaemonReady({ homeDir, daemonUrl, timeoutMs: 10_000 }),
+        runtime.ensureDaemonReady({ homeDir, daemonUrl, timeoutMs: 10_000 }),
+      ])
+      pid = results[0].pid
+      assert.equal(new Set(results.map((result) => result.pid)).size, 1)
+      assert.equal(new Set(results.map((result) => result.url)).size, 1)
+      const row = readRuntimeStateRow(homeDir)
+      assert.equal(row?.state, 'running')
+      assert.equal(row?.origin, results[0].url)
+      assert.equal(row?.pid, pid)
+    } finally {
+      if (pid) await stopPid(pid)
+      fs.rmSync(homeDir, { recursive: true, force: true })
+    }
+  }
+})
+
+test('ensureDaemonReady skips a foreign preferred port and later CLI stop uses the persisted actual origin', async () => {
+  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-daemon-dynamic-port-')))
+  const preferredPort = await freePort()
+  const preferredUrl = `http://127.0.0.1:${preferredPort}`
+  const foreign = await startForeignListener(preferredUrl)
+  const runtime = await importCli()
+  let pid
+  try {
+    await runtime.writeTokenlessConfig({ homeDir, daemonUrl: preferredUrl })
+    const ready = await runtime.ensureDaemonReady({ homeDir, daemonUrl: preferredUrl, timeoutMs: 10_000 })
+    pid = ready.pid
+    assert.equal(ready.started, true)
+    assert.notEqual(ready.url, preferredUrl)
+    assert.equal(new URL(ready.url).hostname, '127.0.0.1')
+    assert.equal(Number(new URL(ready.url).port) > preferredPort, true)
+    assert.equal(readPersistedRuntimeOrigin(homeDir), ready.url)
+    assert.equal((await runtime.readTokenlessConfig(homeDir)).daemonUrl, preferredUrl)
+    assert.equal(await tcpReachable(preferredUrl), true)
+
+    const doctor = runCli(['doctor', '--home', homeDir, '--json'])
+    assert.equal(doctor.status, 1, doctor.stderr || doctor.stdout)
+    const doctorPayload = JSON.parse(doctor.stdout)
+    assert.equal(doctorPayload.checks.daemon.ready, true)
+    assert.equal(doctorPayload.checks.daemon.url, ready.url)
+    assert.equal(doctorPayload.checks.daemon.pid, pid)
+    assert.equal((await runtime.readTokenlessConfig(homeDir)).daemonUrl, preferredUrl)
+
+    const stopped = runCli(['daemon', 'stop', '--home', homeDir, '--json'])
+    assert.equal(stopped.status, 0, stopped.stderr || stopped.stdout)
+    const payload = JSON.parse(stopped.stdout)
+    assert.equal(payload.ok, true)
+    assert.equal(payload.status, 'stopped')
+    assert.equal(payload.url, ready.url)
+    assert.equal(payload.pid, pid)
+    assert.equal(await pidExited(pid), true)
+    pid = undefined
+    assert.equal(await tcpReachable(preferredUrl), true)
+    assert.equal((await runtime.readTokenlessConfig(homeDir)).daemonUrl, preferredUrl)
+  } finally {
+    await foreign.close()
+    if (pid) await stopPid(pid)
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('superseded daemon child never becomes ready or accepts jobs before claim-bound publish', async () => {
+  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-daemon-superseded-child-')))
+  const port = await freePort()
+  const daemonUrl = `http://127.0.0.1:${port}`
+  const staleOwner = `stale-${randomUUID()}`
+  let child
+  try {
+    seedStartingRuntimeState(homeDir, {
+      generation: 2,
+      ownerToken: `current-${randomUUID()}`,
+      ownerPid: process.pid,
+    })
+    child = spawnDaemonEntry({
+      homeDir,
+      port,
+      startupOwnerToken: staleOwner,
+      startupGeneration: 1,
+    })
+    const probe = await waitForReadyStatusOrExit(child, daemonUrl)
+    if (probe.exited !== true) {
+      assert.notEqual(probe.status, 200)
+      const token = fs.readFileSync(path.join(homeDir, 'daemon.token'), 'utf8').trim()
+      const response = await fetch(`${daemonUrl}/jobs`, {
+        method: 'POST',
+        headers: {
+          accept: 'application/json',
+          authorization: `Bearer ${token}`,
+          'content-type': 'application/json',
+        },
+        body: JSON.stringify({
+          provider: 'chatgpt',
+          action: 'visible_provider_actions',
+          execution_backend: 'playwright',
+          profile_id: randomUUID(),
+          job_id: randomUUID(),
+          request_json: { malformed: true },
+        }),
+      }).catch(() => null)
+      if (response) assert.notEqual(response.status, 200)
+    }
+    await waitForExit(child, 5_000).catch(() => undefined)
+    assert.equal(readJobCount(homeDir), 0)
+  } finally {
+    if (child) await stopChild(child)
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('direct concurrent daemon starts converge to one running daemon', async () => {
+  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-daemon-direct-concurrent-')))
+  const port = await freePort()
+  const first = spawnDaemonEntry({ homeDir, port })
+  const second = spawnDaemonEntry({ homeDir, port })
+  let ready
+  try {
+    ready = await waitForOneReadyDaemon([
+      { child: first, url: `http://127.0.0.1:${port}` },
+      { child: second, url: `http://127.0.0.1:${port}` },
+      { child: first, url: `http://127.0.0.1:${port + 1}` },
+      { child: second, url: `http://127.0.0.1:${port + 1}` },
+    ], homeDir)
+    const endpoint = readPersistedRuntimeEndpoint(homeDir)
+    assert.equal(endpoint.origin, ready.url)
+    assert.equal(endpoint.pid, ready.pid)
+    const exits = await Promise.all([
+      waitForExitResult(first, 2_000).catch(() => null),
+      waitForExitResult(second, 2_000).catch(() => null),
+    ])
+    assert.equal(exits.filter(Boolean).length, 1)
+  } finally {
+    await Promise.all([stopChild(first), stopChild(second)])
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('ensureDaemonReady gracefully replaces a proof-verified same-home version mismatch', async () => {
+  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-daemon-version-replace-')))
   const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const token = 'spawn-cleanup-control-token'
+  const token = 'same-home-version-mismatch-token'
   fs.writeFileSync(path.join(homeDir, 'daemon.token'), `${token}\n`, { mode: 0o600 })
-  const childPidPath = path.join(homeDir, 'spawned-bad-daemon.pid')
-  const binaryPath = writeSpawnedBadDaemon({
+  const fake = await startReadyOnlyDaemon({
     homeDir,
-    childPidPath,
-    version: packageVersion,
-    runningBinaryHash: '3'.repeat(64),
+    daemonUrl,
+    token,
+    version: '0.2.0',
   })
+  let pid
   try {
     const runtime = await importCli()
-    await assert.rejects(
-      runtime.ensureDaemonReady({ homeDir, daemonUrl, binaryPath, timeoutMs: 5_000 }),
-      (error) => error.code === 'daemon_binary_hash_mismatch'
-    )
-    const spawnedPid = Number(fs.readFileSync(childPidPath, 'utf8'))
-    assert.equal(await pidExited(spawnedPid), true)
-    assert.equal(fs.existsSync(path.join(homeDir, 'daemon.pid.json')), false)
+    const ready = await runtime.ensureDaemonReady({ homeDir, daemonUrl, timeoutMs: 10_000 })
+    pid = ready.pid
+    assert.equal(fake.shutdownCount, 1)
+    assert.notEqual(pid, fake.pid)
+    assert.equal(ready.started, true)
+    assert.equal(ready.body.version, packageVersion)
+    assert.equal(Object.hasOwn(ready.body, 'protocol'), false)
   } finally {
+    await fake.close()
+    if (pid) await stopPid(pid)
     fs.rmSync(homeDir, { recursive: true, force: true })
   }
 })
 
-test('running daemon reports the startup-frozen executable hash after its binary path is replaced', async () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-daemon-frozen-hash-')))
+test('ensureDaemonReady does not stop or treat a foreign preferred listener as Tokenless', async () => {
+  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-daemon-foreign-listener-')))
+  const foreignHome = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-daemon-foreign-home-')))
   const daemonUrl = `http://127.0.0.1:${await freePort()}`
+  fs.writeFileSync(path.join(homeDir, 'daemon.token'), 'requested-home-token\n', { mode: 0o600 })
+  const fake = await startReadyOnlyDaemon({
+    homeDir: foreignHome,
+    daemonUrl,
+    token: 'foreign-home-token',
+    version: packageVersion,
+  })
   let pid
   try {
     const runtime = await importCli()
-    const inspection = await runtime.inspectManagedRuntime(homeDir)
-    const binaryPath = path.join(homeDir, `tokenless-daemon-copy${process.platform === 'win32' ? '.exe' : ''}`)
-    fs.copyFileSync(inspection.packaged.path, binaryPath)
-    if (process.platform !== 'win32') fs.chmodSync(binaryPath, 0o755)
-    const startupHash = fileHash(binaryPath)
-    const ready = await runtime.ensureDaemonReady({ homeDir, daemonUrl, binaryPath, timeoutMs: 10_000 })
+    const ready = await runtime.ensureDaemonReady({ homeDir, daemonUrl, timeoutMs: 10_000 })
     pid = ready.pid
-    assert.equal(ready.body.running_binary_hash, startupHash)
+    assert.equal(ready.started, true)
+    assert.notEqual(ready.url, daemonUrl)
+    assert.equal(fake.shutdownCount, 0)
+    assert.equal(await tcpReachable(daemonUrl), true)
+  } finally {
+    await fake.close()
+    if (pid) await stopPid(pid)
+    fs.rmSync(homeDir, { recursive: true, force: true })
+    fs.rmSync(foreignHome, { recursive: true, force: true })
+  }
+})
 
-    const replacement = `${binaryPath}.replacement`
-    fs.writeFileSync(replacement, Buffer.concat([fs.readFileSync(binaryPath), Buffer.from('\nreplacement\n')]))
-    if (process.platform !== 'win32') fs.chmodSync(replacement, 0o755)
-    fs.renameSync(replacement, binaryPath)
-    assert.notEqual(fileHash(binaryPath), startupHash)
+test('playwright daemon client verifies /ready before sending the bearer token', async () => {
+  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-daemon-client-ready-auth-')))
+  const foreignHome = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-daemon-client-foreign-home-')))
+  const daemonUrl = `http://127.0.0.1:${await freePort()}`
+  fs.writeFileSync(path.join(homeDir, 'daemon.token'), 'requested-home-token\n', { mode: 0o600 })
+  const fake = await startReadyOnlyDaemon({
+    homeDir: foreignHome,
+    daemonUrl,
+    token: 'foreign-home-token',
+    version: packageVersion,
+  })
+  try {
+    const playwright = await importPlaywright()
+    const runtime = await importCli()
+    await assert.rejects(
+      runtime.createDaemonJob({
+        homeDir,
+        daemonUrl,
+        provider: 'chatgpt',
+        action: 'visible_provider_actions',
+        requestJson: {},
+        executionBackend: 'playwright',
+        profileId: 'default',
+      }),
+      (error) => {
+        assert.equal(error.code, 'daemon_ready_proof_mismatch')
+        return true
+      }
+    )
+    assert.deepEqual(fake.readyAuthorizationHeaders, [undefined])
 
-    const reprobe = await runtime.probeDaemonReady({ homeDir, daemonUrl })
-    assert.equal(reprobe.ok, true)
-    assert.equal(reprobe.body.running_binary_hash, startupHash)
+    await assert.rejects(
+      playwright.submitManagedPlaywrightJob({
+        homeDir,
+        daemonUrl,
+        profileId: 'default',
+        request: {
+          provider: 'chatgpt',
+          browserVisibility: 'headed',
+          taskId: 'ready-auth-test',
+          actions: [
+            { requestId: 'ready-auth-test:auth', action: playwright.VISIBLE_ACTIONS.AUTH_STATUS, payload: {} },
+          ],
+        },
+      }),
+      (error) => {
+        assert.equal(error.code, 'daemon_ready_proof_mismatch')
+        return true
+      }
+    )
+    assert.deepEqual(fake.readyAuthorizationHeaders, [undefined, undefined])
+    assert.deepEqual(fake.jobAuthorizationHeaders, [])
   } finally {
-    if (pid) await stopPid(pid)
+    await fake.close()
     fs.rmSync(homeDir, { recursive: true, force: true })
+    fs.rmSync(foreignHome, { recursive: true, force: true })
   }
 })
 
@@ -220,6 +386,7 @@ test('doctor is read-only for an uninitialized Tokenless home', () => {
     assert.equal(result.status, 1)
     const payload = JSON.parse(result.stdout)
     assert.equal(payload.ok, false)
+    assert.equal(payload.runtime, 'typescript')
     assert.equal(payload.checks.daemon.ready, false)
     assert.equal(payload.checks.daemon.daemonLogPath, path.join(homeDir, 'daemon.log'))
     assert.equal(payload.checks.daemon.daemonLogExists, false)
@@ -231,36 +398,113 @@ test('doctor is read-only for an uninitialized Tokenless home', () => {
   }
 })
 
-test('doctor reports daemon mismatch for an old running daemon instead of ok=true', async () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-doctor-old-daemon-')))
+test('daemon stop is idempotent when no daemon is listening', async () => {
+  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-daemon-stop-not-running-')))
   const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const token = 'doctor-old-daemon-control-token'
-  fs.writeFileSync(path.join(homeDir, 'daemon.token'), `${token}\n`, { mode: 0o600 })
-  const server = await startChildStaleDaemon({
-    homeDir,
-    token,
-    daemonUrl,
-    version: '0.1.2',
-    includeProcessProof: true,
-    runningBinaryHash: '2'.repeat(64),
-  })
   try {
+    const result = runCli(['daemon', 'stop', '--home', homeDir, '--daemon-url', daemonUrl, '--json'])
+    assert.equal(result.status, 0, result.stderr || result.stdout)
+    const payload = JSON.parse(result.stdout)
+    assert.equal(payload.ok, true)
+    assert.equal(payload.status, 'not_running')
+    assert.equal(payload.url, daemonUrl)
+  } finally {
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('daemon stop uses bearer-authenticated self-shutdown for a verified daemon', async () => {
+  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-daemon-stop-self-')))
+  const daemonUrl = `http://127.0.0.1:${await freePort()}`
+  let pid
+  try {
+    const runtime = await importCli()
+    const ready = await runtime.ensureDaemonReady({ homeDir, daemonUrl, timeoutMs: 10_000 })
+    pid = ready.pid
+    const result = runCli(['daemon', 'stop', '--home', homeDir, '--daemon-url', daemonUrl, '--json'])
+    assert.equal(result.status, 0, result.stderr || result.stdout)
+    const payload = JSON.parse(result.stdout)
+    assert.equal(payload.ok, true)
+    assert.equal(payload.status, 'stopped')
+    assert.equal(payload.pid, pid)
+    assert.equal(fs.existsSync(path.join(homeDir, 'daemon.pid.json')), false)
+    assert.equal(await pidExited(pid), true)
+    pid = undefined
+  } finally {
+    if (pid) await stopPid(pid)
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('daemon shutdown endpoint uses bearer authentication', async () => {
+  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-daemon-bearer-shutdown-')))
+  const daemonUrl = `http://127.0.0.1:${await freePort()}`
+  let pid
+  try {
+    const runtime = await importCli()
+    const ready = await runtime.ensureDaemonReady({ homeDir, daemonUrl, timeoutMs: 10_000 })
+    pid = ready.pid
+    const controlToken = await runtime.readDaemonToken({ homeDir })
+
+    const missing = await fetch(`${daemonUrl}/control/shutdown`, { method: 'POST' })
+    assert.equal(missing.status, 401)
+    const missingBody = await missing.json()
+    assert.equal(Object.hasOwn(missingBody.error, 'protocol'), false)
+    assert.equal(missingBody.error.code, 'control_auth_missing')
+
+    const rejected = await fetch(`${daemonUrl}/control/shutdown`, {
+      method: 'POST',
+      headers: { authorization: 'Bearer wrong-token' },
+    })
+    assert.equal(rejected.status, 403)
+    const rejectedBody = await rejected.json()
+    assert.equal(Object.hasOwn(rejectedBody.error, 'protocol'), false)
+    assert.equal(rejectedBody.error.code, 'control_auth_rejected')
+    assert.equal(JSON.stringify(rejectedBody).includes(controlToken), false)
+    assert.equal((await runtime.probeDaemonReady({ homeDir, daemonUrl })).ok, true)
+
+    const accepted = await fetch(`${daemonUrl}/control/shutdown`, {
+      method: 'POST',
+      headers: { authorization: `Bearer ${controlToken}` },
+    })
+    assert.equal(accepted.status, 200)
+    const acceptedBody = await accepted.json()
+    assert.equal(acceptedBody.status, 'shutting_down')
+    assert.equal(await pidExited(pid), true)
+    assert.notEqual(readRuntimeStateRow(homeDir)?.state, 'running')
+    pid = undefined
+  } finally {
+    if (pid) await stopPid(pid)
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('doctor reports authenticated embedded browser runtime status for a ready TypeScript daemon', async () => {
+  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-doctor-embedded-runtime-')))
+  const daemonUrl = `http://127.0.0.1:${await freePort()}`
+  let pid
+  try {
+    const runtime = await importCli()
+    const ready = await runtime.ensureDaemonReady({ homeDir, daemonUrl, timeoutMs: 10_000 })
+    pid = ready.pid
+
     const result = runCli(['doctor', '--home', homeDir, '--daemon-url', daemonUrl, '--json'])
-    assert.equal(result.status, 1)
+    assert.equal(result.status, 1, result.stderr || result.stdout)
     const payload = JSON.parse(result.stdout)
-    assert.equal(payload.checks.daemon.ok, false)
+    assert.equal(payload.runtime, 'typescript')
     assert.equal(payload.checks.daemon.ready, true)
-    assert.equal(payload.checks.daemon.code, 'daemon_version_mismatch')
-    assert.equal(payload.checks.daemon.expectedVersion, packageVersion)
-    assert.equal(payload.checks.daemon.runningVersion, '0.1.2')
-    assert.equal(payload.checks.daemon.runningHash, '2'.repeat(64))
-    assert.match(payload.checks.daemon.packagedHash, /^[0-9a-f]{64}$/)
-    assert.equal(payload.checks.daemon.daemonLogPath, path.join(homeDir, 'daemon.log'))
-    assert.equal(payload.checks.daemon.daemonLogExists, false)
-    assert.equal(fs.existsSync(path.join(homeDir, 'daemon.log')), false)
+    assert.equal(payload.checks.daemon.pid, pid)
+    assert.equal(payload.checks.runner.runtime, 'embedded')
+    assert.equal(payload.checks.runner.runtimeStatus, 'running')
+    assert.equal(payload.checks.runner.state, 'running')
+    assert.equal(payload.checks.runner.pid, pid)
+    assert.equal(payload.checks.runner.sessionId, 'embedded')
+    assert.equal(payload.checks.runner.safeToStop, false)
+    assert.equal(payload.checks.runner.heartbeatAt, null)
+    assert.equal(payload.checks.runner.activeProfileCount, 0)
+    assert.equal(payload.checks.runner.activeJobCount, 0)
   } finally {
-    server.child.kill('SIGTERM')
-    await processExited(server.child)
+    if (pid) await stopPid(pid)
     fs.rmSync(homeDir, { recursive: true, force: true })
   }
 })
@@ -293,6 +537,7 @@ test('doctor validates an existing managed profile registry without mutating hom
       },
     },
   }, null, 2)}\n`, { mode: 0o600 })
+  fs.writeFileSync(path.join(homeDir, 'daemon.token'), 'initialized-stopped-home-token\n', { mode: 0o600 })
   fs.writeFileSync(markerPath, 'unchanged\n', { mode: 0o600 })
   const before = snapshotTree(homeDir)
   try {
@@ -301,6 +546,13 @@ test('doctor validates an existing managed profile registry without mutating hom
     const payload = JSON.parse(result.stdout)
     assert.equal(payload.checks.managedProfile.ok, true)
     assert.equal(payload.checks.managedProfile.slug, 'personal')
+    assert.equal(payload.checks.daemon.ok, true)
+    assert.equal(payload.checks.daemon.ready, false)
+    assert.equal(payload.checks.daemon.running, false)
+    assert.equal(payload.checks.daemon.status, 'stopped')
+    assert.equal(payload.checks.daemon.versionCompatible, null)
+    assert.equal(payload.checks.runner.ok, true)
+    assert.equal(payload.checks.runner.state, 'stopped')
     assert.equal(payload.checks.daemon.daemonLogPath, path.join(homeDir, 'daemon.log'))
     assert.equal(payload.checks.daemon.daemonLogExists, false)
     assert.deepEqual(snapshotTree(homeDir), before)
@@ -309,45 +561,6 @@ test('doctor validates an existing managed profile registry without mutating hom
   }
 })
 
-test('setup aborts on local runtime failure before provider readiness jobs', async () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-setup-runtime-gate-')))
-  const skillHome = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-setup-runtime-gate-skills-')))
-  const token = 'setup-runtime-control-token'
-  fs.writeFileSync(path.join(homeDir, 'daemon.token'), `${token}\n`, { mode: 0o600 })
-  writeVerifiedSkills(skillHome)
-  const server = await startChildStaleDaemon({
-    homeDir,
-    token,
-    daemonUrl: `http://127.0.0.1:${await freePort()}`,
-    version: '0.0.0-stale',
-    includeProcessProof: false,
-  })
-  try {
-    const result = await runCliAsync([
-      'setup',
-      '--defaults',
-      '--fresh',
-      '--skip-skill-install',
-      '--home', homeDir,
-      '--daemon-url', server.url,
-      '--json',
-    ], {
-      TOKENLESS_BROWSER_EXECUTABLE: process.execPath,
-      TOKENLESS_SETUP_SKILL_HOME: skillHome,
-    })
-    assert.equal(result.status, 1, result.stderr || result.stdout)
-    const payload = JSON.parse(result.stdout)
-    assert.equal(payload.error.code, 'daemon_restart_unsafe')
-    assert.equal(fs.existsSync(path.join(homeDir, 'browser', 'profiles.json')), false)
-    assert.equal(server.jobRequests(), 0)
-  } finally {
-    server.child.kill('SIGTERM')
-    await processExited(server.child)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-    fs.rmSync(skillHome, { recursive: true, force: true })
-  }
-})
-
 function runCli(args, env = {}) {
   return spawnSync(process.execPath, [cliEntry, ...args], {
     cwd: root,
@@ -357,335 +570,268 @@ function runCli(args, env = {}) {
   })
 }
 
-function runCliAsync(args, env = {}) {
-  return new Promise((resolve, reject) => {
-    const child = spawn(process.execPath, [cliEntry, ...args], {
-      cwd: root,
-      env: { ...process.env, TOKENLESS_PROVIDER: '', ...env },
-      stdio: ['ignore', 'pipe', 'pipe'],
-    })
-    let stdout = ''
-    let stderr = ''
-    child.stdout.setEncoding('utf8')
-    child.stderr.setEncoding('utf8')
-    child.stdout.on('data', (chunk) => { stdout += chunk })
-    child.stderr.on('data', (chunk) => { stderr += chunk })
-    const timer = setTimeout(() => {
-      child.kill('SIGTERM')
-      reject(new Error(`Tokenless CLI timed out.\n${stdout}\n${stderr}`))
-    }, 20_000)
-    child.once('error', (error) => {
-      clearTimeout(timer)
-      reject(error)
-    })
-    child.once('exit', (status, signal) => {
-      clearTimeout(timer)
-      resolve({ status, signal, stdout, stderr })
-    })
-  })
-}
-
 async function importCli() {
   return await import(`${pathToFileURL(cliIndex).href}?daemon_lifecycle=${Date.now()}_${Math.random()}`)
 }
 
-async function startForeignReadyServer({
-  homeDir,
-  token,
-  version,
-  includeProcessProof,
-  runningBinaryHash = 'f'.repeat(64),
-  onReady = () => {},
-}) {
-  let jobRequests = 0
+async function importPlaywright() {
+  return await import(`${pathToFileURL(cliPlaywrightIndex).href}?daemon_lifecycle=${Date.now()}_${Math.random()}`)
+}
+
+async function freePort() {
+  const server = net.createServer()
+  await new Promise((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(0, '127.0.0.1', resolve)
+  })
+  const address = server.address()
+  const port = address.port
+  await new Promise((resolve) => server.close(resolve))
+  return port
+}
+
+async function startReadyOnlyDaemon({ homeDir, daemonUrl, token, version }) {
+  const url = new URL(daemonUrl)
+  let shutdownCount = 0
+  let closed = false
+  const readyAuthorizationHeaders = []
+  const jobAuthorizationHeaders = []
   const server = http.createServer((request, response) => {
-    if (request.url?.startsWith('/jobs')) jobRequests += 1
-    if (!request.url?.startsWith('/ready')) {
-      response.writeHead(404, { 'content-type': 'application/json' })
-      response.end(JSON.stringify({ error: 'not found' }))
+    const requestUrl = new URL(request.url || '/', daemonUrl)
+    if (request.method === 'GET' && requestUrl.pathname === '/ready') {
+      readyAuthorizationHeaders.push(request.headers.authorization)
+      const challenge = requestUrl.searchParams.get('challenge') ?? ''
+      writeJson(response, 200, {
+        version,
+        ready: true,
+        home_dir: homeDir,
+        pid: process.pid,
+        proof: readyProof(token, challenge, homeDir),
+      })
       return
     }
-    onReady()
-    const url = new URL(request.url, 'http://127.0.0.1')
-    const challenge = url.searchParams.get('challenge') ?? ''
-    const body = {
-      protocol: 'tokenless.daemon.v1',
-      daemon_protocol: 'tokenless.daemon.v1',
-      version,
-      native_protocol: 'tokenless.native.v1',
-      status: 'ok',
-      ready: true,
-      home_dir: homeDir,
-      ready_proof_protocol: 'tokenless.daemon-ready-proof.v1',
-      ready_challenge: challenge,
-      ready_proof: hmac(token, [
-        'tokenless.daemon-ready-proof.v1',
-        challenge,
-        'tokenless.daemon.v1',
-        'tokenless.native.v1',
-        homeDir,
-      ]),
-      ...(includeProcessProof ? {
-        pid: process.pid,
-        instance_id: 'AAAAAAAAAAAAAAAAAAAAAA',
-        running_binary_hash: runningBinaryHash,
-        daemon_process_proof_protocol: 'tokenless.daemon-process-proof.v1',
-        daemon_process_proof: hmac(token, [
-          'tokenless.daemon-process-proof.v1',
-          challenge,
-          'tokenless.daemon.v1',
-          'tokenless.native.v1',
-          homeDir,
-          String(process.pid),
-          'AAAAAAAAAAAAAAAAAAAAAA',
-          runningBinaryHash,
-        ]),
-      } : {}),
+    if (request.method === 'POST' && requestUrl.pathname === '/jobs') {
+      jobAuthorizationHeaders.push(request.headers.authorization)
+      writeJson(response, 200, { ok: true })
+      return
     }
-    response.writeHead(200, { 'content-type': 'application/json' })
-    response.end(JSON.stringify(body))
+    if (request.method === 'POST' && requestUrl.pathname === '/control/shutdown') {
+      if (request.headers.authorization !== `Bearer ${token}`) {
+        writeJson(response, 403, { error: { message: 'forbidden' } })
+        return
+      }
+      shutdownCount += 1
+      writeJson(response, 200, { ok: true, status: 'shutting_down', pid: process.pid })
+      setImmediate(() => {
+        void closeServer()
+      })
+      return
+    }
+    writeJson(response, 404, { error: { message: 'not found' } })
   })
   await new Promise((resolve, reject) => {
     server.once('error', reject)
-    server.listen(0, '127.0.0.1', resolve)
+    server.listen(Number(url.port), url.hostname, resolve)
   })
   return {
-    get url() {
-      return `http://127.0.0.1:${server.address().port}`
-    },
-    get jobRequests() {
-      return jobRequests
+    pid: process.pid,
+    get shutdownCount() {
+      return shutdownCount
     },
-    listening() {
-      return server.listening
+    get readyAuthorizationHeaders() {
+      return readyAuthorizationHeaders
     },
-    close() {
-      return new Promise((resolve) => server.close(resolve))
+    get jobAuthorizationHeaders() {
+      return jobAuthorizationHeaders
     },
+    close: closeServer,
   }
-}
-
-async function startChildStaleDaemon({
-  homeDir,
-  token,
-  daemonUrl,
-  includeProcessProof,
-  runningBinaryHash = 'f'.repeat(64),
-  version = '0.0.0-stale',
-}) {
-  const entry = path.join(homeDir, 'stale-daemon.mjs')
-  const jobRequestsPath = path.join(homeDir, 'stale-daemon-job-requests.txt')
-  fs.writeFileSync(entry, `
-import { createHmac } from 'node:crypto'
-import fs from 'node:fs'
-import http from 'node:http'
 
-const homeDir = ${JSON.stringify(homeDir)}
-const token = ${JSON.stringify(token)}
-const daemonUrl = new URL(${JSON.stringify(daemonUrl)})
-const instanceId = 'BBBBBBBBBBBBBBBBBBBBBB'
-const includeProcessProof = ${JSON.stringify(includeProcessProof)}
-const runningBinaryHash = ${JSON.stringify(runningBinaryHash)}
-const jobRequestsPath = ${JSON.stringify(jobRequestsPath)}
-const server = http.createServer((request, response) => {
-  if (request.url?.startsWith('/jobs')) {
-    fs.appendFileSync(jobRequestsPath, '1\\n')
-  }
-  if (!request.url?.startsWith('/ready')) {
-    response.writeHead(404, { 'content-type': 'application/json' })
-    response.end(JSON.stringify({ error: 'not found' }))
-    return
+  function closeServer() {
+    if (closed) return Promise.resolve()
+    closed = true
+    return new Promise((resolve) => server.close(() => resolve()))
   }
-  const url = new URL(request.url, 'http://127.0.0.1')
-  const challenge = url.searchParams.get('challenge') ?? ''
-  const body = {
-    protocol: 'tokenless.daemon.v1',
-    daemon_protocol: 'tokenless.daemon.v1',
-    version: ${JSON.stringify(version)},
-    native_protocol: 'tokenless.native.v1',
-    status: 'ok',
-    ready: true,
-    home_dir: homeDir,
-    ready_proof_protocol: 'tokenless.daemon-ready-proof.v1',
-    ready_challenge: challenge,
-    ready_proof: hmac([
-      'tokenless.daemon-ready-proof.v1',
-      challenge,
-      'tokenless.daemon.v1',
-      'tokenless.native.v1',
-      homeDir,
-    ]),
-    ...(includeProcessProof ? {
-      pid: process.pid,
-      instance_id: instanceId,
-      running_binary_hash: runningBinaryHash,
-      daemon_process_proof_protocol: 'tokenless.daemon-process-proof.v1',
-      daemon_process_proof: hmac([
-        'tokenless.daemon-process-proof.v1',
-        challenge,
-        'tokenless.daemon.v1',
-        'tokenless.native.v1',
-        homeDir,
-        String(process.pid),
-        instanceId,
-        runningBinaryHash,
-      ]),
-    } : {}),
-  }
-  response.writeHead(200, { 'content-type': 'application/json' })
-  response.end(JSON.stringify(body))
-})
-server.listen(Number(daemonUrl.port), daemonUrl.hostname, () => {
-  process.stdout.write('ready\\n')
-})
-process.once('SIGTERM', () => server.close(() => process.exit(0)))
-
-function hmac(fields) {
-  return createHmac('sha256', token).update(lengthPrefixed(fields)).digest('base64url')
 }
 
-function lengthPrefixed(fields) {
-  return Buffer.concat(fields.flatMap((field) => {
-    const value = Buffer.from(field, 'utf8')
-    const length = Buffer.allocUnsafe(4)
-    length.writeUInt32BE(value.length)
-    return [length, value]
-  }))
-}
-`, { mode: 0o700 })
-  const child = spawn(process.execPath, [entry], {
-    cwd: root,
-    stdio: ['ignore', 'pipe', 'pipe'],
+async function startForeignListener(daemonUrl) {
+  const url = new URL(daemonUrl)
+  let closed = false
+  const server = http.createServer((_request, response) => {
+    writeJson(response, 200, { ok: true, service: 'foreign' })
   })
-  child.stdout.setEncoding('utf8')
-  child.stderr.setEncoding('utf8')
-  let stdout = ''
-  let stderr = ''
-  child.stdout.on('data', (chunk) => { stdout += chunk })
-  child.stderr.on('data', (chunk) => { stderr += chunk })
   await new Promise((resolve, reject) => {
-    const timer = setTimeout(() => reject(new Error(`Timed out waiting for stale daemon.\n${stdout}\n${stderr}`)), 5000)
-    child.once('error', (error) => {
-      clearTimeout(timer)
-      reject(error)
-    })
-    child.stdout.on('data', () => {
-      if (!stdout.includes('ready')) return
-      clearTimeout(timer)
-      resolve()
-    })
-    child.once('exit', (code) => {
-      clearTimeout(timer)
-      reject(new Error(`Stale daemon exited early with ${code}.\n${stdout}\n${stderr}`))
-    })
+    server.once('error', reject)
+    server.listen(Number(url.port), url.hostname, resolve)
   })
   return {
-    child,
-    pid: child.pid,
-    url: daemonUrl,
-    jobRequests() {
-      try {
-        return fs.readFileSync(jobRequestsPath, 'utf8').trim().split('\\n').filter(Boolean).length
-      } catch {
-        return 0
-      }
+    close() {
+      if (closed) return Promise.resolve()
+      closed = true
+      return new Promise((resolve) => server.close(() => resolve()))
     },
   }
 }
 
-function writeSpawnedBadDaemon({
-  homeDir,
-  childPidPath,
-  version,
-  runningBinaryHash,
-}) {
-  const entry = path.join(homeDir, 'spawned-bad-daemon.mjs')
-  fs.writeFileSync(entry, `#!/usr/bin/env node
-import { createHmac } from 'node:crypto'
-import fs from 'node:fs'
-import http from 'node:http'
+function readPersistedRuntimeOrigin(homeDir) {
+  const row = readRuntimeStateRow(homeDir)
+  assert.equal(row?.state, 'running')
+  return row.origin
+}
 
-const args = process.argv.slice(2)
-const valueAfter = (flag) => args[args.indexOf(flag) + 1]
-const homeDir = valueAfter('--home')
-const host = valueAfter('--host')
-const port = Number(valueAfter('--port'))
-const token = fs.readFileSync(\`\${homeDir.replace(/\\/$/, '')}/daemon.token\`, 'utf8').trim()
-const version = ${JSON.stringify(version)}
-const runningBinaryHash = ${JSON.stringify(runningBinaryHash)}
-const instanceId = 'CCCCCCCCCCCCCCCCCCCCCC'
-const childPidPath = ${JSON.stringify(childPidPath)}
-
-const server = http.createServer((request, response) => {
-  if (!request.url?.startsWith('/ready')) {
-    response.writeHead(404, { 'content-type': 'application/json' })
-    response.end(JSON.stringify({ error: 'not found' }))
-    return
+function readPersistedRuntimeEndpoint(homeDir) {
+  const row = readRuntimeStateRow(homeDir)
+  assert.equal(row?.state, 'running')
+  return {
+    origin: row.origin,
+    pid: row.pid,
   }
-  const url = new URL(request.url, 'http://127.0.0.1')
-  const challenge = url.searchParams.get('challenge') ?? ''
-  const body = {
-    protocol: 'tokenless.daemon.v1',
-    daemon_protocol: 'tokenless.daemon.v1',
-    version,
-    native_protocol: 'tokenless.native.v1',
-    status: 'ok',
-    ready: true,
-    home_dir: homeDir,
-    pid: process.pid,
-    instance_id: instanceId,
-    running_binary_hash: runningBinaryHash,
-    ready_proof_protocol: 'tokenless.daemon-ready-proof.v1',
-    ready_challenge: challenge,
-    ready_proof: hmac([
-      'tokenless.daemon-ready-proof.v1',
-      challenge,
-      'tokenless.daemon.v1',
-      'tokenless.native.v1',
-      homeDir,
-    ]),
-    daemon_process_proof_protocol: 'tokenless.daemon-process-proof.v1',
-    daemon_process_proof: hmac([
-      'tokenless.daemon-process-proof.v1',
-      challenge,
-      'tokenless.daemon.v1',
-      'tokenless.native.v1',
-      homeDir,
-      String(process.pid),
-      instanceId,
-      runningBinaryHash,
-    ]),
+}
+
+function readRuntimeStateRow(homeDir) {
+  const database = new DatabaseSync(path.join(homeDir, 'tokenless.sqlite3'), { readOnly: true })
+  try {
+    const row = database.prepare(
+      `SELECT state, origin, pid
+       FROM daemon_runtime_state
+       WHERE id = 'daemon'`
+    ).get()
+    return row ?? null
+  } finally {
+    database.close()
   }
-  response.writeHead(200, { 'content-type': 'application/json' })
-  response.end(JSON.stringify(body))
-})
+}
 
-server.listen(port, host, () => {
-  fs.writeFileSync(childPidPath, String(process.pid))
-})
-process.once('SIGTERM', () => server.close(() => process.exit(0)))
+function seedStartingRuntimeState(homeDir, { generation, ownerToken, ownerPid }) {
+  fs.mkdirSync(homeDir, { recursive: true, mode: 0o700 })
+  const database = new DatabaseSync(path.join(homeDir, 'tokenless.sqlite3'))
+  try {
+    database.exec(`
+      PRAGMA journal_mode = WAL;
+      CREATE TABLE IF NOT EXISTS daemon_runtime_state (
+        id TEXT PRIMARY KEY NOT NULL CHECK (id = 'daemon'),
+        generation INTEGER NOT NULL,
+        state TEXT NOT NULL CHECK (state IN ('starting', 'running')),
+        owner_token TEXT,
+        origin TEXT,
+        pid INTEGER,
+        lease_expires_at INTEGER NOT NULL,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      );
+    `)
+    const now = new Date().toISOString()
+    database.prepare(
+      `INSERT INTO daemon_runtime_state (
+         id, generation, state, owner_token, origin, pid, lease_expires_at, created_at, updated_at
+       ) VALUES ('daemon', ?, 'starting', ?, NULL, ?, ?, ?, ?)`
+    ).run(generation, ownerToken, ownerPid, Date.now() + 60_000, now, now)
+  } finally {
+    database.close()
+  }
+}
 
-function hmac(fields) {
-  return createHmac('sha256', token).update(lengthPrefixed(fields)).digest('base64url')
+function readJobCount(homeDir) {
+  const database = new DatabaseSync(path.join(homeDir, 'tokenless.sqlite3'), { readOnly: true })
+  try {
+    const table = database.prepare(
+      `SELECT name FROM sqlite_schema WHERE type = 'table' AND name = 'jobs'`
+    ).get()
+    if (!table) return 0
+    const row = database.prepare('SELECT COUNT(*) AS count FROM jobs').get()
+    return Number(row.count)
+  } finally {
+    database.close()
+  }
 }
 
-function lengthPrefixed(fields) {
-  return Buffer.concat(fields.flatMap((field) => {
-    const value = Buffer.from(field, 'utf8')
-    const length = Buffer.allocUnsafe(4)
-    length.writeUInt32BE(value.length)
-    return [length, value]
-  }))
+function spawnDaemonEntry({
+  homeDir,
+  port,
+  startupOwnerToken,
+  startupGeneration,
+}) {
+  const args = [
+    tsDaemonEntry,
+    '--home',
+    homeDir,
+    'serve',
+    '--host',
+    '127.0.0.1',
+    '--port',
+    String(port),
+  ]
+  if (startupOwnerToken !== undefined && startupGeneration !== undefined) {
+    args.push('--startup-owner-token', startupOwnerToken, '--startup-generation', String(startupGeneration))
+  }
+  return spawn(process.execPath, args, {
+    cwd: root,
+    env: { ...process.env, TOKENLESS_HOME: homeDir },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  })
+}
+
+async function waitForReadyStatusOrExit(child, daemonUrl) {
+  const deadline = Date.now() + 5_000
+  let latest = null
+  while (Date.now() < deadline) {
+    if (child.exitCode !== null || child.signalCode !== null) {
+      return { exited: true, exit: { code: child.exitCode, signal: child.signalCode } }
+    }
+    try {
+      const response = await fetch(`${daemonUrl}/ready?challenge=${randomBytes(32).toString('base64url')}`)
+      const body = await response.json().catch(() => null)
+      latest = { exited: false, status: response.status, body }
+      if (response.status !== 404) return latest
+    } catch {
+      // The child may not have bound yet or may have already exited.
+    }
+    await new Promise((resolve) => setTimeout(resolve, 25))
+  }
+  return latest ?? { exited: false, status: null, body: null }
 }
-`, { mode: 0o700 })
-  return entry
+
+async function waitForOneReadyDaemon(candidates, homeDir) {
+  const deadline = Date.now() + 10_000
+  let latestError
+  while (Date.now() < deadline) {
+    for (const candidate of candidates) {
+      if (candidate.child.exitCode !== null || candidate.child.signalCode !== null) continue
+      try {
+        const response = await fetch(`${candidate.url}/ready?challenge=${randomBytes(32).toString('base64url')}`)
+        if (!response.ok) continue
+        const body = await response.json()
+        if (body.ready === true && body.home_dir === homeDir) {
+          return { url: candidate.url, pid: body.pid }
+        }
+      } catch (error) {
+        latestError = error
+      }
+    }
+    await new Promise((resolve) => setTimeout(resolve, 50))
+  }
+  throw new Error(`No direct daemon became ready: ${latestError?.message ?? latestError ?? 'unknown'}`)
 }
 
-function hmac(token, fields) {
-  return createHmac('sha256', token).update(lengthPrefixed(fields)).digest('base64url')
+function writeJson(response, status, body) {
+  const payload = JSON.stringify(body)
+  response.writeHead(status, {
+    'content-type': 'application/json',
+    'content-length': Buffer.byteLength(payload),
+  })
+  response.end(payload)
+}
+
+function readyProof(token, challenge, homeDir) {
+  return createHmac('sha256', token)
+    .update(lengthPrefixedMessage([
+      challenge,
+      homeDir,
+    ]))
+    .digest('base64url')
 }
 
-function lengthPrefixed(fields) {
+function lengthPrefixedMessage(fields) {
   return Buffer.concat(fields.flatMap((field) => {
     const value = Buffer.from(field, 'utf8')
     const length = Buffer.allocUnsafe(4)
@@ -694,16 +840,18 @@ function lengthPrefixed(fields) {
   }))
 }
 
-async function freePort() {
-  const server = net.createServer()
-  await new Promise((resolve, reject) => {
-    server.once('error', reject)
-    server.listen(0, '127.0.0.1', resolve)
+async function tcpReachable(daemonUrl) {
+  const url = new URL(daemonUrl)
+  return await new Promise((resolve) => {
+    const socket = net.createConnection({ host: url.hostname, port: Number(url.port) })
+    const done = (reachable) => {
+      socket.destroy()
+      resolve(reachable)
+    }
+    socket.setTimeout(500, () => done(false))
+    socket.once('connect', () => done(true))
+    socket.once('error', () => done(false))
   })
-  const address = server.address()
-  const port = address.port
-  await new Promise((resolve) => server.close(resolve))
-  return port
 }
 
 async function stopPid(pid) {
@@ -722,13 +870,36 @@ async function stopPid(pid) {
   }
 }
 
-async function processExited(child) {
-  if (child.exitCode !== null || child.signalCode !== null) return true
-  for (let index = 0; index < 50; index += 1) {
-    await new Promise((resolve) => setTimeout(resolve, 50))
-    if (child.exitCode !== null || child.signalCode !== null) return true
+async function stopChild(child) {
+  if (!child || child.exitCode !== null || child.signalCode !== null) return
+  child.kill('SIGTERM')
+  try {
+    await waitForExitResult(child, 2_000)
+  } catch {
+    child.kill('SIGKILL')
+    await waitForExitResult(child, 2_000).catch(() => undefined)
   }
-  return false
+}
+
+function waitForExit(child, timeoutMs) {
+  return waitForExitResult(child, timeoutMs).then(() => undefined)
+}
+
+function waitForExitResult(child, timeoutMs) {
+  if (child.exitCode !== null || child.signalCode !== null) {
+    return Promise.resolve({ code: child.exitCode, signal: child.signalCode })
+  }
+  return new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      child.off('exit', onExit)
+      reject(new Error(`process ${child.pid} did not exit within ${timeoutMs} ms`))
+    }, timeoutMs)
+    const onExit = (code, signal) => {
+      clearTimeout(timeout)
+      resolve({ code, signal })
+    }
+    child.once('exit', onExit)
+  })
 }
 
 async function pidExited(pid) {
@@ -748,10 +919,6 @@ function pidIsAlive(pid) {
   }
 }
 
-function fileHash(file) {
-  return createHash('sha256').update(fs.readFileSync(file)).digest('hex')
-}
-
 function snapshotTree(rootDir) {
   const entries = {}
   visit(rootDir)
@@ -771,22 +938,3 @@ function snapshotTree(rootDir) {
     }
   }
 }
-
-function writeVerifiedSkills(home) {
-  const rootDir = path.join(home, '.agents')
-  const names = ['tokenless', 'tokenless-install']
-  for (const name of names) {
-    const directory = path.join(rootDir, 'skills', name)
-    fs.mkdirSync(directory, { recursive: true })
-    fs.writeFileSync(path.join(directory, 'SKILL.md'), `---\nname: ${name}\n---\n`, 'utf8')
-  }
-  fs.writeFileSync(path.join(rootDir, '.skill-lock.json'), JSON.stringify({
-    version: 3,
-    skills: Object.fromEntries(names.map((name) => [name, {
-      source: 'jazelly/tokenless',
-      sourceType: 'github',
-      sourceUrl: 'https://github.com/jazelly/tokenless.git',
-      skillPath: `skills/${name}/SKILL.md`,
-    }])),
-  }), 'utf8')
-}
diff --git a/test/daemon-waiting-client.test.mjs b/test/daemon-waiting-client.test.mjs
deleted file mode 100644
index 86ae501..0000000
--- a/test/daemon-waiting-client.test.mjs
+++ /dev/null
@@ -1,161 +0,0 @@
-import assert from 'node:assert/strict'
-import { createHmac } from 'node:crypto'
-import fs from 'node:fs/promises'
-import http from 'node:http'
-import os from 'node:os'
-import path from 'node:path'
-import test from 'node:test'
-import { fileURLToPath, pathToFileURL } from 'node:url'
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-const cliDaemonClient = path.join(root, 'packages/cli/dist/src/daemon-client.js')
-
-test('CLI daemon wait returns waiting_for_user promptly with blocker and does not cancel', async () => {
-  const homeDir = await fs.mkdtemp(path.join(os.tmpdir(), 'tokenless-cli-waiting-'))
-  const canonicalHome = await fs.realpath(homeDir)
-  await fs.writeFile(path.join(homeDir, 'daemon.token'), 'control-token\n', { mode: 0o600 })
-  const requests = []
-  const job = daemonJob({
-    status: 'waiting_for_user',
-    blocker_json: {
-      blocker: { code: 'visible_recaptcha', kind: 'challenge', userResolvable: true },
-    },
-  })
-
-  await withReadyDaemon({ homeDir: canonicalHome, token: 'control-token', job, requests }, async (daemonUrl) => {
-    const { waitDaemonJobResult } = await import(pathToFileURL(cliDaemonClient).href)
-    const result = await waitDaemonJobResult({
-      homeDir,
-      daemonUrl,
-      jobId: job.job_id,
-      timeoutMs: 10_000,
-      pollMs: 5,
-    })
-
-    assert.equal(result.ok, null)
-    assert.equal(result.status, 'waiting_for_user')
-    assert.equal(result.blocker.blocker.code, 'visible_recaptcha')
-    assert.match(result.userAction.message, /visible managed browser is open/i)
-    assert.equal(requests.some((request) => request.method === 'POST' && request.url.includes('/cancel')), false)
-  })
-})
-
-test('headless waiting jobs expose the same-job headed resume command and authenticated resume request', async () => {
-  const homeDir = await fs.mkdtemp(path.join(os.tmpdir(), 'tokenless-cli-headless-waiting-'))
-  const canonicalHome = await fs.realpath(homeDir)
-  await fs.writeFile(path.join(homeDir, 'daemon.token'), 'control-token\n', { mode: 0o600 })
-  const requests = []
-  const job = daemonJob({
-    status: 'waiting_for_user',
-    blocker_json: {
-      blocker: { code: 'visible_recaptcha', kind: 'challenge', userResolvable: true },
-      browser: { requestedVisibility: 'headless', effectiveVisibility: 'headless', windowOpen: false },
-    },
-  })
-
-  await withReadyDaemon({ homeDir: canonicalHome, token: 'control-token', job, requests }, async (daemonUrl) => {
-    const { resumeDaemonJob, waitDaemonJobResult } = await import(pathToFileURL(cliDaemonClient).href)
-    const waiting = await waitDaemonJobResult({ homeDir, daemonUrl, jobId: job.job_id, timeoutMs: 10_000, pollMs: 5 })
-
-    assert.match(waiting.userAction.message, /no browser window is open/i)
-    assert.match(waiting.userAction.resumeCommand, /tokenless resume .*--browser-visibility headed/)
-
-    const resumed = await resumeDaemonJob({
-      homeDir,
-      daemonUrl,
-      jobId: job.job_id,
-      browserVisibility: 'headed',
-    })
-    assert.equal(resumed.status, 'queued')
-    const request = requests.find((candidate) => candidate.url.endsWith('/resume'))
-    assert.deepEqual(request.body, { browser_visibility: 'headed' })
-    assert.equal(request.authorization, 'Bearer control-token')
-  })
-})
-
-function daemonJob(overrides = {}) {
-  return {
-    job_id: 'job-waiting',
-    execution_backend: 'playwright',
-    profile_id: 'profile-a',
-    provider: 'chatgpt',
-    action: 'visible_provider_actions',
-    status: 'queued',
-    request_json: { taskId: 'task-waiting' },
-    result_json: null,
-    error_json: null,
-    blocker_json: null,
-    created_at: '2026-07-18T00:00:00.000Z',
-    updated_at: '2026-07-18T00:00:00.000Z',
-    ...overrides,
-  }
-}
-
-async function withReadyDaemon({ homeDir, token, job, requests }, callback) {
-  const server = http.createServer(async (request, response) => {
-    const body = request.method === 'POST' ? await readJsonBody(request) : undefined
-    requests.push({
-      method: request.method,
-      url: request.url,
-      body,
-      authorization: request.headers.authorization,
-    })
-    if (request.url?.startsWith('/ready?')) {
-      const challenge = new URL(request.url, 'http://127.0.0.1').searchParams.get('challenge')
-      const body = {
-        protocol: 'tokenless.daemon.v1',
-        daemon_protocol: 'tokenless.daemon.v1',
-        version: '0.1.2',
-        native_protocol: 'tokenless.native.v1',
-        status: 'ok',
-        ready: true,
-        home_dir: homeDir,
-        ready_proof_protocol: 'tokenless.daemon-ready-proof.v1',
-        ready_challenge: challenge,
-      }
-      body.ready_proof = createHmac('sha256', token)
-        .update(daemonReadyProofMessage([
-          body.ready_proof_protocol,
-          challenge,
-          body.daemon_protocol,
-          body.native_protocol,
-          body.home_dir,
-        ]))
-        .digest('base64url')
-      return respondJson(response, 200, body)
-    }
-    if (request.url === `/jobs/${encodeURIComponent(job.job_id)}` && request.method === 'GET') {
-      return respondJson(response, 200, job)
-    }
-    if (request.url === `/jobs/${encodeURIComponent(job.job_id)}/resume` && request.method === 'POST') {
-      return respondJson(response, 200, { ...job, status: 'queued' })
-    }
-    respondJson(response, 404, { error: { message: 'not found' } })
-  })
-  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve))
-  try {
-    await callback(`http://127.0.0.1:${server.address().port}`)
-  } finally {
-    await new Promise((resolve) => server.close(resolve))
-  }
-}
-
-async function readJsonBody(request) {
-  const chunks = []
-  for await (const chunk of request) chunks.push(chunk)
-  return chunks.length === 0 ? undefined : JSON.parse(Buffer.concat(chunks).toString('utf8'))
-}
-
-function daemonReadyProofMessage(fields) {
-  return Buffer.concat(fields.flatMap((field) => {
-    const value = Buffer.from(String(field), 'utf8')
-    const length = Buffer.allocUnsafe(4)
-    length.writeUInt32BE(value.length)
-    return [length, value]
-  }))
-}
-
-function respondJson(response, status, body) {
-  response.writeHead(status, { 'content-type': 'application/json' })
-  response.end(JSON.stringify(body))
-}
diff --git a/test/fixtures/chatgpt-real-dom-fixture.html b/test/fixtures/chatgpt-real-dom-fixture.html
deleted file mode 100644
index 16d35a9..0000000
--- a/test/fixtures/chatgpt-real-dom-fixture.html
+++ /dev/null
@@ -1,383 +0,0 @@
-<!doctype html>
-<html lang="en-US" data-build="prod-real-dom-fixture" data-contrast="default" dir="ltr" class="light" style="color-scheme: light;">
-  <head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
-    <meta name="text-scale" content="scale">
-    <title>ChatGPT</title>
-    <meta property="og:title" content="ChatGPT">
-    <meta property="og:url" content="https://chatgpt.com/">
-    <meta property="og:site_name" content="ChatGPT">
-    <meta name="description" content="ChatGPT is your AI chatbot for everyday use.">
-    <style>
-      :root {
-        color-scheme: light;
-        --main-surface-primary: #ffffff;
-        --main-surface-secondary: #f9f9f9;
-        --text-primary: #0d0d0d;
-        --text-secondary: #5d5d5d;
-        --border-light: #e3e3e3;
-        font-family: ui-sans-serif, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
-      }
-
-      body {
-        margin: 0;
-        min-height: 100vh;
-        background: var(--main-surface-primary);
-        color: var(--text-primary);
-      }
-
-      #root {
-        min-height: 100vh;
-      }
-
-      .relative.flex.h-full.w-full.overflow-hidden {
-        min-height: 100vh;
-        display: flex;
-      }
-
-      .draggable.no-draggable-children {
-        width: 260px;
-        background: #f7f7f7;
-        border-right: 1px solid var(--border-light);
-        padding: 12px;
-        box-sizing: border-box;
-      }
-
-      main {
-        flex: 1;
-        min-width: 0;
-        display: flex;
-        flex-direction: column;
-      }
-
-      header {
-        height: 56px;
-        display: flex;
-        align-items: center;
-        gap: 12px;
-        padding: 0 20px;
-        border-bottom: 1px solid var(--border-light);
-      }
-
-      [data-testid="conversation-panel"] {
-        flex: 1;
-        overflow: auto;
-        padding: 24px 0 172px;
-      }
-
-      article[data-testid*="conversation-turn"] {
-        width: min(768px, calc(100vw - 320px));
-        margin: 0 auto;
-        padding: 18px 0;
-        display: grid;
-        grid-template-columns: 36px 1fr;
-        gap: 14px;
-      }
-
-      [data-message-author-role="assistant"] .avatar {
-        background: #10a37f;
-      }
-
-      [data-message-author-role="user"] .avatar {
-        background: #ececec;
-        color: #0d0d0d;
-      }
-
-      .avatar {
-        width: 28px;
-        height: 28px;
-        border-radius: 999px;
-        display: grid;
-        place-items: center;
-        color: white;
-        font-size: 12px;
-        font-weight: 700;
-      }
-
-      .markdown {
-        line-height: 1.6;
-        white-space: pre-wrap;
-      }
-
-      .composer-parent {
-        position: fixed;
-        left: 260px;
-        right: 0;
-        bottom: 0;
-        padding: 20px 24px 28px;
-        background: linear-gradient(to top, var(--main-surface-primary) 74%, rgba(255,255,255,0));
-      }
-
-      form[data-testid="composer"] {
-        width: min(768px, calc(100vw - 320px));
-        margin: 0 auto;
-        border: 1px solid #d7d7d7;
-        border-radius: 28px;
-        background: var(--main-surface-primary);
-        box-shadow: 0 8px 22px rgba(0,0,0,.06);
-        display: grid;
-        grid-template-columns: 1fr 42px;
-        align-items: end;
-        gap: 10px;
-        padding: 10px;
-      }
-
-      #prompt-textarea.ProseMirror {
-        min-height: 24px;
-        max-height: 180px;
-        overflow-y: auto;
-        outline: none;
-        padding: 9px 12px;
-        line-height: 1.5;
-      }
-
-      #prompt-textarea:empty::before {
-        content: attr(data-placeholder);
-        color: #8f8f8f;
-      }
-
-      button[data-testid="composer-send-button"] {
-        width: 36px;
-        height: 36px;
-        border-radius: 999px;
-        border: 0;
-        background: #0d0d0d;
-        color: white;
-        cursor: pointer;
-      }
-
-      button[data-testid="composer-send-button"][disabled],
-      button[data-testid="composer-send-button"][aria-disabled="true"] {
-        opacity: .35;
-        cursor: default;
-      }
-
-      button[data-testid="stop-button"] {
-        position: fixed;
-        right: 32px;
-        bottom: 100px;
-      }
-
-      .sr-only {
-        position: absolute;
-        width: 1px;
-        height: 1px;
-        overflow: hidden;
-        clip: rect(0, 0, 0, 0);
-      }
-    </style>
-  </head>
-  <body>
-    <div id="root">
-      <div class="relative flex h-full w-full overflow-hidden">
-        <aside class="draggable no-draggable-children">
-          <nav aria-label="Chat history">
-            <button aria-label="New chat">New chat</button>
-            <ol>
-              <li><a href="/c/stale-fixture-conversation">Earlier Tokenless selector check</a></li>
-            </ol>
-          </nav>
-        </aside>
-        <main>
-          <header>
-            <button aria-label="Open sidebar">☰</button>
-            <div>ChatGPT</div>
-          </header>
-          <div role="banner" data-testid="chat-surface">
-            <button type="button" role="radio" aria-checked="true" data-state="on">Chat</button>
-            <button type="button" role="radio" aria-checked="false" data-state="off">Work</button>
-          </div>
-          <div data-testid="conversation-panel">
-            <article data-testid="conversation-turn-1" data-message-author-role="user">
-              <div class="avatar">U</div>
-              <div>
-                <div class="sr-only">You said:</div>
-                <div class="whitespace-pre-wrap">Earlier real-DOM fixture prompt</div>
-              </div>
-            </article>
-            <article data-testid="conversation-turn-2" data-message-author-role="assistant">
-              <div class="avatar">AI</div>
-              <div>
-                <div class="sr-only">ChatGPT said:</div>
-                <div class="markdown prose">stale ChatGPT real-DOM fixture answer that must not be read</div>
-              </div>
-            </article>
-          </div>
-          <div class="composer-parent">
-            <form data-testid="composer" aria-label="Message composer">
-              <button id="intelligence-control" type="button" aria-expanded="false" aria-haspopup="menu">Medium</button>
-              <div
-                id="prompt-textarea"
-                class="ProseMirror"
-                data-id="root"
-                contenteditable="true"
-                role="textbox"
-                aria-label="Message ChatGPT"
-                data-placeholder="Ask anything"
-              ></div>
-              <button
-                type="submit"
-                data-testid="composer-send-button"
-                aria-label="Send message"
-                aria-disabled="true"
-                disabled
-              >↑</button>
-            </form>
-          </div>
-        </main>
-      </div>
-    </div>
-    <script>
-      const composer = document.querySelector('[data-testid="composer"] [contenteditable="true"]')
-      const form = document.querySelector('[data-testid="composer"]')
-      const send = document.querySelector('[data-testid="composer-send-button"]')
-      const conversation = document.querySelector('[data-testid="conversation-panel"]')
-      const intelligence = document.querySelector('#intelligence-control')
-      const surfaceRadios = [...document.querySelectorAll('[role="banner"] [role="radio"]')]
-      const effortLabels = ['Instant', 'Medium', 'High', 'Extra High', 'Pro']
-      let selectedModel = 'GPT-5.6 Sol'
-      let selectedEffort = 1
-
-      surfaceRadios.forEach((radio, selectedIndex) => radio.addEventListener('click', () => {
-        surfaceRadios.forEach((candidate, index) => {
-          const selected = index === selectedIndex
-          candidate.setAttribute('aria-checked', String(selected))
-          candidate.setAttribute('data-state', selected ? 'on' : 'off')
-        })
-      }))
-
-      function dismissIntelligenceMenus() {
-        document.querySelectorAll('[role="menu"]').forEach((menu) => menu.remove())
-        intelligence.setAttribute('aria-expanded', 'false')
-      }
-
-      function updateIntelligenceTrigger() {
-        intelligence.textContent = selectedModel === 'GPT-5.6 Sol'
-          ? effortLabels[selectedEffort]
-          : selectedModel.replace('GPT-', '') + ' ' + effortLabels[selectedEffort]
-      }
-
-      function createModelMenu(parentMenu) {
-        const menu = document.createElement('div')
-        menu.setAttribute('role', 'menu')
-        menu.style.cssText = 'position:fixed;left:620px;bottom:96px;z-index:20;background:#fff;border:1px solid #ddd;padding:8px;display:grid;gap:4px'
-        for (const model of ['GPT-5.6 Sol', 'GPT-5.5', 'GPT-5.4', 'GPT-5.3', 'o3']) {
-          const item = document.createElement('button')
-          item.type = 'button'
-          item.setAttribute('role', 'menuitemradio')
-          item.setAttribute('aria-checked', String(model === selectedModel))
-          item.textContent = model
-          item.addEventListener('click', () => {
-            selectedModel = model
-            dismissIntelligenceMenus()
-            updateIntelligenceTrigger()
-          })
-          menu.append(item)
-        }
-        document.body.append(menu)
-      }
-
-      function createIntelligenceMenu() {
-        dismissIntelligenceMenus()
-        intelligence.setAttribute('aria-expanded', 'true')
-        const menu = document.createElement('div')
-        menu.setAttribute('role', 'menu')
-        menu.setAttribute('aria-labelledby', intelligence.id)
-        menu.style.cssText = 'position:fixed;left:380px;bottom:96px;z-index:20;background:#fff;border:1px solid #ddd;padding:8px;display:grid;gap:4px'
-        effortLabels.forEach((label, index) => {
-          const item = document.createElement('button')
-          item.type = 'button'
-          item.setAttribute('role', 'menuitemradio')
-          item.setAttribute('aria-checked', String(index === selectedEffort))
-          item.textContent = label
-          item.addEventListener('click', () => {
-            selectedEffort = index
-            dismissIntelligenceMenus()
-            updateIntelligenceTrigger()
-          })
-          menu.append(item)
-        })
-        const submenu = document.createElement('button')
-        submenu.type = 'button'
-        submenu.setAttribute('role', 'menuitem')
-        submenu.setAttribute('aria-haspopup', 'menu')
-        submenu.textContent = selectedModel
-        submenu.addEventListener('click', () => createModelMenu(menu))
-        menu.append(submenu)
-        document.body.append(menu)
-      }
-
-      intelligence.addEventListener('click', createIntelligenceMenu)
-      document.addEventListener('keydown', (event) => {
-        if (event.key === 'Escape') dismissIntelligenceMenus()
-      })
-      updateIntelligenceTrigger()
-
-      composer.addEventListener('input', () => {
-        const hasPrompt = textOf(composer).trim().length > 0
-        send.disabled = !hasPrompt
-        send.setAttribute('aria-disabled', String(!hasPrompt))
-      })
-
-      form.addEventListener('submit', (event) => {
-        event.preventDefault()
-        if (send.disabled || send.getAttribute('aria-disabled') === 'true') return
-
-        const prompt = textOf(composer)
-        conversation.append(message('user', prompt))
-        composer.textContent = ''
-        send.disabled = true
-        send.setAttribute('aria-disabled', 'true')
-
-        const stop = document.createElement('button')
-        stop.dataset.testid = 'stop-button'
-        stop.setAttribute('aria-label', 'Stop generating')
-        stop.textContent = 'Stop generating'
-        document.body.append(stop)
-
-        setTimeout(() => {
-          const assistant = message('assistant', 'visible ChatGPT real-DOM fixture answer_streaming for: ' + prompt)
-          conversation.append(assistant)
-          setTimeout(() => {
-            const content = assistant.querySelector('.markdown')
-            content.textContent = 'visible ChatGPT real-DOM fixture answer for: ' + prompt
-            const citation = document.createElement('a')
-            citation.href = 'https://example.com/tokenless-fixture-source?utm_source=chatgpt.com&keep=fixture#citation'
-            citation.textContent = 'Fixture citation'
-            content.append(' ', citation)
-            stop.remove()
-            history.replaceState(null, '', '/c/123e4567-e89b-12d3-a456-426614174006')
-          }, 900)
-        }, 120)
-      })
-
-      function message(role, text) {
-        const article = document.createElement('article')
-        article.dataset.testid = 'conversation-turn-' + crypto.randomUUID()
-        article.dataset.messageAuthorRole = role
-
-        const avatar = document.createElement('div')
-        avatar.className = 'avatar'
-        avatar.textContent = role === 'assistant' ? 'AI' : 'U'
-
-        const body = document.createElement('div')
-        const label = document.createElement('div')
-        label.className = 'sr-only'
-        label.textContent = role === 'assistant' ? 'ChatGPT said:' : 'You said:'
-
-        const content = document.createElement('div')
-        content.className = role === 'assistant' ? 'markdown prose' : 'whitespace-pre-wrap'
-        content.textContent = text
-
-        body.append(label, content)
-        article.append(avatar, body)
-        return article
-      }
-
-      function textOf(node) {
-        return node.innerText || node.textContent || ''
-      }
-    </script>
-  </body>
-</html>
diff --git a/test/fixtures/claude-real-dom-fixture.html b/test/fixtures/claude-real-dom-fixture.html
deleted file mode 100644
index 66764dd..0000000
--- a/test/fixtures/claude-real-dom-fixture.html
+++ /dev/null
@@ -1,314 +0,0 @@
-<!--
-  Provenance: the static DOM in this redacted, reduced fixture was captured from the
-  public SSR app shell served by https://claude.ai/new on 2026-07-15. The inline
-  behavior script is a deterministic Tokenless test shim; it is not provider JavaScript.
--->
-<!doctype html>
-<html lang="en" dir="ltr">
-  <head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1">
-    <title>Claude</title>
-    <style>
-      :root {
-        color-scheme: light;
-        font-family: ui-sans-serif, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
-        color: #2f2f2b;
-        background: #f7f6f2;
-      }
-
-      * {
-        box-sizing: border-box;
-      }
-
-      body {
-        margin: 0;
-        min-height: 100vh;
-      }
-
-      #app {
-        min-height: 100vh;
-        display: grid;
-        grid-template-columns: 248px minmax(0, 1fr);
-      }
-
-      aside {
-        padding: 18px;
-        border-right: 1px solid #deddd8;
-        background: #efeee9;
-      }
-
-      nav {
-        display: grid;
-        gap: 10px;
-      }
-
-      nav a {
-        color: #3e3e39;
-        text-decoration: none;
-        padding: 10px 12px;
-        border-radius: 8px;
-      }
-
-      main {
-        min-width: 0;
-        min-height: 100vh;
-        display: flex;
-        flex-direction: column;
-      }
-
-      header {
-        height: 58px;
-        display: flex;
-        align-items: center;
-        padding: 0 24px;
-        border-bottom: 1px solid #e4e2dc;
-        background: #faf9f6;
-        font-weight: 600;
-      }
-
-      [data-testid="virtual-message-list"] {
-        width: min(800px, calc(100vw - 312px));
-        margin: 0 auto;
-        flex: 1;
-        padding: 36px 12px 190px;
-        overflow-y: auto;
-      }
-
-      .message-row {
-        margin: 0 0 24px;
-        line-height: 1.6;
-      }
-
-      .message-row[data-role="user"] {
-        width: fit-content;
-        max-width: 78%;
-        margin-left: auto;
-        padding: 10px 14px;
-        border-radius: 16px;
-        background: #e9e7e1;
-        white-space: pre-wrap;
-      }
-
-      .message-row[data-role="assistant"] {
-        max-width: 100%;
-      }
-
-      .font-claude-response-body {
-        white-space: pre-wrap;
-      }
-
-      .composer-shell {
-        position: fixed;
-        left: 248px;
-        right: 0;
-        bottom: 0;
-        padding: 26px 24px 30px;
-        background: linear-gradient(to top, #f7f6f2 78%, rgba(247, 246, 242, 0));
-      }
-
-      .composer {
-        width: min(800px, calc(100vw - 312px));
-        min-height: 104px;
-        margin: 0 auto;
-        padding: 14px;
-        display: grid;
-        grid-template-columns: 42px minmax(0, 1fr) 42px;
-        align-items: end;
-        gap: 10px;
-        border: 1px solid #d4d1ca;
-        border-radius: 22px;
-        background: #ffffff;
-        box-shadow: 0 8px 24px rgba(36, 35, 31, 0.08);
-      }
-
-      [data-testid="chat-input"] {
-        min-height: 48px;
-        max-height: 150px;
-        padding: 10px 4px;
-        overflow-y: auto;
-        outline: none;
-        line-height: 1.5;
-      }
-
-      [data-testid="chat-input"] p {
-        margin: 0;
-      }
-
-      [data-testid="chat-input"] p:only-child:has(br)::before {
-        content: attr(data-placeholder);
-        color: #8c8a83;
-      }
-
-      button[data-cds="Button"] {
-        width: 38px;
-        height: 38px;
-        border: 1px solid #d8d5ce;
-        border-radius: 999px;
-        background: #f8f7f4;
-        color: #34332f;
-        cursor: pointer;
-      }
-
-      button[aria-label="Send message"] {
-        border-color: #c96442;
-        background: #c96442;
-        color: #fff;
-      }
-
-      button[aria-label="Send message"][disabled] {
-        border-color: #d8d5ce;
-        background: #ddd9d1;
-        color: #8d8a82;
-        cursor: default;
-      }
-
-      .sr-only {
-        position: absolute;
-        width: 1px;
-        height: 1px;
-        padding: 0;
-        margin: -1px;
-        overflow: hidden;
-        clip: rect(0, 0, 0, 0);
-        white-space: nowrap;
-        border: 0;
-      }
-    </style>
-  </head>
-  <body>
-    <div id="app">
-      <aside>
-        <nav aria-label="Primary navigation">
-          <a href="/new">New chat</a>
-          <a href="/projects" aria-label="Projects">Projects</a>
-        </nav>
-      </aside>
-      <main>
-        <header>Claude</header>
-        <div data-testid="virtual-message-list" aria-live="polite">
-          <div class="message-row" data-role="user">
-            Earlier redacted fixture prompt
-          </div>
-          <div class="message-row" data-role="assistant">
-            <div class="sr-only">Claude said:</div>
-            <div class="font-claude-response-body">stale Claude real-DOM fixture answer that must not be read</div>
-          </div>
-        </div>
-        <div class="composer-shell">
-          <div class="composer" aria-label="Message composer">
-            <input
-              id="chat-input-file-upload-onpage"
-              data-testid="file-upload"
-              aria-hidden="true"
-              tabindex="-1"
-              accept=".pdf,.doc,.docx,.txt,.md,.rtf,.csv,.json,.xml,.html,.png,.jpg,.jpeg,.gif,.webp"
-              multiple
-              aria-label="Upload files"
-              type="file"
-              hidden
-            >
-            <button
-              type="button"
-              aria-label="Add files, connectors, and more"
-              aria-haspopup="menu"
-              aria-expanded="false"
-              data-cds="Button"
-            >+</button>
-            <div
-              contenteditable="true"
-              role="textbox"
-              enterkeyhint="enter"
-              data-testid="chat-input"
-              aria-label="Write your prompt to Claude"
-              aria-multiline="true"
-              class="tiptap ProseMirror ProseMirror-focused"
-            ><p data-placeholder="How can I help you today?"><br></p></div>
-            <button
-              type="button"
-              disabled
-              data-cds="Button"
-              aria-label="Send message"
-              data-trigger-disabled
-            >↑</button>
-          </div>
-        </div>
-      </main>
-    </div>
-    <script>
-      const input = document.querySelector('[data-testid="chat-input"]')
-      const send = document.querySelector('button[aria-label="Send message"]')
-      const messageList = document.querySelector('[data-testid="virtual-message-list"]')
-      let messageNumber = 0
-
-      input.addEventListener('input', updateSendState)
-      input.addEventListener('keydown', (event) => {
-        if (event.key === 'Enter' && !event.shiftKey) {
-          event.preventDefault()
-          send.click()
-        }
-      })
-
-      send.addEventListener('click', () => {
-        const prompt = textOf(input).trim()
-        if (send.disabled || !prompt) return
-
-        messageList.append(createMessage('user', prompt))
-
-        const assistant = createMessage(
-          'assistant',
-          'visible Claude real-DOM fixture answer_streaming for: ' + prompt
-        )
-        const response = assistant.querySelector('.font-claude-response-body')
-        response.setAttribute('data-is-streaming', 'true')
-        messageList.append(assistant)
-
-        input.innerHTML = '<p data-placeholder="How can I help you today?"><br></p>'
-        updateSendState()
-
-        setTimeout(() => {
-          response.textContent = 'visible Claude real-DOM fixture answer for: ' + prompt
-          response.removeAttribute('data-is-streaming')
-          history.replaceState(null, '', '/chat/123e4567-e89b-12d3-a456-426614174001')
-        }, 650)
-      })
-
-      function createMessage(role, text) {
-        messageNumber += 1
-        const row = document.createElement('div')
-        row.className = 'message-row'
-        row.dataset.role = role
-        row.dataset.fixtureMessage = String(messageNumber)
-
-        if (role === 'assistant') {
-          const label = document.createElement('div')
-          label.className = 'sr-only'
-          label.textContent = 'Claude said:'
-
-          const response = document.createElement('div')
-          response.className = 'font-claude-response-body'
-          response.textContent = text
-          row.append(label, response)
-        } else {
-          row.textContent = text
-        }
-
-        return row
-      }
-
-      function updateSendState() {
-        const disabled = textOf(input).trim().length === 0
-        send.disabled = disabled
-        if (disabled) {
-          send.setAttribute('data-trigger-disabled', '')
-        } else {
-          send.removeAttribute('data-trigger-disabled')
-        }
-      }
-
-      function textOf(node) {
-        return node.innerText || node.textContent || ''
-      }
-    </script>
-  </body>
-</html>
diff --git a/test/fixtures/gemini-real-dom-fixture.html b/test/fixtures/gemini-real-dom-fixture.html
deleted file mode 100644
index 0a31022..0000000
--- a/test/fixtures/gemini-real-dom-fixture.html
+++ /dev/null
@@ -1,426 +0,0 @@
-<!--
-  Provenance: this redacted, reduced fixture merges the visible DOM captured from
-  https://gemini.google.com/app and the assistant-response DOM observed on a public
-  Gemini share page on 2026-07-15. The inline behavior script is a deterministic
-  Tokenless test shim; it is not provider JavaScript.
--->
-<!doctype html>
-<html lang="en" dir="ltr">
-  <head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1">
-    <title>Gemini</title>
-    <style>
-      :root {
-        color-scheme: light;
-        font-family: Arial, sans-serif;
-        color: #1f1f1f;
-        background: #fff;
-      }
-
-      * {
-        box-sizing: border-box;
-      }
-
-      body {
-        margin: 0;
-        min-height: 100vh;
-      }
-
-      bard-sidenav-container {
-        min-height: 100vh;
-        display: grid;
-        grid-template-columns: 236px minmax(0, 1fr);
-      }
-
-      aside {
-        padding: 18px;
-        background: #f0f4f9;
-      }
-
-      aside a,
-      aside button {
-        display: block;
-        margin-bottom: 14px;
-      }
-
-      main {
-        min-width: 0;
-        min-height: 100vh;
-        display: flex;
-        flex-direction: column;
-      }
-
-      header {
-        min-height: 64px;
-        display: flex;
-        align-items: center;
-        gap: 16px;
-        padding: 10px 24px;
-      }
-
-      #conversation {
-        width: min(820px, calc(100vw - 300px));
-        margin: 0 auto;
-        flex: 1;
-        padding: 32px 12px 190px;
-      }
-
-      user-query,
-      response-container,
-      structured-content-container,
-      message-content {
-        display: block;
-      }
-
-      user-query {
-        width: fit-content;
-        max-width: 78%;
-        margin: 0 0 24px auto;
-        padding: 11px 16px;
-        border-radius: 20px;
-        background: #f0f4f9;
-        white-space: pre-wrap;
-      }
-
-      response-container {
-        margin: 0 0 30px;
-        line-height: 1.6;
-      }
-
-      .markdown {
-        white-space: pre-wrap;
-      }
-
-      .input-area-container {
-        position: fixed;
-        left: 236px;
-        right: 0;
-        bottom: 0;
-        padding: 26px 24px 30px;
-        background: linear-gradient(to top, #fff 78%, rgba(255, 255, 255, 0));
-      }
-
-      [data-node-type="input-area"] {
-        width: min(820px, calc(100vw - 300px));
-        min-height: 112px;
-        margin: 0 auto;
-        padding: 13px 16px;
-        border: 1px solid #c4c7c5;
-        border-radius: 28px;
-        background: #f0f4f9;
-      }
-
-      [data-test-id="textarea-wrapper"] {
-        min-height: 54px;
-      }
-
-      .ql-editor {
-        min-height: 46px;
-        padding: 12px 4px;
-        outline: none;
-        line-height: 1.45;
-      }
-
-      .ql-editor p {
-        margin: 0;
-      }
-
-      .ql-editor.ql-blank p:only-child:has(br)::before {
-        content: attr(data-placeholder);
-        color: #6f7378;
-      }
-
-      .composer-actions {
-        display: flex;
-        align-items: center;
-        gap: 10px;
-      }
-
-      .composer-actions button {
-        min-height: 36px;
-        padding: 7px 12px;
-        border: 0;
-        border-radius: 18px;
-        background: #e1e7ef;
-        color: #1f1f1f;
-      }
-
-      .composer-actions button[aria-label="Send message"] {
-        margin-left: auto;
-        background: #0b57d0;
-        color: #fff;
-      }
-
-      button[aria-label="Stop response"] {
-        min-height: 34px;
-        margin-top: 12px;
-      }
-
-      [role="dialog"] {
-        position: fixed;
-        left: 320px;
-        top: 80px;
-        z-index: 20;
-        min-width: 300px;
-        padding: 20px;
-        border: 1px solid #c4c7c5;
-        background: #fff;
-      }
-
-      [role="menu"][data-fixture="gemini-model-menu"] {
-        position: fixed;
-        right: 80px;
-        bottom: 145px;
-        z-index: 30;
-        min-width: 280px;
-        padding: 8px;
-        border: 1px solid #c4c7c5;
-        border-radius: 16px;
-        background: #fff;
-      }
-
-      gem-menu-item[role="menuitem"] {
-        display: block;
-        padding: 10px 12px;
-        border-radius: 10px;
-        cursor: pointer;
-      }
-
-      gem-menu-item[aria-disabled="true"] {
-        opacity: .45;
-        cursor: default;
-      }
-
-      gem-menu-item .label,
-      gem-menu-item .sublabel {
-        display: block;
-      }
-
-      gem-menu-item .label {
-        font-weight: 600;
-      }
-    </style>
-  </head>
-  <body>
-    <bard-sidenav-container>
-      <aside>
-        <button type="button" aria-label="New chat">New chat</button>
-        <a
-          aria-label="Sign in"
-          href="https://accounts.google.com/ServiceLogin?service=bard"
-        >Sign in</a>
-      </aside>
-      <main>
-        <header>
-          <strong>Gemini</strong>
-          <button
-            type="button"
-            data-test-id="bard-mode-menu-button"
-            aria-label="Open mode picker, currently Flash"
-            aria-haspopup="true"
-            aria-expanded="false"
-          >Flash</button>
-        </header>
-        <section id="conversation" aria-live="polite">
-          <user-query>
-            <div class="query-text">Earlier redacted fixture prompt</div>
-          </user-query>
-          <response-container class="response-container">
-            <structured-content-container class="message-content">
-              <message-content class="ng-star-inserted">
-                <div class="markdown markdown-main-panel">
-                  stale Gemini real-DOM fixture answer that must not be read
-                </div>
-              </message-content>
-            </structured-content-container>
-          </response-container>
-        </section>
-        <div class="input-area-container">
-          <div data-node-type="input-area">
-            <div data-test-id="textarea-wrapper">
-              <rich-textarea enterkeyhint="send">
-                <div
-                  class="ql-editor ql-blank textarea new-input-ui"
-                  data-gramm="false"
-                  contenteditable="true"
-                  role="textbox"
-                  aria-multiline="true"
-                  aria-label="Enter a prompt for Gemini"
-                  data-placeholder="Ask Gemini"
-                ><p data-placeholder="Ask Gemini"><br></p></div>
-              </rich-textarea>
-            </div>
-            <div class="composer-actions">
-              <button
-                type="button"
-                aria-label="Upload &amp; tools"
-                aria-haspopup="menu"
-              >Upload &amp; tools</button>
-              <span id="send-slot"></span>
-            </div>
-          </div>
-        </div>
-      </main>
-    </bard-sidenav-container>
-    <script>
-      const input = document.querySelector('rich-textarea .ql-editor')
-      const sendSlot = document.querySelector('#send-slot')
-      const conversation = document.querySelector('#conversation')
-      const modelTrigger = document.querySelector('[data-test-id="bard-mode-menu-button"]')
-      const geminiModels = [
-        { id: 'fbb127bbb056c959', label: '3.5 Flash', shortLabel: 'Flash', sublabel: 'All-around help' },
-        { id: '5bf011840784117a', label: '3.5 Thinking', shortLabel: 'Thinking', sublabel: 'Solves complex problems' },
-        { id: '9d8ca3786ebdfbea', label: '3.1 Pro', shortLabel: 'Pro', sublabel: 'Advanced math and code' },
-      ]
-      let selectedGeminiModel = '3.5 Flash'
-      let extendedThinking = false
-
-      input.addEventListener('input', updateSendButton)
-      input.addEventListener('keydown', (event) => {
-        if (event.key === 'Enter' && !event.shiftKey) {
-          event.preventDefault()
-          sendSlot.querySelector('button[aria-label="Send message"]')?.click()
-        }
-      })
-
-      modelTrigger.addEventListener('click', () => {
-        if (modelTrigger.getAttribute('aria-expanded') === 'true') {
-          dismissGeminiModelMenu()
-        } else {
-          createGeminiModelMenu()
-        }
-      })
-      document.addEventListener('keydown', (event) => {
-        if (event.key === 'Escape') dismissGeminiModelMenu()
-      })
-
-      function enabledGeminiModels() {
-        return new Set(Array.isArray(globalThis.__fixtureGeminiEnabledModels)
-          ? globalThis.__fixtureGeminiEnabledModels
-          : ['3.5 Flash'])
-      }
-
-      function createGeminiModelMenu() {
-        dismissGeminiModelMenu()
-        modelTrigger.setAttribute('aria-expanded', 'true')
-        const menu = document.createElement('div')
-        menu.setAttribute('role', 'menu')
-        menu.dataset.fixture = 'gemini-model-menu'
-        const enabled = enabledGeminiModels()
-        for (const model of geminiModels) {
-          const item = document.createElement('gem-menu-item')
-          const selected = model.label === selectedGeminiModel
-          item.setAttribute('role', 'menuitem')
-          item.setAttribute('data-mode-id', model.id)
-          item.setAttribute('data-test-id', 'bard-mode-option-' + model.id)
-          // Gemini's live data-active marks keyboard focus, not selection.
-          item.setAttribute('data-active', String(model.label === '3.5 Flash'))
-          item.setAttribute('aria-haspopup', 'false')
-          item.setAttribute('aria-disabled', String(!enabled.has(model.label)))
-          const content = document.createElement('gem-menu-item-content')
-          if (selected) content.classList.add('selected')
-          const label = document.createElement('span')
-          label.className = 'label'
-          label.textContent = model.label
-          const sublabel = document.createElement('div')
-          sublabel.className = 'sublabel'
-          sublabel.textContent = model.sublabel
-          content.append(label, sublabel)
-          item.append(content)
-          item.addEventListener('click', () => {
-            if (item.getAttribute('aria-disabled') === 'true') return
-            selectedGeminiModel = model.label
-            modelTrigger.textContent = model.shortLabel
-            modelTrigger.setAttribute('aria-label', 'Open mode picker, currently ' + model.shortLabel)
-            dismissGeminiModelMenu()
-          })
-          menu.append(item)
-        }
-        const thinkingItem = document.createElement('gem-menu-item')
-        thinkingItem.setAttribute('role', 'menuitem')
-        thinkingItem.setAttribute('aria-disabled', 'false')
-        const thinkingContent = document.createElement('gem-menu-item-content')
-        if (extendedThinking) thinkingContent.classList.add('selected')
-        const thinkingLabel = document.createElement('span')
-        thinkingLabel.className = 'label'
-        thinkingLabel.textContent = 'Extended thinking'
-        thinkingContent.append(thinkingLabel)
-        thinkingItem.append(thinkingContent)
-        thinkingItem.addEventListener('click', () => {
-          extendedThinking = !extendedThinking
-          dismissGeminiModelMenu()
-        })
-        menu.append(thinkingItem)
-        document.body.append(menu)
-      }
-
-      function dismissGeminiModelMenu() {
-        document.querySelector('[role="menu"][data-fixture="gemini-model-menu"]')?.remove()
-        modelTrigger.setAttribute('aria-expanded', 'false')
-      }
-
-      function updateSendButton() {
-        const hasPrompt = textOf(input).trim().length > 0
-        input.classList.toggle('ql-blank', !hasPrompt)
-        const existing = sendSlot.querySelector('button[aria-label="Send message"]')
-        if (!hasPrompt) {
-          existing?.remove()
-          return
-        }
-        if (existing) return
-
-        const send = document.createElement('button')
-        send.type = 'button'
-        send.setAttribute('aria-label', 'Send message')
-        send.textContent = 'Send'
-        send.addEventListener('click', submitPrompt)
-        sendSlot.append(send)
-      }
-
-      function submitPrompt() {
-        const prompt = textOf(input).trim()
-        if (!prompt) return
-
-        const user = document.createElement('user-query')
-        const query = document.createElement('div')
-        query.className = 'query-text'
-        query.textContent = prompt
-        user.append(query)
-        conversation.append(user)
-
-        const responseContainer = document.createElement('response-container')
-        responseContainer.className = 'response-container'
-        const structured = document.createElement('structured-content-container')
-        structured.className = 'message-content'
-        const message = document.createElement('message-content')
-        message.className = 'ng-star-inserted'
-        const markdown = document.createElement('div')
-        markdown.className = 'markdown markdown-main-panel'
-        markdown.textContent = 'visible Gemini real-DOM fixture answer_streaming for: ' + prompt
-        message.append(markdown)
-        structured.append(message)
-
-        const stop = document.createElement('button')
-        stop.type = 'button'
-        stop.setAttribute('aria-label', 'Stop response')
-        stop.textContent = 'Stop response'
-        responseContainer.append(structured, stop)
-        conversation.append(responseContainer)
-
-        input.innerHTML = '<p data-placeholder="Ask Gemini"><br></p>'
-        updateSendButton()
-
-        setTimeout(() => {
-          markdown.textContent = 'visible Gemini real-DOM fixture answer for: ' + prompt
-          stop.remove()
-          history.replaceState(null, '', '/app/4b9f2c7d1e6a')
-        }, 650)
-      }
-
-      function textOf(node) {
-        return node.innerText || node.textContent || ''
-      }
-    </script>
-  </body>
-</html>
diff --git a/test/fixtures/grok-real-dom-fixture.html b/test/fixtures/grok-real-dom-fixture.html
deleted file mode 100644
index a394bca..0000000
--- a/test/fixtures/grok-real-dom-fixture.html
+++ /dev/null
@@ -1,372 +0,0 @@
-<!--
-  Provenance: this redacted, reduced fixture combines the visible composer DOM
-  observed at https://grok.com/ and assistant/user message containers observed on
-  a public Grok share page on 2026-07-15. The inline behavior script is a
-  deterministic Tokenless test shim; it is not provider JavaScript.
--->
-<!doctype html>
-<html lang="en" dir="ltr">
-  <head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1">
-    <title>Grok</title>
-    <style>
-      :root {
-        color-scheme: light;
-        font-family: Arial, sans-serif;
-        color: #141414;
-        background: #fff;
-      }
-
-      * {
-        box-sizing: border-box;
-      }
-
-      body {
-        margin: 0;
-        min-height: 100vh;
-      }
-
-      #app {
-        min-height: 100vh;
-        display: grid;
-        grid-template-columns: 232px minmax(0, 1fr);
-      }
-
-      aside {
-        padding: 18px;
-        border-right: 1px solid #e5e5e5;
-      }
-
-      aside a,
-      aside button {
-        display: block;
-        margin-bottom: 14px;
-      }
-
-      main {
-        min-width: 0;
-        min-height: 100vh;
-        display: flex;
-        flex-direction: column;
-      }
-
-      header {
-        min-height: 62px;
-        display: flex;
-        align-items: center;
-        padding: 10px 24px;
-      }
-
-      #conversation {
-        width: min(820px, calc(100vw - 300px));
-        margin: 0 auto;
-        flex: 1;
-        padding: 36px 12px 190px;
-      }
-
-      [data-testid="user-message"],
-      [data-testid="assistant-message"] {
-        display: block;
-        margin-bottom: 26px;
-        line-height: 1.6;
-      }
-
-      [data-testid="user-message"] {
-        width: fit-content;
-        max-width: 78%;
-        margin-left: auto;
-        padding: 10px 14px;
-        border-radius: 18px;
-        background: #f1f1f1;
-      }
-
-      .response-content-markdown {
-        white-space: pre-wrap;
-      }
-
-      .composer-shell {
-        position: fixed;
-        left: 232px;
-        right: 0;
-        bottom: 0;
-        padding: 26px 24px 30px;
-        background: linear-gradient(to top, #fff 78%, rgba(255, 255, 255, 0));
-      }
-
-      .composer {
-        width: min(820px, calc(100vw - 300px));
-        min-height: 108px;
-        margin: 0 auto;
-        padding: 14px;
-        display: grid;
-        grid-template-columns: 42px minmax(0, 1fr) 42px;
-        align-items: end;
-        gap: 10px;
-        border: 1px solid #d4d4d4;
-        border-radius: 22px;
-        background: #fff;
-      }
-
-      [aria-label="Ask Grok anything"] {
-        width: 100%;
-        min-height: 48px;
-        max-height: 150px;
-        padding: 10px 4px;
-        border: 0;
-        outline: none;
-        resize: none;
-        font: inherit;
-        line-height: 1.5;
-      }
-
-      .composer button {
-        width: 38px;
-        height: 38px;
-        border: 1px solid #d6d6d6;
-        border-radius: 999px;
-        background: #f4f4f4;
-      }
-
-      .composer button[data-testid="chat-submit"]:not([disabled]) {
-        background: #141414;
-        color: #fff;
-      }
-
-      [data-testid="anon-paywall-sign-up-card"] {
-        position: fixed;
-        left: 320px;
-        top: 90px;
-        z-index: 20;
-        min-width: 320px;
-        padding: 22px;
-        border: 1px solid #d4d4d4;
-        border-radius: 18px;
-        background: #fff;
-        box-shadow: 0 12px 36px rgba(0, 0, 0, 0.14);
-      }
-
-      [role="menu"][data-fixture="grok-model-menu"] {
-        position: fixed;
-        right: 78px;
-        bottom: 150px;
-        z-index: 30;
-        min-width: 250px;
-        padding: 8px;
-        border: 1px solid #d4d4d4;
-        border-radius: 16px;
-        background: #fff;
-      }
-
-      [role="menuitem"][data-radix-collection-item] {
-        display: flex;
-        flex-direction: column;
-        align-items: flex-start;
-        padding: 9px 11px;
-        border-radius: 10px;
-        cursor: pointer;
-      }
-
-      [role="menuitem"][aria-disabled="true"] {
-        opacity: .45;
-        cursor: default;
-      }
-
-      [role="menuitem"] .font-semibold {
-        font-weight: 600;
-      }
-    </style>
-  </head>
-  <body>
-    <div id="app">
-      <aside>
-        <strong>Grok</strong>
-        <a href="/">New chat</a>
-        <button type="button">Sign in</button>
-        <button type="button">Sign up</button>
-      </aside>
-      <main>
-        <header>
-          <button
-            id="model-select-trigger"
-            type="button"
-            aria-label="Model select"
-            aria-haspopup="menu"
-            aria-expanded="false"
-          >Fast</button>
-        </header>
-        <section id="conversation" aria-live="polite">
-          <div data-testid="user-message">
-            <div class="response-content-markdown markdown">Earlier redacted fixture prompt</div>
-          </div>
-          <div data-testid="assistant-message">
-            <div class="response-content-markdown markdown">
-              stale Grok real-DOM fixture answer that must not be read
-            </div>
-          </div>
-        </section>
-        <div class="composer-shell">
-          <form class="composer" aria-label="Message composer">
-            <input type="file" name="files" multiple hidden>
-            <button
-              type="button"
-              data-testid="attach-button"
-              aria-label="Attach"
-              aria-haspopup="menu"
-            >+</button>
-            <div
-              class="tiptap ProseMirror"
-              contenteditable="true"
-              role="textbox"
-              aria-label="Ask Grok anything"
-              aria-multiline="true"
-              aria-disabled="false"
-              tabindex="0"
-              translate="no"
-            ></div>
-            <button
-              type="submit"
-              data-testid="chat-submit"
-              aria-label="Submit"
-              disabled
-            >Submit</button>
-          </form>
-        </div>
-      </main>
-    </div>
-    <script>
-      const form = document.querySelector('.composer')
-      const submit = document.querySelector('button[data-testid="chat-submit"]')
-      const conversation = document.querySelector('#conversation')
-      const modelTrigger = document.querySelector('#model-select-trigger')
-      const grokModels = [
-        { label: 'Fast', sublabel: 'Quick responses' },
-        { label: 'Auto', sublabel: 'Chooses Fast or Expert' },
-        { label: 'Expert', sublabel: 'Thinks hard' },
-        { label: 'Heavy', sublabel: 'Team of Experts' },
-      ]
-      let selectedGrokModel = 'Fast'
-
-      document.addEventListener('input', (event) => {
-        if (event.target.matches('[aria-label="Ask Grok anything"]')) updateSubmitState()
-      })
-
-      document.addEventListener('keydown', (event) => {
-        if (
-          event.target instanceof Element &&
-          event.target.matches('[aria-label="Ask Grok anything"]') &&
-          event.key === 'Enter' &&
-          !event.shiftKey
-        ) {
-          event.preventDefault()
-          form.requestSubmit()
-        }
-        if (event.key === 'Escape') dismissGrokModelMenu()
-      })
-
-      modelTrigger.addEventListener('click', () => {
-        if (modelTrigger.getAttribute('aria-expanded') === 'true') {
-          dismissGrokModelMenu()
-        } else {
-          createGrokModelMenu()
-        }
-      })
-
-      function createGrokModelMenu() {
-        dismissGrokModelMenu()
-        modelTrigger.setAttribute('aria-expanded', 'true')
-        const menu = document.createElement('div')
-        menu.setAttribute('role', 'menu')
-        menu.dataset.fixture = 'grok-model-menu'
-        const enabled = new Set(Array.isArray(globalThis.__fixtureGrokEnabledModels)
-          ? globalThis.__fixtureGrokEnabledModels
-          : grokModels.map((model) => model.label))
-        for (const model of grokModels) {
-          const item = document.createElement('div')
-          item.setAttribute('role', 'menuitem')
-          item.setAttribute('data-radix-collection-item', '')
-          item.setAttribute('aria-disabled', String(!enabled.has(model.label)))
-          const label = document.createElement('span')
-          label.className = 'font-semibold text-sm'
-          label.textContent = model.label
-          const sublabel = document.createElement('span')
-          sublabel.className = 'text-xs text-secondary'
-          sublabel.textContent = model.sublabel
-          item.append(label, sublabel)
-          item.addEventListener('click', () => {
-            if (item.getAttribute('aria-disabled') === 'true') return
-            selectedGrokModel = model.label
-            modelTrigger.textContent = selectedGrokModel
-            dismissGrokModelMenu()
-          })
-          menu.append(item)
-        }
-        document.body.append(menu)
-      }
-
-      function dismissGrokModelMenu() {
-        document.querySelector('[role="menu"][data-fixture="grok-model-menu"]')?.remove()
-        modelTrigger.setAttribute('aria-expanded', 'false')
-      }
-
-      form.addEventListener('submit', (event) => {
-        event.preventDefault()
-        const input = composer()
-        const prompt = textOf(input).trim()
-        if (submit.disabled || !prompt) return
-
-        conversation.append(createMessage('user', prompt))
-        clearComposer(input)
-        updateSubmitState()
-
-        if (globalThis.__fixtureGrokAnonymousPaywall === true || Number.isFinite(globalThis.__fixtureGrokAnonymousPaywallDelayMs)) {
-          const paywall = document.createElement('div')
-          paywall.dataset.testid = 'anon-paywall-sign-up-card'
-          paywall.innerHTML = '<strong>Continue your conversation</strong><p>Sign up for free to continue.</p>'
-          const delayMs = globalThis.__fixtureGrokAnonymousPaywall === true
-            ? 0
-            : Math.max(0, globalThis.__fixtureGrokAnonymousPaywallDelayMs)
-          setTimeout(() => document.body.append(paywall), delayMs)
-          return
-        }
-
-        conversation.append(createMessage(
-          'assistant',
-          'visible Grok real-DOM fixture answer for: ' + prompt
-        ))
-        history.replaceState(null, '', '/c/123e4567-e89b-12d3-a456-426614174003')
-      })
-
-      function composer() {
-        return document.querySelector('[aria-label="Ask Grok anything"]')
-      }
-
-      function updateSubmitState() {
-        submit.disabled = textOf(composer()).trim().length === 0
-      }
-
-      function clearComposer(input) {
-        if ('value' in input) {
-          input.value = ''
-        } else {
-          input.textContent = ''
-        }
-      }
-
-      function createMessage(role, text) {
-        const message = document.createElement('div')
-        message.dataset.testid = role + '-message'
-        const markdown = document.createElement('div')
-        markdown.className = 'response-content-markdown markdown'
-        markdown.textContent = text
-        message.append(markdown)
-        return message
-      }
-
-      function textOf(node) {
-        if (!node) return ''
-        return 'value' in node ? node.value : (node.innerText || node.textContent || '')
-      }
-    </script>
-  </body>
-</html>
diff --git a/test/fixtures/live-web-ui.example.json b/test/fixtures/live-web-ui.example.json
new file mode 100644
index 0000000..6df2ca7
--- /dev/null
+++ b/test/fixtures/live-web-ui.example.json
@@ -0,0 +1,72 @@
+{
+  "schema": "tokenless.live-web-ui-fixtures.v1",
+  "homes": {
+    "main": {
+      "path": "~/.tokenless"
+    }
+  },
+  "profiles": {
+    "work": {
+      "home": "main",
+      "slug": "work"
+    }
+  },
+  "providers": {
+    "chatgpt": {
+      "id": "chatgpt"
+    }
+  },
+  "startups": {
+    "desktop-fresh": {
+      "context": "fresh",
+      "reload": false,
+      "viewport": {
+        "width": 1920,
+        "height": 1080
+      }
+    },
+    "desktop-reload": {
+      "context": "shared",
+      "reload": true,
+      "viewport": {
+        "width": 1920,
+        "height": 1080
+      }
+    },
+    "mobile-fresh": {
+      "context": "fresh",
+      "reload": false,
+      "viewport": {
+        "width": 390,
+        "height": 844
+      }
+    }
+  },
+  "cases": {
+    "work-chatgpt-desktop": {
+      "profile": "work",
+      "provider": "chatgpt",
+      "startup": "desktop-fresh"
+    },
+    "work-chatgpt-reload": {
+      "profile": "work",
+      "provider": "chatgpt",
+      "startup": "desktop-reload"
+    },
+    "work-chatgpt-mobile": {
+      "profile": "work",
+      "provider": "chatgpt",
+      "startup": "mobile-fresh"
+    }
+  },
+  "suites": {
+    "smoke": [
+      "work-chatgpt-desktop"
+    ],
+    "startup-matrix": [
+      "work-chatgpt-desktop",
+      "work-chatgpt-reload",
+      "work-chatgpt-mobile"
+    ]
+  }
+}
diff --git a/test/fixtures/live-web-ui.md b/test/fixtures/live-web-ui.md
new file mode 100644
index 0000000..e3eccd3
--- /dev/null
+++ b/test/fixtures/live-web-ui.md
@@ -0,0 +1,10 @@
+# Local live Web UI fixtures
+
+Real-provider Web UI E2E selection is composed from local fixtures instead of environment variables.
+
+1. Copy `test/fixtures/live-web-ui.example.json` to `test/fixtures/local/web-ui.json`.
+2. Set the local Tokenless home, explicitly selected setup-managed profile, and provider.
+3. Add startup fixtures and compose them into cases and suites as needed.
+4. Run `npm run test:e2e:web-provider -- --fixture smoke` or `--fixture startup-matrix`.
+
+The whole `test/fixtures/local/` directory is gitignored. These files may contain local paths and non-secret selection identifiers only. Never place credentials, cookies, tokens, browser storage, headers, or copied profile data in a fixture.
diff --git a/test/fixtures/provider-attachment-dom-fixture.html b/test/fixtures/provider-attachment-dom-fixture.html
deleted file mode 100644
index 0dd123b..0000000
--- a/test/fixtures/provider-attachment-dom-fixture.html
+++ /dev/null
@@ -1,290 +0,0 @@
-<!--
-  Reduced attachment-only fixture assembled from the exact visible file-input and
-  composer nodes captured for ChatGPT, Claude, and Grok on 2026-07-16. Gemini is
-  intentionally limited to its authenticated composer because no authenticated
-  Gemini file input has been captured yet. The behavior below is a deterministic
-  Tokenless test shim, not provider JavaScript.
--->
-<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1">
-    <title>Tokenless attachment DOM fixture</title>
-    <style>
-      body {
-        margin: 0;
-        min-height: 100vh;
-        display: grid;
-        place-items: center;
-        font-family: system-ui, sans-serif;
-      }
-
-      .composer-shell {
-        width: min(720px, calc(100vw - 48px));
-        min-height: 140px;
-        padding: 20px;
-        border: 1px solid #aaa;
-        border-radius: 18px;
-      }
-
-      [contenteditable="true"] {
-        min-height: 52px;
-        padding: 12px;
-        border: 1px solid #ccc;
-      }
-
-      .attachment-chip {
-        display: inline-block;
-        margin: 8px 8px 0 0;
-        padding: 6px 10px;
-        border-radius: 999px;
-        background: #eee;
-      }
-
-      [data-testid="conversation-panel"] {
-        width: min(720px, calc(100vw - 48px));
-        margin-bottom: 16px;
-      }
-
-      article[data-message-author-role] {
-        margin: 8px 0;
-        padding: 10px 12px;
-        border-radius: 12px;
-        background: #f5f5f5;
-      }
-    </style>
-  </head>
-  <body>
-    <main id="fixture-root"></main>
-    <script>
-      const host = location.hostname
-      const root = document.querySelector('#fixture-root')
-      const records = []
-      const events = []
-      const submissions = []
-      Object.defineProperty(globalThis, '__attachmentFixture', {
-        configurable: true,
-        value: { events, records, submissions, suppressVisibleSubmit: false },
-      })
-
-      if (host === 'chatgpt.com') {
-        root.innerHTML = `
-          <button data-testid="accounts-profile-button" role="button" aria-label="Account menu">Account</button>
-          <div data-testid="conversation-panel"></div>
-          <form class="composer-shell" data-testid="composer" aria-label="Message composer">
-            <button id="intelligence-control" type="button" aria-expanded="false" aria-haspopup="menu">Medium</button>
-            <input id="upload-files" type="file" accept="text/plain,.txt" multiple hidden>
-            <input data-decoy-file-input type="file" multiple hidden>
-            <div id="attachment-evidence"></div>
-            <div id="prompt-textarea" class="ProseMirror" data-id="root" contenteditable="true" role="textbox" aria-label="Message ChatGPT"></div>
-            <button data-testid="composer-send-button" aria-label="Send message" aria-disabled="true" disabled type="submit">Send</button>
-          </form>`
-      } else if (host === 'claude.ai') {
-        root.innerHTML = `
-          <section class="composer-shell" aria-label="Message composer">
-            <input id="chat-input-file-upload-onpage" data-testid="file-upload" aria-hidden="true" tabindex="-1" accept=".pdf,.doc,.docx,.txt,.md,.rtf,.csv,.json,.xml,.html,.png,.jpg,.jpeg,.gif,.webp" multiple aria-label="Upload files" type="file" hidden>
-            <input data-decoy-file-input type="file" multiple hidden>
-            <div id="attachment-evidence"></div>
-            <div contenteditable="true" role="textbox" data-testid="chat-input" aria-label="Write your prompt to Claude" aria-multiline="true" class="tiptap ProseMirror"><p><br></p></div>
-            <button type="button" data-cds="Button" aria-label="Send message">Send</button>
-          </section>`
-      } else if (host === 'grok.com') {
-        root.innerHTML = `
-          <section class="composer-shell" aria-label="Message composer">
-            <input type="file" name="files" accept="text/plain,.txt" multiple hidden>
-            <input data-decoy-file-input type="file" multiple hidden>
-            <div id="attachment-evidence"></div>
-            <div class="tiptap ProseMirror" contenteditable="true" role="textbox" aria-label="Ask Grok anything" aria-multiline="true"></div>
-            <button data-testid="chat-submit" aria-label="Submit" type="submit">Send</button>
-          </section>`
-      } else if (host === 'gemini.google.com') {
-        root.innerHTML = `
-          <section class="composer-shell" aria-label="Message composer">
-            <input data-decoy-file-input type="file" multiple hidden>
-            <div id="attachment-evidence"></div>
-            <rich-textarea><div class="ql-editor" data-gramm="false" contenteditable="true" role="textbox" aria-multiline="true" aria-label="Enter a prompt for Gemini"></div></rich-textarea>
-            <button aria-label="Upload and tools" type="button">Upload and tools</button>
-            <button aria-label="Send message" type="button">Send</button>
-          </section>`
-      }
-
-      let exactInput = root.querySelector([
-        '#upload-files',
-        '#chat-input-file-upload-onpage',
-        'input[name="Filedata"]',
-        'input[name="files"]',
-      ].join(','))
-
-      const geminiUploadTrigger = root.querySelector('button[aria-label="Upload and tools"]')
-      if (geminiUploadTrigger) {
-        geminiUploadTrigger.addEventListener('click', () => {
-          document.querySelector('[data-fixture="gemini-upload-menu"]')?.remove()
-          const menu = document.createElement('div')
-          menu.dataset.fixture = 'gemini-upload-menu'
-          menu.setAttribute('role', 'menu')
-          const localUpload = document.createElement('button')
-          localUpload.type = 'button'
-          localUpload.setAttribute('role', 'menuitem')
-          localUpload.setAttribute('data-test-id', 'local-images-files-uploader-button')
-          localUpload.setAttribute('aria-label', 'Upload files. Documents, data, code files')
-          localUpload.textContent = 'Upload files'
-          localUpload.addEventListener('click', () => {
-            if (!exactInput) {
-              exactInput = document.createElement('input')
-              exactInput.type = 'file'
-              exactInput.name = 'Filedata'
-              exactInput.multiple = true
-              exactInput.hidden = true
-              root.querySelector('.composer-shell').append(exactInput)
-              registerExactInput(exactInput)
-            }
-            menu.remove()
-          })
-          menu.append(localUpload)
-          root.querySelector('.composer-shell').append(menu)
-        })
-      }
-
-      const intelligence = root.querySelector('#intelligence-control')
-      if (intelligence) {
-        let selectedModel = 'GPT-5.6 Sol'
-        const dismissIntelligenceMenus = () => {
-          document.querySelectorAll('[data-attachment-fixture-model-menu]').forEach((menu) => menu.remove())
-          intelligence.setAttribute('aria-expanded', 'false')
-        }
-        const createModelMenu = () => {
-          const menu = document.createElement('div')
-          menu.dataset.attachmentFixtureModelMenu = 'true'
-          menu.setAttribute('role', 'menu')
-          menu.style.cssText = 'position:fixed;left:420px;bottom:90px;display:grid;background:white'
-          for (const model of ['GPT-5.6 Sol', 'GPT-5.5']) {
-            const item = document.createElement('button')
-            item.type = 'button'
-            item.setAttribute('role', 'menuitemradio')
-            item.setAttribute('aria-checked', String(model === selectedModel))
-            item.textContent = model
-            item.addEventListener('click', () => {
-              selectedModel = model
-              events.push('model-selected:' + model)
-              dismissIntelligenceMenus()
-            })
-            menu.append(item)
-          }
-          document.body.append(menu)
-        }
-        intelligence.addEventListener('click', () => {
-          dismissIntelligenceMenus()
-          intelligence.setAttribute('aria-expanded', 'true')
-          const menu = document.createElement('div')
-          menu.dataset.attachmentFixtureModelMenu = 'true'
-          menu.setAttribute('role', 'menu')
-          menu.setAttribute('aria-labelledby', intelligence.id)
-          menu.style.cssText = 'position:fixed;left:260px;bottom:90px;display:grid;background:white'
-          const submenu = document.createElement('button')
-          submenu.type = 'button'
-          submenu.setAttribute('role', 'menuitem')
-          submenu.setAttribute('aria-haspopup', 'menu')
-          submenu.textContent = selectedModel
-          submenu.addEventListener('click', createModelMenu)
-          menu.append(submenu)
-          document.body.append(menu)
-        })
-        document.addEventListener('keydown', (event) => {
-          if (event.key === 'Escape') dismissIntelligenceMenus()
-        })
-      }
-
-      function registerExactInput(input) {
-        input.addEventListener('input', () => events.push('input'))
-        input.addEventListener('change', async () => {
-          events.push('change')
-          const files = [...(input.files || [])]
-          if (!files.length) return
-          for (const file of files) {
-            const bytes = [...new Uint8Array(await file.arrayBuffer())]
-            records.push({ bytes, name: file.name, size: file.size, type: file.type })
-            const chip = document.createElement('span')
-            chip.className = 'attachment-chip'
-            chip.textContent = file.name
-            document.querySelector('#attachment-evidence').append(chip)
-            events.push('chip-visible')
-          }
-          updateChatGptSendState()
-        })
-      }
-      if (exactInput) registerExactInput(exactInput)
-
-      const chatGptComposer = root.querySelector('#prompt-textarea')
-      const chatGptForm = root.querySelector('form[data-testid="composer"]')
-      const chatGptSend = root.querySelector('[data-testid="composer-send-button"]')
-      if (chatGptComposer && chatGptForm && chatGptSend) {
-        chatGptComposer.addEventListener('input', () => {
-          events.push('prompt-input')
-          updateChatGptSendState()
-        })
-        chatGptForm.addEventListener('submit', (event) => {
-          event.preventDefault()
-          if (chatGptSend.disabled || chatGptSend.getAttribute('aria-disabled') === 'true') return
-          if (globalThis.__attachmentFixture.suppressVisibleSubmit) {
-            events.push('submit-suppressed')
-            return
-          }
-
-          const prompt = textOf(chatGptComposer).trim()
-          const files = [...(exactInput.files || [])]
-          const chips = [...document.querySelectorAll('#attachment-evidence .attachment-chip')]
-          const submittedAfterVisibleAttachment = files.length > 0 && files.every((file) => (
-            chips.some((chip) => textOf(chip) === file.name)
-          ))
-          events.push('submit')
-          submissions.push({
-            fileName: files[0] ? files[0].name : null,
-            fileNames: files.map((file) => file.name),
-            prompt,
-            submittedAfterVisibleAttachment,
-          })
-          document.querySelector('[data-testid="conversation-panel"]').append(message('user', prompt))
-          chatGptComposer.textContent = ''
-          updateChatGptSendState()
-
-          const stop = document.createElement('button')
-          stop.dataset.testid = 'stop-button'
-          stop.setAttribute('aria-label', 'Stop generating')
-          stop.textContent = 'Stop generating'
-          document.body.append(stop)
-          setTimeout(() => {
-            document.querySelector('[data-testid="conversation-panel"]').append(
-              message('assistant', 'visible attachment fixture answer for: ' + prompt)
-            )
-            stop.remove()
-          }, 80)
-        })
-      }
-
-      function updateChatGptSendState() {
-        if (!chatGptComposer || !chatGptSend) return
-        const hasPrompt = textOf(chatGptComposer).trim().length > 0
-        const hasVisibleAttachment = Boolean(document.querySelector('#attachment-evidence .attachment-chip'))
-        const disabled = !(hasPrompt && hasVisibleAttachment)
-        chatGptSend.disabled = disabled
-        chatGptSend.setAttribute('aria-disabled', String(disabled))
-      }
-
-      function message(role, text) {
-        const article = document.createElement('article')
-        article.dataset.messageAuthorRole = role
-        article.dataset.testid = 'conversation-turn-' + crypto.randomUUID()
-        const content = document.createElement('div')
-        content.className = role === 'assistant' ? 'markdown prose' : 'whitespace-pre-wrap'
-        content.textContent = text
-        article.append(content)
-        return article
-      }
-
-      function textOf(node) {
-        return node && (node.innerText || node.textContent) || ''
-      }
-    </script>
-  </body>
-</html>
diff --git a/test/fixtures/provider-dom/README.md b/test/fixtures/provider-dom/README.md
new file mode 100644
index 0000000..64df54f
--- /dev/null
+++ b/test/fixtures/provider-dom/README.md
@@ -0,0 +1,47 @@
+# Provider DOM Fixtures
+
+This directory stores redacted, reduced DOM evidence captured from visible provider pages. It covers authenticated ChatGPT, Claude, Gemini, Grok, and DeepSeek sessions plus the public Qwen guest surface without retaining cookies, browser storage, tokens, account email addresses, chat content, or private route identifiers.
+
+The hierarchy is:
+
+```text
+provider-dom/
+  <provider>/
+    <account-state>/
+      <scenario>.html
+      <scenario>.provenance.json
+```
+
+Every provenance file records the sanitized page URL, route class, capture date, account-state classification, observed plan confidence, evidence selectors, redactions, and the SHA-256 digest of its paired HTML file. Generated workflow fixtures also record their operation phase and capability outcome. The v2 `manifest.json` inventories those fields with every fixture and provenance path so multiple routes and overlays can coexist under one provider account state.
+
+Provider development must capture each materially distinct capability-relevant state from a real visible session before relying on its selectors. Reduce and redact the capture once, then use the checked-in fixture for focused selector, parser, and sanitizer work instead of repeatedly revisiting the provider. Login, CAPTCHA, mode, menu, upload-selection, streaming, completed-response, and terminal-error states are separate evidence when they change behavior. If a state cannot be captured without signing the user out, changing accounts, or crossing another user-controlled boundary, record the evidence gap; never invent or splice DOM and never disturb the authenticated profile just to complete the corpus.
+
+An available menu, input, or creation form proves only that captured phase. It must not be treated as a successful upload or workspace mutation without a separate visible success fixture.
+
+The committed fixtures intentionally contain only the minimum visible DOM needed for regression tests. Raw page HTML is not committed because it is privacy-sensitive, highly volatile, and may include executable provider code. Use `test/helpers/capture-provider-dom-cdp.mjs` to collect a fresh sanitized candidate, inspect it manually, then reduce and promote only the relevant visible evidence.
+
+The deep workflow corpus currently covers:
+
+| Provider | Additional authenticated workflows |
+| --- | --- |
+| ChatGPT | Existing conversation, upload/tools menu, library, connector directory, scheduled jobs, settings, generated-image result |
+| Claude | Existing conversation, upload/connectors menu, settings, connector settings, projects, artifacts |
+| Gemini | Existing conversation, chat search, upload/tools menu, connected upload sources, settings menu, image workspace, media library |
+| Grok | Attachment menu, skills, connectors, Imagine, automation list and creation, account settings, empty history, project creation |
+| DeepSeek | Instant, Expert, and Vision composer states with mode-dependent DeepThink, Search, and file controls |
+
+Run `node test/helpers/build-provider-workflow-fixtures.mjs` after changing the deep workflow descriptor. It rewrites those reduced HTML fixtures and their provenance sidecars, recalculates content digests, and regenerates the complete v2 manifest without replacing the older baseline fixture variants.
+
+Grok has two retained model-menu variants:
+
+- `signed-in-unknown/model-menu-open` preserves an older DOM variant whose reduced artifact did not expose a reliable disabled-state signal.
+- `signed-in-free/model-menu-open` records the current Free-account contract: `Auto`, `Expert`, and `Heavy` use Grok's visible `text-secondary opacity-75` unavailable styling while `Fast` remains available.
+
+Qwen retains two guest-session fixtures captured on 2026-07-26:
+
+- `signed-out-guest/composer-idle` proves the public composer, sign-in invitation, and submit control.
+- `signed-out-guest/response-complete` proves a visibly complete response, same-origin conversation continuation, and the absence of the observed streaming-state class.
+
+DeepSeek retains signed-in, plan-unknown fixtures captured on 2026-08-01. The composer variants prove only visible control topology: Instant exposes DeepThink, Search, and a file input; Expert exposes DeepThink without Search or a file input; Vision exposes DeepThink and a file input without Search. Separate completed-response variants preserve the stable final-answer selector, the distinct DeepThink reasoning container, and Search responses with visible public source links.
+
+The DeepSeek signed-out login and visible hCaptcha states were observed but were not captured before the temporary managed session was closed. They remain an explicit fixture gap. Runtime challenge detection recognizes visible hCaptcha frames as `visible_hcaptcha`; a future fixture must come from a real user-visible signed-out session and must not be obtained by logging the authenticated Chrome profile out.
diff --git a/test/fixtures/provider-dom/chatgpt/signed-in-paid/composer-no-choice-controls.html b/test/fixtures/provider-dom/chatgpt/signed-in-paid/composer-no-choice-controls.html
new file mode 100644
index 0000000..6a34dad
--- /dev/null
+++ b/test/fixtures/provider-dom/chatgpt/signed-in-paid/composer-no-choice-controls.html
@@ -0,0 +1,11 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>ChatGPT composer without choice controls</title></head>
+  <body>
+    <div role="button" data-testid="accounts-profile-button" aria-label="[redacted] Pro, open profile menu"></div>
+    <button data-testid="composer-plus-btn" aria-label="Add files and more"></button>
+    <textarea></textarea>
+    <div role="textbox" contenteditable="true"></div>
+    <button data-testid="send-button" aria-label="Send prompt"></button>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/chatgpt/signed-in-paid/composer-no-choice-controls.provenance.json b/test/fixtures/provider-dom/chatgpt/signed-in-paid/composer-no-choice-controls.provenance.json
new file mode 100644
index 0000000..a8cd3db
--- /dev/null
+++ b/test/fixtures/provider-dom/chatgpt/signed-in-paid/composer-no-choice-controls.provenance.json
@@ -0,0 +1,52 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "chatgpt",
+  "accountState": "signed-in-paid",
+  "observedPlan": {
+    "status": "observed",
+    "label": "Pro"
+  },
+  "scenario": "composer-no-choice-controls",
+  "routeClass": "new-chat",
+  "operationPhase": "choice-inspection",
+  "capabilityOutcome": "unavailable",
+  "observedOn": "2026-07-28",
+  "sanitizedUrl": "https://chatgpt.com/",
+  "source": "managed-visible-provider-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "54ded4663ebe2fefb9deeba161835ea0d06e82e069fe8a356fa3439aadf49031",
+  "evidenceSelectors": [
+    {
+      "capability": "session.authenticated",
+      "selector": "[data-testid=\"accounts-profile-button\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "prompt.input",
+      "selector": "[contenteditable=\"true\"][role=\"textbox\"]",
+      "expectedCount": 1
+    }
+  ],
+  "absenceSelectors": [
+    {
+      "purpose": "model-choice-control-not-observed",
+      "selector": "[data-testid=\"model-switcher-dropdown-button\"]",
+      "expectedCount": 0
+    },
+    {
+      "purpose": "effort-choice-control-not-observed",
+      "selector": "button[aria-label*=\"thinking\" i]",
+      "expectedCount": 0
+    }
+  ],
+  "redactions": [
+    "account identity",
+    "conversation history",
+    "message content",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ]
+}
diff --git a/test/fixtures/provider-dom/chatgpt/signed-in-paid/connectors-directory.html b/test/fixtures/provider-dom/chatgpt/signed-in-paid/connectors-directory.html
new file mode 100644
index 0000000..0c0627d
--- /dev/null
+++ b/test/fixtures/provider-dom/chatgpt/signed-in-paid/connectors-directory.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>ChatGPT connectors directory</title></head>
+  <body>
+      <main>
+        <div role="tablist" aria-label="Directory type"><button role="tab" aria-selected="true">Plugins</button><button role="tab">Skills</button></div>
+        <h1>Plugins</h1>
+        <input type="search" aria-label="Search plugins">
+        <section aria-label="Connector results">
+          <article><h2>Figma</h2><button>Connect</button></article>
+          <article><h2>GitHub</h2><button>Connect</button></article>
+          <article><h2>Gmail</h2><button>Connect</button></article>
+        </section>
+      </main>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/chatgpt/signed-in-paid/connectors-directory.provenance.json b/test/fixtures/provider-dom/chatgpt/signed-in-paid/connectors-directory.provenance.json
new file mode 100644
index 0000000..13bcf86
--- /dev/null
+++ b/test/fixtures/provider-dom/chatgpt/signed-in-paid/connectors-directory.provenance.json
@@ -0,0 +1,44 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "chatgpt",
+  "accountState": "signed-in-paid",
+  "observedPlan": {
+    "status": "observed",
+    "label": "Pro"
+  },
+  "scenario": "connectors-directory",
+  "routeClass": "connectors-directory",
+  "operationPhase": "observed",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://chatgpt.com/plugins",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "b7be1587fae61da043e02ceda3913d13d0f6530fcdf855581987c060059a9aa5",
+  "evidenceSelectors": [
+    {
+      "capability": "connector.search",
+      "selector": "input[aria-label=\"Search plugins\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "connector.list",
+      "selector": "section[aria-label=\"Connector results\"] article",
+      "expectedCount": 3
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/chatgpt/signed-in-paid/conversation-existing.html b/test/fixtures/provider-dom/chatgpt/signed-in-paid/conversation-existing.html
new file mode 100644
index 0000000..ffe8bd4
--- /dev/null
+++ b/test/fixtures/provider-dom/chatgpt/signed-in-paid/conversation-existing.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>ChatGPT existing conversation</title></head>
+  <body>
+      <header><button aria-label="Share">Share</button><button aria-label="Open conversation options">More</button></header>
+      <main>
+        <article data-message-author-role="user"><h2>You said:</h2><p>[redacted message]</p></article>
+        <article data-message-author-role="assistant"><h2>ChatGPT said:</h2><p>[redacted response]</p></article>
+        <div id="prompt-textarea" role="textbox" contenteditable="true" aria-label="Chat with ChatGPT"></div>
+      </main>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/chatgpt/signed-in-paid/conversation-existing.provenance.json b/test/fixtures/provider-dom/chatgpt/signed-in-paid/conversation-existing.provenance.json
new file mode 100644
index 0000000..8c6eae5
--- /dev/null
+++ b/test/fixtures/provider-dom/chatgpt/signed-in-paid/conversation-existing.provenance.json
@@ -0,0 +1,49 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "chatgpt",
+  "accountState": "signed-in-paid",
+  "observedPlan": {
+    "status": "observed",
+    "label": "Pro"
+  },
+  "scenario": "conversation-existing",
+  "routeClass": "conversation",
+  "operationPhase": "conversation-existing",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://chatgpt.com/c/[redacted]",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "b29e4ff1d1a9bd5ad891060d26d726f6e761094ea67529e49d9c7de5bf2b2af3",
+  "evidenceSelectors": [
+    {
+      "capability": "job.existing",
+      "selector": "main article[data-message-author-role]",
+      "expectedCount": 2
+    },
+    {
+      "capability": "job.continue",
+      "selector": "main [role=\"textbox\"][aria-label=\"Chat with ChatGPT\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "job.share",
+      "selector": "button[aria-label=\"Share\"]",
+      "expectedCount": 1
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/chatgpt/signed-in-paid/image-result.html b/test/fixtures/provider-dom/chatgpt/signed-in-paid/image-result.html
new file mode 100644
index 0000000..cbcb351
--- /dev/null
+++ b/test/fixtures/provider-dom/chatgpt/signed-in-paid/image-result.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>ChatGPT generated image result</title></head>
+  <body>
+      <main>
+        <article data-message-author-role="assistant">
+          <button aria-label="Generated image: [redacted description]"><img alt="Generated image: [redacted description]"></button>
+          <button aria-label="Edit image">Edit image</button>
+          <button aria-label="Share this image">Share this image</button>
+          <div role="group" aria-label="Response actions"><button>Copy</button><button>Like</button><button>Dislike</button><button>More</button></div>
+        </article>
+      </main>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/chatgpt/signed-in-paid/image-result.provenance.json b/test/fixtures/provider-dom/chatgpt/signed-in-paid/image-result.provenance.json
new file mode 100644
index 0000000..0acd9be
--- /dev/null
+++ b/test/fixtures/provider-dom/chatgpt/signed-in-paid/image-result.provenance.json
@@ -0,0 +1,49 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "chatgpt",
+  "accountState": "signed-in-paid",
+  "observedPlan": {
+    "status": "observed",
+    "label": "Pro"
+  },
+  "scenario": "image-result",
+  "routeClass": "conversation-image-result",
+  "operationPhase": "observed",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://chatgpt.com/c/[redacted]",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "ed2bbb66ba9934ccb3dcadbabb2741b40a5dfff0db3117e3f152f81b68ca2e8d",
+  "evidenceSelectors": [
+    {
+      "capability": "image.result",
+      "selector": "button[aria-label^=\"Generated image:\"] img",
+      "expectedCount": 1
+    },
+    {
+      "capability": "image.edit",
+      "selector": "button[aria-label=\"Edit image\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "image.share",
+      "selector": "button[aria-label=\"Share this image\"]",
+      "expectedCount": 1
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/chatgpt/signed-in-paid/library-files.html b/test/fixtures/provider-dom/chatgpt/signed-in-paid/library-files.html
new file mode 100644
index 0000000..d68ae9d
--- /dev/null
+++ b/test/fixtures/provider-dom/chatgpt/signed-in-paid/library-files.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>ChatGPT library</title></head>
+  <body>
+      <main>
+        <h1>Library</h1>
+        <button aria-label="Upload">Upload</button>
+        <input type="search" aria-label="Search">
+        <div role="tablist" aria-label="Library filters">
+          <button role="tab" aria-selected="true">All</button>
+          <button role="tab">Images</button>
+          <button role="tab">Documents</button>
+        </div>
+        <div role="grid" aria-label="Files"><div role="row">[redacted file]</div></div>
+      </main>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/chatgpt/signed-in-paid/library-files.provenance.json b/test/fixtures/provider-dom/chatgpt/signed-in-paid/library-files.provenance.json
new file mode 100644
index 0000000..76bdb6b
--- /dev/null
+++ b/test/fixtures/provider-dom/chatgpt/signed-in-paid/library-files.provenance.json
@@ -0,0 +1,49 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "chatgpt",
+  "accountState": "signed-in-paid",
+  "observedPlan": {
+    "status": "observed",
+    "label": "Pro"
+  },
+  "scenario": "library-files",
+  "routeClass": "library",
+  "operationPhase": "observed",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://chatgpt.com/library",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "898560b26227ddc80058abc29466fbd10aff7e016ea331c0c7eb4704fa25774b",
+  "evidenceSelectors": [
+    {
+      "capability": "library.open",
+      "selector": "main h1",
+      "expectedCount": 1
+    },
+    {
+      "capability": "library.upload",
+      "selector": "button[aria-label=\"Upload\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "library.filter",
+      "selector": "[role=\"tablist\"] [role=\"tab\"]",
+      "expectedCount": 3
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/chatgpt/signed-in-paid/scheduled-jobs.html b/test/fixtures/provider-dom/chatgpt/signed-in-paid/scheduled-jobs.html
new file mode 100644
index 0000000..bd06a4a
--- /dev/null
+++ b/test/fixtures/provider-dom/chatgpt/signed-in-paid/scheduled-jobs.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>ChatGPT scheduled jobs</title></head>
+  <body>
+      <main>
+        <h1>Scheduled</h1>
+        <div role="radiogroup" aria-label="Select chat surface"><label><input type="radio" checked>Chat</label><label><input type="radio">Work</label></div>
+        <button aria-label="Filter tasks">Active</button>
+        <textarea aria-label="Schedule a task"></textarea>
+        <article data-testid="scheduled-task"><h2>[redacted task]</h2><button>Edit</button><button>Pause</button><button>More</button></article>
+      </main>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/chatgpt/signed-in-paid/scheduled-jobs.provenance.json b/test/fixtures/provider-dom/chatgpt/signed-in-paid/scheduled-jobs.provenance.json
new file mode 100644
index 0000000..44613b5
--- /dev/null
+++ b/test/fixtures/provider-dom/chatgpt/signed-in-paid/scheduled-jobs.provenance.json
@@ -0,0 +1,49 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "chatgpt",
+  "accountState": "signed-in-paid",
+  "observedPlan": {
+    "status": "observed",
+    "label": "Pro"
+  },
+  "scenario": "scheduled-jobs",
+  "routeClass": "scheduled-jobs",
+  "operationPhase": "observed",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://chatgpt.com/scheduled",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "e99837e070c8855e5dc613f62d65217a511c4294bf8370ae4e573b310b28a5eb",
+  "evidenceSelectors": [
+    {
+      "capability": "job.schedule",
+      "selector": "textarea[aria-label=\"Schedule a task\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "job.existing",
+      "selector": "article[data-testid=\"scheduled-task\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "job.control",
+      "selector": "article[data-testid=\"scheduled-task\"] button",
+      "expectedCount": 3
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/chatgpt/signed-in-paid/settings-general.html b/test/fixtures/provider-dom/chatgpt/signed-in-paid/settings-general.html
new file mode 100644
index 0000000..70014cb
--- /dev/null
+++ b/test/fixtures/provider-dom/chatgpt/signed-in-paid/settings-general.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>ChatGPT settings</title></head>
+  <body>
+      <div role="dialog" aria-label="Settings">
+        <nav aria-label="Settings sections">
+          <button aria-current="page">General</button><button>Notifications</button><button>Personalization</button>
+          <button>Plugins</button><button>Billing</button><button>Usage</button><button>Data controls</button>
+          <button>Cloud browser</button><button>Storage</button><button>Security and login</button>
+        </nav>
+        <main><h2>General</h2><label>Appearance<select><option>System</option></select></label><label>Language<select><option>English</option></select></label></main>
+      </div>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/chatgpt/signed-in-paid/settings-general.provenance.json b/test/fixtures/provider-dom/chatgpt/signed-in-paid/settings-general.provenance.json
new file mode 100644
index 0000000..adf0bfd
--- /dev/null
+++ b/test/fixtures/provider-dom/chatgpt/signed-in-paid/settings-general.provenance.json
@@ -0,0 +1,44 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "chatgpt",
+  "accountState": "signed-in-paid",
+  "observedPlan": {
+    "status": "observed",
+    "label": "Pro"
+  },
+  "scenario": "settings-general",
+  "routeClass": "settings-overlay",
+  "operationPhase": "observed",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://chatgpt.com/scheduled",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "b1d32ce3a7a717bcc4e537fa3ccce0c39838908d83145653137a8ec0bf3b0a99",
+  "evidenceSelectors": [
+    {
+      "capability": "settings.open",
+      "selector": "[role=\"dialog\"][aria-label=\"Settings\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "settings.sections",
+      "selector": "nav[aria-label=\"Settings sections\"] button",
+      "expectedCount": 10
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/chatgpt/signed-in-paid/upload-tools-menu-open.html b/test/fixtures/provider-dom/chatgpt/signed-in-paid/upload-tools-menu-open.html
new file mode 100644
index 0000000..2353753
--- /dev/null
+++ b/test/fixtures/provider-dom/chatgpt/signed-in-paid/upload-tools-menu-open.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>ChatGPT upload and tools menu</title></head>
+  <body>
+      <main>
+        <div id="prompt-textarea" role="textbox" contenteditable="true" aria-label="Chat with ChatGPT"></div>
+        <button data-testid="composer-plus-btn" aria-label="Add files and more" aria-expanded="true">Add</button>
+      </main>
+      <div role="menu" aria-label="Add files and more">
+        <div role="menuitem">Upload from computer</div>
+        <div role="menuitem">Create image</div>
+        <div role="menuitem">Web search</div>
+        <div role="menuitem">Deep research</div>
+        <div role="menuitem">Connect an app</div>
+      </div>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/chatgpt/signed-in-paid/upload-tools-menu-open.provenance.json b/test/fixtures/provider-dom/chatgpt/signed-in-paid/upload-tools-menu-open.provenance.json
new file mode 100644
index 0000000..e985785
--- /dev/null
+++ b/test/fixtures/provider-dom/chatgpt/signed-in-paid/upload-tools-menu-open.provenance.json
@@ -0,0 +1,44 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "chatgpt",
+  "accountState": "signed-in-paid",
+  "observedPlan": {
+    "status": "observed",
+    "label": "Pro"
+  },
+  "scenario": "upload-tools-menu-open",
+  "routeClass": "new-chat",
+  "operationPhase": "upload-menu-open",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://chatgpt.com/",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "93f589721d88ee115b867fc208fb18729dc12b1c6a65acf2542d27533c1bad5a",
+  "evidenceSelectors": [
+    {
+      "capability": "upload.open",
+      "selector": "button[data-testid=\"composer-plus-btn\"][aria-expanded=\"true\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "tools.enumerate",
+      "selector": "[role=\"menu\"] [role=\"menuitem\"]",
+      "expectedCount": 5
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/claude/signed-in-free/artifacts-list.html b/test/fixtures/provider-dom/claude/signed-in-free/artifacts-list.html
new file mode 100644
index 0000000..67ef686
--- /dev/null
+++ b/test/fixtures/provider-dom/claude/signed-in-free/artifacts-list.html
@@ -0,0 +1,10 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Claude artifacts</title></head>
+  <body>
+      <main>
+        <h1>Artifacts</h1><button aria-label="Search your artifacts">Search</button><button>New artifact</button>
+        <ul aria-label="Artifacts"><li><a href="/chat/[redacted]"><h2>[redacted artifact]</h2></a><span>Edited</span><button aria-label="More options">More</button></li></ul>
+      </main>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/claude/signed-in-free/artifacts-list.provenance.json b/test/fixtures/provider-dom/claude/signed-in-free/artifacts-list.provenance.json
new file mode 100644
index 0000000..00889f3
--- /dev/null
+++ b/test/fixtures/provider-dom/claude/signed-in-free/artifacts-list.provenance.json
@@ -0,0 +1,44 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "claude",
+  "accountState": "signed-in-free",
+  "observedPlan": {
+    "status": "observed",
+    "label": "Free"
+  },
+  "scenario": "artifacts-list",
+  "routeClass": "artifacts",
+  "operationPhase": "observed",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://claude.ai/artifacts",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "c789a86b8560486f1c7ab8826afe7ac1bc99f2f6a9276bc394e8e0c1001bc5b0",
+  "evidenceSelectors": [
+    {
+      "capability": "artifact.list",
+      "selector": "ul[aria-label=\"Artifacts\"] li",
+      "expectedCount": 1
+    },
+    {
+      "capability": "artifact.create",
+      "selector": "button",
+      "expectedCount": 3
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/claude/signed-in-free/connectors-settings.html b/test/fixtures/provider-dom/claude/signed-in-free/connectors-settings.html
new file mode 100644
index 0000000..f76348e
--- /dev/null
+++ b/test/fixtures/provider-dom/claude/signed-in-free/connectors-settings.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Claude connectors settings</title></head>
+  <body>
+      <div role="dialog" aria-label="Settings">
+        <button aria-current="page">Connectors</button>
+        <main>
+          <h2>Connectors</h2><input type="search" aria-label="Search connectors"><button>Add connector</button>
+          <div role="radiogroup" aria-label="Connector status"><button role="radio" aria-checked="true">All</button><button role="radio">Connected</button><button role="radio">Not connected</button></div>
+          <table><thead><tr><th>Connector</th><th>Type</th><th>Status</th></tr></thead><tbody><tr><td>GitHub</td><td>Integration</td><td><button>Connect</button></td></tr><tr><td>Notion</td><td>Integration</td><td><button>Connect</button></td></tr></tbody></table>
+        </main>
+      </div>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/claude/signed-in-free/connectors-settings.provenance.json b/test/fixtures/provider-dom/claude/signed-in-free/connectors-settings.provenance.json
new file mode 100644
index 0000000..a638875
--- /dev/null
+++ b/test/fixtures/provider-dom/claude/signed-in-free/connectors-settings.provenance.json
@@ -0,0 +1,49 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "claude",
+  "accountState": "signed-in-free",
+  "observedPlan": {
+    "status": "observed",
+    "label": "Free"
+  },
+  "scenario": "connectors-settings",
+  "routeClass": "connectors-settings-overlay",
+  "operationPhase": "observed",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://claude.ai/new",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "b6f755ca3d5c6d4a8ad6169284163cc87114628140b75bb1a25ae097ca162910",
+  "evidenceSelectors": [
+    {
+      "capability": "connector.search",
+      "selector": "input[aria-label=\"Search connectors\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "connector.list",
+      "selector": "table tbody tr",
+      "expectedCount": 2
+    },
+    {
+      "capability": "connector.connect",
+      "selector": "table button",
+      "expectedCount": 2
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/claude/signed-in-free/conversation-existing.html b/test/fixtures/provider-dom/claude/signed-in-free/conversation-existing.html
new file mode 100644
index 0000000..42a36c9
--- /dev/null
+++ b/test/fixtures/provider-dom/claude/signed-in-free/conversation-existing.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Claude existing conversation</title></head>
+  <body>
+      <main>
+        <button aria-label="[redacted title], rename chat">[redacted title]</button>
+        <div role="feed" aria-label="Chat messages">
+          <article aria-label="Message 1"><h2>You said:</h2><p>[redacted message]</p></article>
+          <article aria-label="Message 2"><h2>Claude responded:</h2><p>[redacted response]</p></article>
+        </div>
+        <div data-testid="chat-input" role="textbox" contenteditable="true" aria-label="Write your prompt to Claude"></div>
+        <button aria-label="Add files, connectors, and more">Add</button>
+      </main>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/claude/signed-in-free/conversation-existing.provenance.json b/test/fixtures/provider-dom/claude/signed-in-free/conversation-existing.provenance.json
new file mode 100644
index 0000000..de91f0d
--- /dev/null
+++ b/test/fixtures/provider-dom/claude/signed-in-free/conversation-existing.provenance.json
@@ -0,0 +1,44 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "claude",
+  "accountState": "signed-in-free",
+  "observedPlan": {
+    "status": "observed",
+    "label": "Free"
+  },
+  "scenario": "conversation-existing",
+  "routeClass": "conversation",
+  "operationPhase": "conversation-existing",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://claude.ai/chat/[redacted]",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "00db7aa2ff62f6c517158ab9a1c67953b1960c7a34906b8fb1222ef6d3f0d35b",
+  "evidenceSelectors": [
+    {
+      "capability": "job.existing",
+      "selector": "[role=\"feed\"][aria-label=\"Chat messages\"] article",
+      "expectedCount": 2
+    },
+    {
+      "capability": "job.continue",
+      "selector": "[data-testid=\"chat-input\"][role=\"textbox\"]",
+      "expectedCount": 1
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/claude/signed-in-free/projects-list.html b/test/fixtures/provider-dom/claude/signed-in-free/projects-list.html
new file mode 100644
index 0000000..87d8ebc
--- /dev/null
+++ b/test/fixtures/provider-dom/claude/signed-in-free/projects-list.html
@@ -0,0 +1,10 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Claude projects</title></head>
+  <body>
+      <main>
+        <h1>Projects</h1><button aria-label="Search projects">Search projects</button><button aria-label="Sort projects">Sort projects</button><button>New project</button>
+        <ul aria-label="Projects"><li><a href="/project/[redacted]"><h2>[redacted project]</h2></a><button aria-label="Project options">More</button></li></ul>
+      </main>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/claude/signed-in-free/projects-list.provenance.json b/test/fixtures/provider-dom/claude/signed-in-free/projects-list.provenance.json
new file mode 100644
index 0000000..ce74c4f
--- /dev/null
+++ b/test/fixtures/provider-dom/claude/signed-in-free/projects-list.provenance.json
@@ -0,0 +1,44 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "claude",
+  "accountState": "signed-in-free",
+  "observedPlan": {
+    "status": "observed",
+    "label": "Free"
+  },
+  "scenario": "projects-list",
+  "routeClass": "projects",
+  "operationPhase": "workspace-list",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://claude.ai/projects",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "ab88319450fd3a9fa3b0a10ffe97e985b83c1fcfe2160847c3e0ef135961fb44",
+  "evidenceSelectors": [
+    {
+      "capability": "project.list",
+      "selector": "ul[aria-label=\"Projects\"] li",
+      "expectedCount": 1
+    },
+    {
+      "capability": "project.create",
+      "selector": "button",
+      "expectedCount": 4
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/claude/signed-in-free/session-status.html b/test/fixtures/provider-dom/claude/signed-in-free/session-status.html
index 7fae013..598ec60 100644
--- a/test/fixtures/provider-dom/claude/signed-in-free/session-status.html
+++ b/test/fixtures/provider-dom/claude/signed-in-free/session-status.html
@@ -3,8 +3,10 @@
   <head><meta charset="utf-8"><title>Claude signed-in session evidence</title></head>
   <body>
     <!-- Account identity was removed; the visible plan label was retained. -->
-    <button data-testid="user-menu-button" type="button" aria-label="Account settings for [redacted account identity]"><span>[redacted account identity]</span></button>
-    <span>Free plan</span>
+    <button data-testid="user-menu-button" type="button" aria-label="[redacted account identity], Settings">
+      <span>[redacted account identity]</span>
+      <span>Free plan</span>
+    </button>
     <nav>
       <a href="/recents" aria-label="Chats">Chats</a>
       <a href="/projects" aria-label="Projects">Projects</a>
diff --git a/test/fixtures/provider-dom/claude/signed-in-free/session-status.provenance.json b/test/fixtures/provider-dom/claude/signed-in-free/session-status.provenance.json
index c24b8be..ea7fd84 100644
--- a/test/fixtures/provider-dom/claude/signed-in-free/session-status.provenance.json
+++ b/test/fixtures/provider-dom/claude/signed-in-free/session-status.provenance.json
@@ -11,7 +11,7 @@
   "artifactKind": "redacted-reduced-dom",
   "containsProviderJavaScript": false,
   "containsSyntheticBehavior": false,
-  "contentSha256": "fae1195d721fb42bddc717687b5ef28a45ac7881b340515a5d99667aa58ee25b",
+  "contentSha256": "9d74855465a2bae48567acbc7d2f545363305e344e19e77e3397adea8dab85fa",
   "evidenceSelectors": [
     { "capability": "auth.status", "selector": "button[data-testid=\"user-menu-button\"]", "expectedCount": 1 },
     { "capability": "project.inspect", "selector": "a[href=\"/projects\"][aria-label=\"Projects\"]", "expectedCount": 1 },
diff --git a/test/fixtures/provider-dom/claude/signed-in-free/settings-general.html b/test/fixtures/provider-dom/claude/signed-in-free/settings-general.html
new file mode 100644
index 0000000..4c3f8d1
--- /dev/null
+++ b/test/fixtures/provider-dom/claude/signed-in-free/settings-general.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Claude settings</title></head>
+  <body>
+      <div role="dialog" aria-label="Settings">
+        <nav aria-label="Settings sections">
+          <button aria-current="page">General</button><button>Account</button><button>Privacy</button><button>Billing</button>
+          <button>Capabilities</button><button>Reflect</button><button>Time and focus</button><button>Claude Code</button>
+          <button>Skills</button><button>Connectors</button><button>Plugins</button><button>Memory</button>
+        </nav>
+        <main><h2>Profile</h2><label>Full name<input value="[redacted account identity]"></label><label>Display name<input value="[redacted account identity]"></label></main>
+      </div>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/claude/signed-in-free/settings-general.provenance.json b/test/fixtures/provider-dom/claude/signed-in-free/settings-general.provenance.json
new file mode 100644
index 0000000..13d8e0a
--- /dev/null
+++ b/test/fixtures/provider-dom/claude/signed-in-free/settings-general.provenance.json
@@ -0,0 +1,44 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "claude",
+  "accountState": "signed-in-free",
+  "observedPlan": {
+    "status": "observed",
+    "label": "Free"
+  },
+  "scenario": "settings-general",
+  "routeClass": "settings-overlay",
+  "operationPhase": "observed",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://claude.ai/new",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "0d6cd7a582c3fb1869fea9b4cf77ba546a2ac958ab3477c7cb6df6e3879cb16e",
+  "evidenceSelectors": [
+    {
+      "capability": "settings.open",
+      "selector": "[role=\"dialog\"][aria-label=\"Settings\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "settings.sections",
+      "selector": "nav[aria-label=\"Settings sections\"] button",
+      "expectedCount": 12
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/claude/signed-in-free/upload-connectors-menu-open.html b/test/fixtures/provider-dom/claude/signed-in-free/upload-connectors-menu-open.html
new file mode 100644
index 0000000..29789ea
--- /dev/null
+++ b/test/fixtures/provider-dom/claude/signed-in-free/upload-connectors-menu-open.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Claude upload and connectors menu</title></head>
+  <body>
+      <main><button aria-label="Add files, connectors, and more" aria-expanded="true">Add</button></main>
+      <div role="menu" aria-label="Add files, connectors, and more">
+        <div role="menuitem">Add files or photos</div><div role="menuitem">Take a screenshot</div>
+        <div role="menuitem">Add to project</div><div role="menuitem">Skills</div>
+        <div role="menuitem">Add connector</div><div role="menuitem">Add plugins...</div>
+        <div role="menuitemcheckbox" aria-checked="true">Web search</div>
+      </div>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/claude/signed-in-free/upload-connectors-menu-open.provenance.json b/test/fixtures/provider-dom/claude/signed-in-free/upload-connectors-menu-open.provenance.json
new file mode 100644
index 0000000..724a5c0
--- /dev/null
+++ b/test/fixtures/provider-dom/claude/signed-in-free/upload-connectors-menu-open.provenance.json
@@ -0,0 +1,44 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "claude",
+  "accountState": "signed-in-free",
+  "observedPlan": {
+    "status": "observed",
+    "label": "Free"
+  },
+  "scenario": "upload-connectors-menu-open",
+  "routeClass": "new-chat",
+  "operationPhase": "upload-menu-open",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://claude.ai/new",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "2290fb0730f09a76b95bbb227976d8b2ff7b73d1de5b04dfe60797eaca5071a6",
+  "evidenceSelectors": [
+    {
+      "capability": "upload.open",
+      "selector": "button[aria-label=\"Add files, connectors, and more\"][aria-expanded=\"true\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "tools.enumerate",
+      "selector": "[role=\"menu\"] [role^=\"menuitem\"]",
+      "expectedCount": 7
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/claude/signed-out-challenge/cloudflare-security-verification.html b/test/fixtures/provider-dom/claude/signed-out-challenge/cloudflare-security-verification.html
new file mode 100644
index 0000000..c5a191c
--- /dev/null
+++ b/test/fixtures/provider-dom/claude/signed-out-challenge/cloudflare-security-verification.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Just a moment...</title></head>
+  <body>
+    <div role="main">
+      <div>
+        <h1>claude.ai</h1>
+        <h2>Performing security verification</h2>
+        <p>This website uses a security service to protect against malicious bots. This page is displayed while the website verifies you are not a bot.</p>
+      </div>
+      <div>Ray ID: <code>[redacted]</code></div>
+      <div>Performance and Security by <a href="[url]">Cloudflare</a></div>
+    </div>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/claude/signed-out-challenge/cloudflare-security-verification.provenance.json b/test/fixtures/provider-dom/claude/signed-out-challenge/cloudflare-security-verification.provenance.json
new file mode 100644
index 0000000..c08ada9
--- /dev/null
+++ b/test/fixtures/provider-dom/claude/signed-out-challenge/cloudflare-security-verification.provenance.json
@@ -0,0 +1,55 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "claude",
+  "accountState": "signed-out-challenge",
+  "observedPlan": {
+    "status": "unknown",
+    "label": null
+  },
+  "scenario": "cloudflare-security-verification",
+  "routeClass": "new-chat-challenge",
+  "operationPhase": "challenge-visible",
+  "capabilityOutcome": "unavailable",
+  "observedOn": "2026-07-31",
+  "sanitizedUrl": "https://claude.ai/new",
+  "source": "development-visible-provider-session-cdp-observer",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "bfde982ba37a4218d08196dc202be44dd19d570ca022c102198bdabb1c8e4647",
+  "evidenceSelectors": [
+    {
+      "capability": "blocker.check",
+      "selector": "div[role=\"main\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "blocker.check",
+      "selector": "h2",
+      "expectedCount": 1
+    },
+    {
+      "capability": "blocker.check",
+      "selector": "code",
+      "expectedCount": 1
+    }
+  ],
+  "absenceSelectors": [
+    {
+      "purpose": "provider-composer",
+      "selector": "div[data-testid=\"chat-input\"][contenteditable=\"true\"][role=\"textbox\"]",
+      "expectedCount": 0
+    }
+  ],
+  "redactions": [
+    "Cloudflare Ray ID",
+    "network identifiers",
+    "scripts",
+    "styles",
+    "iframe challenge URL"
+  ],
+  "notes": [
+    "Captured from a real visible Claude Cloudflare security-verification interstitial in the selected local managed profile.",
+    "The retained wording and element structure are a reduced subset of the observed page; no transition or provider behavior is simulated."
+  ]
+}
diff --git a/test/fixtures/provider-dom/deepseek/signed-in-unknown/composer-expert.html b/test/fixtures/provider-dom/deepseek/signed-in-unknown/composer-expert.html
new file mode 100644
index 0000000..6e150e6
--- /dev/null
+++ b/test/fixtures/provider-dom/deepseek/signed-in-unknown/composer-expert.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>DeepSeek Expert composer evidence</title></head>
+  <body>
+    <main>
+      <div role="radiogroup">
+        <div role="radio" aria-checked="false"><span>Instant</span></div>
+        <div role="radio" aria-checked="true"><span>Expert</span></div>
+        <div role="radio" aria-checked="false"><span>Vision</span></div>
+      </div>
+      <textarea name="search" placeholder="Message DeepSeek"></textarea>
+      <div class="ds-toggle-button ds-toggle-button--m ds-toggle-button--selected" aria-pressed="true"><span>DeepThink</span></div>
+      <div role="button" class="ds-button ds-button--primary ds-button--disabled"></div>
+    </main>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/deepseek/signed-in-unknown/composer-expert.provenance.json b/test/fixtures/provider-dom/deepseek/signed-in-unknown/composer-expert.provenance.json
new file mode 100644
index 0000000..a2c4afa
--- /dev/null
+++ b/test/fixtures/provider-dom/deepseek/signed-in-unknown/composer-expert.provenance.json
@@ -0,0 +1,30 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "deepseek",
+  "accountState": "signed-in-unknown",
+  "observedPlan": { "status": "unknown", "label": null },
+  "scenario": "composer-expert",
+  "routeClass": "new-chat",
+  "operationPhase": "mode-inspection",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-08-01",
+  "sanitizedUrl": "https://chat.deepseek.com/",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "9ae22e013c8f7a11276e09f640ab0a2e9a8e16fd81dfe7a071e4692ed093069e",
+  "evidenceSelectors": [
+    { "capability": "deepseek.mode.expert", "selector": "[role=\"radio\"][aria-checked=\"true\"]", "expectedCount": 1 },
+    { "capability": "prompt.input", "selector": "textarea[name=\"search\"][placeholder=\"Message DeepSeek\"]", "expectedCount": 1 },
+    { "capability": "deepseek.deepthink", "selector": ".ds-toggle-button[aria-pressed=\"true\"]", "expectedCount": 1 }
+  ],
+  "absenceSelectors": [
+    { "purpose": "file-input-not-observed-in-expert", "selector": "input[type=\"file\"]", "expectedCount": 0 }
+  ],
+  "redactions": ["account identity", "conversation history", "message content", "private route identifiers", "scripts", "styles"],
+  "notes": [
+    "Expert and DeepThink were observed together; Search and the file input were not present in this state.",
+    "No account credentials, browser storage, or unrelated account content were inspected."
+  ]
+}
diff --git a/test/fixtures/provider-dom/deepseek/signed-in-unknown/composer-instant.html b/test/fixtures/provider-dom/deepseek/signed-in-unknown/composer-instant.html
new file mode 100644
index 0000000..a4b58db
--- /dev/null
+++ b/test/fixtures/provider-dom/deepseek/signed-in-unknown/composer-instant.html
@@ -0,0 +1,19 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>DeepSeek Instant composer evidence</title></head>
+  <body>
+    <main>
+      <div role="radiogroup">
+        <div role="radio" aria-checked="true"><span>Instant</span></div>
+        <div role="radio" aria-checked="false"><span>Expert</span></div>
+        <div role="radio" aria-checked="false"><span>Vision</span></div>
+      </div>
+      <textarea name="search" placeholder="Message DeepSeek"></textarea>
+      <div class="ds-toggle-button ds-toggle-button--m ds-toggle-button--selected" aria-pressed="true"><span>DeepThink</span></div>
+      <div class="ds-toggle-button ds-toggle-button--m ds-toggle-button--selected" aria-pressed="true"><span>Search</span></div>
+      <input type="file" multiple accept=".txt,.pdf,.png,.jpg">
+      <div role="button" class="ds-button ds-button--iconLabelPrimary"></div>
+      <div role="button" class="ds-button ds-button--primary ds-button--disabled"></div>
+    </main>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/deepseek/signed-in-unknown/composer-instant.provenance.json b/test/fixtures/provider-dom/deepseek/signed-in-unknown/composer-instant.provenance.json
new file mode 100644
index 0000000..a4ef8e0
--- /dev/null
+++ b/test/fixtures/provider-dom/deepseek/signed-in-unknown/composer-instant.provenance.json
@@ -0,0 +1,32 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "deepseek",
+  "accountState": "signed-in-unknown",
+  "observedPlan": { "status": "unknown", "label": null },
+  "scenario": "composer-instant",
+  "routeClass": "new-chat",
+  "operationPhase": "mode-inspection",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-08-01",
+  "sanitizedUrl": "https://chat.deepseek.com/",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "304c3fad4501ba99fba3cbce2a551bc0371a564ec1d267008507e78a33e09a07",
+  "evidenceSelectors": [
+    { "capability": "deepseek.mode.instant", "selector": "[role=\"radio\"][aria-checked=\"true\"]", "expectedCount": 1 },
+    { "capability": "prompt.input", "selector": "textarea[name=\"search\"][placeholder=\"Message DeepSeek\"]", "expectedCount": 1 },
+    { "capability": "deepseek.deepthink", "selector": ".ds-toggle-button[aria-pressed=\"true\"]", "expectedCount": 2 },
+    { "capability": "deepseek.search", "selector": ".ds-toggle-button[aria-pressed=\"true\"]", "expectedCount": 2 },
+    { "capability": "file.upload", "selector": "input[type=\"file\"][multiple]", "expectedCount": 1 },
+    { "capability": "prompt.submit", "selector": "[role=\"button\"].ds-button--primary.ds-button--disabled", "expectedCount": 1 }
+  ],
+  "absenceSelectors": [],
+  "redactions": ["account identity", "conversation history", "message content", "private route identifiers", "scripts", "styles"],
+  "notes": [
+    "Instant, DeepThink, Search, file input, and the disabled empty-state submit control were observed together.",
+    "The real file input accept list included text, document, and image formats; the reduced fixture retains representative .txt, .pdf, .png, and .jpg entries.",
+    "No account credentials, browser storage, or unrelated account content were inspected."
+  ]
+}
diff --git a/test/fixtures/provider-dom/deepseek/signed-in-unknown/composer-vision.html b/test/fixtures/provider-dom/deepseek/signed-in-unknown/composer-vision.html
new file mode 100644
index 0000000..f8d13e4
--- /dev/null
+++ b/test/fixtures/provider-dom/deepseek/signed-in-unknown/composer-vision.html
@@ -0,0 +1,18 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>DeepSeek Vision composer evidence</title></head>
+  <body>
+    <main>
+      <div role="radiogroup">
+        <div role="radio" aria-checked="false"><span>Instant</span></div>
+        <div role="radio" aria-checked="false"><span>Expert</span></div>
+        <div role="radio" aria-checked="true"><span>Vision</span></div>
+      </div>
+      <textarea name="search" placeholder="Message DeepSeek"></textarea>
+      <div class="ds-toggle-button ds-toggle-button--m ds-toggle-button--selected" aria-pressed="true"><span>DeepThink</span></div>
+      <input type="file" multiple accept=".txt,.pdf,.png,.jpg">
+      <div role="button" class="ds-button ds-button--iconLabelPrimary"></div>
+      <div role="button" class="ds-button ds-button--primary ds-button--disabled"></div>
+    </main>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/deepseek/signed-in-unknown/composer-vision.provenance.json b/test/fixtures/provider-dom/deepseek/signed-in-unknown/composer-vision.provenance.json
new file mode 100644
index 0000000..f24d038
--- /dev/null
+++ b/test/fixtures/provider-dom/deepseek/signed-in-unknown/composer-vision.provenance.json
@@ -0,0 +1,30 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "deepseek",
+  "accountState": "signed-in-unknown",
+  "observedPlan": { "status": "unknown", "label": null },
+  "scenario": "composer-vision",
+  "routeClass": "new-chat",
+  "operationPhase": "mode-inspection",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-08-01",
+  "sanitizedUrl": "https://chat.deepseek.com/",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "5fd3baa2d5fbaa336c6bf68a917b2d87ab0d64405a8019fc2800682a6b0a2d23",
+  "evidenceSelectors": [
+    { "capability": "deepseek.mode.vision", "selector": "[role=\"radio\"][aria-checked=\"true\"]", "expectedCount": 1 },
+    { "capability": "prompt.input", "selector": "textarea[name=\"search\"][placeholder=\"Message DeepSeek\"]", "expectedCount": 1 },
+    { "capability": "deepseek.deepthink", "selector": ".ds-toggle-button[aria-pressed=\"true\"]", "expectedCount": 1 },
+    { "capability": "file.upload", "selector": "input[type=\"file\"][multiple]", "expectedCount": 1 }
+  ],
+  "absenceSelectors": [],
+  "redactions": ["account identity", "conversation history", "message content", "private route identifiers", "scripts", "styles"],
+  "notes": [
+    "Vision, DeepThink, and the file input were observed together; Search was not present in this state.",
+    "The real file input accept list included text, document, and image formats; the reduced fixture retains representative .txt, .pdf, .png, and .jpg entries.",
+    "No account credentials, browser storage, or unrelated account content were inspected."
+  ]
+}
diff --git a/test/fixtures/provider-dom/deepseek/signed-in-unknown/deepthink-response-complete.html b/test/fixtures/provider-dom/deepseek/signed-in-unknown/deepthink-response-complete.html
new file mode 100644
index 0000000..0b505cf
--- /dev/null
+++ b/test/fixtures/provider-dom/deepseek/signed-in-unknown/deepthink-response-complete.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>DeepSeek DeepThink response evidence</title></head>
+  <body>
+    <main>
+      <div role="radiogroup"><div role="radio" aria-checked="true"><span>Instant</span></div></div>
+      <div class="ds-toggle-button ds-toggle-button--selected" aria-pressed="true"><span>DeepThink</span></div>
+      <div><div class="ds-think-content"><div class="ds-markdown">[redacted-test-reasoning]</div></div></div>
+      <div class="ds-message"><div class="ds-markdown ds-assistant-message-main-content">[redacted-test-response]</div></div>
+      <textarea name="search" placeholder="Message DeepSeek"></textarea>
+    </main>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/deepseek/signed-in-unknown/deepthink-response-complete.provenance.json b/test/fixtures/provider-dom/deepseek/signed-in-unknown/deepthink-response-complete.provenance.json
new file mode 100644
index 0000000..864052f
--- /dev/null
+++ b/test/fixtures/provider-dom/deepseek/signed-in-unknown/deepthink-response-complete.provenance.json
@@ -0,0 +1,25 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "deepseek",
+  "accountState": "signed-in-unknown",
+  "observedPlan": { "status": "unknown", "label": null },
+  "scenario": "deepthink-response-complete",
+  "routeClass": "conversation",
+  "operationPhase": "response-complete",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-08-01",
+  "sanitizedUrl": "https://chat.deepseek.com/a/chat/s/[redacted]",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "30dbd73fb66c352a682a1bb2c85a618e357d81a29cbdc95c11ceac321b23a21a",
+  "evidenceSelectors": [
+    { "capability": "deepseek.deepthink", "selector": ".ds-toggle-button[aria-pressed=\"true\"]", "expectedCount": 1 },
+    { "capability": "reasoning.visible", "selector": ".ds-think-content > .ds-markdown", "expectedCount": 1 },
+    { "capability": "response.read", "selector": ".ds-message > .ds-markdown.ds-assistant-message-main-content", "expectedCount": 1 }
+  ],
+  "absenceSelectors": [],
+  "redactions": ["account identity", "conversation history", "prompt content", "reasoning content", "response content", "private route identifiers", "scripts", "styles"],
+  "notes": ["DeepThink produced a distinct visible reasoning container followed by a final assistant message."]
+}
diff --git a/test/fixtures/provider-dom/deepseek/signed-in-unknown/response-complete.html b/test/fixtures/provider-dom/deepseek/signed-in-unknown/response-complete.html
new file mode 100644
index 0000000..8b8ad82
--- /dev/null
+++ b/test/fixtures/provider-dom/deepseek/signed-in-unknown/response-complete.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>DeepSeek completed response evidence</title></head>
+  <body>
+    <main>
+      <div role="radiogroup"><div role="radio" aria-checked="true"><span>Instant</span></div></div>
+      <div class="ds-message"><div class="ds-markdown ds-assistant-message-main-content">[redacted-test-response]</div></div>
+      <textarea name="search" placeholder="Message DeepSeek"></textarea>
+      <div role="button" class="ds-button ds-button--primary ds-button--disabled"></div>
+    </main>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/deepseek/signed-in-unknown/response-complete.provenance.json b/test/fixtures/provider-dom/deepseek/signed-in-unknown/response-complete.provenance.json
new file mode 100644
index 0000000..75bd048
--- /dev/null
+++ b/test/fixtures/provider-dom/deepseek/signed-in-unknown/response-complete.provenance.json
@@ -0,0 +1,27 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "deepseek",
+  "accountState": "signed-in-unknown",
+  "observedPlan": { "status": "unknown", "label": null },
+  "scenario": "response-complete",
+  "routeClass": "conversation",
+  "operationPhase": "response-complete",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-08-01",
+  "sanitizedUrl": "https://chat.deepseek.com/a/chat/s/[redacted]",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "8c1d9c9ff90b3b4649685c7df4b805ea997cfcd8d191044918947971151156c6",
+  "evidenceSelectors": [
+    { "capability": "response.read", "selector": ".ds-message > .ds-markdown.ds-assistant-message-main-content", "expectedCount": 1 },
+    { "capability": "conversation.continue", "selector": "textarea[name=\"search\"][placeholder=\"Message DeepSeek\"]", "expectedCount": 1 },
+    { "capability": "prompt.submit", "selector": "[role=\"button\"].ds-button--primary.ds-button--disabled", "expectedCount": 1 }
+  ],
+  "absenceSelectors": [
+    { "purpose": "deepthink-content-not-present", "selector": ".ds-think-content", "expectedCount": 0 }
+  ],
+  "redactions": ["account identity", "conversation history", "prompt content", "response content", "private route identifiers", "scripts", "styles"],
+  "notes": ["A correlated Instant response and same-conversation composer were observed with unique test markers."]
+}
diff --git a/test/fixtures/provider-dom/deepseek/signed-in-unknown/search-response-complete.html b/test/fixtures/provider-dom/deepseek/signed-in-unknown/search-response-complete.html
new file mode 100644
index 0000000..3540a17
--- /dev/null
+++ b/test/fixtures/provider-dom/deepseek/signed-in-unknown/search-response-complete.html
@@ -0,0 +1,18 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>DeepSeek Search response evidence</title></head>
+  <body>
+    <main>
+      <div role="radiogroup"><div role="radio" aria-checked="true"><span>Instant</span></div></div>
+      <div class="ds-toggle-button ds-toggle-button--selected" aria-pressed="true"><span>Search</span></div>
+      <div class="ds-message">
+        <div class="ds-markdown ds-assistant-message-main-content">
+          [redacted-test-response]
+          <a href="https://nodejs.org/">https://nodejs.org/</a>
+          <a href="https://raw.githubusercontent.com/nodejs/nodejs.org/main/README.md">-7</a>
+        </div>
+      </div>
+      <textarea name="search" placeholder="Message DeepSeek"></textarea>
+    </main>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/deepseek/signed-in-unknown/search-response-complete.provenance.json b/test/fixtures/provider-dom/deepseek/signed-in-unknown/search-response-complete.provenance.json
new file mode 100644
index 0000000..ca08dfd
--- /dev/null
+++ b/test/fixtures/provider-dom/deepseek/signed-in-unknown/search-response-complete.provenance.json
@@ -0,0 +1,26 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "deepseek",
+  "accountState": "signed-in-unknown",
+  "observedPlan": { "status": "unknown", "label": null },
+  "scenario": "search-response-complete",
+  "routeClass": "conversation",
+  "operationPhase": "response-complete",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-08-01",
+  "sanitizedUrl": "https://chat.deepseek.com/a/chat/s/[redacted]",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "243a188d6d15dd54b0c03bba4951ee8ec1241dae77b6a2d8fec4f3f87ed70b1a",
+  "evidenceSelectors": [
+    { "capability": "deepseek.search", "selector": ".ds-toggle-button[aria-pressed=\"true\"]", "expectedCount": 1 },
+    { "capability": "response.read", "selector": ".ds-message > .ds-markdown.ds-assistant-message-main-content", "expectedCount": 1 },
+    { "capability": "response.citations", "selector": ".ds-assistant-message-main-content a[href=\"https://nodejs.org/\"]", "expectedCount": 1 },
+    { "capability": "response.citations", "selector": ".ds-assistant-message-main-content a[href^=\"https://raw.githubusercontent.com/nodejs/\"]", "expectedCount": 1 }
+  ],
+  "absenceSelectors": [],
+  "redactions": ["account identity", "conversation history", "prompt content", "response content", "private route identifiers", "scripts", "styles"],
+  "notes": ["Search produced a grounded visible response containing direct and numbered public source links."]
+}
diff --git a/test/fixtures/provider-dom/gemini/signed-in-unknown/conversation-existing.html b/test/fixtures/provider-dom/gemini/signed-in-unknown/conversation-existing.html
new file mode 100644
index 0000000..f195eee
--- /dev/null
+++ b/test/fixtures/provider-dom/gemini/signed-in-unknown/conversation-existing.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Gemini existing conversation</title></head>
+  <body>
+      <main>
+        <button aria-label="Open menu for conversation actions.">More</button>
+        <h1>Conversation with Gemini</h1>
+        <section aria-label="Conversation turns"><article><h2>You said</h2><p>[redacted message]</p></article><article><h2>Gemini said</h2><p>[redacted response]</p><button aria-label="Good response">Good</button><button aria-label="Copy">Copy</button></article></section>
+        <div role="textbox" contenteditable="true" aria-label="Enter a prompt for Gemini"></div>
+      </main>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/gemini/signed-in-unknown/conversation-existing.provenance.json b/test/fixtures/provider-dom/gemini/signed-in-unknown/conversation-existing.provenance.json
new file mode 100644
index 0000000..771daec
--- /dev/null
+++ b/test/fixtures/provider-dom/gemini/signed-in-unknown/conversation-existing.provenance.json
@@ -0,0 +1,44 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "gemini",
+  "accountState": "signed-in-unknown",
+  "observedPlan": {
+    "status": "unknown",
+    "label": null
+  },
+  "scenario": "conversation-existing",
+  "routeClass": "conversation",
+  "operationPhase": "conversation-existing",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://gemini.google.com/app/[redacted]",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "8cf0d149eb6666b471aa430f89978c951cc1240966372256d962e956d63c2640",
+  "evidenceSelectors": [
+    {
+      "capability": "job.existing",
+      "selector": "section[aria-label=\"Conversation turns\"] article",
+      "expectedCount": 2
+    },
+    {
+      "capability": "job.continue",
+      "selector": "[role=\"textbox\"][aria-label=\"Enter a prompt for Gemini\"]",
+      "expectedCount": 1
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/gemini/signed-in-unknown/image-workspace.html b/test/fixtures/provider-dom/gemini/signed-in-unknown/image-workspace.html
new file mode 100644
index 0000000..51597ff
--- /dev/null
+++ b/test/fixtures/provider-dom/gemini/signed-in-unknown/image-workspace.html
@@ -0,0 +1,10 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Gemini image workspace</title></head>
+  <body>
+      <main>
+        <div role="textbox" contenteditable="true" aria-label="Enter a prompt for Gemini" data-placeholder="Describe your image"></div>
+        <div role="dialog" aria-label="Create images"><h2>Create images</h2><p>with Nano Banana 2</p><section><h3>Try a template</h3><p>Just add an image to get started</p></section><section><h3>Visualise anything</h3><p>Describe an idea in chat</p></section><button>Try it</button></div>
+      </main>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/gemini/signed-in-unknown/image-workspace.provenance.json b/test/fixtures/provider-dom/gemini/signed-in-unknown/image-workspace.provenance.json
new file mode 100644
index 0000000..44bd865
--- /dev/null
+++ b/test/fixtures/provider-dom/gemini/signed-in-unknown/image-workspace.provenance.json
@@ -0,0 +1,44 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "gemini",
+  "accountState": "signed-in-unknown",
+  "observedPlan": {
+    "status": "unknown",
+    "label": null
+  },
+  "scenario": "image-workspace",
+  "routeClass": "images",
+  "operationPhase": "observed",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://gemini.google.com/images",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "983c4d740815ddb2881207daadd905c913906301d4e428b946dac5d253dd77f0",
+  "evidenceSelectors": [
+    {
+      "capability": "image.create",
+      "selector": "[role=\"dialog\"][aria-label=\"Create images\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "image.prompt",
+      "selector": "[role=\"textbox\"][data-placeholder=\"Describe your image\"]",
+      "expectedCount": 1
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/gemini/signed-in-unknown/library-media.html b/test/fixtures/provider-dom/gemini/signed-in-unknown/library-media.html
new file mode 100644
index 0000000..96564d0
--- /dev/null
+++ b/test/fixtures/provider-dom/gemini/signed-in-unknown/library-media.html
@@ -0,0 +1,10 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Gemini library</title></head>
+  <body>
+      <main>
+        <h1>Library</h1><section aria-label="Documents"><h2>Documents</h2><p>Documents that you create will appear here</p></section>
+        <section aria-label="Media"><h2>Media</h2><button aria-label="Preview or open"><img alt="[redacted media]"></button><button aria-label="Delete media">Delete</button></section>
+      </main>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/gemini/signed-in-unknown/library-media.provenance.json b/test/fixtures/provider-dom/gemini/signed-in-unknown/library-media.provenance.json
new file mode 100644
index 0000000..8924bc3
--- /dev/null
+++ b/test/fixtures/provider-dom/gemini/signed-in-unknown/library-media.provenance.json
@@ -0,0 +1,44 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "gemini",
+  "accountState": "signed-in-unknown",
+  "observedPlan": {
+    "status": "unknown",
+    "label": null
+  },
+  "scenario": "library-media",
+  "routeClass": "library",
+  "operationPhase": "observed",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://gemini.google.com/library",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "0f443d262ae8c52d7cba16ecb6a5326ad6c8fc3ae931b326d0fe73db2fac89be",
+  "evidenceSelectors": [
+    {
+      "capability": "library.sections",
+      "selector": "main section",
+      "expectedCount": 2
+    },
+    {
+      "capability": "image.retrieve",
+      "selector": "button[aria-label=\"Preview or open\"] img",
+      "expectedCount": 1
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/gemini/signed-in-unknown/search-chats.html b/test/fixtures/provider-dom/gemini/signed-in-unknown/search-chats.html
new file mode 100644
index 0000000..fb91916
--- /dev/null
+++ b/test/fixtures/provider-dom/gemini/signed-in-unknown/search-chats.html
@@ -0,0 +1,10 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Gemini chat search</title></head>
+  <body>
+      <main>
+        <input role="textbox" aria-label="Search chats"><h3>Recent</h3>
+        <div role="listbox" aria-label="Recent"><div role="option">[redacted conversation]<span>[redacted date]</span></div><div role="option">[redacted conversation]<span>[redacted date]</span></div></div>
+      </main>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/gemini/signed-in-unknown/search-chats.provenance.json b/test/fixtures/provider-dom/gemini/signed-in-unknown/search-chats.provenance.json
new file mode 100644
index 0000000..2bd9c21
--- /dev/null
+++ b/test/fixtures/provider-dom/gemini/signed-in-unknown/search-chats.provenance.json
@@ -0,0 +1,44 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "gemini",
+  "accountState": "signed-in-unknown",
+  "observedPlan": {
+    "status": "unknown",
+    "label": null
+  },
+  "scenario": "search-chats",
+  "routeClass": "chat-search",
+  "operationPhase": "observed",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://gemini.google.com/search",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "9cee327d575bbc6ea25c6d0cb5a4f336cabfde14ffd5ba29ff01489b43dc2628",
+  "evidenceSelectors": [
+    {
+      "capability": "job.search",
+      "selector": "[role=\"textbox\"][aria-label=\"Search chats\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "job.history",
+      "selector": "[role=\"listbox\"][aria-label=\"Recent\"] [role=\"option\"]",
+      "expectedCount": 2
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/gemini/signed-in-unknown/settings-menu-open.html b/test/fixtures/provider-dom/gemini/signed-in-unknown/settings-menu-open.html
new file mode 100644
index 0000000..fc2655e
--- /dev/null
+++ b/test/fixtures/provider-dom/gemini/signed-in-unknown/settings-menu-open.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Gemini settings menu</title></head>
+  <body>
+      <button aria-label="Settings" aria-expanded="true">Settings</button>
+      <div role="menu" aria-label="Settings">
+        <div role="menuitem">Activity</div><div role="menuitem">Personal Intelligence</div><div role="menuitem">Import memory to Gemini</div>
+        <div role="menuitem">Usage limits</div><div role="menuitem">Gems</div><div role="menuitem">Your public links</div>
+        <div role="menuitem">Theme</div><div role="menuitem">View subscriptions</div><div role="menuitem">Gemini Notebook</div>
+      </div>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/gemini/signed-in-unknown/settings-menu-open.provenance.json b/test/fixtures/provider-dom/gemini/signed-in-unknown/settings-menu-open.provenance.json
new file mode 100644
index 0000000..460af58
--- /dev/null
+++ b/test/fixtures/provider-dom/gemini/signed-in-unknown/settings-menu-open.provenance.json
@@ -0,0 +1,44 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "gemini",
+  "accountState": "signed-in-unknown",
+  "observedPlan": {
+    "status": "unknown",
+    "label": null
+  },
+  "scenario": "settings-menu-open",
+  "routeClass": "settings-menu",
+  "operationPhase": "observed",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://gemini.google.com/app",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "3068edc13761d162e77000e1e56a95f757fa37d8047df08f193b9f77948c8010",
+  "evidenceSelectors": [
+    {
+      "capability": "settings.open",
+      "selector": "button[aria-label=\"Settings\"][aria-expanded=\"true\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "settings.sections",
+      "selector": "[role=\"menu\"][aria-label=\"Settings\"] [role=\"menuitem\"]",
+      "expectedCount": 9
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/gemini/signed-in-unknown/upload-sources-open.html b/test/fixtures/provider-dom/gemini/signed-in-unknown/upload-sources-open.html
new file mode 100644
index 0000000..76606ef
--- /dev/null
+++ b/test/fixtures/provider-dom/gemini/signed-in-unknown/upload-sources-open.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Gemini upload sources</title></head>
+  <body>
+      <div role="menu" aria-label="Menu options"><button aria-label="More uploads" aria-expanded="true">More uploads</button></div>
+      <div role="group" aria-label="More upload options"><div role="menuitem">Google Photos</div><div role="menuitem">Avatar</div><div role="menuitem">Notebooks</div></div>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/gemini/signed-in-unknown/upload-sources-open.provenance.json b/test/fixtures/provider-dom/gemini/signed-in-unknown/upload-sources-open.provenance.json
new file mode 100644
index 0000000..dcfde21
--- /dev/null
+++ b/test/fixtures/provider-dom/gemini/signed-in-unknown/upload-sources-open.provenance.json
@@ -0,0 +1,44 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "gemini",
+  "accountState": "signed-in-unknown",
+  "observedPlan": {
+    "status": "unknown",
+    "label": null
+  },
+  "scenario": "upload-sources-open",
+  "routeClass": "new-chat",
+  "operationPhase": "upload-menu-open",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://gemini.google.com/app",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "420d106525f98a38967552c7e27e107ab4febc9b79b3dd30841c89890b6de3b0",
+  "evidenceSelectors": [
+    {
+      "capability": "upload.sources",
+      "selector": "[role=\"group\"][aria-label=\"More upload options\"] [role=\"menuitem\"]",
+      "expectedCount": 3
+    },
+    {
+      "capability": "upload.expand",
+      "selector": "button[aria-label=\"More uploads\"][aria-expanded=\"true\"]",
+      "expectedCount": 1
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/gemini/signed-in-unknown/upload-tools-menu-open.html b/test/fixtures/provider-dom/gemini/signed-in-unknown/upload-tools-menu-open.html
new file mode 100644
index 0000000..d0fb2ec
--- /dev/null
+++ b/test/fixtures/provider-dom/gemini/signed-in-unknown/upload-tools-menu-open.html
@@ -0,0 +1,11 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Gemini upload and tools menu</title></head>
+  <body>
+      <main><button aria-label="Upload and tools" aria-expanded="true">Add</button></main>
+      <div role="menu" aria-label="Menu options">
+        <div role="menuitem" aria-label="Upload files. Documents, data, code files">Upload files</div><div role="menuitem" aria-label="Add from Drive. Sheets, Docs, Slides">Add from Drive</div>
+        <button aria-label="More uploads">More uploads</button><div role="menuitemcheckbox">Create image</div><div role="menuitemcheckbox">Canvas</div><div role="menuitemcheckbox">Deep Research</div>
+      </div>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/gemini/signed-in-unknown/upload-tools-menu-open.provenance.json b/test/fixtures/provider-dom/gemini/signed-in-unknown/upload-tools-menu-open.provenance.json
new file mode 100644
index 0000000..324d682
--- /dev/null
+++ b/test/fixtures/provider-dom/gemini/signed-in-unknown/upload-tools-menu-open.provenance.json
@@ -0,0 +1,44 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "gemini",
+  "accountState": "signed-in-unknown",
+  "observedPlan": {
+    "status": "unknown",
+    "label": null
+  },
+  "scenario": "upload-tools-menu-open",
+  "routeClass": "new-chat",
+  "operationPhase": "upload-menu-open",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://gemini.google.com/app",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "f3d0db9158c5d71e006e6676a84409828662af8263965829273b050eba3d2f61",
+  "evidenceSelectors": [
+    {
+      "capability": "upload.open",
+      "selector": "button[aria-label=\"Upload and tools\"][aria-expanded=\"true\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "tools.enumerate",
+      "selector": "[role=\"menu\"] [role^=\"menuitem\"]",
+      "expectedCount": 5
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/gemini/signed-out-guest/mode-picker.html b/test/fixtures/provider-dom/gemini/signed-out-guest/mode-picker.html
new file mode 100644
index 0000000..611d426
--- /dev/null
+++ b/test/fixtures/provider-dom/gemini/signed-out-guest/mode-picker.html
@@ -0,0 +1,9 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Gemini guest mode picker</title></head>
+  <body>
+    <button aria-label="Sign in"></button>
+    <div role="textbox" contenteditable="true" aria-label="Enter a prompt for Gemini"></div>
+    <button data-test-id="bard-mode-menu-button" aria-label="Open mode picker, currently Flash-Lite">Flash-Lite</button>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/gemini/signed-out-guest/mode-picker.provenance.json b/test/fixtures/provider-dom/gemini/signed-out-guest/mode-picker.provenance.json
new file mode 100644
index 0000000..916d6e6
--- /dev/null
+++ b/test/fixtures/provider-dom/gemini/signed-out-guest/mode-picker.provenance.json
@@ -0,0 +1,41 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "gemini",
+  "accountState": "signed-out-guest",
+  "observedPlan": {
+    "status": "unknown",
+    "label": null
+  },
+  "scenario": "mode-picker",
+  "routeClass": "new-chat",
+  "operationPhase": "choice-inspection",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-28",
+  "sanitizedUrl": "https://gemini.google.com/",
+  "source": "managed-visible-provider-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "1c39741699ca6d5282b35f9c76ee81194bd239d82e72d8a08e3fa80ca624beda",
+  "evidenceSelectors": [
+    {
+      "capability": "prompt.input",
+      "selector": "[contenteditable=\"true\"][role=\"textbox\"][aria-label=\"Enter a prompt for Gemini\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "model.choice",
+      "selector": "button[data-test-id=\"bard-mode-menu-button\"]",
+      "expectedCount": 1
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "conversation history",
+    "message content",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ]
+}
diff --git a/test/fixtures/provider-dom/grok/signed-in-free/attach-menu-open.html b/test/fixtures/provider-dom/grok/signed-in-free/attach-menu-open.html
new file mode 100644
index 0000000..4792238
--- /dev/null
+++ b/test/fixtures/provider-dom/grok/signed-in-free/attach-menu-open.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Grok attachment menu</title></head>
+  <body>
+      <main><button data-testid="attach-button" aria-label="Attach" aria-expanded="true">Attach</button></main>
+      <div role="menu" aria-label="Attach"><div role="menuitem">Upload a file</div><div role="menuitem">Recent</div><div role="menuitem">Skills</div><div role="menuitem">Add connector</div></div>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/grok/signed-in-free/attach-menu-open.provenance.json b/test/fixtures/provider-dom/grok/signed-in-free/attach-menu-open.provenance.json
new file mode 100644
index 0000000..174982b
--- /dev/null
+++ b/test/fixtures/provider-dom/grok/signed-in-free/attach-menu-open.provenance.json
@@ -0,0 +1,44 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "grok",
+  "accountState": "signed-in-free",
+  "observedPlan": {
+    "status": "observed",
+    "label": "Free"
+  },
+  "scenario": "attach-menu-open",
+  "routeClass": "new-chat",
+  "operationPhase": "upload-menu-open",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://grok.com/",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "f3507e5ac81868009e4b2336d14b9cd7dc6987372c3ec2ef3d04897a30bfa1b4",
+  "evidenceSelectors": [
+    {
+      "capability": "upload.open",
+      "selector": "button[data-testid=\"attach-button\"][aria-expanded=\"true\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "tools.enumerate",
+      "selector": "[role=\"menu\"][aria-label=\"Attach\"] [role=\"menuitem\"]",
+      "expectedCount": 4
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/grok/signed-in-free/automation-new.html b/test/fixtures/provider-dom/grok/signed-in-free/automation-new.html
new file mode 100644
index 0000000..e8fb275
--- /dev/null
+++ b/test/fixtures/provider-dom/grok/signed-in-free/automation-new.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Grok new automation</title></head>
+  <body>
+      <div role="dialog" aria-label="New Automation">
+        <button aria-label="Close">Close</button><input aria-label="Automation Name" value="My Automation"><h3>Triggers</h3><button>Add Trigger</button>
+        <h3>Instructions</h3><div role="textbox" contenteditable="true" aria-label="Ask Grok anything"></div><button aria-label="Attach">Attach</button>
+        <button aria-label="Connectors">Connectors 0</button><button aria-label="Skills">Skills 0</button><button aria-label="Model select">Fast</button>
+        <button>Cancel</button><button disabled>Save</button>
+      </div>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/grok/signed-in-free/automation-new.provenance.json b/test/fixtures/provider-dom/grok/signed-in-free/automation-new.provenance.json
new file mode 100644
index 0000000..9f8936a
--- /dev/null
+++ b/test/fixtures/provider-dom/grok/signed-in-free/automation-new.provenance.json
@@ -0,0 +1,49 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "grok",
+  "accountState": "signed-in-free",
+  "observedPlan": {
+    "status": "observed",
+    "label": "Free"
+  },
+  "scenario": "automation-new",
+  "routeClass": "automation-create-overlay",
+  "operationPhase": "observed",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://grok.com/automations",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "4fa162d9ca67e4ac7ef89d0eca19076e8dff954c477ce47b89f001113535317d",
+  "evidenceSelectors": [
+    {
+      "capability": "automation.form",
+      "selector": "[role=\"dialog\"][aria-label=\"New Automation\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "automation.trigger",
+      "selector": "button:not([disabled])",
+      "expectedCount": 7
+    },
+    {
+      "capability": "automation.save-guard",
+      "selector": "button[disabled]",
+      "expectedCount": 1
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/grok/signed-in-free/automations-list.html b/test/fixtures/provider-dom/grok/signed-in-free/automations-list.html
new file mode 100644
index 0000000..7aaabdd
--- /dev/null
+++ b/test/fixtures/provider-dom/grok/signed-in-free/automations-list.html
@@ -0,0 +1,10 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Grok automations</title></head>
+  <body>
+      <main>
+        <h1>Automations</h1><button aria-label="New Automation">New Automation</button><h2>Suggested</h2>
+        <section aria-label="Suggested automations"><article><h3>Email Auto-Responder</h3><button>Add</button></article><article><h3>Daily Stock Tracker</h3><button>Add</button></article><article><h3>Task Extractor</h3><button>Add</button></article></section>
+      </main>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/grok/signed-in-free/automations-list.provenance.json b/test/fixtures/provider-dom/grok/signed-in-free/automations-list.provenance.json
new file mode 100644
index 0000000..c18c88d
--- /dev/null
+++ b/test/fixtures/provider-dom/grok/signed-in-free/automations-list.provenance.json
@@ -0,0 +1,44 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "grok",
+  "accountState": "signed-in-free",
+  "observedPlan": {
+    "status": "observed",
+    "label": "Free"
+  },
+  "scenario": "automations-list",
+  "routeClass": "automations",
+  "operationPhase": "observed",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://grok.com/automations",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "aa932ecf3cd5db0fca085669b48678df81c7b47289d32d4da415a5d9d99269c3",
+  "evidenceSelectors": [
+    {
+      "capability": "automation.list",
+      "selector": "section[aria-label=\"Suggested automations\"] article",
+      "expectedCount": 3
+    },
+    {
+      "capability": "automation.create",
+      "selector": "button[aria-label=\"New Automation\"]",
+      "expectedCount": 1
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/grok/signed-in-free/connectors-list.html b/test/fixtures/provider-dom/grok/signed-in-free/connectors-list.html
new file mode 100644
index 0000000..051b404
--- /dev/null
+++ b/test/fixtures/provider-dom/grok/signed-in-free/connectors-list.html
@@ -0,0 +1,10 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Grok connectors</title></head>
+  <body>
+      <main>
+        <h1>Skills and Connectors</h1><button>New Connector</button><div role="tablist"><button role="tab">Skills</button><button role="tab" aria-selected="true">Connectors</button></div><input type="search" aria-label="Search">
+        <section aria-label="Featured connectors"><button>Gmail</button><button>Google Calendar</button><button>Google Drive</button><button>GitHub</button><button>Box</button><button>Canva</button><button>Notion</button><button>Stripe</button><button>Vercel</button></section>
+      </main>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/grok/signed-in-free/connectors-list.provenance.json b/test/fixtures/provider-dom/grok/signed-in-free/connectors-list.provenance.json
new file mode 100644
index 0000000..6b2e16e
--- /dev/null
+++ b/test/fixtures/provider-dom/grok/signed-in-free/connectors-list.provenance.json
@@ -0,0 +1,44 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "grok",
+  "accountState": "signed-in-free",
+  "observedPlan": {
+    "status": "observed",
+    "label": "Free"
+  },
+  "scenario": "connectors-list",
+  "routeClass": "connectors",
+  "operationPhase": "observed",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://grok.com/connectors",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "67b0b06605482b317291ab65dfc8c90cbc376ffffc4d3c53c3974b134c9e23bc",
+  "evidenceSelectors": [
+    {
+      "capability": "connector.list",
+      "selector": "section[aria-label=\"Featured connectors\"] button",
+      "expectedCount": 9
+    },
+    {
+      "capability": "connector.create",
+      "selector": "main > button",
+      "expectedCount": 1
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/grok/signed-in-free/imagine-workspace.html b/test/fixtures/provider-dom/grok/signed-in-free/imagine-workspace.html
new file mode 100644
index 0000000..fc43c6d
--- /dev/null
+++ b/test/fixtures/provider-dom/grok/signed-in-free/imagine-workspace.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Grok Imagine workspace</title></head>
+  <body>
+      <main>
+        <h1>Featured Templates</h1><section aria-label="Featured templates"><button>Glossy Product Shot</button><button>Chibi</button><button>Object Remover</button><button>Professional Headshot</button></section>
+        <div role="textbox" contenteditable="true" aria-label="Ask Grok anything" data-placeholder="Type to imagine"></div><button aria-label="Upload">Upload</button>
+        <div role="radiogroup" aria-label="Generation mode"><label><input type="radio" checked>Image</label><label><input type="radio">Video</label><label><input type="radio">Agent</label></div>
+        <button aria-label="Image Count">Auto</button><button aria-label="Aspect Ratio">2:3</button>
+      </main>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/grok/signed-in-free/imagine-workspace.provenance.json b/test/fixtures/provider-dom/grok/signed-in-free/imagine-workspace.provenance.json
new file mode 100644
index 0000000..f073c2a
--- /dev/null
+++ b/test/fixtures/provider-dom/grok/signed-in-free/imagine-workspace.provenance.json
@@ -0,0 +1,49 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "grok",
+  "accountState": "signed-in-free",
+  "observedPlan": {
+    "status": "observed",
+    "label": "Free"
+  },
+  "scenario": "imagine-workspace",
+  "routeClass": "imagine",
+  "operationPhase": "observed",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://grok.com/imagine",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "e9c87ab2c6be19e822160e899829dd2ebe16d99c223d737dd77aecd38591d4ca",
+  "evidenceSelectors": [
+    {
+      "capability": "image.prompt",
+      "selector": "[role=\"textbox\"][data-placeholder=\"Type to imagine\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "image.mode",
+      "selector": "[role=\"radiogroup\"][aria-label=\"Generation mode\"] input",
+      "expectedCount": 3
+    },
+    {
+      "capability": "image.upload",
+      "selector": "button[aria-label=\"Upload\"]",
+      "expectedCount": 1
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/grok/signed-in-free/model-menu-open.html b/test/fixtures/provider-dom/grok/signed-in-free/model-menu-open.html
new file mode 100644
index 0000000..45350a8
--- /dev/null
+++ b/test/fixtures/provider-dom/grok/signed-in-free/model-menu-open.html
@@ -0,0 +1,23 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Grok Free model menu evidence</title></head>
+  <body>
+    <button id="model-select-trigger" type="button" aria-label="Model select" aria-haspopup="menu" aria-expanded="true" data-state="open"><span>Fast</span></button>
+    <div role="menu">
+      <div role="menuitem" data-radix-collection-item class="cursor-pointer select-none text-primary opacity-100">
+        <span class="font-semibold">Fast</span><span>Quick responses · Grok 4.5</span>
+      </div>
+      <div role="menuitem" data-radix-collection-item class="cursor-pointer select-none text-secondary opacity-75">
+        <span class="font-semibold">Auto</span><span>Chooses Fast or Expert</span>
+      </div>
+      <div role="menuitem" data-radix-collection-item class="cursor-pointer select-none text-secondary opacity-75">
+        <span class="font-semibold">Expert</span><span>Thinks hard · Grok 4.5</span>
+      </div>
+      <div role="menuitem" data-radix-collection-item class="cursor-pointer select-none text-secondary opacity-75">
+        <span class="font-semibold">Heavy</span><span>Team of Experts · Grok 4.5</span>
+      </div>
+      <div role="menuitem" class="group/mode-select-upsell"><span>Unlock extended capabilities</span><button type="button">Upgrade</button></div>
+      <div role="menuitem"><span>Custom Instructions</span><button type="button">Customize</button></div>
+    </div>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/grok/signed-in-free/model-menu-open.provenance.json b/test/fixtures/provider-dom/grok/signed-in-free/model-menu-open.provenance.json
new file mode 100644
index 0000000..fb517dd
--- /dev/null
+++ b/test/fixtures/provider-dom/grok/signed-in-free/model-menu-open.provenance.json
@@ -0,0 +1,26 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "grok",
+  "accountState": "signed-in-free",
+  "observedPlan": { "status": "observed", "label": "Free" },
+  "scenario": "model-menu-open",
+  "routeClass": "new-chat",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://grok.com/",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "55ce1cb2ed166e74252e40f4f2f94f1fa8d66e81856d0665c01b49999a4aa66b",
+  "evidenceSelectors": [
+    { "capability": "model.inspect", "selector": "button#model-select-trigger[aria-label=\"Model select\"][aria-haspopup=\"menu\"]", "expectedCount": 1 },
+    { "capability": "model.free-tier-unavailable", "selector": "[role=\"menuitem\"][data-radix-collection-item].text-secondary.opacity-75 span.font-semibold", "expectedCount": 3 },
+    { "capability": "model.free-tier-available", "selector": "[role=\"menuitem\"][data-radix-collection-item].text-primary span.font-semibold", "expectedCount": 1 },
+    { "capability": "model.upgrade", "selector": "[role=\"menuitem\"].group\\/mode-select-upsell button", "expectedCount": 1 }
+  ],
+  "absenceSelectors": [
+    { "purpose": "current-unavailable-rows-use-visual-state-not-native-disabled", "selector": "[role=\"menuitem\"][data-radix-collection-item][disabled], [role=\"menuitem\"][data-radix-collection-item][aria-disabled=\"true\"], [role=\"menuitem\"][data-radix-collection-item][data-disabled]", "expectedCount": 0 }
+  ],
+  "redactions": ["account identity", "chat titles", "message content", "private route identifiers", "scripts", "styles"],
+  "notes": ["Free is inferred only when Auto, Expert, and Heavy all expose Grok's visible unavailable state.", "The current Grok DOM uses text-secondary and opacity-75 instead of native disabled or aria-disabled attributes."]
+}
diff --git a/test/fixtures/provider-dom/grok/signed-in-free/project-new.html b/test/fixtures/provider-dom/grok/signed-in-free/project-new.html
new file mode 100644
index 0000000..b5b395d
--- /dev/null
+++ b/test/fixtures/provider-dom/grok/signed-in-free/project-new.html
@@ -0,0 +1,10 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Grok new project</title></head>
+  <body>
+      <div role="dialog" aria-label="New Project">
+        <button aria-label="Close">Close</button><input aria-label="Project name"><label>Project Instructions<textarea aria-label="Project Instructions" placeholder="Add instructions about the tone, style, and persona you want Grok to adopt."></textarea></label>
+        <button>Cancel</button><button>Next</button>
+      </div>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/grok/signed-in-free/project-new.provenance.json b/test/fixtures/provider-dom/grok/signed-in-free/project-new.provenance.json
new file mode 100644
index 0000000..986ee8b
--- /dev/null
+++ b/test/fixtures/provider-dom/grok/signed-in-free/project-new.provenance.json
@@ -0,0 +1,49 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "grok",
+  "accountState": "signed-in-free",
+  "observedPlan": {
+    "status": "observed",
+    "label": "Free"
+  },
+  "scenario": "project-new",
+  "routeClass": "project-create-overlay",
+  "operationPhase": "workspace-create-form",
+  "capabilityOutcome": "unknown",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://grok.com/",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "ea18d45b14e57ddd313318b13e56a93970120d06ac2ef7371ed6e17ec8ccacd4",
+  "evidenceSelectors": [
+    {
+      "capability": "project.form",
+      "selector": "[role=\"dialog\"][aria-label=\"New Project\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "project.name",
+      "selector": "input[aria-label=\"Project name\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "project.instructions",
+      "selector": "textarea[aria-label=\"Project Instructions\"]",
+      "expectedCount": 1
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/grok/signed-in-free/search-history-empty.html b/test/fixtures/provider-dom/grok/signed-in-free/search-history-empty.html
new file mode 100644
index 0000000..561b2a6
--- /dev/null
+++ b/test/fixtures/provider-dom/grok/signed-in-free/search-history-empty.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Grok empty chat history</title></head>
+  <body>
+      <div role="dialog" aria-label="Command Menu">
+        <input role="combobox" aria-label="Command Menu" aria-expanded="true"><div role="listbox" aria-label="Suggestions">
+          <div role="group" aria-label="Actions"><div role="option" aria-selected="true">Create New Private Chat</div></div>
+          <div role="group" aria-label="History"><p>History is empty</p></div>
+        </div><button aria-label="Hide Conversation Previews">Hide previews</button>
+      </div>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/grok/signed-in-free/search-history-empty.provenance.json b/test/fixtures/provider-dom/grok/signed-in-free/search-history-empty.provenance.json
new file mode 100644
index 0000000..9fa7da2
--- /dev/null
+++ b/test/fixtures/provider-dom/grok/signed-in-free/search-history-empty.provenance.json
@@ -0,0 +1,50 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "grok",
+  "accountState": "signed-in-free",
+  "observedPlan": {
+    "status": "observed",
+    "label": "Free"
+  },
+  "scenario": "search-history-empty",
+  "routeClass": "chat-search-overlay",
+  "operationPhase": "observed",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://grok.com/",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "1bd0ec983a74eeedc05a1b5315bb99eea10b9325912c23046275380fdd45fed5",
+  "evidenceSelectors": [
+    {
+      "capability": "job.search",
+      "selector": "[role=\"combobox\"][aria-label=\"Command Menu\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "job.history-empty",
+      "selector": "[role=\"group\"][aria-label=\"History\"] p",
+      "expectedCount": 1
+    }
+  ],
+  "absenceSelectors": [
+    {
+      "purpose": "no-observed-existing-conversations",
+      "selector": "[role=\"group\"][aria-label=\"History\"] [role=\"option\"]",
+      "expectedCount": 0
+    }
+  ],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/grok/signed-in-free/settings-account.html b/test/fixtures/provider-dom/grok/signed-in-free/settings-account.html
new file mode 100644
index 0000000..bf9c742
--- /dev/null
+++ b/test/fixtures/provider-dom/grok/signed-in-free/settings-account.html
@@ -0,0 +1,10 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Grok account settings</title></head>
+  <body>
+      <div role="dialog" aria-label="Settings">
+        <nav aria-label="Settings sections"><button aria-current="page">Account</button><button>Appearance</button><button>Behavior</button><button>Customize</button><button>Data Controls</button></nav>
+        <main><h2>Account</h2><p>[redacted account identity]</p><section aria-label="Plan"><span>Basic</span><p>Get SuperGrok</p><button>Upgrade</button></section><button aria-label="Language">Change</button><button aria-label="Birth Year">Change</button></main>
+      </div>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/grok/signed-in-free/settings-account.provenance.json b/test/fixtures/provider-dom/grok/signed-in-free/settings-account.provenance.json
new file mode 100644
index 0000000..f7b1aa1
--- /dev/null
+++ b/test/fixtures/provider-dom/grok/signed-in-free/settings-account.provenance.json
@@ -0,0 +1,51 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "grok",
+  "accountState": "signed-in-free",
+  "observedPlan": {
+    "status": "observed",
+    "label": "Free"
+  },
+  "scenario": "settings-account",
+  "routeClass": "settings-overlay",
+  "operationPhase": "observed",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://grok.com/",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "da15d4a6657807412c361973ce7678635bbde2e4a6466272ae57481a4cc1251f",
+  "evidenceSelectors": [
+    {
+      "capability": "settings.open",
+      "selector": "[role=\"dialog\"][aria-label=\"Settings\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "plan.visible",
+      "selector": "section[aria-label=\"Plan\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "plan.upgrade",
+      "selector": "section[aria-label=\"Plan\"] button",
+      "expectedCount": 1
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": [
+    "The account panel exposes Basic and an upgrade action; runtime plan inference still uses model entitlement availability."
+  ]
+}
diff --git a/test/fixtures/provider-dom/grok/signed-in-free/skills-list.html b/test/fixtures/provider-dom/grok/signed-in-free/skills-list.html
new file mode 100644
index 0000000..3ca9b23
--- /dev/null
+++ b/test/fixtures/provider-dom/grok/signed-in-free/skills-list.html
@@ -0,0 +1,10 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Grok skills</title></head>
+  <body>
+      <main>
+        <h1>Skills and Connectors</h1><button>New Skill</button><div role="tablist"><button role="tab" aria-selected="true">Skills</button><button role="tab">Connectors</button></div><input type="search" aria-label="Search">
+        <section aria-label="Personal skills"><button>Word Documents</button><button>PDFs</button><button>Presentations</button><button>Spreadsheets</button><button>Skill Creator</button></section>
+      </main>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/grok/signed-in-free/skills-list.provenance.json b/test/fixtures/provider-dom/grok/signed-in-free/skills-list.provenance.json
new file mode 100644
index 0000000..27a0ca2
--- /dev/null
+++ b/test/fixtures/provider-dom/grok/signed-in-free/skills-list.provenance.json
@@ -0,0 +1,44 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "grok",
+  "accountState": "signed-in-free",
+  "observedPlan": {
+    "status": "observed",
+    "label": "Free"
+  },
+  "scenario": "skills-list",
+  "routeClass": "skills",
+  "operationPhase": "observed",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-25",
+  "sanitizedUrl": "https://grok.com/skills-and-connectors",
+  "source": "authenticated-user-visible-chrome-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "5adf37a85cd82c6de8a9ae535db77382b26fa940db3b00ec96979ef468467780",
+  "evidenceSelectors": [
+    {
+      "capability": "skill.list",
+      "selector": "section[aria-label=\"Personal skills\"] button",
+      "expectedCount": 5
+    },
+    {
+      "capability": "skill.create",
+      "selector": "main > button",
+      "expectedCount": 1
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "account identity",
+    "chat titles",
+    "message content",
+    "uploaded file names",
+    "generated asset URLs",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": []
+}
diff --git a/test/fixtures/provider-dom/grok/signed-in-unknown/session-status.html b/test/fixtures/provider-dom/grok/signed-in-unknown/session-status.html
index 79d5829..b7ffc03 100644
--- a/test/fixtures/provider-dom/grok/signed-in-unknown/session-status.html
+++ b/test/fixtures/provider-dom/grok/signed-in-unknown/session-status.html
@@ -2,7 +2,7 @@
 <html lang="en">
   <head><meta charset="utf-8"><title>Grok signed-in session evidence</title></head>
   <body>
-    <!-- No account identity or chat history titles are retained. Auth status uses compound signed-in-only UI evidence. -->
+    <!-- Account identity and chat history titles were removed. -->
     <nav>
       <a href="/skills-and-connectors">Skills and connectors</a>
       <button type="button" aria-label="New Project">New Project</button>
@@ -10,5 +10,6 @@
       <button type="button" aria-label="Search">Search</button>
       <button type="button" aria-label="See all">See all</button>
     </nav>
+    <button type="button"><img src="data:," alt="pfp"><span>[redacted account identity]</span></button>
   </body>
 </html>
diff --git a/test/fixtures/provider-dom/grok/signed-in-unknown/session-status.provenance.json b/test/fixtures/provider-dom/grok/signed-in-unknown/session-status.provenance.json
index 9481173..8b40163 100644
--- a/test/fixtures/provider-dom/grok/signed-in-unknown/session-status.provenance.json
+++ b/test/fixtures/provider-dom/grok/signed-in-unknown/session-status.provenance.json
@@ -11,9 +11,9 @@
   "artifactKind": "redacted-reduced-dom",
   "containsProviderJavaScript": false,
   "containsSyntheticBehavior": false,
-  "contentSha256": "aefdc93f212e7fb07a6320c860947215d06c3dfcbe4c1f97911ca5e0f596f591",
+  "contentSha256": "0da4e5b87dd4a8e6ed895d0dbafc41c3d4d1203561e23edbcae48c6da1a503ee",
   "evidenceSelectors": [
-    { "capability": "auth.status", "selector": "a[href=\"/skills-and-connectors\"]", "expectedCount": 1 },
+    { "capability": "auth.status", "selector": "button:has(img[alt=\"pfp\"])", "expectedCount": 1 },
     { "capability": "project.inspect", "selector": "button[aria-label=\"New Project\"]", "expectedCount": 1 },
     { "capability": "history.inspect", "selector": "button[aria-label=\"History\"]", "expectedCount": 1 }
   ],
@@ -21,5 +21,5 @@
     { "purpose": "signed-out-control", "selector": "a[href*=\"login\"], button[aria-label=\"Sign in\"]", "expectedCount": 0 }
   ],
   "redactions": ["account identity", "chat titles", "message content", "private route identifiers", "scripts", "styles"],
-  "notes": ["Signed-in status uses compound authenticated-only navigation evidence; no plan tier was established."]
+  "notes": ["Signed-in status uses the visible account button; no plan tier was established."]
 }
diff --git a/test/fixtures/provider-dom/manifest.json b/test/fixtures/provider-dom/manifest.json
new file mode 100644
index 0000000..16fb175
--- /dev/null
+++ b/test/fixtures/provider-dom/manifest.json
@@ -0,0 +1,774 @@
+{
+  "schema": "tokenless.provider-dom-manifest.v2",
+  "generatedBy": "test/helpers/build-provider-workflow-fixtures.mjs",
+  "fixtures": [
+    {
+      "provider": "deepseek",
+      "accountState": "signed-in-unknown",
+      "scenario": "composer-expert",
+      "routeClass": "new-chat",
+      "operationPhase": "mode-inspection",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://chat.deepseek.com/",
+      "observedOn": "2026-08-01",
+      "htmlPath": "deepseek/signed-in-unknown/composer-expert.html",
+      "provenancePath": "deepseek/signed-in-unknown/composer-expert.provenance.json"
+    },
+    {
+      "provider": "deepseek",
+      "accountState": "signed-in-unknown",
+      "scenario": "composer-instant",
+      "routeClass": "new-chat",
+      "operationPhase": "mode-inspection",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://chat.deepseek.com/",
+      "observedOn": "2026-08-01",
+      "htmlPath": "deepseek/signed-in-unknown/composer-instant.html",
+      "provenancePath": "deepseek/signed-in-unknown/composer-instant.provenance.json"
+    },
+    {
+      "provider": "deepseek",
+      "accountState": "signed-in-unknown",
+      "scenario": "composer-vision",
+      "routeClass": "new-chat",
+      "operationPhase": "mode-inspection",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://chat.deepseek.com/",
+      "observedOn": "2026-08-01",
+      "htmlPath": "deepseek/signed-in-unknown/composer-vision.html",
+      "provenancePath": "deepseek/signed-in-unknown/composer-vision.provenance.json"
+    },
+    {
+      "provider": "deepseek",
+      "accountState": "signed-in-unknown",
+      "scenario": "deepthink-response-complete",
+      "routeClass": "conversation",
+      "operationPhase": "response-complete",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://chat.deepseek.com/a/chat/s/[redacted]",
+      "observedOn": "2026-08-01",
+      "htmlPath": "deepseek/signed-in-unknown/deepthink-response-complete.html",
+      "provenancePath": "deepseek/signed-in-unknown/deepthink-response-complete.provenance.json"
+    },
+    {
+      "provider": "deepseek",
+      "accountState": "signed-in-unknown",
+      "scenario": "response-complete",
+      "routeClass": "conversation",
+      "operationPhase": "response-complete",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://chat.deepseek.com/a/chat/s/[redacted]",
+      "observedOn": "2026-08-01",
+      "htmlPath": "deepseek/signed-in-unknown/response-complete.html",
+      "provenancePath": "deepseek/signed-in-unknown/response-complete.provenance.json"
+    },
+    {
+      "provider": "deepseek",
+      "accountState": "signed-in-unknown",
+      "scenario": "search-response-complete",
+      "routeClass": "conversation",
+      "operationPhase": "response-complete",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://chat.deepseek.com/a/chat/s/[redacted]",
+      "observedOn": "2026-08-01",
+      "htmlPath": "deepseek/signed-in-unknown/search-response-complete.html",
+      "provenancePath": "deepseek/signed-in-unknown/search-response-complete.provenance.json"
+    },
+    {
+      "provider": "chatgpt",
+      "accountState": "signed-in-paid",
+      "scenario": "composer-idle",
+      "routeClass": "new-chat",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://chatgpt.com/",
+      "observedOn": "2026-07-17",
+      "htmlPath": "chatgpt/signed-in-paid/composer-idle.html",
+      "provenancePath": "chatgpt/signed-in-paid/composer-idle.provenance.json"
+    },
+    {
+      "provider": "chatgpt",
+      "accountState": "signed-in-paid",
+      "scenario": "composer-no-choice-controls",
+      "routeClass": "new-chat",
+      "operationPhase": "choice-inspection",
+      "capabilityOutcome": "unavailable",
+      "sanitizedUrl": "https://chatgpt.com/",
+      "observedOn": "2026-07-28",
+      "htmlPath": "chatgpt/signed-in-paid/composer-no-choice-controls.html",
+      "provenancePath": "chatgpt/signed-in-paid/composer-no-choice-controls.provenance.json"
+    },
+    {
+      "provider": "chatgpt",
+      "accountState": "signed-in-paid",
+      "scenario": "connectors-directory",
+      "routeClass": "connectors-directory",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://chatgpt.com/plugins",
+      "observedOn": "2026-07-25",
+      "htmlPath": "chatgpt/signed-in-paid/connectors-directory.html",
+      "provenancePath": "chatgpt/signed-in-paid/connectors-directory.provenance.json"
+    },
+    {
+      "provider": "chatgpt",
+      "accountState": "signed-in-paid",
+      "scenario": "conversation-existing",
+      "routeClass": "conversation",
+      "operationPhase": "conversation-existing",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://chatgpt.com/c/[redacted]",
+      "observedOn": "2026-07-25",
+      "htmlPath": "chatgpt/signed-in-paid/conversation-existing.html",
+      "provenancePath": "chatgpt/signed-in-paid/conversation-existing.provenance.json"
+    },
+    {
+      "provider": "chatgpt",
+      "accountState": "signed-in-paid",
+      "scenario": "file-input-ready",
+      "routeClass": "new-chat",
+      "operationPhase": "file-input-ready",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://chatgpt.com/",
+      "observedOn": "2026-07-17",
+      "htmlPath": "chatgpt/signed-in-paid/file-input-ready.html",
+      "provenancePath": "chatgpt/signed-in-paid/file-input-ready.provenance.json"
+    },
+    {
+      "provider": "chatgpt",
+      "accountState": "signed-in-paid",
+      "scenario": "image-result",
+      "routeClass": "conversation-image-result",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://chatgpt.com/c/[redacted]",
+      "observedOn": "2026-07-25",
+      "htmlPath": "chatgpt/signed-in-paid/image-result.html",
+      "provenancePath": "chatgpt/signed-in-paid/image-result.provenance.json"
+    },
+    {
+      "provider": "chatgpt",
+      "accountState": "signed-in-paid",
+      "scenario": "library-files",
+      "routeClass": "library",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://chatgpt.com/library",
+      "observedOn": "2026-07-25",
+      "htmlPath": "chatgpt/signed-in-paid/library-files.html",
+      "provenancePath": "chatgpt/signed-in-paid/library-files.provenance.json"
+    },
+    {
+      "provider": "chatgpt",
+      "accountState": "signed-in-paid",
+      "scenario": "model-menu-open",
+      "routeClass": "new-chat",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://chatgpt.com/",
+      "observedOn": "2026-07-17",
+      "htmlPath": "chatgpt/signed-in-paid/model-menu-open.html",
+      "provenancePath": "chatgpt/signed-in-paid/model-menu-open.provenance.json"
+    },
+    {
+      "provider": "chatgpt",
+      "accountState": "signed-in-paid",
+      "scenario": "scheduled-jobs",
+      "routeClass": "scheduled-jobs",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://chatgpt.com/scheduled",
+      "observedOn": "2026-07-25",
+      "htmlPath": "chatgpt/signed-in-paid/scheduled-jobs.html",
+      "provenancePath": "chatgpt/signed-in-paid/scheduled-jobs.provenance.json"
+    },
+    {
+      "provider": "chatgpt",
+      "accountState": "signed-in-paid",
+      "scenario": "session-status",
+      "routeClass": "new-chat",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://chatgpt.com/",
+      "observedOn": "2026-07-17",
+      "htmlPath": "chatgpt/signed-in-paid/session-status.html",
+      "provenancePath": "chatgpt/signed-in-paid/session-status.provenance.json"
+    },
+    {
+      "provider": "chatgpt",
+      "accountState": "signed-in-paid",
+      "scenario": "settings-general",
+      "routeClass": "settings-overlay",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://chatgpt.com/scheduled",
+      "observedOn": "2026-07-25",
+      "htmlPath": "chatgpt/signed-in-paid/settings-general.html",
+      "provenancePath": "chatgpt/signed-in-paid/settings-general.provenance.json"
+    },
+    {
+      "provider": "chatgpt",
+      "accountState": "signed-in-paid",
+      "scenario": "thinking-effort-menu-open",
+      "routeClass": "new-chat",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://chatgpt.com/",
+      "observedOn": "2026-07-17",
+      "htmlPath": "chatgpt/signed-in-paid/thinking-effort-menu-open.html",
+      "provenancePath": "chatgpt/signed-in-paid/thinking-effort-menu-open.provenance.json"
+    },
+    {
+      "provider": "chatgpt",
+      "accountState": "signed-in-paid",
+      "scenario": "upload-tools-menu-open",
+      "routeClass": "new-chat",
+      "operationPhase": "upload-menu-open",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://chatgpt.com/",
+      "observedOn": "2026-07-25",
+      "htmlPath": "chatgpt/signed-in-paid/upload-tools-menu-open.html",
+      "provenancePath": "chatgpt/signed-in-paid/upload-tools-menu-open.provenance.json"
+    },
+    {
+      "provider": "claude",
+      "accountState": "signed-in-free",
+      "scenario": "artifacts-list",
+      "routeClass": "artifacts",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://claude.ai/artifacts",
+      "observedOn": "2026-07-25",
+      "htmlPath": "claude/signed-in-free/artifacts-list.html",
+      "provenancePath": "claude/signed-in-free/artifacts-list.provenance.json"
+    },
+    {
+      "provider": "claude",
+      "accountState": "signed-in-free",
+      "scenario": "composer-idle",
+      "routeClass": "new-chat",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://claude.ai/new",
+      "observedOn": "2026-07-17",
+      "htmlPath": "claude/signed-in-free/composer-idle.html",
+      "provenancePath": "claude/signed-in-free/composer-idle.provenance.json"
+    },
+    {
+      "provider": "claude",
+      "accountState": "signed-in-free",
+      "scenario": "connectors-settings",
+      "routeClass": "connectors-settings-overlay",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://claude.ai/new",
+      "observedOn": "2026-07-25",
+      "htmlPath": "claude/signed-in-free/connectors-settings.html",
+      "provenancePath": "claude/signed-in-free/connectors-settings.provenance.json"
+    },
+    {
+      "provider": "claude",
+      "accountState": "signed-in-free",
+      "scenario": "conversation-existing",
+      "routeClass": "conversation",
+      "operationPhase": "conversation-existing",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://claude.ai/chat/[redacted]",
+      "observedOn": "2026-07-25",
+      "htmlPath": "claude/signed-in-free/conversation-existing.html",
+      "provenancePath": "claude/signed-in-free/conversation-existing.provenance.json"
+    },
+    {
+      "provider": "claude",
+      "accountState": "signed-in-free",
+      "scenario": "file-input-ready",
+      "routeClass": "new-chat",
+      "operationPhase": "file-input-ready",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://claude.ai/new",
+      "observedOn": "2026-07-17",
+      "htmlPath": "claude/signed-in-free/file-input-ready.html",
+      "provenancePath": "claude/signed-in-free/file-input-ready.provenance.json"
+    },
+    {
+      "provider": "claude",
+      "accountState": "signed-in-free",
+      "scenario": "model-menu-open",
+      "routeClass": "new-chat",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://claude.ai/new",
+      "observedOn": "2026-07-17",
+      "htmlPath": "claude/signed-in-free/model-menu-open.html",
+      "provenancePath": "claude/signed-in-free/model-menu-open.provenance.json"
+    },
+    {
+      "provider": "claude",
+      "accountState": "signed-in-free",
+      "scenario": "projects-list",
+      "routeClass": "projects",
+      "operationPhase": "workspace-list",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://claude.ai/projects",
+      "observedOn": "2026-07-25",
+      "htmlPath": "claude/signed-in-free/projects-list.html",
+      "provenancePath": "claude/signed-in-free/projects-list.provenance.json"
+    },
+    {
+      "provider": "claude",
+      "accountState": "signed-in-free",
+      "scenario": "session-status",
+      "routeClass": "new-chat",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://claude.ai/new",
+      "observedOn": "2026-07-17",
+      "htmlPath": "claude/signed-in-free/session-status.html",
+      "provenancePath": "claude/signed-in-free/session-status.provenance.json"
+    },
+    {
+      "provider": "claude",
+      "accountState": "signed-in-free",
+      "scenario": "settings-general",
+      "routeClass": "settings-overlay",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://claude.ai/new",
+      "observedOn": "2026-07-25",
+      "htmlPath": "claude/signed-in-free/settings-general.html",
+      "provenancePath": "claude/signed-in-free/settings-general.provenance.json"
+    },
+    {
+      "provider": "claude",
+      "accountState": "signed-in-free",
+      "scenario": "thinking-effort-menu-open",
+      "routeClass": "new-chat",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://claude.ai/new",
+      "observedOn": "2026-07-17",
+      "htmlPath": "claude/signed-in-free/thinking-effort-menu-open.html",
+      "provenancePath": "claude/signed-in-free/thinking-effort-menu-open.provenance.json"
+    },
+    {
+      "provider": "claude",
+      "accountState": "signed-in-free",
+      "scenario": "upload-connectors-menu-open",
+      "routeClass": "new-chat",
+      "operationPhase": "upload-menu-open",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://claude.ai/new",
+      "observedOn": "2026-07-25",
+      "htmlPath": "claude/signed-in-free/upload-connectors-menu-open.html",
+      "provenancePath": "claude/signed-in-free/upload-connectors-menu-open.provenance.json"
+    },
+    {
+      "provider": "claude",
+      "accountState": "signed-out-challenge",
+      "scenario": "cloudflare-security-verification",
+      "routeClass": "new-chat-challenge",
+      "operationPhase": "challenge-visible",
+      "capabilityOutcome": "unavailable",
+      "sanitizedUrl": "https://claude.ai/new",
+      "observedOn": "2026-07-31",
+      "htmlPath": "claude/signed-out-challenge/cloudflare-security-verification.html",
+      "provenancePath": "claude/signed-out-challenge/cloudflare-security-verification.provenance.json"
+    },
+    {
+      "provider": "gemini",
+      "accountState": "signed-in-unknown",
+      "scenario": "composer-idle",
+      "routeClass": "new-chat",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://gemini.google.com/app",
+      "observedOn": "2026-07-17",
+      "htmlPath": "gemini/signed-in-unknown/composer-idle.html",
+      "provenancePath": "gemini/signed-in-unknown/composer-idle.provenance.json"
+    },
+    {
+      "provider": "gemini",
+      "accountState": "signed-in-unknown",
+      "scenario": "conversation-existing",
+      "routeClass": "conversation",
+      "operationPhase": "conversation-existing",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://gemini.google.com/app/[redacted]",
+      "observedOn": "2026-07-25",
+      "htmlPath": "gemini/signed-in-unknown/conversation-existing.html",
+      "provenancePath": "gemini/signed-in-unknown/conversation-existing.provenance.json"
+    },
+    {
+      "provider": "gemini",
+      "accountState": "signed-in-unknown",
+      "scenario": "file-input-ready",
+      "routeClass": "new-chat",
+      "operationPhase": "file-input-ready",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://gemini.google.com/app",
+      "observedOn": "2026-07-17",
+      "htmlPath": "gemini/signed-in-unknown/file-input-ready.html",
+      "provenancePath": "gemini/signed-in-unknown/file-input-ready.provenance.json"
+    },
+    {
+      "provider": "gemini",
+      "accountState": "signed-in-unknown",
+      "scenario": "image-workspace",
+      "routeClass": "images",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://gemini.google.com/images",
+      "observedOn": "2026-07-25",
+      "htmlPath": "gemini/signed-in-unknown/image-workspace.html",
+      "provenancePath": "gemini/signed-in-unknown/image-workspace.provenance.json"
+    },
+    {
+      "provider": "gemini",
+      "accountState": "signed-in-unknown",
+      "scenario": "library-media",
+      "routeClass": "library",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://gemini.google.com/library",
+      "observedOn": "2026-07-25",
+      "htmlPath": "gemini/signed-in-unknown/library-media.html",
+      "provenancePath": "gemini/signed-in-unknown/library-media.provenance.json"
+    },
+    {
+      "provider": "gemini",
+      "accountState": "signed-in-unknown",
+      "scenario": "model-menu-open",
+      "routeClass": "new-chat",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://gemini.google.com/app",
+      "observedOn": "2026-07-17",
+      "htmlPath": "gemini/signed-in-unknown/model-menu-open.html",
+      "provenancePath": "gemini/signed-in-unknown/model-menu-open.provenance.json"
+    },
+    {
+      "provider": "gemini",
+      "accountState": "signed-in-unknown",
+      "scenario": "search-chats",
+      "routeClass": "chat-search",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://gemini.google.com/search",
+      "observedOn": "2026-07-25",
+      "htmlPath": "gemini/signed-in-unknown/search-chats.html",
+      "provenancePath": "gemini/signed-in-unknown/search-chats.provenance.json"
+    },
+    {
+      "provider": "gemini",
+      "accountState": "signed-in-unknown",
+      "scenario": "session-status",
+      "routeClass": "new-chat",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://gemini.google.com/app",
+      "observedOn": "2026-07-17",
+      "htmlPath": "gemini/signed-in-unknown/session-status.html",
+      "provenancePath": "gemini/signed-in-unknown/session-status.provenance.json"
+    },
+    {
+      "provider": "gemini",
+      "accountState": "signed-in-unknown",
+      "scenario": "settings-menu-open",
+      "routeClass": "settings-menu",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://gemini.google.com/app",
+      "observedOn": "2026-07-25",
+      "htmlPath": "gemini/signed-in-unknown/settings-menu-open.html",
+      "provenancePath": "gemini/signed-in-unknown/settings-menu-open.provenance.json"
+    },
+    {
+      "provider": "gemini",
+      "accountState": "signed-in-unknown",
+      "scenario": "thinking-effort-menu-open",
+      "routeClass": "new-chat",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://gemini.google.com/app",
+      "observedOn": "2026-07-17",
+      "htmlPath": "gemini/signed-in-unknown/thinking-effort-menu-open.html",
+      "provenancePath": "gemini/signed-in-unknown/thinking-effort-menu-open.provenance.json"
+    },
+    {
+      "provider": "gemini",
+      "accountState": "signed-in-unknown",
+      "scenario": "upload-sources-open",
+      "routeClass": "new-chat",
+      "operationPhase": "upload-menu-open",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://gemini.google.com/app",
+      "observedOn": "2026-07-25",
+      "htmlPath": "gemini/signed-in-unknown/upload-sources-open.html",
+      "provenancePath": "gemini/signed-in-unknown/upload-sources-open.provenance.json"
+    },
+    {
+      "provider": "gemini",
+      "accountState": "signed-in-unknown",
+      "scenario": "upload-tools-menu-open",
+      "routeClass": "new-chat",
+      "operationPhase": "upload-menu-open",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://gemini.google.com/app",
+      "observedOn": "2026-07-25",
+      "htmlPath": "gemini/signed-in-unknown/upload-tools-menu-open.html",
+      "provenancePath": "gemini/signed-in-unknown/upload-tools-menu-open.provenance.json"
+    },
+    {
+      "provider": "gemini",
+      "accountState": "signed-out-guest",
+      "scenario": "mode-picker",
+      "routeClass": "new-chat",
+      "operationPhase": "choice-inspection",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://gemini.google.com/",
+      "observedOn": "2026-07-28",
+      "htmlPath": "gemini/signed-out-guest/mode-picker.html",
+      "provenancePath": "gemini/signed-out-guest/mode-picker.provenance.json"
+    },
+    {
+      "provider": "grok",
+      "accountState": "signed-in-free",
+      "scenario": "attach-menu-open",
+      "routeClass": "new-chat",
+      "operationPhase": "upload-menu-open",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://grok.com/",
+      "observedOn": "2026-07-25",
+      "htmlPath": "grok/signed-in-free/attach-menu-open.html",
+      "provenancePath": "grok/signed-in-free/attach-menu-open.provenance.json"
+    },
+    {
+      "provider": "grok",
+      "accountState": "signed-in-free",
+      "scenario": "automation-new",
+      "routeClass": "automation-create-overlay",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://grok.com/automations",
+      "observedOn": "2026-07-25",
+      "htmlPath": "grok/signed-in-free/automation-new.html",
+      "provenancePath": "grok/signed-in-free/automation-new.provenance.json"
+    },
+    {
+      "provider": "grok",
+      "accountState": "signed-in-free",
+      "scenario": "automations-list",
+      "routeClass": "automations",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://grok.com/automations",
+      "observedOn": "2026-07-25",
+      "htmlPath": "grok/signed-in-free/automations-list.html",
+      "provenancePath": "grok/signed-in-free/automations-list.provenance.json"
+    },
+    {
+      "provider": "grok",
+      "accountState": "signed-in-free",
+      "scenario": "connectors-list",
+      "routeClass": "connectors",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://grok.com/connectors",
+      "observedOn": "2026-07-25",
+      "htmlPath": "grok/signed-in-free/connectors-list.html",
+      "provenancePath": "grok/signed-in-free/connectors-list.provenance.json"
+    },
+    {
+      "provider": "grok",
+      "accountState": "signed-in-free",
+      "scenario": "imagine-workspace",
+      "routeClass": "imagine",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://grok.com/imagine",
+      "observedOn": "2026-07-25",
+      "htmlPath": "grok/signed-in-free/imagine-workspace.html",
+      "provenancePath": "grok/signed-in-free/imagine-workspace.provenance.json"
+    },
+    {
+      "provider": "grok",
+      "accountState": "signed-in-free",
+      "scenario": "model-menu-open",
+      "routeClass": "new-chat",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://grok.com/",
+      "observedOn": "2026-07-25",
+      "htmlPath": "grok/signed-in-free/model-menu-open.html",
+      "provenancePath": "grok/signed-in-free/model-menu-open.provenance.json"
+    },
+    {
+      "provider": "grok",
+      "accountState": "signed-in-free",
+      "scenario": "project-new",
+      "routeClass": "project-create-overlay",
+      "operationPhase": "workspace-create-form",
+      "capabilityOutcome": "unknown",
+      "sanitizedUrl": "https://grok.com/",
+      "observedOn": "2026-07-25",
+      "htmlPath": "grok/signed-in-free/project-new.html",
+      "provenancePath": "grok/signed-in-free/project-new.provenance.json"
+    },
+    {
+      "provider": "grok",
+      "accountState": "signed-in-free",
+      "scenario": "search-history-empty",
+      "routeClass": "chat-search-overlay",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://grok.com/",
+      "observedOn": "2026-07-25",
+      "htmlPath": "grok/signed-in-free/search-history-empty.html",
+      "provenancePath": "grok/signed-in-free/search-history-empty.provenance.json"
+    },
+    {
+      "provider": "grok",
+      "accountState": "signed-in-free",
+      "scenario": "settings-account",
+      "routeClass": "settings-overlay",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://grok.com/",
+      "observedOn": "2026-07-25",
+      "htmlPath": "grok/signed-in-free/settings-account.html",
+      "provenancePath": "grok/signed-in-free/settings-account.provenance.json"
+    },
+    {
+      "provider": "grok",
+      "accountState": "signed-in-free",
+      "scenario": "skills-list",
+      "routeClass": "skills",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://grok.com/skills-and-connectors",
+      "observedOn": "2026-07-25",
+      "htmlPath": "grok/signed-in-free/skills-list.html",
+      "provenancePath": "grok/signed-in-free/skills-list.provenance.json"
+    },
+    {
+      "provider": "grok",
+      "accountState": "signed-in-unknown",
+      "scenario": "composer-idle",
+      "routeClass": "new-chat",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://grok.com/",
+      "observedOn": "2026-07-17",
+      "htmlPath": "grok/signed-in-unknown/composer-idle.html",
+      "provenancePath": "grok/signed-in-unknown/composer-idle.provenance.json"
+    },
+    {
+      "provider": "grok",
+      "accountState": "signed-in-unknown",
+      "scenario": "file-input-ready",
+      "routeClass": "new-chat",
+      "operationPhase": "file-input-ready",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://grok.com/",
+      "observedOn": "2026-07-17",
+      "htmlPath": "grok/signed-in-unknown/file-input-ready.html",
+      "provenancePath": "grok/signed-in-unknown/file-input-ready.provenance.json"
+    },
+    {
+      "provider": "grok",
+      "accountState": "signed-in-unknown",
+      "scenario": "model-menu-open",
+      "routeClass": "new-chat",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://grok.com/",
+      "observedOn": "2026-07-17",
+      "htmlPath": "grok/signed-in-unknown/model-menu-open.html",
+      "provenancePath": "grok/signed-in-unknown/model-menu-open.provenance.json"
+    },
+    {
+      "provider": "grok",
+      "accountState": "signed-in-unknown",
+      "scenario": "session-status",
+      "routeClass": "new-chat",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://grok.com/",
+      "observedOn": "2026-07-17",
+      "htmlPath": "grok/signed-in-unknown/session-status.html",
+      "provenancePath": "grok/signed-in-unknown/session-status.provenance.json"
+    },
+    {
+      "provider": "grok",
+      "accountState": "signed-in-unknown",
+      "scenario": "thinking-effort-menu-open",
+      "routeClass": "new-chat",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://grok.com/",
+      "observedOn": "2026-07-17",
+      "htmlPath": "grok/signed-in-unknown/thinking-effort-menu-open.html",
+      "provenancePath": "grok/signed-in-unknown/thinking-effort-menu-open.provenance.json"
+    },
+    {
+      "provider": "qwen",
+      "accountState": "signed-out-guest",
+      "scenario": "composer-idle",
+      "routeClass": "new-chat",
+      "operationPhase": "observed",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://www.qianwen.com/",
+      "observedOn": "2026-07-26",
+      "htmlPath": "qwen/signed-out-guest/composer-idle.html",
+      "provenancePath": "qwen/signed-out-guest/composer-idle.provenance.json"
+    },
+    {
+      "provider": "qwen",
+      "accountState": "signed-out-guest",
+      "scenario": "composer-slate-placeholder",
+      "routeClass": "new-chat",
+      "operationPhase": "prompt-input-clear",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://www.qianwen.com/",
+      "observedOn": "2026-07-28",
+      "htmlPath": "qwen/signed-out-guest/composer-slate-placeholder.html",
+      "provenancePath": "qwen/signed-out-guest/composer-slate-placeholder.provenance.json"
+    },
+    {
+      "provider": "qwen",
+      "accountState": "signed-out-guest",
+      "scenario": "deep-research-advanced-selected",
+      "routeClass": "new-chat",
+      "operationPhase": "selected",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://chat.qwen.ai/",
+      "observedOn": "2026-07-30",
+      "htmlPath": "qwen/signed-out-guest/deep-research-advanced-selected.html",
+      "provenancePath": "qwen/signed-out-guest/deep-research-advanced-selected.provenance.json"
+    },
+    {
+      "provider": "qwen",
+      "accountState": "signed-out-guest",
+      "scenario": "response-complete",
+      "routeClass": "conversation",
+      "operationPhase": "response-complete",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://www.qianwen.com/chat/[redacted]",
+      "observedOn": "2026-07-26",
+      "htmlPath": "qwen/signed-out-guest/response-complete.html",
+      "provenancePath": "qwen/signed-out-guest/response-complete.provenance.json"
+    },
+    {
+      "provider": "qwen",
+      "accountState": "signed-out-guest",
+      "scenario": "studio-response-complete",
+      "routeClass": "conversation",
+      "operationPhase": "response-complete",
+      "capabilityOutcome": "available",
+      "sanitizedUrl": "https://chat.qwen.ai/c/guest",
+      "observedOn": "2026-07-29",
+      "htmlPath": "qwen/signed-out-guest/studio-response-complete.html",
+      "provenancePath": "qwen/signed-out-guest/studio-response-complete.provenance.json"
+    }
+  ]
+}
diff --git a/test/fixtures/provider-dom/qwen/signed-out-guest/composer-idle.html b/test/fixtures/provider-dom/qwen/signed-out-guest/composer-idle.html
new file mode 100644
index 0000000..6a9ad5f
--- /dev/null
+++ b/test/fixtures/provider-dom/qwen/signed-out-guest/composer-idle.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<html lang="zh-CN">
+  <head><meta charset="utf-8"><title>Qwen guest composer evidence</title></head>
+  <body>
+    <button type="button">登录</button>
+    <div
+      contenteditable="true"
+      role="textbox"
+      aria-multiline="true"
+      data-placeholder="向千问提问"
+      data-slate-editor="true"
+      data-slate-node="value"
+      translate="no"
+    ><p>向千问提问</p></div>
+    <button type="button" aria-label="发送消息" disabled></button>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/qwen/signed-out-guest/composer-idle.provenance.json b/test/fixtures/provider-dom/qwen/signed-out-guest/composer-idle.provenance.json
new file mode 100644
index 0000000..467b4de
--- /dev/null
+++ b/test/fixtures/provider-dom/qwen/signed-out-guest/composer-idle.provenance.json
@@ -0,0 +1,46 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "qwen",
+  "accountState": "signed-out-guest",
+  "observedPlan": { "status": "unknown", "label": null },
+  "scenario": "composer-idle",
+  "routeClass": "new-chat",
+  "operationPhase": "observed",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-26",
+  "sanitizedUrl": "https://www.qianwen.com/",
+  "source": "unauthenticated-user-visible-in-app-browser-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "6c4a17224f7a0589b33d1b655b4210afc80e4611c78366036ee89762a049111f",
+  "evidenceSelectors": [
+    {
+      "capability": "session.guest",
+      "selector": "button:has-text(\"登录\")",
+      "expectedCount": 1
+    },
+    {
+      "capability": "prompt.input",
+      "selector": "div[contenteditable=\"true\"][role=\"textbox\"][aria-multiline=\"true\"][data-placeholder=\"向千问提问\"][data-slate-editor=\"true\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "prompt.submit",
+      "selector": "button[aria-label=\"发送消息\"]",
+      "expectedCount": 1
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "conversation history",
+    "message content",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": [
+    "The guest composer and disabled empty-state submit control were observed on the public Qwen product surface.",
+    "No account credentials or browser storage were inspected."
+  ]
+}
diff --git a/test/fixtures/provider-dom/qwen/signed-out-guest/composer-slate-placeholder.html b/test/fixtures/provider-dom/qwen/signed-out-guest/composer-slate-placeholder.html
new file mode 100644
index 0000000..1107549
--- /dev/null
+++ b/test/fixtures/provider-dom/qwen/signed-out-guest/composer-slate-placeholder.html
@@ -0,0 +1,11 @@
+<!doctype html>
+<html lang="zh-CN">
+  <head><meta charset="utf-8"><title>Qwen Slate placeholder composer</title></head>
+  <body>
+    <div role="textbox" aria-multiline="true" data-slate-editor="true" contenteditable="true">
+      <p data-slate-node="element"><span data-slate-node="text"><span data-slate-leaf="true"><span data-slate-zero-width="n" data-slate-length="0">&#65279;<br><span data-slate-placeholder="true" contenteditable="false">向千问提问</span></span></span></span></p>
+    </div>
+    <button aria-label="添加附件"></button>
+    <button aria-label="发送消息"></button>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/qwen/signed-out-guest/composer-slate-placeholder.provenance.json b/test/fixtures/provider-dom/qwen/signed-out-guest/composer-slate-placeholder.provenance.json
new file mode 100644
index 0000000..b23bdb7
--- /dev/null
+++ b/test/fixtures/provider-dom/qwen/signed-out-guest/composer-slate-placeholder.provenance.json
@@ -0,0 +1,40 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "qwen",
+  "accountState": "signed-out-guest",
+  "observedPlan": {
+    "status": "unknown",
+    "label": null
+  },
+  "scenario": "composer-slate-placeholder",
+  "routeClass": "new-chat",
+  "operationPhase": "prompt-input-clear",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-28",
+  "sanitizedUrl": "https://www.qianwen.com/",
+  "source": "managed-visible-provider-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "80f3fae8ed520d57477295438b063c60c5d9b151d194b57839f723e50af84959",
+  "evidenceSelectors": [
+    {
+      "capability": "prompt.input",
+      "selector": "div[contenteditable=\"true\"][role=\"textbox\"][data-slate-editor=\"true\"]",
+      "expectedCount": 1
+    },
+    {
+      "capability": "prompt.placeholder",
+      "selector": "[data-slate-placeholder=\"true\"][contenteditable=\"false\"]",
+      "expectedCount": 1
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "conversation history",
+    "message content",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ]
+}
diff --git a/test/fixtures/provider-dom/qwen/signed-out-guest/deep-research-advanced-selected.html b/test/fixtures/provider-dom/qwen/signed-out-guest/deep-research-advanced-selected.html
new file mode 100644
index 0000000..8cddf60
--- /dev/null
+++ b/test/fixtures/provider-dom/qwen/signed-out-guest/deep-research-advanced-selected.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<html>
+<head><title>Qwen Studio</title></head>
+<body>
+  <textarea class="message-input-textarea message-input-textarea-separation"></textarea>
+  <div class="mode-select">
+    <span class="ant-dropdown-trigger">
+      <div class="mode-select-open" role="button" aria-label="Select Mode">
+        <div class="mode-select-open-mode-select"></div>
+        <span role="img" class="anticon"></span>
+      </div>
+    </span>
+    <div class="mode-select-current-mode">
+      <span role="img" class="anticon mode-select-current-mode-close"></span>
+      <span role="img" class="anticon mode-select-current-mode-icon"></span>
+      <span>Deep Research</span>
+    </div>
+    <div class="message-input-column-footer-submode">
+      <span class="ant-dropdown-trigger">
+        <div class="advanced">Advanced<span role="img" class="anticon advanced-icon"></span></div>
+      </span>
+    </div>
+  </div>
+</body>
+</html>
diff --git a/test/fixtures/provider-dom/qwen/signed-out-guest/deep-research-advanced-selected.provenance.json b/test/fixtures/provider-dom/qwen/signed-out-guest/deep-research-advanced-selected.provenance.json
new file mode 100644
index 0000000..05e6709
--- /dev/null
+++ b/test/fixtures/provider-dom/qwen/signed-out-guest/deep-research-advanced-selected.provenance.json
@@ -0,0 +1,51 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "qwen",
+  "accountState": "signed-out-guest",
+  "observedPlan": {
+    "status": "unknown",
+    "label": null
+  },
+  "scenario": "deep-research-advanced-selected",
+  "routeClass": "new-chat",
+  "operationPhase": "selected",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-30",
+  "sanitizedUrl": "https://chat.qwen.ai/",
+  "source": "development-visible-provider-session-cdp-observer",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "3539a0437c9b56f3ed82ce8646095793ce9dc1d163651a49dd0c3db26ca72adb",
+  "evidenceSelectors": [
+    {
+      "capability": "qwen.mode.select",
+      "selector": ".mode-select .mode-select-current-mode",
+      "expectedCount": 1
+    },
+    {
+      "capability": "qwen.mode.select",
+      "selector": ".message-input-column-footer-submode .advanced",
+      "expectedCount": 1
+    },
+    {
+      "capability": "prompt.input",
+      "selector": "textarea.message-input-textarea",
+      "expectedCount": 1
+    }
+  ],
+  "absenceSelectors": [],
+  "redactions": [
+    "scripts",
+    "styles",
+    "unrelated controls",
+    "provider-generated examples",
+    "resource attributes"
+  ],
+  "notes": [
+    "A real signed-out Qwen Studio guest session visibly selected Deep Research and its Advanced variant before any prompt was entered.",
+    "A separate CDP client read and reduced the selected state without performing provider actions.",
+    "The development capture used a temporary guest profile and a one-off public-DNS host resolution because the machine system resolver was failing; this artifact is not E2E or acceptance evidence.",
+    "The fixture proves only recognition of the selected visible state. It does not prove the selection transition, prompt submission, research execution, or response completion."
+  ]
+}
diff --git a/test/fixtures/provider-dom/qwen/signed-out-guest/response-complete.html b/test/fixtures/provider-dom/qwen/signed-out-guest/response-complete.html
new file mode 100644
index 0000000..399f5bd
--- /dev/null
+++ b/test/fixtures/provider-dom/qwen/signed-out-guest/response-complete.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<html lang="zh-CN">
+  <head><meta charset="utf-8"><title>Qwen guest response evidence</title></head>
+  <body>
+    <button type="button">登录</button>
+    <div class="chat-round last-message-item">
+      <div>[redacted prompt]</div>
+      <div class="chat-answers-card-wrap">
+        <div class="qk-markdown qk-markdown-react qk-markdown-code-dark qk-markdown-complete">
+          <div class="qk-md-paragraph"><span class="qk-md-text complete">[redacted response]</span></div>
+        </div>
+      </div>
+    </div>
+    <div
+      contenteditable="true"
+      role="textbox"
+      aria-multiline="true"
+      data-placeholder="向千问提问"
+      data-slate-editor="true"
+      data-slate-node="value"
+      translate="no"
+    ><p>向千问提问</p></div>
+    <button type="button" aria-label="发送消息" disabled></button>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/qwen/signed-out-guest/response-complete.provenance.json b/test/fixtures/provider-dom/qwen/signed-out-guest/response-complete.provenance.json
new file mode 100644
index 0000000..2a3a704
--- /dev/null
+++ b/test/fixtures/provider-dom/qwen/signed-out-guest/response-complete.provenance.json
@@ -0,0 +1,47 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "qwen",
+  "accountState": "signed-out-guest",
+  "observedPlan": { "status": "unknown", "label": null },
+  "scenario": "response-complete",
+  "routeClass": "conversation",
+  "operationPhase": "response-complete",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-26",
+  "sanitizedUrl": "https://www.qianwen.com/chat/[redacted]",
+  "source": "unauthenticated-user-visible-in-app-browser-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "52af63c7a4b0c660cf593e1cf15e6e376720c078c86796e11d10d22f0fbc6b63",
+  "evidenceSelectors": [
+    {
+      "capability": "response.read",
+      "selector": ".chat-answers-card-wrap .qk-markdown.qk-markdown-complete",
+      "expectedCount": 1
+    },
+    {
+      "capability": "conversation.continue",
+      "selector": "div[contenteditable=\"true\"][role=\"textbox\"][aria-multiline=\"true\"][data-placeholder=\"向千问提问\"][data-slate-editor=\"true\"]",
+      "expectedCount": 1
+    }
+  ],
+  "absenceSelectors": [
+    {
+      "purpose": "response.not-streaming",
+      "selector": ".chat-answers-card-wrap .qk-markdown:not(.qk-markdown-complete)",
+      "expectedCount": 0
+    }
+  ],
+  "redactions": [
+    "conversation history",
+    "message content",
+    "private route identifiers",
+    "scripts",
+    "styles"
+  ],
+  "notes": [
+    "A guest prompt produced a visibly complete response and a same-origin conversation route.",
+    "The prompt, response, and private conversation identifier were reduced to redaction markers."
+  ]
+}
diff --git a/test/fixtures/provider-dom/qwen/signed-out-guest/studio-response-complete.html b/test/fixtures/provider-dom/qwen/signed-out-guest/studio-response-complete.html
new file mode 100644
index 0000000..191f835
--- /dev/null
+++ b/test/fixtures/provider-dom/qwen/signed-out-guest/studio-response-complete.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Qwen Studio guest response evidence</title></head>
+  <body>
+    <button type="button">Log in</button>
+    <main>
+      <div class="qwen-chat-message-assistant">
+        <div class="chat-response-message">
+          <div class="qwen-markdown"><div><span>[redacted response]</span></div></div>
+        </div>
+      </div>
+      <textarea class="message-input-textarea"></textarea>
+      <button class="send-button" type="button" disabled></button>
+    </main>
+  </body>
+</html>
diff --git a/test/fixtures/provider-dom/qwen/signed-out-guest/studio-response-complete.provenance.json b/test/fixtures/provider-dom/qwen/signed-out-guest/studio-response-complete.provenance.json
new file mode 100644
index 0000000..ca6c601
--- /dev/null
+++ b/test/fixtures/provider-dom/qwen/signed-out-guest/studio-response-complete.provenance.json
@@ -0,0 +1,55 @@
+{
+  "schema": "tokenless.provider-dom-provenance.v1",
+  "provider": "qwen",
+  "accountState": "signed-out-guest",
+  "observedPlan": {
+    "status": "unknown",
+    "label": null
+  },
+  "scenario": "studio-response-complete",
+  "routeClass": "conversation",
+  "operationPhase": "response-complete",
+  "capabilityOutcome": "available",
+  "observedOn": "2026-07-29",
+  "sanitizedUrl": "https://chat.qwen.ai/c/guest",
+  "source": "managed-visible-provider-session",
+  "artifactKind": "redacted-reduced-dom",
+  "containsProviderJavaScript": false,
+  "containsSyntheticBehavior": false,
+  "contentSha256": "dca904c8dd9350767b6eb658b2e43a2ff36fefff71c74e97e0d87aac501dc484",
+  "evidenceSelectors": [
+    {
+      "capability": "prompt.input",
+      "selector": "textarea.message-input-textarea",
+      "expectedCount": 1
+    },
+    {
+      "capability": "prompt.submit",
+      "selector": "button.send-button",
+      "expectedCount": 1
+    },
+    {
+      "capability": "response.read",
+      "selector": ".qwen-chat-message-assistant .chat-response-message .qwen-markdown",
+      "expectedCount": 1
+    }
+  ],
+  "absenceSelectors": [
+    {
+      "purpose": "response.not-streaming",
+      "selector": "button.stop-button, .qwen-chat-message-awaiting-response",
+      "expectedCount": 0
+    }
+  ],
+  "redactions": [
+    "prompt content",
+    "response content",
+    "scripts",
+    "styles",
+    "unrelated controls"
+  ],
+  "notes": [
+    "A real guest prompt submitted from the canonical Qwen Studio home and navigated the same visible page to /c/guest.",
+    "The response text and unrelated page structure were removed from this reduction."
+  ]
+}
diff --git a/test/helpers/README.md b/test/helpers/README.md
index b785f1b..b48517d 100644
--- a/test/helpers/README.md
+++ b/test/helpers/README.md
@@ -2,7 +2,7 @@
 
 ## Capture Provider DOM With CDP
 
-Use `capture-provider-dom-cdp.mjs` to capture a sanitized DOM snapshot from a real provider page in a dedicated Chrome profile with the Chrome DevTools Protocol enabled. The helper supports `chatgpt`, `claude`, `gemini`, and `grok` through one provider-definition table. Each definition owns its allowed origin, launch URL, selector probes, and DOM artifact name.
+Use `capture-provider-dom-cdp.mjs` to capture a sanitized DOM snapshot from a real provider page in a dedicated Chrome profile with the Chrome DevTools Protocol enabled. The helper supports `chatgpt`, `claude`, `gemini`, `grok`, `qwen`, and `deepseek` through one provider-definition table. Each definition owns its allowed origin, launch URL, selector probes, and DOM artifact name.
 
 Start a dedicated Chrome profile at the provider page you want to inspect. For example, for Claude:
 
@@ -27,6 +27,7 @@ The accepted provider values and default pages are:
 | `claude` | `https://claude.ai/new` |
 | `gemini` | `https://gemini.google.com/app` |
 | `grok` | `https://grok.com/` |
+| `qwen` | `https://chat.qwen.ai/` |
 
 Artifacts are written under `test-results/<provider>-dom-captures/<timestamp>/`:
 
@@ -39,6 +40,16 @@ Artifacts are written under `test-results/<provider>-dom-captures/<timestamp>/`:
 
 The helper does not read or export provider cookies, localStorage, sessionStorage, hidden authentication headers, or private provider backend APIs. It evaluates read-only page JavaScript through CDP and writes only the sanitized DOM, probes, and metadata described above. Use a dedicated capture profile and inspect every artifact before promoting it into a test fixture.
 
+Promoted regression evidence lives under `test/fixtures/provider-dom/<provider>/<account-state>/`. Its machine-readable v2 `manifest.json` lists each HTML/provenance pair with the provider, sanitized page URL, route class, account state, capture date, scenario, operation phase, and capability outcome. A ready menu, input, or form does not imply that a later provider mutation succeeded; only a captured success postcondition may record that outcome.
+
+The authenticated deep-workflow reductions are maintained by:
+
+```bash
+node test/helpers/build-provider-workflow-fixtures.mjs
+```
+
+That helper rewrites the reduced workflow fixtures, recalculates their provenance digests, and inventories the full corpus. It never replaces the capture step: refresh visible evidence through Chrome or CDP first, inspect and redact it, then update the descriptor.
+
 Useful options:
 
 ```bash
diff --git a/test/helpers/api-capacity-child.mjs b/test/helpers/api-capacity-child.mjs
deleted file mode 100644
index 35f5994..0000000
--- a/test/helpers/api-capacity-child.mjs
+++ /dev/null
@@ -1,34 +0,0 @@
-import path from 'node:path'
-import { pathToFileURL } from 'node:url'
-
-const [moduleRoot, homeDir, provider, accountInternalId, maxConcurrency] = process.argv.slice(2)
-if (!moduleRoot || !homeDir || !provider || !accountInternalId || !maxConcurrency) {
-  process.exitCode = 2
-} else {
-  const { withApiAccountCapacity } = await import(new URL(
-    'api-account-capacity.js',
-    pathToFileURL(`${path.resolve(moduleRoot)}${path.sep}`),
-  ))
-  try {
-    await withApiAccountCapacity({
-      homeDir: path.resolve(homeDir),
-      provider,
-      accountInternalId,
-      maxConcurrency: Number(maxConcurrency),
-      queueDepth: 4,
-      queueWaitMs: 10_000,
-    }, async () => {
-      process.stdout.write('acquired\n')
-      await new Promise((resolve, reject) => {
-        process.stdin.once('data', resolve)
-        process.stdin.once('error', reject)
-        process.stdin.resume()
-      })
-      process.stdin.pause()
-      process.stdout.write('released\n')
-    })
-  } catch (error) {
-    process.stderr.write(`${error?.code ?? error?.name ?? 'error'}\n`)
-    process.exitCode = 1
-  }
-}
diff --git a/test/helpers/build-provider-workflow-fixtures.mjs b/test/helpers/build-provider-workflow-fixtures.mjs
new file mode 100644
index 0000000..e2281f5
--- /dev/null
+++ b/test/helpers/build-provider-workflow-fixtures.mjs
@@ -0,0 +1,719 @@
+import { createHash } from 'node:crypto'
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..')
+const fixtureRoot = path.join(root, 'test', 'fixtures', 'provider-dom')
+const observedOn = '2026-07-25'
+const source = 'authenticated-user-visible-chrome-session'
+const redactions = [
+  'account identity',
+  'chat titles',
+  'message content',
+  'uploaded file names',
+  'generated asset URLs',
+  'private route identifiers',
+  'scripts',
+  'styles',
+]
+
+const plans = Object.freeze({
+  chatgpt: { status: 'observed', label: 'Pro' },
+  claude: { status: 'observed', label: 'Free' },
+  gemini: { status: 'unknown', label: null },
+  grok: { status: 'observed', label: 'Free' },
+})
+
+const states = Object.freeze({
+  chatgpt: 'signed-in-paid',
+  claude: 'signed-in-free',
+  gemini: 'signed-in-unknown',
+  grok: 'signed-in-free',
+})
+
+const fixtures = [
+  fixture({
+    provider: 'chatgpt',
+    scenario: 'conversation-existing',
+    routeClass: 'conversation',
+    sanitizedUrl: 'https://chatgpt.com/c/[redacted]',
+    title: 'ChatGPT existing conversation',
+    body: `
+      <header><button aria-label="Share">Share</button><button aria-label="Open conversation options">More</button></header>
+      <main>
+        <article data-message-author-role="user"><h2>You said:</h2><p>[redacted message]</p></article>
+        <article data-message-author-role="assistant"><h2>ChatGPT said:</h2><p>[redacted response]</p></article>
+        <div id="prompt-textarea" role="textbox" contenteditable="true" aria-label="Chat with ChatGPT"></div>
+      </main>`,
+    evidenceSelectors: [
+      evidence('job.existing', 'main article[data-message-author-role]', 2),
+      evidence('job.continue', 'main [role="textbox"][aria-label="Chat with ChatGPT"]', 1),
+      evidence('job.share', 'button[aria-label="Share"]', 1),
+    ],
+  }),
+  fixture({
+    provider: 'chatgpt',
+    scenario: 'upload-tools-menu-open',
+    routeClass: 'new-chat',
+    sanitizedUrl: 'https://chatgpt.com/',
+    title: 'ChatGPT upload and tools menu',
+    body: `
+      <main>
+        <div id="prompt-textarea" role="textbox" contenteditable="true" aria-label="Chat with ChatGPT"></div>
+        <button data-testid="composer-plus-btn" aria-label="Add files and more" aria-expanded="true">Add</button>
+      </main>
+      <div role="menu" aria-label="Add files and more">
+        <div role="menuitem">Upload from computer</div>
+        <div role="menuitem">Create image</div>
+        <div role="menuitem">Web search</div>
+        <div role="menuitem">Deep research</div>
+        <div role="menuitem">Connect an app</div>
+      </div>`,
+    evidenceSelectors: [
+      evidence('upload.open', 'button[data-testid="composer-plus-btn"][aria-expanded="true"]', 1),
+      evidence('tools.enumerate', '[role="menu"] [role="menuitem"]', 5),
+    ],
+  }),
+  fixture({
+    provider: 'chatgpt',
+    scenario: 'library-files',
+    routeClass: 'library',
+    sanitizedUrl: 'https://chatgpt.com/library',
+    title: 'ChatGPT library',
+    body: `
+      <main>
+        <h1>Library</h1>
+        <button aria-label="Upload">Upload</button>
+        <input type="search" aria-label="Search">
+        <div role="tablist" aria-label="Library filters">
+          <button role="tab" aria-selected="true">All</button>
+          <button role="tab">Images</button>
+          <button role="tab">Documents</button>
+        </div>
+        <div role="grid" aria-label="Files"><div role="row">[redacted file]</div></div>
+      </main>`,
+    evidenceSelectors: [
+      evidence('library.open', 'main h1', 1),
+      evidence('library.upload', 'button[aria-label="Upload"]', 1),
+      evidence('library.filter', '[role="tablist"] [role="tab"]', 3),
+    ],
+  }),
+  fixture({
+    provider: 'chatgpt',
+    scenario: 'connectors-directory',
+    routeClass: 'connectors-directory',
+    sanitizedUrl: 'https://chatgpt.com/plugins',
+    title: 'ChatGPT connectors directory',
+    body: `
+      <main>
+        <div role="tablist" aria-label="Directory type"><button role="tab" aria-selected="true">Plugins</button><button role="tab">Skills</button></div>
+        <h1>Plugins</h1>
+        <input type="search" aria-label="Search plugins">
+        <section aria-label="Connector results">
+          <article><h2>Figma</h2><button>Connect</button></article>
+          <article><h2>GitHub</h2><button>Connect</button></article>
+          <article><h2>Gmail</h2><button>Connect</button></article>
+        </section>
+      </main>`,
+    evidenceSelectors: [
+      evidence('connector.search', 'input[aria-label="Search plugins"]', 1),
+      evidence('connector.list', 'section[aria-label="Connector results"] article', 3),
+    ],
+  }),
+  fixture({
+    provider: 'chatgpt',
+    scenario: 'scheduled-jobs',
+    routeClass: 'scheduled-jobs',
+    sanitizedUrl: 'https://chatgpt.com/scheduled',
+    title: 'ChatGPT scheduled jobs',
+    body: `
+      <main>
+        <h1>Scheduled</h1>
+        <div role="radiogroup" aria-label="Select chat surface"><label><input type="radio" checked>Chat</label><label><input type="radio">Work</label></div>
+        <button aria-label="Filter tasks">Active</button>
+        <textarea aria-label="Schedule a task"></textarea>
+        <article data-testid="scheduled-task"><h2>[redacted task]</h2><button>Edit</button><button>Pause</button><button>More</button></article>
+      </main>`,
+    evidenceSelectors: [
+      evidence('job.schedule', 'textarea[aria-label="Schedule a task"]', 1),
+      evidence('job.existing', 'article[data-testid="scheduled-task"]', 1),
+      evidence('job.control', 'article[data-testid="scheduled-task"] button', 3),
+    ],
+  }),
+  fixture({
+    provider: 'chatgpt',
+    scenario: 'settings-general',
+    routeClass: 'settings-overlay',
+    sanitizedUrl: 'https://chatgpt.com/scheduled',
+    title: 'ChatGPT settings',
+    body: `
+      <div role="dialog" aria-label="Settings">
+        <nav aria-label="Settings sections">
+          <button aria-current="page">General</button><button>Notifications</button><button>Personalization</button>
+          <button>Plugins</button><button>Billing</button><button>Usage</button><button>Data controls</button>
+          <button>Cloud browser</button><button>Storage</button><button>Security and login</button>
+        </nav>
+        <main><h2>General</h2><label>Appearance<select><option>System</option></select></label><label>Language<select><option>English</option></select></label></main>
+      </div>`,
+    evidenceSelectors: [
+      evidence('settings.open', '[role="dialog"][aria-label="Settings"]', 1),
+      evidence('settings.sections', 'nav[aria-label="Settings sections"] button', 10),
+    ],
+  }),
+  fixture({
+    provider: 'chatgpt',
+    scenario: 'image-result',
+    routeClass: 'conversation-image-result',
+    sanitizedUrl: 'https://chatgpt.com/c/[redacted]',
+    title: 'ChatGPT generated image result',
+    body: `
+      <main>
+        <article data-message-author-role="assistant">
+          <button aria-label="Generated image: [redacted description]"><img alt="Generated image: [redacted description]"></button>
+          <button aria-label="Edit image">Edit image</button>
+          <button aria-label="Share this image">Share this image</button>
+          <div role="group" aria-label="Response actions"><button>Copy</button><button>Like</button><button>Dislike</button><button>More</button></div>
+        </article>
+      </main>`,
+    evidenceSelectors: [
+      evidence('image.result', 'button[aria-label^="Generated image:"] img', 1),
+      evidence('image.edit', 'button[aria-label="Edit image"]', 1),
+      evidence('image.share', 'button[aria-label="Share this image"]', 1),
+    ],
+  }),
+
+  fixture({
+    provider: 'claude',
+    scenario: 'conversation-existing',
+    routeClass: 'conversation',
+    sanitizedUrl: 'https://claude.ai/chat/[redacted]',
+    title: 'Claude existing conversation',
+    body: `
+      <main>
+        <button aria-label="[redacted title], rename chat">[redacted title]</button>
+        <div role="feed" aria-label="Chat messages">
+          <article aria-label="Message 1"><h2>You said:</h2><p>[redacted message]</p></article>
+          <article aria-label="Message 2"><h2>Claude responded:</h2><p>[redacted response]</p></article>
+        </div>
+        <div data-testid="chat-input" role="textbox" contenteditable="true" aria-label="Write your prompt to Claude"></div>
+        <button aria-label="Add files, connectors, and more">Add</button>
+      </main>`,
+    evidenceSelectors: [
+      evidence('job.existing', '[role="feed"][aria-label="Chat messages"] article', 2),
+      evidence('job.continue', '[data-testid="chat-input"][role="textbox"]', 1),
+    ],
+  }),
+  fixture({
+    provider: 'claude',
+    scenario: 'upload-connectors-menu-open',
+    routeClass: 'new-chat',
+    sanitizedUrl: 'https://claude.ai/new',
+    title: 'Claude upload and connectors menu',
+    body: `
+      <main><button aria-label="Add files, connectors, and more" aria-expanded="true">Add</button></main>
+      <div role="menu" aria-label="Add files, connectors, and more">
+        <div role="menuitem">Add files or photos</div><div role="menuitem">Take a screenshot</div>
+        <div role="menuitem">Add to project</div><div role="menuitem">Skills</div>
+        <div role="menuitem">Add connector</div><div role="menuitem">Add plugins...</div>
+        <div role="menuitemcheckbox" aria-checked="true">Web search</div>
+      </div>`,
+    evidenceSelectors: [
+      evidence('upload.open', 'button[aria-label="Add files, connectors, and more"][aria-expanded="true"]', 1),
+      evidence('tools.enumerate', '[role="menu"] [role^="menuitem"]', 7),
+    ],
+  }),
+  fixture({
+    provider: 'claude',
+    scenario: 'settings-general',
+    routeClass: 'settings-overlay',
+    sanitizedUrl: 'https://claude.ai/new',
+    title: 'Claude settings',
+    body: `
+      <div role="dialog" aria-label="Settings">
+        <nav aria-label="Settings sections">
+          <button aria-current="page">General</button><button>Account</button><button>Privacy</button><button>Billing</button>
+          <button>Capabilities</button><button>Reflect</button><button>Time and focus</button><button>Claude Code</button>
+          <button>Skills</button><button>Connectors</button><button>Plugins</button><button>Memory</button>
+        </nav>
+        <main><h2>Profile</h2><label>Full name<input value="[redacted account identity]"></label><label>Display name<input value="[redacted account identity]"></label></main>
+      </div>`,
+    evidenceSelectors: [
+      evidence('settings.open', '[role="dialog"][aria-label="Settings"]', 1),
+      evidence('settings.sections', 'nav[aria-label="Settings sections"] button', 12),
+    ],
+  }),
+  fixture({
+    provider: 'claude',
+    scenario: 'connectors-settings',
+    routeClass: 'connectors-settings-overlay',
+    sanitizedUrl: 'https://claude.ai/new',
+    title: 'Claude connectors settings',
+    body: `
+      <div role="dialog" aria-label="Settings">
+        <button aria-current="page">Connectors</button>
+        <main>
+          <h2>Connectors</h2><input type="search" aria-label="Search connectors"><button>Add connector</button>
+          <div role="radiogroup" aria-label="Connector status"><button role="radio" aria-checked="true">All</button><button role="radio">Connected</button><button role="radio">Not connected</button></div>
+          <table><thead><tr><th>Connector</th><th>Type</th><th>Status</th></tr></thead><tbody><tr><td>GitHub</td><td>Integration</td><td><button>Connect</button></td></tr><tr><td>Notion</td><td>Integration</td><td><button>Connect</button></td></tr></tbody></table>
+        </main>
+      </div>`,
+    evidenceSelectors: [
+      evidence('connector.search', 'input[aria-label="Search connectors"]', 1),
+      evidence('connector.list', 'table tbody tr', 2),
+      evidence('connector.connect', 'table button', 2),
+    ],
+  }),
+  fixture({
+    provider: 'claude',
+    scenario: 'projects-list',
+    routeClass: 'projects',
+    sanitizedUrl: 'https://claude.ai/projects',
+    title: 'Claude projects',
+    body: `
+      <main>
+        <h1>Projects</h1><button aria-label="Search projects">Search projects</button><button aria-label="Sort projects">Sort projects</button><button>New project</button>
+        <ul aria-label="Projects"><li><a href="/project/[redacted]"><h2>[redacted project]</h2></a><button aria-label="Project options">More</button></li></ul>
+      </main>`,
+    evidenceSelectors: [
+      evidence('project.list', 'ul[aria-label="Projects"] li', 1),
+      evidence('project.create', 'button', 4),
+    ],
+  }),
+  fixture({
+    provider: 'claude',
+    scenario: 'artifacts-list',
+    routeClass: 'artifacts',
+    sanitizedUrl: 'https://claude.ai/artifacts',
+    title: 'Claude artifacts',
+    body: `
+      <main>
+        <h1>Artifacts</h1><button aria-label="Search your artifacts">Search</button><button>New artifact</button>
+        <ul aria-label="Artifacts"><li><a href="/chat/[redacted]"><h2>[redacted artifact]</h2></a><span>Edited</span><button aria-label="More options">More</button></li></ul>
+      </main>`,
+    evidenceSelectors: [
+      evidence('artifact.list', 'ul[aria-label="Artifacts"] li', 1),
+      evidence('artifact.create', 'button', 3),
+    ],
+  }),
+
+  fixture({
+    provider: 'gemini',
+    scenario: 'conversation-existing',
+    routeClass: 'conversation',
+    sanitizedUrl: 'https://gemini.google.com/app/[redacted]',
+    title: 'Gemini existing conversation',
+    body: `
+      <main>
+        <button aria-label="Open menu for conversation actions.">More</button>
+        <h1>Conversation with Gemini</h1>
+        <section aria-label="Conversation turns"><article><h2>You said</h2><p>[redacted message]</p></article><article><h2>Gemini said</h2><p>[redacted response]</p><button aria-label="Good response">Good</button><button aria-label="Copy">Copy</button></article></section>
+        <div role="textbox" contenteditable="true" aria-label="Enter a prompt for Gemini"></div>
+      </main>`,
+    evidenceSelectors: [
+      evidence('job.existing', 'section[aria-label="Conversation turns"] article', 2),
+      evidence('job.continue', '[role="textbox"][aria-label="Enter a prompt for Gemini"]', 1),
+    ],
+  }),
+  fixture({
+    provider: 'gemini',
+    scenario: 'search-chats',
+    routeClass: 'chat-search',
+    sanitizedUrl: 'https://gemini.google.com/search',
+    title: 'Gemini chat search',
+    body: `
+      <main>
+        <input role="textbox" aria-label="Search chats"><h3>Recent</h3>
+        <div role="listbox" aria-label="Recent"><div role="option">[redacted conversation]<span>[redacted date]</span></div><div role="option">[redacted conversation]<span>[redacted date]</span></div></div>
+      </main>`,
+    evidenceSelectors: [
+      evidence('job.search', '[role="textbox"][aria-label="Search chats"]', 1),
+      evidence('job.history', '[role="listbox"][aria-label="Recent"] [role="option"]', 2),
+    ],
+  }),
+  fixture({
+    provider: 'gemini',
+    scenario: 'upload-tools-menu-open',
+    routeClass: 'new-chat',
+    sanitizedUrl: 'https://gemini.google.com/app',
+    title: 'Gemini upload and tools menu',
+    body: `
+      <main><button aria-label="Upload and tools" aria-expanded="true">Add</button></main>
+      <div role="menu" aria-label="Menu options">
+        <div role="menuitem" aria-label="Upload files. Documents, data, code files">Upload files</div><div role="menuitem" aria-label="Add from Drive. Sheets, Docs, Slides">Add from Drive</div>
+        <button aria-label="More uploads">More uploads</button><div role="menuitemcheckbox">Create image</div><div role="menuitemcheckbox">Canvas</div><div role="menuitemcheckbox">Deep Research</div>
+      </div>`,
+    evidenceSelectors: [
+      evidence('upload.open', 'button[aria-label="Upload and tools"][aria-expanded="true"]', 1),
+      evidence('tools.enumerate', '[role="menu"] [role^="menuitem"]', 5),
+    ],
+  }),
+  fixture({
+    provider: 'gemini',
+    scenario: 'upload-sources-open',
+    routeClass: 'new-chat',
+    sanitizedUrl: 'https://gemini.google.com/app',
+    title: 'Gemini upload sources',
+    body: `
+      <div role="menu" aria-label="Menu options"><button aria-label="More uploads" aria-expanded="true">More uploads</button></div>
+      <div role="group" aria-label="More upload options"><div role="menuitem">Google Photos</div><div role="menuitem">Avatar</div><div role="menuitem">Notebooks</div></div>`,
+    evidenceSelectors: [
+      evidence('upload.sources', '[role="group"][aria-label="More upload options"] [role="menuitem"]', 3),
+      evidence('upload.expand', 'button[aria-label="More uploads"][aria-expanded="true"]', 1),
+    ],
+  }),
+  fixture({
+    provider: 'gemini',
+    scenario: 'settings-menu-open',
+    routeClass: 'settings-menu',
+    sanitizedUrl: 'https://gemini.google.com/app',
+    title: 'Gemini settings menu',
+    body: `
+      <button aria-label="Settings" aria-expanded="true">Settings</button>
+      <div role="menu" aria-label="Settings">
+        <div role="menuitem">Activity</div><div role="menuitem">Personal Intelligence</div><div role="menuitem">Import memory to Gemini</div>
+        <div role="menuitem">Usage limits</div><div role="menuitem">Gems</div><div role="menuitem">Your public links</div>
+        <div role="menuitem">Theme</div><div role="menuitem">View subscriptions</div><div role="menuitem">Gemini Notebook</div>
+      </div>`,
+    evidenceSelectors: [
+      evidence('settings.open', 'button[aria-label="Settings"][aria-expanded="true"]', 1),
+      evidence('settings.sections', '[role="menu"][aria-label="Settings"] [role="menuitem"]', 9),
+    ],
+  }),
+  fixture({
+    provider: 'gemini',
+    scenario: 'image-workspace',
+    routeClass: 'images',
+    sanitizedUrl: 'https://gemini.google.com/images',
+    title: 'Gemini image workspace',
+    body: `
+      <main>
+        <div role="textbox" contenteditable="true" aria-label="Enter a prompt for Gemini" data-placeholder="Describe your image"></div>
+        <div role="dialog" aria-label="Create images"><h2>Create images</h2><p>with Nano Banana 2</p><section><h3>Try a template</h3><p>Just add an image to get started</p></section><section><h3>Visualise anything</h3><p>Describe an idea in chat</p></section><button>Try it</button></div>
+      </main>`,
+    evidenceSelectors: [
+      evidence('image.create', '[role="dialog"][aria-label="Create images"]', 1),
+      evidence('image.prompt', '[role="textbox"][data-placeholder="Describe your image"]', 1),
+    ],
+  }),
+  fixture({
+    provider: 'gemini',
+    scenario: 'library-media',
+    routeClass: 'library',
+    sanitizedUrl: 'https://gemini.google.com/library',
+    title: 'Gemini library',
+    body: `
+      <main>
+        <h1>Library</h1><section aria-label="Documents"><h2>Documents</h2><p>Documents that you create will appear here</p></section>
+        <section aria-label="Media"><h2>Media</h2><button aria-label="Preview or open"><img alt="[redacted media]"></button><button aria-label="Delete media">Delete</button></section>
+      </main>`,
+    evidenceSelectors: [
+      evidence('library.sections', 'main section', 2),
+      evidence('image.retrieve', 'button[aria-label="Preview or open"] img', 1),
+    ],
+  }),
+
+  fixture({
+    provider: 'grok',
+    scenario: 'attach-menu-open',
+    routeClass: 'new-chat',
+    sanitizedUrl: 'https://grok.com/',
+    title: 'Grok attachment menu',
+    body: `
+      <main><button data-testid="attach-button" aria-label="Attach" aria-expanded="true">Attach</button></main>
+      <div role="menu" aria-label="Attach"><div role="menuitem">Upload a file</div><div role="menuitem">Recent</div><div role="menuitem">Skills</div><div role="menuitem">Add connector</div></div>`,
+    evidenceSelectors: [
+      evidence('upload.open', 'button[data-testid="attach-button"][aria-expanded="true"]', 1),
+      evidence('tools.enumerate', '[role="menu"][aria-label="Attach"] [role="menuitem"]', 4),
+    ],
+  }),
+  fixture({
+    provider: 'grok',
+    scenario: 'skills-list',
+    routeClass: 'skills',
+    sanitizedUrl: 'https://grok.com/skills-and-connectors',
+    title: 'Grok skills',
+    body: `
+      <main>
+        <h1>Skills and Connectors</h1><button>New Skill</button><div role="tablist"><button role="tab" aria-selected="true">Skills</button><button role="tab">Connectors</button></div><input type="search" aria-label="Search">
+        <section aria-label="Personal skills"><button>Word Documents</button><button>PDFs</button><button>Presentations</button><button>Spreadsheets</button><button>Skill Creator</button></section>
+      </main>`,
+    evidenceSelectors: [
+      evidence('skill.list', 'section[aria-label="Personal skills"] button', 5),
+      evidence('skill.create', 'main > button', 1),
+    ],
+  }),
+  fixture({
+    provider: 'grok',
+    scenario: 'connectors-list',
+    routeClass: 'connectors',
+    sanitizedUrl: 'https://grok.com/connectors',
+    title: 'Grok connectors',
+    body: `
+      <main>
+        <h1>Skills and Connectors</h1><button>New Connector</button><div role="tablist"><button role="tab">Skills</button><button role="tab" aria-selected="true">Connectors</button></div><input type="search" aria-label="Search">
+        <section aria-label="Featured connectors"><button>Gmail</button><button>Google Calendar</button><button>Google Drive</button><button>GitHub</button><button>Box</button><button>Canva</button><button>Notion</button><button>Stripe</button><button>Vercel</button></section>
+      </main>`,
+    evidenceSelectors: [
+      evidence('connector.list', 'section[aria-label="Featured connectors"] button', 9),
+      evidence('connector.create', 'main > button', 1),
+    ],
+  }),
+  fixture({
+    provider: 'grok',
+    scenario: 'imagine-workspace',
+    routeClass: 'imagine',
+    sanitizedUrl: 'https://grok.com/imagine',
+    title: 'Grok Imagine workspace',
+    body: `
+      <main>
+        <h1>Featured Templates</h1><section aria-label="Featured templates"><button>Glossy Product Shot</button><button>Chibi</button><button>Object Remover</button><button>Professional Headshot</button></section>
+        <div role="textbox" contenteditable="true" aria-label="Ask Grok anything" data-placeholder="Type to imagine"></div><button aria-label="Upload">Upload</button>
+        <div role="radiogroup" aria-label="Generation mode"><label><input type="radio" checked>Image</label><label><input type="radio">Video</label><label><input type="radio">Agent</label></div>
+        <button aria-label="Image Count">Auto</button><button aria-label="Aspect Ratio">2:3</button>
+      </main>`,
+    evidenceSelectors: [
+      evidence('image.prompt', '[role="textbox"][data-placeholder="Type to imagine"]', 1),
+      evidence('image.mode', '[role="radiogroup"][aria-label="Generation mode"] input', 3),
+      evidence('image.upload', 'button[aria-label="Upload"]', 1),
+    ],
+  }),
+  fixture({
+    provider: 'grok',
+    scenario: 'automations-list',
+    routeClass: 'automations',
+    sanitizedUrl: 'https://grok.com/automations',
+    title: 'Grok automations',
+    body: `
+      <main>
+        <h1>Automations</h1><button aria-label="New Automation">New Automation</button><h2>Suggested</h2>
+        <section aria-label="Suggested automations"><article><h3>Email Auto-Responder</h3><button>Add</button></article><article><h3>Daily Stock Tracker</h3><button>Add</button></article><article><h3>Task Extractor</h3><button>Add</button></article></section>
+      </main>`,
+    evidenceSelectors: [
+      evidence('automation.list', 'section[aria-label="Suggested automations"] article', 3),
+      evidence('automation.create', 'button[aria-label="New Automation"]', 1),
+    ],
+  }),
+  fixture({
+    provider: 'grok',
+    scenario: 'automation-new',
+    routeClass: 'automation-create-overlay',
+    sanitizedUrl: 'https://grok.com/automations',
+    title: 'Grok new automation',
+    body: `
+      <div role="dialog" aria-label="New Automation">
+        <button aria-label="Close">Close</button><input aria-label="Automation Name" value="My Automation"><h3>Triggers</h3><button>Add Trigger</button>
+        <h3>Instructions</h3><div role="textbox" contenteditable="true" aria-label="Ask Grok anything"></div><button aria-label="Attach">Attach</button>
+        <button aria-label="Connectors">Connectors 0</button><button aria-label="Skills">Skills 0</button><button aria-label="Model select">Fast</button>
+        <button>Cancel</button><button disabled>Save</button>
+      </div>`,
+    evidenceSelectors: [
+      evidence('automation.form', '[role="dialog"][aria-label="New Automation"]', 1),
+      evidence('automation.trigger', 'button:not([disabled])', 7),
+      evidence('automation.save-guard', 'button[disabled]', 1),
+    ],
+  }),
+  fixture({
+    provider: 'grok',
+    scenario: 'settings-account',
+    routeClass: 'settings-overlay',
+    sanitizedUrl: 'https://grok.com/',
+    title: 'Grok account settings',
+    body: `
+      <div role="dialog" aria-label="Settings">
+        <nav aria-label="Settings sections"><button aria-current="page">Account</button><button>Appearance</button><button>Behavior</button><button>Customize</button><button>Data Controls</button></nav>
+        <main><h2>Account</h2><p>[redacted account identity]</p><section aria-label="Plan"><span>Basic</span><p>Get SuperGrok</p><button>Upgrade</button></section><button aria-label="Language">Change</button><button aria-label="Birth Year">Change</button></main>
+      </div>`,
+    evidenceSelectors: [
+      evidence('settings.open', '[role="dialog"][aria-label="Settings"]', 1),
+      evidence('plan.visible', 'section[aria-label="Plan"]', 1),
+      evidence('plan.upgrade', 'section[aria-label="Plan"] button', 1),
+    ],
+    notes: ['The account panel exposes Basic and an upgrade action; runtime plan inference still uses model entitlement availability.'],
+  }),
+  fixture({
+    provider: 'grok',
+    scenario: 'search-history-empty',
+    routeClass: 'chat-search-overlay',
+    sanitizedUrl: 'https://grok.com/',
+    title: 'Grok empty chat history',
+    body: `
+      <div role="dialog" aria-label="Command Menu">
+        <input role="combobox" aria-label="Command Menu" aria-expanded="true"><div role="listbox" aria-label="Suggestions">
+          <div role="group" aria-label="Actions"><div role="option" aria-selected="true">Create New Private Chat</div></div>
+          <div role="group" aria-label="History"><p>History is empty</p></div>
+        </div><button aria-label="Hide Conversation Previews">Hide previews</button>
+      </div>`,
+    evidenceSelectors: [
+      evidence('job.search', '[role="combobox"][aria-label="Command Menu"]', 1),
+      evidence('job.history-empty', '[role="group"][aria-label="History"] p', 1),
+    ],
+    absenceSelectors: [
+      absence('no-observed-existing-conversations', '[role="group"][aria-label="History"] [role="option"]', 0),
+    ],
+  }),
+  fixture({
+    provider: 'grok',
+    scenario: 'project-new',
+    routeClass: 'project-create-overlay',
+    sanitizedUrl: 'https://grok.com/',
+    title: 'Grok new project',
+    body: `
+      <div role="dialog" aria-label="New Project">
+        <button aria-label="Close">Close</button><input aria-label="Project name"><label>Project Instructions<textarea aria-label="Project Instructions" placeholder="Add instructions about the tone, style, and persona you want Grok to adopt."></textarea></label>
+        <button>Cancel</button><button>Next</button>
+      </div>`,
+    evidenceSelectors: [
+      evidence('project.form', '[role="dialog"][aria-label="New Project"]', 1),
+      evidence('project.name', 'input[aria-label="Project name"]', 1),
+      evidence('project.instructions', 'textarea[aria-label="Project Instructions"]', 1),
+    ],
+  }),
+]
+
+for (const entry of fixtures) {
+  const accountRoot = path.join(fixtureRoot, entry.provider, entry.accountState)
+  await fs.mkdir(accountRoot, { recursive: true })
+  const html = document(entry.title, entry.body)
+  const htmlPath = path.join(accountRoot, `${entry.scenario}.html`)
+  const provenancePath = path.join(accountRoot, `${entry.scenario}.provenance.json`)
+  await fs.writeFile(htmlPath, html)
+  await fs.writeFile(provenancePath, `${JSON.stringify({
+    schema: 'tokenless.provider-dom-provenance.v1',
+    provider: entry.provider,
+    accountState: entry.accountState,
+    observedPlan: entry.observedPlan,
+    scenario: entry.scenario,
+    routeClass: entry.routeClass,
+    operationPhase: entry.operationPhase,
+    capabilityOutcome: entry.capabilityOutcome,
+    observedOn,
+    sanitizedUrl: entry.sanitizedUrl,
+    source,
+    artifactKind: 'redacted-reduced-dom',
+    containsProviderJavaScript: false,
+    containsSyntheticBehavior: false,
+    contentSha256: sha256(html),
+    evidenceSelectors: entry.evidenceSelectors,
+    absenceSelectors: entry.absenceSelectors,
+    redactions,
+    notes: entry.notes,
+  }, null, 2)}\n`)
+}
+
+const manifestEntries = []
+const providerDirectories = (await fs.readdir(fixtureRoot, { withFileTypes: true }))
+  .filter((entry) => entry.isDirectory())
+  .map((entry) => entry.name)
+for (const provider of providerDirectories) {
+  const providerRoot = path.join(fixtureRoot, provider)
+  const accountStates = await fs.readdir(providerRoot, { withFileTypes: true })
+  for (const accountState of accountStates.filter((entry) => entry.isDirectory())) {
+    const files = await fs.readdir(path.join(providerRoot, accountState.name))
+    for (const file of files.filter((name) => name.endsWith('.provenance.json'))) {
+      const provenance = JSON.parse(await fs.readFile(
+        path.join(providerRoot, accountState.name, file),
+        'utf8'
+      ))
+      manifestEntries.push({
+        provider,
+        accountState: accountState.name,
+        scenario: provenance.scenario,
+        routeClass: provenance.routeClass,
+        operationPhase: provenance.operationPhase ?? fixtureWorkflowMetadata(provenance.scenario).operationPhase,
+        capabilityOutcome: provenance.capabilityOutcome ?? fixtureWorkflowMetadata(provenance.scenario).capabilityOutcome,
+        sanitizedUrl: provenance.sanitizedUrl,
+        observedOn: provenance.observedOn,
+        htmlPath: `${provider}/${accountState.name}/${provenance.scenario}.html`,
+        provenancePath: `${provider}/${accountState.name}/${provenance.scenario}.provenance.json`,
+      })
+    }
+  }
+}
+
+manifestEntries.sort((left, right) => (
+  left.provider.localeCompare(right.provider)
+  || left.accountState.localeCompare(right.accountState)
+  || left.scenario.localeCompare(right.scenario)
+))
+
+await fs.writeFile(path.join(fixtureRoot, 'manifest.json'), `${JSON.stringify({
+  schema: 'tokenless.provider-dom-manifest.v2',
+  generatedBy: 'test/helpers/build-provider-workflow-fixtures.mjs',
+  fixtures: manifestEntries,
+}, null, 2)}\n`)
+
+console.log(`Wrote ${fixtures.length} deep workflow fixtures and inventoried ${manifestEntries.length} total fixtures.`)
+
+function fixture({
+  provider,
+  scenario,
+  routeClass,
+  sanitizedUrl,
+  title,
+  body,
+  evidenceSelectors,
+  absenceSelectors = [],
+  notes = [],
+}) {
+  return {
+    provider,
+    accountState: states[provider],
+    observedPlan: plans[provider],
+    scenario,
+    routeClass,
+    ...fixtureWorkflowMetadata(scenario),
+    sanitizedUrl,
+    title,
+    body,
+    evidenceSelectors,
+    absenceSelectors,
+    notes,
+  }
+}
+
+function fixtureWorkflowMetadata(scenario) {
+  if (scenario === 'conversation-existing') {
+    return { operationPhase: 'conversation-existing', capabilityOutcome: 'available' }
+  }
+  if (scenario === 'file-input-ready') {
+    return { operationPhase: 'file-input-ready', capabilityOutcome: 'available' }
+  }
+  if (
+    scenario === 'upload-tools-menu-open' ||
+    scenario === 'upload-connectors-menu-open' ||
+    scenario === 'upload-sources-open' ||
+    scenario === 'attach-menu-open'
+  ) {
+    return { operationPhase: 'upload-menu-open', capabilityOutcome: 'available' }
+  }
+  if (scenario === 'projects-list') {
+    return { operationPhase: 'workspace-list', capabilityOutcome: 'available' }
+  }
+  if (scenario === 'project-new') {
+    return { operationPhase: 'workspace-create-form', capabilityOutcome: 'unknown' }
+  }
+  return { operationPhase: 'observed', capabilityOutcome: 'available' }
+}
+
+function evidence(capability, selector, expectedCount) {
+  return { capability, selector, expectedCount }
+}
+
+function absence(purpose, selector, expectedCount) {
+  return { purpose, selector, expectedCount }
+}
+
+function document(title, body) {
+  return `<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>${title}</title></head>
+  <body>${body}
+  </body>
+</html>
+`
+}
+
+function sha256(value) {
+  return createHash('sha256').update(value).digest('hex')
+}
diff --git a/test/helpers/capture-provider-dom-cdp.mjs b/test/helpers/capture-provider-dom-cdp.mjs
index a9e952f..6bdb0cc 100644
--- a/test/helpers/capture-provider-dom-cdp.mjs
+++ b/test/helpers/capture-provider-dom-cdp.mjs
@@ -99,6 +99,7 @@ export const PROVIDER_DEFINITIONS = Object.freeze({
       ],
       blockers: [
         'iframe[src*="captcha"]',
+        'iframe[src*="challenges.cloudflare.com"]',
         'button[data-testid="login-with-google"]',
         'form:has(input[placeholder="Enter your email"]) button[data-testid="continue"]',
         'input[placeholder="Enter your email"]',
@@ -195,6 +196,85 @@ export const PROVIDER_DEFINITIONS = Object.freeze({
       projectLinks: [],
     },
   }),
+  qwen: defineProvider({
+    id: 'qwen',
+    label: 'Qwen',
+    origin: 'https://chat.qwen.ai',
+    url: 'https://chat.qwen.ai/',
+    outputName: 'qwen-dom.sanitized.html',
+    selectors: {
+      composers: [
+        'textarea.message-input-textarea',
+      ],
+      submits: [
+        'button.send-button',
+      ],
+      answers: [
+        '.qwen-chat-message-assistant .chat-response-message .qwen-markdown',
+        '.qwen-chat-message-assistant .qwen-markdown',
+      ],
+      blockers: [],
+      busy: [
+        'button.stop-button',
+        '.qwen-chat-message-awaiting-response',
+      ],
+      modelPickers: [],
+      effortPickers: [
+        '.qwen-select-thinking',
+        '[role="combobox"][aria-label="Thinking"]',
+      ],
+      modePickers: [
+        '[role="button"][aria-label="Select Mode"]',
+        '.mode-select',
+        '.message-input-column-footer-submode',
+        '[role="menuitem"].mode-select-common-item',
+      ],
+      fileInputs: [],
+      projectLinks: [],
+    },
+  }),
+  deepseek: defineProvider({
+    id: 'deepseek',
+    label: 'DeepSeek',
+    origin: 'https://chat.deepseek.com',
+    url: 'https://chat.deepseek.com/',
+    outputName: 'deepseek-dom.sanitized.html',
+    selectors: {
+      composers: [
+        'textarea#chat-input',
+        'textarea[placeholder="Message DeepSeek"]',
+      ],
+      submits: [
+        'button[aria-label="Send message"]',
+        'div[role="button"].ds-button.ds-button--primary',
+      ],
+      answers: [
+        '.ds-markdown.ds-markdown--block',
+        '.ds-markdown',
+      ],
+      blockers: [
+        'input[placeholder="Phone number / email address"]',
+        'iframe[src*="captcha" i]',
+        '[aria-label*="captcha" i]',
+      ],
+      busy: [
+        'button[aria-label*="Stop" i]',
+        '.ds-loading',
+      ],
+      modelPickers: [
+        'button:has-text("Instant Mode")',
+        'button:has-text("Expert Mode")',
+        'div[role="button"]:has-text("Instant Mode")',
+        'div[role="button"]:has-text("Expert Mode")',
+      ],
+      fileInputs: [
+        'input[type="file"]',
+        'button[aria-label*="Attach" i]',
+        'button[aria-label*="Upload" i]',
+      ],
+      projectLinks: [],
+    },
+  }),
 })
 
 export const providerDefinitions = PROVIDER_DEFINITIONS
@@ -225,7 +305,7 @@ export async function captureProviderDom({
     if (!provider) {
       throw usageError(
         'unsupported_provider',
-        'Provider must be one of: chatgpt, claude, gemini, grok.'
+        'Provider must be one of: chatgpt, claude, gemini, grok, qwen.'
       )
     }
     validateArgs(args)
@@ -278,7 +358,6 @@ export async function captureProviderDom({
         'meta',
         'noscript',
         'template',
-        'iframe',
         'object',
         'embed',
         'input[type="hidden"]',
@@ -618,6 +697,7 @@ export async function captureProviderDom({
           claude: new Set(['/new']),
           gemini: new Set(['/app', '/gems/view']),
           grok: new Set(['/']),
+          qwen: new Set(['/', '/c/guest']),
         }
         if (staticPaths[provider]?.has(normalized)) return normalized
 
@@ -626,6 +706,7 @@ export async function captureProviderDom({
           claude: new Set(['chat']),
           gemini: new Set(['app', 'gems', 'share']),
           grok: new Set(['c', 'share']),
+          qwen: new Set(['c']),
         }
         const firstSegment = normalized.split('/').filter(Boolean)[0]
         return firstSegment && knownRoutePrefixes[provider]?.has(firstSegment)
@@ -833,7 +914,7 @@ function printHelp({ forcedProvider, programName }) {
     '',
     ...(provider ? [] : [
       'Providers:',
-      '  chatgpt | claude | gemini | grok',
+      '  chatgpt | claude | gemini | grok | qwen',
       '',
     ]),
     'Options:',
diff --git a/test/helpers/capture-provider-dom-cdp.test.mjs b/test/helpers/capture-provider-dom-cdp.test.mjs
deleted file mode 100644
index 4026255..0000000
--- a/test/helpers/capture-provider-dom-cdp.test.mjs
+++ /dev/null
@@ -1,721 +0,0 @@
-import assert from 'node:assert/strict'
-import fs from 'node:fs/promises'
-import os from 'node:os'
-import path from 'node:path'
-import { spawn } from 'node:child_process'
-import { once } from 'node:events'
-import { createServer } from 'node:net'
-import { setTimeout as delay } from 'node:timers/promises'
-import test from 'node:test'
-import { chromium } from 'playwright'
-import {
-  captureProviderDom,
-  disconnectFromCdp,
-  PROVIDER_DEFINITIONS,
-} from './capture-provider-dom-cdp.mjs'
-
-const PRIVATE_MARKER = 'TOKENLESS_PRIVATE_ATTRIBUTE_MARKER_7f41d9'
-const EXACT_GROUPS = ['composers', 'submits', 'answers', 'fileInputs', 'projectLinks']
-const GEMINI_SELECTOR_INDEXES = Object.freeze({
-  composers: [0],
-  submits: [0],
-  answers: [0, 1],
-  busy: [0],
-  modelPickers: [0],
-  fileInputs: [0, 1],
-  projectLinks: [0],
-})
-const GROK_SELECTOR_INDEXES = Object.freeze({
-  composers: [0, 1],
-  submits: [0],
-  answers: [0],
-  blockers: [0],
-  modelPickers: [0],
-  fileInputs: [0, 1],
-})
-const captureCdpE2eEnabled = process.env.TOKENLESS_CAPTURE_CDP_E2E === '1'
-
-test('capture sanitizer preserves provider selectors without retaining arbitrary attribute values', {
-  skip: captureCdpE2eEnabled ? false : 'set TOKENLESS_CAPTURE_CDP_E2E=1 to run the external-CDP helper test',
-  timeout: 120000,
-}, async () => {
-  const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'tokenless-capture-sanitizer-'))
-  const port = await availablePort()
-  const endpoint = `http://127.0.0.1:${port}`
-  const chrome = spawn(chromium.executablePath(), [
-    '--headless=new',
-    `--remote-debugging-port=${port}`,
-    '--remote-allow-origins=*',
-    `--user-data-dir=${path.join(tempRoot, 'profile')}`,
-    '--disable-background-networking',
-    '--no-default-browser-check',
-    '--no-first-run',
-    'about:blank',
-  ], {
-    stdio: 'ignore',
-    windowsHide: true,
-  })
-
-  let browser
-  try {
-    await waitForCdp(endpoint, chrome)
-    browser = await chromium.connectOverCDP(endpoint)
-    const context = browser.contexts()[0]
-    await context.route('https://claude.ai/**', (route) => route.fulfill({
-      status: 200,
-      contentType: 'text/html',
-      body: secretBearingClaudeFixture(),
-    }))
-    const providerPage = context.pages()[0] ?? await context.newPage()
-    await providerPage.goto('https://claude.ai/new')
-    disconnectFromCdp(browser)
-    browser = undefined
-
-    const savedArgv = process.argv
-    process.argv = [
-      'node',
-      'capture-provider-dom-cdp.mjs',
-      '--provider',
-      'claude',
-      '--cdp-url',
-      endpoint,
-      '--output-dir',
-      path.join(tempRoot, 'captures'),
-    ]
-    let result
-    try {
-      result = await captureProviderDom()
-    } finally {
-      process.argv = savedArgv
-    }
-
-    assert.equal(result.ok, true)
-    const metadata = JSON.parse(await fs.readFile(result.metadataPath, 'utf8'))
-    const probes = JSON.parse(await fs.readFile(result.selectorProbesPath, 'utf8'))
-    const html = await fs.readFile(result.htmlPath, 'utf8')
-    assert.equal(metadata.provider, 'claude')
-    assert.equal(metadata.surface, 'visible-session-web-ui')
-    assert.equal(html.includes(PRIVATE_MARKER), false)
-    for (const group of EXACT_GROUPS) assert.equal(probes[group][0].count, 1, group)
-
-    browser = await chromium.connectOverCDP(endpoint)
-    const validationPage = await browser.contexts()[0].newPage()
-    await validationPage.setContent(html)
-    for (const group of EXACT_GROUPS) {
-      assert.equal(
-        await validationPage.locator(PROVIDER_DEFINITIONS.claude.selectors[group][0]).count(),
-        1,
-        `${group} exact selector`
-      )
-    }
-
-    const arbitraryAttributes = await validationPage.locator('section').evaluate((node) => (
-      Object.fromEntries([...node.attributes].map((attribute) => [attribute.name, attribute.value]))
-    ))
-    assert.deepEqual(arbitraryAttributes, {})
-
-    const composer = validationPage.locator(PROVIDER_DEFINITIONS.claude.selectors.composers[0])
-    assert.equal(await composer.getAttribute('id'), null)
-    assert.equal(await composer.getAttribute('class'), 'ProseMirror')
-    assert.equal(await composer.getAttribute('name'), null)
-    assert.equal(await composer.getAttribute('aria-controls'), null)
-    assert.equal(await composer.getAttribute('aria-description'), null)
-    assert.equal(await composer.getAttribute('data-private'), null)
-    assert.equal(await composer.getAttribute('aria-label'), 'Write your prompt to Claude')
-
-    const fileInput = validationPage.locator(PROVIDER_DEFINITIONS.claude.selectors.fileInputs[0])
-    assert.equal(await fileInput.getAttribute('id'), 'chat-input-file-upload-onpage')
-    assert.equal(await fileInput.getAttribute('class'), null)
-    assert.equal(await fileInput.getAttribute('name'), null)
-    assert.equal(await fileInput.getAttribute('aria-label'), null)
-
-    const projectLink = validationPage.locator(PROVIDER_DEFINITIONS.claude.selectors.projectLinks[0])
-    assert.equal(await projectLink.getAttribute('href'), '/projects')
-    assert.equal(await projectLink.getAttribute('aria-label'), 'Projects')
-    assert.equal(await projectLink.getAttribute('id'), null)
-    assert.equal(await projectLink.getAttribute('class'), null)
-
-    const broadSend = validationPage.locator('button').filter({ hasText: '[text]' }).last()
-    assert.equal((await broadSend.getAttribute('aria-label'))?.includes('Send'), true)
-    assert.equal((await broadSend.getAttribute('aria-label'))?.includes(PRIVATE_MARKER), false)
-    await validationPage.close()
-
-    process.argv = [
-      'node',
-      'capture-provider-dom-cdp.mjs',
-      '--provider',
-      'claude',
-      '--cdp-url',
-      endpoint,
-      '--output-dir',
-      path.join(tempRoot, 'bounded-text-captures'),
-      '--include-text',
-      '--max-text-chars',
-      '24',
-    ]
-    let boundedResult
-    try {
-      boundedResult = await captureProviderDom()
-    } finally {
-      process.argv = savedArgv
-    }
-    assert.equal(boundedResult.ok, true)
-    const boundedHtml = await fs.readFile(boundedResult.htmlPath, 'utf8')
-    const boundedVisibleText = await fs.readFile(boundedResult.visibleTextPath, 'utf8')
-    const boundedMetadataText = await fs.readFile(boundedResult.metadataPath, 'utf8')
-    const boundedProbesText = await fs.readFile(boundedResult.selectorProbesPath, 'utf8')
-    const boundedMetadata = JSON.parse(boundedMetadataText)
-    const boundedProbes = JSON.parse(boundedProbesText)
-    assert.ok(boundedVisibleText.trimEnd().length <= 24)
-    assert.ok(boundedMetadata.title.length <= 24)
-    for (const probes of Object.values(boundedProbes)) {
-      for (const probe of probes) assert.ok(probe.firstText.length <= 24)
-    }
-    for (const artifact of [
-      boundedHtml,
-      boundedVisibleText,
-      boundedMetadataText,
-      boundedProbesText,
-    ]) {
-      assert.equal(artifact.includes(PRIVATE_MARKER), false)
-    }
-
-    const boundedPage = await browser.contexts()[0].newPage()
-    await boundedPage.setContent(boundedHtml)
-    const preservedDomTextLength = await boundedPage.evaluate(() => {
-      const walker = document.createTreeWalker(document.documentElement, NodeFilter.SHOW_TEXT)
-      let length = 0
-      while (walker.nextNode()) {
-        const value = walker.currentNode.nodeValue?.trim() || ''
-        if (value && value !== '[text]') length += value.length
-      }
-      return length
-    })
-    assert.ok(preservedDomTextLength <= 24)
-    await boundedPage.close()
-
-    const geminiContext = browser.contexts()[0]
-    await geminiContext.route('https://gemini.google.com/**', (route) => route.fulfill({
-      status: 200,
-      contentType: 'text/html',
-      body: secretBearingGeminiFixture(),
-    }))
-    const geminiProviderPage = await geminiContext.newPage()
-    await geminiProviderPage.goto('https://gemini.google.com/app')
-    await geminiProviderPage.evaluate((privateMarker) => {
-      history.replaceState(null, '', `/app/${privateMarker}`)
-    }, PRIVATE_MARKER)
-    disconnectFromCdp(browser)
-    browser = undefined
-
-    process.argv = [
-      'node',
-      'capture-provider-dom-cdp.mjs',
-      '--provider',
-      'gemini',
-      '--cdp-url',
-      endpoint,
-      '--output-dir',
-      path.join(tempRoot, 'gemini-captures'),
-    ]
-    let geminiResult
-    try {
-      geminiResult = await captureProviderDom()
-    } finally {
-      process.argv = savedArgv
-    }
-
-    assert.equal(geminiResult.ok, true)
-    const geminiMetadataText = await fs.readFile(geminiResult.metadataPath, 'utf8')
-    const geminiProbesText = await fs.readFile(geminiResult.selectorProbesPath, 'utf8')
-    const geminiHtml = await fs.readFile(geminiResult.htmlPath, 'utf8')
-    const geminiMetadata = JSON.parse(geminiMetadataText)
-    const geminiProbes = JSON.parse(geminiProbesText)
-    assert.equal(geminiMetadata.provider, 'gemini')
-    assert.equal(geminiMetadata.surface, 'visible-session-web-ui')
-    assert.equal(geminiMetadata.url, 'https://gemini.google.com/app/[redacted]')
-    assert.equal(geminiResult.url, geminiMetadata.url)
-    for (const artifact of [geminiHtml, geminiMetadataText, geminiProbesText]) {
-      assert.equal(artifact.includes(PRIVATE_MARKER), false)
-    }
-    for (const [group, indexes] of Object.entries(GEMINI_SELECTOR_INDEXES)) {
-      for (const index of indexes) {
-        assert.equal(geminiProbes[group][index].count, 1, `${group}[${index}] probe`)
-      }
-    }
-
-    browser = await chromium.connectOverCDP(endpoint)
-    const geminiValidationPage = await browser.contexts()[0].newPage()
-    await geminiValidationPage.setContent(geminiHtml)
-    for (const [group, indexes] of Object.entries(GEMINI_SELECTOR_INDEXES)) {
-      for (const index of indexes) {
-        const selector = PROVIDER_DEFINITIONS.gemini.selectors[group][index]
-        assert.equal(
-          await geminiValidationPage.locator(selector).count(),
-          1,
-          `${group}[${index}] exact selector`
-        )
-      }
-    }
-
-    const geminiArbitraryAttributes = await geminiValidationPage.locator('section').evaluate((node) => (
-      Object.fromEntries([...node.attributes].map((attribute) => [attribute.name, attribute.value]))
-    ))
-    assert.deepEqual(geminiArbitraryAttributes, {})
-
-    const geminiComposer = geminiValidationPage.locator(
-      PROVIDER_DEFINITIONS.gemini.selectors.composers[0]
-    )
-    assert.equal(await geminiComposer.getAttribute('class'), 'ql-editor')
-    assert.equal(await geminiComposer.getAttribute('data-gramm'), 'false')
-    assert.equal(await geminiComposer.getAttribute('aria-label'), 'Enter a prompt for Gemini')
-    assert.equal(await geminiComposer.getAttribute('id'), null)
-    assert.equal(await geminiComposer.getAttribute('name'), null)
-    assert.equal(await geminiComposer.getAttribute('aria-controls'), null)
-    assert.equal(await geminiComposer.getAttribute('data-private'), null)
-
-    const geminiAnswer = geminiValidationPage.locator(
-      PROVIDER_DEFINITIONS.gemini.selectors.answers[0]
-    )
-    assert.equal(await geminiAnswer.textContent(), '[text]')
-    assert.equal(await geminiAnswer.getAttribute('id'), null)
-    assert.equal(await geminiAnswer.getAttribute('class'), null)
-    assert.equal(await geminiAnswer.getAttribute('data-private'), null)
-
-    const modelPicker = geminiValidationPage.locator(
-      PROVIDER_DEFINITIONS.gemini.selectors.modelPickers[0]
-    )
-    assert.equal(await modelPicker.getAttribute('data-test-id'), 'bard-mode-menu-button')
-    assert.equal(
-      await modelPicker.getAttribute('aria-label'),
-      'Open mode picker, currently [text]'
-    )
-    assert.equal(await modelPicker.getAttribute('data-private'), null)
-
-    const localUploader = geminiValidationPage.locator(
-      PROVIDER_DEFINITIONS.gemini.selectors.fileInputs[1]
-    )
-    assert.equal(
-      await localUploader.getAttribute('aria-label'),
-      'Upload files. Documents, data, code files'
-    )
-    assert.equal(await localUploader.getAttribute('data-private'), null)
-
-    const gemsLink = geminiValidationPage.locator(
-      PROVIDER_DEFINITIONS.gemini.selectors.projectLinks[0]
-    )
-    assert.equal(await gemsLink.getAttribute('href'), '/gems/view')
-    assert.equal(await gemsLink.getAttribute('id'), null)
-    assert.equal(await gemsLink.getAttribute('data-private'), null)
-    await geminiValidationPage.close()
-
-    const grokContext = browser.contexts()[0]
-    await grokContext.route('https://grok.com/**', (route) => route.fulfill({
-      status: 200,
-      contentType: 'text/html',
-      body: secretBearingGrokFixture(),
-    }))
-    const grokProviderPage = await grokContext.newPage()
-    await grokProviderPage.goto('https://grok.com/')
-    await grokProviderPage.evaluate((privateMarker) => {
-      history.replaceState(null, '', `/c/${privateMarker}`)
-    }, PRIVATE_MARKER)
-    disconnectFromCdp(browser)
-    browser = undefined
-
-    process.argv = [
-      'node',
-      'capture-provider-dom-cdp.mjs',
-      '--provider',
-      'grok',
-      '--cdp-url',
-      endpoint,
-      '--output-dir',
-      path.join(tempRoot, 'grok-captures'),
-    ]
-    let grokResult
-    try {
-      grokResult = await captureProviderDom()
-    } finally {
-      process.argv = savedArgv
-    }
-
-    assert.equal(grokResult.ok, true)
-    const grokMetadataText = await fs.readFile(grokResult.metadataPath, 'utf8')
-    const grokProbesText = await fs.readFile(grokResult.selectorProbesPath, 'utf8')
-    const grokHtml = await fs.readFile(grokResult.htmlPath, 'utf8')
-    const grokMetadata = JSON.parse(grokMetadataText)
-    const grokProbes = JSON.parse(grokProbesText)
-    assert.equal(grokMetadata.provider, 'grok')
-    assert.equal(grokMetadata.surface, 'visible-session-web-ui')
-    assert.equal(grokMetadata.url, 'https://grok.com/c/[redacted]')
-    assert.equal(grokResult.url, grokMetadata.url)
-    for (const artifact of [grokHtml, grokMetadataText, grokProbesText]) {
-      assert.equal(artifact.includes(PRIVATE_MARKER), false)
-    }
-    for (const [group, indexes] of Object.entries(GROK_SELECTOR_INDEXES)) {
-      for (const index of indexes) {
-        assert.equal(grokProbes[group][index].count, 1, `${group}[${index}] probe`)
-      }
-    }
-
-    browser = await chromium.connectOverCDP(endpoint)
-    const grokValidationPage = await browser.contexts()[0].newPage()
-    await grokValidationPage.setContent(grokHtml)
-    for (const [group, indexes] of Object.entries(GROK_SELECTOR_INDEXES)) {
-      for (const index of indexes) {
-        const selector = PROVIDER_DEFINITIONS.grok.selectors[group][index]
-        assert.equal(
-          await grokValidationPage.locator(selector).count(),
-          1,
-          `${group}[${index}] exact selector`
-        )
-      }
-    }
-
-    const grokComposer = grokValidationPage.locator(
-      PROVIDER_DEFINITIONS.grok.selectors.composers[0]
-    )
-    assert.equal(await grokComposer.getAttribute('class'), 'tiptap ProseMirror')
-    assert.equal(await grokComposer.getAttribute('aria-label'), 'Ask Grok anything')
-    assert.equal(await grokComposer.getAttribute('aria-multiline'), 'true')
-    assert.equal(await grokComposer.getAttribute('id'), null)
-    assert.equal(await grokComposer.getAttribute('data-private'), null)
-
-    const grokFileInput = grokValidationPage.locator(
-      PROVIDER_DEFINITIONS.grok.selectors.fileInputs[0]
-    )
-    assert.equal(await grokFileInput.getAttribute('name'), 'files')
-    assert.equal(await grokFileInput.getAttribute('multiple'), '')
-    assert.equal(await grokFileInput.getAttribute('class'), null)
-    assert.equal(await grokFileInput.getAttribute('data-private'), null)
-
-    const grokAnswer = grokValidationPage.locator(
-      PROVIDER_DEFINITIONS.grok.selectors.answers[0]
-    )
-    assert.equal(await grokAnswer.textContent(), '[text]')
-    assert.equal(await grokAnswer.getAttribute('id'), null)
-    assert.equal(await grokAnswer.getAttribute('data-private'), null)
-    await grokValidationPage.close()
-  } finally {
-    disconnectFromCdp(browser)
-    await stopControlledChrome(endpoint, chrome)
-    const resolvedTempRoot = path.resolve(tempRoot)
-    assert.equal(
-      path.dirname(resolvedTempRoot).toLowerCase(),
-      path.resolve(os.tmpdir()).toLowerCase(),
-      'Refusing to remove an unexpected directory.'
-    )
-    await fs.rm(resolvedTempRoot, {
-      recursive: true,
-      force: true,
-      maxRetries: 5,
-      retryDelay: 100,
-    })
-  }
-})
-
-async function availablePort() {
-  const server = createServer()
-  await new Promise((resolve, reject) => {
-    server.once('error', reject)
-    server.listen(0, '127.0.0.1', resolve)
-  })
-  const { port } = server.address()
-  await new Promise((resolve) => server.close(resolve))
-  return port
-}
-
-async function waitForCdp(endpoint, chrome) {
-  for (let attempt = 0; attempt < 100; attempt += 1) {
-    if (chrome.exitCode !== null) throw new Error('Controlled Chrome exited before CDP was ready.')
-    try {
-      if ((await fetch(`${endpoint}/json/version`)).ok) return
-    } catch {
-      // The dedicated local endpoint may not be listening yet.
-    }
-    await delay(50)
-  }
-  throw new Error('Controlled Chrome did not expose CDP in time.')
-}
-
-async function stopControlledChrome(endpoint, chrome) {
-  let cleanupBrowser
-  try {
-    cleanupBrowser = await chromium.connectOverCDP(endpoint, { timeout: 2000 })
-    const session = await cleanupBrowser.newBrowserCDPSession()
-    await Promise.race([
-      session.send('Browser.close').catch(() => undefined),
-      delay(2000),
-    ])
-  } catch {
-    // The controlled process may already be gone after a failed assertion.
-  } finally {
-    disconnectFromCdp(cleanupBrowser)
-  }
-  if (chrome.exitCode === null) await Promise.race([once(chrome, 'exit'), delay(3000)])
-  if (chrome.exitCode === null) chrome.kill('SIGTERM')
-  if (chrome.exitCode === null) await Promise.race([once(chrome, 'exit'), delay(3000)])
-  if (chrome.exitCode === null) chrome.kill('SIGKILL')
-  if (chrome.exitCode === null) await Promise.race([once(chrome, 'exit'), delay(3000)])
-}
-
-function secretBearingClaudeFixture() {
-  return `<!doctype html>
-<html
-  id="${PRIVATE_MARKER}-html-id"
-  class="${PRIVATE_MARKER}-html-class"
-  name="${PRIVATE_MARKER}-html-name"
-  aria-label="${PRIVATE_MARKER}-html-aria"
-  data-private="${PRIVATE_MARKER}-html-data"
->
-  <head><title>${PRIVATE_MARKER} title</title></head>
-  <body>
-    <section
-      id="${PRIVATE_MARKER}-id"
-      class="${PRIVATE_MARKER}-class"
-      name="${PRIVATE_MARKER}-name"
-      aria-label="${PRIVATE_MARKER}-aria-label"
-      aria-controls="${PRIVATE_MARKER}-aria-controls"
-      aria-valuetext="${PRIVATE_MARKER}-aria-value"
-      data-testid="${PRIVATE_MARKER}-testid"
-      data-private="${PRIVATE_MARKER}-data"
-      custom-attribute="${PRIVATE_MARKER}-custom"
-    >${PRIVATE_MARKER} arbitrary text</section>
-    <main>
-      <div data-testid="virtual-message-list" aria-live="polite">
-        <div
-          class="font-claude-response-body ${PRIVATE_MARKER}-answer-class"
-          id="${PRIVATE_MARKER}-answer-id"
-          name="${PRIVATE_MARKER}-answer-name"
-          aria-label="${PRIVATE_MARKER}-answer-aria"
-          data-private="${PRIVATE_MARKER}-answer-data"
-        >${PRIVATE_MARKER} answer text</div>
-      </div>
-      <input
-        id="chat-input-file-upload-onpage"
-        data-testid="file-upload"
-        type="file"
-        hidden
-        class="${PRIVATE_MARKER}-file-class"
-        name="${PRIVATE_MARKER}-file-name"
-        aria-label="${PRIVATE_MARKER}-file-aria"
-      >
-      <div
-        data-testid="chat-input"
-        contenteditable="true"
-        role="textbox"
-        class="ProseMirror ${PRIVATE_MARKER}-composer-class"
-        id="${PRIVATE_MARKER}-composer-id"
-        name="${PRIVATE_MARKER}-composer-name"
-        aria-label="Write your prompt to Claude"
-        aria-controls="${PRIVATE_MARKER}-composer-controls"
-        aria-description="${PRIVATE_MARKER}-composer-description"
-        data-private="${PRIVATE_MARKER}-composer-data"
-      ><p>${PRIVATE_MARKER} prompt text</p></div>
-      <button
-        data-cds="Button"
-        aria-label="Send message"
-        type="button"
-        class="${PRIVATE_MARKER}-send-class"
-        name="${PRIVATE_MARKER}-send-name"
-      >${PRIVATE_MARKER} send text</button>
-      <button
-        aria-label="Send ${PRIVATE_MARKER}-broad-label"
-        class="${PRIVATE_MARKER}-broad-send-class"
-      >${PRIVATE_MARKER} broad send text</button>
-      <a
-        href="/projects"
-        aria-label="Projects"
-        id="${PRIVATE_MARKER}-project-id"
-        class="${PRIVATE_MARKER}-project-class"
-        name="${PRIVATE_MARKER}-project-name"
-        data-private="${PRIVATE_MARKER}-project-data"
-      >${PRIVATE_MARKER} projects text</a>
-    </main>
-  </body>
-</html>`
-}
-
-function secretBearingGeminiFixture() {
-  return `<!doctype html>
-<html
-  id="${PRIVATE_MARKER}-html-id"
-  class="${PRIVATE_MARKER}-html-class"
-  aria-label="${PRIVATE_MARKER}-html-aria"
-  data-private="${PRIVATE_MARKER}-html-data"
->
-  <head><title>${PRIVATE_MARKER} Gemini title</title></head>
-  <body>
-    <section
-      id="${PRIVATE_MARKER}-id"
-      class="${PRIVATE_MARKER}-class"
-      name="${PRIVATE_MARKER}-name"
-      aria-label="${PRIVATE_MARKER}-aria-label"
-      aria-controls="${PRIVATE_MARKER}-aria-controls"
-      data-test-id="${PRIVATE_MARKER}-testid"
-      data-private="${PRIVATE_MARKER}-data"
-      custom-attribute="${PRIVATE_MARKER}-custom"
-    >${PRIVATE_MARKER} arbitrary Gemini text</section>
-    <nav>
-      <a
-        href="/gems/view"
-        id="${PRIVATE_MARKER}-gems-id"
-        class="${PRIVATE_MARKER}-gems-class"
-        data-private="${PRIVATE_MARKER}-gems-data"
-      >${PRIVATE_MARKER} Gems text</a>
-    </nav>
-    <main>
-      <response-container
-        id="${PRIVATE_MARKER}-response-id"
-        data-private="${PRIVATE_MARKER}-response-data"
-      >
-        <structured-content-container
-          class="message-content ${PRIVATE_MARKER}-structured-class"
-          aria-label="${PRIVATE_MARKER}-structured-aria"
-          data-private="${PRIVATE_MARKER}-structured-data"
-        >
-          <message-content
-            id="${PRIVATE_MARKER}-message-id"
-            class="${PRIVATE_MARKER}-message-class"
-            data-private="${PRIVATE_MARKER}-message-data"
-          >${PRIVATE_MARKER} answer text</message-content>
-        </structured-content-container>
-      </response-container>
-      <rich-textarea data-private="${PRIVATE_MARKER}-rich-textarea-data">
-        <div
-          class="ql-editor ${PRIVATE_MARKER}-composer-class"
-          data-gramm="false"
-          contenteditable="true"
-          role="textbox"
-          aria-multiline="true"
-          aria-label="Enter a prompt for Gemini"
-          id="${PRIVATE_MARKER}-composer-id"
-          name="${PRIVATE_MARKER}-composer-name"
-          aria-controls="${PRIVATE_MARKER}-composer-controls"
-          data-private="${PRIVATE_MARKER}-composer-data"
-        ><p>${PRIVATE_MARKER} prompt text</p></div>
-      </rich-textarea>
-      <button
-        aria-label="Send message"
-        type="button"
-        class="${PRIVATE_MARKER}-send-class"
-        data-private="${PRIVATE_MARKER}-send-data"
-      >${PRIVATE_MARKER} send text</button>
-      <button
-        aria-label="Stop response"
-        type="button"
-        class="${PRIVATE_MARKER}-stop-class"
-        data-private="${PRIVATE_MARKER}-stop-data"
-      >${PRIVATE_MARKER} stop text</button>
-      <button
-        data-test-id="bard-mode-menu-button"
-        aria-label="Open mode picker, currently Flash ${PRIVATE_MARKER}"
-        type="button"
-        class="${PRIVATE_MARKER}-model-class"
-        data-private="${PRIVATE_MARKER}-model-data"
-      >${PRIVATE_MARKER} model text</button>
-      <button
-        aria-label="Upload &amp; tools"
-        aria-haspopup="menu"
-        type="button"
-        class="${PRIVATE_MARKER}-tools-class"
-        data-private="${PRIVATE_MARKER}-tools-data"
-      >${PRIVATE_MARKER} tools text</button>
-      <button
-        data-test-id="local-images-files-uploader-button"
-        role="menuitem"
-        aria-label="Upload files. Documents, data, code files"
-        type="button"
-        class="${PRIVATE_MARKER}-upload-class"
-        data-private="${PRIVATE_MARKER}-upload-data"
-      >${PRIVATE_MARKER} upload text</button>
-    </main>
-  </body>
-</html>`
-}
-
-function secretBearingGrokFixture() {
-  return `<!doctype html>
-<html
-  id="${PRIVATE_MARKER}-html-id"
-  class="${PRIVATE_MARKER}-html-class"
-  aria-label="${PRIVATE_MARKER}-html-aria"
-  data-private="${PRIVATE_MARKER}-html-data"
->
-  <head><title>${PRIVATE_MARKER} Grok title</title></head>
-  <body>
-    <section
-      id="${PRIVATE_MARKER}-id"
-      class="${PRIVATE_MARKER}-class"
-      name="${PRIVATE_MARKER}-name"
-      aria-label="${PRIVATE_MARKER}-aria-label"
-      data-testid="${PRIVATE_MARKER}-testid"
-      data-private="${PRIVATE_MARKER}-data"
-      custom-attribute="${PRIVATE_MARKER}-custom"
-    >${PRIVATE_MARKER} arbitrary Grok text</section>
-    <main>
-      <div
-        data-testid="assistant-message"
-        dir="auto"
-        id="${PRIVATE_MARKER}-answer-id"
-        class="${PRIVATE_MARKER}-answer-class"
-        data-private="${PRIVATE_MARKER}-answer-data"
-      >${PRIVATE_MARKER} answer text</div>
-      <div
-        class="tiptap ProseMirror ${PRIVATE_MARKER}-composer-class"
-        contenteditable="true"
-        role="textbox"
-        aria-label="Ask Grok anything"
-        aria-multiline="true"
-        aria-disabled="false"
-        id="${PRIVATE_MARKER}-composer-id"
-        data-private="${PRIVATE_MARKER}-composer-data"
-      ><p>${PRIVATE_MARKER} prompt text</p></div>
-      <textarea
-        aria-label="Ask Grok anything"
-        placeholder="What do you want to know?"
-        id="${PRIVATE_MARKER}-textarea-id"
-        class="${PRIVATE_MARKER}-textarea-class"
-        data-private="${PRIVATE_MARKER}-textarea-data"
-      >${PRIVATE_MARKER} alternate prompt text</textarea>
-      <button
-        data-testid="chat-submit"
-        aria-label="Submit"
-        type="submit"
-        class="${PRIVATE_MARKER}-submit-class"
-        data-private="${PRIVATE_MARKER}-submit-data"
-      >${PRIVATE_MARKER} submit text</button>
-      <div
-        data-testid="anon-paywall-sign-up-card"
-        id="${PRIVATE_MARKER}-paywall-id"
-        class="${PRIVATE_MARKER}-paywall-class"
-        data-private="${PRIVATE_MARKER}-paywall-data"
-      >${PRIVATE_MARKER} paywall text</div>
-      <button
-        id="model-select-trigger"
-        aria-label="Model select"
-        aria-haspopup="menu"
-        type="button"
-        class="${PRIVATE_MARKER}-model-class"
-        data-private="${PRIVATE_MARKER}-model-data"
-      >${PRIVATE_MARKER} model text</button>
-      <input
-        type="file"
-        name="files"
-        multiple
-        class="${PRIVATE_MARKER}-file-class"
-        data-private="${PRIVATE_MARKER}-file-data"
-      >
-      <button
-        data-testid="attach-button"
-        aria-label="Attach"
-        aria-haspopup="menu"
-        type="button"
-        class="${PRIVATE_MARKER}-attach-class"
-        data-private="${PRIVATE_MARKER}-attach-data"
-      >${PRIVATE_MARKER} attach text</button>
-    </main>
-  </body>
-</html>`
-}
diff --git a/test/helpers/live-browser-observer.mjs b/test/helpers/live-browser-observer.mjs
new file mode 100644
index 0000000..8bf8948
--- /dev/null
+++ b/test/helpers/live-browser-observer.mjs
@@ -0,0 +1,427 @@
+import assert from 'node:assert/strict'
+import { createHash, randomBytes, randomUUID } from 'node:crypto'
+import { spawn, spawnSync } from 'node:child_process'
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import { DatabaseSync } from 'node:sqlite'
+import { fileURLToPath } from 'node:url'
+
+import { chromium } from 'playwright'
+import { getProviderInstanceForUrl } from '../../packages/cli/dist/src/playwright/index.js'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..')
+const cliEntry = path.join(root, 'packages/cli/dist/src/tokenless.mjs')
+const protocol = 'tokenless.e2e-browser-inspection.v2'
+const pollMs = 50
+const daemonStopTimeoutMs = 60_000
+
+export async function createLiveBrowserInspectionSession(options) {
+  const homeDir = path.resolve(requiredString(options.homeDir, 'homeDir'))
+  const profileSlug = requiredString(options.profileSlug, 'profileSlug')
+  const daemonUrl = options.daemonUrl === undefined ? undefined : requiredString(options.daemonUrl, 'daemonUrl')
+  const runId = `e2e-${randomUUID()}`
+  const nonce = randomBytes(32).toString('base64url')
+  const startedAt = Date.now()
+  const env = {
+    ...process.env,
+    TOKENLESS_PROVIDER: '',
+    TOKENLESS_E2E_BROWSER_INSPECTION: '1',
+    TOKENLESS_E2E_RUN_ID: runId,
+    TOKENLESS_E2E_NONCE: nonce,
+    TOKENLESS_E2E_OBSERVER_TIMEOUT_MS: String(options.observerTimeoutMs ?? 30_000),
+  }
+  const barrierRoot = path.join(homeDir, 'e2e', 'browser-inspection', runId)
+  const runKey = createHash('sha256').update(runId).digest('base64url').slice(0, 16)
+  const jobPrefix = `tlp_e2e_${runKey}_`
+  const seenBarriers = new Set()
+  const observers = new Set()
+
+  await stopExistingDaemons({ homeDir, daemonUrl })
+
+  const observeNextAttempt = async (observeOptions = {}) => {
+    const waiting = await waitForWaitingBarrier({
+      barrierRoot,
+      nonce,
+      jobPrefix,
+      seenBarriers,
+      expectedJobId: observeOptions.jobId,
+      childOutput: observeOptions.childOutput,
+      timeoutMs: observeOptions.timeoutMs ?? 120_000,
+    })
+    seenBarriers.add(barrierIdentity(waiting))
+    const observer = await connectObserver(waiting, startedAt)
+    observers.add(observer.browser)
+    await observeOptions.beforeRelease?.({ waiting, page: observer.page })
+    const observation = observeOptions.observeAfterRelease === undefined
+      ? Promise.resolve(undefined)
+      : Promise.resolve().then(() => observeOptions.observeAfterRelease({ waiting, page: observer.page }))
+    await releaseBarrier({ barrierRoot, waiting, runId, nonce })
+    return {
+      waiting,
+      page: observer.page,
+      async wait() {
+        return await observation
+      },
+      async close() {
+        await observer.browser.close()
+        observers.delete(observer.browser)
+      },
+    }
+  }
+
+  return {
+    runId,
+    homeDir,
+    profileSlug,
+    environment: Object.freeze({ ...env }),
+    createJobId() {
+      return `${jobPrefix}${randomUUID()}`
+    },
+    observeNextAttempt,
+    async startCli(args, startOptions = {}) {
+      const commandArgs = [
+        ...args,
+        '--profile', profileSlug,
+        '--home', homeDir,
+        ...(daemonUrl ? ['--daemon-url', daemonUrl] : []),
+        '--json',
+      ]
+      const child = spawn(process.execPath, [cliEntry, ...commandArgs], {
+        cwd: root,
+        env,
+        stdio: ['ignore', 'pipe', 'pipe'],
+      })
+      const output = collectChildOutput(child)
+      const attempt = await observeNextAttempt({
+        childOutput: output,
+        timeoutMs: startOptions.startTimeoutMs ?? 120_000,
+        beforeRelease: startOptions.beforeRelease,
+        observeAfterRelease: startOptions.observeAfterRelease,
+      })
+      return {
+        waiting: attempt.waiting,
+        page: attempt.page,
+        async wait() {
+          const [result, observerResult] = await Promise.all([output.exit, attempt.wait()])
+          return {
+            ...result,
+            payload: parseJsonOutput(result),
+            observerResult,
+          }
+        },
+        async close() {
+          await attempt.close()
+        },
+      }
+    },
+    async close() {
+      const canceledJobs = cancelRunJobs({ homeDir, daemonUrl, env, jobPrefix })
+      await Promise.allSettled([...observers].map((browser) => browser.close()))
+      observers.clear()
+      const result = runCliSync([
+        'daemon', 'stop',
+        '--home', homeDir,
+        ...(daemonUrl ? ['--daemon-url', daemonUrl] : []),
+        '--timeout-ms', String(daemonStopTimeoutMs),
+        '--json',
+      ], env)
+      await fs.rm(barrierRoot, { recursive: true, force: true }).catch(() => undefined)
+      assertCliSuccess(result, 'stop the E2E inspection daemon')
+      for (const canceled of canceledJobs) {
+        assertCliSuccess(canceled.result, `cancel E2E inspection job ${canceled.jobId}`)
+      }
+      return { ...result, canceledJobs }
+    },
+  }
+}
+
+function cancelRunJobs({ homeDir, daemonUrl, env, jobPrefix }) {
+  const database = new DatabaseSync(path.join(homeDir, 'tokenless.sqlite3'), { readOnly: true })
+  let rows
+  try {
+    rows = database.prepare(
+      `SELECT job_id
+       FROM jobs
+       WHERE substr(job_id, 1, length(?)) = ?
+         AND status IN ('queued', 'claimed', 'running', 'waiting_for_user')
+       ORDER BY created_at, job_id`,
+    ).all(jobPrefix, jobPrefix)
+  } finally {
+    database.close()
+  }
+  return rows.map(({ job_id: jobId }) => ({
+    jobId,
+    result: runCliSync([
+      'cancel',
+      '--job-id', jobId,
+      '--home', homeDir,
+      ...(daemonUrl ? ['--daemon-url', daemonUrl] : []),
+      '--json',
+    ], env),
+  }))
+}
+
+async function waitForWaitingBarrier(options) {
+  const deadline = Date.now() + options.timeoutMs
+  while (Date.now() <= deadline) {
+    const exited = options.childOutput?.settled()
+    const waiting = await findWaitingBarrier(
+      options.barrierRoot,
+      options.seenBarriers,
+      options.jobPrefix,
+      options.expectedJobId,
+    )
+    if (waiting) {
+      assert.equal(waiting.protocol, protocol)
+      assert.equal(waiting.nonce, options.nonce)
+      assert.equal(typeof waiting.jobId, 'string')
+      assert.equal(typeof waiting.profileId, 'string')
+      assert.equal(typeof waiting.profileDirectory, 'string')
+      assert.equal(typeof waiting.provider, 'string')
+      assert.equal(typeof waiting.url, 'string')
+      assert.match(waiting.targetId ?? '', /^[A-Fa-f0-9]{16,128}$/)
+      return waiting
+    }
+    if (exited) {
+      throw new Error(`CLI exited before reaching the browser observer barrier:\n${summarizeProcess(exited)}`)
+    }
+    await delay(pollMs)
+  }
+  throw new Error(`Timed out after ${options.timeoutMs}ms waiting for the browser observer barrier.`)
+}
+
+async function findWaitingBarrier(barrierRoot, seenBarriers, jobPrefix, expectedJobId) {
+  let entries
+  try {
+    entries = await fs.readdir(barrierRoot, { withFileTypes: true })
+  } catch (error) {
+    if (isMissingFileError(error)) return null
+    throw error
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory() || !entry.name.startsWith(jobPrefix)) continue
+    if (expectedJobId !== undefined && entry.name !== expectedJobId) continue
+    const waitingPath = path.join(barrierRoot, entry.name, 'waiting.json')
+    try {
+      const waiting = JSON.parse(await fs.readFile(waitingPath, 'utf8'))
+      if (seenBarriers.has(barrierIdentity(waiting))) continue
+      return waiting
+    } catch (error) {
+      if (isMissingFileError(error) || error instanceof SyntaxError) continue
+      throw error
+    }
+  }
+  return null
+}
+
+function barrierIdentity(waiting) {
+  return `${String(waiting?.jobId ?? '')}:${String(waiting?.waitingAt ?? '')}`
+}
+
+async function connectObserver(waiting, sessionStartedAt) {
+  const endpointFile = path.join(path.resolve(waiting.profileDirectory), 'DevToolsActivePort')
+  const deadline = Date.now() + 30_000
+  let endpoint
+  while (Date.now() <= deadline) {
+    try {
+      const stat = await fs.stat(endpointFile)
+      if (stat.mtimeMs + 2_000 < sessionStartedAt) {
+        throw new Error('DevToolsActivePort predates the current E2E inspection session.')
+      }
+      const [port, websocketPath] = (await fs.readFile(endpointFile, 'utf8')).trim().split(/\r?\n/u)
+      assert.match(port ?? '', /^\d+$/)
+      assert.match(websocketPath ?? '', /^\/devtools\/browser\/[A-Za-z0-9-]+$/)
+      endpoint = `http://127.0.0.1:${port}`
+      break
+    } catch (error) {
+      if (!isMissingFileError(error)) throw error
+    }
+    await delay(pollMs)
+  }
+  if (!endpoint) throw new Error('Current DevToolsActivePort was not available for E2E inspection.')
+  const browser = await chromium.connectOverCDP(endpoint)
+  const contexts = browser.contexts()
+  assert.equal(contexts.length, 1, 'managed persistent browser must expose exactly one CDP context')
+  const expectedUrl = canonicalObservedUrl(waiting.url)
+  const page = await waitForExpectedPage(contexts[0], waiting.targetId, expectedUrl, waiting.provider)
+  if (!page) {
+    await browser.close()
+    throw new Error(`CDP observer did not find the product page at ${expectedUrl}.`)
+  }
+  return { browser, page }
+}
+
+async function releaseBarrier({ barrierRoot, waiting, runId, nonce }) {
+  const target = path.join(barrierRoot, waiting.jobId, 'release.json')
+  const temporary = `${target}.${process.pid}.tmp`
+  await fs.writeFile(temporary, `${JSON.stringify({
+    protocol,
+    runId,
+    jobId: waiting.jobId,
+    nonce,
+  }, null, 2)}\n`, {
+    encoding: 'utf8',
+    mode: 0o600,
+    flag: 'wx',
+  })
+  await fs.rename(temporary, target)
+}
+
+async function stopExistingDaemons({ homeDir, daemonUrl }) {
+  const configured = await configuredDaemonUrl(homeDir)
+  const targets = [...new Set([daemonUrl, configured].filter(Boolean))]
+  if (targets.length === 0) targets.push(undefined)
+  for (const target of targets) {
+    const result = runCliSync([
+      'daemon', 'stop',
+      '--home', homeDir,
+      ...(target ? ['--daemon-url', target] : []),
+      '--timeout-ms', String(daemonStopTimeoutMs),
+      '--json',
+    ])
+    if (result.status !== 0) {
+      throw new Error(`Unable to stop the existing Tokenless daemon before E2E inspection:\n${summarizeProcess(result)}`)
+    }
+  }
+}
+
+async function configuredDaemonUrl(homeDir) {
+  try {
+    const config = JSON.parse(await fs.readFile(path.join(homeDir, 'config.json'), 'utf8'))
+    return typeof config.daemonUrl === 'string' && config.daemonUrl ? config.daemonUrl : undefined
+  } catch (error) {
+    if (isMissingFileError(error) || error instanceof SyntaxError) return undefined
+    throw error
+  }
+}
+
+function collectChildOutput(child) {
+  let stdout = ''
+  let stderr = ''
+  let settled = null
+  child.stdout.setEncoding('utf8')
+  child.stderr.setEncoding('utf8')
+  child.stdout.on('data', (chunk) => { stdout += chunk })
+  child.stderr.on('data', (chunk) => { stderr += chunk })
+  const exit = new Promise((resolve, reject) => {
+      child.once('error', reject)
+      child.once('close', (status, signal) => {
+        settled = { status, signal, stdout, stderr }
+        resolve(settled)
+      })
+    })
+  return {
+    exit,
+    settled() {
+      return settled
+    },
+  }
+}
+
+function runCliSync(args, env = process.env) {
+  const result = spawnSync(process.execPath, [cliEntry, ...args], {
+    cwd: root,
+    env,
+    encoding: 'utf8',
+    timeout: daemonStopTimeoutMs + 10_000,
+  })
+  return {
+    status: result.status,
+    signal: result.signal,
+    stdout: result.stdout ?? '',
+    stderr: result.stderr ?? '',
+    error: result.error,
+  }
+}
+
+function assertCliSuccess(result, action) {
+  if (result.status !== 0) {
+    throw new Error(`Unable to ${action}:\n${summarizeProcess(result)}`)
+  }
+  let payload
+  try {
+    payload = JSON.parse(result.stdout)
+  } catch (error) {
+    throw new Error(`Unable to ${action}: CLI did not return JSON: ${error.message}\n${summarizeProcess(result)}`)
+  }
+  if (payload?.ok !== true) {
+    throw new Error(`Unable to ${action}: CLI did not confirm success:\n${summarizeProcess(result)}`)
+  }
+}
+
+function parseJsonOutput(result) {
+  if (result.status !== 0) {
+    throw new Error(`CLI failed:\n${summarizeProcess(result)}`)
+  }
+  try {
+    return JSON.parse(result.stdout)
+  } catch (error) {
+    throw new Error(`CLI did not return JSON: ${error.message}\n${summarizeProcess(result)}`)
+  }
+}
+
+function canonicalObservedUrl(value) {
+  const parsed = new URL(value)
+  parsed.search = ''
+  parsed.hash = ''
+  return parsed.toString()
+}
+
+async function waitForExpectedPage(context, expectedTargetId, expectedUrl, expectedProvider) {
+  const deadline = Date.now() + 10_000
+  while (Date.now() <= deadline) {
+    for (const page of context.pages()) {
+      if (await pageTargetId(context, page) !== expectedTargetId) continue
+      const observedUrl = canonicalObservedUrl(page.url())
+      if (
+        observedUrl !== expectedUrl &&
+        getProviderInstanceForUrl(observedUrl)?.id !== expectedProvider
+      ) {
+        throw new Error(`CDP target ${expectedTargetId} resolved to an unexpected page URL.`)
+      }
+      return page
+    }
+    await delay(pollMs)
+  }
+  return null
+}
+
+async function pageTargetId(context, page) {
+  if (page.isClosed()) return null
+  const session = await context.newCDPSession(page).catch(() => null)
+  if (!session) return null
+  try {
+    return (await session.send('Target.getTargetInfo')).targetInfo.targetId
+  } catch {
+    return null
+  } finally {
+    await session.detach().catch(() => undefined)
+  }
+}
+
+function summarizeProcess(result) {
+  return JSON.stringify({
+    status: result.status,
+    signal: result.signal,
+    error: result.error?.message,
+    stdout: truncate(result.stdout),
+    stderr: truncate(result.stderr),
+  }, null, 2)
+}
+
+function truncate(value) {
+  return typeof value === 'string' && value.length > 2_000 ? `${value.slice(0, 2_000)}...[truncated]` : value
+}
+
+function requiredString(value, label) {
+  if (typeof value !== 'string' || value.trim() === '') throw new Error(`${label} is required`)
+  return value.trim()
+}
+
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms))
+}
+
+function isMissingFileError(error) {
+  return error instanceof Error && 'code' in error && error.code === 'ENOENT'
+}
diff --git a/test/helpers/live-provider-capability-matrix.mjs b/test/helpers/live-provider-capability-matrix.mjs
new file mode 100644
index 0000000..fe081b0
--- /dev/null
+++ b/test/helpers/live-provider-capability-matrix.mjs
@@ -0,0 +1,208 @@
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import {
+  VISIBLE_ACTIONS,
+  listProviderDescriptors,
+} from '../../packages/cli/dist/src/playwright/index.js'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..')
+export const liveProviderCapabilityMatrixPath = path.join(root, 'test/live-provider-capability-matrix.json')
+
+const schema = 'tokenless.live-provider-capability-matrix.v1'
+const gates = new Set(['non_submission', 'mutation', 'project'])
+const knownIssueSkipReasons = new Set(['claude_recurring_cloudflare_human_check'])
+const knownIssueSkipBlockerCodes = new Set([
+  'visible_cloudflare_turnstile',
+  'visible_cloudflare_interstitial',
+])
+const accountConditions = new Set([
+  'signed_in_selected_setup_profile',
+  'guest_or_signed_in_selected_setup_profile',
+])
+const connectionModes = new Set(['playwright', 'cdp'])
+const closures = new Set([
+  'cli',
+  'visible_dom',
+  'durable_state',
+  'restore_original',
+  'visible_attachment',
+  'visible_response',
+  'visible_submission',
+  'visible_citation',
+  'two_cli_processes',
+  'same_conversation',
+  'visible_two_turns',
+  'durable_mapping',
+  'conversation_fallback',
+  'created_then_reused',
+  'project_identity',
+  'project_instructions',
+  'durable_project_mapping',
+  'durable_conversation_mapping',
+])
+
+export function loadLiveProviderCapabilityMatrix() {
+  const matrix = JSON.parse(fs.readFileSync(liveProviderCapabilityMatrixPath, 'utf8'))
+  validateLiveProviderCapabilityMatrix(matrix)
+  return matrix
+}
+
+export function validateLiveProviderCapabilityMatrix(matrix) {
+  assert.equal(isRecord(matrix), true, 'live capability matrix must be an object')
+  assert.deepEqual(
+    Object.keys(matrix).sort(),
+    ['cases', 'connectionModes', 'journey', 'knownIssueSkips', 'providers', 'schema'],
+    'live capability matrix fields must be exact',
+  )
+  assert.equal(matrix.schema, schema)
+  assert.deepEqual(matrix.connectionModes, [...connectionModes])
+  assert.deepEqual(matrix.journey, {
+    scope: 'provider_connection_mode',
+    pagePolicy: 'one_managed_page',
+    caseOrder: 'providers.required',
+    identityProof: ['stable_task_id', 'stable_chromium_target_id'],
+  })
+  assert.equal(isRecord(matrix.cases), true, 'live capability matrix cases must be an object')
+  assert.equal(isRecord(matrix.providers), true, 'live capability matrix providers must be an object')
+  assert.equal(Array.isArray(matrix.knownIssueSkips), true, 'live capability matrix knownIssueSkips must be an array')
+
+  const visibleActions = new Set(Object.values(VISIBLE_ACTIONS))
+  const caseIds = Object.keys(matrix.cases)
+  assert.ok(caseIds.length > 0, 'live capability matrix must declare cases')
+  for (const caseId of caseIds) {
+    assert.match(caseId, /^[a-z][a-z0-9-]*$/)
+    const definition = matrix.cases[caseId]
+    assert.deepEqual(Object.keys(definition).sort(), ['actions', 'closure', 'gate', 'submissions'])
+    assert.equal(gates.has(definition.gate), true, `${caseId} gate must be recognized`)
+    assert.equal(Number.isSafeInteger(definition.submissions), true, `${caseId} submissions must be an integer`)
+    assert.ok(definition.submissions >= 0 && definition.submissions <= 2, `${caseId} submissions must be between zero and two`)
+    assert.equal(
+      definition.gate === 'non_submission',
+      definition.submissions === 0,
+      `${caseId} submission budget must match its gate`,
+    )
+    assert.equal(Array.isArray(definition.actions), true, `${caseId} actions must be an array`)
+    assert.equal(Array.isArray(definition.closure), true, `${caseId} closure must be an array`)
+    assert.ok(definition.actions.length > 0, `${caseId} must declare actions`)
+    assert.ok(definition.closure.length > 0, `${caseId} must declare closure`)
+    assert.equal(new Set(definition.actions).size, definition.actions.length, `${caseId} actions must be unique`)
+    assert.equal(new Set(definition.closure).size, definition.closure.length, `${caseId} closure must be unique`)
+    for (const action of definition.actions) {
+      assert.equal(visibleActions.has(action), true, `${caseId} uses unknown visible action ${action}`)
+    }
+    for (const closure of definition.closure) {
+      assert.equal(closures.has(closure), true, `${caseId} uses unknown closure ${closure}`)
+    }
+  }
+
+  const descriptors = listProviderDescriptors()
+  const providerIds = new Set(descriptors.map((provider) => provider.id))
+  validateKnownIssueSkips(matrix.knownIssueSkips, providerIds)
+  assert.deepEqual(
+    Object.keys(matrix.providers).sort(),
+    descriptors.map((provider) => provider.id).sort(),
+    'live capability matrix must classify every registered provider exactly once',
+  )
+  for (const descriptor of descriptors) {
+    const provider = matrix.providers[descriptor.id]
+    assert.deepEqual(
+      Object.keys(provider).sort(),
+      ['account', 'required', 'stage', 'unavailable'],
+      `${descriptor.id} matrix fields must be exact`,
+    )
+    assert.equal(provider.stage, descriptor.stage, `${descriptor.id} matrix stage must match registry`)
+    assert.equal(accountConditions.has(provider.account), true, `${descriptor.id} account condition must be recognized`)
+    assert.equal(Array.isArray(provider.required), true)
+    assert.equal(isRecord(provider.unavailable), true)
+    assert.equal(new Set(provider.required).size, provider.required.length, `${descriptor.id} required cases must be unique`)
+    const classified = [...provider.required, ...Object.keys(provider.unavailable)]
+    assert.equal(new Set(classified).size, classified.length, `${descriptor.id} cases must not overlap`)
+    assert.deepEqual(
+      [...classified].sort(),
+      [...caseIds].sort(),
+      `${descriptor.id} must classify every live case as required or unavailable`,
+    )
+    for (const [caseId, reason] of Object.entries(provider.unavailable)) {
+      assert.equal(typeof reason, 'string', `${descriptor.id}.${caseId} unavailable reason must be a string`)
+      assert.match(reason, /^[a-z][a-z0-9_]*$/, `${descriptor.id}.${caseId} unavailable reason must be machine-readable`)
+    }
+  }
+  return matrix
+}
+
+export function knownIssueSkipForDurableBlocker(matrix, provider, payload) {
+  if (payload?.status !== 'waiting_for_user') return null
+  if (payload?.provider !== provider) return null
+  const blockerCodes = structuredBlockerCodes(payload?.blocker)
+  for (const issue of matrix.knownIssueSkips) {
+    if (issue.provider !== provider) continue
+    const blockerCode = blockerCodes.find((code) => issue.blockerCodes.includes(code))
+    if (!blockerCode) continue
+    return {
+      provider: issue.provider,
+      reason: issue.reason,
+      blockerCode,
+    }
+  }
+  return null
+}
+
+export function structuredBlockerCodes(blocker) {
+  const codes = []
+  appendBlockerCode(codes, blocker)
+  appendBlockerCode(codes, blocker?.primary)
+  appendBlockerCode(codes, blocker?.blocker)
+  if (Array.isArray(blocker?.blockers)) {
+    for (const candidate of blocker.blockers) appendBlockerCode(codes, candidate)
+  }
+  return [...new Set(codes)]
+}
+
+function validateKnownIssueSkips(knownIssueSkips, providerIds) {
+  assert.equal(knownIssueSkips.length, 1, 'live capability matrix must declare exactly one known issue skip')
+  for (const issue of knownIssueSkips) {
+    assert.equal(isRecord(issue), true, 'known issue skip must be an object')
+    assert.deepEqual(
+      Object.keys(issue).sort(),
+      ['blockerCodes', 'provider', 'reason'],
+      'known issue skip fields must be exact',
+    )
+    assert.equal(issue.provider, 'claude', 'known issue skip provider must be claude')
+    assert.equal(providerIds.has(issue.provider), true, `${issue.provider} known issue provider must be registered`)
+    assert.equal(
+      knownIssueSkipReasons.has(issue.reason),
+      true,
+      `${issue.provider} known issue skip reason must be recognized`,
+    )
+    assert.equal(Array.isArray(issue.blockerCodes), true, `${issue.provider} known issue blockerCodes must be an array`)
+    assert.ok(issue.blockerCodes.length > 0, `${issue.provider} known issue must declare blocker codes`)
+    assert.equal(
+      new Set(issue.blockerCodes).size,
+      issue.blockerCodes.length,
+      `${issue.provider} known issue blocker codes must be unique`,
+    )
+    assert.deepEqual(
+      [...issue.blockerCodes].sort(),
+      [...knownIssueSkipBlockerCodes].sort(),
+      `${issue.provider} known issue blocker codes must match the allowed Cloudflare codes exactly`,
+    )
+    for (const code of issue.blockerCodes) {
+      assert.equal(
+        knownIssueSkipBlockerCodes.has(code),
+        true,
+        `${issue.provider} known issue blocker code ${code} is not allowed`,
+      )
+    }
+  }
+}
+
+function appendBlockerCode(codes, candidate) {
+  if (isRecord(candidate) && typeof candidate.code === 'string') codes.push(candidate.code)
+}
+
+function isRecord(value) {
+  return Boolean(value && typeof value === 'object' && !Array.isArray(value))
+}
diff --git a/test/helpers/live-provider-test-profile.mjs b/test/helpers/live-provider-test-profile.mjs
new file mode 100644
index 0000000..bde6c4c
--- /dev/null
+++ b/test/helpers/live-provider-test-profile.mjs
@@ -0,0 +1,170 @@
+import fs from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import {
+  BrowserRuntimeManager,
+  normalizeBrowserSelection,
+  readTokenlessConfig,
+} from '../../packages/cli/dist/src/index.js'
+import { ManagedProfileRegistry } from '../../packages/cli/dist/src/playwright/index.js'
+
+const repositoryRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..')
+
+export const LIVE_PROVIDER_TEST_BROWSERS = Object.freeze([
+  'chrome',
+  'brave',
+  'edge',
+  'arc',
+  'chromium',
+  'chrome-for-testing',
+  'managed-chromium',
+  'cloak',
+])
+
+ export function resolveLiveProviderTestTarget({
+  browser,
+  home,
+  env = process.env,
+} = {}) {
+  const requestedBrowser = nonempty(browser) ?? nonempty(env.TOKENLESS_LIVE_PROVIDER_TEST_BROWSER)
+  if (!requestedBrowser) {
+    throw new Error(
+      `Live provider E2E requires --browser <${LIVE_PROVIDER_TEST_BROWSERS.join('|')}>.`,
+    )
+  }
+
+  const browserSelection = normalizeBrowserSelection(requestedBrowser)
+  if (!browserSelection || !LIVE_PROVIDER_TEST_BROWSERS.includes(browserSelection)) {
+    throw new Error(
+      `Live provider E2E requires one explicit browser: ${LIVE_PROVIDER_TEST_BROWSERS.join(', ')}.`,
+    )
+  }
+
+  const baseHome = path.resolve(nonempty(env.TOKENLESS_HOME) ?? path.join(os.homedir(), '.tokenless'))
+  const homeDir = path.resolve(
+    nonempty(home) ??
+    nonempty(env.TOKENLESS_LIVE_PROVIDER_TEST_HOME) ??
+    path.join(baseHome, 'e2e', 'live-provider'),
+  )
+  if (homeDir === baseHome) {
+    throw new Error('Live provider E2E home must not be the ordinary Tokenless home.')
+  }
+  if (isWithin(repositoryRoot, homeDir)) {
+    throw new Error('Live provider E2E home must remain outside the repository and its worktrees.')
+  }
+  return Object.freeze({
+    homeDir,
+    ordinaryHome: baseHome,
+    profileSlug: `live-provider-${browserSelection}`,
+    browserSelection,
+    source: 'browser-selection',
+  })
+}
+
+export async function canonicalizeLiveProviderTestTarget(target) {
+  const homeDir = await fs.realpath(target.homeDir)
+  const ordinaryHome = await fs.realpath(target.ordinaryHome).catch((error) => {
+    if (error?.code === 'ENOENT') return path.resolve(target.ordinaryHome)
+    throw error
+  })
+  assertTestOnlyHome(homeDir, ordinaryHome)
+  return Object.freeze({ ...target, homeDir, ordinaryHome })
+}
+
+export async function validateLiveProviderTestTarget(target) {
+  let canonicalTarget
+  try {
+    canonicalTarget = await canonicalizeLiveProviderTestTarget(target)
+  } catch (error) {
+    if (error?.code === 'ENOENT') throw profileNotPreparedError(target, error)
+    throw error
+  }
+  const registry = new ManagedProfileRegistry(canonicalTarget.homeDir)
+  let profile
+  try {
+    profile = await registry.resolveProfile(canonicalTarget.profileSlug)
+  } catch (error) {
+    if (error?.code === 'profile_not_found' || error?.code === 'profile_not_configured') {
+      throw profileNotPreparedError(canonicalTarget, error)
+    }
+    throw error
+  }
+  if (profile.lifecycle !== 'ready') {
+    throw new Error(
+      `Dedicated live provider profile '${profile.slug}' is ${profile.lifecycle}; it must be ready before automation.`,
+    )
+  }
+
+  const profilesRoot = await fs.realpath(registry.paths.profilesRoot)
+  const profileDirectory = await fs.realpath(profile.directory)
+  const relativeDirectory = path.relative(profilesRoot, profileDirectory)
+  if (
+    !relativeDirectory ||
+    path.isAbsolute(relativeDirectory) ||
+    relativeDirectory === '..' ||
+    relativeDirectory.startsWith(`..${path.sep}`)
+  ) {
+    throw new Error(
+      `Dedicated live provider profile '${profile.slug}' resolves outside its test-only profile root.`,
+    )
+  }
+
+  if (process.platform !== 'win32') {
+    const metadata = await fs.stat(profileDirectory)
+    if ((metadata.mode & 0o077) !== 0) {
+      throw new Error(
+        `Dedicated live provider profile '${profile.slug}' must not grant group or other filesystem access.`,
+      )
+    }
+  }
+
+  const config = await readTokenlessConfig(canonicalTarget.homeDir)
+  const runtime = await new BrowserRuntimeManager({ homeDir: canonicalTarget.homeDir }).resolveForProfile(profile, {
+    browserExecutablePath: profile.runtimeBinding?.browserId === config.browser
+      ? config.browserExecutablePath
+      : null,
+  })
+  if (canonicalTarget.browserSelection && runtime.selection !== canonicalTarget.browserSelection) {
+    throw new Error(
+      `Dedicated live provider profile '${profile.slug}' is bound to ${runtime.selection}, ` +
+      `not requested browser ${canonicalTarget.browserSelection}.`,
+    )
+  }
+
+  return Object.freeze({
+    ...canonicalTarget,
+    profile,
+    runtime,
+    relativeDirectory,
+  })
+}
+
+function assertTestOnlyHome(homeDir, ordinaryHome) {
+  if (homeDir === ordinaryHome) {
+    throw new Error('Live provider E2E home must not be the ordinary Tokenless home.')
+  }
+  if (isWithin(repositoryRoot, homeDir)) {
+    throw new Error('Live provider E2E home must remain outside the repository and its worktrees.')
+  }
+}
+
+function isWithin(root, candidate) {
+  const relative = path.relative(root, candidate)
+  return relative === '' || (!path.isAbsolute(relative) && relative !== '..' && !relative.startsWith(`..${path.sep}`))
+}
+
+function profileNotPreparedError(target, cause) {
+  return new Error(
+    `Dedicated live provider profile '${target.profileSlug}' is not prepared under ${target.homeDir}. ` +
+    'Run the live provider E2E prepare command before automation.',
+    { cause },
+  )
+}
+
+function nonempty(value) {
+  if (typeof value !== 'string') return null
+  const normalized = value.trim()
+  return normalized || null
+}
diff --git a/test/helpers/live-web-ui-fixtures.mjs b/test/helpers/live-web-ui-fixtures.mjs
new file mode 100644
index 0000000..a321ad3
--- /dev/null
+++ b/test/helpers/live-web-ui-fixtures.mjs
@@ -0,0 +1,160 @@
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+const SCHEMA = 'tokenless.live-web-ui-fixtures.v1'
+
+export function loadLiveWebUiFixtures({ fixtureFile, selection }) {
+  const resolvedFile = path.resolve(fixtureFile)
+  let document
+  try {
+    document = JSON.parse(fs.readFileSync(resolvedFile, 'utf8'))
+  } catch (error) {
+    throw new Error(`Cannot read live Web UI fixture file '${resolvedFile}'. Copy test/fixtures/live-web-ui.example.json to test/fixtures/local/web-ui.json first.`, { cause: error })
+  }
+
+  requireRecord(document, 'fixture document')
+  requireKnownFields(document, ['schema', 'homes', 'profiles', 'providers', 'startups', 'cases', 'suites'], 'fixture document')
+  if (document.schema !== SCHEMA) throw new Error(`Fixture schema must be '${SCHEMA}'.`)
+
+  const homes = requireFixtureMap(document.homes, 'homes')
+  const profiles = requireFixtureMap(document.profiles, 'profiles')
+  const providers = requireFixtureMap(document.providers, 'providers')
+  const startups = requireFixtureMap(document.startups, 'startups')
+  const cases = requireFixtureMap(document.cases, 'cases')
+  const suites = requireFixtureMap(document.suites, 'suites')
+  const selectedCaseIds = resolveSelection(selection, cases, suites)
+
+  return {
+    fixtureFile: resolvedFile,
+    selection,
+    cases: selectedCaseIds.map((caseId) => resolveCase({
+      caseId,
+      value: cases[caseId],
+      homes,
+      profiles,
+      providers,
+      startups,
+    })),
+  }
+}
+
+function resolveSelection(selection, cases, suites) {
+  if (Object.hasOwn(cases, selection)) return [selection]
+  const suite = suites[selection]
+  if (!Array.isArray(suite) || suite.length === 0) {
+    throw new Error(`Fixture selection '${selection}' must name one case or one non-empty suite.`)
+  }
+  const seen = new Set()
+  return suite.map((caseId, index) => {
+    const id = requireIdentifier(caseId, `suites.${selection}[${index}]`)
+    if (!Object.hasOwn(cases, id)) throw new Error(`Suite '${selection}' references unknown case '${id}'.`)
+    if (seen.has(id)) throw new Error(`Suite '${selection}' repeats case '${id}'.`)
+    seen.add(id)
+    return id
+  })
+}
+
+function resolveCase({ caseId, value, homes, profiles, providers, startups }) {
+  requireRecord(value, `cases.${caseId}`)
+  requireKnownFields(value, ['profile', 'provider', 'startup'], `cases.${caseId}`)
+  const profileId = requireIdentifier(value.profile, `cases.${caseId}.profile`)
+  const providerId = requireIdentifier(value.provider, `cases.${caseId}.provider`)
+  const startupId = requireIdentifier(value.startup, `cases.${caseId}.startup`)
+
+  const profile = requireNamedFixture(profiles, profileId, 'profiles')
+  requireKnownFields(profile, ['home', 'slug'], `profiles.${profileId}`)
+  const homeId = requireIdentifier(profile.home, `profiles.${profileId}.home`)
+  const home = requireNamedFixture(homes, homeId, 'homes')
+  requireKnownFields(home, ['path'], `homes.${homeId}`)
+  const homeDir = expandHome(requireString(home.path, `homes.${homeId}.path`))
+  const profileSlug = requireSlug(profile.slug, `profiles.${profileId}.slug`)
+
+  const provider = requireNamedFixture(providers, providerId, 'providers')
+  requireKnownFields(provider, ['id'], `providers.${providerId}`)
+  const providerName = requireSlug(provider.id, `providers.${providerId}.id`)
+
+  const startup = requireNamedFixture(startups, startupId, 'startups')
+  requireKnownFields(startup, ['context', 'reload', 'viewport'], `startups.${startupId}`)
+  const context = startup.context ?? 'fresh'
+  if (context !== 'fresh' && context !== 'shared') {
+    throw new Error(`startups.${startupId}.context must be 'fresh' or 'shared'.`)
+  }
+  if (startup.reload !== undefined && typeof startup.reload !== 'boolean') {
+    throw new Error(`startups.${startupId}.reload must be a boolean.`)
+  }
+  const viewport = resolveViewport(startup.viewport, startupId)
+
+  return Object.freeze({
+    id: caseId,
+    targetId: `${homeId}:${profileId}:${providerId}`,
+    homeDir: path.resolve(homeDir),
+    profile: profileSlug,
+    provider: providerName,
+    startup: Object.freeze({
+      id: startupId,
+      context,
+      reload: startup.reload === true,
+      viewport,
+    }),
+  })
+}
+
+function resolveViewport(value, startupId) {
+  requireRecord(value, `startups.${startupId}.viewport`)
+  requireKnownFields(value, ['width', 'height'], `startups.${startupId}.viewport`)
+  const width = requireInteger(value.width, `startups.${startupId}.viewport.width`, 320, 3840)
+  const height = requireInteger(value.height, `startups.${startupId}.viewport.height`, 480, 2160)
+  return Object.freeze({ width, height })
+}
+
+function requireFixtureMap(value, label) {
+  requireRecord(value, label)
+  if (Object.keys(value).length === 0) throw new Error(`${label} must contain at least one fixture.`)
+  for (const id of Object.keys(value)) requireIdentifier(id, `${label} key`)
+  return value
+}
+
+function requireNamedFixture(fixtures, id, label) {
+  const value = fixtures[id]
+  if (value === undefined) throw new Error(`Unknown ${label} fixture '${id}'.`)
+  requireRecord(value, `${label}.${id}`)
+  return value
+}
+
+function requireKnownFields(value, fields, label) {
+  const allowed = new Set(fields)
+  const unknown = Object.keys(value).filter((field) => !allowed.has(field))
+  if (unknown.length > 0) throw new Error(`${label} contains unsupported field(s): ${unknown.join(', ')}.`)
+}
+
+function requireRecord(value, label) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error(`${label} must be an object.`)
+}
+
+function requireString(value, label) {
+  if (typeof value !== 'string' || !value.trim()) throw new Error(`${label} must be a non-empty string.`)
+  return value.trim()
+}
+
+function requireIdentifier(value, label) {
+  const result = requireString(value, label)
+  if (!/^[a-z0-9][a-z0-9-]*$/.test(result)) throw new Error(`${label} must use lowercase letters, numbers, and hyphens.`)
+  return result
+}
+
+function requireSlug(value, label) {
+  return requireIdentifier(value, label)
+}
+
+function requireInteger(value, label, minimum, maximum) {
+  if (!Number.isInteger(value) || value < minimum || value > maximum) {
+    throw new Error(`${label} must be an integer from ${minimum} through ${maximum}.`)
+  }
+  return value
+}
+
+function expandHome(value) {
+  if (value === '~') return os.homedir()
+  return value.startsWith('~/') ? path.join(os.homedir(), value.slice(2)) : value
+}
diff --git a/test/live-browser-provider-surfaces.e2e.mjs b/test/live-browser-provider-surfaces.e2e.mjs
new file mode 100644
index 0000000..4214f31
--- /dev/null
+++ b/test/live-browser-provider-surfaces.e2e.mjs
@@ -0,0 +1,194 @@
+import assert from 'node:assert/strict'
+import fs from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+import test from 'node:test'
+import { chromium } from 'playwright-core'
+
+import { BrowserRuntimeManager } from '../packages/cli/dist/src/browser-runtime/manager.js'
+import { listProviderDescriptors } from '../packages/cli/dist/src/providers/registry.js'
+
+if (process.env.TOKENLESS_LIVE_BROWSER_SURFACE_GATE !== '1') {
+  throw new Error('Set TOKENLESS_LIVE_BROWSER_SURFACE_GATE=1 to run the real browser provider-surface acceptance gate.')
+}
+if (!(
+  (process.platform === 'darwin' && process.arch === 'arm64') ||
+  (process.platform === 'win32' && process.arch === 'x64')
+)) {
+  throw new Error(`The browser surface gate does not support ${process.platform}-${process.arch}.`)
+}
+
+const selection = process.env.TOKENLESS_LIVE_BROWSER_SURFACE_SELECTION
+if (!['auto', 'managed-chromium', 'cloak'].includes(selection)) {
+  throw new Error('Set TOKENLESS_LIVE_BROWSER_SURFACE_SELECTION to auto, managed-chromium, or cloak.')
+}
+
+test(`${selection} reaches every provider surface and Google Search without a detected anti-bot challenge`, { timeout: 20 * 60_000 }, async () => {
+  const temporaryRoot = await fs.realpath(os.tmpdir())
+  const suppliedHome = process.env.TOKENLESS_LIVE_BROWSER_SURFACE_HOME
+  const homeDir = suppliedHome
+    ? path.resolve(suppliedHome)
+    : await fs.mkdtemp(path.join(temporaryRoot, 'tokenless-browser-surface-home-'))
+  const ownsHome = !suppliedHome
+  const profileDir = await fs.mkdtemp(path.join(temporaryRoot, 'tokenless-browser-surface-profile-'))
+  const runtime = await new BrowserRuntimeManager({ homeDir }).ensure(selection, { allowDownload: true })
+  if (runtime.managed) assert.equal(runtime.actualVersion, runtime.expectedVersion)
+
+  const context = await chromium.launchPersistentContext(profileDir, {
+    executablePath: runtime.executablePath,
+    headless: false,
+    chromiumSandbox: true,
+    args: [
+      '--password-store=basic',
+      '--use-mock-keychain',
+      '--disable-sync',
+      '--no-first-run',
+      '--no-default-browser-check',
+    ],
+    ...(runtime.launchPolicy === 'cloak'
+      ? { ignoreDefaultArgs: ['--enable-automation', '--enable-unsafe-swiftshader'] }
+      : {}),
+  })
+  const evidence = {
+    selection,
+    runtimeId: runtime.runtimeId,
+    family: runtime.family,
+    actualVersion: runtime.actualVersion,
+    executablePath: runtime.executablePath,
+    providers: [],
+    google: null,
+  }
+  try {
+    const page = context.pages()[0] ?? await context.newPage()
+    for (const descriptor of listProviderDescriptors().filter((candidate) => candidate.stage !== 'disabled')) {
+      const result = await visitSurface(page, descriptor.navigation.homeUrl)
+      evidence.providers.push({
+        provider: descriptor.id === 'grok' ? 'grok-cloud' : descriptor.id,
+        ...result,
+      })
+    }
+
+    const googleTarget = new URL('https://www.google.com/search')
+    googleTarget.searchParams.set('q', 'OpenAI API documentation')
+    evidence.google = await visitGoogle(page, googleTarget.toString())
+    console.log(JSON.stringify(evidence, null, 2))
+    assert.deepEqual(surfaceFailures(evidence), [])
+  } finally {
+    await context.close().catch(() => undefined)
+    await fs.rm(profileDir, { recursive: true, force: true })
+    if (ownsHome) await fs.rm(homeDir, { recursive: true, force: true })
+  }
+})
+
+function surfaceFailures(evidence) {
+  const failures = []
+  for (const provider of evidence.providers) {
+    if (provider.navigationError) {
+      failures.push(`${provider.provider} navigation failed: ${provider.navigationError}`)
+    }
+    if (provider.challenge) {
+      failures.push(`${provider.provider} showed ${provider.challenge.code}.`)
+    }
+  }
+  if (evidence.google.navigationError) {
+    failures.push(`Google navigation failed: ${evidence.google.navigationError}`)
+  }
+  if (evidence.google.captchaTriggered) {
+    failures.push(`Google showed ${evidence.google.challenge?.code ?? 'a CAPTCHA'}.`)
+  }
+  if (!evidence.google.resultsVisible && evidence.google.challenge?.family !== 'consent') {
+    failures.push('Google neither rendered search results nor a normal consent surface.')
+  }
+  return failures
+}
+
+async function visitSurface(page, targetUrl) {
+  let response = null
+  let navigationError = null
+  try {
+    response = await page.goto(targetUrl, { waitUntil: 'domcontentloaded', timeout: 120_000 })
+  } catch (error) {
+    navigationError = error instanceof Error ? error.message : String(error)
+  }
+  await page.waitForTimeout(2_000)
+  const finalUrl = publicLocation(page.url())
+  const title = await page.title().catch(() => '')
+  const requestedOrigin = new URL(targetUrl).origin
+  const challenge = navigationError && finalUrl.origin !== requestedOrigin
+    ? null
+    : await visibleChallenge(page, title)
+  return {
+    requestedOrigin,
+    httpStatus: response?.status() ?? null,
+    finalOrigin: finalUrl.origin,
+    finalPath: finalUrl.pathname,
+    title,
+    challenge,
+    navigationError,
+  }
+}
+
+async function visitGoogle(page, targetUrl) {
+  const surface = await visitSurface(page, targetUrl)
+  const challenge = await googleChallenge(page)
+  return {
+    ...surface,
+    challenge,
+    resultsVisible: challenge === null && await anyVisible(page, ['#search', '#rso', 'a h3']),
+    captchaTriggered: challenge?.family === 'recaptcha',
+  }
+}
+
+async function googleChallenge(page) {
+  if (page.url().includes('/sorry/')) return { family: 'recaptcha', code: 'google_sorry_url' }
+  if (await anyVisible(page, [
+    'iframe[src*="recaptcha"]',
+    'form#captcha-form',
+    '.g-recaptcha',
+    'text=/our systems have detected unusual traffic/i',
+  ])) return { family: 'recaptcha', code: 'visible_google_recaptcha' }
+  if (await anyVisible(page, [
+    'text=/before you continue to google/i',
+    'form[action*="consent.google"]',
+  ])) return { family: 'consent', code: 'visible_google_consent' }
+  return null
+}
+
+async function visibleChallenge(page, title) {
+  if (/just a moment|checking your browser/i.test(title)) {
+    return { family: 'cloudflare', code: 'cloudflare_interstitial_title' }
+  }
+  if (/human verification|security verification|captcha/i.test(title)) {
+    return { family: 'bot_verification', code: 'visible_verification_title' }
+  }
+  if (await anyVisible(page, [
+    'iframe[src*="recaptcha"]',
+    '.g-recaptcha',
+    '[aria-label*="captcha" i]',
+  ])) return { family: 'recaptcha', code: 'visible_recaptcha' }
+  if (await anyVisible(page, [
+    'iframe[src*="challenges.cloudflare.com"]',
+    'input[name="cf-turnstile-response"]',
+    '#challenge-running',
+  ])) return { family: 'cloudflare', code: 'visible_cloudflare_challenge' }
+  if (await anyVisible(page, ['iframe[src*="hcaptcha.com"]', '.h-captcha'])) {
+    return { family: 'hcaptcha', code: 'visible_hcaptcha' }
+  }
+  return null
+}
+
+async function anyVisible(page, selectors) {
+  for (const selector of selectors) {
+    if (await page.locator(selector).first().isVisible().catch(() => false)) return true
+  }
+  return false
+}
+
+function publicLocation(value) {
+  try {
+    const parsed = new URL(value)
+    return { origin: parsed.origin, pathname: parsed.pathname }
+  } catch {
+    return { origin: '', pathname: '' }
+  }
+}
diff --git a/test/live-browser-runtime.e2e.mjs b/test/live-browser-runtime.e2e.mjs
new file mode 100644
index 0000000..9f1e074
--- /dev/null
+++ b/test/live-browser-runtime.e2e.mjs
@@ -0,0 +1,307 @@
+import assert from 'node:assert/strict'
+import { spawn } from 'node:child_process'
+import fs from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+import test from 'node:test'
+import { fileURLToPath } from 'node:url'
+import { chromium } from 'playwright-core'
+
+import { BrowserRuntimeManager } from '../packages/cli/dist/src/browser-runtime/manager.js'
+import { ManagedProfileRegistry } from '../packages/cli/dist/src/playwright/profiles/registry.js'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const cliEntry = path.join(root, 'packages/cli/dist/src/tokenless.mjs')
+const enabled = process.env.TOKENLESS_LIVE_BROWSER_RUNTIME_GATE === '1'
+const expectedAutoFamily = process.env.TOKENLESS_LIVE_BROWSER_RUNTIME_EXPECT_AUTO
+
+if (!enabled) {
+  throw new Error('Set TOKENLESS_LIVE_BROWSER_RUNTIME_GATE=1 to run the real browser-runtime acceptance gate.')
+}
+if (expectedAutoFamily !== 'system' && expectedAutoFamily !== 'managed-chromium') {
+  throw new Error('Set TOKENLESS_LIVE_BROWSER_RUNTIME_EXPECT_AUTO to system or managed-chromium for this machine.')
+}
+if (!(
+  (process.platform === 'darwin' && process.arch === 'arm64') ||
+  (process.platform === 'win32' && process.arch === 'x64')
+)) {
+  throw new Error(`Browser-runtime acceptance does not support ${process.platform}-${process.arch}.`)
+}
+
+test('built CLI installs, binds, inspects, repairs, and reuses exact browser runtimes', { timeout: 45 * 60_000 }, async () => {
+  const realTemporaryRoot = await fs.realpath(os.tmpdir())
+  const homeDir = await fs.mkdtemp(path.join(realTemporaryRoot, 'tokenless-browser-runtime-e2e-'))
+  const skillHome = path.join(homeDir, 'operator-home')
+  const env = {
+    ...process.env,
+    TOKENLESS_SETUP_SKILL_HOME: skillHome,
+  }
+  const ownedDaemonPids = new Set()
+  try {
+    await fs.mkdir(skillHome, { recursive: true, mode: 0o700 })
+
+    const customExecutablePath = chromium.executablePath()
+    await fs.access(customExecutablePath)
+    const configured = await runCli([
+      'config',
+      '--browser', 'chrome-for-testing',
+      '--browser-executable-path', customExecutablePath,
+      '--home', homeDir,
+      '--json',
+    ], env)
+    assert.equal(configured.config.browser, 'chrome-for-testing')
+    assert.equal(configured.config.browserExecutablePath, customExecutablePath)
+    const configuredRuntime = await new BrowserRuntimeManager({ homeDir }).ensure(
+      configured.config.browser,
+      { allowDownload: false, browserExecutablePath: configured.config.browserExecutablePath },
+    )
+    assert.equal(configuredRuntime.executablePath, customExecutablePath)
+    const cachedPathContext = await chromium.launchPersistentContext(
+      path.join(homeDir, 'cached-path-smoke-profile'),
+      {
+        executablePath: configuredRuntime.executablePath,
+        headless: true,
+        chromiumSandbox: true,
+        args: ['--password-store=basic', '--use-mock-keychain'],
+      },
+    )
+    try {
+      const page = cachedPathContext.pages()[0] ?? await cachedPathContext.newPage()
+      await page.goto('data:text/html,<title>cached-browser-path</title>')
+      assert.equal(await page.title(), 'cached-browser-path')
+    } finally {
+      await cachedPathContext.close()
+    }
+
+    const automatic = await runCli([
+      'install', '--browser', 'auto', '--home', homeDir, '--json',
+    ], env)
+    rememberDaemonPid(ownedDaemonPids, automatic)
+    assert.equal(automatic.ok, true)
+    assert.equal(automatic.browser.family, expectedAutoFamily)
+    const automaticConfig = JSON.parse(await fs.readFile(path.join(homeDir, 'config.json'), 'utf8'))
+    assert.equal(automaticConfig.browser, automatic.browser.id)
+    assert.equal(typeof automaticConfig.browserExecutablePath, 'string')
+    await fs.access(automaticConfig.browserExecutablePath)
+    const staleExecutablePath = automatic.browser.family === 'system'
+      ? path.join(homeDir, 'missing-browser-executable')
+      : path.join(homeDir, 'browser', 'runtimes', 'missing-browser-executable')
+    await fs.writeFile(
+      path.join(homeDir, 'config.json'),
+      `${JSON.stringify({ ...automaticConfig, browserExecutablePath: staleExecutablePath }, null, 2)}\n`,
+      { mode: 0o600 },
+    )
+    const fallbackProfile = await runCli([
+      'profiles', 'add', '--profile', 'cache-fallback', '--home', homeDir, '--json',
+    ], env)
+    assert.equal(fallbackProfile.ok, true)
+    const refreshedConfig = JSON.parse(await fs.readFile(path.join(homeDir, 'config.json'), 'utf8'))
+    assert.equal(refreshedConfig.browserExecutablePath, automaticConfig.browserExecutablePath)
+
+    const managed = await runCli([
+      'install', '--browser', 'managed-chromium', '--home', homeDir, '--json',
+    ], env)
+    rememberDaemonPid(ownedDaemonPids, managed)
+    assert.equal(managed.ok, true)
+    assert.equal(managed.browser.family, 'managed-chromium')
+    assert.match(managed.browser.runtimeId, /^managed-chromium:/)
+
+    const managedProfile = await runCli([
+      'profiles', 'add', '--profile', 'managed-runtime', '--set-default', '--home', homeDir, '--json',
+    ], env)
+    assert.equal(managedProfile.ok, true)
+    assert.equal(managedProfile.profile.runtimeBinding.runtimeId, managed.browser.runtimeId)
+
+    const cloak = await runCli([
+      'install', '--browser', 'cloak', '--home', homeDir, '--json',
+    ], env)
+    rememberDaemonPid(ownedDaemonPids, cloak)
+    assert.equal(cloak.ok, true)
+    assert.equal(cloak.browser.family, 'cloak')
+    assert.match(cloak.browser.runtimeId, /^cloak:/)
+
+    const cloakProfile = await runCli([
+      'profiles', 'add', '--profile', 'cloak-runtime', '--set-default', '--home', homeDir, '--json',
+    ], env)
+    assert.equal(cloakProfile.ok, true)
+    assert.equal(cloakProfile.profile.runtimeBinding.runtimeId, cloak.browser.runtimeId)
+
+    const repaired = await runCli([
+      'install', '--browser', 'cloak', '--repair-browser', '--home', homeDir, '--json',
+    ], env)
+    rememberDaemonPid(ownedDaemonPids, repaired)
+    assert.equal(repaired.ok, true)
+    assert.equal(repaired.browser.runtimeId, cloak.browser.runtimeId)
+
+    const doctor = await runCli(['doctor', '--home', homeDir, '--json'], env, { allowFailure: true })
+    assert.equal(doctor.checks.browser.ok, true)
+    assert.equal(doctor.checks.browser.runtimeId, cloak.browser.runtimeId)
+    assert.equal(doctor.checks.managedProfile.runtime.ok, true)
+    assert.equal(doctor.checks.managedProfile.runtime.runtime.runtimeId, cloak.browser.runtimeId)
+    assert.equal(doctor.checks.profileRuntime.ok, true)
+    assert.equal(doctor.checks.profileRuntime.runtime.runtimeId, cloak.browser.runtimeId)
+
+    await runNegativeRuntimeAcceptance({
+      homeDir,
+      env,
+      ownedDaemonPids,
+    })
+  } finally {
+    await runCli(['daemon', 'stop', '--home', homeDir, '--json'], env, { allowFailure: true }).catch(() => undefined)
+    await stopOwnedDaemonProcesses(ownedDaemonPids)
+    await fs.rm(homeDir, { recursive: true, force: true })
+  }
+})
+
+async function runNegativeRuntimeAcceptance({ homeDir, env, ownedDaemonPids }) {
+  await runCli(['daemon', 'stop', '--home', homeDir, '--json'], env, { allowFailure: true })
+  await stopOwnedDaemonProcesses(ownedDaemonPids)
+
+  const runtimeManager = new BrowserRuntimeManager({ homeDir })
+  const cloak = await runtimeManager.ensure('cloak', { allowDownload: false })
+  const runtimeDirectory = path.join(
+    runtimeManager.runtimesRoot,
+    cloak.family,
+    cloak.platform,
+    cloak.artifactVersion,
+  )
+  const manifestPath = path.join(runtimeDirectory, 'runtime.json')
+  const configPath = path.join(homeDir, 'config.json')
+  const registryPath = path.join(homeDir, 'browser', 'profiles.json')
+  const originalManifest = await fs.readFile(manifestPath)
+  const configBeforeCacheChecks = await fs.readFile(configPath)
+  const registryBeforeCacheChecks = await fs.readFile(registryPath)
+  try {
+    const parsed = JSON.parse(originalManifest.toString('utf8'))
+    for (const mutation of [
+      { field: 'sha256', value: '0'.repeat(64) },
+      { field: 'browserVersion', value: '0.0.0.0' },
+    ]) {
+      await fs.writeFile(manifestPath, `${JSON.stringify({ ...parsed, [mutation.field]: mutation.value }, null, 2)}\n`, { mode: 0o600 })
+      await assert.rejects(
+        new BrowserRuntimeManager({ homeDir }).ensure('cloak', { allowDownload: false }),
+        (error) => error?.code === 'browser_runtime_cache_invalid',
+      )
+      assert.deepEqual(await fs.readFile(configPath), configBeforeCacheChecks)
+      assert.deepEqual(await fs.readFile(registryPath), registryBeforeCacheChecks)
+      await fs.writeFile(manifestPath, originalManifest, { mode: 0o600 })
+    }
+  } finally {
+    await fs.writeFile(manifestPath, originalManifest, { mode: 0o600 })
+  }
+
+  const automatic = await runtimeManager.ensure('auto', { allowDownload: false })
+  const negativeEnv = {
+    ...env,
+    TOKENLESS_BROWSER_EXECUTABLE: automatic.executablePath,
+  }
+  const registry = new ManagedProfileRegistry(homeDir)
+  const cases = [
+    {
+      slug: 'runtime-mismatch',
+      expectedCode: 'profile_runtime_mismatch',
+      binding: {
+        runtimeId: 'test:mismatched-profile',
+        family: 'test',
+        browserId: 'profile',
+        createdWithVersion: automatic.actualVersion,
+        profileFormat: 1,
+      },
+    },
+    {
+      slug: 'runtime-downgrade',
+      expectedCode: 'profile_browser_downgrade_blocked',
+      binding: {
+        runtimeId: 'test:profile',
+        family: 'test',
+        browserId: 'profile',
+        createdWithVersion: '999.0.0.0',
+        profileFormat: 1,
+      },
+    },
+  ]
+  for (const entry of cases) {
+    const profile = await registry.addProfile({
+      slug: entry.slug,
+      lifecycle: 'ready',
+      setDefault: true,
+      runtimeBinding: entry.binding,
+    })
+    const configBefore = await fs.readFile(configPath)
+    const registryBefore = await fs.readFile(registryPath)
+    const profileEntriesBefore = await fs.readdir(profile.directory)
+    const result = await runCli([
+      'profiles', 'open', '--profile', profile.slug, '--home', homeDir, '--json',
+    ], negativeEnv, { allowFailure: true })
+    assert.equal(result.ok, false)
+    assert.equal(result.error?.code, entry.expectedCode)
+    assert.deepEqual(await fs.readFile(configPath), configBefore)
+    assert.deepEqual(await fs.readFile(registryPath), registryBefore)
+    assert.deepEqual(await fs.readdir(profile.directory), profileEntriesBefore)
+    await runCli(['daemon', 'stop', '--home', homeDir, '--json'], negativeEnv, { allowFailure: true })
+  }
+}
+
+function rememberDaemonPid(ownedDaemonPids, payload) {
+  if (Number.isSafeInteger(payload?.daemon?.pid) && payload.daemon.pid > 0) {
+    ownedDaemonPids.add(payload.daemon.pid)
+  }
+}
+
+async function stopOwnedDaemonProcesses(ownedDaemonPids) {
+  const living = [...ownedDaemonPids].filter(processIsAlive)
+  for (const pid of living) signalProcess(pid, 'SIGTERM')
+  const deadline = Date.now() + 5_000
+  while (living.some(processIsAlive) && Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, 100))
+  }
+  for (const pid of living.filter(processIsAlive)) signalProcess(pid, 'SIGKILL')
+}
+
+function signalProcess(pid, signal) {
+  try {
+    process.kill(pid, signal)
+  } catch (error) {
+    if (error?.code !== 'ESRCH') throw error
+  }
+}
+
+function processIsAlive(pid) {
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch {
+    return false
+  }
+}
+
+async function runCli(args, env, { allowFailure = false } = {}) {
+  const result = await new Promise((resolvePromise, reject) => {
+    const child = spawn(process.execPath, [cliEntry, ...args], {
+      cwd: root,
+      env,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    })
+    const stdout = []
+    const stderr = []
+    child.stdout.on('data', (chunk) => stdout.push(chunk))
+    child.stderr.on('data', (chunk) => stderr.push(chunk))
+    child.once('error', reject)
+    child.once('close', (code, signal) => resolvePromise({
+      code,
+      signal,
+      stdout: Buffer.concat(stdout).toString('utf8'),
+      stderr: Buffer.concat(stderr).toString('utf8'),
+    }))
+  })
+  let payload
+  try {
+    payload = JSON.parse(result.stdout)
+  } catch (error) {
+    throw new Error(`Tokenless did not return JSON for ${args.join(' ')}: ${result.stderr || result.stdout}`, { cause: error })
+  }
+  if (!allowFailure && result.code !== 0) {
+    throw new Error(`Tokenless failed for ${args.join(' ')}: ${result.stderr || result.stdout}`)
+  }
+  return payload
+}
diff --git a/test/live-managed-playwright-lifecycle.test.mjs b/test/live-managed-playwright-lifecycle.test.mjs
deleted file mode 100644
index 147f66c..0000000
--- a/test/live-managed-playwright-lifecycle.test.mjs
+++ /dev/null
@@ -1,38 +0,0 @@
-import assert from 'node:assert/strict'
-import fs from 'node:fs'
-import path from 'node:path'
-import test from 'node:test'
-import { fileURLToPath } from 'node:url'
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-const liveManagedPlaywrightFiles = [
-  'test/live-managed-playwright.e2e.mjs',
-  'test/live-managed-playwright-prompt-actions.e2e.mjs',
-]
-
-test('managed Playwright live suites reuse existing Tokenless profiles without import or removal', () => {
-  for (const relativePath of liveManagedPlaywrightFiles) {
-    const source = fs.readFileSync(path.join(root, relativePath), 'utf8')
-    assert.match(source, /TOKENLESS_LIVE_MANAGED_PLAYWRIGHT_HOME/, `${relativePath} must require an existing Tokenless home`)
-    assert.match(source, /TOKENLESS_LIVE_MANAGED_PLAYWRIGHT_PROFILE/, `${relativePath} must require an existing managed profile slug`)
-    assert.match(source, /profiles['"],\s*['"]list/, `${relativePath} must resolve the managed profile before provider actions`)
-    assert.doesNotMatch(source, /profiles['"],\s*['"]add/, `${relativePath} must not import or create profiles`)
-    assert.doesNotMatch(source, /profiles['"],\s*['"]remove/, `${relativePath} must not remove managed profiles`)
-    assert.doesNotMatch(source, /--import-chrome-profile|--consent-local-profile-copy|--chrome-user-data-dir/, `${relativePath} must not copy from Chrome`)
-    assert.doesNotMatch(source, /TOKENLESS_LIVE_PROFILE_COPY_CONSENT|TOKENLESS_LIVE_CHROME_PROFILE|TOKENLESS_LIVE_CHROME_USER_DATA_DIR/, `${relativePath} must not depend on Chrome source-profile gates`)
-    assert.doesNotMatch(source, /\bimportChromeProfile\b|\bdiscoverChromeProfiles\b|\bcopyFile\b|\bmkdtemp\b/, `${relativePath} must not reach Chrome import or temporary-copy helpers`)
-    assert.doesNotMatch(source, /fs\.rm\(.*homeDir|fs\.rmSync\(.*homeDir/, `${relativePath} must not delete the managed home`)
-    assert.match(source, /profile\.import\?\.profileDirectoryKey/, `${relativePath} must require a user-imported managed profile`)
-    assert.match(source, /promptInputConfirmed|draftInputConfirmed/, `${relativePath} must track confirmed prompt input before cleanup`)
-    assert.match(source, /attemptPromptClearCleanup/, `${relativePath} must best-effort clear confirmed prompt drafts on failure`)
-  }
-})
-
-test('managed Playwright full live suite removes only generated upload marker files', () => {
-  const relativePath = 'test/live-managed-playwright.e2e.mjs'
-  const source = fs.readFileSync(path.join(root, relativePath), 'utf8')
-  assert.match(source, /finally\s*{\s*const cleanup = await removeGeneratedUploadFile\(upload\)/, `${relativePath} must remove marker uploads in a finally after use`)
-  assert.match(source, /await fs\.unlink\(file\)/, `${relativePath} must remove the exact generated marker file`)
-  assert.doesNotMatch(source, /fs\.rm\(/, `${relativePath} must not use broad recursive deletion for live cleanup`)
-  assert.doesNotMatch(source, /fs\.rmdir|fsSync\.rm|fsSync\.unlink/, `${relativePath} must keep live cleanup scoped to async unlink`)
-})
diff --git a/test/live-managed-playwright-prompt-actions.e2e.mjs b/test/live-managed-playwright-prompt-actions.e2e.mjs
deleted file mode 100644
index c9fe0ad..0000000
--- a/test/live-managed-playwright-prompt-actions.e2e.mjs
+++ /dev/null
@@ -1,246 +0,0 @@
-import assert from 'node:assert/strict'
-import { spawnSync } from 'node:child_process'
-import { createHash, randomUUID } from 'node:crypto'
-import fs from 'node:fs/promises'
-import fsSync from 'node:fs'
-import path from 'node:path'
-import test from 'node:test'
-import { fileURLToPath } from 'node:url'
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-const cliEntry = path.join(root, 'packages/cli/dist/src/tokenless.mjs')
-const providers = ['chatgpt', 'claude', 'gemini', 'grok']
-const gates = [
-  'TOKENLESS_LIVE_MANAGED_PLAYWRIGHT_M1',
-  'TOKENLESS_LIVE_MANAGED_PLAYWRIGHT_HOME',
-  'TOKENLESS_LIVE_MANAGED_PLAYWRIGHT_PROFILE',
-]
-const liveEnabled = gates.every((key) => (
-  key === 'TOKENLESS_LIVE_MANAGED_PLAYWRIGHT_M1' ? process.env[key] === '1' : Boolean(process.env[key])
-))
-
-test('live managed Playwright milestone 1 authenticates then inputs and clears provider drafts only', {
-  skip: liveEnabled ? false : `set ${gates.join(', ')} to run live managed Playwright prompt-action E2E`,
-  timeout: 900000,
-}, async () => {
-  const homeDir = path.resolve(requiredEnv('TOKENLESS_LIVE_MANAGED_PLAYWRIGHT_HOME'))
-  const profileSlug = requiredEnv('TOKENLESS_LIVE_MANAGED_PLAYWRIGHT_PROFILE')
-  const managedProfile = resolveManagedProfile({ homeDir, profileSlug })
-
-  const artifactDir = await createArtifactDir()
-  const evidence = {
-    protocol: 'tokenless.live-managed-playwright.prompt-actions.evidence.v1',
-    startedAt: new Date().toISOString(),
-    node: process.version,
-    platform: process.platform,
-    managedProfile,
-    providers: {},
-  }
-  let evidenceWritten = false
-
-  try {
-    assert.deepEqual(providers, ['chatgpt', 'claude', 'gemini', 'grok'])
-    for (const provider of providers) {
-      try {
-        evidence.providers[provider] = exerciseProvider({ provider, homeDir, profileSlug })
-      } catch (error) {
-        if (error?.providerEvidence) evidence.providers[provider] = error.providerEvidence
-        throw error
-      }
-    }
-
-    evidence.completedAt = new Date().toISOString()
-    await writeArtifact(artifactDir, 'prompt-actions.json', evidence)
-    evidenceWritten = true
-  } finally {
-    if (!evidenceWritten) {
-      await writeArtifact(artifactDir, 'prompt-actions.partial.json', evidence).catch(() => undefined)
-    }
-  }
-})
-
-function exerciseProvider({ provider, homeDir, profileSlug }) {
-  const started = Date.now()
-  const marker = `TOKENLESS_M1_DRAFT_${provider}_${randomUUID()}`
-  const entry = {
-    startedAt: new Date().toISOString(),
-    markerSha256: sha256String(marker),
-    markerBytes: Buffer.byteLength(marker, 'utf8'),
-    actions: {},
-  }
-  let promptInputConfirmed = false
-  let promptCleared = false
-
-  try {
-    const auth = runJson([
-      'provider-action',
-      '--profile', profileSlug,
-      '--provider', provider,
-      '--action', 'auth.status',
-      '--home', homeDir,
-      '--timeout-ms', '90000',
-      '--json',
-    ])
-    const authResult = findResponseResult(auth, 'auth.status')
-    assert.equal(authResult?.state, 'authenticated', `${provider} must be authenticated before prompt mutation`)
-    entry.actions.auth = { state: authResult.state, visibleProof: authResult.visibleProof }
-
-    const input = runJson([
-      'provider-action',
-      '--profile', profileSlug,
-      '--provider', provider,
-      '--action', 'prompt.input',
-      '--prompt', marker,
-      '--home', homeDir,
-      '--timeout-ms', '90000',
-      '--json',
-    ])
-    const inputResult = findResponseResult(input, 'prompt.input')
-    assert.deepEqual(inputResult, { visible: true, inputProof: 'prompt-text-visible' }, `${provider} prompt.input must succeed`)
-    promptInputConfirmed = true
-    entry.actions.input = { visible: inputResult.visible, inputProof: inputResult.inputProof }
-
-    const clear = runJson([
-      'provider-action',
-      '--profile', profileSlug,
-      '--provider', provider,
-      '--action', 'prompt.clear',
-      '--home', homeDir,
-      '--timeout-ms', '90000',
-      '--json',
-    ])
-    const clearResult = findResponseResult(clear, 'prompt.clear')
-    assert.deepEqual(clearResult, { visible: true, inputProof: 'empty' }, `${provider} prompt.clear must succeed`)
-    promptCleared = true
-    entry.actions.clear = { visible: clearResult.visible, inputProof: clearResult.inputProof }
-
-    entry.completedAt = new Date().toISOString()
-    entry.elapsedMs = Date.now() - started
-    return entry
-  } catch (error) {
-    entry.failedAt = new Date().toISOString()
-    entry.elapsedMs = Date.now() - started
-    attachProviderEvidence(error, entry)
-    throw error
-  } finally {
-    if (promptInputConfirmed && !promptCleared) {
-      entry.cleanup = {
-        ...entry.cleanup,
-        promptClear: attemptPromptClearCleanup({ provider, homeDir, profileSlug }),
-      }
-    }
-  }
-}
-
-function attemptPromptClearCleanup({ provider, homeDir, profileSlug }) {
-  const cleanup = {
-    attempted: true,
-    succeeded: false,
-  }
-  try {
-    const result = runCli([
-      'provider-action',
-      '--profile', profileSlug,
-      '--provider', provider,
-      '--action', 'prompt.clear',
-      '--home', homeDir,
-      '--timeout-ms', '90000',
-      '--json',
-    ])
-    cleanup.status = result.status
-    cleanup.stdoutBytes = Buffer.byteLength(result.stdout ?? '', 'utf8')
-    cleanup.stderrBytes = Buffer.byteLength(result.stderr ?? '', 'utf8')
-    if (result.status !== 0) return cleanup
-    const clearResult = findResponseResult(JSON.parse(result.stdout), 'prompt.clear')
-    cleanup.succeeded = clearResult?.visible === true && clearResult?.inputProof === 'empty'
-    cleanup.result = clearResult
-      ? { visible: clearResult.visible, inputProof: clearResult.inputProof }
-      : { visible: false, inputProof: 'missing' }
-    return cleanup
-  } catch (error) {
-    cleanup.error = boundedError(error)
-    return cleanup
-  }
-}
-
-function runJson(args) {
-  const result = runCli(args)
-  assert.equal(result.status, 0, summarizeProcess(result))
-  return JSON.parse(result.stdout)
-}
-
-function runCli(args) {
-  return spawnSync(process.execPath, [cliEntry, ...args], {
-    cwd: root,
-    env: { ...process.env, TOKENLESS_PROVIDER: '' },
-    encoding: 'utf8',
-    timeout: 300000,
-  })
-}
-
-function findResponseResult(payload, action) {
-  const responses = payload?.result?.result?.responses ?? payload?.result?.responses ?? payload?.latest?.result?.value?.responses
-  if (!Array.isArray(responses)) return null
-  return [...responses].reverse().find((response) => response?.ok === true && response.action === action)?.result ?? null
-}
-
-function resolveManagedProfile({ homeDir, profileSlug }) {
-  assert.equal(fsSync.existsSync(homeDir), true, `${homeDir} must already exist`)
-  const payload = runJson(['profiles', 'list', '--home', homeDir, '--json'])
-  const profile = payload.profiles?.find((candidate) => candidate.slug === profileSlug)
-  assert.ok(profile, `${profileSlug} must be registered in ${homeDir}`)
-  assert.equal(profile.lifecycle, 'ready', `${profileSlug} must be ready before the live suite starts`)
-  assert.equal(Boolean(profile.import?.profileDirectoryKey), true, `${profileSlug} must be a user-imported managed profile`)
-  return {
-    slug: profile.slug,
-    id: profile.id,
-    lifecycle: profile.lifecycle,
-    isDefault: profile.isDefault,
-    imported: Boolean(profile.import?.profileDirectoryKey),
-  }
-}
-
-async function createArtifactDir() {
-  const dir = path.join(root, 'test-results', 'live-managed-playwright-m1', new Date().toISOString().replace(/[:.]/g, '-'))
-  await fs.mkdir(dir, { recursive: true, mode: 0o700 })
-  return dir
-}
-
-async function writeArtifact(dir, name, value) {
-  await fs.writeFile(path.join(dir, name), `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 })
-}
-
-function summarizeProcess(result) {
-  return JSON.stringify({
-    status: result.status,
-    stdout: truncate(result.stdout),
-    stderr: truncate(result.stderr),
-  }, null, 2)
-}
-
-function truncate(value) {
-  return typeof value === 'string' && value.length > 2000 ? `${value.slice(0, 2000)}...[truncated]` : value
-}
-
-function boundedError(error) {
-  return {
-    name: error?.name ?? 'Error',
-    code: typeof error?.code === 'string' ? error.code.slice(0, 64) : 'unknown_error',
-  }
-}
-
-function attachProviderEvidence(error, entry) {
-  if (error && (typeof error === 'object' || typeof error === 'function')) {
-    error.providerEvidence = entry
-  }
-}
-
-function sha256String(value) {
-  return createHash('sha256').update(value).digest('hex')
-}
-
-function requiredEnv(name) {
-  const value = process.env[name]
-  if (!value) throw new Error(`${name} is required`)
-  return value
-}
diff --git a/test/live-managed-playwright.e2e.mjs b/test/live-managed-playwright.e2e.mjs
index d7a4618..cf3e856 100644
--- a/test/live-managed-playwright.e2e.mjs
+++ b/test/live-managed-playwright.e2e.mjs
@@ -1,367 +1,1177 @@
 import assert from 'node:assert/strict'
-import { createHash } from 'node:crypto'
-import { spawnSync } from 'node:child_process'
+import { randomUUID } from 'node:crypto'
 import fs from 'node:fs/promises'
-import fsSync from 'node:fs'
+import net from 'node:net'
 import path from 'node:path'
 import test from 'node:test'
+import { DatabaseSync } from 'node:sqlite'
 import { fileURLToPath } from 'node:url'
 
+import { createLiveBrowserInspectionSession } from './helpers/live-browser-observer.mjs'
+import {
+  knownIssueSkipForDurableBlocker,
+  loadLiveProviderCapabilityMatrix,
+  structuredBlockerCodes,
+} from './helpers/live-provider-capability-matrix.mjs'
+
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-const cliEntry = path.join(root, 'packages/cli/dist/src/tokenless.mjs')
-const providers = ['chatgpt', 'claude', 'gemini', 'grok']
-const gates = [
-  'TOKENLESS_LIVE_MANAGED_PLAYWRIGHT',
-  'TOKENLESS_LIVE_PROVIDER_MUTATIONS',
-  'TOKENLESS_LIVE_MANAGED_PLAYWRIGHT_HOME',
-  'TOKENLESS_LIVE_MANAGED_PLAYWRIGHT_PROFILE',
-]
-const liveEnabled = gates.every((key) => (
-  key === 'TOKENLESS_LIVE_MANAGED_PLAYWRIGHT' || key === 'TOKENLESS_LIVE_PROVIDER_MUTATIONS'
-    ? process.env[key] === '1'
-    : Boolean(process.env[key])
-))
-
-test('live managed Playwright provider matrix reuses existing managed profile and real DOM', {
-  skip: liveEnabled ? false : `set ${gates.join(', ')} to run live managed Playwright E2E`,
-  timeout: 1_200_000,
-}, async () => {
-  const homeDir = path.resolve(requiredEnv('TOKENLESS_LIVE_MANAGED_PLAYWRIGHT_HOME'))
-  const profileSlug = requiredEnv('TOKENLESS_LIVE_MANAGED_PLAYWRIGHT_PROFILE')
-  const managedProfile = resolveManagedProfile({ homeDir, profileSlug })
-
-  const artifactDir = await createArtifactDir()
-  const evidence = {
-    protocol: 'tokenless.live-managed-playwright.evidence.v1',
-    startedAt: new Date().toISOString(),
-    node: process.version,
-    platform: process.platform,
-    versions: await runtimeVersions(),
-    managedProfile,
-    providers: {},
-  }
-  let evidenceWritten = false
+const matrix = loadLiveProviderCapabilityMatrix()
+const gate = requiredGate()
+const homeDir = path.resolve(requiredEnv('TOKENLESS_LIVE_MANAGED_PLAYWRIGHT_HOME'))
+const profileSlug = requiredEnv('TOKENLESS_LIVE_MANAGED_PLAYWRIGHT_PROFILE')
+const browserConnectionMode = optionalConnectionMode(process.env.TOKENLESS_LIVE_BROWSER_CONNECTION_MODE)
+const providerFilter = optionalProviderFilter(process.env.TOKENLESS_LIVE_E2E_PROVIDER)
+const suiteRunMarker = `${compactTimestamp(new Date())}_${randomUUID().slice(0, 8)}`
+const submissionTrackers = new WeakMap()
+const handlers = {
+  'session-readiness': sessionReadiness,
+  'prompt-draft': promptDraft,
+  'model-choice': modelChoice,
+  'effort-choice': effortChoice,
+  'file-selection': fileSelection,
+  'conversation-workflow': conversationWorkflow,
+  'workspace-response-citations': workspaceResponseCitations,
+  'workspace-response-baseline': workspaceResponseBaseline,
+  'qwen-mode-workspace': qwenModeWorkspace,
+  'deepseek-controls': deepSeekControls,
+  'deepseek-search-reasoning': deepSeekSearchReasoning,
+  'deepseek-vision-input': deepSeekVisionInput,
+  'doubao-controls': doubaoControls,
+  'native-project': nativeProject,
+}
+
+const selectedProviders = Object.entries(matrix.providers)
+  .map(([provider, declaration]) => ({
+    provider,
+    declaration,
+    caseIds: declaration.required.filter(
+      (caseId) => gate === 'all' || matrix.cases[caseId].gate === gate,
+    ),
+  }))
+  .filter(({ provider }) => providerFilter === null || provider === providerFilter)
+  .filter(({ caseIds }) => caseIds.length > 0)
+
+assert.ok(selectedProviders.length > 0, `TOKENLESS_LIVE_E2E_GATE=${gate} selected no required providers`)
+let sharedSession
+let originalBrowserConnectionMode
+
+test.before(async () => {
+  const runtime = await import('../packages/cli/dist/src/index.js')
+  originalBrowserConnectionMode = (await runtime.readTokenlessConfig(homeDir)).browserConnectionMode
+  await runtime.writeTokenlessConfig({ homeDir, browserConnectionMode })
+  const daemonUrl = `http://127.0.0.1:${await freePort()}`
+  sharedSession = await createLiveBrowserInspectionSession({
+    homeDir,
+    profileSlug,
+    daemonUrl,
+  })
+})
+
+test.after(async () => {
   try {
-    for (const provider of providers) {
-      try {
-        evidence.providers[provider] = await exerciseProvider({ provider, homeDir, profileSlug })
-      } catch (error) {
-        if (error?.providerEvidence) evidence.providers[provider] = error.providerEvidence
-        throw error
-      }
+    await sharedSession?.close()
+  } finally {
+    if (originalBrowserConnectionMode) {
+      const runtime = await import('../packages/cli/dist/src/index.js')
+      await runtime.writeTokenlessConfig({ homeDir, browserConnectionMode: originalBrowserConnectionMode })
     }
+  }
+})
+
+for (const { provider, declaration, caseIds } of selectedProviders) {
+  test(`real provider ${provider}: ${gate} journey`, { timeout: 1_200_000 }, async (t) => {
+    const session = sharedSession
+    assert.ok(session, 'shared live E2E browser session must be initialized')
+    const journey = createProviderJourney(session, provider)
+    for (const caseId of caseIds) {
+      await t.test(`${provider}: ${caseId}`, { timeout: 1_200_000 }, async (step) => {
+        if (journey.skipReason) {
+          step.skip(journey.skipReason)
+          return
+        }
+        const handler = handlers[caseId]
+        assert.equal(typeof handler, 'function', `missing real E2E handler for ${caseId}`)
+        submissionTrackers.set(journey, {
+          attempts: 0,
+          budget: matrix.cases[caseId].submissions,
+          caseId,
+        })
+        try {
+          if (
+            matrix.cases[caseId].gate !== 'non_submission' &&
+            declaration.account === 'signed_in_selected_setup_profile' &&
+            !journey.authenticated
+          ) {
+            await requireSignedInSelectedProfile(journey)
+          }
+          await handler({ provider, declaration, journey })
+          assertSubmissionBudget(journey)
+        } catch (error) {
+          if (isKnownIssueSkip(error)) {
+            journey.skipReason = `${caseId}: ${error.message}`
+            step.skip(journey.skipReason)
+            return
+          }
+          throw Object.assign(
+            new Error(`${provider} journey step ${caseId}: ${error instanceof Error ? error.message : String(error)}`),
+            { cause: error },
+          )
+        }
+      })
+    }
+  })
+}
+
+async function requireSignedInSelectedProfile(journey) {
+  const auth = await journey.action('auth.status')
+  const result = responseResult(auth.payload, 'auth.status')
+  await auth.close()
+  const signedIn = result?.state === 'authenticated' || String(result?.access ?? '').startsWith('signed_in_')
+  if (!signedIn) {
+    throw e2eFailure(
+      'e2e_provider_auth_unavailable',
+      `${journey.provider} selected setup profile is not authenticated`,
+    )
+  }
+  journey.authenticated = true
+}
+
+async function sessionReadiness({ provider, declaration, journey }) {
+  const auth = await journey.action('auth.status')
+  const authResult = responseResult(auth.payload, 'auth.status')
+  await auth.close()
+  const capabilities = await journey.action('capability.inspect')
+  const capabilityResult = responseResult(capabilities.payload, 'capability.inspect')
+  const navigation = await journey.action('navigation.check')
+  assert.equal(responseResult(navigation.payload, 'navigation.check')?.allowed, true)
+  const blocker = await journey.action('blocker.check')
+  const blockerResult = responseResult(blocker.payload, 'blocker.check')
+  assert.equal(blockerResult?.blocked, false)
+  await Promise.all([capabilities.close(), navigation.close(), blocker.close()])
+  const signedIn = authResult?.state === 'authenticated' || String(authResult?.access ?? '').startsWith('signed_in_')
+  const guestReady = authResult?.access === 'guest' ||
+    blockerResult?.observation?.composerVisible === true ||
+    capabilityResult?.capabilities?.['conversation.continue']?.availability === 'available'
+  const ready = declaration.account === 'signed_in_selected_setup_profile'
+    ? signedIn
+    : signedIn || guestReady
+  if (!ready) {
+    throw e2eFailure(
+      'e2e_provider_auth_unavailable',
+      `${provider} selected setup profile does not satisfy ${declaration.account}`,
+    )
+  }
+  journey.authenticated = signedIn
+}
+
+async function promptDraft({ provider, journey }) {
+  const marker = markerFor(provider, 'DRAFT')
+  const input = await journey.action('prompt.input', ['--prompt', marker])
+  assert.deepEqual(responseResult(input.payload, 'prompt.input'), {
+    visible: true,
+    inputProof: 'prompt-text-visible',
+  })
+  assert.equal(await composerContains(input.page, marker), true, `${provider} observer must see the unique draft`)
+  await input.close()
+
+  const clear = await journey.action('prompt.clear')
+  assert.deepEqual(responseResult(clear.payload, 'prompt.clear'), {
+    visible: true,
+    inputProof: 'empty',
+  })
+  assert.equal(await composerContains(clear.page, marker), false, `${provider} observer must see the draft removed`)
+  await clear.close()
+}
+
+async function modelChoice(context) {
+  await choiceCase(context, 'model')
+}
+
+async function effortChoice(context) {
+  await choiceCase(context, 'effort')
+}
+
+async function qwenModeWorkspace({ provider, journey }) {
+  assert.equal(provider, 'qwen')
+  const inspected = await journey.action('qwen.mode.inspect')
+  const inspection = responseResult(inspected.payload, 'qwen.mode.inspect')
+  assert.equal(inspection?.supported, true)
+  assert.deepEqual(inspection?.active, { mode: 'Chat', variant: null })
+  assert.equal(
+    inspection?.modes?.some((mode) => mode.mode === 'Deep Research' && mode.enabled),
+    true,
+    'Qwen must expose an enabled Deep Research mode',
+  )
+  await inspected.close()
+
+  const name = markerFor(provider, 'MODE_WORKSPACE')
+  const marker = markerFor(provider, 'DEEP_RESEARCH')
+  const run = await journey.run([
+    '--project-name', name,
+    '--workspace-mode', 'conversation',
+    '--qwen-mode', 'Deep Research',
+    '--qwen-mode-variant', 'Advanced',
+    '--prompt', [
+      'Proceed immediately with a standalone research report about the official Qwen homepage.',
+      'Focus only on its current product features, available user entry points, and stated use cases.',
+      'Use the official Qwen site as the primary source, do not compare competitors, and do not ask clarifying questions.',
+      `Include this exact marker exactly once in the final report: ${marker}`,
+    ].join(' '),
+  ], 720_000, async ({ page }) => (
+    await exactTextVisible(page, 'Deep Research') &&
+    await exactTextVisible(page, 'Advanced')
+  ))
+  const selected = responseResult(run.payload, 'qwen.mode.select')
+  assert.deepEqual(selected, {
+    supported: true,
+    selectedMode: 'Deep Research',
+    selectedVariant: 'Advanced',
+    visibleProof: 'qwen-mode-and-variant-visible',
+  })
+  assert.equal(run.observerResult, true, 'Qwen observer must see Deep Research Advanced selected')
+  assert.match(responseResult(run.payload, 'response.read')?.text ?? '', new RegExp(escapeRegExp(marker)))
+  assertConversationWorkspaceResult(provider, journey.taskId, run)
+  await run.close()
+
+  const restored = await journey.action('qwen.mode.select', ['--qwen-mode', 'Chat'])
+  assert.deepEqual(responseResult(restored.payload, 'qwen.mode.select'), {
+    supported: true,
+    selectedMode: 'Chat',
+    selectedVariant: null,
+    visibleProof: 'qwen-chat-mode-visible',
+  })
+  assert.equal(await exactTextVisible(restored.page, 'Auto'), true)
+  await restored.close()
+}
+
+async function deepSeekControls({ provider, journey }) {
+  assert.equal(provider, 'deepseek')
+  const modeInspection = await journey.action('deepseek.mode.inspect')
+  const modes = responseResult(modeInspection.payload, 'deepseek.mode.inspect')
+  assert.equal(modes?.supported, true)
+  assert.deepEqual(modes?.modes?.map((choice) => choice.mode), ['Instant', 'Expert', 'Vision'])
+  assert.equal(modes?.modes?.find((choice) => choice.mode === 'Instant')?.controls.search, true)
+  assert.equal(modes?.modes?.find((choice) => choice.mode === 'Expert')?.controls.fileUpload, false)
+  assert.equal(modes?.modes?.find((choice) => choice.mode === 'Vision')?.controls.imageFileSelection, true)
+  const originalMode = modes.activeMode
+  await modeInspection.close()
+
+  const deepThinkInspection = await journey.action('deepseek.deepthink.inspect')
+  const originalDeepThink = responseResult(deepThinkInspection.payload, 'deepseek.deepthink.inspect')?.enabled
+  assert.equal(typeof originalDeepThink, 'boolean')
+  await deepThinkInspection.close()
+
+  let originalSearch
+  try {
+    const instant = await journey.action('deepseek.mode.select', ['--deepseek-mode', 'Instant'])
+    assert.equal(responseResult(instant.payload, 'deepseek.mode.select')?.selectedMode, 'Instant')
+    await instant.close()
+
+    const searchInspection = await journey.action('deepseek.search.inspect')
+    originalSearch = responseResult(searchInspection.payload, 'deepseek.search.inspect')?.enabled
+    assert.equal(typeof originalSearch, 'boolean')
+    await searchInspection.close()
+
+    const searchChanged = await journey.action('deepseek.search.select', [
+      '--deepseek-search', originalSearch ? 'off' : 'on',
+    ])
+    assert.equal(responseResult(searchChanged.payload, 'deepseek.search.select')?.enabled, !originalSearch)
+    await searchChanged.close()
 
-    evidence.completedAt = new Date().toISOString()
-    await writeArtifact(artifactDir, 'matrix.json', evidence)
-    evidenceWritten = true
+    const deepThinkChanged = await journey.action('deepseek.deepthink.select', [
+      '--deepseek-deepthink', originalDeepThink ? 'off' : 'on',
+    ])
+    assert.equal(responseResult(deepThinkChanged.payload, 'deepseek.deepthink.select')?.enabled, !originalDeepThink)
+    await deepThinkChanged.close()
 
+    for (const mode of ['Expert', 'Vision']) {
+      const selected = await journey.action('deepseek.mode.select', ['--deepseek-mode', mode])
+      assert.equal(responseResult(selected.payload, 'deepseek.mode.select')?.selectedMode, mode)
+      await selected.close()
+      const search = await journey.action('deepseek.search.inspect')
+      assert.deepEqual(responseResult(search.payload, 'deepseek.search.inspect'), {
+        supported: false,
+        activeMode: mode,
+        reason: 'unavailable_in_mode',
+      })
+      await search.close()
+    }
   } finally {
-    if (!evidenceWritten) {
-      await writeArtifact(artifactDir, 'matrix.partial.json', evidence).catch(() => undefined)
+    const restoredMode = await journey.action('deepseek.mode.select', ['--deepseek-mode', originalMode])
+    await restoredMode.close()
+    const restoredDeepThink = await journey.action('deepseek.deepthink.select', [
+      '--deepseek-deepthink', originalDeepThink ? 'on' : 'off',
+    ])
+    await restoredDeepThink.close()
+    if (originalMode === 'Instant' && typeof originalSearch === 'boolean') {
+      const restoredSearch = await journey.action('deepseek.search.select', [
+        '--deepseek-search', originalSearch ? 'on' : 'off',
+      ])
+      await restoredSearch.close()
     }
   }
-})
+}
+
+async function doubaoControls({ provider, journey }) {
+  assert.equal(provider, 'doubao')
+  const modeInspection = await journey.action('doubao.mode.inspect')
+  const modes = responseResult(modeInspection.payload, 'doubao.mode.inspect')
+  assert.equal(modes?.supported, true)
+  assert.equal(modes?.activeMode, 'fast')
+  assert.deepEqual(modes?.modes?.map((choice) => choice.mode), [
+    'fast',
+    'expert',
+    'work-task-turbo',
+    'work-task-pro',
+  ])
+  assert.deepEqual(modes?.modes?.find((choice) => choice.mode === 'work-task-pro'), {
+    mode: 'work-task-pro',
+    nativeLabel: '工作任务 Pro',
+    description: '执行 agent 任务 - 2.1 Pro',
+    canonicalCapabilities: ['task.background', 'task.interactive'],
+    enabled: false,
+    selected: false,
+    reason: 'upgrade_required',
+  })
+  const originalMode = modes.activeMode
+  await modeInspection.close()
 
-async function exerciseProvider({ provider, homeDir, profileSlug }) {
-  const started = Date.now()
-  const entry = { actions: {}, startedAt: new Date().toISOString() }
-  let draftInputConfirmed = false
-  let draftCleared = false
   try {
-    const auth = runJson(['provider-action', '--profile', profileSlug, '--provider', provider, '--action', 'auth.status', '--home', homeDir, '--timeout-ms', '90000', '--json'])
-    const authState = findResponseResult(auth, 'auth.status')?.state
-    assert.equal(authState, 'authenticated', `${provider} must be authenticated`)
-    entry.actions.auth = { state: authState, ms: Date.now() - started }
-
-    const controls = runJson(['provider-controls', '--profile', profileSlug, '--provider', provider, '--home', homeDir, '--timeout-ms', '90000', '--json'])
-    const modelInspect = findResponseResult(controls, 'model.inspect')
-    const effortInspect = findResponseResult(controls, 'effort.inspect')
-    assert.equal(modelInspect?.supported, true, `${provider} model inspect must be supported`)
-    assert.ok(selectedChoice(modelInspect), `${provider} model inspect must expose selected model`)
-    entry.actions.modelInspect = inspectSummary(modelInspect)
-    entry.actions.effortInspect = inspectSummary(effortInspect)
-
-    const modelRestore = selectedChoice(modelInspect)
-    const modelAlternate = alternateChoice(modelInspect) ?? modelRestore
-    if (modelAlternate) {
-      try {
-        const selected = runJson(['provider-action', '--profile', profileSlug, '--provider', provider, '--action', 'model.select', '--model', modelAlternate.label, '--home', homeDir, '--timeout-ms', '90000', '--json'])
-        const selectedResult = findResponseResult(selected, 'model.select')
-        assert.equal(selectedResult?.selectedLabel, modelAlternate.label, `${provider} model select must apply exact label`)
-        entry.actions.modelSelect = { requested: modelAlternate.label, selectedLabel: selectedResult.selectedLabel }
-      } finally {
-        if (modelRestore) {
-          const restored = runJson(['provider-action', '--profile', profileSlug, '--provider', provider, '--action', 'model.select', '--model', modelRestore.label, '--home', homeDir, '--timeout-ms', '90000', '--json'])
-          assert.equal(findResponseResult(restored, 'model.select')?.selectedLabel, modelRestore.label, `${provider} model restore must apply exact label`)
-        }
-      }
+    for (const mode of ['expert', 'work-task-turbo']) {
+      const selected = await journey.action('doubao.mode.select', ['--doubao-mode', mode])
+      const result = responseResult(selected.payload, 'doubao.mode.select')
+      assert.equal(result?.selectedMode, mode)
+      assert.equal(await doubaoModeVisible(selected.page, result.nativeLabel), true)
+      await selected.close()
     }
+    const unavailable = await journey.action('doubao.mode.select', ['--doubao-mode', 'work-task-pro'])
+    assert.deepEqual(responseResult(unavailable.payload, 'doubao.mode.select'), {
+      supported: false,
+      reason: 'mode_unavailable',
+    })
+    await unavailable.close()
+  } finally {
+    const restored = await journey.action('doubao.mode.select', ['--doubao-mode', originalMode])
+    assert.equal(responseResult(restored.payload, 'doubao.mode.select')?.selectedMode, originalMode)
+    await restored.close()
+  }
 
-    const effortRestore = selectedChoice(effortInspect)
-    const effortAlternate = alternateChoice(effortInspect) ?? effortRestore
-    if (effortInspect?.supported === false) {
-      entry.actions.effortSelect = { supported: false, reason: effortInspect.reason }
-    } else if (effortAlternate) {
-      try {
-        const selected = runJson(['provider-action', '--profile', profileSlug, '--provider', provider, '--action', 'effort.select', '--effort', effortAlternate.label, '--home', homeDir, '--timeout-ms', '90000', '--json'])
-        const selectedResult = findResponseResult(selected, 'effort.select')
-        assert.equal(selectedResult?.selectedLabel, effortAlternate.label, `${provider} effort select must apply exact label`)
-        entry.actions.effortSelect = { requested: effortAlternate.label, selectedLabel: selectedResult.selectedLabel }
-      } finally {
-        if (effortRestore) {
-          const restored = runJson(['provider-action', '--profile', profileSlug, '--provider', provider, '--action', 'effort.select', '--effort', effortRestore.label, '--home', homeDir, '--timeout-ms', '90000', '--json'])
-          assert.equal(findResponseResult(restored, 'effort.select')?.selectedLabel, effortRestore.label, `${provider} effort restore must apply exact label`)
-        }
-      }
+  const skillInspection = await journey.action('doubao.skill.inspect')
+  const skills = responseResult(skillInspection.payload, 'doubao.skill.inspect')
+  assert.equal(skills?.supported, true)
+  assert.equal(skills?.activeSkill, 'chat')
+  assert.deepEqual(
+    skills?.skills?.find((choice) => choice.skill === 'audio-transcription'),
+    {
+      skill: 'audio-transcription',
+      nativeLabel: '录音转写',
+      canonicalCapabilities: ['audio.transcription'],
+      enabled: false,
+      selected: false,
+      reason: 'desktop_app_required',
+    },
+  )
+  const selectableSkills = skills.skills.filter((choice) => choice.enabled && choice.skill !== 'chat')
+  assert.deepEqual(selectableSkills.map((choice) => choice.skill), [
+    'document-writing',
+    'presentation-generation',
+    'image-generation',
+    'video-generation',
+    'deep-research',
+    'audio-podcast',
+    'music-generation',
+    'problem-solving',
+    'spreadsheet-generation',
+  ])
+  await skillInspection.close()
+
+  try {
+    for (const choice of selectableSkills) {
+      const selected = await journey.action('doubao.skill.select', ['--doubao-skill', choice.skill])
+      const result = responseResult(selected.payload, 'doubao.skill.select')
+      assert.equal(result?.selectedSkill, choice.skill)
+      assert.equal(await doubaoSkillVisible(selected.page, choice.nativeLabel), true)
+      await selected.close()
     }
+    const unavailable = await journey.action('doubao.skill.select', ['--doubao-skill', 'audio-transcription'])
+    assert.deepEqual(responseResult(unavailable.payload, 'doubao.skill.select'), {
+      supported: false,
+      reason: 'skill_unavailable',
+    })
+    await unavailable.close()
+  } finally {
+    const restored = await journey.action('doubao.skill.select', ['--doubao-skill', 'chat'])
+    assert.deepEqual(responseResult(restored.payload, 'doubao.skill.select'), {
+      supported: true,
+      selectedSkill: 'chat',
+      nativeLabel: '普通对话',
+      visibleProof: 'doubao-default-composer-visible',
+    })
+    assert.equal(await restored.page.locator('textarea.semi-input-textarea').filter({ visible: true }).count(), 1)
+    await restored.close()
+  }
+}
 
-    const draft = `TOKENLESS_DRAFT_CLEAR_${provider}_${Date.now()}`
-    const input = runJson(['provider-action', '--profile', profileSlug, '--provider', provider, '--action', 'prompt.input', '--prompt', draft, '--home', homeDir, '--timeout-ms', '90000', '--json'])
-    const inputResult = findResponseResult(input, 'prompt.input')
-    assert.deepEqual(inputResult, { visible: true, inputProof: 'prompt-text-visible' }, `${provider} prompt.input must succeed`)
-    draftInputConfirmed = true
-    const clear = runJson(['provider-action', '--profile', profileSlug, '--provider', provider, '--action', 'prompt.clear', '--home', homeDir, '--timeout-ms', '90000', '--json'])
-    const clearResult = findResponseResult(clear, 'prompt.clear')
-    assert.deepEqual(clearResult, { visible: true, inputProof: 'empty' }, `${provider} prompt.clear must succeed`)
-    draftCleared = true
-    entry.actions.draftClear = { visible: clearResult.visible, inputProof: clearResult.inputProof }
-
-    const marker = `TOKENLESS_LIVE_${provider}_${Date.now()}`
-    const upload = await markerUploadFile(provider, marker)
-    let uploadUsesError = null
-    try {
-      const uploadResult = runJson(['provider-action', '--profile', profileSlug, '--provider', provider, '--action', 'file.upload', '--attach-file', upload, '--home', homeDir, '--timeout-ms', '120000', '--json'])
-      entry.actions.fileUpload = {
-        ok: Boolean(findResponseResult(uploadResult, 'file.upload')),
-        markerSha256: sha256String(marker),
-      }
+async function doubaoModeVisible(page, nativeLabel) {
+  const trigger = page.locator(
+    'button[aria-haspopup="menu"][aria-expanded]:has([data-valid-btn="mode-select-action-btn"])',
+  ).filter({ visible: true }).last()
+  return await trigger.count() > 0 && (await trigger.innerText()).replace(/\s+/gu, ' ').trim().startsWith(nativeLabel)
+}
 
-      const run = runJson(['run', '--profile', profileSlug, '--provider', provider, '--task-id', `live-${provider}-${Date.now()}`, '--attach-file', upload, '--prompt', `Reply with marker ${marker} and include any visible citation/source controls if available.`, '--home', homeDir, '--timeout-ms', '240000', '--json'])
-      const responseRead = findResponseResult(run, 'response.read')
-      const runUpload = findResponseResult(run, 'file.upload')
-      assert.match(responseRead?.text ?? '', new RegExp(marker), `${provider} response must correlate marker`)
-      assert.equal(Array.isArray(responseRead?.citations), true, `${provider} response.read must return citations array`)
-      assert.ok(runUpload, `${provider} run must include marker file upload in the same job`)
-      entry.actions.response = {
-        markerMatched: true,
-        textChars: String(responseRead.text).length,
-        citationCount: Array.isArray(responseRead.citations) ? responseRead.citations.length : 0,
-      }
-    } catch (error) {
-      uploadUsesError = error
-      throw error
-    } finally {
-      const cleanup = await removeGeneratedUploadFile(upload)
-      entry.cleanup = {
-        ...entry.cleanup,
-        markerUploadFile: cleanup,
-      }
-      if (!cleanup.succeeded && !uploadUsesError) {
-        throw new Error(`${provider} generated marker upload file cleanup failed: ${cleanup.error?.code ?? 'unknown_error'}`)
-      }
+async function doubaoSkillVisible(page, nativeLabel) {
+  const token = page.locator('div[data-input-engine-action-source="actionbar"][data-value]')
+    .filter({ visible: true })
+    .filter({ hasText: new RegExp(`^${escapeRegExp(nativeLabel)}$`) })
+    .last()
+  return await token.count() > 0
+}
+
+async function deepSeekSearchReasoning({ provider, journey }) {
+  assert.equal(provider, 'deepseek')
+  const modeInspection = await journey.action('deepseek.mode.inspect')
+  const originalMode = responseResult(modeInspection.payload, 'deepseek.mode.inspect')?.activeMode
+  assert.ok(['Instant', 'Expert', 'Vision'].includes(originalMode))
+  await modeInspection.close()
+  const deepThinkInspection = await journey.action('deepseek.deepthink.inspect')
+  const originalDeepThink = responseResult(deepThinkInspection.payload, 'deepseek.deepthink.inspect')?.enabled
+  assert.equal(typeof originalDeepThink, 'boolean')
+  await deepThinkInspection.close()
+  const instant = await journey.action('deepseek.mode.select', ['--deepseek-mode', 'Instant'])
+  await instant.close()
+  const searchInspection = await journey.action('deepseek.search.inspect')
+  const originalSearch = responseResult(searchInspection.payload, 'deepseek.search.inspect')?.enabled
+  assert.equal(typeof originalSearch, 'boolean')
+  await searchInspection.close()
+
+  try {
+    const reasoningMarker = markerFor(provider, 'DEEPTHINK_RESPONSE')
+    const reasoning = await journey.run([
+      '--deepseek-mode', 'Instant',
+      '--deepseek-deepthink', 'on',
+      '--deepseek-search', 'off',
+      '--prompt', `Use DeepThink to calculate 37 multiplied by 43. Include this exact marker in the final answer: ${reasoningMarker}`,
+    ])
+    assert.equal(responseResult(reasoning.payload, 'deepseek.mode.select')?.selectedMode, 'Instant')
+    assert.equal(responseResult(reasoning.payload, 'deepseek.deepthink.select')?.enabled, true)
+    assert.equal(responseResult(reasoning.payload, 'deepseek.search.select')?.enabled, false)
+    assert.match(responseResult(reasoning.payload, 'response.read')?.text ?? '', new RegExp(escapeRegExp(reasoningMarker)))
+    await reasoning.close()
+
+    const searchMarker = markerFor(provider, 'SEARCH_RESPONSE')
+    const search = await journey.run([
+      '--deepseek-mode', 'Instant',
+      '--deepseek-deepthink', 'off',
+      '--deepseek-search', 'on',
+      '--prompt', `Use web search to identify the official Node.js homepage. Include this exact marker: ${searchMarker}. Provide visible source links.`,
+    ])
+    const response = responseResult(search.payload, 'response.read')
+    assert.equal(responseResult(search.payload, 'deepseek.search.select')?.enabled, true)
+    assert.match(response?.text ?? '', new RegExp(escapeRegExp(searchMarker)))
+    assert.ok(Array.isArray(response?.citations) && response.citations.length > 0)
+    assert.ok(await visibleCitationCount(search.page, response.citations) > 0)
+    await search.close()
+  } finally {
+    const restoreInstant = await journey.action('deepseek.mode.select', ['--deepseek-mode', 'Instant'])
+    await restoreInstant.close()
+    const restoreSearch = await journey.action('deepseek.search.select', [
+      '--deepseek-search', originalSearch ? 'on' : 'off',
+    ])
+    await restoreSearch.close()
+    const restoreMode = await journey.action('deepseek.mode.select', ['--deepseek-mode', originalMode])
+    await restoreMode.close()
+    const restoreDeepThink = await journey.action('deepseek.deepthink.select', [
+      '--deepseek-deepthink', originalDeepThink ? 'on' : 'off',
+    ])
+    await restoreDeepThink.close()
+  }
+}
+
+async function choiceCase({ provider, journey }, kind) {
+  const inspectAction = `${kind}.inspect`
+  const selectAction = `${kind}.select`
+  const inspect = await journey.action(inspectAction)
+  const result = responseResult(inspect.payload, inspectAction)
+  assert.equal(result?.supported, true, `${provider} ${inspectAction} must be supported`)
+  const selected = result.choices.find((choice) => choice.selected && choice.enabled)
+  const alternate = result.choices.find((choice) => !choice.selected && choice.enabled)
+  assert.ok(selected, `${provider} ${kind} must expose the selected choice`)
+  assert.ok(alternate, `${provider} ${kind} must expose a real alternate choice`)
+  await inspect.close()
+
+  const option = kind === 'model' ? '--model' : '--effort'
+  const changed = await journey.action(selectAction, [option, alternate.label])
+  try {
+    assert.equal(responseResult(changed.payload, selectAction)?.selectedLabel, alternate.label)
+    assert.equal(await exactTextVisible(changed.page, alternate.label), true, `${provider} observer must see selected ${kind}`)
+  } finally {
+    await changed.close()
+    const restored = await journey.action(selectAction, [option, selected.label])
+    assert.equal(responseResult(restored.payload, selectAction)?.selectedLabel, selected.label)
+    await restored.close()
+  }
+}
+
+async function fileSelection({ provider, journey }) {
+  const name = `${markerFor(provider, 'ATTACHMENT')}.txt`
+  const file = path.join(root, 'test-results', 'live-provider-inputs', name)
+  await fs.mkdir(path.dirname(file), { recursive: true, mode: 0o700 })
+  await fs.writeFile(file, `${name}\n`, { mode: 0o600 })
+  const deepSeekState = provider === 'deepseek' ? await captureDeepSeekState(journey) : null
+  try {
+    if (deepSeekState) {
+      const instant = await journey.action('deepseek.mode.select', ['--deepseek-mode', 'Instant'])
+      assert.equal(responseResult(instant.payload, 'deepseek.mode.select')?.selectedMode, 'Instant')
+      await instant.close()
     }
+    const uploaded = await journey.action('file.upload', ['--attach-file', file], 180_000)
+    const result = responseResult(uploaded.payload, 'file.upload')
+    assert.ok(result?.attachments?.some((attachment) => attachment.name === name))
+    assert.equal(await exactTextVisible(uploaded.page, name), true, `${provider} observer must see selected attachment`)
+    await uploaded.close()
+    const cleared = await journey.action('prompt.clear')
+    await cleared.close()
+  } finally {
+    await fs.rm(file, { force: true })
+    if (deepSeekState) await restoreDeepSeekState(journey, deepSeekState)
+  }
+}
+
+async function conversationWorkflow({ provider, journey }) {
+  const name = markerFor(provider, 'CONVERSATION_WORKFLOW')
+  const attachmentMarker = markerFor(provider, 'ATTACHMENT')
+  const responseMarker = markerFor(provider, 'TURN_ONE_RESPONSE')
+  const contextSecret = markerFor(provider, 'CONTEXT_SECRET')
+  const attachmentName = `${attachmentMarker}.txt`
+  const attachment = path.join(root, 'test-results', 'live-provider-inputs', attachmentName)
+  await fs.mkdir(path.dirname(attachment), { recursive: true, mode: 0o700 })
+  await fs.writeFile(attachment, `${attachmentMarker}\n`, { mode: 0o600 })
+  const deepSeekState = provider === 'deepseek' ? await captureDeepSeekState(journey) : null
+  try {
+    const first = await journey.run([
+      '--project-name', name,
+      '--workspace-mode', 'conversation',
+      ...(provider === 'deepseek' ? [
+        '--deepseek-mode', 'Instant',
+        '--deepseek-deepthink', 'off',
+        '--deepseek-search', 'on',
+      ] : []),
+      '--attach-file', attachment,
+      '--prompt', [
+        'Read the attached file and include its exact marker in your response.',
+        `Also include this exact response marker: ${responseMarker}.`,
+        `Remember this secret for my next message but do not reveal it yet: ${contextSecret}.`,
+        'Identify the official Node.js homepage and cite that official source.',
+      ].join(' '),
+    ], 360_000, ({ page }) => waitForExactText(page, attachmentName, 180_000))
+    const firstText = responseResult(first.payload, 'response.read')?.text ?? ''
+    const citations = responseResult(first.payload, 'response.read')?.citations
+    assert.match(firstText, new RegExp(escapeRegExp(attachmentMarker)))
+    assert.match(firstText, new RegExp(escapeRegExp(responseMarker)))
+    assert.doesNotMatch(firstText, new RegExp(escapeRegExp(contextSecret)))
+    assert.ok(responseResult(first.payload, 'file.upload')?.attachments?.some(
+      (attachmentResult) => attachmentResult.name === attachmentName,
+    ))
+    assert.equal(first.observerResult, true, `${provider} observer must see the submitted attachment`)
+    assert.equal(await pageContains(first.page, responseMarker, 2), true)
+    assert.ok(Array.isArray(citations) && citations.length > 0, `${provider} must return normalized real citations`)
+    assert.ok(await visibleCitationCount(first.page, citations) > 0, `${provider} observer must see a returned citation link`)
+    const firstUrl = assertConversationWorkspaceResult(provider, journey.taskId, first)
+    await first.close()
+
+    const second = await journey.run([
+      '--project-name', name,
+      '--workspace-mode', 'conversation',
+      ...(provider === 'deepseek' ? [
+        '--deepseek-mode', 'Instant',
+        '--deepseek-deepthink', 'off',
+        '--deepseek-search', 'on',
+      ] : []),
+      '--prompt', 'Reply with exactly the secret from my previous message and no other text.',
+    ])
+    const secondText = responseResult(second.payload, 'response.read')?.text ?? ''
+    assert.match(secondText, new RegExp(escapeRegExp(contextSecret)))
+    assert.equal(canonicalPageUrl(second.page.url()), firstUrl, `${provider} both CLI processes must share one exact conversation`)
+    assertTaskConversationMapping(provider, journey.taskId, firstUrl, second.payload)
+    await second.close()
+  } finally {
+    await fs.rm(attachment, { force: true })
+    if (deepSeekState) await restoreDeepSeekState(journey, deepSeekState)
+  }
+}
+
+async function deepSeekVisionInput({ provider, journey }) {
+  assert.equal(provider, 'deepseek')
+  const original = await captureDeepSeekState(journey)
+  const image = path.join(root, 'assets', 'tokenless-mark.png')
+  const marker = markerFor(provider, 'VISION_RESPONSE')
+  try {
+    const run = await journey.run([
+      '--deepseek-mode', 'Vision',
+      '--deepseek-deepthink', 'off',
+      '--attach-file', image,
+      '--prompt', [
+        'Describe the central mark in the attached image in one short sentence.',
+        `Include this exact marker: ${marker}`,
+      ].join(' '),
+    ], 360_000, ({ page }) => waitForExactText(page, path.basename(image), 180_000))
+    assert.equal(responseResult(run.payload, 'deepseek.mode.select')?.selectedMode, 'Vision')
+    assert.ok(responseResult(run.payload, 'file.upload')?.attachments?.some(
+      (attachment) => attachment.name === path.basename(image),
+    ))
+    assert.equal(run.observerResult, true, 'DeepSeek observer must see the selected Vision image')
+    assert.match(responseResult(run.payload, 'response.read')?.text ?? '', new RegExp(escapeRegExp(marker)))
+    await run.close()
+  } finally {
+    await restoreDeepSeekState(journey, original)
+  }
+}
+
+async function captureDeepSeekState(journey) {
+  const modeInspection = await journey.action('deepseek.mode.inspect')
+  const mode = responseResult(modeInspection.payload, 'deepseek.mode.inspect')?.activeMode
+  assert.ok(['Instant', 'Expert', 'Vision'].includes(mode))
+  await modeInspection.close()
+
+  const deepThinkInspection = await journey.action('deepseek.deepthink.inspect')
+  const deepThink = responseResult(deepThinkInspection.payload, 'deepseek.deepthink.inspect')?.enabled
+  assert.equal(typeof deepThink, 'boolean')
+  await deepThinkInspection.close()
+
+  let search = null
+  if (mode === 'Instant') {
+    const searchInspection = await journey.action('deepseek.search.inspect')
+    search = responseResult(searchInspection.payload, 'deepseek.search.inspect')?.enabled
+    assert.equal(typeof search, 'boolean')
+    await searchInspection.close()
+  }
+  return { mode, deepThink, search }
+}
+
+async function restoreDeepSeekState(journey, state) {
+  const instant = await journey.action('deepseek.mode.select', ['--deepseek-mode', 'Instant'])
+  await instant.close()
+  if (typeof state.search === 'boolean') {
+    const search = await journey.action('deepseek.search.select', [
+      '--deepseek-search', state.search ? 'on' : 'off',
+    ])
+    await search.close()
+  }
+  const mode = await journey.action('deepseek.mode.select', ['--deepseek-mode', state.mode])
+  await mode.close()
+  const deepThink = await journey.action('deepseek.deepthink.select', [
+    '--deepseek-deepthink', state.deepThink ? 'on' : 'off',
+  ])
+  await deepThink.close()
+}
+
+async function workspaceResponseCitations({ provider, journey }) {
+  const name = markerFor(provider, 'WORKSPACE_RESPONSE')
+  const responseMarker = markerFor(provider, 'WORKSPACE_RESPONSE_MARKER')
+  const run = await journey.run([
+    '--project-name', name,
+    '--workspace-mode', 'conversation',
+    '--prompt', `Include this exact marker: ${responseMarker}. Identify the official Node.js homepage and cite that official source.`,
+  ])
+  const response = responseResult(run.payload, 'response.read')
+  assert.match(response?.text ?? '', new RegExp(escapeRegExp(responseMarker)))
+  assert.equal(await pageContains(run.page, responseMarker, 2), true)
+  assert.ok(Array.isArray(response?.citations) && response.citations.length > 0, `${provider} must return normalized real citations`)
+  assert.ok(await visibleCitationCount(run.page, response.citations) > 0, `${provider} observer must see a returned citation link`)
+  assertConversationWorkspaceResult(provider, journey.taskId, run)
+  await run.close()
+}
+
+async function workspaceResponseBaseline({ provider, journey }) {
+  const name = markerFor(provider, 'WORKSPACE_RESPONSE')
+  const responseMarker = markerFor(provider, 'WORKSPACE_RESPONSE_MARKER')
+  const prompt = provider === 'doubao'
+    ? `请只在代码块中原样回复：\`${responseMarker}\``
+    : `Reply with this exact marker: ${responseMarker}`
+  const run = await journey.run([
+    '--project-name', name,
+    '--workspace-mode', 'conversation',
+    '--prompt', prompt,
+  ])
+  const response = responseResult(run.payload, 'response.read')
+  assert.match(response?.text ?? '', new RegExp(escapeRegExp(responseMarker)))
+  assert.equal(await pageContains(run.page, responseMarker, 2), true)
+  assertConversationWorkspaceResult(provider, journey.taskId, run)
+  await run.close()
+}
+
+async function nativeProject({ provider, journey }) {
+  const projectName = markerFor(provider, 'PROJECT')
+  const instructionMarker = markerFor(provider, 'PROJECT_INSTRUCTION')
+  const instructions = `Include this exact marker in every response: ${instructionMarker}`
+  const created = await journey.action('workspace.ensure', [
+    '--project-name', projectName,
+    '--workspace-mode', 'native',
+    '--project-instructions', instructions,
+  ], 240_000)
+  const createdResult = responseResult(created.payload, 'workspace.ensure')
+  assert.equal(createdResult?.mode, 'native')
+  assert.equal(createdResult?.resource?.disposition, 'created')
+  assert.equal(createdResult?.instructionOutcome, 'applied_on_creation')
+  assert.equal(await exactTextVisible(created.page, projectName), true)
+  const projectUrl = createdResult.resource.canonicalUrl
+  await created.close()
 
-    const navigation = runJson(['provider-action', '--profile', profileSlug, '--provider', provider, '--action', 'navigation.check', '--home', homeDir, '--timeout-ms', '90000', '--json'])
-    entry.actions.navigation = boundedResult(findResponseResult(navigation, 'navigation.check'))
-    assert.equal(entry.actions.navigation.allowed, true, `${provider} navigation must be allowed`)
+  const reused = await journey.action('workspace.ensure', [
+    '--project-name', projectName,
+    '--workspace-mode', 'native',
+    '--project-instructions', instructions,
+  ], 240_000)
+  const reusedResult = responseResult(reused.payload, 'workspace.ensure')
+  assert.equal(reusedResult?.resource?.disposition, 'reused')
+  assert.equal(reusedResult?.resource?.canonicalUrl, projectUrl)
+  assert.equal(reusedResult?.instructionOutcome, 'skipped_on_reuse')
+  await reused.close()
 
-    const blocker = runJson(['provider-action', '--profile', profileSlug, '--provider', provider, '--action', 'blocker.check', '--home', homeDir, '--timeout-ms', '90000', '--json'])
-    entry.actions.blocker = boundedResult(findResponseResult(blocker, 'blocker.check'))
-    assert.equal(entry.actions.blocker.blocked, false, `${provider} must not be visibly blocked`)
+  const controls = []
+  if (matrix.providers[provider].required.includes('model-choice')) {
+    controls.push(await projectChoice(provider, journey, projectUrl, 'model'))
+  }
+  if (matrix.providers[provider].required.includes('effort-choice')) {
+    controls.push(await projectChoice(provider, journey, projectUrl, 'effort'))
+  }
+
+  const firstMarker = markerFor(provider, 'PROJECT_TURN_ONE')
+  const attachmentName = `${markerFor(provider, 'PROJECT_ATTACHMENT')}.txt`
+  const attachment = path.join(root, 'test-results', 'live-provider-inputs', attachmentName)
+  await fs.mkdir(path.dirname(attachment), { recursive: true, mode: 0o700 })
+  await fs.writeFile(attachment, `${firstMarker}\n`, { mode: 0o600 })
+  let primaryError
+  try {
+    const first = await journey.run([
+      '--project-name', projectName,
+      '--project-instructions', instructions,
+      '--workspace-mode', 'native',
+      '--attach-file', attachment,
+      ...controls.flatMap((control) => [control.option, control.alternate]),
+      '--prompt', `Read the attached file and report its exact marker.`,
+    ], 360_000, ({ page }) => waitForExactText(page, attachmentName, 180_000))
+    const firstText = responseResult(first.payload, 'response.read')?.text ?? ''
+    assert.match(firstText, new RegExp(escapeRegExp(firstMarker)))
+    assert.match(firstText, new RegExp(escapeRegExp(instructionMarker)))
+    assert.ok(responseResult(first.payload, 'file.upload')?.attachments?.some(
+      (candidate) => candidate.name === attachmentName,
+    ))
+    assert.equal(first.observerResult, true, `${provider} observer must see the Project attachment`)
+    for (const control of controls) {
+      assert.equal(responseResult(first.payload, `${control.kind}.select`)?.selectedLabel, control.alternate)
+    }
+    const conversationUrl = canonicalPageUrl(first.page.url())
+    assert.notEqual(conversationUrl, canonicalPageUrl(projectUrl))
+    await first.close()
 
-    entry.completedAt = new Date().toISOString()
-    entry.elapsedMs = Date.now() - started
-    return entry
+    const secondMarker = markerFor(provider, 'PROJECT_TURN_TWO')
+    const second = await journey.run([
+      '--project-name', projectName,
+      '--workspace-mode', 'native',
+      '--prompt', `Reply with both the earlier file marker and this marker: ${secondMarker}`,
+    ], 360_000)
+    const text = responseResult(second.payload, 'response.read')?.text ?? ''
+    assert.match(text, new RegExp(escapeRegExp(firstMarker)))
+    assert.match(text, new RegExp(escapeRegExp(secondMarker)))
+    assert.match(text, new RegExp(escapeRegExp(instructionMarker)))
+    assert.equal(canonicalPageUrl(second.page.url()), conversationUrl)
+
+    const database = new DatabaseSync(path.join(homeDir, 'tokenless.sqlite3'), { readOnly: true })
+    try {
+      const project = database.prepare(
+        'SELECT resource_id, canonical_url FROM provider_projects WHERE provider = ? AND profile_id = ? AND name = ?',
+      ).get(provider, createdResult.scope.profileId, projectName)
+      assert.equal(project?.canonical_url, projectUrl)
+      const conversation = database.prepare(
+        `SELECT canonical_url FROM provider_conversations
+         WHERE provider = ? AND profile_id = ? AND project_resource_id = ? AND task_id = ?`,
+      ).get(provider, createdResult.scope.profileId, project.resource_id, journey.taskId)
+      assert.equal(conversation?.canonical_url, conversationUrl)
+    } finally {
+      database.close()
+    }
+    await second.close()
   } catch (error) {
-    entry.failedAt = new Date().toISOString()
-    entry.elapsedMs = Date.now() - started
-    attachProviderEvidence(error, entry)
+    primaryError = error
     throw error
   } finally {
-    if (draftInputConfirmed && !draftCleared) {
-      entry.cleanup = {
-        ...entry.cleanup,
-        promptClear: attemptPromptClearCleanup({ provider, homeDir, profileSlug }),
+    await fs.rm(attachment, { force: true })
+    for (const control of controls) {
+      try {
+        const restored = await journey.action(`${control.kind}.select`, [
+          '--target-url', projectUrl,
+          control.option, control.original,
+        ])
+        assert.equal(responseResult(restored.payload, `${control.kind}.select`)?.selectedLabel, control.original)
+        await restored.close()
+      } catch (error) {
+        if (primaryError === undefined) throw error
       }
     }
   }
 }
 
-function runJson(args) {
-  const result = runCli(args)
-  assert.equal(result.status, 0, summarizeProcess(result))
-  return JSON.parse(result.stdout)
+async function projectChoice(provider, journey, targetUrl, kind) {
+  const inspectAction = `${kind}.inspect`
+  const inspected = await journey.action(inspectAction, ['--target-url', targetUrl])
+  const result = responseResult(inspected.payload, inspectAction)
+  assert.equal(result?.supported, true)
+  const selected = result.choices.find((choice) => choice.selected && choice.enabled)
+  const alternate = result.choices.find((choice) => !choice.selected && choice.enabled)
+  assert.ok(selected, `${provider} Project must expose the selected ${kind}`)
+  assert.ok(alternate, `${provider} Project must expose an alternate ${kind}`)
+  await inspected.close()
+  return {
+    kind,
+    option: kind === 'model' ? '--model' : '--effort',
+    original: selected.label,
+    alternate: alternate.label,
+  }
+}
+
+function createProviderJourney(session, provider) {
+  const journey = {
+    session,
+    provider,
+    taskId: markerFor(provider, 'JOURNEY_TASK'),
+    targetId: null,
+    authenticated: false,
+    skipReason: null,
+  }
+  journey.action = (visibleAction, args = [], timeoutMs = 120_000, observeAfterRelease) => (
+    action(journey, visibleAction, args, timeoutMs, observeAfterRelease)
+  )
+  journey.run = (args, timeoutMs = 300_000, observeAfterRelease) => (
+    cliRun(journey, args, timeoutMs, observeAfterRelease)
+  )
+  return journey
 }
 
-function runCli(args) {
-  return spawnSync(process.execPath, [cliEntry, ...args], {
-    cwd: root,
-    env: { ...process.env, TOKENLESS_PROVIDER: '' },
-    encoding: 'utf8',
-    timeout: 300000,
+async function action(journey, visibleAction, args = [], timeoutMs = 120_000, observeAfterRelease) {
+  assert.equal(args.includes('--task-id'), false, 'provider journey owns the stable task id')
+  const operation = await journey.session.startCli([
+    'provider-action',
+    '--provider', journey.provider,
+    '--task-id', journey.taskId,
+    '--action', visibleAction,
+    ...args,
+    '--browser-visibility', 'headed',
+    '--timeout-ms', String(timeoutMs),
+  ], {
+    beforeRelease: ({ waiting, page }) => {
+      assertJourneyPage(journey, waiting, page)
+    },
+    observeAfterRelease,
   })
+  try {
+    const result = await operation.wait()
+    assertDurableSuccess(result.payload, journey.provider)
+    return { ...operation, ...result }
+  } catch (error) {
+    await operation.close()
+    throw error
+  }
 }
 
-function findResponseResult(payload, action) {
-  const responses = payload?.result?.result?.responses ?? payload?.result?.responses ?? payload?.latest?.result?.value?.responses
-  if (!Array.isArray(responses)) return null
-  return [...responses].reverse().find((response) => response?.ok === true && response.action === action)?.result ?? null
+async function cliRun(journey, args, timeoutMs = 300_000, observeAfterRelease) {
+  assert.equal(args.includes('--task-id'), false, 'provider journey owns the stable task id')
+  recordSubmissionAttempt(journey)
+  const operation = await journey.session.startCli([
+    'run',
+    '--provider', journey.provider,
+    '--task-id', journey.taskId,
+    ...args,
+    '--browser-visibility', 'headed',
+    '--timeout-ms', String(timeoutMs),
+  ], {
+    beforeRelease: ({ waiting, page }) => {
+      assertJourneyPage(journey, waiting, page)
+    },
+    observeAfterRelease,
+  })
+  try {
+    const result = await operation.wait()
+    assertDurableSuccess(result.payload, journey.provider)
+    return { ...operation, ...result }
+  } catch (error) {
+    await operation.close()
+    throw error
+  }
 }
 
-function selectedChoice(result) {
-  return result?.supported === true && Array.isArray(result.choices)
-    ? result.choices.find((choice) => choice.selected && choice.enabled) ?? null
-    : null
+function assertJourneyPage(journey, waiting, page) {
+  assert.equal(waiting.provider, journey.provider)
+  assert.equal(canonicalPageUrl(waiting.url), canonicalPageUrl(page.url()))
+  if (journey.targetId === null) journey.targetId = waiting.targetId
+  assert.equal(
+    waiting.targetId,
+    journey.targetId,
+    `${journey.provider} capability journey must stay on one exact Chromium page target`,
+  )
 }
 
-function alternateChoice(result) {
-  return result?.supported === true && Array.isArray(result.choices)
-    ? result.choices.find((choice) => !choice.selected && choice.enabled) ?? null
-    : null
+function recordSubmissionAttempt(journey) {
+  const tracker = submissionTrackers.get(journey)
+  assert.ok(tracker, 'live E2E submission tracker must be initialized')
+  tracker.attempts += 1
+  assert.ok(
+    tracker.attempts <= tracker.budget,
+    `${tracker.caseId} exceeded its provider submission budget of ${tracker.budget}`,
+  )
 }
 
-function inspectSummary(result) {
-  if (!result) return { available: false }
-  if (result.supported === false) return { supported: false, reason: result.reason }
-  return {
-    supported: true,
-    choices: Array.isArray(result.choices)
-      ? result.choices.map((choice) => ({ label: choice.label, selected: Boolean(choice.selected), enabled: Boolean(choice.enabled) }))
-      : [],
-  }
+function assertSubmissionBudget(journey) {
+  const tracker = submissionTrackers.get(journey)
+  assert.ok(tracker, 'live E2E submission tracker must be initialized')
+  assert.equal(
+    tracker.attempts,
+    tracker.budget,
+    `${tracker.caseId} must use exactly ${tracker.budget} provider submissions`,
+  )
 }
 
-function boundedResult(result) {
-  if (!result || typeof result !== 'object') return result
-  return JSON.parse(JSON.stringify(result, (key, value) => {
-    if (typeof value === 'string' && value.length > 240) return `${value.slice(0, 240)}...[truncated]`
-    return value
-  }))
+function assertDurableSuccess(payload, provider) {
+  assert.equal(payload?.ok, true)
+  if (payload?.status === 'waiting_for_user' || payload?.waitingForUser === true) {
+    const knownIssueSkip = knownIssueSkipForDurableBlocker(matrix, provider, payload)
+    if (knownIssueSkip) {
+      assertDurableWaitingForUser(payload, provider, knownIssueSkip.blockerCode)
+      throw e2eSkip(
+        'e2e_known_issue_provider_blocker',
+        `${provider} known issue ${knownIssueSkip.reason}: ${knownIssueSkip.blockerCode}`,
+      )
+    }
+    const blockerCode = structuredBlockerCodes(payload?.blocker)[0] ?? 'provider_user_handover_required'
+    throw e2eFailure(
+      'e2e_provider_prerequisite_unavailable',
+      `provider job requires user action: ${blockerCode}`,
+    )
+  }
+  assert.equal(payload?.status, 'succeeded')
+  const jobId = payload.jobId
+  assert.equal(typeof jobId, 'string')
+  const database = new DatabaseSync(path.join(homeDir, 'tokenless.sqlite3'), { readOnly: true })
+  try {
+    const row = database.prepare(
+      'SELECT status, result_json, error_json FROM jobs WHERE job_id = ?',
+    ).get(jobId)
+    assert.equal(row?.status, 'succeeded')
+    assert.equal(typeof row?.result_json, 'string')
+    assert.equal(row?.error_json, null)
+  } finally {
+    database.close()
+  }
 }
 
-function resolveManagedProfile({ homeDir, profileSlug }) {
-  assert.equal(fsSync.existsSync(homeDir), true, `${homeDir} must already exist`)
-  const payload = runJson(['profiles', 'list', '--home', homeDir, '--json'])
-  const profile = payload.profiles?.find((candidate) => candidate.slug === profileSlug)
-  assert.ok(profile, `${profileSlug} must be registered in ${homeDir}`)
-  assert.equal(profile.lifecycle, 'ready', `${profileSlug} must be ready before the live suite starts`)
-  assert.equal(Boolean(profile.import?.profileDirectoryKey), true, `${profileSlug} must be a user-imported managed profile`)
-  return {
-    slug: profile.slug,
-    id: profile.id,
-    lifecycle: profile.lifecycle,
-    isDefault: profile.isDefault,
-    imported: Boolean(profile.import?.profileDirectoryKey),
+function assertDurableWaitingForUser(payload, provider, blockerCode) {
+  const jobId = payload.jobId
+  assert.equal(typeof jobId, 'string')
+  const database = new DatabaseSync(path.join(homeDir, 'tokenless.sqlite3'), { readOnly: true })
+  try {
+    const row = database.prepare(
+      'SELECT provider, status, blocker_json, error_json FROM jobs WHERE job_id = ?',
+    ).get(jobId)
+    assert.equal(row?.provider, provider)
+    assert.equal(row?.status, 'waiting_for_user')
+    assert.equal(row?.error_json, null)
+    const durableBlocker = typeof row?.blocker_json === 'string'
+      ? JSON.parse(row.blocker_json)
+      : null
+    assert.equal(
+      structuredBlockerCodes(durableBlocker).includes(blockerCode),
+      true,
+      `durable blocker must include ${blockerCode}`,
+    )
+  } finally {
+    database.close()
   }
 }
 
-async function markerUploadFile(provider, marker) {
-  const inputDir = path.join(root, 'test-results', 'live-managed-playwright-inputs')
-  await fs.mkdir(inputDir, { recursive: true, mode: 0o700 })
-  const file = path.join(inputDir, `${provider}-${Date.now()}-marker.txt`)
-  await fs.writeFile(file, `${marker}\n`, { mode: 0o600 })
-  return file
+function responseResult(payload, actionName) {
+  const responses = payload?.result?.result?.responses ??
+    payload?.result?.responses ??
+    payload?.latest?.result?.value?.responses
+  if (!Array.isArray(responses)) return null
+  return [...responses].reverse().find((response) => response?.ok === true && response.action === actionName)?.result ?? null
 }
 
-function attemptPromptClearCleanup({ provider, homeDir, profileSlug }) {
-  const cleanup = {
-    attempted: true,
-    succeeded: false,
-  }
+function assertConversationWorkspaceResult(provider, taskId, run) {
+  const result = responseResult(run.payload, 'workspace.ensure')
+  assert.equal(result?.mode, 'conversation')
+  assert.equal(result?.resource?.kind, 'conversation')
+  assert.equal(result?.resource?.native, false)
+  assert.equal(result?.resource?.disposition, 'fallback')
+  const conversationUrl = canonicalPageUrl(run.page.url())
+  const database = new DatabaseSync(path.join(homeDir, 'tokenless.sqlite3'), { readOnly: true })
   try {
-    const result = runCli([
-      'provider-action',
-      '--profile', profileSlug,
-      '--provider', provider,
-      '--action', 'prompt.clear',
-      '--home', homeDir,
-      '--timeout-ms', '90000',
-      '--json',
-    ])
-    cleanup.status = result.status
-    cleanup.stdoutBytes = Buffer.byteLength(result.stdout ?? '', 'utf8')
-    cleanup.stderrBytes = Buffer.byteLength(result.stderr ?? '', 'utf8')
-    if (result.status !== 0) return cleanup
-    const clearResult = findResponseResult(JSON.parse(result.stdout), 'prompt.clear')
-    cleanup.succeeded = clearResult?.visible === true && clearResult?.inputProof === 'empty'
-    cleanup.result = clearResult
-      ? { visible: clearResult.visible, inputProof: clearResult.inputProof }
-      : { visible: false, inputProof: 'missing' }
-    return cleanup
-  } catch (error) {
-    cleanup.error = boundedError(error)
-    return cleanup
+    const mapping = database.prepare(
+      `SELECT canonical_url
+       FROM provider_task_conversations
+       WHERE provider = ? AND profile_id = ? AND task_id = ?`,
+    ).get(provider, result.scope.profileId, taskId)
+    assert.equal(typeof mapping?.canonical_url, 'string', `${provider} must persist the conversation Workspace mapping`)
+    assert.equal(canonicalPageUrl(mapping?.canonical_url), conversationUrl)
+  } finally {
+    database.close()
   }
+  return conversationUrl
 }
 
-async function removeGeneratedUploadFile(file) {
-  const cleanup = {
-    attempted: true,
-    succeeded: false,
-  }
+function assertTaskConversationMapping(provider, taskId, expectedUrl, payload) {
+  const database = new DatabaseSync(path.join(homeDir, 'tokenless.sqlite3'), { readOnly: true })
   try {
-    await fs.unlink(file)
-    cleanup.succeeded = true
-  } catch (error) {
-    cleanup.error = boundedError(error)
+    const job = database.prepare('SELECT profile_id FROM jobs WHERE job_id = ?').get(payload?.jobId)
+    assert.equal(typeof job?.profile_id, 'string')
+    const mapping = database.prepare(
+      `SELECT canonical_url
+       FROM provider_task_conversations
+       WHERE provider = ? AND profile_id = ? AND task_id = ?`,
+    ).get(provider, job.profile_id, taskId)
+    assert.equal(typeof mapping?.canonical_url, 'string', `${provider} must persist the continuation mapping`)
+    assert.equal(canonicalPageUrl(mapping.canonical_url), expectedUrl)
+  } finally {
+    database.close()
   }
-  return cleanup
 }
 
-function sha256String(value) {
-  return createHash('sha256').update(value).digest('hex')
+async function composerContains(page, marker) {
+  const fields = page.locator('textarea, [contenteditable="true"]')
+  for (let index = 0; index < await fields.count(); index += 1) {
+    const field = fields.nth(index)
+    if (!await field.isVisible({ timeout: 100 }).catch(() => false)) continue
+    const value = await field.evaluate((element) => (
+      element instanceof HTMLTextAreaElement || element instanceof HTMLInputElement
+        ? element.value
+        : element.textContent ?? ''
+    ))
+    if (value.includes(marker)) return true
+  }
+  return false
 }
 
-async function createArtifactDir() {
-  const dir = path.join(root, 'test-results', 'live-managed-playwright', new Date().toISOString().replace(/[:.]/g, '-'))
-  await fs.mkdir(dir, { recursive: true, mode: 0o700 })
-  return dir
+async function exactTextVisible(page, value) {
+  const locator = page.getByText(value, { exact: true })
+  for (let index = 0; index < await locator.count(); index += 1) {
+    if (await locator.nth(index).isVisible({ timeout: 100 }).catch(() => false)) return true
+  }
+  return false
 }
 
-async function writeArtifact(dir, name, value) {
-  await fs.writeFile(path.join(dir, name), `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 })
+async function waitForExactText(page, value, timeoutMs) {
+  const deadline = Date.now() + timeoutMs
+  while (Date.now() <= deadline) {
+    if (await exactTextVisible(page, value)) return true
+    await new Promise((resolve) => setTimeout(resolve, 100))
+  }
+  return false
 }
 
-function summarizeProcess(result) {
-  return JSON.stringify({
-    status: result.status,
-    stdout: truncate(result.stdout),
-    stderr: truncate(result.stderr),
-  }, null, 2)
+async function pageContains(page, value, minimumVisibleMatches = 1) {
+  const matches = page.getByText(new RegExp(escapeRegExp(value)))
+  let visible = 0
+  for (let index = 0; index < await matches.count(); index += 1) {
+    if (await matches.nth(index).isVisible({ timeout: 100 }).catch(() => false)) visible += 1
+    if (visible >= minimumVisibleMatches) return true
+  }
+  return false
 }
 
-function truncate(value) {
-  return typeof value === 'string' && value.length > 2000 ? `${value.slice(0, 2000)}...[truncated]` : value
+async function visibleCitationCount(page, citations) {
+  const expected = new Set(citations.map((citation) => canonicalPageUrl(citation.href)))
+  const controls = page.locator('main a[href]')
+  let count = 0
+  for (let index = 0; index < await controls.count(); index += 1) {
+    const control = controls.nth(index)
+    const href = await control.getAttribute('href').catch(() => null)
+    if (!href) continue
+    const canonical = canonicalPageUrl(new URL(href, page.url()).toString())
+    if (expected.has(canonical) && await control.isVisible({ timeout: 100 }).catch(() => false)) count += 1
+  }
+  return count
 }
 
-function boundedError(error) {
-  return {
-    name: error?.name ?? 'Error',
-    code: typeof error?.code === 'string' ? error.code.slice(0, 64) : 'unknown_error',
+async function freePort() {
+  const server = net.createServer()
+  await new Promise((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(0, '127.0.0.1', resolve)
+  })
+  const address = server.address()
+  assert.ok(address && typeof address !== 'string')
+  await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()))
+  return address.port
+}
+
+function requiredGate() {
+  const value = requiredEnv('TOKENLESS_LIVE_E2E_GATE')
+  if (!['all', 'non_submission', 'mutation', 'project'].includes(value)) {
+    throw e2eFailure('e2e_gate_invalid', 'TOKENLESS_LIVE_E2E_GATE must be all, non_submission, mutation, or project')
   }
+  return value
 }
 
-function attachProviderEvidence(error, entry) {
-  if (error && (typeof error === 'object' || typeof error === 'function')) {
-    error.providerEvidence = entry
+function optionalConnectionMode(value) {
+  const connectionMode = value ?? 'playwright'
+  if (connectionMode !== 'playwright' && connectionMode !== 'cdp') {
+    throw e2eFailure(
+      'e2e_browser_connection_mode_invalid',
+      'TOKENLESS_LIVE_BROWSER_CONNECTION_MODE must be playwright or cdp',
+    )
   }
+  return connectionMode
 }
 
-async function runtimeVersions() {
-  const versions = {
-    chrome: null,
-    playwrightCore: null,
+function optionalProviderFilter(value) {
+  const provider = value?.trim()
+  if (!provider) return null
+  if (!Object.hasOwn(matrix.providers, provider)) {
+    throw e2eFailure(
+      'e2e_provider_filter_invalid',
+      `TOKENLESS_LIVE_E2E_PROVIDER must name a provider declared in the live capability matrix: ${provider}`,
+    )
   }
-  try {
-    versions.playwrightCore = JSON.parse(await fs.readFile(path.join(root, 'node_modules', 'playwright-core', 'package.json'), 'utf8')).version
-  } catch {}
-  const chrome = spawnSync('/Applications/Google Chrome.app/Contents/MacOS/Google Chrome', ['--version'], { encoding: 'utf8' })
-  if (chrome.status === 0) versions.chrome = chrome.stdout.trim()
-  return versions
+  return provider
 }
 
 function requiredEnv(name) {
-  const value = process.env[name]
-  if (!value) throw new Error(`${name} is required`)
+  const value = process.env[name]?.trim()
+  if (!value) {
+    throw e2eFailure(
+      'e2e_activation_missing',
+      `${name} is required; only declared durable provider known issues may skip`,
+    )
+  }
   return value
 }
+
+function markerFor(provider, kind) {
+  return `TOKENLESS_E2E_${kind}_${provider}_${suiteRunMarker}_${randomUUID().slice(0, 8)}`
+}
+
+function compactTimestamp(value) {
+  return value.toISOString().replace(/[-:]/gu, '').replace(/\.\d{3}Z$/u, 'Z')
+}
+
+function canonicalPageUrl(value) {
+  const parsed = new URL(value)
+  parsed.search = ''
+  parsed.hash = ''
+  return parsed.toString()
+}
+
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&')
+}
+
+function e2eFailure(code, message) {
+  return Object.assign(new Error(`${code}: ${message}`), { code })
+}
+
+function e2eSkip(code, message) {
+  return Object.assign(new Error(`${code}: ${message}`), { code })
+}
+
+function isKnownIssueSkip(error) {
+  return error?.code === 'e2e_known_issue_provider_blocker'
+}
diff --git a/test/live-provider-capability-matrix.json b/test/live-provider-capability-matrix.json
new file mode 100644
index 0000000..466c69c
--- /dev/null
+++ b/test/live-provider-capability-matrix.json
@@ -0,0 +1,478 @@
+{
+  "schema": "tokenless.live-provider-capability-matrix.v1",
+  "connectionModes": [
+    "playwright",
+    "cdp"
+  ],
+  "journey": {
+    "scope": "provider_connection_mode",
+    "pagePolicy": "one_managed_page",
+    "caseOrder": "providers.required",
+    "identityProof": [
+      "stable_task_id",
+      "stable_chromium_target_id"
+    ]
+  },
+  "knownIssueSkips": [
+    {
+      "provider": "claude",
+      "reason": "claude_recurring_cloudflare_human_check",
+      "blockerCodes": [
+        "visible_cloudflare_turnstile",
+        "visible_cloudflare_interstitial"
+      ]
+    }
+  ],
+  "cases": {
+    "session-readiness": {
+      "gate": "non_submission",
+      "submissions": 0,
+      "actions": [
+        "auth.status",
+        "capability.inspect",
+        "navigation.check",
+        "blocker.check"
+      ],
+      "closure": [
+        "cli",
+        "visible_dom",
+        "durable_state"
+      ]
+    },
+    "prompt-draft": {
+      "gate": "non_submission",
+      "submissions": 0,
+      "actions": [
+        "prompt.input",
+        "prompt.clear"
+      ],
+      "closure": [
+        "cli",
+        "visible_dom",
+        "durable_state"
+      ]
+    },
+    "model-choice": {
+      "gate": "non_submission",
+      "submissions": 0,
+      "actions": [
+        "model.inspect",
+        "model.select"
+      ],
+      "closure": [
+        "cli",
+        "visible_dom",
+        "durable_state",
+        "restore_original"
+      ]
+    },
+    "effort-choice": {
+      "gate": "non_submission",
+      "submissions": 0,
+      "actions": [
+        "effort.inspect",
+        "effort.select"
+      ],
+      "closure": [
+        "cli",
+        "visible_dom",
+        "durable_state",
+        "restore_original"
+      ]
+    },
+    "deepseek-controls": {
+      "gate": "non_submission",
+      "submissions": 0,
+      "actions": [
+        "deepseek.mode.inspect",
+        "deepseek.mode.select",
+        "deepseek.deepthink.inspect",
+        "deepseek.deepthink.select",
+        "deepseek.search.inspect",
+        "deepseek.search.select"
+      ],
+      "closure": [
+        "cli",
+        "visible_dom",
+        "durable_state",
+        "restore_original"
+      ]
+    },
+    "deepseek-search-reasoning": {
+      "gate": "mutation",
+      "submissions": 2,
+      "actions": [
+        "deepseek.mode.inspect",
+        "deepseek.mode.select",
+        "deepseek.deepthink.inspect",
+        "deepseek.deepthink.select",
+        "deepseek.search.inspect",
+        "deepseek.search.select",
+        "prompt.input",
+        "prompt.submit",
+        "response.read"
+      ],
+      "closure": [
+        "cli",
+        "visible_dom",
+        "visible_submission",
+        "visible_response",
+        "visible_citation",
+        "durable_state",
+        "restore_original"
+      ]
+    },
+    "deepseek-vision-input": {
+      "gate": "mutation",
+      "submissions": 1,
+      "actions": [
+        "deepseek.mode.inspect",
+        "deepseek.mode.select",
+        "deepseek.deepthink.inspect",
+        "deepseek.deepthink.select",
+        "file.upload",
+        "prompt.input",
+        "prompt.submit",
+        "response.read"
+      ],
+      "closure": [
+        "cli",
+        "visible_dom",
+        "visible_attachment",
+        "visible_submission",
+        "visible_response",
+        "durable_state",
+        "restore_original"
+      ]
+    },
+    "file-selection": {
+      "gate": "non_submission",
+      "submissions": 0,
+      "actions": [
+        "file.upload",
+        "prompt.clear"
+      ],
+      "closure": [
+        "cli",
+        "visible_dom",
+        "visible_attachment",
+        "durable_state"
+      ]
+    },
+    "conversation-workflow": {
+      "gate": "mutation",
+      "submissions": 2,
+      "actions": [
+        "workspace.ensure",
+        "file.upload",
+        "prompt.input",
+        "prompt.submit",
+        "response.read"
+      ],
+      "closure": [
+        "cli",
+        "conversation_fallback",
+        "visible_attachment",
+        "visible_submission",
+        "visible_response",
+        "visible_citation",
+        "two_cli_processes",
+        "same_conversation",
+        "visible_two_turns",
+        "durable_mapping"
+      ]
+    },
+    "workspace-response-citations": {
+      "gate": "mutation",
+      "submissions": 1,
+      "actions": [
+        "workspace.ensure",
+        "prompt.input",
+        "prompt.submit",
+        "response.read"
+      ],
+      "closure": [
+        "cli",
+        "conversation_fallback",
+        "visible_submission",
+        "visible_response",
+        "visible_citation",
+        "durable_mapping"
+      ]
+    },
+    "workspace-response-baseline": {
+      "gate": "mutation",
+      "submissions": 1,
+      "actions": [
+        "workspace.ensure",
+        "prompt.input",
+        "prompt.submit",
+        "response.read"
+      ],
+      "closure": [
+        "cli",
+        "conversation_fallback",
+        "visible_submission",
+        "visible_response",
+        "durable_mapping"
+      ]
+    },
+    "qwen-mode-workspace": {
+      "gate": "mutation",
+      "submissions": 1,
+      "actions": [
+        "qwen.mode.inspect",
+        "qwen.mode.select",
+        "workspace.ensure",
+        "prompt.input",
+        "prompt.submit",
+        "response.read"
+      ],
+      "closure": [
+        "cli",
+        "visible_dom",
+        "conversation_fallback",
+        "visible_submission",
+        "visible_response",
+        "durable_mapping",
+        "restore_original"
+      ]
+    },
+    "doubao-controls": {
+      "gate": "non_submission",
+      "submissions": 0,
+      "actions": [
+        "doubao.mode.inspect",
+        "doubao.mode.select",
+        "doubao.skill.inspect",
+        "doubao.skill.select"
+      ],
+      "closure": [
+        "cli",
+        "visible_dom",
+        "durable_state",
+        "restore_original"
+      ]
+    },
+    "native-project": {
+      "gate": "project",
+      "submissions": 2,
+      "actions": [
+        "workspace.ensure",
+        "file.upload",
+        "prompt.input",
+        "prompt.submit",
+        "response.read"
+      ],
+      "closure": [
+        "created_then_reused",
+        "project_identity",
+        "project_instructions",
+        "visible_attachment",
+        "visible_two_turns",
+        "durable_project_mapping",
+        "durable_conversation_mapping"
+      ]
+    }
+  },
+  "providers": {
+    "chatgpt": {
+      "stage": "supported",
+      "account": "signed_in_selected_setup_profile",
+      "required": [
+        "session-readiness",
+        "prompt-draft",
+        "file-selection",
+        "conversation-workflow"
+      ],
+      "unavailable": {
+        "model-choice": "no_visible_model_control_observed_2026_07_28",
+        "effort-choice": "no_visible_effort_control_observed_2026_07_28",
+        "deepseek-controls": "provider_specific_capability",
+        "deepseek-search-reasoning": "provider_specific_capability",
+        "deepseek-vision-input": "provider_specific_capability",
+        "workspace-response-citations": "covered_by_conversation_workflow",
+        "workspace-response-baseline": "covered_by_conversation_workflow",
+        "qwen-mode-workspace": "provider_specific_capability",
+        "doubao-controls": "provider_specific_capability",
+        "native-project": "native_project_not_yet_proven"
+      }
+    },
+    "claude": {
+      "stage": "supported",
+      "account": "signed_in_selected_setup_profile",
+      "required": [
+        "session-readiness",
+        "prompt-draft",
+        "model-choice",
+        "file-selection",
+        "conversation-workflow",
+        "native-project"
+      ],
+      "unavailable": {
+        "effort-choice": "no_independent_effort_control_declared",
+        "deepseek-controls": "provider_specific_capability",
+        "deepseek-search-reasoning": "provider_specific_capability",
+        "deepseek-vision-input": "provider_specific_capability",
+        "workspace-response-citations": "covered_by_conversation_workflow",
+        "workspace-response-baseline": "covered_by_conversation_workflow",
+        "qwen-mode-workspace": "provider_specific_capability",
+        "doubao-controls": "provider_specific_capability"
+      }
+    },
+    "gemini": {
+      "stage": "supported",
+      "account": "guest_or_signed_in_selected_setup_profile",
+      "required": [
+        "session-readiness",
+        "prompt-draft",
+        "workspace-response-citations"
+      ],
+      "unavailable": {
+        "model-choice": "no_enabled_alternate_model_in_selected_guest_profile",
+        "effort-choice": "no_independent_effort_control_declared",
+        "deepseek-controls": "provider_specific_capability",
+        "deepseek-search-reasoning": "provider_specific_capability",
+        "deepseek-vision-input": "provider_specific_capability",
+        "file-selection": "no_visible_upload_control_in_selected_guest_profile_2026_07_28",
+        "conversation-workflow": "no_upload_or_continuation_closure_in_selected_guest_profile",
+        "workspace-response-baseline": "covered_by_workspace_response_citations",
+        "qwen-mode-workspace": "provider_specific_capability",
+        "doubao-controls": "provider_specific_capability",
+        "native-project": "native_project_not_yet_proven"
+      }
+    },
+    "grok": {
+      "stage": "supported",
+      "account": "signed_in_selected_setup_profile",
+      "required": [
+        "session-readiness",
+        "prompt-draft",
+        "model-choice",
+        "effort-choice",
+        "file-selection",
+        "conversation-workflow",
+        "native-project"
+      ],
+      "unavailable": {
+        "deepseek-controls": "provider_specific_capability",
+        "deepseek-search-reasoning": "provider_specific_capability",
+        "deepseek-vision-input": "provider_specific_capability",
+        "workspace-response-citations": "covered_by_conversation_workflow",
+        "workspace-response-baseline": "covered_by_conversation_workflow",
+        "qwen-mode-workspace": "provider_specific_capability",
+        "doubao-controls": "provider_specific_capability"
+      }
+    },
+    "qwen": {
+      "stage": "experimental",
+      "account": "guest_or_signed_in_selected_setup_profile",
+      "required": [
+        "session-readiness",
+        "prompt-draft",
+        "effort-choice",
+        "qwen-mode-workspace"
+      ],
+      "unavailable": {
+        "deepseek-controls": "provider_specific_capability",
+        "deepseek-search-reasoning": "provider_specific_capability",
+        "deepseek-vision-input": "provider_specific_capability",
+        "model-choice": "no_real_selection_closure",
+        "file-selection": "no_real_visible_attachment_closure",
+        "conversation-workflow": "no_real_attachment_or_continuation_closure",
+        "workspace-response-citations": "covered_by_qwen_mode_workspace",
+        "workspace-response-baseline": "covered_by_qwen_mode_workspace",
+        "doubao-controls": "provider_specific_capability",
+        "native-project": "native_project_not_proven"
+      }
+    },
+    "deepseek": {
+      "stage": "experimental",
+      "account": "signed_in_selected_setup_profile",
+      "required": [
+        "session-readiness",
+        "prompt-draft",
+        "deepseek-controls",
+        "file-selection",
+        "deepseek-search-reasoning",
+        "deepseek-vision-input",
+        "conversation-workflow"
+      ],
+      "unavailable": {
+        "model-choice": "no_real_selection_closure",
+        "effort-choice": "no_independent_effort_control_declared",
+        "workspace-response-citations": "covered_by_conversation_workflow",
+        "workspace-response-baseline": "covered_by_conversation_workflow",
+        "qwen-mode-workspace": "provider_specific_capability",
+        "doubao-controls": "provider_specific_capability",
+        "native-project": "native_project_not_observed"
+      }
+    },
+    "perplexity": {
+      "stage": "experimental",
+      "account": "guest_or_signed_in_selected_setup_profile",
+      "required": [
+        "session-readiness",
+        "prompt-draft",
+        "workspace-response-citations"
+      ],
+      "unavailable": {
+        "model-choice": "no_real_selection_closure",
+        "effort-choice": "no_independent_effort_control_declared",
+        "deepseek-controls": "provider_specific_capability",
+        "deepseek-search-reasoning": "provider_specific_capability",
+        "deepseek-vision-input": "provider_specific_capability",
+        "file-selection": "no_real_visible_attachment_closure",
+        "conversation-workflow": "no_real_attachment_or_continuation_closure",
+        "workspace-response-baseline": "covered_by_workspace_response_citations",
+        "qwen-mode-workspace": "provider_specific_capability",
+        "doubao-controls": "provider_specific_capability",
+        "native-project": "native_space_not_proven"
+      }
+    },
+    "zai": {
+      "stage": "experimental",
+      "account": "guest_or_signed_in_selected_setup_profile",
+      "required": [
+        "session-readiness",
+        "prompt-draft",
+        "workspace-response-baseline"
+      ],
+      "unavailable": {
+        "model-choice": "no_real_selection_closure",
+        "effort-choice": "no_real_selection_closure",
+        "deepseek-controls": "provider_specific_capability",
+        "deepseek-search-reasoning": "provider_specific_capability",
+        "deepseek-vision-input": "provider_specific_capability",
+        "file-selection": "no_real_visible_attachment_closure",
+        "conversation-workflow": "no_real_attachment_or_continuation_closure",
+        "workspace-response-citations": "no_real_visible_citation_closure",
+        "qwen-mode-workspace": "provider_specific_capability",
+        "doubao-controls": "provider_specific_capability",
+        "native-project": "native_project_not_observed"
+      }
+    },
+    "doubao": {
+      "stage": "experimental",
+      "account": "signed_in_selected_setup_profile",
+      "required": [
+        "session-readiness",
+        "prompt-draft",
+        "file-selection",
+        "doubao-controls",
+        "workspace-response-baseline"
+      ],
+      "unavailable": {
+        "model-choice": "no_real_selection_closure",
+        "effort-choice": "no_real_selection_closure",
+        "deepseek-controls": "provider_specific_capability",
+        "deepseek-search-reasoning": "provider_specific_capability",
+        "deepseek-vision-input": "provider_specific_capability",
+        "conversation-workflow": "no_real_attachment_or_continuation_closure",
+        "workspace-response-citations": "no_real_visible_citation_closure",
+        "qwen-mode-workspace": "provider_specific_capability",
+        "native-project": "native_project_not_observed"
+      }
+    }
+  }
+}
diff --git a/test/live-provider-fallback.e2e.mjs b/test/live-provider-fallback.e2e.mjs
new file mode 100644
index 0000000..25a6034
--- /dev/null
+++ b/test/live-provider-fallback.e2e.mjs
@@ -0,0 +1,300 @@
+import assert from 'node:assert/strict'
+import { randomUUID } from 'node:crypto'
+import { spawnSync } from 'node:child_process'
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import test from 'node:test'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+
+import { createLiveBrowserInspectionSession } from './helpers/live-browser-observer.mjs'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const cliDir = path.join(root, 'packages/cli')
+const cliEntry = path.join(cliDir, 'dist/src/tokenless.mjs')
+const cliIndex = pathToFileURL(path.join(cliDir, 'dist/src/index.js')).href
+const playwrightIndex = pathToFileURL(path.join(cliDir, 'dist/src/playwright/index.js')).href
+const homeDir = path.resolve(requiredEnv('TOKENLESS_LIVE_MANAGED_PLAYWRIGHT_HOME'))
+const profileSlug = requiredEnv('TOKENLESS_LIVE_MANAGED_PLAYWRIGHT_PROFILE')
+const daemonUrl = requiredEnv('TOKENLESS_LIVE_MANAGED_PLAYWRIGHT_DAEMON_URL')
+const primaryProvider = requiredEnv('TOKENLESS_LIVE_FALLBACK_PRIMARY')
+const fallbackProvider = requiredEnv('TOKENLESS_LIVE_FALLBACK_PROVIDER')
+const gate = requiredEnv('TOKENLESS_LIVE_FALLBACK_E2E_GATE')
+
+assert.equal(gate, 'real-provider-fallback', 'TOKENLESS_LIVE_FALLBACK_E2E_GATE must be real-provider-fallback')
+assert.notEqual(primaryProvider, fallbackProvider, 'fallback provider must differ from the primary provider')
+
+let runtime
+let inspection
+let restoreInspectionEnvironment
+let liveAttachmentPath
+let fallbackUploadControls
+
+test.after(async () => {
+  if (runtime) {
+    await runtime.stopDaemon({ homeDir, daemonUrl, timeoutMs: 60_000 }).catch(() => undefined)
+  }
+  await inspection?.close().catch(() => undefined)
+  if (liveAttachmentPath) await fs.rm(liveAttachmentPath, { force: true }).catch(() => undefined)
+  restoreInspectionEnvironment?.()
+})
+
+test('real visible provider blocker falls back under one durable job', { timeout: 600_000 }, async () => {
+  inspection = await createLiveBrowserInspectionSession({
+    homeDir,
+    profileSlug,
+    daemonUrl,
+    observerTimeoutMs: 120_000,
+  })
+  restoreInspectionEnvironment = installInspectionEnvironment(inspection.environment)
+  runtime = await import(cliIndex)
+  const playwright = await import(playwrightIndex)
+  const profile = await new playwright.ManagedProfileRegistry(homeDir).resolveProfile(profileSlug)
+  const primaryRoute = requiredRoute(playwright, primaryProvider)
+  const fallbackRoute = requiredRoute(playwright, fallbackProvider)
+  const primary = requiredProvider(playwright, primaryProvider)
+  const fallback = requiredProvider(playwright, fallbackProvider)
+  const marker = `TOKENLESS_E2E_PROVIDER_FALLBACK_${new Date().toISOString().replace(/\W/gu, '')}_${randomUUID().slice(0, 8)}`
+  const taskId = `provider-fallback:${marker}`
+  const jobId = inspection.createJobId()
+  const attachmentName = `tokenless-fallback-input-${randomUUID().slice(0, 8)}.txt`
+  const attachmentPath = path.join(root, 'test-results', 'live-provider-inputs', attachmentName)
+  liveAttachmentPath = attachmentPath
+  await fs.mkdir(path.dirname(attachmentPath), { recursive: true, mode: 0o700 })
+  await fs.writeFile(attachmentPath, `${marker}\n`, { mode: 0o600 })
+  const attachments = await runtime.stageVisibleAttachments({
+    homeDir,
+    bundleId: jobId,
+    files: [{ sourcePath: attachmentPath, type: 'text/plain' }],
+  })
+  const request = playwright.createManagedPlaywrightJobRequest({
+    provider: primary.id,
+    target: { kind: 'provider_home', url: primary.descriptor.navigation.homeUrl },
+    taskId,
+    capabilityRoute: primaryRoute,
+    fallback: {
+      protocol: 'tokenless.provider-fallback.v1',
+      mode: 'automatic',
+      replay: 'from_start',
+      alternatives: [{
+        provider: fallback.id,
+        target: { kind: 'provider_home', url: fallback.descriptor.navigation.homeUrl },
+        capabilityRoute: fallbackRoute,
+      }],
+    },
+    browserVisibility: 'headed',
+    actions: [
+      {
+        requestId: `${jobId}:files`,
+        action: playwright.VISIBLE_ACTIONS.FILE_UPLOAD,
+        payload: { attachments },
+      },
+      {
+        requestId: `${jobId}:prompt`,
+        action: playwright.VISIBLE_ACTIONS.PROMPT_INPUT,
+        payload: { text: 'Read the attached text file, then reply with exactly the single marker written inside it and no other text.' },
+      },
+      {
+        requestId: `${jobId}:submit`,
+        action: playwright.VISIBLE_ACTIONS.PROMPT_SUBMIT,
+        payload: {},
+      },
+      {
+        requestId: `${jobId}:read`,
+        action: playwright.VISIBLE_ACTIONS.RESPONSE_READ,
+        payload: {},
+      },
+    ],
+  })
+
+  const daemon = await runtime.ensureDaemonReady({
+    homeDir,
+    daemonUrl,
+    timeoutMs: 60_000,
+    requiredProvider: primary.id,
+  })
+  const created = await playwright.submitManagedPlaywrightJob({
+    daemonUrl: daemon.url,
+    homeDir,
+    profileId: profile.id,
+    request,
+    jobId,
+  })
+  assert.equal(created.job_id, jobId)
+  let completionError
+  const completion = runtime.waitDaemonJobResult({
+    daemonUrl: daemon.url,
+    homeDir,
+    jobId,
+    timeoutMs: 480_000,
+    pollMs: 250,
+  }).catch((error) => {
+    completionError = error
+    return null
+  })
+  const primaryAttempt = await inspection.observeNextAttempt({ jobId })
+  assert.equal(primaryAttempt.waiting.provider, primary.id)
+  const fallbackAttempt = await inspection.observeNextAttempt({
+    jobId,
+    beforeRelease: async ({ page }) => {
+      fallbackUploadControls = await observeUploadControls(page)
+    },
+  })
+  assert.equal(fallbackAttempt.waiting.provider, fallback.id)
+  const completed = await completion
+  if (!completed) throw completionError
+
+  assert.equal(completed.ok, true, JSON.stringify({
+    error: completed.error ?? completed,
+    fallbackUploadControls,
+  }, null, 2))
+  assert.equal(completed.status, 'succeeded')
+  assert.equal(completed.job.job_id, jobId)
+  assert.equal(completed.job.provider, fallback.id)
+  const attempts = completed.job.provider_attempts_json
+  assert.equal(Array.isArray(attempts), true)
+  assert.equal(attempts.length, 2)
+  assert.deepEqual(attempts.map((attempt) => [attempt.provider, attempt.status]), [
+    [primary.id, 'blocked'],
+    [fallback.id, 'succeeded'],
+  ])
+  assert.equal(structuredBlockerCodes(attempts[0]?.blocker).some((code) => (
+    code === 'provider_sign_in_required' ||
+    code === 'provider_sign_in_visible' ||
+    code === 'provider_sign_in_navigation' ||
+    code === 'provider_sign_in_url' ||
+    code === 'visible_cloudflare_turnstile' ||
+    code === 'visible_cloudflare_interstitial'
+  )), true, JSON.stringify(attempts[0]?.blocker, null, 2))
+  assert.deepEqual(completed.job.request_json.capabilityRoute.requirements, [
+    playwright.TASK_CAPABILITIES.CONVERSATION_CHAT,
+    playwright.TASK_CAPABILITIES.FILE_UPLOAD,
+  ])
+  assert.deepEqual(completed.job.request_json.context, request.context)
+  const upload = responseResult(completed.result, playwright.VISIBLE_ACTIONS.FILE_UPLOAD)
+  assert.equal(upload?.acceptance, 'accepted')
+  assert.equal(upload?.visibleProof, 'visible-attachment-filename')
+  assert.ok(upload?.attachments?.some((attachment) => attachment.name === attachmentName))
+  const response = responseResult(completed.result, playwright.VISIBLE_ACTIONS.RESPONSE_READ)
+  assert.equal(response?.text?.trim(), marker)
+
+  const state = spawnSync(process.execPath, [
+    cliEntry,
+    'state',
+    '--home', homeDir,
+    '--daemon-url', daemon.url,
+    '--job-id', jobId,
+    '--json',
+  ], {
+    cwd: root,
+    env: { ...process.env, TOKENLESS_PROVIDER: '' },
+    encoding: 'utf8',
+    timeout: 60_000,
+  })
+  assert.equal(state.status, 0, state.stderr || state.stdout)
+  const statePayload = JSON.parse(state.stdout)
+  assert.equal(statePayload.latest.jobId, jobId)
+  assert.equal(statePayload.latest.provider, fallback.id)
+  assert.deepEqual(statePayload.latest.providerAttempts, attempts)
+  await fs.rm(attachmentPath, { force: true })
+  liveAttachmentPath = undefined
+})
+
+function requiredRoute(playwright, provider) {
+  const decision = playwright.resolveTaskCapabilityRoute({
+    requirements: [
+      playwright.TASK_CAPABILITIES.CONVERSATION_CHAT,
+      playwright.TASK_CAPABILITIES.FILE_UPLOAD,
+    ],
+    candidates: [{ provider, runtimeEligibility: 'unchecked' }],
+  })
+  assert.equal(decision.ok, true, `provider ${provider} must have an E2E-closed conversation.chat route`)
+  return decision.route
+}
+
+function requiredProvider(playwright, provider) {
+  const instance = playwright.getProviderInstanceById(provider)
+  assert.ok(instance, `unknown provider ${provider}`)
+  return instance
+}
+
+async function observeUploadControls(page) {
+  return await page.evaluate(() => {
+    const selectors = [
+      'input[type="file"]',
+      'button[data-testid="composer-plus-btn"]',
+      'button[aria-haspopup="menu"]',
+      'button[aria-label*="file" i]',
+      'button[aria-label*="photo" i]',
+      'button[aria-label*="attach" i]',
+      'button[aria-label*="upload" i]',
+      '[role="menuitem"]',
+    ]
+    const seen = new Set()
+    return selectors.flatMap((selector) => Array.from(document.querySelectorAll(selector)))
+      .filter((element) => {
+        if (seen.has(element)) return false
+        seen.add(element)
+        return true
+      })
+      .slice(0, 20)
+      .map((element) => {
+        const rect = element.getBoundingClientRect()
+        const style = window.getComputedStyle(element)
+        return {
+          tag: element.tagName.toLowerCase(),
+          id: element.id || null,
+          role: element.getAttribute('role'),
+          type: element.getAttribute('type'),
+          testId: element.getAttribute('data-testid'),
+          ariaLabel: element.getAttribute('aria-label'),
+          ariaHasPopup: element.getAttribute('aria-haspopup'),
+          ariaExpanded: element.getAttribute('aria-expanded'),
+          text: (element.textContent ?? '').replace(/\s+/gu, ' ').trim().slice(0, 120),
+          visible: style.display !== 'none' && style.visibility !== 'hidden' && rect.width > 0 && rect.height > 0,
+          disabled: element.hasAttribute('disabled') || element.getAttribute('aria-disabled') === 'true',
+        }
+      })
+  })
+}
+
+function responseResult(result, action) {
+  const responses = result?.responses
+  if (!Array.isArray(responses)) return null
+  return [...responses].reverse().find((response) => response?.ok === true && response.action === action)?.result ?? null
+}
+
+function structuredBlockerCodes(value) {
+  const codes = []
+  appendCode(codes, value)
+  appendCode(codes, value?.blocker)
+  appendCode(codes, value?.primary)
+  if (Array.isArray(value?.blockers)) value.blockers.forEach((blocker) => appendCode(codes, blocker))
+  return [...new Set(codes)]
+}
+
+function appendCode(codes, value) {
+  if (typeof value?.code === 'string') codes.push(value.code)
+}
+
+function requiredEnv(name) {
+  const value = process.env[name]?.trim()
+  if (!value) throw Object.assign(new Error(`${name} is required; live fallback E2E never skips missing activation`), {
+    code: 'e2e_activation_missing',
+  })
+  return value
+}
+
+function installInspectionEnvironment(environment) {
+  const previous = new Map()
+  for (const [name, value] of Object.entries(environment)) {
+    if (!name.startsWith('TOKENLESS_E2E_')) continue
+    previous.set(name, process.env[name])
+    process.env[name] = value
+  }
+  return () => {
+    for (const [name, value] of previous) {
+      if (value === undefined) delete process.env[name]
+      else process.env[name] = value
+    }
+  }
+}
diff --git a/test/live-web-ui-provider.e2e.mjs b/test/live-web-ui-provider.e2e.mjs
new file mode 100644
index 0000000..a6f8b13
--- /dev/null
+++ b/test/live-web-ui-provider.e2e.mjs
@@ -0,0 +1,146 @@
+import assert from 'node:assert/strict'
+import { execFile } from 'node:child_process'
+import { randomUUID } from 'node:crypto'
+import path from 'node:path'
+import test from 'node:test'
+import { promisify } from 'node:util'
+
+import { chromium } from 'playwright-core'
+
+import { loadLiveWebUiFixtures } from './helpers/live-web-ui-fixtures.mjs'
+
+const execFileAsync = promisify(execFile)
+const cliEntry = path.resolve('packages/cli/dist/src/tokenless.mjs')
+const gate = requiredEnv('TOKENLESS_LIVE_WEB_UI_GATE')
+assert.equal(gate, 'representative-provider', 'TOKENLESS_LIVE_WEB_UI_GATE must be representative-provider')
+const fixtureSelection = loadLiveWebUiFixtures({
+  fixtureFile: requiredEnv('TOKENLESS_LIVE_WEB_UI_FIXTURE_FILE'),
+  selection: requiredEnv('TOKENLESS_LIVE_WEB_UI_FIXTURE'),
+})
+const targets = groupCasesByTarget(fixtureSelection.cases)
+
+for (const target of targets) {
+  test(`Web UI displays one completed real-provider job for ${target.profile}/${target.provider}`, { timeout: 1_200_000 }, async (suite) => {
+    const marker = `TOKENLESS_WEB_UI_${new Date().toISOString().replaceAll(/[^0-9]/g, '').slice(0, 14)}_${randomUUID().slice(0, 8)}`
+    const taskId = `web-ui-provider-${target.provider}-${randomUUID()}`
+    const run = await cli([
+      'run',
+      '--home', target.homeDir,
+      '--profile', target.profile,
+      '--provider', target.provider,
+      '--task-id', taskId,
+      '--prompt', `Reply with this exact marker: ${marker}`,
+      '--browser-visibility', 'headed',
+      '--timeout-ms', '300000',
+      '--json',
+    ], 420_000)
+    assert.equal(run.ok, true)
+    assert.equal(run.status, 'succeeded', `real ${target.provider} job must complete successfully`)
+    assert.equal(typeof run.jobId, 'string')
+
+    const browser = await chromium.launch({
+      headless: true,
+      args: ['--password-store=basic', '--use-mock-keychain', '--no-first-run'],
+    })
+    let sharedContext
+    try {
+      for (const fixture of target.cases) {
+        await suite.test(`startup fixture ${fixture.startup.id}: ${fixture.id}`, async () => {
+          const dashboard = await cli([
+            'dashboard',
+            '--home', fixture.homeDir,
+            '--profile', fixture.profile,
+            '--no-open',
+            '--json',
+          ], 60_000)
+          assert.equal(dashboard.ok, true)
+          assert.equal(dashboard.profile.slug, fixture.profile)
+          assert.equal(dashboard.dashboard.opened, false)
+
+          const freshContext = fixture.startup.context === 'fresh'
+          const context = freshContext
+            ? await browser.newContext({ viewport: fixture.startup.viewport })
+            : sharedContext ??= await browser.newContext({ viewport: fixture.startup.viewport })
+          const page = await context.newPage()
+          const consoleFailures = []
+          try {
+            await page.setViewportSize(fixture.startup.viewport)
+            page.on('console', (message) => {
+              if (message.type() === 'error' || message.type() === 'warning') consoleFailures.push(message.text())
+            })
+            page.on('pageerror', (error) => consoleFailures.push(error.message))
+            await page.goto(dashboard.dashboard.url, { waitUntil: 'networkidle' })
+            if (fixture.startup.reload) await page.reload({ waitUntil: 'networkidle' })
+            await openJobs(page)
+            await page.getByTestId('job-search').fill(taskId)
+            const row = page.getByTestId(`job-${run.jobId}`)
+            await row.waitFor()
+            assert.match(await row.textContent(), /succeeded/)
+            await row.click()
+            const detail = page.getByTestId('job-detail')
+            await detail.waitFor()
+            assert.match(await detail.textContent(), new RegExp(marker))
+            assert.equal(await hasDocumentOverflow(page), false)
+            assert.deepEqual(consoleFailures, [])
+          } finally {
+            await page.close()
+            if (freshContext) await context.close()
+          }
+        })
+      }
+    } finally {
+      await sharedContext?.close()
+      await browser.close()
+    }
+  })
+}
+
+function groupCasesByTarget(cases) {
+  const groups = new Map()
+  for (const fixture of cases) {
+    const existing = groups.get(fixture.targetId)
+    if (existing) {
+      existing.cases.push(fixture)
+      continue
+    }
+    groups.set(fixture.targetId, {
+      targetId: fixture.targetId,
+      homeDir: fixture.homeDir,
+      profile: fixture.profile,
+      provider: fixture.provider,
+      cases: [fixture],
+    })
+  }
+  return [...groups.values()]
+}
+
+async function openJobs(page) {
+  const desktop = page.locator('.rail button[data-nav="jobs"]')
+  if (await desktop.isVisible()) await desktop.click()
+  else await page.locator('.mobile-nav button[data-nav="jobs"]').click()
+  await page.getByTestId('jobs-view').waitFor()
+}
+
+async function hasDocumentOverflow(page) {
+  return await page.evaluate(() => document.documentElement.scrollWidth > document.documentElement.clientWidth)
+}
+
+async function cli(arguments_, timeout) {
+  try {
+    const result = await execFileAsync(process.execPath, [cliEntry, ...arguments_], {
+      timeout,
+      maxBuffer: 16 * 1024 * 1024,
+    })
+    return JSON.parse(result.stdout)
+  } catch (error) {
+    const stderr = typeof error?.stderr === 'string' ? error.stderr.trim() : ''
+    const stdout = typeof error?.stdout === 'string' ? error.stdout.trim() : ''
+    throw new Error(`Tokenless CLI failed.${stderr ? ` ${stderr}` : ''}${stdout ? ` ${stdout}` : ''}`, { cause: error })
+  }
+}
+
+function requiredEnv(name) {
+  const value = process.env[name]?.trim()
+  if (!value) throw new Error(`${name} is required for the explicitly gated real Web UI provider E2E.`)
+  return value
+}
diff --git a/test/local-web-control-plane.test.mjs b/test/local-web-control-plane.test.mjs
new file mode 100644
index 0000000..d16061b
--- /dev/null
+++ b/test/local-web-control-plane.test.mjs
@@ -0,0 +1,303 @@
+import assert from 'node:assert/strict'
+import { execFile } from 'node:child_process'
+import fs from 'node:fs'
+import http from 'node:http'
+import os from 'node:os'
+import path from 'node:path'
+import test from 'node:test'
+import { promisify } from 'node:util'
+
+import Ajv2020 from 'ajv/dist/2020.js'
+import addFormats from 'ajv-formats'
+import { startDaemon } from '../packages/cli/dist/src/daemon/lifecycle.js'
+import { ManagedProfileRegistry } from '../packages/cli/dist/src/playwright/profiles/registry.js'
+
+const execFileAsync = promisify(execFile)
+const cliEntry = path.resolve('packages/cli/dist/src/tokenless.mjs')
+const uiApiDocument = JSON.parse(fs.readFileSync(path.resolve('api/tokenless-ui-api.openapi.json'), 'utf8'))
+const validateUiSession = uiSchemaValidator('UiSession')
+const validateUiSnapshot = uiSchemaValidator('UiSnapshot')
+const validateUiError = uiSchemaValidator('ErrorEnvelope')
+
+test('local web control plane enforces one-time bootstrap, session, CSRF, Origin, Host, and redaction', async () => {
+  await withDaemon(async ({ daemon, homeDir }) => {
+    const token = fs.readFileSync(path.join(homeDir, 'daemon.token'), 'utf8').trim()
+    const minted = await mintTicket(daemon.origin, token)
+    assert.equal(minted.response.status, 200)
+    assert.equal(new URL(minted.body.bootstrapUrl).origin, daemon.origin)
+
+    const bootstrap = await fetch(minted.body.bootstrapUrl, { redirect: 'manual' })
+    assert.equal(bootstrap.status, 303)
+    assert.equal(bootstrap.headers.get('location'), '/ui/')
+    assert.equal(new URL(minted.body.bootstrapUrl).searchParams.has('ticket'), true)
+    const cookie = bootstrap.headers.get('set-cookie')?.split(';')[0]
+    assert.match(cookie ?? '', /^tokenless_ui_session=/)
+    assert.match(bootstrap.headers.get('set-cookie') ?? '', /HttpOnly/)
+    assert.match(bootstrap.headers.get('set-cookie') ?? '', /SameSite=Strict/)
+
+    const reused = await fetch(minted.body.bootstrapUrl, { redirect: 'manual' })
+    assert.equal(reused.status, 401)
+
+    const initialHtml = await fetch(`${daemon.origin}/ui/`, {
+      headers: { 'accept-language': 'zh-CN,zh;q=0.9' },
+    })
+    assert.equal(initialHtml.status, 200)
+    const html = await initialHtml.text()
+    assert.match(html, /<html lang="zh-CN">/)
+    assert.match(html, />跳到主要内容<\/a>/)
+    assert.match(html, />English<\/option>/)
+    assert.match(html, />简体中文<\/option>/)
+    assert.equal(initialHtml.headers.get('referrer-policy'), 'no-referrer')
+    assert.match(initialHtml.headers.get('content-security-policy') ?? '', /frame-ancestors 'none'/)
+    assert.equal(initialHtml.headers.get('x-content-type-options'), 'nosniff')
+
+    const session = await fetch(`${daemon.origin}/ui-api/v1/session`, { headers: { cookie } })
+    assert.equal(session.status, 200)
+    const sessionBody = await session.json()
+    assert.equal(typeof sessionBody.csrf, 'string')
+    assertUiSchema(validateUiSession, sessionBody)
+
+    const snapshot = await fetch(`${daemon.origin}/ui-api/v1/snapshot`, { headers: { cookie } })
+    assert.equal(snapshot.status, 200)
+    const snapshotText = await snapshot.text()
+    assert.equal(snapshotText.includes(token), false)
+    assert.equal(/claim_token|checkpoint_json|browser-storage|cookie/i.test(snapshotText), false)
+    const snapshotBody = JSON.parse(snapshotText)
+    assert.equal(snapshotBody.schema, 'tokenless.ui-snapshot.v1')
+    assert.equal(typeof snapshotBody.revision, 'string')
+    assertUiSchema(validateUiSnapshot, snapshotBody)
+
+    const unchanged = await fetch(`${daemon.origin}/ui-api/v1/snapshot`, {
+      headers: { cookie, 'if-none-match': `"${snapshotBody.revision}"` },
+    })
+    assert.equal(unchanged.status, 304)
+
+    const missingJob = await fetch(`${daemon.origin}/ui-api/v1/jobs/not-a-job`, { headers: { cookie } })
+    assert.equal(missingJob.status, 404)
+    const missingJobBody = await missingJob.json()
+    assert.equal(missingJobBody.error.code, 'job_not_found')
+    assertUiSchema(validateUiError, missingJobBody)
+
+    const missingCsrf = await fetch(`${daemon.origin}/ui-api/v1/config`, {
+      method: 'PATCH',
+      headers: { cookie, origin: daemon.origin, 'content-type': 'application/json' },
+      body: '{}',
+    })
+    assert.equal(missingCsrf.status, 403)
+
+    const wrongOrigin = await fetch(`${daemon.origin}/ui-api/v1/config`, {
+      method: 'PATCH',
+      headers: {
+        cookie,
+        origin: 'http://evil.invalid',
+        'x-tokenless-csrf': sessionBody.csrf,
+        'content-type': 'application/json',
+      },
+      body: '{}',
+    })
+    assert.equal(wrongOrigin.status, 403)
+
+    const disabledProfileCopy = await fetch(`${daemon.origin}/ui-api/v1/profiles/import`, {
+      method: 'POST',
+      headers: {
+        cookie,
+        origin: daemon.origin,
+        'x-tokenless-csrf': sessionBody.csrf,
+        'content-type': 'application/json',
+      },
+      body: '{}',
+    })
+    assert.equal(disabledProfileCopy.status, 404)
+
+    const changed = await fetch(`${daemon.origin}/ui-api/v1/config`, {
+      method: 'PATCH',
+      headers: {
+        cookie,
+        origin: daemon.origin,
+        'x-tokenless-csrf': sessionBody.csrf,
+        'content-type': 'application/json',
+      },
+      body: JSON.stringify({ language: 'zh-CN' }),
+    })
+    assert.equal(changed.status, 200)
+    assert.equal((await changed.json()).language, 'zh-CN')
+
+    const registry = new ManagedProfileRegistry(homeDir)
+    const invalidProfile = await fetch(`${daemon.origin}/ui-api/v1/profiles`, {
+      method: 'POST',
+      headers: {
+        cookie,
+        origin: daemon.origin,
+        'x-tokenless-csrf': sessionBody.csrf,
+        'content-type': 'application/json',
+      },
+      body: JSON.stringify({
+        slug: 'invalid-proxy',
+        enabledProviders: ['chatgpt'],
+        proxy: { server: 'https://user:password@example.invalid' },
+      }),
+    })
+    assert.equal(invalidProfile.status, 400)
+    assert.deepEqual(await registry.listProfiles(), [])
+
+    const workProfile = await registry.addProfile({ slug: 'work', label: 'Work', lifecycle: 'ready', setDefault: true })
+    const mappedJob = daemon.store.createJob({
+      provider: 'chatgpt',
+      action: 'profile-mapping-check',
+      request_json: { taskId: 'ui-profile-mapping-check' },
+      execution_backend: 'playwright',
+      profile_id: workProfile.id,
+    })
+    const mappedJobResponse = await fetch(`${daemon.origin}/ui-api/v1/jobs/${mappedJob.job_id}`, { headers: { cookie } })
+    assert.equal(mappedJobResponse.status, 200)
+    assert.equal((await mappedJobResponse.json()).profileSlug, 'work')
+    await daemon.store.cancelJob(mappedJob.job_id, { source: 'test-cleanup' })
+
+    const configCommand = await execFileAsync(process.execPath, [
+      cliEntry,
+      'config',
+      '--home', homeDir,
+      '--profile', 'work',
+      '--provider-whitelist', 'chatgpt,claude',
+      '--browser-visibility', 'headed',
+      '--proxy-server', 'socks5://127.0.0.1:1080',
+      '--proxy-bypass', 'localhost,127.0.0.1',
+      '--json',
+    ])
+    const configBody = JSON.parse(configCommand.stdout)
+    assert.deepEqual(configBody.preferences.enabledProviders, ['chatgpt', 'claude'])
+    assert.equal(configBody.preferences.browserVisibility, 'headed')
+    assert.equal(configBody.preferences.proxy.server, 'socks5://127.0.0.1:1080')
+    assert.deepEqual(configBody.preferences.proxy.bypass, ['localhost', '127.0.0.1'])
+
+    const dashboardCommand = await execFileAsync(process.execPath, [
+      cliEntry,
+      'dashboard',
+      '--home', homeDir,
+      '--daemon-url', daemon.origin,
+      '--profile', 'work',
+      '--no-open',
+      '--json',
+    ])
+    const dashboardBody = JSON.parse(dashboardCommand.stdout)
+    assert.equal(dashboardBody.command, 'dashboard')
+    assert.equal(dashboardBody.profile.slug, 'work')
+    assert.equal(dashboardBody.dashboard.opened, false)
+    assert.equal(new URL(dashboardBody.dashboard.url).origin, daemon.origin)
+
+    const profileMutation = await fetch(`${daemon.origin}/ui-api/v1/profiles/work`, {
+      method: 'PATCH',
+      headers: {
+        cookie,
+        origin: daemon.origin,
+        'x-tokenless-csrf': sessionBody.csrf,
+        'content-type': 'application/json',
+      },
+      body: JSON.stringify({
+        roleLabel: 'Research',
+        enabledProviders: ['chatgpt', 'claude'],
+        browserVisibility: 'headed',
+        proxy: { server: 'socks5://127.0.0.1:1080', bypass: ['localhost'] },
+      }),
+    })
+    assert.equal(profileMutation.status, 200)
+    const profileBody = await profileMutation.json()
+    assert.equal(profileBody.preferences.roleLabel, 'Research')
+    assert.deepEqual(profileBody.preferences.enabledProviders, ['chatgpt', 'claude'])
+    assert.equal(profileBody.preferences.proxy.server, 'socks5://127.0.0.1:1080')
+    assert.equal(Object.hasOwn(profileBody, 'directory'), false)
+
+    const afterProfile = await fetch(`${daemon.origin}/ui-api/v1/snapshot`, { headers: { cookie } }).then((response) => response.json())
+    assertUiSchema(validateUiSnapshot, afterProfile)
+    assert.deepEqual(afterProfile.profiles[0].preferences.enabledProviders, ['chatgpt', 'claude'])
+    assert.equal(afterProfile.providers.find((provider) => provider.id === 'chatgpt').profiles[0].enabled, true)
+    assert.equal(afterProfile.providers.find((provider) => provider.id === 'gemini').profiles[0].enabled, false)
+
+    assert.equal(await requestWithHost(daemon.port, 'evil.invalid'), 403)
+  })
+})
+
+test('dashboard sessions are invalidated when the real daemon restarts', async () => {
+  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-ui-restart-')))
+  let daemon = await startDaemon({ homeDir, host: '127.0.0.1', port: 0 })
+  try {
+    const token = fs.readFileSync(path.join(homeDir, 'daemon.token'), 'utf8').trim()
+    const minted = await mintTicket(daemon.origin, token)
+    const bootstrap = await fetch(minted.body.bootstrapUrl, { redirect: 'manual' })
+    const cookie = bootstrap.headers.get('set-cookie')?.split(';')[0]
+    assert.match(cookie ?? '', /^tokenless_ui_session=/)
+    await daemon.close()
+
+    daemon = await startDaemon({ homeDir, host: '127.0.0.1', port: 0 })
+    const staleSession = await fetch(`${daemon.origin}/ui-api/v1/session`, { headers: { cookie } })
+    assert.equal(staleSession.status, 401)
+  } finally {
+    await daemon.close()
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+async function withDaemon(operation) {
+  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-local-ui-')))
+  const daemon = await startDaemon({ homeDir, host: '127.0.0.1', port: 0 })
+  try {
+    return await operation({ daemon, homeDir })
+  } finally {
+    await daemon.close()
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+}
+
+async function mintTicket(origin, token) {
+  const response = await fetch(`${origin}/control/ui-bootstrap`, {
+    method: 'POST',
+    headers: {
+      authorization: `Bearer ${token}`,
+      'content-type': 'application/json',
+    },
+    body: '{}',
+  })
+  return { response, body: await response.json() }
+}
+
+async function requestWithHost(port, host) {
+  return await new Promise((resolve, reject) => {
+    const request = http.request({
+      host: '127.0.0.1',
+      port,
+      path: '/ui/',
+      headers: { host },
+    }, (response) => {
+      response.resume()
+      resolve(response.statusCode)
+    })
+    request.on('error', reject)
+    request.end()
+  })
+}
+
+function uiSchemaValidator(name) {
+  const ajv = new Ajv2020({ allErrors: true, strict: true })
+  addFormats(ajv)
+  const defs = Object.fromEntries(Object.entries(uiApiDocument.components.schemas).map(([schemaName, schema]) => [schemaName, rewriteUiSchemaRefs(schema)]))
+  return ajv.compile({
+    $schema: 'https://json-schema.org/draft/2020-12/schema',
+    $defs: defs,
+    $ref: `#/$defs/${name}`,
+  })
+}
+
+function rewriteUiSchemaRefs(value) {
+  if (Array.isArray(value)) return value.map(rewriteUiSchemaRefs)
+  if (!value || typeof value !== 'object') return value
+  return Object.fromEntries(Object.entries(value).map(([key, child]) => [
+    key,
+    key === '$ref' && typeof child === 'string' && child.startsWith('#/components/schemas/')
+      ? `#/$defs/${child.slice('#/components/schemas/'.length)}`
+      : rewriteUiSchemaRefs(child),
+  ]))
+}
+
+function assertUiSchema(validate, value) {
+  assert.equal(validate(value), true, JSON.stringify(validate.errors))
+}
diff --git a/test/local-web-ui.e2e.mjs b/test/local-web-ui.e2e.mjs
new file mode 100644
index 0000000..c785fe7
--- /dev/null
+++ b/test/local-web-ui.e2e.mjs
@@ -0,0 +1,161 @@
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import test from 'node:test'
+
+import { chromium } from 'playwright-core'
+
+import { startDaemon } from '../packages/cli/dist/src/daemon/lifecycle.js'
+import { PersistentContextManager } from '../packages/cli/dist/src/playwright/browser/context-manager.js'
+import { ManagedProfileRegistry } from '../packages/cli/dist/src/playwright/profiles/registry.js'
+
+test('Svelte Web UI completes setup, persists configuration, renders durable work, and remains responsive', async () => {
+  await withDaemon(async ({ daemon, homeDir }) => {
+    const token = fs.readFileSync(path.join(homeDir, 'daemon.token'), 'utf8').trim()
+    const minted = await mintTicket(daemon.origin, token)
+    const browserProfileDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-web-ui-browser-'))
+    const manager = new PersistentContextManager({
+      browser: {
+        id: 'profile',
+        executablePath: chromium.executablePath(),
+      },
+    })
+    const browserProfile = { id: 'web-ui-browser', directory: browserProfileDir, lifecycle: 'ready' }
+    const consoleFailures = []
+    const snapshotStatuses = []
+
+    try {
+      const context = await manager.ensureContext(browserProfile, 'headless')
+      const page = await context.acquireReservedPage({ key: 'tokenless:control-plane:web-e2e' })
+      await page.setViewportSize({ width: 1920, height: 1080 })
+      page.on('console', (message) => {
+        if (message.type() === 'error' || message.type() === 'warning') consoleFailures.push(message.text())
+      })
+      page.on('pageerror', (error) => consoleFailures.push(error.message))
+      page.on('response', (response) => {
+        if (new URL(response.url()).pathname === '/ui-api/v1/snapshot') snapshotStatuses.push(response.status())
+      })
+
+      await page.goto(minted.body.bootstrapUrl, { waitUntil: 'networkidle' })
+      assert.equal(await page.title(), 'Tokenless local console')
+      await page.getByTestId('setup-view').waitFor()
+      await page.getByTestId('setup-slug').fill('work')
+      await page.getByTestId('setup-label').fill('Work')
+      await page.getByTestId('setup-role').fill('Research')
+      await page.getByTestId('setup-visibility').selectOption('headless')
+      assert.equal(await page.locator('.provider-pill').filter({ hasText: 'ChatGPT' }).locator('input').isChecked(), true)
+      assert.equal(await page.locator('.provider-pill').filter({ hasText: 'Gemini' }).locator('input').isChecked(), false)
+      await page.getByTestId('finish-setup').click()
+      await page.getByTestId('profiles-view').waitFor()
+      const setupConfig = JSON.parse(fs.readFileSync(path.join(homeDir, 'config.json'), 'utf8'))
+      assert.notEqual(setupConfig.browser, 'auto')
+      assert.equal(typeof setupConfig.browserExecutablePath, 'string')
+      fs.accessSync(setupConfig.browserExecutablePath, fs.constants.X_OK)
+
+      assert.equal(await page.locator('.rail').evaluate((element) => Math.round(element.getBoundingClientRect().width)), 64)
+      assert.equal(await page.locator('.profile-master').evaluate((element) => Math.round(element.getBoundingClientRect().width)), 302)
+      assert.equal(await hasDocumentOverflow(page), false)
+      assert.equal(await page.locator('.rail nav').getAttribute('aria-label'), 'Primary navigation')
+
+      await page.getByTestId('add-profile').click()
+      await page.getByTestId('profile-slug').fill('unsaved-draft')
+      await page.getByTestId('profile-label').fill('Unsaved draft')
+      await page.waitForTimeout(3300)
+      assert.equal(await page.getByTestId('profile-slug').inputValue(), 'unsaved-draft')
+      assert.equal(await page.getByTestId('profile-label').inputValue(), 'Unsaved draft')
+      assert.equal(snapshotStatuses.includes(304), true)
+      await page.getByTestId('modal-close').click()
+
+      await page.locator('.settings-section').first().locator('.text-button').click()
+      await page.getByTestId('profile-label').fill('Work updated')
+      await page.getByTestId('profile-role').fill('Operations')
+      await page.getByTestId('profile-submit').click()
+      await page.getByTestId('modal').waitFor({ state: 'detached' })
+      await page.getByRole('heading', { name: 'Work updated' }).waitFor()
+
+      const registry = new ManagedProfileRegistry(homeDir)
+      const workProfile = await registry.resolveProfile('work')
+      const work = daemon.store.createJob({
+        provider: 'chatgpt',
+        action: 'web-ui-display-check',
+        request_json: { taskId: 'web-ui-durable-work' },
+        execution_backend: 'playwright',
+        profile_id: workProfile.id,
+      })
+      await daemon.store.cancelJob(work.job_id, { source: 'web-ui-e2e' })
+      await page.waitForTimeout(3300)
+      await page.locator('.rail button[data-nav="jobs"]').click()
+      await page.getByTestId('job-search').fill('web-ui-durable-work')
+      const workRow = page.getByTestId(`job-${work.job_id}`)
+      await workRow.waitFor()
+      assert.match(await workRow.textContent(), /canceled/)
+      await workRow.click()
+      assert.match(await page.getByTestId('job-detail').textContent(), /web-ui-durable-work|canceled/)
+      await page.getByTestId('modal-close').click()
+
+      await page.locator('.rail button[data-nav="system"]').click()
+      await page.getByTestId('config-language').selectOption('zh-CN')
+      await page.getByTestId('config-visibility').selectOption('headed')
+      await page.getByTestId('config-save').click()
+      await page.waitForFunction(() => document.documentElement.lang === 'zh-CN')
+      assert.equal(await page.title(), 'Tokenless 本地控制台')
+      await page.reload({ waitUntil: 'networkidle' })
+      await page.getByTestId('app-shell').waitFor()
+      await page.locator('.rail button[data-nav="system"]').click()
+      await page.getByTestId('system-view').waitFor()
+      assert.equal(await page.getByTestId('config-language').inputValue(), 'zh-CN')
+      assert.equal(await page.getByTestId('config-visibility').inputValue(), 'headed')
+      await page.getByTestId('config-language').selectOption('en')
+      await page.getByTestId('config-save').click()
+      await page.waitForFunction(() => document.documentElement.lang === 'en')
+
+      await page.locator('.rail button[data-nav="profiles"]').click()
+      await page.setViewportSize({ width: 390, height: 844 })
+      await page.locator('.mobile-nav').waitFor()
+      assert.equal(await hasDocumentOverflow(page), false)
+      assert.equal(await page.locator('.mobile-nav').getAttribute('aria-label'), 'Primary navigation')
+      assert.equal(await page.locator('.profile-master').evaluate((element) => Math.round(element.getBoundingClientRect().width)), 390)
+
+      const providerPage = await context.acquirePage({
+        key: 'provider:chatgpt:task:web-ui-replacement-proof',
+        policy: 'replace',
+      })
+      assert.notEqual(providerPage, page)
+      assert.equal(page.isClosed(), false)
+      assert.equal(new URL(page.url()).pathname, '/ui/')
+      assert.deepEqual(consoleFailures, [])
+    } finally {
+      await manager.shutdown()
+      fs.rmSync(browserProfileDir, { recursive: true, force: true })
+    }
+  })
+})
+
+async function withDaemon(operation) {
+  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-web-ui-e2e-')))
+  const daemon = await startDaemon({ homeDir, host: '127.0.0.1', port: 0 })
+  try {
+    return await operation({ daemon, homeDir })
+  } finally {
+    await daemon.close()
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+}
+
+async function mintTicket(origin, token) {
+  const response = await fetch(`${origin}/control/ui-bootstrap`, {
+    method: 'POST',
+    headers: {
+      authorization: `Bearer ${token}`,
+      'content-type': 'application/json',
+    },
+    body: '{}',
+  })
+  assert.equal(response.status, 200)
+  return { response, body: await response.json() }
+}
+
+async function hasDocumentOverflow(page) {
+  return await page.evaluate(() => document.documentElement.scrollWidth > document.documentElement.clientWidth)
+}
diff --git a/test/managed-browser-tabs.test.mjs b/test/managed-browser-tabs.test.mjs
new file mode 100644
index 0000000..6ea33cd
--- /dev/null
+++ b/test/managed-browser-tabs.test.mjs
@@ -0,0 +1,251 @@
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import http from 'node:http'
+import os from 'node:os'
+import path from 'node:path'
+import test from 'node:test'
+
+import { chromium } from 'playwright-core'
+
+import {
+  PersistentContextManager,
+} from '../packages/cli/dist/src/playwright/index.js'
+
+const connectionModes = ['playwright', 'cdp']
+
+for (const connectionMode of connectionModes) {
+  test(`${connectionMode} production launch keeps configured Chromium executables keychain-neutral`, async () => {
+    await withManager(connectionMode, async ({ manager, profile }) => {
+      const managed = await manager.ensureContext(profile, 'headless')
+      const page = await managed.acquirePage({ key: 'browser-command-line' })
+      await page.goto('chrome://version')
+      const commandLine = await page.locator('#command_line').textContent()
+      assert.match(commandLine ?? '', /(?:^|\s)--password-store=basic(?:\s|$)/u)
+      assert.match(commandLine ?? '', /(?:^|\s)--use-mock-keychain(?:\s|$)/u)
+    }, { browserId: 'chromium' })
+  })
+
+  test(`${connectionMode} managed browser reuses one persistent browser for one selected profile`, async () => {
+    await withManager(connectionMode, async ({ manager, profile }) => {
+      const first = await manager.ensureContext(profile, 'headless')
+      const second = await manager.ensureContext(profile, 'headless')
+
+      assert.equal(second.browserContext, first.browserContext)
+      assert.equal(second.browserContext.browser(), first.browserContext.browser())
+
+      const firstPage = await first.acquirePage({ key: 'provider:chatgpt:task:first' })
+      const secondPage = await second.acquirePage({ key: 'provider:gemini:task:second' })
+      assert.notEqual(secondPage, firstPage)
+      assert.equal(first.browserContext.pages().length, 2)
+    })
+  })
+
+  test(`${connectionMode} managed browser keeps one stable browser instance per active profile`, async () => {
+    await withManager(connectionMode, async ({ manager, profile, otherProfile }) => {
+      const first = await manager.ensureContext(profile, 'headless')
+      const firstBrowser = first.browserContext.browser()
+      const second = await manager.ensureContext(otherProfile, 'headless')
+      const secondBrowser = second.browserContext.browser()
+      const reusedFirst = await manager.ensureContext(profile, 'headless')
+
+      assert.deepEqual(manager.activeProfileIds(), [profile.id, otherProfile.id].sort())
+      assert.notEqual(secondBrowser, firstBrowser)
+      assert.equal(reusedFirst.browserContext, first.browserContext)
+      assert.equal(reusedFirst.browserContext.browser(), firstBrowser)
+      assert.equal(firstBrowser?.isConnected(), true)
+      assert.equal(secondBrowser?.isConnected(), true)
+    })
+  })
+
+  test(`${connectionMode} managed browser never evicts an active profile to make room`, async () => {
+    await withManager(connectionMode, async ({ manager, profile, otherProfile, overflowProfile }) => {
+      const first = await manager.ensureContext(profile, 'headless')
+      const second = await manager.ensureContext(otherProfile, 'headless')
+      const firstBrowser = first.browserContext.browser()
+      const secondBrowser = second.browserContext.browser()
+
+      await assert.rejects(
+        manager.ensureContext(overflowProfile, 'headless'),
+        (error) => error?.code === 'playwright_context_limit_reached' && error?.retryable === true,
+      )
+
+      assert.deepEqual(manager.activeProfileIds(), [profile.id, otherProfile.id].sort())
+      assert.equal((await manager.ensureContext(profile, 'headless')).browserContext, first.browserContext)
+      assert.equal((await manager.ensureContext(otherProfile, 'headless')).browserContext, second.browserContext)
+      assert.equal(firstBrowser?.isConnected(), true)
+      assert.equal(secondBrowser?.isConnected(), true)
+    })
+  })
+
+  test(`${connectionMode} managed browser preserves independent logical tabs in one profile`, async () => {
+    await withManager(connectionMode, async ({ manager, profile }) => {
+      await manager.runWithProfile(profile, 'headless', async (context) => {
+        const chatgpt = await context.acquirePage({ key: 'provider:chatgpt:task:chat-a' })
+        await chatgpt.setContent('<title>ChatGPT chat A</title>')
+
+        const claude = await context.acquirePage({ key: 'provider:claude:task:chat-b' })
+        await claude.setContent('<title>Claude chat B</title>')
+
+        assert.notEqual(claude, chatgpt)
+        assert.equal(await chatgpt.title(), 'ChatGPT chat A')
+        assert.equal(await claude.title(), 'Claude chat B')
+        assert.equal(context.browserContext.pages().length, 2)
+
+        const resumedChatgpt = await context.acquirePage({ key: 'provider:chatgpt:task:chat-a' })
+        assert.equal(resumedChatgpt, chatgpt)
+        assert.equal(await resumedChatgpt.title(), 'ChatGPT chat A')
+        assert.equal(context.browserContext.pages().length, 2)
+
+        const forcedReplacement = await context.acquirePage({
+          key: 'provider:grok:task:chat-c',
+          policy: 'replace',
+        })
+        assert.equal(forcedReplacement, claude)
+        assert.equal(context.browserContext.pages().length, 2)
+
+        const restoredClaude = await context.acquirePage({ key: 'provider:claude:task:chat-b' })
+        assert.notEqual(restoredClaude, forcedReplacement)
+        assert.equal(context.browserContext.pages().length, 3)
+      })
+    })
+  })
+
+  test(`${connectionMode} managed browser closes capability gaps at a real Chromium boundary`, async () => {
+    await withCapabilityServer(async (origin) => {
+      await withManager(connectionMode, async ({ manager, profile, profileDirectory }) => {
+        const upload = path.join(profileDirectory, 'capability-upload.txt')
+        fs.writeFileSync(upload, `upload-${connectionMode}\n`, { mode: 0o600 })
+
+        await manager.runWithProfile(profile, 'headless', async (context) => {
+          await context.browserContext.grantPermissions(['clipboard-read', 'clipboard-write'], { origin })
+          const page = await context.acquirePage({ key: 'capability-matrix' })
+          await page.goto(`${origin}/start`)
+
+          await page.getByLabel('Message').fill(`filled-${connectionMode}`)
+          assert.equal(await page.getByLabel('Message').inputValue(), `filled-${connectionMode}`)
+          assert.equal(await page.locator('[data-capability="dom-read"]').textContent(), 'DOM ready')
+
+          await page.getByRole('link', { name: 'Navigate' }).click()
+          await page.waitForURL(`${origin}/navigated`)
+          assert.equal(await page.locator('h1').textContent(), 'Navigated')
+          await page.goto(`${origin}/start`)
+
+          await page.locator('#direct-file').setInputFiles(upload)
+          assert.equal(await page.locator('#direct-file').evaluate((input) => input.files?.[0]?.name), path.basename(upload))
+
+          const [chooser] = await Promise.all([
+            page.waitForEvent('filechooser'),
+            page.locator('button', { hasText: 'Choose file' }).click(),
+          ])
+          await chooser.setFiles(upload)
+          assert.equal(await page.locator('#chooser-file').evaluate((input) => input.files?.[0]?.name), path.basename(upload))
+
+          const [popup] = await Promise.all([
+            page.waitForEvent('popup'),
+            page.getByRole('button', { name: 'Open popup' }).click(),
+          ])
+          await popup.waitForLoadState()
+          assert.equal(await popup.locator('h1').textContent(), 'Popup')
+          await popup.close()
+
+          const [download] = await Promise.all([
+            page.waitForEvent('download'),
+            page.getByRole('link', { name: 'Download' }).click(),
+          ])
+          assert.equal(download.suggestedFilename(), 'tokenless-capability.txt')
+          assert.equal(await download.failure(), null)
+
+          const clipboardValue = `clipboard-${connectionMode}`
+          await page.evaluate(async (value) => await navigator.clipboard.writeText(value), clipboardValue)
+          assert.equal(await page.evaluate(async () => await navigator.clipboard.readText()), clipboardValue)
+        })
+      })
+    })
+  })
+
+  test(`${connectionMode} managed browser rebuilds page mapping after context loss and visibility changes`, async () => {
+    await withManager(connectionMode, async ({ manager, profile }) => {
+      const initial = await manager.ensureContext(profile, 'headless')
+      const initialPage = await initial.acquirePage({ key: 'provider:chatgpt:task:reconnect' })
+      await initialPage.setContent(`<title>${connectionMode} before reconnect</title>`)
+      await initial.browserContext.close()
+
+      const reconnected = await manager.ensureContext(profile, 'headless')
+      const reconstructedPage = await reconnected.acquirePage({ key: 'provider:chatgpt:task:reconnect' })
+      assert.notEqual(reconstructedPage, initialPage)
+      assert.equal(reconstructedPage.isClosed(), false)
+
+      const switched = await reconnected.switchVisibility('headed')
+      assert.equal(switched.effectiveBrowserVisibility, 'headed')
+      assert.notEqual(switched.browserContext, reconnected.browserContext)
+    })
+  })
+}
+
+async function withManager(connectionMode, operation, { browserId = 'profile' } = {}) {
+  const profileDirectory = fs.mkdtempSync(path.join(os.tmpdir(), `tokenless-${connectionMode}-capabilities-`))
+  const otherProfileDirectory = fs.mkdtempSync(path.join(os.tmpdir(), `tokenless-${connectionMode}-other-profile-`))
+  const overflowProfileDirectory = fs.mkdtempSync(path.join(os.tmpdir(), `tokenless-${connectionMode}-overflow-profile-`))
+  const manager = new PersistentContextManager({
+    maxContexts: 2,
+    connectionMode,
+    browser: {
+      id: browserId,
+      executablePath: chromium.executablePath(),
+    },
+  })
+  const profile = { id: 'default', directory: profileDirectory, lifecycle: 'ready' }
+  const otherProfile = { id: 'secondary', directory: otherProfileDirectory, lifecycle: 'ready' }
+  const overflowProfile = { id: 'overflow', directory: overflowProfileDirectory, lifecycle: 'ready' }
+  try {
+    return await operation({ manager, profile, otherProfile, overflowProfile, profileDirectory })
+  } finally {
+    await manager.shutdown()
+    fs.rmSync(profileDirectory, { recursive: true, force: true })
+    fs.rmSync(otherProfileDirectory, { recursive: true, force: true })
+    fs.rmSync(overflowProfileDirectory, { recursive: true, force: true })
+  }
+}
+
+async function withCapabilityServer(operation) {
+  const server = http.createServer((request, response) => {
+    if (request.url === '/download') {
+      response.writeHead(200, {
+        'content-disposition': 'attachment; filename="tokenless-capability.txt"',
+        'content-type': 'text/plain; charset=utf-8',
+      })
+      response.end('download-ready\n')
+      return
+    }
+    response.setHeader('content-type', 'text/html; charset=utf-8')
+    if (request.url === '/popup') {
+      response.end('<!doctype html><h1>Popup</h1>')
+      return
+    }
+    if (request.url === '/navigated') {
+      response.end('<!doctype html><h1>Navigated</h1>')
+      return
+    }
+    response.end(`<!doctype html>
+      <label>Message <textarea></textarea></label>
+      <p data-capability="dom-read">DOM ready</p>
+      <a href="/navigated">Navigate</a>
+      <input id="direct-file" type="file">
+      <input id="chooser-file" type="file" hidden>
+      <button type="button" onclick="document.querySelector('#chooser-file').click()">Choose file</button>
+      <button type="button" onclick="window.open('/popup', '_blank')">Open popup</button>
+      <a href="/download" download>Download</a>
+    `)
+  })
+  await new Promise((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(0, '127.0.0.1', resolve)
+  })
+  const address = server.address()
+  assert.ok(address && typeof address === 'object')
+  try {
+    return await operation(`http://127.0.0.1:${address.port}`)
+  } finally {
+    await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()))
+  }
+}
diff --git a/test/package-contract.test.mjs b/test/package-contract.test.mjs
index 725e7bd..1529f28 100644
--- a/test/package-contract.test.mjs
+++ b/test/package-contract.test.mjs
@@ -1,24 +1,156 @@
 import assert from 'node:assert/strict'
 import { execFileSync, spawnSync } from 'node:child_process'
 import fs from 'node:fs'
-import fsPromises from 'node:fs/promises'
 import os from 'node:os'
 import path from 'node:path'
 import test from 'node:test'
-import { fileURLToPath, pathToFileURL } from 'node:url'
+import { fileURLToPath } from 'node:url'
+import { loadLiveProviderCapabilityMatrix } from './helpers/live-provider-capability-matrix.mjs'
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
 const cliDir = path.join(root, 'packages/cli')
 const cliEntry = path.join(cliDir, 'dist/src/tokenless.mjs')
-const executableSuffix = process.platform === 'win32' ? '.exe' : ''
-const nativeTuples = [
-  ['darwin', 'arm64'],
-  ['darwin', 'x64'],
-  ['linux', 'arm64'],
-  ['linux', 'x64'],
-  ['win32', 'arm64'],
-  ['win32', 'x64'],
-]
+
+test('checked-in live provider capability matrix classifies every registered provider and case', () => {
+  const matrix = loadLiveProviderCapabilityMatrix()
+  assert.equal(matrix.schema, 'tokenless.live-provider-capability-matrix.v1')
+  assert.deepEqual(matrix.knownIssueSkips, [{
+    provider: 'claude',
+    reason: 'claude_recurring_cloudflare_human_check',
+    blockerCodes: [
+      'visible_cloudflare_turnstile',
+      'visible_cloudflare_interstitial',
+    ],
+  }])
+})
+
+test('built provider navigation catalog owns every entry point and known page pattern', async () => {
+  const {
+    PROVIDER_NAVIGATION_CATALOG,
+    listProviderDescriptors,
+  } = await import('../packages/cli/dist/src/playwright/index.js')
+  const descriptors = listProviderDescriptors()
+  assert.deepEqual(
+    Object.keys(PROVIDER_NAVIGATION_CATALOG).sort(),
+    descriptors.map((descriptor) => descriptor.id).sort(),
+  )
+  for (const descriptor of descriptors) {
+    assert.equal(descriptor.navigation, PROVIDER_NAVIGATION_CATALOG[descriptor.id])
+    assert.ok(descriptor.navigation.pagePatterns.some((page) => (
+      page.kind === 'entry' && page.urlPattern === descriptor.navigation.entryUrl
+    )))
+  }
+  assert.equal(PROVIDER_NAVIGATION_CATALOG.zai.entryUrl, 'https://z.ai/chat')
+  assert.equal(PROVIDER_NAVIGATION_CATALOG.zai.homeUrl, 'https://chat.z.ai/')
+  assert.deepEqual(PROVIDER_NAVIGATION_CATALOG.zai.origins, [
+    'https://z.ai',
+    'https://chat.z.ai',
+  ])
+  assert.ok(PROVIDER_NAVIGATION_CATALOG.zai.pagePatterns.some((page) => (
+    page.kind === 'conversation' && page.urlPattern === 'https://chat.z.ai/c/:conversationId'
+  )))
+})
+
+test('built capability routes stay provenance-bound to required live provider matrix cases', () => {
+  const matrix = loadLiveProviderCapabilityMatrix()
+  const result = spawnSync(process.execPath, [cliEntry, 'capabilities', 'list', '--json'], {
+    cwd: root,
+    encoding: 'utf8',
+  })
+  assert.equal(result.status, 0, result.stderr || result.stdout)
+  const payload = JSON.parse(result.stdout)
+  for (const capability of payload.capabilities) {
+    for (const route of capability.routes) {
+      const provider = matrix.providers[route.provider]
+      assert.ok(provider, `route provider ${route.provider} must exist in the live matrix`)
+      assert.ok(route.evidence.length > 0, `${route.provider}/${capability.id} must declare live evidence cases`)
+      for (const evidence of route.evidence) {
+        assert.ok(matrix.cases[evidence], `${route.provider}/${capability.id} references unknown live case ${evidence}`)
+        assert.ok(
+          provider.required.includes(evidence),
+          `${route.provider}/${capability.id} evidence ${evidence} must be required for that provider`,
+        )
+        assert.equal(provider.unavailable[evidence], undefined)
+      }
+    }
+  }
+})
+
+test('persistent config defaults, stores, and validates browser runtime fields through the filesystem boundary', async () => {
+  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-browser-connection-mode-'))
+  const runtime = await import('../packages/cli/dist/src/index.js')
+  try {
+    const defaults = await runtime.readTokenlessConfig(homeDir)
+    assert.equal(defaults.browserConnectionMode, 'playwright')
+    assert.equal(defaults.browserExecutablePath, null)
+    assert.deepEqual(defaults.providerWhitelist, [
+      'chatgpt',
+      'claude',
+      'grok',
+      'qwen',
+      'deepseek',
+      'perplexity',
+      'zai',
+      'doubao',
+    ])
+    assert.equal(Object.hasOwn(defaults, 'preferredProviders'), false)
+    assert.equal(
+      (await runtime.writeTokenlessConfig({ homeDir, browserConnectionMode: 'cdp' })).browserConnectionMode,
+      'cdp',
+    )
+    assert.equal((await runtime.readTokenlessConfig(homeDir)).browserConnectionMode, 'cdp')
+    const executablePath = path.join(homeDir, 'browsers', 'chrome')
+    await runtime.writeTokenlessConfig({ homeDir, browser: 'chrome', browserExecutablePath: executablePath })
+    assert.equal((await runtime.readTokenlessConfig(homeDir)).browserExecutablePath, executablePath)
+    await runtime.writeTokenlessConfig({ homeDir, browser: 'brave' })
+    assert.equal((await runtime.readTokenlessConfig(homeDir)).browserExecutablePath, null)
+    const managedExecutablePath = path.join(homeDir, 'browser', 'runtimes', 'managed-chromium', 'browser')
+    await runtime.writeTokenlessConfig({
+      homeDir,
+      browser: 'managed-chromium',
+      browserExecutablePath: managedExecutablePath,
+    })
+    assert.equal((await runtime.readTokenlessConfig(homeDir)).browserExecutablePath, managedExecutablePath)
+    await assert.rejects(
+      runtime.writeTokenlessConfig({
+        homeDir,
+        browser: 'managed-chromium',
+        browserExecutablePath: path.join(homeDir, 'outside-managed-runtime'),
+      }),
+      (error) => error?.code === 'tokenless_config_invalid',
+    )
+    await assert.rejects(
+      runtime.writeTokenlessConfig({ homeDir, browserConnectionMode: 'webdriver' }),
+      (error) => error?.code === 'tokenless_config_invalid',
+    )
+    await assert.rejects(
+      runtime.writeTokenlessConfig({ homeDir, browserExecutablePath: 'relative/browser' }),
+      (error) => error?.code === 'tokenless_config_invalid',
+    )
+  } finally {
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('persistent config migrates the legacy preferredProviders key to providerWhitelist', async () => {
+  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-provider-whitelist-migration-'))
+  const configPath = path.join(homeDir, 'config.json')
+  const runtime = await import('../packages/cli/dist/src/index.js')
+  try {
+    fs.writeFileSync(configPath, `${JSON.stringify({
+      protocol: 'tokenless.config.v1',
+      preferredProviders: ['gemini', 'chatgpt'],
+    }, null, 2)}\n`, { mode: 0o600 })
+    assert.deepEqual((await runtime.readTokenlessConfig(homeDir)).providerWhitelist, ['gemini', 'chatgpt'])
+
+    await runtime.writeTokenlessConfig({ homeDir, language: 'zh-CN' })
+    const persisted = JSON.parse(fs.readFileSync(configPath, 'utf8'))
+    assert.deepEqual(persisted.providerWhitelist, ['gemini', 'chatgpt'])
+    assert.equal(Object.hasOwn(persisted, 'preferredProviders'), false)
+  } finally {
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
 
 test('workspace packages keep standalone product names', () => {
   const cli = readJson('packages/cli/package.json')
@@ -26,7 +158,6 @@ test('workspace packages keep standalone product names', () => {
   assert.deepEqual(cli.bin, { tokenless: 'dist/src/tokenless.mjs' })
   assert.ok(!cli.name.startsWith('@tokenless/'))
   assert.equal(fs.existsSync(path.join(root, 'packages/extension')), false)
-  assert.equal(fs.existsSync(path.join(root, 'legacy/extension/package.json')), true)
 })
 
 test('CLI reports the installed package version through standard version flags', () => {
@@ -42,525 +173,402 @@ test('CLI reports the installed package version through standard version flags',
   }
 })
 
-test('universal CLI package contains JS only and declares exact platform runtime optionals', () => {
+test('CLI help separates canonical and advanced commands into described workflow groups', () => {
+  const result = spawnSync(process.execPath, [cliEntry, 'help'], {
+    cwd: root,
+    encoding: 'utf8',
+  })
+  assert.equal(result.status, 0, result.stderr || result.stdout)
+  assert.equal(result.stdout, '')
+
+  const advancedHeading = '\nAdvanced Usage:\n'
+  const advancedIndex = result.stderr.indexOf(advancedHeading)
+  assert.ok(advancedIndex > 0, 'advanced usage heading must follow canonical usage')
+  const canonicalUsage = result.stderr.slice(0, advancedIndex)
+  const advancedUsage = result.stderr.slice(advancedIndex + 1)
+  const expectedSections = ['Run', 'Setup', 'Profile', 'Provider', 'Other']
+  const sectionNames = (text) => [...text.matchAll(/^  ([^:\n]+):$/gm)].map((match) => match[1])
+
+  assert.match(canonicalUsage, /^Usage:\n  Canonical commands for everyday workflows\./)
+  assert.match(advancedUsage, /^Advanced Usage:\n  Less common commands for detailed control and maintenance\./)
+  assert.deepEqual(sectionNames(canonicalUsage), expectedSections)
+  assert.deepEqual(sectionNames(advancedUsage), expectedSections)
+  for (const description of [
+    'Send work through a visible AI provider.',
+    'Get Tokenless ready for first use.',
+    'Manage browser profiles and their sign-in sessions.',
+    'Manage AI providers and their visible controls.',
+    'Use miscellaneous maintenance and help commands.',
+    'Customize, inspect, resume, or cancel jobs.',
+    'Automate browser runtime and clean-profile setup.',
+    'Discover metadata or manage clean browser profiles.',
+    'Use low-level actions and provider-specific controls.',
+    'Inspect or update persistent Tokenless configuration.',
+  ]) {
+    assert.match(result.stderr, new RegExp(`^    ${description.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}$`, 'm'))
+  }
+
+  assert.match(canonicalUsage, /tokenless run --provider/)
+  assert.match(canonicalUsage, /tokenless capabilities list --json/)
+  assert.match(canonicalUsage, /tokenless run --capability <capability>/)
+  assert.match(canonicalUsage, /tokenless setup/)
+  assert.match(canonicalUsage, /tokenless profiles list/)
+  assert.match(canonicalUsage, /tokenless provider-status/)
+  assert.match(canonicalUsage, /tokenless doctor/)
+  assert.match(canonicalUsage, /tokenless upgrade/)
+  assert.match(canonicalUsage, /tokenless help/)
+  assert.match(canonicalUsage, /tokenless daemon stop \[--json\]/)
+  assert.doesNotMatch(result.stderr, /^  Daemon:$/m)
+  assert.doesNotMatch(canonicalUsage, /tokenless (provider-action|state|resume|cancel|snapshot-dom)/)
+  assert.doesNotMatch(canonicalUsage, /tokenless profiles (add|clear|reset|remove)/)
+  assert.match(advancedUsage, /tokenless provider-action/)
+  assert.match(advancedUsage, /tokenless state/)
+  assert.match(advancedUsage, /tokenless profiles remove/)
+  assert.match(advancedUsage, /tokenless config/)
+  assert.match(result.stderr, /^Short options:$/m)
+  assert.match(result.stderr, /^  -P, --profile <slug>        Select a managed browser profile\.$/m)
+  assert.match(result.stderr, /^  -p, --provider <provider>   Select an AI provider\.$/m)
+  assert.match(result.stderr, /^Command reference:$/m)
+  assert.match(result.stderr, /^  https:\/\/github\.com\/jazelly\/tokenless\/blob\/main\/COMMANDS\.md$/m)
+})
+
+test('CLI localizes human output from system setup locale and persistent language config', () => {
+  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-language-'))
+  try {
+    const systemLocalizedSetupHelp = runCli(['setup', '--help'], {
+      env: {
+        ...process.env,
+        TOKENLESS_HOME: homeDir,
+        LC_ALL: 'zh_CN.UTF-8',
+      },
+    })
+    assert.equal(systemLocalizedSetupHelp.status, 0, systemLocalizedSetupHelp.stderr)
+    assert.match(systemLocalizedSetupHelp.stderr, /^用法：$/m)
+    assert.match(systemLocalizedSetupHelp.stderr, /^通用选项：$/m)
+
+    const configured = runCli(['config', '--home', homeDir, '--language', 'zh-CN', '--json'])
+    assert.equal(configured.status, 0, configured.stderr || configured.stdout)
+    assert.equal(JSON.parse(configured.stdout).config.language, 'zh-CN')
+
+    const localizedHelp = runCli(['help'], {
+      env: { ...process.env, TOKENLESS_HOME: homeDir, LC_ALL: 'en_US.UTF-8' },
+    })
+    assert.equal(localizedHelp.status, 0, localizedHelp.stderr)
+    assert.match(localizedHelp.stderr, /^用法：$/m)
+    assert.match(localizedHelp.stderr, /^高级用法：$/m)
+    assert.match(localizedHelp.stderr, /选择托管浏览器 profile。/)
+    assert.match(localizedHelp.stderr, /tokenless run --provider/)
+    assert.match(localizedHelp.stderr, /COMMANDS\.zh-CN\.md/)
+
+    const localizedPrompt = runCli(['prompt', '--prompt', 'Summarize this.'], {
+      env: { ...process.env, TOKENLESS_HOME: homeDir },
+    })
+    assert.equal(localizedPrompt.status, 0, localizedPrompt.stderr)
+    assert.match(localizedPrompt.stdout, /^## Response Language$/m)
+    assert.match(localizedPrompt.stdout, /Respond in Simplified Chinese unless the user prompt explicitly requests another language\./)
+
+    const localizedError = runCli(['run', '--all'], {
+      env: { ...process.env, TOKENLESS_HOME: homeDir },
+    })
+    assert.equal(localizedError.status, 2)
+    assert.match(localizedError.stderr, /^错误： invalid_option: tokenless run 不接受选项：--all。/)
+    assert.match(localizedError.stderr, /^用法：$/m)
+  } finally {
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('CLI accepts distinct case-sensitive short options for profile and provider', () => {
+  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-short-options-')))
+  try {
+    const added = spawnSync(process.execPath, [
+      cliEntry,
+      'profiles',
+      'add',
+      '-P',
+      'work',
+      '--home',
+      homeDir,
+      '--json',
+    ], {
+      cwd: root,
+      encoding: 'utf8',
+    })
+    assert.equal(added.status, 0, added.stderr || added.stdout)
+    assert.equal(JSON.parse(added.stdout).profile.slug, 'work')
+
+    const status = spawnSync(process.execPath, [
+      cliEntry,
+      'profiles',
+      'status',
+      '-P',
+      'missing',
+      '-p',
+      'claude',
+      '--home',
+      homeDir,
+      '--json',
+    ], {
+      cwd: root,
+      encoding: 'utf8',
+    })
+    assert.equal(status.status, 1)
+    const payload = JSON.parse(status.stdout)
+    assert.equal(payload.error.code, 'profile_not_found')
+    assert.match(payload.error.message, /missing/)
+  } finally {
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('daemon stop accepts only daemon stop options and positive integer timeout', () => {
+  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-daemon-stop-args-'))
+  try {
+    for (const [args, expectedStatus, expectedCode] of [
+      [['daemon', 'stop', '--home', homeDir, '--provider', 'chatgpt', '--json'], 2, 'invalid_option'],
+      [['daemon', 'stop', '--home', homeDir, '--timeout-ms', '1.5', '--json'], 1, 'invalid_timeout'],
+    ]) {
+      const result = spawnSync(process.execPath, [cliEntry, ...args], {
+        cwd: root,
+        encoding: 'utf8',
+      })
+      assert.equal(result.status, expectedStatus)
+      const payload = JSON.parse(result.stdout)
+      assert.equal(payload.ok, false)
+      assert.equal(payload.error.code, expectedCode)
+    }
+  } finally {
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('CLI rejects misspelled, unknown, and wrong-command options with usage before side effects', () => {
+  const humanInvalid = runCli(['run', '--all'])
+  assert.equal(humanInvalid.status, 2)
+  assert.equal(humanInvalid.stdout, '')
+  assert.match(humanInvalid.stderr, /^error: invalid_option: tokenless run does not accept option: --all\./)
+  assert.match(humanInvalid.stderr, /^Usage:$/m)
+  assert.match(humanInvalid.stderr, /^  tokenless run \[--capability <capability>\] --provider/m)
+  assert.match(humanInvalid.stderr, /^Common options:$/m)
+  assert.match(humanInvalid.stderr, /^  -h, --help$/m)
+
+  const jsonInvalid = runCli(['run', '--all', '--json'])
+  assert.equal(jsonInvalid.status, 2)
+  assert.equal(jsonInvalid.stderr, '')
+  const jsonInvalidPayload = JSON.parse(jsonInvalid.stdout)
+  assert.equal(jsonInvalidPayload.error.code, 'invalid_option')
+  assert.deepEqual(jsonInvalidPayload.error.usage.invalidOptions, ['--all'])
+  assert.ok(jsonInvalidPayload.error.usage.usage.some((line) => line.startsWith('tokenless run ')))
+  assert.ok(jsonInvalidPayload.error.usage.commonOptions.includes('-h, --help'))
+
+  const misspelled = runCli(['run', '--profle', 'default', '--json'])
+  assert.equal(misspelled.status, 2)
+  const misspelledPayload = JSON.parse(misspelled.stdout)
+  assert.equal(misspelledPayload.error.code, 'unknown_argument')
+  assert.deepEqual(misspelledPayload.error.usage.invalidOptions, ['--profle'])
+  assert.ok(misspelledPayload.error.usage.commonOptions.includes('-h, --help'))
+
+  const unknownCommand = runCli(['frobnicate'])
+  assert.equal(unknownCommand.status, 2)
+  assert.equal(unknownCommand.stdout, '')
+  assert.match(unknownCommand.stderr, /^error: unknown_command: Unknown Tokenless command: frobnicate\./)
+  assert.match(unknownCommand.stderr, /^Usage:$/m)
+  assert.match(unknownCommand.stderr, /^Common options:$/m)
+  assert.match(unknownCommand.stderr, /^Valid commands:$/m)
+
+  const unknownCommandJson = runCli(['frobnicate', '--json'])
+  assert.equal(unknownCommandJson.status, 2)
+  assert.equal(unknownCommandJson.stderr, '')
+  const unknownCommandPayload = JSON.parse(unknownCommandJson.stdout)
+  assert.equal(unknownCommandPayload.error.code, 'unknown_command')
+  assert.ok(unknownCommandPayload.error.usage.usage.some((line) => line.includes('tokenless <command>')))
+  assert.ok(unknownCommandPayload.error.usage.commonOptions.includes('-h, --help'))
+  assert.ok(unknownCommandPayload.error.usage.validCommands.includes('run'))
+
+  const nestedCommand = runCli(['profiles', 'wat', '--json'])
+  assert.equal(nestedCommand.status, 2)
+  assert.equal(nestedCommand.stderr, '')
+  const nestedPayload = JSON.parse(nestedCommand.stdout)
+  assert.equal(nestedPayload.error.code, 'profiles_command_invalid')
+  assert.ok(nestedPayload.error.usage.usage.some((line) => line.startsWith('tokenless profiles list')))
+  assert.ok(nestedPayload.error.usage.commonOptions.includes('-h, --help'))
+  assert.ok(nestedPayload.error.usage.validCommands.includes('status'))
+
+  for (const args of [
+    ['help', '--profile', 'default'],
+    ['version', '--profile', 'default'],
+    ['run', '--all'],
+    ['provider-status', '--all'],
+    ['provider-auth-status', '--all'],
+    ['provider-action', '--all'],
+    ['provider-controls', '--all'],
+    ['inspect-provider-controls', '--all'],
+    ['provider-configure', '--all'],
+    ['chatgpt-controls', '--all'],
+    ['inspect-chatgpt-controls', '--all'],
+    ['chatgpt-configure', '--all'],
+    ['snapshot-dom', '--all'],
+    ['state', '--all'],
+    ['status', '--all'],
+    ['resume', '--all'],
+    ['cancel', '--all'],
+    ['setup', '--provider', 'chatgpt'],
+    ['install', '--provider', 'chatgpt'],
+    ['upgrade', '--provider', 'chatgpt'],
+    ['doctor', '--provider', 'chatgpt'],
+    ['config', '--provider', 'chatgpt'],
+    ['prompt', '--provider', 'chatgpt'],
+    ['profiles', 'add', '--action', 'prompt.submit'],
+    ['profiles', 'clear', '--action', 'prompt.submit'],
+    ['profiles', 'discover', '--profile', 'default'],
+    ['profiles', 'list', '--profile', 'default'],
+    ['profiles', 'reset', '--action', 'prompt.submit'],
+    ['profiles', 'status', '--all'],
+    ['profiles', 'open', '--all'],
+    ['profiles', 'set-default', '--provider', 'chatgpt'],
+    ['profiles', 'remove', '--provider', 'chatgpt'],
+    ['daemon', 'stop', '--provider', 'chatgpt'],
+  ]) {
+    const result = runCli(args)
+    assert.equal(result.status, 2, `${args.join(' ')}\nstdout:\n${result.stdout}\nstderr:\n${result.stderr}`)
+    assert.equal(result.stdout, '')
+    assert.match(result.stderr, /^error: invalid_option:/, args.join(' '))
+    assert.match(result.stderr, /^Usage:$/m, args.join(' '))
+    assert.match(result.stderr, /^Common options:$/m, args.join(' '))
+    assert.match(result.stderr, /^  -h, --help$/m, args.join(' '))
+  }
+})
+
+test('CLI command help is a supported common option for commands and subcommands', () => {
+  for (const args of [
+    ['--help'],
+    ['run', '--help'],
+    ['profiles', '--help'],
+    ['profiles', 'status', '--help'],
+    ['daemon', '--help'],
+    ['daemon', 'stop', '--help'],
+  ]) {
+    const result = runCli(args)
+    assert.equal(result.status, 0, `${args.join(' ')}\nstdout:\n${result.stdout}\nstderr:\n${result.stderr}`)
+    assert.equal(result.stdout, '')
+    assert.match(result.stderr, /^Usage:$/m)
+    assert.match(result.stderr, /^Common options:$/m)
+    assert.match(result.stderr, /^  -h, --help$/m)
+  }
+})
+
+test('universal CLI manifest declares the pure JS runtime without native optionals', () => {
   const pkg = readJson('packages/cli/package.json')
   assert.equal(pkg.dependencies['@tokenless/playwright'], undefined)
   assert.equal(typeof pkg.dependencies['playwright-core'], 'string')
-  assert.match(pkg.scripts.build, /build:native/)
-  assert.match(pkg.scripts['build:native'], /build-rust-binaries\.mjs/)
-  assert.doesNotMatch(pkg.scripts.prepack, /build-rust-binaries/)
   assert.equal(pkg.files.includes('dist/bin'), false)
-  assert.deepEqual(pkg.optionalDependencies, Object.fromEntries(
-    nativeTuples.map(([platform, arch]) => [`tokenless-native-${platform}-${arch}`, pkg.version])
-  ))
-  assert.equal(Object.values(pkg.optionalDependencies).some((version) => version.startsWith('workspace:')), false)
+  assert.equal(pkg.optionalDependencies, undefined)
+  assert.equal(pkg.scripts['build:native'], undefined)
   assert.equal(fs.existsSync(path.join(cliDir, 'dist/src/native-host.mjs')), false)
-  assert.equal(fs.existsSync(path.join(cliDir, 'src/native-host.mts')), false)
   assert.equal(fs.existsSync(path.join(cliDir, 'dist/src/direct')), false)
-  assert.equal(fs.existsSync(path.join(cliDir, 'src/direct')), false)
-
-  const output = execFileSync('npm', ['pack', '--dry-run', '--json'], { cwd: cliDir, encoding: 'utf8' })
-  const [pack] = JSON.parse(output)
-  const paths = pack.files.map((file) => file.path)
-  assert.equal(paths.some((file) => file.startsWith('dist/bin/') || file.startsWith('npm/')), false)
-  assert.ok(paths.includes('dist/src/tokenless.mjs'))
-  assert.ok(paths.includes('dist/src/playwright/index.js'))
-  assert.ok(paths.includes('dist/src/playwright/index.d.ts'))
-  assert.ok(paths.includes('dist/src/playwright/runner-entry.mjs'))
-  assert.ok(paths.includes('README.md'))
-  assert.equal(paths.some((file) => /native-host\.mjs$/.test(file)), false)
-  assert.equal(paths.some((file) => file.startsWith('dist/src/direct/')), false)
-
-  const compiledStore = fs.readFileSync(path.join(cliDir, 'dist/src/job-store.js'), 'utf8')
-  for (const legacyName of [
-    'tokenless.local-job',
-    'conversation-map',
-    'createLocalJob',
-    'readLocalTaskState',
-    'waitLocalJobResult',
-    'conversations.json',
-    "path.join(homeDir, 'jobs')",
-  ]) {
-    assert.doesNotMatch(compiledStore, new RegExp(legacyName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')))
-  }
 })
 
-test('public manifests do not reference unpublished scoped Tokenless runtime packages', () => {
-  const publicManifests = [
-    readJson('packages/cli/package.json'),
-    ...nativeTuples.map(([platform, arch]) => readJson(`packages/cli/npm/tokenless-native-${platform}-${arch}/package.json`)),
-  ]
-  for (const manifest of publicManifests) {
-    for (const field of ['dependencies', 'optionalDependencies', 'peerDependencies']) {
-      for (const packageName of Object.keys(manifest[field] ?? {})) {
-        assert.notEqual(packageName, '@tokenless/playwright')
-        assert.equal(packageName.startsWith('@tokenless/'), false, `${manifest.name} must not publish ${field}.${packageName}`)
-      }
+test('public manifests and lockfile do not reference unpublished scoped or native Tokenless packages', () => {
+  const manifest = readJson('packages/cli/package.json')
+  for (const field of ['dependencies', 'optionalDependencies', 'peerDependencies']) {
+    for (const packageName of Object.keys(manifest[field] ?? {})) {
+      assert.notEqual(packageName, '@tokenless/playwright')
+      assert.equal(packageName.startsWith('@tokenless/'), false, `${manifest.name} must not publish ${field}.${packageName}`)
+      assert.equal(packageName.startsWith('tokenless-native-'), false, `${manifest.name} must not depend on ${packageName}`)
     }
   }
 
   const rootPackage = readJson('package.json')
   assert.equal(rootPackage.workspaces.includes('packages/playwright'), false)
+  assert.equal(rootPackage.workspaces.includes('packages/cli/npm/*'), false)
 
   const lock = readJson('package-lock.json')
+  assert.equal(lock.packages['packages/cli'].optionalDependencies, undefined)
   for (const [packagePath, entry] of Object.entries(lock.packages)) {
     assert.notEqual(entry.name, '@tokenless/playwright', `${packagePath} must not be a scoped Playwright package`)
     assert.equal(packagePath.includes('@tokenless/playwright'), false)
+    assert.equal(entry.name?.startsWith?.('tokenless-native-') ?? false, false, `${packagePath} must not be a native runtime package`)
+    assert.equal(packagePath.includes('tokenless-native-'), false)
     for (const field of ['dependencies', 'optionalDependencies', 'peerDependencies']) {
       assert.equal(entry[field]?.['@tokenless/playwright'], undefined, `${packagePath} must not depend on @tokenless/playwright`)
+      for (const packageName of Object.keys(entry[field] ?? {})) {
+        assert.equal(packageName.startsWith('tokenless-native-'), false, `${packagePath} must not depend on ${packageName}`)
+      }
     }
   }
 })
 
-test('root lockfile records every optional native runtime without foreign-platform workspaces', () => {
-  const rootPackage = readJson('package.json')
-  const lock = readJson('package-lock.json')
-  const cliPackage = readJson('packages/cli/package.json')
-  assert.equal(rootPackage.workspaces.includes('packages/cli/npm/*'), false)
-  assert.deepEqual(lock.packages['packages/cli'].optionalDependencies, cliPackage.optionalDependencies)
-  for (const packageName of Object.keys(cliPackage.optionalDependencies)) {
-    const packageLockEntry = lock.packages[`packages/cli/node_modules/${packageName}`] ??
-      lock.packages[`node_modules/${packageName}`]
-    assert.equal(packageLockEntry?.optional, true)
-    assert.equal(packageLockEntry?.version, cliPackage.version)
-  }
-})
-
-test('all supported tuples resolve to strict local native package manifests', async () => {
-  const {
-    NATIVE_PLATFORM_PACKAGE_PROTOCOL,
-    nativePlatformPackageName,
-    resolveNativePlatformPackage,
-  } = await importCli()
-  for (const [platform, arch] of nativeTuples) {
-    const expectedName = `tokenless-native-${platform}-${arch}`
-    assert.equal(nativePlatformPackageName(platform, arch), expectedName)
-    const resolved = resolveNativePlatformPackage({
-      platform,
-      arch,
-      expectedVersion: readJson('packages/cli/package.json').version,
-      resolvePackageJson: (packageName) => path.join(cliDir, 'npm', packageName, 'package.json'),
-    })
-    assert.equal(resolved.name, expectedName)
-    const manifest = JSON.parse(fs.readFileSync(resolved.manifestPath, 'utf8'))
-    assert.deepEqual(manifest.os, [platform])
-    assert.deepEqual(manifest.cpu, [arch])
-    assert.equal(manifest.tokenlessRuntime.protocol, NATIVE_PLATFORM_PACKAGE_PROTOCOL)
-    assert.deepEqual(manifest.exports, { './package.json': './package.json' })
-    assert.match(manifest.scripts.prepack, /verify-native-package\.mjs/)
-    for (const lifecycle of ['preinstall', 'install', 'postinstall']) {
-      assert.equal(manifest.scripts[lifecycle], undefined)
-    }
-  }
-  assert.throws(
-    () => nativePlatformPackageName('aix', 'ppc64'),
-    (error) => error.code === 'unsupported_native_platform' && /darwin-arm64.*win32-x64/.test(error.message)
-  )
-})
-
-test('native package verifier proves binary role, version, and normalized target tuple', async () => {
-  const packageName = `tokenless-native-${process.platform}-${process.arch}`
-  const nativePackageDir = path.join(cliDir, 'npm', packageName)
-  const verifier = path.join(cliDir, 'scripts/verify-native-package.mjs')
-  const manifest = JSON.parse(fs.readFileSync(path.join(nativePackageDir, 'package.json'), 'utf8'))
-  const verification = await import(`${pathToFileURL(verifier).href}?verification=${Date.now()}`)
-  const expectedKeys = ['arch', 'binary', 'platform', 'protocol', 'version']
-
-  for (const binary of ['tokenless-daemon']) {
-    const executable = path.join(nativePackageDir, 'bin', `${binary}${executableSuffix}`)
-    const buildInfo = JSON.parse(execFileSync(executable, ['--tokenless-build-info'], {
-      encoding: 'utf8',
-      timeout: 5_000,
-    }))
-    assert.deepEqual(Object.keys(buildInfo).sort(), expectedKeys)
-    assert.deepEqual(buildInfo, {
-      protocol: verification.NATIVE_BINARY_BUILD_INFO_PROTOCOL,
-      binary,
-      version: manifest.version,
-      platform: process.platform,
-      arch: process.arch,
-    })
-    assert.throws(
-      () => verification.validateNativeBuildInfo({ ...buildInfo, version: '0.0.0-stale' }, buildInfo),
-      /build identity mismatch/
-    )
-  }
-
-  const verified = spawnSync(process.execPath, [verifier], { cwd: nativePackageDir, encoding: 'utf8' })
-  assert.equal(verified.status, 0, verified.stderr)
-
-  const swappedPackageDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-native-swapped-'))
-  try {
-    fs.copyFileSync(path.join(nativePackageDir, 'package.json'), path.join(swappedPackageDir, 'package.json'))
-    fs.mkdirSync(path.join(swappedPackageDir, 'bin'))
-    const daemon = path.join(nativePackageDir, 'bin', `tokenless-daemon${executableSuffix}`)
-    const swappedDaemon = path.join(swappedPackageDir, 'bin', `tokenless-daemon${executableSuffix}`)
-    // Corrupt the build-info role by writing an empty executable placeholder when possible.
-    fs.writeFileSync(swappedDaemon, fs.readFileSync(daemon))
-    if (process.platform !== 'win32') fs.chmodSync(swappedDaemon, 0o755)
-    const buildInfo = JSON.parse(execFileSync(swappedDaemon, ['--tokenless-build-info'], {
-      encoding: 'utf8',
-      timeout: 5_000,
-    }))
-    assert.throws(
-      () => verification.validateNativeBuildInfo({ ...buildInfo, binary: 'tokenless-native-host' }, {
-        ...buildInfo,
-        binary: 'tokenless-daemon',
-      }),
-      /build identity mismatch/
-    )
-  } finally {
-    fs.rmSync(swappedPackageDir, { recursive: true, force: true })
-  }
-})
-
-test('current platform runtime and universal CLI truly pack, install, and resolve without Rust lifecycle scripts', async () => {
-  const packageName = `tokenless-native-${process.platform}-${process.arch}`
-  const nativePackageDir = path.join(cliDir, 'npm', packageName)
+test('pure JS CLI packs, installs, and exposes executable runtime artifacts', () => {
   const packDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-pack-tarballs-'))
   const installDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-pack-install-'))
-  const runtimeHome = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-pack-runtime-'))
-  const manifestHome = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-pack-manifest-'))
   let universalTarball
-  let nativeTarball
+  let playwrightCoreTarball
   try {
     const universalPack = npmPack(cliDir, packDir)
-    const nativePack = npmPack(nativePackageDir, packDir)
+    const playwrightCorePack = npmPack(path.join(root, 'node_modules', 'playwright-core'), packDir)
     universalTarball = path.join(packDir, universalPack.filename)
-    nativeTarball = path.join(packDir, nativePack.filename)
+    playwrightCoreTarball = path.join(packDir, playwrightCorePack.filename)
     assert.ok(universalPack.files.some((file) => file.path === 'dist/src/playwright/index.js'))
-    assert.ok(universalPack.files.some((file) => file.path === 'dist/src/playwright/runner-entry.mjs'))
-    const nativePaths = nativePack.files.map((file) => file.path)
-    assert.ok(nativePaths.includes(`bin/tokenless-daemon${executableSuffix}`))
-    assert.equal(nativePaths.includes(`bin/tokenless-native-host${executableSuffix}`), false)
+    assert.ok(universalPack.files.some((file) => file.path === 'dist/src/playwright/index.d.ts'))
+    assert.ok(universalPack.files.some((file) => file.path === 'dist/src/daemon/daemon-entry.mjs'))
+    assert.ok(universalPack.files.some((file) => file.path === 'dist/src/tokenless.mjs'))
+    assert.ok(universalPack.files.some((file) => file.path === 'dist/src/daemon/ui/index.html'))
+    assert.ok(universalPack.files.some((file) => file.path === 'dist/src/daemon/ui/app.js'))
+    assert.ok(universalPack.files.some((file) => file.path === 'dist/src/daemon/ui/styles.css'))
+    assert.ok(universalPack.files.some((file) => file.path === 'dist/src/daemon/ui/mark.png'))
+    assert.equal(universalPack.files.some((file) => file.path === 'dist/src/daemon/ui/dashboard.js'), false)
+    assert.equal(universalPack.files.some((file) => file.path.startsWith('dist/src/daemon/ui/pages/')), false)
+    assert.ok(universalPack.files.some((file) => file.path === 'README.md'))
+    assert.equal(universalPack.files.some((file) => file.path === 'dist/src/playwright/runner-entry.mjs'), false)
     assert.equal(universalPack.files.some((file) => file.path.startsWith('dist/bin/')), false)
+    assert.equal(universalPack.files.some((file) => file.path.startsWith('npm/')), false)
+    assert.equal(universalPack.files.some((file) => /native-host\.mjs$/.test(file.path)), false)
+    assert.equal(universalPack.files.some((file) => file.path.startsWith('dist/src/direct/')), false)
 
-    execFileSync('npm', [
+    npmExecFileSync([
       'install',
       universalTarball,
-      nativeTarball,
+      playwrightCoreTarball,
       '--prefix',
       installDir,
       '--omit=optional',
       '--offline',
       '--no-audit',
       '--no-fund',
-    ], { encoding: 'utf8' })
+    ])
 
     const installedCli = path.join(installDir, 'node_modules', 'tokenless')
-    const installedNative = path.join(installDir, 'node_modules', packageName)
+    const installedDaemonEntry = path.join(installedCli, 'dist', 'src', 'daemon', 'daemon-entry.mjs')
     assert.equal(fs.existsSync(path.join(installedCli, 'dist', 'bin')), false)
     assert.equal(fs.existsSync(path.join(installedCli, 'dist', 'src', 'playwright', 'index.js')), true)
-    assert.equal(fs.existsSync(path.join(installedCli, 'dist', 'src', 'playwright', 'runner-entry.mjs')), true)
+    assert.equal(fs.existsSync(path.join(installedCli, 'dist', 'src', 'playwright', 'runner-entry.mjs')), false)
     assert.equal(fs.existsSync(path.join(installDir, 'node_modules', '@tokenless', 'playwright')), false)
-    assert.equal(fs.existsSync(path.join(installedNative, 'bin', `tokenless-daemon${executableSuffix}`)), true)
+    assert.equal(fs.existsSync(path.join(installDir, 'node_modules', 'tokenless-native-darwin-arm64')), false)
+    assert.equal(fs.existsSync(installedDaemonEntry), true)
+
+    const buildInfo = JSON.parse(execFileSync(process.execPath, [installedDaemonEntry, '--tokenless-build-info'], {
+      encoding: 'utf8',
+      timeout: 5_000,
+    }))
+    assert.equal(Object.hasOwn(buildInfo, 'protocol'), false)
+    assert.equal(buildInfo.binary, 'tokenless-daemon')
+    assert.equal(buildInfo.version, readJson('packages/cli/package.json').version)
+
     if (process.platform !== 'win32') {
       const installedBin = path.join(installDir, 'node_modules', '.bin', 'tokenless')
       assert.ok((fs.statSync(installedBin).mode & 0o111) !== 0, 'npm bin target must be executable')
       const cliHelp = spawnSync(installedBin, ['help'], { cwd: installDir, encoding: 'utf8' })
       assert.equal(cliHelp.status, 0, cliHelp.stderr || cliHelp.stdout)
     }
-    const exports = await import(`${pathToFileURL(path.join(installedCli, 'dist/src/index.js')).href}?smoke=${Date.now()}`)
-    const resolved = exports.resolveNativePlatformPackage()
-    assert.equal(fs.realpathSync(resolved.root), fs.realpathSync(installedNative))
-    assert.equal(exports.bundledRustBinaryPath('tokenless-daemon'), path.join(resolved.root, 'bin', `tokenless-daemon${executableSuffix}`))
-
-    const installed = await exports.installRustRuntime({
-      homeDir: runtimeHome,
-    })
-    assert.equal(fs.existsSync(installed.daemonExecutable), true)
-    assert.equal(installed.nativeHostExecutable, undefined)
   } finally {
     if (universalTarball) fs.rmSync(universalTarball, { force: true })
-    if (nativeTarball) fs.rmSync(nativeTarball, { force: true })
+    if (playwrightCoreTarball) fs.rmSync(playwrightCoreTarball, { force: true })
     fs.rmSync(packDir, { recursive: true, force: true })
     fs.rmSync(installDir, { recursive: true, force: true })
-    fs.rmSync(runtimeHome, { recursive: true, force: true })
-    fs.rmSync(manifestHome, { recursive: true, force: true })
   }
 })
 
-test('Rust runtime install copies the daemon executable only', async () => {
-  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-rust-install-'))
-  try {
-    const { installRustRuntime } = await importCli()
-    const installed = await installRustRuntime({ homeDir })
-    assert.equal(installed.runtime, 'rust')
-    assert.equal(path.basename(installed.daemonExecutable), `tokenless-daemon${executableSuffix}`)
-    assert.equal(fs.statSync(installed.daemonExecutable).isFile(), true)
-    assert.equal(installed.nativeHostExecutable, undefined)
-    assert.equal(fs.existsSync(path.join(homeDir, 'bin', 'tokenless-native-host')), false)
-    assert.equal(fs.existsSync(path.join(homeDir, 'bin', 'tokenless-native-host.exe')), false)
-  } finally {
-    fs.rmSync(homeDir, { recursive: true, force: true })
-  }
-})
-
-test('Windows native-host registration commands are per selected browser and HKCU-only', async () => {
-  const { windowsNativeHostRegistryCommands, NATIVE_HOST_NAME } = await importCli()
-  const manifestPath = 'C:\\Users\\me\\.tokenless\\native-messaging\\host.json'
-  const commands = windowsNativeHostRegistryCommands({
-    manifestPath,
-    browsers: ['chrome', 'chrome-for-testing', 'edge', 'brave'],
-  })
-  assert.equal(commands.length, 3, 'Chrome and Chrome for Testing share one registry key')
-  for (const command of commands) {
-    assert.equal(command[0], 'reg.exe')
-    assert.equal(command[1], 'ADD')
-    assert.match(command[2], /^HKCU\\Software\\/)
-    assert.match(command[2], new RegExp(`${NATIVE_HOST_NAME}$`))
-    assert.deepEqual(command.slice(-3), ['/d', manifestPath, '/f'])
-  }
-})
-
-test('Chrome for Testing installs current and pre-146 native manifest compatibility paths', async () => {
-  const { nativeMessagingHostDirs } = await importCli()
-  assert.deepEqual(nativeMessagingHostDirs('chrome-for-testing', '/Users/test', 'darwin'), [
-    '/Users/test/Library/Application Support/Google/ChromeForTesting/NativeMessagingHosts',
-    '/Users/test/Library/Application Support/Google/Chrome/NativeMessagingHosts',
-  ])
-  assert.deepEqual(nativeMessagingHostDirs('chrome-for-testing', '/home/test', 'linux'), [
-    '/home/test/.config/google-chrome-for-testing/NativeMessagingHosts',
-    '/home/test/.config/google-chrome/NativeMessagingHosts',
-  ])
-})
-
-test('CLI canonicalizes the legacy Chrome for Testing config identifier', async () => {
-  const { normalizeBrowserId } = await importCli()
-  assert.equal(normalizeBrowserId('chrome-for-testing-legacy'), 'chrome-for-testing')
-})
-
-test('CLI config preserves Grok as a visible preferred provider', async () => {
-  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-grok-config-'))
-  const { readTokenlessConfig, writeTokenlessConfig } = await importCli()
-  try {
-    const written = await writeTokenlessConfig({
-      homeDir,
-      preferredProviders: [' GROK ', 'chatgpt', 'grok', 'unsupported'],
-    })
-    assert.deepEqual(written.preferredProviders, ['grok', 'chatgpt'])
-    assert.deepEqual((await readTokenlessConfig(homeDir)).preferredProviders, ['grok', 'chatgpt'])
-  } finally {
-    fs.rmSync(homeDir, { recursive: true, force: true })
-  }
-})
-
-test('CLI config defaults and preserves browser visibility policy', async () => {
-  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-visibility-config-'))
-  const { readTokenlessConfig, writeTokenlessConfig } = await importCli()
-  try {
-    assert.equal((await readTokenlessConfig(homeDir)).browserVisibility, 'auto')
-    const written = await writeTokenlessConfig({
-      homeDir,
-      browserVisibility: ' HEADLESS ',
-    })
-    assert.equal(written.browserVisibility, 'headless')
-    await writeTokenlessConfig({ homeDir, preferredProviders: ['chatgpt'] })
-    assert.equal((await readTokenlessConfig(homeDir)).browserVisibility, 'headless')
-    await assert.rejects(
-      () => writeTokenlessConfig({ homeDir, browserVisibility: 'hidden' }),
-      (error) => error?.code === 'tokenless_config_invalid'
-    )
-  } finally {
-    fs.rmSync(homeDir, { recursive: true, force: true })
-  }
-})
-
-test('file collection rejects lexical and symlink escapes from the canonical project root', {
-  skip: process.platform === 'win32' && 'Creating symlinks may require Developer Mode on Windows.',
-}, async () => {
-  const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-file-containment-'))
-  const projectRoot = path.join(temp, 'project')
-  const outside = path.join(temp, 'outside.txt')
-  fs.mkdirSync(projectRoot)
-  fs.writeFileSync(path.join(projectRoot, 'inside.txt'), 'safe')
-  fs.writeFileSync(outside, 'must not escape')
-  fs.symlinkSync(outside, path.join(projectRoot, 'escape.txt'))
-  try {
-    const { collectFiles } = await importCli()
-    assert.deepEqual(await collectFiles(projectRoot, ['inside.txt'], 1024, 1024), [{
-      path: 'inside.txt',
-      truncated: false,
-      text: 'safe',
-    }])
-    await assert.rejects(
-      collectFiles(projectRoot, ['../outside.txt'], 1024, 1024),
-      /outside project root/
-    )
-    await assert.rejects(
-      collectFiles(projectRoot, ['escape.txt'], 1024, 1024),
-      /resolves outside project root/
-    )
-
-    const slot = path.join(projectRoot, 'slot')
-    const savedSlot = path.join(projectRoot, 'slot-safe')
-    const outsideDir = path.join(temp, 'outside-dir')
-    fs.mkdirSync(slot)
-    fs.mkdirSync(outsideDir)
-    fs.writeFileSync(path.join(slot, 'race.txt'), 'inside')
-    fs.writeFileSync(path.join(outsideDir, 'race.txt'), 'OUTSIDE_SECRET')
-    const originalRealpath = fsPromises.realpath
-    const originalOpen = fsPromises.open
-    let swapped = false
-    let readCalls = 0
-    fsPromises.realpath = async (...arguments_) => {
-      const resolved = await originalRealpath(...arguments_)
-      if (!swapped && path.resolve(String(arguments_[0])) === path.join(slot, 'race.txt')) {
-        swapped = true
-        fs.renameSync(slot, savedSlot)
-        fs.symlinkSync(outsideDir, slot, 'dir')
-      }
-      return resolved
-    }
-    fsPromises.open = async (...arguments_) => {
-      const handle = await originalOpen(...arguments_)
-      const originalRead = handle.read.bind(handle)
-      handle.read = async (...readArguments) => {
-        readCalls += 1
-        return originalRead(...readArguments)
-      }
-      return handle
-    }
-    try {
-      await assert.rejects(
-        collectFiles(projectRoot, ['slot/race.txt'], 1024, 1024),
-        /outside project root|changed while enforcing/
-      )
-      assert.equal(readCalls, 0, 'outside file contents must not be read before containment is verified')
-    } finally {
-      fsPromises.realpath = originalRealpath
-      fsPromises.open = originalOpen
-    }
-  } finally {
-    fs.rmSync(temp, { recursive: true, force: true })
-  }
-})
-
-test('public CLI exports daemon/runtime APIs but not obsolete removed APIs', async () => {
-  const exports = await importCli()
-  for (const name of [
-    'ensureDaemonReady',
-    'installRustRuntime',
-    'readLiveBridgeMarker',
-    'listDaemonJobs',
-    'cancelDaemonJob',
-    'resumeDaemonJob',
-    'providerWakeUrl',
-  ]) {
-    assert.equal(typeof exports[name], 'function', `${name} should be public`)
-  }
-  for (const name of [
-    'buildTaskUrl',
-    'createLocalJob',
-    'readLocalTaskState',
-    'waitLocalJobResult',
-    `execute${'Direct'}Run`,
-    `resolve${'Direct'}Backend`,
-    `execute${'Direct'}Api`,
-    `start${'Direct'}Broker`,
-    `${'Direct'}Error`,
-    `${'DIRECT'}_PROTOCOL`,
-    `${'DIRECT'}_BROKER_PROTOCOL`,
-  ]) {
-    assert.equal(exports[name], undefined, `${name} should not remain a public product API`)
-  }
-})
-
-test('provider wake URL accepts selected-provider HTTPS only', async () => {
-  const { openProviderUrl, providerWakeUrl } = await importCli()
-  assert.equal(providerWakeUrl('chatgpt'), 'https://chatgpt.com/')
-  assert.equal(providerWakeUrl('claude'), 'https://claude.ai/new')
-  assert.equal(providerWakeUrl('gemini'), 'https://gemini.google.com/app')
-  assert.equal(providerWakeUrl('grok'), 'https://grok.com/')
-  assert.equal(providerWakeUrl('chatgpt', 'https://chatgpt.com/c/123'), 'https://chatgpt.com/c/123')
-  assert.equal(
-    providerWakeUrl('grok', 'https://grok.com/c/6ab0dd2c-ea15-4eff-a0b2-87fa149c98cd'),
-    'https://grok.com/c/6ab0dd2c-ea15-4eff-a0b2-87fa149c98cd'
-  )
-  assert.throws(() => providerWakeUrl('chatgpt', 'http://chatgpt.com/c/123'), /HTTPS/)
-  assert.throws(() => providerWakeUrl('chatgpt', 'https://example.com/steal'), /selected chatgpt provider/)
-  assert.throws(() => providerWakeUrl('claude', 'https://chatgpt.com/'), /selected claude provider/)
-  assert.throws(() => providerWakeUrl('grok', 'https://x.com/'), /selected grok provider/)
-  await assert.rejects(
-    openProviderUrl('https://example.com/', {
-      browser: 'profile',
-      command: '/definitely/not/executed',
-      argsPrefix: [],
-      displayName: 'test',
-    }),
-    /allowlisted ChatGPT, Claude, Gemini, or Grok/
-  )
-})
-
-test('bridge marker reader accepts only the exact current protocol and path', async () => {
-  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-marker-contract-'))
-  const markerPath = path.join(homeDir, 'extension-bridge.json')
-  const { EXTENSION_BRIDGE_PROTOCOL, readLiveBridgeMarker } = await importCli()
-  try {
-    for (const protocol of [undefined, 'tokenless.native.v1', 'tokenless.native-bridge.v1']) {
-      fs.writeFileSync(markerPath, JSON.stringify({
-        protocol,
-        pid: process.pid,
-        sessionId: 'legacy',
-        connectedAt: new Date().toISOString(),
-        heartbeatAt: new Date().toISOString(),
-      }))
-      assert.equal(await readLiveBridgeMarker({ homeDir }), null)
-    }
-    const valid = {
-      protocol: EXTENSION_BRIDGE_PROTOCOL,
-      pid: process.pid,
-      sessionId: 'current',
-      connectedAt: new Date().toISOString(),
-      heartbeatAt: new Date().toISOString(),
-    }
-    for (const invalid of [
-      { ...valid, connectedAt: undefined },
-      { ...valid, heartbeatAt: undefined },
-      { ...valid, session_id: valid.sessionId },
-      { ...valid, extra: true },
-      { ...valid, pid: 2_147_483_647 },
-      { ...valid, connectedAt: 'not-an-iso-date' },
-      { ...valid, connectedAt: '2026-02-30T00:00:00.000Z' },
-      { ...valid, heartbeatAt: new Date(Date.now() + 60_000).toISOString() },
-      {
-        ...valid,
-        connectedAt: new Date(Date.now() + 20_000).toISOString(),
-        heartbeatAt: new Date().toISOString(),
-      },
-    ]) {
-      fs.writeFileSync(markerPath, JSON.stringify(invalid))
-      assert.equal(await readLiveBridgeMarker({ homeDir }), null)
-    }
-    for (const invalidJson of ['null', 'true', '42', '[]']) {
-      fs.writeFileSync(markerPath, invalidJson)
-      assert.equal(await readLiveBridgeMarker({ homeDir }), null)
-    }
-    fs.writeFileSync(markerPath, JSON.stringify({
-      ...valid,
-      connectedAt: new Date(Date.now() - 30_000).toISOString(),
-      heartbeatAt: new Date(Date.now() - 30_000).toISOString(),
-    }))
-    assert.equal(await readLiveBridgeMarker({ homeDir, maxAgeMs: 1_000 }), null)
-
-    fs.writeFileSync(markerPath, JSON.stringify(valid))
-    assert.equal((await readLiveBridgeMarker({ homeDir })).sessionId, 'current')
-    fs.rmSync(markerPath)
-    fs.writeFileSync(path.join(homeDir, 'bridge.json'), JSON.stringify(valid))
-    assert.equal(await readLiveBridgeMarker({ homeDir }), null)
-  } finally {
-    fs.rmSync(homeDir, { recursive: true, force: true })
-  }
-})
-
-test('CLI rejects removed local fallback and oversized native messages before network access', async () => {
-  const cliSource = fs.readFileSync(path.join(cliDir, 'src', 'tokenless.mts'), 'utf8')
-  const usageSource = cliSource.slice(cliSource.indexOf('function usage()'))
-  assert.match(usageSource, /--fresh\|-f/)
-  assert.doesNotMatch(usageSource, /--clean-profile/)
-  assert.doesNotMatch(usageSource, /tokenless install|extension-id/i)
-  assert.doesNotMatch(usageSource, new RegExp(`--mode ${'direct'}|--${'direct'}|tokenless ${'serve'}|tokenless ${'accounts'}|tokenless ${'projects'}`, 'i'))
-
+test('CLI rejects removed local fallback routes before network access', () => {
   for (const flag of ['--fresh', '-f']) {
     const conflict = spawnSync(process.execPath, [
       cliEntry,
@@ -586,14 +594,30 @@ test('CLI rejects removed local fallback and oversized native messages before ne
   assert.equal(reimportConflict.status, 1)
   assert.equal(JSON.parse(reimportConflict.stdout).error.code, 'setup_profile_choice_conflict')
 
+  const copyConsentRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-copy-consent-'))
+  const copyConsentHome = path.join(copyConsentRoot, 'home')
+  try {
+    for (const args of [
+      ['setup', '--import-browser-profile', 'Default', '--home', copyConsentHome, '--json'],
+      ['profiles', 'add', '--profile', 'copied', '--import-browser-profile', 'Default', '--home', copyConsentHome, '--json'],
+    ]) {
+      const result = spawnSync(process.execPath, [cliEntry, ...args], { cwd: root, encoding: 'utf8' })
+      assert.equal(result.status, 1, result.stderr || result.stdout)
+      assert.equal(JSON.parse(result.stdout).error.code, 'profile_import_consent_required')
+      assert.equal(fs.existsSync(copyConsentHome), false, 'missing consent must fail before local profile mutation')
+    }
+  } finally {
+    fs.rmSync(copyConsentRoot, { recursive: true, force: true })
+  }
+
   const compatibilityAlias = spawnSync(process.execPath, [
     cliEntry,
     'doctor',
     '--clean-profile',
     '--json',
   ], { cwd: root, encoding: 'utf8' })
-  assert.equal(compatibilityAlias.status, 1)
-  assert.equal(JSON.parse(compatibilityAlias.stdout).error.code, 'setup_options_require_setup')
+  assert.equal(compatibilityAlias.status, 2)
+  assert.equal(JSON.parse(compatibilityAlias.stdout).error.code, 'invalid_option')
 
   const removed = spawnSync(process.execPath, [
     cliEntry,
@@ -614,7 +638,11 @@ test('CLI rejects removed local fallback and oversized native messages before ne
       '--json',
     ], { cwd: root, encoding: 'utf8' })
     assert.equal(result.status, 2)
-    assert.equal(result.stdout, '')
+    assert.equal(result.stderr, '')
+    const payload = JSON.parse(result.stdout)
+    assert.equal(payload.error.code, 'unknown_command')
+    assert.ok(payload.error.usage.usage.some((line) => line.includes('tokenless <command>')))
+    assert.ok(payload.error.usage.commonOptions.includes('-h, --help'))
   }
 
   const removedFlag = spawnSync(process.execPath, [
@@ -626,7 +654,7 @@ test('CLI rejects removed local fallback and oversized native messages before ne
     'hello',
     '--json',
   ], { cwd: root, encoding: 'utf8' })
-  assert.equal(removedFlag.status, 1)
+  assert.equal(removedFlag.status, 2)
   assert.equal(JSON.parse(removedFlag.stdout).error.code, 'unknown_argument')
 
   const removedProjectRouteFlag = spawnSync(process.execPath, [
@@ -638,111 +666,203 @@ test('CLI rejects removed local fallback and oversized native messages before ne
     'hello',
     '--json',
   ], { cwd: root, encoding: 'utf8' })
-  assert.equal(removedProjectRouteFlag.status, 1)
+  assert.equal(removedProjectRouteFlag.status, 2)
   assert.equal(JSON.parse(removedProjectRouteFlag.stdout).error.code, 'unknown_argument')
-
-  const { createDaemonJob, MAX_NATIVE_MESSAGE_BYTES } = await importCli()
-  await assert.rejects(
-    createDaemonJob({
-      daemonUrl: 'http://127.0.0.1:9',
-      provider: 'chatgpt',
-      action: 'submit_and_read',
-      requestJson: { prompt: 'x'.repeat(MAX_NATIVE_MESSAGE_BYTES + 1) },
-    }),
-    (error) => error.code === 'native_message_too_large' && /Attach fewer or smaller files/.test(error.message)
-  )
 })
 
-test('agent skills use the managed Playwright workflow and two profile setup paths', () => {
-  const skill = fs.readFileSync(path.join(root, 'skills/tokenless/SKILL.md'), 'utf8')
-  const installSkill = fs.readFileSync(path.join(root, 'skills/tokenless-install/SKILL.md'), 'utf8')
-  assert.match(skill, /tokenless run/)
-  assert.match(skill, /tokenless state/)
-  assert.match(skill, /tokenless profiles list --json/)
-  assert.match(skill, /tokenless profiles status/)
-  assert.match(skill, /--profile/)
-  assert.match(skill, /Rust daemon/)
-  assert.match(skill, /Playwright worker/)
-  assert.match(skill, /persistent managed Chromium profile/)
-  assert.match(skill, /tokenless-install/)
-  assert.match(skill, /--long-running/)
-  assert.match(skill, /Do not use `--no-wait`/)
-  assert.match(skill, /daemon_waiting/)
-  assert.match(skill, /state.*Rust daemon/s)
-  assert.doesNotMatch(skill, /npx tokenless/)
-  assert.doesNotMatch(skill, /packages\/cli/)
-  assert.doesNotMatch(skill, /--no-daemon/)
-  assert.doesNotMatch(skill, /tokenless-native-host|extension id|chrome:\/\/extensions/i)
-
-  assert.match(installSkill, /user's preferred language/)
-  assert.match(installSkill, /npm install --global tokenless@latest/)
-  assert.match(installSkill, /tokenless setup --fresh --json/)
-  assert.match(installSkill, /tokenless profiles discover/)
-  assert.match(installSkill, /--import-browser-profile/)
-  assert.match(installSkill, /--consent-local-profile-copy/)
-  assert.match(installSkill, /Never run bare `tokenless setup`/)
-  assert.match(installSkill, /never imports an existing browser profile/i)
-  assert.match(installSkill, /installs and verifies both Tokenless agent skills/)
-  assert.match(installSkill, /detects supported browsers/)
-  assert.match(installSkill, /tokenless doctor --json/)
-  assert.match(installSkill, /tokenless profiles status/)
-  assert.match(installSkill, /Playwright worker/)
-  assert.match(installSkill, /managed profile/)
-  assert.match(installSkill, /Completed locally/)
-  assert.match(installSkill, /Action needed/)
-  assert.match(installSkill, /Next verification/)
-  assert.doesNotMatch(installSkill, /interactive terminal/i)
-  assert.doesNotMatch(installSkill, /extensionBridge|extension_setup_incomplete|chrome:\/\/extensions/i)
+test('built CLI classifies Chromium profile directories without reading browser state', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-profile-inventory-'))
+  const expectedCloakVersion = process.platform === 'win32'
+    ? '146.0.7680.177'
+    : '145.0.7632.109'
+  try {
+    fs.mkdirSync(path.join(root, 'Default'))
+    fs.mkdirSync(path.join(root, 'Profile 1'))
+    fs.mkdirSync(path.join(root, 'System Profile'))
+    fs.writeFileSync(path.join(root, 'Last Version'), expectedCloakVersion)
+    fs.writeFileSync(path.join(root, 'Local State'), 'intentionally invalid and never read')
+
+    const aligned = spawnSync(process.execPath, [
+      cliEntry,
+      'profiles',
+      'discover',
+      '--browser',
+      'edge',
+      '--browser-user-data-dir',
+      root,
+      '--json',
+    ], { cwd: root, encoding: 'utf8' })
+    assert.equal(aligned.status, 0, aligned.stderr || aligned.stdout)
+    const alignedPayload = JSON.parse(aligned.stdout)
+    assert.equal(alignedPayload.cloak.browserVersion, expectedCloakVersion)
+    assert.equal(alignedPayload.roots[0].browser, 'edge')
+    assert.deepEqual(
+      alignedPayload.roots[0].profiles.map((profile) => ({
+        directoryKey: profile.directoryKey,
+        compatibility: profile.cloakCompatibility,
+      })),
+      [
+        { directoryKey: 'Default', compatibility: 'aligned' },
+        { directoryKey: 'Profile 1', compatibility: 'aligned' },
+      ],
+    )
+
+    fs.writeFileSync(path.join(root, 'Last Version'), '150.0.7871.187')
+    const mismatched = spawnSync(process.execPath, [
+      cliEntry,
+      'profiles',
+      'discover',
+      '--browser',
+      'edge',
+      '--browser-user-data-dir',
+      root,
+      '--json',
+    ], { cwd: root, encoding: 'utf8' })
+    assert.equal(mismatched.status, 0, mismatched.stderr || mismatched.stdout)
+    assert.deepEqual(
+      JSON.parse(mismatched.stdout).roots[0].profiles.map((profile) => profile.cloakCompatibility),
+      ['not_aligned', 'not_aligned'],
+    )
+
+    fs.writeFileSync(path.join(root, 'Last Version'), '146.0.7680')
+    const incomplete = spawnSync(process.execPath, [
+      cliEntry,
+      'profiles',
+      'discover',
+      '--browser',
+      'edge',
+      '--browser-user-data-dir',
+      root,
+      '--json',
+    ], { cwd: root, encoding: 'utf8' })
+    assert.equal(incomplete.status, 0, incomplete.stderr || incomplete.stdout)
+    assert.deepEqual(
+      JSON.parse(incomplete.stdout).roots[0].profiles.map((profile) => profile.cloakCompatibility),
+      ['unknown', 'unknown'],
+    )
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true })
+  }
 })
 
-test('public onboarding describes managed Playwright startup without removed runtime claims', () => {
-  const readme = fs.readFileSync(path.join(root, 'README.md'), 'utf8')
-  const chinese = fs.readFileSync(path.join(root, 'README.zh-CN.md'), 'utf8')
-  const cliReadme = fs.readFileSync(path.join(root, 'packages/cli/README.md'), 'utf8')
-  const installer = fs.readFileSync(path.join(root, 'deploy/install.sh'), 'utf8')
-  const privacy = fs.readFileSync(path.join(root, 'PRIVACY.md'), 'utf8')
-  const architecture = fs.readFileSync(path.join(root, 'docs/architecture.md'), 'utf8')
-  const skill = fs.readFileSync(path.join(root, 'skills/tokenless/SKILL.md'), 'utf8')
-  const installSkill = fs.readFileSync(path.join(root, 'skills/tokenless-install/SKILL.md'), 'utf8')
-  for (const text of [readme, cliReadme]) {
-    assert.match(text, /Playwright/)
-    assert.match(text, /visible/)
-    assert.doesNotMatch(text, /\/Users\/jazelly/)
+test('Cloak setup gates explicit profile import on an exact supported browser version before download', () => {
+  const temporaryRoot = fs.realpathSync(os.tmpdir())
+  const profileRoot = fs.mkdtempSync(path.join(temporaryRoot, 'tokenless-cloak-import-profile-'))
+  const homeDir = fs.mkdtempSync(path.join(temporaryRoot, 'tokenless-cloak-import-home-'))
+  const expectedCloakVersion = process.platform === 'win32'
+    ? '146.0.7680.177'
+    : '145.0.7632.109'
+  const setupArgs = [
+    cliEntry,
+    'setup',
+    '--browser', 'cloak',
+    '--import-browser-profile', 'Default',
+    '--browser-user-data-dir', profileRoot,
+    '--consent-local-profile-copy',
+    '--defaults',
+    '--no-browser-download',
+    '--home', homeDir,
+    '--json',
+  ]
+  try {
+    fs.mkdirSync(path.join(profileRoot, 'Default'))
+    fs.writeFileSync(path.join(profileRoot, 'Last Version'), '150.0.7871.187')
+    fs.writeFileSync(path.join(profileRoot, 'Local State'), 'intentionally invalid and never read')
+
+    const mismatched = spawnSync(process.execPath, setupArgs, { cwd: root, encoding: 'utf8' })
+    assert.equal(mismatched.status, 1, mismatched.stderr || mismatched.stdout)
+    assert.equal(JSON.parse(mismatched.stdout).error.code, 'cloak_profile_version_incompatible')
+
+    fs.writeFileSync(path.join(profileRoot, 'Last Version'), expectedCloakVersion)
+    const aligned = spawnSync(process.execPath, setupArgs, { cwd: root, encoding: 'utf8' })
+    assert.equal(aligned.status, 1, aligned.stderr || aligned.stdout)
+    assert.equal(JSON.parse(aligned.stdout).error.code, 'browser_runtime_download_required')
+  } finally {
+    fs.rmSync(homeDir, { recursive: true, force: true })
+    fs.rmSync(profileRoot, { recursive: true, force: true })
   }
-  assert.match(readme, /npx tokenless@latest setup/)
-  assert.match(readme, /Save tokens/)
-  assert.match(readme, /tokenless setup --fresh/)
-  assert.match(readme, /Use an existing browser profile \(recommended\)/)
-  assert.match(chinese, /使用现有浏览器配置（推荐）/)
-  assert.match(chinese, /使用全新配置启动/)
-  assert.ok(readme.indexOf('## Why Tokenless') < readme.indexOf('## How Tokenless Works'))
-  assert.match(chinese, /Playwright/)
-  assert.match(chinese, /tokenless profiles/)
-  assert.match(installer, /setup --fresh --json/)
-  for (const text of [readme, chinese, cliReadme, installer, privacy, architecture, skill, installSkill]) {
-    assert.doesNotMatch(text, /native[- ]host|browser extension|chrome extension/i)
-    assert.doesNotMatch(text, new RegExp(`${'direct'} mode|--mode ${'direct'}|--${'direct'}|TOKENLESS_${'DIRECT'}|${'direct'} broker|${'direct'} API`, 'i'))
+})
+
+test('non-interactive Cloak setup requires an explicit Anti-Detect selection', () => {
+  const homeDir = fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), 'tokenless-cloak-consent-'))
+  try {
+    const configured = spawnSync(process.execPath, [
+      cliEntry,
+      'config',
+      '--browser',
+      'cloak',
+      '--home',
+      homeDir,
+      '--json',
+    ], { cwd: root, encoding: 'utf8' })
+    assert.equal(configured.status, 0, configured.stderr || configured.stdout)
+
+    const implicit = spawnSync(process.execPath, [
+      cliEntry,
+      'setup',
+      '--defaults',
+      '--no-browser-download',
+      '--home',
+      homeDir,
+      '--json',
+    ], { cwd: root, encoding: 'utf8' })
+    assert.equal(implicit.status, 1, implicit.stderr || implicit.stdout)
+    assert.equal(JSON.parse(implicit.stdout).error.code, 'setup_cloak_confirmation_required')
+    assert.equal(fs.existsSync(path.join(homeDir, 'browser', 'profiles.json')), false)
+
+    const explicit = spawnSync(process.execPath, [
+      cliEntry,
+      'setup',
+      '--anti-detect',
+      '--fresh',
+      '--no-browser-download',
+      '--home',
+      homeDir,
+      '--json',
+    ], { cwd: root, encoding: 'utf8' })
+    assert.equal(explicit.status, 1, explicit.stderr || explicit.stdout)
+    assert.equal(JSON.parse(explicit.stdout).error.code, 'browser_runtime_download_required')
+    assert.equal(fs.existsSync(path.join(homeDir, 'browser', 'profiles.json')), false)
+  } finally {
+    fs.rmSync(homeDir, { recursive: true, force: true })
   }
-  assert.equal(fs.existsSync(path.join(root, 'docs', `${'direct'}-mode.md`)), false)
-  assert.equal(fs.existsSync(path.join(root, 'docs', `${'direct'}-gateway-rfc.md`)), false)
-  assert.equal(fs.existsSync(path.join(root, 'docs/account-pool-rfc.md')), false)
-  assert.equal(fs.existsSync(path.join(root, 'docs/multi-account-routing.md')), false)
 })
 
 function readJson(relativePath) {
   return JSON.parse(fs.readFileSync(path.join(root, relativePath), 'utf8'))
 }
 
-function importCli() {
-  return import(pathToFileURL(path.join(cliDir, 'dist/src/index.js')).href)
+function runCli(args, options = {}) {
+  return spawnSync(process.execPath, [cliEntry, ...args], {
+    cwd: root,
+    encoding: 'utf8',
+    ...options,
+  })
 }
 
 function npmPack(directory, destination) {
-  const output = execFileSync('npm', ['pack', '--json', '--pack-destination', destination], {
+  const output = npmExecFileSync(['pack', '--json', '--pack-destination', destination], {
     cwd: directory,
-    encoding: 'utf8',
   })
   const jsonStart = output.indexOf('[')
   if (jsonStart < 0) throw new Error(`npm pack did not return JSON: ${output}`)
   return JSON.parse(output.slice(jsonStart))[0]
 }
+
+function npmExecFileSync(args, options = {}) {
+  const cacheDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-npm-cache-'))
+  try {
+    return execFileSync('npm', args, {
+      encoding: 'utf8',
+      ...options,
+      env: {
+        ...process.env,
+        ...options.env,
+        npm_config_cache: cacheDir,
+        NPM_CONFIG_CACHE: cacheDir,
+      },
+    })
+  } finally {
+    fs.rmSync(cacheDir, { recursive: true, force: true })
+  }
+}
diff --git a/test/playwright-chrome-import.test.mjs b/test/playwright-chrome-import.test.mjs
deleted file mode 100644
index bbc37a6..0000000
--- a/test/playwright-chrome-import.test.mjs
+++ /dev/null
@@ -1,441 +0,0 @@
-import assert from 'node:assert/strict'
-import { createHash } from 'node:crypto'
-import { copyFile, mkdir, mkdtemp, readFile, readdir, rm, stat, symlink, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { DatabaseSync } from 'node:sqlite'
-import test from 'node:test'
-import {
-  TokenlessPlaywrightError,
-  assertSourceUnchanged,
-  discoverChromeProfiles,
-  discoverChromiumProfiles,
-  importChromeProfile,
-  resolveChromeProfile,
-  shouldCopyChromeEntry,
-  standardChromiumUserDataDirs,
-} from '../packages/cli/dist/src/playwright/index.js'
-
-test('Chrome discovery enumerates exact directory keys from Local State', async () => {
-  const root = await fakeChromeRoot()
-  const discovered = await discoverChromeProfiles({ userDataDirs: [root] })
-  assert.equal(discovered.length, 1)
-  assert.deepEqual(discovered[0].profiles.map((profile) => profile.directoryKey), ['Default', 'Profile 1'])
-
-  const profile = await resolveChromeProfile(root, 'Profile 1')
-  assert.equal(profile.name, 'Work')
-  await assert.rejects(() => resolveChromeProfile(root, '../Default'), matchCode('invalid_chrome_profile_key'))
-})
-
-test('Brave discovery uses its platform root and the same exact profile-directory contract', async () => {
-  assert.deepEqual(
-    standardChromiumUserDataDirs('brave', 'darwin', '/Users/example', {}),
-    ['/Users/example/Library/Application Support/BraveSoftware/Brave-Browser']
-  )
-  const root = await fakeChromeRoot()
-  const discovered = await discoverChromiumProfiles({ browser: 'brave', userDataDirs: [root] })
-  assert.equal(discovered[0].browser, 'brave')
-  assert.deepEqual(discovered[0].profiles.map((profile) => profile.directoryKey), ['Default', 'Profile 1'])
-})
-
-test('Chrome import copies only selected provider cookie auth rows, excludes shared auth stores, disables sync, and leaves source unchanged', async () => {
-  const root = await fakeChromeRoot()
-  writeSyntheticCookieDb(join(root, 'Default', 'Cookies'), [
-    { host_key: 'chatgpt.com', name: 'chatgpt-root', encrypted_value: Buffer.from('opaque-chatgpt') },
-    { host_key: '.chatgpt.com', name: 'chatgpt-subdomain', encrypted_value: Buffer.from('opaque-chatgpt-subdomain') },
-    { host_key: 'auth.openai.com', name: 'openai-auth', encrypted_value: Buffer.from('opaque-openai') },
-    { host_key: 'claude.ai', name: 'claude', encrypted_value: Buffer.from('opaque-claude') },
-    { host_key: 'grok.com', name: 'grok', encrypted_value: Buffer.from('opaque-grok') },
-    { host_key: 'x.ai', name: 'xai', encrypted_value: Buffer.from('opaque-xai') },
-    { host_key: 'x.com', name: 'x-social', encrypted_value: Buffer.from('opaque-x') },
-    { host_key: 'twitter.com', name: 'twitter-social', encrypted_value: Buffer.from('opaque-twitter') },
-    { host_key: 'gemini.google.com', name: 'gemini', encrypted_value: Buffer.from('opaque-gemini') },
-    { host_key: 'accounts.google.com', name: 'google-account', encrypted_value: Buffer.from('opaque-google') },
-    { host_key: 'example.com', name: 'unrelated', encrypted_value: Buffer.from('opaque-unrelated') },
-    { host_key: 'chatgpt.com', name: 'partitioned-google', encrypted_value: Buffer.from('opaque-partitioned-google'), top_frame_site_key: 'https://accounts.google.com' },
-    { host_key: 'grok.com', name: 'partitioned-grok', encrypted_value: Buffer.from('opaque-partitioned-grok'), top_frame_site_key: 'https://grok.com' },
-  ])
-  await writeFile(join(root, 'Default', 'History'), 'history')
-  await writeFile(join(root, 'Default', 'Bookmarks'), 'bookmarks')
-  await writeFile(join(root, 'Default', 'Login Data'), 'password db')
-  await mkdir(join(root, 'Default', 'Cache'), { recursive: true })
-  await writeFile(join(root, 'Default', 'Cache', 'entry'), 'cache')
-  await mkdir(join(root, 'Default', 'Extensions'), { recursive: true })
-  await writeFile(join(root, 'Default', 'Extensions', 'ext'), 'extension')
-  await mkdir(join(root, 'Default', 'Local Storage'), { recursive: true })
-  await writeFile(join(root, 'Default', 'Local Storage', 'leveldb'), 'opaque local state')
-  await mkdir(join(root, 'Default', 'IndexedDB'), { recursive: true })
-  await writeFile(join(root, 'Default', 'IndexedDB', 'provider.indexeddb.leveldb'), 'opaque indexed db')
-  await mkdir(join(root, 'Default', 'Service Worker'), { recursive: true })
-  await writeFile(join(root, 'Default', 'Service Worker', 'state'), 'opaque service worker state')
-
-  const sourceProof = await sourceSnapshot([
-    join(root, 'Local State'),
-    join(root, 'Default', 'Cookies'),
-    join(root, 'Default', 'History'),
-  ])
-  const tokenlessHome = await mkdtemp(join(tmpdir(), 'tokenless-playwright-home-'))
-  const destinationDir = join(tokenlessHome, 'browser', 'profiles', crypto.randomUUID())
-
-  const result = await importChromeProfile({
-    sourceUserDataDir: root,
-    profileDirectoryKey: 'Default',
-    destinationDir,
-    tokenlessHome,
-    providers: ['chatgpt', 'grok', 'gemini'],
-  })
-
-  assert.equal(result.syncDisabled, true)
-  assert.ok(result.copiedFiles >= 3)
-  assert.deepEqual(result.cookieAuth.providers, [
-    { provider: 'chatgpt', cookies: 3, supported: true },
-    { provider: 'grok', cookies: 3, supported: true },
-    { provider: 'gemini', cookies: 0, supported: false },
-  ])
-  assert.equal(result.cookieAuth.totalCookies, 6)
-  assert.deepEqual(readCookieRows(join(destinationDir, 'Default', 'Cookies')), [
-    { host_key: 'chatgpt.com', name: 'chatgpt-root', top_frame_site_key: '' },
-    { host_key: '.chatgpt.com', name: 'chatgpt-subdomain', top_frame_site_key: '' },
-    { host_key: 'auth.openai.com', name: 'openai-auth', top_frame_site_key: '' },
-    { host_key: 'grok.com', name: 'grok', top_frame_site_key: '' },
-    { host_key: 'x.ai', name: 'xai', top_frame_site_key: '' },
-    { host_key: 'grok.com', name: 'partitioned-grok', top_frame_site_key: 'https://grok.com' },
-  ])
-  assert.deepEqual(readMetaRows(join(destinationDir, 'Default', 'Cookies')), [{ key: 'version', value: '24' }])
-  await assert.rejects(() => stat(join(destinationDir, 'Default', 'History')), { code: 'ENOENT' })
-  await assert.rejects(() => stat(join(destinationDir, 'Default', 'Bookmarks')), { code: 'ENOENT' })
-  await assert.rejects(() => stat(join(destinationDir, 'Default', 'Login Data')), { code: 'ENOENT' })
-  await assert.rejects(() => stat(join(destinationDir, 'Default', 'Cache')), { code: 'ENOENT' })
-  await assert.rejects(() => stat(join(destinationDir, 'Default', 'Extensions')), { code: 'ENOENT' })
-  await assert.rejects(() => stat(join(destinationDir, 'Default', 'Local Storage')), { code: 'ENOENT' })
-  await assert.rejects(() => stat(join(destinationDir, 'Default', 'IndexedDB')), { code: 'ENOENT' })
-  await assert.rejects(() => stat(join(destinationDir, 'Default', 'Service Worker')), { code: 'ENOENT' })
-
-  const clonedState = JSON.parse(await readFile(join(destinationDir, 'Local State'), 'utf8'))
-  assert.equal(clonedState.sync.disabled, true)
-  assert.equal(clonedState.os_crypt.encrypted_key, 'opaque-root-encryption-metadata')
-  await assertSourceUnchanged(sourceProof)
-})
-
-test('Chrome import does not copy cookie triggers that can inject disallowed rows', async () => {
-  const root = await fakeChromeRoot()
-  writeSyntheticCookieDb(join(root, 'Default', 'Cookies'), [
-    { host_key: 'chatgpt.com', name: 'allowed-chatgpt', encrypted_value: Buffer.from('opaque-chatgpt') },
-  ])
-  writeCookieTrigger(join(root, 'Default', 'Cookies'), `
-    CREATE TRIGGER inject_disallowed_cookie
-    AFTER INSERT ON cookies
-    WHEN NEW.host_key = 'chatgpt.com'
-    BEGIN
-      INSERT INTO cookies(creation_utc, host_key, top_frame_site_key, name, value, encrypted_value)
-      VALUES (999, 'accounts.google.com', '', 'injected-google', '', X'');
-    END;
-  `)
-  poisonCookieSchemaSql(
-    join(root, 'Default', 'Cookies'),
-    'CREATE TABLE cookies(creation_utc INTEGER NOT NULL, host_key TEXT NOT NULL, top_frame_site_key TEXT NOT NULL, name TEXT NOT NULL, value TEXT NOT NULL, encrypted_value BLOB NOT NULL, PRIMARY KEY(host_key, top_frame_site_key, name)); CREATE TABLE injected_schema_sql(host_key TEXT); --'
-  )
-  const tokenlessHome = await mkdtemp(join(tmpdir(), 'tokenless-playwright-home-'))
-  const destinationDir = join(tokenlessHome, 'browser', 'profiles', crypto.randomUUID())
-
-  const result = await importChromeProfile({
-    sourceUserDataDir: root,
-    profileDirectoryKey: 'Default',
-    destinationDir,
-    tokenlessHome,
-    providers: ['chatgpt'],
-  })
-
-  assert.deepEqual(result.cookieAuth.providers, [
-    { provider: 'chatgpt', cookies: 1, supported: true },
-  ])
-  assert.equal(result.cookieAuth.totalCookies, 1)
-  assert.deepEqual(readCookieRows(join(destinationDir, 'Default', 'Cookies')), [
-    { host_key: 'chatgpt.com', name: 'allowed-chatgpt', top_frame_site_key: '' },
-  ])
-  assert.deepEqual(readTriggerRows(join(destinationDir, 'Default', 'Cookies')), [])
-  assert.equal(readTableNames(join(destinationDir, 'Default', 'Cookies')).includes('injected_schema_sql'), false)
-})
-
-test('Chrome hot import ignores root lock files while rejecting symlinks and Tokenless-home sources', async () => {
-  const root = await fakeChromeRoot()
-  const tokenlessHome = await mkdtemp(join(tmpdir(), 'tokenless-playwright-home-'))
-  const destinationDir = join(tokenlessHome, 'browser', 'profiles', crypto.randomUUID())
-
-  await writeFile(join(root, 'SingletonLock'), 'locked')
-  const hotImport = await importChromeProfile({
-    sourceUserDataDir: root,
-    profileDirectoryKey: 'Default',
-    destinationDir,
-    tokenlessHome,
-  })
-  assert.ok(hotImport.copiedFiles > 0)
-  await assert.rejects(() => stat(join(destinationDir, 'SingletonLock')), { code: 'ENOENT' })
-
-  await import('node:fs/promises').then((fs) => fs.rm(join(root, 'SingletonLock')))
-  try {
-    await symlink(join(root, 'Default', 'Cookies'), join(root, 'Default', 'SymlinkedCookies'))
-  } catch (error) {
-    if (error?.code === 'EPERM') return
-    throw error
-  }
-
-  await assert.rejects(() => importChromeProfile({
-    sourceUserDataDir: root,
-    profileDirectoryKey: 'Default',
-    destinationDir,
-    tokenlessHome,
-  }), matchCode('chrome_profile_symlink_rejected'))
-
-  const profileParent = join(tokenlessHome, 'browser', 'profiles')
-  const entries = await readdir(profileParent).catch(() => [])
-  assert.equal(entries.some((entry) => entry.startsWith('.staging-')), false)
-
-  const sourceInsideHome = await fakeChromeRoot(join(tokenlessHome, 'source-chrome'))
-  await assert.rejects(() => importChromeProfile({
-    sourceUserDataDir: sourceInsideHome,
-    profileDirectoryKey: 'Default',
-    destinationDir,
-    tokenlessHome,
-  }), matchCode('chrome_profile_inside_tokenless_home'))
-})
-
-test('Chrome hot import accepts a source file mutation during best-effort copy', async () => {
-  const root = await fakeChromeRoot()
-  const tokenlessHome = await mkdtemp(join(tmpdir(), 'tokenless-playwright-home-'))
-  const destinationDir = join(tokenlessHome, 'browser', 'profiles', crypto.randomUUID())
-  let mutated = false
-
-  const result = await importChromeProfile({
-    sourceUserDataDir: root,
-    profileDirectoryKey: 'Default',
-    destinationDir,
-    tokenlessHome,
-    copyFile: async (source, destination) => {
-      await copyFile(source, destination)
-      if (!mutated && source === join(root, 'Default', 'Preferences')) {
-        mutated = true
-        await writeFile(source, JSON.stringify({ sync: { requested: true }, mutated: true }))
-      }
-    },
-  })
-
-  assert.equal(mutated, true)
-  assert.ok(result.copiedFiles > 0)
-  const profileParent = join(tokenlessHome, 'browser', 'profiles')
-  const entries = await readdir(profileParent).catch(() => [])
-  assert.equal(entries.some((entry) => entry.startsWith('.staging-')), false)
-  assert.equal((await stat(destinationDir)).isDirectory(), true)
-  await rm(tokenlessHome, { recursive: true, force: true })
-})
-
-test('Chrome import rejects destinations outside the managed UUID directory without modifying them', async () => {
-  const root = await fakeChromeRoot()
-  const tokenlessHome = await mkdtemp(join(tmpdir(), 'tokenless-playwright-home-'))
-  const unsafeDestination = join(tokenlessHome, 'do-not-delete')
-  await mkdir(unsafeDestination)
-  await writeFile(join(unsafeDestination, 'sentinel'), 'keep me')
-
-  await assert.rejects(() => importChromeProfile({
-    sourceUserDataDir: root,
-    profileDirectoryKey: 'Default',
-    destinationDir: unsafeDestination,
-    tokenlessHome,
-  }), matchCode('unsafe_managed_profile_destination'))
-
-  assert.equal(await readFile(join(unsafeDestination, 'sentinel'), 'utf8'), 'keep me')
-  await rm(tokenlessHome, { recursive: true, force: true })
-})
-
-test('Chrome hot import promotes regular copied bytes without source snapshot verification', async () => {
-  const root = await fakeChromeRoot()
-  const tokenlessHome = await mkdtemp(join(tmpdir(), 'tokenless-playwright-home-'))
-  const destinationDir = join(tokenlessHome, 'browser', 'profiles', crypto.randomUUID())
-  let corrupted = false
-
-  const result = await importChromeProfile({
-    sourceUserDataDir: root,
-    profileDirectoryKey: 'Default',
-    destinationDir,
-    tokenlessHome,
-    copyFile: async (source, destination) => {
-      await copyFile(source, destination)
-      if (!corrupted && source === join(root, 'Default', 'Preferences')) {
-        corrupted = true
-        await writeFile(destination, 'corrupt staged bytes')
-      }
-    },
-  })
-
-  assert.equal(corrupted, true)
-  assert.ok(result.copiedFiles > 0)
-  assert.equal(await readFile(join(destinationDir, 'Default', 'Preferences'), 'utf8'), 'corrupt staged bytes')
-  assert.equal((await readFile(join(root, 'Default', 'Preferences'), 'utf8')).includes('requested'), true)
-  const profileParent = join(tokenlessHome, 'browser', 'profiles')
-  const entries = await readdir(profileParent).catch(() => [])
-  assert.equal(entries.some((entry) => entry.startsWith('.staging-')), false)
-  assert.equal((await stat(destinationDir)).isDirectory(), true)
-  await rm(tokenlessHome, { recursive: true, force: true })
-})
-
-test('Chrome import include and exclude rules are conservative', () => {
-  assert.equal(shouldCopyChromeEntry('Local State', 'root'), true)
-  assert.equal(shouldCopyChromeEntry('Default', 'root'), false)
-  assert.equal(shouldCopyChromeEntry('Cookies', 'profile'), false)
-  assert.equal(shouldCopyChromeEntry('Network/Cookies', 'profile'), false)
-  assert.equal(shouldCopyChromeEntry('Local Storage/leveldb', 'profile'), false)
-  assert.equal(shouldCopyChromeEntry('IndexedDB/provider.leveldb', 'profile'), false)
-  assert.equal(shouldCopyChromeEntry('Session Storage/leveldb', 'profile'), false)
-  assert.equal(shouldCopyChromeEntry('Service Worker/ScriptCache', 'profile'), false)
-  assert.equal(shouldCopyChromeEntry('History', 'profile'), false)
-  assert.equal(shouldCopyChromeEntry('Login Data', 'profile'), false)
-  assert.equal(shouldCopyChromeEntry('Extensions/a', 'profile'), false)
-  assert.equal(shouldCopyChromeEntry('Code Cache/js', 'profile'), false)
-  assert.equal(shouldCopyChromeEntry('Sync Data/LevelDB', 'profile'), false)
-  assert.equal(shouldCopyChromeEntry('Sessions/Session_123', 'profile'), false)
-  assert.equal(shouldCopyChromeEntry('Sessions/Tabs_123', 'profile'), false)
-  assert.equal(shouldCopyChromeEntry('Current Session', 'profile'), false)
-  assert.equal(shouldCopyChromeEntry('Current Tabs', 'profile'), false)
-  assert.equal(shouldCopyChromeEntry('Last Session', 'profile'), false)
-  assert.equal(shouldCopyChromeEntry('Last Tabs', 'profile'), false)
-})
-
-async function fakeChromeRoot(root = undefined) {
-  const userDataDir = root ?? await mkdtemp(join(tmpdir(), 'tokenless-fake-chrome-'))
-  await mkdir(join(userDataDir, 'Default'), { recursive: true })
-  await mkdir(join(userDataDir, 'Profile 1'), { recursive: true })
-  await writeFile(join(userDataDir, 'Local State'), JSON.stringify({
-    os_crypt: {
-      encrypted_key: 'opaque-root-encryption-metadata',
-    },
-    profile: {
-      info_cache: {
-        Default: {
-          name: 'Personal',
-          is_using_default_name: true,
-        },
-        'Profile 1': {
-          name: 'Work',
-          is_using_default_name: false,
-        },
-      },
-    },
-    sync: {
-      disabled: false,
-    },
-  }))
-  await writeFile(join(userDataDir, 'Default', 'Preferences'), JSON.stringify({
-    sync: {
-      requested: true,
-    },
-  }))
-  return userDataDir
-}
-
-function writeSyntheticCookieDb(path, rows) {
-  const database = new DatabaseSync(path)
-  try {
-    database.exec(`
-      CREATE TABLE meta(key LONGVARCHAR NOT NULL UNIQUE PRIMARY KEY, value LONGVARCHAR);
-      INSERT INTO meta(key, value) VALUES ('version', '24');
-      CREATE TABLE cookies(
-        creation_utc INTEGER NOT NULL,
-        host_key TEXT NOT NULL,
-        top_frame_site_key TEXT NOT NULL DEFAULT '',
-        name TEXT NOT NULL,
-        value TEXT NOT NULL DEFAULT '',
-        encrypted_value BLOB NOT NULL DEFAULT X'',
-        PRIMARY KEY(host_key, top_frame_site_key, name)
-      );
-      CREATE INDEX cookies_host_key_idx ON cookies(host_key);
-    `)
-    const insert = database.prepare(`
-      INSERT INTO cookies(creation_utc, host_key, top_frame_site_key, name, value, encrypted_value)
-      VALUES (?, ?, ?, ?, '', ?)
-    `)
-    let creation = 13_396_451_883_850_632n
-    for (const row of rows) {
-      insert.run(creation++, row.host_key, row.top_frame_site_key ?? '', row.name, row.encrypted_value)
-    }
-  } finally {
-    database.close()
-  }
-}
-
-function writeCookieTrigger(path, sql) {
-  const database = new DatabaseSync(path)
-  try {
-    database.exec(sql)
-  } finally {
-    database.close()
-  }
-}
-
-function poisonCookieSchemaSql(path, sql) {
-  const database = new DatabaseSync(path)
-  try {
-    database.enableDefensive(false)
-    database.exec('PRAGMA writable_schema=ON')
-    database.prepare("UPDATE sqlite_master SET sql = ? WHERE type = 'table' AND name = 'cookies'").run(sql)
-    database.exec('PRAGMA writable_schema=OFF')
-  } finally {
-    database.close()
-  }
-}
-
-function readCookieRows(path) {
-  const database = new DatabaseSync(path, { readOnly: true })
-  try {
-    return database.prepare('SELECT host_key, name, top_frame_site_key FROM cookies ORDER BY creation_utc').all()
-      .map((row) => ({ ...row }))
-  } finally {
-    database.close()
-  }
-}
-
-function readTriggerRows(path) {
-  const database = new DatabaseSync(path, { readOnly: true })
-  try {
-    return database.prepare("SELECT name FROM sqlite_master WHERE type = 'trigger' ORDER BY name").all()
-      .map((row) => ({ ...row }))
-  } finally {
-    database.close()
-  }
-}
-
-function readTableNames(path) {
-  const database = new DatabaseSync(path, { readOnly: true })
-  try {
-    return database.prepare("SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name").all()
-      .map((row) => row.name)
-  } finally {
-    database.close()
-  }
-}
-
-function readMetaRows(path) {
-  const database = new DatabaseSync(path, { readOnly: true })
-  try {
-    return database.prepare('SELECT key, value FROM meta ORDER BY key').all()
-      .map((row) => ({ ...row }))
-  } finally {
-    database.close()
-  }
-}
-
-async function sourceSnapshot(paths) {
-  return await Promise.all(paths.map(async (path) => {
-    const fileStat = await stat(path)
-    const digest = createHash('sha256').update(await readFile(path)).digest('hex')
-    return {
-      path,
-      size: fileStat.size,
-      mtimeMs: fileStat.mtimeMs,
-      sha256: digest,
-    }
-  }))
-}
-
-function matchCode(code) {
-  return (error) => error instanceof TokenlessPlaywrightError && error.code === code
-}
diff --git a/test/playwright-cli-managed.test.mjs b/test/playwright-cli-managed.test.mjs
deleted file mode 100644
index f381de8..0000000
--- a/test/playwright-cli-managed.test.mjs
+++ /dev/null
@@ -1,2368 +0,0 @@
-import assert from 'node:assert/strict'
-import { spawn, spawnSync } from 'node:child_process'
-import fs from 'node:fs'
-import net from 'node:net'
-import os from 'node:os'
-import path from 'node:path'
-import test from 'node:test'
-import { fileURLToPath } from 'node:url'
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-const cliEntry = path.join(root, 'packages/cli/dist/src/tokenless.mjs')
-const SETUP_VISIBLE_PROVIDERS = ['chatgpt', 'claude', 'gemini', 'grok']
-
-test('canonical default setup noninteractively selects a browser/profile and proves all-provider visible readiness', async () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-')))
-  const skillHome = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-skills-')))
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const fakeRunnerEntry = writeFakeRunnerEntry(homeDir)
-  writeVerifiedSkills(skillHome)
-  installWorkspaceDaemon(homeDir)
-  let daemonPid
-  try {
-    const setup = spawnCli([
-      'setup',
-      '--fresh',
-      '--home', homeDir,
-      '--daemon-url', daemonUrl,
-      '--runner-heartbeat-timeout-ms', '3000',
-      '--skip-skill-install',
-      '--json',
-    ], {
-      TOKENLESS_BROWSER_EXECUTABLE: process.execPath,
-      TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry,
-      TOKENLESS_SETUP_SKILL_HOME: skillHome,
-    })
-    const profile = await waitForManagedProfile(homeDir)
-    const jobs = await completeSetupAuthSweep({ daemonUrl, homeDir, profileId: profile.id })
-    daemonPid = JSON.parse(fs.readFileSync(path.join(homeDir, 'daemon.pid.json'), 'utf8')).pid
-    const result = await waitForProcess(setup, 10000)
-    assert.equal(result.status, 0, result.stderr || result.stdout)
-    const payload = JSON.parse(result.stdout)
-    assert.equal(payload.ok, true)
-    assert.equal(payload.completed, true)
-    assert.equal(payload.status, 'ready')
-    assert.equal(payload.skills.ok, true)
-    assert.equal(payload.browser.id, 'profile')
-    assert.deepEqual(payload.providers, SETUP_VISIBLE_PROVIDERS)
-    assert.deepEqual(JSON.parse(fs.readFileSync(path.join(homeDir, 'config.json'), 'utf8')).preferredProviders, SETUP_VISIBLE_PROVIDERS)
-    assert.equal(payload.profile.slug, 'default')
-    assert.deepEqual(Object.keys(payload.readiness), SETUP_VISIBLE_PROVIDERS)
-    for (const provider of SETUP_VISIBLE_PROVIDERS) {
-      assert.equal(payload.readiness[provider].auth, 'authenticated')
-      assert.equal(payload.readiness[provider].jobId, jobs[provider].job_id)
-      assert.deepEqual(jobs[provider].request_json.actions.map((action) => action.action), ['auth.status'])
-    }
-
-    const doctor = runCli([
-      'doctor',
-      '--home', homeDir,
-      '--daemon-url', daemonUrl,
-      '--json',
-    ], {
-      TOKENLESS_BROWSER_EXECUTABLE: process.execPath,
-      TOKENLESS_SETUP_SKILL_HOME: skillHome,
-    })
-    assert.equal(doctor.status, 0, doctor.stderr || doctor.stdout)
-    const diagnosis = JSON.parse(doctor.stdout)
-    assert.equal(diagnosis.ok, true)
-    assert.equal(diagnosis.checks.skills.ok, true)
-    assert.equal(diagnosis.checks.managedRuntime.ok, true)
-    assert.equal(diagnosis.checks.runner.ok, true)
-    assert.equal(diagnosis.checks.managedProfile.ok, true)
-    assert.deepEqual(Object.keys(diagnosis.checks.providerReadiness.providers), SETUP_VISIBLE_PROVIDERS)
-    for (const provider of SETUP_VISIBLE_PROVIDERS) {
-      assert.equal(diagnosis.checks.providerReadiness.providers[provider].auth, 'authenticated')
-    }
-    assert.equal('nativeHostManifests' in diagnosis.checks, false)
-    assert.equal('extensionBridge' in diagnosis.checks, false)
-
-    const defaultRun = runCli([
-      'run',
-      '--profile', 'default',
-      '--prompt', 'default provider check',
-      '--home', homeDir,
-      '--daemon-url', daemonUrl,
-      '--runner-heartbeat-timeout-ms', '3000',
-      '--no-wait',
-      '--json',
-    ], {
-      TOKENLESS_BROWSER_EXECUTABLE: process.execPath,
-      TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry,
-      TOKENLESS_SETUP_SKILL_HOME: skillHome,
-    })
-    assert.equal(defaultRun.status, 0, defaultRun.stderr || defaultRun.stdout)
-    const defaultRunPayload = JSON.parse(defaultRun.stdout)
-    assert.equal(defaultRunPayload.provider, 'chatgpt')
-    const defaultRunJob = await fetchJson(`${daemonUrl}/jobs/${encodeURIComponent(defaultRunPayload.jobId)}`, homeDir)
-    assert.equal(defaultRunJob.provider, 'chatgpt')
-  } finally {
-    try {
-      const { stopRunnerSupervisor } = await import(path.join(root, 'packages/cli/dist/src/playwright/index.js'))
-      await stopRunnerSupervisor({ homeDir })
-    } catch {}
-    if (daemonPid) await stopPid(daemonPid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-    fs.rmSync(skillHome, { recursive: true, force: true })
-  }
-})
-
-test('setup rejects obsolete provider selection flags before configuring a profile', () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-provider-flag-')))
-  try {
-    for (const args of [
-      ['setup', '--provider', 'claude', '--home', homeDir, '--json'],
-      ['setup', '--preferred-providers', 'chatgpt,claude', '--home', homeDir, '--json'],
-    ]) {
-      const result = runCli(args)
-      assert.equal(result.status, 1, result.stderr || result.stdout)
-      const payload = JSON.parse(result.stdout)
-      assert.equal(payload.ok, false)
-      assert.equal(payload.error.code, 'setup_provider_selection_unsupported')
-      assert.match(payload.error.message, /checks every supported visible provider/)
-    }
-    assert.equal(fs.existsSync(path.join(homeDir, 'browser', 'profiles.json')), false)
-  } finally {
-    fs.rmSync(homeDir, { recursive: true, force: true })
-  }
-})
-
-test('interactive setup -f reuses a managed profile without offering source profile import or re-import', { skip: process.platform === 'win32' || !fs.existsSync('/usr/bin/expect') }, async () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-fresh-')))
-  const skillHome = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-fresh-skills-')))
-  const sourceHome = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-fresh-source-')))
-  const chromeRoot = path.join(sourceHome, 'chrome-root')
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const fakeRunnerEntry = writeFakeRunnerEntry(homeDir)
-  fs.mkdirSync(path.join(chromeRoot, 'Default'), { recursive: true })
-  fs.writeFileSync(path.join(chromeRoot, 'Local State'), JSON.stringify({
-    profile: {
-      info_cache: {
-        Default: {
-          name: 'Jason',
-          is_using_default_name: true,
-        },
-      },
-    },
-  }), 'utf8')
-  writeVerifiedSkills(skillHome)
-  installWorkspaceDaemon(homeDir)
-  const added = runCli(['profiles', 'add', '--profile', 'default', '--home', homeDir, '--json'])
-  assert.equal(added.status, 0, added.stderr || added.stdout)
-  let daemonPid
-  let setup
-  try {
-    setup = spawnCliTty([
-      'setup',
-      '-f',
-      '--profile', 'default',
-      '--browser-user-data-dir', chromeRoot,
-      '--home', homeDir,
-      '--daemon-url', daemonUrl,
-      '--runner-heartbeat-timeout-ms', '3000',
-      '--skip-skill-install',
-    ], {
-      TOKENLESS_BROWSER_EXECUTABLE: process.execPath,
-      TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry,
-      TOKENLESS_SETUP_SKILL_HOME: skillHome,
-    })
-    const browserPrompt = waitForProcessOutput(setup, 'Choose [1]: ')
-    const setupFinished = waitForProcess(setup, 10000)
-    await browserPrompt
-    setup.stdin.write('\n')
-
-    const profile = await waitForManagedProfile(homeDir)
-    await completeSetupAuthSweep({ daemonUrl, homeDir, profileId: profile.id })
-    daemonPid = JSON.parse(fs.readFileSync(path.join(homeDir, 'daemon.pid.json'), 'utf8')).pid
-
-    const result = await setupFinished
-    assert.equal(result.status, 0, result.stderr || result.stdout)
-    assert.doesNotMatch(result.stdout, /Import an existing .* profile into Tokenless/)
-    assert.doesNotMatch(result.stdout, /Re-import .* from/)
-    assert.doesNotMatch(result.stdout, /Providers \(comma-separated/)
-    assert.equal(profile.slug, 'default')
-    assert.equal(profile.label, 'default')
-    assert.equal(profile.import, undefined)
-  } finally {
-    try {
-      const { stopRunnerSupervisor } = await import(path.join(root, 'packages/cli/dist/src/playwright/index.js'))
-      await stopRunnerSupervisor({ homeDir })
-    } catch {}
-    if (setup?.exitCode === null) setup.kill('SIGTERM')
-    if (daemonPid) await stopPid(daemonPid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-    fs.rmSync(skillHome, { recursive: true, force: true })
-    fs.rmSync(sourceHome, { recursive: true, force: true })
-  }
-})
-
-test('setup uses the imported browser profile name as its managed profile label', async () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-import-label-')))
-  const skillHome = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-import-label-skills-')))
-  const sourceHome = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-import-source-')))
-  const chromeRoot = path.join(sourceHome, 'chrome-root')
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const fakeRunnerEntry = writeFakeRunnerEntry(homeDir)
-  fs.mkdirSync(path.join(chromeRoot, 'Default'), { recursive: true })
-  fs.writeFileSync(path.join(chromeRoot, 'Local State'), JSON.stringify({
-    profile: {
-      info_cache: {
-        Default: {
-          name: 'Jason',
-          is_using_default_name: true,
-        },
-      },
-    },
-  }), 'utf8')
-  writeVerifiedSkills(skillHome)
-  installWorkspaceDaemon(homeDir)
-  let daemonPid
-  try {
-    const setup = spawnCli([
-      'setup',
-      '--profile', 'default',
-      '--browser', 'chrome',
-      '--browser-user-data-dir', chromeRoot,
-      '--import-browser-profile', 'Default',
-      '--consent-local-profile-copy',
-      '--home', homeDir,
-      '--daemon-url', daemonUrl,
-      '--runner-heartbeat-timeout-ms', '3000',
-      '--skip-skill-install',
-      '--json',
-    ], {
-      TOKENLESS_BROWSER_EXECUTABLE: process.execPath,
-      TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry,
-      TOKENLESS_SETUP_SKILL_HOME: skillHome,
-    })
-    const setupFinished = waitForProcess(setup, 10000)
-    let profile
-    try {
-      profile = await waitForManagedProfile(homeDir)
-    } catch (error) {
-      const result = await setupFinished
-      assert.fail(`${error.message}\n${result.stderr || result.stdout}`)
-    }
-    await completeSetupAuthSweep({ daemonUrl, homeDir, profileId: profile.id })
-    daemonPid = JSON.parse(fs.readFileSync(path.join(homeDir, 'daemon.pid.json'), 'utf8')).pid
-
-    const result = await setupFinished
-    assert.equal(result.status, 0, result.stderr || result.stdout)
-    const payload = JSON.parse(result.stdout)
-    assert.equal(payload.profile.slug, 'default')
-    assert.equal(payload.profile.label, 'Jason')
-    const registry = JSON.parse(fs.readFileSync(path.join(homeDir, 'browser', 'profiles.json'), 'utf8'))
-    assert.deepEqual(registry.profiles.default.import.providers, SETUP_VISIBLE_PROVIDERS)
-    assert.equal(profile.labelOrigin, 'import')
-  } finally {
-    try {
-      const { stopRunnerSupervisor } = await import(path.join(root, 'packages/cli/dist/src/playwright/index.js'))
-      await stopRunnerSupervisor({ homeDir })
-    } catch {}
-    if (daemonPid) await stopPid(daemonPid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-    fs.rmSync(skillHome, { recursive: true, force: true })
-    fs.rmSync(sourceHome, { recursive: true, force: true })
-  }
-})
-
-test('interactive setup copies the chosen browser profile without a second consent prompt', { skip: process.platform === 'win32' || !fs.existsSync('/usr/bin/expect') }, async () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-direct-import-')))
-  const skillHome = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-direct-import-skills-')))
-  const sourceHome = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-direct-import-source-')))
-  const chromeRoot = path.join(sourceHome, 'chrome-root')
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const fakeRunnerEntry = writeFakeRunnerEntry(homeDir)
-  fs.mkdirSync(path.join(chromeRoot, 'Default'), { recursive: true })
-  fs.writeFileSync(path.join(chromeRoot, 'Local State'), JSON.stringify({
-    profile: {
-      info_cache: {
-        Default: {
-          name: 'Jason',
-          is_using_default_name: true,
-        },
-      },
-    },
-  }), 'utf8')
-  writeVerifiedSkills(skillHome)
-  installWorkspaceDaemon(homeDir)
-  let daemonPid
-  let setup
-  try {
-    setup = spawnCliTty([
-      'setup',
-      '--profile', 'default',
-      '--browser-user-data-dir', chromeRoot,
-      '--home', homeDir,
-      '--daemon-url', daemonUrl,
-      '--runner-heartbeat-timeout-ms', '3000',
-      '--skip-skill-install',
-    ], {
-      TOKENLESS_BROWSER_EXECUTABLE: process.execPath,
-      TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry,
-      TOKENLESS_SETUP_SKILL_HOME: skillHome,
-    })
-    const setupFinished = waitForProcess(setup, 10000)
-    await waitForProcessOutput(setup, 'Choose [1]: ')
-    setup.stdin.write('\n')
-    await waitForProcessOutput(setup, 'Import an existing profile profile into Tokenless?')
-    const sourcePrompt = waitForProcessOutput(setup, 'Choose [1]: ')
-    setup.stdin.write('\n')
-    await sourcePrompt
-    setup.stdin.write('\n')
-
-    const profile = await waitForManagedProfile(homeDir)
-    await completeSetupAuthSweep({ daemonUrl, homeDir, profileId: profile.id })
-    daemonPid = JSON.parse(fs.readFileSync(path.join(homeDir, 'daemon.pid.json'), 'utf8')).pid
-
-    const result = await setupFinished
-    assert.equal(result.status, 0, result.stderr || result.stdout)
-    assert.doesNotMatch(result.stdout, /Copy .* into managed profile/)
-    assert.doesNotMatch(result.stdout, /Providers \(comma-separated/)
-    assert.equal(profile.label, 'Jason')
-  } finally {
-    try {
-      const { stopRunnerSupervisor } = await import(path.join(root, 'packages/cli/dist/src/playwright/index.js'))
-      await stopRunnerSupervisor({ homeDir })
-    } catch {}
-    if (setup?.exitCode === null) setup.kill('SIGTERM')
-    if (daemonPid) await stopPid(daemonPid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-    fs.rmSync(skillHome, { recursive: true, force: true })
-    fs.rmSync(sourceHome, { recursive: true, force: true })
-  }
-})
-
-test('setup surfaces failed managed readiness jobs as technical CLI failures', async () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-failed-')))
-  const skillHome = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-failed-skills-')))
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const fakeRunnerEntry = writeFakeRunnerEntry(homeDir)
-  writeVerifiedSkills(skillHome)
-  installWorkspaceDaemon(homeDir)
-  let daemonPid
-  try {
-    const setup = spawnCli([
-      'setup',
-      '--defaults',
-      '--home', homeDir,
-      '--daemon-url', daemonUrl,
-      '--runner-heartbeat-timeout-ms', '3000',
-      '--skip-skill-install',
-      '--json',
-    ], {
-      TOKENLESS_BROWSER_EXECUTABLE: process.execPath,
-      TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry,
-      TOKENLESS_SETUP_SKILL_HOME: skillHome,
-    })
-    const profile = await waitForManagedProfile(homeDir)
-    const job = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'chatgpt',
-      actionNames: ['auth.status'],
-    })
-    daemonPid = JSON.parse(fs.readFileSync(path.join(homeDir, 'daemon.pid.json'), 'utf8')).pid
-    const claimed = await daemonPost({
-      daemonUrl,
-      homeDir,
-      path: `/control/jobs/claim-next?${new URLSearchParams({
-        execution_backend: 'playwright',
-        profile_id: profile.id,
-        action: 'visible_provider_actions',
-      })}`,
-    })
-    assert.equal(claimed.job.job_id, job.job_id)
-    await daemonPost({
-      daemonUrl,
-      homeDir,
-      path: `/jobs/${encodeURIComponent(job.job_id)}/complete`,
-      body: {
-        claim_token: claimed.job.claim_token,
-        error_json: {
-          code: 'playwright_navigation_failed',
-          message: 'Managed Playwright could not open the provider page.',
-          retryable: true,
-        },
-      },
-    })
-    await completeSetupAuthSweep({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      providers: ['claude', 'gemini', 'grok'],
-      excludeJobIds: new Set([job.job_id]),
-    })
-
-    const result = await waitForProcess(setup, 10000)
-
-    assert.equal(result.status, 1, result.stderr || result.stdout)
-    const payload = JSON.parse(result.stdout)
-    assert.equal(payload.ok, false)
-    assert.equal(payload.status, 'failed')
-    assert.equal(payload.error.code, 'playwright_navigation_failed')
-    assert.equal(payload.summary.counts.ready, 3)
-    assert.equal(payload.summary.counts.failed, 1)
-    assert.match(payload.error.message, /Managed Playwright could not open the provider page/)
-    assert.notEqual(payload.completed, true)
-    assert.notEqual(payload.status, 'waiting_for_user')
-  } finally {
-    try {
-      const { stopRunnerSupervisor } = await import(path.join(root, 'packages/cli/dist/src/playwright/index.js'))
-      await stopRunnerSupervisor({ homeDir })
-    } catch {}
-    if (daemonPid) await stopPid(daemonPid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-    fs.rmSync(skillHome, { recursive: true, force: true })
-  }
-})
-
-test('setup sweeps every supported provider before opening first actionable handoff', async () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-sweep-')))
-  const skillHome = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-sweep-skills-')))
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const fakeRunnerEntry = writeFakeRunnerEntry(homeDir)
-  writeVerifiedSkills(skillHome)
-  installWorkspaceDaemon(homeDir)
-  let daemonPid
-  let handoffJobId
-  try {
-    const setup = spawnCli([
-      'setup',
-      '--defaults',
-      '--home', homeDir,
-      '--daemon-url', daemonUrl,
-      '--runner-heartbeat-timeout-ms', '3000',
-      '--skip-skill-install',
-      '--json',
-    ], {
-      TOKENLESS_BROWSER_EXECUTABLE: process.execPath,
-      TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry,
-      TOKENLESS_SETUP_SKILL_HOME: skillHome,
-    })
-    const profile = await waitForManagedProfile(homeDir)
-    const chatgptSweep = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'chatgpt',
-      actionNames: ['auth.status'],
-    })
-    daemonPid = JSON.parse(fs.readFileSync(path.join(homeDir, 'daemon.pid.json'), 'utf8')).pid
-    const completedChatgpt = await completeAsInjectedRunner({ daemonUrl, homeDir, profileId: profile.id, authState: 'unauthenticated' })
-    assert.equal(completedChatgpt.job_id, chatgptSweep.job_id)
-
-    const claudeSweep = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'claude',
-      actionNames: ['auth.status'],
-      excludeJobIds: new Set([chatgptSweep.job_id]),
-    })
-    const completedClaude = await completeAsInjectedRunner({ daemonUrl, homeDir, profileId: profile.id, authState: 'authenticated' })
-    assert.equal(completedClaude.job_id, claudeSweep.job_id)
-    const geminiSweep = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'gemini',
-      actionNames: ['auth.status'],
-      excludeJobIds: new Set([chatgptSweep.job_id, claudeSweep.job_id]),
-    })
-    const completedGemini = await completeAsInjectedRunner({ daemonUrl, homeDir, profileId: profile.id, authState: 'authenticated' })
-    assert.equal(completedGemini.job_id, geminiSweep.job_id)
-    const grokSweep = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'grok',
-      actionNames: ['auth.status'],
-      excludeJobIds: new Set([chatgptSweep.job_id, claudeSweep.job_id, geminiSweep.job_id]),
-    })
-    const completedGrok = await completeAsInjectedRunner({ daemonUrl, homeDir, profileId: profile.id, authState: 'authenticated' })
-    assert.equal(completedGrok.job_id, grokSweep.job_id)
-
-    const handoffJob = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'chatgpt',
-      actionNames: ['navigation.check'],
-      excludeJobIds: new Set([chatgptSweep.job_id, claudeSweep.job_id, geminiSweep.job_id, grokSweep.job_id]),
-    })
-    handoffJobId = handoffJob.job_id
-    assert.equal(handoffJob.request_json.target.url, 'https://chatgpt.com/')
-    await markNextPlaywrightJobWaiting({ daemonUrl, homeDir, profileId: profile.id, expectedJobId: handoffJobId })
-
-    const result = await waitForProcess(setup, 10000)
-
-    assert.equal(result.status, 0, result.stderr || result.stdout)
-    const payload = JSON.parse(result.stdout)
-    assert.equal(payload.status, 'waiting_for_user')
-    assert.deepEqual(payload.providers, SETUP_VISIBLE_PROVIDERS)
-    assert.equal(payload.summary.counts.ready, 3)
-    assert.equal(payload.summary.counts.action_required, 1)
-    assert.equal(payload.summary.counts.failed, 0)
-    assert.equal(payload.summary.counts.total, 4)
-    assert.equal(payload.readiness.chatgpt.classification, 'action_required')
-    assert.equal(payload.readiness.chatgpt.handoff.jobId, handoffJobId)
-    assert.equal(payload.readiness.claude.classification, 'ready')
-    assert.equal(payload.readiness.claude.jobId, claudeSweep.job_id)
-    assert.equal(payload.readiness.gemini.classification, 'ready')
-    assert.equal(payload.readiness.grok.classification, 'ready')
-  } finally {
-    if (handoffJobId) {
-      await daemonPost({
-        daemonUrl,
-        homeDir,
-        path: `/control/jobs/${encodeURIComponent(handoffJobId)}/cancel`,
-      }).catch(() => undefined)
-    }
-    try {
-      const { stopRunnerSupervisor } = await import(path.join(root, 'packages/cli/dist/src/playwright/index.js'))
-      await stopRunnerSupervisor({ homeDir })
-    } catch {}
-    if (daemonPid) await stopPid(daemonPid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-    fs.rmSync(skillHome, { recursive: true, force: true })
-  }
-})
-
-test('setup returns nonzero mixed ready and failed provider summary without dropping results', async () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-mixed-failed-')))
-  const skillHome = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-mixed-failed-skills-')))
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const fakeRunnerEntry = writeFakeRunnerEntry(homeDir)
-  writeVerifiedSkills(skillHome)
-  installWorkspaceDaemon(homeDir)
-  let daemonPid
-  try {
-    const setup = spawnCli([
-      'setup',
-      '--defaults',
-      '--home', homeDir,
-      '--daemon-url', daemonUrl,
-      '--runner-heartbeat-timeout-ms', '3000',
-      '--skip-skill-install',
-      '--json',
-    ], {
-      TOKENLESS_BROWSER_EXECUTABLE: process.execPath,
-      TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry,
-      TOKENLESS_SETUP_SKILL_HOME: skillHome,
-    })
-    const profile = await waitForManagedProfile(homeDir)
-    const chatgptSweep = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'chatgpt',
-      actionNames: ['auth.status'],
-    })
-    daemonPid = JSON.parse(fs.readFileSync(path.join(homeDir, 'daemon.pid.json'), 'utf8')).pid
-    await completeAsInjectedRunner({ daemonUrl, homeDir, profileId: profile.id, authState: 'authenticated' })
-    await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'claude',
-      actionNames: ['auth.status'],
-      excludeJobIds: new Set([chatgptSweep.job_id]),
-    })
-    const failedJob = await failNextPlaywrightJob({ daemonUrl, homeDir, profileId: profile.id, expectedProvider: 'claude' })
-    await completeSetupAuthSweep({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      providers: ['gemini', 'grok'],
-      excludeJobIds: new Set([chatgptSweep.job_id, failedJob.job_id]),
-    })
-
-    const result = await waitForProcess(setup, 10000)
-
-    assert.equal(result.status, 1, result.stderr || result.stdout)
-    const payload = JSON.parse(result.stdout)
-    assert.equal(payload.ok, false)
-    assert.equal(payload.status, 'failed')
-    assert.deepEqual(payload.providers, SETUP_VISIBLE_PROVIDERS)
-    assert.equal(payload.summary.counts.ready, 3)
-    assert.equal(payload.summary.counts.failed, 1)
-    assert.equal(payload.summary.counts.total, 4)
-    assert.equal(payload.readiness.chatgpt.classification, 'ready')
-    assert.equal(payload.readiness.claude.classification, 'failed')
-    assert.equal(payload.readiness.claude.jobId, failedJob.job_id)
-    assert.equal(payload.readiness.gemini.classification, 'ready')
-    assert.equal(payload.readiness.grok.classification, 'ready')
-    assert.equal(payload.error.code, 'playwright_navigation_failed')
-  } finally {
-    try {
-      const { stopRunnerSupervisor } = await import(path.join(root, 'packages/cli/dist/src/playwright/index.js'))
-      await stopRunnerSupervisor({ homeDir })
-    } catch {}
-    if (daemonPid) await stopPid(daemonPid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-    fs.rmSync(skillHome, { recursive: true, force: true })
-  }
-})
-
-test('setup preserves actionable handoff guidance when technical failures also exist', async () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-failed-action-')))
-  const skillHome = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-failed-action-skills-')))
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const fakeRunnerEntry = writeFakeRunnerEntry(homeDir)
-  writeVerifiedSkills(skillHome)
-  installWorkspaceDaemon(homeDir)
-  let daemonPid
-  let handoffJobId
-  try {
-    const setup = spawnCli([
-      'setup',
-      '--defaults',
-      '--home', homeDir,
-      '--daemon-url', daemonUrl,
-      '--runner-heartbeat-timeout-ms', '3000',
-      '--skip-skill-install',
-      '--json',
-    ], {
-      TOKENLESS_BROWSER_EXECUTABLE: process.execPath,
-      TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry,
-      TOKENLESS_SETUP_SKILL_HOME: skillHome,
-    })
-    const profile = await waitForManagedProfile(homeDir)
-    const chatgptSweep = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'chatgpt',
-      actionNames: ['auth.status'],
-    })
-    daemonPid = JSON.parse(fs.readFileSync(path.join(homeDir, 'daemon.pid.json'), 'utf8')).pid
-    await completeAsInjectedRunner({ daemonUrl, homeDir, profileId: profile.id, authState: 'unauthenticated' })
-    const claudeSweep = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'claude',
-      actionNames: ['auth.status'],
-      excludeJobIds: new Set([chatgptSweep.job_id]),
-    })
-    await failNextPlaywrightJob({ daemonUrl, homeDir, profileId: profile.id, expectedProvider: 'claude' })
-    const providerSweepExclude = new Set([chatgptSweep.job_id, claudeSweep.job_id])
-    const geminiSweep = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'gemini',
-      actionNames: ['auth.status'],
-      excludeJobIds: providerSweepExclude,
-    })
-    providerSweepExclude.add(geminiSweep.job_id)
-    await completeAsInjectedRunner({ daemonUrl, homeDir, profileId: profile.id, authState: 'authenticated' })
-    const grokSweep = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'grok',
-      actionNames: ['auth.status'],
-      excludeJobIds: providerSweepExclude,
-    })
-    providerSweepExclude.add(grokSweep.job_id)
-    await completeAsInjectedRunner({ daemonUrl, homeDir, profileId: profile.id, authState: 'authenticated' })
-    const handoffJob = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'chatgpt',
-      actionNames: ['navigation.check'],
-      excludeJobIds: providerSweepExclude,
-    })
-    handoffJobId = handoffJob.job_id
-    await markNextPlaywrightJobWaiting({ daemonUrl, homeDir, profileId: profile.id, expectedJobId: handoffJobId })
-
-    const result = await waitForProcess(setup, 10000)
-
-    assert.equal(result.status, 1, result.stderr || result.stdout)
-    const payload = JSON.parse(result.stdout)
-    assert.equal(payload.ok, false)
-    assert.equal(payload.status, 'failed')
-    assert.equal(payload.waitingForUser, true)
-    assert.deepEqual(payload.providers, SETUP_VISIBLE_PROVIDERS)
-    assert.equal(payload.summary.counts.action_required, 1)
-    assert.equal(payload.summary.counts.failed, 1)
-    assert.equal(payload.summary.counts.ready, 2)
-    assert.equal(payload.summary.counts.total, 4)
-    assert.equal(payload.readiness.chatgpt.classification, 'action_required')
-    assert.equal(payload.readiness.chatgpt.handoff.jobId, handoffJobId)
-    assert.equal(payload.readiness.claude.classification, 'failed')
-    assert.equal(payload.readiness.gemini.classification, 'ready')
-    assert.equal(payload.readiness.grok.classification, 'ready')
-    assert.equal(payload.userActions.chatgpt.handoff.jobId, handoffJobId)
-    assert.match(payload.compactOutput, /Action required: chatgpt/)
-    assert.match(payload.compactOutput, new RegExp(handoffJobId))
-  } finally {
-    if (handoffJobId) {
-      await daemonPost({
-        daemonUrl,
-        homeDir,
-        path: `/control/jobs/${encodeURIComponent(handoffJobId)}/cancel`,
-      }).catch(() => undefined)
-    }
-    try {
-      const { stopRunnerSupervisor } = await import(path.join(root, 'packages/cli/dist/src/playwright/index.js'))
-      await stopRunnerSupervisor({ homeDir })
-    } catch {}
-    if (daemonPid) await stopPid(daemonPid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-    fs.rmSync(skillHome, { recursive: true, force: true })
-  }
-})
-
-test('interactive setup records handoff wait errors and continues later actionable providers', { skip: process.platform === 'win32' || !fs.existsSync('/usr/bin/expect') }, async () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-interactive-wait-failed-')))
-  const skillHome = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-interactive-wait-failed-skills-')))
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const fakeRunnerEntry = writeFakeRunnerEntry(homeDir)
-  writeVerifiedSkills(skillHome)
-  installWorkspaceDaemon(homeDir)
-  let daemonPid
-  let restartedDaemonPid
-  let claudeHandoffJobId
-  try {
-    const setup = spawnCliTty([
-      'setup',
-      '--home', homeDir,
-      '--daemon-url', daemonUrl,
-      '--runner-heartbeat-timeout-ms', '3000',
-      '--profile', 'default',
-      '--clean-profile',
-      '--skip-skill-install',
-    ], {
-      TOKENLESS_BROWSER_EXECUTABLE: process.execPath,
-      TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry,
-      TOKENLESS_SETUP_SKILL_HOME: skillHome,
-    })
-    const browserPrompt = waitForProcessOutput(setup, 'Choose [1]: ')
-    const setupFinished = waitForProcess(setup, 20000)
-    await browserPrompt
-    setup.stdin.write('\n')
-    const profile = await waitForManagedProfile(homeDir)
-    const chatgptSweep = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'chatgpt',
-      actionNames: ['auth.status'],
-    })
-    daemonPid = JSON.parse(fs.readFileSync(path.join(homeDir, 'daemon.pid.json'), 'utf8')).pid
-    await completeAsInjectedRunner({ daemonUrl, homeDir, profileId: profile.id, authState: 'unauthenticated' })
-    const claudeSweep = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'claude',
-      actionNames: ['auth.status'],
-      excludeJobIds: new Set([chatgptSweep.job_id]),
-    })
-    await completeAsInjectedRunner({ daemonUrl, homeDir, profileId: profile.id, authState: 'unauthenticated' })
-    const geminiSweep = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'gemini',
-      actionNames: ['auth.status'],
-      excludeJobIds: new Set([chatgptSweep.job_id, claudeSweep.job_id]),
-    })
-    await completeAsInjectedRunner({ daemonUrl, homeDir, profileId: profile.id, authState: 'authenticated' })
-    const grokSweep = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'grok',
-      actionNames: ['auth.status'],
-      excludeJobIds: new Set([chatgptSweep.job_id, claudeSweep.job_id, geminiSweep.job_id]),
-    })
-    await completeAsInjectedRunner({ daemonUrl, homeDir, profileId: profile.id, authState: 'authenticated' })
-    const chatgptHandoff = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'chatgpt',
-      actionNames: ['navigation.check'],
-      excludeJobIds: new Set([chatgptSweep.job_id, claudeSweep.job_id, geminiSweep.job_id, grokSweep.job_id]),
-    })
-    await markNextPlaywrightJobWaiting({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      expectedJobId: chatgptHandoff.job_id,
-      provider: 'chatgpt',
-    })
-
-    await stopPid(daemonPid)
-    daemonPid = undefined
-    setup.stdin.write('\n')
-
-    const claudeHandoff = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'claude',
-      actionNames: ['navigation.check'],
-      excludeJobIds: new Set([chatgptSweep.job_id, claudeSweep.job_id, geminiSweep.job_id, grokSweep.job_id, chatgptHandoff.job_id]),
-    })
-    claudeHandoffJobId = claudeHandoff.job_id
-    restartedDaemonPid = JSON.parse(fs.readFileSync(path.join(homeDir, 'daemon.pid.json'), 'utf8')).pid
-    await markNextPlaywrightJobWaiting({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      expectedJobId: claudeHandoffJobId,
-      provider: 'claude',
-    })
-    await daemonPost({
-      daemonUrl,
-      homeDir,
-      path: `/control/jobs/${encodeURIComponent(claudeHandoffJobId)}/cancel`,
-    })
-    setup.stdin.write('\n')
-
-    const result = await setupFinished
-
-    assert.equal(result.status, 1, result.stderr || result.stdout)
-    assert.match(result.stdout, /chatgpt: failed/)
-    assert.match(result.stdout, /claude: failed/)
-  } finally {
-    try {
-      const { stopRunnerSupervisor } = await import(path.join(root, 'packages/cli/dist/src/playwright/index.js'))
-      await stopRunnerSupervisor({ homeDir })
-    } catch {}
-    if (daemonPid) await stopPid(daemonPid)
-    if (restartedDaemonPid && restartedDaemonPid !== daemonPid) await stopPid(restartedDaemonPid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-    fs.rmSync(skillHome, { recursive: true, force: true })
-  }
-})
-
-test('setup returns actionable waiting_for_user data for managed browser handoff', async () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-waiting-')))
-  const skillHome = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-waiting-skills-')))
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const fakeRunnerEntry = writeFakeRunnerEntry(homeDir)
-  writeVerifiedSkills(skillHome)
-  installWorkspaceDaemon(homeDir)
-  let daemonPid
-  let jobId
-  try {
-    const setup = spawnCli([
-      'setup',
-      '--defaults',
-      '--home', homeDir,
-      '--daemon-url', daemonUrl,
-      '--runner-heartbeat-timeout-ms', '3000',
-      '--skip-skill-install',
-      '--json',
-    ], {
-      TOKENLESS_BROWSER_EXECUTABLE: process.execPath,
-      TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry,
-      TOKENLESS_SETUP_SKILL_HOME: skillHome,
-    })
-    const profile = await waitForManagedProfile(homeDir)
-    const job = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'chatgpt',
-      actionNames: ['auth.status'],
-    })
-    daemonPid = JSON.parse(fs.readFileSync(path.join(homeDir, 'daemon.pid.json'), 'utf8')).pid
-    const sweepJob = await completeAsInjectedRunner({ daemonUrl, homeDir, profileId: profile.id, authState: 'unauthenticated' })
-    assert.equal(sweepJob.job_id, job.job_id)
-    const remainingJobs = await completeSetupAuthSweep({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      providers: ['claude', 'gemini', 'grok'],
-      excludeJobIds: new Set([job.job_id]),
-    })
-    const handoffJob = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'chatgpt',
-      actionNames: ['navigation.check'],
-      excludeJobIds: new Set([job.job_id, ...Object.values(remainingJobs).map((candidate) => candidate.job_id)]),
-    })
-    jobId = handoffJob.job_id
-    await markNextPlaywrightJobWaiting({ daemonUrl, homeDir, profileId: profile.id, expectedJobId: jobId })
-
-    const result = await waitForProcess(setup, 10000)
-
-    assert.equal(result.status, 0, result.stderr || result.stdout)
-    const payload = JSON.parse(result.stdout)
-    assert.equal(payload.ok, true)
-    assert.equal(payload.completed, false)
-    assert.equal(payload.status, 'waiting_for_user')
-    assert.equal(payload.waitingForUser, true)
-    assert.deepEqual(payload.providers, SETUP_VISIBLE_PROVIDERS)
-    assert.equal(payload.summary.counts.ready, 3)
-    assert.equal(payload.summary.counts.action_required, 1)
-    assert.equal(payload.readiness.chatgpt.classification, 'action_required')
-    assert.equal(payload.readiness.chatgpt.status, 'succeeded')
-    assert.equal(payload.readiness.chatgpt.jobId, job.job_id)
-    assert.equal(payload.readiness.chatgpt.handoff.jobId, jobId)
-    assert.equal(payload.readiness.chatgpt.userAction.provider, 'chatgpt')
-    assert.equal(payload.readiness.chatgpt.userAction.profile.slug, 'default')
-    assert.equal(payload.readiness.chatgpt.userAction.profile.id, profile.id)
-    assert.match(payload.readiness.chatgpt.userAction.message, /Tokenless-managed Chrome window\/tab/)
-    assert.match(payload.readiness.chatgpt.userAction.message, /chatgpt profile default/)
-    assert.match(payload.readiness.chatgpt.userAction.message, /composer is visible/)
-    assert.equal(payload.userActions.chatgpt.handoff.jobId, jobId)
-  } finally {
-    if (jobId) {
-      await daemonPost({
-        daemonUrl,
-        homeDir,
-        path: `/control/jobs/${encodeURIComponent(jobId)}/cancel`,
-      }).catch(() => undefined)
-    }
-    try {
-      const { stopRunnerSupervisor } = await import(path.join(root, 'packages/cli/dist/src/playwright/index.js'))
-      await stopRunnerSupervisor({ homeDir })
-    } catch {}
-    if (daemonPid) await stopPid(daemonPid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-    fs.rmSync(skillHome, { recursive: true, force: true })
-  }
-})
-
-test('setup treats unknown auth readiness as an inconclusive completed check requiring fresh recheck', async () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-unknown-')))
-  const skillHome = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-unknown-skills-')))
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const fakeRunnerEntry = writeFakeRunnerEntry(homeDir)
-  writeVerifiedSkills(skillHome)
-  installWorkspaceDaemon(homeDir)
-  let daemonPid
-  try {
-    const setup = spawnCli([
-      'setup',
-      '--defaults',
-      '--home', homeDir,
-      '--daemon-url', daemonUrl,
-      '--runner-heartbeat-timeout-ms', '3000',
-      '--skip-skill-install',
-      '--json',
-    ], {
-      TOKENLESS_BROWSER_EXECUTABLE: process.execPath,
-      TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry,
-      TOKENLESS_SETUP_SKILL_HOME: skillHome,
-    })
-    const profile = await waitForManagedProfile(homeDir)
-    const job = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'chatgpt',
-      actionNames: ['auth.status'],
-    })
-    daemonPid = JSON.parse(fs.readFileSync(path.join(homeDir, 'daemon.pid.json'), 'utf8')).pid
-    await completeAsInjectedRunner({ daemonUrl, homeDir, profileId: profile.id, authState: 'unknown' })
-    const remainingJobs = await completeSetupAuthSweep({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      providers: ['claude', 'gemini', 'grok'],
-      excludeJobIds: new Set([job.job_id]),
-    })
-    const handoffJob = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'chatgpt',
-      actionNames: ['navigation.check'],
-      excludeJobIds: new Set([job.job_id, ...Object.values(remainingJobs).map((candidate) => candidate.job_id)]),
-    })
-    await markNextPlaywrightJobWaiting({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      expectedJobId: handoffJob.job_id,
-    })
-
-    const result = await waitForProcess(setup, 10000)
-
-    assert.equal(result.status, 0, result.stderr || result.stdout)
-    const payload = JSON.parse(result.stdout)
-    assert.equal(payload.ok, true)
-    assert.equal(payload.completed, false)
-    assert.equal(payload.status, 'waiting_for_user')
-    assert.deepEqual(payload.providers, SETUP_VISIBLE_PROVIDERS)
-    assert.equal(payload.summary.counts.ready, 3)
-    assert.equal(payload.summary.counts.action_required, 1)
-    assert.equal(payload.readiness.chatgpt.auth, 'unknown')
-    assert.equal(payload.readiness.chatgpt.status, 'succeeded')
-    assert.equal(payload.readiness.chatgpt.jobId, job.job_id)
-    assert.equal(payload.readiness.chatgpt.userAction.previousJobId, job.job_id)
-    assert.match(payload.readiness.chatgpt.userAction.message, /auth status was unknown/)
-    assert.match(payload.readiness.chatgpt.userAction.message, /Tokenless-managed Chrome window\/tab/)
-    assert.match(payload.readiness.chatgpt.userAction.recheckCommand, /tokenless profiles status --profile 'default' --provider 'chatgpt' --json/)
-    assert.equal('resumeCommand' in payload.readiness.chatgpt.userAction, false)
-    assert.match(payload.readiness.chatgpt.userAction.queryGuidance, /cannot resume/)
-  } finally {
-    try {
-      const { stopRunnerSupervisor } = await import(path.join(root, 'packages/cli/dist/src/playwright/index.js'))
-      await stopRunnerSupervisor({ homeDir })
-    } catch {}
-    if (daemonPid) await stopPid(daemonPid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-    fs.rmSync(skillHome, { recursive: true, force: true })
-  }
-})
-
-test('setup compact waiting output names provider profile managed Chrome window and composer target', async () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-compact-waiting-')))
-  const skillHome = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-compact-waiting-skills-')))
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const fakeRunnerEntry = writeFakeRunnerEntry(homeDir)
-  writeVerifiedSkills(skillHome)
-  installWorkspaceDaemon(homeDir)
-  let daemonPid
-  let jobId
-  try {
-    const setup = spawnCli([
-      'setup',
-      '--defaults',
-      '--home', homeDir,
-      '--daemon-url', daemonUrl,
-      '--runner-heartbeat-timeout-ms', '3000',
-      '--skip-skill-install',
-    ], {
-      TOKENLESS_BROWSER_EXECUTABLE: process.execPath,
-      TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry,
-      TOKENLESS_SETUP_SKILL_HOME: skillHome,
-    })
-      const profile = await waitForManagedProfile(homeDir)
-      const job = await waitForPlaywrightJob({
-        daemonUrl,
-        homeDir,
-        profileId: profile.id,
-        provider: 'chatgpt',
-        actionNames: ['auth.status'],
-      })
-      daemonPid = JSON.parse(fs.readFileSync(path.join(homeDir, 'daemon.pid.json'), 'utf8')).pid
-      const sweepJob = await completeAsInjectedRunner({ daemonUrl, homeDir, profileId: profile.id, authState: 'unauthenticated' })
-      assert.equal(sweepJob.job_id, job.job_id)
-      const remainingJobs = await completeSetupAuthSweep({
-        daemonUrl,
-        homeDir,
-        profileId: profile.id,
-        providers: ['claude', 'gemini', 'grok'],
-        excludeJobIds: new Set([job.job_id]),
-      })
-      const handoffJob = await waitForPlaywrightJob({
-        daemonUrl,
-        homeDir,
-        profileId: profile.id,
-        provider: 'chatgpt',
-        actionNames: ['navigation.check'],
-        excludeJobIds: new Set([job.job_id, ...Object.values(remainingJobs).map((candidate) => candidate.job_id)]),
-      })
-      jobId = handoffJob.job_id
-      await markNextPlaywrightJobWaiting({ daemonUrl, homeDir, profileId: profile.id, expectedJobId: jobId })
-
-    const result = await waitForProcess(setup, 10000)
-
-      assert.equal(result.status, 0, result.stderr || result.stdout)
-      assert.match(result.stdout, /chatgpt/)
-      assert.match(result.stdout, /profile default/)
-      assert.match(result.stdout, /Tokenless-managed Chrome window\/tab/)
-      assert.match(result.stdout, /composer is visible/)
-      assert.match(result.stdout, /tokenless profiles status --profile 'default' --provider 'chatgpt' --json/)
-      assert.match(result.stdout, new RegExp(jobId))
-      assert.doesNotMatch(result.stdout, /^\s*\{/)
-  } finally {
-    if (jobId) {
-      await daemonPost({
-        daemonUrl,
-        homeDir,
-        path: `/control/jobs/${encodeURIComponent(jobId)}/cancel`,
-      }).catch(() => undefined)
-    }
-    try {
-      const { stopRunnerSupervisor } = await import(path.join(root, 'packages/cli/dist/src/playwright/index.js'))
-      await stopRunnerSupervisor({ homeDir })
-    } catch {}
-    if (daemonPid) await stopPid(daemonPid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-    fs.rmSync(skillHome, { recursive: true, force: true })
-  }
-})
-
-test('setup compact output lists every provider classification and handoff guidance', async () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-compact-summary-')))
-  const skillHome = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-setup-compact-summary-skills-')))
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const fakeRunnerEntry = writeFakeRunnerEntry(homeDir)
-  writeVerifiedSkills(skillHome)
-  installWorkspaceDaemon(homeDir)
-  let daemonPid
-  let handoffJobId
-  try {
-    const setup = spawnCli([
-      'setup',
-      '--defaults',
-      '--home', homeDir,
-      '--daemon-url', daemonUrl,
-      '--runner-heartbeat-timeout-ms', '3000',
-      '--skip-skill-install',
-    ], {
-      TOKENLESS_BROWSER_EXECUTABLE: process.execPath,
-      TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry,
-      TOKENLESS_SETUP_SKILL_HOME: skillHome,
-    })
-    const profile = await waitForManagedProfile(homeDir)
-    const chatgptSweep = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'chatgpt',
-      actionNames: ['auth.status'],
-    })
-    daemonPid = JSON.parse(fs.readFileSync(path.join(homeDir, 'daemon.pid.json'), 'utf8')).pid
-    await completeAsInjectedRunner({ daemonUrl, homeDir, profileId: profile.id, authState: 'authenticated' })
-    const claudeSweep = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'claude',
-      actionNames: ['auth.status'],
-      excludeJobIds: new Set([chatgptSweep.job_id]),
-    })
-    await completeAsInjectedRunner({ daemonUrl, homeDir, profileId: profile.id, authState: 'unauthenticated' })
-    const geminiSweep = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'gemini',
-      actionNames: ['auth.status'],
-      excludeJobIds: new Set([chatgptSweep.job_id, claudeSweep.job_id]),
-    })
-    await completeAsInjectedRunner({ daemonUrl, homeDir, profileId: profile.id, authState: 'authenticated' })
-    const grokSweep = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'grok',
-      actionNames: ['auth.status'],
-      excludeJobIds: new Set([chatgptSweep.job_id, claudeSweep.job_id, geminiSweep.job_id]),
-    })
-    await completeAsInjectedRunner({ daemonUrl, homeDir, profileId: profile.id, authState: 'authenticated' })
-    const handoffJob = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      provider: 'claude',
-      actionNames: ['navigation.check'],
-      excludeJobIds: new Set([chatgptSweep.job_id, claudeSweep.job_id, geminiSweep.job_id, grokSweep.job_id]),
-    })
-    handoffJobId = handoffJob.job_id
-    assert.equal(handoffJob.request_json.target.url, 'https://claude.ai/new')
-    await markNextPlaywrightJobWaiting({
-      daemonUrl,
-      homeDir,
-      profileId: profile.id,
-      expectedJobId: handoffJobId,
-      provider: 'claude',
-    })
-
-    const result = await waitForProcess(setup, 10000)
-
-    assert.equal(result.status, 0, result.stderr || result.stdout)
-    assert.match(result.stdout, /chatgpt: ready/)
-    assert.match(result.stdout, /claude: action_required/)
-    assert.match(result.stdout, /gemini: ready/)
-    assert.match(result.stdout, /grok: ready/)
-    assert.match(result.stdout, /Counts: ready 3, action_required 1, failed 0/)
-    assert.match(result.stdout, /claude \(handoff job /)
-    assert.match(result.stdout, new RegExp(handoffJobId))
-    assert.match(result.stdout, /tokenless profiles status --profile 'default' --provider 'claude' --json/)
-    assert.doesNotMatch(result.stdout, /^\s*\{/)
-  } finally {
-    if (handoffJobId) {
-      await daemonPost({
-        daemonUrl,
-        homeDir,
-        path: `/control/jobs/${encodeURIComponent(handoffJobId)}/cancel`,
-      }).catch(() => undefined)
-    }
-    try {
-      const { stopRunnerSupervisor } = await import(path.join(root, 'packages/cli/dist/src/playwright/index.js'))
-      await stopRunnerSupervisor({ homeDir })
-    } catch {}
-    if (daemonPid) await stopPid(daemonPid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-    fs.rmSync(skillHome, { recursive: true, force: true })
-  }
-})
-
-test('CLI discovers Chrome profile directory keys without creating a managed profile registry', () => {
-  const tempRoot = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-discover-')))
-  const chromeRoot = path.join(tempRoot, 'chrome-root')
-  const poisonHome = path.join(tempRoot, 'tokenless-home-must-not-exist')
-  fs.mkdirSync(path.join(chromeRoot, 'Default'), { recursive: true })
-  fs.mkdirSync(path.join(chromeRoot, 'Profile 2'), { recursive: true })
-  fs.writeFileSync(path.join(chromeRoot, 'Local State'), JSON.stringify({
-    profile: {
-      info_cache: {
-        Default: {
-          name: 'Personal',
-          is_using_default_name: true,
-        },
-        'Profile 2': {
-          name: 'Research',
-          is_using_default_name: false,
-        },
-      },
-    },
-  }), 'utf8')
-
-  try {
-    const discovered = runCli([
-      'profiles',
-      'discover',
-      '--browser-user-data-dir',
-      chromeRoot,
-      '--json',
-    ], { TOKENLESS_HOME: poisonHome, TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: path.join(tempRoot, 'runner-must-not-start.mjs') })
-    assert.equal(discovered.status, 0, discovered.stderr || discovered.stdout)
-    assert.equal(fs.existsSync(poisonHome), false)
-    assert.doesNotMatch(discovered.stdout, /profileDir|sourcePath|destinationDir/)
-    const payload = JSON.parse(discovered.stdout)
-    assert.equal(payload.ok, true)
-    assert.deepEqual(payload.roots, [{
-      userDataDir: chromeRoot,
-      profiles: [
-        {
-          directoryKey: 'Default',
-          name: 'Personal',
-          isDefault: true,
-        },
-        {
-          directoryKey: 'Profile 2',
-          name: 'Research',
-          isDefault: false,
-        },
-      ],
-    }])
-    const brave = runCli([
-      'profiles',
-      'discover',
-      '--browser',
-      'brave',
-      '--browser-user-data-dir',
-      chromeRoot,
-      '--json',
-    ], { TOKENLESS_HOME: poisonHome, TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: path.join(tempRoot, 'runner-must-not-start.mjs') })
-    assert.equal(brave.status, 0, brave.stderr || brave.stdout)
-    assert.equal(JSON.parse(brave.stdout).browser, 'brave')
-    assert.equal(fs.existsSync(poisonHome), false)
-  } finally {
-    fs.rmSync(tempRoot, { recursive: true, force: true })
-  }
-})
-
-test('CLI uses the imported Chrome profile name as the default managed profile label', () => {
-  const tempRoot = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-import-label-')))
-  const chromeRoot = path.join(tempRoot, 'chrome-root')
-  const homeDir = path.join(tempRoot, 'tokenless-home')
-  fs.mkdirSync(path.join(chromeRoot, 'Default'), { recursive: true })
-  fs.writeFileSync(path.join(chromeRoot, 'Local State'), JSON.stringify({
-    profile: {
-      info_cache: {
-        Default: {
-          name: 'Jason',
-          is_using_default_name: true,
-        },
-      },
-    },
-  }), 'utf8')
-
-  try {
-    const imported = runCli([
-      'profiles',
-      'add',
-      '--profile', 'default',
-      '--browser', 'chrome',
-      '--browser-user-data-dir', chromeRoot,
-      '--import-browser-profile', 'Default',
-      '--preferred-providers', 'chatgpt',
-      '--consent-local-profile-copy',
-      '--set-default',
-      '--home', homeDir,
-      '--json',
-    ])
-
-    assert.equal(imported.status, 0, imported.stderr || imported.stdout)
-    const payload = JSON.parse(imported.stdout)
-    assert.equal(payload.profile.slug, 'default')
-    assert.equal(payload.profile.label, 'Jason')
-  } finally {
-    fs.rmSync(tempRoot, { recursive: true, force: true })
-  }
-})
-
-test('CLI resets an imported managed profile from its recorded source and provider scope', () => {
-  const tempRoot = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-reset-import-')))
-  const chromeRoot = path.join(tempRoot, 'chrome-root')
-  const homeDir = path.join(tempRoot, 'tokenless-home')
-  fs.mkdirSync(path.join(chromeRoot, 'Default'), { recursive: true })
-  fs.writeFileSync(path.join(chromeRoot, 'Local State'), JSON.stringify({
-    profile: { info_cache: { Default: { name: 'Jason', is_using_default_name: true } } },
-  }), 'utf8')
-  fs.writeFileSync(path.join(chromeRoot, 'Default', 'Preferences'), JSON.stringify({ marker: 'source-v1' }), 'utf8')
-
-  try {
-    const added = runCli([
-      'profiles', 'add',
-      '--profile', 'default',
-      '--browser', 'chrome',
-      '--browser-user-data-dir', chromeRoot,
-      '--import-browser-profile', 'Default',
-      '--preferred-providers', 'chatgpt,claude',
-      '--consent-local-profile-copy',
-      '--set-default',
-      '--home', homeDir,
-      '--json',
-    ])
-    assert.equal(added.status, 0, added.stderr || added.stdout)
-    const addedProfile = JSON.parse(added.stdout).profile
-    fs.writeFileSync(path.join(addedProfile.import.source, 'Default', 'Preferences'), JSON.stringify({ marker: 'source-v2' }), 'utf8')
-    const registryPath = path.join(homeDir, 'browser', 'profiles.json')
-    const registry = JSON.parse(fs.readFileSync(registryPath, 'utf8'))
-    const managedDirectory = registry.profiles.default.directory
-    fs.writeFileSync(path.join(managedDirectory, 'stale-managed-file'), 'remove me', 'utf8')
-    registry.profiles.default.lastObservedAuth = {
-      chatgpt: { provider: 'chatgpt', auth: 'authenticated', checkedAt: new Date().toISOString() },
-    }
-    fs.writeFileSync(registryPath, `${JSON.stringify(registry, null, 2)}\n`, { mode: 0o600 })
-
-    const jsonReset = runCli(['profiles', 'reset', '--home', homeDir, '--json'])
-    assert.notEqual(jsonReset.status, 0)
-    assert.match(jsonReset.stdout, /profile_command_json_unsupported/)
-    const reset = runCli(['profiles', 'reset', '--home', homeDir])
-    assert.equal(reset.status, 0, reset.stderr || reset.stdout)
-    assert.match(reset.stdout, /Reset managed profile 'default' from Jason/)
-    const updatedRegistry = JSON.parse(fs.readFileSync(registryPath, 'utf8'))
-    assert.equal(updatedRegistry.profiles.default.id, addedProfile.id)
-    assert.deepEqual(updatedRegistry.profiles.default.import.providers, ['chatgpt', 'claude'])
-    assert.deepEqual(updatedRegistry.profiles.default.lastObservedAuth, {})
-    assert.equal(JSON.parse(fs.readFileSync(path.join(managedDirectory, 'Default', 'Preferences'), 'utf8')).marker, 'source-v2')
-    assert.equal(fs.existsSync(path.join(managedDirectory, 'stale-managed-file')), false)
-  } finally {
-    fs.rmSync(tempRoot, { recursive: true, force: true })
-  }
-})
-
-test('CLI keeps the previous managed profile ready when reset staging fails', () => {
-  const tempRoot = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-reset-failure-')))
-  const chromeRoot = path.join(tempRoot, 'chrome-root')
-  const homeDir = path.join(tempRoot, 'tokenless-home')
-  fs.mkdirSync(path.join(chromeRoot, 'Default'), { recursive: true })
-  fs.writeFileSync(path.join(chromeRoot, 'Local State'), JSON.stringify({
-    profile: { info_cache: { Default: { name: 'Jason', is_using_default_name: true } } },
-  }), 'utf8')
-  fs.writeFileSync(path.join(chromeRoot, 'Default', 'Preferences'), JSON.stringify({ marker: 'preserve-me' }), 'utf8')
-
-  try {
-    const added = runCli([
-      'profiles', 'add',
-      '--profile', 'default',
-      '--browser', 'chrome',
-      '--browser-user-data-dir', chromeRoot,
-      '--import-browser-profile', 'Default',
-      '--preferred-providers', 'chatgpt',
-      '--consent-local-profile-copy',
-      '--set-default',
-      '--home', homeDir,
-      '--json',
-    ])
-    assert.equal(added.status, 0, added.stderr || added.stdout)
-    fs.writeFileSync(path.join(chromeRoot, 'Default', 'Cookies'), 'not a sqlite database', 'utf8')
-
-    const reset = runCli(['profiles', 'reset', '--home', homeDir])
-    assert.notEqual(reset.status, 0)
-    assert.match(reset.stderr, /chrome_cookie_import_failed/)
-    const registry = JSON.parse(fs.readFileSync(path.join(homeDir, 'browser', 'profiles.json'), 'utf8'))
-    const managedDirectory = registry.profiles.default.directory
-    assert.equal(registry.profiles.default.lifecycle, 'ready')
-    assert.equal(JSON.parse(fs.readFileSync(path.join(managedDirectory, 'Default', 'Preferences'), 'utf8')).marker, 'preserve-me')
-  } finally {
-    fs.rmSync(tempRoot, { recursive: true, force: true })
-  }
-})
-
-test('CLI clears one managed profile by slug or every profile with --all', () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-clear-profiles-')))
-  try {
-    const addDefault = runCli(['profiles', 'add', '--profile', 'default', '--set-default', '--home', homeDir, '--json'])
-    const addWork = runCli(['profiles', 'add', '--profile', 'work', '--home', homeDir, '--json'])
-    assert.equal(addDefault.status, 0, addDefault.stderr || addDefault.stdout)
-    assert.equal(addWork.status, 0, addWork.stderr || addWork.stdout)
-    const registryPath = path.join(homeDir, 'browser', 'profiles.json')
-    let registry = JSON.parse(fs.readFileSync(registryPath, 'utf8'))
-    const defaultDirectory = registry.profiles.default.directory
-    const workDirectory = registry.profiles.work.directory
-
-    const jsonClear = runCli(['profiles', 'clear', '--all', '--home', homeDir, '--json'])
-    assert.notEqual(jsonClear.status, 0)
-    assert.match(jsonClear.stdout, /profile_command_json_unsupported/)
-    const missingTarget = runCli(['profiles', 'clear', '--home', homeDir])
-    assert.notEqual(missingTarget.status, 0)
-    assert.match(missingTarget.stderr, /profile_clear_target_required/)
-    const ambiguousTarget = runCli(['profiles', 'clear', '--profile', 'work', '--all', '--home', homeDir])
-    assert.notEqual(ambiguousTarget.status, 0)
-    assert.match(ambiguousTarget.stderr, /profile_clear_target_required/)
-
-    const clearWork = runCli(['profiles', 'clear', '--profile', 'work', '--home', homeDir])
-    assert.equal(clearWork.status, 0, clearWork.stderr || clearWork.stdout)
-    assert.match(clearWork.stdout, /Cleared managed profile 'work'/)
-    assert.equal(fs.existsSync(workDirectory), false)
-    assert.equal(fs.existsSync(defaultDirectory), true)
-
-    const addTest = runCli(['profiles', 'add', '--profile', 'test', '--home', homeDir, '--json'])
-    assert.equal(addTest.status, 0, addTest.stderr || addTest.stdout)
-    registry = JSON.parse(fs.readFileSync(registryPath, 'utf8'))
-    const testDirectory = registry.profiles.test.directory
-    const clearAll = runCli(['profiles', 'clear', '--all', '--home', homeDir])
-    assert.equal(clearAll.status, 0, clearAll.stderr || clearAll.stdout)
-    assert.match(clearAll.stdout, /Cleared 2 managed profiles/)
-    assert.equal(fs.existsSync(defaultDirectory), false)
-    assert.equal(fs.existsSync(testDirectory), false)
-    assert.deepEqual(JSON.parse(fs.readFileSync(registryPath, 'utf8')).profiles, {})
-  } finally {
-    fs.rmSync(homeDir, { recursive: true, force: true })
-  }
-})
-
-test('CLI requires explicit selected providers for browser profile imports', () => {
-  const tempRoot = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-import-provider-required-')))
-  const chromeRoot = path.join(tempRoot, 'chrome-root')
-  const homeDir = path.join(tempRoot, 'tokenless-home')
-  fs.mkdirSync(path.join(chromeRoot, 'Default'), { recursive: true })
-  fs.writeFileSync(path.join(chromeRoot, 'Local State'), JSON.stringify({
-    profile: {
-      info_cache: {
-        Default: {
-          name: 'Jason',
-          is_using_default_name: true,
-        },
-      },
-    },
-  }), 'utf8')
-
-  try {
-    const imported = runCli([
-      'profiles',
-      'add',
-      '--profile', 'default',
-      '--browser', 'chrome',
-      '--browser-user-data-dir', chromeRoot,
-      '--import-browser-profile', 'Default',
-      '--consent-local-profile-copy',
-      '--home', homeDir,
-      '--json',
-    ])
-
-    assert.notEqual(imported.status, 0)
-    assert.match(imported.stdout, /profile_import_provider_required/)
-    assert.match(imported.stdout, /--preferred-providers/)
-  } finally {
-    fs.rmSync(tempRoot, { recursive: true, force: true })
-  }
-})
-
-test('CLI recovers legacy imported profile labels from the managed copy', () => {
-  const tempRoot = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-legacy-label-')))
-  const chromeRoot = path.join(tempRoot, 'chrome-root')
-  const homeDir = path.join(tempRoot, 'tokenless-home')
-  fs.mkdirSync(path.join(chromeRoot, 'Default'), { recursive: true })
-  fs.writeFileSync(path.join(chromeRoot, 'Local State'), JSON.stringify({
-    profile: {
-      info_cache: {
-        Default: {
-          name: 'Jason',
-          is_using_default_name: true,
-        },
-      },
-    },
-  }), 'utf8')
-
-  try {
-    const imported = runCli([
-      'profiles', 'add',
-      '--profile', 'default',
-      '--browser', 'chrome',
-      '--browser-user-data-dir', chromeRoot,
-      '--import-browser-profile', 'Default',
-      '--preferred-providers', 'chatgpt',
-      '--consent-local-profile-copy',
-      '--set-default',
-      '--home', homeDir,
-      '--json',
-    ])
-    assert.equal(imported.status, 0, imported.stderr || imported.stdout)
-
-    const registryPath = path.join(homeDir, 'browser', 'profiles.json')
-    const registry = JSON.parse(fs.readFileSync(registryPath, 'utf8'))
-    registry.profiles.default.label = 'default'
-    delete registry.profiles.default.labelOrigin
-    fs.writeFileSync(registryPath, `${JSON.stringify(registry, null, 2)}\n`, { mode: 0o600 })
-
-    const listed = runCli(['profiles', 'list', '--home', homeDir, '--json'])
-    assert.equal(listed.status, 0, listed.stderr || listed.stdout)
-    assert.equal(JSON.parse(listed.stdout).profiles[0].label, 'Jason')
-  } finally {
-    fs.rmSync(tempRoot, { recursive: true, force: true })
-  }
-})
-
-test('CLI submits managed Playwright jobs through real daemon with profile-filtered state', async () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-playwright-')))
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const fakeRunnerEntry = writeFakeRunnerEntry(homeDir)
-  const attachmentPath = path.join(homeDir, 'upload-marker.txt')
-  fs.writeFileSync(attachmentPath, 'managed playwright upload marker', 'utf8')
-  installWorkspaceDaemon(homeDir)
-  let daemonPid
-  try {
-    const add = runCli([
-      'profiles',
-      'add',
-      '--profile',
-      'default',
-      '--label',
-      'Default visible profile',
-      '--set-default',
-      '--home',
-      homeDir,
-      '--json',
-    ], { TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry })
-    assert.equal(add.status, 0, add.stderr || add.stdout)
-    const added = JSON.parse(add.stdout)
-    assert.equal(added.profile.slug, 'default')
-    assert.equal(added.profile.isDefault, true)
-    const addWork = runCli([
-      'profiles',
-      'add',
-      '--profile',
-      'work',
-      '--label',
-      'Work visible profile',
-      '--home',
-      homeDir,
-      '--json',
-    ], { TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry })
-    assert.equal(addWork.status, 0, addWork.stderr || addWork.stdout)
-    const workProfile = JSON.parse(addWork.stdout).profile
-    assert.equal(workProfile.slug, 'work')
-    assert.equal(workProfile.isDefault, false)
-
-    const visibilityConfig = runCli([
-      'config',
-      '--browser-visibility',
-      'headed',
-      '--home',
-      homeDir,
-      '--json',
-    ], { TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry })
-    assert.equal(visibilityConfig.status, 0, visibilityConfig.stderr || visibilityConfig.stdout)
-    assert.equal(JSON.parse(visibilityConfig.stdout).config.browserVisibility, 'headed')
-
-    const missing = runCli([
-      'run',
-      '--profile',
-      'missing',
-      '--provider',
-      'chatgpt',
-      '--prompt',
-      'must not create',
-      '--home',
-      homeDir,
-      '--daemon-url',
-      daemonUrl,
-      '--json',
-    ], { TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry })
-    assert.equal(missing.status, 1, missing.stderr || missing.stdout)
-    assert.equal(JSON.parse(missing.stdout).error.code, 'profile_not_found')
-    assert.equal(fs.existsSync(path.join(homeDir, 'daemon.pid.json')), false)
-
-    const run = runCli([
-      'run',
-      '--profile',
-      'default',
-      '--provider',
-      'chatgpt',
-      '--task-id',
-      'cli-managed-task',
-      '--model',
-      'GPT-5',
-      '--effort',
-      'High',
-      '--prompt',
-      'hello managed playwright',
-      '--attach-file',
-      attachmentPath,
-      '--home',
-      homeDir,
-      '--daemon-url',
-      daemonUrl,
-      '--runner-heartbeat-timeout-ms',
-      '3000',
-      '--browser-visibility',
-      'auto',
-      '--no-wait',
-      '--json',
-    ], { TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry })
-    assert.equal(run.status, 0, `stdout:\n${run.stdout}\nstderr:\n${run.stderr}\nrunner log:\n${readOptional(path.join(homeDir, 'playwright-runner', 'runner.log'))}`)
-    const payload = JSON.parse(run.stdout)
-    assert.equal(payload.ok, true)
-    assert.equal(payload.backend, 'playwright')
-    assert.equal(payload.profile.slug, 'default')
-    assert.equal(payload.status, 'no_wait')
-    assert.equal(payload.statusLog.some((event) => event.event === 'bridge_missing'), false)
-    assert.equal(payload.statusLog.some((event) => event.event === 'provider_opened'), false)
-    assert.doesNotMatch(run.stdout, /chrome-extension:\/\/|extensionBridge|bridgeSession/)
-
-    daemonPid = JSON.parse(fs.readFileSync(path.join(homeDir, 'daemon.pid.json'), 'utf8')).pid
-    const daemonJob = await fetchJson(`${daemonUrl}/jobs/${encodeURIComponent(payload.jobId)}`, homeDir)
-    assert.equal(daemonJob.action, 'visible_provider_actions')
-    assert.equal(daemonJob.execution_backend, 'playwright', JSON.stringify(daemonJob))
-    assert.equal(daemonJob.profile_id, added.profile.id)
-    assert.equal(daemonJob.request_json.protocol, 'tokenless.playwright.job.v2')
-    assert.equal(daemonJob.request_json.browserVisibility, 'auto')
-    assert.equal(daemonJob.request_json.taskId, 'cli-managed-task')
-    assert.deepEqual(daemonJob.request_json.actions.map((action) => action.action), [
-      'model.select',
-      'effort.select',
-      'file.upload',
-      'prompt.input',
-      'prompt.submit',
-      'response.read',
-    ])
-    const uploadAction = daemonJob.request_json.actions.find((action) => action.action === 'file.upload')
-    assert.equal(uploadAction.payload.attachments[0].bundleId, daemonJob.job_id)
-    assert.doesNotMatch(JSON.stringify(daemonJob.request_json), /sourcePath|stagedPath|chrome-extension|legacy_extension/)
-    assert.equal(fs.existsSync(path.join(homeDir, 'attachments', daemonJob.job_id)), true)
-    await completeAsInjectedRunner({
-      daemonUrl,
-      homeDir,
-      profileId: added.profile.id,
-    })
-    assert.equal(fs.existsSync(path.join(homeDir, 'attachments', daemonJob.job_id)), false)
-
-    const state = runCli([
-      'state',
-      '--profile',
-      'default',
-      '--job-id',
-      payload.jobId,
-      '--home',
-      homeDir,
-      '--daemon-url',
-      daemonUrl,
-      '--json',
-    ], { TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry })
-    assert.equal(state.status, 0, state.stderr || state.stdout)
-    const statePayload = JSON.parse(state.stdout)
-    assert.equal(statePayload.backend, 'playwright')
-    assert.equal(statePayload.profile.id, added.profile.id)
-    assert.equal(statePayload.latest.backend, 'playwright')
-    assert.equal(statePayload.latest.profile.id, added.profile.id)
-    assert.equal(statePayload.latest.status, 'succeeded')
-    assert.match(JSON.stringify(statePayload.latest.result), /fake managed response for cli-managed-task/)
-
-    const workRun = runCli([
-      'run',
-      '--profile',
-      'work',
-      '--provider',
-      'chatgpt',
-      '--task-id',
-      'cli-managed-work-task',
-      '--prompt',
-      'hello managed playwright work profile',
-      '--home',
-      homeDir,
-      '--daemon-url',
-      daemonUrl,
-      '--runner-heartbeat-timeout-ms',
-      '3000',
-      '--no-wait',
-      '--json',
-    ], { TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry })
-    assert.equal(workRun.status, 0, workRun.stderr || workRun.stdout)
-    const workPayload = JSON.parse(workRun.stdout)
-    assert.equal(workPayload.profile.id, workProfile.id)
-    const workDaemonJob = await fetchJson(`${daemonUrl}/jobs/${encodeURIComponent(workPayload.jobId)}`, homeDir)
-    assert.equal(workDaemonJob.request_json.browserVisibility, 'headed')
-    await completeAsInjectedRunner({
-      daemonUrl,
-      homeDir,
-      profileId: workProfile.id,
-    })
-    const workStateByJobId = runCli([
-      'state',
-      '--job-id',
-      workPayload.jobId,
-      '--home',
-      homeDir,
-      '--daemon-url',
-      daemonUrl,
-      '--json',
-    ], { TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry })
-    assert.equal(workStateByJobId.status, 0, workStateByJobId.stderr || workStateByJobId.stdout)
-    const workStatePayload = JSON.parse(workStateByJobId.stdout)
-    assert.equal(workStatePayload.profile.slug, 'work')
-    assert.equal(workStatePayload.profile.id, workProfile.id)
-    assert.equal(workStatePayload.latest.profile.id, workProfile.id)
-    const workStateWrongProfile = runCli([
-      'state',
-      '--profile',
-      'default',
-      '--job-id',
-      workPayload.jobId,
-      '--home',
-      homeDir,
-      '--daemon-url',
-      daemonUrl,
-      '--json',
-    ], { TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry })
-    assert.equal(workStateWrongProfile.status, 1, workStateWrongProfile.stderr || workStateWrongProfile.stdout)
-    assert.equal(JSON.parse(workStateWrongProfile.stdout).error.code, 'task_state_not_found')
-
-    const taskState = runCli([
-      'state',
-      '--profile',
-      'default',
-      '--task-id',
-      'cli-managed-task',
-      '--home',
-      homeDir,
-      '--daemon-url',
-      daemonUrl,
-      '--json',
-    ], { TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry })
-    assert.equal(taskState.status, 0, taskState.stderr || taskState.stdout)
-    const taskStatePayload = JSON.parse(taskState.stdout)
-    assert.equal(taskStatePayload.taskId, 'cli-managed-task')
-    assert.equal(taskStatePayload.latest.jobId, payload.jobId)
-    assert.equal(taskStatePayload.latest.profile.id, added.profile.id)
-
-    const missingAfterDaemon = runCli([
-      'provider-status',
-      '--profile',
-      'missing',
-      '--provider',
-      'chatgpt',
-      '--home',
-      homeDir,
-      '--daemon-url',
-      daemonUrl,
-      '--json',
-    ], { TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry })
-    assert.equal(missingAfterDaemon.status, 1, missingAfterDaemon.stderr || missingAfterDaemon.stdout)
-    assert.equal(JSON.parse(missingAfterDaemon.stdout).error.code, 'profile_not_found')
-    const jobs = await fetchJson(`${daemonUrl}/jobs?execution_backend=playwright&profile_id=${encodeURIComponent(added.profile.id)}`, homeDir)
-    assert.equal(jobs.length, 1)
-  } finally {
-    try {
-      const { stopRunnerSupervisor } = await import(path.join(root, 'packages/cli/dist/src/playwright/index.js'))
-      await stopRunnerSupervisor({ homeDir })
-    } catch {}
-    if (daemonPid) await stopPid(daemonPid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-  }
-})
-
-test('attached CLI run returns waiting_for_user envelope promptly without canceling daemon job', async () => {
-  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-cli-waiting-run-')))
-  const daemonUrl = `http://127.0.0.1:${await freePort()}`
-  const fakeRunnerEntry = writeFakeRunnerEntry(homeDir)
-  installWorkspaceDaemon(homeDir)
-  let daemonPid
-  let jobId
-  try {
-    const add = runCli([
-      'profiles',
-      'add',
-      '--profile',
-      'default',
-      '--label',
-      'Default visible profile',
-      '--set-default',
-      '--home',
-      homeDir,
-      '--json',
-    ], { TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry })
-    assert.equal(add.status, 0, add.stderr || add.stdout)
-    const added = JSON.parse(add.stdout)
-
-    const run = spawnCli([
-      'run',
-      '--profile',
-      'default',
-      '--provider',
-      'chatgpt',
-      '--task-id',
-      'cli-waiting-task',
-      '--prompt',
-      'wait for user',
-      '--home',
-      homeDir,
-      '--daemon-url',
-      daemonUrl,
-      '--runner-heartbeat-timeout-ms',
-      '3000',
-      '--timeout-ms',
-      '10000',
-      '--json',
-    ], { TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry })
-
-    const job = await waitForPlaywrightJob({ daemonUrl, homeDir, profileId: added.profile.id })
-    jobId = job.job_id
-    daemonPid = JSON.parse(fs.readFileSync(path.join(homeDir, 'daemon.pid.json'), 'utf8')).pid
-    const claimed = await daemonPost({
-      daemonUrl,
-      homeDir,
-      path: `/control/jobs/claim-next?${new URLSearchParams({
-        execution_backend: 'playwright',
-        profile_id: added.profile.id,
-        action: 'visible_provider_actions',
-      })}`,
-    })
-    assert.equal(claimed.job.job_id, jobId)
-    await daemonPost({
-      daemonUrl,
-      homeDir,
-      path: `/control/jobs/${encodeURIComponent(jobId)}/running`,
-      body: { claim_token: claimed.job.claim_token },
-    })
-    await daemonPost({
-      daemonUrl,
-      homeDir,
-      path: `/control/jobs/${encodeURIComponent(jobId)}/waiting-for-user`,
-      body: {
-        claim_token: claimed.job.claim_token,
-        blocker_json: {
-          protocol: 'tokenless.playwright.user-handover.v1',
-          jobId,
-          taskId: 'cli-waiting-task',
-          provider: 'chatgpt',
-          profileId: added.profile.id,
-          blocker: {
-            kind: 'challenge',
-            code: 'visible_recaptcha',
-            message: 'Visible reCAPTCHA verification is blocking the provider page.',
-            userResolvable: true,
-            retryable: true,
-            visibleProof: 'visible-recaptcha-frame',
-            provider: 'chatgpt',
-            url: 'https://chatgpt.com',
-            family: 'recaptcha',
-          },
-          userAction: {
-            message: 'Complete visible verification in Chrome.',
-          },
-        },
-      },
-    })
-
-    const completedRun = await waitForProcess(run, 5000)
-    assert.equal(completedRun.status, 0, `stdout:\n${completedRun.stdout}\nstderr:\n${completedRun.stderr}`)
-    const payload = JSON.parse(completedRun.stdout)
-    assert.equal(payload.ok, true)
-    assert.equal(payload.completed, false)
-    assert.equal(payload.jobContinues, true)
-    assert.equal(payload.status, 'waiting_for_user')
-    assert.equal(payload.jobId, jobId)
-    assert.equal(payload.taskId, 'cli-waiting-task')
-    assert.equal(payload.provider, 'chatgpt')
-    assert.equal(payload.profile.id, added.profile.id)
-    assert.equal(payload.blocker.blocker.code, 'visible_recaptcha')
-    assert.match(payload.userAction.message, /visible managed browser is open|Complete visible verification/i)
-
-    const waitingJob = await fetchJson(`${daemonUrl}/jobs/${encodeURIComponent(jobId)}`, homeDir)
-    assert.equal(waitingJob.status, 'waiting_for_user')
-    assert.equal(waitingJob.blocker_json.blocker.code, 'visible_recaptcha')
-
-    const state = runCli([
-      'state',
-      '--profile',
-      'default',
-      '--job-id',
-      jobId,
-      '--home',
-      homeDir,
-      '--daemon-url',
-      daemonUrl,
-      '--json',
-    ], { TOKENLESS_PLAYWRIGHT_RUNNER_ENTRY: fakeRunnerEntry })
-    assert.equal(state.status, 0, state.stderr || state.stdout)
-    const statePayload = JSON.parse(state.stdout)
-    assert.equal(statePayload.latest.status, 'waiting_for_user')
-    assert.equal(statePayload.latest.blocker.blocker.code, 'visible_recaptcha')
-  } finally {
-    if (jobId) {
-      await daemonPost({
-        daemonUrl,
-        homeDir,
-        path: `/control/jobs/${encodeURIComponent(jobId)}/cancel`,
-      }).catch(() => undefined)
-    }
-    try {
-      const { stopRunnerSupervisor } = await import(path.join(root, 'packages/cli/dist/src/playwright/index.js'))
-      await stopRunnerSupervisor({ homeDir })
-    } catch {}
-    if (daemonPid) await stopPid(daemonPid)
-    fs.rmSync(homeDir, { recursive: true, force: true })
-  }
-})
-
-function writeFakeRunnerEntry(homeDir) {
-  const entry = path.join(homeDir, 'fake-runner.mjs')
-  fs.writeFileSync(entry, `
-import {
-  writeRunnerHeartbeat,
-} from ${JSON.stringify(path.join(root, 'packages/cli/dist/src/playwright/index.js'))}
-
-const args = new Map()
-for (let index = 2; index < process.argv.length; index += 2) args.set(process.argv[index], process.argv[index + 1])
-const homeDir = args.get('--home-dir')
-const sessionId = args.get('--session-id')
-let stopped = false
-process.once('SIGTERM', () => { stopped = true })
-await writeRunnerHeartbeat({ homeDir, sessionId })
-const heartbeat = setInterval(() => {
-  void writeRunnerHeartbeat({ homeDir, sessionId }).catch(() => undefined)
-}, 250)
-try {
-  while (!stopped) {
-    await new Promise((resolve) => setTimeout(resolve, 250))
-  }
-} finally {
-  clearInterval(heartbeat)
-}
-`, { mode: 0o700 })
-  return entry
-}
-
-function writeVerifiedSkills(home) {
-  const rootDir = path.join(home, '.agents')
-  const names = ['tokenless', 'tokenless-install']
-  for (const name of names) {
-    const directory = path.join(rootDir, 'skills', name)
-    fs.mkdirSync(directory, { recursive: true })
-    fs.writeFileSync(path.join(directory, 'SKILL.md'), `---\nname: ${name}\n---\n`, 'utf8')
-  }
-  fs.writeFileSync(path.join(rootDir, '.skill-lock.json'), JSON.stringify({
-    version: 3,
-    skills: Object.fromEntries(names.map((name) => [name, {
-      source: 'jazelly/tokenless',
-      sourceType: 'github',
-      sourceUrl: 'https://github.com/jazelly/tokenless.git',
-      skillPath: `skills/${name}/SKILL.md`,
-    }])),
-  }), 'utf8')
-}
-
-async function waitForManagedProfile(homeDir) {
-  for (let attempt = 0; attempt < 100; attempt += 1) {
-    try {
-      const payload = JSON.parse(fs.readFileSync(path.join(homeDir, 'browser', 'profiles.json'), 'utf8'))
-      const profile = payload.profiles?.default
-      if (profile) return profile
-    } catch {}
-    await new Promise((resolve) => setTimeout(resolve, 50))
-  }
-  throw new Error('Timed out waiting for setup to create the managed profile.')
-}
-
-function installWorkspaceDaemon(homeDir) {
-  const suffix = process.platform === 'win32' ? '.exe' : ''
-  const source = path.join(
-    root,
-    'packages/cli/npm',
-    `tokenless-native-${process.platform}-${process.arch}`,
-    'bin',
-    `tokenless-daemon${suffix}`,
-  )
-  const destinationDir = path.join(homeDir, 'bin')
-  fs.mkdirSync(destinationDir, { recursive: true, mode: 0o700 })
-  const destination = path.join(destinationDir, `tokenless-daemon${suffix}`)
-  fs.copyFileSync(source, destination)
-  if (process.platform !== 'win32') fs.chmodSync(destination, 0o755)
-}
-
-async function completeAsInjectedRunner({ daemonUrl, homeDir, profileId, authState = 'authenticated' }) {
-  const claimed = await daemonPost({
-    daemonUrl,
-    homeDir,
-    path: `/control/jobs/claim-next?${new URLSearchParams({
-      execution_backend: 'playwright',
-      profile_id: profileId,
-      action: 'visible_provider_actions',
-    })}`,
-  })
-  assert.ok(claimed.job, 'in-process runner should claim queued Playwright job')
-  const job = claimed.job
-  assert.equal(job.action, 'visible_provider_actions')
-  const request = job.request_json
-  const responses = request.actions.map((action) => ({
-    protocol: action.protocol,
-    requestId: action.requestId,
-    provider: action.provider,
-    action: action.action,
-    ok: true,
-    result: action.action === 'response.read'
-      ? {
-          text: 'fake managed response for cli-managed-task',
-          citations: [{ label: 'Fixture citation', href: 'https://example.com/source' }],
-          visibleProof: 'in-process-runner',
-        }
-      : action.action === 'auth.status'
-        ? { state: authState, visibleProof: authState === 'authenticated' ? 'visible-authenticated-composer' : 'no-auth-proof-visible' }
-        : action.action === 'navigation.check'
-          ? { allowed: true, provider: request.provider, reason: null }
-          : { visible: true, visibleProof: 'in-process-runner' },
-    error: null,
-  }))
-  await daemonPost({
-    daemonUrl,
-    homeDir,
-    path: `/jobs/${encodeURIComponent(job.job_id)}/complete`,
-    body: {
-      claim_token: job.claim_token,
-      result_json: {
-        protocol: 'tokenless.playwright.job.v2',
-        provider: request.provider,
-        responses,
-      },
-    },
-    })
-    fs.rmSync(path.join(homeDir, 'attachments', job.job_id), { recursive: true, force: true })
-    return job
-  }
-
-async function completeSetupAuthSweep({
-  daemonUrl,
-  homeDir,
-  profileId,
-  providers = SETUP_VISIBLE_PROVIDERS,
-  authStates = {},
-  excludeJobIds = new Set(),
-}) {
-  const jobs = {}
-  for (const provider of providers) {
-    const job = await waitForPlaywrightJob({
-      daemonUrl,
-      homeDir,
-      profileId,
-      provider,
-      actionNames: ['auth.status'],
-      excludeJobIds,
-    })
-    jobs[provider] = job
-    excludeJobIds.add(job.job_id)
-    const completed = await completeAsInjectedRunner({
-      daemonUrl,
-      homeDir,
-      profileId,
-      authState: authStates[provider] ?? 'authenticated',
-    })
-    assert.equal(completed.job_id, job.job_id)
-  }
-  return jobs
-}
-
-async function markNextPlaywrightJobWaiting({
-  daemonUrl,
-  homeDir,
-  profileId,
-  expectedJobId,
-  provider = 'chatgpt',
-}) {
-  const claimed = await daemonPost({
-    daemonUrl,
-    homeDir,
-    path: `/control/jobs/claim-next?${new URLSearchParams({
-      execution_backend: 'playwright',
-      profile_id: profileId,
-      action: 'visible_provider_actions',
-    })}`,
-  })
-  assert.equal(claimed.job.job_id, expectedJobId)
-  await daemonPost({
-    daemonUrl,
-    homeDir,
-    path: `/control/jobs/${encodeURIComponent(expectedJobId)}/running`,
-    body: { claim_token: claimed.job.claim_token },
-  })
-  await daemonPost({
-    daemonUrl,
-    homeDir,
-    path: `/control/jobs/${encodeURIComponent(expectedJobId)}/waiting-for-user`,
-    body: {
-      claim_token: claimed.job.claim_token,
-      blocker_json: {
-        protocol: 'tokenless.playwright.user-handover.v1',
-        jobId: expectedJobId,
-        provider,
-        profileId,
-        blocker: {
-          kind: 'auth',
-          code: 'provider_sign_in_visible',
-          message: 'Provider sign-in is visible and requires the user.',
-          userResolvable: true,
-          retryable: true,
-          visibleProof: 'visible-provider-sign-in-control',
-          provider,
-          url: provider === 'chatgpt' ? 'https://chatgpt.com/' : `https://${provider}.example/`,
-          family: 'provider_sign_in',
-        },
-      },
-    },
-  })
-  return claimed.job
-}
-
-async function failNextPlaywrightJob({
-  daemonUrl,
-  homeDir,
-  profileId,
-  expectedProvider,
-  error = {
-    code: 'playwright_navigation_failed',
-    message: 'Managed Playwright could not open the provider page.',
-    retryable: true,
-  },
-}) {
-  const claimed = await daemonPost({
-    daemonUrl,
-    homeDir,
-    path: `/control/jobs/claim-next?${new URLSearchParams({
-      execution_backend: 'playwright',
-      profile_id: profileId,
-      action: 'visible_provider_actions',
-    })}`,
-  })
-  assert.ok(claimed.job, 'in-process runner should claim queued Playwright job')
-  if (expectedProvider !== undefined) assert.equal(claimed.job.provider, expectedProvider)
-  await daemonPost({
-    daemonUrl,
-    homeDir,
-    path: `/jobs/${encodeURIComponent(claimed.job.job_id)}/complete`,
-    body: {
-      claim_token: claimed.job.claim_token,
-      error_json: error,
-    },
-  })
-  return claimed.job
-}
-
-async function daemonPost({ daemonUrl, homeDir, path: requestPath, body }) {
-  const token = fs.readFileSync(path.join(homeDir, 'daemon.token'), 'utf8').trim()
-  const response = await fetch(`${daemonUrl}${requestPath}`, {
-    method: 'POST',
-    headers: {
-      accept: 'application/json',
-      authorization: `Bearer ${token}`,
-      ...(body === undefined ? {} : { 'content-type': 'application/json' }),
-    },
-    ...(body === undefined ? {} : { body: JSON.stringify(body) }),
-  })
-  const text = await response.text()
-  assert.equal(response.ok, true, `${requestPath}: ${text}`)
-  return text ? JSON.parse(text) : null
-}
-
-function runCli(args, env = {}) {
-  return spawnSync(process.execPath, [cliEntry, ...args], {
-    cwd: root,
-    env: { ...process.env, TOKENLESS_PROVIDER: '', ...env },
-    encoding: 'utf8',
-    timeout: 20000,
-  })
-}
-
-function spawnCli(args, env = {}) {
-  return spawn(process.execPath, [cliEntry, ...args], {
-    cwd: root,
-    env: { ...process.env, TOKENLESS_PROVIDER: '', ...env },
-    stdio: ['ignore', 'pipe', 'pipe'],
-  })
-}
-
-function spawnCliTty(args, env = {}) {
-  const command = [process.execPath, cliEntry, ...args]
-    .map((value) => `{${String(value).replaceAll('\\', '\\\\').replaceAll('{', '\\{').replaceAll('}', '\\}')}}`)
-    .join(' ')
-  const relayScript = [
-    'log_user 1',
-    'set timeout -1',
-    `spawn ${command}`,
-    'fileevent stdin readable {if {[gets stdin line] < 0} {fileevent stdin readable {}} else {send -- "$line\\r"}}',
-    'expect eof',
-    'catch wait result',
-    'exit [lindex $result 3]',
-  ].join('; ')
-  return spawn('expect', ['-c', relayScript], {
-    cwd: root,
-    env: { ...process.env, TOKENLESS_PROVIDER: '', ...env },
-    stdio: ['pipe', 'pipe', 'pipe'],
-  })
-}
-
-function waitForProcessOutput(child, expected, timeoutMs = 5000) {
-  return new Promise((resolve, reject) => {
-    let output = ''
-    const onData = (chunk) => {
-      output += chunk
-      if (!output.includes(expected)) return
-      cleanup()
-      resolve(output)
-    }
-    const onClose = (status) => {
-      cleanup()
-      reject(new Error(`Process exited with status ${status} before output matched ${JSON.stringify(expected)}.\n${output}`))
-    }
-    const timer = setTimeout(() => {
-      cleanup()
-      reject(new Error(`Timed out waiting for output ${JSON.stringify(expected)}.\n${output}`))
-    }, timeoutMs)
-    const cleanup = () => {
-      clearTimeout(timer)
-      child.stdout.off('data', onData)
-      child.stderr.off('data', onData)
-      child.off('close', onClose)
-    }
-    child.stdout.setEncoding('utf8')
-    child.stderr.setEncoding('utf8')
-    child.stdout.on('data', onData)
-    child.stderr.on('data', onData)
-    child.once('close', onClose)
-  })
-}
-
-async function waitForProcess(child, timeoutMs) {
-  let stdout = ''
-  let stderr = ''
-  child.stdout.setEncoding('utf8')
-  child.stderr.setEncoding('utf8')
-  child.stdout.on('data', (chunk) => { stdout += chunk })
-  child.stderr.on('data', (chunk) => { stderr += chunk })
-  return await new Promise((resolve, reject) => {
-    const timer = setTimeout(() => {
-      child.kill('SIGTERM')
-      reject(new Error(`Process timed out.\nstdout:\n${stdout}\nstderr:\n${stderr}`))
-    }, timeoutMs)
-    child.once('error', (error) => {
-      clearTimeout(timer)
-      reject(error)
-    })
-    child.once('close', (status, signal) => {
-      clearTimeout(timer)
-      resolve({ status, signal, stdout, stderr })
-    })
-  })
-}
-
-async function waitForPlaywrightJob({
-  daemonUrl,
-  homeDir,
-  profileId,
-  provider,
-  actionNames,
-  excludeJobIds = new Set(),
-}) {
-  for (let attempt = 0; attempt < 100; attempt += 1) {
-    try {
-      const jobs = await fetchJson(`${daemonUrl}/jobs?execution_backend=playwright&profile_id=${encodeURIComponent(profileId)}`, homeDir)
-      const job = jobs.find((candidate) => {
-        if (candidate.action !== 'visible_provider_actions') return false
-        if (excludeJobIds.has(candidate.job_id)) return false
-        if (provider !== undefined && candidate.provider !== provider) return false
-        if (actionNames !== undefined) {
-          const candidateActions = candidate.request_json?.actions?.map((action) => action.action) ?? []
-          if (candidateActions.join(',') !== actionNames.join(',')) return false
-        }
-        return true
-      })
-      if (job) return job
-    } catch {
-      // The daemon may still be starting.
-    }
-    await new Promise((resolve) => setTimeout(resolve, 50))
-  }
-  throw new Error('Timed out waiting for attached CLI run to create a Playwright job.')
-}
-
-function readOptional(file) {
-  try {
-    return fs.readFileSync(file, 'utf8')
-  } catch {
-    return ''
-  }
-}
-
-async function fetchJson(url, homeDir) {
-  const token = fs.readFileSync(path.join(homeDir, 'daemon.token'), 'utf8').trim()
-  const response = await fetch(url, {
-    headers: { authorization: `Bearer ${token}` },
-  })
-  const text = await response.text()
-  assert.equal(response.ok, true, text)
-  return JSON.parse(text)
-}
-
-async function freePort() {
-  const server = net.createServer()
-  await new Promise((resolve, reject) => {
-    server.once('error', reject)
-    server.listen(0, '127.0.0.1', resolve)
-  })
-  const address = server.address()
-  const port = address.port
-  await new Promise((resolve) => server.close(resolve))
-  return port
-}
-
-async function stopPid(pid) {
-  try {
-    process.kill(pid, 'SIGTERM')
-  } catch {
-    return
-  }
-  for (let index = 0; index < 50; index += 1) {
-    try {
-      process.kill(pid, 0)
-      await new Promise((resolve) => setTimeout(resolve, 50))
-    } catch {
-      return
-    }
-  }
-  try {
-    process.kill(pid, 'SIGKILL')
-  } catch {
-    return
-  }
-  for (let index = 0; index < 50; index += 1) {
-    try {
-      process.kill(pid, 0)
-      await new Promise((resolve) => setTimeout(resolve, 50))
-    } catch {
-      return
-    }
-  }
-  throw new Error(`Process ${pid} did not exit after SIGKILL.`)
-}
diff --git a/test/playwright-context-manager.test.mjs b/test/playwright-context-manager.test.mjs
deleted file mode 100644
index 1d70935..0000000
--- a/test/playwright-context-manager.test.mjs
+++ /dev/null
@@ -1,330 +0,0 @@
-import assert from 'node:assert/strict'
-import { EventEmitter } from 'node:events'
-import test from 'node:test'
-import {
-  PersistentContextManager,
-  TokenlessPlaywrightError,
-  chromeLaunchOptions,
-  managedBrowserLaunchOptions,
-  normalizeBrowserVisibility,
-} from '../packages/cli/dist/src/playwright/index.js'
-
-test('persistent context manager serializes same-profile work and launches Chrome persistently', async () => {
-  const launches = []
-  const manager = new PersistentContextManager({
-    launcher: async (userDataDir, options) => {
-      launches.push({ userDataDir, options })
-      return new FakeContext()
-    },
-  })
-  const profile = { id: 'profile-a', directory: '/tmp/profile-a' }
-  const events = []
-
-  await Promise.all([
-    manager.runWithProfile(profile, async () => {
-      events.push('a-start')
-      await delay(20)
-      events.push('a-end')
-    }),
-    manager.runWithProfile(profile, async () => {
-      events.push('b-start')
-      events.push('b-end')
-    }),
-  ])
-
-  assert.deepEqual(events, ['a-start', 'a-end', 'b-start', 'b-end'])
-  assert.equal(launches.length, 1)
-  assert.equal(launches[0].options.channel, 'chrome')
-  assert.equal(launches[0].options.headless, false)
-  assert.ok(launches[0].options.args.includes('--disable-sync'))
-  await manager.shutdown()
-})
-
-test('persistent context manager caps active profiles at four and shuts down deterministically', async () => {
-  const closed = []
-  const manager = new PersistentContextManager({
-    launcher: async (userDataDir) => new FakeContext(() => closed.push(userDataDir)),
-  })
-  for (let index = 0; index < 4; index += 1) {
-    await manager.ensureContext({ id: `profile-${index}`, directory: `/tmp/profile-${index}` })
-  }
-  await assert.rejects(
-    () => manager.ensureContext({ id: 'profile-4', directory: '/tmp/profile-4' }),
-    matchCode('playwright_context_limit_reached')
-  )
-  assert.deepEqual(manager.activeProfileIds(), ['profile-0', 'profile-1', 'profile-2', 'profile-3'])
-  await manager.shutdown()
-  assert.equal(closed.length, 4)
-  assert.deepEqual(manager.activeProfileIds(), [])
-})
-
-test('persistent context manager deduplicates concurrent direct launches for one profile', async () => {
-  let launches = 0
-  const manager = new PersistentContextManager({
-    launcher: async () => {
-      launches += 1
-      await delay(20)
-      return new FakeContext()
-    },
-  })
-  const profile = { id: 'profile-a', directory: '/tmp/profile-a' }
-
-  const contexts = await Promise.all(Array.from({ length: 8 }, () => manager.ensureContext(profile)))
-
-  assert.equal(launches, 1)
-  assert.equal(new Set(contexts.map((context) => context.browserContext)).size, 1)
-  assert.deepEqual(manager.activeProfileIds(), ['profile-a'])
-  await manager.shutdown()
-})
-
-test('persistent context manager enforces maxContexts under concurrent direct launches', async () => {
-  let launches = 0
-  const manager = new PersistentContextManager({
-    maxContexts: 2,
-    launcher: async () => {
-      launches += 1
-      await delay(20)
-      return new FakeContext()
-    },
-  })
-
-  const results = await Promise.allSettled([
-    manager.ensureContext({ id: 'profile-a', directory: '/tmp/profile-a' }),
-    manager.ensureContext({ id: 'profile-b', directory: '/tmp/profile-b' }),
-    manager.ensureContext({ id: 'profile-c', directory: '/tmp/profile-c' }),
-  ])
-
-  assert.equal(results.filter((result) => result.status === 'fulfilled').length, 2)
-  assert.equal(results.filter((result) => result.status === 'rejected').length, 1)
-  assert.equal(launches, 2)
-  assert.deepEqual(manager.activeProfileIds(), ['profile-a', 'profile-b'])
-  assert.equal(results[2].status, 'rejected')
-  assert.equal(results[2].reason.code, 'playwright_context_limit_reached')
-  await manager.shutdown()
-})
-
-test('persistent context manager reports browser closure as retryable and relaunches later', async () => {
-  let launches = 0
-  const manager = new PersistentContextManager({
-    launcher: async () => {
-      launches += 1
-      return new FakeContext()
-    },
-  })
-  const profile = { id: 'profile-a', directory: '/tmp/profile-a' }
-  await assert.rejects(
-    () => manager.runWithProfile(profile, async () => {
-      throw new Error('browser has been closed')
-    }),
-    (error) => error instanceof TokenlessPlaywrightError && error.code === 'playwright_browser_closed' && error.retryable
-  )
-  await manager.runWithProfile(profile, async () => undefined)
-  assert.equal(launches, 2)
-  await manager.shutdown()
-})
-
-test('persistent context manager relaunches one profile when effective visibility changes', async () => {
-  const closed = []
-  const launches = []
-  const manager = new PersistentContextManager({
-    launcher: async (userDataDir, options) => {
-      const context = new FakeContext(() => closed.push(`${userDataDir}:${options.headless ? 'headless' : 'headed'}`))
-      launches.push({ userDataDir, options, context })
-      return context
-    },
-  })
-  const profile = { id: 'profile-a', directory: '/tmp/profile-a' }
-
-  const auto = await manager.ensureContext(profile, 'auto')
-  const headed = await manager.switchProfileVisibility(profile, 'headed')
-  const headless = await manager.switchProfileVisibility(profile, 'headless')
-
-  assert.notEqual(auto.browserContext, headed.browserContext)
-  assert.notEqual(headed.browserContext, headless.browserContext)
-  assert.equal(auto.browserVisibility, 'auto')
-  assert.equal(auto.effectiveBrowserVisibility, 'headless')
-  assert.equal(headed.effectiveBrowserVisibility, 'headed')
-  assert.equal(headless.browserVisibility, 'headless')
-  assert.equal(headless.effectiveBrowserVisibility, 'headless')
-  assert.deepEqual(launches.map((launch) => launch.options.headless), [true, false, true])
-  assert.deepEqual(launches.map((launch) => launch.options.chromiumSandbox), [true, true, true])
-  assert.deepEqual(closed, ['/tmp/profile-a:headless', '/tmp/profile-a:headed'])
-  assert.deepEqual(manager.activeProfileIds(), ['profile-a'])
-  await manager.shutdown()
-})
-
-test('persistent context manager accepts per-run visibility while preserving legacy call shape', async () => {
-  const launches = []
-  const manager = new PersistentContextManager({
-    launcher: async (_userDataDir, options) => {
-      launches.push(options)
-      return new FakeContext()
-    },
-  })
-  const profile = { id: 'profile-a', directory: '/tmp/profile-a' }
-  const observed = []
-
-  await manager.runWithProfile(profile, async (context) => {
-    observed.push(context.effectiveBrowserVisibility)
-  })
-  await manager.runWithProfile(profile, 'headless', async (context) => {
-    observed.push(context.effectiveBrowserVisibility)
-  })
-
-  assert.deepEqual(observed, ['headed', 'headless'])
-  assert.deepEqual(launches.map((options) => options.headless), [false, true])
-  await manager.shutdown()
-})
-
-test('persistent context manager scheduled profile close is idle and context identity safe', async () => {
-  const timers = new FakeTimers()
-  const contexts = []
-  const manager = new PersistentContextManager({
-    timers,
-    launcher: async () => {
-      const context = new FakeContext()
-      contexts.push(context)
-      return context
-    },
-  })
-  const profile = { id: 'profile-a', directory: '/tmp/profile-a' }
-
-  const headed = await manager.ensureContext(profile, 'headed')
-  manager.scheduleCloseProfile(profile.id, { delayMs: 30_000, browserContext: headed.browserContext })
-  await manager.runWithProfile(profile, 'headed', async () => undefined)
-  await timers.advance(30_000)
-  assert.deepEqual(manager.activeProfileIds(), ['profile-a'])
-  assert.equal(contexts[0].closed, false)
-
-  manager.scheduleCloseProfile(profile.id, { delayMs: 30_000, browserContext: headed.browserContext })
-  const headless = await manager.switchProfileVisibility(profile, 'headless')
-  await timers.advance(30_000)
-  assert.deepEqual(manager.activeProfileIds(), ['profile-a'])
-  assert.equal(contexts[0].closed, true)
-  assert.equal(contexts[1].closed, false)
-
-  manager.scheduleCloseProfile(profile.id, { delayMs: 30_000, browserContext: headed.browserContext })
-  await timers.advance(30_000)
-  assert.deepEqual(manager.activeProfileIds(), ['profile-a'])
-  assert.equal(contexts[1].closed, false)
-
-  manager.scheduleCloseProfile(profile.id, { delayMs: 30_000, browserContext: headless.browserContext })
-  await timers.advance(29_999)
-  assert.deepEqual(manager.activeProfileIds(), ['profile-a'])
-  await timers.advance(1)
-  assert.deepEqual(manager.activeProfileIds(), [])
-  assert.equal(contexts[1].closed, true)
-})
-
-test('Chrome launch options preserve imported OS credential state without exposing remote debugging', () => {
-  const options = chromeLaunchOptions()
-  assert.equal(options.channel, 'chrome')
-  assert.equal(options.headless, false)
-  assert.equal(options.chromiumSandbox, true)
-  assert.deepEqual(options.ignoreDefaultArgs, [
-    '--password-store=basic',
-    '--use-mock-keychain',
-  ])
-  assert.equal(options.args.some((arg) => /remote-debugging/i.test(arg)), false)
-})
-
-test('headless launch options keep Chromium sandbox enabled', () => {
-  const options = managedBrowserLaunchOptions({ id: 'chrome' }, 'headless')
-  assert.equal(options.channel, 'chrome')
-  assert.equal(options.headless, true)
-  assert.equal(options.chromiumSandbox, true)
-  assert.equal(options.args.some((arg) => /no-sandbox/i.test(arg)), false)
-})
-
-test('auto launch options use fresh headless mode with Chromium sandbox enabled', () => {
-  const options = managedBrowserLaunchOptions({ id: 'chrome' }, 'auto')
-  assert.equal(options.channel, 'chrome')
-  assert.equal(options.headless, true)
-  assert.equal(options.chromiumSandbox, true)
-})
-
-test('managed Brave launch uses the selected executable with the same visible persistent safety options', () => {
-  const options = managedBrowserLaunchOptions({ id: 'brave', executablePath: '/Applications/Brave Browser.app/Contents/MacOS/Brave Browser' })
-  assert.equal(options.channel, undefined)
-  assert.equal(options.executablePath, '/Applications/Brave Browser.app/Contents/MacOS/Brave Browser')
-  assert.equal(options.headless, false)
-  assert.equal(options.chromiumSandbox, true)
-  assert.ok(options.args.includes('--disable-sync'))
-  assert.equal(options.args.some((arg) => /remote-debugging/i.test(arg)), false)
-})
-
-test('browser visibility normalization accepts only public visibility policies', () => {
-  assert.equal(normalizeBrowserVisibility(' AUTO '), 'auto')
-  assert.equal(normalizeBrowserVisibility('headed'), 'headed')
-  assert.equal(normalizeBrowserVisibility('headless'), 'headless')
-  assert.equal(normalizeBrowserVisibility('hidden'), null)
-})
-
-class FakeContext extends EventEmitter {
-  #pages = []
-  #onClose
-
-  constructor(onClose = () => undefined) {
-    super()
-    this.#onClose = onClose
-    this.closed = false
-  }
-
-  pages() {
-    return this.#pages
-  }
-
-  async newPage() {
-    const page = {}
-    this.#pages.push(page)
-    return page
-  }
-
-  async close() {
-    this.closed = true
-    this.#onClose()
-    this.emit('close')
-  }
-}
-
-function delay(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms))
-}
-
-function matchCode(code) {
-  return (error) => error instanceof TokenlessPlaywrightError && error.code === code
-}
-
-class FakeTimers {
-  constructor() {
-    this.now = 0
-    this.timers = []
-  }
-
-  setTimeout(callback, ms) {
-    const timer = {
-      dueAt: this.now + ms,
-      callback,
-      cleared: false,
-    }
-    this.timers.push(timer)
-    return timer
-  }
-
-  clearTimeout(timer) {
-    timer.cleared = true
-  }
-
-  async advance(ms) {
-    this.now += ms
-    while (true) {
-      const due = this.timers
-        .filter((timer) => !timer.cleared && timer.dueAt <= this.now)
-        .sort((left, right) => left.dueAt - right.dueAt)[0]
-      if (!due) return
-      due.cleared = true
-      due.callback()
-      await Promise.resolve()
-    }
-  }
-}
diff --git a/test/playwright-contracts.test.mjs b/test/playwright-contracts.test.mjs
deleted file mode 100644
index fe37dc7..0000000
--- a/test/playwright-contracts.test.mjs
+++ /dev/null
@@ -1,479 +0,0 @@
-import assert from 'node:assert/strict'
-import { createHash } from 'node:crypto'
-import { mkdtemp, readFile, rm, symlink, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import test from 'node:test'
-import {
-  TokenlessPlaywrightError,
-  MANAGED_PLAYWRIGHT_JOB_PROTOCOL_VERSION,
-  MANAGED_PLAYWRIGHT_JOB_PROTOCOL_VERSION_V1,
-  VISIBLE_ACTIONS,
-  VISIBLE_ATTACHMENT_PROTOCOL_VERSION,
-  VISIBLE_ACTION_PROTOCOL_VERSION,
-  createManagedPlaywrightJobRequest,
-  createVisibleActionRequest,
-  createProviderAdapterRegistry,
-  assertProviderUrlAllowed,
-  canonicalProviderTarget,
-  listProviders,
-  validateManagedPlaywrightJobRequest,
-  validateVisibleActionRequest,
-} from '../packages/cli/dist/src/playwright/index.js'
-
-test('visible action validation is versioned, exact-key only, path-free in upload results, and provider-complete', () => {
-  assert.deepEqual(listProviders().map((provider) => provider.id).sort(), ['chatgpt', 'claude', 'gemini', 'grok'])
-
-  const request = createVisibleActionRequest({
-    provider: 'chatgpt',
-    action: VISIBLE_ACTIONS.PROMPT_INPUT,
-    payload: { text: 'hello' },
-  })
-  assert.equal(request.protocol, VISIBLE_ACTION_PROTOCOL_VERSION)
-
-  assert.throws(() => validateVisibleActionRequest({
-    protocol: VISIBLE_ACTION_PROTOCOL_VERSION,
-    requestId: 'r1',
-    provider: 'chatgpt',
-    action: VISIBLE_ACTIONS.PROMPT_INPUT,
-    payload: { text: 'hello', extra: true },
-  }), matchCode('invalid_visible_action_payload'))
-
-  assert.throws(() => validateVisibleActionRequest({
-    protocol: VISIBLE_ACTION_PROTOCOL_VERSION,
-    requestId: 'r1',
-    provider: 'chatgpt',
-    action: VISIBLE_ACTIONS.FILE_UPLOAD,
-    payload: {
-      attachments: [{
-        protocol: VISIBLE_ATTACHMENT_PROTOCOL_VERSION,
-        bundleId: 'bundle-1',
-        attachmentId: 'a1',
-        name: '../secret.txt',
-        type: 'text/plain',
-        size: 1,
-        sha256: 'a'.repeat(64),
-      }],
-    },
-  }), matchCode('invalid_visible_attachment'))
-
-  assert.throws(() => validateVisibleActionRequest({
-    protocol: VISIBLE_ACTION_PROTOCOL_VERSION,
-    requestId: 'r1',
-    provider: 'chatgpt',
-    action: VISIBLE_ACTIONS.FILE_UPLOAD,
-    payload: {
-      attachments: [{
-        protocol: VISIBLE_ATTACHMENT_PROTOCOL_VERSION,
-        bundleId: 'bundle-1',
-        attachmentId: 'a1',
-        name: 'safe.txt',
-        type: 'text/plain',
-        size: 1,
-        sha256: 'a'.repeat(64),
-        stagedFile: '/private/staged/file',
-      }],
-    },
-  }), matchCode('invalid_visible_attachment'))
-})
-
-test('managed Playwright job contract emits v2 visibility and normalizes v1 as headed', () => {
-  const request = createManagedPlaywrightJobRequest({
-    provider: 'chatgpt',
-    browserVisibility: 'headless',
-    actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-  })
-
-  assert.equal(request.protocol, MANAGED_PLAYWRIGHT_JOB_PROTOCOL_VERSION)
-  assert.equal(request.browserVisibility, 'headless')
-  assert.throws(() => validateManagedPlaywrightJobRequest({
-    ...request,
-    browserVisibility: 'hidden',
-  }), matchCode('invalid_playwright_job_browser_visibility'))
-
-  const legacy = validateManagedPlaywrightJobRequest({
-    protocol: MANAGED_PLAYWRIGHT_JOB_PROTOCOL_VERSION_V1,
-    provider: 'chatgpt',
-    target: { kind: 'provider_home', url: 'https://chatgpt.com/' },
-    taskId: null,
-    actions: request.actions,
-  })
-
-  assert.equal(legacy.protocol, MANAGED_PLAYWRIGHT_JOB_PROTOCOL_VERSION)
-  assert.equal(legacy.browserVisibility, 'headed')
-
-  const defaulted = createManagedPlaywrightJobRequest({
-    provider: 'chatgpt',
-    actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-  })
-
-  assert.equal(defaulted.browserVisibility, 'auto')
-})
-
-test('observed provider URLs ignore same-origin query state without relaxing requested targets', () => {
-  const claude = listProviders().find((provider) => provider.id === 'claude')
-  assert.ok(claude)
-
-  assert.equal(canonicalProviderTarget(claude, 'https://claude.ai/new?provider-state=opaque#composer'), null)
-  assert.deepEqual(assertProviderUrlAllowed(claude, 'https://claude.ai/new?provider-state=opaque#composer'), {
-    ok: true,
-    target: {
-      providerId: 'claude',
-      href: 'https://claude.ai/new',
-      origin: 'https://claude.ai',
-      pathname: '/new',
-    },
-  })
-  for (const rejected of [
-    'http://claude.ai/new?provider-state=opaque',
-    'https://user@claude.ai/new?provider-state=opaque',
-    'https://claude.ai:444/new?provider-state=opaque',
-    'https://example.com/new?provider-state=opaque',
-    'https://claude.ai/new\\settings?provider-state=opaque',
-  ]) {
-    assert.equal(assertProviderUrlAllowed(claude, rejected).ok, false, rejected)
-  }
-})
-
-test('sanitized snapshots expose only bounded structure and never page body or private route text', async () => {
-  const registry = createProviderAdapterRegistry()
-  const page = new FakeSnapshotPage()
-  const response = await registry.execute(page, createVisibleActionRequest({
-    provider: 'chatgpt',
-    action: VISIBLE_ACTIONS.SNAPSHOT_SANITIZED,
-    payload: {},
-  }), {
-    profileId: 'profile-a',
-    operationId: 'op-a',
-  })
-
-  assert.equal(response.ok, true)
-  assert.deepEqual(response.result.page, {
-    origin: 'https://chatgpt.com',
-  })
-  const serialized = JSON.stringify(response.result)
-  assert.equal(serialized.includes('PRIVATE_BODY_SENTINEL'), false)
-  assert.equal(serialized.includes('alice@example.com'), false)
-  assert.equal(serialized.includes('PROMPT_SENTINEL'), false)
-  assert.equal(serialized.includes('history item sentinel'), false)
-  assert.equal(serialized.includes('Send message'), false)
-  assert.equal(serialized.includes('Alice Smith'), false)
-  assert.equal(serialized.includes('Tax audit notes'), false)
-  assert.deepEqual(response.result.controls, [
-    { tag: 'button', disabled: false, visible: true },
-    { tag: 'textarea', disabled: false, visible: true },
-    { tag: 'button', disabled: false, visible: true },
-  ])
-  assert.equal('text' in response.result, false)
-})
-
-test('auth status waits for provider UI hydration before reporting unknown', async () => {
-  const registry = createProviderAdapterRegistry()
-  const page = new FakeHydratingAuthPage()
-  const response = await registry.execute(page, createVisibleActionRequest({
-    provider: 'chatgpt',
-    action: VISIBLE_ACTIONS.AUTH_STATUS,
-    payload: {},
-  }), {
-    profileId: 'profile-a',
-    operationId: 'op-a',
-  })
-
-  assert.equal(response.ok, true)
-  assert.deepEqual(response.result, {
-    state: 'authenticated',
-    visibleProof: 'authenticated-control-visible',
-  })
-  assert.equal(page.waits > 0, true)
-})
-
-test('auth status accepts a visible provider composer when dedicated account controls drift', async () => {
-  const registry = createProviderAdapterRegistry()
-  const page = new FakeComposerAuthPage()
-  const response = await registry.execute(page, createVisibleActionRequest({
-    provider: 'claude',
-    action: VISIBLE_ACTIONS.AUTH_STATUS,
-    payload: {},
-  }), {
-    profileId: 'profile-a',
-    operationId: 'op-a',
-  })
-
-  assert.equal(response.ok, true)
-  assert.deepEqual(response.result, {
-    state: 'authenticated',
-    visibleProof: 'authenticated-control-visible',
-  })
-})
-
-test('visible file uploads resolve path-free attachment descriptors inside attachmentRoot', async () => {
-  const root = await mkdtemp(join(tmpdir(), 'tokenless-attachments-'))
-  try {
-    const content = Buffer.from('visible upload payload')
-    const descriptor = await writeAttachment(root, 'bundle-1', 'attachment-1', content)
-    const page = new FakeUploadPage()
-    const registry = createProviderAdapterRegistry()
-    const response = await registry.execute(page, createVisibleActionRequest({
-      provider: 'chatgpt',
-      action: VISIBLE_ACTIONS.FILE_UPLOAD,
-      payload: { attachments: [descriptor] },
-    }), {
-      profileId: 'profile-a',
-      operationId: 'op-a',
-      attachmentRoot: root,
-    })
-
-    assert.equal(response.ok, true)
-    assert.equal(page.uploads.length, 1)
-    assert.equal(page.uploads[0].name, 'note.txt')
-    assert.equal(page.uploads[0].mimeType, 'text/plain')
-    assert.deepEqual(page.uploads[0].buffer, content)
-    assert.equal(JSON.stringify(response.result).includes(root), false)
-    assert.deepEqual(response.result.attachments[0], {
-      protocol: VISIBLE_ATTACHMENT_PROTOCOL_VERSION,
-      bundleId: 'bundle-1',
-      attachmentId: 'attachment-1',
-      name: 'note.txt',
-      type: 'text/plain',
-      size: content.length,
-      sha256: descriptor.sha256,
-      visible: true,
-    })
-  } finally {
-    await rm(root, { recursive: true, force: true })
-  }
-})
-
-test('visible file uploads reject symlinks and descriptor integrity mismatches', async (t) => {
-  const root = await mkdtemp(join(tmpdir(), 'tokenless-attachments-'))
-  try {
-    const content = Buffer.from('visible upload payload')
-    const descriptor = await writeAttachment(root, 'bundle-1', 'attachment-1', content)
-    const registry = createProviderAdapterRegistry()
-
-    await assertUploadRejected(registry, root, {
-      ...descriptor,
-      size: descriptor.size + 1,
-    }, 'invalid_visible_attachment')
-
-    await assertUploadRejected(registry, root, {
-      ...descriptor,
-      sha256: '0'.repeat(64),
-    }, 'invalid_visible_attachment')
-
-    await rm(join(root, 'bundle-1', 'attachment-1.bin'))
-    try {
-      await symlink(join(root, 'outside.bin'), join(root, 'bundle-1', 'attachment-1.bin'))
-      await writeFile(join(root, 'outside.bin'), content)
-    } catch (error) {
-      if (error?.code === 'EPERM') {
-        t.diagnostic('Symlink upload rejection is covered on platforms that permit symlink creation.')
-        return
-      }
-      throw error
-    }
-    await assertUploadRejected(registry, root, descriptor, 'invalid_visible_attachment')
-  } finally {
-    await rm(root, { recursive: true, force: true })
-  }
-})
-
-test('visible file upload failures do not expose local attachment paths', async () => {
-  const root = await mkdtemp(join(tmpdir(), 'tokenless-private-attachment-root-'))
-  try {
-    const registry = createProviderAdapterRegistry()
-    const descriptor = {
-      protocol: VISIBLE_ATTACHMENT_PROTOCOL_VERSION,
-      bundleId: 'missing-bundle',
-      attachmentId: 'missing-file',
-      name: 'note.txt',
-      type: 'text/plain',
-      size: 1,
-      sha256: '0'.repeat(64),
-    }
-    const response = await registry.execute(new FakeUploadPage(), createVisibleActionRequest({
-      provider: 'chatgpt',
-      action: VISIBLE_ACTIONS.FILE_UPLOAD,
-      payload: { attachments: [descriptor] },
-    }), {
-      profileId: 'profile-a',
-      operationId: 'op-a',
-      attachmentRoot: root,
-    })
-    assert.equal(response.ok, false)
-    assert.equal(response.error.code, 'invalid_visible_attachment')
-    assert.equal(JSON.stringify(response).includes(root), false)
-    assert.equal(response.error.message, 'Attachment file cannot be resolved or verified.')
-  } finally {
-    await rm(root, { recursive: true, force: true })
-  }
-})
-
-test('managed Playwright source contains no forbidden browser credential or private transport APIs', async () => {
-  const files = [
-    'actions.ts',
-    'adapters/index.ts',
-    'adapters/provider-dom-adapter.ts',
-    'browser/context-manager.ts',
-    'profiles/chrome-discovery.ts',
-    'profiles/import.ts',
-    'profiles/registry.ts',
-    'profiles/sqlite-lock.ts',
-    'providers.ts',
-  ]
-  const source = (await Promise.all(files.map((file) => readFile(join('packages/cli/src/playwright', file), 'utf8')))).join('\n')
-  const forbidden = [
-    /\.cookies\s*\(/,
-    /\.storageState\s*\(/,
-    /localStorage\s*\./,
-    /\.route\s*\(/,
-    /connectOverCDP/,
-    /remote-debugging-port/,
-    /Network\./,
-    /console\.(?:log|debug|info|warn|error)/,
-  ]
-  for (const pattern of forbidden) {
-    assert.equal(pattern.test(source), false, `forbidden pattern found: ${pattern}`)
-  }
-})
-
-test('CLI package declares playwright-core as a direct runtime dependency', async () => {
-  const manifest = JSON.parse(await readFile('packages/cli/package.json', 'utf8'))
-  assert.equal(typeof manifest.dependencies['playwright-core'], 'string')
-  assert.equal(manifest.dependencies['@tokenless/playwright'], undefined)
-})
-
-function matchCode(code) {
-  return (error) => error instanceof TokenlessPlaywrightError && error.code === code
-}
-
-async function writeAttachment(root, bundleId, attachmentId, content) {
-  await import('node:fs/promises').then((fs) => fs.mkdir(join(root, bundleId), { recursive: true }))
-  await writeFile(join(root, bundleId, `${attachmentId}.bin`), content)
-  return {
-    protocol: VISIBLE_ATTACHMENT_PROTOCOL_VERSION,
-    bundleId,
-    attachmentId,
-    name: 'note.txt',
-    type: 'text/plain',
-    size: content.length,
-    sha256: createHash('sha256').update(content).digest('hex'),
-  }
-}
-
-async function assertUploadRejected(registry, root, descriptor, code) {
-  const response = await registry.execute(new FakeUploadPage(), createVisibleActionRequest({
-    provider: 'chatgpt',
-    action: VISIBLE_ACTIONS.FILE_UPLOAD,
-    payload: { attachments: [descriptor] },
-  }), {
-    profileId: 'profile-a',
-    operationId: 'op-a',
-    attachmentRoot: root,
-  })
-  assert.equal(response.ok, false)
-  assert.equal(response.error.code, code)
-}
-
-class FakeUploadPage {
-  uploads = []
-
-  url() {
-    return 'https://chatgpt.com/'
-  }
-
-  locator() {
-    const locator = {
-      filter: () => locator,
-      first: () => ({
-        isVisible: async () => true,
-        setInputFiles: async (files) => {
-          this.uploads = files
-        },
-      }),
-    }
-    return locator
-  }
-}
-
-class FakeSnapshotPage {
-  url() {
-    return 'https://chatgpt.com/c/12345678-1234-4234-9234-123456789abc'
-  }
-
-  async evaluate(callback) {
-    const previousDocument = globalThis.document
-    const previousLocation = globalThis.location
-    globalThis.location = {
-      origin: 'https://chatgpt.com',
-      pathname: '/c/12345678-1234-4234-9234-123456789abc',
-    }
-    globalThis.document = {
-      body: {
-        innerText: 'PRIVATE_BODY_SENTINEL alice@example.com PROMPT_SENTINEL history item sentinel',
-      },
-      querySelectorAll: () => [
-        fakeElement('BUTTON', { 'aria-label': 'Send message' }, 'PROMPT_SENTINEL'),
-        fakeElement('TEXTAREA', { placeholder: 'Alice Smith' }, ''),
-        fakeElement('BUTTON', { 'aria-label': 'Tax audit notes' }, ''),
-      ],
-    }
-    try {
-      return callback()
-    } finally {
-      globalThis.document = previousDocument
-      globalThis.location = previousLocation
-    }
-  }
-}
-
-class FakeHydratingAuthPage {
-  hydrated = false
-  waits = 0
-
-  url() {
-    return 'https://chatgpt.com/'
-  }
-
-  locator(selector) {
-    return {
-      first: () => ({
-        isVisible: async () => this.hydrated && selector === '#prompt-textarea',
-      }),
-    }
-  }
-
-  async waitForTimeout() {
-    this.waits += 1
-    this.hydrated = true
-  }
-}
-
-class FakeComposerAuthPage {
-  url() {
-    return 'https://claude.ai/new'
-  }
-
-  locator(selector) {
-    return {
-      first: () => ({
-        isVisible: async () => selector === 'div[contenteditable="true"][role="textbox"]',
-      }),
-    }
-  }
-
-  async waitForTimeout() {}
-}
-
-function fakeElement(tagName, attributes, textContent) {
-  return {
-    tagName,
-    textContent,
-    getAttribute(name) {
-      return attributes[name] ?? null
-    },
-    hasAttribute(name) {
-      return Object.hasOwn(attributes, name)
-    },
-  }
-}
diff --git a/test/playwright-provider-prompt-actions.test.mjs b/test/playwright-provider-prompt-actions.test.mjs
deleted file mode 100644
index 75d20b0..0000000
--- a/test/playwright-provider-prompt-actions.test.mjs
+++ /dev/null
@@ -1,395 +0,0 @@
-import assert from 'node:assert/strict'
-import fs from 'node:fs'
-import path from 'node:path'
-import test from 'node:test'
-import { fileURLToPath } from 'node:url'
-
-import {
-  VISIBLE_ACTIONS,
-  createProviderAdapterRegistry,
-  createVisibleActionRequest,
-  listProviders,
-} from '../packages/cli/dist/src/playwright/index.js'
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-const fixtureRoot = path.join(root, 'test/fixtures/provider-dom')
-
-const providers = [
-  {
-    id: 'chatgpt',
-    state: 'signed-in-paid',
-    url: 'https://chatgpt.com/',
-  },
-  {
-    id: 'claude',
-    state: 'signed-in-free',
-    url: 'https://claude.ai/new',
-  },
-  {
-    id: 'gemini',
-    state: 'signed-in-unknown',
-    url: 'https://gemini.google.com/app',
-  },
-  {
-    id: 'grok',
-    state: 'signed-in-unknown',
-    url: 'https://grok.com/',
-  },
-]
-
-test('blocker.check classifies visible challenge families, sign-in, terminal blockers, and ignores hidden matches', { timeout: 60000 }, async (t) => {
-  const { chromium } = await import('playwright')
-  const browser = await chromium.launch({ headless: true })
-  const registry = createProviderAdapterRegistry()
-  t.after(() => browser.close())
-
-  const cases = [
-    ['recaptcha', '<iframe title="reCAPTCHA" src="https://www.google.com/recaptcha/api2/anchor" style="width:300px;height:80px"></iframe>', 'visible_recaptcha', 'challenge'],
-    ['cloudflare', '<main style="display:block">Checking if the site connection is secure. Verify you are human.</main>', 'visible_cloudflare_interstitial', 'challenge'],
-    ['turnstile', '<iframe title="Cloudflare Turnstile" src="https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/managed/v1" style="width:300px;height:80px"></iframe>', 'visible_cloudflare_turnstile', 'challenge'],
-    ['hcaptcha', '<iframe title="hCaptcha" src="https://newassets.hcaptcha.com/captcha/v1/test" style="width:300px;height:80px"></iframe>', 'visible_hcaptcha', 'challenge'],
-    ['arkose', '<iframe title="FunCaptcha" src="https://client-api.arkoselabs.com/fc/gc/" style="width:300px;height:80px"></iframe>', 'visible_arkose_funcaptcha', 'challenge'],
-    ['sign-in', '<button style="display:block;width:200px;height:40px">Sign in</button>', 'provider_sign_in_visible', 'auth'],
-    ['placeholder-sign-in', '<input placeholder="Email address" style="display:block;width:260px;height:40px">', 'provider_sign_in_visible', 'auth'],
-    ['rate-limit', '<main style="display:block">Rate limit reached. Too many requests.</main>', 'provider_rate_limited', 'terminal'],
-    ['plan-limit', '<main style="display:block">Upgrade your plan to continue.</main>', 'provider_plan_limited', 'terminal'],
-  ]
-
-  for (const [name, body, code, kind] of cases) {
-    await t.test(name, async () => {
-      const context = await browser.newContext({ viewport: { width: 900, height: 700 } })
-      const page = await context.newPage()
-      try {
-        await fulfillProviderPage(page, `<!doctype html><html><body>${body}<textarea style="width:400px;height:80px"></textarea></body></html>`)
-        const response = await registry.execute(
-          page,
-          visibleRequest('chatgpt', VISIBLE_ACTIONS.BLOCKER_CHECK),
-          { profileId: 'profile', operationId: `blocker-${name}` },
-        )
-        assert.equal(response.ok, true, JSON.stringify(response, null, 2))
-        assert.equal(response.result.blocked, true)
-        assert.equal(response.result.blockers.some((blocker) => blocker.code === code && blocker.kind === kind), true)
-      } finally {
-        await context.close()
-      }
-    })
-  }
-
-  const context = await browser.newContext({ viewport: { width: 900, height: 700 } })
-  const page = await context.newPage()
-  try {
-    await fulfillProviderPage(page, '<!doctype html><html><body><iframe title="reCAPTCHA" src="https://www.google.com/recaptcha/api2/anchor" style="display:none;width:300px;height:80px"></iframe><main>Ready</main></body></html>')
-    const startedAt = performance.now()
-    const response = await registry.execute(
-      page,
-      visibleRequest('chatgpt', VISIBLE_ACTIONS.BLOCKER_CHECK),
-      { profileId: 'profile', operationId: 'blocker-hidden' },
-    )
-    const elapsedMs = performance.now() - startedAt
-    assert.equal(response.ok, true, JSON.stringify(response, null, 2))
-    assert.equal(response.result.blocked, false)
-    assert.equal(response.result.blockers.length, 0)
-    assert.ok(elapsedMs < 250, `no-blocker check took ${elapsedMs}ms`)
-  } finally {
-    await context.close()
-  }
-
-  for (const [name, body] of [
-    ['hidden-ancestor-text', '<div style="opacity:0"><main style="display:block;width:300px;height:80px">Checking if the site connection is secure. Verify you are human.</main></div>'],
-    ['hidden-placeholder-sign-in', '<div style="opacity:0"><input placeholder="Email address" style="display:block;width:260px;height:40px"></div>'],
-    ['generic-data-sitekey', '<div data-sitekey="recaptcha-site-key" style="display:block;width:260px;height:80px"></div>'],
-  ]) {
-    await t.test(name, async () => {
-      const context = await browser.newContext({ viewport: { width: 900, height: 700 } })
-      const page = await context.newPage()
-      try {
-        await fulfillProviderPage(page, `<!doctype html><html><body>${body}<textarea style="width:400px;height:80px"></textarea></body></html>`)
-        const response = await registry.execute(
-          page,
-          visibleRequest('chatgpt', VISIBLE_ACTIONS.BLOCKER_CHECK),
-          { profileId: 'profile', operationId: `blocker-${name}` },
-        )
-        assert.equal(response.ok, true, JSON.stringify(response, null, 2))
-        assert.equal(response.result.blocked, false)
-        assert.equal(response.result.blockers.length, 0)
-      } finally {
-        await context.close()
-      }
-    })
-  }
-
-  for (const [name, provider, url, body] of [
-    ['hidden-login-selector-fallback', 'claude', 'https://claude.ai/new', '<div style="opacity:0"><input placeholder="Enter your email" style="display:block;width:260px;height:40px"></div>'],
-    ['hidden-captcha-selector-fallback', 'chatgpt', 'https://chatgpt.com/', '<div style="opacity:0"><iframe title="captcha" src="https://example.com/captcha" style="width:300px;height:80px"></iframe></div>'],
-    ['hidden-rate-selector-fallback', 'chatgpt', 'https://chatgpt.com/', '<div style="opacity:0;width:300px;height:80px">Rate limit reached. Too many requests.</div>'],
-  ]) {
-    await t.test(name, async () => {
-      const context = await browser.newContext({ viewport: { width: 900, height: 700 } })
-      const page = await context.newPage()
-      try {
-        await fulfillProviderPage(page, `<!doctype html><html><body>${body}<textarea style="width:400px;height:80px"></textarea></body></html>`, url)
-        const response = await registry.execute(
-          page,
-          visibleRequest(provider, VISIBLE_ACTIONS.BLOCKER_CHECK),
-          { profileId: 'profile', operationId: `blocker-${name}` },
-        )
-        assert.equal(response.ok, true, JSON.stringify(response, null, 2))
-        assert.equal(response.result.blocked, false)
-        assert.equal(response.result.blockers.length, 0)
-      } finally {
-        await context.close()
-      }
-    })
-  }
-})
-
-test('public Playwright provider registry inputs and clears prompt text on captured composer DOM', { timeout: 60000 }, async (t) => {
-  const { chromium } = await import('playwright')
-  const browser = await chromium.launch({ headless: true })
-  const registry = createProviderAdapterRegistry()
-  const providerConfigs = new Map(listProviders().map((provider) => [provider.id, provider]))
-  t.after(() => browser.close())
-
-  assert.deepEqual(providers.map((provider) => provider.id), ['chatgpt', 'claude', 'gemini', 'grok'])
-
-  for (const provider of providers) {
-    await t.test(provider.id, async () => {
-      const context = await browser.newContext({ viewport: { width: 1100, height: 850 } })
-      const page = await context.newPage()
-      try {
-        await openCapturedFixture(page, provider)
-        const providerConfig = providerConfigs.get(provider.id)
-        assert.ok(providerConfig, `provider config missing: ${provider.id}`)
-        const prompt = `Tokenless deterministic prompt draft for ${provider.id}`
-        const adapterContext = {
-          profileId: `${provider.id}-fixture-profile`,
-          operationId: `${provider.id}-prompt-actions`,
-        }
-
-        const input = await registry.execute(page, visibleRequest(provider.id, VISIBLE_ACTIONS.PROMPT_INPUT, { text: prompt }), adapterContext)
-        assert.equal(input.ok, true, JSON.stringify(input, null, 2))
-        assert.deepEqual(input.result, {
-          visible: true,
-          inputProof: 'prompt-text-visible',
-        })
-        assert.equal(await visibleComposerText(page, providerConfig.composerSelectors), prompt)
-
-        const clear = await registry.execute(page, visibleRequest(provider.id, VISIBLE_ACTIONS.PROMPT_CLEAR), adapterContext)
-        assert.equal(clear.ok, true, JSON.stringify(clear, null, 2))
-        assert.deepEqual(clear.result, {
-          visible: true,
-          inputProof: 'empty',
-        })
-        assert.equal(await visibleComposerText(page, providerConfig.composerSelectors), '')
-      } finally {
-        await context.close()
-      }
-    })
-  }
-})
-
-async function fulfillProviderPage(page, body, url = 'https://chatgpt.com/') {
-  const origin = new URL(url).origin
-  await page.route(`${origin}/**`, (route) => route.fulfill({
-    status: 200,
-    contentType: 'text/html',
-    body,
-  }))
-  await page.goto(url, { waitUntil: 'domcontentloaded' })
-}
-
-test('public Playwright provider registry fails text-free when prompt text is not visible', { timeout: 30000 }, async (t) => {
-  const { chromium } = await import('playwright')
-  const browser = await chromium.launch({ headless: true })
-  const registry = createProviderAdapterRegistry()
-  t.after(() => browser.close())
-
-  const context = await browser.newContext({ viewport: { width: 1100, height: 850 } })
-  const page = await context.newPage()
-  try {
-    const provider = providers[0]
-    const providerConfig = listProviders().find((candidate) => candidate.id === provider.id)
-    assert.ok(providerConfig, `provider config missing: ${provider.id}`)
-    await openCapturedFixture(page, provider)
-    const composer = page.locator(providerConfig.composerSelectors[0]).first()
-    await composer.evaluate((element) => {
-      element.addEventListener('input', () => {
-        if (element instanceof HTMLTextAreaElement || element instanceof HTMLInputElement) {
-          element.value = ''
-        } else {
-          element.textContent = ''
-        }
-      })
-    })
-
-    const marker = 'Tokenless deterministic nonvisible prompt draft'
-    const response = await registry.execute(
-      page,
-      visibleRequest(provider.id, VISIBLE_ACTIONS.PROMPT_INPUT, { text: marker }),
-      {
-        profileId: `${provider.id}-fixture-profile`,
-        operationId: `${provider.id}-prompt-actions-nonvisible`,
-      },
-    )
-
-    assert.equal(response.ok, false, JSON.stringify(response, null, 2))
-    assert.equal(response.result, null)
-    assert.equal(response.error?.code, 'playwright_unexpected_error')
-    assert.doesNotMatch(JSON.stringify(response), new RegExp(marker))
-    assert.equal(await visibleComposerText(page, providerConfig.composerSelectors), '')
-  } finally {
-    await context.close()
-  }
-})
-
-test('public Playwright provider registry targets the visible composer when a hidden fallback matches first', { timeout: 30000 }, async (t) => {
-  const { chromium } = await import('playwright')
-  const browser = await chromium.launch({ headless: true })
-  const registry = createProviderAdapterRegistry()
-  t.after(() => browser.close())
-
-  const context = await browser.newContext({ viewport: { width: 1100, height: 850 } })
-  const page = await context.newPage()
-  try {
-    await page.route('https://chatgpt.com/**', (route) => route.fulfill({
-      status: 200,
-      contentType: 'text/html',
-      body: '<!doctype html><html><body><textarea hidden></textarea><textarea aria-label="Chat with ChatGPT"></textarea></body></html>',
-    }))
-    await page.goto('https://chatgpt.com/', { waitUntil: 'domcontentloaded' })
-
-    const marker = 'Tokenless visible composer selection proof'
-    const response = await registry.execute(
-      page,
-      visibleRequest('chatgpt', VISIBLE_ACTIONS.PROMPT_INPUT, { text: marker }),
-      { profileId: 'chatgpt-fixture-profile', operationId: 'chatgpt-visible-composer' },
-    )
-
-    assert.equal(response.ok, true, JSON.stringify(response, null, 2))
-    assert.equal(await page.locator('textarea').nth(0).inputValue(), '')
-    assert.equal(await page.locator('textarea').nth(1).inputValue(), marker)
-  } finally {
-    await context.close()
-  }
-})
-
-test('public Playwright provider registry retries when hydration replaces the visible composer', { timeout: 60000 }, async (t) => {
-  const { chromium } = await import('playwright')
-  const browser = await chromium.launch({ headless: true })
-  const registry = createProviderAdapterRegistry()
-  t.after(() => browser.close())
-
-  const context = await browser.newContext({ viewport: { width: 1100, height: 850 } })
-  const page = await context.newPage()
-  try {
-    await page.route('https://chatgpt.com/**', (route) => route.fulfill({
-      status: 200,
-      contentType: 'text/html',
-      body: '<!doctype html><html><body><textarea aria-label="Loading composer"></textarea></body></html>',
-    }))
-    await page.goto('https://chatgpt.com/', { waitUntil: 'domcontentloaded' })
-    await page.locator('textarea').evaluate((element) => {
-      element.addEventListener('input', () => {
-        const composer = document.createElement('div')
-        composer.id = 'prompt-textarea'
-        composer.contentEditable = 'true'
-        composer.setAttribute('role', 'textbox')
-        composer.style.cssText = 'display:block;width:600px;height:48px'
-        element.replaceWith(composer)
-      }, { once: true })
-    })
-
-    const marker = 'Tokenless hydrated composer retry proof'
-    const response = await registry.execute(
-      page,
-      visibleRequest('chatgpt', VISIBLE_ACTIONS.PROMPT_INPUT, { text: marker }),
-      { profileId: 'chatgpt-fixture-profile', operationId: 'chatgpt-hydrated-composer' },
-    )
-
-    assert.equal(response.ok, true, JSON.stringify(response, null, 2))
-    assert.equal(await page.locator('#prompt-textarea').textContent(), marker)
-  } finally {
-    await context.close()
-  }
-})
-
-test('public Playwright provider registry waits until a hydrating composer retains input', { timeout: 30000 }, async (t) => {
-  const { chromium } = await import('playwright')
-  const browser = await chromium.launch({ headless: true })
-  const registry = createProviderAdapterRegistry()
-  t.after(() => browser.close())
-
-  const context = await browser.newContext({ viewport: { width: 1100, height: 850 } })
-  const page = await context.newPage()
-  try {
-    await page.route('https://claude.ai/**', (route) => route.fulfill({
-      status: 200,
-      contentType: 'text/html',
-      body: '<!doctype html><html><body><div data-testid="chat-input" contenteditable="true" role="textbox" style="width:600px;height:48px"></div></body></html>',
-    }))
-    await page.goto('https://claude.ai/new', { waitUntil: 'domcontentloaded' })
-    await page.locator('[data-testid="chat-input"]').evaluate((element) => {
-      const readyAt = Date.now() + 2200
-      element.addEventListener('input', () => {
-        if (Date.now() < readyAt) element.textContent = ''
-      })
-    })
-
-    const marker = 'Tokenless delayed hydration proof'
-    const started = Date.now()
-    const response = await registry.execute(
-      page,
-      visibleRequest('claude', VISIBLE_ACTIONS.PROMPT_INPUT, { text: marker }),
-      { profileId: 'claude-fixture-profile', operationId: 'claude-delayed-hydration' },
-    )
-
-    assert.equal(response.ok, true, JSON.stringify(response, null, 2))
-    assert.equal(Date.now() - started >= 7500, true)
-    assert.equal(await page.locator('[data-testid="chat-input"]').textContent(), marker)
-  } finally {
-    await context.close()
-  }
-})
-
-async function openCapturedFixture(page, provider) {
-  const origin = new URL(provider.url).origin
-  await page.route(`${origin}/**`, (route) => route.fulfill({
-    status: 200,
-    contentType: 'text/html',
-    body: composerFixture(provider),
-  }))
-  await page.goto(provider.url, { waitUntil: 'domcontentloaded' })
-}
-
-function composerFixture(provider) {
-  const filename = path.join(fixtureRoot, provider.id, provider.state, 'composer-idle.html')
-  const match = fs.readFileSync(filename, 'utf8').match(/<body[^>]*>([\s\S]*?)<\/body>/iu)
-  assert.ok(match, `fixture body missing: ${filename}`)
-  return `<!doctype html><html lang="en"><head><meta charset="utf-8"></head><body>${match[1]}</body></html>`
-}
-
-function visibleRequest(provider, action, payload = {}) {
-  return createVisibleActionRequest({
-    requestId: `${provider}-${action.replaceAll('.', '-')}`,
-    provider,
-    action,
-    payload,
-  })
-}
-
-async function visibleComposerText(page, selectors) {
-  for (const selector of selectors) {
-    const locator = page.locator(selector).first()
-    try {
-      if (await locator.isVisible({ timeout: 250 })) {
-        return await locator.evaluate((element) => {
-          if (element instanceof HTMLTextAreaElement || element instanceof HTMLInputElement) return element.value
-          return (element.textContent ?? '').replace(/\u00a0/g, ' ').trim()
-        })
-      }
-    } catch {
-      // Try the next configured composer selector.
-    }
-  }
-  throw new Error('No visible composer was found.')
-}
diff --git a/test/playwright-registry.test.mjs b/test/playwright-registry.test.mjs
deleted file mode 100644
index 1d6da46..0000000
--- a/test/playwright-registry.test.mjs
+++ /dev/null
@@ -1,85 +0,0 @@
-import assert from 'node:assert/strict'
-import { mkdtemp, readFile, realpath, stat } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join, basename } from 'node:path'
-import test from 'node:test'
-import {
-  ManagedProfileRegistry,
-  TokenlessPlaywrightError,
-} from '../packages/cli/dist/src/playwright/index.js'
-
-test('managed profile registry resolves explicit/default profiles without using slugs as directories', async () => {
-  const home = await realpath(await mkdtemp(join(tmpdir(), 'tokenless-playwright-registry-')))
-  const registry = new ManagedProfileRegistry(home)
-
-  const personal = await registry.addProfile({ slug: 'personal', label: 'Personal', setDefault: true })
-  const work = await registry.addProfile({ slug: 'work' })
-
-  assert.equal((await registry.resolveProfile()).id, personal.id)
-  assert.equal((await registry.resolveProfile('work')).id, work.id)
-  assert.equal(basename(personal.directory), personal.id)
-  assert.notEqual(basename(personal.directory), personal.slug)
-
-  const registryFile = join(home, 'browser', 'profiles.json')
-  const mode = (await stat(registryFile)).mode & 0o777
-  assert.equal(mode, 0o600)
-
-  const raw = JSON.parse(await readFile(registryFile, 'utf8'))
-  assert.equal(raw.defaultProfile, 'personal')
-  assert.equal(raw.profiles.personal.directory, personal.directory)
-})
-
-test('managed profile registry rejects unknown profiles, unsafe slugs, and unconfirmed delete', async () => {
-  const home = await realpath(await mkdtemp(join(tmpdir(), 'tokenless-playwright-registry-')))
-  const registry = new ManagedProfileRegistry(home)
-  await registry.addProfile({ slug: 'default', setDefault: true })
-
-  assert.throws(() => new ManagedProfileRegistry(home).profileDirectory('../escape'), /invalid/i)
-  await assert.rejects(() => registry.resolveProfile('missing'), matchCode('profile_not_found'))
-  await assert.rejects(() => registry.addProfile({ slug: '../escape' }), matchCode('invalid_profile_slug'))
-  await assert.rejects(() => registry.removeProfile('default', { confirmDelete: false }), matchCode('profile_delete_confirmation_required'))
-
-  const removed = await registry.removeProfile('default', { confirmDelete: true })
-  assert.equal(removed.lifecycle, 'removed')
-  await assert.rejects(() => registry.resolveProfile(), matchCode('profile_not_configured'))
-})
-
-test('managed profile registry stores bounded provider status updates', async () => {
-  const home = await realpath(await mkdtemp(join(tmpdir(), 'tokenless-playwright-registry-')))
-  const registry = new ManagedProfileRegistry(home)
-  await registry.addProfile({ slug: 'default' })
-  await registry.markImported('default', {
-    source: 'Google Chrome Default',
-    profileDirectoryKey: 'Default',
-    importedAt: new Date().toISOString(),
-    providers: ['chatgpt', 'claude'],
-  })
-  const updated = await registry.updateProviderStatus('default', {
-    provider: 'chatgpt',
-    auth: 'authenticated',
-    checkedAt: new Date().toISOString(),
-  })
-  assert.equal(updated.lastObservedAuth.chatgpt?.auth, 'authenticated')
-  assert.equal((await registry.resolveProfile('default')).import?.profileDirectoryKey, 'Default')
-  assert.deepEqual((await registry.resolveProfile('default')).import?.providers, ['chatgpt', 'claude'])
-})
-
-test('managed profile registry serializes concurrent mutations from independent instances', async () => {
-  const home = await realpath(await mkdtemp(join(tmpdir(), 'tokenless-playwright-registry-')))
-  const slugs = Array.from({ length: 16 }, (_, index) => `profile-${index}`)
-
-  await Promise.all(slugs.map((slug, index) => new ManagedProfileRegistry(home).addProfile({
-    slug,
-    label: `Profile ${index}`,
-    setDefault: index === 0,
-  })))
-
-  const registry = new ManagedProfileRegistry(home)
-  const profiles = await registry.listProfiles()
-  assert.deepEqual(profiles.map((profile) => profile.slug).sort(), slugs.sort())
-  assert.equal((await registry.resolveProfile()).slug, 'profile-0')
-})
-
-function matchCode(code) {
-  return (error) => error instanceof TokenlessPlaywrightError && error.code === code
-}
diff --git a/test/playwright-runner-job-api.test.mjs b/test/playwright-runner-job-api.test.mjs
deleted file mode 100644
index a7ffe6b..0000000
--- a/test/playwright-runner-job-api.test.mjs
+++ /dev/null
@@ -1,337 +0,0 @@
-import assert from 'node:assert/strict'
-import { mkdtemp, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import test from 'node:test'
-import {
-  MANAGED_PLAYWRIGHT_JOB_ACTION,
-  MANAGED_PLAYWRIGHT_JOB_PROTOCOL_VERSION,
-  PLAYWRIGHT_EXECUTION_BACKEND,
-  TokenlessPlaywrightError,
-  VISIBLE_ACTIONS,
-  createManagedPlaywrightJobRequest,
-  submitManagedPlaywrightJob,
-  listManagedPlaywrightJobs,
-  cancelManagedPlaywrightJob,
-  createDaemonClient,
-  getManagedPlaywrightJob,
-  resumeManagedPlaywrightJob,
-  validateManagedPlaywrightJobRequest,
-} from '../packages/cli/dist/src/playwright/index.js'
-
-test('managed Playwright job API submits versioned provider-scoped jobs through loopback daemon', async () => {
-  const home = await mkdtemp(join(tmpdir(), 'tokenless-runner-api-'))
-  await writeFile(join(home, 'daemon.token'), 'control-token\n', { mode: 0o600 })
-  const calls = []
-  const fetchImpl = async (url, init) => {
-    calls.push({ url, init, body: init.body ? JSON.parse(init.body) : null })
-    return jsonResponse({
-      job_id: 'job-1',
-      claim_token: 'claim-1',
-      execution_backend: 'playwright',
-      profile_id: 'profile-a',
-      provider: 'chatgpt',
-      action: MANAGED_PLAYWRIGHT_JOB_ACTION,
-      status: 'queued',
-      request_json: calls.at(-1).body.request_json,
-      result_json: null,
-      error_json: null,
-      created_at: '2026-07-17T00:00:00Z',
-      updated_at: '2026-07-17T00:00:00Z',
-    })
-  }
-
-  const job = await submitManagedPlaywrightJob({
-    homeDir: home,
-    daemonUrl: 'http://127.0.0.1:7331',
-    daemonClient: undefined,
-    request: {
-      provider: 'chatgpt',
-      actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-    },
-    profileId: 'profile-a',
-    // The low-level client is exercised through fetch injection.
-    fetchImpl,
-  })
-
-  assert.equal(job.execution_backend, PLAYWRIGHT_EXECUTION_BACKEND)
-  assert.equal(calls.length, 1)
-  assert.equal(calls[0].url, 'http://127.0.0.1:7331/jobs')
-  assert.equal(calls[0].init.headers.authorization, 'Bearer control-token')
-  assert.equal(calls[0].body.execution_backend, PLAYWRIGHT_EXECUTION_BACKEND)
-  assert.equal(calls[0].body.profile_id, 'profile-a')
-  assert.equal(calls[0].body.action, MANAGED_PLAYWRIGHT_JOB_ACTION)
-  assert.equal(calls[0].body.request_json.protocol, MANAGED_PLAYWRIGHT_JOB_PROTOCOL_VERSION)
-  assert.equal(calls[0].body.request_json.provider, 'chatgpt')
-  assert.equal(calls[0].body.request_json.target.url, 'https://chatgpt.com/')
-  assert.equal(calls[0].body.request_json.taskId, null)
-  assert.equal(calls[0].body.request_json.actions[0].provider, 'chatgpt')
-})
-
-test('managed Playwright job contract carries bounded top-level taskId metadata', () => {
-  const request = createManagedPlaywrightJobRequest({
-    provider: 'chatgpt',
-    taskId: 'task-123',
-    actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-  })
-
-  assert.equal(request.taskId, 'task-123')
-  assert.throws(() => createManagedPlaywrightJobRequest({
-    provider: 'chatgpt',
-    taskId: 'bad\ntask',
-    actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-  }), matchCode('invalid_playwright_job_task_id'))
-  assert.throws(() => createManagedPlaywrightJobRequest({
-    provider: 'chatgpt',
-    taskId: 'x'.repeat(257),
-    actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-  }), matchCode('invalid_playwright_job_task_id'))
-  assert.throws(() => validateManagedPlaywrightJobRequest({
-    protocol: MANAGED_PLAYWRIGHT_JOB_PROTOCOL_VERSION,
-    provider: 'chatgpt',
-    target: { kind: 'provider_home', url: 'https://chatgpt.com/' },
-    actions: request.actions,
-  }), matchCode('invalid_playwright_job_request'))
-})
-
-test('managed Playwright job API lists and cancels without entrypoint coupling', async () => {
-  const paths = []
-  const daemonClient = {
-    async createJob() { throw new Error('unused') },
-    async getJob(options) {
-      paths.push(['get', options])
-      return daemonJob({
-        jobId: options.jobId,
-        request_json: createManagedPlaywrightJobRequest({
-          provider: 'chatgpt',
-          actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-        }),
-      })
-    },
-    async claimNextJob() { throw new Error('unused') },
-    async markJobRunning() { throw new Error('unused') },
-    async checkpointJob() { throw new Error('unused') },
-    async parkJob() { throw new Error('unused') },
-    async resumeJob() { throw new Error('unused') },
-    async renewJobClaim() { throw new Error('unused') },
-    async completeJob() { throw new Error('unused') },
-    async listJobs(options) {
-      paths.push(['list', options])
-      return []
-    },
-    async cancelJob(options) {
-      paths.push(['cancel', options])
-      return { job_id: options.jobId, status: 'canceled' }
-    },
-  }
-
-  await listManagedPlaywrightJobs({ daemonClient, profileId: 'profile-a', provider: 'claude', status: 'queued', limit: 10 })
-  await cancelManagedPlaywrightJob({ daemonClient, jobId: 'job-1', profileId: 'profile-a', reason: { code: 'test_cancel' } })
-
-  assert.deepEqual(paths[0], ['list', {
-    daemonUrl: undefined,
-    homeDir: undefined,
-    token: undefined,
-    fetchImpl: undefined,
-    requestTimeoutMs: undefined,
-    signal: undefined,
-    executionBackend: PLAYWRIGHT_EXECUTION_BACKEND,
-    profileId: 'profile-a',
-    provider: 'claude',
-    status: 'queued',
-    taskId: undefined,
-    limit: 10,
-  }])
-  assert.deepEqual(paths[1], ['get', {
-    daemonUrl: undefined,
-    homeDir: undefined,
-    token: undefined,
-    fetchImpl: undefined,
-    requestTimeoutMs: undefined,
-    signal: undefined,
-    jobId: 'job-1',
-  }])
-  assert.deepEqual(paths[2], ['cancel', {
-    daemonUrl: undefined,
-    homeDir: undefined,
-    token: undefined,
-    fetchImpl: undefined,
-    requestTimeoutMs: undefined,
-    signal: undefined,
-    jobId: 'job-1',
-    reason: { code: 'test_cancel' },
-  }])
-})
-
-test('managed Playwright job API resumes parked jobs headed with public job shape', async () => {
-  const request = createManagedPlaywrightJobRequest({
-    provider: 'chatgpt',
-    actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-  })
-  const paths = []
-  const daemonClient = {
-    async createJob() { throw new Error('unused') },
-    async listJobs() { throw new Error('unused') },
-    async claimNextJob() { throw new Error('unused') },
-    async markJobRunning() { throw new Error('unused') },
-    async markJobWaitingForUser() { throw new Error('unused') },
-    async checkpointJob() { throw new Error('unused') },
-    async parkJob() { throw new Error('unused') },
-    async renewJobClaim() { throw new Error('unused') },
-    async completeJob() { throw new Error('unused') },
-    async cancelJob() { throw new Error('unused') },
-    async getJob(options) {
-      paths.push(['get', options])
-      return daemonJob({
-        jobId: options.jobId,
-        status: 'waiting_for_user',
-        request_json: request,
-        checkpoint_json: { private: true },
-        resume_json: { private: true },
-      })
-    },
-    async resumeJob(options) {
-      paths.push(['resume', options])
-      return daemonJob({
-        jobId: options.jobId,
-        status: 'queued',
-        request_json: request,
-      })
-    },
-  }
-
-  const job = await resumeManagedPlaywrightJob({ daemonClient, jobId: 'job-1', profileId: 'profile-a' })
-
-  assert.equal(job.status, 'queued')
-  assert.equal(job.checkpoint_json, undefined)
-  assert.equal(job.resume_json, undefined)
-  assert.deepEqual(paths[1], ['resume', {
-    daemonUrl: undefined,
-    homeDir: undefined,
-    token: undefined,
-    fetchImpl: undefined,
-    requestTimeoutMs: undefined,
-    signal: undefined,
-    jobId: 'job-1',
-    browserVisibility: 'headed',
-  }])
-})
-
-test('managed Playwright get/cancel reject legacy and different-profile jobs before returning or canceling', async () => {
-  const request = createManagedPlaywrightJobRequest({
-    provider: 'chatgpt',
-    actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-  })
-  let canceled = false
-  const daemonClient = {
-    async createJob() { throw new Error('unused') },
-    async listJobs() { throw new Error('unused') },
-    async claimNextJob() { throw new Error('unused') },
-    async markJobRunning() { throw new Error('unused') },
-    async checkpointJob() { throw new Error('unused') },
-    async parkJob() { throw new Error('unused') },
-    async resumeJob() { throw new Error('unused') },
-    async renewJobClaim() { throw new Error('unused') },
-    async completeJob() { throw new Error('unused') },
-    async getJob({ jobId }) {
-      if (jobId === 'legacy') {
-        return daemonJob({ jobId, execution_backend: 'legacy_extension', profile_id: null, request_json: {} })
-      }
-      return daemonJob({ jobId, profile_id: 'other-profile', request_json: request })
-    },
-    async cancelJob() {
-      canceled = true
-      throw new Error('cancel must not be called')
-    },
-  }
-
-  await assert.rejects(() => getManagedPlaywrightJob({
-    daemonClient,
-    jobId: 'legacy',
-    profileId: 'profile-a',
-  }), matchCode('invalid_playwright_job_backend'))
-  await assert.rejects(() => cancelManagedPlaywrightJob({
-    daemonClient,
-    jobId: 'other',
-    profileId: 'profile-a',
-  }), matchCode('invalid_playwright_job_profile'))
-  assert.equal(canceled, false)
-})
-
-test('managed Playwright daemon client posts checkpoint, park, and resume payloads', async () => {
-  const calls = []
-  const fetchImpl = async (url, init) => {
-    calls.push({ url, body: init.body ? JSON.parse(init.body) : null })
-    return jsonResponse(daemonJob({
-      jobId: 'job-1',
-      status: url.endsWith('/resume') ? 'queued' : 'running',
-      request_json: createManagedPlaywrightJobRequest({
-        provider: 'chatgpt',
-        actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-      }),
-    }))
-  }
-  const client = createDaemonClient({
-    daemonUrl: 'http://127.0.0.1:7331',
-    token: 'control-token',
-    fetchImpl,
-  })
-
-  await client.checkpointJob({ jobId: 'job-1', claimToken: 'claim-1', checkpoint: { cursor: 1 } })
-  await client.parkJob({ jobId: 'job-1', claimToken: 'claim-1', blocker: { code: 'captcha' }, checkpoint: { cursor: 1 } })
-  await client.resumeJob({ jobId: 'job-1', browserVisibility: 'headed' })
-
-  assert.deepEqual(calls.map((call) => [new URL(call.url).pathname, call.body]), [
-    ['/control/jobs/job-1/checkpoint', { claim_token: 'claim-1', checkpoint_json: { cursor: 1 } }],
-    ['/control/jobs/job-1/park', { claim_token: 'claim-1', blocker_json: { code: 'captcha' }, checkpoint_json: { cursor: 1 } }],
-    ['/jobs/job-1/resume', { browser_visibility: 'headed' }],
-  ])
-})
-
-test('managed Playwright job contract rejects provider subdomains and non-loopback daemon URLs', async () => {
-  assert.throws(() => createManagedPlaywrightJobRequest({
-    provider: 'chatgpt',
-    target: { url: 'https://evil.chatgpt.com/' },
-    actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-  }), matchCode('invalid_playwright_job_target'))
-
-  await assert.rejects(() => submitManagedPlaywrightJob({
-    daemonUrl: 'https://example.com',
-    token: 'token',
-    profileId: 'profile-a',
-    request: {
-      provider: 'chatgpt',
-      actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-    },
-  }), matchCode('invalid_daemon_url'))
-})
-
-function jsonResponse(value, status = 200) {
-  return new Response(JSON.stringify(value), {
-    status,
-    headers: { 'content-type': 'application/json' },
-  })
-}
-
-function matchCode(code) {
-  return (error) => error instanceof TokenlessPlaywrightError && error.code === code
-}
-
-function daemonJob(overrides) {
-  const job = {
-    job_id: overrides.jobId,
-    execution_backend: 'playwright',
-    profile_id: 'profile-a',
-    provider: 'chatgpt',
-    action: MANAGED_PLAYWRIGHT_JOB_ACTION,
-    status: 'queued',
-    request_json: overrides.request_json,
-    result_json: null,
-    error_json: null,
-    created_at: '2026-07-17T00:00:00Z',
-    updated_at: '2026-07-17T00:00:00Z',
-    ...overrides,
-  }
-  delete job.jobId
-  return job
-}
diff --git a/test/playwright-runner-service.test.mjs b/test/playwright-runner-service.test.mjs
deleted file mode 100644
index 4d97ac3..0000000
--- a/test/playwright-runner-service.test.mjs
+++ /dev/null
@@ -1,1780 +0,0 @@
-import assert from 'node:assert/strict'
-import { EventEmitter } from 'node:events'
-import { mkdtemp, mkdir, realpath, stat, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import test from 'node:test'
-import {
-  MANAGED_PLAYWRIGHT_JOB_ACTION,
-  MANAGED_PLAYWRIGHT_JOB_PROTOCOL_VERSION,
-  ManagedPlaywrightRunnerService,
-  PLAYWRIGHT_EXECUTION_BACKEND,
-  PersistentContextManager,
-  VISIBLE_ACTIONS,
-  createManagedPlaywrightJobRequest,
-  tokenlessError,
-} from '../packages/cli/dist/src/playwright/index.js'
-import { createDomProviderAdapter } from '../packages/cli/dist/src/playwright/adapters/provider-dom-adapter.js'
-import { getProviderById } from '../packages/cli/dist/src/playwright/providers.js'
-
-test('runner polls all registered profiles with exact Playwright/profile scoping and completes lifecycle', async () => {
-  const profiles = fakeProfiles(['profile-a', 'profile-b'])
-  const daemon = new FakeDaemon([
-    fakeJob('job-b', profiles[1], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      actions: [
-        { action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} },
-        { action: VISIBLE_ACTIONS.RESPONSE_READ, payload: {} },
-      ],
-    })),
-  ])
-  const adapterCalls = []
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(),
-    adapterRegistry: fakeAdapterRegistry(async (_page, request, context) => {
-      adapterCalls.push({ request, context })
-      await delay(15)
-      return successResponse(request, { visibleProof: 'ok', state: 'authenticated' })
-    }),
-    renewIntervalMs: 5,
-    cancelPollMs: 1000,
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-b', status: 'succeeded' })
-  assert.deepEqual(daemon.claims.map((claim) => claim.profileId), ['profile-a', 'profile-b'])
-  assert.equal(daemon.running.length, 1)
-  assert.equal(daemon.completed.length, 1)
-  assert.equal(daemon.completed[0].result.protocol, MANAGED_PLAYWRIGHT_JOB_PROTOCOL_VERSION)
-  assert.equal(daemon.completed[0].result.responses.length, 2)
-  assert.ok(daemon.renewals.length >= 1)
-  assert.equal(adapterCalls[0].context.profileId, 'profile-b')
-  assert.equal(adapterCalls[0].context.operationId, 'job-b')
-})
-
-test('runner skips profiles while their managed data is being reset', async () => {
-  const profiles = fakeProfiles(['profile-resetting', 'profile-ready'])
-  profiles[0].lifecycle = 'importing'
-  profiles[1].lifecycle = 'ready'
-  const daemon = new FakeDaemon([
-    fakeJob('job-ready', profiles[1], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-    })),
-  ])
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(),
-    adapterRegistry: fakeAdapterRegistry(),
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-ready', status: 'succeeded' })
-  assert.deepEqual(daemon.claims.map((claim) => claim.profileId), ['profile-ready'])
-})
-
-test('runner brings the provider target page to the foreground for navigation checks only', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const page = new FakeForegroundPage()
-  const daemon = new FakeDaemon([
-    fakeJob('job-foreground', profiles[0], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      actions: [{ action: VISIBLE_ACTIONS.NAVIGATION_CHECK, payload: {} }],
-    })),
-    fakeJob('job-background-auth', profiles[0], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-    })),
-  ])
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(page),
-    adapterRegistry: fakeAdapterRegistry(),
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-foreground', status: 'succeeded' })
-  assert.deepEqual(page.events, [
-    ['goto', 'https://chatgpt.com/', { waitUntil: 'domcontentloaded' }],
-    ['bringToFront'],
-  ])
-
-  page.events = []
-  const authResult = await service.runOnce()
-  assert.deepEqual(authResult, { claimed: true, jobId: 'job-background-auth', status: 'succeeded' })
-  assert.deepEqual(page.events, [
-    ['goto', 'https://chatgpt.com/', { waitUntil: 'domcontentloaded' }],
-  ])
-})
-
-test('runner starts auto jobs headless and headed jobs headed through the context manager', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const autoLaunches = []
-  const headedLaunches = []
-  const autoRequest = createManagedPlaywrightJobRequest({
-    provider: 'chatgpt',
-    browserVisibility: 'auto',
-    actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-  })
-  const headedRequest = createManagedPlaywrightJobRequest({
-    provider: 'chatgpt',
-    browserVisibility: 'headed',
-    actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-  })
-
-  const autoResult = await new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: new FakeDaemon([fakeJob('job-auto', profiles[0], autoRequest)]),
-    contextManager: fakeContextManager(new FakeResponsePage(), autoLaunches),
-    adapterRegistry: fakeAdapterRegistry(),
-  }).runOnce()
-  const headedResult = await new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: new FakeDaemon([fakeJob('job-headed', profiles[0], headedRequest)]),
-    contextManager: fakeContextManager(new FakeResponsePage(), headedLaunches),
-    adapterRegistry: fakeAdapterRegistry(),
-  }).runOnce()
-
-  assert.deepEqual(autoResult, { claimed: true, jobId: 'job-auto', status: 'succeeded' })
-  assert.deepEqual(headedResult, { claimed: true, jobId: 'job-headed', status: 'succeeded' })
-  assert.equal(autoLaunches[0].headless, true)
-  assert.equal(headedLaunches[0].headless, false)
-})
-
-test('runner fails terminal blockers without escalating auto jobs to headed', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const launches = []
-  const page = new FakeHandoverPage()
-  page.rawBlockers = [{
-    kind: 'terminal',
-    code: 'provider_rate_limited',
-    family: 'rate_limit',
-    message: 'Provider rate limit is terminal for this run.',
-    userResolvable: false,
-    retryable: true,
-    visibleProof: 'visible-rate-limit',
-    provider: 'chatgpt',
-    url: 'https://chatgpt.com/',
-  }]
-  const daemon = new FakeDaemon([
-    fakeJob('job-terminal', profiles[0], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      browserVisibility: 'auto',
-      actions: [{ action: VISIBLE_ACTIONS.PROMPT_INPUT, payload: { text: 'must not type' } }],
-    })),
-  ])
-  let actionCalls = 0
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(page, launches),
-    adapterRegistry: fakeAdapterRegistry(async (_page, request) => {
-      actionCalls += 1
-      return successResponse(request, { visible: true, inputProof: 'prompt-text-visible' })
-    }),
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-terminal', status: 'failed' })
-  assert.equal(actionCalls, 0)
-  assert.equal(daemon.waiting.length, 0)
-  assert.equal(daemon.completed[0].error.code, 'provider_rate_limited')
-  assert.deepEqual(launches.map((launch) => launch.headless), [true])
-})
-
-test('runner leaves additional profile jobs queued when four persistent contexts are already active', async () => {
-  const profiles = fakeProfiles(['profile-0', 'profile-1', 'profile-2', 'profile-3', 'profile-4'])
-  const manager = fakeContextManager()
-  for (const profile of profiles.slice(0, 4)) {
-    await manager.ensureContext(profile)
-  }
-  const daemon = new FakeDaemon([
-    fakeJob('job-profile-4', profiles[4], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-    })),
-  ])
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: manager,
-    adapterRegistry: fakeAdapterRegistry(),
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: false })
-  assert.deepEqual(daemon.claims.map((claim) => claim.profileId), ['profile-0', 'profile-1', 'profile-2', 'profile-3'])
-  assert.equal(daemon.jobs.get('job-profile-4').status, 'queued')
-})
-
-test('runner serializes same-profile visible actions through the shared context manager', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const request = createManagedPlaywrightJobRequest({
-    provider: 'chatgpt',
-    actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-  })
-  const daemon = new FakeDaemon([
-    fakeJob('job-1', profiles[0], request),
-    fakeJob('job-2', profiles[0], request),
-  ])
-  const events = []
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(),
-    adapterRegistry: fakeAdapterRegistry(async (_page, visibleRequest, context) => {
-      events.push(`${context.operationId}:start`)
-      await delay(20)
-      events.push(`${context.operationId}:end`)
-      return successResponse(visibleRequest, { visibleProof: 'ok', state: 'authenticated' })
-    }),
-    cancelPollMs: 1000,
-  })
-
-  await Promise.all([service.runOnce(), service.runOnce()])
-
-  assert.deepEqual(events, ['job-1:start', 'job-1:end', 'job-2:start', 'job-2:end'])
-})
-
-test('runner waits for a new visible response after submit before reading', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const page = new FakeResponsePage()
-  const daemon = new FakeDaemon([
-    fakeJob('job-1', profiles[0], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      actions: [
-        { action: VISIBLE_ACTIONS.PROMPT_SUBMIT, payload: {} },
-        { action: VISIBLE_ACTIONS.RESPONSE_READ, payload: {} },
-      ],
-    })),
-  ])
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(page),
-    responseWaitTimeoutMs: 500,
-    responseWaitPollMs: 5,
-    adapterRegistry: fakeAdapterRegistry(async (_page, request) => {
-      if (request.action === VISIBLE_ACTIONS.PROMPT_SUBMIT) {
-        page.busy = true
-        setTimeout(() => {
-          page.answers.push('new answer')
-          page.busy = false
-        }, 25)
-        return successResponse(request, { visible: true, submissionProof: 'submitted' })
-      }
-      if (request.action === VISIBLE_ACTIONS.RESPONSE_READ) {
-        return successResponse(request, {
-          text: page.answers.at(-1),
-          citations: [],
-          visibleProof: 'latest',
-        })
-      }
-      return successResponse(request, { visibleProof: 'ok', state: 'authenticated' })
-    }),
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-1', status: 'succeeded' })
-  const read = daemon.completed[0].result.responses.at(-1)
-  assert.equal(read.result.text, 'new answer')
-  assert.notEqual(read.result.text, 'old answer')
-})
-
-test('runner parks on visible user-resolvable blocker and resumes unfinished action in same page', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const page = new FakeHandoverPage()
-  const daemon = new FakeDaemon([
-    fakeJob('job-handover', profiles[0], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      actions: [
-        { action: VISIBLE_ACTIONS.PROMPT_INPUT, payload: { text: 'after handover' } },
-        { action: VISIBLE_ACTIONS.PROMPT_SUBMIT, payload: {} },
-      ],
-    })),
-  ])
-  const adapterEvents = []
-  daemon.onWaiting = () => {
-    assert.equal(adapterEvents.length, 0, 'runner must not execute page actions while waiting for user')
-    setTimeout(() => {
-      page.rawBlockers = []
-      page.composerVisible = true
-    }, 25)
-  }
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(page),
-    adapterRegistry: fakeAdapterRegistry(async (actionPage, request) => {
-      adapterEvents.push({ page: actionPage, action: request.action })
-      return successResponse(request, request.action === VISIBLE_ACTIONS.PROMPT_SUBMIT
-        ? { visible: true, submissionProof: 'submitted' }
-        : { visible: true, inputProof: 'prompt-text-visible' })
-    }),
-    renewIntervalMs: 5,
-    userHandoverTimeoutMs: 500,
-    userHandoverPollMs: 5,
-    cancelPollMs: 1000,
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-handover', status: 'succeeded' })
-  assert.equal(daemon.waiting.length, 1)
-  assert.equal(daemon.waiting[0].blocker.blocker.code, 'visible_recaptcha')
-  assert.deepEqual(daemon.running, ['job-handover', 'job-handover'])
-  assert.equal(daemon.renewals.length > 0, true)
-  assert.deepEqual(adapterEvents.map((event) => event.action), [VISIBLE_ACTIONS.PROMPT_INPUT, VISIBLE_ACTIONS.PROMPT_SUBMIT])
-  assert.equal(adapterEvents.every((event) => event.page === page), true)
-})
-
-test('auto visibility checkpoints before pre-submit blocker escalation and continues headed', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const page = new FakeHandoverPage()
-  const launches = []
-  const daemon = new FakeDaemon([
-    fakeJob('job-auto-handover', profiles[0], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      browserVisibility: 'auto',
-      actions: [
-        { action: VISIBLE_ACTIONS.PROMPT_INPUT, payload: { text: 'after handover' } },
-        { action: VISIBLE_ACTIONS.PROMPT_SUBMIT, payload: {} },
-      ],
-    })),
-  ])
-  const adapterEvents = []
-  daemon.onWaiting = () => {
-    assert.equal(daemon.checkpoints[0].checkpoint.phase.state, 'idle')
-    setTimeout(() => {
-      page.rawBlockers = []
-      page.composerVisible = true
-    }, 25)
-  }
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(page, launches),
-    adapterRegistry: fakeAdapterRegistry(async (_page, request) => {
-      adapterEvents.push(request.action)
-      return successResponse(request, request.action === VISIBLE_ACTIONS.PROMPT_SUBMIT
-        ? { visible: true, submissionProof: 'submitted' }
-        : { visible: true, inputProof: 'prompt-text-visible' })
-    }),
-    userHandoverTimeoutMs: 500,
-    userHandoverPollMs: 5,
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-auto-handover', status: 'succeeded' })
-  assert.deepEqual(launches.map((launch) => launch.headless), [true, false])
-  assert.deepEqual(adapterEvents, [VISIBLE_ACTIONS.PROMPT_INPUT, VISIBLE_ACTIONS.PROMPT_SUBMIT])
-  assert.equal(daemon.waiting[0].blocker.browser.requestedVisibility, 'auto')
-  assert.equal(daemon.waiting[0].blocker.browser.effectiveVisibility, 'headed')
-  assert.equal(daemon.waiting[0].blocker.browser.windowOpen, true)
-})
-
-test('auto visibility reconstructs completed pre-submit actions after fresh headed relaunch', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const headlessPage = new FakeHandoverPage()
-  headlessPage.rawBlockers = []
-  headlessPage.composerVisible = true
-  const headedPage = new FakeHandoverPage()
-  const launches = []
-  const daemon = new FakeDaemon([
-    fakeJob('job-auto-reconstruct-live', profiles[0], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      browserVisibility: 'auto',
-      actions: [
-        { requestId: 'live-reconstruct:input', action: VISIBLE_ACTIONS.PROMPT_INPUT, payload: { text: 'must survive relaunch' } },
-        { requestId: 'live-reconstruct:submit', action: VISIBLE_ACTIONS.PROMPT_SUBMIT, payload: {} },
-      ],
-    })),
-  ])
-  const adapterEvents = []
-  daemon.onWaiting = () => {
-    setTimeout(() => {
-      headedPage.rawBlockers = []
-      headedPage.composerVisible = true
-    }, 25)
-  }
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManagerSequence([headlessPage, headedPage], launches),
-    adapterRegistry: fakeAdapterRegistry(async (page, request) => {
-      adapterEvents.push({ page, action: request.action })
-      if (page === headlessPage && request.action === VISIBLE_ACTIONS.PROMPT_INPUT) {
-        headlessPage.rawBlockers = headedPage.rawBlockers
-        headlessPage.composerVisible = false
-      }
-      return successResponse(request, request.action === VISIBLE_ACTIONS.PROMPT_SUBMIT
-        ? { visible: true, submissionProof: 'submitted' }
-        : { visible: true, inputProof: 'prompt-text-visible' })
-    }),
-    userHandoverTimeoutMs: 500,
-    userHandoverPollMs: 5,
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-auto-reconstruct-live', status: 'succeeded' })
-  assert.deepEqual(launches.map((launch) => launch.headless), [true, false])
-  assert.deepEqual(adapterEvents.map((event) => event.action), [
-    VISIBLE_ACTIONS.PROMPT_INPUT,
-    VISIBLE_ACTIONS.PROMPT_INPUT,
-    VISIBLE_ACTIONS.PROMPT_SUBMIT,
-  ])
-  assert.equal(adapterEvents[0].page, headlessPage)
-  assert.equal(adapterEvents[1].page, headedPage)
-  assert.equal(adapterEvents[2].page, headedPage)
-  assert.equal(daemon.waiting[0].blocker.browser.windowOpen, true)
-})
-
-test('auto-escalated headed context closes 30 seconds after successful completion', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const page = new FakeHandoverPage()
-  const timers = new FakeTimers()
-  const launches = []
-  const contexts = []
-  const daemon = new FakeDaemon([
-    fakeJob('job-auto-close', profiles[0], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      browserVisibility: 'auto',
-      actions: [{ action: VISIBLE_ACTIONS.PROMPT_INPUT, payload: { text: 'after handover' } }],
-    })),
-  ])
-  daemon.onWaiting = () => {
-    page.rawBlockers = []
-    page.composerVisible = true
-  }
-  const contextManager = fakeContextManager(page, launches, { timers, contexts })
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager,
-    adapterRegistry: fakeAdapterRegistry(async (_page, request) => (
-      successResponse(request, { visible: true, inputProof: 'prompt-text-visible' })
-    )),
-    userHandoverTimeoutMs: 500,
-    userHandoverPollMs: 5,
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-auto-close', status: 'succeeded' })
-  assert.deepEqual(launches.map((launch) => launch.headless), [true, false])
-  assert.deepEqual(contextManager.activeProfileIds(), ['profile-a'])
-  assert.equal(contexts[1].closed, false)
-  await timers.advance(29_999)
-  assert.deepEqual(contextManager.activeProfileIds(), ['profile-a'])
-  assert.equal(contexts[1].closed, false)
-  await timers.advance(1)
-  assert.deepEqual(contextManager.activeProfileIds(), [])
-  assert.equal(contexts[1].closed, true)
-})
-
-test('auto-escalated headed context closes 30 seconds after failed terminal completion', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const page = new FakeHandoverPage()
-  const timers = new FakeTimers()
-  const launches = []
-  const contexts = []
-  const daemon = new FakeDaemon([
-    fakeJob('job-auto-close-failed', profiles[0], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      browserVisibility: 'auto',
-      actions: [{ action: VISIBLE_ACTIONS.PROMPT_INPUT, payload: { text: 'will fail' } }],
-    })),
-  ])
-  daemon.onWaiting = () => {
-    page.rawBlockers = []
-    page.composerVisible = true
-  }
-  const contextManager = fakeContextManager(page, launches, { timers, contexts })
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager,
-    adapterRegistry: fakeAdapterRegistry(async (_page, request) => ({
-      protocol: request.protocol,
-      requestId: request.requestId,
-      provider: request.provider,
-      action: request.action,
-      ok: false,
-      result: null,
-      error: { code: 'provider_terminal_after_handover', message: 'terminal', retryable: false },
-    })),
-    userHandoverTimeoutMs: 500,
-    userHandoverPollMs: 5,
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-auto-close-failed', status: 'failed' })
-  assert.equal(daemon.completed[0].error.code, 'provider_terminal_after_handover')
-  assert.deepEqual(launches.map((launch) => launch.headless), [true, false])
-  await timers.advance(30_000)
-  assert.deepEqual(contextManager.activeProfileIds(), [])
-  assert.equal(contexts[1].closed, true)
-})
-
-test('auto-escalated headed context closes 30 seconds after daemon cancellation while waiting', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const page = new FakeHandoverPage()
-  const timers = new FakeTimers()
-  const launches = []
-  const contexts = []
-  const daemon = new FakeDaemon([
-    fakeJob('job-auto-close-canceled', profiles[0], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      browserVisibility: 'auto',
-      actions: [{ action: VISIBLE_ACTIONS.PROMPT_INPUT, payload: { text: 'must not run' } }],
-    })),
-  ])
-  daemon.cancelAfterWaiting = true
-  let actionCalls = 0
-  const contextManager = fakeContextManager(page, launches, { timers, contexts })
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager,
-    adapterRegistry: fakeAdapterRegistry(async (_page, request) => {
-      actionCalls += 1
-      return successResponse(request, { visible: true, inputProof: 'prompt-text-visible' })
-    }),
-    userHandoverTimeoutMs: 500,
-    userHandoverPollMs: 5,
-    cancelPollMs: 5,
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-auto-close-canceled', status: 'canceled' })
-  assert.equal(actionCalls, 0)
-  assert.equal(daemon.completed.length, 0)
-  assert.deepEqual(launches.map((launch) => launch.headless), [true, false])
-  await timers.advance(29_999)
-  assert.deepEqual(contextManager.activeProfileIds(), ['profile-a'])
-  assert.equal(contexts[1].closed, false)
-  await timers.advance(1)
-  assert.deepEqual(contextManager.activeProfileIds(), [])
-  assert.equal(contexts[1].closed, true)
-})
-
-test('runner preserves auth status as an immediate check without user handover gating', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const page = new FakeHandoverPage()
-  const daemon = new FakeDaemon([
-    fakeJob('job-auth-handover', profiles[0], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-    })),
-  ])
-  const adapterEvents = []
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(page),
-    adapterRegistry: fakeAdapterRegistry(async (_actionPage, request) => {
-      adapterEvents.push(request.action)
-      return successResponse(request, { state: 'authenticated', visibleProof: 'authenticated-control-visible' })
-    }),
-    renewIntervalMs: 5,
-    userHandoverTimeoutMs: 500,
-    userHandoverPollMs: 5,
-    cancelPollMs: 1000,
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-auth-handover', status: 'succeeded' })
-  assert.equal(daemon.waiting.length, 0)
-  assert.deepEqual(daemon.running, ['job-auth-handover'])
-  assert.deepEqual(adapterEvents, [VISIBLE_ACTIONS.AUTH_STATUS])
-})
-
-test('dom adapter classifies auth status on recognized off-provider sign-in without DOM inspection', async () => {
-  const provider = getProviderById('chatgpt')
-  const adapter = createDomProviderAdapter(provider)
-  const request = createManagedPlaywrightJobRequest({
-    provider: 'chatgpt',
-    actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-  }).actions[0]
-  const page = new FakeOffProviderSignInPage()
-
-  const response = await adapter.execute(page, request, { profileId: 'profile-a', operationId: 'job-auth' })
-
-  assert.equal(response.ok, false)
-  assert.equal(response.error.code, 'provider_sign_in_navigation')
-  assert.equal(response.error.retryable, true)
-  assert.equal(page.offProviderEvaluateCalls, 0)
-})
-
-test('dom adapter fails closed for unsafe off-provider auth status navigation', async () => {
-  const provider = getProviderById('chatgpt')
-  const adapter = createDomProviderAdapter(provider)
-  const request = createManagedPlaywrightJobRequest({
-    provider: 'chatgpt',
-    actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-  }).actions[0]
-  for (const url of ['https://example.com/login', 'https://evil.test/signin']) {
-    const page = new FakeUnsafeOffProviderPage(url)
-
-    const response = await adapter.execute(page, request, { profileId: 'profile-a', operationId: 'job-auth' })
-
-    assert.equal(response.ok, false)
-    assert.equal(response.error.code, 'unsupported_provider_navigation')
-    assert.equal(response.error.retryable, false)
-    assert.equal(page.evaluateCalls, 0)
-  }
-})
-
-test('runner gates setup readiness navigation checks and resumes auth in the same job', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const page = new FakeHandoverPage()
-  const daemon = new FakeDaemon([
-    fakeJob('job-setup-readiness', profiles[0], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      actions: [
-        { action: VISIBLE_ACTIONS.NAVIGATION_CHECK, payload: {} },
-        { action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} },
-      ],
-    })),
-  ])
-  const adapterEvents = []
-  daemon.onWaiting = () => {
-    assert.equal(adapterEvents.length, 0, 'runner must not inspect readiness while waiting for user')
-    setTimeout(() => {
-      page.rawBlockers = []
-      page.composerVisible = true
-    }, 25)
-  }
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(page),
-    adapterRegistry: fakeAdapterRegistry(async (_actionPage, request) => {
-      adapterEvents.push(request.action)
-      return successResponse(request, request.action === VISIBLE_ACTIONS.AUTH_STATUS
-        ? { state: 'authenticated', visibleProof: 'authenticated-control-visible' }
-        : { allowed: true, provider: 'chatgpt', reason: null })
-    }),
-    renewIntervalMs: 5,
-    userHandoverTimeoutMs: 500,
-    userHandoverPollMs: 5,
-    cancelPollMs: 1000,
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-setup-readiness', status: 'succeeded' })
-  assert.equal(daemon.waiting.length, 1)
-  assert.equal(daemon.waiting[0].blocker.blocker.code, 'visible_recaptcha')
-  assert.deepEqual(daemon.running, ['job-setup-readiness', 'job-setup-readiness'])
-  assert.deepEqual(adapterEvents, [VISIBLE_ACTIONS.NAVIGATION_CHECK, VISIBLE_ACTIONS.AUTH_STATUS])
-})
-
-test('runner waits through response-read challenge longer than response timeout without replaying submit', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const page = new FakeHandoverPage()
-  page.rawBlockers = []
-  page.composerVisible = true
-  const daemon = new FakeDaemon([
-    fakeJob('job-response-handover', profiles[0], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      actions: [
-        { action: VISIBLE_ACTIONS.PROMPT_SUBMIT, payload: {} },
-        { action: VISIBLE_ACTIONS.RESPONSE_READ, payload: {} },
-      ],
-    })),
-  ])
-  const adapterEvents = []
-  daemon.onWaiting = () => {
-    setTimeout(() => {
-      page.rawBlockers = []
-      page.composerVisible = true
-      page.answers.push('resumed answer')
-    }, 80)
-  }
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(page),
-    responseWaitTimeoutMs: 30,
-    responseWaitPollMs: 5,
-    userHandoverTimeoutMs: 300,
-    userHandoverPollMs: 5,
-    renewIntervalMs: 5,
-    cancelPollMs: 1000,
-    adapterRegistry: fakeAdapterRegistry(async (_actionPage, request) => {
-      adapterEvents.push(request.action)
-      if (request.action === VISIBLE_ACTIONS.PROMPT_SUBMIT) {
-        page.rawBlockers = [{
-          kind: 'challenge',
-          code: 'visible_recaptcha',
-          family: 'recaptcha',
-          message: 'Visible reCAPTCHA verification is blocking the provider page.',
-          proof: 'visible-recaptcha-frame',
-        }]
-        page.composerVisible = false
-        return successResponse(request, { visible: true, submissionProof: 'submitted' })
-      }
-      if (request.action === VISIBLE_ACTIONS.RESPONSE_READ) {
-        return successResponse(request, { text: page.answers.at(-1), citations: [], visibleProof: 'latest' })
-      }
-      return successResponse(request, { visibleProof: 'ok', state: 'authenticated' })
-    }),
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-response-handover', status: 'succeeded' })
-  assert.deepEqual(adapterEvents, [VISIBLE_ACTIONS.PROMPT_SUBMIT, VISIBLE_ACTIONS.RESPONSE_READ])
-  assert.equal(daemon.waiting.length, 1)
-  assert.equal(daemon.completed[0].result.responses.at(-1).result.text, 'resumed answer')
-  assert.equal(daemon.renewals.length > 0, true)
-})
-
-test('auto post-submit blocker escalates without submitting a second time', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const page = new FakeHandoverPage()
-  page.rawBlockers = []
-  page.composerVisible = true
-  const launches = []
-  const daemon = new FakeDaemon([
-    fakeJob('job-post-submit-handover', profiles[0], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      browserVisibility: 'auto',
-      actions: [
-        { action: VISIBLE_ACTIONS.PROMPT_SUBMIT, payload: {} },
-        { action: VISIBLE_ACTIONS.RESPONSE_READ, payload: {} },
-      ],
-    })),
-  ])
-  const adapterEvents = []
-  daemon.onWaiting = () => {
-    setTimeout(() => {
-      page.rawBlockers = []
-      page.composerVisible = true
-      page.answers.push('post-submit answer')
-    }, 25)
-  }
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(page, launches),
-    responseWaitTimeoutMs: 30,
-    responseWaitPollMs: 5,
-    userHandoverTimeoutMs: 300,
-    userHandoverPollMs: 5,
-    adapterRegistry: fakeAdapterRegistry(async (_page, request) => {
-      adapterEvents.push(request.action)
-      if (request.action === VISIBLE_ACTIONS.PROMPT_SUBMIT) {
-        page.rawBlockers = [{
-          kind: 'challenge',
-          code: 'visible_recaptcha',
-          family: 'recaptcha',
-          message: 'Visible reCAPTCHA verification is blocking the provider page.',
-          proof: 'visible-recaptcha-frame',
-        }]
-        page.composerVisible = false
-        return successResponse(request, { visible: true, submissionProof: 'submitted' })
-      }
-      if (request.action === VISIBLE_ACTIONS.RESPONSE_READ) {
-        return successResponse(request, { text: page.answers.at(-1), citations: [], visibleProof: 'latest' })
-      }
-      return successResponse(request, { visibleProof: 'ok', state: 'authenticated' })
-    }),
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-post-submit-handover', status: 'succeeded' })
-  assert.deepEqual(adapterEvents, [VISIBLE_ACTIONS.PROMPT_SUBMIT, VISIBLE_ACTIONS.RESPONSE_READ])
-  assert.deepEqual(launches.map((launch) => launch.headless), [true, false])
-  assert.equal(daemon.checkpoints.some((entry) => entry.checkpoint.submitted?.requestId === daemon.jobs.get('job-post-submit-handover').request_json.actions[0].requestId), true)
-  assert.equal(daemon.completed[0].result.responses.filter((response) => response.action === VISIBLE_ACTIONS.PROMPT_SUBMIT).length, 1)
-})
-
-test('runner classifies off-provider sign-in navigation without DOM inspection and stores origin-only blocker URL', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const page = new FakeOffProviderSignInPage()
-  const daemon = new FakeDaemon([
-    fakeJob('job-off-provider', profiles[0], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      actions: [{ action: VISIBLE_ACTIONS.PROMPT_INPUT, payload: { text: 'after login' } }],
-    })),
-  ])
-  const adapterEvents = []
-  daemon.onWaiting = () => {
-    setTimeout(() => {
-      page.currentUrl = 'https://chatgpt.com/'
-      page.composerVisible = true
-    }, 25)
-  }
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(page),
-    userHandoverTimeoutMs: 300,
-    userHandoverPollMs: 5,
-    cancelPollMs: 1000,
-    adapterRegistry: fakeAdapterRegistry(async (_actionPage, request) => {
-      adapterEvents.push(request.action)
-      return successResponse(request, { visible: true, inputProof: 'prompt-text-visible' })
-    }),
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-off-provider', status: 'succeeded' })
-  assert.equal(page.offProviderEvaluateCalls, 0)
-  assert.equal(daemon.waiting[0].blocker.blocker.code, 'provider_sign_in_navigation')
-  assert.equal(daemon.waiting[0].blocker.blocker.url, 'https://accounts.google.com')
-  assert.deepEqual(adapterEvents, [VISIBLE_ACTIONS.PROMPT_INPUT])
-})
-
-test('runner fails closed for unsafe off-provider sign-in-shaped navigation without waiting or DOM inspection', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const page = new FakeUnsafeOffProviderPage('https://evil.test/signin')
-  const daemon = new FakeDaemon([
-    fakeJob('job-unsafe-off-provider', profiles[0], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      actions: [{ action: VISIBLE_ACTIONS.PROMPT_INPUT, payload: { text: 'after login' } }],
-    })),
-  ])
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(page),
-    cancelPollMs: 1000,
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-unsafe-off-provider', status: 'failed' })
-  assert.equal(daemon.waiting.length, 0)
-  assert.equal(daemon.completed[0].error.code, 'unsupported_provider_navigation')
-  assert.equal(page.evaluateCalls, 0)
-})
-
-test('runner cancellation while waiting stops without running further adapter actions', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const page = new FakeHandoverPage()
-  const daemon = new FakeDaemon([
-    fakeJob('job-cancel-waiting', profiles[0], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      actions: [{ action: VISIBLE_ACTIONS.PROMPT_INPUT, payload: { text: 'must not run' } }],
-    })),
-  ])
-  daemon.cancelAfterWaiting = true
-  let actionCalls = 0
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(page),
-    adapterRegistry: fakeAdapterRegistry(async (_actionPage, request) => {
-      actionCalls += 1
-      return successResponse(request, { visible: true, inputProof: 'prompt-text-visible' })
-    }),
-    userHandoverTimeoutMs: 500,
-    userHandoverPollMs: 5,
-    cancelPollMs: 5,
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-cancel-waiting', status: 'canceled' })
-  assert.equal(actionCalls, 0)
-  assert.equal(daemon.completed.length, 0)
-})
-
-test('runner times out user handover without running the blocked action', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const page = new FakeHandoverPage()
-  const daemon = new FakeDaemon([
-    fakeJob('job-timeout', profiles[0], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      actions: [{ action: VISIBLE_ACTIONS.PROMPT_INPUT, payload: { text: 'never' } }],
-    })),
-  ])
-  let actionCalls = 0
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(page),
-    adapterRegistry: fakeAdapterRegistry(async (actionPage, request) => {
-      actionCalls += 1
-      return successResponse(request, { visible: true, inputProof: 'prompt-text-visible' })
-    }),
-    userHandoverTimeoutMs: 30,
-    userHandoverPollMs: 5,
-    cancelPollMs: 1000,
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-timeout', status: 'failed' })
-  assert.equal(actionCalls, 0)
-  assert.equal(daemon.completed[0].error.code, 'playwright_user_handover_timeout')
-  assert.equal(daemon.completed[0].error.retryable, true)
-})
-
-test('strict headless jobs checkpoint and park user blockers without switching or cleanup', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const page = new FakeHandoverPage()
-  const launches = []
-  const root = await mkdtemp(join(tmpdir(), 'tokenless-headless-park-'))
-  const jobRoot = join(root, 'job-headless-park')
-  await mkdir(jobRoot)
-  await writeFile(join(jobRoot, 'sentinel.txt'), 'keep me')
-  const daemon = new FakeDaemon([
-    fakeJob('job-headless-park', profiles[0], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      browserVisibility: 'headless',
-      actions: [{ action: VISIBLE_ACTIONS.PROMPT_INPUT, payload: { text: 'must park' } }],
-    })),
-  ])
-  let actionCalls = 0
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(page, launches),
-    adapterRegistry: fakeAdapterRegistry(async (_page, request) => {
-      actionCalls += 1
-      return successResponse(request, { visible: true, inputProof: 'prompt-text-visible' })
-    }),
-    attachmentRootForJob: (job) => join(root, job.job_id),
-    userHandoverTimeoutMs: 100,
-    userHandoverPollMs: 5,
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-headless-park', status: 'waiting_for_user' })
-  assert.equal(actionCalls, 0)
-  assert.equal(daemon.completed.length, 0)
-  assert.equal(daemon.parked.length, 1)
-  assert.deepEqual(launches.map((launch) => launch.headless), [true])
-  assert.equal(daemon.parked[0].blocker.browser.requestedVisibility, 'headless')
-  assert.equal(daemon.parked[0].blocker.browser.effectiveVisibility, 'headless')
-  assert.equal(daemon.parked[0].blocker.browser.windowOpen, false)
-  await stat(join(jobRoot, 'sentinel.txt'))
-})
-
-test('runner resumes the same auto job headed from checkpoint after restart', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const launches = []
-  const page = new FakeResponsePage()
-  const request = createManagedPlaywrightJobRequest({
-    provider: 'chatgpt',
-    browserVisibility: 'auto',
-    actions: [
-      { requestId: 'resume:input', action: VISIBLE_ACTIONS.PROMPT_INPUT, payload: { text: 'reconstruct me' } },
-      { requestId: 'resume:submit', action: VISIBLE_ACTIONS.PROMPT_SUBMIT, payload: {} },
-      { requestId: 'resume:read', action: VISIBLE_ACTIONS.RESPONSE_READ, payload: {} },
-    ],
-  })
-  const job = fakeJob('job-resume', profiles[0], request)
-  job.checkpoint_json = {
-    protocol: 'tokenless.playwright.runner-checkpoint.v1',
-    jobId: 'job-resume',
-    profileId: 'profile-a',
-    provider: 'chatgpt',
-    targetUrl: 'https://chatgpt.com/',
-    browserVisibility: 'auto',
-    actionCursor: 1,
-    responses: [successResponse(request.actions[0], { visible: true, inputProof: 'prompt-text-visible' })],
-    responseBaseline: null,
-    submitted: null,
-    phase: {
-      state: 'completed',
-      actionIndex: 0,
-      requestId: 'resume:input',
-      action: VISIBLE_ACTIONS.PROMPT_INPUT,
-      mutating: true,
-      providerUrl: 'https://chatgpt.com/',
-    },
-  }
-  job.resume_json = { browser_visibility: 'headed' }
-  const daemon = new FakeDaemon([job])
-  const adapterEvents = []
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(page, launches),
-    responseWaitTimeoutMs: 500,
-    responseWaitPollMs: 5,
-    adapterRegistry: fakeAdapterRegistry(async (_page, action) => {
-      adapterEvents.push(action.action)
-      if (action.action === VISIBLE_ACTIONS.PROMPT_SUBMIT) {
-        setTimeout(() => page.answers.push('resumed answer'), 20)
-        return successResponse(action, { visible: true, submissionProof: 'submitted' })
-      }
-      if (action.action === VISIBLE_ACTIONS.RESPONSE_READ) {
-        return successResponse(action, { text: page.answers.at(-1), citations: [], visibleProof: 'latest' })
-      }
-      return successResponse(action, { visible: true, inputProof: 'prompt-text-visible' })
-    }),
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-resume', status: 'succeeded' })
-  assert.deepEqual(launches.map((launch) => launch.headless), [false])
-  assert.deepEqual(adapterEvents, [VISIBLE_ACTIONS.PROMPT_INPUT, VISIBLE_ACTIONS.PROMPT_SUBMIT, VISIBLE_ACTIONS.RESPONSE_READ])
-  assert.equal(daemon.completed[0].result.responses.length, 3)
-  assert.equal(daemon.completed[0].result.responses.filter((response) => response.action === VISIBLE_ACTIONS.PROMPT_SUBMIT).length, 1)
-  assert.equal(daemon.completed[0].result.responses.at(-1).result.text, 'resumed answer')
-})
-
-test('runner resume override launches strict headless parked jobs headed without parking again', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const launches = []
-  const page = new FakeHandoverPage()
-  const request = createManagedPlaywrightJobRequest({
-    provider: 'chatgpt',
-    browserVisibility: 'headless',
-    actions: [{ requestId: 'headless-resume:input', action: VISIBLE_ACTIONS.PROMPT_INPUT, payload: { text: 'resume headed' } }],
-  })
-  const job = fakeJob('job-headless-resume', profiles[0], request)
-  job.checkpoint_json = {
-    protocol: 'tokenless.playwright.runner-checkpoint.v1',
-    jobId: 'job-headless-resume',
-    profileId: 'profile-a',
-    provider: 'chatgpt',
-    targetUrl: 'https://chatgpt.com/',
-    browserVisibility: 'headless',
-    actionCursor: 0,
-    responses: [],
-    responseBaseline: null,
-    submitted: null,
-    phase: { state: 'idle' },
-  }
-  job.resume_json = { browser_visibility: 'headed' }
-  const daemon = new FakeDaemon([job])
-  const adapterEvents = []
-  daemon.onWaiting = () => {
-    setTimeout(() => {
-      page.rawBlockers = []
-      page.composerVisible = true
-    }, 25)
-  }
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(page, launches),
-    adapterRegistry: fakeAdapterRegistry(async (_page, action) => {
-      adapterEvents.push(action.action)
-      return successResponse(action, { visible: true, inputProof: 'prompt-text-visible' })
-    }),
-    userHandoverTimeoutMs: 500,
-    userHandoverPollMs: 5,
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-headless-resume', status: 'succeeded' })
-  assert.deepEqual(launches.map((launch) => launch.headless), [false])
-  assert.equal(daemon.parked.length, 0)
-  assert.equal(daemon.waiting[0].blocker.browser.requestedVisibility, 'headed')
-  assert.equal(daemon.waiting[0].blocker.browser.effectiveVisibility, 'headed')
-  assert.equal(daemon.waiting[0].blocker.browser.windowOpen, true)
-  assert.deepEqual(adapterEvents, [VISIBLE_ACTIONS.PROMPT_INPUT])
-})
-
-test('runner fails closed when a checkpoint stopped inside a mutating action', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const request = createManagedPlaywrightJobRequest({
-    provider: 'chatgpt',
-    browserVisibility: 'auto',
-    actions: [
-      { requestId: 'ambiguous:input', action: VISIBLE_ACTIONS.PROMPT_INPUT, payload: { text: 'already typed' } },
-      { requestId: 'ambiguous:submit', action: VISIBLE_ACTIONS.PROMPT_SUBMIT, payload: {} },
-      { requestId: 'ambiguous:read', action: VISIBLE_ACTIONS.RESPONSE_READ, payload: {} },
-    ],
-  })
-  const job = fakeJob('job-ambiguous', profiles[0], request)
-  job.checkpoint_json = {
-    protocol: 'tokenless.playwright.runner-checkpoint.v1',
-    jobId: 'job-ambiguous',
-    profileId: 'profile-a',
-    provider: 'chatgpt',
-    targetUrl: 'https://chatgpt.com/',
-    browserVisibility: 'auto',
-    actionCursor: 1,
-    responses: [successResponse(request.actions[0], { visible: true, inputProof: 'prompt-text-visible' })],
-    responseBaseline: 1,
-    submitted: null,
-    phase: {
-      state: 'started',
-      actionIndex: 1,
-      requestId: 'ambiguous:submit',
-      action: VISIBLE_ACTIONS.PROMPT_SUBMIT,
-      mutating: true,
-      providerUrl: 'https://chatgpt.com/',
-    },
-  }
-  const daemon = new FakeDaemon([job])
-  const launches = []
-  let actionCalls = 0
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(new FakeResponsePage(), launches),
-    adapterRegistry: fakeAdapterRegistry(async (_page, action) => {
-      actionCalls += 1
-      return successResponse(action, { visibleProof: 'ok', state: 'authenticated' })
-    }),
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-ambiguous', status: 'failed' })
-  assert.equal(actionCalls, 0)
-  assert.deepEqual(launches, [])
-  assert.equal(daemon.completed[0].error.code, 'ambiguous_action_outcome')
-})
-
-test('runUntilStopped scheduler overlaps distinct profiles while keeping same-profile jobs single-flight', async () => {
-  const profiles = fakeProfiles(['profile-a', 'profile-b'])
-  const request = createManagedPlaywrightJobRequest({
-    provider: 'chatgpt',
-    actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-  })
-  const daemon = new FakeDaemon([
-    fakeJob('job-a-1', profiles[0], request),
-    fakeJob('job-a-2', profiles[0], request),
-    fakeJob('job-b-1', profiles[1], request),
-  ])
-  const events = []
-  const activeByProfile = new Map()
-  let crossProfileOverlap = false
-  let sameProfileOverlap = false
-  const controller = new AbortController()
-  let service
-  daemon.onComplete = () => {
-    if (daemon.completed.length === 3) {
-      service.stop()
-      controller.abort()
-    }
-  }
-  service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(),
-    pollIdleMs: 1,
-    cancelPollMs: 1000,
-    adapterRegistry: fakeAdapterRegistry(async (_page, visibleRequest, context) => {
-      const active = activeByProfile.get(context.profileId) ?? 0
-      sameProfileOverlap ||= active > 0
-      activeByProfile.set(context.profileId, active + 1)
-      crossProfileOverlap ||= [...activeByProfile.values()].filter((count) => count > 0).length > 1
-      events.push(`${context.operationId}:start`)
-      await delay(context.operationId === 'job-b-1' ? 60 : 20)
-      events.push(`${context.operationId}:end`)
-      activeByProfile.set(context.profileId, activeByProfile.get(context.profileId) - 1)
-      return successResponse(visibleRequest, { visibleProof: 'ok', state: 'authenticated' })
-    }),
-  })
-
-  await service.runUntilStopped(controller.signal)
-
-  assert.equal(crossProfileOverlap, true)
-  assert.equal(sameProfileOverlap, false)
-  assert.ok(events.indexOf('job-a-2:start') > events.indexOf('job-a-1:end'))
-  assert.ok(events.indexOf('job-b-1:end') > events.indexOf('job-a-2:start'))
-  assert.deepEqual(daemon.completed.map((completion) => completion.jobId).sort(), ['job-a-1', 'job-a-2', 'job-b-1'])
-})
-
-test('runUntilStopped scheduler keeps fifth profile queued while four profiles are in flight', async () => {
-  const profiles = fakeProfiles(['profile-0', 'profile-1', 'profile-2', 'profile-3', 'profile-4'])
-  const request = createManagedPlaywrightJobRequest({
-    provider: 'chatgpt',
-    actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-  })
-  const daemon = new FakeDaemon(profiles.map((profile, index) => fakeJob(`job-${index}`, profile, request)))
-  const controller = new AbortController()
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(),
-    pollIdleMs: 1,
-    cancelPollMs: 1000,
-    adapterRegistry: fakeAdapterRegistry(async (_page, _visibleRequest, context) => {
-      await waitForAbort(context.signal)
-      throw tokenlessError('aborted', 'aborted')
-    }),
-  })
-
-  const running = service.runUntilStopped(controller.signal)
-  await waitUntil(() => daemon.running.length === 4)
-  assert.equal(daemon.jobs.get('job-4').status, 'queued')
-  assert.equal(daemon.claims.some((claim) => claim.profileId === 'profile-4'), false)
-  service.stop()
-  controller.abort()
-  await running
-})
-
-test('runner observes cancelation, aborts actions, and cleans only the exact job attachment directory', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const root = await mkdtemp(join(tmpdir(), 'tokenless-runner-attachments-'))
-  const jobRoot = join(root, 'job-1')
-  await mkdir(jobRoot)
-  await writeFile(join(jobRoot, 'sentinel.txt'), 'delete me')
-  const daemon = new FakeDaemon([
-    fakeJob('job-1', profiles[0], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-    })),
-  ])
-  daemon.cancelAfterRunning = true
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(),
-    adapterRegistry: fakeAdapterRegistry(async (_page, _request, context) => {
-      await waitForAbort(context.signal)
-      throw tokenlessError('aborted', 'aborted')
-    }),
-    attachmentRootForJob: (job) => join(root, job.job_id),
-    cancelPollMs: 5,
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-1', status: 'canceled' })
-  await assert.rejects(() => stat(jobRoot), /ENOENT/)
-  assert.equal(daemon.completed.length, 0)
-})
-
-test('runner uses home-scoped default attachment bundle path and cleans exact job directory', async () => {
-  const homeDir = await mkdtemp(join(tmpdir(), 'tokenless-runner-home-'))
-  const canonicalHome = await realpath(homeDir)
-  const profiles = fakeProfiles(['profile-a'])
-  const jobId = 'job-default-attachments'
-  const jobRoot = join(canonicalHome, 'attachments', jobId)
-  await mkdir(jobRoot, { recursive: true })
-  await writeFile(join(jobRoot, 'sentinel.txt'), 'delete me')
-  const daemon = new FakeDaemon([
-    fakeJob(jobId, profiles[0], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-    })),
-  ])
-  let adapterAttachmentRoot
-  const service = new ManagedPlaywrightRunnerService({
-    homeDir,
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(),
-    adapterRegistry: fakeAdapterRegistry(async (_page, request, context) => {
-      adapterAttachmentRoot = context.attachmentRoot
-      await stat(join(context.attachmentRoot, 'sentinel.txt'))
-      return successResponse(request, { visibleProof: 'ok', state: 'authenticated' })
-    }),
-    cancelPollMs: 1000,
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId, status: 'succeeded' })
-  assert.equal(adapterAttachmentRoot, jobRoot)
-  await assert.rejects(() => stat(jobRoot), /ENOENT/)
-})
-
-test('runner refuses unsafe daemon job ids for default attachment paths', async () => {
-  const homeDir = await mkdtemp(join(tmpdir(), 'tokenless-runner-home-'))
-  const profiles = fakeProfiles(['profile-a'])
-  const daemon = new FakeDaemon([
-    fakeJob('../bad', profiles[0], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-    })),
-  ])
-  const service = new ManagedPlaywrightRunnerService({
-    homeDir,
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(),
-    adapterRegistry: fakeAdapterRegistry(),
-    cancelPollMs: 1000,
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: '../bad', status: 'failed' })
-  assert.equal(daemon.completed[0].error.code, 'invalid_playwright_job_id')
-})
-
-test('runner treats renewal failure as a failed job and refuses unsafe attachment cleanup roots', async () => {
-  const profiles = fakeProfiles(['profile-a'])
-  const daemon = new FakeDaemon([
-    fakeJob('job-1', profiles[0], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-    })),
-  ])
-  daemon.failRenewal = true
-  const service = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: daemon,
-    contextManager: fakeContextManager(),
-    adapterRegistry: fakeAdapterRegistry(async (_page, _request, context) => {
-      await waitForAbort(context.signal)
-      throw tokenlessError('aborted', 'aborted')
-    }),
-    renewIntervalMs: 5,
-    cancelPollMs: 1000,
-  })
-
-  const result = await service.runOnce()
-
-  assert.deepEqual(result, { claimed: true, jobId: 'job-1', status: 'failed' })
-  assert.equal(daemon.completed[0].error.code, 'lease_lost')
-
-  const unsafe = new ManagedPlaywrightRunnerService({
-    profileRegistry: { async listProfiles() { return profiles } },
-    daemonClient: new FakeDaemon([fakeJob('job-2', profiles[0], createManagedPlaywrightJobRequest({
-      provider: 'chatgpt',
-      actions: [{ action: VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
-    }))]),
-    contextManager: fakeContextManager(),
-    adapterRegistry: fakeAdapterRegistry(),
-    attachmentRootForJob: () => join(tmpdir(), 'attachments'),
-  })
-  const unsafeResult = await unsafe.runOnce()
-  assert.deepEqual(unsafeResult, { claimed: true, jobId: 'job-2', status: 'failed' })
-})
-
-class FakeDaemon {
-  constructor(jobs) {
-    this.jobs = new Map(jobs.map((job) => [job.job_id, job]))
-    this.claims = []
-    this.running = []
-    this.renewals = []
-    this.completed = []
-    this.checkpoints = []
-    this.parked = []
-    this.waiting = []
-    this.cancelAfterRunning = false
-    this.cancelAfterWaiting = false
-    this.failRenewal = false
-    this.onComplete = undefined
-  }
-
-  async createJob() { throw new Error('unused') }
-  async listJobs() { throw new Error('unused') }
-
-  async getJob({ jobId }) {
-    const job = this.jobs.get(jobId)
-    if (this.cancelAfterRunning && job?.status === 'running') job.status = 'canceled'
-    if (this.cancelAfterWaiting && job?.status === 'waiting_for_user') job.status = 'canceled'
-    return job
-  }
-
-  async claimNextJob({ executionBackend, profileId, action }) {
-    this.claims.push({ executionBackend, profileId, action })
-    const job = [...this.jobs.values()].find((candidate) => (
-      candidate.status === 'queued' &&
-      candidate.execution_backend === executionBackend &&
-      candidate.profile_id === profileId &&
-      candidate.action === action
-    ))
-    if (!job) return { job: null }
-    job.status = 'claimed'
-    return { job }
-  }
-
-  async markJobRunning({ jobId }) {
-    const job = this.jobs.get(jobId)
-    job.status = 'running'
-    this.running.push(jobId)
-    return job
-  }
-
-  async markJobWaitingForUser({ jobId, blocker }) {
-    const job = this.jobs.get(jobId)
-    job.status = 'waiting_for_user'
-    job.blocker_json = blocker
-    this.waiting.push({ jobId, blocker })
-    this.onWaiting?.()
-    return job
-  }
-
-  async checkpointJob({ jobId, checkpoint }) {
-    const job = this.jobs.get(jobId)
-    job.checkpoint_json = checkpoint
-    this.checkpoints.push({ jobId, checkpoint })
-    return job
-  }
-
-  async parkJob({ jobId, blocker, checkpoint }) {
-    const job = this.jobs.get(jobId)
-    job.status = 'waiting_for_user'
-    job.claim_token = `${jobId}-parked-claim`
-    job.blocker_json = blocker
-    job.checkpoint_json = checkpoint
-    job.resume_json = null
-    this.parked.push({ jobId, blocker, checkpoint })
-    this.onWaiting?.()
-    return job
-  }
-
-  async resumeJob({ jobId, browserVisibility }) {
-    const job = this.jobs.get(jobId)
-    job.status = 'queued'
-    job.resume_json = { browser_visibility: browserVisibility }
-    return job
-  }
-
-  async renewJobClaim({ jobId }) {
-    this.renewals.push(jobId)
-    if (this.failRenewal) throw tokenlessError('lease_lost', 'claim lease was lost', { retryable: true })
-    return this.jobs.get(jobId)
-  }
-
-  async completeJob({ jobId, result, error }) {
-    const job = this.jobs.get(jobId)
-    job.status = error ? 'failed' : 'succeeded'
-    this.completed.push({ jobId, result, error })
-    this.onComplete?.()
-    return job
-  }
-
-  async cancelJob() { throw new Error('unused') }
-}
-
-class FakeContext extends EventEmitter {
-  #pages = []
-  #page
-  constructor(page) {
-    super()
-    this.#page = page
-    this.closed = false
-  }
-  pages() {
-    return this.#pages
-  }
-  async newPage() {
-    const page = this.#page ?? { async goto() {} }
-    this.#pages.push(page)
-    return page
-  }
-  async close() {
-    this.closed = true
-    this.emit('close')
-  }
-}
-
-function fakeContextManager(page, launches = [], managerOptions = {}) {
-  return new PersistentContextManager({
-    ...(managerOptions.timers === undefined ? {} : { timers: managerOptions.timers }),
-    launcher: async (_userDataDir, launchOptions) => {
-      launches.push(launchOptions)
-      const context = new FakeContext(page)
-      managerOptions.contexts?.push(context)
-      return context
-    },
-  })
-}
-
-function fakeContextManagerSequence(pages, launches = [], managerOptions = {}) {
-  let launchIndex = 0
-  return new PersistentContextManager({
-    ...(managerOptions.timers === undefined ? {} : { timers: managerOptions.timers }),
-    launcher: async (_userDataDir, launchOptions) => {
-      launches.push(launchOptions)
-      const page = pages[Math.min(launchIndex, pages.length - 1)]
-      launchIndex += 1
-      const context = new FakeContext(page)
-      managerOptions.contexts?.push(context)
-      return context
-    },
-  })
-}
-
-class FakeResponsePage {
-  constructor() {
-    this.answers = ['old answer']
-    this.busy = false
-  }
-
-  async goto() {}
-
-  locator(selector) {
-    if (selector === '[data-message-author-role="assistant"]') {
-      return new FakeLocator(() => this.answers.map(() => true))
-    }
-    if (selector === 'button[data-testid="stop-button"]') {
-      return new FakeLocator(() => this.busy ? [true] : [])
-    }
-    return new FakeLocator(() => [])
-  }
-}
-
-class FakeForegroundPage {
-  constructor() {
-    this.events = []
-    this.currentUrl = ''
-  }
-
-  async goto(url, options) {
-    this.currentUrl = url
-    this.events.push(['goto', url, options])
-  }
-
-  async bringToFront() {
-    this.events.push(['bringToFront'])
-  }
-
-  url() {
-    return this.currentUrl
-  }
-
-  locator() {
-    return new FakeLocator(() => [])
-  }
-}
-
-class FakeHandoverPage {
-  constructor() {
-    this.answers = ['old answer']
-    this.rawBlockers = [{
-      kind: 'challenge',
-      code: 'visible_recaptcha',
-      family: 'recaptcha',
-      message: 'Visible reCAPTCHA verification is blocking the provider page.',
-      proof: 'visible-recaptcha-frame',
-    }]
-    this.composerVisible = false
-  }
-
-  async goto() {}
-
-  url() {
-    return 'https://chatgpt.com/'
-  }
-
-  async evaluate() {
-    return this.rawBlockers
-  }
-
-  locator(selector) {
-    if (selector === '[data-message-author-role="assistant"]') {
-      return new FakeLocator(() => this.answers.map(() => true))
-    }
-    if (selector === 'button[data-testid="stop-button"]') {
-      return new FakeLocator(() => [])
-    }
-    if (selector === 'div#prompt-textarea[contenteditable="true"]' || selector === '#prompt-textarea[contenteditable="true"]') {
-      return new FakeSingleLocator(() => this.composerVisible)
-    }
-    return new FakeSingleLocator(() => false)
-  }
-}
-
-class FakeOffProviderSignInPage {
-  constructor() {
-    this.currentUrl = 'https://accounts.google.com/signin/v2/identifier?continue=https%3A%2F%2Fchatgpt.com%2Fsecret#private'
-    this.composerVisible = false
-    this.offProviderEvaluateCalls = 0
-  }
-
-  async goto() {}
-
-  url() {
-    return this.currentUrl
-  }
-
-  async evaluate() {
-    if (this.currentUrl.startsWith('https://accounts.google.com/')) {
-      this.offProviderEvaluateCalls += 1
-      throw new Error('off-provider DOM must not be inspected')
-    }
-    return []
-  }
-
-  locator(selector) {
-    if (selector === 'div#prompt-textarea[contenteditable="true"]' || selector === '#prompt-textarea[contenteditable="true"]') {
-      return new FakeSingleLocator(() => this.composerVisible)
-    }
-    return new FakeSingleLocator(() => false)
-  }
-}
-
-class FakeUnsafeOffProviderPage {
-  constructor(url = 'https://example.com/private?token=secret#fragment') {
-    this.currentUrl = url
-    this.evaluateCalls = 0
-  }
-
-  async goto() {}
-
-  url() {
-    return this.currentUrl
-  }
-
-  async evaluate() {
-    this.evaluateCalls += 1
-    throw new Error('unsafe off-provider DOM must not be inspected')
-  }
-
-  locator() {
-    return new FakeSingleLocator(() => false)
-  }
-}
-
-class FakeLocator {
-  constructor(values) {
-    this.values = values
-  }
-
-  async count() {
-    return this.values().length
-  }
-
-  nth(index) {
-    return {
-      isVisible: async () => Boolean(this.values()[index]),
-    }
-  }
-}
-
-class FakeSingleLocator {
-  constructor(visible) {
-    this.visible = visible
-  }
-
-  first() {
-    return this
-  }
-
-  filter() {
-    return this
-  }
-
-  async isVisible() {
-    return Boolean(this.visible())
-  }
-
-  async count() {
-    return this.visible() ? 1 : 0
-  }
-
-  nth() {
-    return this
-  }
-}
-
-function fakeAdapterRegistry(execute = async (_page, request) => successResponse(request, { visibleProof: 'ok', state: 'authenticated' })) {
-  return {
-    list() { return [] },
-    get() { return null },
-    execute,
-  }
-}
-
-function fakeProfiles(ids) {
-  return ids.map((id) => ({ id, directory: join(tmpdir(), id) }))
-}
-
-function fakeJob(jobId, profile, request) {
-  return {
-    job_id: jobId,
-    claim_token: `${jobId}-claim`,
-    execution_backend: PLAYWRIGHT_EXECUTION_BACKEND,
-    profile_id: profile.id,
-    provider: request.provider,
-    action: MANAGED_PLAYWRIGHT_JOB_ACTION,
-    status: 'queued',
-    request_json: request,
-    result_json: null,
-    error_json: null,
-    blocker_json: null,
-    checkpoint_json: null,
-    resume_json: null,
-    created_at: '2026-07-17T00:00:00Z',
-    updated_at: '2026-07-17T00:00:00Z',
-  }
-}
-
-function successResponse(request, result) {
-  return {
-    protocol: request.protocol,
-    requestId: request.requestId,
-    provider: request.provider,
-    action: request.action,
-    ok: true,
-    result,
-    error: null,
-  }
-}
-
-function delay(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms))
-}
-
-function waitForAbort(signal) {
-  return new Promise((resolve) => {
-    if (signal.aborted) {
-      resolve()
-      return
-    }
-    signal.addEventListener('abort', resolve, { once: true })
-  })
-}
-
-async function waitUntil(predicate, timeoutMs = 500) {
-  const startedAt = Date.now()
-  while (Date.now() - startedAt < timeoutMs) {
-    if (predicate()) return
-    await delay(5)
-  }
-  throw new Error('Timed out waiting for test condition.')
-}
-
-class FakeTimers {
-  constructor() {
-    this.now = 0
-    this.timers = []
-  }
-
-  setTimeout(callback, ms) {
-    const timer = {
-      dueAt: this.now + ms,
-      callback,
-      cleared: false,
-    }
-    this.timers.push(timer)
-    return timer
-  }
-
-  clearTimeout(timer) {
-    timer.cleared = true
-  }
-
-  async advance(ms) {
-    this.now += ms
-    while (true) {
-      const due = this.timers
-        .filter((timer) => !timer.cleared && timer.dueAt <= this.now)
-        .sort((left, right) => left.dueAt - right.dueAt)[0]
-      if (!due) return
-      due.cleared = true
-      due.callback()
-      await Promise.resolve()
-    }
-  }
-}
diff --git a/test/playwright-runner-supervisor.test.mjs b/test/playwright-runner-supervisor.test.mjs
deleted file mode 100644
index 1cc610d..0000000
--- a/test/playwright-runner-supervisor.test.mjs
+++ /dev/null
@@ -1,307 +0,0 @@
-import assert from 'node:assert/strict'
-import { mkdtemp, readFile, stat, symlink, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import test from 'node:test'
-import {
-  RUNNER_HEARTBEAT_FRESHNESS_MS,
-  RUNNER_HEARTBEAT_INTERVAL_MS,
-  TokenlessPlaywrightError,
-  ensureRunnerMarkersDir,
-  runnerSupervisorStatus,
-  startRunnerSupervisor,
-  stopRunnerSupervisor,
-  writeRunnerHeartbeat,
-} from '../packages/cli/dist/src/playwright/index.js'
-
-test('home-scoped supervisor starts one runner, waits for heartbeat, and writes private markers', async () => {
-  const homeDir = await mkdtemp(join(tmpdir(), 'tokenless-runner-supervisor-'))
-  let spawns = 0
-  const options = {
-    homeDir,
-    sessionId: 'session-a',
-    heartbeatTimeoutMs: 1000,
-    isProcessAlive: (pid) => pid === 4242,
-    spawnDetached: async (_command, args) => {
-      spawns += 1
-      assert.equal(args.includes('--profile-id'), false)
-      assert.equal(args.includes('--profile-directory'), false)
-      const sessionId = args[args.indexOf('--session-id') + 1]
-      await writeRunnerHeartbeat({ homeDir, sessionId, pid: 4242, now: fixedNow })
-      return { pid: 4242 }
-    },
-    now: fixedNow,
-  }
-
-  const started = await startRunnerSupervisor(options)
-  const second = await startRunnerSupervisor(options)
-  const status = await runnerSupervisorStatus(options)
-  const markers = await ensureRunnerMarkersDir(homeDir)
-
-  assert.equal(started.started, true)
-  assert.equal(started.safeToStop, true)
-  assert.equal(second.started, false)
-  assert.equal(spawns, 1)
-  assert.deepEqual(status, {
-    state: 'running',
-    pid: 4242,
-    sessionId: 'session-a',
-    safeToStop: true,
-    heartbeatAt: '2026-07-17T00:00:00.000Z',
-  })
-  assert.equal((await stat(markers.runnerDir)).mode & 0o777, 0o700)
-  assert.equal((await stat(markers.sessionFile)).mode & 0o777, 0o600)
-  assert.equal((await stat(markers.pidFile)).mode & 0o777, 0o600)
-  assert.equal((await stat(markers.heartbeatFile)).mode & 0o777, 0o600)
-  assert.equal((await stat(markers.logFile)).mode & 0o777, 0o600)
-})
-
-test('supervisor refuses to reuse a running home with a different managed browser', async () => {
-  const homeDir = await mkdtemp(join(tmpdir(), 'tokenless-runner-browser-'))
-  const options = {
-    homeDir,
-    browser: 'chrome',
-    sessionId: 'session-browser',
-    heartbeatTimeoutMs: 1000,
-    isProcessAlive: (pid) => pid === 5151,
-    spawnDetached: async (_command, args) => {
-      const sessionId = args[args.indexOf('--session-id') + 1]
-      await writeRunnerHeartbeat({ homeDir, sessionId, pid: 5151, now: fixedNow })
-      return { pid: 5151 }
-    },
-    now: fixedNow,
-  }
-  await startRunnerSupervisor(options)
-  await assert.rejects(
-    () => startRunnerSupervisor({ ...options, browser: 'brave', browserExecutablePath: '/Applications/Brave Browser' }),
-    matchCode('playwright_runner_browser_mismatch')
-  )
-})
-
-test('supervisor validates heartbeat identity before stopping', async () => {
-  const homeDir = await mkdtemp(join(tmpdir(), 'tokenless-runner-supervisor-'))
-  const killed = []
-  const options = {
-    homeDir,
-    sessionId: 'session-a',
-    heartbeatTimeoutMs: 1000,
-    isProcessAlive: (pid) => pid === 7777,
-    killProcess: async (pid, signal) => killed.push({ pid, signal }),
-    spawnDetached: async (_command, args) => {
-      const sessionId = args[args.indexOf('--session-id') + 1]
-      await writeRunnerHeartbeat({ homeDir, sessionId, pid: 7777, now: fixedNow })
-      return { pid: 7777 }
-    },
-    now: fixedNow,
-  }
-
-  await startRunnerSupervisor(options)
-  const stopped = await stopRunnerSupervisor(options)
-
-  assert.deepEqual(killed, [{ pid: 7777, signal: 'SIGTERM' }])
-  assert.equal(stopped.state, 'stopped')
-})
-
-test('supervisor serializes concurrent starts to one spawned runner per home', async () => {
-  const homeDir = await mkdtemp(join(tmpdir(), 'tokenless-runner-supervisor-'))
-  let spawns = 0
-  const options = {
-    homeDir,
-    heartbeatTimeoutMs: 1000,
-    isProcessAlive: (pid) => pid === 5151,
-    spawnDetached: async (_command, args) => {
-      spawns += 1
-      await delay(20)
-      const sessionId = args[args.indexOf('--session-id') + 1]
-      await writeRunnerHeartbeat({ homeDir, sessionId, pid: 5151, now: fixedNow })
-      return { pid: 5151 }
-    },
-    now: fixedNow,
-  }
-
-  const results = await Promise.all([
-    startRunnerSupervisor({ ...options, sessionId: 'session-a' }),
-    startRunnerSupervisor({ ...options, sessionId: 'session-b' }),
-  ])
-
-  assert.equal(spawns, 1)
-  assert.equal(results.filter((result) => result.started).length, 1)
-  assert.equal(results.filter((result) => !result.started).length, 1)
-  assert.equal((await runnerSupervisorStatus(options)).safeToStop, true)
-})
-
-test('supervisor refuses to overwrite live unverified sessions', async () => {
-  const homeDir = await mkdtemp(join(tmpdir(), 'tokenless-runner-supervisor-'))
-  const markers = await ensureRunnerMarkersDir(homeDir)
-  await writeFile(markers.sessionFile, JSON.stringify({
-    protocol: 'tokenless.playwright.runner-session.v1',
-    sessionId: 'unverified',
-    pid: 9999,
-    startedAt: '2026-07-17T00:00:00.000Z',
-  }), { mode: 0o600 })
-  await writeFile(markers.pidFile, await readFile(markers.sessionFile), { mode: 0o600 })
-
-  const options = {
-    homeDir,
-    isProcessAlive: (pid) => pid === 9999,
-    spawnDetached: async () => {
-      throw new Error('must not spawn over unverified live marker')
-    },
-  }
-
-  const status = await runnerSupervisorStatus(options)
-  assert.equal(status.state, 'unsafe')
-  await assert.rejects(() => startRunnerSupervisor(options), matchCode('playwright_runner_identity_unverified'))
-  await assert.rejects(() => stopRunnerSupervisor(options), matchCode('playwright_runner_identity_unverified'))
-})
-
-test('supervisor treats stale heartbeat for a live pid as unsafe', async () => {
-  const homeDir = await mkdtemp(join(tmpdir(), 'tokenless-runner-supervisor-'))
-  const markers = await ensureRunnerMarkersDir(homeDir)
-  await writeFile(markers.sessionFile, JSON.stringify({
-    protocol: 'tokenless.playwright.runner-session.v1',
-    sessionId: 'session-a',
-    pid: 6060,
-    startedAt: '2026-07-17T00:00:00.000Z',
-  }), { mode: 0o600 })
-  await writeFile(markers.pidFile, await readFile(markers.sessionFile), { mode: 0o600 })
-  await writeFile(markers.heartbeatFile, JSON.stringify({
-    protocol: 'tokenless.playwright.runner-heartbeat.v1',
-    sessionId: 'session-a',
-    pid: 6060,
-    updatedAt: '2000-01-01T00:00:00.000Z',
-  }), { mode: 0o600 })
-  const options = {
-    homeDir,
-    heartbeatTimeoutMs: 50,
-    isProcessAlive: (pid) => pid === 6060,
-    now: fixedNow,
-  }
-
-  const status = await runnerSupervisorStatus(options)
-  assert.equal(status.state, 'unsafe')
-  await assert.rejects(() => stopRunnerSupervisor(options), matchCode('playwright_runner_identity_unverified'))
-})
-
-test('supervisor uses a wider default heartbeat freshness window than writer cadence', async () => {
-  assert.equal(RUNNER_HEARTBEAT_INTERVAL_MS, 2_000)
-  assert.equal(RUNNER_HEARTBEAT_FRESHNESS_MS, 15_000)
-  const homeDir = await mkdtemp(join(tmpdir(), 'tokenless-runner-supervisor-'))
-  const markers = await ensureRunnerMarkersDir(homeDir)
-  await writeFile(markers.sessionFile, JSON.stringify({
-    protocol: 'tokenless.playwright.runner-session.v1',
-    sessionId: 'session-a',
-    pid: 6161,
-    startedAt: '2026-07-17T00:00:00.000Z',
-  }), { mode: 0o600 })
-  await writeFile(markers.pidFile, await readFile(markers.sessionFile), { mode: 0o600 })
-  await writeFile(markers.heartbeatFile, JSON.stringify({
-    protocol: 'tokenless.playwright.runner-heartbeat.v1',
-    sessionId: 'session-a',
-    pid: 6161,
-    updatedAt: '2026-07-16T23:59:50.000Z',
-  }), { mode: 0o600 })
-  const options = {
-    homeDir,
-    isProcessAlive: (pid) => pid === 6161,
-    now: fixedNow,
-  }
-
-  assert.equal((await runnerSupervisorStatus(options)).state, 'running')
-  await writeFile(markers.heartbeatFile, JSON.stringify({
-    protocol: 'tokenless.playwright.runner-heartbeat.v1',
-    sessionId: 'session-a',
-    pid: 6161,
-    updatedAt: '2026-07-16T23:59:44.000Z',
-  }), { mode: 0o600 })
-  assert.equal((await runnerSupervisorStatus(options)).state, 'unsafe')
-})
-
-test('supervisor kills and cleans its own spawned runner when heartbeat handshake times out', async () => {
-  const homeDir = await mkdtemp(join(tmpdir(), 'tokenless-runner-supervisor-'))
-  const alive = new Set([7070])
-  const killed = []
-  const options = {
-    homeDir,
-    sessionId: 'session-a',
-    heartbeatTimeoutMs: 50,
-    isProcessAlive: (pid) => alive.has(pid),
-    killProcess: async (pid, signal) => {
-      killed.push({ pid, signal })
-      alive.delete(pid)
-    },
-    spawnDetached: async () => ({ pid: 7070 }),
-    now: fixedNow,
-  }
-
-  await assert.rejects(() => startRunnerSupervisor(options), matchCode('playwright_runner_heartbeat_timeout'))
-  assert.deepEqual(killed, [{ pid: 7070, signal: 'SIGTERM' }])
-  assert.equal((await runnerSupervisorStatus(options)).state, 'stopped')
-})
-
-test('supervisor treats corrupt existing session markers as unsafe', async () => {
-  const homeDir = await mkdtemp(join(tmpdir(), 'tokenless-runner-supervisor-'))
-  const markers = await ensureRunnerMarkersDir(homeDir)
-  await writeFile(markers.sessionFile, '{not json', { mode: 0o600 })
-
-  const status = await runnerSupervisorStatus({ homeDir })
-  assert.equal(status.state, 'unsafe')
-  await assert.rejects(() => startRunnerSupervisor({
-    homeDir,
-    spawnDetached: async () => {
-      throw new Error('must not spawn over corrupt marker')
-    },
-  }), matchCode('playwright_runner_identity_unverified'))
-})
-
-test('supervisor rejects symlink and overbroad marker files', async () => {
-  const homeDir = await mkdtemp(join(tmpdir(), 'tokenless-runner-supervisor-'))
-  const markers = await ensureRunnerMarkersDir(homeDir)
-  await writeFile(join(markers.runnerDir, 'target.json'), '{}', { mode: 0o600 })
-  await symlink(join(markers.runnerDir, 'target.json'), markers.sessionFile)
-
-  await assert.rejects(() => runnerSupervisorStatus({ homeDir }), matchCode('playwright_runner_marker_permissions'))
-})
-
-test('supervisor rejects pre-existing pid symlinks before spawning', async () => {
-  const homeDir = await mkdtemp(join(tmpdir(), 'tokenless-runner-supervisor-'))
-  const markers = await ensureRunnerMarkersDir(homeDir)
-  await writeFile(join(markers.runnerDir, 'target.json'), '{}', { mode: 0o600 })
-  await symlink(join(markers.runnerDir, 'target.json'), markers.pidFile)
-  let spawned = false
-
-  await assert.rejects(() => startRunnerSupervisor({
-    homeDir,
-    isProcessAlive: () => false,
-    spawnDetached: async () => {
-      spawned = true
-      return { pid: 1 }
-    },
-  }), matchCode('playwright_runner_marker_permissions'))
-  assert.equal(spawned, false)
-})
-
-test('runner heartbeat writer rejects pre-existing heartbeat symlinks', async () => {
-  const homeDir = await mkdtemp(join(tmpdir(), 'tokenless-runner-supervisor-'))
-  const markers = await ensureRunnerMarkersDir(homeDir)
-  await writeFile(join(markers.runnerDir, 'target.json'), '{}', { mode: 0o600 })
-  await symlink(join(markers.runnerDir, 'target.json'), markers.heartbeatFile)
-
-  await assert.rejects(() => writeRunnerHeartbeat({
-    homeDir,
-    sessionId: 'session-a',
-    pid: 1234,
-  }), matchCode('playwright_runner_marker_permissions'))
-})
-
-function fixedNow() {
-  return new Date('2026-07-17T00:00:00.000Z')
-}
-
-function matchCode(code) {
-  return (error) => error instanceof TokenlessPlaywrightError && error.code === code
-}
-
-function delay(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms))
-}
diff --git a/test/provider-availability-routing.test.mjs b/test/provider-availability-routing.test.mjs
new file mode 100644
index 0000000..6d7367e
--- /dev/null
+++ b/test/provider-availability-routing.test.mjs
@@ -0,0 +1,437 @@
+import assert from 'node:assert/strict'
+import { spawnSync } from 'node:child_process'
+import fs from 'node:fs'
+import net from 'node:net'
+import os from 'node:os'
+import path from 'node:path'
+import test from 'node:test'
+import { fileURLToPath } from 'node:url'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const cliEntry = path.join(root, 'packages/cli/dist/src/tokenless.mjs')
+
+test('capabilities list exposes canonical outcomes and only evidence-backed routes', () => {
+  const result = runCli(['capabilities', 'list', '--json'])
+  assert.equal(result.status, 0, result.stderr || result.stdout)
+  const payload = JSON.parse(result.stdout)
+  assert.equal(payload.schema, 'tokenless.task-capability-catalog.v1')
+
+  const byId = new Map(payload.capabilities.map((capability) => [capability.id, capability]))
+  assert.equal(byId.get('conversation.chat').routeable, true)
+  assert.deepEqual(
+    byId.get('conversation.chat').routes.map((route) => route.provider),
+    ['chatgpt', 'claude', 'gemini', 'grok', 'qwen', 'perplexity', 'zai', 'doubao'],
+  )
+  assert.deepEqual(
+    byId.get('file.upload').routes.map((route) => route.provider),
+    ['chatgpt', 'claude', 'grok', 'doubao'],
+  )
+  assert.equal(byId.get('workspace.native').routeable, false)
+  assert.deepEqual(byId.get('workspace.native').routes, [])
+  assert.equal(byId.get('research.deep').routeable, false)
+  assert.deepEqual(byId.get('research.deep').routes, [])
+  assert.equal(byId.get('audio.transcription').routeable, false)
+  assert.deepEqual(byId.get('audio.transcription').routes, [])
+  assert.equal(byId.has('qwen.mode'), false)
+  assert.equal(byId.has('model.choice'), false)
+  assert.equal(byId.has('effort.choice'), false)
+})
+
+test('implicit run routing chooses the first usable cached provider in setup order', async () => {
+  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-provider-route-')))
+  const daemonUrl = `http://127.0.0.1:${await freePort()}`
+  let daemonStarted = false
+  try {
+    seedManagedProfile(homeDir, {
+      chatgpt: observedProvider('chatgpt', 'unknown', 'unknown'),
+      claude: observedProvider('claude', 'unauthenticated', 'sign_in_required'),
+      gemini: observedProvider('gemini', 'unauthenticated', 'guest'),
+      grok: observedProvider('grok', 'authenticated', 'signed_in_paid'),
+    })
+    writeConfig(homeDir, ['chatgpt', 'claude', 'grok', 'gemini'], daemonUrl)
+
+    const result = runCli([
+      'run',
+      '--home',
+      homeDir,
+      '--daemon-url',
+      daemonUrl,
+      '--prompt',
+      'Tokenless provider availability routing test',
+      '--no-wait',
+      '--json',
+    ])
+    daemonStarted = result.status === 0
+    assert.equal(result.status, 0, result.stderr || result.stdout)
+    const payload = JSON.parse(result.stdout)
+    assert.equal(payload.provider, 'grok')
+    assert.equal(payload.status, 'no_wait')
+    const state = runCli([
+      'state', '--home', homeDir, '--daemon-url', daemonUrl,
+      '--job-id', payload.jobId, '--json',
+    ])
+    assert.equal(state.status, 0, state.stderr || state.stdout)
+    const latest = JSON.parse(state.stdout).latest
+    assert.deepEqual(latest.fallback, {
+      protocol: 'tokenless.provider-fallback.v1',
+      mode: 'automatic',
+      replay: 'from_start',
+      providers: ['gemini'],
+      routes: [{
+        rank: 1,
+        provider: 'gemini',
+        requirements: ['conversation.chat'],
+        support: 'supported',
+        runtimeEligibility: 'eligible',
+        strategies: ['visible-conversation'],
+        evidence: ['workspace-response-citations'],
+      }],
+    })
+    assert.equal(latest.providerAttempts[0].provider, 'grok')
+  } finally {
+    if (daemonStarted) runCli(['daemon', 'stop', '--home', homeDir, '--daemon-url', daemonUrl, '--json'])
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('attachment inference routes around a usable provider without file acceptance closure', async () => {
+  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-capability-file-route-')))
+  const daemonUrl = `http://127.0.0.1:${await freePort()}`
+  const attachment = path.join(homeDir, 'evidence.txt')
+  fs.writeFileSync(attachment, 'Tokenless capability routing evidence.\n')
+  let daemonStarted = false
+  try {
+    seedManagedProfile(homeDir, {
+      gemini: observedProvider('gemini', 'unauthenticated', 'guest'),
+      grok: observedProvider('grok', 'authenticated', 'signed_in_paid'),
+    })
+    writeConfig(homeDir, ['gemini', 'grok'], daemonUrl)
+
+    const result = runCli([
+      'run',
+      '--home',
+      homeDir,
+      '--daemon-url',
+      daemonUrl,
+      '--prompt',
+      'Tokenless capability file routing test',
+      '--attach-file',
+      attachment,
+      '--no-wait',
+      '--json',
+    ])
+    daemonStarted = result.status === 0
+    assert.equal(result.status, 0, result.stderr || result.stdout)
+    const payload = JSON.parse(result.stdout)
+    assert.equal(payload.provider, 'grok')
+    assert.deepEqual(payload.capabilityRoute.requirements, ['conversation.chat', 'file.upload'])
+    assert.deepEqual(
+      payload.capabilityRoute.strategies,
+      ['visible-conversation', 'visible-file-attachment'],
+    )
+    const state = runCli([
+      'state',
+      '--home',
+      homeDir,
+      '--daemon-url',
+      daemonUrl,
+      '--job-id',
+      payload.jobId,
+      '--json',
+    ])
+    assert.equal(state.status, 0, state.stderr || state.stdout)
+    assert.deepEqual(
+      JSON.parse(state.stdout).latest.capabilityRoute,
+      payload.capabilityRoute,
+    )
+  } finally {
+    if (daemonStarted) runCli(['daemon', 'stop', '--home', homeDir, '--daemon-url', daemonUrl, '--json'])
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('explicit provider fails before daemon submission when required capability is not closed', () => {
+  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-capability-explicit-')))
+  const daemonUrl = 'http://127.0.0.1:9'
+  const attachment = path.join(homeDir, 'evidence.txt')
+  fs.writeFileSync(attachment, 'Tokenless explicit route evidence.\n')
+  try {
+    seedManagedProfile(homeDir, {
+      gemini: observedProvider('gemini', 'unauthenticated', 'guest'),
+    })
+    writeConfig(homeDir, ['gemini'], daemonUrl)
+
+    const result = runCli([
+      'run',
+      '--home',
+      homeDir,
+      '--daemon-url',
+      daemonUrl,
+      '--provider',
+      'gemini',
+      '--capability',
+      'file.upload',
+      '--attach-file',
+      attachment,
+      '--prompt',
+      'Tokenless explicit capability failure test',
+      '--json',
+    ])
+    assert.equal(result.status, 1, result.stderr || result.stdout)
+    const payload = JSON.parse(result.stdout)
+    assert.equal(payload.error.code, 'task_capability_route_unavailable')
+    assert.deepEqual(payload.error.context.requirements, ['file.upload', 'conversation.chat'])
+    assert.deepEqual(payload.error.context.providers[0].missingCapabilities, ['file.upload'])
+    assert.equal(fs.existsSync(path.join(homeDir, 'daemon.token')), false)
+  } finally {
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('deep research stays unavailable until its complete lifecycle is closed', () => {
+  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-capability-research-')))
+  try {
+    seedManagedProfile(homeDir, {
+      qwen: observedProvider('qwen', 'unauthenticated', 'guest'),
+    })
+    writeConfig(homeDir, ['qwen'], 'http://127.0.0.1:9')
+
+    const result = runCli([
+      'run',
+      '--home',
+      homeDir,
+      '--provider',
+      'qwen',
+      '--capability',
+      'research.deep',
+      '--prompt',
+      'Tokenless deep research closure test',
+      '--json',
+    ])
+    assert.equal(result.status, 1, result.stderr || result.stdout)
+    const payload = JSON.parse(result.stdout)
+    assert.equal(payload.error.code, 'task_capability_route_unavailable')
+    assert.deepEqual(payload.error.context.requirements, [
+      'research.deep',
+      'search.web',
+      'response.citations',
+      'task.background',
+      'task.interactive',
+      'conversation.chat',
+    ])
+    assert.equal(fs.existsSync(path.join(homeDir, 'daemon.token')), false)
+  } finally {
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('attachment media infers its semantic input capability', () => {
+  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-capability-image-input-')))
+  const image = path.join(homeDir, 'evidence.png')
+  fs.writeFileSync(image, Buffer.from('89504e470d0a1a0a', 'hex'))
+  try {
+    seedManagedProfile(homeDir, {
+      chatgpt: observedProvider('chatgpt', 'unauthenticated', 'guest'),
+    })
+    writeConfig(homeDir, ['chatgpt'], 'http://127.0.0.1:9')
+
+    const result = runCli([
+      'run',
+      '--home',
+      homeDir,
+      '--attach-file',
+      image,
+      '--prompt',
+      'Tokenless image input closure test',
+      '--json',
+    ])
+    assert.equal(result.status, 1, result.stderr || result.stdout)
+    const payload = JSON.parse(result.stdout)
+    assert.equal(payload.error.code, 'task_capability_route_unavailable')
+    assert.deepEqual(
+      payload.error.context.requirements,
+      ['conversation.chat', 'file.upload', 'image.input'],
+    )
+    assert.deepEqual(payload.error.context.providers[0].missingCapabilities, ['image.input'])
+    assert.equal(fs.existsSync(path.join(homeDir, 'daemon.token')), false)
+  } finally {
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('explicit run provider is not replaced by cached provider usability', async () => {
+  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-provider-explicit-')))
+  const daemonUrl = `http://127.0.0.1:${await freePort()}`
+  let daemonStarted = false
+  try {
+    seedManagedProfile(homeDir, {
+      chatgpt: observedProvider('chatgpt', 'unknown', 'unknown'),
+      gemini: observedProvider('gemini', 'unauthenticated', 'guest'),
+    })
+    writeConfig(homeDir, ['chatgpt', 'gemini'], daemonUrl)
+
+    const result = runCli([
+      'run',
+      '--home',
+      homeDir,
+      '--daemon-url',
+      daemonUrl,
+      '--provider',
+      'chatgpt',
+      '--prompt',
+      'Tokenless explicit provider routing test',
+      '--no-wait',
+      '--json',
+    ])
+    daemonStarted = result.status === 0
+    assert.equal(result.status, 0, result.stderr || result.stdout)
+    const payload = JSON.parse(result.stdout)
+    assert.equal(payload.provider, 'chatgpt')
+    assert.equal(payload.status, 'no_wait')
+  } finally {
+    if (daemonStarted) runCli(['daemon', 'stop', '--home', homeDir, '--daemon-url', daemonUrl, '--json'])
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('implicit run routing fails before daemon submission when no cached provider is usable', async () => {
+  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-provider-none-')))
+  const daemonUrl = `http://127.0.0.1:${await freePort()}`
+  try {
+    seedManagedProfile(homeDir, {
+      chatgpt: observedProvider('chatgpt', 'unknown', 'unknown'),
+      claude: observedProvider('claude', 'unauthenticated', 'sign_in_required'),
+    })
+    writeConfig(homeDir, ['chatgpt', 'claude'], daemonUrl)
+
+    const result = runCli([
+      'run',
+      '--home',
+      homeDir,
+      '--daemon-url',
+      daemonUrl,
+      '--prompt',
+      'Tokenless no provider availability routing test',
+      '--no-wait',
+      '--json',
+    ])
+    assert.equal(result.status, 1, result.stderr || result.stdout)
+    const payload = JSON.parse(result.stdout)
+    assert.equal(payload.error.code, 'provider_unavailable')
+    assert.equal(payload.error.context.profile.slug, 'default')
+    assert.deepEqual(
+      payload.error.context.providers.map((provider) => [provider.provider, provider.access, provider.usable]),
+      [
+        ['chatgpt', 'unknown', false],
+        ['claude', 'sign_in_required', false],
+      ]
+    )
+    assert.match(payload.error.context.nextAction, /tokenless setup/)
+    assert.equal(fs.existsSync(path.join(homeDir, 'daemon.token')), false)
+  } finally {
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('doctor reports observation health separately from cached provider usability', () => {
+  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-provider-doctor-')))
+  try {
+    seedManagedProfile(homeDir, {
+      chatgpt: observedProvider('chatgpt', 'unknown', 'unknown'),
+      claude: observedProvider('claude', 'unauthenticated', 'sign_in_required'),
+      gemini: observedProvider('gemini', 'unauthenticated', 'guest'),
+      grok: observedProvider('grok', 'authenticated', 'signed_in_paid'),
+    })
+    writeConfig(homeDir, ['chatgpt', 'claude', 'gemini', 'grok'], `http://127.0.0.1:9`)
+
+    const result = runCli(['doctor', '--home', homeDir, '--json'])
+    assert.notEqual(result.stdout, '', result.stderr)
+    const payload = JSON.parse(result.stdout)
+    assert.equal(payload.checks.providerReadiness.ok, true)
+    assert.deepEqual(payload.checks.providerReadiness.usableProviders, ['gemini', 'grok'])
+    assert.equal(payload.checks.providerReadiness.providers.chatgpt.usable, false)
+    assert.equal(payload.checks.providerReadiness.providers.chatgpt.access, 'unknown')
+    assert.equal(payload.checks.providerReadiness.providers.claude.usable, false)
+    assert.equal(payload.checks.providerReadiness.providers.claude.access, 'sign_in_required')
+    assert.equal(payload.checks.providerReadiness.providers.gemini.usable, true)
+  } finally {
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+function writeConfig(homeDir, providerWhitelist, daemonUrl) {
+  fs.mkdirSync(homeDir, { recursive: true, mode: 0o700 })
+  fs.writeFileSync(path.join(homeDir, 'config.json'), `${JSON.stringify({
+    protocol: 'tokenless.config.v1',
+    updatedAt: new Date().toISOString(),
+    providerWhitelist,
+    browser: null,
+    browserVisibility: 'auto',
+    daemonUrl,
+  }, null, 2)}\n`, { mode: 0o600 })
+}
+
+function seedManagedProfile(homeDir, lastObservedAuth) {
+  const id = '11111111-1111-4111-8111-111111111111'
+  const profilesRoot = path.join(homeDir, 'browser', 'profiles')
+  const directory = path.join(profilesRoot, id)
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 })
+  fs.writeFileSync(path.join(homeDir, 'browser', 'profiles.json'), `${JSON.stringify({
+    version: 1,
+    defaultProfile: 'default',
+    profiles: {
+      default: {
+        slug: 'default',
+        id,
+        label: 'default',
+        labelOrigin: 'slug',
+        directory,
+        lifecycle: 'ready',
+        createdAt: new Date().toISOString(),
+        updatedAt: new Date().toISOString(),
+        lastObservedAuth,
+      },
+    },
+  }, null, 2)}\n`, { mode: 0o600 })
+}
+
+function observedProvider(provider, auth, access) {
+  return {
+    provider,
+    auth,
+    access,
+    checkedAt: new Date().toISOString(),
+    ...(auth === 'authenticated'
+      ? {
+          account: {
+            name: `${provider} user`,
+            subscription: null,
+            tier: { class: access, label: null },
+          },
+        }
+      : {}),
+  }
+}
+
+function runCli(args) {
+  return spawnSync(process.execPath, [cliEntry, ...args], {
+    cwd: root,
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      TOKENLESS_PROVIDER: '',
+    },
+  })
+}
+
+async function freePort() {
+  const server = net.createServer()
+  await new Promise((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(0, '127.0.0.1', resolve)
+  })
+  const address = server.address()
+  await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()))
+  assert.equal(typeof address, 'object')
+  return address.port
+}
diff --git a/test/provider-dom-authenticated-fixtures.test.mjs b/test/provider-dom-authenticated-fixtures.test.mjs
index 2ca6f66..f0791cb 100644
--- a/test/provider-dom-authenticated-fixtures.test.mjs
+++ b/test/provider-dom-authenticated-fixtures.test.mjs
@@ -15,6 +15,12 @@ const scenarios = Object.freeze([
   'file-input-ready',
   'composer-idle',
 ])
+const deepWorkflowMinimums = Object.freeze({
+  chatgpt: 7,
+  claude: 6,
+  gemini: 7,
+  grok: 9,
+})
 const providers = Object.freeze({
   chatgpt: {
     accountState: 'signed-in-paid',
@@ -98,7 +104,7 @@ const adapterSelectorAudit = Object.freeze({
     'composer-idle': [['rich-textarea div.ql-editor[data-gramm="false"][contenteditable="true"][role="textbox"][aria-multiline="true"][aria-label="Enter a prompt for Gemini"]', 1]],
   },
   grok: {
-    'session-status': [['a[href="/skills-and-connectors"]', 1]],
+    'session-status': [['button:has(img[alt="pfp"])', 1]],
     'model-menu-open': [
       ['button#model-select-trigger[aria-label="Model select"][aria-haspopup="menu"]', 1],
       ['[role="menuitem"][data-radix-collection-item] span.font-semibold', 4],
@@ -125,11 +131,14 @@ test('authenticated provider DOM fixtures retain only redacted, provenance-bound
   try {
     for (const [provider, expected] of Object.entries(providers)) {
       const accountRoot = path.join(fixtureRoot, provider, expected.accountState)
-      assert.deepEqual(
-        (await fs.readdir(accountRoot)).filter((name) => name.endsWith('.html')).sort(),
-        scenarios.map((scenario) => `${scenario}.html`).sort(),
-        `${provider} authenticated scenario set`
+      const retainedScenarios = new Set(
+        (await fs.readdir(accountRoot))
+          .filter((name) => name.endsWith('.html'))
+          .map((name) => name.replace(/\.html$/, ''))
       )
+      for (const scenario of scenarios) {
+        assert.equal(retainedScenarios.has(scenario), true, `${provider} retains ${scenario}`)
+      }
 
       for (const scenario of scenarios) {
         const htmlPath = path.join(accountRoot, `${scenario}.html`)
@@ -192,11 +201,285 @@ test('authenticated provider DOM fixtures retain only redacted, provenance-bound
   }
 })
 
-test('authenticated evidence does not replace the existing legacy fixture corpus', async () => {
-  for (const provider of Object.keys(providers)) {
-    const legacyPath = path.join(root, 'test', 'fixtures', `${provider}-real-dom-fixture.html`)
-    const stat = await fs.stat(legacyPath)
-    assert.equal(stat.isFile(), true, `${provider} legacy fixture remains available`)
+test('provider DOM manifest inventories every fixture with its sanitized page URL', async () => {
+  const manifest = JSON.parse(await fs.readFile(path.join(fixtureRoot, 'manifest.json'), 'utf8'))
+  assert.equal(manifest.schema, 'tokenless.provider-dom-manifest.v2')
+  assert.equal(manifest.generatedBy, 'test/helpers/build-provider-workflow-fixtures.mjs')
+  assert.equal(Array.isArray(manifest.fixtures), true)
+
+  const listed = new Set()
+  for (const entry of manifest.fixtures) {
+    const provenance = JSON.parse(await fs.readFile(
+      path.join(fixtureRoot, entry.provenancePath),
+      'utf8'
+    ))
+    await fs.access(path.join(fixtureRoot, entry.htmlPath))
+    assert.equal(provenance.provider, entry.provider)
+    assert.equal(provenance.accountState, entry.accountState)
+    assert.equal(provenance.scenario, entry.scenario)
+    assert.equal(provenance.routeClass, entry.routeClass)
+    assert.equal(typeof entry.operationPhase, 'string')
+    assert.match(entry.capabilityOutcome, /^(?:available|unavailable|unknown)$/)
+    if (provenance.operationPhase !== undefined) {
+      assert.equal(provenance.operationPhase, entry.operationPhase)
+      assert.equal(provenance.capabilityOutcome, entry.capabilityOutcome)
+    }
+    assert.equal(provenance.sanitizedUrl, entry.sanitizedUrl)
+    assert.equal(provenance.observedOn, entry.observedOn)
+    listed.add(entry.htmlPath)
+  }
+
+  const actual = new Set()
+  const providerDirectories = (await fs.readdir(fixtureRoot, { withFileTypes: true }))
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => entry.name)
+  for (const provider of providerDirectories) {
+    const accountStates = await fs.readdir(path.join(fixtureRoot, provider), { withFileTypes: true })
+    for (const accountState of accountStates.filter((entry) => entry.isDirectory())) {
+      const files = await fs.readdir(path.join(fixtureRoot, provider, accountState.name))
+      for (const file of files.filter((name) => name.endsWith('.html'))) {
+        actual.add(path.join(provider, accountState.name, file))
+      }
+    }
+  }
+  assert.deepEqual([...listed].sort(), [...actual].sort())
+})
+
+test('DeepSeek fixtures preserve mode-dependent visible control topology', { timeout: 30000 }, async () => {
+  const accountRoot = path.join(fixtureRoot, 'deepseek', 'signed-in-unknown')
+  const expected = {
+    'composer-instant': { mode: 'Instant', toggles: ['DeepThink', 'Search'], fileInput: 1 },
+    'composer-expert': { mode: 'Expert', toggles: ['DeepThink'], fileInput: 0 },
+    'composer-vision': { mode: 'Vision', toggles: ['DeepThink'], fileInput: 1 },
+  }
+  const browser = await chromium.launch({ headless: true })
+  const page = await browser.newPage()
+  try {
+    for (const [scenario, topology] of Object.entries(expected)) {
+      const htmlPath = path.join(accountRoot, `${scenario}.html`)
+      const provenancePath = path.join(accountRoot, `${scenario}.provenance.json`)
+      const [htmlBytes, provenanceText] = await Promise.all([
+        fs.readFile(htmlPath),
+        fs.readFile(provenancePath, 'utf8'),
+      ])
+      const provenance = JSON.parse(provenanceText)
+      assert.equal(provenance.provider, 'deepseek')
+      assert.equal(provenance.source, 'authenticated-user-visible-chrome-session')
+      assert.equal(provenance.containsSyntheticBehavior, false)
+      assert.equal(provenance.contentSha256, sha256(htmlBytes))
+      await page.setContent(htmlBytes.toString('utf8'))
+      assert.equal(await page.locator('textarea[name="search"][placeholder="Message DeepSeek"]').count(), 1)
+      assert.equal(await page.getByRole('radio', { name: topology.mode, exact: true }).getAttribute('aria-checked'), 'true')
+      assert.deepEqual(
+        await page.locator('.ds-toggle-button').allTextContents(),
+        topology.toggles,
+      )
+      assert.equal(await page.locator('input[type="file"][multiple]').count(), topology.fileInput)
+      if (topology.fileInput === 1) {
+        const accept = await page.locator('input[type="file"][multiple]').getAttribute('accept')
+        assert.match(accept ?? '', /(?:^|,)\.txt(?:,|$)/u)
+        assert.match(accept ?? '', /(?:^|,)\.png(?:,|$)/u)
+      }
+      assert.equal(await page.locator('[role="button"].ds-button--primary.ds-button--disabled').count(), 1)
+      for (const evidence of provenance.evidenceSelectors) {
+        assert.equal(await page.locator(evidence.selector).count(), evidence.expectedCount)
+      }
+      for (const absence of provenance.absenceSelectors) {
+        assert.equal(await page.locator(absence.selector).count(), absence.expectedCount)
+      }
+    }
+
+    for (const scenario of ['response-complete', 'deepthink-response-complete', 'search-response-complete']) {
+      const htmlPath = path.join(accountRoot, `${scenario}.html`)
+      const provenancePath = path.join(accountRoot, `${scenario}.provenance.json`)
+      const [htmlBytes, provenanceText] = await Promise.all([
+        fs.readFile(htmlPath),
+        fs.readFile(provenancePath, 'utf8'),
+      ])
+      const provenance = JSON.parse(provenanceText)
+      assert.equal(provenance.contentSha256, sha256(htmlBytes))
+      await page.setContent(htmlBytes.toString('utf8'))
+      for (const evidence of provenance.evidenceSelectors) {
+        assert.equal(await page.locator(evidence.selector).count(), evidence.expectedCount)
+      }
+      assert.equal(await page.locator('.ds-message > .ds-markdown.ds-assistant-message-main-content').count(), 1)
+    }
+  } finally {
+    await browser.close()
+  }
+})
+
+test('Qwen guest fixtures preserve provenance-bound composer, mode, and completed-response evidence', {
+  timeout: 30000,
+}, async () => {
+  const accountRoot = path.join(fixtureRoot, 'qwen', 'signed-out-guest')
+  const browser = await chromium.launch({ headless: true })
+  const page = await browser.newPage()
+  try {
+    const cases = [
+      {
+        scenario: 'composer-idle',
+        observedOn: '2026-07-26',
+        source: 'unauthenticated-user-visible-in-app-browser-session',
+      },
+      {
+        scenario: 'response-complete',
+        observedOn: '2026-07-26',
+        source: 'unauthenticated-user-visible-in-app-browser-session',
+      },
+      {
+        scenario: 'deep-research-advanced-selected',
+        observedOn: '2026-07-30',
+        source: 'development-visible-provider-session-cdp-observer',
+      },
+      {
+        scenario: 'studio-response-complete',
+        observedOn: '2026-07-29',
+        source: 'managed-visible-provider-session',
+      },
+    ]
+    for (const fixtureCase of cases) {
+      const { scenario } = fixtureCase
+      const [htmlBytes, provenanceText] = await Promise.all([
+        fs.readFile(path.join(accountRoot, `${scenario}.html`)),
+        fs.readFile(path.join(accountRoot, `${scenario}.provenance.json`), 'utf8'),
+      ])
+      const html = htmlBytes.toString('utf8')
+      const provenance = JSON.parse(provenanceText)
+
+      assert.equal(provenance.schema, 'tokenless.provider-dom-provenance.v1')
+      assert.equal(provenance.provider, 'qwen')
+      assert.equal(provenance.accountState, 'signed-out-guest')
+      assert.deepEqual(provenance.observedPlan, { status: 'unknown', label: null })
+      assert.equal(provenance.scenario, scenario)
+      assert.equal(provenance.observedOn, fixtureCase.observedOn)
+      assert.equal(provenance.source, fixtureCase.source)
+      assert.equal(provenance.artifactKind, 'redacted-reduced-dom')
+      assert.equal(provenance.containsProviderJavaScript, false)
+      assert.equal(provenance.containsSyntheticBehavior, false)
+      assert.equal(sha256(htmlBytes), provenance.contentSha256)
+      assertPrivacyBoundary(html)
+      assertPrivacyBoundary(provenanceText)
+      assert.doesNotMatch(html, /<script\b|<style\b/i)
+
+      await page.setContent(html)
+      for (const evidence of provenance.evidenceSelectors) {
+        assert.equal(
+          await page.locator(evidence.selector).count(),
+          evidence.expectedCount,
+          `qwen/${scenario} ${evidence.capability}: ${evidence.selector}`
+        )
+      }
+      for (const absence of provenance.absenceSelectors) {
+        assert.equal(
+          await page.locator(absence.selector).count(),
+          absence.expectedCount,
+          `qwen/${scenario} ${absence.purpose}: ${absence.selector}`
+        )
+      }
+      await assertSanitizedLinks(page, `qwen/${scenario}`)
+    }
+  } finally {
+    await browser.close()
+  }
+})
+
+test('deep workflow fixtures cover authenticated provider jobs, settings, connectors, uploads, and media', {
+  timeout: 30000,
+}, async () => {
+  const manifest = JSON.parse(await fs.readFile(path.join(fixtureRoot, 'manifest.json'), 'utf8'))
+  const deepEntries = manifest.fixtures.filter((entry) => entry.observedOn === '2026-07-25')
+  const counts = Object.fromEntries(Object.keys(deepWorkflowMinimums).map((provider) => [provider, 0]))
+  const routeClasses = Object.fromEntries(Object.keys(deepWorkflowMinimums).map((provider) => [provider, new Set()]))
+  const browser = await chromium.launch({ headless: true })
+  const page = await browser.newPage()
+
+  try {
+    for (const entry of deepEntries) {
+      const [htmlBytes, provenanceText] = await Promise.all([
+        fs.readFile(path.join(fixtureRoot, entry.htmlPath)),
+        fs.readFile(path.join(fixtureRoot, entry.provenancePath), 'utf8'),
+      ])
+      const html = htmlBytes.toString('utf8')
+      const provenance = JSON.parse(provenanceText)
+      counts[entry.provider] += 1
+      routeClasses[entry.provider].add(entry.routeClass)
+
+      assert.equal(provenance.source, 'authenticated-user-visible-chrome-session')
+      assert.equal(provenance.artifactKind, 'redacted-reduced-dom')
+      assert.equal(provenance.containsProviderJavaScript, false)
+      assert.equal(provenance.containsSyntheticBehavior, false)
+      if (provenance.operationPhase !== undefined) {
+        assert.equal(provenance.operationPhase, entry.operationPhase)
+        assert.equal(provenance.capabilityOutcome, entry.capabilityOutcome)
+      }
+      assert.equal(sha256(htmlBytes), provenance.contentSha256)
+      assertPrivacyBoundary(html)
+      assertPrivacyBoundary(provenanceText)
+      assert.doesNotMatch(html, /<script\b|<style\b/i)
+
+      await page.setContent(html)
+      for (const evidence of provenance.evidenceSelectors) {
+        assert.equal(
+          await page.locator(evidence.selector).count(),
+          evidence.expectedCount,
+          `${entry.provider}/${entry.scenario} ${evidence.capability}: ${evidence.selector}`
+        )
+      }
+      for (const expectedAbsence of provenance.absenceSelectors) {
+        assert.equal(
+          await page.locator(expectedAbsence.selector).count(),
+          expectedAbsence.expectedCount,
+          `${entry.provider}/${entry.scenario} ${expectedAbsence.purpose}: ${expectedAbsence.selector}`
+        )
+      }
+      await assertSanitizedLinks(page, `${entry.provider}/${entry.scenario}`)
+    }
+  } finally {
+    await browser.close()
+  }
+
+  for (const [provider, minimum] of Object.entries(deepWorkflowMinimums)) {
+    assert.equal(counts[provider] >= minimum, true, `${provider} deep fixture count`)
+    assert.equal(routeClasses[provider].size >= 4, true, `${provider} distinct route classes`)
+  }
+})
+
+test('current Grok Free fixture preserves the visible model entitlement boundary', async () => {
+  const accountRoot = path.join(fixtureRoot, 'grok', 'signed-in-free')
+  const [htmlBytes, provenanceText] = await Promise.all([
+    fs.readFile(path.join(accountRoot, 'model-menu-open.html')),
+    fs.readFile(path.join(accountRoot, 'model-menu-open.provenance.json'), 'utf8'),
+  ])
+  const html = htmlBytes.toString('utf8')
+  const provenance = JSON.parse(provenanceText)
+
+  assert.equal(provenance.observedOn, '2026-07-25')
+  assert.equal(provenance.sanitizedUrl, 'https://grok.com/')
+  assert.deepEqual(provenance.observedPlan, { status: 'observed', label: 'Free' })
+  assert.equal(sha256(htmlBytes), provenance.contentSha256)
+  assertPrivacyBoundary(html)
+  assertPrivacyBoundary(provenanceText)
+
+  const browser = await chromium.launch({ headless: true })
+  const page = await browser.newPage()
+  try {
+    await page.setContent(html)
+    assert.equal(
+      await page.locator('[role="menuitem"][data-radix-collection-item].text-secondary.opacity-75 span.font-semibold').count(),
+      3
+    )
+    assert.deepEqual(
+      await page.locator('[role="menuitem"][data-radix-collection-item].text-secondary.opacity-75 span.font-semibold').allTextContents(),
+      ['Auto', 'Expert', 'Heavy']
+    )
+    assert.equal(
+      await page.locator('[role="menuitem"][data-radix-collection-item][disabled], [role="menuitem"][data-radix-collection-item][aria-disabled="true"], [role="menuitem"][data-radix-collection-item][data-disabled]').count(),
+      0
+    )
+    assert.equal(await page.getByRole('button', { name: 'Upgrade' }).count(), 1)
+  } finally {
+    await browser.close()
   }
 })
 
@@ -206,7 +489,7 @@ test('provider-specific selection semantics and plan uncertainty remain explicit
   const claudeRoot = path.join(fixtureRoot, 'claude', 'signed-in-free')
   const chatgptRoot = path.join(fixtureRoot, 'chatgpt', 'signed-in-paid')
 
-  const [geminiHtml, grokModelHtml, grokEffort, claudeModel, chatgptEffort] = await Promise.all([
+  const [geminiHtml, grokModelHtml, grokEffort, claudeModelHtml, chatgptEffortHtml] = await Promise.all([
     fs.readFile(path.join(geminiRoot, 'model-menu-open.html'), 'utf8'),
     fs.readFile(path.join(grokRoot, 'model-menu-open.html'), 'utf8'),
     readProvenance(grokRoot, 'thinking-effort-menu-open'),
@@ -214,14 +497,39 @@ test('provider-specific selection semantics and plan uncertainty remain explicit
     fs.readFile(path.join(chatgptRoot, 'thinking-effort-menu-open.html'), 'utf8'),
   ])
 
-  assert.match(geminiHtml, /data-active="true"[\s\S]*?<gem-menu-item-content>/)
-  assert.match(geminiHtml, /data-mode-id="pro"[\s\S]*?<gem-menu-item-content class="selected">/)
-  assert.equal((grokModelHtml.match(/data-radix-collection-item aria-disabled="false"/g) ?? []).length, 4)
-  assert.equal((grokModelHtml.match(/class="font-semibold"/g) ?? []).length, 4)
-  assert.match(grokModelHtml, /role="menuitem"><button type="button">Upgrade<\/button>/)
+  const browser = await chromium.launch({ headless: true })
+  const page = await browser.newPage()
+  try {
+    await page.setContent(geminiHtml)
+    assert.equal(
+      await page.locator('gem-menu-item[data-active="true"] gem-menu-item-content').innerText(),
+      '3.1 Flash-Lite'
+    )
+    assert.equal(
+      await page.locator('gem-menu-item[data-mode-id="pro"] gem-menu-item-content.selected').innerText(),
+      '3.1 ProSelected'
+    )
+
+    await page.setContent(grokModelHtml)
+    assert.deepEqual(
+      await page.locator('[role="menuitem"][data-radix-collection-item][aria-disabled="false"] .font-semibold').allTextContents(),
+      ['Fast', 'Auto', 'Expert', 'Heavy']
+    )
+    assert.equal(await page.getByRole('button', { name: 'Upgrade' }).count(), 1)
+
+    await page.setContent(claudeModelHtml)
+    assert.equal(
+      await page.getByRole('menuitemradio').filter({ hasText: 'Fable 5' }).filter({ hasText: 'Upgrade' }).count(),
+      1
+    )
+
+    await page.setContent(chatgptEffortHtml)
+    assert.equal(await page.getByRole('menuitemradio').count(), 3)
+  } finally {
+    await browser.close()
+  }
+
   assert.equal(grokEffort.effortMode, 'coupled-to-model')
-  assert.match(claudeModel, /Fable 5[\s\S]*?Upgrade/)
-  assert.equal((chatgptEffort.match(/role="menuitemradio"/g) ?? []).length, 3)
 
   const geminiSession = await readProvenance(geminiRoot, 'session-status')
   const grokSession = await readProvenance(grokRoot, 'session-status')
diff --git a/test/provider-dom-blockers.test.mjs b/test/provider-dom-blockers.test.mjs
new file mode 100644
index 0000000..53821ca
--- /dev/null
+++ b/test/provider-dom-blockers.test.mjs
@@ -0,0 +1,89 @@
+import assert from 'node:assert/strict'
+import { createHash } from 'node:crypto'
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import test from 'node:test'
+import { fileURLToPath } from 'node:url'
+import { chromium } from 'playwright'
+
+import {
+  VISIBLE_ACTIONS,
+  createVisibleActionRequest,
+  getProviderInstanceById,
+} from '../packages/cli/dist/src/playwright/index.js'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const fixturePath = path.join(
+  root,
+  'test/fixtures/provider-dom/claude/signed-out-challenge/cloudflare-security-verification.html',
+)
+const provenancePath = fixturePath.replace(/\.html$/u, '.provenance.json')
+
+test('Claude blocker check recognizes the captured Cloudflare security-verification interstitial', {
+  timeout: 30000,
+}, async () => {
+  const browser = await chromium.launch({ headless: true })
+  const context = await browser.newContext({ viewport: { width: 1100, height: 850 } })
+  const page = await context.newPage()
+  try {
+    const [fixtureBytes, provenanceText] = await Promise.all([
+      fs.readFile(fixturePath),
+      fs.readFile(provenancePath, 'utf8'),
+    ])
+    const fixture = fixtureBytes.toString('utf8')
+    const provenance = JSON.parse(provenanceText)
+    assert.equal(provenance.schema, 'tokenless.provider-dom-provenance.v1')
+    assert.equal(provenance.provider, 'claude')
+    assert.equal(provenance.accountState, 'signed-out-challenge')
+    assert.equal(provenance.scenario, 'cloudflare-security-verification')
+    assert.equal(provenance.source, 'development-visible-provider-session-cdp-observer')
+    assert.equal(provenance.containsProviderJavaScript, false)
+    assert.equal(provenance.containsSyntheticBehavior, false)
+    assert.equal(
+      createHash('sha256').update(fixtureBytes).digest('hex'),
+      provenance.contentSha256,
+    )
+    assert.doesNotMatch(fixture, /<script\b|<style\b|a237828eab33ed76/iu)
+
+    await page.route('https://claude.ai/**', (route) => route.fulfill({
+      status: 200,
+      contentType: 'text/html',
+      body: fixture,
+    }))
+    await page.goto('https://claude.ai/new', { waitUntil: 'domcontentloaded' })
+
+    const provider = getProviderInstanceById('claude')
+    assert.ok(provider, 'Claude provider instance is required')
+    const response = await provider.executeAction(
+      page,
+      createVisibleActionRequest({
+        requestId: 'claude-cloudflare-blocker-fixture',
+        provider: 'claude',
+        action: VISIBLE_ACTIONS.BLOCKER_CHECK,
+        payload: {},
+      }),
+      {
+        profileId: 'claude-cloudflare-fixture-profile',
+        operationId: 'claude-cloudflare-blocker-check',
+      },
+    )
+
+    assert.equal(response.ok, true, JSON.stringify(response, null, 2))
+    assert.equal(response.result.blocked, true)
+    assert.deepEqual(response.result.reasons, ['visible_cloudflare_interstitial'])
+    assert.deepEqual(response.result.blockers, [{
+      kind: 'challenge',
+      code: 'visible_cloudflare_interstitial',
+      message: 'Visible Cloudflare interstitial is blocking the provider page.',
+      userResolvable: true,
+      retryable: true,
+      visibleProof: 'visible-cloudflare-interstitial-text',
+      provider: 'claude',
+      url: 'https://claude.ai',
+      family: 'cloudflare',
+    }])
+  } finally {
+    await context.close()
+    await browser.close()
+  }
+})
diff --git a/test/provider-dom-prompt-actions.test.mjs b/test/provider-dom-prompt-actions.test.mjs
new file mode 100644
index 0000000..5b98ecd
--- /dev/null
+++ b/test/provider-dom-prompt-actions.test.mjs
@@ -0,0 +1,230 @@
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import path from 'node:path'
+import test from 'node:test'
+import { fileURLToPath } from 'node:url'
+import { chromium } from 'playwright'
+
+import {
+  VISIBLE_ACTIONS,
+  createVisibleActionRequest,
+  getProviderInstanceById,
+} from '../packages/cli/dist/src/playwright/index.js'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const fixtureRoot = path.join(root, 'test/fixtures/provider-dom')
+const providers = [
+  {
+    id: 'chatgpt',
+    state: 'signed-in-paid',
+    url: 'https://chatgpt.com/',
+    composerSelectors: [
+      'div#prompt-textarea[contenteditable="true"]',
+      'textarea[name="prompt-textarea"]',
+    ],
+  },
+  {
+    id: 'claude',
+    state: 'signed-in-free',
+    url: 'https://claude.ai/new',
+    composerSelectors: [
+      'div[data-testid="chat-input"][contenteditable="true"][role="textbox"]',
+    ],
+  },
+  {
+    id: 'gemini',
+    state: 'signed-in-unknown',
+    url: 'https://gemini.google.com/app',
+    composerSelectors: [
+      'rich-textarea div.ql-editor[contenteditable="true"][role="textbox"]',
+    ],
+  },
+  {
+    id: 'grok',
+    state: 'signed-in-unknown',
+    url: 'https://grok.com/',
+    composerSelectors: [
+      'div.tiptap.ProseMirror[contenteditable="true"][role="textbox"][aria-label="Ask Grok anything"]',
+    ],
+  },
+  {
+    id: 'qwen',
+    state: 'signed-out-guest',
+    scenario: 'studio-response-complete',
+    url: 'https://chat.qwen.ai/',
+    composerSelectors: [
+      'textarea.message-input-textarea',
+    ],
+  },
+]
+
+test('real Chromium inputs and clears drafts on provenance-bound provider DOM captures', {
+  timeout: 60000,
+}, async (t) => {
+  const browser = await chromium.launch({ headless: true })
+  t.after(() => browser.close())
+
+  for (const provider of providers) {
+    await t.test(provider.id, async () => {
+      const context = await browser.newContext({ viewport: { width: 1100, height: 850 } })
+      const page = await context.newPage()
+      try {
+        await openCapturedFixture(page, provider, provider.scenario)
+        const providerInstance = getProviderInstanceById(provider.id)
+        assert.ok(providerInstance, `provider instance missing: ${provider.id}`)
+        const prompt = `Tokenless deterministic prompt draft for ${provider.id}`
+        const adapterContext = {
+          profileId: `${provider.id}-fixture-profile`,
+          operationId: `${provider.id}-prompt-actions`,
+        }
+
+        const input = await providerInstance.executeAction(
+          page,
+          visibleRequest(provider.id, VISIBLE_ACTIONS.PROMPT_INPUT, { text: prompt }),
+          adapterContext,
+        )
+        assert.equal(input.ok, true, JSON.stringify(input, null, 2))
+        assert.deepEqual(input.result, {
+          visible: true,
+          inputProof: 'prompt-text-visible',
+        })
+        assert.equal(await visibleComposerText(page, provider.composerSelectors), prompt)
+
+        const clear = await providerInstance.executeAction(
+          page,
+          visibleRequest(provider.id, VISIBLE_ACTIONS.PROMPT_CLEAR),
+          adapterContext,
+        )
+        assert.equal(clear.ok, true, JSON.stringify(clear, null, 2))
+        assert.deepEqual(clear.result, {
+          visible: true,
+          inputProof: 'empty',
+        })
+        assert.equal(await visibleComposerText(page, provider.composerSelectors), '')
+      } finally {
+        await context.close()
+      }
+    })
+  }
+})
+
+test('prompt input reports a visibility timeout when the captured provider page has no composer', {
+  timeout: 30000,
+}, async () => {
+  const browser = await chromium.launch({ headless: true })
+  const context = await browser.newContext({ viewport: { width: 1100, height: 850 } })
+  const page = await context.newPage()
+  try {
+    const provider = providers[0]
+    assert.ok(provider)
+    await openCapturedFixture(page, provider, 'settings-general')
+
+    const startedAt = Date.now()
+    const providerInstance = getProviderInstanceById(provider.id)
+    assert.ok(providerInstance, `provider instance missing: ${provider.id}`)
+    const input = await providerInstance.executeAction(
+      page,
+      visibleRequest(provider.id, VISIBLE_ACTIONS.PROMPT_INPUT, { text: 'Tokenless timeout probe' }),
+      {
+        profileId: `${provider.id}-fixture-profile`,
+        operationId: `${provider.id}-prompt-input-timeout`,
+      },
+    )
+    const elapsedMs = Date.now() - startedAt
+
+    assert.equal(input.ok, false)
+    assert.deepEqual(input.error, {
+      code: 'prompt_input_visibility_timeout',
+      message: 'Timed out after 15000ms waiting for a visible prompt input.',
+      retryable: true,
+    })
+    assert.ok(elapsedMs >= 14000, `prompt input returned before the visibility timeout: ${elapsedMs}ms`)
+    assert.ok(elapsedMs < 20000, `prompt input exceeded the bounded visibility timeout: ${elapsedMs}ms`)
+  } finally {
+    await context.close()
+    await browser.close()
+  }
+})
+
+test('prompt submit reports an actionability timeout when the captured provider page has no enabled submit control', {
+  timeout: 30000,
+}, async () => {
+  const browser = await chromium.launch({ headless: true })
+  const context = await browser.newContext({ viewport: { width: 1100, height: 850 } })
+  const page = await context.newPage()
+  try {
+    const provider = providers[0]
+    assert.ok(provider)
+    await openCapturedFixture(page, provider, 'settings-general')
+
+    const startedAt = Date.now()
+    const providerInstance = getProviderInstanceById(provider.id)
+    assert.ok(providerInstance, `provider instance missing: ${provider.id}`)
+    const submit = await providerInstance.executeAction(
+      page,
+      visibleRequest(provider.id, VISIBLE_ACTIONS.PROMPT_SUBMIT),
+      {
+        profileId: `${provider.id}-fixture-profile`,
+        operationId: `${provider.id}-prompt-submit-timeout`,
+      },
+    )
+    const elapsedMs = Date.now() - startedAt
+
+    assert.equal(submit.ok, false)
+    assert.deepEqual(submit.error, {
+      code: 'prompt_submit_actionability_timeout',
+      message: 'Timed out after 15000ms waiting for an enabled visible prompt submit control.',
+      retryable: true,
+    })
+    assert.ok(elapsedMs >= 14000, `prompt submit returned before the actionability timeout: ${elapsedMs}ms`)
+    assert.ok(elapsedMs < 20000, `prompt submit exceeded the bounded actionability timeout: ${elapsedMs}ms`)
+  } finally {
+    await context.close()
+    await browser.close()
+  }
+})
+
+async function openCapturedFixture(page, provider, scenario = 'composer-idle') {
+  const origin = new URL(provider.url).origin
+  await page.route(`${origin}/**`, (route) => route.fulfill({
+    status: 200,
+    contentType: 'text/html',
+    body: capturedFixture(provider, scenario),
+  }))
+  await page.goto(provider.url, { waitUntil: 'domcontentloaded' })
+}
+
+function capturedFixture(provider, scenario) {
+  const filename = path.join(fixtureRoot, provider.id, provider.state, `${scenario}.html`)
+  const match = fs.readFileSync(filename, 'utf8').match(/<body[^>]*>([\s\S]*?)<\/body>/iu)
+  assert.ok(match, `fixture body missing: ${filename}`)
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"></head><body>${match[1]}</body></html>`
+}
+
+function visibleRequest(provider, action, payload = {}) {
+  return createVisibleActionRequest({
+    requestId: `${provider}-${action.replaceAll('.', '-')}`,
+    provider,
+    action,
+    payload,
+  })
+}
+
+async function visibleComposerText(page, selectors) {
+  for (const selector of selectors) {
+    const locator = page.locator(selector).first()
+    try {
+      if (await locator.isVisible({ timeout: 250 })) {
+        return await locator.evaluate((element) => {
+          if (element instanceof HTMLTextAreaElement || element instanceof HTMLInputElement) {
+            return element.value
+          }
+          return (element.textContent ?? '').replace(/\u00a0/g, ' ').trim()
+        })
+      }
+    } catch {
+      // Try the next configured composer selector.
+    }
+  }
+  throw new Error('No visible composer was found.')
+}
diff --git a/test/provider-rate-limit-algorithm.test.mjs b/test/provider-rate-limit-algorithm.test.mjs
new file mode 100644
index 0000000..f306fe0
--- /dev/null
+++ b/test/provider-rate-limit-algorithm.test.mjs
@@ -0,0 +1,329 @@
+import assert from 'node:assert/strict'
+import { spawn, spawnSync } from 'node:child_process'
+import { randomBytes, randomUUID } from 'node:crypto'
+import fs from 'node:fs'
+import net from 'node:net'
+import os from 'node:os'
+import path from 'node:path'
+import { DatabaseSync } from 'node:sqlite'
+import test from 'node:test'
+import { fileURLToPath } from 'node:url'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const cliEntry = path.join(root, 'packages/cli/dist/src/tokenless.mjs')
+const daemonEntry = path.join(root, 'packages/cli/dist/src/daemon/daemon-entry.mjs')
+const children = new Set()
+
+test.after(async () => {
+  await Promise.all([...children].map((child) => terminateChild(child)))
+})
+
+test('provider rate-limit policy projects subscription-aware cadence from durable SQLite history', {
+  timeout: 60_000,
+}, async () => {
+  assert.equal(fs.existsSync(cliEntry), true, 'build the CLI before running the rate-limit simulation')
+  assert.equal(fs.existsSync(daemonEntry), true, 'build the daemon before running the rate-limit simulation')
+  const homeDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-rate-limit-')))
+  const profile = createReadyManagedProfile(homeDir)
+  const daemon = await startDaemon(homeDir)
+  let database
+  try {
+    const token = fs.readFileSync(path.join(homeDir, 'daemon.token'), 'utf8').trim()
+    await daemonRequest(daemon.url, token, 'POST', '/control/browser-runtime/quiesce')
+    database = new DatabaseSync(path.join(homeDir, 'tokenless.sqlite3'))
+    database.exec('PRAGMA busy_timeout = 5000;')
+
+    const burstBase = Date.now() - 5_000
+    replacePromptHistory(database, profile.id, Array.from({ length: 7 }, () => burstBase))
+    const withinBurst = await capacity(daemon.url, token, profile.id, 'chatgpt', 'signed_in_paid', 'Plus')
+    assert.equal(withinBurst.subscription.planId, 'plus')
+    assert.equal(withinBurst.subscription.match, 'label')
+    assert.equal(withinBurst.decision, 'admit')
+    assert.equal(rule(withinBurst, 'chatgpt.gpt-5.5.go-plus.messages').usedUnits, 7)
+    assert.equal(rule(withinBurst, 'chatgpt.gpt-5.5.go-plus.messages').burstUnits, 8)
+
+    const subscriptionAlias = await capacity(
+      daemon.url,
+      token,
+      profile.id,
+      'chatgpt',
+      'signed_in_paid',
+      'Paid',
+      'ChatGPT Plus',
+    )
+    assert.equal(subscriptionAlias.subscription.planId, 'plus')
+    assert.equal(subscriptionAlias.subscription.observedLabel, 'ChatGPT Plus')
+
+    replacePromptHistory(database, profile.id, Array.from({ length: 8 }, () => burstBase))
+    const burstExceeded = await capacity(daemon.url, token, profile.id, 'chatgpt', 'signed_in_paid', 'Plus')
+    assert.equal(burstExceeded.decision, 'defer')
+    assert.ok(Date.parse(burstExceeded.eligibleAt) > Date.now())
+
+    const cadenceBase = Date.now()
+    replacePromptHistory(database, profile.id, Array.from(
+      { length: 143 },
+      (_value, index) => cadenceBase - (143 - index) * 75_000,
+    ))
+    const belowWindow = await capacity(daemon.url, token, profile.id, 'chatgpt', 'signed_in_paid', 'Plus')
+    const belowWindowRule = rule(belowWindow, 'chatgpt.gpt-5.5.go-plus.messages')
+    assert.equal(belowWindow.decision, 'admit')
+    assert.equal(belowWindowRule.publishedAllowance, 160)
+    assert.equal(belowWindowRule.effectiveAllowance, 144)
+    assert.equal(belowWindowRule.usedUnits, 143)
+    assert.equal(belowWindowRule.remainingUnits, 1)
+
+    const fullWindowBase = Date.now()
+    replacePromptHistory(database, profile.id, Array.from(
+      { length: 144 },
+      (_value, index) => fullWindowBase - (143 - index) * 74_000 - 10_000,
+    ))
+    const fullWindow = await capacity(daemon.url, token, profile.id, 'chatgpt', 'signed_in_paid', 'Plus')
+    const fullWindowRule = rule(fullWindow, 'chatgpt.gpt-5.5.go-plus.messages')
+    assert.equal(fullWindow.decision, 'defer')
+    assert.equal(fullWindowRule.usedUnits, 144)
+    assert.equal(fullWindowRule.remainingUnits, 0)
+    assert.ok(Date.parse(fullWindow.eligibleAt) > Date.now())
+
+    replacePromptHistory(database, profile.id, Array.from(
+      { length: 144 },
+      (_value, index) => fullWindowBase - (143 - index) * 74_000 - 10_000,
+    ), 'GPT-5.5 Thinking')
+    const separateModelPool = await capacity(daemon.url, token, profile.id, 'chatgpt', 'signed_in_paid', 'Plus')
+    assert.equal(separateModelPool.decision, 'admit')
+    assert.equal(rule(separateModelPool, 'chatgpt.gpt-5.5.go-plus.messages').usedUnits, 0)
+
+    replacePromptHistory(database, profile.id, Array.from(
+      { length: 144 },
+      (_value, index) => fullWindowBase - (143 - index) * 74_000 - 10_000,
+    ))
+
+    const dynamicFree = await capacity(daemon.url, token, profile.id, 'chatgpt', 'signed_in_free', 'Free')
+    assert.equal(dynamicFree.subscription.planId, 'free')
+    assert.equal(dynamicFree.decision, 'unknown')
+    assert.equal(rule(dynamicFree, 'chatgpt.gpt-5.5.free.messages').knowledge, 'non_numeric')
+
+    const guardrailedPro = await capacity(daemon.url, token, profile.id, 'chatgpt', 'signed_in_paid', 'Pro')
+    assert.equal(guardrailedPro.subscription.planId, 'pro')
+    assert.equal(guardrailedPro.decision, 'unknown')
+
+    const relativeClaude = await capacity(daemon.url, token, profile.id, 'claude', 'signed_in_paid', 'Pro')
+    assert.equal(relativeClaude.subscription.planId, 'pro')
+    assert.equal(relativeClaude.decision, 'unknown')
+    assert.equal(rule(relativeClaude, 'claude.pro.session').knowledge, 'non_numeric')
+
+    for (const scenario of [
+      ['gemini', 'signed_in_free', 'Standard', 'no_google_ai_plan'],
+      ['grok', 'signed_in_free', 'Free', 'free'],
+      ['qwen', 'guest', null, 'guest'],
+      ['deepseek', 'signed_in_unknown', null, 'unknown'],
+      ['perplexity', 'signed_in_free', 'Standard', 'standard'],
+    ]) {
+      const [provider, accessClass, tierLabel, planId] = scenario
+      const projection = await capacity(daemon.url, token, profile.id, provider, accessClass, tierLabel)
+      assert.equal(projection.subscription.planId, planId)
+      assert.equal(projection.decision, 'unknown')
+    }
+
+    const cli = spawnSync(process.execPath, [
+      cliEntry,
+      'limits',
+      'inspect',
+      '--home',
+      homeDir,
+      '--daemon-url',
+      daemon.url,
+      '--profile',
+      'default',
+      '--provider',
+      'chatgpt',
+      '--json',
+    ], {
+      cwd: root,
+      env: { ...process.env, TOKENLESS_HOME: homeDir },
+      encoding: 'utf8',
+      timeout: 20_000,
+    })
+    assert.equal(cli.status, 0, cli.stderr || cli.stdout)
+    const cliPayload = JSON.parse(cli.stdout)
+    assert.equal(cliPayload.ok, true)
+    assert.equal(cliPayload.capacity.subscription.planId, 'plus')
+    assert.equal(cliPayload.capacity.decision, 'defer')
+  } finally {
+    database?.close()
+    await shutdownDaemon(daemon).catch(() => undefined)
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+function createReadyManagedProfile(homeDir) {
+  const browserDir = path.join(homeDir, 'browser')
+  const profileId = randomUUID()
+  const profileDir = path.join(browserDir, 'profiles', profileId)
+  fs.mkdirSync(profileDir, { recursive: true, mode: 0o700 })
+  const now = new Date().toISOString()
+  fs.writeFileSync(path.join(browserDir, 'profiles.json'), `${JSON.stringify({
+    version: 1,
+    defaultProfile: 'default',
+    profiles: {
+      default: {
+        slug: 'default',
+        id: profileId,
+        label: 'Default',
+        labelOrigin: 'slug',
+        directory: profileDir,
+        lifecycle: 'ready',
+        createdAt: now,
+        updatedAt: now,
+        lastObservedAuth: {
+          chatgpt: {
+            provider: 'chatgpt',
+            auth: 'authenticated',
+            access: 'signed_in_paid',
+            checkedAt: now,
+            account: {
+              name: null,
+              subscription: 'ChatGPT Plus',
+              tier: { class: 'signed_in_paid', label: 'Plus' },
+            },
+          },
+        },
+      },
+    },
+  }, null, 2)}\n`, { mode: 0o600 })
+  return { id: profileId }
+}
+
+function replacePromptHistory(database, profileId, timestamps, modelLabel = null) {
+  database.exec('BEGIN IMMEDIATE; DELETE FROM jobs;')
+  try {
+    const insert = database.prepare(`INSERT INTO jobs (
+      job_id, claim_token, execution_backend, profile_id, provider, action, status,
+      request_json, provider_attempts_json, provider_submitted_at, created_at, updated_at
+    ) VALUES (?, ?, 'playwright', ?, 'chatgpt', 'visible_provider_actions', 'succeeded', ?, '[]', ?, ?, ?)`)
+    for (const timestamp of timestamps) {
+      const submittedAt = new Date(timestamp).toISOString()
+      insert.run(
+        randomUUID(),
+        randomBytes(32).toString('base64url'),
+        profileId,
+        JSON.stringify({
+          provider: 'chatgpt',
+          actions: [
+            ...(modelLabel ? [{ action: 'model.select', payload: { label: modelLabel } }] : []),
+            { action: 'prompt.submit', payload: {} },
+          ],
+        }),
+        submittedAt,
+        submittedAt,
+        submittedAt,
+      )
+    }
+    database.exec('COMMIT')
+  } catch (error) {
+    database.exec('ROLLBACK')
+    throw error
+  }
+}
+
+async function capacity(url, token, profileId, provider, accessClass, tierLabel, subscriptionLabel = null) {
+  const query = new URLSearchParams({
+    provider,
+    profile_id: profileId,
+    access_class: accessClass,
+  })
+  if (tierLabel) query.set('tier_label', tierLabel)
+  if (subscriptionLabel) query.set('subscription_label', subscriptionLabel)
+  return daemonRequest(url, token, 'GET', `/provider-capacity?${query}`)
+}
+
+function rule(projection, ruleId) {
+  const result = projection.rules.find((candidate) => candidate.ruleId === ruleId)
+  assert.ok(result, `missing projected rule ${ruleId}`)
+  return result
+}
+
+async function startDaemon(homeDir) {
+  const port = await freePort()
+  const child = spawn(process.execPath, [
+    daemonEntry,
+    '--home',
+    homeDir,
+    'serve',
+    '--host',
+    '127.0.0.1',
+    '--port',
+    String(port),
+  ], {
+    cwd: root,
+    env: { ...process.env, TOKENLESS_HOME: homeDir },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  })
+  children.add(child)
+  let stderr = ''
+  child.stderr.on('data', (chunk) => { stderr += chunk.toString('utf8') })
+  const url = `http://127.0.0.1:${port}`
+  const deadline = Date.now() + 10_000
+  while (Date.now() < deadline) {
+    if (child.exitCode !== null) throw new Error(`daemon exited before ready: ${stderr}`)
+    try {
+      const response = await fetch(`${url}/ready?challenge=${randomBytes(32).toString('base64url')}`)
+      if (response.ok && (await response.json()).ready === true) return { child, url, homeDir }
+    } catch {
+      // Retry until the bounded startup deadline.
+    }
+    await new Promise((resolve) => setTimeout(resolve, 50))
+  }
+  throw new Error(`daemon did not become ready: ${stderr}`)
+}
+
+async function shutdownDaemon(daemon) {
+  if (daemon.child.exitCode !== null) return
+  const token = fs.readFileSync(path.join(daemon.homeDir, 'daemon.token'), 'utf8').trim()
+  await daemonRequest(daemon.url, token, 'POST', '/control/shutdown')
+  await waitForExit(daemon.child, 5_000)
+  children.delete(daemon.child)
+}
+
+async function daemonRequest(url, token, method, requestPath, body) {
+  const response = await fetch(`${url}${requestPath}`, {
+    method,
+    headers: {
+      accept: 'application/json',
+      authorization: `Bearer ${token}`,
+      'content-type': 'application/json',
+    },
+    ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+  })
+  const text = await response.text()
+  assert.equal(response.ok, true, `${method} ${requestPath} returned ${response.status}: ${text}`)
+  return text ? JSON.parse(text) : null
+}
+
+async function freePort() {
+  return await new Promise((resolve, reject) => {
+    const server = net.createServer()
+    server.once('error', reject)
+    server.listen(0, '127.0.0.1', () => {
+      const address = server.address()
+      const port = typeof address === 'object' && address ? address.port : 0
+      server.close((error) => error ? reject(error) : resolve(port))
+    })
+  })
+}
+
+async function terminateChild(child) {
+  if (child.exitCode !== null) return
+  child.kill('SIGTERM')
+  await waitForExit(child, 2_000).catch(() => child.kill('SIGKILL'))
+}
+
+async function waitForExit(child, timeoutMs) {
+  if (child.exitCode !== null) return
+  await new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => reject(new Error('child process did not exit')), timeoutMs)
+    child.once('exit', () => {
+      clearTimeout(timeout)
+      resolve()
+    })
+  })
+}
diff --git a/test/release-contract.test.mjs b/test/release-contract.test.mjs
deleted file mode 100644
index 56494fd..0000000
--- a/test/release-contract.test.mjs
+++ /dev/null
@@ -1,203 +0,0 @@
-import assert from 'node:assert/strict'
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import { spawnSync } from 'node:child_process'
-import test from 'node:test'
-import { fileURLToPath } from 'node:url'
-import { updateCargoPackageVersion, updatePackageLock } from '../scripts/release/version.mjs'
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-const repositoryUrl = 'git+https://github.com/jazelly/tokenless.git'
-const nativePackages = [
-  'tokenless-native-darwin-arm64',
-  'tokenless-native-darwin-x64',
-  'tokenless-native-linux-arm64',
-  'tokenless-native-linux-x64',
-  'tokenless-native-win32-arm64',
-  'tokenless-native-win32-x64',
-]
-
-test('Changesets release configuration tracks only the public CLI', () => {
-  const config = readJson('.changeset/config.json')
-  const rootPackage = readJson('package.json')
-  assert.equal(config.access, 'public')
-  assert.equal(config.baseBranch, 'main')
-  assert.deepEqual(config.ignore, [])
-  assert.ok(rootPackage.devDependencies['@changesets/cli'])
-  assert.equal(rootPackage.scripts.changeset, 'changeset')
-  assert.equal(rootPackage.scripts['release:version'], 'node scripts/release/version.mjs')
-})
-
-test('npm manifests use the canonical repository and MIT license', () => {
-  const rootPackage = readJson('package.json')
-  const cliPackage = readJson('packages/cli/package.json')
-  const legacyExtensionPackage = readJson('legacy/extension/package.json')
-  assert.equal(rootPackage.license, 'MIT')
-  assert.equal(cliPackage.repository.url, repositoryUrl)
-  assert.equal(cliPackage.publishConfig.access, 'public')
-  assert.equal(cliPackage.license, 'MIT')
-  assert.equal(legacyExtensionPackage.license, 'MIT')
-  assert.equal(fs.existsSync(path.join(root, 'packages/extension')), false)
-  assert.deepEqual(Object.keys(cliPackage.optionalDependencies).sort(), nativePackages)
-
-  for (const packageName of nativePackages) {
-    const manifest = readJson(`packages/cli/npm/${packageName}/package.json`)
-    assert.equal(manifest.repository.url, repositoryUrl)
-    assert.equal(manifest.publishConfig.access, 'public')
-    assert.equal(manifest.license, 'MIT')
-  }
-})
-
-test('npm publishing is marker-gated, platform-complete, and cleans up in a second commit', () => {
-  const prepare = readText('.github/workflows/prepare-npm-release.yml')
-  const publish = readText('.github/workflows/publish-npm.yml')
-  assert.match(prepare, /uses: changesets\/action@v1/)
-  assert.match(prepare, /version: npm run release:version/)
-  assert.match(prepare, /npm install --ignore-scripts/)
-  assert.match(prepare, /\.changeset\/publish-pending\.json/)
-  assert.match(prepare, /if: steps\.release-state\.outputs\.pending != 'true'/)
-  assert.doesNotMatch(`${prepare}\n${publish}`, /npm ci/)
-  assert.match(publish, /id-token: write/)
-  assert.match(publish, /pull-requests: write/)
-  assert.doesNotMatch(publish, /NPM_TOKEN|_authToken|Configure npm token fallback/)
-  assert.match(publish, /\.changeset\/publish-pending\.json/)
-  assert.match(publish, /needs: \[prepare, publish-native\]/)
-  assert.match(publish, /rm package-lock\.json/)
-  assert.match(publish, /npm install --package-lock-only --ignore-scripts/)
-  assert.match(publish, /git rm \.changeset\/publish-pending\.json/)
-  assert.match(publish, /git add package-lock\.json/)
-  assert.match(publish, /gh pr create/)
-  assert.match(publish, /gh pr merge/)
-  assert.doesNotMatch(publish, /git push origin HEAD:main/)
-  for (const [platform, arch] of [
-    ['darwin', 'arm64'], ['darwin', 'x64'], ['linux', 'arm64'],
-    ['linux', 'x64'], ['win32', 'arm64'], ['win32', 'x64'],
-  ]) {
-    assert.match(publish, new RegExp(`platform: ${platform}[\\s\\S]*arch: ${arch}`))
-  }
-})
-
-test('npm publisher invokes Windows npm through a shell', () => {
-  const publisher = readText('scripts/release/publish-package.mjs')
-  assert.match(publisher, /shell: process\.platform === 'win32'/)
-  assert.match(publisher, /path\.resolve\(packageDirectoryArgument\)/)
-})
-
-test('publish verification reflects the tracked release marker state', () => {
-  const pending = path.join(root, '.changeset', 'publish-pending.json')
-  const result = spawnSync(process.execPath, ['scripts/release/verify-pending.mjs'], {
-    cwd: root,
-    encoding: 'utf8',
-  })
-  assert.equal(result.status, 0, result.stderr)
-  if (fs.existsSync(pending)) {
-    const marker = JSON.parse(fs.readFileSync(pending, 'utf8'))
-    assert.equal(result.stdout, `publish=true\nversion=${marker.version}\n`)
-  } else {
-    assert.equal(result.stdout, 'publish=false\n')
-  }
-})
-
-test('tracked Cargo manifests identify the same Tokenless daemon version', () => {
-  const cargoToml = readText('packages/daemon/Cargo.toml')
-  const cargoLock = readText('packages/daemon/Cargo.lock')
-  const manifestVersion = cargoToml.match(/\[package\]\nname = "tokenless-daemon"\nversion = "([^"]+)"/)?.[1]
-  const lockVersion = cargoLock.match(/\[\[package\]\]\nname = "tokenless-daemon"\nversion = "([^"]+)"/)?.[1]
-  assert.equal(lockVersion, manifestVersion)
-  assert.match(cargoLock, /\[\[package\]\]\nname = "ahash"\nversion = "0\.8\.12"/)
-})
-
-test('release versioning updates only tokenless-daemon in Cargo manifests', (t) => {
-  const fixture = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-release-cargo-'))
-  t.after(() => fs.rmSync(fixture, { recursive: true, force: true }))
-  const cargoToml = path.join(fixture, 'Cargo.toml')
-  const cargoLock = path.join(fixture, 'Cargo.lock')
-
-  fs.writeFileSync(cargoToml, `[package]
-name = "tokenless-daemon"
-version = "0.1.2"
-edition = "2021"
-
-[dependencies]
-tokenless-helper = "0.1.2"
-`)
-  fs.writeFileSync(cargoLock, `# This file is automatically @generated by Cargo.
-version = 4
-
-[[package]]
-name = "ahash"
-version = "0.8.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-
-[[package]]
-name = "tokenless-daemon"
-version = "0.1.2"
-dependencies = [
- "ahash",
-]
-
-[[package]]
-name = "tokenless-helper"
-version = "0.1.2"
-`)
-
-  updateCargoPackageVersion(cargoToml, '0.2.0')
-  updateCargoPackageVersion(cargoLock, '0.2.0')
-
-  const updatedToml = fs.readFileSync(cargoToml, 'utf8')
-  const updatedLock = fs.readFileSync(cargoLock, 'utf8')
-  assert.match(updatedToml, /\[package\]\nname = "tokenless-daemon"\nversion = "0\.2\.0"/)
-  assert.match(updatedToml, /\[dependencies\]\ntokenless-helper = "0\.1\.2"/)
-  assert.match(updatedLock, /^version = 4$/m)
-  assert.match(updatedLock, /name = "ahash"\nversion = "0\.8\.12"/)
-  assert.match(updatedLock, /name = "tokenless-daemon"\nversion = "0\.2\.0"/)
-  assert.match(updatedLock, /name = "tokenless-helper"\nversion = "0\.1\.2"/)
-})
-
-test('release versioning keeps package-lock native optional dependencies coherent', (t) => {
-  const fixture = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-release-lock-'))
-  t.after(() => fs.rmSync(fixture, { recursive: true, force: true }))
-  const lockPath = path.join(fixture, 'package-lock.json')
-  const optionalDependencies = Object.fromEntries(nativePackages.map((packageName) => [packageName, '0.2.0']))
-  const packages = {
-    'packages/cli': {
-      name: 'tokenless',
-      version: '0.1.2',
-      optionalDependencies: Object.fromEntries(nativePackages.map((packageName) => [packageName, '0.1.2'])),
-    },
-  }
-
-  for (const packageName of nativePackages) {
-    packages[`node_modules/${packageName}`] = {
-      version: '0.1.2',
-      resolved: `https://registry.npmjs.org/${packageName}/-/${packageName}-0.1.2.tgz`,
-      integrity: 'sha512-stale',
-      optional: true,
-    }
-  }
-
-  fs.writeFileSync(lockPath, `${JSON.stringify({ lockfileVersion: 3, packages }, null, 2)}\n`)
-
-  updatePackageLock(lockPath, { optionalDependencies }, '0.2.0')
-
-  const lock = JSON.parse(fs.readFileSync(lockPath, 'utf8'))
-  assert.equal(lock.packages['packages/cli'].version, '0.2.0')
-  assert.deepEqual(lock.packages['packages/cli'].optionalDependencies, optionalDependencies)
-  for (const packageName of nativePackages) {
-    const entry = lock.packages[`node_modules/${packageName}`]
-    assert.equal(entry.version, '0.2.0')
-    assert.equal(entry.optional, true)
-    assert.equal('resolved' in entry, false)
-    assert.equal('integrity' in entry, false)
-  }
-  assert.doesNotMatch(JSON.stringify(lock), /tokenless-native-[^"]+-0\.1\.2\.tgz/)
-})
-
-function readJson(relativePath) {
-  return JSON.parse(readText(relativePath))
-}
-
-function readText(relativePath) {
-  return fs.readFileSync(path.join(root, relativePath), 'utf8')
-}
diff --git a/test/run-gated-e2e.mjs b/test/run-gated-e2e.mjs
new file mode 100644
index 0000000..90e5247
--- /dev/null
+++ b/test/run-gated-e2e.mjs
@@ -0,0 +1,139 @@
+import { spawn } from 'node:child_process'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const [suite, ...suiteArguments] = process.argv.slice(2)
+const definition = resolveDefinition(suite, suiteArguments)
+let activeChild = null
+let interruptedSignal = null
+
+const interrupt = (signal) => {
+  interruptedSignal = signal
+  activeChild?.kill(signal)
+}
+const onSigint = () => interrupt('SIGINT')
+const onSigterm = () => interrupt('SIGTERM')
+process.once('SIGINT', onSigint)
+process.once('SIGTERM', onSigterm)
+
+try {
+  const child = spawn(process.execPath, [
+    '--test',
+    '--test-concurrency=1',
+    definition.testPath,
+  ], {
+    cwd: root,
+    env: {
+      ...process.env,
+      ...definition.environment,
+    },
+    stdio: 'inherit',
+  })
+  activeChild = child
+  const result = await new Promise((resolve, reject) => {
+    child.once('error', reject)
+    child.once('close', (code, signal) => resolve({ code, signal }))
+  })
+  activeChild = null
+  if (interruptedSignal) process.exitCode = interruptedSignal === 'SIGINT' ? 130 : 143
+  else if (result.signal) process.exitCode = 1
+  else process.exitCode = result.code ?? 1
+} finally {
+  process.removeListener('SIGINT', onSigint)
+  process.removeListener('SIGTERM', onSigterm)
+}
+
+function resolveDefinition(name, arguments_) {
+  if (name === 'browser-runtime') {
+    let expectedAuto = process.env.TOKENLESS_LIVE_BROWSER_RUNTIME_EXPECT_AUTO ?? 'system'
+    if (arguments_.length > 0) {
+      if (arguments_.length !== 2 || arguments_[0] !== '--expected-auto') {
+        failUsage('browser-runtime accepts only --expected-auto <system|managed-chromium>')
+      }
+      expectedAuto = arguments_[1]
+    }
+    if (expectedAuto !== 'system' && expectedAuto !== 'managed-chromium') {
+      failUsage('browser-runtime expected auto family must be system or managed-chromium')
+    }
+    return {
+      testPath: 'test/live-browser-runtime.e2e.mjs',
+      environment: {
+        TOKENLESS_LIVE_BROWSER_RUNTIME_GATE: '1',
+        TOKENLESS_LIVE_BROWSER_RUNTIME_EXPECT_AUTO: expectedAuto,
+      },
+    }
+  }
+
+  if (name === 'managed-playwright') {
+    if (arguments_.length !== 1) {
+      failUsage('managed-playwright requires exactly one gate argument')
+    }
+    const gate = arguments_[0]
+    const supportedGates = new Set(['all', 'non_submission', 'mutation', 'project'])
+    if (!gate || !supportedGates.has(gate)) {
+      failUsage(`managed-playwright requires one of: ${[...supportedGates].join(', ')}`)
+    }
+    return {
+      testPath: 'test/live-managed-playwright.e2e.mjs',
+      environment: { TOKENLESS_LIVE_E2E_GATE: gate },
+    }
+  }
+
+  if (name === 'provider-fallback') {
+    if (arguments_.length !== 0) failUsage('provider-fallback does not accept a gate argument')
+    return {
+      testPath: 'test/live-provider-fallback.e2e.mjs',
+      environment: { TOKENLESS_LIVE_FALLBACK_E2E_GATE: 'real-provider-fallback' },
+    }
+  }
+
+  if (name === 'web-ui-provider') {
+    const options = parseWebUiFixtureArguments(arguments_)
+    return {
+      testPath: 'test/live-web-ui-provider.e2e.mjs',
+      environment: {
+        TOKENLESS_LIVE_WEB_UI_GATE: 'representative-provider',
+        TOKENLESS_LIVE_WEB_UI_FIXTURE_FILE: options.fixtureFile,
+        TOKENLESS_LIVE_WEB_UI_FIXTURE: options.fixture,
+      },
+    }
+  }
+
+  failUsage('suite must be browser-runtime, managed-playwright, provider-fallback, or web-ui-provider')
+}
+
+function failUsage(message) {
+  console.error(message)
+  console.error('Usage: node test/run-gated-e2e.mjs browser-runtime [--expected-auto system|managed-chromium]')
+  console.error('   or: node test/run-gated-e2e.mjs managed-playwright <all|non_submission|mutation|project>')
+  console.error('   or: node test/run-gated-e2e.mjs provider-fallback')
+  console.error('   or: node test/run-gated-e2e.mjs web-ui-provider [--fixture <case-or-suite>] [--fixture-file <path>]')
+  process.exit(2)
+}
+
+function parseWebUiFixtureArguments(arguments_) {
+  let fixture = 'smoke'
+  let fixtureFile = path.join(root, 'test/fixtures/local/web-ui.json')
+  for (let index = 0; index < arguments_.length; index += 1) {
+    const argument = arguments_[index]
+    const value = arguments_[index + 1]
+    if (argument === '--fixture') {
+      if (!value || value.startsWith('--')) failUsage('web-ui-provider --fixture requires a case or suite name')
+      fixture = value
+      index += 1
+      continue
+    }
+    if (argument === '--fixture-file') {
+      if (!value || value.startsWith('--')) failUsage('web-ui-provider --fixture-file requires a path')
+      fixtureFile = path.resolve(root, value)
+      index += 1
+      continue
+    }
+    failUsage(`web-ui-provider does not support '${argument}'`)
+  }
+  if (!/^[a-z0-9][a-z0-9-]*$/.test(fixture)) {
+    failUsage('web-ui-provider fixture selection must use lowercase letters, numbers, and hyphens')
+  }
+  return { fixture, fixtureFile }
+}
diff --git a/test/run-live-browser-surface-matrix.mjs b/test/run-live-browser-surface-matrix.mjs
new file mode 100644
index 0000000..256c6a3
--- /dev/null
+++ b/test/run-live-browser-surface-matrix.mjs
@@ -0,0 +1,86 @@
+import { spawn } from 'node:child_process'
+import fs from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const surfaceTest = path.join(root, 'test/live-browser-provider-surfaces.e2e.mjs')
+const supportedSelections = Object.freeze(['auto', 'managed-chromium', 'cloak'])
+const selections = resolveSelections(process.argv.slice(2))
+const suppliedHome = process.env.TOKENLESS_LIVE_BROWSER_SURFACE_HOME
+const temporaryRoot = await fs.realpath(os.tmpdir())
+const homeDir = suppliedHome
+  ? path.resolve(suppliedHome)
+  : await fs.mkdtemp(path.join(temporaryRoot, 'tokenless-browser-surface-matrix-'))
+const ownsHome = !suppliedHome
+let activeChild = null
+let interruptedSignal = null
+
+const interrupt = (signal) => {
+  interruptedSignal = signal
+  activeChild?.kill(signal)
+}
+const onSigint = () => interrupt('SIGINT')
+const onSigterm = () => interrupt('SIGTERM')
+process.once('SIGINT', onSigint)
+process.once('SIGTERM', onSigterm)
+
+let failed = false
+try {
+  for (const selection of selections) {
+    const result = await runSelection(selection)
+    if (result.code !== 0) failed = true
+    if (interruptedSignal) break
+  }
+} finally {
+  process.removeListener('SIGINT', onSigint)
+  process.removeListener('SIGTERM', onSigterm)
+  if (ownsHome) await fs.rm(homeDir, { recursive: true, force: true })
+}
+
+if (interruptedSignal) process.exitCode = interruptedSignal === 'SIGINT' ? 130 : 143
+else if (failed) process.exitCode = 1
+
+function runSelection(selection) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [
+      '--test',
+      '--test-concurrency=1',
+      surfaceTest,
+    ], {
+      cwd: root,
+      env: {
+        ...process.env,
+        TOKENLESS_LIVE_BROWSER_SURFACE_GATE: '1',
+        TOKENLESS_LIVE_BROWSER_SURFACE_SELECTION: selection,
+        TOKENLESS_LIVE_BROWSER_SURFACE_HOME: homeDir,
+      },
+      stdio: 'inherit',
+    })
+    activeChild = child
+    child.once('error', reject)
+    child.once('close', (code, signal) => {
+      if (activeChild === child) activeChild = null
+      resolve({ code: code ?? (signal ? 1 : 0), signal })
+    })
+  })
+}
+
+function resolveSelections(arguments_) {
+  if (arguments_.length === 0) return supportedSelections
+  if (arguments_.length !== 2 || arguments_[0] !== '--selection') {
+    failUsage('Expected exactly --selection <browser>')
+  }
+  const selection = arguments_[1]
+  if (!supportedSelections.includes(selection)) {
+    failUsage(`Unsupported browser selection: ${selection}`)
+  }
+  return Object.freeze([selection])
+}
+
+function failUsage(message) {
+  console.error(message)
+  console.error(`Usage: node test/run-live-browser-surface-matrix.mjs [--selection ${supportedSelections.join('|')}]`)
+  process.exit(2)
+}
diff --git a/test/run-live-connection-mode-matrix.mjs b/test/run-live-connection-mode-matrix.mjs
new file mode 100644
index 0000000..9066cd9
--- /dev/null
+++ b/test/run-live-connection-mode-matrix.mjs
@@ -0,0 +1,63 @@
+import { spawn } from 'node:child_process'
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const modes = ['playwright', 'cdp']
+const results = []
+
+for (const mode of modes) {
+  const startedAt = new Date()
+  const status = await runMode(mode)
+  results.push({
+    mode,
+    status,
+    startedAt: startedAt.toISOString(),
+    completedAt: new Date().toISOString(),
+  })
+}
+
+const report = {
+  schema: 'tokenless.live-browser-connection-matrix-result.v1',
+  gate: process.env.TOKENLESS_LIVE_E2E_GATE ?? 'all',
+  results,
+}
+const reportDirectory = path.join(root, 'test-results', 'live-browser-connection-matrix')
+await fs.mkdir(reportDirectory, { recursive: true, mode: 0o700 })
+const reportPath = path.join(reportDirectory, `${compactTimestamp(new Date())}.json`)
+await fs.writeFile(reportPath, `${JSON.stringify(report, null, 2)}\n`, { mode: 0o600 })
+console.log(`Browser connection matrix result: ${reportPath}`)
+
+if (results.some((result) => result.status !== 0)) process.exitCode = 1
+
+function runMode(mode) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [
+      '--test',
+      '--test-concurrency=1',
+      'test/live-managed-playwright.e2e.mjs',
+    ], {
+      cwd: root,
+      env: {
+        ...process.env,
+        TOKENLESS_LIVE_E2E_GATE: process.env.TOKENLESS_LIVE_E2E_GATE ?? 'all',
+        TOKENLESS_LIVE_BROWSER_CONNECTION_MODE: mode,
+      },
+      stdio: 'inherit',
+    })
+    child.once('error', reject)
+    child.once('close', (status, signal) => {
+      if (signal) {
+        console.error(`${mode} live matrix terminated by ${signal}`)
+        resolve(1)
+        return
+      }
+      resolve(status ?? 1)
+    })
+  })
+}
+
+function compactTimestamp(date) {
+  return date.toISOString().replace(/[-:]/g, '').replace(/\.\d{3}Z$/u, 'Z')
+}
diff --git a/test/run-live-provider-e2e.mjs b/test/run-live-provider-e2e.mjs
new file mode 100644
index 0000000..8b4be53
--- /dev/null
+++ b/test/run-live-provider-e2e.mjs
@@ -0,0 +1,264 @@
+import { spawn } from 'node:child_process'
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import {
+  openBrowserRuntimeProviderTabs,
+  readTokenlessConfig,
+} from '../packages/cli/dist/src/index.js'
+import {
+  LIVE_PROVIDER_TEST_BROWSERS,
+  canonicalizeLiveProviderTestTarget,
+  resolveLiveProviderTestTarget,
+  validateLiveProviderTestTarget,
+} from './helpers/live-provider-test-profile.mjs'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const cliEntry = path.join(root, 'packages/cli/dist/src/tokenless.mjs')
+const options = parseArguments(process.argv.slice(2))
+let activeChild = null
+let interruptedSignal = null
+const interruptController = new AbortController()
+
+const interrupt = (signal) => {
+  interruptedSignal = signal
+  interruptController.abort()
+  activeChild?.kill(signal)
+}
+const onSigint = () => interrupt('SIGINT')
+const onSigterm = () => interrupt('SIGTERM')
+process.once('SIGINT', onSigint)
+process.once('SIGTERM', onSigterm)
+
+try {
+  const target = resolveLiveProviderTestTarget({ browser: options.browser, home: options.home })
+  if (options.command === 'prepare') {
+    await prepareTarget(target, options)
+  } else {
+    const validated = await validateLiveProviderTestTarget(target)
+    reportTarget(validated)
+    if (options.command === 'status') {
+      process.exitCode = 0
+    } else {
+      process.exitCode = await runProviderSuite(validated, options)
+    }
+  }
+} catch (error) {
+  if (interruptedSignal) {
+    process.exitCode = interruptedSignal === 'SIGINT' ? 130 : 143
+  } else {
+    console.error(error instanceof Error ? error.message : String(error))
+    process.exitCode = 1
+  }
+} finally {
+  process.removeListener('SIGINT', onSigint)
+  process.removeListener('SIGTERM', onSigterm)
+}
+
+async function prepareTarget(target, options) {
+  await fs.mkdir(target.homeDir, { recursive: true, mode: 0o700 })
+  if (process.platform !== 'win32') await fs.chmod(target.homeDir, 0o700)
+  target = await canonicalizeLiveProviderTestTarget(target)
+
+  const installed = await runJsonCli([
+    'install',
+    '--home', target.homeDir,
+    '--browser', target.browserSelection,
+  ], {
+    TOKENLESS_SETUP_SKILL_HOME: path.join(target.homeDir, 'agent-skills'),
+  })
+  const listed = await runJsonCli(['profiles', 'list', '--home', target.homeDir])
+  if (!listed.profiles.some((profile) => profile.slug === target.profileSlug)) {
+    await runJsonCli([
+      'profiles', 'add',
+      '--home', target.homeDir,
+      '--profile', target.profileSlug,
+      '--browser', target.browserSelection,
+      '--label', `Live Provider E2E (${target.browserSelection})`,
+      '--set-default',
+    ])
+  } else {
+    await runJsonCli([
+      'profiles', 'set-default',
+      '--home', target.homeDir,
+      '--profile', target.profileSlug,
+    ])
+  }
+
+  const config = await readTokenlessConfig(target.homeDir)
+  const providers = config.profilePreferences[target.profileSlug]?.enabledProviders ?? config.providerWhitelist
+  if (providers.length === 0) {
+    throw new Error(
+      `Dedicated live provider profile '${target.profileSlug}' has an empty effective providerWhitelist.`,
+    )
+  }
+
+  const validated = await validateLiveProviderTestTarget(target)
+  if (installed.browser.runtimeId !== validated.runtime.runtimeId) {
+    throw new Error(
+      `Installed runtime ${installed.browser.runtimeId} does not match profile runtime ${validated.runtime.runtimeId}.`,
+    )
+  }
+  reportTarget(validated)
+
+  if (options.noOpen) {
+    if (installed.daemon.started) {
+      await runJsonCli([
+        'daemon', 'stop',
+        '--home', target.homeDir,
+        '--daemon-url', installed.daemon.url,
+      ])
+    }
+    console.log('Preparation completed without opening the browser.')
+    return
+  }
+
+  const review = await openBrowserRuntimeProviderTabs({
+    daemonUrl: installed.daemon.url,
+    homeDir: target.homeDir,
+    profileId: validated.profile.id,
+    providers,
+    browserVisibility: 'headed',
+    requestTimeoutMs: 5_000,
+    signal: interruptController.signal,
+  })
+  const requestedProviders = review.tabs.map((tab) => tab.provider)
+  const newTabCount = review.tabs.filter((tab) => !tab.reused).length
+  const reusedTabCount = review.tabs.length - newTabCount
+  console.log(
+    `Requested ${requestedProviders.length}/${providers.length} provider login tab(s) in one browser handoff ` +
+    `(${newTabCount} new, ${reusedTabCount} reused): ${requestedProviders.join(', ') || 'none'}.`,
+  )
+  console.log('Preparation is complete; provider pages continue loading in the dedicated managed browser.')
+  console.log('Sign in manually, then stop its daemon before starting provider automation:')
+  console.log(
+    `${process.execPath} ${cliEntry} daemon stop --home ${JSON.stringify(target.homeDir)} ` +
+    `--daemon-url ${JSON.stringify(installed.daemon.url)} --json`,
+  )
+  if (review.failures.length > 0) {
+    for (const failure of review.failures) {
+      console.error(`Could not open ${failure.provider}: ${failure.message}`)
+    }
+    throw new Error(`Failed to open ${review.failures.length} provider login tab(s).`)
+  }
+}
+
+async function runProviderSuite(target, options) {
+  const environment = {
+    ...process.env,
+    TOKENLESS_LIVE_MANAGED_PLAYWRIGHT_HOME: target.homeDir,
+    TOKENLESS_LIVE_MANAGED_PLAYWRIGHT_PROFILE: target.profileSlug,
+    TOKENLESS_LIVE_PROVIDER_TEST_BROWSER: target.browserSelection,
+    TOKENLESS_LIVE_E2E_GATE: options.gate,
+  }
+  const script = options.command === 'connection-matrix'
+    ? ['test/run-live-connection-mode-matrix.mjs']
+    : ['test/run-gated-e2e.mjs', 'managed-playwright', options.gate]
+  return await runInherited(process.execPath, script, environment)
+}
+
+async function runJsonCli(arguments_, environment = {}) {
+  const result = await runCaptured(
+    process.execPath,
+    [cliEntry, ...arguments_, '--json'],
+    { ...process.env, ...environment },
+  )
+  if (result.status !== 0) {
+    throw new Error(result.stderr.trim() || result.stdout.trim() || `Tokenless CLI exited with ${result.status}.`)
+  }
+  try {
+    return JSON.parse(result.stdout)
+  } catch (error) {
+    throw new Error('Tokenless CLI did not return its required JSON payload.', { cause: error })
+  }
+}
+
+function runCaptured(command, arguments_, environment) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, arguments_, {
+      cwd: root,
+      env: environment,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    })
+    activeChild = child
+    let stdout = ''
+    let stderr = ''
+    child.stdout.setEncoding('utf8')
+    child.stderr.setEncoding('utf8')
+    child.stdout.on('data', (chunk) => { stdout += chunk })
+    child.stderr.on('data', (chunk) => { stderr += chunk })
+    child.once('error', reject)
+    child.once('close', (status, signal) => {
+      if (activeChild === child) activeChild = null
+      resolve({ status: status ?? (signal ? 1 : 0), signal, stdout, stderr })
+    })
+  })
+}
+
+function runInherited(command, arguments_, environment) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, arguments_, {
+      cwd: root,
+      env: environment,
+      stdio: 'inherit',
+    })
+    activeChild = child
+    child.once('error', reject)
+    child.once('close', (status, signal) => {
+      if (activeChild === child) activeChild = null
+      if (interruptedSignal) resolve(interruptedSignal === 'SIGINT' ? 130 : 143)
+      else resolve(status ?? (signal ? 1 : 0))
+    })
+  })
+}
+
+function reportTarget(target) {
+  console.log('Live provider E2E target:')
+  console.log(`  home: ${target.homeDir}`)
+  console.log(`  profile: ${target.profileSlug}`)
+  console.log(`  directory: browser/profiles/${target.relativeDirectory}`)
+  console.log(`  browser: ${target.runtime.selection}`)
+  console.log(`  runtime: ${target.runtime.runtimeId}`)
+}
+
+function parseArguments(arguments_) {
+  const command = arguments_[0]
+  if (!['prepare', 'run', 'connection-matrix', 'status'].includes(command)) failUsage()
+  const parsed = {
+    command,
+    browser: null,
+    home: null,
+    gate: 'all',
+    noOpen: false,
+  }
+  for (let index = 1; index < arguments_.length; index += 1) {
+    const argument = arguments_[index]
+    if (argument === '--no-open') {
+      parsed.noOpen = true
+      continue
+    }
+    const value = arguments_[index + 1]
+    if (!value || value.startsWith('--')) failUsage(`${argument} requires a value.`)
+    if (argument === '--browser') parsed.browser = value
+    else if (argument === '--home') parsed.home = value
+    else if (argument === '--gate') parsed.gate = value
+    else failUsage(`Unsupported argument '${argument}'.`)
+    index += 1
+  }
+  if (!['all', 'non_submission', 'mutation', 'project'].includes(parsed.gate)) {
+    failUsage('Gate must be all, non_submission, mutation, or project.')
+  }
+  if (parsed.noOpen && command !== 'prepare') failUsage('--no-open is valid only for prepare.')
+  return parsed
+}
+
+function failUsage(message) {
+  if (message) console.error(message)
+  console.error(
+    `Usage: node test/run-live-provider-e2e.mjs <prepare|run|connection-matrix|status> ` +
+    `--browser <${LIVE_PROVIDER_TEST_BROWSERS.join('|')}> ` +
+    '[--home <test-home>] [--gate <all|non_submission|mutation|project>] [--no-open]',
+  )
+  process.exit(2)
+}
diff --git a/test/setup-workflow.test.mjs b/test/setup-workflow.test.mjs
deleted file mode 100644
index 3213983..0000000
--- a/test/setup-workflow.test.mjs
+++ /dev/null
@@ -1,268 +0,0 @@
-import assert from 'node:assert/strict'
-import fs from 'node:fs/promises'
-import os from 'node:os'
-import path from 'node:path'
-import test from 'node:test'
-
-import {
-  TOKENLESS_SKILL_NAMES,
-  TOKENLESS_SKILL_SOURCE,
-  inspectTokenlessSkills,
-  installTokenlessSkills,
-} from '../packages/cli/dist/src/setup-workflow.js'
-import {
-  SETUP_MANAGED_PROFILE_DISCLOSURE,
-  SETUP_READINESS_DISCLOSURE,
-  createSetupPresenter,
-  resolveSetupTerminalCapabilities,
-  supportsAnsi,
-  supportsAnimation,
-} from '../packages/cli/dist/src/setup-presenter.js'
-
-test('setup skill check requires both manifests and canonical GitHub lock metadata', async () => {
-  const home = await fs.mkdtemp(path.join(os.tmpdir(), 'tokenless-setup-skills-'))
-  await writeInstalledSkills(home)
-
-  const check = await inspectTokenlessSkills(home)
-
-  assert.equal(check.ok, true)
-  assert.equal(check.source, TOKENLESS_SKILL_SOURCE)
-  assert.deepEqual(Object.keys(check.skills).sort(), [...TOKENLESS_SKILL_NAMES].sort())
-  await fs.rm(home, { recursive: true, force: true })
-})
-
-test('setup installs both skills from the canonical repository with telemetry disabled and verifies the result', async () => {
-  const home = await fs.mkdtemp(path.join(os.tmpdir(), 'tokenless-setup-install-'))
-  const calls = []
-  const result = await installTokenlessSkills({
-    home,
-    run: async (command, args, options) => {
-      calls.push({ command, args: [...args], env: options.env })
-      await writeInstalledSkills(home)
-    },
-  })
-
-  assert.equal(calls.length, 1)
-  assert.match(calls[0].command, /^npx(?:\.cmd)?$/)
-  assert.deepEqual(calls[0].args, [
-    '--yes', 'skills', 'add', 'jazelly/tokenless',
-    '--skill', 'tokenless',
-    '--skill', 'tokenless-install',
-    '--global', '--yes',
-  ])
-  assert.equal(calls[0].env.DISABLE_TELEMETRY, '1')
-  assert.equal(result.check.ok, true)
-  await fs.rm(home, { recursive: true, force: true })
-})
-
-test('setup presenter keeps interactive setup output compact', () => {
-  const stream = captureStream()
-  const presenter = createSetupPresenter({
-    enabled: true,
-    stream,
-    env: { NO_COLOR: '1' },
-    animation: false,
-  })
-
-  presenter.welcome()
-  presenter.explain({
-    title: 'Agent skills',
-    lines: [
-      'Tokenless will read local skill manifests before changing anything.',
-      'Installation changes only local agent skill files.',
-    ],
-  })
-
-  const output = stream.output()
-  assert.match(output, /Tokenless setup/)
-  assert.doesNotMatch(output, /Roadmap/)
-  assert.doesNotMatch(output, /Visible-session onboarding/)
-  assert.match(output, /Tokenless will read local skill manifests before changing anything/)
-  assert.doesNotMatch(output, /\u001b\[/)
-})
-
-test('setup prompt capability stays independent from stderr presentation capability', () => {
-  assert.deepEqual(resolveSetupTerminalCapabilities({
-    json: false,
-    stdin: { isTTY: true },
-    stdout: { isTTY: true },
-    stderr: { isTTY: false },
-  }), {
-    canPrompt: true,
-    canPresent: false,
-  })
-  assert.deepEqual(resolveSetupTerminalCapabilities({
-    json: true,
-    stdin: { isTTY: true },
-    stdout: { isTTY: true },
-    stderr: { isTTY: true },
-  }), {
-    canPrompt: false,
-    canPresent: false,
-  })
-  assert.deepEqual(resolveSetupTerminalCapabilities({
-    json: false,
-    stdin: { isTTY: true },
-    stdout: { isTTY: false },
-    stderr: { isTTY: true },
-  }), {
-    canPrompt: false,
-    canPresent: false,
-  })
-})
-
-test('setup disclosures state essential boundaries concisely', () => {
-  assert.equal(SETUP_MANAGED_PROFILE_DISCLOSURE.length, 1)
-  assert.match(SETUP_MANAGED_PROFILE_DISCLOSURE[0], /Keeps sign-ins between jobs/)
-  assert.match(SETUP_MANAGED_PROFILE_DISCLOSURE[0], /selected provider cookies only/)
-  assert.match(SETUP_MANAGED_PROFILE_DISCLOSURE[0], /other browser data is excluded/)
-  assert.equal(SETUP_READINESS_DISCLOSURE.length, 1)
-  assert.match(SETUP_READINESS_DISCLOSURE[0], /visible sign-in state/)
-  assert.match(SETUP_READINESS_DISCLOSURE[0], /without submitting a prompt/)
-})
-
-test('setup presenter cleans animated progress on success and failure', async () => {
-  const successStream = captureStream()
-  const successTimers = manualTimers()
-  const successPresenter = createSetupPresenter({
-    enabled: true,
-    stream: successStream,
-    env: { TERM: 'xterm-256color', TOKENLESS_FORCE_ANIMATION: '1' },
-    timers: successTimers,
-  })
-
-  const value = await successPresenter.withProgress('Checking visible login state', async () => {
-    successTimers.tick()
-    return 'ready'
-  })
-
-  assert.equal(value, 'ready')
-  assert.equal(successTimers.cleared(), 1)
-  assert.match(successStream.output(), /\u001b\[2K\u001b\[1G/)
-  assert.doesNotMatch(successStream.output(), /\r/)
-  assert.match(successStream.output(), /OK.*Checking visible login state/)
-  assert.equal(successStream.output().endsWith('\n'), true)
-
-  const failureStream = captureStream()
-  const failureTimers = manualTimers()
-  const failurePresenter = createSetupPresenter({
-    enabled: true,
-    stream: failureStream,
-    env: { TERM: 'xterm-256color', TOKENLESS_FORCE_ANIMATION: '1' },
-    timers: failureTimers,
-  })
-
-  await assert.rejects(
-    failurePresenter.withProgress('Installing skills', async () => {
-      failureTimers.tick()
-      throw new Error('install failed')
-    }),
-    /install failed/,
-  )
-
-  assert.equal(failureTimers.cleared(), 1)
-  assert.match(failureStream.output(), /\u001b\[2K\u001b\[1G/)
-  assert.doesNotMatch(failureStream.output(), /\r/)
-  assert.match(failureStream.output(), /X.*Installing skills/)
-  assert.equal(failureStream.output().endsWith('\n'), true)
-})
-
-test('setup presenter keeps animated progress on one terminal line', async () => {
-  const stream = captureStream({ columns: 40 })
-  const timers = manualTimers()
-  const presenter = createSetupPresenter({
-    enabled: true,
-    stream,
-    env: { NO_COLOR: '1', TERM: 'xterm-256color' },
-    timers,
-  })
-
-  await presenter.withProgress('Installing and verifying Tokenless agent skills from GitHub', async () => {
-    timers.tick()
-    timers.tick()
-  })
-
-  assert.doesNotMatch(stream.output(), /\r/)
-  assert.equal(stream.output().match(/\n/g)?.length, 1)
-  for (const write of stream.writes()) {
-    const visible = write.replace(/\u001b\[[0-9;]*[A-Za-z]/g, '').replace(/\n$/, '')
-    assert.ok(visible.length < stream.columns, `progress write exceeded terminal width: ${visible.length}`)
-  }
-})
-
-test('setup presenter is silent when disabled and respects reduced terminal environments', async () => {
-  const stream = captureStream()
-  const presenter = createSetupPresenter({
-    enabled: false,
-    stream,
-    env: { TERM: 'xterm-256color' },
-  })
-
-  presenter.welcome()
-  presenter.explain({ title: 'Silent', lines: ['No output should be written.'] })
-  const result = await presenter.withProgress('No-op progress', async () => 'done')
-
-  assert.equal(result, 'done')
-  assert.equal(stream.output(), '')
-  assert.equal(supportsAnsi({ NO_COLOR: '1' }), false)
-  assert.equal(supportsAnsi({ TERM: 'dumb' }), false)
-  assert.equal(supportsAnimation({ TERM: 'dumb' }), false)
-  assert.equal(supportsAnimation({ CI: '1' }), false)
-})
-
-async function writeInstalledSkills(home) {
-  const root = path.join(home, '.agents')
-  for (const name of TOKENLESS_SKILL_NAMES) {
-    const directory = path.join(root, 'skills', name)
-    await fs.mkdir(directory, { recursive: true })
-    await fs.writeFile(path.join(directory, 'SKILL.md'), `---\nname: ${name}\n---\n`, 'utf8')
-  }
-  await fs.writeFile(path.join(root, '.skill-lock.json'), JSON.stringify({
-    version: 3,
-    skills: Object.fromEntries(TOKENLESS_SKILL_NAMES.map((name) => [name, {
-      source: 'jazelly/tokenless',
-      sourceType: 'github',
-      sourceUrl: 'https://github.com/jazelly/tokenless.git',
-      skillPath: `skills/${name}/SKILL.md`,
-      installedAt: new Date().toISOString(),
-      updatedAt: new Date().toISOString(),
-    }])),
-  }), 'utf8')
-}
-
-function captureStream({ columns } = {}) {
-  const chunks = []
-  return {
-    ...(columns === undefined ? {} : { columns }),
-    write(chunk) {
-      chunks.push(String(chunk))
-    },
-    output() {
-      return chunks.join('')
-    },
-    writes() {
-      return [...chunks]
-    },
-  }
-}
-
-function manualTimers() {
-  let callback = null
-  let clearCount = 0
-  return {
-    setInterval(next) {
-      callback = next
-      return Symbol('timer')
-    },
-    clearInterval() {
-      clearCount += 1
-    },
-    tick() {
-      assert.equal(typeof callback, 'function')
-      callback()
-    },
-    cleared() {
-      return clearCount
-    },
-  }
-}
diff --git a/test/tokenless-skill-contract.test.mjs b/test/tokenless-skill-contract.test.mjs
deleted file mode 100644
index f7a9c8c..0000000
--- a/test/tokenless-skill-contract.test.mjs
+++ /dev/null
@@ -1,61 +0,0 @@
-import assert from 'node:assert/strict'
-import fs from 'node:fs/promises'
-import path from 'node:path'
-import test from 'node:test'
-import { fileURLToPath } from 'node:url'
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-
-test('tokenless skill stops on waiting_for_user and preserves the same daemon job', async () => {
-  const skill = await fs.readFile(path.join(root, 'skills/tokenless/SKILL.md'), 'utf8')
-
-  assert.match(skill, /waiting_for_user/)
-  assert.match(skill, /already-open managed browser/)
-  assert.match(skill, /same `jobId`\/`taskId`/)
-  assert.match(skill, /never retry, reimport, resubmit, or create a replacement job/)
-  assert.match(skill, /Do not claim completion until the daemon reports `succeeded`/)
-  assert.match(skill, /tokenless profiles list --json/)
-  assert.match(skill, /tokenless profiles status --profile/)
-  assert.match(skill, /tokenless run \\\s*\n\s*--profile/)
-  assert.doesNotMatch(skill, /npx tokenless/)
-})
-
-test('tokenless-install skill stays noninteractive for agent sessions', async () => {
-  const installSkill = await fs.readFile(path.join(root, 'skills/tokenless-install/SKILL.md'), 'utf8')
-
-  assert.match(installSkill, /tokenless setup --fresh --json/)
-  assert.match(installSkill, /tokenless profiles discover/)
-  assert.match(installSkill, /--import-browser-profile/)
-  assert.match(installSkill, /--consent-local-profile-copy/)
-  assert.match(installSkill, /--json/)
-  assert.match(installSkill, /Never run bare `tokenless setup`/)
-  assert.match(installSkill, /human cannot answer CLI questions/i)
-  assert.doesNotMatch(installSkill, /interactive terminal/i)
-  assert.doesNotMatch(installSkill, /^```bash\ntokenless setup\n```$/m)
-})
-
-test('tokenless-install skill treats upgrade as the canonical maintenance path', async () => {
-  const installSkill = await fs.readFile(path.join(root, 'skills/tokenless-install/SKILL.md'), 'utf8')
-
-  assert.match(installSkill, /canonical upgrade path/i)
-  assert.match(installSkill, /tokenless upgrade --json/)
-  assert.match(installSkill, /npm install --global tokenless@latest/)
-  assert.match(installSkill, /unknown command/)
-  assert.match(installSkill, /exact CLI entrypoint/)
-  assert.match(installSkill, /command itself is prompt-free/)
-  assert.match(installSkill, /Human users may omit the flag and run `tokenless upgrade`/)
-  assert.match(installSkill, /Agents and CI keep `--json`/i)
-  assert.match(installSkill, /not a different upgrade workflow or a version selector/)
-  assert.match(installSkill, /Earlier successful phases may remain installed; do not claim rollback/)
-  assert.match(installSkill, /still attempts the final doctor check after a skill or runtime failure/)
-  assert.doesNotMatch(installSkill, /npx skills update/)
-})
-
-test('CLI state contract exposes daemon blocker_json instead of hiding waiting state', async () => {
-  const cli = await fs.readFile(path.join(root, 'packages/cli/src/tokenless.mts'), 'utf8')
-
-  assert.match(cli, /blocker:\s*job\.blocker_json/)
-  assert.match(cli, /state:\s*{[\s\S]*blocker:\s*job\.blocker_json/)
-  assert.match(cli, /waiting_for_user/)
-  assert.match(cli, /visible managed browser is open/i)
-})
diff --git a/test/ts-daemon-conformance.test.mjs b/test/ts-daemon-conformance.test.mjs
new file mode 100644
index 0000000..91c1ebc
--- /dev/null
+++ b/test/ts-daemon-conformance.test.mjs
@@ -0,0 +1,1531 @@
+import assert from 'node:assert/strict'
+import { spawn, spawnSync } from 'node:child_process'
+import { createHmac, randomBytes, randomUUID } from 'node:crypto'
+import fs from 'node:fs'
+import net from 'node:net'
+import os from 'node:os'
+import path from 'node:path'
+import { DatabaseSync } from 'node:sqlite'
+import test from 'node:test'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const cliDir = path.join(root, 'packages/cli')
+const cliEntry = path.join(cliDir, 'dist/src/tokenless.mjs')
+const cliIndex = path.join(cliDir, 'dist/src/index.js')
+const tsDaemonEntry = path.join(cliDir, 'dist/src/daemon/daemon-entry.mjs')
+const managedPlaywrightJobAction = 'visible_provider_actions'
+const createdChildren = new Set()
+
+test.after(async () => {
+  await Promise.all([...createdChildren].map((child) => terminateChild(child)))
+})
+
+test('TS daemon embeds the managed Playwright scheduler without idle browser launch', {
+  timeout: 60_000,
+}, async () => {
+  requireBuiltArtifacts()
+  const homeDir = tempHome('tokenless-ts-embedded-scheduler-')
+  const profile = createReadyManagedProfile(homeDir)
+  const daemon = await startTsDaemon(homeDir)
+  try {
+    await delay(1_500)
+    assertProfileDirectoryEmpty(profile.directory)
+
+    const token = readControlToken(homeDir)
+    const jobId = randomUUID()
+    await daemonRequest(daemon.url, token, 'POST', '/jobs', {
+      provider: 'chatgpt',
+      action: managedPlaywrightJobAction,
+      execution_backend: 'playwright',
+      profile_id: profile.id,
+      job_id: jobId,
+      request_json: { malformed: true },
+    })
+
+    const failed = await waitForDaemonJobStatus(daemon.url, token, jobId, 'failed', 10_000)
+    assert.equal(failed.error_json.code, 'invalid_playwright_job_request')
+    assertProfileDirectoryEmpty(profile.directory)
+  } finally {
+    await shutdownDaemon(daemon).catch(() => undefined)
+    await terminateChildrenForHome(homeDir)
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('TS daemon rejects unsupported Playwright providers', {
+  timeout: 60_000,
+}, async () => {
+  requireBuiltArtifacts()
+  const homeDir = tempHome('tokenless-ts-provider-negotiation-')
+  const daemon = await startTsDaemon(homeDir)
+  try {
+    const token = readControlToken(homeDir)
+    const rejected = await fetch(`${daemon.url}/jobs`, {
+      method: 'POST',
+      headers: jsonHeaders(token),
+      body: JSON.stringify({
+        provider: 'not-a-provider',
+        action: managedPlaywrightJobAction,
+        execution_backend: 'playwright',
+        profile_id: randomUUID(),
+        job_id: randomUUID(),
+        request_json: { malformed: true },
+      }),
+    })
+    assert.equal(rejected.status, 400)
+    const rejectedBody = await rejected.json()
+    assert.equal(rejectedBody.error.code, 'invalid_input')
+    assert.match(rejectedBody.error.message, /unsupported playwright provider: not-a-provider/)
+  } finally {
+    await shutdownDaemon(daemon).catch(() => undefined)
+    await terminateChildrenForHome(homeDir)
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('TS daemon rejects under-declared capability routes before durable job creation', {
+  timeout: 60_000,
+}, async () => {
+  requireBuiltArtifacts()
+  const homeDir = tempHome('tokenless-ts-capability-route-validation-')
+  const daemon = await startTsDaemon(homeDir)
+  try {
+    const token = readControlToken(homeDir)
+    const playwright = await importPlaywright()
+    const route = playwright.resolveTaskCapabilityRoute({
+      requirements: [playwright.TASK_CAPABILITIES.CONVERSATION_CHAT],
+      candidates: [{ provider: 'chatgpt', runtimeEligibility: 'eligible' }],
+    })
+    assert.equal(route.ok, true)
+    const rejected = await fetch(`${daemon.url}/jobs`, {
+      method: 'POST',
+      headers: jsonHeaders(token),
+      body: JSON.stringify({
+        provider: 'chatgpt',
+        action: managedPlaywrightJobAction,
+        execution_backend: 'playwright',
+        profile_id: randomUUID(),
+        job_id: randomUUID(),
+        request_json: {
+          protocol: 'tokenless.playwright.job.v3',
+          provider: 'chatgpt',
+          target: { kind: 'provider_home', url: 'https://chatgpt.com/' },
+          taskId: 'under-declared-route',
+          capabilityRoute: route.route,
+          fallback: null,
+          browserVisibility: 'headless',
+          actions: [{
+            protocol: 'tokenless.playwright.visible-action.v3',
+            requestId: 'under-declared-route:file',
+            provider: 'chatgpt',
+            action: playwright.VISIBLE_ACTIONS.FILE_UPLOAD,
+            payload: {
+              attachments: [{
+                protocol: 'tokenless.visible-attachment.v1',
+                bundleId: 'under-declared-route-bundle',
+                attachmentId: 'under-declared-route-attachment',
+                name: 'evidence.txt',
+                type: 'text/plain',
+                size: 8,
+                sha256: 'c'.repeat(64),
+              }],
+            },
+          }],
+        },
+      }),
+    })
+    assert.equal(rejected.status, 400)
+    const body = await rejected.json()
+    assert.equal(body.error.code, 'invalid_input')
+    assert.match(body.error.message, /omits action-required capabilities: file\.upload/)
+    const jobs = await daemonRequest(daemon.url, token, 'GET', '/jobs?limit=10')
+    assert.deepEqual(jobs, [])
+  } finally {
+    await shutdownDaemon(daemon).catch(() => undefined)
+    await terminateChildrenForHome(homeDir)
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('agent replay drains each durable job once, survives restart, and keeps full job state queryable', {
+  timeout: 60_000,
+}, async () => {
+  requireBuiltArtifacts()
+  const homeDir = tempHome('tokenless-ts-agent-replay-')
+  let daemon = await startTsDaemon(homeDir)
+  const agentA = { agent_kind: 'codex', agent_session_id: `session-a-${randomUUID()}` }
+  const agentB = { agent_kind: 'codex', agent_session_id: `session-b-${randomUUID()}` }
+  const agentC = { agent_kind: 'codex', agent_session_id: `session-c-${randomUUID()}` }
+  const agentD = { agent_kind: 'codex', agent_session_id: `session-d-${randomUUID()}` }
+  const agentE = { agent_kind: 'codex', agent_session_id: `session-e-${randomUUID()}` }
+  const jobA = randomUUID()
+  const jobB = randomUUID()
+  const jobC = randomUUID()
+  const jobD = randomUUID()
+  const jobE = randomUUID()
+  const unaddressedJob = randomUUID()
+  try {
+    const token = readControlToken(homeDir)
+    await daemonRequest(daemon.url, token, 'POST', '/control/browser-runtime/quiesce')
+    for (const invalidRecipient of [
+      { agent_kind: null },
+      { agent_kind: null, agent_session_id: null },
+    ]) {
+      const response = await fetch(`${daemon.url}/jobs`, {
+        method: 'POST',
+        headers: jsonHeaders(token),
+        body: JSON.stringify({
+          provider: 'chatgpt',
+          action: managedPlaywrightJobAction,
+          execution_backend: 'playwright',
+          profile_id: randomUUID(),
+          request_json: { malformed: true },
+          ...invalidRecipient,
+        }),
+      })
+      assert.equal(response.status, 400)
+      assert.equal((await response.json()).error.code, 'invalid_input')
+    }
+    for (const invalidLimit of [null, 201]) {
+      const invalidReplayLimit = await fetch(`${daemon.url}/replay/drain`, {
+        method: 'POST',
+        headers: jsonHeaders(token),
+        body: JSON.stringify({
+          ...agentA,
+          limit: invalidLimit,
+        }),
+      })
+      assert.equal(invalidReplayLimit.status, 400)
+      assert.equal((await invalidReplayLimit.json()).error.code, 'invalid_input')
+    }
+
+    for (const [jobId, recipient] of [
+      [jobA, agentA],
+      [jobB, agentB],
+      [unaddressedJob, null],
+    ]) {
+      await daemonRequest(daemon.url, token, 'POST', '/jobs', {
+        provider: 'chatgpt',
+        action: managedPlaywrightJobAction,
+        execution_backend: 'playwright',
+        profile_id: randomUUID(),
+        job_id: jobId,
+        ...(recipient ?? {}),
+        request_json: {
+          malformed: true,
+          taskId: `task-${jobId}`,
+        },
+      })
+      await daemonRequest(daemon.url, token, 'POST', `/jobs/${encodeURIComponent(jobId)}/cancel`, {
+        reason: { code: 'replay_test', detail: 'x'.repeat(2_000) },
+      })
+    }
+
+    const isolated = await daemonRequest(daemon.url, token, 'POST', '/replay/drain', {
+      agent_kind: agentA.agent_kind,
+      agent_session_id: `unknown-${randomUUID()}`,
+    })
+    assert.deepEqual(isolated.jobs, [])
+
+    await daemonRequest(daemon.url, token, 'POST', '/jobs', {
+      provider: 'chatgpt',
+      action: managedPlaywrightJobAction,
+      execution_backend: 'playwright',
+      profile_id: randomUUID(),
+      job_id: jobC,
+      ...agentC,
+      request_json: { malformed: true, taskId: `task-${jobC}` },
+    })
+    const waitingDatabase = new DatabaseSync(path.join(homeDir, 'tokenless.sqlite3'))
+    try {
+      waitingDatabase.prepare(
+        `UPDATE jobs
+         SET status = 'waiting_for_user', blocker_json = ?, checkpoint_json = ?,
+             claim_expires_at = NULL, updated_at = ?,
+             outcome_revision = outcome_revision + 1
+         WHERE job_id = ?`
+      ).run(
+        JSON.stringify({ code: 'user_action_required' }),
+        JSON.stringify({ cursor: 'durable-checkpoint' }),
+        new Date(1_000).toISOString(),
+        jobC
+      )
+    } finally {
+      waitingDatabase.close()
+    }
+    const waitingReplay = await daemonRequest(daemon.url, token, 'POST', '/replay/drain', agentC)
+    assert.deepEqual(waitingReplay.jobs.map((job) => [job.job_id, job.status]), [[jobC, 'waiting_for_user']])
+    const sameTimestampDatabase = new DatabaseSync(path.join(homeDir, 'tokenless.sqlite3'))
+    try {
+      sameTimestampDatabase.prepare(
+        `UPDATE jobs
+         SET status = 'canceled', error_json = ?, blocker_json = NULL, checkpoint_json = NULL,
+             outcome_revision = outcome_revision + 1
+         WHERE job_id = ?`
+      ).run(JSON.stringify({ code: 'job_canceled', reason: { code: 'after_waiting_report' } }), jobC)
+    } finally {
+      sameTimestampDatabase.close()
+    }
+    const finalRevisionReplay = await daemonRequest(daemon.url, token, 'POST', '/replay/drain', agentC)
+    assert.deepEqual(finalRevisionReplay.jobs.map((job) => [job.job_id, job.status]), [[jobC, 'canceled']])
+    assert.equal(finalRevisionReplay.jobs[0].updated_at, waitingReplay.jobs[0].updated_at)
+    assert.deepEqual((await daemonRequest(daemon.url, token, 'POST', '/replay/drain', agentC)).jobs, [])
+
+    const createdJobD = await daemonRequest(daemon.url, token, 'POST', '/jobs', {
+      provider: 'chatgpt',
+      action: managedPlaywrightJobAction,
+      execution_backend: 'playwright',
+      profile_id: randomUUID(),
+      job_id: jobD,
+      ...agentD,
+      request_json: { malformed: true },
+    })
+    assert.equal(Object.hasOwn(createdJobD, 'agent_kind'), false)
+    assert.equal(Object.hasOwn(createdJobD, 'agent_session_id'), false)
+    await daemonRequest(daemon.url, token, 'POST', `/jobs/${encodeURIComponent(jobD)}/cancel`)
+    const mismatchedReceipt = await fetch(`${daemon.url}/jobs/${encodeURIComponent(jobD)}/report`, {
+      method: 'POST',
+      headers: jsonHeaders(token),
+      body: JSON.stringify({
+        agent_kind: agentD.agent_kind,
+        agent_session_id: `wrong-${randomUUID()}`,
+      }),
+    })
+    assert.equal(mismatchedReceipt.status, 404)
+    const mismatchedReceiptBody = await mismatchedReceipt.json()
+    assert.equal(mismatchedReceiptBody.error.code, 'job_not_found')
+    assert.equal(Object.hasOwn(mismatchedReceiptBody, 'job'), false)
+    const runtime = await importCli()
+    const firstReceipt = await runtime.markDaemonJobReported({
+      homeDir,
+      daemonUrl: daemon.url,
+      jobId: jobD,
+      agentKind: agentD.agent_kind,
+      agentSessionId: agentD.agent_session_id,
+    })
+    assert.equal(firstReceipt.reported, true)
+    const repeatedReceipt = await runtime.markDaemonJobReported({
+      homeDir,
+      daemonUrl: daemon.url,
+      jobId: jobD,
+      agentKind: agentD.agent_kind,
+      agentSessionId: agentD.agent_session_id,
+    })
+    assert.equal(repeatedReceipt.reported, false)
+    assert.deepEqual((await daemonRequest(daemon.url, token, 'POST', '/replay/drain', agentD)).jobs, [])
+
+    await daemonRequest(daemon.url, token, 'POST', '/jobs', {
+      provider: 'chatgpt',
+      action: managedPlaywrightJobAction,
+      execution_backend: 'playwright',
+      profile_id: randomUUID(),
+      job_id: jobE,
+      ...agentE,
+      request_json: { malformed: true },
+    })
+    const activeWaitingDatabase = new DatabaseSync(path.join(homeDir, 'tokenless.sqlite3'))
+    try {
+      activeWaitingDatabase.prepare(
+        `UPDATE jobs
+         SET status = 'waiting_for_user', blocker_json = ?,
+             claim_expires_at = ?, outcome_revision = outcome_revision + 1
+         WHERE job_id = ?`
+      ).run(
+        JSON.stringify({ code: 'active_user_handover' }),
+        Date.now() + 60_000,
+        jobE
+      )
+    } finally {
+      activeWaitingDatabase.close()
+    }
+    const activeWaitingReceipt = await runtime.markDaemonJobReported({
+      homeDir,
+      daemonUrl: daemon.url,
+      jobId: jobE,
+      agentKind: agentE.agent_kind,
+      agentSessionId: agentE.agent_session_id,
+    })
+    assert.equal(activeWaitingReceipt.reported, true)
+    const repeatedActiveWaitingReceipt = await runtime.markDaemonJobReported({
+      homeDir,
+      daemonUrl: daemon.url,
+      jobId: jobE,
+      agentKind: agentE.agent_kind,
+      agentSessionId: agentE.agent_session_id,
+    })
+    assert.equal(repeatedActiveWaitingReceipt.reported, false)
+    assert.deepEqual((await daemonRequest(daemon.url, token, 'POST', '/replay/drain', agentE)).jobs, [])
+
+    const cliReplay = runCli([
+      'replay',
+      '--home',
+      homeDir,
+      '--agent-kind',
+      agentA.agent_kind,
+      '--agent-session-id',
+      agentA.agent_session_id,
+      '--json',
+    ])
+    assert.equal(cliReplay.status, 0, cliReplay.stderr || cliReplay.stdout)
+    const cliPayload = JSON.parse(cliReplay.stdout)
+    assert.equal(cliPayload.ok, true)
+    assert.equal(cliPayload.count, 1)
+    assert.equal(cliPayload.jobs[0].job_id, jobA)
+    assert.equal(cliPayload.jobs[0].status, 'canceled')
+    assert.equal(cliPayload.jobs[0].task_id, `task-${jobA}`)
+    assert.equal(cliPayload.jobs[0].outcome_kind, 'error')
+    assert.equal(cliPayload.jobs[0].has_error, true)
+    assert.equal(Object.hasOwn(cliPayload.jobs[0], 'preview'), false)
+    assert.equal(Object.hasOwn(cliPayload.jobs[0], 'request_json'), false)
+
+    const emptySecondDrain = await daemonRequest(daemon.url, token, 'POST', '/replay/drain', agentA)
+    assert.deepEqual(emptySecondDrain.jobs, [])
+
+    await shutdownDaemon(daemon)
+    daemon = await startTsDaemon(homeDir)
+    const restartedToken = readControlToken(homeDir)
+    const emptyAfterRestart = await daemonRequest(daemon.url, restartedToken, 'POST', '/replay/drain', agentA)
+    assert.deepEqual(emptyAfterRestart.jobs, [])
+
+    const fullJob = await daemonRequest(
+      daemon.url,
+      restartedToken,
+      'GET',
+      `/jobs/${encodeURIComponent(jobA)}`
+    )
+    assert.equal(fullJob.job_id, jobA)
+    assert.equal(fullJob.status, 'canceled')
+    assert.equal(fullJob.error_json.reason.detail.length, 2_000)
+    assert.equal(Object.hasOwn(fullJob, 'agent_kind'), false)
+    assert.equal(Object.hasOwn(fullJob, 'agent_session_id'), false)
+
+    const otherAgent = await daemonRequest(daemon.url, restartedToken, 'POST', '/replay/drain', agentB)
+    assert.deepEqual(otherAgent.jobs.map((job) => job.job_id), [jobB])
+    assert.equal(otherAgent.jobs.some((job) => job.job_id === unaddressedJob), false)
+  } finally {
+    await shutdownDaemon(daemon).catch(() => undefined)
+    await terminateChildrenForHome(homeDir)
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('daemon startup reconciles an expired running lease before becoming ready', {
+  timeout: 60_000,
+}, async () => {
+  requireBuiltArtifacts()
+  const homeDir = tempHome('tokenless-ts-startup-recovery-')
+  let daemon = await startTsDaemon(homeDir)
+  const jobId = randomUUID()
+  try {
+    const token = readControlToken(homeDir)
+    await daemonRequest(daemon.url, token, 'POST', '/control/browser-runtime/quiesce')
+    await daemonRequest(daemon.url, token, 'POST', '/jobs', {
+      provider: 'chatgpt',
+      action: managedPlaywrightJobAction,
+      execution_backend: 'playwright',
+      profile_id: randomUUID(),
+      job_id: jobId,
+      request_json: { malformed: true },
+    })
+    await shutdownDaemon(daemon)
+
+    const database = new DatabaseSync(path.join(homeDir, 'tokenless.sqlite3'))
+    try {
+      database.prepare(
+        `UPDATE jobs
+         SET status = 'running', claim_token = ?, claim_expires_at = ?, updated_at = ?
+         WHERE job_id = ?`
+      ).run(`stale-${randomUUID()}`, 1, new Date(0).toISOString(), jobId)
+    } finally {
+      database.close()
+    }
+
+    daemon = await startTsDaemon(homeDir)
+    const restartedToken = readControlToken(homeDir)
+    const recovered = await daemonRequest(
+      daemon.url,
+      restartedToken,
+      'GET',
+      `/jobs/${encodeURIComponent(jobId)}`
+    )
+    assert.equal(recovered.status, 'queued')
+    const recoveredDatabase = new DatabaseSync(path.join(homeDir, 'tokenless.sqlite3'), { readOnly: true })
+    try {
+      const row = recoveredDatabase.prepare(
+        'SELECT status, claim_expires_at FROM jobs WHERE job_id = ?'
+      ).get(jobId)
+      assert.equal(row.status, 'queued')
+      assert.equal(row.claim_expires_at, null)
+    } finally {
+      recoveredDatabase.close()
+    }
+  } finally {
+    await shutdownDaemon(daemon).catch(() => undefined)
+    await terminateChildrenForHome(homeDir)
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('replay migration initializes durable outcome revisions and preserves an existing receipt', {
+  timeout: 60_000,
+}, async () => {
+  requireBuiltArtifacts()
+  const homeDir = tempHome('tokenless-ts-replay-migration-')
+  let daemon = await startTsDaemon(homeDir)
+  const recipient = { agent_kind: 'codex', agent_session_id: `migration-${randomUUID()}` }
+  const replayableJobId = randomUUID()
+  const alreadyReportedJobId = randomUUID()
+  const activeWaitingJobId = randomUUID()
+  const activeWaitingReportedJobId = randomUUID()
+  try {
+    const token = readControlToken(homeDir)
+    await daemonRequest(daemon.url, token, 'POST', '/control/browser-runtime/quiesce')
+    for (const jobId of [replayableJobId, alreadyReportedJobId]) {
+      await daemonRequest(daemon.url, token, 'POST', '/jobs', {
+        provider: 'chatgpt',
+        action: managedPlaywrightJobAction,
+        execution_backend: 'playwright',
+        profile_id: randomUUID(),
+        job_id: jobId,
+        ...recipient,
+        request_json: { malformed: true },
+      })
+      await daemonRequest(daemon.url, token, 'POST', `/jobs/${encodeURIComponent(jobId)}/cancel`)
+    }
+    for (const jobId of [activeWaitingJobId, activeWaitingReportedJobId]) {
+      await daemonRequest(daemon.url, token, 'POST', '/jobs', {
+        provider: 'chatgpt',
+        action: managedPlaywrightJobAction,
+        execution_backend: 'playwright',
+        profile_id: randomUUID(),
+        job_id: jobId,
+        ...recipient,
+        request_json: { malformed: true },
+      })
+    }
+    await shutdownDaemon(daemon)
+
+    const database = new DatabaseSync(path.join(homeDir, 'tokenless.sqlite3'))
+    try {
+      database.exec('ALTER TABLE jobs ADD COLUMN replay_reported_job_updated_at TEXT')
+      database.prepare(
+        `UPDATE jobs
+         SET outcome_revision = 0, reported_outcome_revision = NULL,
+             replay_reported_at = NULL, replay_reported_job_updated_at = NULL
+         WHERE job_id = ?`
+      ).run(replayableJobId)
+      database.prepare(
+        `UPDATE jobs
+         SET outcome_revision = 0, reported_outcome_revision = NULL,
+             replay_reported_at = updated_at, replay_reported_job_updated_at = updated_at
+         WHERE job_id = ?`
+      ).run(alreadyReportedJobId)
+      database.prepare(
+        `UPDATE jobs
+         SET status = 'waiting_for_user', blocker_json = ?, claim_expires_at = ?,
+             outcome_revision = 0, reported_outcome_revision = NULL,
+             replay_reported_at = NULL, replay_reported_job_updated_at = NULL
+         WHERE job_id = ?`
+      ).run(
+        JSON.stringify({ code: 'legacy_active_waiting' }),
+        Date.now() + 60_000,
+        activeWaitingJobId
+      )
+      database.prepare(
+        `UPDATE jobs
+         SET status = 'waiting_for_user', blocker_json = ?, claim_expires_at = ?,
+             outcome_revision = 0, reported_outcome_revision = NULL,
+             replay_reported_at = updated_at, replay_reported_job_updated_at = updated_at
+         WHERE job_id = ?`
+      ).run(
+        JSON.stringify({ code: 'legacy_active_waiting_reported' }),
+        Date.now() + 60_000,
+        activeWaitingReportedJobId
+      )
+    } finally {
+      database.close()
+    }
+
+    daemon = await startTsDaemon(homeDir)
+    const restartedToken = readControlToken(homeDir)
+    const replay = await daemonRequest(daemon.url, restartedToken, 'POST', '/replay/drain', recipient)
+    assert.deepEqual(replay.jobs.map((job) => job.job_id), [replayableJobId])
+    assert.deepEqual((await daemonRequest(daemon.url, restartedToken, 'POST', '/replay/drain', recipient)).jobs, [])
+    const runtime = await importCli()
+    const migratedActiveReceipt = await runtime.markDaemonJobReported({
+      homeDir,
+      daemonUrl: daemon.url,
+      jobId: activeWaitingJobId,
+      agentKind: recipient.agent_kind,
+      agentSessionId: recipient.agent_session_id,
+    })
+    assert.equal(migratedActiveReceipt.reported, true)
+    const migratedExistingReceipt = await runtime.markDaemonJobReported({
+      homeDir,
+      daemonUrl: daemon.url,
+      jobId: activeWaitingReportedJobId,
+      agentKind: recipient.agent_kind,
+      agentSessionId: recipient.agent_session_id,
+    })
+    assert.equal(migratedExistingReceipt.reported, false)
+    const migratedDatabase = new DatabaseSync(path.join(homeDir, 'tokenless.sqlite3'), { readOnly: true })
+    try {
+      const rows = migratedDatabase.prepare(
+        `SELECT job_id, outcome_revision, reported_outcome_revision
+         FROM jobs
+         WHERE job_id IN (?, ?)
+         ORDER BY job_id`
+      ).all(activeWaitingJobId, activeWaitingReportedJobId)
+      assert.equal(rows.every((row) => row.outcome_revision === 1), true)
+      assert.equal(rows.every((row) => row.reported_outcome_revision === 1), true)
+    } finally {
+      migratedDatabase.close()
+    }
+  } finally {
+    await shutdownDaemon(daemon).catch(() => undefined)
+    await terminateChildrenForHome(homeDir)
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('SQLite preserves exact provider Project and conversation mappings across store restart', {
+  timeout: 60_000,
+}, async () => {
+  requireBuiltArtifacts()
+  const homeDir = tempHome('tokenless-provider-mappings-')
+  const { JobStore } = await import(`${pathToFileURL(path.join(cliDir, 'dist/src/daemon/job-store.js')).href}?test=${randomUUID()}`)
+  let store = await JobStore.open(homeDir)
+  try {
+    const job = store.createJob({
+      provider: 'claude',
+      action: managedPlaywrightJobAction,
+      execution_backend: 'playwright',
+      profile_id: 'profile-mapping',
+      request_json: {
+        protocol: 'tokenless.playwright.job.v3',
+        provider: 'claude',
+        target: { kind: 'provider_home', url: 'https://claude.ai/new' },
+        taskId: 'task-mapping',
+        browserVisibility: 'headed',
+        actions: [],
+      },
+    })
+    store.upsertProviderProject({
+      provider: 'claude',
+      profile_id: 'profile-mapping',
+      resource_id: 'project-resource',
+      name: 'TOKENLESS_E2E_PROJECT_MAPPING',
+      canonical_url: 'https://claude.ai/project/project-resource',
+      visible_proof: 'native-project-url-name-and-composer-visible',
+      job_id: job.job_id,
+      created: true,
+    })
+    store.upsertProviderConversation({
+      provider: 'claude',
+      profile_id: 'profile-mapping',
+      project_resource_id: 'project-resource',
+      task_id: 'task-mapping',
+      canonical_url: 'https://claude.ai/project/project-resource/chat/conversation-resource',
+      job_id: job.job_id,
+    })
+    store.upsertProviderTaskConversation({
+      provider: 'claude',
+      profile_id: 'profile-mapping',
+      task_id: 'task-mapping',
+      canonical_url: 'https://claude.ai/project/project-resource/chat/conversation-resource',
+      job_id: job.job_id,
+    })
+    const e2eJob = store.createJob({
+      provider: 'claude',
+      action: managedPlaywrightJobAction,
+      execution_backend: 'playwright',
+      profile_id: 'profile-mapping',
+      job_id: `tlp_e2e-run-${randomUUID()}`,
+      request_json: {
+        protocol: 'tokenless.playwright.job.v3',
+        provider: 'claude',
+        target: { kind: 'provider_home', url: 'https://claude.ai/new' },
+        taskId: 'task-e2e-isolation',
+        browserVisibility: 'headed',
+        actions: [],
+      },
+    })
+    const isolatedClaim = store.claimNextJob(
+      {
+        action: managedPlaywrightJobAction,
+        job_id_prefix: 'tlp_e2e-run-',
+      },
+      'playwright',
+      'profile-mapping',
+    )
+    assert.equal(isolatedClaim.job_id, e2eJob.job_id)
+    assert.equal(store.getJob(job.job_id).status, 'queued')
+    store.close()
+    store = await JobStore.open(homeDir)
+
+    const project = store.resolveProviderMapping({
+      provider: 'claude',
+      profile_id: 'profile-mapping',
+      project_name: 'TOKENLESS_E2E_PROJECT_MAPPING',
+      task_id: 'task-mapping',
+    })
+    assert.equal(project.project.resource_id, 'project-resource')
+    assert.equal(project.conversation.task_id, 'task-mapping')
+    const conversation = store.resolveProviderTaskConversation({
+      provider: 'claude',
+      profile_id: 'profile-mapping',
+      task_id: 'task-mapping',
+    })
+    assert.equal(
+      conversation.canonical_url,
+      'https://claude.ai/project/project-resource/chat/conversation-resource',
+    )
+  } finally {
+    store.close()
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('built Playwright validators enforce the current internal schema IDs', {
+  timeout: 60_000,
+}, async () => {
+  requireBuiltArtifacts()
+  const playwright = await importPlaywright()
+  const runtime = await importCli()
+  const created = playwright.createManagedPlaywrightJobRequest({
+    provider: 'qwen',
+    target: { kind: 'provider_home', url: 'https://chat.qwen.ai/' },
+    taskId: 'v3-qwen-provider',
+    browserVisibility: 'headless',
+    actions: [
+      {
+        requestId: 'v3-action',
+        action: playwright.VISIBLE_ACTIONS.AUTH_STATUS,
+        payload: {},
+      },
+    ],
+  })
+  assert.equal(created.protocol, runtime.MANAGED_PLAYWRIGHT_JOB_SCHEMA_ID)
+  assert.equal(created.protocol, runtime.MANAGED_PLAYWRIGHT_JOB_SCHEMA_ID_V3)
+  assert.equal(created.provider, 'qwen')
+  assert.equal(created.target.url, 'https://chat.qwen.ai/')
+  assert.equal(created.capabilityRoute, null)
+  assert.equal(created.actions[0].provider, 'qwen')
+  assert.equal(created.actions[0].protocol, runtime.VISIBLE_ACTION_SCHEMA_ID)
+  assert.equal(created.actions[0].protocol, runtime.VISIBLE_ACTION_SCHEMA_ID_V3)
+
+  const forcedReplacement = playwright.createManagedPlaywrightJobRequest({
+    provider: 'qwen',
+    target: { kind: 'provider_home', url: 'https://chat.qwen.ai/' },
+    taskId: 'v3-explicit-tab-replacement',
+    pagePolicy: 'replace',
+    browserVisibility: 'headless',
+    actions: [
+      {
+        requestId: 'v3-explicit-tab-replacement-action',
+        action: playwright.VISIBLE_ACTIONS.AUTH_STATUS,
+        payload: {},
+      },
+    ],
+  })
+  assert.equal(forcedReplacement.pagePolicy, 'replace')
+  assert.equal(playwright.validateManagedPlaywrightJobRequest(forcedReplacement).pagePolicy, 'replace')
+  assert.throws(
+    () => playwright.createManagedPlaywrightJobRequest({
+      provider: 'qwen',
+      pagePolicy: 'reuse-any-tab',
+      actions: [{ action: playwright.VISIBLE_ACTIONS.AUTH_STATUS, payload: {} }],
+    }),
+    (error) => {
+      assert.equal(error.code, 'invalid_managed_page_policy')
+      return true
+    },
+  )
+
+  const v3Validated = playwright.validateManagedPlaywrightJobRequest({
+    protocol: runtime.MANAGED_PLAYWRIGHT_JOB_SCHEMA_ID_V3,
+    provider: 'qwen',
+    target: { kind: 'provider_home', url: 'https://chat.qwen.ai/' },
+    taskId: 'v3-explicit-qwen-provider',
+    browserVisibility: 'headless',
+    actions: [
+      {
+        protocol: runtime.VISIBLE_ACTION_SCHEMA_ID_V3,
+        requestId: 'v3-explicit-action',
+        provider: 'qwen',
+        action: playwright.VISIBLE_ACTIONS.AUTH_STATUS,
+        payload: {},
+      },
+    ],
+  })
+  assert.equal(v3Validated.provider, 'qwen')
+  assert.equal(v3Validated.capabilityRoute, null)
+  assert.equal(v3Validated.actions[0].provider, 'qwen')
+
+  const routeDecision = playwright.resolveTaskCapabilityRoute({
+    requirements: [playwright.TASK_CAPABILITIES.CONVERSATION_CHAT],
+    candidates: [{ provider: 'qwen', runtimeEligibility: 'unchecked' }],
+  })
+  assert.equal(routeDecision.ok, true)
+  const rankedRoutes = playwright.resolveTaskCapabilityRoutes({
+    requirements: [playwright.TASK_CAPABILITIES.CONVERSATION_CHAT],
+    candidates: [
+      { provider: 'qwen', runtimeEligibility: 'eligible', preferenceRank: 0 },
+      { provider: 'chatgpt', runtimeEligibility: 'eligible', preferenceRank: 1 },
+    ],
+  })
+  assert.equal(rankedRoutes.ok, true)
+  assert.deepEqual(rankedRoutes.routes.map((route) => route.provider), ['chatgpt', 'qwen'])
+  assert.deepEqual(
+    rankedRoutes.evaluated.map((evaluation) => [evaluation.provider, evaluation.rank, evaluation.support]),
+    [['qwen', 2, 'experimental'], ['chatgpt', 1, 'supported']],
+  )
+  const completeSetRoutes = playwright.resolveTaskCapabilityRoutes({
+    requirements: [
+      playwright.TASK_CAPABILITIES.CONVERSATION_CHAT,
+      playwright.TASK_CAPABILITIES.FILE_UPLOAD,
+    ],
+    candidates: [
+      { provider: 'gemini', runtimeEligibility: 'eligible', preferenceRank: 0 },
+      { provider: 'chatgpt', runtimeEligibility: 'eligible', preferenceRank: 1 },
+    ],
+  })
+  assert.equal(completeSetRoutes.ok, true)
+  assert.deepEqual(completeSetRoutes.routes.map((route) => route.provider), ['chatgpt'])
+  assert.deepEqual(completeSetRoutes.evaluated[0].missingCapabilities, [playwright.TASK_CAPABILITIES.FILE_UPLOAD])
+  const routed = playwright.createManagedPlaywrightJobRequest({
+    provider: 'qwen',
+    target: { kind: 'provider_home', url: 'https://chat.qwen.ai/' },
+    taskId: 'v3-qwen-capability-route',
+    capabilityRoute: routeDecision.route,
+    browserVisibility: 'headless',
+    actions: [
+      {
+        requestId: 'v3-routed-action',
+        action: playwright.VISIBLE_ACTIONS.AUTH_STATUS,
+        payload: {},
+      },
+    ],
+  })
+  assert.deepEqual(routed.capabilityRoute, routeDecision.route)
+  assert.equal(routed.context.schema, 'tokenless.context-envelope.v1')
+  assert.deepEqual(routed.context.requirements, [playwright.TASK_CAPABILITIES.CONVERSATION_CHAT])
+
+  assert.throws(
+    () => playwright.validateManagedPlaywrightJobRequest({
+      ...routed,
+      capabilityRoute: {
+        ...routed.capabilityRoute,
+        evidence: ['invented-evidence'],
+      },
+    }),
+    (error) => {
+      assert.equal(error.code, 'invalid_playwright_job_capability_route')
+      return true
+    }
+  )
+
+  const chatgptPortableRoute = playwright.resolveTaskCapabilityRoute({
+    requirements: [
+      playwright.TASK_CAPABILITIES.CONVERSATION_CHAT,
+      playwright.TASK_CAPABILITIES.FILE_UPLOAD,
+    ],
+    candidates: [{ provider: 'chatgpt', runtimeEligibility: 'eligible' }],
+  })
+  assert.equal(chatgptPortableRoute.ok, true)
+  const chatgptChatRoute = playwright.resolveTaskCapabilityRoute({
+    requirements: [playwright.TASK_CAPABILITIES.CONVERSATION_CHAT],
+    candidates: [{ provider: 'chatgpt', runtimeEligibility: 'eligible' }],
+  })
+  assert.equal(chatgptChatRoute.ok, true)
+  assert.throws(
+    () => playwright.createManagedPlaywrightJobRequest({
+      provider: 'chatgpt',
+      capabilityRoute: chatgptChatRoute.route,
+      actions: [{
+        requestId: 'under-declared-file-action',
+        action: playwright.VISIBLE_ACTIONS.FILE_UPLOAD,
+        payload: {
+          attachments: [{
+            protocol: runtime.VISIBLE_ATTACHMENT_SCHEMA_ID,
+            bundleId: 'under-declared-bundle',
+            attachmentId: 'under-declared-attachment',
+            name: 'evidence.txt',
+            type: 'text/plain',
+            size: 8,
+            sha256: 'a'.repeat(64),
+          }],
+        },
+      }],
+    }),
+    (error) => {
+      assert.equal(error.code, 'invalid_playwright_job_capability_requirements')
+      assert.deepEqual(error.details.missing, [playwright.TASK_CAPABILITIES.FILE_UPLOAD])
+      return true
+    },
+  )
+  assert.throws(
+    () => playwright.createManagedPlaywrightJobRequest({
+      provider: 'chatgpt',
+      capabilityRoute: chatgptPortableRoute.route,
+      actions: [{
+        requestId: 'semantic-image-action',
+        action: playwright.VISIBLE_ACTIONS.FILE_UPLOAD,
+        payload: {
+          attachments: [{
+            protocol: runtime.VISIBLE_ATTACHMENT_SCHEMA_ID,
+            bundleId: 'semantic-image-bundle',
+            attachmentId: 'semantic-image-attachment',
+            name: 'evidence.png',
+            type: 'image/png',
+            size: 8,
+            sha256: 'b'.repeat(64),
+          }],
+        },
+      }],
+    }),
+    (error) => {
+      assert.equal(error.code, 'invalid_playwright_job_capability_requirements')
+      assert.deepEqual(error.details.missing, [playwright.TASK_CAPABILITIES.IMAGE_INPUT])
+      return true
+    },
+  )
+
+  assert.throws(
+    () => playwright.validateManagedPlaywrightJobRequest({
+      protocol: runtime.MANAGED_PLAYWRIGHT_JOB_SCHEMA_ID_V3,
+      provider: 'future-ai',
+      target: { kind: 'provider_home', url: 'https://future.example/' },
+      taskId: 'registry-rejects-unknown-provider',
+      browserVisibility: 'headless',
+      actions: [
+        {
+          protocol: runtime.VISIBLE_ACTION_SCHEMA_ID_V3,
+          requestId: 'unknown-provider-action',
+          provider: 'future-ai',
+          action: playwright.VISIBLE_ACTIONS.AUTH_STATUS,
+          payload: {},
+        },
+      ],
+    }),
+    (error) => {
+      assert.equal(error.code, 'unknown_playwright_job_provider')
+      return true
+    }
+  )
+})
+
+test('SQLite atomically preserves provider fallback attempts under one durable job id', async () => {
+  requireBuiltArtifacts()
+  const homeDir = tempHome('tokenless-provider-fallback-store-')
+  const { JobStore } = await import(`${pathToFileURL(path.join(cliDir, 'dist/src/daemon/job-store.js')).href}?test=${randomUUID()}`)
+  const playwright = await importPlaywright()
+  let store = await JobStore.open(homeDir)
+  try {
+    const chatgptRoute = playwright.resolveTaskCapabilityRoute({
+      requirements: [playwright.TASK_CAPABILITIES.CONVERSATION_CHAT],
+      candidates: [{ provider: 'chatgpt', runtimeEligibility: 'eligible' }],
+    })
+    const claudeRoute = playwright.resolveTaskCapabilityRoute({
+      requirements: [playwright.TASK_CAPABILITIES.CONVERSATION_CHAT],
+      candidates: [{ provider: 'claude', runtimeEligibility: 'eligible' }],
+    })
+    assert.equal(chatgptRoute.ok, true)
+    assert.equal(claudeRoute.ok, true)
+    const alternative = playwright.createManagedPlaywrightJobRequest({
+      provider: 'claude',
+      taskId: 'fallback-store-task',
+      capabilityRoute: claudeRoute.route,
+      actions: [{ requestId: 'fallback-prompt', action: playwright.VISIBLE_ACTIONS.PROMPT_INPUT, payload: { text: 'fallback' } }],
+    })
+    const baseRequest = playwright.createManagedPlaywrightJobRequest({
+      provider: 'chatgpt',
+      taskId: 'fallback-store-task',
+      capabilityRoute: chatgptRoute.route,
+      fallback: {
+        protocol: 'tokenless.provider-fallback.v1',
+        mode: 'automatic',
+        replay: 'from_start',
+        alternatives: [{
+          provider: alternative.provider,
+          target: alternative.target,
+          capabilityRoute: alternative.capabilityRoute,
+        }],
+      },
+      actions: [{ requestId: 'primary-prompt', action: playwright.VISIBLE_ACTIONS.PROMPT_INPUT, payload: { text: 'fallback' } }],
+    })
+    const request = playwright.validateManagedPlaywrightJobRequest({
+      ...baseRequest,
+      context: {
+        ...baseRequest.context,
+        instructions: [{ role: 'developer', content: 'fallback', provenance: 'upstream_agent' }],
+        outputContract: { language: 'en', format: 'plain_text' },
+        constraints: { tokenBudget: 64, deadline: '2030-01-01T00:00:00.000Z' },
+        upstream: { agentKind: 'codex', sessionId: 'fallback-session', state: { phase: 'portable' } },
+      },
+    })
+    const created = store.createJob({
+      provider: request.provider,
+      action: managedPlaywrightJobAction,
+      request_json: request,
+      profile_id: 'fallback-profile',
+    })
+    const claimed = store.claimJob(created.job_id, created.claim_token)
+    store.markRunning(claimed.job_id, claimed.claim_token)
+    const fallbackRequest = playwright.validateManagedPlaywrightJobRequest({
+      ...request,
+      provider: alternative.provider,
+      target: alternative.target,
+      capabilityRoute: alternative.capabilityRoute,
+      fallback: null,
+      context: request.context,
+      actions: request.actions.map((action) => ({ ...action, provider: alternative.provider })),
+    })
+    const queued = store.fallbackJob({
+      job_id: claimed.job_id,
+      claim_token: claimed.claim_token,
+      provider: 'claude',
+      request_json: fallbackRequest,
+      blocker_json: { blocker: { code: 'visible_cloudflare_turnstile' } },
+    })
+    assert.equal(queued.job_id, created.job_id)
+    assert.equal(queued.provider, 'claude')
+    assert.equal(queued.status, 'queued')
+    assert.equal(queued.provider_attempts_json.length, 2)
+    assert.equal(queued.provider_attempts_json[0].status, 'blocked')
+    assert.equal(queued.provider_attempts_json[0].blocker.blocker.code, 'visible_cloudflare_turnstile')
+    assert.deepEqual(queued.request_json.context, request.context)
+    const fallbackClaim = store.claimJob(queued.job_id, queued.claim_token)
+    store.markRunning(fallbackClaim.job_id, fallbackClaim.claim_token)
+    store.completeJob(fallbackClaim.job_id, fallbackClaim.claim_token, { result_json: { provider: 'claude' } })
+    store.close()
+    store = await JobStore.open(homeDir)
+    const completed = store.getJob(created.job_id)
+    assert.equal(completed.status, 'succeeded')
+    assert.deepEqual(completed.request_json.context, request.context)
+    assert.deepEqual(completed.provider_attempts_json.map((attempt) => [attempt.provider, attempt.status]), [
+      ['chatgpt', 'blocked'],
+      ['claude', 'succeeded'],
+    ])
+  } finally {
+    store.close()
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('TS daemon browser runtime control is authenticated, quiesces queued work, and wakes on later job creation', {
+  timeout: 60_000,
+}, async () => {
+  requireBuiltArtifacts()
+  const homeDir = tempHome('tokenless-ts-browser-runtime-control-')
+  const profileId = randomUUID()
+  const daemon = await startTsDaemon(homeDir)
+  try {
+    const token = readControlToken(homeDir)
+
+    const missingStatus = await fetch(`${daemon.url}/control/browser-runtime/status`)
+    assert.equal(missingStatus.status, 401)
+    const missingStatusBody = await missingStatus.json()
+    assert.equal(missingStatusBody.error.code, 'control_auth_missing')
+
+    const rejectedQuiesce = await fetch(`${daemon.url}/control/browser-runtime/quiesce`, {
+      method: 'POST',
+      headers: { authorization: 'Bearer wrong-token' },
+    })
+    assert.equal(rejectedQuiesce.status, 403)
+    const rejectedQuiesceBody = await rejectedQuiesce.json()
+    assert.equal(rejectedQuiesceBody.error.code, 'control_auth_rejected')
+    assert.equal(JSON.stringify(rejectedQuiesceBody).includes(token), false)
+
+    const running = await daemonRequest(daemon.url, token, 'GET', '/control/browser-runtime/status')
+    assert.equal(Object.hasOwn(running, 'protocol'), false)
+    assert.equal(running.status, 'running')
+    assert.equal(running.pid, daemon.child.pid)
+    assert.equal(running.activeProfileCount, 0)
+    assert.equal(running.activeJobCount, 0)
+
+    const pausedJobId = randomUUID()
+    await daemonRequest(daemon.url, token, 'POST', '/jobs', {
+      provider: 'chatgpt',
+      action: managedPlaywrightJobAction,
+      execution_backend: 'playwright',
+      profile_id: profileId,
+      job_id: pausedJobId,
+      request_json: { malformed: true },
+    })
+    const quiesced = await daemonRequest(daemon.url, token, 'POST', '/control/browser-runtime/quiesce')
+    assert.equal(quiesced.status, 'quiesced')
+    assert.equal(quiesced.activeProfileCount, 0)
+    assert.equal(quiesced.activeJobCount, 0)
+
+    await delay(1_500)
+    const stillQueued = await daemonRequest(daemon.url, token, 'GET', `/jobs/${encodeURIComponent(pausedJobId)}`)
+    assert.equal(stillQueued.status, 'queued')
+    const profile = createReadyManagedProfile(homeDir, { profileId })
+    assertProfileDirectoryEmpty(profile.directory)
+
+    const wakeJobId = randomUUID()
+    await daemonRequest(daemon.url, token, 'POST', '/jobs', {
+      provider: 'chatgpt',
+      action: managedPlaywrightJobAction,
+      execution_backend: 'playwright',
+      profile_id: profileId,
+      job_id: wakeJobId,
+      request_json: { malformed: true },
+    })
+    const failedPausedJob = await waitForDaemonJobStatus(daemon.url, token, pausedJobId, 'failed', 10_000)
+    assert.equal(failedPausedJob.error_json.code, 'invalid_playwright_job_request')
+    const failedWakeJob = await waitForDaemonJobStatus(daemon.url, token, wakeJobId, 'failed', 10_000)
+    assert.equal(failedWakeJob.error_json.code, 'invalid_playwright_job_request')
+    const awake = await daemonRequest(daemon.url, token, 'GET', '/control/browser-runtime/status')
+    assert.equal(awake.status, 'running')
+    assertProfileDirectoryEmpty(profile.directory)
+  } finally {
+    await shutdownDaemon(daemon).catch(() => undefined)
+    await terminateChildrenForHome(homeDir)
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+for (const browserConnectionMode of ['playwright', 'cdp']) {
+test(`profiles open without provider uses ${browserConnectionMode} through daemon browser runtime control`, {
+  timeout: 60_000,
+}, async () => {
+  requireBuiltArtifacts()
+  const homeDir = tempHome('tokenless-ts-profile-open-providerless-')
+  const profile = createReadyManagedProfile(homeDir)
+  const runtime = await importCli()
+  const { chromium } = await import('playwright-core')
+  const previousExecutable = process.env.TOKENLESS_BROWSER_EXECUTABLE
+  const previousProvider = process.env.TOKENLESS_PROVIDER
+  process.env.TOKENLESS_BROWSER_EXECUTABLE = chromium.executablePath()
+  process.env.TOKENLESS_PROVIDER = 'claude'
+  let daemon
+  try {
+    await runtime.writeTokenlessConfig({ homeDir, browser: 'profile', browserConnectionMode })
+    daemon = await startTsDaemon(homeDir)
+    await runtime.writeTokenlessConfig({ homeDir, daemonUrl: daemon.url })
+
+    const result = runCli([
+      'profiles',
+      'open',
+      '--home',
+      homeDir,
+      '--json',
+    ])
+    assert.equal(result.status, 0, result.stderr || result.stdout)
+    const payload = JSON.parse(result.stdout)
+    assert.equal(payload.ok, true)
+    assert.equal(payload.command, 'profiles.open')
+    assert.equal(payload.transport, 'daemon')
+    assert.equal(payload.backend, 'playwright')
+    assert.equal(payload.profile.slug, 'default')
+    assert.equal(payload.profile.id, profile.id)
+    assert.equal(Object.hasOwn(payload, 'provider'), false)
+    assert.equal(Object.hasOwn(payload, 'jobId'), false)
+    assert.equal(Object.hasOwn(payload, 'result'), false)
+    assert.equal(payload.browser.requestedVisibility, 'headed')
+    assert.equal(payload.browser.effectiveVisibility, 'headed')
+    assert.equal(payload.runner.runtime, 'embedded')
+    assert.equal(payload.runner.runtimeStatus, 'running')
+    assert.equal(payload.runner.activeProfileCount, 1)
+
+    const token = readControlToken(homeDir)
+    const jobs = await daemonRequest(daemon.url, token, 'GET', `/jobs?profile_id=${encodeURIComponent(profile.id)}`)
+    assert.deepEqual(jobs, [])
+  } finally {
+    if (previousExecutable === undefined) delete process.env.TOKENLESS_BROWSER_EXECUTABLE
+    else process.env.TOKENLESS_BROWSER_EXECUTABLE = previousExecutable
+    if (previousProvider === undefined) delete process.env.TOKENLESS_PROVIDER
+    else process.env.TOKENLESS_PROVIDER = previousProvider
+    await shutdownDaemon(daemon).catch(() => undefined)
+    await terminateChildrenForHome(homeDir)
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+}
+
+test('profile removal quiesces the TS browser runtime while preserving the old runner JSON shape', {
+  timeout: 60_000,
+}, async () => {
+  requireBuiltArtifacts()
+  const homeDir = tempHome('tokenless-ts-profile-remove-quiesce-')
+  createReadyManagedProfile(homeDir)
+  const daemon = await startTsDaemon(homeDir)
+  try {
+    const runtime = await importCli()
+    await runtime.writeTokenlessConfig({ homeDir, daemonUrl: daemon.url })
+    const result = runCli([
+      'profiles',
+      'remove',
+      '--home',
+      homeDir,
+      '--profile',
+      'default',
+      '--confirm-delete',
+      '--json',
+    ])
+    assert.equal(result.status, 0, result.stderr || result.stdout)
+    const payload = JSON.parse(result.stdout)
+    assert.equal(payload.ok, true)
+    assert.deepEqual(payload.runner, {
+      state: 'stopped',
+      pid: null,
+      sessionId: null,
+      safeToStop: false,
+      heartbeatAt: null,
+    })
+    assert.deepEqual(Object.keys(payload.runner).sort(), ['heartbeatAt', 'pid', 'safeToStop', 'sessionId', 'state'].sort())
+    const token = readControlToken(homeDir)
+    const status = await daemonRequest(daemon.url, token, 'GET', '/control/browser-runtime/status')
+    assert.equal(status.status, 'quiesced')
+  } finally {
+    await shutdownDaemon(daemon).catch(() => undefined)
+    await terminateChildrenForHome(homeDir)
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+test('TS daemon closes when the embedded managed Playwright scheduler exits fatally', {
+  timeout: 30_000,
+}, async () => {
+  requireBuiltArtifacts()
+  const homeDir = tempHome('tokenless-ts-embedded-scheduler-fatal-')
+  createOverlyPermissiveManagedProfileRegistry(homeDir)
+  const port = await freePort()
+  const url = `http://127.0.0.1:${port}`
+  const child = spawn(process.execPath, [
+    tsDaemonEntry,
+    '--home',
+    homeDir,
+    'serve',
+    '--host',
+    '127.0.0.1',
+    '--port',
+    String(port),
+  ], {
+    cwd: root,
+    env: { ...process.env, TOKENLESS_HOME: homeDir },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  })
+  trackChild(child, homeDir)
+  let stderr = ''
+  child.stderr?.on('data', (chunk) => {
+    stderr += chunk.toString('utf8')
+  })
+  try {
+    const exit = await waitForExitResult(child, 10_000)
+    assert.equal(exit.code, 1, `expected scheduler fatal exit; got ${JSON.stringify(exit)}\nstderr:\n${stderr}`)
+    await assert.rejects(fetch(`${url}/ready?challenge=${randomBytes(32).toString('base64url')}`))
+  } finally {
+    await terminateChildrenForHome(homeDir)
+    fs.rmSync(homeDir, { recursive: true, force: true })
+  }
+})
+
+async function startTsDaemon(homeDir) {
+  const port = await freePort()
+  const child = spawn(process.execPath, [
+    tsDaemonEntry,
+    '--home',
+    homeDir,
+    'serve',
+    '--host',
+    '127.0.0.1',
+    '--port',
+    String(port),
+  ], {
+    cwd: root,
+    env: { ...process.env, TOKENLESS_HOME: homeDir },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  })
+  return waitForDaemon(child, `http://127.0.0.1:${port}`, homeDir, 'TS')
+}
+
+async function waitForDaemon(child, url, homeDir, label) {
+  trackChild(child, homeDir)
+  let stdout = ''
+  let stderr = ''
+  child.stdout?.on('data', (chunk) => {
+    stdout += chunk.toString('utf8')
+  })
+  child.stderr?.on('data', (chunk) => {
+    stderr += chunk.toString('utf8')
+  })
+  const exited = new Promise((resolve) => {
+    child.once('exit', (code, signal) => resolve({ code, signal }))
+  })
+  const deadline = Date.now() + 10_000
+  let lastError
+  while (Date.now() < deadline) {
+    const exit = await Promise.race([exited, delay(50).then(() => null)])
+    if (exit) {
+      throw new Error(`${label} daemon exited before ready: ${JSON.stringify(exit)}\nstdout:\n${stdout}\nstderr:\n${stderr}`)
+    }
+    try {
+      const ready = await readyProbe(url)
+      assert.equal(ready.ready, true)
+      assert.equal(Object.hasOwn(ready, 'protocol'), false)
+      assert.equal(ready.home_dir, homeDir)
+      return { child, url, homeDir, label }
+    } catch (error) {
+      lastError = error
+    }
+  }
+  throw new Error(`${label} daemon did not become ready: ${lastError?.message ?? lastError}\nstdout:\n${stdout}\nstderr:\n${stderr}`)
+}
+
+async function shutdownDaemon(daemon) {
+  if (!daemon) return null
+  const token = readControlToken(daemon.homeDir)
+  const body = await daemonRequest(daemon.url, token, 'POST', '/control/shutdown')
+  await waitForExit(daemon.child, 5_000)
+  createdChildren.delete(daemon.child)
+  return body
+}
+
+async function daemonRequest(daemonUrl, token, method, requestPath, body) {
+  const init = {
+    method,
+    headers: jsonHeaders(token),
+  }
+  if (body !== undefined) init.body = JSON.stringify(body)
+  const response = await fetch(`${daemonUrl}${requestPath}`, init)
+  const text = await response.text()
+  let payload = null
+  if (text) payload = JSON.parse(text)
+  assert.equal(response.ok, true, `${method} ${requestPath} returned ${response.status}: ${text}`)
+  return payload
+}
+
+function jsonHeaders(token) {
+  return {
+    accept: 'application/json',
+    authorization: `Bearer ${token}`,
+    'content-type': 'application/json',
+  }
+}
+
+async function readyProbe(daemonUrl, challenge = randomBytes(32).toString('base64url')) {
+  const response = await fetch(`${daemonUrl}/ready?challenge=${challenge}`)
+  const text = await response.text()
+  assert.equal(response.ok, true, `/ready returned ${response.status}: ${text}`)
+  return JSON.parse(text)
+}
+
+function readyProof(token, challenge, homeDir) {
+  return createHmac('sha256', token)
+    .update(lengthPrefixedMessage([
+      challenge,
+      homeDir,
+    ]))
+    .digest('base64url')
+}
+
+function lengthPrefixedMessage(fields) {
+  return Buffer.concat(fields.flatMap((field) => {
+    const value = Buffer.from(field, 'utf8')
+    const length = Buffer.allocUnsafe(4)
+    length.writeUInt32BE(value.length)
+    return [length, value]
+  }))
+}
+
+async function importCli() {
+  return await import(`${pathToFileURL(cliIndex).href}?test=${Date.now()}-${Math.random()}`)
+}
+
+async function importPlaywright() {
+  return await import(`${pathToFileURL(path.join(cliDir, 'dist/src/playwright/index.js')).href}?test=${Date.now()}-${Math.random()}`)
+}
+
+function runCli(args) {
+  return spawnSync(process.execPath, [cliEntry, ...args], {
+    cwd: root,
+    env: { ...process.env },
+    encoding: 'utf8',
+    timeout: 30_000,
+  })
+}
+
+function createReadyManagedProfile(homeDir, options = {}) {
+  const browserDir = path.join(homeDir, 'browser')
+  const profilesRoot = path.join(browserDir, 'profiles')
+  const profileId = options.profileId ?? randomUUID()
+  const profileDir = path.join(profilesRoot, profileId)
+  fs.mkdirSync(profileDir, { recursive: true, mode: 0o700 })
+  const now = new Date().toISOString()
+  fs.writeFileSync(path.join(browserDir, 'profiles.json'), `${JSON.stringify({
+    version: 1,
+    defaultProfile: 'default',
+    profiles: {
+      default: {
+        slug: 'default',
+        id: profileId,
+        label: 'Default',
+        labelOrigin: 'slug',
+        directory: profileDir,
+        lifecycle: 'ready',
+        createdAt: now,
+        updatedAt: now,
+        lastObservedAuth: {},
+      },
+    },
+  }, null, 2)}\n`, { mode: 0o600 })
+  return { id: profileId, directory: profileDir }
+}
+
+function assertProfileDirectoryEmpty(profileDir) {
+  assert.deepEqual(fs.readdirSync(profileDir).sort(), [])
+}
+
+function createOverlyPermissiveManagedProfileRegistry(homeDir) {
+  const browserDir = path.join(homeDir, 'browser')
+  const profilesRoot = path.join(browserDir, 'profiles')
+  fs.mkdirSync(profilesRoot, { recursive: true, mode: 0o700 })
+  const registryPath = path.join(browserDir, 'profiles.json')
+  fs.writeFileSync(registryPath, `${JSON.stringify({
+    version: 1,
+    defaultProfile: null,
+    profiles: {},
+  }, null, 2)}\n`, { mode: 0o644 })
+  fs.chmodSync(registryPath, 0o644)
+}
+
+async function waitForDaemonJobStatus(daemonUrl, token, jobId, status, timeoutMs) {
+  const deadline = Date.now() + timeoutMs
+  let latest
+  while (Date.now() < deadline) {
+    latest = await daemonRequest(daemonUrl, token, 'GET', `/jobs/${encodeURIComponent(jobId)}`)
+    if (latest.status === status) return latest
+    await delay(100)
+  }
+  throw new Error(`job ${jobId} did not reach ${status}; latest: ${JSON.stringify(latest)}`)
+}
+
+async function waitForDaemonJobOneOf(daemonUrl, token, jobId, statuses, timeoutMs) {
+  const expected = new Set(statuses)
+  const deadline = Date.now() + timeoutMs
+  let latest
+  while (Date.now() < deadline) {
+    latest = await daemonRequest(daemonUrl, token, 'GET', `/jobs/${encodeURIComponent(jobId)}`)
+    if (expected.has(latest.status)) return latest
+    await delay(100)
+  }
+  throw new Error(`job ${jobId} did not reach one of ${statuses.join(', ')}; latest: ${JSON.stringify(latest)}`)
+}
+
+function trackChild(child, homeDir) {
+  child.tokenlessHome = homeDir
+  createdChildren.add(child)
+  child.once('exit', () => {
+    createdChildren.delete(child)
+  })
+}
+
+async function terminateChildrenForHome(homeDir) {
+  await Promise.all([...createdChildren]
+    .filter((child) => child.tokenlessHome === homeDir)
+    .map((child) => terminateChild(child)))
+}
+
+async function killChild(child) {
+  if (!child || child.exitCode !== null || child.signalCode !== null) {
+    if (child) createdChildren.delete(child)
+    return
+  }
+  child.kill('SIGKILL')
+  await waitForExit(child, 5_000).catch(() => undefined)
+  createdChildren.delete(child)
+}
+
+async function terminateChild(child) {
+  if (!child || child.exitCode !== null || child.signalCode !== null) {
+    if (child) createdChildren.delete(child)
+    return
+  }
+  child.kill('SIGTERM')
+  try {
+    await waitForExit(child, 2_000)
+  } catch {
+    child.kill('SIGKILL')
+    await waitForExit(child, 2_000).catch(() => undefined)
+  } finally {
+    createdChildren.delete(child)
+  }
+}
+
+function waitForExit(child, timeoutMs) {
+  if (child.exitCode !== null || child.signalCode !== null) return Promise.resolve()
+  return new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      child.off('exit', onExit)
+      reject(new Error(`process ${child.pid} did not exit within ${timeoutMs} ms`))
+    }, timeoutMs)
+    const onExit = () => {
+      clearTimeout(timeout)
+      resolve()
+    }
+    child.once('exit', onExit)
+  })
+}
+
+function waitForExitResult(child, timeoutMs) {
+  if (child.exitCode !== null || child.signalCode !== null) {
+    return Promise.resolve({ code: child.exitCode, signal: child.signalCode })
+  }
+  return new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      child.off('exit', onExit)
+      reject(new Error(`process ${child.pid} did not exit within ${timeoutMs} ms`))
+    }, timeoutMs)
+    const onExit = (code, signal) => {
+      clearTimeout(timeout)
+      resolve({ code, signal })
+    }
+    child.once('exit', onExit)
+  })
+}
+
+function tempHome(prefix) {
+  return fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), prefix)))
+}
+
+function readControlToken(homeDir) {
+  return fs.readFileSync(path.join(homeDir, 'daemon.token'), 'utf8').trim()
+}
+
+function assertUnixRestrictivePermissions(homeDir) {
+  if (process.platform === 'win32') return
+  assert.equal(fileMode(homeDir), 0o700)
+  assert.equal(fileMode(path.join(homeDir, 'daemon.token')), 0o600)
+  assert.equal(fileMode(path.join(homeDir, 'tokenless.sqlite3')), 0o600)
+}
+
+function fileMode(filePath) {
+  return fs.statSync(filePath).mode & 0o777
+}
+
+async function freePort() {
+  return new Promise((resolve, reject) => {
+    const server = net.createServer()
+    server.unref()
+    server.once('error', reject)
+    server.listen(0, '127.0.0.1', () => {
+      const address = server.address()
+      server.close(() => {
+        if (!address || typeof address === 'string') reject(new Error('failed to allocate a port'))
+        else resolve(address.port)
+      })
+    })
+  })
+}
+
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms))
+}
+
+function requireBuiltArtifacts() {
+  assert.equal(fs.existsSync(tsDaemonEntry), true, `missing compiled TS daemon: ${tsDaemonEntry}`)
+}
diff --git a/test/upgrade-command.test.mjs b/test/upgrade-command.test.mjs
deleted file mode 100644
index b5baf5c..0000000
--- a/test/upgrade-command.test.mjs
+++ /dev/null
@@ -1,586 +0,0 @@
-import assert from 'node:assert/strict'
-import { createHash } from 'node:crypto'
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import { spawn } from 'node:child_process'
-import test from 'node:test'
-import { fileURLToPath, pathToFileURL } from 'node:url'
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-const cliEntry = path.join(root, 'packages/cli/dist/src/tokenless.mjs')
-const upgradeModuleUrl = pathToFileURL(path.join(root, 'packages/cli/dist/src/upgrade.js')).href
-
-test('upgrade installs npm package, verifies global entrypoint, refreshes skills, then hands off to the new CLI', async () => {
-  const fixture = createFixture('tokenless-upgrade-success-')
-  try {
-    const { runUpgradeCommand } = await import(upgradeModuleUrl)
-    const globalRoot = path.join(fixture.root, 'global')
-    const entrypoint = writeGlobalTokenlessPackage(globalRoot, '9.9.9')
-    const calls = []
-    const progress = []
-    const result = await runUpgradeCommand({
-      json: true,
-      home: fixture.home,
-      daemonUrl: 'http://127.0.0.1:7777',
-      browser: 'chrome',
-      browsers: 'chrome,brave',
-      daemonStartTimeoutMs: '1234',
-      files: [],
-      attachFiles: [],
-    }, {
-      runProcess: fakeUpgradeProcess({
-        globalRoot,
-        version: '9.9.9',
-        calls,
-        installPayload: { ok: true, phase: 'install' },
-        doctorPayload: { ok: true, phase: 'doctor' },
-      }),
-      installSkills: async () => {
-        calls.push({ kind: 'skills' })
-        return { check: { ok: true } }
-      },
-      onProgress: (event) => progress.push(event),
-      lockDir: fixture.locks,
-    })
-
-    assert.equal(result.ok, true)
-    assert.equal(result.cli.beforeVersion, '0.2.0')
-    assert.equal(result.cli.afterVersion, '9.9.9')
-    assert.equal(result.phases.resolveGlobalCli.entrypoint, fs.realpathSync(entrypoint))
-    assert.deepEqual(calls.map((call) => call.kind), ['npm-install', 'npm-root', 'version', 'skills', 'install', 'doctor'])
-    assert.deepEqual(calls.find((call) => call.kind === 'install').args.slice(1), [
-      'install',
-      '--json',
-      '--home',
-      fixture.home,
-      '--daemon-url',
-      'http://127.0.0.1:7777',
-      '--browser',
-      'chrome',
-      '--browsers',
-      'chrome,brave',
-      '--daemon-start-timeout-ms',
-      '1234',
-    ])
-    assert.deepEqual(calls.find((call) => call.kind === 'doctor').args.slice(1), [
-      'doctor',
-      '--json',
-      '--home',
-      fixture.home,
-      '--daemon-url',
-      'http://127.0.0.1:7777',
-      '--browser',
-      'chrome',
-      '--daemon-start-timeout-ms',
-      '1234',
-    ])
-    assert.deepEqual(progress.map(({ phase, status }) => `${phase}:${status}`), [
-      'npmInstall:started',
-      'npmInstall:succeeded',
-      'resolveGlobalCli:started',
-      'resolveGlobalCli:succeeded',
-      'skills:started',
-      'skills:succeeded',
-      'runtimeInstall:started',
-      'runtimeInstall:succeeded',
-      'doctor:started',
-      'doctor:succeeded',
-    ])
-    assert.equal(fs.existsSync(path.join(fixture.locks, `upgrade-${lockOwnerKey()}.lock`)), false)
-  } finally {
-    fixture.remove()
-  }
-})
-
-test('upgrade formats concise human progress and summary without changing the JSON result', async () => {
-  const { formatUpgradeProgress, formatUpgradeSummary } = await import(upgradeModuleUrl)
-  assert.equal(formatUpgradeProgress({
-    phase: 'npmInstall',
-    label: 'Updating global CLI',
-    status: 'started',
-  }), '  - Updating global CLI...')
-  assert.equal(formatUpgradeProgress({
-    phase: 'doctor',
-    label: 'Running doctor',
-    status: 'failed',
-    errorCode: 'tokenless_doctor_unhealthy',
-  }), '  X Running doctor (tokenless_doctor_unhealthy)')
-  assert.equal(formatUpgradeSummary({
-    ok: true,
-    cli: { beforeVersion: '0.2.0', afterVersion: '0.2.1' },
-    phases: { doctor: { ok: true } },
-  }), 'Tokenless upgraded from 0.2.0 to 0.2.1. Skills and local runtime are current; doctor is healthy.')
-  assert.equal(formatUpgradeSummary({
-    ok: false,
-    cli: { beforeVersion: '0.2.0', afterVersion: '0.2.1' },
-    phases: { skills: { ok: false, error: { code: 'tokenless_skill_refresh_failed' } } },
-  }), 'Tokenless upgrade stopped at Refreshing agent skills (tokenless_skill_refresh_failed). Resolve that failure, then rerun tokenless upgrade.')
-})
-
-test('upgrade stops before global resolution when npm install fails', async () => {
-  const fixture = createFixture('tokenless-upgrade-npm-failure-')
-  try {
-    const { runUpgradeCommand } = await import(upgradeModuleUrl)
-    const calls = []
-    const result = await runUpgradeCommand({
-      json: true,
-      home: fixture.home,
-      files: [],
-      attachFiles: [],
-    }, {
-      runProcess: async (command, args) => {
-        calls.push({ command, args: [...args] })
-        return processResult(command, args, { ok: false, exitCode: 1, stderr: 'registry unavailable' })
-      },
-      installSkills: async () => assert.fail('skills must not run after npm failure'),
-      lockDir: fixture.locks,
-    })
-
-    assert.equal(result.ok, false)
-    assert.equal(result.phases.npmInstall.ok, false)
-    assert.equal(result.phases.npmInstall.error.code, 'npm_global_install_failed')
-    assert.equal(result.phases.npmInstall.processErrorCode, 'tokenless_upgrade_process_failed')
-    assert.equal(calls.length, 1)
-    assert.equal(result.phases.resolveGlobalCli, undefined)
-    assert.equal(result.doctor, null)
-  } finally {
-    fixture.remove()
-  }
-})
-
-test('upgrade rejects a global package whose entrypoint version does not match package.json', async () => {
-  const fixture = createFixture('tokenless-upgrade-version-mismatch-')
-  try {
-    const { runUpgradeCommand } = await import(upgradeModuleUrl)
-    const globalRoot = path.join(fixture.root, 'global')
-    writeGlobalTokenlessPackage(globalRoot, '2.0.0')
-    const calls = []
-    const result = await runUpgradeCommand({
-      json: true,
-      home: fixture.home,
-      files: [],
-      attachFiles: [],
-    }, {
-      runProcess: fakeUpgradeProcess({
-        globalRoot,
-        version: '3.0.0',
-        calls,
-        installPayload: { ok: true },
-        doctorPayload: { ok: true },
-      }),
-      installSkills: async () => assert.fail('skills must not run after version mismatch'),
-      lockDir: fixture.locks,
-    })
-
-    assert.equal(result.ok, false)
-    assert.equal(result.cli.afterVersion, null)
-    assert.equal(result.phases.resolveGlobalCli.ok, false)
-    assert.equal(result.phases.resolveGlobalCli.error.code, 'global_tokenless_version_mismatch')
-    assert.deepEqual(calls.map((call) => call.kind), ['npm-install', 'npm-root', 'version'])
-  } finally {
-    fixture.remove()
-  }
-})
-
-test('upgrade reports skill and runtime failures but still runs doctor through the verified new CLI', async () => {
-  const fixture = createFixture('tokenless-upgrade-partial-')
-  try {
-    const { runUpgradeCommand } = await import(upgradeModuleUrl)
-    const globalRoot = path.join(fixture.root, 'global')
-    writeGlobalTokenlessPackage(globalRoot, '4.0.0')
-    const calls = []
-    const skillError = new Error('skills command failed')
-    skillError.code = 'skills_failed'
-    const result = await runUpgradeCommand({
-      json: true,
-      home: fixture.home,
-      files: [],
-      attachFiles: [],
-    }, {
-      runProcess: fakeUpgradeProcess({
-        globalRoot,
-        version: '4.0.0',
-        calls,
-        installPayload: {
-          ok: false,
-          error: { code: 'daemon_process_proof_missing', message: 'Stop the existing daemon bound to http://127.0.0.1:8787, then rerun tokenless setup.' },
-        },
-        installExitCode: 1,
-        doctorPayload: { ok: true, checks: { daemon: { ok: true } } },
-      }),
-      installSkills: async () => {
-        calls.push({ kind: 'skills' })
-        throw skillError
-      },
-      lockDir: fixture.locks,
-    })
-
-    assert.equal(result.ok, false)
-    assert.equal(result.phases.skills.ok, false)
-    assert.equal(result.phases.runtimeInstall.ok, false)
-    assert.equal(result.phases.runtimeInstall.payload.error.code, 'daemon_process_proof_missing')
-    assert.match(result.phases.runtimeInstall.followUp, /doctor --json/)
-    assert.equal(result.phases.doctor.ok, true)
-    assert.deepEqual(calls.map((call) => call.kind), ['npm-install', 'npm-root', 'version', 'skills', 'install', 'doctor'])
-  } finally {
-    fixture.remove()
-  }
-})
-
-test('upgrade sanitizes secret-bearing skill and runtime fields while forwarding raw daemon arguments', async () => {
-  const fixture = createFixture('tokenless-upgrade-secret-sanitize-')
-  const previousSecret = process.env.TOKENLESS_UPGRADE_TEST_SECRET
-  process.env.TOKENLESS_UPGRADE_TEST_SECRET = 'env-secret-value-123456'
-  try {
-    const { runUpgradeCommand } = await import(upgradeModuleUrl)
-    const globalRoot = path.join(fixture.root, 'global')
-    writeGlobalTokenlessPackage(globalRoot, '4.1.0')
-    const calls = []
-    const daemonUrl = 'http://user:pass@127.0.0.1:8787/?token=secret'
-    const skillError = new Error(
-      'skills failed with _authToken=skill-token-123 Bearer bearer-token-123 Basic basic-token-123 env-secret-value-123456',
-    )
-    skillError.code = 'tokenless_skill_refresh_failed'
-
-    const result = await runUpgradeCommand({
-      json: true,
-      home: fixture.home,
-      daemonUrl,
-      files: [],
-      attachFiles: [],
-    }, {
-      runProcess: fakeUpgradeProcess({
-        globalRoot,
-        version: '4.1.0',
-        calls,
-        installPayload: {
-          ok: false,
-          error: {
-            code: 'daemon_auth_failed',
-            message: `daemon rejected ${daemonUrl} with _authToken=runtime-token-123 and Bearer runtime-bearer-123`,
-          },
-        },
-        installExitCode: 1,
-        doctorPayload: {
-          ok: true,
-          checks: {
-            daemon: {
-              ok: true,
-              url: daemonUrl,
-            },
-          },
-        },
-      }),
-      installSkills: async () => {
-        calls.push({ kind: 'skills' })
-        throw skillError
-      },
-      lockDir: fixture.locks,
-    })
-
-    assert.equal(calls.find((call) => call.kind === 'install').args.includes(daemonUrl), true)
-    assert.equal(calls.find((call) => call.kind === 'doctor').args.includes(daemonUrl), true)
-
-    const serialized = JSON.stringify(result)
-    for (const secret of [
-      'user:pass',
-      'token=secret',
-      'skill-token-123',
-      'bearer-token-123',
-      'basic-token-123',
-      'env-secret-value-123456',
-      'runtime-token-123',
-      'runtime-bearer-123',
-    ]) {
-      assert.equal(serialized.includes(secret), false, `${secret} leaked in ${serialized}`)
-    }
-    assert.equal(serialized.includes('http://127.0.0.1:8787'), false)
-    assert.equal(serialized.includes('http://[redacted]@127.0.0.1:8787/?token=[redacted]'), true)
-  } finally {
-    if (previousSecret === undefined) {
-      delete process.env.TOKENLESS_UPGRADE_TEST_SECRET
-    } else {
-      process.env.TOKENLESS_UPGRADE_TEST_SECRET = previousSecret
-    }
-    fixture.remove()
-  }
-})
-
-test('upgrade fails overall when doctor returns unhealthy JSON', async () => {
-  const fixture = createFixture('tokenless-upgrade-doctor-unhealthy-')
-  try {
-    const { runUpgradeCommand } = await import(upgradeModuleUrl)
-    const globalRoot = path.join(fixture.root, 'global')
-    writeGlobalTokenlessPackage(globalRoot, '5.0.0')
-    const result = await runUpgradeCommand({
-      json: true,
-      home: fixture.home,
-      files: [],
-      attachFiles: [],
-    }, {
-      runProcess: fakeUpgradeProcess({
-        globalRoot,
-        version: '5.0.0',
-        calls: [],
-        installPayload: { ok: true },
-        doctorPayload: { ok: false, checks: { daemon: { ok: false } } },
-        doctorExitCode: 1,
-      }),
-      installSkills: async () => ({ check: { ok: true } }),
-      lockDir: fixture.locks,
-    })
-
-    assert.equal(result.ok, false)
-    assert.equal(result.phases.doctor.ok, false)
-    assert.equal(result.phases.doctor.error.code, 'tokenless_doctor_failed')
-    assert.equal(result.phases.doctor.payload.ok, false)
-  } finally {
-    fixture.remove()
-  }
-})
-
-test('upgrade lock serializes concurrent runs by failing safely when a lock already exists', async () => {
-  const fixture = createFixture('tokenless-upgrade-lock-')
-  try {
-    const { runUpgradeCommand } = await import(upgradeModuleUrl)
-    fs.mkdirSync(fixture.locks, { recursive: true, mode: 0o700 })
-    fs.writeFileSync(path.join(fixture.locks, `upgrade-${lockOwnerKey()}.lock`), JSON.stringify({
-      pid: process.pid,
-      startedAt: new Date().toISOString(),
-    }))
-    await assert.rejects(
-      () => runUpgradeCommand({ json: true, home: fixture.home, files: [], attachFiles: [] }, {
-        runProcess: async () => assert.fail('upgrade must not execute while locked'),
-        installSkills: async () => assert.fail('skills must not run while locked'),
-        lockDir: fixture.locks,
-      }),
-      (error) => error.code === 'tokenless_upgrade_in_progress',
-    )
-  } finally {
-    fixture.remove()
-  }
-})
-
-test('upgrade recovers a stale lock by age even when the recorded pid is alive', async () => {
-  const fixture = createFixture('tokenless-upgrade-stale-lock-')
-  try {
-    const { runUpgradeCommand } = await import(upgradeModuleUrl)
-    const globalRoot = path.join(fixture.root, 'global')
-    writeGlobalTokenlessPackage(globalRoot, '6.0.0')
-    fs.mkdirSync(fixture.locks, { recursive: true, mode: 0o700 })
-    fs.writeFileSync(path.join(fixture.locks, `upgrade-${lockOwnerKey()}.lock`), JSON.stringify({
-      pid: process.pid,
-      startedAt: new Date(Date.now() - 31 * 60_000).toISOString(),
-    }))
-    const calls = []
-    const result = await runUpgradeCommand({ json: true, home: fixture.home, files: [], attachFiles: [] }, {
-      runProcess: fakeUpgradeProcess({
-        globalRoot,
-        version: '6.0.0',
-        calls,
-        installPayload: { ok: true },
-        doctorPayload: { ok: true },
-      }),
-      installSkills: async () => {
-        calls.push({ kind: 'skills' })
-        return { check: { ok: true } }
-      },
-      lockDir: fixture.locks,
-    })
-
-    assert.equal(result.ok, true)
-    assert.deepEqual(calls.map((call) => call.kind), ['npm-install', 'npm-root', 'version', 'skills', 'install', 'doctor'])
-    assert.equal(fs.existsSync(path.join(fixture.locks, `upgrade-${lockOwnerKey()}.lock`)), false)
-  } finally {
-    fixture.remove()
-  }
-})
-
-test('upgrade fails closed when the lock directory cannot be prepared', async () => {
-  const fixture = createFixture('tokenless-upgrade-lock-dir-failure-')
-  try {
-    const { runUpgradeCommand } = await import(upgradeModuleUrl)
-    const lockDir = path.join(fixture.root, 'lock-file')
-    fs.writeFileSync(lockDir, 'not a directory')
-    await assert.rejects(
-      () => runUpgradeCommand({ json: true, home: fixture.home, files: [], attachFiles: [] }, {
-        runProcess: async () => assert.fail('upgrade must not execute without a usable lock directory'),
-        installSkills: async () => assert.fail('skills must not run without a usable lock directory'),
-        lockDir,
-      }),
-      (error) => error.code === 'tokenless_upgrade_lock_dir_unusable',
-    )
-  } finally {
-    fixture.remove()
-  }
-})
-
-test('bounded process runner reports timeouts and output caps as stable failures', async () => {
-  const { runBoundedProcess } = await import(upgradeModuleUrl)
-  const timedOut = await runBoundedProcess(process.execPath, ['-e', 'setTimeout(() => {}, 200)'], {
-    timeoutMs: 25,
-    maxOutputBytes: 1024,
-  })
-  assert.equal(timedOut.ok, false)
-  assert.equal(timedOut.timedOut, true)
-  assert.equal(timedOut.error.code, 'tokenless_upgrade_process_timeout')
-
-  const capped = await runBoundedProcess(process.execPath, ['-e', 'process.stdout.write("x".repeat(100000))'], {
-    timeoutMs: 1000,
-    maxOutputBytes: 32,
-  })
-  assert.equal(capped.ok, false)
-  assert.equal(capped.outputTruncated, true)
-  assert.equal(capped.error.code, 'tokenless_upgrade_process_output_limit')
-})
-
-test('CLI upgrade rejects arbitrary scoped arguments before touching Tokenless home', async () => {
-  const fixture = createFixture('tokenless-upgrade-cli-routing-')
-  try {
-    const poisonHome = path.join(fixture.root, 'home-is-a-file')
-    fs.writeFileSync(poisonHome, 'must remain untouched')
-    const completed = await runCli(['upgrade', '--provider', 'chatgpt', '--home', poisonHome, '--json'])
-    assert.equal(completed.code, 1, `${completed.stderr}\n${completed.stdout}`)
-    assert.equal(completed.stderr, '')
-    assert.doesNotMatch(completed.stdout, /Tokenless upgrade|Updating global CLI|Running doctor/)
-    const payload = JSON.parse(completed.stdout)
-    assert.equal(payload.error.code, 'upgrade_option_invalid')
-    assert.match(payload.error.message, /Unsupported option: --provider/)
-    assert.equal(fs.readFileSync(poisonHome, 'utf8'), 'must remain untouched')
-  } finally {
-    fixture.remove()
-  }
-})
-
-test('CLI upgrade without --json reports human errors on stderr only', async () => {
-  const fixture = createFixture('tokenless-upgrade-cli-human-routing-')
-  try {
-    const poisonHome = path.join(fixture.root, 'home-is-a-file')
-    fs.writeFileSync(poisonHome, 'must remain untouched')
-    const completed = await runCli(['upgrade', '--provider', 'chatgpt', '--home', poisonHome])
-    assert.equal(completed.code, 1, `${completed.stderr}\n${completed.stdout}`)
-    assert.equal(completed.stdout, '')
-    assert.match(completed.stderr, /^upgrade_option_invalid: .*Unsupported option: --provider/m)
-    assert.doesNotMatch(completed.stderr, /"ok": false/)
-    assert.equal(fs.readFileSync(poisonHome, 'utf8'), 'must remain untouched')
-  } finally {
-    fixture.remove()
-  }
-})
-
-function createFixture(prefix) {
-  const rootDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), prefix)))
-  const home = path.join(rootDir, 'home')
-  const locks = path.join(rootDir, 'locks')
-  fs.mkdirSync(home)
-  return {
-    root: rootDir,
-    home,
-    locks,
-    remove: () => fs.rmSync(rootDir, { recursive: true, force: true }),
-  }
-}
-
-function lockOwnerKey() {
-  return createHash('sha256').update(os.homedir()).digest('hex').slice(0, 16)
-}
-
-function writeGlobalTokenlessPackage(globalRoot, version) {
-  const packageDir = path.join(globalRoot, 'tokenless')
-  const distDir = path.join(packageDir, 'dist/src')
-  fs.mkdirSync(distDir, { recursive: true })
-  const entrypoint = path.join(distDir, 'tokenless.mjs')
-  fs.writeFileSync(path.join(packageDir, 'package.json'), JSON.stringify({
-    name: 'tokenless',
-    version,
-    bin: {
-      tokenless: 'dist/src/tokenless.mjs',
-    },
-  }, null, 2))
-  fs.writeFileSync(entrypoint, '#!/usr/bin/env node\n')
-  return entrypoint
-}
-
-function fakeUpgradeProcess({
-  globalRoot,
-  version,
-  calls,
-  installPayload,
-  doctorPayload,
-  installExitCode = 0,
-  doctorExitCode = 0,
-}) {
-  return async (command, args) => {
-    const argv = [...args]
-    if (argv[0] === 'install' && argv[1] === '--global') {
-      calls.push({ kind: 'npm-install', command, args: argv })
-      return processResult(command, argv, { ok: true })
-    }
-    if (argv[0] === 'root' && argv[1] === '--global') {
-      calls.push({ kind: 'npm-root', command, args: argv })
-      return processResult(command, argv, { ok: true, stdout: `${globalRoot}\n` })
-    }
-    if (command === process.execPath && argv[1] === '--version') {
-      calls.push({ kind: 'version', command, args: argv })
-      return processResult(command, argv, { ok: true, stdout: `${version}\n` })
-    }
-    if (command === process.execPath && argv[1] === 'install') {
-      calls.push({ kind: 'install', command, args: argv })
-      return processResult(command, argv, {
-        ok: installExitCode === 0,
-        exitCode: installExitCode,
-        stdout: JSON.stringify(installPayload),
-      })
-    }
-    if (command === process.execPath && argv[1] === 'doctor') {
-      calls.push({ kind: 'doctor', command, args: argv })
-      return processResult(command, argv, {
-        ok: doctorExitCode === 0,
-        exitCode: doctorExitCode,
-        stdout: JSON.stringify(doctorPayload),
-      })
-    }
-    throw new Error(`Unexpected process: ${command} ${argv.join(' ')}`)
-  }
-}
-
-function processResult(command, args, overrides = {}) {
-  const ok = overrides.ok ?? true
-  return {
-    ok,
-    command,
-    args: [...args],
-    stdout: overrides.stdout ?? '',
-    stderr: overrides.stderr ?? '',
-    exitCode: overrides.exitCode ?? (ok ? 0 : 1),
-    signal: overrides.signal ?? null,
-    timedOut: overrides.timedOut ?? false,
-    outputTruncated: overrides.outputTruncated ?? false,
-    ...(ok
-      ? {}
-      : {
-          error: overrides.error ?? {
-            code: 'tokenless_upgrade_process_failed',
-            message: overrides.stderr || 'Process failed.',
-          },
-        }),
-  }
-}
-
-async function runCli(args) {
-  const child = spawn(process.execPath, [cliEntry, ...args], {
-    cwd: root,
-    env: { ...process.env, TOKENLESS_HOME: path.join(os.tmpdir(), 'must-not-be-read') },
-    stdio: ['ignore', 'pipe', 'pipe'],
-  })
-  let stdout = ''
-  let stderr = ''
-  child.stdout.on('data', (chunk) => { stdout += chunk.toString('utf8') })
-  child.stderr.on('data', (chunk) => { stderr += chunk.toString('utf8') })
-  const code = await new Promise((resolve, reject) => {
-    child.once('error', reject)
-    child.once('close', resolve)
-  })
-  return { code, stdout, stderr }
-}
diff --git a/test/visible-attachments.test.mjs b/test/visible-attachments.test.mjs
deleted file mode 100644
index d8f4875..0000000
--- a/test/visible-attachments.test.mjs
+++ /dev/null
@@ -1,180 +0,0 @@
-import assert from 'node:assert/strict'
-import { createHash } from 'node:crypto'
-import fs from 'node:fs/promises'
-import os from 'node:os'
-import path from 'node:path'
-import test from 'node:test'
-
-import {
-  VISIBLE_ATTACHMENT_PROTOCOL,
-  cleanupOrphanedVisibleAttachmentBundles,
-  removeStagedVisibleAttachmentBundle,
-  stageVisibleAttachment,
-  stageVisibleAttachments,
-  validateVisibleAttachmentDescriptor,
-  visibleAttachmentPath,
-} from '../packages/cli/dist/src/index.js'
-
-test('visible attachment staging copies bytes into a private path and returns a path-free descriptor', async () => {
-  await withTemporaryDirectory(async (directory) => {
-    const homeDir = path.join(directory, 'home')
-    const sourcePath = path.join(directory, 'report.txt')
-    const bytes = Buffer.from('Tokenless visible attachment\nwith binary byte: \0\n')
-    await fs.writeFile(sourcePath, bytes)
-
-    const descriptor = await stageVisibleAttachment({
-      homeDir,
-      sourcePath,
-      bundleId: 'bundle_safe-1',
-      attachmentId: 'attachment_safe-1',
-      type: 'text/plain',
-    })
-
-    assert.deepEqual(descriptor, {
-      protocol: VISIBLE_ATTACHMENT_PROTOCOL,
-      bundleId: 'bundle_safe-1',
-      attachmentId: 'attachment_safe-1',
-      name: 'report.txt',
-      type: 'text/plain',
-      size: bytes.length,
-      sha256: createHash('sha256').update(bytes).digest('hex'),
-    })
-    const serializedDescriptor = JSON.stringify(descriptor)
-    assert.doesNotMatch(serializedDescriptor, /sourcePath|stagedPath/i)
-    assert.equal(serializedDescriptor.includes(directory), false)
-    assert.equal(serializedDescriptor.includes(homeDir), false)
-    assert.equal(serializedDescriptor.includes(sourcePath), false)
-    const stagedPath = visibleAttachmentPath(homeDir, descriptor.bundleId, descriptor.attachmentId)
-    assert.deepEqual(await fs.readFile(stagedPath), bytes)
-    if (process.platform !== 'win32') {
-      assert.equal((await fs.stat(stagedPath)).mode & 0o777, 0o600)
-      assert.equal((await fs.stat(path.dirname(stagedPath))).mode & 0o777, 0o700)
-    }
-    assert.equal(await removeStagedVisibleAttachmentBundle({ homeDir, bundleId: descriptor.bundleId }), true)
-    await assert.rejects(fs.stat(stagedPath), { code: 'ENOENT' })
-  })
-})
-
-test('visible attachment descriptors reject paths, unknown fields, unsafe ids, and malformed hashes', () => {
-  const base = {
-    protocol: VISIBLE_ATTACHMENT_PROTOCOL,
-    bundleId: 'bundle-1',
-    attachmentId: 'attachment-1',
-    name: 'safe.txt',
-    type: 'text/plain',
-    size: 4,
-    sha256: 'a'.repeat(64),
-  }
-  assert.deepEqual(validateVisibleAttachmentDescriptor(base), base)
-  assert.throws(() => validateVisibleAttachmentDescriptor({ ...base, sourcePath: 'C:\\private.txt' }), /unsupported field/i)
-  assert.throws(() => validateVisibleAttachmentDescriptor({ ...base, stagedPath: '/tmp/private' }), /unsupported field/i)
-  assert.throws(() => validateVisibleAttachmentDescriptor({ ...base, bundleId: '../escape' }), /bundleId/)
-  assert.throws(() => validateVisibleAttachmentDescriptor({ ...base, attachmentId: 'a/b' }), /attachmentId/)
-  assert.throws(() => validateVisibleAttachmentDescriptor({ ...base, name: '../secret.txt' }), /path-free/)
-  assert.throws(() => validateVisibleAttachmentDescriptor({ ...base, sha256: 'A'.repeat(64) }), /lowercase/)
-})
-
-test('visible attachment staging fails closed on collisions, size limits, and batch partial failures', async () => {
-  await withTemporaryDirectory(async (directory) => {
-    const homeDir = path.join(directory, 'home')
-    const first = path.join(directory, 'first.txt')
-    const second = path.join(directory, 'second.txt')
-    const aggregateFirst = path.join(directory, 'aggregate-first.txt')
-    const aggregateSecond = path.join(directory, 'aggregate-second.txt')
-    await fs.writeFile(first, 'first')
-    await fs.writeFile(second, 'second is too large')
-    await fs.writeFile(aggregateFirst, '1234')
-    await fs.writeFile(aggregateSecond, '5678')
-
-    await stageVisibleAttachment({
-      homeDir,
-      sourcePath: first,
-      bundleId: 'collision',
-      attachmentId: 'same',
-    })
-    await assert.rejects(
-      stageVisibleAttachment({ homeDir, sourcePath: first, bundleId: 'collision', attachmentId: 'same' }),
-      { code: 'EEXIST' }
-    )
-    await assert.rejects(
-      stageVisibleAttachment({ homeDir, sourcePath: second, maxBytes: 4 }),
-      /staging limit/
-    )
-    await assert.rejects(
-      stageVisibleAttachments({
-        homeDir,
-        bundleId: 'batch-rollback',
-        maxBytes: 5,
-        files: [{ sourcePath: first }, { sourcePath: second }],
-      }),
-      /staging limit/
-    )
-    await assert.rejects(
-      fs.stat(path.join(homeDir, 'attachments', 'batch-rollback')),
-      { code: 'ENOENT' }
-    )
-    await assert.rejects(
-      stageVisibleAttachments({
-        homeDir,
-        bundleId: 'aggregate-rollback',
-        maxBytes: 6,
-        files: [{ sourcePath: aggregateFirst }, { sourcePath: aggregateSecond }],
-      }),
-      /aggregate staging limit|staging limit/
-    )
-    await assert.rejects(
-      fs.stat(path.join(homeDir, 'attachments', 'aggregate-rollback')),
-      { code: 'ENOENT' }
-    )
-  })
-})
-
-test('visible attachment staging rejects source and staging-root symlinks', {
-  skip: process.platform === 'win32' && 'Creating symlinks may require Windows Developer Mode.',
-}, async () => {
-  await withTemporaryDirectory(async (directory) => {
-    const homeDir = path.join(directory, 'home')
-    const source = path.join(directory, 'source.txt')
-    const sourceLink = path.join(directory, 'source-link.txt')
-    await fs.writeFile(source, 'private')
-    await fs.symlink(source, sourceLink)
-    await assert.rejects(stageVisibleAttachment({ homeDir, sourcePath: sourceLink }), /non-symlink/)
-
-    const outside = path.join(directory, 'outside')
-    await fs.mkdir(homeDir, { recursive: true })
-    await fs.mkdir(outside)
-    await fs.symlink(outside, path.join(homeDir, 'attachments'), 'dir')
-    await assert.rejects(stageVisibleAttachment({ homeDir, sourcePath: source }), /non-symlink directory|escaped/)
-    assert.deepEqual(await fs.readdir(outside), [])
-  })
-})
-
-test('orphan cleanup removes only expired, structurally valid attachment bundles', async () => {
-  await withTemporaryDirectory(async (directory) => {
-    const homeDir = path.join(directory, 'home')
-    const source = path.join(directory, 'source.txt')
-    await fs.writeFile(source, 'cleanup')
-    const old = await stageVisibleAttachment({ homeDir, sourcePath: source, bundleId: 'old-bundle' })
-    const recent = await stageVisibleAttachment({ homeDir, sourcePath: source, bundleId: 'recent-bundle' })
-    const oldTime = new Date('2026-01-01T00:00:00.000Z')
-    await fs.utimes(path.dirname(visibleAttachmentPath(homeDir, old.bundleId, old.attachmentId)), oldTime, oldTime)
-
-    const removed = await cleanupOrphanedVisibleAttachmentBundles({
-      homeDir,
-      ttlMs: 60_000,
-      nowMs: Date.parse('2026-01-01T00:02:00.000Z'),
-    })
-    assert.deepEqual(removed, ['old-bundle'])
-    await assert.rejects(fs.stat(visibleAttachmentPath(homeDir, old.bundleId, old.attachmentId)), { code: 'ENOENT' })
-    assert.equal((await fs.stat(visibleAttachmentPath(homeDir, recent.bundleId, recent.attachmentId))).isFile(), true)
-  })
-})
-
-async function withTemporaryDirectory(run) {
-  const directory = await fs.mkdtemp(path.join(os.tmpdir(), 'tokenless-visible-attachment-'))
-  try {
-    await run(directory)
-  } finally {
-    await fs.rm(directory, { recursive: true, force: true })
-  }
-}
diff --git a/test/visible-provider-controls-cli.test.mjs b/test/visible-provider-controls-cli.test.mjs
index 0169f88..e915224 100644
--- a/test/visible-provider-controls-cli.test.mjs
+++ b/test/visible-provider-controls-cli.test.mjs
@@ -38,16 +38,30 @@ test('provider control commands validate generic model and effort labels while k
       {
         args: ['provider-controls', '--provider', 'gemini', '--model', 'Flash'],
         code: 'controls_unsupported_for_action',
+        usage: true,
       },
       {
         args: ['chatgpt-configure', '--provider', 'gemini', '--model', 'Flash'],
         code: 'chatgpt_controls_unsupported',
       },
+      {
+        args: ['provider-configure', '--provider', 'deepseek', '--deepseek-search', 'on'],
+        code: 'deepseek_search_requires_instant',
+      },
+      {
+        args: ['provider-configure', '--provider', 'claude', '--deepseek-mode', 'Instant'],
+        code: 'deepseek_control_unsupported',
+      },
     ]) {
       const completed = await runCli([...fixture.args, '--home', home, '--json'])
       assert.equal(completed.exitCode, 1, `${completed.stderr}\n${completed.stdout}`)
       const payload = JSON.parse(completed.stdout)
       assert.equal(payload.error.code, fixture.code)
+      if (fixture.usage) {
+        assert.deepEqual(payload.error.usage.invalidOptions, ['--model'])
+        assert.ok(payload.error.usage.usage.some((line) => line.startsWith('tokenless provider-controls ')))
+        assert.ok(payload.error.usage.commonOptions.includes('-h, --help'))
+      }
     }
   } finally {
     fs.rmSync(home, { recursive: true, force: true })
@@ -76,6 +90,18 @@ test('provider-action maps only the strict priority payload for each action', as
         args: ['provider-action', '--provider', 'grok', '--action', 'effort.select', '--effort', 'Fast', '--thinking-effort', 'Heavy'],
         code: 'duplicate_effort',
       },
+      {
+        args: ['provider-action', '--provider', 'qwen', '--action', 'qwen.mode.select'],
+        code: 'missing_visible_action_qwen_mode',
+      },
+      {
+        args: ['provider-action', '--provider', 'claude', '--action', 'qwen.mode.inspect'],
+        code: 'qwen_mode_unsupported',
+      },
+      {
+        args: ['provider-action', '--provider', 'qwen', '--action', 'qwen.mode.select', '--qwen-mode', 'Deep Research\nAdvanced'],
+        code: 'invalid_qwen_mode',
+      },
       {
         args: ['provider-action', '--provider', 'chatgpt', '--action', 'file.upload'],
         code: 'missing_visible_action_file',
@@ -96,6 +122,14 @@ test('provider-action maps only the strict priority payload for each action', as
         args: ['provider-action', '--provider', 'gemini', '--action', 'model.select', '--model', 'Flash', '--model-fallback', 'Pro'],
         code: 'model_fallback_unsupported',
       },
+      {
+        args: ['provider-action', '--provider', 'deepseek', '--action', 'deepseek.mode.select'],
+        code: 'missing_visible_action_deepseek_mode',
+      },
+      {
+        args: ['provider-action', '--provider', 'qwen', '--action', 'deepseek.search.inspect'],
+        code: 'deepseek_control_unsupported',
+      },
     ]) {
       const completed = await runCli([...fixture.args, '--home', home, '--json'])
       assert.equal(completed.exitCode, 1, `${completed.stderr}\n${completed.stdout}`)
@@ -107,6 +141,37 @@ test('provider-action maps only the strict priority payload for each action', as
   }
 })
 
+test('DeepSeek canonical requirements fail closed on incompatible explicit controls', async () => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'tokenless-deepseek-controls-'))
+  const image = path.join(root, 'assets', 'tokenless-mark.png')
+  try {
+    for (const fixture of [
+      {
+        args: ['run', '--provider', 'deepseek', '--capability', 'search.web', '--deepseek-search', 'off', '--prompt', 'x'],
+        code: 'deepseek_search_required',
+      },
+      {
+        args: ['run', '--provider', 'deepseek', '--capability', 'image.input', '--deepseek-mode', 'Instant', '--attach-file', image, '--prompt', 'x'],
+        code: 'deepseek_image_requires_vision',
+      },
+      {
+        args: ['run', '--provider', 'deepseek', '--capability', 'search.web', '--attach-file', image, '--prompt', 'x'],
+        code: 'deepseek_capability_combination_unavailable',
+      },
+      {
+        args: ['run', '--provider', 'deepseek', '--capability', 'reasoning.extended', '--deepseek-deepthink', 'off', '--prompt', 'x'],
+        code: 'deepseek_deepthink_required',
+      },
+    ]) {
+      const completed = await runCli([...fixture.args, '--home', home, '--json'])
+      assert.equal(completed.exitCode, 1, `${completed.stderr}\n${completed.stdout}`)
+      assert.equal(JSON.parse(completed.stdout).error.code, fixture.code)
+    }
+  } finally {
+    fs.rmSync(home, { recursive: true, force: true })
+  }
+})
+
 async function runCli(args) {
   const child = spawn(process.execPath, [cliEntry, ...args], {
     cwd: root,