diff --git a/CLAUDE.md b/CLAUDE.md
index af76f8da..8e9ef734 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -24,12 +24,12 @@ Run from repo root unless noted.
 | `pnpm build` | Build all packages (`pnpm -r build`). |
 | `pnpm test` | Run vitest suite once. |
 | `pnpm test:watch` | Run vitest in watch mode. |
-| `pnpm test:coverage` | Run vitest with v8 coverage. The thresholds in `vitest.config.ts` are the floor — drops fail CI. |
+| `pnpm test:coverage` | Run vitest with v8 coverage. The thresholds in `vitest.config.ts` are aspirational, not a gate: that file states CI does not run this and the suite is currently below all four. CI runs `test`/`lint`/`test:ui`. |
 | `pnpm lint` | Lint all packages in parallel. Includes `eslint-plugin-security` for a subset of CodeQL findings; deeper taint-flow checks surface on the PR's CodeQL scan. |
 | `pnpm demo:wdio` / `pnpm demo:nightwatch` / `pnpm demo:selenium` | Run the per-framework example projects. Useful for manual verification of UI or runtime changes. |
 | `pnpm dev` | Run all packages in parallel dev mode. |
 
-`selenium-devtools` exposes per-runner variants of its example via `pnpm --filter @wdio/selenium-devtools example:mocha` / `:jest` / `:cucumber` / `:jasmine` / `:vitest`.
+`selenium-devtools` exposes per-runner variants of its example via `pnpm --filter @wdio/selenium-devtools example:mocha` / `:mocha:allure` / `:jest` / `:cucumber`.
 
 ---
 
@@ -102,7 +102,7 @@ No `any` crosses a package boundary. When a framework API forces a loosely-typed
 - Neither is added to a bundler's `external` config. Vite's `external` callback receives both the bare package name *and* the resolved absolute path (e.g. `/Users/.../packages/core/src/index.ts`); a check for only one form silently externalizes the other.
 - The same callback receives bare relative imports (`./utils.js`, `../constants.js`). A check that allows only `./` will externalize `../`-style imports from subfolders and the dist crashes with `ERR_MODULE_NOT_FOUND` at install time.
 - `packages/service/vite.config.ts` is the canonical pattern for getting both right.
-- After any change to a bundler config or build script, `grep -E "@wdio/devtools-(core|shared)|/packages/(core|shared)/" packages/<pkg>/dist/*.js` should return nothing. That's how you catch the absolute-path leak.
+- After any change to a bundler config or build script, `grep -nE "(from|require\()\s*['\"](@wdio/devtools-(core|shared)|.*/packages/(core|shared)/)" packages/<pkg>/dist/*.js` should return nothing. That's how you catch the absolute-path leak. Match on the `from`/`require(` prefix, not the bare package name: `LIBRARY_NAME = "@wdio/devtools-core"` (written into the trace's `context-options`) and `Symbol.for("@wdio/devtools-core/assert-patched")` are inlined string *values* that legitimately survive bundling, so a bare-name grep always reports a false leak.
 
 Bundlers in use: **vite** for `app`, `service`, `script`; **tsup** for `backend`, `nightwatch-devtools`, `selenium-devtools`.
 
@@ -159,7 +159,7 @@ Unused exports, unused imports, commented-out blocks, and `_unused` parameters g
 
 ## Testing
 
-The repo uses **vitest** at the root. The current state: 1315 tests across 112 files; thresholds at `vitest.config.ts` enforce a floor of 85/77/86/85 (statements/branches/functions/lines). Coverage is ratcheted upward as gaps close, never downward.
+The repo uses **vitest** at the root. The current state: 1776 tests across 139 files; thresholds at `vitest.config.ts` enforce a floor of 85/77/86/85 (statements/branches/functions/lines). Coverage is ratcheted upward as gaps close, never downward.
 
 ### What gets tested
 
@@ -241,8 +241,37 @@ Documented divergences from the conventions above. They exist today as debt to b
   - **Nightwatch: `retain-on-failure` works; the other retry-aware policies degrade.** Its `--retries` re-runs the testcase *internally* without re-firing the plugin's per-test hooks, and the per-testcase results carry no attempt/retry field (retries live only in undocumented, version-varying Nightwatch internals — `suiteRetries.testRetriesCount` / `reporter.testResults.retryTest`), so the ledger sees only the final attempt for the `describe/it` and exports-object interfaces. Cucumber scenarios expose per-scenario hooks, so the feed captures their attempts. Not cleanly fixable without depending on those internals.
   - WDIO `specFileRetries` spawns a fresh worker per retry, so cross-process attempts aren't in the (process-scoped) ledger.
 - Run identity across worker sockets is env-propagated. `core/run-id.ts` `resolveRunId()` publishes `DEVTOOLS_RUN_ID` (`RUNNER_ENV.RUN_ID`) and every worker socket carries it as `?runId=` (`WORKER_WS_QUERY`), so the backend keeps accumulated run state when the *next spec's* worker connects and wipes it only for a genuinely new run. Without it every connect read as a new run: Preserve & Rerun 409'd for every spec except the last one that ran, and a dashboard opened mid-run replayed only the current spec. The WDIO service stamps it in the launcher's `onPrepare`, before workers fork, so all workers of one run agree; single-process adapters self-stamp on first use. **Gap: multi-process parallel runs in Selenium/Nightwatch** (jest/vitest workers, nightwatch `test_workers`) load the plugin per worker with no launcher-side hook to stamp first, so each worker generates its own id and still reads as a new run — the pre-fix behaviour, not a regression. Deriving the fallback from `process.ppid` would group those siblings, but would also make two sequential single-process runs share an id and inherit each other's state against a standalone dashboard, so the per-process fallback stands.
-- **Chrome 150 headless drops trusted input once capture traffic is running** — a click dispatches but never navigates, so a live-mode example fails on its second test with a missing-element error that looks like a devtools bug. It is a browser regression (fixed in 151), not fixable client-side; `browser.reloadSession()` between tests works around it. Pin the example's `browserVersion` to 149 when reproducing live-mode behaviour on a 150 machine.
+- **Chrome discards all WebDriver-synthesized input to a tab after a breached credential is submitted.** The first time a test types a `(username, password)` pair that Chrome's password-leak check finds in a breach corpus into an `<input type="password">` and submits a form whose destination no longer shows that login form, Chrome queries `passwordsleakcheck-pa.googleapis.com` and ~0.3-0.9 s later stops delivering **all** synthesized input — mouse *and* keyboard — to that tab. chromedriver returns HTTP 200 for every subsequent Element Click / Send Keys; nothing reaches the page. Untrusted JS (`element.click()`) still works and direct CDP `Input.dispatchMouseEvent`/`dispatchKeyEvent` are equally dead, so this is Chrome, not chromedriver and not our capture. `tomsmith` / `SuperSecretPassword!` — the-internet's demo credential — triggers it; changing only the *username* does not, nor does a random password.
+  - **Workaround: add `--host-resolver-rules=MAP passwordsleakcheck-pa.googleapis.com 127.0.0.1` to the browser args.** Both examples do. Verified 3/3 on the WDIO mocha example and on the Nightwatch example, where it also fixes the **within-one-test** logout click that a session reset never could. `--guest` also works (3/3); `--incognito` works at the raw-WebDriver level but WebdriverIO rejects it at session creation; disabling the password manager via `prefs` does **not** (6/6 still fail).
+  - **Not a version regression, not headless-specific, not the site, not "the Nth navigation".** Measured identically on Chrome 149.0.7827.155 / 150.0.7871.124 / 151.0.7922.77 / 152.0.7977.30 with matched chromedrivers (5/5 each), headless and headed, and on a purely local two-page static form. It fires **once per browser profile** on a wall clock — a liveness probe that never navigates again goes dead 904 ms after the submit — so the historical ~25% intermittency was the race between the next input command and that round trip. Do **not** pin `browserVersion` to 149; every part of the earlier "Chrome 150 regression, fixed in 151" attribution is contradicted.
+  - Minimal reproduction (own HTTP server, raw `fetch` to chromedriver, no repo, no client library, no framework) is in the session scratchpad as `minimal-repro.mjs`; it is what an upstream chromedriver bug report needs. If a session is already stuck, navigating away and back or opening a new tab restores input (4/4 each); `refresh()`, ESC, JS focus/blur and a 10 s wait do not (0/4 each).
+- **Live mode has no per-action DOM snapshot, so its replay is only as fresh as the last drain.** Per-action snapshots cost two injected scripts plus a screenshot and stay trace-only; all three adapters instead drain the collector after a command that could have moved the page. Service: `#drainAfterLiveCommand`. Selenium: `commandPostActions.ts` `warrantsLiveDrain` + `SessionCapturer.drainAfterLiveCommand`, the same deny-list shape over its own command vocabulary plus `mapAssertCommand` (a node:assert row never reaches the browser) — the predicate is *not* in core because the vocabularies are per-framework and only two `includes` calls would be shared. Without it Selenium drained only at navigation, and that hook is deferred behind an injection and a 500 ms settle: measured on the login example, **2 mutation entries and 2 anchors for a 16-row run**, with the page test 1 spent most of its life on never anchored, so all 11 of its rows replayed the page the test *ended* on (2 → 24 entries, 2 → 3 anchors, 0 → 21 field-state mutations after the fix). Selenium's drain is serialized on a tail because the driver patcher does not await `onCommand`, and the app scans the mutation stream in order and stops at the first entry past a row's window — an overtaken batch strands every row after it.
+- **A live client receives commands in ARRIVAL order, and one consumer assumed timeline order.** Nightwatch withholds native asserts until their outcome is known and flushes them in one batch at test-end (BDD fires `afterEach` once per *module*, so a whole module's asserts arrive after every driver row). The display list already sorts and `utils/elapsed.ts` already treats capture order as untrusted, but `app/src/components/browser/mutation-at-command.ts` bounded a row's DOM by `commands[idx + 1]` — the *array* neighbour — so a row was bounded by a time before it ran: measured, the run's last `waitForElementVisible('#username')` took its bound from an assert that had run 7.6 s earlier and replayed `/secure`. It now orders by `(startTime ?? timestamp, sequence ?? 0, array index)` — the key `buildActionEvents` uses, with the index last so a chronologically ordered array (every trace) resolves to its own successor. Measured: live **5/21 → 1/21** rows on the wrong document, trace **0/21 with 0/21 selections differing**. Live-mode anchoring itself is not the gap: `processTracePayload` sends mutations upstream unconditionally, and a live run streams one anchor per document visited.
+  - Residual: a submit click whose end, destination birth and next command's start land in the **same millisecond** still shows its pre-navigation page; and the app deliberately leaves the **last** row unbounded, rendering the newest DOM.
+- **The Nightwatch filmstrip was never losing frames across `browser.end()`.** Instrumented: 155 poll ticks, 129 frames appended, the 26 skipped only in the null-session gap, and the login-page image present once per session in the export. It works because Nightwatch mutates `sessionId` in place on one `browser` object and the screenshot probe reads it fresh. An observed 17→6 drop was `thinScreencastFrames`' byte-identical dedup meeting a different failure profile — 10 of the 17 were a **blinking text caret** captured while a `waitForElementVisible` sat 5 s on a focused form. Don't read a low polling-mode filmstrip count as frame loss without a sha1 histogram of the emitted events. What *was* real: `#emitTestArtifacts` read `recorder?.frames ?? filmstripFrames`, so once a recorder existed it dropped every frame from before a session change.
 - Eager per-test trace slice (Nightwatch + Selenium) can drop an action snapshot whose fire-and-forget capture hasn't resolved by `afterEach` / scenario end — the slice is written from whatever snapshots exist at flush time. The WDIO service is immune because it awaits each snapshot inline before flushing.
+- **A command row is stamped at COMPLETION, and the DOM anchor carries the document's own birth time.** These two together are what make the replay line up; both adapters got them wrong in the same way and the fix is symmetric. (a) `selenium-devtools/src/driverPatcher.ts` and `nightwatch-devtools/src/helpers/browserProxy.ts` both ran their capture at completion but stamped `timestamp` with the *invocation* clock, keeping the invocation time as `startTime` only after this fix. The page-side mutation stream is on real time, so an invocation-stamped row ended before its own effect landed and replayed the page from before it — the `#username` fill rendered an empty field, the `#password` fill rendered only the username, and a navigation row rendered the page it had just left. Rows also now span their real duration instead of a synthetic 1 ms. (b) `collector.captureCurrentDom` (the only producer of a mutation with a `url`) stamps `performance.timeOrigin`, not the drain clock. A drain is forced from Node whenever a collector might be fresh, which is always after the navigation — a round trip at best, a whole page load at worst — so drain-stamping put the anchor after several later actions (measured: 9/15 Selenium and 8/15 Nightwatch rows on the wrong DOM). With both in place a navigation row ends after its destination document was born, so the anchor needs no repositioning at all.
+  - `core/trace-mutations.ts` `reattributeDomAnchors` remains as a narrow backstop for the one case the stamps can't cover: an anchor born *after* the last logged command, i.e. a click whose navigation commits once the click has already returned. It snaps such an anchor to the newest logged command, but **only when no logged command completed after it** — if one did, that command's row already resolves the anchor and pulling it earlier mis-credits it to a preceding action and steals the new page's DOM from rows still on the old one (measured: a 206 ms pull moved `/login` onto two rows that were on `/add_remove_elements`). Anchors are only pulled earlier, never past the newest timestamp already in the stream, or replay would apply the outgoing document's refs to the incoming tree.
+  - Residual, accepted: Nightwatch's `click` resolves *before* its navigation commits (measured 5 ms), so a submit-click row can still show its pre-navigation page. Selenium is immune — its click waits for page load. Not worth another heuristic; every heuristic tried here regressed a different row.
+- **Document-start injection is what removes the whole race class; everything else is reconstruction.** `<script>`-append injection only instruments the document loaded at the time it runs, and a `<script>` dies with its document — so a navigation always yields a document we learn about afterwards, and every question that follows (when to re-inject, when to drain, which action owns the new DOM) is guesswork. `core/bidi-preload.ts` `registerCollectorPreload` registers the collector via BiDi `script.addPreloadScript` with **no browsing-context id**, which scopes it globally so contexts created later are covered: every document then instruments itself before any of its own script runs and anchors its own DOM at its own `performance.timeOrigin`. Measured on the Nightwatch example: 5 of 5 documents anchored and **0 of 19 rows on the wrong DOM**, versus 4 of 5 and 1–5 wrong with the polling/attribution approach. The service has always done this (`browser.scriptAddPreloadScript`), which is why it never had this bug class.
+  - **All three adapters now register it.** Selenium does so per driver in `session-lifecycle.ts` `registerPreload`, inside the `Promise.all` that `onDriverCreated` awaits — the patched `build()` thenable waits on that, so the preload is live before the first `get`; `ensureBidiCapability` already sets `webSocketUrl: true` on the Builder. Measured on a local two-page form, the appended-`<script>` path captured **21 of 29 input events** (all 8 username keystrokes lost — the collector came up ~1 s after `get`, behind `injectScript`'s ≥200 ms readiness poll and `capturePerformance`'s 500 ms settle) and **3 of 4 DOM anchors** (a destination that lived 150 ms never anchored, the recovery injection's poll never finishing); with the preload, **29 of 29** and **4 of 4**, 3/3 runs. On the cucumber example: **0** injections and **0** "collector missing" recoveries (was 6-9 per run), rows-on-wrong-document 0 of 15, trace zip 1.66-1.71 MB → 1.31-1.41 MB — the injected `<script>`'s own source is no longer part of the captured DOM.
+  - The `<script>` branches are **gated on `SessionCapturer.preloadRegistered`, not deleted**: they are the only capture when BiDi is absent, and a *missing* collector is the fallback's only "the document was replaced" signal — which the preload makes permanently false. Verified by forcing the helper to return false: the example reproduces the pre-change numbers exactly (46 mutations, 4 anchors, 42 input events, 6 injection lines). Selenium's navigation hook also drains **before** `capturePerformance`'s 500 ms settle rather than after: the drain is what moves a destination's anchor out of the page, and a short-lived page was gone by the time the settle ended. Performance entries only get more complete with time; the anchor does not.
+  - **A preload dies with its session, and Nightwatch replaces sessions without saying so.** Registration used to run once at bringup, so a mid-run `browser.end()` left sessions 2..N with neither preload nor BiDi: measured 1 registration and 1 attach for a whole run, 4-6 `Collector missing … re-injecting` recoveries, and — because `bidiActive` stayed `true` from the dead session and gates the perf-log fallback off — **zero network capture after the rotation** (75 requests in session 1, 0 in session 2). `session-init.ts` `rearmCaptureForSession` re-arms both off the same command-hook detection the screencast rotation uses (`armedSessionId`, stamped before the first await so the command flood latches out), clearing `preloadRegistered`/`bidiActive` at detection so the fallbacks are open in the gap. After: 2 registrations, 2 attaches, 0-1 recoveries, 125 network entries (75 + 50), and the accumulated stream untouched — 21 action rows split 12/9 across the two sessions, identical to before. It deliberately does **not** rebuild the `SessionCapturer` (that is `handleSessionChange`, which discards the run's whole trace).
+    - The preload registers **before** the BiDi attach, sequentially: behind the attach it lost the race it exists to win (the network subscribe took 6.2 s while the triggering command navigated, so registration landed after its own document was born), and `Promise.all` races selenium-webdriver's unsynchronized `getBidi()` cache into two websockets of which `quit()` closes one.
+    - Residual: detection is at command invocation and chromedriver serialises the handshake behind the in-flight command, so the **first navigation after a rotation** can still land before registration and falls back to `<script>` injection (1 recovery in 3 of 4 runs, 0 in the fourth). Nightwatch exposes no pre-test session hook to a plugin.
+  - Deliberately **not** gated on Nightwatch's `bidi` option. That option exists to avoid double-reporting console/network against the perf-log path; preload registration needs nothing but a session created with `webSocketUrl: true`, and gating DOM capture on an unrelated opt-in that defaults to `false` would leave the race in place for nearly every user. `ScriptManager.init` throws without that capability, so the helper self-degrades to the `<script>` path and returns false.
+  - The fallback path is kept and still works, but is strictly lower fidelity: measured with `bidi:false`, 0 rows without DOM but the per-action field-state mutations don't survive and a navigating click keeps the ~5 ms residual. Prefer `webSocketUrl: true`.
+- **Nightwatch navigation injection must not ride on a queued `perform()`.** `wrapNav` used `chainable.perform()` to run the injection after the navigation completed, but Nightwatch **aborts the remaining queue when a test fails**, so the queued callback is discarded: measured 2 of 3 navigations skipped entirely, and with them the first document's whole DOM — which is why trace quality appeared to vary run to run with no code change. The injection now hangs off the command's own thenable (the chainable is thenable, and resolving it means the navigation finished), and `result` is returned unchanged so `browser.url(…).waitFor…()` chaining still works.
+- **Nightwatch's page-side drain must not go through `browser.execute`, and one drain cannot serve both purposes.** `browser.*` are QUEUED commands, so the drain used to be deferred 200 ms via `setTimeout` just to stay off Nightwatch's callback stack. The drain, the collector-ready probe and the injection now go over `helpers/webdriverHttp.ts`, so they touch no queue and fire synchronously from the command callback; because a driver serialises requests per session, a drain issued there is served *before* the next queued command. That immediate drain is what captures the **outgoing** page's field edits — deferred, a submit click navigated first and they died with the page, so the `#password` fill row replayed with an empty password box.
+  - A second drain anchors the **destination**, and it has to wait: a Nightwatch click resolves before its navigation commits (measured 6 ms), so the immediate drain still finds the outgoing collector, recovers nothing, and the new document is never anchored — every action on it then replays the page it came from (measured: 5 of 20 rows, with no `/secure` anchor in the stream at all). `session.ts` `anchorAfterNavigation` polls for the collector to *disappear* — the signal that the document was replaced — then drains with a forced anchor. Keyed on the document being replaced rather than on which command ran, so it covers any route to a new document without a command list to keep in sync; a command that navigated nowhere polls out and costs one drain of an empty buffer. Tracked in `snapshotCaptures` so finalize awaits it.
+  - Deleting the (accidentally load-bearing) `browser.url()`-getter injection is what exposed this: that spurious re-injection had been anchoring the destination as a side effect.
+- **A failing step needs a ROW before its error has anywhere to go.** `ACTION_MAP` carried WDIO's explicit waits but none of Nightwatch's, so `waitForElementVisible` — the command a Nightwatch test most often fails on — produced no action at all: the failure was absent from the action list *and* the Errors tab (which collects commands carrying `error`), surviving only as console text. The `waitForElement*` family is now normalized onto the WDIO wait methods. Two derivations back it up in `trace-action-events.ts` `actionError`: a collapsed `passed: false` result now marks any row failed rather than only assert-class rows, and a **wait whose result is `false` is a timeout** — Nightwatch reports those through its own assertion channel, not the command callback, which hands back `{value: null}` and collapses to a bare boolean, so that boolean is the row's only evidence. The `false` reading is scoped to waits because it is a legitimate value for a boolean read like `isDisplayed`, and WDIO's waits throw rather than return it. The message is synthesized from the command + selector; Nightwatch's own prose is not reachable from the callback.
+- **`browser.url()` is both a navigation and a getter.** With no argument it just reads the current url, which is how `assert.urlContains` reads it from inside Nightwatch's queue. The nav proxy treated that read as a navigation — re-injecting the collector and forcing an anchored drain mid-test for a command that changed nothing, and logging the capture callback's whole function body as the "url". It now gates on a string first argument.
+- **A Nightwatch command failure arrives as a callback RESULT, not a throw.** Only a synchronous failure reaches the `try/catch` around the wrapped method; an async one (a command that times out waiting for an element) invokes the capture callback with an error-shaped object, and the driver response nests it one level down under the W3C `value` wrapper. `browserProxy.ts` `callbackError` unwraps that and promotes it to the row's `error`. Left in `result`, the row kept `error: undefined` and rendered as a success — no red row, nothing in the Errors tab, the failure readable only as raw text in the result pane. A result carrying `passed` is an assertion outcome and is deliberately not reinterpreted, since those have their own pass/fail path.
+- **Row order comes from issue order (`CommandLog.sequence`), not from the millisecond clock.** `browser.assert.*` calls are enqueued synchronously and the next command is invoked in the same millisecond, so their `startTime`s tie; because assert rows are appended in the test-end batch while driver rows are appended at completion, the tie resolved in insertion order and put an assert *after* the command it preceded (measured: `assert.textContains` landing below the logout click it ran before). Nightwatch stamps `sequence` when the test issues a row — a driver command at invocation, an assert at enqueue — and `buildActionEvents` uses it as the sort tiebreak. Adapters that emit no deferred rows leave it unset and keep insertion order.
+  - Nightwatch's own per-assertion execution windows are unavailable here: `results.commands` is **empty** for the BDD interface, so `assertCommandTimings` always returns nulls and the rows keep their enqueue timestamp. That is why issue order, not reported timing, has to carry the ordering.
+- **Actions that only read the page inherit the preceding action's capture** (`core/trace-frame-snapshots.ts` `claimAfter`). It is non-consuming and falls back to the most recent earlier capture instead of returning nothing, because several actions legitimately share one page state — Nightwatch emits its native assertion rows in a batch whose execution windows collapse onto one instant, and handing the capture to whichever claimed first left the rest of the batch with no DOM, no a11y tree and no screenshot. Nightwatch correspondingly takes **no** capture for an assertion row (`captureAssertCommand`): those rows are emitted at test-end but positioned back on their real execution window, so probing there recorded the page as it was *then* under a timestamp seconds earlier (an assert that ran on `/secure` rendered the `/login` page the test later logged out to).
+- **Every per-action snapshot probe is timeout-guarded** (`core/action-snapshot.ts` `probe`, `SNAPSHOT_DRIVER_PROBE_TIMEOUT_MS`), not just the in-page scripts. Nightwatch's `browser.getCurrentUrl()`/`getTitle()` are QUEUED commands: called from inside the plugin's own command hook they enqueue behind the command still running and never resolve, and one unguarded probe in the capture's `Promise.all` stranded the whole snapshot — 10 of 14 captures never settled, so those actions reached the trace with no DOM, no a11y tree and no element rects. Nightwatch now runs all four probes (url/title/screenshot/script) over the raw WebDriver HTTP transport in `nightwatch-devtools/src/helpers/webdriverHttp.ts`, bypassing the queue entirely — the pattern `takeScreenshotViaHttp` already used. Relatedly, `runWith` treats a `null` script result as its fallback: a driver that answers `null` instead of rejecting (no-such-session, transport-swallowed script error) otherwise handed the serializers a non-array and lost the entire snapshot, screenshot and all.
 - The per-test `screenshot` and `video` options live on the **WDIO `ServiceOptions` only** — not `BaseDevToolsOptions` — because only the service implements them (an option belongs on an adapter until a second adapter consumes it, mirroring the core-helper rule; putting them on the shared base made them appear available in Selenium/Nightwatch and broke those adapters' `Required<>` option types). The policy *types* (`TraceScreenshotPolicy`/`TraceVideoPolicy`) and the capture/slice/encode logic (`core/screenshot-artifact.ts`, `core/video-slice.ts`) are framework-agnostic, so Selenium/Nightwatch adoption was wiring-only — now done (Selenium adds the options on its own `DevToolsOptions` with full inline attach; Nightwatch adds them produce-only — see the Allure-attach entry below). All are gated to `traceGranularity:'test'` (per-test inline Allure); coarser granularities keep artifacts in the manifest. Video records the screencast continuously and slices per-test by wall-time — the session frame buffer is bounded by `maxBufferFrames` (default 2000; decimates keeping first/last), and on non-Chrome the polling recorder issues many `takeScreenshot`s that flood `@wdio/allure-reporter` (pair with `disableWebdriverStepsReporting`).
 - The `filmstrip` option (dense screencast into the trace) is on **`BaseDevToolsOptions`** — the counterexample to the screenshot/video entry above — because all three adapters implement it (the "second consumer → base" rule realized). Core owns the work (`core/screencast-trace.ts` `thinScreencastFrames`/`buildDenseScreencast`; slice windowing in `spec-trace-helpers.ts`); adapters only default the option, un-gate the recorder in trace mode when it's set, and feed `recorder.frames` into the finalize context. Each adapter captures frames while the recorder is still alive (service `onReload` → `#filmstripFrames`; Selenium `onDriverEnd` drain before nulling; Nightwatch `#finalizeCurrentScreencast` snapshot before delegating), and each finalize context spreads `[...accumulated, ...(live recorder frames)]` so a **mid-run** per-spec/per-test slice flush (which fires before the recorder is drained) isn't blank. When dense frames are present they **supersede** the sparse per-action filmstrip (the per-action DOM `elements`/`snapshot` are carried independently by the `frame-snapshot` events, so no DOM data is lost); a run without dense frames keeps the sparse filmstrip, byte-stable with before. Thinning is applied at export; the live session frame buffer is bounded by `maxBufferFrames` (default 2000; see the screenshot/video entry above). Per-test filmstrip slicing follows the same per-test-hook availability as `traceGranularity:'test'` (works for WDIO mocha/cucumber, Selenium mocha, Nightwatch exports-object/cucumber; Nightwatch BDD `describe/it` degrades to session scope per the entry below), and non-Chrome polling carries the same reporter-noise caveat.
 - Per-test artifact **Allure attachment** is cross-adapter via a pluggable sink in `core/allure-artifacts.ts` (`AllureAttachSink`; `captureAndAttachScreenshot`/`captureAndAttachVideo`/`attachTraceArtifact`/`lastRenderedScreenshot` — moved out of the WDIO service). The service supplies a `@wdio/allure-reporter` sink; **Selenium** supplies an `allure-js-commons` `attachment()` sink (runtime-agnostic — attaches under any allure runner adapter — gated on `globalThis.allureTestRuntime`, dynamic-imported as an optional peer dep). An **undefined sink = produce-only** (write file + manifest, skip attach). Caveats: (a) **Selenium inline-attach needs awaited runner hooks** — its mocha `afterEach`/jest `afterEach`/cucumber `After` are now async + awaited so the async produce+attach lands while the allure adapter still holds the current test open (fire-and-forget attaches to the next test or drops); Gherkin `AfterStep`→`onTestEnd` stays fire-and-forget. (b) **Nightwatch inline-attach is unsupported** — `nightwatch-allure` is post-hoc with no live attach API, and `allure-js-commons` no-ops in a Nightwatch run (nothing calls `setGlobalTestRuntime`); Nightwatch is produce-only. Revisit if an `allure-js-commons`-based Nightwatch runtime adapter appears (then it's a sink swap). (c) **video is standalone** in both adapters (recorder starts for `video != off` OR filmstrip in trace mode; the orphan session-webm encode is trace-gated to stop-only).
@@ -250,17 +279,25 @@ Documented divergences from the conventions above. They exist today as debt to b
 - Nightwatch native asserts are buffered at call time and emitted in one batch at test-end (Nightwatch exposes no per-assertion execution/outcome hook reachable from the plugin — `client.queue.tree` / `client.reporter` aren't on `browser`). Streaming mid-run would flash every assert green before its outcome is known, so rows are held and reconciled against `results.testcases[*].assertions` at `afterEach` (the flat `results.assertions` only reflects the last testcase). The exporter re-sorts commands by timestamp (`buildActionEvents`) so the batched rows land at their real timeline positions rather than clustering at flush time. `actual` is parsed from the failure message (`but got: …`, failures only) into a collapsed `{passed, expected, actual}` result; `expected` is the assertion arg — the label still mirrors the call args, not the derived values.
 - Nightwatch's BDD `describe/it` interface fires the plugin's global `beforeEach`/`afterEach` **once per module** (with an empty `currentTest.name`), not per `it` — Nightwatch runs the individual `it`s internally with no per-testcase hook or event reachable from the plugin (the lib emits only transport-level events). So `traceGranularity:'test'` records a single slice boundary (the first test) and collapses to one session-scoped slice; retry-aware/per-test retention (`tracePolicy`) degrades to session scope for this interface. Per-test slicing works for adapters/styles that expose per-test hooks (WDIO mocha/cucumber, Selenium mocha; likely Nightwatch's exports-object style, unverified). Session-granularity trace is unaffected. **No per-test support has been built for this interface** — real per-`it` slicing needs a hook Nightwatch doesn't surface; deferred to a full-picture pass, not attempted yet.
   - **Empirically confirmed** (BDD example, `mode:'trace'` + `traceGranularity:'test'` + `tracePolicy:'retain-on-failure'` + `screenshot:'on'` + `video:'retain-on-failure'`): the one collapsed slice is keyed to the **first** test's uid (the artifacts manifest's `tests[]` still carries every testcase with correct `state`, so metadata capture is fine — it's the *slice/artifact* keying that collapses). Consequence: with a passing first test and a failing later test, the screenshot **produces** (policy `'on'` captures regardless of outcome, keyed to the first test) but the **trace zip and video are dropped** — `retain-on-failure` evaluates the first (passing) test's outcome, and the actually-failing test never gets its own slice to retain. The per-test produce-only path itself (screenshot/video write + manifest) is correct; only the BDD slice-keying limits it.
-- **Nightwatch cucumber: traces now generate + capture asserts; DOM mutations still missing** (via the `test/` harness, 2026-07). Three fixes made the cucumber runner emit a useful trace: **(1) build** — `packages/nightwatch-devtools/tsup.config.ts` now compiles `src/helpers/cucumberHooks.cts` → `dist/helpers/cucumberHooks.cjs` as a self-contained CJS bundle (`@cucumber/cucumber` external). Previously the build ran only `tsup src/index.ts --clean`, so that file never existed and Cucumber's `require:[cucumberHooksPath]` registered *no* hooks (glob matched nothing) → zero capture. `PLUGIN_GLOBAL_KEY` moved to a leaf module `plugin-global-key.ts` so the hooks bundle stays tiny and CJS-safe (importing it via `constants.ts` dragged in core → `createRequire(import.meta.url)`, which throws when bundled to CJS). **(2) capture ordering** — a pre-quit cucumber `After` hook (`order:1000`, `captureCucumberScenarioBeforeQuit`) runs the trace capture + slice flush while the per-scenario browser session is live (the `order:-1` finalize is post browser-quit, so the flush bailed on the absent `sessionId`). Requires `traceGranularity:'test'` (per-scenario slices). **(3) native asserts** — the same pre-quit hook drains `browserProxy.drainNativeAssertCalls()` and calls `captureNativeAssertions` (the `afterEach` path early-returns for cucumber), so `assert.*` rows now appear. **Remaining gaps:** (a) assert **pass/fail isn't correlated** for cucumber — `captureNativeAssertions` is passed `currentTest: undefined` (cucumber has no `browser.currentTest.results`), so rows render neutral; cucumber needs a reconcile against its own scenario result. (b) DOM **`mutations` aren't captured** (`hasMutations:false`) — the page collector fails to (re)inject on the per-scenario re-navigated session (`ECONNRESET` / "collector not found" during teardown), and that noisy teardown-race is itself worth cleaning up. Console/network (BiDi) + commands + asserts + frames + sources + transcript are captured. BDD and live mode are unaffected.
+- **Nightwatch cucumber: traces generate, capture asserts with real pass/fail, and carry DOM mutations** (via the `test/` harness, 2026-07; both remaining gaps closed and re-verified 2026-08-06). Three fixes made the cucumber runner emit a useful trace: **(1) build** — `packages/nightwatch-devtools/tsup.config.ts` now compiles `src/helpers/cucumberHooks.cts` → `dist/helpers/cucumberHooks.cjs` as a self-contained CJS bundle (`@cucumber/cucumber` external). Previously the build ran only `tsup src/index.ts --clean`, so that file never existed and Cucumber's `require:[cucumberHooksPath]` registered *no* hooks (glob matched nothing) → zero capture. `PLUGIN_GLOBAL_KEY` moved to a leaf module `plugin-global-key.ts` so the hooks bundle stays tiny and CJS-safe (importing it via `constants.ts` dragged in core → `createRequire(import.meta.url)`, which throws when bundled to CJS). **(2) capture ordering** — a pre-quit cucumber `After` hook (`order:1000`, `captureCucumberScenarioBeforeQuit`) runs the trace capture + slice flush while the per-scenario browser session is live (the `order:-1` finalize is post browser-quit, so the flush bailed on the absent `sessionId`). Requires `traceGranularity:'test'` (per-scenario slices). **(3) native asserts** — the same pre-quit hook drains `browserProxy.drainNativeAssertCalls()` and calls `captureNativeAssertions` (the `afterEach` path early-returns for cucumber), so `assert.*` rows now appear. Console/network (BiDi) + commands + asserts + frames + sources + transcript are captured. BDD and live mode are unaffected.
+  - **Assert outcomes are correlated off the assertion's own promise, because the results bag does not exist.** Cucumber's Nightwatch client is built by `createClient` with **no reporter**, so `SimplifiedReporter.logAssertResult` no-ops and `results.assertions`/`results.testcases` are *never* populated — no scenario-level reconcile can recover them, which is why `currentTest: undefined` was a dead end. `nativeAssertions.ts` `observedAssertOutcome` reads the outcome from the returned promise instead (`lib/core/asynctree.js` `shouldRejectNodePromise`: a failing `assert.*` rejects its deferred, a failing `verify.*` resolves *with* the AssertionError, a pass resolves with the command value). A fulfilment of `undefined` stays **neutral** — that is an assertion enqueued but never executed after an earlier `assert.*` emptied the queue, and reading it as a pass would paint a never-run assertion green. The results bag still wins where it exists and the row's window comes from whichever source supplied the outcome, so the describe/it timeline is byte-stable. Measured: **4 of 4 assert rows with a real pass/fail** (was 2 of 4 rows, 0 correlated), spanning real 44–372 ms windows instead of a synthetic 1 ms.
+  - Relatedly, cucumber's **per-step** `resetCommandTracking()` was wiping the native-assert buffer, so each scenario kept only its *last* step's assertions (measured 1 of 2). The buffer is per **test unit** — `resetTestTracking()` at `wrapBrowserOnce` now clears it.
+  - **DOM `mutations` ARE captured**, and the old `ECONNRESET` / "collector not found" attribution is **wrong** — neither appears any more. The gap closed itself with document-start injection (`core/bidi-preload.ts`), confirmed on a *baseline* build so the credit is A10's. Measured per scenario with `traceGranularity:'test'` + `webSocketUrl: true`: 39 and 19 mutation entries, 2 DOM anchors each, **0 of 19 rows on the wrong document**. What remains is noise, not a gap: the screencast poller issues `/screenshot` every 200 ms into the session Nightwatch quits per scenario, logging 9–26 `WARN webdriverHttp: … socket hang up` per run. Fix is to stop the recorder before the per-scenario quit, or suppress the warn for a session in teardown.
+- **A captured text locator is generated in the recording runner's dialect; every other branch is portable CSS.** `shared/locator-dialect.ts` `locatorDialect(runner)` is the one fact table — WDIO runners (`mocha`/`jasmine`/`cucumber`) get `a*=Logout`, `nightwatch*`/`selenium-webdriver` and an **unidentified recorder** get `//a[contains(., "Logout")]`. The id reaches the page script as `CaptureActionSnapshotInput.runner` and the zip as an extension field on `context-options`, read back through `isTestRunnerId` onto `Metadata.runner`; absent in older and foreign zips, where the player shows no hint. Under WDIO a text carrying a `"` still emits XPath — WDIO compiles `tag*=` to XPath with `"` quoting and would build a broken expression — and WDIO resolves `//` itself. `locatorsMatch` decomposes **both** sides from either dialect, so `after.point` survives whichever way round the two grammars fall; the `concat()`-stitched literal is still left to exact comparison. `@wdio/elements`' standalone `getSnapshot` deliberately keeps the portable XPath default (its output is pasted into arbitrary tools), so a WDIO run's `browser.getSnapshot()` and its trace A11y tab disagree on that one branch.
+- `Metadata.runner` (typed `TestRunnerId`) and `metadata.options.framework` (untyped `string`, read by the sidebar's `getFramework`) are two carriers of the same fact. All three adapters now set both; the next change to either should collapse `getFramework` onto `Metadata.runner`.
+- Selenium's `ctx.runner` (the *detected JS runner* — mocha/jest/cucumber, from `detectRunner()`) shadows the new `Metadata.runner` concept. Renamed to `detectedRunner` at the `driverMetadata` boundary only, where the two met inside one function and a swap would have been a silent dialect bug; the repo-wide rename in `plugin-internals.ts`/`session-lifecycle.ts` is still open.
+- **A node:assert's target comes from VALUE PROVENANCE, not from the assert call.** node:assert takes values, so `assert.equal(await el.getText(), …)` names no element. `core/read-value-locators.ts` owns the value→locator registry (`rememberReadValue`/`selectorForReadValue`/`resolveAssertTargetFromArgs`; most-recent-producer-wins, 200 keys, ≤256 chars, primitives only), reached through `patchNodeAssert`'s optional `resolveAssertTarget` hook, which walks the **raw** args (sanitizing destroys handle identity) onto the shared `CommandLog.selector`. It lives in core because two adapters feed it. **Selenium** feeds it from `driverPatcher`'s settle path and composes it with its handle WeakMap (`helpers/element-locators.ts`, adapter-local — it keys on `WebElement` identity, which no other framework has). **Nightwatch** feeds it from `browserProxy`'s capture callback via `assertTarget.commandTargetSelector`, an allowlist of element-read commands; every other command — every driver-level read (`title`, `getCurrentUrl`, `source`) included — records the **null sentinel**, without which a page-title assertion inherits the box of an element that reads the same text (measured on selenium's mocha example, `h1` vs `document.title` both "Example Domain"; reproduced and fixed for Nightwatch on a local `#hero`/`<title>` collision page). Measured: Nightwatch node:assert rows with a locator **0/7 → 4/7** (the 3 without are a title read, the title/`#hero` collision, and a literal); Selenium unchanged at 2/4 mocha and 2/3 cucumber. Residuals: boolean reads are weakly discriminating, so a value collision with no intervening producer can mis-attribute; Nightwatch's `element()/.find()` API and its ignored commands (`execute`, `executeAsync`, `perform`) are never wrapped, so their values neither claim nor clear. **`after.point` is deliberately not extended to assert rows** — `resolveActionPoint` gates on `class:'Element'` + `POINTABLE_METHODS`, so WDIO's folded assertion rows get none either; a point draws a click marker an assertion never earned.
+- **A Nightwatch NATIVE assert's target comes from the CALL, not from value provenance.** Its element assertions take the element definition as their first argument (`textContains(definition, expected)`) while the page-level ones take the expected value there (`urlContains(expected)`), so `nightwatch-devtools/src/helpers/assertTarget.ts` reads the locator straight off the recorded args. It is an **allowlist transcribed from Nightwatch's own assertion signatures**, never a "first string arg" heuristic — the same namespace also carries `title*`/`url*` and node:assert's value mirrors (`ok`, `equal`, `strictEqual`), whose first argument is a plain value. A `{selector, locateStrategy}` bag and a Nightwatch `Element` are duck-typed on `.selector`; a definition built from a resolved handle yields none, and `not.*` reads through the negated namespace. Measured: 2 of 4 assert rows carry `#flash` and both `urlContains` rows carry none, on both the BDD and cucumber interfaces, with action counts, DOM anchors and row→document mapping identical to a same-build baseline.
+- **Two mechanisms resolve a command's target selector, and the WDIO one is wrong for interleaved handles.** Selenium keys a `WeakMap` on handle identity (`WebElement.id_` is a promise, so no id is readable when a command is invoked); the service uses a mutable last-selector in `service/src/command-selectors.ts`, which stamps the wrong locator for `const a = await $('#a'); const b = await $('#b'); await a.click()` (the Selenium side is covered in `selenium-devtools/tests/element-locators.test.ts`; the WDIO failure itself has **no** test — it is an unverified reading of `command-selectors.ts`). They cannot share a registry — WDIO's hook sees a *serialized* handle carrying an id string and never the live object, Selenium has the object and no readable id. Unifying would need the policy parameterized rather than the storage shared; until then the WDIO path is knowingly wrong in that case. Nightwatch is a third mechanism: it reads arg 0 through a per-kind allowlist (`assertTarget.ts`) rather than tracking handles at all, because its classic API takes selector strings. The allowlists are deliberately **not** derived from shared's `ACTION_MAP` — that table says how a command *renders* (its `Element` entries include WDIO commands called on a handle, with no selector argument), not whether arg 0 is an element definition.
 - Service renders expect-webdriverio matchers as single `expect.<matcher>` rows by **folding**, not stack/depth suppression (the old `#assertionDepth`/`#matcherStarted`/self-heal machinery is gone). The matcher's value-read (`toHaveText`→`getText`, `toExist`→`isExisting`, …) is captured as a normal command; `afterAssertion` then coalesces the synthesized `expect.*` row into that read in place — inheriting its callSource, screenshot, and timeline position — and the fold replaces **by timestamp, never a public `id`**: `id` is the per-worker `commandCounter`, which resets per spec, so stamping one lets the app's id-first `replaceCommand` swap a same-id row from another spec (duplicate rows + a fold from another spec vanishing, in multi-spec live mode). `beforeAssertion` arms the pending matcher (depth-counted so aliases like `toBeChecked`→`toBeSelected` fold once); a matcher that **hard-throws** — element never resolves, so expect-webdriverio's `waitUntil` rethrows and `afterAssertion` never fires — is synthesized at `afterTest`/`afterStep` from the throwing read, so a failing assertion renders as `expect.<matcher>` whether or not the element existed. Two limits: its error is then the read's (`Can't call getText on … element wasn't found`), not an assertion-phrased message; and `MATCHER_READ_COMMANDS` is a hand-maintained allowlist, so a matcher whose read isn't listed leaves its raw read visible alongside the `expect.*` row. Plain-value jest matchers (`expect(x).toBe(y)`) don't fire the ewdio hooks, so they aren't captured as rows.
 
 ### File-size (raw line counts; soft cap is 500 logic lines)
 
 Most entries below don't trigger the `max-lines` lint rule after `skipBlankLines`/`skipComments`; they're documented because their raw line count is over 500, and the next substantive change to any of them should still look for an extraction opportunity. The service plugin is the exception — it's now over the *logic*-line cap.
 
-- `packages/service/src/index.ts` — over the 500-**logic**-line soft cap and ~620 raw (the WDIO plugin god-file: session/screencast/command/assertion/trace-slice wiring in one class). The assertion-capture block (`beforeAssertion`/`afterAssertion`/`#handleAssertionOutcome`/`#finalizePendingAssertion`, plus the `#assertionDepth`/`#pendingAssertion` state) is now the largest self-contained seam and the prime extraction candidate; trace-slice and screencast are the next two.
-
-- `packages/nightwatch-devtools/src/index.ts` (~536 raw). Cucumber/test/run-lifecycle, session-init, event-hub modules already extracted; remainder is the `PluginInternals` accessor bag plus per-method delegators plus the factory. Accept-as-is.
-- `packages/selenium-devtools/src/index.ts` (~758 raw). Session/test-lifecycle **and** the per-test-artifact seam are now extracted: the sink cache + input snapshot + produce/attach flow live in `selenium-devtools/src/test-artifacts.ts` as `SeleniumTestArtifacts` (mirrors Nightwatch's twin — a typed input bag threading the Allure sink + flushed-trace promise), and the plugin keeps only a thin bag-building delegator. Remainder is the `PluginInternals` accessor bag plus onCommand/onDriverCreated wiring. Still over the 500 **raw** soft cap (under the logic-line cap after `skipBlankLines`/`skipComments`); the accessor bag / command wiring is the next extraction candidate if it grows.
+- `packages/service/src/index.ts` (602 logic / 843 raw, was 729/1043). Still over the 500-logic cap. The screencast and trace-slice seams are extracted: `screencast-lifecycle.ts` (139 logic / 217 raw) owns every read and write of recorder frames — start, reload, finalize, the cross-`reloadSession` filmstrip buffer and the per-test video slice, two invariants that were previously produced and consumed 400 lines apart — and `trace-slices.ts` (58 logic / 87 raw) owns boundary recording plus the eager per-test flush beside the flush I/O it already held. The only remaining cluster large enough to close the gap is the command-hook family (`beforeCommand`/`afterCommand`/`#commandStack`/`#markDocument`/`#drainAfterLiveCommand`, ~120 logic lines); `before()` is still over the function cap at 62 logic lines.
+- `packages/nightwatch-devtools/src/index.ts` (783 raw / 676 logic). Cucumber/test/run-lifecycle, session-init, event-hub and now the screencast seam (`plugin-screencast.ts`, 105 raw / 60 logic) are extracted; the remainder is the `PluginInternals` accessor bag plus per-method delegators plus the factory. The bag is deliberately declarative — accept as-is.
+- `packages/selenium-devtools/src/index.ts` (~644 raw, down from ~758 — the dead `scriptInjected` accessor pair and setter are gone). Session/test-lifecycle **and** the per-test-artifact seam are now extracted: the sink cache + input snapshot + produce/attach flow live in `selenium-devtools/src/test-artifacts.ts` as `SeleniumTestArtifacts` (mirrors Nightwatch's twin — a typed input bag threading the Allure sink + flushed-trace promise), and the plugin keeps only a thin bag-building delegator. Remainder is the `PluginInternals` accessor bag plus onCommand/onDriverCreated wiring. Still over the 500 **raw** soft cap (under the logic-line cap after `skipBlankLines`/`skipComments`); the accessor bag / command wiring is the next extraction candidate if it grows.
 - `packages/nightwatch-devtools/src/session.ts` (~468). `captureNetworkFromPerformanceLogs` + `captureBrowserLogs` + `captureTrace` are tightly coupled to NightwatchBrowser state. Coverage at 78% after recent backfill; further extraction would need rewriting the browser-coupling.
 
 ### Test coverage gaps (worst-risk-first)
diff --git a/README.md b/README.md
index 9444f512..a3695816 100644
--- a/README.md
+++ b/README.md
@@ -136,8 +136,8 @@ The trace artifact contains:
 - `trace.trace` — NDJSON `context-options` + `before`/`after` action events. When test hooks are available (Mocha's `it()` / Cucumber's `Scenario()`), each test becomes a `Tracing.tracingGroup` span — an open/close `before`/`after` pair with `method: "tracingGroup"` and `params.name` set to the test title. Child actions inside the group carry `parentId` pointing back to the group's `callId`, so timeline viewers render tests as labelled spans wrapping their commands.
 - `trace.network` — HAR-style network entries derived from the existing capture
 - `resources/page@<id>-<ts>.jpeg` — screenshot per user-facing action
-- `resources/elements-page@<id>-<ts>.json` — flat interactable element list extracted by the page-injected scripts in `@wdio/devtools-core/element-scripts`
-- `resources/snapshot-page@<id>-<ts>.txt` — depth-indented accessibility-tree snapshot (AI-friendly)
+- `resources/page@<id>-<ts>-elements.json` — flat interactable element list extracted by the page-injected scripts in `@wdio/devtools-core/element-scripts`
+- `resources/page@<id>-<ts>-snapshot.txt` — depth-indented accessibility-tree snapshot (AI-friendly)
 - `transcript.md` — human/LLM-readable Markdown transcript of the captured actions, with timing, selectors, and value annotations
 
 What counts as a user-facing action is filtered through an allow-list in `@wdio/devtools-core/action-mapping.ts` (`url`, `click`, `setValue`, `sendKeys`, `get`, etc.). Internal commands like `findElement`/`waitUntil`/`executeScript` don't produce trace entries.
@@ -158,7 +158,7 @@ npx show-trace path/to/trace.zip      # in a project that installs an adapter
 The player exposes everything captured in the archive:
 
 - **DOM time-travel** — the browser pane replays the page from the captured DOM **mutation stream**, so scrubbing the playhead reconstructs the live DOM at any point, not just a screenshot.
-- **A11y tab** — the accessibility tree (roles + accessible names) captured for the selected command; hover a row to outline the element in the snapshot, click to copy its locator.
+- **A11y tab** — the accessibility tree (roles + accessible names) captured for the selected command; hover a row to outline the element in the snapshot, click to copy its locator. Locators are generated in the recording runner's own dialect. An element identified only by its text is `a*=Logout` under WebdriverIO and `//a[contains(., "Logout")]` under Selenium, where the panel names the strategy that resolves it (`By.xpath()`). **Nightwatch prefers a native CSS locator** (`button[type="submit"]`, `a.button`) — it is the only runner that reads a bare selector string under a default CSS strategy — and falls back to XPath, captioned `useXpath()` / `locateStrategy: 'xpath'`, only when nothing unique exists. Every other branch is portable CSS.
 - **Errors tab** — every failing `expect`/assertion and step failure collected in one place, each with a jump-to-source link to the command that threw.
 - **Element overlay (pick-locator)** — labelled, click-to-copy boxes drawn over every element the test interacted with, cross-linked to the A11y rows.
 - **Transcript tab + Copy-for-LLM** — the run's Markdown transcript with a one-click "copy prompt" that bundles it with any failing-command errors, paste-ready for an LLM.
diff --git a/examples/nightwatch/cucumber/features/login.feature b/examples/nightwatch/cucumber/features/login.feature
index 05fdd88d..e15ec16b 100644
--- a/examples/nightwatch/cucumber/features/login.feature
+++ b/examples/nightwatch/cucumber/features/login.feature
@@ -1,15 +1,19 @@
-Feature: Example site smoke test
+Feature: the-internet login flow
 
-  Mirrors the Nightwatch BDD smoke-test: open a site, wait for the body to be
-  visible, and assert the page title. Runs as a Cucumber scenario so the
-  cross-adapter harness has a nightwatch-cucumber trace fixture.
+  Mirrors the Selenium cucumber example's feature so the cross-adapter harness
+  has a nightwatch-cucumber trace fixture over the same flow. Cucumber exposes
+  per-scenario hooks, so each scenario below is captured as its own test unit.
 
-  Scenario Outline: I can open a site and read its title
-    Given I navigate to "<url>"
-    When the page body becomes visible
-    Then the page title contains "<title>"
+  Scenario: logs in with valid credentials and lands on /secure
+    Given I am on the login page
+    When I enter username "tomsmith" and password "SuperSecretPassword!"
+    And I submit the login form
+    Then I should be on the secure page
+    And I should see a flash message matching "You logged into a secure area"
 
-    Examples:
-      | url                    | title   |
-      | https://example.com    | Example |
-      | https://example.org    | Example |
+  Scenario: rejects invalid username with an error flash
+    Given I am on the login page
+    When I enter username "foobar" and password "barfoo"
+    And I submit the login form
+    Then I should see a flash message matching "Your username is invalid"
+    And I should still be on the login page
diff --git a/examples/nightwatch/cucumber/features/step_definitions/login.steps.js b/examples/nightwatch/cucumber/features/step_definitions/login.steps.js
index 00e11202..13b3e1c9 100644
--- a/examples/nightwatch/cucumber/features/step_definitions/login.steps.js
+++ b/examples/nightwatch/cucumber/features/step_definitions/login.steps.js
@@ -1,18 +1,42 @@
-// Step definitions for the example-site smoke scenario.
+// Step definitions for the the-internet login scenarios.
 //
 // Nightwatch's Cucumber integration injects the Nightwatch `browser` onto the
 // World, so steps reach it via `this.browser` — hence regular (non-arrow)
 // functions so `this` binds to the World.
 const { Given, When, Then } = require('@cucumber/cucumber')
 
-Given(/^I navigate to "([^"]*)"$/, async function (url) {
-  await this.browser.url(url)
+const LOGIN_URL = 'https://the-internet.herokuapp.com/login'
+
+Given(/^I am on the login page$/, async function () {
+  await this.browser.url(LOGIN_URL)
+  await this.browser.waitForElementVisible('#username', 5000)
 })
 
-When(/^the page body becomes visible$/, async function () {
-  await this.browser.waitForElementVisible('body', 5000)
+When(
+  /^I enter username "([^"]*)" and password "([^"]*)"$/,
+  async function (username, password) {
+    await this.browser.setValue('#username', username)
+    await this.browser.setValue('#password', password)
+  }
+)
+
+When(/^I submit the login form$/, async function () {
+  await this.browser.click('button[type="submit"]')
 })
 
-Then(/^the page title contains "([^"]*)"$/, async function (title) {
-  await this.browser.assert.titleContains(title)
+Then(/^I should be on the secure page$/, async function () {
+  await this.browser.waitForElementVisible('#flash', 5000)
+  await this.browser.assert.urlContains('/secure')
+})
+
+Then(
+  /^I should see a flash message matching "([^"]*)"$/,
+  async function (text) {
+    await this.browser.waitForElementVisible('#flash', 5000)
+    await this.browser.assert.textContains('#flash', text)
+  }
+)
+
+Then(/^I should still be on the login page$/, async function () {
+  await this.browser.assert.urlContains('/login')
 })
diff --git a/examples/nightwatch/nightwatch.conf.cjs b/examples/nightwatch/nightwatch.conf.cjs
index bcbe00da..7aa4bd94 100644
--- a/examples/nightwatch/nightwatch.conf.cjs
+++ b/examples/nightwatch/nightwatch.conf.cjs
@@ -30,6 +30,11 @@ module.exports = {
         'goog:chromeOptions': {
           args: [
             '--headless',
+            // Chrome's password-leak check silently stops delivering ALL
+            // WebDriver-synthesized input to the tab ~1s after a breached
+            // credential is submitted (tomsmith/SuperSecretPassword! is in the
+            // corpus). Blocking only that host prevents it; see CLAUDE.md.
+            '--host-resolver-rules=MAP passwordsleakcheck-pa.googleapis.com 127.0.0.1',
             '--no-sandbox',
             '--disable-dev-shm-usage',
             '--window-size=1600,900'
diff --git a/examples/nightwatch/tests/smoke-test.js b/examples/nightwatch/tests/smoke-test.js
index 3cdca005..df5652b8 100644
--- a/examples/nightwatch/tests/smoke-test.js
+++ b/examples/nightwatch/tests/smoke-test.js
@@ -1,10 +1,13 @@
 /**
  * Example + config-sweep harness for @wdio/nightwatch-devtools.
  *
- * Walk the live/trace ladder by editing ONLY the mode/traceGranularity/
- * tracePolicy block in ../nightwatch.conf.cjs. The suite carries a passing
- * pair, an always-failing test (retain-on-failure target), and a flaky
- * fail-then-pass test (on-first-retry / attempt-capture target).
+ * Exercises the same the-internet login flow the WDIO and Selenium examples
+ * use, so a trace captured here is comparable across adapters. Walk the
+ * live/trace ladder by editing ONLY the mode/traceGranularity/tracePolicy
+ * block in ../nightwatch.conf.cjs. The suite carries a passing pair (a login
+ * round-trip and a DOM-mutation test), an always-failing test
+ * (retain-on-failure target), and a flaky fail-then-pass test
+ * (on-first-retry / attempt-capture target).
  *
  * Native asserts (browser.assert.*) double as the assertion-capture check:
  * the passing ones must render green ✓, the failing one red ✗.
@@ -14,35 +17,50 @@
  *   pnpm demo:nightwatch:retry    (rung 5 — adds --retries 1)
  */
 
+const BASE_URL = 'https://the-internet.herokuapp.com'
+
 // Survives Nightwatch's testcase retry so the flaky test fails once, then passes.
 let flakyAttempts = 0
 
 describe('nightwatch-devtools smoke test', function () {
-  it('loads example.com and reads the heading', async function (browser) {
-    await browser.url('https://example.com')
-    await browser.waitForElementVisible('body', 5000)
-    browser.assert.titleContains('Example')
-  })
+  it('logs into the secure area with valid credentials', async function (browser) {
+    console.log('[TEST] logging in with valid credentials')
+    await browser.url(`${BASE_URL}/login`)
+    await browser.waitForElementVisible('#username', 5000)
+    await browser.setValue('#username', 'tomsmith')
+    await browser.setValue('#password', 'SuperSecretPassword!')
+    await browser.click('button[type="submit"]')
+    await browser.waitForElementVisible('#flash', 5000)
+    browser.assert.urlContains('/secure')
+    browser.assert.textContains('#flash', 'You logged into a secure area')
 
-  it('navigates and reads the page title', async function (browser) {
-    await browser.url('https://example.org')
-    await browser.waitForElementVisible('body', 5000)
-    browser.assert.titleContains('Example')
+    await browser.waitForElementVisible('a.button', 5000)
+    await browser.click('a.button')
+    await browser.waitForElementVisible('#username', 5000)
+    browser.assert.urlContains('/login')
+    console.log('[TEST] logged back out')
   })
 
-  it('fails on a wrong title (retain-on-failure target)', async function (browser) {
-    await browser.url('https://example.com')
-    await browser.waitForElementVisible('body', 5000)
-    browser.assert.titleContains('This Is Not The Title')
+  it('fails on a wrong flash message (retain-on-failure target)', async function (browser) {
+    console.log('[TEST] submitting invalid credentials')
+    await browser.url(`${BASE_URL}/login`)
+    await browser.waitForElementVisible('#username', 5000)
+
+    await browser.setValue('#username', 'foobar')
+    await browser.setValue('#password', 'barfoo')
+
+    await browser.click('button[type="submit"]')
+    await browser.waitForElementVisible('#flash', 5000)
+    browser.assert.textContains('#flash', 'You logged into a secure area')
   })
 
   it('flaky: fails the first attempt, then passes (retry target)', async function (browser) {
-    await browser.url('https://example.com')
-    await browser.waitForElementVisible('body', 5000)
+    await browser.url(`${BASE_URL}/login`)
+    await browser.waitForElementVisible('#username', 5000)
     flakyAttempts += 1
     if (flakyAttempts === 1) {
       throw new Error('intentional first-attempt failure — should retry')
     }
-    browser.assert.titleContains('Example')
+    browser.assert.titleContains('The Internet')
   })
 })
diff --git a/examples/selenium/cucumber-test/features/support/setup.js b/examples/selenium/cucumber-test/features/support/setup.js
index 907dfb90..7650e29b 100644
--- a/examples/selenium/cucumber-test/features/support/setup.js
+++ b/examples/selenium/cucumber-test/features/support/setup.js
@@ -6,8 +6,8 @@
 
 import { DevTools } from '@wdio/selenium-devtools'
 
-// mode defaults to 'live' (the demo default); the verification harness sets
-// DEVTOOLS_MODE=trace to produce a golden fixture from this same example.
+// mode defaults to 'live' (the demo default); set DEVTOOLS_MODE=trace to
+// produce a trace.zip from this same example.
 DevTools.configure({
   mode: process.env.DEVTOOLS_MODE === 'trace' ? 'trace' : 'live',
   screencast: { enabled: true, quality: 70, maxWidth: 1280, maxHeight: 720 },
diff --git a/examples/wdio/mocha/wdio.conf.ts b/examples/wdio/mocha/wdio.conf.ts
index e6724f21..09069e1e 100644
--- a/examples/wdio/mocha/wdio.conf.ts
+++ b/examples/wdio/mocha/wdio.conf.ts
@@ -13,6 +13,11 @@ export const config: WebdriverIO.Config = {
       'goog:chromeOptions': {
         args: [
           '--headless',
+          // Chrome's password-leak check silently stops delivering ALL
+          // WebDriver-synthesized input to the tab ~1s after a breached
+          // credential is submitted (tomsmith/SuperSecretPassword! is in the
+          // corpus). Blocking only that host prevents it; see CLAUDE.md.
+          '--host-resolver-rules=MAP passwordsleakcheck-pa.googleapis.com 127.0.0.1',
           '--disable-gpu',
           '--remote-allow-origins=*',
           '--window-size=1600,900'
diff --git a/examples/wdio/mocha/wdio.trace.conf.ts b/examples/wdio/mocha/wdio.trace.conf.ts
index b89aa411..40ff25a8 100644
--- a/examples/wdio/mocha/wdio.trace.conf.ts
+++ b/examples/wdio/mocha/wdio.trace.conf.ts
@@ -1,7 +1,8 @@
-// Trace-mode variant of wdio.conf.ts, used by the verification harness
-// (`pnpm fixtures:regen`) to produce a deterministic golden trace.zip. Same
+// Trace-mode variant of wdio.conf.ts, for manually verifying trace output. Same
 // capabilities and specs as the live config; session granularity writes one zip
-// per run. Kept separate so the demo config's live default stays untouched.
+// per run. Every knob reads from the environment so one config covers the
+// live→trace→per-test→retain→retry ladder. Kept separate so the demo config's
+// live default stays untouched.
 export const config: WebdriverIO.Config = {
   runner: 'local',
   specs: ['./specs/**/*.e2e.ts'],
@@ -46,7 +47,7 @@ export const config: WebdriverIO.Config = {
           | 'on-first-retry'
           | 'on-all-retries'
           | 'retain-on-failure-and-retries',
-        // Always emit the manifest so scenario-parity can read the artifact set.
+        // Always emit the manifest so the artifact set is inspectable per run.
         emitArtifactsManifest: true
       }
     ]
diff --git a/packages/app/src/components/browser/element-overlay.ts b/packages/app/src/components/browser/element-overlay.ts
index 02109759..805a5073 100644
--- a/packages/app/src/components/browser/element-overlay.ts
+++ b/packages/app/src/components/browser/element-overlay.ts
@@ -3,6 +3,8 @@
 // boxes inherit the iframe's scale transform (no manual coordinate math). Kept
 // out of snapshot.ts so that file stays focused on capture/replay.
 
+import { isXPathLocator } from '@wdio/devtools-shared'
+
 const OVERLAY_CLASS = '__wdio-el-overlay__'
 
 export interface OverlayHandlers {
@@ -10,7 +12,8 @@ export interface OverlayHandlers {
   onPick: (selector: string, label: string) => void
   /** Hover a box — reveal the matching a11y-tree row (by selector, else by the
    *  element's accessible name for locators the serializer captured a different
-   *  way, e.g. the test's `button[type=submit]` vs the tree's `button*=Login`). */
+   *  way, e.g. the test's `button[type=submit]` vs the tree's
+   *  `//button[contains(., "Login")]`). */
   onHover?: (selector: string, label: string) => void
   onLeave?: () => void
 }
@@ -37,15 +40,45 @@ function elementLabel(el: Element): string {
   return el.getAttribute('placeholder')?.trim() ?? ''
 }
 
-/** Resolve a test locator in the replayed document: native CSS first, then the
- *  WebdriverIO text-selectors querySelector can't parse (`tag=Exact`,
- *  `tag*=Contains`, and their tag-less forms). Returns the deepest text match
- *  so a container that merely encloses the text isn't boxed over the real
- *  element. Returns null when nothing matches (locator absent on this page). */
+/** `XPathResult.FIRST_ORDERED_NODE_TYPE`, read as a literal so the resolver
+ *  doesn't depend on the constant being reachable from this realm. */
+const XPATH_FIRST_ORDERED_NODE = 9
+
+/** First node an XPath locator matches, as the frameworks' own `By.xpath` /
+ *  `useXpath` do. Element-only: an expression selecting an attribute or text
+ *  node has nothing to draw a box over. */
+function resolveXPath(doc: Document, expression: string): Element | null {
+  try {
+    const node = doc.evaluate(
+      expression,
+      doc,
+      null,
+      XPATH_FIRST_ORDERED_NODE,
+      null
+    ).singleNodeValue
+    // nodeType, not `instanceof Element`: the replayed nodes belong to the
+    // iframe's realm, where the parent document's constructors don't match.
+    return node?.nodeType === 1 ? (node as Element) : null
+  } catch {
+    // Malformed expression, or a document with no XPath engine.
+    return null
+  }
+}
+
+/** Resolve a test locator in the replayed document: XPath first, then native
+ *  CSS, then the WebdriverIO text-selectors querySelector can't parse
+ *  (`tag=Exact`, `tag*=Contains`, and their tag-less forms) — those still arrive
+ *  from hand-written WDIO tests and from traces recorded before the capture
+ *  became portable. Returns the deepest text match so a container that merely
+ *  encloses the text isn't boxed over the real element. Returns null when
+ *  nothing matches (locator absent on this page). */
 export function resolveTestSelector(
   doc: Document,
   selector: string
 ): Element | null {
+  if (isXPathLocator(selector)) {
+    return resolveXPath(doc, selector)
+  }
   try {
     const css = doc.querySelector(selector)
     if (css) {
diff --git a/packages/app/src/components/browser/mutation-at-command.ts b/packages/app/src/components/browser/mutation-at-command.ts
index f605da2b..41d799c4 100644
--- a/packages/app/src/components/browser/mutation-at-command.ts
+++ b/packages/app/src/components/browser/mutation-at-command.ts
@@ -5,6 +5,56 @@ import type { CommandLog } from '@wdio/devtools-shared'
 // stores; using the shared Node-side TraceMutation here would not be
 // assignable back into the player's global-typed render methods.
 
+/** Timeline position of a command: its issue clock, then the adapter's issue
+ *  counter, then its position in the array. The first two are the key
+ *  `buildActionEvents` orders the trace by; the array index is the last resort
+ *  so a fully-tied pair keeps arrival order (and a chronologically ordered
+ *  array — every trace — resolves to its own successor, unchanged). */
+type TimelinePosition = readonly [
+  start: number,
+  sequence: number,
+  index: number
+]
+
+const positionOf = (command: CommandLog, index: number): TimelinePosition => [
+  command.startTime ?? command.timestamp,
+  command.sequence ?? 0,
+  index
+]
+
+const isLater = (a: TimelinePosition, b: TimelinePosition): boolean =>
+  a[0] !== b[0] ? a[0] > b[0] : a[1] !== b[1] ? a[1] > b[1] : a[2] > b[2]
+
+/** Start of the command that follows this one ON THE TIMELINE, which is not the
+ *  one that follows it in the array: live mode appends commands in ARRIVAL
+ *  order, and a deferred row (a Nightwatch native assert, held back until its
+ *  outcome is known and flushed in a batch at test-end) arrives long after the
+ *  rows it ran between while carrying its real, much earlier start. Reading the
+ *  array neighbour then bounded a command by a time before it even ran, and the
+ *  replay resolved it to a document several navigations back — measured on the
+ *  BDD example, the run's last `waitForElementVisible('#username')` (on /login)
+ *  took its bound from an assert that had run 7.6s earlier and replayed
+ *  /secure. Traces are exported in timeline order, so there the successor is
+ *  the array neighbour and nothing changes. */
+function nextCommandStart(command: CommandLog, commands: CommandLog[]): number {
+  const idx = commands.indexOf(command)
+  if (idx === -1) {
+    return Infinity
+  }
+  const own = positionOf(command, idx)
+  let next: TimelinePosition | undefined
+  for (let i = 0; i < commands.length; i++) {
+    const candidate = positionOf(commands[i], i)
+    if (!isLater(candidate, own)) {
+      continue
+    }
+    if (next === undefined || isLater(next, candidate)) {
+      next = candidate
+    }
+  }
+  return next ? next[0] : Infinity
+}
+
 /** The DOM state a command left behind — i.e. its RESULT, not the page it
  *  started from. A navigating click's destination DOM is captured a few ms
  *  AFTER the click's own endTime (the mutation timestamp trails the command),
@@ -24,9 +74,7 @@ export function mutationForCommand(
   if (command === undefined || !mutations.length) {
     return undefined
   }
-  const idx = commands.indexOf(command)
-  const next = idx >= 0 ? commands[idx + 1] : undefined
-  const upperBound = next?.startTime ?? next?.timestamp ?? Infinity
+  const upperBound = nextCommandStart(command, commands)
   let best: TraceMutation | undefined
   for (const mutation of mutations) {
     if (mutation.timestamp < upperBound) {
diff --git a/packages/app/src/components/browser/snapshot.ts b/packages/app/src/components/browser/snapshot.ts
index be4d8ff2..cf815a94 100644
--- a/packages/app/src/components/browser/snapshot.ts
+++ b/packages/app/src/components/browser/snapshot.ts
@@ -16,11 +16,11 @@ import { booleanAttributeOn, isBooleanAttribute } from './boolean-attribute.js'
 import { type ComponentChildren, h, render, type VNode } from 'preact'
 import { customElement, query } from 'lit/decorators.js'
 import { transform } from './vnode-transform.js'
-import type { SimplifiedVNode } from '../../../../script/types'
+import type { SimplifiedVNode } from '@wdio/devtools-script/types'
 // Type-only, like the `script/types` import above: the collector owns the
 // characterData wire shape (parent ref + child index), so the replay reads it
 // from the same declaration that produces it.
-import type { TextMutation } from '../../../../script/src/mutations.js'
+import type { TextMutation } from '@wdio/devtools-script/mutations.js'
 import type { CommandLog } from '@wdio/devtools-shared'
 
 import {
@@ -637,8 +637,8 @@ export class DevtoolsBrowser extends Element {
 
   /** Outline the element for an a11y-tree locator. Resolved through the same
    *  resolver the forward direction (the element overlay) uses, because the tree
-   *  captures interactive elements as WDIO text locators (`button*=Login`) that
-   *  querySelector cannot parse. */
+   *  captures text-matched elements as XPath (`//button[contains(., "Login")]`)
+   *  that querySelector cannot parse. */
   #highlightBySelector = (ev: Event) => {
     const detail = (ev as CustomEvent<{ selector?: string } | null>).detail
     const docEl = this.iframe?.contentDocument
diff --git a/packages/app/src/components/sidebar/runnerCapabilities.ts b/packages/app/src/components/sidebar/runnerCapabilities.ts
index 979aed58..93774615 100644
--- a/packages/app/src/components/sidebar/runnerCapabilities.ts
+++ b/packages/app/src/components/sidebar/runnerCapabilities.ts
@@ -36,10 +36,14 @@ export function getRunnerOptions(
   return metadata?.options as RunnerOptions | undefined
 }
 
+/** The runner that recorded this stream. `Metadata.runner` is the typed carrier;
+ *  the untyped `options.framework` is the same fact under an older name, kept as
+ *  a fallback so a zip recorded before the field existed — or by a foreign tool
+ *  that only wrote the option — still resolves. */
 export function getFramework(
   metadata: Metadata | undefined
 ): string | undefined {
-  return getRunnerOptions(metadata)?.framework
+  return metadata?.runner ?? getRunnerOptions(metadata)?.framework
 }
 
 export function getRunCapabilities(
@@ -49,7 +53,7 @@ export function getRunCapabilities(
   if (options?.runCapabilities) {
     return { ...DEFAULT_CAPABILITIES, ...options.runCapabilities }
   }
-  const framework = options?.framework?.toLowerCase() ?? ''
+  const framework = getFramework(metadata)?.toLowerCase() ?? ''
   return FRAMEWORK_CAPABILITIES[framework] || DEFAULT_CAPABILITIES
 }
 
diff --git a/packages/app/src/components/workbench/a11y-tree.ts b/packages/app/src/components/workbench/a11y-tree.ts
index bfa9db3c..f4261193 100644
--- a/packages/app/src/components/workbench/a11y-tree.ts
+++ b/packages/app/src/components/workbench/a11y-tree.ts
@@ -1,13 +1,18 @@
 import { Element } from '@core/element'
+import { consume } from '@lit/context'
 import { html, css, nothing, type TemplateResult } from 'lit'
 import { customElement, state } from 'lit/decorators.js'
 
 import {
   isSnapshotHeaderLine,
+  isXPathLocator,
+  locatorDialect,
   SNAPSHOT_INDENT_UNIT,
   SNAPSHOT_LOCATOR_DELIM
 } from '@wdio/devtools-shared'
-import type { CommandLog } from '@wdio/devtools-shared'
+import type { CommandLog, Metadata } from '@wdio/devtools-shared'
+
+import { metadataContext } from '../../controller/context.js'
 
 import '../placeholder.js'
 
@@ -30,6 +35,11 @@ interface A11yNode {
  *  the same `show-command` event the browser pane listens to. */
 @customElement(COMPONENT)
 export class DevtoolsA11yTree extends Element {
+  /** Only `runner` is read — the captured text locators are in its dialect. */
+  @consume({ context: metadataContext, subscribe: true })
+  @state()
+  metadata: Metadata | undefined = undefined
+
   @state()
   private active?: CommandLog
 
@@ -197,6 +207,16 @@ export class DevtoolsA11yTree extends Element {
         color: var(--vscode-descriptionForeground);
         opacity: 0.7;
       }
+      /* Last in the bar and flex:none, so the locator ellipsizes before the
+         note does — the note is the part the user can't infer. */
+      .copybar .xp {
+        margin-left: 8px;
+        padding: 1px 6px;
+        border-radius: 4px;
+        color: var(--vscode-descriptionForeground);
+        background: var(--vscode-badge-background, rgba(255, 255, 255, 0.08));
+        flex: none;
+      }
       .scroll {
         flex: 1;
         min-height: 0;
@@ -297,6 +317,7 @@ export class DevtoolsA11yTree extends Element {
   #row(node: A11yNode): TemplateResult {
     const sel = node.selector
     const hot = this.#isRevealed(node)
+    const note = this.#xpathNote(sel)
     return html`<div
       class="node ${sel ? 'pick' : ''} ${hot ? 'hot' : ''}"
       style="padding-left:${8 + node.depth * 16}px"
@@ -309,7 +330,9 @@ export class DevtoolsA11yTree extends Element {
         this.#highlight(undefined)
       }}
       @click=${() => this.#copy(sel)}
-      title=${sel ? `Click to copy locator: ${sel}` : nothing}
+      title=${sel
+        ? `Click to copy locator: ${sel}${note ? ` (${note})` : ''}`
+        : nothing}
     >
       <span class="twig">•</span>
       <span class="role">${node.role}</span>
@@ -324,20 +347,35 @@ export class DevtoolsA11yTree extends Element {
     </div>`
   }
 
+  /** How to resolve a captured XPath locator in the recording runner — pasted
+   *  verbatim into a runner that doesn't auto-detect `//` it matches nothing. */
+  #xpathNote(selector?: string): string | undefined {
+    if (!selector || !isXPathLocator(selector)) {
+      return undefined
+    }
+    const hint = locatorDialect(this.metadata?.runner).xpathHint
+    return hint ? `XPath — use ${hint}` : undefined
+  }
+
+  #note(selector?: string): TemplateResult | typeof nothing {
+    const note = this.#xpathNote(selector)
+    return note ? html`<span class="xp">${note}</span>` : nothing
+  }
+
   /** The copy-hint bar's content: a copied confirmation, else the locator under
    *  the cursor (or the one the snapshot pane is pointing at), else the idle
    *  affordance prompt. */
   #hint(): TemplateResult {
     if (this.copiedSel) {
       return html`<span class="ok">✓ Copied</span
-        ><span class="loc">${this.copiedSel}</span>`
+        ><span class="loc">${this.copiedSel}</span>${this.#note(this.copiedSel)}`
     }
     const sel =
       this.hoveredSel ?? this.pinned?.selector ?? this.revealed?.selector
     if (sel) {
       return html`<span class="clip">⧉</span
         ><span class="lead">Click to copy locator:</span
-        ><span class="loc">${sel}</span>`
+        ><span class="loc">${sel}</span>${this.#note(sel)}`
     }
     return html`<span class="clip">⧉</span
       ><span class="idle"
@@ -346,14 +384,14 @@ export class DevtoolsA11yTree extends Element {
   }
 
   /** Why the panel is empty. A selected command with no `snapshotText` is a
-   *  capture gap, not an idle panel: per-command a11y capture is WDIO-only, so
-   *  Selenium and Nightwatch traces always land here. */
+   *  capture gap, not an idle panel — all three adapters capture the tree, so
+   *  what lands here is a command whose capture never bound to it. */
   #unavailable(): TemplateResult {
     return this.active
       ? html`<wdio-devtools-placeholder
           icon="${UNAVAILABLE_GLYPH}"
           heading="No accessibility snapshot for this command"
-          description="Per-command accessibility capture is WebdriverIO-only — Selenium and Nightwatch traces do not include it."
+          description="Nothing was captured for this action — either the capture had not resolved when the trace slice was written, or the action ran on native mobile, which has no DOM tree."
         ></wdio-devtools-placeholder>`
       : html`<wdio-devtools-placeholder
           icon="${UNAVAILABLE_GLYPH}"
diff --git a/packages/app/test-ui/shared/placeholder.test.ts b/packages/app/test-ui/shared/placeholder.test.ts
index 41ee5566..0c6dbf3f 100644
--- a/packages/app/test-ui/shared/placeholder.test.ts
+++ b/packages/app/test-ui/shared/placeholder.test.ts
@@ -17,7 +17,7 @@ const EMPTY_DETAIL = '.empty-state-detail'
 const GLYPH = '🌳'
 const HEADING = 'No accessibility snapshot for this command'
 const DETAIL =
-  'Per-command accessibility capture is WebdriverIO-only — Selenium and Nightwatch traces do not include it.'
+  'Nothing was captured for this action — either the capture had not resolved when the trace slice was written, or the action ran on native mobile, which has no DOM tree.'
 
 const mountPlaceholder = (props?: Record<string, unknown>) =>
   mount<DevtoolsPlaceholder>(COMPONENT, props)
diff --git a/packages/app/test-ui/workbench/panels/a11y-fixtures.ts b/packages/app/test-ui/workbench/panels/a11y-fixtures.ts
index cf912f3c..f9de4669 100644
--- a/packages/app/test-ui/workbench/panels/a11y-fixtures.ts
+++ b/packages/app/test-ui/workbench/panels/a11y-fixtures.ts
@@ -1,7 +1,8 @@
 // Accessibility-snapshot text for the A11y tree panel. The panel takes no
-// properties and no context — it follows the `show-command` event — so a spec
-// hands these strings to a `CommandLog.snapshotText`, the field the trace reader
-// fills from the per-action `-snapshot.txt` resource.
+// properties — it follows the `show-command` event — so a spec hands these
+// strings to a `CommandLog.snapshotText`, the field the trace reader fills from
+// the per-action `-snapshot.txt` resource. Its one context is the session
+// metadata, read only for the runner that recorded the trace.
 //
 // The lines are composed from shared's snapshot-format tokens rather than typed
 // out: the producers (core's `serializeWebSnapshot` and `serializeMobileSnapshot`)
@@ -119,6 +120,38 @@ export const LOGIN_DEPTHS = LOGIN_NODES.map((node) => node.depth)
 /** A page the capture reached before any element was on it. */
 export const headerOnlySnapshot = PAGE_HEADER
 
+// The one branch of the capture that varies per runner: an element identified by
+// its own text. Selenium and Nightwatch get XPath (neither has a text syntax of
+// its own), WebdriverIO gets `tag*=`. Only the first needs the player to say so.
+
+export const LOGOUT_XPATH_LOCATOR = '//a[contains(., "Logout")]'
+export const LOGOUT_WDIO_LOCATOR = 'a*=Logout'
+
+/** What a Nightwatch capture emits for a control that has a unique native CSS
+ *  locator — there the text branch is only reached when none exists, so the same
+ *  row is XPath in one capture and CSS in another. */
+export const NATIVE_CSS_LOCATOR = 'button[type="submit"]'
+
+/** Secure-area page with a text-identified link plus one CSS-located control, so
+ *  a spec can check the note appears on the first and not the second. */
+export function secureSnapshot(logoutLocator: string): string {
+  return [
+    PAGE_HEADER,
+    a11yLine({ depth: 0, role: 'heading[2]', name: 'Secure Area' }),
+    a11yLine({
+      depth: 1,
+      role: 'link',
+      name: 'Logout',
+      selector: logoutLocator
+    }),
+    a11yLine({ depth: 1, role: 'textbox', name: 'Search', selector: '#search' })
+  ].join('\n')
+}
+
+/** Row index per node in `secureSnapshot`. */
+export const LOGOUT_ROW = 1
+export const SEARCH_ROW = 2
+
 // A native-mobile capture. `serializeMobileSnapshot` always opens with a header
 // of its own — `[<platform> …]`, never a `[Page …]` line — and its locators are
 // Appium's rather than CSS.
diff --git a/packages/app/test-ui/workbench/panels/a11y-tree.test.ts b/packages/app/test-ui/workbench/panels/a11y-tree.test.ts
index aa32a59e..8db42ae6 100644
--- a/packages/app/test-ui/workbench/panels/a11y-tree.test.ts
+++ b/packages/app/test-ui/workbench/panels/a11y-tree.test.ts
@@ -1,10 +1,12 @@
-import type { CommandLog } from '@wdio/devtools-shared'
+import { TraceType } from '@wdio/devtools-shared'
+import type { CommandLog, Metadata, TestRunnerId } from '@wdio/devtools-shared'
 
 import '@components/workbench/a11y-tree.js'
 import type { DevtoolsA11yTree } from '@components/workbench/a11y-tree.js'
+import { metadataContext } from '@/controller/context.js'
 
 import { commandLog } from '../../support/builders.js'
-import { mount, settle } from '../../support/mount.js'
+import { mount, mountWithContext, settle } from '../../support/mount.js'
 import { shadow, shadowAll, text, texts } from '../../support/queries.js'
 import {
   BARE_MOBILE_HEADER,
@@ -18,13 +20,19 @@ import {
   LOGIN_ROLES,
   loginCommand,
   loginSnapshot,
+  LOGOUT_ROW,
+  LOGOUT_WDIO_LOCATOR,
+  LOGOUT_XPATH_LOCATOR,
   LONG_NAME,
   longNameSnapshot,
   MOBILE_HEADER,
   MOBILE_ROLES,
   mobileSnapshot,
+  NATIVE_CSS_LOCATOR,
   PAGE_HEADER,
   PASSWORD_LOCATOR,
+  SEARCH_ROW,
+  secureSnapshot,
   snapshotlessCommand,
   USERNAME_LOCATOR
 } from './a11y-fixtures.js'
@@ -43,6 +51,7 @@ const HINT_LEAD = '.copybar .lead'
 const HINT_LOCATOR = '.copybar .loc'
 const HINT_IDLE = '.copybar .idle'
 const HINT_CONFIRMATION = '.copybar .ok'
+const HINT_DIALECT = '.copybar .xp'
 const PLACEHOLDER = 'wdio-devtools-placeholder'
 const EMPTY_ICON = '.empty-state-icon'
 const EMPTY_HEADING = '.empty-state-text'
@@ -52,10 +61,11 @@ const SKELETON = '.ph-item'
 /** Glyph the panel hands its empty-state placeholder. */
 const TREE_GLYPH = '🌳'
 
-/** Why a trace can reach this panel with commands that carry no snapshot —
- *  per-command accessibility capture is WDIO-only. */
+/** Why a trace can reach this panel with commands that carry no snapshot — all
+ *  three adapters capture the tree, so this is an unbound or native-mobile
+ *  capture, not an unsupported runner. */
 const CAPTURE_UNSUPPORTED =
-  'Per-command accessibility capture is WebdriverIO-only — Selenium and Nightwatch traces do not include it.'
+  'Nothing was captured for this action — either the capture had not resolved when the trace slice was written, or the action ran on native mobile, which has no DOM tree.'
 
 /** The copy shown before anything is selected, which is not a capture gap. */
 const NOTHING_SELECTED =
@@ -484,6 +494,131 @@ describe('wdio-devtools-a11y', () => {
     })
   })
 
+  // A captured text locator is XPath for the runners with no text syntax of
+  // their own, and neither of those auto-detects the leading `//` — pasted
+  // verbatim into Nightwatch's default CSS strategy it matches nothing. The
+  // panel is where the user copies it from, so it is where that has to be said.
+  describe('locator dialect note', () => {
+    async function mountWithRunner(
+      runner: TestRunnerId | undefined,
+      logoutLocator = LOGOUT_XPATH_LOCATOR
+    ): Promise<DevtoolsA11yTree> {
+      // Shaped as the trace reader rebuilds it: a standalone-trace metadata that
+      // carries the recording runner only when the zip named one.
+      const metadata: Metadata = {
+        type: TraceType.Standalone,
+        ...(runner ? { runner } : {})
+      }
+      const panel = await mountWithContext<DevtoolsA11yTree>(PANEL, [
+        { context: metadataContext, value: metadata }
+      ])
+      await showCommand(
+        panel,
+        commandLog({ snapshotText: secureSnapshot(logoutLocator) })
+      )
+      return panel
+    }
+
+    it('says nothing for the CSS locator a Nightwatch capture prefers', async () => {
+      // Nightwatch reaches the text branch only where no unique CSS locator
+      // exists, so the note has to follow the locator rather than the runner —
+      // same row, same runner, no instruction to give.
+      const panel = await mountWithRunner('nightwatch', NATIVE_CSS_LOCATOR)
+      await hover(panel, LOGOUT_ROW)
+
+      expect(text(shadow(panel, HINT_LOCATOR))).toBe(NATIVE_CSS_LOCATOR)
+      expect(shadowAll(panel, HINT_DIALECT)).toHaveLength(0)
+    })
+
+    it('tells a Nightwatch user which strategy the locator needs', async () => {
+      const panel = await mountWithRunner('nightwatch')
+      await hover(panel, LOGOUT_ROW)
+
+      expect(text(shadow(panel, HINT_LOCATOR))).toBe(LOGOUT_XPATH_LOCATOR)
+      expect(text(shadow(panel, HINT_DIALECT))).toBe(
+        "XPath — use useXpath() or locateStrategy: 'xpath'"
+      )
+    })
+
+    it('names the cucumber runner the same way', async () => {
+      const panel = await mountWithRunner('nightwatch-cucumber')
+      await hover(panel, LOGOUT_ROW)
+
+      expect(text(shadow(panel, HINT_DIALECT))).toBe(
+        "XPath — use useXpath() or locateStrategy: 'xpath'"
+      )
+    })
+
+    it('tells a Selenium user to wrap it in By.xpath', async () => {
+      const panel = await mountWithRunner('selenium-webdriver')
+      await hover(panel, LOGOUT_ROW)
+
+      expect(text(shadow(panel, HINT_DIALECT))).toBe('XPath — use By.xpath()')
+    })
+
+    it('says nothing to a WebdriverIO user, whose locator is already native', async () => {
+      const panel = await mountWithRunner('mocha', LOGOUT_WDIO_LOCATOR)
+      await hover(panel, LOGOUT_ROW)
+
+      expect(text(shadow(panel, HINT_LOCATOR))).toBe(LOGOUT_WDIO_LOCATOR)
+      expect(shadowAll(panel, HINT_DIALECT)).toHaveLength(0)
+    })
+
+    it('says nothing to a WebdriverIO user even for an XPath locator', async () => {
+      // WDIO auto-detects the leading `//`, so a trace recorded before the
+      // per-runner capture still needs no instruction there.
+      const panel = await mountWithRunner('cucumber')
+      await hover(panel, LOGOUT_ROW)
+
+      expect(shadowAll(panel, HINT_DIALECT)).toHaveLength(0)
+    })
+
+    it('says nothing when the zip named no runner', async () => {
+      const panel = await mountWithRunner(undefined)
+      await hover(panel, LOGOUT_ROW)
+
+      expect(text(shadow(panel, HINT_LOCATOR))).toBe(LOGOUT_XPATH_LOCATOR)
+      expect(shadowAll(panel, HINT_DIALECT)).toHaveLength(0)
+    })
+
+    it('says nothing for a CSS locator, which needs no strategy', async () => {
+      const panel = await mountWithRunner('nightwatch')
+      await hover(panel, SEARCH_ROW)
+
+      expect(text(shadow(panel, HINT_LOCATOR))).toBe('#search')
+      expect(shadowAll(panel, HINT_DIALECT)).toHaveLength(0)
+    })
+
+    it('keeps the note on the copy confirmation', async () => {
+      recordClipboard()
+      const panel = await mountWithRunner('nightwatch')
+      await clickRow(panel, LOGOUT_ROW)
+
+      expect(text(shadow(panel, HINT_CONFIRMATION))).toBe('✓ Copied')
+      expect(text(shadow(panel, HINT_DIALECT))).toBe(
+        "XPath — use useXpath() or locateStrategy: 'xpath'"
+      )
+    })
+
+    it('carries the note in the row title too', async () => {
+      const panel = await mountWithRunner('nightwatch')
+
+      expect(attrOf(rowAt(panel, LOGOUT_ROW), 'title')).toBe(
+        `Click to copy locator: ${LOGOUT_XPATH_LOCATOR} (XPath — use useXpath() or locateStrategy: 'xpath')`
+      )
+      expect(attrOf(rowAt(panel, SEARCH_ROW), 'title')).toBe(
+        'Click to copy locator: #search'
+      )
+    })
+
+    it('leaves the idle prompt alone before anything is hovered', async () => {
+      const panel = await mountWithRunner('nightwatch')
+
+      expect(shadowAll(panel, HINT_IDLE)).toHaveLength(1)
+      expect(shadowAll(panel, HINT_DIALECT)).toHaveLength(0)
+    })
+  })
+
   describe('unavailable snapshot', () => {
     it('renders the placeholder before a command is selected', async () => {
       const panel = await mountTree()
diff --git a/packages/app/test-ui/workbench/player/captured-pages.ts b/packages/app/test-ui/workbench/player/captured-pages.ts
index 7e0dfc65..0a7204fe 100644
--- a/packages/app/test-ui/workbench/player/captured-pages.ts
+++ b/packages/app/test-ui/workbench/player/captured-pages.ts
@@ -20,12 +20,15 @@ export const STALE_USERNAME = 'olduser'
 export const TYPED_USERNAME = 'tomsmith'
 export const FLASH_TEXT = 'You logged into a secure area!'
 
-/** Label of the submit button. The a11y tree captures interactive elements as
- *  WDIO text locators (`button*=Login`), so the reverse highlight has to resolve
- *  one — which needs an element whose TEXT identifies it. It is also the overlay's
- *  visible-text branch (see the three constants below). */
+/** Label of the submit button. The reverse highlight has to resolve the locator
+ *  the a11y tree captured, which for this element is its text — so the page needs
+ *  an element whose TEXT identifies it. It is also the overlay's visible-text
+ *  branch (see the three constants below). */
 export const LOGIN_LABEL = 'Login'
 
+/** The locator core's capture emits for that button — a text match, so XPath. */
+export const LOGIN_XPATH = `//button[contains(., "${LOGIN_LABEL}")]`
+
 /**
  * The captured page carries one element per branch of the accessible name the
  * element overlay reads (`elementLabel`): `aria-label` first, then visible text,
diff --git a/packages/app/test-ui/workbench/player/snapshot.test.ts b/packages/app/test-ui/workbench/player/snapshot.test.ts
index 32ffe2b7..4e522c11 100644
--- a/packages/app/test-ui/workbench/player/snapshot.test.ts
+++ b/packages/app/test-ui/workbench/player/snapshot.test.ts
@@ -31,6 +31,7 @@ import {
   CANCEL_TEXT,
   FLASH_TEXT,
   LOGIN_LABEL,
+  LOGIN_XPATH,
   NOTICE_LEAD,
   NOTICE_TAIL,
   NOTICE_TAIL_UPDATED,
@@ -177,6 +178,18 @@ const revealFromA11y = (selector: string) =>
     new CustomEvent('a11y-highlight', { detail: { selector } })
   )
 
+/** How many elements an XPath locator matches, straight from the browser's own
+ *  engine — `ORDERED_NODE_SNAPSHOT_TYPE`. */
+function matchCount(doc: Document, expression: string): number {
+  return doc.evaluate(
+    expression,
+    doc,
+    null,
+    XPathResult.ORDERED_NODE_SNAPSHOT_TYPE,
+    null
+  ).snapshotLength
+}
+
 const recordingArrives = () =>
   window.dispatchEvent(
     new CustomEvent('screencast-ready', {
@@ -1120,12 +1133,26 @@ describe('wdio-devtools-browser', () => {
       expect(boxesIn(el, HIGHLIGHT_BOX)).toHaveLength(1)
     })
 
-    it('outlines the element an a11y text locator points at', async () => {
+    it('outlines the element an a11y xpath locator points at', async () => {
+      const el = await mountBrowser(loginTrace)
+      const doc = await replayedPage(el)
+
+      // Only document.evaluate resolves it, which is why this case needs a real
+      // browser — and its uniqueness here is the property the capture's same-tag
+      // DOM count stands in for.
+      expect(matchCount(doc, LOGIN_XPATH)).toBe(1)
+
+      revealFromA11y(LOGIN_XPATH)
+
+      expect(boxesIn(el, HIGHLIGHT_BOX)).toHaveLength(1)
+    })
+
+    it('outlines the element a legacy text locator points at', async () => {
       const el = await mountBrowser(loginTrace)
       await replayedPage(el)
 
-      // The form the a11y tree captures its own locators in — querySelector
-      // cannot parse it, so only the shared resolver finds the element.
+      // Traces recorded before the capture emitted XPath carry this syntax, and
+      // a hand-written WDIO test still uses it, so the resolver keeps it.
       revealFromA11y(`button*=${LOGIN_LABEL}`)
 
       expect(boxesIn(el, HIGHLIGHT_BOX)).toHaveLength(1)
@@ -1135,10 +1162,12 @@ describe('wdio-devtools-browser', () => {
       const el = await mountBrowser(loginTrace)
       await replayedPage(el)
 
-      // Same locator syntax as above, so this is about the page not carrying
-      // the text — not about the syntax being unparseable.
+      // Both syntaxes resolve on this page for text it does carry (above), so
+      // this is about the text being absent rather than unparseable.
       revealFromA11y('button*=Log out')
+      expect(boxesIn(el, HIGHLIGHT_BOX)).toHaveLength(0)
 
+      revealFromA11y('//button[contains(., "Log out")]')
       expect(boxesIn(el, HIGHLIGHT_BOX)).toHaveLength(0)
     })
   })
diff --git a/packages/app/tests/element-overlay.test.ts b/packages/app/tests/element-overlay.test.ts
index 92fe495f..5dfeccdf 100644
--- a/packages/app/tests/element-overlay.test.ts
+++ b/packages/app/tests/element-overlay.test.ts
@@ -1,5 +1,5 @@
 // @vitest-environment happy-dom
-import { describe, expect, it, beforeEach } from 'vitest'
+import { afterEach, describe, expect, it, beforeEach } from 'vitest'
 import { resolveTestSelector } from '../src/components/browser/element-overlay.js'
 
 describe('resolveTestSelector', () => {
@@ -21,7 +21,8 @@ describe('resolveTestSelector', () => {
   })
 
   it('resolves WDIO contains-text selectors querySelector cannot parse', () => {
-    // The exact locators from the failing trace.
+    // Still reached: hand-written WDIO tests use this syntax, and traces
+    // recorded before the capture emitted XPath carry it in their a11y trees.
     expect(resolveTestSelector(document, 'button*=Login')?.tagName).toBe(
       'BUTTON'
     )
@@ -43,6 +44,72 @@ describe('resolveTestSelector', () => {
     expect(resolveTestSelector(document, 'button*=Register')).toBeNull()
   })
 
+  describe('XPath locators — the form the capture emits for a text match', () => {
+    const nativeEvaluate = document.evaluate
+
+    afterEach(() => {
+      document.evaluate = nativeEvaluate
+    })
+
+    /** happy-dom ships no XPath engine, so the engine is stubbed to assert what
+     *  the resolver asks of it. Resolution against a real one is covered by the
+     *  browser spec in `test-ui/workbench/player/snapshot.test.ts`. The
+     *  double-cast is the stub satisfying only the one field the resolver reads
+     *  out of the `XPathResult` it never constructs. */
+    function stubXPath(result: Node | null): string[] {
+      const asked: string[] = []
+      document.evaluate = ((expression: string) => {
+        asked.push(expression)
+        return { singleNodeValue: result }
+      }) as unknown as Document['evaluate']
+      return asked
+    }
+
+    it('hands the expression to the document XPath engine verbatim', () => {
+      const button = document.querySelector('button')
+      const asked = stubXPath(button)
+
+      expect(
+        resolveTestSelector(document, '//button[contains(., "Login")]')
+      ).toBe(button)
+      expect(asked).toEqual(['//button[contains(., "Login")]'])
+    })
+
+    it('recognises every XPath shape a locator can arrive in', () => {
+      const asked = stubXPath(document.querySelector('a'))
+
+      for (const locator of [
+        '//a[contains(., "Logout")]',
+        '/html/body/a',
+        './/a',
+        '(//a[contains(., "Logout")])[1]'
+      ]) {
+        expect(resolveTestSelector(document, locator)).not.toBeNull()
+      }
+      expect(asked).toHaveLength(4)
+    })
+
+    it('draws nothing for a non-element result or a malformed expression', () => {
+      stubXPath(document.createTextNode('Logout'))
+      expect(resolveTestSelector(document, '//a/text()')).toBeNull()
+
+      document.evaluate = (() => {
+        throw new Error('Invalid expression')
+      }) as unknown as Document['evaluate']
+      expect(resolveTestSelector(document, '//a[contains(.,]')).toBeNull()
+    })
+
+    it('leaves CSS attribute selectors to querySelector', () => {
+      // `[href="/logout"]` contains a slash but is not XPath — the shape test
+      // must not steal it, since only querySelector can resolve it.
+      stubXPath(null)
+
+      expect(resolveTestSelector(document, 'a[href="/logout"]')?.tagName).toBe(
+        'A'
+      )
+    })
+  })
+
   it('does not treat an expected-text assertion arg as a selector', () => {
     // expect.toHaveText args carry the expected string, not a locator; without
     // a `tag=`/`*=` operator it must not match anything.
diff --git a/packages/app/tests/mutation-at-command.test.ts b/packages/app/tests/mutation-at-command.test.ts
index 88bd92eb..351d1edc 100644
--- a/packages/app/tests/mutation-at-command.test.ts
+++ b/packages/app/tests/mutation-at-command.test.ts
@@ -9,8 +9,18 @@ function mut(timestamp: number): TraceMutation {
   return { type: 'childList', addedNodes: [], removedNodes: [], timestamp }
 }
 
-function cmd(timestamp: number, startTime?: number): CommandLog {
-  return { command: 'click', args: [], timestamp, startTime } as CommandLog
+function cmd(
+  timestamp: number,
+  startTime?: number,
+  sequence?: number
+): CommandLog {
+  return {
+    command: 'click',
+    args: [],
+    timestamp,
+    startTime,
+    sequence
+  } as CommandLog
 }
 
 describe('mutationForCommand', () => {
@@ -66,3 +76,51 @@ describe('mutationForCommand', () => {
     expect(mutationForCommand(cmd(100), [], [])).toBeUndefined()
   })
 })
+
+// Live mode appends commands in ARRIVAL order, and a deferred row — a
+// Nightwatch native assert, held back until its outcome is known and flushed in
+// one batch at test-end — arrives after rows it ran long before while carrying
+// its real, earlier start. Shape below mirrors the measured example run.
+describe('mutationForCommand with out-of-order arrival', () => {
+  // Three documents: login@100, secure@400, login again@700.
+  const stream = [mut(100), mut(400), mut(700), mut(1000)]
+  const firstDriver = cmd(350, 320, 1)
+  const deferredAssert = cmd(360, 360, 2)
+  const laterDriver = cmd(800, 700, 3)
+  const lastDriver = cmd(950, 900, 4)
+  // Exactly what the client receives: every driver row, then the assert batch.
+  const asArrived = [firstDriver, laterDriver, lastDriver, deferredAssert]
+
+  it('bounds a command by its timeline successor, not its array neighbour', () => {
+    // lastDriver's array neighbour is the assert that ran at 360, which bounded
+    // it back onto the FIRST document; nothing runs after it on the timeline,
+    // so its state is the newest captured DOM.
+    expect(mutationForCommand(lastDriver, asArrived, stream)).toBe(stream[3])
+  })
+
+  it('resolves a deferred row against the command that followed it', () => {
+    // The assert arrives last, so an array neighbour gives it no bound at all
+    // and it inherited the end of the run; its real successor starts at 700.
+    expect(mutationForCommand(deferredAssert, asArrived, stream)).toBe(
+      stream[1]
+    )
+  })
+
+  it('is unchanged when the array is already in timeline order', () => {
+    const inOrder = [firstDriver, deferredAssert, laterDriver, lastDriver]
+    for (const command of inOrder) {
+      expect(mutationForCommand(command, inOrder, stream)).toBe(
+        mutationForCommand(command, asArrived, stream)
+      )
+    }
+  })
+
+  it('breaks a full tie on array order so a sorted trace keeps its successor', () => {
+    // Same start and no `sequence` (a reconstructed trace carries neither) —
+    // the array is the only remaining evidence of which ran first.
+    const a = cmd(500, 400)
+    const b = cmd(600, 400)
+    expect(mutationForCommand(a, [a, b], stream)).toBe(stream[0])
+    expect(mutationForCommand(b, [a, b], stream)).toBe(stream[3])
+  })
+})
diff --git a/packages/app/tests/runnerCapabilities.test.ts b/packages/app/tests/runnerCapabilities.test.ts
index c4aaedc2..b8b78ec8 100644
--- a/packages/app/tests/runnerCapabilities.test.ts
+++ b/packages/app/tests/runnerCapabilities.test.ts
@@ -28,6 +28,12 @@ function md(options: Record<string, unknown> = {}): Metadata {
   return { options } as unknown as Metadata
 }
 
+/** A trace zip's metadata: `runner` comes back off `context-options` and there
+ *  are no runner `options` at all. */
+function playerMd(runner: string): Metadata {
+  return { runner } as unknown as Metadata
+}
+
 function entry(type: 'test' | 'suite'): TestEntry {
   return { type, uid: 'u', label: 'u', children: [] }
 }
@@ -41,9 +47,22 @@ function runAllDetail(): TestRunDetail {
 }
 
 describe('getFramework', () => {
-  it('reads options.framework', () => {
+  it('reads the typed Metadata.runner', () => {
+    expect(getFramework(playerMd('nightwatch-cucumber'))).toBe(
+      'nightwatch-cucumber'
+    )
+  })
+  it('falls back to options.framework for a stream that carries no runner', () => {
+    // A zip recorded before `Metadata.runner` existed, or by a foreign tool.
     expect(getFramework(md({ framework: 'wdio' }))).toBe('wdio')
   })
+  it('prefers the typed field when both carry the fact', () => {
+    const both = {
+      runner: 'nightwatch',
+      options: { framework: 'stale' }
+    } as unknown as Metadata
+    expect(getFramework(both)).toBe('nightwatch')
+  })
   it('undefined when metadata missing', () => {
     expect(getFramework(undefined)).toBeUndefined()
   })
@@ -74,6 +93,14 @@ describe('getRunCapabilities', () => {
       canRunAll: true
     })
   })
+
+  it('reads the runner off a trace zip, which carries no runner options', () => {
+    expect(getRunCapabilities(playerMd('nightwatch'))).toEqual({
+      canRunSuites: true,
+      canRunTests: true,
+      canRunAll: false
+    })
+  })
 })
 
 describe('isRunAll', () => {
diff --git a/packages/backend/src/trace-reader-types.ts b/packages/backend/src/trace-reader-types.ts
index 237b37f0..912588fc 100644
--- a/packages/backend/src/trace-reader-types.ts
+++ b/packages/backend/src/trace-reader-types.ts
@@ -67,6 +67,10 @@ export interface ContextOptionsEvent {
   browserName?: string
   contextId?: string
   options?: { viewport?: { width: number; height: number } }
+  /** Extension field naming the runner that recorded the zip; absent in foreign
+   *  zips and in ours from before the field existed. Untrusted — narrowed
+   *  through `isTestRunnerId` before it reaches `Metadata.runner`. */
+  runner?: string
 }
 
 /** Sidecar `.stacks` shape: file table + per-call [fileIndex, line, column, function] frames. */
diff --git a/packages/backend/src/trace-reader-utils.ts b/packages/backend/src/trace-reader-utils.ts
index aa329a87..72f2a709 100644
--- a/packages/backend/src/trace-reader-utils.ts
+++ b/packages/backend/src/trace-reader-utils.ts
@@ -4,6 +4,7 @@
 import { createHash } from 'node:crypto'
 import { strFromU8 } from 'fflate'
 import {
+  isTestRunnerId,
   TraceType,
   type ConsoleLog,
   type LogLevel,
@@ -325,6 +326,7 @@ export function buildMetadata(ctx: ContextOptionsEvent | undefined): Metadata {
     capabilities: ctx?.browserName
       ? { browserName: ctx.browserName }
       : undefined,
-    ...(sessionId ? { sessionId } : {})
+    ...(sessionId ? { sessionId } : {}),
+    ...(isTestRunnerId(ctx?.runner) ? { runner: ctx.runner } : {})
   }
 }
diff --git a/packages/backend/src/trace-reader.ts b/packages/backend/src/trace-reader.ts
index 690f09bf..11ea5cda 100644
--- a/packages/backend/src/trace-reader.ts
+++ b/packages/backend/src/trace-reader.ts
@@ -329,6 +329,8 @@ function parseMutationStreams(
 ): TraceMutation[] {
   // The `.mutations` NDJSON is TraceMutation JSON, minus the trailing
   // truncation marker; cast at this boundary like the HAR/action parsers.
+  // Timestamps stay as written: they are page-side absolute wall ms, which is
+  // the same timebase `rebaseToEpoch` puts the action streams on.
   return names
     .flatMap((name) => parseNdjson(strFromU8(files[name])))
     .filter(
diff --git a/packages/backend/tests/trace-reader.test.ts b/packages/backend/tests/trace-reader.test.ts
index 3822abc8..90573db1 100644
--- a/packages/backend/tests/trace-reader.test.ts
+++ b/packages/backend/tests/trace-reader.test.ts
@@ -60,7 +60,7 @@ function fixtureZip(): Uint8Array {
       startTime: 100,
       class: 'Element',
       method: 'fill',
-      params: { selector: '#name', value: 'vishnu' },
+      params: { selector: '#name', value: 'frodo' },
       parentId: 'call@0'
     },
     { type: 'after', callId: 'call@2', endTime: 160 },
@@ -166,7 +166,7 @@ describe('parseTraceZip', () => {
       'click'
     ])
     expect(trace.commands[0].args).toEqual(['https://example.com'])
-    expect(trace.commands[1].args).toEqual(['#name', 'vishnu'])
+    expect(trace.commands[1].args).toEqual(['#name', 'frodo'])
     expect(trace.commands[2].args).toEqual(['#submit'])
     expect(trace.commands[2].error?.message).toBe('boom')
   })
@@ -212,6 +212,44 @@ describe('parseTraceZip', () => {
     expect(trace.suites).toEqual([])
   })
 
+  // The player names the locator dialect the capture used, which it can only do
+  // if the zip says which runner recorded it.
+  describe('recording runner', () => {
+    const withRunner = (runner: unknown) =>
+      zipSync({
+        'trace.trace': toNdjson([
+          {
+            type: 'context-options',
+            wallTime: WALL_TIME,
+            browserName: 'chrome',
+            contextId: 'context@abcd1234',
+            options: { viewport: { width: 1024, height: 768 } },
+            ...(runner === undefined ? {} : { runner })
+          }
+        ])
+      })
+
+    it('restores the runner the zip names', () => {
+      const { trace } = parseTraceZip(withRunner('nightwatch'))
+
+      expect(trace.metadata.runner).toBe('nightwatch')
+    })
+
+    it('leaves it unset for a zip recorded without one', () => {
+      // Our own older zips, and every foreign one — the reader already tolerates
+      // those and must not invent a runner for them.
+      const { trace } = parseTraceZip(withRunner(undefined))
+
+      expect(trace.metadata.runner).toBeUndefined()
+    })
+
+    it('drops a value that is not a known runner id', () => {
+      const { trace } = parseTraceZip(withRunner('playwright-test'))
+
+      expect(trace.metadata.runner).toBeUndefined()
+    })
+  })
+
   it('restores DOM mutations from a trace.mutations stream, dropping the marker', () => {
     const mutations = [
       {
diff --git a/packages/core/package.json b/packages/core/package.json
index 90be8676..fb4372c9 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -2,6 +2,7 @@
   "name": "@wdio/devtools-core",
   "version": "1.0.1",
   "private": true,
+  "author": "Vishnu Vardhan",
   "description": "Framework-agnostic capture/reporter logic shared by @wdio/devtools-* adapters. Workspace-internal, never published \u2014 code is inlined into each consuming adapter at build time.",
   "repository": {
     "type": "git",
diff --git a/packages/core/src/action-snapshot.ts b/packages/core/src/action-snapshot.ts
index e589f743..c3b729b7 100644
--- a/packages/core/src/action-snapshot.ts
+++ b/packages/core/src/action-snapshot.ts
@@ -13,22 +13,33 @@ import {
   generateAllElementLocators,
   getDefaultFilters
 } from './locators/index.js'
-import { SNAPSHOT_PROBE_TIMEOUT_MS, withTimeout } from './with-timeout.js'
-import type { ActionSnapshot } from '@wdio/devtools-shared'
+import {
+  SNAPSHOT_DRIVER_PROBE_TIMEOUT_MS,
+  SNAPSHOT_PROBE_TIMEOUT_MS,
+  withTimeout
+} from './with-timeout.js'
+import type { ActionSnapshot, TestRunnerId } from '@wdio/devtools-shared'
 
 export type ScriptRunner = (scriptSrc: string) => Promise<unknown>
 
 export interface CaptureActionSnapshotInput {
   command: string
+  /** The logged command's timestamp. Export claims snapshots by exact equality
+   * (`claimAfter`/`elementsAt`) and slices them by command time, so a snapshot
+   * stamped with its own capture time binds to no action at all. */
+  timestamp?: number
   /** Browser script runner — omit on native mobile where Appium can't execute JS. */
   runScript?: ScriptRunner
   takeScreenshot?: () => Promise<string | null | undefined>
-  getUrl?: () => Promise<string | undefined>
-  getTitle?: () => Promise<string | undefined>
+  getUrl?: () => Promise<string | null | undefined>
+  getTitle?: () => Promise<string | null | undefined>
   /** Page-source XML fetcher for native mobile — used instead of runScript. */
   getPageSource?: () => Promise<string | undefined>
   /** Platform identifier for mobile snapshot formatting ('android' | 'ios'). */
   platform?: 'android' | 'ios'
+  /** Runner this capture belongs to — decides which text-locator dialect the
+   *  injected scripts emit. Omitted → the portable XPath form. */
+  runner?: TestRunnerId
 }
 
 async function runWith<T>(
@@ -41,71 +52,113 @@ async function runWith<T>(
   }
 
   return withTimeout(
-    runScript(scriptSrc).then((r) => r as T),
+    // A driver can answer `null` rather than reject (no-such-session, a script
+    // error swallowed by the transport). Passing that through hands the
+    // serializers a non-array where they expect one, which throws and loses the
+    // WHOLE snapshot — screenshot, url and all — not just the probe.
+    runScript(scriptSrc).then((r) =>
+      r === null || r === undefined ? fallback : (r as T)
+    ),
     SNAPSHOT_PROBE_TIMEOUT_MS,
     fallback
   ).catch(() => fallback)
 }
 
+/**
+ * Run one driver-side probe under a timeout, resolving to `undefined` on a
+ * timeout, a rejection, or a synchronous throw.
+ *
+ * Every probe is guarded, not just the in-page scripts: a framework whose
+ * url/title/screenshot readers go through its own command queue blocks
+ * indefinitely when called from inside a command hook, and an unguarded probe
+ * in this `Promise.all` stranded the entire capture — observed as 10 of 14
+ * Nightwatch captures never settling, so those actions reached the trace with
+ * no DOM, no a11y tree and no element rects at all.
+ */
+function probe<T>(
+  read: (() => Promise<T | null | undefined>) | undefined
+): Promise<T | undefined> {
+  if (!read) {
+    return Promise.resolve(undefined)
+  }
+  // `Promise.resolve().then(read)` so a probe that throws synchronously becomes
+  // a rejection this catch can absorb, rather than escaping the Promise.all.
+  return withTimeout(
+    Promise.resolve()
+      .then(read)
+      .then((value) => value ?? undefined),
+    SNAPSHOT_DRIVER_PROBE_TIMEOUT_MS,
+    undefined
+  ).catch(() => undefined)
+}
+
+/** Native-mobile snapshot text + locators, derived from the page-source XML. */
+function fromPageSource(
+  pageSource: string,
+  platform: 'android' | 'ios'
+): { snapshotText: string; elements: unknown[] } {
+  const jsonTree = xmlToJSON(pageSource)
+  let snapshotText = `[${platform}]`
+  if (jsonTree) {
+    jsonTree.attributes._sourceXML = pageSource
+    snapshotText = serializeMobileSnapshot(jsonTree, {
+      platform,
+      sourceXML: pageSource
+    })
+  }
+  try {
+    const filters = getDefaultFilters(platform, false)
+    return {
+      snapshotText,
+      elements: generateAllElementLocators(pageSource, {
+        platform,
+        viewportSize: { width: 9999, height: 9999 },
+        filters,
+        inViewportOnly: false
+      })
+    }
+  } catch {
+    // Non-fatal — snapshot text is the primary deliverable.
+    return { snapshotText, elements: [] }
+  }
+}
+
 export async function captureActionSnapshot(
   input: CaptureActionSnapshotInput
 ): Promise<ActionSnapshot | null> {
   try {
-    const timestamp = Date.now()
+    const timestamp = input.timestamp ?? Date.now()
     const isNativeMobile = !input.runScript && !!input.getPageSource
 
-    const [shot, url, title, pageSource, tree, elements] = await Promise.all([
-      input.takeScreenshot?.().catch(() => null),
-      input.getUrl?.().catch(() => undefined),
-      input.getTitle?.().catch(() => undefined),
-      isNativeMobile
-        ? input.getPageSource?.().catch(() => undefined)
-        : undefined,
+    // Probe order is load-bearing, not cosmetic. A driver serialises requests
+    // per session, so `Promise.all` starting them together still has them served
+    // in the order issued — and the screenshot is by far the slowest. Issued
+    // first, it delayed the cheap reads behind it by hundreds of ms, long enough
+    // for the next command to navigate: a fill on the login page reported the
+    // page its submit had already reached. Cheapest-and-most-order-sensitive
+    // first, screenshot last; the screenshot is served no later than before.
+    const [url, title, pageSource, tree, elements, shot] = await Promise.all([
+      probe(input.getUrl),
+      probe(input.getTitle),
+      isNativeMobile ? probe(input.getPageSource) : undefined,
       runWith<AccessibilityNode[]>(
         input.runScript,
-        accessibilityTreeScript(true),
+        accessibilityTreeScript(true, input.runner),
         []
       ),
       runWith<BrowserElementInfo[]>(
         input.runScript,
         // includeBounds: the per-action element rects drive A8 input points.
-        elementsScript(true, true),
+        elementsScript(true, true, input.runner),
         []
-      )
+      ),
+      probe(input.takeScreenshot)
     ])
 
-    let snapshotText: string
-    let finalElements: unknown[] = elements
-
-    if (isNativeMobile && pageSource) {
-      const platform = input.platform ?? 'android'
-      const jsonTree = xmlToJSON(pageSource)
-      if (jsonTree) {
-        jsonTree.attributes._sourceXML = pageSource
-        snapshotText = serializeMobileSnapshot(jsonTree, {
-          platform,
-          sourceXML: pageSource
-        })
-      } else {
-        snapshotText = `[${platform}]`
-      }
-      // Generate mobile element locators from the page source XML.
-      try {
-        const viewport = { width: 9999, height: 9999 }
-        const filters = getDefaultFilters(platform, false)
-        const locators = generateAllElementLocators(pageSource, {
-          platform,
-          viewportSize: viewport,
-          filters,
-          inViewportOnly: false
-        })
-        finalElements = locators
-      } catch {
-        // Non-fatal — snapshot text is the primary deliverable.
-      }
-    } else {
-      snapshotText = serializeWebSnapshot(tree, { url, title })
-    }
+    const mobile =
+      isNativeMobile && pageSource
+        ? fromPageSource(pageSource, input.platform ?? 'android')
+        : undefined
 
     return {
       timestamp,
@@ -113,8 +166,9 @@ export async function captureActionSnapshot(
       url,
       title,
       screenshot: shot ?? undefined,
-      elements: finalElements,
-      snapshotText
+      elements: mobile?.elements ?? elements,
+      snapshotText:
+        mobile?.snapshotText ?? serializeWebSnapshot(tree, { url, title })
     }
   } catch {
     return null
diff --git a/packages/core/src/assert-patcher.ts b/packages/core/src/assert-patcher.ts
index 0c6b2753..353c22b9 100644
--- a/packages/core/src/assert-patcher.ts
+++ b/packages/core/src/assert-patcher.ts
@@ -32,6 +32,11 @@ export interface CapturedAssert {
   error: Error | undefined
   callSource: string | undefined
   timestamp: number
+  /** Locator of the element the assertion was about, when the adapter can name
+   *  one from the raw args (see `patchNodeAssert`'s `resolveAssertTarget`).
+   *  Lands on `CommandLog.selector` so the player's overlay boxes the target the
+   *  way it does for a folded matcher row. */
+  selector?: string
 }
 
 /**
@@ -122,7 +127,8 @@ function makeAssertEmitters(
   methodName: string,
   args: unknown[],
   onCommand: (cmd: CapturedAssert) => void,
-  callerStack: string | undefined
+  callerStack: string | undefined,
+  resolveAssertTarget?: (args: unknown[]) => string | undefined
 ): { passed: () => void; failed: (err: unknown) => void } {
   const callInfo = getCallSourceFromStack(callerStack)
   // Drop asserts the user's test didn't fire directly: either no user-code frame
@@ -133,16 +139,25 @@ function makeAssertEmitters(
     return { passed: () => {}, failed: () => {} }
   }
   const startedAt = Date.now()
+  // Resolved from the RAW args: sanitizing loses the object identity an element
+  // handle is recognised by. After the user-code gate, so a dropped assert
+  // doesn't pay for it.
+  const selector = resolveAssertTarget?.(args)
   const sanitizedArgs = args.map(safeSerializeAssertArg)
-  const emit = (result: CapturedAssert['result'], error: Error | undefined) =>
-    onCommand({
+  const emit = (result: CapturedAssert['result'], error: Error | undefined) => {
+    const cmd: CapturedAssert = {
       command: `assert.${methodName}`,
       args: sanitizedArgs,
       result,
       error,
       callSource: callInfo.callSource,
       timestamp: startedAt
-    })
+    }
+    if (selector) {
+      cmd.selector = selector
+    }
+    onCommand(cmd)
+  }
   return {
     passed: () => emit('passed', undefined),
     failed: (err: unknown) => {
@@ -156,7 +171,8 @@ function makePatchedAssertMethod(
   methodName: string,
   assertObj: Record<string | symbol, unknown>,
   original: (...a: unknown[]) => unknown,
-  onCommand: (cmd: CapturedAssert) => void
+  onCommand: (cmd: CapturedAssert) => void,
+  resolveAssertTarget?: (args: unknown[]) => string | undefined
 ): (...args: unknown[]) => unknown {
   return function patchedAssert(this: unknown, ...args: unknown[]) {
     // Captured HERE so frames[0] is this wrapper and frames[1] is the assert's
@@ -166,7 +182,8 @@ function makePatchedAssertMethod(
       methodName,
       args,
       onCommand,
-      callerStack
+      callerStack,
+      resolveAssertTarget
     )
     let result: unknown
     // Node's internalMatch dispatches on `fn === assert.match` (Node ≤20), so
@@ -227,6 +244,9 @@ export function capturedAssertToCommandLog(
   if (cmd.callSource) {
     entry.callSource = cmd.callSource
   }
+  if (cmd.selector) {
+    entry.selector = cmd.selector
+  }
   if (testUid) {
     entry.testUid = testUid
   }
@@ -284,7 +304,8 @@ export function matcherAssertionToCommandLog(
  *  how many were patched. Used for both `assert.*` and `assert.strict.*`. */
 function patchAssertNamespace(
   nsObj: Record<string | symbol, unknown>,
-  onCommand: (cmd: CapturedAssert) => void
+  onCommand: (cmd: CapturedAssert) => void,
+  resolveAssertTarget?: (args: unknown[]) => string | undefined
 ): number {
   let count = 0
   for (const methodName of TRACKED_ASSERT_METHODS) {
@@ -296,7 +317,8 @@ function patchAssertNamespace(
       methodName,
       nsObj,
       original as (...a: unknown[]) => unknown,
-      onCommand
+      onCommand,
+      resolveAssertTarget
     )
     count++
   }
@@ -318,10 +340,16 @@ function patchAssertNamespace(
  *                  Receives the captured shape; do NOT throw — the wrapper
  *                  re-throws the original assert error after the callback.
  * @param onLog     Optional logger for lifecycle events. Default: silent.
+ * @param resolveAssertTarget
+ *                  Optional adapter hook naming the element an assert was about,
+ *                  from its raw args. node:assert takes values, not elements, so
+ *                  only the adapter that captured the reads can make the link;
+ *                  the result rides along as `CapturedAssert.selector`.
  */
 export function patchNodeAssert(
   onCommand: (cmd: CapturedAssert) => void,
-  onLog?: (level: 'info' | 'warn', message: string) => void
+  onLog?: (level: 'info' | 'warn', message: string) => void,
+  resolveAssertTarget?: (args: unknown[]) => string | undefined
 ): boolean {
   const log = (level: 'info' | 'warn', message: string) =>
     onLog?.(level, message)
@@ -342,7 +370,7 @@ export function patchNodeAssert(
   }
   assertObj[ASSERT_PATCHED_SYMBOL] = true
 
-  let patched = patchAssertNamespace(assertObj, onCommand)
+  let patched = patchAssertNamespace(assertObj, onCommand, resolveAssertTarget)
   // `import { strict as assert }` and `assert.strict.*` reference a separate
   // object with its own method identities; patch it too so strict-mode
   // assertions are captured the same as the default ones. `assert.strict` is a
@@ -352,7 +380,8 @@ export function patchNodeAssert(
   if (strict && (typeof strict === 'object' || typeof strict === 'function')) {
     patched += patchAssertNamespace(
       strict as Record<string | symbol, unknown>,
-      onCommand
+      onCommand,
+      resolveAssertTarget
     )
   }
 
diff --git a/packages/core/src/bidi-preload.ts b/packages/core/src/bidi-preload.ts
new file mode 100644
index 00000000..df30a5dc
--- /dev/null
+++ b/packages/core/src/bidi-preload.ts
@@ -0,0 +1,67 @@
+// Document-start injection of the collector via a BiDi preload script.
+//
+// The `<script>`-append injection in `script-loader.ts` only ever instruments
+// the document that is loaded at the time it runs, and a `<script>` dies with
+// its document. So a navigation always produces a document we learn about
+// afterwards, and everything built on that — when to re-inject, when to drain,
+// which action to credit the new DOM to — is reconstruction, and races. A
+// preload script registered globally runs in EVERY document before any of its
+// script does, so each one instruments itself and anchors its own DOM at its own
+// `performance.timeOrigin`. Nothing to detect, nothing to attribute.
+
+import { loadSeleniumSubmodule } from './bidi.js'
+import { errorMessage } from './error.js'
+import { loadCollectorSource } from './script-loader.js'
+
+interface ScriptManager {
+  addPreloadScript: (
+    functionDeclaration: string,
+    argumentValueList?: unknown[],
+    sandbox?: string | null
+  ) => Promise<number>
+}
+
+/** `selenium-webdriver/bidi/scriptManager`'s default export. Cast at this
+ *  boundary — the module ships no types. */
+type ScriptManagerFactory = (
+  browsingContextIds: unknown,
+  driver: unknown
+) => Promise<ScriptManager>
+
+/**
+ * Register the collector to run at document-start in every document of this
+ * session. Returns false when BiDi isn't available, so the caller can fall back
+ * to per-document `<script>` injection.
+ *
+ * Requires the session to have been created with `webSocketUrl: true`; the
+ * script manager throws without it.
+ */
+export async function registerCollectorPreload(
+  driver: unknown,
+  log?: (level: 'info' | 'warn', message: string) => void
+): Promise<boolean> {
+  const factory =
+    loadSeleniumSubmodule<ScriptManagerFactory>('bidi/scriptManager')
+  if (!factory) {
+    return false
+  }
+  try {
+    // No browsing-context id, which registers the script GLOBALLY — contexts
+    // created later are covered too. Scoping it to the current context would
+    // miss exactly the documents this exists to catch.
+    const manager = await factory(undefined, driver)
+    // Raw source, not the IIFE-wrapped form: a preload script is a function
+    // declaration, so the bundle's top-level await works in the body directly.
+    await manager.addPreloadScript(
+      `async () => { ${await loadCollectorSource()} }`
+    )
+    log?.('info', '✓ Collector registered at document-start (BiDi preload)')
+    return true
+  } catch (err) {
+    log?.(
+      'warn',
+      `BiDi preload unavailable, falling back to per-document injection: ${errorMessage(err)}`
+    )
+    return false
+  }
+}
diff --git a/packages/core/src/element-scripts.ts b/packages/core/src/element-scripts.ts
index 9b9b33d9..b92922d3 100644
--- a/packages/core/src/element-scripts.ts
+++ b/packages/core/src/element-scripts.ts
@@ -9,14 +9,174 @@
  * `@wdio/elements` — these are just the script bodies.
  */
 
+import { locatorDialect } from '@wdio/devtools-shared'
+import type {
+  LocatorDialect,
+  TestRunnerId,
+  TextLocatorDialect
+} from '@wdio/devtools-shared'
+
+/** Shared by both injected scripts below — the same visibility gate decides
+ *  which elements each one reports. */
+const IS_VISIBLE_SCRIPT = `
+    function isVisible(el) {
+      if (typeof el.checkVisibility === 'function') {
+        return el.checkVisibility({ opacityProperty: true, visibilityProperty: true, contentVisibilityAuto: true })
+      }
+      var style = window.getComputedStyle(el)
+      return style.display !== 'none' && style.visibility !== 'hidden' && style.opacity !== '0' && el.offsetWidth > 0 && el.offsetHeight > 0
+    }
+`
+
+/** XPath 1.0 has no string escape, so a value carrying both quote kinds is
+ *  stitched from single-kind literals; a literal double quote can only enter the
+ *  expression as its own single-quoted token. */
+const XPATH_TEXT_LITERAL_SCRIPT = `
+    function xpathTextLiteral(value) {
+      if (value.indexOf('"') === -1) { return '"' + value + '"' }
+      if (value.indexOf("'") === -1) { return "'" + value + "'" }
+      var quoteToken = "'" + '"' + "'"
+      var parts = value.split('"')
+      var pieces = []
+      for (var p = 0; p < parts.length; p++) {
+        if (parts[p]) { pieces.push('"' + parts[p] + '"') }
+        if (p < parts.length - 1) { pieces.push(quoteToken) }
+      }
+      // concat() takes at least two arguments — a value that is nothing but
+      // double quotes yields one piece and needs no concat.
+      return pieces.length > 1 ? 'concat(' + pieces.join(', ') + ')' : pieces[0]
+    }
+`
+
+/** The meaning-bearing CSS branches: portable across all runners, so they are
+ *  dialect-independent. Null when none of them identifies the element uniquely,
+ *  which is what lets a caller order them against the text branch. */
+const SEMANTIC_CSS_SELECTOR_SCRIPT = `
+    function semanticCssSelector(element, tag) {
+      var ariaLabel = element.getAttribute('aria-label')
+      if (ariaLabel && ariaLabel.length <= 200) {
+        var sel = '[aria-label="' + CSS.escape(ariaLabel) + '"]'
+        if (document.querySelectorAll(sel).length === 1) { return sel }
+      }
+      var testId = element.getAttribute('data-testid')
+      if (testId) {
+        var testSel = '[data-testid="' + CSS.escape(testId) + '"]'
+        if (document.querySelectorAll(testSel).length === 1) { return testSel }
+      }
+      if (element.id) {
+        var idSel = '#' + CSS.escape(element.id)
+        if (document.querySelectorAll(idSel).length === 1) { return idSel }
+      }
+      var nameAttr = element.getAttribute('name')
+      if (nameAttr) {
+        var nameSel = tag + '[name="' + CSS.escape(nameAttr) + '"]'
+        if (document.querySelectorAll(nameSel).length === 1) { return nameSel }
+      }
+      var typeAttr = element.getAttribute('type')
+      if (typeAttr) {
+        var typeSel = tag + '[type="' + CSS.escape(typeAttr) + '"]'
+        if (document.querySelectorAll(typeSel).length === 1) { return typeSel }
+      }
+      if (element.className && typeof element.className === 'string') {
+        var classes = element.className.trim().split(/\\s+/).filter(Boolean)
+        for (var i = 0; i < classes.length; i++) {
+          var clsSel = tag + '.' + CSS.escape(classes[i])
+          if (document.querySelectorAll(clsSel).length === 1) { return clsSel }
+        }
+        if (classes.length >= 2) {
+          var twoClsSel = tag + classes.slice(0, 2).map(function(c) { return '.' + CSS.escape(c) }).join('')
+          if (document.querySelectorAll(twoClsSel).length === 1) { return twoClsSel }
+        }
+      }
+      return null
+    }
+`
+
+/** Last resort: a positional `:nth-of-type` path, which always resolves but
+ *  carries no meaning — hence every other branch getting first refusal. */
+const POSITIONAL_SELECTOR_SCRIPT = `
+    function positionalSelector(element) {
+      var current = element
+      var path = []
+      while (current && current !== document.documentElement) {
+        var seg = current.tagName.toLowerCase()
+        if (current.id) { path.unshift('#' + CSS.escape(current.id)); break }
+        var parent = current.parentElement
+        if (parent) {
+          var siblings = Array.from(parent.children).filter(function(c) { return c.tagName === current.tagName })
+          if (siblings.length > 1) { seg += ':nth-of-type(' + (siblings.indexOf(current) + 1) + ')' }
+        }
+        path.unshift(seg)
+        current = current.parentElement
+        if (path.length >= 4) { break }
+      }
+      return path.join(' > ')
+    }
+`
+
+/** The text branch's return expression. WebdriverIO's `tag*=text` compiles
+ *  internally to XPath with `"` quoting, so a text carrying a double quote would
+ *  yield a broken expression — those keep the XPath form, which it also resolves. */
+function textLocatorExpression(dialect: TextLocatorDialect): string {
+  const xpath = "'//' + tag + '[contains(., ' + xpathTextLiteral(text) + ')]'"
+  return dialect === 'webdriverio'
+    ? `text.indexOf('"') === -1 ? tag + '*=' + text : ${xpath}`
+    : xpath
+}
+
+/** Identify the element by its own text, in `dialect`'s grammar. Null when the
+ *  text neither exists nor singles it out, so it composes with the CSS branches
+ *  in either order. */
+function textSelectorScript(dialect: TextLocatorDialect): string {
+  return `
+    function textSelector(element, tag) {
+      var text = (element.textContent || '').trim().replace(/\\s+/g, ' ')
+      if (!text || text.length > 120) { return null }
+      var sameTagElements = document.querySelectorAll(tag)
+      var matchCount = 0
+      sameTagElements.forEach(function(el) { if (el.textContent.includes(text)) { matchCount++ } })
+      // The DOM predicate this counts is exactly XPath's
+      // \`//tag[contains(., text)]\`, so a single match here is a unique match
+      // there — the emitted expression carries the uniqueness just checked.
+      if (matchCount !== 1) { return null }
+      return ${textLocatorExpression(dialect)}
+    }
+`
+}
+
+/** Shared by both injected scripts below, so one grammar produces the locator in
+ *  `-snapshot.txt` and `-elements.json`. The dialect decides both what the text
+ *  branch emits and where it sits; the positional path stays last either way. */
+function getSelectorScript(dialect: LocatorDialect): string {
+  const preferred =
+    dialect.textBranch === 'first'
+      ? ['textSelector(element, tag)', 'semanticCssSelector(element, tag)']
+      : ['semanticCssSelector(element, tag)', 'textSelector(element, tag)']
+  return `
+    ${XPATH_TEXT_LITERAL_SCRIPT}
+    ${SEMANTIC_CSS_SELECTOR_SCRIPT}
+    ${POSITIONAL_SELECTOR_SCRIPT}
+    ${textSelectorScript(dialect.text)}
+
+    function getSelector(element) {
+      var tag = element.tagName.toLowerCase()
+      return ${preferred[0]} || ${preferred[1]} || positionalSelector(element)
+    }
+`
+}
+
 /**
  * Accessibility tree walk — returns a flat array of AccessibilityNode.
  *
  * Walks the DOM from `document.body`, assigning semantic roles (button, link,
  * textbox, heading, img, statictext, …) based on tag name, ARIA attributes,
- * and visibility. Each node carries a unique CSS selector.
+ * and visibility. Each node carries a unique locator, in `runner`'s own text
+ * dialect — omit it for the portable XPath form every runner resolves.
  */
-export function accessibilityTreeScript(inViewportOnly: boolean): string {
+export function accessibilityTreeScript(
+  inViewportOnly: boolean,
+  runner?: TestRunnerId
+): string {
   return `(function () {
     var INPUT_TYPE_ROLES = {
       text: 'textbox', search: 'searchbox', email: 'textbox', url: 'textbox',
@@ -108,58 +268,7 @@ export function accessibilityTreeScript(inViewportOnly: boolean): string {
       return ((el.textContent || '').trim().replace(/\\s+/g, ' ') || '').slice(0, 200)
     }
 
-    function getSelector(element) {
-      var tag = element.tagName.toLowerCase()
-      var text = (element.textContent || '').trim().replace(/\\s+/g, ' ')
-      if (text && text.length > 0 && text.length <= 120) {
-        var sameTagElements = document.querySelectorAll(tag)
-        var matchCount = 0
-        sameTagElements.forEach(function(el) { if (el.textContent.includes(text)) { matchCount++ } })
-        if (matchCount === 1) { return tag + '*=' + text }
-      }
-      var ariaLabel = element.getAttribute('aria-label')
-      if (ariaLabel && ariaLabel.length <= 200) {
-        var sel = '[aria-label="' + CSS.escape(ariaLabel) + '"]'
-        if (document.querySelectorAll(sel).length === 1) { return sel }
-      }
-      var testId = element.getAttribute('data-testid')
-      if (testId) {
-        var testSel = '[data-testid="' + CSS.escape(testId) + '"]'
-        if (document.querySelectorAll(testSel).length === 1) { return testSel }
-      }
-      if (element.id) { return '#' + CSS.escape(element.id) }
-      var nameAttr = element.getAttribute('name')
-      if (nameAttr) {
-        var nameSel = tag + '[name="' + CSS.escape(nameAttr) + '"]'
-        if (document.querySelectorAll(nameSel).length === 1) { return nameSel }
-      }
-      if (element.className && typeof element.className === 'string') {
-        var classes = element.className.trim().split(/\\s+/).filter(Boolean)
-        for (var i = 0; i < classes.length; i++) {
-          var clsSel = tag + '.' + CSS.escape(classes[i])
-          if (document.querySelectorAll(clsSel).length === 1) { return clsSel }
-        }
-        if (classes.length >= 2) {
-          var twoClsSel = tag + classes.slice(0, 2).map(function(c) { return '.' + CSS.escape(c) }).join('')
-          if (document.querySelectorAll(twoClsSel).length === 1) { return twoClsSel }
-        }
-      }
-      var current = element
-      var path = []
-      while (current && current !== document.documentElement) {
-        var seg = current.tagName.toLowerCase()
-        if (current.id) { path.unshift('#' + CSS.escape(current.id)); break }
-        var parent = current.parentElement
-        if (parent) {
-          var siblings = Array.from(parent.children).filter(function(c) { return c.tagName === current.tagName })
-          if (siblings.length > 1) { seg += ':nth-of-type(' + (siblings.indexOf(current) + 1) + ')' }
-        }
-        path.unshift(seg)
-        current = current.parentElement
-        if (path.length >= 4) { break }
-      }
-      return path.join(' > ')
-    }
+    ${getSelectorScript(locatorDialect(runner))}
 
     function getDirectText(el) {
       var text = ''
@@ -169,13 +278,7 @@ export function accessibilityTreeScript(inViewportOnly: boolean): string {
       return text.trim().replace(/\\s+/g, ' ')
     }
 
-    function isVisible(el) {
-      if (typeof el.checkVisibility === 'function') {
-        return el.checkVisibility({ opacityProperty: true, visibilityProperty: true, contentVisibilityAuto: true })
-      }
-      var style = window.getComputedStyle(el)
-      return style.display !== 'none' && style.visibility !== 'hidden' && style.opacity !== '0' && el.offsetWidth > 0 && el.offsetHeight > 0
-    }
+    ${IS_VISIBLE_SCRIPT}
 
     function isInViewport(el) {
       var rect = el.getBoundingClientRect()
@@ -238,11 +341,13 @@ export function accessibilityTreeScript(inViewportOnly: boolean): string {
  *
  * Uses `querySelectorAll` with a broad interactable-selector list, then
  * filters by visibility and (optionally) viewport containment. Each element
- * gets a computed accessible name and a unique CSS selector.
+ * gets a computed accessible name and a unique locator, in `runner`'s own text
+ * dialect — omit it for the portable XPath form every runner resolves.
  */
 export function elementsScript(
   includeBounds: boolean,
-  inViewportOnly: boolean
+  inViewportOnly: boolean,
+  runner?: TestRunnerId
 ): string {
   return `(function () {
     var interactableSelectors = [
@@ -253,13 +358,7 @@ export function elementsScript(
       '[role="spinbutton"]', '[contenteditable="true"]', '[tabindex]:not([tabindex="-1"])'
     ].join(',')
 
-    function isVisible(element) {
-      if (typeof element.checkVisibility === 'function') {
-        return element.checkVisibility({ opacityProperty: true, visibilityProperty: true, contentVisibilityAuto: true })
-      }
-      var style = window.getComputedStyle(element)
-      return style.display !== 'none' && style.visibility !== 'hidden' && style.opacity !== '0' && element.offsetWidth > 0 && element.offsetHeight > 0
-    }
+    ${IS_VISIBLE_SCRIPT}
 
     function getAccessibleName(el) {
       var ariaLabel = el.getAttribute('aria-label')
@@ -295,58 +394,7 @@ export function elementsScript(
       return ((el.textContent || '').trim().replace(/\\s+/g, ' ') || '').slice(0, 200)
     }
 
-    function getSelector(element) {
-      var tag = element.tagName.toLowerCase()
-      var text = (element.textContent || '').trim().replace(/\\s+/g, ' ')
-      if (text && text.length > 0 && text.length <= 120) {
-        var sameTagElements = document.querySelectorAll(tag)
-        var matchCount = 0
-        sameTagElements.forEach(function(el) { if (el.textContent.includes(text)) { matchCount++ } })
-        if (matchCount === 1) { return tag + '*=' + text }
-      }
-      var ariaLabel = element.getAttribute('aria-label')
-      if (ariaLabel && ariaLabel.length <= 200) {
-        var sel = '[aria-label="' + CSS.escape(ariaLabel) + '"]'
-        if (document.querySelectorAll(sel).length === 1) { return sel }
-      }
-      var testId = element.getAttribute('data-testid')
-      if (testId) {
-        var testSel = '[data-testid="' + CSS.escape(testId) + '"]'
-        if (document.querySelectorAll(testSel).length === 1) { return testSel }
-      }
-      if (element.id) { return '#' + CSS.escape(element.id) }
-      var nameAttr = element.getAttribute('name')
-      if (nameAttr) {
-        var nameSel = tag + '[name="' + CSS.escape(nameAttr) + '"]'
-        if (document.querySelectorAll(nameSel).length === 1) { return nameSel }
-      }
-      if (element.className && typeof element.className === 'string') {
-        var classes = element.className.trim().split(/\\s+/).filter(Boolean)
-        for (var i = 0; i < classes.length; i++) {
-          var clsSel = tag + '.' + CSS.escape(classes[i])
-          if (document.querySelectorAll(clsSel).length === 1) { return clsSel }
-        }
-        if (classes.length >= 2) {
-          var twoClsSel = tag + classes.slice(0, 2).map(function(c) { return '.' + CSS.escape(c) }).join('')
-          if (document.querySelectorAll(twoClsSel).length === 1) { return twoClsSel }
-        }
-      }
-      var current = element
-      var path = []
-      while (current && current !== document.documentElement) {
-        var seg = current.tagName.toLowerCase()
-        if (current.id) { path.unshift('#' + CSS.escape(current.id)); break }
-        var parent = current.parentElement
-        if (parent) {
-          var siblings = Array.from(parent.children).filter(function(c) { return c.tagName === current.tagName })
-          if (siblings.length > 1) { seg += ':nth-of-type(' + (siblings.indexOf(current) + 1) + ')' }
-        }
-        path.unshift(seg)
-        current = current.parentElement
-        if (path.length >= 4) { break }
-      }
-      return path.join(' > ')
-    }
+    ${getSelectorScript(locatorDialect(runner))}
 
     var elements = []
     var seen = new Set()
diff --git a/packages/core/src/element-snapshot.ts b/packages/core/src/element-snapshot.ts
index c792bed2..09b971ed 100644
--- a/packages/core/src/element-snapshot.ts
+++ b/packages/core/src/element-snapshot.ts
@@ -16,7 +16,8 @@ import {
   SNAPSHOT_INDENT_UNIT,
   SNAPSHOT_PAGE_HEADER,
   SNAPSHOT_LOCATOR_DELIM,
-  SNAPSHOT_PURPOSE_TOKEN
+  SNAPSHOT_PURPOSE_TOKEN,
+  xpathLocatorTag
 } from '@wdio/devtools-shared'
 
 import type { JSONElement } from './locators/types.js'
@@ -833,8 +834,13 @@ export function serializeMobileSnapshot(
 // Unified snapshot formatter — web + mobile share the same render pass.
 // ---------------------------------------------------------------------------
 
-/** Derive a tag name from a CSS selector prefix (e.g. "button*=Submit" → "button"). */
+/** Derive a tag name from a locator prefix (e.g. `//button[contains(., "Submit")]`
+ *  or "button*=Submit" → "button"). */
 function extractTagFromSelector(selector: string, fallback: string): string {
+  const xpathTag = xpathLocatorTag(selector)
+  if (xpathTag) {
+    return xpathTag
+  }
   // Matches tag name followed by a CSS selector combinator or operator.
   // Supports hyphenated custom elements (my-component) and pseudo-classes (:nth-of-type).
   const match = selector.match(
diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts
index 67f02439..345c9373 100644
--- a/packages/core/src/index.ts
+++ b/packages/core/src/index.ts
@@ -28,6 +28,7 @@ export * from './trace-mutations.js'
 export * from './trace-snapshots.js'
 export * from './trace-zip-writer.js'
 export * from './bidi.js'
+export * from './bidi-preload.js'
 export * from './console.js'
 export * from './uid.js'
 export * from './net.js'
@@ -36,8 +37,10 @@ export * from './stack.js'
 export * from './terminal-throttle.js'
 export * from './error.js'
 export * from './finalize-screencast.js'
+export * from './input-dispatch.js'
 export * from './output-dir.js'
 export * from './performance-capture.js'
+export * from './read-value-locators.js'
 export * from './retry-tracker.js'
 export * from './run-id.js'
 export * from './screencast.js'
diff --git a/packages/core/src/input-dispatch.ts b/packages/core/src/input-dispatch.ts
new file mode 100644
index 00000000..80d8424a
--- /dev/null
+++ b/packages/core/src/input-dispatch.ts
@@ -0,0 +1,63 @@
+import { isInputDispatchingCommand } from '@wdio/devtools-shared'
+
+// A screenshot landing inside chromedriver's click — after it computed the
+// element's coordinates, before it dispatches at them — makes the click report
+// success while activating nothing (CLAUDE.md § Known debt has the measurements).
+// One instance per adapter bundle, not per session: both halves are module-scoped
+// and must be imported from the same bundle to see the same gate.
+
+/** Bound on one command's suppression: a failing Nightwatch test discards its
+ *  command queue, so the callback that closes a window may never fire. */
+export const INPUT_DISPATCH_MAX_HOLD_MS = 3000
+
+const NOOP = (): void => {}
+
+export class InputDispatchGate {
+  readonly #openedAt = new Map<number, number>()
+  #nextToken = 0
+
+  constructor(private readonly maxHoldMs = INPUT_DISPATCH_MAX_HOLD_MS) {}
+
+  /**
+   * Open a suppression window for `command` and return its closer. Always
+   * returns a callable so call sites need no branch — for a command that
+   * dispatches no input the closer is a no-op and nothing is tracked.
+   */
+  open(command: string): () => void {
+    if (!isInputDispatchingCommand(command)) {
+      return NOOP
+    }
+    const token = this.#nextToken++
+    this.#openedAt.set(token, Date.now())
+    return () => {
+      this.#openedAt.delete(token)
+    }
+  }
+
+  /**
+   * Whether an unexpired window is open. Expired windows are dropped here, so a
+   * closer that never runs costs one bounded stall rather than a permanent one
+   * and cannot leak entries for the rest of the run.
+   */
+  isOpen(): boolean {
+    const cutoff = Date.now() - this.maxHoldMs
+    for (const [token, openedAt] of this.#openedAt) {
+      if (openedAt <= cutoff) {
+        this.#openedAt.delete(token)
+      }
+    }
+    return this.#openedAt.size > 0
+  }
+}
+
+const sharedGate = new InputDispatchGate()
+
+/** Adapter side: open the window around a command. Returns its closer. */
+export function beginInputDispatch(command: string): () => void {
+  return sharedGate.open(command)
+}
+
+/** Recorder side: is a driver command dispatching input right now? */
+export function isInputDispatchInFlight(): boolean {
+  return sharedGate.isOpen()
+}
diff --git a/packages/core/src/read-value-locators.ts b/packages/core/src/read-value-locators.ts
new file mode 100644
index 00000000..b3463cc3
--- /dev/null
+++ b/packages/core/src/read-value-locators.ts
@@ -0,0 +1,86 @@
+// Value → locator provenance: which element's read produced a given value.
+//
+// node:assert takes VALUES, not elements — `assert.equal(await el.getText(), …)`
+// names no element — so an assertion row can only name its target if something
+// remembers which element each read value came from. Adapters feed this from
+// their command path (where a read's result and its selector are both visible)
+// and read it back when a patched assert fires; the answer lands on
+// `CommandLog.selector` so the player's overlay boxes the assertion's subject.
+//
+// Framework-agnostic by construction: it stores primitives and selector strings
+// only. The complementary handle → locator map (an assert taking the element
+// object itself) is Selenium-specific and stays in that adapter.
+
+/** Bounds the registry. A run reads far more values than any assertion looks
+ *  back over, and only the recent ones can be an assert's subject. */
+const MAX_READ_VALUES = 200
+
+/** Values longer than this are never an assertion's subject, and keying a map on
+ *  one costs real memory — a page source or a base64 screenshot is a command
+ *  result too. */
+const MAX_READ_VALUE_LENGTH = 256
+
+// Value → the locator of the element whose read produced it, or null when the
+// most recent producer was a driver-level read that no element owns. The null is
+// load-bearing: a page-title assertion would otherwise inherit the locator of an
+// element that happened to have the same text (measured on the selenium mocha
+// example, where `h1` and the document title are both "Example Domain").
+const selectorByReadValue = new Map<unknown, string | null>()
+
+// Only primitives: an object result is compared by identity, which no assertion
+// on a read value relies on, and holding one would pin it for the run.
+function isRememberableValue(value: unknown): boolean {
+  if (typeof value === 'string') {
+    return value.length > 0 && value.length <= MAX_READ_VALUE_LENGTH
+  }
+  return typeof value === 'number' || typeof value === 'boolean'
+}
+
+/** Attribute a command result to the element it was read from, so an assertion
+ *  on that value can name the element. Pass `selector: undefined` for a
+ *  driver-level read — that records the value as belonging to no element rather
+ *  than leaving an older element's claim standing. */
+export function rememberReadValue(
+  value: unknown,
+  selector: string | undefined
+): void {
+  if (!isRememberableValue(value)) {
+    return
+  }
+  // Delete before set so map order is recency order: the newest producer of a
+  // value wins the lookup, and the least recent is what eviction drops.
+  selectorByReadValue.delete(value)
+  selectorByReadValue.set(value, selector ?? null)
+  if (selectorByReadValue.size > MAX_READ_VALUES) {
+    const oldest = selectorByReadValue.keys().next()
+    if (!oldest.done) {
+      selectorByReadValue.delete(oldest.value)
+    }
+  }
+}
+
+/** The element locator this value was read from — undefined when an element read
+ *  wasn't its most recent producer. */
+export function selectorForReadValue(value: unknown): string | undefined {
+  return selectorByReadValue.get(value) ?? undefined
+}
+
+/**
+ * The element an assert was about, from its RAW args (sanitizing loses the
+ * object identity a handle is recognised by). First arg that resolves wins —
+ * node:assert puts the subject first. `fromHandle` lets an adapter that also
+ * tracks element handles answer for an element passed straight to the assert;
+ * adapters whose asserts only ever see values omit it.
+ */
+export function resolveAssertTargetFromArgs(
+  args: unknown[],
+  fromHandle?: (arg: unknown) => string | undefined
+): string | undefined {
+  for (const arg of args) {
+    const selector = fromHandle?.(arg) ?? selectorForReadValue(arg)
+    if (selector) {
+      return selector
+    }
+  }
+  return undefined
+}
diff --git a/packages/core/src/screencast-trace.ts b/packages/core/src/screencast-trace.ts
index c823ef52..9625fd50 100644
--- a/packages/core/src/screencast-trace.ts
+++ b/packages/core/src/screencast-trace.ts
@@ -27,6 +27,20 @@ export interface DenseScreencastOptions {
 const DEFAULT_MAX_FRAMES = 600
 const DEFAULT_MIN_INTERVAL_MS = 100
 
+/**
+ * A run's whole filmstrip: the frames drained from sessions that have already
+ * ended plus the one still recording. Both sources are always needed — a
+ * mid-run per-spec/per-test flush fires before the live recorder is drained, so
+ * its frames exist only on the recorder, while at the final write the recorder
+ * is already gone. Reading either alone silently truncates the filmstrip.
+ */
+export function accumulatedScreencastFrames(
+  drained: readonly ScreencastFrame[],
+  recording: { readonly frames: readonly ScreencastFrame[] } | undefined
+): ScreencastFrame[] {
+  return [...drained, ...(recording?.frames ?? [])]
+}
+
 /**
  * Thin a continuous frame buffer down to a bounded event set. Keeps a frame
  * only when it is at least `minFrameIntervalMs` after the last kept frame and
diff --git a/packages/core/src/screencast.ts b/packages/core/src/screencast.ts
index e2c8b4ea..e5d3b8f9 100644
--- a/packages/core/src/screencast.ts
+++ b/packages/core/src/screencast.ts
@@ -1,5 +1,6 @@
 import type { ScreencastFrame, ScreencastOptions } from '@wdio/devtools-shared'
 import { SCREENCAST_DEFAULTS } from '@wdio/devtools-shared'
+import { isInputDispatchInFlight } from './input-dispatch.js'
 
 /**
  * Shared screencast scaffolding consumed by every adapter (service, selenium,
@@ -219,6 +220,13 @@ export abstract class ScreencastRecorderBase<TDriver = unknown> {
 
       const intervalMs = this.options.pollIntervalMs
       this.#pollTimer = setInterval(async () => {
+        // A screenshot that reaches the driver mid-click makes the click report
+        // success while dispatching nothing, so the page never navigates. Drop
+        // the tick rather than race it — the gate is bounded, so a command whose
+        // completion never arrives costs frames only until it expires.
+        if (isInputDispatchInFlight()) {
+          return
+        }
         try {
           const data = await this.takeScreenshot()
           if (data !== null) {
diff --git a/packages/core/src/script-loader.ts b/packages/core/src/script-loader.ts
index fee66221..7c4da0ef 100644
--- a/packages/core/src/script-loader.ts
+++ b/packages/core/src/script-loader.ts
@@ -13,19 +13,42 @@ export const COLLECTOR_READY_EXPRESSION =
   'typeof window.wdioTraceCollector !== "undefined"'
 
 /**
- * Load the `@wdio/devtools-script` browser preload, wrapped in an async IIFE
- * so its top-level `await` works inside a regular `<script>` element body.
- * Shared by selenium-devtools and nightwatch-devtools, which both inject the
- * script via `document.createElement('script')` rather than BiDi preload (the
- * WDIO service uses `browser.scriptAddPreloadScript`, which doesn't need the
- * wrap and stays in its own adapter).
+ * Browser-side expression that drains the collector in one round-trip, atomic
+ * against a navigation replacing the document mid-check.
+ *
+ * `forceAnchor` forces a full-DOM anchor of the CURRENT document before
+ * draining. The collector's initial anchor is scheduled asynchronously (after
+ * `waitForBody`), so a drain issued right after injecting on a navigation
+ * destination beats it and returns nothing — and the destination's buffer then
+ * dies with the page, leaving the navigating action's DOM absent entirely.
+ *
+ * Shared by the two adapters that eval the drain as a string; the WDIO service
+ * passes an equivalent function to `browser.execute` instead.
  */
-export async function loadInjectableScript(): Promise<string> {
+export function collectorDrainExpression(forceAnchor = false): string {
+  const call = forceAnchor
+    ? 'window.wdioTraceCollector.captureCurrentDom();'
+    : ''
+  return `if (!(${COLLECTOR_READY_EXPRESSION})) { return null; } ${call} return window.wdioTraceCollector.getTraceData();`
+}
+
+/** The collector bundle's raw source. Callers wrap it for their own injection
+ *  mechanism — an async IIFE for a `<script>` body, a function declaration for a
+ *  BiDi preload script. */
+export async function loadCollectorSource(): Promise<string> {
   const scriptPath = require.resolve('@wdio/devtools-script')
   const scriptDir = path.dirname(scriptPath)
-  const preloadScriptPath = path.join(scriptDir, 'script.js')
-  const scriptContent = await fs.readFile(preloadScriptPath, 'utf-8')
-  return `(async function() { ${scriptContent} })()`
+  return fs.readFile(path.join(scriptDir, 'script.js'), 'utf-8')
+}
+
+/**
+ * The collector bundle wrapped in an async IIFE so its top-level `await` works
+ * inside a regular `<script>` element body. Used for instrumenting the document
+ * that is loaded RIGHT NOW; documents created later are covered by the BiDi
+ * preload script (`registerCollectorPreload`), which takes the raw source.
+ */
+export async function loadInjectableScript(): Promise<string> {
+  return `(async function() { ${await loadCollectorSource()} })()`
 }
 
 /** Schemes that carry no test-relevant DOM — the browser's own start page,
diff --git a/packages/core/src/session-capturer.ts b/packages/core/src/session-capturer.ts
index d20416e3..c6aa219e 100644
--- a/packages/core/src/session-capturer.ts
+++ b/packages/core/src/session-capturer.ts
@@ -13,6 +13,7 @@ import type {
 import { WORKER_WS_QUERY, WS_PATHS, WS_SCOPE } from '@wdio/devtools-shared'
 import { mapCommandToAction } from './action-mapping.js'
 import { resolveRunId } from './run-id.js'
+import { reattributeDomAnchors } from './trace-mutations.js'
 import {
   CONSOLE_METHODS,
   LOG_SOURCES,
@@ -275,6 +276,36 @@ export abstract class SessionCapturerBase {
     // no-op — service silently swallows; subclasses can opt into a log line.
   }
 
+  /**
+   * The action a document born at `time` belongs to, or undefined when the
+   * anchor already sits where it should and must be left alone.
+   *
+   * Derived from the anchor rather than from the draining call, because the
+   * post-command hooks fire at command START in some adapters: a navigation's
+   * own drain then runs against the document it is leaving, and whichever later
+   * drain does see the destination would otherwise be credited with it.
+   *
+   * Answers only when NO logged command completed after `time`. A command that
+   * completed after the document was born is the one that navigated there, and
+   * its own row already resolves the anchor — pulling the anchor earlier then
+   * mis-credits it to a preceding action and steals the DOM from rows that were
+   * genuinely still on the previous page. That is the whole difference between
+   * an adapter that stamps commands at invocation and one that stamps them at
+   * completion, so it stays a property of the data rather than a per-adapter flag.
+   */
+  protected anchorOwnerTimestamp(time: number): number | undefined {
+    let best: number | undefined
+    for (const cmd of this.commandsLog) {
+      if (cmd.timestamp > time) {
+        return undefined
+      }
+      if (best === undefined || cmd.timestamp > best) {
+        best = cmd.timestamp
+      }
+    }
+    return best
+  }
+
   /**
    * Ingest the `{ mutations, traceLogs, consoleLogs, networkRequests, metadata }`
    * payload returned by the page-side `wdioTraceCollector.getTraceData()`.
@@ -293,7 +324,14 @@ export abstract class SessionCapturerBase {
       networkRequests?: unknown
       metadata?: unknown
     },
-    opts: { skipConsoleLogs?: boolean; skipNetworkRequests?: boolean } = {}
+    opts: {
+      skipConsoleLogs?: boolean
+      skipNetworkRequests?: boolean
+      /** The command this batch's anchors were CAUSED by, when the caller
+       *  observed the document being replaced right after it. Causal knowledge,
+       *  so it overrides the timestamp inference below. */
+      anchorTimestamp?: number
+    } = {}
   ): void {
     const { mutations, traceLogs, consoleLogs, networkRequests, metadata } =
       payload
@@ -333,8 +371,15 @@ export abstract class SessionCapturerBase {
     }
 
     if (Array.isArray(mutations) && mutations.length > 0) {
-      this.mutations.push(...mutations)
-      this.sendUpstream('mutations', mutations)
+      const batch = mutations as TraceMutation[]
+      reattributeDomAnchors(
+        batch,
+        (anchorOwnTime) =>
+          opts.anchorTimestamp ?? this.anchorOwnerTimestamp(anchorOwnTime),
+        this.mutations[this.mutations.length - 1]?.timestamp ?? 0
+      )
+      this.mutations.push(...batch)
+      this.sendUpstream('mutations', batch)
     }
 
     if (Array.isArray(traceLogs) && traceLogs.length > 0) {
diff --git a/packages/core/src/trace-action-events.ts b/packages/core/src/trace-action-events.ts
index 1c6d6220..3f8119e0 100644
--- a/packages/core/src/trace-action-events.ts
+++ b/packages/core/src/trace-action-events.ts
@@ -6,7 +6,7 @@ import type {
   CommandLog,
   TestMetadataMap
 } from '@wdio/devtools-shared'
-import { POINTABLE_METHODS } from '@wdio/devtools-shared'
+import { locatorsMatch, POINTABLE_METHODS } from '@wdio/devtools-shared'
 import {
   ASSERT_ACTION_CLASS,
   formatActionTitle,
@@ -232,17 +232,37 @@ function buildParamsAndTitle(
 
 function actionError(
   cmd: CommandLog,
-  isAssert: boolean
+  action: TraceAction
 ): { message: string } | undefined {
   if (cmd.error) {
     const err = cmd.error as { message?: string }
     return { message: err.message ?? String(cmd.error) }
   }
-  if (isAssert) {
-    // Nightwatch assert failures carry no Error — only the collapsed result.
-    const collapsed = collapsedAssertResult(cmd.result)
-    if (collapsed && collapsed.passed === false) {
-      return { message: String(collapsed.message ?? 'Assertion failed') }
+  const isAssert = action.class === ASSERT_ACTION_CLASS
+  // A command whose own result reports `passed: false` failed, whatever class it
+  // maps to — not just the assert rows this used to be gated on.
+  const collapsed = collapsedAssertResult(cmd.result)
+  if (collapsed && collapsed.passed === false) {
+    return {
+      message: String(
+        collapsed.message ??
+          (isAssert ? 'Assertion failed' : `${cmd.command} failed`)
+      )
+    }
+  }
+  // A wait that resolved `false` timed out. Nightwatch reports its
+  // waitForElement* timeouts through its own assertion channel rather than the
+  // command callback, which hands back `{value: null}` — so the row's only
+  // evidence of the failure is that boolean, and without this the step a test
+  // most often fails on rendered green with nothing in the Errors tab. Scoped to
+  // waits because `false` is a legitimate value for a boolean read like
+  // `isDisplayed`, and WDIO's waits throw rather than return false.
+  if (cmd.result === false && action.method.startsWith('waitFor')) {
+    const target = cmd.args?.find((a) => typeof a === 'string')
+    return {
+      message: target
+        ? `${cmd.command} timed out waiting for ${String(target)}`
+        : `${cmd.command} timed out`
     }
   }
   return undefined
@@ -251,7 +271,10 @@ function actionError(
 /** Centre of the element a pointer action matched, from the captured element
  *  rects at the command's completion. Undefined for non-pointer actions, a
  *  non-string selector, or a selector absent from the captured elements (e.g. a
- *  WDIO text/xpath locator `getSelector` didn't reproduce). */
+ *  WDIO text/xpath locator `getSelector` didn't reproduce). A runner that acts
+ *  through a resolved element handle leaves nothing selector-shaped in `args`
+ *  (Selenium: the handle is the receiver, the args hold only the typed value), so
+ *  the row's recorded locator is read first. */
 function resolveActionPoint(
   action: TraceAction,
   cmd: CommandLog,
@@ -260,7 +283,7 @@ function resolveActionPoint(
   if (action.class !== 'Element' || !POINTABLE_METHODS.has(action.method)) {
     return undefined
   }
-  const selector = cmd.args?.[0]
+  const selector = cmd.selector ?? cmd.args?.[0]
   if (typeof selector !== 'string') {
     return undefined
   }
@@ -271,7 +294,7 @@ function resolveActionPoint(
       selector?: string
       boundingBox?: { x: number; y: number; width: number; height: number }
     }
-    if (e.selector === selector && e.boundingBox) {
+    if (e.selector && locatorsMatch(e.selector, selector) && e.boundingBox) {
       const bb = e.boundingBox
       return { x: bb.x + bb.width / 2, y: bb.y + bb.height / 2 }
     }
@@ -287,7 +310,7 @@ function buildAfterEvent(
   snapshotIndex?: FrameSnapshotIndex
 ): AfterEvent {
   const afterEvent: AfterEvent = { type: 'after', callId, endTime: endMs }
-  const error = actionError(cmd, action.class === ASSERT_ACTION_CLASS)
+  const error = actionError(cmd, action)
   if (error) {
     afterEvent.error = error
   }
@@ -367,11 +390,16 @@ export function buildActionEvents(
   // late but carry their real call-time `startTime`; since pushActionPair floors
   // each start at the running prevEndMs, out-of-order input would clamp those
   // late rows to the end of the timeline (clustering them after the last real
-  // command). A stable sort by start time restores true positions and keeps
-  // equal-time rows in insertion order (each command owns its own before/after
-  // pair, so pairing is unaffected).
+  // command). A stable sort by start time restores true positions. `sequence`
+  // then breaks ties the millisecond clock can't: a deferred row issued
+  // microseconds before the command that follows it reads as the same
+  // `startTime`, and insertion order put it after — which is how an assert that
+  // ran on the secure page landed below the logout click it preceded. Each
+  // command owns its own before/after pair, so pairing is unaffected.
   const ordered = [...commands].sort(
-    (a, b) => (a.startTime ?? a.timestamp) - (b.startTime ?? b.timestamp)
+    (a, b) =>
+      (a.startTime ?? a.timestamp) - (b.startTime ?? b.timestamp) ||
+      (a.sequence ?? 0) - (b.sequence ?? 0)
   )
   for (const cmd of ordered) {
     const action = mapCommandToAction(cmd.command)
diff --git a/packages/core/src/trace-exporter.ts b/packages/core/src/trace-exporter.ts
index 2fc1a5e9..8d789f88 100644
--- a/packages/core/src/trace-exporter.ts
+++ b/packages/core/src/trace-exporter.ts
@@ -12,6 +12,7 @@ import type {
   NetworkRequest,
   ScreencastFrame,
   TestMetadataMap,
+  TestRunnerId,
   TraceFormat,
   TraceLog,
   TraceMutation
@@ -115,6 +116,10 @@ interface ContextOptionsEvent {
   title: string
   contextId: string
   options: { viewport: { width: number; height: number } }
+  /** Extension field: the runner that recorded this zip, so the player can tell
+   *  the user how to resolve a captured locator in their own framework. Absent
+   *  when the capture didn't identify itself, and in foreign zips. */
+  runner?: TestRunnerId
 }
 
 type TraceEvent =
@@ -190,7 +195,8 @@ function buildContextOptions(
     contextId,
     options: {
       viewport: { width: viewport.width, height: viewport.height }
-    }
+    },
+    ...(trace.metadata.runner ? { runner: trace.metadata.runner } : {})
   }
 }
 
diff --git a/packages/core/src/trace-finalizer.ts b/packages/core/src/trace-finalizer.ts
index 1ed8c937..84d54899 100644
--- a/packages/core/src/trace-finalizer.ts
+++ b/packages/core/src/trace-finalizer.ts
@@ -75,8 +75,6 @@ export interface TraceExportContext {
   flushed: Set<string>
   /** Adapters keep their differing dir logic; range is set for spec writes. */
   resolveOutputDir: (range?: SpecRange) => string
-  /** Service dedupes same-timestamp snapshots; others pass identity. */
-  prepareSnapshots?: (snaps: ActionSnapshot[]) => ActionSnapshot[]
   /** Pending snapshot captures to settle before writing (selenium/nightwatch). */
   awaitPending?: Promise<unknown>[]
   log?: (level: 'info' | 'warn', msg: string) => void
@@ -308,8 +306,7 @@ export async function flushRangeLogged(
 async function writeSessionTrace(
   ctx: TraceExportContext
 ): Promise<TraceArtifact | undefined> {
-  const prepare = ctx.prepareSnapshots ?? ((s) => s)
-  const snapshots = prepare(ctx.actionSnapshots ?? [])
+  const snapshots = ctx.actionSnapshots ?? []
   const artifact: TraceArtifact = {
     kind: 'trace',
     path: '',
diff --git a/packages/core/src/trace-frame-snapshots.ts b/packages/core/src/trace-frame-snapshots.ts
index 4f91f208..dc11e497 100644
--- a/packages/core/src/trace-frame-snapshots.ts
+++ b/packages/core/src/trace-frame-snapshots.ts
@@ -88,19 +88,40 @@ export class FrameSnapshotIndex {
     return this.#lastName
   }
 
-  /** Claims the screenshot captured at the command's completion, if any. */
+  /**
+   * The capture describing the page when this command completed: the one at its
+   * exact timestamp, else the most recent one before it.
+   *
+   * Non-consuming, and falls back rather than returning nothing, because several
+   * actions legitimately share one page state. Nightwatch emits its native
+   * assertion rows in a batch whose execution windows collapse onto the same
+   * instant, so handing the capture to whichever claimed first left the rest of
+   * the batch with no DOM, no a11y tree and no screenshot in the action pane.
+   * And an assertion reads the page rather than changing it, so it takes no
+   * capture of its own and correctly inherits the preceding action's.
+   */
   claimAfter(timestamp: number, callId: string): string | undefined {
-    const snap = this.#byTimestamp.get(timestamp)
+    const snap =
+      this.#byTimestamp.get(timestamp) ?? this.#latestAtOrBefore(timestamp)
     if (!snap) {
       return undefined
     }
-    this.#byTimestamp.delete(timestamp)
     const snapshotName = `after@${callId}`
     this.#refs.push({ callId, snapshotName, snapshot: snap })
     this.#lastName = snapshotName
     return snapshotName
   }
 
+  #latestAtOrBefore(timestamp: number): ActionSnapshot | undefined {
+    let best: ActionSnapshot | undefined
+    for (const [ts, snap] of this.#byTimestamp) {
+      if (ts <= timestamp && (!best || ts > best.timestamp)) {
+        best = snap
+      }
+    }
+    return best
+  }
+
   refs(): FrameSnapshotRef[] {
     return this.#refs
   }
diff --git a/packages/core/src/trace-mutations.ts b/packages/core/src/trace-mutations.ts
index d63ce094..aaf94a8b 100644
--- a/packages/core/src/trace-mutations.ts
+++ b/packages/core/src/trace-mutations.ts
@@ -14,6 +14,52 @@ import type {
  *  on mutation-heavy SPAs. Late mutations drop first (replay-from-start holds). */
 export const MAX_MUTATIONS_NDJSON_BYTES = 50 * 1024 * 1024
 
+/** A full-document anchor rather than an observed diff. `url` is the reliable
+ *  discriminator: only the collector's `captureCurrentDom` sets it, and neither
+ *  the MutationObserver serializer nor the synthetic field-state records do. */
+function isDomAnchor(mutation: TraceMutation): boolean {
+  return mutation.type === 'childList' && mutation.url !== undefined
+}
+
+/**
+ * Re-stamp the full-document anchors in a freshly drained batch onto the action
+ * that produced the document.
+ *
+ * An anchor carries the document's own birth time, which lands a few ms *after*
+ * the command that navigated there — so the navigating action's row, which ends
+ * the moment the command was logged, still resolves to the PREVIOUS page's DOM.
+ *
+ * `resolve` maps an anchor's own timestamp to the action it belongs to. Deriving
+ * it from the anchor rather than from whichever drain collected it is what makes
+ * this race-free: several drains compete for a fresh collector's buffer (the
+ * first `getTraceData` empties it) and the winner is routinely a later command's
+ * post-DOM drain, so trusting the collecting drain mis-credited the anchor.
+ *
+ * `floor` is the newest timestamp already in the accumulated stream. An anchor is
+ * never pulled ahead of mutations belonging to the document it replaces — replay
+ * would then apply those stale refs to the new tree — and never pushed later than
+ * the page stamped it, so an overshooting attribution is simply ignored.
+ */
+export function reattributeDomAnchors(
+  batch: TraceMutation[],
+  resolve: (anchorOwnTime: number) => number | undefined,
+  floor = 0
+): void {
+  let lowerBound = floor
+  for (const mutation of batch) {
+    if (isDomAnchor(mutation)) {
+      const attributed = resolve(mutation.timestamp)
+      if (attributed !== undefined) {
+        const target = Math.max(attributed, lowerBound)
+        if (target < mutation.timestamp) {
+          mutation.timestamp = target
+        }
+      }
+    }
+    lowerBound = Math.max(lowerBound, mutation.timestamp)
+  }
+}
+
 export interface MutationsNdjsonResult {
   /** NDJSON payload (one mutation per line, optional trailing marker). Empty
    *  buffer when there are no mutations. */
diff --git a/packages/core/src/trace-snapshots.ts b/packages/core/src/trace-snapshots.ts
index ab7ed3f5..9633ea80 100644
--- a/packages/core/src/trace-snapshots.ts
+++ b/packages/core/src/trace-snapshots.ts
@@ -16,11 +16,29 @@ export interface ScreencastFrameEvent {
   timestamp: number
 }
 
+// The one merge rule for same-timestamp snapshots: richest wins per field,
+// first-seen wins for identity (command/url/title, which no export path reads).
+// Merging per field matters because the real screenshot and the real elements
+// can land on different captures of the same action.
+function mergeSnapshotInto(
+  existing: ActionSnapshot,
+  snap: ActionSnapshot
+): void {
+  if ((snap.screenshot?.length ?? 0) > (existing.screenshot?.length ?? 0)) {
+    existing.screenshot = snap.screenshot
+  }
+  if (!existing.elements?.length && snap.elements?.length) {
+    existing.elements = snap.elements
+  }
+  if (!existing.snapshotText && snap.snapshotText) {
+    existing.snapshotText = snap.snapshotText
+  }
+}
+
 // Two snapshots at the same timestamp (a real post-action capture and a blank
 // end-of-scenario one) map to the same `${pageId}-${ts}` resource name, so a
-// last-wins write lets a blank frame clobber the real one — and the real
-// screenshot and real elements can land on different captures. Collapse to one
-// per timestamp: largest screenshot, richest metadata, merged across duplicates.
+// last-wins write lets a blank frame clobber the real one. Collapse to one per
+// timestamp so the resource writer never sees a collision.
 function collapseByTimestamp(snapshots: ActionSnapshot[]): ActionSnapshot[] {
   const byTs = new Map<number, ActionSnapshot>()
   const order: number[] = []
@@ -31,19 +49,27 @@ function collapseByTimestamp(snapshots: ActionSnapshot[]): ActionSnapshot[] {
       order.push(snap.timestamp)
       continue
     }
-    if ((snap.screenshot?.length ?? 0) > (existing.screenshot?.length ?? 0)) {
-      existing.screenshot = snap.screenshot
-    }
-    if (!existing.elements?.length && snap.elements?.length) {
-      existing.elements = snap.elements
-    }
-    if (!existing.snapshotText && snap.snapshotText) {
-      existing.snapshotText = snap.snapshotText
-    }
+    mergeSnapshotInto(existing, snap)
   }
   return order.map((ts) => byTs.get(ts)!)
 }
 
+/** Insert a snapshot, or merge it into the one already holding its timestamp.
+ *  Applies the collapse rule at capture time so the accumulator holds one record
+ *  per timestamp: a mid-run slice flush reads this array live, before export
+ *  would have collapsed it, and would otherwise emit a blank duplicate. */
+export function upsertRichestSnapshot(
+  snapshots: ActionSnapshot[],
+  snap: ActionSnapshot
+): void {
+  const idx = snapshots.findIndex((s) => s.timestamp === snap.timestamp)
+  if (idx === -1) {
+    snapshots.push(snap)
+    return
+  }
+  mergeSnapshotInto(snapshots[idx]!, snap)
+}
+
 export function buildSnapshotResources(
   rawSnapshots: ActionSnapshot[],
   pageId: string
diff --git a/packages/core/src/trace-transcript.ts b/packages/core/src/trace-transcript.ts
index 370d97e1..d3a5161a 100644
--- a/packages/core/src/trace-transcript.ts
+++ b/packages/core/src/trace-transcript.ts
@@ -50,7 +50,9 @@ function capturedSteps(
   // here so the transcript matches execution order. Stable + a no-op for
   // already-ordered WDIO/Selenium command logs.
   const ordered = [...commands].sort(
-    (a, b) => (a.startTime ?? a.timestamp) - (b.startTime ?? b.timestamp)
+    (a, b) =>
+      (a.startTime ?? a.timestamp) - (b.startTime ?? b.timestamp) ||
+      (a.sequence ?? 0) - (b.sequence ?? 0)
   )
   const captured: { entry: CommandLog; action: TraceAction }[] = []
   for (const c of ordered) {
diff --git a/packages/core/src/with-timeout.ts b/packages/core/src/with-timeout.ts
index feb840e2..d89b9c05 100644
--- a/packages/core/src/with-timeout.ts
+++ b/packages/core/src/with-timeout.ts
@@ -24,3 +24,9 @@ export function withTimeout<T>(
 
 /** Default ceiling for a single in-page snapshot probe. */
 export const SNAPSHOT_PROBE_TIMEOUT_MS = 2500
+
+/** Ceiling for a driver round-trip probe (screenshot, url, title). Larger than
+ *  the in-page ceiling because encoding a full-page screenshot legitimately
+ *  takes longer than reading the DOM, but still inside the adapters' 5s
+ *  settle window so a hung probe can't strand the whole capture. */
+export const SNAPSHOT_DRIVER_PROBE_TIMEOUT_MS = 4000
diff --git a/packages/core/tests/action-snapshot.test.ts b/packages/core/tests/action-snapshot.test.ts
new file mode 100644
index 00000000..b59811cc
--- /dev/null
+++ b/packages/core/tests/action-snapshot.test.ts
@@ -0,0 +1,163 @@
+import { describe, it, expect, vi } from 'vitest'
+import { captureActionSnapshot } from '../src/action-snapshot.js'
+import { SNAPSHOT_DRIVER_PROBE_TIMEOUT_MS } from '../src/with-timeout.js'
+
+const okScript = () => Promise.resolve([])
+
+describe('captureActionSnapshot timestamp', () => {
+  it('stamps the caller-supplied command timestamp', async () => {
+    // Export claims snapshots by exact equality with the command timestamp, so
+    // the caller — not the capture — owns the stamp.
+    const snap = await captureActionSnapshot({
+      command: 'click',
+      timestamp: 4242,
+      runScript: okScript,
+      takeScreenshot: () => Promise.resolve('AA')
+    })
+    expect(snap?.timestamp).toBe(4242)
+  })
+
+  it('falls back to capture time when no timestamp is given', async () => {
+    const before = Date.now()
+    const snap = await captureActionSnapshot({
+      command: 'click',
+      runScript: okScript
+    })
+    const after = Date.now()
+    expect(snap?.timestamp).toBeGreaterThanOrEqual(before)
+    expect(snap?.timestamp).toBeLessThanOrEqual(after)
+  })
+
+  it('honours the supplied timestamp on the native-mobile path', async () => {
+    // No runScript + a page source is what selects the mobile branch; the stamp
+    // must survive the different snapshot-text path.
+    const snap = await captureActionSnapshot({
+      command: 'click',
+      timestamp: 777,
+      getPageSource: () => Promise.resolve('<hierarchy />'),
+      platform: 'android'
+    })
+    expect(snap?.timestamp).toBe(777)
+  })
+
+  it('stamps a zero timestamp rather than treating it as absent', async () => {
+    const snap = await captureActionSnapshot({
+      command: 'click',
+      timestamp: 0,
+      runScript: okScript
+    })
+    expect(snap?.timestamp).toBe(0)
+  })
+})
+
+describe('captureActionSnapshot probe isolation', () => {
+  it('still resolves when a driver probe never settles', async () => {
+    // Nightwatch's url/title readers are QUEUED commands: called from inside the
+    // plugin's own command hook they enqueue behind the running command and can
+    // never resolve. Unguarded, one of them stranded the whole capture and the
+    // action reached the trace with no DOM at all.
+    vi.useFakeTimers()
+    const capture = captureActionSnapshot({
+      command: 'click',
+      timestamp: 10,
+      runScript: okScript,
+      getUrl: () => new Promise<string>(() => {}),
+      takeScreenshot: () => Promise.resolve('AA')
+    })
+    await vi.advanceTimersByTimeAsync(SNAPSHOT_DRIVER_PROBE_TIMEOUT_MS + 1)
+    const snap = await capture
+    vi.useRealTimers()
+    expect(snap?.timestamp).toBe(10)
+    expect(snap?.url).toBeUndefined()
+    expect(snap?.screenshot).toBe('AA')
+  })
+
+  it('absorbs a probe that throws synchronously', async () => {
+    const snap = await captureActionSnapshot({
+      command: 'click',
+      timestamp: 11,
+      runScript: okScript,
+      getTitle: () => {
+        throw new Error('no such session')
+      },
+      takeScreenshot: () => Promise.resolve('BB')
+    })
+    expect(snap?.title).toBeUndefined()
+    expect(snap?.screenshot).toBe('BB')
+  })
+
+  it('takes a null url/title the same way it takes a null screenshot', async () => {
+    // A raw-transport reader answers `null` on a failed read rather than
+    // rejecting, so the probes accept it and normalize it to `undefined` — the
+    // adapters must not have to coerce it themselves.
+    const snap = await captureActionSnapshot({
+      command: 'click',
+      timestamp: 13,
+      runScript: okScript,
+      getUrl: () => Promise.resolve(null),
+      getTitle: () => Promise.resolve(null),
+      takeScreenshot: () => Promise.resolve(null)
+    })
+    expect(snap?.url).toBeUndefined()
+    expect(snap?.title).toBeUndefined()
+    expect(snap?.screenshot).toBeUndefined()
+  })
+
+  it('absorbs a rejecting screenshot without losing the rest', async () => {
+    const snap = await captureActionSnapshot({
+      command: 'click',
+      timestamp: 12,
+      runScript: okScript,
+      getUrl: () => Promise.resolve('https://example.com/x'),
+      takeScreenshot: () => Promise.reject(new Error('boom'))
+    })
+    expect(snap?.screenshot).toBeUndefined()
+    expect(snap?.url).toBe('https://example.com/x')
+  })
+})
+
+describe('captureActionSnapshot locator dialect', () => {
+  /** Both injected script bodies, as the adapter's runScript receives them. */
+  async function injectedScripts(
+    input: Parameters<typeof captureActionSnapshot>[0]
+  ): Promise<string[]> {
+    const scripts: string[] = []
+    await captureActionSnapshot({
+      ...input,
+      runScript: (src) => {
+        scripts.push(src)
+        return Promise.resolve([])
+      }
+    })
+    return scripts
+  }
+
+  it("threads the runner into both scripts' text branch", async () => {
+    const scripts = await injectedScripts({ command: 'click', runner: 'mocha' })
+
+    expect(scripts).toHaveLength(2)
+    for (const src of scripts) {
+      expect(src).toContain("tag + '*=' + text")
+    }
+  })
+
+  it('keeps the portable XPath form for a runner without its own syntax', async () => {
+    const scripts = await injectedScripts({
+      command: 'click',
+      runner: 'nightwatch'
+    })
+
+    for (const src of scripts) {
+      expect(src).not.toContain("tag + '*=' + text")
+      expect(src).toContain("'[contains(., '")
+    }
+  })
+
+  it('defaults to the portable form when no runner is given', async () => {
+    const scripts = await injectedScripts({ command: 'click' })
+
+    for (const src of scripts) {
+      expect(src).not.toContain("tag + '*=' + text")
+    }
+  })
+})
diff --git a/packages/core/tests/assert-patcher.test.ts b/packages/core/tests/assert-patcher.test.ts
index 5eccc4c7..71b8fda7 100644
--- a/packages/core/tests/assert-patcher.test.ts
+++ b/packages/core/tests/assert-patcher.test.ts
@@ -274,6 +274,68 @@ describe('patchNodeAssert', () => {
       expect(ASSERT_MUT['equal']).toBe(wrapped)
     })
   })
+
+  describe('assert target resolution', () => {
+    it('stamps the resolved selector on the capture', () => {
+      const captured: CapturedAssert[] = []
+      patchNodeAssert(
+        (c) => captured.push(c),
+        undefined,
+        () => '#flash'
+      )
+      assert.equal('logged in', 'logged in')
+      expect(captured[0].selector).toBe('#flash')
+    })
+
+    it('resolves from the RAW args, not the serialized ones', () => {
+      // The adapter recognises an element handle by object identity, which
+      // safeSerializeAssertArg destroys — so the resolver must see the originals.
+      const handle = { getId: () => 'e1' }
+      const seen: unknown[][] = []
+      const captured: CapturedAssert[] = []
+      patchNodeAssert(
+        (c) => captured.push(c),
+        undefined,
+        (args) => {
+          seen.push(args)
+          return args[0] === handle ? '#flash' : undefined
+        }
+      )
+      assert.ok(handle)
+      expect(seen[0][0]).toBe(handle)
+      expect(captured[0].selector).toBe('#flash')
+      expect(captured[0].args[0]).not.toBe(handle)
+    })
+
+    it('leaves selector absent when the resolver names nothing', () => {
+      const captured: CapturedAssert[] = []
+      patchNodeAssert(
+        (c) => captured.push(c),
+        undefined,
+        () => undefined
+      )
+      assert.equal(1, 1)
+      expect(captured[0].selector).toBeUndefined()
+      expect('selector' in captured[0]).toBe(false)
+    })
+
+    it('resolves once per call and reuses it for the failing emit', () => {
+      const captured: CapturedAssert[] = []
+      const resolve = vi.fn(() => '#flash')
+      patchNodeAssert((c) => captured.push(c), undefined, resolve)
+      expect(() => assert.equal('a', 'b')).toThrow()
+      expect(resolve).toHaveBeenCalledTimes(1)
+      expect(captured[0].selector).toBe('#flash')
+    })
+
+    it('skips resolution for an assert dropped as non-user-code', () => {
+      vi.mocked(getCallSourceFromStack).mockReturnValue(INTERNAL_FRAME)
+      const resolve = vi.fn(() => '#flash')
+      patchNodeAssert(() => {}, undefined, resolve)
+      assert.equal(1, 1)
+      expect(resolve).not.toHaveBeenCalled()
+    })
+  })
 })
 
 describe('capturedAssertToCommandLog', () => {
@@ -312,6 +374,15 @@ describe('capturedAssertToCommandLog', () => {
     })
     expect(entry.testUid).toBeUndefined()
   })
+
+  // Without this the row reaches the trace with no `locator` param and the
+  // player's element overlay has nothing to box the assertion's target with.
+  it('carries the resolved target selector onto the row', () => {
+    expect(
+      capturedAssertToCommandLog({ ...base, selector: '#flash' }).selector
+    ).toBe('#flash')
+    expect(capturedAssertToCommandLog(base).selector).toBeUndefined()
+  })
 })
 
 describe('matcherAssertionToCommandLog', () => {
diff --git a/packages/core/tests/collector-drain.test.ts b/packages/core/tests/collector-drain.test.ts
new file mode 100644
index 00000000..e04be599
--- /dev/null
+++ b/packages/core/tests/collector-drain.test.ts
@@ -0,0 +1,37 @@
+import { describe, it, expect } from 'vitest'
+import {
+  COLLECTOR_READY_EXPRESSION,
+  collectorDrainExpression
+} from '../src/script-loader.js'
+
+describe('collectorDrainExpression', () => {
+  it('guards on the collector before draining', () => {
+    const expr = collectorDrainExpression()
+    expect(expr).toContain(COLLECTOR_READY_EXPRESSION)
+    expect(expr).toContain('return null;')
+    expect(expr).toContain('getTraceData()')
+  })
+
+  it('omits the anchor when none is requested', () => {
+    expect(collectorDrainExpression()).not.toContain('captureCurrentDom')
+    expect(collectorDrainExpression(false)).not.toContain('captureCurrentDom')
+  })
+
+  it('anchors the document before draining when asked', () => {
+    // Regression: without this the freshly injected collector's async initial
+    // anchor loses the race with the drain, so a navigation destination's DOM
+    // never reaches the trace — it dies in the page buffer at the next nav.
+    const expr = collectorDrainExpression(true)
+    expect(expr).toContain('captureCurrentDom()')
+    expect(expr.indexOf('captureCurrentDom')).toBeLessThan(
+      expr.indexOf('getTraceData')
+    )
+  })
+
+  it('keeps the guard ahead of the anchor so a missing collector is safe', () => {
+    const expr = collectorDrainExpression(true)
+    expect(expr.indexOf('return null;')).toBeLessThan(
+      expr.indexOf('captureCurrentDom')
+    )
+  })
+})
diff --git a/packages/core/tests/element-scripts.test.ts b/packages/core/tests/element-scripts.test.ts
new file mode 100644
index 00000000..d4a30847
--- /dev/null
+++ b/packages/core/tests/element-scripts.test.ts
@@ -0,0 +1,362 @@
+// @vitest-environment happy-dom
+import { beforeEach, describe, expect, it } from 'vitest'
+
+import {
+  accessibilityTreeScript,
+  elementsScript
+} from '../src/element-scripts.js'
+import type {
+  AccessibilityNode,
+  BrowserElementInfo
+} from '../src/element-types.js'
+import { locatorsMatch } from '@wdio/devtools-shared'
+import type { TestRunnerId } from '@wdio/devtools-shared'
+import { accessibilityNodesToSnapshotNodes } from '../src/element-snapshot.js'
+
+/** The scripts are injectable source, so they are run the way the adapters run
+ *  them — `@wdio/elements` builds the same `new Function` wrapper. */
+function run<T>(source: string): T[] {
+  return new Function(`return ${source}`)() as T[]
+}
+
+function a11yNodes(html: string, runner?: TestRunnerId): AccessibilityNode[] {
+  document.body.innerHTML = html
+  return run<AccessibilityNode>(accessibilityTreeScript(false, runner))
+}
+
+function interactables(
+  html: string,
+  runner?: TestRunnerId
+): BrowserElementInfo[] {
+  document.body.innerHTML = html
+  return run<BrowserElementInfo>(elementsScript(false, false, runner))
+}
+
+function locatorFor(
+  nodes: (AccessibilityNode | BrowserElementInfo)[],
+  name: string
+): string {
+  const node = nodes.find((n) => n.name === name)
+  if (!node) {
+    throw new Error(`no captured node named ${JSON.stringify(name)}`)
+  }
+  return node.selector
+}
+
+beforeEach(() => {
+  // happy-dom has no layout engine, so the scripts' visibility gate would reject
+  // every element and the walk would return nothing.
+  Element.prototype.checkVisibility = () => true
+})
+
+describe('captured locators', () => {
+  it('emits portable XPath for a uniquely text-matched element', () => {
+    const nodes = a11yNodes('<a href="/logout"><i></i> Logout</a>')
+
+    expect(locatorFor(nodes, 'Logout')).toBe('//a[contains(., "Logout")]')
+  })
+
+  it('emits no WebdriverIO text-selector syntax for any node', () => {
+    const nodes = a11yNodes(`
+      <h2>Login Page</h2>
+      <form>
+        <input id="username" name="username" placeholder="Username">
+        <button type="submit">Login</button>
+      </form>
+      <a href="/logout"><i></i> Logout</a>
+    `)
+
+    expect(nodes.length).toBeGreaterThan(0)
+    for (const node of nodes) {
+      expect(node.selector).not.toContain('*=')
+    }
+  })
+
+  it('emits the runner-native text form for a WebdriverIO run', () => {
+    // `//a[…]` needs `useXpath()` in Nightwatch and `By.xpath` in Selenium, but
+    // a WDIO user pastes `a*=Logout` straight into `$()`.
+    const nodes = a11yNodes('<a href="/logout"><i></i> Logout</a>', 'mocha')
+
+    expect(locatorFor(nodes, 'Logout')).toBe('a*=Logout')
+  })
+
+  it('emits XPath for the runners with no text form of their own', () => {
+    const html = '<a href="/logout"><i></i> Logout</a>'
+
+    for (const runner of ['nightwatch', 'selenium-webdriver'] as const) {
+      expect(locatorFor(a11yNodes(html, runner), 'Logout')).toBe(
+        '//a[contains(., "Logout")]'
+      )
+    }
+  })
+
+  it('keeps XPath under WebdriverIO when the text carries a double quote', () => {
+    // WDIO compiles `tag*=text` into XPath with `"` quoting, so a text carrying
+    // one would produce a broken expression. WDIO resolves `//` itself.
+    const nodes = a11yNodes('<p>He said "hello" loudly</p>', 'mocha')
+
+    expect(locatorFor(nodes, 'He said "hello" loudly')).toBe(
+      '//p[contains(., \'He said "hello" loudly\')]'
+    )
+  })
+
+  it('emits the same CSS branches for every runner — only their order varies', () => {
+    // Every element here shares its text with a same-tag sibling, so the text
+    // branch is unreachable in both orders and the two runners have to agree.
+    const html = `
+      <button aria-label="close">dismiss</button>
+      <button data-testid="save">dismiss</button>
+      <input id="username" name="username" placeholder="Username">
+      <input name="password" type="password">
+      <div role="button" class="pick-me">dismiss</div>
+      <div role="button">dismiss</div>
+    `
+
+    expect(a11yNodes(html, 'mocha').map((n) => n.selector)).toEqual(
+      a11yNodes(html, 'nightwatch').map((n) => n.selector)
+    )
+  })
+
+  it('keeps the tag scope, so the locator cannot match a different element type', () => {
+    const nodes = a11yNodes(
+      '<button type="submit">Login</button><a href="/login">Login</a>'
+    )
+
+    expect(locatorFor(nodes, 'Login')).toBe('//button[contains(., "Login")]')
+  })
+
+  it('falls through to CSS when the text is not unique for the tag', () => {
+    // The ancestor div contains the inner text too, so neither the DOM count
+    // nor XPath's `contains(., …)` would resolve to one element.
+    const nodes = a11yNodes(
+      '<div role="button">outer <div role="button">inner</div></div>'
+    )
+
+    expect(locatorFor(nodes, 'inner')).toBe('body > div > div')
+  })
+
+  it('leaves the CSS fallback branches untouched', () => {
+    // Every element here shares its text with a same-tag sibling, which is what
+    // pushes each past the text branch onto the branch under test.
+    const nodes = a11yNodes(`
+      <button aria-label="close">dismiss</button>
+      <button data-testid="save">dismiss</button>
+      <input id="username" name="username" placeholder="Username">
+      <input name="password" type="password">
+      <textarea name="comment"></textarea>
+      <div role="button" class="pick-me">dismiss</div>
+      <div role="button">dismiss</div>
+    `)
+    const locators = nodes.map((node) => node.selector)
+
+    expect(locatorFor(nodes, 'close')).toBe('[aria-label="close"]')
+    expect(locatorFor(nodes, 'Username')).toBe('#username')
+    expect(locators).toContain('[data-testid="save"]')
+    expect(locators).toContain('input[name="password"]')
+    expect(locators).toContain('textarea[name="comment"]')
+    expect(locators).toContain('div.pick-me')
+  })
+
+  it('skips a duplicated id, like every other CSS branch skips a non-unique match', () => {
+    // An id is only a locator while it is unique. Duplicate ids are invalid HTML
+    // but common in real pages, and `#dup` there resolves to whichever element
+    // the DOM happens to return first.
+    const nodes = a11yNodes(
+      `<button id="dup" type="submit">Alpha</button>
+       <button id="dup" type="reset">Beta</button>`,
+      'nightwatch'
+    )
+
+    expect(locatorFor(nodes, 'Alpha')).toBe('button[type="submit"]')
+    expect(locatorFor(nodes, 'Beta')).toBe('button[type="reset"]')
+  })
+
+  it('lets the text branch have its turn when a duplicated id is all the CSS branches had', () => {
+    // Nightwatch orders CSS first, so an unconditional `#id` consumed the
+    // element before the text branch — the one branch that could still identify
+    // it — was ever reached.
+    const nodes = a11yNodes(
+      `<div role="button" id="dup">Alpha</div>
+       <div role="button" id="dup">Beta</div>`,
+      'nightwatch'
+    )
+
+    expect(locatorFor(nodes, 'Alpha')).toBe('//div[contains(., "Alpha")]')
+  })
+
+  it('prefers a native CSS locator to XPath for Nightwatch', () => {
+    // The one runner that reads a bare locator string under a default CSS
+    // strategy: `//button[…]` there needs useXpath(), `button[type="submit"]`
+    // needs nothing.
+    const nodes = a11yNodes(
+      '<button class="radius" type="submit">Login</button>',
+      'nightwatch'
+    )
+
+    expect(locatorFor(nodes, 'Login')).toBe('button[type="submit"]')
+  })
+
+  it('keeps text first for the runners it costs nothing', () => {
+    // WDIO resolves `button*=Login` natively; Selenium wraps every locator in a
+    // `By.…` anyway, so `By.xpath` asks no more than `By.css`.
+    const html = '<button class="radius" type="submit">Login</button>'
+
+    expect(locatorFor(a11yNodes(html, 'mocha'), 'Login')).toBe('button*=Login')
+    expect(locatorFor(a11yNodes(html, 'selenium-webdriver'), 'Login')).toBe(
+      '//button[contains(., "Login")]'
+    )
+    expect(locatorFor(a11yNodes(html), 'Login')).toBe(
+      '//button[contains(., "Login")]'
+    )
+  })
+
+  it('falls back to text for Nightwatch when no unique CSS locator exists', () => {
+    // Nothing on the link is unique but its own text, so the demoted branch is
+    // still reached — ahead of the meaningless positional path.
+    const nodes = a11yNodes(
+      '<a href="/logout"><i></i> Logout</a>',
+      'nightwatch'
+    )
+
+    expect(locatorFor(nodes, 'Logout')).toBe('//a[contains(., "Logout")]')
+  })
+
+  it('prefers text to the positional path for Nightwatch', () => {
+    const nodes = a11yNodes(
+      '<div role="button">alpha</div><div role="button">beta</div>',
+      'nightwatch'
+    )
+
+    expect(locatorFor(nodes, 'alpha')).toBe('//div[contains(., "alpha")]')
+  })
+
+  it('generates one grammar for both injected scripts', () => {
+    const html = '<a href="/logout"><i></i> Logout</a>'
+
+    expect(locatorFor(interactables(html), 'Logout')).toBe(
+      locatorFor(a11yNodes(html), 'Logout')
+    )
+  })
+
+  it('generates one grammar for both scripts under each runner', () => {
+    // `-snapshot.txt` comes from one script and `-elements.json` from the other;
+    // a per-runner branch in only one would desync the two artifacts.
+    const html = '<a href="/logout"><i></i> Logout</a>'
+
+    for (const runner of ['mocha', 'nightwatch'] as const) {
+      expect(locatorFor(interactables(html, runner), 'Logout')).toBe(
+        locatorFor(a11yNodes(html, runner), 'Logout')
+      )
+    }
+  })
+})
+
+// `type` is what a form control is usually written by (`button[type="submit"]`,
+// `input[type="email"]`) and it is the only semantic attribute a control that
+// carries no id, name or test id tends to have.
+describe('the type-attribute branch', () => {
+  it('identifies a control by its type when that is unique', () => {
+    const nodes = a11yNodes(
+      `<input type="text" class="first" placeholder="First">
+       <input type="email" class="third" placeholder="Email">`,
+      'nightwatch'
+    )
+
+    expect(locatorFor(nodes, 'Email')).toBe('input[type="email"]')
+  })
+
+  it('skips it when the type does not single the control out', () => {
+    const nodes = a11yNodes(
+      `<input type="text" class="first" placeholder="First">
+       <input type="text" class="second" placeholder="Second">`,
+      'nightwatch'
+    )
+
+    expect(locatorFor(nodes, 'First')).toBe('input.first')
+  })
+
+  it('yields to the branches that identify the element more strongly', () => {
+    const nodes = a11yNodes(
+      `<button id="go" type="submit">Go</button>
+       <input name="q" type="search" placeholder="Query">
+       <input type="checkbox" data-testid="agree" aria-label="Agree">`,
+      'nightwatch'
+    )
+    const locators = nodes.map((node) => node.selector)
+
+    expect(locatorFor(nodes, 'Go')).toBe('#go')
+    expect(locatorFor(nodes, 'Query')).toBe('input[name="q"]')
+    expect(locatorFor(nodes, 'Agree')).toBe('[aria-label="Agree"]')
+    expect(locators).not.toContain('input[type="checkbox"]')
+  })
+})
+
+describe('XPath string literals', () => {
+  it('wraps text carrying a double quote in single quotes', () => {
+    const nodes = a11yNodes('<p>He said "hello" loudly</p>')
+
+    expect(locatorFor(nodes, 'He said "hello" loudly')).toBe(
+      '//p[contains(., \'He said "hello" loudly\')]'
+    )
+  })
+
+  it('keeps double quotes for text carrying only a single quote', () => {
+    const nodes = a11yNodes("<p>It's fine</p>")
+
+    expect(locatorFor(nodes, "It's fine")).toBe(
+      '//p[contains(., "It\'s fine")]'
+    )
+  })
+
+  it('stitches text carrying both quote kinds with concat', () => {
+    // XPath 1.0 has no string escape, so this is the only expressible form.
+    const nodes = a11yNodes('<p>It\'s a "quoted" mess</p>')
+
+    expect(locatorFor(nodes, 'It\'s a "quoted" mess')).toBe(
+      '//p[contains(., concat("It\'s a ", \'"\', "quoted", \'"\', " mess"))]'
+    )
+  })
+
+  it('emits a bare literal rather than a one-argument concat', () => {
+    // `concat()` takes at least two arguments, so a value that is nothing but
+    // double quotes must not be wrapped in one.
+    const nodes = a11yNodes('<p>"</p><span>x</span>')
+
+    expect(locatorFor(nodes, '"')).toBe("//p[contains(., '\"')]")
+  })
+})
+
+// The grammar is emitted here as a string and parsed in shared by regex. Feeding
+// a REAL generated locator through the parser is what keeps the two from
+// drifting — a producer tweak that the regex can't read would otherwise only
+// show up as a silently missing input point in an exported trace.
+describe('generated locators the exporter has to parse back', () => {
+  const html = '<a href="/logout"><i></i> Logout</a>'
+
+  it('matches the test-written form it was generated from, in either dialect', () => {
+    for (const runner of [
+      'mocha',
+      'nightwatch',
+      'selenium-webdriver'
+    ] as const) {
+      const captured = locatorFor(a11yNodes(html, runner), 'Logout')
+
+      expect(locatorsMatch(captured, 'a*=Logout')).toBe(true)
+      expect(locatorsMatch(captured, '//a[contains(., "Logout")]')).toBe(true)
+      expect(locatorsMatch(captured, 'button*=Logout')).toBe(false)
+    }
+  })
+
+  it('yields its tag to the snapshot serializer in either dialect', () => {
+    // The serializer reads the tag back out of the locator it was handed, so a
+    // dialect it can't parse would report the ARIA role as the tag instead.
+    for (const runner of ['mocha', 'nightwatch'] as const) {
+      const nodes = accessibilityNodesToSnapshotNodes(a11yNodes(html, runner), {
+        inViewportOnly: false
+      })
+      const link = nodes.find((n) => n.name === 'Logout')
+
+      expect(link?.tagName).toBe('a')
+    }
+  })
+})
diff --git a/packages/core/tests/input-dispatch.test.ts b/packages/core/tests/input-dispatch.test.ts
new file mode 100644
index 00000000..d164eef4
--- /dev/null
+++ b/packages/core/tests/input-dispatch.test.ts
@@ -0,0 +1,117 @@
+import { describe, it, expect } from 'vitest'
+import { isInputDispatchingCommand } from '@wdio/devtools-shared'
+import {
+  InputDispatchGate,
+  beginInputDispatch,
+  isInputDispatchInFlight
+} from '../src/input-dispatch.js'
+
+const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms))
+
+describe('isInputDispatchingCommand', () => {
+  it('classifies pointer and keyboard commands across runners', () => {
+    for (const command of [
+      'click',
+      'doubleClick',
+      'moveTo',
+      'dragAndDrop',
+      'touchAction',
+      'scrollIntoView',
+      'selectByVisibleText',
+      'setValue',
+      'sendKeys',
+      'addValue',
+      'clearValue',
+      'clear',
+      'keys'
+    ]) {
+      expect(isInputDispatchingCommand(command)).toBe(true)
+    }
+  })
+
+  it("covers runner-native pointer commands ACTION_MAP doesn't name", () => {
+    for (const command of [
+      'moveToElement',
+      'mouseButtonClick',
+      'mouseButtonDown',
+      'mouseButtonUp',
+      'rightClick',
+      'submitForm'
+    ]) {
+      expect(isInputDispatchingCommand(command)).toBe(true)
+    }
+  })
+
+  it('leaves reads, waits, navigation and unknown commands alone', () => {
+    for (const command of [
+      'getText',
+      'isDisplayed',
+      'getCurrentUrl',
+      'waitForElementVisible',
+      'url',
+      'execute',
+      'takeScreenshot',
+      'notACommand'
+    ]) {
+      expect(isInputDispatchingCommand(command)).toBe(false)
+    }
+  })
+})
+
+describe('InputDispatchGate', () => {
+  it('opens for an input command and closes on release', () => {
+    const gate = new InputDispatchGate()
+    expect(gate.isOpen()).toBe(false)
+    const close = gate.open('click')
+    expect(gate.isOpen()).toBe(true)
+    close()
+    expect(gate.isOpen()).toBe(false)
+  })
+
+  it('never opens for a command that dispatches no input', () => {
+    const gate = new InputDispatchGate()
+    const close = gate.open('getText')
+    expect(gate.isOpen()).toBe(false)
+    expect(() => close()).not.toThrow()
+  })
+
+  it('stays open until the last of several overlapping commands closes', () => {
+    const gate = new InputDispatchGate()
+    const closeClick = gate.open('click')
+    const closeKeys = gate.open('setValue')
+    closeClick()
+    expect(gate.isOpen()).toBe(true)
+    closeKeys()
+    expect(gate.isOpen()).toBe(false)
+  })
+
+  it('recovers after the bound when a command never closes its window', async () => {
+    const gate = new InputDispatchGate(20)
+    gate.open('click') // deliberately never closed
+    expect(gate.isOpen()).toBe(true)
+    await sleep(40)
+    expect(gate.isOpen()).toBe(false)
+  })
+
+  it('closing an already-expired window is harmless', async () => {
+    const gate = new InputDispatchGate(20)
+    const close = gate.open('click')
+    await sleep(40)
+    expect(gate.isOpen()).toBe(false)
+    close()
+    expect(gate.isOpen()).toBe(false)
+  })
+})
+
+describe('process-wide gate', () => {
+  it('routes begin/close through the shared instance', () => {
+    expect(isInputDispatchInFlight()).toBe(false)
+    const close = beginInputDispatch('click')
+    try {
+      expect(isInputDispatchInFlight()).toBe(true)
+    } finally {
+      close()
+    }
+    expect(isInputDispatchInFlight()).toBe(false)
+  })
+})
diff --git a/packages/core/tests/read-value-locators.test.ts b/packages/core/tests/read-value-locators.test.ts
new file mode 100644
index 00000000..dcab7f9e
--- /dev/null
+++ b/packages/core/tests/read-value-locators.test.ts
@@ -0,0 +1,130 @@
+import { describe, it, expect } from 'vitest'
+import {
+  rememberReadValue,
+  resolveAssertTargetFromArgs,
+  selectorForReadValue
+} from '../src/read-value-locators.js'
+
+describe('read-value provenance', () => {
+  it('names the element a read value came from', () => {
+    rememberReadValue('You logged into a secure area!', '#flash')
+    expect(selectorForReadValue('You logged into a secure area!')).toBe(
+      '#flash'
+    )
+  })
+
+  it('lets a driver-level read clear an element claim on the same value', () => {
+    // Regression: `h1` and the document title are both "Example Domain" in the
+    // selenium mocha example, so a page-title assertion inherited the h1's
+    // locator and the overlay boxed an element the assertion was not about. The
+    // nightwatch equivalent is `browser.title()` / `browser.getCurrentUrl()`.
+    rememberReadValue('Example Domain', 'h1')
+    rememberReadValue('Example Domain', undefined)
+    expect(selectorForReadValue('Example Domain')).toBeUndefined()
+  })
+
+  it('lets the most recent producer win', () => {
+    rememberReadValue('Submit', '#first')
+    rememberReadValue('Submit', '#second')
+    expect(selectorForReadValue('Submit')).toBe('#second')
+  })
+
+  it('lets an element read reclaim a value a page-level read released', () => {
+    rememberReadValue('The Internet', undefined)
+    rememberReadValue('The Internet', 'h1')
+    expect(selectorForReadValue('The Internet')).toBe('h1')
+  })
+
+  it('keeps values of different primitive types apart', () => {
+    rememberReadValue(1, '#number')
+    rememberReadValue('1', '#string')
+    rememberReadValue(true, '#boolean')
+    expect(selectorForReadValue(1)).toBe('#number')
+    expect(selectorForReadValue('1')).toBe('#string')
+    expect(selectorForReadValue(true)).toBe('#boolean')
+  })
+
+  it('ignores values that cannot identify an assertion subject', () => {
+    // An empty string is what every element with no text reads as; an object is
+    // matched by identity, which no assertion on a read value relies on.
+    rememberReadValue('', '#empty')
+    rememberReadValue(undefined, '#undefined')
+    rememberReadValue(null, '#null')
+    const obj = { x: 1 }
+    rememberReadValue(obj, '#object')
+    expect(selectorForReadValue('')).toBeUndefined()
+    expect(selectorForReadValue(undefined)).toBeUndefined()
+    expect(selectorForReadValue(null)).toBeUndefined()
+    expect(selectorForReadValue(obj)).toBeUndefined()
+  })
+
+  it('ignores a value too long to be an assertion subject', () => {
+    // getPageSource and takeScreenshot are captured commands too — keying the
+    // registry on their results would pin megabytes for the run.
+    const huge = 'x'.repeat(300)
+    rememberReadValue(huge, '#huge')
+    expect(selectorForReadValue(huge)).toBeUndefined()
+  })
+
+  it('evicts the least recent value once the registry is full', () => {
+    rememberReadValue('oldest-value', '#oldest')
+    for (let i = 0; i < 200; i++) {
+      rememberReadValue(`filler-${i}`, `#filler-${i}`)
+    }
+    expect(selectorForReadValue('oldest-value')).toBeUndefined()
+    expect(selectorForReadValue('filler-199')).toBe('#filler-199')
+  })
+
+  it('keeps a re-read value alive across an eviction sweep', () => {
+    // Recency is by last WRITE, so a value the test keeps reading stays in the
+    // registry however long the run is.
+    rememberReadValue('kept-value', '#kept')
+    for (let i = 0; i < 150; i++) {
+      rememberReadValue(`sweep-a-${i}`, `#sweep-a-${i}`)
+    }
+    rememberReadValue('kept-value', '#kept')
+    for (let i = 0; i < 150; i++) {
+      rememberReadValue(`sweep-b-${i}`, `#sweep-b-${i}`)
+    }
+    expect(selectorForReadValue('kept-value')).toBe('#kept')
+  })
+})
+
+describe('resolveAssertTargetFromArgs', () => {
+  it('names the element a read value came from', () => {
+    rememberReadValue('You logged into a secure area!', '#flash')
+    expect(
+      resolveAssertTargetFromArgs([
+        'You logged into a secure area!',
+        'You logged into a secure area'
+      ])
+    ).toBe('#flash')
+  })
+
+  it('takes the first arg that resolves — node:assert puts the subject first', () => {
+    rememberReadValue('actual-text', '#subject')
+    rememberReadValue('expected-text', '#other')
+    expect(resolveAssertTargetFromArgs(['actual-text', 'expected-text'])).toBe(
+      '#subject'
+    )
+  })
+
+  it('names nothing for a page-level read or a literal', () => {
+    rememberReadValue('The Internet', undefined)
+    expect(resolveAssertTargetFromArgs(['The Internet'])).toBeUndefined()
+    expect(resolveAssertTargetFromArgs([2, 2])).toBeUndefined()
+    expect(resolveAssertTargetFromArgs([])).toBeUndefined()
+  })
+
+  it('prefers the adapter handle resolver over the value registry', () => {
+    // Selenium's case: an element handle passed straight to the assert names its
+    // own locator, and that beats whatever a read of the same object said.
+    const handle = { id_: 'el-1' }
+    rememberReadValue('ignored', '#value')
+    expect(
+      resolveAssertTargetFromArgs([handle, 'ignored'], (arg) =>
+        arg === handle ? '#handle' : undefined
+      )
+    ).toBe('#handle')
+  })
+})
diff --git a/packages/core/tests/screencast-trace.test.ts b/packages/core/tests/screencast-trace.test.ts
index 79ef0adb..2830f26d 100644
--- a/packages/core/tests/screencast-trace.test.ts
+++ b/packages/core/tests/screencast-trace.test.ts
@@ -2,6 +2,7 @@ import { describe, it, expect } from 'vitest'
 import { createHash } from 'node:crypto'
 import type { ScreencastFrame } from '@wdio/devtools-shared'
 import {
+  accumulatedScreencastFrames,
   thinScreencastFrames,
   buildDenseScreencast
 } from '../src/screencast-trace.js'
@@ -135,3 +136,27 @@ describe('buildDenseScreencast', () => {
     expect(resources[0]!.data.toString()).toBe('hello')
   })
 })
+
+describe('accumulatedScreencastFrames', () => {
+  it('carries the drained sessions and the one still recording', () => {
+    // Regression: an adapter that read `recording?.frames ?? drained` dropped
+    // every frame captured before a mid-run session change.
+    const drained = [frame('a', 0), frame('b', 1)]
+    const recording = { frames: [frame('c', 2)] }
+    expect(accumulatedScreencastFrames(drained, recording)).toEqual([
+      ...drained,
+      ...recording.frames
+    ])
+  })
+
+  it('falls back to the drained frames when nothing is recording', () => {
+    const drained = [frame('a', 0)]
+    expect(accumulatedScreencastFrames(drained, undefined)).toEqual(drained)
+  })
+
+  it('returns a copy, so a caller cannot mutate the run buffer', () => {
+    const drained = [frame('a', 0)]
+    accumulatedScreencastFrames(drained, undefined).push(frame('z', 9))
+    expect(drained).toHaveLength(1)
+  })
+})
diff --git a/packages/core/tests/screencast.test.ts b/packages/core/tests/screencast.test.ts
index d1c1de47..663a7693 100644
--- a/packages/core/tests/screencast.test.ts
+++ b/packages/core/tests/screencast.test.ts
@@ -1,5 +1,9 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest'
 import { ScreencastRecorderBase } from '../src/screencast.js'
+import {
+  INPUT_DISPATCH_MAX_HOLD_MS,
+  beginInputDispatch
+} from '../src/input-dispatch.js'
 
 class TestRecorder extends ScreencastRecorderBase<{ name: string }> {
   shotsTaken = 0
@@ -84,6 +88,62 @@ describe('ScreencastRecorderBase — polling path', () => {
   })
 })
 
+describe('ScreencastRecorderBase — input-dispatch gate', () => {
+  it('drops ticks while an input command is in flight, resumes once it settles', async () => {
+    vi.useFakeTimers()
+    const r = new TestRecorder({ pollIntervalMs: 50 })
+    await r.start({ name: 'driver' })
+    const suppressed = r.bufferLength
+    const close = beginInputDispatch('click')
+    try {
+      await vi.advanceTimersByTimeAsync(150) // 3 ticks, all skipped
+      expect(r.bufferLength).toBe(suppressed)
+    } finally {
+      close()
+    }
+    await vi.advanceTimersByTimeAsync(150)
+    expect(r.bufferLength).toBeGreaterThan(suppressed)
+    await r.stop()
+    vi.useRealTimers()
+  })
+
+  it('keeps polling through a command that dispatches no input', async () => {
+    vi.useFakeTimers()
+    const r = new TestRecorder({ pollIntervalMs: 50 })
+    await r.start({ name: 'driver' })
+    const before = r.bufferLength
+    const close = beginInputDispatch('getText')
+    try {
+      await vi.advanceTimersByTimeAsync(150)
+      expect(r.bufferLength).toBeGreaterThan(before)
+    } finally {
+      close()
+    }
+    await r.stop()
+    vi.useRealTimers()
+  })
+
+  it('resumes after the bound when a command never settles', async () => {
+    vi.useFakeTimers()
+    const r = new TestRecorder({ pollIntervalMs: 50 })
+    await r.start({ name: 'driver' })
+    const stalled = r.bufferLength
+    // Stands in for a command whose completion callback never fires — a failing
+    // Nightwatch test discards the rest of its queue.
+    const close = beginInputDispatch('click')
+    try {
+      await vi.advanceTimersByTimeAsync(150)
+      expect(r.bufferLength).toBe(stalled)
+      await vi.advanceTimersByTimeAsync(INPUT_DISPATCH_MAX_HOLD_MS)
+      expect(r.bufferLength).toBeGreaterThan(stalled)
+    } finally {
+      close()
+    }
+    await r.stop()
+    vi.useRealTimers()
+  })
+})
+
 describe('ScreencastRecorderBase — frames / setStartMarker / duration', () => {
   it('setStartMarker trims preceding frames from the public getter', async () => {
     class CdpFlavor extends ScreencastRecorderBase<{ name: string }> {
diff --git a/packages/core/tests/session-capturer-base.test.ts b/packages/core/tests/session-capturer-base.test.ts
index 668b6996..5207f1a3 100644
--- a/packages/core/tests/session-capturer-base.test.ts
+++ b/packages/core/tests/session-capturer-base.test.ts
@@ -107,6 +107,69 @@ describe('processTracePayload — mutations + traceLogs', () => {
   })
 })
 
+describe('processTracePayload — DOM anchor attribution', () => {
+  const anchor = (timestamp: number, url = 'https://example.com/next') => ({
+    type: 'childList',
+    url,
+    addedNodes: [{ tag: 'html' }],
+    removedNodes: [],
+    timestamp
+  })
+  const cmd = (timestamp: number) => ({ command: 'click', args: [], timestamp })
+
+  it('pulls the anchor onto the navigation still in flight', () => {
+    // Adapter stamps commands at invocation, so the navigate's row ends before
+    // the destination document exists and would replay the page it left.
+    cap.commandsLog.push(cmd(1000))
+    cap.process({ mutations: [anchor(1250)] })
+    expect(cap.mutations[0]!.timestamp).toBe(1000)
+  })
+
+  it('leaves the anchor alone once a command has completed after it', () => {
+    // Adapter stamps commands at completion: the navigate finished after the
+    // document was born, so its row already resolves this anchor. Pulling it
+    // back would hand the new page's DOM to actions still on the old one.
+    cap.commandsLog.push(cmd(1000), cmd(1400))
+    cap.process({ mutations: [anchor(1250)] })
+    expect(cap.mutations[0]!.timestamp).toBe(1250)
+  })
+
+  it('leaves the anchor alone when every command completed after it', () => {
+    cap.commandsLog.push(cmd(1400))
+    cap.process({ mutations: [anchor(1250)] })
+    expect(cap.mutations[0]!.timestamp).toBe(1250)
+  })
+
+  it('never pulls an anchor ahead of the document it replaces', () => {
+    cap.mutations.push({
+      type: 'attributes',
+      target: '7',
+      addedNodes: [],
+      removedNodes: [],
+      timestamp: 1100
+    })
+    cap.commandsLog.push(cmd(1000))
+    cap.process({ mutations: [anchor(1250)] })
+    expect(cap.mutations[1]!.timestamp).toBe(1100)
+  })
+
+  it('leaves observed diffs untouched', () => {
+    cap.commandsLog.push(cmd(1000))
+    cap.process({
+      mutations: [
+        {
+          type: 'attributes',
+          target: '35',
+          addedNodes: [],
+          removedNodes: [],
+          timestamp: 1250
+        }
+      ]
+    })
+    expect(cap.mutations[0]!.timestamp).toBe(1250)
+  })
+})
+
 describe('captureSource', () => {
   it('caches by file path — second read is a no-op', async () => {
     const filePath = new URL(import.meta.url).pathname
diff --git a/packages/core/tests/trace-assertions.test.ts b/packages/core/tests/trace-assertions.test.ts
index d28b8d55..1f32f697 100644
--- a/packages/core/tests/trace-assertions.test.ts
+++ b/packages/core/tests/trace-assertions.test.ts
@@ -120,6 +120,150 @@ describe('buildActionEvents with assert commands', () => {
       (e): e is AfterEvent => e.type === 'after' && e.callId === callId
     )
 
+  it('marks a non-assert command whose result reports passed:false as failed', () => {
+    // Nightwatch's waitForElement* commands carry no Error, only the collapsed
+    // result, and they map to `Element` — so gating the collapsed-failure read on
+    // the assert class left the step a test most often fails on rendered green,
+    // with the timeout readable only in the result pane.
+    const commands: CommandLog[] = [
+      {
+        command: 'waitForElementVisible',
+        args: ['a*=Logout', 5000],
+        result: {
+          passed: false,
+          expected: 'visible',
+          actual: 'not found',
+          message: 'Timed out while waiting for element <a*=Logout>'
+        },
+        startTime: WALL + 10,
+        timestamp: WALL + 5010
+      }
+    ]
+    const events = buildActionEvents(commands, 'page@1', WALL)
+    const [row] = befores(events)
+    expect(row.apiName).toBe('element.waitForDisplayed')
+    expect(afterOf(events, row.callId)?.error?.message).toContain('Timed out')
+  })
+
+  it('falls back to a command-named message when the result carries none', () => {
+    const commands: CommandLog[] = [
+      {
+        command: 'waitForElementPresent',
+        args: ['#gone'],
+        result: { passed: false },
+        timestamp: WALL + 20
+      }
+    ]
+    const events = buildActionEvents(commands, 'page@1', WALL)
+    const [row] = befores(events)
+    expect(afterOf(events, row.callId)?.error?.message).toBe(
+      'waitForElementPresent failed'
+    )
+  })
+
+  it('marks a wait that resolved false as timed out', () => {
+    // Nightwatch reports waitForElement* timeouts through its own assertion
+    // channel, not the command callback — which hands back {value: null} and
+    // collapses to plain false. That boolean is the row's only evidence.
+    const commands: CommandLog[] = [
+      {
+        command: 'waitForElementVisible',
+        args: ['a*=Logout', 5000],
+        result: false,
+        startTime: WALL + 10,
+        timestamp: WALL + 5010
+      }
+    ]
+    const events = buildActionEvents(commands, 'page@1', WALL)
+    const [row] = befores(events)
+    expect(afterOf(events, row.callId)?.error?.message).toBe(
+      'waitForElementVisible timed out waiting for a*=Logout'
+    )
+  })
+
+  it('does not read false as a failure for a non-wait command', () => {
+    // `false` is a legitimate value for a boolean read.
+    const commands: CommandLog[] = [
+      {
+        command: 'isDisplayed',
+        args: ['#hidden'],
+        result: false,
+        timestamp: WALL + 40
+      }
+    ]
+    const events = buildActionEvents(commands, 'page@1', WALL)
+    const [row] = befores(events)
+    expect(afterOf(events, row.callId)?.error).toBeUndefined()
+  })
+
+  it('leaves a passing wait without an error', () => {
+    const commands: CommandLog[] = [
+      {
+        command: 'waitForElementVisible',
+        args: ['#username'],
+        result: true,
+        timestamp: WALL + 30
+      }
+    ]
+    const events = buildActionEvents(commands, 'page@1', WALL)
+    const [row] = befores(events)
+    expect(afterOf(events, row.callId)?.error).toBeUndefined()
+  })
+
+  it('orders an issued-earlier assert before a longer command sharing its start', () => {
+    // Nightwatch enqueues `browser.assert.*` synchronously and then awaits the
+    // next command, so both read the same millisecond `startTime`. The assert is
+    // appended to commandsLog in the test-end batch, i.e. AFTER the click, so
+    // without `sequence` the tie resolved in insertion order and the assert
+    // landed below the logout click it actually preceded.
+    const commands: CommandLog[] = [
+      {
+        command: 'click',
+        args: ['a*=Logout'],
+        startTime: WALL + 100,
+        timestamp: WALL + 5100,
+        sequence: 3
+      },
+      {
+        command: 'assert.urlContains',
+        args: ['/secure'],
+        result: 'passed',
+        startTime: WALL + 100,
+        timestamp: WALL + 100,
+        sequence: 1
+      },
+      {
+        command: 'assert.textContains',
+        args: ['#flash', 'You logged into a secure area'],
+        result: 'passed',
+        startTime: WALL + 100,
+        timestamp: WALL + 100,
+        sequence: 2
+      }
+    ]
+    const order = befores(buildActionEvents(commands, 'page@1', WALL)).map(
+      (b) => b.apiName
+    )
+    expect(order).toEqual([
+      'assert.urlContains',
+      'assert.textContains',
+      'element.click'
+    ])
+  })
+
+  it('falls back to insertion order when no sequence is stamped', () => {
+    const commands: CommandLog[] = [
+      { command: 'click', args: ['#a'], startTime: WALL, timestamp: WALL },
+      { command: 'click', args: ['#b'], startTime: WALL, timestamp: WALL }
+    ]
+    const order = befores(buildActionEvents(commands, 'page@1', WALL)).map(
+      (b) => b.title
+    )
+    expect(order).toEqual(order.slice().sort())
+    expect(order[0]).toContain('#a')
+    expect(order[1]).toContain('#b')
+  })
+
   it('emits an action pair with assert params, apiName and title', () => {
     const commands: CommandLog[] = [
       {
diff --git a/packages/core/tests/trace-exporter.test.ts b/packages/core/tests/trace-exporter.test.ts
index 0c4b2d1e..f91a3169 100644
--- a/packages/core/tests/trace-exporter.test.ts
+++ b/packages/core/tests/trace-exporter.test.ts
@@ -581,3 +581,48 @@ describe('exported trace stream — DOM mutations', () => {
     await fs.rm(outputDir, { recursive: true, force: true })
   })
 })
+
+// The zip carried no runner identity at all, so the player had no way to tell a
+// user which of the three frameworks' locator syntax the capture used.
+describe('exported trace stream — context-options runner', () => {
+  async function contextOptions(
+    metadata: TraceCapturer['metadata']
+  ): Promise<Record<string, unknown>> {
+    const outputDir = await fs.mkdtemp(path.join(os.tmpdir(), 'trace-runner-'))
+    const capturer: TraceCapturer = {
+      mutations: [],
+      traceLogs: [],
+      consoleLogs: [],
+      networkRequests: [],
+      commandsLog: [cmd('click')],
+      sources: new Map(),
+      metadata,
+      startWallTime: 1000
+    }
+    const dir = await writeTraceZip(capturer, {
+      outputDir,
+      sessionId: 'abc12345',
+      format: 'ndjson-directory'
+    })
+    const raw = await fs.readFile(path.join(dir, 'trace.trace'), 'utf8')
+    await fs.rm(outputDir, { recursive: true, force: true })
+    return JSON.parse(raw.trim().split('\n')[0]!) as Record<string, unknown>
+  }
+
+  it('writes the recording runner into the context-options event', async () => {
+    const ctx = await contextOptions({
+      type: TraceType.Testrunner,
+      runner: 'nightwatch-cucumber'
+    })
+
+    expect(ctx.type).toBe('context-options')
+    expect(ctx.runner).toBe('nightwatch-cucumber')
+  })
+
+  it('omits the field entirely when the capture named no runner', async () => {
+    // Byte-stable with the pre-field output, so an older reader is unaffected.
+    const ctx = await contextOptions({ type: TraceType.Testrunner })
+
+    expect('runner' in ctx).toBe(false)
+  })
+})
diff --git a/packages/core/tests/trace-finalizer.test.ts b/packages/core/tests/trace-finalizer.test.ts
index 6fe66b9d..e436f3de 100644
--- a/packages/core/tests/trace-finalizer.test.ts
+++ b/packages/core/tests/trace-finalizer.test.ts
@@ -1,7 +1,7 @@
 import fs from 'node:fs/promises'
 import os from 'node:os'
 import path from 'node:path'
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import {
   buildSpecSessionId,
   buildTestSliceFolder,
@@ -560,12 +560,6 @@ describe('finalizeTraceExport', () => {
       )
     })
   })
-
-  it('applies prepareSnapshots only to the session write', async () => {
-    const prepare = vi.fn((s: unknown[]) => s)
-    await finalizeTraceExport(baseCtx({ prepareSnapshots: prepare as never }))
-    expect(prepare).toHaveBeenCalledOnce()
-  })
 })
 
 describe('flushRangeTrace', () => {
diff --git a/packages/core/tests/trace-frame-snapshots.test.ts b/packages/core/tests/trace-frame-snapshots.test.ts
index 6d23cd05..106c3195 100644
--- a/packages/core/tests/trace-frame-snapshots.test.ts
+++ b/packages/core/tests/trace-frame-snapshots.test.ts
@@ -21,16 +21,37 @@ describe('FrameSnapshotIndex', () => {
     ])
   })
 
-  it('returns undefined for unmatched timestamps', () => {
-    const index = new FrameSnapshotIndex([snap()])
+  it('returns undefined when the index holds no captures at all', () => {
+    const index = new FrameSnapshotIndex([])
     expect(index.claimAfter(1234, 'call@2')).toBeUndefined()
     expect(index.refs()).toEqual([])
   })
 
-  it('consumes the snapshot on claim', () => {
+  it('shares one capture across actions completing at the same instant', () => {
+    // Nightwatch emits its native assertion rows in a batch whose execution
+    // windows collapse onto one instant; consuming left the rest blank.
     const index = new FrameSnapshotIndex([snap()])
-    index.claimAfter(2000, 'call@2')
-    expect(index.claimAfter(2000, 'call@3')).toBeUndefined()
+    expect(index.claimAfter(2000, 'call@2')).toBe('after@call@2')
+    expect(index.claimAfter(2000, 'call@3')).toBe('after@call@3')
+    expect(index.refs().map((r) => r.callId)).toEqual(['call@2', 'call@3'])
+    expect(index.refs()[1]!.snapshot).toEqual(snap())
+  })
+
+  it('falls back to the most recent capture before an uncaptured action', () => {
+    // An assertion reads the page rather than changing it, so it takes no
+    // capture of its own and inherits the preceding action's.
+    const index = new FrameSnapshotIndex([
+      snap(),
+      snap({ timestamp: 3000, command: 'setValue', screenshot: 'BB' })
+    ])
+    expect(index.claimAfter(3500, 'call@9')).toBe('after@call@9')
+    expect(index.refs()[0]!.snapshot.screenshot).toBe('BB')
+  })
+
+  it('still returns nothing for an action preceding every capture', () => {
+    const index = new FrameSnapshotIndex([snap()])
+    expect(index.claimAfter(1000, 'call@1')).toBeUndefined()
+    expect(index.refs()).toEqual([])
   })
 
   it('ignores snapshots without a screenshot', () => {
@@ -103,6 +124,31 @@ describe('input point synthesis (A8)', () => {
     expect(point).toEqual({ x: 30, y: 25 })
   })
 
+  it('resolves the point from the row locator when args carry none', () => {
+    // Selenium acts through a resolved element handle — the receiver, not an
+    // argument — so `args` holds no locator and `selector` is the only evidence.
+    const point = pointOf(
+      [{ command: 'click', args: [], selector: '#go', timestamp: 2000 }],
+      [snap({ elements: [{ selector: '#go', boundingBox: box }] })]
+    )
+    expect(point).toEqual({ x: 30, y: 25 })
+  })
+
+  it('prefers the row locator over a fill value sitting in args[0]', () => {
+    const point = pointOf(
+      [
+        {
+          command: 'sendKeys',
+          args: ['tomsmith'],
+          selector: '#username',
+          timestamp: 2000
+        }
+      ],
+      [snap({ elements: [{ selector: '#username', boundingBox: box }] })]
+    )
+    expect(point).toEqual({ x: 30, y: 25 })
+  })
+
   it('omits the point when the selector is absent from captured elements', () => {
     const point = pointOf(
       [{ command: 'click', args: ['#go'], timestamp: 2000, startTime: 1950 }],
diff --git a/packages/core/tests/trace-mutations.test.ts b/packages/core/tests/trace-mutations.test.ts
index 9dfd5bdd..fdbf6141 100644
--- a/packages/core/tests/trace-mutations.test.ts
+++ b/packages/core/tests/trace-mutations.test.ts
@@ -1,5 +1,8 @@
 import { describe, it, expect } from 'vitest'
-import { buildMutationsNdjson } from '@wdio/devtools-core'
+import {
+  buildMutationsNdjson,
+  reattributeDomAnchors
+} from '@wdio/devtools-core'
 import {
   isMutationsTruncationMarker,
   type TraceMutation
@@ -85,3 +88,77 @@ describe('isMutationsTruncationMarker', () => {
     expect(isMutationsTruncationMarker('x')).toBe(false)
   })
 })
+
+describe('reattributeDomAnchors', () => {
+  const anchor = (timestamp: number, url = 'https://example.com/a') =>
+    mutation({
+      type: 'childList',
+      url,
+      addedNodes: [{ tag: 'html' }],
+      timestamp
+    })
+  const at = (ts: number) => () => ts
+
+  it('pulls a drain-stamped anchor back to the command that produced it', () => {
+    const batch = [anchor(9625)]
+    reattributeDomAnchors(batch, at(8568), 8566)
+    expect(batch[0]!.timestamp).toBe(8568)
+  })
+
+  it("resolves the action from the anchor's own time, not the draining call", () => {
+    // The navigation's own drain runs against the page it is leaving, so a later
+    // command's drain collects the anchor — the resolver must key on the anchor.
+    const seen: number[] = []
+    const batch = [anchor(7860)]
+    reattributeDomAnchors(batch, (t) => {
+      seen.push(t)
+      return 7858
+    })
+    expect(seen).toEqual([7860])
+    expect(batch[0]!.timestamp).toBe(7858)
+  })
+
+  it('leaves observed diffs alone — only full-document anchors move', () => {
+    const diff = mutation({ type: 'attributes', target: '35', timestamp: 8600 })
+    reattributeDomAnchors([diff], at(100), 0)
+    expect(diff.timestamp).toBe(8600)
+  })
+
+  it('never pulls an anchor ahead of the document it replaces', () => {
+    // The prior page's field edits are already at 5131; replay would apply those
+    // stale refs to the new tree if the anchor landed before them.
+    const batch = [anchor(6509)]
+    reattributeDomAnchors(batch, at(4871), 5131)
+    expect(batch[0]!.timestamp).toBe(5131)
+  })
+
+  it('never pushes an anchor later than the page stamped it', () => {
+    const batch = [anchor(4259)]
+    reattributeDomAnchors(batch, at(99999), 0)
+    expect(batch[0]!.timestamp).toBe(4259)
+  })
+
+  it('leaves the anchor untouched when no action resolves', () => {
+    const batch = [anchor(4259)]
+    reattributeDomAnchors(batch, () => undefined, 0)
+    expect(batch[0]!.timestamp).toBe(4259)
+  })
+
+  it('keeps the batch ascending across two anchors', () => {
+    const batch = [
+      anchor(5000, 'https://example.com/one'),
+      mutation({ type: 'attributes', target: '35', timestamp: 5200 }),
+      anchor(6000, 'https://example.com/two')
+    ]
+    reattributeDomAnchors(batch, at(1000), 0)
+    expect(batch.map((m) => m.timestamp)).toEqual([1000, 5200, 5200])
+  })
+
+  it('is a no-op on a batch with no anchors', () => {
+    const batch = [
+      mutation({ type: 'characterData', target: '7', timestamp: 42 })
+    ]
+    reattributeDomAnchors(batch, at(1), 0)
+    expect(batch[0]!.timestamp).toBe(42)
+  })
+})
diff --git a/packages/core/tests/trace-snapshots.test.ts b/packages/core/tests/trace-snapshots.test.ts
new file mode 100644
index 00000000..4a95ddbe
--- /dev/null
+++ b/packages/core/tests/trace-snapshots.test.ts
@@ -0,0 +1,190 @@
+import fs from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+import { describe, it, expect } from 'vitest'
+import {
+  upsertRichestSnapshot,
+  writeTraceZip,
+  type TraceCapturer
+} from '@wdio/devtools-core'
+import { TraceType, type ActionSnapshot } from '@wdio/devtools-shared'
+
+const BLANK = 'AA'
+const REAL = 'R'.repeat(200)
+const RESULT = 'B'.repeat(400)
+
+function snap(
+  timestamp: number,
+  screenshot: string,
+  overrides: Partial<ActionSnapshot> = {}
+): ActionSnapshot {
+  return { timestamp, command: 'click', screenshot, ...overrides }
+}
+
+describe('upsertRichestSnapshot', () => {
+  it("does not let a blank __final__ clobber the last action's real frame", () => {
+    const list = [snap(50, REAL), snap(100, REAL)]
+    upsertRichestSnapshot(list, {
+      timestamp: 100,
+      command: '__final__',
+      screenshot: BLANK
+    })
+    expect(list).toHaveLength(2)
+    expect(list[1]!.screenshot).toBe(REAL)
+  })
+
+  it('upgrades the screenshot when the later capture is richer', () => {
+    const list = [snap(50, REAL), snap(100, BLANK)]
+    upsertRichestSnapshot(list, {
+      timestamp: 100,
+      command: '__final__',
+      screenshot: RESULT
+    })
+    expect(list[1]!.screenshot).toBe(RESULT)
+  })
+
+  it('keeps the first capture as the action identity', () => {
+    // The exporter's collapse keeps first-seen identity, so upsert matches it
+    // rather than letting a trailing __final__ rename the action's resource.
+    const list = [snap(100, BLANK)]
+    upsertRichestSnapshot(list, {
+      timestamp: 100,
+      command: '__final__',
+      screenshot: RESULT
+    })
+    expect(list[0]!.command).toBe('click')
+  })
+
+  it("keeps a poorer capture's elements and snapshotText", () => {
+    // The real screenshot and the real element rects can land on different
+    // captures of one action; a wholesale replace would drop the latter.
+    const list = [
+      snap(100, REAL, { elements: [{ selector: '#a' }], snapshotText: 'tree' })
+    ]
+    upsertRichestSnapshot(list, snap(100, RESULT))
+    expect(list[0]!.screenshot).toBe(RESULT)
+    expect(list[0]!.elements).toEqual([{ selector: '#a' }])
+    expect(list[0]!.snapshotText).toBe('tree')
+  })
+
+  it('fills gaps from the later capture', () => {
+    const list = [snap(100, RESULT)]
+    upsertRichestSnapshot(list, snap(100, BLANK, { snapshotText: 'tree' }))
+    expect(list[0]!.snapshotText).toBe('tree')
+  })
+
+  it('preserves array length on a timestamp collision', () => {
+    // One record per timestamp: a mid-run slice flush reads this array live, so
+    // a duplicate would reach the resource writer as a colliding name.
+    const list = [snap(100, REAL)]
+    upsertRichestSnapshot(list, snap(100, BLANK))
+    expect(list).toHaveLength(1)
+  })
+
+  it('appends when the timestamp is new', () => {
+    const list = [snap(100, REAL)]
+    upsertRichestSnapshot(list, snap(200, BLANK))
+    expect(list.map((s) => s.timestamp)).toEqual([100, 200])
+  })
+})
+
+function capturerAt(timestamps: number[]): TraceCapturer {
+  return {
+    mutations: [],
+    traceLogs: [],
+    consoleLogs: [],
+    networkRequests: [],
+    commandsLog: timestamps.map((timestamp) => ({
+      command: 'click',
+      args: [],
+      timestamp,
+      startTime: timestamp - 50
+    })),
+    sources: new Map(),
+    metadata: {
+      type: TraceType.Testrunner,
+      viewport: {
+        width: 800,
+        height: 600,
+        offsetLeft: 0,
+        offsetTop: 0,
+        scale: 1
+      }
+    },
+    startWallTime: 1000
+  }
+}
+
+async function exportWith(snapshots: ActionSnapshot[]) {
+  const outputDir = await fs.mkdtemp(path.join(os.tmpdir(), 'snap-bind-'))
+  const dir = await writeTraceZip(capturerAt([1200, 1400]), {
+    outputDir,
+    sessionId: 'sess1234',
+    format: 'ndjson-directory',
+    actionSnapshots: snapshots
+  })
+  const trace = await fs.readFile(path.join(dir, 'trace.trace'), 'utf8')
+  const events = trace
+    .split('\n')
+    .filter(Boolean)
+    .map((l) => JSON.parse(l) as Record<string, unknown>)
+  const resources = await fs.readdir(path.join(dir, 'resources'))
+  return { dir, events, resources, outputDir }
+}
+
+describe('snapshot binding contract (capture → export)', () => {
+  it('binds a snapshot stamped at the command timestamp', async () => {
+    // The triple the A11y tab and the click marker both depend on. This is why
+    // every adapter must stamp the command timestamp, not its own capture time.
+    const { events, resources, outputDir } = await exportWith([
+      snap(1400, RESULT, { snapshotText: 'tree', elements: [{ x: 1 }] })
+    ])
+
+    const after = events.find(
+      (e) => e.type === 'after' && e.afterSnapshot !== undefined
+    )
+    expect(after?.afterSnapshot).toBe('after@call@2')
+
+    const frame = events.find((e) => e.type === 'frame-snapshot')
+    expect(frame).toBeDefined()
+    expect(
+      (frame!.snapshot as Record<string, unknown> | undefined)?.wallTime
+    ).toBe(1400)
+
+    expect(resources).toContain('page@sess1234-1400-snapshot.txt')
+
+    await fs.rm(outputDir, { recursive: true, force: true })
+  })
+
+  it('binds nothing when the snapshot trails the command timestamp', async () => {
+    // The pre-fix Selenium/Nightwatch shape: the capture resolves after the
+    // command, so its own Date.now() misses every claim.
+    const { events, outputDir } = await exportWith([
+      snap(1440, RESULT, { snapshotText: 'tree' })
+    ])
+
+    expect(
+      events.some((e) => e.type === 'after' && e.afterSnapshot !== undefined)
+    ).toBe(false)
+    expect(events.some((e) => e.type === 'frame-snapshot')).toBe(false)
+
+    await fs.rm(outputDir, { recursive: true, force: true })
+  })
+
+  it("exports the last action's real result, not the blank __final__ frame", async () => {
+    const snapshots = [snap(1200, REAL), snap(1400, RESULT)]
+    upsertRichestSnapshot(snapshots, {
+      timestamp: 1400,
+      command: '__final__',
+      screenshot: BLANK
+    })
+    const { dir, outputDir } = await exportWith(snapshots)
+
+    const frame = await fs.readFile(
+      path.join(dir, 'resources', 'page@sess1234-1400.jpeg')
+    )
+    expect(frame.toString('base64')).toBe(RESULT)
+
+    await fs.rm(outputDir, { recursive: true, force: true })
+  })
+})
diff --git a/packages/core/tests/trace-transcript.test.ts b/packages/core/tests/trace-transcript.test.ts
index fbe1c6e4..8d068dcb 100644
--- a/packages/core/tests/trace-transcript.test.ts
+++ b/packages/core/tests/trace-transcript.test.ts
@@ -42,6 +42,21 @@ function unattributedLines(lines: string[]): string[] {
 }
 
 describe('generateTranscript', () => {
+  // Nightwatch enqueues an assert and issues the next command in the SAME
+  // millisecond, so start times tie and only `sequence` — the issue counter —
+  // separates them. buildActionEvents breaks the tie that way; the transcript
+  // did not, so transcript.md could order the pair opposite to the Actions tree.
+  it('breaks a start-time tie on issue order, like the action stream', () => {
+    const lines = transcript([
+      cmd('click', { startTime: 500, timestamp: 600, sequence: 9 }),
+      cmd('assert.urlContains', { startTime: 500, timestamp: 550, sequence: 4 })
+    ])
+    const assertAt = lines.findIndex((l) => l.includes('urlContains'))
+    const clickAt = lines.findIndex((l) => l.includes('click'))
+    expect(assertAt).toBeGreaterThan(-1)
+    expect(assertAt).toBeLessThan(clickAt)
+  })
+
   it('orders commands by invocation time when captured out of order (Nightwatch batches asserts to test-end)', () => {
     // Array order puts a later navigation before an earlier-timestamped click,
     // mimicking Nightwatch buffering native asserts until test-end.
diff --git a/packages/elements/README.md b/packages/elements/README.md
index fa9762f0..c2c167eb 100644
--- a/packages/elements/README.md
+++ b/packages/elements/README.md
@@ -29,10 +29,20 @@ A single call for web and mobile that returns an AI-readable accessibility/DOM s
 import { getSnapshot } from '@wdio/elements'
 
 const { text, elements } = await getSnapshot(browser, { inViewportOnly: true })
-// text: '[Page: Login — https://…]\n  button "Log in" → button*=Log in\n  …'
+// text: '[Page: Login — https://…]\n  button "Log in" → //button[contains(., "Log in")]\n  …'
 // elements: { e1: { selector, qualifiedSelector?, tagName, role, text }, … }
 ```
 
+Every locator this API returns is portable across WebdriverIO, Selenium and
+Nightwatch: CSS where an id/attribute/class identifies the element uniquely,
+XPath where its text does (WebdriverIO resolves a leading `//` as XPath;
+Selenium takes it via `By.xpath`, Nightwatch via its `'xpath'` locate strategy).
+
+The DevTools **per-action trace capture** runs the same scripts but asks for the
+locator in the recording runner's own dialect, so a WebdriverIO trace shows
+`button*=Log in` while a Selenium or Nightwatch one shows the XPath above. Only
+the text branch differs; every other branch is the same portable CSS.
+
 It auto-detects platform: web sessions walk the browser accessibility tree, mobile sessions parse the page-source XML. `@wdio/devtools-service` also registers a `browser.getSnapshot()` runtime accessor that calls this directly.
 
 This is the snapshot the DevTools **trace player** consumes: the per-action accessibility tree feeds the player's **A11y tab** (roles + accessible names, hover to highlight, click to copy a locator), and the resolved `elements` back the player's **element overlay / pick-locator** (click-to-copy boxes drawn over each interacted element, cross-linked to the A11y rows).
diff --git a/packages/elements/tests/snapshot.test.ts b/packages/elements/tests/snapshot.test.ts
index 91cc4ff2..d739c7ef 100644
--- a/packages/elements/tests/snapshot.test.ts
+++ b/packages/elements/tests/snapshot.test.ts
@@ -576,6 +576,25 @@ describe('accessibilityNodesToSnapshotNodes', () => {
     expect(result[0]!.tagName).toBe('a')
   })
 
+  it('derives tagName from the xpath the capture emits for a text match', () => {
+    const input = [
+      node({
+        role: 'link',
+        depth: 0,
+        name: 'Home',
+        selector: '//a[contains(., "Home")]'
+      }),
+      node({
+        role: 'button',
+        depth: 0,
+        name: 'Go',
+        selector: '//my-button[contains(., "Go")]'
+      })
+    ]
+    const result = accessibilityNodesToSnapshotNodes(input)
+    expect(result.map((n) => n.tagName)).toEqual(['a', 'my-button'])
+  })
+
   it('falls back to role for selectorless tag extraction', () => {
     const input = [
       node({ role: 'textbox', depth: 0, name: 'Email', selector: '#email' })
diff --git a/packages/nightwatch-devtools/package.json b/packages/nightwatch-devtools/package.json
index a69ed1af..a9a448e0 100644
--- a/packages/nightwatch-devtools/package.json
+++ b/packages/nightwatch-devtools/package.json
@@ -44,7 +44,7 @@
     "debugging",
     "testing"
   ],
-  "author": "WebdriverIO Team",
+  "author": "Vishnu Vardhan",
   "license": "MIT",
   "dependencies": {
     "@wdio/devtools-backend": "workspace:*",
diff --git a/packages/nightwatch-devtools/src/action-snapshot.ts b/packages/nightwatch-devtools/src/action-snapshot.ts
index 6d1fc8c1..5c4aa814 100644
--- a/packages/nightwatch-devtools/src/action-snapshot.ts
+++ b/packages/nightwatch-devtools/src/action-snapshot.ts
@@ -1,31 +1,30 @@
 // Nightwatch adapter: wires NightwatchBrowser into core's captureActionSnapshot.
+// Every probe goes over the raw WebDriver HTTP transport rather than `browser.*`:
+// those are QUEUED commands, so a probe issued from inside the plugin's own
+// command hook enqueues behind the command still running and can't resolve until
+// the queue drains. `browser.getCurrentUrl()`/`getTitle()` that way left every
+// snapshot with `url: undefined` (so `frameUrl` fell back to `about:blank`) and
+// hung the capture outright; the queued `execute` merely timed out, leaving an
+// empty a11y tree and no element rects.
 
 import { captureActionSnapshot as coreCapture } from '@wdio/devtools-core'
 import type { ActionSnapshot } from '@wdio/devtools-shared'
-import type { NightwatchBrowser } from './types.js'
-
-interface BrowserWithUrl extends NightwatchBrowser {
-  getCurrentUrl?: () => Promise<string>
-  getTitle?: () => Promise<string>
-}
+import { webdriverExecute, webdriverGet } from './helpers/webdriverHttp.js'
+import type { NightwatchBrowser, TestRunnerId } from './types.js'
 
 export function captureActionSnapshot(
   browser: NightwatchBrowser,
   command: string,
-  takeScreenshot?: () => Promise<string | null | undefined>
+  timestamp?: number,
+  runner?: TestRunnerId
 ): Promise<ActionSnapshot | null> {
-  const b = browser as BrowserWithUrl
   return coreCapture({
     command,
-    runScript: (src) => browser.execute(`return (${src})`) as Promise<unknown>,
-    takeScreenshot,
-    getUrl: () =>
-      b.getCurrentUrl
-        ? b.getCurrentUrl().catch(() => undefined)
-        : Promise.resolve(undefined),
-    getTitle: () =>
-      b.getTitle
-        ? b.getTitle().catch(() => undefined)
-        : Promise.resolve(undefined)
+    timestamp,
+    runner,
+    runScript: (src) => webdriverExecute(browser, `return (${src})`),
+    takeScreenshot: () => webdriverGet<string>(browser, 'screenshot'),
+    getUrl: () => webdriverGet<string>(browser, 'url'),
+    getTitle: () => webdriverGet<string>(browser, 'title')
   })
 }
diff --git a/packages/nightwatch-devtools/src/cucumber-lifecycle.ts b/packages/nightwatch-devtools/src/cucumber-lifecycle.ts
index df01f5e0..60633da2 100644
--- a/packages/nightwatch-devtools/src/cucumber-lifecycle.ts
+++ b/packages/nightwatch-devtools/src/cucumber-lifecycle.ts
@@ -267,8 +267,10 @@ export async function captureCucumberScenarioBeforeQuit(
     // Emit native asserts (assert.titleContains, …) while the session is live —
     // Nightwatch's afterEach path skips the cucumber runner, so this is the only
     // place scenario asserts get captured. drainNativeAssertCalls() is empty when
-    // captureAssertions is off. Pass/fail isn't correlated to cucumber's result
-    // shape yet, so rows may render neutral (never dropped) — tracked follow-up.
+    // captureAssertions is off. `currentTest` is undefined because a cucumber run
+    // installs Nightwatch's no-op SimplifiedReporter and never fills a results
+    // bag; each row's pass/fail comes from its own settled promise instead
+    // (`observedAssertOutcome`).
     const assertCalls = ctx.browserProxy?.drainNativeAssertCalls() ?? []
     if (assertCalls.length > 0) {
       await captureNativeAssertions(
@@ -279,7 +281,9 @@ export async function captureCucumberScenarioBeforeQuit(
         assertCalls
       )
     }
-    await ctx.sessionCapturer.captureTrace(browser)
+    // Anchored: a scenario ending on a navigation leaves the destination's
+    // async initial anchor unrun, so its DOM would be absent from the slice.
+    await ctx.sessionCapturer.captureTrace(browser, true)
     flushTestSlice(ctx)
     await ctx.emitTestArtifacts(
       scenario?.uid,
diff --git a/packages/nightwatch-devtools/src/helpers/assertCapture.ts b/packages/nightwatch-devtools/src/helpers/assertCapture.ts
index a38f025b..b54bb5c3 100644
--- a/packages/nightwatch-devtools/src/helpers/assertCapture.ts
+++ b/packages/nightwatch-devtools/src/helpers/assertCapture.ts
@@ -6,6 +6,7 @@ import logger from '@wdio/logger'
 import {
   errorMessage,
   patchNodeAssert,
+  resolveAssertTargetFromArgs,
   type CapturedAssert
 } from '@wdio/devtools-core'
 import type { SessionCapturer } from '../session.js'
@@ -22,7 +23,11 @@ export function wireAssertCapture(
 ): void {
   patchNodeAssert(
     (cmd) => captureAssert(getCapturer(), getTestUid(), cmd),
-    (level, message) => log[level](message)
+    (level, message) => log[level](message),
+    // No handle resolver: Nightwatch commands take selector strings, so an
+    // element object never reaches an assert — only the value's provenance,
+    // recorded by the command path (BrowserProxy), can name the target.
+    (args) => resolveAssertTargetFromArgs(args)
   )
 }
 
@@ -35,15 +40,14 @@ function captureAssert(
     return
   }
   capturer
-    .captureCommand(
-      cmd.command,
-      cmd.args,
-      cmd.result,
-      cmd.error,
+    .captureCommand(cmd.command, cmd.args, cmd.result, cmd.error, {
       testUid,
-      cmd.callSource,
-      cmd.timestamp
-    )
+      callSource: cmd.callSource,
+      timestamp: cmd.timestamp,
+      // The assert's args hold the compared VALUES, so provenance — recorded by
+      // the command path — is the row's only route to a locator.
+      selector: cmd.selector
+    })
     .catch((err) =>
       log.warn(`Failed to capture ${cmd.command}: ${errorMessage(err)}`)
     )
diff --git a/packages/nightwatch-devtools/src/helpers/assertTarget.ts b/packages/nightwatch-devtools/src/helpers/assertTarget.ts
new file mode 100644
index 00000000..5f819d13
--- /dev/null
+++ b/packages/nightwatch-devtools/src/helpers/assertTarget.ts
@@ -0,0 +1,177 @@
+// Which element a Nightwatch row is about — for a native `browser.assert.*` /
+// `browser.verify.*` row, and for a driver command whose result an assertion may
+// later be made on.
+//
+// Nightwatch names the target in the CALL: every element assertion in
+// `lib/api/assertions/*.js` takes the element definition as its FIRST argument
+// (`textContains(definition, expected)`), while the page-level ones take the
+// expected value there instead (`urlContains(expected)`). Element commands
+// follow the same shape (`getText(definition, callback)`), so both answers come
+// off arg 0 — under a per-kind allowlist, because the same namespaces also carry
+// calls whose arg 0 is a plain value or a url.
+//
+// node:assert is the case this can't answer: it takes VALUES and names no
+// element, so `commandTargetSelector` feeds core's value→locator registry from
+// the command path and the assert row reads its target back from there.
+//
+// Neither allowlist is derivable from shared's `ACTION_MAP`: that table says how
+// a command RENDERS (its `Element` entries include WDIO commands called on a
+// handle, with no selector argument at all), not whether arg 0 is a definition.
+
+/**
+ * Assertions whose first argument is an element definition, transcribed from
+ * Nightwatch's own assertion signatures. An allowlist, not a heuristic: the same
+ * namespace also carries the page-level assertions (`titleContains`,
+ * `urlContains`) and node:assert's value-based mirrors (`ok`, `equal`, …), whose
+ * first argument is a plain value — attaching it as a locator is how a
+ * page-title assertion ends up boxing an unrelated element.
+ */
+const ELEMENT_TARGET_ASSERTIONS: ReadonlySet<string> = new Set([
+  'attributeContains',
+  'attributeEquals',
+  'attributeMatches',
+  'containsText',
+  'cssClassNotPresent',
+  'cssClassPresent',
+  'cssProperty',
+  'domPropertyContains',
+  'domPropertyEquals',
+  'domPropertyMatches',
+  'elementNotPresent',
+  'elementPresent',
+  'elementsCount',
+  'enabled',
+  'hasAttribute',
+  'hasClass',
+  'hasDescendants',
+  'hidden',
+  'selected',
+  'textContains',
+  'textEquals',
+  'textMatches',
+  'value',
+  'valueContains',
+  'valueEquals',
+  'visible'
+])
+
+/**
+ * Commands whose RESULT is a read of the element named by their first argument,
+ * transcribed from Nightwatch's element-command signatures. An allowlist for the
+ * same reason as above: `browser.url('https://…')` takes a string first too, and
+ * reading it as a locator would attribute the page's own reads to an element.
+ * Everything absent — every driver-level read included — records its value as
+ * belonging to no element (core's `rememberReadValue` sentinel).
+ */
+const ELEMENT_READ_COMMANDS: ReadonlySet<string> = new Set([
+  'getAccessibleName',
+  'getAriaRole',
+  'getAttribute',
+  'getCssProperty',
+  'getElementProperty',
+  'getElementSize',
+  'getLocation',
+  'getLocationInView',
+  'getRect',
+  'getTagName',
+  'getText',
+  'getValue',
+  'isEnabled',
+  'isPresent',
+  'isSelected',
+  'isVisible',
+  'waitForElementNotPresent',
+  'waitForElementNotVisible',
+  'waitForElementPresent',
+  'waitForElementVisible'
+])
+
+/**
+ * Element commands that ACT on the element named by their first argument.
+ * Deliberately a second set rather than an extension of the reads above: that
+ * one also decides which results enter the value→locator registry, and a click's
+ * result is not a value any assertion can be made about. Same allowlist
+ * discipline — `browser.keys('abc')` takes a string first too.
+ */
+const ELEMENT_ACTION_COMMANDS: ReadonlySet<string> = new Set([
+  'clearValue',
+  'click',
+  'doubleClick',
+  'moveToElement',
+  'rightClick',
+  'setValue',
+  'submitForm',
+  'updateValue'
+])
+
+/** `assert.not.visible('#x')` is recorded under the dotted path `not.visible`;
+ *  negating an assertion doesn't change which argument is the element. */
+function baseMethod(method: string): string {
+  return method.startsWith('not.') ? method.slice('not.'.length) : method
+}
+
+/**
+ * The selector an element definition carries: a raw string, or the `selector`
+ * property of a `{selector, locateStrategy}` bag / a Nightwatch `Element`
+ * (duck-typed, so no dependency on Nightwatch's class identity). A definition
+ * built from an already-resolved handle carries no selector at all — such a row
+ * gets none rather than a wrong one.
+ */
+function definitionSelector(definition: unknown): string | undefined {
+  if (typeof definition === 'string') {
+    return definition || undefined
+  }
+  if (definition && typeof definition === 'object') {
+    const selector = (definition as { selector?: unknown }).selector
+    if (typeof selector === 'string' && selector) {
+      return selector
+    }
+  }
+  return undefined
+}
+
+/** Locator of the element a native assertion was about, or undefined when the
+ *  assertion targets no element (page title, url, a value comparison). Lands on
+ *  `CommandLog.selector` so the player's overlay boxes the target the way it
+ *  does for WDIO's folded matcher rows. */
+export function assertTargetSelector(
+  method: string,
+  args: unknown[]
+): string | undefined {
+  if (!ELEMENT_TARGET_ASSERTIONS.has(baseMethod(method))) {
+    return undefined
+  }
+  return definitionSelector(args[0])
+}
+
+/** Locator a driver-command row is about — the element it read or acted on.
+ *  Lands on `CommandLog.selector` so the row says what it targeted instead of
+ *  leaving the exporter to fall back to `args[0]`. Wider than
+ *  {@link commandTargetSelector}, which answers the narrower provenance question
+ *  (whose read produced this value) for the value→locator registry. */
+export function commandRowSelector(
+  method: string,
+  args: unknown[]
+): string | undefined {
+  if (
+    !ELEMENT_READ_COMMANDS.has(method) &&
+    !ELEMENT_ACTION_COMMANDS.has(method)
+  ) {
+    return undefined
+  }
+  return definitionSelector(args[0])
+}
+
+/** Locator of the element a driver command read from, or undefined when the
+ *  command reads the page rather than an element. Feeds core's value→locator
+ *  registry: `undefined` records the result as belonging to no element, which is
+ *  the sentinel a later node:assert on a page-level value relies on. */
+export function commandTargetSelector(
+  method: string,
+  args: unknown[]
+): string | undefined {
+  if (!ELEMENT_READ_COMMANDS.has(method)) {
+    return undefined
+  }
+  return definitionSelector(args[0])
+}
diff --git a/packages/nightwatch-devtools/src/helpers/browserProxy.ts b/packages/nightwatch-devtools/src/helpers/browserProxy.ts
index 1d41c4fb..60102d74 100644
--- a/packages/nightwatch-devtools/src/helpers/browserProxy.ts
+++ b/packages/nightwatch-devtools/src/helpers/browserProxy.ts
@@ -8,32 +8,32 @@ import {
   INTERNAL_COMMANDS_TO_IGNORE,
   NAVIGATION_COMMANDS
 } from '../constants.js'
+import { callbackError } from './callbackError.js'
+import { commandRowSelector, commandTargetSelector } from './assertTarget.js'
 import { getCallSourceFromStack } from './utils.js'
 import { serializeCommandResult } from './serializeCommandResult.js'
+import { NativeAssertRecorder } from './nativeAssertRecorder.js'
 import {
-  latestResolvedScreenshot,
-  pendingAssertionCommand
-} from './nativeAssertions.js'
-import { RetryTracker, toError } from '@wdio/devtools-core'
+  RetryTracker,
+  beginInputDispatch,
+  rememberReadValue,
+  toError
+} from '@wdio/devtools-core'
 import type { SessionCapturer } from '../session.js'
 import type { TestManager } from './testManager.js'
 import type {
+  CommandCaptureMeta,
+  CommandInvocation,
   CommandLog,
   NativeAssertCall,
   NightwatchBrowser,
+  NightwatchChainable,
   NightwatchCurrentTest,
   CommandStackFrame
 } from '../types.js'
 
 const log = logger('@wdio/nightwatch-devtools:browserProxy')
 
-/** Nightwatch's chainable command result — exposes `.perform` to queue work
- *  after the command completes. Cucumber async/await mode returns a Promise
- *  instead, so callers narrow on `.perform` before using it. */
-type NightwatchChainable = {
-  perform?: (cb: (done: Function) => void) => void
-}
-
 export class BrowserProxy {
   /** Tracks which browser *instances* have already been proxied to avoid double-wrapping. */
   private proxiedBrowsers = new WeakSet<object>()
@@ -48,20 +48,30 @@ export class BrowserProxy {
   private retryTracker = new RetryTracker()
 
   /**
-   * Per-test buffer of explicit `browser.assert.*` / `browser.verify.*` calls,
-   * recorded synchronously at call time by {@link wrapAssertionNamespaces}.
-   * Nightwatch exposes no per-assertion hook and its test-end results carry no
-   * source location for passing assertions, so call-time capture is the only
-   * way to get real args + callSource. Drained (and cleared) each `afterEach`.
+   * Monotonic issue-order counter. Stamped when the test ISSUES a row — a
+   * driver command at invocation, an assert at enqueue — which is source order.
+   * Both are recorded into `commandsLog` much later and out of that order (a
+   * driver command at completion, an assert in the test-end batch), so this is
+   * what lets the exporter recover the order the test wrote. Shared with the
+   * assert recorder so both row kinds draw from one sequence.
    */
-  private nativeAssertCalls: NativeAssertCall[] = []
+  private issueCounter = 0
+
+  private assertRecorder: NativeAssertRecorder
 
   constructor(
     private sessionCapturer: SessionCapturer,
     private testManager: TestManager,
     private getCurrentTest: () => { uid?: string } | null,
-    private captureAssertions = true
-  ) {}
+    private captureAssertions = true,
+    private observeSession?: (browser: NightwatchBrowser) => void
+  ) {
+    this.assertRecorder = new NativeAssertRecorder(
+      sessionCapturer,
+      getCurrentTest,
+      () => this.issueCounter++
+    )
+  }
 
   /**
    * Update the session capturer reference after a WebDriver session change.
@@ -69,110 +79,29 @@ export class BrowserProxy {
    */
   updateSessionCapturer(capturer: SessionCapturer): void {
     this.sessionCapturer = capturer
+    this.assertRecorder.updateSessionCapturer(capturer)
   }
 
+  /** Per-command-scope dedup state only. Cucumber calls this per STEP, so it
+   *  must not touch the native-assert buffer — that buffer spans the whole
+   *  scenario and is drained once, at the scenario's pre-quit hook. */
   resetCommandTracking(): void {
     this.commandStack = []
     this.lastCommandSig = null
     this.retryTracker.reset()
-    this.nativeAssertCalls = []
+  }
+
+  /** Everything scoped to one test unit: dedup state plus any native-assert
+   *  calls a previous unit left behind because its drain never ran. */
+  resetTestTracking(): void {
+    this.resetCommandTracking()
+    this.assertRecorder.clear()
   }
 
   /** Hand off this test's recorded native-assertion calls and clear the
    *  buffer so the next test starts fresh. */
   drainNativeAssertCalls(): NativeAssertCall[] {
-    const calls = this.nativeAssertCalls
-    this.nativeAssertCalls = []
-    return calls
-  }
-
-  /**
-   * Replace `browser.assert` / `browser.verify` (both are Nightwatch Proxies
-   * whose `get` returns a fresh function per access) with a recording Proxy:
-   * on each method call it captures `{prefix, method, args, callSource}` from a
-   * user-code frame, streams a neutral pending row immediately (live), then
-   * delegates to the ORIGINAL namespace method so Nightwatch's queue, chaining,
-   * and abortOnFailure semantics (assert aborts, verify does not) are
-   * byte-for-byte unchanged. Called once per browser.
-   */
-  private wrapAssertionNamespaces(browser: NightwatchBrowser): void {
-    // captureAssertions:false → leave assert/verify original so no neutral
-    // pending rows stream (the afterEach finalize path is gated to match).
-    if (!this.captureAssertions) {
-      return
-    }
-    // Cast once: the assert/verify namespaces aren't on the public type; each
-    // is a dynamic method bag reached by property name.
-    const b = browser as unknown as Record<string, unknown>
-    ;(['assert', 'verify'] as const).forEach((prefix) => {
-      const original = b[prefix]
-      if (!original || typeof original !== 'object') {
-        return
-      }
-      b[prefix] = this.recordingNamespaceProxy(original, prefix, [])
-    })
-  }
-
-  /**
-   * Recording Proxy over one assert/verify namespace. A function property
-   * becomes a call-time recorder keyed by its full dotted path
-   * (`titleContains`, `not.titleContains`); a nested namespace object recurses
-   * through the SAME wrapper — Nightwatch exposes `assert.not` as its own Proxy,
-   * so negated asserts are recorded via the identical mechanism as positive
-   * ones instead of a parallel path. The recorder buffers a pending row, then
-   * delegates to the ORIGINAL method so Nightwatch's queue, chaining, and
-   * abort/negate semantics stay byte-for-byte unchanged. Non-method,
-   * non-namespace props pass through untouched.
-   */
-  private recordingNamespaceProxy(
-    target: object,
-    prefix: 'assert' | 'verify',
-    path: readonly string[]
-  ): object {
-    return new Proxy(target, {
-      get: (t, name, receiver) => {
-        const orig = Reflect.get(t, name, receiver)
-        if (typeof name !== 'string') {
-          return orig
-        }
-        if (orig !== null && typeof orig === 'object') {
-          return this.recordingNamespaceProxy(orig, prefix, [...path, name])
-        }
-        if (typeof orig !== 'function') {
-          return orig
-        }
-        return (...args: unknown[]) => {
-          const callInfo = getCallSourceFromStack()
-          if (callInfo.filePath !== undefined) {
-            this.emitPendingAssertion({
-              prefix,
-              method: [...path, name].join('.'),
-              args,
-              callSource: callInfo.callSource,
-              timestamp: Date.now()
-            })
-          }
-          return (orig as (...a: unknown[]) => unknown)(...args)
-        }
-      }
-    })
-  }
-
-  /** Buffer an explicit assert/verify call at invocation time (prebuilding its
-   *  row with args/callSource/screenshot), but do NOT stream it yet. Nightwatch
-   *  exposes no per-assertion result hook, so streaming here would show every
-   *  assert as a neutral (green) row while the test is still Running — before
-   *  its pass/fail is known. `captureNativeAssertions` emits the rows at test-end
-   *  with real outcomes + execution timing instead. */
-  private emitPendingAssertion(call: NativeAssertCall): void {
-    const testUid = this.getCurrentTest()?.uid
-    const entry = pendingAssertionCommand(
-      call,
-      testUid,
-      latestResolvedScreenshot(this.sessionCapturer)
-    )
-    call.entry = entry
-    this.nativeAssertCalls.push(call)
+    return this.assertRecorder.drain()
   }
 
   getCurrentTestFullPath(): string | null {
@@ -211,26 +140,48 @@ export class BrowserProxy {
       const original = b[methodName].bind(browser)
 
       b[methodName] = function (...args: unknown[]) {
+        // `browser.url()` is BOTH a navigation and a getter: with no url it just
+        // reads the current one, which is how `assert.urlContains` reads it from
+        // inside Nightwatch's own queue. Treating that read as a navigation
+        // re-injected the collector and forced an anchored drain mid-test — real
+        // round trips against the page for a command that changed nothing — and
+        // logged the capture callback's whole function body as the "url".
+        if (typeof args[0] !== 'string') {
+          return original(...args)
+        }
         const result = original(...args)
 
         const injectAndCapture = () => {
           log.info(`[nav] ${methodName}(${args[0] ?? ''}) — injecting script`)
-          return sessionCapturer
-            .injectScript(browser)
-            .then(() => sessionCapturer.captureTrace(browser))
-            .catch((err: Error) =>
-              log.error(`Failed to inject script: ${(err as Error).message}`)
-            )
+          return (
+            sessionCapturer
+              .injectScript(browser)
+              // Anchored: the just-injected collector anchors the document
+              // asynchronously, so an unanchored drain beats it and this page's
+              // DOM never reaches the trace.
+              .then(() => sessionCapturer.captureTrace(browser, true))
+              .catch((err: Error) =>
+                log.error(`Failed to inject script: ${(err as Error).message}`)
+              )
+          )
         }
 
         const chainable = result as NightwatchChainable | undefined
         if (chainable && typeof chainable.perform === 'function') {
-          // Standard Nightwatch (chained API): queue inside perform so it
-          // runs after navigation completes.  Always pass `done` so the
-          // command queue is unblocked even if injection fails.
-          chainable.perform((done: Function) => {
-            injectAndCapture().finally(() => done && done())
-          })
+          // Standard Nightwatch (chained API). Hung off the command's OWN
+          // thenable, not a queued `perform()`: a queued callback is discarded
+          // when a failing test aborts the rest of the queue, so the destination
+          // of a navigation in a failing test was never instrumented at all
+          // (measured: 2 of 3 navigations skipped, and with them the first
+          // document's entire DOM). The chainable is itself thenable, and
+          // resolving it means the navigation finished — the same signal
+          // `perform` gave, minus the dependency on the queue surviving.
+          //
+          // `result` is returned unchanged so `browser.url(…).waitFor…()`
+          // chaining still works; the injection runs as a side effect.
+          void Promise.resolve(result)
+            .then(injectAndCapture)
+            .catch(() => {})
           return result
         }
         // Cucumber async/await: result is a Promise (or thenable).
@@ -302,7 +253,11 @@ export class BrowserProxy {
       wrappedMethods.push(methodName)
     })
 
-    this.wrapAssertionNamespaces(browser)
+    // captureAssertions:false → leave assert/verify original so no native
+    // assertion rows are recorded (the finalize paths are gated to match).
+    if (this.captureAssertions) {
+      this.assertRecorder.wrapNamespaces(browser)
+    }
     this.proxiedBrowsers.add(browser as object)
     log.info(`✓ Wrapped ${wrappedMethods.length} browser methods`)
   }
@@ -312,9 +267,8 @@ export class BrowserProxy {
     methodName: string,
     logArgs: unknown[],
     serializedResult: unknown,
-    effectiveUid: string,
-    callSource: string | undefined,
-    commandTimestamp: number
+    meta: CommandCaptureMeta,
+    commandError: Error | undefined
   ): void {
     // Same command fired again (internal retry) — replace the previous
     // entry so only the final result appears in the UI.
@@ -323,10 +277,8 @@ export class BrowserProxy {
       methodName,
       logArgs,
       serializedResult,
-      undefined,
-      effectiveUid,
-      callSource,
-      commandTimestamp
+      commandError,
+      meta
     )
     this.retryTracker.setLastId(entry._id ?? null)
     this.sessionCapturer.sendReplaceCommand(oldTimestamp, entry)
@@ -338,10 +290,9 @@ export class BrowserProxy {
     methodName: string,
     logArgs: unknown[],
     serializedResult: unknown,
-    effectiveUid: string,
-    callSource: string | undefined,
-    commandTimestamp: number,
-    cmdSig: string
+    meta: CommandCaptureMeta,
+    cmdSig: string,
+    commandError: Error | undefined
   ): void {
     // captureCommand() pushes the entry to commandsLog synchronously before
     // any async work (navigation perf capture), so we can grab the ID
@@ -352,15 +303,7 @@ export class BrowserProxy {
     this.retryTracker.setLastSig(cmdSig)
     this.retryTracker.setLastId(null)
     this.sessionCapturer
-      .captureCommand(
-        methodName,
-        logArgs,
-        serializedResult,
-        undefined,
-        effectiveUid,
-        callSource,
-        commandTimestamp
-      )
+      .captureCommand(methodName, logArgs, serializedResult, commandError, meta)
       .catch((err) =>
         log.error(`Failed to capture ${methodName}: ${(err as Error).message}`)
       )
@@ -377,9 +320,28 @@ export class BrowserProxy {
     this.maybeRepollMutations(browser, methodName)
   }
 
-  // After DOM-mutating commands, re-poll mutations from the injected script
-  // so the browser preview stays in sync. setTimeout runs OUTSIDE Nightwatch's
-  // current callback stack (safer queue-wise).
+  /**
+   * After a DOM-mutating command, drain the collector — TWICE, for two different
+   * reasons that no single drain can serve.
+   *
+   * The first drain fires synchronously, with no setTimeout in front. It used to
+   * defer 200ms to stay off Nightwatch's callback stack, safe only because the
+   * drain went through `browser.execute`, a QUEUED command; over the raw HTTP
+   * transport it touches no queue, and because a driver serialises requests per
+   * session, a drain issued here is served BEFORE the next queued command. That
+   * is what captures the OUTGOING page's field edits — deferred, a submit click
+   * navigated first and they died with the page, so the `#password` fill row
+   * replayed with an empty password box.
+   *
+   * The second drain is what anchors the DESTINATION, and it has to wait: a
+   * Nightwatch click resolves before its navigation commits, so the first drain
+   * still finds the outgoing page's collector, recovers nothing, and the new
+   * document is never anchored — every action on it then replayed the page it
+   * came from (measured: 5 of 20 rows). `anchorAfterNavigation` keys off the
+   * document actually being replaced rather than off which command ran, so it
+   * covers any route to a new document — a submit click, a JS redirect, a
+   * same-command re-navigation — without a list of commands to keep in sync.
+   */
   private maybeRepollMutations(
     browser: NightwatchBrowser,
     methodName: string
@@ -401,9 +363,12 @@ export class BrowserProxy {
     if (!isDomMutating) {
       return
     }
-    setTimeout(() => {
-      this.sessionCapturer.captureTrace(browser).catch(() => {})
-    }, 200)
+    this.sessionCapturer.captureTrace(browser, true).catch(() => {})
+    // Tracked so finalize awaits it — an untracked anchor drain can still be in
+    // flight when the trace is written, which loses the document entirely.
+    this.sessionCapturer.snapshotCaptures.push(
+      this.sessionCapturer.anchorAfterNavigation(browser).catch(() => {})
+    )
   }
 
   private popCommandStackIfMatches(methodName: string, cmdSig: string): void {
@@ -413,6 +378,21 @@ export class BrowserProxy {
     }
   }
 
+  /** Serialize the result and record which element produced it, so a later
+   *  node:assert on that value can name its target (core's value→locator
+   *  registry). Fed for every command, so a page-level read records "no
+   *  element" — see `rememberReadValue` for why that sentinel matters. Folded
+   *  into one call because `makeCaptureCallback` is already over the line cap. */
+  private serializeAndAttributeResult(
+    methodName: string,
+    logArgs: unknown[],
+    callbackResult: unknown
+  ): unknown {
+    const result = serializeCommandResult(callbackResult, methodName)
+    rememberReadValue(result, commandTargetSelector(methodName, logArgs))
+    return result
+  }
+
   // Result-capturing callback factory — called by Nightwatch's async queue
   // when the command completes. This is where we get the *actual* result.
   private makeCaptureCallback(
@@ -422,16 +402,26 @@ export class BrowserProxy {
     cmdSig: string,
     callSource: string | undefined,
     hasUserSource: boolean,
-    commandTimestamp: number,
+    invokedAt: number,
+    sequence: number,
     testUid: string | undefined,
     userCallback: Function | null
   ): (callbackResult: unknown) => unknown {
     return (callbackResult: unknown) => {
+      // Stamped HERE, when the command actually finished in the browser — not
+      // when the test enqueued it. Nightwatch runs commands off a queue, so
+      // invocation leads real execution by hundreds of ms, and the page-side
+      // mutation stream is on real time: a row stamped at invocation replayed
+      // the page from BEFORE its own effect (the `#username` fill rendered an
+      // empty field, the `#password` fill rendered only the username). The
+      // invocation time becomes the row's `startTime`, so the row also spans its
+      // real duration instead of a synthetic 1ms.
+      const commandTimestamp = Date.now()
       this.popCommandStackIfMatches(methodName, cmdSig)
-      const serializedResult = serializeCommandResult(
-        callbackResult,
-        methodName
-      )
+      const commandError = callbackError(callbackResult)
+      const serializedResult = commandError
+        ? undefined
+        : this.serializeAndAttributeResult(methodName, logArgs, callbackResult)
       const effectiveUid = this.getCurrentTest()?.uid ?? testUid
       // Only surface commands that originate from a user-code frame. Commands
       // Nightwatch issues from inside its own queue (e.g. the getTitle a
@@ -439,15 +429,22 @@ export class BrowserProxy {
       // user frame on the stack, so they'd otherwise leak as top-level actions
       // with an "unknown" source. Mirrors the service's user-spec-source guard.
       if (effectiveUid && hasUserSource) {
+        const meta: CommandCaptureMeta = {
+          testUid: effectiveUid,
+          callSource,
+          timestamp: commandTimestamp,
+          startTime: invokedAt,
+          sequence,
+          selector: commandRowSelector(methodName, logArgs)
+        }
         if (this.retryTracker.isRetry(cmdSig)) {
           this.handleRetryReplacement(
             browser,
             methodName,
             logArgs,
             serializedResult,
-            effectiveUid,
-            callSource,
-            commandTimestamp
+            meta,
+            commandError
           )
         } else {
           this.captureFreshCommand(
@@ -455,10 +452,9 @@ export class BrowserProxy {
             methodName,
             logArgs,
             serializedResult,
-            effectiveUid,
-            callSource,
-            commandTimestamp,
-            cmdSig
+            meta,
+            cmdSig,
+            commandError
           )
         }
       }
@@ -484,53 +480,84 @@ export class BrowserProxy {
     this.lastCommandSig = cmdSig
   }
 
-  private handleCommandExecution(
-    browser: NightwatchBrowser,
-    browserAny: Record<string, unknown>,
+  private describeInvocation(
     methodName: string,
-    originalMethod: Function,
     args: unknown[]
-  ): unknown {
-    this.testManager.startTestIfPending(
-      this.testManager.detectTestBoundary(
-        browserAny.currentTest as NightwatchCurrentTest
-      )
-    )
-
+  ): CommandInvocation {
     const callInfo = getCallSourceFromStack()
     if (callInfo.filePath && !this.currentTestFullPath) {
       this.currentTestFullPath = callInfo.filePath
     }
-
     const lastArg = args[args.length - 1]
     const hasUserCallback = typeof lastArg === 'function'
-    const userCallback: Function | null = hasUserCallback ? lastArg : null
     const logArgs = hasUserCallback ? args.slice(0, -1) : args
-
     const cmdSig = JSON.stringify({
       command: methodName,
       args: logArgs,
       src: callInfo.callSource
     })
     this.pushCommandStackIfNew(methodName, cmdSig, callInfo.callSource)
+    return {
+      userCallback: hasUserCallback
+        ? (lastArg as (result: unknown) => unknown)
+        : null,
+      logArgs,
+      cmdSig,
+      callSource: callInfo.callSource,
+      hasUserSource: callInfo.filePath !== undefined
+    }
+  }
 
-    const callSource = callInfo.callSource
-    const commandTimestamp = Date.now()
+  private handleCommandExecution(
+    browser: NightwatchBrowser,
+    browserAny: Record<string, unknown>,
+    methodName: string,
+    originalMethod: Function,
+    args: unknown[]
+  ): unknown {
+    // The command's session id is the only evidence a mid-run `browser.end()`
+    // leaves behind — Nightwatch raises no event and `end` is never wrapped.
+    this.observeSession?.(browser)
+    this.testManager.startTestIfPending(
+      this.testManager.detectTestBoundary(
+        browserAny.currentTest as NightwatchCurrentTest
+      )
+    )
+
+    const { userCallback, logArgs, cmdSig, callSource, hasUserSource } =
+      this.describeInvocation(methodName, args)
+    // Invocation time only — the row's real completion stamp is taken inside the
+    // capture callback (see makeCaptureCallback).
+    const invokedAt = Date.now()
+    const sequence = this.issueCounter++
     const captureCallback = this.makeCaptureCallback(
       browser,
       methodName,
       logArgs,
       cmdSig,
       callSource,
-      callInfo.filePath !== undefined,
-      commandTimestamp,
+      hasUserSource,
+      invokedAt,
+      sequence,
       this.getCurrentTest()?.uid,
       userCallback
     )
-    const modifiedArgs = [...logArgs, captureCallback]
+    // Suppress screencast polling while this command may be dispatching input: a
+    // screenshot landing mid-click makes the click activate nothing. Enqueue is
+    // the only hook the adapter has — Nightwatch executes off a queue it exposes
+    // no start event for — so an awaited call (enqueue ≈ execution) is covered,
+    // while one queued behind a long wait can see its window expire before it
+    // runs. The bound is what keeps that from stalling the recorder instead.
+    const closeInputWindow = beginInputDispatch(methodName)
+    const gatedCallback = (callbackResult: unknown) => {
+      closeInputWindow()
+      return captureCallback(callbackResult)
+    }
+    const modifiedArgs = [...logArgs, gatedCallback]
     try {
       return originalMethod(...modifiedArgs)
     } catch (error) {
+      closeInputWindow()
       this.popCommandStackIfMatches(methodName, cmdSig)
       this.captureCommandError(methodName, logArgs, error, callSource)
       throw error
@@ -552,14 +579,11 @@ export class BrowserProxy {
     log.error(`[command error] ${methodName}: ${normalizedError.message}`)
 
     this.sessionCapturer
-      .captureCommand(
-        methodName,
-        args,
-        undefined,
-        normalizedError,
-        currentTest.uid,
-        callSource
-      )
+      .captureCommand(methodName, args, undefined, normalizedError, {
+        testUid: currentTest.uid,
+        callSource,
+        selector: commandRowSelector(methodName, args)
+      })
       .catch((err) =>
         log.error(`Failed to capture ${methodName}: ${(err as Error).message}`)
       )
diff --git a/packages/nightwatch-devtools/src/helpers/callbackError.ts b/packages/nightwatch-devtools/src/helpers/callbackError.ts
new file mode 100644
index 00000000..36718946
--- /dev/null
+++ b/packages/nightwatch-devtools/src/helpers/callbackError.ts
@@ -0,0 +1,38 @@
+/**
+ * The failure a Nightwatch command reports by invoking its callback with an
+ * error-shaped result instead of throwing.
+ *
+ * Only a SYNCHRONOUS failure reaches the try/catch around the wrapped method; an
+ * async one (a command that times out waiting for an element) arrives here as a
+ * result object. Left in `result`, the row kept `error: undefined` and rendered
+ * as a success — the failure was readable only as raw text in the result pane,
+ * with no red row and nothing in the Errors tab.
+ *
+ * `passed` present means this is an assertion result, which carries its own
+ * pass/fail handling and must not be reinterpreted here.
+ */
+export function callbackError(result: unknown, depth = 0): Error | undefined {
+  if (result instanceof Error) {
+    return result
+  }
+  if (!result || typeof result !== 'object') {
+    return undefined
+  }
+  const r = result as Record<string, unknown>
+  // W3C driver responses nest their payload under `value` and Nightwatch passes
+  // that wrapper through untouched, so the failure sits one level down — reading
+  // only the top level found no `error` and the row stayed green. Depth-bounded:
+  // this runs inside the command hook, so a self-referencing result must not be
+  // able to overflow the stack and take the user's test down with it.
+  if ('value' in r) {
+    return depth < 2 ? callbackError(r.value, depth + 1) : undefined
+  }
+  if ('passed' in r || !r.error) {
+    return undefined
+  }
+  const err = new Error(String(r.message ?? r.error))
+  if (typeof r.stack === 'string') {
+    err.stack = r.stack
+  }
+  return err
+}
diff --git a/packages/nightwatch-devtools/src/helpers/nativeAssertRecorder.ts b/packages/nightwatch-devtools/src/helpers/nativeAssertRecorder.ts
new file mode 100644
index 00000000..55b58e95
--- /dev/null
+++ b/packages/nightwatch-devtools/src/helpers/nativeAssertRecorder.ts
@@ -0,0 +1,170 @@
+/**
+ * Call-time recorder for explicit `browser.assert.*` / `browser.verify.*`.
+ *
+ * Extracted from BrowserProxy: the recording Proxy, the per-test buffer and the
+ * settlement observation are one concern (getting a native assertion's args,
+ * source location and outcome), separate from driver-command interception.
+ * `nativeAssertions.ts` consumes the drained buffer at test-end.
+ */
+
+import {
+  observedAssertOutcome,
+  latestResolvedScreenshot,
+  pendingAssertionCommand
+} from './nativeAssertions.js'
+import { getCallSourceFromStack } from './utils.js'
+import type { SessionCapturer } from '../session.js'
+import type { NativeAssertCall, NightwatchBrowser } from '../types.js'
+
+export class NativeAssertRecorder {
+  /**
+   * Per-test-unit buffer of recorded calls. Nightwatch exposes no per-assertion
+   * hook and its test-end results carry no source location for passing
+   * assertions, so call-time capture is the only way to get real args +
+   * callSource. Drained once per test unit (`afterEach`, or the cucumber
+   * scenario's pre-quit hook) — never per step.
+   */
+  private calls: NativeAssertCall[] = []
+
+  constructor(
+    private capturer: SessionCapturer,
+    private getCurrentTest: () => { uid?: string } | null,
+    private nextSequence: () => number
+  ) {}
+
+  updateSessionCapturer(capturer: SessionCapturer): void {
+    this.capturer = capturer
+  }
+
+  clear(): void {
+    this.calls = []
+  }
+
+  /** Hand off this test's recorded calls and clear the buffer so the next test
+   *  unit starts fresh. */
+  drain(): NativeAssertCall[] {
+    const calls = this.calls
+    this.calls = []
+    return calls
+  }
+
+  /**
+   * Replace `browser.assert` / `browser.verify` (both are Nightwatch Proxies
+   * whose `get` returns a fresh function per access) with a recording Proxy:
+   * on each method call it captures `{prefix, method, args, callSource}` from a
+   * user-code frame, buffers a pending row, then delegates to the ORIGINAL
+   * namespace method so Nightwatch's queue, chaining, and abortOnFailure
+   * semantics (assert aborts, verify does not) are byte-for-byte unchanged.
+   * Called once per browser.
+   */
+  wrapNamespaces(browser: NightwatchBrowser): void {
+    // Cast once: the assert/verify namespaces aren't on the public type; each
+    // is a dynamic method bag reached by property name.
+    const b = browser as unknown as Record<string, unknown>
+    ;(['assert', 'verify'] as const).forEach((prefix) => {
+      const original = b[prefix]
+      if (!original || typeof original !== 'object') {
+        return
+      }
+      b[prefix] = this.namespaceProxy(original, prefix, [])
+    })
+  }
+
+  /**
+   * Recording Proxy over one assert/verify namespace. A function property
+   * becomes a call-time recorder keyed by its full dotted path
+   * (`titleContains`, `not.titleContains`); a nested namespace object recurses
+   * through the SAME wrapper — Nightwatch exposes `assert.not` as its own Proxy,
+   * so negated asserts are recorded via the identical mechanism as positive
+   * ones instead of a parallel path. Non-method, non-namespace props pass
+   * through untouched.
+   */
+  private namespaceProxy(
+    target: object,
+    prefix: 'assert' | 'verify',
+    path: readonly string[]
+  ): object {
+    return new Proxy(target, {
+      get: (t, name, receiver) => {
+        const orig = Reflect.get(t, name, receiver)
+        if (typeof name !== 'string') {
+          return orig
+        }
+        if (orig !== null && typeof orig === 'object') {
+          return this.namespaceProxy(orig, prefix, [...path, name])
+        }
+        if (typeof orig !== 'function') {
+          return orig
+        }
+        return (...args: unknown[]) => {
+          const callInfo = getCallSourceFromStack()
+          const call =
+            callInfo.filePath === undefined
+              ? undefined
+              : this.buffer({
+                  prefix,
+                  method: [...path, name].join('.'),
+                  args,
+                  callSource: callInfo.callSource,
+                  timestamp: Date.now()
+                })
+          const result = (orig as (...a: unknown[]) => unknown)(...args)
+          if (call) {
+            this.observe(call, result)
+          }
+          return result
+        }
+      }
+    })
+  }
+
+  /** Buffer an explicit assert/verify call at invocation time (prebuilding its
+   *  row with args/callSource/screenshot), but do NOT stream it yet. Nightwatch
+   *  exposes no per-assertion result hook, so streaming here would show every
+   *  assert as a neutral (green) row while the test is still Running — before
+   *  its pass/fail is known. `captureNativeAssertions` emits the rows at
+   *  test-end with real outcomes + execution timing instead. */
+  private buffer(call: NativeAssertCall): NativeAssertCall {
+    const entry = pendingAssertionCommand(
+      call,
+      this.getCurrentTest()?.uid,
+      latestResolvedScreenshot(this.capturer)
+    )
+    entry.sequence = this.nextSequence()
+    call.entry = entry
+    this.calls.push(call)
+    return call
+  }
+
+  /**
+   * Watch the assertion's OWN returned promise for its outcome — see
+   * `observedAssertOutcome` for the settlement semantics and why this is the
+   * cucumber runner's only pass/fail source. `result` is handed back to the
+   * caller untouched; this only adds a second handler, so Nightwatch's own
+   * chaining and rejection propagation are unchanged. A non-thenable result
+   * (Nightwatch's synchronous `api` return, when commands aren't ES6-async)
+   * leaves the call unobserved and the results-bag path supplies the outcome.
+   */
+  private observe(call: NativeAssertCall, result: unknown): void {
+    const thenable = result as { then?: unknown } | null | undefined
+    if (!thenable || typeof thenable.then !== 'function') {
+      return
+    }
+    void (result as Promise<unknown>).then(
+      (value) => {
+        call.observed = observedAssertOutcome({
+          rejected: false,
+          value,
+          settledAt: Date.now()
+        })
+      },
+      (reason) => {
+        call.observed = observedAssertOutcome({
+          rejected: true,
+          value: reason,
+          settledAt: Date.now()
+        })
+      }
+    )
+  }
+}
diff --git a/packages/nightwatch-devtools/src/helpers/nativeAssertions.ts b/packages/nightwatch-devtools/src/helpers/nativeAssertions.ts
index b86beba2..675d3d22 100644
--- a/packages/nightwatch-devtools/src/helpers/nativeAssertions.ts
+++ b/packages/nightwatch-devtools/src/helpers/nativeAssertions.ts
@@ -3,34 +3,42 @@
 // a clickable source location, and pass/fail colour.
 //
 // Nightwatch exposes no per-assertion hook. Each explicit call is intercepted
-// at CALL TIME (BrowserProxy.wrapAssertionNamespaces) and BUFFERED — concise
-// title, real args, callSource, the per-test testUid, and the preceding
-// screenshot — but NOT streamed, because streaming a neutral row mid-run would
-// render every assert green before its outcome is known. At test-end
-// `captureNativeAssertions` reads the pass/fail truth + verbose failure message
-// from the results bag and emits each row once, positioned on its real
-// execution window (the exporter re-sorts by the buffered call timestamp).
-// Correlating the recorded calls (not the raw results) also excludes
-// Nightwatch's implicit command-generated assertions (e.g.
+// at CALL TIME (NativeAssertRecorder) and BUFFERED — concise title, real args,
+// callSource, the per-test testUid, and the preceding screenshot — but NOT
+// streamed, because streaming a neutral row mid-run would render every assert
+// green before its outcome is known. At test-end `captureNativeAssertions` reads
+// the pass/fail truth + verbose failure message and emits each row once,
+// positioned on its real execution window (the exporter re-sorts by the buffered
+// call timestamp). Correlating the recorded calls (not the raw results) also
+// excludes Nightwatch's implicit command-generated assertions (e.g.
 // waitForElementVisible's "element was visible" entry).
 //
+// Two outcome sources, in this order: the per-test results bag (`correlate`),
+// then the settlement of the call's own promise (`observedAssertOutcome`). The
+// cucumber runner has no results bag at all, so the settlement is its only
+// source; the describe/it interface has a bag but no per-assertion window.
+//
 // The plugin `afterEach` fires once per describe-suite (not per `it`), so the
 // finalize reads assertions from `results.testcases` (all tests) — see
 // gatherResultAssertions.
 
 import logger from '@wdio/logger'
 import {
+  errorMessage,
   matcherAssertionToCommandLog,
   safeSerializeAssertArg,
   stripAnsi
 } from '@wdio/devtools-core'
+import { assertTargetSelector } from './assertTarget.js'
 import type { SessionCapturer } from '../session.js'
 import type {
+  AssertSettlement,
   CollapsedAssertResult,
   CommandLog,
   NativeAssertCall,
   NightwatchBrowser,
-  NightwatchCurrentTest
+  NightwatchCurrentTest,
+  ObservedAssertOutcome
 } from '../types.js'
 
 const log = logger('@wdio/nightwatch-devtools:nativeAssertions')
@@ -100,6 +108,40 @@ interface Outcome {
   message: string
 }
 
+/** Pass/fail read off the assertion's own promise — the only outcome evidence
+ *  cucumber has, since its client is built with no reporter so `results` is
+ *  never populated. A fulfilment of `undefined` stays neutral: that is an
+ *  assertion enqueued but never executed, not a pass. Semantics and measurements
+ *  in CLAUDE.md § Known debt. */
+export function observedAssertOutcome({
+  rejected,
+  value,
+  settledAt
+}: AssertSettlement): ObservedAssertOutcome | undefined {
+  if (rejected || value instanceof Error) {
+    return {
+      passed: false,
+      message: stripAnsi(errorMessage(value)).trim(),
+      settledAt
+    }
+  }
+  if (value === undefined) {
+    return undefined
+  }
+  return { passed: true, message: '', settledAt }
+}
+
+/** Execution window recovered from the observed settlement: enqueue → settle.
+ *  The cucumber runner logs no commands, so `assertCommandTimings` yields
+ *  nothing there and the row would otherwise span a synthetic 1 ms. */
+function observedTiming(
+  call: NativeAssertCall
+): { startTime: number; endTime: number } | null {
+  return call.observed
+    ? { startTime: call.timestamp, endTime: call.observed.settledAt }
+    : null
+}
+
 /**
  * All assertion entries for the suite, in declaration order. Nightwatch's
  * plugin `afterEach` fires once per describe-suite (not per `it`), so the flat
@@ -240,6 +282,12 @@ export function pendingAssertionCommand(
   if (screenshot) {
     entry.screenshot = screenshot
   }
+  // Only element assertions name a target; a title/url/value one gets none, so
+  // the overlay never boxes an element the assertion wasn't about.
+  const selector = assertTargetSelector(call.method, call.args)
+  if (selector) {
+    entry.selector = selector
+  }
   return entry
 }
 
@@ -269,8 +317,12 @@ function collapsedAssertResult(
 ): CollapsedAssertResult {
   const result: CollapsedAssertResult = {
     passed: outcome.passed,
-    expected: call.args.length <= 1 ? call.args[0] : call.args,
-    message: outcome.message
+    expected: call.args.length <= 1 ? call.args[0] : call.args
+  }
+  // Omitted rather than empty for a pass observed off the settlement: the
+  // promise carries no prose, and an empty message would render as a blank row.
+  if (outcome.message) {
+    result.message = outcome.message
   }
   const actual = outcome.passed
     ? undefined
@@ -366,13 +418,20 @@ export async function captureNativeAssertions(
     if (!call.entry) {
       return
     }
-    const outcome = outcomes[index]
+    // Results-bag correlation first (it also carries the verbose per-assertion
+    // message, which a settlement can't supply for a pass); the observed
+    // settlement is the fallback that makes cucumber rows coloured at all. The
+    // timing comes from whichever source supplied the outcome — a correlated row
+    // keeps its enqueue timestamp when the bag reports no window (the BDD
+    // interface always does), which is what `sequence` ordering relies on.
+    const correlated = outcomes[index]
+    const outcome = correlated ?? call.observed
     if (outcome) {
       finalizeAssertionRow(
         capturer,
         call,
         outcome,
-        timings[index],
+        correlated ? timings[index] : observedTiming(call),
         screenshot,
         testUid
       )
diff --git a/packages/nightwatch-devtools/src/helpers/utils.ts b/packages/nightwatch-devtools/src/helpers/utils.ts
index 0110234a..05fdb2b0 100644
--- a/packages/nightwatch-devtools/src/helpers/utils.ts
+++ b/packages/nightwatch-devtools/src/helpers/utils.ts
@@ -12,6 +12,7 @@ import type {
   NightwatchTestCase,
   TestFileMetadata,
   StepLocation,
+  TestRunnerId,
   TestStats
 } from '../types.js'
 
@@ -50,12 +51,19 @@ export function incrementCounters(
   }
 }
 
+/** This adapter's runner identity. Both Nightwatch runners take the same
+ *  locator dialect, but the id also reaches the dashboard's run capabilities,
+ *  where the cucumber variant differs. */
+export function nightwatchRunnerId(isCucumberRunner: boolean): TestRunnerId {
+  return isCucumberRunner ? 'nightwatch-cucumber' : 'nightwatch'
+}
+
 export function buildPluginMetadataOptions(input: {
   isCucumberRunner: boolean
   configPath: string | undefined
 }) {
   return {
-    framework: input.isCucumberRunner ? 'nightwatch-cucumber' : 'nightwatch',
+    framework: nightwatchRunnerId(input.isCucumberRunner),
     configFile: input.configPath,
     baseDir: process.cwd(),
     runCapabilities: {
diff --git a/packages/nightwatch-devtools/src/helpers/webdriverHttp.ts b/packages/nightwatch-devtools/src/helpers/webdriverHttp.ts
new file mode 100644
index 00000000..27d6a797
--- /dev/null
+++ b/packages/nightwatch-devtools/src/helpers/webdriverHttp.ts
@@ -0,0 +1,172 @@
+// Direct WebDriver HTTP transport for the capture probes.
+//
+// Every probe the trace capture makes — url, title, screenshot, in-page script
+// — has to bypass Nightwatch's command queue. `browser.*` commands are QUEUED,
+// so a probe the plugin issues from inside its own command hook enqueues behind
+// the command that is still running and cannot resolve until the queue drains.
+// Unguarded, one such probe stranded the whole per-action snapshot capture; the
+// in-page script probe merely timed out, leaving empty a11y trees.
+
+import http from 'node:http'
+import logger from '@wdio/logger'
+import { errorMessage } from '@wdio/devtools-core'
+import type { NightwatchBrowser } from '../types.js'
+
+const log = logger('@wdio/nightwatch-devtools:webdriverHttp')
+
+/** Ceiling on a single driver request — a driver that stops answering must not
+ *  hold a capture open longer than the adapter's settle window. */
+const REQUEST_TIMEOUT_MS = 5000
+
+type LooseRec = Record<string, unknown>
+
+const getProp = (obj: unknown, key: string): unknown =>
+  obj && typeof obj === 'object' ? (obj as LooseRec)[key] : undefined
+
+const getPath = (obj: unknown, ...path: string[]): unknown =>
+  path.reduce<unknown>((acc, k) => getProp(acc, k), obj)
+
+const firstDefined = (obj: unknown, ...keys: string[]): unknown => {
+  if (!obj || typeof obj !== 'object') {
+    return undefined
+  }
+  const rec = obj as LooseRec
+  for (const k of keys) {
+    const v = rec[k]
+    if (v !== undefined && v !== null) {
+      return v
+    }
+  }
+  return undefined
+}
+
+/**
+ * Walks Nightwatch's internal config (transport / queue.transport /
+ * nightwatchInstance — none of which are on the public NightwatchBrowser type)
+ * to find the underlying WebDriver host+port.
+ */
+export function resolveWebDriverAddress(browser: NightwatchBrowser): {
+  driverHost: string
+  driverPort: number
+} {
+  const transportSettings =
+    getPath(browser, 'transport', 'settings', 'webdriver') ||
+    getPath(browser, 'queue', 'transport', 'settings', 'webdriver') ||
+    getPath(
+      browser,
+      'nightwatchInstance',
+      'transport',
+      'settings',
+      'webdriver'
+    ) ||
+    {}
+  const opts = getProp(browser, 'options') ?? {}
+  const nightwatchSettings =
+    getPath(browser, 'nightwatchInstance', 'settings') ||
+    getPath(browser, 'globals', 'nightwatchInstance', 'settings') ||
+    {}
+  const driverHost = String(
+    firstDefined(transportSettings, 'host', 'server_address') ||
+      firstDefined(getProp(opts, 'webdriver'), 'host') ||
+      firstDefined(getProp(nightwatchSettings, 'webdriver'), 'host') ||
+      'localhost'
+  )
+  const driverPort = Number(
+    firstDefined(transportSettings, 'port') ||
+      firstDefined(getProp(opts, 'webdriver'), 'port') ||
+      firstDefined(getProp(nightwatchSettings, 'webdriver'), 'port') ||
+      9515
+  )
+  return { driverHost, driverPort }
+}
+
+function sessionEndpoint(
+  browser: NightwatchBrowser,
+  path: string
+): string | undefined {
+  const sessionId = (browser as unknown as { sessionId?: string }).sessionId
+  if (!sessionId) {
+    return undefined
+  }
+  const { driverHost, driverPort } = resolveWebDriverAddress(browser)
+  return `http://${driverHost}:${driverPort}/session/${sessionId}/${path}`
+}
+
+/** Resolves the W3C `value` field, or null on any transport/parse/timeout
+ *  failure — a probe is best-effort and never fails the user's test. */
+function request<T>(
+  endpoint: string,
+  method: 'GET' | 'POST',
+  body?: unknown
+): Promise<T | null> {
+  const payload = body === undefined ? undefined : JSON.stringify(body)
+  return new Promise((resolve) => {
+    const req = http.request(
+      endpoint,
+      {
+        method,
+        headers: payload
+          ? {
+              'content-type': 'application/json',
+              'content-length': Buffer.byteLength(payload)
+            }
+          : undefined
+      },
+      (res) => {
+        let raw = ''
+        res.on('data', (chunk: string | Buffer) => {
+          raw += chunk
+        })
+        res.on('end', () => {
+          try {
+            resolve((JSON.parse(raw).value as T) ?? null)
+          } catch {
+            log.warn(`Failed to parse response from ${endpoint}`)
+            resolve(null)
+          }
+        })
+      }
+    )
+    req.on('error', (err) => {
+      log.warn(`Request failed (${endpoint}): ${errorMessage(err)}`)
+      resolve(null)
+    })
+    req.setTimeout(REQUEST_TIMEOUT_MS, () => {
+      log.warn(`Request timed out (${endpoint})`)
+      req.destroy()
+      resolve(null)
+    })
+    if (payload) {
+      req.write(payload)
+    }
+    req.end()
+  })
+}
+
+/** GET `/session/:id/<path>`. Null when the session is gone or the call fails. */
+export function webdriverGet<T>(
+  browser: NightwatchBrowser,
+  path: string
+): Promise<T | null> {
+  const endpoint = sessionEndpoint(browser, path)
+  return endpoint ? request<T>(endpoint, 'GET') : Promise.resolve(null)
+}
+
+/** POST `/session/:id/<path>`. Null when the session is gone or the call fails. */
+export function webdriverPost<T>(
+  browser: NightwatchBrowser,
+  path: string,
+  body: unknown
+): Promise<T | null> {
+  const endpoint = sessionEndpoint(browser, path)
+  return endpoint ? request<T>(endpoint, 'POST', body) : Promise.resolve(null)
+}
+
+/** Run a script in the page, outside the command queue. `body` is a function
+ *  body, matching what `browser.execute` accepts. */
+export function webdriverExecute<T>(
+  browser: NightwatchBrowser,
+  body: string
+): Promise<T | null> {
+  return webdriverPost<T>(browser, 'execute/sync', { script: body, args: [] })
+}
diff --git a/packages/nightwatch-devtools/src/index.ts b/packages/nightwatch-devtools/src/index.ts
index ce85105a..675d54e6 100644
--- a/packages/nightwatch-devtools/src/index.ts
+++ b/packages/nightwatch-devtools/src/index.ts
@@ -23,10 +23,8 @@ import { wireAssertCapture } from './helpers/assertCapture.js'
 import { stop as stopBackend } from '@wdio/devtools-backend'
 import {
   REUSE_ENV,
-  SCREENCAST_DEFAULTS,
   type CucumberPickle,
-  type CucumberPickleStep,
-  type ScreencastFrame
+  type CucumberPickleStep
 } from '@wdio/devtools-shared'
 import logger from '@wdio/logger'
 import {
@@ -41,7 +39,10 @@ import {
 import type { PluginInternals } from './plugin-internals.js'
 import type { SessionCapturer } from './session.js'
 import type { TestReporter } from './reporter.js'
-import type { ScreencastRecorder } from './screencast.js'
+import {
+  PluginScreencast,
+  resolveScreencastOptions
+} from './plugin-screencast.js'
 import type { TestManager } from './helpers/testManager.js'
 import type { SuiteManager } from './helpers/suiteManager.js'
 import type { BrowserProxy } from './helpers/browserProxy.js'
@@ -50,7 +51,6 @@ import type {
   NightwatchBrowser,
   NightwatchCurrentTest,
   NightwatchEventHub,
-  ScreencastOptions,
   SuiteStats,
   TestStats
 } from './types.js'
@@ -71,16 +71,14 @@ import {
   wrapBrowserOnce,
   closeOutTestcases
 } from './test-lifecycle.js'
-import {
-  ensureSessionInitialized,
-  finalizeCurrentScreencast
-} from './session-init.js'
+import { ensureSessionInitialized } from './session-init.js'
 import { captureNativeAssertions } from './helpers/nativeAssertions.js'
 import { flushTestSlice, recordSpecSliceBoundary } from './trace-slices.js'
 import {
   getTestIcon,
   incrementCounters,
-  buildPluginMetadataOptions
+  buildPluginMetadataOptions,
+  nightwatchRunnerId
 } from './helpers/utils.js'
 
 const log = logger('@wdio/nightwatch-devtools')
@@ -126,14 +124,9 @@ class NightwatchDevToolsPlugin {
       : undefined
   }
 
-  #screencastOptions: ScreencastOptions
-  #screencastRecorder?: ScreencastRecorder
-  #screencastSessionId?: string
-
-  // Snapshotted before each recorder is nulled, so the export isn't blank.
-  #filmstripFrames: ScreencastFrame[] = []
+  #screencast: PluginScreencast
   #bidiEnabled = false
-  #bidiAttachAttempted = false
+  #armedSessionId: string | undefined
 
   /** Wall-clock ms at the current test/scenario start — the lower bound of that
    *  test's action-snapshot and video-frame window (per-test artifact slicing). */
@@ -145,34 +138,34 @@ class NightwatchDevToolsPlugin {
 
   constructor(options: DevToolsOptions = {}) {
     const mode = options.mode ?? 'live'
-    // Filmstrip OR a produce-only per-test video drives the recorder in trace
-    // mode; bare screencast (with neither on) stays a live-only feature.
-    const wantRecorder =
-      mode === 'trace' &&
-      (options.filmstrip === true ||
-        (options.video !== undefined && options.video !== 'off'))
-    const ignore =
-      mode === 'trace' && !wantRecorder && options.screencast?.enabled === true
-    if (ignore) {
-      log.warn('trace mode: ignoring screencast option (live-mode feature)')
-    }
-    let screencast = ignore ? {} : (options.screencast ?? {})
-    if (wantRecorder) {
-      screencast = { ...(options.screencast ?? {}), enabled: true }
+    // Resolve the defaults ONCE and gate on the resolved values: reading the raw
+    // `options.filmstrip === true` left the default-on filmstrip inert unless a
+    // config set it explicitly, so the recorder never started while
+    // `this.options.filmstrip` claimed it was on.
+    const filmstrip = options.filmstrip ?? true
+    const video = options.video ?? 'off'
+    const screencast = resolveScreencastOptions({
+      mode,
+      filmstrip,
+      video,
+      screencast: options.screencast
+    })
+    if (screencast.warning) {
+      log.warn(screencast.warning)
     }
     this.options = {
       port: options.port ?? 3000,
       hostname: options.hostname ?? 'localhost',
-      screencast,
+      screencast: screencast.options,
       bidi: options.bidi ?? false,
       captureAssertions: options.captureAssertions ?? true,
       mode,
       traceFormat: options.traceFormat ?? 'zip',
       traceGranularity: options.traceGranularity ?? 'session',
       tracePolicy: options.tracePolicy ?? 'on',
-      filmstrip: options.filmstrip ?? true,
+      filmstrip,
       screenshot: options.screenshot ?? 'off',
-      video: options.video ?? 'off',
+      video,
       // No live Allure signal in Nightwatch (produce-only), so no auto-detect:
       // off by default, opt-in via the option.
       emitArtifactsManifest: options.emitArtifactsManifest ?? false
@@ -181,7 +174,10 @@ class NightwatchDevToolsPlugin {
     if (policyWarning) {
       log.warn(policyWarning)
     }
-    this.#screencastOptions = { ...SCREENCAST_DEFAULTS, ...screencast }
+    this.#screencast = new PluginScreencast(
+      screencast.options,
+      filmstrip || video !== 'off'
+    )
     this.#bidiEnabled = options.bidi === true
   }
 
@@ -210,7 +206,7 @@ class NightwatchDevToolsPlugin {
         return self.options.mode
       },
       get screencastOptions() {
-        return self.#screencastOptions
+        return self.#screencast.options
       },
       get bidiEnabled() {
         return self.#bidiEnabled
@@ -290,11 +286,11 @@ class NightwatchDevToolsPlugin {
       set lastSessionId(v) {
         self.#lastSessionId = v
       },
-      get bidiAttachAttempted() {
-        return self.#bidiAttachAttempted
+      get armedSessionId() {
+        return self.#armedSessionId
       },
-      set bidiAttachAttempted(v) {
-        self.#bidiAttachAttempted = v
+      set armedSessionId(v) {
+        self.#armedSessionId = v
       },
       get srcFolders() {
         return self.#srcFolders
@@ -303,20 +299,29 @@ class NightwatchDevToolsPlugin {
         self.#srcFolders = v
       },
       get screencastRecorder() {
-        return self.#screencastRecorder
+        return self.#screencast.recorder
       },
       set screencastRecorder(v) {
-        self.#screencastRecorder = v
+        self.#screencast.recorder = v
       },
       get screencastSessionId() {
-        return self.#screencastSessionId
+        return self.#screencast.sessionId
       },
       set screencastSessionId(v) {
-        self.#screencastSessionId = v
+        self.#screencast.sessionId = v
+      },
+      get screencastRotation() {
+        return self.#screencast.rotation
+      },
+      set screencastRotation(v) {
+        self.#screencast.rotation = v
       },
       get configPath() {
         return self.#configPath
       },
+      get runner() {
+        return nightwatchRunnerId(self.#isCucumberRunner)
+      },
       getCurrentTest: () => self.#currentTest,
       getCurrentScenarioSuite: () => self.#currentScenarioSuite,
       getCurrentStep: () => self.#currentStep,
@@ -341,6 +346,7 @@ class NightwatchDevToolsPlugin {
       attemptFor: (uid) => self.#attemptTracker.attemptFor(uid),
       buildMetadataOptions: () => self.#buildMetadataOptions(),
       ensureSessionInitialized: (b) => self.#ensureSessionInitialized(b),
+      finalizeCurrentScreencast: () => self.#finalizeCurrentScreencast(),
       wrapBrowserOnce: (b) => self.#wrapBrowserOnce(b),
       incrementCount: (s) => self.#incrementCount(s),
       testIcon: (s) => self.#testIcon(s),
@@ -397,21 +403,11 @@ class NightwatchDevToolsPlugin {
   }
 
   async #ensureSessionInitialized(browser: NightwatchBrowser) {
-    await ensureSessionInitialized(this.#getInternals(), browser, () =>
-      this.#finalizeCurrentScreencast()
-    )
+    await ensureSessionInitialized(this.#getInternals(), browser)
   }
 
   async #finalizeCurrentScreencast(): Promise<void> {
-    // Preserve pre-reload frames for the trace filmstrip AND the produce-only
-    // per-test video — either can drive the recorder in trace mode now.
-    if (
-      (this.options.filmstrip || this.options.video !== 'off') &&
-      this.#screencastRecorder
-    ) {
-      this.#filmstripFrames.push(...this.#screencastRecorder.frames)
-    }
-    await finalizeCurrentScreencast(this.#getInternals())
+    await this.#screencast.finalize(this.#getInternals())
   }
 
   async cucumberBefore(browser: NightwatchBrowser, pickle: CucumberPickle) {
@@ -570,7 +566,9 @@ class NightwatchDevToolsPlugin {
             this.browserProxy.drainNativeAssertCalls()
           )
         }
-        await this.sessionCapturer.captureTrace(browser)
+        // Anchored: a test ending on a navigation leaves the destination's
+        // async initial anchor unrun, so its DOM would be absent from the slice.
+        await this.sessionCapturer.captureTrace(browser, true)
         // Flush this test's slice before the next test overwrites its outcome.
         flushTestSlice(this.#getInternals())
         const results = (browser.currentTest as NightwatchCurrentTest)?.results
@@ -611,20 +609,23 @@ class NightwatchDevToolsPlugin {
       videoPolicy: this.options.video,
       failed,
       actionSnapshots: this.sessionCapturer.actionSnapshots,
-      frames: this.#screencastRecorder?.frames ?? this.#filmstripFrames,
+      frames: this.#screencast.frames,
       startWallTime: this.#currentTestStartWallTime,
       outcomes: uid ? this.#attemptTracker.forTest(uid, attempt) : [],
       uid,
       attempt,
       sessionId: this.sessionCapturer?.metadata?.sessionId,
       outputDir: this.#outputDir,
-      captureFormat: this.#screencastOptions.captureFormat,
+      captureFormat: this.#screencast.options.captureFormat,
       onArtifact: (a) => this.#artifacts.push(a),
       onLog: (level, msg) => log[level](msg)
     })
   }
 
   async after(browser?: NightwatchBrowser) {
+    // Drain first: a rotation still in flight would otherwise start its new
+    // recorder after this finalize and strand the poll interval.
+    await this.#screencast.rotation
     await this.#finalizeCurrentScreencast()
     try {
       await this.#finalizeAllSuites(browser)
@@ -690,15 +691,8 @@ class NightwatchDevToolsPlugin {
         artifacts: this.#artifacts,
         traceFlushes: this.#traceFlushes,
         emitArtifactsManifest: this.options.emitArtifactsManifest,
-        // Accumulated (finalized-session) frames plus the live recorder's — a
-        // mid-run per-spec/per-test flush fires before the recorder is drained
-        // into #filmstripFrames, so its frames live only on the recorder still;
-        // at the final write the recorder is already nulled, so no double-count.
         screencastFrames: this.options.filmstrip
-          ? [
-              ...this.#filmstripFrames,
-              ...(this.#screencastRecorder?.frames ?? [])
-            ]
+          ? this.#screencast.frames
           : undefined,
         configPath: this.#configPath,
         testFilePath:
diff --git a/packages/nightwatch-devtools/src/plugin-internals.ts b/packages/nightwatch-devtools/src/plugin-internals.ts
index 1d239fb4..af3dc7b9 100644
--- a/packages/nightwatch-devtools/src/plugin-internals.ts
+++ b/packages/nightwatch-devtools/src/plugin-internals.ts
@@ -19,6 +19,7 @@ import type {
   NightwatchBrowser,
   ScreencastOptions,
   SuiteStats,
+  TestRunnerId,
   TestStats,
   TraceGranularity
 } from './types.js'
@@ -32,6 +33,9 @@ export interface PluginInternals {
   readonly screencastOptions: ScreencastOptions
   readonly bidiEnabled: boolean
   readonly captureAssertions: boolean
+  /** Derived from the cucumber flag, so one value answers both the metadata
+   *  payload and the capture's locator dialect. */
+  readonly runner: TestRunnerId
 
   // Runtime instances (mutable — bringup/session-change replaces them)
   sessionCapturer: SessionCapturer
@@ -50,10 +54,13 @@ export interface PluginInternals {
 
   // Session state
   lastSessionId: string | null
-  bidiAttachAttempted: boolean
+  /** Session the BiDi attach + collector preload were last armed for; a command
+   *  seen under any other session is a mid-run `browser.end()`. */
+  armedSessionId: string | undefined
   srcFolders: string[]
   screencastRecorder: ScreencastRecorder | undefined
   screencastSessionId: string | undefined
+  screencastRotation: Promise<void> | undefined
 
   /** Absolute path to the resolved Nightwatch config file, if known. Used as
    *  a fallback directory for screencast video output. */
@@ -71,6 +78,7 @@ export interface PluginInternals {
   clearExecutionData(): void
   buildMetadataOptions(): unknown
   ensureSessionInitialized(b: NightwatchBrowser): Promise<void>
+  finalizeCurrentScreencast(): Promise<void>
   wrapBrowserOnce(b: NightwatchBrowser): void
   incrementCount(state: TestStats['state']): void
   testIcon(state: TestStats['state']): string
diff --git a/packages/nightwatch-devtools/src/plugin-screencast.ts b/packages/nightwatch-devtools/src/plugin-screencast.ts
new file mode 100644
index 00000000..03726644
--- /dev/null
+++ b/packages/nightwatch-devtools/src/plugin-screencast.ts
@@ -0,0 +1,105 @@
+/**
+ * The plugin's screencast seam: what a run's mode and filmstrip/video options
+ * imply for the recorder, plus the per-run frame buffer the trace filmstrip and
+ * the per-test video slices are cut from.
+ *
+ * The recorder itself is `screencast.ts`, and binding it to a session — or
+ * rotating it when the session is replaced — is `screencast-session.ts`. This is
+ * the plugin-level state those two hang off, split out of `index.ts` so the
+ * plugin keeps only its accessor bag and thin delegators.
+ */
+
+import { accumulatedScreencastFrames } from '@wdio/devtools-core'
+import { SCREENCAST_DEFAULTS } from '@wdio/devtools-shared'
+import { finalizeCurrentScreencast } from './session-init.js'
+import type { SessionInitCtx } from './session-init.js'
+import type { ScreencastRecorder } from './screencast.js'
+import type {
+  DevToolsMode,
+  ScreencastFrame,
+  ScreencastOptions,
+  TraceVideoPolicy
+} from './types.js'
+
+/** The already-defaulted options the recorder decision is made from — read the
+ *  resolved `filmstrip`/`video`, never the raw `options.filmstrip`, or a
+ *  default-on filmstrip leaves the recorder inert while the plugin's own options
+ *  claim it is running. */
+export interface ScreencastResolutionInput {
+  mode: DevToolsMode
+  filmstrip: boolean
+  video: TraceVideoPolicy
+  screencast: ScreencastOptions | undefined
+}
+
+export interface ResolvedScreencast {
+  /** What the plugin exposes as `options.screencast`. */
+  options: ScreencastOptions
+  /** Config warning to log, when the mode makes the option meaningless. */
+  warning?: string
+}
+
+/**
+ * Whether this run records a screencast, and under which options. Filmstrip OR a
+ * produce-only per-test video drives the recorder in trace mode; bare screencast
+ * with neither is a live-mode feature and is dropped there.
+ */
+export function resolveScreencastOptions(
+  input: ScreencastResolutionInput
+): ResolvedScreencast {
+  const screencast = input.screencast ?? {}
+  if (input.mode !== 'trace') {
+    return { options: screencast }
+  }
+  if (input.filmstrip || input.video !== 'off') {
+    return { options: { ...screencast, enabled: true } }
+  }
+  if (screencast.enabled === true) {
+    return {
+      options: {},
+      warning: 'trace mode: ignoring screencast option (live-mode feature)'
+    }
+  }
+  return { options: screencast }
+}
+
+/**
+ * One run's screencast state: the live recorder and the session it is bound to,
+ * an in-flight rotation, and the frames drained from recorders already finalized.
+ */
+export class PluginScreencast {
+  /** Recorder options with the shared defaults applied. */
+  readonly options: ScreencastOptions
+  recorder?: ScreencastRecorder
+  sessionId?: string
+  /** In-flight recorder rotation — see `screencast-session.ts`. */
+  rotation?: Promise<void>
+
+  // Snapshotted before each recorder is nulled, so the export isn't blank.
+  #accumulated: ScreencastFrame[] = []
+  readonly #keepFrames: boolean
+
+  /** `keepFrames` when the trace filmstrip or a per-test video will consume
+   *  them; without either, a finalized recorder's frames are of no further use. */
+  constructor(options: ScreencastOptions, keepFrames: boolean) {
+    this.options = { ...SCREENCAST_DEFAULTS, ...options }
+    this.#keepFrames = keepFrames
+  }
+
+  /** Every frame this run has produced — the finalized recorders' plus the live
+   *  one's, so a mid-run slice flush (which fires before the recorder is
+   *  drained) isn't blank. */
+  get frames(): ScreencastFrame[] {
+    return accumulatedScreencastFrames(this.#accumulated, this.recorder)
+  }
+
+  /** Drain the live recorder into the run buffer, then stop and clear it. The
+   *  drain has to precede the stop: `finalizeCurrentScreencast` nulls the
+   *  recorder, and with it the only reference to its frames. */
+  async finalize(ctx: SessionInitCtx): Promise<void> {
+    if (this.#keepFrames && this.recorder) {
+      this.#accumulated.push(...this.recorder.frames)
+    }
+    await finalizeCurrentScreencast(ctx)
+  }
+}
diff --git a/packages/nightwatch-devtools/src/screencast-session.ts b/packages/nightwatch-devtools/src/screencast-session.ts
new file mode 100644
index 00000000..b6b06386
--- /dev/null
+++ b/packages/nightwatch-devtools/src/screencast-session.ts
@@ -0,0 +1,97 @@
+/**
+ * Binds the screencast recorder to a browser session, and rebinds it — and
+ * nothing else — when that session is replaced mid-run.
+ *
+ * Nightwatch raises no session event, and `end` sits in
+ * INTERNAL_COMMANDS_TO_IGNORE, so the command proxy never sees the call that
+ * destroys the session. The BDD `describe/it` interface compounds it: the
+ * plugin's `beforeEach` fires once per MODULE, so `ensureSessionInitialized` —
+ * the only place that detects a session change — is never re-entered for a
+ * `browser.end()` between `it`s. A command executing under a different
+ * `sessionId` is the sole evidence the session was replaced.
+ *
+ * Rotation is deliberately narrower than `handleSessionChange`: that path also
+ * rebuilds the SessionCapturer, which in trace mode would discard every command,
+ * console line, network entry and mutation the run has accumulated. It leaves
+ * `lastSessionId` alone for the same reason — that field is
+ * `ensureSessionInitialized`'s own bookkeeping. The other half of a session
+ * rebind, re-arming BiDi and the collector preload, hangs off the same detection
+ * in `session-init.ts` `rearmCaptureForSession`.
+ */
+
+import logger from '@wdio/logger'
+import { errorMessage } from '@wdio/devtools-core'
+import { ScreencastRecorder } from './screencast.js'
+import type { SessionInitCtx } from './session-init.js'
+import type { NightwatchBrowser } from './types.js'
+
+const log = logger('@wdio/nightwatch-devtools:screencast-session')
+
+/**
+ * Start a fresh recorder for `sessionId` — every session gets its own, matching
+ * the WDIO service. Polling mode only (Nightwatch exposes no stable CDP escape
+ * hatch). Idempotent, so bringup and rotation share one path.
+ */
+export async function startScreencast(
+  ctx: SessionInitCtx,
+  browser: NightwatchBrowser,
+  sessionId: string | undefined
+): Promise<void> {
+  if (!ctx.screencastOptions.enabled || ctx.screencastRecorder || !sessionId) {
+    return
+  }
+  ctx.screencastRecorder = new ScreencastRecorder(
+    ctx.sessionCapturer,
+    ctx.screencastOptions
+  )
+  ctx.screencastSessionId = sessionId
+  log.info(`🎬 Starting screencast for session ${sessionId}`)
+  await ctx.screencastRecorder.start(browser)
+}
+
+/**
+ * Whether the recorder is bound to a session the browser has already left.
+ * Requires BOTH a live recorder and a live session id: starting one from
+ * nothing would strand a poll interval past the plugin's own teardown, which
+ * finalizes the recorder before its last browser calls.
+ */
+export function needsScreencastRotation(
+  ctx: Pick<SessionInitCtx, 'screencastRecorder' | 'screencastSessionId'>,
+  sessionId: string | undefined
+): boolean {
+  return (
+    ctx.screencastRecorder !== undefined &&
+    sessionId !== undefined &&
+    ctx.screencastSessionId !== sessionId
+  )
+}
+
+/**
+ * Observe one command. Rotation is fire-and-forget — a command must not wait on
+ * a video encode — and parked on `ctx.screencastRotation`, which both latches
+ * out the flood of commands arriving before it completes and gives teardown
+ * something to await, so a rotation cannot start a recorder after the plugin
+ * has already finalized.
+ */
+export function rotateScreencastForSession(
+  ctx: SessionInitCtx,
+  browser: NightwatchBrowser
+): void {
+  if (ctx.screencastRotation || !ctx.screencastOptions.enabled) {
+    return
+  }
+  const sessionId = browser.sessionId ?? undefined
+  if (!needsScreencastRotation(ctx, sessionId)) {
+    return
+  }
+  log.info(`🎬 Session replaced — rotating screencast to ${sessionId}`)
+  ctx.screencastRotation = ctx
+    .finalizeCurrentScreencast()
+    .then(() => startScreencast(ctx, browser, sessionId))
+    .catch((err) =>
+      log.warn(`Screencast rotation failed: ${errorMessage(err)}`)
+    )
+    .finally(() => {
+      ctx.screencastRotation = undefined
+    })
+}
diff --git a/packages/nightwatch-devtools/src/session-init.ts b/packages/nightwatch-devtools/src/session-init.ts
index 9e5138cd..9edb234b 100644
--- a/packages/nightwatch-devtools/src/session-init.ts
+++ b/packages/nightwatch-devtools/src/session-init.ts
@@ -8,12 +8,17 @@
  * Includes:
  *   - Per-session bringup (capturer + reporter chain + metadata + BiDi + screencast)
  *   - Session-change cleanup
+ *   - Re-arming the per-session capture channels when a session is replaced
  *   - Screencast finalize-and-clear
+ *
+ * The recorder's own session binding lives in `screencast-session.ts`.
  */
 
 import logger from '@wdio/logger'
 import {
+  errorMessage,
   finalizeScreencast,
+  registerCollectorPreload,
   resolveAdapterOutputDir
 } from '@wdio/devtools-core'
 import { TraceType } from './types.js'
@@ -23,12 +28,17 @@ import { TestReporter } from './reporter.js'
 import { TestManager } from './helpers/testManager.js'
 import { SuiteManager } from './helpers/suiteManager.js'
 import { BrowserProxy } from './helpers/browserProxy.js'
-import { ScreencastRecorder } from './screencast.js'
+import type { ScreencastRecorder } from './screencast.js'
+import {
+  rotateScreencastForSession,
+  startScreencast
+} from './screencast-session.js'
 import type {
   DevToolsMode,
   NightwatchBrowser,
   ScreencastOptions,
   SuiteStats,
+  TestRunnerId,
   TestStats
 } from './types.js'
 
@@ -41,6 +51,7 @@ export interface SessionInitCtx {
   readonly bidiEnabled: boolean
   readonly mode: DevToolsMode
   readonly captureAssertions: boolean
+  readonly runner: TestRunnerId
 
   sessionCapturer: SessionCapturer
   testReporter: TestReporter
@@ -50,10 +61,14 @@ export interface SessionInitCtx {
   isScriptInjected: boolean
 
   lastSessionId: string | null
-  bidiAttachAttempted: boolean
+  /** Session the BiDi attach + collector preload were last armed for — the
+   *  once-per-session guard for both, and the rotation detector. */
+  armedSessionId: string | undefined
   srcFolders: string[]
   screencastRecorder: ScreencastRecorder | undefined
   screencastSessionId: string | undefined
+  /** In-flight recorder rotation — see screencast-session.ts. */
+  screencastRotation: Promise<void> | undefined
   configPath: string | undefined
 
   getCurrentTest(): unknown
@@ -61,22 +76,17 @@ export interface SessionInitCtx {
   buildMetadataOptions(): unknown
   attemptFor(uid: string): number | undefined
   recordOutcome(uid: string, state: TestStats['state']): void
+  /** Drains the live recorder's frames into the run's filmstrip buffer, then
+   *  stops and clears it. */
+  finalizeCurrentScreencast(): Promise<void>
 }
 
-async function handleSessionChange(
-  ctx: SessionInitCtx,
-  finalizeCurrent: () => Promise<void>
-): Promise<void> {
+async function handleSessionChange(ctx: SessionInitCtx): Promise<void> {
   log.info('Browser session changed — reconnecting WebSocket only')
   ctx.isScriptInjected = false
-  // Reset BiDi-attach state so the new session gets its own attach —
-  // inspectors are bound to a specific driver instance and don't carry
-  // across sessions. Without this, only the first session captures via
-  // BiDi and the rest silently fall back to the perf-log path.
-  ctx.bidiAttachAttempted = false
   // Finalize the previous session's screencast BEFORE we tear down its
   // capturer — encode + broadcast use the existing WS connection.
-  await finalizeCurrent()
+  await ctx.finalizeCurrentScreencast()
   ctx.sessionCapturer?.cleanup()
   // Intentional null-out — the next call to ensureSessionInitialized
   // reassigns. Cast through unknown so the strict field type passes.
@@ -104,7 +114,15 @@ function initReporterChain(ctx: SessionInitCtx): void {
     ctx.sessionCapturer,
     ctx.testManager,
     () => ctx.getCurrentTest() ?? ctx.getCurrentScenarioSuite(),
-    ctx.captureAssertions
+    ctx.captureAssertions,
+    // Nightwatch raises no session event and never wraps `end`, so a command
+    // running under a new sessionId is the only trace a mid-run
+    // `browser.end()` leaves behind. Both re-bindings hang off it; each latches
+    // and gates itself, so neither can suppress the other.
+    (browser) => {
+      rotateScreencastForSession(ctx, browser)
+      rearmCaptureForSession(ctx, browser)
+    }
   )
 }
 
@@ -144,6 +162,7 @@ function broadcastSessionMetadata(
     testEnv: opts.testEnv,
     host: opts.webdriver?.host,
     options: ctx.buildMetadataOptions(),
+    runner: ctx.runner,
     url: ''
   }
   ctx.sessionCapturer.metadata = metadata
@@ -172,16 +191,16 @@ function broadcastSessionMetadata(
 }
 
 // BiDi: opt-in. Requires `webSocketUrl: true` capability + a BiDi-capable
-// chromedriver. We attempt once per session; on failure or unavailability
-// the perf-log fallback path continues to work.
+// chromedriver. Attempted once per session (the caller's `armedSessionId` stamp
+// is that guard); on failure or unavailability the perf-log fallback path
+// continues to work.
 async function tryAttachBidi(
   ctx: SessionInitCtx,
   browser: NightwatchBrowser
 ): Promise<void> {
-  if (!ctx.bidiEnabled || ctx.bidiAttachAttempted) {
+  if (!ctx.bidiEnabled) {
     return
   }
-  ctx.bidiAttachAttempted = true
   const driver = (browser as { driver?: unknown }).driver
   if (!driver) {
     log.warn('bidi:true set but browser.driver unavailable — skipping')
@@ -198,32 +217,112 @@ async function tryAttachBidi(
   }
 }
 
-// Screencast: start a fresh recorder per browser session — every
-// reloadSession / per-test browser produces its own .webm, matching
-// the WDIO service behavior. Polling mode only (Nightwatch has no
-// stable CDP escape hatch). Finalized when the next session change
-// fires or when after() runs.
-async function tryStartScreencast(
+/**
+ * Register the collector to run at document-start, so every document — including
+ * the ones a navigation creates without us noticing — instruments and anchors
+ * itself.
+ *
+ * Deliberately NOT gated on the `bidi` option: that option exists to avoid
+ * double-reporting console/network against the perf-log path, whereas this needs
+ * nothing but a session created with `webSocketUrl: true`. Gating DOM capture on
+ * an unrelated opt-in that defaults to false would leave the race in place for
+ * almost every user. Self-degrades to the per-document `<script>` injection when
+ * BiDi isn't there.
+ */
+async function tryRegisterPreload(
   ctx: SessionInitCtx,
-  browser: NightwatchBrowser,
-  sessionId: string | undefined
+  browser: NightwatchBrowser
 ): Promise<void> {
-  if (!ctx.screencastOptions.enabled || ctx.screencastRecorder || !sessionId) {
+  const driver = (browser as { driver?: unknown }).driver
+  if (!driver) {
     return
   }
-  ctx.screencastRecorder = new ScreencastRecorder(
-    ctx.sessionCapturer,
-    ctx.screencastOptions
+  ctx.sessionCapturer.preloadRegistered = await registerCollectorPreload(
+    driver,
+    (level, message) => log[level](message)
+  )
+}
+
+/**
+ * Arm the two capture channels that belong to ONE WebDriver session: the BiDi
+ * inspectors (bound to that session's driver object) and the document-start
+ * collector preload (registered on that session's BiDi channel). Neither
+ * survives the session, so a replaced session needs both again.
+ *
+ * The stamp is written before any await: on rotation this runs from the command
+ * hook, where the next command arrives long before a BiDi round trip completes,
+ * and the stamp is what keeps that flood from re-arming.
+ *
+ * The preload goes FIRST. Behind the attach it lost the race it exists to win —
+ * measured on a re-arm, the network subscribe took 6.2 s while the command that
+ * triggered the re-arm navigated, so the registration landed two seconds after
+ * the document it was meant to instrument was born. Sequential rather than
+ * parallel because both steps open the session's BiDi channel through the same
+ * unsynchronized `getBidi()` cache, and racing them opens two websockets of
+ * which `quit()` closes one.
+ */
+async function armCaptureForSession(
+  ctx: SessionInitCtx,
+  browser: NightwatchBrowser
+): Promise<void> {
+  ctx.armedSessionId = browser.sessionId ?? undefined
+  await tryRegisterPreload(ctx, browser)
+  await tryAttachBidi(ctx, browser)
+}
+
+/**
+ * Whether the browser is executing under a session the capture channels were
+ * never armed for. Requires an already-armed session: before bringup there is no
+ * capturer to arm onto, and `ensureSessionInitialized` owns that first arm.
+ */
+export function needsCaptureRearm(
+  ctx: Pick<SessionInitCtx, 'armedSessionId' | 'sessionCapturer'>,
+  sessionId: string | undefined
+): boolean {
+  return (
+    Boolean(ctx.sessionCapturer) &&
+    sessionId !== undefined &&
+    ctx.armedSessionId !== undefined &&
+    ctx.armedSessionId !== sessionId
+  )
+}
+
+/**
+ * Re-arm BiDi and the collector preload after a mid-run `browser.end()` replaced
+ * the session. Without it both are established exactly once, at bringup, and
+ * sessions 2..N silently fall back to `<script>` injection — the whole
+ * navigation race class the preload exists to remove comes back for the rest of
+ * the run.
+ *
+ * Deliberately narrower than `handleSessionChange`, which also rebuilds the
+ * SessionCapturer and would discard every command, console line, network entry
+ * and mutation the run has accumulated. Fire-and-forget, because a command must
+ * not wait on a BiDi handshake.
+ */
+export function rearmCaptureForSession(
+  ctx: SessionInitCtx,
+  browser: NightwatchBrowser
+): void {
+  const sessionId = browser.sessionId ?? undefined
+  if (!needsCaptureRearm(ctx, sessionId)) {
+    return
+  }
+  // Both claims belong to the session that just died. Until the new
+  // registration lands this session's documents are back on the `<script>`
+  // path — exactly what `anchorAfterNavigation` polls for — and a stale
+  // `bidiActive` would keep the perf-log network path gated off behind
+  // inspectors that no longer receive anything.
+  ctx.sessionCapturer.preloadRegistered = false
+  ctx.sessionCapturer.bidiActive = false
+  log.info(`Session replaced — re-arming capture for ${sessionId}`)
+  void armCaptureForSession(ctx, browser).catch((err) =>
+    log.warn(`Capture re-arm failed: ${errorMessage(err)}`)
   )
-  ctx.screencastSessionId = sessionId
-  log.info(`🎬 Starting screencast for session ${sessionId}`)
-  await ctx.screencastRecorder.start(browser)
 }
 
 export async function ensureSessionInitialized(
   ctx: SessionInitCtx,
-  browser: NightwatchBrowser,
-  finalizeCurrentScreencast: () => Promise<void>
+  browser: NightwatchBrowser
 ): Promise<void> {
   const currentSessionId = browser.sessionId
   const isSessionChange =
@@ -231,7 +330,7 @@ export async function ensureSessionInitialized(
     ctx.lastSessionId &&
     currentSessionId !== ctx.lastSessionId
   if (isSessionChange) {
-    await handleSessionChange(ctx, finalizeCurrentScreencast)
+    await handleSessionChange(ctx)
   }
   ctx.lastSessionId = currentSessionId ?? null
   if (ctx.sessionCapturer) {
@@ -255,6 +354,7 @@ export async function ensureSessionInitialized(
     browser
   )
   ctx.sessionCapturer.traceMode = ctx.mode
+  ctx.sessionCapturer.runner = ctx.runner
   if (ctx.mode !== 'trace') {
     const connected = await ctx.sessionCapturer.waitForConnection(3000)
     if (!connected) {
@@ -267,8 +367,8 @@ export async function ensureSessionInitialized(
     rebindReporterToNewSession(ctx)
   }
   broadcastSessionMetadata(ctx, browser)
-  await tryAttachBidi(ctx, browser)
-  await tryStartScreencast(ctx, browser, browser.sessionId)
+  await armCaptureForSession(ctx, browser)
+  await startScreencast(ctx, browser, browser.sessionId)
 }
 
 export async function finalizeCurrentScreencast(
diff --git a/packages/nightwatch-devtools/src/session.ts b/packages/nightwatch-devtools/src/session.ts
index 18c05153..60e24232 100644
--- a/packages/nightwatch-devtools/src/session.ts
+++ b/packages/nightwatch-devtools/src/session.ts
@@ -1,16 +1,22 @@
-import http from 'node:http'
 import logger from '@wdio/logger'
 import {
+  CAPTURE_PERFORMANCE_SCRIPT,
+  COLLECTOR_READY_EXPRESSION,
   SessionCapturerBase,
+  applyPerformanceData,
+  collectorDrainExpression,
   drainCollectorWithRecovery,
   errorMessage,
   loadInjectableScript,
   mapChromeBrowserLogs,
+  mapCommandToAction,
   pollUntilReady,
-  serializeError
+  serializeError,
+  upsertRichestSnapshot,
+  type CapturedPerformancePayload
 } from '@wdio/devtools-core'
-import { mapCommandToAction } from '@wdio/devtools-core'
 import { captureActionSnapshot } from './action-snapshot.js'
+import { nightwatchRunnerId } from './helpers/utils.js'
 import { NAVIGATION_COMMANDS } from './constants.js'
 import {
   parseNetworkFromPerfLogs,
@@ -18,16 +24,14 @@ import {
   type NetworkEntry,
   type PerfLogEntry
 } from './helpers/perfLogs.js'
-import {
-  CAPTURE_PERFORMANCE_SCRIPT,
-  type CapturedPerformancePayload,
-  applyPerformanceData
-} from '@wdio/devtools-core'
+import { webdriverExecute, webdriverGet } from './helpers/webdriverHttp.js'
 import type {
   ActionSnapshot,
+  CommandCaptureMeta,
   CommandLog,
   DevToolsMode,
-  NightwatchBrowser
+  NightwatchBrowser,
+  TestRunnerId
 } from './types.js'
 
 const log = logger('@wdio/nightwatch-devtools:SessionCapturer')
@@ -44,66 +48,6 @@ function unwrapDriverValue<T = unknown>(result: unknown): T {
   return result as T
 }
 
-type LooseRec = Record<string, unknown>
-const getProp = (obj: unknown, key: string): unknown =>
-  obj && typeof obj === 'object' ? (obj as LooseRec)[key] : undefined
-const getPath = (obj: unknown, ...path: string[]): unknown =>
-  path.reduce<unknown>((acc, k) => getProp(acc, k), obj)
-const firstDefined = (obj: unknown, ...keys: string[]): unknown => {
-  if (!obj || typeof obj !== 'object') {
-    return undefined
-  }
-  const rec = obj as LooseRec
-  for (const k of keys) {
-    const v = rec[k]
-    if (v !== undefined && v !== null) {
-      return v
-    }
-  }
-  return undefined
-}
-
-/**
- * Walks Nightwatch's internal config (transport / queue.transport /
- * nightwatchInstance — none of which are on the public NightwatchBrowser
- * type) to find the underlying WebDriver host+port for direct screenshot
- * fetches that bypass the command queue.
- */
-function resolveWebDriverAddress(browser: NightwatchBrowser): {
-  driverHost: string
-  driverPort: number
-} {
-  const transportSettings =
-    getPath(browser, 'transport', 'settings', 'webdriver') ||
-    getPath(browser, 'queue', 'transport', 'settings', 'webdriver') ||
-    getPath(
-      browser,
-      'nightwatchInstance',
-      'transport',
-      'settings',
-      'webdriver'
-    ) ||
-    {}
-  const opts = getProp(browser, 'options') ?? {}
-  const nightwatchSettings =
-    getPath(browser, 'nightwatchInstance', 'settings') ||
-    getPath(browser, 'globals', 'nightwatchInstance', 'settings') ||
-    {}
-  const driverHost = String(
-    firstDefined(transportSettings, 'host', 'server_address') ||
-      firstDefined(getProp(opts, 'webdriver'), 'host') ||
-      firstDefined(getProp(nightwatchSettings, 'webdriver'), 'host') ||
-      'localhost'
-  )
-  const driverPort = Number(
-    firstDefined(transportSettings, 'port') ||
-      firstDefined(getProp(opts, 'webdriver'), 'port') ||
-      firstDefined(getProp(nightwatchSettings, 'webdriver'), 'port') ||
-      9515
-  )
-  return { driverHost, driverPort }
-}
-
 export class SessionCapturer extends SessionCapturerBase {
   #browser: NightwatchBrowser | undefined
 
@@ -111,8 +55,18 @@ export class SessionCapturer extends SessionCapturerBase {
   // capture path skips when set, so we don't double-emit network requests.
   bidiActive = false
 
+  /** True once the collector is registered to run at document-start. Every
+   *  document then instruments and anchors itself, so the paths that exist to
+   *  notice a navigation after the fact — re-injection and the settle poll — have
+   *  nothing left to do and stand down. */
+  preloadRegistered = false
+
   // Populated by captureCommand when mode === 'trace' (set by the plugin).
   traceMode: DevToolsMode = 'live'
+
+  /** Which Nightwatch runner is driving — set by the plugin, and passed to the
+   *  per-action capture so the injected scripts emit this runner's dialect. */
+  runner: TestRunnerId = nightwatchRunnerId(false)
   readonly actionSnapshots: ActionSnapshot[] = []
   readonly snapshotCaptures: Promise<void>[] = []
 
@@ -147,9 +101,7 @@ export class SessionCapturer extends SessionCapturerBase {
     args: unknown[],
     result: unknown,
     error: Error | undefined,
-    testUid?: string,
-    callSource?: string,
-    timestamp?: number
+    meta: CommandCaptureMeta = {}
   ): Promise<boolean> {
     // Serialize error properly (Error objects don't JSON.stringify well)
     const serializedError = serializeError(error)
@@ -161,9 +113,12 @@ export class SessionCapturer extends SessionCapturerBase {
       args,
       result,
       error: serializedError,
-      timestamp: timestamp || Date.now(),
-      callSource,
-      testUid
+      timestamp: meta.timestamp || Date.now(),
+      startTime: meta.startTime,
+      sequence: meta.sequence,
+      callSource: meta.callSource,
+      testUid: meta.testUid,
+      selector: meta.selector
     }
 
     this.commandsLog.push(commandLogEntry)
@@ -177,27 +132,39 @@ export class SessionCapturer extends SessionCapturerBase {
       })
     }
 
-    if (
-      this.traceMode === 'trace' &&
-      !error &&
-      this.#browser &&
-      mapCommandToAction(command)
-    ) {
-      const browser = this.#browser
-      this.snapshotCaptures.push(
-        captureActionSnapshot(browser, command, () =>
-          this.takeScreenshotViaHttp(browser)
-        ).then((snap) => {
-          if (snap) {
-            this.actionSnapshots.push(snap)
-          }
-        })
-      )
+    if (!error) {
+      this.#queueActionSnapshot(command, commandLogEntry.timestamp)
     }
 
     return true
   }
 
+  /** Fire-and-forget post-action snapshot, drained at finalize. Stamped with the
+   *  logged command's timestamp, not the capture's own: the capture resolves
+   *  after the command completes, and export claims snapshots by exact equality
+   *  with the command timestamp (FrameSnapshotIndex.claimAfter / elementsAt). */
+  #queueActionSnapshot(command: string, timestamp: number): void {
+    if (
+      this.traceMode !== 'trace' ||
+      !this.#browser ||
+      !mapCommandToAction(command)
+    ) {
+      return
+    }
+    this.snapshotCaptures.push(
+      captureActionSnapshot(
+        this.#browser,
+        command,
+        timestamp,
+        this.runner
+      ).then((snap) => {
+        if (snap) {
+          upsertRichestSnapshot(this.actionSnapshots, snap)
+        }
+      })
+    )
+  }
+
   async #capturePerformanceData(
     commandLogEntry: CommandLog & { _id?: number },
     args: unknown[]
@@ -229,23 +196,14 @@ export class SessionCapturer extends SessionCapturerBase {
     withId._id = this.commandCounter++
     withId.id = withId._id
     this.commandsLog.push(withId)
-    if (
-      this.traceMode === 'trace' &&
-      !entry.error &&
-      this.#browser &&
-      mapCommandToAction(entry.command)
-    ) {
-      const browser = this.#browser
-      this.snapshotCaptures.push(
-        captureActionSnapshot(browser, entry.command, () =>
-          this.takeScreenshotViaHttp(browser)
-        ).then((snap) => {
-          if (snap) {
-            this.actionSnapshots.push(snap)
-          }
-        })
-      )
-    }
+    // Deliberately no snapshot capture. These rows are emitted in a batch at
+    // test-end but positioned back on their real execution window, so capturing
+    // here would probe the page as it is NOW and stamp it at a moment seconds
+    // earlier — an assert that ran on /secure rendered the /login page it later
+    // logged out to. An assertion reads the page rather than changing it, so the
+    // exporter lets it inherit the preceding action's capture instead
+    // (FrameSnapshotIndex.claimAfter). The row's own `screenshot` is already
+    // attached by the caller from the last resolved capture.
     this.sendCommand(withId)
   }
 
@@ -262,9 +220,7 @@ export class SessionCapturer extends SessionCapturerBase {
     args: unknown[],
     result: unknown,
     error: Error | undefined,
-    testUid?: string,
-    callSource?: string,
-    timestamp?: number
+    meta: CommandCaptureMeta = {}
   ): { entry: CommandLog & { _id?: number }; oldTimestamp: number } {
     // Remove the superseded entry and capture its timestamp for the UI
     const idx = this.commandsLog.findIndex(
@@ -286,67 +242,77 @@ export class SessionCapturer extends SessionCapturerBase {
       args,
       result,
       error: serializedError,
-      timestamp: timestamp || Date.now(),
-      callSource,
-      testUid
+      timestamp: meta.timestamp || Date.now(),
+      startTime: meta.startTime,
+      sequence: meta.sequence,
+      callSource: meta.callSource,
+      testUid: meta.testUid,
+      selector: meta.selector
     }
     this.commandsLog.push(entry)
     return { entry, oldTimestamp }
   }
 
   /**
-   * Take a screenshot by calling the WebDriver HTTP endpoint directly.
-   * This completely bypasses Nightwatch's command queue so there is no risk
-   * of the request being appended after `end()` / `quit()`.
+   * Wait for a navigation to actually replace the document, then drain with a
+   * forced anchor so the destination's DOM enters the stream.
+   *
+   * A Nightwatch click resolves BEFORE its navigation commits, so the drain that
+   * runs at command completion still finds the outgoing page's collector: it
+   * recovers nothing, and the destination is never anchored — every action on the
+   * new page then replays the page it came from. Waiting for the collector to
+   * disappear is the signal that the document was replaced; a command that
+   * navigated nowhere polls out and costs one drain of an empty buffer.
    */
-  // Nightwatch's internal config lives at non-public paths (transport,
-  // queue.transport, nightwatchInstance.settings, globals.nightwatchInstance);
-  // none are in the NightwatchBrowser type. Cast for dynamic access.
-  #resolveDriverEndpoint(
-    browser: NightwatchBrowser,
-    sessionId: string
-  ): string {
-    const { driverHost, driverPort } = resolveWebDriverAddress(browser)
-    return `http://${driverHost}:${driverPort}/session/${sessionId}/screenshot`
+  async anchorAfterNavigation(browser: NightwatchBrowser): Promise<void> {
+    const replaced = await pollUntilReady(
+      async () =>
+        (await webdriverExecute<boolean>(
+          browser,
+          `return ${COLLECTOR_READY_EXPRESSION};`
+        )) !== true,
+      // With the preload active every document instruments itself at
+      // document-start, so there is normally nothing to catch — but ONE probe
+      // still runs rather than standing down entirely, because a document created
+      // before the registration landed has no collector and nothing else would
+      // ever notice. Without the preload this is the only detector, so it keeps
+      // the full settle poll.
+      this.preloadRegistered
+        ? { attempts: 1, intervalMs: 0 }
+        : { attempts: 5, intervalMs: 150 }
+    )
+    if (!replaced) {
+      return
+    }
+    // captureTrace's own recovery injects into the fresh document and re-drains,
+    // and it gates that on the url being worth instrumenting — so a torn-down
+    // session falls out here rather than logging an injection failure.
+    //
+    // The attribution is the newest command at THIS moment, not the one whose
+    // completion started the poll: several polls overlap, so a field edit's poll
+    // routinely observes the navigation the following click caused and would
+    // credit itself — which pulled the anchor back before the edit's own row and
+    // moved the wrong-DOM row one earlier instead of fixing it. Read at detection
+    // time it is right for whichever poll gets there first.
+    //
+    // Unlike the inference in `anchorOwnerTimestamp`, this does not need the
+    // "nothing completed after the anchor" guard: we just watched the document be
+    // replaced, so a navigation demonstrably happened and the newest command is
+    // the one that caused it. The guard exists for the case where that is a guess.
+    await this.captureTrace(
+      browser,
+      true,
+      this.commandsLog[this.commandsLog.length - 1]?.timestamp
+    )
   }
 
+  /**
+   * Take a screenshot by calling the WebDriver HTTP endpoint directly, bypassing
+   * Nightwatch's command queue so the request can't be appended after
+   * `end()` / `quit()`.
+   */
   takeScreenshotViaHttp(browser: NightwatchBrowser): Promise<string | null> {
-    const sessionId = (browser as unknown as { sessionId?: string }).sessionId
-    if (!sessionId) {
-      return Promise.resolve(null)
-    }
-    const endpoint = this.#resolveDriverEndpoint(browser, sessionId)
-    return new Promise((resolve) => {
-      const req = http.get(endpoint, (res) => {
-        let body = ''
-        res.on('data', (chunk: string | Buffer) => {
-          body += chunk
-        })
-        res.on('end', () => {
-          try {
-            const value = JSON.parse(body).value || null
-            if (!value) {
-              log.warn(`[screenshot] Empty response from ${endpoint}`)
-            }
-            resolve(value)
-          } catch {
-            log.warn(`[screenshot] Failed to parse response from ${endpoint}`)
-            resolve(null)
-          }
-        })
-      })
-      req.on('error', (err) => {
-        log.warn(
-          `[screenshot] HTTP request failed (${endpoint}): ${errorMessage(err)}`
-        )
-        resolve(null)
-      })
-      req.setTimeout(5000, () => {
-        log.warn(`[screenshot] Request timed out (${endpoint})`)
-        req.destroy()
-        resolve(null)
-      })
-    })
+    return webdriverGet<string>(browser, 'screenshot')
   }
 
   protected override onSourceReadError(filePath: string, err: unknown): void {
@@ -372,21 +338,36 @@ export class SessionCapturer extends SessionCapturerBase {
    */
   async injectScript(browser: NightwatchBrowser) {
     try {
+      // Injecting over a live collector replaces `window.wdioTraceCollector`
+      // with a fresh instance and DISCARDS whatever it had buffered — including
+      // the destination's full-DOM anchor. Several paths can reach the same
+      // document (navigation proxy, drain recovery), so guard here once.
+      const alreadyPresent = await webdriverExecute<boolean>(
+        browser,
+        `return ${COLLECTOR_READY_EXPRESSION};`
+      )
+      if (alreadyPresent === true) {
+        return
+      }
       const scriptContent = await loadInjectableScript()
+      // Inlined as a literal rather than passed via `arguments[0]`: the raw
+      // /execute/sync transport takes its args separately and this keeps the
+      // injection a single self-contained body.
       const injectionScript = `
         const script = document.createElement('script');
-        script.textContent = arguments[0];
+        script.textContent = ${JSON.stringify(scriptContent)};
         document.head.appendChild(script);
         return true;
       `
-      await browser.execute(injectionScript, [scriptContent])
-
-      const hasCollector = await pollUntilReady(async () => {
-        const checkResult = await browser.execute(
-          'return typeof window.wdioTraceCollector !== "undefined"'
-        )
-        return unwrapDriverValue<unknown>(checkResult) === true
-      })
+      await webdriverExecute(browser, injectionScript)
+
+      const hasCollector = await pollUntilReady(
+        async () =>
+          (await webdriverExecute<boolean>(
+            browser,
+            `return ${COLLECTOR_READY_EXPRESSION};`
+          )) === true
+      )
 
       if (hasCollector) {
         log.info('✓ Script injected and collector ready')
@@ -475,7 +456,16 @@ export class SessionCapturer extends SessionCapturerBase {
   /**
    * Capture trace data from the browser (network requests, console logs, etc.)
    */
-  async captureTrace(browser: NightwatchBrowser) {
+  /** `forceAnchor` forces a full-DOM anchor of the current document before
+   *  draining, so a freshly injected collector's async anchor isn't lost.
+   *  `anchorTimestamp` is the command this drain's anchors were CAUSED by — pass
+   *  it only when the caller observed the document being replaced right after
+   *  that command, since it overrides the inference at ingest. */
+  async captureTrace(
+    browser: NightwatchBrowser,
+    forceAnchor = false,
+    anchorTimestamp?: number
+  ) {
     // Capture network requests from Chrome performance logs
     await this.captureNetworkFromPerformanceLogs(browser)
 
@@ -485,19 +475,15 @@ export class SessionCapturer extends SessionCapturerBase {
     // (the collector can disappear between the two round-trips).
     try {
       const traceData = await drainCollectorWithRecovery({
-        drain: async () => {
-          const result = await browser.execute(`
-            if (typeof window.wdioTraceCollector === 'undefined') {
-              return null;
-            }
-            return window.wdioTraceCollector.getTraceData();
-          `)
-          return unwrapDriverValue<Record<string, unknown> | null>(result)
-        },
+        drain: () =>
+          webdriverExecute<Record<string, unknown> | null>(
+            browser,
+            collectorDrainExpression(forceAnchor)
+          ),
         injectIntoCurrentDocument: () => this.injectScript(browser),
-        currentUrl: async () =>
-          unwrapDriverValue<string | undefined>(
-            await browser.execute('return location.href;')
+        currentUrl: () =>
+          webdriverExecute<string>(browser, 'return location.href;').then(
+            (u) => u ?? undefined
           ),
         log: (level, message) => log[level](message)
       })
@@ -506,7 +492,7 @@ export class SessionCapturer extends SessionCapturerBase {
         return
       }
 
-      this.processTracePayload(traceData)
+      this.processTracePayload(traceData, { anchorTimestamp })
       const mutationCount = Array.isArray(
         (traceData as { mutations?: unknown }).mutations
       )
diff --git a/packages/nightwatch-devtools/src/test-lifecycle.ts b/packages/nightwatch-devtools/src/test-lifecycle.ts
index e8e0c60d..ac11645c 100644
--- a/packages/nightwatch-devtools/src/test-lifecycle.ts
+++ b/packages/nightwatch-devtools/src/test-lifecycle.ts
@@ -176,7 +176,7 @@ export function wrapBrowserOnce(
     ctx.browserProxy.wrapUrlMethod(browser)
     ctx.isScriptInjected = true
   }
-  ctx.browserProxy.resetCommandTracking()
+  ctx.browserProxy.resetTestTracking()
   ctx.browserProxy.wrapBrowserCommands(browser)
 }
 
diff --git a/packages/nightwatch-devtools/src/types.ts b/packages/nightwatch-devtools/src/types.ts
index 89b2a9f1..00b12725 100644
--- a/packages/nightwatch-devtools/src/types.ts
+++ b/packages/nightwatch-devtools/src/types.ts
@@ -15,6 +15,7 @@ export {
   type ScreencastFrame,
   type ScreencastOptions,
   type SuiteStats,
+  type TestRunnerId,
   type TestStats,
   type TestStatus,
   type TraceFormat,
@@ -39,9 +40,64 @@ export interface CommandStackFrame {
   signature: string
 }
 
+/** Nightwatch's chainable command result — exposes `.perform` to queue work
+ *  after the command completes. Cucumber async/await mode returns a Promise
+ *  instead, so callers narrow on `.perform` before using it. */
+export interface NightwatchChainable {
+  perform?: (cb: (done: Function) => void) => void
+}
+
+/** One intercepted command call, split into the parts capture needs. */
+export interface CommandInvocation {
+  /** Nightwatch passes results to a trailing callback; a user-supplied one must
+   *  still run after capture. */
+  userCallback: ((result: unknown) => unknown) | null
+  logArgs: unknown[]
+  /** Identifies a retry of the same call from the same source line. */
+  cmdSig: string
+  callSource: string | undefined
+  /** False for commands Nightwatch issues from inside its own queue, which have
+   *  no user frame on the stack and must not surface as top-level actions. */
+  hasUserSource: boolean
+}
+
+/** Everything a captured row carries beyond the call itself. Named rather than
+ *  positional so a field the command doesn't name — the target selector, which
+ *  a node:assert row can only learn from value provenance — reaches the row
+ *  through the capture call instead of being stamped on afterwards. */
+export interface CommandCaptureMeta {
+  testUid?: string
+  callSource?: string
+  /** Wall-clock at completion; defaults to capture time. */
+  timestamp?: number
+  /** Wall-clock at invocation, so the row spans its real duration. */
+  startTime?: number
+  /** Issue order — what the exporter sorts on when timestamps tie. */
+  sequence?: number
+  /** Element the row is about, when one is known. */
+  selector?: string
+}
+
+/** How a native assertion's own returned promise settled. */
+export interface AssertSettlement {
+  rejected: boolean
+  /** The fulfilment value, or the rejection reason when `rejected`. */
+  value: unknown
+  settledAt: number
+}
+
+/** Pass/fail read off a native assertion's own returned promise — the only
+ *  outcome source for the cucumber runner, whose results bag stays empty. */
+export interface ObservedAssertOutcome {
+  passed: boolean
+  message: string
+  /** Wall-clock at settlement — the assertion's real execution end. */
+  settledAt: number
+}
+
 /** One explicit `browser.assert.*` / `browser.verify.*` call, recorded at call
- *  time by BrowserProxy. A neutral "pending" row (`entry`) is streamed live at
- *  call time; `captureNativeAssertions` finalizes its pass/fail at test-end. */
+ *  time by NativeAssertRecorder. Its row (`entry`) is buffered, not streamed —
+ *  `captureNativeAssertions` emits it at test-end once its outcome is known. */
 export interface NativeAssertCall {
   prefix: 'assert' | 'verify'
   method: string
@@ -51,6 +107,9 @@ export interface NativeAssertCall {
   timestamp: number
   /** The pending row emitted at call time, updated in place when finalized. */
   entry?: CommandLog
+  /** Filled in asynchronously when the call's own promise settles; absent when
+   *  the settlement carried no outcome evidence (see observedAssertOutcome). */
+  observed?: ObservedAssertOutcome
 }
 
 export interface NightwatchTestCase {
diff --git a/packages/nightwatch-devtools/tests/actionSnapshot.test.ts b/packages/nightwatch-devtools/tests/actionSnapshot.test.ts
new file mode 100644
index 00000000..bcf03368
--- /dev/null
+++ b/packages/nightwatch-devtools/tests/actionSnapshot.test.ts
@@ -0,0 +1,71 @@
+import { describe, it, expect, vi } from 'vitest'
+import { SessionCapturer } from '../src/session.js'
+import type { CommandLog, NightwatchBrowser } from '../src/types.js'
+
+function makeMockBrowser(): NightwatchBrowser {
+  return {
+    url: vi.fn(async () => ({})),
+    execute: vi.fn(async () => ({ value: [] })),
+    executeAsync: vi.fn(async () => ({ value: [] })),
+    pause: vi.fn(async () => ({})),
+    getCurrentUrl: vi.fn(async () => 'http://example.test/'),
+    getTitle: vi.fn(async () => 'Example')
+  } as unknown as NightwatchBrowser
+}
+
+/** No hostname/port → no WebSocket, so the capture surface is testable without
+ *  a backend stub. Trace mode is what enables snapshot capture. */
+function makeCapturer(): SessionCapturer {
+  const cap = new SessionCapturer({}, makeMockBrowser())
+  cap.traceMode = 'trace'
+  return cap
+}
+
+describe('nightwatch action-snapshot timestamp binding', () => {
+  it("stamps the snapshot with the logged command's timestamp", async () => {
+    // Regression: the capture is fire-and-forget and resolves after the command
+    // completes, so its own Date.now() never equalled cmd.timestamp — and the
+    // exporter claims snapshots by exact equality, so nothing bound.
+    const cap = makeCapturer()
+    await cap.captureCommand('click', ['#btn'], undefined, undefined, {
+      timestamp: 7777
+    })
+    await Promise.all(cap.snapshotCaptures)
+
+    expect(cap.actionSnapshots).toHaveLength(1)
+    expect(cap.actionSnapshots[0]!.timestamp).toBe(7777)
+    expect(cap.actionSnapshots[0]!.timestamp).toBe(
+      cap.commandsLog[0]!.timestamp
+    )
+    cap.cleanup()
+  })
+
+  it('takes no snapshot for an assertion row', async () => {
+    // Assertion rows are emitted in a batch at test-end but positioned back on
+    // their real execution window, so a capture here would probe the page as it
+    // is now and stamp it seconds earlier. They inherit the preceding action's
+    // capture at export instead (FrameSnapshotIndex.claimAfter).
+    const cap = makeCapturer()
+    const entry: CommandLog = {
+      command: 'assert.titleContains',
+      args: ['Example'],
+      timestamp: 8888
+    }
+    cap.captureAssertCommand(entry)
+    await Promise.all(cap.snapshotCaptures)
+
+    expect(cap.actionSnapshots).toHaveLength(0)
+    expect(cap.commandsLog).toHaveLength(1)
+    cap.cleanup()
+  })
+
+  it('does not capture outside trace mode', async () => {
+    const cap = new SessionCapturer({}, makeMockBrowser())
+    await cap.captureCommand('click', [], undefined, undefined, {
+      timestamp: 100
+    })
+    await Promise.all(cap.snapshotCaptures)
+    expect(cap.actionSnapshots).toHaveLength(0)
+    cap.cleanup()
+  })
+})
diff --git a/packages/nightwatch-devtools/tests/actionSnapshotDialect.test.ts b/packages/nightwatch-devtools/tests/actionSnapshotDialect.test.ts
new file mode 100644
index 00000000..c8e8c05c
--- /dev/null
+++ b/packages/nightwatch-devtools/tests/actionSnapshotDialect.test.ts
@@ -0,0 +1,64 @@
+// The captured locator has to be one this runner can resolve — see shared's
+// `locator-dialect.ts`. Separate from `actionSnapshot.test.ts` because reading
+// the injected script back means mocking the WebDriver transport the probes go
+// over, and `vi.mock` is file-scoped: mocking it there would change what the
+// timestamp-binding cases exercise.
+
+import { describe, expect, it, vi } from 'vitest'
+
+import { SessionCapturer } from '../src/session.js'
+import { webdriverExecute } from '../src/helpers/webdriverHttp.js'
+import type { NightwatchBrowser, TestRunnerId } from '../src/types.js'
+
+vi.mock('../src/helpers/webdriverHttp.js', () => ({
+  webdriverExecute: vi.fn(async () => []),
+  webdriverGet: vi.fn(async () => null),
+  webdriverPost: vi.fn(async () => null),
+  resolveWebDriverAddress: vi.fn(() => null)
+}))
+
+const mockBrowser = () => ({}) as unknown as NightwatchBrowser
+
+async function injectedScripts(runner: TestRunnerId): Promise<string[]> {
+  vi.mocked(webdriverExecute).mockClear()
+  const cap = new SessionCapturer({}, mockBrowser())
+  cap.traceMode = 'trace'
+  cap.runner = runner
+  await cap.captureCommand('click', ['#btn'], undefined, undefined)
+  await Promise.all(cap.snapshotCaptures)
+  cap.cleanup()
+  return vi.mocked(webdriverExecute).mock.calls.map(([, src]) => String(src))
+}
+
+describe('nightwatch action-snapshot locator dialect', () => {
+  it('injects the XPath text form for both Nightwatch runners', async () => {
+    for (const runner of ['nightwatch', 'nightwatch-cucumber'] as const) {
+      const scripts = await injectedScripts(runner)
+
+      expect(scripts).not.toHaveLength(0)
+      for (const src of scripts) {
+        expect(src).not.toContain("tag + '*=' + text")
+        expect(src).toContain("'[contains(., '")
+      }
+    }
+  })
+
+  it('injects the CSS-first branch order for both Nightwatch runners', async () => {
+    // The runner decides where the text branch sits, not just what it emits —
+    // `//button[…]` needs useXpath() here, so a native CSS locator wins when one
+    // exists. This is the plumbing check: the adapter's runner has to reach the
+    // ordering, not only the grammar.
+    for (const runner of ['nightwatch', 'nightwatch-cucumber'] as const) {
+      const scripts = await injectedScripts(runner)
+
+      expect(scripts).not.toHaveLength(0)
+      for (const src of scripts) {
+        const composed = src.slice(src.indexOf('function getSelector'))
+
+        expect(
+          composed.indexOf('semanticCssSelector(element, tag)')
+        ).toBeLessThan(composed.indexOf('textSelector(element, tag)'))
+      }
+    }
+  })
+})
diff --git a/packages/nightwatch-devtools/tests/actionSnapshotProbes.test.ts b/packages/nightwatch-devtools/tests/actionSnapshotProbes.test.ts
new file mode 100644
index 00000000..8c7a3296
--- /dev/null
+++ b/packages/nightwatch-devtools/tests/actionSnapshotProbes.test.ts
@@ -0,0 +1,51 @@
+// The url/title probes go over the raw WebDriver transport, which answers
+// `null` — not a rejection — when the session is gone or the call fails. Core's
+// probe absorbs that, so the adapter hands the reader through unchanged; a
+// separate file because `vi.mock` is file-scoped and the transport has to be
+// stubbed per case here.
+
+import { describe, expect, it, vi } from 'vitest'
+
+import { captureActionSnapshot } from '../src/action-snapshot.js'
+import { webdriverGet } from '../src/helpers/webdriverHttp.js'
+import type { NightwatchBrowser } from '../src/types.js'
+
+vi.mock('../src/helpers/webdriverHttp.js', () => ({
+  webdriverExecute: vi.fn(async () => []),
+  webdriverGet: vi.fn(async () => null),
+  webdriverPost: vi.fn(async () => null),
+  resolveWebDriverAddress: vi.fn(() => null)
+}))
+
+const mockBrowser = () => ({}) as unknown as NightwatchBrowser
+
+describe('nightwatch action-snapshot driver probes', () => {
+  it('normalizes a null url/title read to undefined', async () => {
+    vi.mocked(webdriverGet).mockResolvedValue(null)
+
+    const snap = await captureActionSnapshot(mockBrowser(), 'click', 42)
+
+    expect(snap?.timestamp).toBe(42)
+    expect(snap?.url).toBeUndefined()
+    expect(snap?.title).toBeUndefined()
+    expect(snap?.screenshot).toBeUndefined()
+  })
+
+  it('passes a successful read straight through', async () => {
+    const reads: Record<string, string | null> = {
+      url: 'https://example.test/login',
+      title: 'Login Page',
+      screenshot: null
+    }
+    vi.mocked(webdriverGet).mockImplementation(((
+      _browser: NightwatchBrowser,
+      path: string
+    ) =>
+      Promise.resolve(reads[path] ?? null)) as unknown as typeof webdriverGet)
+
+    const snap = await captureActionSnapshot(mockBrowser(), 'click', 43)
+
+    expect(snap?.url).toBe('https://example.test/login')
+    expect(snap?.title).toBe('Login Page')
+  })
+})
diff --git a/packages/nightwatch-devtools/tests/assertCapture.test.ts b/packages/nightwatch-devtools/tests/assertCapture.test.ts
index 7c498b0b..0d319168 100644
--- a/packages/nightwatch-devtools/tests/assertCapture.test.ts
+++ b/packages/nightwatch-devtools/tests/assertCapture.test.ts
@@ -1,12 +1,13 @@
-import { describe, it, expect, vi, afterAll } from 'vitest'
+import { describe, it, expect, vi, afterAll, beforeAll } from 'vitest'
 import assert from 'node:assert'
 import {
   ASSERT_PATCHED_SYMBOL,
-  TRACKED_ASSERT_METHODS
+  TRACKED_ASSERT_METHODS,
+  rememberReadValue
 } from '@wdio/devtools-core'
 import { wireAssertCapture } from '../src/helpers/assertCapture.js'
 import type { SessionCapturer } from '../src/session.js'
-import type { CommandLog } from '../src/types.js'
+import type { CommandCaptureMeta, CommandLog } from '../src/types.js'
 
 // Snapshot real methods so the process-wide patch is undone after this file.
 const ASSERT_MUT = assert as unknown as Record<string | symbol, unknown>
@@ -29,18 +30,15 @@ function makeFakeCapturer() {
       args: unknown[],
       result: unknown,
       error: Error | undefined,
-      testUid?: string,
-      callSource?: string,
-      timestamp?: number
+      meta: CommandCaptureMeta = {}
     ) => {
       commandsLog.push({
         command,
         args,
         result,
         error,
-        testUid,
-        callSource,
-        timestamp: timestamp ?? Date.now()
+        ...meta,
+        timestamp: meta.timestamp ?? Date.now()
       })
       return Promise.resolve(true)
     }
@@ -55,17 +53,21 @@ function makeFakeCapturer() {
   return { capturer, commandsLog, captureCommand, sendCommand }
 }
 
+// One wiring for the file: patchNodeAssert is guarded per process, so a second
+// wireAssertCapture call is a no-op and every test reads through these getters.
+const live: {
+  fake?: ReturnType<typeof makeFakeCapturer>
+  uid?: string
+} = {}
+beforeAll(() => {
+  wireAssertCapture(
+    () => live.fake?.capturer,
+    () => live.uid
+  )
+})
+
 describe('wireAssertCapture', () => {
   it('routes node:assert calls through captureCommand and sends the entry', () => {
-    const live: {
-      fake?: ReturnType<typeof makeFakeCapturer>
-      uid?: string
-    } = {}
-    wireAssertCapture(
-      () => live.fake?.capturer,
-      () => live.uid
-    )
-
     // No capturer yet — asserts must not throw from the capture path.
     expect(() => assert.ok(true)).not.toThrow()
 
@@ -78,9 +80,11 @@ describe('wireAssertCapture', () => {
       [2, 2],
       'passed',
       undefined,
-      'test-uid',
-      expect.any(String),
-      expect.any(Number)
+      expect.objectContaining({
+        testUid: 'test-uid',
+        callSource: expect.any(String),
+        timestamp: expect.any(Number)
+      })
     )
     expect(fake.sendCommand).toHaveBeenCalledWith(fake.commandsLog[0])
 
@@ -92,3 +96,63 @@ describe('wireAssertCapture', () => {
     expect(fake.sendCommand).toHaveBeenCalledTimes(2)
   })
 })
+
+describe('node:assert target selector', () => {
+  function capture(run: () => void) {
+    const fake = makeFakeCapturer()
+    live.fake = fake
+    live.uid = 'test-uid'
+    run()
+    return fake.commandsLog[0]
+  }
+
+  it('names the element whose read produced the asserted value', () => {
+    // `assert.strictEqual(await browser.getText('#flash'), …)` names no element,
+    // so the row's locator comes from what the command path recorded for the
+    // value. Without it the player's overlay has nothing to box.
+    rememberReadValue('You logged into a secure area!', '#flash')
+    const row = capture(() => {
+      assert.match('You logged into a secure area!', /secure area/)
+    })
+    expect(row.selector).toBe('#flash')
+  })
+
+  it('names no element when the value came from a page-level read', () => {
+    // The null sentinel: `browser.title()` records its value as belonging to no
+    // element, so a title assertion never inherits the box of an element that
+    // happens to read the same text.
+    rememberReadValue('The Internet', 'h1')
+    rememberReadValue('The Internet', undefined)
+    const row = capture(() => {
+      assert.strictEqual('The Internet', 'The Internet')
+    })
+    expect(row.selector).toBeUndefined()
+  })
+
+  it('names no element for a comparison of literals', () => {
+    const row = capture(() => {
+      assert.strictEqual(6 * 7, 42)
+    })
+    expect(row.selector).toBeUndefined()
+  })
+
+  it('passes the selector to captureCommand, so the sent row carries it', () => {
+    // The selector rides in on the capture call rather than being stamped onto
+    // the pushed row afterwards — a row sent without it has no target to box.
+    rememberReadValue('a-unique-read', '#subject')
+    const fake = makeFakeCapturer()
+    live.fake = fake
+    live.uid = 'test-uid'
+    assert.strictEqual('a-unique-read', 'a-unique-read')
+    expect(fake.captureCommand).toHaveBeenCalledWith(
+      'assert.strictEqual',
+      expect.anything(),
+      expect.anything(),
+      undefined,
+      expect.objectContaining({ selector: '#subject' })
+    )
+    expect(fake.sendCommand).toHaveBeenCalledWith(
+      expect.objectContaining({ selector: '#subject' })
+    )
+  })
+})
diff --git a/packages/nightwatch-devtools/tests/assertTarget.test.ts b/packages/nightwatch-devtools/tests/assertTarget.test.ts
new file mode 100644
index 00000000..436dde3b
--- /dev/null
+++ b/packages/nightwatch-devtools/tests/assertTarget.test.ts
@@ -0,0 +1,153 @@
+import { describe, it, expect } from 'vitest'
+import {
+  assertTargetSelector,
+  commandRowSelector,
+  commandTargetSelector
+} from '../src/helpers/assertTarget.js'
+
+describe('assertTargetSelector', () => {
+  it('reads the element definition of an element assertion', () => {
+    expect(assertTargetSelector('textContains', ['#flash', 'You logged'])).toBe(
+      '#flash'
+    )
+    expect(assertTargetSelector('visible', ['a.button'])).toBe('a.button')
+    expect(assertTargetSelector('elementsCount', ['li', 3])).toBe('li')
+    expect(
+      assertTargetSelector('attributeEquals', ['#link', 'href', '/secure'])
+    ).toBe('#link')
+  })
+
+  it('names no element for the page-level and value assertions', () => {
+    // The bug this prevents: `/secure` and `The Internet` are the expected
+    // VALUE, and attaching one boxes whatever element happens to match it.
+    expect(assertTargetSelector('urlContains', ['/secure'])).toBeUndefined()
+    expect(
+      assertTargetSelector('titleContains', ['The Internet'])
+    ).toBeUndefined()
+    expect(assertTargetSelector('titleMatches', [/Internet/])).toBeUndefined()
+    expect(assertTargetSelector('urlEquals', ['#flash'])).toBeUndefined()
+    // node:assert's mirrors live on the same namespace and take values too.
+    expect(assertTargetSelector('ok', [true])).toBeUndefined()
+    expect(assertTargetSelector('strictEqual', ['a', 'a'])).toBeUndefined()
+  })
+
+  it('reads through the negated namespace', () => {
+    expect(assertTargetSelector('not.visible', ['#flash'])).toBe('#flash')
+    expect(assertTargetSelector('not.urlContains', ['/secure'])).toBeUndefined()
+  })
+
+  it('unwraps a definition object and a Nightwatch Element', () => {
+    expect(
+      assertTargetSelector('visible', [
+        { selector: '//div[@id="x"]', locateStrategy: 'xpath' }
+      ])
+    ).toBe('//div[@id="x"]')
+    // Duck-typed: an Element instance exposes the same `selector` getter.
+    class FakeElement {
+      constructor(public selector: string) {}
+    }
+    expect(assertTargetSelector('textEquals', [new FakeElement('#el')])).toBe(
+      '#el'
+    )
+  })
+
+  it('names nothing when the definition carries no selector', () => {
+    // A resolved WebElement handle — no locator to recover, so no box rather
+    // than a wrong one.
+    expect(
+      assertTargetSelector('visible', [{ id_: 'abc', driver_: {} }])
+    ).toBeUndefined()
+    expect(assertTargetSelector('visible', [''])).toBeUndefined()
+    expect(assertTargetSelector('visible', [])).toBeUndefined()
+    expect(assertTargetSelector('elementPresent', [null])).toBeUndefined()
+  })
+
+  it('names nothing for an unknown assertion', () => {
+    // A custom or newer assertion isn't in the table, so it degrades to no
+    // locator instead of guessing that arg 0 is an element.
+    expect(assertTargetSelector('myCustomAssert', ['#x'])).toBeUndefined()
+  })
+})
+
+describe('commandTargetSelector', () => {
+  it('reads the element a read command took its value from', () => {
+    expect(commandTargetSelector('getText', ['#flash'])).toBe('#flash')
+    expect(commandTargetSelector('getValue', ['#username'])).toBe('#username')
+    expect(commandTargetSelector('getAttribute', ['#link', 'href'])).toBe(
+      '#link'
+    )
+    expect(commandTargetSelector('isVisible', ['a.button'])).toBe('a.button')
+    expect(
+      commandTargetSelector('waitForElementVisible', ['#flash', 5000])
+    ).toBe('#flash')
+  })
+
+  it('names no element for a page-level read — the null sentinel', () => {
+    // These record their value as belonging to NO element, which is what stops a
+    // `assert.strictEqual(await browser.title(), …)` inheriting the box of an
+    // element that happens to read the same text.
+    expect(commandTargetSelector('title', [])).toBeUndefined()
+    expect(commandTargetSelector('getTitle', [])).toBeUndefined()
+    expect(commandTargetSelector('getCurrentUrl', [])).toBeUndefined()
+    expect(commandTargetSelector('source', [])).toBeUndefined()
+    expect(
+      commandTargetSelector('execute', ['return document.title'])
+    ).toBeUndefined()
+  })
+
+  it('does not read a navigation url as a locator', () => {
+    // `browser.url('https://…')` takes a string first, like an element command.
+    expect(
+      commandTargetSelector('url', ['https://example.com/login'])
+    ).toBeUndefined()
+  })
+
+  it('unwraps an element definition object', () => {
+    expect(
+      commandTargetSelector('getText', [
+        { selector: '//h1', locateStrategy: 'xpath' }
+      ])
+    ).toBe('//h1')
+  })
+
+  it('names nothing when the definition carries no selector', () => {
+    expect(commandTargetSelector('getText', [])).toBeUndefined()
+    expect(commandTargetSelector('getText', [{ id_: 'abc' }])).toBeUndefined()
+  })
+})
+
+describe('commandRowSelector', () => {
+  it('names the element a command acted on as well as one it read', () => {
+    // Wider than commandTargetSelector: a click acts on an element but produces
+    // no value, so it stays out of the provenance registry while still being a
+    // row about that element.
+    expect(commandRowSelector('click', ['button[type="submit"]'])).toBe(
+      'button[type="submit"]'
+    )
+    expect(commandRowSelector('setValue', ['#username', 'tomsmith'])).toBe(
+      '#username'
+    )
+    expect(commandRowSelector('waitForElementVisible', ['#flash', 5000])).toBe(
+      '#flash'
+    )
+    expect(commandTargetSelector('click', ['button'])).toBeUndefined()
+  })
+
+  it('names no element for a page-level command', () => {
+    // The regression this guards: `url` and `keys` take a string first too, and
+    // stamping it as the row's locator boxes whatever happens to match it.
+    expect(
+      commandRowSelector('url', ['https://example.com/login'])
+    ).toBeUndefined()
+    expect(commandRowSelector('keys', ['abc'])).toBeUndefined()
+    expect(commandRowSelector('pause', [500])).toBeUndefined()
+  })
+
+  it('unwraps an element definition object', () => {
+    expect(
+      commandRowSelector('click', [
+        { selector: '//a[@id="x"]', locateStrategy: 'xpath' }
+      ])
+    ).toBe('//a[@id="x"]')
+  })
+})
diff --git a/packages/nightwatch-devtools/tests/browserProxy.test.ts b/packages/nightwatch-devtools/tests/browserProxy.test.ts
index a7932d30..dd1c6b6d 100644
--- a/packages/nightwatch-devtools/tests/browserProxy.test.ts
+++ b/packages/nightwatch-devtools/tests/browserProxy.test.ts
@@ -1,5 +1,7 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { selectorForReadValue } from '@wdio/devtools-core'
 import type {
+  CommandCaptureMeta,
   CommandLog,
   NightwatchBrowser,
   NightwatchCurrentTest
@@ -27,9 +29,7 @@ function makeCapturer() {
       args: unknown[],
       result: unknown,
       error: Error | undefined,
-      testUid?: string,
-      callSource?: string,
-      timestamp?: number
+      meta: CommandCaptureMeta = {}
     ) => {
       commandsLog.push({
         _id: counter++,
@@ -37,9 +37,8 @@ function makeCapturer() {
         args,
         result,
         error,
-        testUid,
-        callSource,
-        timestamp: timestamp ?? Date.now()
+        ...meta,
+        timestamp: meta.timestamp ?? Date.now()
       })
       return true
     }
@@ -59,7 +58,10 @@ function makeCapturer() {
     sendCommand: vi.fn(),
     sendReplaceCommand: vi.fn(),
     takeScreenshotViaHttp: vi.fn(async () => null),
-    captureTrace: vi.fn(async () => {})
+    captureTrace: vi.fn(async () => {}),
+    injectScript: vi.fn(async () => {}),
+    anchorAfterNavigation: vi.fn(async () => {}),
+    snapshotCaptures: [] as Promise<void>[]
   } as unknown as SessionCapturer
   return { capturer, commandsLog, captureCommand, captureAssertCommand }
 }
@@ -130,6 +132,276 @@ describe('BrowserProxy internal-command suppression', () => {
   })
 })
 
+describe('BrowserProxy read-value provenance', () => {
+  beforeEach(() => {
+    getCallSourceFromStack.mockReset()
+    getCallSourceFromStack.mockReturnValue({
+      filePath: '/tests/spec.js',
+      callSource: '/tests/spec.js:12'
+    })
+  })
+
+  /** Commands that echo a W3C-wrapped value into the capture callback, the way
+   *  Nightwatch's queue hands a read's result back. */
+  function makeReadBrowser(value: unknown) {
+    // The wrapper appends the capture callback as the LAST argument, so every
+    // fake command answers the same way regardless of its own arity.
+    const echo = (...args: unknown[]) => {
+      const cb = args[args.length - 1]
+      if (typeof cb === 'function') {
+        ;(cb as (r: unknown) => void)({ value })
+      }
+      return undefined
+    }
+    return {
+      getText: echo,
+      title: echo,
+      url: echo
+    } as unknown as NightwatchBrowser
+  }
+
+  function proxied(browser: NightwatchBrowser) {
+    const { capturer } = makeCapturer()
+    const proxy = new BrowserProxy(capturer, makeTestManager(), () => ({
+      uid: 'test-1'
+    }))
+    proxy.wrapBrowserCommands(browser)
+    return browser as unknown as Record<string, (...a: unknown[]) => unknown>
+  }
+
+  it('attributes an element read to the selector it was read from', () => {
+    // The link a node:assert has no other way to make: it compares VALUES, so
+    // only the command that produced the value knows which element it came from.
+    proxied(makeReadBrowser('provenance-flash-text')).getText('#flash')
+    expect(selectorForReadValue('provenance-flash-text')).toBe('#flash')
+  })
+
+  it('attributes a page-level read to no element (the null sentinel)', () => {
+    // `title` is not an element read, so its value must not keep an element's
+    // claim standing — otherwise a title assertion boxes an element that merely
+    // happens to read the same text (measured on the selenium mocha example).
+    const shared = 'provenance-shared-text'
+    proxied(makeReadBrowser(shared)).getText('h1')
+    expect(selectorForReadValue(shared)).toBe('h1')
+    proxied(makeReadBrowser(shared)).title()
+    expect(selectorForReadValue(shared)).toBeUndefined()
+  })
+
+  it('does not read a url argument as a locator', () => {
+    // `browser.url('https://…')` takes a string first too; treating it as a
+    // locator would attribute the page's own reads to an "element".
+    const browser = proxied(makeReadBrowser('provenance-url-result'))
+    browser.url('https://example.com/login')
+    expect(selectorForReadValue('provenance-url-result')).toBeUndefined()
+  })
+
+  it('records nothing for a failed read', () => {
+    // A timeout's message is not a value the element ever held.
+    const failing = {
+      getText: (_sel: unknown, cb: (r: unknown) => void) => {
+        cb({ error: 'timeout', message: 'Timed out on <#gone>' })
+        return undefined
+      }
+    } as unknown as NightwatchBrowser
+    proxied(failing).getText('#gone')
+    expect(selectorForReadValue('Timed out on <#gone>')).toBeUndefined()
+  })
+})
+
+describe('BrowserProxy row metadata', () => {
+  beforeEach(() => {
+    getCallSourceFromStack.mockReset()
+    getCallSourceFromStack.mockReturnValue({
+      filePath: '/tests/spec.js',
+      callSource: '/tests/spec.js:9'
+    })
+  })
+
+  /** A browser whose commands echo into the capture callback Nightwatch appends
+   *  as the last argument. */
+  function makeEchoBrowser() {
+    const echo = (...args: unknown[]) => {
+      const cb = args[args.length - 1]
+      if (typeof cb === 'function') {
+        ;(cb as (r: unknown) => void)({ value: null })
+      }
+      return undefined
+    }
+    return { click: echo, url: echo } as unknown as NightwatchBrowser
+  }
+
+  function capture(
+    run: (b: Record<string, (...a: unknown[]) => unknown>) => void
+  ) {
+    const { capturer, commandsLog } = makeCapturer()
+    const proxy = new BrowserProxy(capturer, makeTestManager(), () => ({
+      uid: 'test-1'
+    }))
+    const browser = makeEchoBrowser()
+    proxy.wrapBrowserCommands(browser)
+    run(browser as unknown as Record<string, (...a: unknown[]) => unknown>)
+    return commandsLog[0]
+  }
+
+  it('carries the target selector, issue order and invocation time on the row', () => {
+    // The row says what it targeted rather than leaving the exporter to fall
+    // back to args[0] — and both stamps ride in on the capture call instead of
+    // being written onto the pushed row afterwards.
+    const row = capture((b) => b.click('button[type="submit"]'))
+    expect(row.selector).toBe('button[type="submit"]')
+    expect(row.sequence).toBe(0)
+    expect(row.startTime).toBeTypeOf('number')
+    expect(row.startTime).toBeLessThanOrEqual(row.timestamp!)
+  })
+
+  it('leaves a page-level command with no selector', () => {
+    const row = capture((b) => b.url('https://example.com/login'))
+    expect(row.selector).toBeUndefined()
+  })
+})
+
+describe('BrowserProxy navigation wrapping', () => {
+  beforeEach(() => {
+    getCallSourceFromStack.mockReset()
+    getCallSourceFromStack.mockReturnValue({
+      filePath: '/tests/spec.js',
+      callSource: '/tests/spec.js:5'
+    })
+  })
+
+  function makeUrlBrowser() {
+    return {
+      url: (...args: unknown[]) => {
+        const cb = args[args.length - 1]
+        if (typeof cb === 'function') {
+          ;(cb as (r: unknown) => void)({ value: 'https://example.com/' })
+        }
+        return undefined
+      }
+    } as unknown as NightwatchBrowser
+  }
+
+  it('does not treat browser.url() as a navigation when it is a getter', () => {
+    // assert.urlContains reads the current url via browser.url(cb) from inside
+    // Nightwatch's queue. Treating that as a navigation re-injected the collector
+    // and forced an anchored drain mid-test, for a command that changed nothing.
+    const { capturer } = makeCapturer()
+    const proxy = new BrowserProxy(capturer, makeTestManager(), () => ({
+      uid: 'test-1'
+    }))
+    const browser = makeUrlBrowser()
+    proxy.wrapUrlMethod(browser)
+    ;(browser as unknown as Record<string, (...a: unknown[]) => unknown>).url(
+      () => {}
+    )
+    expect(capturer.injectScript).not.toHaveBeenCalled()
+  })
+
+  it('still treats a url with a destination as a navigation', async () => {
+    const { capturer } = makeCapturer()
+    const proxy = new BrowserProxy(capturer, makeTestManager(), () => ({
+      uid: 'test-1'
+    }))
+    const browser = makeUrlBrowser()
+    proxy.wrapUrlMethod(browser)
+    ;(browser as unknown as Record<string, (...a: unknown[]) => unknown>).url(
+      'https://example.com/login'
+    )
+    // The non-chainable (cucumber async/await) branch defers injection onto the
+    // returned promise, so let the microtask queue drain before asserting.
+    await new Promise((resolve) => setImmediate(resolve))
+    expect(capturer.injectScript).toHaveBeenCalled()
+  })
+})
+
+describe('BrowserProxy async command failure', () => {
+  beforeEach(() => {
+    getCallSourceFromStack.mockReset()
+    getCallSourceFromStack.mockReturnValue({
+      filePath: '/tests/spec.js',
+      callSource: '/tests/spec.js:37'
+    })
+  })
+
+  /** Nightwatch reports an async failure (a command that timed out waiting for
+   *  an element) by INVOKING the callback with an error-shaped result rather than
+   *  throwing, so the try/catch around the original method never sees it. */
+  function makeFailingBrowser(result: unknown) {
+    return {
+      click: (_sel: unknown, cb: (r: unknown) => void) => {
+        cb(result)
+        return undefined
+      }
+    } as unknown as NightwatchBrowser
+  }
+
+  function clickWith(result: unknown) {
+    const ctx = makeCapturer()
+    const proxy = new BrowserProxy(ctx.capturer, makeTestManager(), () => ({
+      uid: 'test-1'
+    }))
+    const browser = makeFailingBrowser(result)
+    proxy.wrapBrowserCommands(browser)
+    ;(browser as unknown as Record<string, (a: unknown) => unknown>).click(
+      'a*=Logout'
+    )
+    return ctx
+  }
+
+  it('surfaces the failure as the row error, not as the result', () => {
+    // Left in `result`, the row kept error: undefined and rendered as a success
+    // — no red row and nothing in the Errors tab.
+    const { commandsLog } = clickWith({
+      error: 'timeout',
+      message:
+        'An error occurred while running .click() command on <a*=Logout>: Timed out',
+      stack: 'Error at BrowserProxy.handleCommandExecution'
+    })
+    expect(commandsLog).toHaveLength(1)
+    expect(commandsLog[0].error).toBeInstanceOf(Error)
+    expect((commandsLog[0].error as Error).message).toContain('Timed out')
+    expect((commandsLog[0].error as Error).stack).toContain('BrowserProxy')
+    expect(commandsLog[0].result).toBeUndefined()
+  })
+
+  it('finds the failure nested under a W3C value wrapper', () => {
+    // Nightwatch passes the driver response through untouched, so the failure
+    // sits under `value` — reading only the top level left the row green.
+    const { commandsLog } = clickWith({
+      status: -1,
+      value: {
+        error: 'timeout',
+        message: 'Timed out while waiting for element "a*=Logout"',
+        stack: 'Error at BrowserProxy.handleCommandExecution'
+      }
+    })
+    expect((commandsLog[0].error as Error).message).toContain('Timed out')
+    expect(commandsLog[0].result).toBeUndefined()
+  })
+
+  it('treats a thrown Error handed to the callback as the row error', () => {
+    const { commandsLog } = clickWith(new Error('stale element reference'))
+    expect((commandsLog[0].error as Error).message).toBe(
+      'stale element reference'
+    )
+  })
+
+  it('leaves a successful result untouched', () => {
+    const { commandsLog } = clickWith({ value: null })
+    expect(commandsLog[0].error).toBeUndefined()
+  })
+
+  it('does not reinterpret an assertion result as a command failure', () => {
+    // An assertion result carries its own pass/fail handling.
+    const { commandsLog } = clickWith({
+      passed: false,
+      error: 'assertion failed',
+      message: 'nope'
+    })
+    expect(commandsLog[0].error).toBeUndefined()
+  })
+})
+
 describe('BrowserProxy captureAssertions gating', () => {
   beforeEach(() => {
     getCallSourceFromStack.mockReset()
@@ -262,3 +534,113 @@ describe('BrowserProxy negated native assertions (assert.not.* / verify.not.*)',
     expect(row.error).toBeDefined()
   })
 })
+
+describe('BrowserProxy native-assert buffer scope', () => {
+  beforeEach(() => {
+    getCallSourceFromStack.mockReset()
+    getCallSourceFromStack.mockReturnValue({
+      filePath: '/tests/steps.js',
+      callSource: '/tests/steps.js:31'
+    })
+  })
+
+  /** Browser whose assert method returns a promise the test controls, mirroring
+   *  Nightwatch's ES6-async command return (`node.deferred.promise`). */
+  function makeSettleableAssertBrowser() {
+    const settlers: Array<{
+      resolve: (v: unknown) => void
+      reject: (e: unknown) => void
+    }> = []
+    const method = vi.fn(
+      () =>
+        new Promise<unknown>((resolve, reject) => {
+          settlers.push({ resolve, reject })
+        })
+    )
+    const browser = {
+      assert: { urlContains: method },
+      verify: { urlContains: method }
+    } as unknown as NightwatchBrowser
+    return { browser, settlers }
+  }
+
+  function assertNs(browser: NightwatchBrowser) {
+    return (
+      browser as unknown as {
+        assert: { urlContains: (a: unknown) => unknown }
+      }
+    ).assert
+  }
+
+  it('survives a per-step resetCommandTracking (cucumber calls it between steps)', () => {
+    const { capturer } = makeCapturer()
+    const proxy = new BrowserProxy(capturer, makeTestManager(), () => ({
+      uid: 'scenario-1'
+    }))
+    const { browser } = makeSettleableAssertBrowser()
+    proxy.wrapBrowserCommands(browser)
+
+    assertNs(browser).urlContains('/secure')
+    // Cucumber resets dedup state at every BeforeStep. Clearing the assert
+    // buffer there dropped every assertion but the last step's.
+    proxy.resetCommandTracking()
+    assertNs(browser).urlContains('/login')
+
+    const calls = proxy.drainNativeAssertCalls()
+    expect(calls.map((c) => c.args[0])).toEqual(['/secure', '/login'])
+  })
+
+  it('clears the buffer on resetTestTracking (a new test unit starts fresh)', () => {
+    const { capturer } = makeCapturer()
+    const proxy = new BrowserProxy(capturer, makeTestManager(), () => ({
+      uid: 'scenario-1'
+    }))
+    const { browser } = makeSettleableAssertBrowser()
+    proxy.wrapBrowserCommands(browser)
+
+    assertNs(browser).urlContains('/secure')
+    proxy.resetTestTracking()
+
+    expect(proxy.drainNativeAssertCalls()).toEqual([])
+  })
+
+  it('records the outcome off the assertion promise for both settlements', async () => {
+    const { capturer } = makeCapturer()
+    const proxy = new BrowserProxy(capturer, makeTestManager(), () => ({
+      uid: 'scenario-1'
+    }))
+    const { browser, settlers } = makeSettleableAssertBrowser()
+    proxy.wrapBrowserCommands(browser)
+
+    const okPromise = assertNs(browser).urlContains('/secure')
+    const failPromise = assertNs(browser).urlContains('/nope')
+    const calls = proxy.drainNativeAssertCalls()
+
+    settlers[0].resolve('https://example.com/secure')
+    settlers[1].reject(new Error('expected "/nope" but got: "/secure"'))
+    await okPromise
+    await expect(failPromise).rejects.toThrow('but got')
+
+    expect(calls[0].observed?.passed).toBe(true)
+    expect(calls[1].observed?.passed).toBe(false)
+    expect(calls[1].observed?.message).toContain('but got')
+  })
+
+  it('leaves a non-thenable command return unobserved', () => {
+    const { capturer } = makeCapturer()
+    const proxy = new BrowserProxy(capturer, makeTestManager(), () => ({
+      uid: 'scenario-1'
+    }))
+    // Nightwatch returns the `api` object (not a promise) when commands aren't
+    // ES6-async; the results-bag path supplies the outcome there.
+    const browser = {
+      assert: { urlContains: vi.fn(() => browser) },
+      verify: { urlContains: vi.fn(() => browser) }
+    } as unknown as NightwatchBrowser
+    proxy.wrapBrowserCommands(browser)
+
+    assertNs(browser).urlContains('/secure')
+
+    expect(proxy.drainNativeAssertCalls()[0].observed).toBeUndefined()
+  })
+})
diff --git a/packages/nightwatch-devtools/tests/filmstripGate.test.ts b/packages/nightwatch-devtools/tests/filmstripGate.test.ts
new file mode 100644
index 00000000..a6d58838
--- /dev/null
+++ b/packages/nightwatch-devtools/tests/filmstripGate.test.ts
@@ -0,0 +1,46 @@
+import { describe, it, expect } from 'vitest'
+import { NightwatchDevToolsPlugin } from '../src/index.js'
+import type { DevToolsOptions } from '../src/types.js'
+
+/** `options` is `private`, which is compile-time only — the constructor's
+ *  resolved option bag IS the unit under test here, so read it structurally. */
+function resolved(options: DevToolsOptions): Required<DevToolsOptions> {
+  const plugin = new NightwatchDevToolsPlugin(options)
+  return (plugin as unknown as { options: Required<DevToolsOptions> }).options
+}
+
+describe('filmstrip recorder gate', () => {
+  it('starts the recorder when filmstrip is left at its default', () => {
+    // Regression: the gate read the RAW `options.filmstrip === true`, so an
+    // unset filmstrip left the recorder off while the resolved options claimed
+    // it was on — no dense frames unless a config said `filmstrip: true`.
+    const opts = resolved({ mode: 'trace' })
+    expect(opts.filmstrip).toBe(true)
+    expect(opts.screencast.enabled).toBe(true)
+  })
+
+  it('starts the recorder when filmstrip is set explicitly', () => {
+    const opts = resolved({ mode: 'trace', filmstrip: true })
+    expect(opts.screencast.enabled).toBe(true)
+  })
+
+  it('leaves the recorder off when filmstrip is opted out', () => {
+    const opts = resolved({ mode: 'trace', filmstrip: false })
+    expect(opts.filmstrip).toBe(false)
+    expect(opts.screencast.enabled).not.toBe(true)
+  })
+
+  it('starts the recorder for a video policy even with filmstrip off', () => {
+    const opts = resolved({
+      mode: 'trace',
+      filmstrip: false,
+      video: 'retain-on-failure'
+    })
+    expect(opts.screencast.enabled).toBe(true)
+  })
+
+  it('does not force the recorder on in live mode', () => {
+    const opts = resolved({ mode: 'live' })
+    expect(opts.screencast.enabled).not.toBe(true)
+  })
+})
diff --git a/packages/nightwatch-devtools/tests/nativeAssertions.test.ts b/packages/nightwatch-devtools/tests/nativeAssertions.test.ts
index 352875f2..f686b288 100644
--- a/packages/nightwatch-devtools/tests/nativeAssertions.test.ts
+++ b/packages/nightwatch-devtools/tests/nativeAssertions.test.ts
@@ -2,6 +2,7 @@ import { describe, it, expect, vi } from 'vitest'
 import {
   captureNativeAssertions,
   latestResolvedScreenshot,
+  observedAssertOutcome,
   pendingAssertionCommand
 } from '../src/helpers/nativeAssertions.js'
 import type { SessionCapturer } from '../src/session.js'
@@ -303,6 +304,37 @@ describe('captureNativeAssertions (buffer → finalize at test-end)', () => {
     expect(calls[0].entry!.error).toBeDefined()
   })
 
+  it('carries the asserted element as the row selector, and only for element assertions', async () => {
+    const { capturer } = makeFakeCapturer()
+    const calls = [
+      call('assert', 'textContains', [
+        '#flash',
+        'You logged into a secure area'
+      ]),
+      call('assert', 'urlContains', ['/secure'])
+    ]
+    emitPending(capturer, calls, 'uid')
+    expect(calls[0].entry!.selector).toBe('#flash')
+    // The url assertion's arg is its expected value, not an element.
+    expect(calls[1].entry!.selector).toBeUndefined()
+
+    await captureNativeAssertions(
+      capturer,
+      browser,
+      currentTestWith([
+        passing(
+          "Testing if element <#flash> contains text 'You logged into a secure area'"
+        ),
+        passing("Testing if the URL contains '/secure'")
+      ]),
+      'uid',
+      calls
+    )
+    // Survives finalization — the row emitted at test-end is the buffered one.
+    expect(calls[0].entry!.selector).toBe('#flash')
+    expect(calls[1].entry!.selector).toBeUndefined()
+  })
+
   it('leaves an uncorrelated pending row in its neutral state (defensive)', async () => {
     const { capturer, sent, sendReplaceCommand } = makeFakeCapturer()
     const calls = [call('assert', 'ok', [true])]
@@ -367,3 +399,166 @@ describe('captureNativeAssertions (buffer → finalize at test-end)', () => {
     expect(takeScreenshotViaHttp).not.toHaveBeenCalled()
   })
 })
+
+describe('observedAssertOutcome (settlement of the assertion promise)', () => {
+  it('reads a rejection as a failure with the ANSI-stripped message', () => {
+    const err = new Error(
+      "Testing if the page title contains 'NOPE' - " +
+        'expected "contains \'NOPE\'" but got: "The Internet"'
+    )
+    expect(
+      observedAssertOutcome({ rejected: true, value: err, settledAt: 7 })
+    ).toEqual({
+      passed: false,
+      message:
+        "Testing if the page title contains 'NOPE' - expected " +
+        '"contains \'NOPE\'" but got: "The Internet"',
+      settledAt: 7
+    })
+  })
+
+  it('reads a fulfilment WITH an Error as a failure — the non-aborting verify path', () => {
+    // `verify.*` does not abort the queue, so Nightwatch resolves the node with
+    // the AssertionError rather than rejecting it (lib/core/asynctree.js).
+    const outcome = observedAssertOutcome({
+      rejected: false,
+      value: new Error('verify failed - expected "x" but got: "y"'),
+      settledAt: 9
+    })
+    expect(outcome?.passed).toBe(false)
+    expect(outcome?.message).toBe('verify failed - expected "x" but got: "y"')
+  })
+
+  it('reads a fulfilment with a value as a pass and carries no message', () => {
+    expect(
+      observedAssertOutcome({
+        rejected: false,
+        value: 'https://example.com/secure',
+        settledAt: 3
+      })
+    ).toEqual({ passed: true, message: '', settledAt: 3 })
+  })
+
+  it('treats a falsy-but-defined fulfilment as a pass', () => {
+    // A passing assertion can resolve with `null`/`false` (the unwrapped W3C
+    // `value`); only `undefined` means the node never ran.
+    expect(
+      observedAssertOutcome({ rejected: false, value: null, settledAt: 1 })
+        ?.passed
+    ).toBe(true)
+    expect(
+      observedAssertOutcome({ rejected: false, value: false, settledAt: 1 })
+        ?.passed
+    ).toBe(true)
+  })
+
+  it('returns no outcome for an undefined fulfilment (assertion never executed)', () => {
+    // An `assert.*` failure empties the queue; every assertion still enqueued
+    // then has its deferred resolved with the unset `node.resolveValue`. Reading
+    // that as a pass would paint a never-run assertion green.
+    expect(
+      observedAssertOutcome({
+        rejected: false,
+        value: undefined,
+        settledAt: 5
+      })
+    ).toBeUndefined()
+  })
+})
+
+describe('captureNativeAssertions with no results bag (cucumber runner)', () => {
+  /** The cucumber runner builds its Nightwatch client with no reporter, so
+   *  `SimplifiedReporter.logAssertResult` no-ops and there is no results bag at
+   *  all — `currentTest` is undefined and `correlate` has nothing to read. */
+  it('colours rows from the observed settlement instead of the results bag', async () => {
+    const { capturer, sent } = makeFakeCapturer()
+    const calls = [
+      call('assert', 'urlContains', ['/secure'], 'steps.js:31'),
+      call('assert', 'titleContains', ['NOPE'], 'steps.js:32')
+    ]
+    emitPending(capturer, calls, 'scenario-uid')
+    calls[0].observed = {
+      passed: true,
+      message: '',
+      settledAt: calls[0].timestamp + 146
+    }
+    calls[1].observed = {
+      passed: false,
+      message:
+        "Testing if the page title contains 'NOPE' - expected \"contains " +
+        '\'NOPE\'" but got: "The Internet"',
+      settledAt: calls[1].timestamp + 5072
+    }
+
+    await captureNativeAssertions(capturer, browser, undefined, 'uid', calls)
+
+    expect(sent).toHaveLength(2)
+    expect(sent[0].result).toEqual({ passed: true, expected: '/secure' })
+    expect(sent[0].error).toBeUndefined()
+    // Passing rows carry no prose (a settlement has none) — omitted, not blank.
+    expect(sent[0].result).not.toHaveProperty('message')
+    const failed = sent[1].result as {
+      passed: boolean
+      expected: unknown
+      actual: unknown
+    }
+    expect(failed.passed).toBe(false)
+    expect(failed.expected).toBe('NOPE')
+    // `actual` still comes from the "but got: …" clause, as on the BDD path.
+    expect(failed.actual).toBe('The Internet')
+    expect(sent[1].error?.message).toContain('but got')
+  })
+
+  it('spans each row over its observed execution window instead of a synthetic 1 ms', async () => {
+    const { capturer, sent } = makeFakeCapturer()
+    const calls = [call('assert', 'urlContains', ['/secure'])]
+    emitPending(capturer, calls, 'scenario-uid')
+    const enqueued = calls[0].timestamp
+    calls[0].observed = { passed: true, message: '', settledAt: enqueued + 146 }
+
+    await captureNativeAssertions(capturer, browser, undefined, 'uid', calls)
+
+    expect(sent[0].startTime).toBe(enqueued)
+    expect(sent[0].timestamp).toBe(enqueued + 146)
+  })
+
+  it('leaves a row neutral when the settlement carried no outcome', async () => {
+    const { capturer, sent } = makeFakeCapturer()
+    const calls = [call('assert', 'urlContains', ['/secure'])]
+    emitPending(capturer, calls, 'scenario-uid')
+
+    await captureNativeAssertions(capturer, browser, undefined, 'uid', calls)
+
+    expect(sent).toHaveLength(1)
+    expect(sent[0].result).toBeUndefined()
+    expect(sent[0].error).toBeUndefined()
+  })
+
+  it('keeps the results-bag outcome and its enqueue timestamp when both sources exist', async () => {
+    // The BDD interface reports no per-assertion command window, so a correlated
+    // row must keep its enqueue timestamp — `sequence` ordering depends on the
+    // resulting tie. The settlement must not quietly reposition it.
+    const { capturer, sent } = makeFakeCapturer()
+    const calls = [call('assert', 'titleContains', ['Example'])]
+    emitPending(capturer, calls, 'uid')
+    const enqueued = calls[0].timestamp
+    calls[0].observed = {
+      passed: false,
+      message: 'settlement says failed',
+      settledAt: enqueued + 500
+    }
+
+    await captureNativeAssertions(
+      capturer,
+      browser,
+      currentTestWith([
+        passing("Testing if the page title contains 'Example'")
+      ]),
+      'uid',
+      calls
+    )
+
+    expect((sent[0].result as { passed: boolean }).passed).toBe(true)
+    expect(sent[0].timestamp).toBe(enqueued)
+  })
+})
diff --git a/packages/nightwatch-devtools/tests/pluginScreencast.test.ts b/packages/nightwatch-devtools/tests/pluginScreencast.test.ts
new file mode 100644
index 00000000..b11d2131
--- /dev/null
+++ b/packages/nightwatch-devtools/tests/pluginScreencast.test.ts
@@ -0,0 +1,138 @@
+import { describe, it, expect, vi } from 'vitest'
+import type { ScreencastFrame } from '@wdio/devtools-shared'
+import {
+  PluginScreencast,
+  resolveScreencastOptions
+} from '../src/plugin-screencast.js'
+import type { SessionInitCtx } from '../src/session-init.js'
+import type { ScreencastRecorder } from '../src/screencast.js'
+
+const frame = (timestamp: number, data: string): ScreencastFrame => ({
+  data,
+  timestamp
+})
+
+/** Structural stand-in: the seam reads only `frames` off the recorder. */
+const fakeRecorder = (frames: ScreencastFrame[]): ScreencastRecorder =>
+  ({ frames, stop: async () => {} }) as unknown as ScreencastRecorder
+
+describe('resolveScreencastOptions', () => {
+  it('enables the recorder in trace mode for a filmstrip or a video policy', () => {
+    expect(
+      resolveScreencastOptions({
+        mode: 'trace',
+        filmstrip: true,
+        video: 'off',
+        screencast: undefined
+      }).options.enabled
+    ).toBe(true)
+    expect(
+      resolveScreencastOptions({
+        mode: 'trace',
+        filmstrip: false,
+        video: 'retain-on-failure',
+        screencast: undefined
+      }).options.enabled
+    ).toBe(true)
+  })
+
+  it('keeps the user options while forcing it on', () => {
+    const resolved = resolveScreencastOptions({
+      mode: 'trace',
+      filmstrip: true,
+      video: 'off',
+      screencast: { pollIntervalMs: 500 }
+    })
+    expect(resolved.options).toEqual({ pollIntervalMs: 500, enabled: true })
+    expect(resolved.warning).toBeUndefined()
+  })
+
+  it('drops a bare trace-mode screencast and says why', () => {
+    // Screencast with neither filmstrip nor video is a live-mode feature; left
+    // enabled it would record a session .webm nothing in the trace references.
+    const resolved = resolveScreencastOptions({
+      mode: 'trace',
+      filmstrip: false,
+      video: 'off',
+      screencast: { enabled: true }
+    })
+    expect(resolved.options.enabled).toBeUndefined()
+    expect(resolved.warning).toContain('live-mode feature')
+  })
+
+  it('leaves live mode to the user options', () => {
+    expect(
+      resolveScreencastOptions({
+        mode: 'live',
+        filmstrip: true,
+        video: 'off',
+        screencast: { enabled: true }
+      })
+    ).toEqual({ options: { enabled: true } })
+  })
+})
+
+describe('PluginScreencast', () => {
+  /** finalize delegates the stop to session-init, which nulls the recorder. */
+  function makeCtx(screencast: PluginScreencast): SessionInitCtx {
+    return {
+      mode: 'trace',
+      get screencastRecorder() {
+        return screencast.recorder
+      },
+      set screencastRecorder(v) {
+        screencast.recorder = v
+      },
+      get screencastSessionId() {
+        return screencast.sessionId
+      },
+      set screencastSessionId(v) {
+        screencast.sessionId = v
+      }
+    } as unknown as SessionInitCtx
+  }
+
+  it('combines the finalized sessions frames with the live recorder', async () => {
+    const screencast = new PluginScreencast({}, true)
+    screencast.recorder = fakeRecorder([frame(1, 'a')])
+    screencast.sessionId = 'session-1'
+
+    await screencast.finalize(makeCtx(screencast))
+    screencast.recorder = fakeRecorder([frame(2, 'b')])
+
+    // A mid-run slice flush reads both: the ended session's frames survive on
+    // the run buffer, the live recorder's are still in its own.
+    expect(screencast.frames.map((f) => f.data)).toEqual(['a', 'b'])
+  })
+
+  it('applies the shared recorder defaults over the given options', () => {
+    const screencast = new PluginScreencast({ pollIntervalMs: 50 }, true)
+    expect(screencast.options.pollIntervalMs).toBe(50)
+    expect(screencast.options.captureFormat).toBe('jpeg')
+  })
+
+  it('drops the frames when nothing will consume them', async () => {
+    // No filmstrip and no per-test video: keeping every frame of every session
+    // would grow unbounded for a buffer nothing reads.
+    const screencast = new PluginScreencast({}, false)
+    screencast.recorder = fakeRecorder([frame(1, 'a')])
+    screencast.sessionId = 'session-1'
+
+    await screencast.finalize(makeCtx(screencast))
+
+    expect(screencast.frames).toEqual([])
+  })
+
+  it('stops the recorder through the session-init finalize', async () => {
+    const screencast = new PluginScreencast({}, true)
+    const recorder = fakeRecorder([frame(1, 'a')])
+    const stop = vi.spyOn(recorder, 'stop')
+    screencast.recorder = recorder
+    screencast.sessionId = 'session-1'
+
+    await screencast.finalize(makeCtx(screencast))
+
+    expect(stop).toHaveBeenCalled()
+    expect(screencast.recorder).toBeUndefined()
+  })
+})
diff --git a/packages/nightwatch-devtools/tests/screencastSession.test.ts b/packages/nightwatch-devtools/tests/screencastSession.test.ts
new file mode 100644
index 00000000..21ef866c
--- /dev/null
+++ b/packages/nightwatch-devtools/tests/screencastSession.test.ts
@@ -0,0 +1,185 @@
+import { describe, it, expect, vi, afterEach } from 'vitest'
+import { accumulatedScreencastFrames } from '@wdio/devtools-core'
+import type { ScreencastFrame } from '@wdio/devtools-shared'
+import {
+  needsScreencastRotation,
+  rotateScreencastForSession
+} from '../src/screencast-session.js'
+import type { SessionInitCtx } from '../src/session-init.js'
+import type { ScreencastRecorder } from '../src/screencast.js'
+import type { NightwatchBrowser } from '../src/types.js'
+
+const frame = (timestamp: number, data: string): ScreencastFrame => ({
+  data,
+  timestamp
+})
+
+/** Structural stand-ins: rotation reads only `frames` off the recorder and
+ *  `sessionId` off the browser. */
+const fakeRecorder = (frames: ScreencastFrame[]): ScreencastRecorder =>
+  ({ frames, stop: async () => {} }) as unknown as ScreencastRecorder
+
+const fakeBrowser = (sessionId: string | undefined): NightwatchBrowser =>
+  ({ sessionId }) as unknown as NightwatchBrowser
+
+/** Exactly the ctx members rotation touches — narrowed on purpose, so a
+ *  rotation that starts reading a sixth one fails to compile. */
+type RotationCtx = Pick<
+  SessionInitCtx,
+  | 'screencastOptions'
+  | 'screencastRecorder'
+  | 'screencastSessionId'
+  | 'screencastRotation'
+  | 'sessionCapturer'
+  | 'finalizeCurrentScreencast'
+>
+
+/** Mirrors the plugin: `filmstripFrames` is the run buffer that ended sessions
+ *  drain into, `screencastRecorder` is the live one. The real recorder is
+ *  started, so the rebind is exercised end to end; polling is pushed out of the
+ *  way because only its first frame matters here. */
+function makeCtx(
+  overrides: {
+    enabled?: boolean
+    recorder?: ScreencastRecorder
+    sessionId?: string
+  } = {}
+) {
+  const filmstripFrames: ScreencastFrame[] = []
+  const ctx: RotationCtx = {
+    screencastOptions: {
+      enabled: overrides.enabled ?? true,
+      pollIntervalMs: 60_000
+    },
+    screencastRecorder: overrides.recorder,
+    screencastSessionId: overrides.sessionId,
+    screencastRotation: undefined,
+    sessionCapturer: {
+      takeScreenshotViaHttp: async () => 'c'
+    } as unknown as SessionInitCtx['sessionCapturer'],
+    finalizeCurrentScreencast: vi.fn(async () => {
+      if (ctx.screencastRecorder) {
+        filmstripFrames.push(...ctx.screencastRecorder.frames)
+      }
+      ctx.screencastRecorder = undefined
+      ctx.screencastSessionId = undefined
+    })
+  }
+  live.push(ctx)
+  return { ctx, filmstripFrames }
+}
+
+/** Every ctx a test built, so a started recorder's poll interval can't outlive
+ *  the test that started it. */
+const live: RotationCtx[] = []
+
+afterEach(async () => {
+  await Promise.all(live.splice(0).map((c) => c.screencastRecorder?.stop()))
+})
+
+const rotate = (ctx: RotationCtx, browser: NightwatchBrowser) =>
+  rotateScreencastForSession(ctx as SessionInitCtx, browser)
+
+describe('needsScreencastRotation', () => {
+  it('fires when the browser reports a session the recorder is not on', () => {
+    const ctx = {
+      screencastRecorder: fakeRecorder([]),
+      screencastSessionId: 'session-1'
+    }
+    expect(needsScreencastRotation(ctx, 'session-2')).toBe(true)
+  })
+
+  it('stays quiet while the session is unchanged', () => {
+    const ctx = {
+      screencastRecorder: fakeRecorder([]),
+      screencastSessionId: 'session-1'
+    }
+    expect(needsScreencastRotation(ctx, 'session-1')).toBe(false)
+  })
+
+  it('never starts a recorder from nothing', () => {
+    // after() finalizes the recorder BEFORE the plugin's last browser calls;
+    // restarting there would strand a poll interval past teardown.
+    const ctx = { screencastRecorder: undefined, screencastSessionId: 'old' }
+    expect(needsScreencastRotation(ctx, 'session-2')).toBe(false)
+  })
+
+  it('waits for a live session rather than rotating into the gap', () => {
+    // `browser.end()` leaves sessionId undefined until the next test creates
+    // one; rotating then would stop the recorder with nowhere to restart it.
+    const ctx = {
+      screencastRecorder: fakeRecorder([]),
+      screencastSessionId: 'session-1'
+    }
+    expect(needsScreencastRotation(ctx, undefined)).toBe(false)
+  })
+})
+
+describe('rotateScreencastForSession', () => {
+  it('carries the ended session frames into the run buffer before rebinding', async () => {
+    const { ctx, filmstripFrames } = makeCtx({
+      recorder: fakeRecorder([frame(1, 'a'), frame(2, 'b')]),
+      sessionId: 'session-1'
+    })
+
+    rotate(ctx, fakeBrowser('session-2'))
+    await ctx.screencastRotation
+
+    // The ended session survives on the run buffer, and the combined view the
+    // trace + per-test artifact paths read carries it AND the new session's.
+    expect(filmstripFrames.map((f) => f.data)).toEqual(['a', 'b'])
+    expect(ctx.screencastSessionId).toBe('session-2')
+    expect(
+      accumulatedScreencastFrames(filmstripFrames, ctx.screencastRecorder).map(
+        (f) => f.data
+      )
+    ).toEqual(['a', 'b', 'c'])
+  })
+
+  it('rotates once while a rotation is still in flight', async () => {
+    const { ctx } = makeCtx({
+      recorder: fakeRecorder([frame(1, 'a')]),
+      sessionId: 'session-1'
+    })
+
+    // Commands fire far faster than a rotation completes; unlatched, a second
+    // pass would tear down the recorder the first one just started.
+    rotate(ctx, fakeBrowser('session-2'))
+    rotate(ctx, fakeBrowser('session-2'))
+    rotate(ctx, fakeBrowser('session-2'))
+    await ctx.screencastRotation
+
+    expect(ctx.finalizeCurrentScreencast).toHaveBeenCalledTimes(1)
+  })
+
+  it('leaves a drain handle teardown can await, then clears it', async () => {
+    const { ctx } = makeCtx({
+      recorder: fakeRecorder([frame(1, 'a')]),
+      sessionId: 'session-1'
+    })
+
+    rotate(ctx, fakeBrowser('session-2'))
+    expect(ctx.screencastRotation).toBeInstanceOf(Promise)
+    await ctx.screencastRotation
+    expect(ctx.screencastRotation).toBeUndefined()
+  })
+
+  it('does nothing when the screencast is off', () => {
+    const { ctx } = makeCtx({
+      enabled: false,
+      recorder: fakeRecorder([frame(1, 'a')]),
+      sessionId: 'session-1'
+    })
+    rotate(ctx, fakeBrowser('session-2'))
+    expect(ctx.finalizeCurrentScreencast).not.toHaveBeenCalled()
+  })
+
+  it('leaves a recorder alone while its session is still current', () => {
+    const { ctx } = makeCtx({
+      recorder: fakeRecorder([frame(1, 'a')]),
+      sessionId: 'session-1'
+    })
+    rotate(ctx, fakeBrowser('session-1'))
+    expect(ctx.finalizeCurrentScreencast).not.toHaveBeenCalled()
+  })
+})
diff --git a/packages/nightwatch-devtools/tests/session.test.ts b/packages/nightwatch-devtools/tests/session.test.ts
index 9062c006..6c698b69 100644
--- a/packages/nightwatch-devtools/tests/session.test.ts
+++ b/packages/nightwatch-devtools/tests/session.test.ts
@@ -38,18 +38,22 @@ describe('SessionCapturer.captureCommand', () => {
     )
   })
 
-  it('uses provided timestamp when given', async () => {
+  it('carries the row metadata off the meta bag', async () => {
     const cap = makeCapturer()
-    await cap.captureCommand(
-      'x',
-      [],
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      12345
-    )
-    expect(cap.commandsLog[0].timestamp).toBe(12345)
+    await cap.captureCommand('getText', ['#flash'], undefined, undefined, {
+      timestamp: 12345,
+      startTime: 12300,
+      sequence: 7,
+      callSource: '/tests/spec.js:5',
+      selector: '#flash'
+    })
+    expect(cap.commandsLog[0]).toMatchObject({
+      timestamp: 12345,
+      startTime: 12300,
+      sequence: 7,
+      callSource: '/tests/spec.js:5',
+      selector: '#flash'
+    })
   })
 
   it('serializes Error before storing', async () => {
@@ -82,13 +86,9 @@ describe('SessionCapturer.captureCommand', () => {
 
   it('stores testUid on the captured entry', async () => {
     const cap = makeCapturer()
-    await cap.captureCommand(
-      'click',
-      ['.btn'],
-      undefined,
-      undefined,
-      'uid-nightwatch-1'
-    )
+    await cap.captureCommand('click', ['.btn'], undefined, undefined, {
+      testUid: 'uid-nightwatch-1'
+    })
     expect(cap.commandsLog[0].testUid).toBe('uid-nightwatch-1')
   })
 
@@ -327,26 +327,49 @@ describe('SessionCapturer.captureTrace', () => {
   })
 
   it('processes trace payload when collector is present', async () => {
-    let call = 0
+    // The drain goes over the raw WebDriver HTTP transport, never through
+    // `browser.execute` — that is a QUEUED command, and deferring the drain off
+    // Nightwatch's callback stack to use it lost the outgoing page's field edits
+    // whenever the next command navigated.
+    const http = await import('node:http')
+    const bodies: string[] = []
+    const server = http.createServer((req, res) => {
+      let raw = ''
+      req.on('data', (c) => {
+        raw += c
+      })
+      req.on('end', () => {
+        bodies.push(raw)
+        res.setHeader('content-type', 'application/json')
+        res.end(
+          JSON.stringify({
+            value: {
+              mutations: [
+                { type: 'attributes', addedNodes: [], removedNodes: [] }
+              ],
+              networkRequests: [],
+              consoleLogs: []
+            }
+          })
+        )
+      })
+    })
+    await new Promise<void>((r) => server.listen(0, '127.0.0.1', () => r()))
+    const port = (server.address() as { port: number }).port
     const browser = makeMockBrowser({
       getLog: vi.fn(async () => []),
-      execute: vi.fn(async () => {
-        call++
-        // Single atomic check+read — the inline `typeof === 'undefined' → null`
-        // guard in the script body avoids the navigation TOCTOU race.
-        return {
-          value: {
-            mutations: [
-              { type: 'attributes', addedNodes: [], removedNodes: [] }
-            ],
-            networkRequests: [],
-            consoleLogs: []
-          }
-        }
-      })
+      sessionId: 'sess-drain',
+      transport: { settings: { webdriver: { host: '127.0.0.1', port } } }
     })
     const cap = makeCapturer(browser)
-    await cap.captureTrace(browser)
-    expect(call).toBe(1)
+    try {
+      await cap.captureTrace(browser)
+      expect(bodies).toHaveLength(1)
+      expect(bodies[0]).toContain('getTraceData')
+      expect(cap.mutations).toHaveLength(1)
+      expect(browser.execute).not.toHaveBeenCalled()
+    } finally {
+      await new Promise<void>((r) => server.close(() => r()))
+    }
   })
 })
diff --git a/packages/nightwatch-devtools/tests/sessionRearm.test.ts b/packages/nightwatch-devtools/tests/sessionRearm.test.ts
new file mode 100644
index 00000000..c6a86595
--- /dev/null
+++ b/packages/nightwatch-devtools/tests/sessionRearm.test.ts
@@ -0,0 +1,254 @@
+import { describe, it, expect, vi, afterEach } from 'vitest'
+import type * as DevToolsCore from '@wdio/devtools-core'
+import {
+  needsCaptureRearm,
+  rearmCaptureForSession
+} from '../src/session-init.js'
+import type { SessionInitCtx } from '../src/session-init.js'
+import type { NightwatchBrowser } from '../src/types.js'
+
+const registerCollectorPreload = vi.hoisted(() =>
+  vi.fn(async () => true as boolean)
+)
+
+vi.mock('@wdio/devtools-core', async (importOriginal) => ({
+  ...(await importOriginal<typeof DevToolsCore>()),
+  registerCollectorPreload
+}))
+
+const attachBidiHandlers = vi.hoisted(() => vi.fn(async () => true as boolean))
+
+vi.mock('../src/bidi.js', () => ({
+  attachBidiHandlers,
+  buildBidiSinks: () => ({})
+}))
+
+/** A session change is only visible through the browser: Nightwatch raises no
+ *  event, and `end` is never wrapped. `driver` is what both channels attach to. */
+const fakeBrowser = (sessionId: string | undefined): NightwatchBrowser =>
+  ({ sessionId, driver: { id: sessionId } }) as unknown as NightwatchBrowser
+
+/** Exactly the ctx members the re-arm touches — narrowed on purpose, so a
+ *  re-arm that starts reading a fifth one fails to compile. */
+type RearmCtx = Pick<
+  SessionInitCtx,
+  'armedSessionId' | 'sessionCapturer' | 'bidiEnabled' | 'lastSessionId'
+>
+
+/** Stands in for the accumulated trace state a re-arm must leave alone. */
+interface FakeCapturer {
+  preloadRegistered: boolean
+  bidiActive: boolean
+  commandsLog: unknown[]
+  consoleLogs: unknown[]
+  networkRequests: unknown[]
+}
+
+function makeCtx(
+  overrides: { armedSessionId?: string; bidiEnabled?: boolean } = {}
+) {
+  const capturer: FakeCapturer = {
+    preloadRegistered: true,
+    bidiActive: true,
+    commandsLog: ['cmd-1', 'cmd-2'],
+    consoleLogs: ['log-1'],
+    networkRequests: ['req-1']
+  }
+  const ctx: RearmCtx = {
+    armedSessionId: overrides.armedSessionId ?? 'session-1',
+    bidiEnabled: overrides.bidiEnabled ?? true,
+    lastSessionId: 'session-1',
+    sessionCapturer: capturer as unknown as SessionInitCtx['sessionCapturer']
+  }
+  return { ctx, capturer }
+}
+
+const rearm = (ctx: RearmCtx, browser: NightwatchBrowser) =>
+  rearmCaptureForSession(ctx as SessionInitCtx, browser)
+
+/** The re-arm is fire-and-forget by design — and its BiDi step crosses a
+ *  dynamic `import()` — so a test that asserts on its outcome, or an afterEach
+ *  that resets the mocks it calls, has to drain the ticks it left behind. */
+const settle = async () => {
+  for (let i = 0; i < 5; i++) {
+    await new Promise((resolve) => setTimeout(resolve, 0))
+  }
+}
+
+afterEach(async () => {
+  await settle()
+  registerCollectorPreload.mockClear()
+  registerCollectorPreload.mockResolvedValue(true)
+  attachBidiHandlers.mockClear()
+  attachBidiHandlers.mockResolvedValue(true)
+})
+
+describe('needsCaptureRearm', () => {
+  it('fires when a command runs under a session that was never armed', () => {
+    expect(
+      needsCaptureRearm(
+        { armedSessionId: 'session-1', sessionCapturer: {} as never },
+        'session-2'
+      )
+    ).toBe(true)
+  })
+
+  it('stays quiet while the armed session is still current', () => {
+    expect(
+      needsCaptureRearm(
+        { armedSessionId: 'session-1', sessionCapturer: {} as never },
+        'session-1'
+      )
+    ).toBe(false)
+  })
+
+  it('never arms from nothing', () => {
+    // Before bringup there is no capturer to arm onto, and
+    // ensureSessionInitialized owns that first arm.
+    expect(
+      needsCaptureRearm(
+        { armedSessionId: undefined, sessionCapturer: {} as never },
+        'session-1'
+      )
+    ).toBe(false)
+  })
+
+  it('waits for a live session rather than arming into the gap', () => {
+    // `browser.end()` leaves sessionId undefined until the next testcase
+    // creates one; there is no BiDi channel to register against yet.
+    expect(
+      needsCaptureRearm(
+        { armedSessionId: 'session-1', sessionCapturer: {} as never },
+        undefined
+      )
+    ).toBe(false)
+  })
+
+  it('stays quiet while the capturer is being rebuilt', () => {
+    expect(
+      needsCaptureRearm(
+        {
+          armedSessionId: 'session-1',
+          sessionCapturer: undefined as never
+        },
+        'session-2'
+      )
+    ).toBe(false)
+  })
+})
+
+describe('rearmCaptureForSession', () => {
+  it('re-attaches BiDi and re-registers the preload for the new session', async () => {
+    // The gap this closes: both used to happen once, at bringup, so every
+    // session after a mid-run `browser.end()` ran with neither.
+    const { ctx, capturer } = makeCtx()
+
+    rearm(ctx, fakeBrowser('session-2'))
+    await settle()
+
+    expect(attachBidiHandlers).toHaveBeenCalledTimes(1)
+    expect(registerCollectorPreload).toHaveBeenCalledTimes(1)
+    expect(capturer.preloadRegistered).toBe(true)
+    expect(capturer.bidiActive).toBe(true)
+    expect(ctx.armedSessionId).toBe('session-2')
+  })
+
+  it('leaves the accumulated capture state untouched', async () => {
+    // Deliberately narrower than handleSessionChange, which rebuilds the
+    // SessionCapturer and in trace mode drops the whole run so far.
+    const { ctx, capturer } = makeCtx()
+    const capturerRef = ctx.sessionCapturer
+
+    rearm(ctx, fakeBrowser('session-2'))
+    await settle()
+
+    expect(ctx.sessionCapturer).toBe(capturerRef)
+    expect(capturer.commandsLog).toEqual(['cmd-1', 'cmd-2'])
+    expect(capturer.consoleLogs).toEqual(['log-1'])
+    expect(capturer.networkRequests).toEqual(['req-1'])
+    // ensureSessionInitialized's own bookkeeping stays its own.
+    expect(ctx.lastSessionId).toBe('session-1')
+  })
+
+  it('arms once while the arm is still in flight', async () => {
+    // Commands fire far faster than a BiDi handshake completes; unlatched,
+    // every command of the new session would register another preload.
+    const { ctx } = makeCtx()
+
+    rearm(ctx, fakeBrowser('session-2'))
+    rearm(ctx, fakeBrowser('session-2'))
+    rearm(ctx, fakeBrowser('session-2'))
+    await settle()
+
+    expect(registerCollectorPreload).toHaveBeenCalledTimes(1)
+  })
+
+  it('drops the dead session claims at detection, before the new ones land', () => {
+    // anchorAfterNavigation stands its settle poll down when the preload is
+    // registered, and captureNetworkFromPerformanceLogs stands down when BiDi
+    // is active — between sessions neither claim is true any more.
+    const { ctx, capturer } = makeCtx()
+
+    rearm(ctx, fakeBrowser('session-2'))
+
+    expect(capturer.preloadRegistered).toBe(false)
+    expect(capturer.bidiActive).toBe(false)
+  })
+
+  it('leaves the perf-log network path open when BiDi cannot be re-attached', async () => {
+    // A stale bidiActive gates perf-log capture off behind inspectors bound to
+    // a session that is gone, which is zero network capture for the rest of the
+    // run rather than a degraded stream.
+    attachBidiHandlers.mockResolvedValue(false)
+    const { ctx, capturer } = makeCtx()
+
+    rearm(ctx, fakeBrowser('session-2'))
+    await settle()
+
+    expect(capturer.bidiActive).toBe(false)
+  })
+
+  it('degrades to the `<script>` path when the session carries no BiDi', async () => {
+    // No `webSocketUrl: true` → the script manager throws and the helper
+    // reports false; the per-document injection stays the capture path.
+    registerCollectorPreload.mockResolvedValue(false)
+    const { ctx, capturer } = makeCtx()
+
+    rearm(ctx, fakeBrowser('session-2'))
+    await settle()
+
+    expect(capturer.preloadRegistered).toBe(false)
+    expect(ctx.armedSessionId).toBe('session-2')
+  })
+
+  it('registers the preload even with the bidi option off', async () => {
+    // The preload needs only a session created with `webSocketUrl: true`;
+    // gating it on the console/network opt-in would leave the navigation race
+    // in place for nearly every user.
+    const { ctx, capturer } = makeCtx({ bidiEnabled: false })
+
+    rearm(ctx, fakeBrowser('session-2'))
+    await settle()
+
+    expect(attachBidiHandlers).not.toHaveBeenCalled()
+    expect(registerCollectorPreload).toHaveBeenCalledTimes(1)
+    expect(capturer.preloadRegistered).toBe(true)
+  })
+
+  it('survives a registration that throws', async () => {
+    registerCollectorPreload.mockRejectedValue(new Error('ws closed'))
+    const { ctx } = makeCtx()
+
+    expect(() => rearm(ctx, fakeBrowser('session-2'))).not.toThrow()
+    await settle()
+
+    // Armed all the same: one attempt per session, matching bringup.
+    expect(ctx.armedSessionId).toBe('session-2')
+  })
+
+  it('does nothing while the armed session is still current', () => {
+    const { ctx } = makeCtx()
+    rearm(ctx, fakeBrowser('session-1'))
+    expect(registerCollectorPreload).not.toHaveBeenCalled()
+  })
+})
diff --git a/packages/nightwatch-devtools/tests/utils.test.ts b/packages/nightwatch-devtools/tests/utils.test.ts
index 82dcc3b2..a90c17cf 100644
--- a/packages/nightwatch-devtools/tests/utils.test.ts
+++ b/packages/nightwatch-devtools/tests/utils.test.ts
@@ -5,6 +5,7 @@ import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import { resetSignatureCounters } from '@wdio/devtools-core'
 import {
   buildPluginMetadataOptions,
+  nightwatchRunnerId,
   determineTestState,
   extractTestMetadata,
   findStepDefinitionLine,
@@ -90,6 +91,24 @@ describe('incrementCounters', () => {
   })
 })
 
+describe('nightwatchRunnerId', () => {
+  it('distinguishes the cucumber runner from the vanilla one', () => {
+    // Both take the same locator dialect, but the id also drives the
+    // dashboard's run capabilities, where cucumber cannot run a single test.
+    expect(nightwatchRunnerId(true)).toBe('nightwatch-cucumber')
+    expect(nightwatchRunnerId(false)).toBe('nightwatch')
+  })
+
+  it('is the same value the metadata payload reports', () => {
+    for (const isCucumberRunner of [true, false]) {
+      expect(
+        buildPluginMetadataOptions({ isCucumberRunner, configPath: undefined })
+          .framework
+      ).toBe(nightwatchRunnerId(isCucumberRunner))
+    }
+  })
+})
+
 describe('buildPluginMetadataOptions', () => {
   it('marks nightwatch + cucumber + canRunTests=false', () => {
     expect(
diff --git a/packages/script/src/collector.ts b/packages/script/src/collector.ts
index ecd9ad3d..fab4ea82 100644
--- a/packages/script/src/collector.ts
+++ b/packages/script/src/collector.ts
@@ -3,7 +3,27 @@ import { ConsoleLogCollector } from './collectors/consoleLogs.js'
 import { NetworkRequestCollector } from './collectors/networkRequests.js'
 import { assignRef, hasRef, parseDocument } from './utils.js'
 
-class DataCollector {
+/**
+ * When THIS document came into existence, as epoch ms.
+ *
+ * The anchor must not be stamped with the drain's clock. A drain is forced from
+ * Node whenever a collector might be fresh, which is always some time after the
+ * navigation that created the document — a round trip at best, a whole page load
+ * at worst — and several actions can run inside that gap. Stamped at drain time
+ * the anchor lands after them, so they all replay the PREVIOUS page's DOM.
+ *
+ * `performance.timeOrigin` is this document's navigation start, which is exactly
+ * the moment the anchor describes and is immune to which drain happens to
+ * collect it. Falls back to the drain clock where it isn't exposed.
+ */
+function documentAnchorTime(): number {
+  const origin = performance?.timeOrigin
+  return typeof origin === 'number' && Number.isFinite(origin) && origin > 0
+    ? Math.round(origin)
+    : Date.now()
+}
+
+export class DataCollector {
   #metadata = {
     url: window.location.href,
     // Serialize viewport values explicitly — VisualViewport properties are
@@ -18,6 +38,10 @@ class DataCollector {
   }
   #errors: string[] = []
   #mutations: TraceMutation[] = []
+  /** Whether THIS collector has emitted its full-DOM anchor. Instance-scoped on
+   *  purpose: the document's refs outlive a replaced collector, so keying on
+   *  them made a re-injected collector unable to anchor at all. */
+  #anchored = false
   #consoleLogs = new ConsoleLogCollector()
   #networkRequests = new NetworkRequestCollector()
 
@@ -38,15 +62,23 @@ class DataCollector {
    *  async anchor won the race): re-running assignRef would renumber descendants
    *  and desync every prior mutation. */
   captureCurrentDom() {
-    if (hasRef(document.documentElement)) {
+    if (this.#anchored) {
       return
     }
-    assignRef(document.documentElement)
+    this.#anchored = true
+    // Only number the tree when it isn't numbered yet. A re-injected collector
+    // lands on a document a PREVIOUS collector already ref'd; re-running
+    // assignRef would renumber every descendant and desync prior mutations,
+    // but refusing to anchor at all loses the document entirely — which is what
+    // made a navigation destination's DOM vanish from the trace.
+    if (!hasRef(document.documentElement)) {
+      assignRef(document.documentElement)
+    }
     this.captureMutation([
       {
         type: 'childList',
         url: window.location.href,
-        timestamp: Date.now(),
+        timestamp: documentAnchorTime(),
         addedNodes: [parseDocument(document.documentElement)],
         removedNodes: []
       }
@@ -56,6 +88,8 @@ class DataCollector {
   reset() {
     this.#errors = []
     this.#mutations = []
+    // `#anchored` deliberately survives a reset so a later drain doesn't
+    // re-emit the whole document.
     this.#consoleLogs.clear()
     this.#networkRequests.clear()
     clearLogs()
diff --git a/packages/script/tests/collector.test.ts b/packages/script/tests/collector.test.ts
new file mode 100644
index 00000000..b6125daa
--- /dev/null
+++ b/packages/script/tests/collector.test.ts
@@ -0,0 +1,72 @@
+/** @vitest-environment happy-dom */
+import { describe, it, expect, beforeEach } from 'vitest'
+import { DataCollector } from '../src/collector.js'
+
+const REF_ATTR = 'data-wdio-ref'
+
+const clearRefs = () => {
+  document.documentElement.removeAttribute(REF_ATTR)
+  document.querySelectorAll(`[${REF_ATTR}]`).forEach((el) => {
+    el.removeAttribute(REF_ATTR)
+  })
+}
+
+beforeEach(() => {
+  document.body.replaceChildren()
+  clearRefs()
+})
+
+describe('captureCurrentDom', () => {
+  it('anchors only once per collector', () => {
+    const c = new DataCollector()
+    c.captureCurrentDom()
+    c.captureCurrentDom()
+    expect(c.getTraceData().mutations).toHaveLength(1)
+  })
+
+  it('does not re-anchor after a drain reset it', () => {
+    // getTraceData() resets the buffer; re-anchoring on the next drain would
+    // emit the whole document again on every poll.
+    const c = new DataCollector()
+    c.captureCurrentDom()
+    c.getTraceData()
+    c.captureCurrentDom()
+    expect(c.getTraceData().mutations).toHaveLength(0)
+  })
+
+  it('anchors a document a previous collector already ref’d', () => {
+    // Regression: injecting over a live collector replaces the global with a
+    // fresh instance and discards its buffer, but the document keeps the refs
+    // the old one assigned. Guarding the anchor on those refs meant the new
+    // collector could never anchor — so a navigation destination's DOM vanished
+    // from the trace entirely (observed: drain returned 0 mutations).
+    const first = new DataCollector()
+    first.captureCurrentDom()
+    first.getTraceData()
+    expect(document.documentElement.hasAttribute(REF_ATTR)).toBe(true)
+
+    const replacement = new DataCollector()
+    replacement.captureCurrentDom()
+    const { mutations } = replacement.getTraceData()
+    expect(mutations).toHaveLength(1)
+  })
+
+  it('reuses existing refs rather than renumbering the tree', () => {
+    // Renumbering would desync every mutation the previous collector emitted.
+    const div = document.createElement('div')
+    div.append(document.createElement('span'))
+    document.body.append(div)
+
+    const first = new DataCollector()
+    first.captureCurrentDom()
+    const before = [...document.querySelectorAll(`[${REF_ATTR}]`)].map((el) =>
+      el.getAttribute(REF_ATTR)
+    )
+
+    new DataCollector().captureCurrentDom()
+    const after = [...document.querySelectorAll(`[${REF_ATTR}]`)].map((el) =>
+      el.getAttribute(REF_ATTR)
+    )
+    expect(after).toEqual(before)
+  })
+})
diff --git a/packages/selenium-devtools/package.json b/packages/selenium-devtools/package.json
index 5d30c6fe..7245af02 100644
--- a/packages/selenium-devtools/package.json
+++ b/packages/selenium-devtools/package.json
@@ -44,7 +44,7 @@
     "debugging",
     "testing"
   ],
-  "author": "WebdriverIO Team",
+  "author": "Vishnu Vardhan",
   "license": "MIT",
   "dependencies": {
     "@wdio/devtools-backend": "workspace:*",
diff --git a/packages/selenium-devtools/src/action-snapshot.ts b/packages/selenium-devtools/src/action-snapshot.ts
index 83a81d3e..e45f5d02 100644
--- a/packages/selenium-devtools/src/action-snapshot.ts
+++ b/packages/selenium-devtools/src/action-snapshot.ts
@@ -7,16 +7,20 @@
 
 import { captureActionSnapshot as coreCapture } from '@wdio/devtools-core'
 import type { ActionSnapshot } from '@wdio/devtools-shared'
+import { SELENIUM_RUNNER_ID } from './constants.js'
 import { getDriverOriginals } from './driverPatcher.js'
 import type { SeleniumDriverLike } from './types.js'
 
 export function captureActionSnapshot(
   driver: SeleniumDriverLike,
-  command: string
+  command: string,
+  timestamp?: number
 ): Promise<ActionSnapshot | null> {
   const orig = getDriverOriginals()
   return coreCapture({
     command,
+    timestamp,
+    runner: SELENIUM_RUNNER_ID,
     runScript: (src) =>
       orig.executeScript
         ? orig.executeScript(driver, `return (${src})`)
diff --git a/packages/selenium-devtools/src/assertPatcher.ts b/packages/selenium-devtools/src/assertPatcher.ts
index 008df8e4..b3de39f5 100644
--- a/packages/selenium-devtools/src/assertPatcher.ts
+++ b/packages/selenium-devtools/src/assertPatcher.ts
@@ -1,12 +1,24 @@
 import logger from '@wdio/logger'
 import {
   patchNodeAssert as patchNodeAssertCore,
+  resolveAssertTargetFromArgs,
   type CapturedAssert
 } from '@wdio/devtools-core'
+import { selectorForElement } from './helpers/element-locators.js'
 import type { CapturedCommand } from './types.js'
 
 const log = logger('@wdio/selenium-devtools:assertPatcher')
 
+/**
+ * The element an assert was about. A Selenium test asserts on a value it read
+ * out of the page (`assert.equal(await el.getText(), …)`), so the target is
+ * recovered from the args by core's value-provenance registry; the handle map
+ * is the Selenium-only addition, for an element passed straight to the assert.
+ */
+export function resolveAssertTarget(args: unknown[]): string | undefined {
+  return resolveAssertTargetFromArgs(args, selectorForElement)
+}
+
 /**
  * Selenium-specific wrapper around the core `patchNodeAssert`. Maps each
  * captured assert to selenium's wider `CapturedCommand` shape (adding the
@@ -20,9 +32,13 @@ export function patchNodeAssert(
     (cmd: CapturedAssert) =>
       onCommand({
         ...cmd,
+        // An assert is instantaneous, so its capture timestamp is also its start
+        // — matching what core's own capturedAssertToCommandLog does.
+        startTime: cmd.timestamp,
         rawResult: undefined,
         fromElement: false
       }),
-    (level, message) => log[level](message)
+    (level, message) => log[level](message),
+    resolveAssertTarget
   )
 }
diff --git a/packages/selenium-devtools/src/constants.ts b/packages/selenium-devtools/src/constants.ts
index cc39f0c2..aabca735 100644
--- a/packages/selenium-devtools/src/constants.ts
+++ b/packages/selenium-devtools/src/constants.ts
@@ -55,6 +55,10 @@ export const TRACKED_ELEMENT_METHODS = [
   'isSelected'
 ] as const
 
+/** Driver methods whose first argument is the locator that produces an element
+ *  handle — the only place a selector is observable, since the handle carries none. */
+export const ELEMENT_LOCATOR_METHODS = ['findElement', 'findElements'] as const
+
 export const NAVIGATION_COMMANDS = [
   'get',
   'navigate',
@@ -71,6 +75,7 @@ export { ANSI_REGEX, CONSOLE_METHODS, LOG_SOURCES } from '@wdio/devtools-core'
 export { SPINNER_RE } from '@wdio/devtools-core'
 
 import { DEFAULTS_BASE, TIMING_BASE } from '@wdio/devtools-shared'
+import type { TestRunnerId } from '@wdio/devtools-shared'
 
 export const DEFAULTS = {
   ...DEFAULTS_BASE,
@@ -103,3 +108,8 @@ export const BLANK_FRAME_THRESHOLD_BYTES = 4_000
 
 /** Per-prototype "already patched" guard for driverPatcher / assertPatcher. */
 export const PATCHED_SYMBOL = Symbol.for('@wdio/selenium-devtools/patched')
+
+/** This adapter's runner identity — one value regardless of which test runner
+ *  drives it (mocha/jest/cucumber), since the driver API is what the capture and
+ *  the locator dialect depend on. */
+export const SELENIUM_RUNNER_ID: TestRunnerId = 'selenium-webdriver'
diff --git a/packages/selenium-devtools/src/driverPatcher.ts b/packages/selenium-devtools/src/driverPatcher.ts
index d1aab68f..f1ff9cd9 100644
--- a/packages/selenium-devtools/src/driverPatcher.ts
+++ b/packages/selenium-devtools/src/driverPatcher.ts
@@ -1,13 +1,23 @@
 import { createRequire } from 'node:module'
 import logger from '@wdio/logger'
-import { errorMessage } from '@wdio/devtools-core'
 import {
+  beginInputDispatch,
+  errorMessage,
+  rememberReadValue
+} from '@wdio/devtools-core'
+import {
+  ELEMENT_LOCATOR_METHODS,
   INTERNAL_DRIVER_METHODS,
   PATCHED_SYMBOL,
   TRACKED_ELEMENT_METHODS
 } from './constants.js'
+import {
+  rememberElementLocator,
+  selectorForElement
+} from './helpers/element-locators.js'
 import { getCallSourceFromStack } from './helpers/utils.js'
 import type {
+  CapturedCommand,
   DriverOriginals,
   DriverPatcherHooks,
   ElementOriginals,
@@ -110,34 +120,71 @@ export function webElementSummary(el: unknown): string {
 // drops per-line `as any`.
 type Patchable = Record<string | symbol, unknown>
 
+function emitCommand(hooks: DriverPatcherHooks, cmd: CapturedCommand): void {
+  try {
+    hooks.onCommand(cmd)
+  } catch (err) {
+    log.warn(`onCommand hook threw for ${cmd.command}: ${errorMessage(err)}`)
+  }
+}
+
+/** Reports the command once it settles — see `CapturedCommand.timestamp` for why
+ *  the row is stamped at completion rather than at invocation. */
+function makeSettle(
+  hooks: DriverPatcherHooks,
+  meta: Omit<CapturedCommand, 'result' | 'rawResult' | 'error' | 'timestamp'>,
+  closeInputWindow: () => void
+): (result: unknown, error: Error | undefined) => void {
+  return (result, error) => {
+    closeInputWindow()
+    // An assertion names no element — it acts on the value a read resolved to —
+    // so the value is what carries the locator forward to the assertion row.
+    if (!error) {
+      rememberReadValue(result, meta.selector)
+    }
+    emitCommand(hooks, {
+      ...meta,
+      result: error ? undefined : safeSerialize(result),
+      rawResult: error ? undefined : result,
+      error,
+      timestamp: Date.now()
+    })
+  }
+}
+
 function makeWrappedMethod(
   original: (...args: unknown[]) => unknown,
   methodName: string,
   fromElement: boolean,
   hooks: DriverPatcherHooks
 ): (...args: unknown[]) => unknown {
+  const isLocatorCall =
+    !fromElement &&
+    (ELEMENT_LOCATOR_METHODS as readonly string[]).includes(methodName)
   return function (this: unknown, ...args: unknown[]): unknown {
-    const callInfo = getCallSourceFromStack()
-    const startedAt = Date.now()
-    const sanitizedArgs = args.map(safeSerialize)
-    const settle = (result: unknown, error: Error | undefined) => {
-      try {
-        hooks.onCommand({
-          command: methodName,
-          args: sanitizedArgs,
-          result: error ? undefined : safeSerialize(result),
-          rawResult: error ? undefined : result,
-          error,
-          callSource: callInfo.callSource,
-          timestamp: startedAt,
-          fromElement
-        })
-      } catch (hookErr) {
-        log.warn(
-          `onCommand hook threw for ${methodName}: ${(hookErr as Error).message}`
-        )
-      }
-    }
+    // Before the instrumentation below: serializing args and walking the stack
+    // both cost time that would otherwise land inside the row's own duration.
+    const startTime = Date.now()
+    // Suppresses the screencast recorder's screenshot polling until this command
+    // settles: a poll landing inside chromedriver's click, between computing the
+    // element's coordinates and dispatching at them, makes the click report
+    // success while activating nothing. Only the non-Chrome polling path is
+    // affected — Chrome uses push-based CDP screencast and never polls.
+    const closeInputWindow = beginInputDispatch(methodName)
+    const settle = makeSettle(
+      hooks,
+      {
+        command: methodName,
+        args: args.map(safeSerialize),
+        callSource: getCallSourceFromStack().callSource,
+        startTime,
+        fromElement,
+        // `this` is the only trace of which element the command targets — the
+        // locator was consumed by the findElement that produced it.
+        selector: fromElement ? selectorForElement(this) : undefined
+      },
+      closeInputWindow
+    )
 
     let result: unknown
     try {
@@ -146,6 +193,11 @@ function makeWrappedMethod(
       settle(undefined, err as Error)
       throw err
     }
+    // findElements resolves to its array later; only findElement hands back a
+    // usable handle here, which is what a chained call acts on.
+    if (isLocatorCall && isWebElementLike(result)) {
+      rememberElementLocator(result, args[0])
+    }
 
     // CRITICAL: return the original thenable. findElement returns a
     // WebElementPromise that carries sendKeys/click for chaining; a plain
@@ -153,7 +205,12 @@ function makeWrappedMethod(
     const thenable = result as { then?: PromiseLike<unknown>['then'] } | null
     if (thenable && typeof thenable.then === 'function') {
       thenable.then(
-        (v: unknown) => settle(v, undefined),
+        (v: unknown) => {
+          if (isLocatorCall) {
+            rememberElementLocator(v, args[0])
+          }
+          settle(v, undefined)
+        },
         (err: unknown) => settle(undefined, err as Error)
       )
       return result
diff --git a/packages/selenium-devtools/src/helpers/captureOrReplaceCommand.ts b/packages/selenium-devtools/src/helpers/captureOrReplaceCommand.ts
index 39b35768..21bff705 100644
--- a/packages/selenium-devtools/src/helpers/captureOrReplaceCommand.ts
+++ b/packages/selenium-devtools/src/helpers/captureOrReplaceCommand.ts
@@ -2,6 +2,16 @@ import { RetryTracker, toError } from '@wdio/devtools-core'
 import type { SessionCapturer } from '../session.js'
 import type { CapturedCommand, CommandLog, TestStats } from '../types.js'
 
+/** Fields the capturer's positional API doesn't carry. An absent `selector`
+ *  leaves the previous one standing: `replaceCommand` mutates the row in place,
+ *  so a retry must not blank the locator its first attempt resolved. */
+function applyCapturedFields(entry: CommandLog, cmd: CapturedCommand): void {
+  entry.startTime = cmd.startTime
+  if (cmd.selector) {
+    entry.selector = cmd.selector
+  }
+}
+
 /**
  * Capture (or replace, on a detected retry) a single CapturedCommand into the
  * SessionCapturer's command log. Returns the resulting CommandLog entry with
@@ -34,6 +44,7 @@ export async function captureOrReplaceCommand(opts: {
       cmd.timestamp
     )
     const entry = replaced.entry as CommandLog & { _id?: number }
+    applyCapturedFields(entry, cmd)
     retryTracker.setLastId(entry._id ?? null)
     capturer.sendReplaceCommand(replaced.oldTimestamp, entry)
     return entry
@@ -48,6 +59,7 @@ export async function captureOrReplaceCommand(opts: {
     cmd.callSource,
     cmd.timestamp
   )) as CommandLog & { _id?: number }
+  applyCapturedFields(entry, cmd)
   capturer.sendCommand(entry)
   retryTracker.recordCapture(cmdSig, entry._id ?? null)
   return entry
diff --git a/packages/selenium-devtools/src/helpers/commandPostActions.ts b/packages/selenium-devtools/src/helpers/commandPostActions.ts
index 486a76f8..8655ba10 100644
--- a/packages/selenium-devtools/src/helpers/commandPostActions.ts
+++ b/packages/selenium-devtools/src/helpers/commandPostActions.ts
@@ -4,11 +4,14 @@ import {
   applyPerformanceData,
   errorMessage,
   isSessionGoneError,
+  mapAssertCommand,
   mapCommandToAction,
   toError,
+  upsertRichestSnapshot,
   type CapturedPerformancePayload,
   type RetryTracker
 } from '@wdio/devtools-core'
+import { ELEMENT_LOCATOR_METHODS } from '../constants.js'
 import { getDriverOriginals, getElementOriginals } from '../driverPatcher.js'
 import { captureOrReplaceCommand } from './captureOrReplaceCommand.js'
 import { captureActionSnapshot } from '../action-snapshot.js'
@@ -79,11 +82,10 @@ export async function enrichFindResult(
 }
 
 /**
- * On navigation commands, inject the page-side capture script (once per
- * session), capture Performance API data onto the command entry, and pull
- * the latest trace + browser logs. Fire-and-forget; errors are logged unless
- * the session has already finalized (post-quit errors are expected and
- * uninteresting).
+ * On navigation commands, drain the page-side collector and capture Performance
+ * API data onto the command entry, plus browser logs. Fire-and-forget; errors
+ * are logged unless the session has already finalized (post-quit errors are
+ * expected and uninteresting).
  *
  * When `entry` is provided, the shared `CAPTURE_PERFORMANCE_SCRIPT` runs
  * against the driver and attaches navigation / resources / cookies /
@@ -92,7 +94,6 @@ export async function enrichFindResult(
  */
 export function captureNavigationTrace(
   capturer: SessionCapturer,
-  onInjected: () => void,
   isFinalized: () => boolean,
   entry?: CommandLog,
   args?: unknown[],
@@ -100,16 +101,24 @@ export function captureNavigationTrace(
 ): void {
   void (async () => {
     try {
-      // A navigation replaced the document, so the previous page's collector is
-      // gone — (re)inject on every navigation so each visited page's DOM (and
-      // field edits) is captured, not just the first. onInjected keeps the
-      // first-injection flag other capture paths read.
-      onInjected()
-      await capturer.injectScript()
+      // Fallback path: an appended `<script>` dies with its document, so every
+      // navigation needs it back. Under the document-start preload the
+      // destination instrumented itself before any of its own script ran, and
+      // re-injecting would only cost a round trip.
+      if (!capturer.preloadRegistered) {
+        await capturer.injectScript()
+      }
+      // Drained BEFORE the performance read, which sits on a 500ms settle: the
+      // drain is what moves the destination's DOM anchor out of the page and
+      // into the trace, and the page can be gone by the time that settle ends.
+      // Anchored, because the fallback path's freshly injected collector anchors
+      // asynchronously and an unanchored drain would beat it. Which action owns
+      // the anchor is derived from the anchor's own document birth time at
+      // ingest, not from this call.
+      await capturer.captureTrace(true)
       if (entry && driver) {
         await capturePerformance(capturer, driver, entry, args)
       }
-      await capturer.captureTrace()
       if (!capturer.bidiActive) {
         await capturer.captureBrowserLogs()
       }
@@ -157,12 +166,10 @@ export interface OnCommandCtx {
   readonly testManager: TestManager | undefined
   readonly retryTracker: RetryTracker
   readonly options: { captureScreenshots: boolean; mode?: DevToolsMode }
-  readonly scriptInjected: boolean
   readonly finalized: boolean
   readonly driver: SeleniumDriverLike | undefined
   readonly actionSnapshots: ActionSnapshot[]
   readonly snapshotCaptures: Promise<void>[]
-  setScriptInjected(v: boolean): void
 }
 
 function attachScreenshotAsync(
@@ -184,9 +191,20 @@ function attachScreenshotAsync(
 /**
  * After a DOM-mutating element command (type/click/clear/submit): drain the
  * collector so the page's field edits land before the page is discarded, then —
- * if the command navigated (a submit click) — re-inject on the destination so
- * its DOM is captured too (the previous page's `<script>` collector didn't
- * survive the navigation). Fire-and-forget; trace mode only.
+ * on the fallback injection path only — re-inject on the destination if the
+ * command navigated (a submit click), since the previous page's `<script>`
+ * collector didn't survive it. Trace mode only.
+ *
+ * Under the document-start preload there is nothing to re-inject: a missing
+ * collector is the fallback path's only signal that the document was replaced,
+ * and the preload makes that signal permanently false. The destination anchored
+ * itself at its own birth time, so whichever drain reaches it next places the
+ * anchor correctly.
+ *
+ * Tracked in `snapshotCaptures` rather than left loose: the driver patcher does
+ * not await `onCommand`, so this races the next command, and an untracked drain
+ * could still be in flight when the trace is written — which is how a
+ * navigating click's destination DOM went missing from the trace entirely.
  */
 function maybeDrainAfterDomCommand(
   ctx: OnCommandCtx,
@@ -199,11 +217,68 @@ function maybeDrainAfterDomCommand(
     DOM_MUTATING_ELEMENT_COMMANDS.has(cmd.command) &&
     !ctx.finalized
   ) {
-    void (async () => {
-      await capturer.captureTrace()
-      await capturer.reinjectIfNavigated()
-    })().catch(() => {})
+    ctx.snapshotCaptures.push(
+      (async () => {
+        // Anchor on the FIRST drain too: if the command already navigated, this
+        // drain's own recovery re-injects on the destination, which then makes
+        // reinjectIfNavigated see a live collector and early-return — so the
+        // anchor there never runs and the destination's DOM is lost. Attributed
+        // to this command so the player shows the destination for THIS action.
+        await capturer.captureTrace(true)
+        if (!capturer.preloadRegistered) {
+          await capturer.reinjectIfNavigated()
+        }
+      })().catch(() => {})
+    )
+  }
+}
+
+/**
+ * Whether a live-mode command warrants a drain — everything except the three
+ * classes that can't have moved the page or already drained: a navigation
+ * (`captureNavigationTrace` drains AND re-anchors it), a locator resolution
+ * (reading the DOM can't change it), and a node:assert row (it never reaches
+ * the browser at all). Same deny-list shape the WDIO service's live drain uses,
+ * over selenium's own command vocabulary.
+ */
+function warrantsLiveDrain(
+  capturer: SessionCapturer,
+  cmd: CapturedCommand
+): boolean {
+  if (capturer.isNavigationCommand(cmd.command) && !cmd.fromElement) {
+    return false
+  }
+  if ((ELEMENT_LOCATOR_METHODS as readonly string[]).includes(cmd.command)) {
+    return false
+  }
+  return !mapAssertCommand(cmd.command)
+}
+
+/**
+ * Live mode carries no per-action DOM snapshot — that costs two injected
+ * scripts plus a screenshot per action and is deliberately trace-only — so the
+ * dashboard replays whatever the last drain delivered. With only the navigation
+ * hook draining, every row between two document loads showed the page as it
+ * loaded: an unfilled form after `sendKeys`, and the destination of a
+ * navigating click never anchored at all because the `<script>` collector dies
+ * with its document. Mirrors the service's `#drainAfterLiveCommand`.
+ */
+function maybeDrainAfterLiveCommand(
+  ctx: OnCommandCtx,
+  capturer: SessionCapturer,
+  cmd: CapturedCommand
+): void {
+  if (
+    ctx.options.mode === 'trace' ||
+    ctx.finalized ||
+    !warrantsLiveDrain(capturer, cmd)
+  ) {
+    return
   }
+  // Tracked in `snapshotCaptures` for the same reason the trace path is: the
+  // driver patcher does not await `onCommand`, so an untracked drain can still
+  // be in flight when the session is torn down.
+  ctx.snapshotCaptures.push(capturer.drainAfterLiveCommand())
 }
 
 /**
@@ -245,7 +320,6 @@ export async function handleOnCommand(
   if (capturer.isNavigationCommand(cmd.command) && !cmd.fromElement) {
     captureNavigationTrace(
       capturer,
-      () => ctx.setScriptInjected(true),
       () => ctx.finalized,
       entry,
       cmd.args,
@@ -253,19 +327,33 @@ export async function handleOnCommand(
     )
   }
   maybeDrainAfterDomCommand(ctx, capturer, cmd)
+  maybeDrainAfterLiveCommand(ctx, capturer, cmd)
+  queueActionSnapshot(ctx, cmd, entry.timestamp, error)
+}
+
+/** Fire-and-forget post-action snapshot, drained at finalize. Stamped with the
+ *  logged command's timestamp, not the capture's own: the capture resolves after
+ *  the command completes, and export claims snapshots by exact equality with the
+ *  command timestamp (FrameSnapshotIndex.claimAfter / elementsAt). */
+function queueActionSnapshot(
+  ctx: OnCommandCtx,
+  cmd: CapturedCommand,
+  timestamp: number,
+  error: unknown
+): void {
   if (
-    ctx.options.mode === 'trace' &&
-    !error &&
-    ctx.driver &&
-    mapCommandToAction(cmd.command)
+    ctx.options.mode !== 'trace' ||
+    error ||
+    !ctx.driver ||
+    !mapCommandToAction(cmd.command)
   ) {
-    const driver = ctx.driver
-    ctx.snapshotCaptures.push(
-      captureActionSnapshot(driver, cmd.command).then((snap) => {
-        if (snap) {
-          ctx.actionSnapshots.push(snap)
-        }
-      })
-    )
+    return
   }
+  ctx.snapshotCaptures.push(
+    captureActionSnapshot(ctx.driver, cmd.command, timestamp).then((snap) => {
+      if (snap) {
+        upsertRichestSnapshot(ctx.actionSnapshots, snap)
+      }
+    })
+  )
 }
diff --git a/packages/selenium-devtools/src/helpers/driverMetadata.ts b/packages/selenium-devtools/src/helpers/driverMetadata.ts
index 9b9367e0..68751c2b 100644
--- a/packages/selenium-devtools/src/helpers/driverMetadata.ts
+++ b/packages/selenium-devtools/src/helpers/driverMetadata.ts
@@ -1,6 +1,7 @@
 import logger from '@wdio/logger'
 import { errorMessage } from '@wdio/devtools-core'
 import { TraceType } from '@wdio/devtools-shared'
+import { SELENIUM_RUNNER_ID } from '../constants.js'
 import type { SeleniumDriverLike } from '../types.js'
 
 const log = logger('@wdio/selenium-devtools:driverMetadata')
@@ -8,7 +9,9 @@ const log = logger('@wdio/selenium-devtools:driverMetadata')
 export interface DriverMetadataInput {
   driver: SeleniumDriverLike
   driverReadyTs: number
-  runner: string | null
+  /** The JS test runner `detectRunner` found (mocha/jest/cucumber). Distinct
+   *  from `Metadata.runner`, which names this adapter for every one of them. */
+  detectedRunner: string | null
   rerunCommand?: string
   rerunTemplate?: string
   launchCommand?: string
@@ -75,7 +78,7 @@ function logBrowserBoot(
 export async function buildDriverMetadata(
   input: DriverMetadataInput
 ): Promise<DriverMetadataResult> {
-  const { driver, driverReadyTs, runner } = input
+  const { driver, driverReadyTs, detectedRunner } = input
   try {
     const session = driver.getSession ? await driver.getSession() : undefined
     const capabilities = driver.getCapabilities
@@ -95,8 +98,8 @@ export async function buildDriverMetadata(
           capabilities ??
           {},
         sessionId,
+        runner: SELENIUM_RUNNER_ID,
         options: {
-          framework: 'selenium-webdriver',
           baseDir: process.cwd(),
           rerunCommand: input.rerunCommand ?? input.rerunTemplate,
           launchCommand: input.launchCommand,
@@ -104,7 +107,7 @@ export async function buildDriverMetadata(
           // leaf-step rerun stays disabled there.
           runCapabilities: {
             canRunSuites: true,
-            canRunTests: runner !== 'cucumber',
+            canRunTests: detectedRunner !== 'cucumber',
             canRunAll: true
           }
         }
diff --git a/packages/selenium-devtools/src/helpers/element-locators.ts b/packages/selenium-devtools/src/helpers/element-locators.ts
new file mode 100644
index 00000000..9f09e443
--- /dev/null
+++ b/packages/selenium-devtools/src/helpers/element-locators.ts
@@ -0,0 +1,88 @@
+// Recovers the locator an element command acted through: Selenium consumes it at
+// `findElement` time and hands back an opaque handle, so the command itself sees
+// only the handle. The row carries the result as `CommandLog.selector`.
+//
+// Selenium-specific by nature — it keys on `WebElement` handle identity. The
+// companion question an assertion asks ("which element produced this VALUE") is
+// framework-agnostic and lives in core's `read-value-locators`.
+
+/** `By.id('x')` compiles to this CSS form. */
+const BY_ID_CSS_RE = /^\*\[id="([\w-]+)"\]$/
+
+// Keyed by handle identity rather than element id: `WebElement.id_` is a promise
+// in every supported version, so no id is readable when a command is invoked. A
+// WeakMap also bounds itself — a dropped or stale handle is collected, not pinned
+// for the length of the run.
+const locatorsByElement = new WeakMap<object, string>()
+
+const BY_USING_TO_SELECTOR: Record<string, (value: string) => string> = {
+  'css selector': canonicalizeCss,
+  xpath: (value) => value,
+  'tag name': (value) => value
+}
+
+// A shorthand hash (`findElement({ id: 'x' })`) goes through the matching `By`
+// factory, so mirror what each one compiles to.
+const BY_HASH_TO_SELECTOR: Record<string, (value: string) => string> = {
+  css: (value) => value,
+  id: (value) => `#${value}`,
+  name: (value) => `[name="${value}"]`,
+  className: (value) => `.${value.trim().split(/\s+/).join('.')}`,
+  tagName: (value) => value,
+  xpath: (value) => value
+}
+
+function canonicalizeCss(value: string): string {
+  // `#x` is the form the captured element records carry, and the input point
+  // matches those records by exact string.
+  const byId = BY_ID_CSS_RE.exec(value)
+  return byId ? `#${byId[1]}` : value
+}
+
+/** A `By`, a `{using, value}` pair, a shorthand hash or a raw string, as the
+ *  selector string the rest of the system speaks. Undefined for locators with no
+ *  selector equivalent (link text, a JS or relative locator). */
+export function locatorToSelector(locator: unknown): string | undefined {
+  if (typeof locator === 'string') {
+    return locator || undefined
+  }
+  if (!locator || typeof locator !== 'object') {
+    return undefined
+  }
+  const by = locator as { using?: unknown; value?: unknown }
+  if (typeof by.using === 'string' && typeof by.value === 'string') {
+    return BY_USING_TO_SELECTOR[by.using]?.(by.value)
+  }
+  for (const [key, toSelector] of Object.entries(BY_HASH_TO_SELECTOR)) {
+    const value = (locator as Record<string, unknown>)[key]
+    if (typeof value === 'string' && value) {
+      return toSelector(value)
+    }
+  }
+  return undefined
+}
+
+/** Attribute a locator to the element handle(s) it produced. Called for both of
+ *  the objects one find yields — the promise it returns and the element that
+ *  promise resolves to — because either can be the receiver of a command. */
+export function rememberElementLocator(
+  target: unknown,
+  locator: unknown
+): void {
+  const selector = locatorToSelector(locator)
+  if (!selector) {
+    return
+  }
+  for (const el of Array.isArray(target) ? target : [target]) {
+    if (el && typeof el === 'object') {
+      locatorsByElement.set(el as object, selector)
+    }
+  }
+}
+
+/** The locator that produced this element handle, if we saw the find. */
+export function selectorForElement(el: unknown): string | undefined {
+  return el && typeof el === 'object'
+    ? locatorsByElement.get(el as object)
+    : undefined
+}
diff --git a/packages/selenium-devtools/src/index.ts b/packages/selenium-devtools/src/index.ts
index d0e073dc..69b49c0b 100644
--- a/packages/selenium-devtools/src/index.ts
+++ b/packages/selenium-devtools/src/index.ts
@@ -76,12 +76,12 @@ import {
 const log = logger('@wdio/selenium-devtools')
 
 const PLUGIN_VERSION = detectOwnVersion()
-const RUNNER = detectRunner()
+const DETECTED_RUNNER = detectRunner()
 const SELENIUM_VERSION = detectSeleniumVersion() ?? 'unknown'
 
 log.info(`@wdio/selenium-devtools v${PLUGIN_VERSION} loaded`)
 log.info(`Workspace: ${process.cwd()}`)
-log.info(`Detected runner: ${RUNNER}`)
+log.info(`Detected runner: ${DETECTED_RUNNER}`)
 log.info(`Detected selenium-webdriver: v${SELENIUM_VERSION}`)
 
 class SeleniumDevToolsPlugin {
@@ -105,7 +105,6 @@ class SeleniumDevToolsPlugin {
   #backendStarted = false
   #backendStartPromise?: Promise<void>
   #driver?: SeleniumDriverLike
-  #scriptInjected = false
   #isReuse = false
   // Coalesce internal retries: same {command,args,src} replaces prior entry.
   #retryTracker = new RetryTracker()
@@ -180,7 +179,7 @@ class SeleniumDevToolsPlugin {
     if (policyWarning) {
       log.warn(policyWarning)
     }
-    this.#rerunManager = new RerunManager(RUNNER)
+    this.#rerunManager = new RerunManager(DETECTED_RUNNER)
     if (options.rerunCommand) {
       this.#rerunManager.configure(options.rerunCommand)
     }
@@ -383,8 +382,8 @@ class SeleniumDevToolsPlugin {
       get screencastOptions() {
         return self.#screencastOptions
       },
-      get runner() {
-        return RUNNER
+      get detectedRunner() {
+        return DETECTED_RUNNER
       },
       get rerunTemplate() {
         return self.#rerunManager.rerunTemplate
@@ -443,12 +442,6 @@ class SeleniumDevToolsPlugin {
       set sessionId(v) {
         self.#sessionId = v
       },
-      get scriptInjected() {
-        return self.#scriptInjected
-      },
-      set scriptInjected(v) {
-        self.#scriptInjected = v
-      },
       get testFilePath() {
         return self.#testFilePath
       },
@@ -491,9 +484,6 @@ class SeleniumDevToolsPlugin {
       setFinalized: (v) => {
         self.#finalized = v
       },
-      setScriptInjected: (v) => {
-        self.#scriptInjected = v
-      },
       get actionSnapshots() {
         return self.#actionSnapshots
       },
diff --git a/packages/selenium-devtools/src/plugin-internals.ts b/packages/selenium-devtools/src/plugin-internals.ts
index 2893b0e9..7e9f01f6 100644
--- a/packages/selenium-devtools/src/plugin-internals.ts
+++ b/packages/selenium-devtools/src/plugin-internals.ts
@@ -38,7 +38,9 @@ export interface PluginInternals {
     traceGranularity?: TraceGranularity
   }
   readonly screencastOptions: ScreencastOptions
-  readonly runner: string
+  /** The JS test runner `detectRunner` found (mocha/jest/cucumber). Distinct
+   *  from `Metadata.runner`, which names this adapter for every one of them. */
+  readonly detectedRunner: string
   readonly rerunTemplate: string | undefined
   readonly launchCommand: string | undefined
   readonly isReuse: boolean
@@ -53,7 +55,6 @@ export interface PluginInternals {
   testManager: TestManager | undefined
   screencast: ScreencastRecorder | undefined
   sessionId: string | undefined
-  scriptInjected: boolean
   testFilePath: string | undefined
   keepAliveTimer: ReturnType<typeof setInterval> | undefined
 
@@ -77,7 +78,6 @@ export interface PluginInternals {
 
   // Plugin-side delegates
   setFinalized(v: boolean): void
-  setScriptInjected(v: boolean): void
   ensureBackendStarted(): Promise<void>
   flushPendingTestActions(): void
   resetRetryTracker(): void
diff --git a/packages/selenium-devtools/src/rerunManager.ts b/packages/selenium-devtools/src/rerunManager.ts
index 17229b47..3dc9d175 100644
--- a/packages/selenium-devtools/src/rerunManager.ts
+++ b/packages/selenium-devtools/src/rerunManager.ts
@@ -20,12 +20,15 @@ const FILTER_FLAG_ALIASES: Record<string, string[]> = {
 
 export class RerunManager {
   #launchCommand: string
-  #runner: string
+  #detectedRunner: string
   #rerunTemplate?: string
 
-  constructor(runner: string) {
+  /** `detectedRunner` is the JS test runner (mocha/jest/cucumber) whose CLI
+   *  flag the template replays — not `Metadata.runner`, which names the
+   *  adapter. */
+  constructor(detectedRunner: string) {
     this.#launchCommand = captureLaunchCommand()
-    this.#runner = runner
+    this.#detectedRunner = detectedRunner
   }
 
   configure(template: string | undefined) {
@@ -37,7 +40,7 @@ export class RerunManager {
     if (this.#rerunTemplate) {
       return this.#rerunTemplate
     }
-    const flag = FILTER_FLAGS[this.#runner]
+    const flag = FILTER_FLAGS[this.#detectedRunner]
     if (!flag) {
       return undefined
     }
@@ -50,7 +53,7 @@ export class RerunManager {
   }
 
   #stripFilterFlags(argv: string[]): string[] {
-    const aliases = FILTER_FLAG_ALIASES[this.#runner] ?? []
+    const aliases = FILTER_FLAG_ALIASES[this.#detectedRunner] ?? []
     if (aliases.length === 0) {
       return argv
     }
diff --git a/packages/selenium-devtools/src/runnerHooks.ts b/packages/selenium-devtools/src/runnerHooks.ts
index 27c6db9e..cb8d4510 100644
--- a/packages/selenium-devtools/src/runnerHooks.ts
+++ b/packages/selenium-devtools/src/runnerHooks.ts
@@ -36,14 +36,14 @@ export function detectRunner(): 'jest' | 'mocha' | 'cucumber' | null {
 export function tryRegisterRunnerHooks(
   callbacks: RunnerHookCallbacks
 ): 'jest' | 'mocha' | 'cucumber' | false {
-  const runner = detectRunner()
-  if (runner === 'jest') {
+  const detectedRunner = detectRunner()
+  if (detectedRunner === 'jest') {
     return tryRegisterJestHooks(callbacks) ? 'jest' : false
   }
-  if (runner === 'mocha') {
+  if (detectedRunner === 'mocha') {
     return tryRegisterMochaHooks(callbacks) ? 'mocha' : false
   }
-  if (runner === 'cucumber') {
+  if (detectedRunner === 'cucumber') {
     return tryRegisterCucumberHooks(callbacks) ? 'cucumber' : false
   }
   return false
diff --git a/packages/selenium-devtools/src/session-lifecycle.ts b/packages/selenium-devtools/src/session-lifecycle.ts
index 9007738c..a072d9ef 100644
--- a/packages/selenium-devtools/src/session-lifecycle.ts
+++ b/packages/selenium-devtools/src/session-lifecycle.ts
@@ -18,6 +18,7 @@ import {
   flushRangeLogged,
   recordSliceBoundary as coreRecordSliceBoundary,
   recordSpecBoundary as coreRecordSpecBoundary,
+  registerCollectorPreload,
   resolveAdapterOutputDir,
   type SpecBoundaryContext,
   type SpecRange,
@@ -64,7 +65,9 @@ export interface SessionLifecycleCtx {
     emitArtifactsManifest?: boolean
   }
   readonly screencastOptions: ScreencastOptions
-  readonly runner: string
+  /** The JS test runner `detectRunner` found (mocha/jest/cucumber). Distinct
+   *  from `Metadata.runner`, which names this adapter for every one of them. */
+  readonly detectedRunner: string
   readonly rerunTemplate: string | undefined
   readonly launchCommand: string | undefined
   readonly isReuse: boolean
@@ -77,7 +80,6 @@ export interface SessionLifecycleCtx {
   testManager: TestManager | undefined
   screencast: ScreencastRecorder | undefined
   sessionId: string | undefined
-  scriptInjected: boolean
   testFilePath: string | undefined
   keepAliveTimer: ReturnType<typeof setInterval> | undefined
 
@@ -189,7 +191,7 @@ async function initPerDriverCapture(
   const { sessionId, metadata } = await buildDriverMetadata({
     driver,
     driverReadyTs,
-    runner: ctx.runner,
+    detectedRunner: ctx.detectedRunner,
     rerunCommand: ctx.options.rerunCommand,
     rerunTemplate: ctx.rerunTemplate,
     launchCommand: ctx.launchCommand
@@ -216,31 +218,72 @@ async function initPerDriverCapture(
       })()
     : Promise.resolve()
 
-  const bidiPromise = (async () => {
-    try {
-      const sinks = buildBidiSinks(ctx.sessionCapturer!)
-      const ok = await attachBidiHandlers(driver, sinks)
-      if (ok) {
-        ctx.sessionCapturer!.bidiActive = true
-        log.info(
-          '✓ BiDi data flow active — script-injected console/network suppressed'
-        )
-      }
-    } catch (err) {
-      log.warn(`BiDi attach threw: ${errorMessage(err)}`)
+  await Promise.all([
+    screencastPromise,
+    attachBidi(ctx, driver),
+    registerPreload(ctx, driver)
+  ])
+}
+
+/** Route this driver's console/network through BiDi, which suppresses the
+ *  script-injected equivalents so neither stream double-reports. */
+async function attachBidi(
+  ctx: SessionLifecycleCtx,
+  driver: SeleniumDriverLike
+): Promise<void> {
+  try {
+    const attached = await attachBidiHandlers(
+      driver,
+      buildBidiSinks(ctx.sessionCapturer!)
+    )
+    if (attached) {
+      ctx.sessionCapturer!.bidiActive = true
+      log.info(
+        '✓ BiDi data flow active — script-injected console/network suppressed'
+      )
     }
-  })()
+  } catch (err) {
+    log.warn(`BiDi attach threw: ${errorMessage(err)}`)
+  }
+}
 
-  await Promise.all([screencastPromise, bidiPromise])
+/**
+ * Register the collector to run at document-start, so every document — including
+ * the ones a navigation creates without us noticing — instruments and anchors
+ * itself before any of its own script runs.
+ *
+ * Awaited as part of the per-driver bringup, which the patched `build()`
+ * thenable waits on: registering after the first `get` would leave that document
+ * on the `<script>` path it exists to replace. Self-degrades to per-document
+ * `<script>` injection when the session carries no BiDi channel.
+ */
+function registerPreload(
+  ctx: SessionLifecycleCtx,
+  driver: SeleniumDriverLike
+): Promise<void> {
+  return registerCollectorPreload(driver, (level, message) =>
+    log[level](message)
+  ).then((registered) => {
+    if (ctx.sessionCapturer) {
+      ctx.sessionCapturer.preloadRegistered = registered
+    }
+  })
 }
 
 export async function onDriverEnd(ctx: SessionLifecycleCtx): Promise<void> {
   // Drain the live page's mutations before the driver quits — onDriverEnd runs
   // (via onBeforeQuit) while the session is still alive, so the final page's
-  // DOM + field edits reach capturer.mutations before the trace is written.
+  // DOM + field edits reach capturer.mutations before the trace is written (in
+  // live mode, before the dashboard loses the session).
   // Gated on ctx.driver so the post-quit onDriverEnd call skips a dead session.
-  if (ctx.options.mode === 'trace' && ctx.driver) {
-    await ctx.sessionCapturer?.captureTrace()
+  if (ctx.driver && ctx.sessionCapturer) {
+    // Anchored: a run ending on a navigation (logout → /login as the last
+    // action) leaves the destination's async initial anchor unrun at teardown.
+    // Live mode goes through the post-command queue instead, so the drains
+    // still in flight land before the session goes away.
+    await (ctx.options.mode === 'trace'
+      ? ctx.sessionCapturer.captureTrace(true)
+      : ctx.sessionCapturer.drainAfterLiveCommand())
   }
   if (ctx.screencast && ctx.sessionId) {
     if (ctx.options.mode === 'trace') {
@@ -270,7 +313,6 @@ export async function onDriverEnd(ctx: SessionLifecycleCtx): Promise<void> {
   }
   ctx.driver = undefined
   ctx.screencast = undefined
-  ctx.scriptInjected = false
   ctx.sessionId = undefined
   ctx.resetRetryTracker()
 }
diff --git a/packages/selenium-devtools/src/session.ts b/packages/selenium-devtools/src/session.ts
index 0b60b6c0..ab7ae590 100644
--- a/packages/selenium-devtools/src/session.ts
+++ b/packages/selenium-devtools/src/session.ts
@@ -1,6 +1,7 @@
 import logger from '@wdio/logger'
 import {
   COLLECTOR_READY_EXPRESSION,
+  collectorDrainExpression,
   SessionCapturerBase,
   drainCollectorWithRecovery,
   errorMessage,
@@ -20,8 +21,18 @@ const log = logger('@wdio/selenium-devtools:SessionCapturer')
 export class SessionCapturer extends SessionCapturerBase {
   #driver: SeleniumDriverLike | undefined
 
+  // Tail of the serialized live-mode drain queue — see drainAfterLiveCommand.
+  #liveDrain: Promise<void> = Promise.resolve()
+
   // True once BiDi inspectors are attached — script-trace path skips streams.
   bidiActive = false
+
+  /** True once the collector is registered as a document-start BiDi preload.
+   *  Every document then instruments itself before any of its own script runs,
+   *  which makes the `<script>`-append paths (eager injection on navigation,
+   *  post-navigation re-injection) unreachable rather than merely redundant. */
+  preloadRegistered = false
+
   #clientConnected = false
   #clientConnectedWaiters: Array<() => void> = []
   #onClientDisconnected?: () => void
@@ -204,6 +215,18 @@ export class SessionCapturer extends SessionCapturerBase {
       return
     }
     try {
+      // Injecting over a live collector replaces `window.wdioTraceCollector`
+      // with a fresh instance and DISCARDS whatever it had buffered — including
+      // the destination's full-DOM anchor. Three call paths can reach the same
+      // document (navigation trace, post-command drain recovery, explicit
+      // re-inject), so the guard lives here rather than in each caller.
+      const present = await exec(
+        driver,
+        `return ${COLLECTOR_READY_EXPRESSION};`
+      )
+      if (present === true) {
+        return
+      }
       const scriptContent = await loadInjectableScript()
       await exec(
         driver,
@@ -229,7 +252,11 @@ export class SessionCapturer extends SessionCapturerBase {
     }
   }
 
-  async captureTrace(): Promise<void> {
+  /** `forceAnchor` forces a full-DOM anchor of the current document before
+   *  draining, so a freshly injected collector's async anchor isn't lost. Which
+   *  action the anchor belongs to is derived from the anchor itself at ingest,
+   *  not from this call — see `reattributeDomAnchors`. */
+  async captureTrace(forceAnchor = false): Promise<void> {
     const driver = this.#driver
     const exec = getDriverOriginals().executeScript
     if (!driver || !exec) {
@@ -240,20 +267,27 @@ export class SessionCapturer extends SessionCapturerBase {
       // (page navigation) between the existence check and the getTraceData
       // call. Two round-trips left a TOCTOU race that logged spurious
       // "Cannot read properties of undefined (reading 'getTraceData')" errors.
+      let recovered = false
       const traceData = await drainCollectorWithRecovery({
-        drain: () =>
-          exec(
-            driver,
-            `return ${COLLECTOR_READY_EXPRESSION} ? window.wdioTraceCollector.getTraceData() : null;`
-          ),
-        injectIntoCurrentDocument: () => this.injectScript(),
+        drain: () => exec(driver, collectorDrainExpression(forceAnchor)),
+        injectIntoCurrentDocument: async () => {
+          recovered = true
+          await this.injectScript()
+        },
         currentUrl: async () =>
           (await exec(driver, 'return location.href;')) as string | undefined,
         log: (level, message) => log[level](message)
       })
       if (!traceData) {
+        log.debug(
+          `drain: no payload (anchor=${forceAnchor} recovered=${recovered})`
+        )
         return
       }
+      const drained = (traceData as { mutations?: unknown[] }).mutations ?? []
+      log.debug(
+        `drain: ${drained.length} mutations (anchor=${forceAnchor} recovered=${recovered})`
+      )
       this.processTracePayload(traceData as Record<string, unknown>, {
         skipConsoleLogs: this.bidiActive,
         skipNetworkRequests: this.bidiActive
@@ -302,13 +336,13 @@ export class SessionCapturer extends SessionCapturerBase {
   }
 
   /**
-   * After a click/submit that may have navigated, the previous page's injected
-   * `<script>` collector is gone (unlike WDIO's BiDi preload, it doesn't survive
-   * navigation). If the current document has no collector, the page was
-   * replaced — re-inject on it and drain so the destination DOM lands in the
-   * trace. No-op for a same-document click (the collector is still present).
-   * Relies on the default `normal` page-load strategy, so a navigating click
-   * has finished loading by the time this runs.
+   * Fallback path only — see `preloadRegistered`. With no document-start
+   * preload the previous page's appended `<script>` collector dies with its
+   * document, so a click/submit that navigated leaves the destination
+   * uninstrumented: re-inject on it and drain so its DOM lands in the trace.
+   * No-op for a same-document click (the collector is still present). Relies on
+   * the default `normal` page-load strategy, so a navigating click has finished
+   * loading by the time this runs.
    */
   async reinjectIfNavigated(): Promise<void> {
     const driver = this.#driver
@@ -325,7 +359,10 @@ export class SessionCapturer extends SessionCapturerBase {
         return
       }
       await this.injectScript()
-      await this.captureTrace()
+      // Anchor forced: the freshly injected collector's initial anchor is async,
+      // so an unanchored drain here beats it and the destination's DOM is lost
+      // with the page.
+      await this.captureTrace(true)
     } catch (err) {
       const msg = errorMessage(err)
       if (isSessionGoneError(msg)) {
@@ -335,6 +372,31 @@ export class SessionCapturer extends SessionCapturerBase {
     }
   }
 
+  /**
+   * Drain after a user command in live mode, queued behind the previous such
+   * drain. Anchored, which is also what recovers a navigation under the fallback
+   * injection: a click that replaced the document leaves no collector, so the
+   * drain re-injects into the destination and its retry anchors it — no separate
+   * `reinjectIfNavigated` pass, which would double the round trips on every
+   * DOM-mutating command and whose readiness poll pushed the queue far enough
+   * behind the test that the destination was gone before it ran. With the
+   * document-start preload there is nothing to recover: the destination has
+   * already anchored itself and this drain just collects it.
+   *
+   * Serialized because the driver patcher does not await `onCommand`: two
+   * drains can overlap, and one that falls into collector recovery pays an
+   * injection plus a readiness poll — long enough to land its batch behind a
+   * later one. The dashboard walks the mutation stream in order and stops at
+   * the first entry past the selected row's window, so an overtaken batch
+   * strands every row after it on the previous document.
+   */
+  drainAfterLiveCommand(): Promise<void> {
+    this.#liveDrain = this.#liveDrain
+      .then(() => this.captureTrace(true))
+      .catch(() => {})
+    return this.#liveDrain
+  }
+
   isNavigationCommand(command: string): boolean {
     const target = command.toLowerCase()
     return NAVIGATION_COMMANDS.some((c) => target === c.toLowerCase())
diff --git a/packages/selenium-devtools/src/types.ts b/packages/selenium-devtools/src/types.ts
index 925ec86b..8804a772 100644
--- a/packages/selenium-devtools/src/types.ts
+++ b/packages/selenium-devtools/src/types.ts
@@ -89,8 +89,17 @@ export interface CapturedCommand {
   rawResult?: unknown
   error: Error | undefined
   callSource: string | undefined
+  /** When the command COMPLETED. The page-side mutation stream is on real time,
+   *  so a row stamped at invocation replays the page from before its own effect. */
   timestamp: number
+  /** When the command was invoked — the row's real start, so it spans its actual
+   *  duration instead of a synthetic 1ms. */
+  startTime: number
   fromElement: boolean
+  /** Locator that produced the element this command acted on. An element command
+   *  carries no locator of its own — the earlier `findElement` consumed it — so
+   *  it is recovered from the handle and threaded onto the row here. */
+  selector?: string
 }
 
 export interface DriverPatcherHooks {
diff --git a/packages/selenium-devtools/tests/action-snapshot.test.ts b/packages/selenium-devtools/tests/action-snapshot.test.ts
new file mode 100644
index 00000000..51439c36
--- /dev/null
+++ b/packages/selenium-devtools/tests/action-snapshot.test.ts
@@ -0,0 +1,134 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+import { resetSignatureCounters } from '../src/helpers/utils.js'
+import { TestManager } from '../src/helpers/testManager.js'
+import { SuiteManager } from '../src/helpers/suiteManager.js'
+import { TestReporter } from '../src/reporter.js'
+import { SessionCapturer } from '../src/session.js'
+import {
+  handleOnCommand,
+  type OnCommandCtx
+} from '../src/helpers/commandPostActions.js'
+import { RetryTracker } from '@wdio/devtools-core'
+import type { ActionSnapshot } from '@wdio/devtools-shared'
+import type { CapturedCommand, SeleniumDriverLike } from '../src/types.js'
+
+const capturers: SessionCapturer[] = []
+
+afterEach(() => {
+  while (capturers.length) {
+    capturers.pop()!.cleanup()
+  }
+})
+
+/** A driver whose probes resolve to empty results — enough for the snapshot to
+ *  be produced without a browser. The patcher's `originals` bag is empty here
+ *  (nothing was patched), so the adapter falls back to these directly. */
+function fakeDriver(): SeleniumDriverLike {
+  return {
+    executeScript: vi.fn().mockResolvedValue([]),
+    takeScreenshot: vi.fn().mockResolvedValue('AA'),
+    getCurrentUrl: vi.fn().mockResolvedValue('http://example.test/'),
+    getTitle: vi.fn().mockResolvedValue('Example')
+  } as unknown as SeleniumDriverLike
+}
+
+function makeCtx(driver: SeleniumDriverLike) {
+  resetSignatureCounters()
+  const reporter = new TestReporter(vi.fn())
+  const suiteManager = new SuiteManager(reporter)
+  const rootSuite = suiteManager.getOrCreateRootSuite('login.spec.ts', 'Suite')
+  const testManager = new TestManager(rootSuite, reporter, suiteManager)
+  const capturer = new SessionCapturer()
+  capturers.push(capturer)
+
+  const actionSnapshots: ActionSnapshot[] = []
+  const snapshotCaptures: Promise<void>[] = []
+  // Structural ctx: handleOnCommand reads only the capturer, test manager,
+  // options, driver and the two snapshot accumulators.
+  const ctx = {
+    sessionCapturer: capturer,
+    testManager,
+    retryTracker: new RetryTracker(),
+    options: { captureScreenshots: false, mode: 'trace' },
+    finalized: false,
+    driver,
+    actionSnapshots,
+    snapshotCaptures
+  } as unknown as OnCommandCtx
+  return { ctx, capturer, actionSnapshots, snapshotCaptures }
+}
+
+function cmd(overrides: Partial<CapturedCommand>): CapturedCommand {
+  return {
+    command: 'click',
+    args: [],
+    timestamp: 0,
+    startTime: 0,
+    fromElement: true,
+    result: undefined,
+    error: undefined,
+    callSource: undefined,
+    ...overrides
+  }
+}
+
+describe('selenium action-snapshot timestamp binding', () => {
+  it("stamps the snapshot with the logged command's timestamp", async () => {
+    // Regression: the capture resolves after the command completes, so its own
+    // Date.now() never equals cmd.timestamp — and the exporter claims snapshots
+    // by exact equality, so nothing bound and the trace carried no
+    // frame-snapshot events at all.
+    const { ctx, capturer, actionSnapshots, snapshotCaptures } =
+      makeCtx(fakeDriver())
+
+    await handleOnCommand(ctx, cmd({ command: 'click', timestamp: 12345 }))
+    await Promise.all(snapshotCaptures)
+
+    expect(actionSnapshots).toHaveLength(1)
+    expect(actionSnapshots[0]!.timestamp).toBe(12345)
+    expect(actionSnapshots[0]!.timestamp).toBe(
+      capturer.commandsLog[0]!.timestamp
+    )
+  })
+
+  it('does not capture for a non-mapped command', async () => {
+    const { ctx, snapshotCaptures, actionSnapshots } = makeCtx(fakeDriver())
+    await handleOnCommand(
+      ctx,
+      cmd({ command: 'findElement', timestamp: 500, fromElement: false })
+    )
+    await Promise.all(snapshotCaptures)
+    expect(actionSnapshots).toHaveLength(0)
+  })
+
+  it('does not capture for a failed command', async () => {
+    const { ctx, snapshotCaptures, actionSnapshots } = makeCtx(fakeDriver())
+    await handleOnCommand(
+      ctx,
+      cmd({ command: 'click', timestamp: 500, error: new Error('boom') })
+    )
+    await Promise.all(snapshotCaptures)
+    expect(actionSnapshots).toHaveLength(0)
+  })
+})
+
+describe('selenium action-snapshot locator dialect', () => {
+  it('injects the XPath text form, which By.xpath resolves', async () => {
+    // `a*=Logout` is WebdriverIO-only syntax; a Selenium user pastes the
+    // captured locator into `By.xpath`, so the capture must emit XPath.
+    const driver = fakeDriver()
+    const { ctx, snapshotCaptures } = makeCtx(driver)
+
+    await handleOnCommand(ctx, cmd({ command: 'click', timestamp: 1 }))
+    await Promise.all(snapshotCaptures)
+
+    const scripts = vi
+      .mocked(driver.executeScript)
+      .mock.calls.map(([src]) => String(src))
+    expect(scripts).not.toHaveLength(0)
+    for (const src of scripts) {
+      expect(src).not.toContain("tag + '*=' + text")
+    }
+  })
+})
diff --git a/packages/selenium-devtools/tests/captureOrReplaceCommand.test.ts b/packages/selenium-devtools/tests/captureOrReplaceCommand.test.ts
new file mode 100644
index 00000000..445fc949
--- /dev/null
+++ b/packages/selenium-devtools/tests/captureOrReplaceCommand.test.ts
@@ -0,0 +1,82 @@
+import { describe, it, expect } from 'vitest'
+import { RetryTracker } from '@wdio/devtools-core'
+import { captureOrReplaceCommand } from '../src/helpers/captureOrReplaceCommand.js'
+import { SessionCapturer } from '../src/session.js'
+import type { CapturedCommand, TestStats } from '../src/types.js'
+
+const test = { uid: 'test-1' } as TestStats
+
+function command(overrides: Partial<CapturedCommand> = {}): CapturedCommand {
+  return {
+    command: 'click',
+    args: [],
+    result: undefined,
+    error: undefined,
+    callSource: '/spec.js:10:3',
+    timestamp: 1_000,
+    startTime: 950,
+    fromElement: true,
+    ...overrides
+  }
+}
+
+describe('captureOrReplaceCommand', () => {
+  it('stamps the resolved locator and invocation time onto the row', async () => {
+    const capturer = new SessionCapturer({})
+    try {
+      const entry = await captureOrReplaceCommand({
+        capturer,
+        retryTracker: new RetryTracker(),
+        test,
+        cmd: command({ selector: '#username' })
+      })
+      expect(entry.selector).toBe('#username')
+      expect(entry.startTime).toBe(950)
+      expect(capturer.commandsLog[0].selector).toBe('#username')
+    } finally {
+      capturer.cleanup()
+    }
+  })
+
+  it('leaves no locator on a command that resolved none', async () => {
+    const capturer = new SessionCapturer({})
+    try {
+      const entry = await captureOrReplaceCommand({
+        capturer,
+        retryTracker: new RetryTracker(),
+        test,
+        cmd: command({ command: 'get', args: ['http://x'], fromElement: false })
+      })
+      expect(entry.selector).toBeUndefined()
+    } finally {
+      capturer.cleanup()
+    }
+  })
+
+  it('keeps the locator when a retry replaces the row in place', async () => {
+    // replaceCommand mutates the row to preserve `_id`/`id` for chained calls, so
+    // a retry whose handle no longer resolves must not blank the locator.
+    const capturer = new SessionCapturer({})
+    const retryTracker = new RetryTracker()
+    try {
+      const first = await captureOrReplaceCommand({
+        capturer,
+        retryTracker,
+        test,
+        cmd: command({ selector: '#username' })
+      })
+      const retried = await captureOrReplaceCommand({
+        capturer,
+        retryTracker,
+        test,
+        cmd: command({ timestamp: 2_000, startTime: 1_900 })
+      })
+      expect(retried._id).toBe(first._id)
+      expect(capturer.commandsLog).toHaveLength(1)
+      expect(retried.selector).toBe('#username')
+      expect(retried.startTime).toBe(1_900)
+    } finally {
+      capturer.cleanup()
+    }
+  })
+})
diff --git a/packages/selenium-devtools/tests/collector-preload.test.ts b/packages/selenium-devtools/tests/collector-preload.test.ts
new file mode 100644
index 00000000..a7116bd5
--- /dev/null
+++ b/packages/selenium-devtools/tests/collector-preload.test.ts
@@ -0,0 +1,240 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+import { RetryTracker } from '@wdio/devtools-core'
+import type * as DevToolsCore from '@wdio/devtools-core'
+import type { ActionSnapshot } from '@wdio/devtools-shared'
+import { getDriverOriginals } from '../src/driverPatcher.js'
+import { resetSignatureCounters } from '../src/helpers/utils.js'
+import { TestManager } from '../src/helpers/testManager.js'
+import { SuiteManager } from '../src/helpers/suiteManager.js'
+import { TestReporter } from '../src/reporter.js'
+import { SessionCapturer } from '../src/session.js'
+import {
+  captureNavigationTrace,
+  handleOnCommand,
+  type OnCommandCtx
+} from '../src/helpers/commandPostActions.js'
+import { onDriverCreated } from '../src/session-lifecycle.js'
+import type { SessionLifecycleCtx } from '../src/session-lifecycle.js'
+import type { CapturedCommand, SeleniumDriverLike } from '../src/types.js'
+
+const registerCollectorPreload = vi.hoisted(() =>
+  vi.fn(async () => true as boolean)
+)
+
+vi.mock('@wdio/devtools-core', async (importOriginal) => ({
+  ...(await importOriginal<typeof DevToolsCore>()),
+  registerCollectorPreload
+}))
+
+const capturers: SessionCapturer[] = []
+
+function makeCapturer(preloadRegistered: boolean): SessionCapturer {
+  const capturer = new SessionCapturer({}, { id: 'd' } as never)
+  capturer.preloadRegistered = preloadRegistered
+  capturers.push(capturer)
+  return capturer
+}
+
+afterEach(() => {
+  while (capturers.length) {
+    capturers.pop()!.cleanup()
+  }
+  vi.restoreAllMocks()
+})
+
+describe('captureNavigationTrace injection', () => {
+  // Regression: the `<script>` append only instruments the document loaded when
+  // it runs, so its readiness poll raced the first keystrokes on every fresh
+  // page. With the collector registered at document-start there is nothing to
+  // inject, and probing for it is a wasted round trip on the anchor path.
+  it('skips the `<script>` injection when the preload is registered', async () => {
+    const capturer = makeCapturer(true)
+    const inject = vi.spyOn(capturer, 'injectScript').mockResolvedValue()
+    const drain = vi.spyOn(capturer, 'captureTrace').mockResolvedValue()
+
+    captureNavigationTrace(capturer, () => false)
+    await vi.waitFor(() => expect(drain).toHaveBeenCalledWith(true))
+    expect(inject).not.toHaveBeenCalled()
+  })
+
+  it('injects before draining when the preload is unavailable', async () => {
+    const capturer = makeCapturer(false)
+    const order: string[] = []
+    vi.spyOn(capturer, 'injectScript').mockImplementation(async () => {
+      order.push('inject')
+    })
+    vi.spyOn(capturer, 'captureTrace').mockImplementation(async () => {
+      order.push('drain')
+    })
+
+    captureNavigationTrace(capturer, () => false)
+    await vi.waitFor(() => expect(order).toEqual(['inject', 'drain']))
+  })
+})
+
+describe('captureNavigationTrace ordering against the performance read', () => {
+  let restoreExec: (() => void) | undefined
+
+  beforeEach(() => {
+    const originals = getDriverOriginals()
+    const previous = originals.executeScript
+    restoreExec = () => {
+      if (previous) {
+        originals.executeScript = previous
+      } else {
+        delete originals.executeScript
+      }
+    }
+  })
+
+  afterEach(() => {
+    restoreExec?.()
+    restoreExec = undefined
+  })
+
+  // The performance read sits on a 500ms settle; running it first delayed the
+  // drain that moves the destination's DOM anchor out of the page, and a
+  // short-lived page can be gone by then. Perf entries only get more complete
+  // with time — the anchor does not.
+  it('drains the collector before reading the Performance API', async () => {
+    const capturer = makeCapturer(true)
+    const order: string[] = []
+    vi.spyOn(capturer, 'captureTrace').mockImplementation(async () => {
+      order.push('drain')
+    })
+    getDriverOriginals().executeScript = (async () => {
+      order.push('perf')
+      return {}
+    }) as ReturnType<typeof getDriverOriginals>['executeScript']
+
+    captureNavigationTrace(
+      capturer,
+      () => false,
+      { command: 'get', args: [], timestamp: 1 },
+      ['https://example.com'],
+      { id: 'd' } as unknown as SeleniumDriverLike
+    )
+    await vi.waitFor(() => expect(order).toEqual(['drain', 'perf']), {
+      timeout: 4000
+    })
+  })
+})
+
+describe('post-command re-injection', () => {
+  function makeCtx(capturer: SessionCapturer) {
+    resetSignatureCounters()
+    const reporter = new TestReporter(vi.fn())
+    const suiteManager = new SuiteManager(reporter)
+    const rootSuite = suiteManager.getOrCreateRootSuite(
+      'login.spec.ts',
+      'Suite'
+    )
+    const snapshotCaptures: Promise<void>[] = []
+    return {
+      ctx: {
+        sessionCapturer: capturer,
+        testManager: new TestManager(rootSuite, reporter, suiteManager),
+        retryTracker: new RetryTracker(),
+        options: { captureScreenshots: false, mode: 'trace' },
+        finalized: false,
+        driver: undefined,
+        actionSnapshots: [] as ActionSnapshot[],
+        snapshotCaptures
+      } as unknown as OnCommandCtx,
+      snapshotCaptures
+    }
+  }
+
+  const cmd: CapturedCommand = {
+    command: 'sendKeys',
+    args: [],
+    timestamp: 0,
+    startTime: 0,
+    fromElement: true,
+    result: undefined,
+    error: undefined,
+    callSource: undefined
+  }
+
+  // A missing collector is the fallback path's only signal that the document
+  // was replaced; the preload makes that signal permanently false, so the probe
+  // can only ever cost a round trip.
+  it('skips reinjectIfNavigated when the preload is registered', async () => {
+    const capturer = makeCapturer(true)
+    const drain = vi.spyOn(capturer, 'captureTrace').mockResolvedValue()
+    const reinject = vi
+      .spyOn(capturer, 'reinjectIfNavigated')
+      .mockResolvedValue()
+    const { ctx, snapshotCaptures } = makeCtx(capturer)
+
+    await handleOnCommand(ctx, cmd)
+    await Promise.all(snapshotCaptures)
+
+    expect(drain).toHaveBeenCalledWith(true)
+    expect(reinject).not.toHaveBeenCalled()
+  })
+
+  it('still re-injects after a navigation when the preload is unavailable', async () => {
+    const capturer = makeCapturer(false)
+    vi.spyOn(capturer, 'captureTrace').mockResolvedValue()
+    const reinject = vi
+      .spyOn(capturer, 'reinjectIfNavigated')
+      .mockResolvedValue()
+    const { ctx, snapshotCaptures } = makeCtx(capturer)
+
+    await handleOnCommand(ctx, cmd)
+    await Promise.all(snapshotCaptures)
+
+    expect(reinject).toHaveBeenCalledTimes(1)
+  })
+})
+
+describe('per-driver preload registration', () => {
+  function makeLifecycleCtx(): SessionLifecycleCtx {
+    return {
+      options: { hostname: 'localhost', port: 0, mode: 'trace' },
+      screencastOptions: {},
+      detectedRunner: 'mocha',
+      finalized: false,
+      driver: undefined,
+      sessionCapturer: undefined,
+      actionSnapshots: [],
+      snapshotCaptures: [],
+      specRanges: [],
+      flushedSpecs: new Set<string>(),
+      traceFlushes: [],
+      artifacts: [],
+      filmstripFrames: [],
+      setFinalized: () => {},
+      ensureBackendStarted: async () => {},
+      flushPendingTestActions: () => {},
+      resetRetryTracker: () => {},
+      clearKeepAlive: () => {}
+    } as unknown as SessionLifecycleCtx
+  }
+
+  it('marks the capturer once the collector is registered at document-start', async () => {
+    registerCollectorPreload.mockResolvedValueOnce(true)
+    const ctx = makeLifecycleCtx()
+
+    await onDriverCreated(ctx, { id: 'd' } as unknown as SeleniumDriverLike)
+
+    expect(registerCollectorPreload).toHaveBeenCalled()
+    expect(ctx.sessionCapturer?.preloadRegistered).toBe(true)
+    ctx.sessionCapturer?.cleanup()
+  })
+
+  // A session created without `webSocketUrl` has no BiDi channel, so the
+  // script manager throws and the adapter has to stay on the `<script>` path
+  // rather than silently capturing nothing.
+  it('leaves the capturer on the `<script>` path when BiDi is unavailable', async () => {
+    registerCollectorPreload.mockResolvedValueOnce(false)
+    const ctx = makeLifecycleCtx()
+
+    await onDriverCreated(ctx, { id: 'd' } as unknown as SeleniumDriverLike)
+
+    expect(ctx.sessionCapturer?.preloadRegistered).toBe(false)
+    ctx.sessionCapturer?.cleanup()
+  })
+})
diff --git a/packages/selenium-devtools/tests/driverMetadata.test.ts b/packages/selenium-devtools/tests/driverMetadata.test.ts
new file mode 100644
index 00000000..0274b58a
--- /dev/null
+++ b/packages/selenium-devtools/tests/driverMetadata.test.ts
@@ -0,0 +1,71 @@
+import { describe, expect, it } from 'vitest'
+import { buildDriverMetadata } from '../src/helpers/driverMetadata.js'
+import { SELENIUM_RUNNER_ID } from '../src/constants.js'
+import type { SeleniumDriverLike } from '../src/types.js'
+
+function driverStub(sessionId = 'sess-1'): SeleniumDriverLike {
+  return {
+    getSession: () => Promise.resolve({ getId: () => sessionId }),
+    getCapabilities: () =>
+      Promise.resolve({ serialize: () => ({ browserName: 'chrome' }) })
+  } as unknown as SeleniumDriverLike
+}
+
+async function metadataFor(detectedRunner: string | null) {
+  const { metadata } = await buildDriverMetadata({
+    driver: driverStub(),
+    driverReadyTs: Date.now(),
+    detectedRunner
+  })
+  return metadata as {
+    runner?: string
+    options?: { framework?: string; runCapabilities?: Record<string, boolean> }
+  }
+}
+
+describe('buildDriverMetadata', () => {
+  it('names the adapter on the typed `runner` field', async () => {
+    // `runner` means TestRunnerId everywhere; the mocha/jest/cucumber value is
+    // `detectedRunner` and must never leak into this field.
+    const metadata = await metadataFor('mocha')
+
+    expect(metadata?.runner).toBe(SELENIUM_RUNNER_ID)
+  })
+
+  it('leaves the same fact off `options.framework`', async () => {
+    // One carrier per fact: the sidebar reads `Metadata.runner` and only falls
+    // back to the option for zips recorded before that field existed.
+    const metadata = await metadataFor('mocha')
+
+    expect(metadata?.options?.framework).toBeUndefined()
+  })
+
+  it('derives run capabilities from the detected JS runner, not from `runner`', async () => {
+    // Cucumber's `--name` filters scenarios but not Gherkin steps, so leaf-step
+    // rerun stays disabled — a per-detectedRunner distinction the adapter-wide
+    // `runner` value cannot make.
+    expect((await metadataFor('cucumber'))?.options?.runCapabilities).toEqual({
+      canRunSuites: true,
+      canRunTests: false,
+      canRunAll: true
+    })
+    expect((await metadataFor('mocha'))?.options?.runCapabilities).toEqual({
+      canRunSuites: true,
+      canRunTests: true,
+      canRunAll: true
+    })
+  })
+
+  it('returns no metadata when the driver cannot be queried', async () => {
+    const { sessionId, metadata } = await buildDriverMetadata({
+      driver: {
+        getSession: () => Promise.reject(new Error('no such session'))
+      } as unknown as SeleniumDriverLike,
+      driverReadyTs: Date.now(),
+      detectedRunner: 'mocha'
+    })
+
+    expect(sessionId).toBeUndefined()
+    expect(metadata).toBeUndefined()
+  })
+})
diff --git a/packages/selenium-devtools/tests/element-locators.test.ts b/packages/selenium-devtools/tests/element-locators.test.ts
new file mode 100644
index 00000000..17202569
--- /dev/null
+++ b/packages/selenium-devtools/tests/element-locators.test.ts
@@ -0,0 +1,153 @@
+import { describe, it, expect } from 'vitest'
+import { createRequire } from 'node:module'
+import { rememberReadValue } from '@wdio/devtools-core'
+import {
+  locatorToSelector,
+  rememberElementLocator,
+  selectorForElement
+} from '../src/helpers/element-locators.js'
+import { resolveAssertTarget } from '../src/assertPatcher.js'
+
+const require = createRequire(import.meta.url)
+const sw = require('selenium-webdriver')
+const { By, WebElement, WebElementPromise } = sw
+
+// Element commands act on a resolved handle, so these use the real selenium
+// classes: the mechanism turns on one find producing TWO objects for one element
+// (the promise it returns, the element that promise resolves to), neither of
+// which exposes its element id synchronously.
+function webElement(id: string): object {
+  return new WebElement({}, id)
+}
+function webElementPromise(el: object): object {
+  return new WebElementPromise({}, Promise.resolve(el))
+}
+
+describe('locatorToSelector', () => {
+  it('canonicalizes By.id to the #id form the captured elements use', () => {
+    // By.id compiles to `*[id="x"]`, which is equivalent but never string-matches
+    // the `#x` in the captured element records the input point resolves against.
+    expect(locatorToSelector(By.id('username'))).toBe('#username')
+  })
+
+  it('passes css, xpath and tag-name locators through', () => {
+    expect(locatorToSelector(By.css('button[type="submit"]'))).toBe(
+      'button[type="submit"]'
+    )
+    expect(locatorToSelector(By.xpath('//a[@href="/logout"]'))).toBe(
+      '//a[@href="/logout"]'
+    )
+    expect(locatorToSelector(By.tagName('h1'))).toBe('h1')
+  })
+
+  it('reads By.className / By.name through their compiled css', () => {
+    expect(locatorToSelector(By.className('radius'))).toBe('.radius')
+    expect(locatorToSelector(By.name('q'))).toBe('*[name="q"]')
+  })
+
+  it('accepts a bare {using, value} pair and a raw selector string', () => {
+    expect(locatorToSelector({ using: 'css selector', value: '#flash' })).toBe(
+      '#flash'
+    )
+    expect(locatorToSelector('#flash')).toBe('#flash')
+  })
+
+  it('resolves shorthand hash locators the way By does', () => {
+    expect(locatorToSelector({ id: 'username' })).toBe('#username')
+    expect(locatorToSelector({ css: '.btn' })).toBe('.btn')
+    expect(locatorToSelector({ className: 'a b' })).toBe('.a.b')
+    expect(locatorToSelector({ name: 'q' })).toBe('[name="q"]')
+    expect(locatorToSelector({ xpath: '//div' })).toBe('//div')
+  })
+
+  it('returns undefined for locators with no selector equivalent', () => {
+    expect(locatorToSelector(By.linkText('Logout'))).toBeUndefined()
+    expect(locatorToSelector(By.partialLinkText('Log'))).toBeUndefined()
+    expect(locatorToSelector(() => [])).toBeUndefined()
+    expect(locatorToSelector(undefined)).toBeUndefined()
+    expect(locatorToSelector('')).toBeUndefined()
+  })
+})
+
+describe('handle → locator correlation', () => {
+  it('resolves a chained call from the promise findElement returned', () => {
+    // `findElement(By.id('username')).sendKeys(…)` acts on the WebElementPromise
+    // itself, before the element behind it exists.
+    const handle = webElementPromise(webElement('el-1'))
+    rememberElementLocator(handle, By.id('username'))
+    expect(selectorForElement(handle)).toBe('#username')
+  })
+
+  it('resolves an awaited handle, which is a different object', () => {
+    const resolved = webElement('el-1')
+    const handle = webElementPromise(resolved)
+    rememberElementLocator(handle, By.id('username'))
+    rememberElementLocator(resolved, By.id('username'))
+    expect(selectorForElement(resolved)).toBe('#username')
+  })
+
+  it('keeps each handle on its own locator across interleaved finds', () => {
+    // The regression a "last selector wins" scheme causes: Selenium hands out
+    // handles that outlive the find that made them, so the row for the FIRST
+    // handle must not inherit the locator of the most recent find.
+    const user = webElement('el-user')
+    const pass = webElement('el-pass')
+    rememberElementLocator(user, By.id('username'))
+    rememberElementLocator(pass, By.id('password'))
+    expect(selectorForElement(user)).toBe('#username')
+    expect(selectorForElement(pass)).toBe('#password')
+  })
+
+  it('resolves every element of a findElements result', () => {
+    const els = [webElement('el-1'), webElement('el-2')]
+    rememberElementLocator(els, By.css('a[href]'))
+    expect(els.map(selectorForElement)).toEqual(['a[href]', 'a[href]'])
+  })
+
+  it('keeps resolving a handle reused across repeated commands', () => {
+    const el = webElement('el-1')
+    rememberElementLocator(el, By.css('h1'))
+    expect(selectorForElement(el)).toBe('h1')
+    expect(selectorForElement(el)).toBe('h1')
+  })
+
+  it('returns undefined for an unseen handle and a non-object', () => {
+    expect(selectorForElement(webElement('never-found'))).toBeUndefined()
+    expect(selectorForElement(undefined)).toBeUndefined()
+  })
+
+  it('remembers nothing for a locator with no selector equivalent', () => {
+    const el = webElement('el-1')
+    rememberElementLocator(el, By.linkText('Logout'))
+    expect(selectorForElement(el)).toBeUndefined()
+  })
+})
+
+// The value→locator registry itself is core's — see
+// packages/core/tests/read-value-locators.test.ts. These cover only the
+// selenium-side composition of the two provenance sources.
+describe('resolveAssertTarget', () => {
+  it('names the element a read value came from', () => {
+    rememberReadValue('Example Domain', 'h1')
+    expect(resolveAssertTarget(['Example Domain', 'Example Domain'])).toBe('h1')
+  })
+
+  it('names an element handle passed straight to the assert', () => {
+    const el = webElement('el-1')
+    rememberElementLocator(el, By.id('flash'))
+    expect(resolveAssertTarget([el])).toBe('#flash')
+  })
+
+  it('takes the first arg that resolves — node:assert puts the subject first', () => {
+    rememberReadValue('actual-text', '#subject')
+    rememberReadValue('expected-text', '#other')
+    expect(resolveAssertTarget(['actual-text', 'expected-text'])).toBe(
+      '#subject'
+    )
+  })
+
+  it('names nothing when no arg traces back to an element', () => {
+    expect(resolveAssertTarget(['never-read', /a-regexp/])).toBeUndefined()
+    expect(resolveAssertTarget([])).toBeUndefined()
+  })
+})
diff --git a/packages/selenium-devtools/tests/index.test.ts b/packages/selenium-devtools/tests/index.test.ts
index 1e53fb24..199bbd20 100644
--- a/packages/selenium-devtools/tests/index.test.ts
+++ b/packages/selenium-devtools/tests/index.test.ts
@@ -1,4 +1,8 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import {
+  INPUT_DISPATCH_MAX_HOLD_MS,
+  isInputDispatchInFlight
+} from '@wdio/devtools-core'
 import { createRequire } from 'node:module'
 import * as fs from 'node:fs'
 import * as os from 'node:os'
@@ -471,6 +475,45 @@ describe('driverPatcher', () => {
     }
   })
 
+  // A screenshot poll landing inside chromedriver's click, between computing the
+  // element's coordinates and dispatching at them, makes the click report success
+  // while activating nothing. `settle` runs on every path, so the window it closes
+  // must survive a resolve, a reject and a sync throw.
+  it('holds a screencast-poll suppression window until an input command settles', async () => {
+    // The gate is module-scoped in core, so drop anything an earlier case left
+    // open: jump past the hold bound and read once, which is what prunes it.
+    vi.useFakeTimers()
+    vi.setSystemTime(Date.now() + INPUT_DISPATCH_MAX_HOLD_MS + 1)
+    isInputDispatchInFlight()
+    vi.useRealTimers()
+    ;(driverProto as any).click = function () {
+      return Promise.resolve('ok')
+    }
+    ;(driverProto as any).clickBoom = function () {
+      throw new Error('boom')
+    }
+    stash.driverFns.click = (driverProto as any).click
+    stash.driverFns.clickBoom = (driverProto as any).clickBoom
+
+    patchSelenium({ onDriverCreated: vi.fn(), onCommand: vi.fn() })
+    const fakeDriver = Object.create(driverProto)
+
+    const pending = (fakeDriver as any).click()
+    expect(isInputDispatchInFlight()).toBe(true)
+    await pending
+    await new Promise((r) => setImmediate(r))
+    expect(isInputDispatchInFlight()).toBe(false)
+
+    // A command that throws synchronously settles too, so its window closes.
+    expect(() => (fakeDriver as any).clickBoom()).toThrow('boom')
+    expect(isInputDispatchInFlight()).toBe(false)
+
+    for (const m of ['click', 'clickBoom']) {
+      delete (driverProto as any)[m]
+      delete stash.driverFns[m]
+    }
+  })
+
   it('captures sync, async, and throwing wrapper invocations through onCommand', async () => {
     const onCommand = vi.fn<(cmd: CapturedCommand) => void>()
     ;(driverProto as any).testSync = function (n: number) {
@@ -560,6 +603,53 @@ describe('driverPatcher', () => {
       'original-quit'
     ])
   })
+
+  it('threads the locator that produced an element onto its element commands', async () => {
+    const onCommand = vi.fn<(cmd: CapturedCommand) => void>()
+    // One find per element, each resolving to its own handle — the shape
+    // `findElement(By.id('username')).sendKeys(…)` and `await find(...)` produce.
+    const elements = new Map<string, any>([
+      ['#username', new sw.WebElement({}, 'el-user')],
+      ['#password', new sw.WebElement({}, 'el-pass')]
+    ])
+    ;(driverProto as any).findElement = function (locator: any) {
+      const el = elements.get(
+        `#${locator.value.replace(/^\*\[id="|"\]$/g, '')}`
+      )
+      return new sw.WebElementPromise(this, Promise.resolve(el))
+    }
+    ;(elementProto as any).click = function () {
+      return Promise.resolve()
+    }
+    ;(elementProto as any).sendKeys = function () {
+      return Promise.resolve()
+    }
+    patchSelenium({ onDriverCreated: vi.fn(), onCommand })
+    const driver = Object.create(driverProto)
+
+    // Chained: the command runs against the promise, before the element exists.
+    await (driver as any).findElement(sw.By.id('username')).sendKeys('tomsmith')
+    // Awaited: the handle is a different object, and the find that produced it is
+    // no longer the most recent one — a "last selector" scheme would say #password.
+    const user = await (driver as any).findElement(sw.By.id('username'))
+    await (driver as any).findElement(sw.By.id('password'))
+    await user.click()
+    await new Promise((r) => setImmediate(r))
+
+    const selectorsByCommand = onCommand.mock.calls
+      .map(([cmd]) => cmd)
+      .filter((cmd) => cmd.fromElement)
+      .map((cmd) => [cmd.command, cmd.selector])
+    expect(selectorsByCommand).toEqual([
+      ['sendKeys', '#username'],
+      ['click', '#username']
+    ])
+    // A driver-level command owns its args and must not claim an element locator.
+    const find = onCommand.mock.calls
+      .map(([cmd]) => cmd)
+      .find((cmd) => cmd.command === 'findElement')
+    expect(find?.selector).toBeUndefined()
+  })
 })
 
 // ───── RerunManager ─────────────────────────────────────────────────────────
diff --git a/packages/selenium-devtools/tests/live-drain.test.ts b/packages/selenium-devtools/tests/live-drain.test.ts
new file mode 100644
index 00000000..e563cf9d
--- /dev/null
+++ b/packages/selenium-devtools/tests/live-drain.test.ts
@@ -0,0 +1,174 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+import { RetryTracker } from '@wdio/devtools-core'
+import type { ActionSnapshot } from '@wdio/devtools-shared'
+import { resetSignatureCounters } from '../src/helpers/utils.js'
+import { TestManager } from '../src/helpers/testManager.js'
+import { SuiteManager } from '../src/helpers/suiteManager.js'
+import { TestReporter } from '../src/reporter.js'
+import { SessionCapturer } from '../src/session.js'
+import {
+  handleOnCommand,
+  type OnCommandCtx
+} from '../src/helpers/commandPostActions.js'
+import type { CapturedCommand, DevToolsMode } from '../src/types.js'
+
+const capturers: SessionCapturer[] = []
+
+afterEach(() => {
+  while (capturers.length) {
+    capturers.pop()!.cleanup()
+  }
+})
+
+function makeCtx(mode: DevToolsMode) {
+  resetSignatureCounters()
+  const reporter = new TestReporter(vi.fn())
+  const suiteManager = new SuiteManager(reporter)
+  const rootSuite = suiteManager.getOrCreateRootSuite('login.spec.ts', 'Suite')
+  const testManager = new TestManager(rootSuite, reporter, suiteManager)
+  const capturer = new SessionCapturer()
+  capturers.push(capturer)
+
+  // The drain itself needs a real browser; only the decision is under test.
+  const liveDrain = vi
+    .spyOn(capturer, 'drainAfterLiveCommand')
+    .mockResolvedValue()
+  const traceDrain = vi.spyOn(capturer, 'captureTrace').mockResolvedValue()
+  const reinject = vi.spyOn(capturer, 'reinjectIfNavigated').mockResolvedValue()
+
+  const snapshotCaptures: Promise<void>[] = []
+  const ctx = {
+    sessionCapturer: capturer,
+    testManager,
+    retryTracker: new RetryTracker(),
+    options: { captureScreenshots: false, mode },
+    finalized: false,
+    // No driver: keeps the trace-mode per-action snapshot path out of the way.
+    driver: undefined,
+    actionSnapshots: [] as ActionSnapshot[],
+    snapshotCaptures
+  } as unknown as OnCommandCtx
+
+  return { ctx, snapshotCaptures, liveDrain, traceDrain, reinject }
+}
+
+function cmd(overrides: Partial<CapturedCommand>): CapturedCommand {
+  return {
+    command: 'click',
+    args: [],
+    timestamp: 0,
+    startTime: 0,
+    fromElement: true,
+    result: undefined,
+    error: undefined,
+    callSource: undefined,
+    ...overrides
+  }
+}
+
+describe('selenium live-mode DOM drain', () => {
+  // Regression: live mode reconstructs the DOM purely from the mutation stream
+  // and only the navigation hook drained it, so every row between two document
+  // loads replayed the page as it loaded — an unfilled form after sendKeys, and
+  // the destination of a navigating click never anchored at all.
+  it.each([
+    ['sendKeys', true],
+    ['click', true],
+    ['clear', true],
+    ['getText', true],
+    ['getCurrentUrl', false]
+  ])('drains after %s', async (command, fromElement) => {
+    const { ctx, snapshotCaptures, liveDrain } = makeCtx('live')
+    await handleOnCommand(ctx, cmd({ command, fromElement }))
+    await Promise.all(snapshotCaptures)
+    expect(liveDrain).toHaveBeenCalledTimes(1)
+  })
+
+  it.each([
+    // Already drained (and re-anchored) by captureNavigationTrace.
+    ['get', false],
+    ['refresh', false],
+    // Resolving a locator cannot change the DOM.
+    ['findElement', false],
+    ['findElements', false],
+    // A node:assert row never reaches the browser.
+    ['assert.equal', false]
+  ])('does not drain after %s', async (command, fromElement) => {
+    const { ctx, snapshotCaptures, liveDrain } = makeCtx('live')
+    await handleOnCommand(ctx, cmd({ command, fromElement }))
+    await Promise.all(snapshotCaptures)
+    expect(liveDrain).not.toHaveBeenCalled()
+  })
+
+  it('leaves trace mode on its own pre-navigation flush', async () => {
+    const { ctx, snapshotCaptures, liveDrain, traceDrain, reinject } =
+      makeCtx('trace')
+    await handleOnCommand(ctx, cmd({ command: 'sendKeys', fromElement: true }))
+    await Promise.all(snapshotCaptures)
+
+    expect(liveDrain).not.toHaveBeenCalled()
+    expect(traceDrain).toHaveBeenCalledWith(true)
+    expect(reinject).toHaveBeenCalledTimes(1)
+  })
+
+  it('takes no drain at all in trace mode for a read', async () => {
+    const { ctx, snapshotCaptures, liveDrain, traceDrain } = makeCtx('trace')
+    await handleOnCommand(ctx, cmd({ command: 'getText', fromElement: true }))
+    await Promise.all(snapshotCaptures)
+
+    expect(liveDrain).not.toHaveBeenCalled()
+    expect(traceDrain).not.toHaveBeenCalled()
+  })
+
+  it('skips the drain once the session is finalized', async () => {
+    const { ctx, snapshotCaptures, liveDrain } = makeCtx('live')
+    ;(ctx as { finalized: boolean }).finalized = true
+    await handleOnCommand(ctx, cmd({ command: 'sendKeys', fromElement: true }))
+    await Promise.all(snapshotCaptures)
+    expect(liveDrain).not.toHaveBeenCalled()
+  })
+})
+
+describe('SessionCapturer.drainAfterLiveCommand', () => {
+  it('serializes drains so their batches stay in issue order', async () => {
+    // The driver patcher does not await onCommand, so overlapping drains can
+    // push their batches out of timestamp order — and the dashboard stops
+    // replaying at the first entry past the selected row's window.
+    const capturer = new SessionCapturer()
+    capturers.push(capturer)
+
+    const order: string[] = []
+    let release: (() => void) | undefined
+    vi.spyOn(capturer, 'captureTrace').mockImplementation(async () => {
+      order.push(`start${order.length}`)
+      if (!release) {
+        await new Promise<void>((resolve) => {
+          release = resolve
+        })
+      }
+    })
+
+    const first = capturer.drainAfterLiveCommand()
+    const second = capturer.drainAfterLiveCommand()
+    await Promise.resolve()
+    expect(order).toEqual(['start0'])
+
+    release!()
+    await Promise.all([first, second])
+    expect(order).toEqual(['start0', 'start1'])
+  })
+
+  it('swallows a drain failure so the next one still runs', async () => {
+    const capturer = new SessionCapturer()
+    capturers.push(capturer)
+    const trace = vi
+      .spyOn(capturer, 'captureTrace')
+      .mockRejectedValueOnce(new Error('no such session'))
+      .mockResolvedValue()
+
+    await expect(capturer.drainAfterLiveCommand()).resolves.toBeUndefined()
+    await expect(capturer.drainAfterLiveCommand()).resolves.toBeUndefined()
+    expect(trace).toHaveBeenCalledTimes(2)
+  })
+})
diff --git a/packages/selenium-devtools/tests/session.test.ts b/packages/selenium-devtools/tests/session.test.ts
index e95553dd..786a7e02 100644
--- a/packages/selenium-devtools/tests/session.test.ts
+++ b/packages/selenium-devtools/tests/session.test.ts
@@ -216,7 +216,9 @@ describe('selenium SessionCapturer (with stashed executeScript)', () => {
         }
         if (s.includes('wdioTraceCollector')) {
           collectorReadyCalls++
-          return collectorReadyCalls >= 1
+          // Absent on the pre-injection probe, present once injected — the
+          // real sequence on a navigation destination.
+          return scriptInjected
         }
         return undefined
       })
@@ -227,6 +229,30 @@ describe('selenium SessionCapturer (with stashed executeScript)', () => {
     }
   )
 
+  it.skipIf(!scriptPackageAvailable)(
+    'skips injection when a collector is already live on the document',
+    async () => {
+      // Injecting over a live collector replaces the global with a fresh
+      // instance and discards its buffered full-DOM anchor, which is how a
+      // navigation destination's DOM went missing from the trace entirely.
+      let scriptInjected = false
+      stubExec(async (_driver, script) => {
+        const s = String(script)
+        if (s.includes('createElement')) {
+          scriptInjected = true
+          return true
+        }
+        if (s.includes('wdioTraceCollector')) {
+          return true
+        }
+        return undefined
+      })
+      const cap = makeCapturer({ id: 'd' })
+      await cap.injectScript()
+      expect(scriptInjected).toBe(false)
+    }
+  )
+
   it('injectScript swallows ECONNREFUSED / no-such-session errors silently', async () => {
     stubExec(async () => {
       throw new Error('ECONNREFUSED')
diff --git a/packages/service/src/action-snapshot.ts b/packages/service/src/action-snapshot.ts
index f8dc7fe9..d30d7e5c 100644
--- a/packages/service/src/action-snapshot.ts
+++ b/packages/service/src/action-snapshot.ts
@@ -10,11 +10,13 @@
 
 import {
   captureActionSnapshot as coreCapture,
-  mapCommandToAction
+  mapCommandToAction,
+  upsertRichestSnapshot
 } from '@wdio/devtools-core'
 import type { ActionSnapshot } from '@wdio/devtools-shared'
 import { isNativeMobile, mobilePlatform } from './mobile.js'
 import { INTERNAL_COMMANDS } from './constants.js'
+import { wdioRunnerId } from './wdio-runner-id.js'
 
 function reviveScript(src: string): () => unknown {
   // `src` from core/element-scripts is already a self-invoking IIFE
@@ -74,10 +76,13 @@ export async function captureActionResult(
   if (!isNativeMobile(browser)) {
     await waitForActionResult(browser)
   }
-  const snap = await captureActionSnapshot(browser, command)
+  // Stamped before the capture, not after: a snapshot probe can never enter
+  // commandsLog (beforeCommand requires an empty command stack), so the latest
+  // logged action is the same either way — and reading it up front keeps the
+  // stamp a capture input rather than a post-hoc mutation.
+  const snap = await captureActionSnapshot(browser, command, stampTimestamp())
   if (snap) {
-    snap.timestamp = stampTimestamp()
-    actionSnapshots.push(snap)
+    upsertRichestSnapshot(actionSnapshots, snap)
   }
 }
 
@@ -92,20 +97,22 @@ export async function pushActionSnapshotAt(
   timestamp: number,
   actionSnapshots: ActionSnapshot[]
 ): Promise<void> {
-  const snap = await captureActionSnapshot(browser, command)
+  const snap = await captureActionSnapshot(browser, command, timestamp)
   if (snap) {
-    snap.timestamp = timestamp
-    actionSnapshots.push(snap)
+    upsertRichestSnapshot(actionSnapshots, snap)
   }
 }
 
 export function captureActionSnapshot(
   browser: WebdriverIO.Browser,
-  command: string
+  command: string,
+  timestamp?: number
 ): Promise<ActionSnapshot | null> {
   const native = isNativeMobile(browser)
   return coreCapture({
     command,
+    timestamp,
+    runner: wdioRunnerId(browser),
     runScript: native ? undefined : (src) => browser.execute(reviveScript(src)),
     takeScreenshot: () => browser.takeScreenshot().catch(() => undefined),
     // url/title are browser-only concepts — they fail with "Method has not
diff --git a/packages/service/src/index.ts b/packages/service/src/index.ts
index 67515d90..e586c99e 100644
--- a/packages/service/src/index.ts
+++ b/packages/service/src/index.ts
@@ -2,19 +2,17 @@
 import logger from '@wdio/logger'
 import {
   attachTraceArtifact,
+  beginInputDispatch,
   captureAndAttachScreenshot,
-  captureAndAttachVideo,
   errorMessage,
-  finalizeScreencast,
   finalizeTraceExport,
   lastRenderedScreenshot,
   mapCommandToAction,
-  recordSliceBoundary,
   resolveAdapterOutputDir,
   stepMetadataUid,
   TestAttemptTracker,
   tracePolicyModeWarning,
-  type SpecRange,
+  upsertRichestSnapshot,
   type TraceArtifact,
   type TraceExportContext
 } from '@wdio/devtools-core'
@@ -30,20 +28,12 @@ import {
   type TestOutcomeResult
 } from './test-metadata.js'
 import { resolveCallSourceFromFrame } from './call-source.js'
-import { flushPrevSlice, flushTestSlice } from './trace-slices.js'
+import { TraceSliceTracker } from './trace-slices.js'
 import {
   captureActionResult,
   captureActionSnapshot
 } from './action-snapshot.js'
-import {
-  dedupeSnapshotsByTimestamp,
-  upsertRichestSnapshot
-} from './snapshot-dedupe.js'
-import type {
-  ActionSnapshot,
-  ScreencastFrame,
-  TestMetadataMap
-} from '@wdio/devtools-shared'
+import type { ActionSnapshot, TestMetadataMap } from '@wdio/devtools-shared'
 import { SevereServiceError } from 'webdriverio'
 import type { Services, Capabilities, Options, Reporters } from '@wdio/types'
 import type { WebDriverCommands } from '@wdio/protocols'
@@ -56,14 +46,10 @@ import {
   getBrowserObject,
   isUserSpecFile
 } from './utils.js'
-import { ScreencastRecorder } from './screencast.js'
+import { ScreencastLifecycle } from './screencast-lifecycle.js'
 import { attachBidiListeners } from './bidi-listeners.js'
 import { parse } from 'stack-trace'
-import {
-  type ScreencastOptions,
-  type ServiceOptions,
-  TraceType
-} from './types.js'
+import { type ServiceOptions, TraceType } from './types.js'
 import {
   CONTEXT_CHANGE_COMMANDS,
   INTERNAL_COMMANDS,
@@ -71,6 +57,7 @@ import {
   PAGE_TRANSITION_COMMANDS
 } from './constants.js'
 import { isNativeMobile } from './mobile.js'
+import { stampRunnerMetadata } from './wdio-runner-id.js'
 import { detectInvocationConfigPath } from './standalone.js'
 
 export * from './types.js'
@@ -90,11 +77,11 @@ export default class DevToolsHookService implements Services.ServiceInstance {
   #testReporters: TestReporter[] = []
   #sessionCapturer = new SessionCapturer()
   #browser?: WebdriverIO.Browser
-  #screencastRecorder?: ScreencastRecorder
-  #screencastOptions?: ScreencastOptions
   #options: ServiceOptions
   #actionSnapshots: ActionSnapshot[] = []
   #assertionTracker: AssertionTracker
+  #screencast: ScreencastLifecycle
+  #slices: TraceSliceTracker
 
   constructor(serviceOptions: ServiceOptions = {}) {
     this.#options = serviceOptions
@@ -113,15 +100,22 @@ export default class DevToolsHookService implements Services.ServiceInstance {
     if (policyWarning) {
       log.warn(policyWarning)
     }
-    if (serviceOptions.mode === 'trace' && serviceOptions.screencast?.enabled) {
-      log.warn(
-        'trace mode: `screencast.enabled` is ignored — use `video` to record; ' +
-          'the tuning fields (quality/interval) still apply'
-      )
-    }
-    // Tuning is kept for both modes; whether we actually record is decided by
-    // #shouldRecordScreencast (screencast.enabled in live, `video` in trace).
-    this.#screencastOptions = serviceOptions.screencast
+    this.#screencast = new ScreencastLifecycle({
+      options: this.#options,
+      getBrowser: () => this.#browser,
+      getCapturer: () => this.#sessionCapturer,
+      getOutputDir: () => this.#outputDir,
+      getTestUid: () => this.#currentTestUid,
+      getTestStartWallTime: () => this.#currentTestStartWallTime,
+      onArtifact: (artifact) => this.#artifacts.push(artifact),
+      log: (level, message) => log[level](message)
+    })
+    this.#slices = new TraceSliceTracker({
+      options: this.#options,
+      getBrowser: () => this.#browser,
+      getCapturer: () => this.#sessionCapturer,
+      buildExportContext: (browser) => this.#traceContext(browser)
+    })
   }
 
   /**
@@ -130,6 +124,12 @@ export default class DevToolsHookService implements Services.ServiceInstance {
    */
   #commandStack: CommandFrame[] = []
 
+  /** Closes the running command's screenshot-polling suppression window. Single
+   *  slot because WDIO serialises commands per session; a concurrent pair (e.g.
+   *  multiremote) closes the earlier window early, degrading to unguarded
+   *  polling rather than stalling the recorder. */
+  #closeInputWindow?: () => void
+
   /** Current test UID, set in beforeTest(), used by afterCommand() to tag commands. */
   #currentTestUid?: string
   /** Current Cucumber step UID, set in beforeStep(), used by afterCommand() to
@@ -146,21 +146,6 @@ export default class DevToolsHookService implements Services.ServiceInstance {
    *  the lower bound of that test's video frame window (per-test slicing). */
   #currentTestStartWallTime = 0
 
-  /** Recorder frames snapshotted in onReload before reloadSession replaces the
-   *  recorder — so the ending test's per-test video can still be sliced in
-   *  afterScenario (which runs AFTER the cucumber After hook's reloadSession). */
-  #pendingVideoFrames?: {
-    testUid: string | undefined
-    startWallTime: number
-    frames: ScreencastFrame[]
-  }
-
-  /** Filmstrip frames accumulated across reloadSession() boundaries — the
-   *  recorder's buffer resets per session, so this persists earlier sessions'
-   *  frames (like #actionSnapshots) and is concatenated with the live recorder's
-   *  frames at export, then windowed per slice in core. Filmstrip mode only. */
-  #filmstripFrames: ScreencastFrame[] = []
-
   /** Map of testUid → metadata for trace group events and per-spec partitioning. */
   #testMetadata: TestMetadataMap = new Map()
 
@@ -169,96 +154,10 @@ export default class DevToolsHookService implements Services.ServiceInstance {
    *  (Mocha this.retries(n)); cross-worker attempts rely on the WDIO result. */
   #attemptTracker = new TestAttemptTracker()
 
-  /** Index ranges into the session capturer's flat arrays, one per spec file. */
-  #specRanges: SpecRange[] = []
-
-  /** Set of spec files already flushed to disk. */
-  #flushedSpecs = new Set<string>()
-
   /** Every trace/video artifact seen this run (retained or not), for the
    *  end-of-run artifacts manifest. Populated via the context's onArtifact. */
   #artifacts: TraceArtifact[] = []
 
-  /** Build the boundary context for recordSliceBoundary — the same shape is
-   *  needed in both beforeTest and beforeScenario. */
-  get #boundaryContext() {
-    return {
-      specRanges: this.#specRanges,
-      flushedSpecs: this.#flushedSpecs,
-      capturer: this.#sessionCapturer
-    }
-  }
-
-  /** Record a trace-slice boundary. `spec` slices per file; `test` per test
-   *  (retries keyed per attempt by core); `session` records nothing. The
-   *  previous-slice flush fires for `spec`; `test` slices eager-flush at their
-   *  own test end (see #eagerFlushTestSlice) so this is only a missed-slice net. */
-  #recordBoundary(specFile: string | undefined, testUid?: string): void {
-    if (!specFile) {
-      return
-    }
-    const prevRange = recordSliceBoundary(
-      this.#boundaryContext,
-      this.#options.traceGranularity,
-      specFile,
-      testUid
-    )
-    if (prevRange && this.#browser) {
-      flushPrevSlice(this.#traceContext(this.#browser), prevRange)
-    }
-  }
-
-  /** Record a screencast this session? Live mode: `screencast.enabled`. Trace
-   *  mode: a non-`off` `video` policy (frames sliced per test at flush) or
-   *  `filmstrip` (dense frames written into the trace itself). */
-  /** Filmstrip defaults ON in trace mode; explicit `filmstrip: false` opts out. */
-  #filmstripOn(): boolean {
-    return this.#options.filmstrip ?? true
-  }
-
-  #shouldRecordScreencast(): boolean {
-    if (this.#options.mode === 'trace') {
-      return (
-        (!!this.#options.video && this.#options.video !== 'off') ||
-        this.#filmstripOn()
-      )
-    }
-    return !!this.#screencastOptions?.enabled
-  }
-
-  /** Whole-run filmstrip frames for the export context: earlier sessions'
-   *  accumulated frames plus the live recorder's, or undefined when filmstrip
-   *  is off (so the trace stays byte-stable with today's output). */
-  #filmstripFramesForExport(): ScreencastFrame[] | undefined {
-    if (!this.#filmstripOn()) {
-      return undefined
-    }
-    return [
-      ...this.#filmstripFrames,
-      ...(this.#screencastRecorder?.frames ?? [])
-    ]
-  }
-
-  /** Eager per-test flush at test end (test granularity only), run after the
-   *  outcome is stamped so this attempt's metadata is written before a retry
-   *  overwrites it; the end-of-run finalizer then dedupes it via the key set. */
-  async #eagerFlushTestSlice(
-    testUid: string
-  ): Promise<TraceArtifact | undefined> {
-    if (
-      this.#options.traceGranularity !== 'test' ||
-      this.#options.mode !== 'trace' ||
-      !this.#browser
-    ) {
-      return undefined
-    }
-    return flushTestSlice(
-      this.#traceContext(this.#browser),
-      this.#specRanges,
-      testUid
-    )
-  }
-
   /** Assemble the framework-agnostic trace-export context from this service's
    *  state. Output dir ignores the spec range — WDIO writes next to config. */
   #traceContext(browser: WebdriverIO.Browser): TraceExportContext {
@@ -269,16 +168,15 @@ export default class DevToolsHookService implements Services.ServiceInstance {
       format: this.#options.traceFormat,
       capturer: this.#sessionCapturer,
       actionSnapshots: this.#actionSnapshots,
-      screencastFrames: this.#filmstripFramesForExport(),
+      screencastFrames: this.#screencast.filmstripFramesForExport(),
       sessionId: browser.sessionId,
       capabilities: browser.capabilities,
       testMetadata: this.#testMetadata,
       attemptInfoAvailable: true,
       outcomes: this.#attemptTracker,
-      ranges: this.#specRanges,
-      flushed: this.#flushedSpecs,
+      ranges: this.#slices.ranges,
+      flushed: this.#slices.flushed,
       resolveOutputDir: () => this.#outputDir,
-      prepareSnapshots: dedupeSnapshotsByTimestamp,
       log: (level, msg) => log[level](msg),
       emitManifest:
         this.#options.emitArtifactsManifest ?? this.#allureReporterConfigured,
@@ -317,6 +215,7 @@ export default class DevToolsHookService implements Services.ServiceInstance {
     this.#sessionCapturer = new SessionCapturer(
       wdioCaps['wdio:devtoolsOptions']
     )
+    stampRunnerMetadata(this.#sessionCapturer, browser, this.captureType)
 
     if (this.#options.captureAssertions !== false) {
       wireAssertCapture(
@@ -346,18 +245,7 @@ export default class DevToolsHookService implements Services.ServiceInstance {
       attachBidiListeners(browser, this.#sessionCapturer)
     }
 
-    /**
-     * Start screencast recording when enabled — `screencast.enabled` in live
-     * mode, or a non-`off` `video` policy (per-test slicing at flush) or
-     * `filmstrip` (dense frames into the trace) in trace mode. Failures are
-     * non-fatal — logged, session continues.
-     */
-    if (this.#shouldRecordScreencast()) {
-      this.#screencastRecorder = new ScreencastRecorder(
-        this.#screencastOptions ?? {}
-      )
-      await this.#screencastRecorder.start(browser)
-    }
+    await this.#screencast.start(browser)
 
     /**
      * propagate session metadata at the beginning of the session.
@@ -371,7 +259,8 @@ export default class DevToolsHookService implements Services.ServiceInstance {
             viewport: viewport || undefined,
             type: this.captureType,
             options: browser.options,
-            capabilities: browser.capabilities as Capabilities.W3CCapabilities
+            capabilities: browser.capabilities as Capabilities.W3CCapabilities,
+            runner: this.#sessionCapturer.metadata?.runner
           })
         )
     }
@@ -469,7 +358,7 @@ export default class DevToolsHookService implements Services.ServiceInstance {
           )
         : undefined
 
-    this.#recordBoundary(featureFile, uid)
+    this.#slices.recordBoundary(featureFile, uid)
 
     // ── Test identity for command tagging ──
     if (uid && scenarioName && featureFile) {
@@ -495,7 +384,7 @@ export default class DevToolsHookService implements Services.ServiceInstance {
     const testTitle = test?.fullTitle || test?.title
     const uid = testTitle ? testMetadataUid(test?.file, testTitle) : undefined
 
-    this.#recordBoundary(test?.file, uid)
+    this.#slices.recordBoundary(test?.file, uid)
 
     if (uid && testTitle) {
       this.#currentTestUid = uid
@@ -594,7 +483,7 @@ export default class DevToolsHookService implements Services.ServiceInstance {
     const attach = await getAllureSink()
     const onLog = (level: 'info' | 'warn', msg: string) => log[level](msg)
     if (uid) {
-      const artifact = await this.#eagerFlushTestSlice(uid)
+      const artifact = await this.#slices.flushTest(uid)
       if (artifact) {
         await attachTraceArtifact(artifact, attach, onLog)
       }
@@ -618,28 +507,11 @@ export default class DevToolsHookService implements Services.ServiceInstance {
     // #stampOutcome, which ran just before this). Scopes retention + the video
     // filename to this attempt so retries don't overwrite each other.
     const attempt = uid ? this.#testMetadata.get(uid)?.attempt : undefined
-    // Prefer frames snapshotted in onReload (reloadSession tears the recorder
-    // down before this hook); fall back to the live recorder otherwise.
-    const pending =
-      this.#pendingVideoFrames?.testUid === uid
-        ? this.#pendingVideoFrames
-        : undefined
-    this.#pendingVideoFrames = undefined
-    await captureAndAttachVideo({
-      mode: this.#options.mode,
-      granularity: this.#options.traceGranularity,
-      policy: this.#options.video,
-      frames: pending?.frames ?? this.#screencastRecorder?.frames,
-      startWallTime: pending?.startWallTime ?? this.#currentTestStartWallTime,
-      outcomes: uid ? this.#attemptTracker.forTest(uid, attempt) : [],
-      attempt,
-      outputDir: this.#outputDir,
+    await this.#screencast.attachTestVideo({
       testUid: uid,
-      sessionId: this.#browser?.sessionId,
-      captureFormat: this.#screencastOptions?.captureFormat,
-      attach,
-      onArtifact: (a) => this.#artifacts.push(a),
-      onLog
+      attempt,
+      outcomes: uid ? this.#attemptTracker.forTest(uid, attempt) : [],
+      attach
     })
   }
 
@@ -666,10 +538,12 @@ export default class DevToolsHookService implements Services.ServiceInstance {
     // otherwise never be captured before teardown. forceAnchor: the destination's
     // async initial anchor may not have run yet, so anchor it synchronously here.
     await this.#sessionCapturer.captureTrace(this.#browser, true)
-    const stamp = this.#lastActionTimestamp()
-    const snap = await captureActionSnapshot(this.#browser, '__final__')
+    const snap = await captureActionSnapshot(
+      this.#browser,
+      '__final__',
+      this.#lastActionTimestamp()
+    )
     if (snap) {
-      snap.timestamp = stamp
       // The last action's post-capture shares this timestamp and resources are
       // named by timestamp, so keep only the richer screenshot — a blank
       // end-of-scenario frame must not clobber the action's real result.
@@ -690,6 +564,10 @@ export default class DevToolsHookService implements Services.ServiceInstance {
 
   private resetStack() {
     this.#commandStack = []
+    // No command is in flight after a reset; without this a window stranded by a
+    // spec boundary would keep dropping frames until its bound expired.
+    this.#closeInputWindow?.()
+    this.#closeInputWindow = undefined
     this.#assertionTracker.reset()
     this.#sessionCapturer.resetLastSelector()
     this.#sessionCapturer.resetRetryTracker()
@@ -716,11 +594,17 @@ export default class DevToolsHookService implements Services.ServiceInstance {
     if (!this.#browser) {
       return
     }
-    // On first URL navigation, mark the start of meaningful recording so
-    // leading blank frames (pre-test pauses, etc.) are trimmed from the video.
-    // Fires regardless of runner (Mocha, Jasmine, Cucumber, standalone).
+    // Suppress screenshot polling for the duration of an input-dispatching
+    // command: a poll landing inside chromedriver's click, between computing the
+    // element's coordinates and dispatching at them, makes the click report
+    // success while activating nothing. Opened before the pre-action probes below
+    // so it spans the whole command.
+    this.#closeInputWindow?.()
+    this.#closeInputWindow = beginInputDispatch(command)
+    // `url` is the one start-of-recording signal every runner reaches (Mocha,
+    // Jasmine, Cucumber, standalone), so the video's start marker hangs off it.
     if (command === 'url') {
-      this.#screencastRecorder?.setStartMarker()
+      this.#screencast.markStart()
       this.#sessionCapturer.sendUpstream('metadata', { url: args[0] })
     }
     // Smart stack filtering to detect top-level user commands. This bookkeeping
@@ -757,10 +641,13 @@ export default class DevToolsHookService implements Services.ServiceInstance {
       mapCommandToAction(command) &&
       !INTERNAL_COMMANDS.includes(command)
     ) {
-      const snap = await captureActionSnapshot(this.#browser, command)
+      const snap = await captureActionSnapshot(
+        this.#browser,
+        command,
+        this.#lastActionTimestamp()
+      )
       if (snap) {
-        snap.timestamp = this.#lastActionTimestamp()
-        this.#actionSnapshots.push(snap)
+        upsertRichestSnapshot(this.#actionSnapshots, snap)
       }
       // Tag the current document so the post-action capture can tell whether
       // this action navigated (a new document drops the tag).
@@ -789,6 +676,8 @@ export default class DevToolsHookService implements Services.ServiceInstance {
     if (this.#injecting) {
       return
     }
+    this.#closeInputWindow?.()
+    this.#closeInputWindow = undefined
 
     // Record every element resolution, even those below the top-level command
     // boundary — an `expect($('#flash'))` resolves its element inside the
@@ -872,7 +761,7 @@ export default class DevToolsHookService implements Services.ServiceInstance {
     }
 
     // Stop and encode the screencast for the current session.
-    await this.#finalizeScreencast(this.#browser.sessionId)
+    await this.#screencast.finalize(this.#browser.sessionId)
 
     await finalizeTraceExport(this.#traceContext(this.#browser))
 
@@ -881,52 +770,20 @@ export default class DevToolsHookService implements Services.ServiceInstance {
   }
 
   /**
-   * Called by WebdriverIO after browser.reloadSession() completes.
-   * The old browser session (and its CDP connection) is destroyed at this
-   * point, so any in-flight screencast is already dead. We encode whatever
-   * frames were captured for the old session and then start a fresh recorder
-   * on the new session so the second scenario is also covered.
+   * Called by WebdriverIO after browser.reloadSession() completes. The old
+   * session (and its CDP connection) is destroyed at this point, so both the
+   * page instrumentation and the screencast have to be re-armed for the new one.
    */
   async onReload(oldSessionId: string, _newSessionId: string) {
     // reloadSession starts a fresh session with no preload script (BiDi preload
     // scripts are per-session), so DOM-mutation capture would silently stop
     // after the first session — every post-reload scenario would replay the
     // prior session's last DOM. Re-arm capture for the new session here,
-    // independent of screencast, so it runs before the early-return below.
+    // independent of screencast, so it runs before that early-returns.
     this.#sessionCapturer.resetScriptInjection()
     await this.#ensureInjected('reloadSession')
 
-    if (!this.#shouldRecordScreencast() || !this.#browser) {
-      return
-    }
-
-    // Trace mode: the ending test's afterScenario runs AFTER this reload (a
-    // cucumber `After(() => reloadSession())` is WDIO boilerplate), by which
-    // point the recorder below has replaced these frames. Snapshot them now,
-    // keyed to the ending test, so afterScenario can still slice its video.
-    if (this.#options.mode === 'trace' && this.#screencastRecorder) {
-      const frames = [...this.#screencastRecorder.frames]
-      this.#pendingVideoFrames = {
-        testUid: this.#currentTestUid,
-        startWallTime: this.#currentTestStartWallTime,
-        frames
-      }
-      // Persist for the filmstrip too — the recorder below resets the buffer,
-      // so a session/spec trace spanning this reload keeps its earlier frames.
-      if (this.#options.filmstrip) {
-        this.#filmstripFrames.push(...frames)
-      }
-    }
-
-    // Finalize the recording from the old session (CDP is already gone, so
-    // stop() will fail gracefully and we encode whatever frames arrived).
-    await this.#finalizeScreencast(oldSessionId)
-
-    // Start a new recorder for the new session.
-    this.#screencastRecorder = new ScreencastRecorder(
-      this.#screencastOptions ?? {}
-    )
-    await this.#screencastRecorder.start(this.#browser)
+    await this.#screencast.handleReload(oldSessionId)
   }
 
   /**
@@ -952,39 +809,6 @@ export default class DevToolsHookService implements Services.ServiceInstance {
     })
   }
 
-  /**
-   * Stops the current screencast recorder, encodes collected frames into a
-   * .webm file, and notifies the backend. Safe to call even if recording
-   * never started or the CDP session died early.
-   */
-  async #finalizeScreencast(sessionId: string) {
-    if (!this.#screencastRecorder) {
-      return
-    }
-    // Trace mode: the video is emitted per-test (sliced in #emitTestArtifacts),
-    // and there's no dashboard to receive a session recording — so just stop the
-    // recorder to release resources; never encode an orphan session-wide webm.
-    if (this.#options.mode === 'trace') {
-      await this.#screencastRecorder.stop()
-      return
-    }
-    // Skip ghost sessions: browser.reloadSession() creates a new session at
-    // the end of a test run that has no steps — it captures at most a handful
-    // of frames before teardown. Require at least 5 frames so we don't produce
-    // empty videos for these ephemeral sessions.
-    await finalizeScreencast({
-      recorder: this.#screencastRecorder,
-      sessionId,
-      filenamePrefix: 'wdio-video',
-      outputDir: this.#outputDir,
-      minFrames: 5,
-      captureFormat: this.#screencastOptions?.captureFormat,
-      sendUpstream: (scope, data) =>
-        this.#sessionCapturer.sendUpstream(scope, data),
-      onLog: (level, message) => log[level](message)
-    })
-  }
-
   /**
    * Synchronous injection that blocks until complete
    */
diff --git a/packages/service/src/screencast-lifecycle.ts b/packages/service/src/screencast-lifecycle.ts
new file mode 100644
index 00000000..4d8a2835
--- /dev/null
+++ b/packages/service/src/screencast-lifecycle.ts
@@ -0,0 +1,217 @@
+// Owns the WDIO run's screencast: the recorder across reloadSession boundaries,
+// the filmstrip frame buffer that outlives each session, and the per-test video
+// slice. The plugin only forwards its hooks here — everything that reads or
+// writes recorder frames lives in this file.
+
+import {
+  accumulatedScreencastFrames,
+  captureAndAttachVideo,
+  finalizeScreencast,
+  type AllureAttachSink,
+  type TestOutcome,
+  type TraceArtifact
+} from '@wdio/devtools-core'
+import type { ScreencastFrame } from '@wdio/devtools-shared'
+import { ScreencastRecorder } from './screencast.js'
+import type { SessionCapturer } from './session.js'
+import type { ServiceOptions } from './types.js'
+
+type LogFn = (level: 'info' | 'warn', message: string) => void
+
+/** Live accessors into the owning service's state. The capturer is replaced in
+ *  before() and the browser is replaced by reloadSession, so each is read
+ *  lazily. */
+export interface ScreencastLifecycleContext {
+  options: ServiceOptions
+  getBrowser: () => WebdriverIO.Browser | undefined
+  getCapturer: () => SessionCapturer
+  getOutputDir: () => string
+  getTestUid: () => string | undefined
+  getTestStartWallTime: () => number
+  onArtifact: (artifact: TraceArtifact) => void
+  log: LogFn
+}
+
+/** Per-test facts the video slice is keyed and retained on. */
+export interface TestVideoInput {
+  testUid: string | undefined
+  attempt: number | undefined
+  outcomes: TestOutcome[]
+  attach: AllureAttachSink | undefined
+}
+
+export class ScreencastLifecycle {
+  #ctx: ScreencastLifecycleContext
+  #recorder?: ScreencastRecorder
+
+  /** Recorder frames snapshotted in onReload before reloadSession replaces the
+   *  recorder — so the ending test's per-test video can still be sliced in
+   *  afterScenario (which runs AFTER the cucumber After hook's reloadSession). */
+  #pendingVideoFrames?: {
+    testUid: string | undefined
+    startWallTime: number
+    frames: ScreencastFrame[]
+  }
+
+  /** Filmstrip frames accumulated across reloadSession() boundaries — the
+   *  recorder's buffer resets per session, so this persists earlier sessions'
+   *  frames (like the action snapshots) and is concatenated with the live
+   *  recorder's frames at export, then windowed per slice in core. */
+  #filmstripFrames: ScreencastFrame[] = []
+
+  constructor(ctx: ScreencastLifecycleContext) {
+    this.#ctx = ctx
+    if (ctx.options.mode === 'trace' && ctx.options.screencast?.enabled) {
+      ctx.log(
+        'warn',
+        'trace mode: `screencast.enabled` is ignored — use `video` to record; ' +
+          'the tuning fields (quality/interval) still apply'
+      )
+    }
+  }
+
+  /** Filmstrip defaults ON in trace mode; explicit `filmstrip: false` opts out. */
+  #filmstripOn(): boolean {
+    return this.#ctx.options.filmstrip ?? true
+  }
+
+  /** Record a screencast this session? Live mode: `screencast.enabled`. Trace
+   *  mode: a non-`off` `video` policy (frames sliced per test at flush) or
+   *  `filmstrip` (dense frames written into the trace itself). */
+  #shouldRecord(): boolean {
+    if (this.#ctx.options.mode === 'trace') {
+      return (
+        (!!this.#ctx.options.video && this.#ctx.options.video !== 'off') ||
+        this.#filmstripOn()
+      )
+    }
+    return !!this.#ctx.options.screencast?.enabled
+  }
+
+  /** Whole-run filmstrip frames for the export context: earlier sessions'
+   *  accumulated frames plus the live recorder's, or undefined when filmstrip
+   *  is off (so the trace stays byte-stable with today's output). */
+  filmstripFramesForExport(): ScreencastFrame[] | undefined {
+    if (!this.#filmstripOn()) {
+      return undefined
+    }
+    return accumulatedScreencastFrames(this.#filmstripFrames, this.#recorder)
+  }
+
+  /**
+   * Start recording on a freshly created session when enabled — `screencast.
+   * enabled` in live mode, or a non-`off` `video` policy (per-test slicing at
+   * flush) or `filmstrip` (dense frames into the trace) in trace mode. Failures
+   * are non-fatal — logged by the recorder, session continues.
+   */
+  async start(browser: WebdriverIO.Browser): Promise<void> {
+    if (!this.#shouldRecord()) {
+      return
+    }
+    this.#recorder = new ScreencastRecorder(this.#ctx.options.screencast ?? {})
+    await this.#recorder.start(browser)
+  }
+
+  /** On first URL navigation, mark the start of meaningful recording so leading
+   *  blank frames (pre-test pauses, etc.) are trimmed from the video. */
+  markStart(): void {
+    this.#recorder?.setStartMarker()
+  }
+
+  /**
+   * Called after browser.reloadSession(): the old session (and its CDP
+   * connection) is already destroyed, so encode whatever frames it collected
+   * and start a fresh recorder on the new session.
+   */
+  async handleReload(oldSessionId: string): Promise<void> {
+    const browser = this.#ctx.getBrowser()
+    if (!this.#shouldRecord() || !browser) {
+      return
+    }
+
+    // Trace mode: the ending test's afterScenario runs AFTER this reload (a
+    // cucumber `After(() => reloadSession())` is WDIO boilerplate), by which
+    // point the recorder below has replaced these frames. Snapshot them now,
+    // keyed to the ending test, so afterScenario can still slice its video.
+    if (this.#ctx.options.mode === 'trace' && this.#recorder) {
+      const frames = [...this.#recorder.frames]
+      this.#pendingVideoFrames = {
+        testUid: this.#ctx.getTestUid(),
+        startWallTime: this.#ctx.getTestStartWallTime(),
+        frames
+      }
+      // Persist for the filmstrip too — the recorder below resets the buffer,
+      // so a session/spec trace spanning this reload keeps its earlier frames.
+      if (this.#filmstripOn()) {
+        this.#filmstripFrames.push(...frames)
+      }
+    }
+
+    // Finalize the recording from the old session (CDP is already gone, so
+    // stop() will fail gracefully and we encode whatever frames arrived).
+    await this.finalize(oldSessionId)
+
+    await this.start(browser)
+  }
+
+  /**
+   * Stops the current recorder, encodes collected frames into a .webm file, and
+   * notifies the backend. Safe to call even if recording never started or the
+   * CDP session died early.
+   */
+  async finalize(sessionId: string): Promise<void> {
+    if (!this.#recorder) {
+      return
+    }
+    // Trace mode: the video is emitted per-test (sliced in attachTestVideo),
+    // and there's no dashboard to receive a session recording — so just stop the
+    // recorder to release resources; never encode an orphan session-wide webm.
+    if (this.#ctx.options.mode === 'trace') {
+      await this.#recorder.stop()
+      return
+    }
+    // Skip ghost sessions: browser.reloadSession() creates a new session at
+    // the end of a test run that has no steps — it captures at most a handful
+    // of frames before teardown. Require at least 5 frames so we don't produce
+    // empty videos for these ephemeral sessions.
+    await finalizeScreencast({
+      recorder: this.#recorder,
+      sessionId,
+      filenamePrefix: 'wdio-video',
+      outputDir: this.#ctx.getOutputDir(),
+      minFrames: 5,
+      captureFormat: this.#ctx.options.screencast?.captureFormat,
+      sendUpstream: (scope, data) =>
+        this.#ctx.getCapturer().sendUpstream(scope, data),
+      onLog: this.#ctx.log
+    })
+  }
+
+  /** Slice the ending test's video out of the frame buffer and attach it per
+   *  policy. Prefers frames snapshotted in handleReload (reloadSession tears the
+   *  recorder down before the per-test hook runs); falls back to the live
+   *  recorder otherwise. */
+  async attachTestVideo(input: TestVideoInput): Promise<void> {
+    const pending =
+      this.#pendingVideoFrames?.testUid === input.testUid
+        ? this.#pendingVideoFrames
+        : undefined
+    this.#pendingVideoFrames = undefined
+    await captureAndAttachVideo({
+      mode: this.#ctx.options.mode,
+      granularity: this.#ctx.options.traceGranularity,
+      policy: this.#ctx.options.video,
+      frames: pending?.frames ?? this.#recorder?.frames,
+      startWallTime: pending?.startWallTime ?? this.#ctx.getTestStartWallTime(),
+      outcomes: input.outcomes,
+      attempt: input.attempt,
+      outputDir: this.#ctx.getOutputDir(),
+      testUid: input.testUid,
+      sessionId: this.#ctx.getBrowser()?.sessionId,
+      captureFormat: this.#ctx.options.screencast?.captureFormat,
+      attach: input.attach,
+      onArtifact: this.#ctx.onArtifact,
+      onLog: this.#ctx.log
+    })
+  }
+}
diff --git a/packages/service/src/snapshot-dedupe.ts b/packages/service/src/snapshot-dedupe.ts
deleted file mode 100644
index 5e51cccd..00000000
--- a/packages/service/src/snapshot-dedupe.ts
+++ /dev/null
@@ -1,41 +0,0 @@
-import type { ActionSnapshot } from '@wdio/devtools-shared'
-
-/** Collapse snapshots sharing a timestamp to the one with the largest
- *  screenshot. The trace writer names resources by timestamp, so same-timestamp
- *  snapshots collide; keeping the richest preserves a navigated action's result
- *  over a blank mid-navigation frame. */
-export function dedupeSnapshotsByTimestamp(
-  snapshots: ActionSnapshot[]
-): ActionSnapshot[] {
-  const best = new Map<number, ActionSnapshot>()
-  for (const snap of snapshots) {
-    const current = best.get(snap.timestamp)
-    if (
-      !current ||
-      (snap.screenshot?.length ?? 0) > (current.screenshot?.length ?? 0)
-    ) {
-      best.set(snap.timestamp, snap)
-    }
-  }
-  return [...best.values()].sort((a, b) => a.timestamp - b.timestamp)
-}
-
-/** Insert a snapshot, or — when one already shares its timestamp — keep only
- *  the richer screenshot, replacing in place to preserve any index ranges into
- *  the list. Applies the dedupe heuristic at capture time so a blank
- *  end-of-scenario frame can't clobber the last action's real result on export
- *  paths that don't run dedupeSnapshotsByTimestamp (e.g. per-spec traces). */
-export function upsertRichestSnapshot(
-  snapshots: ActionSnapshot[],
-  snap: ActionSnapshot
-): void {
-  const idx = snapshots.findIndex((s) => s.timestamp === snap.timestamp)
-  if (idx === -1) {
-    snapshots.push(snap)
-    return
-  }
-  const existing = snapshots[idx]!
-  if ((snap.screenshot?.length ?? 0) > (existing.screenshot?.length ?? 0)) {
-    snapshots[idx] = snap
-  }
-}
diff --git a/packages/service/src/trace-slices.ts b/packages/service/src/trace-slices.ts
index 24533abb..2a7e3b50 100644
--- a/packages/service/src/trace-slices.ts
+++ b/packages/service/src/trace-slices.ts
@@ -1,37 +1,87 @@
-// Trace-slice flushing for the WDIO adapter: previous-slice flush at boundary
-// changes plus the eager per-test flush. Kept out of index.ts so the slice
-// selection and flush I/O are unit-testable and the god-file stays lean.
+// Trace-slice bookkeeping for the WDIO adapter: where a slice boundary falls,
+// which slice is flushed when, and the flush I/O itself. Kept out of index.ts
+// so the slice selection is unit-testable and the god-file only forwards its
+// lifecycle hooks.
 
 import {
   findFlushableRange,
   flushRangeLogged,
+  recordSliceBoundary,
   type SpecRange,
   type TraceArtifact,
   type TraceExportContext
 } from '@wdio/devtools-core'
+import type { SessionCapturer } from './session.js'
+import type { ServiceOptions } from './types.js'
 
-/** Fire-and-forget flush of the previous unflushed slice at a boundary change
- *  (spec granularity, or a test slice whose eager flush was missed). Errors are
- *  logged, never thrown, so a failed flush can't abort the next test. */
-export function flushPrevSlice(
-  ctx: TraceExportContext,
-  range: SpecRange
-): void {
-  void flushRangeLogged(ctx, range)
+/** Live accessors into the owning service's state. The capturer is replaced in
+ *  before() and the browser by reloadSession, so both are read lazily; the
+ *  export context is rebuilt per flush because it snapshots live state. */
+export interface TraceSliceContext {
+  options: ServiceOptions
+  getCapturer: () => SessionCapturer
+  getBrowser: () => WebdriverIO.Browser | undefined
+  buildExportContext: (browser: WebdriverIO.Browser) => TraceExportContext
 }
 
-/** Awaited flush of the just-ended test's slice (test granularity), so this
- *  attempt's just-stamped metadata is written before a retry's beforeTest
- *  overwrites the entry. Returns the produced artifact (for same-hook Allure
- *  attach); undefined when the test recorded no range. */
-export async function flushTestSlice(
-  ctx: TraceExportContext,
-  ranges: readonly SpecRange[],
-  testUid: string
-): Promise<TraceArtifact | undefined> {
-  const range = findFlushableRange(ranges, testUid)
-  if (!range) {
-    return undefined
+export class TraceSliceTracker {
+  /** Index ranges into the session capturer's flat arrays, one per slice. */
+  readonly ranges: SpecRange[] = []
+
+  /** Slice keys already flushed to disk. Shared by reference with the export
+   *  context so the end-of-run finalizer dedupes what was flushed eagerly. */
+  readonly flushed = new Set<string>()
+
+  #ctx: TraceSliceContext
+
+  constructor(ctx: TraceSliceContext) {
+    this.#ctx = ctx
+  }
+
+  /** Record a trace-slice boundary. `spec` slices per file; `test` per test
+   *  (retries keyed per attempt by core); `session` records nothing. The
+   *  previous-slice flush fires for `spec`; `test` slices eager-flush at their
+   *  own test end (see flushTest) so this is only a missed-slice net. */
+  recordBoundary(specFile: string | undefined, testUid?: string): void {
+    if (!specFile) {
+      return
+    }
+    const prevRange = recordSliceBoundary(
+      {
+        specRanges: this.ranges,
+        flushedSpecs: this.flushed,
+        capturer: this.#ctx.getCapturer()
+      },
+      this.#ctx.options.traceGranularity,
+      specFile,
+      testUid
+    )
+    const browser = this.#ctx.getBrowser()
+    if (prevRange && browser) {
+      // Fire-and-forget: errors are logged, never thrown, so a failed flush of
+      // the previous slice can't abort the test that just started.
+      void flushRangeLogged(this.#ctx.buildExportContext(browser), prevRange)
+    }
+  }
+
+  /** Awaited eager flush of the just-ended test's slice (test granularity), run
+   *  after the outcome is stamped so this attempt's metadata is written before a
+   *  retry's beforeTest overwrites the entry; the end-of-run finalizer then
+   *  dedupes it via the key set. Returns the produced artifact (for same-hook
+   *  Allure attach); undefined when the test recorded no range. */
+  async flushTest(testUid: string): Promise<TraceArtifact | undefined> {
+    const browser = this.#ctx.getBrowser()
+    if (
+      this.#ctx.options.traceGranularity !== 'test' ||
+      this.#ctx.options.mode !== 'trace' ||
+      !browser
+    ) {
+      return undefined
+    }
+    const range = findFlushableRange(this.ranges, testUid)
+    if (!range) {
+      return undefined
+    }
+    return flushRangeLogged(this.#ctx.buildExportContext(browser), range)
   }
-  return flushRangeLogged(ctx, range)
 }
diff --git a/packages/service/src/wdio-runner-id.ts b/packages/service/src/wdio-runner-id.ts
new file mode 100644
index 00000000..9f9f4b85
--- /dev/null
+++ b/packages/service/src/wdio-runner-id.ts
@@ -0,0 +1,39 @@
+// This adapter's runner identity, and the stamping of it onto session metadata.
+// WDIO's own `framework` config value IS the runner id, so it is read off the
+// session rather than restated. Named for the WDIO runner to stay distinct from
+// core's `run-id.ts`, which is the unrelated per-run identity.
+
+import {
+  isTestRunnerId,
+  type Metadata,
+  type TestRunnerId,
+  type TraceType
+} from '@wdio/devtools-shared'
+
+/** WDIO's own default framework, and the answer for a standalone session whose
+ *  options carry no framework at all. */
+const DEFAULT_RUNNER: TestRunnerId = 'mocha'
+
+export function wdioRunnerId(browser: WebdriverIO.Browser): TestRunnerId {
+  // `browser.options` is the merged testrunner config at runtime, but its static
+  // type is the remote-options subset, which declares no `framework`. Optional
+  // because a multiremote/standalone handle can reach here without options.
+  const framework = (browser.options as { framework?: unknown } | undefined)
+    ?.framework
+  return isTestRunnerId(framework) ? framework : DEFAULT_RUNNER
+}
+
+/** Put the runner on the capturer's own metadata — the copy the trace exporter
+ *  reads on its way into the zip's `context-options`. `sendUpstream` alone feeds
+ *  the live dashboard and never reaches it. */
+export function stampRunnerMetadata(
+  capturer: { metadata?: Metadata },
+  browser: WebdriverIO.Browser,
+  type: TraceType
+): void {
+  capturer.metadata = {
+    type,
+    ...capturer.metadata,
+    runner: wdioRunnerId(browser)
+  }
+}
diff --git a/packages/service/tests/action-snapshot.test.ts b/packages/service/tests/action-snapshot.test.ts
index f81be33c..e4be8d8c 100644
--- a/packages/service/tests/action-snapshot.test.ts
+++ b/packages/service/tests/action-snapshot.test.ts
@@ -27,3 +27,22 @@ describe('pushActionSnapshotAt', () => {
     expect(snapshots[0]!.screenshot).toBe('SHOT')
   })
 })
+
+describe('service action-snapshot locator dialect', () => {
+  it("injects WebdriverIO's own text form, which resolves in $() directly", async () => {
+    // Portable XPath resolves here too, but a WDIO user copying a locator out of
+    // the A11y tab expects `a*=Logout`, not something they must wrap.
+    const browser = Object.assign(mockBrowser(), {
+      options: { framework: 'cucumber' }
+    })
+    await pushActionSnapshotAt(browser, 'click', 1, [])
+
+    const bodies = vi
+      .mocked(browser.execute)
+      .mock.calls.map(([fn]) => String(fn))
+    expect(bodies).not.toHaveLength(0)
+    for (const body of bodies) {
+      expect(body).toContain("tag + '*=' + text")
+    }
+  })
+})
diff --git a/packages/service/tests/dedupe-snapshots.test.ts b/packages/service/tests/dedupe-snapshots.test.ts
deleted file mode 100644
index d1ac50ee..00000000
--- a/packages/service/tests/dedupe-snapshots.test.ts
+++ /dev/null
@@ -1,156 +0,0 @@
-import fs from 'node:fs/promises'
-import os from 'node:os'
-import path from 'node:path'
-import { describe, it, expect } from 'vitest'
-import { writeTraceZip, type TraceCapturer } from '@wdio/devtools-core'
-import { TraceType, type ActionSnapshot } from '@wdio/devtools-shared'
-import {
-  dedupeSnapshotsByTimestamp,
-  upsertRichestSnapshot
-} from '../src/snapshot-dedupe.js'
-
-function snap(timestamp: number, screenshot: string): ActionSnapshot {
-  return { timestamp, command: 'click', screenshot }
-}
-
-describe('dedupeSnapshotsByTimestamp', () => {
-  it('keeps the largest screenshot when timestamps collide', () => {
-    // A navigated action's content result and the blank pre/final captures all
-    // land on the same timestamp; the richest (content) frame must win.
-    const blank = 'AA'
-    const content = 'A'.repeat(100)
-    const result = dedupeSnapshotsByTimestamp([
-      snap(100, content),
-      snap(100, blank),
-      snap(100, blank)
-    ])
-    expect(result).toHaveLength(1)
-    expect(result[0].screenshot).toBe(content)
-  })
-
-  it('keeps distinct timestamps and returns them sorted', () => {
-    const result = dedupeSnapshotsByTimestamp([
-      snap(300, 'c'),
-      snap(100, 'a'),
-      snap(200, 'b')
-    ])
-    expect(result.map((s) => s.timestamp)).toEqual([100, 200, 300])
-  })
-
-  it('handles an empty list', () => {
-    expect(dedupeSnapshotsByTimestamp([])).toEqual([])
-  })
-})
-
-describe('upsertRichestSnapshot', () => {
-  const blank = 'AA'
-  const content = 'A'.repeat(100)
-
-  it("does not let a blank __final__ clobber the last action's real frame", () => {
-    // The last action's post-capture (real) and the end-of-scenario __final__
-    // (blank) share the last action's timestamp; the real frame must survive.
-    const list: ActionSnapshot[] = [snap(50, content), snap(100, content)]
-    const final: ActionSnapshot = {
-      timestamp: 100,
-      command: '__final__',
-      screenshot: blank
-    }
-    upsertRichestSnapshot(list, final)
-    expect(list).toHaveLength(2)
-    expect(list[1].screenshot).toBe(content)
-    expect(list[1].command).toBe('click')
-  })
-
-  it('replaces in place when the final capture is richer', () => {
-    // Mirror the opposite case: the action was screenshotted mid-navigation
-    // (blank) and the settled __final__ is the real frame.
-    const list: ActionSnapshot[] = [snap(50, content), snap(100, blank)]
-    const final: ActionSnapshot = {
-      timestamp: 100,
-      command: '__final__',
-      screenshot: content
-    }
-    upsertRichestSnapshot(list, final)
-    expect(list).toHaveLength(2)
-    expect(list[1].screenshot).toBe(content)
-    expect(list[1].command).toBe('__final__')
-  })
-
-  it('preserves array length/indices on a timestamp collision', () => {
-    // Spec-range slicing indexes into this array, so a collision must never
-    // change its length — only replace in place or skip.
-    const list: ActionSnapshot[] = [snap(100, content)]
-    upsertRichestSnapshot(list, snap(100, blank))
-    expect(list).toHaveLength(1)
-  })
-
-  it('appends when the timestamp is new', () => {
-    const list: ActionSnapshot[] = [snap(100, content)]
-    upsertRichestSnapshot(list, snap(200, blank))
-    expect(list.map((s) => s.timestamp)).toEqual([100, 200])
-  })
-})
-
-describe('final-frame regression (capture → export)', () => {
-  it("exports the last action's real result, not the blank __final__ frame", async () => {
-    // Base64 payloads chosen so byte-length ranks blank < real < result and
-    // each round-trips cleanly through the resource writer's base64 decode.
-    const blank = 'AA'
-    const real = 'R'.repeat(200)
-    const result = 'B'.repeat(400)
-
-    // The service builds pre/post captures per action; the last action's
-    // post-capture (result) collides on timestamp with the trailing __final__.
-    const snapshots: ActionSnapshot[] = [
-      { timestamp: 1200, command: 'url', screenshot: real },
-      { timestamp: 1200, command: 'click', screenshot: real },
-      { timestamp: 1400, command: 'click', screenshot: result }
-    ]
-    upsertRichestSnapshot(snapshots, {
-      timestamp: 1400,
-      command: '__final__',
-      screenshot: blank
-    })
-    const prepared = dedupeSnapshotsByTimestamp(snapshots)
-
-    const capturer: TraceCapturer = {
-      mutations: [],
-      traceLogs: [],
-      consoleLogs: [],
-      networkRequests: [],
-      commandsLog: [
-        { command: 'url', args: [], timestamp: 1200, startTime: 1150 },
-        { command: 'click', args: [], timestamp: 1400, startTime: 1350 }
-      ],
-      sources: new Map(),
-      metadata: {
-        type: TraceType.Testrunner,
-        viewport: {
-          width: 800,
-          height: 600,
-          offsetLeft: 0,
-          offsetTop: 0,
-          scale: 1
-        }
-      },
-      startWallTime: 1000
-    }
-
-    const outputDir = await fs.mkdtemp(path.join(os.tmpdir(), 'final-frame-'))
-    const dir = await writeTraceZip(capturer, {
-      outputDir,
-      sessionId: 'sess1234',
-      format: 'ndjson-directory',
-      actionSnapshots: prepared
-    })
-
-    const frame = await fs.readFile(
-      path.join(dir, 'resources', 'page@sess1234-1400.jpeg')
-    )
-    // The last action's frame is the real result, never the blank capture.
-    expect(frame.toString('base64')).toBe(result)
-    expect(frame.length).not.toBe(Buffer.from(blank, 'base64').length)
-
-    await fs.rm(outputDir, { recursive: true, force: true })
-  })
-})
diff --git a/packages/service/tests/index.test.ts b/packages/service/tests/index.test.ts
index 5d443c56..3ff2fc03 100644
--- a/packages/service/tests/index.test.ts
+++ b/packages/service/tests/index.test.ts
@@ -1,5 +1,9 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest'
 import type * as DevtoolsCore from '@wdio/devtools-core'
+import {
+  INPUT_DISPATCH_MAX_HOLD_MS,
+  isInputDispatchInFlight
+} from '@wdio/devtools-core'
 import DevToolsHookService from '../src/index.js'
 
 // Controllable stack: `frames` defaults to a single user-spec frame (commands
@@ -30,6 +34,8 @@ const mockSessionCapturerInstance = {
   captureTrace: vi.fn().mockResolvedValue(undefined),
   resetScriptInjection: vi.fn(),
   noteResolvedSelector: vi.fn(),
+  resetLastSelector: vi.fn(),
+  resetRetryTracker: vi.fn(),
   captureSource: vi.fn(),
   captureAssertCommand: vi.fn(),
   cleanup: vi.fn(),
@@ -220,6 +226,51 @@ describe('DevtoolsService - Internal Command Filtering', () => {
     })
   })
 
+  // A screenshot poll landing inside chromedriver's click, between computing the
+  // element's coordinates and dispatching at them, makes the click report success
+  // while activating nothing. The recorder drops a tick while this window is open,
+  // so the service has to open one around every input-dispatching command.
+  describe('beforeCommand - input-dispatch window', () => {
+    // The gate is module-scoped in core (one per adapter bundle), so a window
+    // left open by an earlier case in this file is still open here. Jump past the
+    // hold bound and read once, which is what prunes it.
+    const flushInputWindows = () => {
+      vi.useFakeTimers()
+      vi.setSystemTime(Date.now() + INPUT_DISPATCH_MAX_HOLD_MS + 1)
+      isInputDispatchInFlight()
+      vi.useRealTimers()
+    }
+
+    beforeEach(async () => {
+      await service.before({} as any, [], mockBrowser)
+      vi.clearAllMocks()
+      flushInputWindows()
+    })
+
+    it('holds the window open for the duration of an input command', async () => {
+      await service.beforeCommand('click' as any, ['.button'])
+      expect(isInputDispatchInFlight()).toBe(true)
+      await service.afterCommand('click' as any, ['.button'], {})
+      expect(isInputDispatchInFlight()).toBe(false)
+    })
+
+    it('opens no window for a command that dispatches no input', async () => {
+      await service.beforeCommand('getText' as any, ['#flash'])
+      expect(isInputDispatchInFlight()).toBe(false)
+      await service.afterCommand('getText' as any, ['#flash'], 'text')
+    })
+
+    // A window stranded by a command whose afterCommand never paired (a failed
+    // command, an internal injection call) would otherwise keep dropping frames
+    // into the next test until its bound expired.
+    it('closes the window at the next test boundary', async () => {
+      await service.beforeCommand('setValue' as any, ['#username', 'foo'])
+      expect(isInputDispatchInFlight()).toBe(true)
+      service.beforeTest({ file: '/test/specs/fake.spec.ts', title: 'next' })
+      expect(isInputDispatchInFlight()).toBe(false)
+    })
+  })
+
   // Field edits (value/checked) fire no page transition, so with a
   // navigation-only drain they stayed buffered in the page until the next
   // navigation — every action in between replayed the form as it loaded, empty.
diff --git a/packages/service/tests/screencast-lifecycle.test.ts b/packages/service/tests/screencast-lifecycle.test.ts
new file mode 100644
index 00000000..49f919d7
--- /dev/null
+++ b/packages/service/tests/screencast-lifecycle.test.ts
@@ -0,0 +1,303 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import type * as DevtoolsCore from '@wdio/devtools-core'
+import {
+  ScreencastLifecycle,
+  type ScreencastLifecycleContext
+} from '../src/screencast-lifecycle.js'
+import type { ServiceOptions } from '../src/types.js'
+
+const recorder = {
+  start: vi.fn().mockResolvedValue(undefined),
+  stop: vi.fn().mockResolvedValue(undefined),
+  setStartMarker: vi.fn(),
+  frames: [] as Array<{ data: string; timestamp: number }>,
+  duration: 0
+}
+
+vi.mock('../src/screencast.js', () => ({
+  ScreencastRecorder: vi.fn(function () {
+    // Every construction hands back the same stub, so a reload's "fresh"
+    // recorder is observable through the shared frames array.
+    recorder.frames = []
+    return recorder
+  })
+}))
+
+vi.mock('@wdio/devtools-core', async (importOriginal) => {
+  const actual = await importOriginal<typeof DevtoolsCore>()
+  return {
+    ...actual,
+    finalizeScreencast: vi.fn().mockResolvedValue(undefined),
+    captureAndAttachVideo: vi.fn().mockResolvedValue(undefined)
+  }
+})
+
+const browser = { sessionId: 'session-1' } as unknown as WebdriverIO.Browser
+const capturer = { sendUpstream: vi.fn() }
+
+const frame = (data: string, timestamp: number) => ({ data, timestamp })
+
+function makeLifecycle(
+  options: ServiceOptions,
+  overrides: Partial<ScreencastLifecycleContext> = {}
+) {
+  const ctx: ScreencastLifecycleContext = {
+    options,
+    getBrowser: () => browser,
+    getCapturer: () => capturer as never,
+    getOutputDir: () => '/out',
+    getTestUid: () => 'test-1',
+    getTestStartWallTime: () => 1000,
+    onArtifact: vi.fn(),
+    log: vi.fn(),
+    ...overrides
+  }
+  return { lifecycle: new ScreencastLifecycle(ctx), ctx }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  recorder.frames = []
+})
+
+describe('ScreencastLifecycle.start', () => {
+  it.each([
+    ['live, no options', {}, false],
+    ['live, screencast enabled', { screencast: { enabled: true } }, true],
+    ['trace, filmstrip default-on', { mode: 'trace' }, true],
+    [
+      'trace, filmstrip off + no video',
+      { mode: 'trace', filmstrip: false },
+      false
+    ],
+    [
+      'trace, filmstrip off + video on',
+      { mode: 'trace', filmstrip: false, video: 'on' },
+      true
+    ],
+    [
+      'trace, filmstrip off + video off',
+      { mode: 'trace', filmstrip: false, video: 'off' },
+      false
+    ]
+  ])('%s → records: %s', async (_name, options, recording) => {
+    const { lifecycle } = makeLifecycle(options as ServiceOptions)
+    await lifecycle.start(browser)
+    expect(recorder.start).toHaveBeenCalledTimes(recording ? 1 : 0)
+  })
+})
+
+describe('ScreencastLifecycle filmstrip frames', () => {
+  it('is undefined when filmstrip is off, so the trace stays byte-stable', () => {
+    const { lifecycle } = makeLifecycle({ mode: 'trace', filmstrip: false })
+    expect(lifecycle.filmstripFramesForExport()).toBeUndefined()
+  })
+
+  it('concatenates the live recorder onto frames drained from earlier sessions', async () => {
+    const { lifecycle } = makeLifecycle({ mode: 'trace', filmstrip: true })
+    await lifecycle.start(browser)
+    recorder.frames = [frame('a', 1), frame('b', 2)]
+
+    // A mid-run flush must see the still-recording session's frames.
+    expect(lifecycle.filmstripFramesForExport()).toEqual([
+      frame('a', 1),
+      frame('b', 2)
+    ])
+
+    await lifecycle.handleReload('session-1')
+    recorder.frames = [frame('c', 3)]
+
+    // The recorder's buffer resets per session; the earlier frames survive only
+    // because handleReload drained them into the run-scoped buffer.
+    expect(lifecycle.filmstripFramesForExport()).toEqual([
+      frame('a', 1),
+      frame('b', 2),
+      frame('c', 3)
+    ])
+  })
+})
+
+describe('ScreencastLifecycle.handleReload', () => {
+  it('does nothing when recording is off', async () => {
+    const { lifecycle } = makeLifecycle({ mode: 'trace', filmstrip: false })
+    await lifecycle.handleReload('session-1')
+    expect(recorder.stop).not.toHaveBeenCalled()
+    expect(recorder.start).not.toHaveBeenCalled()
+  })
+
+  it('stops the dead session and starts a recorder on the new one', async () => {
+    const { lifecycle } = makeLifecycle({ screencast: { enabled: true } })
+    await lifecycle.start(browser)
+    vi.clearAllMocks()
+    recorder.frames = Array.from({ length: 10 }, (_, i) => frame('f', i))
+
+    await lifecycle.handleReload('old-session')
+
+    const { finalizeScreencast } = await import('@wdio/devtools-core')
+    expect(finalizeScreencast).toHaveBeenCalledWith(
+      expect.objectContaining({ sessionId: 'old-session', minFrames: 5 })
+    )
+    expect(recorder.start).toHaveBeenCalledWith(browser)
+  })
+
+  // The recorder's buffer resets per session, so a run that spans a reload keeps
+  // its earlier frames only if they were accumulated here. Reading the RAW
+  // option missed the default: filmstrip is on in trace mode unless opted out,
+  // so an unset option accumulated nothing and the export kept the last session.
+  it('accumulates across a reload when filmstrip is on by default', async () => {
+    const { lifecycle } = makeLifecycle({ mode: 'trace' })
+    await lifecycle.start(browser)
+    recorder.frames = [frame('a', 0), frame('b', 1)]
+
+    await lifecycle.handleReload('old-session')
+    recorder.frames = [frame('c', 2)]
+
+    expect(lifecycle.filmstripFramesForExport()).toEqual([
+      frame('a', 0),
+      frame('b', 1),
+      frame('c', 2)
+    ])
+  })
+
+  it('accumulates nothing when filmstrip is explicitly off', async () => {
+    const { lifecycle } = makeLifecycle({ mode: 'trace', filmstrip: false })
+    await lifecycle.start(browser)
+    recorder.frames = [frame('a', 0)]
+
+    await lifecycle.handleReload('old-session')
+
+    expect(lifecycle.filmstripFramesForExport()).toBeUndefined()
+  })
+})
+
+describe('ScreencastLifecycle.attachTestVideo', () => {
+  const videoOptions: ServiceOptions = {
+    mode: 'trace',
+    traceGranularity: 'test',
+    video: 'on'
+  }
+
+  it('slices the frames snapshotted before reloadSession replaced the recorder', async () => {
+    const { lifecycle } = makeLifecycle(videoOptions)
+    await lifecycle.start(browser)
+    recorder.frames = [frame('a', 1), frame('b', 2)]
+
+    // The cucumber After hook reloads the session before afterScenario runs.
+    await lifecycle.handleReload('old-session')
+    recorder.frames = [frame('next-session', 9)]
+
+    await lifecycle.attachTestVideo({
+      testUid: 'test-1',
+      attempt: 0,
+      outcomes: [{ uid: 'test-1', attempt: 0, state: 'passed' }],
+      attach: undefined
+    })
+
+    const { captureAndAttachVideo } = await import('@wdio/devtools-core')
+    expect(captureAndAttachVideo).toHaveBeenCalledWith(
+      expect.objectContaining({
+        testUid: 'test-1',
+        frames: [frame('a', 1), frame('b', 2)],
+        startWallTime: 1000,
+        sessionId: 'session-1',
+        outputDir: '/out'
+      })
+    )
+  })
+
+  it('falls back to the live recorder and consumes the pending slot once', async () => {
+    const { lifecycle } = makeLifecycle(videoOptions)
+    await lifecycle.start(browser)
+    recorder.frames = [frame('a', 1)]
+    await lifecycle.handleReload('old-session')
+    recorder.frames = [frame('live', 5)]
+
+    // A different test than the one the pending frames were keyed to: the
+    // snapshot must not be handed to it, and it must not survive the read.
+    await lifecycle.attachTestVideo({
+      testUid: 'other-test',
+      attempt: undefined,
+      outcomes: [],
+      attach: undefined
+    })
+    await lifecycle.attachTestVideo({
+      testUid: 'test-1',
+      attempt: undefined,
+      outcomes: [],
+      attach: undefined
+    })
+
+    const { captureAndAttachVideo } = await import('@wdio/devtools-core')
+    expect(vi.mocked(captureAndAttachVideo).mock.calls[0]![0].frames).toEqual([
+      frame('live', 5)
+    ])
+    expect(vi.mocked(captureAndAttachVideo).mock.calls[1]![0].frames).toEqual([
+      frame('live', 5)
+    ])
+  })
+})
+
+describe('ScreencastLifecycle.finalize', () => {
+  it('trace mode stops the recorder without encoding an orphan session video', async () => {
+    const { lifecycle } = makeLifecycle({ mode: 'trace' })
+    await lifecycle.start(browser)
+    await lifecycle.finalize('session-1')
+
+    const { finalizeScreencast } = await import('@wdio/devtools-core')
+    expect(recorder.stop).toHaveBeenCalled()
+    expect(finalizeScreencast).not.toHaveBeenCalled()
+  })
+
+  it('live mode encodes through the shared finalizer', async () => {
+    const { lifecycle } = makeLifecycle({
+      screencast: { enabled: true, captureFormat: 'png' }
+    })
+    await lifecycle.start(browser)
+    await lifecycle.finalize('session-1')
+
+    const { finalizeScreencast } = await import('@wdio/devtools-core')
+    expect(finalizeScreencast).toHaveBeenCalledWith(
+      expect.objectContaining({
+        sessionId: 'session-1',
+        filenamePrefix: 'wdio-video',
+        outputDir: '/out',
+        minFrames: 5,
+        captureFormat: 'png'
+      })
+    )
+  })
+
+  it('is a no-op when recording never started', async () => {
+    const { lifecycle } = makeLifecycle({})
+    await lifecycle.finalize('session-1')
+    const { finalizeScreencast } = await import('@wdio/devtools-core')
+    expect(finalizeScreencast).not.toHaveBeenCalled()
+    expect(recorder.stop).not.toHaveBeenCalled()
+  })
+})
+
+describe('ScreencastLifecycle option warnings', () => {
+  it('warns that screencast.enabled is ignored in trace mode', () => {
+    const log = vi.fn()
+    makeLifecycle({ mode: 'trace', screencast: { enabled: true } }, { log })
+    expect(log).toHaveBeenCalledWith(
+      'warn',
+      expect.stringContaining('`screencast.enabled` is ignored')
+    )
+  })
+
+  it('stays quiet in live mode', () => {
+    const log = vi.fn()
+    makeLifecycle({ screencast: { enabled: true } }, { log })
+    expect(log).not.toHaveBeenCalled()
+  })
+
+  it('markStart forwards to the recorder only while one exists', async () => {
+    const { lifecycle } = makeLifecycle({ screencast: { enabled: true } })
+    lifecycle.markStart()
+    expect(recorder.setStartMarker).not.toHaveBeenCalled()
+    await lifecycle.start(browser)
+    lifecycle.markStart()
+    expect(recorder.setStartMarker).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/packages/service/tests/trace-slice-tracker.test.ts b/packages/service/tests/trace-slice-tracker.test.ts
new file mode 100644
index 00000000..edfbe69d
--- /dev/null
+++ b/packages/service/tests/trace-slice-tracker.test.ts
@@ -0,0 +1,133 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import type * as DevtoolsCore from '@wdio/devtools-core'
+import {
+  TraceSliceTracker,
+  type TraceSliceContext
+} from '../src/trace-slices.js'
+import type { ServiceOptions } from '../src/types.js'
+
+vi.mock('@wdio/devtools-core', async (importOriginal) => {
+  const actual = await importOriginal<typeof DevtoolsCore>()
+  return {
+    ...actual,
+    flushRangeLogged: vi
+      .fn()
+      .mockResolvedValue({ kind: 'trace', path: '/out/trace.zip' })
+  }
+})
+
+const capturer = {
+  commandsLog: [],
+  consoleLogs: [],
+  networkRequests: [],
+  mutations: [],
+  traceLogs: []
+}
+
+const browser = { sessionId: 'session-1' } as unknown as WebdriverIO.Browser
+const exportContext = { granularity: 'test' } as unknown as ReturnType<
+  TraceSliceContext['buildExportContext']
+>
+
+function makeTracker(
+  options: ServiceOptions,
+  overrides: Partial<TraceSliceContext> = {}
+) {
+  const ctx: TraceSliceContext = {
+    options,
+    getCapturer: () => capturer as never,
+    getBrowser: () => browser,
+    buildExportContext: () => exportContext,
+    ...overrides
+  }
+  return new TraceSliceTracker(ctx)
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('TraceSliceTracker.recordBoundary', () => {
+  it('records nothing without a spec file', () => {
+    const tracker = makeTracker({ mode: 'trace', traceGranularity: 'test' })
+    tracker.recordBoundary(undefined, 'uid-1')
+    expect(tracker.ranges).toHaveLength(0)
+  })
+
+  it('session granularity records no slices', () => {
+    const tracker = makeTracker({ mode: 'trace', traceGranularity: 'session' })
+    tracker.recordBoundary('a.feature', 'uid-1')
+    expect(tracker.ranges).toHaveLength(0)
+  })
+
+  it('test granularity records one slice per test, keyed per attempt', () => {
+    const tracker = makeTracker({ mode: 'trace', traceGranularity: 'test' })
+    tracker.recordBoundary('a.spec.ts', 'uid-1')
+    tracker.recordBoundary('a.spec.ts', 'uid-1')
+    expect(tracker.ranges.map((r) => r.key)).toEqual(['uid-1', 'uid-1-retry1'])
+  })
+
+  it('spec granularity flushes the previous, unflushed slice when the file changes', async () => {
+    const tracker = makeTracker({ mode: 'trace', traceGranularity: 'spec' })
+    tracker.recordBoundary('a.spec.ts')
+    tracker.recordBoundary('a.spec.ts')
+    const { flushRangeLogged } = await import('@wdio/devtools-core')
+    expect(flushRangeLogged).not.toHaveBeenCalled()
+
+    tracker.recordBoundary('b.spec.ts')
+    expect(flushRangeLogged).toHaveBeenCalledWith(
+      exportContext,
+      expect.objectContaining({ key: 'a.spec.ts' })
+    )
+  })
+
+  it('skips the previous-slice flush when no session is up', async () => {
+    const tracker = makeTracker(
+      { mode: 'trace', traceGranularity: 'spec' },
+      { getBrowser: () => undefined }
+    )
+    tracker.recordBoundary('a.spec.ts')
+    tracker.recordBoundary('b.spec.ts')
+    const { flushRangeLogged } = await import('@wdio/devtools-core')
+    expect(flushRangeLogged).not.toHaveBeenCalled()
+  })
+})
+
+describe('TraceSliceTracker.flushTest', () => {
+  it('flushes the ending test its own slice and returns the artifact', async () => {
+    const tracker = makeTracker({ mode: 'trace', traceGranularity: 'test' })
+    tracker.recordBoundary('a.spec.ts', 'uid-1')
+
+    await expect(tracker.flushTest('uid-1')).resolves.toEqual({
+      kind: 'trace',
+      path: '/out/trace.zip'
+    })
+  })
+
+  it('flushes the latest attempt of a retried test', async () => {
+    const tracker = makeTracker({ mode: 'trace', traceGranularity: 'test' })
+    tracker.recordBoundary('a.spec.ts', 'uid-1')
+    tracker.recordBoundary('a.spec.ts', 'uid-1')
+    await tracker.flushTest('uid-1')
+
+    const { flushRangeLogged } = await import('@wdio/devtools-core')
+    expect(flushRangeLogged).toHaveBeenLastCalledWith(
+      exportContext,
+      expect.objectContaining({ key: 'uid-1-retry1' })
+    )
+  })
+
+  it.each([
+    ['spec granularity', { mode: 'trace', traceGranularity: 'spec' }],
+    ['live mode', { mode: 'live', traceGranularity: 'test' }]
+  ])('is a no-op under %s', async (_name, options) => {
+    const tracker = makeTracker(options as ServiceOptions)
+    tracker.recordBoundary('a.spec.ts', 'uid-1')
+    await expect(tracker.flushTest('uid-1')).resolves.toBeUndefined()
+  })
+
+  it('is a no-op for a test that recorded no range', async () => {
+    const tracker = makeTracker({ mode: 'trace', traceGranularity: 'test' })
+    await expect(tracker.flushTest('never-started')).resolves.toBeUndefined()
+  })
+})
diff --git a/packages/service/tests/wdio-runner-id.test.ts b/packages/service/tests/wdio-runner-id.test.ts
new file mode 100644
index 00000000..75e0216b
--- /dev/null
+++ b/packages/service/tests/wdio-runner-id.test.ts
@@ -0,0 +1,57 @@
+// WDIO's `framework` config value IS its runner id, so the service reads it off
+// the session rather than restating it — and the value has to be narrowed,
+// because a user config can name a framework this build doesn't know.
+
+import { describe, expect, it } from 'vitest'
+
+import { TraceType, type Metadata } from '@wdio/devtools-shared'
+
+import { stampRunnerMetadata, wdioRunnerId } from '../src/wdio-runner-id.js'
+
+const browserWith = (options: unknown) =>
+  ({ options }) as unknown as WebdriverIO.Browser
+
+describe('wdioRunnerId', () => {
+  it('reports the framework the run is configured with', () => {
+    expect(wdioRunnerId(browserWith({ framework: 'cucumber' }))).toBe(
+      'cucumber'
+    )
+    expect(wdioRunnerId(browserWith({ framework: 'jasmine' }))).toBe('jasmine')
+  })
+
+  it("falls back to WDIO's own default framework", () => {
+    // A standalone session carries no framework at all.
+    expect(wdioRunnerId(browserWith({}))).toBe('mocha')
+    expect(wdioRunnerId(browserWith(undefined))).toBe('mocha')
+  })
+
+  it('rejects a framework this build has no id for', () => {
+    expect(wdioRunnerId(browserWith({ framework: 'vitest' }))).toBe('mocha')
+  })
+})
+
+describe('stampRunnerMetadata', () => {
+  it('puts the runner where the trace exporter reads it', () => {
+    // The service only ever sent metadata upstream, so `capturer.metadata` — the
+    // exporter's input — carried no runner and the zip named none.
+    const capturer: { metadata?: Metadata } = {}
+    stampRunnerMetadata(
+      capturer,
+      browserWith({ framework: 'cucumber' }),
+      TraceType.Testrunner
+    )
+
+    expect(capturer.metadata?.runner).toBe('cucumber')
+    expect(capturer.metadata?.type).toBe(TraceType.Testrunner)
+  })
+
+  it('keeps whatever the collector already merged in', () => {
+    const capturer: { metadata?: Metadata } = {
+      metadata: { type: TraceType.Testrunner, url: 'http://example.test/' }
+    }
+    stampRunnerMetadata(capturer, browserWith({}), TraceType.Testrunner)
+
+    expect(capturer.metadata?.url).toBe('http://example.test/')
+    expect(capturer.metadata?.runner).toBe('mocha')
+  })
+})
diff --git a/packages/shared/package.json b/packages/shared/package.json
index 5a03da9b..4a2cb132 100644
--- a/packages/shared/package.json
+++ b/packages/shared/package.json
@@ -2,6 +2,7 @@
   "name": "@wdio/devtools-shared",
   "version": "1.0.0",
   "private": true,
+  "author": "Vishnu Vardhan",
   "description": "Shared types, constants, and HTTP/WS contracts for @wdio/devtools-* packages. Workspace-internal, never published — code is inlined into each consuming package at build time.",
   "repository": {
     "type": "git",
diff --git a/packages/shared/src/index.ts b/packages/shared/src/index.ts
index ac3ba8e7..d26924c4 100644
--- a/packages/shared/src/index.ts
+++ b/packages/shared/src/index.ts
@@ -3,6 +3,7 @@
 
 export * from './baseline.js'
 export * from './files.js'
+export * from './locator-dialect.js'
 export * from './routes.js'
 export * from './runner.js'
 export * from './snapshot-format.js'
diff --git a/packages/shared/src/locator-dialect.ts b/packages/shared/src/locator-dialect.ts
new file mode 100644
index 00000000..262057f5
--- /dev/null
+++ b/packages/shared/src/locator-dialect.ts
@@ -0,0 +1,124 @@
+// Which locator each runner is best handed: the grammar its text form is
+// written in, where that text form sits in the capture's branch order, and what
+// it needs told when the grammar is XPath. The one fact table behind both sides
+// — the page capture reads it to decide what to emit, the player reads it to
+// caption what it hands the user.
+//
+// WebdriverIO has its own `tag*=text` form and auto-detects a leading `//`;
+// Selenium and Nightwatch have no text form, and neither auto-detects XPath —
+// Selenium takes it via `By.xpath`, Nightwatch via its `'xpath'` strategy.
+
+import type { TestRunnerId } from './types.js'
+
+/** Text-locator grammar a runner resolves natively. Only the capture's text
+ *  branch varies by it; every other branch is portable CSS. */
+export type TextLocatorDialect = 'webdriverio' | 'xpath'
+
+/** Where the text branch sits among the capture's branches. `first` prefers the
+ *  readable text form; `fallback` reaches it only when no unique CSS locator
+ *  exists, still ahead of the meaningless positional path. */
+export type TextBranchOrder = 'first' | 'fallback'
+
+export interface LocatorDialect {
+  text: TextLocatorDialect
+  textBranch: TextBranchOrder
+  /** The call that makes the runner treat a captured XPath locator as XPath.
+   *  Undefined where naming one would be wrong (WebdriverIO needs none) or a
+   *  guess (an unidentified recorder). */
+  xpathHint?: string
+}
+
+/** An unidentified recorder gets XPath text first: it is the portable form and
+ *  the readable one, so it is the safe answer rather than a guess. */
+export function locatorDialect(
+  runner: TestRunnerId | undefined
+): LocatorDialect {
+  switch (runner) {
+    case 'mocha':
+    case 'jasmine':
+    case 'cucumber':
+      return { text: 'webdriverio', textBranch: 'first' }
+    // Every Selenium locator is wrapped in a `By.…`, so `By.xpath` asks no more
+    // of the user than `By.css` — the text form stays first.
+    case 'selenium-webdriver':
+      return { text: 'xpath', textBranch: 'first', xpathHint: 'By.xpath()' }
+    // The only runner where a bare locator string is read under a default CSS
+    // strategy, so it is the only one where XPath costs the user something.
+    case 'nightwatch':
+    case 'nightwatch-cucumber':
+      return {
+        text: 'xpath',
+        textBranch: 'fallback',
+        xpathHint: "useXpath() or locateStrategy: 'xpath'"
+      }
+    case undefined:
+      return { text: 'xpath', textBranch: 'first' }
+  }
+}
+
+/** A captured locator is portable CSS, or XPath where the element's own text
+ *  identifies it */
+export function isXPathLocator(locator: string): boolean {
+  // No CSS selector can open with `/` or `(`, so this never claims one that
+  // querySelector could have parsed. Covers `//a[…]`, `/html/…`, `./a`, `.//a`
+  // and the indexed `(//a[…])[2]`.
+  return /^\(*\.{0,2}\//.test(locator)
+}
+
+/** Tag name an XPath locator is scoped to, for a consumer that reports the tag
+ *  it matched. Undefined for CSS and for a tag-less expression (`//*[…]`). */
+export function xpathLocatorTag(locator: string): string | undefined {
+  return /^\/\/([a-z][a-z0-9-]*)\[/.exec(locator)?.[1]
+}
+
+/** WebdriverIO's text-locator forms — `tag*=Contains`, `tag=Exact`, tag optional. */
+const TEXT_LOCATOR_RE = /^([a-z][a-z0-9-]*)?(\*?)=(.+)$/i
+
+/** A text locator in either dialect, decomposed. `tag` is `*` when the form
+ *  names none; `partial` marks a contains-match rather than an exact one.
+ *  Undefined for every non-text locator, including the `concat()`-stitched
+ *  literal that text carrying both quote kinds produces — that one is left to
+ *  exact comparison rather than parsed back. */
+function textLocatorParts(
+  locator: string
+): { tag: string; text: string; partial: boolean } | undefined {
+  const xpath =
+    /^\/\/([a-z][a-z0-9-]*|\*)\[contains\(\.,\s*(["'])(.*)\2\)\]$/i.exec(
+      locator
+    )
+  if (xpath) {
+    return { tag: xpath[1]!.toLowerCase(), text: xpath[3]!, partial: true }
+  }
+  const wdio = TEXT_LOCATOR_RE.exec(locator)
+  if (!wdio) {
+    return undefined
+  }
+  return {
+    tag: wdio[1]?.toLowerCase() ?? '*',
+    text: wdio[3]!,
+    partial: wdio[2] === '*'
+  }
+}
+
+/** Whether a locator the page capture generated and one a test wrote denote the
+ *  same element. Both sides are decomposed from either dialect, because which of
+ *  the two the capture emits depends on the runner while what a test writes does
+ *  not — a `===` drops the input point whenever they differ. */
+export function locatorsMatch(captured: string, written: string): boolean {
+  if (captured === written) {
+    return true
+  }
+  const target = textLocatorParts(captured)
+  const test = textLocatorParts(written)
+  if (!target || !test) {
+    return false
+  }
+  if (target.tag !== '*' && test.tag !== '*' && target.tag !== test.tag) {
+    return false
+  }
+  // The capture stores the element's whole trimmed text, so a contains-match has
+  // to be a substring of it while an exact one names it in full.
+  return test.partial
+    ? target.text.includes(test.text)
+    : target.text === test.text
+}
diff --git a/packages/shared/src/trace-actions.ts b/packages/shared/src/trace-actions.ts
index 75eebeb2..59b34899 100644
--- a/packages/shared/src/trace-actions.ts
+++ b/packages/shared/src/trace-actions.ts
@@ -94,6 +94,15 @@ export const ACTION_MAP: Record<string, TraceAction> = {
   waitForEnabled: { class: 'Element', method: 'waitForEnabled' },
   waitForClickable: { class: 'Element', method: 'waitForClickable' },
   waitUntil: { class: 'Browser', method: 'waitForFunction' },
+  // Nightwatch's wait family, normalized onto the WDIO names above. These are
+  // written by the user and are the commands a Nightwatch test most often fails
+  // on, so leaving them out of the allow-list meant the failing step produced no
+  // row at all — and with no row, its error had nowhere to attach and neither the
+  // action list nor the Errors tab showed the failure.
+  waitForElementVisible: { class: 'Element', method: 'waitForDisplayed' },
+  waitForElementNotVisible: { class: 'Element', method: 'waitForHidden' },
+  waitForElementPresent: { class: 'Element', method: 'waitForExist' },
+  waitForElementNotPresent: { class: 'Element', method: 'waitForNotExist' },
   // WDIO page/browser reads
   getTitle: { class: 'Page', method: 'getTitle' },
   getUrl: { class: 'Page', method: 'getUrl' },
@@ -136,3 +145,33 @@ const KEYBOARD_COMMANDS: ReadonlySet<string> = new Set([
 export function isKeyboardCommand(command: string): boolean {
   return KEYBOARD_COMMANDS.has(command)
 }
+
+/** Runner-native pointer commands the trace vocabulary deliberately doesn't
+ *  name — Nightwatch's low-level mouse API has no meaningful trace method, so
+ *  adding it to ACTION_MAP would put noise in the timeline. Listed here because
+ *  they still dispatch, and a command that dispatches unrecognized keeps the
+ *  screenshot poll running straight through it. */
+const UNMAPPED_POINTER_COMMANDS: ReadonlySet<string> = new Set([
+  'moveToElement',
+  'mouseButtonClick',
+  'mouseButtonDown',
+  'mouseButtonUp',
+  'rightClick',
+  'submitForm'
+])
+
+/**
+ * Whether a runner command makes the driver dispatch trusted input into the
+ * page. Derived from the vocabulary above rather than declared as a second list:
+ * a command qualifies when it types (`isKeyboardCommand`) or when its trace
+ * method acts at a point (`POINTABLE_METHODS`). A command wrongly classified as
+ * non-dispatching is the costly direction — it leaves the screencast poll racing
+ * the dispatch — so the unmapped pointer commands above are named explicitly.
+ */
+export function isInputDispatchingCommand(command: string): boolean {
+  if (isKeyboardCommand(command) || UNMAPPED_POINTER_COMMANDS.has(command)) {
+    return true
+  }
+  const action = ACTION_MAP[command]
+  return action !== undefined && POINTABLE_METHODS.has(action.method)
+}
diff --git a/packages/shared/src/types.ts b/packages/shared/src/types.ts
index f9a8db68..2cdc9786 100644
--- a/packages/shared/src/types.ts
+++ b/packages/shared/src/types.ts
@@ -116,13 +116,27 @@ export const TEST_STATE = {
  * selenium) — wdio's runner can be mocha/jasmine/cucumber, nightwatch can be
  * vanilla or cucumber, selenium adapters report 'selenium-webdriver'.
  */
-export type TestRunnerId =
-  | 'mocha'
-  | 'jasmine'
-  | 'cucumber'
-  | 'nightwatch'
-  | 'nightwatch-cucumber'
-  | 'selenium-webdriver'
+export const TEST_RUNNER_IDS = [
+  'mocha',
+  'jasmine',
+  'cucumber',
+  'nightwatch',
+  'nightwatch-cucumber',
+  'selenium-webdriver'
+] as const
+export type TestRunnerId = (typeof TEST_RUNNER_IDS)[number]
+
+/**
+ * Narrow an untrusted value onto {@link TestRunnerId}. Needed wherever the id
+ * arrives from outside this build — a framework's own config value, or a trace
+ * zip recorded by another version — since the static type can't vouch for it.
+ */
+export function isTestRunnerId(value: unknown): value is TestRunnerId {
+  return (
+    typeof value === 'string' &&
+    (TEST_RUNNER_IDS as readonly string[]).includes(value)
+  )
+}
 
 // ─── Inner event payloads ───────────────────────────────────────────────────
 
@@ -166,6 +180,12 @@ export interface CommandLog {
   timestamp: number
   /** Wall-clock ms when the command was invoked (before execution). */
   startTime?: number
+  /** Monotonic issue order, stamped when the test issued the command. Breaks
+   *  ties the millisecond clock can't: a deferred row (a Nightwatch native
+   *  assert, finalized in a batch at test-end) is appended long after the driver
+   *  row it was issued before, so an equal `startTime` otherwise resolved in
+   *  insertion order and put the assert after the command that followed it. */
+  sequence?: number
   callSource?: string
   screenshot?: string
   testUid?: string
@@ -415,6 +435,10 @@ export interface Metadata {
   host?: string
   modulePath?: string
   desiredCapabilities?: Record<string, unknown>
+  /** Runner that recorded this stream. Drives the locator dialect the page
+   *  capture emits and the player's locator hint; undefined for a trace zip
+   *  recorded before the field existed, or by a foreign tool. */
+  runner?: TestRunnerId
 }
 
 /** Captured metadata keyed by browser `sessionId` — lets the UI keep each
diff --git a/packages/shared/tests/locator-dialect.test.ts b/packages/shared/tests/locator-dialect.test.ts
new file mode 100644
index 00000000..5ce40eee
--- /dev/null
+++ b/packages/shared/tests/locator-dialect.test.ts
@@ -0,0 +1,211 @@
+// Which locator the capture emits is decided per runner, because `a*=Logout`
+// resolves in WebdriverIO alone while `//a[…]` resolves everywhere — and because
+// XPath is free to reach in two of the three runners and not in the third. The
+// exhaustive switch means a new TestRunnerId can't fall through silently, so each
+// case is listed literally rather than looped over the table under test.
+
+import { describe, it, expect } from 'vitest'
+import {
+  isXPathLocator,
+  locatorDialect,
+  locatorsMatch,
+  xpathLocatorTag
+} from '../src/locator-dialect.js'
+import { TEST_RUNNER_IDS, isTestRunnerId } from '../src/types.js'
+
+describe('locatorDialect grammar', () => {
+  it('gives WebdriverIO its own text syntax', () => {
+    // All three are WDIO runners — the framework, not the runner, owns the syntax.
+    expect(locatorDialect('mocha').text).toBe('webdriverio')
+    expect(locatorDialect('jasmine').text).toBe('webdriverio')
+    expect(locatorDialect('cucumber').text).toBe('webdriverio')
+  })
+
+  it('gives XPath to the runners that have no text syntax', () => {
+    expect(locatorDialect('nightwatch').text).toBe('xpath')
+    expect(locatorDialect('nightwatch-cucumber').text).toBe('xpath')
+    expect(locatorDialect('selenium-webdriver').text).toBe('xpath')
+  })
+
+  it('defaults an unidentified recorder to the portable form', () => {
+    // A trace zip recorded before the runner was written into it, or by a
+    // foreign tool: XPath is resolvable everywhere, so it is the safe answer.
+    expect(locatorDialect(undefined).text).toBe('xpath')
+  })
+
+  it('answers for every runner id, so a new one cannot fall through', () => {
+    for (const runner of TEST_RUNNER_IDS) {
+      expect(['webdriverio', 'xpath']).toContain(locatorDialect(runner).text)
+    }
+  })
+})
+
+describe('locatorDialect branch order', () => {
+  it('demotes the text branch for Nightwatch alone', () => {
+    // The only runner reading a bare locator string under a default CSS
+    // strategy, so the only one an XPath locator costs an extra call.
+    expect(locatorDialect('nightwatch').textBranch).toBe('fallback')
+    expect(locatorDialect('nightwatch-cucumber').textBranch).toBe('fallback')
+  })
+
+  it('keeps the text branch first where it is free', () => {
+    // `button*=Login` is native to WDIO, and `By.xpath` is no more ceremony than
+    // `By.css` — in both, the readable text form costs the user nothing.
+    expect(locatorDialect('mocha').textBranch).toBe('first')
+    expect(locatorDialect('jasmine').textBranch).toBe('first')
+    expect(locatorDialect('cucumber').textBranch).toBe('first')
+    expect(locatorDialect('selenium-webdriver').textBranch).toBe('first')
+  })
+
+  it('leaves an unidentified recorder on the portable default', () => {
+    expect(locatorDialect(undefined).textBranch).toBe('first')
+  })
+
+  it('answers for every runner id, so a new one cannot fall through', () => {
+    for (const runner of TEST_RUNNER_IDS) {
+      expect(['first', 'fallback']).toContain(locatorDialect(runner).textBranch)
+    }
+  })
+})
+
+describe('locatorDialect xpath hint', () => {
+  it('names what Nightwatch needs, which has no // auto-detection', () => {
+    expect(locatorDialect('nightwatch').xpathHint).toBe(
+      "useXpath() or locateStrategy: 'xpath'"
+    )
+    expect(locatorDialect('nightwatch-cucumber').xpathHint).toBe(
+      "useXpath() or locateStrategy: 'xpath'"
+    )
+  })
+
+  it('names By.xpath for Selenium', () => {
+    expect(locatorDialect('selenium-webdriver').xpathHint).toBe('By.xpath()')
+  })
+
+  it('names nothing for WebdriverIO, which auto-detects the leading //', () => {
+    expect(locatorDialect('mocha').xpathHint).toBeUndefined()
+    expect(locatorDialect('jasmine').xpathHint).toBeUndefined()
+    expect(locatorDialect('cucumber').xpathHint).toBeUndefined()
+  })
+
+  it('names nothing for an unidentified recorder rather than guessing', () => {
+    expect(locatorDialect(undefined).xpathHint).toBeUndefined()
+  })
+})
+
+describe('isTestRunnerId', () => {
+  it('accepts every id in the table', () => {
+    for (const runner of TEST_RUNNER_IDS) {
+      expect(isTestRunnerId(runner)).toBe(true)
+    }
+  })
+
+  it('rejects anything else a zip or a config might carry', () => {
+    expect(isTestRunnerId('vitest')).toBe(false)
+    expect(isTestRunnerId('Mocha')).toBe(false)
+    expect(isTestRunnerId(undefined)).toBe(false)
+    expect(isTestRunnerId(null)).toBe(false)
+    expect(isTestRunnerId(1)).toBe(false)
+  })
+})
+
+describe('isXPathLocator', () => {
+  it('accepts every XPath shape a captured or hand-written locator takes', () => {
+    expect(isXPathLocator('//a[contains(., "Logout")]')).toBe(true)
+    expect(isXPathLocator('/html/body/a')).toBe(true)
+    expect(isXPathLocator('./a')).toBe(true)
+    expect(isXPathLocator('.//a')).toBe(true)
+    expect(isXPathLocator('(//a[contains(., "Logout")])[2]')).toBe(true)
+  })
+
+  it('leaves every CSS form to querySelector', () => {
+    // `[href="/logout"]` and `a.b\\/c` carry a slash but are CSS: claiming one
+    // would route it to an engine that cannot resolve it.
+    expect(isXPathLocator('#username')).toBe(false)
+    expect(isXPathLocator('a[href="/logout"]')).toBe(false)
+    expect(isXPathLocator('.flash')).toBe(false)
+    expect(isXPathLocator('body > div:nth-of-type(2) > a')).toBe(false)
+  })
+
+  it('leaves the WebdriverIO text-selectors older traces carry to their parser', () => {
+    expect(isXPathLocator('a*=Logout')).toBe(false)
+    expect(isXPathLocator('button=Login')).toBe(false)
+  })
+})
+
+describe('xpathLocatorTag', () => {
+  it('reads the tag the capture scoped its text match to', () => {
+    expect(xpathLocatorTag('//a[contains(., "Logout")]')).toBe('a')
+    expect(xpathLocatorTag('//my-button[contains(., "Go")]')).toBe('my-button')
+  })
+
+  it('has no tag to report for CSS or a tag-less expression', () => {
+    expect(xpathLocatorTag('//*[@text="Logout"]')).toBeUndefined()
+    expect(xpathLocatorTag('#username')).toBeUndefined()
+    expect(xpathLocatorTag('a*=Logout')).toBeUndefined()
+  })
+})
+
+// The exporter matches a command's locator against the captured element records
+// to stamp an input point. Once the capture emitted portable XPath, a `===` match
+// stopped recognising a test that locates by WebdriverIO text syntax.
+describe('locatorsMatch', () => {
+  const captured = '//a[contains(., "Logout here")]'
+
+  it('matches an identical locator', () => {
+    expect(locatorsMatch('#username', '#username')).toBe(true)
+    expect(locatorsMatch(captured, captured)).toBe(true)
+  })
+
+  it('matches a text locator against the XPath the capture emits for it', () => {
+    expect(locatorsMatch(captured, 'a*=Logout')).toBe(true)
+    expect(locatorsMatch(captured, '*=Logout')).toBe(true)
+    expect(locatorsMatch(captured, 'a=Logout here')).toBe(true)
+  })
+
+  it('holds the tag and the text to account', () => {
+    expect(locatorsMatch(captured, 'button*=Logout')).toBe(false)
+    expect(locatorsMatch(captured, 'a*=Login')).toBe(false)
+    // `=` is exact: the element's whole text is "Logout here", not "Logout".
+    expect(locatorsMatch(captured, 'a=Logout')).toBe(false)
+  })
+
+  it('matches through either quote style the literal may use', () => {
+    expect(locatorsMatch('//a[contains(., \'He said "go"\')]', 'a*=said')).toBe(
+      true
+    )
+  })
+
+  it('does not match unrelated CSS, or a concat()-stitched literal', () => {
+    expect(locatorsMatch('#username', 'a*=Logout')).toBe(false)
+    expect(locatorsMatch('a[href="/logout"]', 'a*=Logout')).toBe(false)
+    expect(
+      locatorsMatch('//a[contains(., concat("it\'s ", \'"x"\'))]', 'a*=x')
+    ).toBe(false)
+  })
+
+  // The capture emits WebdriverIO's own syntax under WDIO now, so the two
+  // dialects can appear on either side of the comparison.
+  describe('with a WebdriverIO-dialect capture', () => {
+    const wdioCapture = 'a*=Logout here'
+
+    it('matches a test that wrote the same dialect', () => {
+      expect(locatorsMatch(wdioCapture, 'a*=Logout')).toBe(true)
+      expect(locatorsMatch(wdioCapture, '*=Logout')).toBe(true)
+      expect(locatorsMatch(wdioCapture, 'a=Logout here')).toBe(true)
+    })
+
+    it('matches a test that wrote XPath instead', () => {
+      expect(locatorsMatch(wdioCapture, '//a[contains(., "Logout")]')).toBe(
+        true
+      )
+    })
+
+    it('still holds the tag and the text to account', () => {
+      expect(locatorsMatch(wdioCapture, 'button*=Logout')).toBe(false)
+      expect(locatorsMatch(wdioCapture, 'a*=Login')).toBe(false)
+      expect(locatorsMatch(wdioCapture, 'a=Logout')).toBe(false)
+      expect(locatorsMatch(wdioCapture, '#username')).toBe(false)
+    })
+  })
+})
diff --git a/tsconfig.json b/tsconfig.json
index 0748d964..79b23784 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -33,6 +33,9 @@
       "@wdio/devtools-backend": ["./packages/backend/src/index.ts"],
       "@wdio/devtools-backend/*": ["./packages/backend/src/*"],
       "@wdio/devtools-script": ["./packages/script/src/index.ts"],
+      // Ahead of the wildcard: the collector's wire types sit at the package
+      // root, not under `src/`, so the `/*` mapping can't reach them.
+      "@wdio/devtools-script/types": ["./packages/script/types.d.ts"],
       "@wdio/devtools-script/*": ["./packages/script/src/*"],
       "@wdio/devtools-service": ["./packages/service/src/index.ts"],
       "@wdio/devtools-service/*": ["./packages/service/src/*"],