From e81cdbd9b31a62227698bd3d824fd901551061f0 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 11 Aug 2026 06:33:46 +0900
Subject: [PATCH 01/10] test(mv3): require content-script isolated-world proof

---
 tests/test_mv3_isolated_world_contract.py | 44 +++++++++++++++++++++++
 1 file changed, 44 insertions(+)
 create mode 100644 tests/test_mv3_isolated_world_contract.py

diff --git a/tests/test_mv3_isolated_world_contract.py b/tests/test_mv3_isolated_world_contract.py
new file mode 100644
index 000000000..15a36bece
--- /dev/null
+++ b/tests/test_mv3_isolated_world_contract.py
@@ -0,0 +1,44 @@
+"""Fail-first contract for real Manifest V3 content-script isolated-world evidence."""
+
+from __future__ import annotations
+
+import pathlib
+import unittest
+
+ROOT = pathlib.Path(__file__).resolve().parents[1]
+FIXTURE = ROOT / "tests" / "fixtures" / "mv3_basic"
+
+
+class ManifestV3IsolatedWorldContractTests(unittest.TestCase):
+    """Require content-script compatibility to prove main/isolated world separation."""
+
+    def test_page_continuously_exposes_its_main_world_sentinel(self) -> None:
+        """The page must re-read its own window after the content script runs."""
+
+        page = (FIXTURE / "page.html").read_text(encoding="utf-8")
+        for expected in (
+            'window.originweaveWorldSentinel = "page"',
+            "originweavePageWorld",
+            "setInterval",
+        ):
+            with self.subTest(expected=expected):
+                self.assertIn(expected, page)
+
+    def test_content_ready_depends_on_isolated_world_separation(self) -> None:
+        """The existing content-script gate must fail if page and extension worlds collapse."""
+
+        content = (FIXTURE / "content_script.js").read_text(encoding="utf-8")
+        for expected in (
+            'window.originweaveWorldSentinel = "extension"',
+            "originweavePageWorld",
+            'window.originweaveWorldSentinel === "extension"',
+            'pageWorldSentinel === "page"',
+        ):
+            with self.subTest(expected=expected):
+                self.assertIn(expected, content)
+        self.assertIn("setTimeout", content)
+        self.assertIn("originweaveContentScript", content)
+
+
+if __name__ == "__main__":
+    unittest.main()

From b2d2324f06f18efdd2547b04adc38703aa5d4e47 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 11 Aug 2026 06:35:46 +0900
Subject: [PATCH 02/10] feat(mv3): publish main-world isolation sentinel

---
 tests/fixtures/mv3_basic/page.html | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tests/fixtures/mv3_basic/page.html b/tests/fixtures/mv3_basic/page.html
index cc224cff0..ef4f2bb7a 100644
--- a/tests/fixtures/mv3_basic/page.html
+++ b/tests/fixtures/mv3_basic/page.html
@@ -12,6 +12,14 @@ <h1>OriginWeave MV3 compatibility fixture</h1>
   </main>
   <script>
     "use strict";
+    window.originweaveWorldSentinel = "page";
+    const publishPageWorld = () => {
+      document.documentElement.dataset.originweavePageWorld =
+        window.originweaveWorldSentinel;
+    };
+    publishPageWorld();
+    setInterval(publishPageWorld, 25);
+
     document.querySelector("#fixture-button").addEventListener("click", () => {
       document.querySelector("#fixture-output").textContent = "clicked";
     });

From 26762be245f944544b3435c14059662f5842509f Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 11 Aug 2026 06:36:19 +0900
Subject: [PATCH 03/10] feat(mv3): gate content readiness on isolated world

---
 tests/fixtures/mv3_basic/content_script.js | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/tests/fixtures/mv3_basic/content_script.js b/tests/fixtures/mv3_basic/content_script.js
index 1056d3690..c9514779e 100644
--- a/tests/fixtures/mv3_basic/content_script.js
+++ b/tests/fixtures/mv3_basic/content_script.js
@@ -1,7 +1,13 @@
 "use strict";
 
 (async () => {
-  document.documentElement.dataset.originweaveContentScript = "ready";
+  window.originweaveWorldSentinel = "extension";
+  await new Promise((resolve) => setTimeout(resolve, 75));
+  const pageWorldSentinel = document.documentElement.dataset.originweavePageWorld;
+  document.documentElement.dataset.originweaveContentScript =
+    window.originweaveWorldSentinel === "extension" && pageWorldSentinel === "page"
+      ? "ready"
+      : "missing";
 
   const previous = await chrome.storage.local.get("originweave_content");
   const storagePersisted = previous.originweave_content === "ready";

From c1705ad9fd2d96e620b89bb6e7ea1235063dcb6a Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 11 Aug 2026 06:36:58 +0900
Subject: [PATCH 04/10] docs(changelog): record isolated-world compatibility

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 119e20f86..94a86bef5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -30,6 +30,7 @@ All notable changes to OriginWeave are documented in this file. The format follo
 - Proposed product-wide target-architecture ADRs for the Rust control plane, isolated execution modes, typed actions, semantic observation/stale-node authority, prompt-injection and secret separation, resource-governor priority, provenance evidence, browser/protocol adapters, crawler policy, and hourly automation operational closure; these remain Proposed rather than shipped claims until protected review and merge.
 - Pinned real-Chromium Manifest V3 compatibility evidence for a controlled history add/read/delete lifecycle confined to the ephemeral loopback fixture profile, with cleanup verification and no OriginWeave Agent history-authority claim.
 - Pinned real-Chromium Manifest V3 update-migration evidence using a trial-local unpacked-extension copy, a controlled `1.0.0` to `1.0.1` transition, persisted profile state, and explicit schema migration without modifying the checked-in fixture or granting Agent authority.
+- Pinned real-Chromium Manifest V3 content-script isolated-world evidence that requires the page main world and extension isolated world to retain distinct JavaScript globals while sharing only a controlled DOM sentinel.
 
 ### Changed
 

From e3ef1b99ad952a8c2835299f992a6db595a7212a Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sun, 16 Aug 2026 12:18:24 +0900
Subject: [PATCH 05/10] fix: preserve current MV3 download prerequisite
 semantics

---
 tests/fixtures/mv3_basic/service_worker.js | 2 +-
 tests/test_mv3_downloads_contract.py       | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/tests/fixtures/mv3_basic/service_worker.js b/tests/fixtures/mv3_basic/service_worker.js
index ecaaa1bf4..fa06d0b28 100644
--- a/tests/fixtures/mv3_basic/service_worker.js
+++ b/tests/fixtures/mv3_basic/service_worker.js
@@ -124,7 +124,7 @@ async function exerciseDownload(sender) {
     downloadId = await chrome.downloads.download({
       url,
       filename: "originweave-mv3/download.txt",
-      conflictAction: "overwrite",
+      conflictAction: "uniquify",
       saveAs: false,
     });
   } catch (_error) {
diff --git a/tests/test_mv3_downloads_contract.py b/tests/test_mv3_downloads_contract.py
index 94696376c..53218b965 100644
--- a/tests/test_mv3_downloads_contract.py
+++ b/tests/test_mv3_downloads_contract.py
@@ -50,6 +50,13 @@ def test_service_worker_executes_and_verifies_a_real_loopback_download(self) ->
                 self.assertIn(expected, worker)
         self.assertNotIn('chrome.runtime.getURL("download.txt")', worker)
 
+    def test_restart_pair_never_overwrites_the_previous_controlled_download(self) -> None:
+        """Restart evidence must not race Chrome while replacing the first pass's file."""
+
+        worker = (FIXTURE / "service_worker.js").read_text(encoding="utf-8")
+        self.assertIn('conflictAction: "uniquify"', worker)
+        self.assertNotIn('conflictAction: "overwrite"', worker)
+
     def test_download_failures_emit_only_bounded_stage_diagnostics(self) -> None:
         """Fixture diagnostics must name a reviewed stage without retaining raw browser errors."""
 

From 13a4e35d3d88b3476c352083a7e97a979e8bbb52 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sun, 16 Aug 2026 22:33:01 +0900
Subject: [PATCH 06/10] test(mv3): inherit update-lane cleanup normalization

---
 tests/test_mv3_session_cleanup_exception_contract.py | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/tests/test_mv3_session_cleanup_exception_contract.py b/tests/test_mv3_session_cleanup_exception_contract.py
index 8f3171712..2edebaad8 100644
--- a/tests/test_mv3_session_cleanup_exception_contract.py
+++ b/tests/test_mv3_session_cleanup_exception_contract.py
@@ -6,7 +6,7 @@
 import runpy
 import tempfile
 import unittest
-from unittest import mock
+import unittest.mock
 
 ROOT = pathlib.Path(__file__).resolve().parents[1]
 RUNNER = ROOT / "scripts" / "ci" / "run_mv3_compatibility.py"
@@ -103,8 +103,10 @@ def fake_json_request(
             extension_dir = trial_dir / "extension"
             extension_dir.mkdir()
             with (
-                mock.patch.object(globals_["subprocess"], "Popen", return_value=fake_driver),
-                mock.patch.dict(
+                unittest.mock.patch.object(
+                    globals_["subprocess"], "Popen", return_value=fake_driver
+                ),
+                unittest.mock.patch.dict(
                     globals_,
                     {
                         "_free_loopback_port": lambda: 43123,

From e149dcda5e83a4ebabd6a72be40589a4f7ba18de Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Mon, 17 Aug 2026 04:48:19 +0900
Subject: [PATCH 07/10] fix(mv3): rebuild isolated-world tree from current
 update prerequisite

Use the exact repaired #60 tree as the descendant baseline and preserve only the isolated-world page fixture and regression test at this step. This removes stale child-tree deletions before merging the two overlapping isolated-world files.
---
 CHANGELOG.md                                  |   7 +-
 docs/DOCUMENTATION_FITNESS.md                 |   2 +-
 docs/PRD.md                                   |   4 +-
 docs/TRD.md                                   |   2 +-
 docs/doctoring.md                             |  24 +++
 docs/doctoring/mv3-compatibility.md           |  28 ++-
 .../evidence/2026-08-10-active-pr-maturity.md |   2 +-
 docs/traceability/README.md                   |   2 +-
 scripts/ci/run_mv3_compatibility.py           | 174 ++++++++++++++----
 tests/fixtures/mv3_basic/content_script.js    |  10 +-
 tests/fixtures/mv3_basic/service_worker.js    |  44 +++--
 tests/test_mv3_binary_authority_contract.py   | 108 +++++++++++
 tests/test_mv3_bookmark_mutation_contract.py  | 121 ++++++++++++
 ...mv3_browser_version_diagnostic_contract.py | 110 +++++++++++
 tests/test_mv3_click_diagnostic_contract.py   |  48 +++++
 tests/test_mv3_compatibility_contract.py      |  90 +++++++++
 ..._mv3_session_cleanup_exception_contract.py | 145 +++++++++++----
 ...3_transport_protocol_exception_contract.py |  70 +++++++
 18 files changed, 889 insertions(+), 102 deletions(-)
 mode change 100755 => 100644 scripts/ci/run_mv3_compatibility.py
 create mode 100644 tests/test_mv3_binary_authority_contract.py
 create mode 100644 tests/test_mv3_browser_version_diagnostic_contract.py
 create mode 100644 tests/test_mv3_click_diagnostic_contract.py
 create mode 100644 tests/test_mv3_transport_protocol_exception_contract.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 94a86bef5..7f36b0c3d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -30,10 +30,15 @@ All notable changes to OriginWeave are documented in this file. The format follo
 - Proposed product-wide target-architecture ADRs for the Rust control plane, isolated execution modes, typed actions, semantic observation/stale-node authority, prompt-injection and secret separation, resource-governor priority, provenance evidence, browser/protocol adapters, crawler policy, and hourly automation operational closure; these remain Proposed rather than shipped claims until protected review and merge.
 - Pinned real-Chromium Manifest V3 compatibility evidence for a controlled history add/read/delete lifecycle confined to the ephemeral loopback fixture profile, with cleanup verification and no OriginWeave Agent history-authority claim.
 - Pinned real-Chromium Manifest V3 update-migration evidence using a trial-local unpacked-extension copy, a controlled `1.0.0` to `1.0.1` transition, persisted profile state, and explicit schema migration without modifying the checked-in fixture or granting Agent authority.
-- Pinned real-Chromium Manifest V3 content-script isolated-world evidence that requires the page main world and extension isolated world to retain distinct JavaScript globals while sharing only a controlled DOM sentinel.
 
 ### Changed
 
+- Classified a mismatched Chrome `browserVersion` capability as an expected-only diagnostic so browser-reported capability text cannot enter Manifest V3 runner exception output.
+- Classified Manifest V3 bookmark create/get/remove failures as allow-listed stage tokens so raw Chrome bookmark errors and fixture titles cannot enter runner evidence.
+- Recorded the current Chrome Extensions `chrome.bookmarks` primary reference in APA 7th form and stated that the active bookmark-mutation lane proves one controlled loopback lifecycle in pinned Chromium, not Agent bookmark authority.
+- Classified Manifest V3 WebDriver HTTP/1.1 parser failures as a fixed transport-protocol token so a malformed status-line or incomplete message body cannot enter runner exception text.
+- Classified Manifest V3 real-click post-condition failures as a fixed mismatch token so page-controlled WebDriver text cannot enter runner exception text.
+- Recorded the current Chrome Extensions `chrome.downloads` primary reference in APA 7th form and stated that the active downloads lane proves one controlled loopback payload in pinned Chromium, not Agent filesystem authority.
 - Separated logical origin authority from resolved network destination authority; an origin grant no longer implies permission to connect to every resolver result.
 - Separated resolved-address authorization from direct transport evidence; an approved IP now becomes a usable stream only after the operating system reports the exact requested IP and port.
 - Separated exact TCP peer proof from authenticated TLS service identity; an observed peer becomes an authenticated HTTPS stream only after explicit-root, fixed-time, SAN-bound WebPKI verification over that same stream.
diff --git a/docs/DOCUMENTATION_FITNESS.md b/docs/DOCUMENTATION_FITNESS.md
index 69f603252..11b5d5dd7 100644
--- a/docs/DOCUMENTATION_FITNESS.md
+++ b/docs/DOCUMENTATION_FITNESS.md
@@ -55,7 +55,7 @@ Protected main already proves a pinned-Chromium baseline for service worker, con
 
 - #43: controlled downloads;
 - #49: per-trial ephemeral profile isolation;
-- #56: bookmark create/read/delete cleanup;
+- #56: bookmark create/read/delete cleanup with allow-listed stage diagnostics;
 - #59: history add/read/delete/absence verification;
 - #60: trial-local unpacked-extension `1.0.0` → `1.0.1` update with explicit schema migration; and
 - #61: real content-script isolated-world evidence in which the page main world retains a `page` sentinel while the content script independently retains an `extension` sentinel.
diff --git a/docs/PRD.md b/docs/PRD.md
index 40539a28f..4b409f2dd 100644
--- a/docs/PRD.md
+++ b/docs/PRD.md
@@ -183,7 +183,7 @@ public-crawl purpose
 | ID | Requirement | Status | Implementation evidence / note |
 |---|---|---|---|
 | PRD-COMP-001 | Chromium is the compatibility kernel; OriginWeave does not reimplement Blink or V8 | Accepted architecture | ADR 0001 |
-| PRD-COMP-002 | Maintain a Manifest V3 compatibility matrix and representative extension test farm | Planned | Partial protected-main pinned-Chromium evidence covers service worker, content script, storage, DNR, tabs, windows, scripting, commands, side panel, bookmarks, history, restart and repeatability; active PR #43 adds bounded real downloads evidence; issue #27 still owns the complete matrix/release acceptance |
+| PRD-COMP-002 | Maintain a Manifest V3 compatibility matrix and representative extension test farm | Planned | Partial protected-main pinned-Chromium evidence covers service worker, content script, storage, DNR, tabs, windows, scripting, commands, side panel, bookmarks, history, restart and repeatability; active PR #43 adds bounded real downloads evidence; active PR #56 adds bounded bookmark mutation with allow-listed stage diagnostics; issue #27 still owns the complete matrix/release acceptance |
 | PRD-COMP-003 | Chromium-specific integrations remain behind versioned adapters | Planned | Adapter strategy ADR 0107 |
 | PRD-COMP-004 | Headless runtime remains independently usable without the interactive browser UI | Planned | Modular architecture target |
 
@@ -267,7 +267,7 @@ public-crawl purpose
 | PRD-EXT-001 | Manifest V3 remains the extension compatibility baseline | Accepted architecture | Official Chrome platform baseline; real pinned-Chromium evidence exists on protected main |
 | PRD-EXT-002 | Upstream extension APIs are preserved where possible | Accepted architecture | Chromium-kernel strategy; current protected-main compatibility lane exercises multiple real MV3 APIs |
 | PRD-EXT-003 | Extension access to agent authority requires separate signed policy grant | Planned | Protected-main extension authority foundation exists, but the complete managed-extension/native-messaging/enterprise runtime contract remains open under issue #27; Proposed ADR 0013 does not itself make this shipped |
-| PRD-EXT-004 | Compatibility tests cover install/update, worker lifecycle, scripts, storage, DNR, messaging, download, side panel and isolation | Planned | Protected-main suite already covers worker/content/storage/DNR/tabs/windows/scripting/commands/side panel/bookmarks/history/restart/repeatability; active PR #43 adds downloads; install/update/native messaging/enterprise isolation and release-wide matrix remain open under issue #27 |
+| PRD-EXT-004 | Compatibility tests cover install/update, worker lifecycle, scripts, storage, DNR, messaging, download, side panel and isolation | Planned | Protected-main suite already covers worker/content/storage/DNR/tabs/windows/scripting/commands/side panel/bookmarks/history/restart/repeatability; active PR #43 adds downloads; active PR #56 adds bookmark create/get/remove diagnostics; install/update/native messaging/enterprise isolation and release-wide matrix remain open under issue #27 |
 
 ### 9.10 Crawler and capture policy
 
diff --git a/docs/TRD.md b/docs/TRD.md
index 3e8030012..bb5292833 100644
--- a/docs/TRD.md
+++ b/docs/TRD.md
@@ -339,7 +339,7 @@ Generic network evidence retains bounded names and canonical locators while valu
 
 The complete compatibility program is **Planned** under issue #27, while partial real-browser evidence exists on protected main. OriginWeave preserves Chromium's extension implementation rather than rebuilding Chrome APIs in Rust. Agent authority remains separate from ordinary extension permissions. Proposed ADR 0013 documents this separation but is not Accepted design authority until reviewed/integrated accordingly.
 
-Protected-main pinned-Chromium evidence currently exercises service-worker lifecycle, content scripts, storage, declarativeNetRequest, tabs, windows, scripting, commands, side panel, bookmarks, history, restart persistence and repeatability. Active PR #43 adds a bounded real `chrome.downloads` path and allowlisted download-stage failure evidence. Installation/update, native messaging, managed-extension/enterprise policy, broader isolation, Web Store and release-wide compatibility remain outside the current protected-main claim.
+Protected-main pinned-Chromium evidence currently exercises service-worker lifecycle, content scripts, storage, declarativeNetRequest, tabs, windows, scripting, commands, side panel, bookmarks, history, restart persistence and repeatability. Active PR #43 adds a bounded real `chrome.downloads` path and allowlisted download-stage failure evidence. Active PR #56 adds a bounded `chrome.bookmarks` create/get/remove lifecycle with allow-listed stage diagnostics. Installation/update, native messaging, managed-extension/enterprise policy, broader isolation, Web Store and release-wide compatibility remain outside the current protected-main claim.
 
 ## 14. Prompt-injection and model boundary
 
diff --git a/docs/doctoring.md b/docs/doctoring.md
index 75c107ef0..ad91de059 100644
--- a/docs/doctoring.md
+++ b/docs/doctoring.md
@@ -8,6 +8,22 @@ This document records external evidence that changes OriginWeave architecture, t
 
 The 1 June 2026 WebDriver BiDi Working Draft defines a bidirectional remote-control protocol, events, commands, and user contexts. Because it remains a W3C Working Draft, OriginWeave places BiDi behind a versioned adapter and Web Platform Tests-derived contract tests rather than make it the internal authority model.
 
+### Manifest V3 downloads compatibility
+
+The current Chrome Extensions Downloads API documents the `downloads` manifest permission and `chrome.downloads` methods that initiate, monitor, search, and inspect downloads. That living vendor reference is API semantics only. OriginWeave treats a successful controlled loopback download in pinned Chromium as compatibility evidence for one declared surface, not as Agent filesystem authority, general download persistence, or a claim that every Downloads method is supported.
+
+### Manifest V3 bookmarks compatibility
+
+The current Chrome Extensions Bookmarks API documents the `bookmarks` manifest permission and Promise-returning `chrome.bookmarks.create`, `chrome.bookmarks.get`, and `chrome.bookmarks.remove` methods. Bookmark node identifiers are strings unique within one browser profile. That living vendor reference is API semantics only. OriginWeave treats one controlled loopback create → get → remove lifecycle plus allow-listed stage diagnostics as compatibility evidence, not as Agent bookmark capability or ambient human-profile bookmark authority.
+
+### Manifest V3 WebDriver transport-protocol diagnostics
+
+RFC 9112 defines the HTTP/1.1 status-line and the requirement that a message body match the announced framing. A malformed status-line or an incomplete body is a recoverable parser failure, not a trusted diagnostic payload. W3C WebDriver carries commands over that HTTP transport. The Manifest V3 compatibility runner therefore converts `http.client.HTTPException` subclasses such as `BadStatusLine` and `IncompleteRead` into the classified message `WebDriver transport protocol failure`. Raw status-line text, partial body bytes, paths, URLs, or tokens must not enter exception text, trial evidence, or logs.
+
+### Manifest V3 click post-condition diagnostics
+
+W3C WebDriver Get Element Text returns the rendered text content of a located element. That value is page-controlled data, not a trusted diagnostic token. The Manifest V3 compatibility runner therefore compares the fixture output against the exact expected `clicked` token and, on mismatch, raises only the classified message `real click post-condition mismatch`. Raw element text must not enter exception text, trial evidence, or logs.
+
 ### Browser origin equivalence
 
 The WHATWG URL host parser and Chromium canonicalizer classify shortened decimal, integer, hexadecimal, legacy octal-looking, and mixed-component numeric hosts as IPv4 or broken IPv4 candidates rather than ordinary DNS names. Chromium's regression suite includes values such as `192`, `0xC0a80001`, `030052000001`, and mixed hexadecimal components. A non-final empty `0x` component can participate in Chromium's multi-part IPv4 truncation behavior, but a final `0x` label does not produce an IPv4 number because stripping its prefix leaves no digits; it remains a domain label. Chromium also warns that broken IP-like hosts must not be connected because another resolver could accept them. OriginWeave therefore admits only canonical dotted-decimal IPv4 into its policy origin type, rejects browser-special numeric spellings before DNS validation, and preserves final non-numeric DNS labels such as `0x`.
@@ -98,6 +114,10 @@ Autio, C., Schwartz, R., Dunietz, J., Jain, S., Stanley, M., Tabassi, E., Hall,
 
 Bonica, R., Cotton, M., Haberman, B., & Vegoda, L. (2017). *Updates to the special-purpose IP address registries* (RFC 8190). Internet Engineering Task Force. https://doi.org/10.17487/RFC8190
 
+Chrome for Developers. (n.d.). *chrome.bookmarks*. Google. Retrieved August 16, 2026, from https://developer.chrome.com/docs/extensions/reference/api/bookmarks
+
+Chrome for Developers. (n.d.). *chrome.downloads*. Google. Retrieved August 16, 2026, from https://developer.chrome.com/docs/extensions/reference/api/downloads
+
 Chromium Authors. (n.d.). *Proxy support in Chrome* [Source documentation]. Chromium. https://chromium.googlesource.com/chromium/src/+/a3e71ebfa307d8760eb68b777e2998a869940092/net/docs/proxy.md
 
 Chromium Authors. (2026). *URL canonicalizer unit tests* [Source code]. Chromium. https://chromium.googlesource.com/chromium/src/+/446d05d21720f0b3505ec21057b3e9f909784262/url/url_canon_unittest.cc
@@ -114,6 +134,8 @@ Evtimov, I., Zharmagambetov, A., Grattafiori, A., Guo, C., & Chaudhuri, K. (2025
 
 Fielding, R., Nottingham, M., & Reschke, J. (2022). *HTTP semantics* (RFC 9110). Internet Engineering Task Force. https://doi.org/10.17487/RFC9110
 
+Fielding, R., Nottingham, M., & Reschke, J. (Eds.). (2022). *HTTP/1.1* (RFC 9112). Internet Engineering Task Force. https://doi.org/10.17487/RFC9112
+
 Fugu Team, Sakana AI. (2026). *Sakana Fugu technical report* [Technical report]. arXiv. https://doi.org/10.48550/arXiv.2606.21228
 
 Huston, G., & Buraglio, N. (2024). *Expanding the IPv6 documentation space* (RFC 9637). Internet Engineering Task Force. https://doi.org/10.17487/RFC9637
@@ -154,6 +176,8 @@ Web Hypertext Application Technology Working Group. (2026). *URL standard*. http
 
 World Wide Web Consortium. (2013). *PROV-O: The PROV ontology*. https://www.w3.org/TR/prov-o/
 
+World Wide Web Consortium. (2018, June 5). *WebDriver* (W3C Recommendation). https://www.w3.org/TR/2018/REC-webdriver1-20180605/
+
 World Wide Web Consortium. (2026, June 1). *WebDriver BiDi* (W3C Working Draft). https://www.w3.org/TR/2026/WD-webdriver-bidi-20260601/
 
 Xu, J., Sun, Q., Schwendeman, P., Nielsen, S., Cetin, E., & Tang, Y. (2025). *TRINITY: An evolved LLM coordinator* [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2512.04695
diff --git a/docs/doctoring/mv3-compatibility.md b/docs/doctoring/mv3-compatibility.md
index 571c49329..3a4f058ea 100644
--- a/docs/doctoring/mv3-compatibility.md
+++ b/docs/doctoring/mv3-compatibility.md
@@ -1,7 +1,7 @@
 # Manifest V3 compatibility evidence baseline
 
 - **Status:** Active implementation evidence for issue #27
-- **Reviewed:** 2026-08-11
+- **Reviewed:** 2026-08-16
 - **Pinned browser:** Chrome for Testing `150.0.7871.129`, Chromium revision `r1639810`
 
 OriginWeave uses Chromium as its compatibility kernel, so browser-extension compatibility must be demonstrated with executable Chromium evidence rather than inferred from architecture alone. The protected-main lane exercises a controlled unpacked Manifest V3 extension against one exact Chrome for Testing build and proves service-worker, content-script, storage, declarative-network-request, tabs, windows, scripting, commands, side-panel, bookmarks/history read compatibility, restart persistence, repeatability, and one real WebDriver click/post-condition. Active stacked compatibility work adds downloads, bounded bookmark/history mutation, profile isolation, explicit extension update/version-migration evidence, and an exact content-script isolated-world check. OriginWeave does **not claim 100% Chrome extension compatibility**.
@@ -22,7 +22,7 @@ This matrix separates protected-main executable evidence from active, non-shippe
 | `declarativeNetRequest` | **PROTECTED_MAIN** | Controlled local rule blocks its fixture request in pinned Chromium. | No claim for every DNR rule/action combination. |
 | `tabs`, `windows`, `scripting`, `commands`, `sidePanel` | **PROTECTED_MAIN** | Each declared API is exercised in real Chromium and required by the repeatability gate. | Chrome API permission does not become Agent capability. |
 | Bookmarks read compatibility | **PROTECTED_MAIN** | Protected-main fixture exercises the declared bookmarks surface. | Ambient human-profile bookmark authority is not granted. |
-| Bookmarks create/read/delete lifecycle | **ACTIVE_PR #56** | Controlled synthetic bookmark is created, read back, and removed in the ephemeral compatibility profile. | Compatibility only; no Agent bookmark capability. |
+| Bookmarks create/read/delete lifecycle | **ACTIVE_PR #56** | Controlled synthetic bookmark is created, read back, and removed in the ephemeral compatibility profile, with allow-listed stage diagnostics. | Compatibility only; no Agent bookmark capability. |
 | History read compatibility | **PROTECTED_MAIN** | Protected-main fixture exercises bounded history search in the isolated profile. | No model-visible browsing-history content or default-profile access. |
 | History add/read/delete lifecycle | **ACTIVE_PR #59** | Controlled synthetic loopback visit is added, exactly read back, deleted in `finally`, and required to be absent afterward. | Compatibility only; no Agent history capability. |
 | Downloads | **ACTIVE_PR #43** | Controlled loopback payload is downloaded and validated through pinned Chromium. | No general download persistence, unsafe filename, or Agent filesystem authority claim. |
@@ -34,10 +34,26 @@ This matrix separates protected-main executable evidence from active, non-shippe
 
 The release-quality capability matrix must remain coupled to executable evidence. Adding a row to documentation never creates support; declaring a new supported capability must first add a realistic regression test and pinned-Chromium proof. Conversely, if a declared protected-main capability regresses, the release gate must fail rather than silently downgrading the matrix.
 
+## Bookmarks API primary evidence
+
+For bookmark compatibility specifically, the current official Chrome Extensions API documents the `bookmarks` manifest permission and Promise-returning `chrome.bookmarks.create`, `chrome.bookmarks.get`, and `chrome.bookmarks.remove` methods. Bookmark node identifiers are strings unique within one browser profile. This living vendor reference establishes API semantics only. Active PR #56 exercises one controlled loopback create → get → remove lifecycle through pinned Chromium and retains only allow-listed stage diagnostics. That proof is not Agent bookmark capability, ambient human-profile bookmark authority, or a release claim that every `chrome.bookmarks` method works.
+
 ## History API primary evidence
 
 For history compatibility specifically, the current official Chrome Extensions API documents the `history` manifest permission and Promise-returning `chrome.history.addUrl`, `chrome.history.search`, and `chrome.history.deleteUrl` methods. This living vendor reference establishes API semantics only. OriginWeave release evidence continues to depend on the exact pinned Chromium fixture and exact-head CI result rather than inferring compatibility from documentation.
 
+## Downloads API primary evidence
+
+For downloads compatibility specifically, the current official Chrome Extensions API documents the `downloads` manifest permission and the `chrome.downloads` methods that initiate, monitor, search, and inspect downloads. This living vendor reference establishes API semantics only. Active PR #43 exercises one controlled loopback payload through pinned Chromium and retains only allow-listed stage diagnostics. That proof is not Agent filesystem authority, general download persistence, unsafe-filename handling, or a release claim that every `chrome.downloads` method works.
+
+## WebDriver transport-protocol diagnostic boundary
+
+RFC 9112 requires a well-formed HTTP/1.1 status-line and a message body that matches the announced framing. W3C WebDriver sends commands over that HTTP transport. When ChromeDriver returns a malformed status-line or an incomplete body, the compatibility runner raises only `WebDriver transport protocol failure`. Raw status-line text, partial body bytes, paths, URLs, or tokens must not enter exception text or trial evidence. This classification lets `main` record the failure in `trial_results` instead of aborting the compatibility run with an unclassified parser exception.
+
+## Click post-condition diagnostic boundary
+
+W3C WebDriver Get Element Text returns rendered element text. That value is page-controlled data. The compatibility runner compares the fixture output against the exact expected `clicked` token and, on mismatch, retains only the classified message `real click post-condition mismatch`. Raw element text must not enter exception text or trial evidence.
+
 ## Update-migration evidence boundary
 
 Restart persistence and extension update migration are separate compatibility claims. A successful restart proves only that state survives a new browser process. The active update-migration lane additionally uses a trial-local copy of the checked-in fixture, preserves the same extension path and ephemeral profile across passes, changes only the controlled manifest version from `1.0.0` to `1.0.1`, observes `chrome.runtime.getManifest().version`, and requires the fixture schema marker to migrate from version 1 to version 2. The checked-in fixture is not rewritten by the test. This establishes one deterministic unpacked-extension version transition; it does not establish Chrome Web Store update behavior, enterprise rollout semantics, downgrade behavior, or arbitrary third-party extension migration safety.
@@ -60,6 +76,10 @@ Chrome for Developers. (2023, May 2). *The extension service worker lifecycle*.
 
 Chrome for Developers. (n.d.). *chrome.declarativeNetRequest*. Google. Retrieved August 9, 2026, from https://developer.chrome.com/docs/extensions/reference/api/declarativeNetRequest
 
+Chrome for Developers. (n.d.). *chrome.bookmarks*. Google. Retrieved August 16, 2026, from https://developer.chrome.com/docs/extensions/reference/api/bookmarks
+
+Chrome for Developers. (n.d.). *chrome.downloads*. Google. Retrieved August 16, 2026, from https://developer.chrome.com/docs/extensions/reference/api/downloads
+
 Chrome for Developers. (n.d.). *chrome.history*. Google. Retrieved August 11, 2026, from https://developer.chrome.com/docs/extensions/reference/api/history
 
 Chrome for Developers. (n.d.). *Manifest file format*. Google. Retrieved August 9, 2026, from https://developer.chrome.com/docs/extensions/reference/manifest
@@ -67,3 +87,7 @@ Chrome for Developers. (n.d.). *Manifest file format*. Google. Retrieved August
 Bynens, M. (2023, June 12). *Chrome for Testing*. Chrome for Developers. https://developer.chrome.com/docs/automation-and-testing/chrome-for-testing
 
 Google Chrome Labs. (2026, July 21). *Chrome for Testing availability*. https://googlechromelabs.github.io/chrome-for-testing/
+
+Fielding, R., Nottingham, M., & Reschke, J. (Eds.). (2022). *HTTP/1.1* (RFC 9112). Internet Engineering Task Force. https://doi.org/10.17487/RFC9112
+
+World Wide Web Consortium. (2018, June 5). *WebDriver* (W3C Recommendation). https://www.w3.org/TR/2018/REC-webdriver1-20180605/
diff --git a/docs/evidence/2026-08-10-active-pr-maturity.md b/docs/evidence/2026-08-10-active-pr-maturity.md
index 71353dca2..e9d3868f4 100644
--- a/docs/evidence/2026-08-10-active-pr-maturity.md
+++ b/docs/evidence/2026-08-10-active-pr-maturity.md
@@ -31,7 +31,7 @@ This dated appendix records volatile implementation evidence that must not be em
 | #53 | Authoritative in-process sensitive-handle revocation state | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #46 at exact head `86ce4bc1c11c270dc532593d673c42bd6f623d74`; CI and CodeRabbit are green. It adds typed first-revocation-wins state but no durable broker, cross-process transactionality, protected-value resolution, KMS, or persistence. |
 | #54 | Recheck resolution freshness at socket use | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #50 at exact head `ec81031c537f2b662910c1ce78c7ae0e0bfc9c1e`; CI and CodeRabbit are green. `connect_at` revalidates freshness immediately before socket I/O and the compatibility path derives elapsed monotonic time; no resolver, DNS lookup, proxy/PAC or wall-clock authority is added. |
 | #55 | Bind opaque sensitive-value handle use to a non-transferable audience | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on exact #53 head `86ce4bc1c11c270dc532593d673c42bd6f623d74`. Test-only head `95f0f1e418024f5dbe7aa613e5fd1e9d88a9417a` and CI run `31419991170` proved a real regression: audience binding had caused a revoked handle with later mismatched policy state to return `ScopeMismatch` instead of authoritative `Revoked`. Current exact head `8d3ccf0a3b99fd9789210dd9798b422431fab7d8` restores revocation precedence, retains audience binding, and adds a synchronized one-use concurrency regression. CI run `31421061134` passes repository contracts, rustfmt, locked workspace check, all workspace tests, strict Clippy, rustdoc and exact owned production function/line/region/branch coverage; CodeRabbit exact-head status is success. A future trusted broker must still derive the audience from authenticated workload/service identity. |
-| #56 | Real pinned-Chromium bookmark mutation compatibility | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #43. Exact head `e1099e35ac000c7bf87ea75666cfdd928a386370` aligns the fixture and repository contracts with the bounded create → get → remove bookmark lifecycle; CI run `31427219564`, Manifest V3 Compatibility run `31427220684`, and CodeRabbit exact-head status all succeed. This is compatibility evidence only: it grants no OriginWeave Agent capability and does not complete issue #27's full extension matrix. |
+| #56 | Real pinned-Chromium bookmark mutation compatibility | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #43. Exact head `82403ecac1d9395871b6b05df150c47a8bbbc749` aligns the fixture and repository contracts with the bounded create → get → remove bookmark lifecycle; CI run `31959457551` includes a successful pinned-Chromium MV3 fixture job. Successor work on this lane adds allow-listed bookmark stage diagnostics so raw Chrome errors cannot enter runner evidence. This is compatibility evidence only: it grants no OriginWeave Agent capability and does not complete issue #27's full extension matrix. |
 | #57 | Typed semantic-node query over bounded observation evidence | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on exact #52 head `94fd284fe41746eeba9edc05d9753903b1c41ebf`. Test-only head `d0cd133f5be62fff99612d5b08aa4cf08ce2f29f` and CI run `31429065905` intentionally proved the missing public query boundary by failing compilation on absent `SemanticNodeQuery`/`SemanticNodeQueryError`. Current exact head `b4fa49953cbbb21c879a3340e264a6e132e41634` implements bounded exact role, accessible-name and typed-action selection against already validated `SemanticNodeObservation` values, with no CSS/XPath/raw DOM selector language, arbitrary JavaScript, browser I/O or action authority. CI run `31429995885`, Manifest V3 Compatibility run `31429997851`, and CodeRabbit exact-head status succeed. The PR remains Draft because #52/#40 are active prerequisites. |
 | #58 | Authority-bound semantic-node action target | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #57. Current exact head `efe440c7a609cac187faacfa03a4df904a99386f` accepts only an advertised `NodeActionKind`, carries the exact OriginWeave-owned node handle, and delegates immediate-use session/context/origin/document-epoch validation to the browser authority boundary. CI run `31431277478`, Manifest V3 Compatibility run `31431277521`, and CodeRabbit exact-head status succeed. This remains descriptive execution input, not policy authorization, business-risk classification, browser I/O or action success. |
 | #59 | Real pinned-Chromium history mutation compatibility | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #56. Test-only head `4b5f393a7420541723a07243b83cdaa7e28948de` and CI run `31432051381` established the intended repository-contract RED because controlled `history.addUrl`/`deleteUrl` lifecycle support was absent. Current exact head `b0d9c905fd7a50128eb1dde643b8a3a0f9cb1dc8` adds loopback-only add → exact readback → delete → absence verification. CI run `31432338572`, Manifest V3 Compatibility run `31432338759`, and CodeRabbit exact-head status succeed, including exact owned production function/line/region/branch coverage. Compatibility evidence only; no Agent history capability. |
diff --git a/docs/traceability/README.md b/docs/traceability/README.md
index e30b9eda1..edb8a04aa 100644
--- a/docs/traceability/README.md
+++ b/docs/traceability/README.md
@@ -69,7 +69,7 @@ ADR lifecycle is separate and remains `Proposed`, `Accepted`, `Superseded`, `Dep
 | Human interaction outranks inference/background collection | PARTIAL | `ARCHITECTURE.md`; PRD-RES-002 | Deterministic resource mitigation/CPU-worker admission foundations exist; platform telemetry/actuation remain Planned |
 | Structured observation precedes raw HTML/screenshot fallback | ACCEPTED_ARCHITECTURE | PRD-OBS-003; TRD Section 7 | Active PR #52 supplies a non-shipped bounded semantic value primitive; real browser observation and fallback adapters remain Planned |
 | WebDriver BiDi / CDP / WebMCP / MCP are adapters, not internal authority | ACCEPTED_ARCHITECTURE | PRD Section 9.8; TRD Section 12 | Protocol adapter implementation remains Planned/active under issue #28; active PR #40 may not be called shipped |
-| Manifest V3 compatibility is preserved upstream where practical | PARTIAL | ADR 0001; issue #27; Proposed ADR 0013 | Protected main has pinned real-Chromium compatibility evidence for service worker/content script/storage/DNR/tabs/windows/scripting/commands/side panel/bookmarks/history/restart/repeatability; active PR #43 adds real bounded downloads evidence; full issue #27 matrix remains incomplete |
+| Manifest V3 compatibility is preserved upstream where practical | PARTIAL | ADR 0001; issue #27; Proposed ADR 0013 | Protected main has pinned real-Chromium compatibility evidence for service worker/content script/storage/DNR/tabs/windows/scripting/commands/side panel/bookmarks/history/restart/repeatability; active PR #43 adds real bounded downloads evidence; active PR #56 adds bookmark mutation with allow-listed stage diagnostics; full issue #27 matrix remains incomplete |
 | Extension permission does not imply OriginWeave Agent capability | PARTIAL | protected-main extension authority kernel; Proposed ADR 0013 | Core extension-to-Agent authority isolation exists on protected main; complete managed-extension/native-messaging/enterprise release policy remains incomplete |
 | WARC/PROV-oriented durable evidence adapters | PLANNED | ADR 0003; PRD-EVD-005 | Source/provenance kernel foundation exists; persistence/export adapters remain Planned |
 | Origin Map visualizes value/action provenance | PLANNED | PRD-EVD-004; this traceability record | No shipped UI claim |
diff --git a/scripts/ci/run_mv3_compatibility.py b/scripts/ci/run_mv3_compatibility.py
old mode 100755
new mode 100644
index eb143a550..8661e430f
--- a/scripts/ci/run_mv3_compatibility.py
+++ b/scripts/ci/run_mv3_compatibility.py
@@ -29,6 +29,12 @@
 FIXTURE = ROOT / "tests" / "fixtures" / "mv3_basic"
 PINNED_CHROME_VERSION = "150.0.7871.129"
 PINNED_CHROME_REVISION = "r1639810"
+PINNED_CHROME_RELATIVE_PATH = pathlib.PurePosixPath(
+    ".mv3-browser/chrome-linux64/chrome"
+)
+PINNED_CHROMEDRIVER_RELATIVE_PATH = pathlib.PurePosixPath(
+    ".mv3-browser/chromedriver-linux64/chromedriver"
+)
 INITIAL_EXTENSION_VERSION = "1.0.0"
 UPDATED_EXTENSION_VERSION = "1.0.1"
 REPEATABILITY_TRIALS = 3
@@ -55,6 +61,7 @@
     "commands",
     "sidePanel",
     "bookmarks",
+    "bookmarksDiagnostic",
     "history",
     "downloads",
     "downloadsDiagnostic",
@@ -87,6 +94,19 @@
         "download-not-evaluated",
     }
 )
+BOOKMARK_DIAGNOSTIC_VALUES = frozenset(
+    {
+        "bookmark-source-rejected",
+        "bookmark-create-rejected",
+        "bookmark-get-missing",
+        "bookmark-id-mismatch",
+        "bookmark-title-mismatch",
+        "bookmark-url-mismatch",
+        "bookmark-remove-rejected",
+        "bookmark-complete-ready",
+        "bookmark-not-evaluated",
+    }
+)
 EXTENSION_VERSION_EVIDENCE_VALUES = frozenset(
     {INITIAL_EXTENSION_VERSION, UPDATED_EXTENSION_VERSION, "missing"}
 )
@@ -122,6 +142,8 @@ def _safe_surface_value(key: str, value: str) -> str:
         return value if value.isdecimal() and len(value) <= 20 else "invalid"
     if key == "downloadsDiagnostic":
         return value if value in DOWNLOAD_DIAGNOSTIC_VALUES else "unexpected"
+    if key == "bookmarksDiagnostic":
+        return value if value in BOOKMARK_DIAGNOSTIC_VALUES else "unexpected"
     if key == "extensionVersion":
         return value if value in EXTENSION_VERSION_EVIDENCE_VALUES else "unexpected"
     return value if value in SURFACE_EVIDENCE_VALUES else "unexpected"
@@ -181,7 +203,13 @@ def _json_request(
     *,
     timeout: float = REQUEST_TIMEOUT_SECONDS,
 ) -> dict[str, Any]:
-    """Issue one bounded JSON request to the fixed loopback ChromeDriver authority."""
+    """Issue one bounded JSON request to the fixed loopback ChromeDriver authority.
+
+    Recoverable HTTP/1.1 parser failures, including a malformed status-line or an
+    incomplete message body, become `RuntimeError("WebDriver transport protocol
+    failure")` so trial evidence can record a classified outcome without retaining
+    raw transport text.
+    """
 
     if not 1 <= driver_port <= 65_535:
         raise ValueError("invalid ChromeDriver port")
@@ -193,19 +221,21 @@ def _json_request(
     body = None if payload is None else json.dumps(payload).encode("utf-8")
     connection = http.client.HTTPConnection("127.0.0.1", driver_port, timeout=timeout)
     try:
-        connection.request(
-            method,
-            path,
-            body=body,
-            headers={"Content-Type": "application/json"},
-        )
-        response = connection.getresponse()
-        raw = response.read(MAX_WEBDRIVER_RESPONSE_BYTES + 1)
+        try:
+            connection.request(
+                method,
+                path,
+                body=body,
+                headers={"Content-Type": "application/json"},
+            )
+            response = connection.getresponse()
+            raw = response.read(MAX_WEBDRIVER_RESPONSE_BYTES + 1)
+        except http.client.HTTPException:
+            raise RuntimeError("WebDriver transport protocol failure") from None
         if len(raw) > MAX_WEBDRIVER_RESPONSE_BYTES:
             raise RuntimeError("WebDriver response exceeded the bounded JSON limit")
         if response.status >= 400:
-            detail = raw.decode("utf-8", errors="replace")
-            raise RuntimeError(f"WebDriver HTTP {response.status}: {detail}")
+            raise RuntimeError(f"WebDriver HTTP {response.status} error")
     finally:
         connection.close()
 
@@ -214,24 +244,24 @@ def _json_request(
         raise RuntimeError("WebDriver returned a non-object JSON payload")
     value = decoded.get("value")
     if isinstance(value, dict) and value.get("error"):
-        raise RuntimeError(f"WebDriver error: {value.get('error')}: {value.get('message')}")
+        raise RuntimeError("WebDriver returned a protocol error")
     return decoded
 
 
 def _wait_for_driver(driver_port: int) -> None:
-    """Wait for the exact local ChromeDriver process to become ready."""
+    """Wait for local ChromeDriver readiness while retaining only a safe failure class."""
 
     deadline = time.monotonic() + STARTUP_TIMEOUT_SECONDS
-    last_error: Exception | None = None
+    last_failure_kind = "not_observed"
     while time.monotonic() < deadline:
         try:
             status = _json_request(driver_port, "GET", "/status", timeout=1.0)
             if status.get("value", {}).get("ready") is True:
                 return
         except (OSError, ValueError, RuntimeError, json.JSONDecodeError) as exc:
-            last_error = exc
+            last_failure_kind = str(_failure_evidence(exc)["failure_kind"])
         time.sleep(0.1)
-    raise RuntimeError(f"ChromeDriver did not become ready: {last_error}")
+    raise RuntimeError(f"ChromeDriver did not become ready ({last_failure_kind})")
 
 
 def _execute(driver_port: int, session_id: str, script: str) -> Any:
@@ -287,6 +317,8 @@ def _wait_for_extension_evidence(
   commands: document.documentElement.dataset.originweaveCommands || "missing",
   sidePanel: document.documentElement.dataset.originweaveSidePanel || "missing",
   bookmarks: document.documentElement.dataset.originweaveBookmarks || "missing",
+  bookmarksDiagnostic:
+    document.documentElement.dataset.originweaveBookmarksDiagnostic || "bookmark-not-evaluated",
   history: document.documentElement.dataset.originweaveHistory || "missing",
   downloads: document.documentElement.dataset.originweaveDownloads || "missing",
   downloadsDiagnostic:
@@ -309,6 +341,7 @@ def _wait_for_extension_evidence(
         "commands": "ready",
         "sidePanel": "ready",
         "bookmarks": "ready",
+        "bookmarksDiagnostic": "bookmark-complete-ready",
         "history": "ready",
         "downloads": "ready",
         "downloadsDiagnostic": "download-complete-ready",
@@ -332,7 +365,7 @@ def _wait_for_extension_evidence(
 
 
 def _exercise_real_click(driver_port: int, session_id: str) -> str:
-    """Use the WebDriver element-click command and verify the DOM post-condition."""
+    """Use the WebDriver element-click command and classify DOM post-condition mismatches."""
 
     found = _json_request(
         driver_port,
@@ -367,7 +400,7 @@ def _exercise_real_click(driver_port: int, session_id: str) -> str:
         _webdriver_path(session_id, f"/element/{safe_output}/text"),
     ).get("value")
     if text != "clicked":
-        raise RuntimeError(f"real click post-condition failed: {text!r}")
+        raise RuntimeError("real click post-condition mismatch")
     return str(text)
 
 
@@ -397,6 +430,34 @@ def _set_fixture_version(extension_dir: pathlib.Path, version: str) -> None:
     )
 
 
+def _teardown_driver_process(driver: subprocess.Popen[str]) -> Exception | None:
+    """Best-effort reap ChromeDriver while preserving reviewed process failures."""
+
+    try:
+        driver.terminate()
+    except OSError as terminate_error:
+        try:
+            driver.kill()
+            driver.wait(timeout=5)
+        except (OSError, subprocess.TimeoutExpired) as fallback_error:
+            terminate_error.add_note(
+                "bounded ChromeDriver kill fallback also failed: "
+                f"{type(fallback_error).__name__}"
+            )
+        return terminate_error
+
+    try:
+        driver.wait(timeout=5)
+        return None
+    except subprocess.TimeoutExpired:
+        try:
+            driver.kill()
+            driver.wait(timeout=5)
+        except (OSError, subprocess.TimeoutExpired) as fallback_error:
+            return fallback_error
+        return None
+
+
 def _run_browser_pass(
     chrome_bin: pathlib.Path,
     chromedriver_bin: pathlib.Path,
@@ -465,8 +526,7 @@ def _run_browser_pass(
         )
         if browser_version != PINNED_CHROME_VERSION:
             raise RuntimeError(
-                f"unexpected Chrome version: expected {PINNED_CHROME_VERSION}, "
-                f"got {browser_version!r}"
+                f"unexpected Chrome version; expected {PINNED_CHROME_VERSION}"
             )
 
         _json_request(
@@ -521,16 +581,13 @@ def _run_browser_pass(
                 except (OSError, ValueError, RuntimeError, json.JSONDecodeError) as error:
                     cleanup_error = error
         finally:
-            driver.terminate()
-            try:
-                driver.wait(timeout=5)
-            except subprocess.TimeoutExpired:
-                driver.kill()
-                driver.wait(timeout=5)
+            teardown_error = _teardown_driver_process(driver)
         if cleanup_error is not None:
             raise WebDriverSessionCleanupError(
                 "WebDriver session cleanup failed after bounded process teardown"
             ) from cleanup_error
+        if teardown_error is not None:
+            raise teardown_error
 
 
 def _run_restart_trial(
@@ -638,15 +695,66 @@ def _run_restart_trial(
     }
 
 
+def _pinned_workspace_binary(
+    env_name: str,
+    relative_path: pathlib.PurePosixPath,
+    label: str,
+    *,
+    root: pathlib.Path = ROOT,
+) -> pathlib.Path:
+    """Authorize only the exact non-symlink executable provisioned under the workspace.
+
+    Environment variables remain compatibility inputs for the workflow, but they
+    cannot redirect execution. The release lane has one reviewed path for each
+    pinned Chrome-for-Testing artifact, and any other executable fails closed.
+    """
+
+    if relative_path.is_absolute() or ".." in relative_path.parts:
+        raise SystemExit(f"{label} pinned workspace path is invalid")
+
+    trusted_root = pathlib.Path(os.path.abspath(root))
+    expected = pathlib.Path(os.path.abspath(trusted_root.joinpath(*relative_path.parts)))
+    configured = os.environ.get(env_name)
+    if configured:
+        configured_path = pathlib.Path(configured)
+        if not configured_path.is_absolute():
+            raise SystemExit(f"{env_name} must name the pinned workspace executable")
+        if pathlib.Path(os.path.abspath(configured_path)) != expected:
+            raise SystemExit(f"{env_name} must name the pinned workspace executable")
+
+    current = expected
+    while current != trusted_root:
+        if current.is_symlink():
+            raise SystemExit(f"{label} pinned workspace executable path contains a symlink")
+        parent = current.parent
+        if parent == current:
+            raise SystemExit(f"{label} pinned workspace executable escaped the workspace")
+        current = parent
+
+    try:
+        expected.relative_to(trusted_root)
+    except ValueError as exc:
+        raise SystemExit(f"{label} pinned workspace executable escaped the workspace") from exc
+    if not expected.is_file():
+        raise SystemExit(f"{label} pinned workspace executable is missing")
+    if not os.access(expected, os.X_OK):
+        raise SystemExit(f"{label} pinned workspace executable is not executable")
+    return expected
+
+
 def main() -> int:
     """Run three independent restart/update trials and emit bounded repeatability evidence."""
 
-    chrome_bin = pathlib.Path(os.environ.get("CHROME_BIN", ""))
-    chromedriver_bin = pathlib.Path(os.environ.get("CHROMEDRIVER_BIN", ""))
-    if not chrome_bin.is_file():
-        raise SystemExit("CHROME_BIN must point to the pinned Chrome for Testing executable")
-    if not chromedriver_bin.is_file():
-        raise SystemExit("CHROMEDRIVER_BIN must point to the matching pinned ChromeDriver")
+    chrome_bin = _pinned_workspace_binary(
+        "CHROME_BIN",
+        PINNED_CHROME_RELATIVE_PATH,
+        "Chrome for Testing",
+    )
+    chromedriver_bin = _pinned_workspace_binary(
+        "CHROMEDRIVER_BIN",
+        PINNED_CHROMEDRIVER_RELATIVE_PATH,
+        "ChromeDriver",
+    )
     if not (FIXTURE / "manifest.json").is_file():
         raise SystemExit("MV3 fixture manifest is missing")
 
@@ -732,4 +840,4 @@ def main() -> int:
 
 
 if __name__ == "__main__":
-    raise SystemExit(main())
+    raise SystemExit(main())
\ No newline at end of file
diff --git a/tests/fixtures/mv3_basic/content_script.js b/tests/fixtures/mv3_basic/content_script.js
index c9514779e..1bde75ed9 100644
--- a/tests/fixtures/mv3_basic/content_script.js
+++ b/tests/fixtures/mv3_basic/content_script.js
@@ -1,13 +1,7 @@
 "use strict";
 
 (async () => {
-  window.originweaveWorldSentinel = "extension";
-  await new Promise((resolve) => setTimeout(resolve, 75));
-  const pageWorldSentinel = document.documentElement.dataset.originweavePageWorld;
-  document.documentElement.dataset.originweaveContentScript =
-    window.originweaveWorldSentinel === "extension" && pageWorldSentinel === "page"
-      ? "ready"
-      : "missing";
+  document.documentElement.dataset.originweaveContentScript = "ready";
 
   const previous = await chrome.storage.local.get("originweave_content");
   const storagePersisted = previous.originweave_content === "ready";
@@ -36,6 +30,8 @@
   document.documentElement.dataset.originweaveCommands = response?.commands ?? "missing";
   document.documentElement.dataset.originweaveSidePanel = response?.sidePanel ?? "missing";
   document.documentElement.dataset.originweaveBookmarks = response?.bookmarks ?? "missing";
+  document.documentElement.dataset.originweaveBookmarksDiagnostic =
+    response?.bookmarksDiagnostic ?? "bookmark-not-evaluated";
   document.documentElement.dataset.originweaveHistory = response?.history ?? "missing";
   document.documentElement.dataset.originweaveDownloads = response?.downloads ?? "missing";
   document.documentElement.dataset.originweaveDownloadsDiagnostic =
diff --git a/tests/fixtures/mv3_basic/service_worker.js b/tests/fixtures/mv3_basic/service_worker.js
index fa06d0b28..995fc6b9b 100644
--- a/tests/fixtures/mv3_basic/service_worker.js
+++ b/tests/fixtures/mv3_basic/service_worker.js
@@ -139,14 +139,14 @@ async function exerciseDownload(sender) {
 async function exerciseBookmarkMutation(sender) {
   const sourceUrl = sender?.tab?.url;
   if (typeof sourceUrl !== "string") {
-    return false;
+    return { ready: false, diagnostic: "bookmark-source-rejected" };
   }
 
   let parsed;
   try {
     parsed = new URL(sourceUrl);
   } catch (_error) {
-    return false;
+    return { ready: false, diagnostic: "bookmark-source-rejected" };
   }
   if (
     parsed.protocol !== "http:" ||
@@ -155,40 +155,50 @@ async function exerciseBookmarkMutation(sender) {
     parsed.username !== "" ||
     parsed.password !== ""
   ) {
-    return false;
+    return { ready: false, diagnostic: "bookmark-source-rejected" };
   }
 
   const title = "OriginWeave MV3 compatibility bookmark";
   let bookmarkId;
   try {
     const created = await chrome.bookmarks.create({ title, url: sourceUrl });
-    if (typeof created?.id !== "string" || created.id.length === 0) {
-      return false;
+    const createdId = created?.id;
+    if (typeof createdId !== "string" || createdId.length === 0) {
+      return { ready: false, diagnostic: "bookmark-create-rejected" };
     }
-    bookmarkId = created.id;
+    bookmarkId = createdId;
   } catch (_error) {
-    return false;
+    return { ready: false, diagnostic: "bookmark-create-rejected" };
   }
 
+  let diagnostic = "bookmark-get-missing";
   let bookmarkMutationReady = false;
   try {
     const nodes = await chrome.bookmarks.get(bookmarkId);
-    bookmarkMutationReady =
-      Array.isArray(nodes) &&
-      nodes.length === 1 &&
-      nodes[0]?.id === bookmarkId &&
-      nodes[0]?.title === title &&
-      nodes[0]?.url === sourceUrl;
+    if (!Array.isArray(nodes) || nodes.length !== 1) {
+      diagnostic = "bookmark-get-missing";
+    } else if (nodes[0]?.id !== bookmarkId) {
+      diagnostic = "bookmark-id-mismatch";
+    } else if (nodes[0]?.title !== title) {
+      diagnostic = "bookmark-title-mismatch";
+    } else if (nodes[0]?.url !== sourceUrl) {
+      diagnostic = "bookmark-url-mismatch";
+    } else {
+      diagnostic = "bookmark-complete-ready";
+      bookmarkMutationReady = true;
+    }
   } catch (_error) {
+    diagnostic = "bookmark-get-missing";
     bookmarkMutationReady = false;
   } finally {
     try {
       await chrome.bookmarks.remove(bookmarkId);
     } catch (_error) {
+      diagnostic = "bookmark-remove-rejected";
       bookmarkMutationReady = false;
     }
   }
-  return bookmarkMutationReady;
+  return { ready: bookmarkMutationReady, diagnostic };
 }
 
 async function exerciseHistoryMutation(sender) {
@@ -277,8 +287,8 @@ async function exerciseCoreApis(sender) {
   const sidePanelOptions = await chrome.sidePanel.getOptions({ tabId });
   const sidePanelReady = sidePanelOptions?.path === "side_panel.html";
 
-  const bookmarkMutationReady = await exerciseBookmarkMutation(sender);
-  const bookmarksReady = bookmarkMutationReady;
+  const bookmarkResult = await exerciseBookmarkMutation(sender);
+  const bookmarksReady = bookmarkResult.ready;
 
   const historyMutationReady = await exerciseHistoryMutation(sender);
   const historyReady = historyMutationReady;
@@ -293,6 +303,7 @@ async function exerciseCoreApis(sender) {
     commands: commandsReady ? "ready" : "missing",
     sidePanel: sidePanelReady ? "ready" : "missing",
     bookmarks: bookmarksReady ? "ready" : "missing",
+    bookmarksDiagnostic: bookmarkResult.diagnostic,
     history: historyReady ? "ready" : "missing",
     downloads: downloadsReady ? "ready" : "missing",
     downloadsDiagnostic: downloadResult.diagnostic,
@@ -336,6 +347,7 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
         commands: "missing",
         sidePanel: "missing",
         bookmarks: "missing",
+        bookmarksDiagnostic: "bookmark-not-evaluated",
         history: "missing",
         downloads: "missing",
         downloadsDiagnostic: "download-not-evaluated",
diff --git a/tests/test_mv3_binary_authority_contract.py b/tests/test_mv3_binary_authority_contract.py
new file mode 100644
index 000000000..68fedbf9f
--- /dev/null
+++ b/tests/test_mv3_binary_authority_contract.py
@@ -0,0 +1,108 @@
+"""Security contract for pinned Manifest V3 browser executable authority."""
+
+from __future__ import annotations
+
+import os
+import pathlib
+import runpy
+import tempfile
+import unittest
+import unittest.mock
+
+ROOT = pathlib.Path(__file__).resolve().parents[1]
+RUNNER = ROOT / "scripts" / "ci" / "run_mv3_compatibility.py"
+
+
+class ManifestV3BinaryAuthorityContractTests(unittest.TestCase):
+    """Prevent environment variables from selecting arbitrary executable code."""
+
+    def setUp(self) -> None:
+        """Load the production runner without executing its command-line entrypoint."""
+
+        self.namespace = runpy.run_path(str(RUNNER), run_name="mv3_binary_authority")
+        self.validate = self.namespace["_pinned_workspace_binary"]
+
+    @staticmethod
+    def _make_executable(path: pathlib.Path) -> None:
+        """Create one inert executable fixture without ever executing it."""
+
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text("#!/bin/sh\nexit 0\n", encoding="utf-8")
+        path.chmod(0o755)
+
+    def test_untrusted_environment_override_is_rejected_before_execution(self) -> None:
+        """An existing executable outside the pinned workspace path must fail closed."""
+
+        with tempfile.TemporaryDirectory(prefix="originweave-binary-authority-") as temp_dir:
+            root = pathlib.Path(temp_dir)
+            expected = root / ".mv3-browser" / "chromedriver-linux64" / "chromedriver"
+            attacker = root / "attacker-controlled" / "chromedriver"
+            self._make_executable(expected)
+            self._make_executable(attacker)
+
+            with unittest.mock.patch.dict(
+                os.environ,
+                {"CHROMEDRIVER_BIN": str(attacker)},
+                clear=False,
+            ):
+                with self.assertRaisesRegex(SystemExit, "pinned workspace executable"):
+                    self.validate(
+                        "CHROMEDRIVER_BIN",
+                        pathlib.PurePosixPath(
+                            ".mv3-browser/chromedriver-linux64/chromedriver"
+                        ),
+                        "ChromeDriver",
+                        root=root,
+                    )
+
+    def test_exact_pinned_workspace_executable_is_accepted(self) -> None:
+        """The exact executable provisioned by the pinned workflow remains usable."""
+
+        with tempfile.TemporaryDirectory(prefix="originweave-binary-authority-") as temp_dir:
+            root = pathlib.Path(temp_dir)
+            expected = root / ".mv3-browser" / "chrome-linux64" / "chrome"
+            self._make_executable(expected)
+
+            with unittest.mock.patch.dict(
+                os.environ,
+                {"CHROME_BIN": str(expected)},
+                clear=False,
+            ):
+                actual = self.validate(
+                    "CHROME_BIN",
+                    pathlib.PurePosixPath(".mv3-browser/chrome-linux64/chrome"),
+                    "Chrome for Testing",
+                    root=root,
+                )
+
+            self.assertEqual(actual, expected)
+
+    def test_symlink_at_pinned_executable_path_is_rejected(self) -> None:
+        """A matching pathname must not authorize a symlink to foreign executable code."""
+
+        with tempfile.TemporaryDirectory(prefix="originweave-binary-authority-") as temp_dir:
+            root = pathlib.Path(temp_dir)
+            expected = root / ".mv3-browser" / "chromedriver-linux64" / "chromedriver"
+            attacker = root / "attacker-controlled" / "chromedriver"
+            self._make_executable(attacker)
+            expected.parent.mkdir(parents=True, exist_ok=True)
+            expected.symlink_to(attacker)
+
+            with unittest.mock.patch.dict(
+                os.environ,
+                {"CHROMEDRIVER_BIN": str(expected)},
+                clear=False,
+            ):
+                with self.assertRaisesRegex(SystemExit, "symlink"):
+                    self.validate(
+                        "CHROMEDRIVER_BIN",
+                        pathlib.PurePosixPath(
+                            ".mv3-browser/chromedriver-linux64/chromedriver"
+                        ),
+                        "ChromeDriver",
+                        root=root,
+                    )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_mv3_bookmark_mutation_contract.py b/tests/test_mv3_bookmark_mutation_contract.py
index 4c121b19f..c5e41f752 100644
--- a/tests/test_mv3_bookmark_mutation_contract.py
+++ b/tests/test_mv3_bookmark_mutation_contract.py
@@ -2,12 +2,27 @@
 
 from __future__ import annotations
 
+import importlib.util
 import json
 import pathlib
 import unittest
 
 ROOT = pathlib.Path(__file__).resolve().parents[1]
 FIXTURE = ROOT / "tests" / "fixtures" / "mv3_basic"
+RUNNER = ROOT / "scripts" / "ci" / "run_mv3_compatibility.py"
+DOCTORING = ROOT / "docs" / "doctoring" / "mv3-compatibility.md"
+ROOT_DOCTORING = ROOT / "docs" / "doctoring.md"
+
+
+def _load_runner_module():
+    """Load the compatibility runner without invoking its command-line entry point."""
+
+    spec = importlib.util.spec_from_file_location("originweave_mv3_runner", RUNNER)
+    if spec is None or spec.loader is None:
+        raise AssertionError("unable to load the MV3 compatibility runner")
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
 
 
 class ManifestV3BookmarkMutationContractTests(unittest.TestCase):
@@ -50,6 +65,112 @@ def test_bookmark_mutation_is_bound_to_controlled_fixture_url_and_cleanup(self)
         self.assertNotIn("_error.message", worker)
         self.assertNotIn("String(_error)", worker)
 
+    def test_bookmark_failures_emit_only_bounded_stage_diagnostics(self) -> None:
+        """Fixture diagnostics must name a reviewed stage without retaining raw browser errors."""
+
+        worker = (FIXTURE / "service_worker.js").read_text(encoding="utf-8")
+        content = (FIXTURE / "content_script.js").read_text(encoding="utf-8")
+        for expected in (
+            "bookmark-source-rejected",
+            "bookmark-create-rejected",
+            "bookmark-get-missing",
+            "bookmark-id-mismatch",
+            "bookmark-title-mismatch",
+            "bookmark-url-mismatch",
+            "bookmark-remove-rejected",
+            "bookmark-complete-ready",
+            "bookmarksDiagnostic",
+        ):
+            with self.subTest(expected=expected):
+                self.assertIn(expected, worker)
+        self.assertIn("originweaveBookmarksDiagnostic", content)
+        self.assertNotIn("created.id", worker)
+        self.assertNotIn("nodes[0].url", worker)
+        self.assertNotIn("_error.message", worker)
+        self.assertNotIn("String(_error)", worker)
+
+    def test_content_script_and_runner_require_bookmark_diagnostics_on_every_pass(self) -> None:
+        """The compatibility report must retain a classified bookmark stage on every trial."""
+
+        content = (FIXTURE / "content_script.js").read_text(encoding="utf-8")
+        runner = RUNNER.read_text(encoding="utf-8")
+        self.assertIn("originweaveBookmarks", content)
+        self.assertIn("originweaveBookmarksDiagnostic", content)
+        self.assertIn('"bookmarks": surfaces["bookmarks"] == "ready"', runner)
+        self.assertIn('"bookmarksDiagnostic": "bookmark-complete-ready"', runner)
+
+    def test_runner_preserves_only_reviewed_bookmark_diagnostic_tokens(self) -> None:
+        """Runner failure evidence must retain stage tokens while rejecting raw diagnostics."""
+
+        runner = _load_runner_module()
+        approved = {
+            "bookmark-source-rejected",
+            "bookmark-create-rejected",
+            "bookmark-get-missing",
+            "bookmark-id-mismatch",
+            "bookmark-title-mismatch",
+            "bookmark-url-mismatch",
+            "bookmark-remove-rejected",
+            "bookmark-complete-ready",
+            "bookmark-not-evaluated",
+        }
+        self.assertIn("bookmarksDiagnostic", runner.SURFACE_EVIDENCE_KEYS)
+        self.assertEqual(runner.BOOKMARK_DIAGNOSTIC_VALUES, frozenset(approved))
+        for token in approved:
+            with self.subTest(token=token):
+                self.assertEqual(
+                    runner._safe_surface_value("bookmarksDiagnostic", token), token
+                )
+
+        approved_error = runner.CompatibilitySurfaceError(
+            {
+                "bookmarks": "missing",
+                "bookmarksDiagnostic": "bookmark-source-rejected",
+            }
+        )
+        approved_evidence = runner._failure_evidence(approved_error)
+        self.assertEqual(
+            approved_evidence["observed"]["bookmarksDiagnostic"],
+            "bookmark-source-rejected",
+        )
+
+        raw_bookmark_title = "OriginWeave MV3 compatibility bookmark"
+        raw_browser_error = "Error: secret bookmark failure"
+        for raw in (raw_bookmark_title, raw_browser_error):
+            with self.subTest(raw=raw):
+                error = runner.CompatibilitySurfaceError(
+                    {
+                        "bookmarks": "missing",
+                        "bookmarksDiagnostic": raw,
+                    }
+                )
+                evidence = runner._failure_evidence(error)
+                self.assertEqual(
+                    evidence["observed"]["bookmarksDiagnostic"], "unexpected"
+                )
+                self.assertNotIn(raw, repr(evidence))
+
+    def test_doctoring_records_bookmarks_api_primary_citation(self) -> None:
+        """The living Chrome Bookmarks API reference must stay distinct from Agent authority."""
+
+        doctoring = DOCTORING.read_text(encoding="utf-8")
+        root_doctoring = ROOT_DOCTORING.read_text(encoding="utf-8")
+        changelog = (ROOT / "CHANGELOG.md").read_text(encoding="utf-8")
+        for expected in (
+            "chrome.bookmarks",
+            "https://developer.chrome.com/docs/extensions/reference/api/bookmarks",
+            "allow-listed stage diagnostics",
+            "no Agent bookmark capability",
+        ):
+            with self.subTest(expected=expected):
+                self.assertIn(expected, doctoring)
+        self.assertIn("*chrome.bookmarks*", root_doctoring)
+        self.assertIn(
+            "https://developer.chrome.com/docs/extensions/reference/api/bookmarks",
+            root_doctoring,
+        )
+        self.assertIn("chrome.bookmarks", changelog)
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/test_mv3_browser_version_diagnostic_contract.py b/tests/test_mv3_browser_version_diagnostic_contract.py
new file mode 100644
index 000000000..c79da5ac8
--- /dev/null
+++ b/tests/test_mv3_browser_version_diagnostic_contract.py
@@ -0,0 +1,110 @@
+"""Regression contract for classified Chrome capability version diagnostics."""
+
+from __future__ import annotations
+
+import pathlib
+import runpy
+import tempfile
+import unittest
+import unittest.mock
+
+ROOT = pathlib.Path(__file__).resolve().parents[1]
+RUNNER = ROOT / "scripts" / "ci" / "run_mv3_compatibility.py"
+
+
+class _FakeDriver:
+    """Model bounded ChromeDriver process cleanup without launching a process."""
+
+    def __init__(self) -> None:
+        self.terminated = False
+
+    def terminate(self) -> None:
+        """Record graceful teardown."""
+
+        self.terminated = True
+
+    def kill(self) -> None:
+        """Fail if the normal teardown unexpectedly needs hard-kill fallback."""
+
+        raise AssertionError("unexpected ChromeDriver hard-kill fallback")
+
+    def wait(self, timeout: float) -> int:
+        """Model an immediately reaped ChromeDriver process."""
+
+        if timeout <= 0:
+            raise AssertionError("timeout must remain positive")
+        return 0
+
+
+class ManifestV3BrowserVersionDiagnosticTests(unittest.TestCase):
+    """Keep browser-reported capability text out of runner diagnostics."""
+
+    def test_browser_version_mismatch_does_not_retain_raw_capability_text(self) -> None:
+        """An unexpected browser version must fail closed with a classified safe message."""
+
+        namespace = runpy.run_path(str(RUNNER), run_name="mv3_browser_version_contract")
+        run_browser_pass = namespace["_run_browser_pass"]
+        globals_ = run_browser_pass.__globals__
+        fake_driver = _FakeDriver()
+        raw_version = "151.0 secret-token /home/runner/private https://example.invalid"
+
+        def fake_json_request(
+            _driver_port: int,
+            method: str,
+            path: str,
+            _payload=None,
+            *,
+            timeout: float = 5.0,
+        ):
+            if timeout <= 0:
+                raise AssertionError("timeout must remain positive")
+            if method == "POST" and path == "/session":
+                return {
+                    "value": {
+                        "sessionId": "session-1",
+                        "capabilities": {"browserVersion": raw_version},
+                    }
+                }
+            if method == "DELETE" and path.endswith("/session/session-1"):
+                return {"value": None}
+            raise AssertionError(f"unexpected WebDriver request: {method} {path}")
+
+        with tempfile.TemporaryDirectory(
+            prefix="originweave-browser-version-contract-"
+        ) as profile_dir:
+            with (
+                unittest.mock.patch.object(
+                    globals_["subprocess"], "Popen", return_value=fake_driver
+                ),
+                unittest.mock.patch.dict(
+                    globals_,
+                    {
+                        "_free_loopback_port": lambda: 43123,
+                        "_wait_for_driver": lambda _port: None,
+                        "_json_request": fake_json_request,
+                    },
+                ),
+            ):
+                with self.assertRaises(RuntimeError) as raised:
+                    run_browser_pass(
+                        pathlib.Path("/controlled/chrome"),
+                        pathlib.Path("/controlled/chromedriver"),
+                        "http://127.0.0.1:8080/page.html",
+                        profile_dir,
+                        "initialized",
+                    )
+
+        rendered = str(raised.exception)
+        self.assertEqual(
+            rendered,
+            f"unexpected Chrome version; expected {namespace['PINNED_CHROME_VERSION']}",
+        )
+        self.assertNotIn("secret-token", rendered)
+        self.assertNotIn("/home/runner/private", rendered)
+        self.assertNotIn("example.invalid", rendered)
+        self.assertIsNone(raised.exception.__cause__)
+        self.assertTrue(fake_driver.terminated)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_mv3_click_diagnostic_contract.py b/tests/test_mv3_click_diagnostic_contract.py
new file mode 100644
index 000000000..e0e28931a
--- /dev/null
+++ b/tests/test_mv3_click_diagnostic_contract.py
@@ -0,0 +1,48 @@
+"""Fail-closed contract for real-click diagnostic handling in the MV3 runner."""
+
+from __future__ import annotations
+
+import pathlib
+import runpy
+import unittest
+import unittest.mock
+
+ROOT = pathlib.Path(__file__).resolve().parents[1]
+RUNNER = ROOT / "scripts" / "ci" / "run_mv3_compatibility.py"
+
+
+class ManifestV3ClickDiagnosticContractTests(unittest.TestCase):
+    """Keep browser-controlled click postconditions out of exception text."""
+
+    def test_click_mismatch_does_not_retain_raw_browser_text(self) -> None:
+        """A failed click must classify the mismatch without copying page-controlled text."""
+
+        namespace = runpy.run_path(str(RUNNER), run_name="mv3_click_contract")
+        exercise = namespace["_exercise_real_click"]
+        element_key = namespace["W3C_ELEMENT_KEY"]
+        raw_text = "secret-token /home/runner/private https://example.invalid"
+        responses = iter(
+            (
+                {"value": {element_key: "f.1.d.2.e.3"}},
+                {"value": {}},
+                {"value": {element_key: "f.4.d.5.e.6"}},
+                {"value": raw_text},
+            )
+        )
+
+        with unittest.mock.patch.dict(
+            exercise.__globals__,
+            {"_json_request": unittest.mock.Mock(side_effect=lambda *_a, **_k: next(responses))},
+        ):
+            with self.assertRaises(RuntimeError) as raised:
+                exercise(9515, "session.1")
+
+        rendered = str(raised.exception)
+        self.assertEqual(rendered, "real click post-condition mismatch")
+        self.assertNotIn("secret-token", rendered)
+        self.assertNotIn("/home/runner/private", rendered)
+        self.assertNotIn("example.invalid", rendered)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_mv3_compatibility_contract.py b/tests/test_mv3_compatibility_contract.py
index 6c92afd4d..afa0d8511 100644
--- a/tests/test_mv3_compatibility_contract.py
+++ b/tests/test_mv3_compatibility_contract.py
@@ -6,6 +6,7 @@
 import pathlib
 import runpy
 import unittest
+import unittest.mock
 
 ROOT = pathlib.Path(__file__).resolve().parents[1]
 FIXTURE = ROOT / "tests" / "fixtures" / "mv3_basic"
@@ -179,6 +180,93 @@ def test_runner_preserves_safe_surface_failure_evidence(self) -> None:
         )
         self.assertEqual(generic, {"failure_kind": "runtime_error"})
 
+    def test_webdriver_errors_do_not_retain_raw_response_payloads(self) -> None:
+        """WebDriver protocol failures must stay useful without copying raw browser text."""
+
+        namespace = runpy.run_path(str(RUNNER), run_name="mv3_contract")
+        json_request = namespace["_json_request"]
+        http_module = namespace["http"]
+
+        class FakeResponse:
+            def __init__(self, status: int, body: bytes) -> None:
+                self.status = status
+                self.body = body
+
+            def read(self, _limit: int) -> bytes:
+                return self.body
+
+        class FakeConnection:
+            def __init__(self, response: FakeResponse) -> None:
+                self.response = response
+
+            def request(self, *_args: object, **_kwargs: object) -> None:
+                return None
+
+            def getresponse(self) -> FakeResponse:
+                return self.response
+
+            def close(self) -> None:
+                return None
+
+        raw_secret = "secret-token /home/runner/private https://example.invalid"
+        cases = (
+            FakeResponse(500, raw_secret.encode("utf-8")),
+            FakeResponse(
+                200,
+                json.dumps(
+                    {
+                        "value": {
+                            "error": "unknown error",
+                            "message": raw_secret,
+                        }
+                    }
+                ).encode("utf-8"),
+            ),
+        )
+        for response in cases:
+            with self.subTest(status=response.status):
+                with unittest.mock.patch.object(
+                    http_module.client,
+                    "HTTPConnection",
+                    return_value=FakeConnection(response),
+                ):
+                    with self.assertRaises(RuntimeError) as raised:
+                        json_request(9515, "GET", "/status")
+                rendered = str(raised.exception)
+                self.assertNotIn("secret-token", rendered)
+                self.assertNotIn("/home/runner/private", rendered)
+                self.assertNotIn("example.invalid", rendered)
+
+    def test_chromedriver_startup_timeout_does_not_retain_raw_last_error(self) -> None:
+        """Startup timeout diagnostics must classify transient errors without copying raw text."""
+
+        namespace = runpy.run_path(str(RUNNER), run_name="mv3_contract")
+        wait_for_driver = namespace["_wait_for_driver"]
+        time_module = namespace["time"]
+        raw_error = "secret-token /home/runner/private https://example.invalid"
+
+        with (
+            unittest.mock.patch.dict(
+                wait_for_driver.__globals__,
+                {"_json_request": unittest.mock.Mock(side_effect=OSError(raw_error))},
+            ),
+            unittest.mock.patch.object(
+                time_module,
+                "monotonic",
+                side_effect=(0.0, 0.0, 99.0),
+            ),
+            unittest.mock.patch.object(time_module, "sleep", return_value=None),
+        ):
+            with self.assertRaises(RuntimeError) as raised:
+                wait_for_driver(9515)
+
+        rendered = str(raised.exception)
+        self.assertIn("ChromeDriver did not become ready", rendered)
+        self.assertIn("io_error", rendered)
+        self.assertNotIn("secret-token", rendered)
+        self.assertNotIn("/home/runner/private", rendered)
+        self.assertNotIn("example.invalid", rendered)
+
     def test_workflow_runs_the_real_browser_lane_without_model_credentials(self) -> None:
         """Compatibility evidence must execute Chromium and never require LLM secrets."""
 
@@ -210,6 +298,8 @@ def test_doctoring_records_primary_chromium_evidence(self) -> None:
             "not claim 100% Chrome extension compatibility",
             "Chrome for Developers",
             "Google Chrome Labs",
+            "chrome.downloads",
+            "https://developer.chrome.com/docs/extensions/reference/api/downloads",
         ):
             with self.subTest(expected=expected):
                 self.assertIn(expected, doctoring)
diff --git a/tests/test_mv3_session_cleanup_exception_contract.py b/tests/test_mv3_session_cleanup_exception_contract.py
index 2edebaad8..6ba9e3301 100644
--- a/tests/test_mv3_session_cleanup_exception_contract.py
+++ b/tests/test_mv3_session_cleanup_exception_contract.py
@@ -1,9 +1,10 @@
-"""Regression contract for fail-closed WebDriver session cleanup on update trials."""
+"""Regression contract for fail-closed WebDriver session cleanup."""
 
 from __future__ import annotations
 
 import pathlib
 import runpy
+import subprocess
 import tempfile
 import unittest
 import unittest.mock
@@ -19,38 +20,80 @@ class _UnexpectedCleanupFailure(Exception):
 class _FakeDriver:
     """Record process cleanup without launching ChromeDriver."""
 
-    def __init__(self) -> None:
+    def __init__(
+        self,
+        *,
+        terminate_error: OSError | None = None,
+        kill_error: OSError | None = None,
+        wait_timeout_once: bool = False,
+    ) -> None:
         self.terminated = False
         self.killed = False
+        self.terminate_error = terminate_error
+        self.kill_error = kill_error
+        self.wait_timeout_once = wait_timeout_once
+        self.wait_calls = 0
 
     def terminate(self) -> None:
         """Record the graceful process-termination fallback."""
 
         self.terminated = True
+        if self.terminate_error is not None:
+            raise self.terminate_error
 
     def kill(self) -> None:
         """Record the bounded hard-kill fallback when requested."""
 
         self.killed = True
+        if self.kill_error is not None:
+            raise self.kill_error
 
     def wait(self, timeout: float) -> int:
-        """Model an immediately reaped process."""
+        """Model either an immediately reaped process or one bounded timeout."""
 
         if timeout <= 0:
             raise AssertionError("timeout must remain positive")
+        self.wait_calls += 1
+        if self.wait_timeout_once and self.wait_calls == 1:
+            raise subprocess.TimeoutExpired("controlled-chromedriver", timeout)
         return 0
 
 
 class ManifestV3SessionCleanupExceptionTests(unittest.TestCase):
     """Unexpected cleanup failures must remain visible after process teardown."""
 
-    def test_unreviewed_session_cleanup_exception_is_not_silently_suppressed(self) -> None:
-        """A new exception class must propagate while ChromeDriver is still terminated."""
+    @staticmethod
+    def _surfaces() -> dict[str, str]:
+        """Return one fully passing controlled compatibility surface set."""
+
+        return {
+            "workerStartCount": "1",
+            "storagePersistence": "initialized",
+            "workerReply": "pong",
+            "content": "ready",
+            "storage": "ready",
+            "dnr": "blocked",
+            "tabs": "ready",
+            "windows": "ready",
+            "scripting": "ready",
+            "scriptingExecuted": "ready",
+            "commands": "ready",
+            "sidePanel": "ready",
+            "bookmarks": "ready",
+            "history": "ready",
+            "downloads": "ready",
+        }
+
+    def _run_with_cleanup_failure(
+        self,
+        cleanup_failure: Exception,
+        fake_driver: _FakeDriver,
+    ) -> tuple[object, object]:
+        """Run the production browser-pass boundary with controlled cleanup failures."""
 
         namespace = runpy.run_path(str(RUNNER), run_name="mv3_cleanup_contract")
         run_browser_pass = namespace["_run_browser_pass"]
         globals_ = run_browser_pass.__globals__
-        fake_driver = _FakeDriver()
 
         def fake_json_request(
             _driver_port: int,
@@ -74,34 +117,10 @@ def fake_json_request(
             if method == "POST" and path.endswith("/url"):
                 return {"value": None}
             if method == "DELETE" and path.endswith("/session/session-1"):
-                raise _UnexpectedCleanupFailure("must not be normalized")
+                raise cleanup_failure
             raise AssertionError(f"unexpected WebDriver request: {method} {path}")
 
-        surfaces = {
-            "workerStartCount": "1",
-            "storagePersistence": "initialized",
-            "extensionVersion": namespace["INITIAL_EXTENSION_VERSION"],
-            "storageMigration": "initialized",
-            "workerReply": "pong",
-            "content": "ready",
-            "storage": "ready",
-            "dnr": "blocked",
-            "tabs": "ready",
-            "windows": "ready",
-            "scripting": "ready",
-            "scriptingExecuted": "ready",
-            "commands": "ready",
-            "sidePanel": "ready",
-            "bookmarks": "ready",
-            "history": "ready",
-            "downloads": "ready",
-        }
-
-        with tempfile.TemporaryDirectory(prefix="originweave-cleanup-contract-") as trial_root:
-            trial_dir = pathlib.Path(trial_root)
-            profile_dir = trial_dir / "profile"
-            extension_dir = trial_dir / "extension"
-            extension_dir.mkdir()
+        with tempfile.TemporaryDirectory(prefix="originweave-cleanup-contract-") as profile_dir:
             with (
                 unittest.mock.patch.object(
                     globals_["subprocess"], "Popen", return_value=fake_driver
@@ -113,27 +132,79 @@ def fake_json_request(
                         "_wait_for_driver": lambda _port: None,
                         "_json_request": fake_json_request,
                         "_wait_for_extension_evidence": (
-                            lambda _port, _session, _persistence, _version, _migration: surfaces
+                            lambda _port, _session, _expected: self._surfaces()
                         ),
                         "_exercise_real_click": lambda _port, _session: "clicked",
                     },
                 ),
             ):
-                with self.assertRaises(_UnexpectedCleanupFailure):
+                try:
                     run_browser_pass(
                         pathlib.Path("/controlled/chrome"),
                         pathlib.Path("/controlled/chromedriver"),
                         "http://127.0.0.1:8080/page.html",
                         profile_dir,
-                        extension_dir,
-                        "initialized",
-                        namespace["INITIAL_EXTENSION_VERSION"],
                         "initialized",
                     )
+                except Exception as error:  # noqa: BLE001 - return exact boundary error.
+                    return namespace, error
+        self.fail("cleanup failure unexpectedly became success")
+
+    def test_unreviewed_session_cleanup_exception_is_not_silently_suppressed(self) -> None:
+        """A new exception class must propagate while ChromeDriver is still terminated."""
+
+        fake_driver = _FakeDriver()
+        expected = _UnexpectedCleanupFailure("must not be normalized")
+        _namespace, error = self._run_with_cleanup_failure(expected, fake_driver)
 
+        self.assertIs(error, expected)
         self.assertTrue(fake_driver.terminated)
         self.assertFalse(fake_driver.killed)
 
+    def test_reviewed_session_cleanup_error_survives_teardown_failure(self) -> None:
+        """The causal session failure must not be replaced by a later terminate error."""
+
+        fake_driver = _FakeDriver(terminate_error=OSError("terminate failed"))
+        session_error = RuntimeError("session delete failed")
+        namespace, error = self._run_with_cleanup_failure(session_error, fake_driver)
+
+        self.assertIsInstance(error, namespace["WebDriverSessionCleanupError"])
+        self.assertIs(error.__cause__, session_error)
+        self.assertTrue(fake_driver.terminated)
+        self.assertTrue(fake_driver.killed)
+
+    def test_successful_kill_after_wait_timeout_is_normal_cleanup(self) -> None:
+        """A bounded wait timeout must remain a successful fallback when kill reaps the process."""
+
+        namespace = runpy.run_path(str(RUNNER), run_name="mv3_teardown_contract")
+        fake_driver = _FakeDriver(wait_timeout_once=True)
+
+        error = namespace["_teardown_driver_process"](fake_driver)
+
+        self.assertIsNone(error)
+        self.assertTrue(fake_driver.terminated)
+        self.assertTrue(fake_driver.killed)
+        self.assertEqual(fake_driver.wait_calls, 2)
+
+    def test_failed_kill_fallback_is_recorded_on_the_primary_teardown_error(self) -> None:
+        """A secondary fallback failure must not disappear while the first error stays causal."""
+
+        namespace = runpy.run_path(str(RUNNER), run_name="mv3_teardown_contract")
+        terminate_error = OSError("terminate failed")
+        fake_driver = _FakeDriver(
+            terminate_error=terminate_error,
+            kill_error=PermissionError("kill denied"),
+        )
+
+        error = namespace["_teardown_driver_process"](fake_driver)
+
+        self.assertIs(error, terminate_error)
+        self.assertTrue(fake_driver.killed)
+        self.assertIn(
+            "bounded ChromeDriver kill fallback also failed: PermissionError",
+            getattr(error, "__notes__", []),
+        )
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/test_mv3_transport_protocol_exception_contract.py b/tests/test_mv3_transport_protocol_exception_contract.py
new file mode 100644
index 000000000..f8a6d9963
--- /dev/null
+++ b/tests/test_mv3_transport_protocol_exception_contract.py
@@ -0,0 +1,70 @@
+"""Regression contract for bounded WebDriver transport-protocol failures."""
+
+from __future__ import annotations
+
+import pathlib
+import runpy
+import unittest
+import unittest.mock
+
+ROOT = pathlib.Path(__file__).resolve().parents[1]
+RUNNER = ROOT / "scripts" / "ci" / "run_mv3_compatibility.py"
+
+
+class ManifestV3TransportProtocolExceptionContractTests(unittest.TestCase):
+    """Keep recoverable HTTP parser failures inside the typed runner boundary."""
+
+    def test_http_protocol_exceptions_are_classified_without_raw_transport_text(self) -> None:
+        """BadStatusLine and IncompleteRead must become one bounded RuntimeError."""
+
+        namespace = runpy.run_path(str(RUNNER), run_name="mv3_transport_contract")
+        json_request = namespace["_json_request"]
+        http_module = namespace["http"]
+        raw_secret = "secret-token /home/runner/private https://example.invalid"
+
+        class BadStatusConnection:
+            def request(self, *_args: object, **_kwargs: object) -> None:
+                return None
+
+            def getresponse(self) -> object:
+                raise http_module.client.BadStatusLine(raw_secret)
+
+            def close(self) -> None:
+                return None
+
+        class IncompleteReadResponse:
+            status = 200
+
+            def read(self, _limit: int) -> bytes:
+                partial = raw_secret.encode("utf-8")
+                raise http_module.client.IncompleteRead(partial, len(partial) + 10)
+
+        class IncompleteReadConnection:
+            def request(self, *_args: object, **_kwargs: object) -> None:
+                return None
+
+            def getresponse(self) -> IncompleteReadResponse:
+                return IncompleteReadResponse()
+
+            def close(self) -> None:
+                return None
+
+        for connection in (BadStatusConnection(), IncompleteReadConnection()):
+            with self.subTest(connection=type(connection).__name__):
+                with unittest.mock.patch.object(
+                    http_module.client,
+                    "HTTPConnection",
+                    return_value=connection,
+                ):
+                    with self.assertRaises(RuntimeError) as raised:
+                        json_request(9515, "GET", "/status")
+
+                rendered = str(raised.exception)
+                self.assertEqual(rendered, "WebDriver transport protocol failure")
+                self.assertNotIn("secret-token", rendered)
+                self.assertNotIn("/home/runner/private", rendered)
+                self.assertNotIn("example.invalid", rendered)
+
+
+if __name__ == "__main__":
+    unittest.main()

From b2116322e387f6fdc5d501adffff9aa98a73ea29 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Mon, 17 Aug 2026 04:48:51 +0900
Subject: [PATCH 08/10] fix(mv3): compose isolated-world proof with current
 fixture evidence

---
 tests/fixtures/mv3_basic/content_script.js | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/tests/fixtures/mv3_basic/content_script.js b/tests/fixtures/mv3_basic/content_script.js
index 1bde75ed9..161d5db51 100644
--- a/tests/fixtures/mv3_basic/content_script.js
+++ b/tests/fixtures/mv3_basic/content_script.js
@@ -1,7 +1,13 @@
 "use strict";
 
 (async () => {
-  document.documentElement.dataset.originweaveContentScript = "ready";
+  window.originweaveWorldSentinel = "extension";
+  await new Promise((resolve) => setTimeout(resolve, 75));
+  const pageWorldSentinel = document.documentElement.dataset.originweavePageWorld;
+  document.documentElement.dataset.originweaveContentScript =
+    window.originweaveWorldSentinel === "extension" && pageWorldSentinel === "page"
+      ? "ready"
+      : "missing";
 
   const previous = await chrome.storage.local.get("originweave_content");
   const storagePersisted = previous.originweave_content === "ready";

From 6afe270af946a24b0dfa06292340776930fb24c8 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Mon, 17 Aug 2026 04:49:26 +0900
Subject: [PATCH 09/10] fix(mv3): compose isolated-world changelog with
 prerequisite truth

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7f36b0c3d..1780147c6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -30,6 +30,7 @@ All notable changes to OriginWeave are documented in this file. The format follo
 - Proposed product-wide target-architecture ADRs for the Rust control plane, isolated execution modes, typed actions, semantic observation/stale-node authority, prompt-injection and secret separation, resource-governor priority, provenance evidence, browser/protocol adapters, crawler policy, and hourly automation operational closure; these remain Proposed rather than shipped claims until protected review and merge.
 - Pinned real-Chromium Manifest V3 compatibility evidence for a controlled history add/read/delete lifecycle confined to the ephemeral loopback fixture profile, with cleanup verification and no OriginWeave Agent history-authority claim.
 - Pinned real-Chromium Manifest V3 update-migration evidence using a trial-local unpacked-extension copy, a controlled `1.0.0` to `1.0.1` transition, persisted profile state, and explicit schema migration without modifying the checked-in fixture or granting Agent authority.
+- Pinned real-Chromium Manifest V3 content-script isolated-world evidence that requires the page main world and extension isolated world to retain distinct JavaScript globals while sharing only a controlled DOM sentinel.
 
 ### Changed
 

From aba6668ceb282833c14ba037fffd963291c2eae7 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 18 Aug 2026 02:24:49 +0900
Subject: [PATCH 10/10] docs(doctoring): preserve prerequisite bookmark
 evidence

Overlay the exact current PR #60 doctoring blob so the isolated-world child no longer regresses the prerequisite Chrome Bookmarks standards/evidence section or APA reference. Keep the isolated-world semantic delta unchanged.
---
 docs/doctoring.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/docs/doctoring.md b/docs/doctoring.md
index 14bbca978..04ae737a4 100644
--- a/docs/doctoring.md
+++ b/docs/doctoring.md
@@ -12,6 +12,10 @@ The 1 June 2026 WebDriver BiDi Working Draft defines a bidirectional remote-cont
 
 The current Chrome Extensions Downloads API documents the `downloads` manifest permission and `chrome.downloads` methods that initiate, monitor, search, and inspect downloads. That living vendor reference is API semantics only. OriginWeave treats a successful controlled loopback download in pinned Chromium as compatibility evidence for one declared surface, not as Agent filesystem authority, general download persistence, or a claim that every Downloads method is supported.
 
+### Manifest V3 bookmarks compatibility
+
+The current Chrome Extensions Bookmarks API documents the `bookmarks` manifest permission and Promise-returning `chrome.bookmarks.create`, `chrome.bookmarks.get`, and `chrome.bookmarks.remove` methods. Bookmark node identifiers are strings unique within one browser profile. That living vendor reference is API semantics only. OriginWeave treats one controlled loopback create → get → remove lifecycle plus allow-listed stage diagnostics as compatibility evidence, not as Agent bookmark capability or ambient human-profile bookmark authority.
+
 ### Manifest V3 WebDriver transport-protocol diagnostics
 
 RFC 9112 defines the HTTP/1.1 status-line and the requirement that a message body match the announced framing. A malformed status-line or an incomplete body is a recoverable parser failure, not a trusted diagnostic payload. W3C WebDriver carries commands over that HTTP transport. The Manifest V3 compatibility runner therefore converts `http.client.HTTPException` subclasses such as `BadStatusLine` and `IncompleteRead` into the classified message `WebDriver transport protocol failure`. Raw status-line text, partial body bytes, paths, URLs, or tokens must not enter exception text, trial evidence, or logs.
@@ -120,6 +124,8 @@ Barth, A. (2011). *The web origin concept* (RFC 6454). Internet Engineering Task
 
 Bonica, R., Cotton, M., Haberman, B., & Vegoda, L. (2017). *Updates to the special-purpose IP address registries* (RFC 8190). Internet Engineering Task Force. https://doi.org/10.17487/RFC8190
 
+Chrome for Developers. (n.d.). *chrome.bookmarks*. Google. Retrieved August 16, 2026, from https://developer.chrome.com/docs/extensions/reference/api/bookmarks
+
 Chrome for Developers. (n.d.). *chrome.downloads*. Google. Retrieved August 16, 2026, from https://developer.chrome.com/docs/extensions/reference/api/downloads
 
 Chromium Authors. (n.d.). *Proxy support in Chrome* [Source documentation]. Chromium. https://chromium.googlesource.com/chromium/src/+/a3e71ebfa307d8760eb68b777e2998a869940092/net/docs/proxy.md