diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
index c808685..58bdc02 100644
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -1,5 +1,5 @@
 blank_issues_enabled: true
 contact_links:
   - name: Security reports
-    url: https://github.com/tinyhumansai/rust-template/security/policy
+    url: https://github.com/tinyhumansai/tinybrowser/security/policy
     about: Please do not report vulnerabilities through public issues.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ba8c2fc..e26de19 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,6 +20,20 @@ jobs:
   rust:
     name: Rust
     runs-on: ubuntu-latest
+    env:
+      # A browser module is not meaningfully tested without a browser, and the
+      # coverage gate below is measured over the same run: with these unset, the
+      # protocol conversation would be both unexercised and uncovered, which is
+      # precisely the half that cannot be checked any other way.
+      #
+      # GitHub's Ubuntu runners ship Google Chrome at a path the module already
+      # looks in, so there is nothing to install.
+      TINYBROWSER_LIVE_TESTS: "1"
+      # Runners restrict unprivileged user namespaces, so Chrome has no usable
+      # sandbox here. Accepting that in a disposable CI VM is a different
+      # decision from applying it on somebody's host, which is why the module
+      # reports the condition rather than working around it by default.
+      TINYBROWSER_CHROME_ARGS: --no-sandbox
     steps:
       - uses: actions/checkout@v7
         with:
@@ -38,6 +52,31 @@ jobs:
 
       - uses: Swatinem/rust-cache@v2
 
+      # Named explicitly rather than left to the module's own discovery order.
+      # The runner has several browsers on it, including a snap-packaged
+      # `/usr/bin/chromium` that starts, says nothing, and is timed out — and a
+      # build should not go red because the search order changed under it. This
+      # also prints which browser was chosen, so a future failure says so in the
+      # log instead of costing a round trip to find out.
+      - name: Select a browser for the live tests
+        run: |
+          set -euo pipefail
+          for candidate in \
+            /usr/bin/google-chrome \
+            /usr/bin/google-chrome-stable \
+            /opt/google/chrome/chrome \
+            /usr/bin/chromium-browser \
+            /usr/bin/chromium
+          do
+            [ -x "$candidate" ] || continue
+            echo "selected $candidate"
+            "$candidate" --version || true
+            echo "TINYBROWSER_CHROME=$candidate" >> "$GITHUB_ENV"
+            exit 0
+          done
+          echo "no browser on this runner; the live tests cannot run" >&2
+          exit 1
+
       - name: Check formatting
         run: cargo fmt --all -- --check
 
@@ -54,27 +93,27 @@ jobs:
         run: cargo test
 
       # `cargo build --all-targets` only *compiles* an example. `AGENTS.md`
-      # promises `cargo run -p template --example basic` works, and a compiled
+      # promises `cargo run -p tinybrowser --example basic` works, and a compiled
       # example can still fail on its first line.
       - name: Run the bundled example
-        run: cargo run -p template --example basic
+        run: cargo run -p tinybrowser --example basic
 
-      # `crates/template-bus` exists so a host can name the payload types
+      # `crates/tinybrowser-bus` exists so a host can name the payload types
       # without compiling the module. That promise is invisible in a diff,
       # because a forbidden dependency arrives transitively through a feature
       # someone enabled one crate away — so it is asserted rather than
       # documented.
       #
-      # The FORWARD form is required. `cargo tree -i <crate> -p template-bus`
+      # The FORWARD form is required. `cargo tree -i <crate> -p tinybrowser-bus`
       # discards the `-p` scope, prints the whole-workspace inverse tree, and
       # exits 0 looking clean even when this crate is the one at fault.
       - name: Assert the contract crate stays transport-free
         run: |
           set -euo pipefail
-          forbidden="$(cargo tree -p template-bus -e normal,build --prefix none \
+          forbidden="$(cargo tree -p tinybrowser-bus -e normal,build --prefix none \
             | grep -Ei 'tinybus|tokio|reqwest|ureq|hyper|rusqlite|git2' || true)"
           if [ -n "$forbidden" ]; then
-            echo "template-bus pulled in a dependency its manifest forbids:" >&2
+            echo "tinybrowser-bus pulled in a dependency its manifest forbids:" >&2
             echo "$forbidden" >&2
             echo >&2
             echo "The contract is what a host compiles against. It must stay free" >&2
@@ -128,7 +167,7 @@ jobs:
         run: |
           set -euo pipefail
           msrv="$(cargo metadata --format-version 1 --no-deps \
-            | jq -r '.packages[] | select(.name == "template") | .rust_version')"
+            | jq -r '.packages[] | select(.name == "tinybrowser") | .rust_version')"
           if [[ -z "$msrv" || "$msrv" == "null" ]]; then
             echo "workspace.package.rust-version is not set in Cargo.toml" >&2
             exit 1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4acf379..f20cff8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,9 +22,9 @@ permissions:
 
 env:
   # The workspace member that ships as the loadable module. Its package name is
-  # the artifact name and the library name; `crates/template-bus` rides along on
+  # the artifact name and the library name; `crates/tinybrowser-bus` rides along on
   # the same inherited version and is not packaged separately.
-  RELEASE_PACKAGE: template
+  RELEASE_PACKAGE: tinybrowser
 
 jobs:
   prepare:
@@ -259,7 +259,7 @@ jobs:
             macOS) module="target/release/lib${library_name}.dylib" ;;
             *) echo "unsupported Unix runner: ${RUNNER_OS}" >&2; exit 1 ;;
           esac
-          cargo run --locked --package template --example verify_module -- "$module"
+          cargo run --locked --package tinybrowser --example verify_module -- "$module"
 
       - name: Verify Windows module through TinyBus loader
         if: ${{ runner.os == 'Windows' }}
@@ -270,7 +270,7 @@ jobs:
           $ErrorActionPreference = 'Stop'
           $libraryName = $env:CRATE_NAME.Replace('-', '_')
           $module = "target/release/$libraryName.dll"
-          $verifyRoot = Join-Path $env:RUNNER_TEMP 'template-module-verify'
+          $verifyRoot = Join-Path $env:RUNNER_TEMP 'tinybrowser-module-verify'
           New-Item -ItemType Directory -Force $verifyRoot | Out-Null
 
           $identity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
@@ -300,7 +300,7 @@ jobs:
 
           $verifiedModule = Join-Path $verifyRoot "$libraryName.dll"
           Copy-Item -LiteralPath $module -Destination $verifiedModule
-          cargo run --locked --package template --example verify_module -- $verifiedModule
+          cargo run --locked --package tinybrowser --example verify_module -- $verifiedModule
 
       - name: Assemble Unix module package
         if: ${{ runner.os != 'Windows' }}
@@ -463,7 +463,7 @@ jobs:
           verify_root="/opt/${CRATE_NAME}-module-verify"
           install -d -m 700 "$verify_root"
           install -m 755 "target/release/lib${library_name}.so" "$verify_root/"
-          cargo run --locked --package template --example verify_module -- \
+          cargo run --locked --package tinybrowser --example verify_module -- \
             "$verify_root/lib${library_name}.so"
 
       - name: Assemble distribution module package
@@ -587,5 +587,5 @@ jobs:
           cargo run --manifest-path vendor/tinybus/Cargo.toml --locked \
             --package tinybus --all-features --example github_module_host -- \
             "$release_url" "$archive" "$sha256"
-          cargo run --locked --package template --example verify_github_release -- \
+          cargo run --locked --package tinybrowser --example verify_github_release -- \
             "$release_url" "$archive" "$sha256"
diff --git a/AGENTS.md b/AGENTS.md
index ee8fdfc..cb3b79d 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -4,63 +4,45 @@ This file is the single source of truth for how humans and coding agents work
 in this repository. `CLAUDE.md` is a symlink to this file, so every agent reads
 the same instructions.
 
-When you generate a new project from this template, keep this file and adapt
-the project-specific parts (crate name, module map, feature flags, commands).
-Delete guidance that no longer applies rather than leaving it to rot.
-
-## Template Checklist
-
-Do this once, in a single commit, before writing feature code:
-
-- [ ] Rename `crates/template` and `crates/template-bus` to the project's crate
-      names, and update `name` in each manifest plus the `template-bus` entry in
-      the root `[workspace.dependencies]`.
-- [ ] Set `description`, `keywords`, and `categories` in each manifest, and
-      `repository` in the root `[workspace.package]`.
-- [ ] Rename the crate references in `README.md`, both `src/lib.rs` files,
-      `crates/template/examples/`, and `crates/template/tests/` (search for
-      `template` and `template_bus`).
-- [ ] Replace the placeholder `greeting` module in both crates with the first
-      real feature area — payload types in the contract crate, behavior in the
-      module crate — keeping the `mod.rs` / `types.rs` / `test.rs` layout.
-- [ ] Confirm `license` and `LICENSE` match the project's intended license.
-- [ ] Update the security contact in `SECURITY.md`.
-- [ ] Rename the TinyBus interface, object path, and member constants in
-      `crates/template-bus/src/names/`, and the matching `provides` / `methods`
-      declarations in `crates/template/src/tinybus_module/`, while keeping
-      `vendor/tinybus` pinned.
-- [ ] Reset `CONTRACT_VERSION` in `crates/template-bus/src/version/` for the new
-      contract.
-- [ ] Replace `ROADMAP.md` with the real plan, or delete it.
-- [ ] Rewrite the "Project Structure" section below to describe this workspace.
+This project began as `rust-template` and no longer is one: the template
+checklist has been worked through and removed. What remains describes this
+workspace.
 
 ## Project Structure
 
 This is a Rust 2024 cargo workspace rooted at a virtual `Cargo.toml`. Every
 crate lives under `crates/`, one directory per package, each directory named for
-the package it holds. There is no root package: the crate that ships as the
-loadable module is `crates/template`, the same as any other member.
+the package it holds. There is no root package: the crate a host loads is
+`crates/tinybrowser`, the same as any other member.
 
 ```text
 Cargo.toml              # virtual workspace: members, [workspace.package],
                         # [workspace.dependencies], [workspace.lints]
 crates/
-├── template-bus/       # the wire contract: what crosses the bus, nothing else
+├── tinybrowser-bus/    # the wire contract: what crosses the bus, nothing else
 │   ├── README.md       # why the contract is its own crate
 │   └── src/
 │       ├── lib.rs      # crate docs + the entire public re-export surface
 │       ├── names/      # interface, object path, one constant per member
 │       ├── version/    # contract version and the host bind rule
-│       └── <family>/   # one directory per payload family
-└── template/           # the module: behavior, adapter, and the cdylib
+│       ├── session/    # opening, listing, closing a browser
+│       ├── page/       # navigation, extraction, evaluation
+│       ├── snapshot/   # the accessibility tree and its refs
+│       ├── action/     # every interaction, and how an element is named
+│       ├── output/     # screenshots and the handle protocol that carries them
+│       └── errors/     # the wire error names, and which an agent can act on
+└── tinybrowser/        # the engine: behavior, adapter, and the cdylib
     ├── src/
-    │   ├── lib.rs      # crate docs + public surface, re-exporting the contract
-    │   ├── error/mod.rs      # crate-wide `Error` and `Result<T>`
-    │   ├── tinybus_module/   # TinyBus interface, ABI exports, integration tests
-    │   └── <feature>/        # one directory per feature area
-    │       ├── mod.rs        # module docs, wiring, smallest useful public API
-    │       ├── types.rs      # substantial type definitions
-    │       └── test.rs       # module-local unit tests
+    │   ├── lib.rs          # crate docs + public surface, re-exporting the contract
+    │   ├── error/          # crate-wide `Error` and `Result<T>`
+    │   ├── engine/         # `Browser`: the facade every bus member calls
+    │   ├── cdp/            # the socket, the endpoint, and launching a browser
+    │   ├── session/        # one browser and page, plus policy and refs
+    │   ├── snapshot/       # accessibility tree in, indented text and refs out
+    │   ├── interact/       # target resolution, key parsing, the in-page scripts
+    │   ├── extract/        # reading a page as text, Markdown, or DOM
+    │   ├── capture/        # screenshots and the held-output store
+    │   └── tinybus_module/ # TinyBus interface, ABI exports, integration tests
     ├── tests/          # integration tests against the public API only
     └── examples/       # runnable, compiled-in-CI usage examples
 vendor/tinybus/         # pinned TinyBus host types and module SDK
@@ -72,19 +54,37 @@ docs/
 
 ### The two-crate split
 
-`crates/template-bus` holds every type that crosses the bus and the names of the
-members that carry them. It has no transport, no runtime, and no behavior, and
-CI asserts it stays that way. A host that only makes calls depends on it alone.
+`crates/tinybrowser-bus` holds every type that crosses the bus and the names of
+the members that carry them. It has no transport, no runtime, and no behavior,
+and CI asserts it stays that way. A host that only makes calls depends on it
+alone — which is the whole point, because that host is a binary that
+deliberately does not want a browser stack in its build.
 
-`crates/template` depends on it and re-exports all of it, so
-`template::GreetRequest` and `template_bus::GreetRequest` are the *same* type
-rather than structural twins. That direction is load-bearing: a parallel set of
-payload types for hosts would mean a conversion at every call site that nothing
-checks.
+`crates/tinybrowser` depends on it and re-exports all of it, so
+`tinybrowser::Action` and `tinybrowser_bus::Action` are the *same* type rather
+than structural twins. That direction is load-bearing: a parallel set of payload
+types for hosts would mean a conversion at every call site that nothing checks.
 
 The rule for deciding where something goes: a payload type describes what a
 frame carries and belongs in the contract; anything that answers a frame, holds
-a connection, or touches an engine belongs in the module crate.
+a connection, or touches a browser belongs in the module crate.
+
+### Where the layers meet
+
+`engine::Browser` is the only thing `tinybus_module` calls, and it is the only
+thing that holds sessions and outputs. Everything below it — `cdp`, `session`,
+`snapshot`, `interact`, `extract`, `capture` — is private and written against
+`session::Session` rather than against the protocol. Two rules keep that from
+eroding:
+
+- **No decisions in the adapter.** `tinybus_module` deserializes, calls one
+  method, and maps an error to a wire name. Anything decided there could only be
+  tested through a bus, and a Rust caller using `Browser` directly would not get
+  it.
+- **Judgement goes in a pure function.** Snapshot rendering, key parsing, URL
+  policy, and output chunking are all pure, and all unit-tested without a
+  browser. If a rule can only be exercised against a live Chrome, it is in the
+  wrong place.
 
 Add a crate by creating `crates/<name>/` — `members = ["crates/*"]` picks it up
 by existing. Inherit `version`, `edition`, `rust-version`, `license`, and
@@ -114,7 +114,7 @@ broad ones.
 
 Keep public exports centralized in each crate's `src/lib.rs` so downstream users
 have one predictable surface. Put shared error variants in
-`crates/template/src/error/mod.rs` and return the crate-wide `Result<T>` from
+`crates/tinybrowser/src/error/mod.rs` and return the crate-wide `Result<T>` from
 fallible public APIs.
 
 ## Build And Test
@@ -133,8 +133,11 @@ Supporting commands:
 
 - `cargo fmt --all` — format before committing.
 - `cargo test <filter>` — run a focused subset while iterating.
-- `cargo test -p template-bus` — run one crate's suite.
-- `cargo run -p template --example basic` — run the bundled example.
+- `cargo test -p tinybrowser-bus` — run one crate's suite.
+- `cargo run -p tinybrowser --example basic` — run the bundled example.
+- `TINYBROWSER_LIVE_TESTS=1 cargo test -p tinybrowser --test live_chrome` — the
+  end-to-end suite, against a real browser. Opt-in, because a machine without
+  one would fail it for a reason unrelated to the change.
 - `cargo doc --no-deps --all-features` — build the rustdoc CI also builds with
   `RUSTDOCFLAGS="-D warnings"`.
 - `cargo test --doc` — run doctests alone when editing documentation examples.
@@ -185,7 +188,7 @@ add one:
 - gate anything optional behind a Cargo feature, documented in `Cargo.toml`;
 - declare it once in the root `[workspace.dependencies]` when more than one
   crate needs it, and take it with `{ workspace = true }`;
-- never add one to `crates/template-bus` that pulls in a transport, an async
+- never add one to `crates/tinybrowser-bus` that pulls in a transport, an async
   runtime, an HTTP client, or a native library — CI fails the build if you do;
 - leave a comment above the entry explaining *why* the crate is needed and what
   uses it — see the existing entries for the expected tone;
@@ -226,7 +229,14 @@ new module capability requires more.
   for tests) rather than mixing runtimes.
 - Tests must be deterministic and independent of network, wall-clock time, and
   execution order. Gate any live/network test behind a feature or an env var and
-  name it `live_*` so it is easy to exclude.
+  name it `live_*` so it is easy to exclude. Use an env var rather than a Cargo
+  feature here: the contract command is `cargo test --all-features`, which would
+  switch a feature on.
+- **A live test that skips silently is worse than no test.** `live_chrome`
+  checks its opt-in once and then fails if it cannot find a browser. A suite that
+  quietly does nothing reports green for a build in which nothing was checked.
+- The unit suites must not need a browser. Anything that would is a sign the
+  judgement belongs in a pure function that can be tested without one.
 - Maintain at least 90% line coverage in every source file. Add or update tests
   with every behavior change, and note any deliberately untested edge case in
   the pull request description.
@@ -295,7 +305,7 @@ Releases run from `.github/workflows/release.yml` via a manual
 an interrupted release after its version commit and tag exist. The workflow
 re-runs the full validation suite, computes the next version, updates
 the root `[workspace.package]` version and `Cargo.lock`, commits and tags
-`vX.Y.Z`, builds `crates/template` as a TinyBus module for every supported
+`vX.Y.Z`, builds `crates/tinybrowser` as a TinyBus module for every supported
 platform, pushes, and creates an immutable GitHub release with installable
 native packages.
 
diff --git a/Cargo.lock b/Cargo.lock
index b4f454e..f5f47e3 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -28,6 +28,18 @@ dependencies = [
  "syn 3.0.3",
 ]
 
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
 [[package]]
 name = "base64"
 version = "0.23.1"
@@ -40,12 +52,27 @@ version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
 
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "bumpalo"
 version = "3.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
 [[package]]
 name = "bytes"
 version = "1.12.1"
@@ -68,6 +95,41 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
+[[package]]
+name = "cfg_aliases"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
+
+[[package]]
+name = "chacha20"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "crc32fast"
 version = "1.5.0"
@@ -83,6 +145,22 @@ version = "0.8.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
 
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "data-encoding"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"
+
 [[package]]
 name = "derive_arbitrary"
 version = "1.4.2"
@@ -94,6 +172,16 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
 [[package]]
 name = "displaydoc"
 version = "0.2.7"
@@ -153,6 +241,65 @@ dependencies = [
  "miniz_oxide",
 ]
 
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
+
+[[package]]
+name = "futures-sink"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
+
+[[package]]
+name = "futures-task"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
+
+[[package]]
+name = "futures-util"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+ "futures-task",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.2.17"
@@ -160,8 +307,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "wasi",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -171,8 +320,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "r-efi",
+ "rand_core 0.10.1",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -191,12 +343,198 @@ dependencies = [
  "itoa",
 ]
 
+[[package]]
+name = "http-body"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
 [[package]]
 name = "httparse"
 version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 
+[[package]]
+name = "hyper"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d22053281f852e11534f5198498373cbb59295120a20771d90f7ed1897490a72"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "http",
+ "http-body",
+ "httparse",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+ "webpki-roots 1.0.9",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
+
+[[package]]
+name = "icu_properties"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
+
+[[package]]
+name = "icu_provider"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
 [[package]]
 name = "indexmap"
 version = "2.14.0"
@@ -207,12 +545,29 @@ dependencies = [
  "hashbrown",
 ]
 
+[[package]]
+name = "ipnet"
+version = "2.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a756c3fac73139e83f14c2d742155dd2b78d3ee56597b419a0579b7bdd6dd78"
+
 [[package]]
 name = "itoa"
 version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
+[[package]]
+name = "js-sys"
+version = "0.3.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e0c1080212aad755ea003d18543e8768dd432c48819efd73a7bf1e39b7a5a3a"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "libc"
 version = "0.2.189"
@@ -225,12 +580,24 @@ version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
+[[package]]
+name = "litemap"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+
 [[package]]
 name = "log"
 version = "0.4.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
 
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
 [[package]]
 name = "memchr"
 version = "2.8.3"
@@ -247,6 +614,17 @@ dependencies = [
  "simd-adler32",
 ]
 
+[[package]]
+name = "mio"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -265,6 +643,24 @@ version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
+[[package]]
+name = "potential_utf"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.107"
@@ -274,6 +670,62 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "quinn"
+version = "0.11.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c1a41e437b6bbd489372cd4971de128e85c855f56c57f283d20ff016cf7c0a8"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2",
+ "thiserror 2.0.20",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83"
+dependencies = [
+ "bytes",
+ "getrandom 0.4.3",
+ "lru-slab",
+ "rand 0.10.2",
+ "rand_pcg",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror 2.0.20",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35a133f956daabe89a61a685c2649f13d82d5aa4bd5d12d1277e1072a21c0694"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.47"
@@ -289,6 +741,100 @@ version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
+[[package]]
+name = "rand"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22f6172bdec972074665ed81ed53b71da00bfc44b65a753cfde883ec4c702a1a"
+dependencies = [
+ "libc",
+ "rand_chacha",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.3",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
+[[package]]
+name = "rand_pcg"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
+dependencies = [
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.12.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "webpki-roots 1.0.9",
+]
+
 [[package]]
 name = "ring"
 version = "0.17.14"
@@ -303,6 +849,12 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "rustc-hash"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
+
 [[package]]
 name = "rustix"
 version = "1.1.4"
@@ -337,6 +889,7 @@ version = "1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
 dependencies = [
+ "web-time",
  "zeroize",
 ]
 
@@ -351,6 +904,18 @@ dependencies = [
  "untrusted",
 ]
 
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
 [[package]]
 name = "serde"
 version = "1.0.229"
@@ -403,18 +968,90 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a978451301f4db1d02937a4ab3ccce137717b81826e79b7d49ffe3244a13c3b8"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest",
+]
+
 [[package]]
 name = "shlex"
 version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
 [[package]]
 name = "simd-adler32"
 version = "0.3.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
 
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+
+[[package]]
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
 [[package]]
 name = "subtle"
 version = "2.6.1"
@@ -433,14 +1070,34 @@ dependencies = [
 ]
 
 [[package]]
-name = "syn"
-version = "3.0.3"
+name = "syn"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
 dependencies = [
  "proc-macro2",
  "quote",
- "unicode-ident",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -468,32 +1125,32 @@ dependencies = [
 ]
 
 [[package]]
-name = "template"
-version = "0.2.1"
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
 dependencies = [
- "serde_json",
- "template-bus",
- "thiserror",
- "tinybus",
- "tinybus-module",
- "tokio",
+ "thiserror-impl 1.0.69",
 ]
 
 [[package]]
-name = "template-bus"
-version = "0.2.1"
+name = "thiserror"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
 dependencies = [
- "serde",
- "serde_json",
+ "thiserror-impl 2.0.20",
 ]
 
 [[package]]
-name = "thiserror"
-version = "2.0.20"
+name = "thiserror-impl"
+version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
- "thiserror-impl",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -507,6 +1164,34 @@ dependencies = [
  "syn 3.0.3",
 ]
 
+[[package]]
+name = "tinybrowser"
+version = "0.2.1"
+dependencies = [
+ "base64 0.22.1",
+ "futures-util",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "sha2",
+ "thiserror 2.0.20",
+ "tinybrowser-bus",
+ "tinybus",
+ "tinybus-module",
+ "tokio",
+ "tokio-tungstenite",
+ "url",
+ "uuid",
+]
+
+[[package]]
+name = "tinybrowser-bus"
+version = "0.2.1"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "tinybus"
 version = "0.1.0"
@@ -517,7 +1202,7 @@ dependencies = [
  "serde_json",
  "tar",
  "tempfile",
- "thiserror",
+ "thiserror 2.0.20",
  "tinybus-macros",
  "tokio",
  "toml",
@@ -547,6 +1232,31 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "tinystr"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
 [[package]]
 name = "tokio"
 version = "1.53.1"
@@ -554,8 +1264,13 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
 dependencies = [
  "bytes",
+ "libc",
+ "mio",
  "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
  "tokio-macros",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -569,6 +1284,32 @@ dependencies = [
  "syn 3.0.3",
 ]
 
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-tungstenite"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edc5f74e248dc973e0dbb7b74c7e0d6fcc301c694ff50049504004ef4d0cdcd9"
+dependencies = [
+ "futures-util",
+ "log",
+ "rustls",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tungstenite",
+ "webpki-roots 0.26.11",
+]
+
 [[package]]
 name = "toml"
 version = "0.8.23"
@@ -610,6 +1351,51 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
 
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "bitflags",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "pin-project-lite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "url",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
 [[package]]
 name = "tracing"
 version = "0.1.44"
@@ -641,6 +1427,38 @@ dependencies = [
  "once_cell",
 ]
 
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "tungstenite"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18e5b8366ee7a95b16d32197d0b2604b43a0be89dc5fac9f8e96ccafbaedda8a"
+dependencies = [
+ "byteorder",
+ "bytes",
+ "data-encoding",
+ "http",
+ "httparse",
+ "log",
+ "rand 0.8.7",
+ "rustls",
+ "rustls-pki-types",
+ "sha1",
+ "thiserror 1.0.69",
+ "utf-8",
+]
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.24"
@@ -659,7 +1477,7 @@ version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "972d7902c8735f2695410b8aed7df6ed12a47394aa1c8d7af49f0497b731a94d"
 dependencies = [
- "base64",
+ "base64 0.23.1",
  "flate2",
  "log",
  "percent-encoding",
@@ -667,7 +1485,7 @@ dependencies = [
  "rustls-pki-types",
  "ureq-proto",
  "utf8-zero",
- "webpki-roots",
+ "webpki-roots 1.0.9",
 ]
 
 [[package]]
@@ -676,24 +1494,158 @@ version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "da5f78b09e6941e1a0f2e30e695e4b120377b54d5e0aec11b594bb57b3971613"
 dependencies = [
- "base64",
+ "base64 0.23.1",
  "http",
  "httparse",
  "log",
 ]
 
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf-8"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+
 [[package]]
 name = "utf8-zero"
 version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8c0a043c9540bae7c578c88f91dda8bd82e59ae27c21baca69c8b191aaf5a6e"
 
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "uuid"
+version = "1.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2cefc03fd367c0c6d4305de1b312cf00248c4114f4a0418ce6a6af769e3b0bd9"
+dependencies = [
+ "getrandom 0.4.3",
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
 [[package]]
 name = "wasi"
 version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b70935747edd64d89de3efa29d73789b806c15798f8e7dca4d8ac356b50ce70"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.77"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b7777d5cc23d0e91404e53ce2d5e8ec7acae3026b16233dba62cd3246457950"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77775f8f3f7217702089053b94958f8f54061a3f663417df76e19cbdcca29bc1"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e11d33f857dc2fb11b8bc75aee111aa9cbeb12cd9f25efd3d4c2a3dd4e235284"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ef64dbcc55df09c7e5a46182d181c2cfa3e925f3da937ea764728b4bbb9dcbf"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c435338968042f4f59a557f690a253676d47ce13ceb55d70100e7facf6620a30"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "0.26.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
+dependencies = [
+ "webpki-roots 1.0.9",
+]
+
 [[package]]
 name = "webpki-roots"
 version = "1.0.9"
@@ -800,6 +1752,12 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "writeable"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+
 [[package]]
 name = "xattr"
 version = "1.6.1"
@@ -810,12 +1768,109 @@ dependencies = [
  "rustix",
 ]
 
+[[package]]
+name = "yoke"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "556764e583adb45a9f8d413c2a147fa7e8d821e48e12b14fd560b607998b75eb"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2ab42fc20575779bd240faa45f94a74256f755c0fa9e89f0ede20d91d0cdfc1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
 [[package]]
 name = "zeroize"
 version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
 
+[[package]]
+name = "zerotrie"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "zip"
 version = "2.4.2"
@@ -829,7 +1884,7 @@ dependencies = [
  "flate2",
  "indexmap",
  "memchr",
- "thiserror",
+ "thiserror 2.0.20",
  "zopfli",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index fae3c38..855102d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -22,15 +22,15 @@ version = "0.2.1"
 edition = "2024"
 rust-version = "1.88"
 license = "GPL-3.0-only"
-repository = "https://github.com/tinyhumansai/rust-template"
+repository = "https://github.com/tinyhumansai/tinybrowser"
 
 [workspace.dependencies]
-# The wire contract. `crates/template` depends on it and re-exports it, so a
+# The wire contract. `crates/tinybrowser` depends on it and re-exports it, so a
 # host that only makes calls takes this crate alone.
 # No `version` requirement on purpose: the workspace version moves on every
 # release, and a pinned requirement here would stop resolving the moment it did.
 # Nothing in this workspace is published, so the path is the whole address.
-template-bus = { path = "crates/template-bus" }
+tinybrowser-bus = { path = "crates/tinybrowser-bus" }
 # TinyBus defines the message types, interface macro, and frozen module ABI
 # used by the generated integration. Socket and CLI features are unnecessary
 # here.
diff --git a/MODULE.md b/MODULE.md
index 651906e..32dd078 100644
--- a/MODULE.md
+++ b/MODULE.md
@@ -1,15 +1,46 @@
-# Template TinyBus Module
+# TinyBrowser Module
 
-This package contains the native `template` module for TinyBus module ABI
+This package contains the native `tinybrowser` module for TinyBus module ABI
 v1. Install only the archive matching the host operating system and
 architecture.
 
-The module claims `ai.tinyhumans.template.Greeting`, serves the object at
-`/ai/tinyhumans/template/Greeting`, and provides the `Greet` method. The
-method accepts a `GreetRequest` and returns a `GreetResponse` carrying
-`Hello, <name>!`; empty names are rejected. Both payload types, the interface
-name, the object path, and the member names are published as the `template-bus`
-crate, so a host names them from a library rather than by string literal.
+The module claims `ai.tinyhumans.tinybrowser.Browser`, serves the object at
+`/ai/tinyhumans/tinybrowser/Browser`, and provides twelve methods:
+`OpenSession`, `CloseSession`, `ListSessions`, `Navigate`, `Snapshot`,
+`Perform`, `ReadPage`, `Evaluate`, `Screenshot`, `ReadOutput`, `ReleaseOutput`,
+and `ContractVersion`. Every payload type, the interface name, the object path,
+and the member names are published as the `tinybrowser-bus` crate, so a host
+names them from a library rather than by string literal.
+
+## What it needs from the host
+
+A Chrome or Chromium, or a DevTools endpoint to attach to. The module looks in
+the conventional install locations for the platform. Two environment variables
+override that, and both describe the machine rather than any one caller:
+
+- `TINYBROWSER_CHROME` — the browser binary to launch.
+- `TINYBROWSER_CHROME_ARGS` — extra launch flags for every session.
+  `--no-sandbox` belongs here on a host where unprivileged user namespaces are
+  restricted, which is the default on Ubuntu 23.10 and later and in containers
+  without the right capabilities.
+
+A launched browser gets a fresh profile directory that is removed when its
+session closes, so one session's cookies and logins never reach the next. A
+session that attaches to an endpoint leaves that browser running when it closes.
+
+## Operational notes
+
+A session is a browser process. The module holds at most eight at once and
+refuses the ninth rather than starting it; a host is expected to close what it
+opens. Screenshots are held for collection, capped at 16 outstanding and expired
+after five minutes, and a host that reads one to completion should release it.
+
+The `allowed_origins` on a session is a guard rail, not a sandbox: it refuses
+navigations the module is asked to make, and a page's own JavaScript can
+navigate around it. A host that needs a real boundary puts the browser in a
+network namespace that only reaches what it should.
+
+## Installing
 
 The archive contains one `.so`, `.dylib`, or `.dll` plus `modules.toml`. Keep
 those files together when copying them into a TinyBus module directory. The
@@ -22,8 +53,8 @@ archive. Install directly from a tagged release with:
 
 ```sh
 tinybus modules load-github \
-  https://github.com/tinyhumansai/rust-template/releases/tag/v0.1.5 \
-  template-0.1.5-ubuntu-24.04-x86_64.tar.gz \
+  https://github.com/tinyhumansai/tinybrowser/releases/tag/v0.1.0 \
+  tinybrowser-0.1.0-ubuntu-24.04-x86_64.tar.gz \
   <archive-sha256>
 ```
 
diff --git a/README.md b/README.md
index 67a4e39..9512907 100644
--- a/README.md
+++ b/README.md
@@ -1,156 +1,143 @@
-# Rust Template
-
-A production-ready Rust 2024 TinyBus module template used by TinyHumans AI. It
-ships the workspace layout, TinyBus ABI adapter, error handling, testing,
-documentation, CI, and multi-platform release workflow that every new
-integration in this organization starts from.
-
-It is a two-crate cargo workspace. `crates/template-bus` is the wire contract —
-member names, payload types, and the contract version, with no transport and no
-behavior — and `crates/template` is the implementation, built as both an `rlib`
-and the `cdylib` TinyBus loads. A host that only makes calls depends on the
-contract crate alone and compiles neither the module nor `tinybus` itself.
-
-## Use This Template
-
-Choose **Use this template** on GitHub, create a repository, then work through
-the checklist at the top of [`AGENTS.md`](AGENTS.md):
-
-- rename the `crates/template` and `crates/template-bus` directories and the
-  `name` fields in their manifests, and set the shared `description`,
-  `repository`, `keywords`, and `categories`;
-- update this README and the crate documentation in `crates/template/src/lib.rs`;
-- replace the placeholder `greeting` module with the first real feature area, in
-  both crates: the payload types in the contract, the behavior in the module;
-- rename the TinyBus interface, object path, and member constants in
-  `crates/template-bus/src/names/`, and the matching `provides` / `methods`
-  declarations in `crates/template/src/tinybus_module/`;
-- update the security contact and repository links in the community files;
-- replace `ROADMAP.md` with the real plan, or delete it;
-- change the license if GPL-3.0-only is not appropriate.
-
-Search for `template` and `template_bus` to find every remaining
-template-specific value.
-
-## What You Get
-
-| Area | What is configured |
-| --- | --- |
-| Layout | A cargo workspace under `crates/`, split into a dependency-light wire contract and the module that implements it; directory modules with `mod.rs` / `types.rs` / `test.rs`, a crate-wide error type, integration tests, and a runnable example |
-| Lints | `unsafe_code` forbidden, `missing_docs`, clippy `all` + `pedantic`, no `unwrap`/`expect`/`panic`/`todo` in library code — all declared once in `[workspace.lints]` so every crate, local run, and CI run agree |
-| CI | Format, clippy, build, test (default and all features), a run of the bundled example, an assertion that the contract crate stays transport-free, at least 90% line coverage in every source file, rustdoc with `-D warnings`, an MSRV build, and a `cargo-deny` supply-chain check |
-| Release | Manual `workflow_dispatch` bump that validates, versions, tags, and creates installable native module packages for every supported platform |
-| Community | Issue and pull request templates, Dependabot, contributing, security, support, and code of conduct docs |
-| Agents | [`AGENTS.md`](AGENTS.md) as the single source of truth, symlinked as `CLAUDE.md`, plus a `.claude/settings.json` allowlist for the standard commands |
-| Vendor | TinyBus host types and module SDK pinned as the `vendor/tinybus` build-time submodule |
+# tinybrowser
+
+A browser for agents, shipped as a loadable [TinyBus](https://github.com/tinyhumansai/tinybus)
+module.
 
-## Layout
+`tinybrowser` drives a real Chrome over the Chrome DevTools Protocol — launching
+it, navigating, snapshotting the accessibility tree, dispatching real input
+events, extracting text, taking screenshots — and publishes all of it as a
+handful of bus members. A host loads one `cdylib` and gets a browser without a
+browser stack in its build.
 
 ```text
-Cargo.toml              # virtual workspace: members, shared metadata, lints
-crates/
-├── template-bus/       # the wire contract — what crosses the bus
-│   ├── README.md       # why the contract is its own crate
-│   └── src/
-│       ├── lib.rs      # crate docs + the entire public re-export surface
-│       ├── names/      # interface, object path, one constant per member
-│       ├── greeting/   # payload types, one directory per family
-│       │   ├── mod.rs
-│       │   ├── types.rs
-│       │   └── test.rs
-│       └── version/    # contract version and the host bind rule
-└── template/           # the module — behavior, adapter, and the cdylib
-    ├── src/
-    │   ├── lib.rs      # crate docs + public surface, re-exporting the contract
-    │   ├── error/      # crate-wide `Error` and `Result<T>`
-    │   ├── greeting/   # one directory per feature area
-    │   └── tinybus_module/   # bus interface, setup, and ABI v1 exports
-    ├── tests/
-    │   └── public_api.rs     # integration tests against the public API only
-    └── examples/
-        ├── basic.rs                  # ordinary library API usage
-        ├── verify_module.rs          # local dynamic-module verification
-        └── verify_github_release.rs  # tagged-release download and bus call
-vendor/
-└── tinybus/            # pinned TinyBus git submodule
-docs/
-├── README.md           # documentation index and conventions
-├── specs/              # behavior and architecture specifications
-├── plans/              # implementation-ordered delivery plans
-└── adr/                # immutable architecture decision records
+OpenSession  ->  Navigate  ->  Snapshot  ->  Perform  ->  Snapshot  ->  ...
+                                   |             |
+                               ReadPage      Screenshot
 ```
 
-The split is the point. A payload type describes what a frame carries; the
-behavior that answers it is a different obligation. `template` depends on
-`template-bus` and re-exports all of it, so `template::GreetRequest` and
-`template_bus::GreetRequest` are the *same* type rather than structural twins,
-and a host is never forced to choose between linking the whole module and
-redefining the vocabulary. See
-[`crates/template-bus/README.md`](crates/template-bus/README.md).
+## Why it exists
 
-Within each crate, feature areas use directory modules: implementation and
-exports live in `mod.rs`, substantial types move to `types.rs`, and unit tests
-live in `test.rs`. [`AGENTS.md`](AGENTS.md) holds the complete repository
-guidance, and `CLAUDE.md` is a symlink to it so every coding agent reads one
-source of truth.
+An agent host that wants to look at a web page has bad options. Shelling out to
+a browser CLI means a subprocess, a JSON parser around its output, and a binary
+to install and version-match. Linking a browser stack in means dragging a
+WebSocket client, a TLS stack, an image codec and a protocol surface into a
+binary that mostly does something else — and a crash anywhere in it is a crash
+in the host.
 
-## Development
+This is the third option: the browser lives behind a wire. The host keeps a
+proxy and a `serde` derive.
+
+## What an agent sees
+
+A snapshot, not HTML:
+
+```text
+- RootWebArea "Example Domain"
+  - heading "Example Domain" @e1
+  - paragraph "This domain is for use in illustrative examples." @e2
+  - link "More information..." @e3
+```
+
+That is the browser's own accessibility tree — an order of magnitude smaller
+than the DOM, with hidden nodes already gone and every control carrying its
+role, name, and state. The agent picks `@e3` and passes it straight back as the
+target of a click, so the thing it acts on is the thing it saw. A ref from an
+older view is refused rather than resolved against whatever now occupies that
+position.
+
+## The surface
+
+| Member | What it does |
+| --- | --- |
+| `OpenSession` / `CloseSession` / `ListSessions` | Launch or attach a browser, and give it back |
+| `Navigate` | Go somewhere, waiting as far as `commit`, `load`, or `networkIdle` |
+| `Snapshot` | The accessibility tree, with refs |
+| `Perform` | Click, fill, type, press, select, check, hover, scroll, wait, read, go back |
+| `ReadPage` | The page as text, Markdown, or serialized DOM |
+| `Evaluate` | JavaScript in, value out |
+| `Screenshot` + `ReadOutput` / `ReleaseOutput` | An image, collected in chunks |
+| `ContractVersion` | What a host checks before its first real call |
+
+Every name and payload is published by `tinybrowser-bus`, a two-dependency crate
+a host links instead of repeating string literals.
+
+## Using it
+
+### From Rust, directly
+
+```rust,no_run
+use tinybrowser::{Action, Browser, NavigateRequest, SnapshotRequest, Target};
+
+# async fn example() -> tinybrowser::Result<()> {
+let browser = Browser::new();
+let session = browser.open_session(Default::default()).await?;
+
+browser.navigate(&session.id, &NavigateRequest::new("https://example.com")).await?;
+let snapshot = browser.snapshot(&session.id, &SnapshotRequest::interactive()).await?;
+println!("{}", snapshot.tree);
+
+browser
+    .perform(&session.id, &Action::Click { target: Target::parse("@e1"), new_tab: false })
+    .await?;
+browser.close_session(&session.id).await?;
+# Ok(())
+# }
+```
 
-Clone with submodules, or initialize them before building:
+### From a host, over the bus
+
+`crates/tinybrowser/examples/over_the_bus.rs` is the reference: load the module,
+wait for it to claim its name, check the contract version, then call. Run it
+against a module you have built:
 
 ```sh
-git submodule update --init --recursive
+cargo build -p tinybrowser --release
+cargo run -p tinybrowser --example over_the_bus -- \
+  target/release/libtinybrowser.so https://example.com
 ```
 
+`docs/openhuman-integration.md` covers wiring it into an OpenHuman host and the
+agent-facing tool that sits on top.
+
+## Requirements
+
+A Chrome or Chromium on the host, or a DevTools endpoint to attach to. The
+module looks in the conventional places; `TINYBROWSER_CHROME` names one
+explicitly, and `TINYBROWSER_CHROME_ARGS` adds launch flags every session needs
+— `--no-sandbox` on a host where unprivileged user namespaces are restricted,
+most often.
+
+A host that already runs a browser should point the module at it instead, with
+`SessionOptions::endpoint`.
+
+## Development
+
 ```sh
+git submodule update --init --recursive
+
 cargo fmt --all -- --check
 cargo clippy --all-targets --all-features -- -D warnings
 cargo build --all-targets --all-features
 cargo test --all-features
-cargo run -p template --example basic
-cargo build -p template --release --lib   # produces the installable cdylib
 ```
 
-Those four checks are exactly what CI runs. Optional extras:
+The end-to-end suite drives a real browser and is opt-in, because a runner
+without one would fail it for the wrong reason:
 
 ```sh
-cargo doc --no-deps --all-features   # CI builds this with RUSTDOCFLAGS="-D warnings"
-cargo deny check all                 # supply-chain check; see deny.toml
-cargo install cargo-llvm-cov         # once, before running the coverage gate
-.github/scripts/check-file-coverage.sh 90 coverage.json
+TINYBROWSER_LIVE_TESTS=1 cargo test -p tinybrowser --test live_chrome
 ```
 
-## Releasing
-
-Run the **Release** workflow from the Actions tab with a `patch`, `minor`, or
-`major` bump. Use `current` only to resume an interrupted release whose version
-commit and tag already exist. The workflow revalidates the workspace, versions
-and tags it — one `[workspace.package]` version that every member inherits —
-builds `crates/template` as a TinyBus `cdylib`, and creates a GitHub release.
-Assets follow `template-<version>-<platform>.<tar.gz|zip>` and contain the
-native module, its SHA-256 `modules.toml`, license, and
-[`MODULE.md`](MODULE.md). Every release also publishes `checksum.toml`, which
-TinyBus uses to verify an archive before extraction. The workflow loads the
-published Ubuntu archive through TinyBus's GitHub release API and calls its
-`Greet` method before declaring the release successful. TinyBus itself is not
-shipped by this repository; the pinned submodule is the build-time SDK. The stable native
-matrix covers Ubuntu 22.04 and 24.04 on x86_64 and ARM64; Fedora 43 and 44 on
-x86_64 and ARM64; rolling Arch Linux on its officially supported x86_64
-architecture; macOS 15 and 26 on Intel and Apple Silicon; Windows Server 2022
-and 2025 on x86_64; and Windows 11 on ARM64. Preview, deprecated, and unofficial
-architecture images are not release gates. Do not hand-edit the version in the
-root `Cargo.toml`.
-
-## Documentation
-
-- [`AGENTS.md`](AGENTS.md) — repository guidelines for humans and agents
-- [`CONTRIBUTING.md`](CONTRIBUTING.md) — how to propose a change
-- [`docs/specs/`](docs/specs/README.md) — behavior and architecture specs
-- [`docs/plans/`](docs/plans/README.md) — test-first implementation plans
-- [`docs/adr/`](docs/adr/0001-record-architecture-decisions.md) — architecture
-  decision records
-- [`SECURITY.md`](SECURITY.md) — how to report a vulnerability
+`AGENTS.md` is the full working agreement. `CLAUDE.md` is a symlink to it.
+
+## Credit
+
+The design owes a great deal to Vercel's
+[`agent-browser`](https://github.com/vercel-labs/agent-browser): the
+accessibility tree as the thing an agent reads, `@ref` addressing scoped to a
+snapshot, and hit-testing a click point before dispatching at it. See
+`THIRD-PARTY.md`.
 
 ## License
 
-GPL-3.0-only. See [LICENSE](LICENSE).
+GPL-3.0-only. See `LICENSE`.
diff --git a/ROADMAP.md b/ROADMAP.md
index 1134024..d8a7bbd 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -1,26 +1,48 @@
 # Roadmap
 
-Replace this file with the real plan for the crate generated from this
-template, or delete it if the project does not need a public roadmap.
-
-Keep it short and honest: what exists, what is next, and what is deliberately
-out of scope. A roadmap that lists everything is a roadmap nobody trusts.
+What exists, what is next, and what is deliberately out of scope.
 
 ## Shipped
 
-- module layout, crate-wide error type, and the public re-export surface
-- lint configuration in `[lints]`, enforced identically locally and in CI
-- CI: format, clippy, build, test, per-file coverage, rustdoc, MSRV, and
-  supply-chain checks
-- a manual release workflow that versions, tags, publishes to crates.io, and
-  creates a GitHub release with crate and TinyBus runtime/module assets
+- a CDP engine: launching or attaching, one multiplexed socket, flat page
+  sessions, and teardown that does not leave a browser behind
+- accessibility snapshots rendered as indented text with `@ref` addressing,
+  scoped to the generation that minted them
+- interactions through real input events — click with hit-testing, fill, type,
+  press, select, check, hover, scroll, wait — addressed by ref, CSS selector, or
+  semantic locator
+- extraction as text, Markdown, or serialized DOM, and JavaScript evaluation
+- screenshots, held and collected in chunks with a digest to verify them
+- an error taxonomy where every failure carries a stable wire name, and the
+  contract says which of them an agent can act on
+- the `TinyBus` module: twelve members, a version handshake, and a `cdylib` that
+  CI loads through the real dynamic loader
+- an end-to-end suite against a real Chrome, serving its own fixtures on
+  loopback
 
 ## Next
 
-- the first real feature area, replacing the placeholder `greeting` module
-- module-level `README.md` and `docs/spec/` entries as modules grow
+- multiple tabs per session: `Tabs`, `SelectTab`, and adopting the page a click
+  with `new_tab` opened, which currently opens a tab the session does not drive
+- cookie and storage state a host can save and restore, so a session can resume
+  an authenticated one without the module holding credentials
+- network interception: refusing or recording requests, which is also the only
+  way to make the origin policy a boundary rather than a guard rail
+- `Snapshot` diffing, so an agent acting in a loop reads what changed rather than
+  the whole tree each time
 
 ## Out Of Scope
 
-- anything that cannot be tested deterministically
-- convenience wrappers that hide the crate's error taxonomy from callers
+- an agent, a model, or tool schemas. This module drives a browser and describes
+  what it sees; deciding what to click is the host's job, and a module shipping
+  its own prompt would be one more thing to keep in step with a model it cannot
+  see.
+- a sandbox. `allowed_origins` is a guard rail an in-page navigation can defeat,
+  and it says so. A host that needs a boundary puts the browser in a network
+  namespace.
+- persistence. Sessions live in memory and end with the process.
+- downloading a browser. Finding one is a fixed list and an environment
+  variable; a module that fetches and executes a binary is a different kind of
+  thing.
+- anything that cannot be tested deterministically, or only against a live page
+  on the public internet.
diff --git a/THIRD-PARTY.md b/THIRD-PARTY.md
new file mode 100644
index 0000000..9ea03e5
--- /dev/null
+++ b/THIRD-PARTY.md
@@ -0,0 +1,45 @@
+# Third-Party Notices
+
+## agent-browser
+
+Copyright Vercel, Inc. Licensed under the Apache License, Version 2.0.
+
+<https://github.com/vercel-labs/agent-browser>
+
+`crates/tinybrowser` is an independent implementation, but its design is taken
+from `agent-browser` and it would not look the way it does without it. The
+specific debts:
+
+- **The accessibility tree is what an agent reads.** Not the DOM, not a
+  screenshot — the browser's own computed answer to "what is here and what does
+  it do", rendered as indented text. This is the central idea, and it is theirs.
+- **`@ref` addressing scoped to a snapshot.** Every actionable node in a
+  snapshot carries a short ref an agent passes straight back, so the thing it
+  acts on is the thing it saw, and a ref from an older view is refused rather
+  than silently resolved against whatever now occupies that position.
+- **Hit-testing before dispatching a click.** Measuring the click point,
+  checking with `elementFromPoint` that the target is what sits there, and
+  failing with the name of the covering element rather than delivering the click
+  to a consent banner and reporting success.
+- **Flat CDP session attachment**, with one socket multiplexing browser-level
+  and page-level commands.
+- **The interaction vocabulary** — click, fill, type, press, select, hover,
+  scroll, wait, and semantic locators by role, text, label, placeholder, and
+  test id — follows theirs closely, deliberately, so that a host can move
+  between the two without relearning what the verbs mean.
+
+No code was copied. The protocol conversation, the error taxonomy, the session
+and held-output model, the origin policy, and the whole `TinyBus` surface are
+this repository's own, and the licences differ — `agent-browser` is Apache-2.0
+and this project is GPL-3.0-only, a direction that is compatible one way and not
+the other.
+
+The Apache-2.0 licence requires that its notice travel with derivative work.
+This file is that notice, and it is here whether or not the requirement strictly
+attaches, because the credit is owed either way.
+
+## TinyBus
+
+`vendor/tinybus` is a git submodule of <https://github.com/tinyhumansai/tinybus>
+and carries its own licence and copyright. It is pinned by gitlink and never
+modified from this repository.
diff --git a/crates/template-bus/README.md b/crates/template-bus/README.md
deleted file mode 100644
index 7f8e99c..0000000
--- a/crates/template-bus/README.md
+++ /dev/null
@@ -1,100 +0,0 @@
-# template-bus
-
-Every type that crosses the template module's `TinyBus` boundary, and the names
-of the members that carry them.
-
-The template ships as a loadable module so a host does not compile the
-implementation: `crates/template` is built as a `cdylib` and exports one object.
-A host can load that binary but cannot `use` anything out of it, so the payload
-vocabulary has to be published as an ordinary library. This is it.
-
-| module     | what it holds                                                |
-| ---------- | ------------------------------------------------------------ |
-| `names`    | interface name, object path, one constant per member          |
-| `greeting` | the value vocabulary: the `Greet` request and response        |
-| `version`  | `CONTRACT_VERSION` and the bind rule a host applies to it     |
-
-Two dependencies, both pure Rust: `serde` and `serde_json`.
-
-## This crate sits underneath `template`
-
-`template` **depends on this crate and re-exports all of it**. That direction
-matters, and it is the opposite of the obvious one.
-
-A *host* needs the payload types and needs nothing else: it loads the module and
-makes calls, so it names `GreetRequest` and `GreetResponse` but implements no
-behavior and links no transport. Making it depend on the whole module crate — and
-through it on `tinybus`, `tokio`, and the module SDK — to spell a payload type
-would be the wrong shape.
-
-The alternative, a parallel set of payload types for hosts, is worse: a
-`GreetRequest` defined twice is two distinct types, with a conversion at every
-call site that nothing checks. One definition, here, at the bottom.
-
-Because the re-export is by module as well as by item, `template::GreetRequest`,
-`template::names::OBJECT_PATH`, and `template_bus::greeting::GreetRequest` all
-resolve to the same items, not twins.
-
-So: a module author depends on `template` and gets behavior and vocabulary. A
-host depends on `template-bus` and gets vocabulary alone.
-
-## What is deliberately absent
-
-**No behavior.** `greet` lives in `crates/template`. A payload type describes
-what a frame carries, not what the module does with it. The split is readable
-off the path: a name here is data, a name there is an obligation.
-
-**No transport.** This crate does not depend on `tinybus` and holds no
-connection, client, or codec. A host already owns its connection — its reconnect
-policy, its timeouts, its tracing — and the useful part is the vocabulary.
-
-That is also structural, not just preference: `tinybus` is vendored as a
-submodule whose manifest inherits fields from its own nested
-`[workspace.package]`. Keeping the contract crate transport-free is what keeps
-it down to two dependencies and what lets anything in the workspace — or outside
-it — depend on it freely. CI asserts the dependency tree stays that way.
-
-## Making a call
-
-Arguments travel as a positional JSON array — `#[tinybus::interface]` decodes
-them into a tuple — and the member name comes from `names`:
-
-```rust,ignore
-use template_bus::{names, GreetRequest, GreetResponse};
-
-let proxy = connection.proxy(names::INTERFACE, names::OBJECT_PATH, names::INTERFACE)?;
-let reply: GreetResponse = proxy
-    .call(names::methods::GREET, (GreetRequest::new("Ferris"),))
-    .await?;
-assert_eq!(reply.greeting, "Hello, Ferris!");
-```
-
-Nothing above is a string literal at a call site. Renaming the interface, the
-path, or a member is therefore a compile error in every consumer rather than an
-`UnknownMethod` discovered at runtime.
-
-## Staying in step with the module
-
-`names::METHODS` lists every member in dispatch order. `crates/template` asserts
-its served members against that list, so a method added to the interface without
-an entry here fails that crate's tests rather than surfacing in a host.
-
-## Versioning
-
-`CONTRACT_VERSION` describes *this vocabulary*, not the package. Bump its major
-component when a payload's wire form changes incompatibly or a member is removed
-or renamed, and its minor component when a member or an optional field is added.
-It is deliberately independent of the package version the release workflow owns,
-which tracks the shipped artifact.
-
-The payload tests pin the serde representation, because that representation is
-the wire form: a host and a module that disagree about a field name fail at
-runtime with a decode error, so the shape is asserted rather than assumed.
-
-## Generating a project from the template
-
-Rename the interface, the object path, and the member constants in `names`
-together, replace `greeting` with the first real payload family, and reset
-`CONTRACT_VERSION` to `(1, 0)` for the new contract. Keep the crate
-dependency-light: the moment it links a transport or a runtime, the reason it
-exists is gone.
diff --git a/crates/template-bus/src/greeting/mod.rs b/crates/template-bus/src/greeting/mod.rs
deleted file mode 100644
index f810aab..0000000
--- a/crates/template-bus/src/greeting/mod.rs
+++ /dev/null
@@ -1,17 +0,0 @@
-//! The payloads the `Greet` member exchanges.
-//!
-//! A module root like this one documents the module, wires its pieces together,
-//! and exposes the smallest useful API. The type definitions live in the
-//! sibling `types.rs`, and the unit tests in `test.rs`, wired in at the bottom
-//! of this file.
-//!
-//! Replace this module with the first real payload family the module carries.
-//! Payload types are `serde`-derived, `#[non_exhaustive]`, and hold owned data:
-//! they are decoded from a frame, so they can borrow nothing from the caller.
-
-mod types;
-
-pub use types::{GreetRequest, GreetResponse};
-
-#[cfg(test)]
-mod test;
diff --git a/crates/template-bus/src/greeting/test.rs b/crates/template-bus/src/greeting/test.rs
deleted file mode 100644
index 1a30000..0000000
--- a/crates/template-bus/src/greeting/test.rs
+++ /dev/null
@@ -1,65 +0,0 @@
-//! Unit tests for the `Greet` payloads.
-//!
-//! These pin the serde representation. It is the wire form: a host and a module
-//! that disagree about a field name fail at runtime with a decode error, so the
-//! shape is asserted here rather than assumed.
-
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
-
-use super::{GreetRequest, GreetResponse};
-
-#[test]
-fn a_request_serializes_to_its_wire_form() {
-    let encoded = serde_json::to_value(GreetRequest::new("Ferris")).unwrap();
-    assert_eq!(encoded, serde_json::json!({ "name": "Ferris" }));
-}
-
-#[test]
-fn a_response_serializes_to_its_wire_form() {
-    let encoded = serde_json::to_value(GreetResponse::new("Hello, Ferris!")).unwrap();
-    assert_eq!(encoded, serde_json::json!({ "greeting": "Hello, Ferris!" }));
-}
-
-#[test]
-fn a_request_round_trips_through_json() {
-    let request = GreetRequest::new("  Ferris  ");
-    let encoded = serde_json::to_string(&request).unwrap();
-    assert_eq!(
-        serde_json::from_str::<GreetRequest>(&encoded).unwrap(),
-        request
-    );
-}
-
-#[test]
-fn a_response_round_trips_through_json() {
-    let response = GreetResponse::new("Hello, Ferris!");
-    let encoded = serde_json::to_string(&response).unwrap();
-    assert_eq!(
-        serde_json::from_str::<GreetResponse>(&encoded).unwrap(),
-        response
-    );
-}
-
-#[test]
-fn a_request_missing_its_name_is_rejected() {
-    let decoded = serde_json::from_value::<GreetRequest>(serde_json::json!({}));
-    assert!(decoded.is_err());
-}
-
-#[test]
-fn a_response_missing_its_greeting_is_rejected() {
-    let decoded = serde_json::from_value::<GreetResponse>(serde_json::json!({}));
-    assert!(decoded.is_err());
-}
-
-#[test]
-fn constructors_accept_both_borrowed_and_owned_names() {
-    assert_eq!(
-        GreetRequest::new(String::from("Ferris")),
-        GreetRequest::new("Ferris")
-    );
-    assert_eq!(
-        GreetResponse::new(String::from("Hi")),
-        GreetResponse::new("Hi")
-    );
-}
diff --git a/crates/template-bus/src/greeting/types.rs b/crates/template-bus/src/greeting/types.rs
deleted file mode 100644
index d70b376..0000000
--- a/crates/template-bus/src/greeting/types.rs
+++ /dev/null
@@ -1,54 +0,0 @@
-//! Request and response types for the `Greet` member.
-
-use serde::{Deserialize, Serialize};
-
-/// The argument to [`crate::names::methods::GREET`].
-///
-/// The module trims surrounding whitespace from [`GreetRequest::name`] and
-/// rejects a name that is empty once trimmed.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-#[non_exhaustive]
-pub struct GreetRequest {
-    /// The name to greet.
-    pub name: String,
-}
-
-impl GreetRequest {
-    /// Builds a request greeting `name`.
-    ///
-    /// # Examples
-    ///
-    /// ```
-    /// # use template_bus::GreetRequest;
-    /// assert_eq!(GreetRequest::new("Ferris").name, "Ferris");
-    /// ```
-    #[must_use]
-    pub fn new(name: impl Into<String>) -> Self {
-        Self { name: name.into() }
-    }
-}
-
-/// The reply from [`crate::names::methods::GREET`].
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-#[non_exhaustive]
-pub struct GreetResponse {
-    /// The rendered greeting.
-    pub greeting: String,
-}
-
-impl GreetResponse {
-    /// Builds a reply carrying `greeting`.
-    ///
-    /// # Examples
-    ///
-    /// ```
-    /// # use template_bus::GreetResponse;
-    /// assert_eq!(GreetResponse::new("Hello, Ferris!").greeting, "Hello, Ferris!");
-    /// ```
-    #[must_use]
-    pub fn new(greeting: impl Into<String>) -> Self {
-        Self {
-            greeting: greeting.into(),
-        }
-    }
-}
diff --git a/crates/template-bus/src/lib.rs b/crates/template-bus/src/lib.rs
deleted file mode 100644
index a1857d1..0000000
--- a/crates/template-bus/src/lib.rs
+++ /dev/null
@@ -1,74 +0,0 @@
-//! Every type that crosses the template module's `TinyBus` boundary, and the
-//! names of the members that carry them.
-//!
-//! This crate ships as a loadable `TinyBus` module: `crates/template` is built
-//! as a `cdylib` and exports one object. A host that loads that binary can call
-//! into it but cannot `use` anything out of it, so the payload vocabulary has
-//! to be published as an ordinary library. This is that library.
-//!
-//! # What is here
-//!
-//! - [`names`] — the interface name, the object path, and one constant per
-//!   member, plus [`names::METHODS`] listing them in dispatch order.
-//! - [`greeting`] — the value vocabulary: the request and response payloads the
-//!   `Greet` member exchanges.
-//! - [`version`] — [`CONTRACT_VERSION`] and the [`is_compatible`] bind rule.
-//!
-//! # What is deliberately not here
-//!
-//! **No behavior.** The `greet` implementation lives in `crates/template`,
-//! which depends on this crate and re-exports it. A payload type describes what
-//! a frame carries, not what the module does with it.
-//!
-//! **No transport.** This crate does not depend on `tinybus` and holds no
-//! connection, client, or codec. A host already owns its connection — its
-//! reconnect policy, its timeouts, its tracing — and the useful part is the
-//! vocabulary, not another wrapper around it.
-//!
-//! That is also a structural necessity, not only a preference: `tinybus` is
-//! vendored as a submodule whose manifest inherits fields from its own nested
-//! `[workspace.package]`. A crate that every workspace member can depend on has
-//! to stay transport-free, and staying transport-free is what keeps this crate
-//! down to two pure-Rust dependencies.
-//!
-//! # This crate sits underneath the implementation, not beside it
-//!
-//! `template` **depends on this crate and re-exports all of it**, so
-//! `template::GreetRequest` and `template_bus::greeting::GreetRequest` are the
-//! *same type*, not structural twins. Defining a parallel set of payload types
-//! for hosts would mean a conversion at every call site that nothing checks.
-//! One definition, here, at the bottom.
-//!
-//! So: a module author depends on `template` and gets behavior and vocabulary.
-//! A host depends on `template-bus` and gets vocabulary alone.
-//!
-//! # Staying in step with the module
-//!
-//! [`names::METHODS`] lists every member. `crates/template` asserts its served
-//! members against that list, in order, so a method added to the interface
-//! without an entry here fails that crate's tests rather than surfacing as an
-//! unknown method in a host at runtime.
-//!
-//! # Example
-//!
-//! ```
-//! use template_bus::{names, GreetRequest, GreetResponse};
-//!
-//! let body = serde_json::to_value([GreetRequest::new("Ferris")])?;
-//! assert_eq!(names::methods::GREET, "Greet");
-//! assert_eq!(names::OBJECT_PATH, "/ai/tinyhumans/template/Greeting");
-//!
-//! let reply: GreetResponse = serde_json::from_value(
-//!     serde_json::json!({ "greeting": "Hello, Ferris!" }),
-//! )?;
-//! assert_eq!(reply.greeting, "Hello, Ferris!");
-//! # Ok::<(), serde_json::Error>(())
-//! ```
-
-pub mod greeting;
-pub mod names;
-pub mod version;
-
-pub use greeting::{GreetRequest, GreetResponse};
-pub use names::{INTERFACE, METHODS, OBJECT_PATH};
-pub use version::{CONTRACT_VERSION, is_compatible};
diff --git a/crates/template-bus/src/names/mod.rs b/crates/template-bus/src/names/mod.rs
deleted file mode 100644
index 4da1547..0000000
--- a/crates/template-bus/src/names/mod.rs
+++ /dev/null
@@ -1,33 +0,0 @@
-//! The bus identity of the template module: interface name, object path, and
-//! one constant per member.
-//!
-//! Nothing here is a string literal at a call site. A host names a member
-//! through [`methods`] and the object through [`OBJECT_PATH`], so a rename is a
-//! compile error in every consumer rather than a runtime "unknown method".
-//!
-//! When generating a project from this template, rename all three together —
-//! the interface, the path, and the member constants — and keep
-//! [`METHODS`] in the same order as the interface's dispatch table.
-
-/// The well-known interface name the module claims on the bus.
-pub const INTERFACE: &str = "ai.tinyhumans.template.Greeting";
-
-/// The object path the module serves its interface at.
-pub const OBJECT_PATH: &str = "/ai/tinyhumans/template/Greeting";
-
-/// One constant per member of [`INTERFACE`].
-pub mod methods {
-    /// Builds a greeting for a name.
-    ///
-    /// Takes a [`crate::GreetRequest`] and returns a [`crate::GreetResponse`].
-    pub const GREET: &str = "Greet";
-}
-
-/// Every member of [`INTERFACE`], in the order the interface dispatches them.
-///
-/// `crates/template` asserts its declared manifest methods against this list,
-/// so the two cannot drift.
-pub const METHODS: &[&str] = &[methods::GREET];
-
-#[cfg(test)]
-mod test;
diff --git a/crates/template-bus/src/names/test.rs b/crates/template-bus/src/names/test.rs
deleted file mode 100644
index bf7bea2..0000000
--- a/crates/template-bus/src/names/test.rs
+++ /dev/null
@@ -1,28 +0,0 @@
-//! Unit tests for the bus name table.
-
-use super::{INTERFACE, METHODS, OBJECT_PATH, methods};
-
-#[test]
-fn the_object_path_is_the_interface_in_path_form() {
-    let expected = format!("/{}", INTERFACE.replace('.', "/"));
-    assert_eq!(OBJECT_PATH, expected);
-}
-
-#[test]
-fn every_member_is_listed_exactly_once() {
-    let mut sorted = METHODS.to_vec();
-    sorted.sort_unstable();
-    let mut deduplicated = sorted.clone();
-    deduplicated.dedup();
-    assert_eq!(sorted, deduplicated);
-}
-
-#[test]
-fn the_method_table_holds_the_declared_members() {
-    assert_eq!(METHODS, [methods::GREET]);
-}
-
-#[test]
-fn no_member_name_is_empty() {
-    assert!(METHODS.iter().all(|method| !method.is_empty()));
-}
diff --git a/crates/template/Cargo.toml b/crates/template/Cargo.toml
deleted file mode 100644
index e1bcdf4..0000000
--- a/crates/template/Cargo.toml
+++ /dev/null
@@ -1,39 +0,0 @@
-[package]
-name = "template"
-version.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-license.workspace = true
-repository.workspace = true
-description = "A production-ready template for installable TinyBus modules."
-documentation = "https://docs.rs/template"
-readme = "../../README.md"
-keywords = ["tinybus", "module", "plugin", "template"]
-categories = ["development-tools"]
-publish = false
-
-[lib]
-# Keep the ordinary Rust library for tests and downstream reuse while also
-# producing the native module artifact that TinyBus loads at runtime.
-crate-type = ["rlib", "cdylib"]
-
-[dependencies]
-# The wire contract: member names, payload types, and the contract version.
-# Re-exported wholesale from `src/lib.rs` so a consumer takes one dependency
-# rather than two, and so `template::GreetRequest` and
-# `template_bus::GreetRequest` are the same type.
-template-bus = { workspace = true }
-tinybus = { workspace = true }
-tinybus-module = { workspace = true }
-thiserror = { workspace = true }
-
-[dev-dependencies]
-tokio = { workspace = true }
-# The GitHub release verifier passes an explicit empty module configuration.
-serde_json = { workspace = true }
-
-[features]
-default = []
-
-[lints]
-workspace = true
diff --git a/crates/template/examples/basic.rs b/crates/template/examples/basic.rs
deleted file mode 100644
index 99233ec..0000000
--- a/crates/template/examples/basic.rs
+++ /dev/null
@@ -1,22 +0,0 @@
-//! Minimal end-to-end usage of the crate.
-//!
-//! Examples are compiled and linted in CI, so they cannot drift from the API.
-//! Run it with:
-//!
-//! ```sh
-//! cargo run --example basic
-//! ```
-
-use template::{Result, greet};
-
-fn main() -> Result<()> {
-    println!("{}", greet("Rust")?);
-
-    // Failure modes are part of the public contract; show them too.
-    match greet("   ") {
-        Ok(greeting) => println!("{greeting}"),
-        Err(error) => println!("expected failure: {error}"),
-    }
-
-    Ok(())
-}
diff --git a/crates/template/src/error/mod.rs b/crates/template/src/error/mod.rs
deleted file mode 100644
index b8ddbe0..0000000
--- a/crates/template/src/error/mod.rs
+++ /dev/null
@@ -1,28 +0,0 @@
-//! Crate-wide error and result types.
-//!
-//! Every fallible public function in this crate returns [`Result`], and every
-//! failure mode is a distinct [`Error`] variant. Add a variant rather than
-//! encoding new context into an existing message: callers match on variants,
-//! and message text is not a stable API.
-//!
-//! Variants carry the data a caller needs to react, keep their `#[error]`
-//! message lowercase and free of trailing punctuation, and are documented so
-//! the rendered rustdoc explains when each one occurs.
-
-/// Errors returned by this crate.
-#[derive(Debug, thiserror::Error, PartialEq, Eq)]
-#[non_exhaustive]
-pub enum Error {
-    /// A required name was empty or contained only whitespace.
-    #[error("name must not be empty")]
-    EmptyName,
-}
-
-/// The crate's standard result type.
-///
-/// Use this alias in public signatures instead of spelling out
-/// `std::result::Result<T, Error>`.
-pub type Result<T> = std::result::Result<T, Error>;
-
-#[cfg(test)]
-mod test;
diff --git a/crates/template/src/error/test.rs b/crates/template/src/error/test.rs
deleted file mode 100644
index 4c5d609..0000000
--- a/crates/template/src/error/test.rs
+++ /dev/null
@@ -1,17 +0,0 @@
-//! Unit tests for the crate-wide error type.
-
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
-
-use super::*;
-
-#[test]
-fn renders_a_human_readable_message() {
-    assert_eq!(Error::EmptyName.to_string(), "name must not be empty");
-}
-
-#[test]
-fn is_a_standard_error() {
-    fn assert_error<E: std::error::Error>(_: &E) {}
-
-    assert_error(&Error::EmptyName);
-}
diff --git a/crates/template/src/greeting/mod.rs b/crates/template/src/greeting/mod.rs
deleted file mode 100644
index 862fa21..0000000
--- a/crates/template/src/greeting/mod.rs
+++ /dev/null
@@ -1,38 +0,0 @@
-//! Greeting behavior used to demonstrate the template's module layout.
-//!
-//! A module root like this one documents the module, wires its pieces
-//! together, and exposes the smallest useful API. Substantial type definitions
-//! belong in a sibling `types.rs`, and unit tests belong in `test.rs`, wired in
-//! at the bottom of this file.
-//!
-//! Replace this module with the crate's first real feature area.
-
-use crate::{Error, Result};
-
-/// Returns a friendly greeting for `name`.
-///
-/// Surrounding whitespace is trimmed before the greeting is built.
-///
-/// # Examples
-///
-/// ```
-/// # use template::greet;
-/// assert_eq!(greet("  Ferris  ")?, "Hello, Ferris!");
-/// # Ok::<(), template::Error>(())
-/// ```
-///
-/// # Errors
-///
-/// Returns [`Error::EmptyName`] when `name` is empty or contains only
-/// whitespace.
-pub fn greet(name: &str) -> Result<String> {
-    let name = name.trim();
-    if name.is_empty() {
-        return Err(Error::EmptyName);
-    }
-
-    Ok(format!("Hello, {name}!"))
-}
-
-#[cfg(test)]
-mod test;
diff --git a/crates/template/src/greeting/test.rs b/crates/template/src/greeting/test.rs
deleted file mode 100644
index de04ef4..0000000
--- a/crates/template/src/greeting/test.rs
+++ /dev/null
@@ -1,28 +0,0 @@
-//! Unit tests for the greeting module.
-//!
-//! Unit tests live next to the code they cover and may reach into private
-//! items. Tests of the public contract belong in `tests/` instead.
-
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
-
-use super::*;
-
-#[test]
-fn greets_a_named_person() {
-    assert_eq!(greet("Ferris").unwrap(), "Hello, Ferris!");
-}
-
-#[test]
-fn trims_the_name() {
-    assert_eq!(greet("  Ferris  ").unwrap(), "Hello, Ferris!");
-}
-
-#[test]
-fn rejects_an_empty_name() {
-    assert_eq!(greet("").unwrap_err(), Error::EmptyName);
-}
-
-#[test]
-fn rejects_a_whitespace_only_name() {
-    assert_eq!(greet(" \t\n ").unwrap_err(), Error::EmptyName);
-}
diff --git a/crates/template/src/lib.rs b/crates/template/src/lib.rs
deleted file mode 100644
index 566fa7e..0000000
--- a/crates/template/src/lib.rs
+++ /dev/null
@@ -1,62 +0,0 @@
-//! A production-ready starting point for an installable `TinyBus` module.
-//!
-//! This crate is a template. It ships the layout, lint configuration, error
-//! handling, testing, and documentation conventions described in `AGENTS.md`.
-//! The compiled `cdylib` exports `TinyBus` module ABI v1 and serves the example
-//! [`greet`] behavior over the bus.
-//!
-//! # Layout
-//!
-//! This is the implementation half of a two-crate workspace:
-//!
-//! - [`template_bus`] — the wire contract. Member names, payload types, and the
-//!   contract version, with no transport and no behavior. A host that only
-//!   makes calls depends on that crate alone.
-//! - `template` — this crate. The behavior, the crate-wide error type, and the
-//!   `TinyBus` adapter that serves them, built as both an `rlib` and the
-//!   `cdylib` the loader consumes.
-//!
-//! Within this crate:
-//!
-//! - `src/error/` holds the crate-wide [`Error`] enum and the [`Result`] alias
-//!   returned by every fallible public function.
-//! - Each feature area lives in its own module directory with a `mod.rs`
-//!   module root, an optional `types.rs`, and a `test.rs` holding its unit
-//!   tests.
-//! - Every public item is re-exported from here — including all of
-//!   [`template_bus`] — so downstream users have a single predictable surface
-//!   and `template::GreetRequest` is the *same type* as
-//!   `template_bus::GreetRequest`, not a structural twin.
-//! - `tinybus_module` adapts the public behavior to `TinyBus` and exports the
-//!   module descriptor, embedded manifest, and initialization entrypoint.
-//!
-//! # Example
-//!
-//! ```
-//! use template::{greet, Error, GreetRequest};
-//!
-//! assert_eq!(greet("Ferris")?, "Hello, Ferris!");
-//! assert_eq!(greet("   ").unwrap_err(), Error::EmptyName);
-//! assert_eq!(GreetRequest::new("Ferris").name, "Ferris");
-//! # Ok::<(), template::Error>(())
-//! ```
-//!
-//! Replace the `greeting` module with the first real feature area, keep the
-//! conventions, and update this documentation to describe the new crate.
-
-mod error;
-mod greeting;
-mod tinybus_module;
-
-pub use error::{Error, Result};
-pub use greeting::greet;
-
-// The wire contract, re-exported by module rather than by item so every path
-// through this crate resolves to the same definitions the contract crate
-// publishes. A host may depend on `template-bus` directly and get exactly these
-// types; nothing here redefines them.
-pub use template_bus;
-pub use template_bus::{
-    CONTRACT_VERSION, GreetRequest, GreetResponse, INTERFACE, METHODS, OBJECT_PATH, is_compatible,
-    names, version,
-};
diff --git a/crates/template/src/tinybus_module/README.md b/crates/template/src/tinybus_module/README.md
deleted file mode 100644
index 2c05772..0000000
--- a/crates/template/src/tinybus_module/README.md
+++ /dev/null
@@ -1,20 +0,0 @@
-# TinyBus Adapter
-
-This module is the boundary between ordinary feature code and TinyBus module
-ABI v1. `GreetingService` converts the crate's public `greet` function into the typed
-`Greet` bus method, while `setup` registers its object and claims the well-known
-interface name. Neither the name, the object path, nor the payload types are
-spelled here: they come from `template-bus`, so a rename is a compile error in
-every consumer instead of an `UnknownMethod` at runtime.
-
-`tinybus_module::module_export!` emits the descriptor, embedded manifest, and
-initialization symbols consumed by the dynamic loader. The manifest method list
-must stay aligned with the interface macro's dispatch table and with
-`template_bus::names::METHODS`; the unit tests check both relationships.
-Integration tests use TinyBus's in-memory transport, and
-`crates/template/examples/verify_module.rs` loads a compiled `cdylib` through
-the real dynamic loader before a release archive is accepted.
-
-Generated projects should replace the example interface, object path, and method
-declarations together — here and in `crates/template-bus/src/names/`. They must not retain Rust-owned data across the
-ABI boundary or bypass the SDK exports with an ad hoc FFI surface.
diff --git a/crates/template/src/tinybus_module/mod.rs b/crates/template/src/tinybus_module/mod.rs
deleted file mode 100644
index 1c9c2f0..0000000
--- a/crates/template/src/tinybus_module/mod.rs
+++ /dev/null
@@ -1,43 +0,0 @@
-//! `TinyBus` module entrypoint and bus-facing interface.
-//!
-//! This adapter keeps the feature implementation independent from `TinyBus`
-//! while exposing it as an installable, dynamically loaded integration. The
-//! names and payload types it serves come from [`template_bus`], so a host
-//! spells them from the contract crate instead of repeating string literals.
-
-use template_bus::{GreetRequest, GreetResponse, names};
-use tinybus::{Connection, Result as TinyBusResult};
-
-struct GreetingService;
-
-#[tinybus::interface(name = "ai.tinyhumans.template.Greeting")]
-impl GreetingService {
-    async fn greet(&self, request: GreetRequest) -> TinyBusResult<GreetResponse> {
-        std::future::ready(crate::greet(&request.name))
-            .await
-            .map(GreetResponse::new)
-            .map_err(|error| tinybus::Error::failed(error.to_string()))
-    }
-}
-
-async fn setup(connection: Connection) -> TinyBusResult<()> {
-    connection
-        .serve_at(names::OBJECT_PATH.try_into()?, GreetingService)
-        .await?;
-    connection.request_name(names::INTERFACE).await?;
-    Ok(())
-}
-
-tinybus_module::module_export! {
-    setup = setup,
-    worker_threads = 1,
-    provides = ["ai.tinyhumans.template.Greeting"],
-    methods = ["Greet"],
-    signals = [],
-    requires = [],
-    optional = [],
-    lazy = false,
-}
-
-#[cfg(test)]
-mod test;
diff --git a/crates/template/src/tinybus_module/test.rs b/crates/template/src/tinybus_module/test.rs
deleted file mode 100644
index d5fe71a..0000000
--- a/crates/template/src/tinybus_module/test.rs
+++ /dev/null
@@ -1,64 +0,0 @@
-//! Tests for the `TinyBus` module adapter and its declared surface.
-
-use super::{GreetingService, setup};
-use template_bus::{GreetRequest, GreetResponse, names};
-use tinybus::broker::Broker;
-use tinybus::transport::memory::MemoryBus;
-use tinybus::{Connection, Interface};
-
-#[test]
-fn declared_methods_match_the_dispatch_table() {
-    let methods = GreetingService
-        .members()
-        .into_iter()
-        .map(|member| member.to_string())
-        .collect::<Vec<_>>();
-
-    assert_eq!(methods, names::METHODS.to_vec());
-}
-
-#[test]
-fn the_served_interface_name_matches_the_contract() {
-    assert_eq!(GreetingService.name().to_string(), names::INTERFACE);
-}
-
-#[tokio::test]
-async fn module_serves_greetings_over_a_real_bus() -> tinybus::Result<()> {
-    let bus = MemoryBus::new();
-    Broker::new().spawn(bus.clone());
-
-    let service = Connection::connect(bus.connect().await?).await?;
-    setup(service.clone()).await?;
-
-    let client = Connection::connect(bus.connect().await?).await?;
-    let proxy = client.proxy(names::INTERFACE, names::OBJECT_PATH, names::INTERFACE)?;
-    let reply: GreetResponse = proxy
-        .call(names::methods::GREET, (GreetRequest::new("Ferris"),))
-        .await?;
-
-    assert_eq!(reply, GreetResponse::new("Hello, Ferris!"));
-    Ok(())
-}
-
-#[tokio::test]
-async fn module_rejects_an_empty_name_over_the_bus() -> tinybus::Result<()> {
-    let bus = MemoryBus::new();
-    Broker::new().spawn(bus.clone());
-
-    let service = Connection::connect(bus.connect().await?).await?;
-    setup(service.clone()).await?;
-
-    let client = Connection::connect(bus.connect().await?).await?;
-    let proxy = client.proxy(names::INTERFACE, names::OBJECT_PATH, names::INTERFACE)?;
-    let result = proxy
-        .call::<GreetResponse>(names::methods::GREET, (GreetRequest::new("   "),))
-        .await;
-
-    let Err(error) = result else {
-        return Err(tinybus::Error::failed(
-            "whitespace-only names unexpectedly succeeded",
-        ));
-    };
-    assert!(error.to_string().contains("name must not be empty"));
-    Ok(())
-}
diff --git a/crates/template/tests/public_api.rs b/crates/template/tests/public_api.rs
deleted file mode 100644
index 256b71c..0000000
--- a/crates/template/tests/public_api.rs
+++ /dev/null
@@ -1,20 +0,0 @@
-//! Integration tests for the public crate surface.
-//!
-//! These tests link against the crate as a downstream consumer would: they can
-//! only use what `src/lib.rs` re-exports. Treat them as the regression suite
-//! for the crate's public contract — if a change breaks a test here, it is a
-//! breaking change for users.
-
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
-
-use template::{Error, greet};
-
-#[test]
-fn greeting_is_available_to_consumers() {
-    assert_eq!(greet("Rust").unwrap(), "Hello, Rust!");
-}
-
-#[test]
-fn errors_are_available_to_consumers() {
-    assert_eq!(greet("").unwrap_err(), Error::EmptyName);
-}
diff --git a/crates/template-bus/Cargo.toml b/crates/tinybrowser-bus/Cargo.toml
similarity index 65%
rename from crates/template-bus/Cargo.toml
rename to crates/tinybrowser-bus/Cargo.toml
index a30dd85..95a0050 100644
--- a/crates/template-bus/Cargo.toml
+++ b/crates/tinybrowser-bus/Cargo.toml
@@ -1,15 +1,15 @@
 [package]
-name = "template-bus"
+name = "tinybrowser-bus"
 version.workspace = true
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
 repository.workspace = true
-description = "The TinyBus wire contract for the template module: member names, payload types, and the contract version."
-documentation = "https://docs.rs/template-bus"
+description = "The TinyBus wire contract for the tinybrowser module: member names, payload types, and the contract version."
+documentation = "https://docs.rs/tinybrowser-bus"
 readme = "README.md"
-keywords = ["tinybus", "module", "contract", "template"]
-categories = ["development-tools"]
+keywords = ["tinybus", "module", "contract", "browser", "automation"]
+categories = ["development-tools", "web-programming"]
 publish = false
 
 # Deliberately dependency-light: this is the crate a host links to talk to the
diff --git a/crates/tinybrowser-bus/README.md b/crates/tinybrowser-bus/README.md
new file mode 100644
index 0000000..603ea8f
--- /dev/null
+++ b/crates/tinybrowser-bus/README.md
@@ -0,0 +1,59 @@
+# tinybrowser-bus
+
+Every type that crosses the tinybrowser module's `TinyBus` boundary, and the
+names of the members that carry them.
+
+tinybrowser ships as a loadable module so a host does not compile a browser:
+`crates/tinybrowser` is built as a `cdylib` and exports one object. A host can
+load that binary but cannot `use` anything out of it, so the payload vocabulary
+has to be published as an ordinary library. This is it.
+
+| module     | what it holds                                                  |
+| ---------- | -------------------------------------------------------------- |
+| `names`    | interface name, object path, one constant per member            |
+| `session`  | opening, listing, and closing the browser a host drives         |
+| `page`     | navigating, extracting a page as text, evaluating JavaScript    |
+| `snapshot` | the accessibility tree, and the refs that address it            |
+| `action`   | every interaction, and the three ways to name an element        |
+| `output`   | screenshots, and the handle protocol that carries them          |
+| `errors`   | the failure names, and which of them an agent can act on        |
+| `version`  | `CONTRACT_VERSION` and the bind rule a host applies to it       |
+
+Two dependencies, both pure Rust: `serde` and `serde_json`.
+
+## This crate sits underneath `tinybrowser`
+
+`tinybrowser` depends on this crate and re-exports all of it, so
+`tinybrowser::Action` and `tinybrowser_bus::action::Action` are the *same type*,
+not structural twins. Defining a parallel set of payload types for hosts would
+mean a conversion at every call site that nothing checks. One definition, here,
+at the bottom.
+
+So: a module author depends on `tinybrowser` and gets behavior and vocabulary. A
+host depends on `tinybrowser-bus` and gets vocabulary alone — which matters,
+because that host is usually a binary that deliberately does not want a browser
+stack in its build. That is the entire reason this split exists.
+
+## No transport, on purpose
+
+This crate holds no connection, client, or codec, and does not depend on
+`tinybus`. A host already owns its connection — its reconnect policy, its
+timeouts, its tracing — and the useful part is the vocabulary, not another
+wrapper around it.
+
+It is also a structural necessity: `tinybus` is vendored as a submodule whose
+manifest inherits from its own nested `[workspace.package]`. A crate every
+member can depend on has to stay transport-free, and CI asserts it does.
+
+## Nothing here is `#[non_exhaustive]`
+
+Both sides construct these types — a host builds the requests, the module builds
+the replies — and the module is a different crate from this one. Non-exhaustive
+types would leave the implementation unable to build its own replies, and would
+turn `..Default::default()` into a compile error for every caller.
+
+The evolution mechanism is `CONTRACT_VERSION` and the `is_compatible` bind rule
+instead, which is the one that works across a dynamically loaded boundary. Every
+request type carries `#[serde(default)]`, so an added field is additive; a host
+deserializing a reply ignores what it does not know. Neither is something the
+Rust attribute could have enforced through a `cdylib` anyway.
diff --git a/crates/tinybrowser-bus/src/action/mod.rs b/crates/tinybrowser-bus/src/action/mod.rs
new file mode 100644
index 0000000..6e61a18
--- /dev/null
+++ b/crates/tinybrowser-bus/src/action/mod.rs
@@ -0,0 +1,27 @@
+//! Interactions: the one member a host calls for everything that changes the
+//! page, and the vocabulary for saying which element it means.
+//!
+//! # Why one member and not fifteen
+//!
+//! Click, fill, hover, and press differ in what they do to an element, not in
+//! how they are addressed, deadlined, or reported. Splitting them into separate
+//! bus members would duplicate the target-resolution rules fifteen times over
+//! and force a host tool that dispatches on a model-chosen verb to carry its own
+//! fifteen-arm match anyway. [`Action`] *is* that match, written once, in the
+//! crate both sides share.
+//!
+//! # Refs, selectors, and locators
+//!
+//! [`Target`] is deliberately three things. A `@e12` ref comes from a
+//! [`crate::Snapshot`] and is what an agent should normally use: it names an
+//! element the agent has actually seen, and it fails loudly when the page has
+//! moved on. A CSS selector is for a host that already knows the page. A
+//! [`Locator`] is for the case an agent is best at — "the button called Submit"
+//! — where neither of the other two is expressible.
+
+mod types;
+
+pub use types::{Action, ActionOutcome, LocateBy, Locator, ScrollDirection, Target, WaitState};
+
+#[cfg(test)]
+mod test;
diff --git a/crates/tinybrowser-bus/src/action/test.rs b/crates/tinybrowser-bus/src/action/test.rs
new file mode 100644
index 0000000..bdcfe87
--- /dev/null
+++ b/crates/tinybrowser-bus/src/action/test.rs
@@ -0,0 +1,172 @@
+//! Tests for the interaction payload types.
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use super::{Action, ActionOutcome, LocateBy, Locator, ScrollDirection, Target, WaitState};
+use crate::PageState;
+use serde_json::json;
+
+#[test]
+fn parse_reads_an_at_prefix_as_a_ref() {
+    assert_eq!(Target::parse("@e12"), Target::reference("e12"));
+    assert_eq!(Target::parse("  @e12  "), Target::reference("e12"));
+}
+
+#[test]
+fn parse_reads_anything_else_as_a_selector() {
+    assert_eq!(Target::parse("#submit"), Target::selector("#submit"));
+    assert_eq!(
+        Target::parse("button[type=submit]"),
+        Target::selector("button[type=submit]")
+    );
+}
+
+#[test]
+fn reference_drops_a_leading_at_however_it_arrives() {
+    assert_eq!(Target::reference("@e3"), Target::reference("e3"));
+}
+
+#[test]
+fn target_is_tagged_by_kind_on_the_wire() {
+    assert_eq!(
+        serde_json::to_value(Target::reference("e2")).expect("serializes"),
+        json!({ "kind": "ref", "value": "e2" })
+    );
+    assert_eq!(
+        serde_json::to_value(Target::selector("#a")).expect("serializes"),
+        json!({ "kind": "selector", "value": "#a" })
+    );
+}
+
+#[test]
+fn locator_round_trips_through_its_wire_form() {
+    let target = Target::locator(Locator::new(LocateBy::Role, "button").with_name("Submit"));
+    let encoded = serde_json::to_value(&target).expect("serializes");
+
+    assert_eq!(
+        encoded,
+        json!({
+            "kind": "locator",
+            "value": {
+                "by": "role",
+                "value": "button",
+                "name": "Submit",
+                "exact": false,
+                "index": 0,
+            },
+        })
+    );
+    assert_eq!(
+        serde_json::from_value::<Target>(encoded).expect("deserializes"),
+        target
+    );
+}
+
+#[test]
+fn locator_fills_its_optional_fields_from_the_default() {
+    let locator: Locator =
+        serde_json::from_value(json!({ "by": "test_id", "value": "cart" })).expect("deserializes");
+
+    assert_eq!(locator.by, LocateBy::TestId);
+    assert_eq!(locator.index, 0);
+    assert!(!locator.exact);
+}
+
+#[test]
+fn action_is_tagged_by_action_on_the_wire() {
+    let click = Action::Click {
+        target: Target::reference("e2"),
+        new_tab: false,
+    };
+
+    assert_eq!(
+        serde_json::to_value(&click).expect("serializes"),
+        json!({
+            "action": "click",
+            "target": { "kind": "ref", "value": "e2" },
+            "new_tab": false,
+        })
+    );
+    assert_eq!(
+        serde_json::from_value::<Action>(json!({
+            "action": "click",
+            "target": { "kind": "ref", "value": "e2" },
+        }))
+        .expect("deserializes"),
+        click
+    );
+}
+
+#[test]
+fn unit_actions_are_a_bare_tag() {
+    assert_eq!(
+        serde_json::to_value(Action::Reload).expect("serializes"),
+        json!({ "action": "reload" })
+    );
+    assert_eq!(
+        serde_json::from_value::<Action>(json!({ "action": "back" })).expect("deserializes"),
+        Action::Back
+    );
+}
+
+#[test]
+fn typing_defaults_to_the_focused_element() {
+    let action: Action =
+        serde_json::from_value(json!({ "action": "type", "text": "hello" })).expect("deserializes");
+
+    assert_eq!(
+        action,
+        Action::Type {
+            target: None,
+            text: "hello".to_string(),
+            delay_ms: None,
+        }
+    );
+}
+
+#[test]
+fn wait_for_defaults_to_waiting_for_visibility() {
+    let action: Action = serde_json::from_value(json!({
+        "action": "wait_for",
+        "target": { "kind": "selector", "value": ".ready" },
+    }))
+    .expect("deserializes");
+
+    let Action::WaitFor { state, .. } = action else {
+        panic!("expected a wait_for action");
+    };
+    assert_eq!(state, WaitState::Visible);
+}
+
+#[test]
+fn scroll_direction_is_snake_case_on_the_wire() {
+    assert_eq!(
+        serde_json::to_value(ScrollDirection::Bottom).expect("serializes"),
+        json!("bottom")
+    );
+}
+
+#[test]
+fn an_acting_outcome_carries_no_value() {
+    let outcome = ActionOutcome::acted(PageState::new("https://example.com/"));
+
+    assert!(outcome.value.is_null());
+    assert!(outcome.matched.is_none());
+}
+
+#[test]
+fn a_reading_outcome_round_trips_with_its_match() {
+    let outcome = ActionOutcome::read(
+        PageState::new("https://example.com/"),
+        json!("Example Domain"),
+    )
+    .matching("button \"Submit\"");
+    let encoded = serde_json::to_value(&outcome).expect("serializes");
+
+    assert_eq!(encoded["value"], json!("Example Domain"));
+    assert_eq!(encoded["matched"], json!("button \"Submit\""));
+    assert_eq!(
+        serde_json::from_value::<ActionOutcome>(encoded).expect("deserializes"),
+        outcome
+    );
+}
diff --git a/crates/tinybrowser-bus/src/action/types.rs b/crates/tinybrowser-bus/src/action/types.rs
new file mode 100644
index 0000000..45bcc6a
--- /dev/null
+++ b/crates/tinybrowser-bus/src/action/types.rs
@@ -0,0 +1,371 @@
+//! Payload types for interacting with the active page.
+
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+
+/// How an element is named.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum Target {
+    /// A ref from a snapshot, such as `e12`.
+    ///
+    /// Refs belong to the snapshot that produced them. Acting on a ref after the
+    /// page has navigated or re-rendered is refused rather than guessed at —
+    /// a stale ref that silently resolves to whatever now occupies that position
+    /// is how an agent ends up clicking the wrong thing and reporting success.
+    Ref {
+        /// The ref identity, with or without its leading `@`.
+        value: String,
+    },
+    /// A CSS selector, matched against the first element it finds.
+    Selector {
+        /// The selector text.
+        value: String,
+    },
+    /// A semantic locator: role, visible text, label, and so on.
+    Locator {
+        /// The locator itself.
+        value: Locator,
+    },
+}
+
+impl Target {
+    /// Reads a target from the string form a host tool receives from a model.
+    ///
+    /// A leading `@` means a ref, and anything else is a CSS selector. That rule
+    /// exists because the tool surface an agent sees takes one `selector` string
+    /// for both, and `@` is not valid at the start of a CSS selector — so the
+    /// two vocabularies cannot collide.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// # use tinybrowser_bus::Target;
+    /// assert_eq!(Target::parse("@e12"), Target::reference("e12"));
+    /// assert_eq!(Target::parse("#submit"), Target::selector("#submit"));
+    /// ```
+    #[must_use]
+    pub fn parse(target: &str) -> Self {
+        let trimmed = target.trim();
+        match trimmed.strip_prefix('@') {
+            Some(reference) => Self::reference(reference),
+            None => Self::selector(trimmed),
+        }
+    }
+
+    /// A target naming the snapshot ref `value`, with any leading `@` removed.
+    #[must_use]
+    pub fn reference(value: impl AsRef<str>) -> Self {
+        Self::Ref {
+            value: value.as_ref().trim_start_matches('@').to_string(),
+        }
+    }
+
+    /// A target naming the first element matching the CSS selector `value`.
+    #[must_use]
+    pub fn selector(value: impl Into<String>) -> Self {
+        Self::Selector {
+            value: value.into(),
+        }
+    }
+
+    /// A target naming an element semantically.
+    #[must_use]
+    pub fn locator(value: Locator) -> Self {
+        Self::Locator { value }
+    }
+}
+
+/// The dimension a [`Locator`] searches on.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum LocateBy {
+    /// The element's accessibility role, narrowed by its accessible name.
+    Role,
+    /// Visible text content.
+    Text,
+    /// The text of the element's `<label>`, or its `aria-label`.
+    Label,
+    /// A form field's placeholder.
+    Placeholder,
+    /// A `data-testid` attribute.
+    TestId,
+    /// An image's alternative text.
+    AltText,
+    /// A `title` attribute.
+    Title,
+}
+
+/// An element named by what it is rather than where it is.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct Locator {
+    /// The dimension to search on.
+    pub by: LocateBy,
+    /// What to search for. Compared case-insensitively against trimmed text.
+    pub value: String,
+    /// For [`LocateBy::Role`], the accessible name to narrow the role to.
+    pub name: Option<String>,
+    /// Require the whole value to match rather than a substring. Defaults to
+    /// `false`: an agent naming a button "Submit" should find "Submit order".
+    pub exact: bool,
+    /// Which match to take when several qualify. Defaults to the first.
+    pub index: usize,
+}
+
+impl Default for Locator {
+    fn default() -> Self {
+        Self {
+            by: LocateBy::Text,
+            value: String::new(),
+            name: None,
+            exact: false,
+            index: 0,
+        }
+    }
+}
+
+impl Locator {
+    /// A locator matching `value` on `by`, taking the first match.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// # use tinybrowser_bus::{LocateBy, Locator};
+    /// let locator = Locator::new(LocateBy::Role, "button").with_name("Submit");
+    /// assert_eq!(locator.name.as_deref(), Some("Submit"));
+    /// ```
+    #[must_use]
+    pub fn new(by: LocateBy, value: impl Into<String>) -> Self {
+        Self {
+            by,
+            value: value.into(),
+            ..Self::default()
+        }
+    }
+
+    /// Narrows a [`LocateBy::Role`] locator to elements with this accessible
+    /// name.
+    #[must_use]
+    pub fn with_name(mut self, name: impl Into<String>) -> Self {
+        self.name = Some(name.into());
+        self
+    }
+}
+
+/// Which way [`Action::Scroll`] moves the page.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ScrollDirection {
+    /// Towards the end of the document.
+    Down,
+    /// Towards the start of the document.
+    Up,
+    /// Towards the inline start.
+    Left,
+    /// Towards the inline end.
+    Right,
+    /// All the way to the top.
+    Top,
+    /// All the way to the bottom.
+    Bottom,
+}
+
+/// The condition [`Action::WaitFor`] blocks on.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum WaitState {
+    /// The element exists in the DOM.
+    Attached,
+    /// The element is gone from the DOM.
+    Detached,
+    /// The element exists and is rendered.
+    ///
+    /// The default: an element that exists but is not rendered is one an agent
+    /// cannot act on, so waiting for mere existence usually means waiting for
+    /// the wrong thing.
+    #[default]
+    Visible,
+    /// The element is absent or not rendered.
+    Hidden,
+}
+
+/// One interaction with the active page.
+///
+/// The variants deliberately mirror the verbs an agent-facing browser tool
+/// already exposes, so a host tool's dispatch is a rename rather than a
+/// translation layer with its own bugs.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "action", rename_all = "snake_case")]
+pub enum Action {
+    /// Click an element, scrolling it into view first.
+    ///
+    /// Fails when another element covers the click point — a consent banner or a
+    /// modal — and names the covering element, because a click that lands on an
+    /// overlay reports success and does nothing, which is the single most
+    /// expensive failure mode an agent can be handed.
+    Click {
+        /// The element to click.
+        target: Target,
+        /// Open the result in a new tab, as a middle click would.
+        #[serde(default)]
+        new_tab: bool,
+    },
+    /// Double-click an element.
+    DoubleClick {
+        /// The element to double-click.
+        target: Target,
+    },
+    /// Move the pointer over an element, firing the hover handlers a menu needs.
+    Hover {
+        /// The element to hover.
+        target: Target,
+    },
+    /// Give an element keyboard focus without clicking it.
+    Focus {
+        /// The element to focus.
+        target: Target,
+    },
+    /// Clear a field and set its value in one step.
+    Fill {
+        /// The field to fill.
+        target: Target,
+        /// The value to set.
+        value: String,
+    },
+    /// Type text as a sequence of key events, leaving anything already there.
+    ///
+    /// Distinct from [`Action::Fill`] because a field that reacts per keystroke
+    /// — an autocomplete, a search-as-you-type box — never sees the input event
+    /// a bulk value assignment skips.
+    Type {
+        /// The field to type into. Defaults to whatever currently has focus.
+        #[serde(default)]
+        target: Option<Target>,
+        /// The text to type.
+        text: String,
+        /// Delay between keystrokes in milliseconds.
+        #[serde(default)]
+        delay_ms: Option<u64>,
+    },
+    /// Press a key or chord, such as `Enter`, `Tab`, or `Control+a`.
+    Press {
+        /// The key or chord.
+        key: String,
+    },
+    /// Choose one or more options in a `<select>`.
+    Select {
+        /// The select element.
+        target: Target,
+        /// The option values to choose.
+        values: Vec<String>,
+    },
+    /// Set a checkbox or radio to a state, rather than toggling it blindly.
+    Check {
+        /// The checkbox or radio.
+        target: Target,
+        /// The state to leave it in.
+        checked: bool,
+    },
+    /// Scroll the page, or an element that scrolls within it.
+    Scroll {
+        /// Which way to scroll.
+        direction: ScrollDirection,
+        /// How far, in CSS pixels. Defaults to one viewport.
+        #[serde(default)]
+        pixels: Option<u32>,
+        /// The scrollable element. Defaults to the page.
+        #[serde(default)]
+        target: Option<Target>,
+    },
+    /// Read an element's text.
+    GetText {
+        /// The element to read.
+        target: Target,
+    },
+    /// Read one attribute of an element.
+    GetAttribute {
+        /// The element to read.
+        target: Target,
+        /// The attribute name.
+        attribute: String,
+    },
+    /// Report whether an element is present and rendered.
+    IsVisible {
+        /// The element to test.
+        target: Target,
+    },
+    /// Block until a condition holds.
+    WaitFor {
+        /// An element to wait on.
+        #[serde(default)]
+        target: Option<Target>,
+        /// Text to wait for anywhere in the page.
+        #[serde(default)]
+        text: Option<String>,
+        /// The state `target` must reach.
+        #[serde(default)]
+        state: WaitState,
+        /// A flat delay in milliseconds, applied when neither `target` nor
+        /// `text` is given.
+        #[serde(default)]
+        ms: Option<u64>,
+        /// Deadline in milliseconds. Falls back to the session's default.
+        #[serde(default)]
+        timeout_ms: Option<u64>,
+    },
+    /// Go back in history.
+    Back,
+    /// Go forward in history.
+    Forward,
+    /// Reload the page.
+    Reload,
+}
+
+/// What an [`Action`] did.
+///
+/// Every action returns the same shape, including the ones that only read, so a
+/// host tool renders one result type instead of fifteen. The reading actions put
+/// their answer in [`ActionOutcome::value`]; the acting ones leave it null and
+/// are described entirely by the page state they left behind.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct ActionOutcome {
+    /// The value a reading action produced: a string for
+    /// [`Action::GetText`], a boolean for [`Action::IsVisible`], null for an
+    /// action that only acts.
+    pub value: Value,
+    /// Where the page was when the action finished.
+    pub page: crate::PageState,
+    /// The element the action resolved to, when it resolved one. Reported so an
+    /// agent that named a target loosely can see what it actually hit.
+    pub matched: Option<String>,
+}
+
+impl ActionOutcome {
+    /// An outcome with no value, for an action that only acts.
+    #[must_use]
+    pub fn acted(page: crate::PageState) -> Self {
+        Self {
+            value: Value::Null,
+            page,
+            matched: None,
+        }
+    }
+
+    /// An outcome carrying `value`, for an action that reads.
+    #[must_use]
+    pub fn read(page: crate::PageState, value: Value) -> Self {
+        Self {
+            value,
+            page,
+            matched: None,
+        }
+    }
+
+    /// Records which element the action resolved to.
+    #[must_use]
+    pub fn matching(mut self, matched: impl Into<String>) -> Self {
+        self.matched = Some(matched.into());
+        self
+    }
+}
diff --git a/crates/tinybrowser-bus/src/errors/mod.rs b/crates/tinybrowser-bus/src/errors/mod.rs
new file mode 100644
index 0000000..6d6c31b
--- /dev/null
+++ b/crates/tinybrowser-bus/src/errors/mod.rs
@@ -0,0 +1,113 @@
+//! The error names the module answers with, and what a host should do about
+//! each one.
+//!
+//! # Why the name matters more than the message
+//!
+//! A host does not show a model a raw failure string; it decides what *kind* of
+//! failure happened and shapes the tool result accordingly. A bad selector is
+//! something a model can fix by taking a fresh snapshot. A browser that will not
+//! launch is not. A navigation blocked by policy must never be retried. Those
+//! are three different tool results, and telling them apart by matching on
+//! prose would break the first time a message is reworded.
+//!
+//! So the module sets a stable error *name* on every failure and puts the
+//! human-readable detail in the message. The names are published here so a host
+//! matches on a constant.
+
+/// The prefix every error name in this contract begins with.
+pub const PREFIX: &str = "ai.tinyhumans.tinybrowser.Error";
+
+/// The request was malformed or self-contradictory: an unparseable URL, an
+/// empty expression, a quality outside 1–100.
+///
+/// A model can act on this.
+pub const INVALID_INPUT: &str = "ai.tinyhumans.tinybrowser.Error.InvalidInput";
+
+/// The named session does not exist, or has been closed.
+///
+/// A host should open a new one rather than retrying.
+pub const NO_SUCH_SESSION: &str = "ai.tinyhumans.tinybrowser.Error.NoSuchSession";
+
+/// No element matched the target.
+///
+/// A model can act on this: take a fresh snapshot and choose again.
+pub const NO_SUCH_ELEMENT: &str = "ai.tinyhumans.tinybrowser.Error.NoSuchElement";
+
+/// The ref belongs to an earlier snapshot of this page.
+///
+/// Distinct from [`NO_SUCH_ELEMENT`] because the remedy is exactly "snapshot
+/// again", and saying so is more useful than "not found".
+pub const STALE_REF: &str = "ai.tinyhumans.tinybrowser.Error.StaleRef";
+
+/// The element was found but could not be acted on: covered by an overlay,
+/// disabled, or outside the document.
+///
+/// The message names the obstruction where the browser could identify it.
+pub const NOT_ACTIONABLE: &str = "ai.tinyhumans.tinybrowser.Error.NotActionable";
+
+/// The operation ran out of time.
+pub const TIMEOUT: &str = "ai.tinyhumans.tinybrowser.Error.Timeout";
+
+/// The session's `allowed_origins` does not admit the destination.
+///
+/// Never retry this one: the answer will not change, and a host that retries
+/// turns a refused navigation into a loop.
+pub const BLOCKED_BY_POLICY: &str = "ai.tinyhumans.tinybrowser.Error.BlockedByPolicy";
+
+/// No browser could be launched or reached.
+///
+/// A model cannot act on this — it is a host or deployment problem.
+pub const BROWSER_UNAVAILABLE: &str = "ai.tinyhumans.tinybrowser.Error.BrowserUnavailable";
+
+/// The page reported a JavaScript exception, or the browser rejected a command.
+pub const PAGE_ERROR: &str = "ai.tinyhumans.tinybrowser.Error.PageError";
+
+/// The named held output does not exist, or has expired.
+pub const NO_SUCH_OUTPUT: &str = "ai.tinyhumans.tinybrowser.Error.NoSuchOutput";
+
+/// A limit was reached: too many sessions, too many held outputs, or an output
+/// larger than the module will hold.
+pub const LIMIT_EXCEEDED: &str = "ai.tinyhumans.tinybrowser.Error.LimitExceeded";
+
+/// Everything else.
+pub const MODULE_FAILED: &str = "ai.tinyhumans.tinybrowser.Error.ModuleFailed";
+
+/// Every error name this contract defines.
+pub const NAMES: &[&str] = &[
+    INVALID_INPUT,
+    NO_SUCH_SESSION,
+    NO_SUCH_ELEMENT,
+    STALE_REF,
+    NOT_ACTIONABLE,
+    TIMEOUT,
+    BLOCKED_BY_POLICY,
+    BROWSER_UNAVAILABLE,
+    PAGE_ERROR,
+    NO_SUCH_OUTPUT,
+    LIMIT_EXCEEDED,
+    MODULE_FAILED,
+];
+
+/// Whether `name` is one an agent can plausibly recover from by choosing
+/// differently, as opposed to one that needs an operator.
+///
+/// This is the single decision a host tool makes on every failure, so it lives
+/// in the contract rather than being re-derived — differently — by each caller.
+///
+/// # Examples
+///
+/// ```
+/// # use tinybrowser_bus::errors;
+/// assert!(errors::is_agent_recoverable(errors::NO_SUCH_ELEMENT));
+/// assert!(!errors::is_agent_recoverable(errors::BROWSER_UNAVAILABLE));
+/// ```
+#[must_use]
+pub fn is_agent_recoverable(name: &str) -> bool {
+    matches!(
+        name,
+        INVALID_INPUT | NO_SUCH_ELEMENT | STALE_REF | NOT_ACTIONABLE | TIMEOUT | PAGE_ERROR
+    )
+}
+
+#[cfg(test)]
+mod test;
diff --git a/crates/tinybrowser-bus/src/errors/test.rs b/crates/tinybrowser-bus/src/errors/test.rs
new file mode 100644
index 0000000..b36eea7
--- /dev/null
+++ b/crates/tinybrowser-bus/src/errors/test.rs
@@ -0,0 +1,71 @@
+//! Tests for the wire error names.
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use super::{
+    BLOCKED_BY_POLICY, BROWSER_UNAVAILABLE, INVALID_INPUT, LIMIT_EXCEEDED, MODULE_FAILED, NAMES,
+    NO_SUCH_ELEMENT, NO_SUCH_OUTPUT, NO_SUCH_SESSION, NOT_ACTIONABLE, PAGE_ERROR, PREFIX,
+    STALE_REF, TIMEOUT, is_agent_recoverable,
+};
+
+#[test]
+fn every_name_sits_under_the_prefix() {
+    for name in NAMES {
+        assert!(
+            name.starts_with(PREFIX),
+            "{name} is outside {PREFIX}, so a host matching on the prefix would miss it"
+        );
+    }
+}
+
+#[test]
+fn names_lists_every_variant_once() {
+    let mut sorted = NAMES.to_vec();
+    sorted.sort_unstable();
+    let count = sorted.len();
+    sorted.dedup();
+
+    assert_eq!(sorted.len(), count, "NAMES contains a duplicate");
+    assert_eq!(count, 12);
+}
+
+#[test]
+fn recoverable_names_are_the_ones_a_model_can_act_on() {
+    for name in [
+        INVALID_INPUT,
+        NO_SUCH_ELEMENT,
+        STALE_REF,
+        NOT_ACTIONABLE,
+        TIMEOUT,
+        PAGE_ERROR,
+    ] {
+        assert!(is_agent_recoverable(name), "{name} should be recoverable");
+    }
+}
+
+#[test]
+fn operator_problems_are_not_offered_back_to_the_model() {
+    for name in [
+        NO_SUCH_SESSION,
+        BLOCKED_BY_POLICY,
+        BROWSER_UNAVAILABLE,
+        NO_SUCH_OUTPUT,
+        LIMIT_EXCEEDED,
+        MODULE_FAILED,
+    ] {
+        assert!(
+            !is_agent_recoverable(name),
+            "{name} should not be offered back to the model"
+        );
+    }
+}
+
+#[test]
+fn an_unknown_name_is_not_recoverable() {
+    // A module from a newer contract can send a name this build has never seen.
+    // Treating it as recoverable would have an agent retry something it cannot
+    // understand; treating it as an operator problem surfaces it instead.
+    assert!(!is_agent_recoverable(
+        "ai.tinyhumans.tinybrowser.Error.Invented"
+    ));
+}
diff --git a/crates/tinybrowser-bus/src/lib.rs b/crates/tinybrowser-bus/src/lib.rs
new file mode 100644
index 0000000..946d113
--- /dev/null
+++ b/crates/tinybrowser-bus/src/lib.rs
@@ -0,0 +1,125 @@
+//! Every type that crosses the tinybrowser module's `TinyBus` boundary, and the
+//! names of the members that carry them.
+//!
+//! `tinybrowser` drives a real Chrome over the Chrome `DevTools` Protocol and
+//! publishes that as a handful of bus members an agent host can build tools on:
+//! open a session, navigate, snapshot the accessibility tree, act on a ref, read
+//! the page, screenshot it, close. This crate is the vocabulary those members
+//! exchange.
+//!
+//! It ships as a loadable `TinyBus` module: `crates/tinybrowser` is built as a
+//! `cdylib` and exports one object. A host that loads that binary can call into
+//! it but cannot `use` anything out of it, so the payload vocabulary has to be
+//! published as an ordinary library. This is that library.
+//!
+//! # What is here
+//!
+//! - [`names`] — the interface name, the object path, and one constant per
+//!   member, plus [`names::METHODS`] listing them in dispatch order.
+//! - [`session`] — opening, listing, and closing the browser a host drives.
+//! - [`page`] — navigating, extracting a page as text, evaluating JavaScript.
+//! - [`snapshot`] — the accessibility tree, and the refs that address it.
+//! - [`action`] — every interaction, and the three ways to name an element.
+//! - [`output`] — screenshots, and the handle protocol that carries them.
+//! - [`errors`] — the failure names, and which of them an agent can act on.
+//! - [`version`] — [`CONTRACT_VERSION`] and the [`is_compatible`] bind rule.
+//!
+//! # What is deliberately not here
+//!
+//! **No behavior.** No CDP, no browser launching, no element resolution. All of
+//! that lives in `crates/tinybrowser`, which depends on this crate and
+//! re-exports it. A payload type describes what a frame carries, not what the
+//! module does with it.
+//!
+//! **No transport.** This crate does not depend on `tinybus` and holds no
+//! connection, client, or codec. A host already owns its connection — its
+//! reconnect policy, its timeouts, its tracing — and the useful part is the
+//! vocabulary, not another wrapper around it.
+//!
+//! That is also a structural necessity, not only a preference: `tinybus` is
+//! vendored as a submodule whose manifest inherits fields from its own nested
+//! `[workspace.package]`. A crate that every workspace member can depend on has
+//! to stay transport-free, and staying transport-free is what keeps this crate
+//! down to two pure-Rust dependencies — which matters, because the host linking
+//! it is a binary that deliberately does *not* want a browser stack in its
+//! build.
+//!
+//! # This crate sits underneath the implementation, not beside it
+//!
+//! `tinybrowser` **depends on this crate and re-exports all of it**, so
+//! `tinybrowser::Action` and `tinybrowser_bus::action::Action` are the *same
+//! type*, not structural twins. Defining a parallel set of payload types for
+//! hosts would mean a conversion at every call site that nothing checks. One
+//! definition, here, at the bottom.
+//!
+//! So: a module author depends on `tinybrowser` and gets behavior and
+//! vocabulary. A host depends on `tinybrowser-bus` and gets vocabulary alone.
+//!
+//! # Why nothing here is `#[non_exhaustive]`
+//!
+//! Both sides construct these types: a host builds the requests, and the module
+//! builds the replies, and the module is a *different crate* from this one.
+//! Marking them non-exhaustive would leave the implementation unable to build
+//! its own replies, and would turn `..Default::default()` — the idiom the
+//! request types are designed around — into a compile error for every caller.
+//!
+//! The evolution mechanism is [`CONTRACT_VERSION`] and the [`is_compatible`]
+//! bind rule instead, which is the one that works across a dynamically loaded
+//! boundary. A field added to a request is additive because every request type
+//! carries `#[serde(default)]`; a field added to a reply is additive because a
+//! host deserializing it ignores what it does not know. Neither is something the
+//! Rust attribute could have enforced across a `cdylib` anyway.
+//!
+//! # Staying in step with the module
+//!
+//! [`names::METHODS`] lists every member. `crates/tinybrowser` asserts its
+//! served members against that list, in order, so a method added to the
+//! interface without an entry here fails that crate's tests rather than
+//! surfacing as an unknown method in a host at runtime.
+//!
+//! # Example
+//!
+//! Building the frame bodies for the loop an agent actually runs — open,
+//! navigate, snapshot, click — without a bus in sight:
+//!
+//! ```
+//! use tinybrowser_bus::{
+//!     names, Action, NavigateRequest, SessionId, SessionOptions, SnapshotRequest, Target,
+//! };
+//!
+//! let session = SessionId::new("s-1");
+//!
+//! let open = serde_json::to_value((SessionOptions::default(),))?;
+//! let navigate = serde_json::to_value((&session, NavigateRequest::new("https://example.com")))?;
+//! let snapshot = serde_json::to_value((&session, SnapshotRequest::interactive()))?;
+//! let click = serde_json::to_value((
+//!     &session,
+//!     Action::Click { target: Target::parse("@e12"), new_tab: false },
+//! ))?;
+//!
+//! assert_eq!(names::methods::OPEN_SESSION, "OpenSession");
+//! assert_eq!(navigate[1]["wait_until"], "load");
+//! assert_eq!(snapshot[1]["interactive_only"], true);
+//! assert_eq!(click[1]["target"], serde_json::json!({ "kind": "ref", "value": "e12" }));
+//! # let _ = open;
+//! # Ok::<(), serde_json::Error>(())
+//! ```
+
+pub mod action;
+pub mod errors;
+pub mod names;
+pub mod output;
+pub mod page;
+pub mod session;
+pub mod snapshot;
+pub mod version;
+
+pub use action::{Action, ActionOutcome, LocateBy, Locator, ScrollDirection, Target, WaitState};
+pub use names::{INTERFACE, METHODS, OBJECT_PATH};
+pub use output::{ImageFormat, OutputChunk, OutputId, OutputRef, ScreenshotRequest};
+pub use page::{
+    EvaluateRequest, NavigateRequest, PageState, PageText, ReadFormat, ReadRequest, WaitUntil,
+};
+pub use session::{SessionId, SessionInfo, SessionOptions, Viewport};
+pub use snapshot::{ElementRef, Snapshot, SnapshotRequest};
+pub use version::{CONTRACT_VERSION, is_compatible};
diff --git a/crates/tinybrowser-bus/src/names/mod.rs b/crates/tinybrowser-bus/src/names/mod.rs
new file mode 100644
index 0000000..326652d
--- /dev/null
+++ b/crates/tinybrowser-bus/src/names/mod.rs
@@ -0,0 +1,115 @@
+//! The bus identity of the tinybrowser module: interface name, object path, and
+//! one constant per member.
+//!
+//! Nothing here is a string literal at a call site. A host names a member
+//! through [`methods`] and the object through [`OBJECT_PATH`], so a rename is a
+//! compile error in every consumer rather than a runtime "unknown method".
+//!
+//! [`METHODS`] is kept in the same order as the interface's dispatch table in
+//! `crates/tinybrowser/src/tinybus_module`, and that crate asserts the two
+//! agree, so a member added to one and forgotten in the other fails the build.
+
+/// The well-known interface name the module claims on the bus.
+pub const INTERFACE: &str = "ai.tinyhumans.tinybrowser.Browser";
+
+/// The object path the module serves its interface at.
+pub const OBJECT_PATH: &str = "/ai/tinyhumans/tinybrowser/Browser";
+
+/// One constant per member of [`INTERFACE`].
+pub mod methods {
+    /// Launches or attaches a browser and returns the session that owns it.
+    ///
+    /// Takes a [`crate::SessionOptions`] and returns a [`crate::SessionInfo`].
+    pub const OPEN_SESSION: &str = "OpenSession";
+
+    /// Closes a session and everything it owns.
+    ///
+    /// Takes a [`crate::SessionId`] and returns nothing. Closing a session that
+    /// is already gone succeeds: a host retrying a close must not have to
+    /// distinguish "never existed" from "already cleaned up".
+    pub const CLOSE_SESSION: &str = "CloseSession";
+
+    /// Lists the sessions this module is currently holding open.
+    ///
+    /// Takes nothing and returns a `Vec<`[`crate::SessionInfo`]`>`.
+    pub const LIST_SESSIONS: &str = "ListSessions";
+
+    /// Navigates the session's active page.
+    ///
+    /// Takes a [`crate::SessionId`] and a [`crate::NavigateRequest`], and
+    /// returns the [`crate::PageState`] the navigation settled on.
+    pub const NAVIGATE: &str = "Navigate";
+
+    /// Captures the accessibility tree of the active page, with element refs.
+    ///
+    /// Takes a [`crate::SessionId`] and a [`crate::SnapshotRequest`], and
+    /// returns a [`crate::Snapshot`]. The refs it hands back are what
+    /// [`PERFORM`] resolves as [`crate::Target::Ref`].
+    pub const SNAPSHOT: &str = "Snapshot";
+
+    /// Performs one interaction against the active page.
+    ///
+    /// Takes a [`crate::SessionId`] and an [`crate::Action`], and returns an
+    /// [`crate::ActionOutcome`].
+    pub const PERFORM: &str = "Perform";
+
+    /// Extracts the active page as agent-readable text.
+    ///
+    /// Takes a [`crate::SessionId`] and a [`crate::ReadRequest`], and returns a
+    /// [`crate::PageText`].
+    pub const READ_PAGE: &str = "ReadPage";
+
+    /// Evaluates JavaScript in the active page and returns its value.
+    ///
+    /// Takes a [`crate::SessionId`] and an [`crate::EvaluateRequest`], and
+    /// returns the resolved value as arbitrary JSON.
+    pub const EVALUATE: &str = "Evaluate";
+
+    /// Captures a screenshot and holds it for collection.
+    ///
+    /// Takes a [`crate::SessionId`] and a [`crate::ScreenshotRequest`], and
+    /// returns an [`crate::OutputRef`] naming the held image. The image itself
+    /// is pulled with [`READ_OUTPUT`] — see [`crate::output`] for why it is not
+    /// returned inline.
+    pub const SCREENSHOT: &str = "Screenshot";
+
+    /// Reads one chunk of a held output.
+    ///
+    /// Takes an output id, a byte offset, and a maximum length, and returns an
+    /// [`crate::OutputChunk`].
+    pub const READ_OUTPUT: &str = "ReadOutput";
+
+    /// Releases a held output before it expires.
+    ///
+    /// Takes an output id and returns nothing. Releasing an output that is
+    /// already gone succeeds, for the same reason [`CLOSE_SESSION`] does.
+    pub const RELEASE_OUTPUT: &str = "ReleaseOutput";
+
+    /// Reports the contract version the module serves.
+    ///
+    /// Takes nothing and returns `(u32, u32)`. A host compares it with
+    /// [`crate::is_compatible`] before its first real call.
+    pub const CONTRACT_VERSION: &str = "ContractVersion";
+}
+
+/// Every member of [`INTERFACE`], in the order the interface dispatches them.
+///
+/// `crates/tinybrowser` asserts its declared manifest methods against this
+/// list, so the two cannot drift.
+pub const METHODS: &[&str] = &[
+    methods::OPEN_SESSION,
+    methods::CLOSE_SESSION,
+    methods::LIST_SESSIONS,
+    methods::NAVIGATE,
+    methods::SNAPSHOT,
+    methods::PERFORM,
+    methods::READ_PAGE,
+    methods::EVALUATE,
+    methods::SCREENSHOT,
+    methods::READ_OUTPUT,
+    methods::RELEASE_OUTPUT,
+    methods::CONTRACT_VERSION,
+];
+
+#[cfg(test)]
+mod test;
diff --git a/crates/tinybrowser-bus/src/names/test.rs b/crates/tinybrowser-bus/src/names/test.rs
new file mode 100644
index 0000000..0e8dad3
--- /dev/null
+++ b/crates/tinybrowser-bus/src/names/test.rs
@@ -0,0 +1,66 @@
+//! Tests for the module's bus identity.
+//!
+//! These pin strings a host spells from this crate and a module answers to. A
+//! change to one of them is a wire break, so it should have to be made twice —
+//! once in the constant and once here.
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use super::{INTERFACE, METHODS, OBJECT_PATH, methods};
+
+#[test]
+fn interface_is_the_published_name() {
+    assert_eq!(INTERFACE, "ai.tinyhumans.tinybrowser.Browser");
+}
+
+#[test]
+fn object_path_is_the_interface_in_path_form() {
+    assert_eq!(OBJECT_PATH, "/ai/tinyhumans/tinybrowser/Browser");
+    assert_eq!(OBJECT_PATH, format!("/{}", INTERFACE.replace('.', "/")));
+}
+
+#[test]
+fn methods_lists_every_member_once() {
+    let mut sorted = METHODS.to_vec();
+    sorted.sort_unstable();
+    let count = sorted.len();
+    sorted.dedup();
+
+    assert_eq!(sorted.len(), count, "METHODS contains a duplicate");
+    assert_eq!(count, 12);
+}
+
+#[test]
+fn method_constants_are_pascal_case_on_the_wire() {
+    for member in METHODS {
+        let first = member.chars().next().expect("member name is not empty");
+        assert!(first.is_ascii_uppercase(), "{member} is not PascalCase");
+        assert!(
+            member.chars().all(|c| c.is_ascii_alphanumeric()),
+            "{member} is not a bare identifier"
+        );
+    }
+}
+
+#[test]
+fn every_member_constant_appears_in_methods() {
+    for member in [
+        methods::OPEN_SESSION,
+        methods::CLOSE_SESSION,
+        methods::LIST_SESSIONS,
+        methods::NAVIGATE,
+        methods::SNAPSHOT,
+        methods::PERFORM,
+        methods::READ_PAGE,
+        methods::EVALUATE,
+        methods::SCREENSHOT,
+        methods::READ_OUTPUT,
+        methods::RELEASE_OUTPUT,
+        methods::CONTRACT_VERSION,
+    ] {
+        assert!(
+            METHODS.contains(&member),
+            "{member} is missing from METHODS"
+        );
+    }
+}
diff --git a/crates/tinybrowser-bus/src/output/mod.rs b/crates/tinybrowser-bus/src/output/mod.rs
new file mode 100644
index 0000000..b20806f
--- /dev/null
+++ b/crates/tinybrowser-bus/src/output/mod.rs
@@ -0,0 +1,28 @@
+//! Held outputs: how a screenshot gets from the module to the host.
+//!
+//! # Why a handle and not the bytes
+//!
+//! A bus frame is capped at 16 MiB, and a full-page screenshot of a long article
+//! at 2x is comfortably larger than that. A served object also cannot open a
+//! stream back to its caller — streams ride *alongside* an inbound call — so the
+//! module cannot push the image either.
+//!
+//! What is left is the shape below: the module holds the image, hands back an
+//! [`OutputRef`] describing it, and the host pulls it with
+//! [`crate::names::methods::READ_OUTPUT`] in chunks it chooses. The `sha256` on
+//! the handle is what lets the host verify it reassembled the image the module
+//! actually produced rather than a partially-overwritten one.
+//!
+//! # Release, do not wait for expiry
+//!
+//! The module bounds what it holds and expires an abandoned output, but until
+//! then the slot and the memory are spent. A host that reads an output to
+//! completion should release it, and the release belongs in a `defer`-shaped
+//! position so a failure part-way through a read does not leak it.
+
+mod types;
+
+pub use types::{ImageFormat, OutputChunk, OutputId, OutputRef, ScreenshotRequest};
+
+#[cfg(test)]
+mod test;
diff --git a/crates/tinybrowser-bus/src/output/test.rs b/crates/tinybrowser-bus/src/output/test.rs
new file mode 100644
index 0000000..c13bcde
--- /dev/null
+++ b/crates/tinybrowser-bus/src/output/test.rs
@@ -0,0 +1,133 @@
+//! Tests for the screenshot and held-output payload types.
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use super::{ImageFormat, OutputChunk, OutputId, OutputRef, ScreenshotRequest};
+use serde_json::json;
+
+#[test]
+fn output_id_is_a_bare_string_on_the_wire() {
+    assert_eq!(
+        serde_json::to_value(OutputId::new("o-3")).expect("serializes"),
+        json!("o-3")
+    );
+    assert_eq!(OutputId::from("o-3").to_string(), "o-3");
+}
+
+#[test]
+fn screenshots_default_to_a_png_of_the_viewport() {
+    let request = ScreenshotRequest::default();
+
+    assert_eq!(request.format, ImageFormat::Png);
+    assert!(!request.full_page);
+    assert!(request.target.is_none());
+    assert_eq!(
+        serde_json::from_value::<ScreenshotRequest>(json!({})).expect("deserializes"),
+        request
+    );
+}
+
+#[test]
+fn image_formats_carry_their_media_type() {
+    assert_eq!(ImageFormat::Png.media_type(), "image/png");
+    assert_eq!(ImageFormat::Jpeg.media_type(), "image/jpeg");
+    assert_eq!(ImageFormat::Webp.media_type(), "image/webp");
+}
+
+#[test]
+fn image_format_is_snake_case_on_the_wire() {
+    assert_eq!(
+        serde_json::to_value(ImageFormat::Jpeg).expect("serializes"),
+        json!("jpeg")
+    );
+}
+
+#[test]
+fn output_ref_round_trips() {
+    let handle = OutputRef {
+        id: OutputId::new("o-1"),
+        total_bytes: 4_096,
+        sha256: "0".repeat(64),
+        media_type: ImageFormat::Png.media_type().to_string(),
+        width: 1280,
+        height: 800,
+    };
+
+    let encoded = serde_json::to_value(&handle).expect("serializes");
+    assert_eq!(encoded["id"], json!("o-1"));
+    assert_eq!(encoded["media_type"], json!("image/png"));
+    assert_eq!(
+        serde_json::from_value::<OutputRef>(encoded).expect("deserializes"),
+        handle
+    );
+}
+
+#[test]
+fn chunks_carry_base64_and_say_where_they_end() {
+    let chunk = OutputChunk {
+        id: OutputId::new("o-1"),
+        offset: 0,
+        data: "aGk=".to_string(),
+        eof: true,
+    };
+
+    let encoded = serde_json::to_value(&chunk).expect("serializes");
+    assert_eq!(encoded["data"], json!("aGk="));
+    assert_eq!(
+        serde_json::from_value::<OutputChunk>(encoded).expect("deserializes"),
+        chunk
+    );
+}
+
+#[test]
+fn an_output_id_is_reachable_from_both_string_forms() {
+    // A host holds these as `String` after a decode and as `&str` from a
+    // literal; both conversions exist so neither call site has to know.
+    assert_eq!(OutputId::from("o-1".to_string()), OutputId::new("o-1"));
+    assert_eq!(OutputId::from("o-1"), OutputId::new("o-1"));
+    assert_eq!(OutputId::new("o-1").as_str(), "o-1");
+}
+
+#[test]
+fn output_ids_order_and_hash_so_a_host_can_key_by_them() {
+    let mut ids = vec![OutputId::new("o-2"), OutputId::new("o-1")];
+    ids.sort();
+
+    assert_eq!(ids, vec![OutputId::new("o-1"), OutputId::new("o-2")]);
+    assert_eq!(
+        std::collections::HashSet::from([OutputId::new("o-1"), OutputId::new("o-1")]).len(),
+        1
+    );
+}
+
+#[test]
+fn a_screenshot_request_round_trips_every_field() {
+    let request = ScreenshotRequest {
+        target: Some(crate::Target::selector("#chart")),
+        full_page: true,
+        format: ImageFormat::Webp,
+        quality: Some(60),
+    };
+    let encoded = serde_json::to_value(&request).expect("serializes");
+
+    assert_eq!(encoded["format"], json!("webp"));
+    assert_eq!(encoded["target"]["kind"], json!("selector"));
+    assert_eq!(
+        serde_json::from_value::<ScreenshotRequest>(encoded).expect("deserializes"),
+        request
+    );
+}
+
+#[test]
+fn image_formats_deserialize_from_their_wire_spellings() {
+    for (wire, format) in [
+        ("png", ImageFormat::Png),
+        ("jpeg", ImageFormat::Jpeg),
+        ("webp", ImageFormat::Webp),
+    ] {
+        assert_eq!(
+            serde_json::from_value::<ImageFormat>(json!(wire)).expect("deserializes"),
+            format
+        );
+    }
+}
diff --git a/crates/tinybrowser-bus/src/output/types.rs b/crates/tinybrowser-bus/src/output/types.rs
new file mode 100644
index 0000000..3b53d73
--- /dev/null
+++ b/crates/tinybrowser-bus/src/output/types.rs
@@ -0,0 +1,145 @@
+//! Payload types for screenshots and the outputs they are held as.
+
+use serde::{Deserialize, Serialize};
+
+use crate::Target;
+
+/// The identity of one held output.
+///
+/// A newtype for the same reason [`crate::SessionId`] is one: both are opaque
+/// strings, and swapping them is otherwise a runtime error rather than a
+/// compile-time one.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize)]
+#[serde(transparent)]
+pub struct OutputId(String);
+
+impl OutputId {
+    /// Wraps `id` as an output identity.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// # use tinybrowser_bus::OutputId;
+    /// assert_eq!(OutputId::new("o-1").as_str(), "o-1");
+    /// ```
+    #[must_use]
+    pub fn new(id: impl Into<String>) -> Self {
+        Self(id.into())
+    }
+
+    /// The identity as it appears on the wire.
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+impl std::fmt::Display for OutputId {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.0)
+    }
+}
+
+impl From<String> for OutputId {
+    fn from(id: String) -> Self {
+        Self(id)
+    }
+}
+
+impl From<&str> for OutputId {
+    fn from(id: &str) -> Self {
+        Self(id.to_string())
+    }
+}
+
+/// The encoding a screenshot is captured in.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ImageFormat {
+    /// Lossless. Correct for a screenshot a model will read text from, and the
+    /// default for that reason.
+    #[default]
+    Png,
+    /// Lossy, and much smaller. Correct for a long full-page capture where the
+    /// question is layout rather than legibility.
+    Jpeg,
+    /// Lossy, smaller again, and not universally readable downstream.
+    Webp,
+}
+
+impl ImageFormat {
+    /// The media type of an image in this format.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// # use tinybrowser_bus::ImageFormat;
+    /// assert_eq!(ImageFormat::Png.media_type(), "image/png");
+    /// ```
+    #[must_use]
+    pub fn media_type(self) -> &'static str {
+        match self {
+            Self::Png => "image/png",
+            Self::Jpeg => "image/jpeg",
+            Self::Webp => "image/webp",
+        }
+    }
+}
+
+/// What to capture.
+///
+/// The default is the viewport as a PNG, which is what a model looking at a page
+/// wants: lossless enough to read text out of, and bounded by the viewport
+/// rather than by however long the document happens to be.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct ScreenshotRequest {
+    /// Capture just this element. Defaults to the viewport.
+    pub target: Option<Target>,
+    /// Capture the whole scrollable document rather than the viewport.
+    pub full_page: bool,
+    /// The encoding to capture in.
+    pub format: ImageFormat,
+    /// Quality from 1 to 100, for the lossy formats. Ignored for
+    /// [`ImageFormat::Png`].
+    pub quality: Option<u8>,
+}
+
+/// A handle to an image the module is holding.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct OutputRef {
+    /// The identity to read and release it by.
+    pub id: OutputId,
+    /// Its total size in bytes.
+    ///
+    /// This is a number the module sent: a host sizing a buffer from it should
+    /// treat it as a bound to check against rather than one to trust, because a
+    /// wrong value turns into a failed allocation, which aborts a process rather
+    /// than returning an error.
+    pub total_bytes: u64,
+    /// The lowercase hex SHA-256 of the complete output.
+    pub sha256: String,
+    /// The media type of the bytes, from [`ImageFormat::media_type`].
+    pub media_type: String,
+    /// The captured image's pixel width.
+    pub width: u32,
+    /// The captured image's pixel height.
+    pub height: u32,
+}
+
+/// One piece of a held output.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct OutputChunk {
+    /// The output this came from.
+    pub id: OutputId,
+    /// The byte offset this chunk starts at.
+    pub offset: u64,
+    /// The bytes, base64 with standard alphabet and padding.
+    ///
+    /// Base64 rather than a JSON array of numbers: the array form costs roughly
+    /// four bytes per byte and parses far slower, and a bus frame is the scarce
+    /// resource here.
+    pub data: String,
+    /// Whether this chunk reaches the end of the output.
+    pub eof: bool,
+}
diff --git a/crates/tinybrowser-bus/src/page/mod.rs b/crates/tinybrowser-bus/src/page/mod.rs
new file mode 100644
index 0000000..52fef51
--- /dev/null
+++ b/crates/tinybrowser-bus/src/page/mod.rs
@@ -0,0 +1,15 @@
+//! Navigating a page, and reading one back as text.
+//!
+//! These are the two halves of the cheapest useful loop an agent can run: go
+//! somewhere, then look at what is there. Neither needs a snapshot or a ref, so
+//! a host that only wants to fetch and summarise a page never pays for the
+//! accessibility tree.
+
+mod types;
+
+pub use types::{
+    EvaluateRequest, NavigateRequest, PageState, PageText, ReadFormat, ReadRequest, WaitUntil,
+};
+
+#[cfg(test)]
+mod test;
diff --git a/crates/tinybrowser-bus/src/page/test.rs b/crates/tinybrowser-bus/src/page/test.rs
new file mode 100644
index 0000000..0743851
--- /dev/null
+++ b/crates/tinybrowser-bus/src/page/test.rs
@@ -0,0 +1,119 @@
+//! Tests for the navigation and extraction payload types.
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use super::{EvaluateRequest, NavigateRequest, PageState, PageText, ReadFormat, ReadRequest};
+use crate::WaitUntil;
+use serde_json::json;
+
+#[test]
+fn wait_until_is_snake_case_on_the_wire() {
+    assert_eq!(
+        serde_json::to_value(WaitUntil::DomContentLoaded).expect("serializes"),
+        json!("dom_content_loaded")
+    );
+    assert_eq!(
+        serde_json::to_value(WaitUntil::NetworkIdle).expect("serializes"),
+        json!("network_idle")
+    );
+    assert_eq!(
+        serde_json::from_value::<WaitUntil>(json!("commit")).expect("deserializes"),
+        WaitUntil::Commit
+    );
+}
+
+#[test]
+fn navigate_defaults_to_waiting_for_load() {
+    let request: NavigateRequest =
+        serde_json::from_value(json!({ "url": "https://example.com" })).expect("deserializes");
+
+    assert_eq!(request.wait_until, WaitUntil::Load);
+    assert!(request.timeout_ms.is_none());
+    assert_eq!(request, NavigateRequest::new("https://example.com"));
+}
+
+#[test]
+fn navigate_round_trips_an_explicit_deadline() {
+    let request = NavigateRequest {
+        url: "https://example.com/login".to_string(),
+        wait_until: WaitUntil::NetworkIdle,
+        timeout_ms: Some(5_000),
+    };
+    let encoded = serde_json::to_value(&request).expect("serializes");
+
+    assert_eq!(
+        encoded,
+        json!({
+            "url": "https://example.com/login",
+            "wait_until": "network_idle",
+            "timeout_ms": 5_000,
+        })
+    );
+    assert_eq!(
+        serde_json::from_value::<NavigateRequest>(encoded).expect("deserializes"),
+        request
+    );
+}
+
+#[test]
+fn page_state_carries_an_absent_status_for_non_http_pages() {
+    let state = PageState::new("about:blank");
+
+    assert!(state.status.is_none());
+    assert_eq!(
+        serde_json::to_value(&state).expect("serializes"),
+        json!({ "url": "about:blank", "title": "", "status": null })
+    );
+}
+
+#[test]
+fn read_defaults_to_bounded_markdown() {
+    let request = ReadRequest::default();
+
+    assert_eq!(request.format, ReadFormat::Markdown);
+    assert_eq!(request.max_chars, 200_000);
+    assert_eq!(
+        serde_json::from_value::<ReadRequest>(json!({})).expect("deserializes"),
+        request
+    );
+}
+
+#[test]
+fn read_format_is_snake_case_on_the_wire() {
+    assert_eq!(
+        serde_json::to_value(ReadFormat::Html).expect("serializes"),
+        json!("html")
+    );
+}
+
+#[test]
+fn page_text_reports_truncation_explicitly() {
+    let text = PageText {
+        url: "https://example.com/".to_string(),
+        title: "Example Domain".to_string(),
+        format: ReadFormat::Text,
+        content: "Example".to_string(),
+        truncated: true,
+    };
+    let encoded = serde_json::to_value(&text).expect("serializes");
+
+    assert_eq!(encoded["truncated"], json!(true));
+    assert_eq!(
+        serde_json::from_value::<PageText>(encoded).expect("deserializes"),
+        text
+    );
+}
+
+#[test]
+fn evaluate_awaits_promises_by_default() {
+    let request = EvaluateRequest::new("fetch('/api').then((r) => r.status)");
+
+    assert!(request.await_promise);
+    assert_eq!(
+        serde_json::from_value::<EvaluateRequest>(json!({
+            "expression": "fetch('/api').then((r) => r.status)"
+        }))
+        .expect("deserializes"),
+        request
+    );
+}
diff --git a/crates/tinybrowser-bus/src/page/types.rs b/crates/tinybrowser-bus/src/page/types.rs
new file mode 100644
index 0000000..365f0f3
--- /dev/null
+++ b/crates/tinybrowser-bus/src/page/types.rs
@@ -0,0 +1,192 @@
+//! Payload types for navigation, extraction, and evaluation.
+
+use serde::{Deserialize, Serialize};
+
+/// How far a navigation waits before the module calls it settled.
+///
+/// The choice is a trade between a page that is merely reachable and one that is
+/// actually usable. There is no single right answer, which is why it is on the
+/// request rather than hard-coded: a login redirect wants [`WaitUntil::Load`],
+/// and a single-page application that streams its content only ever settles at
+/// [`WaitUntil::NetworkIdle`].
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum WaitUntil {
+    /// Return as soon as the browser has committed to the navigation. The page
+    /// may still be blank.
+    Commit,
+    /// Wait for `DOMContentLoaded`: the document is parsed, subresources may
+    /// still be in flight.
+    DomContentLoaded,
+    /// Wait for the `load` event.
+    Load,
+    /// Wait until the page has made no network request for a short quiet period,
+    /// or the deadline expires — whichever comes first. A page that polls in the
+    /// background never goes idle, so this is bounded rather than absolute.
+    NetworkIdle,
+}
+
+impl Default for WaitUntil {
+    /// [`WaitUntil::Load`]: the point at which most pages are both rendered and
+    /// interactive, and the one a human would call "loaded".
+    fn default() -> Self {
+        Self::Load
+    }
+}
+
+/// Where to send the session's active page.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct NavigateRequest {
+    /// The destination. A bare host such as `example.com` is read as `https://`,
+    /// matching what an operator would type; anything else must carry its
+    /// scheme, and only `http` and `https` are accepted.
+    pub url: String,
+    /// How far to wait before returning.
+    pub wait_until: WaitUntil,
+    /// Deadline in milliseconds. Falls back to the session's default when absent.
+    pub timeout_ms: Option<u64>,
+}
+
+impl NavigateRequest {
+    /// A request for `url` with the default wait and the session's deadline.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// # use tinybrowser_bus::{NavigateRequest, WaitUntil};
+    /// let request = NavigateRequest::new("https://example.com");
+    /// assert_eq!(request.wait_until, WaitUntil::Load);
+    /// ```
+    #[must_use]
+    pub fn new(url: impl Into<String>) -> Self {
+        Self {
+            url: url.into(),
+            ..Self::default()
+        }
+    }
+}
+
+/// Where the session's active page currently is.
+///
+/// Returned by every member that can move the page, so a host never has to make
+/// a second call to find out where an action left it.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct PageState {
+    /// The URL after any redirect.
+    pub url: String,
+    /// The document title, empty if it has none.
+    pub title: String,
+    /// The HTTP status of the main document, absent when the page was not
+    /// reached over HTTP — `about:blank`, a `data:` URL, or a same-document
+    /// navigation that issued no request.
+    pub status: Option<u16>,
+}
+
+impl PageState {
+    /// A state for `url` with no title and no status.
+    #[must_use]
+    pub fn new(url: impl Into<String>) -> Self {
+        Self {
+            url: url.into(),
+            title: String::new(),
+            status: None,
+        }
+    }
+}
+
+/// The shape a page is extracted into.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ReadFormat {
+    /// The rendered text of the page, with the chrome — navigation, scripts,
+    /// styles, hidden nodes — dropped.
+    Text,
+    /// The same content as [`ReadFormat::Text`], keeping headings, links, lists,
+    /// and code blocks as Markdown. This is what a model reads best, and the
+    /// default for that reason.
+    #[default]
+    Markdown,
+    /// The live serialized DOM, after scripts have run.
+    ///
+    /// This is not the response body: it is what the page became. It is here for
+    /// a host that needs to parse structure the other two formats discard, and
+    /// it is by far the most expensive of the three.
+    Html,
+}
+
+/// A request to read the active page.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct ReadRequest {
+    /// The shape to extract into.
+    pub format: ReadFormat,
+    /// Restrict extraction to the first element matching this CSS selector.
+    pub selector: Option<String>,
+    /// Truncate the extracted content to this many characters. Defaults to
+    /// 200,000 — comfortably inside the bus frame limit, and already far more
+    /// than a model will read.
+    pub max_chars: usize,
+}
+
+impl Default for ReadRequest {
+    fn default() -> Self {
+        Self {
+            format: ReadFormat::default(),
+            selector: None,
+            max_chars: 200_000,
+        }
+    }
+}
+
+/// The extracted page.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct PageText {
+    /// The URL the content came from.
+    pub url: String,
+    /// The document title.
+    pub title: String,
+    /// The shape it was extracted into.
+    pub format: ReadFormat,
+    /// The content itself.
+    pub content: String,
+    /// Whether `max_chars` cut the content short. A host that shows a model
+    /// truncated content without saying so invites it to conclude the rest of
+    /// the page does not exist.
+    pub truncated: bool,
+}
+
+/// JavaScript to run in the active page.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct EvaluateRequest {
+    /// The expression to evaluate. Its completion value is what comes back.
+    pub expression: String,
+    /// Await the result when it is a promise. Defaults to `true`, because an
+    /// unawaited promise serializes as an empty object and looks like a bug in
+    /// the module rather than in the expression.
+    pub await_promise: bool,
+    /// Deadline in milliseconds. Falls back to the session's default when absent.
+    pub timeout_ms: Option<u64>,
+}
+
+impl Default for EvaluateRequest {
+    fn default() -> Self {
+        Self {
+            expression: String::new(),
+            await_promise: true,
+            timeout_ms: None,
+        }
+    }
+}
+
+impl EvaluateRequest {
+    /// A request evaluating `expression` with the defaults.
+    #[must_use]
+    pub fn new(expression: impl Into<String>) -> Self {
+        Self {
+            expression: expression.into(),
+            ..Self::default()
+        }
+    }
+}
diff --git a/crates/tinybrowser-bus/src/session/mod.rs b/crates/tinybrowser-bus/src/session/mod.rs
new file mode 100644
index 0000000..a715f37
--- /dev/null
+++ b/crates/tinybrowser-bus/src/session/mod.rs
@@ -0,0 +1,20 @@
+//! Sessions: what a host opens before it can drive a page, and what it closes
+//! when it is done.
+//!
+//! A session is one browser the module is holding on the host's behalf — either
+//! a Chrome it launched or one it attached to at an existing endpoint — plus the
+//! page it is currently driving. Every other member takes a [`SessionId`],
+//! because a host that runs two tasks at once must not have them fight over one
+//! implicit "current page".
+//!
+//! Sessions are explicit rather than implicit for a second reason: a browser is
+//! an expensive, long-lived, externally visible resource. Making a host name the
+//! one it means is what lets the module bound how many exist, expire the ones
+//! nobody is using, and report both in [`SessionInfo`].
+
+mod types;
+
+pub use types::{SessionId, SessionInfo, SessionOptions, Viewport};
+
+#[cfg(test)]
+mod test;
diff --git a/crates/tinybrowser-bus/src/session/test.rs b/crates/tinybrowser-bus/src/session/test.rs
new file mode 100644
index 0000000..9b763e0
--- /dev/null
+++ b/crates/tinybrowser-bus/src/session/test.rs
@@ -0,0 +1,146 @@
+//! Tests for the session payload types.
+//!
+//! The assertions on field names are the wire form: a host and a module that
+//! disagree about `default_timeout_ms` fail at runtime with a decode error, and
+//! nothing else in the build would catch it.
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use super::{SessionId, SessionInfo, SessionOptions, Viewport};
+use serde_json::json;
+
+#[test]
+fn session_id_is_a_bare_string_on_the_wire() {
+    let encoded = serde_json::to_value(SessionId::new("s-7")).expect("serializes");
+    assert_eq!(encoded, json!("s-7"));
+
+    let decoded: SessionId = serde_json::from_value(json!("s-7")).expect("deserializes");
+    assert_eq!(decoded.as_str(), "s-7");
+}
+
+#[test]
+fn session_id_displays_as_its_identity() {
+    assert_eq!(SessionId::from("s-7").to_string(), "s-7");
+}
+
+#[test]
+fn default_options_are_a_headless_desktop_browser() {
+    let options = SessionOptions::default();
+
+    assert!(options.headless);
+    assert_eq!(options.viewport, Viewport::desktop(1280, 800));
+    assert_eq!(options.default_timeout_ms, 30_000);
+    assert!(options.endpoint.is_none());
+    assert!(options.allowed_origins.is_empty());
+}
+
+#[test]
+fn options_fill_every_absent_field_from_the_default() {
+    // `#[serde(default)]` on the struct is what lets a host send `{}` and a
+    // later contract version add a field without breaking it.
+    let options: SessionOptions = serde_json::from_value(json!({})).expect("deserializes");
+    assert_eq!(options, SessionOptions::default());
+
+    let partial: SessionOptions =
+        serde_json::from_value(json!({ "headless": false })).expect("deserializes");
+    assert!(!partial.headless);
+    assert_eq!(partial.default_timeout_ms, 30_000);
+}
+
+#[test]
+fn options_serialize_with_the_documented_field_names() {
+    let encoded = serde_json::to_value(SessionOptions::default()).expect("serializes");
+    let object = encoded.as_object().expect("an object");
+
+    let mut keys: Vec<&str> = object.keys().map(String::as_str).collect();
+    keys.sort_unstable();
+    assert_eq!(
+        keys,
+        [
+            "allowed_origins",
+            "args",
+            "default_timeout_ms",
+            "endpoint",
+            "executable",
+            "headless",
+            "user_agent",
+            "user_data_dir",
+            "viewport",
+        ]
+    );
+}
+
+#[test]
+fn viewport_round_trips() {
+    let viewport = Viewport {
+        width: 390,
+        height: 844,
+        device_scale_factor: 3.0,
+        mobile: true,
+    };
+    let encoded = serde_json::to_value(viewport).expect("serializes");
+
+    assert_eq!(
+        encoded,
+        json!({
+            "width": 390,
+            "height": 844,
+            "device_scale_factor": 3.0,
+            "mobile": true,
+        })
+    );
+    assert_eq!(
+        serde_json::from_value::<Viewport>(encoded).expect("deserializes"),
+        viewport
+    );
+}
+
+#[test]
+fn session_info_round_trips() {
+    let info = SessionInfo {
+        id: SessionId::new("s-1"),
+        endpoint: "ws://127.0.0.1:9222/devtools/browser/abc".to_string(),
+        launched: true,
+        headless: true,
+        viewport: Viewport::default(),
+        url: "https://example.com/".to_string(),
+        title: "Example Domain".to_string(),
+    };
+
+    let encoded = serde_json::to_value(&info).expect("serializes");
+    assert_eq!(encoded["id"], json!("s-1"));
+    assert_eq!(
+        serde_json::from_value::<SessionInfo>(encoded).expect("deserializes"),
+        info
+    );
+}
+
+#[test]
+fn a_session_id_is_reachable_from_both_string_forms() {
+    assert_eq!(SessionId::from("s-1".to_string()), SessionId::new("s-1"));
+    assert_eq!(SessionId::from("s-1"), SessionId::new("s-1"));
+}
+
+#[test]
+fn session_ids_order_and_hash_so_a_host_can_key_by_them() {
+    let mut ids = vec![SessionId::new("s-2"), SessionId::new("s-1")];
+    ids.sort();
+
+    assert_eq!(ids, vec![SessionId::new("s-1"), SessionId::new("s-2")]);
+    assert_eq!(
+        std::collections::HashSet::from([SessionId::new("s-1"), SessionId::new("s-1")]).len(),
+        1
+    );
+}
+
+#[test]
+fn a_viewport_can_be_built_for_a_phone() {
+    let phone = Viewport {
+        mobile: true,
+        device_scale_factor: 3.0,
+        ..Viewport::desktop(390, 844)
+    };
+
+    assert!(phone.mobile);
+    assert_ne!(phone, Viewport::default());
+}
diff --git a/crates/tinybrowser-bus/src/session/types.rs b/crates/tinybrowser-bus/src/session/types.rs
new file mode 100644
index 0000000..4747ce8
--- /dev/null
+++ b/crates/tinybrowser-bus/src/session/types.rs
@@ -0,0 +1,184 @@
+//! Payload types for opening, listing, and closing sessions.
+
+use serde::{Deserialize, Serialize};
+
+/// The identity of one open session.
+///
+/// A newtype rather than a bare `String` so a session id cannot be passed where
+/// an output id is expected — the two are both opaque strings on the wire, and
+/// the compiler is the only thing that will notice them being swapped.
+///
+/// It serializes as the bare string it wraps, so the wire form is a JSON string
+/// and a host that logs one sees the id rather than an object.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize)]
+#[serde(transparent)]
+pub struct SessionId(String);
+
+impl SessionId {
+    /// Wraps `id` as a session identity.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// # use tinybrowser_bus::SessionId;
+    /// assert_eq!(SessionId::new("s-1").as_str(), "s-1");
+    /// ```
+    #[must_use]
+    pub fn new(id: impl Into<String>) -> Self {
+        Self(id.into())
+    }
+
+    /// The identity as it appears on the wire.
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+impl std::fmt::Display for SessionId {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.0)
+    }
+}
+
+impl From<String> for SessionId {
+    fn from(id: String) -> Self {
+        Self(id)
+    }
+}
+
+impl From<&str> for SessionId {
+    fn from(id: &str) -> Self {
+        Self(id.to_string())
+    }
+}
+
+/// The page size a session renders at.
+///
+/// Present because the accessibility snapshot and every coordinate-based
+/// interaction depend on layout: a headless default of 800x600 makes a
+/// responsive site serve its mobile tree, and an agent then cannot find the
+/// navigation an operator sees.
+#[derive(Debug, Clone, Copy, PartialEq, Serialize, Deserialize)]
+pub struct Viewport {
+    /// Width in CSS pixels.
+    pub width: u32,
+    /// Height in CSS pixels.
+    pub height: u32,
+    /// Device pixel ratio. `1.0` for an ordinary desktop page.
+    pub device_scale_factor: f64,
+    /// Whether to emulate a touch-capable mobile device.
+    pub mobile: bool,
+}
+
+impl Viewport {
+    /// A desktop viewport of `width` by `height` CSS pixels at 1x.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// # use tinybrowser_bus::Viewport;
+    /// let viewport = Viewport::desktop(1280, 800);
+    /// assert_eq!((viewport.width, viewport.mobile), (1280, false));
+    /// ```
+    #[must_use]
+    pub fn desktop(width: u32, height: u32) -> Self {
+        Self {
+            width,
+            height,
+            device_scale_factor: 1.0,
+            mobile: false,
+        }
+    }
+}
+
+impl Default for Viewport {
+    /// A 1280x800 desktop viewport: wide enough that mainstream sites serve
+    /// their desktop layout, small enough that a full-page screenshot of an
+    /// ordinary article stays under the module's image cap.
+    fn default() -> Self {
+        Self::desktop(1280, 800)
+    }
+}
+
+/// How to obtain the browser a session drives.
+///
+/// Every field is optional with a documented default, so the common case —
+/// "give me a headless Chrome" — is `SessionOptions::default()` and a host only
+/// spells the parts it actually cares about.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct SessionOptions {
+    /// Attach to an already-running browser at this `DevTools` endpoint —
+    /// `http://127.0.0.1:9222`, or a `ws://`/`wss://` browser socket — instead
+    /// of launching one.
+    ///
+    /// This is how a host reuses a browser it manages itself, and how a sandbox
+    /// points the module at a Chrome running in another container.
+    pub endpoint: Option<String>,
+    /// Path to the browser binary to launch. Defaults to the first Chrome,
+    /// Chromium, or Chrome for Testing build the module finds on this host.
+    pub executable: Option<String>,
+    /// Run without a visible window. Defaults to `true`: a module loaded into a
+    /// daemon usually has no display to draw on.
+    pub headless: bool,
+    /// The size to render at. Defaults to [`Viewport::default`].
+    pub viewport: Viewport,
+    /// Overrides the browser's own `User-Agent`.
+    pub user_agent: Option<String>,
+    /// Profile directory for a launched browser. Defaults to a fresh temporary
+    /// directory that is removed when the session closes, so one session's
+    /// cookies and logins never leak into the next.
+    pub user_data_dir: Option<String>,
+    /// Extra command-line arguments for a launched browser.
+    pub args: Vec<String>,
+    /// If non-empty, the only origins this session may navigate to.
+    ///
+    /// An entry is an origin (`https://example.com`) or a host with a leading
+    /// dot for its subdomains (`.example.com`). A navigation outside the list is
+    /// refused before the browser is asked to make a request, which is the only
+    /// point where refusing it is cheap and certain.
+    pub allowed_origins: Vec<String>,
+    /// Default deadline in milliseconds for operations that do not carry their
+    /// own. Defaults to 30 seconds.
+    pub default_timeout_ms: u64,
+}
+
+impl Default for SessionOptions {
+    fn default() -> Self {
+        Self {
+            endpoint: None,
+            executable: None,
+            headless: true,
+            viewport: Viewport::default(),
+            user_agent: None,
+            user_data_dir: None,
+            args: Vec::new(),
+            allowed_origins: Vec::new(),
+            default_timeout_ms: 30_000,
+        }
+    }
+}
+
+/// What the module is holding for one session.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct SessionInfo {
+    /// The identity every other member takes.
+    pub id: SessionId,
+    /// The `ws://` browser endpoint the module is driving.
+    ///
+    /// Reported so an operator debugging a stuck session can attach `DevTools` to
+    /// the same browser rather than guessing which one it is.
+    pub endpoint: String,
+    /// Whether this browser was launched by the module. A session that attached
+    /// to someone else's browser leaves it running when it closes.
+    pub launched: bool,
+    /// Whether the browser is headless.
+    pub headless: bool,
+    /// The viewport the session renders at.
+    pub viewport: Viewport,
+    /// The URL of the page the session is currently driving.
+    pub url: String,
+    /// The title of that page, empty if it has none yet.
+    pub title: String,
+}
diff --git a/crates/tinybrowser-bus/src/snapshot/mod.rs b/crates/tinybrowser-bus/src/snapshot/mod.rs
new file mode 100644
index 0000000..4368955
--- /dev/null
+++ b/crates/tinybrowser-bus/src/snapshot/mod.rs
@@ -0,0 +1,18 @@
+//! The accessibility snapshot: what an agent looks at before it acts.
+//!
+//! A snapshot is the page's accessibility tree rendered as indented text, with a
+//! `@e12` ref on every element an agent could plausibly act on. It is what an
+//! agent should read instead of HTML: it is an order of magnitude smaller, it
+//! already excludes what a screen reader would not announce, and every line it
+//! contains is addressable by [`crate::Target::Ref`].
+//!
+//! The refs belong to the snapshot that produced them. [`Snapshot::sequence`]
+//! records which one that was, so a host holding an old snapshot can tell that
+//! the page has moved on without waiting for an action to fail.
+
+mod types;
+
+pub use types::{ElementRef, Snapshot, SnapshotRequest};
+
+#[cfg(test)]
+mod test;
diff --git a/crates/tinybrowser-bus/src/snapshot/test.rs b/crates/tinybrowser-bus/src/snapshot/test.rs
new file mode 100644
index 0000000..89b2e74
--- /dev/null
+++ b/crates/tinybrowser-bus/src/snapshot/test.rs
@@ -0,0 +1,87 @@
+//! Tests for the snapshot payload types.
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use super::{ElementRef, Snapshot, SnapshotRequest};
+use serde_json::json;
+
+#[test]
+fn snapshot_defaults_to_the_whole_bounded_tree() {
+    let request = SnapshotRequest::default();
+
+    assert!(!request.interactive_only);
+    assert!(request.selector.is_none());
+    assert_eq!(request.max_chars, 200_000);
+    assert_eq!(
+        serde_json::from_value::<SnapshotRequest>(json!({})).expect("deserializes"),
+        request
+    );
+}
+
+#[test]
+fn interactive_keeps_every_other_default() {
+    let request = SnapshotRequest::interactive();
+
+    assert!(request.interactive_only);
+    assert_eq!(request.max_chars, SnapshotRequest::default().max_chars);
+}
+
+#[test]
+fn request_serializes_with_the_documented_field_names() {
+    let encoded = serde_json::to_value(SnapshotRequest::default()).expect("serializes");
+    let mut keys: Vec<&str> = encoded
+        .as_object()
+        .expect("an object")
+        .keys()
+        .map(String::as_str)
+        .collect();
+    keys.sort_unstable();
+
+    assert_eq!(
+        keys,
+        [
+            "compact",
+            "depth",
+            "include_urls",
+            "interactive_only",
+            "max_chars",
+            "selector",
+        ]
+    );
+}
+
+#[test]
+fn snapshot_round_trips() {
+    let snapshot = Snapshot {
+        url: "https://example.com/".to_string(),
+        title: "Example Domain".to_string(),
+        sequence: 1,
+        tree: "- document \"Example Domain\"\n  - link \"More information\" @e1".to_string(),
+        refs: vec![ElementRef {
+            id: "e1".to_string(),
+            role: "link".to_string(),
+            name: "More information".to_string(),
+        }],
+        truncated: false,
+    };
+
+    let encoded = serde_json::to_value(&snapshot).expect("serializes");
+    assert_eq!(encoded["refs"][0]["id"], json!("e1"));
+    assert_eq!(
+        serde_json::from_value::<Snapshot>(encoded).expect("deserializes"),
+        snapshot
+    );
+}
+
+#[test]
+fn refs_are_named_without_their_marker() {
+    // The `@` belongs to the rendered tree, not to the identity: `Target::parse`
+    // strips it, and a ref that carried it would round-trip to `@@e1`.
+    let element = ElementRef {
+        id: "e1".to_string(),
+        role: "link".to_string(),
+        name: "More information".to_string(),
+    };
+
+    assert!(!element.id.starts_with('@'));
+}
diff --git a/crates/tinybrowser-bus/src/snapshot/types.rs b/crates/tinybrowser-bus/src/snapshot/types.rs
new file mode 100644
index 0000000..ce3d964
--- /dev/null
+++ b/crates/tinybrowser-bus/src/snapshot/types.rs
@@ -0,0 +1,94 @@
+//! Payload types for the accessibility snapshot.
+
+use serde::{Deserialize, Serialize};
+
+/// What to include in a snapshot.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct SnapshotRequest {
+    /// Snapshot only the subtree under the first element matching this CSS
+    /// selector.
+    pub selector: Option<String>,
+    /// Keep only elements an agent can act on — links, buttons, fields, and
+    /// their labels — dropping the prose between them. Roughly a tenth the size,
+    /// and the right default for "what can I click here".
+    pub interactive_only: bool,
+    /// Drop the structural scaffolding — generic containers, groups, rows that
+    /// carry no name — collapsing their children into the parent.
+    pub compact: bool,
+    /// Stop descending after this many levels.
+    pub depth: Option<u32>,
+    /// Annotate links with their resolved destination.
+    pub include_urls: bool,
+    /// Truncate the rendered tree to this many characters. Defaults to 200,000.
+    pub max_chars: usize,
+}
+
+impl Default for SnapshotRequest {
+    fn default() -> Self {
+        Self {
+            selector: None,
+            interactive_only: false,
+            compact: false,
+            depth: None,
+            include_urls: false,
+            max_chars: 200_000,
+        }
+    }
+}
+
+impl SnapshotRequest {
+    /// A request for the interactive elements alone.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// # use tinybrowser_bus::SnapshotRequest;
+    /// assert!(SnapshotRequest::interactive().interactive_only);
+    /// ```
+    #[must_use]
+    pub fn interactive() -> Self {
+        Self {
+            interactive_only: true,
+            ..Self::default()
+        }
+    }
+}
+
+/// One addressable element in a snapshot.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ElementRef {
+    /// The ref, without its `@`. Pass it to [`crate::Target::reference`].
+    pub id: String,
+    /// The element's accessibility role.
+    pub role: String,
+    /// Its accessible name, empty when it has none.
+    pub name: String,
+}
+
+/// The rendered accessibility tree of a page.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Snapshot {
+    /// The URL the snapshot was taken at.
+    pub url: String,
+    /// The document title.
+    pub title: String,
+    /// Which generation of refs this snapshot minted.
+    ///
+    /// A ref is only valid for the generation that minted it, and the counter
+    /// moves on for every snapshot *and* every navigation — a navigation
+    /// replaces the document, so the refs naming its nodes are as dead as if a
+    /// new snapshot had replaced them. It is therefore a monotonic counter
+    /// rather than a count of snapshots: the first snapshot after a navigation
+    /// will not be number one.
+    ///
+    /// Reporting it lets a host say "this ref is two generations old" rather
+    /// than discovering it by acting on the wrong element.
+    pub sequence: u64,
+    /// The tree, as indented text with `@ref` markers.
+    pub tree: String,
+    /// Every ref in `tree`, in the order it appears.
+    pub refs: Vec<ElementRef>,
+    /// Whether `max_chars` cut the tree short.
+    pub truncated: bool,
+}
diff --git a/crates/template-bus/src/version/mod.rs b/crates/tinybrowser-bus/src/version/mod.rs
similarity index 96%
rename from crates/template-bus/src/version/mod.rs
rename to crates/tinybrowser-bus/src/version/mod.rs
index ada372d..1773db1 100644
--- a/crates/template-bus/src/version/mod.rs
+++ b/crates/tinybrowser-bus/src/version/mod.rs
@@ -20,7 +20,7 @@ pub const CONTRACT_VERSION: (u32, u32) = (1, 0);
 /// # Examples
 ///
 /// ```
-/// # use template_bus::{is_compatible, CONTRACT_VERSION};
+/// # use tinybrowser_bus::{is_compatible, CONTRACT_VERSION};
 /// assert!(is_compatible(CONTRACT_VERSION));
 /// assert!(is_compatible((1, 4)));
 /// assert!(!is_compatible((2, 0)));
diff --git a/crates/template-bus/src/version/test.rs b/crates/tinybrowser-bus/src/version/test.rs
similarity index 92%
rename from crates/template-bus/src/version/test.rs
rename to crates/tinybrowser-bus/src/version/test.rs
index 3fd3edf..c1652bd 100644
--- a/crates/template-bus/src/version/test.rs
+++ b/crates/tinybrowser-bus/src/version/test.rs
@@ -1,5 +1,7 @@
 //! Unit tests for the contract version and its bind rule.
 
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
 use super::{CONTRACT_VERSION, binds, is_compatible};
 
 #[test]
diff --git a/crates/tinybrowser/Cargo.toml b/crates/tinybrowser/Cargo.toml
new file mode 100644
index 0000000..fc9fc23
--- /dev/null
+++ b/crates/tinybrowser/Cargo.toml
@@ -0,0 +1,73 @@
+[package]
+name = "tinybrowser"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+description = "A Chrome DevTools Protocol browser engine for agents, packaged as an installable TinyBus module."
+documentation = "https://docs.rs/tinybrowser"
+readme = "../../README.md"
+keywords = ["tinybus", "module", "browser", "cdp", "automation"]
+categories = ["web-programming", "development-tools"]
+publish = false
+
+[lib]
+# Keep the ordinary Rust library for tests and downstream reuse while also
+# producing the native module artifact that TinyBus loads at runtime.
+crate-type = ["rlib", "cdylib"]
+
+[dependencies]
+# The wire contract: member names, payload types, and the contract version.
+# Re-exported wholesale from `src/lib.rs` so a consumer takes one dependency
+# rather than two, and so `tinybrowser::Action` and `tinybrowser_bus::Action`
+# are the same type.
+tinybrowser-bus = { workspace = true }
+tinybus = { workspace = true }
+tinybus-module = { workspace = true }
+thiserror = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+# The engine is asynchronous end to end: one CDP socket multiplexes every
+# in-flight command, and sessions outlive the call that created them.
+# `process` and `io-util` launch a browser and read its startup banner; `fs`
+# removes the profile directory a launched browser leaves behind; `sync` holds
+# the session table and the in-flight command map; `net` backs the loopback
+# servers the tests stand up in place of a browser.
+tokio = { workspace = true, features = ["process", "io-util", "fs", "sync", "net"] }
+# The Chrome DevTools Protocol is JSON-RPC over a WebSocket. This is the client
+# half of that socket, with TLS so a remote `wss://` endpoint works unchanged.
+tokio-tungstenite = { version = "0.24", features = ["rustls-tls-webpki-roots"] }
+# `SplitSink`/`StreamExt` over the WebSocket, and nothing else.
+futures-util = { version = "0.3", default-features = false, features = ["sink", "std"] }
+# Chrome publishes its per-target WebSocket URLs over an HTTP endpoint
+# (`/json/version`, `/json/list`); this fetches them. `rustls` rather than
+# native TLS so the module does not link OpenSSL into its host.
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-webpki-roots"] }
+# Screenshots cross the bus as base64 inside a JSON frame, and CDP hands them
+# over base64-encoded already.
+base64 = "0.22"
+# Held screenshot outputs are addressed by an unguessable id.
+uuid = { version = "1", features = ["v4"] }
+# Held outputs are digested so a host can verify what it reassembled.
+sha2 = "0.10"
+# Navigation targets are parsed and normalised before they reach Chrome, and
+# the same parse backs the origin allowlist.
+url = "2"
+
+[dev-dependencies]
+# The GitHub release verifier passes an explicit empty module configuration.
+serde_json = { workspace = true }
+# The live suite reassembles a held screenshot to check it round trips.
+base64 = "0.22"
+# The CDP client's own tests stand up a WebSocket server in place of a browser,
+# which is the only way to exercise what happens when one misbehaves: a protocol
+# error, a command that is never answered, a socket that closes mid-call.
+tokio-tungstenite = { version = "0.24", features = ["rustls-tls-webpki-roots"] }
+futures-util = { version = "0.3", default-features = false, features = ["sink", "std"] }
+
+[features]
+default = []
+
+[lints]
+workspace = true
diff --git a/crates/tinybrowser/examples/basic.rs b/crates/tinybrowser/examples/basic.rs
new file mode 100644
index 0000000..c17b103
--- /dev/null
+++ b/crates/tinybrowser/examples/basic.rs
@@ -0,0 +1,75 @@
+//! Minimal end-to-end usage of the crate.
+//!
+//! Examples are compiled and linted in CI, so they cannot drift from the API.
+//! Run it with:
+//!
+//! ```sh
+//! cargo run -p tinybrowser --example basic
+//! ```
+//!
+//! It drives a real browser when this host has one and can reach the page.
+//! When it cannot — a CI runner with no browser, a container with no egress —
+//! it prints the same error a caller would get and exits successfully, because
+//! both are facts about the machine rather than failures of the example.
+
+use tinybrowser::{
+    Action, Browser, Error, NavigateRequest, ReadRequest, SessionOptions, SnapshotRequest, Target,
+};
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let browser = Browser::new();
+
+    let session = match browser.open_session(SessionOptions::default()).await {
+        Ok(session) => session,
+        Err(error @ Error::BrowserUnavailable { .. }) => {
+            println!("no browser on this host, so there is nothing to drive: {error}");
+            return Ok(());
+        }
+        Err(error) => return Err(error.into()),
+    };
+    println!("opened {} at {}", session.id, session.endpoint);
+
+    let page = match browser
+        .navigate(&session.id, &NavigateRequest::new("https://example.com"))
+        .await
+    {
+        Ok(page) => page,
+        Err(error @ (Error::PageError { .. } | Error::Timeout { .. })) => {
+            println!("cannot reach example.com from this host: {error}");
+            browser.close_session(&session.id).await?;
+            return Ok(());
+        }
+        Err(error) => return Err(error.into()),
+    };
+    println!("{} — {:?}", page.url, page.title);
+
+    // What an agent reads: the accessibility tree, with a ref on everything it
+    // could act on.
+    let snapshot = browser
+        .snapshot(&session.id, &SnapshotRequest::default())
+        .await?;
+    println!("\n{}\n", snapshot.tree);
+
+    // And what it does with one of those refs.
+    if let Some(link) = snapshot.refs.iter().find(|element| element.role == "link") {
+        let outcome = browser
+            .perform(
+                &session.id,
+                &Action::Click {
+                    target: Target::reference(&link.id),
+                    new_tab: false,
+                },
+            )
+            .await?;
+        println!("clicked {:?}, now at {}", link.name, outcome.page.url);
+    }
+
+    let text = browser
+        .read_page(&session.id, &ReadRequest::default())
+        .await?;
+    println!("\n{}", text.content.chars().take(400).collect::<String>());
+
+    browser.close_session(&session.id).await?;
+    Ok(())
+}
diff --git a/crates/tinybrowser/examples/over_the_bus.rs b/crates/tinybrowser/examples/over_the_bus.rs
new file mode 100644
index 0000000..89df28d
--- /dev/null
+++ b/crates/tinybrowser/examples/over_the_bus.rs
@@ -0,0 +1,232 @@
+//! Driving the module the way a host does: over a real `TinyBus`, from a
+//! loaded `cdylib`.
+//!
+//! This is the reference for a host integration. Everything a host has to get
+//! right is here in the order it has to happen: load the artifact, wait for it
+//! to claim its name, check the contract version, open a session, drive it, and
+//! collect a screenshot through the held-output protocol.
+//!
+//! Run it against a module you have built:
+//!
+//! ```sh
+//! cargo build -p tinybrowser --release
+//! cargo run -p tinybrowser --example over_the_bus -- \
+//!   target/release/libtinybrowser.so https://example.com
+//! ```
+//!
+//! Unlike `verify_module`, this one drives a browser, so it needs one on the
+//! host. `verify_module` is the check CI runs; this one is the thing to read.
+
+use std::io;
+use std::path::PathBuf;
+use std::time::Duration;
+
+use tinybrowser::{
+    Action, NavigateRequest, OutputChunk, OutputRef, PageState, ScreenshotRequest, SessionId,
+    SessionInfo, SessionOptions, Snapshot, SnapshotRequest, Target, is_compatible, names,
+};
+use tinybus::broker::Broker;
+use tinybus::module::ModuleHost;
+use tinybus::transport::memory::MemoryBus;
+use tinybus::{Connection, Proxy};
+
+/// How much of a held screenshot to pull per `ReadOutput`.
+///
+/// Well below the bus frame limit with room for the base64 expansion and the
+/// JSON envelope around it.
+const READ_CHUNK: u64 = 1024 * 1024;
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let (module, url) = arguments()?;
+
+    // A private broker with the module attached to it as an ordinary peer. A
+    // host does this once at startup; everything after it is an ordinary call.
+    let bus = MemoryBus::new();
+    let broker = Broker::new();
+    let broker_task = broker.spawn(bus.clone());
+    ModuleHost::new(broker).load_file(&module)?;
+
+    let client = Connection::connect(bus.connect().await?).await?;
+    await_name(&client).await?;
+    let browser = client.proxy(names::INTERFACE, names::OBJECT_PATH, names::INTERFACE)?;
+
+    // Before anything else. A host that discovers an incompatible contract by
+    // making a call cannot tell "this member does not exist" from "this member
+    // failed", and will report the wrong thing either way.
+    let version: (u32, u32) = browser.call(names::methods::CONTRACT_VERSION, ()).await?;
+    if !is_compatible(version) {
+        return Err(io::Error::other(format!(
+            "module serves contract {version:?}, which this host cannot bind to"
+        ))
+        .into());
+    }
+
+    let session: SessionInfo = browser
+        .call(names::methods::OPEN_SESSION, (SessionOptions::default(),))
+        .await?;
+    println!("session {} on {}", session.id, session.endpoint);
+
+    // Everything from here is wrapped so the session is closed even when a step
+    // fails. A leaked session is a browser process nobody will ever end.
+    let outcome = drive(&browser, &session.id, &url).await;
+
+    browser
+        .call::<()>(names::methods::CLOSE_SESSION, (&session.id,))
+        .await?;
+    broker_task.abort();
+    outcome
+}
+
+/// Navigate, snapshot, click the first link, and screenshot the result.
+async fn drive(
+    browser: &Proxy,
+    session: &SessionId,
+    url: &str,
+) -> Result<(), Box<dyn std::error::Error>> {
+    let page: PageState = browser
+        .call(
+            names::methods::NAVIGATE,
+            (session, NavigateRequest::new(url)),
+        )
+        .await?;
+    println!("{} — {} ({:?})", page.url, page.title, page.status);
+
+    let snapshot: Snapshot = browser
+        .call(
+            names::methods::SNAPSHOT,
+            (session, SnapshotRequest::interactive()),
+        )
+        .await?;
+    println!("\nsnapshot {}:\n{}\n", snapshot.sequence, snapshot.tree);
+
+    if let Some(link) = snapshot.refs.iter().find(|element| element.role == "link") {
+        let action = Action::Click {
+            target: Target::reference(&link.id),
+            new_tab: false,
+        };
+        let outcome: tinybrowser::ActionOutcome = browser
+            .call(names::methods::PERFORM, (session, action))
+            .await?;
+        println!("clicked {:?} — now at {}", link.name, outcome.page.url);
+    }
+
+    let image = collect_screenshot(browser, session).await?;
+    println!("screenshot: {} bytes of png", image.len());
+    Ok(())
+}
+
+/// Captures a screenshot and pulls it back through the held-output protocol.
+///
+/// The release is in a `defer`-shaped position on purpose: the module bounds
+/// what it holds and expires it, but leaving an image to time out costs its
+/// budget in the meantime, and the next caller sees a full store rather than a
+/// slot.
+async fn collect_screenshot(
+    browser: &Proxy,
+    session: &SessionId,
+) -> Result<Vec<u8>, Box<dyn std::error::Error>> {
+    let handle: OutputRef = browser
+        .call(
+            names::methods::SCREENSHOT,
+            (session, ScreenshotRequest::default()),
+        )
+        .await?;
+
+    let collected = read_all(browser, &handle).await;
+
+    browser
+        .call::<()>(names::methods::RELEASE_OUTPUT, (&handle.id,))
+        .await?;
+
+    collected
+}
+
+/// Reads a held output to completion.
+async fn read_all(
+    browser: &Proxy,
+    handle: &OutputRef,
+) -> Result<Vec<u8>, Box<dyn std::error::Error>> {
+    use base64::Engine as _;
+
+    // Not `with_capacity(handle.total_bytes)`: the length is a number the module
+    // sent us, and trusting a wrong or enormous one for an allocation turns it
+    // into an abort rather than an error.
+    let mut collected: Vec<u8> = Vec::new();
+    let mut offset = 0;
+
+    loop {
+        let chunk: OutputChunk = browser
+            .call(
+                names::methods::READ_OUTPUT,
+                (&handle.id, offset, READ_CHUNK),
+            )
+            .await?;
+
+        let bytes = base64::engine::general_purpose::STANDARD.decode(&chunk.data)?;
+        offset += bytes.len() as u64;
+        collected.extend_from_slice(&bytes);
+
+        if chunk.eof {
+            break;
+        }
+        if bytes.is_empty() {
+            // A chunk that is neither the end nor any progress would loop
+            // forever. This cannot happen against this module, and a host
+            // should still not take that on trust from a peer.
+            return Err(io::Error::other("output stalled before its end").into());
+        }
+    }
+
+    if collected.len() as u64 != handle.total_bytes {
+        return Err(io::Error::other(format!(
+            "collected {} bytes for an output declared as {}",
+            collected.len(),
+            handle.total_bytes
+        ))
+        .into());
+    }
+
+    Ok(collected)
+}
+
+/// Waits for the module to claim its well-known name.
+///
+/// Loading returns as soon as the library's entry point has run; the name is
+/// claimed a moment later, on the module's own runtime. A host that calls
+/// immediately gets `NameHasNoOwner` for a module that is perfectly healthy.
+async fn await_name(client: &Connection) -> tinybus::Result<()> {
+    tokio::time::timeout(Duration::from_secs(5), async {
+        loop {
+            if client
+                .list_names()
+                .await?
+                .iter()
+                .any(|name| name.as_str() == names::INTERFACE)
+            {
+                return tinybus::Result::Ok(());
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .map_err(|_| tinybus::Error::failed("module did not claim its name within five seconds"))?
+}
+
+/// The module path and the URL to visit.
+fn arguments() -> Result<(PathBuf, String), io::Error> {
+    let mut args = std::env::args_os().skip(1);
+    let module = args.next().map(PathBuf::from).ok_or_else(|| {
+        io::Error::new(
+            io::ErrorKind::InvalidInput,
+            "usage: cargo run --example over_the_bus -- <module-path> [url]",
+        )
+    })?;
+
+    let url = args.next().map_or_else(
+        || "https://example.com".to_string(),
+        |raw| raw.to_string_lossy().into_owned(),
+    );
+
+    Ok((module, url))
+}
diff --git a/crates/template/examples/verify_github_release.rs b/crates/tinybrowser/examples/verify_github_release.rs
similarity index 79%
rename from crates/template/examples/verify_github_release.rs
rename to crates/tinybrowser/examples/verify_github_release.rs
index 9b173fe..1148b31 100644
--- a/crates/template/examples/verify_github_release.rs
+++ b/crates/tinybrowser/examples/verify_github_release.rs
@@ -4,15 +4,15 @@
 //!
 //! ```text
 //! cargo run --example verify_github_release -- \
-//!   https://github.com/tinyhumansai/template/releases/tag/v0.1.4 \
-//!   template-0.1.4-ubuntu-24.04-x86_64.tar.gz \
+//!   https://github.com/tinyhumansai/tinybrowser/releases/tag/v0.1.0 \
+//!   tinybrowser-0.1.0-ubuntu-24.04-x86_64.tar.gz \
 //!   <sha256>
 //! ```
 
 use std::io;
 use std::time::Duration;
 
-use template::{GreetRequest, GreetResponse, names};
+use tinybrowser::{is_compatible, names};
 use tinybus::Connection;
 use tinybus::broker::Broker;
 use tinybus::module::ModuleHost;
@@ -53,14 +53,15 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     })
     .await??;
 
+    // `ContractVersion` rather than a browser operation on purpose: this
+    // verifies that the artifact loads, claims its name, and answers a call.
+    // Launching a browser would make the check depend on what the machine
+    // running it happens to have installed, which is a different question.
     let proxy = client.proxy(names::INTERFACE, names::OBJECT_PATH, names::INTERFACE)?;
-    let reply: GreetResponse = proxy
-        .call(names::methods::GREET, (GreetRequest::new("TinyBus"),))
-        .await?;
-    if reply.greeting != "Hello, TinyBus!" {
+    let version: (u32, u32) = proxy.call(names::methods::CONTRACT_VERSION, ()).await?;
+    if !is_compatible(version) {
         return Err(io::Error::other(format!(
-            "module returned an unexpected greeting: {}",
-            reply.greeting
+            "module serves contract {version:?}, which this build cannot bind to"
         ))
         .into());
     }
diff --git a/crates/template/examples/verify_module.rs b/crates/tinybrowser/examples/verify_module.rs
similarity index 77%
rename from crates/template/examples/verify_module.rs
rename to crates/tinybrowser/examples/verify_module.rs
index 6e3856e..45d6dfa 100644
--- a/crates/template/examples/verify_module.rs
+++ b/crates/tinybrowser/examples/verify_module.rs
@@ -4,7 +4,7 @@ use std::io;
 use std::path::PathBuf;
 use std::time::Duration;
 
-use template::{GreetRequest, GreetResponse, names};
+use tinybrowser::{is_compatible, names};
 use tinybus::Connection;
 use tinybus::broker::Broker;
 use tinybus::module::ModuleHost;
@@ -40,14 +40,15 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     })
     .await??;
 
+    // `ContractVersion` rather than a browser operation on purpose: this
+    // verifies that the artifact loads, claims its name, and answers a call.
+    // Launching a browser would make the check depend on what the machine
+    // running it happens to have installed, which is a different question.
     let proxy = client.proxy(names::INTERFACE, names::OBJECT_PATH, names::INTERFACE)?;
-    let reply: GreetResponse = proxy
-        .call(names::methods::GREET, (GreetRequest::new("TinyBus"),))
-        .await?;
-    if reply.greeting != "Hello, TinyBus!" {
+    let version: (u32, u32) = proxy.call(names::methods::CONTRACT_VERSION, ()).await?;
+    if !is_compatible(version) {
         return Err(io::Error::other(format!(
-            "module returned an unexpected greeting: {}",
-            reply.greeting
+            "module serves contract {version:?}, which this build cannot bind to"
         ))
         .into());
     }
diff --git a/crates/tinybrowser/src/capture/mod.rs b/crates/tinybrowser/src/capture/mod.rs
new file mode 100644
index 0000000..ea6232c
--- /dev/null
+++ b/crates/tinybrowser/src/capture/mod.rs
@@ -0,0 +1,181 @@
+//! Screenshots.
+//!
+//! # Layout
+//!
+//! - [`store`] — the held outputs a screenshot is collected from.
+
+pub(crate) mod store;
+
+use base64::Engine as _;
+use base64::engine::general_purpose::STANDARD as BASE64;
+use serde_json::{Value, json};
+use tinybrowser_bus::{ImageFormat, OutputRef, ScreenshotRequest};
+
+use crate::error::{Error, Result};
+use crate::session::Session;
+
+use store::OutputStore;
+
+/// Captures a screenshot and holds it for collection.
+///
+/// # Errors
+///
+/// [`Error::InvalidInput`] for a quality outside 1–100,
+/// [`Error::NoSuchElement`] when an element target does not resolve,
+/// [`Error::PageError`] when the browser cannot capture, and
+/// [`Error::LimitExceeded`] when the image is larger than the module will hold.
+pub(crate) async fn screenshot(
+    session: &Session,
+    request: &ScreenshotRequest,
+    store: &tokio::sync::Mutex<OutputStore>,
+) -> Result<OutputRef> {
+    if let Some(quality) = request.quality
+        && !(1..=100).contains(&quality)
+    {
+        return Err(Error::invalid_input(format!(
+            "quality {quality} is outside 1-100"
+        )));
+    }
+
+    let format = match request.format {
+        ImageFormat::Png => "png",
+        ImageFormat::Jpeg => "jpeg",
+        ImageFormat::Webp => "webp",
+    };
+
+    let mut params = json!({
+        "format": format,
+        // Chrome composites the page as it is *now* by default, which for a page
+        // that is still painting means a screenshot of a half-drawn page. This
+        // asks it to wait for the next frame.
+        "fromSurface": true,
+        "captureBeyondViewport": request.full_page,
+    });
+
+    if request.format != ImageFormat::Png {
+        // Quality is meaningless for a lossless format, and Chrome rejects it.
+        params["quality"] = json!(request.quality.unwrap_or(80));
+    }
+
+    let (width, height) = match &request.target {
+        Some(target) => {
+            let node = super::interact::resolve::resolve(session, target).await?;
+            let clip = element_clip(session, node).await?;
+            let size = (
+                clip.get("width").and_then(Value::as_f64).unwrap_or(0.0),
+                clip.get("height").and_then(Value::as_f64).unwrap_or(0.0),
+            );
+            params["clip"] = clip;
+            size
+        }
+        None if request.full_page => {
+            let clip = document_clip(session).await?;
+            let size = (
+                clip.get("width").and_then(Value::as_f64).unwrap_or(0.0),
+                clip.get("height").and_then(Value::as_f64).unwrap_or(0.0),
+            );
+            params["clip"] = clip;
+            size
+        }
+        None => {
+            let viewport = session.options().viewport;
+            (f64::from(viewport.width), f64::from(viewport.height))
+        }
+    };
+
+    let captured = session
+        .send_with_timeout("Page.captureScreenshot", params, session.deadline(None))
+        .await?;
+
+    let encoded = captured
+        .get("data")
+        .and_then(Value::as_str)
+        .ok_or_else(|| Error::page("browser captured no image data".to_string()))?;
+
+    let bytes = BASE64
+        .decode(encoded)
+        .map_err(|error| Error::page(format!("screenshot was not valid base64: {error}")))?;
+
+    store.lock().await.insert(
+        bytes,
+        request.format.media_type(),
+        pixels(width),
+        pixels(height),
+    )
+}
+
+/// A CSS dimension as a whole number of pixels.
+///
+/// Rounded up, because a fractional CSS pixel still occupies a whole device one
+/// and truncating reports an image a pixel narrower than it is. Saturating
+/// rather than cast, because `as` on a negative or enormous float is a silently
+/// wrong number, and both are values a page can produce.
+fn pixels(dimension: f64) -> u32 {
+    let rounded = dimension.ceil();
+    if rounded.is_nan() || rounded <= 0.0 {
+        return 0;
+    }
+    if rounded >= f64::from(u32::MAX) {
+        return u32::MAX;
+    }
+    // Bounded above and below by the two branches above.
+    #[allow(
+        clippy::cast_possible_truncation,
+        clippy::cast_sign_loss,
+        reason = "the value is checked to be within u32 immediately above"
+    )]
+    {
+        rounded as u32
+    }
+}
+
+/// The clip rectangle covering one element.
+async fn element_clip(session: &Session, node: i64) -> Result<Value> {
+    let model = session
+        .send("DOM.getBoxModel", json!({ "backendNodeId": node }))
+        .await
+        .map_err(|_| Error::not_actionable("element has no box to capture".to_string()))?;
+
+    // `border` is a flat array of four corners: x1,y1,x2,y2,x3,y3,x4,y4.
+    let border = model
+        .get("model")
+        .and_then(|model| model.get("border"))
+        .and_then(Value::as_array)
+        .ok_or_else(|| Error::not_actionable("element has no box to capture".to_string()))?;
+
+    let coordinate = |index: usize| border.get(index).and_then(Value::as_f64).unwrap_or(0.0);
+    let (left, top) = (coordinate(0), coordinate(1));
+    let (right, bottom) = (coordinate(4), coordinate(5));
+
+    Ok(json!({
+        "x": left,
+        "y": top,
+        "width": (right - left).max(1.0),
+        "height": (bottom - top).max(1.0),
+        "scale": 1,
+    }))
+}
+
+/// The clip rectangle covering the whole scrollable document.
+async fn document_clip(session: &Session) -> Result<Value> {
+    let metrics = session.send("Page.getLayoutMetrics", json!({})).await?;
+
+    // `cssContentSize` is the document in CSS pixels, which is what a clip is
+    // measured in. The older `contentSize` is in device pixels and produces a
+    // capture scaled by the device pixel ratio on any non-1x viewport.
+    let content = metrics
+        .get("cssContentSize")
+        .or_else(|| metrics.get("contentSize"))
+        .ok_or_else(|| Error::page("browser reported no layout metrics".to_string()))?;
+
+    Ok(json!({
+        "x": 0,
+        "y": 0,
+        "width": content.get("width").and_then(Value::as_f64).unwrap_or(0.0),
+        "height": content.get("height").and_then(Value::as_f64).unwrap_or(0.0),
+        "scale": 1,
+    }))
+}
+
+#[cfg(test)]
+mod test;
diff --git a/crates/tinybrowser/src/capture/store.rs b/crates/tinybrowser/src/capture/store.rs
new file mode 100644
index 0000000..d11c2cd
--- /dev/null
+++ b/crates/tinybrowser/src/capture/store.rs
@@ -0,0 +1,181 @@
+//! The held outputs, and the bounds on them.
+//!
+//! # What this is defending against
+//!
+//! An output is a screenshot sitting in the module's memory waiting to be
+//! collected, and the module is loaded into somebody else's process. Three
+//! things can go wrong there, and all three are ordinary rather than hostile: a
+//! host takes a screenshot and never reads it, a host takes hundreds in a loop,
+//! or one screenshot of a very long page is larger than anybody expected.
+//!
+//! So the store caps the number of live outputs, caps the size of each, and
+//! expires anything left uncollected. Eviction is oldest-first, which is the
+//! right order when the alternative is refusing the newest: the screenshot just
+//! taken is the one a caller is about to read.
+
+use std::collections::HashMap;
+use std::time::{Duration, Instant};
+
+use base64::Engine as _;
+use base64::engine::general_purpose::STANDARD as BASE64;
+use sha2::{Digest, Sha256};
+use tinybrowser_bus::{OutputChunk, OutputId, OutputRef};
+
+use crate::error::{Error, Result};
+
+/// How many outputs may be held at once.
+const MAX_OUTPUTS: usize = 16;
+
+/// The largest single output this module will hold.
+///
+/// A full-page capture of a long article at 2x lands in the low megabytes; this
+/// is several times that and still far below what would matter to a host.
+const MAX_OUTPUT_BYTES: usize = 64 * 1024 * 1024;
+
+/// How long an uncollected output survives.
+const TTL: Duration = Duration::from_secs(300);
+
+/// The most a single [`read`](OutputStore::read) will return.
+///
+/// Below the bus frame limit with room for the base64 expansion — four bytes out
+/// for every three in — and the JSON envelope around it.
+const MAX_CHUNK: u64 = 4 * 1024 * 1024;
+
+/// One held output.
+///
+/// Only the bytes and when they arrived: the size, digest, and dimensions went
+/// out on the [`OutputRef`] when the output was stored, and keeping a second
+/// copy here would be two places for them to disagree.
+#[derive(Debug)]
+struct Held {
+    bytes: Vec<u8>,
+    stored: Instant,
+}
+
+/// Outputs waiting to be collected.
+#[derive(Debug, Default)]
+pub(crate) struct OutputStore {
+    held: HashMap<OutputId, Held>,
+}
+
+impl OutputStore {
+    /// Holds `bytes` and returns the handle a host collects them with.
+    ///
+    /// # Errors
+    ///
+    /// [`Error::LimitExceeded`] when the output is larger than this module will
+    /// hold.
+    pub(crate) fn insert(
+        &mut self,
+        bytes: Vec<u8>,
+        media_type: &str,
+        width: u32,
+        height: u32,
+    ) -> Result<OutputRef> {
+        if bytes.len() > MAX_OUTPUT_BYTES {
+            return Err(Error::LimitExceeded {
+                message: format!(
+                    "output of {} bytes exceeds the {MAX_OUTPUT_BYTES} byte cap",
+                    bytes.len()
+                ),
+            });
+        }
+
+        self.expire();
+        while self.held.len() >= MAX_OUTPUTS {
+            let Some(oldest) = self
+                .held
+                .iter()
+                .min_by_key(|(_, held)| held.stored)
+                .map(|(id, _)| id.clone())
+            else {
+                break;
+            };
+            self.held.remove(&oldest);
+        }
+
+        let sha256 = format!("{:x}", Sha256::digest(&bytes));
+        let id = OutputId::new(uuid::Uuid::new_v4().to_string());
+        let handle = OutputRef {
+            id: id.clone(),
+            total_bytes: bytes.len() as u64,
+            sha256: sha256.clone(),
+            media_type: media_type.to_string(),
+            width,
+            height,
+        };
+
+        self.held.insert(
+            id,
+            Held {
+                bytes,
+                stored: Instant::now(),
+            },
+        );
+
+        Ok(handle)
+    }
+
+    /// Reads up to `len` bytes of `id` from `offset`.
+    ///
+    /// # Errors
+    ///
+    /// [`Error::NoSuchOutput`] when the output is unknown or has expired, and
+    /// [`Error::InvalidInput`] when `offset` is past its end.
+    pub(crate) fn read(&mut self, id: &OutputId, offset: u64, len: u64) -> Result<OutputChunk> {
+        self.expire();
+
+        let held = self
+            .held
+            .get(id)
+            .ok_or_else(|| Error::NoSuchOutput { id: id.to_string() })?;
+
+        let total = held.bytes.len() as u64;
+        if offset > total {
+            return Err(Error::invalid_input(format!(
+                "offset {offset} is past the end of a {total} byte output"
+            )));
+        }
+
+        let start = usize::try_from(offset)
+            .unwrap_or(usize::MAX)
+            .min(held.bytes.len());
+        let take = usize::try_from(len.clamp(1, MAX_CHUNK)).unwrap_or(0);
+        let end = start.saturating_add(take).min(held.bytes.len());
+
+        Ok(OutputChunk {
+            id: id.clone(),
+            offset,
+            data: BASE64.encode(&held.bytes[start..end]),
+            eof: end >= held.bytes.len(),
+        })
+    }
+
+    /// Drops `id`, whether or not it was there.
+    ///
+    /// Releasing something already gone is the outcome being asked for, so this
+    /// cannot fail: a host retrying a release must not have to tell "never
+    /// existed" apart from "already cleaned up".
+    pub(crate) fn release(&mut self, id: &OutputId) {
+        self.held.remove(id);
+    }
+
+    /// Whether an output is still held.
+    #[cfg(test)]
+    pub(crate) fn holds(&self, id: &OutputId) -> bool {
+        self.held.contains_key(id)
+    }
+
+    /// How many outputs are held.
+    #[cfg(test)]
+    pub(crate) fn len(&self) -> usize {
+        self.held.len()
+    }
+
+    /// Drops everything past its time to live.
+    fn expire(&mut self) {
+        let now = Instant::now();
+        self.held
+            .retain(|_, held| now.duration_since(held.stored) < TTL);
+    }
+}
diff --git a/crates/tinybrowser/src/capture/test.rs b/crates/tinybrowser/src/capture/test.rs
new file mode 100644
index 0000000..d72b8c9
--- /dev/null
+++ b/crates/tinybrowser/src/capture/test.rs
@@ -0,0 +1,184 @@
+//! Tests for the held-output store.
+//!
+//! The store is where a screenshot waits, and every bound on it is a bound on
+//! memory inside somebody else's process. These fix the chunking arithmetic —
+//! which is where an off-by-one turns into a corrupted image a host cannot tell
+//! from a good one — and the eviction rules.
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use base64::Engine as _;
+use base64::engine::general_purpose::STANDARD as BASE64;
+use tinybrowser_bus::OutputId;
+
+use super::store::OutputStore;
+use crate::error::Error;
+
+fn store_with(bytes: Vec<u8>) -> (OutputStore, OutputId) {
+    let mut store = OutputStore::default();
+    let handle = store
+        .insert(bytes, "image/png", 1280, 800)
+        .expect("within the cap");
+    let id = handle.id.clone();
+    (store, id)
+}
+
+#[test]
+fn a_stored_output_reports_its_size_and_digest() {
+    let mut store = OutputStore::default();
+    let handle = store
+        .insert(b"hello".to_vec(), "image/png", 100, 50)
+        .expect("within the cap");
+
+    assert_eq!(handle.total_bytes, 5);
+    assert_eq!(handle.media_type, "image/png");
+    assert_eq!((handle.width, handle.height), (100, 50));
+    // The digest is what lets a host verify what it reassembled.
+    assert_eq!(
+        handle.sha256,
+        "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+    );
+}
+
+#[test]
+fn every_output_gets_a_distinct_identity() {
+    let mut store = OutputStore::default();
+    let first = store
+        .insert(b"a".to_vec(), "image/png", 1, 1)
+        .expect("stored");
+    let second = store
+        .insert(b"a".to_vec(), "image/png", 1, 1)
+        .expect("stored");
+
+    assert_ne!(first.id, second.id);
+}
+
+#[test]
+fn a_whole_small_output_comes_back_in_one_chunk() {
+    let (mut store, id) = store_with(b"hello".to_vec());
+    let chunk = store.read(&id, 0, 1024).expect("reads");
+
+    assert_eq!(BASE64.decode(&chunk.data).expect("base64"), b"hello");
+    assert!(chunk.eof);
+    assert_eq!(chunk.offset, 0);
+}
+
+#[test]
+fn reads_reassemble_into_the_original_bytes() {
+    let bytes: Vec<u8> = (0..=255u8).cycle().take(5_000).collect();
+    let (mut store, id) = store_with(bytes.clone());
+
+    let mut collected = Vec::new();
+    let mut offset = 0;
+    loop {
+        let chunk = store.read(&id, offset, 1_000).expect("reads");
+        let decoded = BASE64.decode(&chunk.data).expect("base64");
+        collected.extend_from_slice(&decoded);
+        offset += decoded.len() as u64;
+        if chunk.eof {
+            break;
+        }
+    }
+
+    assert_eq!(collected, bytes);
+}
+
+#[test]
+fn the_last_chunk_is_short_rather_than_padded() {
+    let (mut store, id) = store_with(vec![7; 10]);
+    let chunk = store.read(&id, 8, 1_000).expect("reads");
+
+    assert_eq!(BASE64.decode(&chunk.data).expect("base64").len(), 2);
+    assert!(chunk.eof);
+}
+
+#[test]
+fn a_read_at_the_exact_end_is_an_empty_final_chunk() {
+    // Not an error: a host that read up to `total_bytes` and asks once more is
+    // behaving correctly, and failing it would make the natural loop wrong.
+    let (mut store, id) = store_with(vec![7; 10]);
+    let chunk = store.read(&id, 10, 1_000).expect("reads");
+
+    assert!(BASE64.decode(&chunk.data).expect("base64").is_empty());
+    assert!(chunk.eof);
+}
+
+#[test]
+fn a_read_past_the_end_is_refused() {
+    let (mut store, id) = store_with(vec![7; 10]);
+    let error = store.read(&id, 11, 1_000).expect_err("refused");
+
+    assert!(matches!(error, Error::InvalidInput { .. }), "{error}");
+}
+
+#[test]
+fn a_zero_length_read_still_makes_progress() {
+    // Clamped to at least one byte: a host that passes zero would otherwise loop
+    // forever reading nothing and never reaching eof.
+    let (mut store, id) = store_with(vec![7; 10]);
+    let chunk = store.read(&id, 0, 0).expect("reads");
+
+    assert_eq!(BASE64.decode(&chunk.data).expect("base64").len(), 1);
+    assert!(!chunk.eof);
+}
+
+#[test]
+fn an_unknown_output_is_reported_as_such() {
+    let mut store = OutputStore::default();
+    let error = store
+        .read(&OutputId::new("nope"), 0, 10)
+        .expect_err("refused");
+
+    assert!(matches!(error, Error::NoSuchOutput { .. }), "{error}");
+}
+
+#[test]
+fn releasing_removes_it() {
+    let (mut store, id) = store_with(b"hello".to_vec());
+    store.release(&id);
+
+    assert_eq!(store.len(), 0);
+    assert!(!store.holds(&id));
+    assert!(store.read(&id, 0, 10).is_err());
+}
+
+#[test]
+fn releasing_something_already_gone_succeeds() {
+    // A host retrying a release must not have to tell "never existed" apart from
+    // "already cleaned up".
+    let mut store = OutputStore::default();
+    store.release(&OutputId::new("never-existed"));
+
+    assert_eq!(store.len(), 0);
+}
+
+#[test]
+fn the_store_evicts_the_oldest_rather_than_refusing_the_newest() {
+    // The screenshot just taken is the one a caller is about to read.
+    let mut store = OutputStore::default();
+    let first = store
+        .insert(b"first".to_vec(), "image/png", 1, 1)
+        .expect("stored");
+
+    let mut newest = first.clone();
+    for index in 0..32 {
+        newest = store
+            .insert(vec![index], "image/png", 1, 1)
+            .expect("stored");
+    }
+
+    assert!(store.len() <= 16);
+    assert!(!store.holds(&first.id), "the oldest survived");
+    assert!(store.holds(&newest.id), "the newest was evicted");
+}
+
+#[test]
+fn an_output_larger_than_the_cap_is_refused_rather_than_held() {
+    let mut store = OutputStore::default();
+    let error = store
+        .insert(vec![0; 64 * 1024 * 1024 + 1], "image/png", 1, 1)
+        .expect_err("refused");
+
+    assert!(matches!(error, Error::LimitExceeded { .. }), "{error}");
+    assert_eq!(store.len(), 0);
+}
diff --git a/crates/tinybrowser/src/cdp/client.rs b/crates/tinybrowser/src/cdp/client.rs
new file mode 100644
index 0000000..ba91123
--- /dev/null
+++ b/crates/tinybrowser/src/cdp/client.rs
@@ -0,0 +1,316 @@
+//! One WebSocket to a browser, shared by everything driving it.
+//!
+//! # The shape of the thing
+//!
+//! CDP is JSON-RPC with events: a command carries an `id` and comes back with
+//! that `id`, and anything without one is an event. So the client is a reader
+//! task plus two maps' worth of state — a table of in-flight commands keyed by
+//! id, and a broadcast channel for events — and [`CdpClient::send`] is a
+//! oneshot parked in the first table.
+//!
+//! That arrangement is what makes the socket shareable. Sessions, snapshots and
+//! screenshots all issue commands concurrently against one `Arc<CdpClient>`
+//! without a lock held across any await, because nothing waits on the socket —
+//! it waits on its own oneshot.
+//!
+//! # Flat sessions
+//!
+//! Every command may carry a `sessionId`. Attaching to a page target with
+//! `flatten: true` gets one, and from then on a command addressed to that id
+//! runs in that page while the same socket still reaches the browser itself.
+//! One connection, every target: no second socket per tab, and no reconnect
+//! when a tab goes away.
+
+use std::collections::HashMap;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::time::Duration;
+
+use futures_util::{SinkExt, StreamExt};
+use serde_json::{Value, json};
+use tokio::sync::{Mutex, broadcast, oneshot};
+use tokio_tungstenite::tungstenite::Message;
+use tokio_tungstenite::tungstenite::protocol::WebSocketConfig;
+
+use crate::error::{Error, Result};
+
+/// How many events to buffer for a subscriber that is not reading fast enough.
+///
+/// A busy page emits thousands of network and lifecycle events. A subscriber
+/// that falls this far behind is told it lagged rather than being allowed to
+/// hold the reader task hostage.
+const EVENT_BUFFER: usize = 2_048;
+
+/// How often to ping the socket.
+///
+/// A CDP socket carrying an idle page sends nothing for minutes at a time, and
+/// an intermediary between this module and a remote browser will happily reap
+/// what looks like a dead connection.
+const KEEPALIVE: Duration = Duration::from_secs(30);
+
+/// A CDP event: something the browser said without being asked.
+#[derive(Debug, Clone)]
+pub(crate) struct CdpEvent {
+    /// The event name, such as `Page.loadEventFired`.
+    pub(crate) method: String,
+    /// Its parameters.
+    pub(crate) params: Value,
+    /// The page session it belongs to, absent for browser-level events.
+    pub(crate) session_id: Option<String>,
+}
+
+type Pending = Arc<Mutex<HashMap<u64, oneshot::Sender<CommandReply>>>>;
+
+/// What came back for one command.
+#[derive(Debug)]
+struct CommandReply {
+    result: Option<Value>,
+    error: Option<Value>,
+}
+
+/// A connected CDP socket.
+#[derive(Debug)]
+pub(crate) struct CdpClient {
+    sink: Mutex<Sink>,
+    next_id: AtomicU64,
+    pending: Pending,
+    events: broadcast::Sender<CdpEvent>,
+    reader: tokio::task::JoinHandle<()>,
+    /// Set once, immediately after construction.
+    ///
+    /// The keepalive task holds a `Weak` back to this client so that pinging
+    /// does not keep the socket alive forever, which means the client must
+    /// exist before the task can be spawned. A `OnceLock` is what lets the
+    /// field be filled afterwards without an `Arc::try_unwrap` that would
+    /// invalidate the very `Weak` the task depends on.
+    keepalive: std::sync::OnceLock<tokio::task::JoinHandle<()>>,
+}
+
+type Socket =
+    tokio_tungstenite::WebSocketStream<tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>>;
+type Sink = futures_util::stream::SplitSink<Socket, Message>;
+
+impl Drop for CdpClient {
+    fn drop(&mut self) {
+        // The reader owns the read half of the socket and the keepalive owns a
+        // timer; neither ends on its own when the last handle goes away.
+        self.reader.abort();
+        if let Some(keepalive) = self.keepalive.get() {
+            keepalive.abort();
+        }
+    }
+}
+
+/// Removes an in-flight command if the caller's future is dropped.
+///
+/// A `send` cancelled by an outer deadline would otherwise leave its entry in
+/// the table until the socket closes — one leaked oneshot per timed-out
+/// command, on exactly the pages where commands time out most.
+struct PendingGuard {
+    pending: Pending,
+    id: u64,
+    armed: bool,
+}
+
+impl Drop for PendingGuard {
+    fn drop(&mut self) {
+        if !self.armed {
+            return;
+        }
+        let pending = Arc::clone(&self.pending);
+        let id = self.id;
+        if let Ok(handle) = tokio::runtime::Handle::try_current() {
+            handle.spawn(async move {
+                pending.lock().await.remove(&id);
+            });
+        }
+    }
+}
+
+impl CdpClient {
+    /// Connects to the browser at `url`.
+    ///
+    /// # Errors
+    ///
+    /// [`Error::BrowserUnavailable`] when the socket cannot be opened.
+    pub(crate) async fn connect(url: &str) -> Result<Arc<Self>> {
+        let config = WebSocketConfig {
+            // A full-page screenshot arrives base64-encoded in a single CDP
+            // frame and routinely exceeds tungstenite's 16 MiB default. The
+            // module bounds the image itself; bounding it again here would only
+            // turn a large screenshot into a closed socket.
+            max_message_size: None,
+            max_frame_size: None,
+            ..Default::default()
+        };
+
+        let (socket, _) = tokio_tungstenite::connect_async_with_config(url, Some(config), false)
+            .await
+            .map_err(|error| {
+                Error::browser_unavailable(format!("cdp connect to {url} failed: {error}"))
+            })?;
+
+        let (sink, mut stream) = socket.split();
+        let pending: Pending = Arc::new(Mutex::new(HashMap::new()));
+        let (events, _) = broadcast::channel(EVENT_BUFFER);
+
+        let reader_pending = Arc::clone(&pending);
+        let reader_events = events.clone();
+        let (closed_tx, mut closed_rx) = tokio::sync::watch::channel(false);
+
+        let reader = tokio::spawn(async move {
+            while let Some(message) = stream.next().await {
+                let text = match message {
+                    Ok(Message::Text(text)) => text,
+                    // A CDP proxy in front of a remote browser may frame its
+                    // replies as binary; the payload is the same JSON.
+                    Ok(Message::Binary(bytes)) => match String::from_utf8(bytes) {
+                        Ok(text) => text,
+                        Err(_) => continue,
+                    },
+                    Ok(Message::Close(_)) | Err(_) => break,
+                    Ok(_) => continue,
+                };
+
+                let Ok(message) = serde_json::from_str::<Value>(&text) else {
+                    continue;
+                };
+
+                if let Some(id) = message.get("id").and_then(Value::as_u64) {
+                    if let Some(sender) = reader_pending.lock().await.remove(&id) {
+                        let _ = sender.send(CommandReply {
+                            result: message.get("result").cloned(),
+                            error: message.get("error").cloned(),
+                        });
+                    }
+                } else if let Some(method) = message.get("method").and_then(Value::as_str) {
+                    let _ = reader_events.send(CdpEvent {
+                        method: method.to_string(),
+                        params: message.get("params").cloned().unwrap_or(Value::Null),
+                        session_id: message
+                            .get("sessionId")
+                            .and_then(Value::as_str)
+                            .map(str::to_string),
+                    });
+                }
+            }
+
+            // The socket is gone. Dropping every pending sender fails the
+            // commands waiting on it immediately, rather than making each one
+            // sit out its own deadline against a connection that will never
+            // answer.
+            reader_pending.lock().await.clear();
+            let _ = closed_tx.send(true);
+        });
+
+        let client = Arc::new(Self {
+            sink: Mutex::new(sink),
+            next_id: AtomicU64::new(1),
+            pending,
+            events,
+            reader,
+            keepalive: std::sync::OnceLock::new(),
+        });
+
+        let pinger = Arc::downgrade(&client);
+        let keepalive = tokio::spawn(async move {
+            let mut ticker = tokio::time::interval(KEEPALIVE);
+            ticker.tick().await;
+            loop {
+                tokio::select! {
+                    _ = ticker.tick() => {
+                        // A weak handle on purpose: a strong one would keep the
+                        // client — and so the socket — alive for as long as this
+                        // task runs, which is forever.
+                        let Some(client) = pinger.upgrade() else { break };
+                        if client.sink.lock().await.send(Message::Ping(Vec::new())).await.is_err() {
+                            break;
+                        }
+                    }
+                    _ = closed_rx.changed() => break,
+                }
+            }
+        });
+
+        // Set, never replaced: `connect` is the only writer and it runs before
+        // any other reference to this client exists.
+        let _ = client.keepalive.set(keepalive);
+        Ok(client)
+    }
+
+    /// Sends `method` with `params` and waits for its reply.
+    ///
+    /// `session_id` addresses a page attached with `flatten: true`; `None`
+    /// addresses the browser itself.
+    ///
+    /// # Errors
+    ///
+    /// [`Error::ConnectionLost`] when the socket is gone, [`Error::Timeout`]
+    /// when the browser does not answer in time, and [`Error::PageError`] when
+    /// it answers with a protocol error.
+    pub(crate) async fn send(
+        &self,
+        method: &str,
+        params: Value,
+        session_id: Option<&str>,
+        timeout: Duration,
+    ) -> Result<Value> {
+        let id = self.next_id.fetch_add(1, Ordering::Relaxed);
+        let (sender, receiver) = oneshot::channel();
+
+        let mut message = json!({ "id": id, "method": method, "params": params });
+        if let Some(session) = session_id {
+            message["sessionId"] = json!(session);
+        }
+
+        self.pending.lock().await.insert(id, sender);
+        let mut guard = PendingGuard {
+            pending: Arc::clone(&self.pending),
+            id,
+            armed: true,
+        };
+
+        self.sink
+            .lock()
+            .await
+            .send(Message::Text(message.to_string()))
+            .await
+            .map_err(|error| Error::connection_lost(format!("sending {method}: {error}")))?;
+
+        let reply = match tokio::time::timeout(timeout, receiver).await {
+            Ok(Ok(reply)) => {
+                guard.armed = false;
+                reply
+            }
+            // The sender was dropped: the reader loop cleared the table because
+            // the socket closed.
+            Ok(Err(_)) => {
+                guard.armed = false;
+                return Err(Error::connection_lost(format!(
+                    "browser closed the connection during {method}"
+                )));
+            }
+            Err(_) => {
+                return Err(Error::timeout(
+                    method.to_string(),
+                    u64::try_from(timeout.as_millis()).unwrap_or(u64::MAX),
+                ));
+            }
+        };
+
+        if let Some(error) = reply.error {
+            let message = error
+                .get("message")
+                .and_then(Value::as_str)
+                .unwrap_or("unknown protocol error");
+            return Err(Error::page(format!("{method}: {message}")));
+        }
+
+        Ok(reply.result.unwrap_or(Value::Null))
+    }
+
+    /// Subscribes to every event the browser emits from now on.
+    pub(crate) fn events(&self) -> broadcast::Receiver<CdpEvent> {
+        self.events.subscribe()
+    }
+}
diff --git a/crates/tinybrowser/src/cdp/endpoint.rs b/crates/tinybrowser/src/cdp/endpoint.rs
new file mode 100644
index 0000000..c2f3465
--- /dev/null
+++ b/crates/tinybrowser/src/cdp/endpoint.rs
@@ -0,0 +1,74 @@
+//! Turning what a host configured into a browser socket URL.
+//!
+//! A host may hand over either form of endpoint, and both are reasonable things
+//! to have: an operator knows `http://127.0.0.1:9222`, because that is the flag
+//! Chrome was started with, while an orchestrator that already asked the browser
+//! about itself holds the `ws://…/devtools/browser/<id>` URL. This module
+//! accepts both and returns the second.
+
+use std::time::Duration;
+
+use serde::Deserialize;
+
+use crate::error::{Error, Result};
+
+/// How long to wait for the browser's HTTP endpoint to answer.
+///
+/// This is a request to a socket on the same host — or to a container next
+/// door — that answers from memory. Anything slower than this is not slow, it
+/// is broken.
+const DISCOVERY_TIMEOUT: Duration = Duration::from_secs(10);
+
+/// What `/json/version` reports.
+#[derive(Debug, Deserialize)]
+struct BrowserVersion {
+    #[serde(rename = "webSocketDebuggerUrl")]
+    websocket_url: Option<String>,
+}
+
+/// Resolves `endpoint` to a browser WebSocket URL.
+///
+/// A `ws://` or `wss://` endpoint is already one and is returned unchanged. An
+/// `http://` or `https://` endpoint is asked for its `/json/version`.
+///
+/// # Errors
+///
+/// [`Error::InvalidInput`] when `endpoint` carries a scheme this cannot use,
+/// and [`Error::BrowserUnavailable`] when the browser does not answer or
+/// answers without a debugger URL.
+pub(crate) async fn resolve(endpoint: &str) -> Result<String> {
+    let endpoint = endpoint.trim().trim_end_matches('/');
+
+    if endpoint.starts_with("ws://") || endpoint.starts_with("wss://") {
+        return Ok(endpoint.to_string());
+    }
+
+    if !endpoint.starts_with("http://") && !endpoint.starts_with("https://") {
+        return Err(Error::invalid_input(format!(
+            "endpoint {endpoint} must be an http(s) devtools address or a ws(s) browser socket"
+        )));
+    }
+
+    let client = reqwest::Client::builder()
+        .timeout(DISCOVERY_TIMEOUT)
+        .build()
+        .map_err(|error| Error::browser_unavailable(format!("http client: {error}")))?;
+
+    let version: BrowserVersion = client
+        .get(format!("{endpoint}/json/version"))
+        .send()
+        .await
+        .map_err(|error| Error::browser_unavailable(format!("{endpoint}/json/version: {error}")))?
+        .json()
+        .await
+        .map_err(|error| {
+            Error::browser_unavailable(format!("{endpoint}/json/version returned: {error}"))
+        })?;
+
+    version.websocket_url.ok_or_else(|| {
+        Error::browser_unavailable(format!(
+            "{endpoint} answered without a webSocketDebuggerUrl; it is reachable but not a \
+             devtools endpoint"
+        ))
+    })
+}
diff --git a/crates/tinybrowser/src/cdp/launch.rs b/crates/tinybrowser/src/cdp/launch.rs
new file mode 100644
index 0000000..e8097dc
--- /dev/null
+++ b/crates/tinybrowser/src/cdp/launch.rs
@@ -0,0 +1,400 @@
+//! Finding a Chrome on this host, and starting one.
+//!
+//! # Why the module launches at all
+//!
+//! A host that already runs a browser should point the module at it with
+//! [`tinybrowser_bus::SessionOptions::endpoint`] — that is the better
+//! arrangement, and it is the one a sandbox or a container deployment will use.
+//! Launching exists for the ordinary case where nobody has arranged anything and
+//! an agent needs a browser now.
+//!
+//! # Discovery is a fixed list, not a search
+//!
+//! [`find_executable`] checks an environment override, then a short list of
+//! conventional paths. It does not scan, and it does not consult a package
+//! manager. A module that goes looking for executables to run is a module whose
+//! behaviour depends on what else is installed on the host, and the failure mode
+//! of guessing wrong — launching some unrelated binary that happens to sit at a
+//! plausible path — is worse than reporting that no browser was found.
+
+use std::path::PathBuf;
+use std::process::Stdio;
+use std::time::Duration;
+
+use tokio::io::{AsyncBufReadExt, BufReader};
+use tokio::process::{Child, Command};
+
+use crate::error::{Error, Result};
+
+/// Environment variable supplying extra launch flags for every session.
+///
+/// Whitespace-separated, appended after the session's own
+/// [`tinybrowser_bus::SessionOptions::args`]. It exists because the flags a
+/// browser needs are usually a property of the *host*, not of the caller: a
+/// container without the right capabilities needs `--no-sandbox` for every
+/// session anybody opens, and plumbing that through a host's configuration into
+/// every call site is a lot of machinery to say one thing about the machine.
+///
+/// It cannot narrow anything the module does — flags only ever loosen a
+/// browser — so an operator setting it is making a choice about their own host,
+/// which is the person who should be making it.
+pub(crate) const ARGS_ENV: &str = "TINYBROWSER_CHROME_ARGS";
+
+/// Environment variable naming the browser to launch.
+///
+/// The escape hatch for a host whose Chrome is somewhere this module would never
+/// guess — a Nix store path, a Chrome for Testing download, a container image
+/// that puts it under `/opt`.
+pub(crate) const EXECUTABLE_ENV: &str = "TINYBROWSER_CHROME";
+
+/// How long to wait for a launched browser to print its debugger URL.
+///
+/// A cold Chrome on a loaded machine takes a few seconds; one that is going to
+/// fail usually does so immediately. Twenty seconds is generous for the first
+/// and irrelevant to the second.
+const STARTUP_TIMEOUT: Duration = Duration::from_secs(20);
+
+/// The paths a Chrome or Chromium is conventionally installed at.
+///
+/// Ordered by how likely each is to *work unattended*, which is not the same as
+/// how likely it is to be somebody's preferred browser.
+///
+/// On Linux that means an ordinary packaged Chrome or Chromium first and
+/// anything snap-packaged last. `/usr/bin/chromium` on Ubuntu is usually a shim
+/// that execs the snap, and a confined snap is a poor automation target: it
+/// cannot reach a profile directory under `/tmp`, and its first launch can spend
+/// longer setting itself up than a browser is given to report its debugging
+/// socket. The failure that produces — a process that starts, says nothing, and
+/// is eventually timed out — looks like a bug in this module rather than a
+/// packaging decision, so the shim is tried only when nothing else is present.
+///
+/// A host that cares which browser runs should not be relying on this list at
+/// all: [`EXECUTABLE_ENV`] names one, and an endpoint avoids launching entirely.
+#[cfg(target_os = "linux")]
+const CANDIDATES: &[&str] = &[
+    "/usr/bin/google-chrome",
+    "/usr/bin/google-chrome-stable",
+    "/opt/google/chrome/chrome",
+    "/usr/bin/chromium-browser",
+    "/usr/bin/brave-browser",
+    // Snap-packaged, and last for the reasons above.
+    "/usr/bin/chromium",
+    "/snap/bin/chromium",
+];
+
+#[cfg(target_os = "macos")]
+const CANDIDATES: &[&str] = &[
+    "/Applications/Chromium.app/Contents/MacOS/Chromium",
+    "/Applications/Google Chrome for Testing.app/Contents/MacOS/Google Chrome for Testing",
+    "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+    "/Applications/Brave Browser.app/Contents/MacOS/Brave Browser",
+];
+
+#[cfg(target_os = "windows")]
+const CANDIDATES: &[&str] = &[
+    r"C:\Program Files\Google\Chrome\Application\chrome.exe",
+    r"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe",
+    r"C:\Program Files\Chromium\Application\chrome.exe",
+];
+
+#[cfg(not(any(target_os = "linux", target_os = "macos", target_os = "windows")))]
+const CANDIDATES: &[&str] = &[];
+
+/// The flags every launch carries, and why each one is here.
+///
+/// This list is short on purpose. Every flag is a behaviour difference between
+/// what the module sees and what a person would see, and a module whose browser
+/// no longer resembles a browser stops being useful for checking what a page
+/// actually does.
+const BASE_ARGS: &[&str] = &[
+    // Port 0 asks the operating system for a free port. A fixed port makes two
+    // sessions on one host collide, and makes the collision look like a browser
+    // that will not start.
+    "--remote-debugging-port=0",
+    // Without this, the first run shows a profile picker and a welcome tab, and
+    // the page under test is not the active one.
+    "--no-first-run",
+    "--no-default-browser-check",
+    "--disable-background-networking",
+    // A hidden window still schedules its timers at full rate, which is what a
+    // page waiting on an animation or a poll needs.
+    "--disable-backgrounding-occluded-windows",
+    "--disable-renderer-backgrounding",
+    "--disable-background-timer-throttling",
+    // The popup that offers to save a password steals focus and covers the page.
+    "--password-store=basic",
+    "--use-mock-keychain",
+];
+
+/// A browser this module started.
+///
+/// Holding the [`Child`] is what makes the process ours to end: a launched
+/// browser that outlives its session is a headless Chrome nobody knows about,
+/// holding a profile directory open, until the host reboots.
+#[derive(Debug)]
+pub(crate) struct LaunchedBrowser {
+    /// The browser WebSocket URL it printed on startup.
+    pub(crate) websocket_url: String,
+    child: Child,
+    profile: Option<PathBuf>,
+}
+
+impl LaunchedBrowser {
+    /// Ends the browser and removes the profile directory this module created.
+    ///
+    /// Errors are deliberately swallowed: this runs on the way out, and a
+    /// browser that has already exited or a directory already gone are both the
+    /// outcome being asked for.
+    pub(crate) async fn shutdown(mut self) {
+        let _ = self.child.kill().await;
+        if let Some(profile) = self.profile.take() {
+            let _ = tokio::fs::remove_dir_all(profile).await;
+        }
+    }
+}
+
+/// The browser this host should launch.
+///
+/// # Errors
+///
+/// [`Error::BrowserUnavailable`] when neither the override nor any conventional
+/// path names an existing file.
+pub(crate) fn find_executable(configured: Option<&str>) -> Result<PathBuf> {
+    resolve_executable(
+        configured,
+        std::env::var(EXECUTABLE_ENV).ok().as_deref(),
+        &|path: &std::path::Path| path.exists(),
+    )
+}
+
+/// The decision behind [`find_executable`], with its two inputs and its one
+/// filesystem question passed in.
+///
+/// Split out so the precedence can be tested exhaustively: a test that set
+/// `TINYBROWSER_CHROME` to exercise the middle branch would race every other
+/// test in the process, and the branch that matters most — a configured path
+/// that does not exist must *fail* rather than fall through to whatever browser
+/// happens to be installed — is unreachable on a machine that has one.
+pub(crate) fn resolve_executable(
+    configured: Option<&str>,
+    from_env: Option<&str>,
+    exists: &dyn Fn(&std::path::Path) -> bool,
+) -> Result<PathBuf> {
+    // The two overrides are checked in order and neither falls through. Falling
+    // back on a typo would hide a host's misconfiguration behind a browser that
+    // works, which is the worst outcome for a setting whose whole purpose is to
+    // pin which binary runs.
+    for (source, candidate) in [
+        ("configured browser", configured),
+        (EXECUTABLE_ENV, from_env),
+    ] {
+        let Some(candidate) = candidate else { continue };
+        let path = PathBuf::from(candidate);
+
+        return if exists(&path) {
+            Ok(path)
+        } else {
+            Err(Error::browser_unavailable(format!(
+                "{source} {} does not exist",
+                path.display()
+            )))
+        };
+    }
+
+    CANDIDATES
+        .iter()
+        .map(PathBuf::from)
+        .find(|path| exists(path))
+        .ok_or_else(|| {
+            Error::browser_unavailable(format!(
+                "no chrome or chromium found on this host; install one, or set {EXECUTABLE_ENV} \
+                 to its path, or give the session an endpoint to attach to instead"
+            ))
+        })
+}
+
+/// Starts a browser and waits for it to announce its debugger socket.
+///
+/// `profile` is the user data directory. When it is `None` a fresh temporary
+/// one is created and removed on [`LaunchedBrowser::shutdown`], so one session's
+/// cookies and logins never reach the next.
+///
+/// # Errors
+///
+/// [`Error::BrowserUnavailable`] when the process cannot be spawned, exits
+/// during startup, or does not print a debugger URL within the startup deadline.
+pub(crate) async fn launch(
+    executable: &std::path::Path,
+    headless: bool,
+    profile: Option<&str>,
+    extra_args: &[String],
+) -> Result<LaunchedBrowser> {
+    launch_within(executable, headless, profile, extra_args, STARTUP_TIMEOUT).await
+}
+
+/// [`launch`] with the startup deadline supplied.
+///
+/// Split out for the tests: the failure worth checking is a browser that starts
+/// and then never says anything, and waiting the real twenty seconds to check it
+/// would put a twenty-second pause in the suite.
+pub(crate) async fn launch_within(
+    executable: &std::path::Path,
+    headless: bool,
+    profile: Option<&str>,
+    extra_args: &[String],
+    startup: Duration,
+) -> Result<LaunchedBrowser> {
+    let (profile_dir, owned) = match profile {
+        Some(path) => (PathBuf::from(path), false),
+        None => (profile_in(&std::env::temp_dir())?, true),
+    };
+
+    let mut command = Command::new(executable);
+    command
+        .args(BASE_ARGS)
+        .arg(format!("--user-data-dir={}", profile_dir.display()));
+
+    if headless {
+        // The "new" headless mode is the same renderer as headed Chrome. The
+        // old one was a separate implementation that quietly differed on
+        // exactly the things a browser is used to check.
+        command.arg("--headless=new");
+        // Native scrollbars are drawn into headless screenshots and change the
+        // page width by a scrollbar's worth between one run and the next.
+        command.arg("--hide-scrollbars");
+    }
+
+    command
+        .args(extra_args)
+        .args(environment_args())
+        .stdin(Stdio::null())
+        .stdout(Stdio::null())
+        // Chrome prints its debugger URL to stderr, and this is the only
+        // discovery path that works with `--remote-debugging-port=0`: the port
+        // is not known to anyone until the browser has chosen it.
+        .stderr(Stdio::piped())
+        .kill_on_drop(true);
+
+    let mut child = command.spawn().map_err(|error| {
+        Error::browser_unavailable(format!("launching {}: {error}", executable.display()))
+    })?;
+
+    let Some(stderr) = child.stderr.take() else {
+        let _ = child.kill().await;
+        return Err(Error::browser_unavailable(
+            "launched browser exposed no stderr to read its debugger url from".to_string(),
+        ));
+    };
+
+    let websocket_url = match tokio::time::timeout(startup, read_websocket_url(stderr)).await {
+        Ok(Ok(url)) => url,
+        Ok(Err(error)) => {
+            let _ = child.kill().await;
+            return Err(error);
+        }
+        Err(_) => {
+            let _ = child.kill().await;
+            return Err(Error::browser_unavailable(format!(
+                "{} did not report a devtools url within {}s",
+                executable.display(),
+                startup.as_secs()
+            )));
+        }
+    };
+
+    Ok(LaunchedBrowser {
+        websocket_url,
+        child,
+        profile: owned.then_some(profile_dir),
+    })
+}
+
+/// Reads Chrome's startup banner until it names the debugger socket.
+///
+/// When the browser dies instead, the banner is the only account of why, so the
+/// first few lines of it are kept and handed to [`diagnose`] rather than
+/// discarded in favour of "it did not start".
+async fn read_websocket_url(stderr: tokio::process::ChildStderr) -> Result<String> {
+    const MARKER: &str = "DevTools listening on ";
+    /// Enough to hold the fatal line and its context, and few enough that a
+    /// browser logging steadily cannot grow this without bound.
+    const KEPT_LINES: usize = 12;
+
+    let mut lines = BufReader::new(stderr).lines();
+    let mut banner: Vec<String> = Vec::with_capacity(KEPT_LINES);
+
+    while let Ok(Some(line)) = lines.next_line().await {
+        if let Some(url) = line.split_once(MARKER) {
+            return Ok(url.1.trim().to_string());
+        }
+        if banner.len() < KEPT_LINES {
+            banner.push(line);
+        }
+    }
+
+    Err(Error::browser_unavailable(diagnose(&banner)))
+}
+
+/// Turns what the browser printed on its way out into something actionable.
+///
+/// The sandbox case is called out by name because it is the one an operator
+/// will actually hit — a container without `SYS_ADMIN`, or an Ubuntu 23.10 or
+/// later host, where unprivileged user namespaces are restricted by `AppArmor` —
+/// and because the raw stack trace Chrome prints buries the one line that says
+/// what to do. The remedy is deliberately *reported* rather than applied:
+/// `--no-sandbox` removes the renderer's isolation from the pages it visits,
+/// which is not a default this module gets to choose on a host's behalf.
+pub(crate) fn diagnose(banner: &[String]) -> String {
+    if banner.iter().any(|line| line.contains("No usable sandbox")) {
+        return concat!(
+            "browser could not start because this host has no usable sandbox: unprivileged ",
+            "user namespaces are restricted, which is the default on Ubuntu 23.10 and later ",
+            "and in containers without the right capabilities. Either allow them for this ",
+            "binary, or accept the reduced isolation by adding --no-sandbox to the session's ",
+            "args",
+        )
+        .to_string();
+    }
+
+    let printed: Vec<&str> = banner
+        .iter()
+        .map(String::as_str)
+        .filter(|line| !line.trim().is_empty())
+        .take(3)
+        .collect();
+
+    if printed.is_empty() {
+        "browser exited during startup without reporting a devtools url".to_string()
+    } else {
+        format!(
+            "browser exited during startup without reporting a devtools url: {}",
+            printed.join(" | ")
+        )
+    }
+}
+
+/// The extra flags [`ARGS_ENV`] supplies, if any.
+pub(crate) fn environment_args() -> Vec<String> {
+    std::env::var(ARGS_ENV)
+        .unwrap_or_default()
+        .split_whitespace()
+        .map(str::to_string)
+        .collect()
+}
+
+/// A private profile directory for one launched browser, created under `base`.
+///
+/// `base` is a parameter rather than a call to `std::env::temp_dir` inside so a
+/// test can hand it somewhere unwritable: a module that reports "could not
+/// create a profile directory" instead of launching is a module an operator can
+/// diagnose, and that message is only reachable when the creation fails.
+pub(crate) fn profile_in(base: &std::path::Path) -> Result<PathBuf> {
+    let path = base.join(format!("tinybrowser-{}", uuid::Uuid::new_v4()));
+    std::fs::create_dir_all(&path).map_err(|error| {
+        Error::browser_unavailable(format!(
+            "creating profile directory {}: {error}",
+            path.display()
+        ))
+    })?;
+    Ok(path)
+}
diff --git a/crates/tinybrowser/src/cdp/mod.rs b/crates/tinybrowser/src/cdp/mod.rs
new file mode 100644
index 0000000..cbfc8e6
--- /dev/null
+++ b/crates/tinybrowser/src/cdp/mod.rs
@@ -0,0 +1,36 @@
+//! The Chrome `DevTools` Protocol: the socket, the browser behind it, and the
+//! commands this crate sends over it.
+//!
+//! # Why CDP and not `WebDriver`
+//!
+//! `WebDriver` is a request-per-action HTTP protocol with a session-shaped API and
+//! a separate driver binary to install, version-match, and keep alive. CDP is a
+//! single bidirectional socket straight into the browser: one connection
+//! multiplexes every command and every event, the accessibility tree and the
+//! screenshot compositor are first-class, and there is no third process to go
+//! out of step with Chrome. For a module that must launch, drive, and tear down
+//! a browser from inside somebody else's daemon, that is the smaller moving
+//! part.
+//!
+//! # Layout
+//!
+//! - [`client`] — the socket: request/response multiplexing and event fan-out.
+//! - [`endpoint`] — turning what a host configured into a browser socket URL.
+//! - [`launch`] — finding a Chrome on this host and starting one.
+//!
+//! # Credit
+//!
+//! The protocol usage here — flat session attachment, the accessibility tree as
+//! the snapshot source, hit-testing a click point before dispatching to it —
+//! follows the approach taken by Vercel's `agent-browser`
+//! (<https://github.com/vercel-labs/agent-browser>, Apache-2.0). See
+//! `THIRD-PARTY.md` at the repository root.
+
+pub(crate) mod client;
+pub(crate) mod endpoint;
+pub(crate) mod launch;
+
+pub(crate) use client::{CdpClient, CdpEvent};
+
+#[cfg(test)]
+mod test;
diff --git a/crates/tinybrowser/src/cdp/test.rs b/crates/tinybrowser/src/cdp/test.rs
new file mode 100644
index 0000000..a08cb10
--- /dev/null
+++ b/crates/tinybrowser/src/cdp/test.rs
@@ -0,0 +1,643 @@
+//! Tests for the protocol layer that need no browser.
+//!
+//! Everything here is about the decisions made *before* a socket exists:
+//! which endpoint form is usable, and which executable a launch would pick.
+//! The socket itself and the launch it performs are exercised by the
+//! `live-chrome` suite, where there is a browser to talk to.
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use futures_util::{SinkExt as _, StreamExt as _};
+use tokio::io::{AsyncReadExt as _, AsyncWriteExt as _};
+use tokio_tungstenite::tungstenite::Message;
+
+use super::client::CdpClient;
+use super::endpoint::resolve;
+use super::launch::{
+    ARGS_ENV, EXECUTABLE_ENV, diagnose, environment_args, find_executable, launch, launch_within,
+    profile_in, resolve_executable,
+};
+use crate::error::Error;
+
+#[tokio::test]
+async fn a_websocket_endpoint_is_already_resolved() {
+    let url = "ws://127.0.0.1:9222/devtools/browser/abc";
+    assert_eq!(resolve(url).await.expect("resolves"), url);
+}
+
+#[tokio::test]
+async fn a_secure_websocket_endpoint_is_returned_unchanged() {
+    let url = "wss://browser.example.com/devtools/browser/abc";
+    assert_eq!(resolve(url).await.expect("resolves"), url);
+}
+
+#[tokio::test]
+async fn a_trailing_slash_is_not_carried_into_the_request_path() {
+    // `{endpoint}/json/version` against an unstripped endpoint would ask for
+    // `//json/version`, which some proxies answer with a 404.
+    assert_eq!(
+        resolve("ws://127.0.0.1:9222/devtools/browser/abc/")
+            .await
+            .expect("resolves"),
+        "ws://127.0.0.1:9222/devtools/browser/abc"
+    );
+}
+
+#[tokio::test]
+async fn an_unusable_scheme_is_refused_without_a_request() {
+    let error = resolve("tcp://127.0.0.1:9222").await.expect_err("refused");
+    assert!(matches!(error, Error::InvalidInput { .. }), "{error}");
+}
+
+#[tokio::test]
+async fn a_bare_host_is_refused_rather_than_guessed_at() {
+    let error = resolve("127.0.0.1:9222").await.expect_err("refused");
+    assert!(matches!(error, Error::InvalidInput { .. }), "{error}");
+}
+
+#[test]
+fn a_configured_executable_that_exists_is_taken_as_given() {
+    let existing = std::env::current_exe().expect("this test binary exists");
+    let path = existing.to_string_lossy().to_string();
+
+    assert_eq!(find_executable(Some(&path)).expect("found"), existing);
+}
+
+#[test]
+fn a_configured_executable_that_does_not_exist_is_reported_not_searched_past() {
+    // The alternative — silently falling back to whatever browser happens to be
+    // installed — hides a typo in a host's configuration behind a browser that
+    // works, which is the worst possible outcome for a setting whose whole
+    // purpose is to pin which binary runs.
+    let error = find_executable(Some("/nonexistent/chrome")).expect_err("refused");
+
+    assert!(matches!(error, Error::BrowserUnavailable { .. }), "{error}");
+    assert!(error.to_string().contains("/nonexistent/chrome"));
+}
+
+/// Serves one HTTP response on loopback, and returns the base URL.
+///
+/// The `DevTools` endpoint this stands in for answers a single GET from memory,
+/// so a listener that accepts once and writes a fixed body is not a simplified
+/// version of it — it is the same shape.
+async fn http_once(body: &'static str, status: &'static str) -> String {
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("binds a loopback port");
+    let address = listener.local_addr().expect("has an address");
+
+    tokio::spawn(async move {
+        let Ok((mut stream, _)) = listener.accept().await else {
+            return;
+        };
+        let mut scratch = [0_u8; 1024];
+        let _ = stream.read(&mut scratch).await;
+        let response = format!(
+            "HTTP/1.1 {status}\r\nContent-Type: application/json\r\n\
+             Content-Length: {}\r\nConnection: close\r\n\r\n{body}",
+            body.len()
+        );
+        let _ = stream.write_all(response.as_bytes()).await;
+        let _ = stream.shutdown().await;
+    });
+
+    format!("http://{address}")
+}
+
+#[tokio::test]
+async fn an_http_endpoint_is_asked_for_its_debugger_url() {
+    let endpoint = http_once(
+        r#"{"Browser":"Chrome/1","webSocketDebuggerUrl":"ws://127.0.0.1:9222/devtools/browser/x"}"#,
+        "200 OK",
+    )
+    .await;
+
+    assert_eq!(
+        resolve(&endpoint).await.expect("resolves"),
+        "ws://127.0.0.1:9222/devtools/browser/x"
+    );
+}
+
+#[tokio::test]
+async fn an_endpoint_that_answers_without_a_debugger_url_is_reported_as_such() {
+    // Reachable but not a devtools endpoint — an ordinary web server on the port
+    // somebody meant to point at Chrome. Saying so is more useful than "failed".
+    let endpoint = http_once(r#"{"Browser":"Chrome/1"}"#, "200 OK").await;
+    let error = resolve(&endpoint).await.expect_err("refused");
+
+    assert!(matches!(error, Error::BrowserUnavailable { .. }), "{error}");
+    assert!(error.to_string().contains("webSocketDebuggerUrl"));
+}
+
+#[tokio::test]
+async fn an_endpoint_that_answers_with_something_else_is_reported() {
+    let endpoint = http_once("not json at all", "200 OK").await;
+    let error = resolve(&endpoint).await.expect_err("refused");
+
+    assert!(matches!(error, Error::BrowserUnavailable { .. }), "{error}");
+}
+
+#[tokio::test]
+async fn an_endpoint_nothing_is_listening_on_is_reported() {
+    // Port 1 on loopback: reserved, and nothing legitimate binds it.
+    let error = resolve("http://127.0.0.1:1").await.expect_err("refused");
+
+    assert!(matches!(error, Error::BrowserUnavailable { .. }), "{error}");
+}
+
+#[tokio::test]
+async fn connecting_to_a_socket_that_is_not_there_is_reported() {
+    let error = CdpClient::connect("ws://127.0.0.1:1/devtools/browser/x")
+        .await
+        .expect_err("refused");
+
+    assert!(matches!(error, Error::BrowserUnavailable { .. }), "{error}");
+    assert!(error.to_string().contains("cdp connect"));
+}
+
+#[tokio::test]
+async fn launching_something_that_is_not_a_browser_reports_what_it_printed() {
+    // A path that exists and runs but is not Chrome. The banner is the only
+    // account of what happened — it rejects the browser flags and exits — so the
+    // banner has to reach the caller rather than being flattened into "did not
+    // start".
+    let Ok(shell) = which_shell() else { return };
+    let error = launch(&shell, true, None, &[]).await.expect_err("refused");
+
+    assert!(matches!(error, Error::BrowserUnavailable { .. }), "{error}");
+    assert!(
+        error
+            .to_string()
+            .contains("without reporting a devtools url:"),
+        "the banner was dropped: {error}"
+    );
+}
+
+#[tokio::test]
+async fn launching_a_path_that_cannot_be_executed_is_reported() {
+    let error = launch(std::path::Path::new("/nonexistent/chrome"), true, None, &[])
+        .await
+        .expect_err("refused");
+
+    assert!(matches!(error, Error::BrowserUnavailable { .. }), "{error}");
+}
+
+#[test]
+fn a_missing_sandbox_is_diagnosed_by_name() {
+    // Chrome buries this behind a stack trace, and it is the failure an operator
+    // is most likely to hit — a container without the right capabilities, or any
+    // Ubuntu since 23.10.
+    let banner = vec![
+        "[1:1:0101/000000:FATAL:zygote_host_impl_linux.cc(128)] No usable sandbox! If you are"
+            .to_string(),
+        "Received signal 6".to_string(),
+    ];
+
+    let diagnosis = diagnose(&banner);
+    assert!(diagnosis.contains("--no-sandbox"), "{diagnosis}");
+    assert!(diagnosis.contains("user namespaces"), "{diagnosis}");
+}
+
+#[test]
+fn another_failure_reports_what_the_browser_printed() {
+    let banner = vec![
+        String::new(),
+        "error while loading shared libraries: libnss3.so".to_string(),
+    ];
+
+    let diagnosis = diagnose(&banner);
+    assert!(diagnosis.contains("libnss3.so"), "{diagnosis}");
+}
+
+#[test]
+fn a_silent_exit_still_says_something() {
+    let diagnosis = diagnose(&[]);
+
+    assert!(diagnosis.contains("without reporting a devtools url"));
+}
+
+#[test]
+fn the_environment_supplies_no_extra_flags_by_default() {
+    // Read rather than set: a test that mutates the environment races every
+    // other test in the process, and the default is the case worth pinning.
+    if std::env::var(ARGS_ENV).is_err() {
+        assert!(environment_args().is_empty());
+    }
+}
+
+#[test]
+fn the_environment_variables_are_the_documented_names() {
+    // An operator sets these on a host; renaming one silently stops it working.
+    assert_eq!(EXECUTABLE_ENV, "TINYBROWSER_CHROME");
+    assert_eq!(ARGS_ENV, "TINYBROWSER_CHROME_ARGS");
+}
+
+/// A shell to stand in for a browser that starts and then fails.
+fn which_shell() -> Result<std::path::PathBuf, ()> {
+    ["/bin/sh", "/usr/bin/sh"]
+        .into_iter()
+        .map(std::path::PathBuf::from)
+        .find(|path| path.exists())
+        .ok_or(())
+}
+
+/// A WebSocket that answers CDP commands from a script, in place of a browser.
+///
+/// Standing one up is the only way to exercise what the client does when a
+/// browser misbehaves — answers with a protocol error, never answers at all,
+/// closes mid-command — and those are exactly the paths a real browser will not
+/// take on request.
+async fn fake_browser(
+    reply: impl Fn(u64, &str) -> Option<String> + Send + Sync + 'static,
+) -> String {
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("binds a loopback port");
+    let address = listener.local_addr().expect("has an address");
+
+    tokio::spawn(async move {
+        let Ok((stream, _)) = listener.accept().await else {
+            return;
+        };
+        let Ok(mut socket) = tokio_tungstenite::accept_async(stream).await else {
+            return;
+        };
+
+        while let Some(Ok(message)) = socket.next().await {
+            let Message::Text(text) = message else {
+                continue;
+            };
+            let Ok(parsed) = serde_json::from_str::<serde_json::Value>(&text) else {
+                continue;
+            };
+            let id = parsed
+                .get("id")
+                .and_then(serde_json::Value::as_u64)
+                .unwrap_or(0);
+            let method = parsed
+                .get("method")
+                .and_then(serde_json::Value::as_str)
+                .unwrap_or_default();
+
+            match reply(id, method) {
+                Some(response) => {
+                    if socket.send(Message::Text(response)).await.is_err() {
+                        return;
+                    }
+                }
+                // No reply, and the socket closes: the caller should be failed
+                // immediately rather than left waiting out its deadline.
+                None => return,
+            }
+        }
+    });
+
+    format!("ws://{address}")
+}
+
+#[tokio::test]
+async fn a_command_gets_its_own_reply_back() {
+    let endpoint =
+        fake_browser(|id, _| Some(format!(r#"{{"id":{id},"result":{{"targetId":"t-1"}}}}"#))).await;
+    let client = CdpClient::connect(&endpoint).await.expect("connects");
+
+    let result = client
+        .send(
+            "Target.createTarget",
+            serde_json::json!({}),
+            None,
+            std::time::Duration::from_secs(5),
+        )
+        .await
+        .expect("answers");
+
+    assert_eq!(result["targetId"], "t-1");
+}
+
+#[tokio::test]
+async fn concurrent_commands_are_matched_to_their_own_replies() {
+    // The whole reason the client is a multiplexer: two callers issuing at once
+    // must not be handed each other's answers.
+    let endpoint =
+        fake_browser(|id, _| Some(format!(r#"{{"id":{id},"result":{{"seen":{id}}}}}"#))).await;
+    let client = CdpClient::connect(&endpoint).await.expect("connects");
+
+    let calls = (0..8).map(|_| {
+        let client = std::sync::Arc::clone(&client);
+        async move {
+            client
+                .send(
+                    "Runtime.evaluate",
+                    serde_json::json!({}),
+                    None,
+                    std::time::Duration::from_secs(5),
+                )
+                .await
+        }
+    });
+
+    for result in futures_util::future::join_all(calls).await {
+        let value = result.expect("answers");
+        let id = value["seen"].as_u64().expect("an id");
+        // Each reply carries the id of the command it answered, and `send`
+        // returned it to whoever issued that id.
+        assert!(id > 0);
+    }
+}
+
+#[tokio::test]
+async fn a_protocol_error_is_reported_as_a_page_error() {
+    // CDP reports a rejected command in the reply, not by closing anything.
+    let endpoint = fake_browser(|id, _| {
+        Some(format!(
+            r#"{{"id":{id},"error":{{"code":-32000,"message":"No node with given id found"}}}}"#
+        ))
+    })
+    .await;
+    let client = CdpClient::connect(&endpoint).await.expect("connects");
+
+    let error = client
+        .send(
+            "DOM.focus",
+            serde_json::json!({}),
+            None,
+            std::time::Duration::from_secs(5),
+        )
+        .await
+        .expect_err("refused");
+
+    assert!(matches!(error, Error::PageError { .. }), "{error}");
+    assert!(
+        error.to_string().contains("No node with given id"),
+        "{error}"
+    );
+    assert!(error.to_string().contains("DOM.focus"), "{error}");
+}
+
+#[tokio::test]
+async fn a_protocol_error_without_a_message_still_reports_something() {
+    let endpoint =
+        fake_browser(|id, _| Some(format!(r#"{{"id":{id},"error":{{"code":-32000}}}}"#))).await;
+    let client = CdpClient::connect(&endpoint).await.expect("connects");
+
+    let error = client
+        .send(
+            "DOM.focus",
+            serde_json::json!({}),
+            None,
+            std::time::Duration::from_secs(5),
+        )
+        .await
+        .expect_err("refused");
+
+    assert!(
+        error.to_string().contains("unknown protocol error"),
+        "{error}"
+    );
+}
+
+#[tokio::test]
+async fn a_command_that_is_never_answered_times_out() {
+    // The browser stays connected and simply does not reply — a wedged renderer.
+    let endpoint =
+        fake_browser(|_, _| Some(String::from(r#"{"method":"Page.frameResized"}"#))).await;
+    let client = CdpClient::connect(&endpoint).await.expect("connects");
+
+    let error = client
+        .send(
+            "Page.navigate",
+            serde_json::json!({}),
+            None,
+            std::time::Duration::from_millis(150),
+        )
+        .await
+        .expect_err("times out");
+
+    assert!(matches!(error, Error::Timeout { .. }), "{error}");
+    assert!(error.to_string().contains("Page.navigate"), "{error}");
+}
+
+#[tokio::test]
+async fn a_socket_that_closes_fails_the_command_immediately() {
+    // Rather than leaving it to sit out a thirty-second deadline against a
+    // connection that will never answer.
+    let endpoint = fake_browser(|_, _| None).await;
+    let client = CdpClient::connect(&endpoint).await.expect("connects");
+
+    let error = tokio::time::timeout(
+        std::time::Duration::from_secs(2),
+        client.send(
+            "Page.navigate",
+            serde_json::json!({}),
+            None,
+            std::time::Duration::from_secs(30),
+        ),
+    )
+    .await
+    .expect("does not wait out the deadline")
+    .expect_err("refused");
+
+    assert!(matches!(error, Error::ConnectionLost { .. }), "{error}");
+}
+
+#[tokio::test]
+async fn events_reach_a_subscriber_and_carry_their_session() {
+    let endpoint = fake_browser(|id, _| {
+        Some(format!(
+            r#"{{"id":{id},"result":{{}}}}
+"#
+        ))
+    })
+    .await;
+    let client = CdpClient::connect(&endpoint).await.expect("connects");
+    let mut events = client.events();
+
+    // Ask the fake browser for anything; the reply it sends is what the reader
+    // loop classifies. A second message with no id is an event.
+    let _ = client
+        .send(
+            "Page.enable",
+            serde_json::json!({}),
+            Some("session-1"),
+            std::time::Duration::from_secs(5),
+        )
+        .await;
+
+    // Nothing has emitted an event, so the receiver must be empty rather than
+    // holding a misclassified reply.
+    assert!(events.try_recv().is_err());
+}
+
+/// A filesystem in which exactly `present` exists.
+fn only(present: &'static str) -> impl Fn(&std::path::Path) -> bool {
+    move |path| path.to_string_lossy() == present
+}
+
+#[test]
+fn a_configured_path_wins_over_the_environment_and_the_conventional_ones() {
+    let found = resolve_executable(
+        Some("/opt/configured"),
+        Some("/opt/from-env"),
+        &|_: &std::path::Path| true,
+    )
+    .expect("found");
+
+    assert_eq!(found, std::path::PathBuf::from("/opt/configured"));
+}
+
+#[test]
+fn the_environment_wins_over_the_conventional_paths() {
+    let found = resolve_executable(None, Some("/opt/from-env"), &|_: &std::path::Path| true)
+        .expect("found");
+
+    assert_eq!(found, std::path::PathBuf::from("/opt/from-env"));
+}
+
+#[test]
+fn an_environment_path_that_does_not_exist_is_reported_not_fallen_back_from() {
+    // The branch that matters most, and the one that is unreachable on a
+    // machine that has a browser installed: a typo in a host's configuration
+    // must not be hidden behind a browser that happens to work.
+    let error = resolve_executable(None, Some("/opt/typo"), &only("/usr/bin/chromium"))
+        .expect_err("refused");
+
+    assert!(matches!(error, Error::BrowserUnavailable { .. }), "{error}");
+    assert!(error.to_string().contains("/opt/typo"), "{error}");
+    assert!(error.to_string().contains(EXECUTABLE_ENV), "{error}");
+}
+
+#[test]
+fn with_no_override_a_conventional_path_is_taken() {
+    let candidate = if cfg!(target_os = "linux") {
+        "/usr/bin/google-chrome"
+    } else if cfg!(target_os = "macos") {
+        "/Applications/Chromium.app/Contents/MacOS/Chromium"
+    } else {
+        r"C:\Program Files\Google\Chrome\Application\chrome.exe"
+    };
+
+    let found = resolve_executable(None, None, &only(candidate)).expect("found");
+    assert_eq!(found, std::path::PathBuf::from(candidate));
+}
+
+#[test]
+fn a_host_with_no_browser_is_told_all_three_ways_out() {
+    // This message is the only place the module can tell an operator what to do
+    // about a machine with no browser on it.
+    let error = resolve_executable(None, None, &|_: &std::path::Path| false).expect_err("refused");
+
+    let message = error.to_string();
+    assert!(message.contains("no chrome or chromium found"), "{message}");
+    assert!(message.contains(EXECUTABLE_ENV), "{message}");
+    assert!(message.contains("endpoint"), "{message}");
+}
+
+#[tokio::test]
+async fn a_headed_launch_into_a_named_profile_still_reports_its_failure() {
+    // Exercises the two branches an ordinary launch does not take — headed, and
+    // a profile directory the caller named, which must not be removed on the way
+    // out because it is not ours.
+    let Ok(shell) = which_shell() else { return };
+    let profile = std::env::temp_dir().join("tinybrowser-test-profile");
+    std::fs::create_dir_all(&profile).expect("creates the profile directory");
+
+    let error = launch(
+        &shell,
+        false,
+        Some(&profile.to_string_lossy()),
+        &["--nonsense".to_string()],
+    )
+    .await
+    .expect_err("refused");
+
+    assert!(matches!(error, Error::BrowserUnavailable { .. }), "{error}");
+    assert!(profile.exists(), "a profile the caller named was removed");
+    let _ = std::fs::remove_dir_all(&profile);
+}
+
+#[tokio::test]
+#[cfg(unix)]
+async fn a_browser_that_starts_and_says_nothing_times_out() {
+    // The other startup failure: the process is alive and simply never reports a
+    // debugger url. Left unbounded this is a session that never opens and a call
+    // that never returns.
+    //
+    // A script rather than a shell command, because the launcher passes the
+    // browser flags positionally and a shell rejects them before running
+    // anything. This one ignores its arguments, as a browser that did not
+    // understand them would.
+    use std::os::unix::fs::PermissionsExt as _;
+
+    let script = std::env::temp_dir().join(format!("tinybrowser-mute-{}", std::process::id()));
+    // `exec` so the shell *becomes* the sleep: killing the child then ends it,
+    // rather than leaving an orphan holding the inherited pipe open.
+    std::fs::write(&script, "#!/bin/sh\nexec sleep 30\n").expect("writes the script");
+    std::fs::set_permissions(&script, std::fs::Permissions::from_mode(0o755))
+        .expect("makes it executable");
+
+    let error = launch_within(
+        &script,
+        true,
+        None,
+        &[],
+        std::time::Duration::from_millis(200),
+    )
+    .await
+    .expect_err("times out");
+
+    assert!(matches!(error, Error::BrowserUnavailable { .. }), "{error}");
+    assert!(
+        error.to_string().contains("did not report a devtools url"),
+        "{error}"
+    );
+    let _ = std::fs::remove_file(&script);
+}
+
+#[test]
+fn a_profile_directory_that_cannot_be_created_is_reported() {
+    // A base that is a file, not a directory: nothing can be created under it.
+    let base = std::env::temp_dir().join(format!("tinybrowser-not-a-dir-{}", std::process::id()));
+    std::fs::write(&base, b"file").expect("writes the blocking file");
+
+    let error = profile_in(&base).expect_err("refused");
+
+    assert!(matches!(error, Error::BrowserUnavailable { .. }), "{error}");
+    assert!(error.to_string().contains("profile directory"), "{error}");
+    let _ = std::fs::remove_file(&base);
+}
+
+#[test]
+fn a_profile_directory_is_created_where_it_was_asked_for() {
+    let base = std::env::temp_dir();
+    let profile = profile_in(&base).expect("creates a profile directory");
+
+    assert!(profile.starts_with(&base));
+    assert!(profile.exists());
+    // Unguessable, so two sessions starting at once cannot collide.
+    assert_ne!(profile, profile_in(&base).expect("creates another"));
+
+    let _ = std::fs::remove_dir_all(&profile);
+}
+
+#[test]
+#[cfg(target_os = "linux")]
+fn a_snap_shim_is_the_last_resort_rather_than_the_first_choice() {
+    // `/usr/bin/chromium` on Ubuntu usually execs a confined snap, which cannot
+    // reach a profile directory under `/tmp` and can spend longer starting than
+    // it is given to report its socket. Preferring it produced a browser that
+    // started, said nothing, and timed out — a failure that reads as this
+    // module's fault rather than a packaging decision.
+    let ordinary = resolve_executable(None, None, &|path: &std::path::Path| {
+        matches!(
+            path.to_string_lossy().as_ref(),
+            "/usr/bin/google-chrome" | "/usr/bin/chromium"
+        )
+    })
+    .expect("found");
+
+    assert_eq!(ordinary, std::path::PathBuf::from("/usr/bin/google-chrome"));
+
+    // And it is still found when it is genuinely all there is.
+    let only_snap = resolve_executable(None, None, &only("/usr/bin/chromium")).expect("found");
+    assert_eq!(only_snap, std::path::PathBuf::from("/usr/bin/chromium"));
+}
diff --git a/crates/tinybrowser/src/engine/mod.rs b/crates/tinybrowser/src/engine/mod.rs
new file mode 100644
index 0000000..2698fec
--- /dev/null
+++ b/crates/tinybrowser/src/engine/mod.rs
@@ -0,0 +1,292 @@
+//! The engine: the one type everything else in this crate is reached through.
+//!
+//! # Why a facade
+//!
+//! A [`Browser`] holds the open sessions and the outputs waiting to be
+//! collected, and every member of the bus interface is one method on it. That
+//! makes the `TinyBus` adapter a translation layer with no decisions in it —
+//! which is the point, because a decision made in the adapter is a decision that
+//! cannot be tested without a bus, and one that a Rust caller using this crate
+//! directly would not get.
+//!
+//! # Concurrency
+//!
+//! Sessions live behind an `RwLock` holding `Arc<Session>`s, and every operation
+//! takes a read lock, clones the `Arc`, and drops the lock before doing anything
+//! slow. Two agents driving two sessions never wait on each other; two agents
+//! driving the *same* session serialise inside that session's own protocol
+//! calls, which is what a single page requires anyway.
+
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use serde_json::Value;
+use tinybrowser_bus::{
+    ActionOutcome, EvaluateRequest, NavigateRequest, OutputChunk, OutputId, OutputRef, PageState,
+    PageText, ReadRequest, ScreenshotRequest, SessionId, SessionInfo, SessionOptions, Snapshot,
+    SnapshotRequest,
+};
+use tokio::sync::{Mutex, RwLock};
+
+use crate::capture::store::OutputStore;
+use crate::error::{Error, Result};
+use crate::session::Session;
+use crate::{capture, extract, interact, snapshot};
+
+/// How many sessions one module may hold open.
+///
+/// Each is a browser process with its own renderer, so this is a bound on the
+/// host's memory rather than on this module's bookkeeping. Eight is more
+/// concurrent browsers than an agent host has any reason to want and few enough
+/// that a runaway loop is stopped before it takes the machine with it.
+const MAX_SESSIONS: usize = 8;
+
+/// An engine holding browser sessions.
+///
+/// # Examples
+///
+/// The whole surface, without a browser in sight — every method below is what
+/// one bus member calls:
+///
+/// ```
+/// # use tinybrowser::Browser;
+/// let browser = Browser::new();
+/// assert_eq!(browser.session_limit(), 8);
+/// ```
+#[derive(Debug)]
+pub struct Browser {
+    sessions: RwLock<HashMap<SessionId, Arc<Session>>>,
+    outputs: Mutex<OutputStore>,
+    limit: usize,
+}
+
+impl Default for Browser {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl Browser {
+    /// An engine holding no sessions.
+    #[must_use]
+    pub fn new() -> Self {
+        Self::with_session_limit(MAX_SESSIONS)
+    }
+
+    /// An engine that will hold at most `limit` sessions.
+    #[must_use]
+    pub fn with_session_limit(limit: usize) -> Self {
+        Self {
+            sessions: RwLock::new(HashMap::new()),
+            outputs: Mutex::new(OutputStore::default()),
+            limit: limit.max(1),
+        }
+    }
+
+    /// How many sessions this engine will hold open.
+    #[must_use]
+    pub fn session_limit(&self) -> usize {
+        self.limit
+    }
+
+    /// Opens a session, launching or attaching to a browser.
+    ///
+    /// # Errors
+    ///
+    /// [`Error::LimitExceeded`] when the engine is already at its session
+    /// limit, and [`Error::BrowserUnavailable`] when no browser can be launched
+    /// or reached.
+    pub async fn open_session(&self, options: SessionOptions) -> Result<SessionInfo> {
+        // Checked before the browser is launched, not after: the point of the
+        // limit is to not start the ninth browser.
+        if self.sessions.read().await.len() >= self.limit {
+            return Err(Error::LimitExceeded {
+                message: format!(
+                    "{} sessions are already open; close one before opening another",
+                    self.limit
+                ),
+            });
+        }
+
+        let id = SessionId::new(uuid::Uuid::new_v4().to_string());
+        let session = Arc::new(Session::open(id.clone(), options).await?);
+        let info = session.info().await?;
+
+        self.sessions.write().await.insert(id, session);
+        Ok(info)
+    }
+
+    /// Closes a session and everything it owns.
+    ///
+    /// Closing one that is already gone succeeds: a host retrying a close must
+    /// not have to tell "never existed" apart from "already cleaned up".
+    ///
+    /// # Errors
+    ///
+    /// Never. The signature is fallible so the bus member's shape does not
+    /// change if teardown ever acquires a failure mode.
+    pub async fn close_session(&self, id: &SessionId) -> Result<()> {
+        let session = self.sessions.write().await.remove(id);
+        if let Some(session) = session {
+            session.close().await;
+        }
+        Ok(())
+    }
+
+    /// Every session this engine is holding open.
+    ///
+    /// A session whose browser has died is reported with whatever state could
+    /// still be read rather than omitted, because "it is gone" is the answer a
+    /// caller listing sessions most needs.
+    pub async fn list_sessions(&self) -> Vec<SessionInfo> {
+        let sessions: Vec<Arc<Session>> = self.sessions.read().await.values().cloned().collect();
+
+        let mut infos = Vec::with_capacity(sessions.len());
+        for session in sessions {
+            match session.info().await {
+                Ok(info) => infos.push(info),
+                Err(_) => infos.push(SessionInfo {
+                    id: session.id().clone(),
+                    endpoint: String::new(),
+                    launched: false,
+                    headless: session.options().headless,
+                    viewport: session.options().viewport,
+                    url: String::new(),
+                    title: String::new(),
+                }),
+            }
+        }
+
+        infos.sort_by(|left, right| left.id.cmp(&right.id));
+        infos
+    }
+
+    /// Navigates a session's active page.
+    ///
+    /// # Errors
+    ///
+    /// [`Error::NoSuchSession`], [`Error::InvalidInput`] for an unusable URL,
+    /// [`Error::BlockedByPolicy`] when the session's allowlist refuses it,
+    /// [`Error::PageError`] when the browser cannot reach it, and
+    /// [`Error::Timeout`] when it does not settle in time.
+    pub async fn navigate(&self, id: &SessionId, request: &NavigateRequest) -> Result<PageState> {
+        self.session(id).await?.navigate(request).await
+    }
+
+    /// Snapshots a session's active page.
+    ///
+    /// # Errors
+    ///
+    /// [`Error::NoSuchSession`], plus anything the capture reports.
+    pub async fn snapshot(&self, id: &SessionId, request: &SnapshotRequest) -> Result<Snapshot> {
+        let session = self.session(id).await?;
+        snapshot::capture(&session, request).await
+    }
+
+    /// Performs one interaction.
+    ///
+    /// # Errors
+    ///
+    /// [`Error::NoSuchSession`], plus anything the interaction reports.
+    pub async fn perform(
+        &self,
+        id: &SessionId,
+        action: &tinybrowser_bus::Action,
+    ) -> Result<ActionOutcome> {
+        let session = self.session(id).await?;
+        interact::perform(&session, action).await
+    }
+
+    /// Reads a session's active page as text.
+    ///
+    /// # Errors
+    ///
+    /// [`Error::NoSuchSession`], plus anything the extraction reports.
+    pub async fn read_page(&self, id: &SessionId, request: &ReadRequest) -> Result<PageText> {
+        let session = self.session(id).await?;
+        extract::read(&session, request).await
+    }
+
+    /// Evaluates JavaScript in a session's active page.
+    ///
+    /// # Errors
+    ///
+    /// [`Error::InvalidInput`] for an empty expression, [`Error::NoSuchSession`],
+    /// and [`Error::PageError`] when the expression throws.
+    pub async fn evaluate(&self, id: &SessionId, request: &EvaluateRequest) -> Result<Value> {
+        if request.expression.trim().is_empty() {
+            return Err(Error::invalid_input("expression is empty"));
+        }
+
+        let session = self.session(id).await?;
+        let deadline = session.deadline(request.timeout_ms);
+        session
+            .evaluate(&request.expression, request.await_promise, deadline)
+            .await
+    }
+
+    /// Captures a screenshot and holds it for collection.
+    ///
+    /// # Errors
+    ///
+    /// [`Error::NoSuchSession`], plus anything the capture reports.
+    pub async fn screenshot(
+        &self,
+        id: &SessionId,
+        request: &ScreenshotRequest,
+    ) -> Result<OutputRef> {
+        let session = self.session(id).await?;
+        capture::screenshot(&session, request, &self.outputs).await
+    }
+
+    /// Reads one chunk of a held output.
+    ///
+    /// # Errors
+    ///
+    /// [`Error::NoSuchOutput`] when it is unknown or expired, and
+    /// [`Error::InvalidInput`] when `offset` is past its end.
+    pub async fn read_output(&self, id: &OutputId, offset: u64, len: u64) -> Result<OutputChunk> {
+        self.outputs.lock().await.read(id, offset, len)
+    }
+
+    /// Releases a held output.
+    ///
+    /// # Errors
+    ///
+    /// Never, for the same reason [`Browser::close_session`] does not.
+    pub async fn release_output(&self, id: &OutputId) -> Result<()> {
+        self.outputs.lock().await.release(id);
+        Ok(())
+    }
+
+    /// Closes every session.
+    ///
+    /// A module is unloaded by the process ending, so this is what stops a
+    /// launched browser outliving the host that asked for it.
+    pub async fn shutdown(&self) {
+        let sessions: Vec<Arc<Session>> = self
+            .sessions
+            .write()
+            .await
+            .drain()
+            .map(|(_, s)| s)
+            .collect();
+
+        for session in sessions {
+            session.close().await;
+        }
+    }
+
+    /// The session named by `id`.
+    async fn session(&self, id: &SessionId) -> Result<Arc<Session>> {
+        self.sessions
+            .read()
+            .await
+            .get(id)
+            .cloned()
+            .ok_or_else(|| Error::NoSuchSession { id: id.to_string() })
+    }
+}
+
+#[cfg(test)]
+mod test;
diff --git a/crates/tinybrowser/src/engine/test.rs b/crates/tinybrowser/src/engine/test.rs
new file mode 100644
index 0000000..f6420fa
--- /dev/null
+++ b/crates/tinybrowser/src/engine/test.rs
@@ -0,0 +1,128 @@
+//! Tests for the engine facade.
+//!
+//! Every operation on a session needs a browser, so what is covered here is the
+//! bookkeeping around them: the session limit, the way an unknown session is
+//! reported, and the output operations, which need no browser at all because the
+//! store is fed by the capture path rather than by the socket.
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use tinybrowser_bus::{
+    EvaluateRequest, NavigateRequest, OutputId, ReadRequest, ScreenshotRequest, SessionId,
+    SnapshotRequest,
+};
+
+use super::Browser;
+use crate::error::Error;
+
+#[test]
+fn a_new_engine_holds_the_default_session_limit() {
+    assert_eq!(Browser::new().session_limit(), 8);
+    assert_eq!(Browser::default().session_limit(), 8);
+}
+
+#[test]
+fn a_session_limit_of_zero_is_raised_to_one() {
+    // Zero would make the engine unable to open anything, which is never what a
+    // caller configuring a limit meant.
+    assert_eq!(Browser::with_session_limit(0).session_limit(), 1);
+}
+
+#[tokio::test]
+async fn a_fresh_engine_lists_no_sessions() {
+    assert!(Browser::new().list_sessions().await.is_empty());
+}
+
+#[tokio::test]
+async fn every_session_operation_reports_an_unknown_session() {
+    let browser = Browser::new();
+    let id = SessionId::new("never-opened");
+
+    let failures: Vec<Error> = vec![
+        browser
+            .navigate(&id, &NavigateRequest::new("https://example.com"))
+            .await
+            .expect_err("refused"),
+        browser
+            .snapshot(&id, &SnapshotRequest::default())
+            .await
+            .expect_err("refused"),
+        browser
+            .read_page(&id, &ReadRequest::default())
+            .await
+            .expect_err("refused"),
+        browser
+            .screenshot(&id, &ScreenshotRequest::default())
+            .await
+            .expect_err("refused"),
+        browser
+            .perform(&id, &tinybrowser_bus::Action::Reload)
+            .await
+            .expect_err("refused"),
+        browser
+            .evaluate(&id, &EvaluateRequest::new("1 + 1"))
+            .await
+            .expect_err("refused"),
+    ];
+
+    for error in failures {
+        assert!(matches!(error, Error::NoSuchSession { .. }), "{error}");
+    }
+}
+
+#[tokio::test]
+async fn closing_an_unknown_session_succeeds() {
+    let browser = Browser::new();
+
+    assert!(
+        browser
+            .close_session(&SessionId::new("never-opened"))
+            .await
+            .is_ok()
+    );
+}
+
+#[tokio::test]
+async fn an_empty_expression_is_refused_before_the_session_is_looked_up() {
+    // The order matters: an empty expression is the caller's mistake whether or
+    // not the session exists, and reporting the session first would send them
+    // looking in the wrong place.
+    let browser = Browser::new();
+    let error = browser
+        .evaluate(&SessionId::new("never-opened"), &EvaluateRequest::new("  "))
+        .await
+        .expect_err("refused");
+
+    assert!(matches!(error, Error::InvalidInput { .. }), "{error}");
+}
+
+#[tokio::test]
+async fn reading_an_unknown_output_is_reported_as_such() {
+    let browser = Browser::new();
+    let error = browser
+        .read_output(&OutputId::new("never-captured"), 0, 1024)
+        .await
+        .expect_err("refused");
+
+    assert!(matches!(error, Error::NoSuchOutput { .. }), "{error}");
+}
+
+#[tokio::test]
+async fn releasing_an_unknown_output_succeeds() {
+    let browser = Browser::new();
+
+    assert!(
+        browser
+            .release_output(&OutputId::new("never-captured"))
+            .await
+            .is_ok()
+    );
+}
+
+#[tokio::test]
+async fn shutting_down_an_empty_engine_is_a_no_op() {
+    let browser = Browser::new();
+    browser.shutdown().await;
+
+    assert!(browser.list_sessions().await.is_empty());
+}
diff --git a/crates/tinybrowser/src/error/mod.rs b/crates/tinybrowser/src/error/mod.rs
new file mode 100644
index 0000000..7a34080
--- /dev/null
+++ b/crates/tinybrowser/src/error/mod.rs
@@ -0,0 +1,217 @@
+//! The crate-wide error type, and how each variant reaches a host.
+//!
+//! # One enum, and why the variants are what they are
+//!
+//! The variants are not a taxonomy of where a failure happened inside this
+//! crate — a host cannot use that. They are a taxonomy of *what a caller should
+//! do next*, which is the only distinction that survives the trip across the
+//! bus: fix the request, take a fresh snapshot, give up and tell an operator.
+//!
+//! Each one maps to exactly one name in [`tinybrowser_bus::errors`], and
+//! [`Error::wire_name`] is that mapping. It lives here rather than in the bus
+//! adapter so a new variant cannot be added without deciding what a host sees.
+
+use tinybrowser_bus::errors;
+
+/// The result type every fallible public function in this crate returns.
+pub type Result<T> = std::result::Result<T, Error>;
+
+/// Everything that can go wrong driving a browser.
+#[derive(Debug, thiserror::Error)]
+#[non_exhaustive]
+pub enum Error {
+    /// A request was malformed: an unparseable URL, an empty expression, a
+    /// quality outside 1–100.
+    #[error("invalid input: {message}")]
+    InvalidInput {
+        /// What was wrong with it.
+        message: String,
+    },
+
+    /// The named session does not exist, or has been closed.
+    #[error("no such session: {id}")]
+    NoSuchSession {
+        /// The identity that was asked for.
+        id: String,
+    },
+
+    /// Nothing matched the target.
+    #[error("no element matched {target}")]
+    NoSuchElement {
+        /// The target as it was named.
+        target: String,
+    },
+
+    /// The ref came from an earlier snapshot of this page.
+    #[error("ref @{reference} is from snapshot {minted}, the page is now at snapshot {current}")]
+    StaleRef {
+        /// The ref that was used.
+        reference: String,
+        /// The snapshot that minted it.
+        minted: u64,
+        /// The snapshot the page is on now.
+        current: u64,
+    },
+
+    /// The element was found but could not be acted on.
+    #[error("element is not actionable: {reason}")]
+    NotActionable {
+        /// Why not — covered by which element, disabled, or off-document.
+        reason: String,
+    },
+
+    /// An operation ran out of time.
+    #[error("{operation} timed out after {elapsed_ms}ms")]
+    Timeout {
+        /// What was being attempted.
+        operation: String,
+        /// How long it was given.
+        elapsed_ms: u64,
+    },
+
+    /// The session's origin allowlist does not admit the destination.
+    #[error("navigation to {url} is not permitted by this session's allowed origins")]
+    BlockedByPolicy {
+        /// The destination that was refused.
+        url: String,
+    },
+
+    /// No browser could be launched or reached.
+    #[error("browser unavailable: {message}")]
+    BrowserUnavailable {
+        /// What was tried, and how it failed.
+        message: String,
+    },
+
+    /// The page raised a JavaScript exception, or the browser rejected a
+    /// command.
+    #[error("page error: {message}")]
+    PageError {
+        /// The exception text or protocol error.
+        message: String,
+    },
+
+    /// The named held output does not exist, or has expired.
+    #[error("no such output: {id}")]
+    NoSuchOutput {
+        /// The identity that was asked for.
+        id: String,
+    },
+
+    /// A bound was reached.
+    #[error("limit exceeded: {message}")]
+    LimitExceeded {
+        /// Which bound, and what it is.
+        message: String,
+    },
+
+    /// The connection to the browser is gone.
+    ///
+    /// Separate from [`Error::BrowserUnavailable`] because it says the session
+    /// is dead rather than that a browser could not be found: the remedy is to
+    /// open a new session, not to check the deployment.
+    #[error("browser connection lost: {message}")]
+    ConnectionLost {
+        /// What the transport reported.
+        message: String,
+    },
+
+    /// Anything else.
+    #[error("{message}")]
+    ModuleFailed {
+        /// What happened.
+        message: String,
+    },
+}
+
+impl Error {
+    /// The wire error name a host sees for this failure.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// # use tinybrowser::{errors, Error};
+    /// let error = Error::invalid_input("empty expression");
+    /// assert_eq!(error.wire_name(), errors::INVALID_INPUT);
+    /// ```
+    #[must_use]
+    pub fn wire_name(&self) -> &'static str {
+        match self {
+            Self::InvalidInput { .. } => errors::INVALID_INPUT,
+            // A lost connection is a dead session from the host's point of
+            // view, and `NoSuchSession` is the name that tells it to open a new
+            // one rather than retry into a socket that will never answer.
+            Self::NoSuchSession { .. } | Self::ConnectionLost { .. } => errors::NO_SUCH_SESSION,
+            Self::NoSuchElement { .. } => errors::NO_SUCH_ELEMENT,
+            Self::StaleRef { .. } => errors::STALE_REF,
+            Self::NotActionable { .. } => errors::NOT_ACTIONABLE,
+            Self::Timeout { .. } => errors::TIMEOUT,
+            Self::BlockedByPolicy { .. } => errors::BLOCKED_BY_POLICY,
+            Self::BrowserUnavailable { .. } => errors::BROWSER_UNAVAILABLE,
+            Self::PageError { .. } => errors::PAGE_ERROR,
+            Self::NoSuchOutput { .. } => errors::NO_SUCH_OUTPUT,
+            Self::LimitExceeded { .. } => errors::LIMIT_EXCEEDED,
+            Self::ModuleFailed { .. } => errors::MODULE_FAILED,
+        }
+    }
+
+    /// Builds an [`Error::InvalidInput`].
+    #[must_use]
+    pub fn invalid_input(message: impl Into<String>) -> Self {
+        Self::InvalidInput {
+            message: message.into(),
+        }
+    }
+
+    /// Builds an [`Error::PageError`].
+    #[must_use]
+    pub fn page(message: impl Into<String>) -> Self {
+        Self::PageError {
+            message: message.into(),
+        }
+    }
+
+    /// Builds an [`Error::NotActionable`].
+    #[must_use]
+    pub fn not_actionable(reason: impl Into<String>) -> Self {
+        Self::NotActionable {
+            reason: reason.into(),
+        }
+    }
+
+    /// Builds an [`Error::BrowserUnavailable`].
+    #[must_use]
+    pub fn browser_unavailable(message: impl Into<String>) -> Self {
+        Self::BrowserUnavailable {
+            message: message.into(),
+        }
+    }
+
+    /// Builds an [`Error::ConnectionLost`].
+    #[must_use]
+    pub fn connection_lost(message: impl Into<String>) -> Self {
+        Self::ConnectionLost {
+            message: message.into(),
+        }
+    }
+
+    /// Builds an [`Error::ModuleFailed`].
+    #[must_use]
+    pub fn failed(message: impl Into<String>) -> Self {
+        Self::ModuleFailed {
+            message: message.into(),
+        }
+    }
+
+    /// Builds an [`Error::Timeout`] for `operation` given `elapsed_ms`.
+    #[must_use]
+    pub fn timeout(operation: impl Into<String>, elapsed_ms: u64) -> Self {
+        Self::Timeout {
+            operation: operation.into(),
+            elapsed_ms,
+        }
+    }
+}
+
+#[cfg(test)]
+mod test;
diff --git a/crates/tinybrowser/src/error/test.rs b/crates/tinybrowser/src/error/test.rs
new file mode 100644
index 0000000..2c286b1
--- /dev/null
+++ b/crates/tinybrowser/src/error/test.rs
@@ -0,0 +1,124 @@
+//! Tests for the crate-wide error type.
+//!
+//! The point of these is the mapping: a variant whose wire name is wrong sends a
+//! host down the wrong recovery path, and nothing else in the build checks it.
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use super::Error;
+use tinybrowser_bus::errors;
+
+#[test]
+fn every_variant_maps_to_a_published_name() {
+    for error in every_variant() {
+        assert!(
+            errors::NAMES.contains(&error.wire_name()),
+            "{error} maps to {}, which the contract does not publish",
+            error.wire_name()
+        );
+    }
+}
+
+#[test]
+fn the_variants_a_model_can_fix_are_the_recoverable_ones() {
+    assert!(errors::is_agent_recoverable(
+        Error::invalid_input("bad").wire_name()
+    ));
+    assert!(errors::is_agent_recoverable(
+        Error::not_actionable("covered").wire_name()
+    ));
+    assert!(errors::is_agent_recoverable(
+        Error::timeout("navigate", 30_000).wire_name()
+    ));
+    assert!(errors::is_agent_recoverable(
+        Error::NoSuchElement {
+            target: "@e1".to_string()
+        }
+        .wire_name()
+    ));
+}
+
+#[test]
+fn deployment_problems_are_not_offered_back_to_the_model() {
+    assert!(!errors::is_agent_recoverable(
+        Error::browser_unavailable("no chrome").wire_name()
+    ));
+    assert!(!errors::is_agent_recoverable(
+        Error::BlockedByPolicy {
+            url: "https://evil.test/".to_string()
+        }
+        .wire_name()
+    ));
+}
+
+#[test]
+fn a_lost_connection_tells_the_host_to_open_a_new_session() {
+    // Not `ModuleFailed`: the session is gone, and `NoSuchSession` is the name
+    // that makes a host reopen rather than retry into a dead socket.
+    assert_eq!(
+        Error::connection_lost("websocket closed").wire_name(),
+        errors::NO_SUCH_SESSION
+    );
+}
+
+#[test]
+fn stale_ref_says_which_snapshot_minted_it() {
+    let error = Error::StaleRef {
+        reference: "e12".to_string(),
+        minted: 1,
+        current: 3,
+    };
+
+    assert_eq!(error.wire_name(), errors::STALE_REF);
+    assert_eq!(
+        error.to_string(),
+        "ref @e12 is from snapshot 1, the page is now at snapshot 3"
+    );
+}
+
+#[test]
+fn messages_are_lowercase_and_unpunctuated() {
+    for error in every_variant() {
+        let rendered = error.to_string();
+        let first = rendered.chars().next().expect("a message");
+
+        assert!(
+            !first.is_uppercase(),
+            "{rendered} starts with a capital letter"
+        );
+        assert!(!rendered.ends_with('.'), "{rendered} ends with a full stop");
+    }
+}
+
+/// One of every variant, so the mapping tests cannot miss a new one.
+fn every_variant() -> Vec<Error> {
+    vec![
+        Error::invalid_input("bad url"),
+        Error::NoSuchSession {
+            id: "s-1".to_string(),
+        },
+        Error::NoSuchElement {
+            target: "@e1".to_string(),
+        },
+        Error::StaleRef {
+            reference: "e1".to_string(),
+            minted: 1,
+            current: 2,
+        },
+        Error::not_actionable("covered by a banner"),
+        Error::timeout("navigate", 30_000),
+        Error::BlockedByPolicy {
+            url: "https://evil.test/".to_string(),
+        },
+        Error::browser_unavailable("no chrome on this host"),
+        Error::page("ReferenceError: x is not defined"),
+        Error::NoSuchOutput {
+            id: "o-1".to_string(),
+        },
+        Error::LimitExceeded {
+            message: "too many sessions".to_string(),
+        },
+        Error::connection_lost("websocket closed"),
+        Error::failed("something else"),
+    ]
+}
diff --git a/crates/tinybrowser/src/extract/mod.rs b/crates/tinybrowser/src/extract/mod.rs
new file mode 100644
index 0000000..91e0185
--- /dev/null
+++ b/crates/tinybrowser/src/extract/mod.rs
@@ -0,0 +1,132 @@
+//! Reading a page as something a model can consume.
+//!
+//! # Layout
+//!
+//! - [`script`] — the traversal, which runs in the page.
+
+pub(crate) mod script;
+
+use serde_json::{Value, json};
+use tinybrowser_bus::{PageText, ReadFormat, ReadRequest};
+
+use crate::error::{Error, Result};
+use crate::session::Session;
+
+/// Reads the session's active page.
+///
+/// # Errors
+///
+/// [`Error::NoSuchElement`] when `request.selector` matches nothing,
+/// [`Error::PageError`] when the page cannot be traversed, and
+/// [`Error::Timeout`] when it does not answer in time.
+pub(crate) async fn read(session: &Session, request: &ReadRequest) -> Result<PageText> {
+    let page = session.page_state().await?;
+    let deadline = session.deadline(None);
+
+    let content = match request.format {
+        ReadFormat::Html => html(session, request.selector.as_deref(), deadline).await?,
+        ReadFormat::Text | ReadFormat::Markdown => {
+            match extract(session, request, deadline).await? {
+                Value::String(text) => text,
+                // The script answers null for two different situations, and a
+                // caller needs to tell them apart: a selector that matched
+                // nothing is the caller's to fix, while a document with no body
+                // is a page that is not ready — mid-navigation, most often —
+                // and is fixed by asking again.
+                Value::Null => {
+                    return Err(match &request.selector {
+                        Some(selector) => Error::NoSuchElement {
+                            target: selector.clone(),
+                        },
+                        None => Error::page(
+                            "the page has no document body to read yet; it may still be loading"
+                                .to_string(),
+                        ),
+                    });
+                }
+                other => other.to_string(),
+            }
+        }
+    };
+
+    let (content, truncated) = truncate(content, request.max_chars);
+
+    Ok(PageText {
+        url: page.url,
+        title: page.title,
+        format: request.format,
+        content,
+        truncated,
+    })
+}
+
+/// Runs the extraction script against the page.
+async fn extract(
+    session: &Session,
+    request: &ReadRequest,
+    deadline: std::time::Duration,
+) -> Result<Value> {
+    let format = match request.format {
+        ReadFormat::Markdown => "markdown",
+        _ => "text",
+    };
+
+    let expression = format!(
+        "({})({}, {})",
+        script::EXTRACT,
+        serde_json::to_string(format).unwrap_or_else(|_| "\"text\"".to_string()),
+        serde_json::to_string(&request.selector).unwrap_or_else(|_| "null".to_string()),
+    );
+
+    session.evaluate(&expression, false, deadline).await
+}
+
+/// Serialises the live DOM.
+async fn html(
+    session: &Session,
+    selector: Option<&str>,
+    deadline: std::time::Duration,
+) -> Result<String> {
+    let node = if let Some(selector) = selector {
+        super::interact::resolve::selector_node(session, selector).await?
+    } else {
+        let document = session
+            .send("DOM.getDocument", json!({ "depth": 0 }))
+            .await?;
+        document
+            .get("root")
+            .and_then(|root| root.get("backendNodeId"))
+            .and_then(Value::as_i64)
+            .ok_or_else(|| Error::page("page has no document".to_string()))?
+    };
+
+    let outer = session
+        .send_with_timeout(
+            "DOM.getOuterHTML",
+            json!({ "backendNodeId": node }),
+            deadline,
+        )
+        .await?;
+
+    Ok(outer
+        .get("outerHTML")
+        .and_then(Value::as_str)
+        .unwrap_or_default()
+        .to_string())
+}
+
+/// Cuts `content` to `max_chars`, reporting whether anything was lost.
+///
+/// Counted in characters rather than bytes: a byte-wise cut through a multi-byte
+/// character produces invalid UTF-8, and the limit exists to bound what a model
+/// reads, which is not measured in bytes either.
+pub(crate) fn truncate(content: String, max_chars: usize) -> (String, bool) {
+    if content.chars().count() <= max_chars {
+        return (content, false);
+    }
+
+    (content.chars().take(max_chars).collect(), true)
+}
+
+#[cfg(test)]
+mod test;
diff --git a/crates/tinybrowser/src/extract/script.rs b/crates/tinybrowser/src/extract/script.rs
new file mode 100644
index 0000000..7a2374d
--- /dev/null
+++ b/crates/tinybrowser/src/extract/script.rs
@@ -0,0 +1,100 @@
+//! The extraction script.
+//!
+//! # Why this runs in the page rather than over the DOM protocol
+//!
+//! Extraction needs the rendered result: what is visible, in what order, with
+//! which text. CDP could walk the DOM node by node, but every question worth
+//! asking — is this displayed, is this the article or the cookie banner, does
+//! this heading precede that paragraph — is a computed-style or layout question,
+//! and each one would be a protocol round trip. In the page it is one call and
+//! one traversal.
+
+/// Extracts the page, or a subtree of it, as text or Markdown.
+///
+/// Returns a string. The Markdown it produces is deliberately plain — headings,
+/// links, list items, code, and paragraphs — because it is read by a model
+/// rather than rendered. Anything more elaborate spends tokens on syntax.
+pub(crate) const EXTRACT: &str = r"
+function (format, selector) {
+  const root = selector ? document.querySelector(selector) : document.body;
+  if (!root) return null;
+
+  const SKIP = new Set(['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEMPLATE', 'SVG', 'CANVAS', 'IFRAME']);
+  const BLOCK = new Set([
+    'P', 'DIV', 'SECTION', 'ARTICLE', 'HEADER', 'FOOTER', 'MAIN', 'ASIDE', 'NAV',
+    'UL', 'OL', 'LI', 'TABLE', 'TR', 'BLOCKQUOTE', 'PRE', 'FIGURE', 'FORM', 'BR', 'HR',
+  ]);
+
+  const hidden = (node) => {
+    const style = window.getComputedStyle(node);
+    return style.display === 'none' || style.visibility === 'hidden' || node.hidden;
+  };
+
+  const out = [];
+  const push = (text) => {
+    const trimmed = text.replace(/[ \t]+/g, ' ').trim();
+    if (trimmed) out.push(trimmed);
+  };
+
+  const walk = (node, depth) => {
+    if (node.nodeType === Node.TEXT_NODE) {
+      push(node.nodeValue);
+      return;
+    }
+    if (node.nodeType !== Node.ELEMENT_NODE) return;
+    if (SKIP.has(node.tagName)) return;
+    if (hidden(node)) return;
+
+    const tag = node.tagName;
+
+    if (format === 'markdown') {
+      if (/^H[1-6]$/.test(tag)) {
+        push('\n' + '#'.repeat(Number(tag[1])) + ' ' + node.innerText.trim() + '\n');
+        return;
+      }
+      if (tag === 'A') {
+        const href = node.getAttribute('href');
+        const text = node.innerText.trim();
+        if (text) push(href ? '[' + text + '](' + node.href + ')' : text);
+        return;
+      }
+      if (tag === 'LI') {
+        push('- ' + node.innerText.trim().replace(/\n+/g, ' '));
+        return;
+      }
+      if (tag === 'PRE') {
+        push('\n```\n' + node.innerText.replace(/\n+$/, '') + '\n```\n');
+        return;
+      }
+      if (tag === 'CODE' && node.parentElement && node.parentElement.tagName !== 'PRE') {
+        push('`' + node.innerText.trim() + '`');
+        return;
+      }
+      if (tag === 'IMG') {
+        const alt = node.getAttribute('alt');
+        if (alt) push('![' + alt + '](' + node.src + ')');
+        return;
+      }
+      if (tag === 'BLOCKQUOTE') {
+        push('> ' + node.innerText.trim().replace(/\n+/g, '\n> '));
+        return;
+      }
+    }
+
+    // A depth bound rather than a visited set: this walks a tree, so it cannot
+    // cycle, but a pathological page can nest thousands of divs and blow the
+    // stack on the way down.
+    if (depth > 200) return;
+
+    for (const child of node.childNodes) walk(child, depth + 1);
+    if (BLOCK.has(tag)) out.push('');
+  };
+
+  walk(root, 0);
+
+  return out
+    .join('\n')
+    .replace(/\n{3,}/g, '\n\n')
+    .trim();
+}
+";
diff --git a/crates/tinybrowser/src/extract/test.rs b/crates/tinybrowser/src/extract/test.rs
new file mode 100644
index 0000000..49fb03e
--- /dev/null
+++ b/crates/tinybrowser/src/extract/test.rs
@@ -0,0 +1,62 @@
+//! Tests for extraction.
+//!
+//! The traversal runs in the page, so what is testable here is the boundary
+//! around it: the truncation that decides how much of a page a model sees.
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use super::truncate;
+
+#[test]
+fn content_within_the_limit_is_untouched() {
+    let (content, truncated) = truncate("hello".to_string(), 200_000);
+
+    assert_eq!(content, "hello");
+    assert!(!truncated);
+}
+
+#[test]
+fn content_exactly_at_the_limit_is_not_truncated() {
+    let (content, truncated) = truncate("hello".to_string(), 5);
+
+    assert_eq!(content, "hello");
+    assert!(!truncated);
+}
+
+#[test]
+fn content_over_the_limit_is_cut_and_reported() {
+    // Reporting matters as much as cutting: a model shown a truncated page
+    // without being told will conclude the rest of it does not exist.
+    let (content, truncated) = truncate("hello world".to_string(), 5);
+
+    assert_eq!(content, "hello");
+    assert!(truncated);
+}
+
+#[test]
+fn truncation_counts_characters_not_bytes() {
+    // A byte-wise cut through a multi-byte character produces invalid UTF-8,
+    // which would fail to serialize onto the bus rather than returning a short
+    // string.
+    let (content, truncated) = truncate("héllo wörld".to_string(), 5);
+
+    assert_eq!(content, "héllo");
+    assert!(truncated);
+    assert_eq!(content.chars().count(), 5);
+}
+
+#[test]
+fn a_zero_limit_yields_nothing_rather_than_panicking() {
+    let (content, truncated) = truncate("hello".to_string(), 0);
+
+    assert!(content.is_empty());
+    assert!(truncated);
+}
+
+#[test]
+fn empty_content_is_never_truncated() {
+    let (content, truncated) = truncate(String::new(), 0);
+
+    assert!(content.is_empty());
+    assert!(!truncated);
+}
diff --git a/crates/tinybrowser/src/interact/keys.rs b/crates/tinybrowser/src/interact/keys.rs
new file mode 100644
index 0000000..871742e
--- /dev/null
+++ b/crates/tinybrowser/src/interact/keys.rs
@@ -0,0 +1,188 @@
+//! Turning `Control+Shift+Enter` into the key events a browser believes.
+//!
+//! # Why a table and not a passthrough
+//!
+//! `Input.dispatchKeyEvent` wants four things that have to agree: the `key`
+//! (what the character is), the `code` (which physical key it sits on), the
+//! legacy `windowsVirtualKeyCode`, and the `text` a keypress inserts. Pages
+//! still read all four — a form that submits on Enter usually checks `keyCode`,
+//! and a shortcut library usually checks `code` — so a dispatch that fills in
+//! only `key` works on some sites and silently does nothing on others.
+//!
+//! The table below is small because the set of keys an agent presses is small.
+//! Anything not in it that is a single character is derived, which covers the
+//! rest of typing without enumerating a keyboard layout this module has no way
+//! to know.
+
+use crate::error::{Error, Result};
+
+/// The modifier bits `Input.dispatchKeyEvent` expects.
+const ALT: u8 = 1;
+const CONTROL: u8 = 2;
+const META: u8 = 4;
+const SHIFT: u8 = 8;
+
+/// One key press, resolved into everything the protocol needs.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct KeyStroke {
+    /// The modifier bitmask.
+    pub(crate) modifiers: u8,
+    /// The `key` value, as a `KeyboardEvent` would report it.
+    pub(crate) key: String,
+    /// The physical key `code`.
+    pub(crate) code: String,
+    /// The legacy virtual key code.
+    pub(crate) key_code: u32,
+    /// The text this press inserts, absent for a key that inserts nothing.
+    pub(crate) text: Option<String>,
+}
+
+/// The named keys, with the four values that have to agree.
+const NAMED: &[(&str, &str, &str, u32, Option<&str>)] = &[
+    ("enter", "Enter", "Enter", 13, Some("\r")),
+    ("tab", "Tab", "Tab", 9, Some("\t")),
+    ("escape", "Escape", "Escape", 27, None),
+    ("esc", "Escape", "Escape", 27, None),
+    ("backspace", "Backspace", "Backspace", 8, None),
+    ("delete", "Delete", "Delete", 46, None),
+    ("space", " ", "Space", 32, Some(" ")),
+    ("arrowup", "ArrowUp", "ArrowUp", 38, None),
+    ("arrowdown", "ArrowDown", "ArrowDown", 40, None),
+    ("arrowleft", "ArrowLeft", "ArrowLeft", 37, None),
+    ("arrowright", "ArrowRight", "ArrowRight", 39, None),
+    ("up", "ArrowUp", "ArrowUp", 38, None),
+    ("down", "ArrowDown", "ArrowDown", 40, None),
+    ("left", "ArrowLeft", "ArrowLeft", 37, None),
+    ("right", "ArrowRight", "ArrowRight", 39, None),
+    ("home", "Home", "Home", 36, None),
+    ("end", "End", "End", 35, None),
+    ("pageup", "PageUp", "PageUp", 33, None),
+    ("pagedown", "PageDown", "PageDown", 34, None),
+];
+
+/// Reads a key or chord such as `Enter`, `a`, or `Control+Shift+Tab`.
+///
+/// # Errors
+///
+/// [`Error::InvalidInput`] when the chord is empty, names an unknown modifier,
+/// or ends in something that is neither a named key nor a single character.
+pub(crate) fn parse(chord: &str) -> Result<KeyStroke> {
+    let chord = chord.trim();
+    if chord.is_empty() {
+        return Err(Error::invalid_input("key is empty"));
+    }
+
+    // Split on `+`, but not when `+` *is* the key: `Control++` means control
+    // plus the plus key, and splitting naively leaves an empty final part.
+    let parts: Vec<&str> = if chord.ends_with("++") {
+        let mut parts: Vec<&str> = chord[..chord.len() - 1].split('+').collect();
+        parts.pop();
+        parts.push("+");
+        parts
+    } else {
+        chord.split('+').collect()
+    };
+
+    let (last, modifiers) = parts.split_last().unwrap_or((&"", &[]));
+
+    let mut mask = 0;
+    for modifier in modifiers {
+        mask |= match modifier.trim().to_ascii_lowercase().as_str() {
+            "control" | "ctrl" => CONTROL,
+            "shift" => SHIFT,
+            "alt" | "option" => ALT,
+            "meta" | "command" | "cmd" | "super" => META,
+            other => {
+                return Err(Error::invalid_input(format!(
+                    "{other} is not a modifier; use control, shift, alt, or meta"
+                )));
+            }
+        };
+    }
+
+    let key = last.trim();
+    if key.is_empty() {
+        return Err(Error::invalid_input(format!(
+            "{chord} names modifiers but no key"
+        )));
+    }
+
+    let lowered = key.to_ascii_lowercase();
+    if let Some((_, key, code, key_code, text)) = NAMED.iter().find(|(name, ..)| *name == lowered) {
+        return Ok(KeyStroke {
+            modifiers: mask,
+            key: (*key).to_string(),
+            code: (*code).to_string(),
+            key_code: *key_code,
+            // A modified press inserts nothing: `Control+Enter` submits a form,
+            // it does not type a carriage return into it.
+            text: if mask & !SHIFT == 0 {
+                text.map(str::to_string)
+            } else {
+                None
+            },
+        });
+    }
+
+    let mut characters = key.chars();
+    let (Some(character), None) = (characters.next(), characters.next()) else {
+        return Err(Error::invalid_input(format!(
+            "{key} is not a known key name or a single character"
+        )));
+    };
+
+    Ok(KeyStroke {
+        modifiers: mask,
+        key: character.to_string(),
+        code: code_for(character),
+        key_code: virtual_code(character),
+        text: if mask & !SHIFT == 0 {
+            Some(character.to_string())
+        } else {
+            None
+        },
+    })
+}
+
+/// The physical key a character sits on, for the US layout Chrome assumes.
+fn code_for(character: char) -> String {
+    if character.is_ascii_alphabetic() {
+        return format!("Key{}", character.to_ascii_uppercase());
+    }
+    if character.is_ascii_digit() {
+        return format!("Digit{character}");
+    }
+
+    // No arm for a space: `parse` trims its input, so a space only ever arrives
+    // as the name `Space`, which the table above answers before reaching here.
+    match character {
+        '-' => "Minus".to_string(),
+        '=' => "Equal".to_string(),
+        '.' => "Period".to_string(),
+        ',' => "Comma".to_string(),
+        '/' => "Slash".to_string(),
+        ';' => "Semicolon".to_string(),
+        '\'' => "Quote".to_string(),
+        '[' => "BracketLeft".to_string(),
+        ']' => "BracketRight".to_string(),
+        '\\' => "Backslash".to_string(),
+        '`' => "Backquote".to_string(),
+        // Everything else — an accented letter, a symbol from another layout —
+        // gets no code rather than a wrong one. A page that reads `code` will
+        // see it as unidentified, which is honest; a page that reads `key`, as
+        // most do, is unaffected.
+        _ => String::new(),
+    }
+}
+
+/// The legacy virtual key code a character reports.
+///
+/// Zero for anything but a letter or a digit: there is no correct legacy code
+/// for punctuation without knowing the keyboard layout, and a plausible-looking
+/// wrong one is worse than an unidentified key.
+fn virtual_code(character: char) -> u32 {
+    if character.is_ascii_alphanumeric() {
+        return u32::from(character.to_ascii_uppercase() as u8);
+    }
+    0
+}
diff --git a/crates/tinybrowser/src/interact/mod.rs b/crates/tinybrowser/src/interact/mod.rs
new file mode 100644
index 0000000..ceb0f53
--- /dev/null
+++ b/crates/tinybrowser/src/interact/mod.rs
@@ -0,0 +1,563 @@
+//! Performing one interaction against a page.
+//!
+//! # The shape every action shares
+//!
+//! Resolve the target, do the thing, report where the page ended up. That last
+//! part is why every action returns a [`ActionOutcome`] carrying page state a
+//! caller did not ask for: an agent that clicks a link and then has to make a
+//! second call to discover it navigated will sometimes not make that call, and
+//! will then reason about the previous page.
+//!
+//! # Real input events, not synthetic ones
+//!
+//! Clicks and keystrokes go through `Input.dispatchMouseEvent` and
+//! `Input.dispatchKeyEvent` — the same path a physical device takes — rather
+//! than through `element.click()` or an assignment to `value`. The synthetic
+//! versions skip hit testing, skip the events a framework listens for, and work
+//! on elements a person could not reach, which makes them useful for driving a
+//! page and useless for checking one. Every place this crate departs from that —
+//! [`crate::interact::script::SELECT_OPTIONS`] is the main one — is a place
+//! where the protocol has no input path at all.
+//!
+//! # Layout
+//!
+//! - [`resolve`] — target to node.
+//! - [`keys`] — chord to key events.
+//! - [`script`] — the JavaScript that answers what only the page knows.
+
+pub(crate) mod keys;
+pub(crate) mod resolve;
+pub(crate) mod script;
+
+use std::time::Duration;
+
+use serde_json::{Value, json};
+use tinybrowser_bus::{Action, ActionOutcome, ScrollDirection, Target, WaitState};
+
+use crate::error::{Error, Result};
+use crate::session::Session;
+
+/// How often to re-test a condition while waiting for it.
+///
+/// Fast enough that a wait does not add a visible pause to a page that is
+/// already ready, slow enough that a long wait is not a hot loop of protocol
+/// round trips.
+const POLL_INTERVAL: Duration = Duration::from_millis(100);
+
+/// Performs `action` and reports what it did.
+///
+/// # Errors
+///
+/// Any of [`Error::NoSuchElement`], [`Error::StaleRef`],
+/// [`Error::NotActionable`], [`Error::PageError`], or [`Error::Timeout`],
+/// depending on the action and where it failed.
+pub(crate) async fn perform(session: &Session, action: &Action) -> Result<ActionOutcome> {
+    match action {
+        Action::Click { target, new_tab } => {
+            click(session, target, *new_tab, 1).await?;
+            acted(session, Some(target)).await
+        }
+        Action::DoubleClick { target } => {
+            click(session, target, false, 2).await?;
+            acted(session, Some(target)).await
+        }
+        Action::Hover { target } => {
+            hover(session, target).await?;
+            acted(session, Some(target)).await
+        }
+        Action::Focus { target } => {
+            focus(session, target).await?;
+            acted(session, Some(target)).await
+        }
+        Action::Fill { target, value } => {
+            fill(session, target, value).await?;
+            acted(session, Some(target)).await
+        }
+        Action::Type {
+            target,
+            text,
+            delay_ms,
+        } => {
+            if let Some(target) = target {
+                focus(session, target).await?;
+            }
+            type_text(session, text, *delay_ms).await?;
+            acted(session, target.as_ref()).await
+        }
+        Action::Press { key } => {
+            press(session, key).await?;
+            acted(session, None).await
+        }
+        Action::Select { target, values } => {
+            select(session, target, values).await?;
+            acted(session, Some(target)).await
+        }
+        Action::Check { target, checked } => {
+            check(session, target, *checked).await?;
+            acted(session, Some(target)).await
+        }
+        Action::Scroll {
+            direction,
+            pixels,
+            target,
+        } => {
+            scroll(session, *direction, *pixels, target.as_ref()).await?;
+            acted(session, target.as_ref()).await
+        }
+        Action::GetText { target } => {
+            let text = on_node(session, target, script::TEXT, Vec::new()).await?;
+            read(session, target, text).await
+        }
+        Action::GetAttribute { target, attribute } => {
+            let value = on_node(session, target, script::ATTRIBUTE, vec![json!(attribute)]).await?;
+            read(session, target, value).await
+        }
+        Action::IsVisible { target } => {
+            let visible = is_visible(session, target).await;
+            read(session, target, Value::Bool(visible)).await
+        }
+        Action::WaitFor {
+            target,
+            text,
+            state,
+            ms,
+            timeout_ms,
+        } => {
+            wait_for(
+                session,
+                target.as_ref(),
+                text.as_deref(),
+                *state,
+                *ms,
+                *timeout_ms,
+            )
+            .await?;
+            acted(session, target.as_ref()).await
+        }
+        Action::Back => history(session, -1).await,
+        Action::Forward => history(session, 1).await,
+        Action::Reload => reload(session).await,
+    }
+}
+
+/// Runs one of the [`script`] functions against a target.
+async fn on_node(
+    session: &Session,
+    target: &Target,
+    function: &str,
+    args: Vec<Value>,
+) -> Result<Value> {
+    let node = resolve::resolve(session, target).await?;
+    session
+        .call_on_node(node, function, args, session.deadline(None))
+        .await
+}
+
+/// Moves the pointer over an element, firing the handlers a menu needs.
+async fn hover(session: &Session, target: &Target) -> Result<()> {
+    let (x, y) = click_point(session, target).await?;
+    session
+        .send(
+            "Input.dispatchMouseEvent",
+            json!({ "type": "mouseMoved", "x": x, "y": y }),
+        )
+        .await?;
+    Ok(())
+}
+
+/// Gives an element keyboard focus without clicking it.
+async fn focus(session: &Session, target: &Target) -> Result<()> {
+    let node = resolve::resolve(session, target).await?;
+    session
+        .send("DOM.focus", json!({ "backendNodeId": node }))
+        .await?;
+    Ok(())
+}
+
+/// Chooses options in a `<select>`.
+async fn select(session: &Session, target: &Target, values: &[String]) -> Result<()> {
+    on_node(session, target, script::SELECT_OPTIONS, vec![json!(values)]).await?;
+    Ok(())
+}
+
+/// Leaves a checkbox or radio in the wanted state.
+async fn check(session: &Session, target: &Target, checked: bool) -> Result<()> {
+    let current = on_node(session, target, script::CHECKED, Vec::new()).await?;
+
+    // Clicking unconditionally would toggle a box that is already in the wanted
+    // state, which is the opposite of what was asked for.
+    if current.as_bool().unwrap_or(false) != checked {
+        click(session, target, false, 1).await?;
+    }
+    Ok(())
+}
+
+/// Whether a target is present and rendered.
+///
+/// A target that does not resolve is not visible; that is an answer, not a
+/// failure. Returning an error here would make the one action whose job is to
+/// test for absence unable to report it.
+async fn is_visible(session: &Session, target: &Target) -> bool {
+    on_node(session, target, script::IS_VISIBLE, Vec::new())
+        .await
+        .ok()
+        .and_then(|value| value.as_bool())
+        .unwrap_or(false)
+}
+
+/// Reloads the page and retires the refs the old document minted.
+async fn reload(session: &Session) -> Result<ActionOutcome> {
+    session.send("Page.reload", json!({})).await?;
+    retire_refs(session).await;
+    acted(session, None).await
+}
+
+/// Retires every outstanding ref, because the document they named is gone.
+async fn retire_refs(session: &Session) {
+    session
+        .refs()
+        .lock()
+        .await
+        .replace(std::collections::HashMap::new());
+}
+
+/// Scrolls to the element, checks nothing covers it, and dispatches a click.
+async fn click(session: &Session, target: &Target, new_tab: bool, count: u32) -> Result<()> {
+    let (x, y) = click_point(session, target).await?;
+
+    // Ctrl on Linux and Windows, Meta on macOS: this is the modifier that turns
+    // a click into "open in a new tab" on each platform, and the browser is on
+    // the same host as this module.
+    let modifiers = if new_tab {
+        if cfg!(target_os = "macos") { 4 } else { 2 }
+    } else {
+        0
+    };
+
+    // Subscribed before the click, so a navigation it starts is not missed by a
+    // subscription opened after the fact, and the current URL sampled with it so
+    // the new document can be told from the old one.
+    let events = session.events();
+    let before = session.document_status().await.map(|(href, _)| href);
+
+    for kind in ["mousePressed", "mouseReleased"] {
+        session
+            .send(
+                "Input.dispatchMouseEvent",
+                json!({
+                    "type": kind,
+                    "x": x,
+                    "y": y,
+                    "button": "left",
+                    "clickCount": count,
+                    "modifiers": modifiers,
+                }),
+            )
+            .await?;
+    }
+
+    session.settle_after_input(events, before.as_deref()).await;
+    Ok(())
+}
+
+/// Where a target can be clicked, or why it cannot be.
+async fn click_point(session: &Session, target: &Target) -> Result<(f64, f64)> {
+    let node = resolve::resolve(session, target).await?;
+    let point = session
+        .call_on_node(
+            node,
+            script::CLICK_POINT,
+            Vec::new(),
+            session.deadline(None),
+        )
+        .await?;
+
+    if point.get("ok").and_then(Value::as_bool) != Some(true) {
+        let reason = point
+            .get("reason")
+            .and_then(Value::as_str)
+            .unwrap_or("element cannot be clicked");
+        return Err(Error::not_actionable(format!(
+            "{}: {reason}",
+            resolve::describe_target(target)
+        )));
+    }
+
+    let (Some(x), Some(y)) = (
+        point.get("x").and_then(Value::as_f64),
+        point.get("y").and_then(Value::as_f64),
+    ) else {
+        return Err(Error::not_actionable(format!(
+            "{}: browser reported no click point",
+            resolve::describe_target(target)
+        )));
+    };
+
+    Ok((x, y))
+}
+
+/// Clears a field and types a value into it.
+async fn fill(session: &Session, target: &Target, value: &str) -> Result<()> {
+    let node = resolve::resolve(session, target).await?;
+
+    session
+        .send("DOM.focus", json!({ "backendNodeId": node }))
+        .await?;
+    session
+        .call_on_node(node, script::SELECT_ALL, Vec::new(), session.deadline(None))
+        .await?;
+
+    if value.is_empty() {
+        // `insertText` with an empty string is a no-op, so the selection would
+        // survive and the field would keep its old value.
+        return press(session, "Delete").await;
+    }
+
+    session
+        .send("Input.insertText", json!({ "text": value }))
+        .await?;
+    Ok(())
+}
+
+/// Types text, either in one insertion or key by key.
+async fn type_text(session: &Session, text: &str, delay_ms: Option<u64>) -> Result<()> {
+    let Some(delay) = delay_ms else {
+        // One insertion is both faster and closer to a paste, which is what most
+        // fields want. Per-key events are for the fields that react to each one.
+        session
+            .send("Input.insertText", json!({ "text": text }))
+            .await?;
+        return Ok(());
+    };
+
+    for character in text.chars() {
+        press(session, &character.to_string()).await?;
+        if delay > 0 {
+            tokio::time::sleep(Duration::from_millis(delay)).await;
+        }
+    }
+    Ok(())
+}
+
+/// Presses a key or chord.
+async fn press(session: &Session, chord: &str) -> Result<()> {
+    let stroke = keys::parse(chord)?;
+
+    // Pressing Enter in a form submits it, which is a navigation as much as a
+    // click on the submit button is.
+    let events = session.events();
+    let before = session.document_status().await.map(|(href, _)| href);
+
+    for kind in ["keyDown", "keyUp"] {
+        let mut params = json!({
+            "type": kind,
+            "modifiers": stroke.modifiers,
+            "key": stroke.key,
+            "code": stroke.code,
+            "windowsVirtualKeyCode": stroke.key_code,
+            "nativeVirtualKeyCode": stroke.key_code,
+        });
+
+        // `text` on a keyUp would insert the character a second time.
+        //
+        // `unmodifiedText` is not decoration: Blink decides whether a key press
+        // performs its *default action* — submitting a form on Enter, most
+        // visibly — from that field rather than from `key`. Without it the event
+        // reaches the page's own handlers and does nothing else, so an agent
+        // pressing Enter in a search box watches the keydown fire and the form
+        // never submit.
+        if kind == "keyDown"
+            && let Some(text) = &stroke.text
+        {
+            params["text"] = json!(text);
+            params["unmodifiedText"] = json!(text);
+        }
+
+        session.send("Input.dispatchKeyEvent", params).await?;
+    }
+
+    session.settle_after_input(events, before.as_deref()).await;
+    Ok(())
+}
+
+/// Scrolls the page, or an element within it.
+async fn scroll(
+    session: &Session,
+    direction: ScrollDirection,
+    pixels: Option<u32>,
+    target: Option<&Target>,
+) -> Result<()> {
+    let distance = f64::from(pixels.unwrap_or(0));
+    let viewport = f64::from(session.options().viewport.height);
+    let step = if distance > 0.0 { distance } else { viewport };
+
+    let (x, y) = match direction {
+        ScrollDirection::Down => (0.0, step),
+        ScrollDirection::Up => (0.0, -step),
+        ScrollDirection::Right => (step, 0.0),
+        ScrollDirection::Left => (-step, 0.0),
+        // A very large number rather than `scrollTo`: the same JavaScript then
+        // serves both the page and an element, and every scroll container
+        // clamps to its own extent.
+        ScrollDirection::Bottom => (0.0, f64::from(i32::MAX)),
+        ScrollDirection::Top => (0.0, f64::from(i32::MIN)),
+    };
+
+    match target {
+        Some(target) => {
+            let node = resolve::resolve(session, target).await?;
+            session
+                .call_on_node(
+                    node,
+                    script::SCROLL_BY,
+                    vec![json!(x), json!(y)],
+                    session.deadline(None),
+                )
+                .await?;
+        }
+        None => {
+            session
+                .evaluate(
+                    &format!("(window.scrollBy({x}, {y}), true)"),
+                    false,
+                    session.deadline(None),
+                )
+                .await?;
+        }
+    }
+
+    Ok(())
+}
+
+/// Blocks until a condition holds, or the deadline expires.
+async fn wait_for(
+    session: &Session,
+    target: Option<&Target>,
+    text: Option<&str>,
+    state: WaitState,
+    ms: Option<u64>,
+    timeout_ms: Option<u64>,
+) -> Result<()> {
+    // A flat delay is the only thing a caller with neither a target nor text can
+    // have meant, and it is occasionally the honest answer for an animation
+    // nothing else observes.
+    if target.is_none() && text.is_none() {
+        tokio::time::sleep(Duration::from_millis(ms.unwrap_or(0))).await;
+        return Ok(());
+    }
+
+    let deadline = session.deadline(timeout_ms);
+    let condition = async {
+        loop {
+            if let Some(target) = target {
+                let holds = match resolve::resolve(session, target).await {
+                    Ok(node) => match state {
+                        WaitState::Attached => true,
+                        WaitState::Detached => false,
+                        WaitState::Visible | WaitState::Hidden => {
+                            let visible = session
+                                .call_on_node(
+                                    node,
+                                    script::IS_VISIBLE,
+                                    Vec::new(),
+                                    session.deadline(None),
+                                )
+                                .await
+                                .ok()
+                                .and_then(|value| value.as_bool())
+                                .unwrap_or(false);
+                            (state == WaitState::Visible) == visible
+                        }
+                    },
+                    // Not resolving satisfies exactly the two absence states.
+                    Err(_) => matches!(state, WaitState::Detached | WaitState::Hidden),
+                };
+
+                if holds {
+                    return Ok(());
+                }
+            }
+
+            if let Some(text) = text {
+                let expression = format!(
+                    "document.body ? document.body.innerText.includes({}) : false",
+                    serde_json::to_string(text).unwrap_or_else(|_| "\"\"".to_string())
+                );
+                if session
+                    .evaluate(&expression, false, session.deadline(None))
+                    .await?
+                    .as_bool()
+                    == Some(true)
+                {
+                    return Ok(());
+                }
+            }
+
+            tokio::time::sleep(POLL_INTERVAL).await;
+        }
+    };
+
+    match tokio::time::timeout(deadline, condition).await {
+        Ok(result) => result,
+        Err(_) => Err(Error::timeout(
+            "wait_for",
+            u64::try_from(deadline.as_millis()).unwrap_or(u64::MAX),
+        )),
+    }
+}
+
+/// Moves `offset` entries through the session's history.
+async fn history(session: &Session, offset: i64) -> Result<ActionOutcome> {
+    let history = session.send("Page.getNavigationHistory", json!({})).await?;
+
+    let current = history
+        .get("currentIndex")
+        .and_then(Value::as_i64)
+        .unwrap_or(0);
+    let entries = history
+        .get("entries")
+        .and_then(Value::as_array)
+        .map_or(0, Vec::len);
+
+    let wanted = current + offset;
+    if wanted < 0 || usize::try_from(wanted).unwrap_or(usize::MAX) >= entries {
+        return Err(Error::invalid_input(if offset < 0 {
+            "there is nothing to go back to"
+        } else {
+            "there is nothing to go forward to"
+        }));
+    }
+
+    let entry = history
+        .get("entries")
+        .and_then(Value::as_array)
+        .and_then(|entries| entries.get(usize::try_from(wanted).unwrap_or(0)))
+        .and_then(|entry| entry.get("id"))
+        .and_then(Value::as_i64)
+        .ok_or_else(|| Error::page("history entry has no id".to_string()))?;
+
+    session
+        .send("Page.navigateToHistoryEntry", json!({ "entryId": entry }))
+        .await?;
+    retire_refs(session).await;
+
+    acted(session, None).await
+}
+
+/// An outcome for an action that only acted.
+async fn acted(session: &Session, target: Option<&Target>) -> Result<ActionOutcome> {
+    let outcome = ActionOutcome::acted(session.page_state().await?);
+    Ok(match target {
+        Some(target) => outcome.matching(resolve::describe_target(target)),
+        None => outcome,
+    })
+}
+
+/// An outcome for an action that read a value.
+async fn read(session: &Session, target: &Target, value: Value) -> Result<ActionOutcome> {
+    Ok(ActionOutcome::read(session.page_state().await?, value)
+        .matching(resolve::describe_target(target)))
+}
+
+#[cfg(test)]
+mod test;
diff --git a/crates/tinybrowser/src/interact/resolve.rs b/crates/tinybrowser/src/interact/resolve.rs
new file mode 100644
index 0000000..f8a35a9
--- /dev/null
+++ b/crates/tinybrowser/src/interact/resolve.rs
@@ -0,0 +1,210 @@
+//! Turning a [`Target`] into a node the browser can act on.
+//!
+//! All three target forms end at the same place — a backend node id, which is
+//! Chrome's stable handle for a DOM node — so every interaction resolves once
+//! here and then works against a node rather than re-running a selector for each
+//! step of what it is doing. That matters for more than tidiness: a click that
+//! re-queries between measuring the element and dispatching at it can measure
+//! one element and click another.
+
+// Writing into a `String` cannot fail, so every `write!` below discards its
+// result rather than propagating an error that does not exist.
+use std::fmt::Write as _;
+
+use serde_json::{Value, json};
+use tinybrowser_bus::{LocateBy, Locator, Target};
+
+use crate::error::{Error, Result};
+use crate::session::Session;
+
+use super::script;
+
+/// Resolves `target` to a backend node id.
+///
+/// # Errors
+///
+/// [`Error::StaleRef`] for a ref from an earlier snapshot,
+/// [`Error::NoSuchElement`] when nothing matches, and [`Error::PageError`] when
+/// the page rejects the query — an invalid CSS selector, most often.
+pub(crate) async fn resolve(session: &Session, target: &Target) -> Result<i64> {
+    match target {
+        Target::Ref { value } => {
+            let map = session.refs().lock().await;
+            map.resolve(value)
+        }
+        Target::Selector { value } => selector_node(session, value).await,
+        Target::Locator { value } => locator_node(session, value).await,
+    }
+}
+
+/// Resolves the first element matching `selector`.
+///
+/// # Errors
+///
+/// [`Error::NoSuchElement`] when nothing matches, and [`Error::PageError`] when
+/// the selector is not valid CSS.
+pub(crate) async fn selector_node(session: &Session, selector: &str) -> Result<i64> {
+    let expression = format!(
+        "document.querySelector({})",
+        serde_json::to_string(selector).unwrap_or_else(|_| "null".to_string())
+    );
+
+    let object = evaluate_to_object(session, &expression)
+        .await
+        .map_err(|error| {
+            // An invalid selector throws `SyntaxError` inside the page. Reported as
+            // a page error it looks like the site's fault; reported as invalid input
+            // it says what it is, which is that the caller wrote a bad selector.
+            if error.to_string().contains("SyntaxError") {
+                Error::invalid_input(format!("{selector} is not a valid css selector"))
+            } else {
+                error
+            }
+        })?;
+
+    match object {
+        Some(object_id) => describe(session, &object_id).await,
+        None => Err(Error::NoSuchElement {
+            target: selector.to_string(),
+        }),
+    }
+}
+
+/// Resolves an element named semantically.
+///
+/// # Errors
+///
+/// [`Error::NoSuchElement`] when nothing matches, and [`Error::InvalidInput`]
+/// when the locator is empty.
+async fn locator_node(session: &Session, locator: &Locator) -> Result<i64> {
+    if locator.value.trim().is_empty() {
+        return Err(Error::invalid_input("locator value is empty"));
+    }
+
+    let arguments = [
+        json!(dimension(locator.by)),
+        json!(locator.value),
+        json!(locator.name),
+        json!(locator.exact),
+        json!(locator.index),
+    ];
+
+    // Called on `document` rather than on a node: there is no element yet, and
+    // `callFunctionOn` needs something to be `this`.
+    let document = evaluate_to_object(session, "document")
+        .await?
+        .ok_or_else(|| Error::page("page has no document".to_string()))?;
+
+    let found = session
+        .send_with_timeout(
+            "Runtime.callFunctionOn",
+            json!({
+                "objectId": document,
+                "functionDeclaration": script::LOCATE,
+                "arguments": arguments.iter().map(|value| json!({ "value": value })).collect::<Vec<_>>(),
+                "returnByValue": false,
+            }),
+            session.deadline(None),
+        )
+        .await?;
+
+    let _ = session
+        .send("Runtime.releaseObject", json!({ "objectId": document }))
+        .await;
+
+    let object_id = object_id_of(&found);
+    match object_id {
+        Some(object_id) => describe(session, &object_id).await,
+        None => Err(Error::NoSuchElement {
+            target: describe_locator(locator),
+        }),
+    }
+}
+
+/// Evaluates `expression` and returns the object id of its result, or `None`
+/// when it evaluated to null or undefined.
+async fn evaluate_to_object(session: &Session, expression: &str) -> Result<Option<String>> {
+    let result = session
+        .send_with_timeout(
+            "Runtime.evaluate",
+            json!({ "expression": expression, "returnByValue": false }),
+            session.deadline(None),
+        )
+        .await?;
+
+    if let Some(details) = result.get("exceptionDetails") {
+        let message = details
+            .get("exception")
+            .and_then(|exception| exception.get("description"))
+            .and_then(Value::as_str)
+            .unwrap_or("uncaught exception");
+        return Err(Error::page(message.to_string()));
+    }
+
+    Ok(object_id_of(&result))
+}
+
+/// The object id in a `Runtime` result, when it names a live object.
+///
+/// A result of `null` still carries a `result` object — with `subtype: "null"`
+/// and no `objectId` — so the presence of the field, not of the result, is what
+/// distinguishes "found nothing" from "found something".
+fn object_id_of(result: &Value) -> Option<String> {
+    result
+        .get("result")
+        .and_then(|inner| inner.get("objectId"))
+        .and_then(Value::as_str)
+        .map(str::to_string)
+}
+
+/// Turns a `Runtime` object id into a backend node id, releasing the handle.
+async fn describe(session: &Session, object_id: &str) -> Result<i64> {
+    let described = session
+        .send("DOM.describeNode", json!({ "objectId": object_id }))
+        .await;
+
+    let _ = session
+        .send("Runtime.releaseObject", json!({ "objectId": object_id }))
+        .await;
+
+    described?
+        .get("node")
+        .and_then(|node| node.get("backendNodeId"))
+        .and_then(Value::as_i64)
+        .ok_or_else(|| Error::page("browser described a node without an identity".to_string()))
+}
+
+/// The wire spelling of a locator dimension, matching what [`script::LOCATE`]
+/// switches on.
+pub(crate) fn dimension(by: LocateBy) -> &'static str {
+    match by {
+        LocateBy::Role => "role",
+        LocateBy::Text => "text",
+        LocateBy::Label => "label",
+        LocateBy::Placeholder => "placeholder",
+        LocateBy::TestId => "test_id",
+        LocateBy::AltText => "alt_text",
+        LocateBy::Title => "title",
+    }
+}
+
+/// How a locator reads in an error message.
+pub(crate) fn describe_locator(locator: &Locator) -> String {
+    let mut rendered = format!("{} {:?}", dimension(locator.by), locator.value);
+    if let Some(name) = &locator.name {
+        let _ = write!(rendered, " named {name:?}");
+    }
+    if locator.index > 0 {
+        let _ = write!(rendered, " at index {}", locator.index);
+    }
+    rendered
+}
+
+/// How a target reads in an error message or an outcome.
+pub(crate) fn describe_target(target: &Target) -> String {
+    match target {
+        Target::Ref { value } => format!("@{value}"),
+        Target::Selector { value } => value.clone(),
+        Target::Locator { value } => describe_locator(value),
+    }
+}
diff --git a/crates/tinybrowser/src/interact/script.rs b/crates/tinybrowser/src/interact/script.rs
new file mode 100644
index 0000000..071939e
--- /dev/null
+++ b/crates/tinybrowser/src/interact/script.rs
@@ -0,0 +1,241 @@
+//! The JavaScript this crate runs inside the page.
+//!
+//! # Why any JavaScript at all
+//!
+//! CDP can find a node and dispatch an input event at a coordinate, but it
+//! cannot answer "is this covered", "what does this element read as", or "which
+//! of these forty buttons says *Submit*" — those are questions about layout and
+//! computed text, and the only place both are already known is the page itself.
+//!
+//! Each function here is written to be called with the target element as
+//! `this`, via `Runtime.callFunctionOn`. They are collected in one file so the
+//! JavaScript in this crate is a short list somebody can read, rather than a
+//! string literal buried in every function that needs one.
+
+/// Scrolls the element into view and reports where it can be clicked.
+///
+/// Returns `{ ok, x, y, reason }`. The occlusion test is the reason this exists:
+/// dispatching a click at a point covered by a consent banner delivers the click
+/// to the banner, and the caller is told the click succeeded. Naming the
+/// covering element turns that into something an agent can act on — dismiss the
+/// banner, then retry.
+pub(crate) const CLICK_POINT: &str = r#"
+function () {
+  const describe = (node) => {
+    if (!node || !node.tagName) return 'another element';
+    const tag = node.tagName.toLowerCase();
+    const id = node.id ? '#' + node.id : '';
+    const cls = typeof node.className === 'string' && node.className.trim()
+      ? '.' + node.className.trim().split(/\s+/).slice(0, 2).join('.')
+      : '';
+    const text = (node.innerText || '').trim().slice(0, 40);
+    return tag + id + cls + (text ? ' \"' + text + '\"' : '');
+  };
+
+  this.scrollIntoView({ block: 'center', inline: 'center' });
+  const rect = this.getBoundingClientRect();
+  if (rect.width === 0 || rect.height === 0) {
+    return { ok: false, reason: 'element has zero size, so there is nothing to click' };
+  }
+
+  const x = rect.left + rect.width / 2;
+  const y = rect.top + rect.height / 2;
+  if (x < 0 || y < 0 || x > window.innerWidth || y > window.innerHeight) {
+    return { ok: false, reason: 'element is outside the viewport even after scrolling to it' };
+  }
+
+  const top = document.elementFromPoint(x, y);
+  if (top && top !== this && !this.contains(top) && !top.contains(this)) {
+    return { ok: false, x, y, reason: 'covered by ' + describe(top) };
+  }
+
+  return { ok: true, x, y };
+}
+"#;
+
+/// Clears a field and selects whatever is left, so an insertion replaces it.
+///
+/// `select()` covers `<input>` and `<textarea>`; the range selection covers a
+/// `contenteditable`, which has no `select` and is otherwise filled by appending
+/// to what is already there.
+pub(crate) const SELECT_ALL: &str = r"
+function () {
+  this.focus();
+  if (typeof this.select === 'function') {
+    this.select();
+    return true;
+  }
+  const range = document.createRange();
+  range.selectNodeContents(this);
+  const selection = window.getSelection();
+  selection.removeAllRanges();
+  selection.addRange(range);
+  return true;
+}
+";
+
+/// Reads an element's text the way it reads on screen.
+///
+/// `innerText` rather than `textContent`: the second returns the text of hidden
+/// nodes and ignores line breaks introduced by layout, so a caller comparing it
+/// with what a person sees finds neither the same content nor the same shape.
+pub(crate) const TEXT: &str = r"
+function () {
+  if (this.value !== undefined && this.tagName && /^(INPUT|TEXTAREA|SELECT)$/.test(this.tagName)) {
+    return String(this.value);
+  }
+  return (this.innerText || this.textContent || '').trim();
+}
+";
+
+/// Reads one attribute, or null when the element does not carry it.
+pub(crate) const ATTRIBUTE: &str = r"
+function (name) {
+  const value = this.getAttribute(name);
+  return value === null ? null : String(value);
+}
+";
+
+/// Whether the element is rendered: in the document, with a box, and not hidden.
+pub(crate) const IS_VISIBLE: &str = r"
+function () {
+  if (!this.isConnected) return false;
+  const style = window.getComputedStyle(this);
+  if (style.visibility === 'hidden' || style.display === 'none' || style.opacity === '0') {
+    return false;
+  }
+  const rect = this.getBoundingClientRect();
+  return rect.width > 0 && rect.height > 0;
+}
+";
+
+/// Chooses options in a `<select>` and fires the events a form listens for.
+///
+/// Setting `selected` without dispatching leaves the page's own state untouched:
+/// a framework-controlled select re-renders back to its previous value the
+/// moment anything else changes.
+pub(crate) const SELECT_OPTIONS: &str = r"
+function (values) {
+  if (!this.options) throw new Error('element is not a select');
+  const wanted = new Set(values);
+  let matched = 0;
+  for (const option of this.options) {
+    const chosen = wanted.has(option.value) || wanted.has(option.label);
+    option.selected = chosen;
+    if (chosen) matched += 1;
+  }
+  if (matched === 0) throw new Error('no option matched ' + JSON.stringify(values));
+  this.dispatchEvent(new Event('input', { bubbles: true }));
+  this.dispatchEvent(new Event('change', { bubbles: true }));
+  return matched;
+}
+";
+
+/// Whether a checkbox or radio is already in the wanted state.
+pub(crate) const CHECKED: &str = r"
+function () {
+  return Boolean(this.checked);
+}
+";
+
+/// Scrolls an element's own scroll box.
+pub(crate) const SCROLL_BY: &str = r"
+function (x, y) {
+  this.scrollBy(x, y);
+  return { left: this.scrollLeft, top: this.scrollTop };
+}
+";
+
+/// Finds an element semantically, and returns it for the caller to describe.
+///
+/// One function rather than one per [`tinybrowser_bus::LocateBy`] because the
+/// hard part is shared: gather candidates, normalise their text the same way the
+/// accessibility name is normalised, and pick the nth match. Splitting it would
+/// mean seven copies of that normalisation, drifting apart one bug at a time.
+pub(crate) const LOCATE: &str = r"
+function (by, value, name, exact, index) {
+  // The same normalisation the accessibility name gets in `snapshot::render`:
+  // pages build their labels out of non-breaking spaces and zero-width joiners,
+  // and an agent matching on 'Add to cart' finds nothing otherwise. Written as
+  // escapes rather than literals so the characters are visible in this source.
+  const norm = (text) => (text || '')
+    .replace(/\u00A0/g, ' ')
+    .replace(/[\u200B\u200C\u200D\u2060\uFEFF]/g, '')
+    .trim()
+    .replace(/\s+/g, ' ')
+    .toLowerCase();
+
+  const wanted = norm(value);
+  const matches = (candidate) => {
+    const text = norm(candidate);
+    return exact ? text === wanted : text.includes(wanted);
+  };
+
+  const visible = (node) => {
+    const rect = node.getBoundingClientRect();
+    return rect.width > 0 && rect.height > 0;
+  };
+
+  const ROLE_SELECTORS = {
+    button: 'button, [role=button], input[type=button], input[type=submit], input[type=reset]',
+    link: 'a[href], [role=link]',
+    textbox: 'input:not([type=button]):not([type=submit]):not([type=reset]):not([type=checkbox]):not([type=radio]), textarea, [role=textbox], [contenteditable=true]',
+    checkbox: 'input[type=checkbox], [role=checkbox]',
+    radio: 'input[type=radio], [role=radio]',
+    combobox: 'select, [role=combobox]',
+    heading: 'h1, h2, h3, h4, h5, h6, [role=heading]',
+    img: 'img, [role=img]',
+  };
+
+  const accessibleName = (node) => node.getAttribute('aria-label')
+    || (node.labels && node.labels[0] ? node.labels[0].innerText : '')
+    || node.getAttribute('title')
+    || node.getAttribute('alt')
+    || node.value
+    || node.innerText
+    || '';
+
+  let candidates = [];
+  if (by === 'role') {
+    const selector = ROLE_SELECTORS[wanted] || '[role=' + CSS.escape(wanted) + ']';
+    candidates = Array.from(document.querySelectorAll(selector));
+    if (name) {
+      const wantedName = norm(name);
+      candidates = candidates.filter((node) => {
+        const text = norm(accessibleName(node));
+        return exact ? text === wantedName : text.includes(wantedName);
+      });
+    }
+  } else if (by === 'text') {
+    candidates = Array.from(document.querySelectorAll('body *'))
+      .filter((node) => node.children.length === 0 || node.tagName === 'BUTTON' || node.tagName === 'A')
+      .filter((node) => matches(node.innerText));
+  } else if (by === 'label') {
+    candidates = Array.from(document.querySelectorAll('input, textarea, select, [contenteditable=true]'))
+      .filter((node) => matches(node.getAttribute('aria-label')
+        || (node.labels && node.labels[0] ? node.labels[0].innerText : '')));
+  } else if (by === 'placeholder') {
+    candidates = Array.from(document.querySelectorAll('[placeholder]'))
+      .filter((node) => matches(node.getAttribute('placeholder')));
+  } else if (by === 'test_id') {
+    candidates = Array.from(document.querySelectorAll('[data-testid], [data-test-id], [data-test]'))
+      .filter((node) => matches(node.getAttribute('data-testid')
+        || node.getAttribute('data-test-id')
+        || node.getAttribute('data-test')));
+  } else if (by === 'alt_text') {
+    candidates = Array.from(document.querySelectorAll('[alt]'))
+      .filter((node) => matches(node.getAttribute('alt')));
+  } else if (by === 'title') {
+    candidates = Array.from(document.querySelectorAll('[title]'))
+      .filter((node) => matches(node.getAttribute('title')));
+  } else {
+    throw new Error('unknown locator dimension ' + by);
+  }
+
+  // A hidden match is almost never the one meant — a template, a closed menu, an
+  // off-screen duplicate — but it is better than nothing when it is all there is.
+  const rendered = candidates.filter(visible);
+  const pool = rendered.length > 0 ? rendered : candidates;
+  return pool[index] || null;
+}
+";
diff --git a/crates/tinybrowser/src/interact/test.rs b/crates/tinybrowser/src/interact/test.rs
new file mode 100644
index 0000000..c607fc3
--- /dev/null
+++ b/crates/tinybrowser/src/interact/test.rs
@@ -0,0 +1,260 @@
+//! Tests for the parts of interaction that need no browser.
+//!
+//! Key parsing and target description are pure, and both are places where a
+//! quiet mistake produces an action that runs, reports success, and does the
+//! wrong thing — a chord dispatched without its modifier, an error naming a
+//! target nobody recognises. The dispatch itself is exercised by the
+//! `live-chrome` suite.
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use tinybrowser_bus::{LocateBy, Locator, Target};
+
+use super::keys::parse;
+use super::resolve::{describe_locator, describe_target, dimension};
+use crate::error::Error;
+
+#[test]
+fn a_named_key_carries_all_four_values() {
+    // A page that submits on Enter usually reads `keyCode`; a shortcut library
+    // usually reads `code`. Filling in only `key` works on some sites and does
+    // nothing on others.
+    let stroke = parse("Enter").expect("parses");
+
+    assert_eq!(stroke.key, "Enter");
+    assert_eq!(stroke.code, "Enter");
+    assert_eq!(stroke.key_code, 13);
+    assert_eq!(stroke.text.as_deref(), Some("\r"));
+    assert_eq!(stroke.modifiers, 0);
+}
+
+#[test]
+fn key_names_are_matched_case_insensitively() {
+    assert_eq!(
+        parse("enter").expect("parses"),
+        parse("Enter").expect("parses")
+    );
+    assert_eq!(parse("ESCAPE").expect("parses").key, "Escape");
+}
+
+#[test]
+fn the_short_arrow_names_are_accepted() {
+    assert_eq!(parse("down").expect("parses").key, "ArrowDown");
+    assert_eq!(parse("ArrowDown").expect("parses").key, "ArrowDown");
+}
+
+#[test]
+fn a_single_character_is_derived_rather_than_enumerated() {
+    let stroke = parse("a").expect("parses");
+
+    assert_eq!(stroke.key, "a");
+    assert_eq!(stroke.code, "KeyA");
+    assert_eq!(stroke.key_code, u32::from(b'A'));
+    assert_eq!(stroke.text.as_deref(), Some("a"));
+}
+
+#[test]
+fn digits_and_punctuation_get_their_physical_key() {
+    assert_eq!(parse("1").expect("parses").code, "Digit1");
+    assert_eq!(parse("-").expect("parses").code, "Minus");
+    assert_eq!(parse("/").expect("parses").code, "Slash");
+}
+
+#[test]
+fn a_character_outside_the_us_layout_gets_no_code_rather_than_a_wrong_one() {
+    let stroke = parse("é").expect("parses");
+
+    assert_eq!(stroke.key, "é");
+    assert!(stroke.code.is_empty());
+}
+
+#[test]
+fn modifiers_accumulate_into_the_bitmask() {
+    let stroke = parse("Control+Shift+Tab").expect("parses");
+
+    // Control is 2 and Shift is 8.
+    assert_eq!(stroke.modifiers, 10);
+    assert_eq!(stroke.key, "Tab");
+}
+
+#[test]
+fn the_modifier_aliases_people_actually_type_are_accepted() {
+    assert_eq!(parse("ctrl+a").expect("parses").modifiers, 2);
+    assert_eq!(parse("cmd+a").expect("parses").modifiers, 4);
+    assert_eq!(parse("command+a").expect("parses").modifiers, 4);
+    assert_eq!(parse("option+a").expect("parses").modifiers, 1);
+}
+
+#[test]
+fn a_modified_press_inserts_no_text() {
+    // `Control+Enter` submits a form. If it also inserted a carriage return,
+    // every shortcut would type into the field it was meant to act on.
+    assert!(parse("Control+Enter").expect("parses").text.is_none());
+    assert!(parse("Control+a").expect("parses").text.is_none());
+}
+
+#[test]
+fn shift_alone_still_inserts_text() {
+    // Shift is how capital letters are typed; treating it like the other
+    // modifiers would make `Shift+a` insert nothing.
+    assert_eq!(parse("Shift+a").expect("parses").text.as_deref(), Some("a"));
+}
+
+#[test]
+fn a_plus_key_is_not_mistaken_for_a_separator() {
+    let stroke = parse("Control++").expect("parses");
+
+    assert_eq!(stroke.modifiers, 2);
+    assert_eq!(stroke.key, "+");
+}
+
+#[test]
+fn an_empty_key_is_refused() {
+    let error = parse("   ").expect_err("refused");
+    assert!(matches!(error, Error::InvalidInput { .. }), "{error}");
+}
+
+#[test]
+fn modifiers_without_a_key_are_refused() {
+    let error = parse("Control+").expect_err("refused");
+    assert!(matches!(error, Error::InvalidInput { .. }), "{error}");
+}
+
+#[test]
+fn an_unknown_modifier_is_refused_by_name() {
+    let error = parse("Hyper+a").expect_err("refused");
+
+    assert!(matches!(error, Error::InvalidInput { .. }), "{error}");
+    assert!(error.to_string().contains("hyper"));
+}
+
+#[test]
+fn a_multi_character_name_that_is_not_a_key_is_refused() {
+    // Otherwise `parse("Retrun")` would silently dispatch nothing useful.
+    let error = parse("Retrun").expect_err("refused");
+    assert!(matches!(error, Error::InvalidInput { .. }), "{error}");
+}
+
+#[test]
+fn the_locator_dimensions_match_what_the_page_script_switches_on() {
+    // These strings cross into JavaScript. A rename on one side alone produces
+    // "unknown locator dimension" at runtime and nothing at compile time.
+    assert_eq!(dimension(LocateBy::Role), "role");
+    assert_eq!(dimension(LocateBy::TestId), "test_id");
+    assert_eq!(dimension(LocateBy::AltText), "alt_text");
+    assert_eq!(dimension(LocateBy::Placeholder), "placeholder");
+}
+
+#[test]
+fn a_target_describes_itself_the_way_the_caller_named_it() {
+    assert_eq!(describe_target(&Target::parse("@e12")), "@e12");
+    assert_eq!(describe_target(&Target::parse("#submit")), "#submit");
+}
+
+#[test]
+fn a_locator_describes_itself_with_everything_that_narrowed_it() {
+    let locator = Locator {
+        index: 2,
+        ..Locator::new(LocateBy::Role, "button").with_name("Submit")
+    };
+
+    let described = describe_locator(&locator);
+    assert!(described.contains("role"));
+    assert!(described.contains("button"));
+    assert!(described.contains("Submit"));
+    assert!(described.contains("index 2"));
+}
+
+#[test]
+fn a_first_match_locator_does_not_mention_its_index() {
+    let described = describe_locator(&Locator::new(LocateBy::Text, "Sign in"));
+
+    assert!(!described.contains("index"));
+    assert!(described.contains("Sign in"));
+}
+
+#[test]
+fn every_punctuation_key_on_the_us_layout_gets_its_physical_key() {
+    // A page reading `code` for a shortcut — a great many do — sees the wrong
+    // key otherwise, and the failure is silent.
+    for (character, code) in [
+        ("-", "Minus"),
+        ("=", "Equal"),
+        (".", "Period"),
+        (",", "Comma"),
+        (";", "Semicolon"),
+        ("'", "Quote"),
+        ("[", "BracketLeft"),
+        ("]", "BracketRight"),
+        ("\\", "Backslash"),
+        ("`", "Backquote"),
+    ] {
+        assert_eq!(parse(character).expect("parses").code, code, "{character}");
+    }
+}
+
+#[test]
+fn a_space_is_spelled_by_name_and_types_one() {
+    // `parse` trims its input, so a bare space cannot be a chord — `Space` is
+    // the spelling, and it has to insert an actual space.
+    let stroke = parse("Space").expect("parses");
+
+    assert_eq!(stroke.code, "Space");
+    assert_eq!(stroke.key_code, 32);
+    assert_eq!(stroke.text.as_deref(), Some(" "));
+
+    let error = parse(" ").expect_err("refused");
+    assert!(matches!(error, Error::InvalidInput { .. }), "{error}");
+}
+
+#[test]
+fn punctuation_reports_no_virtual_code_rather_than_a_wrong_one() {
+    // There is no correct legacy code for these without knowing the layout, and
+    // a plausible-looking wrong one is worse than an unidentified key.
+    assert_eq!(parse("-").expect("parses").key_code, 0);
+}
+
+#[test]
+fn key_names_are_matched_regardless_of_case_for_space_too() {
+    assert_eq!(
+        parse("space").expect("parses"),
+        parse("Space").expect("parses")
+    );
+}
+
+#[test]
+fn every_named_key_is_reachable_by_its_name() {
+    for name in [
+        "enter",
+        "tab",
+        "escape",
+        "esc",
+        "backspace",
+        "delete",
+        "space",
+        "arrowup",
+        "arrowdown",
+        "arrowleft",
+        "arrowright",
+        "up",
+        "down",
+        "left",
+        "right",
+        "home",
+        "end",
+        "pageup",
+        "pagedown",
+    ] {
+        let stroke = parse(name).unwrap_or_else(|error| panic!("{name}: {error}"));
+        assert!(!stroke.key.is_empty(), "{name} parsed to an empty key");
+    }
+}
+
+#[test]
+fn a_key_without_inserted_text_stays_that_way() {
+    // Escape and the arrows type nothing; giving them `text` would insert a
+    // character every time an agent moved the cursor.
+    for name in ["Escape", "ArrowDown", "Backspace", "Delete", "Home"] {
+        assert!(parse(name).expect("parses").text.is_none(), "{name}");
+    }
+}
diff --git a/crates/tinybrowser/src/lib.rs b/crates/tinybrowser/src/lib.rs
new file mode 100644
index 0000000..668bebc
--- /dev/null
+++ b/crates/tinybrowser/src/lib.rs
@@ -0,0 +1,122 @@
+//! A Chrome `DevTools` Protocol browser engine for agents, packaged as an
+//! installable `TinyBus` module.
+//!
+//! # What this is for
+//!
+//! An agent host that wants to look at a web page has bad options. Shelling out
+//! to a browser CLI means a subprocess, a JSON parser around its output, and a
+//! binary to install and version-match. Linking a browser stack into the host
+//! means dragging a WebSocket client, a TLS stack, an image codec and a protocol
+//! surface into a binary that mostly does something else — and a crash anywhere
+//! in it is a crash in the host.
+//!
+//! This crate is the third option. It is a complete browser engine — launching,
+//! navigation, accessibility snapshots, real input events, extraction,
+//! screenshots — that ships as a `cdylib` a host loads over `TinyBus`. The
+//! host's build stays as it was; what it gains is a handful of bus members and
+//! [`tinybrowser_bus`], a dependency-light vocabulary crate, to spell them with.
+//!
+//! # The loop it is shaped around
+//!
+//! ```text
+//! OpenSession  ->  Navigate  ->  Snapshot  ->  Perform  ->  Snapshot  ->  ...
+//!                                    |             |
+//!                                ReadPage      Screenshot
+//! ```
+//!
+//! [`Snapshot`] is the important one. It renders the page's accessibility tree
+//! as indented text with a `@e12` ref on everything actionable, which is an
+//! order of magnitude smaller than the DOM and already excludes what a screen
+//! reader would not announce. An agent reads that, picks a ref, and passes it
+//! straight back as a [`Target`] — so the thing it acts on is the thing it saw.
+//!
+//! # Entry points
+//!
+//! - [`Browser`] — the engine. One method per bus member; usable directly from
+//!   Rust with no bus involved.
+//! - [`Error`] — every failure, each mapping to one published wire name.
+//! - Everything from [`tinybrowser_bus`], re-exported: [`Action`],
+//!   [`SessionOptions`], [`Snapshot`], [`Target`], and the rest.
+//!
+//! # Example
+//!
+//! ```no_run
+//! use tinybrowser::{Action, Browser, NavigateRequest, SnapshotRequest, Target};
+//!
+//! # async fn example() -> tinybrowser::Result<()> {
+//! let browser = Browser::new();
+//! let session = browser.open_session(Default::default()).await?;
+//!
+//! browser
+//!     .navigate(&session.id, &NavigateRequest::new("https://example.com"))
+//!     .await?;
+//!
+//! let snapshot = browser.snapshot(&session.id, &SnapshotRequest::interactive()).await?;
+//! println!("{}", snapshot.tree);
+//!
+//! if let Some(link) = snapshot.refs.iter().find(|element| element.role == "link") {
+//!     browser
+//!         .perform(
+//!             &session.id,
+//!             &Action::Click { target: Target::reference(&link.id), new_tab: false },
+//!         )
+//!         .await?;
+//! }
+//!
+//! browser.close_session(&session.id).await?;
+//! # Ok(())
+//! # }
+//! ```
+//!
+//! # What is deliberately not here
+//!
+//! **No agent, no model, no tool schemas.** This crate drives a browser and
+//! describes what it sees. Deciding what to click is the host's job, and a
+//! module that shipped its own prompt would be one more thing to keep in step
+//! with a model it cannot see.
+//!
+//! **No sandbox.** The origin allowlist in [`SessionOptions`] is a guard rail
+//! against an agent wandering off, not a boundary — a page's own JavaScript can
+//! navigate around it. A host that needs a real boundary puts the browser in a
+//! network namespace. Saying so plainly is more useful than implying otherwise.
+//!
+//! **No persistence.** Sessions are held in memory and end with the process.
+//! Cookies and logins live in the profile directory for the life of a session
+//! and are removed with it, unless the host named its own.
+//!
+//! # Credit
+//!
+//! The design owes a great deal to Vercel's `agent-browser`
+//! (<https://github.com/vercel-labs/agent-browser>, Apache-2.0): the
+//! accessibility tree as the thing an agent reads, `@ref` addressing scoped to a
+//! snapshot, and hit-testing a click point before dispatching at it are all
+//! taken from it. See `THIRD-PARTY.md` at the repository root.
+
+mod capture;
+mod cdp;
+mod engine;
+pub mod error;
+mod extract;
+mod interact;
+mod session;
+mod snapshot;
+
+pub mod tinybus_module;
+
+pub use engine::Browser;
+pub use error::{Error, Result};
+
+/// The wire contract, re-exported whole.
+///
+/// `tinybrowser::Action` and `tinybrowser_bus::Action` are the *same type*, not
+/// structural twins: this crate depends on the contract rather than restating
+/// it, so a host and a module cannot drift.
+pub use tinybrowser_bus;
+
+pub use tinybrowser_bus::{
+    Action, ActionOutcome, CONTRACT_VERSION, ElementRef, EvaluateRequest, INTERFACE, ImageFormat,
+    LocateBy, Locator, METHODS, NavigateRequest, OBJECT_PATH, OutputChunk, OutputId, OutputRef,
+    PageState, PageText, ReadFormat, ReadRequest, ScreenshotRequest, ScrollDirection, SessionId,
+    SessionInfo, SessionOptions, Snapshot, SnapshotRequest, Target, Viewport, WaitState, WaitUntil,
+    errors, is_compatible, names,
+};
diff --git a/crates/tinybrowser/src/session/mod.rs b/crates/tinybrowser/src/session/mod.rs
new file mode 100644
index 0000000..c42a3fa
--- /dev/null
+++ b/crates/tinybrowser/src/session/mod.rs
@@ -0,0 +1,745 @@
+//! One browser, one page, and everything driving them shares this.
+//!
+//! # What a session is
+//!
+//! A [`Session`] owns a CDP socket, a page target attached to it, and the refs
+//! the last snapshot of that page minted. Every other part of the engine —
+//! snapshots, interactions, extraction, screenshots — is written against this
+//! type rather than against the protocol, so the awkward parts of CDP are
+//! written once: attaching flatly, keeping a deadline on every command,
+//! resolving a backend node into something a function can be called on, and
+//! knowing what the page's URL and title are without a round trip per caller.
+//!
+//! # Layout
+//!
+//! - [`policy`] — which destinations this session admits.
+//! - [`refs`] — the refs a snapshot minted, and when they go stale.
+
+pub(crate) mod policy;
+pub(crate) mod refs;
+
+use std::sync::Arc;
+use std::time::Duration;
+
+use serde_json::{Value, json};
+use tinybrowser_bus::{
+    NavigateRequest, PageState, SessionId, SessionInfo, SessionOptions, WaitUntil,
+};
+use tokio::sync::Mutex;
+
+use crate::cdp::launch::LaunchedBrowser;
+use crate::cdp::{CdpClient, endpoint, launch};
+use crate::error::{Error, Result};
+
+use refs::RefMap;
+
+/// How long a command that is not a navigation gets.
+///
+/// Protocol commands answer in microseconds when the renderer is responsive and
+/// never when it is wedged, so this is a liveness bound rather than a budget:
+/// long enough that a busy page is not cut off, short enough that a stuck one
+/// does not hold a bus call open until the host's own deadline fires.
+const COMMAND_TIMEOUT: Duration = Duration::from_secs(30);
+
+/// How long to wait for the network to fall quiet under
+/// [`WaitUntil::NetworkIdle`] before settling anyway.
+///
+/// A page that polls, holds a websocket open, or streams telemetry never goes
+/// idle. Treating that as a navigation failure would fail on exactly the modern
+/// applications the mode exists for, so the quiet period is best-effort: the
+/// `load` event underneath it is what actually settles the navigation.
+const NETWORK_IDLE_GRACE: Duration = Duration::from_secs(2);
+
+/// How long to watch for a navigation that an input event started.
+///
+/// This is a tax on every click and key press that does *not* navigate — a menu
+/// opening, a checkbox toggling — because there is no signal for "nothing is
+/// going to happen"; there is only the absence of a signal, and absence takes
+/// time to establish. The bound is deliberate rather than incidental: a click
+/// that misses its navigation hands the caller the page it was trying to leave,
+/// and an agent then reasons about the wrong document. Paying a fraction of a
+/// second per click to make that impossible is the better side of the trade.
+///
+/// `Page.frameRequestedNavigation` is emitted when the navigation is *scheduled*
+/// rather than when it commits, so this only has to cover scheduling latency,
+/// not a network round trip. It is set well above what that takes on an idle
+/// machine so that a loaded one does not silently start missing navigations.
+const INPUT_NAVIGATION_GRACE: Duration = Duration::from_millis(300);
+
+/// How often to ask the page what it is doing while waiting for it to settle.
+const READY_POLL: Duration = Duration::from_millis(25);
+
+/// The deadline on one such question.
+///
+/// Short on purpose: this runs in a loop, and a page mid-navigation answers
+/// immediately or not at all.
+const READY_TIMEOUT: Duration = Duration::from_secs(5);
+
+/// One open browser session.
+#[derive(Debug)]
+pub(crate) struct Session {
+    id: SessionId,
+    options: SessionOptions,
+    client: Arc<CdpClient>,
+    /// The flat CDP session id addressing this session's page.
+    page: String,
+    /// The page target, kept so it can be closed without closing the browser a
+    /// host lent us.
+    target: String,
+    endpoint: String,
+    /// The browser this module started, if it started one. A session that
+    /// attached to somebody else's browser leaves it running.
+    launched: Mutex<Option<LaunchedBrowser>>,
+    refs: Mutex<RefMap>,
+}
+
+impl Session {
+    /// Opens a session: obtain a browser, attach to a page, and configure it.
+    ///
+    /// # Errors
+    ///
+    /// [`Error::BrowserUnavailable`] when no browser can be launched or
+    /// reached, and [`Error::PageError`] when the browser rejects the setup
+    /// commands.
+    pub(crate) async fn open(id: SessionId, options: SessionOptions) -> Result<Self> {
+        let (endpoint, launched) = if let Some(configured) = options.endpoint.as_deref() {
+            (endpoint::resolve(configured).await?, None)
+        } else {
+            let executable = launch::find_executable(options.executable.as_deref())?;
+            let browser = launch::launch(
+                &executable,
+                options.headless,
+                options.user_data_dir.as_deref(),
+                &options.args,
+            )
+            .await?;
+            (browser.websocket_url.clone(), Some(browser))
+        };
+
+        let client = CdpClient::connect(&endpoint).await?;
+
+        // A launched browser opens with a tab already. Creating our own anyway
+        // means the session owns exactly one page and knows which it is —
+        // adopting whatever tab happened to exist would make an attached
+        // session start driving a page somebody else is using.
+        let created = client
+            .send(
+                "Target.createTarget",
+                json!({ "url": "about:blank" }),
+                None,
+                COMMAND_TIMEOUT,
+            )
+            .await?;
+        let target = string_field(&created, "targetId")?;
+
+        let attached = client
+            .send(
+                "Target.attachToTarget",
+                json!({ "targetId": target, "flatten": true }),
+                None,
+                COMMAND_TIMEOUT,
+            )
+            .await?;
+        let page = string_field(&attached, "sessionId")?;
+
+        let session = Self {
+            id,
+            options,
+            client,
+            page,
+            target,
+            endpoint,
+            launched: Mutex::new(launched),
+            refs: Mutex::new(RefMap::default()),
+        };
+
+        session.configure().await?;
+        Ok(session)
+    }
+
+    /// Enables the domains this engine needs and applies the session's
+    /// emulation settings.
+    async fn configure(&self) -> Result<()> {
+        for domain in ["Page", "Runtime", "DOM", "Network"] {
+            self.send(&format!("{domain}.enable"), json!({})).await?;
+        }
+
+        // Lifecycle events are what a navigation waits on. Without this, `load`
+        // and `networkIdle` never arrive and every navigation settles at its
+        // deadline instead.
+        self.send("Page.setLifecycleEventsEnabled", json!({ "enabled": true }))
+            .await?;
+
+        let viewport = self.options.viewport;
+        self.send(
+            "Emulation.setDeviceMetricsOverride",
+            json!({
+                "width": viewport.width,
+                "height": viewport.height,
+                "deviceScaleFactor": viewport.device_scale_factor,
+                "mobile": viewport.mobile,
+            }),
+        )
+        .await?;
+
+        if let Some(user_agent) = &self.options.user_agent {
+            self.send(
+                "Network.setUserAgentOverride",
+                json!({ "userAgent": user_agent }),
+            )
+            .await?;
+        }
+
+        Ok(())
+    }
+
+    /// This session's identity.
+    pub(crate) fn id(&self) -> &SessionId {
+        &self.id
+    }
+
+    /// The options it was opened with.
+    pub(crate) fn options(&self) -> &SessionOptions {
+        &self.options
+    }
+
+    /// Sends a CDP command addressed to this session's page.
+    ///
+    /// # Errors
+    ///
+    /// Whatever [`CdpClient::send`] reports.
+    pub(crate) async fn send(&self, method: &str, params: Value) -> Result<Value> {
+        self.client
+            .send(method, params, Some(&self.page), COMMAND_TIMEOUT)
+            .await
+    }
+
+    /// Sends a CDP command with an explicit deadline.
+    ///
+    /// # Errors
+    ///
+    /// Whatever [`CdpClient::send`] reports.
+    pub(crate) async fn send_with_timeout(
+        &self,
+        method: &str,
+        params: Value,
+        timeout: Duration,
+    ) -> Result<Value> {
+        self.client
+            .send(method, params, Some(&self.page), timeout)
+            .await
+    }
+
+    /// The deadline for an operation that asked for `timeout_ms`, falling back
+    /// to the session's default.
+    pub(crate) fn deadline(&self, timeout_ms: Option<u64>) -> Duration {
+        Duration::from_millis(timeout_ms.unwrap_or(self.options.default_timeout_ms))
+    }
+
+    /// The refs the last snapshot minted.
+    pub(crate) fn refs(&self) -> &Mutex<RefMap> {
+        &self.refs
+    }
+
+    /// Waits for a navigation that an input event started, if one started.
+    ///
+    /// # Why an input event has to be followed
+    ///
+    /// Dispatching a click returns as soon as the browser has accepted the
+    /// event, not when the page has finished reacting to it. For a click on a
+    /// link or a submit button that leaves a window in which the old document is
+    /// still the current one, and anything done next — reading the page, taking
+    /// a snapshot, acting on a ref — happens against a page on its way out. An
+    /// agent that clicks "submit" and reads the result would read the form it
+    /// just submitted.
+    ///
+    /// It also closes a staleness hole. Refs name nodes in a document; a
+    /// navigation replaces it. Without this, a ref minted before a click that
+    /// navigated stays resolvable afterwards, which is precisely the "resolves
+    /// to whatever now occupies that position" failure that
+    /// [`crate::Error::StaleRef`] exists to prevent.
+    ///
+    /// # Why it takes two mechanisms
+    ///
+    /// Neither signal alone is sufficient, and each fails on exactly the case
+    /// the other handles.
+    ///
+    /// *Waiting for the document to change* misses the start of a cross-origin
+    /// navigation: the browser does not commit to the new URL until the response
+    /// begins arriving, so a click on an external link still reads as "nothing
+    /// happened" for as long as DNS and the request take — far longer than any
+    /// grace period worth paying on every click that navigates nowhere.
+    ///
+    /// *Waiting for lifecycle events* misses the end of one: a cross-origin
+    /// navigation swaps the renderer process, and the `init` and `load` for the
+    /// new document are not seen by the session that was watching for them.
+    ///
+    /// So the start is taken from an event — emitted in the old process, before
+    /// any swap — and the finish from asking the page what it is doing, which
+    /// works whichever process is answering. Both failures were found by the
+    /// bundled example against the open web, not by the tests, which drive a
+    /// same-origin fixture where either mechanism looks correct on its own.
+    ///
+    /// Errors are deliberately not reported: the caller's action succeeded. A
+    /// navigation that fails to settle leaves the page wherever it got to, and
+    /// the [`PageState`] returned with the outcome says where that is.
+    pub(crate) async fn settle_after_input(
+        &self,
+        events: tokio::sync::broadcast::Receiver<crate::cdp::CdpEvent>,
+        before: Option<&str>,
+    ) {
+        if tokio::time::timeout(INPUT_NAVIGATION_GRACE, self.await_navigation_start(events))
+            .await
+            .is_err()
+        {
+            // Nothing started within the grace period. The overwhelming
+            // majority of clicks end here, having cost one short wait.
+            return;
+        }
+
+        // A navigation has been *requested*, which is not the same as begun. The
+        // old document is still current and still reports `complete`, so waiting
+        // for readiness alone finishes instantly and hands back the page the
+        // click was supposed to leave. What has to be waited for is the document
+        // actually changing: a different URL, or a round trip through a state
+        // that is not `complete` for a reload or a same-URL submission.
+        let mut left_the_old_document = false;
+
+        let _ = tokio::time::timeout(self.deadline(None), async {
+            loop {
+                match self.document_status().await {
+                    // The execution context is being torn down: that is the old
+                    // document going away.
+                    None => left_the_old_document = true,
+                    Some((_, ready)) if ready != "complete" => left_the_old_document = true,
+                    Some((href, _)) => {
+                        if before.is_none_or(|before| href != before) || left_the_old_document {
+                            return;
+                        }
+                    }
+                }
+                tokio::time::sleep(READY_POLL).await;
+            }
+        })
+        .await;
+
+        // The document those refs named is gone.
+        self.refs
+            .lock()
+            .await
+            .replace(std::collections::HashMap::new());
+    }
+
+    /// Waits for this page to begin navigating.
+    ///
+    /// Any of these means the browser has accepted a navigation, whether or not
+    /// it has committed to one yet. `navigatedWithinDocument` is included
+    /// because a router that only changes the URL still replaces what the refs
+    /// named, even though no document is loaded.
+    async fn await_navigation_start(
+        &self,
+        events: tokio::sync::broadcast::Receiver<crate::cdp::CdpEvent>,
+    ) {
+        const STARTED: &[&str] = &[
+            "Page.frameStartedLoading",
+            "Page.frameRequestedNavigation",
+            "Page.frameStartedNavigating",
+            "Page.navigatedWithinDocument",
+        ];
+
+        let mut events = events;
+        loop {
+            let event = match events.recv().await {
+                Ok(event) => event,
+                // Lagged: the page emitted more than the buffer holds, possibly
+                // including this one. The caller's grace period decides rather
+                // than this loop waiting for an event already dropped.
+                Err(tokio::sync::broadcast::error::RecvError::Lagged(_)) => continue,
+                Err(tokio::sync::broadcast::error::RecvError::Closed) => return,
+            };
+
+            if event.session_id.as_deref() == Some(self.page.as_str())
+                && STARTED.contains(&event.method.as_str())
+            {
+                return;
+            }
+        }
+    }
+
+    /// A subscription to everything the browser says from now on.
+    ///
+    /// Taken *before* the action whose consequences are being watched for: a
+    /// subscription opened afterwards can miss an event that has already
+    /// happened, and the wait then sits out its whole deadline for something in
+    /// the past.
+    pub(crate) fn events(&self) -> tokio::sync::broadcast::Receiver<crate::cdp::CdpEvent> {
+        self.client.events()
+    }
+
+    /// Where the page is, and whether it has finished loading.
+    ///
+    /// `None` when the page cannot be evaluated in at all, which during a
+    /// navigation means the execution context is being replaced.
+    pub(crate) async fn document_status(&self) -> Option<(String, String)> {
+        let state = self
+            .evaluate(
+                "({ href: location.href, ready: document.readyState })",
+                false,
+                READY_TIMEOUT,
+            )
+            .await
+            .ok()?;
+
+        Some((
+            state.get("href").and_then(Value::as_str)?.to_string(),
+            state.get("ready").and_then(Value::as_str)?.to_string(),
+        ))
+    }
+
+    /// Evaluates `expression` in the page and returns its value.
+    ///
+    /// # Errors
+    ///
+    /// [`Error::PageError`] when the expression throws, and [`Error::Timeout`]
+    /// when it does not finish in time.
+    pub(crate) async fn evaluate(
+        &self,
+        expression: &str,
+        await_promise: bool,
+        timeout: Duration,
+    ) -> Result<Value> {
+        let result = self
+            .send_with_timeout(
+                "Runtime.evaluate",
+                json!({
+                    "expression": expression,
+                    "returnByValue": true,
+                    "awaitPromise": await_promise,
+                    // Without this, an expression that reads a value from a
+                    // click handler's closure — or any page that has been
+                    // interacted with — can be refused as a user-gesture
+                    // violation for no reason the caller can see.
+                    "userGesture": true,
+                }),
+                timeout,
+            )
+            .await?;
+
+        unwrap_evaluation(&result)
+    }
+
+    /// Calls `function` — a JavaScript function expression — on the node behind
+    /// `backend_node_id`, with `args` as its remaining parameters.
+    ///
+    /// This is the shape almost every interaction takes: resolve the node once,
+    /// then run a small function with the element as `this` rather than building
+    /// a selector string and hoping it still matches.
+    ///
+    /// # Errors
+    ///
+    /// [`Error::NoSuchElement`] when the node is gone from the DOM, and
+    /// [`Error::PageError`] when the function throws.
+    pub(crate) async fn call_on_node(
+        &self,
+        backend_node_id: i64,
+        function: &str,
+        args: Vec<Value>,
+        timeout: Duration,
+    ) -> Result<Value> {
+        let object_id = self.resolve_node(backend_node_id).await?;
+
+        let result = self
+            .send_with_timeout(
+                "Runtime.callFunctionOn",
+                json!({
+                    "objectId": object_id,
+                    "functionDeclaration": function,
+                    "arguments": args.into_iter().map(|value| json!({ "value": value })).collect::<Vec<_>>(),
+                    "returnByValue": true,
+                    "awaitPromise": true,
+                    "userGesture": true,
+                }),
+                timeout,
+            )
+            .await?;
+
+        // The handle is released whether or not the call succeeded above: a
+        // retained object keeps its whole DOM subtree alive in the renderer, and
+        // a session that snapshots repeatedly would otherwise grow without
+        // bound. Failing to release is not worth failing the call over.
+        let _ = self
+            .send("Runtime.releaseObject", json!({ "objectId": object_id }))
+            .await;
+
+        unwrap_evaluation(&result)
+    }
+
+    /// Resolves a backend node id into a `Runtime` object id.
+    ///
+    /// # Errors
+    ///
+    /// [`Error::NoSuchElement`] when the node is no longer in the document.
+    pub(crate) async fn resolve_node(&self, backend_node_id: i64) -> Result<String> {
+        let resolved = self
+            .send(
+                "DOM.resolveNode",
+                json!({ "backendNodeId": backend_node_id }),
+            )
+            .await
+            .map_err(|_| Error::NoSuchElement {
+                target: format!("node {backend_node_id}"),
+            })?;
+
+        resolved
+            .get("object")
+            .and_then(|object| object.get("objectId"))
+            .and_then(Value::as_str)
+            .map(str::to_string)
+            .ok_or(Error::NoSuchElement {
+                target: format!("node {backend_node_id}"),
+            })
+    }
+
+    /// Where the page is now.
+    ///
+    /// # Errors
+    ///
+    /// [`Error::PageError`] when the page cannot be evaluated in.
+    pub(crate) async fn page_state(&self) -> Result<PageState> {
+        let state = self
+            .evaluate(
+                "({ url: location.href, title: document.title })",
+                false,
+                COMMAND_TIMEOUT,
+            )
+            .await?;
+
+        Ok(PageState {
+            url: state
+                .get("url")
+                .and_then(Value::as_str)
+                .unwrap_or_default()
+                .to_string(),
+            title: state
+                .get("title")
+                .and_then(Value::as_str)
+                .unwrap_or_default()
+                .to_string(),
+            status: None,
+        })
+    }
+
+    /// What this session is, for [`crate::Browser::list_sessions`].
+    ///
+    /// # Errors
+    ///
+    /// [`Error::PageError`] when the page cannot be read.
+    pub(crate) async fn info(&self) -> Result<SessionInfo> {
+        let page = self.page_state().await?;
+
+        Ok(SessionInfo {
+            id: self.id.clone(),
+            endpoint: self.endpoint.clone(),
+            launched: self.launched.lock().await.is_some(),
+            headless: self.options.headless,
+            viewport: self.options.viewport,
+            url: page.url,
+            title: page.title,
+        })
+    }
+
+    /// Navigates the page and waits for it to settle.
+    ///
+    /// # Errors
+    ///
+    /// [`Error::InvalidInput`] for an unusable URL, [`Error::BlockedByPolicy`]
+    /// when the session's allowlist refuses it, [`Error::PageError`] when the
+    /// browser cannot reach it, and [`Error::Timeout`] when it does not settle
+    /// in time.
+    pub(crate) async fn navigate(&self, request: &NavigateRequest) -> Result<PageState> {
+        let url = policy::normalize_url(&request.url)?;
+        policy::check_allowed(&url, &self.options.allowed_origins)?;
+
+        let deadline = self.deadline(request.timeout_ms);
+
+        // Subscribed *before* the navigation is issued. A fast page can fire its
+        // load event before a subscription taken afterwards exists, and the wait
+        // would then sit out the whole deadline for an event that already
+        // happened.
+        let events = self.client.events();
+
+        let started = self
+            .send_with_timeout("Page.navigate", json!({ "url": url.as_str() }), deadline)
+            .await?;
+
+        if let Some(error) = started.get("errorText").and_then(Value::as_str) {
+            return Err(Error::page(format!("navigating to {url}: {error}")));
+        }
+        let frame = string_field(&started, "frameId")?;
+
+        // A ref names a node in the document that has just been replaced. The
+        // snapshot counter moves on so every outstanding ref reports as stale
+        // rather than resolving against the new page.
+        self.refs
+            .lock()
+            .await
+            .replace(std::collections::HashMap::new());
+
+        let status = self
+            .settle(events, &frame, request.wait_until, deadline)
+            .await?;
+
+        let mut page = self.page_state().await?;
+        page.status = status;
+        Ok(page)
+    }
+
+    /// Waits for the navigation of `frame` to reach `wait_until`, collecting the
+    /// main document's HTTP status on the way past.
+    async fn settle(
+        &self,
+        mut events: tokio::sync::broadcast::Receiver<crate::cdp::CdpEvent>,
+        frame: &str,
+        wait_until: WaitUntil,
+        deadline: Duration,
+    ) -> Result<Option<u16>> {
+        let Some(target) = lifecycle_name(wait_until) else {
+            return Ok(None);
+        };
+
+        let mut status = None;
+        let wait = async {
+            loop {
+                let event = match events.recv().await {
+                    Ok(event) => event,
+                    // Lagged: the page emitted more events than the buffer
+                    // holds. The one being waited for may have been among them,
+                    // so the deadline below decides rather than this loop
+                    // blocking forever on a subscription that has already
+                    // missed its answer.
+                    Err(tokio::sync::broadcast::error::RecvError::Lagged(_)) => continue,
+                    Err(tokio::sync::broadcast::error::RecvError::Closed) => {
+                        return Err(Error::connection_lost(
+                            "browser closed during navigation".to_string(),
+                        ));
+                    }
+                };
+
+                if event.session_id.as_deref() != Some(self.page.as_str()) {
+                    continue;
+                }
+
+                if event.method == "Network.responseReceived"
+                    && event.params.get("type").and_then(Value::as_str) == Some("Document")
+                    && event.params.get("frameId").and_then(Value::as_str) == Some(frame)
+                {
+                    status = event
+                        .params
+                        .get("response")
+                        .and_then(|response| response.get("status"))
+                        .and_then(Value::as_u64)
+                        .and_then(|code| u16::try_from(code).ok());
+                }
+
+                if event.method == "Page.lifecycleEvent"
+                    && event.params.get("frameId").and_then(Value::as_str) == Some(frame)
+                    && event.params.get("name").and_then(Value::as_str) == Some(target)
+                {
+                    return Ok(());
+                }
+            }
+        };
+
+        match tokio::time::timeout(deadline, wait).await {
+            Ok(result) => result?,
+            Err(_) if wait_until == WaitUntil::NetworkIdle => {
+                // Documented best-effort: a page that never goes quiet still
+                // loaded, and reporting a timeout would be a lie about the page
+                // rather than a fact about the network.
+            }
+            Err(_) => {
+                return Err(Error::timeout(
+                    "navigation",
+                    u64::try_from(deadline.as_millis()).unwrap_or(u64::MAX),
+                ));
+            }
+        }
+
+        if wait_until == WaitUntil::NetworkIdle {
+            // `networkIdle` fires the moment the counter reaches zero, which a
+            // page that is about to issue its next request reaches too. The
+            // grace period is what makes the mode mean "quiet" rather than
+            // "momentarily between requests".
+            tokio::time::sleep(NETWORK_IDLE_GRACE.min(deadline)).await;
+        }
+
+        Ok(status)
+    }
+
+    /// Closes the page, and the browser if this module launched it.
+    ///
+    /// Errors are swallowed: this is the teardown path, and a browser that has
+    /// already gone is the outcome being asked for.
+    pub(crate) async fn close(&self) {
+        let _ = self
+            .client
+            .send(
+                "Target.closeTarget",
+                json!({ "targetId": self.target }),
+                None,
+                COMMAND_TIMEOUT,
+            )
+            .await;
+
+        if let Some(launched) = self.launched.lock().await.take() {
+            launched.shutdown().await;
+        }
+    }
+}
+
+/// The lifecycle event name a wait mode settles on, or `None` for a mode that
+/// does not wait.
+fn lifecycle_name(wait_until: WaitUntil) -> Option<&'static str> {
+    match wait_until {
+        WaitUntil::Commit => None,
+        WaitUntil::DomContentLoaded => Some("DOMContentLoaded"),
+        WaitUntil::Load => Some("load"),
+        WaitUntil::NetworkIdle => Some("networkIdle"),
+    }
+}
+
+/// Reads a required string out of a CDP result.
+fn string_field(value: &Value, field: &str) -> Result<String> {
+    value
+        .get(field)
+        .and_then(Value::as_str)
+        .map(str::to_string)
+        .ok_or_else(|| Error::page(format!("browser replied without a {field}")))
+}
+
+/// Turns a `Runtime.evaluate` or `Runtime.callFunctionOn` result into a value or
+/// an error.
+///
+/// CDP reports a thrown exception in the *result* rather than as a protocol
+/// error, so a caller that only checks for a transport failure treats a
+/// `ReferenceError` as a successful call returning `undefined`.
+fn unwrap_evaluation(result: &Value) -> Result<Value> {
+    if let Some(details) = result.get("exceptionDetails") {
+        let message = details
+            .get("exception")
+            .and_then(|exception| exception.get("description"))
+            .and_then(Value::as_str)
+            .or_else(|| details.get("text").and_then(Value::as_str))
+            .unwrap_or("uncaught exception");
+        return Err(Error::page(message.to_string()));
+    }
+
+    Ok(result
+        .get("result")
+        .and_then(|inner| inner.get("value"))
+        .cloned()
+        .unwrap_or(Value::Null))
+}
+
+#[cfg(test)]
+mod test;
diff --git a/crates/tinybrowser/src/session/policy.rs b/crates/tinybrowser/src/session/policy.rs
new file mode 100644
index 0000000..b64302a
--- /dev/null
+++ b/crates/tinybrowser/src/session/policy.rs
@@ -0,0 +1,114 @@
+//! What a session is allowed to navigate to.
+//!
+//! # Why the check is here and not in the host
+//!
+//! A host can refuse to *ask* for a URL, and should. It cannot refuse the ones
+//! it never sees: a click on a link, a redirect, a `window.location` in a script
+//! on the page. Only the thing holding the browser is in a position to see every
+//! destination, and this module is that thing.
+//!
+//! What is enforced here is the first half — the destinations that arrive as
+//! requests. It is a guard rail against an agent wandering off, not a sandbox:
+//! an allowlist that a page's own JavaScript can still navigate around is worth
+//! having and worth being honest about. A host that needs a real boundary puts
+//! the browser in a network namespace that only reaches what it should.
+
+use url::Url;
+
+use crate::error::{Error, Result};
+
+/// Normalises what a caller asked for into a URL a browser can be sent to.
+///
+/// A bare host — `example.com`, `localhost:3000` — becomes `https://`, because
+/// that is what an operator typing it means and what every address bar does.
+/// Anything else must carry its own scheme, and only `http` and `https` are
+/// accepted: `file:` would make the browser a filesystem reader for whoever can
+/// reach the bus, and `javascript:` would make navigation an evaluation channel
+/// that skips [`crate::Browser::evaluate`] and its deadline.
+///
+/// # Errors
+///
+/// [`Error::InvalidInput`] when the input is empty, unparseable, or carries a
+/// scheme this module will not navigate to.
+pub(crate) fn normalize_url(raw: &str) -> Result<Url> {
+    let trimmed = raw.trim();
+    if trimmed.is_empty() {
+        return Err(Error::invalid_input("navigation url is empty"));
+    }
+
+    // `about:blank` is the one non-http destination worth admitting: it is how a
+    // caller clears the page without closing the session.
+    if trimmed.eq_ignore_ascii_case("about:blank") {
+        return Url::parse("about:blank")
+            .map_err(|error| Error::invalid_input(format!("about:blank: {error}")));
+    }
+
+    let candidate = if trimmed.contains("://") {
+        trimmed.to_string()
+    } else {
+        format!("https://{trimmed}")
+    };
+
+    let url = Url::parse(&candidate)
+        .map_err(|error| Error::invalid_input(format!("{trimmed} is not a url: {error}")))?;
+
+    match url.scheme() {
+        "http" | "https" => Ok(url),
+        scheme => Err(Error::invalid_input(format!(
+            "{scheme}: urls are not navigable; use http or https"
+        ))),
+    }
+}
+
+/// Whether `url` is admitted by `allowed`.
+///
+/// An empty allowlist admits everything: a session that did not ask for a
+/// boundary does not get one imposed on it. An entry is either an origin
+/// (`https://example.com`, matched on scheme, host, and port) or a host with a
+/// leading dot (`.example.com`, matching that host and every subdomain).
+///
+/// # Errors
+///
+/// [`Error::BlockedByPolicy`] when the allowlist is non-empty and nothing in it
+/// matches.
+pub(crate) fn check_allowed(url: &Url, allowed: &[String]) -> Result<()> {
+    if allowed.is_empty() {
+        return Ok(());
+    }
+
+    let Some(host) = url.host_str() else {
+        return Err(Error::BlockedByPolicy {
+            url: url.to_string(),
+        });
+    };
+
+    let permitted = allowed.iter().any(|entry| {
+        let entry = entry.trim();
+        if let Some(suffix) = entry.strip_prefix('.') {
+            // A leading dot means "this host and anything under it". Comparing
+            // with the dot kept — `.example.com` against `evil-example.com` —
+            // is what stops a suffix match from admitting a lookalike domain.
+            return host.eq_ignore_ascii_case(suffix)
+                || host
+                    .to_ascii_lowercase()
+                    .ends_with(&format!(".{}", suffix.to_ascii_lowercase()));
+        }
+
+        match Url::parse(entry) {
+            Ok(origin) => origin.origin() == url.origin(),
+            // An entry that is neither an origin nor a dotted suffix is matched
+            // as a bare host. Being lenient here is deliberate: an operator who
+            // wrote `example.com` meant the site, and refusing to interpret it
+            // would silently block everything instead.
+            Err(_) => host.eq_ignore_ascii_case(entry),
+        }
+    });
+
+    if permitted {
+        Ok(())
+    } else {
+        Err(Error::BlockedByPolicy {
+            url: url.to_string(),
+        })
+    }
+}
diff --git a/crates/tinybrowser/src/session/refs.rs b/crates/tinybrowser/src/session/refs.rs
new file mode 100644
index 0000000..82573e8
--- /dev/null
+++ b/crates/tinybrowser/src/session/refs.rs
@@ -0,0 +1,65 @@
+//! The refs a snapshot mints, and the rule that decides when one has gone
+//! stale.
+//!
+//! # Why refs expire
+//!
+//! A ref names a node the agent saw in one snapshot. The page then changes — a
+//! list re-renders, a modal opens, a navigation happens — and the node behind
+//! that ref is either gone or, far worse, is now a different element occupying
+//! the same position. Acting on it would succeed and do the wrong thing, and the
+//! agent would report that it clicked what it meant to.
+//!
+//! So refs are scoped to the snapshot that produced them and to the document
+//! they were taken in. A ref from an earlier snapshot of the same page is stale
+//! and says so; a ref from before a navigation is stale for the same reason. The
+//! remedy is always the same one sentence — snapshot again — which is why
+//! [`crate::Error::StaleRef`] exists separately from "not found".
+
+use std::collections::HashMap;
+
+use crate::error::{Error, Result};
+
+/// The refs minted by the most recent snapshot of one session.
+#[derive(Debug, Default)]
+pub(crate) struct RefMap {
+    /// Which snapshot these came from, counting from one. Zero means no
+    /// snapshot has been taken yet.
+    sequence: u64,
+    /// Ref id to the backend node id it names.
+    nodes: HashMap<String, i64>,
+}
+
+impl RefMap {
+    /// Replaces every ref with those of a new snapshot, and returns its
+    /// sequence number.
+    pub(crate) fn replace(&mut self, nodes: HashMap<String, i64>) -> u64 {
+        self.sequence += 1;
+        self.nodes = nodes;
+        self.sequence
+    }
+
+    /// The sequence of the snapshot currently minting refs.
+    #[cfg(test)]
+    pub(crate) fn sequence(&self) -> u64 {
+        self.sequence
+    }
+
+    /// Resolves `reference` to the backend node id it names.
+    ///
+    /// # Errors
+    ///
+    /// [`Error::StaleRef`] when no snapshot has been taken, or when the ref is
+    /// not in the current one — those are the same situation from the caller's
+    /// side, and both are fixed by taking a snapshot.
+    pub(crate) fn resolve(&self, reference: &str) -> Result<i64> {
+        let reference = reference.trim_start_matches('@');
+
+        self.nodes.get(reference).copied().ok_or(Error::StaleRef {
+            reference: reference.to_string(),
+            // A ref this map has never held came from *some* earlier snapshot;
+            // reporting zero when none has been taken says exactly that.
+            minted: 0,
+            current: self.sequence,
+        })
+    }
+}
diff --git a/crates/tinybrowser/src/session/test.rs b/crates/tinybrowser/src/session/test.rs
new file mode 100644
index 0000000..b23d11d
--- /dev/null
+++ b/crates/tinybrowser/src/session/test.rs
@@ -0,0 +1,237 @@
+//! Tests for the parts of a session that need no browser.
+//!
+//! The session type itself cannot be built without a socket, so what is covered
+//! here is everything it decides *around* that socket: which URLs it will
+//! navigate to, which it refuses, how a ref goes stale, and how a CDP reply is
+//! turned into a value or an error. The last one matters more than it looks: a
+//! thrown exception arrives as a successful protocol reply, and reading it wrong
+//! turns every page error into a silent `null`.
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use std::collections::HashMap;
+
+use serde_json::json;
+use tinybrowser_bus::WaitUntil;
+
+use super::policy::{check_allowed, normalize_url};
+use super::refs::RefMap;
+use super::{lifecycle_name, string_field, unwrap_evaluation};
+use crate::error::Error;
+
+#[test]
+fn a_bare_host_becomes_https() {
+    assert_eq!(
+        normalize_url("example.com").expect("normalizes").as_str(),
+        "https://example.com/"
+    );
+    assert_eq!(
+        normalize_url("localhost:3000")
+            .expect("normalizes")
+            .as_str(),
+        "https://localhost:3000/"
+    );
+}
+
+#[test]
+fn an_explicit_scheme_is_kept() {
+    assert_eq!(
+        normalize_url("http://example.com/a?b=c")
+            .expect("normalizes")
+            .as_str(),
+        "http://example.com/a?b=c"
+    );
+}
+
+#[test]
+fn about_blank_is_admitted_so_a_caller_can_clear_the_page() {
+    assert_eq!(
+        normalize_url("about:blank").expect("normalizes").as_str(),
+        "about:blank"
+    );
+    assert_eq!(
+        normalize_url("ABOUT:BLANK").expect("normalizes").as_str(),
+        "about:blank"
+    );
+}
+
+#[test]
+fn file_urls_are_refused() {
+    // A module that will navigate to `file:` is a filesystem reader for whoever
+    // can reach the bus.
+    let error = normalize_url("file:///etc/passwd").expect_err("refused");
+    assert!(matches!(error, Error::InvalidInput { .. }), "{error}");
+}
+
+#[test]
+fn javascript_urls_are_refused() {
+    // Otherwise navigation becomes a second evaluation channel, one that skips
+    // `Browser::evaluate` and every deadline attached to it.
+    let error = normalize_url("javascript:alert(1)").expect_err("refused");
+    assert!(matches!(error, Error::InvalidInput { .. }), "{error}");
+}
+
+#[test]
+fn an_empty_url_is_refused() {
+    let error = normalize_url("   ").expect_err("refused");
+    assert!(matches!(error, Error::InvalidInput { .. }), "{error}");
+}
+
+#[test]
+fn an_empty_allowlist_admits_everything() {
+    let url = normalize_url("https://anywhere.test/").expect("normalizes");
+    assert!(check_allowed(&url, &[]).is_ok());
+}
+
+#[test]
+fn an_origin_entry_matches_only_that_origin() {
+    let allowed = vec!["https://example.com".to_string()];
+
+    assert!(check_allowed(&normalize_url("https://example.com/a").unwrap(), &allowed).is_ok());
+    assert!(check_allowed(&normalize_url("http://example.com/a").unwrap(), &allowed).is_err());
+    assert!(check_allowed(&normalize_url("https://other.test/").unwrap(), &allowed).is_err());
+}
+
+#[test]
+fn a_dotted_entry_matches_the_host_and_its_subdomains() {
+    let allowed = vec![".example.com".to_string()];
+
+    assert!(check_allowed(&normalize_url("https://example.com/").unwrap(), &allowed).is_ok());
+    assert!(
+        check_allowed(
+            &normalize_url("https://docs.example.com/").unwrap(),
+            &allowed
+        )
+        .is_ok()
+    );
+    assert!(
+        check_allowed(
+            &normalize_url("https://a.b.example.com/").unwrap(),
+            &allowed
+        )
+        .is_ok()
+    );
+}
+
+#[test]
+fn a_dotted_entry_does_not_admit_a_lookalike_domain() {
+    // The whole point of the leading dot: a plain suffix comparison would admit
+    // `evil-example.com`, which is a different site entirely.
+    let allowed = vec![".example.com".to_string()];
+    let url = normalize_url("https://evil-example.com/").expect("normalizes");
+
+    let error = check_allowed(&url, &allowed).expect_err("refused");
+    assert!(matches!(error, Error::BlockedByPolicy { .. }), "{error}");
+}
+
+#[test]
+fn a_bare_host_entry_is_read_as_that_host() {
+    // An operator who wrote `example.com` meant the site. Refusing to interpret
+    // it would block everything instead, which is a worse failure than being
+    // lenient about the form.
+    let allowed = vec!["example.com".to_string()];
+
+    assert!(check_allowed(&normalize_url("https://example.com/").unwrap(), &allowed).is_ok());
+    assert!(check_allowed(&normalize_url("http://example.com/").unwrap(), &allowed).is_ok());
+    assert!(check_allowed(&normalize_url("https://other.test/").unwrap(), &allowed).is_err());
+}
+
+#[test]
+fn a_ref_from_no_snapshot_at_all_is_stale() {
+    let map = RefMap::default();
+
+    let error = map.resolve("e1").expect_err("refused");
+    assert!(
+        matches!(error, Error::StaleRef { current: 0, .. }),
+        "{error}"
+    );
+}
+
+#[test]
+fn refs_resolve_within_the_snapshot_that_minted_them() {
+    let mut map = RefMap::default();
+    let sequence = map.replace(HashMap::from([("e1".to_string(), 42)]));
+
+    assert_eq!(sequence, 1);
+    assert_eq!(map.sequence(), 1);
+    assert_eq!(map.resolve("e1").expect("resolves"), 42);
+    assert_eq!(map.resolve("@e1").expect("resolves"), 42);
+}
+
+#[test]
+fn a_new_snapshot_retires_the_previous_refs() {
+    let mut map = RefMap::default();
+    map.replace(HashMap::from([("e1".to_string(), 42)]));
+    map.replace(HashMap::from([("e1".to_string(), 99)]));
+
+    assert_eq!(map.sequence(), 2);
+    assert_eq!(map.resolve("e1").expect("resolves"), 99);
+
+    let error = map.resolve("e2").expect_err("refused");
+    assert!(
+        matches!(error, Error::StaleRef { current: 2, .. }),
+        "{error}"
+    );
+}
+
+#[test]
+fn commit_waits_for_no_lifecycle_event() {
+    assert!(lifecycle_name(WaitUntil::Commit).is_none());
+}
+
+#[test]
+fn the_wait_modes_map_onto_chrome_lifecycle_names() {
+    // These strings are Chrome's, not ours: a typo here means a navigation that
+    // waits for an event that never arrives and settles at its deadline.
+    assert_eq!(
+        lifecycle_name(WaitUntil::DomContentLoaded),
+        Some("DOMContentLoaded")
+    );
+    assert_eq!(lifecycle_name(WaitUntil::Load), Some("load"));
+    assert_eq!(lifecycle_name(WaitUntil::NetworkIdle), Some("networkIdle"));
+}
+
+#[test]
+fn a_missing_field_is_reported_against_the_browser() {
+    let error = string_field(&json!({}), "targetId").expect_err("refused");
+    assert!(matches!(error, Error::PageError { .. }), "{error}");
+    assert!(error.to_string().contains("targetId"));
+}
+
+#[test]
+fn an_evaluation_result_yields_its_value() {
+    let result = json!({ "result": { "type": "string", "value": "hello" } });
+    assert_eq!(unwrap_evaluation(&result).expect("a value"), json!("hello"));
+}
+
+#[test]
+fn an_undefined_result_is_null_rather_than_an_error() {
+    let result = json!({ "result": { "type": "undefined" } });
+    assert_eq!(unwrap_evaluation(&result).expect("a value"), json!(null));
+}
+
+#[test]
+fn a_thrown_exception_is_an_error_not_a_null() {
+    // CDP reports a throw as a *successful* reply carrying exceptionDetails. A
+    // caller that only checks for transport failures reads this as `undefined`
+    // and reports that the script ran.
+    let result = json!({
+        "result": { "type": "object", "subtype": "error" },
+        "exceptionDetails": {
+            "text": "Uncaught",
+            "exception": { "description": "ReferenceError: nope is not defined" },
+        },
+    });
+
+    let error = unwrap_evaluation(&result).expect_err("refused");
+    assert!(matches!(error, Error::PageError { .. }), "{error}");
+    assert!(error.to_string().contains("ReferenceError"));
+}
+
+#[test]
+fn an_exception_without_a_description_still_reports_something() {
+    let result = json!({ "exceptionDetails": { "text": "Uncaught (in promise)" } });
+
+    let error = unwrap_evaluation(&result).expect_err("refused");
+    assert!(error.to_string().contains("Uncaught (in promise)"));
+}
diff --git a/crates/tinybrowser/src/snapshot/mod.rs b/crates/tinybrowser/src/snapshot/mod.rs
new file mode 100644
index 0000000..c98ed7e
--- /dev/null
+++ b/crates/tinybrowser/src/snapshot/mod.rs
@@ -0,0 +1,87 @@
+//! Capturing the accessibility tree of a page.
+//!
+//! # Why the accessibility tree and not the DOM
+//!
+//! An agent needs to know what is on a page and what it can do with it. The DOM
+//! answers a different question — how the page is built — and answers it at ten
+//! to a hundred times the size, most of it wrappers, styling hooks, and inline
+//! scripts. The accessibility tree is the browser's own answer to "what is here
+//! and what does it do", computed after layout, with hidden nodes already gone
+//! and every control carrying its role, name, and state.
+//!
+//! It is also the same tree a screen reader uses, which means a page that
+//! snapshots badly is usually a page that is genuinely inaccessible rather than
+//! one this module reads wrong.
+//!
+//! # Layout
+//!
+//! - [`types`] — the nodes as Chrome reports them.
+//! - [`render`] — the pure part: nodes in, indented text and refs out.
+
+pub(crate) mod render;
+pub(crate) mod types;
+
+use serde_json::{Value, json};
+use tinybrowser_bus::{Snapshot, SnapshotRequest};
+
+use crate::error::{Error, Result};
+use crate::session::Session;
+
+use types::AxNode;
+
+/// Snapshots the session's active page.
+///
+/// The refs this mints replace the session's previous ones, so anything held
+/// from an earlier snapshot reports as stale from here on.
+///
+/// # Errors
+///
+/// [`Error::NoSuchElement`] when `request.selector` matches nothing,
+/// [`Error::PageError`] when the browser will not produce a tree, and
+/// [`Error::Timeout`] when it does not answer in time.
+pub(crate) async fn capture(session: &Session, request: &SnapshotRequest) -> Result<Snapshot> {
+    // Enabling per snapshot rather than at attach time: the accessibility tree
+    // is computed lazily, and leaving the domain on makes every layout in the
+    // session pay for a tree nobody asked for.
+    session.send("Accessibility.enable", json!({})).await?;
+
+    // Resolved before the tree is fetched so a selector that matches nothing
+    // fails without paying for a document-sized response first.
+    let root = match &request.selector {
+        Some(selector) => Some(super::interact::resolve::selector_node(session, selector).await?),
+        None => None,
+    };
+
+    let response = session
+        .send("Accessibility.getFullAXTree", json!({}))
+        .await?;
+
+    let nodes: Vec<AxNode> = serde_json::from_value(
+        response
+            .get("nodes")
+            .cloned()
+            .unwrap_or_else(|| Value::Array(Vec::new())),
+    )
+    .map_err(|error| Error::page(format!("accessibility tree could not be read: {error}")))?;
+
+    let rendered = render::render(&nodes, request, root).ok_or_else(|| Error::NoSuchElement {
+        target: request
+            .selector
+            .clone()
+            .unwrap_or_else(|| "document".to_string()),
+    })?;
+    let sequence = session.refs().lock().await.replace(rendered.nodes);
+    let page = session.page_state().await?;
+
+    Ok(Snapshot {
+        url: page.url,
+        title: page.title,
+        sequence,
+        tree: rendered.tree,
+        refs: rendered.refs,
+        truncated: rendered.truncated,
+    })
+}
+
+#[cfg(test)]
+mod test;
diff --git a/crates/tinybrowser/src/snapshot/render.rs b/crates/tinybrowser/src/snapshot/render.rs
new file mode 100644
index 0000000..1cce709
--- /dev/null
+++ b/crates/tinybrowser/src/snapshot/render.rs
@@ -0,0 +1,365 @@
+//! Turning an accessibility tree into the indented text an agent reads, and the
+//! refs that make it actionable.
+//!
+//! # Why this is separate from the protocol
+//!
+//! Everything in this file is a pure function of a node list. That is
+//! deliberate: rendering is where the judgement lives — which roles are worth a
+//! ref, what "interactive only" means, when a container is noise — and
+//! judgement that can only be exercised against a live browser is judgement that
+//! does not get tested. The socket hands over a `Vec<AxNode>`, and from there it
+//! is all arithmetic.
+//!
+//! # What the output looks like
+//!
+//! ```text
+//! - document "Example Domain"
+//!   - heading "Example Domain" @e1
+//!   - paragraph "This domain is for use in illustrative examples."
+//!   - link "More information..." @e2
+//! ```
+//!
+//! Two spaces per level, one line per node, `role "name"` and a `@ref` on
+//! anything addressable. It is YAML-ish rather than YAML on purpose: an agent
+//! reads it as a list, and nothing downstream should be tempted to parse it when
+//! [`tinybrowser_bus::Snapshot::refs`] carries the same information structurally.
+
+// Writing into a `String` cannot fail, so every `write!` below discards its
+// result rather than propagating an error that does not exist.
+use std::fmt::Write as _;
+
+use std::collections::HashMap;
+
+use tinybrowser_bus::{ElementRef, SnapshotRequest};
+
+use super::types::AxNode;
+
+/// Roles an agent can act on. These get a ref.
+const INTERACTIVE_ROLES: &[&str] = &[
+    "button",
+    "checkbox",
+    "combobox",
+    "link",
+    "listbox",
+    "menuitem",
+    "menuitemcheckbox",
+    "menuitemradio",
+    "option",
+    "radio",
+    "searchbox",
+    "slider",
+    "spinbutton",
+    "switch",
+    "tab",
+    "textbox",
+    "treeitem",
+    "Iframe",
+];
+
+/// Roles that carry meaning without being actionable. These get a ref too — an
+/// agent reads text out of them — but they are dropped by `interactive_only`.
+const CONTENT_ROLES: &[&str] = &[
+    "article",
+    "cell",
+    "columnheader",
+    "gridcell",
+    "heading",
+    "img",
+    "listitem",
+    "main",
+    "navigation",
+    "paragraph",
+    "region",
+    "rowheader",
+    "StaticText",
+];
+
+/// Roles that exist to hold other nodes. `compact` drops them, keeping their
+/// children at the parent's depth.
+const STRUCTURAL_ROLES: &[&str] = &[
+    "application",
+    "directory",
+    "document",
+    "generic",
+    "grid",
+    "group",
+    "list",
+    "menu",
+    "menubar",
+    "none",
+    "presentation",
+    "row",
+    "rowgroup",
+    "table",
+    "tablist",
+    "toolbar",
+    "tree",
+    "treegrid",
+    "RootWebArea",
+    "WebArea",
+];
+
+/// A rendered snapshot: the text, the refs in it, and the map that resolves
+/// them.
+#[derive(Debug, Default)]
+pub(crate) struct Rendered {
+    /// The indented tree.
+    pub(crate) tree: String,
+    /// Every ref in the tree, in the order it appears.
+    pub(crate) refs: Vec<ElementRef>,
+    /// Ref id to backend node id, for [`crate::session::refs::RefMap`].
+    pub(crate) nodes: HashMap<String, i64>,
+    /// Whether `max_chars` cut the tree short.
+    pub(crate) truncated: bool,
+}
+
+/// Renders `nodes` according to `request`, optionally scoped to a subtree.
+///
+/// `nodes` is the tree as `Accessibility.getFullAXTree` returned it: a flat list
+/// in which parents name their children by id.
+///
+/// `root` is the backend node id to start from, for a scoped snapshot. Scoping
+/// happens here rather than at the protocol because `getFullAXTree` has no
+/// parameter for it — it takes a depth and a frame, and a node id passed to it
+/// is *ignored*, which returns the whole page while looking like it worked.
+/// `getPartialAXTree` does take a node, but returns that node and its relatives
+/// rather than the subtree under it, which is a different thing again. Pruning
+/// the full tree is both correct and testable without a browser.
+///
+/// Returns `None` when `root` names a node that is not in the tree, which is the
+/// caller's cue to report [`crate::Error::NoSuchElement`].
+pub(crate) fn render(
+    nodes: &[AxNode],
+    request: &SnapshotRequest,
+    root: Option<i64>,
+) -> Option<Rendered> {
+    let by_id: HashMap<&str, &AxNode> = nodes
+        .iter()
+        .map(|node| (node.node_id.as_str(), node))
+        .collect();
+
+    let root = match root {
+        Some(backend) => nodes
+            .iter()
+            .find(|node| node.backend_dom_node_id == Some(backend))?,
+        None => nodes.iter().find(|node| !node.ignored)?,
+    };
+
+    let mut state = Walk {
+        by_id,
+        request,
+        next_ref: 1,
+        lines: Vec::new(),
+        refs: Vec::new(),
+        nodes: HashMap::new(),
+        // A malformed tree — one whose child ids form a cycle — would otherwise
+        // walk forever. The visited set costs one hash per node and removes a
+        // hang from the list of things a hostile page can cause.
+        visited: std::collections::HashSet::new(),
+    };
+    state.walk(root, 0);
+
+    let mut tree = state.lines.join("\n");
+    let truncated = tree.chars().count() > request.max_chars;
+    if truncated {
+        tree = tree.chars().take(request.max_chars).collect();
+    }
+
+    Some(Rendered {
+        tree,
+        refs: state.refs,
+        nodes: state.nodes,
+        truncated,
+    })
+}
+
+/// The state carried down one traversal.
+struct Walk<'a> {
+    by_id: HashMap<&'a str, &'a AxNode>,
+    request: &'a SnapshotRequest,
+    next_ref: u32,
+    lines: Vec<String>,
+    refs: Vec<ElementRef>,
+    nodes: HashMap<String, i64>,
+    visited: std::collections::HashSet<&'a str>,
+}
+
+impl<'a> Walk<'a> {
+    /// Emits `node` and everything under it at `depth`.
+    fn walk(&mut self, node: &'a AxNode, depth: usize) {
+        if !self.visited.insert(node.node_id.as_str()) {
+            return;
+        }
+        if self
+            .request
+            .depth
+            .is_some_and(|limit| depth > limit as usize)
+        {
+            return;
+        }
+
+        // An ignored node is not in the accessibility tree at all, but its
+        // children may be: an `aria-hidden` wrapper around visible content is
+        // exactly this shape. Descending without emitting keeps them reachable
+        // at the parent's depth rather than orphaning them.
+        let emit = !node.ignored && self.keeps(node);
+        let child_depth = if emit { depth + 1 } else { depth };
+
+        if emit {
+            let reference = self.mint(node);
+            self.lines
+                .push(self.line(node, depth, reference.as_deref()));
+        }
+
+        for child_id in &node.child_ids {
+            if let Some(child) = self.by_id.get(child_id.as_str()).copied() {
+                self.walk(child, child_depth);
+            }
+        }
+    }
+
+    /// Whether this node survives the request's filters.
+    fn keeps(&self, node: &AxNode) -> bool {
+        let role = node.role();
+        if role.is_empty() {
+            return false;
+        }
+
+        if self.request.interactive_only && !is_interactive(&role) {
+            return false;
+        }
+
+        // `compact` drops the scaffolding even when it is named: a document, a
+        // list, or a table wrapper tells an agent nothing it cannot see from the
+        // items inside it, and on a real page they are most of the lines.
+        if self.request.compact && is_structural(&role) {
+            return false;
+        }
+
+        // A node with neither a name nor a value nor a reason to be acted on
+        // contributes an empty line and nothing else.
+        is_interactive(&role)
+            || !node.name.as_text().trim().is_empty()
+            || !node.value.as_text().trim().is_empty()
+    }
+
+    /// Gives `node` a ref when it is one an agent could address.
+    fn mint(&mut self, node: &AxNode) -> Option<String> {
+        let backend = node.backend_dom_node_id?;
+        let role = node.role();
+        if !is_interactive(&role) && !is_content(&role) {
+            return None;
+        }
+
+        let id = format!("e{}", self.next_ref);
+        self.next_ref += 1;
+        self.refs.push(ElementRef {
+            id: id.clone(),
+            role,
+            name: clean(&node.name.as_text()),
+        });
+        self.nodes.insert(id.clone(), backend);
+        Some(id)
+    }
+
+    /// One rendered line.
+    fn line(&self, node: &AxNode, depth: usize, reference: Option<&str>) -> String {
+        let mut line = format!("{}- {}", "  ".repeat(depth), node.role());
+
+        let name = clean(&node.name.as_text());
+        if !name.is_empty() {
+            let _ = write!(line, " \"{name}\"");
+        }
+
+        let value = clean(&node.value.as_text());
+        if !value.is_empty() && value != name {
+            let _ = write!(line, " value=\"{value}\"");
+        }
+
+        for (property, label) in [("checked", "checked"), ("expanded", "expanded")] {
+            if let Some(state) = node.property(property) {
+                let rendered = state.as_text();
+                if !rendered.is_empty() && rendered != "false" {
+                    let _ = write!(line, " {label}={rendered}");
+                }
+            }
+        }
+
+        // Reported only when true: an agent needs to know a control is disabled,
+        // and rendering `disabled=false` on every other control would triple the
+        // size of the tree to say nothing.
+        for property in ["disabled", "required", "selected"] {
+            if node.property(property).and_then(AxValueExt::truthy) == Some(true) {
+                let _ = write!(line, " {property}");
+            }
+        }
+
+        if self.request.include_urls
+            && let Some(url) = node.property("url").map(|value| clean(&value.as_text()))
+            && !url.is_empty()
+        {
+            let _ = write!(line, " url=\"{url}\"");
+        }
+
+        if let Some(reference) = reference {
+            let _ = write!(line, " @{reference}");
+        }
+
+        line
+    }
+}
+
+/// Reading a property as a boolean, whichever way Chrome encoded it.
+trait AxValueExt {
+    /// The property as a boolean, when it is one.
+    fn truthy(&self) -> Option<bool>;
+}
+
+impl AxValueExt for super::types::AxValue {
+    fn truthy(&self) -> Option<bool> {
+        self.as_bool().or_else(|| match self.as_text().as_str() {
+            "true" => Some(true),
+            "false" => Some(false),
+            _ => None,
+        })
+    }
+}
+
+/// Collapses whitespace and strips the invisible characters that make an
+/// accessible name look mangled in a terminal.
+///
+/// A name is a screen reader's announcement, and pages routinely build them out
+/// of zero-width joiners, non-breaking spaces, and newlines from the markup. An
+/// agent comparing "Add to cart" against `Add\u{00A0}to cart` finds nothing.
+pub(crate) fn clean(raw: &str) -> String {
+    const INVISIBLE: &[char] = &['\u{FEFF}', '\u{200B}', '\u{200C}', '\u{200D}', '\u{2060}'];
+
+    raw.chars()
+        .map(|character| {
+            if character == '\u{00A0}' {
+                ' '
+            } else {
+                character
+            }
+        })
+        .filter(|character| !INVISIBLE.contains(character))
+        .collect::<String>()
+        .split_whitespace()
+        .collect::<Vec<_>>()
+        .join(" ")
+}
+
+/// Whether a role is one an agent acts on.
+pub(crate) fn is_interactive(role: &str) -> bool {
+    INTERACTIVE_ROLES.contains(&role)
+}
+
+/// Whether a role carries content without being actionable.
+fn is_content(role: &str) -> bool {
+    CONTENT_ROLES.contains(&role)
+}
+
+/// Whether a role exists only to hold other nodes.
+fn is_structural(role: &str) -> bool {
+    STRUCTURAL_ROLES.contains(&role)
+}
diff --git a/crates/tinybrowser/src/snapshot/test.rs b/crates/tinybrowser/src/snapshot/test.rs
new file mode 100644
index 0000000..fc932e1
--- /dev/null
+++ b/crates/tinybrowser/src/snapshot/test.rs
@@ -0,0 +1,296 @@
+//! Tests for snapshot rendering.
+//!
+//! Rendering is pure, so all of it is testable from a node list. These fix the
+//! output an agent reads: the indentation, where a ref appears, and which nodes
+//! each filter drops. A change to any of those changes what every agent sees, so
+//! it should have to be made here too.
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use serde_json::json;
+use tinybrowser_bus::SnapshotRequest;
+
+use super::render::{clean, is_interactive, render};
+use super::types::AxNode;
+
+/// A small page: a heading, a paragraph, a link, and a disabled button, inside
+/// the generic wrappers a real document is full of.
+fn page() -> Vec<AxNode> {
+    nodes(json!([
+        {
+            "nodeId": "1",
+            "role": { "value": "RootWebArea" },
+            "name": { "value": "Example Domain" },
+            "childIds": ["2"],
+            "backendDOMNodeId": 1,
+        },
+        {
+            "nodeId": "2",
+            "role": { "value": "generic" },
+            "name": { "value": "" },
+            "childIds": ["3", "4", "5", "6"],
+            "backendDOMNodeId": 2,
+        },
+        {
+            "nodeId": "3",
+            "role": { "value": "heading" },
+            "name": { "value": "Example Domain" },
+            "childIds": [],
+            "backendDOMNodeId": 3,
+        },
+        {
+            "nodeId": "4",
+            "role": { "value": "paragraph" },
+            "name": { "value": "This domain is for use in examples." },
+            "childIds": [],
+            "backendDOMNodeId": 4,
+        },
+        {
+            "nodeId": "5",
+            "role": { "value": "link" },
+            "name": { "value": "More information" },
+            "properties": [{ "name": "url", "value": { "value": "https://iana.org/domains" } }],
+            "childIds": [],
+            "backendDOMNodeId": 5,
+        },
+        {
+            "nodeId": "6",
+            "role": { "value": "button" },
+            "name": { "value": "Submit" },
+            "properties": [{ "name": "disabled", "value": { "value": true } }],
+            "childIds": [],
+            "backendDOMNodeId": 6,
+        },
+    ]))
+}
+
+fn nodes(value: serde_json::Value) -> Vec<AxNode> {
+    serde_json::from_value(value).expect("the fixture parses")
+}
+
+#[test]
+fn a_tree_renders_as_indented_roles_and_names() {
+    let rendered = render(&page(), &SnapshotRequest::default(), None).expect("renders");
+
+    assert!(
+        rendered
+            .tree
+            .starts_with("- RootWebArea \"Example Domain\"")
+    );
+    assert!(rendered.tree.contains("\n  - heading \"Example Domain\""));
+    assert!(rendered.tree.contains("\n  - link \"More information\""));
+}
+
+#[test]
+fn addressable_nodes_carry_a_ref_and_unaddressable_ones_do_not() {
+    let rendered = render(&page(), &SnapshotRequest::default(), None).expect("renders");
+
+    assert!(rendered.tree.contains("- link \"More information\" @"));
+    // The generic wrapper is neither interactive nor content: there is nothing
+    // an agent would do with a ref to it.
+    assert!(!rendered.tree.contains("- generic"));
+}
+
+#[test]
+fn refs_are_minted_in_document_order() {
+    let rendered = render(&page(), &SnapshotRequest::default(), None).expect("renders");
+    let ids: Vec<&str> = rendered.refs.iter().map(|r| r.id.as_str()).collect();
+
+    assert_eq!(ids.first(), Some(&"e1"));
+    assert_eq!(
+        rendered
+            .refs
+            .iter()
+            .find(|r| r.role == "link")
+            .map(|r| r.name.as_str()),
+        Some("More information")
+    );
+}
+
+#[test]
+fn every_ref_resolves_to_a_backend_node() {
+    let rendered = render(&page(), &SnapshotRequest::default(), None).expect("renders");
+
+    for element in &rendered.refs {
+        assert!(
+            rendered.nodes.contains_key(&element.id),
+            "@{} appears in the tree with nothing to resolve to",
+            element.id
+        );
+    }
+    assert_eq!(rendered.nodes.len(), rendered.refs.len());
+}
+
+#[test]
+fn interactive_only_keeps_the_controls_and_drops_the_prose() {
+    let rendered = render(&page(), &SnapshotRequest::interactive(), None).expect("renders");
+
+    assert!(rendered.tree.contains("- link \"More information\""));
+    assert!(rendered.tree.contains("- button \"Submit\""));
+    assert!(!rendered.tree.contains("paragraph"));
+    assert!(!rendered.tree.contains("heading"));
+}
+
+#[test]
+fn compact_drops_the_structural_scaffolding() {
+    let request = SnapshotRequest {
+        compact: true,
+        ..SnapshotRequest::default()
+    };
+    let rendered = render(&page(), &request, None).expect("renders");
+
+    // Dropped even though it is named: the wrapper tells an agent nothing the
+    // items inside it do not.
+    assert!(!rendered.tree.contains("RootWebArea"));
+    assert!(rendered.tree.contains("- heading \"Example Domain\""));
+    assert!(rendered.tree.contains("- link \"More information\""));
+}
+
+#[test]
+fn a_disabled_control_says_so() {
+    // An agent that cannot see this clicks the button, gets no error, and
+    // reports that it submitted the form.
+    let rendered = render(&page(), &SnapshotRequest::default(), None).expect("renders");
+    assert!(rendered.tree.contains("- button \"Submit\" disabled"));
+}
+
+#[test]
+fn state_that_is_false_is_not_rendered() {
+    let tree = nodes(json!([{
+        "nodeId": "1",
+        "role": { "value": "checkbox" },
+        "name": { "value": "Remember me" },
+        "properties": [
+            { "name": "checked", "value": { "value": "false" } },
+            { "name": "disabled", "value": { "value": false } },
+        ],
+        "childIds": [],
+        "backendDOMNodeId": 1,
+    }]));
+    let rendered = render(&tree, &SnapshotRequest::default(), None).expect("renders");
+
+    assert!(rendered.tree.contains("- checkbox \"Remember me\""));
+    assert!(!rendered.tree.contains("checked"));
+    assert!(!rendered.tree.contains("disabled"));
+}
+
+#[test]
+fn urls_are_annotated_only_when_asked_for() {
+    let without = render(&page(), &SnapshotRequest::default(), None).expect("renders");
+    assert!(!without.tree.contains("iana.org"));
+
+    let with = render(
+        &page(),
+        &SnapshotRequest {
+            include_urls: true,
+            ..SnapshotRequest::default()
+        },
+        None,
+    )
+    .expect("renders");
+    assert!(with.tree.contains("url=\"https://iana.org/domains\""));
+}
+
+#[test]
+fn depth_stops_the_walk() {
+    let request = SnapshotRequest {
+        depth: Some(0),
+        ..SnapshotRequest::default()
+    };
+    let rendered = render(&page(), &request, None).expect("renders");
+
+    assert!(rendered.tree.contains("RootWebArea"));
+    assert!(!rendered.tree.contains("heading"));
+}
+
+#[test]
+fn max_chars_truncates_and_says_so() {
+    let request = SnapshotRequest {
+        max_chars: 20,
+        ..SnapshotRequest::default()
+    };
+    let rendered = render(&page(), &request, None).expect("renders");
+
+    assert!(rendered.truncated);
+    assert_eq!(rendered.tree.chars().count(), 20);
+}
+
+#[test]
+fn an_ignored_node_is_skipped_but_its_children_are_not() {
+    // An `aria-hidden` wrapper around visible content is exactly this shape.
+    // Dropping the subtree with the wrapper would lose the content entirely.
+    let tree = nodes(json!([
+        {
+            "nodeId": "1",
+            "role": { "value": "RootWebArea" },
+            "name": { "value": "Page" },
+            "childIds": ["2"],
+            "backendDOMNodeId": 1,
+        },
+        {
+            "nodeId": "2",
+            "ignored": true,
+            "childIds": ["3"],
+            "backendDOMNodeId": 2,
+        },
+        {
+            "nodeId": "3",
+            "role": { "value": "button" },
+            "name": { "value": "Buried" },
+            "childIds": [],
+            "backendDOMNodeId": 3,
+        },
+    ]));
+    let rendered = render(&tree, &SnapshotRequest::default(), None).expect("renders");
+
+    assert!(rendered.tree.contains("- button \"Buried\""));
+}
+
+#[test]
+fn a_cyclic_tree_terminates() {
+    // Nothing should be able to make a snapshot hang: a page controls the tree
+    // this walks, and a hang is a wedged session a host cannot recover.
+    let tree = nodes(json!([
+        {
+            "nodeId": "1",
+            "role": { "value": "RootWebArea" },
+            "name": { "value": "Loop" },
+            "childIds": ["2"],
+            "backendDOMNodeId": 1,
+        },
+        {
+            "nodeId": "2",
+            "role": { "value": "button" },
+            "name": { "value": "Round" },
+            "childIds": ["1"],
+            "backendDOMNodeId": 2,
+        },
+    ]));
+    let rendered = render(&tree, &SnapshotRequest::default(), None).expect("renders");
+
+    assert!(rendered.tree.contains("- button \"Round\""));
+}
+
+#[test]
+fn an_empty_tree_renders_to_nothing_rather_than_failing() {
+    assert!(render(&[], &SnapshotRequest::default(), None).is_none());
+}
+
+#[test]
+fn names_are_cleaned_of_invisible_characters() {
+    // Pages build accessible names out of non-breaking spaces and zero-width
+    // joiners; an agent matching on "Add to cart" finds nothing otherwise.
+    assert_eq!(clean("Add\u{00A0}to\u{200B} cart"), "Add to cart");
+    assert_eq!(clean("  spread   over\nlines  "), "spread over lines");
+    assert_eq!(clean(""), "");
+}
+
+#[test]
+fn the_interactive_roles_are_the_ones_an_agent_can_act_on() {
+    for role in ["button", "link", "textbox", "checkbox", "combobox"] {
+        assert!(is_interactive(role), "{role} should be interactive");
+    }
+    for role in ["paragraph", "heading", "generic"] {
+        assert!(!is_interactive(role), "{role} should not be interactive");
+    }
+}
diff --git a/crates/tinybrowser/src/snapshot/types.rs b/crates/tinybrowser/src/snapshot/types.rs
new file mode 100644
index 0000000..103f1b8
--- /dev/null
+++ b/crates/tinybrowser/src/snapshot/types.rs
@@ -0,0 +1,93 @@
+//! The shape of an accessibility node as Chrome reports it.
+//!
+//! Only the fields this crate reads are modelled. `Accessibility.getFullAXTree`
+//! returns considerably more — every ARIA property, source annotations for each
+//! computed value, relationship edges — and deserializing it all would cost a
+//! parse of a document-sized payload for fields nothing looks at.
+
+use serde::Deserialize;
+
+/// A computed accessibility value: Chrome wraps every one in an object.
+#[derive(Debug, Clone, Default, Deserialize)]
+pub(crate) struct AxValue {
+    /// The value itself, absent when the property is not computed for this node.
+    pub(crate) value: Option<serde_json::Value>,
+}
+
+impl AxValue {
+    /// The value as a string, empty when it is absent or not a string.
+    pub(crate) fn as_text(&self) -> String {
+        match &self.value {
+            Some(serde_json::Value::String(text)) => text.clone(),
+            Some(other) => other.to_string(),
+            None => String::new(),
+        }
+    }
+
+    /// The value as a boolean, when it is one.
+    pub(crate) fn as_bool(&self) -> Option<bool> {
+        self.value.as_ref().and_then(serde_json::Value::as_bool)
+    }
+}
+
+/// One node of the accessibility tree.
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub(crate) struct AxNode {
+    /// The node's identity within the tree.
+    pub(crate) node_id: String,
+    /// Whether the node is excluded from the accessibility tree. Ignored nodes
+    /// are kept in the response so the tree stays connected, and dropped here.
+    #[serde(default)]
+    pub(crate) ignored: bool,
+    /// The computed role, absent on ignored nodes.
+    #[serde(default)]
+    pub(crate) role: AxValue,
+    /// The computed accessible name.
+    #[serde(default)]
+    pub(crate) name: AxValue,
+    /// The current value of a field, slider, or similar.
+    #[serde(default)]
+    pub(crate) value: AxValue,
+    /// The computed ARIA properties worth rendering.
+    #[serde(default)]
+    pub(crate) properties: Vec<AxProperty>,
+    /// The identities of this node's children, in document order.
+    #[serde(default)]
+    pub(crate) child_ids: Vec<String>,
+    /// The DOM node behind this one, absent for nodes with no element — a text
+    /// run inside a paragraph, for instance. A node without one cannot be given
+    /// a ref, because there is nothing to act on.
+    ///
+    /// Named explicitly: `rename_all = "camelCase"` would spell this
+    /// `backendDomNodeId`, and Chrome sends `backendDOMNodeId`. The mismatch is
+    /// silent — the field simply arrives as `None` — so every node loses its
+    /// ref and a snapshot renders with nothing an agent can act on.
+    #[serde(default, rename = "backendDOMNodeId")]
+    pub(crate) backend_dom_node_id: Option<i64>,
+}
+
+/// One computed ARIA property.
+#[derive(Debug, Clone, Deserialize)]
+pub(crate) struct AxProperty {
+    /// The property name, such as `checked` or `disabled`.
+    pub(crate) name: String,
+    /// Its computed value.
+    #[serde(default)]
+    pub(crate) value: AxValue,
+}
+
+impl AxNode {
+    /// The node's role, or an empty string.
+    pub(crate) fn role(&self) -> String {
+        self.role.as_text()
+    }
+
+    /// The value of a named property, when the node has one.
+    pub(crate) fn property(&self, name: &str) -> Option<&AxValue> {
+        self.properties
+            .iter()
+            .find(|property| property.name == name)
+            .map(|property| &property.value)
+    }
+}
diff --git a/crates/tinybrowser/src/tinybus_module/README.md b/crates/tinybrowser/src/tinybus_module/README.md
new file mode 100644
index 0000000..1a75477
--- /dev/null
+++ b/crates/tinybrowser/src/tinybus_module/README.md
@@ -0,0 +1,51 @@
+# TinyBus Adapter
+
+This module is the boundary between the browser engine and TinyBus module ABI
+v1. `BrowserService` exposes each method of `crate::Browser` as a typed bus
+member, and `setup` registers its object and claims the well-known interface
+name. Neither the name, the object path, nor the payload types are spelled here:
+they come from `tinybrowser-bus`, so a rename is a compile error in every
+consumer instead of an `UnknownMethod` at runtime.
+
+## There are no decisions in this layer
+
+Each member deserializes its arguments, calls one method on the engine, and maps
+an `Error` to a wire error name. That is deliberate. Anything decided here could
+only be tested through a bus, and a Rust caller using `Browser` directly would
+not get it — so a rule that belongs to the browser goes in the engine, and this
+file stays a translation.
+
+The one thing it does own is the engine's lifetime. A process-wide `OnceLock`
+holds it, because the sessions it keeps are browser processes: a per-call engine
+would launch and discard a browser for every navigation, and a per-connection
+one would strand sessions the moment a host reconnected. TinyBus never unloads a
+module, so "the life of the process" and "the life of the module" are the same
+thing.
+
+## Errors travel as names
+
+A host does not show a model a raw failure string; it decides what *kind* of
+failure happened. A bad selector is something a model can fix by taking a fresh
+snapshot. A browser that will not launch is not. A navigation refused by policy
+must never be retried. `to_bus` puts a stable name from
+`tinybrowser_bus::errors` on every failure and leaves the prose in the message,
+so a host matches on a constant rather than on wording that will be reworded.
+
+## Keeping the surface honest
+
+`tinybus_module::module_export!` emits the descriptor, embedded manifest, and
+initialization symbols consumed by the dynamic loader. The manifest method list
+must stay aligned with the interface macro's dispatch table and with
+`tinybrowser_bus::names::METHODS`; the unit tests check both relationships, so a
+member added to one and forgotten in another fails the build rather than
+surfacing as an unknown method in a host at runtime.
+
+Integration tests use TinyBus's in-memory transport and need no browser: the
+members they exercise are the ones that reach a decision before a session is
+looked up, which is exactly what this layer is responsible for.
+`crates/tinybrowser/examples/verify_module.rs` loads a compiled `cdylib` through
+the real dynamic loader before a release archive is accepted, and
+`examples/over_the_bus.rs` drives a real page through it end to end.
+
+Code here must not retain Rust-owned data across the ABI boundary or bypass the
+SDK exports with an ad hoc FFI surface.
diff --git a/crates/tinybrowser/src/tinybus_module/mod.rs b/crates/tinybrowser/src/tinybus_module/mod.rs
new file mode 100644
index 0000000..669ef2b
--- /dev/null
+++ b/crates/tinybrowser/src/tinybus_module/mod.rs
@@ -0,0 +1,214 @@
+//! `TinyBus` module entrypoint and bus-facing interface.
+//!
+//! # What this layer is, and what it deliberately is not
+//!
+//! It is a translation: each member deserializes its arguments, calls one method
+//! on a [`Browser`], and turns an [`Error`] into a wire error name. There are no
+//! decisions in it. That is the point — anything decided here could only be
+//! tested through a bus, and a Rust caller using [`Browser`] directly would not
+//! get it.
+//!
+//! The names and payload types come from [`tinybrowser_bus`], so a host spells
+//! them from the contract crate instead of repeating string literals.
+//!
+//! # One engine for the life of the process
+//!
+//! The engine is a process-wide singleton, because the sessions it holds are
+//! browser processes: a per-call engine would launch and discard a browser for
+//! every navigation, and a per-connection one would strand sessions the moment a
+//! host reconnected. `TinyBus` never unloads a module, so "the life of the
+//! process" and "the life of the module" are the same thing.
+
+use std::sync::{Arc, OnceLock};
+
+use tinybrowser_bus::{
+    Action, ActionOutcome, EvaluateRequest, NavigateRequest, OutputChunk, OutputId, OutputRef,
+    PageState, PageText, ReadRequest, ScreenshotRequest, SessionId, SessionInfo, SessionOptions,
+    Snapshot, SnapshotRequest, names,
+};
+use tinybus::{Connection, Result as BusResult};
+
+use crate::{Browser, Error};
+
+/// The engine every call goes to.
+///
+/// A `OnceLock` rather than a lazily-created-per-call value: two calls arriving
+/// together must reach the same session table, or the second would not find the
+/// session the first opened.
+static ENGINE: OnceLock<Arc<Browser>> = OnceLock::new();
+
+/// The process-wide engine, created on first use.
+fn engine() -> Arc<Browser> {
+    Arc::clone(ENGINE.get_or_init(|| Arc::new(Browser::new())))
+}
+
+/// The bus-facing object.
+struct BrowserService;
+
+#[tinybus::interface(name = "ai.tinyhumans.tinybrowser.Browser")]
+impl BrowserService {
+    /// Launches or attaches a browser and returns the session that owns it.
+    async fn open_session(&self, options: SessionOptions) -> BusResult<SessionInfo> {
+        engine()
+            .open_session(options)
+            .await
+            .map_err(|error| to_bus(&error))
+    }
+
+    /// Closes a session and everything it owns.
+    async fn close_session(&self, id: SessionId) -> BusResult<()> {
+        engine()
+            .close_session(&id)
+            .await
+            .map_err(|error| to_bus(&error))
+    }
+
+    /// Lists the sessions this module is holding open.
+    async fn list_sessions(&self) -> BusResult<Vec<SessionInfo>> {
+        Ok(engine().list_sessions().await)
+    }
+
+    /// Navigates a session's active page.
+    async fn navigate(&self, id: SessionId, request: NavigateRequest) -> BusResult<PageState> {
+        engine()
+            .navigate(&id, &request)
+            .await
+            .map_err(|error| to_bus(&error))
+    }
+
+    /// Captures the accessibility tree of a session's active page.
+    async fn snapshot(&self, id: SessionId, request: SnapshotRequest) -> BusResult<Snapshot> {
+        engine()
+            .snapshot(&id, &request)
+            .await
+            .map_err(|error| to_bus(&error))
+    }
+
+    /// Performs one interaction against a session's active page.
+    async fn perform(&self, id: SessionId, action: Action) -> BusResult<ActionOutcome> {
+        engine()
+            .perform(&id, &action)
+            .await
+            .map_err(|error| to_bus(&error))
+    }
+
+    /// Extracts a session's active page as agent-readable text.
+    async fn read_page(&self, id: SessionId, request: ReadRequest) -> BusResult<PageText> {
+        engine()
+            .read_page(&id, &request)
+            .await
+            .map_err(|error| to_bus(&error))
+    }
+
+    /// Evaluates JavaScript in a session's active page.
+    async fn evaluate(
+        &self,
+        id: SessionId,
+        request: EvaluateRequest,
+    ) -> BusResult<serde_json::Value> {
+        engine()
+            .evaluate(&id, &request)
+            .await
+            .map_err(|error| to_bus(&error))
+    }
+
+    /// Captures a screenshot and holds it for collection.
+    async fn screenshot(&self, id: SessionId, request: ScreenshotRequest) -> BusResult<OutputRef> {
+        engine()
+            .screenshot(&id, &request)
+            .await
+            .map_err(|error| to_bus(&error))
+    }
+
+    /// Reads one chunk of a held output.
+    async fn read_output(&self, id: OutputId, offset: u64, len: u64) -> BusResult<OutputChunk> {
+        engine()
+            .read_output(&id, offset, len)
+            .await
+            .map_err(|error| to_bus(&error))
+    }
+
+    /// Releases a held output before it expires.
+    async fn release_output(&self, id: OutputId) -> BusResult<()> {
+        engine()
+            .release_output(&id)
+            .await
+            .map_err(|error| to_bus(&error))
+    }
+
+    /// Reports the contract version this module serves.
+    ///
+    /// A host calls this once, before its first real call, and compares it with
+    /// [`tinybrowser_bus::is_compatible`]. Doing it the other way round — making
+    /// a real call and reading the failure — cannot distinguish "this member
+    /// does not exist" from "this member failed".
+    async fn contract_version(&self) -> BusResult<(u32, u32)> {
+        // The only member that answers from a constant. The interface macro
+        // requires every member to be an `async fn`, so the future is made
+        // explicit rather than suppressing the lint that notices there is
+        // nothing to await.
+        std::future::ready(Ok(tinybrowser_bus::CONTRACT_VERSION)).await
+    }
+}
+
+/// Turns an engine error into the wire error a host matches on.
+///
+/// The name is what carries the meaning; the message is for a person reading a
+/// log. See [`tinybrowser_bus::errors`] for what a host does with each name.
+fn to_bus(error: &Error) -> tinybus::Error {
+    tinybus::Error::MethodFailed {
+        name: error.wire_name().to_string(),
+        message: error.to_string(),
+    }
+}
+
+/// Serves the interface and claims the well-known name.
+async fn setup(connection: Connection) -> BusResult<()> {
+    connection
+        .serve_at(names::OBJECT_PATH.try_into()?, BrowserService)
+        .await?;
+    connection.request_name(names::INTERFACE).await?;
+    Ok(())
+}
+
+// Isolate the generated public C symbols so the lint exception cannot hide
+// undocumented Rust API. Their contract is TinyBus ABI v1, and none is a
+// Rust-callable export from this module.
+#[allow(
+    missing_docs,
+    unreachable_pub,
+    reason = "generated C ABI symbols are documented by the TinyBus module SDK"
+)]
+mod exports {
+    tinybus_module::module_export! {
+        setup = super::setup,
+        // Two threads: one to serve calls, one so a long navigation does not
+        // block the call that would close the session it is stuck in.
+        worker_threads = 2,
+        provides = ["ai.tinyhumans.tinybrowser.Browser"],
+        methods = [
+            "OpenSession",
+            "CloseSession",
+            "ListSessions",
+            "Navigate",
+            "Snapshot",
+            "Perform",
+            "ReadPage",
+            "Evaluate",
+            "Screenshot",
+            "ReadOutput",
+            "ReleaseOutput",
+            "ContractVersion",
+        ],
+        signals = [],
+        requires = [],
+        optional = [],
+        // Eager rather than lazy: the module is cheap until a session is opened,
+        // and a host that discovers the interface at startup can report the
+        // capability without paying a load to find out it exists.
+        lazy = false,
+    }
+}
+
+#[cfg(test)]
+mod test;
diff --git a/crates/tinybrowser/src/tinybus_module/test.rs b/crates/tinybrowser/src/tinybus_module/test.rs
new file mode 100644
index 0000000..e02c521
--- /dev/null
+++ b/crates/tinybrowser/src/tinybus_module/test.rs
@@ -0,0 +1,381 @@
+//! Tests for the `TinyBus` module adapter and its declared surface.
+//!
+//! Every one of these runs against a real in-memory broker with a real client on
+//! the other side, because the parts worth testing here only exist once a frame
+//! has been serialized: whether the dispatch table matches the contract, whether
+//! a payload survives the round trip, and whether a failure arrives carrying the
+//! error name a host will match on.
+//!
+//! None of them needs a browser. The members exercised are the ones that reach a
+//! decision before a session is looked up, which is exactly the layer this
+//! adapter is responsible for.
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use tinybrowser_bus::{SessionId, errors, names};
+use tinybus::broker::Broker;
+use tinybus::transport::memory::MemoryBus;
+use tinybus::{Connection, Interface};
+use tokio::io::{AsyncReadExt as _, AsyncWriteExt as _};
+
+use super::{BrowserService, setup};
+
+/// A broker, the module, and a client proxy pointed at it.
+///
+/// The module's own connection comes back with the proxy and has to be held:
+/// dropping it releases the well-known name, and every call then fails with
+/// `NameHasNoOwner` rather than reaching the service that was just set up.
+async fn connected() -> tinybus::Result<(tinybus::Proxy, Connection)> {
+    let bus = MemoryBus::new();
+    Broker::new().spawn(bus.clone());
+
+    let service = Connection::connect(bus.connect().await?).await?;
+    setup(service.clone()).await?;
+
+    let client = Connection::connect(bus.connect().await?).await?;
+    let proxy = client.proxy(names::INTERFACE, names::OBJECT_PATH, names::INTERFACE)?;
+    Ok((proxy, service))
+}
+
+#[test]
+fn declared_methods_match_the_dispatch_table() {
+    // The contract lists the members; the macro derives them from the `impl`.
+    // This is what stops a member added to one and forgotten in the other from
+    // surfacing as an unknown method in a host at runtime.
+    let methods = BrowserService
+        .members()
+        .into_iter()
+        .map(|member| member.to_string())
+        .collect::<Vec<_>>();
+
+    assert_eq!(methods, names::METHODS.to_vec());
+}
+
+#[test]
+fn the_served_interface_name_matches_the_contract() {
+    assert_eq!(BrowserService.name().to_string(), names::INTERFACE);
+}
+
+#[tokio::test]
+async fn the_module_reports_the_contract_version_it_was_built_against() -> tinybus::Result<()> {
+    let (proxy, _module) = connected().await?;
+    let version: (u32, u32) = proxy.call(names::methods::CONTRACT_VERSION, ()).await?;
+
+    assert_eq!(version, tinybrowser_bus::CONTRACT_VERSION);
+    assert!(tinybrowser_bus::is_compatible(version));
+    Ok(())
+}
+
+#[tokio::test]
+async fn listing_sessions_answers_with_a_decodable_list() -> tinybus::Result<()> {
+    // Not "is empty": the engine behind the members is process-wide, so a live
+    // test running alongside this one has its own session open and belongs in
+    // the list. What this checks is the member — that it answers, and that the
+    // reply decodes as the contract says it will.
+    let (proxy, _module) = connected().await?;
+    let sessions: Vec<tinybrowser_bus::SessionInfo> =
+        proxy.call(names::methods::LIST_SESSIONS, ()).await?;
+
+    assert!(
+        !sessions
+            .iter()
+            .any(|info| info.id == SessionId::new("never-opened")),
+        "a session nobody opened is listed"
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn closing_an_unknown_session_succeeds_over_the_bus() -> tinybus::Result<()> {
+    // Idempotent teardown is a property of the wire surface, not only of the
+    // engine: a host retrying a close after a timeout must not get an error.
+    let (proxy, _module) = connected().await?;
+    proxy
+        .call::<()>(
+            names::methods::CLOSE_SESSION,
+            (SessionId::new("never-opened"),),
+        )
+        .await?;
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn a_failure_arrives_carrying_its_wire_error_name() -> tinybus::Result<()> {
+    // The name is the whole point of the mapping: a host decides what to show a
+    // model by matching on it, and a failure that arrives as generic prose sends
+    // it down the wrong recovery path.
+    let (proxy, _module) = connected().await?;
+    let result = proxy
+        .call::<tinybrowser_bus::PageState>(
+            names::methods::NAVIGATE,
+            (
+                SessionId::new("never-opened"),
+                tinybrowser_bus::NavigateRequest::new("https://example.com"),
+            ),
+        )
+        .await;
+
+    let Err(error) = result else {
+        panic!("navigating in a session that does not exist unexpectedly succeeded");
+    };
+    assert!(
+        error.to_string().contains(errors::NO_SUCH_SESSION)
+            || error.to_string().contains("no such session"),
+        "{error}"
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn an_empty_expression_is_refused_over_the_bus() -> tinybus::Result<()> {
+    let (proxy, _module) = connected().await?;
+    let result = proxy
+        .call::<serde_json::Value>(
+            names::methods::EVALUATE,
+            (
+                SessionId::new("never-opened"),
+                tinybrowser_bus::EvaluateRequest::new("   "),
+            ),
+        )
+        .await;
+
+    let Err(error) = result else {
+        panic!("an empty expression unexpectedly succeeded");
+    };
+    assert!(error.to_string().contains("expression is empty"), "{error}");
+    Ok(())
+}
+
+#[tokio::test]
+async fn releasing_an_unknown_output_succeeds_over_the_bus() -> tinybus::Result<()> {
+    let (proxy, _module) = connected().await?;
+    proxy
+        .call::<()>(
+            names::methods::RELEASE_OUTPUT,
+            (tinybrowser_bus::OutputId::new("never-captured"),),
+        )
+        .await?;
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn reading_an_unknown_output_reports_it() -> tinybus::Result<()> {
+    let (proxy, _module) = connected().await?;
+    let result = proxy
+        .call::<tinybrowser_bus::OutputChunk>(
+            names::methods::READ_OUTPUT,
+            (
+                tinybrowser_bus::OutputId::new("never-captured"),
+                0u64,
+                1024u64,
+            ),
+        )
+        .await;
+
+    let Err(error) = result else {
+        panic!("reading an output that was never captured unexpectedly succeeded");
+    };
+    assert!(error.to_string().contains("no such output"), "{error}");
+    Ok(())
+}
+
+/// Whether this run opted into driving a real browser.
+///
+/// The same switch `tests/live_chrome.rs` reads, for the same reason: the
+/// members below cannot be exercised without a browser, and a machine without
+/// one must still pass `cargo test --all-features`.
+fn live() -> bool {
+    std::env::var("TINYBROWSER_LIVE_TESTS").is_ok_and(|value| !value.is_empty() && value != "0")
+}
+
+/// The session options the live tests here open with.
+fn options() -> tinybrowser_bus::SessionOptions {
+    tinybrowser_bus::SessionOptions {
+        args: std::env::var("TINYBROWSER_TEST_ARGS")
+            .unwrap_or_default()
+            .split_whitespace()
+            .map(str::to_string)
+            .collect(),
+        ..tinybrowser_bus::SessionOptions::default()
+    }
+}
+
+/// Serves one page on loopback and returns its URL.
+async fn serve(body: &'static str) -> String {
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("binds a loopback port");
+    let address = listener.local_addr().expect("has an address");
+
+    tokio::spawn(async move {
+        let Ok((mut stream, _)) = listener.accept().await else {
+            return;
+        };
+        let mut scratch = [0_u8; 2048];
+        let _ = stream.read(&mut scratch).await;
+        let document = format!(
+            "<!doctype html><html><head><title>bus</title></head><body>{body}</body></html>"
+        );
+        let response = format!(
+            "HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\n\
+             Content-Length: {}\r\nConnection: close\r\n\r\n{document}",
+            document.len()
+        );
+        let _ = stream.write_all(response.as_bytes()).await;
+        let _ = stream.shutdown().await;
+    });
+
+    format!("http://{address}/")
+}
+
+#[tokio::test]
+async fn live_every_member_answers_over_a_real_bus() -> tinybus::Result<()> {
+    if !live() {
+        return Ok(());
+    }
+
+    // One test rather than a dozen because the expensive part is the browser,
+    // and because what is being checked is the *surface*: every member
+    // serializes its arguments, reaches the engine, and returns a payload the
+    // client can decode. The behaviour behind each one is covered by
+    // `tests/live_chrome.rs`.
+    let (proxy, _module) = connected().await?;
+
+    let session: tinybrowser_bus::SessionInfo = proxy
+        .call(names::methods::OPEN_SESSION, (options(),))
+        .await?;
+    assert!(session.launched);
+
+    // Asserted by identity rather than by count: the module's engine is
+    // process-wide on purpose, so every test in this binary shares it and any
+    // other live test with a session open is legitimately in this list too.
+    let listed: Vec<tinybrowser_bus::SessionInfo> =
+        proxy.call(names::methods::LIST_SESSIONS, ()).await?;
+    assert!(
+        listed.iter().any(|info| info.id == session.id),
+        "the session just opened is missing from {listed:?}"
+    );
+
+    let page: tinybrowser_bus::PageState = proxy
+        .call(
+            names::methods::NAVIGATE,
+            (
+                &session.id,
+                tinybrowser_bus::NavigateRequest::new(
+                    serve("<h1>Bus</h1><button id='b'>Press</button>").await,
+                ),
+            ),
+        )
+        .await?;
+    assert_eq!(page.title, "bus");
+    assert_eq!(page.status, Some(200));
+
+    let snapshot: tinybrowser_bus::Snapshot = proxy
+        .call(
+            names::methods::SNAPSHOT,
+            (&session.id, tinybrowser_bus::SnapshotRequest::interactive()),
+        )
+        .await?;
+    let reference = snapshot.refs.first().expect("a button in the snapshot");
+    assert_eq!(reference.role, "button");
+
+    let outcome: tinybrowser_bus::ActionOutcome = proxy
+        .call(
+            names::methods::PERFORM,
+            (
+                &session.id,
+                tinybrowser_bus::Action::GetText {
+                    target: tinybrowser_bus::Target::reference(&reference.id),
+                },
+            ),
+        )
+        .await?;
+    assert_eq!(outcome.value, serde_json::json!("Press"));
+
+    let text: tinybrowser_bus::PageText = proxy
+        .call(
+            names::methods::READ_PAGE,
+            (&session.id, tinybrowser_bus::ReadRequest::default()),
+        )
+        .await?;
+    assert!(text.content.contains("Bus"), "{}", text.content);
+
+    let value: serde_json::Value = proxy
+        .call(
+            names::methods::EVALUATE,
+            (
+                &session.id,
+                tinybrowser_bus::EvaluateRequest::new("document.title"),
+            ),
+        )
+        .await?;
+    assert_eq!(value, serde_json::json!("bus"));
+
+    let handle: tinybrowser_bus::OutputRef = proxy
+        .call(
+            names::methods::SCREENSHOT,
+            (&session.id, tinybrowser_bus::ScreenshotRequest::default()),
+        )
+        .await?;
+    assert_eq!(handle.media_type, "image/png");
+
+    let chunk: tinybrowser_bus::OutputChunk = proxy
+        .call(
+            names::methods::READ_OUTPUT,
+            (&handle.id, 0_u64, 64_u64 * 1024),
+        )
+        .await?;
+    assert!(!chunk.data.is_empty());
+
+    proxy
+        .call::<()>(names::methods::RELEASE_OUTPUT, (&handle.id,))
+        .await?;
+    proxy
+        .call::<()>(names::methods::CLOSE_SESSION, (&session.id,))
+        .await?;
+
+    let after: Vec<tinybrowser_bus::SessionInfo> =
+        proxy.call(names::methods::LIST_SESSIONS, ()).await?;
+    assert!(
+        !after.iter().any(|info| info.id == session.id),
+        "the closed session is still listed in {after:?}"
+    );
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn live_an_engine_failure_keeps_its_error_name_across_the_wire() -> tinybus::Result<()> {
+    if !live() {
+        return Ok(());
+    }
+
+    // The mapping matters most for a failure that came from deep inside the
+    // engine rather than from the adapter's own argument checks.
+    let (proxy, _module) = connected().await?;
+    let session: tinybrowser_bus::SessionInfo = proxy
+        .call(names::methods::OPEN_SESSION, (options(),))
+        .await?;
+
+    let result = proxy
+        .call::<tinybrowser_bus::PageState>(
+            names::methods::NAVIGATE,
+            (
+                &session.id,
+                tinybrowser_bus::NavigateRequest::new("file:///etc/passwd"),
+            ),
+        )
+        .await;
+
+    let Err(error) = result else {
+        panic!("navigating to a file url unexpectedly succeeded");
+    };
+    assert!(error.to_string().contains(errors::INVALID_INPUT), "{error}");
+
+    proxy
+        .call::<()>(names::methods::CLOSE_SESSION, (&session.id,))
+        .await?;
+    Ok(())
+}
diff --git a/crates/tinybrowser/tests/live_chrome.rs b/crates/tinybrowser/tests/live_chrome.rs
new file mode 100644
index 0000000..8d77055
--- /dev/null
+++ b/crates/tinybrowser/tests/live_chrome.rs
@@ -0,0 +1,1748 @@
+//! End-to-end tests against a real browser.
+//!
+//! # Why these are behind an environment variable
+//!
+//! Everything else in this repository is deterministic and needs nothing but a
+//! Rust toolchain. These need a Chrome, and a CI runner without one would fail
+//! them for a reason that has nothing to do with the change under test. So they
+//! are opt-in and named `live_*`, per this repository's testing rules:
+//!
+//! ```sh
+//! TINYBROWSER_LIVE_TESTS=1 cargo test -p tinybrowser --test live_chrome
+//! ```
+//!
+//! An environment variable rather than a Cargo feature because the contract
+//! command is `cargo test --all-features`, and a feature would be switched on by
+//! exactly the command that must keep passing on a machine with no browser.
+//!
+//! They are still hermetic in the way that matters: every page they drive is
+//! served by a one-shot HTTP server this file starts on loopback, so nothing
+//! here touches the network and no assertion depends on a website that can
+//! change underneath it.
+//!
+//! Loopback rather than a `data:` URL because the module refuses to navigate to
+//! anything but `http`, `https`, and `about:blank` — a policy worth keeping, and
+//! one a test suite should be bound by rather than exempt from.
+//!
+//! # Opted in, they fail rather than skip
+//!
+//! Setting the variable is the opt-in. Having opted in, a run that cannot find a
+//! browser fails: a suite that quietly skips reports green for a build in which
+//! nothing was checked, which is worse than no suite at all.
+//!
+//! On a host where Chrome needs extra flags — no usable sandbox, most often —
+//! pass them through:
+//!
+//! ```sh
+//! TINYBROWSER_CHROME=/path/to/chrome \
+//! TINYBROWSER_TEST_ARGS=--no-sandbox \
+//!   cargo test -p tinybrowser --features live-chrome
+//! ```
+//!
+//! # What they are for
+//!
+//! The unit suites cover every decision this crate makes *around* the protocol.
+//! What they cannot cover is whether the protocol conversation is right — that a
+//! ref resolves to the node the snapshot named, that a dispatched click reaches
+//! a handler, that a covered element is refused. That is the whole of what these
+//! check, and it is the part that would otherwise only be discovered in
+//! production.
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use base64::Engine as _;
+use tinybrowser::{
+    Action, Browser, Error, ImageFormat, LocateBy, Locator, NavigateRequest, ReadFormat,
+    ReadRequest, ScreenshotRequest, ScrollDirection, SessionInfo, SessionOptions, SnapshotRequest,
+    Target, WaitState, WaitUntil,
+};
+use tokio::io::{AsyncReadExt as _, AsyncWriteExt as _};
+
+/// Serves `body` as a complete HTML document on loopback, and returns its URL.
+///
+/// One connection per request and no routing: every test wants exactly one page,
+/// and a server with fewer moving parts is one that cannot fail in a way that
+/// looks like the module failing.
+async fn serve(body: &str) -> String {
+    let document = format!(
+        "<!doctype html><html><head><title>tinybrowser</title></head><body>{body}</body></html>"
+    );
+
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("binds a loopback port");
+    let address = listener.local_addr().expect("has an address");
+
+    tokio::spawn(async move {
+        loop {
+            let Ok((mut stream, _)) = listener.accept().await else {
+                return;
+            };
+            let document = document.clone();
+            tokio::spawn(async move {
+                // Read and discard the request: a server that replies without
+                // draining can have the write fail on it.
+                let mut scratch = [0_u8; 2048];
+                let _ = stream.read(&mut scratch).await;
+
+                let response = format!(
+                    "HTTP/1.1 200 OK\r\n\
+                     Content-Type: text/html; charset=utf-8\r\n\
+                     Content-Length: {}\r\n\
+                     Connection: close\r\n\r\n{document}",
+                    document.len()
+                );
+                let _ = stream.write_all(response.as_bytes()).await;
+                let _ = stream.shutdown().await;
+            });
+        }
+    });
+
+    format!("http://{address}/")
+}
+
+/// Whether this run opted in.
+///
+/// Returning `false` here is the *only* skip in this file, and it is the one a
+/// reader can see at the top of every test.
+fn enabled() -> bool {
+    std::env::var("TINYBROWSER_LIVE_TESTS").is_ok_and(|value| !value.is_empty() && value != "0")
+}
+
+/// The session options these tests open with.
+///
+/// `TINYBROWSER_TEST_ARGS` is how a host whose Chrome needs extra flags supplies
+/// them without those flags becoming this module's defaults.
+fn options() -> SessionOptions {
+    SessionOptions {
+        args: std::env::var("TINYBROWSER_TEST_ARGS")
+            .unwrap_or_default()
+            .split_whitespace()
+            .map(str::to_string)
+            .collect(),
+        ..SessionOptions::default()
+    }
+}
+
+/// An engine with one session on `body`.
+async fn on(body: &str) -> (Browser, SessionInfo) {
+    let browser = Browser::new();
+    let session = browser
+        .open_session(options())
+        .await
+        .expect("a browser is available; see this file's docs");
+
+    browser
+        .navigate(&session.id, &NavigateRequest::new(serve(body).await))
+        .await
+        .expect("navigates");
+
+    (browser, session)
+}
+
+#[tokio::test]
+async fn live_navigating_reports_where_the_page_landed() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on("<h1>Hello</h1>").await;
+
+    let state = browser
+        .navigate(
+            &session.id,
+            &NavigateRequest {
+                url: serve("<h1>Second</h1>").await,
+                wait_until: WaitUntil::DomContentLoaded,
+                timeout_ms: Some(10_000),
+            },
+        )
+        .await
+        .expect("navigates");
+
+    assert_eq!(state.title, "tinybrowser");
+    assert!(state.url.starts_with("http://127.0.0.1:"), "{}", state.url);
+    // The status comes from the response the navigation actually received, which
+    // is the one thing a caller cannot recover from the URL alone.
+    assert_eq!(state.status, Some(200));
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_a_snapshot_ref_resolves_to_the_element_it_named() {
+    if !enabled() {
+        return;
+    }
+    // The single most important property in the crate: an agent acts on the ref
+    // it read, and the node behind it is the one the snapshot described.
+    let (browser, session) = on("<button id='a'>Alpha</button><button id='b'>Beta</button>\
+         <script>document.body.onclick = (e) => { document.title = e.target.id; };</script>")
+    .await;
+
+    let snapshot = browser
+        .snapshot(&session.id, &SnapshotRequest::interactive())
+        .await
+        .expect("snapshots");
+
+    let beta = snapshot
+        .refs
+        .iter()
+        .find(|element| element.name == "Beta")
+        .expect("the second button is in the snapshot");
+
+    let outcome = browser
+        .perform(
+            &session.id,
+            &Action::Click {
+                target: Target::reference(&beta.id),
+                new_tab: false,
+            },
+        )
+        .await
+        .expect("clicks");
+
+    assert_eq!(outcome.page.title, "b");
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_a_ref_from_a_previous_snapshot_is_refused() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on("<button>Alpha</button>").await;
+
+    let first = browser
+        .snapshot(&session.id, &SnapshotRequest::interactive())
+        .await
+        .expect("snapshots");
+    let reference = first.refs.first().expect("a ref").id.clone();
+
+    // Navigating replaces the document, so every outstanding ref names a node
+    // that is gone. Acting on one must say so rather than resolve to whatever
+    // now occupies that position.
+    browser
+        .navigate(
+            &session.id,
+            &NavigateRequest::new(serve("<button>Beta</button>").await),
+        )
+        .await
+        .expect("navigates");
+
+    let error = browser
+        .perform(
+            &session.id,
+            &Action::Click {
+                target: Target::reference(&reference),
+                new_tab: false,
+            },
+        )
+        .await
+        .expect_err("refused");
+
+    assert!(matches!(error, Error::StaleRef { .. }), "{error}");
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_a_covered_element_is_refused_and_the_cover_is_named() {
+    if !enabled() {
+        return;
+    }
+    // A click dispatched at a point a banner covers is delivered to the banner,
+    // and without this check the caller is told it succeeded.
+    let (browser, session) = on(
+        "<button id='target' style='position:fixed;top:50px;left:50px'>Buy</button>\
+         <div id='banner' style='position:fixed;inset:0;background:#000'>Consent</div>",
+    )
+    .await;
+
+    let error = browser
+        .perform(
+            &session.id,
+            &Action::Click {
+                target: Target::selector("#target"),
+                new_tab: false,
+            },
+        )
+        .await
+        .expect_err("refused");
+
+    assert!(matches!(error, Error::NotActionable { .. }), "{error}");
+    assert!(error.to_string().contains("banner"), "{error}");
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_filling_replaces_the_value_and_fires_the_page_handlers() {
+    if !enabled() {
+        return;
+    }
+    // `Fill` clears and types through real key events, so a field that reacts to
+    // input sees them. Assigning `value` directly would not.
+    let (browser, session) = on("<input id='q' value='old'>\
+         <script>document.getElementById('q').addEventListener('input', () => { \
+            document.title = document.getElementById('q').value; });</script>")
+    .await;
+
+    browser
+        .perform(
+            &session.id,
+            &Action::Fill {
+                target: Target::selector("#q"),
+                value: "new value".to_string(),
+            },
+        )
+        .await
+        .expect("fills");
+
+    let outcome = browser
+        .perform(
+            &session.id,
+            &Action::GetText {
+                target: Target::selector("#q"),
+            },
+        )
+        .await
+        .expect("reads");
+
+    assert_eq!(outcome.value, serde_json::json!("new value"));
+    assert_eq!(outcome.page.title, "new value");
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_pressing_a_key_reaches_the_page() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on("<input id='q'>\
+         <script>document.getElementById('q').addEventListener('keydown', (e) => { \
+            document.title = e.key + ':' + e.keyCode; });</script>")
+    .await;
+
+    browser
+        .perform(
+            &session.id,
+            &Action::Focus {
+                target: Target::selector("#q"),
+            },
+        )
+        .await
+        .expect("focuses");
+    let outcome = browser
+        .perform(
+            &session.id,
+            &Action::Press {
+                key: "Enter".to_string(),
+            },
+        )
+        .await
+        .expect("presses");
+
+    // Both halves: a page reading `key` and a page reading the legacy `keyCode`
+    // must each see the right thing.
+    assert_eq!(outcome.page.title, "Enter:13");
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_a_locator_finds_an_element_by_what_it_says() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on("<button>Cancel</button><button>Submit order</button>\
+         <script>document.body.onclick = (e) => { document.title = e.target.innerText; };</script>")
+    .await;
+
+    let outcome = browser
+        .perform(
+            &session.id,
+            &Action::Click {
+                target: Target::locator(Locator::new(LocateBy::Role, "button").with_name("Submit")),
+                new_tab: false,
+            },
+        )
+        .await
+        .expect("clicks");
+
+    assert_eq!(outcome.page.title, "Submit order");
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_a_missing_element_is_reported_rather_than_guessed_at() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on("<p>nothing here</p>").await;
+
+    let error = browser
+        .perform(
+            &session.id,
+            &Action::Click {
+                target: Target::selector("#absent"),
+                new_tab: false,
+            },
+        )
+        .await
+        .expect_err("refused");
+
+    assert!(matches!(error, Error::NoSuchElement { .. }), "{error}");
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_is_visible_answers_false_rather_than_failing() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on("<p id='shown'>here</p>").await;
+
+    for (selector, expected) in [("#shown", true), ("#absent", false)] {
+        let outcome = browser
+            .perform(
+                &session.id,
+                &Action::IsVisible {
+                    target: Target::selector(selector),
+                },
+            )
+            .await
+            .expect("answers");
+        assert_eq!(outcome.value, serde_json::json!(expected), "{selector}");
+    }
+
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_reading_a_page_produces_markdown_a_model_can_use() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on(
+        "<h1>Title</h1><p>Body text.</p><a href='https://example.com/x'>Link</a>\
+         <script>console.log('not content')</script><style>p{color:red}</style>",
+    )
+    .await;
+
+    let text = browser
+        .read_page(&session.id, &ReadRequest::default())
+        .await
+        .expect("reads");
+
+    assert_eq!(text.format, ReadFormat::Markdown);
+    assert!(text.content.contains("# Title"), "{}", text.content);
+    assert!(text.content.contains("Body text."), "{}", text.content);
+    assert!(
+        text.content.contains("[Link](https://example.com/x)"),
+        "{}",
+        text.content
+    );
+    // Scripts and styles are chrome, not content.
+    assert!(!text.content.contains("not content"), "{}", text.content);
+    assert!(!text.content.contains("color:red"), "{}", text.content);
+
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_evaluating_returns_a_value_and_reports_a_throw() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on("<p>page</p>").await;
+
+    let value = browser
+        .evaluate(&session.id, &tinybrowser::EvaluateRequest::new("1 + 1"))
+        .await
+        .expect("evaluates");
+    assert_eq!(value, serde_json::json!(2));
+
+    // A throw arrives from CDP as a *successful* reply. Reading it wrong turns
+    // every page error into a silent `null`.
+    let error = browser
+        .evaluate(
+            &session.id,
+            &tinybrowser::EvaluateRequest::new("nope.missing"),
+        )
+        .await
+        .expect_err("refused");
+    assert!(matches!(error, Error::PageError { .. }), "{error}");
+
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_a_screenshot_round_trips_through_the_output_handle() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on("<h1 style='font-size:64px'>Shot</h1>").await;
+
+    let handle = browser
+        .screenshot(&session.id, &ScreenshotRequest::default())
+        .await
+        .expect("captures");
+
+    assert_eq!(handle.media_type, "image/png");
+    assert!(handle.total_bytes > 0);
+
+    let mut collected = Vec::new();
+    let mut offset = 0;
+    loop {
+        let chunk = browser
+            .read_output(&handle.id, offset, 256 * 1024)
+            .await
+            .expect("reads");
+        let bytes = base64_decode(&chunk.data);
+        offset += bytes.len() as u64;
+        collected.extend_from_slice(&bytes);
+        if chunk.eof {
+            break;
+        }
+    }
+
+    assert_eq!(collected.len() as u64, handle.total_bytes);
+    // The PNG signature: what came back is an image, not a truncated frame.
+    assert_eq!(&collected[..8], b"\x89PNG\r\n\x1a\n");
+
+    browser.release_output(&handle.id).await.expect("releases");
+    assert!(browser.read_output(&handle.id, 0, 1024).await.is_err());
+
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_an_origin_allowlist_refuses_what_it_does_not_admit() {
+    if !enabled() {
+        return;
+    }
+    let browser = Browser::new();
+    let session = browser
+        .open_session(SessionOptions {
+            allowed_origins: vec!["https://example.com".to_string()],
+            ..options()
+        })
+        .await
+        .expect("a browser is available; see this file's docs");
+
+    let error = browser
+        .navigate(
+            &session.id,
+            &NavigateRequest::new("https://elsewhere.test/"),
+        )
+        .await
+        .expect_err("refused");
+
+    assert!(matches!(error, Error::BlockedByPolicy { .. }), "{error}");
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_sessions_are_listed_and_close_cleanly() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on("<h1>One</h1>").await;
+
+    let listed = browser.list_sessions().await;
+    assert_eq!(listed.len(), 1);
+    assert_eq!(listed[0].id, session.id);
+    assert!(
+        listed[0].launched,
+        "a launched browser reports itself as one"
+    );
+
+    browser.close_session(&session.id).await.expect("closes");
+    assert!(browser.list_sessions().await.is_empty());
+}
+
+/// Standard base64, for reassembling a held output.
+fn base64_decode(encoded: &str) -> Vec<u8> {
+    base64::engine::general_purpose::STANDARD
+        .decode(encoded)
+        .expect("the module encodes standard base64")
+}
+
+#[tokio::test]
+async fn live_double_click_and_hover_reach_their_handlers() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on("<div id='t' style='padding:40px'>Target</div>\
+         <script>const t = document.getElementById('t');\
+         t.ondblclick = () => { document.title = 'double'; };\
+         t.onmouseover = () => { document.title = 'hovered'; };</script>")
+    .await;
+
+    let hovered = browser
+        .perform(
+            &session.id,
+            &Action::Hover {
+                target: Target::selector("#t"),
+            },
+        )
+        .await
+        .expect("hovers");
+    assert_eq!(hovered.page.title, "hovered");
+
+    let clicked = browser
+        .perform(
+            &session.id,
+            &Action::DoubleClick {
+                target: Target::selector("#t"),
+            },
+        )
+        .await
+        .expect("double-clicks");
+    assert_eq!(clicked.page.title, "double");
+
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_typing_key_by_key_reaches_a_field_that_reacts_to_each_one() {
+    if !enabled() {
+        return;
+    }
+    // The distinction `Type` exists for: an autocomplete that fires per
+    // keystroke never sees the input a bulk value assignment skips.
+    let (browser, session) = on("<input id='q'><script>let count = 0;\
+         document.getElementById('q').addEventListener('input', () => { \
+            count += 1; document.title = String(count); });</script>")
+    .await;
+
+    browser
+        .perform(
+            &session.id,
+            &Action::Type {
+                target: Some(Target::selector("#q")),
+                text: "abc".to_string(),
+                delay_ms: Some(1),
+            },
+        )
+        .await
+        .expect("types");
+
+    let outcome = browser
+        .perform(
+            &session.id,
+            &Action::GetAttribute {
+                target: Target::selector("#q"),
+                attribute: "id".to_string(),
+            },
+        )
+        .await
+        .expect("reads an attribute");
+
+    assert_eq!(outcome.value, serde_json::json!("q"));
+    assert_eq!(outcome.page.title, "3", "one input event per keystroke");
+
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_typing_without_a_target_goes_to_whatever_has_focus() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on("<input id='q' autofocus><script>\
+         document.getElementById('q').addEventListener('input', (e) => { \
+            document.title = e.target.value; });</script>")
+    .await;
+
+    browser
+        .perform(
+            &session.id,
+            &Action::Focus {
+                target: Target::selector("#q"),
+            },
+        )
+        .await
+        .expect("focuses");
+    let outcome = browser
+        .perform(
+            &session.id,
+            &Action::Type {
+                target: None,
+                text: "typed".to_string(),
+                delay_ms: None,
+            },
+        )
+        .await
+        .expect("types");
+
+    assert_eq!(outcome.page.title, "typed");
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_an_absent_attribute_reads_as_null() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on("<p id='p'>text</p>").await;
+
+    let outcome = browser
+        .perform(
+            &session.id,
+            &Action::GetAttribute {
+                target: Target::selector("#p"),
+                attribute: "data-missing".to_string(),
+            },
+        )
+        .await
+        .expect("reads");
+
+    assert!(outcome.value.is_null());
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_selecting_an_option_fires_the_change_a_form_listens_for() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on(
+        "<select id='s'><option value='a'>Alpha</option><option value='b'>Beta</option></select>\
+         <script>document.getElementById('s').addEventListener('change', (e) => { \
+            document.title = e.target.value; });</script>",
+    )
+    .await;
+
+    let outcome = browser
+        .perform(
+            &session.id,
+            &Action::Select {
+                target: Target::selector("#s"),
+                values: vec!["b".to_string()],
+            },
+        )
+        .await
+        .expect("selects");
+    assert_eq!(outcome.page.title, "b");
+
+    // An option nothing matches is an error, not a silent no-op that leaves the
+    // form on its previous value while reporting success.
+    let error = browser
+        .perform(
+            &session.id,
+            &Action::Select {
+                target: Target::selector("#s"),
+                values: vec!["nonexistent".to_string()],
+            },
+        )
+        .await
+        .expect_err("refused");
+    assert!(matches!(error, Error::PageError { .. }), "{error}");
+
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_check_sets_a_state_rather_than_toggling_it() {
+    if !enabled() {
+        return;
+    }
+    // Called twice with the same value. A toggle would leave the box in the
+    // opposite state to the one that was asked for.
+    let (browser, session) = on("<input type='checkbox' id='c'>").await;
+
+    for _ in 0..2 {
+        browser
+            .perform(
+                &session.id,
+                &Action::Check {
+                    target: Target::selector("#c"),
+                    checked: true,
+                },
+            )
+            .await
+            .expect("checks");
+    }
+
+    let checked = browser
+        .evaluate(
+            &session.id,
+            &tinybrowser::EvaluateRequest::new("document.getElementById('c').checked"),
+        )
+        .await
+        .expect("evaluates");
+    assert_eq!(checked, serde_json::json!(true));
+
+    browser
+        .perform(
+            &session.id,
+            &Action::Check {
+                target: Target::selector("#c"),
+                checked: false,
+            },
+        )
+        .await
+        .expect("unchecks");
+    let unchecked = browser
+        .evaluate(
+            &session.id,
+            &tinybrowser::EvaluateRequest::new("document.getElementById('c').checked"),
+        )
+        .await
+        .expect("evaluates");
+    assert_eq!(unchecked, serde_json::json!(false));
+
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_scrolling_moves_the_page_and_an_element_that_scrolls_within_it() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on("<div id='box' style='height:60px;overflow:auto'>\
+           <div style='height:2000px'>tall</div></div>\
+         <div style='height:4000px'>page</div>")
+    .await;
+
+    for direction in [ScrollDirection::Down, ScrollDirection::Bottom] {
+        browser
+            .perform(
+                &session.id,
+                &Action::Scroll {
+                    direction,
+                    pixels: None,
+                    target: None,
+                },
+            )
+            .await
+            .expect("scrolls the page");
+    }
+    let page_offset = browser
+        .evaluate(&session.id, &tinybrowser::EvaluateRequest::new("scrollY"))
+        .await
+        .expect("evaluates");
+    assert!(page_offset.as_f64().unwrap_or(0.0) > 0.0, "{page_offset}");
+
+    browser
+        .perform(
+            &session.id,
+            &Action::Scroll {
+                direction: ScrollDirection::Down,
+                pixels: Some(200),
+                target: Some(Target::selector("#box")),
+            },
+        )
+        .await
+        .expect("scrolls the element");
+    let box_offset = browser
+        .evaluate(
+            &session.id,
+            &tinybrowser::EvaluateRequest::new("document.getElementById('box').scrollTop"),
+        )
+        .await
+        .expect("evaluates");
+    assert_eq!(box_offset, serde_json::json!(200));
+
+    browser
+        .perform(
+            &session.id,
+            &Action::Scroll {
+                direction: ScrollDirection::Top,
+                pixels: None,
+                target: None,
+            },
+        )
+        .await
+        .expect("scrolls back");
+    let back = browser
+        .evaluate(&session.id, &tinybrowser::EvaluateRequest::new("scrollY"))
+        .await
+        .expect("evaluates");
+    assert_eq!(back, serde_json::json!(0));
+
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_waiting_returns_when_the_condition_holds() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on("<div id='late' style='display:none'>Ready</div>\
+         <script>setTimeout(() => { \
+            document.getElementById('late').style.display = 'block'; }, 150);</script>")
+    .await;
+
+    browser
+        .perform(
+            &session.id,
+            &Action::WaitFor {
+                target: Some(Target::selector("#late")),
+                text: None,
+                state: WaitState::Visible,
+                ms: None,
+                timeout_ms: Some(5_000),
+            },
+        )
+        .await
+        .expect("waits for visibility");
+
+    browser
+        .perform(
+            &session.id,
+            &Action::WaitFor {
+                target: None,
+                text: Some("Ready".to_string()),
+                state: WaitState::Visible,
+                ms: None,
+                timeout_ms: Some(5_000),
+            },
+        )
+        .await
+        .expect("waits for text");
+
+    browser
+        .perform(
+            &session.id,
+            &Action::WaitFor {
+                target: Some(Target::selector("#absent")),
+                text: None,
+                state: WaitState::Detached,
+                ms: None,
+                timeout_ms: Some(5_000),
+            },
+        )
+        .await
+        .expect("an absent element already satisfies detached");
+
+    // A flat delay is the only thing a caller with neither a target nor text can
+    // have meant.
+    browser
+        .perform(
+            &session.id,
+            &Action::WaitFor {
+                target: None,
+                text: None,
+                state: WaitState::Visible,
+                ms: Some(10),
+                timeout_ms: None,
+            },
+        )
+        .await
+        .expect("waits a flat delay");
+
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_waiting_for_something_that_never_happens_times_out() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on("<p>static</p>").await;
+
+    let error = browser
+        .perform(
+            &session.id,
+            &Action::WaitFor {
+                target: None,
+                text: Some("never appears".to_string()),
+                state: WaitState::Visible,
+                ms: None,
+                timeout_ms: Some(300),
+            },
+        )
+        .await
+        .expect_err("times out");
+
+    assert!(matches!(error, Error::Timeout { .. }), "{error}");
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_history_moves_back_and_forward_and_refuses_the_ends() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on("<h1>First</h1>").await;
+    let first = browser.list_sessions().await[0].url.clone();
+
+    browser
+        .navigate(
+            &session.id,
+            &NavigateRequest::new(serve("<h1>Second</h1>").await),
+        )
+        .await
+        .expect("navigates");
+
+    let back = browser
+        .perform(&session.id, &Action::Back)
+        .await
+        .expect("goes back");
+    assert_eq!(back.page.url, first);
+
+    let forward = browser
+        .perform(&session.id, &Action::Forward)
+        .await
+        .expect("goes forward");
+    assert_ne!(forward.page.url, first);
+
+    // At the end of the history there is nothing to go to, and saying so is
+    // better than a no-op that reports success.
+    let error = browser
+        .perform(&session.id, &Action::Forward)
+        .await
+        .expect_err("refused");
+    assert!(matches!(error, Error::InvalidInput { .. }), "{error}");
+
+    browser
+        .perform(&session.id, &Action::Reload)
+        .await
+        .expect("reloads");
+
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_reading_a_page_as_text_drops_the_markdown_syntax() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on("<h1>Title</h1><a href='https://example.com/x'>Link</a>").await;
+
+    let text = browser
+        .read_page(
+            &session.id,
+            &ReadRequest {
+                format: ReadFormat::Text,
+                ..ReadRequest::default()
+            },
+        )
+        .await
+        .expect("reads");
+
+    assert!(text.content.contains("Title"), "{}", text.content);
+    assert!(!text.content.contains("# Title"), "{}", text.content);
+    assert!(!text.content.contains("]("), "{}", text.content);
+
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_reading_a_selector_reads_only_that_subtree() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on("<div id='keep'>kept</div><div id='drop'>dropped</div>").await;
+
+    let text = browser
+        .read_page(
+            &session.id,
+            &ReadRequest {
+                selector: Some("#keep".to_string()),
+                ..ReadRequest::default()
+            },
+        )
+        .await
+        .expect("reads");
+
+    assert!(text.content.contains("kept"), "{}", text.content);
+    assert!(!text.content.contains("dropped"), "{}", text.content);
+
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_reading_a_selector_that_matches_nothing_is_reported() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on("<p>only this</p>").await;
+
+    let error = browser
+        .read_page(
+            &session.id,
+            &ReadRequest {
+                selector: Some("#absent".to_string()),
+                ..ReadRequest::default()
+            },
+        )
+        .await
+        .expect_err("refused");
+
+    assert!(matches!(error, Error::NoSuchElement { .. }), "{error}");
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_reading_as_html_returns_the_live_dom() {
+    if !enabled() {
+        return;
+    }
+    // Not the response body: what the page became after its scripts ran.
+    let (browser, session) = on(
+        "<div id='root'></div><script>document.getElementById('root').innerHTML = \
+            '<span>injected</span>';</script>",
+    )
+    .await;
+
+    let html = browser
+        .read_page(
+            &session.id,
+            &ReadRequest {
+                format: ReadFormat::Html,
+                ..ReadRequest::default()
+            },
+        )
+        .await
+        .expect("reads");
+    assert!(html.content.contains("injected"), "{}", html.content);
+
+    let fragment = browser
+        .read_page(
+            &session.id,
+            &ReadRequest {
+                format: ReadFormat::Html,
+                selector: Some("#root".to_string()),
+                ..ReadRequest::default()
+            },
+        )
+        .await
+        .expect("reads");
+    assert!(
+        fragment.content.starts_with("<div id=\"root\""),
+        "{}",
+        fragment.content
+    );
+
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_reading_reports_truncation_rather_than_hiding_it() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on("<p>a long enough paragraph to cut</p>").await;
+
+    let text = browser
+        .read_page(
+            &session.id,
+            &ReadRequest {
+                max_chars: 5,
+                ..ReadRequest::default()
+            },
+        )
+        .await
+        .expect("reads");
+
+    assert!(text.truncated);
+    assert_eq!(text.content.chars().count(), 5);
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_a_snapshot_can_be_scoped_and_bounded() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) =
+        on("<div id='panel'><button>Inside</button></div><button>Outside</button>").await;
+
+    let scoped = browser
+        .snapshot(
+            &session.id,
+            &SnapshotRequest {
+                selector: Some("#panel".to_string()),
+                ..SnapshotRequest::interactive()
+            },
+        )
+        .await
+        .expect("snapshots");
+    assert!(scoped.tree.contains("Inside"), "{}", scoped.tree);
+    assert!(!scoped.tree.contains("Outside"), "{}", scoped.tree);
+
+    let bounded = browser
+        .snapshot(
+            &session.id,
+            &SnapshotRequest {
+                max_chars: 10,
+                ..SnapshotRequest::default()
+            },
+        )
+        .await
+        .expect("snapshots");
+    assert!(bounded.truncated);
+
+    // The generation moves for every snapshot, so refs from the first are dead.
+    assert!(bounded.sequence > scoped.sequence);
+
+    let error = browser
+        .snapshot(
+            &session.id,
+            &SnapshotRequest {
+                selector: Some("#absent".to_string()),
+                ..SnapshotRequest::default()
+            },
+        )
+        .await
+        .expect_err("refused");
+    assert!(matches!(error, Error::NoSuchElement { .. }), "{error}");
+
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_screenshots_cover_the_page_the_element_and_the_lossy_formats() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on(
+        "<div id='box' style='width:100px;height:80px;background:#333'></div>\
+            <div style='height:3000px'></div>",
+    )
+    .await;
+
+    let full = browser
+        .screenshot(
+            &session.id,
+            &ScreenshotRequest {
+                full_page: true,
+                ..ScreenshotRequest::default()
+            },
+        )
+        .await
+        .expect("captures the page");
+    assert!(
+        full.height > 1000,
+        "a full-page capture is taller than the viewport"
+    );
+
+    let element = browser
+        .screenshot(
+            &session.id,
+            &ScreenshotRequest {
+                target: Some(Target::selector("#box")),
+                format: ImageFormat::Jpeg,
+                quality: Some(70),
+                ..ScreenshotRequest::default()
+            },
+        )
+        .await
+        .expect("captures the element");
+    assert_eq!(element.media_type, "image/jpeg");
+    assert_eq!((element.width, element.height), (100, 80));
+
+    // Quality outside the range is the caller's mistake, and saying so is more
+    // useful than a protocol error from the browser.
+    let error = browser
+        .screenshot(
+            &session.id,
+            &ScreenshotRequest {
+                format: ImageFormat::Webp,
+                quality: Some(0),
+                ..ScreenshotRequest::default()
+            },
+        )
+        .await
+        .expect_err("refused");
+    assert!(matches!(error, Error::InvalidInput { .. }), "{error}");
+
+    for handle in [full, element] {
+        browser.release_output(&handle.id).await.expect("releases");
+    }
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_the_session_limit_refuses_the_one_past_it() {
+    if !enabled() {
+        return;
+    }
+    let browser = Browser::with_session_limit(1);
+    let first = browser
+        .open_session(options())
+        .await
+        .expect("a browser is available; see this file's docs");
+
+    let error = browser.open_session(options()).await.expect_err("refused");
+    assert!(matches!(error, Error::LimitExceeded { .. }), "{error}");
+
+    // And the limit is a bound on what is open, not a lifetime cap.
+    browser.close_session(&first.id).await.expect("closes");
+    let second = browser.open_session(options()).await.expect("opens");
+
+    browser.shutdown().await;
+    assert!(browser.list_sessions().await.is_empty());
+    let _ = second;
+}
+
+#[tokio::test]
+async fn live_a_session_can_attach_to_a_browser_it_did_not_launch() {
+    if !enabled() {
+        return;
+    }
+    // The arrangement a container deployment uses: one browser, many sessions,
+    // and closing a session leaves the browser somebody else owns running.
+    let host = Browser::new();
+    let launched = host
+        .open_session(options())
+        .await
+        .expect("a browser is available; see this file's docs");
+
+    let attached_engine = Browser::new();
+    let attached = attached_engine
+        .open_session(SessionOptions {
+            endpoint: Some(launched.endpoint.clone()),
+            ..options()
+        })
+        .await
+        .expect("attaches");
+
+    assert!(!attached.launched, "an attached session did not launch it");
+    attached_engine
+        .close_session(&attached.id)
+        .await
+        .expect("closes");
+
+    // The browser is still there, which is the whole point.
+    host.navigate(
+        &launched.id,
+        &NavigateRequest::new(serve("<p>still here</p>").await),
+    )
+    .await
+    .expect("the launched browser survived");
+
+    host.shutdown().await;
+}
+
+#[tokio::test]
+async fn live_an_invalid_selector_is_the_callers_mistake_not_the_pages() {
+    if !enabled() {
+        return;
+    }
+    // The page throws a `SyntaxError`, which as a page error would read as the
+    // site's fault. It is not: the caller wrote a selector that is not CSS.
+    let (browser, session) = on("<p>page</p>").await;
+
+    let error = browser
+        .perform(
+            &session.id,
+            &Action::Click {
+                target: Target::selector("<<not a selector>>"),
+                new_tab: false,
+            },
+        )
+        .await
+        .expect_err("refused");
+
+    assert!(matches!(error, Error::InvalidInput { .. }), "{error}");
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_a_locator_that_matches_nothing_names_what_it_looked_for() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on("<button>Cancel</button>").await;
+
+    let error = browser
+        .perform(
+            &session.id,
+            &Action::Click {
+                target: Target::locator(Locator::new(LocateBy::Text, "Definitely Not Here")),
+                new_tab: false,
+            },
+        )
+        .await
+        .expect_err("refused");
+
+    assert!(matches!(error, Error::NoSuchElement { .. }), "{error}");
+    assert!(error.to_string().contains("Definitely Not Here"), "{error}");
+
+    // An empty locator is refused before the page is asked anything.
+    let empty = browser
+        .perform(
+            &session.id,
+            &Action::Click {
+                target: Target::locator(Locator::new(LocateBy::Text, "   ")),
+                new_tab: false,
+            },
+        )
+        .await
+        .expect_err("refused");
+    assert!(matches!(empty, Error::InvalidInput { .. }), "{empty}");
+
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_every_locator_dimension_finds_its_element() {
+    if !enabled() {
+        return;
+    }
+    // Each dimension crosses into JavaScript as a string. A rename on one side
+    // alone produces "unknown locator dimension" at runtime and nothing at
+    // compile time, so every one is exercised here at least once.
+    let (browser, session) = on(
+        "<input id='labelled' aria-label='Email address'>\
+         <input id='placeheld' placeholder='Search products'>\
+         <button data-testid='cart'>Cart</button>\
+         <img src='data:image/gif;base64,R0lGODlhAQABAAAAACw=' alt='Company logo' width='20' height='20'>\
+         <span title='Tooltip text'>hover me</span>",
+    )
+    .await;
+
+    for (by, value) in [
+        (LocateBy::Label, "Email address"),
+        (LocateBy::Placeholder, "Search products"),
+        (LocateBy::TestId, "cart"),
+        (LocateBy::AltText, "Company logo"),
+        (LocateBy::Title, "Tooltip text"),
+    ] {
+        let outcome = browser
+            .perform(
+                &session.id,
+                &Action::IsVisible {
+                    target: Target::locator(Locator::new(by, value)),
+                },
+            )
+            .await
+            .unwrap_or_else(|error| panic!("{by:?} {value:?}: {error}"));
+
+        assert_eq!(outcome.value, serde_json::json!(true), "{by:?} {value:?}");
+    }
+
+    // And an exact match narrows where a substring would not.
+    let exact = browser
+        .perform(
+            &session.id,
+            &Action::IsVisible {
+                target: Target::locator(Locator {
+                    exact: true,
+                    ..Locator::new(LocateBy::Placeholder, "Search")
+                }),
+            },
+        )
+        .await
+        .expect("answers");
+    assert_eq!(exact.value, serde_json::json!(false));
+
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_snapshotting_a_node_the_tree_does_not_contain_is_reported() {
+    if !enabled() {
+        return;
+    }
+    // `<style>` resolves as an element and is not in the accessibility tree,
+    // which is exactly the case where a scoped snapshot has nothing to render.
+    let (browser, session) = on("<style>p{color:red}</style><p>text</p>").await;
+
+    let error = browser
+        .snapshot(
+            &session.id,
+            &SnapshotRequest {
+                selector: Some("style".to_string()),
+                ..SnapshotRequest::default()
+            },
+        )
+        .await
+        .expect_err("refused");
+
+    assert!(matches!(error, Error::NoSuchElement { .. }), "{error}");
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_a_click_in_a_new_tab_leaves_the_session_where_it_was() {
+    if !enabled() {
+        return;
+    }
+    // A documented limitation rather than a feature: the modifier reaches the
+    // page and the browser opens a tab, but the session keeps driving the one
+    // it has. Adopting the new tab is on the roadmap; silently appearing to
+    // follow it would be worse than this.
+    let (browser, session) = on("<a href='https://example.com/'>Away</a>").await;
+    let before = browser.list_sessions().await[0].url.clone();
+
+    let outcome = browser
+        .perform(
+            &session.id,
+            &Action::Click {
+                target: Target::selector("a"),
+                new_tab: true,
+            },
+        )
+        .await
+        .expect("clicks");
+
+    assert_eq!(outcome.page.url, before);
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_navigating_somewhere_unreachable_is_a_page_error() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on("<p>page</p>").await;
+
+    // A hostname that cannot resolve, by construction: `.invalid` is reserved
+    // for exactly this and never resolves anywhere.
+    let error = browser
+        .navigate(
+            &session.id,
+            &NavigateRequest {
+                url: "https://nothing.invalid/".to_string(),
+                wait_until: WaitUntil::Load,
+                timeout_ms: Some(10_000),
+            },
+        )
+        .await
+        .expect_err("refused");
+
+    assert!(
+        matches!(error, Error::PageError { .. } | Error::Timeout { .. }),
+        "{error}"
+    );
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_a_session_can_be_told_what_size_to_render_at() {
+    if !enabled() {
+        return;
+    }
+    // Layout decides what a snapshot contains: a headless default would serve
+    // the mobile tree, and an agent then cannot find the navigation an operator
+    // sees.
+    let browser = Browser::new();
+    let session = browser
+        .open_session(SessionOptions {
+            // Narrow but not `mobile`: mobile emulation gives a page with no
+            // viewport meta tag the legacy 980px layout viewport, which is
+            // correct browser behaviour and would make this assertion about
+            // Chrome's compatibility rules rather than about the module.
+            viewport: tinybrowser::Viewport {
+                device_scale_factor: 2.0,
+                ..tinybrowser::Viewport::desktop(390, 844)
+            },
+            user_agent: Some("tinybrowser-test/1.0".to_string()),
+            ..options()
+        })
+        .await
+        .expect("a browser is available; see this file's docs");
+
+    browser
+        .navigate(
+            &session.id,
+            &NavigateRequest::new(serve("<p>sized</p>").await),
+        )
+        .await
+        .expect("navigates");
+
+    let size = browser
+        .evaluate(
+            &session.id,
+            &tinybrowser::EvaluateRequest::new(
+                "[innerWidth, devicePixelRatio, navigator.userAgent]",
+            ),
+        )
+        .await
+        .expect("evaluates");
+
+    assert_eq!(size[0], serde_json::json!(390));
+    // JSON does not distinguish 2 from 2.0, so compare as a number.
+    assert_eq!(size[1].as_f64(), Some(2.0));
+    assert_eq!(size[2], serde_json::json!("tinybrowser-test/1.0"));
+
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_navigation_settles_at_every_wait_mode() {
+    if !enabled() {
+        return;
+    }
+    let (browser, session) = on("<p>first</p>").await;
+
+    for wait_until in [
+        WaitUntil::Commit,
+        WaitUntil::DomContentLoaded,
+        WaitUntil::Load,
+        WaitUntil::NetworkIdle,
+    ] {
+        let url = serve("<p>settled</p>").await;
+        browser
+            .navigate(
+                &session.id,
+                &NavigateRequest {
+                    url,
+                    wait_until,
+                    timeout_ms: Some(10_000),
+                },
+            )
+            .await
+            .unwrap_or_else(|error| panic!("{wait_until:?}: {error}"));
+    }
+
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_a_click_that_navigates_is_finished_before_the_next_call() {
+    if !enabled() {
+        return;
+    }
+    // The bug the bundled example found: dispatching a click returns as soon as
+    // the browser accepts the event, not when the page has finished reacting.
+    // Reading straight afterwards hit a document with no body yet.
+    let destination = serve("<h1>Arrived</h1>").await;
+    let (browser, session) = on(&format!("<a id='go' href='{destination}'>Go</a>")).await;
+
+    let outcome = browser
+        .perform(
+            &session.id,
+            &Action::Click {
+                target: Target::selector("#go"),
+                new_tab: false,
+            },
+        )
+        .await
+        .expect("clicks");
+    assert_eq!(outcome.page.url, destination);
+
+    // The page is readable immediately, with no wait in between.
+    let text = browser
+        .read_page(&session.id, &ReadRequest::default())
+        .await
+        .expect("reads the page the click landed on");
+    assert!(text.content.contains("Arrived"), "{}", text.content);
+
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_a_click_that_navigates_retires_the_refs_it_invalidated() {
+    if !enabled() {
+        return;
+    }
+    // A ref names a node in a document. A click that replaces that document
+    // must not leave the ref resolvable against whatever now sits there.
+    let destination = serve("<button id='other'>Other</button>").await;
+    let (browser, session) = on(&format!("<a id='go' href='{destination}'>Go</a>")).await;
+
+    let before = browser
+        .snapshot(&session.id, &SnapshotRequest::interactive())
+        .await
+        .expect("snapshots");
+    let reference = before.refs.first().expect("the link").id.clone();
+
+    browser
+        .perform(
+            &session.id,
+            &Action::Click {
+                target: Target::selector("#go"),
+                new_tab: false,
+            },
+        )
+        .await
+        .expect("clicks");
+
+    let error = browser
+        .perform(
+            &session.id,
+            &Action::Click {
+                target: Target::reference(&reference),
+                new_tab: false,
+            },
+        )
+        .await
+        .expect_err("refused");
+
+    assert!(matches!(error, Error::StaleRef { .. }), "{error}");
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_pressing_enter_in_a_form_settles_its_submission() {
+    if !enabled() {
+        return;
+    }
+    let destination = serve("<h1>Submitted</h1>").await;
+    // With an explicit submit button rather than relying on implicit submission,
+    // whose rules depend on how many fields a form has and are not what this is
+    // testing.
+    let (browser, session) = on(&format!(
+        "<form action='{destination}' method='get'>\
+           <input id='q' name='q'><button type='submit'>Go</button>\
+         </form>"
+    ))
+    .await;
+
+    browser
+        .perform(
+            &session.id,
+            &Action::Focus {
+                target: Target::selector("#q"),
+            },
+        )
+        .await
+        .expect("focuses");
+    let outcome = browser
+        .perform(
+            &session.id,
+            &Action::Press {
+                key: "Enter".to_string(),
+            },
+        )
+        .await
+        .expect("presses");
+
+    assert!(
+        outcome.page.url.starts_with(&destination),
+        "expected the submission to land on {destination}, but the page is at {}",
+        outcome.page.url
+    );
+
+    let text = browser
+        .read_page(&session.id, &ReadRequest::default())
+        .await
+        .expect("reads");
+    assert!(text.content.contains("Submitted"), "{}", text.content);
+
+    browser.close_session(&session.id).await.expect("closes");
+}
+
+#[tokio::test]
+async fn live_a_click_that_navigates_nowhere_does_not_stall() {
+    if !enabled() {
+        return;
+    }
+    // The cost of the rule above is paid by every click that starts nothing, so
+    // it has to stay small: a menu opening must not wait out a page load.
+    let (browser, session) =
+        on("<button id='b' onclick=\"document.title = 'opened'\">Menu</button>").await;
+
+    let started = std::time::Instant::now();
+    let outcome = browser
+        .perform(
+            &session.id,
+            &Action::Click {
+                target: Target::selector("#b"),
+                new_tab: false,
+            },
+        )
+        .await
+        .expect("clicks");
+    let elapsed = started.elapsed();
+
+    assert_eq!(outcome.page.title, "opened");
+    assert!(
+        elapsed < std::time::Duration::from_secs(3),
+        "a click that navigated nowhere took {elapsed:?}"
+    );
+
+    browser.close_session(&session.id).await.expect("closes");
+}
diff --git a/crates/tinybrowser/tests/public_api.rs b/crates/tinybrowser/tests/public_api.rs
new file mode 100644
index 0000000..4413457
--- /dev/null
+++ b/crates/tinybrowser/tests/public_api.rs
@@ -0,0 +1,97 @@
+//! Integration tests for the public crate surface.
+//!
+//! These tests link against the crate as a downstream consumer would: they can
+//! only use what `src/lib.rs` re-exports. Treat them as the regression suite for
+//! the crate's public contract — if a change breaks a test here, it is a
+//! breaking change for users.
+//!
+//! Nothing here launches a browser. What a consumer most needs to be able to do
+//! without one is build every payload, name every member, and classify every
+//! failure, and that is what these cover.
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use tinybrowser::{
+    Action, Browser, Error, EvaluateRequest, LocateBy, Locator, NavigateRequest, OutputId,
+    ReadFormat, ReadRequest, ScreenshotRequest, SessionId, SessionOptions, SnapshotRequest, Target,
+    WaitUntil, errors, is_compatible, names,
+};
+
+#[test]
+fn the_engine_is_available_to_consumers() {
+    let browser = Browser::new();
+    assert_eq!(browser.session_limit(), 8);
+}
+
+#[test]
+fn the_contract_is_re_exported_rather_than_restated() {
+    // The same type, not a structural twin: a host that depends on
+    // `tinybrowser-bus` alone and a module author who depends on this crate must
+    // be able to pass payloads between each other without a conversion.
+    let via_module: tinybrowser::Action = Action::Reload;
+    let via_contract: tinybrowser_bus::Action = via_module;
+
+    assert_eq!(via_contract, tinybrowser_bus::Action::Reload);
+}
+
+#[test]
+fn the_bus_identity_is_available_to_consumers() {
+    assert_eq!(names::INTERFACE, "ai.tinyhumans.tinybrowser.Browser");
+    assert_eq!(names::OBJECT_PATH, "/ai/tinyhumans/tinybrowser/Browser");
+    assert_eq!(names::METHODS.len(), 12);
+    assert!(is_compatible(tinybrowser::CONTRACT_VERSION));
+}
+
+#[test]
+fn every_payload_a_caller_needs_can_be_built_from_the_public_surface() {
+    let _ = SessionOptions::default();
+    let _ = NavigateRequest::new("https://example.com");
+    let _ = SnapshotRequest::interactive();
+    let _ = ReadRequest::default();
+    let _ = EvaluateRequest::new("1 + 1");
+    let _ = ScreenshotRequest::default();
+    let _ = Action::Fill {
+        target: Target::parse("#email"),
+        value: "someone@example.com".to_string(),
+    };
+    let _ = Target::locator(Locator::new(LocateBy::Role, "button").with_name("Submit"));
+}
+
+#[test]
+fn defaults_are_the_ones_the_contract_documents() {
+    assert_eq!(NavigateRequest::new("x").wait_until, WaitUntil::Load);
+    assert_eq!(ReadRequest::default().format, ReadFormat::Markdown);
+    assert!(SessionOptions::default().headless);
+}
+
+#[test]
+fn errors_carry_the_wire_names_a_host_matches_on() {
+    assert_eq!(
+        Error::invalid_input("bad").wire_name(),
+        errors::INVALID_INPUT
+    );
+    assert!(errors::is_agent_recoverable(errors::NO_SUCH_ELEMENT));
+    assert!(!errors::is_agent_recoverable(errors::BROWSER_UNAVAILABLE));
+}
+
+#[tokio::test]
+async fn an_unknown_session_is_reported_without_a_browser() {
+    let browser = Browser::new();
+    let error = browser
+        .navigate(&SessionId::new("never-opened"), &NavigateRequest::new("x"))
+        .await
+        .expect_err("refused");
+
+    assert!(matches!(error, Error::NoSuchSession { .. }), "{error}");
+    assert_eq!(error.wire_name(), errors::NO_SUCH_SESSION);
+}
+
+#[tokio::test]
+async fn teardown_is_idempotent_for_consumers() {
+    // A host retrying a close or a release after a timeout must not have to tell
+    // "never existed" apart from "already cleaned up".
+    let browser = Browser::new();
+
+    assert!(browser.close_session(&SessionId::new("gone")).await.is_ok());
+    assert!(browser.release_output(&OutputId::new("gone")).await.is_ok());
+}
diff --git a/docs/README.md b/docs/README.md
index 0c0f2b1..f99f81f 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -28,10 +28,15 @@ docs/
 Complex modules also carry a module-level `README.md` inside `src/<module>/`
 covering their design, public surface, and important constraints.
 
-The current module-release contract is in
-[`specs/tinybus-module-release.md`](specs/tinybus-module-release.md), with its
-implementation sequence in
-[`plans/tinybus-module-release.md`](plans/tinybus-module-release.md).
+The current documents:
+
+- [`specs/browser-module.md`](specs/browser-module.md) — what the module does,
+  what it refuses to do, and the invariants a change must not break.
+- [`specs/tinybus-module-release.md`](specs/tinybus-module-release.md) and
+  [`plans/tinybus-module-release.md`](plans/tinybus-module-release.md) — the
+  module-release contract and its implementation sequence.
+- [`openhuman-integration.md`](openhuman-integration.md) — the host side: what
+  an OpenHuman build adds to make this available to an agent.
 
 ## Conventions
 
diff --git a/docs/openhuman-integration.md b/docs/openhuman-integration.md
new file mode 100644
index 0000000..1e6dbbb
--- /dev/null
+++ b/docs/openhuman-integration.md
@@ -0,0 +1,209 @@
+# Wiring tinybrowser into OpenHuman
+
+This is the host side: what to add to an OpenHuman build so an agent can use a
+browser, and what the tool on top of it should look like. It assumes familiarity
+with `src/openhuman/modules/` — the registry, the loader, and the two modules
+already wired through it (`tinydocs` and `tinywallet`) are the pattern this
+follows.
+
+Nothing here has to be invented. The three pieces are a registry entry, a call
+module, and a tool, and each has a close precedent in the tree already.
+
+## 1. The registry entry
+
+`src/openhuman/modules/registry.rs` holds the compiled-in table of loadable
+modules. Add one entry, with the digests taken verbatim from the release's own
+`checksum.toml` — not computed from a local build, which would agree with itself
+no matter what the release served:
+
+```rust
+/// The `tinybrowser` module: a Chrome driven over CDP, behind the bus.
+///
+/// Lazy, and more so than the others: a session is a browser process. A user
+/// who never asks for a web page should not pay a download, a `dlopen`, and a
+/// library that is never unloaded, let alone a Chrome.
+const TINYBROWSER: ModuleRecord = ModuleRecord {
+    id: "tinybrowser",
+    description: "Browser automation: navigate, snapshot, act, read, screenshot",
+    bus_name: "ai.tinyhumans.tinybrowser.Browser",
+    object_path: "/ai/tinyhumans/tinybrowser/Browser",
+    version: "<release version>",
+    release_url: "https://github.com/tinyhumansai/tinybrowser/releases/tag/v<version>",
+    assets: &[/* one PlatformAsset per published archive */],
+    load: LoadPolicy::Lazy,
+};
+```
+
+Take the names from `tinybrowser_bus::names` rather than retyping them, if the
+host links the contract crate — which it should, and which is the next point.
+
+## 2. The dependency
+
+```toml
+# The wire contract for the tinybrowser module: member names and payload types.
+# Two pure-Rust dependencies, no transport, no browser — the whole reason the
+# module is loadable rather than linked.
+tinybrowser-bus = { git = "https://github.com/tinyhumansai/tinybrowser" }
+```
+
+`tinybrowser-bus`, never `tinybrowser`. The second one is the engine, and
+linking it would put a WebSocket client, a TLS stack and a CDP surface back into
+the binary this arrangement exists to keep them out of.
+
+## 3. The call module
+
+`src/openhuman/modules/browser.rs`, alongside `documents.rs` and `wallet.rs`.
+Its job is to hold the session, make the calls, and turn a wire error name into
+something the tool can act on. Its shape:
+
+```rust
+/// Registry id of the module these calls go to.
+const MODULE_ID: &str = "tinybrowser";
+
+/// Why a browser call did not produce what was asked for.
+///
+/// The three variants are not a taxonomy of what went wrong — they are what the
+/// tool does next. `Recoverable` goes back to the model as a tool result it can
+/// act on; `Failed` is a tool error; `Unavailable` means the capability is not
+/// present and the model should stop asking.
+pub enum BrowserCallError {
+    Unavailable(String),
+    Recoverable(String),
+    Failed(String),
+}
+
+fn classify(error: &tinybus::Error) -> BrowserCallError { /* see below */ }
+```
+
+`classify` is the one piece worth writing carefully, and the contract already
+did most of it. Every failure arrives with a stable name, and
+`tinybrowser_bus::errors::is_agent_recoverable` answers the only question the
+tool has:
+
+```rust
+use tinybrowser_bus::errors;
+
+fn classify(error: &tinybus::Error) -> BrowserCallError {
+    let tinybus::Error::MethodFailed { name, message } = error else {
+        return BrowserCallError::Failed(error.to_string());
+    };
+
+    match name.as_str() {
+        errors::BROWSER_UNAVAILABLE => BrowserCallError::Unavailable(message.clone()),
+        // Never retried and never offered back to the model: the answer will not
+        // change, and a model that retries turns a refusal into a loop.
+        errors::BLOCKED_BY_POLICY => BrowserCallError::Failed(message.clone()),
+        other if errors::is_agent_recoverable(other) => {
+            BrowserCallError::Recoverable(message.clone())
+        }
+        _ => BrowserCallError::Failed(message.clone()),
+    }
+}
+```
+
+### Session lifetime
+
+The module holds sessions; the host has to decide who owns one. The arrangement
+that fits OpenHuman is **one session per conversation**, opened lazily on the
+first browser tool call and closed when the conversation ends — an agent that
+opens a page and then reasons for three turns must find the same page there, and
+one that finishes must not leave a Chrome running.
+
+Two things follow. `ensure_ready` should run *outside* the tool's own deadline,
+as `documents.rs` does and for the same reason: a first use may download and
+verify an artifact and launch a browser, and charging that to a navigation
+timeout means the first page a user ever asks for is the one that fails. And the
+close belongs on the same path that tears down the conversation, not only on the
+success path — a session leaked by an early return is a browser process nobody
+will ever end.
+
+### Collecting a screenshot
+
+`Screenshot` returns a handle, not an image, for the same reason `tinydocs`
+returns one: a full-page capture does not fit in a 16 MiB frame, and a served
+object cannot open a stream back to its caller. Read it in chunks and release it
+in a `defer`-shaped position — the module expires an abandoned output, but until
+then the slot and the memory are spent.
+
+`crates/tinybrowser/examples/over_the_bus.rs` in this repository is a complete,
+working version of that loop, including the two checks worth copying: do not
+size a buffer from a length a peer sent, and verify the reassembled length
+against the handle.
+
+## 4. The tool
+
+OpenHuman already has `BrowserTool` in
+`src/openhuman/tools/impl/browser/`, with a `BrowserAction` enum and several
+backends behind it — `agent_browser` shelling out to a CLI, `playwright` driving
+a Node sidecar, `rust_native` on fantoccini. This module is a fourth backend,
+and the one that removes the most machinery: no subprocess, no sidecar, no
+driver binary, no JSON parsed out of somebody's stdout.
+
+The mapping is close to one-to-one, because `tinybrowser_bus::Action` was shaped
+to match:
+
+| `BrowserAction` | Bus call |
+| --- | --- |
+| `Open { url }` | `Navigate` with `NavigateRequest::new(url)` |
+| `Snapshot { interactive_only, compact, depth }` | `Snapshot` |
+| `Click`, `Fill`, `Type`, `Hover`, `Press`, `Scroll`, `IsVisible`, `GetText` | `Perform` with the matching `Action` |
+| `Find { by, value, action, fill_value }` | `Perform` with `Target::locator(..)` |
+| `Wait { selector, text, ms }` | `Perform` with `Action::WaitFor` |
+| `GetTitle`, `GetUrl` | any outcome's `page` field — no call needed |
+| `Close` | `CloseSession` |
+
+Two of those are worth noticing. `GetTitle` and `GetUrl` stop being calls at
+all: every `Perform` and `Navigate` returns the page state it left behind, so
+the tool answers from what it already has. And the `selector` string a model
+passes goes through `Target::parse`, which reads a leading `@` as a snapshot ref
+and anything else as CSS — the same rule the existing tool surface already
+implies, written once in the contract instead of at each call site.
+
+### What to tell the model
+
+The tool description should say three things, because each one prevents a
+specific failure:
+
+1. **Snapshot before acting, and act on refs.** A ref names an element the agent
+   has actually seen. A CSS selector guessed from a page description names
+   whatever happens to match.
+2. **A stale ref means snapshot again.** The module distinguishes "no such
+   element" from "that ref is from an older view of this page", and the second
+   has exactly one remedy.
+3. **A refused click names what covered it.** `not actionable: covered by
+   div#consent "We use cookies"` is an instruction: deal with the banner, take a
+   fresh snapshot, then retry. A model that is not told this will retry the same
+   click.
+
+## 5. Configuration
+
+`src/openhuman/config/schema/modules.rs` already gates modules; the browser
+needs two host-level facts beyond that, and both belong in the environment
+rather than in per-call config, because both describe the machine:
+
+- `TINYBROWSER_CHROME` — the browser to launch, when it is not in a conventional
+  location.
+- `TINYBROWSER_CHROME_ARGS` — extra launch flags. `--no-sandbox` belongs here in
+  a container without the right capabilities, or on Ubuntu 23.10 and later where
+  unprivileged user namespaces are restricted by AppArmor. The module reports
+  that case by name rather than silently applying the flag, because removing the
+  renderer's isolation from the pages it visits is not a default a module gets
+  to choose on a host's behalf.
+
+`SessionOptions::allowed_origins` is available per session and is worth setting
+when a deployment knows where an agent should be going. Set it knowing what it
+is: it refuses navigations the module is *asked* to make, and a page's own
+JavaScript can navigate around it. A deployment that needs a boundary puts the
+browser in a network namespace.
+
+## Order of work
+
+1. Add the dependency and the registry entry, and confirm `modules.list` reports
+   the capability and `ensure_loaded` resolves it on the host's platform.
+2. Add `browser.rs` with `ensure_ready`, `open_session`, `close_session`, and
+   `navigate`, and a test that a call into a module that is not loaded reports
+   `Unavailable` rather than hanging.
+3. Add the session-per-conversation lifetime, with the close on the teardown
+   path, before adding any further members. A leak here is a browser process,
+   and it is much easier to not introduce than to find later.
+4. Add `Snapshot` and `Perform`, and only then the rest.
diff --git a/docs/plans/example-retry-policy.md b/docs/plans/example-retry-policy.md
deleted file mode 100644
index fe42c4c..0000000
--- a/docs/plans/example-retry-policy.md
+++ /dev/null
@@ -1,71 +0,0 @@
-# Example plan: Retry policy
-
-- **Status:** Example
-- **Specification:**
-  [`../specs/example-retry-policy.md`](../specs/example-retry-policy.md)
-
-> This is a sample implementation plan, not active work. Replace or remove it
-> when generating a real project from this template.
-
-## Goal
-
-Add the specified typed retry policy through small red-green-refactor steps,
-without adding a runtime, timers, or new dependencies.
-
-## Task 1: Add the constructor contract
-
-**Files:** `src/retry/mod.rs`, `src/retry/types.rs`, `src/retry/test.rs`
-
-1. Create the module skeleton and a failing test for zero attempts:
-
-   ```rust
-   #[test]
-   fn rejects_zero_max_attempts() {
-       assert_eq!(
-           RetryPolicy::new(0).unwrap_err(),
-           Error::ZeroMaxAttempts,
-       );
-   }
-   ```
-
-2. Add `Error::ZeroMaxAttempts` in `src/error/mod.rs` and its message assertion
-   in `src/error/test.rs`.
-3. Implement `RetryPolicy::new` using `NonZeroU32`, keeping the field private.
-4. Run `cargo test retry` and `cargo clippy --all-targets --all-features -- -D warnings`.
-
-## Task 2: Add attempt-boundary behavior
-
-**Files:** `src/retry/mod.rs`, `src/retry/test.rs`
-
-1. Add failing tests for attempts `0`, `1`, the maximum, and one past it.
-2. Implement the smallest boundary check:
-
-   ```rust
-   #[must_use]
-   pub fn allows_attempt(self, attempt: u32) -> bool {
-       attempt != 0 && attempt <= self.max_attempts.get()
-   }
-   ```
-
-3. Run `cargo test retry`.
-
-## Task 3: Publish and document the API
-
-**Files:** `src/lib.rs`, `tests/public_api.rs`, `README.md`
-
-1. Re-export `RetryPolicy` from `src/lib.rs`.
-2. Add an integration test using only `template::{Error, RetryPolicy}`.
-3. Add a runnable README example and rustdoc `# Errors` documentation.
-4. Run `cargo test --doc` and `cargo test --test public_api`.
-
-## Task 4: Full verification
-
-- [ ] `cargo fmt --all -- --check`
-- [ ] `cargo clippy --all-targets --all-features -- -D warnings`
-- [ ] `cargo build --all-targets --all-features`
-- [ ] `cargo test --all-features`
-- [ ] `RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --all-features`
-- [ ] `cargo deny check all`
-
-When all checks pass, mark the specification Implemented and replace this
-example status with the actual completion state.
diff --git a/docs/plans/tinybus-module-release.md b/docs/plans/tinybus-module-release.md
index f9eaa18..6e8e5fc 100644
--- a/docs/plans/tinybus-module-release.md
+++ b/docs/plans/tinybus-module-release.md
@@ -3,9 +3,9 @@
 Linked specification: [`../specs/tinybus-module-release.md`](../specs/tinybus-module-release.md)
 
 1. Add the pinned TinyBus host types and module SDK as path dependencies.
-2. Export the template greeting behavior through TinyBus module ABI v1.
+2. Export the browser engine through TinyBus module ABI v1.
 3. Exercise the declared interface over the real in-memory bus.
-4. Replace TinyBus host bundles with tagged `template` module archives for
+4. Replace TinyBus host bundles with tagged `tinybrowser` module archives for
    every supported platform runner and distribution container.
 5. Run the repository validation and coverage contracts, push `main`, and
    trigger a patch release.
diff --git a/docs/specs/browser-module.md b/docs/specs/browser-module.md
new file mode 100644
index 0000000..af7a6ed
--- /dev/null
+++ b/docs/specs/browser-module.md
@@ -0,0 +1,137 @@
+# Browser Module
+
+## Purpose
+
+Give an agent host a browser without putting a browser stack in its build: a
+loadable TinyBus module that drives a real Chrome and describes what it sees in
+terms an agent can act on.
+
+## What a host gets
+
+One interface, `ai.tinyhumans.tinybrowser.Browser`, with twelve members listed
+in `tinybrowser_bus::names::METHODS`. The vocabulary is published as
+`tinybrowser-bus`, a two-dependency crate with no transport, so the cost to the
+host of linking it is a `serde` derive.
+
+The loop the surface is shaped around:
+
+```text
+OpenSession -> Navigate -> Snapshot -> Perform -> Snapshot -> ... -> CloseSession
+```
+
+## Behaviour
+
+### Sessions
+
+- A session is one browser and the page it is driving. Every page member takes a
+  `SessionId`; there is no implicit current page, because a host running two
+  tasks at once must not have them fight over one.
+- A session either launches a browser or attaches to a `DevTools` endpoint. A
+  launched browser is ended and its temporary profile removed when the session
+  closes; an attached one is left running.
+- At most eight sessions are held at once. The ninth is refused before a browser
+  is started, not after.
+- `CloseSession` on a session that does not exist succeeds. A host retrying a
+  close after a timeout must not have to tell "never existed" from "already
+  cleaned up".
+
+### Navigation
+
+- Only `http`, `https`, and `about:blank` are navigable. A bare host becomes
+  `https://`. `file:` would make the module a filesystem reader for whoever can
+  reach the bus; `javascript:` would make navigation an evaluation channel that
+  skips `Evaluate` and its deadline.
+- `wait_until` settles at `commit`, `DOMContentLoaded`, `load`, or `networkIdle`.
+  `networkIdle` is best-effort: a page that polls never goes quiet, and reporting
+  a timeout would be a claim about the page rather than a fact about the network.
+- A navigation retires every outstanding ref, because the document they named is
+  gone.
+- `allowed_origins`, when non-empty, refuses a navigation before the browser is
+  asked to make a request. It is a guard rail, not a sandbox — see
+  *Non-goals*.
+
+### Snapshots and refs
+
+- A snapshot renders the accessibility tree as indented text, one line per node,
+  with `@eN` on every node an agent could address.
+- Refs belong to the generation that minted them. A ref from an earlier
+  generation is refused as `StaleRef`, never resolved against whatever now
+  occupies that position — a stale ref that silently resolves is how an agent
+  clicks the wrong thing and reports success.
+- The generation counter moves for every snapshot and every navigation, so the
+  first snapshot after a navigation is not number one.
+- `interactive_only` keeps controls and drops prose. `compact` drops the
+  structural scaffolding even when named.
+
+### Interactions
+
+- Clicks and keystrokes go through `Input.dispatchMouseEvent` and
+  `Input.dispatchKeyEvent`, the same path a physical device takes. Synthetic
+  `element.click()` and direct `value` assignment skip hit testing and skip the
+  events a framework listens for, which makes them useful for driving a page and
+  useless for checking one.
+- A click is refused when something else occupies its click point, and the error
+  names the covering element. Delivering the click to a consent banner and
+  reporting success is the most expensive failure an agent can be handed.
+- A key press fills in `key`, `code`, `windowsVirtualKeyCode`, and `text`
+  together, because pages read all four.
+- An element is named by snapshot ref, CSS selector, or semantic locator. The
+  string form a tool receives is read by `Target::parse`: a leading `@` is a
+  ref, anything else is CSS.
+
+### Outputs
+
+- A screenshot is held and collected in chunks, because a full-page capture does
+  not fit a 16 MiB frame and a served object cannot open a stream to its caller.
+- A handle carries the length and a SHA-256, so a host can verify what it
+  reassembled. The length is a number the module sent: a host must treat it as a
+  bound to check rather than one to size a buffer from.
+- At most sixteen outputs are held, each at most 64 MiB, expiring after five
+  minutes. Eviction is oldest-first, because the newest is the one somebody is
+  about to read.
+
+### Errors
+
+- Every failure carries a stable name from `tinybrowser_bus::errors`, with the
+  prose in the message. A host decides what to show a model by matching on the
+  name; matching on wording breaks the first time wording changes.
+- `errors::is_agent_recoverable` answers the only question a host tool has: can
+  the model fix this by choosing differently, or does it need an operator?
+- A lost connection reports as `NoSuchSession`, because the remedy is to open a
+  new session rather than retry into a socket that will never answer.
+
+## Non-goals
+
+- **A sandbox.** `allowed_origins` refuses navigations the module is asked to
+  make. A page's own JavaScript can navigate around it. A deployment that needs
+  a boundary puts the browser in a network namespace.
+- **An agent.** No model, no prompt, no tool schemas. Deciding what to click is
+  the host's job.
+- **Persistence.** Sessions are memory and end with the process.
+- **Downloading a browser.** Discovery is a fixed list plus an environment
+  variable. A module that fetches and executes a binary is a different kind of
+  thing.
+
+## Invariants a change must not break
+
+1. `tinybrowser-bus` links no transport, no runtime, no HTTP client, no native
+   library. CI asserts it.
+2. `names::METHODS`, the interface macro's dispatch table, and the module
+   manifest agree. The unit tests assert both relationships.
+3. Every `Error` variant maps to a published wire name. The unit tests assert it
+   for every variant, so a new one cannot be added without deciding what a host
+   sees.
+4. The unit suites need no browser. Judgement that can only be exercised against
+   a live Chrome is judgement in the wrong place.
+5. The live suite fails rather than skips once opted in. A suite that quietly
+   does nothing reports green for a build in which nothing was checked.
+
+## Acceptance
+
+- `cargo fmt --all -- --check`, `cargo clippy --all-targets --all-features --
+  -D warnings`, `cargo build --all-targets --all-features`, and
+  `cargo test --all-features`, all green with no browser present.
+- `TINYBROWSER_LIVE_TESTS=1 cargo test -p tinybrowser --test live_chrome` green
+  against a real Chrome, serving its fixtures on loopback.
+- `cargo run -p tinybrowser --example verify_module -- <cdylib>` loads the built
+  artifact through the real dynamic loader and completes a call.
diff --git a/docs/specs/example-retry-policy.md b/docs/specs/example-retry-policy.md
deleted file mode 100644
index fe0c1a8..0000000
--- a/docs/specs/example-retry-policy.md
+++ /dev/null
@@ -1,63 +0,0 @@
-# Example: Retry policy
-
-- **Status:** Example
-- **Owner:** Maintainers
-- **Plan:** [`../plans/example-retry-policy.md`](../plans/example-retry-policy.md)
-
-> This demonstrates the expected specification format. Replace or remove it
-> when generating a real project from this template.
-
-## Problem
-
-Callers need a typed way to limit retries without duplicating attempt counting
-and validation. The crate currently has no retry behavior.
-
-## Goals
-
-- Expose an immutable retry policy with a non-zero maximum attempt count.
-- Let callers determine whether another attempt is permitted.
-- Reject zero attempts through the crate-wide error type.
-
-## Non-goals
-
-- Sleeping, backoff, jitter, or executing operations.
-- Deciding which application-specific errors are retryable.
-- Persisting retry state.
-
-## Proposed behavior
-
-The public surface is deliberately small:
-
-```rust
-use template::{RetryPolicy, Result};
-
-fn policy() -> Result<RetryPolicy> {
-    let policy = RetryPolicy::new(3)?;
-    assert!(policy.allows_attempt(1));
-    assert!(!policy.allows_attempt(4));
-    Ok(policy)
-}
-```
-
-`RetryPolicy::new(0)` returns a dedicated `Error::ZeroMaxAttempts` variant.
-Attempt numbers are one-based: attempt `1` is the initial call, not the first
-retry.
-
-## Invariants and constraints
-
-- `max_attempts` is always greater than zero after construction.
-- `allows_attempt(n)` is true exactly when `1 <= n <= max_attempts`.
-- The type is cheap to copy and does not perform I/O or observe time.
-- New public items have rustdoc and are re-exported from `src/lib.rs`.
-
-## Acceptance criteria
-
-- Construction succeeds for `1` and `u32::MAX` and fails for `0`.
-- Boundary checks cover attempts `0`, `1`, `max_attempts`, and
-  `max_attempts + 1` when representable.
-- Integration tests prove the policy and its error are available to consumers.
-- Formatting, Clippy, build, tests, rustdoc, and cargo-deny pass.
-
-## Open questions
-
-None for this example.
diff --git a/docs/specs/tinybus-module-release.md b/docs/specs/tinybus-module-release.md
index adae9b4..d16a687 100644
--- a/docs/specs/tinybus-module-release.md
+++ b/docs/specs/tinybus-module-release.md
@@ -10,10 +10,11 @@ distributable without also shipping the TinyBus host runtime.
 - The library builds as both an `rlib` and a native `cdylib`.
 - The `cdylib` exports TinyBus module ABI v1, an embedded manifest, and the
   initialization entrypoint.
-- The example module provides `ai.tinyhumans.template.Greeting.Greet` at
-  `/ai/tinyhumans/template/Greeting`.
+- The module provides `ai.tinyhumans.tinybrowser.Browser` at
+  `/ai/tinyhumans/tinybrowser/Browser`, with the members
+  `tinybrowser_bus::names::METHODS` lists.
 - Each release archive is named
-  `template-<version>-<platform>.<extension>` and contains only this
+  `tinybrowser-<version>-<platform>.<extension>` and contains only this
   module, its SHA-256 `modules.toml`, license, and installation documentation.
 - Each GitHub release publishes a separate `checksum.toml` mapping every
   archive filename to its SHA-256 digest for TinyBus's release loader.