diff --git a/CHANGELOG.md b/CHANGELOG.md
index e6b2563..6f8f949 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,12 +8,14 @@ Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Versioning: [S
 
 ### Added
 
+- Plain-language **Page not working?** recovery card in the popup for the current site, with one-click **Pause this site and reload** / **Turn protection back on**. A detected compatibility warning upgrades the same card instead of using separate technical copy.
+- Pausing a site now also installs a high-priority DNR `allow` rule for that initiator host, so fingerprint/CAPTCHA vendor network blocks no longer keep breaking logins after a per-site pause.
+- Toolbar badge shows `!` when the current site has a fresh compatibility warning, so casual users get a cue to open the popup without an in-page banner.
 - Noise mode now **learns WAR paths** from each origin's own probes and answers those exact files for persona IDs on later visits. LinkedIn-style `{id, file}` AED probes (e.g. `/inpage.js`, `/src/css/content.css`) are poisoned without answering first-visit path canaries. Learned paths are query-stripped, charset-limited, capped at 8 per ID, omitted from research exports, and never store website URLs.
 - DOM/global marker coverage for KeePassXC, Dark Reader, Bitwarden overlay (`data-bw-*`), and LanguageTool, closing Castle-style side-effect detection gaps.
 - KeePassXC-Browser (`oboonakemofpalcgghocfoadofidjkkk`) in the `password_manager` conflict slot, with an ID-seeded Noise manifest name.
 - DNR fingerprint vendor rules for LexisNexis Risk (`lexisnexisrisk.com`), Stytch device telemetry (`telemetry.stytch.com` only, not the auth product), Group-IB RU (`group-ib.ru`), IPFingerprint (`ipfingerprint.com`), Socure IO (`socure.io`), and Nethone (`nethone.com`) (rule IDs 77–82).
 - Playwright coverage for learned-path Noise decoys, path canaries, path caps, research-export omission, and new DOM markers (`tests/noise-learned-paths.spec.js`).
-
 - Noise-mode decoy `manifest.json` bodies are now **ID-seeded**: known store IDs return real-looking extension names (e.g. Bitwarden, uBlock Origin), and unknown IDs get a stable per-ID name/version so multi-ID probe dumps no longer collapse to one generic `"Browser Extension"` string.
 - Noise fetch/XHR image decoys now serve format-matched bodies and `Content-Type` for PNG, GIF, JPEG, and SVG (path extension, headers, and magic bytes stay aligned). Formats Static cannot synthesize correctly (e.g. WebP) stay fail-closed.
 - DNR fingerprint vendor rules for HUMAN legacy `whiteops.com`, Sift root `sift.com`, Accertify (`accertify.com`), and Group-IB (`group-ib.com`) (rule IDs 73–76).
@@ -27,6 +29,10 @@ Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Versioning: [S
 - `docs/noise-behavior.md` documents the ID-seeded manifest contract, image magic-byte fail-closed policy, and learned WAR-path Noise contract.
 - Firefox smoke CI starts the browser with `--remote-allow-system-access` so WebDriver can still open `about:debugging` and `moz-extension://` pages on Firefox 153+.
 
+### Fixed
+
+- Firefox package build no longer leaves Chrome-only DNR resource type names in the pause-allow retry path, so the `build-firefox.js` self-check passes.
+
 ## [2.4.0] — 2026-07-09
 
 ### Added
diff --git a/README.md b/README.md
index 17aa5dc..48d4494 100644
--- a/README.md
+++ b/README.md
@@ -85,13 +85,21 @@ Firefox needs MAIN-world content scripts (128+) and built-in data-collection con
 7. **Replay poisoning (opt-in).** When a likely session-replay SDK is detected in page script, Static can proxy only that recorder's event listeners so they see redacted form values and jittered coordinates while ordinary page handlers still receive the real events.
 8. **Iframe attribute hardening.** Extension probes and fingerprinting scripts can infer browser capabilities from the shape of `<iframe allow>` / `sandbox` / `allowfullscreen` / `allowpaymentrequest>` attributes. Static normalizes these attributes: it drops unsupported `allow` tokens, keeps only valid `sandbox` tokens, coerces legacy `allowfullscreen` / `allowpaymentrequest` into modern `allow` syntax, and works on pages with Trusted Types `require-trusted-types-for 'script'` CSP by creating a dedicated policy.
 9. **Style / CSSOM vector blocking.** Extension URLs can be smuggled into `<style>` text nodes, inline `style` attributes, `CSSStyleSheet.cssText`, `CSSStyleDeclaration.setProperty` / `cssText`, and `insertRule` / `replace` / `replaceSync` / `addRule` calls. Static scrubs these sources before the browser can issue a request, and does it synchronously so the URL cannot be read back.
-10. **Per-site disable.** You can turn Static off for individual sites from the popup. When a site is disabled, all extension-probe blocking, DOM scrubbing, global stripping, and opt-in poisoning modes are bypassed for that origin. The disabled state persists in `chrome.storage.local` and updates instantly on the current page. The **Disabled sites** page lists every paused origin with search, per-origin enable, and **Enable All**.
+10. **Per-site disable.** You can turn Static off for individual sites from the popup, including a plain-language **Page not working?** card with one-click pause and reload. When a site is disabled, all extension-probe blocking, DOM scrubbing, global stripping, and opt-in poisoning modes are bypassed for that origin, and Static also allows that origin's requests through the fingerprint/CAPTCHA network lists. The disabled state persists in `chrome.storage.local` and updates instantly on the current page. The **Disabled sites** page lists every paused origin with search, per-origin enable, and **Enable All**.
 
 The toolbar badge and popup show a live count of extension-enumeration probes blocked on the current tab. On sites that probe aggressively (LinkedIn runs ~4,500 per page load) the number climbs into the thousands within seconds. The popup's diagnostics also include an **Exposed browser profile** view showing the JavaScript-visible user agent, platform, locale/language, timezone, screen, hardware buckets, WebGL, network, storage, and battery signals the current site can read; when Device signal poisoning is active, this view shows Static's stable per-site persona.
 
 ## Compatibility warning
 
-Static also watches for one high-confidence breakage signal: a Static-blocked extension-probe `fetch()` that becomes an unhandled page error. When that happens, the popup shows a local compatibility warning with a **Pause here and reload** escape hatch. The popup also links to a **Disabled sites** page where you can see every paused origin, re-enable individual sites, or enable them all at once. Static does not auto-disable itself, and the warning evidence stays local.
+Static watches for a high-confidence breakage signal: a Static-blocked extension-probe `fetch()` that becomes an unhandled page error. When that happens, the toolbar badge shows `!` and the popup switches the recovery card to a direct warning.
+
+Casual recovery does not depend on that signal. The popup always keeps a **Page not working?** card on the current site, with one button: **Pause this site and reload**. That pause:
+
+- turns off Static's page-layer defenses for that origin
+- lets the site's own requests through Static's fingerprint/CAPTCHA network lists (those lists are otherwise global)
+- reloads the tab so an already-broken page can recover
+
+Static does not auto-disable itself, does not inject an in-page banner (that would be another fingerprint), and keeps the warning evidence local. After a pause, the card becomes **Static is paused here** with **Turn protection back on**. The **Disabled sites** page lists every paused origin so a site can be re-enabled later.
 
 ## Playbook drift detection
 
@@ -329,7 +337,7 @@ static/
 
 - JS-layer patches run only where content scripts run. Pages served from `chrome://`, `about:`, the Chrome Web Store, and a handful of other restricted schemes are not covered.
 - The DOM scrubber ships with a default list of extensions whose markers are stripped. If one of those is an extension you use, its in-page UI (autofill icons, inline suggestions, etc.) may not render. Remove that extension's patterns from `lists.js` to keep it working.
-- Some sites use anti-bot vendors (PerimeterX, DataDome) as part of their login / checkout flow. If a site breaks, try disabling `fingerprint_vendors` first from the popup.
+- Some sites use anti-bot vendors (PerimeterX, DataDome) as part of their login / checkout flow. If a site breaks, use **Pause this site and reload** in the popup first. That pauses Static on that origin, including the fingerprinting vendor network rules. You can also disable `fingerprint_vendors` globally from **More**.
 - `captcha_vendors` is disabled by default because Arkose/FunCAPTCHA, DataDome, and Cloudflare Turnstile / Challenge Platform are served as CAPTCHA or device-check flows on some logins and protected forms (X signup, Roblox, some crypto exchanges, Cloudflare-protected forms); enabling it will break sign-in there.
 - Does not cover the entire browser-fingerprinting surface (canvas, WebGL, audio, fonts, font enumeration, WebRTC IP leak, etc.). Complements, doesn't replace, a dedicated anti-fingerprint extension.
 - Does not block broad tracker, ad-tech, analytics, or social pixel ecosystems. Complements, doesn't replace, uBlock Origin or Privacy Badger.
diff --git a/build-firefox.js b/build-firefox.js
index e33e9f7..569db30 100755
--- a/build-firefox.js
+++ b/build-firefox.js
@@ -80,6 +80,11 @@ function stripTypesFromServiceWorker(filePath) {
     // Remove lines like:  "webtransport",
     content = content.replace(new RegExp(`^\\s*"${typeName}",\\s*\\n`, "gm"), "");
   }
+  // Blank any leftover quoted type names (comparisons, comments, retries)
+  // so the packaged worker cannot mention types Firefox DNR rejects.
+  for (const typeName of UNSUPPORTED_RESOURCE_TYPES) {
+    content = content.split(`"${typeName}"`).join('""');
+  }
   if (content !== before) {
     fs.writeFileSync(filePath, content);
     return true;
diff --git a/disabled.html b/disabled.html
index 6844069..e546669 100644
--- a/disabled.html
+++ b/disabled.html
@@ -217,7 +217,7 @@
         <div class="header-inner">
           <img src="icons/icon-128.png" alt="" />
           <h1>Disabled sites</h1>
-          <div class="subtitle">Sites where Static is paused.</div>
+          <div class="subtitle">Sites where Static is paused. Turn protection back on anytime.</div>
         </div>
       </div>
     </header>
diff --git a/disabled.js b/disabled.js
index eb6f2a9..32ce2b0 100644
--- a/disabled.js
+++ b/disabled.js
@@ -8,7 +8,7 @@ const renderEmpty = () => {
   const content = document.getElementById("content");
   content.innerHTML = `<div class="empty-state">
     <p class="big">No sites are paused</p>
-    <p>Use the site toggle in the popup to pause Static on a site.</p>
+    <p>Use <strong>Page not working?</strong> in the popup, or the site toggle, to pause Static.</p>
   </div>`;
 };
 
diff --git a/popup.html b/popup.html
index 86ab3cb..21d2980 100644
--- a/popup.html
+++ b/popup.html
@@ -136,43 +136,74 @@
       .adaptive[hidden] {
         display: none;
       }
-      .compat {
+      .recovery {
         margin-top: 10px;
         padding: 8px;
-        border: 1px solid #efd4a8;
+        border: 1px solid var(--border-strong);
         border-radius: 7px;
-        color: #744100;
-        background: #fff7e8;
+        color: var(--text);
+        background: #f6f6f6;
         font-size: 10px;
         line-height: 1.35;
       }
-      .compat[hidden] {
+      .recovery[hidden] {
         display: none;
       }
-      .compat-title {
+      .recovery.is-warning {
+        color: #744100;
+        background: #fff7e8;
+        border-color: #efd4a8;
+      }
+      .recovery.is-paused {
+        color: var(--accent);
+        background: #fff5f5;
+        border-color: #ead0d0;
+      }
+      .recovery-title {
         font-weight: 700;
       }
-      .compat-detail {
+      .recovery-detail {
         margin-top: 2px;
+        color: var(--text-muted);
+      }
+      .recovery.is-warning .recovery-detail {
         color: #8a4b00;
       }
-      .compat-actions {
+      .recovery.is-paused .recovery-detail {
+        color: var(--accent);
+      }
+      .recovery-actions {
         margin-top: 7px;
       }
-      .compat-button {
-        padding: 5px 7px;
-        color: #744100;
+      .recovery-button {
+        padding: 6px 8px;
+        color: var(--text);
         background: #fff;
-        border: 1px solid #efd4a8;
+        border: 1px solid var(--border-strong);
         border-radius: 6px;
         font: inherit;
         font-size: 10px;
         font-weight: 700;
         cursor: pointer;
       }
-      .compat-button:hover {
+      .recovery-button:hover {
+        border-color: var(--text-muted);
+      }
+      .recovery.is-warning .recovery-button {
+        color: #744100;
+        border-color: #efd4a8;
+      }
+      .recovery.is-warning .recovery-button:hover {
         border-color: #d88030;
       }
+      .recovery.is-paused .recovery-button {
+        color: var(--accent);
+        border-color: #ead0d0;
+      }
+      .recovery.is-paused .recovery-button:hover {
+        background: #fff;
+        border-color: var(--accent);
+      }
       .site-section {
         padding: 12px 16px;
         background: var(--surface);
@@ -756,12 +787,15 @@ <h1>Static</h1>
       <div class="cumulative" id="cumulative"></div>
       <div class="drift" id="drift" hidden></div>
       <div class="adaptive" id="adaptive" hidden></div>
-      <div class="compat" id="compat" hidden>
-        <div class="compat-title">Static may be interfering with this site</div>
-        <div class="compat-detail" id="compat-detail"></div>
-        <div class="compat-actions">
-          <button class="compat-button" id="compat-pause" type="button">
-            Pause here and reload
+      <div class="recovery" id="recovery" hidden aria-live="polite">
+        <div class="recovery-title" id="recovery-title">Page not working?</div>
+        <div class="recovery-detail" id="recovery-detail">
+          Static can stop logins, checkouts, or extra features on some sites. Pause it here to
+          check.
+        </div>
+        <div class="recovery-actions">
+          <button class="recovery-button" id="recovery-action" type="button">
+            Pause this site and reload
           </button>
         </div>
       </div>
@@ -771,10 +805,10 @@ <h1>Static</h1>
       <div class="toggle-row">
         <div class="col">
           <div class="ttl" id="site-title">
-            <span id="site-title-text">Site status</span>
+            <span id="site-title-text">Protect this site</span>
           </div>
           <div class="desc" id="site-desc">
-            <span id="site-status-text">Protecting this site</span>
+            <span id="site-status-text">On. Pause it if the page looks broken.</span>
           </div>
         </div>
         <label class="switch">
diff --git a/popup.js b/popup.js
index 8550872..3b2f4f0 100644
--- a/popup.js
+++ b/popup.js
@@ -197,46 +197,114 @@ const renderAdaptiveNotice = (resp) => {
   adaptiveEl.hidden = false;
 };
 
-const compatibilityDetailText = (warning) => {
-  const kinds = new Set((warning && warning.kinds ? warning.kinds : []).map(([kind]) => kind));
-  if (kinds.has("unhandled_blocked_fetch")) {
-    return "A blocked extension-probe fetch became an unhandled page error. If the site looks broken, pausing Static here is the safest quick fix.";
+const isHttpOrigin = (origin) => typeof origin === "string" && /^https?:/i.test(origin);
+
+const tabIdFromQuery = () => {
+  try {
+    const value = Number(new URLSearchParams(window.location.search).get("tabId"));
+    return Number.isInteger(value) && value > 0 ? value : null;
+  } catch {
+    return null;
+  }
+};
+
+const isHttpUrl = (url) => typeof url === "string" && /^https?:/i.test(url);
+const isExtensionUrl = (url) =>
+  typeof url === "string" && /^(chrome|moz|safari-web|ms-browser|edge)-extension:/i.test(url);
+
+const tabOrigin = (tab) => {
+  try {
+    return tab && tab.url ? new URL(tab.url).origin : null;
+  } catch {
+    return null;
+  }
+};
+
+const resolvePopupTab = async () => {
+  const [active] = await chrome.tabs
+    .query({ active: true, currentWindow: true })
+    .catch(() => [null]);
+  if (active && isHttpUrl(active.url)) return active;
+  const [focused] = await chrome.tabs
+    .query({ active: true, lastFocusedWindow: true })
+    .catch(() => [null]);
+  if (focused && isHttpUrl(focused.url)) return focused;
+  if (active && isExtensionUrl(active.url)) {
+    const all = await chrome.tabs.query({}).catch(() => []);
+    const httpTabs = all.filter((tab) => isHttpUrl(tab.url));
+    httpTabs.sort((a, b) => (b.lastAccessed || 0) - (a.lastAccessed || 0));
+    if (httpTabs[0]) return httpTabs[0];
   }
-  return "A recent Static action was followed by a page error. If the site looks broken, try pausing Static here.";
+  return active || null;
+};
+
+const reloadOriginTab = async (origin) => {
+  if (!origin) return;
+  const tabs = await chrome.tabs.query({}).catch(() => []);
+  const match = tabs.find((tab) => tabOrigin(tab) === origin && isHttpUrl(tab.url));
+  if (match && match.id != null) await chrome.tabs.reload(match.id);
 };
 
-const pauseSiteAndReload = async (origin, button) => {
+const setSiteDisabledAndReload = async (origin, disabled, button) => {
   if (!origin) return;
-  button.disabled = true;
+  if (button) button.disabled = true;
   try {
     await chrome.runtime.sendMessage({
-      disabled: true,
+      disabled,
       origin,
       type: "static_set_site_disabled",
     });
-    const [tab] = await chrome.tabs.query({ active: true, currentWindow: true });
-    if (tab && tab.id != null) await chrome.tabs.reload(tab.id);
+    await reloadOriginTab(origin);
     window.close();
   } catch (e) {
-    console.error("[Static] compatibility pause failed", e);
-    button.disabled = false;
+    console.error("[Static] site pause/resume failed", e);
+    if (button) button.disabled = false;
   }
 };
 
-const renderCompatibilityNotice = (resp) => {
-  const compatEl = document.getElementById("compat");
-  const detailEl = document.getElementById("compat-detail");
-  const pauseButton = document.getElementById("compat-pause");
-  const warning = resp && resp.compatWarning;
-  if (!warning || resp.disabled || !resp.origin) {
-    compatEl.hidden = true;
-    pauseButton.onclick = null;
+const renderRecoveryCard = (resp) => {
+  const card = document.getElementById("recovery");
+  const titleEl = document.getElementById("recovery-title");
+  const detailEl = document.getElementById("recovery-detail");
+  const actionButton = document.getElementById("recovery-action");
+  if (!resp || !isHttpOrigin(resp.origin)) {
+    card.hidden = true;
+    actionButton.onclick = null;
+    return;
+  }
+
+  card.hidden = false;
+  if (resp.disabled) {
+    card.dataset.state = "paused";
+    card.classList.remove("is-warning");
+    card.classList.add("is-paused");
+    titleEl.textContent = "Static is paused here";
+    detailEl.textContent =
+      "Protection is off on this site. Reload if the page still looks stuck. You can turn Static back on anytime.";
+    actionButton.textContent = "Turn protection back on";
+    actionButton.onclick = () => setSiteDisabledAndReload(resp.origin, false, actionButton);
+    return;
+  }
+
+  if (resp.compatWarning) {
+    card.dataset.state = "warning";
+    card.classList.add("is-warning");
+    card.classList.remove("is-paused");
+    titleEl.textContent = "This site may be broken by Static";
+    detailEl.textContent =
+      "Static blocked something this page expected. Pause here and reload to see if that fixes it.";
+    actionButton.textContent = "Pause this site and reload";
+    actionButton.onclick = () => setSiteDisabledAndReload(resp.origin, true, actionButton);
     return;
   }
-  detailEl.textContent = compatibilityDetailText(warning);
-  pauseButton.disabled = false;
-  pauseButton.onclick = () => pauseSiteAndReload(resp.origin, pauseButton);
-  compatEl.hidden = false;
+
+  card.dataset.state = "help";
+  card.classList.remove("is-warning", "is-paused");
+  titleEl.textContent = "Page not working?";
+  detailEl.textContent =
+    "Static can stop logins, checkouts, or extra features on some sites. Pause it here to check.";
+  actionButton.textContent = "Pause this site and reload";
+  actionButton.onclick = () => setSiteDisabledAndReload(resp.origin, true, actionButton);
 };
 
 const renderTopIds = (topIds) => {
@@ -638,16 +706,16 @@ const renderSiteSection = (resp) => {
 
   const updateUI = () => {
     if (isDisabled) {
-      statusText.textContent = "Paused on this site";
+      statusText.textContent = "Paused. This site can see installed extensions again.";
       statusText.className = "site-status-paused";
     } else {
-      statusText.textContent = "Protecting this site";
+      statusText.textContent = "On. Pause it if the page looks broken.";
       statusText.className = "site-status-active";
     }
   };
   updateUI();
 
-  if (!resp || !resp.origin) {
+  if (!resp || !isHttpOrigin(resp.origin)) {
     section.hidden = true;
     return;
   }
@@ -685,7 +753,7 @@ const renderDetails = (resp) => {
   renderCumulative(cumulative);
   renderDriftNotice(resp && resp.drift);
   renderAdaptiveNotice(resp);
-  renderCompatibilityNotice(resp);
+  renderRecoveryCard(resp);
   renderTopIds(topIds);
   renderPowerDiagnostics(resp);
 };
@@ -936,7 +1004,8 @@ const renderRulesets = (enabledArr, counts) => {
 };
 
 (async () => {
-  const [tab] = await chrome.tabs.query({ active: true, currentWindow: true }).catch(() => [null]);
+  const queriedTabId = tabIdFromQuery();
+  const tab = queriedTabId != null ? { id: queriedTabId } : await resolvePopupTab();
   const detailsPromise = tab
     ? chrome.runtime.sendMessage({ type: "static_get_details", tabId: tab.id }).catch(() => null)
     : Promise.resolve(null);
diff --git a/service_worker.js b/service_worker.js
index 8e11465..889aab1 100644
--- a/service_worker.js
+++ b/service_worker.js
@@ -14,6 +14,8 @@
 //   8. Answer popup queries (`static_get_details`, `static_export_log`,
 //      `static_set_noise`, `static_set_replay`, `static_set_fingerprint`,
 //      `static_set_diagnostics`) and bridge queries (`static_get_persona`).
+//   9. When a site is paused, install initiator-scoped DNR allow rules so
+//      global fingerprint/CAPTCHA lists do not keep blocking that origin.
 
 // In the event-page fallback path (Firefox background.scripts), the deps
 // are loaded as sequential <script> tags before this file, so importScripts
@@ -43,6 +45,11 @@ const safeLog = (err, label) => {
 
 // ─── DNR header-rule management for network-layer fingerprint spoofing ────
 const UA_RULE_ID_BASE = 10_000;
+const PAUSE_ALLOW_RULE_ID_BASE = 30_000;
+const PAUSE_ALLOW_RULE_ID_MAX = 39_999;
+const HEADER_RULE_ID_MAX = PAUSE_ALLOW_RULE_ID_BASE - 1;
+const isHeaderRuleId = (id) => id >= UA_RULE_ID_BASE && id <= HEADER_RULE_ID_MAX;
+const isPauseAllowRuleId = (id) => id >= PAUSE_ALLOW_RULE_ID_BASE && id <= PAUSE_ALLOW_RULE_ID_MAX;
 const SEC_CH_UA_HEADERS = [
   "Sec-CH-UA",
   "Sec-CH-UA-Arch",
@@ -107,7 +114,9 @@ const ensureOriginHeaderRule = async (origin, fingerprintMode, persona) => {
     requestHeaders.push({ header, operation: "remove" });
   }
 
+  if (dnrNextRuleId > HEADER_RULE_ID_MAX) dnrNextRuleId = UA_RULE_ID_BASE;
   const ruleId = dnrNextRuleId++;
+  if (dnrNextRuleId > HEADER_RULE_ID_MAX) dnrNextRuleId = UA_RULE_ID_BASE;
   // requestDomains matches normal domain names. For bare IP addresses and
   // localhost, requestDomains does not apply, so use a regexFilter anchored to
   // scheme+host with a separator boundary. (A bare `*host*` urlFilter would
@@ -205,7 +214,7 @@ const clearAllHeaderRules = async () => {
   // session, even if the in-memory map was already empty.
   try {
     const existingRules = await chrome.declarativeNetRequest.getDynamicRules();
-    const staleIds = existingRules.filter((r) => r.id >= UA_RULE_ID_BASE).map((r) => r.id);
+    const staleIds = existingRules.filter((r) => isHeaderRuleId(r.id)).map((r) => r.id);
     for (const id of staleIds) {
       if (!ruleIds.includes(id)) ruleIds.push(id);
     }
@@ -233,7 +242,7 @@ const cleanupStaleHeaderRules = async () => {
     try {
       const existingRules = await chrome.declarativeNetRequest.getDynamicRules();
       for (const r of existingRules) {
-        if (r.id >= UA_RULE_ID_BASE) liveRuleIds.add(r.id);
+        if (isHeaderRuleId(r.id)) liveRuleIds.add(r.id);
       }
     } catch (err) {
       safeLog(err, "read dynamic rules");
@@ -255,13 +264,158 @@ const cleanupStaleHeaderRules = async () => {
       await chrome.declarativeNetRequest.updateDynamicRules({ removeRuleIds: orphanIds });
     }
 
-    dnrNextRuleId = maxId + 1;
+    dnrNextRuleId = Math.min(maxId + 1, HEADER_RULE_ID_MAX);
     await persistHeaderRules();
   } catch {
     dnrNextRuleId = UA_RULE_ID_BASE;
   }
 };
 
+// ─── DNR allow rules for paused origins ──────────────────────────────────
+// Static's fingerprint/CAPTCHA rulesets are global. Pausing a site must also
+// let that origin's requests through those lists, otherwise "pause and reload"
+// would not fix login/checkout breakage caused by vendor blocking.
+const originPauseAllowRules = new Map(); // hostname -> ruleId
+let pauseAllowNextRuleId = PAUSE_ALLOW_RULE_ID_BASE;
+
+const hostnameForPauseAllow = (origin) => {
+  try {
+    const hostname = new URL(origin).hostname;
+    if (!hostname) return null;
+    if (hostname === "localhost" || /^\d{1,3}(\.\d{1,3}){3}$/.test(hostname)) return null;
+    return hostname;
+  } catch {
+    return null;
+  }
+};
+
+const nextPauseAllowRuleId = (usedIds) => {
+  const take = (id) => {
+    if (usedIds.has(id)) return null;
+    pauseAllowNextRuleId = id >= PAUSE_ALLOW_RULE_ID_MAX ? PAUSE_ALLOW_RULE_ID_BASE : id + 1;
+    return id;
+  };
+  for (let id = pauseAllowNextRuleId; id <= PAUSE_ALLOW_RULE_ID_MAX; id++) {
+    const chosen = take(id);
+    if (chosen != null) return chosen;
+  }
+  for (let id = PAUSE_ALLOW_RULE_ID_BASE; id < pauseAllowNextRuleId; id++) {
+    const chosen = take(id);
+    if (chosen != null) return chosen;
+  }
+  return null;
+};
+
+const pauseAllowRuleForHostname = (ruleId, hostname) => ({
+  action: { type: "allow" },
+  condition: {
+    initiatorDomains: [hostname],
+    resourceTypes: ALL_RESOURCE_TYPES,
+  },
+  id: ruleId,
+  priority: 1000,
+});
+
+const addDynamicRule = async (rule) => {
+  try {
+    await chrome.declarativeNetRequest.updateDynamicRules({ addRules: [rule] });
+    return true;
+  } catch {
+    const types = (rule.condition && rule.condition.resourceTypes) || [];
+    const filtered = types.filter(
+      (typeName) => typeName === "websocket" || !typeName.startsWith("web")
+    );
+    if (filtered.length === types.length) return false;
+    try {
+      await chrome.declarativeNetRequest.updateDynamicRules({
+        addRules: [{ ...rule, condition: { ...rule.condition, resourceTypes: filtered } }],
+      });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+};
+
+const wantedPauseAllowHostnames = (disabledOrigins) => {
+  const wanted = new Set();
+  for (const [origin, disabled] of Object.entries(disabledOrigins || {})) {
+    if (!disabled) continue;
+    const hostname = hostnameForPauseAllow(origin);
+    if (hostname) wanted.add(hostname);
+  }
+  return wanted;
+};
+
+const pauseAllowHostnameFromRule = (rule) =>
+  rule.condition && Array.isArray(rule.condition.initiatorDomains)
+    ? rule.condition.initiatorDomains[0]
+    : null;
+
+const keepOrDropLivePauseAllowRule = (rule, wanted, state) => {
+  const hostname = pauseAllowHostnameFromRule(rule);
+  if (!hostname || !wanted.has(hostname) || state.seenHostnames.has(hostname)) {
+    state.removeRuleIds.push(rule.id);
+    state.usedIds.delete(rule.id);
+    return;
+  }
+  state.seenHostnames.add(hostname);
+  originPauseAllowRules.set(hostname, rule.id);
+  if (rule.id >= pauseAllowNextRuleId) {
+    pauseAllowNextRuleId =
+      rule.id >= PAUSE_ALLOW_RULE_ID_MAX ? PAUSE_ALLOW_RULE_ID_BASE : rule.id + 1;
+  }
+};
+
+const addMissingPauseAllowRules = async (wanted, usedIds) => {
+  for (const hostname of wanted) {
+    if (originPauseAllowRules.has(hostname)) continue;
+    const ruleId = nextPauseAllowRuleId(usedIds);
+    if (ruleId == null) break;
+    const added = await addDynamicRule(pauseAllowRuleForHostname(ruleId, hostname));
+    if (!added) continue;
+    usedIds.add(ruleId);
+    originPauseAllowRules.set(hostname, ruleId);
+  }
+};
+
+const reconcilePauseAllowRules = async (disabledOrigins) => {
+  const wanted = wantedPauseAllowHostnames(disabledOrigins);
+  let live;
+  try {
+    live = await chrome.declarativeNetRequest.getDynamicRules();
+  } catch (err) {
+    safeLog(err, "read pause-allow rules");
+    return;
+  }
+
+  const state = {
+    removeRuleIds: [],
+    seenHostnames: new Set(),
+    usedIds: new Set(live.map((rule) => rule.id)),
+  };
+  originPauseAllowRules.clear();
+  for (const rule of live.filter((entry) => isPauseAllowRuleId(entry.id))) {
+    keepOrDropLivePauseAllowRule(rule, wanted, state);
+  }
+
+  if (state.removeRuleIds.length > 0) {
+    try {
+      await chrome.declarativeNetRequest.updateDynamicRules({ removeRuleIds: state.removeRuleIds });
+    } catch (err) {
+      safeLog(err, "remove pause-allow rules");
+    }
+  }
+
+  await addMissingPauseAllowRules(wanted, state.usedIds);
+};
+
+const reconcilePauseAllowRulesFromStorage = () =>
+  serialize(async () => {
+    const { disabled_origins = {} } = await chrome.storage.local.get({ disabled_origins: {} });
+    await reconcilePauseAllowRules(disabled_origins);
+  });
+
 // ─── In-memory per-tab state ──────────────────────────────────────────────
 const perTabState = new Map(); // tabId -> { origin, frames: Map<frameId, {total, idCounts}> }
 const SW_HELPERS = CFG.helpers || {};
@@ -272,6 +426,8 @@ const MAX_COMPAT_ORIGINS = 50;
 const MAX_DIAGNOSTIC_EVENTS_PER_ORIGIN = 120;
 const MAX_DIAGNOSTIC_ORIGINS = 25;
 const COMPAT_WARNING_TTL_MS = 30 * 60 * 1000;
+const compatEntryIsFresh = (entry) =>
+  !!(entry && entry.lastUpdated && Date.now() - entry.lastUpdated <= COMPAT_WARNING_TTL_MS);
 
 const getOrInitTab = (tabId) => {
   let s = perTabState.get(tabId);
@@ -307,6 +463,7 @@ const updateBadge = (tabId, total) => {
 };
 
 const DISABLED_BADGE_COLOR = "#888";
+const COMPAT_BADGE_COLOR = "#d88030";
 
 const updateBadgeForTab = async (tabId, tabUrl) => {
   let origin = null;
@@ -321,12 +478,20 @@ const updateBadgeForTab = async (tabId, tabUrl) => {
     return;
   }
   try {
-    const { disabled_origins = {} } = await chrome.storage.local.get({ disabled_origins: {} });
+    const { compat_log = {}, disabled_origins = {} } = await chrome.storage.local.get({
+      compat_log: {},
+      disabled_origins: {},
+    });
     if (disabled_origins[origin]) {
       chrome.action.setBadgeText({ tabId, text: "OFF" }).catch(() => {});
       chrome.action.setBadgeBackgroundColor({ tabId, color: DISABLED_BADGE_COLOR }).catch(() => {});
       return;
     }
+    if (compatEntryIsFresh(compat_log[origin])) {
+      chrome.action.setBadgeText({ tabId, text: "!" }).catch(() => {});
+      chrome.action.setBadgeBackgroundColor({ tabId, color: COMPAT_BADGE_COLOR }).catch(() => {});
+      return;
+    }
   } catch {
     // storage read failed
   }
@@ -993,7 +1158,7 @@ const topCompatEntries = (counts) =>
     .slice(0, 3);
 
 const compatWarningForEntry = (entry) => {
-  if (!entry || !entry.lastUpdated || Date.now() - entry.lastUpdated > COMPAT_WARNING_TTL_MS) {
+  if (!compatEntryIsFresh(entry)) {
     return null;
   }
   return {
@@ -1381,6 +1546,7 @@ chrome.storage.onChanged.addListener((changes, area) => {
     for (const origin of Object.keys(next)) {
       if (next[origin] && !prev[origin]) removeOriginHeaderRule(origin);
     }
+    reconcilePauseAllowRulesFromStorage();
     // Update badges for all tabs after disabled_origins changes
     chrome.tabs
       .query({})
@@ -1391,10 +1557,22 @@ chrome.storage.onChanged.addListener((changes, area) => {
       })
       .catch(() => {});
   }
+  if (changes.compat_log) {
+    chrome.tabs
+      .query({})
+      .then((tabs) => {
+        for (const tab of tabs) {
+          if (tab.id != null) updateBadgeForTab(tab.id, tab.url).catch(() => {});
+        }
+      })
+      .catch(() => {});
+  }
 });
 
 // ─── Startup: reconcile persisted DNR header rules against live state ────
-cleanupStaleHeaderRules();
+cleanupStaleHeaderRules()
+  .then(() => reconcilePauseAllowRulesFromStorage())
+  .catch((err) => safeLog(err, "startup DNR reconcile"));
 // Mirror the persisted diagnostics flag into the in-memory gate so safeLog is
 // active immediately after a service-worker restart.
 chrome.storage.local.get({ diagnostics_mode: false }, ({ diagnostics_mode }) => {
diff --git a/tests/extension-behavior.spec.js b/tests/extension-behavior.spec.js
index 4afceb7..28378a5 100644
--- a/tests/extension-behavior.spec.js
+++ b/tests/extension-behavior.spec.js
@@ -8,6 +8,19 @@ const PROBED_ID = "nngceckbapebfimnlniiiahkandclblb";
 const OTHER_ID = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
 const probedUrl = (id = PROBED_ID, path = "/manifest.json") => `chrome-extension://${id}${path}`;
 
+const activeHttpTabId = (serviceWorker) =>
+  serviceWorker.evaluate(async () => {
+    const tabs = await chrome.tabs.query({});
+    const httpTab = tabs.find((tab) => /^https?:/.test(tab.url || ""));
+    return httpTab && httpTab.id;
+  });
+
+const openPopupForTab = async (extension, tabId) => {
+  const popupPage = await extension.context.newPage();
+  await popupPage.goto(`chrome-extension://${extension.extensionId}/popup.html?tabId=${tabId}`);
+  return popupPage;
+};
+
 async function startHeaderFixtureServer({ body = "ok", headers = {}, status = 200 } = {}) {
   const server = http.createServer((req, res) => {
     res.writeHead(status, {
@@ -224,6 +237,169 @@ test("records compatibility warnings for unhandled blocked fetch probes", async
   });
 });
 
+test("popup shows a plain-language recovery card on a regular site", async ({
+  extension,
+  server,
+}) => {
+  const page = await extension.context.newPage();
+  await page.goto(server.url("/blank.html"));
+  await page.bringToFront();
+  const tabId = await activeHttpTabId(extension.serviceWorker);
+  expect(typeof tabId).toBe("number");
+
+  const popupPage = await openPopupForTab(extension, tabId);
+
+  await expect(popupPage.locator("#recovery")).toBeVisible();
+  await expect(popupPage.locator("#recovery")).toHaveAttribute("data-state", "help");
+  await expect(popupPage.locator("#recovery-title")).toHaveText("Page not working?");
+  await expect(popupPage.locator("#recovery-action")).toHaveText("Pause this site and reload");
+  await expect(popupPage.locator("#site-title-text")).toHaveText("Protect this site");
+  await expect(popupPage.locator("#site-status-text")).toHaveText(
+    "On. Pause it if the page looks broken."
+  );
+});
+
+test("popup recovery card upgrades when a compatibility warning is stored", async ({
+  extension,
+  server,
+}) => {
+  const page = await extension.context.newPage();
+  await page.goto(server.url("/blank.html"));
+  await extension.serviceWorker.evaluate(
+    (origin) =>
+      chrome.storage.local.set({
+        compat_log: {
+          [origin]: {
+            kinds: { unhandled_blocked_fetch: 1 },
+            lastUpdated: Date.now(),
+            pathKinds: { manifest: 1 },
+            total: 1,
+            vectors: { fetch: 1 },
+          },
+        },
+      }),
+    server.origin
+  );
+  await page.bringToFront();
+  const tabId = await activeHttpTabId(extension.serviceWorker);
+  expect(typeof tabId).toBe("number");
+
+  const popupPage = await openPopupForTab(extension, tabId);
+
+  await expect(popupPage.locator("#recovery")).toHaveAttribute("data-state", "warning");
+  await expect(popupPage.locator("#recovery-title")).toHaveText(
+    "This site may be broken by Static"
+  );
+  await expect(popupPage.locator("#recovery-action")).toHaveText("Pause this site and reload");
+});
+
+test("popup recovery card offers resume when the site is paused", async ({ extension, server }) => {
+  const page = await extension.context.newPage();
+  await page.goto(server.url("/blank.html"));
+  await extension.serviceWorker.evaluate(
+    (origin) => chrome.storage.local.set({ disabled_origins: { [origin]: true } }),
+    server.origin
+  );
+  await page.bringToFront();
+  const tabId = await activeHttpTabId(extension.serviceWorker);
+  expect(typeof tabId).toBe("number");
+
+  const popupPage = await openPopupForTab(extension, tabId);
+
+  await expect(popupPage.locator("#recovery")).toHaveAttribute("data-state", "paused");
+  await expect(popupPage.locator("#recovery-title")).toHaveText("Static is paused here");
+  await expect(popupPage.locator("#recovery-action")).toHaveText("Turn protection back on");
+  await expect(popupPage.locator("#site-status-text")).toHaveText(
+    "Paused. This site can see installed extensions again."
+  );
+});
+
+test("pausing a site installs a DNR allow rule for that initiator and resume removes it", async ({
+  extension,
+}) => {
+  const origin = "https://shop.example";
+  const hostname = "shop.example";
+
+  await extension.serviceWorker.evaluate(
+    (targetOrigin) => chrome.storage.local.set({ disabled_origins: { [targetOrigin]: true } }),
+    origin
+  );
+
+  await expect
+    .poll(async () => {
+      const rules = await extension.serviceWorker.evaluate(() =>
+        chrome.declarativeNetRequest.getDynamicRules()
+      );
+      return rules.filter((rule) => rule.action && rule.action.type === "allow");
+    })
+    .toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          action: { type: "allow" },
+          condition: expect.objectContaining({
+            initiatorDomains: [hostname],
+          }),
+          priority: 1000,
+        }),
+      ])
+    );
+
+  await extension.serviceWorker.evaluate(() => chrome.storage.local.set({ disabled_origins: {} }));
+
+  await expect
+    .poll(async () => {
+      const rules = await extension.serviceWorker.evaluate(() =>
+        chrome.declarativeNetRequest.getDynamicRules()
+      );
+      return rules.filter(
+        (rule) =>
+          rule.action &&
+          rule.action.type === "allow" &&
+          rule.condition &&
+          Array.isArray(rule.condition.initiatorDomains) &&
+          rule.condition.initiatorDomains.includes(hostname)
+      );
+    })
+    .toEqual([]);
+});
+
+test("toolbar badge shows an attention mark for a fresh compatibility warning", async ({
+  extension,
+  server,
+}) => {
+  const page = await extension.context.newPage();
+  await page.goto(server.url("/blank.html"));
+  await page.bringToFront();
+
+  const tabId = await extension.serviceWorker.evaluate(async () => {
+    const [tab] = await chrome.tabs.query({ active: true, currentWindow: true });
+    return tab && tab.id;
+  });
+  expect(typeof tabId).toBe("number");
+
+  await extension.serviceWorker.evaluate(
+    (origin) =>
+      chrome.storage.local.set({
+        compat_log: {
+          [origin]: {
+            kinds: { unhandled_blocked_fetch: 1 },
+            lastUpdated: Date.now(),
+            pathKinds: { manifest: 1 },
+            total: 1,
+            vectors: { fetch: 1 },
+          },
+        },
+      }),
+    server.origin
+  );
+
+  await expect
+    .poll(() =>
+      extension.serviceWorker.evaluate((id) => chrome.action.getBadgeText({ tabId: id }), tabId)
+    )
+    .toBe("!");
+});
+
 test("does not warn when blocked fetch probes are handled by the page", async ({
   extension,
   server,
diff --git a/tests/network-header-spoof.spec.js b/tests/network-header-spoof.spec.js
index 91354cb..9ef05ec 100644
--- a/tests/network-header-spoof.spec.js
+++ b/tests/network-header-spoof.spec.js
@@ -101,7 +101,7 @@ test.describe("Network-layer header spoofing", () => {
     const rules = await extension.serviceWorker.evaluate(() =>
       chrome.declarativeNetRequest.getDynamicRules()
     );
-    const ourRules = rules.filter((r) => r.id >= 10_000);
+    const ourRules = rules.filter((r) => r.action && r.action.type === "modifyHeaders");
     expect(ourRules.length).toBeGreaterThanOrEqual(1);
 
     const ourRule = ourRules[0];
@@ -133,7 +133,7 @@ test.describe("Network-layer header spoofing", () => {
     let rules = await extension.serviceWorker.evaluate(() =>
       chrome.declarativeNetRequest.getDynamicRules()
     );
-    let ourRules = rules.filter((r) => r.id >= 10_000);
+    let ourRules = rules.filter((r) => r.action && r.action.type === "modifyHeaders");
     expect(ourRules.length).toBeGreaterThanOrEqual(1);
 
     // Turn off — should clean up all rules
@@ -142,7 +142,7 @@ test.describe("Network-layer header spoofing", () => {
     rules = await extension.serviceWorker.evaluate(() =>
       chrome.declarativeNetRequest.getDynamicRules()
     );
-    ourRules = rules.filter((r) => r.id >= 10_000);
+    ourRules = rules.filter((r) => r.action && r.action.type === "modifyHeaders");
     expect(ourRules.length).toBe(0);
   });